- openldap-technical - openldap.org

Match certificate subject with escaped characters using olcAuthzRegexp
by Windl, Ulrich 29 Apr '25

29 Apr '25

Hi! Trying to match the (som,e experimental) certificate subject to assign it LDAP users, I have some problems: Escaping of the subject seems to make regexp matching even harder. For example "CN = "uid=windl+email=u.windl(a)ukr.de", GN = Ulrich, SN = Windl" (as displayed by OpenSSL) is converted to "dn:sn=windl,givenName=ulrich,cn=uid\3Dwindl\2Bemail\3Du.windl@ukr.de" As I understand it uid=windl+email=u.windl(a)ukr.de<mailto:uid=windl+email=u.windl@ukr.de>" and email=u.windl(a)ukr.de<mailto:uid=windl+email=u.windl@ukr.de>+uid=windl" would be equivalent. So when I want to match just the uid part I could use "uid\\3D([^,]+)", but that would include "\2Bemail\3Du...". If I'd use uid\\3D([^,\]+)", instead, any escaped character inside the uid would terminate the match. How do the experts handle it? Use very simplistic CNs in certificates? Kind regards, Ulrich Windl

2 1

LDAP URI for slapcat -H
by Windl, Ulrich 29 Apr '25

29 Apr '25

Hi! After reading the manual of slapcat (for 2.5) it recommends using option -H and an URI instead of other obsolete options. So I tried it, but all I get is a usage message, even with "-v" and "-d9". Like this: # slapcat -d9 -H 'ldap:///?entryCSN?sub?(objectClass=*)' usage: slapcat [-v] [-d debuglevel] [-f configfile] [-F configdir] [-o <name>[=<value>]] [-c] [-g] [-n databasenumber | -b suffix] [-l ldiffile] [-a filter] [-s subtree] [-H url] However when I use # slapcat -H 'ldap://?entryCSN?dc=...,dc=de?sub?(objectClass=*)' I get output. The URI should be: scheme COLON SLASH SLASH [host [COLON port]] [SLASH dn [QUESTION [attributes] [QUESTION [scope] [QUESTION [filter] [QUESTION extensions]]]]] Do I have tomatoes on my eyes? Anyway I think slapcat could provide a better error message. Even an ltrace did not enlighten me: # ltrace slapcat -d9 -H 'ldap:///?entryCSN?sub?(objectClass=*)?' ber_set_option(0, 0x8002, 0x55ad287ce980, 0x7f7d383ff680) = 0 ldap_pvt_thread_initialize(0x7f7d3862c1c0, 0x55ad287ce980, 32, 0x55ad287ce980) = 0 ldap_create(0x55ad287d6a78, 0, 0, 0) = 0 ldap_pvt_tls_set_option(0x55ad56df1a50, 0x6006, 0x7ffd5d8d1f6c, 48) = 0 strrchr("slapcat", '/') = nil strcmp("slapcat", "slapd") = -1 strcmp("slapcat", "slapadd") = 2 strcmp("slapcat", "slapcat") = 0 ldap_set_option(0, 0x5001, 0x55ad287d12d0, 0x7ffd5d8d2158) = 0 getopt(4, 0x7ffd5d8d2158, "a:b:cd:f:F:gH:l:n:o:s:v") = 100 __ctype_b_loc() = 0x7f7d384c1d60 strtoul(0x7ffd5d8d36a9, 0x7ffd5d8d1bb0, 0, 0) = 9 getopt(4, 0x7ffd5d8d2158, "a:b:cd:f:F:gH:l:n:o:s:v") = 72 ldap_url_parse_ext(0x7ffd5d8d36ae, 0x7ffd5d8d1cb0, 5, 0) = 10 __fprintf_chk(0x7f7d384004e0, 1, 0x55ad2877a9f0, 0x55ad2875c4ddusage: slapcat [-v] [-d debuglevel] [-f configfile] [-F configdir] [-o <name>[=<value>]]) = 88 fputs(" [-c]\n\t[-g] [-n databasenumber |"..., 0x7f7d384004e0 [-c] [-g] [-n databasenumber | -b suffix] [-l ldiffile] [-a filter] [-s subtree] [-H url] ) = 1 exit(1 <no return ...> +++ exited (status 1) +++ Kind regards, Ulrich Windl

2 3

SBOM required!
by Sahil Sharma D 29 Apr '25

29 Apr '25

Hi team, Could you please provide the SBOM for OpenLDAP version REL_ENG_2_6_4 , or advise me on where I can locate the SBOMs for all versions? Regards, Sahil

2 1

using refint overlay for pwdPolicySubentry
by Windl, Ulrich 28 Apr '25

28 Apr '25

Hi! Some time ago U had replaced a password policy, and it was quite sme work to replace all occurrences. So I thought reint cul help. I configured: dn: olcOverlay={4}refint,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcRefintConfig olcRefintAttribute: member olcRefintAttribute: pwdPolicySubentry olcOverlay: {4}refint And I did apply a test rename of the policy used by many users. I got no error from the modify, but slapd said many times: slapd[28826]: ppolicy_get: policy subentry cn=pp-default-2024-05x,...,dc=de missing or invalid at 'pwdPolicySubentry', no policy will be applied! Shouldn't refint have fixed those entries, or is there something special about password policy? The other thing I had noticed was that the MMR consumer did not complain at all, and it even looks as if the update wasn't sent. Did anybody try this before? When I checked for the member attribute by deleting a user, all members containing that user were removed, however. I see "modifiersName: cn=Referential Integrity Overlay", too. Same is true for a rename. Kind regards, Ulrich Windl

1 0

ldap proxy
by fred750164＠gmail.com 28 Apr '25

28 Apr '25

I want to set up an architecture that allows a client to query an LDAP backend via an LDAP proxy. I want the query from the client to be unsecured, but the proxied communication between the LDAP proxy and the LDAP backend to be secured through mutual TLS authentication via SASL EXTERNAL. What configurations need to be implemented on the LDAP proxy and the LDAP backend? I saw in the slapd-ldap(5) documentation that the idassert-bind parameter could be used on the LDAP proxy for the TLS connection via SASL EXTERNAL, and in the slapd.conf(5) documentation that the authz-regexp parameter could be used on the LDAP backend to allow querying with a DN extracted from the certificate on this LDAP backend. However, I am struggling to set it up. I use openldap 2.4. slapd.conf on proxy server: [...] Database ldap suffix dc=test,dc=com uri ldaps://mytest.com:636 idassert-bind mode=self bindmethod=sasl saslmech=EXTERNAL tls_cert=/etc/openldap/certs/server.crt tls_key=/etc/openldap/certs/server.key tls_cacert=/etc/ssl/certs/ca-bundle.crt tls_cacertdir=/etc/ssl/certs tls_crlcheck=none tls_reqcert=allow [...] slapd.conf on backend server: [...] # Modules moduleload back_mdb moduleload authz-regexp # TLS TLSCACertificateFile /opt/openldap/etc/openldap/certs/ca-certificates.crt TLSCertificateFile /opt/openldap/etc/openldap/certs/backend.crt TLSCertificateKeyFile /opt/openldap/etc/openldap/certs/backend.key TLSCipherSuite HIGH TLSVerifyClient demand sasl-Host mytest.com sasl-realm EXTERNAL authz-regexp ".*" "cn=user1,dc=test,dc=com" [...] proxy: ldapsearch -H ldaps://mytest.com -b "dc=appli,dc=test,dc=com" -Y EXTERNAL -ZZ ldap_start_tls: Can't contact LDAP server (-1) backend: 67895427.2b4074ce 0x7f7e6bffe6c0 TLS: can't accept: error:0A0000C7:SSL routines::peer did not return a certificate. Any help would be appreciated.

7 40

changing password with otp active
by Stefan Kania 25 Apr '25

25 Apr '25

Hello to all When I activate the otp-overlay I can login with my userpassword and the 6 digit token. But how can I change the password with otp activ? Without otp I do "passwd" then giving the old password and then the new password twice and the password is changed With opt I have to give the old password+6-digit. If I only giving the password the server complains immediately that the password is wrong. When I'm giving the old password plus the 6-digit, the server accepts the password. Then I can give the new password twice, but then I'm getting the massage: Server-message: Old password not accepted. So how can an user change his password via commandline with otp active? Thanks Stefan

2 2

MDB monitoring: How many free pages actually?
by Windl, Ulrich 25 Apr '25

25 Apr '25

Hi, Considering this monitoring information, I wonder: olmMDBPagesMax: 12800 olmMDBPagesUsed: 9229 olmMDBPagesFree: 3810 Is the number of actual free pages 12800 - 9229 + 3810, i.e. "unallocated (12800 - 9229)" plus "usable" (3810)? How many free pages are needed before updates stop working? Kind regards, Ulrich Windl

2 1

core dump when using olcSpSessionlogSource
by Windl, Ulrich 24 Apr '25

24 Apr '25

Hi! Configuring delta-syncrepl, I tried olcSpSessionlogSource instead of olcSPSessionlog. After slapd war started, it dumped core like this: … Apr 24 11:25:41 v05 slapd[5030]: syncprov_db_open: starting syncprov for suffix cn=config Apr 24 11:25:41 v05 slapd[5030]: conn=-1 op=0 syncprov_findcsn: mode=FIND_MAXCSN csn= Apr 24 11:25:41 v05 slapd[5030]: syncprov_db_open: starting syncprov for suffix dc=sap,dc=klinik,dc=uni-regensburg,dc=de Apr 24 11:25:41 v05 slapd[5030]: slapd starting Apr 24 11:25:41 v05 start[5017]: Starting ldap-server Apr 24 11:25:41 v05 systemd[1]: Started OpenLDAP Server Daemon. Apr 24 11:25:41 v05 slapd[5030]: slap_get_csn: conn=1000 op=1 generated new csn=20250424092541.888430Z#000000#005#000000 manage=1 Apr 24 11:25:41 v05 slapd[5030]: slap_queue_csn: queueing 0x7fd1a01217d0 20250424092541.888430Z#000000#005#000000 Apr 24 11:25:41 v05 slapd[5030]: slap_graduate_commit_csn: removing 0x7fd1a01217d0 20250424092541.888430Z#000000#005#000000 Apr 24 11:25:41 v05 ldapmodify[5035]: DIGEST-MD5 common mech free Apr 24 11:25:41 v05 slapd[5030]: slap_get_csn: conn=1001 op=1 generated new csn=20250424092541.896113Z#000000#005#000000 manage=1 Apr 24 11:25:41 v05 slapd[5030]: slap_queue_csn: queueing 0x7fd1a0122df0 20250424092541.896113Z#000000#005#000000 Apr 24 11:25:41 v05 slapd[5030]: conn=1001 op=1 syncprov_checkpoint: running checkpoint Apr 24 11:25:41 v05 slapd[5030]: slap_graduate_commit_csn: removing 0x7fd1a0122df0 20250424092541.896113Z#000000#005#000000 Apr 24 11:25:41 v05 ldapmodify[5037]: DIGEST-MD5 common mech free Apr 24 11:25:41 v05 slapd[5030]: slap_get_csn: conn=1002 op=1 generated new csn=20250424092541.900818Z#000000#005#000000 manage=1 Apr 24 11:25:41 v05 slapd[5030]: slap_queue_csn: queueing 0x7fd1a0128240 20250424092541.900818Z#000000#005#000000 Apr 24 11:25:41 v05 slapd[5030]: slap_queue_csn: queueing 0x7fd1a012b820 20250424092541.900818Z#000000#005#000000 Apr 24 11:25:41 v05 slapd[5030]: slap_graduate_commit_csn: removing 0x7fd1a012b820 20250424092541.900818Z#000000#005#000000 Apr 24 11:25:41 v05 slapd[5030]: slap_graduate_commit_csn: removing 0x7fd1a0128240 20250424092541.900818Z#000000#005#000000 Apr 24 11:25:41 v05 ldapmodify[5039]: DIGEST-MD5 common mech free Apr 24 11:25:41 v05 slapd[5030]: slap_get_csn: conn=1003 op=1 generated new csn=20250424092541.920778Z#000000#005#000000 manage=1 Apr 24 11:25:41 v05 slapd[5030]: slap_queue_csn: queueing 0x7fd19c106d00 20250424092541.920778Z#000000#005#000000 Apr 24 11:25:41 v05 slapd[5030]: slap_queue_csn: queueing 0x7fd19c107760 20250424092541.920778Z#000000#005#000000 Apr 24 11:25:41 v05 slapd[5030]: slap_graduate_commit_csn: removing 0x7fd19c107760 20250424092541.920778Z#000000#005#000000 Apr 24 11:25:41 v05 slapd[5030]: slap_graduate_commit_csn: removing 0x7fd19c106d00 20250424092541.920778Z#000000#005#000000 Apr 24 11:25:41 v05 ldapmodify[5041]: DIGEST-MD5 common mech free Apr 24 11:25:41 v05 slapd[5030]: slap_get_csn: conn=1004 op=1 generated new csn=20250424092541.937140Z#000000#005#000000 manage=1 Apr 24 11:25:41 v05 slapd[5030]: slap_queue_csn: queueing 0x7fd19c10c9f0 20250424092541.937140Z#000000#005#000000 Apr 24 11:25:41 v05 slapd[5030]: slap_queue_csn: queueing 0x7fd19c11c110 20250424092541.937140Z#000000#005#000000 Apr 24 11:25:41 v05 slapd[5030]: slap_graduate_commit_csn: removing 0x7fd19c11c110 20250424092541.937140Z#000000#005#000000 Apr 24 11:25:41 v05 slapd[5030]: slap_graduate_commit_csn: removing 0x7fd19c10c9f0 20250424092541.937140Z#000000#005#000000 Apr 24 11:25:41 v05 ldapmodify[5043]: DIGEST-MD5 common mech free Apr 24 11:25:41 v05 slapd[5030]: slap_get_csn: conn=1005 op=1 generated new csn=20250424092541.989098Z#000000#005#000000 manage=1 Apr 24 11:25:41 v05 slapd[5030]: slap_queue_csn: queueing 0x7fd1a012b920 20250424092541.989098Z#000000#005#000000 Apr 24 11:25:41 v05 slapd[5030]: slap_queue_csn: queueing 0x7fd1a0107320 20250424092541.989098Z#000000#005#000000 Apr 24 11:25:41 v05 slapd[5030]: slap_graduate_commit_csn: removing 0x7fd1a0107320 20250424092541.989098Z#000000#005#000000 Apr 24 11:25:41 v05 slapd[5030]: slap_graduate_commit_csn: removing 0x7fd1a012b920 20250424092541.989098Z#000000#005#000000 Apr 24 11:25:41 v05 ldapmodify[5044]: DIGEST-MD5 common mech free Apr 24 11:25:42 v05 slapd[5030]: slap_get_csn: conn=1006 op=1 generated new csn=20250424092542.004124Z#000000#005#000000 manage=1 Apr 24 11:25:42 v05 slapd[5030]: slap_queue_csn: queueing 0x7fd1a01277f0 20250424092542.004124Z#000000#005#000000 Apr 24 11:25:42 v05 slapd[5030]: index objectClass 0x0004 Apr 24 11:25:42 v05 slapd[5030]: index entryCSN 0x0004 Apr 24 11:25:42 v05 slapd[5030]: index reqEnd 0x0004 Apr 24 11:25:42 v05 slapd[5030]: index reqResult 0x0004 Apr 24 11:25:42 v05 slapd[5030]: slap_queue_csn: queueing 0x7fd1a02376f0 20250424092542.004124Z#000000#005#000000 Apr 24 11:25:42 v05 slapd[5030]: slap_graduate_commit_csn: removing 0x7fd1a02376f0 20250424092542.004124Z#000000#005#000000 Apr 24 11:25:42 v05 slapd[5030]: slap_graduate_commit_csn: removing 0x7fd1a01277f0 20250424092542.004124Z#000000#005#000000 Apr 24 11:25:42 v05 ldapmodify[5046]: DIGEST-MD5 common mech free Apr 24 11:25:42 v05 slapd[5030]: slap_get_csn: conn=1007 op=1 generated new csn=20250424092542.020297Z#000000#005#000000 manage=1 Apr 24 11:25:42 v05 slapd[5030]: slap_queue_csn: queueing 0x7fd1a010a230 20250424092542.020297Z#000000#005#000000 Apr 24 11:25:42 v05 slapd[5030]: index objectClass 0x0004 Apr 24 11:25:42 v05 slapd[5030]: index entryCSN 0x0004 Apr 24 11:25:42 v05 slapd[5030]: index reqEnd 0x0004 Apr 24 11:25:42 v05 slapd[5030]: index reqResult 0x0004 Apr 24 11:25:42 v05 slapd[5030]: slap_queue_csn: queueing 0x7fd1a0117770 20250424092542.020297Z#000000#005#000000 Apr 24 11:25:42 v05 slapd[5030]: slap_graduate_commit_csn: removing 0x7fd1a0117770 20250424092542.020297Z#000000#005#000000 Apr 24 11:25:42 v05 slapd[5030]: slap_graduate_commit_csn: removing 0x7fd1a010a230 20250424092542.020297Z#000000#005#000000 Apr 24 11:25:42 v05 ldapmodify[5048]: DIGEST-MD5 common mech free Apr 24 11:25:42 v05 slapd[5030]: slap_get_csn: conn=1008 op=1 generated new csn=20250424092542.036954Z#000000#005#000000 manage=1 Apr 24 11:25:42 v05 slapd[5030]: slap_queue_csn: queueing 0x7fd1a0237570 20250424092542.036954Z#000000#005#000000 Apr 24 11:25:42 v05 slapd[5030]: syncprov_db_open: starting syncprov for suffix cn=changelog-0 Apr 24 11:25:42 v05 slapd[5030]: [71B blob data] Apr 24 11:25:42 v05 slapd[5030]: olcSpSessionlogSource: value #0: <olcSpSessionlogSource> failed startup (cn=changelog-0)! Apr 24 11:25:42 v05 systemd[1]: Started Process Core Dump (PID 5051/UID 0). Apr 24 11:25:42 v05 systemd-coredump[5052]: [🡕] Process 5030 (slapd) of user 1000 dumped core. Stack trace of thread 5034: #0 0x00007fd1b82a8dfc __pthread_kill_implementation (libc.so.6 + 0xa8dfc) #1 0x00007fd1b8257842 raise (libc.so.6 + 0x57842) #2 0x00007fd1b823f5cf abort (libc.so.6 + 0x3f5cf) #3 0x00007fd1b8240497 __libc_message.cold (libc.so.6 + 0x40497) #4 0x00007fd1b82b34b7 malloc_printerr (libc.so.6 + 0xb34b7) #5 0x00007fd1b82b5a69 _int_free (libc.so.6 + 0xb5a69) #6 0x00007fd1b82b81df free (libc.so.6 + 0xb81df) #7 0x00007fd1b8159bee n/a (syncprov.so + 0x3bee) #8 0x000056122f1a02ee overlay_destroy_one (slapd + 0xb82ee) #9 0x000056122f1156bd n/a (slapd + 0x2d6bd) #10 0x000056122f115fb0 n/a (slapd + 0x2dfb0) #11 0x000056122f19f533 overlay_op_walk (slapd + 0xb7533) #12 0x000056122f19f6be n/a (slapd + 0xb76be) #13 0x000056122f1319ad fe_op_add (slapd + 0x499ad) #14 0x000056122f1328d9 do_add (slapd + 0x4a8d9) #15 0x000056122f12b18f n/a (slapd + 0x4318f) #16 0x000056122f12b98d n/a (slapd + 0x4398d) #17 0x00007fd1b86bcda0 n/a (libldap-2.5.releng.so.0 + 0x48da0) #18 0x00007fd1b82a6f6c start_thread (libc.so.6 + 0xa6f6c) #19 0x00007fd1b832e338 __clone3 (libc.so.6 + 0x12e338) Stack trace of thread 5030: #0 0x00007fd1b82a3c1e __futex_abstimed_wait_common (libc.so.6 + 0xa3c1e) #1 0x00007fd1b82a8b83 __pthread_clockjoin_ex (libc.so.6 + 0xa8b83) #2 0x000056122f1281ca slapd_daemon (slapd + 0x401ca) #3 0x000056122f10b88e main (slapd + 0x2388e) #4 0x00007fd1b8240e6c __libc_start_call_main (libc.so.6 + 0x40e6c) #5 0x00007fd1b8240f35 __libc_start_main@@GLIBC_2.34 (libc.so.6 + 0x40f35) #6 0x000056122f10b90a _start (slapd + 0x2390a) Stack trace of thread 5038: #0 0x00007fd1b82a3c1e __futex_abstimed_wait_common (libc.so.6 + 0xa3c1e) #1 0x00007fd1b82a6548 pthread_cond_wait@@GLIBC_2.3.2 (libc.so.6 + 0xa6548) #2 0x00007fd1b86bce40 n/a (libldap-2.5.releng.so.0 + 0x48e40) #3 0x00007fd1b82a6f6c start_thread (libc.so.6 + 0xa6f6c) #4 0x00007fd1b832e338 __clone3 (libc.so.6 + 0x12e338) Stack trace of thread 5032: #0 0x00007fd1b832e796 epoll_wait (libc.so.6 + 0x12e796) #1 0x000056122f12507b n/a (slapd + 0x3d07b) #2 0x00007fd1b82a6f6c start_thread (libc.so.6 + 0xa6f6c) #3 0x00007fd1b832e338 __clone3 (libc.so.6 + 0x12e338) ELF object binary architecture: AMD x86-64 Apr 24 11:25:42 v05 ldapmodify[5050]: DIGEST-MD5 common mech free Apr 24 11:25:42 v05 systemd[1]: slapd.service: Main process exited, code=dumped, status=6/ABRT Apr 24 11:25:42 v05 systemd[1]: slapd.service: Failed with result 'core-dump'. Apr 24 11:25:42 v05 systemd[1]: systemd-coredump(a)1-5051-0.service: Deactivated successfully. Looks a bit like a bad free() to me. I was adding the syncprov overlay with the accesslog DB being defined, but the accesslog overlay to set “olcAccessLogDB: cn=changelog-0” wasn’t done yet. The changelog-0 database may have contained outdated entries. Kind regards, Ulrich Windl

1 2

Q: odd accesslog entry and unchanged attributes
by Windl, Ulrich 24 Apr '25

24 Apr '25

Hi! Debugging issues with my OpenLDAP configuration I inspected the changelog. One entry had some "odd" values (IMHO). Consider this example: dn: reqStart=20250423131324.000185Z,cn=audit objectClass: auditModify structuralObjectClass: auditModify reqStart: 20250423131324.000185Z reqEnd: 20250423131324.000188Z reqType: modify reqSession: 1024 reqAuthzID: cn=config reqDN: olcDatabase={4}mdb,cn=config reqResult: 0 reqMod: olcRootPW:= {SSHA256}REDACTED agNLQ== reqMod: entryCSN:= 20250423131324.377585Z#000000#005#000000 reqMod: modifiersName:= cn=config reqMod: modifyTimestamp:= 20250423131324Z reqOld: olcRootPW: REDACTED reqOld: entryCSN: 20250423131324.038419Z#000000#005#000000 reqOld: modifiersName: cn=config reqOld: modifyTimestamp: 20250423131324Z reqEntryUUID: 7b0b106c-b490-103f-8f46-3bae5e23549d entryUUID: 7b40af6a-b490-103f-8f7d-3bae5e23549d creatorsName: cn=audit createTimestamp: 20250423131324Z entryCSN: 20250423131324.377585Z#000000#005#000000 modifiersName: cn=audit modifyTimestamp: 20250423131324Z The change in entryCSN and modifyTimestamp are: OLD: 20250423131324.038419Z#000000#005#000000 NEW: 20250423131324.377585Z#000000#005#000000 OLD: 20250423131324Z NEW: 20250423131324Z So the change happened within the same second, and modifyTimestamp did not actually change. So the question is kind of philosophical: Are attibutes logged as changed when actually they did not change? This would apply to modifyTimestamp and modifyTimestamp in this case. Kind regards, Ulrich Windl

1 0

opt attribute oathHMACAlgorithm
by Stefan Kania 23 Apr '25

23 Apr '25

Hi to all, I would like to add the otp-attributes with the following LDIF: --------------- dn: ou=users,dc=example,dc=net changetype: modify add: objectClass objectClass: oathTOTPParams - add: oathOTPLength oathOTPLength: 6 - add: oathHMACAlgorithm oathHMACAlgorithm: 1.2.840.113549.2.11 - add: oathTOTPTimeStepPeriod oathTOTPTimeStepPeriod: 30 - add: oathTOTPTimeStepWindow oathTOTPTimeStepWindow: 3 --------------- But I'm getting: ----------- modifying entry "ou=users,dc=example,dc=net" ldap_modify: Invalid syntax (21) additional info: oathHMACAlgorithm: value #0 invalid per syntax ----------- If I switch to SHA1: ----------- oathHMACAlgorithm: 1.2.840.113549.2.7 ----------- it works. The manpage is telling me: ----------- oathHMACAlgorithm: <OID> The OID of the hash algorithm to use as defined in RFC 8018. Supported algorithms include SHA1, SHA224, SHA256, SHA384 and SHA512. ----------- and .11 is SHA512. Why is it not working? Do I have to give the OID in a different way? Stefan

3 4

slapcat compains "scheme not available" after using "olcPasswordHash: sha256"
by Windl, Ulrich 23 Apr '25

23 Apr '25

Hi! Using OpenLDAP 2.5 from SLES15 SP6 I added "olcPasswordHash: sha256" ("olcPasswordHash: {sha256}") to cn=config (I wanted to add it to the {-1}frontend database, but slapd refused. I was able to set {SHA256} RootPWs, but now when I try slapcat, I get an error saying: slapcat -n0 olcPasswordHash: value #0: <olcPasswordHash> scheme not available ({SSHA256}) olcPasswordHash: value #0: <olcPasswordHash> no valid hashes found config error processing cn=config: <olcPasswordHash> no valid hashes found slapcat: bad configuration file! For slapppasswd I can use option "-o module-load=pw-sha2", but slapcat does not have it: # slapcat -o module-load=pw-sha2 -n0 usage: slapcat [-v] [-d debuglevel] [-f configfile] [-F configdir] [-o <name>[=<value>]] [-c] [-g] [-n databasenumber | -b suffix] [-l ldiffile] [-a filter] [-s subtree] [-H url] Is it my error, or slapcat's? Regards, Ulrich

2 2

Adding syncprov overlay to cn=config seems to freeze the server
by Windl, Ulrich 22 Apr '25

22 Apr '25

Hi! I'm trying to script a reconfiguration of out OpenLDAP servers, also changing the replication details. After dropping the old syncrepl overlay, I tried to add a new one like this: dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig I deliberately did not add more specific attributes, because I wanted to add them later. However I forgot to set olcOverlay. The point is that both, ldapmodify and slapd become unresponsive using that LDIF, at least when provided as ldapmodify -Y EXTERNAL -H ldapi:/// <<LDIF ... LDIF Is this a bug? Seen in OpenLDAP 2.5 provided by SLES15 SP6. From a coredump I forced, I see that the threads are all waiting, using one of these: __pthread_clockjoin_ex pthread_cond_wait __pthread_clockjoin_ex Kind regards, Ulrich Windl

2 4

Search performance pretty bad when result from index > 1
by Norbert 17 Apr '25

17 Apr '25

Hi, Used version 2.5.19.1 (ltb) We have a LDAP with about 4.6 million entries and an indexed attribute which occurs around 3.9 million times. We typicall filter for that attribute with a specific value (eq). Which is typicall very fast and no problems. As soon as the same value used twice the execution time for that filter is becoming really slow even when additional criteria of the filter limits the result to exact 1 entry. Search time is at ~5% for single entry results compared to potential 2 entry results. Some more details how this was determined: 1) enable "stats" logging on production server for 5 minutes. 2) collect the slowest ~1200 from several thousand searches within the 5 minutes from the log 3) create a separate ldap server with exact same data and configuration (imported with slapadd) 4) use a script running locally on the extra server which executes the 1200 filters one after the other and measure complete execution time of script With production data I measure around 11s for the ~1200 searches. For all these searches one attribute in the filter could have 2 hits, but it is actually limited to 1 hit because of following filter "(&(objectClass=value)(almost_uniqe_attr=value)(another_attr=*))" Means searching with only "almost_uniqe_attr=value" as filter it would return 2 results, but objectClass and another_attr limit it to exact 1 entry. When I now remove the second entry from the ldap server for these exact ~1200 filters the script run time will be ~0.5s . If re-add those ~1200 entries the runtime will be around 5s (and with a complete recreate of the db it will be 11s again.) Limiting the search scope by using a more specific base dn for the search does not change anything in regards to the execution time. So the question is: 1) can I change anything on the server side to speed up the execution time of these searches? Regards, Norbert

3 8

openldap 2.5: core dump in slap_tool_update_ctxcsn_check of lsapmodify when deleting syncprov overlay
by Windl, Ulrich 16 Apr '25

16 Apr '25

Hi! I'm trying to batch-convert an openLDAP 2.4 MMR configuration to an configuration using openLDAP 2.5, also using MMR, but on different hosts (SLES15 SP6 on x86_64). When my script tried to drop the syncprov overlay, slapmodify dumps core in function slap_tool_update_ctxcsn_check, like this: kernel: slapmodify[24757]: segfault at 28 ip 000055d656ea7526 sp 00007ffe9e0875f0 error 4 in slapd[55d656dea000+149000] likely on CPU 1 (core 0, socket 2) kernel: Code: 48 33 0c 25 28 00 00 00 48 c7 c0 ff ff ff ff 0f 85 74 01 00 00 48 83 c4 28 5b 5d 41 5c 41 5d c3 0f 1f 40 00 49 89 fd 48 89 f3 <48> 8b 7e 28 48 8b 35 cf fa 09 00 e8 1a f5 f8 ff 48 85 c0... Dump of assembler code for function slap_tool_update_ctxcsn_check: 0x000055d656ea74d0 <+0>: push %r13 0x000055d656ea74d2 <+2>: push %r12 0x000055d656ea74d4 <+4>: push %rbp 0x000055d656ea74d5 <+5>: push %rbx 0x000055d656ea74d6 <+6>: sub $0x28,%rsp 0x000055d656ea74da <+10>: mov 0x9fdd3(%rip),%r8d # 0x55d656f472b4 <tool_globals+20> 0x000055d656ea74e1 <+17>: mov %fs:0x28,%rax 0x000055d656ea74ea <+26>: mov %rax,0x18(%rsp) 0x000055d656ea74ef <+31>: xor %eax,%eax 0x000055d656ea74f1 <+33>: test %r8d,%r8d 0x000055d656ea74f4 <+36>: jne 0x55d656ea7520 <slap_tool_update_ctxcsn_check+80> 0x000055d656ea74f6 <+38>: mov 0x18(%rsp),%rcx 0x000055d656ea74fb <+43>: xor %fs:0x28,%rcx 0x000055d656ea7504 <+52>: mov $0xffffffffffffffff,%rax 0x000055d656ea750b <+59>: jne 0x55d656ea7685 <slap_tool_update_ctxcsn_check+437> 0x000055d656ea7511 <+65>: add $0x28,%rsp 0x000055d656ea7515 <+69>: pop %rbx 0x000055d656ea7516 <+70>: pop %rbp 0x000055d656ea7517 <+71>: pop %r12 0x000055d656ea7519 <+73>: pop %r13 0x000055d656ea751b <+75>: ret 0x000055d656ea751c <+76>: nopl 0x0(%rax) 0x000055d656ea7520 <+80>: mov %rdi,%r13 0x000055d656ea7523 <+83>: mov %rsi,%rbx => 0x000055d656ea7526 <+86>: mov 0x28(%rsi),%rdi 0x000055d656ea752a <+90>: mov 0x9facf(%rip),%rsi # 0x55d656f47000 <slap_schema+192> 0x000055d656ea7531 <+97>: call 0x55d656e36a50 <attr_find> ... Slapmodify had been started with "slapmodify -F /etc/openldap/slapd.d -g -n0 -S 5 -w", and the input was: dn: olcOverlay= {0}syncprov, olcDatabase={0}config,cn=config changetype: delete The version I'm using was provided by SLES support as openldap2_5-2.5.18+31-150500.11.12.1.29527.34.PTF.1239787.x86_64 If I run slapmodify without "-w", no core dump happens. Kind regards, Ulrich Windl

2 1

Using olcAuthRegexpr with Kerberos principalname
by Stefan Kania 14 Apr '25

14 Apr '25

Hi all, I want to rewrite the gssapi user name after authentication using olcAuthzRegex, but I want to rewrite the krbPrincipalName. If a principal is getting a ticket and then test the authentication with "ldapwhoami" I see: uid=my-principal,cn=gssapi,cn=auth So now I want to rewrite the uid to: krbPrincipalName=my-principal@REALM,cn=REALM,cn=kerberos,dc=example,dc=net the real object name. My first try was olcAuthzRegexp: {0}uid=(.+),cn=gssapi,cn=auth krbPrincipalName=$1@REALM,cn=REALM,cn=kerberos,dc=example,dc=net That is working. Now "ldapwhoami" is showing krbPrincipalName=my-principal@REALM,cn=realm,cn=kerbers,dc=example,dc=net then I changed olcAuthzRegexp to uid=(.+),cn=gssapi,cn=auth ldap:///cn=kerberos,dc=example,dc=net??sub?(krbPrincipalName=$1@REALM) I also tried: (krbPrincipalName=$1) (krbPrincipalName=$1@REALM,cn=REALM,cn=kerberos,dc=example,dc=net) but non of the filters is working. How do I have to configure the filter to rewrite the krbPrincipalName with in the search? Stefan

2 2

Usage of slapo-constraint to ensure existence of object
by Adrian Nöthlich 14 Apr '25

14 Apr '25

Hello all, we want to ensure that all entries added to the member and manager attributes are valid DNs and point to existing objects in our LDAP. We had the refint overlay do this on version 2.2 but as it seems 2.3 removed this undocumented feature. We lately moved to 2.5 and have issues with faulty entries. When I tried to configure the overlay with: olcConstraintAttribute: member uri ldap:///dc=example,dc=com?dn?sub?(objectClass=*) or olcConstraintAttribute: member uri ldap:///dc=example,dc=com??sub?(objectClass=*) or both URIs with an actual objectClass specified, my slapd (2.5.19) crashes on the URI verification step as it seems. Is my usage of the overlay itself correct (including the URI) or is there a better way to ensure the existence of an referenced object? Thanks a lot! Best, Adrian

2 2

Message "slapd[2734]: config error processing olcDatabase={0}config,cn=config: <olcMultiProvider> database is not a shadow"
by Windl, Ulrich 09 Apr '25

09 Apr '25

Hi! While setting up an OpenLDAP-2.5-based MMR configuration I had set up the master node, then dumped the config database, copied the LDIF to the other node. However when starting slapd, it failed with the message slapd[2734]: config error processing olcDatabase={0}config,cn=config: <olcMultiProvider> database is not a shadow See also https://stackoverflow.com/q/6792212/6607497 The context of olcMultiProvider is: dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config ... olcMultiProvider: TRUE On the first node I had updated the config using this LDIF: dn: olcDatabase=${db},cn=config changetype: modify delete: olcMirrorMode olcMirrorMode: TRUE - add: olcMultiProvider olcMultiProvider: TRUE So I don't understand why this won't work on the second node. Specifically I can restart the first node without an issue. The only difference is that the primary node has a patch against crashing on an invalid olcAuthzRegexp (I had reported). Well can anybody explain what this message means? Update: Reading https://www.openldap.com/lists/openldap-technical/201807/msg00051.html ("Do you have a unique olcServerID set in cn=config for both masters")I realized that I forgot to specify "-S SID" for slapadd. Unfortunately even after using option -S, the error message remains the same. Kind regards, Ulrich Windl

2 2

Q: "olcDatabase: {1}mdb" from slapcat: why "{1}"?
by Windl, Ulrich 03 Apr '25

03 Apr '25

I have an amost philosophical question about LDIF and OenLDAP: Considering dn: olcDatabase={1}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb # ... I wonder why olcDatabase needs the "{1}" when olcDatabase is a single-valued attribute. I understand that "olcDatabase={1}mdb" is needed for ordering the databases within cn=config, But why is the "{1}" repeated for the actual attribute? When I tried to remove it, I saw that after a slapcat it's there again. Kind regards, Ulrich

2 6

Re: [EXT] Re: Re: Re: accesslog with delta syncrepl: Why wouldn't contebnt be synced?
by Ondřej Kuzník 31 Mar '25

31 Mar '25

On Mon, Mar 31, 2025 at 06:31:30AM +0000, Windl, Ulrich wrote: > Ondřej, > > I must admit that I loaded the same LDIF using -w on both servers > (whenever the automatic sync would not work, or the server would not > start). However the LDIFs should have contained some entryCSN for each > entry, and if I had edited an entry, incremented the entryCSN "a bit". > In my understanding the contextCSN would be adjusted to be the latest > entryCSN, right? Hi Ulrich, `-w` will replace all CSNs from the LDIF with freshly generated ones, that's why I say you should only do that on a manual reload on *one* replica and then use their DB to reload everyone else with. You are rewriting the whole DB from scratch after all. > Still I'm surprised that some "Odd" CSN would cause a huge memory > allocation that causes the server to crash. Until it happens again, > I'll ignore it for now (as I have much more work to do) I'm not saying for sure it's causing it, very likely a bug but then not much we can do looking at that stack trace. Unless you provide concrete steps to reproduce the issue (preferable), usually logs + a full backtrace with debugging info available is the minimum we'd need to start investigating a crash... What I was saying is that what you did was very likely to cause a painful desync later, especially with cn=config and if you're likely to do this sort of thing again and again. Regards, -- Ondřej Kuzník Senior Software Engineer Symas Corporation http://www.symas.com Packaged, certified, and supported LDAP solutions powered by OpenLDAP

1 0

Syncrepl using certificate to authenticate, but certifivcated expired
by Windl, Ulrich 31 Mar '25

31 Mar '25

Hi! In my test environment (using openLDAP 2.5) the certificate used to authenticate syncrepl expired Friday night, so when returning on Monday, I was expe4cting error from syncrepl, but I did not see any. I suspect that this is due to persistent connections are being used. I see a big danger there: The operator may not notice that the certificated had expired as syncrepl still works (it seems, but there were no actual changes over the weekend)). However (as I understand it), syncrepl will start to fail once the network causes the persistent connection to fail, or a server is restarted. So I wonder: Is there a way to recognize expiration of the certificate? Maybe by limiting the life-time of a persistent connection, or slapd/syncrepl doing explicit checks on the certificate? Kind regards, Ulrich Windl

2 1

Can give me some books about openldap?
by anlex N 30 Mar '25

30 Mar '25

I have searched amazon.com and google.com. There are only a few books about openldap. I also review openldap official docs step by step. but I can not master openldap. if you have no books. What websites do you recommend to learn openldap?

4 8

LDIF for moddn: "ldap_rename: Server is unwilling to perform (53)"
by Windl, Ulrich 28 Mar '25

28 Mar '25

Hi! Reading https://kb.symas.com/en_US/configuration/configure-delta-syncrepl I realized that my syncprov is on the original database, not on the accesslog. So I tried to fix it my "moving" the overlay like this: dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config changetype: moddn newrdn: olcOverlay={0}syncprov deleteoldrdn: 1 newsuperior: olcDatabase={3}mdb,cn=config However as I got "ldap_rename: Server is unwilling to perform (53)" I wonder: Is my LDIF wrong, or is it an implementation restriction? Do I have to restart the server with a fresh config? Kind regards, Ulrich Windl

6 10

accesslog with delta syncrepl: Why wouldn't contebnt be synced?
by Windl, Ulrich 27 Mar '25

27 Mar '25

Hi! I had just asked https://serverfault.com/q/1177576/407952, but I'll summarize here: I think I configured delta-syncrepl for a MMR correctly using OpenLDAP >= 2.5.18 (cn=config also synced). However when I offlined one node and updated the main DIT via slapadd, the other node wouldn't update its DIT when the offlined node is online again. I wonder whether I have to empty or delete the corresponding accesslog, or is there some other step to perform? Is delta syncrepl looking at the accesslog only to detect changes? The syncrepl configs look like this for the DIT: olcSyncrepl: {0}rid=115 provider="ldap://server5/\ " searchbase="dc=..." type=refreshAndPersist \ retry="60 5 300 5 1800 +" logbase="cn=changelog-1" logfilter="(&(objectClass=au\ ditWriteObject)(reqResult=0))" schemachecking=on syncdata=accesslog starttls=cr\ itical tls_reqcert=demand bindmethod=sasl saslmech=external tls_cert="/etc/ssl/\ servercerts/syncrepl.pem" tls_key="/etc/ssl/serverkeys/syncrepl.key" tls_cacert\ ="/etc/ssl/servercerts/ CA-bundle.pem" olcSyncrepl: {1}rid=116 provider="ldap://server6/\ " searchbase="dc=..." type=refreshAndPersist \ retry="60 5 300 5 1800 +" logbase="cn=changelog-1" logfilter="(&(objectClass=au\ ditWriteObject)(reqResult=0))" schemachecking=on syncdata=accesslog starttls=cr\ itical tls_reqcert=demand bindmethod=sasl saslmech=external tls_cert="/etc/ssl/\ servercerts/syncrepl.pem" tls_key="/etc/ssl/serverkeys/syncrepl.key" tls_cacert\ ="/etc/ssl/servercerts/ CA-bundle.pem" Kind regards, Ulrich Windl

2 5

Upgrade from 2.4.45 to 2.4.49 and beyond
by justin＠1707.io 27 Mar '25

27 Mar '25

Hey Everyone, I've inherited some rather unmaintained servers as part of a new job and I'm looking to get them all up to date. We have a server for auth for satellite services that uses slapd/openLDAP. It's on a rather old version, and I'm wanting to upgrade it. I would like to see if anyone has advice on how to upgrade from Ubuntu 18.04.6 with the current 2.4.45 slapd/OpenLDAP to Ubuntu 24.04. I've looked around to try and find guides that show upgrades notes between versions but haven't found anything relevant. All advice appreciated! Regards, Justin

3 2

Notes on https://kb.symas.com/en_US/configuration/configure-delta-syncrepl
by Windl, Ulrich 24 Mar '25

24 Mar '25

Hi! Reading https://kb.symas.com/en_US/configuration/configure-delta-syncrepl I found some issues: 1. In "Chaining Overlay" there is a an extra "i" in "dn: olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config i" 2. The syncrepl for "Multi-Master Replication (MMR)" still uses "mirrormode" 3. "Syncrepl" for MMR and cn=config is formatted badly (compared to slapd.conf version) Also for MMR there is a syncprov defined for the database to sync and the accesslog for that database. Why is syncprov for accesslog needed? Kind regards, Ulrich Windl

2 2

Overlay for alternate authentication
by BuzzSaw Code 20 Mar '25

20 Mar '25

We have an existing set of RHEL8 servers running the 2.4.x version of OpenLDAP - we can't upgrade to the latest version due to other dependencies. I'm trying to solve a problem where we want to use our 2FA authentication (which is OTP based on RADIUS) with some devices and applications that don't support RADIUS at all, but they *do* support LDAP authentication. I've read about using the SASL, but since that requires replacing the userPassword attribute for each user it won't work as I have to do this without breaking straight username/password binds for users. I looked into using overlays to create a new OU of users that was a translucent overlay of the existing ou=People (something like ou=rPeople), but searching this list archive and others says that won't work as I can't overlay/rewrite the userPassword attribute ? Is that correct? I'm trying to avoid duplicating the entire directory to new servers or even duplicating the existing ou=People structure just to create a new 'userPassword' attribute that can be used for SASL.

5 4

Feature Requests; where to go? (diff-friendly slapcat/ldapsearch)
by Windl, Ulrich 20 Mar '25

20 Mar '25

Hi! I had an idea for a new feature of slapcat (maybe ldapsearch, too), but I don't know where to file such. So I'm presenting the idea here: "Diff-friendly output format" The order of LDAP attributes is not determined, so after a change to an entry the order of attributes may vary. If you diff the older with the current output, there are more differences than actually there were changes. For example consider this diff (partial output): +entryCSN: 20250319115404.360112Z#000000#005#000000 +modifiersName: cn=config +modifyTimestamp: 20250319115404Z contextCSN: 20130722065709.189194Z#000000#000#000000 contextCSN: 20241204070658.632888Z#000000#001#000000 contextCSN: 20200721123717.002866Z#000000#002#000000 contextCSN: 20181031083258.073732Z#000000#003#000000 -contextCSN: 20250319114038.822575Z#000000#005#000000 +contextCSN: 20250319140809.186543Z#000000#005#000000 contextCSN: 20250227092006.790591Z#000000#006#000000 -entryCSN: 20250319115404.360112Z#000000#005#000000 -modifiersName: cn=config -modifyTimestamp: 20250319115404Z The modifiersName did not change, but its position had moved in output. In a diff-friendly format the position would not change. Obviously that could be done by sorting the output by attribute names (which would also help to locate a specific attribute), but it would have performance impacts, obviously. Another related option is attributes with a list of sub-attributes (name-value pairs), like syncrepl: In standard format the lines are wrapped, and with "-o ldif-wrap=no" you get one long line. For diff-friendliness may idea was to optionally wrap such name-value pairs after each pair, and if a single one exceeds the standard lengh, it would be wrapped still. So the idea could be like this: Use option -D for diff-friendly output format (sorting of attributes), and when doubled, also enable wrapping of name-value pairs. With "-o ldif-wrap=no" given also, single name-value pairs would end up on a separate line, but such lines wouldn't be wrapped themselves. Alternatively one could use "-odiff-friendly=X" where X is 1 or 2. (In case of contextCSN one could even think of X=3 activating sort of the same attribute by attribute value) Do you think it's a useful enhancement? I must admit I played with the idea implementing it myself, but after having had a look at the source of slapcat, it looked more low-level than I had expected, so I had no idea where to start... Kind regards, Ulrich Windl

3 2

Q: DN of a user certificate
by Windl, Ulrich 19 Mar '25

19 Mar '25

Hi! I'm playing with mapping the DN of user certificates to (the DN of) LDAP users. Maybe I'm missing something, but it seems openLDAP appends the certificate DN to the LDAP context for authentication. That way the names can get really long, just as the olcAuthzRegexp will. So can anybody give a real-life example which DN to use for the user certificates? I mean certificate DN, LDAP user context and olcAuthzRegexp. Kind regards, Ulrich Windl

2 1

Q: Using SASL EXTERNAL with certificates for syncrepl
by Windl, Ulrich 19 Mar '25

19 Mar '25

Hi! I'm trying to convert out rencreplc configurtation using plain authentication over TLS to external authentication using a user certificate. It almost works, but slapd is reporting "connection_read(11): TLS accept failure error=-1 id=1002, closing" and "conn=1002 fd=11 closed (TLS negotiation failure)" while I can connect using the certificate and peer with openssl s_client Openssl reports: ... Requested Signature Algorithms: ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:Ed25519:Ed448:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA512:ECDSA+SHA224:ECDSA+SHA1:RSA+SHA224:RSA+SHA1 Shared Requested Signature Algorithms: ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:Ed25519:Ed448:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA512 Peer signing digest: SHA256 Peer signature type: RSA-PSS Server Temp Key: X25519, 253 bits --- SSL handshake has read 20974 bytes and written 5070 bytes Verification: OK --- New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384 Server public key is 2400 bit This TLS version forbids renegotiation. Compression: NONE Expansion: NONE No ALPN negotiated Early data was not sent Verify return code: 0 (ok) ... Somehow I suspect that the certificate being a user certificate (DN mapped to a user entry) is not acceptable in syncrepl's tls_cert; can anybody confirm? The problem is that I'd like to trust a user certificate more than a host certificate for replication. And if I'd use a host certificate, how could I authenticate the user being used to get the changes? I looked a lot around using popular search engines, but could not find a useful example that is complete enough. Let me remark at this point that the description of tls_reqsan is quite poor in {SLAPD-CONFIG(5); it was not obvious to me that i9s is about "Subject Alternate Name". The other thing I noticed was a capitalized "Binding" in "...to establish a TLS session before Binding to the provider." (also in SLAPD-CONFIG(5)) Kind regards, Ulrich Windl

2 2

accesslog seemingly needs a lot of space
by Windl, Ulrich 19 Mar '25

19 Mar '25

Hi! Trying to convert my syncrepl configuration to a delta syncrepl configuration, the slave runs out of accesslog space during initial sync. For the main database about 30MB should be enough, but I configured 50MB, also for the accesslog files. It seems sync continues even if accesslog periodically complains like this: slapd[13951]: => mdb_idl_insert_keys: c_put id failed: MDB_MAP_FULL: Environment mapsize limit reached (-30792) slapd[13951]: conn=-1 op=0 accesslog_response: got result 0x50 adding log entry reqStart=20250314110032.000187Z,cn=changelog-1 From stat I guess that accesslog needs at least three times as much space as the main database does: # stat /var/lib/ldap/data.mdb /var/lib/ldap/changelog-1/data.mdb File: /var/lib/ldap/data.mdb Size: 22888448 Blocks: 44704 IO Block: 4096 regular file Device: 33h/51d Inode: 259467 Links: 1 Access: (0600/-rw-------) Uid: ( 76/ ldap) Gid: ( 70/ ldap) Access: 2025-03-14 11:57:46.303713632 +0100 Modify: 2025-03-14 12:01:08.417328586 +0100 Change: 2025-03-14 12:01:08.417328586 +0100 Birth: 2025-03-14 11:57:46.303713632 +0100 File: /var/lib/ldap/changelog-1/data.mdb Size: 52424704 Blocks: 102392 IO Block: 4096 regular file Device: 33h/51d Inode: 259471 Links: 1 Access: (0600/-rw-------) Uid: ( 76/ ldap) Gid: ( 70/ ldap) Access: 2025-03-14 11:57:46.323713395 +0100 Modify: 2025-03-14 12:01:08.425328492 +0100 Change: 2025-03-14 12:01:08.425328492 +0100 Birth: 2025-03-14 11:57:46.323713395 +0100 Shouldn't (assuming the sync happens entry-by-entry) the accesslog have about the same size as the main database after initial sync (when all databases were empty)? When setting the size of the accesslog database to twice the size of the database it succeeded which stats like this: # stat /var/lib/ldap/data.mdb /var/lib/ldap/changelog-1/data.mdb File: /var/lib/ldap/data.mdb Size: 22888448 Blocks: 44704 IO Block: 4096 regular file Device: 33h/51d Inode: 259514 Links: 1 Access: (0600/-rw-------) Uid: ( 76/ ldap) Gid: ( 70/ ldap) Access: 2025-03-14 12:39:01.278545521 +0100 Modify: 2025-03-14 12:45:03.558274733 +0100 Change: 2025-03-14 12:45:03.558274733 +0100 Birth: 2025-03-14 12:39:01.278545521 +0100 File: /var/lib/ldap/changelog-1/data.mdb Size: 89657344 Blocks: 175112 IO Block: 4096 regular file Device: 33h/51d Inode: 259518 Links: 1 Access: (0600/-rw-------) Uid: ( 76/ ldap) Gid: ( 70/ ldap) Access: 2025-03-14 12:39:01.298545286 +0100 Modify: 2025-03-14 12:45:03.566274639 +0100 Change: 2025-03-14 12:45:03.566274639 +0100 Birth: 2025-03-14 12:39:01.298545286 +0100 So the blocks in the accesslog are roughly four times (3.91 ) as much as in the original database. Is there any doc making statements about the proportion? (I'm a fan of "small is beautiful" instead of "bigger is better") Kind regards, Ulrich Windl

3 8

invalid olcAuthzRegexp crashed openLDAP server in SLES15 SP6
by Windl, Ulrich 17 Mar '25

17 Mar '25

Hi! At work I have to connect to our SLES servers via Windows RDP and a Windows server. Unfortunately RDP is not working reliably, and it sometimes misses key presses, and at other times it duplicates them. That way I ended up adding an olcAuthzRegexp that lacked a backspace. Unfrtunately when trying to ldapmodify the server I just got: modifying entry "cn=config" ldap_result: Can't contact LDAP server (-1) the regex in question is: olcAuthzRegexp: {3} "^dn:dnQualifier=uid\3D(^,)\\2Cou\\3Dpeople\\2Cdc\\3DXXX \\2Cdc\\3Dde$" "dn: uid=$1,ou=people,dc=XXX=de" As it turned out the server dumped core (100% reproducible). I know the regex is bad, but maybe it shouldn’t kill the server. The server is SUSE’s version that corresponds to some 2.5.x with patches. Anyway the backtrace is: Mar 17 14:36:23 v05 slapd[15911]: conn=1000 op=1 syncprov_matchops: recording uuid for dn=cn=config on opc=0x7fcfe0000d58 Mar 17 14:36:23 v05 slapd[15911]: slap_get_csn: conn=1000 op=1 generated new csn=20250317133623.651964Z#000000#005#000000 manage=1 Mar 17 14:36:23 v05 slapd[15911]: slap_queue_csn: queueing 0x7fcfe0106c70 20250317133623.651964Z#000000#005#000000 Mar 17 14:36:23 v05 kernel: slapd[15919]: segfault at 7fc81ceea633 ip 00007fcff658553e sp 00007fcfe9ff4e40 error 4 in libldap-2.5.releng.so.0.1.13[7fcff653b000+5c000] likely on CPU 1 (core 0, socket 2) Mar 17 14:36:23 v05 kernel: Code: 7f 08 4d 85 ff 75 9e 48 83 c4 18 b8 fa ff ff ff 5b 5d 41 5c 41 5d 41 5e 41 5f c3 90 48 85 ff 74 3b 41 54 55 31 ed 53 48 89 fb <48> 8b 7f 08 49 89 f4 48 85 ff 75 3e 48 8b 7b 10 48 85 ff 75 25 4d … Mar 17 14:36:23 v05 systemd[1]: Started Process Core Dump (PID 15922/UID 0). Mar 17 14:36:23 v05 systemd-coredump[15923]: [🡕] Process 15911 (slapd) of user 1000 dumped core. Stack trace of thread 15919: #0 0x00007fcff658553e ldap_avl_free (libldap-2.5.releng.so.0 + 0x4a53e) #1 0x0000555fb6ca9b42 rewrite_info_delete (slapd + 0xd6b42) #2 0x0000555fb6c64bae slap_sasl_regexp_config (slapd + 0x91bae) #3 0x0000555fb6c03a09 n/a (slapd + 0x30a09) #4 0x0000555fb6c091d3 config_set_vals (slapd + 0x361d3) #5 0x0000555fb6c0a14f config_parse_add (slapd + 0x3714f) #6 0x0000555fb6bfcdcc n/a (slapd + 0x29dcc) #7 0x0000555fb6bfdc96 n/a (slapd + 0x2ac96) #8 0x0000555fb6c8a523 overlay_op_walk (slapd + 0xb7523) #9 0x0000555fb6c8a6ae n/a (slapd + 0xb76ae) #10 0x0000555fb6c2dbd2 fe_op_modify (slapd + 0x5abd2) #11 0x0000555fb6c2f941 do_modify (slapd + 0x5c941) #12 0x0000555fb6c1618f n/a (slapd + 0x4318f) #13 0x0000555fb6c1698d n/a (slapd + 0x4398d) #14 0x00007fcff6583da0 n/a (libldap-2.5.releng.so.0 + 0x48da0) #15 0x00007fcff62a758c start_thread (libc.so.6 + 0xa758c) #16 0x00007fcff632ea28 __clone3 (libc.so.6 + 0x12ea28) Stack trace of thread 15915: #0 0x00007fcff62a3c4e __futex_abstimed_wait_common (libc.so.6 + 0xa3c4e) #1 0x00007fcff62a6890 pthread_cond_wait@@GLIBC_2.3.2 (libc.so.6 + 0xa6890) #2 0x00007fcff6583e40 n/a (libldap-2.5.releng.so.0 + 0x48e40) #3 0x00007fcff62a758c start_thread (libc.so.6 + 0xa758c) #4 0x00007fcff632ea28 __clone3 (libc.so.6 + 0x12ea28) Stack trace of thread 15917: #0 0x00007fcff62a3c4e __futex_abstimed_wait_common (libc.so.6 + 0xa3c4e) #1 0x00007fcff62a6890 pthread_cond_wait@@GLIBC_2.3.2 (libc.so.6 + 0xa6890) #2 0x00007fcff6583e40 n/a (libldap-2.5.releng.so.0 + 0x48e40) #3 0x00007fcff62a758c start_thread (libc.so.6 + 0xa758c) #4 0x00007fcff632ea28 __clone3 (libc.so.6 + 0x12ea28) Stack trace of thread 15911: #0 0x00007fcff62a3c4e __futex_abstimed_wait_common (libc.so.6 + 0xa3c4e) #1 0x00007fcff62a91a3 __pthread_clockjoin_ex (libc.so.6 + 0xa91a3) #2 0x0000555fb6c131ca slapd_daemon (slapd + 0x401ca) #3 0x0000555fb6bf688e main (slapd + 0x2388e) #4 0x00007fcff6240e6c __libc_start_call_main (libc.so.6 + 0x40e6c) #5 0x00007fcff6240f35 __libc_start_main@@GLIBC_2.34 (libc.so.6 + 0x40f35) #6 0x0000555fb6bf690a _start (slapd + 0x2390a) Stack trace of thread 15913: #0 0x00007fcff632ee86 epoll_wait (libc.so.6 + 0x12ee86) #1 0x0000555fb6c1007b n/a (slapd + 0x3d07b) #2 0x00007fcff62a758c start_thread (libc.so.6 + 0xa758c) #3 0x00007fcff632ea28 __clone3 (libc.so.6 + 0x12ea28) Stack trace of thread 15918: #0 0x00007fcff62a3c4e __futex_abstimed_wait_common (libc.so.6 + 0xa3c4e) #1 0x00007fcff62a6890 pthread_cond_wait@@GLIBC_2.3.2 (libc.so.6 + 0xa6890) #2 0x00007fcff6583e40 n/a (libldap-2.5.releng.so.0 + 0x48e40) #3 0x00007fcff62a758c start_thread (libc.so.6 + 0xa758c) #4 0x00007fcff632ea28 __clone3 (libc.so.6 + 0x12ea28) Stack trace of thread 15914: #0 0x00007fcff62a3c4e __futex_abstimed_wait_common (libc.so.6 + 0xa3c4e) #1 0x00007fcff62a6890 pthread_cond_wait@@GLIBC_2.3.2 (libc.so.6 + 0xa6890) #2 0x00007fcff6583e40 n/a (libldap-2.5.releng.so.0 + 0x48e40) #3 0x00007fcff62a758c start_thread (libc.so.6 + 0xa758c) #4 0x00007fcff632ea28 __clone3 (libc.so.6 + 0x12ea28) ELF object binary architecture: AMD x86-64 Mar 17 14:36:23 v05 ldapmodify[15921]: DIGEST-MD5 common mech free Mar 17 14:36:23 v05 systemd[1]: slapd.service: Main process exited, code=dumped, status=11/SEGV Mar 17 14:36:23 v05 systemd[1]: slapd.service: Failed with result 'core-dump'. Mar 17 14:36:23 v05 systemd[1]: systemd-coredump(a)3-15922-0.service: Deactivated successfully. Kind regards, Ulrich Windl

2 1

Trying to set 'olcPasswordHash' I get "ldap_modify: Object class violation (65) additional info: attribute 'olcPasswordHash' not allowed"
by Windl, Ulrich 17 Mar '25

17 Mar '25

Hi! After having loaded pw-sha2 in oOpenmLDAp 2.5, I tried to set a new default hashing schema, but I fail to do so using dn: olcDatabase={-1}frontend,cn=config changetype: modify add: olcPasswordHash olcPasswordHash: {SSHA256} olcPasswordHash: {SSHA} ---- modifying entry "olcDatabase={-1}frontend,cn=config" ldap_modify: Object class violation (65) additional info: attribute 'olcPasswordHash' not allowed Before I had tried "replace" instead of "add", and I tried to place both values in one line as suggested by slapd-config: olcPasswordHash: <hash> [<hash>...] This option configures one or more hashes to be used in generation of user passwords stored in the userPassword attribute during processing of LDAP Password Modify Extended Operations (RFC 3062). The <hash> must be one of {SSHA}, {SHA}, {SMD5}, {MD5}, {CRYPT}, and {CLEARTEXT}. The default is {SSHA}. The manual page also states: This setting is only allowed in the frontend entry. I'm running out of ideas. Kind regards, Ulrich Windl

3 11

Understanding sync log for delta syncrepl
by Windl, Ulrich 17 Mar '25

17 Mar '25

Hi! Most likely I misconfigured the accesslog databases used for delta syncrepl (I'm still working on it), but I have some trouble understanding the logs created. I have two identical servers (SIDs 5 and 6) that also have an identical cn=config that is to be synced as well) I created two accesslog databases, one for cn=config, and one for the main database. For SDID=5 I see messages like: Mar 14 15:17:39 v05 slapd[26377]: do_syncrep1: rid=006 starting refresh (sending cookie=rid=006,sid=005,csn=20250314000000.000000Z#000000#000#000000;20250314000000.000000Z#000000#001#000000;20200721123717.002866Z#000000#002#000000;20181031083258.073732Z#000000#003#000000;20250314000002.000000Z#000000#005#000000;20250227092006.790591Z#000000#006#000000) Mar 14 15:17:39 v05 slapd[26377]: do_syncrep2: rid=006 LDAP_RES_SEARCH_RESULT Mar 14 15:17:39 v05 slapd[26377]: do_syncrepl: rid=006 rc -101 retrying Mar 14 15:17:39 v05 slapd[26377]: do_syncrep1: rid=006 starting refresh (sending cookie=rid=006,sid=005,csn=20130719093756.074776Z#000000#000#000000;20250217105250.345944Z#000000#001#000000;20250218171739.629994Z#000000#002#000000;20250217065706.238392Z#000000#003#000000;20250227092327.859231Z#000000#005#000000;20250227092348.803001Z#000000#006#000000) Mar 14 15:17:39 v05 slapd[26377]: do_syncrep2: rid=006 got search entry without Sync State control (reqStart=20250314114001.000003Z,cn=changelog-1) Mar 14 15:17:39 v05 slapd[26377]: do_syncrepl: rid=006 rc -1 retrying For the same time interval I see for SID=6: Mar 14 15:17:26 v06 slapd[14537]: do_syncrep1: rid=005 starting refresh (sending cookie=rid=005,sid=006,csn=20130719093756.074776Z#000000#000#000000;20250217105250.345944Z#000000#001#000000;20250218171739.629994Z#000000#002#000000;20250217065706.238392Z#000000#003#000000;20250227092327.859231Z#000000#005#000000;20250227092348.803001Z#000000#006#000000) Mar 14 15:17:26 v06 slapd[14537]: do_syncrep2: rid=005 LDAP_RES_SEARCH_RESULT Mar 14 15:17:26 v06 slapd[14537]: do_syncrepl: rid=005 rc -101 retrying Mar 14 15:17:26 v06 slapd[14537]: do_syncrep1: rid=005 starting refresh (sending cookie=rid=005,sid=006,csn=20250314000000.000000Z#000000#000#000000;20250314000000.000000Z#000000#001#000000;20200721123717.002866Z#000000#002#000000;20181031083258.073732Z#000000#003#000000;20250314000002.000000Z#000000#005#000000;20250227092006.790591Z#000000#006#000000) Mar 14 15:17:26 v06 slapd[14537]: do_syncrep2: rid=005 got search entry without Sync State control (reqStart=20250314123529.000001Z,cn=changelog-0) Mar 14 15:17:26 v06 slapd[14537]: do_syncrepl: rid=005 rc -1 retrying (no corelated messages on Node 1) Mar 14 15:17:39 v06 slapd[14537]: send_search_entry: conn 1021 ber write failed. Specifically I wonder what the "rc -101 retrying" is really about: the servers should be able to connect to each other. Also what "got search entry without Sync State control" means. Finally I also have a "rc -1 retrying" and the "ber write failed". I really don't know where to start debugging. The first syncprov is. dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config objectClass: olcSyncProvConfig olcOverlay: syncprov olcSpCheckpoint: 100 10 olcSpSessionlog: 10 My first accesslog looks like: dn: olcOverlay={1}accesslog,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcAccessLogConfig olcOverlay: accesslog olcAccessLogDB: cn=changelog-0 olcAccessLogOps: writes olcAccessLogPurge: 60+00:00 1+00:00 olcAccessLogSuccess: FALSE olcAccessLogOld: (objectClass=*) The second syncprov is: dn: olcOverlay={0}syncprov,olcDatabase={1}mdb,cn=config objectClass: olcSyncProvConfig olcOverlay: syncprov olcSpCheckpoint: 100 10 olcSpSessionlog: 100 The second accesslog is: dn: olcOverlay={1}accesslog,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcAccessLogConfig olcOverlay: accesslog olcAccessLogDB: cn=changelog-1 olcAccessLogOps: writes olcAccessLogPurge: 60+00:00 1+00:00 olcAccessLogSuccess: FALSE olcAccessLogOld: (objectClass=*) And the databases are: dn: olcDatabase={3}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: mdb olcDbDirectory: /var/lib/ldap/changelog-0 olcSuffix: cn=changelog-0 olcAccess: {0}to * by dn.exact="uid=syncrepl,..." read by * break olcLimits: {0}dn.exact="uid=syncrepl,..." size.soft=unlimited olcRootDN: cn=admin,cn=changelog-0 olcRootPW: log-0 dn: olcDatabase={4}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: mdb olcDbDirectory: /var/lib/ldap/changelog-1 olcSuffix: cn=changelog-1 olcAccess: {0}to * by dn.exact="uid=syncrepl,..." read by * break olcLimits: {0}dn.exact="uid=syncrepl,..." size.soft=unlimited olcRootDN: cn=admin,cn=changelog-1 olcRootPW: log-1 The syncrepl definitions are like this: olcSyncrepl: {0}rid=5 provider="ldap://v05 /" searchbase="cn=config" type="refreshAndPersist" \ retry="60 5 300 5 1800 +" logbase=cn=changelog-0 logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" \ schemachecking=on syncdata=accesslog starttls=critical tls_reqcert=demand bindmethod="simple" binddn="uid=syncrepl,..." credentials="replicationtest" olcSyncrepl: {1}rid=6 provider="ldap://v06 /" searchbase="cn=config" type="refreshAndPersist" \ retry="60 5 300 5 1800 +" logbase=cn=changelog-0 logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" \ schemachecking=on syncdata=accesslog starttls=critical tls_reqcert=demand bindmethod="simple" binddn="uid=syncrepl,..." credentials="replicationtest" olcSyncrepl: {0}rid=5 provider="ldap:// v05 /" searchbase="dc=..." type="refreshAndPersist" \ retry="60 5 300 5 1800 +" logbase=cn=changelog-1 logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" schemachecking=on syncdata=accesslog \ starttls=critical tls_reqcert=demand bindmethod="simple" binddn="uid=syncrepl,..." credentials="replicationtest" olcSyncrepl: {1}rid=6 provider="ldap://v06 /" searchbase="dc=... " type="refreshAndPersist" \ retry="60 5 300 5 1800 +" logbase=cn=changelog-1 logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" schemachecking=on syncdata=accesslog \ starttls=critical tls_reqcert=demand bindmethod="simple" binddn="uid=syncrepl,..." credentials="replicationtest" Kind regards, Ulrich Windl

1 0

Re: consumer replication not recovering
by Ondřej Kuzník 14 Mar '25

14 Mar '25

On Wed, Mar 12, 2025 at 03:10:12PM -0400, Suresh Veliveli wrote: > Here it is. Hi Suresh, I apologise for not really getting back to you for a while, rest assured I'm still thinking about it. However I'm still confused what might be happening and don't have much in terms of advice yet except that yes, the two (replication effectively stopping and the crash) seem to be two symptoms of the same issue. It looks like you're building OpenLDAP yourself, would you be able to apply a patch or two adding extra information to the sync logs that might help us trace this better? Are you able to compile and run OpenLDAP with -fsanitize=address in CFLAGS or an equivalent? > [root@...] # gdb ... > Reading symbols from /var/services/openldap/libexec/slapd... > BFD: warning: > /var/users/suresh.a/core.slapd.3003.bea19f5a376843abb488dce68d6e81af.5036.1741456520000000 > has a segment extending past end of file > [...] > warning: Error reading shared library list entry at 0x696e6e75723a5652 > Cannot access memory at address 0x69626f6e6e613a5e > Cannot access memory at address 0x69626f6e6e613a56 > Failed to read a valid object file image from memory. > [...] > Thread 2 (LWP 5036): > #0 0x00007f792d8868ba in ?? () > No symbol table info available. > Backtrace stopped: Cannot access memory at address 0x7ffebb22d9a0 I am a little concerned by the above warnings and the fact gdb is unable to extract any stack information at all from most threads. Doesn't seem to correspond what I'd usually see even when debugging information is missing. > Thread 1 (LWP 7650): > #0 connection_abandon (c=0x7f79158a5ba8) at connection.c:714 > o = 0x7f5fa0148170 > next = 0x7f5f90010300 In this frame, would you be able to print the following and paste/attach them here? - '*c' - '*o' - '*o->o_hdr' Thanks, -- Ondřej Kuzník Senior Software Engineer Symas Corporation http://www.symas.com Packaged, certified, and supported LDAP solutions powered by OpenLDAP

1 0

Request for Guidance on Upgrading from 2.4.x(BDB with ppolicy) to 2.6.9
by anilkumar.pathuri7＠gmail.com 13 Mar '25

13 Mar '25

Dear LDAP Community, We are planning to upgrade our setup from OpenLDAP 2.4.x to 2.6.9 (latest version) and would appreciate your guidance on the following: Is a direct upgrade from 2.4.x to 2.6.9 possible, or are there intermediate steps required? We are currently using BDB with ppolicy. Does 2.6.9 support BDB, or is migration to MDB mandatory? Is ppolicy still supported in 2.6.9? Are the ppolicy module and schema included in 2.6.9, or do they need to be obtained externally? If a migration from BDB with ppolicy to MDB with ppolicy is required, could you kindly provide step-by-step guidance? We greatly appreciate any insights, documentation, or recommendations you can share. Thank you for your support! Regards, Anil P

3 3

Re: consumer replication net recovering
by Suresh Veliveli 12 Mar '25

12 Mar '25

This is another instance where replication stops. Dec 23 01:01:23 aaa-prod-aws-3 slapd[1182444]: syncrepl_entry: rid=143 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_MODIFY) csn=20241223060050.594465Z#000000#000#000000 tid 0x7f5aed0fb640 Dec 23 01:01:23 aaa-prod-aws-3 slapd[1182444]: syncrepl_entry: rid=143 be_search (0) Dec 23 01:01:23 aaa-prod-aws-3 slapd[1182444]: syncrepl_entry: rid=143 uid=xxxx,ou=People,dc=georgetown,dc=edu Dec 23 01:01:23 aaa-prod-aws-3 slapd[1182444]: syncrepl_entry: rid=143 be_modify uid=xxxxx,ou=People,dc=georgetown,dc=edu (0) Dec 23 01:01:23 aaa-prod-aws-3 slapd[1182444]: syncrepl_message_to_entry: rid=143 DN: uid=xxxxx,ou=People,dc=georgetown,dc=edu, UUID: db41232e-527d-103f-995c-4344349468b5 Dec 23 01:01:23 aaa-prod-aws-3 slapd[1182444]: syncrepl_entry: rid=143 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_MODIFY) csn=20241223060104.603554Z#000000#000#000000 tid 0x7f5aed0fb640 Dec 23 01:01:23 aaa-prod-aws-3 slapd[1182444]: syncrepl_entry: rid=143 be_search (0) Dec 23 01:01:23 aaa-prod-aws-3 slapd[1182444]: syncrepl_entry: rid=143 uid=yyyyy,ou=People,dc=georgetown,dc=edu Dec 23 01:01:23 aaa-prod-aws-3 slapd[1182444]: syncrepl_entry: rid=143 be_modify uid=yyyy,ou=People,dc=georgetown,dc=edu (0) No "syncrep_" messages were logged after the above. Regards, Suresh On Mon, Dec 23, 2024 at 2:42 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Friday, December 20, 2024 5:46 PM -0500 Suresh Veliveli > <Suresh.Veliveli(a)georgetown.edu> wrote: > > > > > I do have these but no syncrepl_sync. > > > > > > Dec 12 08:59:30 aaa-prod-gcp-9 slapd[4165]: syncrepl_message_to_entry: > > rid=129 DN: uid=xxxx,ou=xxxx,dc=georgetown,dc=edu, UUID: > > 37387976-3ae0-103f-94fc-3b4be3361dc7 > > Dec 12 08:59:30 aaa-prod-gcp-9 slapd[4165]: syncrepl_entry: rid=129 > > LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_MODIFY) > > csn=20241212135921.652395Z#000000#000#000000 tid 0x7f671b7fe640 > > Yes sorry, that was a typo on my end. > > "syncrepl_" sync messages. Specifically you want to see the ones that > have > "be_" in them, but not "be_search". I.e., be_add, be_modify, etc. They > show the result of the operation, something like: > > syncrepl_entry: rid=100 be_modify <DN> (<result code>) > > --Quanah > > -- Suresh Veliveli Sr. UNIX Systems Engineer Georgetown University University Information Services | Security Infrastructure and Policy-Identity and Collaboration 202-262-6676 (cell) | 202-687-3108 (work)

5 30

LMDB: issues when resizing via set_mapsize
by Stefan de Konink 12 Mar '25

12 Mar '25

Hi, Some background; a Windows user of my open source ETL software complained about the huge files. Under Linux I don't have any issues, but I wanted to resolve this issue by implementing automatic growth via a pattern: MapFullError, set_mapsize, apply writing batch again. This week I entered a bug[1] which was stated as not a bug in LMDB. Today I ended up in build/lib/mdb.c:5966: Assertion 'IS_LEAF(mp)' failed in mdb_cursor_next() which also seem I am not the only one hitting, and several fixes have been introduced. The issue does not occur every time when the resize takes place, but can be consistently reproduced given the same input. The error will then occur at the same place. When my initial size is big enough, not to resize there is no issue. In short I am using py-lmdb to access a read only env, and in a second thread a write function is launched which reads out a queue. Upon the MapFullError I am linearly increasing the mapsize, and continue with the failed batch. I have four dupSort tables, the rest is ordinary. I was pointed in the bug at the documentation. One sentence struck me: "It may be called at later times if no transactions are active in this process." My assumption was that if I would have two independent env's I could do whatever I wanted in the first, and the second could do its resize. Does the documentation suggest that the full application must finish all its transactions independent of env? [1] https://bugs.openldap.org/show_bug.cgi?id=10316 -- Stefan

2 1

meta backend : forward the credentials to the server ?
by carnival＠protonmail.com 07 Mar '25

07 Mar '25

Hello, I'm trying to configure a proxy with slapd-meta. I have my data on a OpenLDAP server ldap-1.example.org and my meta backend setup on ldap-proxy.example.org. Here is the main part of my conf : # {2}meta, config dn: olcDatabase={2}meta,cn=config objectClass: olcDatabaseConfig objectClass: olcMetaConfig olcDatabase: {2}meta olcSuffix: dc=test,dc=com olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=bind,dc=test,dc=com olcRootPW: password olcDbRebindAsUser: FALSE # {0}uri, {2}meta, config dn: olcMetaSub={0}uri,olcDatabase={2}meta,cn=config objectClass: olcMetaTargetConfig olcMetaSub: {0}uri olcDbURI: "ldap://ldap-1.example.org:389/ou=dpt,dc=test,dc=com" olcDbIDAssertBind: mode=none flags=non-prescriptive,proxy-authz-non-critical b indmethod=simple timeout=0 network-timeout=0 binddn="cn=manager" cr edentials="password" keepalive=0:0:0 olcDbRewrite: {0}suffixmassage "ou=dpt,dc=test,dc=com" "ou=dpt,dc=test,dc= com" olcDbRebindAsUser: FALSE It's work fine, when I do a ldapsearch on ldap-proxy.example.org I retrieve my data stored on ldap-1.example.org. But in order to do that, I'm forced to use unique and administrative accounts : cn=bind,dc=test,dc=com for my proxy and cn=manager for my main LDAP server. For security reasons, I would like to avoid using an admin account for binding and instead use any user credentials I choose to connect to the target servers for searches beyond the first target (my proxy). For example, if I have an account named ou=account,dc=test,dc=com on my LDAP server, I would like to bind my proxy directly with this account and dynamically propagate the credentials for verification on my LDAP server, returning the results if the credentials are correct. I thought that "rebind-as-user YES" would resolve this, but it doesn't work. Is there something I'm missing? Thanks ! Arthur

1 0

Getting details for "TLS trace: SSL3 alert read:fatal:unsupported certificate"
by Windl, Ulrich 06 Mar '25

06 Mar '25

Hi! After "playing" significant time with certificate authentication, I managed to authenticate one user. However when I tried to authenticate a different user with a similar certificate, I see a TLS trace: SSL3 alert read:fatal:unsupported certificate Error. Can I can some details about the "usupportedness" of my certificate? The only thing I could think if is that uid of the newer certificate has a CN that is three characters longer than the one that worked. A more complete trace for ldapwhoami woul look like this: ... ldap_parse_result ber_scanf fmt ({iAA) ber: ber_scanf fmt (}) ber: ldap_msgfree TLS trace: SSL_connect:before SSL initialization TLS trace: SSL_connect:SSLv3/TLS write client hello TLS trace: SSL_connect:SSLv3/TLS write client hello TLS trace: SSL_connect:SSLv3/TLS read server hello TLS trace: SSL_connect:TLSv1.3 read encrypted extensions TLS trace: SSL_connect:SSLv3/TLS read server certificate request TLS certificate verification: depth: 2, err: 0, subject: /.... Root-CA (2018), issuer: /... Root-CA (2018) TLS certificate verification: depth: 1, err: 0, subject: /... Host-CA (2018), issuer: /... Root-CA (2018) TLS certificate verification: depth: 0, err: 0, subject: /... FQHN, issuer: /... Host-CA (2018) TLS trace: SSL_connect:SSLv3/TLS read server certificate TLS trace: SSL_connect:TLSv1.3 read server certificate verify TLS trace: SSL_connect:SSLv3/TLS read finished TLS trace: SSL_connect:SSLv3/TLS write change cipher spec TLS trace: SSL_connect:SSLv3/TLS write client certificate TLS trace: SSL_connect:SSLv3/TLS write certificate verify TLS trace: SSL_connect:SSLv3/TLS write finished ldap_sasl_interactive_bind: user selected: EXTERNAL ldap_int_sasl_bind: EXTERNAL ldap_int_sasl_open: host=FQHN SASL/EXTERNAL authentication started ldap_sasl_bind ldap_send_initial_request ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({i) ber: ber_flush2: 26 bytes to sd 3 ldap_msgfree ldap_result ld 0x56432476ac30 msgid 2 wait4msg ld 0x56432476ac30 msgid 2 (infinite timeout) wait4msg continue ld 0x56432476ac30 msgid 2 all 1 ** ld 0x56432476ac30 Connections: * host: FQHN port: 389 (default) * from: IP=172.20.16.36:57868 refcnt: 2 status: Connected last used: Wed Mar 5 15:42:03 2025 ** ld 0x56432476ac30 Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ld 0x56432476ac30 request count 1 (abandoned 0) ** ld 0x56432476ac30 Response Queue: Empty ld 0x56432476ac30 response count 0 ldap_chkResponseList ld 0x56432476ac30 msgid 2 all 1 ldap_chkResponseList returns ld 0x56432476ac30 NULL ldap_int_select read1msg: ld 0x56432476ac30 msgid 2 all 1 ber_get_next TLS trace: SSL3 alert read:fatal:unsupported certificate ber_get_next failed, errno=0. ldap_err2string ldap_sasl_interactive_bind: Can't contact LDAP server (-1) ... Kind regards, Ulrich Windl

3 5

Q: Uniqueness of syncrepl rid
by Windl, Ulrich 04 Mar '25

04 Mar '25

Hi! I have a question on the uniqueness of rid in syncrepl: Do they have to be globally unique, or just unique within a database (olcDatabase config)? Kind regards, Ulrich Windl

4 5

OlcLimits : sizelimit exceeded (openldap 2.5.16)
by bourguijl＠gmail.com 04 Mar '25

04 Mar '25

Dears, I've an issue with one user for which I set its limits to "unlimited" but which get err=4 (sizelimit exceeded). This is in the context of a META ldap fronted to a ldap backend. If I do the ldapsearch of this user in CLI directly on the ldap backend where the OlcLimits are set for it, this works perfectly, no err=4 errors but if this ldapsearch comes from the META ldap frontend with the same user which is used in the olcDbIDAssertBind as Binddn, it's failling with err=4 !!?? I did check ldap logs at back end and they are identical in both cases except the err=4. I don't see what can be the cause ?? Any help will be appreciate !! Thx in advance, Jean-Luc.

2 1

How to start debugging olcAuthzRegexp?
by Windl, Ulrich 04 Mar '25

04 Mar '25

Hi! I tried to remove the credentials from my syncrepl configuration using certificate authentication instead. To do so I added a user certificate for my own user and tried ldapwhoami to verify that it works. Unfortunately it does not. I read quite a lot on the subject, and either all the descriptions are all poorly written and incomplete, or it must be very simple to get it running. However I failed so far. My suspect is that my olcAuthzRegexp does not properly map the certificate's name to the user, or the mapping is not called at all. Can anybody provide a sample configuration for the client user to verify the configuration, and maybe give an example on the server side to get it working. What I have tried so far is having a ~/ldaprc with: TLS_REQCERT demand TLS_CACERT ./User-CA.crt TLS_CERT ./uid=user.crt TLS_KEY ./uid=user.pem LDAPSASL_MECH external And I tried the command "ldapwhoami -H ldap://FQHN -D uid=user,cn=gssapi,cn=auth -Z -v" I tried these olcAuthzRegexp: olcAuthzRegexp: {1} "C=DE,...,O=...,uid=([^,]+)" uid=$1,ou=people,dc=...,dc==de olcAuthzRegexp: {2} "^uid=([^,]+),cn=gssapi,cn=auth$" uid=$1,ou=people,dc=...,dc=de (I left out the details of the certificate and directory contexts) Kind regards, Ulrich Windl

4 3

manual page slapd-mdb.5 and "maxsize"
by Windl, Ulrich 03 Mar '25

03 Mar '25

Migrating to OpenLDAP 2.5 and MDB I hit the default 10MB limit (when trying to import a 6.8MB LDIF). Seeking how to extend the size online, I found: maxsize <bytes><https://manpages.debian.org/testing/slapd/slapd-mdb.5.en.html#maxsize> Specify the maximum size of the database in bytes. A memory map of this size is allocated at startup time and the database will not be allowed to grow beyond this size. The default is 10485760 bytes. This setting may be changed upward if the configured limit needs to be increased. However it's completely non-obvious that the name for cn=config is "olcDbMaxSize" (and not "olcMaxssize"). (The final MDB file size was about 23MB, including the indices) Kind regards, Ulrich Windl

4 6

[authcid=<identity>] [authzid=<identity>]
by Stefan Kania 03 Mar '25

03 Mar '25

hi to all, I like to split the replication for cn=config and the object-db between to different kerberos-principals so I did the following (so far) 1. create to principals and a keytab for both of them. 2. configured k5start to get two different cchache files (one for each user) 3. Now I want to change my syncrepl from: --------------------------- dn: olcDatabase={0}config,cn=config changetype: modify replace: olcSyncRepl olcSyncRepl: rid=001 provider=ldaps://provider01.example.net bindmethod=sasl saslmech=gssapi searchbase="cn=config" type=refreshAndPersist retry="5 5 100 +" timeout=1 tls_reqcert=allow olcSyncRepl: rid=002 provider=ldaps://provider02.example.net bindmethod=sasl saslmech=gssapi searchbase="cn=config" type=refreshAndPersist retry="5 5 100 +" timeout=1 tls_reqcert=allow --------------------------- And ----------------------------- dn: olcDatabase={2}mdb,cn=config changetype: modify replace: olcSyncrepl olcSyncrepl: rid=101 provider=ldaps://provider01.example.net bindmethod=sasl saslmech=gssapi authzid=uid=krepl-main,cn=gssapi,cn=auth timeout=0 network-timeout=0 filter="(objectclass=*)" searchbase="dc=example,dc=net" scope=sub schemachecking=off type=refreshAndPersist retry="60 +" tls_reqcert=allow olcSyncrepl: rid=102 provider=ldaps://provider02.example.net bindmethod=sasl saslmech=gssapi authzid=uid=krepl-main,cn=gssapi,cn=auth timeout=0 network-timeout=0 filter="(objectclass=*)" searchbase="dc=example,dc=net" scope=sub schemachecking=off type=refreshAndPersist retry="60 +" keepalive=240:10:30 tls_reqcert=allow ----------------------------------- to use a different identity. I found the options [authcid=<identity>] [authzid=<identity>] But nothing how to configure these options. When I get the ticket for the user and do a ldapwhoami I'm getting dn:uid=krepl-config,cn=gssapi,cn=auth and dn:uid=krepl-main,cn=gssapi,cn=auth The DNs are: krbPrincipalName=krepl-krbPrincipalName=krepl-config(a)EXAMPLE.NET,cn=EXAMPLE.NET,cn=kerberos,dc=example,dc=net and krbPrincipalName=krepl-main(a)EXAMPLE.NET,cn=EXAMPLE.NET,cn=kerberos,dc=example,dc=net So which option du I have to take and what is the right value for the option? Stefan

3 5

When init new consumers receiving: missing or invalid at 'pwdPolicySubentry'
by erikdewaard＠gmail.com 03 Mar '25

03 Mar '25

Hi, When bootstrapping consumers through replication (clean conf/data dir) receiving msgs about pwdPolicySubentry missing. Its not always the same: sometimes 4 msgs another time 60 etc. I have this on various consumers 2.5.17/2.6.7 I thought this could be related to some ordering, maybe the accounts were created before ppolicy cn=noexpirepasswordpolicy data was replicated? <167>2025-02-27T12:16:20.993758+01:00 consumer22 slapd[1098021]: slapd starting <167>2025-02-27T12:16:32.035015+01:00 consumer22 slapd[1098021]: ppolicy_get: policy subentry cn=noexpirepasswordpolicy,ou=policies,dc=company,dc=com missing or invalid at 'pwdPolicySubentry', no policy will be applied! <167>2025-02-27T12:16:35.580938+01:00 consumer22 slapd[1098021]: ppolicy_get: policy subentry cn=noexpirepasswordpolicy,ou=policies,dc=company,dc=com missing or invalid at 'pwdPolicySubentry', no policy will be applied! best regards

2 1

OpenLDAP Pass-through Authentication
by Dino Edwards 01 Mar '25

01 Mar '25

Hi, Trying to get pass-through authentication working however, I'm running to the following error in OpenLDAP: openldap | 679ceede.3aa31e0a 0x7f2ff617e6c0 conn=1004 op=1 SRCH attr=uid mail displayName openldap | 679ceede.3aa4b816 0x7f2ff617e6c0 conn=1004 op=1 SEARCH RESULT tag=101 err=0 qtime=0.000019 etime=0.000172 nentries=1 text= openldap | 679ceede.3aaafd88 0x7f2ff597d6c0 conn=1005 fd=14 ACCEPT from IP=172.16.32.1:47082 (IP=0.0.0.0:1389) openldap | 679ceede.3aab8f34 0x7f2ff597d6c0 conn=1005 op=0 BIND dn="cn=username(a)domain.tld,ou=users,dc=domain,dc=local <mailto:cn=username@domain.tld,ou=users,dc=domain,dc=local> " method=128 openldap | 679ceede.3aac9267 0x7f2ff597d6c0 SASL [conn=1005] Failure: cannot connect to saslauthd server: No such file or directory openldap | 679ceede.3aad25b9 0x7f2ff597d6c0 conn=1005 op=0 RESULT tag=97 err=49 qtime=0.000005 etime=0.000120 text= openldap | 679ceede.3ab0191f 0x7f2ff617e6c0 conn=1005 fd=14 closed (connection lost) openldap | 679ceede.3ab3d76a 0x7f2ff597d6c0 conn=1004 fd=13 closed (connection lost) I followed the admin docs at: https://www.openldap.org/doc/admin26/guide.html#Pass-Through%20authenticatio n Here's what I did: Created /usr/lib/sasl2/slapd.conf with the following content: mech_list: plain pwcheck_method: saslauthd saslauthd_path: /var/run/sasl2/mux Created /etc/saslauthd.conf with the following content: ldap_servers: ldap://192.168.xxx.xxx.xxx ldap_search_base: OU=Users,DC=domain,DC=tld ldap_filter: (uid=%u) ldap_bind_dn: CN=saslauthd,CN=Users,DC=domain,DC=tld ldap_password: somepassword Added a user that already exists in domain.tld in openldap with the following password: {SASL}username(a)domain.tld <mailto:%7bSASL%7dusername@domain.tld> I would appreciate some help on this. Thanks

5 20

Transparent proxy to existing LDAP but with replacing specific attribute from another source
by Alexey D. Filimonov 28 Feb '25

28 Feb '25

Hi. A have Active Directory domain across 30+ domain controllers. In one single location, I have a server with corporate software that uses AD as normal ordinary LDAP with simple binds and it takes users. I want to add users their high quality photos, but I don't want them across all domain controllers in active directory. Can I build a proxy server with OpenLDAP that will proxy all requests to backend AD servers and return results, but for results it will replace one attribute, jpegPhoto, if it was requested, with some binary contents taken from elsewhere ?

2 1

olcDbMaxSize decrease possible?
by cyril＠stoll.info 27 Feb '25

27 Feb '25

Hi there For some reason I don't remember I set the olcDbMaxSize to 4 GB. Turns out that is way too large for our OpenLDAP servers. Both the admin guide and the slapd-mdb manpage state that "this setting may be changed upward". Unfortunately there is no mentioning of decreasing that size. On our servers the data.mdb and lock.mdb Files together are around 176 MB. I don't really expect a significant growth of our OpenLDAP Servers. So I guess that setting it to 1 GB or even just 500 MB would be more than enough for our needs in the coming years. So my question is, can I also decrease that size? Or should I just let it be at 4 GB even though we will never ever come close to that? Thanks a lot and best regards, Cyril

2 1

Querying a tree covered by multiple databases
by Norman Gray 27 Feb '25

27 Feb '25

Greetings. If I have a server which manages a tree split into two databases, one covering o=top, and one ou=sub,o=top, then a query against base o=top with subtree scope returns only objects within the first database, and not the second. Should I have expected that? (I didn't) [ This is a for-interest question. This isn't really a practical problem for me: I'm encountering it because I have a situation where I'm searching objects in ou=sub,o=top and in o=top, which would be on different servers in the real case, but which are in the same server as part of a test harness. Of course, I doubt it would be a good production design to have a tree split into multiple databases like this. ] That makes sense if the semantics of a search are that it searches a _database_, but it conflicts with the intuition that a search is of a _tree_, where I'd expect a search of o=top to implicitly include ou=sub,o=top as well. My problem is that I can't find where in the manual it tells me I should expect the former rather than the latter. What have I not read? Both ldapsearch(1) and ldap_search(3) discuss the scope in terms of sub_tree_, and don't mention databases (I wouldn't expect them to, since here a 'database' is an implementation detail of the LDAP server). Section 1.1 of TFM says 'A directory is a specialized database specifically designed for searching and browsing', but that's 'database' being used somewhat generically. Perhaps I should be looking at referrals? But the introduction of referrals in TFM suggest that these are a mechanism for referring clients to servers broadly 'elsewhere', and Sect. 5.3 documents olcReferral by saying that 'queries not local to one of the databases defined below will be referred to the LDAP server running on [another server]'. And queries to ou=sub,o=top _is_ 'local to one of the databases'. Best wishes, Norman -- Norman Gray : https://nxg.me.uk

2 2

How do I list existing indexes
by Richard Perini 27 Feb '25

27 Feb '25

I'm sure this question has been asked before, but my googling has failed to find an answer: How can I get a list of attribute indexes for our OpenLDAP instance? We're running version 2.4.57 (FreeBSD). Thanks in advance, -- Richard Perini Ramico Australia Pty Ltd Sydney, Australia rpp(a)ramico.com.au ----------------------------------------------------------------------------- "The difference between theory and practice is that in theory there is no difference, but in practice there is"

3 4

OpenLDAP 3-way multimaster oathHOTPCounter problem
by agrru01＠gmail.com 27 Feb '25

27 Feb '25

Hello! I am using a 3-way multimaster syncrepl setup with the slapo-otp module. My problem is that when authenticating with a user using HOTP, the attribute oathHOTPCounter only updates the value on the target ldap instance. This means the other two ldap instances do not get the updated HOTP-counter value and therefore will allow authentication using the same HOTP code. Interestingly enough, if I manually edit the oathHOTPCounter value it synchronizes with the other masters. Any idea what the problem could be?

2 1

A ldif for authentication
by Mohsen Pahlevanzadeh 24 Feb '25

24 Feb '25

Hello, I'm very happy with OpenLDAP. I have the following scenario: I need to have a back to support 1. Usernames 2. Groups 3. Passwords of usernames 4. password of groups And some CN Note: Not only I don't want to use /etc/passwd and local authentication, but also I need to virtual {user,account}. Would you please help me to generate an ldif to import to openldap? Yours, Mohsen

2 1

Debian Bookworm: Issues with stucking / hanging slapd process 2.5, while add / modify entries (master-master replication)
by linuxmail＠4lin.net 24 Feb '25

24 Feb '25

Hello, we fighting since upgrade from Buster to Bookworm with smaller and bigger issues on our OpenLDAP. We use WebADM as IDM (Rcdevs) and this is using OpenLDAP as backend. Since a long while on Bookworm, we have the issues, that slapd stucks on operations, like on adding entries. For example adding more than 1 CN entry to an existing OU. The only way to get all working is again, to stop slapd, but systemctl stop slapd doesn't work, you have to use kill -9 .. and that, pretty often. So, I hoped, to get it working again, I cloned the VMs; cutted the (normal) network and used a localhost bridge, so that both can see each others, without issues. Then I've created a backup (slapcat); deleted the db and slapd.d/cn=config ... and restored on both the DB. This part worked without issues .. but: ``` cat /home/foo/sudo_single.ldif dn: cn=jochoa_fra_dev_bookworm_02,ou=user_rules,ou=sudoers,dc=example,dc=local objectclass: sudorole objectclass: top cn: jochoa_fra_dev_bookworm_02 sudorunasuser: ALL sudooption: !authenticate sudocommand: /bin/su sudohost: fra-dev-bookworm-02.example.local sudouser: jochoa(a)example.local ldapadd -ZZ -c -x -D 'cn=webadmin,ou=Accounts,dc=example,dc=local' -W -H ldap://fra-corp-auth-01.example.com:389 -f /home/foo/sudo_single.ldif -vv ldap_initialize( ldap://fra-corp-auth-01.example.com:389/??base ) Enter LDAP Password: add objectclass: sudorole top add cn: jochoa_fra_dev_bookworm_02 add sudorunasuser: ALL add sudooption: !authenticate add sudocommand: /bin/su add sudohost: fra-dev-bookworm-02.example.local add sudouser: jochoa(a)example.local adding new entry "cn=jochoa_fra_dev_bookworm_02,ou=user_rules,ou=sudoers,dc=example,dc=local" ``` and then .. it just stucks, till I break with CTRL +C The same happens via ApacheDirectory or using WebADM Gui ... sometimes it works .. but often not. ```` eb 20 11:20:22 fra-corp-auth-01 slapd[710]: daemon: activity on 1 descriptor Feb 20 11:20:22 fra-corp-auth-01 slapd[710]: daemon: activity on: Feb 20 11:20:22 fra-corp-auth-01 slapd[710]: 22r Feb 20 11:20:22 fra-corp-auth-01 slapd[710]: Feb 20 11:20:22 fra-corp-auth-01 slapd[710]: daemon: read active on 22 Feb 20 11:20:22 fra-corp-auth-01 slapd[710]: daemon: epoll: listen=8 active_threads=0 tvp=zero Feb 20 11:20:22 fra-corp-auth-01 slapd[710]: daemon: epoll: listen=9 active_threads=0 tvp=zero Feb 20 11:20:22 fra-corp-auth-01 slapd[710]: daemon: epoll: listen=10 active_threads=0 tvp=zero Feb 20 11:20:22 fra-corp-auth-01 slapd[710]: connection_get(22) Feb 20 11:20:22 fra-corp-auth-01 slapd[710]: connection_get(22): got connid=1041 Feb 20 11:20:22 fra-corp-auth-01 slapd[710]: connection_read(22): checking for input on id=1041 Feb 20 11:20:22 fra-corp-auth-01 slapd[710]: op tag 0x68, time 1740046822 Feb 20 11:20:22 fra-corp-auth-01 slapd[710]: conn=1041 op=1 do_add Feb 20 11:20:22 fra-corp-auth-01 slapd[710]: conn=1041 op=1 do_add: dn (cn=jochoa_fra_dev_bookworm_02,ou=user_rules,ou=sudoers,dc=example,dc=local) Feb 20 11:20:22 fra-corp-auth-01 slapd[710]: >>> dnPrettyNormal: <cn=jochoa_fra_dev_bookworm_02,ou=user_rules,ou=sudoers,dc=example,dc=local> Feb 20 11:20:22 fra-corp-auth-01 slapd[710]: <<< dnPrettyNormal: <cn=jochoa_fra_dev_bookworm_02,ou=user_rules,ou=sudoers,dc=example,dc=local>, <cn=jochoa_fra_dev_bookworm_02,ou=user_rules,ou=sudoers,dc=example,dc=local> Feb 20 11:20:22 fra-corp-auth-01 slapd[710]: conn=1041 op=1 ADD dn="cn=jochoa_fra_dev_bookworm_02,ou=user_rules,ou=sudoers,dc=example,dc=local" Feb 20 11:20:22 fra-corp-auth-01 slapd[710]: => mdb_entry_get: ndn: "cn=jochoa_fra_dev_bookworm_02,ou=user_rules,ou=sudoers,dc=example,dc=local" Feb 20 11:20:22 fra-corp-auth-01 slapd[710]: => mdb_entry_get: oc: "(null)", at: "(null)" Feb 20 11:20:22 fra-corp-auth-01 slapd[710]: mdb_dn2entry("cn=jochoa_fra_dev_bookworm_02,ou=user_rules,ou=sudoers,dc=example,dc=local") Feb 20 11:20:22 fra-corp-auth-01 slapd[710]: => mdb_dn2id("cn=jochoa_fra_dev_bookworm_02,ou=user_rules,ou=sudoers,dc=example,dc=local") Feb 20 11:20:22 fra-corp-auth-01 slapd[710]: <= mdb_dn2id: get failed: MDB_NOTFOUND: No matching key/data pair found (-30798) Feb 20 11:20:22 fra-corp-auth-01 slapd[710]: => mdb_entry_get: cannot find entry: "cn=jochoa_fra_dev_bookworm_02,ou=user_rules,ou=sudoers,dc=example,dc=local" Feb 20 11:20:22 fra-corp-auth-01 slapd[710]: mdb_entry_get: rc=32 Feb 20 11:20:22 fra-corp-auth-01 slapd[710]: ==> mdb_add: cn=jochoa_fra_dev_bookworm_02,ou=user_rules,ou=sudoers,dc=example,dc=local Feb 20 11:20:22 fra-corp-auth-01 slapd[710]: oc_check_required entry (cn=jochoa_fra_dev_bookworm_02,ou=user_rules,ou=sudoers,dc=example,dc=local), objectClass "sudoRole" Feb 20 11:20:22 fra-corp-auth-01 slapd[710]: oc_check_allowed type "objectClass" Feb 20 11:20:22 fra-corp-auth-01 slapd[710]: oc_check_allowed type "cn" Feb 20 11:20:22 fra-corp-auth-01 slapd[710]: oc_check_allowed type "sudoRunAsUser" Feb 20 11:20:22 fra-corp-auth-01 slapd[710]: oc_check_allowed type "sudoOption" Feb 20 11:20:22 fra-corp-auth-01 slapd[710]: oc_check_allowed type "sudoCommand" Feb 20 11:20:22 fra-corp-auth-01 slapd[710]: oc_check_allowed type "sudoHost" Feb 20 11:20:22 fra-corp-auth-01 slapd[710]: oc_check_allowed type "sudoUser" Feb 20 11:20:22 fra-corp-auth-01 slapd[710]: oc_check_allowed type "structuralObjectClass" Feb 20 11:20:22 fra-corp-auth-01 slapd[710]: daemon: activity on 1 descriptor Feb 20 11:20:22 fra-corp-auth-01 slapd[710]: daemon: activity on: Feb 20 11:20:22 fra-corp-auth-01 slapd[710]: Feb 20 11:20:22 fra-corp-auth-01 slapd[710]: daemon: epoll: listen=8 active_threads=0 tvp=zero ``` If I try to stop the slapd om ldap1: ``` Feb 20 11:23:10 fra-corp-auth-01 slapd[710]: conn=1001 fd=20 closed (slapd shutdown) Feb 20 11:23:10 fra-corp-auth-01 slapd[710]: connection_closing: readying conn=1041 sd=22 for close Feb 20 11:23:10 fra-corp-auth-01 slapd[710]: connection_close: deferring conn=1041 sd=22 Feb 20 11:23:10 fra-corp-auth-01 slapd[710]: connection_closing: readying conn=1011 sd=23 for close Feb 20 11:23:10 fra-corp-auth-01 slapd[710]: connection_close: deferring conn=1011 sd=23 Feb 20 11:23:10 fra-corp-auth-01 slapd[710]: slapd shutdown: waiting for 4 operations/tasks to finish ``` strace shows: ``` futex(0x7f3e9a9ff990, FUTEX_WAIT_BITSET|FUTEX_CLOCK_REALTIME, 720, NULL, FUTEX_BITSET_MATCH_ANY ``` So, if I stop all .. start slapd again .. all seems fine .. * ldap2 ``` Feb 20 11:49:32 fra-corp-auth-02 slapd[686]: conn=1209 op=2 syncprov_op_search: registered persistent search Feb 20 11:49:32 fra-corp-auth-02 slapd[686]: conn=1209 op=2 syncprov_op_search: no change, skipping log replay Feb 20 11:49:32 fra-corp-auth-02 slapd[686]: conn=1209 op=2 syncprov_op_search: nothing changed, finishing up initial search early Feb 20 11:49:32 fra-corp-auth-02 slapd[686]: conn=1209 op=2 syncprov_sendinfo: refreshDelete cookie= Feb 20 11:49:32 fra-corp-auth-02 slapd[686]: conn=1209 op=2 syncprov_search_response: detaching op ``` then I again try to use ldapadd .. and I see still: * ldap2 ``` ... Feb 20 11:54:35 fra-corp-auth-02 slapd[4696]: =>do_syncrepl rid=002 Feb 20 11:54:36 fra-corp-auth-02 slapd[4696]: daemon: epoll: listen=8 active_threads=0 tvp=zero Feb 20 11:54:36 fra-corp-auth-02 slapd[4696]: daemon: epoll: listen=9 active_threads=0 tvp=zero Feb 20 11:54:36 fra-corp-auth-02 slapd[4696]: daemon: epoll: listen=10 active_threads=0 tvp=zero Feb 20 11:54:36 fra-corp-auth-02 slapd[4696]: start_refresh: rid=002 a refresh on rid=001 in progress, pausing Feb 20 11:54:37 fra-corp-auth-02 slapd[4696]: =>do_syncrepl rid=002 Feb 20 11:54:38 fra-corp-auth-02 slapd[4696]: daemon: epoll: listen=8 active_threads=0 tvp=zero Feb 20 11:54:38 fra-corp-auth-02 slapd[4696]: daemon: epoll: listen=9 active_threads=0 tvp=zero Feb 20 11:54:38 fra-corp-auth-02 slapd[4696]: daemon: epoll: listen=10 active_threads=0 tvp=zero Feb 20 11:54:38 fra-corp-auth-02 slapd[4696]: start_refresh: rid=002 a refresh on rid=001 in progress, pausing Feb 20 11:54:39 fra-corp-auth-02 slapd[4696]: =>do_syncrepl rid=002 .... but .. a ldapsearch on ldap1 .. **still works** :-/ on ldap1 .. log is silent, except from my ldapsearch and ... I have to kill -9 slapd on ldap1 again and start .. I have no clue .. what else I can do ..... any hints ? cu denny

2 2

slapo-otp: manual page could be improved
by Windl, Ulrich 21 Feb '25

21 Feb '25

Hi! Reading the slapo-otp manual page, It's not quite clear to me how it works: * The tokens are stored in a separate entry, but does the manual page say what object type that entry has to be? I wonder why the token isn't stored directly within the user entry as tokens most likely are not shared. * Likewise "parameters" are stored in a separate entry; again what object type would those be? * Confusingly the manual talks about "attributes" next: Are those "parameters"? I mean: length and HMAC algorithm might be shared among entries, but counter and time-step cannot. A sample configuration would be really helpful, given that the only reference is "See also slapd-config(5)". Kind regards, Ulrich Windl

2 1

Migration from 2.4 to 2.5: problem with using "olcPPolicyDefault" in ACL duriung slapadd
by Windl, Ulrich 21 Feb '25

21 Feb '25

Hi! I'm about to migrate openLDAP 2.4 from SLES12 SP5 to openLDAP 2.5 from SLES15 SP6, following the rather terse https://www.openldap.org/doc/admin25/appendix-upgrading.html. I've removed the policy schema as advised from the LDIF export of cn=config, but now it seems that slapadd cannot use "olcPPolicyDefault" in an ACL: # slapadd -v -n0 -F /etc/openldap/slapd.d -S 1 -w -l 0.ldif added: "cn=config" (00000001) added: "cn=module{0},cn=config" (00000001) added: "cn=schema,cn=config" (00000001) added: "cn={0}core,cn=schema,cn=config" (00000001) added: "cn={1}cosine,cn=schema,cn=config" (00000001) added: "cn={2}inetorgperson,cn=schema,cn=config" (00000001) added: "cn={3}rfc2307bis,cn=schema,cn=config" (00000001) added: "cn={4}yast,cn=schema,cn=config" (00000001) added: "cn={5}sudo,cn=schema,cn=config" (00000001) added: "olcDatabase={-1}frontend,cn=config" (00000001) olcAccess: value #1: unknown attr "olcPPolicyDefault" in to clause. <access clause> ::= access to <what> [ by <who> [ <access> ] [ <control> ] ]+ <what> ::= * | dn[.<dnstyle>=<DN>] [filter=<filter>] [attrs=<attrspec>] <attrspec> ::= <attrname> [val[/<matchingRule>][.<attrstyle>]=<value>] | <attrlist> <attrlist> ::= <attr> [ , <attrlist> ] <attr> ::= <attrname> | @<objectClass> | !<objectClass> | entry | children <who> ::= [ * | anonymous | users | self | dn[.<dnstyle>]=<DN> ] [ realanonymous | realusers | realself | realdn[.<dnstyle>]=<DN> ] [dnattr=<attrname>] [realdnattr=<attrname>] [group[/<objectclass>[/<attrname>]][.<style>]=<group>] [peername[.<peernamestyle>]=<peer>] [sockname[.<style>]=<name>] [domain[.<domainstyle>]=<domain>] [sockurl[.<style>]=<url>] [ssf=<n>] [transport_ssf=<n>] [tls_ssf=<n>] [sasl_ssf=<n>] <style> ::= exact | regex | base(Object) <dnstyle> ::= base(Object) | one(level) | sub(tree) | children | exact | regex <attrstyle> ::= exact | regex | base(Object) | one(level) | sub(tree) | children <peernamestyle> ::= exact | regex | ip | ipv6 | path <domainstyle> ::= exact | regex | base(Object) | sub(tree) <access> ::= [[real]self]{<level>|<priv>} <level> ::= none|disclose|auth|compare|search|read|{write|add|delete}|manage <priv> ::= {=|+|-}{0|d|x|c|s|r|{w|a|z}|m}+ <control> ::= [ stop | continue | break ] slapadd: could not add entry dn="olcDatabase={0}config,cn=config" (line=908): ▒5=▒ Closing DB... (Also note the garbage in the error message that seems to appear for any slapadd error) As noted Openldap is SUSE's version (openldap2_5-2.5.18+31-150500.11.12.1.x86_64) they re-introduced in SLES15 SP5 (maybe due to failing to provide a working migration tool to 389-DS and a proper administration manual) So is it a bug that the attribute cannot be used in ACL, or is it a configuration error on my side? (line 908 is "dn: olcDatabase={0}config,cn=config") The actual line in question is like this: olcAccess: {1}to attrs=olcPPolicyDefault by dn.exact="uid=PP-Checker,ou=system,dc=domain,dc=org" read by * break Kind regards, Ulrich Windl

2 2

Change from mono to multivalued
by Frédéric Goudal 19 Feb '25

19 Feb '25

Hello, I may have to change some attributes from mono valued to multivalued on my production openldap I would like to know if I can do the change dynamically on the running ldap ? Most of my openldap are in 2.6.x version, but… I have one old in 2.4 (yes I know, it’s a very bad idea but too many problems to change it for me now) Thanks in advance Frederic — Frédéric Goudal Ingénieur Système, DSI Bordeaux-INP +33 556 84 23 11

2 1

EAP-TLS extend logged lines
by Alexey D. Filimonov 19 Feb '25

19 Feb '25

Hello. Currently I have EAP-TLS auth. On successfull auth, it logs Wed Feb 19 15:23:13 2025 : Auth: (9) Login OK: [anonymous-xxx] (from client name_of_client1 port 8 cli ee:ee:ee:ed:ae:ee) I'd like to extend or replace this line with UPN from certiificate and other attributes. Where should I start from ?

2 2

Attribute value as glue
by mbalakri＠opentext.com 18 Feb '25

18 Feb '25

We have multimaster replication in place, and sync replication is working. However, we have noticed some glue values for certain entries. What could be the reason for these glue entries, and how can we avoid them? This is a sample entry wit glue values for objectClass and structuralObjectClass attribtues. Please suggest how to avoid these glue values. dn: cn=organizational users,o=test,cn=test,cn=acd,o=in.bbn.ac entryUUID: 2acd5574-47fb-4414-b930-65d3fefc40cb creatorsName: cn=Directory Manager,o=in.bbn.ac createTimestamp: 20240730130003Z entryCSN: 20240730130003.412795Z#000000#001#000000 modifiersName: cn=Directory Manager,o=in.bbn.ac modifyTimestamp: 20240730130003Z objectClass: top objectClass: glue structuralObjectClass: glue

4 11

External LDAP authentication depending on user attributes?
by alexey＠filimonic.net 17 Feb '25

17 Feb '25

I have two LDAP servers (ActiveDirectory) with users: On AD horns-and-hooves.org: cn=Jane Smith,ou=users,dc=horns-and-hooves,dc=org cn: jane.smith(a)contoso.com On AD bells-and-whistles.com: cn=John Snow,ou=users,ou=europe,dc=bells-and-whistles,dc=com mail: john.snow(a)contoso.com And for mail system, I need to grab some of those users to single OpenLDAP database (dc=internal), add some mail system-specific attributes (that dont exist in source ADs) and add passthrough authentication for them to the AD server where they belong. Like this: cn=jane.smith,ou=horns-and-hooves,dc=internal mailQuota: 10 imapHost: imap1 mail: jane.smith(a)contoso.com sourceOrg: horns-and-hooves cn=john.snow,ou=bells-and-whistles,dc=internal mailQuota: 20 imapHost: imap2 mail:: john.snow(a)contoso.com sourceOrg: bells-and-whistles I expect algorithm like this: First, I manually create users in OpenLDAP directory without passwords with correct attributes. When Jane makes simple_bind to OpenLDAP server, the server determines if user is related to horns-and-hooves organization or to bells-and-whistles. If "horns-and-hooves" then server makes a search against ldap://horns-and-hooves.org:389/dc=horns-and-hooves,dc=org for '(mail=$1)' where $1 is value of mail from `mail` attribute. it finds one item, OpenLDAP tries to make bind to ldap://horns-and-hooves.org:389 with DN of item found and password provided by Jane to OpenLDAP. If "bells-and-whistles" then backend server is ldap://bells-and-whistles.com:389/dc=bells-and-whistles,dc=com , other is same. How server determines if user is a hosn-an-hooves user or bells-and-whistles user - based on some attriburte value (sourceOrg) or based on DN value (ou=horns-and-hooves,dc=internal vs ou=bells-and-whistles,dc=internal) - IDK if any of this is possible. Does this algorithm implementation requires SALSd, or it can be done with OpenLDAP-only? Could you please help me getting this configuration done?

3 2

Few questions about replica (mirror mode?)
by alexey＠filimonic.net 17 Feb '25

17 Feb '25

I plan few OpenLDAP servers: N readonly secondaries and single writable main. In my case OpenLDAP is critical as readonly database, and changes are allowed to fail. But I need all readonly replicas contain the same data same time, and I have possibilities to temporarily disconnect readonly secondaries from master. Is there a some kind of operational\replication mode when: - Transactional changes over all servers: Writable main fails writing to database and propagating them to secondaries in case any of secondaries can not receive same changes - Secondary server may start "empty" and self-register as secondary server on writeable main, then get in sync. Until sync complete, secondary server will not satisfy any requests from clients.

3 2

lload backend-server connection issues
by Ben Poliakoff 17 Feb '25

17 Feb '25

I've successfully set up haproxy with current openldap slapd backend instances, the ldap client IP is passed on to my slapd instances, and things like IP based ACLs work. But now I'm exploring and comparing the features of the OpenLDAP lloadd backend. I've been using the embedded version, loading lloadd.a into slapd and I've been using the example configs from https://www.openldap.org/doc/admin26/loadbalancer.html as a starting point. I'm consistently seeing these errors on the backend slapd: Feb 4 10:45:33 test local4.debug slapd[508415]: proxyp(19): invalid header signature Feb 4 10:45:33 test local4.debug slapd[508415]: slapd(19): proxyp failed And on the frontend slapd (running lload) I'm seeing these sorts of errors: Feb 4 10:48:12 slapd-lb-a local4.debug slapd[271207]: operation_init: received a new operation, bind request with msgid=1 for client connid=6 Feb 4 10:48:12 slapd-lb-a local4.debug slapd[271207]: request_bind: connid=6, msgid=1 no available connection found When I compare the traffic between slapd w/lload and the backend slapd with traffic between haproxy and the same backend slapd, the main thing that I notice is that the slapd w/lload is doing a TLSv1 client hello whereas haproxy is doing a TLSv1.3 client hello. Is it possible that the lloadd code doesn't support TLSv1.3? I'd be surprised if that were the case, since the same slapd happily supports client connections with TLSv1.3, but I can't figure out why it's only trying TLSv1. I'm running openldap 2.6.9 packages from Symas on Debian 12, for what it's worth. While I've been working on this I've been using the slapd.conf style config, but would transition to cn=config if it were to go to production. I've tried configuring the backend server URI with ldap://, ldaps://, pldap://, and pldaps://, all with the same results. My current config follows. Thanks for any suggestions! Ben ------- current config ----------------------------------------------- TLSCertificateFile /etc/haproxy/haproxy.pem TLSCertificateKeyFile /etc/haproxy/haproxy.pem TLSCACertificatePath /etc/ssl/certs loglevel stats #loglevel -1 pidfile /var/symas/run/openldap-lload.pid allow bind_v2 include /opt/symas/etc/openldap/schema/core.schema modulepath /opt/symas/lib/openldap # require at least SSL/TLS for simple binds security simple_bind=1 moduleload lloadd.la backend lload # The Load Balancer manages its own sockets, so they have to be separate # from the ones slapd manages (as specified with the -h "URLS" option at # startup). listen ldaps://:10636 # Enable authorization tracking feature proxyauthz # Specify the number of threads to use for the connection manager. The default is 1 and this is typically adequate for up to 16 CPU cores. # The value should be set to a power of 2: io-threads 2 TLSShareSlapdCTX true # Authentication and other options (timeouts) shared between backends. bindconf bindmethod=simple tls_cacertdir="/etc/ssl/certs" binddn=uid=ldap-lb,ou=Services,dc=example,dc=com credentials=xxxxxxxxxxxxxxxxxxxxxxxxxxx network-timeout=5 tier bestof backend-server uri=pldaps://backend-slapd-hostname:8636 retry=5000 max-pending-ops=50 conn-max-pending=10 numconns=10 bindconns=5 ####################################################################### database monitor

2 1

Make OpenLDAP proxy only simple_bind requests to other LDAPs
by Alexey D. Filimonov 12 Feb '25

12 Feb '25

My goal is to [manually] maintain a database of users using OpenLDAP directory, with some set of attributes and values. All of those users have their second accounts in different external LDAP directories (2 directories). For those users, I want OpenLDAP server to passthrough simple_bind authentication to one of those directories. When I manually create a user in OpenLDAP directory, I want specify a `backend keys` in some attributes, that will tell OpenLDAP server how to process user's simple_bind authentication. For example, I can specify some sort of attributes like `backendRealm = ActiveDirectory1` and `mail = jack(a)contoso.com` to tell OpenLDAP to lookup object DN on servers from group `ActiveDirectory1` with `mail=jack(a)contoso.com` filter and try to simple_bind against one server from group `ActiveDirectory1` using DN it fount and password user provided originally. DNs of all users are not even partially equal between directories. Suffixes are different too. All OpenLDAP users and attributes are maintained manually, without proxying (except authentication). Please help me if I can do this somehow using OpenLDAP? Can I do this without using SASLD? Alex.

2 4

container image building and syncing
by Marc 11 Feb '25

11 Feb '25

I use echo "127.0.0.2 ldap.example.com" >> /etc/hosts to prevent the running ldap server from syncing during image building. However when using DOCKER_BUILDKIT=1 this is not possible any more (read only fs). I was wondering if it is possible to start slapd so it does not start syncing?

3 5

OpenLDAP Self Registration/Password Reset Portal
by killian.greig＠gmail.com 11 Feb '25

11 Feb '25

I have been working on an OpenLDAP Self Registration/Password Reset Portal in Go that I will be releasing under a BSD license. Its still very much embryonic but if you are interested in taking an early look, please let me know. I'd love to get feedback on it. Kind regards, Killian

8 14

ldap acl matching
by Marc 09 Feb '25

09 Feb '25

olcAccess: {9} to dn.subtree="...... by ssf=256 set="([ldap:///o=XXXX,ou=aaaa,dc=bbbbb,dc=cccc,dc=ddddd??sub?(cn=eeee)])/member & user" search by ssf=256 set="([ldap:///o=YYYY,ou=aaaa,dc=bbbbb,dc=cccc,dc=ddddd??sub?(cn=eeee)])/member & user" search by ssf=256 set="([ldap:///o=ZZZZ,ou=aaaa,dc=bbbbb,dc=cccc,dc=ddddd??sub?(cn=eeee)])/member & user" search Currenlty I have the above rules which seem to work. But for every entry in ou=aaaa I need to manually add an acl line. How can I rewrite this to 1 line that matches XXX, YYYY, ZZZZ and anything else I add in ou=aaaa?

1 0

Re: OpenLDAP 2.6 Long Term Support Announcement
by Geert Hendrickx 07 Feb '25

07 Feb '25

Hi What is now the status of OpenLDAP 2.5 / 2.6 / 2.7 ? The website still lists 2.5.x as the current LTS release, and 2.6.x as the Feature Release. Has the below plan been delayed, or is the website just not up to date? Thanks for any clarification Geert On Sat, Aug 10, 2024 at 15:24:56 +0000, project(a)openldap.org wrote: > The OpenLDAP Project is pleased to announce the promotion of OpenLDAP > 2.6 from Feature Release to Long Term Support (LTS) Release, effective > January, 2025. It is now the recommended OpenLDAP version for > deployments that prioritize stability over features. The projected > lifespan for OpenLDAP 2.6 as the LTS release is five years. > > OpenLDAP 2.5 is now in its end of life stage and, at the discretion of > the Project, will receive critical fixes until January 15, 2027. After > that it will be designated as a historical release and no longer > supported or maintained by the Project. Users are encouraged to develop > a plan that will help them upgrade quickly to the new LTS version so > that they can continue on a supported release. > > OpenLDAP 2.7 is the new Feature Release and will see its first public > availability in the fall of 2024. > > ------------- > Compatibility > ------------- > > Replication: > Replication compatibility between OpenLDAP 2.5 and 2.6 is excellent. > The Project expects this to remain the case throughout the remaining > end-of-life stage of OpenLDAP 2.5. > > Configuration Files: > Configuration file compatibility between OpenLDAP 2.5 and 2.6 is > excellent, but may require some manual intervention at upgrade time, > particularly if you are using the OpenLDAP Load Balancer daemon. > > > ---------------------- > Additional Information > ---------------------- > > * The OpenLDAP Release Maintenance Policy can be found at > https://lists.openldap.org/hyperkitty/list/openldap-announce@openldap.org/t… > > * Notes covering upgrading from OpenLDAP 2.5 to 2.6 can be found at > https://www.openldap.org/doc/admin26/appendix-upgrading.html >

2 1

ldap vs db auth
by Marc 06 Feb '25

06 Feb '25

I was actually wondering how ldap compares to mariadb or other databases for authentication. Has anyone actually tested this?

2 1

Re: consumer replication net recovering
by Suresh Veliveli 17 Jan '25

17 Jan '25

Ok. I will send you the conf files (minus creds). Can I send them directly to you? Thanks, Suresh On Fri, Jan 17, 2025 at 3:01 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Friday, January 17, 2025 2:45 PM -0500 Suresh Veliveli > <Suresh.Veliveli(a)georgetown.edu> wrote: > > > > > Hi Quanah, > > > > > > Understood. Unfortunately, we are experiencing the issue. Here is my > > configuration. > > > > > > On Master: > > database mdb > > suffix "dc=georgetown,dc=edu" > > . > > dbnosync FALSE > > checkpoint 128 5 > > maxsize 108993459200 > > > > > > > ># Replication > > overlay syncprov > > syncprov-checkpoint 10 5 > > syncprov-sessionlog 100 > > > > > > > > On the Replica: > > syncrepl rid=132 > > provider=ldaps://aaa-master-1.uis.georgetown.edu:636/ > > type=refreshAndPersist > > > > keepalive=300:5:5 > > retry="5 5 300 +" > > > > > > How do we go about fixing this? > > Looks like you're using the deprecated slapd.conf files, which can have > interesting issues because they may not properly order directives. > Without > the full slapd.conf for both provider and consumer (minus sensitive data > like passwords), there's not a lot for me to go off of here. > > --Quanah > > > > -- Suresh Veliveli Sr. UNIX Systems Engineer Georgetown University University Information Services | Security Infrastructure and Policy-Identity and Collaboration 202-262-6676 (cell) | 202-687-3108 (work)

2 1

Re: consumer replication net recovering
by Suresh Veliveli 17 Jan '25

17 Jan '25

Hi Quanah, Understood. Unfortunately, we are experiencing the issue. Here is my configuration. *On Master:* database mdb suffix "dc=georgetown,dc=edu" . dbnosync FALSE checkpoint 128 5 maxsize 108993459200 # Replication overlay syncprov syncprov-checkpoint 10 5 syncprov-sessionlog 100 *On the Replica:* syncrepl rid=132 provider=ldaps://aaa-master-1.uis.georgetown.edu:636/ type=refreshAndPersist keepalive=300:5:5 retry="5 5 300 +" How do we go about fixing this? Thanks, Suresh On Fri, Jan 17, 2025 at 2:30 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Friday, January 17, 2025 10:51 AM -0700 Thomas Pritchard > <pritchardtw(a)gmail.com> wrote: > > > > > I have not experienced the master crashing but I have also experienced > > stalled replication regularly over the last 2 years. We've been on 2.46 > > and have keep alive enabled. We were hoping an upgrade would resolve the > > problem but it seems to exist on latest versions as well. I am also on > > aws ec2 instances. > > > I've been running OpenLDAP in AWS on EC2 instances for the last 3 years at > two different companies, and have never encountered this behavior. > > --Quanah > > -- Suresh Veliveli Sr. UNIX Systems Engineer Georgetown University University Information Services | Security Infrastructure and Policy-Identity and Collaboration 202-262-6676 (cell) | 202-687-3108 (work)

2 1

Re: consumer replication not recovering
by Suresh Veliveli 17 Jan '25

17 Jan '25

Hi Quanah, You are correct. I misspoke. We ran "bdb" in OpenLDAP: slapd 2.4.50 (Aug 6 2020 11:11:46). We switched to "mdb" when we went from 2.4.50 to 2.6.x version. The upgrade path, as mentioned, was a clean install of 2.6.x and export of db (slapcat) and import(slapadd). Regards, Suresh On Fri, Jan 17, 2025 at 12:48 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Monday, January 6, 2025 6:47 PM -0500 Suresh Veliveli > <Suresh.Veliveli(a)georgetown.edu> wrote: > > > > > It was "bdb". For migration, we did a clean install, used "slapcat" to > > export the db and "slapadd" to import. We used this procedure a > > number of times in the past when we switched OS, for upgrades etc. Do > > you have a recommended procedure in mind? > > >> We did an upgrade from 2.6.3 to 2.6.7 at the same time, changing the > >> backend db to "mdb". I think that's when we started to notice that > >> consumer replication is not recovering. So we upgraded again to 2.6.8 to > >> now 2.6.9. > > > There was no bdb backend in the 2.6 series. It was removed after the 2.4 > series, so the upgrade route you describe is not feasible. > > > --Quanah > > > > -- Suresh Veliveli Sr. UNIX Systems Engineer Georgetown University University Information Services | Security Infrastructure and Policy-Identity and Collaboration 202-262-6676 (cell) | 202-687-3108 (work)

1 0

Re: consumer replication not recovering
by Suresh Veliveli 17 Jan '25

17 Jan '25

It was "bdb". For migration, we did a clean install, used "slapcat" to export the db and "slapadd" to import. We used this procedure a number of times in the past when we switched OS, for upgrades etc. Do you have a recommended procedure in mind? Regards, Suresh On Mon, Jan 6, 2025 at 6:36 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Monday, January 6, 2025 10:33 AM -0500 Suresh Veliveli > <Suresh.Veliveli(a)georgetown.edu> wrote: > > > > > We just had another instance like this. Any suggestions? > > > > > > Thanks, > > Suresh > > > > > > On Fri, Jan 3, 2025 at 4:52 PM Suresh Veliveli > > <Suresh.Veliveli(a)georgetown.edu> wrote: > > > > > > > > We did an upgrade from 2.6.3 to 2.6.7 at the same time, changing the > > backend db to "mdb". I think that's when we started to notice that > > consumer replication is not recovering. So we upgraded again to 2.6.8 to > > now 2.6.9. > > What backend were you using on 2.6.3 before migrating to mdb? At this > point, I'd suspect your migration may not have been executed correctly. > > --Quanah > -- Suresh Veliveli Sr. UNIX Systems Engineer Georgetown University University Information Services | Security Infrastructure and Policy-Identity and Collaboration 202-262-6676 (cell) | 202-687-3108 (work)

2 1

question regarding olcAccess peername.ip="0.0.0.0%0.0.0.0"
by cyril＠stoll.info 17 Jan '25

17 Jan '25

Hi there My predecessor created a couple of ACLs that are IP based. For example this one: olcAccess: {10}to dn.subtree="ou=something,dc=domain,dc=tld" by peername.ip="0.0.0.0%0.0.0.0" none by * +0 break Unfortunately I can't find any hints what "0.0.0.0%0.0.0.0" means. Can anyone explain that? The only part of the documentation where 0.0.0.0 occurs is in "20.4.4. Listener". In that case it looks to me like 0.0.0.0 is actually the localhost. In other areas (e.g. some Firewalls) 0.0.0.0 is the WAN/Internet which is pretty much the opposite of localhost. Since the subnetmask in the ACL is also 0.0.0.0 I assume that the whole construct peername.ip="0.0.0.0%0.0.0.0" means basically "any" IP. But in that case it does not make a lot of sense to me to even have that in the ACL. However there are a lot of configs leftover from my predecessor that don't make a lot of sense to me, so there's that. Thanks for any hints/explanations and best regards, Cyril

4 7

LMDB: Questions about the MDB_NOSYNC and MDB_MAPASYNC flags
by chris＠christrenkamp.com 16 Jan '25

16 Jan '25

Hi, I have several questions about the environment options in mdb_env_open. * MDB_NOSYNC states that as long as the filesystem preserves the write order, the database will lose durability, but preserve ACI. If we're using EXT4, does that mean we must mount the filesystem with "data=ordered" so LMDB will preserve ACI when used in combination with MDB_NOSYNC? Are there any other mount options we should use so we don't lose ACI? * MDB_MAPASYNC states it has the same corruption potential as MDB_NOSYNC. Does it preserve ACI if the filesystem preserves the write order like MDB_NOSYNC? * The docs states that (MDB_MAPASYNC | MDB_WRITEMAP) may be preferable over MDB_NOSYNC. When would you want to use one over the other? Is there a good rule of thumb to follow if you have to use one of these options? Thanks

1 0

acl question
by Frédéric Goudal 13 Jan '25

13 Jan '25

Hello, I’m working on the acl on my ldap, and I have found a rule that puzzle me on it’s last statement : by * +0 break Well as 0 means no access what does +0 mean ? On my opinion it does nothing and the statement is equivalent to : by * break Am I correct or do I miss something ? f.g. — Frédéric Goudal Ingénieur Système, DSI Bordeaux-INP +33 556 84 23 11

2 2

LDAP Tools don't use LDAP.conf
by maudez.eric＠neuf.fr 13 Jan '25

13 Jan '25

I notice that the ldap.conf file is not used with commands ldapsearch, ldapwhoami (ldap tools). An environment variable (LDAPCONF) was set and pointing to the file (/etc/openldap/ldap.conf) but it doesn't work. On the other hand, using the information provided in an ldaprc file works. How to ensure the LDAP.conf file is taken into account because I need it for a mutual authentication connection with the use of LDAPS for SASL EXTERNAL. I'm using an openldap 2.6.6 version on CentOS.

9 23

Re: [EXT] Re: consumer replication not recovering
by Suresh Veliveli 11 Jan '25

11 Jan '25

I got the debug info this time. Whenever I restart a stuck replica it is crashing the master. Hope the following will be helpful. Regards, Suresh ------------------- Using host libthread_db library "/lib64/libthread_db.so.1". Core was generated by `/var/services/openldap/libexec/slapd -h ldap://*:389 ldaps://*:636 -f /var/serv'. Program terminated with signal SIGSEGV, Segmentation fault. #0 connection_abandon (c=0x7f27364cf0e8) at connection.c:714 714 op.orn_msgid = o->o_msgid; [Current thread is 1 (Thread 0x7f0d98cf5640 (LWP 2460))] (gdb) bt full #0 connection_abandon (c=0x7f27364cf0e8) at connection.c:714 rs = {sr_type = REP_RESULT, sr_tag = 0, sr_msgid = 0, sr_err = 0, sr_matched = 0x0, sr_text = 0x0, sr_ref = 0x0, sr_ctrls = 0x0, sr_un = {sru_search = {r_entry = 0x0, r_attr_flags = 0, r_operational_attrs = 0x0, r_attrs = 0x0, r_nentries = 0, r_v2ref = 0x0}, sru_sasl = {r_sasldata = 0x0}, sru_extended = {r_rspoid = 0x0, r_rspdata = 0x0}}, sr_flags = 0} o = 0x7f0d8413eab0 next = 0x7f0d74137490 op = {o_hdr = 0x7f0d98cf45e0, o_tag = 80, o_time = 0, o_tincr = 0, o_tusec = 0, o_qtime = {tv_sec = 0, tv_usec = 0}, o_bd = 0x0, o_req_dn = {bv_len = 0, bv_val = 0x0}, o_req_ndn = {bv_len = 0, bv_val = 0x0}, o_request = {oq_add = { rs_modlist = 0x0, rs_e = 0x0}, oq_bind = {rb_method = 0, rb_cred = {bv_len = 0, bv_val = 0x0}, rb_edn = {bv_len = 0, bv_val = 0x0}, rb_ssf = 0, rb_mech = {bv_len = 0, bv_val = 0x0}}, oq_compare = {rs_ava = 0x0}, oq_modify = { rs_mods = {rs_modlist = 0x0, rs_no_opattrs = 0 '\000'}, rs_increment = 0}, oq_modrdn = {rs_mods = {rs_modlist = 0x0, rs_no_opattrs = 0 '\000'}, rs_deleteoldrdn = 0, rs_newrdn = {bv_len = 0, bv_val = 0x0}, rs_nnewrdn = {bv_len = 0, bv_val = 0x0}, rs_newSup = 0x0, rs_nnewSup = 0x0, rs_newDN = {bv_len = 0, bv_val = 0x0}, rs_nnewDN = {bv_len = 0, bv_val = 0x0}}, oq_search = {rs_scope = 0, rs_deref = 0, rs_slimit = 0, rs_tlimit = 0, rs_limit = 0x0, rs_attrsonly = 0, rs_attrs = 0x0, rs_filter = 0x0, rs_filterstr = {bv_len = 0, bv_val = 0x0}}, oq_abandon = { rs_msgid = 0}, oq_cancel = {rs_msgid = 0}, oq_extended = {rs_reqoid = {bv_len = 0, bv_val = 0x0}, rs_flags = 0, rs_reqdata = 0x0}, oq_pwdexop = {rs_extended = {rs_reqoid = {bv_len = 0, bv_val = 0x0}, rs_flags = 0, rs_reqdata = 0x0}, rs_old = {bv_len = 0, bv_val = 0x0}, rs_new = {bv_len = 0, bv_val = 0x0}, rs_mods = 0x0, rs_modtail = 0x0}}, o_abandon = 0, o_cancel = 0, o_groups = 0x0, o_do_not_cache = 0 '\000', o_is_auth_check = 0 '\000', o_dont_replicate = 0 '\000', o_acl_priv = ACL_NONE, o_nocaching = 0 '\000', o_delete_glue_parent = 0 '\000', o_no_schema_check = 0 '\000', o_no_subordinate_glue = 0 '\000', o_ctrlflag = '\000' <repeats 31 times>, o_controls = 0x0, o_authz = {sai_method = 0, sai_mech = {bv_len = 0, bv_val = 0x0}, sai_dn = {bv_len = 0, bv_val = 0x0}, sai_ndn = {bv_len = 0, bv_val = 0x0}, sai_ssf = 0, sai_transport_ssf = 0, sai_tls_ssf = 0, sai_sasl_ssf = 0}, o_ber = 0x0, o_res_ber = 0x0, o_callback = 0x0, o_ctrls = 0x0, o_csn = {bv_len = 0, bv_val = 0x0}, o_private = 0x0, o_extra = {slh_first = 0x0}, o_next = { stqe_next = 0x0}} ohdr = {oh_opid = 0, oh_connid = 143657, oh_conn = 0x7f27364cf0e8, oh_msgid = 0, oh_protocol = 0, oh_tid = 0, oh_threadctx = 0x0, oh_tmpmemctx = 0x0, oh_tmpmfuncs = 0x0, oh_counters = 0x0, oh_log_prefix = '\000' <repeats 255 times>} #1 0x00000000004460d5 in connection_closing (c=0x7f27364cf0e8, why=0x5db380 <conn_lost_str> "connection lost") at connection.c:785 __PRETTY_FUNCTION__ = "connection_closing" #2 0x0000000000447d18 in connection_read (s=25, cri=0x7f0d98cf49a0) at connection.c:1453 rc = -2 c = 0x7f27364cf0e8 __PRETTY_FUNCTION__ = "connection_read" #3 0x000000000044741b in connection_read_thread (ctx=0x7f0d98cf49f0, argv=0x19) at connection.c:1260 rc = 0 cri = {op = 0x7f0d74137490, func = 0x0, arg = 0x0, ctx = 0x7f0d98cf49f0, nullop = 0} s = 25 --Type <RET> for more, q to quit, c to continue without paging--c #4 0x00007f274ee74bed in ldap_int_thread_pool_wrapper (xpool=0xc9b0c0) at tpool.c:1059 pq = 0xc9b0c0 pool = 0xc9afc0 task = 0x7f0da01c5960 work_list = 0xc9b130 ctx = {ltu_pq = 0xc9b0c0, ltu_id = 139696375027264, ltu_key = {{ltk_key = 0x4be35e <slap_sl_mem_init>, ltk_data = 0x7f0d90000b60, ltk_free = 0x4be177 <slap_sl_mem_destroy>}, {ltk_key = 0x4466db <operation_counter_init>, ltk_data = 0x7f0d90100bb0, ltk_free = 0x44652a <conn_counter_destroy>}, {ltk_key = 0xf79390, ltk_data = 0x7f0d90101170, ltk_free = 0x539d95 <mdb_reader_free>}, {ltk_key = 0x519179 <search_stack>, ltk_data = 0x7f0d8a5fe010, ltk_free = 0x519155 <search_stack_free>}, {ltk_key = 0x515d3d <scope_chunk_get>, ltk_data = 0x7f0d981f4010, ltk_free = 0x515cf3 <scope_chunk_free>}, {ltk_key = 0x46103b <slap_op_free>, ltk_data = 0x7f0dc8694410, ltk_free = 0x460f8b <slap_op_q_destroy>}, {ltk_key = 0x0, ltk_data = 0x0, ltk_free = 0x0} <repeats 26 times>}} kctx = 0x0 i = 32 keyslot = 521 hash = 1213313545 pool_lock = 0 freeme = 0 __PRETTY_FUNCTION__ = "ldap_int_thread_pool_wrapper" #5 0x00007f274e489c02 in start_thread () from /lib64/libc.so.6 No symbol table info available. #6 0x00007f274e50ec40 in clone3 () from /lib64/libc.so.6 No symbol table info available. (gdb) On Wed, Jan 8, 2025 at 7:38 AM Suresh Veliveli < Suresh.Veliveli(a)georgetown.edu> wrote: > Hi Ulrich, > > Quanah helped to build one with debug and not stripped. > > Thanks, > Suresh > > On Wed, Jan 8, 2025 at 2:29 AM Windl, Ulrich <u.windl(a)ukr.de> wrote: > >> Hi! >> >> >> >> I don’t know the details of the build process, but sometimes RPM strips >> the binaries. Otherwis you could look for strip or a corresponding option >> in the Makefiles. >> >> >> >> Ulrich >> >> >> >> *From:* Suresh Veliveli <Suresh.Veliveli(a)georgetown.edu> >> *Sent:* Tuesday, January 7, 2025 8:22 PM >> *To:* Quanah Gibson-Mount <quanah(a)fast-mail.org> >> *Cc:* Windl, Ulrich <u.windl(a)ukr.de> >> *Subject:* [EXT] Re: consumer replication not recovering >> >> >> >> I used "make STRIP="" install" but it still installed the stripped >> version. I understand your suggestion. I don't have the appropriate access >> on my end to install Symas packages. I can only install the ones I build >> with a prefix limited to /var/services directory. >> >> >> >> Thanks, >> Suresh >> >> >> >> On Tue, Jan 7, 2025 at 2:07 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> >> wrote: >> >> >> >> --On Tuesday, January 7, 2025 11:22 AM -0500 Suresh Veliveli >> <Suresh.Veliveli(a)georgetown.edu> wrote: >> >> > >> > I downloaded the src - openldap-apkg26.tar.gz, removed the optimization >> > flags (export CFLAGS='-g'), configure, build and install, but still >> > installed the stripped version. Am I missing something? >> > >> > >> > [root@aaa-dev-gcp-1 libexec]# file slapd >> > slapd: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically >> > linked, interpreter /lib64/ld-linux-x86-64.so.2, >> > BuildID[sha1]=547e20101751207ad48cc96006ea51e7610c7a1c, for GNU/Linux >> > 3.2.0, stripped >> >> This is basic software building, but: >> >> make STRIP="" install >> >> I still suggest using the Symas packages over building things yourself. >> >> --Quanah >> >> >> >> >> -- >> >> Suresh Veliveli >> >> Sr. UNIX Systems Engineer >> >> Georgetown University >> >> University Information Services | Security Infrastructure and >> Policy-Identity and Collaboration >> >> 202-262-6676 (cell) | 202-687-3108 (work) >> > > > -- > Suresh Veliveli > Sr. UNIX Systems Engineer > Georgetown University > University Information Services | Security Infrastructure and > Policy-Identity and Collaboration > 202-262-6676 (cell) | 202-687-3108 (work) > -- Suresh Veliveli Sr. UNIX Systems Engineer Georgetown University University Information Services | Security Infrastructure and Policy-Identity and Collaboration 202-262-6676 (cell) | 202-687-3108 (work)

1 0

Unable to get the contextCSN
by Frédéric Goudal 08 Jan '25

08 Jan '25

Hello, I just have build a new ldap server @(#) $OpenLDAP: slapd 2.6.8 (Jul 23 2024 09:45:55) $ It is an attenpt to do a partial replication from another ldap server. The objects seem to be synchronized in the logs I have lines like slap_queue_csn: queueing 0x77bfe8109e30 20241218104201.919382Z#000000#00a#000000 where the csn is correct. What is strange is that if I try to get the contextCSN, from the directoryI have no value returned : /usr/local/bin/ldapsearch -H ldap://ldapext2024.dmze.ipb.fr -x -s base -b dc=ipb,dc=fr contextCSN # extended LDIF # # LDAPv3 # base <dc=ipb,dc=fr> with scope baseObject # filter: (objectclass=*) # requesting: contextCSN # # search result search: 2 result: 0 Success # numResponses: 1 The olcSyncrepl value is : {0}rid=430 provider=ldap://<provider> binddn="uid=ldapsync,ou=people,dc=ipb,dc=fr" bindmethod=simple credentials=secret filter="(| (entryDN:dnSubtreeMatch:=ou=groups,dc=ipb,dc=fr) (entryDN:dnSubtreeMatch:=ou=people,dc=ipb,dc=fr))" searchbase="dc=ipb,dc=fr" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" attrs="uid,sn,givenName,userPassword,mail,member,ipbCompteValide,ipbServiceAllow,ipbServiceDeny,ipbPupi" logbase=cn=accesslog type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 +" timeout=1 exattrs=hasSubordinates I have several other secondary ldap from the same source, with the same confiiguration, except the filter is (objectClass=*) and there is no attrs value. I suspect the error is on the attrs or filter but what do I miss ? thanks in advance f.g. — Frédéric Goudal Ingénieur Système, DSI Bordeaux-INP +33 556 84 23 11

3 6

Enabling PPolicy on a live LDAP...
by Marco Gaiarin 08 Jan '25

08 Jan '25

I need to enable PPolicy overlay to control passord policy on an existing LDAP installation. I have to expect some 'breakage'? Or policy attributes get defined only explicitly and have decent default? Speaking plainly: i have to expect to be cut off of my LDAP account immediately because i have my password old? Thanks. --

2 1

Re: [EXT] Re: Replication issues with openldap 2.5 {resolved}
by Ulises Gonzalez Horta 07 Jan '25

07 Jan '25

Can you please give an explanation of the full meaning?? That way we can learn because online it refers to invalid credentials, providing the user is good, then the password is what left over See this example where I intentionally put the wrong password root@nm03-lab-roc1:~/openldap_config_tree/2.1_replication# ldapsearch -Z -LLL -H ldap://servert:389 -D "uid=user,ou=employees,dc=metrocast,dc=net" -W -b "ou=employees,dc=metrocast,dc=net" "(mail=* ugonzalezhorta(a)breezeline.com)" cn Enter LDAP Password: ldap_bind: Invalid credentials (49) Ulises Gonzalez Horta Lead Linux Engineer C: 786 450 2970/ 240 727 6267 E: ugonzalezhorta(a)breezeline.com <jsutherland1(a)breezeline.com> On Fri, Jan 3, 2025 at 2:16 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Friday, January 3, 2025 8:49 AM -0500 Ulises Gonzalez Horta > <ugonzalezhorta(a)breezeline.com> wrote: > > > > > > > Yeah, the error message was misleading here, error 49 is wrong password, > > but I knew for sure the password was right. > > Maybe a log entry as the one you suggested will help you fast pinpoint > > the issue > > That's not what result code 49 means. > > --Quanah > >

2 2

monitoring MMR sync
by Dave 07 Jan '25

07 Jan '25

Hello Everyone, Hope you are enjoying the day. Was curious what people are doing to monitor their MMR clusters being out of sync. At least the implementation we found and have been trying is using telegraf and the [ldap_org](https://github.com/falon/CSI-telegraf-plugins/blob/master/plugins… plugin to gather all objects on each ldap master and compare their count. How is the community doing it? Any better way to go about this? Any input is appreciated! Best, Dave

6 7

Re: consumer replication not recovering
by Suresh Veliveli 07 Jan '25

07 Jan '25

We did an upgrade from 2.6.3 to 2.6.7 at the same time, changing the backend db to "mdb". I think that's when we started to notice that consumer replication is not recovering. So we upgraded again to 2.6.8 to now 2.6.9. Thanks, Suresh On Fri, Jan 3, 2025 at 2:19 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Friday, January 3, 2025 7:52 AM -0500 Suresh Veliveli > <Suresh.Veliveli(a)georgetown.edu> wrote: > > > > > > > The OS is Rock9, AWS EC2 instance. > > Question - Was this working on an earlier OpenLDAP version, and just > started having issues with 2.6.9? I was re-reading your initial post and > that wasn't clear. > > Thanks! > > --Quanah > > -- Suresh Veliveli Sr. UNIX Systems Engineer Georgetown University University Information Services | Security Infrastructure and Policy-Identity and Collaboration 202-262-6676 (cell) | 202-687-3108 (work)

2 2

Re: Replication issues with openldap 2.5
by Ulises Gonzalez Horta 03 Jan '25

03 Jan '25

Thanks for replying, from what I see in your answer, I have already distracted a and b, I can say c is also ruled out but I would like to double check it, maybe acls are not processing in the expected order. What is the best way to troubleshoot acls?? Any recommended log level? Ulises Gonzalez Horta Lead Linux Engineer C: 786 450 2970/ 240 727 6267 E: ugonzalezhorta(a)breezeline.com <jsutherland1(a)breezeline.com> On Fri, Dec 27, 2024 at 2:09 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Friday, December 27, 2024 10:34 AM -0500 Ulises Gonzalez Horta > <ugonzalezhorta(a)breezeline.com> wrote: > > > > > > > Good morning > > > > I am trying to setup a replication in ldap 2.5, using syncrepl, I have a > > provider server and a consumer, both of the servers are running 2.5.11 > > from Ubuntu 22.04, I followed the admin guide chapter 18.3.1 to do the > > configuration. I have some information on the provider that is > > successfully being replicated to the consumer without any errors > > > > > > Consumer configuration > > ldapsearch -Y EXTERNAL -H ldapi:/// -b cn=config olcSyncRepl > > olcUpdateref > > dn: olcDatabase={1}mdb,cn=config > > olcSyncrepl: {0}rid=100 provider=ldap://provider:389 type=refr > > eshOnly interval=00:00:05:00 retry="300 +" > > searchbase="dc=metrocast,dc=net" f > > ilter="(|(entryDN:=dc=metrocast,dc=net)(entryDN:dnOneLevelMatch:=dc=met > > > Why do you have such a complicated filter? > > > > > On the consumer this same query returns error 49 > > > > ldapsearch -Z -LLL -H ldap://providert:389 -D > > "uid=user1,ou=employees,dc=metrocast,dc=net" -W -b > > "ou=employees,dc=metrocast,dc=net" "(mail=*pepe(a)breezeline.com) > > Either: > > a) The user entry doesn't exist > b) The user entry is missing the userPassword attribute > c) The ACLs don't allow anonymous "auth" access on the userPassword > attribute > > --Quanah > > >

5 11

Hello, I have an issue with the configuration of pam_setquota.so. I added the following quota schema:
by Rodrigo Prieto 03 Jan '25

03 Jan '25

# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 8fd665e7 dn: cn=quota,cn=schema,cn=config objectClass: olcSchemaConfig cn: quota olcAttributeTypes: {0}( 1.3.6.1.4.1.19937.1.1.1 NAME 'quota' DESC 'Quotas (FileSystem:BlocksSoft,BlocksHard,InodesSoft,InodesHard)' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{255} ) olcObjectClasses: {0}( 1.3.6.1.4.1.19937.1.2.1 NAME 'systemQuotas' DESC 'System Quotas' SUP posixAccount AUXILIARY MUST uid MAY quota ) I create a user, and the attributes are created correctly: objectclass: systemQuotas objectclass: posixAccount objectclass: inetOrgPerson objectclass: organizationalPerson objectclass: person quota: /home,500,510,0,0 Configuration of /etc/pam.d/common-session: # here are the per-package modules (the "Primary" block) session [default=1] pam_permit.so # here's the fallback if no module succeeds session requisite pam_deny.so # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around session required pam_permit.so # and here are more per-package modules (the "Additional" block) session required pam_unix.so session [success=ok default=ignore] pam_ldap.so minimum_uid=1000 session optional pam_systemd.so session optional pam_mkhomedir.so skel=/etc/skel umask=077 session required pam_setquota.so # end of pam-auth-update config When logging in with an LDAP user, the following appears in Debian logs: pam_setquota(login:session): no limits defined in configuration for user zprieto on /dev/vda5. I don’t know what is missing that prevents the user’s attributes from being read. Thank you very much.

2 1

Replication issues with openldap 2.5
by Ulises Gonzalez Horta 27 Dec '24

27 Dec '24

Good morning I am trying to setup a replication in ldap 2.5, using syncrepl, I have a provider server and a consumer, both of the servers are running 2.5.11 from Ubuntu 22.04, I followed the admin guide chapter 18.3.1 to do the configuration. I have some information on the provider that is successfully being replicated to the consumer without any errors Consumer configuration ldapsearch -Y EXTERNAL -H ldapi:/// -b cn=config olcSyncRepl olcUpdateref dn: olcDatabase={1}mdb,cn=config olcSyncrepl: {0}rid=100 provider=ldap://provider:389 type=refr eshOnly interval=00:00:05:00 retry="300 +" searchbase="dc=metrocast,dc=net" f ilter="(|(entryDN:=dc=metrocast,dc=net)(entryDN:dnOneLevelMatch:=dc=metrocast ,dc=net)(&(entryDN:dnSubtreeMatch:=dc=metrocast,dc=net)(entrydn:dnSubtreeMatc h:=ou=Boxes,dc=metrocast,dc=net))(&(entryDN:dnSubtreeMatch:=dc=metrocast,dc=n et)(entrydn:dnSubtreeMatch:=ou=RadiusGroups,dc=metrocast,dc=net))(&(entryDN:d nSubtreeMatch:=dc=metrocast,dc=net)(entrydn:dnSubtreeMatch:=ou=group,dc=metro cast,dc=net))(&(entryDN:dnSubtreeMatch:=dc=metrocast,dc=net)(entryDN:distingu ishedNameMatch:=ou=People,dc=metrocast,dc=net))(&(entryDN:dnSubtreeMatch:=dc= metrocast,dc=net)(entryDN:dnSubtreeMatch:=ou=employees,dc=metrocast,dc=net))) " timelimit=unlimited sizelimit=unlimited bindmethod=simple binddn="cn=user,ou=boxes,dc=metrocast,dc=net" credentials="xxxx" start tls=critical tls_cacertdir="/etc/ldap/certs" olcUpdateRef: ldap://ldap-write.metrocast.net:389 I can confirm the DIT is present on the consumer and the values matches the provider item by item, including the encrypted passwords, The issue I am having is that a query that runs on the provider without any issue is failing to run on the consumer with error 49 invalid credentials, but I do know for sure that the provided credentials are good, I even did a tcpdump and confirmed they are fine On the provider a query similar to this one runs fine and returns a result ldapsearch -Z -LLL -H ldap://providert:389 -D "uid=user1,ou=employees,dc=metrocast,dc=net" -W -b "ou=employees,dc=metrocast,dc=net" "(mail=*pepe(a)breezeline.com) On the consumer this same query returns error 49 ldapsearch -Z -LLL -H ldap://providert:389 -D "uid=user1,ou=employees,dc=metrocast,dc=net" -W -b "ou=employees,dc=metrocast,dc=net" "(mail=*pepe(a)breezeline.com) I confirmed with ldapsearch -Y EXTERNAL -H ldapi:/// ..... that the information for user1 is exactly the same in the provider and the consumer for all the attributes including the passwords. Tcpdump confirmed that I am sending the right password, doing -W or -w $password gives the same result. For any user I use to run the query I get exactly the same error 49, I did verify that ACLs are not blocking the query. Is there anything else I should check?? any log level that could help me identify where the error is?? Currently my loglevel is olcLogLevel: 128 256 1024 This is a dev environment so I can do changes at will. Thanks and happy new year Ulises Gonzalez Horta Lead Linux Engineer C: 786 450 2970/ 240 727 6267 E: ugonzalezhorta(a)breezeline.com <jsutherland1(a)breezeline.com>

2 1

Re: consumer replication net recovering
by Suresh Veliveli 23 Dec '24

23 Dec '24

Pretty sure It didn't hit the defined maxsize. -rw-------. 1 ldap_svc ldap_svc 108993459200 Dec 20 17:36 data.mdb du -c -h data.mdb 5.2G data.mdb 5.2G total I don't see any "syncrepl_sync" references in the replica logs. The loglevel is "stats sync". Am I missing something? Thanks, Suresh On Fri, Dec 20, 2024 at 5:15 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Friday, December 20, 2024 2:07 PM -0500 Suresh Veliveli > <Suresh.Veliveli(a)georgetown.edu> wrote: > > > > > I do have sync logging enabled. This is the last record in the log file, > > and after that, nothing. It isn't attempting to get changes. > > One thing I'd confirm is that you haven't hit the defined maxsize of your > MDB database. > > Also, I don't see the result in what you posted for the operation. You > seem to have excluded all the "syncrepl_sync" log lines which are critical. > > --Quanah > > -- Suresh Veliveli Sr. UNIX Systems Engineer Georgetown University University Information Services | Security Infrastructure and Policy-Identity and Collaboration 202-262-6676 (cell) | 202-687-3108 (work)

2 2

Re: consumer replication net recovering
by Suresh Veliveli 20 Dec '24

20 Dec '24

I do have sync logging enabled. This is the last record in the log file, and after that, nothing. It isn't attempting to get changes. Log on the replica: Dec 12 08:59:30 aaa-prod-gcp-9 slapd[4165]: slap_queue_csn: queueing 0x7f67101bc860 20241212135921.652395Z#000000#000#000000 Dec 12 08:59:30 aaa-prod-gcp-9 slapd[4165]: slap_graduate_commit_csn: removing 0x7f67101bc860 20241212135921.652395Z#000000#000#000000 Dec 12 08:59:30 aaa-prod-gcp-9 slapd[4165]: slap_queue_csn: queueing 0x7f67102311b0 20241212135921.652395Z#000000#000#000000 Dec 12 08:59:30 aaa-prod-gcp-9 slapd[4165]: slap_graduate_commit_csn: removing 0x7f67102311b0 2*0241212135921.652395Z#000000#000#000000* *Log on the master:* Dec 12 08:59:30 aaa-prod-master-1 slapd[4072]: conn=936345 op=1 syncprov_sendresp: cookie=rid=129,csn=20241212135921.637305Z#000000#000#000000 *Dec 12 08:59:30 aaa-prod-master-1 slapd[4072]: conn=936345 op=1 syncprov_sendresp: cookie=rid=129,csn=20241212135921.652395Z#000000#000#000000* There is nothing in the log on the master or the replica after this entry. Regards, Suresh On Fri, Dec 20, 2024 at 1:40 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Friday, December 20, 2024 11:22 AM -0500 Suresh Veliveli > <Suresh.Veliveli(a)georgetown.edu> wrote: > > > > > > > > > Hi, > > > > > > We have a single master with multiple replicas. Our backend is mdb, and > > we are on the latest version, 2.6.9. The replication type > > is refreshAndPersist. Here is the relevant configuration. > > > > > > syncrepl rid=141 > > provider=ldaps://ldap-master.georgetown.edu:636/ > > type=refreshAndPersist > > > > .. > > .. > > keepalive=300:5:5 retry="5 5 300 +" > > > > > > > > This is now happening at regular intervals. When a consumer replication > > gets stuck, only a service restart seems to restart replication. > > > Need more information on what you mean by "getting stuck". Is it actually > attemping to get changes? Do you have sync logging enabled? If so, you > could see if that particular consumer is having an issue during > replication > and returning a non-zero result code as to why it's unable to proceed. Or > is it not establishing a replication connection at all? etc. > > --Quanah > > > -- Suresh Veliveli Sr. UNIX Systems Engineer Georgetown University University Information Services | Security Infrastructure and Policy-Identity and Collaboration 202-262-6676 (cell) | 202-687-3108 (work)

2 1

consumer replication net recovering
by Suresh Veliveli 20 Dec '24

20 Dec '24

Hi, We have a single master with multiple replicas. Our backend is mdb, and we are on the latest version, 2.6.9. The replication type is refreshAndPersist. Here is the relevant configuration. syncrepl rid=141 provider=ldaps://ldap-master.georgetown.edu:636/ type=refreshAndPersist .. .. keepalive=300:5:5 retry="5 5 300 +" This is now happening at regular intervals. When a consumer replication gets stuck, only a service restart seems to restart replication. ex: ldap-replica-1:1636 # requesting: contextCSN contextCSN: 20241212135921.652395Z#000000#000#000000 ldap-replica-1:2636 # requesting: contextCSN contextCSN: 20241220010002.746041Z#000000#000#000000 You can see the replica on port 1636 CSN is stuck at 20241212135921. Any thoughts? Thanks, -- Suresh Veliveli Sr. UNIX Systems Engineer Georgetown University University Information Services | Security Infrastructure and Policy-Identity and Collaboration 202-262-6676 (cell) | 202-687-3108 (work)

2 1

Replication Specifics and Clarification
by michael.miceli88＠gmail.com 19 Dec '24

19 Dec '24

Hi, this is my first post to this mailing list, so I apologize if this is in the wrong location. I have recently started replicating our openLdap database and as part of that I combed through the admin guide to get a better understanding. I believe I have a decent grasp on replication now, but I had a few clarifying questions to ensure I understand. 1. Firstly and least importantly, how is "present" in "present phase" pronounced? Is it present as a noun, e.g. these are things that are present in the database, or is it present like a verb, e.g. I'm presenting all the things in the database? 2. Besides not needing to send the entire object in the delete phase, is it true that delta-syncrRepl provides an additional benefit of having a persisted session log store, e.g. the session store can survive an openLdap reboot? I didn't see that explicitly mentioned in the admin guide, but it would seem to be to be true. Is it true? 3. Does having a session log configured make sense if delta-syncrepl is being used? I saw a non-authoritative guides saying it's nice to have just in case a fallback to syncrepl happens, but the admin guide doesn't do this anywhere, nor does it make sense to me since even if a consumer provides a stale session cookie, a present phase must occur regardless of a session log. 4. I found in a non-authoritative document online saying during the refresh stage, that either present or delete or both phases can occur. In what situation would both a present and a delete phase occur? Or is that document wrong? 5. Does the phrase "delete phase" feel confusingly named? I spent significant time trying to figure out how data would be synchronized when a non-stale cookie was provided by the consumer since I assumed the delete phase only handled deletes. It wasn't until I read this paragraph carefully in the admin guide. In fact, no where in the admin guide can I find explicit mention that adds occur in the delete phase as well. However, it can be inferred in the last sentence of the following quote. > The transmission of the updated entries in the delete phase is the same as in the present phase. The provider sends all the requested attributes of the entries updated within the search scope since the last synchronization to the consumer. In the delete phase, however, the provider sends a delete message for each entry deleted from the search scope, instead of sending present messages. The delete message consists only of the name of the entry and the synchronization control representing state delete. The new consumer copy can be determined by adding, modifying, and removing entries according to the synchronization control attached to the SearchResultEntry message.

3 3

Problem getting slapd-meta to work
by cyril＠stoll.info 18 Dec '24

18 Dec '24

Hi there Sorry for the long post however I aim to provide as much information as possible to help pinpoint the issue. Also sorry for any wrong wording as I am still a bit overwhelmed with OpenLDAP and struggle to understand everything I need. From my predecessor I inherited an OpenLDAP 2.4.x cluster running on RHEL 7. My job is to migrate this cluster to OpenLDAP 2.6.x on RHEL 8. The cluster consists of two provider and four consumer servers. The old cluster was based on self-compiled original OpenLDAP binaries. For the new cluster I am using the LTB version of OpenLDAP, currently with version 2.6.8. I also switched from HDB to MDB with the new cluster and am using Let's Encrypt instead of DigiCert certificates and upped the TLS version from 1.0 to 1.2. And for the default password hashing algorhythm I switched from SSHA to ARGON2. So there are lots of changes that might potentially influence the meta databases though I did not see anything that suggests this. The synchronisation of the normal databases between the provider servers and to the consumer servers is working fine. My problem is with the meta databases I try to build using slapd-meta. They are only needed on the consumer servers. Unfortunately the meta databases do not seem to be created or are not working as expected. On the old cluster I can ldapsearch in the meta databases and they show up as trees when connecting with Apache Directory Studio. On the new cluster I am setting up I don't see those meta trees in Apache Directory Studio and ldapsearches don't return any results. Furthermore slapcat on those databases returns the message "slapcat: database doesn't support necessary operations." The meta trees don't query external servers but suffixmassage locally present sub-trees. From what I've read this could also be accomplished with slapd-relay but the man page states that it is experimental. That is why I am trying the same way my predecessor did using slapd-meta. I temporarily set the loglevel to 4094 but even then did not see any hint on what goes wrong with those meta databases. By the way, when I do set the loglevel so high I can no longer connect using Apache Directory Studio, but that is not the issue I'm concerned about. Neither the documentation, nor the slapd-meta man page, nor the very few tutorials/stackexchange-posts/mailinglist-posts I found online about meta-back helped me in solving this issue. That is why I hope someone on this mailinglist can spot an issue in my configuration. Or point me to other resources/tutorials or share some debugging advice. For the purpose of sharing the configuration I omitted all the schemata and some of the ACLs. Also I removed the linebreaks so what belongs together is all on one line. Lastly I redacted any sensitive information. It is attached as a text/ldif file. Thanks a lot in advance and let me know if I need to share further information such as log entries etc. Best regards, Cyril

3 2

Replication Issue with OpenLDAP 2.6.3
by mridumit＠amdocs.com 18 Dec '24

18 Dec '24

Hi I am very new to OpenLDAP, and we have a multi master configuration with us and our replication is not working. The error we get in log file is mainly : slap_client_connect: URI=<provider url> DN="cn=<sample value>,dc=<sample value>,dc=<sample value>" ldap_sasl_bind_s failed (-1). Attaching below logs after starting slapd service , Could you please help us ? Oct 16 14:15:47 <our ldap host> slapd[853101]: @(#) $OpenLDAP: slapd 2.6.3 (Nov 15 2023 00:00:00) $#012#011openldap Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 11 (TLSProtocolMin 3.3) Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 12 (TLSCertificateFile <path to crt file>) Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 13 (TLSCertificateKeyFile <path to key file file>) Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 14 (TLSCipherSuite ECDHE-RSA-AES256-SHA) Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 17 (disallow bind_anon) Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 19 (require bind) Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 21 (security simple_bind=128) Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 23 (serverID 001) Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 23: SID=0x001 Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 25 (moduleload syncprov) Oct 16 14:15:47 <our ldap host> slapd[853101]: loaded module syncprov Oct 16 14:15:47 <our ldap host> slapd[853101]: module syncprov: null module registered Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 28 (database config) Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 29 (rootdn cn=admin,cn=config) Oct 16 14:15:47 <our ldap host> slapd[853101]: >>> dnPrettyNormal: <cn=admin,cn=config> Oct 16 14:15:47 <our ldap host> slapd[853101]: <<< dnPrettyNormal: <cn=admin,cn=config>, <cn=admin,cn=config> Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 30 (rootpw ***) Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 33 (database monitor) Oct 16 14:15:47 <our ldap host> slapd[853101]: >>> dnPrettyNormal: <cn=Monitor> Oct 16 14:15:47 <our ldap host> slapd[853101]: <<< dnPrettyNormal: <cn=Monitor>, <cn=monitor> Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 36 (database mdb) Oct 16 14:15:47 <our ldap host> slapd[853101]: mdb_db_init: Initializing mdb database Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 37 (suffix dc=<sample value>,dc=com) Oct 16 14:15:47 <our ldap host> slapd[853101]: >>> dnPrettyNormal: <dc=<sample value>,dc=com> Oct 16 14:15:47 <our ldap host> slapd[853101]: <<< dnPrettyNormal: <dc=<sample value>,dc=com>, <dc=<sample value>,dc=com> Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 38 (rootdn cn=Manager,dc=<sample value>,dc=com) Oct 16 14:15:47 <our ldap host> slapd[853101]: >>> dnPrettyNormal: <cn=Manager,dc=<sample value>,dc=com> Oct 16 14:15:47 <our ldap host> slapd[853101]: <<< dnPrettyNormal: <cn=Manager,dc=<sample value>,dc=com>, <cn=manager,dc=<sample value>,dc=com> Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 39 (rootpw ***) Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 40 (directory /home/ldap) Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 49 (syncrepl ***) Oct 16 14:15:47 <our ldap host> slapd[853101]: >>> dnNormalize: <cn=<sample value>,dc=<sample value>,dc=com> Oct 16 14:15:47 <our ldap host> slapd[853101]: <<< dnNormalize: <cn=<sample value>,dc=<sample value>,dc=com> Oct 16 14:15:47 <our ldap host> slapd[853101]: >>> dnNormalize: <dc=<sample value>,dc=com> Oct 16 14:15:47 <our ldap host> slapd[853101]: <<< dnNormalize: <dc=<sample value>,dc=com> Oct 16 14:15:47 <our ldap host> slapd[853101]: str2filter "(objectclass=*)" Oct 16 14:15:47 <our ldap host> slapd[853101]: begin get_filter Oct 16 14:15:47 <our ldap host> slapd[853101]: PRESENT Oct 16 14:15:47 <our ldap host> slapd[853101]: end get_filter 0 Oct 16 14:15:47 <our ldap host> slapd[853101]: Config: ** successfully added syncrepl rid=001 "<provider url>" Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 51 (mirrormode TRUE) Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 52 (multiprovider on) Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 55 (index entryCSN eq) Oct 16 14:15:47 <our ldap host> slapd[853101]: index entryCSN 0x0004 Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 56 (index entryUUID eq ) Oct 16 14:15:47 <our ldap host> slapd[853101]: index entryUUID 0x0004 Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 58 (index objectClass eq) Oct 16 14:15:47 <our ldap host> slapd[853101]: index objectClass 0x0004 Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 59 (index ps eq) Oct 16 14:15:47 <our ldap host> slapd[853101]: index ps 0x0004 Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 60 (index <sample value>-safe-id eq) Oct 16 14:15:47 <our ldap host> slapd[853101]: index <sample value>--id 0x0004 Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 61 (checkpoint 128 15) Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 64 (overlay syncprov) Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 66 (syncprov-checkpoint 100 10) Oct 16 14:15:47 <our ldap host> slapd[853101]: /etc/openldap/slapd.conf: line 72 (limits dn.exact=cn=<sample value>,dc=<sample value>,dc=com size=unlimited time=unlimited) Oct 16 14:15:47 <our ldap host> slapd[853101]: >>> dnNormalize: <cn=<sample value>,dc=<sample value>,dc=com> Oct 16 14:15:47 <our ldap host> slapd[853101]: <<< dnNormalize: <cn=<sample value>,dc=<sample value>,dc=com> Oct 16 14:15:47 <our ldap host> slapd[853101]: >>> dnNormalize: <cn=Subschema> Oct 16 14:15:47 <our ldap host> slapd[853101]: <<< dnNormalize: <cn=subschema> Oct 16 14:15:47 <our ldap host> slapd[853103]: slapd startup: initiated. Oct 16 14:15:47 <our ldap host> slapd[853103]: backend_startup_one: starting "cn=config" Oct 16 14:15:47 <our ldap host> slapd[853103]: config_back_db_open Oct 16 14:15:47 <our ldap host> slapd[853103]: config_back_db_open: line 0: warning: cannot assess the validity of the ACL scope within backend naming context Oct 16 14:15:47 <our ldap host> slapd[853103]: config_back_db_open: No explicit ACL for back-config configured. Using hardcoded default Oct 16 14:15:47 <our ldap host> slapd[853103]: config_build_entry: "cn=config" Oct 16 14:15:47 <our ldap host> slapd[853103]: slap_get_csn: conn=-1 op=0 generated new csn=20241016084547.895827Z#000000#001#000000 manage=0 Oct 16 14:15:47 <our ldap host> slapd[853103]: config_build_entry: "cn=module{0}" Oct 16 14:15:47 <our ldap host> slapd[853103]: slap_get_csn: conn=-1 op=0 generated new csn=20241016084547.896054Z#000000#001#000000 manage=0 Oct 16 14:15:47 <our ldap host> slapd[853103]: config_build_entry: "cn=schema" Oct 16 14:15:47 <our ldap host> slapd[853103]: slap_get_csn: conn=-1 op=0 generated new csn=20241016084547.897011Z#000000#001#000000 manage=0 Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn={0}core> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn={0}core> Oct 16 14:15:47 <our ldap host> slapd[853103]: config_build_entry: "cn={0}core" Oct 16 14:15:47 <our ldap host> slapd[853103]: slap_get_csn: conn=-1 op=0 generated new csn=20241016084547.899435Z#000000#001#000000 manage=0 Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn={1}> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn={1}> Oct 16 14:15:47 <our ldap host> slapd[853103]: config_build_entry: "cn={1}" Oct 16 14:15:47 <our ldap host> slapd[853103]: slap_get_csn: conn=-1 op=0 generated new csn=20241016084547.903375Z#000000#001#000000 manage=0 Oct 16 14:15:47 <our ldap host> slapd[853103]: config_build_entry: "olcDatabase={-1}frontend" Oct 16 14:15:47 <our ldap host> slapd[853103]: slap_get_csn: conn=-1 op=0 generated new csn=20241016084547.903549Z#000000#001#000000 manage=0 Oct 16 14:15:47 <our ldap host> slapd[853103]: config_build_entry: "olcDatabase={0}config" Oct 16 14:15:47 <our ldap host> slapd[853103]: slap_get_csn: conn=-1 op=0 generated new csn=20241016084547.903679Z#000000#001#000000 manage=0 Oct 16 14:15:47 <our ldap host> slapd[853103]: config_build_entry: "olcDatabase={1}monitor" Oct 16 14:15:47 <our ldap host> slapd[853103]: slap_get_csn: conn=-1 op=0 generated new csn=20241016084547.903828Z#000000#001#000000 manage=0 Oct 16 14:15:47 <our ldap host> slapd[853103]: config_build_entry: "olcDatabase={2}mdb" Oct 16 14:15:47 <our ldap host> slapd[853103]: slap_get_csn: conn=-1 op=0 generated new csn=20241016084547.904066Z#000000#001#000000 manage=0 Oct 16 14:15:47 <our ldap host> slapd[853103]: config_build_entry: "olcOverlay={0}syncprov" Oct 16 14:15:47 <our ldap host> slapd[853103]: slap_get_csn: conn=-1 op=0 generated new csn=20241016084547.904212Z#000000#001#000000 manage=0 Oct 16 14:15:47 <our ldap host> slapd[853103]: backend_startup_one: starting "cn=Monitor" Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Monitor> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=monitor> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnPretty: <cn=Backends> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnPretty: <cn=Backends> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Backends> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=backends> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnPretty: <cn=Connections> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnPretty: <cn=Connections> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Connections> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=connections> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnPretty: <cn=Databases> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnPretty: <cn=Databases> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Databases> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=databases> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnPretty: <cn=Listeners> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnPretty: <cn=Listeners> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Listeners> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=listeners> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnPretty: <cn=Log> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnPretty: <cn=Log> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Log> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=log> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnPretty: <cn=Operations> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnPretty: <cn=Operations> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Operations> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=operations> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnPretty: <cn=Overlays> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnPretty: <cn=Overlays> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Overlays> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=overlays> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnPretty: <cn=SASL> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnPretty: <cn=SASL> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=SASL> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=sasl> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnPretty: <cn=Statistics> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnPretty: <cn=Statistics> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Statistics> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=statistics> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnPretty: <cn=Threads> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnPretty: <cn=Threads> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Threads> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=threads> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnPretty: <cn=Time> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnPretty: <cn=Time> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Time> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=time> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnPretty: <cn=TLS> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnPretty: <cn=TLS> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=TLS> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=tls> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnPretty: <cn=Waiters> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnPretty: <cn=Waiters> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Waiters> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=waiters> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Backend 0> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=backend 0> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Database 0,cn=Databases,cn=Monitor> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=database 0,cn=databases,cn=monitor> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Backend 1> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=backend 1> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Backend 2> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=backend 2> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Database 1,cn=Databases,cn=Monitor> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=database 1,cn=databases,cn=monitor> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Backend 3> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=backend 3> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Backend 4> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=backend 4> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Max File Descriptors> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=max file descriptors> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Total> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=total> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Current> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=current> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Frontend> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=frontend> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Database 0> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=database 0> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Backend 0,cn=Backends,cn=Monitor> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=backend 0,cn=backends,cn=monitor> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Database 1> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=database 1> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Backend 2,cn=Backends,cn=Monitor> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=backend 2,cn=backends,cn=monitor> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Database 2> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=database 2> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Overlay 1,cn=Overlays,cn=Monitor> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=overlay 1,cn=overlays,cn=monitor> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Backend 3,cn=Backends,cn=Monitor> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=backend 3,cn=backends,cn=monitor> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Overlay 0> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=overlay 0> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Overlay 1,cn=Overlays,cn=Monitor> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=overlay 1,cn=overlays,cn=monitor> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Listener 0> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=listener 0> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Listener 1> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=listener 1> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Listener 2> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=listener 2> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Listener 3> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=listener 3> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Listener 4> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=listener 4> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Bind> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=bind> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Unbind> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=unbind> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Search> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=search> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Compare> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=compare> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Modify> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=modify> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Modrdn> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=modrdn> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Add> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=add> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Delete> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=delete> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Abandon> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=abandon> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Extended> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=extended> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Overlay 0> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=overlay 0> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Overlay 1> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=overlay 1> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Database 2,cn=Databases,cn=Monitor> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=database 2,cn=databases,cn=monitor> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Overlay 2> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=overlay 2> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Bytes> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=bytes> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=PDU> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=pdu> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Entries> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=entries> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Referrals> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=referrals> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Max> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=max> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Max Pending> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=max pending> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Open> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=open> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Starting> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=starting> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Active> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=active> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Pending> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=pending> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Backload> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=backload> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=State> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=state> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Runqueue> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=runqueue> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Tasklist> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=tasklist> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Start> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=start> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Current> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=current> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Uptime> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=uptime> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Read> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=read> Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Write> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=write> Oct 16 14:15:47 <our ldap host> slapd[853103]: backend_startup_one: starting "dc=<sample value>,dc=com" Oct 16 14:15:47 <our ldap host> slapd[853103]: mdb_db_open: "dc=<sample value>,dc=com" Oct 16 14:15:47 <our ldap host> slapd[853103]: mdb_db_open: database "dc=<sample value>,dc=com": dbenv_open(/home/ldap). Oct 16 14:15:47 <our ldap host> slapd[853103]: syncprov_db_open: starting syncprov for suffix dc=<sample value>,dc=com Oct 16 14:15:47 <our ldap host> slapd[853103]: => mdb_entry_get: ndn: "dc=<sample value>,dc=com" Oct 16 14:15:47 <our ldap host> slapd[853103]: => mdb_entry_get: oc: "(null)", at: "contextCSN" Oct 16 14:15:47 <our ldap host> slapd[853103]: mdb_dn2entry("dc=<sample value>,dc=com") Oct 16 14:15:47 <our ldap host> slapd[853103]: => mdb_dn2id("dc=<sample value>,dc=com") Oct 16 14:15:47 <our ldap host> slapd[853103]: <= mdb_dn2id: got id=0x1 Oct 16 14:15:47 <our ldap host> slapd[853103]: => mdb_entry_decode: Oct 16 14:15:47 <our ldap host> slapd[853103]: <= mdb_entry_decode Oct 16 14:15:47 <our ldap host> slapd[853103]: => mdb_entry_get: found entry: "dc=<sample value>,dc=com" Oct 16 14:15:47 <our ldap host> slapd[853103]: mdb_entry_get: rc=0 Oct 16 14:15:47 <our ldap host> slapd[853103]: slapd starting Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: added 4r listener=(nil) Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: added 7r listener=0x5612300dd830 Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: added 8r listener=0x5612300dd920 Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: added 9r listener=0x5612300ddad0 Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: added 10r listener=0x5612300ddbc0 Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: added 11r listener=0x5612300ddd10 Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: epoll: listen=7 active_threads=0 tvp=zero Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: epoll: listen=10 active_threads=0 tvp=zero Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: epoll: listen=11 active_threads=0 tvp=zero Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: activity on 1 descriptor Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: activity on: Oct 16 14:15:47 <our ldap host> slapd[853103]: Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: epoll: listen=7 active_threads=0 tvp=zero Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: epoll: listen=10 active_threads=0 tvp=zero Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: epoll: listen=11 active_threads=0 tvp=zero Oct 16 14:15:47 <our ldap host> slapd[853103]: >>> dnNormalize: <cn=Consumer 001> Oct 16 14:15:47 <our ldap host> slapd[853103]: <<< dnNormalize: <cn=consumer 001> Oct 16 14:15:47 <our ldap host> slapd[853103]: =>do_syncrepl rid=001 Oct 16 14:15:47 <our ldap host> slapd[853103]: slap_client_connect: URI=<provider url> DN="cn=<sample value>,dc=<sample value>,dc=com" ldap_sasl_bind_s failed (-1) Oct 16 14:15:47 <our ldap host> slapd[853103]: do_syncrepl: rid=001 rc -1 retrying (4 retries left) Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: activity on 1 descriptor Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: activity on: Oct 16 14:15:47 <our ldap host> slapd[853103]: Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: epoll: listen=7 active_threads=0 tvp=zero Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: epoll: listen=10 active_threads=0 tvp=zero Oct 16 14:15:47 <our ldap host> slapd[853103]: daemon: epoll: listen=11 active_threads=0 tvp=zero Oct 16 14:15:52 <our ldap host> slapd[853103]: daemon: epoll: listen=7 active_threads=0 tvp=zero Oct 16 14:15:52 <our ldap host> slapd[853103]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 16 14:15:52 <our ldap host> slapd[853103]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 16 14:15:52 <our ldap host> slapd[853103]: daemon: epoll: listen=10 active_threads=0 tvp=zero Oct 16 14:15:52 <our ldap host> slapd[853103]: daemon: epoll: listen=11 active_threads=0 tvp=zero Oct 16 14:15:52 <our ldap host> slapd[853103]: =>do_syncrepl rid=001 Oct 16 14:15:52 <our ldap host> slapd[853103]: slap_client_connect: URI=<provider url> DN="cn=<sample value>,dc=<sample value>,dc=com" ldap_sasl_bind_s failed (-1) Oct 16 14:15:52 <our ldap host> slapd[853103]: do_syncrepl: rid=001 rc -1 retrying (3 retries left) Oct 16 14:15:52 <our ldap host> slapd[853103]: daemon: activity on 1 descriptor Oct 16 14:15:52 <our ldap host> slapd[853103]: daemon: activity on: Oct 16 14:15:52 <our ldap host> slapd[853103]: Oct 16 14:15:52 <our ldap host> slapd[853103]: daemon: epoll: listen=7 active_threads=0 tvp=zero Oct 16 14:15:52 <our ldap host> slapd[853103]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 16 14:15:52 <our ldap host> slapd[853103]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 16 14:15:52 <our ldap host> slapd[853103]: daemon: epoll: listen=10 active_threads=0 tvp=zero Oct 16 14:15:52 <our ldap host> slapd[853103]: daemon: epoll: listen=11 active_threads=0 tvp=zero Oct 16 14:15:57 <our ldap host> slapd[853103]: daemon: epoll: listen=7 active_threads=0 tvp=zero Oct 16 14:15:57 <our ldap host> slapd[853103]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 16 14:15:57 <our ldap host> slapd[853103]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 16 14:15:57 <our ldap host> slapd[853103]: daemon: epoll: listen=10 active_threads=0 tvp=zero Oct 16 14:15:57 <our ldap host> slapd[853103]: daemon: epoll: listen=11 active_threads=0 tvp=zero Oct 16 14:15:57 <our ldap host> slapd[853103]: =>do_syncrepl rid=001 Oct 16 14:15:57 <our ldap host> slapd[853103]: slap_client_connect: URI=<provider url> DN="cn=<sample value>,dc=<sample value>,dc=com" ldap_sasl_bind_s failed (-1) Oct 16 14:15:57 <our ldap host> slapd[853103]: do_syncrepl: rid=001 rc -1 retrying (2 retries left) Oct 16 14:15:57 <our ldap host> slapd[853103]: daemon: activity on 1 descriptor

4 9

Meta backends as Failover for replication
by Compy Ulix 16 Dec '24

16 Dec '24

Hello, I have 2 openldap backends with replication configured in mirror mode. Can I use a third openLDAP with the slapd-meta backend as failover system? Is it a reliable solution? Does anyone have a feedback on this kind of solution ? Thanks you for your answer, Franck

2 1

LDIF conversion
by duttaa＠hotmail.com 13 Dec '24

13 Dec '24

Hi, I want to build an application using Java and C++ to convert LDAP responses (sub tree search, tree with multi level hierarchy) into LDIF file. Are there any open source libraries which can be used for this use case. Thanks Abhijit

3 3

ECDSA certs TLS init failed for slapd
by jehan Procaccia 11 Dec '24

11 Dec '24

Hi we finally moved from RSA signed certificate to ECDSA signature as it is the defaults nowdays (https://community.letsencrypt.org/t/ecdsa-certificates-by-default-and-other…) unfortunatly , slapd doesnt like those certificates : / slapd[641]: @(#) $OpenLDAP: slapd 2.4.44 (Feb 23 2022 17:11:27) $/ /mockbuild@x86-01.bsys.centos.org:/builddir/build/BUILD/openldap-2.4.44/openldap-2.4.44/serve/ / slapd[641]: main: TLS init def ctx failed: -1/ / slapd[641]: slapd stopped./ This happened on a server running old openldap 2.4 (openldap-2.4.44-25.el7_9.x86_64) is there a directive to allow ECDSA certs in slapd (2.4) ? is it natively supported in up2date versions of openldap 2.5 / 2.6 ? is there a special directive in certbot to request slapd certs ? thanks .

4 5

Re: Meaning of "slapd[2606]: ppolicy_bind: Setting warning for password expiry for ... = ... seconds"
by Ondřej Kuzník 10 Dec '24

10 Dec '24

On Tue, Dec 10, 2024 at 07:23:55AM +0000, Windl, Ulrich wrote: >> It seems you are running with a loglevel that includes "trace", so I >> will repeat what I said before: >> >> "If you set your log level to trace, you will get logs that document >> decisions made during the tool/server operation. As a user, that is what >> I want out of a level with a name like that." > > The loglevel setup is this: > olcLogLevel: config > olcLogLevel: sync > olcLogLevel: none The message is clearly[0] emitted with level TRACE only, so either you're running a different slapd or these are not the logging options that are actually in use. Maybe -d <level> (debug level setting) and you're referring to the stderr output? [0]. https://git.openldap.org/openldap/openldap/-/blob/master/servers/slapd/over… -- Ondřej Kuzník Senior Software Engineer Symas Corporation http://www.symas.com Packaged, certified, and supported LDAP solutions powered by OpenLDAP

1 0

Re: [EXT] Re: Meaning of "slapd[2606]: ppolicy_bind: Setting warning for password expiry for ... = ... seconds"
by Ondřej Kuzník 09 Dec '24

09 Dec '24

On Wed, Dec 04, 2024 at 10:47:24AM +0000, Windl, Ulrich wrote: >> Not sure what makes you think this is even a bug? > > It's the number of messages: > (Uptime 56 days) > # journalctl -b |grep 'Setting warning for password expiry' | wc -l > 72697 It seems you are running with a loglevel that includes "trace", so I will repeat what I said before: "If you set your log level to trace, you will get logs that document decisions made during the tool/server operation. As a user, that is what I want out of a level with a name like that." Yes, that means you will have plenty of things logged that might not interest you under most circumstances. If it bothers you, set a reasonable loglevel like stats and sync. Regards, -- Ondřej Kuzník Senior Software Engineer Symas Corporation http://www.symas.com Packaged, certified, and supported LDAP solutions powered by OpenLDAP

1 0

PP/expiry issues with Ubuntu22 and RH6
by Felix Natter 07 Dec '24

07 Dec '24

Dear openldap experts, the company I work for recently migrated to Ubuntu 22.04, and we use openldap with password policies and password expiry (once per year), with no changes to OpenLDAP config. However, we also use a scientific linux 6 (SL6, ~RH6) compile machine for backwards compatibility purposes (also using OpenLDAP). Now what happens is: - user ldaptestuser1's password expires - she/he changes her/his password on Ubuntu (problem 1: no PP checking, maybe due to cache_credentials = yes in /etc/sssd/sssd.conf) - SL6 (host X) does not know about that (problem 2: pwd checking on SL6 _always_ yields a Constraint violation, so user ldaptestuser1 cannot login there): ldaptestuser1@X's password: You are required to change your password immediately (password aged) You are required to change your LDAP password immediately. Last login: DATE from Y WARNING: Your password has expired. You must change your password now and login again! Changing password for user ldaptestuser1. Enter login(LDAP) password: New password: Retype new password: LDAP password information update failed: Constraint violation Password fails quality checking policy passwd: Authentication token manipulation error Connection to X closed. I cannot see any relevant error in the server (sys)log (with stats logging). Which log level shall I enable? - is there a workaround / fix for problem 1? - Regarding problem 2: shall I disable password expiry (shadow extension)? Many Thanks and Best Regards! -- Felix Natter

2 2

make the attribute mail SINGLE-VALUE
by A. Schulze 05 Dec '24

05 Dec '24

Hello, I'm planing a schema to store data (mostly mail addresses) in OpenLDAP. one (soft) requirement: the mail address should be a single value. secondary addresses goes in an other attribute which allow multiple values. The only way I found for now is to copy the definition of 'mail' in core.schema [1] and write attributetype ( <my oid> NAME ( 'mail-sv' ) DESC 'RFC1274: RFC822 Mailbox (copy from core.schema, but SINGLE-VALUE)' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} SINGLE-VALUE ) This would work but it's not convenient: Everybody expect a mail address in a attribute named "mail", not "mail-sv" Are there other options to fulfill the requirement or makes the requirement at all no sense? I appreciate any comments. Andreas [1] https://github.com/openldap/openldap/blob/master/servers/slapd/schema/core.…

2 1

Meaning of "slapd[2606]: ppolicy_bind: Setting warning for password expiry for ... = ... seconds"
by Windl, Ulrich 04 Dec '24

04 Dec '24

Hi! Me again after 10 years with basically the same question (https://www.openldap.org/lists/openldap-technical/201411/msg00044.html): What is the meaning of messages like these (note the number of messages created): Nov 19 11:53:47 v07 slapd[2606]: ppolicy_bind: Setting warning for password expiry for uid=user = 1040879 seconds Nov 19 11:53:50 v07 slapd[2606]: ppolicy_bind: Setting warning for password expiry for uid=user = 1040876 seconds Nov 19 11:53:52 v07 slapd[2606]: ppolicy_bind: Setting warning for password expiry for uid=user = 1040874 seconds Nov 19 11:53:54 v07 slapd[2606]: ppolicy_bind: Setting warning for password expiry for uid=user = 1040872 seconds Nov 19 11:53:57 v07 slapd[2606]: ppolicy_bind: Setting warning for password expiry for uid=user = 1040869 seconds Nov 19 11:53:59 v07 slapd[2606]: ppolicy_bind: Setting warning for password expiry for uid=user = 1040867 seconds Nov 19 11:57:41 v07 slapd[2606]: ppolicy_bind: Setting warning for password expiry for uid=user = 1040645 seconds Nov 19 11:57:44 v07 slapd[2606]: ppolicy_bind: Setting warning for password expiry for uid=user = 1040642 seconds Nov 19 11:58:01 v07 slapd[2606]: ppolicy_bind: Setting warning for password expiry for uid=user = 1040625 seconds ... Nov 19 13:18:35 v07 slapd[2606]: ppolicy_bind: Setting warning for password expiry for uid=user = 1035791 seconds Nov 19 13:18:39 v07 slapd[2606]: ppolicy_bind: Setting warning for password expiry for uid=user = 1035787 seconds Nov 19 13:18:41 v07 slapd[2606]: ppolicy_bind: Setting warning for password expiry for uid=user = 1035785 seconds Nov 19 13:18:44 v07 slapd[2606]: ppolicy_bind: Setting warning for password expiry for uid=user = 1035782 seconds Nov 19 13:18:46 v07 slapd[2606]: ppolicy_bind: Setting warning for password expiry for uid=user = 1035780 seconds Nov 19 13:18:48 v07 slapd[2606]: ppolicy_bind: Setting warning for password expiry for uid=user = 1035778 seconds Nov 19 13:18:51 v07 slapd[2606]: ppolicy_bind: Setting warning for password expiry for uid=user = 1035775 seconds Nov 19 13:18:54 v07 slapd[2606]: ppolicy_bind: Setting warning for password expiry for uid=user = 1035772 seconds Nov 19 13:18:56 v07 slapd[2606]: ppolicy_bind: Setting warning for password expiry for uid=user = 1035770 seconds Nov 19 13:18:59 v07 slapd[2606]: ppolicy_bind: Setting warning for password expiry for uid=user = 1035767 seconds Nov 19 13:19:02 v07 slapd[2606]: ppolicy_bind: Setting warning for password expiry for uid=user = 1035764 seconds So the server logs such an entry every few seconds. I might guess that the user tried to authenticate every few seconds (for whatever reason). But what I wonder most: The LDAP server does not seed to "set" the password expiration; it just has to check the value. And for the latter I see no need to log it in syslog. It seems the number is the number of seconds until the password actually expired. So is that a (historic) bug? And yes, I'm still running a historic 2.4 version of OpenLDAP, so no need to tell me that it's quite old. (Despite of that we really intend to upgrade, but the more persons involved, the loger it takes...) Kind regards, Ulrich

2 2

autoca Attribute olcAutoCAserverClass
by Stefan Kania 29 Nov '24

29 Nov '24

Hello, I try to add the autoca overlay with the following ldif: -------------- dn: olcOverlay=autoca,olcDatabase={2}mdb,cn=config objectClass: olcAutoCAConfig objectClass: olcOverlayConfig olcOverlay: autoca olcAutoCADays: 3652 olcAutoCAKeybits: 4096 olcAutoCAserverClass: ipHost olcAutoCAserverDays: 1826 olcAutoCAserverKeybits: 4096 olcAutoCAuserClass: person olcAutoCAuserDays: 365 olcAutoCAuserKeybits: 4096 -------------- ldapadd gives me: adding new entry "olcOverlay=autoca,olcDatabase={2}mdb,cn=config" ldap_add: Other (e.g., implementation specific) error (80) additional info: <olcAutoCAserverClass> handler exited with 1 If I remove the attribute from my ldif, it works. What is wrong with the olcAutoCAserverClass attribute in my ldif? I try to look it up in the admin handbook but I could not find anything. I looked in the source code and found: ------------ { "serverClass", "objectclass", 2, 2, 0, ARG_STRING|ARG_MAGIC|ACA_SRVCLASS, autoca_cf, "( OLcfgOvAt:22.2 NAME 'olcAutoCAserverClass' " "DESC 'ObjectClass of server entries' " "EQUALITY caseIgnoreMatch " "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL }, ------------ For me it looks the same as the attribute olcAutoCAuserclass. ------------- { "userClass", "objectclass", 2, 2, 0, ARG_STRING|ARG_MAGIC|ACA_USRCLASS, autoca_cf, "( OLcfgOvAt:22.1 NAME 'olcAutoCAuserClass' " "DESC 'ObjectClass of user entries' " "EQUALITY caseIgnoreMatch " "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL }, ------------- Stefan

2 2

mdb_tassert(txn, rc == 0) fails in mdb_page_dirty()
by Christian Wendt 29 Nov '24

29 Nov '24

Hi, I have a system that fails to write to its lmdb based database. There is an assertion triggered from within mdb_txn_commit() inside mdb_page_dirty(). Further investigation shows that there is a duplicate page in a freelist entry: ~# mdb_stat -narrfff /home/skov/data/data.mdb Reader Table Status (no active readers) 0 stale readers cleared. (no active readers) Freelist Status Tree depth: 1 Branch pages: 0 Leaf pages: 1 Overflow pages: 0 Entries: 28 Transaction 128121111, 3 pages, maxspan 1 1281 1300 1468 Transaction 128121112, 6 pages, maxspan 1 [bad sequence] 229 229 569 1317 1444 1460 Transaction 128121113, 5 pages, maxspan 1 ... What could trigger such a duplicate entry and what could I try to do to figure out the root cause of the issue? Is there a recommended way of detecting or handling such errors at runtime? Thanks a lot for any pointers. Best regards, Christian Wendt

2 3

Client IP address in accesslog ?
by Benjamin Renard 21 Nov '24

21 Nov '24

Hi, I would like to know if there is a way to get the client's IP address in the events recorded by accesslog (at least during BINDs). I found traces of requests for this dating back to 2010, but I haven't been able to determine if it was ever implemented. Thanks! -- Benjamin Renard - Easter-eggs 44-46 rue de l'Ouest - 75014 Paris - France - Métro Gaité Phone: +33 (0) 1 43 35 00 37 - mailto:brenard@easter-eggs.com

6 9

Technical account impersonation or not
by BECOT Jérôme 20 Nov '24

20 Nov '24

Hello all, We currently use two distinct accounts for chaining and replication purpose. We want to use a passwordless policy and we go for certificates. As we only own a single certificate per slave server, this means that we authenticate as a single user. We see two way to do things: * Either we just use one account (bound by olcAuthzRegexp rule) and merge ACLs to allow this account to read the directory for sync and write authentication attributes for chaining * Or we keep two accounts and use Proxy Auth to impersonate the other one I personnaly would go for the first one as I don't see any value to use another mechanism given that these are technical accounts that have only one purpose each, except having a distinct login in the logs. What would you advice ? I may have miss something intersting, any security issue, or maybe there is another way. Thank you ! Jerome

2 2

RE26 testing call (2.6.9) #1
by Quanah Gibson-Mount 19 Nov '24

19 Nov '24

This is the first testing call for OpenLDAP 2.6.9. Depending on the results, this may be the only testing call. Generally, get the code for RE26: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_6/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.6.9 Engineering Fixed libldap TLS connection timeout handling (ITS#8047) Fixed libldap GnuTLS incompatible pointer type (ITS#10253) Fixed libldap OpenSSL set_ciphersuite error handling (ITS#10223) Fixed libldap to check for OpenSSL EVP_Digest* failure (ITS#10224) Fixed slapd cn=config disallowed modification of cn=schema (ITS#10256) Fixed slapd syncrepl assert during refresh at shutdown (ITS#10232) Fixed slapd syncrepl retry state during refreshDone (ITS#10234) Fixed slapd-ldap use of multi-precision add for op counters (ITS#10237) Fixed slapd-mdb idl intersection (ITS#10233) Fixed slapd-wt idl intersection (ITS#10233) Fixed slapo-memberof to omit dynamic values (ITS#10230) Fixed slapo-nestgroup leak in nestgroup_memberFilter (ITS#10249) Fixed slapo-translucent regression with subordinate databases (ITS#10248) Fixed slapo-translucent regression when requesting attributes (ITS#10272) Fixed slappw-argon2 defaults to be more secure (ITS#9827) Minor Cleanup ITS#10155 ITS#10218 ITS#10219 ITS#10227 ITS#10231 ITS#10235 ITS#10263 ITS#10264 Regards, Quanah

3 2

ACL on userPassword attribute on a relay database
by ptitoliv+openldap＠ptitoliv.net 18 Nov '24

18 Nov '24

Hello dear Openldap community, I'm writing you this email because I'm trying to create a configuration using relay backend + rvm and settings ACLs in the virtual database and I must admit I'm a little bit confused about all these components are working together. I actually have two databases: - The real one dc=ptitoliv,dc=net - The virtual one dc=example,dc=com I did a simple configuration using the RWM overlay and the rwm-suffixmassage directive. Everything seems to be okay except for the ACL. More precisely, my concern is about the ACL to apply in order to restrict the access to the userPassword attribute to the "virtual self" on the virtual database. My current status is the following : - If I don't put any ACL on the relay database, the userPassword attribute is readable by any authenticated user which is a thing I don't want - If I put the following ACL "to attrs=userPassword by self write by anonymous auth by * none" on the relay database nobody can read the userPassword including the virtual self. About the second point, if I understood correctly it's because the virtual binddn is mapped directly to the real one and the ACL tries to be resolved using the real binddn and not the virtual one like it is shown in the next trace. 673bb5e0.21d77b65 0x7f0d33dbf700 => access_allowed: read access to "uid=user,ou=people,dc=example,dc=com" "userPassword" requested 673bb5e0.21d78357 0x7f0d33dbf700 => acl_get: [1] attr userPassword 673bb5e0.21d79164 0x7f0d33dbf700 => acl_mask: access to entry "uid=user,ou=people,dc=example,dc=com", attr "userPassword" requested 673bb5e0.21d798c0 0x7f0d33dbf700 => acl_mask: to value by "uid=user,ou=people,dc=ptitoliv,dc=net", (=0) 673bb5e0.21d7bab8 0x7f0d33dbf700 <= check a_dn_pat: self 673bb5e0.21d7cc2c 0x7f0d33dbf700 <= check a_dn_pat: anonymous 673bb5e0.21d7d9d5 0x7f0d33dbf700 <= check a_dn_pat: * 673bb5e0.21d7e601 0x7f0d33dbf700 <= acl_mask: [3] applying none(=0) (stop) 673bb5e0.21d7f6df 0x7f0d33dbf700 <= acl_mask: [3] mask: none(=0) 673bb5e0.21d7fda4 0x7f0d33dbf700 => slap_access_allowed: read access denied by none(=0) So my question is that if it is possible to have an ACL on a virtual database in order to make the userPassword only readable by the logged user itself. Or is it just something that is not possible and if i want to access the userPassword attribute, it can be only done on the real database ? I tried to do some rewrite operation on the binddn but without any success 🙁 Thanks for you help ! Regards, Olivier Bonhomme

1 0

RE25 testing call (2.5.19) #1
by Quanah Gibson-Mount 18 Nov '24

18 Nov '24

This is the first testing call for OpenLDAP 2.5.19. Depending on the results, this may be the only testing call. Generally, get the code for RE25: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_5/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.5.19 Engineering Fixed libldap GnuTLS incompatible pointer type (ITS#10253) Fixed libldap OpenSSL set_ciphersuite error handling (ITS#10223) Fixed libldap to check for OpenSSL EVP_Digest* failure (ITS#10224) Fixed slapd syncrepl assert during refresh at shutdown (ITS#10232) Fixed slapd-ldap use of multi-precision add for op counters (ITS#10237) Fixed slapd-mdb idl intersection (ITS#10233) Fixed slapd-wt idl intersection (ITS#10233) Fixed slapo-translucent regression with subordinate databases (ITS#10248) Fixed slapo-translucent regression when requesting attributes (ITS#10272) Fixed slappw-argon2 defaults to be more secure (ITS#9827) Minor Cleanup ITS#10155 ITS#10219 ITS#10221 ITS#10227 ITS#10231 ITS#10264 Regards, Quanah

1 0

Master crashing when restarting Replicas
by Suresh Veliveli 14 Nov '24

14 Nov '24

Hello, We have a single master with multiple replicas. Sometimes when replicas are restarted the master is crashing. Openldap version - 2.6.7 Backend Database - mdb (gdb) core core.slapd.3003.d7d7f844eec3408ba1dfc465ee8306a1.16323.1731327494000000 [New LWP 16333] [New LWP 16741] [New LWP 16327] [New LWP 16328] [New LWP 16329] [New LWP 16360] [New LWP 16325] [New LWP 17359] [New LWP 16794] [New LWP 16323] [New LWP 16324] [New LWP 17765] [New LWP 16998] [New LWP 16334] [New LWP 17766] [New LWP 16999] [New LWP 16361] [New LWP 16795] Core was generated by `/var/services/openldap/libexec/slapd -h ldap://*:389 ldaps://*:636 -f /var/serv'. Program terminated with signal SIGSEGV, Segmentation fault. #0 0x00000000004389bb in ?? () [Current thread is 1 (LWP 16333)] (gdb) bt full #0 0x00000000004389bb in ?? () No symbol table info available. #1 0x0000000000000000 in ?? () No symbol table info available. (gdb) q Nov 11 07:18:14 aaa-prod-master-1 kernel: slapd[16333]: segfault at 18 ip 00000000004389bb sp 00007f79ccaf8650 error 4 in slapd[419000+12d000] likely on CPU 1 (core 1, socket 0) Nov 11 07:18:14 aaa-prod-master-1 kernel: Code: 89 e8 b9 0e 00 00 00 4c 89 e7 f3 48 ab 48 89 e8 48 8b ad 90 01 00 00 8b 90 c0 00 00 00 85 d2 75 35 48 8b 10 4c 89 e6 4c 89 f7 <8b> 52 18 c7 80 c0 00 00 00 01 00 00 00 48 8b 05 91 82 1b 00 89 94 Nov 11 07:18:14 aaa-prod-master-1 systemd[1]: Created slice Slice /system/systemd-coredump. Nov 11 07:18:14 aaa-prod-master-1 systemd[1]: Started Process Core Dump (PID 349553/UID 0). Nov 11 07:18:17 aaa-prod-master-1 systemd-coredump[349554]: Process 16323 (slapd) of user 3003 dumped core.#012#012Stack trace of thread 16333:#012#0 0x00000000004389bb n/a (slapd + 0x389bb)#012#1 0x000000000043a6f4 connection_closing (slapd + 0x3a6f4)#012#2 0x000000000043b5ce n/a (slapd + 0x3b5ce)#012#3 0x00007f9340de7d1a ldap_int_thread_pool_wrapper (libldap.so.2 + 0x43d1a)#012#4 0x00007f9340489c02 start_thread (libc.so.6 + 0x89c02)#012#5 0x00007f934050ec40 __clone3 (libc.so.6 + 0x10ec40)#012#012Stack trace of thread 16741:#012#0 0x00007f934048679a __futex_abstimed_wait_common (libc.so.6 + 0x8679a)#012#1 0x00007f9340488fa0 pthread_cond_wait@@GLIBC_2.3.2 (libc.so.6 + 0x88fa0)#012#2 0x00007f9340de7db7 ldap_int_thread_pool_wrapper (libldap.so.2 + 0x43db7)#012#3 0x00007f9340489c02 start_thread (libc.so.6 + 0x89c02)#012#4 0x00007f934050ec40 __clone3 (libc.so.6 + 0x10ec40)#012#012Stack trace of thread 16327:#012#0 0x00007f934048679a __futex_abstimed_wait_common (libc.so.6 + 0x8679a)#012#1 0x00007f9340488fa0 pthread_cond_wait@@GLIBC_2.3.2 (libc.so.6 + 0x88fa0)#012#2 0x00007f9340de7db7 ldap_int_thread_pool_wrapper (libldap.so.2 + 0x43db7)#012#3 0x00007f9340489c02 start_thread (libc.so.6 + 0x89c02)#012#4 0x00007f934050ec40 __clone3 (libc.so.6 + 0x10ec40)#012#012Stack trace of thread 16328:#012#0 0x00007f934048679a __futex_abstimed_wait_common (libc.so.6 + 0x8679a)#012#1 0x00007f9340488fa0 pthread_cond_wait@@GLIBC_2.3.2 (libc.so.6 + 0x88fa0)#012#2 0x00007f9340de7db7 ldap_int_thread_pool_wrapper (libldap.so.2 + 0x43db7)#012#3 0x00007f9340489c02 start_thread (libc.so.6 + 0x89c02)#012#4 0x00007f934050ec40 __clone3 (libc.so.6 + 0x10ec40)#012#012Stack trace of thread 16329:#012#0 0x00007f934048679a __futex_abstimed_wait_common (libc.so.6 + 0x8679a)#012#1 0x00007f9340488fa0 pthread_cond_wait@@GLIBC_2.3.2 (libc.so.6 + 0x88fa0)#012#2 0x00007f9340de7db7 ldap_int_thread_pool_wrapper (libldap.so.2 + 0x43db7)#012#3 0x00007f9340489c02 start_thread (libc.so.6 + 0x89c02)#012#4 0x00007f934050ec40 __clone3 (libc.so.6 + 0x10ec40)#012#012Stack trace of thread 16360:#012#0 0x00007f934048679a __futex_abstimed_wait_common (libc.so.6 + 0x8679a)#012#1 0x00007f9340488fa0 pthread_cond_wait@@GLIBC_2.3.2 (libc.so.6 + 0x88fa0)#012#2 0x00007f9340de7db7 ldap_int_thread_pool_wrapper (libldap.so.2 + 0x43db7)#012#3 0x00007f9340489c02 start_thread (libc.so.6 + 0x89c02)#012#4 0x00007f934050ec40 __clone3 (libc.so.6 + 0x10ec40)#012#012Stack trace of thread 16325:#012#0 0x00007f934048679a __futex_abstimed_wait_common (libc.so.6 + 0x8679a)#012#1 0x00007f9340488fa0 pthread_cond_wait@@GLIBC_2.3.2 (libc.so.6 + 0x88fa0)#012#2 0x00007f9340de7db7 ldap_int_thread_pool_wrapper (libldap.so.2 + 0x43db7)#012#3 0x00007f9340489c02 start_thread (libc.so.6 + 0x89c02)#012#4 0x00007f934050ec40 __clone3 (libc.so.6 + 0x10ec40)#012#012Stack trace of thread 17359:#012#0 0x00007f934048679a __futex_abstimed_wait_common (libc.so.6 + 0x8679a)#012#1 0x00007f9340488fa0 pthread_cond_wait@@GLIBC_2.3.2 (libc.so.6 + 0x88fa0)#012#2 0x00007f9340de7db7 ldap_int_thread_pool_wrapper (libldap.so.2 + 0x43db7)#012#3 0x00007f9340489c02 start_thread (libc.so.6 + 0x89c02)#012#4 0x00007f934050ec40 __clone3 (libc.so.6 + 0x10ec40)#012#012Stack trace of thread 16794:#012#0 0x00007f934048679a __futex_abstimed_wait_common (libc.so.6 + 0x8679a)#012#1 0x00007f9340488fa0 pthread_cond_wait@@GLIBC_2.3.2 (libc.so.6 + 0x88fa0)#012#2 0x00007f9340de7db7 ldap_int_thread_pool_wrapper (libldap.so.2 + 0x43db7)#012#3 0x00007f9340489c02 start_thread (libc.so.6 + 0x89c02)#012#4 0x00007f934050ec40 __clone3 (libc.so.6 + 0x10ec40)#012#012Stack trace of thread 16323:#012#0 0x00007f934048679a __futex_abstimed_wait_common (libc.so.6 + 0x8679a)#012#1 0x00007f934048b6d3 __pthread_clockjoin_ex (libc.so.6 + 0x8b6d3)#012#2 0x00000000004381ca slapd_daemon (slapd + 0x381ca)#012#3 0x000000000041e47f main (slapd + 0x1e47f)#012#4 0x00007f9340429590 __libc_start_call_main (libc.so.6 + 0x29590)#012#5 0x00007f9340429640 __libc_start_main@@GLIBC_2.34 (libc.so.6 + 0x29640)#012#6 0x000000000041e855 _start (slapd + 0x1e855Nov 11 07:18:17 aaa-prod-master-1 systemd[1]: systemd-coredump(a)0-349553-0.service: Deactivated successfully. Nov 11 07:18:17 aaa-prod-master-1 systemd[1]: systemd-coredump(a)0-349553-0.service: Consumed 3.288s CPU time. Nov 11 07:18:18 aaa-prod-master-1 systemd[1]: slapd.master.service: Main process exited, code=dumped, status=11/SEGV Nov 11 07:18:18 aaa-prod-master-1 systemd[1]: slapd.master.service: Failed with result 'core-dump'. Nov 11 07:18:18 aaa-prod-master-1 systemd[1]: slapd.master.service: Consumed 14h 31min 2.574s CPU time. Any thoughts? Thanks, -- Suresh Veliveli Sr. Systems Engineer Georgetown University University Information Services | Security Infrastructure and Policy-Identity and Collaboration

3 3

Trouble with UID Filter in OpenLDAP (slapd meta): Missing Schema or Configuration Issue?
by tmp 2810 08 Nov '24

08 Nov '24

Hi! I think I'm finally able to configure slapd with a meta backend, but I'm experiencing a strange issue when I perform a search with ldapsearch and try to filter by uid. If I use "uid=user" it doesn't work, but if I use "cn=user" it does work, and I need the searches to be by uid. I understand this could be related to the schemas I’m loading, but I thought uid was a standard attribute already loaded in core.schema. Just in case, I'm using Debian 12, and these are the schemas available: collective.schema corba.schema core.schema cosine.schema dsee.schema duaconf.schema dyngroup.schema inetorgperson.schema java.schema misc.schema msuser.schema namedobject.schema nis.schema openldap.schema pmi.schema These are the schemas I’m using to test: include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/nis.schema And as a detail, I find that this part referring to uid (I might be mistaken) is commented out: attributetype ( 0.9.2342.19200300.100.1.1 NAME ( 'uid' 'userid' ) DESC 'RFC1274: user identifier' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) but when I try to uncomment it, I get the error: 672b6c65.324d8768 0x7febb561d200 /etc/ldap/schema/core.schema: line 564 attributetype: Duplicate attributeType: "0.9.2342.19200300.100.1.1" Just in case, here’s my configuration. Could it be that something is missing so that a user can log in against this slapd? Since my applications search by uid (some are very legacy and I can't modify them), I'm unable to verify if everything is correctly set up to make a connection. The only indication that it’s working is that I can retrieve all users with ldapsearch and their attributes, but I can't filter by uid. ########################################## include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/nis.schema modulepath /usr/lib/ldap moduleload back_meta.la moduleload back_ldap.la database meta suffix "dc=proxy" rootdn "cn=admin,dc=proxy" rootpw 1234 ## example.com uri "ldaps://ldap.google.com/dc=proxy" suffixmassage "dc=proxy" "dc=example,dc=com" lastmod off readonly on rebind-as-user yes chase-referrals yes idassert-bind bindmethod=simple binddn="uid=ldap,ou=Users,dc=example,dc=com" credentials="secret-password" tls_reqcert=demand tls_reqsan=demand tls_cert=/root/ldapcerts/ldap.crt tls_key=/root/ldapcerts/ldap.key tls_cacert=/root/ldapcerts/ca/gtsr1.pem idassert-authzFrom "*" ############################### Thanks for all the help!

3 2

Re: Issue with slapd and Google LDAP Integration (lowercase user)
by tmp 2810 06 Nov '24

06 Nov '24

Thats my actual config and the message on the logs is : Unauhtenticated ================================================ uri "ldaps://ldap.google.com/dc=proxy" suffixmassage "dc=proxy" "dc=example,dc=com" lastmod off readonly on idassert-bind bindmethod=sasl saslmech=EXTERNAL tls_reqcert=demand tls_reqsan=demand tls_cert=/root/ldapcerts/google_cert.crt tls_key=/root/ldapcerts/google_cert.key tls_cacert=/root/ldapcerts/ca/gtsr1.pem ================================================ I've actually been trying all kinds of configurations for the last 2 weeks. Is there a chance that this doesn't work with Google's LDAP? I can't find a single example on the entire internet of someone who has managed to do this whit the LDAP of google. El mar, 5 nov 2024 a las 12:51, Quanah Gibson-Mount (<quanah(a)fast-mail.org>) escribió: > > > --On Monday, November 4, 2024 8:29 PM -0300 tmp 2810 <t2810mp(a)gmail.com> > wrote: > > > Once again, I apologize; I ran so many tests that I accidentally copied > > one where the binddn was incorrect. > > > > The target looks more like this: > > > >## example.com > > uri "ldaps://ldap.google.com/dc=proxy" > > suffixmassage "dc=proxy" "dc=example,dc=com" > > lastmod off > > readonly on > > idassert-bind bindmethod=simple > > binddn="cn=ChiwewDaw" > > cn, is by definition, case insensitive. If Google LDAP is forcing case > sensitivity in this attribute, it is gross violation of the LDAP RFCs. > However, having had to interface with it in the past, I don't believe that > is the case. I would generally suspect that this is not the full DN of > the > user. > > > idassert-bind bindmethod=sasl > > saslmech=EXTERNAL > > tls_reqcert=demand > > tls_reqsan=demand > > starttls=critical > > > This is not sufficient, please read the man page: > > > idassert-bind bindmethod=none|simple|sasl [binddn=<simple > DN>] > [credentials=<simple password>] [saslmech=<SASL > mech>] > [secprops=<properties>] [realm=<realm>] > [authcId=<authentication > ID>] [authzId=<authorization ID>] > [authz={native|proxyauthz}] > [mode=<mode>] [flags=<flags>] > [starttls=no|yes|critical] > [tls_cert=<file>] [tls_key=<file>] > [tls_cacert=<file>] > [tls_cacertdir=<path>] > [tls_reqcert=never|allow|try|demand] > [tls_reqsan=never|allow|try|demand] > [tls_cipher_suite=<ciphers>] > [tls_ecname=<names>] > [tls_protocol_min=<version>] > [tls_crlcheck=none|peer|all] > > > You *must* specify tls_cert, tls_key, and tls_cacert as a part of > idassert-bind as it provides the TLS identity to bind as. In your > configuration for simple bind, tls_cert and tls_key are unnecessary as > you're not doing SASL/EXTERNAL binds. > > --Quanah > > > >

3 2

Re: Issue with slapd and Google LDAP Integration (lowercase user)
by tmp 2810 05 Nov '24

05 Nov '24

Yes, indeed the way was to use a simple bind of an email user with admin permissions in Google, and with that, I was able to do the bind. Thank you! El mar, 5 nov 2024 a las 13:16, Quanah Gibson-Mount (<quanah(a)fast-mail.org>) escribió: > > > --On Tuesday, November 5, 2024 1:06 PM -0300 tmp 2810 <t2810mp(a)gmail.com> > wrote: > > > I've actually been trying all kinds of configurations for the last 2 > > weeks. Is there a chance that this doesn't work with Google's LDAP? I > > can't find a single example on the entire internet of someone who has > > managed to do this whit the LDAP of google. > > I've no idea if Google's LDAP supports SASL/EXTERNAL. You'd have to ask > Google. We used simple binds to Google w/o issue at a prior job I worked > at to sync data from OpenLDAP to it. > > --Quanah > > > >

1 0

Re: Issue with slapd and Google LDAP Integration (lowercase user)
by tmp 2810 05 Nov '24

05 Nov '24

Thank you for the response! No, no... these are example data that I put together to understand how Google users are structured and the issue that uppercase letters are causing me. In the Google LDAP audit, I see that the user fails and appears in lowercase. Once again, I apologize; I ran so many tests that I accidentally copied one where the binddn was incorrect. The target looks more like this: ## example.com uri "ldaps://ldap.google.com/dc=proxy" suffixmassage "dc=proxy" "dc=example,dc=com" lastmod off readonly on idassert-bind bindmethod=simple binddn="cn=ChiwewDaw" credentials="password-fake" tls_reqcert=demand tls_reqsan=demand starttls=critical tls_cert=/root/ldapcerts/ldap_cert.crt tls_key=/root/ldapcerts/ldap_cert.key tls_cacert=/root/ldapcerts/ca/gtsr1.pem if i use: idassert-bind bindmethod=sasl saslmech=EXTERNAL tls_reqcert=demand tls_reqsan=demand starttls=critical i have the error : "Unauthenticated"

2 1

Issue with slapd and Google LDAP Integration (lowercase user)
by tmp 2810 04 Nov '24

04 Nov '24

Hello everyone! I have been trying to configure slapd for a week to use it as a proxy for Google's LDAP service in order to connect some legacy applications. Since I have multiple domains in Google, I need to centralize all users into a common "dc." Everything is working well, but the problem is that, apparently, when connecting to Google, I am provided with a certificate that I download from the admin console. However, with that certificate alone, slapd cannot connect to the target. So, I generate some credentials from the Google LDAP admin and add them to the slapd configuration. The issue is that, for some reason, slapd converts the username to lowercase, and Google rejects it because it is case-sensitive. Is it possible to disable this function? (There is no way to create a user in Google that is only in lowercase) Here is my current slapd configuration: ################################################################ include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/openldap.schema include /etc/ldap/schema/nis.schema modulepath /usr/lib/ldap moduleload back_meta.la moduleload back_ldap.la database meta suffix "dc=proxy" rootdn "cn=admin,dc=proxy" rootpw 1234 ## example.com uri "ldap://172.25.3.127:2636/dc=proxy" suffixmassage "dc=proxy" "dc=example,dc=com" lastmod off readonly on idassert-bind bindmethod=simple binddn="ChiwewDaw" credentials="ASk0i9ejiosej9o303" tls_reqcert=demand tls_reqsan=demand starttls=critical tls_cert=/root/ldapcerts/ldap_cert.crt tls_key=/root/ldapcerts/ldap_cert.key tls_cacert=/root/ldapcerts/ca/gtsr1.pem ################################################################## Thank you for your assistance! (ps: If anyone knows how to make it work using only the certificate, that would be great.)

2 1

Re: multi-master OpenLDAP with SASL/GSSAPI
by Travis Bean 04 Nov '24

04 Nov '24

On Tue, Jul 30, 2024 at 2:29 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > > --On Sunday, July 28, 2024 7:09 PM -0700 Travis Bean <tbean74(a)gmail.com> > wrote: > > > I developed a Bash script (https://launchpad.net/linuxha) to automate > > the installation and configuration of complex Linux software that is > > out of reach for most people. I want the syntax of this script to be > > perfect so I can use it as a teaching tool to educate people about > > Linux. > > > > If anyone on this mailing list is knowledgeable about multi-master > > OpenLDAP with SASL/GSSAPI authentication, please review the > > OpenLDAP/SASL/GSSAPI code that is part of my LinuxHA script and > > provide feedback. Thank you. > Just glancing at your script I see errors, such as: > > SASL_MECH GSSAPI PLAIN > > for ldap.conf. The man page clearly notes this takes a SINGLE mechanism. If ldap.conf(5) only supports one SASL mechanism for the SASL_MECH variable, then the man page at https://www.openldap.org/software/man.cgi?query=ldap.conf needs to be updated to clarify this. I originally configured the SASL_MECH variable for OpenLDAP's ldap.conf(5) the same way I configured the mech_list variable for Postfix's smtpd.conf and the auth_mechanisms variable for Dovecot's 10-auth.conf. I configured multiple SASL mechanisms for each of these variables for testing purposes. For a local area network, a system administrator has complete control over all the workstations and can make sure they all have Kerberos installed. For internet facing servers providing services to the wide area network (WAN), it makes sense to use a second SASL mechanism (something other than SASL/GSSAPI) in case any WAN devices do not have Kerberos installed, since a sysadmin may have no control over what is installed on WAN devices. I recently replaced libpam-ldap and libnss-ldap with sssd-ldap and sssd-krb5 for LinuxHA, since SSSD is a much better solution for identity and authentication. > Also, SASL/PLAIN is insecure and should never be used. Technically this is true. Even though when SASL/PLAIN is used in conjunction with Transport Layer Security, the credentials are encrypted. When ldap.conf(5) is installed on a server (as was the case when I was testing ldap.conf(5) on LinuxHA), using SASL/PLAIN is not insecure because it is only connected to a local socket on the local machine. > Another note is that SASL/GSASPI is extremely dependent on valid hostname > resolution. The pam ldap.conf seems unlikely to work (ldap://localhost for > the URI). When /etc/ldap.conf (the configuration file for PADL’s pam_ldap and nss_ldap modules) or /etc/ldap/ldap.conf (the configuration file for client applications such as ldapsearch, ldapadd, ldapmodify, and ldapdelete) is installed on a server rather than a workstation, you use "uri ldap://localhost", or "uri ldap://127.0.0.1", or better yet use LDAP over IPC mechanisms (LDAP over Inter-Process Communication) a.k.a. UNIX domain sockets (i.e., "uri ldapi:///"). See the following webpage for further details: https://datatracker.ietf.org/doc/html/draft-chu-ldap-ldapi-00 > I see so many things that are bad practice in this script in general I'm > not going to spend any more time reviewing it. I have tried very hard to make sure there are no “bad practices” incorporated into LinuxHA. From a security standpoint, I have attempted to design LinuxHA so it is one step ahead of standard security policies. Everytime Canonical releases a new version of Ubuntu Server, the configuration for LinuxHA has to be updated. I have tested LinuxHA on seven versions of Ubuntu Server thus far — from 12.04 to 24.04. Even though I try to go through all the software packages incorporated into LinuxHA everytime Canonical releases a new version of Ubuntu Server to see if any configuration file has changed and needs to be updated, it may take awhile to complete these updates. If you find any misconfiguration in LinuxHA, please submit a bug report: https://bugs.launchpad.net/linuxha/+filebug Kind regards, Travis Bean

3 2

Removing AutoCA overlay, objectClass, etc
by Brendan Kearney 30 Oct '24

30 Oct '24

list members, i have a multi-provider footprint that i want to remove the AutoCA functionality from. when i loaded the overlay, i set it to disabled, per the below: dn: olcOverlay={5}autoca objectClass: olcOverlayConfig objectClass: olcAutoCAConfig objectClass: top olcOverlay: {5}autoca structuralObjectClass: olcAutoCAConfig entryUUID: 739501f2-49ad-103e-911a-3dc9b40470bf creatorsName: uid=brendan,ou=domainusers,ou=users,dc=bpk2,dc=com createTimestamp: 20240117175614Z olcAutoCADays: 3650 olcAutoCAKeybits: 2048 olcDisabled: TRUE olcAutoCAserverKeybits: 2048 olcAutoCAuserClass: inetOrgPerson olcAutoCAserverClass: device olcAutoCAserverDays: 1826 olcAutoCAuserDays: 365 olcAutoCAuserKeybits: 2048 entryCSN: 20240117192443.210024Z#000000#001#000000 modifiersName: uid=brendan,ou=domainusers,ou=users,dc=bpk2,dc=com modifyTimestamp: 20240117192443Z note, olcDisabled is set to true. it seems that something went awry and even though i didn't want the capability active, i wound up with some caCertificate and caPrivateKey objects created in the DIT. it looks like i may have added the overlay in an active state and disabled it after the caCertificate/PrivateKey objects were created. i want to clean up things and remove the AutoCA pieces until i can test them better. what process is needed to remove the objects and overlay, as replication may play a part in some of the effort? i could imagine that deleting the caCertificate and caPrivateKey objects would be relatively straight forward, but the overlay may prove a bit more complicated. i found a message on this list from some time ago, https://www.openldap.com/lists/openldap-technical/201811/msg00075.html, that says i can stop the slapd instance, remove the overlay ldif files and restart the instance, to accomplish this task. the issue that i am trying to avoid is having to take down the entire fully replicated DIT, in order to delete the overlay and not have replication recreate it because one active node "didn't get the memo". are there any insights into how i can delete overlays without having replication recreate the objects i want to remove, all while still providing at least one instance to service requests? if it clarifies things, i am running 3 slapd instances behind a load balancer and both the config DB and DIT are replicated between all nodes. if it comes to it, i could take down all instances to perform this work, but i would like to avoid it if possible. thanks in advance, brendan kearney

3 8

Unnamed sub-databases in LMDB
by ruben.soh＠rutgers.edu 26 Oct '24

26 Oct '24

Background: I am trying to implement a fully dynamic connectivity algorithm, based on this paper (https://dl.acm.org/doi/10.1145/502090.502095), using LMDB as the backend. Other implementations use an in-memory binary search tree. I am currently working on trying to implement an Euler Tour Forest using LMDB. Essentially, an Euler Tour of an unbalanced tree is obtained by doing a DFS and assigning an increasing index every time we visit a node (https://en.m.wikipedia.org/wiki/Euler_tour_technique). An Euler Tour Tree is simply a balanced tree containing the euler tour index as the key and a pointer to the node as the value, so I plan to store each Euler Tour Tree using an LMDB database. Problem: I need an unlimited amount of sub-databases - my first thought was to use mdb_dbi_open, however, it seems like this doesn't scale well because a list of named sub-databases is stored in every transaction. In the talk about LMDB's functionality at CMU (https://www.youtube.com/watch?v=tEa5sAh-kVk) there is some reference to sub-databases, but from reading the code it seems like unnamed sub-databases are only used for sorted duplicate keys. Am I correct in thinking that I'm going to need to add some new code to support unnamed sub-databases, or is there some way to do it that I'm not recognizing? And if I do need to change things, where should I start? Ruben Soh

2 1

Error after OpenLDAP update from 2.4 to 2.5 - ppolicy schema
by sharbich＠t-online.de 21 Oct '24

21 Oct '24

Hello, unfortunately I missed the update version note for the schema ppolicy. After updating and restarting the slapd service, I can no longer delete the schema. I get the following error message: "root@dsme01:~# slapcat -n0 > config.ldif olcAttributeTypes: value #0 olcAttributeTypes: Duplicate attributeType: "1.3.6.1.4.1.42.2.27.8.1.1" config error processing cn={15}ppolicy,cn=schema,cn=config: olcAttributeTypes: Duplicate attributeType: "1.3.6.1.4.1.42.2.27.8.1.1" slapcat: bad configuration file!" What can I do now? Greetings from Stefan Harbich

3 2

Help me understand LMDB internals
by ruben.soh＠rutgers.edu 20 Oct '24

20 Oct '24

I am a student trying to understand the code for LMDB. One thing I am confused about - there is apparently no mutex for creating a reader transaction. In the function mdb_txn_renew0, which is called by mdb_txn_begin to create the transaction, I see that if we are creating a read-only transaction, we select a meta page without acquiring any mutex. Then, the meta page snapshotted in these lines (and accessed later in the function as well): /* Copy the DB info and flags */ memcpy(txn->mt_dbs, meta->mm_dbs, CORE_DBS * sizeof(MDB_db)); /* Moved to here to avoid a data race in read TXNs */ txn->mt_next_pgno = meta->mm_last_pg+1; What happens if a write transaction commits to the meta page while this copy is happening? Isn't it possible that the reader transaction will have copied an inconsistent view of the meta page? Sincerely, Ruben

2 1

Re: Replication issue during performance test with MMR configuration and LastBind enabled
by Falgon 16 Oct '24

16 Oct '24

Hello, I'm working on the same project as Meheni. Thanks for your answer, we'll try version 2.6 OpenLDAP using the lastbind-precision. However we have several questions for the current version we're using. Is this a known problem and referenced somewhere? (we haven't found it) Is it normal to find no replication error logs even in stats + sync mode? We ran some tests in sequential mode (300,000 accounts one after the other) and managed to reproduce the problem. -Denis Le mer. 11 oct. 2023 à 14:11, Quanah Gibson-Mount <quanah(a)fast-mail.org> a écrit : > > > --On Tuesday, October 10, 2023 9:30 PM +0200 Ziani Meheni > <mehani06(a)gmail.com> wrote: > > > > > > > Hello, we are working on a project and we've come across a problem with > > the replication after performance testing : > > You need to use OpenLDAP 2.6 and then set the: > > lastbind-precision > > value. I use 5 minutes. > > --Quanah >

4 8

Advice for upgrade from OpenLDAP 2.4 to 2.6?
by gsafcik+ldap＠gmail.com 15 Oct '24

15 Oct '24

Hello all, We are planning an upgrade from OpenLDAP 2.4 to 2.6. We would like some guidance on the upgrade path. We are currently looking over the upgrade guides: - https://www.openldap.org/doc/admin25/appendix-upgrading.html - https://www.openldap.org/doc/admin26/appendix-upgrading.html Currently, we build OpenLDAP from source to create the RPMs and then install them. We are building version 2.4.56-4. Originally they were built for CentOS 7, but we've recently converted to AWS AL2023. We have 3 mdb write instances (synced to each other) and then many hdb read instances (consumers) syncing to those. The following are the RPMs built: - openldap-2.4.56-4.el7.x86_64.rpm - openldap-clients-2.4.56-4.el7.x86_64.rpm - openldap-compat-2.4.56-4.el7.x86_64.rpm - openldap-debuginfo-2.4.56-4.el7.x86_64.rpm - openldap-devel-2.4.56-4.el7.x86_64.rpm - openldap-servers-2.4.56-4.el7.x86_64.rpm We plan on addressing the components listed in those guides earlier and to build/install version 2.6 as we have before. We have run into an issue before where CPU spiked on our consumers when we tried to change them to mdb which stopped the 2.5 upgrade but now we're thinking of upgrading and changing the backend to mdb at the same time for the upgrade. We wanted to see if anyone has any advice or caveats that they've run into during their upgrades and to see if this general upgrade path is good. We appreciate any help anyone can offer with the OpenLDAP upgrade. Thanks!

3 2

ACL: write vs. manage
by Windl, Ulrich 14 Oct '24

14 Oct '24

Hi! Basically I have the same question as unanswered https://serverfault.com/q/998893/407952: What is the difference between write and manage? I have a use with write permissions for pwdGraceUseTime, and deleting that attribute requires "-e relax" for ldapmodify. However when my user ties it, it gets a ldap_modify: Insufficient access (50) Kind regards, Ulrich

2 1

symas2.6.7 is data transfer is faster in centos7 but very very slow in rocky8
by anilkumar.pathuri7＠gmail.com 11 Oct '24

11 Oct '24

Hi Team, GM We are working on moving from openldap2.4.44 to symasldap2.6.7. We have total of 13million docs. centos7 to centos7 is taking 1~2hours where as rocky8 is taking 48hours and more. Settings of centos7 and rocky8 are identical. We are moving to rocky8 as centos7 is EOL. Can you please let us know how we can fix the data transfer issue. Regards, Anil P

4 14

ldapsearch by aliased objectClass
by Joril 11 Oct '24

11 Oct '24

Hello, I've created an alias by following the FAQ at https://www.openldap.org/faq/data/cache/1111.html dn: uid=alias,ou=People,dc=example,dc=net objectclass: alias objectclass: extensibleObject uid: alias aliasedobjectname: uid=target,ou=Retired People,dc=example,dc=com The problem I'm facing is that this needs to be queried by an application (out of my control) that queries LDAP looking for a particular objectClass, like this: (&(objectClass=person)(uid=alias)) This query misses the alias, I guess because the alias object has just "alias" and "extensibleObject" as classes... Is this expected? Is there a way to work around this, server-side? I mean, to tell the LDAP server to look for "aliased" properties? Many thanks for your time!

3 3

An interesting note on using ldappasswd in OpenLDAP 2.4
by Windl, Ulrich 09 Oct '24

09 Oct '24

Hi! In the past I was using some LDAP administrator account to reset a user's password (using "ldappasswd -H $server -x -ZZ -D $admin -W "$DN""), and the system output the new password. But after having created a special account that ist to be used to reset passwords only, the same command failed with Result: Constraint violation (19) Additional info: Password fails quality checking policy So it seems the admin account circumvents the password policy restrictions, while the special account does not. But the main reason I'm writing this is that the passwords generated by ldappasswd do not seem to fulfill today's requirements (too short, basically). However 2.4 is very old, and it seems the current ldappasswd does no longer create automatic passwords (reading https://git.openldap.org/openldap/openldap/-/blob/master/clients/tools/ldap…). Regards, Ulrich

2 1

Slapd process randomly hangs on consumers and comes back to life after a while with no intervention
by Pierre-Jean CROUZET 20 Sep '24

20 Sep '24

Hello, To start with, this is my very first post on a mailing list of this kind. I've read much about how to do things right, like here: https://www.openldap.org/doc/admin24/troubleshooting.html or here: https://www.openldap.org/faq/data/cache/59.html Nonetheless, please do tell me if I'm not following the standards. I'm facing an issue with my OpenLDAP servers that I struggle to fix or even find info about. To summarize: We have an architecture of 2 providers with mirror mode replication for their configuration. They are LXC's hosted in a datacenter. We have 2 consumers with mirror mode replication for their config also, and they get the DB (mdb backend) from the above providers. They are VMs hosted in a different hypervisor and datacenter than the providers. We have a loadbalancing architecture in front that sends requests evenly to the 4 servers. The writes requests directed to the consumers are forwarded to the providers using the chain overlay. The slapd process of those 2 consumers randomly hangs. When it happens, the slapd service is still running and listening, but not a single query can go through, even the logging stops. Like a complete freeze. The service comes back to life after some time (several minutes, different every time) without any manual intervention. Trying to manually restart the process during such even obviously fails, unless I kill -9, which is not something I want to do. My observations so far : - The hangs appear only during business hours (nothing during nights or week-end). - Only the consumers hang. The providers are always fine. - CPU / RAM / Disks are fine before / during the crashes. - The hangs seem random and I could not find a way to trigger them at will. - strace shows the following lines in an infinite loop during hangs. ``` [pid 1082] gettimeofday({tv_sec=1726669191, tv_usec=694473}, NULL) = 0 [pid 1082] poll([{fd=18, events=POLLIN|POLLPRI}], 1, 100) = 0 (Timeout) [pid 1082] sched_yield() ``` It seems that the process is waiting for some data that never comes. The fd=18 is referencing to a TCP socket connected to provider1. So it would suggests that the provider is not sending what the consumer wants. This has led me to several suppositions: 1. Network issues Unlikely, since only those 2 servers in the DC are experiencing misbehavior, and I can telnet / ldapsearch from the faulty consumer to the provider with no problem during hangs. 2. Syncrepl / slapo-chain misconfiguration I might have a configuration problem, but no matter how much I review it, I don't see what's wrong. I've provided the syncrepl / slapo-chain conf in the config.ldif attachment. I've also provided several other attachments that I thought would be helpful: - log.txt => The slapd logs in trace level that show the last bind before the service hangs. - ldaps_request.log => An ldapsearch performed against the faulty consumer during hang. - starttls_request.log => Same as above, but using StartTLS => the connection seems successful and stops at the server hello TLS exchange. Versions : - slapd: 2.5.18 LTS - Server: Ubuntu 22.04 LTS I am a bit out of ideas on things I could try to fix the issues. Hence this email. I thank you for your time and I am very grateful for any help you could give me. Regards, Pierre-Jean

1 0

"realdn" in auditlog
by Christopher Paul 18 Sep '24

18 Sep '24

Hi OpenLDAP-Technical, What does a comment beginning with "realdn" mean in an auditlog LDIF? I see it after the first line of COMMENT FIELD INFORMATION on some modify operations. Running version 2.5.18 on Ubuntu. At first glance, it looks like it's due to overlays (refint, ppolicy) making modifications as a result of an operation by "realdn"(?)b Many thanks for any insight on this. -- Chris Paul | Rex Consulting |https://www.rexconsulting.net ParaphraseBasicClose

2 1

Double free in ldap_set_option
by radiatejava 16 Sep '24

16 Sep '24

I am getting double free core from ldap library. We are running this version of the code (2.4.49 with 2 patches). git clone https://github.com/openldap/openldap.git -b OPENLDAP_REL_ENG_2_4_49 git cherry-pick 32e965c27134d3d83adbf471186330e361150491 git cherry-pick 5452fb154eaabc46992402a4f1bb1081bc367157 Any idea what could be going on? I am putting the stack trace below: #2 0x00007a1e506d7590 in DoLiveCoreDump (cause=0x7a1e506df7e2 "DoubleFree") at src/heap-profiler.cc:732 #3 0x00007a1e506bed31 in (anonymous namespace)::do_free_with_callback (ptr=ptr@entry=0x5af3d4216dc8, invalid_free_fn=0x7a1e506bd270 <(anonymous namespace)::InvalidFree(void*)>) at src/tcmalloc.cc:1299 #4 0x00007a1e506dd467 in (anonymous namespace)::do_free (ptr=0x5af3d4216dc8) at src/tcmalloc.cc:1376 #5 tc_free (ptr=0x5af3d4216dc8) at src/tcmalloc.cc:1761 #6 0x00007a1e3f19106b in ldap_pvt_tls_set_option (ld=ld@entry=0x0, option=option@entry=24579, arg=arg@entry=0x7a1e416e2220) at tls2.c:766 #7 0x00007a1e3f186386 in ldap_set_option (ld=0x0, option=24579, invalue=0x7a1e416e2220) at options.c:791 #8 0x00007a1e415e03fd in auth::LdapAuthenticationBroker::connectAndBindLdap(sec::LdapProvider const&) () from /mgmt/usr/lib/x86_64-linux-gnu/libauth.so

2 1

Search callbacks for refreshAndPersist sync searches
by Hawes, David 10 Sep '24

10 Sep '24

I have a custom overlay that registers a callback to rewrite attribute values for searches. I noticed that it was not working for refreshAndPersist sync searches for queued responses, and the reason for this is that there are no callbacks registered in syncprov_qtask() [1]. I'd see the initial responses come through with rewritten attributes, but later responses would not be rewritten. I had some success adding the callbacks back, but it was a bit of a minefield. Before investigating further, I was hoping to understand why the decision was made to not set callbacks in syncprov_qtask(). For now I'm operating under the assumption that this is simply not supported. So, why aren't callbacks supported for queued sync responses? I noticed that valsort doesn't handle syncrepl responses [2], and I wonder if the reason is because the results may be inconsistent, as I am experiencing. [1] https://git.openldap.org/openldap/openldap/-/blob/OPENLDAP_REL_ENG_2_5/serv… [2] https://git.openldap.org/openldap/openldap/-/blob/OPENLDAP_REL_ENG_2_5/serv…

2 3

certutil - nsldap + nss trustargs
by venugopal chinnakotla 04 Sep '24

04 Sep '24

Hi Team, We are migrating our source code to use openldap client libraries instead of nsldap libraries. We have the below query for the openldap team. Please share your thoughts on this feature availability in the openldap library. nsldap has the below feature while validating TLS Connections. please refer to the nss tool, and refer to the section "Options and Arguments" https://www-archive.mozilla.org/projects/security/pki/nss/tools/certutil -t trustargs Specify the trust attributes to modify in an existing certificate or to apply to a certificate when creating it or adding it to a database. There are three available trust categories for each certificate, expressed in this order: "SSL, email, object signing". In each category position use zero or more of the following attribute codes: p Valid peer P Trusted peer (implies p) c Valid CA T Trusted CA to issue client certificates (implies c) C Trusted CA to issue server certificates (SSL only) (implies c) u Certificate can be used for authentication or signing w Send warning (use with other attributes to include a warning when the certificate is used in that context) The attribute codes for the categories are separated by commas, and the entire set of attributes enclosed by quotation marks. For example: -t "TCu,Cu,Tuw" Use the -L option to see a list of the current certificates and trust attributes in a certificate database. our query: Does openldap provide trustargs support to verify TLS connection? Please share details on this. Thanks In advance. -- Thanks, *c.venugopal*

4 3

Syncrepl getting stuck on partial sync
by jose Pereira 04 Sep '24

04 Sep '24

Hello All! I have multiple setups with a Provider(2.6.4) and consumer(2.6.2) with RefreshAndPersist. From time to time I see data missing in the consumer e.g only groups are present and all users are missing, even though users were never removed from the Provider, and were present in the Consumer beforehand. On the Provider all data is present and correct. I can still see the incoming connection, from the Consumers Sync, in the Provider without errors. No errors on the Comsumer logs from syncrepl (with -256 logs). Attempted to look in debug (-1 logs), but nothing caught my eye. When this happened I attempted restart services on both the Provider and the Consumer, disabling and re-enabling the sync on the Consumer. Only clearing the Consumers database seemed to fix the issue. There maybe be sporatic failures in the network connectivity between both systems. This is the config on the Consumer olcSyncrepl: {0}rid=000 provider=ldaps://Provider:636 type=refreshAndPersist retry="30 5 300 +" searchbase="ou=subtree,dc=test,dc=net" scope=sub schemachecking=on binddn="cn=Manager,dc=test,dc=net" credentials=credentials keepalive=240:10:30 Any advice on how to troubleshoot this or fix it?

4 18

FW: [External] RE: Help Openldap objectclass schema add
by Khan, Afaque 04 Sep '24

04 Sep '24

Hi Openldap- Version 2.6.7 I am using below command to change the current running port to 2636 but I am getting below error message Error: name '_pretty_exception' is not defined dsconf -D "cn=admin..... " ldap://(hostname) config replace nsslapd-secureport=2636 Please let me know the command or steps to change the port and also please let me know where to add below local objectclass created file to add new objectclass in schema I am not able to find the slapd.conf(5) or slapd.conf(8) file to include below schema objectclass file '/usr/local/etc/openldap/schema/local.schema' Thanks Afaque khan From: Chris Paul <chris.paul(a)rexconsulting.net<mailto:chris.paul@rexconsulting.net>> Sent: Tuesday, September 3, 2024 1:10 AM Subject: [External] RE: Help Openldap objectclass schema add You don't often get email from chris.paul(a)rexconsulting.net<mailto:chris.paul@rexconsulting.net>. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification> WARNING: This message has originated from an External Source. This may be a phishing email that can result in unauthorized access to Honeywell systems. Please use proper judgment and caution when opening attachments, clicking links, scanning QR codes, or responding. Hi Afaque, You have not indicated what you have tried, given any error, your configuration, or useful information except that everyone now knows that you work for..... Have you read the OpenLDAP admin guide, and the man pages? When I post to openldap-technical(a)openldap.org<mailto:openldap-technical@openldap.org>, I never reveal my clients' identity, for their protection. Yes, obscurity is a layer of security. Good luck to you and....., -- Chris Paul | https://www.rexconsulting.net Sent: Monday, September 2, 2024 3:13 AM To: openldap-technical-request(a)openldap.org<mailto:openldap-technical-request@openldap.org>; openldap-technical(a)openldap.org<mailto:openldap-technical@openldap.org> Subject: Help Openldap objectclass schema add Hi Openldap Team, I have installed the openldap openldap-2.6.7 version on RHEL 8 but I am not able to add the new objectclass hworgperson and attribute manager and hwtype. Please let me know how I can add the new objectclass and attributes. Help -----Original Message----- From: openldap-technical-request(a)openldap.org<mailto:openldap-technical-request@openldap.org> <openldap-technical-request(a)openldap.org<mailto:openldap-technical-request@openldap.org>> Sent: Monday, September 2, 2024 3:37 PM Subject: [External] Welcome to the "openldap-technical" mailing list WARNING: This message has originated from an External Source. This may be a phishing email that can result in unauthorized access to Honeywell systems. Please use proper judgment and caution when opening attachments, clicking links, scanning QR codes, or responding. Welcome to the "openldap-technical" mailing list! To post to this list, send your message to: openldap-technical(a)openldap.org<mailto:openldap-technical@openldap.org> You can unsubscribe or make adjustments to your options via email by sending a message to: openldap-technical-request(a)openldap.org<mailto:openldap-technical-request@openldap.org> with the word 'help' in the subject or body (don't include the quotes), and you will get back a message with instructions. You will need your password to change your options, but for security purposes, this password is not included here. If you have forgotten your password you will need to reset it via the web UI.

2 1

Help Openldap objectclass schema add
by Khan, Afaque 04 Sep '24

04 Sep '24

Hi Openldap Team, I have installed the openldap openldap-2.6.7 version on RHEL 8 but I am not able to add the new objectclass hworgperson and attribute manager and hwtype. Please let me know how I can add the new objectclass and attributes. Help Thanks & Regards, Afaque khan Advanced Cyber Sec Archt/Engr Honeywell | Honeywell Global Security Mobile: +91 9599800986 md.khan(a)honeywell.com<mailto:md.khan@honeywell.com> Thanks & Regards, Afaque khan Advanced Cyber Sec Archt/Engr Honeywell | Honeywell Global Security Mobile: +91 9599800986 md.khan(a)honeywell.com<mailto:md.khan@honeywell.com> -----Original Message----- From: openldap-technical-request(a)openldap.org <openldap-technical-request(a)openldap.org> Sent: Monday, September 2, 2024 3:37 PM To: Khan, Afaque <md.khan(a)honeywell.com> Subject: [External] Welcome to the "openldap-technical" mailing list WARNING: This message has originated from an External Source. This may be a phishing email that can result in unauthorized access to Honeywell systems. Please use proper judgment and caution when opening attachments, clicking links, scanning QR codes, or responding. Welcome to the "openldap-technical" mailing list! To post to this list, send your message to: openldap-technical(a)openldap.org<mailto:openldap-technical@openldap.org> You can unsubscribe or make adjustments to your options via email by sending a message to: openldap-technical-request(a)openldap.org<mailto:openldap-technical-request@openldap.org> with the word 'help' in the subject or body (don't include the quotes), and you will get back a message with instructions. You will need your password to change your options, but for security purposes, this password is not included here. If you have forgotten your password you will need to reset it via the web UI.

2 1

long restart time of openldap
by Norbert 30 Aug '24

30 Aug '24

Hi, we have ldap servers with many ldap entries (3 million and more) these are replicating with other instances (Master-Master + Read slaves). When we need to restart and ldap due to maintenance or other problems those are taking a lot of time before they serving a requests again. It looks like that in most cases it does a full refresh of the whole tree (printed to the log) but there are is also a timespan where nothing is printed to the log but the slapd process is really busy and consuming more than one core. We are currently using 2.5.16.1 of openldap but have experienced this with older version too. Any hint about how to improve this? Thanks, Norbert

2 5

LMDB write commit time hockey-sticks [corrected]
by Alec Matusis 23 Aug '24

23 Aug '24

Problem: Our application first writes data into LMDB. After the write cursor is closed, the LMDB is used with a read-only cursor. Our problem is that writing commit time hockey-sticks. Here is the graph on the machine with 128GB of RAM: https://i.imgur.com/py83dRV.jpeg (happens at 3200) We used a virtual machine with 16 GB, to wait less for this hockey-stick: https://i.imgur.com/CYohM3O.jpeg (red curve is the commit time, happens at 3080; the lmdb env stats are on the bottom graph. Size on the top graph is total program size from /proc/[pid]/statm) . We tried various combinations of environment flags: MDB_WRITEMAP, MDB_MAPASYNC, MDB_NOSYNC and MDB_NOMETASYNC. We also tried increasing mapsize. Nothing seems to matter (e.g. https://i.imgur.com/MkZJkxp.jpeg with 64G mapsize and MDB_NOSYNC), the best combination seems to be without any flags at all. Smaller mapsizes are worse, but increasing mapsize above 4GB in a 16GB RAM machine doesn't seem to gain anything. Can you recommend a way to prevent or delay this hockey-stick when we are in the write regime and the reads are very minimal? We just want to write the data to disk fast, we don’t even need mmap() for read performance, we will need it in the read-only mode later, after the write cursor finishes and a read-only cursor is used. Details: The environment contains two databases, one with no flags (keys are 32 bytes, values are 8 byte integers), second one with MDB_INTEGERKEY (keys are 8 byte integers, values are 32 bytes, uses MDB_APPEND for writing). All commits are similar sized, 6000-8000 pages (page size is 4096). Each commit therefore is ~400k keys total for boths dbs, (7000*4096/((32+8)*2). The VM has no disk swap, from perf output here https://i.imgur.com/zuTGawz.jpeg we can see that the machine is under page swap load. On a VM with 16GB RAM, hockey-stick happens when the LMDB size is only 1.5GB, 12% of the available RAM. Detailed stats: Below is the excerpt from the application log on each commit, the same data is plotted in the linked graphs above. Memory stats are from. /proc/[pid]/statm , lmdb stats are from the environment.“Difference” the time the commit takes, it degrades from 45 seconds to 3+ minutes. Final LMDB size in this log is pgs_in_use 448993*4096 = 1.84GB. Start of log before write degradation: 2024-08-09 02:26:19 [INFO][src/importer.rs:198] File 3054: 132932384 bytes. Memory stats: Size: 27540910 pages, Resident: 286072 pages, Shared: 99484 pages, Text: 981 pages, Data: 191849 pages, lmdb: dict_env: branch_pgs 0 leaf_pgs 1 of_pgs 0 last_pgno 108959 last_txnid 18 max_readers 126 num_readers 1 free_pgs 56171 pgs_in_use 52788 Difference: 0 min 44 sec 2024-08-09 02:27:03 [INFO][src/importer.rs:198] File 3055: 133951354 bytes. Memory stats: Size: 27541730 pages, Resident: 298463 pages, Shared: 111020 pages, Text: 981 pages, Data: 192669 pages, lmdb: dict_env: branch_pgs 0 leaf_pgs 1 of_pg s 0 last_pgno 121928 last_txnid 19 max_readers 126 num_readers 1 free_pgs 62881 pgs_in_use 59047 Difference: 0 min 48 sec 2024-08-09 02:27:51 [INFO][src/importer.rs:198] File 3056: 133218473 bytes. Memory stats: Size: 27543735 pages, Resident: 313441 pages, Shared: 123980 pages, Text: 981 pages, Data: 194674 pages, lmdb: dict_env: branch_pgs 0 leaf_pgs 1 of_pg s 0 last_pgno 133243 last_txnid 20 max_readers 126 num_readers 1 free_pgs 69672 pgs_in_use 63571 Difference: 0 min 40 sec …… End of log after write degradation: 2024-08-09 04:39:33 [INFO][src/importer.rs:198] File 3127: 132694310 bytes. Memory stats: Size: 27654397 pages, Resident: 1028693 pages, Shared: 727992 pages, Text: 981 pages, Data: 305336 pages, lmdb: dict_env: branch_pgs 0 leaf_pgs 1 of_pgs 0 last_pgno 745440 last_txnid 91 max_readers 126 num_readers 1 free_pgs 308699 pgs_in_use 436741 Difference: 2 min 36 sec 2024-08-09 04:42:09 [INFO][src/importer.rs:198] File 3128: 133418687 bytes. Memory stats: Size: 27654397 pages, Resident: 1033516 pages, Shared: 732815 pages, Text: 981 pages, Data: 305336 pages, lmdb: dict_env: branch_pgs 0 leaf_pgs 1 of_pgs 0 last_pgno 745440 last_txnid 92 max_readers 126 num_readers 1 free_pgs 304043 pgs_in_use 441397 Difference: 3 min 18 sec 2024-08-09 04:45:27 [INFO][src/importer.rs:198] File 3129: 133118782 bytes. Memory stats: Size: 27654397 pages, Resident: 1043876 pages, Shared: 743175 pages, Text: 981 pages, Data: 305336 pages, lmdb: dict_env: branch_pgs 0 leaf_pgs 1 of_pgs 0 last_pgno 762922 last_txnid 93 max_readers 126 num_readers 1 free_pgs 313929 pgs_in_use 448993

1 1

start slapd with mdb on readonly filesystem
by Zach Hanson-Hart 19 Aug '24

19 Aug '24

Hello list, When starting slapd when an lmdb backend in readonly mode is on a readonly filesystem, slapd fails to start with: 66c347f4.334226ce 0x7fc9c14ffb08 @(#) $OpenLDAP: slapd 2.6.6 (Oct 22 2023 00:57:15) $ 2024-08-19T09:26:12.865756736-04:00 openldap 2024-08-19T09:26:12.875884302-04:00 66c347f4.342f703c 0x7fc9c14ffb08 olcDbDirectory: value #0: invalid path: Read-only file system 2024-08-19T09:26:12.875912369-04:00 66c347f4.3430d2ab 0x7fc9c14ffb08 config error processing olcDatabase={1}mdb,cn=config: olcDbDirectory: value #0: invalid path: Read-only file system 2024-08-19T09:26:12.875942620-04:00 66c347f4.3434526e 0x7fc9c14ffb08 slapd stopped. 2024-08-19T09:26:12.875950918-04:00 66c347f4.343518c7 0x7fc9c14ffb08 connections_destroy: nothing to destroy. Is there something I can set to make it start even though the filesystem is readonly? For reference, the slapd configuration is below: dn: cn=config objectClass: olcGlobal cn: config olcPidFile: /etc/openldap/scratch/run/slapd.pid olcArgsFile: /etc/openldap/scratch/run/slapd.args olcLogLevel: stats olcAuthzPolicy: none olcSecurity: ssf=0 tls=0 simple_bind=0 transport=0 olcReadOnly: FALSE dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAccess: to dn.base="" by * read olcAccess: to dn.base="cn=Subschema" by * read dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulepath: /usr/lib/openldap olcModuleload: back_mdb.so olcModuleload: back_ldap.so olcModuleLoad: ppolicy dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema include: file:///etc/openldap/schema/core.ldif include: file:///etc/openldap/schema/cosine.ldif include: file:///etc/openldap/schema/inetorgperson.ldif dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: to dn.base="cn=config" by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by * read olcAccess: to dn.subtree="cn=config" by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * read olcAccess: to * by * read dn: olcDatabase={1}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb olcSuffix: ou=data,dc=example,dc=com olcRootDN: cn=root,ou=data,dc=example,dc=com olcRootPW: <REDACTED> olcReadOnly: TRUE olcDbDirectory: /var/lib/openldap/data olcAccess: to dn.base="ou=data,dc=example,dc=com" by * read # Allow full read access for now for testing. olcAccess: to dn.subtree="ou=data,dc=example,dc=com" by * read olcLimits: * size=unlimited time=unlimited olcDbMaxsize: 171798691840 olcDbIndex: objectClass eq,pres olcDbIndex: entryUUID eq olcDbIndex: entryCSN eq olcDbIndex: cn eq Thanks in advance. Zach

1 0

Need support to configure ldap for duo MFA for auth proxy.
by Ajay Kumar 16 Aug '24

16 Aug '24

Hi Team, we get stuck at configuring Openldap for enabling Multifactor authentication for ldap users. As per duo support team, for doing the same we need to configure schema includes the memberOf overlay for groups and that the following requirements to satisfied: Synced groups must have the groupOfNames object class. Synced groups must list their members by DN (directoryName) via the member attribute. Synced groups must have a cn attribute, used as the Duo group name after import. Synced groups must also have the attributes entrydn (used as the distinguished name) and entryuuid (the group unique identifier). Synced users must list group memberships by DN using the memberOf attribute. Synced users must have the organizationalPerson object class. We are trying to enable Multifactor authentication using duo auth proxy & duo admin panel configuration for ldap users. Ldap server is getting synced successfully with Duo admin portal but groups and users details not getting fetched at duo admin portal. Duo support team mentioned to change ldap configuration as mention in below mentioned article. Can you pls share some reference document to make required changes. https://duo.my.site.com/s/article/4529?language=en_US Regards, Ajay Kumar Engineering Cloud Ops | Bharti Airtel Ltd. Mob.: +91 8510020994 [photo_6075787602121832799_m] *********************************************************************************************************************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited . The information contained in this mail is propriety and strictly confidential. *********************************************************************************************************************************************************************** “CONFIDENTIALITY NOTICE This e-mail message and any attachments are only for the use of the intended recipient and may contain information that is privileged, confidential or exempt from disclosure under applicable law. If you are not the intended recipient, any disclosure, distribution or other use of this e-mail message or attachments is prohibited. If you have received this e-mail message in error, please delete and notify the sender immediately. Thank you.”

2 1

Push-based synchronization & dynamic attributes
by Benjamin Renard 13 Aug '24

13 Aug '24

Hello, Since updating our LDAP infrastructure to OpenLDAP 2.5 (2.5.13 from the Debian repository), we have encountered desynchronization issues with certain objects. The synchronization in place is in push mode as documented in the official documentation (https://www.openldap.org/doc/admin25/replication.html#Syncrepl%20Proxy). The problem seems to stem from the fact that we are using dynamic attributes via the dynlist overlay, and the master server attempts to push these dynamic attributes to the slave servers when modifications are made to these objects, which the slaves refuse. Log extract from one of our slave servers: Aug 13 10:12:28 volubilis slapd[2005636]: conn=20983 op=54 MOD dn="uid=ele-ladon-test,ou=contracts,o=easter-eggs" Aug 13 10:12:28 volubilis slapd[2005636]: conn=20983 op=54 MOD attr=eeTechnicalContact eeStartDate eeStorageDisks entryCSN modifiersName modifyTimestamp eeContractId eeContractIncludedService Aug 13 10:12:28 volubilis slapd[2005636]: conn=20983 op=54 RESULT tag=103 err=16 qtime=0.000022 etime=0.000536 text=modify/delete: eeContractId: no such attribute Note: The attribute eeContractId is a dynamic attribute of the object in question. Previously, with OpenLDAP 2.4, we did not have this issue, and the attributes were dynamic (and therefore managed by dynlist) on both our master server and slave servers. To immediately resolve this problem, we have removed the dynlist configuration on our slave servers. These attributes are therefore "static" on our slave servers, and desynchronizations are potentially possible. How can we correctly manage this situation? Please note that some of the affected attributes are both static on certain objects and dynamic on others, so we cannot simply exclude them completely from synchronization. Thank you in advance. -- Benjamin Renard - Easter-eggs 44-46 rue de l'Ouest - 75014 Paris - France - Métro Gaité Phone: +33 (0) 1 43 35 00 37 - mailto:brenard@easter-eggs.com

1 0

Help using the memberOf overlay
by awoestmann＠intevation.de 13 Aug '24

13 Aug '24

Hi everyone, i am trying to set up a OpenLDAP (2.6.7 in a Ubuntu noble container) with the memberOf Overlay activated. Adding the users and groups seems to work fine but i was not yet able to activate the overlay and query the memberships of a given user. I am using the following ldif to load the overlay: dn: cn=module,cn=config cn: module objectClass: olcModuleList olcModuleLoad: memberof olcModulePath: /usr/lib/ldap dn: olcOverlay={0}memberof,olcDatabase={1}mdb,cn=config objectClass: olcConfig objectClass: olcMemberOf objectClass: olcOverlayConfig objectClass: top olcOverlay: memberof olcMemberOfDangling: ignore olcMemberOfRefInt: TRUE olcMemberOfGroupOC: groupOfNames olcMemberOfMemberAD: member olcMemberOfMemberOfAD: memberOf The config is added using "slapadd -n0 -l /path/to/ldif", after that i add the users using slapadd. To check if the overlay works i am trying to query the memberOf attribute using ldapvi: "ldapvi --discover "(uid=exampleUid)" memberOf" Does anyone has a hint for me what i am doing wrong? Best regards, Alexander

5 5

LMDB write commit time hockey-sticks
by Alec Matusis 12 Aug '24

12 Aug '24

Problem: Our application first writes data into LMDB. After the data is written, the LMDB is used in the read-only mode. Our problem is that writing commit time hockey-sticks. Here is the graph on the machine with 128GB of RAM: https://i.imgur.com/py83dRV.jpeg (happens at 3200) We used a virtual machine with 16 GB, to wait less for this hockey-stick: https://i.imgur.com/CYohM3O.jpeg (red curve is the commit time, happens at 3080; the lmdb env stats are on the bottom graph. Size on the top graph is total program size from /proc/[pid]/statm) . We tried various combinations of environment flags: MDB_WRITEMAP, MDB_MAPASYNC, MDB_NOSYNC and MDB_NOMETASYNC. We also tried increasing mapsize. Nothing seems to matter (e.g. https://i.imgur.com/MkZJkxp.jpeg with 64G mapsize and MDB_NOSYNC), the best combination seems to be without any flags at all. Smaller mapsizes are worse, but increasing mapsize above 4GB in a 16GB RAM machine doesn't seem to gain anything. Can you recommend a way to prevent or delay this hockey-stick when we are in the write-only, append-only regime? We just want to write the data to disk fast, we don’t even need mmap() here, we will need it in the read-only mode later. Details: The environment contains two databases, one with no flags (keys are 32 bytes, values are 8 byte integers), second one with MDB_INTEGERKEY (keys are 8 byte integers, values are 32 bytes, uses MDB_APPEND for writing). All commits are similar sized, 6000-8000 pages (page size is 4096). Each commit therefore is ~400k keys total for boths dbs, (7000*4096/((32+8)*2). The VM has no disk swap, from perf output here https://i.imgur.com/zuTGawz.jpeg we can see that the machine is under page swap load. On a VM with 16GB RAM, hockey-stick happens when the LMDB size is only 1.5GB, 12% of the available RAM. Detailed stats: Below is the excerpt from the application log on each commit, the same data is plotted in the linked graphs above. Memory stats are from. /proc/[pid]/statm , lmdb stats are from the environment.“Difference” the time the commit takes, it degrades from 45 seconds to 3+ minutes. Final LMDB size in this log is pgs_in_use 448993*4096 = 1.84GB. Start of log before write degradation: 2024-08-09 02:26:19 [INFO][src/importer.rs:198] File 3054: 132932384 bytes. Memory stats: Size: 27540910 pages, Resident: 286072 pages, Shared: 99484 pages, Text: 981 pages, Data: 191849 pages, lmdb: dict_env: branch_pgs 0 leaf_pgs 1 of_pgs 0 last_pgno 108959 last_txnid 18 max_readers 126 num_readers 1 free_pgs 56171 pgs_in_use 52788 Difference: 0 min 44 sec 2024-08-09 02:27:03 [INFO][src/importer.rs:198] File 3055: 133951354 bytes. Memory stats: Size: 27541730 pages, Resident: 298463 pages, Shared: 111020 pages, Text: 981 pages, Data: 192669 pages, lmdb: dict_env: branch_pgs 0 leaf_pgs 1 of_pg s 0 last_pgno 121928 last_txnid 19 max_readers 126 num_readers 1 free_pgs 62881 pgs_in_use 59047 Difference: 0 min 48 sec 2024-08-09 02:27:51 [INFO][src/importer.rs:198] File 3056: 133218473 bytes. Memory stats: Size: 27543735 pages, Resident: 313441 pages, Shared: 123980 pages, Text: 981 pages, Data: 194674 pages, lmdb: dict_env: branch_pgs 0 leaf_pgs 1 of_pg s 0 last_pgno 133243 last_txnid 20 max_readers 126 num_readers 1 free_pgs 69672 pgs_in_use 63571 Difference: 0 min 40 sec …… End of log after write degradation: 2024-08-09 04:39:33 [INFO][src/importer.rs:198] File 3127: 132694310 bytes. Memory stats: Size: 27654397 pages, Resident: 1028693 pages, Shared: 727992 pages, Text: 981 pages, Data: 305336 pages, lmdb: dict_env: branch_pgs 0 leaf_pgs 1 of_pgs 0 last_pgno 745440 last_txnid 91 max_readers 126 num_readers 1 free_pgs 308699 pgs_in_use 436741 Difference: 2 min 36 sec 2024-08-09 04:42:09 [INFO][src/importer.rs:198] File 3128: 133418687 bytes. Memory stats: Size: 27654397 pages, Resident: 1033516 pages, Shared: 732815 pages, Text: 981 pages, Data: 305336 pages, lmdb: dict_env: branch_pgs 0 leaf_pgs 1 of_pgs 0 last_pgno 745440 last_txnid 92 max_readers 126 num_readers 1 free_pgs 304043 pgs_in_use 441397 Difference: 3 min 18 sec 2024-08-09 04:45:27 [INFO][src/importer.rs:198] File 3129: 133118782 bytes. Memory stats: Size: 27654397 pages, Resident: 1043876 pages, Shared: 743175 pages, Text: 981 pages, Data: 305336 pages, lmdb: dict_env: branch_pgs 0 leaf_pgs 1 of_pgs 0 last_pgno 762922 last_txnid 93 max_readers 126 num_readers 1 free_pgs 313929 pgs_in_use 448993

1 0

ppolicy: passing operational attribute changes from replica to provider
by Nick Urbanik 08 Aug '24

08 Aug '24

Dear Team, I love your work. in man(5) slapo-ppolicy we see: "In general, authentication attempts on a replica server only affect the copy of the operational attributes on that replica and will not affect any attributes for a user's entry on the provider." I would prefer to have the replica send the changes to the provider. Is the chain overlay the right approach for this?

2 1

Understanding LDAP vs shadow password policies
by Windl, Ulrich 08 Aug '24

08 Aug '24

Hi! I'm writing a tool that checks password policy provided by LDAP against the attributes defines in shadowAccount. For example shadowLastChange vs. pwdChangedTime. For one account I see: pwdChangedTime 20240806150232Z shadowLastChange 16000 (I have no idea where that 16000 came from, but the difference is almost 10 years if I understood it correctly) Sorry, for the ignorance, but *who* is expected to update those attributes on password change (assuming UNIX/Linux "passwd" is being used)? Could it be a permission problem when isn't updated? Also it seems to me that the "old LDAP client" is using shadowAccount attributes to display an expiration warning, while the newer sssd seems to use the LDAP password policy attributes instead. The original reason for writing the tool was users complaining that they didn't get a warning when their password was expired and grace logins were being used (and eventually the account being locked). I have a similar question: How many failed login attempts (pwdFailureTime) are being stored, and who will remove the attributes? We have a setting that at most 10 bad authentication attempts (pwdMaxFailure ) are allowed, and that the failed attempts will be deleted after two weeks (pwdFailureCountInterval). However one user has 15 authentication failures recorded, and the first one is like 10 years old. Our platform is Linux (SLES 12/15), BTW. Regards, Ulrich

1 0

Re: Maximum Replicating Consumers
by Erik de Waard 06 Aug '24

06 Aug '24

Curious what's the rationale of using syncrepl over delta-syncrepl? We have 40 consumers (5GB data (and using syncrepl) no problems, but was interested in switching.. thought it might be more efficient. On Sat, Aug 3, 2024, 05:10 Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Friday, August 2, 2024 9:15 PM +0000 thomaswilliampritchard(a)gmail.com > wrote: > > > OpenLDAP 2.4.56 (we are working to upgrade to OpenLDAP 2.5 LTS) > > Known issue with OpenLDAP 2.4 series. > > > We are configured with delta-syncrepl. > > I would recommend upgrading to the latest OpenLDAP 2.6 release and > switching to standard syncrepl. If you don't want to build OpenLDAP > yourself, the Symas packages are what I use in production. > > --Quanah >

3 3

Help debugging sync issue with accesslog
by BECOT Jérôme 06 Aug '24

06 Aug '24

Hello, We face sync issue between two servers (2.5.14) in mirrormode with accesslog. Some updates on groups are not replicated because the modification is not added to the accesslog where the modification is applied. There is no plain error when we ADD some groups (they are added to the DIT) but after enabling the 'sync' log level, we an see these errors: Aug 5 15:20:18 server1 slapd[15489]: conn=12173218 op=8040 accesslog_response: got result 0x50 adding log entry reqStart=20240805132018.000093Z,cn=accesslog We could find that it is probably due to olcAccessLogSuccess: TRUE, but the log follows with a normal result: Aug 5 15:20:18 server1 slapd[15489]: conn=12173218 op=8040 RESULT tag=105 err=0 qtime=0.000019 etime=0.034941 text= If we later update the group, a fullsync happens and the group is created on the other server. Since increasing loglevel may overwhelm the server, I didn't blindly try any other loglevels. How should I test and debug what makes the accesslog entry rejected (and thus, the object is not replicated) ? Thanks Jerome

3 3

Maximum Replicating Consumers
by thomaswilliampritchard＠gmail.com 06 Aug '24

06 Aug '24

Hi Friends, Is there a hard limit on the number of consumers that can replicate from a provider? I have a 3 provider master multi master configuration where each consumer is aware of all 3 providers and replicate with refreshAndPersist. Over time we find that the consumers stop getting updates from providers. We enabled keepalive on our replication configs and see that keepalive takes effect. After the idle timer expires keepalive seems to think the connection is still active. Is it possible the providers simply stop pushing changes to some consumers, or fail to push to some at a high number of consumers? What would be the potential failures modes of providers who are expected to push to a high number of consumers? Thanks for the considerations, Tom

2 9

Ordering index and integerOrderingMatch rule
by thierryblaise＠hotmail.com 05 Aug '24

05 Aug '24

Hi everyone, I posting again about my issue on my v2.5.18 OpenLDAP installation on RHEL8. I'm required by an editor to add a custom structural class to the LDAP schema, and especially afterwards to add an index on one interger attribute part of the new class. To that end, in openLdap, I think it means : 1) to my knowledge and following documentation (https://www.openldap.org/doc/admin25/schema.html#Attribute%20Type%20Specifi…), I need to declare an ordering matching rule in attribute definition of the schema. However, when I do that with the following olcAttributeTypes definition : olcAttributeTypes: ( 1.3.6.1.4.1.xxx.x.x.xxx NAME 'last-modified' DESC 'Object Last Modified Time' ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) and try to import the ldif containing this definition, the following error appears: modifying entry "cn={5}clients,cn=schema,cn=config" ldap_modify: Other (e.g., implementation specific) error (80) additional info: olcAttributeTypes: AttributeType inappropriate matching rule: "integerOrderingMatch" I tried with all documented OrderingMatch rules in case, but same error modulo name of OrderingMatch rule appears each time, as if syntax and rule of the attribute don't match. Note that I tested the attribute definition without the ORDERING rule, the attribute is correctly added, but search with operators "<=" and ">=" are not working. 2) add an index to y MDB database through, for example, the following ldif: dn: olcDatabase={1}mdb,cn=config add: olcDbIndex olcDbIndex: last-modified <indexKeyword> However, here, I can't find the index keyword needed for ordering in the documentation... don't know if this is even supported. Can somebody please help me on those two topics ? Regards,

3 5

ldap_simple_bind_s is failing after setting LDAP_OPT_NETWORK_TIMEOUT value
by venugopal chinnakotla 05 Aug '24

05 Aug '24

Hi Team, We are working on migration of nsldap C sdk to OpenLDAP C sdk for our application client code. We are using OpenLDAP 2.6.7. As part of this migration activity, we are replacing one of the timeout values. Without setting LDAP_OPT_NETWORK_TIMEOUT value, ldap bind is working fine and application functionality also working well with bind, search and other operations. After setting LDAP_OPT_NETWORK_TIMEOUT value, ldap_simple_bind_s is failing with return code -1 (LDAP error -1-Unknown Error). Here is the snippet. struct timeval tv = { 20, 0 }; ldap_set_option(ld, LDAP_OPT_NETWORK_TIMEOUT, (void *) &tv); lderr = ldap_simple_bind_s( ld, (char *)AdminDN, (char *)AdminPW); Here we are getting bind failure with return code as -1. But without setting LDAP_OPT_NETWORK_TIMEOUT, the bind function is working well. Could you help us to fix this issue? or let me know if I am missing anything here? -- Thanks, *c.venugopal*

1 0

ACL by anonyous auth
by pficheux＠integra.fr 05 Aug '24

05 Aug '24

Hello, I'm trying to put ACL for a group, to allow write actions. I followed this and it's workin : https://www.openldap.org/faq/data/cache/52.html Here is what I put in my ldif file: dn: olcDatabase={1}mdb,cn=config olcAccess: {0}to dn.subtree="dc=test,dc=example,dc=com" by group.exact="cn=writer,dc=test,dc=example,dc=com" write by anonymous auth But I have two questions: Why do I have to put "by anonymous auth"? Without that I have an error 49, invalid credentials. I have not put "by self write", and it's working like that. Is it important? Regards, Gab

3 9

No permissions on files created by LMDB
by Ian Emmons 31 Jul '24

31 Jul '24

I am attempting to use LMDB for the first time, on Mac OS 14.6 on an Apple Silicon (M3) Mac, using Apple’s clang compiler. The issue I am having is that when LMDB creates new data and lock files, they are created with no permissions at all, and then LMDB fails to open the file with error #13: Unable to open LMDB environment: Permission denied. After this happens, a directory listing (ls -l) shows this: ---------- 1 iemmons staff 8.0K Jul 31 14:45 tempFile.db-lock Where a typical directory entry on my system looks like this: -rw-r--r-- 1 iemmons staff 6.7K Apr 16 10:33 SomeFile.txt Is this issue something that you all might recognize and perhaps even know the fix for? If not, I will work up a minimal test case that exhibits the problem and post it. Thanks, Ian

2 1

multi-master OpenLDAP with SASL/GSSAPI
by Travis Bean 30 Jul '24

30 Jul '24

I developed a Bash script (https://launchpad.net/linuxha) to automate the installation and configuration of complex Linux software that is out of reach for most people. I want the syntax of this script to be perfect so I can use it as a teaching tool to educate people about Linux. If anyone on this mailing list is knowledgeable about multi-master OpenLDAP with SASL/GSSAPI authentication, please review the OpenLDAP/SASL/GSSAPI code that is part of my LinuxHA script and provide feedback. Thank you. Kind regards, Travis Bean

2 1

Re: Facing issues with Symas LDAP upgrade from 2.4 to 2.5
by anil kumar pathuri 24 Jul '24

24 Jul '24

hi Quanah, Hope you are doing well. Thank you for your email. PFA This is what I did: Installed openldap 2.4.44 --> Upgraded to Symas OpenLDAP 2.4.57 --> Upgrading from Symas OpenLDAP 2.4.57 to Symas OpenLDAP 2.6.7 ***PS: I am not using slapd.conf, what should I do in this case. Regards, Anil P On Fri, 17 May 2024 at 01:57, Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > --On Thursday, May 16, 2024 7:55 PM +0000 anilkumar.pathuri7(a)gmail.com > wrote: > > > Hi Team, GM > > Successful while trying to upgrade from openLDAP 2.4.44 to > SymasLDAP2.4.57 > > > > Facing issues while trying to upgrade to 2.5.x and 2.6.x from > > SymasLDAP2.4.57 https://repo.symas.com/soldap2.5/upgrading/ > > > > Issues while trying to upgrade from SymasLDAP2.4.57 to SymasLDAP 2.5.17. > > 1. config error processing olcDatabase={2}mdb,cn=config > > UNKNOWN attributeDescription "OLCDBINDEX" inserted > > Providing a config snippet is not particularly useful. > > You also say issue going from 2.5.x to 2.6.x but then you say the error is > in going from 2.4.57 to 2.5.17. > > Your error generally indicates that you're missing a module load on the > MDB > backend module. > > --Quanah > >

7 13

How to synchronize between different DC domains
by 2458943823＠qq.com 24 Jul '24

24 Jul '24

OpenLDAP version: 2.4.44 Requirement: How to configure the slapd.conf file to successfully synchronize user information between master and slave servers from different DCs, to keep the user DC consistent with the slave server DC. Current issue: 1. When filling in the syncrepl synchronization rule with suffixmassage "dc=ws,dc=sip,dc=com" "dc=ws,dc=slave2,dc=sip,dc=com", it shows Error: parse_syncrepl_line: unable to parse "suffixmassage".

3 6

question about partial replication
by Frédéric Goudal 24 Jul '24

24 Jul '24

Hello, I’m trying to build a partial replication, but due to the structure of our ldap directory I’m wondering how to do : I have an ou branch for people that I want to replicate (ou=people,<prefix>) I have an ou branch for groups that I want to replicate (ou=groups,<prefix>) I have an ou branche for sudo that I want to replicate (ou=sudo,<prefix>) I guess that the setup for that is to replicate on <prefix> base and just filter on the objectClass BUT… my problem is that I have another ou branch for some people (ou=otherPeople,<prefix>) that I don’t want to replicate, but that contains exactly the same objects than then ou=people,<prefix> branch, so I can not use a filter on objectClass, there is no specific attribut that allow to say if an object belongs to ou=otherPoeple ou to ou=People I wonder what is the correct solution to achieve my goal. I was wondering if I could put several olcSyncrepl on the database with the same provider but one for every ou that I want to replicate ? Or is there a better way to do ? Thanks in advance — Frédéric Goudal Ingénieur Système, DSI Bordeaux-INP +33 556 84 23 11

2 4

Openldap 2.6.8 installation some minor questions
by Frédéric Goudal 23 Jul '24

23 Jul '24

Hello, I have just ran into un install from source of 2.6.8 on an ubuntu24.04 server. I have had some minor problems with systemd, but maybe it’s my fault. I have compiled openldap with —with-tls and —with-systemd But on the service file there was no ldaps:// in url list, maybe it’s normal ? On the service file there is a reference of a /etc/sysconfig/slapd Environment file but this file is not installed with the make install, maybe I did miss a point ? And I wonder for the location of the slapd.service file, it is put in the main /usr/lib/systemd/system . As I have not put openldap in the main /usr/ hierarchy directory but /usr/local (that is the default), I was expecting to find slapd.service in /etc/systemd/system directory. I have not found a place in the configure tool to tell where to put the service file. Any thoughts on these points ? — Frédéric Goudal Ingénieur Système, DSI Bordeaux-INP +33 556 84 23 11

1 0

LDAP search API failing if search filter contains escape character before equals to sign
by c.venugopal521＠gmail.com 19 Jul '24

19 Jul '24

Hi Team, We are working on migration of nsldap C sdk to OpenLDAP C sdk for our application client code. As part of this activity, from our application, we are sending one search query using search API (Ex: ldap_search_ext_s) to one of LDAP servers with a filter: smVariableName=dzORGS\=\= In this search filter, escape character (\) is added for equals to (=) symbols. We expected a successful result for this query as we have a valid entry. But the LDAP search call failed. By high level investigation, it was identified that the search call did not reach the LDAP server and OpenLDAP API internally returned failure status by saying BAD filter. Note: With the same client application code (where search filter and search API is same), using nsldap C SDK, we are able to execute the query successfully and able to see results. Could you please let me know if I missed any specific configuration/setting in OpenLDAP APIs before making a search? OR Do we need to change the search filter value (remove escape character) for OpenLDAP APIs?

2 1

slapo-remoteauth "remoteauth_store on" and password changes
by Christopher Paul 17 Jul '24

17 Jul '24

Hi OpenLDAP-Technical, Thank you, OpenLDAP Project Team for slapo-remoteauth. It is much simpler to set up compared to SASL. I have one comment relating to using "remoteauth_store on" and the possibility of being able to handle upstream password changes. According to the manual, and confirmed by testing, slapo-remoteauth is only engaged when the userPassword value is not present. In order for upstream AD password changes to propagate when using "remoteauth_store on", it would seem to be very useful to also engage the overlay when the userPassword value is present and a simple BIND fails with err=49. The downside of this would be high-frequency repeated err=49 BIND failures causing undesirable upstream load and lockouts, but perhaps this could be mitigated by limiting it to a configurable number of upstream failures before setting a value on some attribute say "remoteauth_enabled=False" to cause remoteauth to disengage entirely for the specific user until reset to True. Thanks, -- Chris Paul | Rex Consulting |https://www.rexconsulting.net

2 1

OpenLDAP authentication acts very slow when Active Directory is unreachable
by maupas.alexis＠hotmail.com 12 Jul '24

12 Jul '24

Hello everyone, I am currently struggling with my OpenLDAP configuration (v2.5.13 on Debian 12). I want my OpenLDAP server to host a local database and to act as a proxy to an Active Directory database. Both databases should be merged to centralise authentication. Through my research, I've discovered slapd-meta to merge multiple databases. Here is a small schema of what I expect : |--------> Local database (LDIF) "ou=local" META "dc=example,dc=com" ---| |--------> Proxy Active Directory "cn=Users,dc=addomain,dc=com" I am able to regroup accounts from both Active Directory and local OpenLDAP databases within the same naming context "dc=example,dc=com". Available accounts within "dc=example,dc=com" : - cn=userad,dc=example,dc=com (From Active Directory database) - cn=userldap,dc=example,dc=com (From local OpenLDAP database) For my Windows devices, I use pGina to manage user authentication against my OpenLDAP server. Once pGINA is correctly configured, I can easily and quickly connect with all available accounts from AD and LDAP (userad et userldap). My "only" problem is when the Active Directory server is down or unreachable. I am obviously no longer able to connect with Active Directory accounts. However, authentication with OpenLDAP accounts (userldap) becomes very slow and sometimes I can't connect. In fact, OpenLDAP server keeps trying to reach Active Directory for every request even if it's unreachable. This behaviour seems to slow the OpenLDAP searches within the local LDAP database a lot. I've tried implementing different types of timeout in order to stop reaching unreachable servers but it doesn't make the authentication for LDAP accounts go any faster. Here is my slapd.conf : #################BOF################### ### SCHEMAS include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/misc.schema include /etc/ldap/schema/microsoft.minimal.schema include /etc/ldap/schema/rfc2307bis.schema ### MODULES modulepath /usr/lib/ldap #Path moduleload back_ldap #Module for ldap database moduleload back_meta #Module for meta database ### MAIN SETTINGS pidfile /run/slapd/slapd.pid argsfile /run/slapd/slapd.args ### DATABASES DEFINITION ## GENERAL ## ## LOCAL DATABASE CONFIG ## database ldif suffix "ou=local" directory "/var/lib/ldap" rootdn "cn=ldapadm,ou=local" rootpw "*****" access to * by dn="cn=admin,dc=example,dc=com" write by * read by * search ## MAIN DATABASE TO REGROUP BOTH REMOTE AND LOCAL DATABASE## database meta suffix "dc=example,dc=com" rootdn "cn=admin,dc=example,dc=com" rootpw "*****" ## PROXY TO LOCAL DB ## uri "ldap://127.0.0.1/dc=example,dc=com" lastmod off suffixmassage "dc=example,dc=com" "ou=local" rebind-as-user idassert-bind bindmethod=simple binddn="cn=ldapadm,ou=local" credentials="*****" mode=none idassert-authzFrom "*" ## PROXY TO Active Directory ## uri "ldap://AD-ip:389/dc=example,dc=com" readonly yes lastmod off suffixmassage "dc=example,dc=com" "cn=Users,dc=addomain,dc=com" protocol-version 3 rebind-as-user idassert-bind bindmethod=simple binddn="cn=Administrator,cn=Users,dc=addomain,dc=com" credentials="*****" mode=none flags=override idassert-authzFrom "*" map attribute uid sAMAccountName #################EOF################### Any help or suggestion on how to authenticate with local OpenLDAP accounts even if the Active Directory server is down would be appreciated. Have a good day. Alexis

2 3

OpenSSL 3.0 support with OpenLDAP 2.6.7 for SSL support
by venugopal chinnakotla 10 Jul '24

10 Jul '24

Hi Team, We are working on migration of nsldap C sdk to OpenLDAP c sdk for our application client code. As part of this activity, we have chosen openssl 3.0 as SSL provider with OpenLDAP. *OpenSSL Version is:* OpenSSL 3.0.10 1 Aug 2023 (Library: OpenSSL 3.0.10 1 Aug 2023) Could you please confirm from your side on support of OpenSSL 3.0 with OpenLDAP 2.6.7 and 2.6.8 versions? -- Thanks, *c.venugopal*

2 1

Configure multi-master replication OpenLDAP using https://repo.symas.com/soldap2.5/rhel8/
by Kaushal Shriyan 08 Jul '24

08 Jul '24

Hi, I am running OpenLdap server 2.5.18 on Red Hat Enterprise Linux release 8.10 (Ootpa) OS to enable multimaster replication on both nodes (node 1 and node 2). Currently on Node1 I am encountering the *ldap_modify: Insufficient access (50) *issue *Node1* # rpm -qa | grep openldap symas-openldap-clients-2.5.18-1.el8.x86_64 symas-openldap-servers-selinux-1.0.6-2.el8.noarch openldap-2.4.46-18.el8.x86_64 symas-openldap-servers-2.5.18-1.el8.x86_64 symas-openldap-libs-2.5.18-1.el8.x86_64 # cat /etc/redhat-release Red Hat Enterprise Linux release 8.10 (Ootpa) # # pwd /opt/symas/etc/openldap # ls -l total 20 -rw-r--r-- 1 symas symas 247 May 23 20:21 ldap.conf.default drwxr-xr-x 2 symas symas 4096 Jun 26 16:02 schema -rw------- 1 symas symas 2901 Jun 27 17:55 slapd.conf -rw------- 1 symas symas 2710 May 23 20:21 slapd.conf.default -rw------- 1 symas symas 2761 May 23 20:21 slapd.ldif.default # # cat syncprov_mod.ldif dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: syncprov.la dn: olcOverlay=syncprov,olcDatabase={1}mdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov # ldapadd -Y EXTERNAL -H ldapi:/// -f syncprov_mod.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "cn=module{0},cn=config" *ldap_modify: Insufficient access (50)* # Am I missing anything? Please guide me. Best Regards, Kaushal

3 3

Querying the default password policy
by Windl, Ulrich 08 Jul '24

08 Jul '24

Hi! I just discovered a problem (reading "man slapo-ppolicy" in old 2.4 OpenLDAP): It seems one can configure a "default policy", but it cannot be queried. At least https://serverfault.com/a/644658/407952 suggests that, and after reading "man slapo-ppolicy" I did not find something different. Why isn't there some "olc" attribute for it? So far we did not set the default policy, but assigned one to each user. However I wanted to write a utility that would evaluate the changes if a default password policy were added. For obvious reasons I don't want to hard-code the policy name into the utility, and the utility may run on any server, not just LDAP-Servers to query them. However digging in the configs, I found in dn: olcOverlay={2}ppolicy,olcDatabase={1}hdb,cn=config the attribute "olcPPolicyDefault", wondering why it isn't documented. So far, so good, but how would an ACL allowing to read that attribute look like? It seems I cannot specify that specific attribute within the olcPPolicyConfig object class within the corresponding cn=config subtree: I can allow access to the attribute name globally, or to all attributes of the object class, and "attrstyle" can only be used for a specific value. So how should I allow access to that attribute for my special user running the utility? Kind regards, Ulrich

3 5

FW: Accessing ppolicy attributes as non-admin in 2.4
by Windl, Ulrich 08 Jul '24

08 Jul '24

As I think the message had been blocked (I'm still receiving messages, but seem to be unable to send due to address mis-matching), I'm re-sending it. Please ignore if it had been delivered. From: Windl, Ulrich Sent: Thursday, June 20, 2024 9:53 AM To: openldap-technical <openldap-technical(a)openldap.org> Subject: Accessing ppolicy attributes as non-admin in 2.4 Hi! Yes, we are still running an old 2.4 OpenLDAP (mostly because it still has "hdb"), but anyhow: There's a request to search for accounts where the password will expire soon according to configured ppolicies. I wrote the code, realizing that a normal user cannot read other users policy attributes, while the admin user can. As the process should run automatically, I don't want to add admin credentials for that kind of reporting. Instead I added a new user role and tried to add access to the attributes, but somehow it does not work. I think I did not make an error, but ACL configuration can be tricky. So the question is: Can it be done in 2.4, and if so, what might be wrong in this config (lines unfolded, sorry): olcAccess: {0}to * by dn.exact="uid=syncrepl,ou=system,dc=..." read by group/organizationalRole/roleOccupant.exact="cn=LDAP-Manager,dc=roles,dc=..." write by * break olcAccess: {1}to dn.children="dc=roles,dc=..." attrs=roleOccupant by * none olcAccess: {2}to attrs=pwdAccountLockedTime,pwdAllowUserChange,pwdChangedTime,pwdCheckQuality,pwdExpireWarning,pwdFailureCountInterval,pwdGraceAuthNLimit,pwdGraceUseTime,pwdHistory,pwdInHistory,pwdLockoutDuration,pwdMaxFailure,pwdMaxRecordedFailure,pwdMinAge,pwdMinLength,pwdMustChange,pwdPolicySubentry,pwdRe\ set,pwdSafeModify,shadowExpire,shadowInactive,shadowLastChange,shadowMax,shadowMin,shadowWarning by dn.exact="uid=PP-Checker,ou=system,dc=..." read break olcAccess: {3}to attrs=userPassword,userPKCS12 by self write by * auth olcAccess: {4}to attrs=shadowLastChange by self write by * read olcAccess: {5}to attrs=pwdHistory,pwdGraceUseTime,pwdChangedTime by self read by * none olcAccess: {6}to * by * read The account in question is ="uid=PP-Checker,ou=system,dc=..." obviously, and the "cn=LDAP-Manager,dc=roles,dc=..." can access the attributes. The account is like this: dn: uid=PP-Checker,ou=system,dc=... objectClass: top objectClass: account objectClass: simpleSecurityObject structuralObjectClass: account uid: PP-Checker The Admin object looks like this: dn: cn=LDAP-Manager,dc=roles,dc=... objectClass: organizationalRole cn: LDAP-Manager description: Administrative Access to LDAP Directory roleOccupant: uid=me-for-example,ou=people,dc=... roleOccupant: uid=another,ou=people,dc=... structuralObjectClass: organizationalRole Any help on this is highly appreciated. If you think something else is wrong, also tell me please. Alternatively you could give an answer on https://superuser.com/q/1844359/964771 Kind regards, Ulrich

2 11

[2.5.16] Filter Replication Issue
by Pierre Marty 04 Jul '24

04 Jul '24

Hi, When using a filter on a replicated branch, it seems that deletion updates are still propagated... The cluster in use is a 4 nodes master-master with the following settings: olcsyncrepl: rid=4 provider="ldaps://url" type=refreshAndPersist retry="5 10 60 +" timeout=5 network-timeout=10 keepalive=60:10:5 schemachecking=off searchbase="dc=root,dc=com" scope=sub bindmethod=sasl saslmech=external tls_cacertdir=/usr/local/openldap/etc/openldap/certs tls_cert=/usr/local/openldap/etc/openldap/certs/cert.crt tls_key=/usr/local/openldap/etc/openldap/certs/cert.key tls_cipher_suite=HIGH tls_reqcert=demand filter="(!(objectclass=MyOwnClass))" The objectclass is as follow: dn: MyOwnClass=state,ou=initials,dc=root,dc=com AF-UID: state objectClass: MyOwnClass objectClass: top STATE: UP structuralObjectClass: MyOwnClassThe replication account does not possesses any access to this element :olcAccess: to dn.exact="MyOwnClass=state,ou=initials,dc=root,dc=com" by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by dn.exact="cn=status,ou=serviceaccounts,dc=root,dc=com" read by dn.exact="cn=confldap,ou=serviceaccounts,dc=root,dc=com" manage by * none Yet, when MyOwnClass=state,ou=initials,dc=root,dc=com is deleted the following logs appear: serverA : op=1 DEL dn="MyOwnClass=state,ou=initials,dc=root,dc=com" serverA : op=1 syncprov_matchops: recording uuid for dn=MyOwnClass=state,ou=initials,dc=root,dc=com on opc=0x7ff5a00157c0 serverB : op=0 syncprov_matchops: recording uuid for dn=MyOwnClass=state,ou=initials,dc=root,dc=com on opc=0x7f158c0015c8 serverB : syncrepl_del_nonpresent: rid=003 be_delete MyOwnClass=state,ou=initials,dc=root,dc=com (0) serverB : op=1 SRCH base="MyOwnClass=state,ou=initials,dc=root,dc=com" scope=2 dereIs it an expected behavior? When updating the value or renaming the object, no replication is noticed. Have a good day,-- Pierre Marty Ingénieur Logiciel / OSSA pmarty(a)linagora.com (+33) 067 530 3612 ------------------ ossa(a)linagora.com (+33) 080 005 4689 - 3 ------------------ GROUPE LINAGORA Villa Good Tech 37 Rue Pierre Poli 92130 Issy-les-Moulineaux (+33) 097 263 9776

3 2

dummy values for absent attributes ?
by Geert Hendrickx 04 Jul '24

04 Jul '24

Hi We are facing a proprietary application that insists on the presence of certain attributes that are optional in our objectclass schema, and not all objects have them. So we are considering to provision dummy values to all objects that currently don't have these attributes, but that would impact a large number of objects, which I'd like to avoid. (And we'd also have to adjust business logic to always add those attributes in the future, whereas they are truly optional in our data model.) Is there an OpenLDAP overlay that can insert dummy values for missing attributes? For arbitrary objects? (I read about slapo-translucent, but I think it requires each object to be present in the transcluent database?) Geert

4 3

Re: sync repl issue
by Luo, Frank 27 Jun '24

27 Jun '24

OK. Thanks. we just use the RPM package from OEL8. Do you know if 2.6 RPM is available on OEL8? On Fri, Jun 21, 2024 at 1:06 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > > --On Friday, June 21, 2024 1:35 PM -0400 "Luo, Frank" <luoy(a)miamioh.edu> > wrote: > > > sorry. it is 2.4.46 and I believe it is standard syncrepl ( I could > > not find syncdata in slapd.conf). > > Hi, > > The OpenLDAP 2.4 series has been deprecated for several years, and numerous > issues with replication have been fixed in the later release series. I > would strongly advise upgrading to a supported release, in particular the > OpenLDAP 2.6 series. You've most likely encountered one of the many known > and (later) fixed issues with syncrepl in the 2.4 series. > > Regards, > Quanah > > > >

4 5

Q: Reset a locked user's password
by Windl, Ulrich 24 Jun '24

24 Jun '24

Hi! I have a question related to policy and a user with an expired password and all grace logins consumed, like this: pwdChangedTime[0] 20231127075102Z pwdGraceUseTime[0] 20240429142254Z pwdGraceUseTime[1] 20240430112006Z pwdGraceUseTime[2] 20240527074731Z pwdGraceUseTime[3] 20240528114912Z pwdGraceUseTime[4] 20240528130249Z pwdFailureTime[0] 20240611082600.348275Z How can the user change his password? The user cannot log in anymoe, obviously. If the user could log in he would have admin privileges. I had the idea to delete the grace logins via ldapmodify, but the result (for version 2.4) was: ldap_modify: Constraint violation (19) additional info: pwdGraceUseTime: no user modification allowed So what are the options (for the user himself and for an admin)? Regards, Ulrich

3 5

Re: sync repl issue
by Luo, Frank 21 Jun '24

21 Jun '24

sorry. it is 2.4.46 and I believe it is standard syncrepl ( I could not find syncdata in slapd.conf). Thanks On Fri, Jun 21, 2024 at 10:52 AM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > > --On Friday, June 21, 2024 9:59 AM -0400 "Luo, Frank" <luoy(a)miamioh.edu> > wrote: > > > refreshAndPersist, mirrormode on for node 01 and 02 , off for node 03 and > > Hi, you didn't answer these two questions: > > Standard syncrepl or delta syncrepl? What version of OpenLDAP? > > Thanks! > > --Quanah > >

2 1

Re: sync repl issue
by Luo, Frank 21 Jun '24

21 Jun '24

refreshAndPersist, mirrormode on for node 01 and 02 , off for node 03 and 04 Thanks On Thu, Jun 20, 2024 at 7:22 PM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > > > > --On Thursday, June 20, 2024 4:48 PM -0400 "Luo, Frank" <luoy(a)miamioh.edu> > wrote: > > > Hi, all > > > > We have a 4 nodes set up, n01 and n02 have mirror mode on and they are > > provider and consumer to each other. n03's provider is n01 and n04's > > provider is n02. Each has contexcsn as followings so I think they are > > all in sync. > > > > However I have a node n04 missing some data (one entry I found so > > far). How to explain this and how to troubleshoot? Thanks a lot! > > What version of OpenLDAP? What kind of sync replication (standard, delta? > refreshonly, refreshAndPersist?) etc. > > --Quanah > >

2 1

sync repl issue
by Luo, Frank 21 Jun '24

21 Jun '24

Hi, all We have a 4 nodes set up, n01 and n02 have mirror mode on and they are provider and consumer to each other. n03's provider is n01 and n04's provider is n02. Each has contexcsn as followings so I think they are all in sync. However I have a node n04 missing some data (one entry I found so far). How to explain this and how to troubleshoot? Thanks a lot! Frank n01 contextCSN: 20180628172040.692013Z#000000#001#000000 contextCSN: 20180628172039.214361Z#000000#002#000000 contextCSN: 20240620192402.726831Z#000000#015#000000 contextCSN: 20240620193606.038191Z#000000#016#000000 n02 contextCSN: 20180628172040.692013Z#000000#001#000000 contextCSN: 20180628172039.214361Z#000000#002#000000 contextCSN: 20240620192402.726831Z#000000#015#000000 contextCSN: 20240620193606.038191Z#000000#016#000000 n03 contextCSN: 20180628172040.692013Z#000000#001#000000 contextCSN: 20180628172039.214361Z#000000#002#000000 contextCSN: 20240620192402.726831Z#000000#015#000000 contextCSN: 20240620193606.038191Z#000000#016#000000 n04 contextCSN: 20180628172040.692013Z#000000#001#000000 contextCSN: 20180628172039.214361Z#000000#002#000000 contextCSN: 20240620192402.726831Z#000000#015#000000 contextCSN: 20240620193606.038191Z#000000#016#000000

2 1

Complete removal of an attribute
by Benjamin Renard 19 Jun '24

19 Jun '24

Hello, I'm trying to find out the correct way to completely remove an attribute from an existing LDAP database. So far, I've been doing the following: - Deleting this attribute from all existing entries in the directory: ldapsearch -Y EXTERNAL -H ldapi:/// \ -b o=root '(toRemove=*)' dn -LLL | \ sed 's/^dn: $.*$$/dn: \1\nchangetype: modify\ndelete: toRemove/' | \ ldapmodify -Y EXTERNAL -H ldapi:/// - Removing all references to this attribute from the configuration (schema, index, ACLs, ...) My problem is that slapschema still throws an error about this attribute: 6669bbb2 UNKNOWN attributeDescription "TOREMOVE" inserted. I have double-checked and there are no references to this attribute in a database dump. In this situation, a dump/restore solves the problem, but this requires a service interruption that I would like to avoid. Do you have any ideas on how to work around this issue? Regards, -- Benjamin Renard - Easter-eggs 44-46 rue de l'Ouest - 75014 Paris - France - Métro Gaité Phone: +33 (0) 1 43 35 00 37 - mailto:brenard@easter-eggs.com

2 2

[openLDAP 2.5] slapd silently stops
by BECOT Jérôme 13 Jun '24

13 Jun '24

Hello, We have to servers configured as Proxy with back_ldap. They stop almost everyday with a SIGABRT in the service log. Nothing in the standard logs when they stop. I'd like to increase the log level to args, but I'm not sure if it would help me. Any help appreciated. Regards Jerome

2 1

GSSAPI Support from 2.4.x to 2.5.x
by bowen.wang＠cohesity.com 05 Jun '24

05 Jun '24

In 2.4.x, openldap have gssapi.c and several apis on GSSAPI while that is not there anymore after 2.5.x. So what API should use if I want to achieve the same logic such as api ldap_gssapi_bind_s/ldap_gssapi_bind in 2.4.x?

2 1

[OpenLDAP 2.5] Accesslog size and performance issues
by BECOT Jérôme 27 May '24

27 May '24

Hello, Here is our setup: 2 master in mirrormode with accesslog replication and several slaves with lastbind and chain overlay. Everything works, but the accesslog db is quite large and filled with authtimestamp updates from client hosts running sssd. We also have a disk performance issue when the cleanup process is launched every 4h. We plan to reduce the accesslog history by setting 12h retention and increase cleanup . It should reduce the number of entries and therefore lighten the cleanup process but: I wonder if increasing the frequency will also have a positive effects (as the though here is that there will be less entries to delete). I think that allocated pages in the mdb database won't change. Is there a safe way to reduce the db size ? Finally, we considered not logging the sssd auth timestamp updates, but lastbind doesn't have any option to filter which branch is allowed to update, the only option is to set the precision to a higher value. Is there a way to achieve this ? Any suggestion will be warmly appreciated. Thank you Jerome

4 7

its8752 failure
by patrick+openldap.org＠laimbock.com 26 May '24

26 May '24

Hi all, Almalinux 9.4 x86_64. When building 2.6.8 with gcc 11.4.1 20231218 (Red Hat 11.4.1-3) or gcc 13.2.1 20231205 (Red Hat 13.2.1-6) I get a failure in 'make -j1 its' in its8752: >>>>> Starting its8752 ... running defines.sh This test tracks a case where slapd deadlocks during a significant write load See https://bugs.openldap.org/show_bug.cgi?id=8752 for more information. Starting slapd on TCP/IP port 9011... Using ldapsearch to check that slapd is running... Populating database on first provider... Stopping slapd and reworking configuration for MPR... Starting provider slapd on TCP/IP URI ldap://localhost:9011/ Using ldapsearch to check that provider slapd is running... Starting provider slapd on TCP/IP URI ldap://localhost:9012/ Using ldapsearch to check that provider slapd is running... Starting provider slapd on TCP/IP URI ldap://localhost:9013/ Using ldapsearch to check that provider slapd is running... Starting provider slapd on TCP/IP URI ldap://localhost:9014/ Using ldapsearch to check that provider slapd is running... Setting up accesslog on each provider... Modifying dn: cn=Elmer_Fudd,ou=People,dc=example,dc=com on provider 1 Modifying dn: cn=Elmer_Fudd,ou=People,dc=example,dc=com on provider 2 Modifying dn: cn=Elmer_Fudd,ou=People,dc=example,dc=com on provider 3 Modifying dn: cn=Elmer_Fudd,ou=People,dc=example,dc=com on provider 4 Waiting 7 seconds for servers to catch up... Waiting 7 seconds for servers to catch up... Waiting 7 seconds for servers to catch up... Waiting 7 seconds for servers to catch up... Waiting 7 seconds for servers to catch up... Waiting 7 seconds for servers to catch up... Servers did not replicate in time >>>>> ./data/regressions/its8752/its8752 failed (exit 1) make[1]: Leaving directory '/builddir/build/BUILD/openldap-2.6.8/tests' make[1]: *** [Makefile:364: mdb-its-yes] Error 1 make: *** [Makefile:355: regressions] Error 2 error: Bad exit status from /var/tmp/rpm-tmp.cKP3aW (%check) Looking at its8752 in bugzilla there is a target of 2.7.0 and there are a number of other ITSs mentioned: https://bugs.openldap.org/show_bug.cgi?id=9782 (confirmed) https://bugs.openldap.org/show_bug.cgi?id=9580 (in progress) https://bugs.openldap.org/show_bug.cgi?id=9341 (unconfirmed) Is this test supposed to pass successfully on 2.6.8? Thanks, Patrick

1 0

el9 bind ip address
by Marc 24 May '24

24 May '24

Anyone know if this file is still working in el9? Looks like if I put SLAPD_URLS it is not read. /etc/sysconfig/slapd

4 7

Unable to enable auditlog in openldap 2.4
by kalybox2020＠gmail.com 20 May '24

20 May '24

We are using cn=config file for configuration. Using ldapmodify dn: olcOverlay={8}auditlog,olcDatabase={1}hdb,cnc=config objectclass: olcOverlayConfig objectClass: olcAuditlogConfig olcAuditLogFile: /var/log/ldapauditlog.ldif restarted slapd, Gave permissions to this file, and restarted slapd, still not able to generate logs. Thanks -Kaly

1 0

How to setup replication in openldap 2.6.7
by kalybox2020＠gmail.com 20 May '24

20 May '24

How to setup replication in openldap 2.6.7 Please let me know Thanks -Kaly

3 2

Facing issues with Symas LDAP upgrade from 2.4 to 2.5
by anilkumar.pathuri7＠gmail.com 16 May '24

16 May '24

Hi Team, GM Successful while trying to upgrade from openLDAP 2.4.44 to SymasLDAP2.4.57 Facing issues while trying to upgrade to 2.5.x and 2.6.x from SymasLDAP2.4.57 https://repo.symas.com/soldap2.5/upgrading/ Issues while trying to upgrade from SymasLDAP2.4.57 to SymasLDAP 2.5.17. 1. config error processing olcDatabase={2}mdb,cn=config UNKNOWN attributeDescription "OLCDBINDEX" inserted if I comment "OLCDBINDEX" 2. ldif_read_file: checksum error on "/opt/symas/etc/openldap/slapd.d/cn=config/olcDatabase={2}mdb.ldif config error processing olcDatabase={2}mdb,cn=config: Can you please guide by looking into this issue. Regards, Anil P ************************************************************* cat olcDatabase={2}mdb.ldif # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 f21f2837 dn: olcDatabase={2}mdb objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {2}mdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=hadoop,dc=com olcRootDN: cn=ldapadm,dc=hadoop,dc=com olcRootPW:: ************ olcDbIndex: objectClass eq,pres structuralObjectClass: olcMdbConfig entryUUID: ba4f359a-a605-103e-9085-7fcb0f4ffaf5 creatorsName: cn=config createTimestamp: 20240514061956Z entryCSN: 20240514062200.341950Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20240514062200Z

2 1

[openldap 2.4]olcdbcheckpoint parameter is not working
by norihisa.kimura＠ctc-g.co.jp 15 May '24

15 May '24

To whom it may concern, Could you confirm if the following understanding is correct? Regarding the olcDbCheckpoint parameter in openldap-2.4.46-18, it is mentioned in the 2.4 manual but it does not seem to work even when the setting is enabled and tested. Upon investigating the source code, it appears that the parameter is deactivated. Based on these results, it is speculated that it will not work as expected because it is an unimplemented item, Is this hypothesis right? * 2.4 manual https://www.openldap.org/doc/admin24/slapdconf2.html 5.2.6.3. olcDbCheckpoint: <kbyte> <min> I am looking forward to your response. regards

2 1

ldapauditlog is too big
by kalybox2020＠gmail.com 15 May '24

15 May '24

Hi Team, We are running openldap 2.4. and I see ldapauditlog is too big about 14GB, never rotated for more than a year. What is the best way to rotate it? I am thinking. 1. Stop the ldap instance mv ldapauditlog file to ldapauditlog.bak touch ldapauditlog start the isntance Is there any better way? Please confirm Thanks -Kaly

2 1

Storage overhead of LMDB vs SQLite3 for file hierarchy indexing scenario
by Jérôme Carretero 13 May '24

13 May '24

Hi, I wanted to share some thoughts and findings and perhaps collect some comments about a small test I did: I used LMDB vs. SQLite3 to perform indexing of a file tree. In this scenario, we're capturing file paths, along with some metadata (size, mtime, and hashes, let's use only sha1 for this example), and we want to be able to efficiently walk the tree, as well as resolve a file's info by id or by path. I'm showing the SQL schema first, as it helps formalizing the "NoSQL" case: CREATE TABLE IF NOT EXISTS files ( id INTEGER PRIMARY KEY AUTOINCREMENT, sha1 BLOB, size INTEGER, mtime INTEGER ); CREATE TABLE IF NOT EXISTS pathsegments ( id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER, file_id INTEGER, segment_name TEXT, FOREIGN KEY(parent_id) REFERENCES pathsegments(id), FOREIGN KEY(file_id) REFERENCES files(id) ); CREATE INDEX IF NOT EXISTS idx_sha1 ON files (sha1); CREATE INDEX IF NOT EXISTS idx_fileid2segment ON pathsegments (file_id); CREATE INDEX IF NOT EXISTS idx_parent_id2segment ON pathsegments (parent_id); Capturing the full path of each entry as a string was not something I wanted, and was also wasteful in the few datasets I tested it on. So we're using path segments, and a full path can be reconstructed; in the walking situation, from root to leaves, or if we have a file ID and want its path, from the leaves to the root, using the fileid2segment index and the parent information. And if files get moved around, we can alter the database without rewriting many paths. With lmdb, as I was conscious that each database would "intrinsically" build an index, I packed the file_id->{mtime,size,hash} as fid2attrs and segment_id->{parent_id,name} as sid2kids databases, and we still have segment_id->kids DUPSORT sid2kids for doing asciibetical readdir like the SQL idx_parent_id2segment. So we have our 2 tables with 2+3 indexes in SQL, and 4 DBs in lmdb (fid2attrs, sid2kids, sid2dirname, hash2fid). I implemented this (in Python) with sqlite and lmdb (using COBS for serialization, for simplicity and because it has the nice property of keeping serialized varint unsigned integers with preserved ordering), and went on to build dbs from a dataset of 474782 small files and 45014 directories (which I've coincidentally uploaded at https://archive.org/download/ftp.modland.com_pub_modules). Well, I was surprised that the SQLite3 file was weighing 67,149,824 bytes, and the lmdb one was larger at 82,718,720 bytes. In particular, looking at database statistics, it seems that the hash to id index/DB had unexpected (for me) overhead of ~ 112% to payload size with lmdb (and it was using less payload), with a size of 24932352 bytes for lmdb's DB vs. 15298560 for SQLite's index; SQLite statistics: Percentage of total database...................... 22.8% Number of entries................................. 474782 Bytes of storage consumed......................... 15298560 Bytes of payload.................................. 12311437 80.5% Bytes of metadata................................. 1469162 9.6% B-tree depth...................................... 3 Average payload per entry......................... 25.93 Average unused bytes per entry.................... 3.20 Average metadata per entry........................ 3.09 Average fanout.................................... 109.00 Non-sequential pages.............................. 2986 80.0% Maximum payload per entry......................... 26 Entries that use overflow......................... 0 0.0% Index pages used.................................. 34 Primary pages used................................ 3701 Overflow pages used............................... 0 Total pages used.................................. 3735 Unused bytes on index pages....................... 16998 12.2% Unused bytes on primary pages..................... 1500963 9.9% Unused bytes on overflow pages.................... 0 Unused bytes on all pages......................... 1517961 9.9% LMDB: depth=3 branch_pages=66 leaf_pages=6021 overflow_pages=0 Keys size: 9495640 Values size: 2261081 Payload size: 11756721 Pages size: 24932352 Average key size: 20.000 (20-20) Average value size: 4.762 (1-5) Average entry size: 24.762 Entries number: 474782 Overhead : 13175631 Overhead/payload ratio: 1.121 Overhead/entry avg: 27.751 I checked the overhead for in-order insertions and it's still around 50% for this key/value sizes, much more than SQLite does (~21%) for random insertions. But even if we were to remove this index, SQLite's file would still be tighter... That's it! Best regards, -- Jérôme

2 1

Re: failed to add jpegPhoto attribute to sql backend
by Quanah Gibson-Mount 13 May '24

13 May '24

--On Sunday, May 12, 2024 3:58 AM +0700 Muchammad Nur Hidayat <hidactive(a)gmail.com> wrote: > > Thank you for the clarification. > At the moment i have to add binary data manually in mysql. It's works > pretty well since I never perform any db config. > > Hope it will be fixed in the latest update. I will re-iterate that back-sql is entirely experimental, unmaintained, and it should not be used with a production environment. It is also magnitudes slower than the native back-mdb backend, so if you're only using the mysql instance for LDAP, it would be much better to switch to the native, supported backend database. Regards, Quanah

1 0

How to properly monitor MDB usage
by Benjamin Renard 08 May '24

08 May '24

Hi, I'm looking for the right method to monitor the usage of an MDB database according to the limit of its size imposed via the parameter olcDbMaxSize. Currently, I am using the following command: # mdb_stat -e /var/lib/ldap/accesslog/ Environment Info Map address: (nil) Map size: 4294967296 Page size: 4096 Max pages: 1048576 Number of pages used: 1048572 Last transaction ID: 24153425 Max readers: 126 Number of readers used: 18 Status of Main DB Tree depth: 1 Branch pages: 0 Leaf pages: 1 Overflow pages: 0 Entries: 6 Here, I determine the percentage of database usage with the information "Number of pages used" and "Max pages". This seemed to be a good method, but I noticed that after a significant purge of objects in the directory, the number of used pages does not seem to decrease. Is there another and/or better method to monitor this? Failing that, is there a solution to release "falsely" used pages, ideally without too much downtime of the service (so not a dump/restore)? I read that it was possible to use the "mdb_copy -c" command, but I am a little concerned about the duration on a database with approximately 1,000,000 entries. Thank you in advance. -- Benjamin Renard - Easter-eggs 44-46 rue de l'Ouest - 75014 Paris - France - Métro Gaité Phone: +33 (0) 1 43 35 00 37 - mailto:brenard@easter-eggs.com

8 9

Query for attribute before adding new entry.
by Singley, Norman 08 May '24

08 May '24

Hi All. I have had a question come down from our Enterprise information team - We currently create a separate identity in oldap for students vs faculty/staff, but want to start creating only one identity going forward. The DN in the ldif is unique for these two identities, but they do share a common attribute. Is there a way in the ldapmodify add process to query the whole directory for an attribute coming from the ldif file, and then if it doesn't exist reject the add for that identity, and then of course go on processing the rest of the file? My gut says no, or at least not without some scripting that I am not familiar with. Thanks for your time. Norman Singley Directory Services / IT University of Montana 406 243 6799 Norman.singley(a)umontana.edu

3 4

failed to add jpegPhoto attribute to sql backend
by Muchammad Nur Hidayat 08 May '24

08 May '24

hi I'm having trouble adding the jpegPhoto attribute to sql, slapd is sending the jpeg data to argv[2] as binary, not hex or base64. So it can't be passed to the add_proc query in sql. is there an option or configuration to set it to hex or base64.

2 1

failed to add jpegPhoto attribute to sql backend
by Muchammad Nur Hidayat 08 May '24

08 May '24

hi I'm having trouble adding the jpegPhoto attribute to sql, slapd is sending the jpeg data to argv[2] as binary, not hex or base64. So it can't be passed to the add_proc query in sql. is there an option or configuration to set it to hex or base64.

1 0

how to identify users or service accounts that have write access
by kalybox2020＠gmail.com 07 May '24

07 May '24

In openldap 2.4, how to identify users or service accounts that have write access. Can we do ldapsearch and find out?

3 3

Not affected: gitlab cve-2023-7028
by Quanah Gibson-Mount 04 May '24

04 May '24

Hello, Community members may be aware of <https://nvd.nist.gov/vuln/detail/CVE-2023-7028> I wanted to note that the OpenLDAP self hosted gitlab instance is not affected by this vulnerability as we regularly update our gitlab instance. Regards, Quanah

1 0

Replication Questions
by BECOT Jérôme 30 Apr '24

30 Apr '24

Hello ! I have few questions regarding replication. I'm doing partial replication on plain replication by limiting the syncrepl user permissions in the ACL. It works well. Is it supported ? Would it work with a delta-sync replication ? Another thing I've been told about is about memberOf overlay. My colleague told me that replication may fail when memberOf is enabled on consumers, mainly because sometimes the group is replicated before the user and memberOf would create an entry if a search is made on the user not yet replicated. Have you some insights about this behaviour that I have not met yet ? Regards

4 4

bindDN massage error
by lsoulas 30 Apr '24

30 Apr '24

Hi, I testing a configuration with rewriteMap option. I have an error bindDN massage error when the rule is redirected. I think who I don't use a good regexp for the rule. My configuration : /defaultsearchbase dc=local,dc=lan database meta suffix "dc=lan" uri "ldaps://192.168.50.2/dc=lan" overlay rwm rwm-rewriteEngine on rwm-rewriteMap ldap attr2dn "ldap://192.168.50.10" rwm-rewriteContext bindDN rwm-rewriteRule "(.*)" "${attr2dn(%1)}" "#"/ For this test, I whish who all request is redirected of the other server. If I viewing a tcp frames, the cn request add a $ in frame: /cn.$user, cn=Users,dc=local,dc=lan/ Thank you for your feedback *Loïc*

1 0

Need information related to multi thread support in OpenLDAP c sdk client
by c.venugopal521＠gmail.com 29 Apr '24

29 Apr '24

Hi Team, We are working on migration of nsldap C sdk to OpenLDAP c sdk for our application client code. As part of this activity, replacing API one by one and also looking for constant replacement. In NSLDAP C SDK: /* * Thread function callbacks (an API extension -- * LDAP_API_FEATURE_X_THREAD_FUNCTIONS). */ #define LDAP_OPT_THREAD_FN_PTRS 0x05 /* 5 - API extension */ /* * Thread callback functions: */ typedef void *(LDAP_C LDAP_CALLBACK LDAP_TF_MUTEX_ALLOC_CALLBACK)( void ); typedef void (LDAP_C LDAP_CALLBACK LDAP_TF_MUTEX_FREE_CALLBACK)( void *m ); typedef int (LDAP_C LDAP_CALLBACK LDAP_TF_MUTEX_LOCK_CALLBACK)( void *m ); typedef int (LDAP_C LDAP_CALLBACK LDAP_TF_MUTEX_UNLOCK_CALLBACK)( void *m ); typedef int (LDAP_C LDAP_CALLBACK LDAP_TF_GET_ERRNO_CALLBACK)( void ); typedef void (LDAP_C LDAP_CALLBACK LDAP_TF_SET_ERRNO_CALLBACK)( int e ); typedef int (LDAP_C LDAP_CALLBACK LDAP_TF_GET_LDERRNO_CALLBACK)( char **matchedp, char **errmsgp, void *arg ); typedef void (LDAP_C LDAP_CALLBACK LDAP_TF_SET_LDERRNO_CALLBACK)( int err, char *matched, char *errmsg, void *arg ); /* * Structure to hold thread function pointers: */ struct ldap_thread_fns { LDAP_TF_MUTEX_ALLOC_CALLBACK *ltf_mutex_alloc; LDAP_TF_MUTEX_FREE_CALLBACK *ltf_mutex_free; LDAP_TF_MUTEX_LOCK_CALLBACK *ltf_mutex_lock; LDAP_TF_MUTEX_UNLOCK_CALLBACK *ltf_mutex_unlock; LDAP_TF_GET_ERRNO_CALLBACK *ltf_get_errno; LDAP_TF_SET_ERRNO_CALLBACK *ltf_set_errno; LDAP_TF_GET_LDERRNO_CALLBACK *ltf_get_lderrno; LDAP_TF_SET_LDERRNO_CALLBACK *ltf_set_lderrno; void *ltf_lderrno_arg; }; nsldap c sdk has thread function pointers option to support multi thread functionality for client programs. In our existing code, we are using 'LDAP_OPT_THREAD_FN_PTRS' option with ldap_set_option API like "Client code usage: ldap_set_option(hLDAP, LDAP_OPT_THREAD_FN_PTRS, &tfns);". Now, we are looking for similar functionality with in OpenLDAP to use it in our client program. Gone through OpenLDAP document and source code, but with my knowledge, did not get any equivalent one. Could you please provide more details on this to achieve equivalent functionality of LDAP_OPT_THREAD_FN_PTRS with OpenLDAP? Thank you Venu

2 1

ldclt ldap performance testing
by Marc 27 Apr '24

27 Apr '24

I am doing some basic testing with ldap with this command. ldclt \ -a 400 \ -H ldap://x.x.x.x:xxxx \ -e bindeach,bindonly,close \ -D "uid=test,dc=me,dc=local" \ -w yyyyyy \ -n 1 I was testing this on two container test environments. Both are running with ~500MB, 1 core. 1. alpine - slapd 2.6.3, mdb still with default slapd.conf ldclt[5594]: Average rate: 12627.00/thr (1262.70/sec), total: 12627 ldclt[5594]: Average rate: 0.00/thr ( 0.00/sec), total: 0 ldclt[5594]: All threads are dead - exit. 2. alpine - slapd 2.6.6, mdb configured with acl's, ssl, modules etc. ldclt[8900]: Average rate: 1495.00/thr ( 149.50/sec), total: 1495 ldclt[8900]: Average rate: 1498.00/thr ( 149.80/sec), total: 1498 ldclt[8900]: Average rate: 1490.00/thr ( 149.00/sec), total: 1490 What should I be expecting from this? It looks like maybe slapd of 1. is not 100% with this 'threads are dead' messages. While slapd of 2. with 150 req/sec is that to be expected normal?

3 5

cache userPassword with bind
by Marc 25 Apr '24

25 Apr '24

I am testing a bit with bind's. With consecutive binds with the same test account I always get 'result not in cache'. How can I get this in cache? access_allowed: result not in cache (userPassword) 6628dba5.0659c27a 0x7ff072843b38 conn=1023 op=0 BIND dn="uid=test,dc=me,dc=local" method=128 6628dba5.0660ea46 0x7ff072843b38 => access_allowed: result not in cache (userPassword) 6628dba5.066470b9 0x7ff072843b38 => access_allowed: auth access to "uid=test,dc=me,dc=local " "userPassword" requested 6628dba5.0667703c 0x7ff072843b38 => slap_access_allowed: backend default auth access granted to "(anonymous)" 6628dba5.0668099f 0x7ff072843b38 => access_allowed: auth access granted by read(=rscxd)

3 7

RE26 testing call (2.6.8) #1
by Quanah Gibson-Mount 19 Apr '24

19 Apr '24

This is the first testing call for OpenLDAP 2.6.8. Depending on the results, this may be the only testing call. Generally, get the code for RE26: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_6/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.6.8 Engineering Fixed libldap exit handling with OpenSSL3 again (ITS#9952) Fixed slapd-meta with dynlist (ITS#10164) Fixed slapd-meta binds when proxying internal op (ITS#10165) Added slapo-nestgroup overlay (ITS#10161) Added slapo-memberof 'addcheck' option (ITS#10167) Fixed slapo-accesslog startup initialization (ITS#10170) Fixed slapo-dynlist with abandoned operations (ITS#10044) Build Fixed build with gcc14.x (ITS#10166) Fixed back-perl with clang15 (ITS#10177) Contrib Added slapo-alias contrib module (ITS#10104, ITS#10182) Fixed slapo-autogroup to work with slapo-dynlist (ITS#10185) Documentation Fixed slapo-memberof exattr requirements (ITS#7400) Fixed slapo-memberof is no longer deprecated (ITS#7400) Minor Cleanup ITS#10103 ITS#10171 ITS#10172 ITS#10173 ITS#10179 ITS#10186 ITS#10188 ITS#10193 Regards, Quanah

2 1

timeout and network-timeout values of zero for syncrepl in LAN replication
by Christopher Paul 18 Apr '24

18 Apr '24

Hello OpenLDAP-technical list, I'm curious about community perspectives on a specific LDAP replication timeout and network-timeout settings: Setting "timeout=0" or "network-timeout=0" within a syncrepl/olcSyncrepl definition for replication settings is not the best practice for LAN environments. These parameters, when set to zero, instruct syncrepl to wait indefinitely for connections and replication operations to conclude. Within a LAN context, establishing new connections should ideally occur in less than a second. Delays beyond a couple of seconds should kick in the retry logic. This suggests that a more fitting network-timeout range is between 1 to 5 seconds. Concerning the "timeout" parameter, the ideal range might be between 60 to 120 seconds, to handle operations exceeding a minute, but again, kicking in retry logic if they exceed two minutes. I admit that my stance on the "timeout" setting is tentative, given that search operation duration hinges more on the provider's responsiveness rather than network speed alone. This approach ensures that LDAP replication remains both responsive and resilient, without compromising on efficiency or performance. Thoughts? -- Chris Paul | Rex Consulting |https://www.rexconsulting.net

3 5

TLS init: ca md too weak
by Uwe Sauter 17 Apr '24

17 Apr '24

Hi all, one of my Rocky Linux 8 servers was updated automatically to 2.6.7 this night from the Symas repo. The install script seems to include an automated restart of the service but that failed with: main: TLS init def ctx failed: -1 error:0A00018E:SSL routines::ca md too weak As this is an internal network with a private CA the strength of the CA is of minor relevance. I think the change comes with symas-openssl-libs-3.0.8-1.el8.x86_64… Can anyone suggest a workaround (other than exchanging the CA and its issued certificates)? Thanks, Uwe

3 3

RE25 testing call (2.5.18) #1
by Quanah Gibson-Mount 16 Apr '24

16 Apr '24

his is the first testing call for OpenLDAP 2.5.18. Depending on the results, this may be the only testing call. Generally, get the code for RE25: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_5/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.5.18 Engineering Fixed libldap exit handling with OpenSSL3 again (ITS#9952) Fixed slapd-meta with dynlist (ITS#10164) Fixed slapd-meta binds when proxying internal op (ITS#10165) Fixed slapo-accesslog startup initialization (ITS#10170) Fixed slapo-dynlist with abandoned operations (ITS#10044) Build Fixed build with gcc14.x (ITS#10166) Fixed back-perl with clang15 (ITS#10177) Minor Cleanup ITS#10171 ITS#10173 ITS#10179 ITS#10186 Regards, Quanah

1 0

Used rewriteMap with different uri
by lsoulas 11 Apr '24

11 Apr '24

Hi, I want used slapo-rwm to redirect a rule in a different URI. Here my configuration : /database meta suffix "dc=lan" uri "ldaps://server1/dc=lan" / /rewriteEngine on rewriteContext default rewriteRule ".*" ".*" ":" rewriteMap ldap attr2dn "ldap://server2/dc=lan?dn?sub" rewriteContext bindDN rewriteRule ".*" "${attr2dn($0)}" ":@I"/ I d'ont really understand rewrite map. Can you explain me. According to the documentation, it seems to be feasible. Thanks -- *Loïc Soulas* *ILIWI* /(https://www.iliwi.fr)/ lsoulas(a)iliwi.fr +33(0)662 249 445 ILIWI - Audit et solutions réseau informatique

1 0

Help debugging slave slapd issues
by BECOT Jérôme 04 Apr '24

04 Apr '24

Hello, On all different OpenLDAP 2.4 and 2.5 slaves of 2.4 servers, we see a lot of deferring errors: slapd[37277]: connection_input: conn=32974 deferring operation: too many executing or slapd[37277]: connection_input: conn=32974 deferring operation: pending operations Can you give any hints about way to debug what causes these messages ? (which log level should I aim for and witch system settings should I check) I can provide more details then. Regards Jerome

6 9

Permissive Modify and mdb
by lesignor＠cirad.fr 02 Apr '24

02 Apr '24

Hi, I try to modify an entry with permissive modify control. The response is protocole error : permissiveModify control value not absent. I check with wireshark the request, and there was no value with the control, but the control was marked as critical. The problem appears with openldap 2.5.x and 2.6.x with mdb database. It is ok with openldap 2.4.x with bdb database. So is the permissive modify control supported with mdb database in openldap >= 2.5.x ? Thank for your help

2 2

kerberos-cache location
by Stefan Kania 02 Apr '24

02 Apr '24

I normally use Debian for OpenLDAP and Kerberos, but now I have to uses Alamalinux 9. When I create a Ticket with kinit I'm getting: --------- u1-prod@ldapserver1 ~]$ kinit Password for u1-prod(a)EXAMPLE.NET: [u1-prod@ldapserver1 ~]$ klist Ticket cache: KCM:10001 Default principal: u1-prod(a)EXAMPLE.NET --------- So the ticket cache is the KCM-daemon and not FILE: like in Debian. When I die an ldapsearch or an ldapwhoami I'm getting ----------- [u1-prod@ldapserver1 ~]$ ldapwhoami SASL/GSSAPI authentication started ldap_sasl_interactive_bind: Local error (-2) additional info: SASL(-1): generic failure: GSSAPI Error: Miscellaneous failure (see text) (get-principal lstat(/tmp/krb5cc_10001)) ----------- All the ldap-commands are looking for the credential cache in FILE: and not in KCM: I'm using OpenLDAP 2.6 from the repositories. Is there a way that the ldap-commands are using KCM:?

3 5

Strange search result in logs
by Frédéric Goudal 27 Mar '24

27 Mar '24

Hello, I’m trying to analyse the requests done to my ldapserver from a nas. While browsing the logs I found the following entries : Mar 27 09:35:45 ldapd2021 slapd[3670819]: conn=2910400 fd=38 ACCEPT from IP=10.220.18.3:47000 (IP=0.0.0.0:636) Mar 27 09:35:45 ldapd2021 slapd[3670819]: conn=2910400 fd=38 TLS established tls_ssf=256 ssf=256 tls_proto=TLSv1.2 tls_cipher=ECDHE-RSA-AES256-GCM-SHA384 Mar 27 09:35:45 ldapd2021 slapd[3670819]: conn=2910400 op=0 BIND dn="" method=128 Mar 27 09:35:45 ldapd2021 slapd[3670819]: conn=2910400 op=0 RESULT tag=97 err=0 qtime=0.000014 etime=0.000110 text= ….. Mar 27 09:37:43 ldapd2021 slapd[3670819]: conn=2910400 op=720 SRCH base="ou=people,dc=ipb,dc=fr" scope=1 deref=0 filter="(&(objectClass=posixAccount)(gidNumber=*)) Mar 27 09:37:43 ldapd2021 slapd[3670819]: conn=2910400 op=720 SRCH attr=gidNumber Mar 27 09:37:43 ldapd2021 slapd[3670819]: conn=2910400 op=720 SEARCH RESULT tag=101 err=4 qtime=0.000007 etime=0.000224 nentries=1 text= But if I do the same seach : Mar 27 09:58:34 ldapd2021 slapd[3670819]: conn=2911004 fd=31 ACCEPT from IP=127.0.0.1:56536 (IP=0.0.0.0:636) Mar 27 09:58:34 ldapd2021 slapd[3670819]: conn=2911004 fd=31 TLS established tls_ssf=256 ssf=256 tls_proto=TLSv1.3 tls_cipher=TLS_AES_256_GCM_SHA384 Mar 27 09:58:34 ldapd2021 slapd[3670819]: conn=2911004 op=0 BIND dn="" method=128 Mar 27 09:58:34 ldapd2021 slapd[3670819]: conn=2911004 op=0 RESULT tag=97 err=0 qtime=0.000008 etime=0.000040 text= Mar 27 09:58:34 ldapd2021 slapd[3670819]: conn=2911004 op=1 SRCH base="ou=people,dc=ipb,dc=fr" scope=1 deref=0 filter="(&(objectClass=posixAccount)(gidNumber=*))" Mar 27 09:58:34 ldapd2021 slapd[3670819]: conn=2911004 op=1 SRCH attr=gidNumber Mar 27 09:58:34 ldapd2021 slapd[3670819]: conn=2911004 op=1 SEARCH RESULT tag=101 err=0 qtime=0.000011 etime=0.054003 nentries=5206 text= I have no specific ACL on the ip quering. What I see is that in the first case I have err=4, from what I have found it means size limit exceeded. Do you have an explanation of the first anwser ? Is there any param that can be in the request to cause the err=4 ? Maybe I should rise the logLevel to find the difference between the two requests ? Thanks in advance for any hint... — Frédéric Goudal Ingénieur Système, DSI Bordeaux-INP +33 556 84 23 11

3 3

how to migrate an openldap server to a new linux server
by xpzhang1971＠gmail.com 27 Mar '24

27 Mar '24

I have an openldap server I want to clone it to another linux server. However, I can't access it by login but can just run ldapsearch because this source openldap server only open port 389. Now I installed openldap-servers package to target linux server, then what? I appreciate if anybody can instruct me or direct me to useful documents.

5 14

etensibleObject vs. creating a new schema
by Uwe Sauter 26 Mar '24

26 Mar '24

Hi all, I was wondering if there is any best practice when to use extensibleObject in contrast to creating new objectClasses within a local schema. E.g. I have the need to filter the visibility of posixGroups depending on some attribute when sssd is accessing the directory. What I could do is to use an extra objectClass: extensibleObject to allow all defined attributes (e.g. host) to be used within my object. I could also create a new objectClass ( 2.25.$UUID.1.2.1 NAME 'myGroup' DESC 'Group with host attribute' SUP posixGroup AUXILIARY MAY host ) As far as I can tell using extensibleObject has the disadvantage to more or less disable the checks for correct attribute usage. Are there more positive or negative aspects to extensibleObject? I'd like to hear your thought on this. Thanks, Uwe

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical