- openldap-technical - openldap.org

Logging Region out of memory
by Scott Mayo 13 Jun '18

13 Jun '18

I just started getting this early this morning. I set this server up a number of years ago. I am getting ready to put a new one in place, but need to get this back up and going in the mean time. Openldap version is 2.4.12 /sbin/service ldap start Checking configuration files for slapd: [FAILED] Logging region out of memory; you may need to increase its size db_open(/var/lib/ldap/id2entry.bdb) failed: Cannot allocate memory (12). backend_startup_one: bi_db_open failed! (12) slap_startup failed (test would succeed using the -u switch) stale lock files may be present in /var/lib/ldap [WARNING] Any ideas on what I need to check there? Thanks. -- Scott Mayo - System Administrator Bloomfield Schools PH: 573-568-5669 FA: 573-568-4565

4 6

LDAP backend uri configuration option order
by Scott Koranda 13 Jun '18

13 Jun '18

Hi, In the LDAP backend manual (eg. 'man slapd-ldap') I read for the 'uri' configuration option "The URI list is space- or comma-separated. Whenever the server that responds is not the first one in the list, the list is rearranged and the responsive server is moved to the head, so that it will be first contacted the next time a connection needs to be created." Outside of updating the value for the 'uri' configuration option (more properly the 'olcDbURI' configuration option) or restarting slapd, is there any way to cause the ordering to return to the configured order once an unresponsive server again becomes responsive? Thanks, Scott K

1 0

OPenLDAP instances frequently crashes
by Saurabh Lahoti 13 Jun '18

13 Jun '18

Dear, Frequently, our OpenLDAP instances crashes thereby leading us into severe disastrous results & outages for business. While going through slapd logs, it always says " bdb_db_open: database: unclean shutdown detected; attempting recovery" What could possibly go wrong here..? ---- *Thanks & Kind Regards,* Saurabh LAHOTI.

3 3

Referrals, Chains, and Subordinate confusion
by Chris 11 Jun '18

11 Jun '18

Hello, We're in the process of setting up a new DIT divided up by a handful of (o) organizations. We would like to split the DIT up so that each organization will sysadmin their own ldap provider containing their branch of the DIT. There are some examples on the Net on how to use referrals and chains and the set up seems to be what we want, and relatively straight forward to implement. But before we begin, I'd like to check. The documentation here is confusing. http://www.openldap.org/doc/admin24/referrals.html At the bottom of the page, the 2nd Note says "A better approach would be to use explicitly defined local and proxy databases in /subordinate/ configurations to provide a seamless view of the Distributed Directory." I've scoured the Net for some clues/examples to what this means but haven't found anything that helps us much to understand. The same page http://www.openldap.org/doc/admin24/referrals.htm says "Subordinate knowledge information is maintained in the directory as a special /referral/ object" but that seems to enter into conflict with the 2nd Note. ?? There also seems to be a "olcSubordinate" attribute that I can't find any information about. How does the "local and proxy databases in /subordinate/ configurations" configuration work? Is it documented anywhere? Any pointers or suggestions would be greatly appreciated. Thanks. Chris. ||||||

2 1

performance problem
by Mark Tilmes 11 Jun '18

11 Jun '18

LDAP list, I have been trying to figure out this problem for a few weeks, I have been reading the archives and searching google to no avail. We have a high load at the beginning of every minute due to automated processes authenticating. During this time, authentications take from about 5 seconds to as much as 12 seconds. I can even run an ldapwho command directly on the ldap server and see the slowness. Looking at netstat, there are as many as 500 connections coming in to each server around that time. The load has been processed within 20 seconds. Here is some info on what I am running: RHEL 6.9 os Openldap 2.4.40 from the RHEL rpm These systems have 16 cpu’s but they are ~90% idle. The ldap database is on mdb, it is 52M. There are 3657 entries. The systems have 32G of memory each, after buffers and cache, 12G is free. I think just about everything this system does for disk is cached in memory. The only other thing running on these servers is dns and ntp, but when we turn those off, we still see the slowness. See below for my openldap configuration. I am trying to figure out if this is an unreasonable load for these servers and I just need more servers, or if there is some tuning I can do to help with this? When I look at cn=threads,cn=monitor I see active threads go up to 16 and pending threads go up to 127 or so. I increased threads but saw a similar result, all threads are active, many are still pending. When increasing threads to 128, I ended up with this error message: mdb_opinfo_get: err MDB_READERS_FULL: Environment maxreaders limit reached(-30790) I'm not sure what I can do about that. I'm also not sure if I also need to increase listener threads? Seems like not since the threads are all active during the traffic burst. We have 4 ldap servers, one handles writes and then syncs to the other 3, so there are no writes on the other 3, and very few writes on the master, just when we add users or change group memberships which is infrequent, just a few times a month. Any advice is appreciated. Mark Tilmes [root@core6 ldap]# slapcat -F /cb/env/infra/openldap/etc/openldap/core6/slapd.d/ -b 'cn=config' dn: cn=config objectClass: olcGlobal cn: config olcConfigFile: slapd.conf olcConfigDir: slapd.d olcAttributeOptions: lang- olcAuthzPolicy: none olcConcurrency: 0 olcConnMaxPending: 100 olcConnMaxPendingAuth: 1000 olcGentleHUP: FALSE olcIndexSubstrIfMaxLen: 4 olcIndexSubstrIfMinLen: 2 olcIndexSubstrAnyLen: 4 olcIndexSubstrAnyStep: 2 olcIndexIntLen: 4 olcLocalSSF: 71 olcReadOnly: FALSE olcReverseLookup: FALSE olcSaslSecProps: noplain,noanonymous olcSockbufMaxIncoming: 262143 olcSockbufMaxIncomingAuth: 16777215 olcTLSCACertificateFile: **** olcTLSCertificateFile: **** olcTLSCertificateKeyFile: **** /ldap6.rsakey.pem olcTLSCipherSuite: HIGH olcTLSVerifyClient: never olcTLSProtocolMin: 3.1 olcToolThreads: 1 olcWriteTimeout: 0 structuralObjectClass: olcGlobal entryUUID: ba4a33d4-097c-1036-94c5-9395bf97badd creatorsName: cn=config createTimestamp: 20160907192632Z olcTCPBuffer: 2048 olcIdleTimeout: 0 olcListenerThreads: 1 olcLogLevel: none olcThreads: 16 entryCSN: 20180607174833.321882Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20180607174833Z dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModuleLoad: {0}back_hdb.la olcModuleLoad: {1}syncprov.la olcModuleLoad: {2}auditlog.la structuralObjectClass: olcModuleList entryUUID: ba4c0010-097c-1036-94c6-9395bf97badd creatorsName: cn=config createTimestamp: 20160907192632Z entryCSN: 20160907192632.339422Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20160907192632Z dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema olcObjectIdentifier: OLcfg 1.3.6.1.4.1.4203.1.12.2 olcObjectIdentifier: OLcfgAt OLcfg:3 olcObjectIdentifier: OLcfgGlAt OLcfgAt:0 olcObjectIdentifier: OLcfgBkAt OLcfgAt:1 olcObjectIdentifier: OLcfgDbAt OLcfgAt:2 olcObjectIdentifier: OLcfgOvAt OLcfgAt:3 olcObjectIdentifier: OLcfgCtAt OLcfgAt:4 olcObjectIdentifier: OLcfgOc OLcfg:4 olcObjectIdentifier: OLcfgGlOc OLcfgOc:0 olcObjectIdentifier: OLcfgBkOc OLcfgOc:1 olcObjectIdentifier: OLcfgDbOc OLcfgOc:2 olcObjectIdentifier: OLcfgOvOc OLcfgOc:3 olcObjectIdentifier: OLcfgCtOc OLcfgOc:4 olcObjectIdentifier: OMsyn 1.3.6.1.4.1.1466.115.121.1 olcObjectIdentifier: OMsBoolean OMsyn:7 olcObjectIdentifier: OMsDN OMsyn:12 olcObjectIdentifier: OMsDirectoryString OMsyn:15 olcObjectIdentifier: OMsIA5String OMsyn:26 olcObjectIdentifier: OMsInteger OMsyn:27 olcObjectIdentifier: OMsOID OMsyn:38 olcObjectIdentifier: OMsOctetString OMsyn:40 olcObjectIdentifier: olmAttributes 1.3.6.1.4.1.4203.666.1.55 olcObjectIdentifier: olmSubSystemAttributes olmAttributes:0 olcObjectIdentifier: olmGenericAttributes olmSubSystemAttributes:0 olcObjectIdentifier: olmDatabaseAttributes olmSubSystemAttributes:1 olcObjectIdentifier: olmObjectClasses 1.3.6.1.4.1.4203.666.3.16 olcObjectIdentifier: olmSubSystemObjectClasses olmObjectClasses:0 olcObjectIdentifier: olmGenericObjectClasses olmSubSystemObjectClasses:0 olcObjectIdentifier: olmDatabaseObjectClasses olmSubSystemObjectClasses:1 olcObjectIdentifier: olmMDBAttributes olmDatabaseAttributes:1 olcObjectIdentifier: olmMDBObjectClasses olmDatabaseObjectClasses:1 olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.1 DESC 'ACI Item' X-BINARY-TRA NSFER-REQUIRED 'TRUE' X-NOT-HUMAN-READABLE 'TRUE' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.2 DESC 'Access Point' X-NOT-HU MAN-READABLE 'TRUE' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.3 DESC 'Attribute Type Descrip tion' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.4 DESC 'Audio' X-NOT-HUMAN-REA DABLE 'TRUE' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.5 DESC 'Binary' X-NOT-HUMAN-RE ADABLE 'TRUE' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.6 DESC 'Bit String' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.7 DESC 'Boolean' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.8 DESC 'Certificate' X-BINARY- TRANSFER-REQUIRED 'TRUE' X-NOT-HUMAN-READABLE 'TRUE' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.9 DESC 'Certificate List' X-BI NARY-TRANSFER-REQUIRED 'TRUE' X-NOT-HUMAN-READABLE 'TRUE' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.10 DESC 'Certificate Pair' X-B INARY-TRANSFER-REQUIRED 'TRUE' X-NOT-HUMAN-READABLE 'TRUE' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.4203.666.11.10.2.1 DESC 'X.509 AttributeCerti ficate' X-BINARY-TRANSFER-REQUIRED 'TRUE' X-NOT-HUMAN-READABLE 'TRUE' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.12 DESC 'Distinguished Name' ) olcLdapSyntaxes: ( 1.2.36.79672281.1.5.0 DESC 'RDN' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.13 DESC 'Data Quality' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.14 DESC 'Delivery Method' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.15 DESC 'Directory String' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.16 DESC 'DIT Content Rule Desc ription' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.17 DESC 'DIT Structure Rule De scription' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.19 DESC 'DSA Quality' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.20 DESC 'DSE Type' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.21 DESC 'Enhanced Guide' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.22 DESC 'Facsimile Telephone N umber' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.23 DESC 'Fax' X-NOT-HUMAN-READ ABLE 'TRUE' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.24 DESC 'Generalized Time' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.25 DESC 'Guide' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.26 DESC 'IA5 String' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.27 DESC 'Integer' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.28 DESC 'JPEG' X-NOT-HUMAN-REA DABLE 'TRUE' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.29 DESC 'Master And Shadow Acc ess Points' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.30 DESC 'Matching Rule Descrip tion' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.31 DESC 'Matching Rule Use Des cription' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.32 DESC 'Mail Preference' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.33 DESC 'MHS OR Address' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.34 DESC 'Name And Optional UID ' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.35 DESC 'Name Form Description ' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.36 DESC 'Numeric String' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.37 DESC 'Object Class Descript ion' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.38 DESC 'OID' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.39 DESC 'Other Mailbox' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.40 DESC 'Octet String' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.41 DESC 'Postal Address' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.42 DESC 'Protocol Information' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.43 DESC 'Presentation Address' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.44 DESC 'Printable String' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.11 DESC 'Country String' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.45 DESC 'SubtreeSpecification' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.49 DESC 'Supported Algorithm' X-BINARY-TRANSFER-REQUIRED 'TRUE' X-NOT-HUMAN-READABLE 'TRUE' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.50 DESC 'Telephone Number' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.51 DESC 'Teletex Terminal Iden tifier' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.52 DESC 'Telex Number' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.54 DESC 'LDAP Syntax Descripti on' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.55 DESC 'Modify Rights' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.56 DESC 'LDAP Schema Definitio n' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.57 DESC 'LDAP Schema Descripti on' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.58 DESC 'Substring Assertion' ) olcLdapSyntaxes: ( 1.3.6.1.1.1.0.0 DESC 'RFC2307 NIS Netgroup Triple' ) olcLdapSyntaxes: ( 1.3.6.1.1.1.0.1 DESC 'RFC2307 Boot Parameter' ) olcLdapSyntaxes: ( 1.3.6.1.1.15.1 DESC 'Certificate Exact Assertion' ) olcLdapSyntaxes: ( 1.3.6.1.1.15.2 DESC 'Certificate Assertion' ) olcLdapSyntaxes: ( 1.3.6.1.1.15.3 DESC 'Certificate Pair Exact Assertion' ) olcLdapSyntaxes: ( 1.3.6.1.1.15.4 DESC 'Certificate Pair Assertion' ) olcLdapSyntaxes: ( 1.3.6.1.1.15.5 DESC 'Certificate List Exact Assertion' ) olcLdapSyntaxes: ( 1.3.6.1.1.15.6 DESC 'Certificate List Assertion' ) olcLdapSyntaxes: ( 1.3.6.1.1.15.7 DESC 'Algorithm Identifier' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.4203.666.11.10.2.2 DESC 'AttributeCertificate Exact Assertion' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.4203.666.11.10.2.3 DESC 'AttributeCertificate Assertion' ) olcLdapSyntaxes: ( 1.3.6.1.1.16.1 DESC 'UUID' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.4203.666.11.2.1 DESC 'CSN' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.4203.666.11.2.4 DESC 'CSN SID' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.4203.1.1.1 DESC 'OpenLDAP void' ) olcLdapSyntaxes: ( 1.3.6.1.4.1.4203.666.2.7 DESC 'OpenLDAP authz' ) olcAttributeTypes: ( 2.5.4.0 NAME 'objectClass' DESC 'RFC4512: object classe s of the entity' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115 .121.1.38 ) olcAttributeTypes: ( 2.5.21.9 NAME 'structuralObjectClass' DESC 'RFC4512: st ructural object class of entry' EQUALITY objectIdentifierMatch SYNTAX 1.3.6 .1.4.1.1466.115.121.1.38 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryO peration ) olcAttributeTypes: ( 2.5.18.1 NAME 'createTimestamp' DESC 'RFC4512: time whi ch object was created' EQUALITY generalizedTimeMatch ORDERING generalizedTi meOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE NO-USER-M ODIFICATION USAGE directoryOperation ) olcAttributeTypes: ( 2.5.18.2 NAME 'modifyTimestamp' DESC 'RFC4512: time whi ch object was last modified' EQUALITY generalizedTimeMatch ORDERING general izedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE NO- USER-MODIFICATION USAGE directoryOperation ) olcAttributeTypes: ( 2.5.18.3 NAME 'creatorsName' DESC 'RFC4512: name of cre ator' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) olcAttributeTypes: ( 2.5.18.4 NAME 'modifiersName' DESC 'RFC4512: name of la st modifier' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.12 1.1.12 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) olcAttributeTypes: ( 2.5.18.9 NAME 'hasSubordinates' DESC 'X.501: entry has children' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE- VALUE NO-USER-MODIFICATION USAGE directoryOperation ) olcAttributeTypes: ( 2.5.18.10 NAME 'subschemaSubentry' DESC 'RFC4512: name of controlling subschema entry' EQUALITY distinguishedNameMatch SYNTAX 1.3. 6.1.4.1.1466.115.121.1.12 SINGLE-VALUE NO-USER-MODIFICATION USAGE directory Operation ) olcAttributeTypes: ( 1.3.6.1.1.20 NAME 'entryDN' DESC 'DN of the entry' EQUA LITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VAL UE NO-USER-MODIFICATION USAGE directoryOperation ) olcAttributeTypes: ( 1.3.6.1.1.16.4 NAME 'entryUUID' DESC 'UUID of the entry ' EQUALITY UUIDMatch ORDERING UUIDOrderingMatch SYNTAX 1.3.6.1.1.16.1 SINGL E-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.7 NAME 'entryCSN' DESC 'change s equence number of the entry content' EQUALITY CSNMatch ORDERING CSNOrdering Match SYNTAX 1.3.6.1.4.1.4203.666.11.2.1{64} SINGLE-VALUE NO-USER-MODIFICAT ION USAGE directoryOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.13 NAME 'namingCSN' DESC 'change sequence number of the entry naming (RDN)' EQUALITY CSNMatch ORDERING CSNO rderingMatch SYNTAX 1.3.6.1.4.1.4203.666.11.2.1{64} SINGLE-VALUE NO-USER-MO DIFICATION USAGE directoryOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.23 NAME 'syncreplCookie' DESC 's yncrepl Cookie for shadow copy' EQUALITY octetStringMatch ORDERING octetStr ingOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE NO-USER- MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.25 NAME 'contextCSN' DESC 'the l argest committed CSN of a context' EQUALITY CSNMatch ORDERING CSNOrderingMa tch SYNTAX 1.3.6.1.4.1.4203.666.11.2.1{64} NO-USER-MODIFICATION USAGE dSAOp eration ) olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.120.6 NAME 'altServer' DESC 'RFC45 12: alternative servers' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 USAGE dSAOper ation ) olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.120.5 NAME 'namingContexts' DESC ' RFC4512: naming contexts' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 USAGE dSAOpe ration ) olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.120.13 NAME 'supportedControl' DES C 'RFC4512: supported controls' SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.120.7 NAME 'supportedExtension' DE SC 'RFC4512: supported extended operations' SYNTAX 1.3.6.1.4.1.1466.115.121 .1.38 USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.120.15 NAME 'supportedLDAPVersion' DESC 'RFC4512: supported LDAP versions' SYNTAX 1.3.6.1.4.1.1466.115.121.1. 27 USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.120.14 NAME 'supportedSASLMechanis ms' DESC 'RFC4512: supported SASL mechanisms' SYNTAX 1.3.6.1.4.1.1466.115.1 21.1.15 USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.1.3.5 NAME 'supportedFeatures' DESC 'R FC4512: features supported by the server' EQUALITY objectIdentifierMatch SY NTAX 1.3.6.1.4.1.1466.115.121.1.38 USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.10 NAME 'monitorContext' DESC 'm onitor context' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115 .121.1.12 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.1.12.2.1 NAME 'configContext' DESC 'co nfig context' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.1 21.1.12 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.1.4 NAME 'vendorName' DESC 'RFC3045: name of im plementation vendor' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.12 1.1.15 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.1.5 NAME 'vendorVersion' DESC 'RFC3045: version of implementation' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121 .1.15 SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 2.5.18.5 NAME 'administrativeRole' DESC 'RFC3672: admin istrative role' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115. 121.1.38 USAGE directoryOperation ) olcAttributeTypes: ( 2.5.18.6 NAME 'subtreeSpecification' DESC 'RFC3672: sub tree specification' SYNTAX 1.3.6.1.4.1.1466.115.121.1.45 SINGLE-VALUE USAGE directoryOperation ) olcAttributeTypes: ( 2.5.21.1 NAME 'dITStructureRules' DESC 'RFC4512: DIT st ructure rules' EQUALITY integerFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466. 115.121.1.17 USAGE directoryOperation ) olcAttributeTypes: ( 2.5.21.2 NAME 'dITContentRules' DESC 'RFC4512: DIT cont ent rules' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1. 1466.115.121.1.16 USAGE directoryOperation ) olcAttributeTypes: ( 2.5.21.4 NAME 'matchingRules' DESC 'RFC4512: matching r ules' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466. 115.121.1.30 USAGE directoryOperation ) olcAttributeTypes: ( 2.5.21.5 NAME 'attributeTypes' DESC 'RFC4512: attribute types' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.146 6.115.121.1.3 USAGE directoryOperation ) olcAttributeTypes: ( 2.5.21.6 NAME 'objectClasses' DESC 'RFC4512: object cla sses' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466. 115.121.1.37 USAGE directoryOperation ) olcAttributeTypes: ( 2.5.21.7 NAME 'nameForms' DESC 'RFC4512: name forms ' E QUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.121 .1.35 USAGE directoryOperation ) olcAttributeTypes: ( 2.5.21.8 NAME 'matchingRuleUse' DESC 'RFC4512: matching rule uses' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1 .1466.115.121.1.31 USAGE directoryOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.120.16 NAME 'ldapSyntaxes' DESC 'R FC4512: LDAP syntaxes' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.54 USAGE directoryOperation ) olcAttributeTypes: ( 2.5.4.1 NAME ( 'aliasedObjectName' 'aliasedEntryName' ) DESC 'RFC4512: name of aliased object' EQUALITY distinguishedNameMatch SYN TAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE ) olcAttributeTypes: ( 2.16.840.1.113730.3.1.34 NAME 'ref' DESC 'RFC3296: subo rdinate referral URL' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.1 21.1.15 USAGE distributedOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.1.3.1 NAME 'entry' DESC 'OpenLDAP ACL entry pseudo-attribute' SYNTAX 1.3.6.1.4.1.4203.1.1.1 SINGLE-VALUE NO-USER- MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.1.3.2 NAME 'children' DESC 'OpenLDAP A CL children pseudo-attribute' SYNTAX 1.3.6.1.4.1.4203.1.1.1 SINGLE-VALUE NO -USER-MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.8 NAME ( 'authzTo' 'saslAuthzTo' ) DESC 'proxy authorization targets' EQUALITY authzMatch SYNTAX 1.3.6.1.4. 1.4203.666.2.7 USAGE distributedOperation X-ORDERED 'VALUES' ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.9 NAME ( 'authzFrom' 'saslAuthzF rom' ) DESC 'proxy authorization sources' EQUALITY authzMatch SYNTAX 1.3.6. 1.4.1.4203.666.2.7 USAGE distributedOperation X-ORDERED 'VALUES' ) olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.119.3 NAME 'entryTtl' DESC 'RFC258 9: entry time-to-live' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE NO -USER-MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.1466.101.119.4 NAME 'dynamicSubtrees' DESC 'RFC2589: dynamic subtrees' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 NO-USER-MO DIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 2.5.4.49 NAME 'distinguishedName' DESC 'RFC4519: common supertype of DN attributes' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1 .4.1.1466.115.121.1.12 ) olcAttributeTypes: ( 2.5.4.41 NAME 'name' DESC 'RFC4519: common supertype of name attributes' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{32768} ) olcAttributeTypes: ( 2.5.4.3 NAME ( 'cn' 'commonName' ) DESC 'RFC4519: commo n name(s) for which the entity is known by' SUP name ) olcAttributeTypes: ( 0.9.2342.19200300.100.1.1 NAME ( 'uid' 'userid' ) DESC 'RFC4519: user identifier' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstr ingsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: ( 1.3.6.1.1.1.1.0 NAME 'uidNumber' DESC 'RFC2307: An inte ger uniquely identifying a user in an administrative domain' EQUALITY integ erMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: ( 1.3.6.1.1.1.1.1 NAME 'gidNumber' DESC 'RFC2307: An inte ger uniquely identifying a group in an administrative domain' EQUALITY inte gerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: ( 2.5.4.35 NAME 'userPassword' DESC 'RFC4519/2307: passwo rd of user' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40{ 128} ) olcAttributeTypes: ( 1.3.6.1.4.1.250.1.57 NAME 'labeledURI' DESC 'RFC2079: U niform Resource Identifier with optional label' EQUALITY caseExactMatch SYN TAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: ( 2.5.4.13 NAME 'description' DESC 'RFC4519: descriptive information' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNT AX 1.3.6.1.4.1.1466.115.121.1.15{1024} ) olcAttributeTypes: ( 2.5.4.34 NAME 'seeAlso' DESC 'RFC4519: DN of related ob ject' SUP distinguishedName ) olcAttributeTypes: ( OLcfgGlAt:78 NAME 'olcConfigFile' DESC 'File for slapd configuration directives' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryStrin g SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:79 NAME 'olcConfigDir' DESC 'Directory for sl apd configuration backend' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryStri ng SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:1 NAME 'olcAccess' DESC 'Access Control List' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString X-ORDERED 'VALUES' ) olcAttributeTypes: ( OLcfgGlAt:86 NAME 'olcAddContentAcl' DESC 'Check ACLs a gainst content of Add ops' SYNTAX OMsBoolean SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:2 NAME 'olcAllows' DESC 'Allowed set of depre cated features' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) olcAttributeTypes: ( OLcfgGlAt:3 NAME 'olcArgsFile' DESC 'File for slapd com mand line options' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString SINGL E-VALUE ) olcAttributeTypes: ( OLcfgGlAt:5 NAME 'olcAttributeOptions' EQUALITY caseIgn oreMatch SYNTAX OMsDirectoryString ) olcAttributeTypes: ( OLcfgGlAt:4 NAME 'olcAttributeTypes' DESC 'OpenLDAP att ributeTypes' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNT AX OMsDirectoryString X-ORDERED 'VALUES' ) olcAttributeTypes: ( OLcfgGlAt:6 NAME 'olcAuthIDRewrite' EQUALITY caseIgnore Match SYNTAX OMsDirectoryString X-ORDERED 'VALUES' ) olcAttributeTypes: ( OLcfgGlAt:7 NAME 'olcAuthzPolicy' EQUALITY caseIgnoreMa tch SYNTAX OMsDirectoryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:8 NAME 'olcAuthzRegexp' EQUALITY caseIgnoreMa tch SYNTAX OMsDirectoryString X-ORDERED 'VALUES' ) olcAttributeTypes: ( OLcfgGlAt:9 NAME 'olcBackend' DESC 'A type of backend' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString SINGLE-VALUE X-ORDERED ' SIBLINGS' ) olcAttributeTypes: ( OLcfgGlAt:10 NAME 'olcConcurrency' SYNTAX OMsInteger SI NGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:11 NAME 'olcConnMaxPending' SYNTAX OMsInteger SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:12 NAME 'olcConnMaxPendingAuth' SYNTAX OMsInt eger SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:13 NAME 'olcDatabase' DESC 'The backend type for a database instance' SUP olcBackend SINGLE-VALUE X-ORDERED 'SIBLINGS' ) olcAttributeTypes: ( OLcfgGlAt:14 NAME 'olcDefaultSearchBase' SYNTAX OMsDN S INGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:15 NAME 'olcDisallows' EQUALITY caseIgnoreMat ch SYNTAX OMsDirectoryString ) olcAttributeTypes: ( OLcfgGlAt:16 NAME 'olcDitContentRules' DESC 'OpenLDAP D IT content rules' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX OMsDirectoryString X-ORDERED 'VALUES' ) olcAttributeTypes: ( OLcfgDbAt:0.20 NAME 'olcExtraAttrs' EQUALITY caseIgnore Match SYNTAX OMsDirectoryString ) olcAttributeTypes: ( OLcfgGlAt:17 NAME 'olcGentleHUP' SYNTAX OMsBoolean SING LE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:0.17 NAME 'olcHidden' SYNTAX OMsBoolean SINGL E-VALUE ) olcAttributeTypes: ( OLcfgGlAt:18 NAME 'olcIdleTimeout' SYNTAX OMsInteger SI NGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:19 NAME 'olcInclude' SUP labeledURI ) olcAttributeTypes: ( OLcfgGlAt:20 NAME 'olcIndexSubstrIfMinLen' SYNTAX OMsIn teger SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:21 NAME 'olcIndexSubstrIfMaxLen' SYNTAX OMsIn teger SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:22 NAME 'olcIndexSubstrAnyLen' SYNTAX OMsInte ger SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:23 NAME 'olcIndexSubstrAnyStep' SYNTAX OMsInt eger SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:84 NAME 'olcIndexIntLen' SYNTAX OMsInteger SI NGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:0.4 NAME 'olcLastMod' SYNTAX OMsBoolean SINGL E-VALUE ) olcAttributeTypes: ( OLcfgGlAt:85 NAME 'olcLdapSyntaxes' DESC 'OpenLDAP ldap Syntax' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX OM sDirectoryString X-ORDERED 'VALUES' ) olcAttributeTypes: ( OLcfgDbAt:0.5 NAME 'olcLimits' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString X-ORDERED 'VALUES' ) olcAttributeTypes: ( OLcfgGlAt:93 NAME 'olcListenerThreads' SYNTAX OMsIntege r SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:26 NAME 'olcLocalSSF' SYNTAX OMsInteger SINGL E-VALUE ) olcAttributeTypes: ( OLcfgGlAt:27 NAME 'olcLogFile' SYNTAX OMsDirectoryStrin g SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:28 NAME 'olcLogLevel' EQUALITY caseIgnoreMatc h SYNTAX OMsDirectoryString ) olcAttributeTypes: ( OLcfgDbAt:0.6 NAME 'olcMaxDerefDepth' SYNTAX OMsInteger SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:0.16 NAME 'olcMirrorMode' SYNTAX OMsBoolean S INGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:30 NAME 'olcModuleLoad' EQUALITY caseIgnoreMa tch SYNTAX OMsDirectoryString X-ORDERED 'VALUES' ) olcAttributeTypes: ( OLcfgGlAt:31 NAME 'olcModulePath' SYNTAX OMsDirectorySt ring SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:0.18 NAME 'olcMonitoring' SYNTAX OMsBoolean S INGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:32 NAME 'olcObjectClasses' DESC 'OpenLDAP obj ect classes' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNT AX OMsDirectoryString X-ORDERED 'VALUES' ) olcAttributeTypes: ( OLcfgGlAt:33 NAME 'olcObjectIdentifier' EQUALITY caseIg noreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX OMsDirectoryString X-ORDE RED 'VALUES' ) olcAttributeTypes: ( OLcfgGlAt:34 NAME 'olcOverlay' SUP olcDatabase SINGLE-V ALUE X-ORDERED 'SIBLINGS' ) olcAttributeTypes: ( OLcfgGlAt:35 NAME 'olcPasswordCryptSaltFormat' SYNTAX O MsDirectoryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:36 NAME 'olcPasswordHash' EQUALITY caseIgnore Match SYNTAX OMsDirectoryString ) olcAttributeTypes: ( OLcfgGlAt:37 NAME 'olcPidFile' SYNTAX OMsDirectoryStrin g SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:38 NAME 'olcPlugin' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) olcAttributeTypes: ( OLcfgGlAt:39 NAME 'olcPluginLogFile' SYNTAX OMsDirector yString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:40 NAME 'olcReadOnly' SYNTAX OMsBoolean SINGL E-VALUE ) olcAttributeTypes: ( OLcfgGlAt:41 NAME 'olcReferral' SUP labeledURI SINGLE-V ALUE ) olcAttributeTypes: ( OLcfgDbAt:0.7 NAME 'olcReplica' SUP labeledURI EQUALITY caseIgnoreMatch X-ORDERED 'VALUES' ) olcAttributeTypes: ( OLcfgGlAt:43 NAME 'olcReplicaArgsFile' SYNTAX OMsDirect oryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:44 NAME 'olcReplicaPidFile' SYNTAX OMsDirecto ryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:45 NAME 'olcReplicationInterval' SYNTAX OMsIn teger SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:46 NAME 'olcReplogFile' SYNTAX OMsDirectorySt ring SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:47 NAME 'olcRequires' EQUALITY caseIgnoreMatc h SYNTAX OMsDirectoryString ) olcAttributeTypes: ( OLcfgGlAt:48 NAME 'olcRestrict' EQUALITY caseIgnoreMatc h SYNTAX OMsDirectoryString ) olcAttributeTypes: ( OLcfgGlAt:49 NAME 'olcReverseLookup' SYNTAX OMsBoolean SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:0.8 NAME 'olcRootDN' EQUALITY distinguishedNa meMatch SYNTAX OMsDN SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:51 NAME 'olcRootDSE' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) olcAttributeTypes: ( OLcfgDbAt:0.9 NAME 'olcRootPW' SYNTAX OMsDirectoryStrin g SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:89 NAME 'olcSaslAuxprops' SYNTAX OMsDirectory String SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:53 NAME 'olcSaslHost' SYNTAX OMsDirectoryStri ng SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:54 NAME 'olcSaslRealm' SYNTAX OMsDirectoryStr ing SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:56 NAME 'olcSaslSecProps' SYNTAX OMsDirectory String SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:58 NAME 'olcSchemaDN' EQUALITY distinguishedN ameMatch SYNTAX OMsDN SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:59 NAME 'olcSecurity' EQUALITY caseIgnoreMatc h SYNTAX OMsDirectoryString ) olcAttributeTypes: ( OLcfgGlAt:81 NAME 'olcServerID' EQUALITY caseIgnoreMatc h SYNTAX OMsDirectoryString ) olcAttributeTypes: ( OLcfgGlAt:60 NAME 'olcSizeLimit' SYNTAX OMsDirectoryStr ing SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:61 NAME 'olcSockbufMaxIncoming' SYNTAX OMsInt eger SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:62 NAME 'olcSockbufMaxIncomingAuth' SYNTAX OM sInteger SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:83 NAME 'olcSortVals' DESC 'Attributes whose values will always be sorted' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryS tring ) olcAttributeTypes: ( OLcfgDbAt:0.15 NAME 'olcSubordinate' SYNTAX OMsDirector yString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:0.10 NAME 'olcSuffix' EQUALITY distinguishedN ameMatch SYNTAX OMsDN ) olcAttributeTypes: ( OLcfgDbAt:0.19 NAME 'olcSyncUseSubentry' DESC 'Store sy nc context in a subentry' SYNTAX OMsBoolean SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:0.11 NAME 'olcSyncrepl' EQUALITY caseIgnoreMa tch SYNTAX OMsDirectoryString X-ORDERED 'VALUES' ) olcAttributeTypes: ( OLcfgGlAt:90 NAME 'olcTCPBuffer' DESC 'Custom TCP buffe r size' SYNTAX OMsDirectoryString ) olcAttributeTypes: ( OLcfgGlAt:66 NAME 'olcThreads' SYNTAX OMsInteger SINGLE -VALUE ) olcAttributeTypes: ( OLcfgGlAt:67 NAME 'olcTimeLimit' SYNTAX OMsDirectoryStr ing ) olcAttributeTypes: ( OLcfgGlAt:68 NAME 'olcTLSCACertificateFile' SYNTAX OMsD irectoryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:69 NAME 'olcTLSCACertificatePath' SYNTAX OMsD irectoryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:70 NAME 'olcTLSCertificateFile' SYNTAX OMsDir ectoryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:71 NAME 'olcTLSCertificateKeyFile' SYNTAX OMs DirectoryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:72 NAME 'olcTLSCipherSuite' SYNTAX OMsDirecto ryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:73 NAME 'olcTLSCRLCheck' SYNTAX OMsDirectoryS tring SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:82 NAME 'olcTLSCRLFile' SYNTAX OMsDirectorySt ring SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:74 NAME 'olcTLSRandFile' SYNTAX OMsDirectoryS tring SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:75 NAME 'olcTLSVerifyClient' SYNTAX OMsDirect oryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:77 NAME 'olcTLSDHParamFile' SYNTAX OMsDirecto ryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:87 NAME 'olcTLSProtocolMin' SYNTAX OMsDirecto ryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgGlAt:80 NAME 'olcToolThreads' SYNTAX OMsInteger SI NGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:0.12 NAME 'olcUpdateDN' SYNTAX OMsDN SINGLE-V ALUE ) olcAttributeTypes: ( OLcfgDbAt:0.13 NAME 'olcUpdateRef' SUP labeledURI EQUAL ITY caseIgnoreMatch ) olcAttributeTypes: ( OLcfgGlAt:88 NAME 'olcWriteTimeout' SYNTAX OMsInteger S INGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:0.1 NAME 'olcDbDirectory' DESC 'Directory for database content' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString SINGL E-VALUE ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.1 NAME 'monitoredInfo' DESC ' monitored info' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch S YNTAX 1.3.6.1.4.1.1466.115.121.1.15{32768} NO-USER-MODIFICATION USAGE dSAOp eration ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.2 NAME 'managedInfo' DESC 'mo nitor managed info' SUP name ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.3 NAME 'monitorCounter' DESC 'monitor counter' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTA X 1.3.6.1.4.1.1466.115.121.1.27 NO-USER-MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.4 NAME 'monitorOpCompleted' D ESC 'monitor completed operations' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.5 NAME 'monitorOpInitiated' D ESC 'monitor initiated operations' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.6 NAME 'monitorConnectionNumb er' DESC 'monitor connection number' SUP monitorCounter NO-USER-MODIFICATIO N USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.7 NAME 'monitorConnectionAuth zDN' DESC 'monitor connection authorization DN' EQUALITY distinguishedNameM atch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 NO-USER-MODIFICATION USAGE dSAOpe ration ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.8 NAME 'monitorConnectionLoca lAddress' DESC 'monitor connection local address' SUP monitoredInfo NO-USER -MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.9 NAME 'monitorConnectionPeer Address' DESC 'monitor connection peer address' SUP monitoredInfo NO-USER-M ODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.10 NAME 'monitorTimestamp' DE SC 'monitor timestamp' EQUALITY generalizedTimeMatch ORDERING generalizedTi meOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE NO-USER-M ODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.11 NAME 'monitorOverlay' DESC 'name of overlays defined for a given database' SUP monitoredInfo NO-USER- MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.12 NAME 'readOnly' DESC 'read /write status of a given database' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1 .1466.115.121.1.7 SINGLE-VALUE USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.13 NAME 'restrictedOperation' DESC 'name of restricted operation for a given database' SUP managedInfo ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.14 NAME 'monitorConnectionPro tocol' DESC 'monitor connection protocol' SUP monitoredInfo NO-USER-MODIFIC ATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.15 NAME 'monitorConnectionOps Received' DESC 'monitor number of operations received by the connection' SU P monitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.16 NAME 'monitorConnectionOps Executing' DESC 'monitor number of operations in execution within the conne ction' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.17 NAME 'monitorConnectionOps Pending' DESC 'monitor number of pending operations within the connection' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.18 NAME 'monitorConnectionOps Completed' DESC 'monitor number of operations completed within the connecti on' SUP monitorCounter NO-USER-MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.19 NAME 'monitorConnectionGet ' DESC 'number of times connection_get() was called so far' SUP monitorCoun ter NO-USER-MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.20 NAME 'monitorConnectionRea d' DESC 'number of times connection_read() was called so far' SUP monitorCo unter NO-USER-MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.21 NAME 'monitorConnectionWri te' DESC 'number of times connection_write() was called so far' SUP monitor Counter NO-USER-MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.22 NAME 'monitorConnectionMas k' DESC 'monitor connection mask' SUP monitoredInfo NO-USER-MODIFICATION US AGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.23 NAME 'monitorConnectionLis tener' DESC 'monitor connection listener' SUP monitoredInfo NO-USER-MODIFIC ATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.24 NAME 'monitorConnectionPee rDomain' DESC 'monitor connection peer domain' SUP monitoredInfo NO-USER-MO DIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.25 NAME 'monitorConnectionSta rtTime' DESC 'monitor connection start time' SUP monitorTimestamp SINGLE-VA LUE NO-USER-MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.26 NAME 'monitorConnectionAct ivityTime' DESC 'monitor connection activity time' SUP monitorTimestamp SIN GLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.27 NAME 'monitorIsShadow' DES C 'TRUE if the database is shadow' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1 .1466.115.121.1.7 SINGLE-VALUE USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.28 NAME 'monitorUpdateRef' DE SC 'update referral for shadow databases' SUP monitoredInfo SINGLE-VALUE US AGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.29 NAME 'monitorRuntimeConfig ' DESC 'TRUE if component allows runtime configuration' EQUALITY booleanMat ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.55.30 NAME 'monitorSuperiorDN' D ESC 'monitor superior DN' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4. 1.1466.115.121.1.12 NO-USER-MODIFICATION USAGE dSAOperation ) olcAttributeTypes: ( OLcfgDbAt:1.11 NAME 'olcDbCacheFree' DESC 'Number of ex tra entries to free when max is reached' SYNTAX OMsInteger SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:1.1 NAME 'olcDbCacheSize' DESC 'Entry cache s ize in entries' SYNTAX OMsInteger SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:1.2 NAME 'olcDbCheckpoint' DESC 'Database che ckpoint interval in kbytes and minutes' SYNTAX OMsDirectoryString SINGLE-VA LUE ) olcAttributeTypes: ( OLcfgDbAt:1.16 NAME 'olcDbChecksum' DESC 'Enable databa se checksum validation' SYNTAX OMsBoolean SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:1.13 NAME 'olcDbCryptFile' DESC 'Pathname of file containing the DB encryption key' SYNTAX OMsDirectoryString SINGLE-VAL UE ) olcAttributeTypes: ( OLcfgDbAt:1.14 NAME 'olcDbCryptKey' DESC 'DB encryption key' SYNTAX OMsOctetString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:1.3 NAME 'olcDbConfig' DESC 'BerkeleyDB DB_CO NFIG configuration directives' SYNTAX OMsIA5String X-ORDERED 'VALUES' ) olcAttributeTypes: ( OLcfgDbAt:1.4 NAME 'olcDbNoSync' DESC 'Disable synchron ous database writes' SYNTAX OMsBoolean SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:1.15 NAME 'olcDbPageSize' DESC 'Page size of specified DB, in Kbytes' EQUALITY caseExactMatch SYNTAX OMsDirectoryString ) olcAttributeTypes: ( OLcfgDbAt:1.5 NAME 'olcDbDirtyRead' DESC 'Allow reads o f uncommitted data' SYNTAX OMsBoolean SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:1.12 NAME 'olcDbDNcacheSize' DESC 'DN cache s ize' SYNTAX OMsInteger SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:1.6 NAME 'olcDbIDLcacheSize' DESC 'IDL cache size in IDLs' SYNTAX OMsInteger SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:0.2 NAME 'olcDbIndex' DESC 'Attribute index p arameters' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) olcAttributeTypes: ( OLcfgDbAt:1.7 NAME 'olcDbLinearIndex' DESC 'Index attri butes one at a time' SYNTAX OMsBoolean SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:1.8 NAME 'olcDbLockDetect' DESC 'Deadlock det ection algorithm' SYNTAX OMsDirectoryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:0.3 NAME 'olcDbMode' DESC 'Unix permissions o f database files' SYNTAX OMsDirectoryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:1.9 NAME 'olcDbSearchStack' DESC 'Depth of se arch stack in IDLs' SYNTAX OMsInteger SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:1.10 NAME 'olcDbShmKey' DESC 'Key for shared memory region' SYNTAX OMsInteger SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:0.14 NAME 'olcDbURI' DESC 'URI (list) for rem ote DSA' SYNTAX OMsDirectoryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:3.1 NAME 'olcDbStartTLS' DESC 'StartTLS' SYNT AX OMsDirectoryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:3.2 NAME 'olcDbACLAuthcDn' DESC 'Remote ACL a dministrative identity' OBSOLETE SYNTAX OMsDN SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:3.3 NAME 'olcDbACLPasswd' DESC 'Remote ACL ad ministrative identity credentials' OBSOLETE SYNTAX OMsDirectoryString SINGL E-VALUE ) olcAttributeTypes: ( OLcfgDbAt:3.4 NAME 'olcDbACLBind' DESC 'Remote ACL admi nistrative identity auth bind configuration' SYNTAX OMsDirectoryString SING LE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:3.5 NAME 'olcDbIDAssertAuthcDn' DESC 'Remote Identity Assertion administrative identity' OBSOLETE SYNTAX OMsDN SINGLE-VA LUE ) olcAttributeTypes: ( OLcfgDbAt:3.6 NAME 'olcDbIDAssertPasswd' DESC 'Remote I dentity Assertion administrative identity credentials' OBSOLETE SYNTAX OMsD irectoryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:3.7 NAME 'olcDbIDAssertBind' DESC 'Remote Ide ntity Assertion administrative identity auth bind configuration' SYNTAX OMs DirectoryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:3.8 NAME 'olcDbIDAssertMode' DESC 'Remote Ide ntity Assertion mode' OBSOLETE SYNTAX OMsDirectoryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:3.9 NAME 'olcDbIDAssertAuthzFrom' DESC 'Remot e Identity Assertion authz rules' EQUALITY caseIgnoreMatch SYNTAX OMsDirect oryString X-ORDERED 'VALUES' ) olcAttributeTypes: ( OLcfgDbAt:3.10 NAME 'olcDbRebindAsUser' DESC 'Rebind as user' SYNTAX OMsBoolean SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:3.11 NAME 'olcDbChaseReferrals' DESC 'Chase r eferrals' SYNTAX OMsBoolean SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:3.12 NAME 'olcDbTFSupport' DESC 'Absolute fil ters support' SYNTAX OMsDirectoryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:3.13 NAME 'olcDbProxyWhoAmI' DESC 'Proxy whoA mI exop' SYNTAX OMsBoolean SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:3.14 NAME 'olcDbTimeout' DESC 'Per-operation timeouts' SYNTAX OMsDirectoryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:3.15 NAME 'olcDbIdleTimeout' DESC 'connection idle timeout' SYNTAX OMsDirectoryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:3.16 NAME 'olcDbConnTtl' DESC 'connection ttl ' SYNTAX OMsDirectoryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:3.17 NAME 'olcDbNetworkTimeout' DESC 'connect ion network timeout' SYNTAX OMsDirectoryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:3.18 NAME 'olcDbProtocolVersion' DESC 'protoc ol version' SYNTAX OMsInteger SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:3.19 NAME 'olcDbSingleConn' DESC 'cache a sin gle connection per identity' SYNTAX OMsBoolean SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:3.20 NAME 'olcDbCancel' DESC 'abandon/ignore/ exop operations when appropriate' SYNTAX OMsDirectoryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:3.21 NAME 'olcDbQuarantine' DESC 'Quarantine database if connection fails and retry according to rule' SYNTAX OMsDirecto ryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:3.22 NAME 'olcDbUseTemporaryConn' DESC 'Use t emporary connections if the cached one is busy' SYNTAX OMsBoolean SINGLE-VA LUE ) olcAttributeTypes: ( OLcfgDbAt:3.23 NAME 'olcDbConnectionPoolMax' DESC 'Max size of privileged connections pool' SYNTAX OMsInteger SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:3.24 NAME 'olcDbSessionTrackingRequest' DESC 'Add session tracking control to proxied requests' SYNTAX OMsBoolean SINGLE -VALUE ) olcAttributeTypes: ( OLcfgDbAt:3.25 NAME 'olcDbNoRefs' DESC 'Do not return s earch reference responses' SYNTAX OMsBoolean SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:3.26 NAME 'olcDbNoUndefFilter' DESC 'Do not p ropagate undefined search filters' SYNTAX OMsBoolean SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:3.108 NAME 'olcDbOnErr' DESC 'error handling' SYNTAX OMsDirectoryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:3.27 NAME 'olcDbIDAssertPassThru' DESC 'Remot e Identity Assertion passthru rules' EQUALITY caseIgnoreMatch SYNTAX OMsDir ectoryString X-ORDERED 'VALUES' ) olcAttributeTypes: ( OLcfgDbAt:3.29 NAME 'olcDbKeepalive' DESC 'TCP keepaliv e' SYNTAX OMsDirectoryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgOvAt:3.1 NAME 'olcChainingBehavior' DESC 'Chaining behavior control parameters (draft-sermersheim-ldap-chaining)' SYNTAX OMsD irectoryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgOvAt:3.2 NAME 'olcChainCacheURI' DESC 'Enables cac hing of URIs not present in configuration' SYNTAX OMsBoolean SINGLE-VALUE ) olcAttributeTypes: ( OLcfgOvAt:3.3 NAME 'olcChainMaxReferralDepth' DESC 'max referral depth' EQUALITY integerMatch SYNTAX OMsInteger SINGLE-VALUE ) olcAttributeTypes: ( OLcfgOvAt:3.4 NAME 'olcChainReturnError' DESC 'Errors a re returned instead of the original referral' SYNTAX OMsBoolean SINGLE-VALU E ) olcAttributeTypes: ( OLcfgDbAt:12.3 NAME 'olcDbEnvFlags' DESC 'Database envi ronment flags' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) olcAttributeTypes: ( OLcfgDbAt:12.1 NAME 'olcDbMaxReaders' DESC 'Maximum num ber of threads that may access the DB concurrently' SYNTAX OMsInteger SINGL E-VALUE ) olcAttributeTypes: ( OLcfgDbAt:12.2 NAME 'olcDbMaxSize' DESC 'Maximum size o f DB in bytes' SYNTAX OMsInteger SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:3.101 NAME 'olcDbRewrite' DESC 'DN rewriting rules' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString X-ORDERED 'VALUES ' ) olcAttributeTypes: ( OLcfgDbAt:3.102 NAME 'olcDbMap' DESC 'Map attribute and objectclass names' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString X-OR DERED 'VALUES' ) olcAttributeTypes: ( OLcfgDbAt:3.103 NAME 'olcDbSubtreeExclude' DESC 'DN of subtree to exclude from target' EQUALITY caseIgnoreMatch SYNTAX OMsDirector yString ) olcAttributeTypes: ( OLcfgDbAt:3.104 NAME 'olcDbSubtreeInclude' DESC 'DN of subtree to include in target' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryS tring ) olcAttributeTypes: ( OLcfgDbAt:3.105 NAME 'olcDbDefaultTarget' DESC 'Specify the default target' SYNTAX OMsDirectoryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:3.106 NAME 'olcDbDnCacheTtl' DESC 'dncache tt l' SYNTAX OMsDirectoryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:3.107 NAME 'olcDbBindTimeout' DESC 'bind time out' SYNTAX OMsDirectoryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:3.109 NAME 'olcDbPseudoRootBindDefer' DESC 'e rror handling' SYNTAX OMsBoolean SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:3.110 NAME 'olcDbNretries' DESC 'retry handli ng' SYNTAX OMsDirectoryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:3.111 NAME 'olcDbClientPr' DESC 'PagedResults handling' SYNTAX OMsDirectoryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:3.100 NAME 'olcMetaSub' DESC 'Placeholder to name a Target entry' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString SIN GLE-VALUE X-ORDERED 'SIBLINGS' ) olcAttributeTypes: ( OLcfgDbAt:3.112 NAME 'olcDbFilter' DESC 'Filter regex p attern to include in target' EQUALITY caseExactMatch SYNTAX OMsDirectoryStr ing ) olcAttributeTypes: ( OLcfgDbAt:8.1 NAME 'olcDbBindAllowed' DESC 'Allow binds to this database' SYNTAX OMsBoolean SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:9.1 NAME 'olcPasswdFile' DESC 'File containin g passwd records' EQUALITY caseExactMatch SYNTAX OMsDirectoryString SINGLE- VALUE ) olcAttributeTypes: ( OLcfgDbAt:5.1 NAME 'olcRelay' DESC 'Relay DN' SYNTAX OM sDN SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:10.1 NAME 'olcShellBind' DESC 'Bind command a nd arguments' EQUALITY caseExactMatch SYNTAX OMsDirectoryString SINGLE-VALU E ) olcAttributeTypes: ( OLcfgDbAt:10.2 NAME 'olcShellUnbind' DESC 'Unbind comma nd and arguments' EQUALITY caseExactMatch SYNTAX OMsDirectoryString SINGLE- VALUE ) olcAttributeTypes: ( OLcfgDbAt:10.3 NAME 'olcShellSearch' DESC 'Search comma nd and arguments' EQUALITY caseExactMatch SYNTAX OMsDirectoryString SINGLE- VALUE ) olcAttributeTypes: ( OLcfgDbAt:10.4 NAME 'olcShellCompare' DESC 'Compare com mand and arguments' EQUALITY caseExactMatch SYNTAX OMsDirectoryString SINGL E-VALUE ) olcAttributeTypes: ( OLcfgDbAt:10.5 NAME 'olcShellModify' DESC 'Modify comma nd and arguments' EQUALITY caseExactMatch SYNTAX OMsDirectoryString SINGLE- VALUE ) olcAttributeTypes: ( OLcfgDbAt:10.6 NAME 'olcShellModRDN' DESC 'ModRDN comma nd and arguments' EQUALITY caseExactMatch SYNTAX OMsDirectoryString SINGLE- VALUE ) olcAttributeTypes: ( OLcfgDbAt:10.7 NAME 'olcShellAdd' DESC 'Add command and arguments' EQUALITY caseExactMatch SYNTAX OMsDirectoryString SINGLE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:10.8 NAME 'olcShellDelete' DESC 'Delete comma nd and arguments' EQUALITY caseExactMatch SYNTAX OMsDirectoryString SINGLE- VALUE ) olcAttributeTypes: ( OLcfgDbAt:7.3 NAME 'olcOvSocketOps' DESC 'Operation typ es to forward' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) olcAttributeTypes: ( OLcfgDbAt:7.4 NAME 'olcOvSocketResps' DESC 'Response ty pes to forward' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) olcAttributeTypes: ( OLcfgDbAt:7.1 NAME 'olcDbSocketPath' DESC 'Pathname for Unix domain socket' EQUALITY caseExactMatch SYNTAX OMsDirectoryString SING LE-VALUE ) olcAttributeTypes: ( OLcfgDbAt:7.2 NAME 'olcDbSocketExtensions' DESC 'binddn , peername, or ssf' EQUALITY caseIgnoreMatch SYNTAX OMsDirectoryString ) olcAttributeTypes: ( OLcfgOvAt:1.1 NAME 'olcSpCheckpoint' DESC 'ContextCSN c heckpoint interval in ops and minutes' SYNTAX OMsDirectoryString SINGLE-VAL UE ) olcAttributeTypes: ( OLcfgOvAt:1.2 NAME 'olcSpSessionlog' DESC 'Session log size in ops' SYNTAX OMsInteger SINGLE-VALUE ) olcAttributeTypes: ( OLcfgOvAt:1.3 NAME 'olcSpNoPresent' DESC 'Omit Present phase processing' SYNTAX OMsBoolean SINGLE-VALUE ) olcAttributeTypes: ( OLcfgOvAt:1.4 NAME 'olcSpReloadHint' DESC 'Observe Relo ad Hint in Request control' SYNTAX OMsBoolean SINGLE-VALUE ) olcAttributeTypes: ( OLcfgOvAt:15.1 NAME 'olcAuditlogFile' DESC 'Filename fo r auditlogging' SYNTAX OMsDirectoryString ) olcAttributeTypes: ( olmDatabaseAttributes:1 NAME 'olmDbDirectory' DESC 'Pat h name of the directory where the database environment resides' SUP monitor edInfo NO-USER-MODIFICATION USAGE dSAOperation ) olcObjectClasses: ( 2.5.6.0 NAME 'top' DESC 'top of the superclass chain' AB STRACT MUST objectClass ) olcObjectClasses: ( 1.3.6.1.4.1.1466.101.120.111 NAME 'extensibleObject' DES C 'RFC4512: extensible object' SUP top AUXILIARY ) olcObjectClasses: ( 2.5.6.1 NAME 'alias' DESC 'RFC4512: an alias' SUP top ST RUCTURAL MUST aliasedObjectName ) olcObjectClasses: ( 2.16.840.1.113730.3.2.6 NAME 'referral' DESC 'namedref: named subordinate referral' SUP top STRUCTURAL MUST ref ) olcObjectClasses: ( 1.3.6.1.4.1.4203.1.4.1 NAME ( 'OpenLDAProotDSE' 'LDAProo tDSE' ) DESC 'OpenLDAP Root DSE object' SUP top STRUCTURAL MAY cn ) olcObjectClasses: ( 2.5.17.0 NAME 'subentry' DESC 'RFC3672: subentry' SUP to p STRUCTURAL MUST ( cn $ subtreeSpecification ) ) olcObjectClasses: ( 2.5.20.1 NAME 'subschema' DESC 'RFC4512: controlling sub schema (sub)entry' AUXILIARY MAY ( dITStructureRules $ nameForms $ dITConte ntRules $ objectClasses $ attributeTypes $ matchingRules $ matchingRuleUse ) ) olcObjectClasses: ( 1.3.6.1.4.1.1466.101.119.2 NAME 'dynamicObject' DESC 'RF C2589: Dynamic Object' SUP top AUXILIARY ) olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.4 NAME 'glue' DESC 'Glue Entry' S UP top STRUCTURAL ) olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.5 NAME 'syncConsumerSubentry' DES C 'Persistent Info for SyncRepl Consumer' AUXILIARY MAY syncreplCookie ) olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.6 NAME 'syncProviderSubentry' DES C 'Persistent Info for SyncRepl Producer' AUXILIARY MAY contextCSN ) olcObjectClasses: ( OLcfgGlOc:0 NAME 'olcConfig' DESC 'OpenLDAP configuratio n object' SUP top ABSTRACT ) olcObjectClasses: ( OLcfgGlOc:1 NAME 'olcGlobal' DESC 'OpenLDAP Global confi guration options' SUP olcConfig STRUCTURAL MAY ( cn $ olcConfigFile $ olcCo nfigDir $ olcAllows $ olcArgsFile $ olcAttributeOptions $ olcAuthIDRewrite $ olcAuthzPolicy $ olcAuthzRegexp $ olcConcurrency $ olcConnMaxPending $ ol cConnMaxPendingAuth $ olcDisallows $ olcGentleHUP $ olcIdleTimeout $ olcInd exSubstrIfMaxLen $ olcIndexSubstrIfMinLen $ olcIndexSubstrAnyLen $ olcIndex SubstrAnyStep $ olcIndexIntLen $ olcListenerThreads $ olcLocalSSF $ olcLogF ile $ olcLogLevel $ olcPasswordCryptSaltFormat $ olcPasswordHash $ olcPidFi le $ olcPluginLogFile $ olcReadOnly $ olcReferral $ olcReplogFile $ olcRequ ires $ olcRestrict $ olcReverseLookup $ olcRootDSE $ olcSaslAuxprops $ olcS aslHost $ olcSaslRealm $ olcSaslSecProps $ olcSecurity $ olcServerID $ olcS izeLimit $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcTCPBuffer $ olcThreads $ olcTimeLimit $ olcTLSCACertificateFile $ olcTLSCACertificat ePath $ olcTLSCertificateFile $ olcTLSCertificateKeyFile $ olcTLSCipherSuit e $ olcTLSCRLCheck $ olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFil e $ olcTLSCRLFile $ olcTLSProtocolMin $ olcToolThreads $ olcWriteTimeout $ olcObjectIdentifier $ olcAttributeTypes $ olcObjectClasses $ olcDitContentR ules $ olcLdapSyntaxes ) ) olcObjectClasses: ( OLcfgGlOc:2 NAME 'olcSchemaConfig' DESC 'OpenLDAP schema object' SUP olcConfig STRUCTURAL MAY ( cn $ olcObjectIdentifier $ olcLdapS yntaxes $ olcAttributeTypes $ olcObjectClasses $ olcDitContentRules ) ) olcObjectClasses: ( OLcfgGlOc:3 NAME 'olcBackendConfig' DESC 'OpenLDAP Backe nd-specific options' SUP olcConfig STRUCTURAL MUST olcBackend ) olcObjectClasses: ( OLcfgGlOc:4 NAME 'olcDatabaseConfig' DESC 'OpenLDAP Data base-specific options' SUP olcConfig STRUCTURAL MUST olcDatabase MAY ( olcH idden $ olcSuffix $ olcSubordinate $ olcAccess $ olcAddContentAcl $ olcLast Mod $ olcLimits $ olcMaxDerefDepth $ olcPlugin $ olcReadOnly $ olcReplica $ olcReplicaArgsFile $ olcReplicaPidFile $ olcReplicationInterval $ olcReplo gFile $ olcRequires $ olcRestrict $ olcRootDN $ olcRootPW $ olcSchemaDN $ o lcSecurity $ olcSizeLimit $ olcSyncUseSubentry $ olcSyncrepl $ olcTimeLimit $ olcUpdateDN $ olcUpdateRef $ olcMirrorMode $ olcMonitoring $ olcExtraAtt rs ) ) olcObjectClasses: ( OLcfgGlOc:5 NAME 'olcOverlayConfig' DESC 'OpenLDAP Overl ay-specific options' SUP olcConfig STRUCTURAL MUST olcOverlay ) olcObjectClasses: ( OLcfgGlOc:6 NAME 'olcIncludeFile' DESC 'OpenLDAP configu ration include file' SUP olcConfig STRUCTURAL MUST olcInclude MAY ( cn $ ol cRootDSE ) ) olcObjectClasses: ( OLcfgGlOc:7 NAME 'olcFrontendConfig' DESC 'OpenLDAP fron tend configuration' AUXILIARY MAY ( olcDefaultSearchBase $ olcPasswordHash $ olcSortVals ) ) olcObjectClasses: ( OLcfgGlOc:8 NAME 'olcModuleList' DESC 'OpenLDAP dynamic module info' SUP olcConfig STRUCTURAL MAY ( cn $ olcModulePath $ olcModuleL oad ) ) olcObjectClasses: ( OLcfgDbOc:2.1 NAME 'olcLdifConfig' DESC 'LDIF backend co nfiguration' SUP olcDatabaseConfig STRUCTURAL MUST olcDbDirectory ) olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.16.1 NAME 'monitor' DESC 'OpenLDA P system monitoring' SUP top STRUCTURAL MUST cn MAY ( description $ seeAlso $ labeledURI $ monitoredInfo $ managedInfo $ monitorOverlay ) ) olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.16.2 NAME 'monitorServer' DESC 'S erver monitoring root entry' SUP monitor STRUCTURAL ) olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.16.3 NAME 'monitorContainer' DESC 'monitor container class' SUP monitor STRUCTURAL ) olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.16.4 NAME 'monitorCounterObject' DESC 'monitor counter class' SUP monitor STRUCTURAL ) olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.16.5 NAME 'monitorOperation' DESC 'monitor operation class' SUP monitor STRUCTURAL ) olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.16.6 NAME 'monitorConnection' DES C 'monitor connection class' SUP monitor STRUCTURAL ) olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.16.7 NAME 'managedObject' DESC 'm onitor managed entity class' SUP monitor STRUCTURAL ) olcObjectClasses: ( 1.3.6.1.4.1.4203.666.3.16.8 NAME 'monitoredObject' DESC 'monitor monitored entity class' SUP monitor STRUCTURAL ) olcObjectClasses: ( OLcfgDbOc:4.1 NAME 'olcMonitorConfig' DESC 'Monitor back end configuration' SUP olcDatabaseConfig STRUCTURAL ) olcObjectClasses: ( OLcfgDbOc:1.1 NAME 'olcBdbConfig' DESC 'BDB backend conf iguration' SUP olcDatabaseConfig STRUCTURAL MUST olcDbDirectory MAY ( olcDb CacheSize $ olcDbCheckpoint $ olcDbConfig $ olcDbCryptFile $ olcDbCryptKey $ olcDbNoSync $ olcDbDirtyRead $ olcDbIDLcacheSize $ olcDbIndex $ olcDbLine arIndex $ olcDbLockDetect $ olcDbMode $ olcDbSearchStack $ olcDbShmKey $ ol cDbCacheFree $ olcDbDNcacheSize $ olcDbPageSize ) ) olcObjectClasses: ( OLcfgDbOc:1.2 NAME 'olcHdbConfig' DESC 'HDB backend conf iguration' SUP olcDatabaseConfig STRUCTURAL MUST olcDbDirectory MAY ( olcDb CacheSize $ olcDbCheckpoint $ olcDbConfig $ olcDbCryptFile $ olcDbCryptKey $ olcDbNoSync $ olcDbDirtyRead $ olcDbIDLcacheSize $ olcDbIndex $ olcDbLine arIndex $ olcDbLockDetect $ olcDbMode $ olcDbSearchStack $ olcDbShmKey $ ol cDbCacheFree $ olcDbDNcacheSize $ olcDbPageSize ) ) olcObjectClasses: ( OLcfgDbOc:3.1 NAME 'olcLDAPConfig' DESC 'LDAP backend co nfiguration' SUP olcDatabaseConfig STRUCTURAL MAY ( olcDbURI $ olcDbStartTL S $ olcDbACLAuthcDn $ olcDbACLPasswd $ olcDbACLBind $ olcDbIDAssertAuthcDn $ olcDbIDAssertPasswd $ olcDbIDAssertBind $ olcDbIDAssertMode $ olcDbIDAsse rtAuthzFrom $ olcDbIDAssertPassThru $ olcDbRebindAsUser $ olcDbChaseReferra ls $ olcDbTFSupport $ olcDbProxyWhoAmI $ olcDbTimeout $ olcDbIdleTimeout $ olcDbConnTtl $ olcDbNetworkTimeout $ olcDbProtocolVersion $ olcDbSingleConn $ olcDbCancel $ olcDbQuarantine $ olcDbUseTemporaryConn $ olcDbConnectionP oolMax $ olcDbSessionTrackingRequest $ olcDbNoRefs $ olcDbNoUndefFilter $ o lcDbOnErr $ olcDbKeepalive ) ) olcObjectClasses: ( OLcfgOvOc:3.1 NAME 'olcChainConfig' DESC 'Chain configur ation' SUP olcOverlayConfig STRUCTURAL MAY ( olcChainingBehavior $ olcChain CacheURI $ olcChainMaxReferralDepth $ olcChainReturnError ) ) olcObjectClasses: ( OLcfgOvOc:3.2 NAME 'olcChainDatabase' DESC 'Chain remote server configuration' AUXILIARY ) olcObjectClasses: ( OLcfgOvOc:3.3 NAME 'olcPBindConfig' DESC 'Proxy Bind con figuration' SUP olcOverlayConfig STRUCTURAL MUST olcDbURI MAY ( olcDbStartT LS $ olcDbNetworkTimeout $ olcDbQuarantine ) ) olcObjectClasses: ( OLcfgOvOc:7.1 NAME 'olcDistProcConfig' DESC 'Distributed procedures <draft-sermersheim-ldap-distproc> configuration' SUP olcOverlay Config STRUCTURAL MAY ( olcChainingBehavior $ olcChainCacheURI ) ) olcObjectClasses: ( OLcfgOvOc:7.2 NAME 'olcDistProcDatabase' DESC 'Distribut ed procedure remote server configuration' AUXILIARY ) olcObjectClasses: ( OLcfgDbOc:12.1 NAME 'olcMdbConfig' DESC 'MDB backend con figuration' SUP olcDatabaseConfig STRUCTURAL MUST olcDbDirectory MAY ( olcD bCheckpoint $ olcDbEnvFlags $ olcDbNoSync $ olcDbIndex $ olcDbMaxReaders $ olcDbMaxsize $ olcDbMode $ olcDbSearchStack ) ) olcObjectClasses: ( OLcfgDbOc:3.2 NAME 'olcMetaConfig' DESC 'Meta backend co nfiguration' SUP olcDatabaseConfig STRUCTURAL MAY ( olcDbConnTtl $ olcDbDnC acheTtl $ olcDbIdleTimeout $ olcDbOnErr $ olcDbPseudoRootBindDefer $ olcDbS ingleConn $ olcDbUseTemporaryConn $ olcDbConnectionPoolMax $ olcDbBindTimeo ut $ olcDbCancel $ olcDbChaseReferrals $ olcDbClientPr $ olcDbDefaultTarget $ olcDbNetworkTimeout $ olcDbNoRefs $ olcDbNoUndefFilter $ olcDbNretries $ olcDbProtocolVersion $ olcDbQuarantine $ olcDbRebindAsUser $ olcDbSessionT rackingRequest $ olcDbStartTLS $ olcDbTFSupport ) ) olcObjectClasses: ( OLcfgDbOc:3.3 NAME 'olcMetaTargetConfig' DESC 'Meta targ et configuration' SUP olcConfig STRUCTURAL MUST ( olcMetaSub $ olcDbURI ) M AY ( olcDbACLAuthcDn $ olcDbACLPasswd $ olcDbIDAssertAuthzFrom $ olcDbIDAss ertBind $ olcDbMap $ olcDbRewrite $ olcDbSubtreeExclude $ olcDbSubtreeInclu de $ olcDbTimeout $ olcDbKeepalive $ olcDbFilter $ olcDbBindTimeout $ olcDb Cancel $ olcDbChaseReferrals $ olcDbClientPr $ olcDbDefaultTarget $ olcDbNe tworkTimeout $ olcDbNoRefs $ olcDbNoUndefFilter $ olcDbNretries $ olcDbProt ocolVersion $ olcDbQuarantine $ olcDbRebindAsUser $ olcDbSessionTrackingReq uest $ olcDbStartTLS $ olcDbTFSupport ) ) olcObjectClasses: ( OLcfgDbOc:8.1 NAME 'olcNullConfig' DESC 'Null backend oc nfiguration' SUP olcDatabaseConfig STRUCTURAL MAY olcDbBindAllowed ) olcObjectClasses: ( OLcfgDbOc:9.1 NAME 'olcPasswdConfig' DESC 'Passwd backen d configuration' SUP olcDatabaseConfig STRUCTURAL MAY olcPasswdFile ) olcObjectClasses: ( OLcfgDbOc:5.1 NAME 'olcRelayConfig' DESC 'Relay backend configuration' SUP olcDatabaseConfig STRUCTURAL MAY olcRelay ) olcObjectClasses: ( OLcfgDbOc:10.1 NAME 'olcShellConfig' DESC 'Shell backend configuration' SUP olcDatabaseConfig STRUCTURAL MAY ( olcShellBind $ olcSh ellUnbind $ olcShellSearch $ olcShellCompare $ olcShellModify $ olcShellMod RDN $ olcShellAdd $ olcShellDelete ) ) olcObjectClasses: ( OLcfgDbOc:7.1 NAME 'olcDbSocketConfig' DESC 'Socket back end configuration' SUP olcDatabaseConfig STRUCTURAL MUST olcDbSocketPath MA Y olcDbSocketExtensions ) olcObjectClasses: ( OLcfgDbOc:7.2 NAME 'olcOvSocketConfig' DESC 'Socket over lay configuration' SUP olcOverlayConfig STRUCTURAL MUST olcDbSocketPath MAY ( olcDbSocketExtensions $ olcOvSocketOps $ olcOvSocketResps ) ) olcObjectClasses: ( OLcfgOvOc:1.1 NAME 'olcSyncProvConfig' DESC 'SyncRepl Pr ovider configuration' SUP olcOverlayConfig STRUCTURAL MAY ( olcSpCheckpoint $ olcSpSessionlog $ olcSpNoPresent $ olcSpReloadHint ) ) olcObjectClasses: ( OLcfgOvOc:15.1 NAME 'olcAuditlogConfig' DESC 'Auditlog c onfiguration' SUP olcOverlayConfig STRUCTURAL MAY olcAuditlogFile ) olcObjectClasses: ( olmMDBObjectClasses:2 NAME 'olmMDBDatabase' SUP top AUXI LIARY MAY olmDbDirectory ) structuralObjectClass: olcSchemaConfig entryUUID: ba52ce04-097c-1036-94c7-9395bf97badd creatorsName: cn=config createTimestamp: 20160907192632Z entryCSN: 20160907192632.339422Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20160907192632Z dn: cn={0}core,cn=schema,cn=config objectClass: olcSchemaConfig cn: {0}core olcAttributeTypes: {0}( 2.5.4.2 NAME 'knowledgeInformation' DESC 'RFC2256: k nowledge information' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115. 121.1.15{32768} ) olcAttributeTypes: {1}( 2.5.4.4 NAME ( 'sn' 'surname' ) DESC 'RFC2256: last (family) name(s) for which the entity is known by' SUP name ) olcAttributeTypes: {2}( 2.5.4.5 NAME 'serialNumber' DESC 'RFC2256: serial nu mber of the entity' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMat ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.44{64} ) olcAttributeTypes: {3}( 2.5.4.6 NAME ( 'c' 'countryName' ) DESC 'RFC4519: tw o-letter ISO-3166 country code' SUP name SYNTAX 1.3.6.1.4.1.1466.115.121.1. 11 SINGLE-VALUE ) olcAttributeTypes: {4}( 2.5.4.7 NAME ( 'l' 'localityName' ) DESC 'RFC2256: l ocality which this object resides in' SUP name ) olcAttributeTypes: {5}( 2.5.4.8 NAME ( 'st' 'stateOrProvinceName' ) DESC 'RF C2256: state or province which this object resides in' SUP name ) olcAttributeTypes: {6}( 2.5.4.9 NAME ( 'street' 'streetAddress' ) DESC 'RFC2 256: street address of this object' EQUALITY caseIgnoreMatch SUBSTR caseIgn oreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} ) olcAttributeTypes: {7}( 2.5.4.10 NAME ( 'o' 'organizationName' ) DESC 'RFC22 56: organization this object belongs to' SUP name ) olcAttributeTypes: {8}( 2.5.4.11 NAME ( 'ou' 'organizationalUnitName' ) DESC 'RFC2256: organizational unit this object belongs to' SUP name ) olcAttributeTypes: {9}( 2.5.4.12 NAME 'title' DESC 'RFC2256: title associate d with the entity' SUP name ) olcAttributeTypes: {10}( 2.5.4.14 NAME 'searchGuide' DESC 'RFC2256: search g uide, deprecated by enhancedSearchGuide' SYNTAX 1.3.6.1.4.1.1466.115.121.1. 25 ) olcAttributeTypes: {11}( 2.5.4.15 NAME 'businessCategory' DESC 'RFC2256: bus iness category' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch S YNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} ) olcAttributeTypes: {12}( 2.5.4.16 NAME 'postalAddress' DESC 'RFC2256: postal address' EQUALITY caseIgnoreListMatch SUBSTR caseIgnoreListSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.41 ) olcAttributeTypes: {13}( 2.5.4.17 NAME 'postalCode' DESC 'RFC2256: postal co de' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6. 1.4.1.1466.115.121.1.15{40} ) olcAttributeTypes: {14}( 2.5.4.18 NAME 'postOfficeBox' DESC 'RFC2256: Post O ffice Box' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{40} ) olcAttributeTypes: {15}( 2.5.4.19 NAME 'physicalDeliveryOfficeName' DESC 'RF C2256: Physical Delivery Office Name' EQUALITY caseIgnoreMatch SUBSTR caseI gnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} ) olcAttributeTypes: {16}( 2.5.4.20 NAME 'telephoneNumber' DESC 'RFC2256: Tele phone Number' EQUALITY telephoneNumberMatch SUBSTR telephoneNumberSubstring sMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.50{32} ) olcAttributeTypes: {17}( 2.5.4.21 NAME 'telexNumber' DESC 'RFC2256: Telex Nu mber' SYNTAX 1.3.6.1.4.1.1466.115.121.1.52 ) olcAttributeTypes: {18}( 2.5.4.22 NAME 'teletexTerminalIdentifier' DESC 'RFC 2256: Teletex Terminal Identifier' SYNTAX 1.3.6.1.4.1.1466.115.121.1.51 ) olcAttributeTypes: {19}( 2.5.4.23 NAME ( 'facsimileTelephoneNumber' 'fax' ) DESC 'RFC2256: Facsimile (Fax) Telephone Number' SYNTAX 1.3.6.1.4.1.1466.11 5.121.1.22 ) olcAttributeTypes: {20}( 2.5.4.24 NAME 'x121Address' DESC 'RFC2256: X.121 Ad dress' EQUALITY numericStringMatch SUBSTR numericStringSubstringsMatch SYNT AX 1.3.6.1.4.1.1466.115.121.1.36{15} ) olcAttributeTypes: {21}( 2.5.4.25 NAME 'internationaliSDNNumber' DESC 'RFC22 56: international ISDN number' EQUALITY numericStringMatch SUBSTR numericSt ringSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.36{16} ) olcAttributeTypes: {22}( 2.5.4.26 NAME 'registeredAddress' DESC 'RFC2256: re gistered postal address' SUP postalAddress SYNTAX 1.3.6.1.4.1.1466.115.121. 1.41 ) olcAttributeTypes: {23}( 2.5.4.27 NAME 'destinationIndicator' DESC 'RFC2256: destination indicator' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstring sMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.44{128} ) olcAttributeTypes: {24}( 2.5.4.28 NAME 'preferredDeliveryMethod' DESC 'RFC22 56: preferred delivery method' SYNTAX 1.3.6.1.4.1.1466.115.121.1.14 SINGLE- VALUE ) olcAttributeTypes: {25}( 2.5.4.29 NAME 'presentationAddress' DESC 'RFC2256: presentation address' EQUALITY presentationAddressMatch SYNTAX 1.3.6.1.4.1. 1466.115.121.1.43 SINGLE-VALUE ) olcAttributeTypes: {26}( 2.5.4.30 NAME 'supportedApplicationContext' DESC 'R FC2256: supported application context' EQUALITY objectIdentifierMatch SYNTA X 1.3.6.1.4.1.1466.115.121.1.38 ) olcAttributeTypes: {27}( 2.5.4.31 NAME 'member' DESC 'RFC2256: member of a g roup' SUP distinguishedName ) olcAttributeTypes: {28}( 2.5.4.32 NAME 'owner' DESC 'RFC2256: owner (of the object)' SUP distinguishedName ) olcAttributeTypes: {29}( 2.5.4.33 NAME 'roleOccupant' DESC 'RFC2256: occupan t of role' SUP distinguishedName ) olcAttributeTypes: {30}( 2.5.4.36 NAME 'userCertificate' DESC 'RFC2256: X.50 9 user certificate, use ;binary' EQUALITY certificateExactMatch SYNTAX 1.3. 6.1.4.1.1466.115.121.1.8 ) olcAttributeTypes: {31}( 2.5.4.37 NAME 'cACertificate' DESC 'RFC2256: X.509 CA certificate, use ;binary' EQUALITY certificateExactMatch SYNTAX 1.3.6.1. 4.1.1466.115.121.1.8 ) olcAttributeTypes: {32}( 2.5.4.38 NAME 'authorityRevocationList' DESC 'RFC22 56: X.509 authority revocation list, use ;binary' SYNTAX 1.3.6.1.4.1.1466.1 15.121.1.9 ) olcAttributeTypes: {33}( 2.5.4.39 NAME 'certificateRevocationList' DESC 'RFC 2256: X.509 certificate revocation list, use ;binary' SYNTAX 1.3.6.1.4.1.14 66.115.121.1.9 ) olcAttributeTypes: {34}( 2.5.4.40 NAME 'crossCertificatePair' DESC 'RFC2256: X.509 cross certificate pair, use ;binary' SYNTAX 1.3.6.1.4.1.1466.115.121 .1.10 ) olcAttributeTypes: {35}( 2.5.4.42 NAME ( 'givenName' 'gn' ) DESC 'RFC2256: f irst name(s) for which the entity is known by' SUP name ) olcAttributeTypes: {36}( 2.5.4.43 NAME 'initials' DESC 'RFC2256: initials of some or all of names, but not the surname(s).' SUP name ) olcAttributeTypes: {37}( 2.5.4.44 NAME 'generationQualifier' DESC 'RFC2256: name qualifier indicating a generation' SUP name ) olcAttributeTypes: {38}( 2.5.4.45 NAME 'x500UniqueIdentifier' DESC 'RFC2256: X.500 unique identifier' EQUALITY bitStringMatch SYNTAX 1.3.6.1.4.1.1466.1 15.121.1.6 ) olcAttributeTypes: {39}( 2.5.4.46 NAME 'dnQualifier' DESC 'RFC2256: DN quali fier' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR case IgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.44 ) olcAttributeTypes: {40}( 2.5.4.47 NAME 'enhancedSearchGuide' DESC 'RFC2256: enhanced search guide' SYNTAX 1.3.6.1.4.1.1466.115.121.1.21 ) olcAttributeTypes: {41}( 2.5.4.48 NAME 'protocolInformation' DESC 'RFC2256: protocol information' EQUALITY protocolInformationMatch SYNTAX 1.3.6.1.4.1. 1466.115.121.1.42 ) olcAttributeTypes: {42}( 2.5.4.50 NAME 'uniqueMember' DESC 'RFC2256: unique member of a group' EQUALITY uniqueMemberMatch SYNTAX 1.3.6.1.4.1.1466.115.1 21.1.34 ) olcAttributeTypes: {43}( 2.5.4.51 NAME 'houseIdentifier' DESC 'RFC2256: hous e identifier' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYN TAX 1.3.6.1.4.1.1466.115.121.1.15{32768} ) olcAttributeTypes: {44}( 2.5.4.52 NAME 'supportedAlgorithms' DESC 'RFC2256: supported algorithms' SYNTAX 1.3.6.1.4.1.1466.115.121.1.49 ) olcAttributeTypes: {45}( 2.5.4.53 NAME 'deltaRevocationList' DESC 'RFC2256: delta revocation list; use ;binary' SYNTAX 1.3.6.1.4.1.1466.115.121.1.9 ) olcAttributeTypes: {46}( 2.5.4.54 NAME 'dmdName' DESC 'RFC2256: name of DMD' SUP name ) olcAttributeTypes: {47}( 2.5.4.65 NAME 'pseudonym' DESC 'X.520(4th): pseudon ym for the object' SUP name ) olcAttributeTypes: {48}( 0.9.2342.19200300.100.1.3 NAME ( 'mail' 'rfc822Mail box' ) DESC 'RFC1274: RFC822 Mailbox' EQUALITY caseIgnoreIA5Match SUBSTR ca seIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} ) olcAttributeTypes: {49}( 0.9.2342.19200300.100.1.25 NAME ( 'dc' 'domainCompo nent' ) DESC 'RFC1274/2247: domain component' EQUALITY caseIgnoreIA5Match S UBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SIN GLE-VALUE ) olcAttributeTypes: {50}( 0.9.2342.19200300.100.1.37 NAME 'associatedDomain' DESC 'RFC1274: domain associated with object' EQUALITY caseIgnoreIA5Match S UBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {51}( 1.2.840.113549.1.9.1 NAME ( 'email' 'emailAddress' 'pkcs9email' ) DESC 'RFC3280: legacy attribute for email addresses in DNs' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3. 6.1.4.1.1466.115.121.1.26{128} ) olcObjectClasses: {0}( 2.5.6.2 NAME 'country' DESC 'RFC2256: a country' SUP top STRUCTURAL MUST c MAY ( searchGuide $ description ) ) olcObjectClasses: {1}( 2.5.6.3 NAME 'locality' DESC 'RFC2256: a locality' SU P top STRUCTURAL MAY ( street $ seeAlso $ searchGuide $ st $ l $ descriptio n ) ) olcObjectClasses: {2}( 2.5.6.4 NAME 'organization' DESC 'RFC2256: an organiz ation' SUP top STRUCTURAL MUST o MAY ( userPassword $ searchGuide $ seeAlso $ businessCategory $ x121Address $ registeredAddress $ destinationIndicato r $ preferredDeliveryMethod $ telexNumber $ teletexTerminalIdentifier $ tel ephoneNumber $ internationaliSDNNumber $ facsimileTelephoneNumber $ street $ postOfficeBox $ postalCode $ postalAddress $ physicalDeliveryOfficeName $ st $ l $ description ) ) olcObjectClasses: {3}( 2.5.6.5 NAME 'organizationalUnit' DESC 'RFC2256: an o rganizational unit' SUP top STRUCTURAL MUST ou MAY ( userPassword $ searchG uide $ seeAlso $ businessCategory $ x121Address $ registeredAddress $ desti nationIndicator $ preferredDeliveryMethod $ telexNumber $ teletexTerminalId entifier $ telephoneNumber $ internationaliSDNNumber $ facsimileTelephoneNu mber $ street $ postOfficeBox $ postalCode $ postalAddress $ physicalDelive ryOfficeName $ st $ l $ description ) ) olcObjectClasses: {4}( 2.5.6.6 NAME 'person' DESC 'RFC2256: a person' SUP to p STRUCTURAL MUST ( sn $ cn ) MAY ( userPassword $ telephoneNumber $ seeAls o $ description ) ) olcObjectClasses: {5}( 2.5.6.7 NAME 'organizationalPerson' DESC 'RFC2256: an organizational person' SUP person STRUCTURAL MAY ( title $ x121Address $ r egisteredAddress $ destinationIndicator $ preferredDeliveryMethod $ telexNu mber $ teletexTerminalIdentifier $ telephoneNumber $ internationaliSDNNumbe r $ facsimileTelephoneNumber $ street $ postOfficeBox $ postalCode $ postal Address $ physicalDeliveryOfficeName $ ou $ st $ l ) ) olcObjectClasses: {6}( 2.5.6.8 NAME 'organizationalRole' DESC 'RFC2256: an o rganizational role' SUP top STRUCTURAL MUST cn MAY ( x121Address $ register edAddress $ destinationIndicator $ preferredDeliveryMethod $ telexNumber $ teletexTerminalIdentifier $ telephoneNumber $ internationaliSDNNumber $ fac simileTelephoneNumber $ seeAlso $ roleOccupant $ preferredDeliveryMethod $ street $ postOfficeBox $ postalCode $ postalAddress $ physicalDeliveryOffic eName $ ou $ st $ l $ description ) ) olcObjectClasses: {7}( 2.5.6.9 NAME 'groupOfNames' DESC 'RFC2256: a group of names (DNs)' SUP top STRUCTURAL MUST ( member $ cn ) MAY ( businessCategor y $ seeAlso $ owner $ ou $ o $ description ) ) olcObjectClasses: {8}( 2.5.6.10 NAME 'residentialPerson' DESC 'RFC2256: an r esidential person' SUP person STRUCTURAL MUST l MAY ( businessCategory $ x1 21Address $ registeredAddress $ destinationIndicator $ preferredDeliveryMet hod $ telexNumber $ teletexTerminalIdentifier $ telephoneNumber $ internati onaliSDNNumber $ facsimileTelephoneNumber $ preferredDeliveryMethod $ stree t $ postOfficeBox $ postalCode $ postalAddress $ physicalDeliveryOfficeName $ st $ l ) ) olcObjectClasses: {9}( 2.5.6.11 NAME 'applicationProcess' DESC 'RFC2256: an application process' SUP top STRUCTURAL MUST cn MAY ( seeAlso $ ou $ l $ de scription ) ) olcObjectClasses: {10}( 2.5.6.12 NAME 'applicationEntity' DESC 'RFC2256: an application entity' SUP top STRUCTURAL MUST ( presentationAddress $ cn ) MA Y ( supportedApplicationContext $ seeAlso $ ou $ o $ l $ description ) ) olcObjectClasses: {11}( 2.5.6.13 NAME 'dSA' DESC 'RFC2256: a directory syste m agent (a server)' SUP applicationEntity STRUCTURAL MAY knowledgeInformati on ) olcObjectClasses: {12}( 2.5.6.14 NAME 'device' DESC 'RFC2256: a device' SUP top STRUCTURAL MUST cn MAY ( serialNumber $ seeAlso $ owner $ ou $ o $ l $ description ) ) olcObjectClasses: {13}( 2.5.6.15 NAME 'strongAuthenticationUser' DESC 'RFC22 56: a strong authentication user' SUP top AUXILIARY MUST userCertificate ) olcObjectClasses: {14}( 2.5.6.16 NAME 'certificationAuthority' DESC 'RFC2256 : a certificate authority' SUP top AUXILIARY MUST ( authorityRevocationList $ certificateRevocationList $ cACertificate ) MAY crossCertificatePair ) olcObjectClasses: {15}( 2.5.6.17 NAME 'groupOfUniqueNames' DESC 'RFC2256: a group of unique names (DN and Unique Identifier)' SUP top STRUCTURAL MUST ( uniqueMember $ cn ) MAY ( businessCategory $ seeAlso $ owner $ ou $ o $ de scription ) ) olcObjectClasses: {16}( 2.5.6.18 NAME 'userSecurityInformation' DESC 'RFC225 6: a user security information' SUP top AUXILIARY MAY supportedAlgorithms ) olcObjectClasses: {17}( 2.5.6.16.2 NAME 'certificationAuthority-V2' SUP cert ificationAuthority AUXILIARY MAY deltaRevocationList ) olcObjectClasses: {18}( 2.5.6.19 NAME 'cRLDistributionPoint' SUP top STRUCTU RAL MUST cn MAY ( certificateRevocationList $ authorityRevocationList $ del taRevocationList ) ) olcObjectClasses: {19}( 2.5.6.20 NAME 'dmd' SUP top STRUCTURAL MUST dmdName MAY ( userPassword $ searchGuide $ seeAlso $ businessCategory $ x121Address $ registeredAddress $ destinationIndicator $ preferredDeliveryMethod $ tel exNumber $ teletexTerminalIdentifier $ telephoneNumber $ internationaliSDNN umber $ facsimileTelephoneNumber $ street $ postOfficeBox $ postalCode $ po stalAddress $ physicalDeliveryOfficeName $ st $ l $ description ) ) olcObjectClasses: {20}( 2.5.6.21 NAME 'pkiUser' DESC 'RFC2587: a PKI user' S UP top AUXILIARY MAY userCertificate ) olcObjectClasses: {21}( 2.5.6.22 NAME 'pkiCA' DESC 'RFC2587: PKI certificate authority' SUP top AUXILIARY MAY ( authorityRevocationList $ certificateRe vocationList $ cACertificate $ crossCertificatePair ) ) olcObjectClasses: {22}( 2.5.6.23 NAME 'deltaCRL' DESC 'RFC2587: PKI user' SU P top AUXILIARY MAY deltaRevocationList ) olcObjectClasses: {23}( 1.3.6.1.4.1.250.3.15 NAME 'labeledURIObject' DESC 'R FC2079: object that contains the URI attribute type' SUP top AUXILIARY MAY labeledURI ) olcObjectClasses: {24}( 0.9.2342.19200300.100.4.19 NAME 'simpleSecurityObjec t' DESC 'RFC1274: simple security object' SUP top AUXILIARY MUST userPasswo rd ) olcObjectClasses: {25}( 1.3.6.1.4.1.1466.344 NAME 'dcObject' DESC 'RFC2247: domain component object' SUP top AUXILIARY MUST dc ) olcObjectClasses: {26}( 1.3.6.1.1.3.1 NAME 'uidObject' DESC 'RFC2377: uid ob ject' SUP top AUXILIARY MUST uid ) structuralObjectClass: olcSchemaConfig entryUUID: ba560b0a-097c-1036-94c8-9395bf97badd creatorsName: cn=config createTimestamp: 20160907192632Z entryCSN: 20160907192632.339422Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20160907192632Z dn: cn={1}cosine,cn=schema,cn=config objectClass: olcSchemaConfig cn: {1}cosine olcAttributeTypes: {0}( 0.9.2342.19200300.100.1.2 NAME 'textEncodedORAddress ' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1. 4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {1}( 0.9.2342.19200300.100.1.4 NAME 'info' DESC 'RFC1274: general information' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsM atch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{2048} ) olcAttributeTypes: {2}( 0.9.2342.19200300.100.1.5 NAME ( 'drink' 'favouriteD rink' ) DESC 'RFC1274: favorite drink' EQUALITY caseIgnoreMatch SUBSTR case IgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {3}( 0.9.2342.19200300.100.1.6 NAME 'roomNumber' DESC 'RF C1274: room number' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMat ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {4}( 0.9.2342.19200300.100.1.7 NAME 'photo' DESC 'RFC1274 : photo (G3 fax)' SYNTAX 1.3.6.1.4.1.1466.115.121.1.23{25000} ) olcAttributeTypes: {5}( 0.9.2342.19200300.100.1.8 NAME 'userClass' DESC 'RFC 1274: category of user' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstring sMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {6}( 0.9.2342.19200300.100.1.9 NAME 'host' DESC 'RFC1274: host computer' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch S YNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {7}( 0.9.2342.19200300.100.1.10 NAME 'manager' DESC 'RFC1 274: DN of manager' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466 .115.121.1.12 ) olcAttributeTypes: {8}( 0.9.2342.19200300.100.1.11 NAME 'documentIdentifier' DESC 'RFC1274: unique identifier of document' EQUALITY caseIgnoreMatch SUB STR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {9}( 0.9.2342.19200300.100.1.12 NAME 'documentTitle' DESC 'RFC1274: title of document' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSub stringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {10}( 0.9.2342.19200300.100.1.13 NAME 'documentVersion' D ESC 'RFC1274: version of document' EQUALITY caseIgnoreMatch SUBSTR caseIgno reSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {11}( 0.9.2342.19200300.100.1.14 NAME 'documentAuthor' DE SC 'RFC1274: DN of author of document' EQUALITY distinguishedNameMatch SYNT AX 1.3.6.1.4.1.1466.115.121.1.12 ) olcAttributeTypes: {12}( 0.9.2342.19200300.100.1.15 NAME 'documentLocation' DESC 'RFC1274: location of document original' EQUALITY caseIgnoreMatch SUBS TR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {13}( 0.9.2342.19200300.100.1.20 NAME ( 'homePhone' 'home TelephoneNumber' ) DESC 'RFC1274: home telephone number' EQUALITY telephone NumberMatch SUBSTR telephoneNumberSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.1 15.121.1.50 ) olcAttributeTypes: {14}( 0.9.2342.19200300.100.1.21 NAME 'secretary' DESC 'R FC1274: DN of secretary' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1 .1466.115.121.1.12 ) olcAttributeTypes: {15}( 0.9.2342.19200300.100.1.22 NAME 'otherMailbox' SYNT AX 1.3.6.1.4.1.1466.115.121.1.39 ) olcAttributeTypes: {16}( 0.9.2342.19200300.100.1.26 NAME 'aRecord' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {17}( 0.9.2342.19200300.100.1.27 NAME 'mDRecord' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {18}( 0.9.2342.19200300.100.1.28 NAME 'mXRecord' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {19}( 0.9.2342.19200300.100.1.29 NAME 'nSRecord' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {20}( 0.9.2342.19200300.100.1.30 NAME 'sOARecord' EQUALIT Y caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {21}( 0.9.2342.19200300.100.1.31 NAME 'cNAMERecord' EQUAL ITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {22}( 0.9.2342.19200300.100.1.38 NAME 'associatedName' DE SC 'RFC1274: DN of entry associated with domain' EQUALITY distinguishedName Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 ) olcAttributeTypes: {23}( 0.9.2342.19200300.100.1.39 NAME 'homePostalAddress' DESC 'RFC1274: home postal address' EQUALITY caseIgnoreListMatch SUBSTR ca seIgnoreListSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.41 ) olcAttributeTypes: {24}( 0.9.2342.19200300.100.1.40 NAME 'personalTitle' DES C 'RFC1274: personal title' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubst ringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {25}( 0.9.2342.19200300.100.1.41 NAME ( 'mobile' 'mobileT elephoneNumber' ) DESC 'RFC1274: mobile telephone number' EQUALITY telephon eNumberMatch SUBSTR telephoneNumberSubstringsMatch SYNTAX 1.3.6.1.4.1.1466. 115.121.1.50 ) olcAttributeTypes: {26}( 0.9.2342.19200300.100.1.42 NAME ( 'pager' 'pagerTel ephoneNumber' ) DESC 'RFC1274: pager telephone number' EQUALITY telephoneNu mberMatch SUBSTR telephoneNumberSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115 .121.1.50 ) olcAttributeTypes: {27}( 0.9.2342.19200300.100.1.43 NAME ( 'co' 'friendlyCou ntryName' ) DESC 'RFC1274: friendly country name' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {28}( 0.9.2342.19200300.100.1.44 NAME 'uniqueIdentifier' DESC 'RFC1274: unique identifer' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4. 1.1466.115.121.1.15{256} ) olcAttributeTypes: {29}( 0.9.2342.19200300.100.1.45 NAME 'organizationalStat us' DESC 'RFC1274: organizational status' EQUALITY caseIgnoreMatch SUBSTR c aseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {30}( 0.9.2342.19200300.100.1.46 NAME 'janetMailbox' DESC 'RFC1274: Janet mailbox' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5S ubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} ) olcAttributeTypes: {31}( 0.9.2342.19200300.100.1.47 NAME 'mailPreferenceOpti on' DESC 'RFC1274: mail preference option' SYNTAX 1.3.6.1.4.1.1466.115.121. 1.27 ) olcAttributeTypes: {32}( 0.9.2342.19200300.100.1.48 NAME 'buildingName' DESC 'RFC1274: name of building' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubs tringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {33}( 0.9.2342.19200300.100.1.49 NAME 'dSAQuality' DESC ' RFC1274: DSA Quality' SYNTAX 1.3.6.1.4.1.1466.115.121.1.19 SINGLE-VALUE ) olcAttributeTypes: {34}( 0.9.2342.19200300.100.1.50 NAME 'singleLevelQuality ' DESC 'RFC1274: Single Level Quality' SYNTAX 1.3.6.1.4.1.1466.115.121.1.13 SINGLE-VALUE ) olcAttributeTypes: {35}( 0.9.2342.19200300.100.1.51 NAME 'subtreeMinimumQual ity' DESC 'RFC1274: Subtree Mininum Quality' SYNTAX 1.3.6.1.4.1.1466.115.12 1.1.13 SINGLE-VALUE ) olcAttributeTypes: {36}( 0.9.2342.19200300.100.1.52 NAME 'subtreeMaximumQual ity' DESC 'RFC1274: Subtree Maximun Quality' SYNTAX 1.3.6.1.4.1.1466.115.12 1.1.13 SINGLE-VALUE ) olcAttributeTypes: {37}( 0.9.2342.19200300.100.1.53 NAME 'personalSignature' DESC 'RFC1274: Personal Signature (G3 fax)' SYNTAX 1.3.6.1.4.1.1466.115.12 1.1.23 ) olcAttributeTypes: {38}( 0.9.2342.19200300.100.1.54 NAME 'dITRedirect' DESC 'RFC1274: DIT Redirect' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1. 1466.115.121.1.12 ) olcAttributeTypes: {39}( 0.9.2342.19200300.100.1.55 NAME 'audio' DESC 'RFC12 74: audio (u-law)' SYNTAX 1.3.6.1.4.1.1466.115.121.1.4{25000} ) olcAttributeTypes: {40}( 0.9.2342.19200300.100.1.56 NAME 'documentPublisher' DESC 'RFC1274: publisher of document' EQUALITY caseIgnoreMatch SUBSTR case IgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcObjectClasses: {0}( 0.9.2342.19200300.100.4.4 NAME ( 'pilotPerson' 'newPi lotPerson' ) SUP person STRUCTURAL MAY ( userid $ textEncodedORAddress $ rf c822Mailbox $ favouriteDrink $ roomNumber $ userClass $ homeTelephoneNumber $ homePostalAddress $ secretary $ personalTitle $ preferredDeliveryMethod $ businessCategory $ janetMailbox $ otherMailbox $ mobileTelephoneNumber $ pagerTelephoneNumber $ organizationalStatus $ mailPreferenceOption $ person alSignature ) ) olcObjectClasses: {1}( 0.9.2342.19200300.100.4.5 NAME 'account' SUP top STRU CTURAL MUST userid MAY ( description $ seeAlso $ localityName $ organizatio nName $ organizationalUnitName $ host ) ) olcObjectClasses: {2}( 0.9.2342.19200300.100.4.6 NAME 'document' SUP top STR UCTURAL MUST documentIdentifier MAY ( commonName $ description $ seeAlso $ localityName $ organizationName $ organizationalUnitName $ documentTitle $ documentVersion $ documentAuthor $ documentLocation $ documentPublisher ) ) olcObjectClasses: {3}( 0.9.2342.19200300.100.4.7 NAME 'room' SUP top STRUCTU RAL MUST commonName MAY ( roomNumber $ description $ seeAlso $ telephoneNum ber ) ) olcObjectClasses: {4}( 0.9.2342.19200300.100.4.9 NAME 'documentSeries' SUP t op STRUCTURAL MUST commonName MAY ( description $ seeAlso $ telephonenumber $ localityName $ organizationName $ organizationalUnitName ) ) olcObjectClasses: {5}( 0.9.2342.19200300.100.4.13 NAME 'domain' SUP top STRU CTURAL MUST domainComponent MAY ( associatedName $ organizationName $ descr iption $ businessCategory $ seeAlso $ searchGuide $ userPassword $ locality Name $ stateOrProvinceName $ streetAddress $ physicalDeliveryOfficeName $ p ostalAddress $ postalCode $ postOfficeBox $ streetAddress $ facsimileTeleph oneNumber $ internationalISDNNumber $ telephoneNumber $ teletexTerminalIden tifier $ telexNumber $ preferredDeliveryMethod $ destinationIndicator $ reg isteredAddress $ x121Address ) ) olcObjectClasses: {6}( 0.9.2342.19200300.100.4.14 NAME 'RFC822localPart' SUP domain STRUCTURAL MAY ( commonName $ surname $ description $ seeAlso $ tel ephoneNumber $ physicalDeliveryOfficeName $ postalAddress $ postalCode $ po stOfficeBox $ streetAddress $ facsimileTelephoneNumber $ internationalISDNN umber $ telephoneNumber $ teletexTerminalIdentifier $ telexNumber $ preferr edDeliveryMethod $ destinationIndicator $ registeredAddress $ x121Address ) ) olcObjectClasses: {7}( 0.9.2342.19200300.100.4.15 NAME 'dNSDomain' SUP domai n STRUCTURAL MAY ( ARecord $ MDRecord $ MXRecord $ NSRecord $ SOARecord $ C NAMERecord ) ) olcObjectClasses: {8}( 0.9.2342.19200300.100.4.17 NAME 'domainRelatedObject' DESC 'RFC1274: an object related to an domain' SUP top AUXILIARY MUST asso ciatedDomain ) olcObjectClasses: {9}( 0.9.2342.19200300.100.4.18 NAME 'friendlyCountry' SUP country STRUCTURAL MUST friendlyCountryName ) olcObjectClasses: {10}( 0.9.2342.19200300.100.4.20 NAME 'pilotOrganization' SUP ( organization $ organizationalUnit ) STRUCTURAL MAY buildingName ) olcObjectClasses: {11}( 0.9.2342.19200300.100.4.21 NAME 'pilotDSA' SUP dsa S TRUCTURAL MAY dSAQuality ) olcObjectClasses: {12}( 0.9.2342.19200300.100.4.22 NAME 'qualityLabelledData ' SUP top AUXILIARY MUST dsaQuality MAY ( subtreeMinimumQuality $ subtreeMa ximumQuality ) ) structuralObjectClass: olcSchemaConfig entryUUID: ba5ceefc-097c-1036-94c9-9395bf97badd creatorsName: cn=config createTimestamp: 20160907192632Z entryCSN: 20160907192632.339422Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20160907192632Z dn: cn={2}inetorgperson,cn=schema,cn=config objectClass: olcSchemaConfig cn: {2}inetorgperson olcAttributeTypes: {0}( 2.16.840.1.113730.3.1.1 NAME 'carLicense' DESC 'RFC2 798: vehicle license or registration plate' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {1}( 2.16.840.1.113730.3.1.2 NAME 'departmentNumber' DESC 'RFC2798: identifies a department within an organization' EQUALITY caseIgn oreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1 .15 ) olcAttributeTypes: {2}( 2.16.840.1.113730.3.1.241 NAME 'displayName' DESC 'R FC2798: preferred name to be used when displaying entries' EQUALITY caseIgn oreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1 .15 SINGLE-VALUE ) olcAttributeTypes: {3}( 2.16.840.1.113730.3.1.3 NAME 'employeeNumber' DESC ' RFC2798: numerically identifies an employee within an organization' EQUALIT Y caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466. 115.121.1.15 SINGLE-VALUE ) olcAttributeTypes: {4}( 2.16.840.1.113730.3.1.4 NAME 'employeeType' DESC 'RF C2798: type of employment for a person' EQUALITY caseIgnoreMatch SUBSTR cas eIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {5}( 0.9.2342.19200300.100.1.60 NAME 'jpegPhoto' DESC 'RF C2798: a JPEG image' SYNTAX 1.3.6.1.4.1.1466.115.121.1.28 ) olcAttributeTypes: {6}( 2.16.840.1.113730.3.1.39 NAME 'preferredLanguage' DE SC 'RFC2798: preferred written or spoken language for a person' EQUALITY ca seIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115. 121.1.15 SINGLE-VALUE ) olcAttributeTypes: {7}( 2.16.840.1.113730.3.1.40 NAME 'userSMIMECertificate' DESC 'RFC2798: PKCS#7 SignedData used to support S/MIME' SYNTAX 1.3.6.1.4. 1.1466.115.121.1.5 ) olcAttributeTypes: {8}( 2.16.840.1.113730.3.1.216 NAME 'userPKCS12' DESC 'RF C2798: personal identity information, a PKCS #12 PFX' SYNTAX 1.3.6.1.4.1.14 66.115.121.1.5 ) olcObjectClasses: {0}( 2.16.840.1.113730.3.2.2 NAME 'inetOrgPerson' DESC 'RF C2798: Internet Organizational Person' SUP organizationalPerson STRUCTURAL MAY ( audio $ businessCategory $ carLicense $ departmentNumber $ displayNam e $ employeeNumber $ employeeType $ givenName $ homePhone $ homePostalAddre ss $ initials $ jpegPhoto $ labeledURI $ mail $ manager $ mobile $ o $ page r $ photo $ roomNumber $ secretary $ uid $ userCertificate $ x500uniqueIden tifier $ preferredLanguage $ userSMIMECertificate $ userPKCS12 ) ) structuralObjectClass: olcSchemaConfig entryUUID: ba5fa840-097c-1036-94ca-9395bf97badd creatorsName: cn=config createTimestamp: 20160907192632Z entryCSN: 20160907192632.339422Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20160907192632Z dn: cn={3}nis,cn=schema,cn=config objectClass: olcSchemaConfig cn: {3}nis olcAttributeTypes: {0}( 1.3.6.1.1.1.1.2 NAME 'gecos' DESC 'The GECOS field; the common name' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5Substrings Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {1}( 1.3.6.1.1.1.1.3 NAME 'homeDirectory' DESC 'The absol ute path to the home directory' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4 .1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {2}( 1.3.6.1.1.1.1.4 NAME 'loginShell' DESC 'The path to the login shell' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121 .1.26 SINGLE-VALUE ) olcAttributeTypes: {3}( 1.3.6.1.1.1.1.5 NAME 'shadowLastChange' EQUALITY int egerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {4}( 1.3.6.1.1.1.1.6 NAME 'shadowMin' EQUALITY integerMat ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {5}( 1.3.6.1.1.1.1.7 NAME 'shadowMax' EQUALITY integerMat ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {6}( 1.3.6.1.1.1.1.8 NAME 'shadowWarning' EQUALITY intege rMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {7}( 1.3.6.1.1.1.1.9 NAME 'shadowInactive' EQUALITY integ erMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {8}( 1.3.6.1.1.1.1.10 NAME 'shadowExpire' EQUALITY intege rMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {9}( 1.3.6.1.1.1.1.11 NAME 'shadowFlag' EQUALITY integerM atch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {10}( 1.3.6.1.1.1.1.12 NAME 'memberUid' EQUALITY caseExac tIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.12 1.1.26 ) olcAttributeTypes: {11}( 1.3.6.1.1.1.1.13 NAME 'memberNisNetgroup' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.146 6.115.121.1.26 ) olcAttributeTypes: {12}( 1.3.6.1.1.1.1.14 NAME 'nisNetgroupTriple' DESC 'Net group triple' SYNTAX 1.3.6.1.1.1.0.0 ) olcAttributeTypes: {13}( 1.3.6.1.1.1.1.15 NAME 'ipServicePort' EQUALITY inte gerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {14}( 1.3.6.1.1.1.1.16 NAME 'ipServiceProtocol' SUP name ) olcAttributeTypes: {15}( 1.3.6.1.1.1.1.17 NAME 'ipProtocolNumber' EQUALITY i ntegerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {16}( 1.3.6.1.1.1.1.18 NAME 'oncRpcNumber' EQUALITY integ erMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {17}( 1.3.6.1.1.1.1.19 NAME 'ipHostNumber' DESC 'IP addre ss' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128} ) olcAttributeTypes: {18}( 1.3.6.1.1.1.1.20 NAME 'ipNetworkNumber' DESC 'IP ne twork' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128 } SINGLE-VALUE ) olcAttributeTypes: {19}( 1.3.6.1.1.1.1.21 NAME 'ipNetmaskNumber' DESC 'IP ne tmask' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128 } SINGLE-VALUE ) olcAttributeTypes: {20}( 1.3.6.1.1.1.1.22 NAME 'macAddress' DESC 'MAC addres s' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128} ) olcAttributeTypes: {21}( 1.3.6.1.1.1.1.23 NAME 'bootParameter' DESC 'rpc.boo tparamd parameter' SYNTAX 1.3.6.1.1.1.0.1 ) olcAttributeTypes: {22}( 1.3.6.1.1.1.1.24 NAME 'bootFile' DESC 'Boot image n ame' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {23}( 1.3.6.1.1.1.1.26 NAME 'nisMapName' SUP name ) olcAttributeTypes: {24}( 1.3.6.1.1.1.1.27 NAME 'nisMapEntry' EQUALITY caseEx actIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115. 121.1.26{1024} SINGLE-VALUE ) olcObjectClasses: {0}( 1.3.6.1.1.1.2.0 NAME 'posixAccount' DESC 'Abstraction of an account with POSIX attributes' SUP top AUXILIARY MUST ( cn $ uid $ u idNumber $ gidNumber $ homeDirectory ) MAY ( userPassword $ loginShell $ ge cos $ description ) ) olcObjectClasses: {1}( 1.3.6.1.1.1.2.1 NAME 'shadowAccount' DESC 'Additional attributes for shadow passwords' SUP top AUXILIARY MUST uid MAY ( userPass word $ shadowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowIna ctive $ shadowExpire $ shadowFlag $ description ) ) olcObjectClasses: {2}( 1.3.6.1.1.1.2.2 NAME 'posixGroup' DESC 'Abstraction o f a group of accounts' SUP top STRUCTURAL MUST ( cn $ gidNumber ) MAY ( use rPassword $ memberUid $ description ) ) olcObjectClasses: {3}( 1.3.6.1.1.1.2.3 NAME 'ipService' DESC 'Abstraction an Internet Protocol service' SUP top STRUCTURAL MUST ( cn $ ipServicePort $ ipServiceProtocol ) MAY description ) olcObjectClasses: {4}( 1.3.6.1.1.1.2.4 NAME 'ipProtocol' DESC 'Abstraction o f an IP protocol' SUP top STRUCTURAL MUST ( cn $ ipProtocolNumber $ descrip tion ) MAY description ) olcObjectClasses: {5}( 1.3.6.1.1.1.2.5 NAME 'oncRpc' DESC 'Abstraction of an ONC/RPC binding' SUP top STRUCTURAL MUST ( cn $ oncRpcNumber $ description ) MAY description ) olcObjectClasses: {6}( 1.3.6.1.1.1.2.6 NAME 'ipHost' DESC 'Abstraction of a host, an IP device' SUP top AUXILIARY MUST ( cn $ ipHostNumber ) MAY ( l $ description $ manager ) ) olcObjectClasses: {7}( 1.3.6.1.1.1.2.7 NAME 'ipNetwork' DESC 'Abstraction of an IP network' SUP top STRUCTURAL MUST ( cn $ ipNetworkNumber ) MAY ( ipNe tmaskNumber $ l $ description $ manager ) ) olcObjectClasses: {8}( 1.3.6.1.1.1.2.8 NAME 'nisNetgroup' DESC 'Abstraction of a netgroup' SUP top STRUCTURAL MUST cn MAY ( nisNetgroupTriple $ memberN isNetgroup $ description ) ) olcObjectClasses: {9}( 1.3.6.1.1.1.2.9 NAME 'nisMap' DESC 'A generic abstrac tion of a NIS map' SUP top STRUCTURAL MUST nisMapName MAY description ) olcObjectClasses: {10}( 1.3.6.1.1.1.2.10 NAME 'nisObject' DESC 'An entry in a NIS map' SUP top STRUCTURAL MUST ( cn $ nisMapEntry $ nisMapName ) MAY de scription ) olcObjectClasses: {11}( 1.3.6.1.1.1.2.11 NAME 'ieee802Device' DESC 'A device with a MAC address' SUP top AUXILIARY MAY macAddress ) olcObjectClasses: {12}( 1.3.6.1.1.1.2.12 NAME 'bootableDevice' DESC 'A devic e with boot parameters' SUP top AUXILIARY MAY ( bootFile $ bootParameter ) ) structuralObjectClass: olcSchemaConfig entryUUID: ba631520-097c-1036-94cb-9395bf97badd creatorsName: cn=config createTimestamp: 20160907192632Z entryCSN: 20160907192632.339422Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20160907192632Z dn: cn={4}misc,cn=schema,cn=config objectClass: olcSchemaConfig cn: {4}misc olcAttributeTypes: {0}( 2.16.840.1.113730.3.1.13 NAME 'mailLocalAddress' DES C 'RFC822 email address of this recipient' EQUALITY caseIgnoreIA5Match SYNT AX 1.3.6.1.4.1.1466.115.121.1.26{256} ) olcAttributeTypes: {1}( 2.16.840.1.113730.3.1.18 NAME 'mailHost' DESC 'FQDN of the SMTP/MTA of this recipient' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6 .1.4.1.1466.115.121.1.26{256} SINGLE-VALUE ) olcAttributeTypes: {2}( 2.16.840.1.113730.3.1.47 NAME 'mailRoutingAddress' D ESC 'RFC822 routing address of this recipient' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} SINGLE-VALUE ) olcAttributeTypes: {3}( 1.3.6.1.4.1.42.2.27.2.1.15 NAME 'rfc822MailMember' D ESC 'rfc822 mail address of group member(s)' EQUALITY caseIgnoreIA5Match SY NTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcObjectClasses: {0}( 2.16.840.1.113730.3.2.147 NAME 'inetLocalMailRecipien t' DESC 'Internet local mail recipient' SUP top AUXILIARY MAY ( mailLocalAd dress $ mailHost $ mailRoutingAddress ) ) olcObjectClasses: {1}( 1.3.6.1.4.1.42.2.27.1.2.5 NAME 'nisMailAlias' DESC 'N IS mail alias' SUP top STRUCTURAL MUST cn MAY rfc822MailMember ) structuralObjectClass: olcSchemaConfig entryUUID: ba664402-097c-1036-94cc-9395bf97badd creatorsName: cn=config createTimestamp: 20160907192632Z entryCSN: 20160907192632.339422Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20160907192632Z dn: cn={5}ppolicy,cn=schema,cn=config objectClass: olcSchemaConfig cn: {5}ppolicy olcAttributeTypes: {0}( 1.3.6.1.4.1.42.2.27.8.1.1 NAME 'pwdAttribute' EQUALI TY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 ) olcAttributeTypes: {1}( 1.3.6.1.4.1.42.2.27.8.1.2 NAME 'pwdMinAge' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121. 1.27 SINGLE-VALUE ) olcAttributeTypes: {2}( 1.3.6.1.4.1.42.2.27.8.1.3 NAME 'pwdMaxAge' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121. 1.27 SINGLE-VALUE ) olcAttributeTypes: {3}( 1.3.6.1.4.1.42.2.27.8.1.4 NAME 'pwdInHistory' EQUALI TY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.1 21.1.27 SINGLE-VALUE ) olcAttributeTypes: {4}( 1.3.6.1.4.1.42.2.27.8.1.5 NAME 'pwdCheckQuality' EQU ALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.11 5.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {5}( 1.3.6.1.4.1.42.2.27.8.1.6 NAME 'pwdMinLength' EQUALI TY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.1 21.1.27 SINGLE-VALUE ) olcAttributeTypes: {6}( 1.3.6.1.4.1.42.2.27.8.1.7 NAME 'pwdExpireWarning' EQ UALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.1 15.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {7}( 1.3.6.1.4.1.42.2.27.8.1.8 NAME 'pwdGraceAuthNLimit' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466 .115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {8}( 1.3.6.1.4.1.42.2.27.8.1.9 NAME 'pwdLockout' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) olcAttributeTypes: {9}( 1.3.6.1.4.1.42.2.27.8.1.10 NAME 'pwdLockoutDuration' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.146 6.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {10}( 1.3.6.1.4.1.42.2.27.8.1.11 NAME 'pwdMaxFailure' EQU ALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.11 5.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {11}( 1.3.6.1.4.1.42.2.27.8.1.12 NAME 'pwdFailureCountInt erval' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4 .1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {12}( 1.3.6.1.4.1.42.2.27.8.1.13 NAME 'pwdMustChange' EQU ALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) olcAttributeTypes: {13}( 1.3.6.1.4.1.42.2.27.8.1.14 NAME 'pwdAllowUserChange ' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) olcAttributeTypes: {14}( 1.3.6.1.4.1.42.2.27.8.1.15 NAME 'pwdSafeModify' EQU ALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) olcAttributeTypes: {15}( 1.3.6.1.4.1.4754.1.99.1 NAME 'pwdCheckModule' DESC 'Loadable module that instantiates "check_password() function' EQUALITY cas eExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcObjectClasses: {0}( 1.3.6.1.4.1.4754.2.99.1 NAME 'pwdPolicyChecker' SUP t op AUXILIARY MAY pwdCheckModule ) olcObjectClasses: {1}( 1.3.6.1.4.1.42.2.27.8.2.1 NAME 'pwdPolicy' SUP top AU XILIARY MUST pwdAttribute MAY ( pwdMinAge $ pwdMaxAge $ pwdInHistory $ pwdC heckQuality $ pwdMinLength $ pwdExpireWarning $ pwdGraceAuthNLimit $ pwdLoc kout $ pwdLockoutDuration $ pwdMaxFailure $ pwdFailureCountInterval $ pwdMu stChange $ pwdAllowUserChange $ pwdSafeModify ) ) structuralObjectClass: olcSchemaConfig entryUUID: ba68d596-097c-1036-94cd-9395bf97badd creatorsName: cn=config createTimestamp: 20160907192632Z entryCSN: 20160907192632.339422Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20160907192632Z dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAccess: {0}to dn.base="" by * read olcAccess: {1}to dn.base="cn=subschema" by * read olcAccess: {2}to dn.children="***" attrs=userPassword b y dn.base="***" write by self write by * aut h olcAccess: {3}to dn.children="***" attrs=shadowLastChang e by dn.base="***" write by self write by * read olcAccess: {4}to dn.children="***" by * read olcAccess: {5}to dn.children="***" by * read olcAccess: {6}to dn.children="***" by * read olcAccess: {7}to dn.children="***" by * read olcAccess: {8}to dn.children="***" by * read olcAccess: {9}to dn.children="dc=org" by * read olcAccess: {10}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=exte rnal,cn=auth" manage by * +0 break olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 0 olcReadOnly: FALSE olcSchemaDN: cn=Subschema olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig entryUUID: ba72394c-097c-1036-94cf-9395bf97badd creatorsName: cn=config createTimestamp: 20160907192632Z entryCSN: 20160907192632.339422Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20160907192632Z dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by * none olcAddContentAcl: TRUE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=config olcRootPW:: ************* olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig entryUUID: ba74458e-097c-1036-94d0-9395bf97badd creatorsName: cn=config createTimestamp: 20160907192632Z entryCSN: 20160907192632.339422Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20160907192632Z dn: olcDatabase={1}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb olcSuffix: ********* olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: ******************* olcRootPW:: ****************** olcSizeLimit: unlimited olcSyncUseSubentry: FALSE olcSyncrepl: rid=002 provider=ldaps://***:636 bindmethod=sim ple timeout=0 network-timeout=0 binddn="***" c redentials="*******" keepalive=0:0:0 starttls=no tls_cert="/***" tls_key="***" tls_cacert="***" tls_reqcert=demand tls_ciphe r_suite=HIGH filter="(objectclass=*)" searchbase="***" s cope=sub schemachecking=off type=refreshAndPersist retry="60 10 300 10" olcTimeLimit: 1800 olcUpdateRef: ldaps://*** olcMirrorMode: FALSE olcMonitoring: TRUE olcDbDirectory: /var/lib/ldap/***/mdb olcDbNoSync: FALSE olcDbIndex: objectClass eq olcDbIndex: modifyTimestamp eq olcDbIndex: cn eq,subinitial olcDbIndex: uid eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: ou eq olcDbIndex: member eq olcDbIndex: o eq olcDbIndex: mail eq,subinitial olcDbIndex: memberUid eq olcDbIndex: sn eq,subinitial olcDbIndex: givenName eq,subinitial olcDbIndex: uniqueMember pres,eq olcDbMaxReaders: 0 olcDbMaxSize: 1073741824 olcDbMode: 0600 olcDbSearchStack: 16 structuralObjectClass: olcMdbConfig entryUUID: ba77bb06-097c-1036-94d1-9395bf97badd creatorsName: cn=config createTimestamp: 20160907192632Z entryCSN: 20160907192632.339422Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20160907192632Z dn: olcDatabase={2}monitor,cn=config objectClass: olcDatabaseConfig objectClass: olcMonitorConfig olcDatabase: {2}Monitor olcAccess: {0}to * by dn="cn=config" read structuralObjectClass: olcMonitorConfig entryUUID: 6b435b12-f84f-1037-8018-bf7c7cd25d0d creatorsName: cn=config createTimestamp: 20180530121917Z entryCSN: 20180530121917.976664Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20180530121917Z

2 1

Problem with slapd log file
by Raja T Nair 08 Jun '18

08 Jun '18

Hello, openldap-ltb-2.4.44-2.el7.centos.x86_64 CentOS Linux release 7.4.1708 I noticed that the openldap.log file keeps growing. Looked like a missing logrotate setting. So i stopped slapd, moved the current file to openldap.log.1, touched openldap.log and started slapd again. Still loglines are written to the old file, openldap.log.1 Am I missing something here? Can someone help me fix this problem? Regards, Raja. -- :^)

2 2

LDAPS Support
by web＠tomjay.co.uk 07 Jun '18

07 Jun '18

Hello, I'm under the impression that LDAPS (and not StartTLS) has been depreciated in OpenLDAP, but I can't find anything on the OpenLDAP website that says this. Is this the case, and is there a reference for it? Thanks.

5 6

Issue with ignoring case on memberUid
by arun 06 Jun '18

06 Jun '18

Hi All, We are trying to use email IDs on memberUid attribute for groups and memberUid is not allowing case insensitive search for characters after @. We modified schema to ignore case but it's not working. Please let us know how do we use memberUid with case-insensitive characters. Ex: Abc.efh(a)Dummy.com is the memberUid attribute Ignore case search for ABC.efh(a)dummy.com doesn't work. Arun

2 1

Switching from bdb to lmdb with Openldap-2.4.46
by Saurabh Lahoti 05 Jun '18

05 Jun '18

Dear, How could we upgrade our bdb to mdb using slapadd..? ---- *Thanks & Kind Regards,* Saurabh LAHOTI.

4 3

Setting up syncrepl
by Fabiano Sidler 31 May '18

31 May '18

Hi folks! I'm trying to set up a working multi-master syncrepl. Both servers I can connect to (using Apache Directory Studio), but nothing is synced. Starting slapd with -d 16384 -d 32768 (sync + none) only produces the following logs on both servers: --- 5b0b0988 do_syncrep2: rid=005 LDAP_RES_SEARCH_RESULT 5b0b0988 do_syncrep2: rid=002 LDAP_RES_SEARCH_RESULT 5b0b0992 do_syncrep2: rid=005 LDAP_RES_SEARCH_RESULT --- This is my configuration: --- dn: cn=config objectClass: olcGlobal cn: config olcPidFile: /var/run/openldap/slapd.pid olcTLSCACertificateFile: /usr/local/etc/openldap/ca olcTLSCertificateFile: /usr/local/etc/openldap/crt olcTLSCertificateKeyFile: /usr/local/etc/openldap/key olcAuthzRegexp: {0}"gidNumber=0\+uidNumber=0,cn=peercred,cn=external,cn=auth" "cn=admin,$basedn" olcAuthzRegexp: {1}"uid=root,cn=$domain,cn=gssapi,cn=auth" "cn=admin,$basedn" olcAuthzRegexp: {2}"uid=dc(1|2),cn=$domain,cn=gssapi,cn=auth" "cn=admin,$basedn" olcServerID: 1 ldap://dc1.$domain/ olcServerID: 2 ldap://dc2.$domain/ olcSaslRealm: $domain olcLogLevel: 0 dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema include: file:///usr/local/etc/openldap/schema/core.ldif include: file:///usr/local/etc/openldap/schema/cosine.ldif include: file:///usr/local/etc/openldap/schema/inetorgperson.ldif include: file:///usr/local/etc/openldap/schema/dyngroup.ldif include: file:///usr/local/etc/openldap/schema/ppolicy.ldif include: file:///usr/local/etc/openldap/schema/nis.ldif include: file:///usr/local/etc/openldap/schema/hdb.ldif include: file:///usr/local/etc/openldap/schema/samba.ldif dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulePath: /usr/local/libexec/openldap olcModuleLoad: {0}back_mdb olcModuleLoad: {2}syncprov olcModuleLoad: {2}rwm olcModuleLoad: {3}back_relay #olcModuleLoad: {4}smbk5pwd dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by * none olcRootDN: $rootdn olcSyncrepl: {0}rid=001 provider=ldap://dc1.$domain/ bindmethod=simple binddn="cn=admin,$basedn" credentials="secret" searchbase="cn=config" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcSyncrepl: {1}rid=002 provider=ldap://dc2.$domain/ bindmethod=simple binddn="cn=admin,$basedn" credentials="secret" searchbase="cn=config" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcMirrorMode: TRUE dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov dn: olcDatabase={1}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb olcSuffix: $basedn olcRootDN: cn=admin,$basedn olcDbDirectory: /var/db/openldap/$domain olcSyncrepl: {0}rid=004 provider=ldap://dc1.$domain/ bindmethod=simple binddn="cn=admin,$basedn" credentials="secret" searchbase="$basedn" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcSyncrepl: {1}rid=005 provider=ldap://dc2.$domain/ bindmethod=simple binddn="cn=admin,$basedn" credentials="secret" searchbase="$basedn" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcMirrorMode: TRUE dn: olcOverlay={0}syncprov,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov --- What's the problem? Best wishes, Fabiano

1 0

Re: removing ppolicy overlay
by Frank Swasey 31 May '18

31 May '18

The lack of responses indicates that people either do not use ppolicy or once used, they never remove it. For future reference here's the procedure that I've worked up: shutdown slapd on all MMR members slapcat the database edit the database to remove all "pwd*" attributes and all entries that are pwd* objectClass edit the slapd.conf file (if you are using slapd.d you are on your own) replace the database (delete, and slapadd) Empty the accesslog database if you are using that start slapd Copy your edited database to the rest of your servers and use the tried and true "nuke & repave" process to delete the existing database, edit the config, slapadd the edited database - Frank > On Apr 16, 2018, at 11:09, Frank Swasey <Frank.Swasey(a)uvm.edu> wrote: > > Is there a recommended way to discontinue the use of the ppolicy overlay? > > The only way I've found that works is to stop the ldap server and using slapcat/edit/slapadd eradicate all the ppolicy attributes (combined with removing the ppolicy overlay and schema from the slapd.conf file). > > I'm attempting this on RHEL7 with OpenLDAP 2.4.46 (local built). > > Thanks, > - Frank

3 2

Duplicate Password Policies and Can Not Rest User Password
by Daniel Howard 31 May '18

31 May '18

Hello, I have two issues. One is I gave myself redundant *ppolicy* overlays I can't delete. The other is I don't know why I can not reset a user's password. The first is that in a rush, late at night, I ended up with multiple (duplicate) Password Policy Overlays. I went back and tried to delete these, but: $ *sudo ldapmodify -Q -Y EXTERNAL -H ldapi:///* dn: olcOverlay={5}ppolicy,olcDatabase={1}hdb,cn=config changetype: delete deleting entry "olcOverlay={5}ppolicy,olcDatabase={1}hdb,cn=config" ldap_delete: Server is unwilling to perform (53) It looks like this is a known consideration, per http://www.zytrax.com/books/ldap/ch6/slapd-config.html#use-overlays and that I'll have to cowboy the server config to get the redundant overlays removed. root@ldap0:~# *slapd -V* @(#) $OpenLDAP: slapd (Ubuntu) (May 31 2017 21:52:16) $ buildd@lgw01-30 :/build/openldap-tnOaja/openldap-2.4.31/debian/build/servers/slapd Okay, so what is that overlay? Pretty simple stuff: dn: olcOverlay={2}ppolicy,olcDatabase={1}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcOverlay: {2}ppolicy olcPPolicyDefault: cn=passwordDefault,ou=Policies,dc=qxxxxxxxxd,dc=com olcPPolicyHashCleartext: FALSE olcPPolicyUseLockout: FALSE olcPPolicyForwardUpdates: FALSE (But defined four times ... {2..5}) What is the problem, then? The problem is I can not set a user's password. root@ldap0:~# */usr/bin/ldappasswd -y /etc/ldapscripts/ldapscripts.passwd -D cn=admin,dc=qxxxxxxxxd,dc=com -x -H ldap://localhost -T /tmp/ldapsetpasswd uid=zachary,ou=People,dc=qxxxxxxxxd,dc=com* Result: No such attribute (16) Say what? dn: uid=zachary,ou=People,dc=qxxxxxxxxd,dc=com structuralObjectClass: account entryUUID: cd55cc80-f8a5-1037-976e-9da738d41e24 creatorsName: cn=admin,dc=qxxxxxxxxd,dc=com createTimestamp: 20180530223739Z pwdFailureTime: 20180530223741Z pwdFailureTime: 20180530224243Z pwdFailureTime: 20180530224244Z pwdFailureTime: 20180530224306Z pwdFailureTime: 20180530224307Z pwdFailureTime: 20180530224354Z pwdFailureTime: 20180530224538Z pwdFailureTime: 20180530224541Z entryCSN: 20180530224541.157285Z#000000#000#000000 modifiersName: cn=admin,dc=qxxxxxxxxd,dc=com modifyTimestamp: 20180530224541Z entryDN: uid=zachary,ou=People,dc=qxxxxxxxxd,dc=com subschemaSubentry: cn=Subschema hasSubordinates: FALSE Maybe the user is locked out? root@ldap0:~# *ldapmodify -Q -Y EXTERNAL -H ldapi:/// -D cn=admin,dc=qxxxxxxxxd,dc=com* dn: uid=zachary,ou=People,dc=qxxxxxxxxd,dc=com changetype: modify delete: pwdFailureTime modifying entry "uid=zachary,ou=People,dc=qxxxxxxxxd,dc=com" ldap_modify: Constraint violation (19) additional info: pwdFailureTime: no user modification allowed Q1: Any bright idea on removing the redundant ppolicy overlays? Q2: Any bright idea on what's up with resetting zachary's password? Thanks, -danny -- http://dannyman.toldme.com

1 0

MDB_INVALID: File is not an LMDB file
by Chris Trenkamp 30 May '18

30 May '18

My program suddenly started returning this error, "MDB_INVALID: File is not an LMDB file" whenever it tries to open the database file. It is running on Windows. I made a copy of the database, compiled lmdb with MDB_DEBUG set to 2 and ran this program: #include <stdio.h> #include "lmdb.h" int main(int argc, char* argv[]) { int rc; MDB_env *env; rc = mdb_env_create(&env); printf("%d\n", rc); rc = mdb_env_open(env, "./brokedb", 0, 0644); printf("%d\n", rc); } And it gave this output: 0 mdb_env_read_header:4040 page 0 not a meta page -30793 Does anyone know how this might have happened, and things to look for in my program that might have caused this? Is there a way to recover the data from the file? Thanks.

2 1

LDAP instance crashing frequently due to swap memory exhaustion
by Saurabh Lahoti 29 May '18

29 May '18

Dear, LDAP instance crashes frequently due to low or no swap memory. What could be the probable reasons for this crash..? ---- *Thanks & Kind Regards,* Saurabh LAHOTI.

1 0

search abandoned by pagedResult nentries=0
by jehan procaccia INT 25 May '18

25 May '18

Hello I have a software (zimbra) that request my openldap server regularly in order to update the "Global Address List" (for mail auto-completion) It request the openldap with a simple search filter after binding however, although it seems to start fine, the result ends with May 24 20:40:48 ldapmt slapd[16434]: conn=1003 op=2 SEARCH RESULT tag=101 err=0 nentries=0 text=search abandoned by pagedResult size=0 nentries=0 and no result is returned I do see the request in the ldap logs May 24 20:40:48 ldapmt slapd[16434]: conn=1003 op=2 SRCH base="dc=telecom,dc=fr" scope=2 deref=3 filter="(|(mail=*)(sn=*))" If I do the exact same request (binddn, bindpassw, searchbase, ldapuri, scope, deref, filter) from the zimbra server itself, I do get a correct result with nentries=6505 I don't understand why when the zimbra software does the same request, it fails with nentries=0 text=search abandoned by pagedResult !? what is that message "search abandoned by pagedResult" means ? how can I further debug that problem ? ( I already set loglevel to acl filter stats ) Regards

1 0

.so version numbers for dlopen'd objects
by Paul B. Henson 23 May '18

23 May '18

I'm trying to get the OpenBSD openldap port updated to use modules, currently it just builds everything into a monolithic binary. They are objecting to the existence of the version number in the shared objects for the modules: -rwxr-xr-x 1 henson henson 1773576 May 21 12:54 back_bdb-2.4.so.2.10.7 -rwxr-xr-x 1 henson henson 864 May 21 12:54 back_bdb.la lrwxrwxrwx 1 henson henson 22 May 21 12:54 back_bdb.so -> back_bdb-2.4.so.2.10.7 They say that shared objects which are intended to be dlopen'd, as opposed to linked to, should not include version numbers, and it should look like: -rwxr-xr-x 1 henson henson 1773576 May 21 12:54 back_bdb-2.4.so -rwxr-xr-x 1 henson henson 864 May 21 12:54 back_bdb.la What is the openldap developer perspective on this? Thanks.

5 14

Understanding slapd connections
by Igor Zobin 22 May '18

22 May '18

Hello everyone! I am struggling to understand what exactly the command lsof -i tcp:389 is showing. What exactly is counted as an established connection here? Can I limit that amount somehow through slapd configuration? Can I monitor which of those connections shown by lsof are still in use and which just hang around doing nothing? Igor.

2 1

Re: pwdRESET not working
by Net Warrior 22 May '18

22 May '18

Hello When I force the expiration changing pwdMaxAge what I can see in the log is the following: ppolicy_bind: Entry uid=jdoe,ou=Users,dc=domain,dc=com has an expired password: 0 grace logins I test the login, I get two warning as configured but the user is never forced to change it and can login as usual, any hint on this? I was expecting something like this, this is from my old notes ( 2013 ) at that time it worked You are required to change your LDAP password immediately. Last login: Wed Feb 13 12:07:38 2013 from server.domain.com WARNING: Your password has expired. You must change your password now and login again! Changing password for user pmorales. Enter login(LDAP) password: My sss configuration # sssd::config [sssd] domains = domain services = nss, pam, ssh, sudo config_file_version=2 [domain/zebra] # sssd::provider::ldap id_provider=ldap auth_provider=ldap chpass_provider=ldap ldap_uri=ldap://openldap.domain.com ldap_chpass_uri=ldap://openldap.domain.com ldap_search_base=dc=domain,dc=com ldap_tls_reqcert=never ldap_tls_cacert=/etc/openldap/cacerts/ca_certs.pem ldap_tls_cacertdir=/etc/openldap/cacerts ldap_id_use_start_tls=false ldap_user_search_base=ou=Users,dc=domain,dc=com ldap_group_search_base=ou=Groups,dc=domain,dc=com debug_level=6 ldap_sudo_search_base=cn=sudo,ou=Groups,dc=domain,dc=com ldap_chpass_update_last_change=true ldap_user_shadow_last_change=shadowLastChange ldap_pwd_policy=shadow nsswitch.conf passwd: files sss shadow: files sss group: files sss System-Auth #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth sufficient pam_sss.so use_first_pass auth required pam_deny.so account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 type= password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok password sufficient pam_sss.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_sss.so session optional pam_mkhomedir.so umask=0077 Password Auth #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth sufficient pam_sss.so use_first_pass auth required pam_deny.so account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 type= password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok password sufficient pam_sss.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_sss.so session optional pam_mkhomedir.so umask=0077 Thanks Regards 2018-05-10 11:45 GMT-03:00 Net Warrior <netwarrior863(a)gmail.com>: > Hi > > From time to time I need to reset user passwords when they forget it so I > want to force them to change it when they connect over ssh, as long as I > remember this worked before, ( do not remember which openldap version it was > a long time ) anyway , how can I force user to change their passwords upon > ssh connection? or is not possible anymore? > > > Thanks > Regards > > > On 05/08/2018 09:25 AM, Clément OUDOT wrote: >> >> >> Le 03/05/2018 à 16:23, Net Warrior a écrit : >>> >>> Hello there guys, when setting the pwsReset to TRUE I cannot login to >>> the system anymore, just get the permission denied, then I found this. >>> >>> https://github.com/pwm-project/pwm/issues/155 >>> >>> Did I face that bug or maybe it's something else? >> >> >> It's not a bug. If pwdReset is set to TRUE, the BIND will be successful >> but you will not be allowed to do another operation but changing >> password. If your application is doing a SEARCH just after the BIND, you >> will be denied. >> >> >> >

2 1

OTP or 2FA for Manager Account?
by Douglas Duckworth 18 May '18

18 May '18

Hi Does OpenLDAP support use of one time passwords or 2FA for the Manager account? Thanks Doug

7 11

ldapdelete: Invalid DN on an Accesslog generated DN
by Giuseppe Civitella 17 May '18

17 May '18

Hi all, while doing some tests to enable accesslog in my directory, I did enable the overlay and then disabled it because of login problems. Once restored the directory, I found a few entries like this: dn: reqStart=20180509102412.000000Z,BASEDN objectClass: auditModify structuralObjectClass: auditModify REQSTART: 20180509102412.000000Z REQEND: 20180509102412.000001Z REQTYPE: modify REQSESSION: 1679 REQAUTHZID: cn=admin,BASEDN REQDN: cn=gcivitella,ou=users,BASEDN REQRESULT: 0 REQMOD: description:= description utente gcivitella (update check accesslog) REQMOD: entryCSN:= 20180509102412.246481Z#000000#000#000000 REQMOD: modifiersName:= cn=admin,BASEDN REQMOD: modifyTimestamp:= 20180509102412Z REQENTRYUUID: 53620528-9276-1037-8c51-e5b01d96303b entryUUID: dc744658-e7be-1037-9c6f-71aa77ba1fb3 creatorsName: cn=admin,BASEDN createTimestamp: 20180509102412Z entryCSN: 20180509102412.246481Z#000000#000#000000 modifiersName: cn=admin,BASEDN modifyTimestamp: 20180509102412Z Now I'm unable to delete them. I get an "invalid DN" error: ldapdelete -D "cn=admin,BASEDN" -W -H ldap://127.0.0.1 -v "reqStart=20180509102412.000000Z,BASEDN" ldap_initialize( ldap://127.0.0.1:389/??base ) Enter LDAP Password: deleting entry "reqStart=20180509102412.000000Z,BASEDN" ldap_delete: Invalid DN syntax (34) additional info: invalid DN Is there a way to force the deletion or temporary disable the schema check? Best regards, Giuseppe

3 3

Schema for a sql->ldap server
by James Cloos 14 May '18

14 May '18

I wonder if anyone can offer some tips on how the ldap schema should look for the setup below. The docs for how to use openldap's sql backend are good; it is only the schema I'm unsure of. The data currently resides in a sql db, and some users have devices which can access data via ldap. One table has data similar to what would work for inetOrgPerson, except that email addresses and inet domains are not guaranteed. Another table has data specific to each device; we'd want the devices to use that name/pw tuple to access the ldap data. Not the person-specific name/pw tuple. The end-users will primarily be interested in contact details for people from the first table. Also, the sql covers multiple customers, and each device should only see the data from the customer with which it is associated. Generating a dn for each company is the first issue. Does it work to just use the company name w/o any hierarchy? I presume that the device's will also need a dn, to use their name/pw tuples for access, yes? I'm also unsure how to define those DNs. Is there any good references for doing ldap w/o using internet concepts for the naming? -JimC -- James Cloos <cloos(a)jhcloos.com> OpenPGP: 0x997A9F17ED7DAEA6

1 0

ldapdelete: Invalid DN on an Accesslog generated DN
by Giuseppe Civitella 14 May '18

14 May '18

Hi all, while doing some tests to enable accesslog in my directory, I did enable the overlay and then disabled it because of login problems. Once restored the directory, I found a few entries like this: dn: reqStart=20180509102412.000000Z,BASEDN objectClass: auditModify structuralObjectClass: auditModify REQSTART: 20180509102412.000000Z REQEND: 20180509102412.000001Z REQTYPE: modify REQSESSION: 1679 REQAUTHZID: cn=admin,BASEDN REQDN: cn=gcivitella,ou=users,BASEDN REQRESULT: 0 REQMOD: description:= description utente gcivitella (update check accesslog) REQMOD: entryCSN:= 20180509102412.246481Z#000000#000#000000 REQMOD: modifiersName:= cn=admin,BASEDN REQMOD: modifyTimestamp:= 20180509102412Z REQENTRYUUID: 53620528-9276-1037-8c51-e5b01d96303b entryUUID: dc744658-e7be-1037-9c6f-71aa77ba1fb3 creatorsName: cn=admin,BASEDN createTimestamp: 20180509102412Z entryCSN: 20180509102412.246481Z#000000#000#000000 modifiersName: cn=admin,BASEDN modifyTimestamp: 20180509102412Z Now I'm unable to delete them. I get an "invalid DN" error: ldapdelete -D "cn=admin,BASEDN" -W -H ldap://127.0.0.1 -v "reqStart=20180509102412.000000Z,BASEDN" ldap_initialize( ldap://127.0.0.1:389/??base ) Enter LDAP Password: deleting entry "reqStart=20180509102412.000000Z,BASEDN" ldap_delete: Invalid DN syntax (34) additional info: invalid DN Is there a way to force the deletion or temporary disable the schema check? Best regards, Giuseppe

1 0

Search only few subtrees under baseDN
by Ervin Hegedüs 14 May '18

14 May '18

Hi, may be the subject doesn't give back my real quastion... and may be this is a returned topic... sorry. Scenario: there is a database with several DC's, all DC's divided to several OU's, and most OU contains several other OU's. dc=hu + dc=company1 + dc=company2 + dc = sub-company21 + ou = orgunit1 + ou = orgunit2 + ou = orgunit3 and there are several users. Take a look two examples: uid=admin1,ou=some-org,dc=sub-company21,dc=company2,dc=hu needs to read the ou=orgunit1 and ou=orgunit2. uid=admin2,ou=some-org,dc=sub-company21,dc=company2,dc=hu needs to read full dc=sub-company21 subtree. All of them are WORKING now as well with ACL's. But now, the admin1 user needs to set up two different connections in GUI browser, because he can't set up the dc=sub-company21,dc=company2,dc=hu as baseDN. When he uses the search through API, then he needs to make 2 different lookup to collect all nodes from DB, and merge them. Is there any way to set up one or more ACL's, where admin1 user can set up the dc=sub-company21,dc=company2,dc=hu as baseDN, and can start to search from there, but he will see the entries only from ou=orgunit1 and ou=orgunit2? Hope that's clear... Thanks, a.

3 6

How to present the memberOf attribute in a syncrepl setup?
by Robert Minsk 14 May '18

14 May '18

/-----------------------------------\ | master1 <- mirror repl -> master2 | \-----------------------------------/ ^ ^ ^ | | | syncrepl syncrepl syncrepl | | | /-------\ /-------\ /-------\ |cache01| |cache02| ... |cache n| \-------/ \-------/ \-------/ The master servers are using mirror replication and are behind a load balancer setup for active/passive failover. All writes go to the active master where the "member" attribute is maintained for the groups. The cache servers get their data from the master servers using syncrepl replication. All the end clients connect to the cache servers. I need to be able to present the memberOf attribute on users on the cache servers. The man page for slapo-memberof states that it is not compatible with syncrepl. Because of this the cache servers are using slapo-dynlist to create the memberOf attribute. The problem is since I am using a dynamic list I can not search using the memberOf attribute only query its value. I need to be able to search by the memberOf attribute. What is the recommended way generate the memberOf attribute? Should I modify the schema for a user and somehow maintain the memberOf attribute on the masters? I am a bit worried about this since looking at the slapo-memberOf source the memberOf attribute it is flagged as a DSAOperation.

1 0

About Openldap's functional testing
by 郦旺 13 May '18

13 May '18

To whom it may concern, I am a student who is interested in software reliability. After read the Administrator's Guide, I only found the tests like “make test” to test the build before installation. For the reason that I need to do some experiments, I wonder if there are some official functional tests against an existing Installation of OpenLDAP. Thanks, Wang

1 0

How to present the memberOf attribute in a syncrepl setup?
by Robert Minsk 13 May '18

13 May '18

/-----------------------------------\ | master1 <- mirror repl -> master2 | \-----------------------------------/ ^ ^ ^ | | | syncrepl syncrepl syncrepl | | | /-------\ /-------\ /-------\ |cache01| |cache02| ... |cache n| \-------/ \-------/ \-------/ The master servers are using mirror replication and are behind a load balancer setup for active/passive failover. All writes go to the active master where the "member" attribute is maintained for the groups. The cache servers get their data from the master servers using syncrepl replication. All the end clients connect to the cache servers. I need to be able to present the memberOf attribute on users on the cache servers. The man page for slapo-memberof states that it is not compatible with syncrepl. Because of this the cache servers are using slapo-dynlist to create the memberOf attribute. The problem is since I am using a dynamic list I can not search using the memberOf attribute only query its value. I need to be able to search by the memberOf attribute. What is the recommended way generate the memberOf atribute? Should I modify the schema for a user and somehow maintain the memberOf attribute on the masters? I am a bit worried about this since looking at the slapo-memberOf source the memberOf attribute it is flagged as a DSAOperation.

1 0

OpenLDAP, MySQL e MemberOf
by Arianna Milazzo 11 May '18

11 May '18

Hello! I installed openLDAP with MySQL. Now I don't know how can I do to use "memberOf" in my slapd.conf I added: overlay memberof > memberof-group-oc groupOfNames > memberof-member-ad member > memberof-memberof-ad memberOf > But in database? I tried to add member and memberon in ldap_attr_mappings... How can I do??? Thank you, Aria

1 0

SASL pass-through and changing passwords
by linux nuse 11 May '18

11 May '18

Hi, There was similar topic 5 years ago, but the problem wasn't completely solved. I've set `olcPasswordHash` to `{SASL}`, so ldappaswd is no longer smashing `userPassword` attribute. I get the same error which Tim Watts encountered 5 years ago. https://www.openldap.org/lists/openldap-technical/201302/msg00190.html namely, ldappaswd says: > Result: Other (e.g., implementation specific) error (80) > Additional info: scheme provided no hash function Tim wrote: > However, the kerberos principle does get updated - and userPassword is left alone. In my case I just get the error and the kerberos password is NOT updated. Also, 9 years ago it was asked (https://www.openldap.org/lists/openldap-software/200909/msg00010.html): > - salspasswd2 calls sasl_setpass(), and a look at OpenLDAP sources > shows that passwd_extop()/slap_sasl_setpass() does the same. That > suggests it is possible to have slapd doing the thing, but how does > it works? In passwd_extop(), slap_sasl_setpass() will only be > called if op-o_bd is NULL. In what situation does it happen? But the question is not answered. Does anyone remember how passwd_extop() works and how to get into the if-statement block with call to slap_sasl_setpass()?

1 0

Re: Optimal configuration for olcToolThreads and olcThreads
by Quanah Gibson-Mount 10 May '18

10 May '18

--On Thursday, May 10, 2018 1:10 PM -0700 rammohan ganapavarapu <rammohanganap(a)gmail.com> wrote: > > Quanah, > > > Thank you, i am using MDB, so do you recommend me to change it from 1 to > 2? by setting it to 2 will improve any performance? also this property > doesnt have any impact on replication (syncrepl) ? Again, the tool threads setting only affects slapadd. So it will improve the performance of slapadd if you set it to "2" instead of "1". Since it only affects offline operations, it has no effect on syncrepl. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Optimal configuration for olcToolThreads and olcThreads
by Quanah Gibson-Mount 10 May '18

10 May '18

--On Thursday, May 10, 2018 12:58 PM -0700 rammohan ganapavarapu <rammohanganap(a)gmail.com> wrote: > > To add more to the previous query, what are the operations used > by olcToolThreads and what are by olcThreads? what does syncrepl > uses olcToolThreads or olcThreads? olcToolThreads is used by slapadd. What value it should be depends on the backend being used. If it is LMDB, then you want it to be no higher than 2. If you set it to more than 2, it'll be set to 2 internally. For other backends, such as back-bdb/hdb, it can result in significant improvement when loading data via slapadd. olcThreads controls how many threads are available to the slapd process. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

pwdRESET not working
by Net Warrior 08 May '18

08 May '18

Hello there guys, when setting the pwsReset to TRUE I cannot login to the system anymore, just get the permission denied, then I found this. https://github.com/pwm-project/pwm/issues/155 Did I face that bug or maybe it's something else? My system CentOS Linux release 7.4.1708 (Core) 3.10.0-693.21.1.el7.x86_64 #1 SMP Wed Mar 7 19:03:37 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux openldap-servers-2.4.44-5.el7.x86_64 openssl-libs-1.0.2k-8.el7.x86_64 openldap-clients-2.4.44-5.el7.x86_64 openldap-2.4.44-5.el7.x86_64 objectClass: pwdPolicy objectClass: person objectClass: top pwdAllowUserChange: TRUE pwdAttribute: userPassword pwdCheckQuality: 2 pwdFailureCountInterval: 30 pwdGraceAuthNLimit: 5 pwdInHistory: 5 pwdLockout: TRUE pwdMaxFailure: 5 pwdMinLength: 5 pwdSafeModify: FALSE sn: default structuralObjectClass: person pwdExpireWarning: 432000 pwdLockoutDuration: 1800 pwdMaxAge: 7776000 pwdMustChange: TRUE pwdMinAge: 0 Thanks Regards

2 1

Re: Missing structural object, ldapadd says it's there,
by Ole Nomann Thomsen 07 May '18

07 May '18

Oh. Answering my own question: The "missing" entry had turned into a glue entry, don't know how. I can modify it with "ldapmodify ... -M ..." (or maybe -MM), to turn it into a regular entry and make dotnet default auth work. Thanks for your time :-] - Ole. > Hi list, I am running @(#) $OpenLDAP: slapd 2.4.45 (Jan 23 2018 08:50:30) $ for > authentication. > > I can authenticate most of my clients, but some of them fail. It seems to be > the .net ones, not using fastbind: > One client tries to authenticate from .net, but can't bind. This is in the log: > > conn=12475338 fd=15 ACCEPT from IP=192.168.252.131:36473 > (IP=0.0.0.0:3890) > conn=12475338 op=0 BIND dn="uid=wscda,ou=Authentication,o=UNI- > C,c=DK" method=128 > conn=12475338 op=0 BIND dn="uid=wscda,ou=Authentication,o=UNI- > C,c=DK" mech=SIMPLE ssf=0 > conn=12475338 op=0 RESULT tag=97 err=0 text= > conn=12475338 op=1 srch base="ou=authentication,o=uni-c,c=dk" scope=0 > deref=0 filter="(objectclass=*)" > conn=12475338 op=1 srch attr=objectclass > conn=12475338 op=1 search result tag=101 err=0 nentries=0 text= > > Aha, "ou=authentication,o=uni-c,c=dk" (that default .net auth seems to > require) must be missing. Verify that: > > ldapsearch -x -H ldaps://host:3891/ -D "..." -w "..." -s base -b > ou=Authentication,o=UNI-C,c=DK objectClass=* + \* > > Gives me: > > # extended LDIF > # > # LDAPv3 > # base <ou=Authentication,o=UNI-C,c=DK> with scope baseObject > # filter: entryUUID=* > # requesting: + * > # > > # search result > search: 2 > result: 0 Success > > # numResponses: 1 > > With this log-entry: > > conn=10181 fd=14 ACCEPT from IP=10.54.43.87:54312 (IP=0.0.0.0:3891) > conn=10181 fd=14 TLS established tls_ssf=256 ssf=256 > conn=10181 op=0 BIND dn="cn=AuthAdmin,ou=Authentication,o=UNI- > C,c=DK" method=128 > conn=10181 op=0 BIND dn="cn=AuthAdmin,ou=Authentication,o=UNI- > C,c=DK" mech=SIMPLE ssf=0 > conn=10181 op=0 RESULT tag=97 err=0 text= > conn=10181 op=1 SRCH base="ou=Authentication,o=UNI-C,c=DK" scope=0 > deref=0 filter="( objectClass=*)" > conn=10181 op=1 SRCH attr=+ * > conn=10181 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= > conn=10181 op=2 UNBIND > > That is "nentries=0", yup it is missing. > > I decide to add the missing structural object: > > ldapadd -h localhost -p 3890 -f missing.ldif -D "..." -w "..." > > with missing.ldif: > > dn: ou=Authentication,o=UNI-C,c=DK > ou: Authentication > objectClass: organizationalUnit > > Result: > > adding new entry "ou=Authentication,o=UNI-C,c=DK" > ldap_add: Already exists (68) > > And this log-entry: > > conn=10182 op=1 ADD dn="ou=Authentication,o=UNI-C,c=DK" > slap_queue_csn: queueing 0x7f63c811e390 > 20180501061454.852525Z#000000#000#000000 > conn=10182 op=1 RESULT tag=105 err=68 text= > > There or not? I try to delete it: > > ldapdelete -h localhost -p 3890 -f missing-delete.ldif -D "..." -w "..." > > missing-delete.ldif: > > ou=Authentication,o=UNI-C,c=DK > > Result: > > ldap_delete: No such object (32) > matched DN: ou=Authentication,o=UNI-C,c=DK > > Log: > > conn=10184 op=1 DEL dn="ou=Authentication,o=UNI-C,c=DK" > conn=10184 op=1 RESULT tag=107 err=32 text= > > I can't add it, beacause it's already there, and I can't delete it, because it isn't > there... > I can't figure out what the problem is; maybe som subtle difference between > what is in the base and what I am searching for? > I've a feeling that there is a face-palm answer, if so please bear with me.

3 2

MDB questions
by William Brown 07 May '18

07 May '18

Hi there, I have a few questions about MDB, and I have some things I'd like to work on. In the docs there are a few references that reference binary searching. It's not 100% clear but I assume this is a binary search of the keys in a BTree node, not that MDB is a bst. How does MDB provide crash resilience on the free pages? According to man, free() should only be called on memory from malloc but I see that you use free on mmaped pages in mdb_dpage_free. There must be something I'm missing here about this. Anyway, I have two things I want to work on. The simple one is when pages are moved from the txn free list to the env free list (I hope that's correct), it would be good to call madvise(MADV_REMOVE) on the data section. The reason for this is that the madvise call will allow supported filesystems to hole punch the sparse file, allowing space reclamation - without MDB needing to worry about it! The much more invasive change I want to work on is page checksumming. Basically there are 4 cases I have in mind * No checksumming (today) * Metadata checksumming only * Metadata and data checksumming These could be used in these scenarios: * write checksums but don't verify them at run time * write checksums, and only verify metadata on read (possibly a good default option) * write checksums, and verify metadata and data on read (slowest, but has strong integrity properties for some applications) And in all cases I want to add an "mdb_verify" command that would assert all of these are also correct offline. There are a few reasons for this * Hardware is unreliable. Ram, disk, cables, even cpu cache memory can all exhibt bit flips and other data loss. Changing a bit in a pointer can cause damage to any datastructure, and flows on to crashes or silent corruption * Software is never perfect - checksumming allows detection of over- writes of data from overflow or other mistakes that we as humans all make. I'd opt to use something fast like crc32c (intel provides hardware to accelerate this with -march=native). The only issue I see is that this would require an ondisk structure change because the current structs don't have space for this -and the csums have to be *first*. http://www.lmdb.tech/doc/group__internal.html#structMDB__page The checksum would have to be the first value *or* the last value of the page header, (so that it can be updated without affecting the result of the checksum). The checksum for the data would have to be within the header so that this is asserted as correct. Is this something I should pursue? Would this require a ondisk format change? Is there something that could be done to avoid this? Thanks, William

2 1

Missing structural object, ldapadd says it's there, ldapdelete says it isn't
by Ole Nomann Thomsen 03 May '18

03 May '18

Hi list, I am running @(#) $OpenLDAP: slapd 2.4.45 (Jan 23 2018 08:50:30) $ for authentication. I can authenticate most of my clients, but some of them fail. It seems to be the .net ones, not using fastbind: One client tries to authenticate from .net, but can't bind. This is in the log: conn=12475338 fd=15 ACCEPT from IP=192.168.252.131:36473 (IP=0.0.0.0:3890) conn=12475338 op=0 BIND dn="uid=wscda,ou=Authentication,o=UNI-C,c=DK" method=128 conn=12475338 op=0 BIND dn="uid=wscda,ou=Authentication,o=UNI-C,c=DK" mech=SIMPLE ssf=0 conn=12475338 op=0 RESULT tag=97 err=0 text= conn=12475338 op=1 srch base="ou=authentication,o=uni-c,c=dk" scope=0 deref=0 filter="(objectclass=*)" conn=12475338 op=1 srch attr=objectclass conn=12475338 op=1 search result tag=101 err=0 nentries=0 text= Aha, "ou=authentication,o=uni-c,c=dk" (that default .net auth seems to require) must be missing. Verify that: ldapsearch -x -H ldaps://host:3891/ -D "..." -w "..." -s base -b ou=Authentication,o=UNI-C,c=DK objectClass=* + \* Gives me: # extended LDIF # # LDAPv3 # base <ou=Authentication,o=UNI-C,c=DK> with scope baseObject # filter: entryUUID=* # requesting: + * # # search result search: 2 result: 0 Success # numResponses: 1 With this log-entry: conn=10181 fd=14 ACCEPT from IP=10.54.43.87:54312 (IP=0.0.0.0:3891) conn=10181 fd=14 TLS established tls_ssf=256 ssf=256 conn=10181 op=0 BIND dn="cn=AuthAdmin,ou=Authentication,o=UNI-C,c=DK" method=128 conn=10181 op=0 BIND dn="cn=AuthAdmin,ou=Authentication,o=UNI-C,c=DK" mech=SIMPLE ssf=0 conn=10181 op=0 RESULT tag=97 err=0 text= conn=10181 op=1 SRCH base="ou=Authentication,o=UNI-C,c=DK" scope=0 deref=0 filter="( objectClass=*)" conn=10181 op=1 SRCH attr=+ * conn=10181 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= conn=10181 op=2 UNBIND That is "nentries=0", yup it is missing. I decide to add the missing structural object: ldapadd -h localhost -p 3890 -f missing.ldif -D "..." -w "..." with missing.ldif: dn: ou=Authentication,o=UNI-C,c=DK ou: Authentication objectClass: organizationalUnit Result: adding new entry "ou=Authentication,o=UNI-C,c=DK" ldap_add: Already exists (68) And this log-entry: conn=10182 op=1 ADD dn="ou=Authentication,o=UNI-C,c=DK" slap_queue_csn: queueing 0x7f63c811e390 20180501061454.852525Z#000000#000#000000 conn=10182 op=1 RESULT tag=105 err=68 text= There or not? I try to delete it: ldapdelete -h localhost -p 3890 -f missing-delete.ldif -D "..." -w "..." missing-delete.ldif: ou=Authentication,o=UNI-C,c=DK Result: ldap_delete: No such object (32) matched DN: ou=Authentication,o=UNI-C,c=DK Log: conn=10184 op=1 DEL dn="ou=Authentication,o=UNI-C,c=DK" conn=10184 op=1 RESULT tag=107 err=32 text= I can't add it, beacause it's already there, and I can't delete it, because it isn't there... I can't figure out what the problem is; maybe som subtle difference between what is in the base and what I am searching for? I've a feeling that there is a face-palm answer, if so please bear with me. Med venlig hilsen Ole Nomann Thomsen Seniorkonsulent [https://www.uvm.dk/-/media/Billeder/Mailsignatur/UVM_STIL_DK.png] Undervisningsministeriet Styrelsen for It og Læring Center for Digitale Overgange og it-styring Vester Voldgade 123 1552 København V Tlf.: 3587 8889 Direkte tlf.: +45 35 87 85 35 E-mail: ole.nomann(a)stil.dk

3 3

Separate trees openldap
by seguranca informacao 02 May '18

02 May '18

Hi guys, I'm trying to accomplish a configuration that I'm not aware of. I need to replicate several directories (AD, openldap, etc) to a unique repository (my openldap). The thing is I need to have completely separate trees for each domain (client). Any ideas in how to do that? bellow is an example what I'm thinking of: dc=example,dc=com cn=users cn=groups ------------------------------ complete separation dc=domain,dc=com cn=users cn=groups ------------------------------ complete separation dc=test,dc=ca cn=users cn=groups ------------------------------ complete separation thx, sergio

3 2

(no subject)
by Chris Cardone 02 May '18

02 May '18

Hello All! I have started building a large scale OpenLDAP infrastructure for the company I work for and Im running into one issue i cant seem to resolve. The final architecture is 4 Master servers (each one in its own data center across the USA) We also want to have 2 slaves tied to each master. We deal with an incredibly high amount of authentication traffic. I currently have the 4 masters configured (n-master - using syncrepl) that is functioning as designed, cn=config and user databases are successfully replicated across the 4 servers no matter which server you use to update. What I am having issues with is getting the slaves to sync to the masters. I have the rpuser set up, the machines can talk to each other. I can run queries using the rpuser from any slave to any master and get data back. I can see the rpuser connecting to the master, and showing successful authentication in an attempt to replicate back to the slave. But this error comes up do_syncrep2: rid=010 got search entry without Sync State control and user data is not replicated back to the slave. some additional notes: On the slaves, i did NOT replicate the cn=config db {0) only the here is the LDIF file (with hostnames/passwd removed) dn: olcDatabase={1}mdb,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=010 provider=ldap://master-1.example.com:389/ bindmethod=simple binddn="uid=rpuser,dc=example,dc=com" credentials=banana searchbase="dc=example,dc=com" type=refreshAndPersist retry="30 5 300 3" interval=00:00:05:00 here is the applied config on the slave server # {1}mdb, config dn: olcDatabase={1}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=squaretrade,dc=com olcAccess: {0}to attrs=userPassword by self write by anonymous auth by * none olcAccess: {1}to attrs=shadowLastChange by self write by * read olcAccess: {2}to * by * read olcLastMod: TRUE olcRootDN: cn=admin,dc=example,dc=com olcSyncrepl: {0}rid=010 provider=ldap://master-1.example.com :389/ bindmethod=simple binddn="uid=rpuser,dc=example,dc=com" credentials =banana searchbase="dc=example,dc=com" type=refreshAndPersist retry="30 5 300 3" interval=00:00:05:00 olcDbCheckpoint: 512 30 olcDbIndex: objectClass eq olcDbIndex: cn,uid eq olcDbIndex: uidNumber,gidNumber eq olcDbIndex: member,memberUid eq olcDbMaxSize: 1073741824 here is the syncprov config on the master it is communicating with # {0}syncprov, {1}mdb, config dn: olcOverlay={0}syncprov,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov My questions 1> does the slave also require the cn=config database replication? 2> do the masters need similar configs (i.e. like the n-master config) does RID=010 also need to be configured on the master? here is a section of logs from a sync attempt Apr 18 09:27:36 la1-ldap-slave-prod-1 slapd[14543]: daemon: epoll: listen=9 active_threads=0 tvp=zero Apr 18 09:27:36 la1-ldap-slave-prod-1 slapd[14543]: daemon: epoll: listen=10 active_threads=0 tvp=zero Apr 18 09:27:36 la1-ldap-slave-prod-1 slapd[14543]: daemon: epoll: listen=11 active_threads=0 tvp=zero Apr 18 09:27:36 la1-ldap-slave-prod-1 slapd[14543]: =>do_syncrepl rid=010 Apr 18 09:27:36 la1-ldap-slave-prod-1 slapd[14543]: daemon: epoll: listen=12 active_threads=0 tvp=zero Apr 18 09:27:36 la1-ldap-slave-prod-1 slapd[14543]: daemon: epoll: listen=13 active_threads=0 tvp=zero Apr 18 09:27:36 la1-ldap-slave-prod-1 slapd[14543]: =>do_syncrep2 rid=010 Apr 18 09:27:36 la1-ldap-slave-prod-1 slapd[14543]: do_syncrep2: rid=010 got search entry without Sync State control (dc=example,dc=com) Apr 18 09:27:36 la1-ldap-slave-prod-1 slapd[14543]: do_syncrepl: rid=010 rc -1 retrying (1 retries left) Apr 18 09:27:36 la1-ldap-slave-prod-1 slapd[14543]: daemon: activity on 1 descriptor Apr 18 09:27:36 la1-ldap-slave-prod-1 slapd[14543]: daemon: activity on: Apr 18 09:27:36 la1-ldap-slave-prod-1 slapd[14543]: Apr 18 09:27:36 la1-ldap-slave-prod-1 slapd[14543]: daemon: epoll: listen=9 active_threads=0 tvp=zero Apr 18 09:27:36 la1-ldap-slave-prod-1 slapd[14543]: daemon: epoll: listen=10 active_threads=0 tvp=zero Apr 18 09:27:36 la1-ldap-slave-prod-1 slapd[14543]: daemon: epoll: listen=11 active_threads=0 tvp=zero Apr 18 09:27:36 la1-ldap-slave-prod-1 slapd[14543]: daemon: epoll: listen=12 active_threads=0 tvp=zero Apr 18 09:27:36 la1-ldap-slave-prod-1 slapd[14543]: daemon: epoll: listen=13 active_threads=0 tvp=zero any assistance would be greatly appreciated! and if there is additional information that will help just ask! Christopher

2 1

OpenLDAP & Mysql backend
by Arianna Milazzo 01 May '18

01 May '18

Hello! I installed openLDAP on Debian 9 with mysql backend. I followed the guide and I used example database (http://www.openldap.org/faq/data/cache/978.html ) Now, I can connect to openldap with root credential (in slapd.conf) or with a "person" present in ldap_entries, but I don't see nothing: no search result. With Apache Directory Studio I see only organization. Even it's impossible add something: ldap_add: Server is unwilling to perform (53) additional info: operation not permitted within namingContext Please, someone can tell me why? Thanks, Arianna

2 3

mdb_del: MDB_MAP_FULL: Environment mapsize limit reached
by James Anderson 27 Apr '18

27 Apr '18

good morning; we recently observed a call to mdb_del had returned a mdb_map_full error for an environment which i believe to be configured when opened to permit 40G, while, currently stat indicates a size of roughly 1.7G on disk. i find no bug reports related to this. are there any secondary factors which would lead to this result? this is using the lmdb library at 0.9.21 --- james anderson | james(a)dydra.com | http://dydra.com

1 0

Re: slapadd not adding some of the roleoccupent entries
by Quanah Gibson-Mount 24 Apr '18

24 Apr '18

--On Tuesday, April 24, 2018 1:05 PM -0700 rammohan ganapavarapu <rammohanganap(a)gmail.com> wrote: > > Thank you for clarification, is it possible to share what are the missing > attributes? There are a number of them (such as entryUUID, entryCSN, etc). Regardless, for replication to work, the operational attr values must be the same across servers. This is generally why if you're bringing up replication in an environment where you already have an existing DB, you slapcat the DB off your "golden" master, and then use slapadd to import it to the other servers. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Migration Task from 2.3.x to 2.4.x
by Periko Support 24 Apr '18

24 Apr '18

Hi people. I got a centos 6.x server running openldap 2.3.x as backend or our samba domain. I need to move to centos 7 which came with openldap 2.4.x. I had read that the files settings change and need to upgrade to the new format for 2.4.x I got my ldap backups, is this the right way to do it? 1) Move my backup to the new server. 2) Remove slapd.d dir from /etc/openldap in the new installation. 3) Copy my openldap settings from the old server (/etc/openldap/) 4) run slapadd -l ldap.backup 5) create a empty directory called slapd.d /etc/openldap 6) convert to new format: slaptest -f ldap.backup -F /etc/openldap/slapd.d This is correct guys or I miss something? Thanks for your help and time!!!

2 1

Re: slapadd not adding some of the roleoccupent entries
by Quanah Gibson-Mount 24 Apr '18

24 Apr '18

--On Wednesday, April 11, 2018 1:31 PM -0700 rammohan ganapavarapu <rammohanganap(a)gmail.com> wrote: > > for the same scenario where i have a old server with data and trying to > replicate that data to new server with default skeleton created as below. This will not work, because your skeleton is missing the required operational attrs. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

exempt some users from OpenLDAP password policy
by Tayyab Saeed 23 Apr '18

23 Apr '18

Dear All, I have tried modifying pwdChangedTime & facing below error modifying entry "uid=test1,ou=ITSupport,ou=people,dc=mydomain,dc=com" ldap_modify: Constraint violation (19) additional info: pwdChangedTime: no user modification allowed Thanks, Tayyab Saeed

6 12

Error Loading Schema
by Net Warrior 17 Apr '18

17 Apr '18

Hello there. Im trying to load this schema http://pig.made-it.com/ldap-openssh.html And I get this error. ldapmodify: invalid format (line 1) entry: "" Googling around I found that I need to add ( : ) after the attribute and that's wha I did, now Im getting the error in line 3 but adding the (: ) in the objectclass: did not help ldapmodify: invalid format (line 3) entry: "" Any help appreciated Thanks Regards

4 4

removing ppolicy overlay
by Frank Swasey 16 Apr '18

16 Apr '18

Is there a recommended way to discontinue the use of the ppolicy overlay? The only way I've found that works is to stop the ldap server and using slapcat/edit/slapadd eradicate all the ppolicy attributes (combined with removing the ppolicy overlay and schema from the slapd.conf file). I'm attempting this on RHEL7 with OpenLDAP 2.4.46 (local built). Thanks, - Frank

1 0

auto-growing data size
by mark diener 14 Apr '18

14 Apr '18

Anybody have any idea on how to have the database file grow until you get to the mapsize instead of pre-allocating the entire mapsize (4GB) upon initialization? mdb_env_set_mapsize() ; I don't mind having an upper limit on the map size, but I think it would be helpful to have it grow to the upper limit, not preallocate the space on storage. There are various areas in the documentation where it talks about having the database not grow without bounds. Comments? Marco

3 6

Introduction of openldapjs
by Dieter Klünter 13 Apr '18

13 Apr '18

Hi, due to the fact that some software libraries are lacking full support of Lightweight Directory Access Protocol according to RFC-4510 and that there is a need to implement full ldap support in JavaScript, openLDAP.js, a wrapper of libldap, has been developed. The library has been published under MIT-Licence and is available at https://github.com/6labs/openldapjs -Dieter -- Dieter Klünter | Systemberatung http://sys4.de GPG Key ID: E9ED159B 53°37'09,95"N 10°08'02,42"E

3 2

Compiling LMDB on Windows 8.1
by jeff.esquivel＠gmail.com 09 Apr '18

09 Apr '18

Hi, I'm trying to install node-lmdb[0] on Windows 8.1 (which uses node-gyp to handle LMDB compilation) but it fails with the following error: ..\dependencies\lmdb\libraries\liblmdb\mdb.c(55): error C2059: syntax error: '(' [C:\Users\Foo\Downloads\node-lmdb\node _modules\node-lmdb\build\node-lmdb.vcxproj] (The whole error log is available here[1]). Looking around the git repository, there seems to be a recent change in that part of the code[2], so I manually checked out to the commit just before that change and that seemed to enable successful compilation. Is there anything I'm doing wrong? Is there any documentation I can read about the correct way to compile LMDB in Windows? Thanks, [0] https://github.com/Venemo/node-lmdb [1] https://pastebin.mozilla.org/9082557 [2] http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commit;h=e85ae1fe… -- Jeffrey Esquivel S.

2 1

Memory management for client API
by Erez Zilber 05 Apr '18

05 Apr '18

Hi, I'm trying to implement a LDAP client. I see that functions like ldap_search_ext_s() may dynamically allocate memory. Is there a way to supply my own memory allocation functions for open-ldap API? I'm asking because I would like to allocate memory during initialization, not during run time. Else, how can I calculate the max amount of memory that such calls will require? What should happen if not enough memory is available when a function like ldap_search_ext_s() gets called? Is there a special error code that indicates that? Thanks, Erez

1 0

LDAP Tool Box RPM and Debian packages for OpenLDAP 2.4.46
by Clément OUDOT 03 Apr '18

03 Apr '18

Hi, LDAP Tool Box project just released packages for OpenLDAP 2.4.46, that can be downloaded here: https://ltb-project.org/download#openldap You can also use our yum and apt repositories to install them. Changes on packaging can be found here: * https://github.com/ltb-project/openldap-rpm/releases/tag/v2.4.46 * https://github.com/ltb-project/openldap-deb/releases/tag/v2.4.46 Thanks to Michael Ströder for the help and David Coutadeur for Debian packages and improvements on ppm module and init script. Clément.

1 0

Syncrepl replication from multi-master OpenLDAP
by Simon ELBAZ 29 Mar '18

29 Mar '18

Hi, I am trying to setup data and cn=config replication on a syncrepl slave from an OpenLDAP multi-master. The replication is fine (data and config replicate). However, I want to override olcSyncrepl attributes on the syncrepl replica (particularly the provider value to use an IP address reachable from outside the multi-master LAN). I have tried exattrs=olcSyncrepl but as mentionned in (https://www.openldap.org/lists/openldap-technical/201508/msg00124.html), the olcSyncrepl attribute gets wiped: dn: olcDatabase={1}mdb,cn=config ..... olcSyncrepl: {0}rid=006 provider=ldap://<IP address> binddn="******" bindmethod=simple credentials="*****" searchbase="*****" type=refreshAndPersist interval=0 0:00:00:10 retry="5 5 300 5" timeout=1 Is there a way to achieve the overriding of olcSyncrepl attribute on the syncrepl server ? Thanks for your help Simon Elbaz

2 1

Re: openLDAP: LDAP and LDAP over TLS support at same time
by GOKUL G 29 Mar '18

29 Mar '18

Hi Quanah, Thanks for the response. Earlier, we tried to do a normal ldapsearch with a library compiled with HAVE_TLS, but what we got in the wireshark trace was ldap message over SSL without any encryption, instead of plain LDAP. So we thought it was not possible to get plain LDAP with library compiled with HAVE_TLS. As you said, we have missed out on something or probably misunderstood the APIs. I will try your suggestions. Thanks once again for your support. Regards, G Gokul On Thu, Mar 29, 2018 at 2:05 AM, Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Wednesday, March 28, 2018 10:29 PM +0100 Raf Czlonka < > rczlonka(a)gmail.com> wrote: > ^^^ > >> Hi Quanah, >> >> You obviously meant 636, right[0]? >> > > Heh, yes, 636. ;) > > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > >

1 0

openLDAP: LDAP and LDAP over TLS support at same time
by GOKUL G 28 Mar '18

28 Mar '18

Hi Team, We are developing a LDAP client in our application. For this we are using openLDAP software. One of our requirement is to support either LDAP or LDAPS (LDAP/TLS) , based on the end-user input at runtime. So, in our application we should have support for both LDAP & LDAPS APIs and we would be calling LDAPS API (ldap_tls_start_s) based on this runtime configuration or else normal LDAP API would be called. ISSUE: We are able to integrate openLDAP with our application and achieve LDAP or LDAP/TLS requirement separately. Since, the support for TLS in openLDAP is macro controlled (HAVE_TLS), at compile time itself its decided whether LDAP or LDAPs . And we are not able to take this decision at run-time. If we compile openLDAP software with HAVE_TLS and use it for normal ldapsearch, this ldap command is seen in trace as ldap message over SSL without any encryption. But not as normal LDAP message. So, we understand to achieve our requirement, we would either be required to change the macro control of TLS to run-time control in the openLDAP code. (But we are feeling not to do this for maintainability purpose) (or) Try to use 2 openLDAP libraries, one compiled with HAVE_TLS and another without HAVE_TLS. And take care in application side to call the respective API without causing any resolution issue. Can you please suggest whether there is any other approach currently available in openLDAP to support both LDAP and LDAP/TLS at the sametime. Regards, G Gokul

3 4

Re: slapadd not adding some of the roleoccupent entries
by Quanah Gibson-Mount 26 Mar '18

26 Mar '18

--On Monday, March 26, 2018 9:16 AM -0700 rammohan ganapavarapu <rammohanganap(a)gmail.com> wrote: > When i try to import using slapadd -f hdb.ldif, some of the entries in > sysadmin role are not getting import, not sure what should be the reason. > Actually hdb backend to hdb backend import also same behaviour if i > pre-create with above root schema and keep the other server in cluster > is running. If i dont pre-create schema or if i dont keep the other > server running in a cluster i dont see this issue. slapadd by default outputs an error and will not continue (unless -c is specified) when it has a problem adding an entry. You should provide the error encountered. I'd also note that you appear to be adding LDIF that is missing operational attributes. That will not work well if you're running in MMR and expect replication to work. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

OpenLDAP UTF8 values support
by Andre Rodier 24 Mar '18

24 Mar '18

Hello, I have started a small project to build a mail server, and the authentication / users list is based on OpenLDAP. I want to use international characters for the "secondary" email addresses but and OpenLDAP is complaining about it, as invalid syntax. I use the field otherMailBox field. I found a make-shift by storing the email address encoded in base64, but I therefore need to be sure any client will be able to read these base64 encoded email addresses. So far, Dovecot is fine, I am not sure yet about Postfix. Is there any limitation in OpenLDAP that would prevent some fields to be stored in UTF8 directly? I have noticed that the givenName and surname are automatically encoded in base64 when containing accents, so is it a standard practice? Thanks for your advices. https://github.com/progmaticltd/homebox Kind regards, André

4 5

LMDB on Ramdisk (tmpfs)
by Luca Foppiano 23 Mar '18

23 Mar '18

Dear everybody, I'm using one of your component (LMDB) via a java JNDI bindings implementation (https://github.com/deephacks/lmdbjni <https://github.com/deephacks/lmdbjni>) and I'm having an issue when I deploy my LMDB file on a tempfs filesystem in RAM. The issue do not occur when the LMDB files are stored on a "normal" filesystem. When the data is in the tempfs ramdisk all the allocated memory ends up being in the Dirty area (it has not been written back to the Filesytem). Here an example using the ramdisk: 7ce320000000-7cfc20000000 r--s 00000000 00:26 2459 /ramfs/nerd/data/db/db-en/entityEmbeddings/data.mdb Size: 104857600 kB Rss: 1255680 kB Pss: 1255680 kB Shared_Clean: 0 kB Shared_Dirty: 0 kB Private_Clean: 0 kB Private_Dirty: 1255680 kB <--- Referenced: 1255680 kB Anonymous: 0 kB AnonHugePages: 0 kB Shared_Hugetlb: 0 kB Private_Hugetlb: 0 kB Swap: 0 kB SwapPss: 0 kB KernelPageSize: 4 kB MMUPageSize: 4 kB Locked: 0 kB VmFlags: rd sh mr mw me ms sd and here an example without: 7ca4fc000000-7cbdfc000000 r--s 00000000 fd:00 11154951 /data/workspace/shared/nerd-data/db/db-en/entityEmbeddings/data.mdb Size: 104857600 kB Rss: 838124 kB Pss: 838124 kB Shared_Clean: 0 kB Shared_Dirty: 0 kB Private_Clean: 838124 kB <---- Private_Dirty: 0 kB Referenced: 764872 kB Anonymous: 0 kB AnonHugePages: 0 kB ShmemPmdMapped: 0 kB Shared_Hugetlb: 0 kB Private_Hugetlb: 0 kB Swap: 0 kB SwapPss: 0 kB KernelPageSize: 4 kB MMUPageSize: 4 kB Locked: 0 kB VmFlags: rd sh mr mw me ms sd According to my understanding the memory is dirty when 1)there are open transactions, 2) the data has not been written back to the filesystem What I don't understand is why there is a difference between filesystem and ramdisk? Is there any reason? The application (listed above) is not writing on the lmdb, but just reading (using reading transaction). Thank you Luca

3 5

Re: Migrate from hdb/bdb to mdb backend.
by Quanah Gibson-Mount 22 Mar '18

22 Mar '18

--On Thursday, March 22, 2018 3:59 PM -0700 rammohan ganapavarapu <rammohanganap(a)gmail.com> wrote: > > Thank you! As an aside, I would note that OpenLDAP 2.4.46 was released today, and it contains multiple fixes for replication. ;) Fixed slapd syncrepl deadlock when updating cookie (ITS#8752) Fixed slapd syncrepl callback to always be last in the stack (ITS#8752) Fixed slapd CSN queue processing (ITS#8801) Fixed slapo-accesslog cleanup to only occur on failed operations (ITS#8752) (delta-sync specific) Fixed slapo-syncprov memory leak with delete operations (ITS#8690) Fixed slapo-syncprov to not clear pending operation when checkpointing (ITS#8444) Fixed slapo-syncprov to correctly record contextCSN values in the accesslog (ITS#8100) (delta-sync specific) Fixed slapo-syncprov not to log checkpoints to accesslog db (ITS#8607) (delta-sync specific) Fixed slapo-syncprov to process changes from this SID on REFRESH (ITS#8800) Fixed slapo-syncprov session log parsing to not block other operations (ITS#8486) --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Migrate from hdb/bdb to mdb backend.
by Quanah Gibson-Mount 22 Mar '18

22 Mar '18

--On Thursday, March 22, 2018 3:50 PM -0700 rammohan ganapavarapu <rammohanganap(a)gmail.com> wrote: > > Quanah, > > > Rest of the config looks OK right? also i can replicate from hdb/bdb to > mdb as i described in previous email right? I am using > openldap-servers-2.4.44-5.el7.x86_64 Replication is a function of protocol, so yes, you can replicate from hdb/bdb to mdb. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Migrate from hdb/bdb to mdb backend.
by Quanah Gibson-Mount 22 Mar '18

22 Mar '18

--On Thursday, March 22, 2018 3:12 PM -0700 rammohan ganapavarapu <rammohanganap(a)gmail.com> wrote: > olcSyncrepl: {0}rid=1 provider=ldap://ldapservertest01:10389/ > binddn="cn=manager,dc=example,dc=com" bindmethod=simple > credentials=dontshare searchbase="dc=example,dc=com" attrs="*,+" > type=refreshAndPersist retry="5 +" timeout=0 keepalive=5:5:5 > network-timeout=0 starttls=no filter="(objectclass=*)" scope=sub > schemachecking=off > olcSyncrepl: {1}rid=2 provider=ldap://ldapservertest02:10389/ > binddn="cn=manager,dc=example,dc=com" bindmethod=simple > credentials=dontshare searchbase="dc=example,dc=com" attrs="*,+" > type=refreshAndPersist retry="5 +" timeout=0 keepalive=5:5:5 > network-timeout=0 starttls=no filter="(objectclass=*)" scope=sub > schemachecking=off > olcSyncrepl: {2}rid=3 provider=ldap://ldapservertest03:10389/ > binddn="cn=manager,dc=example,dc=com" bindmethod=simple > credentials=dontshare searchbase="dc=example,dc=com" attrs="*,+" > type=refreshAndPersist retry="5 +" timeout=0 keepalive=5:5:5 > network-timeout=0 starttls=no filter="(objectclass=*)" scope=sub > schemachecking=off > olcSyncrepl: {3}rid=4 provider=ldap://ldapservertest04:10389/ > binddn="cn=manager,dc=example,dc=com" bindmethod=simple > credentials=dontshare searchbase="dc=example,dc=com" attrs="*,+" > type=refreshAndPersist retry="5 +" timeout=0 keepalive=5:5:5 > network-timeout=0 starttls=no filter="(objectclass=*)" scope=sub > schemachecking=off Remove the pointer back to itself on each server, so they stop trying to replicate from themselves, or use a URL with the serverID. Also, what version of OpenLDAP are you using? --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Migrate from hdb/bdb to mdb backend.
by Quanah Gibson-Mount 22 Mar '18

22 Mar '18

--On Thursday, March 22, 2018 2:25 PM -0700 rammohan ganapavarapu <rammohanganap(a)gmail.com> wrote: > serverID 300 ldap://ldapserver300 > serverID 301 ldap://ldapserver301 >From the slapd.conf man page for serverID: "The fully qualified hostname of each server should be used in the supplied URLs." > And each of them have the same olcSyncrepl You fail to note the olcServerID setting for the MDB cluster. You fail to note the syncprov settings for any of the databases. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Migrate from hdb/bdb to mdb backend.
by Quanah Gibson-Mount 22 Mar '18

22 Mar '18

--On Wednesday, March 21, 2018 11:48 AM -0700 rammohan ganapavarapu <rammohanganap(a)gmail.com> wrote: > It seems data is getting replicate but i am seeing this message in ldap > logs. > > > 5ab27b63 dn_callback : entries have identical CSN (lot of them), i did > find some post regarding this but couldn't find any conclusion. It seems > like this message is because of node is trying to self replicate? can i > have same node information in "olcSyncrepl" config when i am only > replicating user database not config databse? You've not provided any information on your configurations, so one cannot really surmise anything about the validity of said configurations. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

OpenLDAP: ACLs using sockname and DN?
by Norman Gray 22 Mar '18

22 Mar '18

Greetings. In OpenLDAP (2.4.45, on FreeBSD), I'm trying to constrain the access of a DN to an attribute, by giving a DN access only when the connection is made via a socket; but without success. I may just be looking for an example of correct use. What I'm trying is olcAccess: to attrs=userPassword by dn.base="uid=pwreset,ou=service,dc=example,dc=edu" sockname.exact="/var/run/openldap/ldapi" write (the idea is that the pwreset DN can be used by an automatic password-reset script, but that that DN will have that access only when the script is running on the same machine as the LDAP server). This `by` phrase appears to match the production in Sect. 8.3 of the OpenLDAP access control documentation, and the remark in slapd.access(5) that the items in the <who> field ‘may be specified in combination’. And indeed there are no syntax warnings generated. I'm presuming that the combination implies an AND rather than an OR – this isn't made explicit in the documentation. I can find no examples covering this in either OpenLDAP documentation or on the web. This stanza works when the sockname element is absent, suggesting that the configuration is otherwise working as I expect. When I try to write the userPassword attribute using this DN, I get an ldap_modify: Insufficient access (50) error. The OpenLDAP documentation doesn't (somewhat surprisingly) explicitly state what the effect of this sockname element is, and the slapd.access(5) page says, rather obliquely, that: > The statements peername=<peername>, sockname=<sockname>, > domain=<domain>, and sockurl=<sockurl> mean that the contacting host > IP (in the form IP=<ip>:<port> for IPv4, or IP=[<ipv6>]:<port> for > IPv6) or the contacting host named pipe file name (in the form > PATH=<path> if connecting through a named pipe) for peername, the > named pipe file name for sockname, the contacting host name for > domain, and the contacting URL for sockurl are compared against > pattern to determine access. Saying 'determine access' doesn't actually say very much. Have I completely misunderstood the point of this access specification, or is there another way to do this? Best wishes, Norman -- Norman Gray : https://nxg.me.uk

2 2

slapd ACL defintion for access to specific object class
by Space One 22 Mar '18

22 Mar '18

Hello, I have a problem configuring correct ACL's: If you want to grant access to a specific attribute and allow adding the necessary object class for it, we could define: Assuming objectClass is "O" and Attribute name is "A": access to attrs=@O by self write by * +0 break This works but it allows also access to any value in the "objectClass" attribute and is therefor a massive security hole. An alternative would be, which the manpage seem to describe (https://linux.die.net/man/5/slapd.access): access to attrs=objectClass value="O" by self write by * +0 break access to attrs=A by self write by * +0 break But when I apply this, and want to add the object class, I simply get the INSUFFICIENT_ACCESS error code. Maybe one can help? If it's not possible I think the manpage should be adjusted and mention this more explicit. Maye there is a exception for "objectClass"? Or it's a bug in the implementation? Best regards spaceone

1 0

Re: LMDB on Ramdisk (tmpfs)
by Luca Foppiano 22 Mar '18

22 Mar '18

> On 22 Mar 2018, at 11:31, Леонид Юрьев <leo(a)yuriev.ru> wrote: > > Hi. Hi Leonid, > Pages from tmpfs will be in "clean" state if ones swapped-out from RAM. > But while stay in RAM such pages always "dirty”. Thanks for the clarification. Luca

1 0

Re: learning olcAccess
by Lists Nethead 20 Mar '18

20 Mar '18

Quoting Sven Mäder <maeder(a)phys.ethz.ch>: Thank you very much for this! In our case we need access to dn.subtree I believe because admins are supposed to have full control, ie. add and delete accounts. What stopped me was the lack of documentation for the "control" keyword but after a bit of sleep and reading your answer I found a some deep down in the Faq-O-Matic bit it does not seem to cover all of it. So, as I gather, "by * none" is the default processing stops, "by * continue" makes it possible to add rules to the same object and "by * break" resets the processong? And finally, there seems to be additional switches available for the control processing but I cannot find them documented *anywhere*. Thanks again, //per > Hi > > You could insert something like this: > > to dn.exact="ou=somedomain,dc=example,dc=com" > attrs=children > by group="cn=admingroup,ou=ldap,dc=example,dc=com" write stop > by * break > to dn.children="ou=somedomain,dc=example,dc=com" > attrs=@inetOrgPerson,@organizationalUnit,@posixAccount, > @shadowAccount,entry > by group="cn=admingroup,ou=ldap,dc=example,dc=com" write stop > by * break > > This will grant administrative rights by the specified group to: > > - the "children" attr of the entry: ou=somedomain,dc=example,dc=com > - all attrs of children of: ou=somedomain,dc=example,dc=com in the > specified objectClasses plus the entries itself > - all other users/groups will continue with ACL evaluation (by * break) > > This will prevent modifying the entry: ou=somedomain,dc=example,dc=com > If you do not need that, replace the two ACLs with: > > to dn.subtree=ou=somedomain,dc=example,dc=com" > ... > > But you have to add these ACLs before the rule with: > to attrs=userPassword ... > otherwise if you add it at the end, the "by * none" will prevent all > access. > > ou=ldap is just an ou that contains my slapd admin groups, for example: > > dn: ou=ldap,dc=example,dc=com > objectClass: organizationalUnit > ou: ldap > > dn: cn=admingroup,ou=ldap,dc=example,dc=com > objectClass: groupOfNames > member: uid=someuser,ou=somedomain,dc=example,dc=com > cn: admingroup > > Hope that helps a bit with the bleeding :) > And carefully test your ACLs, I had to do a lot of try and error to > get it right. > > Kind regards > Sven > > On 03/18/2018 04:54 PM, Lists Nethead wrote: >> >> Hi all, >> >> First post here, and it is asking for advice on an access rule. Setup is, >> >> +-dc=example,dc=com >> +--ou=somedomain >> +---uid=someuser,ou=somedomain,dc=example,dc=com >> +--ou=someotherdomain >> +---uid=otheruser,ou=someotherdomain,dc=example,dc=com >> +--ou=yetanotherdomain >> >> The ruleset so far that seems to work is >> >> to dn.base="" by * read >> to dn.base="cn=subschema" by * read >> to attrs=userPassword by dn.base="cn=admin,dc=example,dc=com" >>   write by >> dn.base="uid=otheradmin,ou=System,dc=example,dc=com" write by self >>   write by anonymous auth  by * none >> to *  by dn.base="uid=someadmin,ou=System,dc=example,dc=com" w >>  rite by self read  by >> peername.ip=<address>%255.255.255.0 read by peern >>  ame.ip=<address>%255.255.255.0 read by peername.ip=<address>%255.255.2 >>  55.0 read by users tls_ssf=256 read  by * none >> >> What I want next is that >> "uid=someuser,ou=somedomain,dc=example,dc=com" should be able to >> administer accounts in "ou=somedomain" and likewise for other "ou=". >> >> My guess is that a group with admin accounts is the way to go but >> right now my eyes are bleeding after reading the whole day about >> access rules... >> >> Thanks, >> >> //per >> >>

2 1

I can't get relay to work in exposing a database under another suffix
by watery 20 Mar '18

20 Mar '18

Hello, I'm trying to set up a replica of a remote server (suffix: ou=customer,o=main) in a local subtree (suffix: dc=example,dc=com). The two separate databases work, as I can add entries to both of them using their original suffix with ldapmodify. But no configuration of relay let's me query the replicated content using the local suffix, since ldapsearch either ends with "No Such Object" or doesn't terminate at all, it hangs after: ||connect success # extended LDIF # |ï¿œ... # LDAPv3 ||||# base <ou=users,dc=example,dc=com> with scope baseObject ||||# filter: (objectclass=*) ||||# requesting: ALL ||||# |Graphically it should look like this: Remote server: ou=customer,o=main | `-- ou=users,ou=customer,o=main ï¿œï¿œï¿œ | ï¿œï¿œï¿œ `-- ou=1000002052,ou=users,ou=customer,o=main ï¿œï¿œï¿œ | ï¿œï¿œï¿œ `-- ou=1000001458,ou=users,ou=customer,o=main ï¿œï¿œï¿œ | ï¿œï¿œï¿œ `-- ou=1000002113,ou=users,ou=customer,o=main Local server: dc=example,dc=com | `-- ou=customers,dc=example,dc=com |ï¿œï¿œ | |ï¿œï¿œ `-- cn=name-one,dc=example,dc=com |ï¿œï¿œ | |ï¿œï¿œ `-- cn=name-two,dc=example,dc=com | `-- ou=users,dc=example,dc=com ï¿œï¿œï¿œ | ï¿œï¿œï¿œ * ï¿œï¿œï¿œ * (this is the replicated subtree, exposed under the new suffix) ï¿œï¿œï¿œ * ï¿œï¿œï¿œ | ï¿œï¿œï¿œ `-- ou=1000002052,ou=users,dc=example,dc=com ï¿œï¿œï¿œ | ï¿œï¿œï¿œ `-- ou=1000001458,ou=users,dc=example,dc=com ï¿œï¿œï¿œ | ï¿œï¿œï¿œ `-- ou=1000002113,ou=users,dc=example,dc=com Here's one of my attempts: # Remote database bdb directory ... suffix ou=customer,o=main rootdn ... rootpw ... access to * by * manage index ... overlay memberof # Relay database relay suffix ou=customers,dc=example,dc=com relay ou=customer,o=main overlay rwm rwm-suffixmassage ou=customers,dc=example,dc=com ou=customer,o=main # Local database bdb directory ... suffix dc=example,dc=com rootdn ... rootpw ... access to * by * manage index ... overlay memberof overlay refint refint_attributes member refint_nothing "cn=nobody,dc=example,dc=com"

2 1

Mirror mode not working with other user accounts
by Mark Monaghan 19 Mar '18

19 Mar '18

Hi All, I'm looking for a bit of advice on my LDAP setup to see where I'm going wrong with this. I have searched high and low all over the internet for an answer, and I can't see to find anyone having the exact same issue. If anyone could shed any light on this, it would be great. I've built two LDAP servers on Centos 7.4/OpenLDAP 2.4.44 running in mirror mode, and they are working successfully. I can create, delete, and edit entries on either server using the manager account, and the changes will be instantly mirrored over to the other server. However, my problems started when I wanted to introduce two users to have full control over an OU each within the structure. I have put the ACLs for these users in place, and they work, but as soon as I do anything, even just an edit on an existing item in that OU, the change isn't mirrored over to the other server, and the server being mirrored to no longer replicates as it says the database is not a shadow. The users in question are corpadmin and eduadmin, managing the Corporate and Education OUs respectively. The ACLs in my databaseconfig file for the two users being place are as follows: dn: olcDatabase={2}hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {2}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=wireless,dc=org structuralObjectClass: olcHdbConfig creatorsName: cn=config olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=Manager,dc=wireless,dc=org" write by anonymous auth by self write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to dn.subtree="ou=Corporate,dc=wireless,dc=org" by dn="uid=corpadmin,ou=Admins,dc=wireless,dc=org" write by * read olcAccess: {3}to dn.subtree="ou=Education,dc=wireless,dc=org" by dn="uid=eduadmin,ou=Admins,dc=wireless,dc=org" write by * read olcAccess: {4}to * by dn="cn=Manager,dc=wireless,dc=org" write by * read olcRootDN: cn=manager,dc=wireless,dc=org The original databaseconfig file, minus the ACLs is like so: dn: olcDatabase={2}hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {2}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=wireless,dc=org structuralObjectClass: olcHdbConfig creatorsName: cn=config olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=Manager,dc=wireless,dc=org" write by anonymous auth by self write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by dn="cn=Manager,dc=wireless,dc=org" write by * read olcRootDN: cn=manager,dc=wireless,dc=org These ACLs have been added to the same file on the other server, so both ACLs match. Is there anywhere else I should be making these ACL changes, such as the olcDatabase={0}config file (Pasted here for ref)? dn: olcDatabase={0}config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * none olcRootPW:: 213jh287ycshasdkujqy7w483i1234jh123er7qwedfasdf olcMirrorMode: TRUE structuralObjectClass: olcDatabaseConfig entryUUID: 507c5e6e-b24a-1037-9c97-89a2062470b8 creatorsName: cn=config createTimestamp: 20180302094624Z olcSyncrepl: {0}rid=001 provider=ldap://ldapauth1.fqdn.org binddn="cn=config" bindmethod=simple credentials=password searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncrepl: {1}rid=002 provider=ldap://ldapauth2.fqdn.org binddn="cn=config" bindmethod=simple credentials=password searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 entryCSN: 20180302133047.428537Z#000000#002#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20180302133047Z Finally, barring a restore of both servers, is there any way of bringing the two servers back into sync if I get a database is not a shadow error? Again, I've had a good look for information, but most posts mentioned that it was a bug with an earlier version of OpenLDAP and to upgrade to resolve this, rather than any info on how to resync the databases. Thanks in advance. Cheers, Mark

3 3

learning olcAccess
by Lists Nethead 19 Mar '18

19 Mar '18

Hi all, First post here, and it is asking for advice on an access rule. Setup is, +-dc=example,dc=com +--ou=somedomain +---uid=someuser,ou=somedomain,dc=example,dc=com +--ou=someotherdomain +---uid=otheruser,ou=someotherdomain,dc=example,dc=com +--ou=yetanotherdomain The ruleset so far that seems to work is to dn.base="" by * read to dn.base="cn=subschema" by * read to attrs=userPassword by dn.base="cn=admin,dc=example,dc=com" write by dn.base="uid=otheradmin,ou=System,dc=example,dc=com" write by self write by anonymous auth by * none to * by dn.base="uid=someadmin,ou=System,dc=example,dc=com" w rite by self read by peername.ip=<address>%255.255.255.0 read by peern ame.ip=<address>%255.255.255.0 read by peername.ip=<address>%255.255.2 55.0 read by users tls_ssf=256 read by * none What I want next is that "uid=someuser,ou=somedomain,dc=example,dc=com" should be able to administer accounts in "ou=somedomain" and likewise for other "ou=". My guess is that a group with admin accounts is the way to go but right now my eyes are bleeding after reading the whole day about access rules... Thanks, //per

2 1

Missing contextCSN on ldap cluster
by Abel FERNANDEZ 19 Mar '18

19 Mar '18

Hello, I have a two actifs nodes LDAP cluster with replication stablished and working properly. The problem is when trying to check replication status I have no contextCSN returned in any of the nodes. This is the command executed to get replication status and that should return contextCSN values if executed in both nodes (but it returns nothing) : ldapsearch -x -LLL -H ldaps:// -s base -b 'dc=domain,dc=com' contextCSN dn: dc=domain,dc=com This is the replication configuration in node1 (is the same in node 2 excepting the rid and the hostname: syncrepl rid=001 provider=ldaps://HOSTNAME bindmethod=simple binddn="uid=user,ou=group,dc=domain,dc=com" credentials=PASSWORD searchbase="dc=domain,dc=com" attrs="*,+" type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 +" mirrormode on These are the values supossed to be indexed, configured in the slapd.confon both servers index objectClass,entryCSN,entryUUID eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub And the synchronisation options (also in slapd.conf) overlay syncprov syncprov-checkpoint 50 1 syncprov-sessionlog 50 I'm using dbd database. OpendLDAP 2.4.44 from LTB project and CentOS 7 as OS. Any clue of what I'm missing ? Thank you in advance Best regards Abel

2 2

LMDB random writes really slow for large data
by Chuntao HONG 19 Mar '18

19 Mar '18

I am testing LMDB performance with the benchmark given in http://www.lmdb.tech/bench/ondisk/. And I noticed that LMDB random writes are really slow when the data goes beyond memory. I am using a machine with 4GB DRAM with Intel PCIE SSD. The key size is 10 bytes and value size is 1KB. The benchmark code is given in http://www.lmdb.tech/bench/ondisk/, and the command line I used is "./db_bench_mdb --benchmarks=fillrandbatch --threads=1 --stats_interval=1024 --num=10000000 --value_size=1000 --use_existing_db=0 ". For the first 1GB of data written, the average write rate is 140MB/s. The rate then drops significantly to 40MB/s for the first 2GB. At the end of the test, in which 10M values are written, the average rate is just 3MB/s, and the instant rate is 1MB/s. I know LMDB is not optimized for writes, but I didn't expect it to be this slow, given that I have a really high-end Intel SSD. I also notice that the way LMDB access the SSD is really strange. At the beginning of the test, it writes the SSD at around 400MB/s, but performs no read, which is expected. But as we write more and more data, LMDB starts to read the SSD. As time goes on, the read throughput rises while the write throughput drops significantly. At the end of test, LMDB is constantly reading at around 190MB/s, while occationally issuing 100MB writes at around 10-20 second intervals. 1. Is it normal for LMDB to have such low write throughput (1MB/s at the end of test) for data stored on SSD? 2. Why is LMDB reading more data than it is writing (about 20MB data read per 1MB written) at the end of the test? To my understanding, although we have more data than the DRAM can hold, the branch nodes of the B-tree should still be in the DRAM. So for every write, the only pages that we need to fetch from SSD is the leaf nodes. And when we write the leaf node, we might also need to write its parents. So there should be more writes than reads. But it turns out LMDB is reading much more than writing. I think it might be the reason why it is so slow at the end. But I really cannot understand why. For your reference, here is part of the log given by the benchmark: -------------------------------------------------------- 2018/03/12-10:36:30 ... thread 0: (1024,1024) ops and (54584.2,54584.2) ops/second in (0.018760,0.018760) seconds 2018/03/12-10:36:30 ... thread 0: (1024,2048) ops and (111231.8,73231.8) ops/second in (0.009206,0.027966) seconds 2018/03/12-10:36:30 ... thread 0: (1024,3072) ops and (125382.6,85019.2) ops/second in (0.008167,0.036133) seconds 2018/03/12-10:36:30 ... thread 0: (1024,4096) ops and (206202.2,99661.8) ops/second in (0.004966,0.041099) seconds 2018/03/12-10:36:30 ... thread 0: (1024,5120) ops and (259634.9,113669.2) ops/second in (0.003944,0.045043) seconds 2018/03/12-10:36:30 ... thread 0: (1024,6144) ops and (306495.1,126984.1) ops/second in (0.003341,0.048384) seconds 2018/03/12-10:36:30 ... thread 0: (1024,7168) ops and (339185.2,139447.1) ops/second in (0.003019,0.051403) seconds 2018/03/12-10:36:30 ... thread 0: (1024,8192) ops and (384240.2,151512.9) ops/second in (0.002665,0.054068) seconds 2018/03/12-10:36:30 ... thread 0: (1024,9216) ops and (385252.1,162465.2) ops/second in (0.002658,0.056726) seconds 2018/03/12-10:36:30 ... thread 0: (1024,10240) ops and (371553.0,172152.9) ops/second in (0.002756,0.059482) seconds ... 2018/03/12-10:36:37 ... thread 0: (1024,993280) ops and (70127.4,142518.0) ops/second in (0.014602,6.969505) seconds 2018/03/12-10:36:37 ... thread 0: (1024,994304) ops and (199415.8,142559.9) ops/second in (0.005135,6.974640) seconds 2018/03/12-10:36:37 ... thread 0: (1024,995328) ops and (75953.1,142431.4) ops/second in (0.013482,6.988122) seconds 2018/03/12-10:36:37 ... thread 0: (1024,996352) ops and (200823.7,142474.0) ops/second in (0.005099,6.993221) seconds 2018/03/12-10:36:37 ... thread 0: (1024,997376) ops and (71975.8,142330.8) ops/second in (0.014227,7.007448) seconds 2018/03/12-10:36:37 ... thread 0: (1024,998400) ops and (62117.1,142142.6) ops/second in (0.016485,7.023933) seconds 2018/03/12-10:36:37 ... thread 0: (1024,999424) ops and (36366.2,141720.2) ops/second in (0.028158,7.052091) seconds 2018/03/12-10:36:37 ... thread 0: (1024,1000448) ops and (61914.3,141533.5) ops/second in (0.016539,7.068630) seconds 2018/03/12-10:36:37 ... thread 0: (1024,1001472) ops and (60985.1,141342.6) ops/second in (0.016791,7.085421) seconds 2018/03/12-10:36:37 ... thread 0: (1024,1002496) ops and (60466.5,141149.8) ops/second in (0.016935,7.102356) seconds 2018/03/12-10:36:37 ... thread 0: (1024,1003520) ops and (60189.3,140956.3) ops/second in (0.017013,7.119369) seconds 2018/03/12-10:36:37 ... thread 0: (1024,1004544) ops and (61731.4,140772.1) ops/second in (0.016588,7.135957) seconds ... 2018/03/12-10:40:15 ... thread 0: (1024,3236864) ops and (5620.5,14373.0) ops/second in (0.182189,225.203790) seconds 2018/03/12-10:40:15 ... thread 0: (1024,3237888) ops and (6098.5,14366.9) ops/second in (0.167911,225.371701) seconds 2018/03/12-10:40:15 ... thread 0: (1024,3238912) ops and (5469.5,14359.5) ops/second in (0.187221,225.558922) seconds 2018/03/12-10:40:15 ... thread 0: (1024,3239936) ops and (5593.9,14352.4) ops/second in (0.183056,225.741978) seconds 2018/03/12-10:40:16 ... thread 0: (1024,3240960) ops and (5806.9,14345.7) ops/second in (0.176342,225.918320) seconds 2018/03/12-10:40:16 ... thread 0: (1024,3241984) ops and (5332.9,14338.1) ops/second in (0.192016,226.110336) seconds 2018/03/12-10:40:16 ... thread 0: (1024,3243008) ops and (5532.3,14330.9) ops/second in (0.185096,226.295432) seconds 2018/03/12-10:40:16 ... thread 0: (1024,3244032) ops and (6108.8,14324.8) ops/second in (0.167626,226.463058) seconds 2018/03/12-10:40:16 ... thread 0: (1024,3245056) ops and (6074.7,14318.6) ops/second in (0.168567,226.631625) seconds 2018/03/12-10:40:17 ... thread 0: (1024,3246080) ops and (5615.2,14311.6) ops/second in (0.182362,226.813987) seconds 2018/03/12-10:40:17 ... thread 0: (1024,3247104) ops and (5529.3,14304.5) ops/second in (0.185194,226.999181) seconds 2018/03/12-10:40:17 ... thread 0: (1024,3248128) ops and (5846.2,14298.0) ops/second in (0.175156,227.174337) seconds 2018/03/12-10:40:17 ... thread 0: (1024,3249152) ops and (5741.5,14291.2) ops/second in (0.178351,227.352688) seconds 2018/03/12-10:40:17 ... thread 0: (1024,3250176) ops and (5640.2,14284.3) ops/second in (0.181555,227.534243) seconds ... 2018/03/12-11:30:39 ... thread 0: (1024,9988096) ops and (1917.2,3074.3) ops/second in (0.534112,3248.860552) seconds 2018/03/12-11:30:39 ... thread 0: (1024,9989120) ops and (1858.9,3074.1) ops/second in (0.550851,3249.411403) seconds 2018/03/12-11:30:40 ... thread 0: (1024,9990144) ops and (1922.8,3073.9) ops/second in (0.532557,3249.943960) seconds 2018/03/12-11:30:40 ... thread 0: (1024,9991168) ops and (1857.2,3073.7) ops/second in (0.551382,3250.495342) seconds 2018/03/12-11:30:41 ... thread 0: (1024,9992192) ops and (1851.3,3073.5) ops/second in (0.553130,3251.048472) seconds 2018/03/12-11:30:41 ... thread 0: (1024,9993216) ops and (1941.0,3073.3) ops/second in (0.527568,3251.576040) seconds 2018/03/12-11:30:42 ... thread 0: (1024,9994240) ops and (1923.1,3073.2) ops/second in (0.532461,3252.108501) seconds 2018/03/12-11:30:42 ... thread 0: (1024,9995264) ops and (1987.6,3073.0) ops/second in (0.515200,3252.623701) seconds 2018/03/12-11:30:43 ... thread 0: (1024,9996288) ops and (1931.2,3072.8) ops/second in (0.530233,3253.153934) seconds 2018/03/12-11:30:43 ... thread 0: (1024,9997312) ops and (1918.9,3072.6) ops/second in (0.533633,3253.687567) seconds 2018/03/12-11:30:44 ... thread 0: (1024,9998336) ops and (1999.0,3072.4) ops/second in (0.512246,3254.199813) seconds 2018/03/12-11:30:44 ... thread 0: (1024,9999360) ops and (1853.3,3072.2) ops/second in (0.552533,3254.752346) seconds fillrandbatch : 325.508 micros/op 3072 ops/sec; 3.0 MB/s * -------------------------------------------------------- * And here is the read/write rate dumpped from iostat: *-------------------------------------------------------- * Device tps MB_read/s MB_wrtn/s MB_read MB_wrtn sdb 73.00 0.12 25.52 0 25 sdb 531.00 0.00 495.21 0 495 sdb 15089.00 0.00 488.77 0 488 sdb 27431.00 0.01 463.55 0 463 sdb 13093.00 0.00 478.77 0 478 sdb 53676.00 0.00 413.79 0 413 sdb 16781.00 0.00 483.60 0 483 sdb 22267.00 0.00 323.32 0 323 sdb 23945.00 0.00 164.55 0 164 sdb 22867.00 0.00 152.25 0 152 sdb 22038.00 0.00 146.39 0 146 sdb 23825.00 0.00 263.61 0 263 ... sdb 20866.00 85.81 76.90 85 76 sdb 7684.00 101.75 115.19 101 115 sdb 3707.00 154.48 0.00 154 0 sdb 4349.00 181.41 0.00 181 0 sdb 4373.00 184.70 0.00 184 0 sdb 4329.00 185.04 0.00 185 0 sdb 4338.00 182.30 0.01 182 0 sdb 4364.00 184.27 0.00 184 0 sdb 5310.00 177.32 4.99 177 4 sdb 32130.00 99.07 119.70 99 119 sdb 27010.00 103.26 99.25 103 99 sdb 11109.00 67.18 99.96 67 99 sdb 3931.00 172.51 0.00 172 0 sdb 4112.00 171.28 0.00 171 0 sdb 4202.00 183.03 0.00 183 0 sdb 4119.00 183.79 0.00 183 0 sdb 4232.00 182.77 0.02 182 0 sdb 4224.00 185.90 0.00 185 0 sdb 4304.00 186.17 0.00 186 0 sdb 4279.00 188.83 0.00 188 0 sdb 4087.00 184.38 0.00 184 0 sdb 7758.00 163.86 16.70 163 16 sdb 21309.00 68.95 80.11 68 80 sdb 21166.00 81.66 78.42 81 78 sdb 19328.00 71.56 71.55 71 71 sdb 20836.00 89.08 76.52 89 76 sdb 3211.00 112.01 82.21 112 82 sdb 3939.00 173.40 0.00 173 0 sdb 3992.00 178.03 0.00 178 0 sdb 4251.00 181.49 0.00 181 0 sdb 4148.00 185.63 0.00 185 0 sdb 4094.00 184.12 0.01 184 0 sdb 4241.00 187.38 0.00 187 0 sdb 4044.00 186.60 0.00 186 0 sdb 4049.00 185.47 0.00 185 0 sdb 4247.00 189.17 0.00 189 0 ... sdb 17457.00 105.45 64.05 105 64 sdb 16736.00 82.12 62.35 82 62 sdb 12074.00 108.76 66.21 108 66 sdb 2232.00 194.44 0.00 194 0 sdb 2171.00 187.27 0.02 187 0 sdb 2322.00 197.91 0.00 197 0 sdb 2311.00 194.65 0.00 194 0 sdb 2240.00 187.93 0.00 187 0 sdb 2189.00 191.38 0.00 191 0 sdb 2266.00 192.33 0.01 192 0 sdb 2312.00 198.95 0.00 198 0 sdb 2310.00 199.84 0.00 199 0 sdb 2350.00 198.83 0.00 198 0 sdb 2275.00 198.31 0.00 198 0 sdb 3952.00 185.05 6.79 185 6 sdb 15842.00 59.89 59.67 59 59 sdb 16676.00 88.24 61.79 88 61 sdb 14768.00 75.94 55.00 75 54 sdb 5677.00 141.71 35.03 141 35 sdb 2135.00 184.78 0.04 184 0 sdb 2301.00 197.18 0.00 197 0 sdb 2334.00 198.81 0.00 198 0 sdb 2304.00 198.83 0.00 198 0 sdb 2348.00 198.67 0.00 198 0 sdb 2352.00 198.42 0.01 198 0 sdb 2373.00 199.32 0.00 199 0 sdb 2363.00 197.55 0.00 197 0 sdb 2289.00 198.71 0.00 198 0 sdb 2246.00 189.31 0.00 189 0 sdb 2357.00 198.64 0.01 198 0 sdb 2338.00 197.96 0.00 197 0 sdb 6292.00 177.60 16.56 177 16 sdb 19374.00 93.72 72.16 93 72 sdb 16873.00 101.38 62.01 101 62 sdb 16960.00 98.99 76.84 98 76 sdb 2299.00 189.32 6.16 189 6 sdb 2285.00 195.82 0.00 195 0 sdb 2346.00 198.25 0.00 198 0 sdb 2325.00 198.91 0.00 198 0 sdb 2353.00 197.72 0.02 197 0 sdb 2320.00 198.82 0.00 198 0 sdb 2327.00 200.05 0.00 200 0 sdb 2340.00 198.35 0.00 198 0 sdb 2322.00 199.29 0.00 199 0 sdb 2316.00 197.43 0.01 197 0 sdb 690.00 51.17 0.00 51 0 --------------------------------------------------------

2 2

LDAP Account expiry
by Brad Marshall 17 Mar '18

17 Mar '18

Hi all, I'm running OpenLDAP 2.4.44 in Docker on Ubuntu, and have a requirement to lock accounts after they've been idle for a certain amount of time. As I understand there's no native way to do this, I've written a python script that loops over and checks the authTimestamp from the lastbind overlay, which is all good. To lock the account I set the pwdAccountLockTime to the timestamp, which all works well with the ppolicy overlay in place. The problem becomes when we want to unlock the accounts, and give the end users a chance to auth so it will clear out the lock. My understanding from reading the code was that I could set the timestamp for pwdAccountLockTime into the future, and it should expire the account when it gets to that time. This gives the users a grace period in which to authenticate. However when I do this, the account still seems locked - authentication still says invalid credentials, but when I remove the pwdAccountLockTime attribute the same password works. I've tried with both pwdLockoutDuration set to 0 and a non zero value, and pwdLockout is set to True. I also investigated using pwdEndTime and pwdStartTime as per the "Password Policy for LDAP Directories" draft policy, but apparently this isn't implemented. Should any of this be working? Am I missing any piece of this puzzle here? Has anyone got any suggestions on how to solve this problem, either via the approach I'm trying or any alternative solution? Please let me know if I've left any useful information out about this. Thanks, Brad -- Brad Marshall brad.marshall(a)gmail.com

2 1

SAMBA PDC/BDC LDPA replicaiton issues
by Praveen Ghimire 16 Mar '18

16 Mar '18

Hi, We are having some replication issues between the our PDC and BDC LDAP servers. Here are the details Servers: Name: LIN-PDC1.LIN Role: PDC SLAPD: openldap-2.4.28 Samba: 3.6.25 Distro: Ubuntu 12.04 Name: LIN-PDC2.LIN Role: BDC SLAPD: 2.4.31 Samba: 4.3.11 Distro: Ubuntu 14.04 LDAP Method: cn=config with smbldap tools Database: HDB Management: PHPLAMDIN Replication Method: refreshAndPersist Replication: After importing the LDIFs for Provider and consumer, we found that the in the PDC the oldDatabase(1)HDB was converted from a file to a folder. The contents of the which are below. In BDC it remained a file. BDC: LDAP sync related bits from olCDatabase(1)HDB olcSyncrepl: {0}rid=0 provider=ldap://lin-pdc1.lin bindmethod=simple bindd n="cn=admin,dc=lin" credentials=seceret searchbase="dc=lin" log base="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0)) " schemachecking=on type=refreshAndPersist retry="60 +" syncdata=accesslog olcUpdateRef: ldap://lin-pdc1.lin PDC: root@lin-pdc1:/etc/ldap/slapd.d/cn=config/olcDatabase={1}hdb#<mailto:root@lin-pdc1:/etc/ldap/slapd.d/cn=config/olcDatabase=%7b1%7dhdb#> cat olcOverlay\=\{0\}syncprov.ldif # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 59e49836 dn: olcOverlay={0}syncprov objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpNoPresent: TRUE structuralObjectClass: olcSyncProvConfig entryUUID: 977916ca-b8a5-1037-9fec-c19e1fce1248 creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20180310115454Z entryCSN: 20180310115454.449597Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20180310115454Z root@lin-pdc1:/etc/ldap/slapd.d/cn=config/olcDatabase={1}hdb#<mailto:root@lin-pdc1:/etc/ldap/slapd.d/cn=config/olcDatabase=%7b1%7dhdb#> cat olcOverlay\=\{1\}accesslog.ldif # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 98b496b3 dn: olcOverlay={1}accesslog objectClass: olcOverlayConfig objectClass: olcAccessLogConfig olcOverlay: {1}accesslog olcAccessLogDB: cn=accesslog olcAccessLogOps: writes olcAccessLogPurge: 07+00:00 01+00:00 olcAccessLogSuccess: TRUE structuralObjectClass: olcAccessLogConfig entryUUID: 97792548-b8a5-1037-9fed-c19e1fce1248 creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20180310115454Z entryCSN: 20180310115454.449968Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20180310115454Z Results - When the sync was first setup, the ldap data from PDC to BDC replicated. - The following shows the replication is happening. Not sure if the CSN is meant to be different root@lin-pdc2:/tmp/smbldap_files_lin-pdc2/ldifs# ldapsearch -z1 -LLLQY EXTERNAL -H ldapi:/// -s base -b dc=lin contextCSN dn: dc=lin contextCSN: 20180312013413.103495Z#000000#000#000000 root@lin-pdc1:/etc/ldap/slapd.d/cn=config/olcDatabase={1}hdb#<mailto:root@lin-pdc1:/etc/ldap/slapd.d/cn=config/olcDatabase=%7b1%7dhdb#> ldapsearch -z1 -LLLQY EXTERNAL -H ldapi:/// -s base -b dc=lin contextCSN dn: dc=lin contextCSN: 20180312065856.371133Z#000000#000#000000 - The replication stopped working after the initial dump. Logs from PDC and BDC below PDC slapd[25513]: hdb_db_open: warning - no DB_CONFIG file found in directory /var/lib/ldap/accesslog: (2).#012Expect poor performance for suffix "cn=accesslog". slapd starting slapd[25513]: findbase failed! 32 BDC slapd[9799]: do_syncrep2: rid=000 LDAP_RES_SEARCH_RESULT (32) No such object slapd[9799]: do_syncrep2: rid=000 (32) No such object slapd[9799]: do_syncrepl: rid=000 rc -2 retrying Troubleshooting steps: - Used IP instead of hostname - Used the samba.ldif (schema) file from Samba 3 (BDC) for both PDC and BDC. This is to potentially mitigate issues due to different schema versions - Confirmed that the cn=admin,dc=lin password across both DCs are same. Can anyone please advise as to where the issue could be? Regards, Praveen Ghimire

2 1

new attribute
by Alexander Schwarz 16 Mar '18

16 Mar '18

Hello, I tried to create a new objectclass and a new attribute to develop scripts to use against an ActiveDirectory. objectlass=user attribute=sAMAccountName I have a new test.schema: attributetype ( 1.2.840.113556.1.4.221 NAME 'sAMAccountName' EQUALITY caseIgnoreMatch SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' SINGLE-VALUE ) objectclass ( 1.2.840.113556.1.5.9 NAME 'user' DESC 'a user' SUP inetOrgPerson STRUCTURAL MUST ( cn ) MAY ( sAMAccountName ) ) This is included in slapd.conf: include ./schema/core.schema include ./schema/cosine.schema include ./schema/nis.schema include ./schema/inetorgperson.schema include ./schema/openldap.schema include ./schema/pmi.schema include ./schema/ppolicy.schema include ./schema/dyngroup.schema include ./schema/test.schema I tried to modify a dummy user after restart ldap. modify.ldif: dn: cn=test test,ou=Benutzer,ou=Netzwerk,dc=network,dc=de changetype: modify add: sAMAccountName sAMAccountName: test I used the ldapmodify tool: ldapmodify -a -x -D "cn=admin,dc=network,dc=de" -w passwd -H ldap:// -f d:\modify.ldif Eintrag cn=test test,ou=Benutzer,ou=Netzwerk,dc=network,dc=de wird geändert ldap_modify: Objektklassenverletzung ldap_modify: Zusätzliche Info: attribute 'sAMAccountName' not allowed Can someone explain to me where is the mistake? Regards, Alex

3 2

cannot fetch base DNS from replica
by Eugene M. Zheganin 08 Mar '18

08 Mar '18

Hi, previously I succeeded several times on setting up the replication, but this time I'm stuck. The only difference is that now the database is in mdb (since bdb is obsoleted). ldapsearch is able to fetch all the entries from both hosts (I've tried the replication with mirrormode and without it - same result), the numResponses: 189 is both times, but on "replica" (doesn't matter whether the mirrormode is on or off) the Apache Directory Studio is not able to browse the tree, because it says "cannot fetch Base DNs" (so it is only showing the Roor DSE), thus I'm sure there's something wrong. here are my configs (I've skipped the accesslog and ppolicy overlays since their configuration seems not to be the problem): Host A ==== serverID 1 database mdb suffix "dc=playkey,dc=net" rootdn "cn=webmaster,dc=playkey,dc=net" rootpw {SSHA}XXXXXXXXXXXXXXXXXXXXXXXX directory /var/db/openldap-data overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 syncrepl rid=001 provider=ldap://foobar1:389 type=refreshAndPersist interval=00:00:10:00 retry="60 10 300 +" filter="(objectClass=*)" searchbase="dc=playkey,dc=net" attrs="*,+" schemachecking=off bindmethod=simple binddn="uid=proxyagent,ou=accounts,ou=enaza,dc=playkey,dc=net" credentials=ghjcnbvtyzvjzk.,jdm mirrormode on Host B ==== serverID 2 database mdb suffix "dc=playkey,dc=net" rootdn "cn=webmaster,dc=playkey,dc=net" rootpw {SSHA}XXXXXXXXXXXXXXXXXXXXXXXXXX directory /var/db/openldap-data overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 syncrepl rid=001 provider=ldap://foobar2:389 type=refreshAndPersist interval=00:00:10:00 retry="60 10 300 +" filter="(objectClass=*)" searchbase="dc=playkey,dc=net" attrs="*,+" schemachecking=off bindmethod=simple binddn="uid=proxyagent,ou=accounts,ou=enaza,dc=playkey,dc=net" credentials=ghjcnbvtyzvjzk.,jdm mirrormode on So, how do I investigate what's wrong with base DNs on teh host B ? Thanks. Eugene.

2 1

dynamic config replication
by Gerard Ranke 07 Mar '18

07 Mar '18

Hello list, Openldap 2.4.45 here, on 1 producer and 4 consumers. ( I'll attach relevant parts of the configuration at the end of this message. ) Following the scripts from test059, I configured the producer to serve up a cn=config backend for the consumers. This seems to work nicely at first: When you start a consumer from a minimal config, it loads the producers schemafiles and the cn=config, and replication of the main database is fine. Also, when fi. changing the loglevel on the producers cn=config,cn=slave, the consumers pick up this change in their cn=config. However, when I modify an olcAccess line on the producers cn=config,cn=slave database, I get these errors on the consumer: slapd[26324]: syncrepl_message_to_entry: rid=002 DN: olcDatabase={1}mdb,cn=config,cn=slave, UUID: 7cff5ef6-90b1-1037-9d95-6dfd3149c2dc slapd[26324]: syncrepl_entry: rid=002 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) slapd[26324]: syncrepl_entry: rid=002 inserted UUID 7cff5ef6-90b1-1037-9d95-6dfd3149c2dc slapd[26324]: syncrepl_entry: rid=002 be_search (0) slapd[26324]: syncrepl_entry: rid=002 olcDatabase={1}mdb,cn=config slapd[26324]: null_callback : error code 0x43 slapd[26324]: syncrepl_entry: rid=002 be_modify olcDatabase={1}mdb,cn=config (67) slapd[26324]: syncrepl_entry: rid=002 be_modify failed (67) slapd[26324]: do_syncrepl: rid=002 rc 67 retrying >From the error code ox43, it seems that the replication is somehow trying to change the rdn, olcDatabase{1}mdb, on the consumer, which makes no sense to me. >From the producer, cn=config,cn=slave: ( This is identical to the consumer's cn=config ) dn: cn=config,cn=slave objectClass: olcGlobal objectClass: olcConfig objectClass: top cn: slaveconfig cn: config olcArgsFile: /var/run/slapd/slapd.args olcAttributeOptions: lang- olcAuthzPolicy: none olcConcurrency: 0 olcConfigDir: slapd.d/ olcConnMaxPending: 100 olcConnMaxPendingAuth: 1000 olcGentleHUP: FALSE olcIdleTimeout: 0 olcIndexIntLen: 4 olcIndexSubstrAnyLen: 4 olcIndexSubstrAnyStep: 2 olcIndexSubstrIfMaxLen: 4 olcIndexSubstrIfMinLen: 2 olcLocalSSF: 71 olcLogFile: none olcLogLevel: none olcPidFile: /var/run/slapd/slapd.pid olcReadOnly: FALSE olcSaslSecProps: noplain,noanonymous olcSizeLimit: 20000 olcSockbufMaxIncoming: 262143 olcSockbufMaxIncomingAuth: 16777215 olcThreads: 16 olcTLSCACertificatePath: /etc/ssl/certs olcTLSCertificateFile: /etc/ssl/certs/hkuwildcardcacert.cert olcTLSCertificateKeyFile: /etc/ssl/private/hkuwildcardcacert.key olcTLSCRLCheck: none olcTLSVerifyClient: never olcToolThreads: 2 I'll leave the rest PM, except for: dn: olcDatabase={0}config,cn=config,cn=slave objectClass: olcDatabaseConfig objectClass: olcConfig objectClass: top olcDatabase: {0}config olcRootDN: cn=root,cn=config olcRootPW: xxxxxxxxxxxxxx olcSyncrepl: {0}rid=002 provider=ldap://xxx.xx.xx bindmethod=simple binddn="cn=config,cn=slave" credentials="xxxx" tls_cert="/etc/ssl/certs/xxx.cert" tls_key="/etc/ssl/private/xxx.key" tls_cacertdir="/etc/ssl/certs" tls_reqcert=demand tls_crlcheck=none searchbase="cn=config,cn=slave" schemachecking=off type=refreshAndPersist retry="5 5 10 +" suffixmassage="cn=config" olcSyncUseSubentry: FALSE This is identical to the consumers olcDatabase={0}config,cn=config entry. Hopefully somebody can point me in the right direction! Many thanks in advance, gerard

3 4

RE24 testing call (2.4.46) LMDB RE0.9 testing call (0.9.22)
by Quanah Gibson-Mount 01 Mar '18

01 Mar '18

This is expected to be the final testing call for 2.4.45, with an anticipated release, depending on feedback, during the week of 2018/03/12. For this release the primary focus was addressing replication issues found in OpenLDAP, affecting both syncrepl and delta-syncrepl, whether as provider/consumer or MMR-based configurations. Generally, get the code for RE24: <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> Configure & build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its run through the regression suite. Thanks! OpenLDAP 2.4.46 Engineering Fixed libldap connection delete callbacks when TLS fails to start (ITS#8717) Fixed libldap to not reuse tls_session if TLS hostname check fails (ITS#7373) Fixed libldap cross-compiling with OpenSSL 1.1 (ITS#8687) Fixed libldap OpenSSL 1.1.1 compatibility with BIO_method (ITS#8791) Fixed libldap MozNSS CA certificate hash matching (ITS#7374) Fixed libldap MozNSS with PEM certs when also using an NSS cert db (ITS#7389) Fixed libldap MozNSS initialization (ITS#8484) Fixed libldap GnuTLS with GNUTLS_E_AGAIN (ITS#8650) Fixed libldap memory leak with cancel operations (ITS#8782) Fixed slapd Eventlog registry key creation on 64-bit Windows (ITS#8705) Fixed slapd to maintain SSF across SASL binds (ITS#8796) Fixed slapd syncrepl deadlock when updating cookie (ITS#8752) Fixed slapd syncrepl callback to always be last in the stack (ITS#8752) Fixed slapd telephoneNumberNormalize when the value is spaces and hyphens (ITS#8778) Fixed slapd CSN queue processing (ITS#8801) Fixed slapd-ldap TLS connection timeout with high latency connections (ITS#8720) Fixed slapd-ldap to ignore unknown schema when omit-unknown-schema is set (ITS#7520) Fixed slapd-mdb with an optimization for long lived read transactions (ITS#8226) Fixed slapd-meta assert when olcDbRewrite is modified (ITS#8404) Fixed slapd-sock with LDAP_MOD_INCREMENT operations (ITS#8692) Fixed slapo-accesslog cleanup to only occur on failed operations (ITS#8752) Fixed slapo-dds entryTTL to actually decrease as per RFC 2589 (ITS#7100) Fixed slapo-syncprov memory leak with delete operations (ITS#8690) Fixed slapo-syncprov to not clear pending operation when checkpointing (ITS#8444) Fixed slapo-syncprov to correctly record contextCSN values in the accesslog (ITS#8100) Fixed slapo-syncprov not to log checkpoints to accesslog db (ITS#8607) Fixed slapo-syncprov to process changes from this SID on REFRESH (ITS#8800) Fixed slapo-syncprov session log parsing to not block other operations (ITS#8486) Build Environment Fixed Windows build with newer MINGW version (ITS#8697) Fixed compiler warnings and removed unused variables (ITS#8578) Contrib Fixed ldapc++ Control structure (ITS#8583) Documentation Delete stub manpage for back-ldbm (ITS#8713) Fixed ldap_bind(3) to mention the LDAP_SASL_SIMPLE mechanism (ITS#8121) Fixed slapd-config(5) typo for olcTLSCipherSuite (ITS#8715) Fixed slapo-syncprov(5) indexing requirements (ITS#5048) LMDB 0.9.22 Engineering Fix regression with new db from 0.9.19 (ITS#8760) Fix liblmdb to build on Solaris (ITS#8612) Fix delete behavior with DUPSORT DB (ITS#8622) Fix mdb_cursor_get/mdb_cursor_del behavior (ITS#8722) --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

LMDB: EIO/MDB_INVALID and use of pwrite/pread
by opensource＠gmx-topmail.de 28 Feb '18

28 Feb '18

1 0

Acl on a replicated tree: unable to bind as user
by Giuseppe Civitella 27 Feb '18

27 Feb '18

Hi all, I've got a master / slave replica setup. I did use this tutorial to set up the replica: https://wiki.debian.org/LDAP/OpenLDAPSetup My ldap tree is something like: Root -> o=(first level local branch), o=(first level replicated branch). The local branch is just a cut and paste of the replicated branch. On the slave server I can use the replicated branch to authenticate against a Radius server. On the master server I realized I cannot let web users authenticate against the replicated branch. If I try to bind as a user from the replicated branch, on both the master and the slave, I get: ldapwhoami -H ldap://localhost -D "uid=gcivitella,ou=users,o=isiline,dc=who,dc=is" -W Enter LDAP Password: ldap_bind: Invalid credentials (49) On the master, on the local branch, I get: ldapwhoami -H ldap://localhost -D "cn=gcivitella,ou=users,o=area51,dc=who,dc=is" -W Enter LDAP Password: dn:cn=gcivitella,ou=users,o=area51,dc=who,dc=is I did try to configure the acl on the server to disallow anonymous bind. And, once found this problem, I did try to create a bind user (uid=read_only) able to read the replicated branch, userPassword attrs included. Unfortunately this did not solve the problem. My acl on the master are: dn: olcDatabase={1}mdb objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=who,dc=is olcAccess: {0}to dn.subtree="o=isiline,dc=who,dc=is" by dn="uid=read_only,ou =binds,dc=who,dc=is" read olcAccess: {1}to dn.subtree="o=isiline,dc=who,dc=is" by dn="uid=isi_replica, ou=binds,dc=who,dc=is" read olcAccess: {2}to attrs=userPassword by self write by anonymous auth by * non e olcAccess: {3}to attrs=shadowLastChange by self write by * read olcAccess: {4}to * by users read I'm quite new to this kind of setup, is this something to be expected? Is there a way to bind directly on the replicated branch? Regards, Giuseppe

2 1

LMDB: Delete data after MDB_MAP_FULL
by opensource＠gmx-topmail.de 26 Feb '18

26 Feb '18

2 1

Re: Syncrepl and multipe values
by Quanah Gibson-Mount 24 Feb '18

24 Feb '18

--On Friday, January 06, 2017 6:50 PM +0000 Matheus Eduardo Bonifacio Morais <matheus_morais(a)sicredi.com.br> wrote: > > > > Issue 8559 opened. > > > > I'm trying to work on a patch but I'm not sure if the best solution is to > fix accesslog to avoid duplicated values or if the sample LDIF (in its > description) should result in a constraint violation. What do you think? The accesslog should never write an operation that can't be replicated. If the MOD is a valid LDAP operation (which I think it is), then it should be accepted at the frontend. The issue may be more in delta-syncrepl's handling of the write op than anything else. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

3 3

consumer abort with chain overlay
by Michael Wandel 24 Feb '18

24 Feb '18

hallo , i'm not sure if I it is a configuration failure or a openldap error. I have tested this with centos 7 , original RPM, SLES12SP3 and the ltb-project binäries. Every enviroment failed. this is a setup consumer / provider with chain overlay and proxyauth. a minimized slapd.conf global section ... authz-policy to overlay chain chain-uri "ldap://ldap1.example.test" chain-rebind-as-user FALSE chain-idassert-bind bindmethod="simple" binddn="cn=chainadmin,dc=example,dc=test" credentials="secret" mode=legacy flags=override chain-return-error TRUE ... the java code snipplet which makes a connection and then switch the proxyauth and make a password change. --- try { LDAPConnection connection = openLDAPConnection(); BindRequest bindRequest = new SimpleBindRequest(modDN, oldPwd, new DraftBeheraLDAPPasswordPolicy10RequestControl()); BindResult bindResult = connection.bind(bindRequest); DraftBeheraLDAPPasswordPolicy10ResponseControl pwpResponse = DraftBeheraLDAPPasswordPolicy10ResponseControl.get(bindResult); DraftBeheraLDAPPasswordPolicy10WarningType warningType = pwpResponse.getWarningType(); System.out.println("Bind Result " + bindResult.toString()); System.out.println("PwdResponse " + pwpResponse.toString()); connection.close(); connection = openLDAPConnection(); Control[] controls = { new ProxiedAuthorizationV2RequestControl("dn:" + modDN) }; PasswordModifyExtendedRequest passwordModifyRequest = new PasswordModifyExtendedRequest(modDN, oldPwd, newPwd, controls); PasswordModifyExtendedResult passwordModifyResult = (PasswordModifyExtendedResult) connection .processExtendedOperation(passwordModifyRequest); System.out.println("passwordModifyResult " + passwordModifyResult.toString()); connection.close(); connection = openLDAPConnection(); bindRequest = new SimpleBindRequest(modDN, newPwd, new DraftBeheraLDAPPasswordPolicy10RequestControl()); bindResult = connection.bind(bindRequest); pwpResponse = DraftBeheraLDAPPasswordPolicy10ResponseControl.get(bindResult); warningType = pwpResponse.getWarningType(); System.out.println("Bind Result " + bindResult.toString()); System.out.println("PwdResponse " + pwpResponse.toString()); } the gdb output of the crash is here: 5a8c6d3d conn=1001 op=1 RESULT oid= err=123 text=not authorized to assume identity *** Error in `/usr/local/openldap/libexec/slapd': munmap_chunk(): invalid pointer: 0x00007f2b14100986 *** ======= Backtrace: ========= /lib64/libc.so.6(+0x7ada4)[0x7f2d8a9d7da4] /usr/local/openldap/libexec/slapd(ldap_back_controls_free+0xc1)[0x5181a1] /usr/local/openldap/libexec/slapd[0x522ba8] /usr/local/openldap/libexec/slapd[0x51a959] /usr/local/openldap/libexec/slapd[0x51c193] /usr/local/openldap/libexec/slapd[0x4a5118] /usr/local/openldap/libexec/slapd[0x44f286] /usr/local/openldap/libexec/slapd[0x44f787] /usr/local/openldap/libexec/slapd(slap_send_ldap_extended+0xc0)[0x450880] /usr/local/openldap/libexec/slapd(fe_extended+0xba)[0x46f26a] /usr/local/openldap/libexec/slapd(overlay_op_walk+0x92)[0x4a5c42] /usr/local/openldap/libexec/slapd[0x4a5d7e] /usr/local/openldap/libexec/slapd(do_extended+0x24e)[0x46efbe] /usr/local/openldap/libexec/slapd[0x4407ee] /usr/local/openldap/libexec/slapd[0x440aca] /usr/local/openldap/libexec/slapd[0x590769] /lib64/libpthread.so.0(+0x7dc5)[0x7f2d8be00dc5] /lib64/libc.so.6(clone+0x6d)[0x7f2d8aa5473d] ======= Memory map: ======== 00400000-00683000 r-xp 00000000 fd:00 68054818 /usr/local/openldap/libexec/slapd 00882000-00883000 r--p 00282000 fd:00 68054818 /usr/local/openldap/libexec/slapd 00883000-00893000 rw-p 00283000 fd:00 68054818 /usr/local/openldap/libexec/slapd 00893000-00939000 rw-p 00000000 00:00 0 022d2000-02768000 rw-p 00000000 00:00 0 [heap] 7f2b14000000-7f2b1411f000 rw-p 00000000 00:00 0 7f2b1411f000-7f2b18000000 ---p 00000000 00:00 0 7f2b1afff000-7f2b1c000000 rw-p 00000000 00:00 0 7f2b1c000000-7f2b1c021000 rw-p 00000000 00:00 0 7f2b1c021000-7f2b20000000 ---p 00000000 00:00 0 7f2b20000000-7f2b20117000 rw-p 00000000 00:00 0 7f2b20117000-7f2b24000000 ---p 00000000 00:00 0 7f2b24000000-7f2b24021000 rw-p 00000000 00:00 0 I'm not sure if it is a known bug or misconfiguration. If someone wants the java testprogram i'll can send it per pm or give a download link. best regards Michael -- Michael Wandel Braakstraße 43 33647 Bielefeld

2 1

contextCSN not found on consumer!
by Sam Culley 24 Feb '18

24 Feb '18

I have recently set up a provider/consumer using OpenLDAP 2.4.40, everything appears to be working. Changes made on the provider are replicated to the consumer but when querying the contextCSN I am only able to retrieve results for the provider. [root@prod-mail-ldap-master ~]# ldapsearch -z1 -LLLQY EXTERNAL -H ldapi:/// -s base -b dc=domain,dc=cp, contextCSN dn: dc=domain,dc=com contextCSN: 20180222075803.816626Z#000000#000#000000 [root@prod-mail-ldap-slave-1 ~]# ldapsearch -z1 -LLLQY EXTERNAL -H ldapi:/// -s base -b dc=domain,dc=cp, contextCSN dn: dc=domain,dc=com As you can see from the command outputs above when running the same commands on both provider/consumer only the provider returns the contextCSN. Why is this happening, what do I need to do to retrieve the contextCSN from the consumer? Regards, Sam

2 1

IETF opinion change on "implicit TLS" vs. StartTLS
by Michael Ströder 17 Feb '18

17 Feb '18

HI! To me this rationale for SMTP submission with implicit TLS seems also applicable to LDAPS vs. StartTLS: https://tools.ietf.org/html/rfc8314#appendix-A So LDAPS should not be considered deprecated. Rather it should be recommended and the _optional_ use of StartTLS should be strongly discouraged. Ciao, Michael.

4 6

Re: placeholder problems
by Côme Chilliet 12 Feb '18

12 Feb '18

Le jeudi 8 février 2018, 09:59:03 CET Joeri Casteels a écrit : > Now i would like to assign them directly to the correct unix group depending on the base you start from or Primary group you select. > If i use this placeholder:Home directory*: /home/%primaryGroup%/%uid% i get the option in the template to select my primary group but it does not fill in the Home Directory correct nor it fills in the correct group. Hum primaryGroup is not an LDAP field so I don’t think you can use it like that. You can use %gidNumber% but I’m not sure it will help. You can open an issue to make the primary group name available as %primaryGroup% in templates but I can’t guarantee it will be added. > Also setting the passord expiration does not work correctly with the info on the website under placeholder i tried epoch time and it does not work at all to fetch the day of today and add 4years on top for example. Even just fetching the day of today does not work under unix Password Expiration data: The epoch modifier was added in FusionDirectory 1.2.1 which is not out yet. > Then there is another small matter i would like to know if there is an easy change for this. My users are allowed to change some info on their own but non of them find the edit button since it’s in the bottom right corner where nobody looks. Is it possible to make these buttons directly under the last frame? Can i edit this myself in de code? You can create you own CSS theme in which you can change the button display. See https://fusiondirectory-developer-documentation.readthedocs.io/en/latest/th… Côme

1 0

Re: plugin rsyslog
by Côme Chilliet 07 Feb '18

07 Feb '18

Le mercredi 7 février 2018, 15:59:18 CET Albert Shih a écrit : > Hi everyone, > > I try to install the rsyslog plugin but failed with this message The rsyslog plugin was removed some versions ago. > If it's the case how can I keep a log of « who do this, who do that ? » If what you want is to track what users are doing inside FD, you can use the audit plugin. Côme

1 0

openldap replication and server redirect
by Real, Elizabeth (392K) 02 Feb '18

02 Feb '18

Openldap gurus, This maybe a networking issue rather than configuration but I thought I’d run it by you guys to see if this can work. For replication, does ldap care whether I use a server redirect on the /etc/hosts file rather than the actual FQDN or IP address? I have two ldap systems behind a firewall with ldap ports 389 and 636 allowed thru. A redirect was setup to be able to get to these two systems. I set up a third ldap server outside the firewall and could not get it to replicate with other two servers by using the allowed redirect address. The two internal system replicate data just fine. So for example, it is suggested to add the 3 servers FQDN and IP addresses each of their /etc/hosts file and ensure they can see/communicate with eachother. /etc/hosts: Server1.local.srv Server2.local.srv Server3.local.srv My setup looks like this: /etc/hosts Server1andserver2redirect.local.srv (redirect that routes ldap traffic to the two internal servers) Server3.local.srv Can this work? If yes, what am I missing? Thank you, Liz

2 1

Re: Ldap crash with Error "Assertion 'NUMKEYS(mp) > 1' failed in mdb_page_search_root()"
by Quanah Gibson-Mount 30 Jan '18

30 Jan '18

--On Tuesday, January 30, 2018 1:15 PM -0800 rammohan ganapavarapu <rammohanganap(a)gmail.com> wrote: > > One more question i have is, i have installed openldap-2.4.44 but i have > not installed lmdb rpm but i have configured my ldap to use mdb as > backend so now is it really using mdb or some thing else? RHEL may have compiled liblmdb in statically. That's the default configuration for OpenLDAP. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: Ldap crash with Error "Assertion 'NUMKEYS(mp) > 1' failed in mdb_page_search_root()"
by Quanah Gibson-Mount 30 Jan '18

30 Jan '18

--On Tuesday, January 30, 2018 12:01 PM -0800 rammohan ganapavarapu <rammohanganap(a)gmail.com> wrote: > > Quanah, > > > openldap-2.4.44 rpm provided by redhat repo is by defaulting > installing libdb-5.3, so do i have to build rpms with LMDB to get this > fix? It is generally advised to not use the builds provided by RedHat, including their lack of LMDB support. Other options include the LTB project (<https://ltb-project.org/download#openldap>) which include LMDB support along with BDB and require no support contract. Alternatively, the company I work for (Symas) provides builds of OpenLDAP backed by LMDB, but ones that allow for replication require a support contract. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Ldap crash with Error "Assertion 'NUMKEYS(mp) > 1' failed in mdb_page_search_root()"
by Quanah Gibson-Mount 30 Jan '18

30 Jan '18

--On Tuesday, January 30, 2018 8:53 AM -0800 rammohan ganapavarapu <rammohanganap(a)gmail.com> wrote: > > Quanah, > > > Thank you, where can i read more about the reason for this issue and > how it got fixed jut for my understanding? Hi, You can find the details in the ITS I referenced: <http://www.openldap.org/its/index.cgi/?findid=8336> --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Ldap crash with Error "Assertion 'NUMKEYS(mp) > 1' failed in mdb_page_search_root()"
by Quanah Gibson-Mount 30 Jan '18

30 Jan '18

--On Tuesday, January 30, 2018 8:38 AM -0800 rammohan ganapavarapu <rammohanganap(a)gmail.com> wrote: > > Hi, > > > I am using "openldap-2.4.43" with MDB as backend DB, trying to run some > load test before i deploy it in prod, while i am running add or delete > operations ldap is crashing with the following error. > > > ../../../../servers/slapd/back-mdb/../../../libraries/liblmdb/mdb.c:5276: > Assertion 'NUMKEYS(mp) > 1' failed in mdb_page_search_root() This is ITS#8336, fixed in OpenLDAP 2.4.44/LDMB 0.9.18. I suggest you upgrade to the current OpenLDAP Release (2.4.45/LMDB 0.9.21) -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Exponential increase in Free Pages
by John Holder 30 Jan '18

30 Jan '18

Hi OpenLdap list I have a question on how to interprite the Free Pages stat from mdb_copy. I may be reading this particular stat wrong. After using the compact utility from mdb_copy -c, free page count will start at zero and immediately increase to where it left off before the compact then increases by a few. I was just wondering if the free pages count is actually a free pages pointer where it left off instead of a count of total free pages. Is it possible that the sparse file needs holes dug in using fallocate -d or something else. Thank you!

1 0

Partial OpenLDAP replication
by Paulo Coimbra 29 Jan '18

29 Jan '18

Hi everybody, I need to replicate part of our OpenLDAP Directory (Main) to other openLDAP servers (Customers), like this: MAIN...................................CUSTOMER OU=People,dc=XXX ---> OU=XXX_Users,dc=XXX **OR** Customer's LDAP query at Main (if a user is not found on Customer LDAP database) without any kind of replication (I really prefer this). How can I do this? Any Sugestion? -- br, Paulo Coimbra

1 0

Re: publisher migration or upgrade
by Scott Bickford 25 Jan '18

25 Jan '18

Quaanh, I did not use -q on slapadd. Essentially I do a slapadd -f /etc/openldap/slapd.conf -b o=myco,c=us, -v -w > load_myco.log We have three databases, so there are three slapadd above with -b o=myapps,c=us -v -w > load_apps.log and a -b o=mycust,c=us -v -w > load_cust.log We have a very large custom schema and three databases, so we are still using slapd.conf instead of cn=config. The schema dates back to the 1990s. The database is "bdb" on all three schemas. The three production subscribers are load balanced and just one publisher, which is not load balanced. It is used by some java applications (which are also clustered) for updates. I am hoping that we can replace subscribers over the course of several weeks since there is quite a bit involved and have them up and running in production with the publisher still on 2.4.40 and the subscribers on 2.4.44. I am working with a VMWare person on planning how we are going to rename the servers.

2 2

Pending EPIPE fix for macOS
by Lorenz Bauer 25 Jan '18

25 Jan '18

Hello Howard, List, My bug and corresponding patch seems to have fallen through the cracks: http://www.openldap.org/its/index.cgi?findid=8590 Could you have a look and let me know whether you'd like any modifications? Best Lorenz -- Lorenz Bauer | Systems Engineer 25 Lavington St., London SE1 0NZ www.cloudflare.com

3 3

Re: Pending EPIPE fix for macOS
by Lorenz Bauer 25 Jan '18

25 Jan '18

Hello Quanah, I have access to a macOS system, is there a test suite I can run which would help? Best Lorenz On 24 January 2018 at 17:39, Quanah Gibson-Mount <quanah(a)symas.com> wrote: > Hi Lorenz, > > The issue hasn't been lost, but we don't have easy access to an OSX system > to test against. We'll see what we can get set up. > > --Quanah > > > --On Tuesday, January 23, 2018 2:17 PM +0000 Lorenz Bauer < > lmb(a)cloudflare.com> wrote: > > >> >> >> >> >> Hello Howard, List, >> >> My bug and corresponding patch seems to have fallen through the cracks: >> http://www.openldap.org/its/index.cgi?findid=8590 >> >> Could you have a look and let me know whether you'd like any >> modifications? >> >> Best >> Lorenz >> >> >> >> >> >> >> -- >> >> Lorenz Bauer | Systems Engineer >> 25 Lavington St., London SE1 0NZ >> >> www.cloudflare.com >> > > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > > -- Lorenz Bauer | Systems Engineer 25 Lavington St., London SE1 0NZ www.cloudflare.com

1 0

Using virtual IP and N-way mutlimaster mode
by Clément OUDOT 24 Jan '18

24 Jan '18

Hello, I would like to use the N-way mutlimaster mode and a virtual IP to manage failover for applications. The virtual IP will be configured trough keepalived. To work with N-way mutlimaster, we must start OpenLDAP process on the LDAP URI defined in cn=config olcServerID parameter. So we can't use ldap://* to start the service. On the machine running the virtual IP, I can of course listen on this IP by adding an LDAP URI in the start command: slapd -h ldap://master1.example.com ldap://virtual.example.com But this command will not work it the virtual IP is not set on the node as OpenLDAP refuses to start on an unknown IP. Does anyone already face this issue and found a solution? Clément.

7 19

publisher migration or upgrade
by Scott Bickford 24 Jan '18

24 Jan '18

I have a RHEL 6 OpenLDAP 2.4.40 publisher with three subscribers in production of the same version. In development i also have a RHEL 6 OpenLDAP 2.4.40 and one subscriber of the same version. I got a RHEL 7 OpenLDAP 2.4.44 subscriber replicating in development. I was able to load via slapadd the subscriber in about 30 minutes from an overnight slapcat ldif.files from the publisher. How can I upgrade the publisher without too much down time and ultimately do the same in production? I want to also keep the same host names.

2 1

Re: uidNumber for Service Accounts?
by Douglas Duckworth 22 Jan '18

22 Jan '18

Hi Michael I added it using ldapadd. I removed the account ObjectClass and now only use applicationProcess: # preset, Service Accounts, blah dn: uid=preset,ou=Service Accounts,dc=blah objectClass: top objectClass: extensibleObject objectClass: applicationProcess uid: preset cn: preset sn: preset givenName: preset title: Password Reset Account description: Service Account For Resetting Passwords Thanks, Douglas Duckworth, MSc, LFCS HPC System Administrator Scientific Computing Unit Physiology and Biophysics Weill Cornell Medicine E: doug(a)med.cornell.edu O: 212-746-6305 F: 212-746-8690 On Mon, Jan 8, 2018 at 4:49 PM, Michael Ströder <michael(a)stroeder.com> wrote: > Douglas Duckworth wrote: > > adding new entry "uid=preset,ou=Service Accounts,dc=blah > > ldap_add: Object class violation (65) > > additional info: invalid structural object class chain > > (account/applicationProcess) > > A directory entry must have a *single* structural object class. While > there are usually multiple structural object classes listed only one of > them is *the* structural object class. The others are parent object > classes of the structural object class. > > Since 'account' and 'applicationProcess' both directly SUP abstract > object class 'top' they count as two distinct structural object classes. > > > Though this does work as it's now in the LDAP server: > > > > dn: uid=preset,ou=Service Accounts,dc=blah > > objectClass: top > > objectClass: account > > objectClass: applicationProcess > > objectClass: simpleSecurityObject > > It's invalid and you might run into issues modifying this entry later. > You should choose either 'account' or 'applicationProcess'. > > BTW: It should normally not be possible to add such entry. > How did you add it? With slapadd or by using Relax Rules Control? > > Ciao, Michael. > >

1 0

[Q] how to add country attribute to organizationalUnit objectclass?
by Zeus Panchenko 19 Jan '18

19 Jan '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 hi, I'm using organizationalUnit to hold organization related data and I'm wondering, how can I add country attribute to the object? I find it stumbling, all other address attributes are available but country ... I'd like to be able to do something like this: - ---[ fake object quotation start ]------------------------------------------- dn: ou=starfleet,ou=Organizations,dc=umidb associatedDomain: starfleet.startrek.in businessCategory: deep-space exploratory businessCategory: peacekeeping businessCategory: military service l: Fort Baker c: us objectClass: country objectClass: top objectClass: organizationalUnit objectClass: domainRelatedObject ou: starfleet physicalDeliveryOfficeName: Starfleet LLC postalAddress: here the address to be added postalCode: 12345 postOfficeBox: 1a registeredAddress: here the address to be added too st: California street: Space St. telephoneNumber: 922 - ---[ fake object quotation end ]------------------------------------------- - -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET) -----BEGIN PGP SIGNATURE----- iEYEARECAAYFAlphvyQACgkQr3jpPg/3oyr49QCfW+SAQZeq9orhQasTuqtb2A2E KZAAoLnO8DlP7z6bkNDe2JUKw9+JbnlI =9epg -----END PGP SIGNATURE-----

2 1

Slapd pegs CPU every ten minutes
by Singley, Norman 18 Jan '18

18 Jan '18

Hi folks - I have an issue with oldap 2.36 in which every ten minutes, slapd starts consuming all available CPU resources briefly. When this happens ldap searches timeout. I have bumped up the cache size to 1.5 GB dn2id.bdb and id2entry.bdb are approx. 60 mb combined. I'm reading through this: https://www.openldap.org/devel/admin/tuning.html I get errors (mismatched version) when I run DB_STAT (database environment version mismatch) So, I don't have much more to report there. I set logging back to the default to minimize logging. There are three nodes in our cluster - one master. Is there anything else I can look at to help troubleshoot? I am wondering what would cause slapd to peg the cpu at exactly 10 minute intervals. Thanks for any help. Norman Singley Directory Services 406 243 6799 Norman.singley(a)mso.umt.edu

2 2

Re: Antw: RE: [EXTERNAL] Incosistent config after schema modification
by Quanah Gibson-Mount 15 Jan '18

15 Jan '18

--On Monday, January 15, 2018 8:21 AM +0100 Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de> wrote: > > >>>> Quanah Gibson-Mount <quanah(a)symas.com> schrieb am 11.01.2018 um 16:56 >>>> in > Nachricht <5066F03FF8233B456CA521B7(a)[192.168.1.30]>: >> --On Thursday, January 11, 2018 8:40 AM +0100 Ulrich Windl >> <Ulrich.Windl(a)rz.uni-regensburg.de> wrote: >> >>> But those weights are non-standard LDIF, right? >> >> OpenLDAP is the only directory server to implement >> draft-chu-ldap-xordered-00 so far as I know. However, there is no >> standard on how server configurations are managed, so it's rather >> immaterial. > > But the mechanism is independent from server management (talking about > LDIF), isn't it? Hi Ulrich, I'm not clear what you mean by "the mechanism". As far as I know, only OpenLDAP implements having weighted attributes, and as far as I know, only the OpenLDAP server has the concept of removing items in cn=config by weight, or of doing inserts using the weight, etc, which is something specific to the cn=config implementation in OpenLDAP. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: mdb fragmentation
by Quanah Gibson-Mount 15 Jan '18

15 Jan '18

--On Thursday, August 24, 2017 8:30 PM -0500 Quanah Gibson-Mount <quanah(a)symas.com> wrote: > Hi Geert, > > If I could, I would delete 8664 from the ITS system entirely as it was > filed based on invalid information that was provided to me. It generally > should be ignored. > > When a write operation is performed with LMDB, the freelist is scanned > for available space to reuse if possible. The larger the size of the > freelist, the longer amount of time it will take for the operation to > complete successfully. When the database has gotten to a certain point > of fragmentation (This differs based on any individual use case), it will > be start taking a noticeable amount of time for those write operations to > complete and the server processing the write operation does essentially > come to a halt during this process. Once the write operation completes, > things go back to normal. The only solution is to dump and reload the > database (slapcat/slapadd or mdb_copy -c). Eventually, you will get back > into the same situation and have to do this again. > > A recent option was added to the slapd-mdb configuration (rtxnsize) that > can also help reduce the rate of fragmentation. There are some > performance related issues you can find discussed on the -devel list from > when it was added. Whether or not you are affected by them and whether > or not the setting will help you in particular depends on whether or not > your searches result in a large number of entries being returned. You > can find some guidelines around tuning the parameter that I came up with > in that thread. If you do not have an unlimited Zimbra License, the > license check performed by the store servers will definitely affect this, > since the result set is all active accounts which can be quite large. > > Additionally, I had at one point had a patch for the Zimbra build of > OpenLDAP that made it very aggressive in finding freespace to reuse. I > don't recall if it is still applied (I don't believe it currently is > based on what I saw in github). It basically meant that in Zimbra, it > would work extra hard to find reusable freespace, which would reduce the > rate at which the database would fragment, but it also meant that once > the DB was fragmented enough, it would amplify the amount of time it took > for a write op to complete. I.e., it was a tradeoff of a longer time to > reach a catastrophic state, but the state was more catastrophic once > achieved. > > This is one area where LMDB differs significantly from back-hdb/bdb. You > could have back-bdb/hdb databases that endured a high rate of write > operations be in effect for years w/o needing maintenance. With LMDB, > you get better read & write rates, but it requires periodic reloads. I wanted to follow up on this, based on doing an examination of Geert's database, and other affected databases. Geert already has this answer, but it's useful for the general OpenLDAP community. This fragmentation problem is not common. It depends entirely on size of the entries in the database. The issue arises when entries in the LDAP DB are greater than the LMDB pagesize (Usually 4KB) and then have frequent updates. This most often occurs in one of two ways: a) multi-valued attributes with a large number of values b) a very large single-valued attribute (I.e., binary data) For the first problem (a), there is code in the 2.5 release to address this problem, called multival. This feature puts multi-valued attributes with a (configurable) number of values into its own sub-database. For (b), there's not really a solutionn, but it's pretty rare. So for those who have entries that are < 4 KB, they will never see this problem. Note that this is the size of the binary entry on disk, not the size of the entry when exported to LDIF. The binary size is generally significantly smaller than the LDIF version. --Quanah

3 2

Replication Broke
by Daniel Howard 13 Jan '18

13 Jan '18

Hello, He have OpenLDAP replication set up based on the docs at https://help.ubuntu.com/lts/serverguide/openldap-server.html#openldap-serve… I noticed recently a symptom, whereby a new user exists only on the primary. So, I started to debug: Master: (ldap0) 0-16:23 djh@ldap0 ~$ ldapsearch -z1 -LLLQY EXTERNAL -H ldapi:/// -s base -b dc=qxxxxxxxxd,dc=com contextCSN dn: dc=qxxxxxxxxd,dc=com contextCSN: 20180113002606.399160Z#000000#000#000000 Consumer: (ldap1) 0-16:23 djh@ldap1 ~$ ldapsearch -z1 -LLLQY EXTERNAL -H ldapi:/// -s base -b dc=qxxxxxxxxd,dc=com contextCSN dn: dc=qxxxxxxxxd,dc=com contextCSN: 20171121212631.416502Z#000000#000#000000 Ooohhh, my! I have a lot of messages like this on the consumer: Jan 12 16:28:55 ldap1 slapd[5383]: syncrepl_message_to_entry: rid=317 DN: uid=djh,ou=People,dc=qxxxxxxxxd,dc=com, UUID: 29f7fc06-7c2a-1035-83e5-9d6082b37970 Jan 12 16:28:55 ldap1 slapd[5383]: syncrepl_entry: rid=317 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Jan 12 16:28:55 ldap1 slapd[5383]: syncrepl_entry: rid=317 inserted UUID 29f7fc06-7c2a-1035-83e5-9d6082b37970 Jan 12 16:28:55 ldap1 slapd[5383]: dn_callback : entries have identical CSN uid=djh,ou=People,dc=qxxxxxxxxd,dc=com 20180113002133.183992Z#000000#000#000000 Jan 12 16:28:55 ldap1 slapd[5383]: syncrepl_entry: rid=317 be_search (0) Jan 12 16:28:55 ldap1 slapd[5383]: syncrepl_entry: rid=317 uid=djh,ou=People,dc=qxxxxxxxxd,dc=com Jan 12 16:28:55 ldap1 slapd[5383]: syncrepl_entry: rid=317 entry unchanged, ignored (uid=djh,ou=People,dc=qxxxxxxxxd,dc=com) Jan 12 16:28:55 ldap1 slapd[5383]: syncrepl_message_to_entry: rid=317 DN: uid=john,ou=People,dc=qxxxxxxxxd,dc=com, UUID: ddaae880-7c2f-1035-83ed-9d6082b37970 Jan 12 16:28:55 ldap1 slapd[5383]: syncrepl_message_to_entry: rid=317 mods check (pwdChangedTime: attribute type undefined) Jan 12 16:28:55 ldap1 slapd[5383]: do_syncrepl: rid=317 rc 17 retrying What is funny is I can, for example, change the loginshell on my account, and that replicates. Is the latter message about pwdChangedTime a clue that maybe I had a schema change on Master that hasn't been applied to Consumer? Please advise on where to look next? Thanks! -danny -- http://dannyman.toldme.com

1 1

proxyauth app against consumer with chainoverlay
by Michael Wandel 12 Jan '18

12 Jan '18

Hallo, we are testing some application that use proxyauth against an consumer with chain overlay with proxyauth. The oenldap version is 2.4.44 . I'm not sure, if i made a mistake or is it a general problem to work with proxyauth in a ldapmodify against a consumer with chain overlay with proxyauth configured ? It looks like, the provider doesn't see the proxyauth from the app request. If someone has a hint or using this construct, I would be grateful for a solution. best regards Michael Wandel

1 0

Incosistent config after schema modification
by Ervin Hegedüs 11 Jan '18

11 Jan '18

Hi there, here are a 3 member multimaster config with OpenLDAP 2.4.44 (Debian 9.3). We need a custom schema, so I've made that - everithing has worked as well, but the customer said he needs to modify some attribute type in the new custom schema. I've made an ldif: dn: cn={5}cppm,cn=schema,cn=config changetype: modify replace: olcAttributeTypes olcAttributeTypes: {0}( cppmAttrs:1 NAME 'cppmCreateTime' DESC 'Create time' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{20} SINGLE-VALUE ) olcAttributeTypes: {5}( cppmAttrs:6 NAME 'cppmExpireTime' DESC 'Expire time' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{20} SINGLE-VALUE ) olcAttributeTypes: {7}( cppmAttrs:8 NAME 'cppmActivationTime' DESC 'Activati on time' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{20} SINGLE-VALUE ) # ldapmodify -Y EXTERNAL -H ldapi:/// -f mod1.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "cn={5}cppm,cn=schema,cn=config" Then I'ld liked to add this new objectclass to a member of tree, but I got an error: "cppmDomainName: attribute type undefined" but - of corse - I've added this attribute to the original schema. So, I'ld like to backup the config database, but the slapcat said: # slapcat -b cn=config 5a562aa7 olcObjectClasses: value #0 olcObjectClasses: AttributeType not found: "cppmVisitorCompany" 5a562aa7 config error processing cn={5}cppm,cn=schema,cn=config: olcObjectClasses: AttributeType not found: "cppmVisitorCompany" slapcat: bad configuration file! What's happenned? What em'I wrong? And what should I do now? Thanks, a.

4 12

proxy/backend pointers
by David LaPorte 10 Jan '18

10 Jan '18

Sorry to re-send to the list, but I'm hopeful someone might have some thoughts on whether this might be possible! We have an old unsupported application that authenticates users using an LDAP bind. The credential used for authentication (and what all the internal authorizations are tied to) is employee ID. We are moving to LDAP directory that uses email address instead of employee ID as the DN - the employee ID is still present as an attribute in the new directory and the password remains the same. Since I can't modify the problematic application, it’s not going away anytime soon, and it’s the last thing holding up migration to the new directory system, I'm hoping that I can use OpenLDAP as a shim between the application and the new directory to do something like the following: * Collect credentials (employee_id, password) during bind * using a privileged service account, search/bind against the new directory to map employee ID attribute to email address DN (like mod_authz_ldap does it) * return the success/failure as result of original bind I would appreciate any ideas or pointers if this is possible or if there might be a better way. Thanks in advance! Dave David LaPorte david(a)davidlaporte.org

1 0

[Q] what is the best practice or right way to change schemas order for cn=config case?
by Zeus Panchenko 09 Jan '18

09 Jan '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 hi, what is the best practice or right way to change schemas order for cn=config case? 1. to move file? 2. to ldapmodify? for the one used to slapd.conf both of ways look weird ... :( - -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET) -----BEGIN PGP SIGNATURE----- iEYEARECAAYFAlo6mMsACgkQr3jpPg/3oypRzwCdHNMNgUewiolW91I7DB7cK5dE BqoAn0tXLDIMIBg0W9uG39pwN7LPRPth =jKuI -----END PGP SIGNATURE-----

3 3

Re: uidNumber for Service Accounts?
by Douglas Duckworth 08 Jan '18

08 Jan '18

Thanks everyone. I agree it would be ideal to differenaiate this account from others. So far it's in own OU while standard users are in People. Seeing an error. The ldif: dn: uid=preset,ou=Service Accounts,dc=blah objectClass: top objectClass: account objectClass: applicationProcess Enter LDAP Password: adding new entry "uid=preset,ou=Service Accounts,dc=blah ldap_add: Object class violation (65) additional info: invalid structural object class chain (account/applicationProcess) Sorry, I am LDAP padawan. Though this does work as it's now in the LDAP server: dn: uid=preset,ou=Service Accounts,dc=blah objectClass: top objectClass: account objectClass: applicationProcess objectClass: simpleSecurityObject uid: preset cn: preset sn: preset givenName: preset title: Password Reset Account description: Service Account For Resetting Passwords I will then great this account the ability to write to all users in People OU. Any security concerns? Thanks, Douglas Duckworth, MSc, LFCS HPC System Administrator Scientific Computing Unit Physiology and Biophysics Weill Cornell Medicine E: doug(a)med.cornell.edu O: 212-746-6305 F: 212-746-8690 On Wed, Dec 20, 2017 at 2:07 AM, Michael Ströder <michael(a)stroeder.com> wrote: > MJ J wrote: > > Service accounts typically use the simpleSecurityObject object class. > > But one needs an appropriate structural object class to add the entry. > 'simpleSecurityObject' is an auxiliary object class without any naming > attribute. > > Ciao, Michael. > > > On Tue, Dec 19, 2017 at 9:15 PM, Douglas Duckworth > > <dod2014(a)med.cornell.edu> wrote: > >> It seems I created this service account with posixAccount objectClass. > That > >> requires uidNumber. > >> > >> So I need to do some research on what's the appropriate objectClass for > this > >> service account. It's used by SSSD and Apache, for example, to perform > >> binds with our LDAP cluster since we do not allow anon binds. In > addtion > >> ACLs only permit this account, and the Manager, access to read the > entire > >> directory. > >> > >> From reading here http://www.zytrax.com/books/ldap/ape/#objectclasses I > >> think I would only need objectClass: account which the service account > >> already contains. So I could delete the posixAccount objectClass and > then > >> uidNumber, gidNumber, homeDirectory, and loginShell? > >> > >> Thanks, > >> > >> Douglas Duckworth, MSc, LFCS > >

2 1

OpenLDAP slave failure in case of master indisponibility
by Matthieu Cerda 02 Jan '18

02 Jan '18

Greetings, I am observing a rather strange issue in the following setup: * 1 OpenLDAP master server (2.4.31) * 4 OpenLDAP slave servers (2.4.40) * The OpenLDAP slaves do forward any update attempt to the master using the chain overlay / proxyauthz (mainly to update the pwdFailureTime attribute for ppolicy) If I try to shut the master down (for maintenance let's say), the slaves behave properly, then begin to deadlock one after each other after a few minutes (by deadlock I mean no log output anymore, and any ldapwhoami / ldapsearch request connects and then times out) On the attached image, I monitored at the same time one of the slaves using collectd, to keep an eye on cn=monitor data (the period between 15:24:30 and 15:26:00 has been extrapolated by Grafana, no data is available at this time since cn=monitor access also deadlocks) I can see that backload / pending threads and waiters seem to increase gradually until the server gets unresponsive. I found nothing on the ML (except https://www.openldap.org/lists/openldap-technical/200912/msg00112.html) or searching for clues, Is this predictable behavior or and obvious misconfiguration, or it is an interesting occastion to dig a bit deeper ? Thanks in advance, -- Matthieu Cerda Infrastructure, BU Means @ NBS System

2 2

openLDAP with let's encrypt SSL certificate
by Jonas Kellens 01 Jan '18

01 Jan '18

Hello I am trying to configure openLDAP on Centos 6.8 with SSL. LDAP version : @(#) $OpenLDAP: slapd 2.4.40 (May 10 2016 23:30:49) $ mockbuild@worker1.bsys.centos.org:/builddir/build/BUILD/openldap-2.4.40/openldap-2.4.40/build-servers/servers/slapd LDAP service is running with ldaps:// support : ps -ef | grep slap ldap 22182 1 0 20:07 ? 00:00:00 /usr/sbin/slapd -h ldap:/// ldaps:/// ldapi:/// -u ldap root 22193 22118 0 20:07 pts/0 00:00:00 grep slap netstat -plane | grep 636 tcp 0 0 0.0.0.0:636 0.0.0.0:* LISTEN 0 45649460 22182/slapd tcp 0 0 :::636 :::* LISTEN 0 45649461 22182/slapd When I try to do an LDAP search, it fails to connect and the log shows : Dec 31 13:02:12 slap01 slapd[23776]: conn=1119 fd=13 ACCEPT from IP=xx.xx.xx.xx:45426 (IP=0.0.0.0:636) Dec 31 13:02:12 slap01 slapd[23776]: conn=1119 fd=13 closed (TLS negotiation failure) My /etc/openldap/slapd.conf file has the following lines : TLSCACertificateFile /etc/letsencrypt/live/slap01.domain.tld/fullchain.pem TLSCertificateFile /etc/letsencrypt/live/slap01.domain.tld/cert.pem TLSCertificateKeyFile /etc/letsencrypt/live/slap01.domain.tld/privkey.pem What else do I need to make openLDAP work with my let's encrypt SSL-certificate ? I've tried adding : TLSCACertificatePath /usr/share/pki/ca-trust-source But no success. Kind regards Jonas.

2 1

Error in dnx509Normalize when adding userCertificate value
by Cédric Couralet 29 Dec '17

29 Dec '17

Hello all, I encountered a problem when importing several client certificate in usercertificate attribute. The error was : [15362]: >>> certificateExactNormalize: <0x7f07019a9100, 1745> [15362]: dnX509Normalize: <(null)> (21) [15362]: <<< certificateExactNormalize: <0x7f07019a9100, 1745> => <(err)> [15362]: <= str2entry NULL (ssyn_normalize 21) [15362]: conn=1591 op=17 RESULT tag=103 err=21 text=userCertificate;binary: value #0 normalization failed Looking through the certificateExactNormalize in sourcecode, it seems the problem comes from the normalization of IssuerDn. Sure enough, in my case the issuer dn is : CN = Certigna Services CA 2.5.4.97 = NTRFR-48146308100036 OU = 0002 48146308100036 O = DHIMYOTIS C = FR Openldap has problem with the "2.5.4.97 = NTRFR-48146308100036" part, it is declared as organizationIdentifier but don't appear in openldap core schema (yet ?). I managed to avoid the error by adding an attribute to schema but I'm wondering if there is not a better way to do it, and why is the normalize called here ? My ldap version is the debian one : # slapd -V @(#) $OpenLDAP: slapd (Apr 23 2013 12:16:04) $ root@lupin:/tmp/buildd/openldap-2.4.31/debian/build/servers/slapd Is an update sufficient? Thank you for your answers, Cédric Couralet

2 1

LDAP password policies don't seems to work
by André Rodier 24 Dec '17

24 Dec '17

Hello all, I have an LDAP server, that I use for system authentication, emails, etc, in a domain (homebox.space) I have the password policies defined in the LDAP database, but they don't seem to apply to the users when changing a password. Both "olcPPolicyDefault" and "olcPPolicyHashCleartext" are set up, but only the last is working, i.e. passwords sent in clear text by an LDAP client are automatically encrypted. There is an overlay entry for the domain, example: olcPPolicyDefault: cn=default,ou=pwpolicies,dc=homebox,dc=space and a correct entry "pwdPolicySubentry" for each user. However, when I try change the password with pam_ldap or using the roundcube password plugin, even the minimal length rule is ignored. The module configuration: > dn: cn=module{0},cn=config > objectClass: olcModuleList > cn: module{0} > olcModulePath: /usr/lib/ldap > olcModuleLoad: {0}back_mdb > olcModuleLoad: {1}ppolicy.la > olcModuleLoad: {2}deref.la > structuralObjectClass: olcModuleList > entryUUID: acbfbc52-7c3a-1037-9cc1-d74dec6fc011 > creatorsName: cn=admin,cn=config > createTimestamp: 20171223143824Z > entryCSN: 20171223143828.930245Z#000000#000#000000 > modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth > modifyTimestamp: 20171223143828Z The overlay configuration > dn: olcOverlay={0}ppolicy,olcDatabase={1}mdb,cn=config > objectClass: olcPPolicyConfig > objectClass: olcOverlayConfig > olcOverlay: {0}ppolicy > olcPPolicyDefault: cn=default,ou=pwpolicies,dc=homebox,dc=space > olcPPolicyHashCleartext: TRUE > olcPPolicyUseLockout: FALSE > olcPPolicyForwardUpdates: FALSE > structuralObjectClass: olcPPolicyConfig > entryUUID: affa09e0-7c3a-1037-956b-0f107d4f36ac > creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth > createTimestamp: 20171223143829Z > entryCSN: 20171223143829.643274Z#000000#000#000000 > modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth > modifyTimestamp: 20171223143829Z The policy: > dn: cn=default,ou=pwpolicies,dc=homebox,dc=space > pwdExpireWarning: 259200 > pwdMaxFailure: 5 > cn: default > objectClass: pwdPolicy > objectClass: person > objectClass: top > pwdMinLength: 8 > pwdCheckQuality: 0 > pwdAttribute: userPassword > pwdLockoutDuration: 0 > pwdInHistory: 0 > sn: default > pwdMaxAge: 31536000 > pwdGraceAuthNLimit: 0 > pwdFailureCountInterval: 300 > structuralObjectClass: person > entryUUID: b083c4d2-7c3a-1037-956d-0f107d4f36ac > creatorsName: cn=admin,dc=homebox,dc=space > createTimestamp: 20171223143830Z > entryCSN: 20171223143830.545905Z#000000#000#000000 > modifiersName: cn=admin,dc=homebox,dc=space > modifyTimestamp: 20171223143830Z Example of one user: > dn:: Y249QW5kcsOpIFJvZGllcixvdT11c2VycyxkYz1ob21lYm94LGRjPXNwYWNl > pwdPolicySubentry: cn=default,ou=pwpolicies,dc=homebox,dc=space > shadowMin: 0 > uid: andre > objectClass: top > objectClass: person > objectClass: posixAccount > objectClass: shadowAccount > objectClass: inetOrgPerson > loginShell: /bin/bash > shadowFlag: 0 > uidNumber: 1001 > shadowMax: 999999 > gidNumber: 1001 > homeDirectory: /home/users/andre > sn: Rodier > shadowInactive: -1 > mail: andre(a)homebox.space > givenName:: QW5kcsOp > shadowWarning: 7 > structuralObjectClass: inetOrgPerson > cn:: QW5kcsOpIFJvZGllcg== > entryUUID: b12c4db4-7c3a-1037-9572-0f107d4f36ac > creatorsName: cn=admin,dc=homebox,dc=space > createTimestamp: 20171223143831Z > userPassword:: e1NTSEF9SHllVitOazkyekNHYlIwbVRUdkZJZWFpVUo2WElSVWM= > pwdChangedTime: 20171223150211Z > entryCSN: 20171223150211.599058Z#000000#000#000000 > modifiersName: cn=admin,dc=homebox,dc=space > modifyTimestamp: 20171223150211Z > I have the whole source code here: https://github.com/progmaticltd/homebox/ The Ansible tasks I am using to configure the LDAP server are here: https://github.com/progmaticltd/homebox/blob/master/install/playbooks/roles… Any help welcome. Kind regards, André Rodier. PS: Merry Christmas / Happy new year / for those concerned.

2 2

Re: [Q] what is the best practice or right way to change schemas order for cn=config case?
by Howard Chu 21 Dec '17

21 Dec '17

Christian Kratzer wrote: > Hi, > > On Wed, 20 Dec 2017, Zeus Panchenko wrote: > >> -----BEGIN PGP SIGNED MESSAGE----- >> Hash: SHA1 >> >> hi, >> >> what is the best practice or right way to change schemas order for cn=config >> case? Use ldapmodrdn. >> >> 1. to move file? >> 2. to ldapmodify? >> >> for the one used to slapd.conf both of ways look weird ... :( > > for those cases that ldapmodify that does not work you can use slapcat > to dump all of the cn=config database edit it and reimport using slapadd. > > Adding -n0 to slapadd and slapcat makes it use the cn=config database. > > Greetings > Christian > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: uidNumber for Service Accounts?
by Douglas Duckworth 20 Dec '17

20 Dec '17

Thanks John and everyone else. It's only performing binds for Apache, and sssd, as I do not allow anon binds to the LDAP server. This particular account does not perform any interactive logins on *Nix boxes. Thanks, Douglas Duckworth, MSc, LFCS HPC System Administrator Scientific Computing Unit Physiology and Biophysics Weill Cornell Medicine E: doug(a)med.cornell.edu O: 212-746-6305 F: 212-746-8690 On Wed, Oct 25, 2017 at 9:18 PM, John Lewis <jl(a)hyperbolicinnovation.com> wrote: > On Wed, 2017-10-25 at 09:32 -0400, Douglas Duckworth wrote: > > Hi > > > > Do I need uidNumber for Service Accounts used for application / > > server binding if this user won't actually be resolved by sssd or > > nslcd? > > > > I set a very high uidNumber but eventually this will conflict with > > users as in my ignorance I didn't put this in a lower range. > > > > Thanks, > > > > Douglas Duckworth, MSc, LFCS > > HPC System Administrator > > Scientific Computing Unit > > Physiology and Biophysics > > Weill Cornell Medicine > > E: doug(a)med.cornell.edu > > O: 212-746-6305 > > F: 212-746-8690 > > It depends on weather your service account needs to login to a UNIX > compliant system or not. If the account doesn't have a uid, it will > most likely not be able to login as a standard UNIX account via LDAP. > > If the binds go directly to an application without going through an OS > authentication layer, for example a web user login, it probably doesn't > matter either way whether the account has a uidNumber set or not. If > you have an interaction with sssd or nslcd in the middle, you are going > to need the uidNumber attribute set. >

3 4

Re: use-case for clientctrls?
by Howard Chu 19 Dec '17

19 Dec '17

Michael Ströder wrote: > After so many years passing around parameter clientctrls (e.g. in a > wrapper module) I'm still wondering which use-cases this argument is > meant for. > > I only found [1] but this seems akward today anyway. Agreed, OID-based controls for client-side library behavior seems rather unwieldy. I would agree though, that per-request control of library behavior is a good thing. The C API still has no ldap_search() parameter for alias deref behavior. It's a bit ridiculous that it's a library-level option, since the option only has relevance to search requests. > Any more client controls? > > Ciao, Michael. > > [1] > https://tools.ietf.org/html/draft-ietf-ldapext-ldap-c-api-05#section-11.3.1 > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

use-case for clientctrls?
by Michael Ströder 18 Dec '17

18 Dec '17

After so many years passing around parameter clientctrls (e.g. in a wrapper module) I'm still wondering which use-cases this argument is meant for. I only found [1] but this seems akward today anyway. Any more client controls? Ciao, Michael. [1] https://tools.ietf.org/html/draft-ietf-ldapext-ldap-c-api-05#section-11.3.1

1 0

Database limit(s)
by Ervin Hegedüs 17 Dec '17

17 Dec '17

Hi there, I'ld like to ask, is there any hard or soft limit in database? I mean, how many object canbe stored in the DB? Or how many children object could under a parent? I've read the docs about the limits ( http://www.openldap.org/doc/admin24/limits.html), but there are only the sizelimit and timelimit (which aren't affected me now). In other words, which parameters do I check before I start to design a database (LDAP/non-LDAP (eg. OS) parameters)? Thanks, a.

2 1

Re: LMBD - If passing NULL to data parameter is legal in mdb_cursor_get()
by Howard Chu 17 Dec '17

17 Dec '17

Kaho Ng wrote: > Hi, > > When reading the documentation of lmdb, I wonder if the behavior in regards > to passing NULL as data parameter to mdb_cursor_get() is subject to changes. No. Unless there's an obvious bug, or the documentation specifically says "subject to change", existing behavior will not change. > When reading the source code of the library, I found that for some of the > operations, if NULL is passed as data parameter EINVAL will be returned, and > for the other operations passing will lead to different behavior > (for instance, MDB_SET). > > I am not sure if the behavior of future versions of lmdb will stay in > line with the > current version. Or is it generally illegal to pass NULL as data parameter? > > Could you give me some hints on that? Thank you. Ask yourself why you would ever pass NULL in each case and what that would mean. This is basic logic. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: slapd segfault in openldap 2.4.45
by Scott Koch 16 Dec '17

16 Dec '17

Correction, my openldap version is 2.4.45(typo'ed in previous post). On Wed, Dec 13, 2017 at 11:23 AM Scott Koch <scottkoch(a)gmail.com> wrote: > This is an RPM of openldap I built from the latest upstream source. This > slapd server is running on RHEL 7.4 x86_64. > > Error message: > 2017-12-13T00:13:34.944152-05:00 ldap1.example.com kernel: slapd[983]: > segfault at 766f6730 ip 00007f0272e2549b sp 00007f02017f55b8 error 4 in > libc-2.17.so[7f0272ce8000+1b8000] > > We have seen 15 or so instances of this issue and in all cases the last > LDAP operations follow the same pattern where there is an ABANDON and > UNBIND, then there is a SRCH operation. See log output below of full > connection for the client that performs the last operation. > > Let me know if there is any other information I can provide to help > troubleshoot this problem. > > Thanks in advance for the help! > -Scott > > 2017-12-13T00:13:03.560693-05:00 ldap1.example.com slapd[26514]: > conn=873638 fd=105 ACCEPT from IP=10.0.4.37:48520 (IP=0.0.0.0:389) > > 2017-12-13T00:13:03.560869-05:00 ldap1.example.com slapd[26514]: > conn=873638 op=0 EXT oid=1.3.6.1.4.1.1466.20037 > > 2017-12-13T00:13:03.561012-05:00 ldap1.example.com slapd[26514]: > conn=873638 op=0 STARTTLS > > 2017-12-13T00:13:03.561211-05:00 ldap1.example.com slapd[26514]: > conn=873638 op=0 RESULT oid= err=0 text= > > 2017-12-13T00:13:03.569367-05:00 ldap1.example.com slapd[26514]: > conn=873638 fd=105 TLS established tls_ssf=256 ssf=256 > > 2017-12-13T00:13:03.569853-05:00 ldap1.example.com slapd[26514]: > conn=873638 op=1 SRCH base="" scope=0 deref=0 filter="(objectClass=*)" > > 2017-12-13T00:13:03.570014-05:00 ldap1.example.com slapd[26514]: > conn=873638 op=1 SRCH attr=* altServer namingContexts supportedControl > supportedExtension supportedFeatures supportedLDAPVersion > supportedSASLMechanisms domainControllerFunctionality defaultNamingContext > lastUSN highestCommittedUSN > > 2017-12-13T00:13:03.570215-05:00 ldap1.example.com slapd[26514]: > conn=873638 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= > > 2017-12-13T00:13:03.571953-05:00 ldap1.example.com slapd[26514]: > conn=873638 op=2 SRCH base="dc=example,dc=com" scope=2 deref=0 > filter="(&(?objectClass=sudoRole)(|(!(?sudoHost=*))(?sudoHost=ALL)(?sudoHost= > node1713.example.com)(?sudoHost=node1713)(?sudoHost=10.0.4.37)(?sudoHost= > 10.134.0.0/18)(?sudoHost=ffff::ffff:ffff:fff:ffff)(?sudoHost=fe80::/64)(?sudoHost=+*)(|(?sudoHost=*\5C*)(?sudoHost=*?*)(?sudoHost=*\2A*)(?sudoHost=*[*]*))) > <http://10.134.0.0/18)(?sudoHost=ffff::ffff:ffff:fff:ffff)(?sudoHost=fe80::/…> > )" > > 2017-12-13T00:13:03.572214-05:00 ldap1.example.com slapd[26514]: > conn=873638 op=2 SRCH attr=objectClass cn sudoCommand sudoHost sudoUser > sudoOption sudoRunAs sudoRunAsUser sudoRunAsGroup sudoNotBefore > sudoNotAfter sudoOrder modifyTimestamp > > 2017-12-13T00:13:03.573488-05:00 ldap1.example.com slapd[26514]: > conn=873638 op=2 SEARCH RESULT tag=101 err=0 nentries=0 text= > > 2017-12-13T00:13:34.943439-05:00 ldap1.example.com slapd[26514]: > conn=873638 op=4 ABANDON msg=4 > > 2017-12-13T00:13:34.943694-05:00 ldap1.example.com slapd[26514]: > conn=873638 op=3 SRCH base="dc=example,dc=com" scope=2 deref=0 > filter="(&(uid=ntp)(objectClass=posixAccount)(&(uidNumber=*)(!(uidNumber=0))))" > > 2017-12-13T00:13:34.943885-05:00 ldap1.example.com slapd[26514]: > conn=873638 op=5 UNBIND > > 2017-12-13T00:13:34.944092-05:00 ldap1.example.com slapd[26514]: > conn=873638 op=3 SRCH attr=objectClass uid userPassword uidNumber gidNumber > gecos homeDirectory loginShell krbPrincipalName cn modifyTimestamp > modifyTimestamp shadowLastChange shadowMin shadowMax shadowWarning > shadowInactive shadowExpire shadowFlag krbLastPwdChange > krbPasswordExpiration pwdAttribute authorizedService accountExpires > userAccountControl nsAccountLock host loginDisabled loginExpirationTime > loginAllowedTimeMap sshPublicKey mail >

2 1

Re: Database limit(s)
by Howard Chu 16 Dec '17

16 Dec '17

Ervin Hegedüs wrote: > Hi there, > > I'ld like to ask, is there any hard or soft limit in database? No. > I mean, how > many object canbe stored in the DB? Or how many children object could under a > parent? > > I've read the docs about the limits > (http://www.openldap.org/doc/admin24/limits.html), but there are only the > sizelimit and timelimit (which aren't affected me now). > > In other words, which parameters do I check before I start to design a > database (LDAP/non-LDAP (eg. OS) parameters)? > > Thanks, > > > a. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Openldap Password Reset Portal
by Douglas Duckworth 15 Dec '17

15 Dec '17

Hi I am looking for password reset portal where users can reset their credentials. We already have a legacy app written in php but it needs to be retired. I came across PWM which lists a number of schema changes that are required before it can work with openldap. https://github.com/pwm-project/pwm/wiki/General-Directory-Setup I have a few questions: 1) Has anyone used PWM and if so can you describe how stable it operates? I find the documentation lacking though it seems there's not a ton of issues on their Github site. 2) Has anyone found other solutions besides PWM that do the same thing?

3 3

PHP-LDAP added EXOP support with PHP 7.2
by Côme Chilliet 12 Dec '17

12 Dec '17

Hello, Some people on IRC thought this was worth mentioning here. PHP 7.2.0 was released a few weeks ago: https://secure.php.net/archive/2017.php#id2017-11-30-1 It adds support for LDAP EXOP in the ldap module, here are the new functions: https://secure.php.net/manual/en/function.ldap-exop.php https://secure.php.net/manual/en/function.ldap-parse-exop.php https://secure.php.net/manual/en/function.ldap-exop-passwd.php https://secure.php.net/manual/en/function.ldap-exop-whoami.php Note that support for LDAP controls is in the git branch for PHP 7.3. Do not hesitate to have a look and give feedback about this, it’s way easier to change things before first release as PHP have a strong backward compatibility policy. Côme

1 0

ldap_sasl_interactive_bind_s: Can't contact LDAP server
by Turbo Fredriksson 05 Dec '17

05 Dec '17

[I’ve posted this on the OpenStack list as well, but maybe someone here knows more] I’m setting up (Open)LDAP (v2.4.40) on my old Newton installation, with the LDAP servers behind a HAProxy LB. I’m trying to have one at a time enabled to see if I can get them working individually before I try them as a whole/group.. I tried all day yesterday, and I could do the initial connection, but not get any results: ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) I see the connection in syslog on the LDAP server, but don’t get any results back. Now, first thing I did this morning was to just run the exact same command (kinit && ldapwhoami) that I did last night. AND IT WORKED!! No idea why! It shouldn’t have. Glad it did, but since I can’t explain WHY it worked, it’s annoying!! :) So I then disabled that (working) LDAP server in the LB member list and enabled the second. And now that is experiencing the same problem as the first yesterday… I didn’t change anything else - last thing I did before I went to bed last night was try the ldapwhoami command -> “can’t contact ldap server”. And the very first thing I did this morning was kdestroy my ticket, get a new one and then run ldapwhoami. I’ve run with multiple types of debugging, but there’s nothing obvious that I can see, either from ‘-d -1’ or with KRB5_TRACE set). So … “something” internally in OS changed. Any suggestions to what or how to debug this? What is ldap_sasl_interactive_bind_s() actually doing? Why does the ldap_bind() earlier seem to work, but not the SASL bind? See http://bayour.com/misc/ldapwhoami_output.txt <http://bayour.com/misc/ldapwhoami_output.txt> for full output from KRB5_TRACE=/dev/stdout ldapwhoami -YGSSAPI -H ldaps://ldap.bayour.net -d -1 and while this is happening, this is the output from slapd in the logs (running with “loglevel sync stats): Nov 19 12:42:40 admin-auth-ldap-31 slapd[26613]: conn=1015 fd=29 ACCEPT from IP=10.0.17.34:53451 (IP=10.0.17.31:636) Nov 19 12:42:40 admin-auth-ldap-31 slapd[26613]: conn=1015 fd=29 TLS established tls_ssf=256 ssf=256 Nov 19 12:42:40 admin-auth-ldap-31 slapd[26613]: conn=1015 op=0 BIND dn="" method=163 Nov 19 12:43:09 admin-auth-ldap-31 slapd[26613]: conn=1013 fd=22 closed (connection lost) With ‘loglevel -1’ (and filtering out 'daemon: epoll: listen|daemon: activity on’ because it ends up filling the screen), I get: Nov 19 12:49:28 admin-auth-ldap-31 slapd[27043]: Nov 19 12:49:28 admin-auth-ldap-31 slapd[27043]: slap_listener_activate(12): Nov 19 12:49:28 admin-auth-ldap-31 slapd[27043]: >>> slap_listener(ldaps://admin-auth-ldap-31.bayour.net:636/) Nov 19 12:49:28 admin-auth-ldap-31 slapd[27043]: daemon: listen=12, new connection on 25 Nov 19 12:49:29 admin-auth-ldap-31 slapd[27043]: Nov 19 12:49:33 admin-auth-ldap-31 slapd[27043]: daemon: added 25r (active) listener=(nil) Nov 19 12:49:33 admin-auth-ldap-31 slapd[27043]: conn=1001 fd=25 ACCEPT from IP=10.0.17.34:54740 (IP=10.0.17.31:636) Nov 19 12:49:34 admin-auth-ldap-31 slapd[27043]: 25r Nov 19 12:49:34 admin-auth-ldap-31 slapd[27043]: Nov 19 12:49:34 admin-auth-ldap-31 slapd[27043]: daemon: read active on 25 Nov 19 12:49:34 admin-auth-ldap-31 slapd[27043]: connection_get(25) Nov 19 12:49:34 admin-auth-ldap-31 slapd[27043]: connection_get(25): got connid=1001 Nov 19 12:49:34 admin-auth-ldap-31 slapd[27043]: connection_read(25): checking for input on id=1001 Nov 19 12:49:35 admin-auth-ldap-31 slapd[27043]: 25r Nov 19 12:49:35 admin-auth-ldap-31 slapd[27043]: Nov 19 12:49:35 admin-auth-ldap-31 slapd[27043]: daemon: read active on 25 Nov 19 12:49:35 admin-auth-ldap-31 slapd[27043]: connection_get(25) Nov 19 12:49:35 admin-auth-ldap-31 slapd[27043]: connection_get(25): got connid=1001 Nov 19 12:49:35 admin-auth-ldap-31 slapd[27043]: connection_read(25): checking for input on id=1001 Nov 19 12:49:35 admin-auth-ldap-31 slapd[27043]: connection_read(25): unable to get TLS client DN, error=49 id=1001 Nov 19 12:49:35 admin-auth-ldap-31 slapd[27043]: conn=1001 fd=25 TLS established tls_ssf=256 ssf=256 Nov 19 12:49:36 admin-auth-ldap-31 slapd[27043]: 25r Nov 19 12:49:36 admin-auth-ldap-31 slapd[27043]: Nov 19 12:49:36 admin-auth-ldap-31 slapd[27043]: daemon: read active on 25 Nov 19 12:49:36 admin-auth-ldap-31 slapd[27043]: connection_get(25) Nov 19 12:49:36 admin-auth-ldap-31 slapd[27043]: connection_get(25): got connid=1001 Nov 19 12:49:36 admin-auth-ldap-31 slapd[27043]: connection_read(25): checking for input on id=1001 Nov 19 12:49:36 admin-auth-ldap-31 slapd[27043]: op tag 0x60, time 1511095776 Nov 19 12:49:36 admin-auth-ldap-31 slapd[27043]: conn=1001 op=0 do_bind Nov 19 12:49:36 admin-auth-ldap-31 slapd[27043]: >>> dnPrettyNormal: <> Nov 19 12:49:36 admin-auth-ldap-31 slapd[27043]: <<< dnPrettyNormal: <>, <> Nov 19 12:49:36 admin-auth-ldap-31 slapd[27043]: conn=1001 op=0 BIND dn="" method=163 Nov 19 12:49:36 admin-auth-ldap-31 slapd[27043]: do_bind: dn () SASL mech GSSAPI Nov 19 12:49:36 admin-auth-ldap-31 slapd[27043]: ==> sasl_bind: dn="" mech=GSSAPI datalen=617 Nov 19 12:49:37 admin-auth-ldap-31 slapd[27043]: Nov 19 12:49:54 admin-auth-ldap-31 slapd[27043]: Nov 19 12:49:55 admin-auth-ldap-31 slapd[27043]: Nov 19 12:50:26 admin-auth-ldap-31 slapd[27043]: 25r Nov 19 12:50:26 admin-auth-ldap-31 slapd[27043]: Nov 19 12:50:26 admin-auth-ldap-31 slapd[27043]: daemon: read active on 25 Nov 19 12:50:26 admin-auth-ldap-31 slapd[27043]: connection_get(25) Nov 19 12:50:26 admin-auth-ldap-31 slapd[27043]: connection_get(25): got connid=1001 Nov 19 12:50:26 admin-auth-ldap-31 slapd[27043]: connection_read(25): checking for input on id=1001 Nov 19 12:50:26 admin-auth-ldap-31 slapd[27043]: ber_get_next on fd 25 failed errno=0 (Success) Nov 19 12:50:26 admin-auth-ldap-31 slapd[27043]: connection_read(25): input error=-2 id=1001, closing. Nov 19 12:50:26 admin-auth-ldap-31 slapd[27043]: connection_closing: readying conn=1001 sd=25 for close Nov 19 12:50:26 admin-auth-ldap-31 slapd[27043]: connection_close: deferring conn=1001 sd=25 Nov 19 12:50:27 admin-auth-ldap-31 slapd[27043]: Nov 19 12:50:28 admin-auth-ldap-31 slapd[27043]: So nothing obvious that I can see. Which is reasonable, because “eventually” it worked on the previous LDAP server, so can’t be a slapd problem. But I was hoping someone that have tried this on OS or behind a HAProxy setup might be able to shed some light on this. PS. I’ve done the exact same thing at work, in AWS and there it works just fine. So I’m fairly certain it’s something with OS/HAProxy, but I don’t know how to debug that bit..

4 9

Re:ldap_sasl_interactive_bind_s: Can't contact LDAP server
by Quanah Gibson-Mount 05 Dec '17

05 Dec '17

--On Sunday, December 03, 2017 12:44 PM -0800 Bill MacAllister <bill(a)ca-zephyr.org> wrote: > This is not a new problem. I am pretty sure I filed a bug report about > this years ago when I worked at Stanford, but I could not find it. I've filed <https://github.com/cyrusimap/cyrus-sasl/issues/494> --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: [LMDB] Large transactions
by Howard Chu 05 Dec '17

05 Dec '17

Jürgen Baier wrote: > Hi, > > I have a question about LMDB (I hope this is the right mailing list for such a > question). > > I'm running a benchmark (which is similar to my intended use case) which does > not behave as I hoped. I store 1 billion key/value pairs in a single LMDB > database. _In a single transaction._ The keys are MD5 hash codes from random > data (16 bytes) and the value is the string "test". > The documentation about mdb_page_spill says (as far as I understand) that this > function is called to prevent MDB_TXN_FULL situations. Does this mean that my > transaction is simply too large to be handled efficiently by LMDB? Yes. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

3 2

slapd-crash in web directory?
by Dave Horsfall 03 Dec '17

03 Dec '17

Not a problem as such, but I happened to notice this in my Apache log: 164.132.162.164 - - [03/Dec/2017:11:57:00 +1100] "GET /slapd-crash/ HTTP/1.1" 404 210 "-" "Mozilla/5.0 (compatible; AhrefsBot/5.2; +http://ahrefs.com/robot/)" AhrefsBot, for the uninitiated, is a web spider that tends to ignore such bothersome conventions as "content=noindex" and "robots.txt" etc, but anyway... Is it common practice to store SLAPD coredumps where every man and his dog can retrieve them? Note that I am not suggesting that OpenLDAP does this (but somebody obviously is), but I'm curious to know how widespread this silly practice is. -- Dave Horsfall DTM (VK2KFU) "Those who don't understand security will suffer."

1 0

Re: [LMDB] Large transactions
by Howard Chu 02 Dec '17

02 Dec '17

Jürgen Baier wrote: > Hi, > > thanks for the answer. However, I still have a follow-up question on this > benchmark. > > When I add 1 billion key/value pairs (16 byte MD5) to the LMDB database (in a > single transaction (but I also get similar results when I add the same data in > multiple transactions)) I get the following results: > > Windows, without MDB_WRITEMAP: 46h > Windows, with MDB_WRITEMAP: 6h (!) > Linux (ext4), without MDB_WRITEMAP: 75h > Linux (ext4), with MDB_WRITEMAP: 73h > > MDB_WRITEMAP seems to have a huge impact on write performance on Windows, but > on Linux I do not see similar improvements. > > So I have two questions: > > 1) Could the the difference between Linux and Windows performance regarding > the MDB_WRITEMAP option be related to the fact that LMDB currently uses sparse > files on Linux, but not on Windows? Unlikely. > 2) Is there a way to speed up Linux? Is there a way to pre-allocate the > data.mdb on startup? Try it and see. Use the env fd with fallocate(2). > Thanks, > > Jürgen > > > On 21.11.17 21:17, Howard Chu wrote: >> Jürgen Baier wrote: >>> Hi, >>> >>> I have a question about LMDB (I hope this is the right mailing list for >>> such a question). >>> >>> I'm running a benchmark (which is similar to my intended use case) which >>> does not behave as I hoped. I store 1 billion key/value pairs in a single >>> LMDB database. _In a single transaction._ The keys are MD5 hash codes from >>> random data (16 bytes) and the value is the string "test". >> >>> The documentation about mdb_page_spill says (as far as I understand) that >>> this function is called to prevent MDB_TXN_FULL situations. Does this mean >>> that my transaction is simply too large to be handled efficiently by LMDB? >> >> Yes. >> > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Monitoring Queries
by Tim Gustafson 01 Dec '17

01 Dec '17

Hi, I was wondering if there's anything like "iftop" for OpenLDAP. I'd like to monitor all queries to given base DN, but I don't need that information written to disk anywhere. I could use the accesslog overlay, but it seems like that might generate a huge amount of log data and likely tank performance. Is there any other way? -- Tim Gustafson BSOE Computing Director tjg(a)ucsc.edu 831-459-5354 Baskin Engineering, Room 313A To request BSOE IT support, please visit https://support.soe.ucsc.edu/ or send e-mail to help(a)soe.ucsc.edu or call 831-502-7536.

1 0

Re: Openldap-ldb-2.4.44-2 - Issu with Password Management
by Raja T Nair 29 Nov '17

29 Nov '17

Thanks for the timely response, Mike/Ulrich. It was a missing configuration. I missed this line in slapd.conf: ppolicy_hash_cleartext Once that got added, things started working fine. It was a server rebuild as the old one crashed, and I used conf file from a wrong backup :( Mike: Thanks for the explanation. It helped. Btw I was just explaining my observation. Never expected slapd to do that magic :) Best Regards, Raja. On 29 November 2017 at 14:09, Ulrich Windl < Ulrich.Windl(a)rz.uni-regensburg.de> wrote: > You should at least show us the whole $entry. > > > > > Hello All, > > > > I'm using openldap-ltb-2.4.44-2 > > Using password-hash {SSHA512} > > > > We have an in-house portal which allows people to change their passwords. > > It is written in PHP. > > > > version = php 5.6 > > lib = php-ldap > > $entry['userpassword'] = $newpasswd; > > ldap_modify($conn, $userdn, $entry); > > > > $newpasswd contains new password in plain text. > > > > It seems that the server does not encrypt the plain text string sent to > it > > from the portal, it only encodes it in base64. > > > > When an encrypted string is sent (SSHA512), the server rejects based on > > password policy since no special character is present. > > > > We would want to make the first method to work. Can somebody help me with > > this? > > > > ps: ldappasswd command works perfectly and the password gets encrypted in > > SSHA512 and encoded in base64. > > > > Best Regards, > > Raja. > > > > -- > > :^) > > -- :^)

1 0

Openldap-ldb-2.4.44-2 - Issu with Password Management
by Raja T Nair 29 Nov '17

29 Nov '17

Hello All, I'm using openldap-ltb-2.4.44-2 Using password-hash {SSHA512} We have an in-house portal which allows people to change their passwords. It is written in PHP. version = php 5.6 lib = php-ldap $entry['userpassword'] = $newpasswd; ldap_modify($conn, $userdn, $entry); $newpasswd contains new password in plain text. It seems that the server does not encrypt the plain text string sent to it from the portal, it only encodes it in base64. When an encrypted string is sent (SSHA512), the server rejects based on password policy since no special character is present. We would want to make the first method to work. Can somebody help me with this? ps: ldappasswd command works perfectly and the password gets encrypted in SSHA512 and encoded in base64. Best Regards, Raja. -- :^)

4 3

Convert SSHA userPassowrd attribute to use in /etc/shadow
by tran dung 28 Nov '17

28 Nov '17

Hi I have some servers that cannot connect to LDAP server so I have to create accounts on the servers which hash password from LDAP. Is it possible? >From userPassword attribute in LDAP, I can get hashed password and salt value in hex format. How can I convert these hex format values to use in /etc/shadow? Best Regards ----------------------- Tran Dung

1 0

Too Much LDAP Log Activity?
by Douglas Duckworth 23 Nov '17

23 Nov '17

Hi Thanks to several users on this list I have our cluster up and running. The databases look good as does performance. However, logs are increasing about 1MB every few minutes. Does everyone typically send all of local4 to a file or only filter out for example warning and above? Thanks, Douglas Duckworth, MSc, LFCS HPC System Administrator Scientific Computing Unit Physiology and Biophysics Weill Cornell Medicine E: doug(a)med.cornell.edu O: 212-746-6305 F: 212-746-8690

4 3

Re: Too Much LDAP Log Activity?
by Douglas Duckworth 22 Nov '17

22 Nov '17

I agree that logrotate can handle this but I guess what's the point of logging normal activity that's not actionable? On Nov 22, 2017 2:30 PM, "MJ J" <mikedotjackson(a)gmail.com> wrote: > 1mb every few minutes is inconsequential - no impact on performance or > disk space. You have logrotate to handle the disk space. > > 1gb every few minutes and you have a real problem to worry about in > terms of both performance and disk space. > > On Wed, Nov 22, 2017 at 8:35 PM, Douglas Duckworth > <dod2014(a)med.cornell.edu> wrote: > > Hi > > > > Thanks to several users on this list I have our cluster up and running. > > The databases look good as does performance. > > > > However, logs are increasing about 1MB every few minutes. > > > > Does everyone typically send all of local4 to a file or only filter out > for > > example warning and above? > > > > Thanks, > > > > Douglas Duckworth, MSc, LFCS > > HPC System Administrator > > Scientific Computing Unit > > Physiology and Biophysics > > Weill Cornell Medicine > > E: doug(a)med.cornell.edu > > O: 212-746-6305 > > F: 212-746-8690 >

1 0

Re: Too Much LDAP Log Activity?
by Douglas Duckworth 22 Nov '17

22 Nov '17

local4.* but I really would only want to see warnings. Would auth failures show up in local4.warn? On Nov 22, 2017 1:48 PM, "Frank Swasey" <Frank.Swasey(a)uvm.edu> wrote: I send all - but, what gets sent is controlled by the loglevel statement in your config - what have you set yours to? On 11/22/17, 13:36, "openldap-technical on behalf of Douglas Duckworth" < openldap-technical-bounces(a)openldap.org on behalf of dod2014(a)med.cornell.edu> wrote: Hi Thanks to several users on this list I have our cluster up and running. The databases look good as does performance. However, logs are increasing about 1MB every few minutes. Does everyone typically send all of local4 to a file or only filter out for example warning and above? Thanks, Douglas Duckworth, MSc, LFCS HPC System Administrator Scientific Computing Unit Physiology and Biophysics Weill Cornell Medicine E: doug(a)med.cornell.edu O: 212-746-6305 <(212)%20746-6305> F: 212-746-8690 <(212)%20746-8690>

1 0

Re: Antw: Re: ssf Security Question
by Quanah Gibson-Mount 22 Nov '17

22 Nov '17

--On Monday, November 20, 2017 8:43 AM +0100 Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de> wrote: > Hi! > > BTW: Does anyone know the backgraound of SUSE Linux Enterprise Server > (SLES) moving from OpenLDAP to Redhat's directory server in ist next > release? Do you have a relevant link? --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

3 2

Openldap/authconfig authenticating multiple times
by Dave Macias 21 Nov '17

21 Nov '17

Not sure if I sent this right the first time.... I had posted this on centos forum here but no help :( https://www.centos.org/forums/viewtopic.php?f=48&t=65041&hilit=authconfig Basic background: 3 openldap servers with multimaster replication and ppolicy pwdMaxFailure: 6 . When i try to authenticate to the linux box authconfig authenticates to all 3 master servers which return 3 failures, which give you 3 pwdFailureTime attributes for the account. So after typing the password incorrectly twice, the user get's locked out. Trying to understand why this is happening. When configured another clean box i dont see this behavior (one pwdFailureTime per incorrect password attempt). I've also reinstalled related packages but no change. The behavior is seen on all three master ldap servers. Please see the link for details Any input is appreciated. thank you, -dave

1 0

ldap + meta "Proxy operation retry failed" when re-binding as retrieved user for Active Directory account authentication
by Boyd, John K. 20 Nov '17

20 Nov '17

According to my slapd debug logs, after the account is not found locally, the search continues in active directory. I can bind under the admin query only account and successfully retrieve the user account information (I have verified this) from active directory; however, I can't then rebind-as-user with the user password in order to authenticate. I get a "Proxy operation retry failed" error: slapd[22555]: conn=1000 fd=8 ACCEPT from IP=127.0.0.1:35848 (IP=127.0.0.1:389) slapd[22555]: conn=1001 fd=9 ACCEPT from IP=127.0.0.1:35850 (IP=127.0.0.1:389) slapd[22555]: conn=1000 op=0 BIND dn="cn=xxxx,ou=local" method=128 slapd[22555]: conn=1000 op=0 BIND dn="cn=xxxx,ou=local" mech=SIMPLE ssf=0 slapd[22555]: conn=1000 op=0 RESULT tag=97 err=0 text= slapd[22555]: conn=1000 op=1 SRCH base="dc=example,dc=com" scope=2 deref=0 filter="(uid=xxxx0029)" slapd[22555]: conn=1002 fd=11 ACCEPT from IP=127.0.0.1:35852 (IP=127.0.0.1:389) slapd[22555]: conn=1002 op=0 BIND dn="cn=xxxx,ou=local" method=128 slapd[22555]: conn=1002 op=0 BIND dn="cn=xxxx,ou=local" mech=SIMPLE ssf=0 slapd[22555]: conn=1002 op=0 RESULT tag=97 err=0 text= slapd[22555]: conn=1003 fd=13 ACCEPT from IP=127.0.0.1:35854 (IP=127.0.0.1:389) slapd[22555]: conn=1003 op=0 BIND dn="cn=xxxx,ou=local" method=128 slapd[22555]: conn=1003 op=0 BIND dn="cn=xxxx,ou=local" mech=SIMPLE ssf=0 slapd[22555]: conn=1003 op=0 RESULT tag=97 err=0 text= slapd[22555]: conn=1002 op=1 SRCH base="ou=xxxx,dc=sooner,dc=net,dc=ou,dc=edu" scope=2 deref=0 filter="(uid=xxxx0029)" slapd[22555]: conn=1003 op=1 SRCH base="ou=local" scope=2 deref=0 filter="(uid=xxxx0029)" slapd[22555]: conn=1003 op=1 SEARCH RESULT tag=101 err=32 nentries=0 text= slapd[22555]: conn=1000 op=1 meta_back_search[1] match="" err=32 (No such object) text="". slapd[22555]: conn=1002 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= slapd[22555]: conn=1000 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= slapd[22555]: conn=1001 op=0 BIND dn="cn=11079,ou=xxxx,dc=a,dc=example,dc=com" method=128 slapd[22555]: conn=1004 fd=16 ACCEPT from IP=127.0.0.1:35858 (IP=127.0.0.1:389) slapd[22555]: conn=1004 op=0 BIND dn="cn=11079,ou=General,ou=xxxx,dc=sooner,dc=net,dc=ou,dc=edu" method=128 slapd[22555]: conn=1004 op=0 ldap_back_retry: retrying URI="ldaps://active.directory" DN="" slapd[22555]: conn=1004 op=0 RESULT tag=97 err=52 text=Proxy operation retry failed slapd[22555]: conn=1004 op=1 UNBIND slapd[22555]: conn=1001 op=0 RESULT tag=97 err=52 text= slapd[22555]: conn=1004 fd=16 closed Here is my meta configuration: database meta suffix dc=example,dc=com # The last rwm-map line maps all other attributes to nothing. overlay rwm rwm-map attribute uid sAMAccountname rwm-map attribute * #rwm-map objectclass posixGroup group #rwm-map objectclass posixAccount person #rwm-map objectclass memberUid member ## uri "ldap://127.0.0.1/dc=a,dc=example,dc=com" suffixmassage "dc=a,dc=example,dc=com" "ou=xxxx,dc=sooner,dc=net,dc=ou,dc=edu" rebind-as-user true idassert-bind bindmethod=simple binddn="cn=XXXX,ou=local" credentials=XXXX mode=none idassert-authzFrom "dn.regex:.*" ## uri "ldap://127.0.0.1/dc=b,dc=example,dc=com" suffixmassage "dc=b,dc=example,dc=com" "ou=local" rebind-as-user true idassert-bind bindmethod=simple binddn="cn=XXXX,ou=local" credentials=XXXX mode=none idassert-authzFrom "dn.regex:.*" ## database ldap uri ldaps://active.directory suffix ou=xxxx,dc=sooner,dc=net,dc=ou,dc=edu rebind-as-user true idassert-bind bindmethod=simple binddn="cn=XXXX,ou=it,ou=services,ou=accounts,dc=sooner,dc=net,dc=ou,dc=edu" credentials=XXXX tls_reqcert=allow tls_cacert=/etc/letsencrypt/live/lmamr-lims.rccc.ou.edu/fullchain.pem tls_cert=/etc/letsencrypt/live/lmamr-lims.rccc.ou.edu/cert.pem tls_key=/etc/letsencrypt/live/lmamr-lims.rccc.ou.edu/privkey.pem mode=none idassert-authzFrom "dn.regex:.*"

1 0

One account for modifying directory and wiki
by John Lewis 20 Nov '17

20 Nov '17

I want to have one account for modifying both a LDAP directory and a Mediawiki. What tactic would you you use to do it?

2 4

Re: ssf Security Question
by Howard Chu 20 Nov '17

20 Nov '17

William Brown wrote: > On Fri, 2017-11-17 at 08:34 +0100, Michael Ströder wrote: >> William Brown wrote: >>> Just want to point out there are some security risks with ssf >>> settings. >>> I have documented these here: >>> >>> https://fy.blackhats.net.au/blog/html/2016/11/23/the_minssf_trap.ht >>> ml >> >> Nice writeup. I always considered SSF values to be naive and somewhat >> overrated. People expect too much when looking at these numbers - >> especially regarding the "strength" of cryptographic algorithms which >> changes over time anyway with new cryptanalysis results coming up. >> >> Personally I always try to implement a TLS-is-must policy and prefer >> LDAPS (with correct protocol and ciphersuites configured) over >> LDAP/StartTLS to avoid this kind of pre-TLS leakage. >> Yes, I deliberately ignore "LDAPS is deprecated". ;-] > > I agree. If only there was a standards working group that could > deprecate startTLS in favour of TLS .... :) I have to agree as well. On my own servers I also use TLS on other "plaintext" ports too (such as pop3 and others) that no one has any business connecting to in plaintext. >> Furthermore some LDAP server implementation (IIRC e.g. MS AD) refuse >> to >> accept SASL/GSSAPI bind requests sent over TLS-secured channel. Which >> is >> IMO also somewhat questionable. > > Yes, I really agree. While a plain text port exists, data leaks are > possible. We should really improve this situation, where we have TLS > for all data to prevent these mistakes. > > I think a big part of the issue is that GSSAPI forces the encryption > layer, and can't work via an already encrypted channel. The people I > know involved in this space are really resistant to changing this due > to the "kerberos centric" nature of the products. Interesting. Our libldap/liblber works fine with GSSAPI's encryption layered over TLS and vice versa. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

[LMDB] Large transactions
by Jürgen Baier 20 Nov '17

20 Nov '17

Hi, I have a question about LMDB (I hope this is the right mailing list for such a question). I'm running a benchmark (which is similar to my intended use case) which does not behave as I hoped. I store 1 billion key/value pairs in a single LMDB database. _In a single transaction._ The keys are MD5 hash codes from random data (16 bytes) and the value is the string "test". I'm using lmdbjava which currently uses LMDB 0.9.19. The benchmark is executed on Linux (Ubuntu 17.04 with a 4.10 kernel and a ext4 filesystem). In the beginning the data is inserted relatively fast: 1M/1000M took:3317 ms (3s 317ms) Then the insert performance deteriorates gradually. After inserting 642M entries inserting 1M entries takes more than 5 minutes: 642M/1000M took:305734 ms (5m 5s 734ms) At this time the database size (data.mdb) is about 27GiB. The filesystem buffer cache has about the same value, so I assume most pages are cached. Linux still reports 28G free memory. A short analysis with perf seems to indicate that most time is spent in mdb_page_spill Children Self 96,45% 0,00% lmdbjava-native-library.so [.] mdb_cursor_put 96,45% 0,00% lmdbjava-native-library.so [.] mdb_put 96,45% 0,00% jffi8421248145368054745.so (deleted) [.] 0xffff80428d388b3f 60,43% 2,61% lmdbjava-native-library.so [.] mdb_page_spill.isra.16 47,39% 47,39% lmdbjava-native-library.so [.] mdb_midl_sort 26,07% 0,24% lmdbjava-native-library.so [.] mdb_page_touch 26,07% 0,00% lmdbjava-native-library.so [.] mdb_cursor_touch 25,83% 0,00% lmdbjava-native-library.so [.] mdb_page_unspill 23,22% 0,24% lmdbjava-native-library.so [.] mdb_page_dirty 22,99% 22,27% lmdbjava-native-library.so [.] mdb_mid2l_insert 11,14% 0,24% [kernel.kallsyms] [k] entry_SYSCALL_64_fastpath 10,43% 0,47% lmdbjava-native-library.so [.] mdb_page_flush 9,95% 0,00% libpthread-2.24.so [.] __GI___libc_pwrite 9,72% 0,00% [kernel.kallsyms] [k] vfs_write 9,72% 0,00% [kernel.kallsyms] [k] sys_pwrite64 9,48% 0,00% [kernel.kallsyms] [k] generic_perform_write 9,48% 0,00% [kernel.kallsyms] [k] __generic_file_write_iter 9,48% 0,00% [kernel.kallsyms] [k] ext4_file_write_iter 9,48% 0,00% [kernel.kallsyms] [k] new_sync_write 9,48% 0,00% [kernel.kallsyms] [k] __vfs_write 9,24% 0,00% lmdbjava-native-library.so [.] mdb_cursor_set 8,06% 0,47% lmdbjava-native-library.so [.] mdb_page_search 7,35% 0,95% lmdbjava-native-library.so [.] mdb_page_search_root 4,98% 0,24% lmdbjava-native-library.so [.] mdb_page_get.isra.13 The documentation about mdb_page_spill says (as far as I understand) that this function is called to prevent MDB_TXN_FULL situations. Does this mean that my transaction is simply too large to be handled efficiently by LMDB? Note that a similar benchmark with 4 byte integer keys took only 2h34m for 1000M entries (the integer keys were sorted, but I did not use MDB_APPEND). I understand LMDB is not write-optimized and maybe my transactions are simply too large. However, I hope I'm just doing something wrong and I can still use LMDB for my use case. Any ideas? Thank you, Juergen -- Juergen Baier

1 0

ssf Security Question
by Kaya Saman 20 Nov '17

20 Nov '17

Hi, I am a little confused with this. Basically I have a client connecting to the database, a DECT IP phone base station which doesn't support STARTLS and my slapd config has settings for clients to use certificates to connect. What would be the best way to set this up so that the DECT IP client only accesses the particular place that it needs to, the AddressBook section but then other clients will need to use STARTTLS for everything else?? Currently I am looking at: https://www.openldap.org/doc/admin24/security.html https://www.openldap.org/doc/admin24/access-control.html and have currently put this in my slapd.conf: #Removed the Global? security clause #security ssf=128 #Added generic ACL for all access to require ssf of 128 access to * by ssf=128 self write by ssf=128 anonymous auth by ssf=128 users read #Added ACL for open access to AddressBook in Read and Search only mode access to dn.children="ou=AddressBook,dc=domain,dc=com" by * search by * read Is this correct or do I need to engage the "security" Global section too? Though the documentation suggests otherwise: "For fine-grained control, SSFs may be used in access controls. See theAccess Control <https://www.openldap.org/doc/admin24/access-control.html>section for more information." Thanks. Kaya

3 3

Re: ssf Security Question
by Quanah Gibson-Mount 20 Nov '17

20 Nov '17

--On Friday, November 17, 2017 12:53 PM +1000 William Brown <wibrown(a)redhat.com> wrote: Hi William, > Hey mate, > > Just want to point out there are some security risks with ssf settings. > I have documented these here: > > https://fy.blackhats.net.au/blog/html/2016/11/23/the_minssf_trap.html > > This is a flaw in the ldap protocol and can never be resolved without > breaking the standard. The issue is that by the time the ssf check is > done, you have already cleartexted sensitive material. I think what you mean is: There is no way with startTLS to prevent possible leakage of credentials when using simple binds. ;) Your blog certainly covers this concept well, but just wanted to be very clear on what the actual issue is. ;) I've been rather unhappy about this for a long time as well, and have had a discussion going on the openldap-devel list about LDAPv4 and breaking backwards compatibility to fix this protocol bug. Another note -- The reason GSSAPI shows up as an SSF of 56 is because it has been hard coded that way in cyrus-sasl. Starting with cyrus-sasl version 2.1.27, which is near release, the actual SASL SSF is finally passed back into the caller. It may be worthwhile noting this in your blog post. ;) Warm regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

3 2

Re: Is existing documentation kind of vague?
by Howard Chu 19 Nov '17

19 Nov '17

MJ J wrote: > Certainly, I will make a better list tomorrow or so and send them to > you. Generally, it relates to the areas of cn=config which are not > runtime configurable and the lack of inline ACLs being first-class > citizens. > > Basically, I feel that anything which is exposed via cn=config should > not require an offline slapadd in order to take effect. These are not > really huge problems for LDAP experts, but quite challenging when > trying to train a bit less skilled people to handle operations. A > detailed list of cn=config params which can and cannot be modified > during runtime would help matters greatly, instead of the current > situation of knowledge via trial and error ;-) The intention has always been 100% runtime modifiable. Any that aren't should be considered as bugs in 2.5. > On Sun, Nov 19, 2017 at 8:28 PM, Howard Chu <hyc(a)symas.com> wrote: >> MJ J wrote: >>> >>> I actually like 389 a lot and I have used Netscape DS extensively in >>> managing international telecom networks about 15 years ago. There are >>> quite many management features that are superior to OpenLDAP still to >>> this day, but I simply cannot use it anymore because of the lack of >>> scalability. I know the original Netscape DS devs quite extensively... >> >> >> There are certainly some obvious deficiences remaining in cn=config, and >> we're working on addressing as many as possible for 2.5. But I'd be curious >> to see your list of issues. >> >> >>> >>> -mike >>> >>> On Fri, Nov 17, 2017 at 8:34 AM, William Brown <wibrown(a)redhat.com> wrote: >>>> >>>> On Fri, 2017-11-17 at 08:27 +0200, MJ J wrote: >>>>> >>>>> No matter how you wrap poll() and select(), they will always be >>>>> poll() >>>>> and select() - you will always run loops around an ever increasing >>>>> stack of file descriptors while doing I/O. BDB is always going to >>>>> have >>>>> the same old problems... That's what I'm talking about - sacrificing >>>>> performance for platform portability (NSPR). >>>>> >>>>> FreeIPA could be multi-tenant i.e.support top-level and subordinate >>>>> kerberos realms if it supported a more sensible DIT layout. I know >>>>> because I have built such a system (based on OpenLDAP) and deployed >>>>> it >>>>> internationally. Probably the best piece of code to come out of the >>>>> project is bind-dyndb-ldap. >>>> >>>> >>>> Whoa mate - I'm not here to claim that 389 is a better ldap server - we >>>> just do some different things. We acknowledge our limitations and are >>>> really working on them and paying down our tech debt. We want to remove >>>> parts of nspr, replace bdb and more. :) >>>> >>>> I'm here to follow the progress of the openldap project, who have a >>>> team of people I respect greatly and want to learn from, and here to >>>> help discussions and provide input from a different perspective. >>>> >>>> There are things that today openldap does much better than us for >>>> certain - and there are also some things that we do differently too >>>> like DNA plugin uid allocation, replication etc, >>>> >>>> There are also project focusses and decisions made to improve >>>> supportability in systems like FreeIPA - we can discuss them forever, >>>> but reality is today, FreeIPA is not targeting multi-tennant >>>> environments because the majority of our consumers don't want that >>>> functionality. We made a design decision and have to live with it. I'm >>>> providing this information to help give the ability for people to >>>> construct an informed opinion. >>>> >>>> >>>> As mentioned, I'm not here to throw insults and criticisms, I'm here to >>>> have positive, respectful discussions about technology, to provide >>>> different ideas, and to learn from others :) >>>> >>>> Thanks, >>>> >>>>> >>>>> On Fri, Nov 17, 2017 at 4:49 AM, William Brown <wibrown(a)redhat.com> >>>>> wrote: >>>>>> >>>>>> On Thu, 2017-11-16 at 05:54 +0200, MJ J wrote: >>>>>>> >>>>>>> Sure, it can be improved to become invulnerable to the >>>>>>> academically >>>>>>> imaginative race conditions that are not going to happen in real >>>>>>> life. >>>>>>> That will go to the very bottom of my list of things to do now, >>>>>>> thanks. >>>>>>> >>>>>>> FreeIPA is a cool concept, too bad it's not scalable or multi- >>>>>>> tenant >>>>>>> capable. >>>>>> >>>>>> >>>>>> It's a lot more scalable depending on which features you >>>>>> enable/disable. It won't even be multi-tenant due to the design >>>>>> with >>>>>> gssapi/krb. >>>>>> >>>>>> At the end of the day, the atomic UID/GID alloc in FreeIPA is from >>>>>> the >>>>>> DNA plugin from 389-ds-base (which you can multi-instance on a >>>>>> server >>>>>> or multi-tentant with many backends). We use a similar method to AD >>>>>> in >>>>>> that each master has a pool of ids to alloc from, and they can >>>>>> atomically request pools. This prevents the race issues you are >>>>>> describing here with openldap. >>>>>> >>>>>> So that's an option for you, because those race conditions *do* and >>>>>> *will* happen, and it will be a bad day for you when they do. >>>>>> >>>>>> >>>>>> Another option is an external IDM system that allocs the uid's and >>>>>> feeds them to your LDAP environment instead, >>>>>> >>>>>> Full disclosure: I'm a core dev of 389 directory server, so that's >>>>>> why >>>>>> I'm speaking in this context. Not here to say bad about openldap or >>>>>> try >>>>>> to poach you, they are a great project, just want to offer >>>>>> objective >>>>>> insight from "the other (dark?) side". :) >>>>>> >>>>>>> >>>>>>> On Wed, Nov 15, 2017 at 11:09 PM, Michael Ströder <michael@stroed >>>>>>> er.c >>>>>>> om> wrote: >>>>>>>> >>>>>>>> MJ J wrote: >>>>>>>>> >>>>>>>>> TLDR; in a split-brain situation, you could run into trouble. >>>>>>>>> But >>>>>>>>> this >>>>>>>>> isn't the only place. Efffective systems monitoring is the >>>>>>>>> key >>>>>>>>> here. >>>>>>>>> >>>>>>>>> Long answer; >>>>>>>>> [..] >>>>>>>>> The solution I posted has been in production in a large, >>>>>>>>> dynamic >>>>>>>>> company for several years and never encountered a problem. >>>>>>>> >>>>>>>> >>>>>>>> Maybe it works for you. But I still don't understand why you >>>>>>>> post >>>>>>>> such a >>>>>>>> lengthy justification insisting on your MOD_INCREMENT / read- >>>>>>>> after- >>>>>>>> write >>>>>>>> approach with possible race condition even in a single master >>>>>>>> deployment >>>>>>>> while there are two proper solutions with just a few lines code >>>>>>>> more: >>>>>>>> >>>>>>>> 1. delete-by-value to provoke a conflict like the original >>>>>>>> poster >>>>>>>> mentioned by pointing to >>>>>>>> http://www.rexconsulting.net/ldap-protocol-uidNumber.html >>>>>>>> >>>>>>>> 2. MOD_INCREMENT with pre-read control >>>>>>>> >>>>>>>> Of course none of the solutions work when hitting multiple >>>>>>>> providers >>>>>>>> hard in a MMR setup or in a split-brain situation. One has to >>>>>>>> choose a >>>>>>>> "primary" provider then. >>>>>>>> BTW: AFAIK with FreeIPA each provider has its own ID range to >>>>>>>> prevent that. >>>>>>>> >>>>>>>> Ciao, Michael. >>>>>>> >>>>>>> >>>>>>> >>>>>> >>>>>> -- >>>>>> Sincerely, >>>>>> >>>>>> William Brown >>>>>> Software Engineer >>>>>> Red Hat, Australia/Brisbane >>>>>> >>>>> >>>>> >>>> -- >>>> Sincerely, >>>> >>>> William Brown >>>> Software Engineer >>>> Red Hat, Australia/Brisbane >>>> >>> >>> >> >> >> -- >> -- Howard Chu >> CTO, Symas Corp. http://www.symas.com >> Director, Highland Sun http://highlandsun.com/hyc/ >> Chief Architect, OpenLDAP http://www.openldap.org/project/ > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: Is existing documentation kind of vague?
by Howard Chu 19 Nov '17

19 Nov '17

MJ J wrote: > I actually like 389 a lot and I have used Netscape DS extensively in > managing international telecom networks about 15 years ago. There are > quite many management features that are superior to OpenLDAP still to > this day, but I simply cannot use it anymore because of the lack of > scalability. I know the original Netscape DS devs quite extensively... There are certainly some obvious deficiences remaining in cn=config, and we're working on addressing as many as possible for 2.5. But I'd be curious to see your list of issues. > > -mike > > On Fri, Nov 17, 2017 at 8:34 AM, William Brown <wibrown(a)redhat.com> wrote: >> On Fri, 2017-11-17 at 08:27 +0200, MJ J wrote: >>> No matter how you wrap poll() and select(), they will always be >>> poll() >>> and select() - you will always run loops around an ever increasing >>> stack of file descriptors while doing I/O. BDB is always going to >>> have >>> the same old problems... That's what I'm talking about - sacrificing >>> performance for platform portability (NSPR). >>> >>> FreeIPA could be multi-tenant i.e.support top-level and subordinate >>> kerberos realms if it supported a more sensible DIT layout. I know >>> because I have built such a system (based on OpenLDAP) and deployed >>> it >>> internationally. Probably the best piece of code to come out of the >>> project is bind-dyndb-ldap. >> >> Whoa mate - I'm not here to claim that 389 is a better ldap server - we >> just do some different things. We acknowledge our limitations and are >> really working on them and paying down our tech debt. We want to remove >> parts of nspr, replace bdb and more. :) >> >> I'm here to follow the progress of the openldap project, who have a >> team of people I respect greatly and want to learn from, and here to >> help discussions and provide input from a different perspective. >> >> There are things that today openldap does much better than us for >> certain - and there are also some things that we do differently too >> like DNA plugin uid allocation, replication etc, >> >> There are also project focusses and decisions made to improve >> supportability in systems like FreeIPA - we can discuss them forever, >> but reality is today, FreeIPA is not targeting multi-tennant >> environments because the majority of our consumers don't want that >> functionality. We made a design decision and have to live with it. I'm >> providing this information to help give the ability for people to >> construct an informed opinion. >> >> >> As mentioned, I'm not here to throw insults and criticisms, I'm here to >> have positive, respectful discussions about technology, to provide >> different ideas, and to learn from others :) >> >> Thanks, >> >>> >>> On Fri, Nov 17, 2017 at 4:49 AM, William Brown <wibrown(a)redhat.com> >>> wrote: >>>> On Thu, 2017-11-16 at 05:54 +0200, MJ J wrote: >>>>> Sure, it can be improved to become invulnerable to the >>>>> academically >>>>> imaginative race conditions that are not going to happen in real >>>>> life. >>>>> That will go to the very bottom of my list of things to do now, >>>>> thanks. >>>>> >>>>> FreeIPA is a cool concept, too bad it's not scalable or multi- >>>>> tenant >>>>> capable. >>>> >>>> It's a lot more scalable depending on which features you >>>> enable/disable. It won't even be multi-tenant due to the design >>>> with >>>> gssapi/krb. >>>> >>>> At the end of the day, the atomic UID/GID alloc in FreeIPA is from >>>> the >>>> DNA plugin from 389-ds-base (which you can multi-instance on a >>>> server >>>> or multi-tentant with many backends). We use a similar method to AD >>>> in >>>> that each master has a pool of ids to alloc from, and they can >>>> atomically request pools. This prevents the race issues you are >>>> describing here with openldap. >>>> >>>> So that's an option for you, because those race conditions *do* and >>>> *will* happen, and it will be a bad day for you when they do. >>>> >>>> >>>> Another option is an external IDM system that allocs the uid's and >>>> feeds them to your LDAP environment instead, >>>> >>>> Full disclosure: I'm a core dev of 389 directory server, so that's >>>> why >>>> I'm speaking in this context. Not here to say bad about openldap or >>>> try >>>> to poach you, they are a great project, just want to offer >>>> objective >>>> insight from "the other (dark?) side". :) >>>> >>>>> >>>>> On Wed, Nov 15, 2017 at 11:09 PM, Michael Ströder <michael@stroed >>>>> er.c >>>>> om> wrote: >>>>>> MJ J wrote: >>>>>>> TLDR; in a split-brain situation, you could run into trouble. >>>>>>> But >>>>>>> this >>>>>>> isn't the only place. Efffective systems monitoring is the >>>>>>> key >>>>>>> here. >>>>>>> >>>>>>> Long answer; >>>>>>> [..] >>>>>>> The solution I posted has been in production in a large, >>>>>>> dynamic >>>>>>> company for several years and never encountered a problem. >>>>>> >>>>>> Maybe it works for you. But I still don't understand why you >>>>>> post >>>>>> such a >>>>>> lengthy justification insisting on your MOD_INCREMENT / read- >>>>>> after- >>>>>> write >>>>>> approach with possible race condition even in a single master >>>>>> deployment >>>>>> while there are two proper solutions with just a few lines code >>>>>> more: >>>>>> >>>>>> 1. delete-by-value to provoke a conflict like the original >>>>>> poster >>>>>> mentioned by pointing to >>>>>> http://www.rexconsulting.net/ldap-protocol-uidNumber.html >>>>>> >>>>>> 2. MOD_INCREMENT with pre-read control >>>>>> >>>>>> Of course none of the solutions work when hitting multiple >>>>>> providers >>>>>> hard in a MMR setup or in a split-brain situation. One has to >>>>>> choose a >>>>>> "primary" provider then. >>>>>> BTW: AFAIK with FreeIPA each provider has its own ID range to >>>>>> prevent that. >>>>>> >>>>>> Ciao, Michael. >>>>> >>>>> >>>> >>>> -- >>>> Sincerely, >>>> >>>> William Brown >>>> Software Engineer >>>> Red Hat, Australia/Brisbane >>>> >>> >>> >> -- >> Sincerely, >> >> William Brown >> Software Engineer >> Red Hat, Australia/Brisbane >> > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

Re: Is existing documentation kind of vague?
by Howard Chu 19 Nov '17

19 Nov '17

MJ J wrote: > I had a requirement to build a centrally managed SSO system that > replicated subordinate subtrees (kerberos, identities, roles, > permissions, resources, dns, etc) to the respective sites and handle > tens of thousands of concurrent requests per second. I determined that > FreeIPA was unable to perform this mission due to 1) inflexible DIT, > 2) inflexible management tooling, and 3) lack of scalability. So, I > built a system to achieve those goals. And it really wasn't rocket > science. Perhaps I will write a book about it and ask for competent > reviewers from the OL community. Would be happy to review it. > On Fri, Nov 17, 2017 at 4:21 PM, Michael Ströder <michael(a)stroeder.com> wrote: >> MJ J wrote: >>> I know because I have built such a system (based on OpenLDAP) and >>> deployed it internationally. >> So what makes your system special, which goals does it reach and how? >> >> Ciao, Michael. > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

Is existing documentation kind of vague?
by John Lewis 19 Nov '17

19 Nov '17

Hello Everyone. I was trying to implement uidNumber Attribute Auto-Incrementing Method and I read http://www.rexconsulting.net/ldap-protocol-uidNumber.html . I specifically want to point to this line here. > Create a “uidNext” entry (objectClass: uidNext) at an specific > location in the directory to store the incrementing value. Publish > this location in your application programming guides as the well- > known location for obtaining the next UID. Also publish this method > as the required method to retrieve a next UID. But I already know from http://www.openldap.org/doc/admin23/schema.html & http://www.zytrax.com/books/ldap/ch3/ that object classes are defined only. So the writer left out that they defined a schema and what name the called the schema. Maybe it isn't important. What is important is that they used object class "objectclass ( 1.3.6.1.4.1.19173.2.2.2.8" to define it, but I can't find the registration of the object identifier on https://www.ldap.com/ldap-oid- reference or https://www.iana.org/assignments/ldap-parameters/ldap-para meters.xhtml#ldap-parameters-3. It makes perfect scene because it is a PRIVATE ENTERPRISE NUMBER. It would mean that anyone outside of Rex Consulting, Inc. https://www.iana .org/assignments/enterprise-numbers/enterprise-numbers would be using the wrong OID and that the specific object wouldn't be listed. > Under no circumstances should you hijack OID namespace! - OpenLDAP Software 2.4 Administrator's Guide That is a lot of data from a lot of different websites to string together that information. I have a good idea how to implement uidNumber, but I haven't seen it done and I can't do it CORRECT today because I would have to register for a Private Enterprise Number so I won't hijack an OID namespace and that would take up to 30 days and there is no documented contingency plan anywhere. We are all familiar with the the LDAP call out articles that come out every year. All of the articles seem to come from a place of frustration. To be fair I think call out articles are a trend with databases. Do you think existing documentation is kind of vague?

5 19

Re: Is existing documentation kind of vague?
by Shawn McKinney 17 Nov '17

17 Nov '17

> On Nov 17, 2017, at 12:34 AM, William Brown <wibrown(a)redhat.com> wrote: > > Whoa mate - I'm not here to claim that 389 is a better ldap server - we > just do some different things. We acknowledge our limitations and are > really working on them and paying down our tech debt. We want to remove > parts of nspr, replace bdb and more. :) > > I'm here to follow the progress of the openldap project, who have a > team of people I respect greatly and want to learn from, and here to > help discussions and provide input from a different perspective. Openldap and 389 are long-lost siblings, separated during childhood, raised by their respective communities. Now at last perhaps we join again, cooperate, share and enjoy mutual benefit. Welcome! Shawn

1 0

restrict wildcard searches
by Geert Hendrickx 17 Nov '17

17 Nov '17

Hi, Is there a way to restrict (acl?) searches using wildcards? For compliancly reasons, I want to allow certain (actually most) users to search on eg. known email addresses, like: mail=user(a)example.org, but not to retrieve a list of all users, like mail=*(a)example.org. Sizelimit restriction is not enough, because they could still iteratively retrieve everything, without launching an actual dictionary attack on all possible mail addresses, which would be much harder. Geert -- geert.hendrickx.be :: geert(a)hendrickx.be :: PGP: 0xC4BB9E9F This e-mail was composed using 100% recycled spam messages!

3 2

Re: ssf Security Question
by Quanah Gibson-Mount 15 Nov '17

15 Nov '17

--On Tuesday, November 14, 2017 8:56 PM +0000 Kaya Saman <kayasaman(a)gmail.com> wrote: > access to * > by ssf=128 self write > by ssf=128 anonymous auth > by ssf=128 users read > > > > ># Added ACL for open access to AddressBook in Read and Search only mode > > access to dn.children="ou=AddressBook,dc=domain,dc=com" > by * search > by * read Your second ACL will never be evaluated, since the first ACL matches everything. As noted in the slapd.access(5) man page, ACL processing stops on the first matching ACL. In addition, in your second ACL, the "by * read" will never be processed, because of the match to "by * search". If you're already planning on granting read, there is no point to having by * search there at all. I.e., your ACLs should be: access to dn.children="ou=AddressBook,dc=domain,dc=com" by * read access to * by ssf=128 self write by ssf=128 anonymous auth by ssf=128 users read And I generally doubt you want to give users read to "*", as this means they can read the userPassword values of other users, etc. You might want something more like: access to dn.children="ou=AddressBook,dc=domain,dc=com" by * read access to attrs=userPassword by ssf=128 anonymous auth by ssf=128 self write access to * by ssf=128 self write by ssf=128 users read And yes, you have to remove the global SSF setting if the phone cannot support startTLS on port 389. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: Antw: Efficient way to count number of entries in a database?
by Quanah Gibson-Mount 15 Nov '17

15 Nov '17

--On Tuesday, November 14, 2017 12:40 PM +0100 Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de> wrote: > Here olmBDBDNCache from cn=Database 1,cn=Databases,cn=Monitor seems to > be close to the number (10762 vs. 10770). That is a BDB specific item, and not relevant to back-mdb databases. In addition, the value is something that is configurable in slapd.conf, so may or may not contain a result that is valid. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Efficient way to count number of entries in a database?
by Karsten Heymann 15 Nov '17

15 Nov '17

Hi Quanah, 2017-11-14 16:46 GMT+01:00 Quanah Gibson-Mount <quanah(a)symas.com>: > mdb_stat -s id2e /path/to/mdb/db | grep Entries > Entries: 3993833 > That's exactly what I needed. Thanks a lot! btw for those using debian as well, mdb_stat is in the lmdb-utils package BR Karsten

1 0

Re: Efficient way to count number of entries in a database?
by Quanah Gibson-Mount 14 Nov '17

14 Nov '17

--On Tuesday, November 14, 2017 4:35 PM +0100 Karsten Heymann <karsten.heymann(a)gmail.com> wrote: > > Currently about 1.5Mio. If you have access to the system and have mdb_stat available, the easiest method is to simply query the database directly: mdb_stat -s id2e /path/to/mdb/db | grep Entries Entries: 3993833 --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Efficient way to count number of entries in a database?
by Karsten Heymann 14 Nov '17

14 Nov '17

Hi, is there a more efficient way to count how many entries a ldap database has than slapcat -b <suffix> | grep ^dn: | wc -l I searched the cn=Monitor backend but it does not seem to export this number. I want to have this for graphing and reporting and as a secondary data point that replication is working as intended. BR Karsten

3 7

proxy/backend pointers
by David LaPorte 14 Nov '17

14 Nov '17

Hello, I've done a bit of research, but having some difficulty determining if my use case is possible. Here's what I'm trying to do: We have an old unsupported application that authenticates users using an LDAP bind. The credential used for authentication (and what all the internal authorizations are tied to) is employee ID. We are moving to LDAP directory that uses email address instead of employee ID as the DN - the employee ID is still present as an attribute in the new directory and the password remains the same. Since I can't modify the problematic application, it’s not going away anytime soon, and it’s the last thing holding up migration to the new directory system, I'm hoping that I can use OpenLDAP as a shim between the application and the new directory to do something like the following: * Collect credentials (employee_id, password) during bind * using a privileged service account, search/bind against the new directory to map employee ID attribute to email address DN (like mod_authz_ldap does it) * return the success/failure as result of original bind I would appreciate any ideas or pointers if this is possible or if there might be a better way. Thanks in advance! Dave David LaPorte david(a)davidlaporte.org

1 0

Re: a question about "Assertion 'NUMKEYS(mp) > 1' failed in mdb_page_search_root()"
by Howard Chu 14 Nov '17

14 Nov '17

James Anderson wrote: > good afternoon; > > we have seen sporadic instances of the “page search root" error: > > dydrad[20250]: [#2224] CREATE-TRANSACTION 8f9e6986-5fd4-c54b-b073-0c134552aa4a R/O => james/test2@d3102d2e-ded8-d740-8340-4b7e5608eb78 (pid=22136 tid=31865) > mdb.c:5276: Assertion 'NUMKEYS(mp) > 1' failed in mdb_page_search_root() > > this happens in a situation where we are simply executing numerous requests which just clear the contents of a two-entry database and then insert two new entries. > > we are using lmdb in the version 0.9.17, which i had understood from the threads in this list to be after the point when this problem was addressed. > is that true or is it expected to still be an open issue at that version? The bug was reported in 0.9.17, so it certainly was not fixed in that version. http://www.openldap.org/its/index.cgi/Software%20Bugs?id=8336 Git shows the fix was released in 0.9.18. You should be using 0.9.21 now. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: your mail
by Howard Chu 14 Nov '17

14 Nov '17

Dave Horsfall wrote: > On Mon, 13 Nov 2017, Suneet Shah wrote: > >> Hi Openldap >> http://bit.ly/2zC6jTU >> Thank you >> >> Suneet > > Is there some reason why spam is allowed on this list? This email address was a legitimate participant on this list, you can find their posts from 2011-2015 in the archive. Probably his email account has been compromised, we'll turn it off. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

(no subject)
by Suneet Shah 14 Nov '17

14 Nov '17

Hi Openldap http://bit.ly/2zC6jTU Thank you Suneet

2 1

a question about "Assertion 'NUMKEYS(mp) > 1' failed in mdb_page_search_root()"
by James Anderson 14 Nov '17

14 Nov '17

good afternoon; we have seen sporadic instances of the “page search root" error: dydrad[20250]: [#2224] CREATE-TRANSACTION 8f9e6986-5fd4-c54b-b073-0c134552aa4a R/O => james/test2@d3102d2e-ded8-d740-8340-4b7e5608eb78 (pid=22136 tid=31865) mdb.c:5276: Assertion 'NUMKEYS(mp) > 1' failed in mdb_page_search_root() this happens in a situation where we are simply executing numerous requests which just clear the contents of a two-entry database and then insert two new entries. we are using lmdb in the version 0.9.17, which i had understood from the threads in this list to be after the point when this problem was addressed. is that true or is it expected to still be an open issue at that version? if that version is still susceptible, what avenues are customary to upgrade to a version closer to the latest release. we have tried to substitute 0.9.70, but it does not appear possible to do that, due to library incompatibilities, unless we unload/reload all databases. best regards, from berlin, --- james anderson | james(a)dydra.com | http://dydra.com

1 0

Question regarding using OpenLDAP as a proxy to multiple AD servers
by Mārtiņš Mieriņš 11 Nov '17

11 Nov '17

Hi, I'm new to OpenLDAP, I've been reading documentation for some time but cannot figure out whether there is solution. We have many products in our company that are using sAMAccountName (from Active Directory server) as login credentials for authentication purpose. Now we have an additional requirement to support authentication of users from another Active Directory server. Since many products do not allow to specify more than one LDAP server the idea is to configure OpenLDAP proxy that will then forward requests to either AD servers. Nevertheless the format of login credentials has to stay the same. So the final goal is to be able to authenticate users of both AD directories via binding against OpenLDAP proxy using sAMAccountName (can add some other data in DN but it has to be static). 1. Can OpenLDAP be configured to accept sAMAccountName and domain as bind DN and then forward it to either AD servers depending on domain name? 2. If not, can OpenLDAP be configured to perform search (including filtering by sAMAccountName field) behind the scenes and then bind by using DN of a found user?-> all this happens when user tries to bind against OpenLDAP proxy 3. Any other solutions? BR, Martins

2 1

let slapo-ppolicy set pwdFailureTime
by Michael Ströder 09 Nov '17

09 Nov '17

HI! I'm using back-sock as overlay to intercept bind *requests* and send them to an external listener which returns success(0) or invalidCredentials(49). I'd like to avoid having to deal with operational attributes in the user's entry. Therefore in case of invalidCredentials(49) I'd like slapo-ppolicy to add attribute value to 'pwdFailureTime'. The order of overlays in slapd.conf is: overlay sock sockops bind overlay ppolicy overlay lastbind overlay rwm From my understand the requests go from bottom up rwm -> lastbind -> ppolicy -> back-sock .....continue...... returns success(0) or invalidCredentials(49) and vice versa the response go through back-sock -> ppolicy -> lastbind -> rwm It partially works: (/) I see update of 'authTimestamp' by slapo-lastbind. (/) If back-sock listener returns success(0) slapo-ppolicy correctly checks password expiry in the response chain and returns invalidCredentials(49) with appropriate ppolicy response controls. (x) But the attribute 'pwdFailureTime' is not set in case back-sock listener returns invalidCredentials(49). Reading source of ppolicy_bind_response() one of the first things is to check for rs->sr_err == LDAP_INVALID_CREDENTIALS and add another 'pwdFailureTime' value. So it should work. But it doesn't. Any clue what I'm doing wrong? Ciao, Michael.

1 0

Re: Replication problem with attributes
by Quanah Gibson-Mount 09 Nov '17

09 Nov '17

--On Thursday, November 09, 2017 12:39 PM +0100 Dennis Meyer <snooops84(a)gmail.com> wrote: > olcAccess: {0}to attrs=userPassword by self write by anonymous auth by * > none > olcAccess: {1}to attrs=loginShell,gecos by dn="cn=admin,dc=localdomain" > write by self write by * read > olcAccess: {2}to attrs=shadowLastChange by self write by * read > olcAccess: {3}to * by * read > olcAccess: {4}to attrs=userPassword,shadowLastChange by self write by > anonymous auth by dn="cn=admin,dc=localdomain" write by > dn="cn=mirrormode,dc=localdomain" read by * none ACL {4} will never be evaluated, because ACL parsing stops on the first match, which will be ACL {3} (access to everything by anyone read). Even if you fix that problem, ACL {4} would still be unlikely to be evaluated due to ACL {0} as well. > Any Ideas how could solve this? Fix your ACLs. ;) Something like: olcAccess: {0}to attrs=userPassword by self write by anonymous auth by dn="cn=admin,dc=localdomain" write by dn="cn=mirrormode,dc=localdomain" read olcAccess: {1}to attrs=loginShell,gecos by dn="cn=admin,dc=localdomain" write by self write by * read olcAccess: {2}to attrs=shadowLastChange by self write by dn="cn=admin,dc=localdomain" write by * read olcAccess: {3}to * by dn="cn=admin,dc=localdomain" write by * read Note that "by * none" at the end of an ACL is implicit, so it's not required to list it explicitly. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Replication problem with attributes
by Dennis Meyer 09 Nov '17

09 Nov '17

Hi, i have setup a new multimaster with mirrormode = true cluster with Debian 9 and openldap 2.4.44. There are two Servers ldap1 and ldap2. As its just a lab Environment there is no need to hide passwords and stuff: /etc/ldap/slapd.d/cn=config/olcDatabase={1}mdb.ldif # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 8fb04e78 dn: olcDatabase={1}mdb objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=localdomain olcAccess: {0}to attrs=userPassword by self write by anonymous auth by * non e olcAccess: {1}to attrs=loginShell,gecos by dn="cn=admin,dc=localdomain" writ e by self write by * read olcAccess: {2}to attrs=shadowLastChange by self write by * read olcAccess: {3}to * by * read olcAccess: {4}to attrs=userPassword,shadowLastChange by self write by anonym ous auth by dn="cn=admin,dc=localdomain" write by dn="cn=mirrormode,dc=loca ldomain" read by * none olcLastMod: TRUE olcRootDN: cn=admin,dc=localdomain olcRootPW:: e1NTSEF9Z05GbEJIRHE1aTNpa0ZsYVk0WVh3VTM4SkF0VkF0b3Q= olcDbCheckpoint: 512 30 olcDbIndex: member,memberUid eq olcDbIndex: cn pres,sub,eq olcDbIndex: uid pres,sub,eq olcDbIndex: displayName pres,sub,eq olcDbIndex: default sub olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: mail,givenName eq,subinitial olcDbIndex: dc eq olcDbIndex: objectClass,entryCSN,entryUUID eq olcDbMaxSize: 1073741824 structuralObjectClass: olcMdbConfig entryUUID: e9f1dcca-5978-1037-8f17-b1d4dc2a991d creatorsName: cn=admin,cn=config createTimestamp: 20171109090544Z olcMirrorMode: TRUE olcSyncrepl: {0}rid=001 provider=ldap://10.211.55.20:389 bindmethod=simple b inddn="cn=mirrormode,dc=localdomain" credentials=iechi1Eid_ie:quu searchbas e="dc=localdomain" schemachecking=on type=refreshAndPersist retry="60 +" entryCSN: 20171109101419.176516Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20171109101419Z Here is my Database, its on both ldap servers identical - i dumped this on both servers and ran a diff slapcat: dn: dc=localdomain objectClass: top objectClass: dcObject objectClass: organization o: localdomain dc: localdomain structuralObjectClass: organization creatorsName: cn=admin,dc=localdomain entryUUID: 1854fd30-597f-1037-9872-eb46faf4f5e0 createTimestamp: 20171109094959Z entryCSN: 20171109094959.802699Z#000000#000#000000 modifiersName: cn=admin,dc=localdomain modifyTimestamp: 20171109094959Z contextCSN: 20171109100725.365127Z#000000#000#000000 dn: cn=admin,dc=localdomain objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator userPassword:: e1NTSEF9Z05GbEJIRHE1aTNpa0ZsYVk0WVh3VTM4SkF0VkF0b3Q= structuralObjectClass: organizationalRole entryUUID: e9f75c72-5978-1037-8289-d381257e6532 creatorsName: cn=admin,dc=localdomain createTimestamp: 20171109090545Z entryCSN: 20171109090545.033599Z#000000#000#000000 modifiersName: cn=admin,dc=localdomain modifyTimestamp: 20171109090545Z dn: cn=mirrormode,dc=localdomain objectClass: simpleSecurityObject objectClass: organizationalRole cn: mirrormode description: Syncrepl user for mirrormode operation structuralObjectClass: organizationalRole entryUUID: 49734c42-5979-1037-9e9b-d338d82a2242 creatorsName: cn=admin,dc=localdomain createTimestamp: 20171109090825Z userPassword:: e1NTSEF9T3hzeUVnanhLTThZSDJjK3JweG1sM2pWOG5USEkwS1c= entryCSN: 20171109100725.365127Z#000000#000#000000 modifiersName: cn=admin,dc=localdomain modifyTimestamp: 20171109100725Z And this is the error i get only on ldap1 after setting up replication on both servers: Nov 9 12:36:16 ldap1 slapd[17296]: Entry (cn=admin,dc=localdomain): object class 'simpleSecurityObject' requires attribute 'userPassword' Nov 9 12:36:16 ldap1 slapd[17296]: null_callback : error code 0x41 Nov 9 12:36:16 ldap1 slapd[17296]: syncrepl_entry: rid=001 be_add cn=admin,dc=localdomain failed (65) Nov 9 12:36:16 ldap1 slapd[17296]: do_syncrepl: rid=001 rc 65 retrying Any Ideas how could solve this? Best regards Dennis

1 0

Re: disk write on old 2.4.9
by Howard Chu 08 Nov '17

08 Nov '17

richard lucassen wrote: > On Wed, 8 Nov 2017 11:35:40 +0100 > richard lucassen <mailinglists(a)lucassen.org> wrote: > >> Is there a way to limit these disk writes? I didn't touch the standard >> Ubuntu settings, except for the usual settings like SSL. > > I found an old setting that seems to do the job: > > shm_key 100 > > In that old setting it was set to 100, the man page says: > > shm_key _integer_ > Specify a key for a shared memory BDB environment. By default the BDB > environment uses memory mapped files. If a non-zero value is > specified, it will be used as the key to identify a shared memory > region that will house the environment. > > Is that integer a sort of label or does it mean something else? It means what it says - it is a shared memory key. Read the ipcs(1) manpage. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

disk write on old 2.4.9
by richard lucassen 08 Nov '17

08 Nov '17

Hello list, I have an ***old*** Ubuntu-8.04 running 2.4.9. I know, this is old, but there are no security issues here. This slapd contains a small database which is modified rarely. OTOH, there are many read operations. The backend is hdb. As these boxes are running on a CF-disk I'd like to limit disk writes, but when the database is queried, the backend is being updated (slapd started at 11:25, read operation at 11:31): # ls -altr /var/lib/ldap/ total 768 drwxr-xr-x 3 root root 4096 2013-11-11 20:28 .. -rw-r--r-- 1 openldap openldap 96 2017-11-08 09:36 DB_CONFIG -rw------- 1 openldap openldap 8192 2017-11-08 11:25 objectClass.bdb -rw------- 1 openldap openldap 8192 2017-11-08 11:25 dn2id.bdb -rw------- 1 openldap openldap 123193 2017-11-08 11:25 log.0000000001 -rw------- 1 openldap openldap 65536 2017-11-08 11:25 id2entry.bdb drwx------ 2 openldap openldap 4096 2017-11-08 11:25 . -rw-r--r-- 1 openldap openldap 2048 2017-11-08 11:25 alock -rw------- 1 openldap openldap 24576 2017-11-08 11:31 __db.005 -rw------- 1 openldap openldap 565248 2017-11-08 11:31 __db.004 -rw------- 1 openldap openldap 98304 2017-11-08 11:31 __db.003 -rw------- 1 openldap openldap 2629632 2017-11-08 11:31 __db.002 -rw------- 1 openldap openldap 8192 2017-11-08 11:31 __db.001 Is there a way to limit these disk writes? I didn't touch the standard Ubuntu settings, except for the usual settings like SSL. Richard. -- richard lucassen http://contact.xaq.nl/

1 1

Re: NO-USER-MODIFICATION and USAGE dSAOperation in custom schema
by Howard Chu 06 Nov '17

06 Nov '17

Michael Ströder wrote: > HI! > > Why is it not allowed to use > > NO-USER-MODIFICATION > USAGE dSAOperation > > in an attribute type declaration? Because such an operational attribute requires server-side code to actually implement it, and you haven't got any means to provide that code. Custom operational attributes must be defined using code loaded in a module. > > For OATH-LDAP I'd like to define a "virtual" attribute (actually to be > processed by back-sock listener) without having to write a slapd overlay. > > attributetype ( oath-ldap-at:16 > NAME 'oathOTPValue' > DESC 'OATH-LDAP: currently valid OTP value of a token' > X-ORIGIN 'OATH-LDAP' > SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 > EQUALITY integerMatch > SINGLE-VALUE ) > NO-USER-MODIFICATION > USAGE dSAOperation ) > > But slapd refuses to start: > > 5a00641b /home/michael/Proj/oath-ldap/oath-ldap.schema: line 241 > (attributetype ( oath-ldap-at:16 NAME 'oathOTPValue' DESC 'OATH-LDAP: > currently valid OTP value of a token or associated user entry (not > directly used)' X-ORIGIN 'OATH-LDAP' SYNTAX > 1.3.6.1.4.1.1466.115.121.1.27 EQUALITY integerMatch SINGLE-VALUE > NO-USER-MODIFICATION USAGE dSAOperation )) > 5a00641b /home/michael/Proj/oath-ldap/oath-ldap.schema: line 241 > attributetype: "oath-ldap-at:16" is operational > > Ciao, Michael. > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 3

NO-USER-MODIFICATION and USAGE dSAOperation in custom schema
by Michael Ströder 06 Nov '17

06 Nov '17

HI! Why is it not allowed to use NO-USER-MODIFICATION USAGE dSAOperation in an attribute type declaration? For OATH-LDAP I'd like to define a "virtual" attribute (actually to be processed by back-sock listener) without having to write a slapd overlay. attributetype ( oath-ldap-at:16 NAME 'oathOTPValue' DESC 'OATH-LDAP: currently valid OTP value of a token' X-ORIGIN 'OATH-LDAP' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 EQUALITY integerMatch SINGLE-VALUE ) NO-USER-MODIFICATION USAGE dSAOperation ) But slapd refuses to start: 5a00641b /home/michael/Proj/oath-ldap/oath-ldap.schema: line 241 (attributetype ( oath-ldap-at:16 NAME 'oathOTPValue' DESC 'OATH-LDAP: currently valid OTP value of a token or associated user entry (not directly used)' X-ORIGIN 'OATH-LDAP' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 EQUALITY integerMatch SINGLE-VALUE NO-USER-MODIFICATION USAGE dSAOperation )) 5a00641b /home/michael/Proj/oath-ldap/oath-ldap.schema: line 241 attributetype: "oath-ldap-at:16" is operational Ciao, Michael.

1 0

Re: Load testing bind performance
by Tim 03 Nov '17

03 Nov '17

No.. unfortunately not... :) I was/am grasping at straws a little bit currently and just tweaking things one setting at a time to see if I can see any difference - admittedly, increasing threads has not improved the situation at all. -- Tim On Fri, Nov 3, 2017 at 3:44 PM, Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Friday, November 03, 2017 1:11 PM +0000 Tim <tim(a)yetanother.net> > wrote: > > olcThreads: 512 >> > > You have 128 cores on your box? More threads != better performance. In > fact, it will cause significant problems if it is set beyond what your > system can handle. > > > --Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > > > -- Tim tim(a)yetanother.net

2 1

Load testing bind performance
by Tim 03 Nov '17

03 Nov '17

Heya, Could anyone recommend a quick and dirty way in which to load test an OpenLDAP service to get an indication as to the potential capacity for the platform to handle bind requests? I've used the python-ldap library to simulate other varieties of interactions successfully, but when it comes to binds, each interaction seems to generate a substantial amount of traffic behind the scenes, so suspect that *things* are happening that is artificially limiting the bind rate/s. I've seen some links to people using JMeter to perform this sort of load testing, but thought there may be other (quicker to implement) tools also? Thanks in advance, -- Tim tim(a)yetanother.net

4 8

Re: Load testing bind performance
by Quanah Gibson-Mount 03 Nov '17

03 Nov '17

--On Friday, November 03, 2017 1:11 PM +0000 Tim <tim(a)yetanother.net> wrote: > olcThreads: 512 You have 128 cores on your box? More threads != better performance. In fact, it will cause significant problems if it is set beyond what your system can handle. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Load testing bind performance
by Howard Chu 01 Nov '17

01 Nov '17

Tim wrote: > Heya, > > Could anyone recommend a quick and dirty way in which to load test an OpenLDAP > service to get an indication as to the potential capacity for the platform to > handle bind requests? > > I've used the python-ldap library to simulate other varieties of interactions > successfully, but when it comes to binds, each interaction seems to generate a > substantial amount of traffic behind the scenes, so suspect that *things* are > happening that is artificially limiting the bind rate/s. > > I've seen some links to people using JMeter to perform this sort of load > testing, but thought there may be other (quicker to implement) tools also? You can look at slapd-bind and slapd-auth in the OpenLDAP test suite, that's what they're for. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

uidNumber for Service Accounts?
by Douglas Duckworth 26 Oct '17

26 Oct '17

Hi Do I need uidNumber for Service Accounts used for application / server binding if this user won't actually be resolved by sssd or nslcd? I set a very high uidNumber but eventually this will conflict with users as in my ignorance I didn't put this in a lower range. Thanks, Douglas Duckworth, MSc, LFCS HPC System Administrator Scientific Computing Unit Physiology and Biophysics Weill Cornell Medicine E: doug(a)med.cornell.edu O: 212-746-6305 F: 212-746-8690

3 2

Help wanted - LDAP deployment for NTP and Network Time Foundation
by Harlan Stenn 26 Oct '17

26 Oct '17

Hi folks, The NTP Project has an ancient LDAP deployment that needs to be upgraded. We've started a re-deployment that includes both ntp.org and nwtime.org, and have the server side of that mostly finished. The volunteers who have been doing this don't have the time to get it done soon enough. We could really use some more help to get the deployment finished and installed. This includes a reality check on our replicated server setup, the schema, and then getting various "services" (login/ssh, some web apps, etc) hooked in. If you're up for lending a hand on this, please let me know. -- Harlan Stenn <stenn(a)nwtime.org> http://networktimefoundation.org - be a member!

1 0

Re: uidNumber for Service Accounts?
by Douglas Duckworth 25 Oct '17

25 Oct '17

Thanks Michael! No, we do not have uidNumber-based ACLs only DN based. I will remove the uidNumber. Thanks Doug Thanks, Douglas Duckworth, MSc, LFCS HPC System Administrator Scientific Computing Unit Physiology and Biophysics Weill Cornell Medicine E: doug(a)med.cornell.edu O: 212-746-6305 F: 212-746-8690 On Wed, Oct 25, 2017 at 9:55 AM, Michael Ströder <michael(a)stroeder.com> wrote: > Douglas Duckworth wrote: > > Do I need uidNumber for Service Accounts used for application / server > > binding if this user won't actually be resolved by sssd or nslcd? > > In general if your client only binds to the LDAP server it doesn't need > 'uidNumber' attribute. It just needs a bind-DN and a password in its > config. I assume though that your LDAP server does not have ACLs based > uidNumber-based filter affecting your client. > > And I don't know whether something else in your deployment needs it. > This only you can find out. > > Ciao, Michael. > >

1 0

Re: [EXTERNAL] pwdPolicySubentry: value #0 already exists
by Douglas Duckworth 25 Oct '17

25 Oct '17

Thanks so much, Jon! I can see it clearly now! # Service Accounts, domain dn: ou=Service Accounts,domain # g14classified, Service Accounts, domain dn: uid=g14classified,ou=Service Accounts,domain pwdPolicySubentry: cn=CustomBindAccountPolicy,ou=Policies,domain Thanks, Douglas Duckworth, MSc, LFCS HPC System Administrator Scientific Computing Unit Physiology and Biophysics Weill Cornell Medicine E: doug(a)med.cornell.edu O: 212-746-6305 F: 212-746-8690 On Wed, Oct 25, 2017 at 9:34 AM, Jon C Kidder <jckidder(a)aep.com> wrote: > pwdPolicySubentry is an operational attribute. It will not be returned in > search results unless you explicitly request it or use + in your requested > attribute list. > > > > If you change the add to a replace in your ldif file your modify operation > should succeed. > > > > > <https://urldefense.proofpoint.com/v2/url?u=http-3A__www.aep.com_&d=DwMGaQ&c…> > > *JON C KIDDER* | *MIDDLEWARE ADMINISTRATOR LEAD* > JCKIDDER(a)AEP.COM | D:614.716.4970 <(614)%20716-4970> > 1 RIVERSIDE PLAZA, COLUMBUS, OH 43215 > <https://maps.google.com/?q=1+RIVERSIDE+PLAZA,+COLUMBUS,+OH+43215&entry=gmai…> > > > > *From:* openldap-technical [mailto:openldap-technical-bounces@openldap.org] > *On Behalf Of *Douglas Duckworth > *Sent:* Wednesday, October 25, 2017 9:24 AM > *To:* Openldap Technical > *Subject:* [EXTERNAL] pwdPolicySubentry: value #0 already exists > > > > This is an EXTERNAL email. STOP. THINK before you CLICK links or OPEN > attachments. If suspicious please forward to incidents(a)aep.com for review. > ------------------------------ > > Hi > > > > I am trying to make sure my bind Service Account's password does not > expire. I set this in ou=Policies with the intention that the policy would > only be applied to this user: > > > > # Policies, domain > > dn: ou=Policies,domain > > ou: Policies > > objectClass: organizationalUnit > > > > # CustomBindAccountPolicy, Policies, domain > > dn: cn=CustomBindAccountPolicy,ou=Policies,domain > > objectClass: person > > objectClass: top > > cn: passwordDefault > > cn: CustomBindAccountPolicy > > sn: passwordDefault > > pwdAttribute: userPassword > > pwdMinAge: 0 > > pwdMaxAge: 0 > > pwdLockout: FALSE > > > > However, I do not see this dn referenced on the user: > > > > # importantuser, Service Accounts, domain > > dn: uid=importantuser,ou=Service Accounts,domain > > objectClass: top > > objectClass: account > > objectClass: posixAccount > > objectClass: extensibleObject > > uid: binduser > > cn: bind > > sn: user > > givenName: binduser > > title: Account > > loginShell: /dev/null > > uidNumber: 123 > > gidNumber: 456 > > homeDirectory: /dev/null > > description: Service Account > > userPassword:: password123 > > > > When I try to add using ldapadd and this ldif: > > > > dn: uid=importantuser,ou=Service Accounts,domain > > changetype: modify > > add: pwdPolicySubentry > > pwdPolicySubentry: cn=CustomBindAccountPolicy,ou= > Policies,dc=davinci,dc=med,dc=cornell,dc=edu > > > > I get this error: > > me@nsa[~/ldap]$ ladd server.ldif > > > > Enter LDAP Password: > > modifying entry "uid=importantuser,ou=Service Accounts,domain" > > ldap_modify: Type or value exists (20) > > additional info: modify/add: pwdPolicySubentry: value #0 already > exists > > > > Do you have any idea what could be happening? My ACL's allow the binduser > to see everything so I don't understand what's happening. > > > > Thank you very much! > > > > > Thanks, > > > Douglas Duckworth, MSc, LFCS > HPC System Administrator > Scientific Computing Unit > > Physiology and Biophysics > > Weill Cornell Medicine > > E: doug(a)med.cornell.edu > O: 212-746-6305 <(212)%20746-6305> > F: 212-746-8690 <(212)%20746-8690> >

1 0

pwdPolicySubentry: value #0 already exists
by Douglas Duckworth 25 Oct '17

25 Oct '17

Hi I am trying to make sure my bind Service Account's password does not expire. I set this in ou=Policies with the intention that the policy would only be applied to this user: # Policies, domain dn: ou=Policies,domain ou: Policies objectClass: organizationalUnit # CustomBindAccountPolicy, Policies, domain dn: cn=CustomBindAccountPolicy,ou=Policies,domain objectClass: person objectClass: top cn: passwordDefault cn: CustomBindAccountPolicy sn: passwordDefault pwdAttribute: userPassword pwdMinAge: 0 pwdMaxAge: 0 pwdLockout: FALSE However, I do not see this dn referenced on the user: # importantuser, Service Accounts, domain dn: uid=importantuser,ou=Service Accounts,domain objectClass: top objectClass: account objectClass: posixAccount objectClass: extensibleObject uid: binduser cn: bind sn: user givenName: binduser title: Account loginShell: /dev/null uidNumber: 123 gidNumber: 456 homeDirectory: /dev/null description: Service Account userPassword:: password123 When I try to add using ldapadd and this ldif: dn: uid=importantuser,ou=Service Accounts,domain changetype: modify add: pwdPolicySubentry pwdPolicySubentry: cn=CustomBindAccountPolicy,ou=Policies,dc=davinci,dc=med,dc=cornell,dc=edu I get this error: me@nsa[~/ldap]$ ladd server.ldif Enter LDAP Password: modifying entry "uid=importantuser,ou=Service Accounts,domain" ldap_modify: Type or value exists (20) additional info: modify/add: pwdPolicySubentry: value #0 already exists Do you have any idea what could be happening? My ACL's allow the binduser to see everything so I don't understand what's happening. Thank you very much! Thanks, Douglas Duckworth, MSc, LFCS HPC System Administrator Scientific Computing Unit Physiology and Biophysics Weill Cornell Medicine E: doug(a)med.cornell.edu O: 212-746-6305 F: 212-746-8690

2 1

How do internet-facing, multi-domain ldap servers handle TLS?
by John Lewis 20 Oct '17

20 Oct '17

How do internet-facing, multi-domain ldap servers handle TLS? Do they go multi-port or do they use one TLS certificate that covers all of the domains, or do they get more IP addresses that are all on different domains?

1 0

Re: Antw: Re: [Q] amendments to schemes existent
by Zeus Panchenko 20 Oct '17

20 Oct '17

Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de> wrote: > But you are basically changing the semantics of attribute authorizedService: > Before "*" was literal, after it is magic (substring match). > > The discussion on which variant is more useful is a different issue ;-) for *my* flow, the variant of original schema is unusable since I have pleny of values and to hardcode all of them for all available searches is not good idea, to my mind ... if to return to the starting question: is there other way to get originally SUBSTR-less attributes to be matchable by substring, except hacking the scheme? -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET)

2 4

ldapsearch and inherit attributes
by Sylvain 19 Oct '17

19 Oct '17

Hi, If "AAA" is the superior attribute of "BBB" and if I do ldapsearch uid=sylvain AAA. Results will include BBB attributes. Is this possible for ldapsearch to return only AAA ? Thanks, Sylvain

1 0

[Q] amendments to schemes existent
by Zeus Panchenko 19 Oct '17

19 Oct '17

greetings, I'm wondering of search possibility lack for some attributes my question is: is it correct/good/sane/e.t.c. to patch them this way? is there other way to get those attributes searchable? for example I have to patch some schemes like this: ---[ PATCH SAMPLES START ]--------------------------------------------------- --- dhcp.schema.orig 2017-08-25 13:14:26.691570000 +0300 +++ dhcp.schema 2017-08-25 13:15:56.558980000 +0300 @@ -14,6 +14,7 @@ attributetype ( 2.16.840.1.113719.1.203. NAME 'dhcpStatements' EQUALITY caseIgnoreIA5Match DESC 'Flexible storage for specific data depending on what object this exists in. Like conditional statements, server parameters, etc. This allows the standard to evolve without needing to adjust the schema.' + SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) attributetype ( 2.16.840.1.113719.1.203.4.4 @@ -38,6 +39,7 @@ attributetype ( 2.16.840.1.113719.1.203. NAME 'dhcpOption' EQUALITY caseIgnoreIA5Match DESC 'Encoded option values to be sent to clients. Each value represents a single option and contains (OptionTag, Length, OptionValue) encoded in the format used by DHCP.' + SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) attributetype ( 2.16.840.1.113719.1.203.4.8 @@ -199,6 +201,7 @@ attributetype ( 2.16.840.1.113719.1.203. attributetype ( 2.16.840.1.113719.1.203.4.34 NAME 'dhcpHWAddress' EQUALITY caseIgnoreIA5Match + SUBSTR caseIgnoreIA5SubstringsMatch DESC 'The clients hardware address that requested this IP address.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) --- ldapns.schema.orig 2014-09-15 23:47:56.135989000 +0300 +++ ldapns.schema 2015-02-15 23:50:53.714906292 +0200 @@ -1,6 +1,7 @@ attributetype ( 1.3.6.1.4.1.5322.17.2.1 NAME 'authorizedService' DESC 'IANA GSS-API authorized service name' EQUALITY caseIgnoreMatch + SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) objectclass ( 1.3.6.1.4.1.5322.17.1.1 NAME 'authorizedServiceObject' --- nis.schema.orig 2017-02-11 21:38:48.984906000 +0200 +++ nis.schema 2017-10-02 13:20:52.140691000 +0300 @@ -55,6 +55,7 @@ attributetype ( 1.3.6.1.1.1.1.2 NAME 'ge attributetype ( 1.3.6.1.1.1.1.3 NAME 'homeDirectory' DESC 'The absolute path to the home directory' EQUALITY caseExactIA5Match + SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) attributetype ( 1.3.6.1.1.1.1.4 NAME 'loginShell' ---[ PATCH SAMPLES STOP ]--------------------------------------------------- -- IT dpt., I.B.S. LLC

2 2

[ldapmodify] multiple entries of the same attibute
by richard lucassen 18 Oct '17

18 Oct '17

Hello list, I've got records with e.g. multiple mail: entries per dn: dn: cn=Joe Sixpack,ou=addressbook,dc=example,dc=org [ 8< 8< 8< snip objectclasses and other stuff 8< 8< 8< ] mail: user1(a)example.com mail: user2(a)example.com mail: user3(a)example.com GUI ldap clients like jxplorer are able to change a single mail: entry. Using "ldapmodify" I replace the first mail: entry, but it will delete the other mail: antries: ################################################################# change.diff file: dn: cn=Joe Sixpack,ou=addressbook,dc=example,dc=com changetype: modify replace: mail mail: otheruser(a)example.com - ################################################################# invoke: ldapmodify -x -D "cn=admin,dc=example,dc=com" -W -f change.ldif ################################################################# result: dn: cn=Joe Sixpack,ou=addressbook,dc=example,dc=org [ 8< 8< 8< snip objectclasses and other stuff 8< 8< 8< ] mail: otheruser(a)example.com ################################################################# Is there a way to tell ldapmodify to change just a particular entry? R. -- richard lucassen http://contact.xaq.nl/

4 6

Re: Empty directory memory consumption
by Quanah Gibson-Mount 18 Oct '17

18 Oct '17

--On Wednesday, October 18, 2017 5:04 PM +1300 Ivan Kurnosov <zerkms(a)zerkms.ru> wrote: > I have found, that just installed slapd (2.4.42+dfsg-2ubuntu3.2) on > ubuntu 16.04 consumes 730MB+ or resident memory (RSS). Only consumes 12 MB on my Ubuntu 16.04 system. But I don't use the build supplied by Ubuntu, I use my own. So I cannot say what Ubuntu's done to cause this. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Empty directory memory consumption
by Ivan Kurnosov 18 Oct '17

18 Oct '17

Hi, I have found, that just installed slapd (2.4.42+dfsg-2ubuntu3.2) on ubuntu 16.04 consumes 730MB+ or resident memory (RSS). It's an empty database (with `cn=config` only and whatever comes by default), is it supposed to consume so much memory? -- With best regards, Ivan Kurnosov

1 0

Re: Admin roles by group membership per OU
by Quanah Gibson-Mount 16 Oct '17

16 Oct '17

--On Monday, October 16, 2017 6:05 PM +0200 Ervin Hegedüs <airween(a)gmail.com> wrote: >> Hm, yes, that's correct. You'll need to do something like utilize by * >> break appropriately, or have multiple "access to userPassword" ACLs by >> group, then a catchall after that. > > I'm sorry - could you give me an example? Sure, no problem. :) One way to do it is to have an access line per subtree for those attributes, adding the group permission, with a final access to just userPassword itself limiting off all other access for anything outside of those trees: dn: olcDatabase={1}mdb,cn=config olcAccess: {0}to dn.children="ou=ABC Customer,dc=core,dc=hdt,dc=hu" attrs=userPassword,shadowLastChange by self write by anonymous auth by dn="uid=repuser,dc=core,dc=hdt,dc=hu" read by group.exact="cn=groupabcadmin,ou=ABC Customer,dc=core,dc=hdt,dc=hu" write ... Addtional subtree ACLs with groups for userPassword/shadowLastChange access... olcAccess: {#}to attrs=userPassword,shadowLastChange by self write by anonymous auth by dn="uid=repuser,dc=core,dc=hdt,dc=hu" read olcAccess: {#}to dn.children="ou=ABC Customer,dc=core,dc=hdt,dc=hu" by self write by group.exact="cn=groupabcadmin,ou=ABC Customer,dc=core,dc=hdt,dc=hu" write by dn="uid=repuser,dc=core,dc=hdt,dc=hu" read olcAccess: {#}to * by * read The other option is to use "by * break", which tells slapd to continue processing additional rules. If you do that, you'll need to be particularly careful not to give access beyond what you intended. For that purpose, I added a final ACL rule that says zero access to userPassword prior to the "* by * read" ACL. dn: olcDatabase={1}mdb,cn=config olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymous auth by dn="uid=repuser,dc=core,dc=hdt,dc=hu" read by * break olcAccess: {1}to dn.children="ou=ABC Customer,dc=core,dc=hdt,dc=hu" by self write by group.exact="cn=groupabcadmin,ou=ABC Customer,dc=core,dc=hdt,dc=hu" write by dn="uid=repuser,dc=core,dc=hdt,dc=hu" read ... Additional subtree ACLs with groups ... olcAccess: {#} to userPassword by * none olcAccess: {#}to * by * read --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Admin roles by group membership per OU
by Quanah Gibson-Mount 16 Oct '17

16 Oct '17

--On Monday, October 16, 2017 5:55 PM +0200 Ervin Hegedüs <airween(a)gmail.com> wrote: > without any real testing, I'm afraid that the rule{0} gives the > write access to cn=groupabcadmin to _all_ db, not just the ou=ABC > Cumstomer subtree. > > Em I right? Hm, yes, that's correct. You'll need to do something like utilize by * break appropriately, or have multiple "access to userPassword" ACLs by group, then a catchall after that. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: Admin roles by group membership per OU
by Quanah Gibson-Mount 16 Oct '17

16 Oct '17

--On Monday, October 16, 2017 11:45 AM +0200 Ervin Hegedüs <airween(a)gmail.com> wrote: > dn: olcDatabase={1}mdb,cn=config > olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by > anonymous auth by dn="uid=repuser,dc=core,dc=hdt,dc=hu" read by * none > olcAccess: {1}to dn.children="ou=ABC Customer,dc=core,dc=hdt,dc=hu" by > self write by group.exact="cn=groupabcadmin,ou=ABC > Customer,dc=core,dc=hdt,dc=hu" write by > dn="uid=repuser,dc=core,dc=hdt,dc=hu" read olcAccess: {2}to * by * read > > > and a member of cn=groupabcadmin,ou=ABC Customer,dc=core,dc=hdt,dc=hu > can modify any attributes at any users under the ou=ABC Customer, > EXCEPT the userPassword - when I want to modify that, I get > permission error: That would be expected, given your ACLs. > How can I combine the attrs and group permissions? Should I list > all attributes in rule? You need to add a rule in the userPassword ACL to allow the group to write to the attribute. ACLs are processed in the order they are listed, and STOP at the first match. This is clearly documented in the slapd.access(5) man page. I.e., you would need: dn: olcDatabase={1}mdb,cn=config olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymous auth by dn="uid=repuser,dc=core,dc=hdt,dc=hu" read by group.exact="cn=groupabcadmin,ou=ABC Customer,dc=core,dc=hdt,dc=hu" write olcAccess: {1}to dn.children="ou=ABC Customer,dc=core,dc=hdt,dc=hu" by self write by group.exact="cn=groupabcadmin,ou=ABC Customer,dc=core,dc=hdt,dc=hu" write by dn="uid=repuser,dc=core,dc=hdt,dc=hu" read olcAccess: {2}to * by * read I would note again that "by * none" is implicit on any ACL, there's no need to specifically list it. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: Initialize ldap with mdb
by Howard Chu 16 Oct '17

16 Oct '17

Michael Ströder wrote: > rammohan ganapavarapu wrote: >> You mean we can resize db any time? > > You can increase but *not decrease* maxsize later. > >> Wouldn't it be nice to have no max >> limit and grow db dynamically? > > Not possible with a memory-mapped DB. > Others can explain better in detail why. "No limit" is kind of a pointless phrase. The physical limit will always be the size of free space in your filesystem. Aside from that you can simply do what the documentation says - configure a huge size and let the DB grow dynamically within that size. Use 64TB or whatever, and forget about it. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: Admin roles by group membership per OU
by Quanah Gibson-Mount 16 Oct '17

16 Oct '17

--On Thursday, October 12, 2017 6:32 PM +0200 Ervin Hegedüs <airween(a)gmail.com> wrote: > rules: > > olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by > anonymous auth by dn="uid=repuser,dc=core,dc=hdt,dc=hu" read by * none > olcAccess: {1}to dn.base="" by * read > olcAccess: {2}to dn.children="ou=ABC Customer,dc=core,dc=hdt,dc=hu" by > self write by group.exact="cn=groupabcadmin,ou=ABC > Customer,dc=core,dc=hdt,dc=hu" write by self write by anonymous auth by > dn="uid=repuser,dc=mycompany,dc=hu" read olcAccess: {3}to * by * read Your olcAccess: {1} value does not belong in your back-MDB database. That rule goes in the {-1}frontend,cn=config portion of the database as a global access rule. You probably also want a rule that reads: to dn.base="cn=subschema" by * read in the {-1}frontend,cn=config database as well. So for your back-mdb database, what one would expect is more something like: olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymous auth by dn="uid=repuser,dc=core,dc=hdt,dc=hu" read olcAccess: {1}to dn.children="ou=ABC Customer,dc=core,dc=hdt,dc=hu" by self write by group.exact="cn=groupabcadmin,ou=ABC Customer,dc=core,dc=hdt,dc=hu" write by dn="uid=repuser,dc=core,dc=hdt,dc=hu" read olcAccess: {2}to * by * read --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 2

Ensure uniqueness over multiple attributes?
by Karsten Heymann 13 Oct '17

13 Oct '17

Hi, does the unique overlay support checking multiple values for a single uniqueness check? Our clients can use emails in two attributes (think mail and mailAlias) and addresses have to be unique in regard to both fields, which means an address that is used in either of them cannot be used in any other of them. Is that possible? +Karsten

3 4

Re: [ldapmodify] multiple entries of the same attibute
by Quanah Gibson-Mount 13 Oct '17

13 Oct '17

--On Friday, October 13, 2017 6:06 PM +0200 richard lucassen <mailinglists(a)lucassen.org> wrote: > How do I tell ldapmodify just to delete 1 particular item with > AttributeValue=X, and not all of them? You do a delete+add, just like Dieter said. What you did in your example was a replace op. I.e., you'd do something like: dn: <whatever> changetype: modify delete: mail mail: my-value - add: mail mail: my-value --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: Small tip to speed up large imports with ldapadd
by Quanah Gibson-Mount 13 Oct '17

13 Oct '17

--On Friday, October 13, 2017 5:44 PM +0200 Karsten Heymann <karsten.heymann(a)gmail.com> wrote: > > Hi Quanah, > > > > 2017-10-13 16:15 GMT+02:00 Quanah Gibson-Mount <quanah(a)symas.com>: > > Why not just set dbnosync option as documented in the > slapd-mdb(5)/slapd-bdb(5)/slapd-hdb(5) man pages? > > > > > I tried that as well, and it made the import faster, but at least in my > setup using eatmydata still was a *lot* faster. > > > Another option, which I didn't think about when building my test setup, > would have been to put the data directory into a ram disk during the > import and move it to disk afterwards. > > > Either way, each variant seem quite similiar with regard to what effort > they take, so I'm quite happy with my setup. If you're using back-mdb, you could play with the writemap environment flag as well. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Small tip to speed up large imports with ldapadd
by Karsten Heymann 13 Oct '17

13 Oct '17

Hi Quanah, 2017-10-13 16:15 GMT+02:00 Quanah Gibson-Mount <quanah(a)symas.com>: > > Why not just set dbnosync option as documented in the > slapd-mdb(5)/slapd-bdb(5)/slapd-hdb(5) man pages? > I tried that as well, and it made the import faster, but at least in my setup using eatmydata still was a *lot* faster. Another option, which I didn't think about when building my test setup, would have been to put the data directory into a ram disk during the import and move it to disk afterwards. Either way, each variant seem quite similiar with regard to what effort they take, so I'm quite happy with my setup. BR Karsten

1 0

Re: [ldapmodify]multiple entries of the same attibute
by Quanah Gibson-Mount 13 Oct '17

13 Oct '17

--On Friday, October 13, 2017 3:29 PM +0200 Ralf Mattes <rm(a)mh-freiburg.de> wrote: >> Is there a way to tell ldapmodify to change just a particular entry? > > A change of a single value equals a delete of that value plus an add of > the new value, doesn't it? Yes. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Small tip to speed up large imports with ldapadd
by Quanah Gibson-Mount 13 Oct '17

13 Oct '17

--On Friday, October 13, 2017 4:57 PM +0200 Karsten Heymann <karsten.heymann(a)gmail.com> wrote: > - I like the way ldapadd logs complete entries it failed to import, that > makes analyising the cause of the import error much simpler, after e.g. > fixing the schema I can ldapdd these error files directly again to see if > the fix works Why not just set dbnosync option as documented in the slapd-mdb(5)/slapd-bdb(5)/slapd-hdb(5) man pages? --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Small tip to speed up large imports with ldapadd
by Karsten Heymann 13 Oct '17

13 Oct '17

Hi, as I am in the situation where I have to do large imports with ldapadd, I wanted to share a little tip that is saving me a lot of time and may be helpful to others too. As I don't care for data consistency *while* importing (if the import should abort, I can alway restart the process), I'm stopping the regular slapd and run it manually under the control of 'eatmydata', a little tool that LD_PRELOAD's all filesystem sync operations to noops. This has increased the speed of my import tests by several orders of magnitude. Here's my script (slightly obfuscated): systemctl stop slapd rm -f /srv/ldap/data/* systemd-run --unit=slapd-fastimport eatmydata /usr/sbin/slapd -d 0 -s 0 -h ldapi:/// -g openldap -u openldap -F /etc/ldap/slapd.d sleep 2 ldapadd -Y EXTERNAL -H ldapi:/// -Q -c -S errorlog -f data.ldif systemctl stop slapd-fastimport sleep 2 systemctl start slapd grep Error: errorlog | sort | uniq -c | sort -n Best regards Karsten

2 2

Admin roles by group membership per OU
by Ervin Hegedüs 12 Oct '17

12 Oct '17

Hi, here is my scenario: dn: dc=mycompany,dc=hu dn: ou=ABC Customer,dc=mycompany,dc=hu +- dn: cn=group1abc,ou=ABC Customer,dc=mycompany,dc=hu +- dn: cn=group2abc,ou=ABC Customer,dc=mycompany,dc=hu +- dn: cn=groupabcadmin,ou=ABC Customer,dc=mycompany,dc=hu +- dn: uid=user1,ou=ABC Customer,dc=mycompany,dc=hu +- dn: uid=user2,ou=ABC Customer,dc=mycompany,dc=hu dn: ou=XYZ Customer,dc=mycompany,dc=hu +- dn: cn=group1xyz,ou=XYZ Customer,dc=mycompany,dc=hu +- dn: cn=group2xyz,ou=XYZ Customer,dc=mycompany,dc=hu +- dn: uid=user1,ou=XYZ Customer,dc=mycompany,dc=hu +- dn: uid=user2,ou=XYZ Customer,dc=mycompany,dc=hu ... the cn=groupabcadmin,ou=ABC Customer node above looks like this: dn: cn=groupabcadmin,ou=ABC Customer,dc=mycompany,dc=hu objectClass: groupOfNames cn: groupabcadmin member: uid=user1,ou=ABC Customer,dc=mycompany,dc=hu I'ld like to set up, that the all member of cn=groupabcadmin group, now the "uid=user1,ou=ABC Customer",... user can write the db (add, modify, delete) under his own OU, specially the ou=ABC Customer,dc=mycompany,dc=hu. I've found this example: http://www.openldap.org/faq/data/cache/52.html Now the config looks like this: dn: olcDatabase={1}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=mycompany,dc=hu olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymous auth by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by * read olcAccess: {3}to dn.children="ou=ABC Customer,dc=mycompany,dc=hu" by self write by group.exact="cn=groupabcadmin,ou=ABC Customer,dc=mycompany,dc=hu" write by * auth olcLastMod: TRUE The uid=user1 user password is right, I can read with it from DB. But when I would like to add a new user, I've got: ldap_add: Insufficient access (50) additional info: no write access to parent and in log: Oct 11 17:03:16 open-ldap slapd[25821]: mdb_dn2entry("uid=user2,ou=abc customer,dc=mycompany,dc=hu") Oct 11 17:03:16 open-ldap slapd[25821]: => mdb_dn2id("uid=user2,ou=abc customer,dc=mycompany,dc=hu") Oct 11 17:03:16 open-ldap slapd[25821]: <= mdb_dn2id: get failed: MDB_NOTFOUND: No matching key/data pair found (-30798) Oct 11 17:03:16 open-ldap slapd[25821]: => mdb_entry_decode: Oct 11 17:03:16 open-ldap slapd[25821]: <= mdb_entry_decode Oct 11 17:03:16 open-ldap slapd[25821]: => access_allowed: add access to "ou=ABC Customer,dc=mycompany,dc=hu" "children" requested Oct 11 17:03:16 open-ldap slapd[25821]: => dn: [2] Oct 11 17:03:16 open-ldap slapd[25821]: => acl_get: [3] attr children Oct 11 17:03:16 open-ldap slapd[25821]: => acl_mask: access to entry "ou=ABC Customer,dc=mycompany,dc=hu", attr "children" requested Oct 11 17:03:16 open-ldap slapd[25821]: => acl_mask: to all values by "uid=user1,ou=abc customer,dc=mycompany,dc=hu", (=0) Oct 11 17:03:16 open-ldap slapd[25821]: <= check a_dn_pat: * Oct 11 17:03:16 open-ldap slapd[25821]: <= acl_mask: [1] applying read(=rscxd) (stop) Oct 11 17:03:16 open-ldap slapd[25821]: <= acl_mask: [1] mask: read(=rscxd) Oct 11 17:03:16 open-ldap slapd[25821]: => slap_access_allowed: add access denied by read(=rscxd) Oct 11 17:03:16 open-ldap slapd[25821]: => access_allowed: no more rules Oct 11 17:03:16 open-ldap slapd[25821]: mdb_add: no write access to parent Oct 11 17:03:16 open-ldap slapd[25821]: send_ldap_result: conn=1208 op=1 p=3 Oct 11 17:03:16 open-ldap slapd[25821]: send_ldap_result: err=50 matched="" text="no write access to parent" Oct 11 17:03:16 open-ldap slapd[25821]: send_ldap_response: msgid=2 tag=105 err=50 Oct 11 17:03:16 open-ldap slapd[25821]: conn=1208 op=1 RESULT tag=105 err=50 text=no write access to parent What do I miss? Thanks, a.

3 8

Question about automounting nfs directories within ldap
by Bänsch, Christian (TF) 12 Oct '17

12 Oct '17

Dear Community, thank you for your help to made my ldap configuration runnable and the login for users working. Now I have the next question about automounting nfs directories. In my /etc/exports I have several directories /export/home 10.188.114.0/25(fsid=0,rw,sync,root_squash,secure,no_subtree_check) /export/software/linux 10.188.114.0/25(rw,root_squash,sync,subtree_check,secure) /export/calculate 10.188.114.0/25(rw,root_squash,sync,no_subtree_check) I want to export when the ldap user is going to login. But when I do this, I´ll get those error messages. Oct 9 09:59:13 fautm89 automount[13131]: attempting to mount entry /home/iwtm009 Oct 9 09:59:13 fautm89 automount[13131]: >> mount.nfs: access denied by server while mounting fautm89.ltm.uni-erlangen.de:/export/home/iwtm009 Oct 9 09:59:13 fautm89 automount[13131]: mount(nfs): nfs: mount failure fautm89.ltm.uni-erlangen.de:/export/home/iwtm009 on /home/iwtm009 Oct 9 09:59:13 fautm89 automount[13131]: failed to mount /home/iwtm009 Oct 9 10:00:01 fautm89 automount[13131]: attempting to mount entry /local/calculate Oct 9 10:00:01 fautm89 automount[13131]: >> mount.nfs: access denied by server while mounting fautm89.ltm.uni-erlangen.de:/export/calculate Oct 9 10:00:01 fautm89 automount[13131]: mount(nfs): nfs: mount failure fautm89.ltm.uni-erlangen.de:/export/calculate on /local/calculate Oct 9 10:00:01 fautm89 automount[13131]: failed to mount /local/calculate Oct 9 10:00:14 fautm89 automount[13131]: attempting to mount entry /local/linux Oct 9 10:00:14 fautm89 automount[13131]: >> mount.nfs: access denied by server while mounting fautm89.ltm.uni-erlangen.de:/export/software/linux Oct 9 10:00:14 fautm89 automount[13131]: mount(nfs): nfs: mount failure fautm89.ltm.uni-erlangen.de:/export/software/linux on /local/linux Oct 9 10:00:14 fautm89 automount[13131]: failed to mount /local/linux When I do e.g. a ls -la in /home on the server, I get drwx------ 79 iwtm009 tm 4096 Aug 22 13:15 iwtm009/ on the client I get dr-xr-xr-x 2 root root 0 Oct 9 09:47 iwtm009 Should I have to adjust this in slapd configuration or am I just blind to see it? -- Thank you in advance and best regards, Christian

2 2

Re: Replication error
by Quanah Gibson-Mount 12 Oct '17

12 Oct '17

--On Tuesday, October 10, 2017 6:39 PM +0200 Ervin Hegedüs <airween(a)gmail.com> wrote: > binddn="uid=repuser,dc=my,dc=domain,dc=hu" > Anyway - how can I solve this problem? Your uid=repuser,dc=my,dc=domain,dc=hu user does not have "read" access on the userPassword attribute. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 2

Re: make test seg fault related to libc
by Quanah Gibson-Mount 12 Oct '17

12 Oct '17

--On Wednesday, October 11, 2017 1:02 PM -0700 Scott Classen <sclassen(a)lbl.gov> wrote: ># ulimit -a Hm, well, that doesn't appear to be it. :/ You might look at the testrun logs and see what slapd is logging when it dies as well. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: make test seg fault related to libc
by Quanah Gibson-Mount 11 Oct '17

11 Oct '17

--On Wednesday, October 11, 2017 10:44 AM -0700 Scott Classen <sclassen(a)lbl.gov> wrote: > Hello, > > I've built openldap 2.4.45 on a CentOS 7.4.1708 machine with the > following configuration: I've seen this happen when a ulimit value was unreasonably small. Check the limits on -m or -v perhaps. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

make test seg fault related to libc
by Scott Classen 11 Oct '17

11 Oct '17

Hello, I've built openldap 2.4.45 on a CentOS 7.4.1708 machine with the following configuration: ./configure --enable-bdb=no --enable-hdb=no --enable-mdb --with-tls=openssl --enable-spasswd --enable-syslog --enable-modules --enable-cleartext --enable-overlays --enable-accesslog --enable-auditlog --with-threads --enable-shared --enable-ldap --enable-monitor --enable-deref --enable-slapd --enable-ppolicy --enable-memberof When I run make test I receive numerous segmentation faults: output from make test: > ./scripts/test028-idassert: line 252: 28923 Segmentation fault (core dumped) $SLAPD -f $CONF1 -h $URI1 -d $LVL $TIMING > $LOG1 2>&1 > >>>>> test028-idassert completed OK for mdb. > > >>>>> Starting test029-ldapglue for mdb... > running defines.sh > ### This test requires the ldap backend and glue overlay. > ### If available, and explicitly requested, it can use SASL bind; > ### note that SASL must be properly set up, and the requested > ### mechanism must be available. Define SLAPD_USE_SASL={yes|<mech>}, > ### with "yes" defaulting to DIGEST-MD5 to enable SASL authc[/authz]. > Using proxyAuthz with simple authc... > Running slapadd to build slapd database... > Starting local slapd on TCP/IP port 9011... > Starting remote slapd 1 on TCP/IP port 9012... > Starting remote slapd 2 on TCP/IP port 9013... > Using ldapsearch to check that slapd is running... > Using ldapsearch to check that slapd is running... > Using ldapsearch to check that slapd is running... > Testing ldapsearch as uid=bjorn,ou=People,dc=example,dc=com for "dc=example,dc=com"... > Filtering ldapsearch results... > Filtering original ldif used to create database... > Comparing filter output... > Testing ldapsearch as anonymous for "dc=example,dc=com"... > Filtering ldapsearch results... > Filtering original ldif used to create database... > Comparing filter output... > >>>>> Test succeeded > ./scripts/test029-ldapglue: line 222: 28992 Segmentation fault (core dumped) $SLAPD -f $CONF1 -h $URI1 -d $LVL $TIMING > $LOG1 2>&1 > ./scripts/test029-ldapglue: line 222: 28994 Segmentation fault (core dumped) $SLAPD -f $CONF2 -h $URI2 -d $LVL $TIMING > $LOG2 2>&1 > ./scripts/test029-ldapglue: line 222: 28996 Segmentation fault (core dumped) $SLAPD -f $CONF3 -h $URI3 -d $LVL $TIMING > $LOG3 2>&1 > >>>>> test029-ldapglue completed OK for mdb. In /var/log/messages: > Oct 11 09:31:42 www kernel: slapd[9039]: segfault at 1100fffff7 ip 00007febd7a2f4dc sp 00007ffe832541f8 error 4 in libc-2.17.so[7febd79af000+1b8000] > Oct 11 09:31:42 www kernel: slapd[8997]: segfault at 1100fffff7 ip 00007f48923e44dc sp 00007ffec5a22658 error 4 in libc-2.17.so[7f4892364000+1b8000] > Oct 11 09:31:42 www kernel: slapd[8975]: segfault at 1100fffff7 ip 00007f01a727d4dc sp 00007ffd9a127698 error 4 in libc-2.17.so[7f01a71fd000+1b8000] > Oct 11 09:31:42 www abrt-hook-ccpp: Process 8975 (slapd) of user 0 killed by SIGSEGV - ignoring (repeated crash) > Oct 11 09:31:42 www abrt-hook-ccpp: Process 9039 (slapd) of user 0 killed by SIGSEGV - dumping core > Oct 11 09:31:42 www abrt-hook-ccpp: Process 8997 (slapd) of user 0 killed by SIGSEGV - dumping core I don't see any obvious problems with the linked libraries: [me@here openldap-2.4.45]# ldd servers/slapd/slapd linux-vdso.so.1 => (0x00007ffd98751000) libltdl.so.7 => /lib64/libltdl.so.7 (0x00007f930d78b000) libicuuc.so.50 => /lib64/libicuuc.so.50 (0x00007f930d412000) libicudata.so.50 => /lib64/libicudata.so.50 (0x00007f930be3d000) libsasl2.so.3 => /lib64/libsasl2.so.3 (0x00007f930bc20000) libssl.so.10 => /lib64/libssl.so.10 (0x00007f930b9ae000) libcrypto.so.10 => /lib64/libcrypto.so.10 (0x00007f930b54c000) libresolv.so.2 => /lib64/libresolv.so.2 (0x00007f930b332000) libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f930b116000) libc.so.6 => /lib64/libc.so.6 (0x00007f930ad52000) libdl.so.2 => /lib64/libdl.so.2 (0x00007f930ab4e000) libstdc++.so.6 => /lib64/libstdc++.so.6 (0x00007f930a846000) libm.so.6 => /lib64/libm.so.6 (0x00007f930a543000) libgcc_s.so.1 => /lib64/libgcc_s.so.1 (0x00007f930a32d000) libcrypt.so.1 => /lib64/libcrypt.so.1 (0x00007f930a0f6000) libgssapi_krb5.so.2 => /lib64/libgssapi_krb5.so.2 (0x00007f9309ea8000) libkrb5.so.3 => /lib64/libkrb5.so.3 (0x00007f9309bc0000) libcom_err.so.2 => /lib64/libcom_err.so.2 (0x00007f93099bc000) libk5crypto.so.3 => /lib64/libk5crypto.so.3 (0x00007f9309788000) libz.so.1 => /lib64/libz.so.1 (0x00007f9309572000) /lib64/ld-linux-x86-64.so.2 (0x000055eefaf24000) libfreebl3.so => /lib64/libfreebl3.so (0x00007f930936e000) libkrb5support.so.0 => /lib64/libkrb5support.so.0 (0x00007f9309160000) libkeyutils.so.1 => /lib64/libkeyutils.so.1 (0x00007f9308f5c000) libselinux.so.1 => /lib64/libselinux.so.1 (0x00007f9308d34000) libpcre.so.1 => /lib64/libpcre.so.1 (0x00007f9308ad2000) Any advice or suggestions would be welcome. Regards, Scott

1 0

Re: Upgrade from 2.4.40 to 2.4.44
by Quanah Gibson-Mount 11 Oct '17

11 Oct '17

--On Friday, September 15, 2017 9:18 AM -0700 Ryan Tandy <ryan(a)nardis.ca> wrote: > IIRC slapcat doesn't work in this case, because it fails to initialize > the ppolicy module. > > The linked CentOS and RHEL bugs recommend downgrading slapd to the > previously working version and using ldapmodify. Yeah, that's ugly :/ Another reason we really need to get slapmodify out, and some way to execute it with an option to not load modules or similar. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

4 3

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical