- openldap-technical - openldap.org

invalid structural object class chain (account/krbPrincipal)
by Prentice Bisbal 16 May '17

16 May '17

So with you help, I managed to fix my initial issues of adding some additional schemas to my system. Now, when I try to add the directory data from my old LDAP servers with slapcat, I'm getting the following structural error: (line=168): (65) invalid structural object class chain (account/krbPrincipal) The relevant portions for the offending dn look like this: objectClass: top objectClass: account objectClass: posixAccount objectClass: shadowAccount objectClass: krbPrincipal structuralObjectClass: account I should point out that I recently inherited this LDAP directory, and now I'm upgrading the LDAP servers to new hardware and a new OS with a much new version of OpenLDAP. I've never seen the stucturalObjectClass attribute before. From my experience, when you get errors like this, it's because either the schemas have changed, or someone used the -c switch when adding new entries to the directory. Usually it's the latter. I have googled my error and found many discussions for 'invalid structural object chain' on this list, but none of them seem to apply to this case. Most problem seemed be caused by having multiple conflicting STRUCTURAL object classes in one entry, but that doesn't seem to be the case since krbPrincipal is not STRUCTURAL. It's also not AUXILIARY: objectclass ( 2.16.840.1.113719.1.301.6.9.1 NAME 'krbPrincipal' SUP top MUST ( krbPrincipalName ) MAY ( krbObjectReferences ) ) account is STRUCTURAL: objectclass ( 0.9.2342.19200300.100.4.5 NAME 'account' SUP top STRUCTURAL MUST userid MAY ( description $ seeAlso $ localityName $ organizationName $ organizationalUnitName $ host ) ) but posixAccount and shadowAccount are AUXILIARY : objectclass ( 1.3.6.1.1.1.2.0 NAME 'posixAccount' DESC 'Abstraction of an account with POSIX attributes' SUP top AUXILIARY MUST ( cn $ uid $ uidNumber $ gidNumber $ homeDirectory ) MAY ( userPassword $ loginShell $ gecos $ description ) ) objectclass ( 1.3.6.1.1.1.2.1 NAME 'shadowAccount' DESC 'Additional attributes for shadow passwords' SUP top AUXILIARY MUST uid MAY ( userPassword $ shadowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpire $ shadowFlag $ description ) ) Any ideas for how to fix this? Could I just remove the account objectClass? I'm not sure whether or not we're using any of it's attributes. -- Prentice

2 3

Help with assertion control
by Sudhindra M R 16 May '17

16 May '17

Hi I am facing problem sending Assertion Control with LDAP DelRequest message. I am getting this error: 591950a9 begin get_filter 591950a9 conn=1004 op=1 DISCONNECT tag=120 err=2 text=error decoding filter 591950a9 conn=1004 op=1 DISCONNECT tag=120 err=2 text=error decoding filter 591950a9 conn=1004 op=1 do_delete: get_ctrls failed My code snippet looks like below: std::string keyy = "(&(cn=Manager)(givenName=Sudhi))"; struct berval * berEncodedFilter = ber_bvstr(keyy.c_str()); LDAPControl* serverControl[2]; return_code = ldap_control_create(LDAP_CONTROL_ASSERT, 0, berEncodedFilter, 0, &(serverControl[0])); serverControl[1] = NULL; return_code = ldap_delete_ext(m_connection, dn.c_str(), serverControl, 0, &msgID); ber_bvfree(berEncodedFilter); ldap_control_free(serverControl[0]); Is there an issue in this code? Please help. Thanks Sudhi

2 1

2.4.44 reproducible segfault via ldap search operation
by Karsten Heymann 16 May '17

16 May '17

Hi, some hours ago I found a way to instantly kill our (production -sigh- ) slapd processed with a simple unauthenticated ldap search operation. We are running 2.4.40 (from debian wheezy-backports) in production but I was able to reproduce exactly the same behaviour with 2.4.44 (taken from debian jessie-backports). While I'm building a minimal testcase without internal information so I can provide it to the project (are there more bug submission guidelines than http://www.openldap.org/faq/data/cache/59.html ?), I wanted to ask how you want me to handle this in my eyes quite serious incident. Should I just post it to the mailing list or do you prefer a non-public transmission first so the bug does not get exploited in a denial of service use case before you had the chance to come up with a fix? I will also try to verify if the problem is still existing in the current git master or self compiled 2.4.44. Best regards, Karsten

2 2

Re: Client binding to a specific local address
by Quanah Gibson-Mount 16 May '17

16 May '17

Be sure and raise it for discussion on the -devel list before starting work. --Quanah > On May 15, 2017, at 7:13 PM, Daniel Le <daniel.le(a)exfo.com> wrote: > > I filed http://www.openldap.org/its/index.cgi?findid=8654 and will be working on it as well. > > Daniel > > -----Original Message----- > From: Michael Ströder [mailto:michael@stroeder.com] > Sent: Saturday, May 13, 2017 6:58 AM > To: Daniel Le <daniel.le(a)exfo.com> > Cc: openldap-technical(a)openldap.org > Subject: Re: Client binding to a specific local address > > Daniel Le wrote: >> Thanks Quanah and Michael. I much appreciate your help. >> >> I am new to this list. How do I submit an enhancement request? Or would you be willing >> to do it on behalf of the community? > > You can file a RFE request here: > http://www.openldap.org/its/ > > Ciao, Michael. >

1 0

Re: Client binding to a specific local address
by Quanah Gibson-Mount 15 May '17

15 May '17

--On Thursday, May 11, 2017 5:24 PM -0500 Quanah Gibson-Mount <quanah(a)symas.com> wrote: > Ah I see. No such option at this time that I am aware of. Yeah, looking at os-ip.c in libldap, we have no option to use bind(2), and purely use connect(2). I suppose this could be seen as an enhancement request. do{ osip_debug(ld, "attempting to connect: \n", 0, 0, 0); if ( connect(s, sin, addrlen) != AC_SOCKET_ERROR ) { --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

3 3

Transaction log files generated too frequently and DB_LOG_AUTOREMOVE setting does not remove old log files
by Joanne Yan Fu 13 May '17

13 May '17

I have a relatively small OpenLDAP DB (ldif backup file is less than 7M and total size of *bdb files is less than 20M), that handles mostly read requests and few write requests. The servers are configured to run in a cluster env using master-master replication. Recently, the servers ran out of space as the transaction log files accumulated. We deleted the old log files manually (as attemp on using "DB_ARCHIVE -d" failed) and were able to restart one of the servers, however noticed the transaction log files (with default size of 10M) were created too frequently ever since (can be 80 files a day). In peak hours, the 10M transaction log files was generated every min I am sure there were not so many write activities. Does anyone know what could cause the creation of the tranaction log files so frequently? In addition, I had set "set_flags DB_LOG_AUTOREMOVE" flag along with check point settings in one of the servers running in cluster, but the log files were not removed automatically. Am I supposed to set the configurations on each server in the cluster to make it working on any of the servers? Here are some settings and server information: - OpenLDAP: slapd 2.4.23 on linux - In slapd.conf: database bdb ... checkpoint 1024 15 - In DB_CONFIG #the cache size is a little too big, we will tune it down later. Hope this will not be an issue set_cachesize 0 268435456 1 set_lg_regionmax 262144 set_lg_bsize 2097152 set_flags DB_LOG_AUTOREMOVE - a sublist of log files: -rw------- 1 ldap ldap 10485760 May 11 14:50 log.0000000068 -rw------- 1 ldap ldap 10485760 May 11 14:52 log.0000000069 -rw------- 1 ldap ldap 10485760 May 11 14:53 log.0000000070 -rw------- 1 ldap ldap 10485760 May 11 14:54 log.0000000071 -rw------- 1 ldap ldap 10485760 May 11 14:55 log.0000000072 Thanks, Joanne

2 1

Re: Client binding to a specific local address
by Michael Ströder 12 May '17

12 May '17

Ralf, please stay on the mailing list. Ralf Mattes wrote: > Am Freitag, 12. Mai 2017 08:03 CEST, Michael Ströder <michael(a)stroeder.com> schrieb: > >> Quanah Gibson-Mount wrote: >>> Ah I see. No such option at this time that I am aware of. >> >> I'd also see this as a useful feature. > > Admitedly more out of curiosity than need: why? > [..] > The only time a TCP connection can have more than one source IP is when there are > multiple _routes_ to the same target IP - not something very common (and often a sign > of miss- configuration). I have such a configuration (for SMTP) and it's not a misconfiguration. Ciao, Michael.

1 0

Re: Client binding to a specific local address
by Quanah Gibson-Mount 12 May '17

12 May '17

Ah I see. No such option at this time that I am aware of. --Quanah > On May 11, 2017, at 1:42 PM, Daniel Le <daniel.le(a)exfo.com> wrote: > > Indeed, similarly to "telnet -b <client-local-address>" or Microsoft LDAP client API function ldap_set_option(LDAP_OPT_SOCKET_BIND_ADDRESSES...) and my system is a multi-homed host. > > Daniel > > -----Original Message----- > From: Michael Ströder [mailto:michael@stroeder.com] > Sent: Thursday, May 11, 2017 4:26 PM > To: Quanah Gibson-Mount <quanah(a)symas.com>; Daniel Le <daniel.le(a)exfo.com>; 'openldap-technical(a)openldap.org' <openldap-technical(a)openldap.org> > Subject: Re: Client binding to a specific local address > > Quanah Gibson-Mount wrote: >> --On Thursday, May 11, 2017 6:38 PM +0000 Daniel Le <daniel.le(a)exfo.com> wrote: >>> Thanks for the answer, however the -h <URI/URL> appears to be a server >>> (slapd) option. I'm looking for the LDAP client side which uses OpenLDAP >>> libldap and liblber libraries. >> >> You may wish to more carefully read my response (Hint: -h and -H are not the same >> thing). You may also wish to refer to the man pages for client utilities such as >> ldapsearch, (which use the LDAP client side API). > > Maybe there's a misunderstanding: > > As I read it Daniel asks for setting the client's *out-going* IP address, something like > telnet -b <local-address>. Probably he's on a multi-homed host or has a more complicated > IP configuration and has to use a specific out-going address for getting his packets > accepted by the server. > > Ciao, Michael. >

2 1

RE: Client binding to a specific local address
by Quanah Gibson-Mount 12 May '17

12 May '17

--On Thursday, May 11, 2017 11:57 PM +0000 Daniel Le <daniel.le(a)exfo.com> wrote: > Thanks Quanah and Michael. I much appreciate your help. > > I am new to this list. How do I submit an enhancement request? Or would > you be willing to do it on behalf of the community? You can file the request at http://www.openldap.org/its/ If you wish to do the related work, then see also <http://www.openldap.org/devel/contributing.html> I would note there is no guarantee on if/when said feature would be implemented. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Error adding schema: empty AttributeDescription
by Quanah Gibson-Mount 11 May '17

11 May '17

--On Thursday, May 11, 2017 4:34 PM -0400 Prentice Bisbal <pbisbal(a)pppl.gov> wrote: > Is my perception wrong? Yes. You could, for example, to convert "test.schema" that had dependencies on core, cosine, and inetorgperson.schema do the following. a) Create a file named "/tmp/test.conf" with the following contents: include /opt/zimbra/openldap/etc/openldap/schema/core.schema include /opt/zimbra/openldap/etc/openldap/schema/cosine.schema include /opt/zimbra/openldap/etc/openldap/schema/inetorgperson.schema include /tmp/ldap/schema/test.schema b) mkdir -p /tmp/ldap c) slaptest -f /tmp/test.conf -F /tmp/ldap d) Go and grab your newly converted schema file. It will have been numbered in order as it appeared in the conf file, so you'll likely want to tweak it slight, and adjust the dn for adding it via ldapadd. Hope that helps! --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

RE: Client binding to a specific local address
by Quanah Gibson-Mount 11 May '17

11 May '17

--On Thursday, May 11, 2017 6:38 PM +0000 Daniel Le <daniel.le(a)exfo.com> wrote: > Thanks for the answer, however the -h <URI/URL> appears to be a server > (slapd) option. I'm looking for the LDAP client side which uses OpenLDAP > libldap and liblber libraries. You may wish to more carefully read my response (Hint: -h and -H are not the same thing). You may also wish to refer to the man pages for client utilities such as ldapsearch, (which use the LDAP client side API). --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

3 3

Re: Error adding schema: empty AttributeDescription
by Quanah Gibson-Mount 11 May '17

11 May '17

--On Thursday, May 11, 2017 2:07 PM -0700 Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Thursday, May 11, 2017 4:34 PM -0400 Prentice Bisbal > <pbisbal(a)pppl.gov> wrote: > >> Is my perception wrong? > > Yes. You could, for example, to convert "test.schema" that had > dependencies on core, cosine, and inetorgperson.schema do the following. > > a) Create a file named "/tmp/test.conf" with the following contents: > > include /opt/zimbra/openldap/etc/openldap/schema/core.schema > include /opt/zimbra/openldap/etc/openldap/schema/cosine.schema > include /opt/zimbra/openldap/etc/openldap/schema/inetorgperson.schema > include /tmp/ldap/schema/test.schema Heh, adjust those paths of course to the actual locations of the core/cosine/inetorgperson schema files. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

RE: Client binding to a specific local address
by Quanah Gibson-Mount 11 May '17

11 May '17

--On Thursday, May 11, 2017 8:33 PM +0000 Daniel Le <daniel.le(a)exfo.com> wrote: > I'm working on an embedded LDAP application software that makes use of > the OpenLDAP client ldap and lber libraries, not the LDAP client > command-line utilities. For that reason, I didn't look into the client > utilities and narrowly thought of slapd -h (where -H option doesn't > exist). > > I see the client utilities ldapsearch, ldapadd, ldapmodify... have the > [-H ldapuri] option, but the library functions ldap_search, > ldap_search_ext, ldap_add, ldap_add_ext, ldap_modify, ldap_modify_ext, > etc. don't have an equivalent input argument. Is it correct that no > client library function supports specification of a local IP address? As I noted, the LDAP client tools all use the C API. Clearly you can pass in a URI when initializing the connection to create the filehandle that is later utilized by functions such as ldap_search, etc. I would strongly advise reading the ldap_open(3) man page, more specifically the ldap_initialize() function detailed there. I would also note that it is perfectly valid for "host" as described in the man page to be an IP address vs a literal hostname. My point in directing you to the clients is you can trivially see how they use the API to construct a connection, etc, using the LDAP C API. Hope that helps. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Error adding schema: empty AttributeDescription
by Quanah Gibson-Mount 11 May '17

11 May '17

--On Thursday, May 11, 2017 12:15 PM +0100 Sami <s.aitalioulahcen(a)cnrst.ma> wrote: > Hello, > > The attribute type description, as per RFC2252, requires a space before > the closing parenthesis. It might be what's causing the error. I'd also note it's generally recommended to use slaptest (as documented) to convert existing schema files to LDIF format, to avoid errors such as this. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: Client binding to a specific local address
by Quanah Gibson-Mount 11 May '17

11 May '17

--On Wednesday, May 10, 2017 8:05 PM +0000 Daniel Le <daniel.le(a)exfo.com> wrote: > > > Hi, > > > > Is there an API to bind client to a local IP address? If not, how best to > directly handle a BER socket for such purpose? The reason is to direct > traffic to go through a specific interface of a host that has multiple > NICs. There is no option in ldap_set_option() for address binding. I > found the thread "listener question" from the OpenLDAP Technical > archives which asked a similar question, but not exactly the same. Use the IP address as the URI, like -H ldap://1.2.3.4:389 --quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Error adding schema: empty AttributeDescription
by Prentice Bisbal 11 May '17

11 May '17

Hello, I'm in the middle of upgrading our existing LDAP servers to new systems running OpenLDAP 2.4.40 on CentOS 6.9. I have over 10 years of experience managing LDAP directories in relatively simple environments, but this is my first time trying to use the dynamic runtime configuration engine. I'm trying to add all the schemas I need with slapadd before I add a dump of the directory from our old servers with slapadd. I need a kerberos schema, so I copied the kerberos schema from /usr/share/doc/krb5-server-ldap-1.10.3/kerberos.ldif, to /etc/openldap/schema and modified it so it could be added with slapadd rather than ldapmodify, like all the other files in that directory. Here's an example of the start of the file after making those changes: dn: cn=kerberos,cn=schema,cn=config objectClass: olcSchemaConfig cn: kerberos olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.1.1 NAME 'krbPrincipalName' EQUALITY caseExactIA5Match SUBSTR caseExactSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26) olcAttributeTypes: ( 1.2.840.113554.1.4.1.6.1 NAME 'krbCanonicalName' EQUALITY caseExactIA5Match SUBSTR caseExactSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE) olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.3.1 NAME 'krbPrincipalType' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE) When I try to add that file with slapadd. I get this error: # slapadd -n0 -F /etc/openldap/slapd.d -l kerberos.ldif SYNTAX 1.3.6.1.4.1.1466.115.121.1.26)): empty AttributeDescription slapadd: could not parse entry (line=1) _# 6.36% eta none elapsed none spd 18.6 M/s Closing DB... Running the same command debugging set to -1, I get the following: 59138493 => str2entry: "dn: cn=kerberos,cn=schema,cn=config objectClass: olcSchemaConfig cn: kerberos olcAttributeTypes: ( 2.16.840.1.113719.1.301.4.1.1 NAME 'krbPrincipalName' EQUALITY caseExactIA5Match SUBSTR caseExactSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26) " 59138493 >>> dnPrettyNormal: <cn=kerberos,cn=schema,cn=config> 59138493 <<< dnPrettyNormal: <cn=kerberos,cn=schema,cn=config>, <cn=kerberos,cn=schema,cn=config> 59138493 <= str2entry NULL (parse_line) SYNTAX 1.3.6.1.4.1.1466.115.121.1.26)): empty AttributeDescription slapadd: could not parse entry (line=1) 59138493 slapadd shutdown: initiated 59138493 slapadd destroy: freeing system resources. Any ideas what I'm doing wrong? I made similar changes to an autofs schema file, and I was able to add that just fine. Do I need to number each olcAttributeType entry by putting a number in curly braces ({0}, {1,}, etc.) at the start of each olcAttributeTypes entry? -- Prentice

2 3

overlay ppolicy - atribute pwdhistory
by DÍEZ BARREIRO, ANA BELÉN 11 May '17

11 May '17

Hi, I am using ppolicy overlay and I don't want the user to change the password by setting the same value. If I put pwdinhistory = 1 then the new password can not be the same as the current one or the previous on (2 values). But with pwdinhistory = 0 you can put the same value. What would be the solution? Thanks!

2 2

Re: Antw: overlay ppolicy - atribute pwdhistory
by DÍEZ BARREIRO, ANA BELÉN 11 May '17

11 May '17

I know that, but I want to have it like this: that the same password can not be introduced. If I put pwdinhistory = 1 it also does not allow putting the previous one (not just the current one). And that should be possible. Regards, Ana. El 10/05/2017 a las 14:40, Ulrich Windl escribió: >>>> DÍEZ BARREIRO, ANA BELÉN <ana.diez(a)si.upct.es> schrieb am 09.05.2017 um > 14:40 > in Nachricht <85fdee58-2d7f-f443-4ff0-79a97c1058f3(a)si.upct.es>: >> Hi, >> >> I am using ppolicy overlay and I don't want the user to change the >> password by setting the same value. > Usually this is what users do to circumvent such a restriction: > 1) Change old pawword to new password > 2) Change new password to old password > > So a history of size 1 is rather useless, unless you place other restirctions > into effect. > Despite of that UNIX usually refuses a password that is not deifferent from > the current one... > > Regards, > Ulrich > >> If I put pwdinhistory = 1 then the new password can not be the same as >> the current one or the previous on (2 values). But with pwdinhistory = 0 >> you can put the same value. >> What would be the solution? >> >> Thanks! > > >

1 0

Client binding to a specific local address
by Daniel Le 10 May '17

10 May '17

Hi, Is there an API to bind client to a local IP address? If not, how best to directly handle a BER socket for such purpose? The reason is to direct traffic to go through a specific interface of a host that has multiple NICs. There is no option in ldap_set_option() for address binding. I found the thread "listener question" from the OpenLDAP Technical archives which asked a similar question, but not exactly the same. Thanks, Daniel

1 0

Re: ppolicy overlay - not seeming to function?
by Howard Chu 10 May '17

10 May '17

John Cooter wrote: > So, before I ask my question, here are my referenced objects, from a "slapcat -n 0": > dn: olcDatabase={2}hdb,cn=config > objectClass: olcDatabaseConfig > objectClass: olcHdbConfig > olcDatabase: {2}hdb > olcDbDirectory: /var/lib/ldap > olcDbIndex: objectClass eq,pres > olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub > structuralObjectClass: olcHdbConfig > entryUUID: eb941fcc-bef3-1036-9d74-0d6e032eb747 > creatorsName: cn=config > createTimestamp: 20170426174545Z > olcAccess: {0}to dn.base="" by self write by dn="cn=ldapadmin,dc=XXXXXXX > ,dc=net" write by * read > olcAccess: {1}to * by self write by dn="cn=ldapadmin,dc=XXXXXXX,dc=net" w > rite by * read > olcAccess: {2}to dn.subtree="ou=mail,ou=hosting,dc=XXXXXXX,dc=net" attrs= > userPassword,UseAppPassword,children,entry,objectClass,cn,sn,uid by self w > rite by dn="cn=ldapadmin,dc=XXXXXXX,dc=net" write by * auth by * read > olcSuffix: dc=XXXXXXXX,dc=net > olcRootDN: cn=ldapadmin,dc=XXXXXXX,dc=net > olcRootPW:: e1NTSEF9K2p6YnhXL0xQTDJKZFFIZitac3l6RzVXaEN3UEhQUkc= > entryCSN: 20170508155547.001404Z#000000#000#000000 > modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth > modifyTimestamp: 20170508155547Z > > dn: olcOverlay={0}ppolicy,olcDatabase={2}hdb,cn=config > objectClass: olcOverlayConfig > objectClass: olcPPolicyConfig > olcOverlay: {0}ppolicy > olcPPolicyDefault: cn=passwordDefault,ou=policies,dc=XXXXXXX,dc=net > olcPPolicyHashCleartext: FALSE > olcPPolicyUseLockout: FALSE > olcPPolicyForwardUpdates: FALSE > structuralObjectClass: olcPPolicyConfig > > the passwordDefaul policy exists in the correct location, and appears to apply to all user objects BUT > > when I change a user object to a value that either violates the base policy (say, has only 4 characters instead of 5 or more), or would not conform to the check_password.so function, as established by various outside sources, it does not give me an error of any kind, and instead, writes the password to the DB and writes the following to the log: Reread the slapo-ppolicy(5) manpage. You're making modifications using the rootDN, which is documented to ignore any configured policies. > May 10 11:00:05 ldapv slapd[1984]: conn=1007 op=0 EXT oid=1.3.6.1.4.1.1466.20037 > May 10 11:00:05 ldapv slapd[1984]: conn=1007 op=0 STARTTLS > May 10 11:00:05 ldapv slapd[1984]: conn=1007 op=0 RESULT oid= err=0 text= > May 10 11:00:06 ldapv slapd[1984]: conn=1007 fd=11 TLS established tls_ssf=256 ssf=256 > May 10 11:00:06 ldapv slapd[1984]: conn=1007 op=1 BIND dn="cn=ldapadmin,dc=XXXXXXX,dc=net" method=128 > May 10 11:00:06 ldapv slapd[1984]: conn=1007 op=1 BIND dn="cn=ldapadmin,dc=XXXXXXX,dc=net" mech=SIMPLE ssf=0 > May 10 11:00:06 ldapv slapd[1984]: conn=1007 op=1 RESULT tag=97 err=0 text= > May 10 11:00:06 ldapv slapd[1984]: conn=1007 op=2 MOD dn="uid=USER,cn=TESTDOMAIN.com,ou=domain,ou=mail,ou=hosting,dc=XXXXXXX,dc=net" > May 10 11:00:06 ldapv slapd[1984]: conn=1007 op=2 MOD attr=userPassword > May 10 11:00:06 ldapv slapd[1984]: conn=1007 op=2 RESULT tag=103 err=0 text= > > And the entry, as referenced by phpLDAPadmin, appears to correspond to the "bad" password. How can I go about confirming that the password policy is being enforced? Bind as a regular user identity instead of the rootDN when making a change. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: Multimaster Replication
by Quanah Gibson-Mount 10 May '17

10 May '17

--On Monday, May 08, 2017 4:51 PM +0000 "Weiner, Michael" <weinerm(a)ccf.org> wrote: > Searching through the archives, helpful information, but I wasn't able to > find anything that quite matched my issue. Some background, I am running > CentOS 7 with OpenLDAP version 2.4.40 and I have been following along a > tutorial I found here: OpenLDAP 2.4.40 contained a number of serious bugs. I strongly advise against using it, particularly with MMR. As for your ldapadd, did you hit control-D when done, so it would exit? Otherwise, it's waiting on continued input from you. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: ppolicy overlay - not seeming to function?
by Quanah Gibson-Mount 10 May '17

10 May '17

--On Wednesday, May 10, 2017 12:20 PM -0400 John Cooter <jcooter(a)atlantech.net> wrote: > And the entry, as referenced by phpLDAPadmin, appears to correspond to > the "bad" password. How can I go about confirming that the password > policy is being enforced? Your log shows that the LDAPv3 extended password operation was not used. The bug is in your client code. Hope that helps! --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Multimaster Replication
by Weiner, Michael 10 May '17

10 May '17

Searching through the archives, helpful information, but I wasn't able to find anything that quite matched my issue. Some background, I am running CentOS 7 with OpenLDAP version 2.4.40 and I have been following along a tutorial I found here: http://linoxide.com/linux-how-to/setup-openldap-multi-master-replication-ce… everything goes well, of course,until the very last step where I have to add the replication information, I recreated this ldif: dn: cn=config changetype: modify replace: olcServerID olcServerID: 101 ldap://lri-ldap1 olcServerID: 201 ldap://lri-ldap2 olcServerID: 301 ldap://lri-ldap3 olcServerID: 401 ldap://lri-ldap4 dn: olcDatabase={2}hdb,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=ldap://lri-ldap1:389/ bindmethod=simple binddn="cn=admin,dc=lerner,dc=ccf,dc=org" credentials=password12 searchbase="dc=lerner,dc=ccf,dc=org" scope=sub schemachecking=on type=refreshAndPersist retry="30 5 300 3" interval=00:00:05:00 olcSyncRepl: rid=002 provider=ldap://lri-ldap2:389/ bindmethod=simple binddn="cn=admin,dc=lerner,dc=ccf,dc=org" credentials=password12 searchbase="dc=lerner,dc=ccf,dc=org" scope=sub schemachecking=on type=refreshAndPersist retry="30 5 300 3" interval=00:00:05:00 olcSyncRepl: rid=003 provider=ldap://lri-ldap3:389/ bindmethod=simple binddn="cn=admin,dc=lerner,dc=ccf,dc=org" credentials=password12 searchbase="dc=lerner,dc=ccf,dc=org" scope=sub schemachecking=on type=refreshAndPersist retry="30 5 300 3" interval=00:00:05:00 olcSyncRepl: rid=004 provider=ldap://lri-ldap4:389/ bindmethod=simple binddn="cn=admin,dc=lerner,dc=ccf,dc=org" credentials=password12 searchbase="dc=lerner,dc=ccf,dc=org" scope=sub schemachecking=on type=refreshAndPersist retry="30 5 300 3" interval=00:00:05:00 - add: olcMirrorMode olcMirrorMode: TRUE dn: olcOverlay=syncprov,olcDatabase={2}hdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov and then ldapmodify -Y EXTERNAL -H ldapi:/// -f rp.ldif on all 4 masters, and what I get is, they are all just sitting there not providing me with a prompt: [root@lri-ldap4 openldap]# ldapadd -Y EXTERNAL -H ldapi:/// -f rp.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "cn=config" modifying entry "olcDatabase={2}hdb,cn=config" adding new entry "olcOverlay=syncprov,olcDatabase={2}hdb,cn=config" and I cannot tell what it is actually doing at this stage. I check systemctl status spald: May 08 11:17:15 lri-ldap1 slapd[3856]: conn=1000 op=0 BIND authcid="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" authzid="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" May 08 11:17:15 lri-ldap1 slapd[3856]: conn=1000 op=0 BIND dn="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" mech=EXTERNAL sasl_ssf=0 ssf=71 May 08 11:17:15 lri-ldap1 slapd[3856]: conn=1000 op=0 RESULT tag=97 err=0 text= May 08 11:17:15 lri-ldap1 slapd[3856]: conn=1000 op=1 MOD dn="cn=config" May 08 11:17:15 lri-ldap1 slapd[3856]: conn=1000 op=1 MOD attr=olcServerID May 08 11:17:15 lri-ldap1 slapd[3856]: conn=1000 op=1 RESULT tag=103 err=0 text= May 08 11:17:15 lri-ldap1 slapd[3856]: conn=1000 op=2 MOD dn="olcDatabase={2}hdb,cn=config" May 08 11:17:15 lri-ldap1 slapd[3856]: conn=1000 op=2 MOD attr=olcSyncRepl olcMirrorMode May 08 11:17:15 lri-ldap1 slapd[3856]: conn=1000 op=2 RESULT tag=103 err=0 text= May 08 11:17:15 lri-ldap1 slapd[3856]: conn=1000 op=3 ADD dn="olcOverlay=syncprov,olcDatabase={2}hdb,cn=config" And that's where it stops, but I never get a prompt on any of the masters. Has anyone else seen this? Where did I go wrong? And how can I move forward? Thanks in advance Michael =================================== Please consider the environment before printing this e-mail Cleveland Clinic is ranked as one of the top hospitals in America by U.S.News & World Report (2015). Visit us online at http://www.clevelandclinic.org for a complete listing of our services, staff and locations. Confidentiality Note: This message is intended for use only by the individual or entity to which it is addressed and may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please contact the sender immediately and destroy the material in its entirety, whether electronic or hard copy. Thank you.

2 1

ppolicy overlay - not seeming to function?
by John Cooter 10 May '17

10 May '17

So, before I ask my question, here are my referenced objects, from a "slapcat -n 0": dn: olcDatabase={2}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {2}hdb olcDbDirectory: /var/lib/ldap olcDbIndex: objectClass eq,pres olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub structuralObjectClass: olcHdbConfig entryUUID: eb941fcc-bef3-1036-9d74-0d6e032eb747 creatorsName: cn=config createTimestamp: 20170426174545Z olcAccess: {0}to dn.base="" by self write by dn="cn=ldapadmin,dc=XXXXXXX ,dc=net" write by * read olcAccess: {1}to * by self write by dn="cn=ldapadmin,dc=XXXXXXX,dc=net" w rite by * read olcAccess: {2}to dn.subtree="ou=mail,ou=hosting,dc=XXXXXXX,dc=net" attrs= userPassword,UseAppPassword,children,entry,objectClass,cn,sn,uid by self w rite by dn="cn=ldapadmin,dc=XXXXXXX,dc=net" write by * auth by * read olcSuffix: dc=XXXXXXXX,dc=net olcRootDN: cn=ldapadmin,dc=XXXXXXX,dc=net olcRootPW:: e1NTSEF9K2p6YnhXL0xQTDJKZFFIZitac3l6RzVXaEN3UEhQUkc= entryCSN: 20170508155547.001404Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20170508155547Z dn: olcOverlay={0}ppolicy,olcDatabase={2}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcOverlay: {0}ppolicy olcPPolicyDefault: cn=passwordDefault,ou=policies,dc=XXXXXXX,dc=net olcPPolicyHashCleartext: FALSE olcPPolicyUseLockout: FALSE olcPPolicyForwardUpdates: FALSE structuralObjectClass: olcPPolicyConfig the passwordDefaul policy exists in the correct location, and appears to apply to all user objects BUT when I change a user object to a value that either violates the base policy (say, has only 4 characters instead of 5 or more), or would not conform to the check_password.so function, as established by various outside sources, it does not give me an error of any kind, and instead, writes the password to the DB and writes the following to the log: May 10 11:00:05 ldapv slapd[1984]: conn=1007 op=0 EXT oid=1.3.6.1.4.1.1466.20037 May 10 11:00:05 ldapv slapd[1984]: conn=1007 op=0 STARTTLS May 10 11:00:05 ldapv slapd[1984]: conn=1007 op=0 RESULT oid= err=0 text= May 10 11:00:06 ldapv slapd[1984]: conn=1007 fd=11 TLS established tls_ssf=256 ssf=256 May 10 11:00:06 ldapv slapd[1984]: conn=1007 op=1 BIND dn="cn=ldapadmin,dc=XXXXXXX,dc=net" method=128 May 10 11:00:06 ldapv slapd[1984]: conn=1007 op=1 BIND dn="cn=ldapadmin,dc=XXXXXXX,dc=net" mech=SIMPLE ssf=0 May 10 11:00:06 ldapv slapd[1984]: conn=1007 op=1 RESULT tag=97 err=0 text= May 10 11:00:06 ldapv slapd[1984]: conn=1007 op=2 MOD dn="uid=USER,cn=TESTDOMAIN.com,ou=domain,ou=mail,ou=hosting,dc=XXXXXXX,dc=net" May 10 11:00:06 ldapv slapd[1984]: conn=1007 op=2 MOD attr=userPassword May 10 11:00:06 ldapv slapd[1984]: conn=1007 op=2 RESULT tag=103 err=0 text= And the entry, as referenced by phpLDAPadmin, appears to correspond to the "bad" password. How can I go about confirming that the password policy is being enforced?

1 0

Re: [SOLVED] Re: chain overlay does an anonymous bind and ignores the chain binddn (v2.4.44)
by Quanah Gibson-Mount 10 May '17

10 May '17

--On Monday, May 08, 2017 12:16 PM +0000 mailing lists <listas.correo(a)yahoo.es> wrote: > if I add the port to the updateref directive I can reproduce the > behaviour (anonymous bind vs bind with the identity configurated in the > chain overlay) only by switching the updateref beetwen the url with port > and without it. Please see <http://www.openldap.org/its/index.cgi/?findid=7768>, it looks like you would need to set a corresponding olcDbUri attribute to match your updateref value Can you let me know if this resolves the issue? If so, I can update the documentation accordingly. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: Secure replication
by Quanah Gibson-Mount 09 May '17

09 May '17

--On Tuesday, May 09, 2017 2:11 AM +0000 "Real, Elizabeth (392K)" <Elizabeth.Real(a)jpl.nasa.gov> wrote: Hi Elizabeth, > If "ldap://" is secure already then I do not need to proceed further. That says nothing about whether or not your configuration is secure. Again, if it is "ldap://" with the startTLS LDAPv3 extension, and you've configured it be required that it succeed, then it is secure. You've not provided the information that would be necessary to make such a determination. I would again advise reading the slapd-config(5) man page for the olcSyncRepl attribute, specifically the bits on the starttls, tls_cacert/tls_cacertdir, tls_cipher_suite, and tls_protocol_min configuration parameters. You may also want to set olcSecurity (A value of "ssf=1" requires any and all connections to the server be encrypted). Changing this value from the default requires a server restart for it to go into effect. > SSLv3 > TLSv1.2 Those look like protocol versions, not cipher suites. ;) > Why is version 2.4.40 unsafe for multi-master replication? I can upgrade > at a later time I just wanted to find out how to enable ldaps between the > two servers. You can read through the OpenLDAP Release notes here: <http://www.openldap.org/software/release/changes.html> Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Secure replication
by Michael Ströder 09 May '17

09 May '17

Ulrich Windl wrote: >>>> Michael Ströder <michael(a)stroeder.com> schrieb am 08.05.2017 um 23:39 in >> When running different replicas which terminate TLS themselves you can issue a >> different server cert with distinct subject-DN for each of them and put FQDN(s) of >> the same HA address(es) (e.g. of your load-balancer(s)) into subjectAltName >> extension in all these different server certs. > > So you have one certificate for all servers, and the answer is that you cannot > have different certificates? If so, we had discussed that before. I thought you > were advising otherwise now, and I was surprised how that would work. Did you deliberately misread my answer? I cannot imagine how I can make more clear that I have different certs on all replicas. And probably you also misread my former postings about that topic. Ciao, Michael.

1 0

Re: Secure replication
by Quanah Gibson-Mount 09 May '17

09 May '17

--On Saturday, May 06, 2017 1:56 AM +0000 "Real, Elizabeth (392K)" <Elizabeth.Real(a)jpl.nasa.gov> wrote: > The olcSyncRepl directive on both systems needs to go from: > > olcSyncRepl: rid=001 provider=ldap > > to: > > olcSyncRepl: rid=001 provider=ldaps The use of "ldap://" does not mean that you have insecure replication. The "ldaps" designation was developed to allow for SSL encrypted connections as a part of LDAPv2, which did not have a formal design spec for allowing SSL encryption. The LDAPv3 spec, which is what OpenLDAP 2.4 (and much earlier version) implement, specifically has startTLS as a part of that specification, which uses "ldap:///". I.e., ldaps is a bastardized hack for LDAPv2. The proper way to do TLS encryption with LDAPv3 capable servers such as OpenLDAP 2.[1-4+] is to use the startTLS extended operation over a "ldap:///" URI. In addition, there are other ways to have an encrypted connection between an LDAP client and server without involving TLS at all, such as SASL/GSSAPI. As Michael noted, you can, in addition to enabling TLS encryption between the client and servers, use client cert authentication (SASL/EXTERNAL) so as to remove the requirement for clear text credentials to be stored in the olcSyncRepl attribute (if using simple binds). And again, the usage of SASL/GSSAPI also precludes the neccessity of storing cleartext credentials in the olcSyncRepl attribute. As an aside, I would note that 2.4.40 is completely unsafe to use with multimaster replication. I would generally suggest forming a clear set of requirements for your replication environment, and then asking how to implement them. Your current question is too vague/general to really be answered well. Hope that helps! Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: Antw: Re: Secure replication
by Michael Ströder 08 May '17

08 May '17

Ulrich Windl wrote: > I have a related question: Can you have different certificates, depending on > "Normal use" and replication? I guess no, so if you use a load balancer, you'll > have a problem with every server having a different cert (This is how I reaed > your message). Didn't we discuss that before? When running different replicas which terminate TLS themselves you can issue a different server cert with distinct subject-DN for each of them and put FQDN(s) of the same HA address(es) (e.g. of your load-balancer(s)) into subjectAltName extension in all these different server certs. Does that answer your question? Ciao, Michael.

1 0

Re: [SOLVED] Re: chain overlay does an anonymous bind and ignores the chain binddn (v2.4.44)
by Quanah Gibson-Mount 08 May '17

08 May '17

--On Friday, May 05, 2017 10:27 AM +0000 mailing lists <listas.correo(a)yahoo.es> wrote: >> config to the config used in that test? > > > > the chain works as expected, with the identity configurated, if the port > is not included in the updatedn. An DN by definition wouldn't contain port information. Can you provide a real example of the problem and how you fixed it? --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

ACL to authenticate gitlab users
by Xaar 07 May '17

07 May '17

Hello, I want to authenticate users via OpenLDAP to Gitlab. In Gitlab configuration there is a gitlab.rb file, where I can write some special user (let it be gitlabuser) with credentials who will be bind to ldap server. Now my question is, what acl should I provide to this user on OpenLDAP server to allow other users authenticate to Gitlab ? Now my DIT looks like this: dc=company,dc=com | | - cn=admin - cn=gitlabuser | | - ou=Groups - ou=Users -> here are users which I want to give access to Gitlab Is this entry is fair enough ? dn: olcDatabase={1}hdb,cn=config changetype: modify replace: olcAccess olcAccess: {0} to attrs=userPassword by anonymous auth by dn=„cn=admin,dc=company,dc=com” write by * none olcAccess: {1} to dn.base=„” by * read olcAccess: {2} to * by * read Best Regards !

1 0

Interpreting RFC 2849
by Joseph L. Casale 06 May '17

06 May '17

Do I read the RFC correctly regarding the value-spec for the ASCII value case stating exactly one FILL character follows the colon by zero or more SAFE-STRING occurrences? In other words, the following is OK: `attribute-type: ` but not `attribute-type:` This format only applies to changetype add, if I interpret the spec correctly, what sense does it make to ask the dsa to remove any values for the specified attribute type on the new, yet to be created entry, effectively removing the type? And why is the later not tolerated, neither makes sense to me on a changetype add? Thanks, jlc

1 0

Secure replication
by Real, Elizabeth (392K) 06 May '17

06 May '17

Hey guys, I’m running multi-master OpenLDAP (version 2.4.40) servers and need to secure replication. Can you point me to where I can find that information? What I found online is old and does not apply to the version I’m running. The olcSyncRepl directive on both systems needs to go from: olcSyncRepl: rid=001 provider=ldap to: olcSyncRepl: rid=001 provider=ldaps Thank you, Liz

3 2

Re: chain overlay does an anonymous bind and ignores the chain binddn (v2.4.44)
by Howard Chu 05 May '17

05 May '17

mailing lists wrote: > Hello, > > I am testing the chain overlay from a read-only slave (consumer) slapd server > to a read-write master (provider), but what I am seeing is an anonymous bind > from the consumer to the provider instead of the authorization identity > configurated in the chain directive. Have you successfully run test032 in the test suite? Have you compared your config to the config used in that test? > > afaik, the bind dn in the provider must be the chain binddn configured in the > consumer, but it gets an anonymous bind. > > > any suggestion about what can be my mistake?? > > > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 2

Unable to load the lastbind module with 2.4.44 (custom build)
by mailing lists 05 May '17

05 May '17

Hello all, What I'm trying to do is enable the lastbind module in a centos7 server, so I applied this patch to the rpmbuild process: # cat /root/rpmbuild/SOURCES/openldap-lastbind-overlay.patch --- a/servers/slapd/overlays/Makefile.in 2017-04-12 12:14:46.617978071 +0100 +++ b/servers/slapd/overlays/Makefile.in 2017-04-12 12:21:12.569292484 +0100 @@ -36,6 +36,7 @@ valsort.c \ smbk5pwd.c \ allop.c \ + lastbind.c \ sha2.c slapd-sha2.c OBJS = statover.o \ @SLAPD_STATIC_OVERLAYS@ \ @@ -56,7 +57,7 @@ UNIX_LINK_LIBS = $(@BUILD_LIBS_DYNAMIC@_LDAP_LIBS) LIBRARY = ../liboverlays.a -PROGRAMS = @SLAPD_DYNAMIC_OVERLAYS@ smbk5pwd.la allop.la pw-sha2.la +PROGRAMS = @SLAPD_DYNAMIC_OVERLAYS@ smbk5pwd.la allop.la pw-sha2.la lastbind.la XINCPATH = -I.. -I$(srcdir)/.. XDEFS = $(MODULES_CPPFLAGS) @@ -140,6 +141,12 @@ allop.la : allop.lo $(LTLINK_MOD) -module -o $@ allop.lo version.lo $(LINK_LIBS) $(shell pkg-config openssl --libs) +lastbind.lo : lastbind.c + $(LTCOMPILE_MOD) -DDO_SAMBA -UHAVE_MOZNSS -DHAVE_OPENSSL $(shell pkg-config openssl --cflags) $< + +lastbind.la : lastbind.lo + $(LTLINK_MOD) -module -o $@ lastbind.lo version.lo $(LINK_LIBS) $(shell pkg-config openssl --libs) + sha2.lo : sha2.c $(LTCOMPILE_MOD) $< the resulting package contains the module: # rpm -qpl /root/rpmbuild/RPMS/x86_64/openldap-servers-2.4.44-1.x86_64.rpm | grep lastbind /usr/lib64/openldap/lastbind-2.4.so.2 /usr/lib64/openldap/lastbind-2.4.so.2.10.7 /usr/lib64/openldap/lastbind.la /usr/share/man/man5/slapo-lastbind.5.gz but a configuration file as simple as the following one, fails to load: # cat test.conf modulepath /usr/lib64/openldap/ moduleload back_bdb.la moduleload back_hdb.la moduleload back_ldap.la moduleload unique.la moduleload ppolicy.la moduleload dynlist.la moduleload memberof.la moduleload syncprov.la moduleload accesslog.la moduleload lastbind.la moduleload auditlog.la # slaptest -d -1 -f ./test.conf 58ee0ebd slaptest init: initiated tool. 58ee0ebd slap_sasl_init: initialized! 58ee0ebd bdb_back_initialize: initialize BDB backend 58ee0ebd bdb_back_initialize: Berkeley DB 5.3.21: (May 11, 2012) 58ee0ebd hdb_back_initialize: initialize HDB backend 58ee0ebd hdb_back_initialize: Berkeley DB 5.3.21: (May 11, 2012) 58ee0ebd mdb_back_initialize: initialize MDB backend 58ee0ebd mdb_back_initialize: LMDB 0.9.18: (February 5, 2016) 58ee0ebd reading config file ./test.conf 58ee0ebd ./test.conf: line 1 (modulepath /usr/lib64/openldap/) 58ee0ebd ./test.conf: line 2 (moduleload back_bdb.la) 58ee0ebd module_load: (back_bdb.la) already present (static) 58ee0ebd ./test.conf: line 3 (moduleload back_hdb.la) 58ee0ebd module_load: (back_hdb.la) already present (static) 58ee0ebd ./test.conf: line 4 (moduleload back_ldap.la) 58ee0ebd loaded module back_ldap.la 58ee0ebd module back_ldap.la: null module registered 58ee0ebd ./test.conf: line 5 (moduleload unique.la) 58ee0ebd loaded module unique.la 58ee0ebd module unique.la: null module registered 58ee0ebd ./test.conf: line 6 (moduleload ppolicy.la) 58ee0ebd loaded module ppolicy.la 58ee0ebd module ppolicy.la: null module registered 58ee0ebd ./test.conf: line 7 (moduleload dynlist.la) 58ee0ebd loaded module dynlist.la 58ee0ebd module dynlist.la: null module registered 58ee0ebd ./test.conf: line 8 (moduleload memberof.la) 58ee0ebd loaded module memberof.la 58ee0ebd module memberof.la: null module registered 58ee0ebd ./test.conf: line 9 (moduleload syncprov.la) 58ee0ebd loaded module syncprov.la 58ee0ebd module syncprov.la: null module registered 58ee0ebd ./test.conf: line 10 (moduleload accesslog.la) 58ee0ebd loaded module accesslog.la 58ee0ebd module accesslog.la: null module registered 58ee0ebd ./test.conf: line 11 (moduleload lastbind.la) 58ee0ebd loaded module lastbind.la 58ee0ebd module lastbind.la: init_module() failed 58ee0ebd ./test.conf: line 11: <moduleload> handler exited with 1! slaptest: bad configuration file! any idea about where I make the mistake?

2 2

Re: Multi Master replication with many 'nonpresent_callback' lines
by Quanah Gibson-Mount 03 May '17

03 May '17

--On Tuesday, May 02, 2017 3:10 PM +0000 Jesper Grøndahl <grondahl(a)ruc.dk> wrote: > However, as you can see I still get the "nonpresent_callback" lines for > each user. I can see that if you set "olcSpNoPresent: TRUE" in the > syncprov overlay entry the lines disappear. > But I can understand that it should only be done if you have an acceslog. > > So is it really necessary to go through all the objects in the database > every time you modify a single record when you have a mmr setup? > It just seems like a lot of information written to the log and a lot of > work every time a single record is modified. Do you have a session log configured? --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

RE: Issue importing CGP schema into LDAP (centos 7)
by Quanah Gibson-Mount 03 May '17

03 May '17

--On Wednesday, May 03, 2017 12:34 PM -0400 John Cooter <jcooter(a)atlantech.net> wrote: > Thanks! That worked. Much appreciated. Don't mean to seem obtuse. No worries, glad it's working. :) --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

RE: Issue importing CGP schema into LDAP (centos 7)
by Quanah Gibson-Mount 03 May '17

03 May '17

--On Wednesday, May 03, 2017 12:30 PM -0400 John Cooter <jcooter(a)atlantech.net> wrote: > I attempted that this morning as well, and will present reference here: > Contents of test.conf > > include /etc/openldap/schema/core.schema > include /etc/openldap/schema/cosine.schema > include /etc/openldap/schema/inetorgperson.schema > include /etc/openldap/schema/nis.schema > include /etc/openldap/schema/misc.schema > include /etc/openldap/schema/ppolicy.schema > include /etc/openldap/schema/cgp.schema (the referenced schema > for conversion) > > testing directory created > > slaptest -f test.conf -F testing > > error message: > > 5909f790 /etc/openldap/schema/cgp.schema: line 8 attributetype: Duplicate > attributeType: "2.16.840.1.113730.3.1.241" slaptest: bad configuration > directory! Fix your cgp.schema to not include the definition for displayName, since that already comes from inetorgperson.schema. And remove any other attributes it is incorrectly defining that are provided from other schema as well. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

RE: Issue importing CGP schema into LDAP (centos 7)
by Quanah Gibson-Mount 03 May '17

03 May '17

--On Wednesday, May 03, 2017 12:17 PM -0400 John Cooter <jcooter(a)atlantech.net> wrote: > That was my understanding, that I only needed to include the schema I was > trying to convert. The "test.conf" file ONLY had the schema for > conversion included. And since "organization" does come from the base > schema, I'm wondering WHY I'm getting this error on conversion. I have > included the problematic object definition earlier in this thread, and I > really don't see why I'm failing. I can post the entire schema I'm trying > to convert if that would help. I'm really quite stumped. This should be a > simple conversion, but why I'm failing when attempting to attach to an > existing objectClass is beyond my understanding. The test.conf that you are converting has *zero* knowledge of what you have loaded into cn=config. Generally what one does is, define a test.conf that includes all the necessary schema to convert the additional schema you are converting, and then you do something like: mkdir -p /tmp/test-config slaptest -F /tmp/test-config -f test.conf Then you can use the converted schema that is written into /tmp/test-config. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

RE: Issue importing CGP schema into LDAP (centos 7)
by Quanah Gibson-Mount 03 May '17

03 May '17

--On Wednesday, May 03, 2017 9:28 AM -0400 John Cooter <jcooter(a)atlantech.net> wrote: > So, just to confirm what you're saying, that EVEN THOUGH the existing > schema has all the prerequisite objectClass and other object types, and > even though I'm attempting to use slaptest to convert a single extended > .schema, a holdover from an earlier version of openldap, to an .ldif in > the configuration cn, that my test.conf, must have lines that include all > the other base schema files as well? You should absolutely not be including elements from other schema into the file simply for the purpose of conversion, as you will end up with a file you won't be able to import to cn=config if it has those other schema included. And, if it had all the elements as you claim, then you certainly wouldn't be getting an error about the "organization" objectClass being missing, given that that comes from the "core" schema file. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 3

RE: Issue importing CGP schema into LDAP (centos 7)
by Quanah Gibson-Mount 03 May '17

03 May '17

--On Tuesday, May 02, 2017 5:02 PM -0400 John Cooter <jcooter(a)atlantech.net> wrote: > The existing configuration, was created as follows: > Install ldap and related services > ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif > ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif > ldapadd -Y EXTERNAL -H ldapi:/// -f > /etc/openldap/schema/inetorgperson.ldif create test.conf which only > contains a single line: include /etc/openldap/schema/cgp.schema run > slaptest statement, as listed below. Get error. > This slaptest statement should normally allow me to create the ldif to > add to the schema, but it keeps failing. And I'm trying to figure out why > and what I'm doing wrong. Your test LDIF file for converting schema must include all other schema that it is dependent upon for it to be able to convert properly. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 2

Issue importing CGP schema into LDAP (centos 7)
by John Cooter 02 May '17

02 May '17

I have been tasked with virtualizing our existing, aging, LDAP and CommuniGate Pro instances. Doing so will require moving from RHEL 5.X to CentOS 7.X, which means that the existing LDAP implementation has changed. Upon attempting to perform a "slaptest -f test.conf -F testing" where test.conf contains only an include statement that points to /etc/openldap/schema/cgp.schema, and testing is an empty directory, I receive the following error message: 59033edc /etc/openldap/schema/cgp.schema: line 640 objectClass: ObjectClass not found: "organization" slaptest: bad configuration directory! I am able to verify that the various base includes in my LDAP server do include an objectClass "organization" and can verify same in phpLDAPadmin, and in other methods. I am new to the concepts presented here, and since we are using LDAP in what appears to me to be a non-standard use case, I am at a loss. I present the relevant "line 640" below, from the schema I am attempting to import: objectClass ( 2.5.1000.0 NAME 'CommuniGateDomain' SUP 'organization' STRUCTURAL MAY ( cn $ dc ) ) Can someone perhaps tell me where I am going wrong, or how to more effectively troubleshoot this import?

2 4

password change interception overlay
by Michael Ströder 02 May '17

02 May '17

HI! Does anybody know a publicly available overlay which intercepts userPassword changes and grabs the new password for password syncing? Ciao, Michael.

2 2

Using CRLs
by Frank Crow 02 May '17

02 May '17

Is it possible to configure OpenLDAP to trust all certs for validity but then also check a CRL to see if the certificate may have been revoked (to reject it)? Sounds crazy to me and I highly doubt it but I'm asking because somebody handing us requirements is convinced that it is possible to not have connectivity to a CA, and validate a user cert for login using only a CRL. Does that make any sense at all? Thanks, -- Frank

2 1

Re: Multi Master replication with many 'nonpresent_callback' lines
by Quanah Gibson-Mount 02 May '17

02 May '17

--On Sunday, April 23, 2017 12:38 AM +0000 Jesper Grøndahl <grondahl(a)ruc.dk> wrote: > Our log level is stats and sync. > > The logs look like this, for the user being modified > ----- > nonpresent_callback: rid=005 present UUID > 528929d6-acaa-1036-922a-a3f5c9285d9d, dn uid=xxx,ou=users,dc=ruc,dc=dk > Entry uid=xxx,ou=users,dc=ruc,dc=dk CSN > 20170406140323.504919Z#000000#002#000000 greater than snapshot > 20170403102309.253881Z#000000#002#000000 It would appear you have serious issues with your installation, since the CSNs are off by 3 days. I would note that 2.4.40 is not stable for MMR as well. I would ensure you aren't suffering from clock skew across your servers, and upgrade to the current OpenLDAP release as well. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

detect LDAPI support
by Michael Ströder 27 Apr '17

27 Apr '17

HI! Is there an reliable way to detect whether LDAPI support is enabled in the OpenLDAP build on a particular platform? I vaguely remember the developer discussions about disabling LDAPI on platforms where the peer credentials are not secure. Background: I'd like to detect with python-ldap whether to enable LDAPI in automatic testing or not. Ciao, Michael.

2 2

test program for ldap_int_sasl_init issue
by Ryan Tandy 27 Apr '17

27 Apr '17

I'm looking into a Debian bug report: https://bugs.debian.org/860947 ldap_int_sasl_init says: /* XXX not threadsafe */ static int sasl_initialized = 0; I'm not yet sure whether it's the cause of that report, but it does seem to be problematic. I'm seeing spurious "no such mechanism" results and/or crashes in mutiple environments performing SASL binds in parallel: - slapd with multiple syncrepl clients all using SASL binds, - the ldclt tool from the 389-ds project, and - the test program I'm about to describe below. I wrote a test program for this issue, and I'd like to ask the list to check the code before I submit an ITS, in case I've made a mistake that renders my test invalid. gcc -g sasltest.c -pthread -llber -lldap -lsasl2 -DSASL As I understand it, -lldap_r should not be needed here since each thread creates its own LDAP instance. (It doesn't seem to change the results, anyway.) Built without -DSASL, it uses simple binds, and appears to work fine, but again, I'm not confident my code is correct. Thanks! Ryan

1 0

Re: chain overlay does an anonymous bind and ignores the chain binddn (v2.4.44)
by Howard Chu 27 Apr '17

27 Apr '17

Matthew Kemp wrote: > > On Thu, Apr 20, 2017 at 6:36 AM, mailing lists <listas.correo(a)yahoo.es > <mailto:listas.correo@yahoo.es>> wrote: > > Hello, > > I am testing the chain overlay from a read-only slave (consumer) slapd > server to a read-write master (provider), but what I am seeing is an > anonymous bind from the consumer to the provider instead of the > authorization identity configurated in the chain directive. > > > We're also seeing the same behavior and reported a similar issue last month to > this list: > http://www.openldap.org/lists/openldap-technical/201703/msg00047.html > > I'm hopeful we can track down this issue as it's causing us some issues that > we'll need to resolve eventually. Only ProxyAuth will work, now. As documented, the chain overlay only intercepts responses to operations, and only acts when it sees a referral in the response. In order for rebind-as-user to work, the overlay would need to intercept Bind requests and cache the credentials, but it never intercepts Bind requests, therefore it has nothing to rebind with. It *could* intercept referrals from Bind responses, and grab the user's credentials at that point. But back in 2004 we turned those off, and slapd now will never return a referral to a Bind request. (commit 100facedf3c9ec241121a5e3ad7aa059a7c57bc2 in git.) Probably we should remove references to rebind-as-user from the slapo-chain(5) manpage now, since that commit basically killed this feature. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

Re: chain overlay does an anonymous bind and ignores the chain binddn (v2.4.44)
by Matthew Kemp 26 Apr '17

26 Apr '17

On Wed, Apr 26, 2017 at 4:12 PM, Quanah Gibson-Mount <quanah(a)symas.com> wrote: > Hi Matthew, > > Can you look at follow up#4 to ITS#8008 and see if that helps your > situation? > > --Quanah > Hey Quanah! Thanks for reaching out! Sadly in my case the update is not specifically helpful in my case. I found the override flag already, but I do not want to use a ProxyAuth and instead want to bind as the originating user who bound to the consumer. Override allows a ProxyAuth to be used rather than an anonymous bind, which is better, but not the intended behavior I want that the documentation seems to imply is possible. -- Matt Kemp Production Engineer Braintree

1 0

Re: chain overlay does an anonymous bind and ignores the chain binddn (v2.4.44)
by Quanah Gibson-Mount 26 Apr '17

26 Apr '17

--On Monday, April 24, 2017 7:38 PM -0500 Matthew Kemp <matthew.kemp(a)braintreepayments.com> wrote: > > > > > On Thu, Apr 20, 2017 at 6:36 AM, mailing lists <listas.correo(a)yahoo.es> > wrote: > > > > Hello, > > > I am testing the chain overlay from a read-only slave (consumer) slapd > server to a read-write master (provider), but what I am seeing is an > anonymous bind from the consumer to the provider instead of the > authorization identity configurated in the chain directive. > > > > > > We're also seeing the same behavior and reported a similar issue last > month to this list: > http://www.openldap.org/lists/openldap-technical/201703/msg00047.html > > > I'm hopeful we can track down this issue as it's causing us some issues > that we'll need to resolve eventually. Hi Matthew, Can you look at follow up#4 to ITS#8008 and see if that helps your situation? --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Processing telephone number
by Quanah Gibson-Mount 26 Apr '17

26 Apr '17

--On Wednesday, April 26, 2017 9:53 AM +0200 "Angel L. Mateo" <amateo(a)um.es> wrote: > Hi, > > I have an openldap that stores information of my users. One of the > fields we are using is telephoneNumber to store the phone number of the > user. > > In this field we are storing now the complete phone number, that is, a > number like +34 123456789, but now we are deploying applications that > need just the extension number (the last 4 digits), not the hole one. > > Is there any overlay or other option we can use to provide those last 4 > digits of the telephoneNumber attribute without needing to store them in > another different attribute? Nope. I'd suggest fixing the application so it does whatever data manipulation is necessary. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Processing telephone number
by Angel L. Mateo 26 Apr '17

26 Apr '17

Hi, I have an openldap that stores information of my users. One of the fields we are using is telephoneNumber to store the phone number of the user. In this field we are storing now the complete phone number, that is, a number like +34 123456789, but now we are deploying applications that need just the extension number (the last 4 digits), not the hole one. Is there any overlay or other option we can use to provide those last 4 digits of the telephoneNumber attribute without needing to store them in another different attribute? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868889150 Fax: 868888337

1 0

Password storage policy and DIT organisation
by Andreas Ames 26 Apr '17

26 Apr '17

Hi all, my questions below are more about openldap pragmatics than technical issues; if they are off-topic, please point me somewhere else to ask. As I'm a newbie, please bear with me, if I get things completely wrong. What I want to achieve using slapd: a) A centralised authentication service for system accounts of a handful of Linux hosts (libpam-ldapd) and some apache-based webapps (mod_authnz_ldap). b) Every user has a single password stored in exactly one place in the DIT (single-sign on is not topical in my environment). c) I would like to have fine-grained control over whether an ldap user has access to a specific host or webapp or not. Based on that I have got two questions: 1. DIT organisation Let's assume my suffix is dc=foo. I plan to have ou=Users,dc=foo for storing ldap users with their (unique) passwords and ou=Services,dc=foo to have account information for each of my services; e.g. ou=host1,ou=services,dc=foo to provide posix account information for host1, or ou=webapp1,ou=services,dc=foo for mod_authnz_ldap related information regarding webapp1 etc. I plan to use olcAuthzRegexp to authenticate users below ou=host1,ou=services,dc=foo or ou=webapp1,ou=services,dc=foo against ldap users in ou=Users,dc=foo. Is this a sensible setup or are there better hierarchies to achieve my goals? 2. Password storage policy (NB: I am using TLS with a self-signed certificate.) Theoretically I would prefer to store hashed passwords. If I understand correctly, olcAuthRegexp only works with SASL and hashed passwords can only possibly work with the PLAIN mechanism (??). So I tried that and simple binding works as expected, when directly binding to an entry with an attribute "userPassword" (i.e. without indirection through olcAuthzRegexp). To get SASL/PLAIN working, I have tried (without success up till now) to use saslauthd. Moreover the authentication path "client -> TLS/TCP/IP -> slapd (SASL/PLAIN) -> Unix Domain socket -> saslauthd -> localhost/TCP/IP -> slapd (simple bind)" seems a little over the top for my use case. So I am wondering, if hashed password storage is really such a good idea. What are the (security) implications of cleartext storage of passwords? Do you have document links discussing this in some depth? Thanks in advance ... Mit freundlichen Grüßen / With kind regards / Cordiali saluti, Andreas Please consider the environment before you print / Merci de penser à l'environnement avant d'imprimer / Bitte denken Sie an die Umwelt bevor Sie drucken Bombardier Transportation GmbH. Vorsitzender des Aufsichtsrats / Chairman of Supervisory Board: Wolfgang Toelsner. Geschäftsführung / Management Board: Michael Fohrer (Vorsitzender/Chairman), Olaf Berghoff, Dr. Daniel Perlzweig, Konrad Wiebalck. Sitz der Gesellschaft / Principal Office: Berlin. Registergericht / Registration Court: Amtsgericht Charlottenburg, HRB 64838. This e-mail message, and any attachments, may contain information that is confidential and/or privileged. They are intended for the exclusive use of the addressee. Any other person is strictly prohibited from disclosure, distribution or reproduction. No waiver whatsoever is intended by sending this e-mail. If you receive this e-mail in error please immediately inform the sender by return e-mail and delete this e-mail message along with all the attachments and destroy all copies.

3 2

Re: Manual LDAP 2.4.44 Installation
by Quanah Gibson-Mount 25 Apr '17

25 Apr '17

--On Tuesday, April 25, 2017 1:57 AM +0000 Alexandre Vilarinho <acvoliveira(a)yahoo.com.br> wrote: > root@Linux-LDAP-SERVER:~# /usr/local/sbin/slapadd -F > /usr/local/etc/slapd.d -l /usr/local/etc/openldap/slapd.ldif > 58fe9bea invalid config directory /usr/local/etc/slapd.d, error 2 > slapadd: bad configuration directory! As per my previous email: >> Also ensure that directory exists prior to running the command. Not sure how to be any more clear than that. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

chain overlay does an anonymous bind and ignores the chain binddn (v2.4.44)
by mailing lists 25 Apr '17

25 Apr '17

Hello, I am testing the chain overlay from a read-only slave (consumer) slapd server to a read-write master (provider), but what I am seeing is an anonymous bind from the consumer to the provider instead of the authorization identity configurated in the chain directive. consumer/10.112.107.53:------------------------------------- # slapd -V @(#) $OpenLDAP: slapd 2.4.44 (Mar 23 2017 12:46:14) $ root@consumer:/root/rpmbuild/BUILD/openldap-2.4.44/openldap-2.4.44/servers/slapd # grep -v -e '^#' -e '^$' slapd.conf include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/samba.schema include /etc/openldap/schema/freeradius.schema include /etc/openldap/schema/authldap.schema include /etc/openldap/schema/dyngroup.schema include /etc/openldap/schema/ppolicy.schema include /etc/openldap/schema/custom.schema pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args moduleload back_ldap.la moduleload unique.la moduleload ppolicy.la moduleload dynlist.la moduleload memberof.la moduleload syncprov.la moduleload accesslog.la moduleload auditlog.la overlay chain chain-uri "ldap://10.112.107.51" chain-idassert-bind bindmethod="simple" binddn="cn=proxyuser,dc=example,dc=com" credentials="12345678" mode="self" flags=non-prescriptive chain-rebind-as-user TRUE chain-return-error TRUE access to * by * write serverID 101 allow bind_v2 database mdb suffix "dc=example,dc=com" dbnosync rootdn "cn=Manager,dc=example,dc=com" rootpw 12345678 directory /var/lib/ldap maxsize 106300440576 index objectClass eq index uid eq,sub index entryCSN,entryUUID eq loglevel stats syncrepl rid=101 provider=ldap://10.112.107.51:389 type=refreshAndPersist searchbase="dc=example,dc=com" schemachecking=off bindmethod=simple retry="60 10 300 +" binddn="cn=syncrepl,dc=example,dc=com" credentials=12345678 updateref "ldap://10.112.107.51:389" provider/10.112.107.51:----------------------------------- # slapd -V @(#) $OpenLDAP: slapd 2.4.44 (Mar 23 2017 12:46:14) $ root@provider:/root/rpmbuild/BUILD/openldap-2.4.44/openldap-2.4.44/servers/slapd # grep -v -e '^#' -e '^$' slapd.conf include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/samba.schema include /etc/openldap/schema/freeradius.schema include /etc/openldap/schema/authldap.schema include /etc/openldap/schema/dyngroup.schema include /etc/openldap/schema/ppolicy.schema include /etc/openldap/schema/custom.schema pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args modulepath /usr/lib64/openldap moduleload back_ldap.la moduleload unique.la moduleload ppolicy.la moduleload dynlist.la moduleload memberof.la moduleload syncprov.la moduleload accesslog.la moduleload auditlog.la access to * by * write serverID 001 authz-policy to allow bind_v2 database mdb suffix "dc=example,dc=com" dbnosync rootdn "cn=Manager,dc=example,dc=com" rootpw 12345678 directory /var/lib/ldap maxsize 106300440576 index objectClass eq index uid eq,sub index entryCSN,entryUUID eq loglevel stats limits dn="cn=proxyuser,dc=example,dc=com" size=unlimitedlimits dn="cn=syncrepl,dc=example,dc=com" size=unlimitedoverlay syncprov syncprov-checkpoint 1000 1 syncprov-sessionlog 150000 syncprov-reloadhint TRUE now I do an update in the consumer: Apr 20 12:58:57 consumer slapd[23149]: conn=1004 fd=16 ACCEPT from IP=127.0.0.1:42198 (IP=0.0.0.0:389) Apr 20 12:58:57 consumer slapd[23149]: conn=1004 op=0 BIND dn="cn=Manager,dc=example,dc=com" method=128 Apr 20 12:58:57 consumer slapd[23149]: conn=1004 op=0 BIND dn="cn=Manager,dc=example,dc=com" mech=SIMPLE ssf=0 Apr 20 12:58:57 consumer slapd[23149]: conn=1004 op=0 RESULT tag=97 err=0 text= Apr 20 12:58:57 consumer slapd[23149]: conn=1004 op=1 SRCH base="dc=example,dc=com" scope=2 deref=2 filter="(employeeid=759042)" Apr 20 12:58:57 consumer slapd[23149]: conn=1004 op=1 SRCH attr=* + Apr 20 12:58:57 consumer slapd[23149]: conn=1004 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Apr 20 12:58:57 consumer slapd[23149]: conn=1004 op=2 SRCH base="dc=example,dc=com" scope=2 deref=2 filter="(uid=endwmkhwl60nehf2c)" Apr 20 12:58:57 consumer slapd[23149]: conn=1004 op=2 SRCH attr=* + Apr 20 12:58:57 consumer slapd[23149]: conn=1004 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text= Apr 20 12:58:57 consumer slapd[23149]: conn=1004 op=3 MOD dn="uid=enDwmkHWl60NEHf2c,dc=example,dc=com" Apr 20 12:58:57 consumer slapd[23149]: conn=1004 op=3 MOD attr=description Apr 20 12:58:57 consumer slapd[23149]: conn=1004 op=3 RESULT tag=103 err=8 text= Apr 20 12:58:57 consumer slapd[23149]: conn=1004 fd=16 closed (connection lost) and this is the corresponding log in the provider: Apr 20 12:58:57 provider slapd[28974]: conn=3367 fd=16 ACCEPT from IP=10.112.107.53:58416 (IP=0.0.0.0:389) Apr 20 12:58:57 provider slapd[28974]: conn=3367 op=0 BIND dn="" method=128 Apr 20 12:58:57 provider slapd[28974]: conn=3367 op=0 RESULT tag=97 err=0 text= Apr 20 12:58:57 provider slapd[28974]: conn=3367 op=1 MOD dn="uid=enDwmkHWl60NEHf2c,dc=example,dc=com" Apr 20 12:58:57 provider slapd[28974]: conn=3367 op=1 MOD attr=description Apr 20 12:58:57 provider slapd[28974]: conn=3367 op=1 RESULT tag=103 err=8 text=modifications require authentication Apr 20 12:58:57 provider slapd[28974]: conn=3367 op=2 UNBIND Apr 20 12:58:57 provider slapd[28974]: conn=3367 fd=16 closed afaik, the bind dn in the provider must be the chain binddn configured in the consumer, but it gets an anonymous bind. any suggestion about what can be my mistake??

2 1

Re: Manual LDAP 2.4.44 Installation
by Quanah Gibson-Mount 23 Apr '17

23 Apr '17

--On Friday, April 21, 2017 6:35 PM +0000 Alexandre Vilarinho <vilarinhomail-dev(a)yahoo.com.br> wrote: > But from step 9 forward it practically didn't work: > > > 9.Import the configuration database > You are now ready to import your configration database for use by > slapd(8), by running the command: > su root -c /usr/local/sbin/slapadd -F /usr/local/etc/cn=config -l > /usr/local/etc/openldap/slapd.ldif That's a typo in the quickstart guide that's already fixed for the next release. It would be /usr/local/etc/slapd.d Also ensure that directory exists prior to running the command. > 10. Start SLAPD. > You are now ready to start the Standalone LDAP Daemon, slapd(8), by > running the command: > su root -c /usr/local/libexec/slapd -F /usr/local/etc/cn=config And here that would also be /usr/local/etc/slapd.d --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Filtered proxy to Active Directory
by Kamenko Pajic 23 Apr '17

23 Apr '17

We have Panasonic KX-UTG300B phones (SIP phone) which has LDAP Phonebook option. Settings on the phone to make this work are simple: LDAP Server Address: LDAP Server Port: LDAP Authentication ID: LDAP Authentication Password: LDAP Search Base: When I go to LDAP address book on the phone I get thousands of entries listing not only users with their phone number but also all other entries like resources, empty lines(???), N/A, Distribution lists .. Etc. in short probably everything. There is no way I can set up a filter to filter users only that have phone number set in AD. What I need is LDAP proxy server which will be queried by our phones instead of querying AD Server directly and return filtered list (example: just entries containing information in "telephoneNumber" attribute) Is this possible? I've been trying for weeks now with no success. Please someone, send me sample ldap.conf and slapd.conf configuration files Thanks

4 3

Manual LDAP 2.4.44 Installation
by Alexandre Vilarinho 23 Apr '17

23 Apr '17

Hello all, Recently I've installed LDAP - version 2.4.44 Manually in a Ubuntu 16.04 TLS server. root@Linux-LDAP-SERVER:~# lsb_release -aNo LSB modules are available.Distributor ID: UbuntuDescription: Ubuntu 16.04.2 LTSRelease: 16.04Codename: xenialroot@Linux-LDAP-SERVER:~# I followed every step in the official Quick-Start Quide (http://www.openldap.org/doc/admin24/quickstart.html) But from step 9 forward it practically didn't work: 9.Import the configuration database You are now ready to import your configration database for use by slapd(8), by running the command:su root -c /usr/local/sbin/slapadd -F /usr/local/etc/cn=config -l /usr/local/etc/openldap/slapd.ldif root@Linux-LDAP-SERVER:~# /usr/local/sbin/slapadd -F /usr/local/etc/cn=config -l /usr/local/etc/openldap/slapd.ldif58fa3f94 invalid config directory /usr/local/etc/cn=config, error 2slapadd: bad configuration directory! root@Linux-LDAP-SERVER:~# 10. Start SLAPD. You are now ready to start the Standalone LDAP Daemon, slapd(8), by running the command:su root -c /usr/local/libexec/slapd -F /usr/local/etc/cn=config To check to see if the server is running and configured correctly, you can run a search against it with ldapsearch(1). By default, ldapsearch is installed as /usr/local/bin/ldapsearch:ldapsearch -x -b '' -s base '(objectclass=*)' namingContexts Note the use of single quotes around command parameters to prevent special characters from being interpreted by the shell. This should return:dn: namingContexts: dc=example,dc=com root@Linux-LDAP-SERVER:~# /usr/local/libexec/slapd -F /usr/local/etc/cn=configroot@Linux-LDAP-SERVER:~# ldapsearch -x -b 'dc=example,dc=com' '(objectclass=*)'ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)root@Linux-LDAP-SERVER:~# What am i doing wrong? Why can't it contact the server, if the installation was ok, with no errors ou warnings... Regards

2 1

Multi Master replication with many 'nonpresent_callback' lines
by Jesper Grøndahl 23 Apr '17

23 Apr '17

Hi everyone We have a multi-master replication setup with 3 nodes (running openldap-2.4.40 on Debian Jessie). The sync of the config database and the user database is working fine. However, when we modify/delete an object on one node we get a "nonpresent_callback" line for each of our users on the two other nodes. Our log level is stats and sync. The logs look like this, for the user being modified ----- nonpresent_callback: rid=005 present UUID 528929d6-acaa-1036-922a-a3f5c9285d9d, dn uid=xxx,ou=users,dc=ruc,dc=dk Entry uid=xxx,ou=users,dc=ruc,dc=dk CSN 20170406140323.504919Z#000000#002#000000 greater than snapshot 20170403102309.253881Z#000000#002#000000 ----- ... and something like this for the rest of the users ----- nonpresent_callback: rid=005 present UUID c7cf376c-acaa-1036-8052-a3f5c9285d9d, dn uid=yyy,ou=users,dc=ruc,dc=dk ----- We only expected the log entry for the modified user and not for all the rest of the users too. Is this the way it should be because of the log level setting or is it not normal? If this is not the way it's supposed to be I'll of course supply you with our configs. Thanks in advance. Sincerely yours, Jesper

1 0

Re: Filtered proxy to Active Directory
by Howard Chu 23 Apr '17

23 Apr '17

Kamenko Pajic wrote: > We have Panasonic KX-UTG300B phones (SIP phone) which has LDAP Phonebook option. > > > > Settings on the phone to make this work are simple: > > > > LDAP Server Address: > > LDAP Server Port: > > LDAP Authentication ID: > > LDAP Authentication Password: > > LDAP Search Base: > > > > When I go to LDAP address book on the phone I get thousands of entries listing > not only users with their phone number but also all other entries like > resources, empty lines(???), N/A, Distribution lists …. Etc. in short probably > everything. Sounds like quite a stupid phone; they probably expected you to point the search base at an "ou=people" folder that doesn't contain any other types of entries. > There is no way I can set up a filter to filter users only that have phone > number set in AD. > > > > What I need is LDAP proxy server which will be queried by our phones instead > of querying AD Server directly and return filtered list (example: just entries > containing information in “telephoneNumber” attribute) > > > > Is this possible? I’ve been trying for weeks now with no success. I'm not aware of any existing modules that do what you want. But it would be a trivially small piece of overlay code to write. > Please someone, send me sample ldap.conf and slapd.conf configuration files > > > > > > Thanks > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: LMDB master branch
by Howard Chu 21 Apr '17

21 Apr '17

opensource(a)gmx-topmail.de wrote: > Hi there, > > I am on the mdb.master branch because of MDB_VL32. We updated the LMDB code in January, and before I update to the latest commit I wanted to check with you. > > Disclaimer: I am aware of being outside of the official release cycles and potential risks. On the other hand, we have a lot of unit tests, and a pretty good installation base. In that way it is also a good test for LMDB. > > Now to my questions: > 1) What are your rough plans with mdb.master in terms of time line and features? > (With the 0.9.20 release being delayed, new features may pile up in mdb.master. When will they be merged?) 0.9 is not receiving any more new features. Any features not yet released are slated for 1.0. > 2) Is mdb.master running on any systems you know of? mdb.master is a development branch only. > 3) Recent changes in mdb.master also include format changes for the locking file (e.g. commit "Store lock ID instead of pathname in lockfile"). What are the consequences when updating from an older version? The lock file is ephemeral. There is a possibility of a clash if two processes linked against different versions access the same environment at the same time, otherwise there's no issue. > 4) Are the formats for lock & data files considered stable? Nothing in mdb.master is considered stable. > Thanks, > Markus > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

LMDB master branch
by opensource＠gmx-topmail.de 19 Apr '17

19 Apr '17

Hi there, I am on the mdb.master branch because of MDB_VL32. We updated the LMDB code in January, and before I update to the latest commit I wanted to check with you. Disclaimer: I am aware of being outside of the official release cycles and potential risks. On the other hand, we have a lot of unit tests, and a pretty good installation base. In that way it is also a good test for LMDB. Now to my questions: 1) What are your rough plans with mdb.master in terms of time line and features? (With the 0.9.20 release being delayed, new features may pile up in mdb.master. When will they be merged?) 2) Is mdb.master running on any systems you know of? 3) Recent changes in mdb.master also include format changes for the locking file (e.g. commit "Store lock ID instead of pathname in lockfile"). What are the consequences when updating from an older version? 4) Are the formats for lock & data files considered stable? Thanks, Markus

1 0

Is there anything in LDAP that works similar to HTTP's virtual hosting.
by John Lewis 17 Apr '17

17 Apr '17

I am reading in the LDAP spec https://tools.ietf.org/html/rfc4511 about naming contexts and I am looking at my RootDSE. Since my DIT mirrors DNS https://tools.ietf.org/html/rfc2247, there must be some way to route someone to the correct naming context based on the DNS they were using to access the LDAP server, otherwise I just don't understand the spec.

4 10

this is really good news
by Egidio Melissano 17 Apr '17

17 Apr '17

Greetings, Have you heard the latest news already? I think you'll like it, please read it here http://www.mensworld.center/hospital.php?0002 Very truly yours, Egidio Melissano

1 0

Re: lmdb
by Howard Chu 17 Apr '17

17 Apr '17

Patrick Hawley wrote: > > > I've been puzzled by lmdb's free list use. In some experiments, I've > been seeing that it sometimes grabs pages from the end instead of > using free list pages. This means that the number of pages used > tends to grow until it uses them all. I've tried increasing the map size > (to even quite a large value), and ensuring that write transactions are > not held open long but that doesn't seem to help. Length of write transactions is irrelevant. Nothing in the LMDB documentation talks about length of write transactions; perhaps you need to reread the docs. The issue is keeping a lot of read transactions open when writes are in progress. I've tried with > subdatabases and without subdatabases. It does appear to increase > faster when overflow pages are used, but even without overflow > pages the effect occurs. I can see in the code some places where it > might choose not to use the free list, but I haven't been able to > identify a problem in the code. Wondering whether anyone else > has observed this also. The library otherwise looks quite useful > and performant. Using lmdb via python (0.92). Thanks. > > Patrick -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

Slapd authenticating with krb5 localhost principal
by Jaap Winius 15 Apr '17

15 Apr '17

Hi folks, My new Debian stretch slapd consumer configuration is suffering from a Kerberos authentication problem that looks like a bug. It is apparently unable to read the Kerberos keytab file and instead authenticates to its provider as (for my realm) ldap/localhost(a)EXAMPLE.COM. The error I keep getting is: slapd[1668]: GSSAPI Error: Unspecified GSS failure. \ Minor code may provide more information \ (Server ldap/localhost(a)EXAMPLE.COM not found in Kerberos database) The software I'm using is: * Debian stretch * MIT Kerberos 1.15-1 * slapd 2.4.44+dfsg-3 * libsasl2-modules-gssapi-mit 2.1.27~101-g0780600+dfsg-3 The usual way to get slapd to use a Kerberos principal to authenticate to a provider is by telling it where the Kerberos key table file is. On Debian systems, slapd looks in a default location first (/etc/krb5.keytab), but an alternate keytab can be set in /etc/default/slapd with e.g.: export KRB5_KTNAME=/etc/ldap/krb5-ldap.keytab Just ensure that the openldap group can read the keytab file. This works on Debian wheezy with slapd 2.4.31-2+deb7u2, but for some reason it's not working at all on Debian stretch. Other things I have checked are: * /etc/hostname * hostnamectl status * /etc/hosts (contains only '127.0.0.1 localhost' and linklocal addresses) * DNS forward and reverse lookups So, is this a slapd problem, or maybe something to do with a SASL/GSSAPI library, such as libsasl2-modules-gssapi-mit? Thanks, Jaap

2 1

Re: Info Attribute
by Quanah Gibson-Mount 14 Apr '17

14 Apr '17

--On Wednesday, April 12, 2017 11:12 PM +0200 Michael Ströder <michael(a)stroeder.com> wrote: > Tom Jay wrote: >> I'm trying to add the 'info' attribute to an entry and am getting the >> following: >> >> ldap_modify: Object class violation (65) >> additional info: attribute 'info' not allowed >> [..] >> Currently, the only object class assigned to the entry is inetOrgPerson. >> >> Has anyone got any idea why this may be the case? > > In general one would use attribute 'description' for this kind of content > nowadays. In addition, I would note the comments for the "info" attribute even in the RFC say to not use it: 9.3.4. Information The Information attribute type specifies any general information pertinent to an object. It is recommended that specific usage of this attribute type is avoided, and that specific requirements are met by other (possibly additional) attribute types. Reference: <https://www.ietf.org/rfc/rfc1274.txt> --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

3 4

lmdb
by Patrick Hawley 13 Apr '17

13 Apr '17

I've been puzzled by lmdb's free list use. In some experiments, I've been seeing that it sometimes grabs pages from the end instead of using free list pages. This means that the number of pages used tends to grow until it uses them all. I've tried increasing the map size (to even quite a large value), and ensuring that write transactions are not held open long but that doesn't seem to help. I've tried with subdatabases and without subdatabases. It does appear to increase faster when overflow pages are used, but even without overflow pages the effect occurs. I can see in the code some places where it might choose not to use the free list, but I haven't been able to identify a problem in the code. Wondering whether anyone else has observed this also. The library otherwise looks quite useful and performant. Using lmdb via python (0.92). Thanks. Patrick

1 0

Info Attribute
by Tom Jay 12 Apr '17

12 Apr '17

Hello, I'm trying to add the 'info' attribute to an entry and am getting the following: ldap_modify: Object class violation (65) additional info: attribute 'info' not allowed If you look at the Cosine schema, the info attribute is defined, but with no object class (pilotObject has been commented out). If I try and add the 'top' object class, this is successful, but still prevents me from adding the info attribute. Currently, the only object class assigned to the entry is inetOrgPerson. Has anyone got any idea why this may be the case? Thanks. Tom

2 1

OpenLDAP + MySQL BackEnd
by Alexandre Vilarinho 10 Apr '17

10 Apr '17

Hello all, Recently I've donwload the OpenLDAP 2.4.44 and enable mysql as followed. apt-get install libssl-dev libdb-dev unixodbc-dev time wget ftp://ftp.openldap.org/pub/OpenLDAP/openldap-release/openldap-2.4.26.tgz tar xvfz openldap-*.tgz cd openldap-* ./configure --enable-sql make depend make make install apt-get install mysql-server libmyodbc # put mysql root password and confirm password that you want mysql -u root -p # put mysql root password CREATE USER 'openldap'@'localhost' IDENTIFIED BY 'yourpassword'; CREATE DATABASE IF NOT EXISTS openldap; GRANT ALL PRIVILEGES ON openldap.* TO 'openldap'@'localhost'; FLUSH PRIVILEGES; exit edit /etc/odbc.ini [openldap] Description = Example for OpenLDAP's back-sql Driver = MySQL Trace = No Database = openldap Servername = localhost UserName = openldap Password = yourpassword ReadOnly = No RowVersioning = No ShowSystemTables = No ShowOidColumn = No FakeOidIndex = No ConnSettings = SOCKET = /var/run/mysqld/mysqld.sock /etc/odbcinst.ini [MySQL] Description = ODBC for MySQL Driver = /usr/lib/x86_64-linux-gnu/odbc/libmyodbc.soo FileUsage = 1 cd servers/slapd/back-sql/rdbms_depend/mysql/ mysql -u openldap -p openldap < backsql_create.sql mysql -u openldap -p openldap < testdb_create.sql mysql -u openldap -p openldap < testdb_data.sql mysql -u openldap -p openldap < testdb_metadata.sql /usr/local/etc/openldap/slapd.conf # $OpenLDAP$ # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /usr/local/var/slapd.pid argsfile /usr/local/var/slapd.args ####################################################################### # sql database definitions ####################################################################### database sql suffix "dc=example,dc=com" rootdn "cn=root,dc=example,dc=com" rootpw rootpassword dbname openldap dbuser openldap dbpasswd yourpassword subtree_cond "ldap_entries.dn LIKE CONCAT('%',?)" insentry_stmt "INSERT INTO ldap_entries (dn,oc_map_id,parent,keyval) VALUES (?,?,?,?)" has_ldapinfo_dn_ru no When I execute the following command /usr/local/libexec/slapd -d 1 I receive the following information 58eba756 backsql_db_open(): entry deletion SQL statement not specified (use "renentry_stmt" directive in slapd.conf)58eba756 backsql_db_open(): setting "UPDATE ldap_entries SET dn=?,parent=?,keyval=? WHERE id=?" by default58eba756 backsql_db_open(): objclasses deletion SQL statement not specified (use "delobjclasses_stmt" directive in slapd.conf)58eba756 backsql_db_open(): setting "DELETE FROM ldap_entry_objclasses WHERE entry_id=?" by default58eba756 ==>backsql_get_db_conn()58eba756 ==>backsql_open_db_handle()Floating point exception (core dumped) Apparently there is no error. When I execute the following command ldapsearch -x -D cn=root,dc=example,dc=com -w rootpassword -s sub -b "dc=example,dc=com" "(objectClass=*)" I receive the following error root@DNS-TESTE:~# ldapsearch -x -D cn=root,dc=example,dc=com -w teste -s sub -b "dc=example,dc=com" "(objectClass=*)"ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) Apparently after the installation of the ldap, the sldap demon wasn't created. I'm doing something wrong? Is there another way to configure LDAP to support MySQL? Regards Alex

2 1

Re: Is there directory schema for storing information on States and Corporations?
by John Lewis 09 Apr '17

09 Apr '17

On Fri, 2017-04-07 at 11:29 +1200, Kevin Buckley wrote: > Apologies for replying out of the thread but I had binned the > original one, and then had the thoughts ! > > If you post my content (assuming you want to reply!), in to the > thread then I'll get to see the thread continue, when that messgae > appears. I'm putting this back on the list. > > John Lewis <oflameo2(a)gmail.com> wrote: > > > I am bouncing around a couple of projects that involve collecting and > > storing information about Corporations and States. > > > > Is there a already existing schema that will kind of fit this data in > > general? Of hand, the closest one I can think of is inetOrgPerson is the > > closest thing, but it is probably a stretch. > > > > The kind of data is going to be like taking the the top of of > > Corporations and State's inetOrgPerson data and stuffing it under one > > tree and bundling public data with it such as contracts a company have with a state on record. > Have you considered using a domain component (dc=,dc=) based tree, > using dot-us as the root, and the two-letter states sub-domains below it > > dc=ca,dc=us > > and then putting your corporation in below that, for example > > o=mycorp,dc=ca,dc=us > > for the Californian content, in which you "pretend" that the > Californian "branch" > of your Corporation actually "owns" the mycorp,ca.us domain name? > > I take the point made by other respondents about not replying on geographical > info, however a number of corporations do make use of country-based domain > names, for operationsin various theatres, so there is a kind of > precedent, within > the dc= approach. That is what I am thinking about doing. I can probably get away with just using an ou because it is not necessarily a new directory/database. Alternatively I could just make the whole thing flat and put an entry in to describe where it is to be filtered later but I think I like the former better.

1 0

Re: OT: Security management/distribution in "The Cloud" (Was: Dogtag CA with OpenLDAP?)
by Howard Chu 08 Apr '17

08 Apr '17

Turbo Fredriksson wrote: > On 28 Mar 2017, at 11:22, Howard Chu <hyc(a)symas.com> wrote: > >> We had a module for OpenLDAP 2.0, way back when. It hasn't been maintained in years. > > Ok, I see :(. What did that do exactly? Name? I've dug it up and gotten it working again. http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commit;h=2b920eca… Basically it's an overlay that generates certificates for users and servers residing in the directory. A single Search request across the entire directory can trigger generation of certs for every relevant entry. > > > > Sorry for the OT (although it’s _slightly_ relevant to OpenLDAP I guess). > > But how do people handle secrets (key/value, certificates etc) in a cloud > environment? With bare metal, you usually don’t spinup/down machines > that often, so distributing stuff like that is “easy”. But with the cloud and > “resources are cattle, not pets”, how to do that there!? > > This have been racking my brain (and several of my friends and colleagues) > for months now! > > > I’m using OpenLDAP and MIT Kerberos V for users and passwords, but > I’m not sure how I could (if I should) utilise that to keep “secrets”. > > > I’ve looked at Hashicorp Vault, but that’s extremely immature and not any > where near ready a “production” environment (not to mention that it lacks > very important functions etc). > > > Dogtag is apparently good enough (although huge - might not need all that > functionality), but maintaining an additional LDAP/KerberosV setup is seriously > unappealing! > > But what else is there? > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Is there directory schema for storing information on States and Corporations?
by John Lewis 06 Apr '17

06 Apr '17

I am bouncing around a couple of projects that involve collecting and storing information about Corporations and States. Is there a already existing schema that will kind of fit this data in general? Of hand, the closest one I can think of is inetOrgPerson is the closest thing, but it is probably a stretch. The kind of data is going to be like taking the the top of of Corporations and State's inetOrgPerson data and stuffing it under one tree and bundling public data with it such as contracts a company have with a state on record.

2 2

Dogtag CA with OpenLDAP?
by Turbo Fredriksson 06 Apr '17

06 Apr '17

I’m trying to implement Dogtag (http://pki.fedoraproject.org/wiki/PKI_Main_Page) with my existing OpenLDAP/MIT Kerberos V installation (that’s been running for years). But it’s failing because of: [27/Mar/2017:15:49:17][http-bio-8443-exec-3]: confirmMappings: Checking other subtrees using database Domain.TLD-CA. [27/Mar/2017:15:49:17][http-bio-8443-exec-3]: populateDB: netscape.ldap.LDAPException: error result (32); matchedDN = cn=config [27/Mar/2017:15:49:17][http-bio-8443-exec-3]: Error in populating database: Failed to check database mapping: netscape.ldap.LDAPException: error result (32); matchedDN = cn=config Dogtag is only (officially) supporting 389ds, but installing (and maintaining!) another LDAP/Krb5 server(s) on the network just seems … “wrong”! :) The code looks like: https://github.com/dogtagpki/pki/blob/DOGTAG_10_2_6_BRANCH/base/server/cms/… Basically, it looks for “nssldap-backend=Domain.TLD-CA” below “cn=mapping tree,cn=config” (which don’t exists in OpenLDAP of course). Is there any “389ds compatibility module” or possibly a DN rewrite hack I could use for this? I’ve never used “389ds” before, so I’m unsure what that object is supposed to look like, or what “cn=mapping tree” is for exactly..

4 5

Re: [Spam]No olcRootPW in olcDatabase=\{0\}config.ldif
by Quanah Gibson-Mount 05 Apr '17

05 Apr '17

--On Monday, April 03, 2017 7:01 PM +0200 huret deffgok <kadafax(a)gmail.com> wrote: > > > Hi Sami, > > Yes there is a olcRootDN (and its password) for the mdb database. But if > I understand correctly the olcRootDN is valid only for its database. > Anyway this olcRootDN and associated password don't work with the config > database. As for the ACL, again but maybe I'm wrong, from the > documentation it seems that the RootDN is always allowed whatever are the > ACLs. And I can't change them neither as I bump in the same problem as > for the login level :( How to access cn=config may vary depending on if you're using vendor provided packages (RH, Debian, etc). As noted in the slapd.conf(5) man page, the default olcRootDN is "cn=config" unless otherwise specified. If you are not using your own build of OpenLDAP, I would advise reading the documentation that came with your specific distribution. Hope that helps. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: slapo-dds and MMR
by Quanah Gibson-Mount 04 Apr '17

04 Apr '17

--On Tuesday, April 04, 2017 4:20 PM +0200 Michael Ströder <michael(a)stroeder.com> wrote: > HI! > > Reading section REPLICATION of slapo-dds(5) makes me wonder whether > somebody already tried to use slapo-dds with multi-master replication of > dynamicObject entries. > > Any thoughts on this? There are some open ITSes I've come across relating to slapo-dds and various issues as I clean up the ITS incoming queue. You might want to look there. ;) --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: Multiple olcDbIndex for the same attribute
by Quanah Gibson-Mount 04 Apr '17

04 Apr '17

--On Tuesday, April 04, 2017 10:19 AM +0200 "PenguinWhispererThe ." <th3penguinwhisperer(a)gmail.com> wrote: > > > > > Thanks for the response Quanah. > >> I'm not really sure it's the job of the admin guide or the man pages to >> cover all the multitudes of ways in which one can misconfigure the >> server, or what the results of such a misconfiguration will be. > So the above configuration is a misconfiguration? It just might be handy > to have an idea how the indexes work. That might give an idea if this > actually invalid, keeps 2 indexes or doesn't make a difference. > > The openldap server seems to take the ldif so therefor I don't see it as > invalid. If it already exists openldap does throw an error. Question is > if the above has a negative impact on the openldap service. > > I understand man pages and documentation can't cover all. That's why I'm > asking here to perhaps have someone who has internal knowledge about this. Please keep replies on the list. I would say that configuring multiple duplicate indicies for the same attribute is a configuration error. Your example shows "eq" being configured for objectClass twice, once coupled with pres. I would /hope/ that would end up as pres,eq only. What it does end up as, I've no idea. It should be fairly trivial to discover via slapadd and using mdb_stat (if using back-mdb) to see the size of the generated indices in both cases. Then you'd have an exact answer. If the resulting index sub-db is the same for objectClass with either configuration, then the extra "eq" is ignored, etc. I would probably try with something like "sub, eq" rather than "pres, eq" for testing purposes. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

slapo-dds and MMR
by Michael Ströder 04 Apr '17

04 Apr '17

HI! Reading section REPLICATION of slapo-dds(5) makes me wonder whether somebody already tried to use slapo-dds with multi-master replication of dynamicObject entries. Any thoughts on this? Ciao, Michael.

1 0

Re: [Spam]No olcRootPW in olcDatabase=\{0\}config.ldif
by huret deffgok 03 Apr '17

03 Apr '17

Hi Sami, Yes there is a olcRootDN (and its password) for the mdb database. But if I understand correctly the olcRootDN is valid only for its database. Anyway this olcRootDN and associated password don't work with the config database. As for the ACL, again but maybe I'm wrong, from the documentation it seems that the RootDN is always allowed whatever are the ACLs. And I can't change them neither as I bump in the same problem as for the login level :( Thanks On Mon, Apr 3, 2017 at 5:30 PM, Sami <s.aitalioulahcen(a)cnrst.ma> wrote: > Hi Huret, > Could you check if the olcRootDN is in the db conf file > /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{x\}mdb.ldif ? > Also, your olcAccess could be the problem since you denied everything for > everyone. > I'm no openldap expert, so others can correct me if I'm wrong. > > - - > Sami > > > On 03/04/2017 11:04, huret deffgok wrote: > > Hi list, > > I have migrated my openldap installation from 2.3 (CentOS 5) to 2.4.40 > (CentOS 7). > So far so good the server is working, but then I found myself > systematicaly denied when I tried to ajust the log level (or anything else > in fact). > In my olcDatabase=\{0\}config.ldif I see that I dont have a olcRootPW set > for the olcRootDN of this DB (I guess I made an error with my slapd.conf > used for the migration with slaptest). The production db (on mdb, I hope it > is stable enough with the centos 7 shipped version btw) is running fine and > has a olcRootPW set and working. > > # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. > # CRC32 07bfeb05 > dn: olcDatabase={0}config > objectClass: olcDatabaseConfig > olcDatabase: {0}config > olcAccess: {0}to * by * none > olcAddContentAcl: TRUE > olcLastMod: TRUE > olcMaxDerefDepth: 15 > olcReadOnly: FALSE > olcRootDN: cn=config > olcSyncUseSubentry: FALSE > olcMonitoring: FALSE > structuralObjectClass: olcDatabaseConfig > > If I tried to just read the log level with: > > root@ldap /etc/openldap # ldapsearch -x -H ldaps://ldap.mydomain -b > 'cn=config' -D 'cn=config' -s base -LLL -W olcLoglevel > Enter LDAP Password: > ldap_bind: Server is unwilling to perform (53) > additional info: unauthenticated bind (DN with no password) > disallowed > > (and I dont have any password to feed it) > > Or: > root@ldap /etc/openldap # ldapsearch -Y EXTERNAL -H ldapi:/// -b cn=config > SASL/EXTERNAL authentication started > SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth > SASL SSF: 0 > # extended LDIF > # > # LDAPv3 > # base <cn=config> with scope subtree > # filter: (objectclass=*) > # requesting: ALL > # > > # search result > search: 2 > result: 32 No such object > > # numResponses: 1 > > > My question is, and if it is indeed my problem, how can I add a olcRootPW > to the config database if it's possible at all ? > > Thank you, > kfx > > >

1 0

No olcRootPW in olcDatabase=\{0\}config.ldif
by huret deffgok 03 Apr '17

03 Apr '17

Hi list, I have migrated my openldap installation from 2.3 (CentOS 5) to 2.4.40 (CentOS 7). So far so good the server is working, but then I found myself systematicaly denied when I tried to ajust the log level (or anything else in fact). In my olcDatabase=\{0\}config.ldif I see that I dont have a olcRootPW set for the olcRootDN of this DB (I guess I made an error with my slapd.conf used for the migration with slaptest). The production db (on mdb, I hope it is stable enough with the centos 7 shipped version btw) is running fine and has a olcRootPW set and working. # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 07bfeb05 dn: olcDatabase={0}config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by * none olcAddContentAcl: TRUE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=config olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig If I tried to just read the log level with: root@ldap /etc/openldap # ldapsearch -x -H ldaps://ldap.mydomain -b 'cn=config' -D 'cn=config' -s base -LLL -W olcLoglevel Enter LDAP Password: ldap_bind: Server is unwilling to perform (53) additional info: unauthenticated bind (DN with no password) disallowed (and I dont have any password to feed it) Or: root@ldap /etc/openldap # ldapsearch -Y EXTERNAL -H ldapi:/// -b cn=config SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 # extended LDIF # # LDAPv3 # base <cn=config> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 32 No such object # numResponses: 1 My question is, and if it is indeed my problem, how can I add a olcRootPW to the config database if it's possible at all ? Thank you, kfx

1 0

[openldap-technical] OpenLDAP custom schema [dummy question]
by Alexandru Ocheana 01 Apr '17

01 Apr '17

Hi all, My name is Alex and I recently joined this list because I can't find some straight forward guidelines and nothing seems to work for me. Of course it is a dummy question and I know you saw it many time but I am sure that I'm missing something very very simple in fact. If you want, please help me because I am a bit lost and I don't know how to move forward. I am trying to setup an OpenLDAP server on Centos 7. This is my first time, so please take me easy :)) I will try to reproduce my steps because being my first time error may occur at any moment but I strongly want to learn OpenLDAP. My goal is to add some custom fields (atributeType) into Ldap DB. I know there can be a workaround for this, like add the data into inetOrgPerson schema but I want a new Schema, defined for what I need. Basically this schema will contain supplementary informations about students like (ID-Number, University Assigned Number, contact email, address, name after marriage, etc). Here are all steps I've done (successfully I believe): install and configure OpenLDAP from here: https://www.server-world.info/en/note?os=CentOS_7&p=openldap&f=1 ---- I've tried to create my new schema like this (I have my private IANA OID): ----------------------------------- info.schema ---- attributetype ( 1.3.6.1.4.1.49565.1.1.1 NAME 'cnp' DESC 'Cod Numeric Personal' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{32768} ) attributetype ( 1.3.6.1.4.1.49565.1.1.2 NAME 'emailContact' DESC 'Email for external user' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{32768} ) objectclass ( 1.3.6.1.4.1.49565.1.2.1 NAME 'infoVCard' DESC 'Extra Information Card' AUXILIARY ) ----------------------------------- * Moved to /tmp/slapd folder and created an info.conf file: include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/info.schema * transformed info.schema to ldif slaptest -f info.conf -F . config file testing succeeded * moved to cn=config/cn=schema and all 5 files are here: -rw-------. 1 root root 15546 Mar 31 22:15 cn={0}core.ldif -rw-------. 1 root root 11363 Mar 31 22:15 cn={1}cosine.ldif -rw-------. 1 root root 6495 Mar 31 22:15 cn={2}nis.ldif -rw-------. 1 root root 2857 Mar 31 22:15 cn={3}inetorgperson.ldif -rw-------. 1 root root 890 Mar 31 22:15 cn={4}info.ldif -------------------------------------------- * edited cn={4}info.ldif like so: -------------------------------------------- # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 bc62c5f1 dn: cn=info,cn=schema,cn=config objectClass: olcSchemaConfig cn: info olcAttributeTypes: {0}( 1.3.6.1.4.1.49565.1.1.1 NAME 'cnp' DESC 'Cod Numeric Personal' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{32768} ) olcAttributeTypes: {1}( 1.3.6.1.4.1.49565.1.1.2 NAME 'emailContact' DESC 'Em ail for external user' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstrings Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{32768} ) olcObjectClasses: {0}( 1.3.6.1.4.1.49565.1.2.1 NAME 'infoVCard' DESC 'Extra Information Card' AUXILIARY ) ------------------------------------------- * copied info.ldif from /tmp to /etc/openldap/schema/info.ldif * load info.ldif into OpenLDAP ldapadd -Y EXTERNAL -H ldapi:/// -f info.ldif OUTPUT of above command: SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 adding new entry "cn=info,cn=schema,cn=config" ------------------------------------ I suppose everything is correct because at /etc/openldap/slapd.d/cn=config/cn=schema now appears my cn={4}info.ldif file with the following content: # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 a48aaa49 dn: cn={4}info objectClass: olcSchemaConfig cn: {4}info olcAttributeTypes: {0}( 1.3.6.1.4.1.49565.1.1.1 NAME 'cnp' DESC 'Cod Numeric Personal' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{32768} ) olcAttributeTypes: {1}( 1.3.6.1.4.1.49565.1.1.2 NAME 'emailContact' DESC 'Em ail for external user' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstrings Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{32768} ) olcObjectClasses: {0}( 1.3.6.1.4.1.49565.1.2.1 NAME 'infoVCard' DESC 'Extra Information Card' AUXILIARY ) structuralObjectClass: olcSchemaConfig entryUUID: 9d56682a-aa93-1036-9882-31e47bf02dae creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20170331192559Z entryCSN: 20170331192559.397549Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20170331192559Z --------------------------------------- Now, till here everything worked smooth but from this step forward everything turns into a nightmare. How do I add data using this new schema? I've tried this: ldapuser.ldif --- dn: uid=alex,ou=People,dc=info,dc=uaic,dc=ro objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount cn: Alexandru sn: Ocheana userPassword: {SSHA}BBxUpzvO93HlFEFPSkexvXA7G06UBYO4 loginShell: /bin/bash uidNumber: 2000 gidNumber: 2000 homeDirectory: /home/alex ## ------------------------- ## HERE I BELIEVE IS AN ERROR BUT WHICH IS THE CORRECT WAY TO ADD IT? ## THIS PART IS TO ADD DATA TO THAT NEW SCHEMA ## ------------------------- dn: uid=alex,ou=People,dc=info,dc=uaic,dc=ro objectClass: infoVCard cnp: myCNP emailContact: otheremail(a)gmail.com dn: cn=alex,ou=Group,dc=info,dc=uaic,dc=ro objectClass: posixGroup cn: Alex gidNumber: 2000 memberUid: alex ---- I am trying to add this to OpenLDAP like so: ldapadd -x -D cn=Manager,dc=info,dc=uaic,dc=ro -W -f ldapuser.ldif After asking for password I am getting this output: adding new entry "uid=alex,ou=People,dc=info,dc=uaic,dc=ro" adding new entry "uid=alex,ou=People,dc=info,dc=uaic,dc=ro" ldap_add: Object class violation (65) additional info: no structural object class provided My logic tells me that my infoVCard should be bound somehow to first set as inetPersonOrg (I've read about this but I don't know how to really achieve this ... I know about SUP but I am lost at this point). Can you bring some light into my head please? What I am missing? Thank you very much for your time! Regards, Alexandru Ocheana

2 1

OpenLDAP Tutorial on YouTube Channel
by Rajesh R 01 Apr '17

01 Apr '17

Hello, At the outset, thank you to each member of the OpenLDAP project for all the hard work in developing a great LDAP Server. I'm Rajesh Rajasekharan, and have spent a great deal of my time in various Organizations teaching several Products, including their LDAP Servers. While searching for good OpenLDAP resources, I couldn't really find a systematic tutorial for the same, so thought of making one myself. As a result, I have a playlist of 19 vidoes on OpenLDAP on my YouTube channel. If/when you've some time to spare, request you to please take a look at it and kindly advise if I could contribute in any other ways to this great Project. https://www.youtube.com/playlist?list=PLfO6SFqcY2PrDR5yct96n4qfgMmh6g0eP kind regards, --R Rajesh Sent from my iPhone

4 5

Re: Multiple olcDbIndex for the same attribute
by Quanah Gibson-Mount 31 Mar '17

31 Mar '17

--On Friday, March 31, 2017 12:24 PM +0200 "PenguinWhispererThe ." <th3penguinwhisperer(a)gmail.com> wrote: > So for example: > olcDbIndex: objectClass pres,eq > olcDbIndex: objectClass eq > > Is this the same as if you'd only have: > olcDbIndex: objectClass pres,eq > ? > > Or does it really make a difference? > > > > I've checked http://www.openldap.org/doc/admin24/slapdconf2.html but I > couldn't find an answer to this. I'm not really sure it's the job of the admin guide or the man pages to cover all the multitudes of ways in which one can misconfigure the server, or what the results of such a misconfiguration will be. My *guess* is that the end result will be that it will have both a "pres" and an "eq" index. YMMV. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: "Dynamic" authentication passthrough?
by Quanah Gibson-Mount 31 Mar '17

31 Mar '17

--On Friday, March 31, 2017 1:52 PM -0400 Curtiss Howard <curtiss.howard(a)gmail.com> wrote: > Is there a way to do this? > > > Just use slapo-pbind. > > > > > > Ah nice, this sounds more like it. However, I have two AD servers that > I'm proxying -- is there a concept of using this overlay multiple times? Doesn't seem like it, but I've never set it up. I suppose if each AD server had a different base for its DIT, it would be possible to add an option to direct auth requests to different AD servers based off of that. But that would be an enhancement to the existing functionality. May be worth filing an ITS to request it. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: "Dynamic" authentication passthrough?
by Howard Chu 31 Mar '17

31 Mar '17

Curtiss Howard wrote: > Hi, > > I've got two Active Directory servers that are being proxied through OpenLDAP > and their respective trees are being merged into one. So far, so good. > > Now I want to allow users to bind to the OpenLDAP server and pass the > authentication through to the appropriate AD and let it do the password checking. > > I see a lot of documentation on using SASL for passthrough, but where I'm > stuck is that this requires every user to have an account in the OpenLDAP > server in order to see if the userPassword attribute is specially formatted. > In my case, this isn't really a palatable solution because I'm using the > OpenLDAP server with the meta backend and using it as a "live view" into the > data contained in the ADs. Other applications can talk directly to the ADs > and in order to do the SASL approach there'd have to be some syncing from the > ADs to the OpenLDAP server every time a user is created/deleted. > > I would think that surely there must be some way to pass through the > authentication in a more obvious manner -- i.e., if the user doesn't exist > locally, try to bind against each proxied server in succession. But I can't > seem to find a way to do this, all references point to the SASL approach. > > Is there a way to do this? Just use slapo-pbind. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

"Dynamic" authentication passthrough?
by Curtiss Howard 31 Mar '17

31 Mar '17

Hi, I've got two Active Directory servers that are being proxied through OpenLDAP and their respective trees are being merged into one. So far, so good. Now I want to allow users to bind to the OpenLDAP server and pass the authentication through to the appropriate AD and let it do the password checking. I see a lot of documentation on using SASL for passthrough, but where I'm stuck is that this requires every user to have an account in the OpenLDAP server in order to see if the userPassword attribute is specially formatted. In my case, this isn't really a palatable solution because I'm using the OpenLDAP server with the meta backend and using it as a "live view" into the data contained in the ADs. Other applications can talk directly to the ADs and in order to do the SASL approach there'd have to be some syncing from the ADs to the OpenLDAP server every time a user is created/deleted. I would think that surely there must be some way to pass through the authentication in a more obvious manner -- i.e., if the user doesn't exist locally, try to bind against each proxied server in succession. But I can't seem to find a way to do this, all references point to the SASL approach. Is there a way to do this? Thanks in advance.

2 1

Multiple olcDbIndex for the same attribute
by PenguinWhispererThe . 31 Mar '17

31 Mar '17

Hello, I'm wondering what happens when you add multiple indexes for the same attribute with the same keyword occuring in each of them but with a different set. So for example: olcDbIndex: objectClass pres,eq olcDbIndex: objectClass eq Is this the same as if you'd only have: olcDbIndex: objectClass pres,eq ? Or does it really make a difference? I've checked http://www.openldap.org/doc/admin24/slapdconf2.html but I couldn't find an answer to this. Thanks in advance!

1 0

Re: Import data from hdb to bdb
by Jai Bheemsen Rao Dhanwada 30 Mar '17

30 Mar '17

Hello Quanah, Thanks for the Info. this helps :) On Thu, Mar 30, 2017 at 2:48 PM, Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Thursday, March 30, 2017 3:38 PM -0700 Jai Bheemsen Rao Dhanwada < > jaibheemsen(a)gmail.com> wrote: > > >> Hello, >> >> >> We have N way master openldap replication with hdb backend for the data. >> Now we would like to slapcat the data from this cluster and slapadd to >> another cluster which is backed by bdb. >> > > Both back-hdb and back-bdb (which both use BDB underneath) are deprecated > backends. You should not be using either one. Instead, examine migrating > to back-mdb, which is backed by LMDB: <https://en.wikipedia.org/wiki > /Lightning_Memory-Mapped_Database> > > Regardless, LDIF exports are usable regardless of backend (bdb, hdb, mdb). > The "DIF" stands for "Data Interchange Format". You might be best served > by first learning more about LDIF: <https://en.wikipedia.org/wiki > /LDAP_Data_Interchange_Format> > > --Quanah > > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > >

1 0

Re: Import data from hdb to bdb
by Quanah Gibson-Mount 30 Mar '17

30 Mar '17

--On Thursday, March 30, 2017 3:38 PM -0700 Jai Bheemsen Rao Dhanwada <jaibheemsen(a)gmail.com> wrote: > > Hello, > > > We have N way master openldap replication with hdb backend for the data. > Now we would like to slapcat the data from this cluster and slapadd to > another cluster which is backed by bdb. Both back-hdb and back-bdb (which both use BDB underneath) are deprecated backends. You should not be using either one. Instead, examine migrating to back-mdb, which is backed by LMDB: <https://en.wikipedia.org/wiki/Lightning_Memory-Mapped_Database> Regardless, LDIF exports are usable regardless of backend (bdb, hdb, mdb). The "DIF" stands for "Data Interchange Format". You might be best served by first learning more about LDIF: <https://en.wikipedia.org/wiki/LDAP_Data_Interchange_Format> --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Import data from hdb to bdb
by Jai Bheemsen Rao Dhanwada 30 Mar '17

30 Mar '17

Hello, We have N way master openldap replication with hdb backend for the data. Now we would like to slapcat the data from this cluster and slapadd to another cluster which is backed by bdb. Any idea does this work as I am trying to slapcat from hdb and slapadd to bdb? if anyone has done this, please share some details.

1 0

Parallel traversal
by Gabriel Tanase 30 Mar '17

30 Mar '17

Assuming I have an LMDB database: to traverse all data in a table I open a cursor and go over each element in a loop using MDB_NEXT or MDB_NEXT_DUP : :mdb_cursor_get (cur, &_entry.first, &_entry.second, MDB_NEXT_DUP); How can one traverse the data in an LMDB table using multiple threads for a faster overall traversal? I am assuming a read only transaction and I would like each thread to work on distinct entries; Like if there are 100 [key, value] and I use 4 threads, thread zero will work on first 25 elements, thread one will work on the next 25 and so on. 25 doesn't have to be exactly 25 but ideally the partitioned should be balanced. A simple solution I designed is to read all keys into a vector first and then subsequently parallelize with each thread working on a subset of key from this vector. Each thread will traverse a subset of keys, and for each key we find the corresponding [key, value] and work on the value. Is there an alternative ? Thx, Gabriel

1 0

Re: LDAP Replication settings
by Quanah Gibson-Mount 29 Mar '17

29 Mar '17

--On Wednesday, March 29, 2017 7:39 PM +0200 Ondřej Kuzník <ondra(a)mistotebe.net> wrote: > On the other hand, AFAIK syncprov knows what clients are in the > persistent search state at any moment, so it might be able to export > that under cn=monitor. Not that anyone has implemented this monitoring > yet or even sure how useful that would be... Yes, but you can pull that information out of syslog if you have stats logging enabled. But I think (hard to know for sure) they are asking for a way to know /all/ possibly replicas (currently connected or not). You used to be able to do that with slurpd back in OpenLDAP 2.3 and prior. Simply not possible with syncrepl if it's not set up using back-ldap to push out to the clients. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: LDAP Replication settings
by Quanah Gibson-Mount 29 Mar '17

29 Mar '17

--On Tuesday, March 28, 2017 5:39 PM -0700 Jai Bheemsen Rao Dhanwada <jaibheemsen(a)gmail.com> wrote: > > I am using OLC configuration for LDAP setup > > > On Tue, Mar 28, 2017 at 4:21 PM, Jai Bheemsen Rao Dhanwada > <jaibheemsen(a)gmail.com> wrote: > > > Hello, > > > I have multi master replication with 4 LDAP servers. Is there a > ldapsearch query to get all the replica servers? Not quite sure what you mean by your question. Since replication configuration is most often done on the client (replica) side, the master doesn't have any knowledge you can query about what its replicas are. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: SV: 100.000 pr. second: "connection_read(64): no connection" from slapd
by Quanah Gibson-Mount 29 Mar '17

29 Mar '17

--On Wednesday, March 29, 2017 3:37 PM +0000 Ole Nomann Thomsen <ole.nomann(a)stil.dk> wrote: > [Side note, do I answer this directly to you, or to the list? I choose > directly for now ] The list. > Thanks for your answer > > I use -d because I run slapd under deamontools > (https://cr.yp.to/daemontools/faq/create.html) and multilog > (https://cr.yp.to/daemontools/multilog.html) that are both suited for > servers that run in the foreground. So the "not in the background" thing > is intentional. I realize that I might be misusing the -d facility > somewhat, but it has been working fine until now. Reworking the setup to > use backgrounding and syslog is really not an option at this time. > > I use bdb backend database. I'd strongly advise not using back-bdb. > I agree that I have lots of clients that disconnect without closing. > Could this somehow provoke the error? It seems to be cycling in this > line: > > /* get (locked) connection */ > c = connection_get( s ); > > if( c == NULL ) { > Debug( LDAP_DEBUG_ANY, > "connection_read(%ld): no connection!\n", > (long) s, 0, 0 ); > > return -1; > } > > > > > 2017-03-06 13:56:23.140091500 58bd5c77 connection_read(64): no connection! > 2017-03-06 13:56:23.140093500 58bd5c77 connection_read(64): no connection! > 2017-03-06 13:56:23.140095500 58bd5c77 connection_read(64): no connection! > 2017-03-06 13:56:23.140097500 58bd5c77 connection_read(64): no connection! > > Once in every 2 microseconds - that suggest som kind of unintended loop > to me. No, you simply have clients that have disconnected before slapd could finish sending them results. Given that you clearly have broken clients, I'd suggest you see about setting the (olc)writetimeout parameter documented in slapd.conf(5)/slapd-config(5) and see if it alleviates the issue you are facing. --Quanah > Regards > Ole Nomann Thomsen > Seniorkonsulent > > Undervisningsministeriet > Styrelsen for It og Læring > Center for Digitale Overgange og it-styring > > Telefon: 3587 8889 > Direkte: +45 35 87 85 35 > > ole.nomann(a)stil.dk > www.stil.dk > > > >> -----Oprindelig meddelelse----- >> Fra: Quanah Gibson-Mount [mailto:quanah@symas.com] >> Sendt: 23. marts 2017 19:42 >> Til: Ole Nomann Thomsen; 'openldap-technical(a)openldap.org' >> Emne: Re: 100.000 pr. second: "connection_read(64): no connection" from >> slapd >> >> --On Thursday, March 23, 2017 2:37 PM +0000 Ole Nomann Thomsen >> <ole.nomann(a)stil.dk> wrote: >> >> > >> > >> > Hi all, >> > >> > >> > >> > my slapd (@(#) $OpenLDAP: slapd 2.4.44 (Feb 9 2017 13:38:13) $) has >> > developed a tendency to become unresponsive for 10-30 minutes at a >> time. >> > >> > I run it with -dStats,Sync which gets me a fair amount of debugging >> > info. This I pipe thru multilog to get the timestamps below. >> >> Why are you using -d? This prevents slapd from forking. It is better to >> set the loglevel to be stats+sync, and push out data to syslog. >> >> > 2017-03-10 14:39:08.686058500 58c2ac7c slapd shutdown: waiting for >> > 3643059 operations/tasks to finish >> >> You need to determine why tasks are not finishing and instead are >> remaining unfinished. What databse backend are you using? I would note >> that it would appear that you have clients disconnecting w/o waiting for >> the server to respond (thus the no connection messages). >> >> --Quanah >> >> -- >> >> Quanah Gibson-Mount >> Product Architect >> Symas Corporation >> Packaged, certified, and supported LDAP solutions powered by OpenLDAP: >> <http://www.symas.com> > -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

LDAP Replication settings
by Jai Bheemsen Rao Dhanwada 29 Mar '17

29 Mar '17

Hello, I have multi master replication with 4 LDAP servers. Is there a ldapsearch query to get all the replica servers? I am using LDAP 2.4.43

1 1

Re: Dogtag CA with OpenLDAP?
by Howard Chu 28 Mar '17

28 Mar '17

Turbo Fredriksson wrote: > On 27 Mar 2017, at 22:09, Michael Ströder <michael(a)stroeder.com> wrote: > >> I've looked at dogtag approx. two years ago. The use of LDAP was, uumh, somewhat strange: > > Ouch, nah that doesn’t make much sense :(. > > > Do anyone know of any other product/project (open source preferred, but not > a requirement) that can do the same - provide certificates programatically? We had a module for OpenLDAP 2.0, way back when. It hasn't been maintained in years. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

3 3

Re: Large user bases cause huge number of roleOccupant in role organizationalRole
by Quanah Gibson-Mount 27 Mar '17

27 Mar '17

--On Monday, March 27, 2017 11:16 AM +0200 Huang Hongfu <huang.hongfu(a)adnovum.ch> wrote: > Dear Quanah, > > When will the OpenLDAP 2.5 be published? What is the maximum size of a > large set? Hi Hongfu, There is no timeline for when 2.5 will be released at the moment. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Large user bases cause huge number of roleOccupant in role organizationalRole
by Quanah Gibson-Mount 27 Mar '17

27 Mar '17

--On Friday, March 24, 2017 8:25 PM +0000 Howard Chu <hyc(a)symas.com> wrote: > Meanwhile, for people with stupid data models, performance with large > attributes in back-mdb is greatly improved in OpenLDAP 2.5. I would note that Symas's OpenLDAP build includes support for attributes with a large set of values as well, as it is undetermined when OpenLDAP 2.5 will release. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: Large user bases cause huge number of roleOccupant in role organizationalRole
by Howard Chu 27 Mar '17

27 Mar '17

Huang Hongfu wrote: > Hello, > > In a general design, we have a role, which is an object of organizationalRole. > Within this role, let us say it will have more than 10 million users. Each > user has a roleOccupant in the role object. > > You can imagine how huge this role object can be! This will cause a big > performance problem. Especially with LMDB as backend, the "add new user" will > become very slow at some point; and the replication will be very difficult > even we setup a delta (with accesslog and session log) replication. > > From my point of view, organizationalRole is not designed for large user bases. > > Or someone has a better idea? The same logic as used in indexing applies here - it is stupid to define a case for something that matches the majority of your population. I.e., it's stupid to define a presence index on an attribute if that attribute occurs in the majority of your entries. It is stupid to define a group or role if the majority of entries will be a member of it. A presence index is only useful if the attribute occurs rarely. A group/role is only useful if the members are a minority of the total population. In this case you should define a group/role for all users who *aren't* part of the majority. Meanwhile, for people with stupid data models, performance with large attributes in back-mdb is greatly improved in OpenLDAP 2.5. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

Large user bases cause huge number of roleOccupant in role organizationalRole
by Huang Hongfu 24 Mar '17

24 Mar '17

Hello, In a general design, we have a role, which is an object of organizationalRole. Within this role, let us say it will have more than 10 million users. Each user has a roleOccupant in the role object. You can imagine how huge this role object can be! This will cause a big performance problem. Especially with LMDB as backend, the "add new user" will become very slow at some point; and the replication will be very difficult even we setup a delta (with accesslog and session log) replication. From my point of view, organizationalRole is not designed for large user bases. Or someone has a better idea? Best regards Hongfu -- Hongfu Huang, Senior System Engineer MSc in Computer Science We're the tech in Fintech: www.adnovum.ch/fintech AdNovum Informatik AG Wengistrase 7, 8005 Zurich, Switzerland phone +41 44 272 6111, Direct: +41 44 270 5266 huang.hongfu(a)adnovum.ch www.adnovum.ch Locations: Zurich (HQ), Bern, Budapest, Ho Chi Minh City, Singapore

2 1

Re: 100.000 pr. second: "connection_read(64): no connection" from slapd
by Quanah Gibson-Mount 23 Mar '17

23 Mar '17

--On Thursday, March 23, 2017 2:37 PM +0000 Ole Nomann Thomsen <ole.nomann(a)stil.dk> wrote: > > > Hi all, > > > > my slapd (@(#) $OpenLDAP: slapd 2.4.44 (Feb 9 2017 13:38:13) $) has > developed a tendency to become unresponsive for 10-30 minutes at a time. > > I run it with -dStats,Sync which gets me a fair amount of debugging info. > This I pipe thru multilog to get the timestamps below. Why are you using -d? This prevents slapd from forking. It is better to set the loglevel to be stats+sync, and push out data to syslog. > 2017-03-10 14:39:08.686058500 58c2ac7c slapd shutdown: waiting for > 3643059 operations/tasks to finish You need to determine why tasks are not finishing and instead are remaining unfinished. What databse backend are you using? I would note that it would appear that you have clients disconnecting w/o waiting for the server to respond (thus the no connection messages). --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: syncrepl and the frontend database
by Quanah Gibson-Mount 23 Mar '17

23 Mar '17

--On Tuesday, March 21, 2017 10:21 PM +0300 Andrey Klimentev <andrei650816(a)gmail.com> wrote: > > Hello. > > > I've got a question about replicating the frontend database. Should I > send syncprov on it and replicate it with cn=config and other databases? > Or is it somehow handled in automated manner? You can replicate cn=config if you choose, but whether or not that is a wise decision is debatable. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

100.000 pr. second: "connection_read(64): no connection" from slapd
by Ole Nomann Thomsen 23 Mar '17

23 Mar '17

Hi all, my slapd (@(#) $OpenLDAP: slapd 2.4.44 (Feb 9 2017 13:38:13) $) has developed a tendency to become unresponsive for 10-30 minutes at a time. I run it with -dStats,Sync which gets me a fair amount of debugging info. This I pipe thru multilog to get the timestamps below. The two snippets below are from two different dates, due to the difficulty of reproducing the error. What I'm seeing at the time, is that I am getting thousands of these (from an earlier run): 2017-03-06 14:15:11.641329500 58bd60df connection_read(64): no connection! 2017-03-06 14:15:11.641331500 58bd60df connection_read(64): no connection! 2017-03-06 14:15:11.641393500 58bd60df connection_read(64): no connection! 2017-03-06 14:15:11.641396500 58bd60df connection_read(64): no connection! 2017-03-06 14:15:11.641398500 58bd60df connection_read(64): no connection! 2017-03-06 14:15:11.641401500 58bd60df connection_read(64): no connection! 2017-03-06 14:15:11.641403500 58bd60df connection_read(64): no connection! Yes: about 2 or 3 microseconds apart! About 100.000 pr. Second. ( I tried post-filtering the "no connection" message away before it hit the log (possible with multilog), theorizing that the disc simply got swamped by these, but slapd was still unresponsive. I can't run the slapd without some debugging, as I need the logtrace, and the "no connection" seems to be output on any debug flag: >From openldap-2.4.44/servers/slapd/connection.c: Debug( LDAP_DEBUG_ANY, "connection_read(%ld): no connection!\n", (long) s, 0, 0 ); ) The (64) varies, but there is always one number responsible for the 100.000/sec and a few other numbers with less than 10/sec. Sometimes it recovers on itself, other times I kill slapd and get this (from a later run); 2017-03-10 14:39:08.632744500 58c2ac7c daemon: shutdown requested and initiated. 2017-03-10 14:39:08.633288500 58c2ac7c conn=45284802 fd=19 closed (slapd shutdown) 2017-03-10 14:39:08.633348500 58c2ac7c conn=45284896 fd=20 closed (slapd shutdown) 2017-03-10 14:39:08.633468500 58c2ac7c conn=45284823 fd=24 closed (slapd shutdown) 2017-03-10 14:39:08.633519500 58c2ac7c conn=45284825 fd=25 closed (slapd shutdown) 2017-03-10 14:39:08.633558500 58c2ac7c conn=45284829 fd=26 closed (slapd shutdown) 2017-03-10 14:39:08.633596500 58c2ac7c conn=45284838 fd=27 closed (slapd shutdown) 2017-03-10 14:39:08.633684500 58c2ac7c conn=45284845 fd=28 closed (slapd shutdown) 2017-03-10 14:39:08.634018500 58c2ac7c conn=45284890 fd=29 closed (slapd shutdown) 2017-03-10 14:39:08.634823500 58c2ac7c conn=45266816 fd=33 closed (slapd shutdown) 2017-03-10 14:39:08.686058500 58c2ac7c slapd shutdown: waiting for 3643059 operations/tasks to finish 2017-03-10 14:39:17.320835500 58c2ac85 daemon: accept(-1) failed errno=9 (Bad file descriptor) 2017-03-10 14:39:34.750553500 58c2ac96 daemon: accept(-1) failed errno=9 (Bad file descriptor) 2017-03-10 14:40:55.413900500 58c2ace7 slapd stopped. Note that: 3643059 operations/tasks Does anybody have a hint what I am facing here, or where I should look? I have not (yet) discovered a reliable way to reproduce the errorm normally I just wait for it to happend. Regards, Ole.

1 0

Dovecot can't connect to openldap over starttls
by info＠gwarband.de 22 Mar '17

22 Mar '17

Hello, can anybody say something about my problem? The mails in the bottom are from my discuss with the dovecot maillist. Thanks, Tobias -------- Originalnachricht -------- Betreff: Re: Dovecot can't connect to openldap over starttls Datum: 2017-03-18 14:22 Absender: info(a)gwarband.de Empfänger: Tomas Habarta <lists+dovecot(a)tocc.cz> Kopie: dovecot(a)dovecot.org The serverlog of openldap with loglevel "any": https://gwarband.de/openldap/openldap-connect.log Note: openldap waits 1 Minute before he says "TLS negotiation failure" after the connect. and dovecot says direct "Connect error" I've also delete the TLSCipherSuite from openldap. Tobias Am 2017-03-18 14:01, schrieb Tomas Habarta: > Increase log level on server side as well to see what the server > says... > You may remove anything in TLSCipherSuite for the purpose of testing > too. > Hopefully anyone knowing OpenLDAP internals could help you analyse it > more deeply. > Tomas > On 03/18/2017 01:31 PM, info(a)gwarband.de wrote: >> I've replicate the settings from ldapsearch to dovecot but no >> success. >> To the certificate: >> Yes it's a *.crt file but I have linked the *.pem file to it and >> dovecot >> has read access to that file. >> I have enabled the debugging in dovecot and have uploaded the output: >> https://gwarband.de/openldap/dovecot-connect.log >> And the other site with ldapsearch: >> https://gwarband.de/openldap/ldapsearch-connect.log >> I'm pretty sure that there is a problem with the sslhandshaking >> between >> openldap and dovecot, but I can't find the source of the problem. >> One of the steps in the sslhandshaking is not success but in the >> debugging output I can't find any line with a hit to it. >> Tobias >> Am 2017-03-18 12:30, schrieb Tomas Habarta: >>> Well, if ldapsearch works, try to replicate its settings for dovecot >>> client. >>> It's not obvious what settings ldapsearch uses, have a look at >>> default >>> client settings in /etc/openldap/ldap.conf, there may be something >>> set a >>> slightly different way. >>> Also double check permissions for files used by dovecot, I mean >>> mainly >>> the file listed for tls_ca_cert_file as dovecot may not have an >>> access >>> for reading... >>> I cannot see anything downright bad, just posted CA cert (which is >>> ok, >>> tested) is *.crt and your config mentions *.pem but I consider it's >>> the >>> same file. >>> Finally, I would recommend to enable debug option for dovecot's >>> client >>> debug_level = -1 (which logs all available) in your >>> dovecot-ldap.conf >>> to see what the library reports and work further on that. >>> You can compare with output from ldapsearch by adding -d-1 switch to >>> it. >>> Hard to tell more at the moment. >>> >>> Tomas >>> On 03/18/2017 09:41 AM, info(a)gwarband.de wrote: >>>> Hello, >>>> I have also installed LE certs. >>>> But nothing helps, I have double-checking all certs. >>>> ldapsearch with -ZZ works see: >>>> https://gwarband.de/openldap/ldapsearch.log >>>> I have also uploaded the TLSCACertificateFile, maybe I have a >>>> failure in >>>> the merge of the two fiels: >>>> https://gwarband.de/openldap/LetsEncrypt.crt >>>> And also I have uploaded my complete openldap configuration: >>>> https://gwarband.de/openldap/openldap.conf >>>> All other components can work and communicate with my openldap >>>> server. >>>> The components are postfix, openxchange, apache (phpldapadmin). >>>> My installated software is: >>>> Debian 8 >>>> OpenLDAP 2.4.40 >>>> Dovecot 2.2.13 >>>> I hope you can find the issue. >>>> Thanks, >>>> Tobias >>>> Am 2017-03-17 22:48, schrieb Tomas Habarta: >>>>> Hi, >>>>> been running Dovecot 2.2.27 against OpenLDAP 2.4.40 normally over >>>>> the >>>>> unix socket on the same machine, but tried over inet with STARTTLS >>>>> and >>>>> it's working ok... >>>>> I would suggest double-checking key/certs setup on OpenLDAP side; >>>>> for >>>>> the test I have used LE certs, utilizing following cn=config >>>>> attributes: >>>>> olcTLSCertificateKeyFile contains private key >>>>> olcTLSCertificateFile contains certificate >>>>> olcTLSCACertificateFile contains both certs (DST Root CA X3 >>>>> and Let's Encrypt Authority X3) >>>>> and used the same CA file in Dovecot's tls_ca_cert_file >>>>> Is ldapsearch working ok (-ZZ) and only Dovecot has troubles or >>>>> ... ? >>>>> >>>>> >>>>> Hope that helps, good luck ;) >>>>> Tomas >>>>> >>>>> On 03/17/2017 04:27 PM, info(a)gwarband.de wrote: >>>>>> Hello guys, >>>>>> actually I'm trying to configure dovecot to access openldap for >>>>>> passwordcheck. >>>>>> My openldap is only allow access over "secure ldap". >>>>>> The dovecot can communicate with the openldap server but there is >>>>>> maybe >>>>>> a failure in the sslhandshake. >>>>>> Additional information you can find in the logs or in the dump >>>>>> below. >>>>>> Also I have my ldap config from dovecot in the links below. >>>>>> I have already created an bug reporting in the system of openldap >>>>>> but >>>>>> the answer was to get support from her. >>>>>> All datalinks: >>>>>> https://gwarband.de/openldap/dovecot.log >>>>>> https://gwarband.de/openldap/dovecot-ldap.conf >>>>>> https://gwarband.de/openldap/openldap.log >>>>>> https://gwarband.de/openldap/trace.dump >>>>>> The bugreportinglink from openldap: >>>>>> http://www.openldap.org/its/index.cgi/Incoming?id=8615 >>>>>> I hope you can help me. >>>>>> Regards. >>>>>> Tobias Warband

3 8

Re: [LMDB] getting MDB_CORRUPTED when deleting within a DUPSORT database
by Howard Chu 22 Mar '17

22 Mar '17

Klaus Malorny wrote: > Hi, > > I am using version 0.9.20 on Linux (Ubuntu derivates, uname see [1], [2]). Version 0.9.20 was never officially released. The release was withdrawn due to a corruption bug. I suggest you downgrade to 0.9.19. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

3 3

Possible to rebind-as-user with chain overlay using TLS client certificates?
by Matthew Kemp 22 Mar '17

22 Mar '17

Hey all, We've got a fairly straightforward producer/consumer setup with a single producer and multiple syncrepl consumers configured with an updateref back to the producer. The consumers are set up to use the chain overlay with the ldap backend for transparent password updates. We use TLS client certificates to authenticate the clients to the consumers and the consumers to the producers with SASL EXTERNAL binds. However, I've been struggling with configuring what I had hoped would be a simple part of the setup. We would like the ability to have the user simple bind as themselves to the consumer and then have the chain overlay transparently follow the updateref back to the producer and rebind as the user there to do the PASSMOD update. For whatever reason, I haven't been successful at making that happen. I've tried several attempts at various back_ldap configurations, to no avail. By playing with the olcDbIdAssertBind and various mode/flags, I can get the backend to attempt ProxyAuth (which we'd prefer not to use if possible), and alternatively I am able to get the chain to anonymously bind, but I am not able to initiate a rebind as the originating user. We're running slapd 2.4.31 under Debian Wheezy on the producer and a variety of 2.4.31 and 2.4.40 slapd consumers under Debian Wheezy and Debian Jesse, respectively. I was hoping you'd be able to shed some light whether this is even possible? Attached are the most recent configuration that I believe should work for my needs. Thanks! --- Current consumer config: dn: olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config objectClass: olcOverlayConfig objectClass: olcChainConfig olcOverlay: {0}chain olcChainReturnError: TRUE structuralObjectClass: olcChainConfig dn: olcDatabase={0}ldap,olcOverlay={0}chain,olcDatabase={-1} frontend,cn=config objectClass: olcLDAPConfig objectClass: olcChainDatabase olcDatabase: {0}ldap structuralObjectClass: olcLDAPConfig olcDbURI: ldap://ldap-primary olcDbRebindAsUser: TRUE olcDbStartTLS: start tls_cert=/etc/ssl/certs/ldap-consumer.crt tls_key=/etc/ssl/private/ldap-consumer.key tls_cacert=/usr/share/ca-certi ficates/cosmos/ldap_producer_ca_pem.crt -- Matt Kemp Production Engineer Braintree

1 0

syncrepl and the frontend database
by Andrey Klimentev 21 Mar '17

21 Mar '17

Hello. I've got a question about replicating the frontend database. Should I send syncprov on it and replicate it with cn=config and other databases? Or is it somehow handled in automated manner?

1 0

slapd-sock as overlay and PASSMOD
by Michael Ströder 20 Mar '17

20 Mar '17

HI! As said I'd like to intercept password changes (clear-text password) via back-sock used as overlay. Especially the client (Mac OS X) sends a Password Modify ext. op. Unfortunately back-sock does not send the PASSMOD itself to the external listener (which could parse the ASN.1) and therefore I have to look at the MODIFY messages. I'm using my package: https://pypi.python.org/pypi/slapdsock Problem: Everything works as expected with this configuration when rootdn is used with ldappasswd but not as normal user. Excerpt of slapd.conf: database mdb suffix "ou=realdb,dc=example,dc=org" rootdn "cn=root,ou=realdb,dc=example,dc=org" [..] overlay sock extensions binddn peername ssf connid socketpath sockoverlay-listener sockops modify Command: ldappasswd -H ldapi:// -s test uid=test1,ou=realdb,dc=example,dc=org slapd's log (LDAPI and SASL/EXTERNAL maps local user to rootdn): 58d03e84 conn=1000 fd=15 ACCEPT from PATH=/home/michael/Proj/slapd_sockd/examples/openldap/ldapi (PATH=/home/michael/Proj/slapd_sockd/examples/openldap/ldapi) 58d03e84 conn=1000 op=0 BIND dn="" method=163 58d03e84 conn=1000 op=0 BIND authcid="gidNumber=100+uidNumber=1000,cn=peercred,cn=external,cn=auth" authzid="gidNumber=100+uidNumber=1000,cn=peercred,cn=external,cn=auth" 58d03e84 conn=1000 op=0 BIND dn="cn=root,ou=realdb,dc=example,dc=org" mech=EXTERNAL sasl_ssf=0 ssf=71 58d03e84 conn=1000 op=0 RESULT tag=97 err=0 text= 58d03e84 conn=1000 op=1 EXT oid=1.3.6.1.4.1.4203.1.11.1 58d03e84 conn=1000 op=1 PASSMOD id="uid=test1,ou=realdb,dc=example,dc=org" new 58d03e84 sock search reading line (CONTINUE ) 58d03e84 conn=1000 op=1 RESULT oid= err=0 text= 58d03e84 conn=1000 op=2 UNBIND 58d03e84 conn=1000 fd=15 closed The log of my external listener: 2017-03-20 21:41:40,620 DEBUG 140544537579816 ----- incoming request via 'openldap/sockoverlay-listener' from pid=28285 uid=1000 gid=100 ----- 2017-03-20 21:41:40,620 DEBUG 140544537579816 request_data='MODIFY\nmsgid: 2\nbinddn: cn=root,ou=realdb,dc=example,dc=org\npeername: PATH=/home/michael/Proj/slapd_sockd/examples/openldap/ldapi\nssf: 71\nconnid: 1000\nsuffix: ou=realdb,dc=example,dc=org\ndn: uid=test1,ou=realdb,dc=example,dc=org\nreplace: userPassword\nuserPassword:: dGVzdA==\n-\n\n' 2017-03-20 21:41:40,620 DEBUG 140544537579816 reqtype='MODIFY' 2017-03-20 21:41:40,620 DEBUG 140544537579816 sock_req=<slapdsock.message.MODIFYRequest object at 0x7fd3133f10d0> // {'dn': 'uid=test1,ou=realdb,dc=example,dc=org', 'binddn': u'cn=root,ou=realdb,dc=example,dc=org', 'connid': 1000, 'suffix': u'ou=realdb,dc=example,dc=org', '_linecount': 7, 'msgid': 2, '_req_lines': ['MODIFY', 'msgid: 2', 'binddn: cn=root,ou=realdb,dc=example,dc=org', 'peername: PATH=/home/michael/Proj/slapd_sockd/examples/openldap/ldapi', 'ssf: 71', 'connid: 1000', 'suffix: ou=realdb,dc=example,dc=org', 'dn: uid=test1,ou=realdb,dc=example,dc=org', 'changetype: modify', 'replace: userPassword', 'userPassword:: dGVzdA==', '-', '', ''], 'peername': u'PATH=/home/michael/Proj/slapd_sockd/examples/openldap/ldapi', 'modops': [(2, 'userPassword', ['test'])], 'reqtype': 'MODIFY', 'ssf': 71} 2017-03-20 21:41:40,620 DEBUG 140544537579816 connid=1000 msgid=2 Request not cached: cache_key=None 2017-03-20 21:41:40,620 DEBUG 140544537579816 connid=1000 msgid=2 response_str='CONTINUE\n' 2017-03-20 21:41:40,620 DEBUG 140544537579816 connid=1000 msgid=2 response_delay=0.001 So far so good. But with this command (own password change) there's no MODIFY sent to the extenal listener at all: $ ldappasswd -H ldapi://%2Fhome%2Fmichael%2FProj%2Fslapd_sockd%2Fexamples%2Fopenldap%2Fldapi -D "uid=test1,ou=realdb,dc=example,dc=org" -w test -s test23 uid=test1,ou=realdb,dc=example,dc=org ldap_parse_extended_result: Bad parameter to an ldap routine (-9) slapd's log: 58d03f05 conn=1003 fd=15 ACCEPT from PATH=/home/michael/Proj/slapd_sockd/examples/openldap/ldapi (PATH=/home/michael/Proj/slapd_sockd/examples/openldap/ldapi) 58d03f05 conn=1003 op=0 BIND dn="uid=test1,ou=realdb,dc=example,dc=org" method=128 58d03f05 conn=1003 op=0 BIND dn="uid=test1,ou=realdb,dc=example,dc=org" mech=SIMPLE ssf=0 58d03f05 conn=1003 op=0 RESULT tag=97 err=0 text= 58d03f05 conn=1003 op=1 EXT oid=1.3.6.1.4.1.4203.1.11.1 58d03f05 conn=1003 op=1 PASSMOD id="uid=test1,ou=realdb,dc=example,dc=org" new 58d03f05 conn=1003 op=1 RESULT tag=103 err=50 text= 58d03f05 conn=1003 op=1 RESULT oid= err=50 text= 58d03f05 conn=1003 op=2 UNBIND 58d03f05 conn=1003 fd=15 closed Any clue what's going on? Ciao, Michael.

1 1

slapd-sock as overlay, internal modifications
by Michael Ströder 20 Mar '17

20 Mar '17

HI! I'd like to intercept password changes (clear-text password) via back-sock used as overlay: # send all modify requests to external listener (after ppolicy checking) overlay sock extensions binddn peername ssf connid socketpath /tmp/noop-listener sockops modify What seems odd is that internal modifications done by slapo-lastbind have binddn: uid=bccb,cn=test,ou=ae-dir like the bound user and same connid (see log excerpt attached below). Shouldn't internal write operations set another binddn (e.g. to the rootdn)? Ciao, Michael. My listeners log: 2017-03-20 19:13:35,000 DEBUG 140308582867240 ----- incoming request via '/tmp/noop-listener' from pid=21348 uid=1000 gid=100 ----- 2017-03-20 19:13:35,000 DEBUG 140308582867240 request_data='MODIFY\nmsgid: 1\nbinddn: uid=bccb,cn=test,ou=ae-dir\nsuffix: ou=ae-dir\ndn: uid=bccb,cn=test,ou=ae-dir\nreplace: authTimestamp\nauthTimestamp: 20170320181334Z\n-\n\n' 2017-03-20 19:13:35,000 DEBUG 140308582867240 reqtype='MODIFY' 2017-03-20 19:13:35,000 DEBUG 140308582867240 sock_req=<slapdsock.message.MODIFYRequest object at 0x7f9c233fe250> // {'dn': 'uid=bccb,cn=test,ou=ae-dir', 'binddn': u'uid=bccb,cn=test,ou=ae-dir', 'suffix': u'ou=ae-dir', '_linecount': 4, 'msgid': 1, '_req_lines': ['MODIFY', 'msgid: 1', 'binddn: uid=bccb,cn=test,ou=ae-dir', 'suffix: ou=ae-dir', 'dn: uid=bccb,cn=test,ou=ae-dir', 'changetype: modify', 'replace: authTimestamp', 'authTimestamp: 20170320181334Z', '-', '', ''], 'modops': [(2, 'authTimestamp', ['20170320181334Z'])], 'reqtype': 'MODIFY'} 2017-03-20 19:13:35,001 DEBUG 140308582867240 msgid=1 Request not cached: cache_key=None 2017-03-20 19:13:35,001 DEBUG 140308582867240 msgid=1 response_str='CONTINUE\n' 2017-03-20 19:13:35,001 DEBUG 140308582867240 msgid=1 response_delay=0.001

1 0

[LMDB] getting MDB_CORRUPTED when deleting within a DUPSORT database
by Klaus Malorny 20 Mar '17

20 Mar '17

Hi, I am using version 0.9.20 on Linux (Ubuntu derivates, uname see [1], [2]). One of the databases is used as an index to another database and thus has been created using the MDB_DUPSORT. Running my software in a test environment, about 33 million entries were generated in this database. In order to falsify a suspicion that my software would not perform housekeeping correctly, I copied the LMDB file to my workstation and forced my software to delete all "legal" entries in order to see whether any entries remain. Unfortunately, I got an MDB_CORRUPTED during the delete operation on that database. Some more details: The deletion takes place in multiple steps, calling a function that deletes ranges in databases multiple times. The code is as follows (leaving some boilerplate code away): unsigned int dbFlags; int error = mdb_dbi_flags (txn, dbi, &dbFlags); // [...] bool isDupSort = dbFlags & MDB_DUPSORT; error = mdb_cursor_open (txn, dbi, &cursor); // [...] error = mdb_cursor_get (cursor, &ckey, &cdata, MDB_SET_RANGE); while (error != MDB_NOTFOUND) { // [...] int compResult = mdb_cmp (txn, dbi, &ckey, &ekey); if (compResult > 0 || !compResult && !endIsInclusive) break; error = mdb_cursor_del (cursor, isDupSort ? MDB_NODUPDATA : 0); // [...] error = mdb_cursor_get (cursor, &ckey, &cdata, MDB_NEXT); } mdb_cursor_close (cursor); Is this the correct way to delete the data? The MDB_CORRUPTED error occurs in the mdb_cursor_del call. Other operations on that specific database are mdb_put (with no flags) and mdb_del, supplying both key and data. One side observation: In a similar test with a lower number of entries, the database was completely emptied. However, the mdb_stat function still reported a larger number of entries for the database (5-6 digit figures). I also use the stat data to estimate the size of the database by adding all page counts and multiplying it by the page size. This puzzles me, as it is lower than I expected (it is roughly the net size of only the data part of the entries). I guess that the provided information might not be sufficient to find the problem. What additional information would be helpful? How can I test whether the database is already corrupt at the start of the deletion or whether it becomes corrupt during the deletion (I guess the latter)? Shall I attempt to write a specific test case? While I could produce the error a second time with running my software from scratch, but I don't know to which extent the data pattern affects the problem and whether I can artificially reproduce this pattern. Regards, Klaus [1] Linux aaa 4.4.0-65-generic #86-Ubuntu SMP Thu Feb 23 17:49:58 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux [2] Linux bbb 4.8.0-42-generic #45-Ubuntu SMP Wed Mar 8 20:06:06 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux

1 1

no TLS 1.2 after changing certificate
by Norbert Gomes 17 Mar '17

17 Mar '17

Hi I need to change my certificate on a Openldap server (Debian Wheezy with the latest updates (slapd-2.4.31-2+deb7u2) but I'm facing a strange problem using ldaps protocol : With the old certificate, I can use TLS 1.2 Cipher, but with the new one, the TLS 1.2 is not possible I use this nmap command to see what ciphers are proposed : nmap --script ssl-enum-ciphers -p 636 <fqdn> When using the command with the old certificate, the following cipher appears (with also a TLSv1.1 cipher) : | TLSv1.2: | ciphers: | TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C | TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A | TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A | TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A | TLS_RSA_WITH_AES_256_CBC_SHA256 (rsa 2048) - A | TLS_RSA_WITH_CAMELLIA_128_CBC_SHA (rsa 2048) - A | TLS_RSA_WITH_CAMELLIA_256_CBC_SHA (rsa 2048) - A | TLS_RSA_WITH_RC4_128_MD5 (rsa 2048) - A | TLS_RSA_WITH_RC4_128_SHA (rsa 2048) - A | compressors: | NULL | cipher preference: client But when doing the same command, on the same server, with only the certificate files modified, I do not have the TLSv1.2 cipher. And no other configuration change is made on the slapd.conf file. The certificates doesn't contain the cipher instructions, so I don't understand why I have this behavior. Any ideas ? Regards Norbert Gomes

1 1

Re: Antw: Re: synrepl error 69
by Quanah Gibson-Mount 16 Mar '17

16 Mar '17

--On Thursday, March 16, 2017 9:08 AM +0100 Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de> wrote: >> It may also indicate that the >> schema between the master and replica do not match. > Can you explain? See above. Without knowledge of the schema on both servers, nor the knowledge of what the entry looked like on the master pre-modification and the entry on the replica as it exists, and what the entry is now, everything is all speculation. The fact the master accepted the operation would generally indicate that there is a serious mismatch in some way between the master and the replica. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: ldapsearch - unexpected behavior with "-h URI -p PORT"
by Quanah Gibson-Mount 16 Mar '17

16 Mar '17

--On Thursday, March 16, 2017 8:29 AM +0900 Alexandre Rosenberg <alex(a)r42.ch> wrote: > Hello, > > I run into some unexpected behavior using ldapsearch today and believe it > is a bug. It all started with following command: Hi Alex, This definitely appears to be a bug. Please open an ITS at http://www.openldap.org/its/ Thanks! --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

ldapsearch - unexpected behavior with "-h URI -p PORT"
by Alexandre Rosenberg 15 Mar '17

15 Mar '17

Hello, I run into some unexpected behavior using ldapsearch today and believe it is a bug. It all started with following command: ldapsearch -x -LLL -h ldap://localhost -p 10636 -b ${BASEDN} \ uid=${USER} -D ${BINDINGUSER} -W After checking the man page, it became clear that: 1. '-h' should take a *hostname* as argument (not "ldap://...") 2. Using '-H' (+ URI) is recommended instead of '-h'/'-p' And sure enough following command works as expected: ldapsearch -x -LLL -H ldap://localhost:10636 (...) The actual issue is what happens when running the fist command. - The "-h" option takes a hostname. As "ldap://localhost" is *not* a valid hostname, I would expect the command the fail - What happens instead is that ldapsearch connect to localhost on port 389 (!) $ ldapsearch -x -d 255 -h ldap://localhost -p 10389 ldap_create ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP localhost:389 Note this *only* happens when both '-h' and '-p' are used. When only '-h' is used, following happens which seem fine: $ ldapsearch -x -d 255 -h ldap://localhost ldap_create ldap_url_parse_ext(ldap://ldap:%2F%2Flocalhost) ldap_err2string Could not create LDAP session handle for URI=ldap://ldap: %2F%2Flocalhost (-9): Bad parameter to an ldap routine Bellow are some more example: 1. $ ldapsearch -x -d 255 -h example.org -p 10636 -> Connects to example.org on port 10636 (as expected) 2. $ ldapsearch -x -d 255 -h /example.org -p 10636 -> Connects to localhost on port 389 (!) - note the added "/" 3. $ ldapsearch -x -d 255 -h /example.org -> Fails as "/example.org" is not resolvable (as expected) Running the command will give you the debug output (which I omitted here). Note I am using openldap 2.4.44. I hope the explanation is clear. The behavior must definitely looks like a bug to me and got me very confused. Best, Alex

1 0

Re: synrepl error 69
by Quanah Gibson-Mount 15 Mar '17

15 Mar '17

--On Wednesday, March 15, 2017 2:17 PM +0100 Sami <s.aitalioulahcen(a)cnrst.ma> wrote: > Hello Openldap community, > > I have an openldap syncrepl consumer that started producing this error: > > Mar 15 11:52:47 ldap-replic.domain.local slapd[27770]: syncrepl_entry: > rid=xxx be_add uid=xxxxx,ou=myou,dc=domain,dc=xx failed (69) > Mar 15 11:52:47 ldap-replic.domain.local slapd[27770]: do_syncrepl: > rid=xxx rc 69 retrying decimal 69 is hex 45. Hex 45 is: LDAP_NO_OBJECT_CLASS_MODS which is: Indicates that the modify operation attempted to modify the structure rules of an object class. Generally, it sounds like you're attempting to change the structural makeup of the object in question (say, changing from an "inetOrgPerson" to an "account" or similar action). It may also indicate that the schema between the master and replica do not match. Hope that helps! Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

synrepl error 69
by Sami 15 Mar '17

15 Mar '17

Hello Openldap community, I have an openldap syncrepl consumer that started producing this error: Mar 15 11:52:47 ldap-replic.domain.local slapd[27770]: syncrepl_entry: rid=xxx be_add uid=xxxxx,ou=myou,dc=domain,dc=xx failed (69) Mar 15 11:52:47 ldap-replic.domain.local slapd[27770]: do_syncrepl: rid=xxx rc 69 retrying I have a simple provider/consumer replication configured: olcSyncrepl: {0}rid=xxx provider=ldap://<provider>:389 bindmethod=simple b inddn="uid=<replicator>,ou=myou,dc=domain,dc=xx" credentials=secret se archbase="dc=domain,dc=xx" scope=sub schemachecking=on type=refreshAndPersis t retry="5 10 300 +" I couldn't find the error code on search engines. I'd like to know the possible causes/solutions to this. Thank you !

1 0

Re: unique values
by Howard Chu 07 Mar '17

07 Mar '17

Quanah Gibson-Mount wrote: > --On Monday, March 06, 2017 4:37 PM +0100 "A. Schulze" <sca(a)andreasschulze.de> > wrote: > >> >> Hello, >> >> while planning a data scheme update we found it handy to have a unique >> value for each entry. >> short time later we found "entryUUID" :-) >> But we are still unsure.Should we simply use entryUUID or should we >> extend our schema >> to hold a new attribute similar to entryUUID. >> > > entryUUID is defined in RFC4530, as an internal LDAP attribute. Personally, if > you need a UUID for tracking, I would create your own specific to your > application/needs. For example, when I was at Stanford, we used suRegID > (stanford university registry ID) and when I was at zimbra, we used zimbraID > (zimbra identifier). There have been format changes in the past that required > wiping out some of the generated attributes when going between releases. This is bad advice. If you actually want a UUID then use entryUUID. As noted, it is defined in RFC4530 which means it isn't going to change. The format of UUIDs is well-established in internet standards. When an existing attribute has *exactly* the syntax and semantics that you want, use it. suRegID and zimbraID are not UUIDs are they? > Using your own identifier ensures that will not be an issue. Also, if you do > things like allow backing up/restoring user entries that have gotten deleted, > a restored entry (depending on the method use) may end up with a new entryUUID. Yes, you should only use the recommended backup procedures. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

3 2

dds overlay on mirrored master
by Dirk Kastens 07 Mar '17

07 Mar '17

Hi, I'm running a mirrored master server and several read-only replicas. Now I want to deal with dynamic objects, so I enabled the dds overlay. Because the config is mirrored, the dds-state is TRUE on both master servers. In my syncrepl statement I set schemachecking=off and exattrs=entryTtl,entryExpireTimestamp. The replication of dynamic objects is working. My question is: will there be a conflict when both master servers are trying to delete expired objects at the same time? What's the best way to configure the dds overlay on a mirrored master? Thanks in advance. Dirk

1 0

Re: Syncrepl losing connection
by Quanah Gibson-Mount 07 Mar '17

07 Mar '17

--On Thursday, March 02, 2017 1:08 PM +0200 Nick Milas <nick(a)eurobjects.com> wrote: > Since "only some systems support the customization of these values; the > keepalive parameter is ignored otherwise", how can I make sure that this > parameter has been configured successfully and is enabled on my system > (CentOS 7)? I enabled "loglevel config stats sync"but I don't see any > mention of configured syncrepl parameters during OpenLDAP start. Hi Nick, The keepalive parameter was added after the initial 2.4 release, and after the current sections on replication in the admin guide were written. It was created because I kept encountering issues at customer sites where load balancers & packet shapers were closing the syncrepl connection. I use the following: keepalive=240:10:30 The 240 because most of the hardware causing problems used a 5 minute timeout, so 240 was nicely under that. If setting this resolves your problem, then you have something in your network monitoring and severing connections. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: unique values
by Quanah Gibson-Mount 06 Mar '17

06 Mar '17

--On Monday, March 06, 2017 4:37 PM +0100 "A. Schulze" <sca(a)andreasschulze.de> wrote: > > Hello, > > while planning a data scheme update we found it handy to have a unique > value for each entry. > short time later we found "entryUUID" :-) > But we are still unsure.Should we simply use entryUUID or should we > extend our schema > to hold a new attribute similar to entryUUID. > entryUUID is defined in RFC4530, as an internal LDAP attribute. Personally, if you need a UUID for tracking, I would create your own specific to your application/needs. For example, when I was at Stanford, we used suRegID (stanford university registry ID) and when I was at zimbra, we used zimbraID (zimbra identifier). There have been format changes in the past that required wiping out some of the generated attributes when going between releases. Using your own identifier ensures that will not be an issue. Also, if you do things like allow backing up/restoring user entries that have gotten deleted, a restored entry (depending on the method use) may end up with a new entryUUID. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: 2.4.44 + ITS 8432 patch segfault in modify_add_values
by Quanah Gibson-Mount 06 Mar '17

06 Mar '17

--On Saturday, March 04, 2017 6:39 PM -0800 "Paul B. Henson" <henson(a)acm.org> wrote: > It seems like this has something to do with duplicated operations? The > first time this operation was applied, the eduPersonAffiliation > attribute did exist, with a single value that was removed. Then for some > reason it's like it tried to remove it again and went boom? But there > was no operation that *actually* failed. Everything that the client > tried to do was done. > > BTW, I opened the ITS for tracking, it's #8609. Thanks... Great, thanks! Trying to get to a point where I can focus working on this. Can you follow up to the ITS with the notes about the method being used by your perl script to do the deletes as well as the link to the schema? Just so it's all in one spot :) --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

unique values
by A. Schulze 06 Mar '17

06 Mar '17

Hello, while planning a data scheme update we found it handy to have a unique value for each entry. short time later we found "entryUUID" :-) But we are still unsure.Should we simply use entryUUID or should we extend our schema to hold a new attribute similar to entryUUID. so what are the pros and cons on using entryUUID for a second purpose? + entryUUID is implicit available for each and every entry + automatically generated + saved as part of our backup using slapcat - what happen on a complete disaster restore? will the entryUUID values remain if we build a new server from a slapcat backup? - a separate but similar attribute has to be defined is there a suggested schema? "grep -ri uuid /path/to/openldap-source/servers/slapd/schema/" did not disclose the definition of entryUUID. It's somehow defined in servers/slapd/schema_prep.c - a separate but similar attribute has to be written while creating a new entry could that be automated somehow? - what is 'NO-USER-MODIFICATION' in a schema definition and what are the implications if I define an attribute as NO-USER-MODIFICATION? Do you have any thoughts or suggestions on this? A quick search in the list-archive didn't helped me to answer my questions. Thanks, Andreas

1 0

Re: 2.4.44 + ITS 8432 patch segfault in modify_add_values
by Quanah Gibson-Mount 05 Mar '17

05 Mar '17

--On Wednesday, February 15, 2017 6:36 PM -0800 "Paul B. Henson" <henson(a)acm.org> wrote: > On Wed, Feb 15, 2017 at 12:22:29PM -0800, Quanah Gibson-Mount wrote: > >> I would suggest filing an ITS with the full backtrace info, so I can >> track it. > > Ok, will do. > >> It could be useful to have the entry data from the accesslog as >> well for the failed replication op, as we can see the failed entry DN in >> the output of your backtrace. > > That would be in the accesslog on the server that crashed? Hmm, the > server that crashed is the master, and all updates were going to it. Am > I confused, or did the update that caused the crash come in via syncrepl > though, and hence originate from a different server? So the accesslog > entry you want would be from that server, not the server that crashed? > But given no other servers should have been receiving updates, how would > an update have been received via replication? Or is this another issue > like the memberOf problem where updates are being improperly replicated? It appears to be crashing while writing the change to the accesslog database. It's odd that the value for the attribute is NULL. Do we know for sure what the client doing the write op to the server is sending? > Hmm, looking at the logs that correspond with one of the crashes: > This operation appears to succeed? Then there's this: > > Feb 14 04:00:13 fosse slapd[12524]: conn=37859 op=806 MOD > dn="uid=vntruong,ou=user,dc=csupomona,dc=edu" Feb 14 04:00:13 fosse > slapd[12524]: conn=37859 op=806 MOD attr=csupomonaEduPersonExpiration Yeah, so this is the operation that actually failed... It'd be interesting to know if it succeeded in the primary DB, but failed when writing to the accesslog DB (I.e., the master and its consumers are now out of sync for that entry), or if the entire write op failed (master and consumers are in sync for the entry) > when I restarted the server. I guess I am confused; the entryCSN has > serverID 0, the ID of this server, so this isn't a replicated op, it's > an op from this server. So why does the backtrace show the change coming > in via syncrepl? It seems like it's getting applied twice. The change is > deleting the attribute, so the second time it's getting applied you > would get a no such attribute error... Hm, so I guess my question would be is it doing the op like this: dn: ... changetype: modify replace: csupomonaEduPersonExpiration csupomonaEduPersonExpiration: Or is it doing it like this: dn: ... changetype: modify delete: csupomonaEduPersonExpiration Because the NULL value seems to imply the former. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

3 4

Re: How correctly convert ldif dump size to mdb olcDbMaxSize value
by Quanah Gibson-Mount 04 Mar '17

04 Mar '17

--On Tuesday, February 28, 2017 2:48 PM +0300 Ikonta <ikonta(a)yandex.ru> wrote: > Hi everybody, > > I use simple OpenLDAP installation (two servers in mirror mode, something > above 30000 leafs tree). Some time ago I've migrated it to mdb backend. > > The database dump in ldif weight about 300M. > Initially I've set olcDbMaxSize to 2147483648 bytes (2G). > Imported into directory it became about 450M data.mdb on node1 and after > mirror synced — 1.5G replicated data.mdb on node2. Why instances > database sizes are so different? > > Am I right guessing olcDbMaxSize is maximum size of data.mdb file? > And how should I, starting with present and perspective ldif dump size, > count proper value of olcDbMaxSize? For example, if I expect ldif dump > may grow up to 500 M? Generally, you just set it to something *very large*. I usually go with 80GB. You're not supposed to try and keep it down to a small value that's "near" the actual DB size. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Long ldap session when ldap server failover
by Quanah Gibson-Mount 02 Mar '17

02 Mar '17

--On Friday, February 24, 2017 7:27 AM +0000 Huynh Phuoc Tai <fucai1116(a)yahoo.com> wrote: > > > Hi, > > > I have an issue with long ldap session when ldap server failover. > [01/Dec/2016:11:40:01 +0100] conn=7187095 op=4 msgId=5 - UNBIND > [01/Dec/2016:11:40:01 +0100] conn=7187095 op=4 msgId=-1 - closing from > 10.14.97.45:55287 - U1 - Connection closed by unbind client - > [01/Dec/2016:11:40:01 +0100] conn=7187095 op=-1 msgId=-1 - closed. > > > > The openldap client didn't send UNBIND soon but sent after several > minutes. Could you suggest me any way forward to find the root cause? > openldap2-client-2.4.26-0.62.2 Well, it shows that the LDAP client didn't unbind until after 5 minutes. We have no idea *what* that client is, only you do. What is "cn=ProxyUser,ou=proxyagent,ou=com,dc=jerarm,dc=roma,dc=te,dc=com"? Are you sure it's an *openldap* client or is it something else? --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: Syncrepl losing connection
by Quanah Gibson-Mount 02 Mar '17

02 Mar '17

--On Thursday, March 02, 2017 7:59 AM -0800 Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Thursday, March 02, 2017 1:08 PM +0200 Nick Milas > <nick(a)eurobjects.com> wrote: > > >> Since "only some systems support the customization of these values; the >> keepalive parameter is ignored otherwise", how can I make sure that this >> parameter has been configured successfully and is enabled on my system >> (CentOS 7)? I enabled "loglevel config stats sync"but I don't see any >> mention of configured syncrepl parameters during OpenLDAP start. > > Hi Nick, > > The keepalive parameter was added after the initial 2.4 release, and > after the current sections on replication in the admin guide were > written. It was created because I kept encountering issues at customer > sites where load balancers & packet shapers were closing the syncrepl > connection. Oh, and to answer your other question -- "keepalive" works on linux, but not necessarily other *nixes or Windows. So CentOS7 would be fine. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Syncrepl losing connection
by Quanah Gibson-Mount 02 Mar '17

02 Mar '17

--On Wednesday, March 01, 2017 8:48 AM +0200 Nick Milas <nick(a)eurobjects.com> wrote: > Hello, > > I have recently installed two syncrepl consumers using 2.4.44 on CentOS 7 > using LTB rpm packages. > > I am almost daily facing issues with consumers losing connection to the > master. I always have to restart the consumer in order to re-establish > connection. > > Note 1: These two consumers have replaced two older ones running 2.4.39 > LTB (and earlier versions) on CentOS 5 without any such issues. > > Note 2: Master is using 2.4.44 version as well (but on CentOS 5). > > Is this a known bug or I need to change/add something in the config when > using this OpenLDAP version so that the problem gets resolved? Have you tried setting the "keepalive" parameter in your syncrepl configs? --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: RE24 testing call (2.4.45) LMDB RE0.9 testing call (0.9.20)
by Quanah Gibson-Mount 02 Mar '17

02 Mar '17

--On Tuesday, February 14, 2017 5:04 PM -0800 "Paul B. Henson" <henson(a)acm.org> wrote: > On Tue, Feb 14, 2017 at 04:13:17PM -0800, Quanah Gibson-Mount wrote: > >> I have a test setup from a coworker who managed to trigger this to >> examine and see if I can push it into the test script. :) > > Cool, good to hear; it will be nice to track this down and quash it. I > don't know what it is about my environment that triggers it so often, > perhaps because we add/remove group members frequently. Hi Paul, In the ITS, you didn't provide your configuration -- I'm curious to see the order in which you load the overlays. In the initial report from Mark, he loads them in this order (on the primary data db): dynlist memberof syncprov accesslog So I'd like to know the order in which your overlays are loaded. Thanks, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

3 2

Re: 2.4.44 + ITS 8432 patch segfault in modify_add_values
by Quanah Gibson-Mount 01 Mar '17

01 Mar '17

--On Wednesday, February 22, 2017 7:29 PM -0800 "Paul B. Henson" <henson(a)acm.org> wrote: > On Mon, Feb 20, 2017 at 04:30:00PM -0800, Quanah Gibson-Mount wrote: > >> Ok, I can see if I can reproduce something like this. Do you have a >> link to the schema file in use that adds this attribute? > > https://spaces.internet2.edu/display/macedir/OpenLDAP+eduPerson Great, thanks. I want to look at the attribute rules. :) See if I can reproduce the crash in some way. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: RE24 testing call (2.4.45) LMDB RE0.9 testing call (0.9.20)
by Quanah Gibson-Mount 01 Mar '17

01 Mar '17

--On Wednesday, February 22, 2017 7:21 PM -0800 "Paul B. Henson" <henson(a)acm.org> wrote: > On Tue, Feb 21, 2017 at 01:14:58PM -0800, Quanah Gibson-Mount wrote: > >> So I'd like to know the order in which your overlays are loaded. > > First there's > > database mdb > suffix cn=accesslog > overlay syncprov > > Then > > database mdb > suffix "dc=cpp,dc=edu" > overlay memberof > overlay syncprov > overlay accesslog > > > I don't recall ever seeing a requirement for a specific ordering of the > overlays. Should it matter? no. Can it matter? Maybe. I always load up syncprov first, accesslog second, anything else after that. It would be curious if reordering had any effect. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Syncrepl losing connection
by Nick Milas 01 Mar '17

01 Mar '17

Hello, I have recently installed two syncrepl consumers using 2.4.44 on CentOS 7 using LTB rpm packages. I am almost daily facing issues with consumers losing connection to the master. I always have to restart the consumer in order to re-establish connection. Note 1: These two consumers have replaced two older ones running 2.4.39 LTB (and earlier versions) on CentOS 5 without any such issues. Note 2: Master is using 2.4.44 version as well (but on CentOS 5). Is this a known bug or I need to change/add something in the config when using this OpenLDAP version so that the problem gets resolved? Below follows a log example from one of them (it includes my restart to re-establish connection): OpenLDAP Log excerpt: =========================================================================== Feb 28 16:19:20 vdns slapd[10375]: do_syncrep2: rid=353 LDAP_RES_INTERMEDIATE - REFRESH_DELETE Feb 28 16:19:20 vdns slapd[10375]: do_syncrep2: rid=353 cookie=rid=353,csn=20170228140139.002723Z#000000#000#000000 Feb 28 16:19:20 vdns slapd[10375]: slap_queue_csn: queueing 0x7f9314225d90 20170228140139.002723Z#000000#000#000000 Feb 28 16:19:20 vdns slapd[10375]: slap_graduate_commit_csn: removing 0x7f9314225d90 20170228140139.002723Z#000000#000#000000 Feb 28 16:19:21 vdns slapd[10380]: [OK] OpenLDAP started Feb 28 18:19:23 vdns slapd[10375]: do_syncrep2: rid=353 (-1) Can't contact LDAP server Feb 28 18:19:23 vdns slapd[10375]: do_syncrepl: rid=353 rc -1 retrying (14 retries left) Feb 28 18:20:23 vdns slapd[10375]: do_syncrep2: rid=353 LDAP_RES_INTERMEDIATE - REFRESH_DELETE Feb 28 20:20:37 vdns slapd[10375]: do_syncrep2: rid=353 (-1) Can't contact LDAP server Feb 28 20:20:37 vdns slapd[10375]: do_syncrepl: rid=353 rc -1 retrying (14 retries left) Feb 28 20:21:37 vdns slapd[10375]: do_syncrep2: rid=353 LDAP_RES_INTERMEDIATE - REFRESH_DELETE Feb 28 22:21:52 vdns slapd[10375]: do_syncrep2: rid=353 (-1) Can't contact LDAP server Feb 28 22:21:52 vdns slapd[10375]: do_syncrepl: rid=353 rc -1 retrying (14 retries left) Feb 28 22:22:52 vdns slapd[10375]: do_syncrep2: rid=353 LDAP_RES_INTERMEDIATE - REFRESH_DELETE Mar 1 00:23:06 vdns slapd[10375]: do_syncrep2: rid=353 (-1) Can't contact LDAP server Mar 1 00:23:06 vdns slapd[10375]: do_syncrepl: rid=353 rc -1 retrying (14 retries left) Mar 1 00:24:06 vdns slapd[10375]: do_syncrep2: rid=353 LDAP_RES_INTERMEDIATE - REFRESH_DELETE Mar 1 02:24:21 vdns slapd[10375]: do_syncrep2: rid=353 (-1) Can't contact LDAP server Mar 1 02:24:21 vdns slapd[10375]: do_syncrepl: rid=353 rc -1 retrying (14 retries left) Mar 1 02:25:21 vdns slapd[10375]: do_syncrep2: rid=353 LDAP_RES_INTERMEDIATE - REFRESH_DELETE Mar 1 04:25:35 vdns slapd[10375]: do_syncrep2: rid=353 (-1) Can't contact LDAP server Mar 1 04:25:35 vdns slapd[10375]: do_syncrepl: rid=353 rc -1 retrying (14 retries left) Mar 1 04:26:35 vdns slapd[10375]: do_syncrep2: rid=353 LDAP_RES_INTERMEDIATE - REFRESH_DELETE Mar 1 06:26:50 vdns slapd[10375]: do_syncrep2: rid=353 (-1) Can't contact LDAP server Mar 1 06:26:50 vdns slapd[10375]: do_syncrepl: rid=353 rc -1 retrying (14 retries left) Mar 1 06:27:50 vdns slapd[10375]: do_syncrep2: rid=353 LDAP_RES_INTERMEDIATE - REFRESH_DELETE Mar 1 08:17:54 vdns slapd[18585]: [INFO] Using /etc/default/slapd for configuration Mar 1 08:17:54 vdns slapd[18590]: [INFO] Halting OpenLDAP... Mar 1 08:17:54 vdns slapd[10375]: daemon: shutdown requested and initiated. Mar 1 08:17:54 vdns slapd[10375]: slapd shutdown: waiting for 1 operations/tasks to finish Mar 1 08:17:54 vdns slapd[10375]: slapd stopped. Mar 1 08:17:55 vdns slapd[18594]: [OK] OpenLDAP stopped after 1 seconds Mar 1 08:17:55 vdns slapd[18595]: [INFO] No data backup done Mar 1 08:17:55 vdns slapd[18607]: [INFO] Using /etc/default/slapd for configuration Mar 1 08:17:55 vdns slapd[18612]: [INFO] Launching OpenLDAP configuration test... Mar 1 08:17:56 vdns slapd[18626]: [OK] OpenLDAP configuration test successful Mar 1 08:17:56 vdns slapd[18637]: [INFO] No db_recover done Mar 1 08:17:56 vdns slapd[18638]: [INFO] Launching OpenLDAP... Mar 1 08:17:56 vdns slapd[18639]: [OK] File descriptor limit set to 1024 Mar 1 08:17:56 vdns slapd[18640]: @(#) $OpenLDAP: slapd 2.4.44 (Feb 15 2016 11:14:35) $#012#011clement@centos7.unix.example.com:/home/clement/build/BUILD/openldap-2.4.44/servers/slapd Mar 1 08:17:56 vdns slapd[18641]: slapd starting Mar 1 08:17:56 vdns slapd[18641]: do_syncrep2: rid=353 LDAP_RES_INTERMEDIATE - SYNC_ID_SET Mar 1 08:17:56 vdns slapd[18641]: do_syncrep2: rid=353 LDAP_RES_INTERMEDIATE - REFRESH_DELETE Mar 1 08:17:56 vdns slapd[18641]: do_syncrep2: rid=353 cookie=rid=353,csn=20170301060829.837823Z#000000#000#000000 Mar 1 08:17:56 vdns slapd[18641]: slap_queue_csn: queueing 0x7f33f4225d90 20170301060829.837823Z#000000#000#000000 Mar 1 08:17:56 vdns slapd[18641]: slap_graduate_commit_csn: removing 0x7f33f4225d90 20170301060829.837823Z#000000#000#000000 Mar 1 08:17:57 vdns slapd[18646]: [OK] OpenLDAP started =========================================================================== Configuration on this consumer: =========================================================================== include /usr/local/openldap/etc/openldap/schema/core.schema include /usr/local/openldap/etc/openldap/schema/cosine.schema include /usr/local/openldap/etc/openldap/schema/inetorgperson.schema include /usr/local/openldap/etc/openldap/schema/nis.schema include /usr/local/openldap/etc/openldap/schema/eduperson.schema include /usr/local/openldap/etc/openldap/schema/postfix.schema include /usr/local/openldap/etc/openldap/schema/dyngroup.schema include /usr/local/openldap/etc/openldap/schema/misc.schema include /usr/local/openldap/etc/openldap/schema/ppolicy.schema include /usr/local/openldap/etc/openldap/schema/schac-20090326-1.4.0.schema include /usr/local/openldap/etc/openldap/schema/dnsdomain2.schema include /usr/local/openldap/etc/openldap/schema/proftpd-quota.schema include /usr/local/openldap/etc/openldap/schema/kerberos.schema include /usr/local/openldap/etc/openldap/schema/localemail.schema include /usr/local/openldap/etc/openldap/schema/entryaccess.schema include /usr/local/openldap/etc/openldap/schema/radius.schema pidfile /usr/local/openldap/var/run/slapd.pid argsfile /usr/local/openldap/var/run/slapd.args modulepath /usr/local/openldap/lib64 loglevel sync sizelimit unlimited timelimit unlimited TLSCACertificateFile /usr/local/openldap/etc/openldap/cacerts/DigiCertCA.crt TLSCertificateFile /usr/local/openldap/etc/openldap/cacerts/vdns_noa_gr-1058189.crt TLSCertificateKeyFile /usr/local/openldap/etc/openldap/cacerts/vdns_noa_gr-1058189.key TLSVerifyClient never database mdb suffix "dc=noa,dc=gr" rootdn "cn=Manager,dc=noa,dc=gr" rootpw {SSHA}<SECRET> include /usr/local/openldap/etc/openldap/acl.conf directory /usr/local/openldap/var/mdb maxsize 10737418240 index objectClass eq,pres index cn eq,pres,sub index uid eq,pres index ou eq,pres index owner eq index entryCSN,entryUUID eq index associatedDomain pres,eq,sub index dc eq syncrepl rid=353 provider=ldaps://ldap.noa.gr type=refreshAndPersist tls_reqcert=never retry="60 15 180 +" searchbase="dc=noa,dc=gr" schemachecking=off bindmethod=simple binddn="uid=syncuser,dc=noa,dc=gr" credentials="secret" database monitor access to * by dn.exact="cn=Manager,dc=noa,dc=gr" read by * none =========================================================================== Please let me know of any hint/advice to resolve this issue! Thanks in advance, Nick

1 0

How correctly convert ldif dump size to mdb olcDbMaxSize value
by Ikonta 28 Feb '17

28 Feb '17

Hi everybody, I use simple OpenLDAP installation (two servers in mirror mode, something above 30000 leafs tree). Some time ago I've migrated it to mdb backend. The database dump in ldif weight about 300M. Initially I've set olcDbMaxSize to 2147483648 bytes (2G). Imported into directory it became about 450M data.mdb on node1 and after mirror synced — 1.5G replicated data.mdb on node2. Why instances database sizes are so different? Am I right guessing olcDbMaxSize is maximum size of data.mdb file? And how should I, starting with present and perspective ldif dump size, count proper value of olcDbMaxSize? For example, if I expect ldif dump may grow up to 500 M? WBR

1 0

Dynamic groups/lists
by Saša-Stjepan Bakša 28 Feb '17

28 Feb '17

Hi, I have access to LDAP server which doesn't have any groups defined. All users have only attributes which are used to distinguish to which type of users they belong and for application which I have intention to use groups are necessary. I don't have authority to change that but I can create my own LDAP proxy server and direct my application to it. Question is, can I create dynamic groups which will reside only on that proxy server. I am already familiar with translucent and ordinary proxy servers. Br Sasa

2 2

user removed from ldap group but Linux groups command still shows user as member of the group
by Bernard Fay 24 Feb '17

24 Feb '17

Hi, I removed a user from an LDAP group about a week ago. Today, this user still shows as member of the group with the Linux command groups. Also, the group (Administrators) appears twice in the output of the command id: uid=10000(username) gid=10000(Administrators) groups=10001(users),10005(devel),10011(video),10015(ansible),10000(Administrators) The command getent though shows the proper group assignation: getent group | grep username | cut -d: -f1 users devel video ansible All of those groups are LDAP group. Does someone knows why and would know how to fix this? Thanks,

5 14

Fwd: user removed from ldap group but Linux groups command still shows user as member of the group
by Bernard Fay 24 Feb '17

24 Feb '17

On Fri, Feb 24, 2017 at 9:08 AM, Dan White <dwhite(a)cafedemocracy.org> wrote: > On 02/24/17 08:55 -0500, Bernard Fay wrote: > >> I removed a user from an LDAP group about a week ago. Today, this user >> still shows as member of the group with the Linux command groups. Also, >> the >> group (Administrators) appears twice in the output of the command id: >> uid=10000(username) gid=10000(Administrators) >> groups=10001(users),10005(devel),10011(video),10015(ansible) >> ,10000(Administrators) >> >> The command getent though shows the proper group assignation: >> getent group | grep username | cut -d: -f1 >> users >> devel >> video >> ansible >> >> All of those groups are LDAP group. >> > > Is this from a long running shell? If so, start a new shell or > run newgrp. > > Otherwise, verify that it is not cached (such as with nscd), and trouble > shoot as an nss ldap problem. > > No, it is not from a long running shell. I logged out and logged back in since I remove this user from the group. By the way the group in question is Administrators. How can I verify it is not cached? My guess is that it is cached. I tried to use "nscd -i group" but that did not change anything.

1 0

Long ldap session when ldap server failover
by Huynh Phuoc Tai 24 Feb '17

24 Feb '17

Hi, I have an issue with long ldap session when ldap server failover. [01/Dec/2016:11:34:29 +0100] conn=7187095 op=-1 msgId=-1 - fd=89 slot=89 LDAPS connection from 10.14.97.45:55287 to 113.216.102.167 [01/Dec/2016:11:34:29 +0100] conn=7187095 op=-1 msgId=-1 - SSL 128-bit AES-128; client CN=HRM3; issuer O=E,OU=eOAM,CN=jerarm003NECertCA [01/Dec/2016:11:34:29 +0100] conn=7187095 op=-1 msgId=-1 - SSL failed to map client certificate to LDAP DN (No such object) [01/Dec/2016:11:34:29 +0100] conn=7187095 op=0 msgId=1 - BIND dn="cn=ProxyUser,ou=proxyagent,ou=com,dc=jerarm,dc=roma,dc=te,dc=com" method=128 version=3 [01/Dec/2016:11:34:29 +0100] conn=7187095 op=0 msgId=1 - RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=proxyuser,ou=proxyagent,ou=com,dc=jerarm,dc=roma,dc=te,dc=com" [01/Dec/2016:11:34:29 +0100] conn=7187095 op=1 msgId=2 - SRCH base="dc=jerarm,dc=roma,dc=te,dc=com" scope=2 filter="(&(&(objectClass=posixAccount)(|(eUserAuthenticationScope=HLRALL)(eUserAuthenticationScope=HRM3)(eUserAuthenticationScope=\2a)))(&(objectClass=posixAccount)(|(eUserAuthenticationScope=HLRALL)(eUserAuthenticationScope=HRM3)(eUserAuthenticationScope=\2a)))(uid=us000001))" attrs=ALL [01/Dec/2016:11:34:29 +0100] conn=7187095 op=1 msgId=2 - RESULT err=0 tag=101 nentries=1 etime=0 [01/Dec/2016:11:34:29 +0100] conn=7187095 op=2 msgId=3 - BIND dn="uid=us000001,ou=people,dc=jerarm,dc=roma,dc=te,dc=com" method=128 version=3 [01/Dec/2016:11:34:29 +0100] conn=7187095 op=2 msgId=3 - RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=us000001,ou=people,dc=jerarm,dc=roma,dc=te,dc=com" [01/Dec/2016:11:34:29 +0100] conn=7187095 op=3 msgId=4 - BIND dn="cn=ProxyUser,ou=proxyagent,ou=com,dc=jerarm,dc=roma,dc=te,dc=com" method=128 version=3 [01/Dec/2016:11:34:29 +0100] conn=7187095 op=3 msgId=4 - RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=proxyuser,ou=proxyagent,ou=com,dc=jerarm,dc=roma,dc=te,dc=com" [01/Dec/2016:11:40:01 +0100] conn=7187095 op=4 msgId=5 - UNBIND [01/Dec/2016:11:40:01 +0100] conn=7187095 op=4 msgId=-1 - closing from 10.14.97.45:55287 - U1 - Connection closed by unbind client - [01/Dec/2016:11:40:01 +0100] conn=7187095 op=-1 msgId=-1 - closed. The openldap client didn't send UNBIND soon but sent after several minutes. Could you suggest me any way forward to find the root cause?openldap2-client-2.4.26-0.62.2 Regards,Tai

1 0

Re: 2.4.44 + ITS 8432 patch segfault in modify_add_values
by Quanah Gibson-Mount 23 Feb '17

23 Feb '17

--On Friday, February 17, 2017 2:44 PM -0800 "Paul B. Henson" <henson(a)acm.org> wrote: > On Thu, Feb 16, 2017 at 03:53:40PM -0800, Quanah Gibson-Mount wrote: > >> It appears to be crashing while writing the change to the accesslog >> database. It's odd that the value for the attribute is NULL. Do we >> know for sure what the client doing the write op to the server is >> sending? > > The code is in perl, and looks like this: > > $entry->replace(eduPersonAffiliation => \@eduPersonAffiliation); > > In this case, the array @eduPersonAffiliation is empty, effectively > deleting the attribute. I'm not 100% sure what this generates on the > wire, I'd have to debug it. I can say it's the same code that's been > running for a decade or so with no issues. Ok, I can see if I can reproduce something like this. Do you have a link to the schema file in use that adds this attribute? Also, can you confirm your patch matches <https://github.com/Zimbra/packages/blob/master/thirdparty/openldap/patches/…> Thanks, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: Valgrind detecting memory leak on 2-way multi master setup on RHEL 6 - openldap 2.4.44
by ping-shin ching 22 Feb '17

22 Feb '17

Regarding this issue - our production servers are getting affected. Any help is greatly appreciated. Is there anything I can try? http://www.openldap.org/lists/openldap-technical/201702/msg00090.html Regards, Ping PS: I've lost some of my emails - so don't have the email chain

2 2

Re: 2.4.44 + ITS 8432 patch segfault in modify_add_values
by Quanah Gibson-Mount 21 Feb '17

21 Feb '17

--On Tuesday, February 21, 2017 1:04 PM +0000 Frank Swasey <Frank.Swasey(a)uvm.edu> wrote: > Years ago, I had code that did that and then I got a version of Net::LDAP > that sent null attributes across the wire. Even back then OpenLDAP was > upset by such behavior. I quickly updated my code to check if (in your > case) @eduPersonAffiliation had zero entries and issue a proper > $entry->delete('eduPersonAffiliation') call in that case. I've not had > any issues since. Perhaps, your Net::LDAP module version has changed and > it is sending what is being logged across the wire instead of the delete > you are expecting. Interesting... It would still be good for OpenLDAP to not crash in that case, however. ;) --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: syncrepl skipped entryCSN on openldap-2.4.44 on centos 6
by Quanah Gibson-Mount 21 Feb '17

21 Feb '17

--On Saturday, February 18, 2017 9:57 AM +0800 Daniel Jung <mimianddaniel(a)gmail.com> wrote: >> Do you mean contextCSNs? > No. ContextCSN is up to date. But some entries have old entryCSN compared > to the master. >> >> >>> I haven't been able to track the cause nor see anything in the log to >>> indicate the problem. However, we have had slapd become non-responsive >>> due to IO blocking on logging. Could this cause syncrepl to miss >>> updating the entries? Has anyone seen this behaviour? >> >> >> If slapd gets locked up, hard to say what the side effects could be. >> Do you have stats+sync logging enabled on all of the systems? > I do have stats and sync enabled. Well, theoretically slapd shouldn't lose changes, but it's really hard to know the full ramifications/effects in this scenario. You can file an ITS on the issue, for tracking, but it may be some time before it's investigated in depth, as it's not a common scenario. I guess it may be possible to emulate it by using iptables to drop packages from rsyslogd. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: syncrepl skipped entryCSN on openldap-2.4.44 on centos 6
by Howard Chu 19 Feb '17

19 Feb '17

Daniel Jung wrote: > Hi Quanah, > > Speaking of logging, is openldap-3 going to support udp based logging? I saw > while back that there is improved? syslog code that we can compile in the src. > I was thinking of just adding udp into that code and test it out. I have no plans to add UDP support. Could be done, but what's the benefit? If you want to add it, feel free to submit a patch. > > > On Feb 18, 2017 09:57, "Daniel Jung" <mimianddaniel(a)gmail.com > <mailto:mimianddaniel@gmail.com>> wrote: > > On Feb 18, 2017 05:41, "Quanah Gibson-Mount" <quanah(a)symas.com > <mailto:quanah@symas.com>> wrote: > > > > --On Friday, February 17, 2017 5:46 PM +0800 Daniel Jung > <mimianddaniel(a)gmail.com <mailto:mimianddaniel@gmail.com>> wrote: > > > >> > >> Hi, > >> > >> > >> I see that some entryCSN have not been synced properly with the > >> provider. > >> I run multimaster setup and with several slaves and sometimes i see that > >> some slaves have old entryCSNs and I am syncing them manually with -c > >> option. > > > > > > Do you mean contextCSNs? > No. ContextCSN is up to date. But some entries have old entryCSN compared > to the master. > > > > > >> I haven't been able to track the cause nor see anything in the log to > >> indicate the problem. However, we have had slapd become non-responsive > >> due to IO blocking on logging. Could this cause syncrepl to miss updating > >> the entries? Has anyone seen this behaviour? > > > > > > If slapd gets locked up, hard to say what the side effects could be. Do > you have stats+sync logging enabled on all of the systems? > I do have stats and sync enabled. > > > > --Quanah > > > > > > -- > > > > Quanah Gibson-Mount > > Product Architect > > Symas Corporation > > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > > <http://www.symas.com> > > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

3 2

Re: syncrepl skipped entryCSN on openldap-2.4.44 on centos 6
by Daniel Jung 19 Feb '17

19 Feb '17

On Feb 18, 2017 05:41, "Quanah Gibson-Mount" <quanah(a)symas.com> wrote: > > --On Friday, February 17, 2017 5:46 PM +0800 Daniel Jung < mimianddaniel(a)gmail.com> wrote: > >> >> Hi, >> >> >> I see that some entryCSN have not been synced properly with the >> provider. >> I run multimaster setup and with several slaves and sometimes i see that >> some slaves have old entryCSNs and I am syncing them manually with -c >> option. > > > Do you mean contextCSNs? No. ContextCSN is up to date. But some entries have old entryCSN compared to the master. > > >> I haven't been able to track the cause nor see anything in the log to >> indicate the problem. However, we have had slapd become non-responsive >> due to IO blocking on logging. Could this cause syncrepl to miss updating >> the entries? Has anyone seen this behaviour? > > > If slapd gets locked up, hard to say what the side effects could be. Do you have stats+sync logging enabled on all of the systems? I do have stats and sync enabled. > > --Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

1 1

slapo-rwm How to define order that Rewrite Contexts are processed
by Lowrie, Paul, Vodafone NZ 18 Feb '17

18 Feb '17

Hi I've been asked to configure a SLAPD/LDAP proxy with more than one LDAP Back-End. The users log into the LDAP client using their email address and the proxy uses the domain part of their UID to decide which slapd-ldap back-end to authenticate against. I have the proxy working - with two defined slapd-ldap back-ends. It's tested and works with one back-end at a time. I need rwm to process a rewrite of both the searchFilter and searchDN using a key piece of information identified the searchFilter to decide the searchDN. Original searchDN = "ou=people,ou=my,dc=proxy,dc=com" Original searchFilter="(&(objectClass=posixAccount)(uid=john(a)domain.one.com))" Rewritten searchDN = "ou=people,ou=domain,dc=one,dc=com" Rewritten searchFilter = "(&(objectClass=posixAccount)(uid=john))" I have: dn: olcOverlay={0}rwm,olcDatabase={-1}frontend,cn=config objectClass: olcOverlayConfig objectClass: olcRwmConfig olcOverlay: {0}rwm olcRwmNormalizeMapped: FALSE olcRwmRewrite: {0}rwm-rewriteEngine on # #Unix LDAP authentication requests arrive with these three components: # searchDN: OU=people,DC=my,DC=proxy,DC=com - as defined on the LDAP client # searchFilter: (&(objectClass=posixAccount)(uid=john(a)domain.one.com)) # attributes: userPassword cn gidNumber uidNumber # loginShell objectClass gecos uid homeDirectory # # {1} searchFilter Context: # {2} rewrite john(a)domain.one.com: # Strip @domain.one.com part and set &&target to OU=people,DC=domain,DC=one,DC=com # {3} rewrite jane(a)domain.two.com: # Strip @domain.two.com part and set &&target to OU=people,DC=domain,DC=two,DC=com # {4} searchDN Context: # {5} rewrite OU=people,DC=my,DC=proxy,DC=com the value already defined in &&target # olcRwmRewrite: {1}rwm-rewriteContext SearchFilter # olcRwmRewrite: {2}rwm-rewriteRule "^(.+uid=[^,]+)(a)domain.one.com(,.*)$" "${&&target(\"ou=people,dc=domain,dc=one,dc=com\")}$1$2" ":" # olcRwmRewrite: {3}rwm-rewriteRule "^(.+uid=[^,]+)(a)domain.two.com(,.*)$" "${&&target(\"ou=people,dc=domain,dc=two,dc=com\")}$1$2" ":" # olcRwmRewrite: {4}rwm-rewriteContext searchDN # olcRwmRewrite: {5}rwm-rewriteRule "OU=people,[ ]?DC=my,[ ]?DC=proxy,[ ]?DC=com " "${**target}" ":" This results in a slapd crash because searchDN wants to use the **target variable, but its not yet defined because the searchFilter Context hasn't been run yet. How do I change the order that the rwm-rewriteContexts are executed so that the context for searcFilter is run first ? Thanks Paul

2 1

After few seconds slapd automatically closes connection. Why?
by Saša-Stjepan Bakša 18 Feb '17

18 Feb '17

After successful bind and some search actions my client is still bind to server but as I can see from trace few seconds after successful operation slapd shuts down connection. Why is that happening? Can I prevent it? We have monitoring in our software which find that as server down and lots of logs are generated. 229 1786.027248821 172.17.103.226 -> 10.50.200.191 LDAP 294 searchResEntry(49) "cn=config" 230 1786.027396894 172.17.103.226 -> 10.50.200.191 LDAP 68 searchResDone(49) success 231 1786.028152406 10.50.200.191 -> 172.17.103.226 TCP 60 56375 > ldap [ACK] Seq=576 Ack=130237 Win=65280 Len=0 232 1798.039843259 172.17.103.226 -> 10.50.200.191 TCP 54 ldap > 56375 [FIN, ACK] Seq=130237 Ack=576 Win=30336 Len=0 233 1798.042231511 10.50.200.191 -> 172.17.103.226 TCP 60 56375 > ldap [ACK] Seq=576 Ack=130238 Win=65280 Len=0 Br Sasa

2 3

Re: syncrepl skipped entryCSN on openldap-2.4.44 on centos 6
by Quanah Gibson-Mount 17 Feb '17

17 Feb '17

--On Friday, February 17, 2017 5:46 PM +0800 Daniel Jung <mimianddaniel(a)gmail.com> wrote: > > Hi, > > > I see that some entryCSN have not been synced properly with the > provider. > I run multimaster setup and with several slaves and sometimes i see that > some slaves have old entryCSNs and I am syncing them manually with -c > option. Do you mean contextCSNs? > I haven't been able to track the cause nor see anything in the log to > indicate the problem. However, we have had slapd become non-responsive > due to IO blocking on logging. Could this cause syncrepl to miss updating > the entries? Has anyone seen this behaviour? If slapd gets locked up, hard to say what the side effects could be. Do you have stats+sync logging enabled on all of the systems? --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

syncrepl skipped entryCSN on openldap-2.4.44 on centos 6
by Daniel Jung 17 Feb '17

17 Feb '17

Hi, I see that some entryCSN have not been synced properly with the provider. I run multimaster setup and with several slaves and sometimes i see that some slaves have old entryCSNs and I am syncing them manually with -c option. I haven't been able to track the cause nor see anything in the log to indicate the problem. However, we have had slapd become non-responsive due to IO blocking on logging. Could this cause syncrepl to miss updating the entries? Has anyone seen this behaviour? Thanks

1 0

Re: PFS, TLSCipherSuite and Mac OS X interop
by Quanah Gibson-Mount 17 Feb '17

17 Feb '17

--On Thursday, February 16, 2017 5:14 PM +0100 Michael Ströder <michael(a)stroeder.com> wrote: > HI! > > Does anybody here have experience with Mac OS X accessing OpenLDAP server > regarding TLS cipher suites? I don't, but I know that OSX is using its own custom SSL library for its OpenLDAP build, and that has never been run by the OpenLDAP project, so who knows how well it functions. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

PFS, TLSCipherSuite and Mac OS X interop
by Michael Ströder 16 Feb '17

16 Feb '17

HI! Does anybody here have experience with Mac OS X accessing OpenLDAP server regarding TLS cipher suites? OpenLDAP system: - Debian Jessie - OpenSSL 1.0.1t (openssl-1.0.1t-1+deb8u6) - LTB packages openldap-ltb-2.4.44.1 Client is most recent Mac OS X. In Æ-DIR the default is to only use PFS-secured ciphers: TLSCipherSuite ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDH-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDH-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:!ADH But that does not work. Maybe I overlook something but to me it seems Mac OS X does not send any PFS ciphers in its ClientHello (see wireshark dissect below). How to enable PFS ciphers in Mac's libldap? Ciao, Michael. ------------------------------ snip ------------------------------ Secure Sockets Layer TLSv1.2 Record Layer: Handshake Protocol: Client Hello Content Type: Handshake (22) Version: TLS 1.0 (0x0301) Length: 98 Handshake Protocol: Client Hello Handshake Type: Client Hello (1) Length: 94 Version: TLS 1.2 (0x0303) Random Session ID Length: 0 Cipher Suites Length: 14 Cipher Suites (7 suites) Cipher Suite: TLS_EMPTY_RENEGOTIATION_INFO_SCSV (0x00ff) Cipher Suite: TLS_RSA_WITH_AES_256_GCM_SHA384 (0x009d) Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA256 (0x003d) Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA (0x0035) Cipher Suite: TLS_RSA_WITH_AES_128_GCM_SHA256 (0x009c) Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA256 (0x003c) Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f) Compression Methods Length: 1 Compression Methods (1 method) Extensions Length: 39 Extension: signature_algorithms Extension: status_request Extension: signed_certificate_timestamp Extension: Extended Master Secret

1 0

Re: 2.4.44 + ITS 8432 patch segfault in modify_add_values
by Quanah Gibson-Mount 16 Feb '17

16 Feb '17

--On Wednesday, February 15, 2017 12:15 PM -0800 "Paul B. Henson" <henson(a)acm.org> wrote: > On Wed, Feb 15, 2017 at 09:04:48AM -0800, Quanah Gibson-Mount wrote: > >> Hm, so there is <http://www.openldap.org/its/index.cgi/?findid=8413>, >> but not sure that's the same issue. > > I do have a 4-way MMR setup, but that seems to be the only simularity. > It's crashing in mods.c, not search.c, and from a segfault when actually > dereferencing a null pointer, rather than from an assertion failure > checking for one. Well, I suppose the other simularity is that it > happens during replication. > > Fortunately it's not that frequent of an occurance, and our load > balancer pops the load over to the failover master fairly quickly when > it happens, we usually only lose one transaction that I need to go clean > up. It typically happens during the heavy update load of our daily > identity management syncronization batch job. I would suggest filing an ITS with the full backtrace info, so I can track it. :) It could be useful to have the entry data from the accesslog as well for the failed replication op, as we can see the failed entry DN in the output of your backtrace. For example: reqStart=20161225113103.000003Z,cn=accesslog In some ways, although it's hard to be certain, it almost looks like it is complaining that the end operation couldn't be completed (I.e., the account being modified didn't have the attribute/value pair in the entry that the delete was being requested for). Does the operation complete successfully after slapd is restarted? --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: 2.4.44 + ITS 8432 patch segfault in modify_add_values
by Quanah Gibson-Mount 15 Feb '17

15 Feb '17

--On Tuesday, February 14, 2017 5:24 PM -0800 "Paul B. Henson" <henson(a)acm.org> wrote: > So I've gotten a total of 5 crashes so far since I updated my production > environment to 2.4.44 with a locally applied ITS 8432 patch. I finally > went ahead and built a debug enabled binary to take a better look at the > core files. > > They all have the same signature, SIGSEGV in modify_add_values; and in > all of them, "&mod->sm_values[mod->sm_numvals]", is NULL. I included a > full backtrace from one of the cores. Any thoughts as to what might be > going on here? Hm, so there is <http://www.openldap.org/its/index.cgi/?findid=8413>, but not sure that's the same issue. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

2.4.44 + ITS 8432 patch segfault in modify_add_values
by Paul B. Henson 15 Feb '17

15 Feb '17

So I've gotten a total of 5 crashes so far since I updated my production environment to 2.4.44 with a locally applied ITS 8432 patch. I finally went ahead and built a debug enabled binary to take a better look at the core files. They all have the same signature, SIGSEGV in modify_add_values; and in all of them, "&mod->sm_values[mod->sm_numvals]", is NULL. I included a full backtrace from one of the cores. Any thoughts as to what might be going on here? Thanks... #0 0x0000000000485c61 in modify_add_values (e=e@entry=0x7fbdef662480, mod=mod@entry=0x7fbdd0000980, permissive=0, text=text@entry=0x7fbdef6629a0, textbuf=textbuf@entry=0x7fbdef6624d0 "modify/delete: eduPersonAffiliation: no such attribute", textlen=textlen@entry=256) at /var/lib/portage/tmp/portage/net-nds/openldap-2.4.44-r1/work/openldap-2.4.44/servers/slapd/mods.c:61 61 if ( !BER_BVISNULL( &mod->sm_values[mod->sm_numvals] )) { (gdb) print &mod->sm_values[mod->sm_numvals] $1 = (BerValue *) 0x0 #0 0x0000000000485c61 in modify_add_values (e=e@entry=0x7f3a720f3480, mod=mod@entry=0x7f3a6c0013a0, permissive=0, text=text@entry=0x7f3a720f39a0, textbuf=textbuf@entry=0x7f3a720f34d0 "modify/delete: eduPersonAffiliation: no such attribute", textlen=textlen@entry=256) at /var/lib/portage/tmp/portage/net-nds/openldap-2.4.44-r1/work/openldap-2.4.44/servers/slapd/mods.c:61 61 if ( !BER_BVISNULL( &mod->sm_values[mod->sm_numvals] )) { (gdb) print &mod->sm_values[mod->sm_numvals] $1 = (BerValue *) 0x0 #0 0x0000000000485c61 in modify_add_values (e=e@entry=0x7fa36fffd480, mod=mod@entry=0x7fa358000980, permissive=0, text=text@entry=0x7fa36fffd9a0, textbuf=textbuf@entry=0x7fa36fffd4d0 "modify/delete: eduPersonAffiliation: no such attribute", textlen=textlen@entry=256) at /var/lib/portage/tmp/portage/net-nds/openldap-2.4.44-r1/work/openldap-2.4.44/servers/slapd/mods.c:61 61 if ( !BER_BVISNULL( &mod->sm_values[mod->sm_numvals] )) { (gdb) print &mod->sm_values[mod->sm_numvals] $1 = (BerValue *) 0x0 #0 0x0000000000485c61 in modify_add_values (e=e@entry=0x7f7e249f8480, mod=mod@entry=0x7f7e10001f00, permissive=0, text=text@entry=0x7f7e249f89a0, textbuf=textbuf@entry=0x7f7e249f84d0 "modify/delete: eduPersonAffiliation: no such attribute", textlen=textlen@entry=256) at /var/lib/portage/tmp/portage/net-nds/openldap-2.4.44-r1/work/openldap-2.4.44/servers/slapd/mods.c:61 61 if ( !BER_BVISNULL( &mod->sm_values[mod->sm_numvals] )) { (gdb) print &mod->sm_values[mod->sm_numvals] $1 = (BerValue *) 0x0 #0 0x0000000000485c61 in modify_add_values (e=e@entry=0x7f50727fb480, mod=mod@entry=0x7f50600019a0, permissive=0, text=text@entry=0x7f50727fb9a0, textbuf=textbuf@entry=0x7f50727fb4d0 "modify/delete: eduPersonAffiliation: no such attribute", textlen=textlen@entry=256) at /var/lib/portage/tmp/portage/net-nds/openldap-2.4.44-r1/work/openldap-2.4.44/servers/slapd/mods.c:61 61 if ( !BER_BVISNULL( &mod->sm_values[mod->sm_numvals] )) { (gdb) print &mod->sm_values[mod->sm_numvals] $1 = (BerValue *) 0x0 (gdb) bt full #0 0x0000000000485c61 in modify_add_values (e=e@entry=0x7f50727fb480, mod=mod@entry=0x7f50600019a0, permissive=0, text=text@entry=0x7f50727fb9a0, textbuf=textbuf@entry=0x7f50727fb4d0 "modify/delete: eduPersonAffiliation: no such attribute", textlen=textlen@entry=256) at /var/lib/portage/tmp/portage/net-nds/openldap-2.4.44-r1/work/openldap-2.4.44/servers/slapd/mods.c:61 rc = <optimized out> op = 0x4fe045 "add" a = <optimized out> pmod = {sm_desc = <optimized out>, sm_values = 0x0, sm_nvalues = 0x0, sm_numvals = <optimized out>, sm_op = <optimized out>, sm_flags = <optimized out>, sm_type = {bv_len = <optimized out>, bv_val = <optimized out>}} __PRETTY_FUNCTION__ = "modify_add_values" #1 0x00007f526dfccd0c in mdb_modify_internal (op=op@entry=0x7f50727fc600, tid=tid@entry=0x1088a90, modlist=0x7f5060001960, e=e@entry=0x7f50727fb480, text=text@entry=0x7f50727fb9a0, textbuf=textbuf@entry=0x7f50727fb4d0 "modify/delete: eduPersonAffiliation: no such attribute", textlen=256) at /var/lib/portage/tmp/portage/net-nds/openldap-2.4.44-r1/work/openldap-2.4.44/servers/slapd/back-mdb/mod ify.c:137 rc = <optimized out> err = <optimized out> mod = 0x7f50600019a0 ml = 0x7f50600019a0 save_attrs = 0x7f5060004270 ap = 0x7f5272f53010 glue_attr_delete = <optimized out> got_delete = 0 __PRETTY_FUNCTION__ = "mdb_modify_internal" #2 0x00007f526dfce134 in mdb_modify (op=0x7f50727fc600, rs=0x7f50727fb980) at /var/lib/portage/tmp/portage/net-nds/openldap-2.4.44-r1/work/openldap-2.4.44/servers/slapd/back-mdb/mod ify.c:624 mdb = 0x7f5272f53010 e = 0x7f5060004220 manageDSAit = <optimized out> textbuf = "modify/delete: eduPersonAffiliation: no such attribute\000\377\037\000\000\000\000\000\000\000@\003\315\000\000\000\000\000\200\271\177rP\177\000\000\021\000\000\000\000\000\000\000.,\020`P\177\000\000 \360o\315\000\000\000\000\000\360\002\315\000\000\000\000\000\037\000\000\000\000\000\000\000\000\306\177rP\17 7\000\000\300\064\000`P\177\000\000\000\000\000\000\000\000\000\000\360o\315\000\000\000\000\000 T\315\000\000 \000\000\000\000\306\177rP\177\000\000\270\232N\000\000\000\000\000 l\315\000\000\000\000\000\350\064\000`P\17 7\000\000\000\306\177rP\177\000\000\000\000\000\000\000\000\000\000"... txn = 0x1088a90 opinfo = {moi_oe = {oe_next = {sle_next = 0x7f50727fb930}, oe_key = 0x7f5272f53010}, moi_txn = 0x1088a90, moi_ref = 1, moi_flag = 0 '\000'} moi = 0x7f50727fb430 dummy = {e_id = 66196, e_name = {bv_len = 40, bv_val = 0x7f50600041e8 "uid=aapriest,ou=user,dc=csupomona,dc=edu"}, e_nname = {bv_len = 40, bv_val = 0x7f5060004d18 "uid=aapriest,ou=user,dc=csupomona,dc=edu"}, e_attrs = 0xd202e8, e_ocflags = 256, e_bv = {bv_len = 0, bv_val = 0x0}, e_private = 0x7f5060004220} preread_ctrl = 0x0 postread_ctrl = 0x0 ctrls = {0x0, 0x0, 0x0, 0x0, 0x0, 0x7f50727fb250} num_ctrls = 0 numads = 55 #3 0x000000000049c2ea in overlay_op_walk (op=op@entry=0x7f50727fc600, rs=0x7f50727fb980, which=op_modify, oi=0xcd6a40, on=<optimized out>) at /var/lib/portage/tmp/portage/net-nds/openldap-2.4.44-r1/work/openldap-2.4.44/servers/slapd/backover.c:6 77 func = <optimized out> rc = <optimized out> #4 0x000000000049c441 in over_op_func (op=0x7f50727fc600, rs=<optimized out>, which=<optimized out>) at /var/lib/portage/tmp/portage/net-nds/openldap-2.4.44-r1/work/openldap-2.4.44/servers/slapd/backover.c:7 30 oi = <optimized out> on = <optimized out> be = 0xcd0ac0 db = {bd_info = 0x7f526e1e6d40 <bi>, bd_self = 0xcd0ac0, be_ctrls = "\000\001\001\001\000\001\000\000\001\000\000\001\001\000\001\000\000\001", '\000' <repea ts 14 times>, "\001", be_flags = 563464, be_restrictops = 0, be_requires = 0, be_ssf_set = {sss_ssf = 0, sss_transport = 0, sss_tls = 0, sss_sasl = 0, sss_update_ssf = 0, sss_update_transport = 0, sss_update_tls = 0, sss_update_sasl = 0, sss_simple_bind = 64}, be_suffix = 0xcd0880, be_nsuffix = 0xca5c90, be_schemadn = {bv_len = 0, bv_val = 0x0}, be_schemandn = {bv_len = 0, bv_val = 0x0}, be_rootdn = {bv_len = 31, bv_val = 0xcd02f0 "cn=ldaproot,dc=csupomona,dc=edu"}, be_rootndn = {bv_len = 31, bv_val = 0xcd0340 "cn=ldaproot,dc=csupomona,dc=edu"}, be_rootpw = { bv_len = 38, bv_val = 0xca49a0 "{SSHA}XXXXXXXXXXXXXXXXXXXXXXX"}, be_max_deref_depth = 15, be_def_limit = {lms_t_soft = 3600, lms_t_hard = 0, lms_s_soft = -1, lms_s_hard = 0, lms_s_unchecked = -1, lms_s_pr = 0, lms_s_pr_hide = 0, lms_s_pr_total = 0}, be_limits = 0xca5840, be_acl = 0xcd1c80, be_dfltaccess = ACL_READ, be_extra_anlist = 0x0, be_update_ndn = {bv_len = 0, bv_val = 0x0}, be_update_refs = 0x0, be_pending_csn_list = 0xf85dc0, be_pcl_mutex = {__data = {__lock = 0, __count = 0, __owner = 0, __nusers = 0, __kind = 0, __spins = 0, __elision = 0, __list = {__prev = 0x0, __next = 0x0}}, __size = '\000' <repeats 39 times>, __align = 0}, be_syncinfo = 0xcd75c0, be_pb = 0x0, be_cf_ocs = 0x7f526e1e68c0 <mdbocs>, be_private = 0x7f5272f53010, be_next = {stqe_next = 0x0}} cb = {sc_next = 0x7f50727fb950, sc_response = 0x49b650 <over_back_response>, sc_cleanup = 0x0, sc_writewait = 0x0, sc_private = 0xcd6a40} sc = <optimized out> rc = 32768 __PRETTY_FUNCTION__ = "over_op_func" #5 0x000000000048d938 in syncrepl_message_to_op (si=si@entry=0xcd8520, op=op@entry=0x7f50727fc600, msg=0x7f5060102940) at /var/lib/portage/tmp/portage/net-nds/openldap-2.4.44-r1/work/openldap-2.4.44/servers/slapd/syncrepl.c:2 394 oes = {oe = {oe_next = {sle_next = 0x0}, oe_key = 0x48cd60 <syncrepl_message_to_op>}, oe_si = 0xcd8520} ber = 0x7f50604b5390 modlist = 0x7f5060496f60 ls = 0x778940 <accesslog_sc> rs = {sr_type = REP_RESULT, sr_tag = 0, sr_msgid = 0, sr_err = 0, sr_matched = 0x0, sr_text = 0x7f50727fb4d0 "modify/delete: eduPersonAffiliation: no such attribute", sr_ref = 0x0, sr_ctrls = 0x0, sr_un = {sru_search = {r_entry = 0x0, r_attr_flags = 0, r_operational_attrs = 0x0, r_attrs = 0x0, r_nentries = 0, r_v2ref = 0x0}, sru_sasl = {r_sasldata = 0x0}, sru_extended = { r_rspoid = 0x0, r_rspdata = 0x0}}, sr_flags = 0} cb = {sc_next = 0x7f5060003490, sc_response = 0x48c8d0 <null_callback>, sc_cleanup = 0x0, sc_writewait = 0x0, sc_private = 0x0} text = 0x0 txtbuf = "@\277\177rP\177\000\000\020\274\177rP\177\000\000X\371P\000\000\000\000\000\266P\246rR\177\0 00\000@\277\177rP\177\000\000X\371P\000\000\000\000\000\240\272\177rP\177\000\000\060\275\246rR\177\000\000X\3 71P\000\000\000\000\000@^\246rR\177\000\000\000\000\000\000\000\000\000\000\002\000\000\000P\177\000\000\020\0 00\000\000\000\000\000\000\260\272\177rP\177\000\000\377\377\377\377\377\377\377\377&\000\000\017\000\000\000\ 000\020\t\020\230P\177\000\000x\215I`P\177\000\000\177\215I`P\177\000\000\000\275\177rP\177\000\000p\234\305\0 00\000\000\000\000@\275\177rP\177\000\000 \205\315\000\000\000\000\000\313\343I\000\000\000\000\000\020", '\00 0' <repeats 23 times>... bdn = {bv_len = 40, bv_val = 0x7f50600013ac "uid=aapriest,ou=user,dc=csupomona,dc=edu"} dn = {bv_len = 40, bv_val = 0x7f5060001c48 "\360!"} ndn = {bv_len = 40, bv_val = 0x7f5060001cd8 "\340\034"} bv = {bv_len = 0, bv_val = 0x0} bv2 = {bv_len = 0, bv_val = 0x0} bvals = 0x7f506049fb80 rdn = {bv_len = 0, bv_val = 0x0} sup = {bv_len = 0, bv_val = 0x0} prdn = {bv_len = 0, bv_val = 0x0} nrdn = {bv_len = 0, bv_val = 0x0} psup = {bv_len = 0, bv_val = 0x0} nsup = {bv_len = 0, bv_val = 0x0} rc = 0 deleteOldRdn = 0 freeReqDn = 1 do_graduate = 1 #6 0x00000000004915d7 in do_syncrep2 (op=op@entry=0x7f50727fc600, si=si@entry=0xcd8520) at /var/lib/portage/tmp/portage/net-nds/openldap-2.4.44-r1/work/openldap-2.4.44/servers/slapd/syncrepl.c:1 013 match = <optimized out> syncUUID = {{bv_len = 16, bv_val = 0x7f506049fb47 "~\373\337l\214\335IȻ\346\230\350\r\n", <incomplete sequence \316>}, { bv_len = 0, bv_val = 0x0}} cookie = {bv_len = 15, bv_val = 0x7f506049fb59 "rid=003,sid=003"} rctrls = 0x7f506049abe0 rctrlp = <optimized out> bdn = {bv_len = 44, bv_val = 0x7f506000135a "reqStart=20161225113103.000003Z,cn=accesslog"} si_tag = <optimized out> entry = <optimized out> punlock = -1 syncstate = 1 retdata = 0x0 retoid = 0x78 <error: Cannot access memory at address 0x78> syncUUIDs = 0x0 len = 15 berbuf = { buffer = "\002\000\001", '\000' <repeats 29 times>, "@\373I`P\177\000\000h\373I`P\177\000\000h\373I` P\177", '\000' <repeats 26 times>, "п\177rP\177\000\000\000\000\000\000R\177\000\000\001\000\000\000\000\000\0 00\000dZ\023qR\177\000\000Dh,\200\207\001\305\345\000\000\000\000\001\000\000\000\200\255J`P\177\000\000`\305\ 177rP\177\000\000\257X\244qR\177\000\000\031p-rR\177\000\000\000\000\000\000\000\000\000\000\b\246\246rR\177\0 00\000\060", '\000' <repeats 15 times>, "\001\000\000\000\000\000\000\000d"..., ialign = 65538, lalign = 65538, falign = 9.18382988e-41, dalign = 3.2380074297143616e-319, palign = 0x10002 <error: Cannot access memory at address 0x10002>} ber = 0x7f50727fbf40 msg = 0x7f5060102940 syncCookie = {ctxcsn = 0x0, sids = 0x0, numcsns = 0, rid = 3, octet_str = {bv_len = 15, bv_val = 0x7f5060498d70 "rid=003,sid=003"}, sid = 3, sc_next = {stqe_next = 0x0}} syncCookie_req = {ctxcsn = 0x7f50604a6c10, sids = 0x7f50604996c0, numcsns = 4, rid = 3, octet_str = { bv_len = 183, bv_val = 0x7f50604984e0 "rid=003,sid=000,csn=20161225102351.582901Z#000000#000#000000;201612130230 51.387118Z#000000#001#000000;20160721062752.989665Z#000000#002#000000;20160721062824.859874Z#000000#003#000000 "}, sid = 0, sc_next = {stqe_next = 0x0}} rc = 0 err = 0 modlist = 0x0 m = 11 tout_p = 0x7f50727fbc00 tout = {tv_sec = 0, tv_usec = 0} refreshDeletes = 0 empty = "empty" #7 0x0000000000495793 in do_syncrepl (ctx=ctx@entry=0x7f50727fcb90, arg=arg@entry=0xcd8a00) at /var/lib/portage/tmp/portage/net-nds/openldap-2.4.44-r1/work/openldap-2.4.44/servers/slapd/syncrepl.c:1 564 rtask = 0xcd8a00 si = 0xcd8520 conn = {c_struct_state = SLAP_C_UNINITIALIZED, c_conn_state = SLAP_C_INVALID, c_conn_idx = -1, c_sd = 0, c_close_reason = 0x0, c_mutex = {__data = {__lock = 0, __count = 0, __owner = 0, __nusers = 0, __kind = 0, __spins = 0, __elision = 0, __list = {__prev = 0x0, __next = 0x0}}, __size = '\000' <repeats 39 times>, __align = 0}, c_sb = 0x0, c_starttime = 0, c_activitytime = 0, c_connid = 18446744073709551615, c_peer_domain = {bv_len = 0, bv_val = 0x503e42 ""}, c_peer_name = {bv_len = 0, bv_val = 0x503e42 ""}, c_listener = 0x506e00 <dummy_list>, c_sasl_bind_mech = {bv_len = 0, bv_val = 0x0}, c_sasl_dn = { bv_len = 0, bv_val = 0x0}, c_sasl_authz_dn = {bv_len = 0, bv_val = 0x0}, c_authz_backend = 0x0, c_authz_cookie = 0x0, c_authz = {sai_method = 0, sai_mech = {bv_len = 0, bv_val = 0x0}, sai_dn = { bv_len = 0, bv_val = 0x0}, sai_ndn = {bv_len = 0, bv_val = 0x0}, sai_ssf = 0, sai_transport_ssf = 0, sai_tls_ssf = 0, sai_sasl_ssf = 0}, c_protocol = 0, c_ops = { stqh_first = 0x0, stqh_last = 0x0}, c_pending_ops = {stqh_first = 0x0, stqh_last = 0x0}, c_write1_mutex = {__data = {__lock = 0, __count = 0, __owner = 0, __nusers = 0, __kind = 0, __spins = 0, __elision = 0, __list = {__prev = 0x0, __next = 0x0}}, __size = '\000' <repeats 39 times>, __align = 0}, c_write1_cv = {__data = {__lock = 0, __futex = 0, __total_seq = 0, __wakeup_seq = 0, __woken_seq = 0, __mutex = 0x0, __nwaiters = 0, __broadcast_seq = 0}, __size = '\000' <repeats 47 times>, __align = 0}, c_write2_mutex = {__data = {__lock = 0, __count = 0, __owner = 0, __nusers = 0, __kind = 0, __spins = 0, __elision = 0, __list = {__prev = 0x0, __next = 0x0}}, __size = '\000' <repeats 39 times>, __align = 0}, c_write2_cv = {__data = {__lock = 0, __futex = 0, __total_seq = 0, __wakeup_seq = 0, __woken_seq = 0, __mutex = 0x0, __nwaiters = 0, __broadcast_seq = 0}, __size = '\000' <repeats 47 times>, __align = 0}, c_currentber = 0x0, c_writers = 0, c_writing = 0 '\000', c_sasl_bind_in_progress = 0 '\000', c_writewaiter = 0 '\000', c_is_udp = 0 '\000', c_is_tls = 0 '\000', c_needs_tls_accept = 0 '\000', c_sasl_layers = 0 '\000', c_sasl_done = 0 '\000', c_sasl_authctx = 0x0, c_sasl_sockctx = 0x0, c_sasl_extra = 0x0, c_sasl_bindop = 0x0, c_pagedresults_state = {ps_be = 0x0, ps_size = 0, ps_count = 0, ps_cookie = 0, ps_cookieval = {bv_len = 0, bv_val = 0x0}}, c_n_ops_received = 0, c_n_ops_executing = 0, c_n_ops_pending = 0, c_n_ops_completed = 0, c_n_get = 0, c_n_read = 0, c_n_write = 0, c_extensions = 0x0, c_clientfunc = 0x0, c_clientarg = 0x0, c_send_ldap_result = 0x442d90 <slap_send_ldap_result>, c_send_search_entry = 0x4437d0 <slap_send_search_entry>, c_send_search_reference = 0x444d10 <slap_send_search_reference>, c_send_ldap_extended = 0x4434a0 <slap_send_ldap_extended>, c_send_ldap_intermediate = 0x443640 <slap_send_ldap_intermediate>} opbuf = {ob_op = {o_hdr = 0x7f50727fc770, o_tag = 102, o_time = 1482665463, o_tincr = 13, o_bd = 0x7f50727fb690, o_req_dn = {bv_len = 40, bv_val = 0x7f506049f2c0 "uid=aapriest,ou=user,dc=csupomona,dc=edu"}, o_req_ndn = {bv_len = 40, bv_val = 0x7f506049f300 "uid=aapriest,ou=user,dc=csupomona,dc=edu"}, o_request = {oq_add = { rs_modlist = 0x7f5060001960, rs_e = 0x1}, oq_bind = {rb_method = 1610619232, rb_cred = { bv_len = 1, bv_val = 0x0}, rb_edn = {bv_len = 0, bv_val = 0x0}, rb_ssf = 0, rb_mech = { bv_len = 0, bv_val = 0x0}}, oq_compare = {rs_ava = 0x7f5060001960}, oq_modify = { rs_mods = {rs_modlist = 0x7f5060001960, rs_no_opattrs = 1 '\001'}, rs_increment = 0}, oq_modrdn = {rs_mods = {rs_modlist = 0x7f5060001960, rs_no_opattrs = 1 '\001'}, rs_deleteoldrdn = 0, rs_newrdn = {bv_len = 0, bv_val = 0x0}, rs_nnewrdn = {bv_len = 0, bv_val = 0x0}, rs_newSup = 0x0, rs_nnewSup = 0x0}, oq_search = {rs_scope = 1610619232, rs_deref = 32592, rs_slimit = 1, rs_tlimit = 0, rs_limit = 0x0, rs_attrsonly = 0, rs_attrs = 0x0, rs_filter = 0x0, rs_filterstr = {bv_len = 0, bv_val = 0x0}}, oq_abandon = { rs_msgid = 1610619232}, oq_cancel = {rs_msgid = 1610619232}, oq_extended = {rs_reqoid = { bv_len = 139983184730464, bv_val = 0x1 <error: Cannot access memory at address 0x1>}, rs_flags = 0, rs_reqdata = 0x0}, oq_pwdexop = {rs_extended = {rs_reqoid = { bv_len = 139983184730464, bv_val = 0x1 <error: Cannot access memory at address 0x1>}, rs_flags = 0, rs_reqdata = 0x0}, rs_old = {bv_len = 0, bv_val = 0x0}, rs_new = { bv_len = 0, bv_val = 0x0}, rs_mods = 0x0, rs_modtail = 0x0}}, o_abandon = 0, o_cancel = 0, o_groups = 0x0, o_do_not_cache = 0 '\000', o_is_auth_check = 0 '\000', o_dont_replicate = 0 '\000', o_acl_priv = ACL_NONE, o_nocaching = 0 '\000', o_delete_glue_parent = 0 '\000', o_no_schema_check = 1 '\001', o_no_subordinate_glue = 0 '\000', o_ctrlflag = '\000' <repeats 14 times>, "\002", '\000' <repeats 16 times>, o_controls = 0x7f50727fc8c0, o_authz = {sai_method = 0, sai_mech = {bv_len = 0, bv_val = 0x0}, sai_dn = {bv_len = 31, bv_val = 0xcd02f0 "cn=ldaproot,dc=csupomona,dc=edu"}, sai_ndn = { sai_transport_ssf = 0, sai_tls_ssf = 0, sai_sasl_ssf = 0}, o_ber = 0x0, o_res_ber = 0x0, o_callback = 0x7f5060004198, o_ctrls = 0x0, o_csn = {bv_len = 40, bv_val = 0x7f5060102c10 "20161225113103.634923Z#000000#000#000000"}, o_private = 0x0, o_extra = {slh_first = 0x7f50727fb430}, o_next = {stqe_next = 0x0}}, ob_hdr = {oh_opid = 0, oh_connid = 3, oh_conn = 0x7f50727fc340, oh_msgid = 0, oh_protocol = 0, oh_tid = 139983495091968, oh_threadctx = 0x7f50727fcb90, oh_tmpmemctx = 0x7f5060000e30, oh_tmpmfuncs = 0x7787a0 <slap_sl_mfuncs>, oh_counters = 0x7ae000 <slap_counters>, oh_log_prefix = "conn=-1 op=0", '\000' <repeats 243 times>, oh_extensions = 0x0}, ob_controls = { 0x0 <repeats 17 times>, 0x7f50727fbd00, 0x0 <repeats 14 times>}} op = 0x7f50727fc600 rc = 0 dostop = 0 s = 16 i = <optimized out> defer = 1 fail = 0 freeinfo = 0 be = 0xcd0ac0 #8 0x0000000000433037 in connection_read_thread (ctx=0x7f50727fcb90, argv=0x10) at /var/lib/portage/tmp/portage/net-nds/openldap-2.4.44-r1/work/openldap-2.4.44/servers/slapd/connection.c :1296 rc = <optimized out> cri = {op = 0x0, func = 0x4954b0 <do_syncrepl>, arg = 0xcd8a00, ctx = <optimized out>, nullop = <optimized out>} s = <optimized out> #9 0x00007f5272c83a32 in ldap_int_thread_pool_wrapper (xpool=0xc63a40) at /var/lib/portage/tmp/portage/net-nds/openldap-2.4.44-r1/work/openldap-2.4.44/libraries/libldap_r/tpool. c:696 pool = 0xc63a40 task = 0x7f50a8000a20 work_list = <optimized out> ctx = {ltu_id = 139983495091968, ltu_key = {{ltk_key = 0x430810 <conn_counter_init>, ltk_data = 0x7f5060000d20, ltk_free = 0x4308f0 <conn_counter_destroy>}, { ltk_key = 0x486ac0 <slap_sl_mem_init>, ltk_data = 0x7f5060000e30, ltk_free = 0x486990 <slap_sl_mem_destroy>}, {ltk_key = 0x445cd0 <slap_op_free>, ltk_data = 0x7f50a0113e10, ltk_free = 0x445c30 <slap_op_q_destroy>}, {ltk_key = 0xf85de0, ltk_data = 0x7f5060102fd0, ltk_free = 0x7f526dfda950 <mdb_reader_free>}, { ltk_key = 0x7f526dfd07d0 <search_stack>, ltk_data = 0x7f5070ffc010, ltk_free = 0x7f526dfd08e0 <search_stack_free>}, {ltk_key = 0x7f526dfd0730 <scope_chunk_get>, ltk_data = 0x7f5060104e60, ltk_free = 0x7f526dfd08b0 <scope_chunk_free>}, {ltk_key = 0xd7f560, ltk_data = 0x7f50604ab8f0, ltk_free = 0x7f526dfda950 <mdb_reader_free>}, {ltk_key = 0x0, ltk_data = 0x7f506c40fff0, ltk_free = 0x0}, {ltk_key = 0x0, ltk_data = 0x0, ltk_free = 0x0} <repeats 24 times>}} kctx = <optimized out> keyslot = <optimized out> hash = <optimized out> __PRETTY_FUNCTION__ = "ldap_int_thread_pool_wrapper" #10 0x00007f52722ce494 in start_thread () from /lib64/libpthread.so.0 No symbol table info available. #11 0x00007f52719c6edd in clone () from /lib64/libc.so.6 No symbol table info available.

1 0

Re: RE24 testing call (2.4.45) LMDB RE0.9 testing call (0.9.20)
by Quanah Gibson-Mount 15 Feb '17

15 Feb '17

--On Sunday, February 05, 2017 7:12 PM -0800 "Paul B. Henson" <henson(a)acm.org> wrote: > On Fri, Feb 03, 2017 at 01:25:30PM -0800, Quanah Gibson-Mount wrote: > >> It turned out to not be related. :/ > > Oh, that's disappointing :(. I'm reproducing it multiple times on a daily > basis on my production systems 8-/, is there anything I can do to help > track it down? Log dumps from high log levels? I could drop in a custom > slapd binary on one of them if need be with extra logging code; anything > that wouldn't unduly impact normal end user functionality... > > Thanks much. I have a test setup from a coworker who managed to trigger this to examine and see if I can push it into the test script. :) --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: RE24 testing call (2.4.45) LMDB RE0.9 testing call (0.9.20)
by Quanah Gibson-Mount 15 Feb '17

15 Feb '17

--On Sunday, February 05, 2017 10:25 AM -0800 Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Friday, February 03, 2017 2:34 PM +0100 "A. Schulze" > <sca(a)andreasschulze.de> wrote: > >> >> >> Am 31.01.2017 um 22:21 schrieb A. Schulze: >> >>> * but last: make test failed >>> ( attached make_test_result.txt ) >> >> the failing test was test059 > > Ah, whoops. That I was able to reproduce at 25/500 runs. I've filed <http://www.openldap.org/its/index.cgi/?findid=8589> for the issue. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

RE24 testing call (2.4.45) LMDB RE0.9 testing call (0.9.20)
by Quanah Gibson-Mount 14 Feb '17

14 Feb '17

For this testing call, we particularly need folks to test OpenLDAP with startTLS/LDAPS when compiled against OpenSSL (both pre 1.1 series and with the 1.1 series). There is currenly nothing in the test suite that covers encrypted connections (Although it's on my todo list). To build against OpenSSL 1.1 may also require cyrus-sasl HEAD out of the cyrus-sasl GIT repository, depending on your build options as the current cyrus-sasl release does not support the OpenSSL 1.1 series. It can be found at <https://github.com/cyrusimap/cyrus-sasl>. If you build with GSSAPI and use Heimdal, you will also need the Heimdal 7.1.0 or later release (as that is where OpenSSL 1.1 support was added). It can be obtained from <http://h5l.org/>. Also new with this release is the ability to run "make its" in the tests/ directory. This will run a specific set of tests around past bugs to ensure there are no regressions. While I've tested this with modular openldap builds, it has not been tested with the modules and backends built into slapd, so there could be some issues in that scenario. Generally, get the code for RE24: <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> Configure & build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its run through the regression suite. Thanks! OpenLDAP 2.4.45 Engineering Added slapd support for OpenSSL 1.1.0 series (ITS#8353, ITS#8533) Fixed libldap handling of Diffie-Hellman parameters (ITS#7506) Fixed libldap GnuTLS use after free (ITS#8385) Fixed slapd sasl SEGV rebind in same session (ITS#8568) Fixed slapd syncrepl filter handling (ITS#8413) Fixed slapd syncrepl infinite looping mods with delta-sync MMR (ITS#8432) Fixed slapd callback struct so older modules without writewait should function. Custom modules may need to be updated for sc_writewait callback (ITS#8435) Fixed slapd-mdb so it passes ITS6794 regression test (ITS#6794) Fixed slapd-meta uninitialized diagnostic message (ITS#8442) Fixed slapo-accesslog to honor pauses during purge for cn=config update (ITS#8423) Fixed slapo-relay to correctly initialize sc_writewait (ITS#8428) Build Environment Added test065 for proxyauthz (ITS#8571) Fix test008 to be portable (ITS#8414) Fix its4336 regression test (ITS#8534) Fix its4337 regression test (ITS#8535) Fix regression tests to execute on all backends (ITS#8539) Contrib Added slapo-autogroup(5) man page (ITS#8569) Added passwd missing conversion scripts for apr1 (ITS#6826) Fixed contrib modules where the writewait callback was not correctly initialized (ITS#8435) Fixed smbk5pwd to build with newer OpenSSL releases (ITS#8525) Documentation admin24 fixed tls_cipher_suite bindconf option (ITS#8099) admin24 fixed typo cn=config to be slapd.d (ITS#8449) Fixed slapd-config(5), slapd.conf(5) clarification on interval keyword for refreshAndPersist (ITS#8538) Fixed slapo-ppolicy(5) to clearly note rootdn requirement (ITS#8565) Fixed various minor grammar issues in the man pages (ITS#8544) LMDB 0.9.20 Release Engineering Fix mdb_load with escaped plaintext (ITS#8558) Fix mdb_cursor_last / mdb_put interaction (ITS#8557) LMDB 0.9.19 Release (2016/12/28) Fix mdb_env_cwalk cursor init (ITS#8424) Fix robust mutexes on Solaris 10/11 (ITS#8339) Tweak Win32 error message buffer Fix MDB_GET_BOTH on non-dup record (ITS#8393) Optimize mdb_drop Fix xcursors after mdb_cursor_del (ITS#8406) Fix MDB_NEXT_DUP after mdb_cursor_del (ITS#8412) Fix mdb_cursor_put resetting C_EOF (ITS#8489) Fix mdb_env_copyfd2 to return EPIPE on SIGPIPE (ITS#8504) Fix mdb_env_copy with empty DB (ITS#8209) Fix behaviors with fork (ITS#8505) Fix mdb_dbi_open with mainDB cursors (ITS#8542) Fix robust mutexes on kFreeBSD (ITS#8554) Fix utf8_to_utf16 error checks (ITS#7992) Fix F_NOCACHE on MacOS, error is non-fatal (ITS#7682) Build Make shared lib suffix overridable (ITS#8481) Documentation Cleanup doxygen nits Note reserved vs actual mem/disk usage --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

5 8

Valgrind detecting memory leak on 2-way multi master setup on RHEL 6 - openldap 2.4.44
by ping-shin ching 14 Feb '17

14 Feb '17

Hi, I'm running two ldap servers (2.4.44) in a 2-Way multi master setup on RHEL 2.6 (glibc 2.12). Valgrind detects a memory leak every time an entry is deleted a provider. configure options... --without-cyrus-sasl \ --disable-bdb \ --disable-hdb \ --enable-ldap \ --enable-mdb \ --enable-constraint Valgrind output from the provider where the entry was deleted. ..... ==15112== 100 bytes in 1 blocks are possibly lost in loss record 10 of 11 ==15112== at 0x4A05EDF: calloc (vg_replace_malloc.c:710) ==15112== by 0x51CA6C: ber_memcalloc_x (memory.c:260) ==15112== by 0x4F4374: ldap_pvt_runqueue_insert (rq.c:48) ==15112== by 0x4D688A: log_cf_gen (accesslog.c:942) ==15112== by 0x4161D2: config_set_vals (config.c:353) ==15112== by 0x485BD0: over_db_config (backover.c:117) ==15112== by 0x41A142: read_config_file (config.c:844) ==15112== by 0x415290: read_config (bconfig.c:4238) ==15112== by 0x407279: main (main.c:797) ==15112== ==15112== 393 bytes in 1 blocks are definitely lost in loss record 11 of 11 ==15112== at 0x4A0717A: malloc (vg_replace_malloc.c:298) ==15112== by 0x51CB54: ber_memalloc_x (memory.c:204) ==15112== by 0x43A9EA: ch_malloc (ch_malloc.c:54) ==15112== by 0x4DDFE2: syncprov_qresp (syncprov.c:1061) ==15112== by 0x4DF812: syncprov_op_response (syncprov.c:1981) ==15112== by 0x42F87D: slap_response_play (result.c:508) ==15112== by 0x4303F8: send_ldap_response (result.c:583) ==15112== by 0x4310EB: slap_send_ldap_result (result.c:861) ==15112== by 0x4C7681: mdb_delete (delete.c:464) ==15112== by 0x484C1D: overlay_op_walk (backover.c:677) ==15112== by 0x485692: over_op_func (backover.c:730) ==15112== by 0x438B72: fe_op_delete (delete.c:174) ==15112== ==15112== LEAK SUMMARY: ==15112== definitely lost: 548 bytes in 4 blocks ==15112== indirectly lost: 0 bytes in 0 blocks ==15112== possibly lost: 303 bytes in 5 blocks ==15112== still reachable: 64 bytes in 2 blocks ==15112== suppressed: 0 bytes in 0 blocks ==15112== Reachable blocks (those to which a pointer was found) are not shown. ==15112== To see them, rerun with: --leak-check=full --show-leak-kinds=all ==15112== ==15112== For counts of detected and suppressed errors, rerun with: -v ==15112== Use --track-origins=yes to see where uninitialised values come from ==15112== ERROR SUMMARY: 11 errors from 11 contexts (suppressed: 4 from 4) ==15112== could not unlink /tmp/vgdb-pipe-from-vgdb-to-15112-by-root-on-nsdalvmldap12.isppe.in.telstra.com.au ==15112== could not unlink /tmp/vgdb-pipe-to-vgdb-from-15112-by-root-on-nsdalvmldap12.isppe.in.telstra.com.au ==15112== could not unlink /tmp/vgdb-pipe-shared-mem-vgdb-15112-by-root-on-nsdalvmldap12.isppe.in.telstra.com.au snippet of syncprov overlay from the slapd.conf ... mirrormode on overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 10000 syncprov-nopresent TRUE ... Regards, Ping

1 0

[LMDB] Unexpected behavior for MDB_MULTIPLE with zero-length page
by Bryan Matsuo 12 Feb '17

12 Feb '17

Hi, I was working on the lmdb-go bindings for LMDB, using the 0.9.19 release and believe I have found a bug with MDB_MULTIPLE. The bug still exists on the latest commit of branch mdb.RE/0.9, a87c8fd8c9a4ce49be18a642e3572059f39ed1cf, I'm not sure if this bug is part of what held the 0.9.20 release back. But I wanted to check here. I noticed that, for in a corner case of the mdb_cursor_put function when MDB_MULTIPLE is provided, if the number of items is specified to be zero this may lead to garbage data being written or a segfault. My intuition would be that this is essentially a noop, but I also would have thought EINVAL would be an acceptable error code for this strange use of mdb_cursor_put. The actual behavior of LMDB does not seem acceptable. I've included an barebones example which I have written in C to demonstrate the problem. Please let me know what you think. - Bryan Here is my program's output $ ./mdb_putmultiple_empty -V LMDB 0.9.20: (January 11, 2017) $ ./mdb_putmultiple_empty -n putmultiple_empty.mdb && echo ok Segmentation fault (core dumped) And, here is the program source /* mdb_putmultiple_empty.c - test of MDB_PUT_MULTIPLE given zero items*/ #ifdef _WIN32 #include <windows.h> #endif #include <stdio.h> #include <stdlib.h> #include <signal.h> #include "lmdb.h" static void sighandle(int sig) { } int main(int argc,char * argv[]) { int rc; MDB_env *env; MDB_txn *txn; MDB_cursor *cursor; MDB_dbi dbi; MDB_val vals[3]; const char *progname = argv[0], *act; unsigned flags = 0; for (; argc > 1 && argv[1][0] == '-'; argc--, argv++) { if (argv[1][1] == 'n' && argv[1][2] == '\0') flags |= MDB_NOSUBDIR; else if (argv[1][1] == 'V' && argv[1][2] == '\0') { printf("%s\n", MDB_VERSION_STRING); exit(0); } else argc = 0; } if (argc<2 || argc>3) { fprintf(stderr, "usage: %s [-V] [-n] srcpath\n", progname); exit(EXIT_FAILURE); } #ifdef SIGPIPE signal(SIGPIPE, sighandle); #endif #ifdef SIGHUP signal(SIGHUP, sighandle); #endif signal(SIGINT, sighandle); signal(SIGTERM, sighandle); act = "creating environment"; rc = mdb_env_create(&env); if (rc == MDB_SUCCESS) { act = "setting maxdbs"; rc = mdb_env_set_maxdbs(env, 1); } if (rc == MDB_SUCCESS) { act = "opening environment"; rc = mdb_env_open(env, argv[1], flags, 0600); } if (rc == MDB_SUCCESS) { act = "beginning txn"; rc = mdb_txn_begin(env, 0,0, &txn); } if (rc == MDB_SUCCESS) { act = "opening dbi"; rc = mdb_dbi_open(txn, "db", MDB_CREATE|MDB_DUPSORT|MDB_DUPFIXED, &dbi); } if (rc == MDB_SUCCESS) { act = "opening cursor"; rc = mdb_cursor_open(txn, dbi, &cursor); } if (rc == MDB_SUCCESS) { act = "put multiple with zero items but non-empty stride"; vals[0].mv_size = 1; vals[0].mv_data = "x"; vals[1].mv_size = 2; vals[1].mv_data = 0; vals[2].mv_size = 0; vals[2].mv_data = 0; rc = mdb_cursor_put(cursor, &vals[0], &vals[1], MDB_MULTIPLE); } if (rc == MDB_SUCCESS) { act = "put multiple with zero items but non-empty stride"; vals[0].mv_size = 0; vals[0].mv_data = 0; vals[1].mv_size = 0; vals[1].mv_data = 0; rc = mdb_cursor_get(cursor, &vals[0], &vals[1], MDB_FIRST); } if (rc == MDB_SUCCESS) { fprintf(stderr, "FIRST: %.*s %.*s", (int)vals[0].mv_size, (char*)vals[0].mv_data, (int)vals[1].mv_size, (char*)vals[1].mv_data); } if (rc) fprintf(stderr, "%s: %s failed, error %d (%s)\n", progname, act, rc, mdb_strerror(rc)); mdb_txn_abort(txn); mdb_env_close(env); return rc ? EXIT_FAILURE : EXIT_SUCCESS; }

2 1

OpenLDAP backup best practices
by Nikolas Stylianides 10 Feb '17

10 Feb '17

Hi there. I have a setup of two servers in mirror mode. What is the best policy for backup. Currently i am dumping the DIT using slapcat every midnight. Is there another way to be able to take more frequent backups? Is there an incremental backup feature? Thank you in advance. -- Δρ. Νικόλας Στυλιανίδης Ηλεκτρολόγος Μηχανικός και Μηχ. Υπολογιστών Nikolas Stylianides, Dr. Dr. Eng. in Electrical & Computer Engineering Contacts ------------- Mobile Tel.: +35796741315 Email: nstylianides(a)leafnet.com.cy, nstylianides(a)gmail.com Skype: nicostyl Affilication --------------- LEAF NET LTD: Research & Development Open University of Cyprus: Research Associate, APPLIED HEALTH INFORMATICS Master Programme Academic Board Member Tο λακωνίζειν εστί φιλοσοφείν / Μηδέν Άγαν - Χίλων ο Λακεδαιμόνιος: Brevity is the soul of wit - Shakespeare William (Hamlet)

2 1

Re: RE24 testing call (2.4.45) LMDB RE0.9 testing call (0.9.20)
by Quanah Gibson-Mount 10 Feb '17

10 Feb '17

--On Friday, February 10, 2017 12:27 AM +0100 Michael Ströder <michael(a)stroeder.com> wrote: > Quanah Gibson-Mount wrote: >> --On Thursday, February 09, 2017 10:34 PM +0100 "A. Schulze" >> <sca(a)andreasschulze.de> wrote: >> >>> So my guess: openldap not call an important openssl library function and >>> so openssl use it's defaults. >> >> Yes, that sounds like a serious bug. Please file an ITS on it. > > Is this similar to ITS#8529? Sounds exactly like it, thanks! --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: RE24 testing call (2.4.45) LMDB RE0.9 testing call (0.9.20)
by Quanah Gibson-Mount 10 Feb '17

10 Feb '17

--On Thursday, February 09, 2017 8:27 PM +0100 "A. Schulze" <sca(a)andreasschulze.de> wrote: Hi Andreas, > a manual test using openssl s_client also proof the root is wrongly > delivered: $ echo | openssl11 s_client -connect ldap-test.example.org:443 Please see the slapd.conf(5) or slapd.conf(5) man pages, which clearly state: TLSCACertificateFile <filename> Specifies the file that contains certificates for all of the Certificate Authorities that slapd will recognize. Note "That *slapd* will recognize". The server cannot and will not provide the cert chains to clients as that is a massive security risk. Clients can and must be configured with the list of CAs *they* will trust when the server provides the cert. > Ultimate features would be OCSP stapling ( OK, no ldap client currently > implement that ) and setting ecdh_curve via SSL_CTX_set1_curves_list Feel free to submit a patch to implement anything necessary beyond what was discussed in <http://www.openldap.org/its/index.cgi/?findid=7506>. :) Or at least file an ITS so the issue can be tracked. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

3 2

Re: RE24 testing call (2.4.45) LMDB RE0.9 testing call (0.9.20)
by Quanah Gibson-Mount 10 Feb '17

10 Feb '17

--On Thursday, February 09, 2017 10:34 PM +0100 "A. Schulze" <sca(a)andreasschulze.de> wrote: > So my guess: openldap not call an important openssl library function and > so openssl use it's defaults. Yes, that sounds like a serious bug. Please file an ITS on it. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: RE24 testing call (2.4.45) LMDB RE0.9 testing call (0.9.20)
by Howard Chu 09 Feb '17

09 Feb '17

Please read this chapter again, carefully. http://www.openldap.org/doc/admin24/tls.html A. Schulze wrote: > > > Am 09.02.2017 um 22:32 schrieb Ralf Mattes: >> Is this really the problem. I only use TLSCACertificateFile but still get all the >> intermediate certificats as well as the top level (German Telekpm) cert. > > Ah! > > both, TLSCACertificateFile and TLSCACertificatePath contain the acceptable issuer certificates > for connections from a client /to/ slapd if TLSVerifyClient is not "none" > Just as Quanah pointed out some messages ago... > > In any case the list of DNs is sent to the client as part of the SSL handshake. > > If it happen that TLSCACertificateFile and/or TLSCACertificatePath > contain certificates related to the server certificate chain, > these are also sent at all to build this cert chain. > > But even if TLSCertificateFile point to file containing cert + intermediate > OpenLDAP still only the cert is delivered to the client. > (if TLSCACertificateFile and TLSCACertificatePath are unset) > > I'm confused because it's different then postfix for example. > > There I configure "smtpd_tls_cert_file = $cert_and_intermediates" > Optional I may enable "smtpd_tls_ask_ccert = yes" > Then the SMTP-Server ask the client to present a client cert > I've to configure smtpd_tls_CAfile or smtpd_tls_CApath. > > The difference between smtpd_tls_CAfile and smtpd_tls_CApath in postfix: > ( see http://www.postfix.org/postconf.5.html#smtpd_tls_CApath ) > "In contrast to smtpd_tls_CAfile, DNs of Certification Authorities > installed in $smtpd_tls_CApath are not included in the client > certificate request message." > > And this is what you see, Ralf ... > OpenLDAP Allways send the list of DNs. > > Hope that helps. > Andreas > > > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: RE24 testing call (2.4.45) LMDB RE0.9 testing call (0.9.20)
by Quanah Gibson-Mount 09 Feb '17

09 Feb '17

--On Thursday, February 09, 2017 12:49 PM -0800 Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Thursday, February 09, 2017 9:43 PM +0100 "A. Schulze" > <sca(a)andreasschulze.de> wrote: > >> that's not the issue. A TLS server sent it's certificate and all >> intermediates EXCLUDING the self signed root to the client. This is not >> true for my setup and I don't know why: misconfiguration or wrong ssl >> implementation. > > Sorry, reading back over your configuration, I don't believe it's valid > to specify both a CA path and a CA directory. You can use one or the > other. >From the man page: TLSCACertificatePath <path> Specifies the path of a directory that contains Certificate Authority certificates in separate individual files. Usually only one of this or the TLSCACertificateFile is used. This directive is not supported when using GnuTLS. So it is not clear to me what happens if you use both. ;) I've certainly never tried that. Since you are using both, did you correctly "hash" the CA certs in the directory you pointed at? --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

3 3

Re: help troubleshooting
by Quanah Gibson-Mount 09 Feb '17

09 Feb '17

--On Tuesday, February 07, 2017 5:01 PM -0700 scar <scar(a)drigon.com> wrote: > Well it's kind of a mess here and my lack of experience with LDAP isn't > helping much. There is no slapd-config program although there is a > manual page entry for it. "yum whatprovides */slapd-config" returns no > packages. slapd-config is not a program. It's a database format. Please read the man page for slapd-config(5). > I was able to enable users to change their passwords by directly > modifying /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{1\}bdb.ldif and > adding these lines to the bottom: As noted at the top of those files, you should never, ever, manually modify them by hand. You should be using the correct ldap client operations. You can do this via ldapadd, ldapmod, etc. > I know that's not proper but i needed users to be able to change their > password. Thanks for the info about ACLs. the "next to last ACL" > mentioned is for the "database monitor" (see slapd.conf below) and i'm > not sure why "by * read" should be granted that access, perhaps you can > shed some light on why that exists in our config? maybe i don't need > ACLs for that so only rootdn has access? That would be a separate block of ACLs that only applies to the monitor backend. There is no requirement that by * read have access to the monitoring backend. Who/what should have access to it depends on your requirements. > We have a new LDAP server that I am setting up, so I'd like to focus on > moving the database and getting the new server into production, and we > can iron out the wrinkles in this mess at the same time. My > understanding is that I can use slapcat/slapadd to do the export/import... > > I used "slapcat > /tmp/ldif" on current server, then moved ldif and > updated [slapd.conf] (see below) file to the new server, then ran > "slapadd -l /tmp/ldif -l /etc/openldap/slapd.conf -F > /etc/openldap/slapd.d/" but i get an error when trying to start slapd: > "ls: cannot access /etc/openldap/slapd.d//cn=config/olcDatabase*.ldif: No > such file or directory" so how am i supposed to get the slapd.d/* files? > If I am to just copy those over from the current server then I'd like to > figure out why I had to modify the ldif file directly... Your first slapcat exports the binary database, it has zero to do with the slapd-config database. Please read the manpage for slapcat on the proper way to export your slapd-config database. You don't use slapd.conf, you should stop doing anything with it, as it is immaterial. You will need to export/import your slapd-config database prior to importing your binary database. > The current LDAP server is running RHEL 6.8 with kernel > 2.6.32-642.11.1.el6.x86_64. The new LDAP server is running CentOS 6.8 > with kernel 2.6.32-642.13.1.el6.x86_64. The nss/pam configuration for > one of our clients is this (i hope this is what Michael Wandel meant): The RHEL build of OpenLDAP is known to be problematic, outdated, and it links to the insecure MozNSS libraries. I personally would recommend against using it. If you want to use a 3rd party OpenLDAP build, such as RedHat's, you may find the LTB project build a better bet. If you require support for your LDAP deployment, Symas offers supported builds for RHEL. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: RE24 testing call (2.4.45) LMDB RE0.9 testing call (0.9.20)
by Quanah Gibson-Mount 09 Feb '17

09 Feb '17

--On Thursday, February 09, 2017 9:43 PM +0100 "A. Schulze" <sca(a)andreasschulze.de> wrote: > that's not the issue. A TLS server sent it's certificate and all > intermediates EXCLUDING the self signed root to the client. This is not > true for my setup and I don't know why: misconfiguration or wrong ssl > implementation. Sorry, reading back over your configuration, I don't believe it's valid to specify both a CA path and a CA directory. You can use one or the other. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Fw : backend SSL negociation timeout
by Quanah Gibson-Mount 09 Feb '17

09 Feb '17

--On Friday, February 03, 2017 3:06 PM +0100 Louis Chanouha <louis.chanouha(a)univ-toulouse.fr> wrote: > To reproduce the error, i have an meta directory configured like this: > > > > > database meta > suffix "dc=localauth" > rootdn "cn=Manager,dc=localauth" > rootpw XXX > > > uri "ldaps://localhost:666/ou=UT,dc=localauth" > lastmod off > suffixmassage "ou=UT,dc=localauth" "ou=people,dc=example,dc=fr" > timeout 1 > conn-ttl 1 > network-timeout 1 Hi Louis, Please file an ITS at https://www.openldap.org/its with the configuration and reproduction steps you provided here so this issue can be tracked. Thanks, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: MDB_CORRUPTED: Located page was wrong type
by Howard Chu 09 Feb '17

09 Feb '17

opensource(a)gmx-topmail.de wrote: > > Hello, > > We build an Android app with LMDB and are now seeing an error report with the > following info: > error -30796: MDB_CORRUPTED: Located page was wrong type > > We also logged some general info about the DB: > entries=25381 depth=3 branch-pages=43 leaf-pages=891 overflow-pages=10 > page-size=4096 last-page-number=4464 last-tx-id=3752 size=536870912 > max-readers=126 readers=4 > > It is an Android 6.0.1 device, and that's about all the info we have. > Unfortunately we do not have the DB files etc. > > The app runs a LMDB version from mdb.master (45a8827 Howard Chu on 9/1/16 at > 1:41 AM, ITS#8489 reset cursor EOF flag in cursor_set). Generally you should not use mdb.master in production, as it's a development branch. > > DB curruption sounds like a rather bad issue. Any idea how this could have > happend? Not offhand. We've seen a few corruptions on Windows due to running without fully synchronous transactions, with OS crashes and/or faulty hard drives. It's pretty rare for phones to crash though. > Also, is there any chance to repair this DB (automatically)? Nothing automated at present. If you had the DB files you could try to scan the DB using the previous meta-page to see if it's still intact. > Thanks for your help, > Markus > > > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

MDB_CORRUPTED: Located page was wrong type
by opensource＠gmx-topmail.de 09 Feb '17

09 Feb '17

1 0

Transform accesslog database to LDIF for ldapmodify or other way
by Michael Wandel 08 Feb '17

08 Feb '17

Hey, I'm searching for a tool which is able to transform an accesslog Database to an ldif file, what can be used for ldapmodify. Or is there an alternative way to use the accesslog to rebuild an ldap database from a backup time to actual ? Every hint is welcome best regards Michael

2 4

Re: help troubleshooting
by Quanah Gibson-Mount 08 Feb '17

08 Feb '17

--On Monday, January 30, 2017 7:08 PM -0700 scar <scar(a)drigon.com> wrote: > However, this brings me to the next problem: the contents of slapd.conf > do not match the slapd.d/cn\=config.ldif file, so it seems the fixes i am > trying to the ACL's don't have any effect, even when i restart slapd. > If i try "ldapmodify -nv" it just hangs. When i try to stop slapd and > remove slapd.d/* and then start slapd, the contents are recreated > according to the config file, but then users can't login (all i see in > the logfile is access_allowed and slap_access_allowed but no conn lines) If you are using the configuration backend for slapd, then you can ignore the slapd.conf file entirely, and simply use the ldapmodify command to modify your access rules. I suggest reading the ldapmodify manual page for information on how to properly execute it. If you are using a distribution provided build of OpenLDAP, the necessary steps may depend on how they configured things. I would note that the rootdn is never subject to ACLs (as documented in the slapd.access(5) man page). So there is no point in listing it in ACLs. I would note that your final acl: "access to * by dn="uid=ldapadmin,dc=X,dc=Y,dc=Z" read" will never be applied, since ACL processing stops on the first matching acl (As noted in the slapd.access(5) man page), and the ACL immediately preceeding it already covers "access to *". I would note that your next to last ACL has also has items that would never be processed, specifically the "by * auth", since the "by * read" takes precedence. You don't provide any information on what identit(y/ies) you want to be able to modify the userPassword attribute, so it's difficult to help you further. Hopefully this is enough information to help you have forward progress. :) Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

3 2

Script for mass updates
by Nick Milas 07 Feb '17

07 Feb '17

Hello, Does anyone have a ready-made script (e.g. bash) that would do the following: Loop on all entries in the ou=people branch where ou <> "system" { If attribute DisplayName does not exist{ Set DisplayName to the value of attibute cn } } I could do it with a bit of work, but it's urgent. Any help will be appreciated! Thanks in advance, Nick

7 14

Re: RE24 testing call (2.4.45) LMDB RE0.9 testing call (0.9.20)
by Quanah Gibson-Mount 06 Feb '17

06 Feb '17

--On Tuesday, January 31, 2017 12:37 PM -0800 Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Tuesday, January 31, 2017 12:05 PM -0800 Quanah Gibson-Mount > <quanah(a)symas.com> wrote: > >>> ERROR: Entry 21 not replicated to ldap://localhost:9012/! (32)! >>> Error found after 1 of 1 iterations >>>>>>>> test061-syncreplication-initiation failed for mdb >>> (exit 1) >>> Makefile:310: recipe for target 'mdb-yes' failed >>> make: *** [mdb-yes] Error 1 >> >> Interesting -- Can you tar up the testrun directory, ftp it up, and file >> an ITS with a pointer to the upload? > > I was able to reproduce this as well with back-mdb. Are you sure you're testing RE24 and not HEAD? I can reproduce this failure in HEAD easily, but test061 has passed for me approximately 1000 times so far in RE24. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

3 2

Re: Script for mass updates
by Ulrich Windl 06 Feb '17

06 Feb '17

(forgot to reply to the list) >>> Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de> schrieb am 06.02.2017 um 08:14 in Nachricht <58983099.ED38.00A1.0(a)rz.uni-regensburg.de>: >>>> "Ralf Mattes" <rm(a)mh-freiburg.de> schrieb am 01.02.2017 um 17:23 in Nachricht > <45d3-58920b80-2b-2963e90@255443456>: > > > Am Mittwoch, 01. Februar 2017 16:52 CET, Jephte Clain > > <jephte.clain(a)univ-reunion.fr> schrieb: > > > >> using michaël's filter, you could try this: > >> > >> ldapsearch [options] '(&(ou:dn:=people)(!(ou=system))(!(displayName=*)))' > >> cn | awk ' > >> /^dn:/ { > >> print > >> print "changetype: modify" > >> print "replace: displayName" > >> next > >> } > >> /^cn:/ { > >> sub(/^cn/, "displayName") > >> } > >> { print } > >> ' | ldapmodify [options] > >> > >> we aren't doing your homework, are we? :-) > > > > Danger, Will Robinson! > > This will only work for dn values that aren't encoded. > > That's a trivial job for perl or python (or whatever). AWK operates > > on character streams and that's a bad fit for LDIF. > > Zwo questions: > > 1: Doesn't /^dn:/ also match "dn::" (likewise /^cn:/ and "cn::"? > 2: If /^cn:/ matches "cn::", wouldn't the sub() replace "cn::" with > "displayName::"? > > So everything would still work IMHO. > > We don't use displayName like that; we only us it if someone with an > academic title insists on having his "Prof." or "Dr." (or any collection of > that in his/her name). > > Regards, > Ulrich > > Thought of the day: Trump vs. America; who will win? > > > > > Cheers, Ralf Mattes > > > >> regards, > >> Jephté > >> > > > >

1 0

RE: RE24 testing call (2.4.45) LMDB RE0.9 testing call (0.9.20)
by Quanah Gibson-Mount 06 Feb '17

06 Feb '17

--On Friday, February 03, 2017 12:38 PM -0800 "Paul B. Henson" <henson(a)acm.org> wrote: >> From: Quanah Gibson-Mount >> Sent: Thursday, February 02, 2017 1:26 PM >> >> quanah@ub16:~/openldap-2.4.45RC/tests$ ./run -l 500 -b mdb test061 >> >> Will run test061 500 times, using back-mdb as the backend. Instead of a >> specific test, one can do "all" to run everything through a loop X times. > > Ok; to clarify then, if a test fails, make will abort? Yes. >> Interesting... it may be worthwhile to look in the testrun directory and >> see why slapd failed to launch. I'll see if I can reproduce it as well. > > Ah, I bet it is this: > > Unrecognized database type (ldap) > 5894e87d > /user/henson/tmp/openldap-OPENLDAP_REL_ENG_2_4-ab6f04c/tests/testrun/slap > d.2 .conf: line 16: <database> failed init (ldap) > > I configured it the way I run it in production; this test must be using a > module I don't enable. Sorry for the false alarm. For testing purposes, > should I just run ./configure with no options? Or a subset of the options > I would normally use on a production system? It means I need to fix the regression test to ignore back-ldap. ;) >> I've not been able to reproduce it. > > Hmm, I must have misunderstood you; I thought in this message: > > http://www.openldap.org/lists/openldap-technical/201612/msg00108.html > > You had indicated you were able to reproduce it. It turned out to not be related. :/ --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: RE24 testing call (2.4.45) LMDB RE0.9 testing call (0.9.20)
by Quanah Gibson-Mount 05 Feb '17

05 Feb '17

--On Friday, February 03, 2017 2:34 PM +0100 "A. Schulze" <sca(a)andreasschulze.de> wrote: > > > Am 31.01.2017 um 22:21 schrieb A. Schulze: > >> * but last: make test failed >> ( attached make_test_result.txt ) > > the failing test was test059 Ah, whoops. That I was able to reproduce at 25/500 runs. Thanks! --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

RE: RE24 testing call (2.4.45) LMDB RE0.9 testing call (0.9.20)
by Quanah Gibson-Mount 03 Feb '17

03 Feb '17

--On Thursday, February 02, 2017 1:01 PM -0800 "Paul B. Henson" <henson(a)acm.org> wrote: >> From: Quanah Gibson-Mount >> Subject: RE24 testing call (2.4.45) LMDB RE0.9 testing call (0.9.20) >> >> For this testing call, we particularly need folks to test OpenLDAP with >> startTLS/LDAPS when compiled against OpenSSL (both pre 1.1 series and >> with the 1.1 series). > > Compiled successfully with Gentoo linux and openSSL 1.02j/cyrus-sasl > 2.1.26, configured as: > > --prefix=/usr --build=x86_64-pc-linux-gnu --host=x86_64-pc-linux-gnu > --mandir=/usr/share/man --infodir=/usr/share/info --datadir=/usr/share > --sysconfdir=/etc --localstatedir=/var/lib --disable-dependency-tracking > --disable-silent-rules --libdir=/usr/lib64 > --libexecdir=/usr/lib64/openldap --disable-static --enable-ldap > --enable-slapd --enable-bdb --enable-hdb --enable-dnssrv=mod > --enable-ldap=mod --enable-mdb=mod --enable-meta=mod --enable-monitor=mod > --enable-null=mod --enable-passwd=mod > --enable-relay=mod --enable-shell=mod --enable-sock=mod --disable-perl > --disable-sql --disable-crypt --disable-slp --disable-lmpasswd > --enable-syslog --enable-aci --enable-cleartext --enable-modules > --enable-rewrite --enable-rlookups --enable-slapi --enable-syncprov=yes > --enable-overlays=mod --enable-ipv6 --with-cyrus-sasl --enable-spasswd > --disable-wrappers --with-tls=openssl --enable-dynamic --enable-local > --enable-proctitle --enable-shared > > make test completed successfully, is there any particular way to verify > all the tests were okay? Does the make itself fail if any of the tests > do, I did not see a summary at the end. make its was not as happy: "make test" will do a single pass through the entire test suite, for each backend. Unfortunately, that does not always catch issues. For example, the issue Dieter reported against HEAD with test061 only happens to me occassionaly. To help with that, there is the abilty to run the test suite in a loop, for a given backend. Like: quanah@ub16:~/openldap-2.4.45RC/tests$ ./run -l 500 -b mdb test061 Will run test061 500 times, using back-mdb as the backend. Instead of a specific test, one can do "all" to run everything through a loop X times. >>>>>> Starting its4326 ... > running defines.sh > Running slapadd to build slapd database... > Starting slapd on TCP/IP port 9011... > Using ldapsearch to check that slapd is running... > Starting proxy slapd on TCP/IP port 9012... > Using ldapsearch to check that proxy slapd is running... > Waiting 5 seconds for slapd to start... > Waiting 5 seconds for slapd to start... > Waiting 5 seconds for slapd to start... > Waiting 5 seconds for slapd to start... > Waiting 5 seconds for slapd to start... > Waiting 5 seconds for slapd to start... > ldapsearch failed (255)! > ./data/regressions/its4326/its4326: line 93: kill: (28780) - No such > process >>>>>> ./data/regressions/its4326/its4326 failed (exit 255) Interesting... it may be worthwhile to look in the testrun directory and see why slapd failed to launch. I'll see if I can reproduce it as well. > I see the fix for ITS8432 is included in this release (yay); I was > wondering if you've had any luck tracking down the underlying issue > behind ITS8444? So far I still haven't seen any corruption or operational > issues from it, but the rampant noise in the logs and errors being > generated are quite disconcerting :). Plus they will potentially mask any > errors that are actually indicative of a real problem. I've not been able to reproduce it. There's a regression test I wrote for it included in the RE24 source, but it's never really triggered for me. Please feel free to look it over and see if I've missed anything obvious in my reproduction attempts. :) You can execute it directly with ./run -b mdb its8444 --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Fw : backend SSL negociation timeout
by Louis Chanouha 03 Feb '17

03 Feb '17

Hello, I experience some problems with slapd-meta with ldaps backend. gnuTLS (or openssl) negociation timeout seems not to be handled, and i can't find any reference to modify this timeout on docs. My server becames unresponsive (too many connexion slots) when a ssl-secured backend server time out after TCP connexion establishment. To reproduce the error, i have an meta directory configured like this: database meta suffix "dc=localauth" rootdn "cn=Manager,dc=localauth" rootpw XXX uri "ldaps://localhost:666/ou=UT,dc=localauth" lastmod off suffixmassage "ou=UT,dc=localauth" "ou=people,dc=example,dc=fr" timeout 1 conn-ttl 1 network-timeout 1 And i launch a netcat to listen to the 666 port: nc -l -p 666 Then, this command never time out: ldapwhoami -H ldap://YYYY:9009 -D uid=me,ou=UT,dc=localauth -W Error does not happen when no ssl used ("timeout 1" option works well) OS: Debian 8 Jessie x64 slapd: 2.4.40+dfsg-1+deb8u2 gnutls: 3.3.8-6+deb8u4 Sorry for my english, and thanks for the help, Regards, Louis Chanouha University of Toulouse

1 0

RE: RE24 testing call (2.4.45) LMDB RE0.9 testing call (0.9.20)
by Quanah Gibson-Mount 02 Feb '17

02 Feb '17

--On Thursday, February 02, 2017 1:26 PM -0800 Quanah Gibson-Mount <quanah(a)symas.com> wrote: > I've not been able to reproduce it. There's a regression test I wrote > for it included in the RE24 source, but it's never really triggered for > me. Please feel free to look it over and see if I've missed anything > obvious in my reproduction attempts. :) > > You can execute it directly with ./run -b mdb its8444 Hm, actually it's only in master at the moment, since I couldn't get it to trigger. ;) But feel free to peruse it and see if I missed something. :) --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Transform accesslog database to LDIF for ldapmodify or other way
by Quanah Gibson-Mount 02 Feb '17

02 Feb '17

--On Thursday, February 02, 2017 5:51 PM +0100 Michael Wandel <m.wandel(a)t-online.de> wrote: > Great , thank you very very much > > > best regards > > Michael The canonical source can be found at: <https://github.com/quanah/ldap-tools/tree/master/a2ldif> Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Transform accesslog database to LDIF for ldapmodify or other way
by Howard Chu 02 Feb '17

02 Feb '17

Michael Wandel wrote: > Hey, > > I'm searching for a tool which is able to transform an accesslog > Database to an ldif file, what can be used for ldapmodify. > > Or is there an alternative way to use the accesslog to rebuild an ldap > database from a backup time to actual ? > > Every hint is welcome I use this perl script. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

Re: RE24 testing call (2.4.45) LMDB RE0.9 testing call (0.9.20)
by Quanah Gibson-Mount 02 Feb '17

02 Feb '17

--On Tuesday, January 31, 2017 4:13 PM -0800 Quanah Gibson-Mount <quanah(a)symas.com> wrote: >> * compilation against openssl-1.1.0d works without issues and at a first >> startup it also work :-) I'll report on further success... >> >> * but last: make test failed >> ( attached make_test_result.txt ) > > I'll see if I can repo the test058 failure. I've not been able to reproduce this with RE24 even with several hundred runs of the test. It may be timing related. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: Syncrepl refreshAndPersist provider reboot
by Howard Chu 01 Feb '17

01 Feb '17

Quanah Gibson-Mount wrote: > --On Wednesday, February 01, 2017 2:05 PM +0100 Thomas Hummel > <thomas.hummel(a)pasteur.fr> wrote: > >> Is this a normal behavior providing I'm using refreshAndPersist mode ? > > No. It is normal behavior if you didn't configure retries. Without seeing the actual config, nobody can give a definitive yes or no answer to this question. > >> I mean do we have to restart the consumers each time the provider > restarts ? > > No. But there several bugs in OpenLDAP 2.4.40 around replication, and that > release should be used with care if replication is involved. The Redhat > builds of course have additional issues. YMMV. Without seeing configs, there is no evidence of any bug being relevant. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

Re: Syncrepl refreshAndPersist provider reboot
by Quanah Gibson-Mount 01 Feb '17

01 Feb '17

--On Wednesday, February 01, 2017 5:04 PM +0100 Thomas Hummel <thomas.hummel(a)pasteur.fr> wrote: Hi Thomas, > I know. Unfortunately my distro is stuck with this version (though I see > there's a port version update right now). There's nothing that requires anyone to run the 3rd party builds from Redhat. There are significantly better options available if you require pre-built binaries, such as the LTB project builds or the binaries produced by Symas (which also has support options available). If you don't require pre-built binaries, it's also fairly trivial to package up OpenLDAP. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Syncrepl refreshAndPersist provider reboot
by Quanah Gibson-Mount 01 Feb '17

01 Feb '17

--On Wednesday, February 01, 2017 2:05 PM +0100 Thomas Hummel <thomas.hummel(a)pasteur.fr> wrote: > Is this a normal behavior providing I'm using refreshAndPersist mode ? No. > I mean do we have to restart the consumers each time the provider restarts ? No. But there several bugs in OpenLDAP 2.4.40 around replication, and that release should be used with care if replication is involved. The Redhat builds of course have additional issues. YMMV. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Syncrepl refreshAndPersist provider reboot
by Thomas Hummel 01 Feb '17

01 Feb '17

Hello, today, in a simple setup consisting of one provider and 2 syncrepl consumers [openldap-2.4.40-9 on CentOS Linux 7.2, cn=config, mdb backend, refreshAndPersist mode], I noticed that after the provider reboot (the ESX it ran on had some kind of maintenance) : - slapd service was running dans correctly responding (ldapsearch...) on the 3 servers - replication wasn't working anymore (ldapmodify on the provider not sync'ed on the consumers) Rebooting the consumers seemed to fix the problem. Is this a normal behavior providing I'm using refreshAndPersist mode ? I mean do we have to restart the consumers each time the provider restarts ? Thanks -- Thomas HUMMEL

1 0

help troubleshooting
by scar 01 Feb '17

01 Feb '17

I have inherited an LDAP server and admittedly do not have all the technical expertise to troubleshoot the problems we have. We are using slapd 2.4.40. The first problem is nobody but the rootdn can change passwords. We'd like to use "passwd" utility on our servers to change our passwords but the error is "LDAP password information update failed: Insufficient access" In slapd.conf we have (i have removed our dc for privacy): access to attrs=userPassword by self write by anonymous auth by dn="cn=Manager,dc=X,dc=Y,dc=Z" write by * none access to * by self write by dn="cn=Manager,dc=X,dc=Y,dc=Z" write by * read by * auth access to * by dn="uid=ldapadmin,dc=X,dc=Y,dc=Z" read "cn=Manager,dc=X,dc=Y,dc=Z" is our rootdn and i have enabled logleve 128 However, this brings me to the next problem: the contents of slapd.conf do not match the slapd.d/cn\=config.ldif file, so it seems the fixes i am trying to the ACL's don't have any effect, even when i restart slapd. If i try "ldapmodify -nv" it just hangs. When i try to stop slapd and remove slapd.d/* and then start slapd, the contents are recreated according to the config file, but then users can't login (all i see in the logfile is access_allowed and slap_access_allowed but no conn lines) So some basic troubleshooting help would be appreciated! Thanks

2 1

Re: RE24 testing call (2.4.45) LMDB RE0.9 testing call (0.9.20)
by Quanah Gibson-Mount 01 Feb '17

01 Feb '17

--On Tuesday, January 31, 2017 10:49 PM +0100 "A. Schulze" <sca(a)andreasschulze.de> wrote: > > > Am 30.01.2017 um 21:49 schrieb Quanah Gibson-Mount: >> Optionally, cd tests && make its run through the regression suite. > > this set of tests pass, but I noticed one line: > > ./data/regressions/its8521/its8521: 268: test: 1: unexpected operator Thanks, fixed! --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: RE24 testing call (2.4.45) LMDB RE0.9 testing call (0.9.20)
by Quanah Gibson-Mount 01 Feb '17

01 Feb '17

--On Tuesday, January 31, 2017 10:21 PM +0100 "A. Schulze" <sca(a)andreasschulze.de> wrote: > > > Am 30.01.2017 um 21:49 schrieb Quanah Gibson-Mount: >> <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=re >> fs/heads/OPENLDAP_REL_ENG_2_4;sf=tgz> >> >> Configure & build. > > * I noticed 33x "warning: unused variable" > should I write a patch? Patch + ITS would be best. ;) > * Very interesting to me how you modified my patch > http://www.openldap.org/its/index.cgi?findid=8533 ... Thanks! Thanks go to Howard. ;) > * This (and earlier) openldap-releases do not force server side cipher > preference. there is a technical simple way to achieve this: > > --- a/libraries/libldap/tls_o.c > +++ b/libraries/libldap/tls_o.c > @@ -366,6 +366,8 @@ tlso_ctx_init( struct ldapoptions *lo, s > } > } > #endif > + /* maybe some # ifdef is needed */ > + SSL_CTX_set_options( ctx, SSL_OP_CIPHER_SERVER_PREFERENCE ); > return 0; > } > > As far as I know there is no ITS item opened. It it worth to add one? I would suggest filing an ITS, yes. > * An other point I'm interested is compilation of libraries/liblmdb/mdb_* > tools. While all other binaries are build using external defined CFLAGS > and LDFLAGS "make -C libraries/liblmdb/" use other values. > > Any chance, these tools are integrated in the common build process > maybe enabled/disabled by a ./configure option? LMDB is standalone software, so it's generally designed to be buildable on its own. What CFLAGS/LDFLAGS do you feel would be necessary to pass through? > * compilation against openssl-1.1.0d works without issues and at a first > startup it also work :-) I'll report on further success... > > * but last: make test failed > ( attached make_test_result.txt ) I'll see if I can repo the test058 failure. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: RE24 testing call (2.4.45) LMDB RE0.9 testing call (0.9.20)
by Quanah Gibson-Mount 31 Jan '17

31 Jan '17

--On Tuesday, January 31, 2017 12:05 PM -0800 Quanah Gibson-Mount <quanah(a)symas.com> wrote: >> ERROR: Entry 21 not replicated to ldap://localhost:9012/! (32)! >> Error found after 1 of 1 iterations >>>>>>> test061-syncreplication-initiation failed for mdb >> (exit 1) >> Makefile:310: recipe for target 'mdb-yes' failed >> make: *** [mdb-yes] Error 1 > > Interesting -- Can you tar up the testrun directory, ftp it up, and file > an ITS with a pointer to the upload? I was able to reproduce this as well with back-mdb. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: RE24 testing call (2.4.45) LMDB RE0.9 testing call (0.9.20)
by Quanah Gibson-Mount 31 Jan '17

31 Jan '17

--On Tuesday, January 31, 2017 8:35 PM +0100 Dieter Klünter <dieter(a)dkluenter.de> wrote: > Am Mon, 30 Jan 2017 12:49:56 -0800 > schrieb Quanah Gibson-Mount <quanah(a)symas.com>: > [...] > >> Generally, get the code for RE24: >> >> <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=re >> fs/heads/OPENLDAP_REL_ENG_2_4;sf=tgz> >> >> Configure & build. >> >> Execute the test suite (via make test) after it is built. >> Optionally, cd tests && make its run through the regression suite. > > [...] > > Starting test061-syncreplication-initiation for mdb... > Running defines.sh > ... > > ERROR: Entry 21 not replicated to ldap://localhost:9012/! (32)! > Error found after 1 of 1 iterations >>>>>> test061-syncreplication-initiation failed for mdb > (exit 1) > Makefile:310: recipe for target 'mdb-yes' failed > make: *** [mdb-yes] Error 1 Interesting -- Can you tar up the testrun directory, ftp it up, and file an ITS with a pointer to the upload? Thanks, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Mirror Inquiry
by Standalone Admin 31 Jan '17

31 Jan '17

Hi Is there a need for more mirrors for OpenLDAP? If so we can host it on our server in France @1GBPS connection. Thanks, Sam

1 0

How to add index for "member" of ldap groups
by Axel Birndt 27 Jan '17

27 Jan '17

Hi @All, i'am currently searching for a possibility to add an index in openldap (cn=config backend) for the "member" of groups. In my log i got the following message: > 475 admin slapd: <= bdb_equality_candidates: (member) not indexed I found, that "member" is an attribute from an ldap group. > # Entry 1: cn=bind_users,ou=admins,ou=groups,dc=company,dc=de > dn: cn=bind_users,ou=admins,ou=groups,dc=company,dc=de > cn: bind_users > member: cn=apachebind,ou=apache_technical,ou=users,dc=company,dc=de > member: cn=wordpressbind1,ou=wordpress_bind,ou=users,dc=company,dc=de > objectclass: groupOfNames > objectclass: top How could i add an index for this attribute? I searched with google and found: http://www.openldap.org/faq/data/cache/136.html https://wiki.debian.org/LDAP/OpenLDAPSetup http://www.openldap.org/doc/admin24/slapdconf2.html and so on... With this information i already added indices for > # Entry 1: olcDatabase={1}hdb,cn=config > dn: olcDatabase={1}hdb,cn=config > objectclass: olcDatabaseConfig > objectclass: olcHdbConfig > olcdbindex: objectClass eq > olcdbindex: cn pres,sub,eq > olcdbindex: sn pres,sub,eq > olcdbindex: uid pres,sub,eq > olcdbindex: displayName pres,sub,eq > olcdbindex: default sub > olcdbindex: uidNumber eq > olcdbindex: gidNumber eq > olcdbindex: mail,givenName eq,subinitial > olcdbindex: dc eq If i try to add a new index "olcdbindex: member pres,sub,eq" i got an failure Could not perform ldap_modify operation. LDAP said: Other (e.g., implementation specific) error Error number: 0x50 (LDAP_OTHER) Is anyone able to give me a hint, where i could find more information or help me to find the right search key words? -- Gruß/Kind regards Axel ------------------------------

2 2

Re: Antw: How to add index for "member" of ldap groups
by Axel Birndt 27 Jan '17

27 Jan '17

Am 27.01.2017 um 08:24 schrieb Ulrich Windl: >>>> Axel Birndt <towerlexa(a)gmx.de> schrieb am 26.01.2017 um 22:17 in Nachricht > <858439a0-ab4f-cea3-f5ea-9b8f3514d08b(a)gmx.de>: >> Hi @All, >> >> i'am currently searching for a possibility to add an index in openldap >> (cn=config backend) for the "member" of groups. >> >> In my log i got the following message: >> >> > 475 admin slapd: <= bdb_equality_candidates: (member) not indexed >> >> I found, that "member" is an attribute from an ldap group. >> >> > # Entry 1: cn=bind_users,ou=admins,ou=groups,dc=company,dc=de >> > dn: cn=bind_users,ou=admins,ou=groups,dc=company,dc=de >> > cn: bind_users >> > member: cn=apachebind,ou=apache_technical,ou=users,dc=company,dc=de >> > member: cn=wordpressbind1,ou=wordpress_bind,ou=users,dc=company,dc=de >> > objectclass: groupOfNames >> > objectclass: top >> >> How could i add an index for this attribute? > > Maybe via LDIF: > dn: olcDatabase={1}hdb,cn=config > changetype: modify > add: olcDbIndex > olcDbIndex: member eq > Hi Ulrich, thanks for your hint! I could solve it with your LDIF snippet! -------------- dn: olcDatabase={1}hdb,cn=config changetype: modify add: olcDbIndex olcDbIndex: member eq ------------------ It is running fine: -------------------------- abirndt@admin:~/openldap$ sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f olcDbIndex_member.ldif [sudo] password for abirndt: SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "olcDatabase={1}hdb,cn=config" --------------------- -- Gruß/Kind regards Axel ------------------------------

1 0

Re: Difference between root and directory manager
by Quanah Gibson-Mount 27 Jan '17

27 Jan '17

--On Thursday, January 26, 2017 5:53 PM +0300 Tamer Ataol <ataoltamer(a)gmail.com> wrote: > > > > Hi, > > Can you explain the difference between root user of openldap and > directory manager? Specifically where do we use the root user and > password in openldap administration? Hi, Your question makes little sense. "root" is a unix user. It may or may not (depending on the slapd configuration) have the ability to directly manipulate data in the LDAP server. That would depend entirely on your configuration. There is no such thing as a specific "directory manager". There /may/ be a rootdn defined for the various databases, that may or may not be identical per database. There may also be access rules that allow other DNs to provide management functions. Without details on your configuration/setup, there's no way to answer your question. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Has anybody benchmarked OpenLDAP as an Object Storage Service?
by Howard Chu 26 Jan '17

26 Jan '17

John Lewis wrote: > I am wondering if anybody has benchmarked OpenLDAP as a generic network object > storage service. I know Networked Key Value Databases are getting more popular > because they seem to scale laterally better. Probably nothing recent. Back in the CORBA days it was probably a frequent event. > Most of the so called NoSQL databases use some kind of JSON over HTTPS network > transport. I like the idea of using something LDAP based because of the IETF > standardized interface lowers the risk of sudden changes to the interface > forcing a program change, kind of like how Microsoft broke Skype calls for > Blog Talk Radio. LDAP isn't a Key/Value database; it could be used as one but there would be a lot of unnecessary overhead - much like using SQL as only a Key/Value database. The value in using LDAP comes from mapping an application's higher level data model onto LDAP entries. Not just individual keys and blob values. > I know Howard Chu has been reporting a lot of awful but true things about > MongoDB over the last couple of years. > https://twitter.com/hyc_symas/status/664197817498509312 > https://twitter.com/hyc_symas/status/740339320645689344 > https://twitter.com/hyc_symas/status/817696625313349632 > > What I would really want to see is some numbers comparing OpenLDAP to > networked key value databases that are in production such as Reddit's two > table Postgres > <https://kev.inburke.com/kevin/reddits-database-has-two-tables/> or Redis or > even HBase from Hadoop. Could probably rig up a YCSB test without too much trouble. Frankly though I've got very low confidence in any java-based benchmark utility. Our experience with java-based SLAMD over the years has shown that it vastly underreports OpenLDAP's performance simply because SLAMD/java are not efficient enough to drive high enough loads at slapd. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Difference between root and directory manager
by Tamer Ataol 26 Jan '17

26 Jan '17

Hi, Can you explain the difference between root user of openldap and directory manager? Specifically where do we use the root user and password in openldap administration? Thanks.

1 0

Has anybody benchmarked OpenLDAP as an Object Storage Service?
by John Lewis 26 Jan '17

26 Jan '17

I am wondering if anybody has benchmarked OpenLDAP as a generic network object storage service. I know Networked Key Value Databases are getting more popular because they seem to scale laterally better. Most of the so called NoSQL databases use some kind of JSON over HTTPS network transport. I like the idea of using something LDAP based because of the IETF standardized interface lowers the risk of sudden changes to the interface forcing a program change, kind of like how Microsoft broke Skype calls for Blog Talk Radio. I know Howard Chu has been reporting a lot of awful but true things about MongoDB over the last couple of years. https://twitter.com/hyc_symas/status/664197817498509312 https://twitter.com/hyc_symas/status/740339320645689344 https://twitter.com/hyc_symas/status/817696625313349632 What I would really want to see is some numbers comparing OpenLDAP to networked key value databases that are in production such as Reddit's two table Postgres <https://kev.inburke.com/kevin/reddits-database-has-two-tables/> or Redis or even HBase from Hadoop.

1 0

RE: BDB Backend: How to force transaction log rotation for log archival based on db_archive
by Reiterer, Horst 25 Jan '17

25 Jan '17

Hi, > Is there a way to force a transaction log rotation to make sure that even changes that do not cause > a new transaction log to be created will get archived at regular intervals? It can be done but the scenario definitely requires code to do so. The internal function __log_newfile can be used to switch to a new log file. After a checkpoint, the old log file will become unused and eligible for archiving. Cheers, Horst

1 0

BDB Backend: How to force transaction log rotation for log archival based on db_archive
by Reiterer, Horst 24 Jan '17

24 Jan '17

Hi, I use OpenLDAP with the Berkeley DB backend and db_archive to move unused transaction logs to a backup location for the purpose of disaster recovery. The intention is to reduce the data loss window to N minutes. Consequently, I execute db_archive every N minutes. If the transaction throughput is high enough so that the maximum transaction log size causes a new transaction log to be created and database checkpoints occur that cause the old log to become unused, that strategy works as expected. If, however, the throughput is minimal, archiving would only occur once the maximum transaction log size is hit and a checkpoint frees the old log. Consequently, those changes cannot be restored because logs are not being archived. Is there a way to force a transaction log rotation to make sure that even changes that do not cause a new transaction log to be created will get archived at regular intervals? By reducing the maximum transaction log size, the situation could be improved but not resolved. All I can come up with is forcing a rotation by writing a custom appropriately sized transaction log entry using the Berkeley DB API DB_ENV->log_put() before triggering a checkpoint and calling db_archive but that still doesn't sound like a production-ready solution. Thanks in advance for any additional info on this subject! Cheers, Horst

1 0

Re: Deleting an user defined object class from openldap 2.4.40
by Quanah Gibson-Mount 24 Jan '17

24 Jan '17

--On Monday, January 23, 2017 4:35 PM +0300 Tamer Ataol <ataoltamer(a)gmail.com> wrote: > Hi, > > I used the below ldif file to add a user defined objectclass in my > openldap 2.4.40 on CentOS 7. Delete support for cn=config will be a part of the OpenLDAP 2.5 release series, as documented. You will need to slapcat your config DB, remove the offending entries, and slapadd it back. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: use proprietary password hash in "userpassword"
by Quanah Gibson-Mount 24 Jan '17

24 Jan '17

--On Tuesday, January 24, 2017 1:28 PM +0100 Meike Stone <meike.stone(a)googlemail.com> wrote: >>> I don't have to recompile the whole openldap, compiling the module is >>> sufficient? >>> >>> (1) we think about a subscription from symas ... >> >> >> Correct. Any distributor (symas included) should include a development >> package that allows the ability to rebuild a module without rebuilding >> everything. >> > > Ah, ok - it works :-D > If I use a own compiled module and I bought a gold subscription, does > Symas still give full support? Hi Meike, Most often the answer is yes. You would need to work out those details in full as part of the contractual process. You would need to recompile your module against the Symas devel package, as some of the internal structs are larger in the Symas OpenLDAP build. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical