- openldap-technical - openldap.org

Re: organizationIdentifier ATTRIBUTE mapping
by Quanah Gibson-Mount 24 Jan '17

24 Jan '17

--On Wednesday, January 18, 2017 10:59 AM +0000 Francesco Sordi <f_sordi_1(a)yahoo.it> wrote: > attributeType ( id-at-organizationIdentifier > NAME 'organizationIdentifier' > DESC 'X520 attribute Organization Identifier' > SUP name > EQUALITY caseIgnoreMatch > SUBSTR caseIgnoreSubstringsMatch SINGLE-VALUE ) > > > But i cannot understand which objectclass can use this attribute and how > to add an object using it. You would need to create a custom objectClass that allows this attribute. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

4 8

fresh (distro's) installation and cn=config password
by lejeczek 24 Jan '17

24 Jan '17

hi everybody, this must be one of the most ancient questions - but browsing (centos') local docs reveal nothing. I'd imagine passwords is that first & most important thing everybody does to make sure slapd is secured, something like "mysql_secure_installation" I'm trying to do something I'd think is simple and should just work, but, I'm wrong, so I do: slapadd -v -n0 <<EOL dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootDN: cn=admin,cn=config olcRootPW:: exxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx EOL and I get in return: slapadd: could not add entry dn="olcDatabase={0}config,cn=config" (line=1): autocreation of "olcDatabase={-1}frontend" failed So that question - how does one secure ldap installation? But I'd insist on not referring something like "slaptest and convert old school to ..." or .. edit config file(s) What I think is - I have a clean installation which is configured in probably best possible way but missing is: olcRootDN, olcRootPW How to use slapadd for it? Is slapadd not the right tool for this? many thanks, L.

3 2

MDB map size = maxsize ?
by Tamás Rébeli-Szabó 24 Jan '17

24 Jan '17

Hello, we are using 2.4.41, and have run into MDB_MAP_FULL: Environment mapsize limit reached(-30792) " Checking database size we see: [openldap@soa-srv]$ grep maxsize slapd.conf maxsize 4294967296 [openldap@soa-srv]$ mdb_stat -e openldap-data Environment Info Map address: (nil) Map size: 1073741824 I was under the impression that maxsize is the same as map size. However, map size here is 1GB, whereas maxsize is 4GB, even after slapd is restarted. Why this apparent discrepancy? Thanks, tamas

2 1

Re: use proprietary password hash in "userpassword"
by Meike Stone 24 Jan '17

24 Jan '17

>> I don't have to recompile the whole openldap, compiling the module is >> sufficient? >> >> (1) we think about a subscription from symas ... > > > Correct. Any distributor (symas included) should include a development > package that allows the ability to rebuild a module without rebuilding > everything. > Ah, ok - it works :-D If I use a own compiled module and I bought a gold subscription, does Symas still give full support? Thanks Meike

1 0

Re: fresh (distro's) installation and cn=config password
by Ulrich Windl 24 Jan '17

24 Jan '17

(Copy for the list) >>> Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de> schrieb am 24.01.2017 um 13:19 in Nachricht <58875475.ED38.00A1.0(a)rz.uni-regensburg.de>: >>>> lejeczek <peljasz(a)yahoo.co.uk> schrieb am 23.01.2017 um 17:59 in Nachricht > <ff479edd-d352-2357-9275-9a66ed520be0(a)yahoo.co.uk>: > > hi everybody, > > this must be one of the most ancient questions - but > > browsing (centos') local docs reveal nothing. > > I'd imagine passwords is that first & most important thing > > everybody does to make sure slapd is secured, something like > > "mysql_secure_installation" > > > > I'm trying to do something I'd think is simple and should > > just work, but, I'm wrong, so I do: > > > > slapadd -v -n0 <<EOL > > dn: olcDatabase={0}config,cn=config > > objectClass: olcDatabaseConfig > > olcDatabase: {0}config > > > > olcRootDN: cn=admin,cn=config > > olcRootPW:: exxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx > > > > EOL > > > > and I get in return: > > slapadd: could not add entry > > dn="olcDatabase={0}config,cn=config" (line=1): autocreation > > of "olcDatabase={-1}frontend" failed > > What about: > dn: cn=config > objectClass: olcGlobal > cn: config > [...] > dn: cn=schema,cn=config > objectClass: olcSchemaConfig > cn: schema > [...] > dn: olcDatabase={-1}frontend,cn=config > objectClass: olcDatabaseConfig > olcAccess: ... > [...] > dn: olcDatabase={0}config,cn=config > objectClass: olcDatabaseConfig > olcDatabase: {0}config > olcAccess: ... > [...] > olcRootDN: cn=config > olcRootPW: {SSHA}... > > Regards, > Ulrich > > > > > So that question - how does one secure ldap installation? > > But I'd insist on not referring something like "slaptest and > > convert old school to ..." or .. edit config file(s) > > What I think is - I have a clean installation which is > > configured in probably best possible way but missing is: > > olcRootDN, olcRootPW > > How to use slapadd for it? Is slapadd not the right tool for > > this? > > > > many thanks, > > L. > > > >

1 0

Re: openldap slowness after restoration
by Quanah Gibson-Mount 23 Jan '17

23 Jan '17

--On Thursday, January 19, 2017 2:43 PM +0530 PRATIK SINGAL <pratik.singal13(a)gmail.com> wrote: > > Hello all, > > > After performing restoration the openldap server is performing slow. > > > openldap 2.4.40 with bdb. > > > Can any one suggest me on what to check which might cause the slowness. Using bdb will certainly cause slowness. I would note that to tune BDB is generally a dark art. You would be better served running a current version of OpenLDAP and using the back-mdb backend, which does not require fine tuning to be performant. Overall, you do not provide any of the necessary information to really provide any type of useful information on how to proceed. What does "slowness" even mean? I.e., how are you measuring "slowness" and where/how are you seeing it? Have you set up a DB_CONFIG file for BDB that is appropriate for your deployment? Have you tuned the various bits in slapd that's necessary on top of DB_CONFIG to correctly run a system with a BDB based backend? etc. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: use proprietary password hash in "userpassword"
by Quanah Gibson-Mount 23 Jan '17

23 Jan '17

--On Monday, January 23, 2017 10:45 AM +0100 Meike Stone <meike.stone(a)googlemail.com> wrote: > 2017-01-19 12:31 GMT+01:00 Howard Chu <hyc(a)symas.com>: >> Meike Stone wrote: >>> > >>> Write a openldap modul like pw-sha2 is not the first choice, because >>> we need to compile the openldap after each update on our own and that >>> prevents us to use the distribution packages. >> >> >> Writing an OpenLDAP module like pw-sha2 is precisely the way to write a >> small external binary to validate passwords. >> >> There's no need to recompile all of OpenLDAP just to update a password >> module. > > If I use the binary openldap package from the distributor (*1), and I > like to use a own module, > I don't have to recompile the whole openldap, compiling the module is > sufficient? > > (1) we think about a subscription from symas ... Correct. Any distributor (symas included) should include a development package that allows the ability to rebuild a module without rebuilding everything. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: ContextCSN values in 3-multimaster setup
by Quanah Gibson-Mount 23 Jan '17

23 Jan '17

--On Thursday, January 19, 2017 3:36 PM +0100 Marc Franquesa <mark(a)l3jane.net> wrote: >> I can assume some downtime and be in safe place. My idea was to proceed > as follows: > > - Take slapcat Backup of all DITs (including cn=config) > - Remove any contextCSN attribute from the resulting LDIFs > - Stop all 3 servers > - Remove entirely the DBs on the servers > - Do a slapadd of the previous LDIFs > - Start servers again (so re-replicating again with new contextCSN, now > corret). > > Should that work ? even for cn=config DB ? That will not work. As I explained previously, the contextCSN values are generated from the entryCSN values in your database. Removing the contextCSN values will have no effect if there still exist entries in your database with an entryCSN of serverID's you have since gotten rid of. There is also no point in dumping cn=config and doing any work on it, as it clearly has the correct values (as per your later data). > Also to further confuse a bit more the scenario, today I realized that > a new contextCSN appeared: > > dn: dc=l3jane,dc=net > contextCSN: 20170111084028.692133Z#000000#001#000000 > contextCSN: 20170118224410.110554Z#000000#003#000000 > contextCSN: 20161228225757.121969Z#000000#004#000000 > contextCSN: 20160201102250.543748Z#000000#005#000000 > contextCSN: 20150917152138.054326Z#000000#006#000000 That would mean a modification came in from a serverID where previously there had been no modifications from that serverID. > Also the explanation that conextCSN attribute is = > contextCSN#rid#sid#000000 seem not correct as I have rids 001, 002 and > 003, and serverIds 1,2,3 so none of this matches with my results. I'm not clear what you mean. Your results clearly show that in the course of time you have had servers with serverIDs of 1, 3, 4, 5, and 6 that have received modifications. A contextCSN for a given SID will *only* show up if a modification was ever performed on the server with that given SID (thus causing an entryCSN value to be generated for that SID). > But I get this contextCSN values: > > dn: cn=config > contextCSN: 20170111084531.247823Z#000000#001#000000 > contextCSN: 20161230165409.486624Z#000000#003#000000 > > Si I'm missing one contextCSN? (there are 3 providers) ? No. See above. ># ldapsearch -LLL -x -s base contextCSN > dn: dc=l3jane,dc=net > contextCSN: 20170111084028.692133Z#000000#001#000000 > contextCSN: 20170118224410.110554Z#000000#003#000000 > contextCSN: 20161228225757.121969Z#000000#004#000000 > contextCSN: 20160201102250.543748Z#000000#005#000000 > contextCSN: 20150917152138.054326Z#000000#006#000000 See above. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

using two password hashes
by Meike Stone 23 Jan '17

23 Jan '17

Hello, the userPassword is a multivalued attribute. If there are set two values with different schemes, how will openldap handle the request? Will only checked one password and if it is wrong, the access will be declined or will openldap proceed to the second password hash? If both userPassword schemes differs, which one will be used first? Is the handling configurable? thank you Meike

1 0

Permission issue for normal user with ldap_add
by vvv jjj 23 Jan '17

23 Jan '17

Hi OpenLDAP team, I'm new to openLDAP. So this could be a trivial question, please let me know if I missed anything. I'm trying to add entries to "dc=example,dc=com" using ldap_add. It is working fine for super user (root), but we are getting permission error for normal user (non root). I'm able to update with ldap_modify for normal user. Could you please let me know how can we give permissions to any specific user to add entries using ldap_add. Thanks in advance. Regards J.Visu

4 3

Deleting an user defined object class from openldap 2.4.40
by Tamer Ataol 23 Jan '17

23 Jan '17

Hi, I used the below ldif file to add a user defined objectclass in my openldap 2.4.40 on CentOS 7. ----------------------------------------------------------------------- dn: cn={12}ng911,cn=schema,cn=config changetype: add objectClass: olcSchemaConfig cn: ng911 dn: cn={12}ng911,cn=schema,cn=config changetype: modify add: olcAttributeTypes olcAttributeTypes: ( 1.3.6.1.4.1.42.2.27.4.1.6.8.12 NAME 'cityCode' DESC 'city plate' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 ) olcAttributeTypes: ( 1.3.6.1.4.1.42.2.27.4.1.6.8.14 NAME 'identityNumber' DESC 'id number' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 ) olcAttributeTypes: ( 1.3.6.1.4.1.42.2.27.4.1.6.8.16 NAME 'institutionName' DESC 'institution name' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: ( 1.3.6.1.4.1.42.2.27.4.1.6.8.18 NAME 'phoneNumber' DESC 'phone' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 ) olcAttributeTypes: ( 1.3.6.1.4.1.42.2.27.4.1.6.8.20 NAME 'agentId' DESC 'agent id' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 ) olcAttributeTypes: ( 1.3.6.1.4.1.42.2.27.4.1.6.8.22 NAME 'agentPassword' DESC 'agent passwd' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.4203.1.1.2 ) - add: olcObjectClasses olcObjectClasses: ( 1.3.6.1.4.1.42.2.27.4.3.6 NAME 'ng911' DESC 'Container for ng911 object' SUP inetOrgPerson MAY ( cityCode $ identityNumber $ institutionName $ phoneNumber & agentId & agentPassword ) ) ----------------------------------------------------------------- And then I run the command on the server ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f extendtong911.ldif The addition was ok. But I made a mistake and run the same command again which added another copy of the objectclass. The result of the command below is given underneath it ldapsearch -LLL -Y EXTERNAL -H ldapi:/// -b cn=schema,cn=config cn ----------------------------------------------------------------- dn: cn=schema,cn=config cn: schema dn: cn={0}core,cn=schema,cn=config cn: {0}core dn: cn={1}cosine,cn=schema,cn=config cn: {1}cosine dn: cn={2}nis,cn=schema,cn=config cn: {2}nis dn: cn={3}inetorgperson,cn=schema,cn=config cn: {3}inetorgperson dn: cn={4}ng911,cn=schema,cn=config cn: {4}ng911 cn: {12}ng911 dn: cn={5}ng911,cn=schema,cn=config cn: {5}ng911 cn: {12}ng911 ----------------------------------------------------------------- Now, I want to delete the second objectclass created. For this I created an ldif file with the contents as below: ----------------------------------------------------------------- dn: cn={5}ng911,cn=schema,cn=config changetype: modify delete: olcObjectClasses olcObjectClasses: ( 1.3.6.1.4.1.42.2.27.4.3.6 NAME 'ng911' DESC 'Container for ng911 object' SUP inetOrgPerson MAY ( cityCode $ identityNumber $ institutionName $ phoneNumber & agentId & agentPassword ) ) ----------------------------------------------------------------- And I run the command ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f deleteng911.ldif on the server. The result is: ----------------------------------------------------------------- modifying entry "cn={5}ng911,cn=schema,cn=config" ldap_modify: No such attribute (16) additional info: modify/delete: olcObjectClasses: no such attribute ----------------------------------------------------------------- When I change {5} to {12} I get ----------------------------------------------------------------- modifying entry "cn={12}ng911,cn=schema,cn=config" ldap_modify: No such object (32) matched DN: cn=schema,cn=config ----------------------------------------------------------------- I tried many modifications of the ldif file but couldn't succeed. Can you help me writing the right ldif file for deletion of an objectclass? Thanks. Tamer

1 0

organizationIdentifier ATTRIBUTE mapping
by Francesco Sordi 23 Jan '17

23 Jan '17

Hi,I am trying to define into a custom schema the organizationIdentifier attribute, as defined in the doc of ITU x.520 standards: organizationIdentifier ATTRIBUTE ::= { WITH SYNTAX UnboundedDirectoryString EQUALITY MATCHING RULE caseIgnoreMatch SUBSTRINGS MATCHING RULE caseIgnoreSubstringsMatch SINGLE VALUE TRUE LDAP-SYNTAX directoryString.&id LDAP-NAME {"organizationIdentifier"} ID id-at-organizationIdentifier }I managed to start slapd by inserting into a custom schema this: objectidentifier id-at-organizationIdentifier 2.5.4.97 attributeType ( id-at-organizationIdentifier NAME 'organizationIdentifier' DESC 'X520 attribute Organization Identifier' SUP name EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SINGLE-VALUE ) But i cannot understand which objectclass can use this attribute and how to add an object using it.

2 2

openldap slowness after restoration
by PRATIK SINGAL 23 Jan '17

23 Jan '17

Hello all, After performing restoration the openldap server is performing slow. openldap 2.4.40 with bdb. Can any one suggest me on what to check which might cause the slowness. Regards, Pratik

2 1

Re: use proprietary password hash in "userpassword"
by Howard Chu 23 Jan '17

23 Jan '17

Meike Stone wrote: > Hello dear list, > > we like to migrate an a user database from SQL to LDAP and need to > take over the user passwords. > Problem is, the passwords are hashed by an known but proprietary algorithm. > Is there a possibility, to write an small external binary, that is > used by slapd to validate these passwords? (Maybe, we import that in a > own attribute?) > After password change, we want write a ssha hash, so that we can > disable this external binary... > > Write a openldap modul like pw-sha2 is not the first choice, because > we need to compile the openldap after each update on our own and that > prevents us to use the distribution packages. Writing an OpenLDAP module like pw-sha2 is precisely the way to write a small external binary to validate passwords. There's no need to recompile all of OpenLDAP just to update a password module. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

LDAP search rule to find group owners
by Philip Colmer 20 Jan '17

20 Jan '17

We've got LDAP ACLs to restrict who can make changes to a group, like this one: to dn.sub="ou=groups,dc=example,dc=com" by dnattr="owner" write by set="this/owner/member & user" write by users none by * none so that both direct owners and people in groups that are owners can modify the group they own. This works really well but now I want to list all of the groups that a DN matches against as an owner. For direct owners, that is simple enough, but where someone is in a group and that group is an owner, it becomes trickier. Is there a way of performing an LDAP search that does the equivalent of the ACL (or something like it) to tell me which groups can be written to for a given DN? Regards Philip

3 2

Slapd.conf for doing stress
by PRATIK SINGAL 20 Jan '17

20 Jan '17

Hello , Am new to openldap and need to perform stress on openldap2.4. Can any one please provide me with some usefull link / optimized conf file for stress. we are using Berkley DB. Regards, Pratik

3 2

Re: Antw: Re: slapd-meta with olc
by Martin Stejskal 20 Jan '17

20 Jan '17

Hi Ulrich, I totally agree, but I wanted to show "quick and dirty" way. Sometimes you just need to test something, and when everything works it is time to play around ;) Hey Ryan, thanks for advice. Today I played with "osixia/openldap" docker image and at the end of the day I was able to make it work. Just for reference, I'm sending modified part of ".config" file. ====================================================== include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/openldap.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema//ppolicy.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args #ldapmod#modulepath ../servers/slapd/back-ldap/ #ldapmod#moduleload back_ldap.la #metamod#modulepath ../servers/slapd/back-meta/ #metamod#moduleload back_meta.la #monitormod#modulepath ../servers/slapd/back-monitor/ #monitormod#moduleload back_monitor.la modulepath /usr/lib/ldap/ moduleload back_meta.la moduleload rwm.la moduleload back_ldap.la ====================================================== Then just delete old slapd.d and convert .config to slapd.d directory and it is work. But still, it is not proper way through slapadd/slapmodify, which I'm looking for. Best regards Martin Stejskal ________________________________ From: Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de> Sent: 19 January 2017 08:45:43 To: Martin Stejskal; openldap-technical(a)openldap.org; michael(a)stroeder.com Subject: Antw: Re: slapd-meta with olc >>> Martin Stejskal <mstejskal(a)alps.cz> schrieb am 17.01.2017 um 09:08 in Nachricht <OS2PR01MB02343BFA404E587BC43468B9B37C0(a)OS2PR01MB0234.jpnprd01.prod.outlook.com> [...] > 3) Simply remove (3A) or configure (3B) "apparmor" to avoid strange start > failure and another "permission denied" errors. Choice is up to you > (security vs convenience) > > 3A) Remove apparrmor > $ sudo apt remove apparmor > > 3B) Configure apparmor [...] I'd recommend to change the "enforce mode" for slapd to "complain mode". Then updating the apparmor profile can be done with the tools provided. Alternatively remove the profile for slapd in apparmor. I would not remove the whole package, because then no appliocation can/will be protected. Regards, Ulrich

1 1

Re: Replication issue in 2.4
by Quanah Gibson-Mount 19 Jan '17

19 Jan '17

--On Thursday, January 19, 2017 10:14 AM +0100 Dieter Klünter <dieter(a)dkluenter.de> wrote: > Am Tue, 17 Jan 2017 18:07:33 +0530 > schrieb PRATIK SINGAL <pratik.singal13(a)gmail.com>: > >> Hello , >> >> Can any one please help me with this.Am using BDB and openldap 2.4 >> with multi master replication >> below is my slapd.conf for replication >> >> syncRepl rid=000 >> provider=ldap://host1:389 >> type=refreshAndPersist >> retry="5 + 5 +" >> searchbase="dc=example,dc=com" >> attrs=* > > operational attributes should also be synchronized. Or to expand a bit, don't define the attrs= bit at all. Just go with the default. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: ContextCSN values in 3-multimaster setup
by Quanah Gibson-Mount 19 Jan '17

19 Jan '17

--On Tuesday, January 17, 2017 2:11 PM +0100 Marc Franquesa <mark(a)l3jane.net> wrote: > In the past I migrated some server, added some other node so is > possible that a 'ghost' provider CSN is still on the DB ? Yes. If you have any entries still in the DB that have an entryCSN from your old provider, it will be a valid contextCSN value. If you want that contextCSN gone, you'll need to slapcat your database and modify the LDIF accordingly before re-importing. I assume that was serverID 006, you would want to find all instances of #006# and replace them with one of #001#, #004#, or #005# (so they are consistent) and then reload all servers. Hope that helps. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

use proprietary password hash in "userpassword"
by Meike Stone 19 Jan '17

19 Jan '17

Hello dear list, we like to migrate an a user database from SQL to LDAP and need to take over the user passwords. Problem is, the passwords are hashed by an known but proprietary algorithm. Is there a possibility, to write an small external binary, that is used by slapd to validate these passwords? (Maybe, we import that in a own attribute?) After password change, we want write a ssha hash, so that we can disable this external binary... Write a openldap modul like pw-sha2 is not the first choice, because we need to compile the openldap after each update on our own and that prevents us to use the distribution packages. Thanks for help, kindly regards Meike

2 1

Replication issue in 2.4
by PRATIK SINGAL 19 Jan '17

19 Jan '17

Hello , Can any one please help me with this.Am using BDB and openldap 2.4 with multi master replication below is my slapd.conf for replication syncRepl rid=000 provider=ldap://host1:389 type=refreshAndPersist retry="5 + 5 +" searchbase="dc=example,dc=com" attrs=* interval=00:00:00:05 schemachecking=on bindmethod=simple binddn="cn=Manager,dc=example,dc=com" credentials=password when the database are empty and i try to import a ldif the replication is working fine.But after that when i add few records in one ldap its not getting replicated to another.below is the difference in contextCSN ldapsearch -x -u -h<host2> -b "dc=example,dc=com" -s base contextCSN -LLL dn: dc=example,dc=com ufn: example.com contextCSN: 20150604060008.504258Z#000000#000#000000 contextCSN: 20170117173528.506070Z#000000#001#000000 contextCSN: 20170117182158.011615Z#000000#002#000000 ldapsearch -x -u -h<host1> -b "dc=example,dc=com" -s base contextCSN -LLL dn: dc=example,dc=com ufn: example.com contextCSN: 20150604060008.504258Z#000000#000#000000 contextCSN: 20170117174748.128319Z#000000#001#000000 contextCSN: 20170117182127.009918Z#000000#002#000000 *Can any one please help me on how to make the sync speedup or any other parameter that i need to tweak.* Regards, Pratik

2 1

Re: Antw: Re: ContextCSN values in 3-multimaster setup
by Quanah Gibson-Mount 19 Jan '17

19 Jan '17

--On Thursday, January 19, 2017 8:50 AM +0100 Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de> wrote: > Can't it be done online (using ldapmodify), and wouldn't it be > re-replicated back? It won't remove the contextCSN from the root entry if you do it online. I missed noting that step was necessary as well. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: ContextCSN values in 3-multimaster setup
by PRATIK SINGAL 19 Jan '17

19 Jan '17

Hi if you are using syncReply then its ideally contextcsn#rid#sid#00000# also you can have a look at slap -c option you get some more idea about it. Regards, Pratik On 19-Jan-2017 03:29, "Marc Franquesa" <mark(a)l3jane.net> wrote: Hi all I finally got working a new setup with 3-node multimaster replication for both the main DIT and cn=config tree. Now I'm trying to monitor the replication status or all the nodes so I focused on examining the contextCSN value of the root of the DBs, and although I googled and reviewed other posts on the mailing list I'm still not sure to understand correctly its use. As far as I understood (please correct me if I'm wrong): - Each DB backend which is replicated will have its own and independent contextCSN at the root of the replicated DN (so I have 2 DBs: cn=config, and dc=domain,dc=net, each one will have its own contextCSN attribute). - Each master which is running as a sync provider will update one value on the contextCSN values. So, as I have multi-master replication between 3 nodes (3 providers), I should have 3 different values of contextCSN in each DB. ... so, why I'm seeing 4 values (identical on all servers as they are in sync): contextcsn: 20170111084028.692133Z#000000#001#000000 contextcsn: 20161228225757.121969Z#000000#004#000000 contextcsn: 20160201102250.543748Z#000000#005#000000 contextcsn: 20150917152138.054326Z#000000#006#000000 In the past I migrated some server, added some other node so is possible that a 'ghost' provider CSN is still on the DB ? Another point is the syntax of that value... Has any special meaning? It seems that the first part is a timestamp with milisecond resolution, but I would like to know the meaning of the 3 digits between #xxx# Are they the ServerId ? or the rid in the replication ? Please enlight me Thanks for any details

1 0

Re: Replication issue in 2.4
by Quanah Gibson-Mount 18 Jan '17

18 Jan '17

--On Tuesday, January 17, 2017 6:07 PM +0530 PRATIK SINGAL <pratik.singal13(a)gmail.com> wrote: > > Hello , > > > Can any one please help me with this.Am using BDB and openldap 2.4 with > multi master replication > below is my slapd.conf for replication OpenLDAP version? There are many point releases in the 2.4 series. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: slapd-meta with olc
by Quanah Gibson-Mount 18 Jan '17

18 Jan '17

--On Wednesday, January 11, 2017 10:23 AM +0000 Martin Stejskal <mstejskal(a)alps.cz> wrote: I'll fix this LDIF for you, although I don't know the answers to the rest of your questions. > $ cat add_meta_backend.ldif > dn: cn=module{},cn=config > objectClass: olcModuleList > cn: module{} > olcModulePath: /usr/lib/ldap > olcModuleLoad: back_meta > olcModuleLoad: back_ldap > olcModuleLoad: rwm As for olc attribute names, you can trivially grab these out of the source code. Or, you can use slaptest to convert a slapd.conf to cn=config to see the corresponding configuration. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

4 5

Odd ldapsearch behavior
by Frank Swasey 18 Jan '17

18 Jan '17

I have discovered that I have a development server that is giving back multiple copies of the entryDN and subschemaSubentry values when operational attributes are requested. However, my production server (running the same locally compiled version of 2.4.44) does not. My question is what the dickens have I misconfigured that would cause this? Examples: $ ldapsearch -x -H ldaps://production_server -D cn=manager,dc=example,dc=com -y password_file -b 'dc=example,dc=com' -s base '(objectclass=*)' '+' dn: dc=example,dc=com creatorsName: cn=Manager,dc=example,dc=com createTimestamp: 20020531160527Z modifiersName: cn=Manager,dc=example,dc=com modifyTimestamp: 20020531160527Z structuralObjectClass: organization entryUUID: b745df88-a640-1027-9374-fb1dd3799b92 entryCSN: 20031108140804.000000Z#000017#000#000000 contextCSN: 20161004102449.402212Z#000000#000#000000 contextCSN: 20170111164206.727511Z#000000#001#000000 contextCSN: 20161219150039.213065Z#000000#002#000000 entryDN: dc=example,dc=com subschemaSubentry: cn=Subschema auditContext: cn=accesslog hasSubordinates: TRUE $ ldapsearch -x -H ldaps://development_server -D cn=manager,dc=example,dc=com -y password_file -b 'dc=example,dc=com' -s base '(objectclass=*)' '+' dn: dc=example,dc=com creatorsName: cn=Manager,dc=example,dc=com createTimestamp: 20020531160527Z modifiersName: cn=Manager,dc=example,dc=com modifyTimestamp: 20020531160527Z structuralObjectClass: organization entryUUID: b745df88-a640-1027-9374-fb1dd3799b92 entryCSN: 20031108140804.000000Z#000017#000#000000 contextCSN: 20161004102449.402212Z#000000#000#000000 contextCSN: 20170111013201.758363Z#000000#001#000000 contextCSN: 20161219150039.213065Z#000000#002#000000 entryDN: dc=example,dc=com subschemaSubentry: cn=Subschema hasSubordinates: TRUE entryDN: dc=example,dc=com subschemaSubentry: cn=Subschema auditContext: cn=accesslog - Frank Swasey

2 2

ContextCSN values in 3-multimaster setup
by Marc Franquesa 17 Jan '17

17 Jan '17

Hi all I finally got working a new setup with 3-node multimaster replication for both the main DIT and cn=config tree. Now I'm trying to monitor the replication status or all the nodes so I focused on examining the contextCSN value of the root of the DBs, and although I googled and reviewed other posts on the mailing list I'm still not sure to understand correctly its use. As far as I understood (please correct me if I'm wrong): - Each DB backend which is replicated will have its own and independent contextCSN at the root of the replicated DN (so I have 2 DBs: cn=config, and dc=domain,dc=net, each one will have its own contextCSN attribute). - Each master which is running as a sync provider will update one value on the contextCSN values. So, as I have multi-master replication between 3 nodes (3 providers), I should have 3 different values of contextCSN in each DB. ... so, why I'm seeing 4 values (identical on all servers as they are in sync): contextcsn: 20170111084028.692133Z#000000#001#000000 contextcsn: 20161228225757.121969Z#000000#004#000000 contextcsn: 20160201102250.543748Z#000000#005#000000 contextcsn: 20150917152138.054326Z#000000#006#000000 In the past I migrated some server, added some other node so is possible that a 'ghost' provider CSN is still on the DB ? Another point is the syntax of that value... Has any special meaning? It seems that the first part is a timestamp with milisecond resolution, but I would like to know the meaning of the 3 digits between #xxx# Are they the ServerId ? or the rid in the replication ? Please enlight me Thanks for any details

1 0

RE: openldap-technical Digest, Vol 110, Issue 14
by BENICHOU Fabrice - Contractor 16 Jan '17

16 Jan '17

Hello, I would like to clarify my problem: My 2 LDAP servers (configured as Provider) shares the same Tree (DIT) (same part of tree): - "Server local" manages the whole tree with the structure : dc=com ou=People,dc=com uid=local_admin,ou=People,dc=com ou=Group,dc=com - "Server central" manages a database with the SAME tree structure but with other account dc=com ou=People,dc=com uid= central_admin ,ou=People,dc=com ou=Group,dc=com Is it possible to configure the "Server local" to delegates the request to "Server Central" if an account is not found locally? For example, with LDAPSEARCH: >ldapsearch -H ldaps://Server-local.com -b ou=dcom -w private -D "cn=Admin,dc=com" uid=central_admin mail -x -C => This Fails: the Serve Local does not return the "Server central" to Ldapsearch. However, if I change the DIT of "Server central" in order to be different, the Ldap delegation works. For example: - "Server central" 's DIT: dc=com2 ou=People,dc=com2 uid= central_admin ,ou=People,dc=com2 ou=Group,dc=com2 >ldapsearch -H ldaps://Server-local.com -b ou=com2 -w private -D "cn=Admin,dc=com" uid=central_admin mail -x -C => This works: Dn: uid=adminCentral,ou=People,dc=com2 Mail: admin_central(a)com2.com Ldapsearch 's traces contains referral url: "ldap_chase_v3_referral: msgid 2, url "ldaps:// Server-central.com /dc=com2 ??sub" It seems that no referral is returned if the tree are identical: it is possible to configure the Ldap server "local" to return the referral to the "central (root) if the local query fails? OpenLdap Admin Guide (version 2.4) , chapter 5.2.1.3 (olcReferral) says "This directive specifies the referral to pass back when salpd cannot find a local database to handle a request". Best regards Fb [@@ THALES ALENIA SPACE INTERNAL @@] -----Message d'origine----- De : openldap-technical [mailto:openldap-technical-bounces@openldap.org] De la part de openldap-technical-request(a)openldap.org Envoyé : dimanche 15 janvier 2017 13:00 À : openldap-technical(a)openldap.org Objet : openldap-technical Digest, Vol 110, Issue 14 Send openldap-technical mailing list submissions to openldap-technical(a)openldap.org To subscribe or unsubscribe via the World Wide Web, visit http://www.openldap.org/lists/mm/listinfo/openldap-technical or, via email, send a message with subject or body 'help' to openldap-technical-request(a)openldap.org You can reach the person managing the list at openldap-technical-owner(a)openldap.org When replying, please edit your Subject line so it is more specific than "Re: Contents of openldap-technical digest..." Send openldap-technical mailing list submissions to openldap-technical(a)openldap.org When replying, please edit your Subject: header so it is more specific than "Re: openldap-technical digest..." Today's Topics: 1. Re: Generic Referrals never received. (Quanah Gibson-Mount) ---------------------------------------------------------------------- Message: 1 Date: Sat, 14 Jan 2017 11:57:57 -0800 From: Quanah Gibson-Mount <quanah(a)symas.com> To: BENICHOU Fabrice - Contractor <fabrice.benichou(a)external.thalesaleniaspace.com>, openldap-technical(a)openldap.org Subject: Re: Generic Referrals never received. Message-ID: <F3905FAB793AC520D721F0B1(a)[192.168.1.30]> Content-Type: text/plain; charset=us-ascii; format=flowed --On Friday, January 13, 2017 5:16 PM +0100 BENICHOU Fabrice - Contractor <fabrice.benichou(a)external.thalesaleniaspace.com> wrote: > the configuration of "localserver.domain.com" is: > > dn: cn=config > > objectClass: olcGlobal > > cn: config > > olcArgsFile: /var/run/openldap/slapd.args > > olcPidFile: /var/run/openldap/slapd.pid > > olcTLSCACertificatePath: /etc/openldap/certs > > olcTLSCertificateFile: "OpenLDAP Server" > > olcTLSCertificateKeyFile: /etc/openldap/certs/password > > structuralObjectClass: olcGlobal > > creatorsName: cn=config > > olcReferral: ldaps://centralserver.domain.com > > olcLogLevel: -1 This is not a full configuration. It looks like you simply cut and pasted the cn=config.ldif file. You would want to slapcat the cn=config DB to get the full config database. I'm assuming you're trying to report a configuration issue on your end with back-ldap or similar. You'd most likely want to only provide the relevant configuration details for that portion of the configuration database. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com> ------------------------------ Subject: Digest Footer _______________________________________________ openldap-technical mailing list openldap-technical(a)openldap.org http://www.openldap.org/lists/mm/listinfo/openldap-technical ------------------------------ End of openldap-technical Digest, Vol 110, Issue 14 ***************************************************

1 0

Re: Generic Referrals never received.
by Quanah Gibson-Mount 14 Jan '17

14 Jan '17

--On Friday, January 13, 2017 5:16 PM +0100 BENICHOU Fabrice - Contractor <fabrice.benichou(a)external.thalesaleniaspace.com> wrote: > the configuration of "localserver.domain.com" is: > > dn: cn=config > > objectClass: olcGlobal > > cn: config > > olcArgsFile: /var/run/openldap/slapd.args > > olcPidFile: /var/run/openldap/slapd.pid > > olcTLSCACertificatePath: /etc/openldap/certs > > olcTLSCertificateFile: "OpenLDAP Server" > > olcTLSCertificateKeyFile: /etc/openldap/certs/password > > structuralObjectClass: olcGlobal > > creatorsName: cn=config > > olcReferral: ldaps://centralserver.domain.com > > olcLogLevel: -1 This is not a full configuration. It looks like you simply cut and pasted the cn=config.ldif file. You would want to slapcat the cn=config DB to get the full config database. I'm assuming you're trying to report a configuration issue on your end with back-ldap or similar. You'd most likely want to only provide the relevant configuration details for that portion of the configuration database. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Odd ldapsearch behavior
by Quanah Gibson-Mount 13 Jan '17

13 Jan '17

--On Wednesday, January 11, 2017 2:50 PM -0500 Frank Swasey <Frank.Swasey(a)uvm.edu> wrote: > My slapd.conf files are built using mustache templates with minimal > differences... Is there a specific config option I should be looking at > that could cause the operational attributes to be duplicated in the > output of ldapsearch but not slapcat? Well, it'd be a bug, so I've no idea what would specifically trigger it. :) I guess you could diff the slapd.conf files and see what differences exist and start from there? --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: Antw: Odd ldapsearch behavior
by Frank Swasey 13 Jan '17

13 Jan '17

Ulrich, You are correct, the development system is copied from the production system. The process is to perform the same ldapsearch that is producing a corrupted ldif from the development system against the production system on my management system. I then scp the ldif file over to the development system and use slapadd to load it on the development system. I have noted that slapcat on the development system does not produce the corrupted ldif file - so I do not believe my "copy production data to development system" procedure is the cause. - Frank On Thu, 12 Jan 2017 at 2:08am, Ulrich Windl wrote: > Hi! > > From your data it seems your development database is somewhat a copy of your production database, right? How did you copy? I suspect the procedure produced a currupted database (MHO).

1 0

Generic Referrals never received.
by BENICHOU Fabrice - Contractor 13 Jan '17

13 Jan '17

Hello, I have 2 LDAP servers: -machine 1:" localserver.domain.com" : the DIT is dn: dc=example dc: bsr-ivv objectClass: top objectClass: dcObject objectclass: organization o: AAA dn: ou=Users,dc=example objectClass: top objectClass: organizationalUnit ou: Users dn: ou=Groups,dc=example objectClass: top objectClass: organizationalUnit ou: Groups -machine 2: "centralserver.domain.com": the DIT is the SAME. and i want that request not found on "localserver.domain.com" should be delegated to "centralserver.domain.com" the configuration of "localserver.domain.com" is: dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/openldap/slapd.args olcPidFile: /var/run/openldap/slapd.pid olcTLSCACertificatePath: /etc/openldap/certs olcTLSCertificateFile: "OpenLDAP Server" olcTLSCertificateKeyFile: /etc/openldap/certs/password structuralObjectClass: olcGlobal creatorsName: cn=config olcReferral: ldaps://centralserver.domain.com olcLogLevel: -1 I use the command "ldapsearch" on "localserver" to request data about "admincentral1" that only exists on "centralserver.domain.com" machine: >ldapsearch -H ldaps://localserver.domain.com -b ou=Users,dc=bsr-ivv -w password -D "cn=Admin,dc=example" uid=admincentral1 mail -x -C -d 129 But the client "ldapsearch" does not get the refferal of "centralserver" LDAP from "localserver". I look at slap logs and ldapsearch logs but the refferal is never received. Shall i activate anything else? NB: if i use referral Objects, this works fine: i found logs like : " Jan 13 13:44:55 m-deploy slapd[24898]: send_ldap_result: referral="ldaps://centralserver.external.domain.com/ou=Users,dc=example" " but with that configuration, no referral are received by client... Best regards Fabrice

1 0

Re: ppolicy overlay and MMR experiencing frequent delta-sync lost issue
by Quanah Gibson-Mount 13 Jan '17

13 Jan '17

--On Thursday, January 12, 2017 10:20 AM -0500 Beth Halsema <bhalsema(a)purdue.edu> wrote: > > Quanah, are you suggesting that the ppolicy attributes (i.e. > pwdGraceUseTime, pwdFailureTime, etc.) not be replicated? Hi Beth, This is clearly noted in the slapo-ppolicy(5) man page: Note that the current IETF Password Policy proposal does not define how these operational attributes are expected to behave in a replication environment. In general, authentication attempts on a slave server only affect the copy of the operational attributes on that slave and will not affect any attributes for a user's entry on the master server. Operational attribute changes resulting from authentication attempts on a master server will usually replicate to the slaves (and also overwrite any changes that originated on the slave). These behaviors are not guaranteed and are subject to change when a formal specification emerges. The correct fix is to modify your syncrepl configuration so that those attributes are ignored by the syncrepl client. There is no patch to the code necessary. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

3 3

Re: ppolicy overlay and MMR experiencing frequent delta-sync lost issue
by Quanah Gibson-Mount 12 Jan '17

12 Jan '17

--On Thursday, January 12, 2017 11:27 PM +0100 Michael Ströder <michael(a)stroeder.com> wrote: > Mark Cairney wrote: >> On 12/01/17 16:06, Quanah Gibson-Mount wrote: >> >>> The correct fix is to modify your syncrepl configuration so that those >>> attributes are ignored by the syncrepl client. There is no patch to the >>> code necessary. >>> >> >> Possibly a dumb question but do you have a worked example of this? The >> usual "get-all" stanza for this would "*, +" and as far as I'm aware you >> can't subtract attributes from the list returned i.e. search for all >> attributes *except* pwdFailureTime. > > You could try using option exattrs with syncrepl statement, see > slapd.conf(5). One could also change the olcAccess on the accesslog DB to exclude problem attributes from being visible. But exattrs is probably the best route. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: slapd-meta with olc
by Howard Chu 12 Jan '17

12 Jan '17

Quanah Gibson-Mount wrote: > --On Wednesday, January 11, 2017 10:23 AM +0000 Martin Stejskal > <mstejskal(a)alps.cz> wrote: > > I'll fix this LDIF for you, although I don't know the answers to the rest of > your questions. > >> $ cat add_meta_backend.ldif >> dn: cn=module{},cn=config >> objectClass: olcModuleList >> cn: module{} >> olcModulePath: /usr/lib/ldap >> olcModuleLoad: back_meta >> olcModuleLoad: back_ldap >> olcModuleLoad: rwm > > As for olc attribute names, you can trivially grab these out of the source > code. There is no need to read source code. Just read the cn=schema,cn=config entry using ldapsearch for all of the relevant definitions. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: slapd-meta with olc
by Quanah Gibson-Mount 12 Jan '17

12 Jan '17

--On Thursday, January 12, 2017 4:23 PM +0000 Martin Stejskal <mstejskal(a)alps.cz> wrote: > > > > Hi Quannah, > > thanks for support. Now I understand little bit more ldif syntax/rules. > Yes, the source code is option as well, but I tried to avoid it :) > > I know there is slapd.conf to cn=config converter, but unfortunately I > was not able to make it work (errors during conversion). I would note that slaptest will report errors during conversion sometime and then note that they should be ignored, since the configuration isn't actually being used against a running slapd. Since you provide no details about the errors encountered, it's impossible to determine if it was a valid error or simply a note about the difference between the conversion process and an active slapd. You could of course take the configurations from test035 and test036 to trivially come up with working configurations to be converted to cn=config as a starting point. :) Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Chain 2 master LDap
by BENICHOU Fabrice - Contractor 12 Jan '17

12 Jan '17

Hello, I try to chain 2 LDAP master (Provider): My system is : -1 Master "central" with suffix="dc=com" : I contains ldap posix user like "adminCentral". -1 Master "local" with suffix="dc=com": It contains ldap posix user like"adminlocal". The goal is to chain request when a ldapclient ask to Master "local" : this later shall chain the request to Master "central" and get back the result to client. For example, if "uid=adminCentral,User,dc=com" is not found in Master "local" LDAP, the Master "local" LDAP shall find if this Entry exists in Master "central" 1) Is it possible for a Master, to chain via overlay with "olcDbURI" parameter to another master? I only see example where Slave (Consummer) are chaining to Master (Provider).. 2) My Master "local" is configured with TLS : it has a Master_pem certificate, and a rootCA_local.pem (used in fact to authentify a local slave for replication). How to have TLS between "Master local" and "Master central"? If the rootCA_central.pem (trust chain) is not the same that the a rootCA_local.pem, how to complete the trust chain of the Master local? My work is based on documentation : http://www.zytrax.com/books/ldap/ch7/referrals.html#chaining (7.3.5). but the full documentation is not available and I use dynamic configuration with "olc". I have also found at http://serverfault.com/questions/518407/openldap-2-4-chain-overlay-minimal-… the Chain Overlay Minimal LDIF Configuration But the delegation does not work. Anyone does have a tutorial ? My platform: Centos 7 Best regards. Fab [@@ THALES ALENIA SPACE INTERNAL @@]

2 1

Re: Slapd.conf for doing stress
by Quanah Gibson-Mount 12 Jan '17

12 Jan '17

--On Thursday, January 12, 2017 2:39 PM +0530 PRATIK SINGAL <pratik.singal13(a)gmail.com> wrote: > > Hello , > > > Am new to openldap and need to perform stress on openldap2.4. > Can any one please provide me with some usefull link / optimized conf > file for stress. > we are using Berkley DB. <https://mishikal.wordpress.com/> has information about benchmarking with the relevant portions of the configuration noted. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: ppolicy overlay and MMR experiencing frequent delta-sync lost issue
by Quanah Gibson-Mount 12 Jan '17

12 Jan '17

--On Monday, January 09, 2017 9:53 AM -0500 Beth Halsema <bhalsema(a)purdue.edu> wrote: > We have submitted OpenLDAP-ITS #8561 with a unit test and a possible > patch to the ppolicy overlay. > > If anyone else has run into this, we would be interested in any other > work- arounds that have been used to address the issue. Hi Beth, I'm guessing that ppolicy is writing items that are not supposed to be replicated to the accesslog. This issue (ITS8561) and ITS8444 I think are generally similar items, in that while the accesslog is writing all write operations, replication requires that some write operations not be present in the accesslog. I'll be discussing with the other team members on how best to handle what are somewhat conflicting requirements. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

3 2

Re: Odd ldapsearch behavior
by Quanah Gibson-Mount 11 Jan '17

11 Jan '17

--On Wednesday, January 11, 2017 1:18 PM -0500 Frank Swasey <Frank.Swasey(a)uvm.edu> wrote: > Today at 12:44pm, Michael Ströder wrote: > >> Out of curiosity: >> What happens if you slapcat the data on your development server? > > slapcat dumps the data just fine (meaning that the two attributes are not > duplicated). If you are using cn=config, slapcat it and compare? --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: Odd ldapsearch behavior
by Frank Swasey 11 Jan '17

11 Jan '17

Today at 12:44pm, Michael Ströder wrote: > Out of curiosity: > What happens if you slapcat the data on your development server? slapcat dumps the data just fine (meaning that the two attributes are not duplicated). - Frank

1 0

slapd-meta with olc
by Martin Stejskal 11 Jan '17

11 Jan '17

Hi, I'm trying to run "meta" database on our local LDAP server, but I'm not able to set it up. I was checking many tutorials, including man page (http://www.openldap.org/doc/admin24/slapdconfig.html, http://www.openldap.org/doc/admin24/slapdconf2.html, https://linux.die.net/man/5/slapd-relay, https://linux.die.net/man/5/slapo-rwm, https://linux.die.net/man/5/slapd-ldap, https://linux.die.net/man/5/slapd-meta, http://www.openldap.org/doc/admin24/guide.html#Metadirectory ... ) but without success. Most of them are are out-of-date (slapd.conf) and basically there is no reference to new olc migration. I just need to know few things: * Is "meta" database supported at v2.4.42 ? (assume yes) * Can "meta" database represent proxy with remote servers? (also assume yes) Our use case is following: * [ user app ] ---> [ our LDAP ] ---> LDAP1 or LDAP2 or LDAP3 .... * "Our LDAP" should change domanin (dc=abc,dc=local -> dc=sub,dc=abc,dc=org (LDAP1) or dc=sub2,dc=def,dc=com (LDAP2) , ....) and if possible binder as well Can you give us some example ldif configuration? Because at "http://www.openldap.org/doc/admin24/guide.html#Metadirectory" at 11.5.2 is only "LATER" :/ I was able to add backends, but I'm not able to add some working configuration. $ cat add_meta_backend.ldif dn: cn=module{},cn=config objectClass: olcModuleList cn: module{} olcModulePath: /usr/lib/ldap olcModuleLoad: back_meta dn: cn=module{},cn=config objectClass: olcModuleList cn: module{} olcModulePath: /usr/lib/ldap olcModuleLoad: back_ldap dn: cn=module{},cn=config objectClass: olcModuleList cn: module{} olcModulePath: /usr/lib/ldap olcModuleLoad: rwm Best regards Martin Stejskal

1 0

OpenLDAP userpassword instead SambaNTPassword
by Tian Zhiying 10 Jan '17

10 Jan '17

Hi I just intergrated OpenLDAP and Samba service, the prupose is to allow users can use one account and password to login them. But after I change the password from " Self Service Password ", only userpassword has changed, SambaNTPassword has not changed. Could you help me ? Thanks.

3 2

ppolicy overlay and MMR experiencing frequent delta-sync lost issue
by Beth Halsema 09 Jan '17

09 Jan '17

We are running Openldap 2.4.44 on RHEL6 in a delta-syncrepl MMR configuration. We are using the ppolicy overlay. This setup is resulting in frequent occurrences on the consumers of: * delta-sync lost * traversal of the entire directory * delta-syncrepl switches back into refreshAndPersist * slapd memory usage increasing We have found that this behavior is consistently triggered when the operation that is being replicated involves a password change in combination with the removal of ppolicy attributes (e.g. pwdGraceUseTime and pwdFailureTime). The detailed debugging output associated with such an occurrence is: ------------------------------------------------------------------------------ 58739e68 bdb_modify_internal: replace userPassword 58739e68 bdb_modify_internal: replace pwdChangedTime 58739e68 bdb_modify_internal: softdel pwdGraceUseTime 58739e68 bdb_modify_internal: add pwdHistory 58739e68 bdb_modify_internal: replace entryCSN 58739e68 bdb_modify_internal: replace modifiersName 58739e68 bdb_modify_internal: replace modifyTimestamp 58739e68 bdb_modify_internal: delete pwdGraceUseTime 58739e68 bdb_modify_internal: 16 modify/delete: pwdGraceUseTime: no such attribute ... 58739e68 do_syncrep2: rid=001 delta-sync lost sync on (reqStart=20170109142959.000006Z,cn=log), switching to REFRESH ------------------------------------------------------------------------------ We have submitted OpenLDAP-ITS #8561 with a unit test and a possible patch to the ppolicy overlay. If anyone else has run into this, we would be interested in any other work- arounds that have been used to address the issue. Thank you! Beth ------------------------------------------------------------------------- Beth A. Halsema - GSEC, GSSP-Java email:bhalsema@purdue.edu Sofware Engineer, Identity & Access Management OVPIT - IT Security and Policy 3495 Kent Avenue, Suite 100 Fax : (765) 464-2233 West Lafayette, IN 47906 Campus Mail: ROSS

1 0

Allow particular LDAP group users login
by Frank Yu 09 Jan '17

09 Jan '17

Hi, I have a case, allow particular LDAP group user can login host. I get a method from google, which use pam_listfile.so , I tried as description( https://www.cyberciti.biz/tips/howto-deny-allow-linux-user-group-login.html), but it failed to restrict particular group. Below is what I did: 1. add pam_listfile.so to system-auth # grep pam_listfile.so system-auth -A2 auth required pam_listfile.so \ onerr=fail item=group sense=allow file=/etc/login.group.allowed 2. create file login.group.allowed, and add group name in this file # ll /etc/login.group.allowed -rwxr-xr-x. 1 root root 12 Jan 7 19:28 /etc/login.group.allowed # cat /etc/login.group.allowed hogpu-users 3. try to login a user, which is not in group hogpu-users. $ ssh test.lu(a)10.10.10.37 luo.lu(a)101.100.10.37's password: Last login: Sat Jan 7 19:30:04 2017 from 10.31.32.72 id: cannot find name for group ID 501 [luo.lu@xyz-gpu100 ~]$ id test.lu uid=10138(test.lu) gid=501 groups=501,503(hogpu-algorithm-intern) so user test.lu is not in group hogpu-users, but I still can login the host. What I missed? any suggestion about this? Thanks -- Regards Frank Yu

2 2

Re: [SOLVED] /etc/ldap/slapd.conf: line 27: unknown directive <TLSCertificateFile:> outside backend info and database definitions.
by MrBiTs 08 Jan '17

08 Jan '17

Hi, Everybody Thanks a lot for interesting in my problem. I've fixed it. The problem was permissions. User openldap wasn't able to read /etc/ssl/certs directory. CheerS On Sun, Jan 8, 2017 at 10:20 AM, MrBiTs <mrbits.dcf(a)gmail.com> wrote: > Hello, all. Happy 2017 > > From the years 2009 to 2012 I've administrate as OpenLDAP cluster using > SSL configurations, something like that: > > backend hdb > sizelimit unlimited > allow bind_v2 > concurrency 100 > > TLSCipherSuite HIGH:MEDIUM:+SSLv2 > TLSCACertificateFile: /etc/ssl/certs/ca_server.pem > TLSCertificateFile: /etc/ssl/certs/ldap_server.pem > TLSCertificateKeyFile: /etc/ssl/private/ldap_server.key > TLSVerifyClient never > > access to attrs=userPassword by anonymous auth by self write by * none > access to * by self write by * none > > > loglevel 3 > # Database configuration > > database hdb > suffix "dc=example,dc=com" > > This year I'll start to admin another cluster, now installed in Ubuntu > 16.04 using: > > slapd/xenial-updates,now 2.4.42+dfsg-2ubuntu3.1 amd64 [installed] > OpenLDAP server (slapd) > > If I remove TLS directives from slapd.conf, the server runs fine but, of > course, just using LDAP protocol without any kind of cryptography. Using > the TLS directives, I always have the error > > /etc/ldap/slapd.conf: line 27: unknown directive <TLSCertificateFile:> > outside backend info and database definitions. > > I did research in Google and read man 5 slapd.conf and I GUESS directives > are in the right place in slapd.conf. > > Anybody face this error recently and can help me with some tips? > > Thanks in advance > > > > -- > > LLAP > > .0. MrBiTs - mrbits.dcf(a)gmail.com > ..0 GnuPG - http://keyserver.fug.com.br:11371/pks/lookup?op=get& > search=0x6EC818FC2B3CA5AB > 000 http://www.mrbits.com.br > -- LLAP .0. MrBiTs - mrbits.dcf(a)gmail.com ..0 GnuPG - http://keyserver.fug.com.br:11371/pks/lookup?op=get&search=0x6EC818FC2B3CA5… 000 http://www.mrbits.com.br

1 0

/etc/ldap/slapd.conf: line 27: unknown directive <TLSCertificateFile:> outside backend info and database definitions.
by MrBiTs 08 Jan '17

08 Jan '17

Hello, all. Happy 2017 >From the years 2009 to 2012 I've administrate as OpenLDAP cluster using SSL configurations, something like that: backend hdb sizelimit unlimited allow bind_v2 concurrency 100 TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCACertificateFile: /etc/ssl/certs/ca_server.pem TLSCertificateFile: /etc/ssl/certs/ldap_server.pem TLSCertificateKeyFile: /etc/ssl/private/ldap_server.key TLSVerifyClient never access to attrs=userPassword by anonymous auth by self write by * none access to * by self write by * none loglevel 3 # Database configuration database hdb suffix "dc=example,dc=com" This year I'll start to admin another cluster, now installed in Ubuntu 16.04 using: slapd/xenial-updates,now 2.4.42+dfsg-2ubuntu3.1 amd64 [installed] OpenLDAP server (slapd) If I remove TLS directives from slapd.conf, the server runs fine but, of course, just using LDAP protocol without any kind of cryptography. Using the TLS directives, I always have the error /etc/ldap/slapd.conf: line 27: unknown directive <TLSCertificateFile:> outside backend info and database definitions. I did research in Google and read man 5 slapd.conf and I GUESS directives are in the right place in slapd.conf. Anybody face this error recently and can help me with some tips? Thanks in advance -- LLAP .0. MrBiTs - mrbits.dcf(a)gmail.com ..0 GnuPG - http://keyserver.fug.com.br:11371/pks/lookup?op=get&search=0x6EC818FC2B3CA5… 000 http://www.mrbits.com.br

1 0

Regarding the conclusion from ITS# 8521 and cn=config replication
by Nikos Voutsinas 07 Jan '17

07 Jan '17

I was looking at the latest issues/commits and came across ITS#8521 which discusses the correct sequence of setting up the serverID, the syncprov overlay and uploading the actual data in a replication scheme. So there, the conclusion is: "Bottom line, *always* inject the serverID and syncprov *before injecting some data, or be ready to do an update after having injected syncprov and serverID" This made me wonder how can we accomplish this with the replication of cn=config, and if the replication of cn=config requires any extra precaution at the initialization phase. Nikos

1 0

Re: Syncrepl and multipe values
by Quanah Gibson-Mount 06 Jan '17

06 Jan '17

--On Tuesday, January 03, 2017 10:03 PM +0000 Matheus Eduardo Bonifacio Morais <matheus_morais(a)sicredi.com.br> wrote: > > > Hi, > > > > I have one replication tool which makes some modifications in my OpenLDAP > master. For some shitty reason, that tool tries to modify one dn with > duplicated attributes. Here is the snippet of accesslog: Please file an ITS for this issue at http://www.openldap.org/its/ Preferably, include an example ldapmodify command triggering the behavior. Thanks, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 2

Re: help with ACL
by Quanah Gibson-Mount 06 Jan '17

06 Jan '17

--On Wednesday, January 04, 2017 2:44 PM +0100 Alberto Aldrigo <alberto.aldrigo(a)h-farm.com> wrote: > So an ACL could be: > > to dn.subtree="o=company1,dc=domain,dc=com" by group="c > cn=admins_company1,o=company1,dc=domain,dc=com" write > > I have 25 of these groups, so I need 25 ACLs like the one above: having > one per line can lead to a performance issue? Generally it should be fine, as it's not a particularly complex ACL. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Antw: Re: ppolicy overlay unable to set pwdAccountLockedTime on to-be-locked users due to ACLs
by Quanah Gibson-Mount 06 Jan '17

06 Jan '17

--On Tuesday, January 03, 2017 2:49 PM +0100 Matthieu Cerda <matthieu.cerda(a)nbs-system.com> wrote: > > > Le 03/01/2017 à 08:05, Ulrich Windl a écrit : >>>>> Quanah Gibson-Mount <quanah(a)symas.com> schrieb am 03.01.2017 um 00:11 >>>>> in >> Nachricht <F365AC223D2A1E22A5345243(a)[192.168.1.30]>: >>> (...) >>> >>> Note the bit about "all the operations, ..." >>> >>> If you think of a way to reword it that you feel is a better >>> explanation, that could certainly be considered. :) >> >> I think a notice who is the modifier on ppolicy changes would be woth >> it; specifically if it's related to RootDN ;-) I think I had already >> asked earlier about some notice on ACLs that ppolicy may or may not need >> to work. > > Well I certainly didn't understand the message as 'every operation will > be done assuming the rootdn identity' indeed. > > I agree with Ulrich, maybe a small note in the manpage saying exactly > that might help, just in case ? > > Here is a proposal patch on slapo-ppolicy.5 manpage to clarify that. Submissions need to be via the ITS system, http://www.openldap.org/its/ Thanks, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

(host) and (uid) not indexed (after creating an account)
by Peng Yu 04 Jan '17

04 Jan '17

Hi, I can use the following command to change the password in openldap after I create an entry le. ~~~ $ sudo ldapsetpasswd le Changing password for user uid=le,ou=Users,dc=mydomain,dc=example New Password: Retype New Password: Successfully set password for user uid=le,ou=Users,dc=mydomain,dc=example ~~~ And I can see the userPassword field is changed upon calling the above command. ~~~ $ sudo ldapmodifyuser le [sudo] password for pengy: # About to modify the following entry : dn: uid=le,ou=Users,dc=mydomain,dc=example objectClass: account objectClass: posixAccount objectClass: shadowAccount cn: le uid: le uidNumber: 10103 gidNumber: 10002 homeDirectory: /home/le loginShell: /bin/bash gecos: le description: User account shadowMax: 180 shadowLastChange: 0 userPassword:: e1NTSEF9VzZHdlFnTkdDMitzUk5BRStpMGMzcElVWG9hVTYzRjk= # Enter your modifications here, end with CTRL-D. dn: uid=le,ou=Users,dc=mydomain,dc=example Successfully modified user entry uid=le,ou=Users,dc=mydomain,dc=example in LDAP ~~~ (BTW, why whenever I run ldapsetpasswd to set the same password, the userPassword field is set differently?) But the user le is not able to login to the servers (the servers connected to openldap for authentication) with the new password. In /var/log/syslog of the openldap server (ubuntu), I see the following lines. ~~~ Jan 2 12:17:22 openldapserver slapd[1082]: conn=2884 fd=39 ACCEPT from IP=172.17.1.6:51975 (IP=0.0.0.0:389) Jan 2 12:17:22 openldapserver slapd[1082]: conn=2884 op=0 BIND dn="" method=128 Jan 2 12:17:22 openldapserver slapd[1082]: conn=2884 op=0 RESULT tag=97 err=0 text= Jan 2 12:17:22 openldapserver slapd[1082]: conn=2884 op=1 SRCH base="dc=domain,dc=example" scope=2 deref=0 filter="(&(&(|(host=\2A)(host=elnath))(!(host=!elnath)))(&(|(host=\2A)(host=elnath))(!(host=!elnath)))(uid=le))" Jan 2 12:17:22 openldapserver slapd[1082]: <= bdb_equality_candidates: (host) not indexed Jan 2 12:17:22 openldapserver slapd[1082]: message repeated 3 times: [ <= bdb_equality_candidates: (host) not indexed] Jan 2 12:17:22 openldapserver slapd[1082]: <= bdb_equality_candidates: (uid) not indexed Jan 2 12:17:22 openldapserver slapd[1082]: conn=2884 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= ~~~ On the server to be logged in (named as elnath and is also a ubuntu server), /var/log/auth.log has the following line. ~~~ Jan 2 12:17:22 elnath sshd[21249]: Failed password for le from xxx.xx.xx.xx port 57155 ssh2 ~~~ I have tried to stop slapd service then run slapindex as root and then start slapd service on the openldapserver. But it still does not work. Could anybody let me know how to fix this issue? Thanks. -- Regards, Peng

3 4

Re: mdb_stat question
by Howard Chu 04 Jan '17

04 Jan '17

Frank Swasey wrote: > I have noticed that the mdb_stat (-e parameter) now shows the number of pages > used, so I can use that instead of running a du and compare it to the Max > pages value to see how "full" the data.mdb has become. > > We use nagios to monitor such things... is there a frequency of running > mdb_stat that would be too frequent and could cause issues with a moderately > loaded (handling 14 million operations per day) ldap server? It takes more CPU time to fork a process and load the mdb_stat binary than it takes to read and print the statistic. > Should I have nagios not perform the mdb_stat check more frequently than some > recommended amount of time? Whatever, it's your CPU load. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

mdb_stat question
by Frank Swasey 04 Jan '17

04 Jan '17

I have noticed that the mdb_stat (-e parameter) now shows the number of pages used, so I can use that instead of running a du and compare it to the Max pages value to see how "full" the data.mdb has become. We use nagios to monitor such things... is there a frequency of running mdb_stat that would be too frequent and could cause issues with a moderately loaded (handling 14 million operations per day) ldap server? Should I have nagios not perform the mdb_stat check more frequently than some recommended amount of time? Thanks, Frank

1 0

Re: help with ACL
by Quanah Gibson-Mount 04 Jan '17

04 Jan '17

--On Friday, December 23, 2016 11:16 AM +0100 Alberto Aldrigo <alberto.aldrigo(a)h-farm.com> wrote: > uid=user1 and uid=user6 are company1's administrators, so they can write > in whole o=company1 subtree Might be best to make an LDAP group with those users as members, and then write an ACL based off of that group for its specific privileges. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Syncrepl and multipe values
by Matheus Eduardo Bonifacio Morais 03 Jan '17

03 Jan '17

Hi, I have one replication tool which makes some modifications in my OpenLDAP master. For some shitty reason, that tool tries to modify one dn with duplicated attributes. Here is the snippet of accesslog: dn: reqStart=20170103135721.000411Z,cn=accesslog objectClass: auditModify reqStart: 20170103135721.000411Z reqEnd: 20170103135721.000413Z reqType: modify reqSession: 1184351 reqAuthzID: cn=manager,dc=br reqControls: {0}{2.16.840.1.113730.3.4.2} reqDN: ou=marili_advogados,ou=terceiros,cn=sistema,cn=entities,dc=sicredi,dc=c om,dc=br reqResult: 0 reqMod:: U2ljcmVkaU1lbW86PSBt77+9Hu+/veKdqu+/vTA0LjUyOC4yNzYvMDAwMS0wNg1BVi4gT UFSRUNIQUwgRkxPUklBTk8gUEVJWE9UWA== reqMod: SicrediEntidadePai:= ou=terceiros,cn=sistema,cn=entities,dc=sicredi,dc =com,dc=br reqMod: SicrediEntidadePai:= ou=terceiros,cn=sistema,cn=entities,dc=sicredi,dc =com,dc=br reqMod: entryCSN:= 20170103135721.874447Z#000000#000#000000 reqMod: modifiersName:= cn=manager,dc=br reqMod: modifyTimestamp:= 20170103135721Z reqEntryUUID: 61dfd779-5799-4988-927b-914e75d6ae90 As you can see, the attribute "SicrediEntidadePai" is modified two times with the same value, which results in syncrepl to stuck, as described in one of our slaves logs: 2017-01-03T19:14:21.043501-02:00 ds1openldap5p slapd[2245]: syncrepl_message_to_op: rid=000 mods check (SicrediEntidadePai: multiple values provided) 2017-01-03T19:14:21.043599-02:00 ds1openldap5p slapd[2245]: do_syncrepl: rid=000 rc 19 retrying 2017-01-03T19:15:21.039822-02:00 ds1openldap5p slapd[2245]: syncrepl_message_to_op: rid=000 mods check (SicrediEntidadePai: multiple values provided) 2017-01-03T19:15:21.039863-02:00 ds1openldap5p slapd[2245]: do_syncrepl: rid=000 rc 19 retrying My workaround is remove the database on the slaves and let it to do a full replication. I'm looking in the replication tool to fix that modification bug but meanwhile I have two questions about that: 1 - Why that modification happen with no problem in OpenLDAP master and stuck syncrepl? 2 - Should I fill an issue on ITS or this is working as expected? 3 - There is any other workaround for this case? OpenLDAP: slapd 2.4.42 Thanks. Matheus Eduardo Bonifácio Morais Analista de Infraestrutura de TI, Plataforma e Aplicações Confederação Sicredi Centro Administrativo Sicredi - Porto Alegre +55 51 3358 7143 sicredi.com.br [1474907760585_sicredilogo.png] Esta mensagem é somente para uso do destinatário informado e pode conter informações privilegiadas, proprietárias ou privadas. Se você recebeu esta mensagem por engano, por favor, notifique o remetente imediatamente e apague a original. Qualquer outro uso deste e-mail é proibido. This message is for the designated recipient only and may contain privileged, proprietary, or otherwise private information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the email by you is prohibited.

1 0

ldapsearch filter question
by Zhang,Jun 03 Jan '17

03 Jan '17

ldapsearch -x -b dc=myinstitute,dc=edu uid=user1 gidnumber gives me gidnumber=1234 I then tried, ldapsearch -x -b dc=myinstitute,dc=edu "(&(objectclass=groupofnames)(gidnumber=1234))" intending to find out the name of the group, but I got nothing. Thanks Jun The information contained in this e-mail message may be privileged, confidential, and/or protected from disclosure. This e-mail message may contain protected health information (PHI); dissemination of PHI should comply with applicable federal and state laws. If you are not the intended recipient, or an authorized representative of the intended recipient, any further review, disclosure, use, dissemination, distribution, or copying of this message or any attachment (or the information contained therein) is strictly prohibited. If you think that you have received this e-mail message in error, please notify the sender by return e-mail and delete all references to it and its contents from your systems.

4 8

Re: ppolicy overlay unable to set pwdAccountLockedTime on to-be-locked users due to ACLs
by Quanah Gibson-Mount 03 Jan '17

03 Jan '17

--On Monday, January 02, 2017 2:40 PM +0100 Matthieu Cerda <matthieu.cerda(a)nbs-system.com> wrote: > Thank you very much Quanah ! > > Do you think adding a note about mandatory rootdn setting in > slapo-ppolicy manpage would be a worthy contribution ? (I'll gladly > submit a patch) Hi Matthieu, It's already currently noted in the 3rd paragraph of the man page: Note that some of the policies do not take effect when the operation is performed with the rootdn identity; all the operations, when performed with any other identity, may be subjected to constraints, like access control. Note the bit about "all the operations, ..." If you think of a way to reword it that you feel is a better explanation, that could certainly be considered. :) Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

3 2

Fwd: Help pls : KDC w/LDAP backend
by Pascal Jakobi 03 Jan '17

03 Jan '17

Hi there I am trying to install a KDC (kerberos) with an OpenLDAP backend, following instructions found on the MIT kerberos site. Installation went fine and I can see that the default principals have been created (kadmin, krbtgt & so on...). However, I cannot add new principals : kadmin.local -q "addprinc -pw password root" Authenticating as principal root/admin(a)JAKOBI.FR with password. WARNING: no policy specified for root(a)JAKOBI.FR; defaulting to no policy *add_principal: Principal add failed: Insufficient access while creating "root(a)JAKOBI.FR <root(a)JAKOBI.FR>".* Digging a bit further, I could see the following with wireshark (after binding to the Directory as kadmin) : 147 21.719670222 127.0.0.1 127.0.0.1 LDAP 1028 addRequest(7) "krbprincipalname=root(a)JAKOBI.FR,cn=JAKOBI.FR,cn=kerberos,dc=jakobi,dc=fr" 148 21.720138441 127.0.0.1 127.0.0.1 LDAP 107 addResponse(7) *insufficientAccessRights (no write access to parent) * My LDAP ACLs are as follows : {0}to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=jakobi,dc=fr" write by anonymous auth by self write by * none {1}to dn.base="" by * read {2}to * by dn="cn=admin,dc=jakobi,dc=fr" write by * read {3}to dn.subtree="cn=JAKOBI.FR,cn=kerberos,dc=jakobi,dc=fr" by dn.exact="cn=kdc,ou=People,dc=jakobi,dc=fr" read * {4}to dn.subtree="cn=kerberos,dc=jakobi,dc=fr" by dn.exact="cn=kadmin,ou=People,dc=jakobi,dc=fr" write* if ACL #4 refers to *dn.subtree="**cn=JAKOBI.FR <http://JAKOBI.FR>,cn=kerberos,dc=jakobi,dc=fr"* (shouldn'it be the parent of the target principal?), result is the same. As far as I understand, rule #4 should allow me to to write within the realm subtree... Can someone enlighten me ? Thanks in adv. -- *Pascal*

3 2

Re: ppolicy overlay unable to set pwdAccountLockedTime on to-be-locked users due to ACLs
by Quanah Gibson-Mount 02 Jan '17

02 Jan '17

--On Thursday, December 22, 2016 11:23 AM +0100 Matthieu Cerda <kegeruneku+openldap(a)ironflake.org> wrote: > Hello Howard and Ozgur, > > My answers are inlined in the following text. > > I attached a copy of the slapd.conf if you would like to take a look. Your slapd.conf has no rootdn configured. You need to configure it if you want ppolicy to function correctly. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: memberOf overlay issues with 2.4.44 + ITS 8432 patch
by Quanah Gibson-Mount 02 Jan '17

02 Jan '17

Ok good to know! The issue I created occurred when deleting the group, which I believe is the original complaint in the ITS as well. So I will add individual membership deletes as a part of that test too. --Quanah > On Dec 30, 2016, at 9:31 PM, Paul B. Henson <henson(a)acm.org> wrote: > >> On Fri, Dec 30, 2016 at 02:41:06PM -0800, Quanah Gibson-Mount wrote: >> >> Well, it seems to be some sort of race condition. > > Yes, I'd agree; probably also load dependent as I never triggered it on > my dev systems which are mostly idle other than my test load. It only > showed up on my prod systems which tend to have continuous load from > various other things. > >> I did want to confirm that you see this on servers that are long running >> (I.e., they've been running for a long time, and had other group deletes >> that went through w/o issue during that time). If so, then I can modify >> the test to randomly add and delete groups as a part of the test, >> increasing the likelyhood of triggering the issue within the test. > > I don't have too many deletions of group objects themselves in > production, mostly just deletions of the members of groups. I didn't see > any issues with group deletions in dev, or during some basic initial > testing in prod. I'll go ahead and make a new test group, add some > members to it, and then delete it and see what happens now that I've > been running this code for about 3 weeks... > > I didn't see any errors deleting a group, although there were these > syncrepl messages that I don't believe used to show up: > > Dec 30 21:23:29 themis slapd[2607]: syncrepl_message_to_op: rid=001 be_delete uid=ldaptest5,ou=group,dc=cpp,dc=edu (32) > Dec 30 21:23:29 themis slapd[2607]: syncrepl_message_to_op: rid=003 be_delete uid=ldaptest5,ou=group,dc=cpp,dc=edu (32) > Dec 30 21:23:29 themis slapd[2607]: syncrepl_message_to_op: rid=002 be_delete uid=ldaptest5,ou=group,dc=cpp,dc=edu (32) > > The group and memberOf attributes are gone on all four servers, so other > than noise in the logs I'm not sure what these messages meant. > >

2 1

Re: memberOf overlay issues with 2.4.44 + ITS 8432 patch
by Quanah Gibson-Mount 31 Dec '16

31 Dec '16

--On Thursday, December 29, 2016 7:55 PM -0800 "Paul B. Henson" <henson(a)acm.org> wrote: > On Thu, Dec 29, 2016 at 04:48:42PM -0800, Quanah Gibson-Mount wrote: > >> I'm able to reproduce the problem with my test script, so I think things >> are set from here. > > Excellent; in that case please let me know when there is a fix available > :). Thanks much... Well, it seems to be some sort of race condition. I've only had it occur one time out of some 700+ attempts. I don't think it is really related to 4-way MMR at all, but it may be the larger the number of consumers of the accesslog, the more likely it is to occur (so you'll see it more often in 4-way MMR). I did want to confirm that you see this on servers that are long running (I.e., they've been running for a long time, and had other group deletes that went through w/o issue during that time). If so, then I can modify the test to randomly add and delete groups as a part of the test, increasing the likelyhood of triggering the issue within the test. Thanks, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: memberOf overlay issues with 2.4.44 + ITS 8432 patch
by Quanah Gibson-Mount 30 Dec '16

30 Dec '16

--On Wednesday, December 28, 2016 4:44 PM -0800 "Paul B. Henson" <henson(a)acm.org> wrote: > On Wed, Dec 28, 2016 at 09:53:23AM -0800, Quanah Gibson-Mount wrote: > >> I'm going to see if I can create a test that reproduces the issue. >> I've been working on expanding the test suite so we can ensure we >> avoid regressions etc. > > Cool, thanks. Let me know if there's anything I can do to help. I'm able to reproduce the problem with my test script, so I think things are set from here. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: memberOf overlay issues with 2.4.44 + ITS 8432 patch
by Quanah Gibson-Mount 29 Dec '16

29 Dec '16

--On Thursday, December 22, 2016 6:12 PM -0800 "Paul B. Henson" <henson(a)acm.org> wrote: >> Probably worth adding to ITS#8444. > > Ok, will do. Although it seems there's been no response to that ticket > for six months :(? Anything else I can provide to help debug this? > Unfortunately it doesn't seem to be a straight "always happens" bug, I > didn't see it all in my dev environment under a test load, it only > popped up in production under a full load. I'm going to see if I can create a test that reproduces the issue. I've been working on expanding the test suite so we can ensure we avoid regressions etc. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: 2.4.44 segfault in modify_add_values
by Quanah Gibson-Mount 29 Dec '16

29 Dec '16

--On Sunday, December 25, 2016 8:19 AM -0800 "Paul B. Henson" <henson(a)acm.org> wrote: > Woke up this morning to an unwanted Christmas present :(, one of my ldap > servers had crashed with a segfault: > I restarted it and it synced right back up from the failover master and > seems to be ok now. Does this pop out as anything known and possibly > resolved in head? Thanks... Doesn't ring a bell, and unfortunately it looks like your binaries are stripped, so the backtrace doesn't contain useful information. :( --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: Bulk change user's attribute
by Quanah Gibson-Mount 28 Dec '16

28 Dec '16

--On Friday, December 23, 2016 11:39 AM +0000 Bruno Miguel Martins <bruno.miguel.martins(a)iten.pt> wrote: > > > Hello guys, > > > > I am running slapd 2.3.30 and I need to bulk modify one LDAP attribute > (sambaHomePath) for all of my users, like: > > > > Current value = \\oldserver\username > > New value = \\newserver\username > > > > Can this be done? Basically I need a partial change of that attribute – > "oldserver" which is variable, changed with "newserver" which is > fixed. Other than the fact that 2.3.30 is ancient and unsupported... You should be able to do this, yes. You could use a scripting module such as Net::LDAP in Perl. If it is possible to do a substring query on the attribute in question, you could use a filter of "(attr=*oldserver*)" to get a set of entries back, and then iterate over them and do the update in the script. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

cant create child entrys
by robert k Wild 28 Dec '16

28 Dec '16

hi all, i cant create child entrys apart from OU and OR, why is this? i have installed openldap on a centos 7 vm and also phpldapadmin to manage the ldap server i imagine this is an openldap issue and not a php ldap admin issue https://s28.postimg.org/l5zb58h4t/Capture.png -- Regards, Robert K Wild.

2 2

2.4.44 segfault in modify_add_values
by Paul B. Henson 25 Dec '16

25 Dec '16

Woke up this morning to an unwanted Christmas present :(, one of my ldap servers had crashed with a segfault: Core was generated by `/usr/lib64/openldap/slapd -u ldap -g ldap -h ldaps:// ldap://'. Program terminated with signal SIGSEGV, Segmentation fault. #0 0x0000000000485c61 in modify_add_values () [Current thread is 1 (Thread 0x7f50727fd700 (LWP 15556))] (gdb) where #0 0x0000000000485c61 in modify_add_values () #1 0x00007f526dfccd0c in mdb_modify_internal () from /usr/lib64/openldap/openldap/back_mdb.so #2 0x00007f526dfce134 in mdb_modify () from /usr/lib64/openldap/openldap/back_mdb.so #3 0x000000000049c2ea in overlay_op_walk () #4 0x000000000049c441 in ?? () #5 0x000000000048d938 in ?? () #6 0x00000000004915d7 in ?? () #7 0x0000000000495793 in ?? () #8 0x0000000000433037 in ?? () #9 0x00007f5272c83a32 in ?? () from /usr/lib64/libldap_r-2.4.so.2 #10 0x00007f52722ce494 in start_thread () from /lib64/libpthread.so.0 #11 0x00007f52719c6edd in clone () from /lib64/libc.so.6 The last bit in the log was an update, then it ended: Dec 25 03:31:03 fosse slapd[3333]: conn=561646 op=3 MOD dn="uid=aapriest,ou=user,dc=csupomona,dc=edu " Dec 25 03:31:03 fosse slapd[3333]: conn=561646 op=3 MOD attr=csupomonaEduPersonExpiration When I saw the alert on my phone when I woke up I assumed it would have something to do with the memberOf overlay issues I was already looking into but this seems different. I restarted it and it synced right back up from the failover master and seems to be ok now. Does this pop out as anything known and possibly resolved in head? Thanks...

1 0

LDAP User can't login can su to with root account
by Frank Yu 25 Dec '16

25 Dec '16

Hi All, I have setup a LDAP service on host A, and configure ldap client on host B. when I tried to login host B with user which already added in LDAP server, it report error even through I enter right passwd shanzhi.yu(a)10.10.10.101's password: debug3: send packet: type 50 debug2: we sent a password packet, wait for reply debug3: receive packet: type 51 debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password Permission denied, please try again. shanzhi.yu(a)10.10.10.101's password: debug3: send packet: type 50 debug2: we sent a password packet, wait for reply debug3: receive packet: type 51 debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password Permission denied, please try again. shanzhi.yu(a)10.10.10.101's password:" and, I can su to user shanzhi.yu on host B [root@ host B ~]# su shanzhi.yu [shanzhi.yu@ host B root]$ cd [shanzhi.yu@ host B ~]$ What's the problem? any config should I do? Thanks -- Regards Frank Yu

2 4

Bulk change user's attribute
by Bruno Miguel Martins 23 Dec '16

23 Dec '16

Hello guys, I am running slapd 2.3.30 and I need to bulk modify one LDAP attribute (sambaHomePath) for all of my users, like: Current value = \\oldserver\username<file://oldserver/username> New value = \\newserver\username<file://newserver/username> Can this be done? Basically I need a partial change of that attribute - "oldserver" which is variable, changed with "newserver" which is fixed. Thank you! [cid:image002.png@01D25D11.3775A610] BRUNO MIGUEL MARTINS | System Engineer +351 926 845 866 www.iten.pt<http://www.iten.pt>

1 0

help with ACL
by Alberto Aldrigo 23 Dec '16

23 Dec '16

1 0

Re: memberOf overlay issues with 2.4.44 + ITS 8432 patch
by Quanah Gibson-Mount 23 Dec '16

23 Dec '16

----- Original Message ----- > From: "Paul B. Henson" <henson(a)acm.org> > To: openldap-technical(a)openldap.org > Sent: Wednesday, December 21, 2016 6:56:30 PM > Subject: memberOf overlay issues with 2.4.44 + ITS 8432 patch > So far, I've only seem this behavior for group membership removals. Adds > don't seem to cause a problem, nor do create/delete of groups or users > as far as I can tell. > > Any thoughts on what's going on here? It's not causing any failures yes, > as removing members multiple times results in the same end state and the > multiple replication seems to have a fairly low upper bound. But it > would be nice to fix it :). Looks like a bug with the memberOf overlay when it is instantiated in a delta-syncrepl environment, based on this statement from the memberOf man page: The memberof overlay may be used with any backend that provides full read-write functionality, but it is mainly intended for use with local storage backends. The maintenance operations it performs are internal to the server on which the overlay is configured and are never replicated. Replica servers should be configured with their own instances of the memberOf overlay if it is desired to maintain these memberOf attributes on the replicas. Probably worth adding to ITS#8444. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: ppolicy overlay unable to set pwdAccountLockedTime on to-be-locked users due to ACLs
by Howard Chu 22 Dec '16

22 Dec '16

Matthieu Cerda wrote: > Hello folks, > > I just stumbled upon a (maybe not) surprising technical issue with my > OpenLDAP setup: ppolicy seems unable to update pwdAccountLockedTime on > my users. > > Setup: > > * OpenLDAP 2.4.40(+dfsg-1+deb8u2) on Debian jessie > > * Password policy and ACLs: > > ---8<--- > dn: cn=default,ou=policies,dc=company,dc=com > objectClass: top > objectClass: person > objectClass: pwdPolicy > cn: passwordDefault > cn: default > pwdAttribute: userPassword > sn: passwordDefault > pwdAllowUserChange: TRUE > pwdCheckQuality: 0 > pwdExpireWarning: 0 > pwdFailureCountInterval: 0 > pwdGraceAuthNLimit: 0 > pwdInHistory: 3 > pwdLockout: TRUE > pwdLockoutDuration: 300 > pwdMaxAge: 0 > pwdMaxFailure: 3 > pwdMinAge: 0 > pwdMinLength: 8 > pwdMustChange: FALSE > pwdSafeModify: FALSE > ---8<--- > > ---8<--- > access to attrs=userPassword,shadowLastChange > by dn="uid=mcerda,ou=people,dc=company,dc=com" write > by self write > by anonymous auth > by * none > > access to dn.base="" by * read > > access to * > by dn="uid=mcerda,ou=people,dc=company,dc=com" write > by users read > by * none > ---8<--- > > * pwdFailureTime gets updated on each failed login attempt on users > until pwdMaxFailure is reached (3) > > * Testing for account locking is done both by observing we appearance in > user object and using '-e ppolicy' on ldapsearch (ppolicy_use_lockout is > enabled) > > Everytime an user reaches pwdMaxFailure count, the debug log (level > 65535) gives: > > ---8<--- > 585947a5 => mdb_entry_get: found entry: > "cn=default,ou=policies,dc=company,dc=com" > 585947a5 mdb_entry_get: rc=0 > 585947a5 mdb_modify: uid=fbar,ou=people,dc=company,dc=com > 585947a5 slap_queue_csn: queueing 0x65696ef4bce0 > 20161220150053.705334Z#000000#000#000000 > 585947a5 mdb_dn2entry("uid=fbar,ou=people,dc=company,dc=com") > 585947a5 => mdb_dn2id("uid=fbar,ou=people,dc=company,dc=com") > 585947a5 <= mdb_dn2id: got id=0x9 > 585947a5 => mdb_entry_decode: > 585947a5 <= mdb_entry_decode > 585947a5 mdb_modify_internal: 0x00000009: > uid=fbar,ou=people,dc=company,dc=com > 585947a5 => access_allowed: result not in cache (pwdAccountLockedTime) > 585947a5 => access_allowed: delete access to > "uid=fbar,ou=people,dc=company,dc=com" "pwdAccountLockedTime" requested > 585947a5 => dn: [2] > 585947a5 => acl_get: [3] attr pwdAccountLockedTime > 585947a5 => acl_mask: access to entry > "uid=fbar,ou=people,dc=company,dc=com", attr "pwdAccountLockedTime" > requested > 585947a5 => acl_mask: to all values by "", (=0) > 585947a5 <= check a_dn_pat: uid=mcerda,ou=people,dc=company,dc=com > 585947a5 <= check a_dn_pat: users > 585947a5 <= check a_dn_pat: anonymous > 585947a5 <= acl_mask: [3] applying read(=rscxd) (stop) > 585947a5 <= acl_mask: [3] mask: read(=rscxd) > 585947a5 => slap_access_allowed: delete access denied by read(=rscxd) > 585947a5 => access_allowed: no more rules > 585947a5 mdb_modify: modify failed (50) > 585947a5 send_ldap_result: conn=1000 op=0 p=3 > 585947a5 send_ldap_result: err=50 matched="" text="" > 585947a5 slap_graduate_commit_csn: removing 0x6569601047f0 > 20161220150053.705334Z#000000#000#000000 > 585947a5 send_ldap_response: msgid=1 tag=97 err=49 > ---8<--- > > I can't see a reason why the update gets denied. Setting the global ACL to: > > ---8<--- > access to * > by dn="uid=mcerda,ou=people,dc=company,dc=com" write > by * write > ---8<--- > > fixes the issue (but I obviously not want an open bar slapd). > > The documentation (http://www.openldap.org/doc/admin24/overlays.html) > advises nothing about ACLs. That is not the documentation, that is only a guide. The manpages are the authoritative documentation. > > Is this and issue or a misconfiguration ? Read the slapo-ppolicy(5) manpage. > > Thanks in advance, -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

memberOf overlay issues with 2.4.44 + ITS 8432 patch
by Paul B. Henson 22 Dec '16

22 Dec '16

I recently updated to openldap 2.4.44 with the patch for ITS 8432. I'd been holding off in hopes of a new release with that patch included and for some update on ITS 8444, but decided to go ahead and push it through during the holiday break. I installed it on my dev environment and was unable to replicate the issues reported in ITS 8444 so went ahead and rolled into production. However, now that I'm in production, I'm seeing different issues with the memberOf overlay. It seems for some reason group membership deletions are getting replicated multiple times? In the logs, I will see something like the following: Dec 21 04:16:59 themis slapd[2607]: conn=364875 op=227806 MOD dn="uid=members,ou=group,dc=cpp,dc=edu" Dec 21 04:16:59 themis slapd[2607]: conn=364875 op=227806 MOD attr=member My identity management system connected and removed some members from this group. Next, there will be a number of lines like this: Dec 21 04:17:15 themis slapd[2607]: conn=-1 op=0: memberof_value_modify DN="uid=prsloan,ou=user,dc=cpp,dc=edu" delete memberOf="uid=members,ou=group,dc=cpp,dc=edu" failed err=16 Dec 21 04:17:16 themis slapd[2607]: conn=-1 op=0: memberof_value_modify DN="uid=prsloan,ou=user,dc=cpp,dc=edu" delete memberOf="uid=members,ou=group,dc=cpp,dc=edu" failed err=16 Dec 21 04:17:17 themis slapd[2607]: conn=-1 op=0: memberof_value_modify DN="uid=prsloan,ou=user,dc=cpp,dc=edu" delete memberOf="uid=members,ou=group,dc=cpp,dc=edu" failed err=16 Dec 21 04:17:18 themis slapd[2607]: conn=-1 op=0: memberof_value_modify DN="uid=prsloan,ou=user,dc=cpp,dc=edu" delete memberOf="uid=members,ou=group,dc=cpp,dc=edu" failed err=16 Dec 21 04:17:18 themis slapd[2607]: conn=-1 op=0: memberof_value_modify DN="uid=prsloan,ou=user,dc=cpp,dc=edu" delete memberOf="uid=members,ou=group,dc=cpp,dc=edu" failed err=16 Dec 21 04:17:18 themis slapd[2607]: conn=-1 op=0: memberof_value_modify DN="uid=prsloan,ou=user,dc=c Where the memberOf overlay is complaining that it can't remove the corresponding memberOf attribute from the user. Reviewing the accesslog, we see: dn: reqStart=20161221121659.000002Z,cn=accesslog objectClass: auditModify structuralObjectClass: auditModify reqStart: 20161221121659.000002Z reqEnd: 20161221121706.000000Z reqType: modify reqSession: 364875 reqAuthzID: cn=idmgmt,ou=user,ou=service,dc=cpp,dc=edu reqDN: uid=members,ou=group,dc=cpp,dc=edu reqResult: 0 reqMod: member:- uid=jjtringali,ou=user,dc=cpp,dc=edu reqMod: member:- uid=kaijulee,ou=user,dc=cpp,dc=edu reqMod: member:- uid=srknight,ou=user,dc=cpp,dc=edu reqMod: member:- uid=ppimentel,ou=user,dc=cpp,dc=edu reqMod: member:- uid=epdetering,ou=user,dc=cpp,dc=edu reqMod: member:- uid=ktran,ou=user,dc=cpp,dc=edu [...] reqMod: member:- uid=prsloan,ou=user,dc=cpp,dc=edu The initial tranaction from my client, authenticated as cn=idmgmt. This one is successful and the overlay deletes the memberOf attribute. However, there are then *six* more instances of the same transaction: dn: reqStart=20161221121714.000001Z,cn=accesslog objectClass: auditModify structuralObjectClass: auditModify reqStart: 20161221121714.000001Z reqEnd: 20161221121715.000000Z reqType: modify reqSession: 3 reqAuthzID: cn=ldaproot,dc=cpp,dc=edu reqDN: uid=members,ou=group,dc=cpp,dc=edu reqResult: 0 reqMod: member:- uid=jjtringali,ou=user,dc=cpp,dc=edu reqMod: member:- uid=kaijulee,ou=user,dc=cpp,dc=edu reqMod: member:- uid=srknight,ou=user,dc=cpp,dc=edu reqMod: member:- uid=ppimentel,ou=user,dc=cpp,dc=edu reqMod: member:- uid=epdetering,ou=user,dc=cpp,dc=edu reqMod: member:- uid=ktran,ou=user,dc=cpp,dc=edu [...] reqMod: member:- uid=prsloan,ou=user,dc=cpp,dc=edu dn: reqStart=20161221121716.000001Z,cn=accesslog objectClass: auditModify structuralObjectClass: auditModify reqStart: 20161221121716.000001Z reqEnd: 20161221121716.000002Z reqType: modify reqSession: 1 reqAuthzID: cn=ldaproot,dc=cpp,dc=edu reqDN: uid=members,ou=group,dc=cpp,dc=edu reqResult: 0 reqMod: member:- uid=jjtringali,ou=user,dc=cpp,dc=edu reqMod: member:- uid=kaijulee,ou=user,dc=cpp,dc=edu reqMod: member:- uid=srknight,ou=user,dc=cpp,dc=edu reqMod: member:- uid=ppimentel,ou=user,dc=cpp,dc=edu reqMod: member:- uid=epdetering,ou=user,dc=cpp,dc=edu reqMod: member:- uid=ktran,ou=user,dc=cpp,dc=edu [...] reqMod: member:- uid=prsloan,ou=user,dc=cpp,dc=edu dn: reqStart=20161221121716.000004Z,cn=accesslog objectClass: auditModify structuralObjectClass: auditModify reqStart: 20161221121716.000004Z reqEnd: 20161221121717.000002Z reqType: modify reqSession: 1 reqAuthzID: cn=ldaproot,dc=cpp,dc=edu reqDN: uid=members,ou=group,dc=cpp,dc=edu reqResult: 0 reqMod: member:- uid=jjtringali,ou=user,dc=cpp,dc=edu reqMod: member:- uid=kaijulee,ou=user,dc=cpp,dc=edu reqMod: member:- uid=srknight,ou=user,dc=cpp,dc=edu reqMod: member:- uid=ppimentel,ou=user,dc=cpp,dc=edu reqMod: member:- uid=epdetering,ou=user,dc=cpp,dc=edu reqMod: member:- uid=ktran,ou=user,dc=cpp,dc=edu [...] reqMod: member:- uid=prsloan,ou=user,dc=cpp,dc=edu dn: reqStart=20161221121717.000001Z,cn=accesslog objectClass: auditModify structuralObjectClass: auditModify reqStart: 20161221121717.000001Z reqEnd: 20161221121718.000000Z reqType: modify reqSession: 2 reqAuthzID: cn=ldaproot,dc=cpp,dc=edu reqDN: uid=members,ou=group,dc=cpp,dc=edu reqResult: 0 reqMod: member:- uid=jjtringali,ou=user,dc=cpp,dc=edu reqMod: member:- uid=kaijulee,ou=user,dc=cpp,dc=edu reqMod: member:- uid=srknight,ou=user,dc=cpp,dc=edu reqMod: member:- uid=ppimentel,ou=user,dc=cpp,dc=edu reqMod: member:- uid=epdetering,ou=user,dc=cpp,dc=edu reqMod: member:- uid=ktran,ou=user,dc=cpp,dc=edu [...] reqMod: member:- uid=prsloan,ou=user,dc=cpp,dc=edu dn: reqStart=20161221121718.000001Z,cn=accesslog objectClass: auditModify structuralObjectClass: auditModify reqStart: 20161221121718.000001Z reqEnd: 20161221121718.000002Z reqType: modify reqSession: 2 reqAuthzID: cn=ldaproot,dc=cpp,dc=edu reqDN: uid=members,ou=group,dc=cpp,dc=edu reqResult: 0 reqMod: member:- uid=jjtringali,ou=user,dc=cpp,dc=edu reqMod: member:- uid=kaijulee,ou=user,dc=cpp,dc=edu reqMod: member:- uid=srknight,ou=user,dc=cpp,dc=edu reqMod: member:- uid=ppimentel,ou=user,dc=cpp,dc=edu reqMod: member:- uid=epdetering,ou=user,dc=cpp,dc=edu reqMod: member:- uid=ktran,ou=user,dc=cpp,dc=edu [...] reqMod: member:- uid=prsloan,ou=user,dc=cpp,dc=edu dn: reqStart=20161221121718.000003Z,cn=accesslog objectClass: auditModify structuralObjectClass: auditModify reqStart: 20161221121718.000003Z reqEnd: 20161221121718.000004Z reqType: modify reqSession: 2 reqAuthzID: cn=ldaproot,dc=cpp,dc=edu reqDN: uid=members,ou=group,dc=cpp,dc=edu reqResult: 0 reqMod: member:- uid=jjtringali,ou=user,dc=cpp,dc=edu reqMod: member:- uid=kaijulee,ou=user,dc=cpp,dc=edu reqMod: member:- uid=srknight,ou=user,dc=cpp,dc=edu reqMod: member:- uid=ppimentel,ou=user,dc=cpp,dc=edu reqMod: member:- uid=epdetering,ou=user,dc=cpp,dc=edu reqMod: member:- uid=ktran,ou=user,dc=cpp,dc=edu [...] reqMod: member:- uid=prsloan,ou=user,dc=cpp,dc=edu These are are performed by cn=ldaproot, and correspond to the six error messages from the overlay about failing to remove the attribute (which was already removed). Similarly, on a replica: Dec 21 04:17:16 coeus slapd[2841]: conn=-1 op=0: memberof_value_modify DN="uid=prsloan,ou=user,dc=cpp,dc=edu" delete memberOf="uid=members,ou=group,dc=cpp,dc=edu" failed err=16 There is one error, because there are two copies of the transaction: dn: reqStart=20161221121706.000001Z,cn=accesslog objectClass: auditModify structuralObjectClass: auditModify reqStart: 20161221121706.000001Z reqEnd: 20161221121716.000000Z reqType: modify reqSession: 1 reqAuthzID: cn=ldaproot,dc=cpp,dc=edu reqDN: uid=members,ou=group,dc=cpp,dc=edu reqResult: 0 reqMod: member:- uid=jjtringali,ou=user,dc=cpp,dc=edu reqMod: member:- uid=kaijulee,ou=user,dc=cpp,dc=edu reqMod: member:- uid=srknight,ou=user,dc=cpp,dc=edu reqMod: member:- uid=ppimentel,ou=user,dc=cpp,dc=edu reqMod: member:- uid=epdetering,ou=user,dc=cpp,dc=edu reqMod: member:- uid=ktran,ou=user,dc=cpp,dc=edu [...] reqMod: member:- uid=prsloan,ou=user,dc=cpp,dc=edu dn: reqStart=20161221121714.000002Z,cn=accesslog objectClass: auditModify structuralObjectClass: auditModify reqStart: 20161221121714.000002Z reqEnd: 20161221121716.000001Z reqType: modify reqSession: 3 reqAuthzID: cn=ldaproot,dc=cpp,dc=edu reqDN: uid=members,ou=group,dc=cpp,dc=edu reqResult: 0 reqMod: member:- uid=jjtringali,ou=user,dc=cpp,dc=edu reqMod: member:- uid=kaijulee,ou=user,dc=cpp,dc=edu reqMod: member:- uid=srknight,ou=user,dc=cpp,dc=edu reqMod: member:- uid=ppimentel,ou=user,dc=cpp,dc=edu reqMod: member:- uid=epdetering,ou=user,dc=cpp,dc=edu reqMod: member:- uid=ktran,ou=user,dc=cpp,dc=edu [...] reqMod: member:- uid=prsloan,ou=user,dc=cpp,dc=edu So far, I've only seem this behavior for group membership removals. Adds don't seem to cause a problem, nor do create/delete of groups or users as far as I can tell. Any thoughts on what's going on here? It's not causing any failures yes, as removing members multiple times results in the same end state and the multiple replication seems to have a fairly low upper bound. But it would be nice to fix it :). Thanks...

1 0

ppolicy overlay unable to set pwdAccountLockedTime on to-be-locked users due to ACLs
by Matthieu Cerda 21 Dec '16

21 Dec '16

Hello folks, I just stumbled upon a (maybe not) surprising technical issue with my OpenLDAP setup: ppolicy seems unable to update pwdAccountLockedTime on my users. Setup: * OpenLDAP 2.4.40(+dfsg-1+deb8u2) on Debian jessie * Password policy and ACLs: ---8<--- dn: cn=default,ou=policies,dc=company,dc=com objectClass: top objectClass: person objectClass: pwdPolicy cn: passwordDefault cn: default pwdAttribute: userPassword sn: passwordDefault pwdAllowUserChange: TRUE pwdCheckQuality: 0 pwdExpireWarning: 0 pwdFailureCountInterval: 0 pwdGraceAuthNLimit: 0 pwdInHistory: 3 pwdLockout: TRUE pwdLockoutDuration: 300 pwdMaxAge: 0 pwdMaxFailure: 3 pwdMinAge: 0 pwdMinLength: 8 pwdMustChange: FALSE pwdSafeModify: FALSE ---8<--- ---8<--- access to attrs=userPassword,shadowLastChange by dn="uid=mcerda,ou=people,dc=company,dc=com" write by self write by anonymous auth by * none access to dn.base="" by * read access to * by dn="uid=mcerda,ou=people,dc=company,dc=com" write by users read by * none ---8<--- * pwdFailureTime gets updated on each failed login attempt on users until pwdMaxFailure is reached (3) * Testing for account locking is done both by observing we appearance in user object and using '-e ppolicy' on ldapsearch (ppolicy_use_lockout is enabled) Everytime an user reaches pwdMaxFailure count, the debug log (level 65535) gives: ---8<--- 585947a5 => mdb_entry_get: found entry: "cn=default,ou=policies,dc=company,dc=com" 585947a5 mdb_entry_get: rc=0 585947a5 mdb_modify: uid=fbar,ou=people,dc=company,dc=com 585947a5 slap_queue_csn: queueing 0x65696ef4bce0 20161220150053.705334Z#000000#000#000000 585947a5 mdb_dn2entry("uid=fbar,ou=people,dc=company,dc=com") 585947a5 => mdb_dn2id("uid=fbar,ou=people,dc=company,dc=com") 585947a5 <= mdb_dn2id: got id=0x9 585947a5 => mdb_entry_decode: 585947a5 <= mdb_entry_decode 585947a5 mdb_modify_internal: 0x00000009: uid=fbar,ou=people,dc=company,dc=com 585947a5 => access_allowed: result not in cache (pwdAccountLockedTime) 585947a5 => access_allowed: delete access to "uid=fbar,ou=people,dc=company,dc=com" "pwdAccountLockedTime" requested 585947a5 => dn: [2] 585947a5 => acl_get: [3] attr pwdAccountLockedTime 585947a5 => acl_mask: access to entry "uid=fbar,ou=people,dc=company,dc=com", attr "pwdAccountLockedTime" requested 585947a5 => acl_mask: to all values by "", (=0) 585947a5 <= check a_dn_pat: uid=mcerda,ou=people,dc=company,dc=com 585947a5 <= check a_dn_pat: users 585947a5 <= check a_dn_pat: anonymous 585947a5 <= acl_mask: [3] applying read(=rscxd) (stop) 585947a5 <= acl_mask: [3] mask: read(=rscxd) 585947a5 => slap_access_allowed: delete access denied by read(=rscxd) 585947a5 => access_allowed: no more rules 585947a5 mdb_modify: modify failed (50) 585947a5 send_ldap_result: conn=1000 op=0 p=3 585947a5 send_ldap_result: err=50 matched="" text="" 585947a5 slap_graduate_commit_csn: removing 0x6569601047f0 20161220150053.705334Z#000000#000#000000 585947a5 send_ldap_response: msgid=1 tag=97 err=49 ---8<--- I can't see a reason why the update gets denied. Setting the global ACL to: ---8<--- access to * by dn="uid=mcerda,ou=people,dc=company,dc=com" write by * write ---8<--- fixes the issue (but I obviously not want an open bar slapd). The documentation (http://www.openldap.org/doc/admin24/overlays.html) advises nothing about ACLs. Is this and issue or a misconfiguration ? Thanks in advance, -- Matthieu Cerda

2 1

Re: PID File
by Quanah Gibson-Mount 21 Dec '16

21 Dec '16

Actually to start with, try using the correct db_recover binary while in the data directory. If that fails, then remove the alock file and see if slapd will start. Sadly not uncommon for alock to report problems incorrectly. But agree, best thing to do after those steps is move to back-mdb on a current release. --Quanah > On Dec 20, 2016, at 1:41 PM, Clément OUDOT <clem.oudot(a)gmail.com> wrote: > > 2016-12-20 22:35 GMT+01:00 Singley, Norman <Norman.Singley(a)mso.umt.edu>: >> Thanks. Here are the results. I can start googling this result, but I am kind of a newbie at openldap, so if you know something obvious, let me know. Thank you very much. >> >> >> # service slapd debug >> slapd: [INFO] Using /etc/default/slapd for configuration >> slapd: [INFO] Halting OpenLDAP... >> slapd: [INFO] Can't read PID file, to stop OpenLDAP try: /etc/init.d/slapd forcestop >> slapd: [INFO] No db_recover done >> slapd: [INFO] Launching OpenLDAP... >> slapd: [OK] File descriptor limit set to 1024 >> 5859a359 @(#) $OpenLDAP: slapd 2.4.36 (Apr 8 2014 12:06:19) $ >> username@itds120.umt.edu:/u01/app/openldap-2.4.36/servers/slapd >> 5859a359 hdb_db_open: database "dc=umt,dc=edu": alock package is unstable. >> 5859a359 backend_startup_one (type=hdb, suffix="dc=umt,dc=edu"): bi_db_open failed! (-1) >> 5859a359 slapd stopped > > > The database seems corrupted. > > You can try to slapcat to get a backup of the data (or try service > slapd backup). Then remove all files and reimport data with slapadd > (or try service slapd restore). > > > You should then try to upgrade to 2.4.44 and use LMDB backend. > > > Clément. >

3 2

PID File
by Singley, Norman 20 Dec '16

20 Dec '16

Hi Folks - I am getting the No PID file for openLDAP error when starting/stopping slapd. run]# /etc/init.d/slapd stop slapd: [INFO] Using /etc/default/slapd for configuration slapd: [INFO] Halting OpenLDAP... slapd: [INFO] Can't read PID file, to stop OpenLDAP try: /etc/init.d/slapd forcestop [root@itds120 run]# /etc/init.d/slapd forcestop slapd: [INFO] Using /etc/default/slapd for configuration slapd: [INFO] Killing OpenLDAP with force... slapd: [INFO] Found no OpenLDAP process running with ldap://oldap.umt.edu:389 ldaps://oldap.umt.edu:636 slapd: [INFO] Killing OpenLDAP replication with force... slapd: [INFO] Found no slurpd process running [root@itds120 run]# ps -ea | grep slapd 6723 ? 00:00:00 slapd [root@itds120 run]# /etc/init.d/slapd start slapd: [INFO] Using /etc/default/slapd for configuration slapd: [INFO] Launching OpenLDAP configuration test... slapd: [OK] OpenLDAP configuration test successful slapd: [INFO] No db_recover done slapd: [INFO] Launching OpenLDAP... slapd: [OK] File descriptor limit set to 1024 slapd: [ALERT] No PID file for OpenLDAP [root@itds120 run]# ps -ea | grep slapd 6723 ? 00:00:00 slapd It seems to show that openLDAP is running on this box, but I can't connect to it. The slapd.conf file is attached. I see a lot of results about this error out there on the web, but most of the fixes like manually creating the pid file don't seem to work. If anyone has any tips I can try, it would be greatly appreciated. This is a standalone (test oldap, running 2.4.36) on redhat 6. Thanks in advance. Norman Singley Directory Services 406 243 6799 Norman.singley(a)mso.umt.edu

2 3

Re: Antw: RE: Constraint violation when swapping two unique attributes
by Howard Chu 20 Dec '16

20 Dec '16

Bannister, Mark wrote: > Howard Chu wrote: >>> Ulrich Windl wrote: >>>>>>> Ulrich Windl schrieb am 20.12.2016 um 08:09 in Nachricht <5858D90F.7AD : 161 : 60728>: >>>>>>>> "Bannister, Mark" <Mark.Bannister(a)morganstanley.com> schrieb am >>>>>>>> 19.12.2016 um >>>>> 16:43 in Nachricht >>>>> >>>>> [...] >>>>>> Agreed. LDAP doesn't have a swap operation. There's a shame. >>>>> [...] >>>>> >>>>> More generally LDAP has no transactions for updates. I wonder if a >> >> Wrong, LDAP Transactions are specified in RFC 5805. Please stop posting misinformation to this list. > > Interesting. I see RFC 5805 is classified as "experimental". How widely is it implemented? Does OpenLDAP support it? Does an LDAP client support it? If they did this would solve my constraint violation problem, I presume. Support is merged in the OpenLDAP 2.5 release branch. Unclear that this would help you, which is why I didn't mention it before. It depends on when the constraint overlay takes effect. The overlay will still see two independent operations, even though a transaction is in place. You're still better off doing the rename - that will work on all existing LDAP implementations. And to the list in general - you're better off ignoring all of Ulrich Windl's posts. He clearly has no idea what he's talking about, and over the past couple years has shown no evidence of improving his knowledge. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: Antw: RE: Constraint violation when swapping two unique attributes
by Howard Chu 20 Dec '16

20 Dec '16

Bannister, Mark wrote: > Ulrich Windl wrote: >>>>> Ulrich Windl schrieb am 20.12.2016 um 08:09 in Nachricht <5858D90F.7AD : 161 : 60728>: >>>>>> "Bannister, Mark" <Mark.Bannister(a)morganstanley.com> schrieb am >>>>>> 19.12.2016 um >>> 16:43 in Nachricht >>> >>> [...] >>>> Agreed. LDAP doesn't have a swap operation. There's a shame. >>> [...] >>> >>> More generally LDAP has no transactions for updates. I wonder if a Wrong, LDAP Transactions are specified in RFC 5805. Please stop posting misinformation to this list. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

RE: Antw: RE: Constraint violation when swapping two unique attributes
by Bannister, Mark 20 Dec '16

20 Dec '16

Ulrich Windl wrote: > >>> Ulrich Windl schrieb am 20.12.2016 um 08:09 in Nachricht <5858D90F.7AD : 161 : 60728>: > >>>> "Bannister, Mark" <Mark.Bannister(a)morganstanley.com> schrieb am > >>>> 19.12.2016 um > > 16:43 in Nachricht > > > > [...] > > > Agreed. LDAP doesn't have a swap operation. There's a shame. > > [...] > > > > More generally LDAP has no transactions for updates. I wonder if a > > transaction mechanism could be implemented using LDAP extensions. > > Occassionally for some mass-update I'd prefer the whole update to fail > > if a few operations failed. Currently you'll have to fix each failing > > operation separately... > > And of course it would be cool if LDIF could be extended to be able to bracket changes with transactions, > so automation could be made easier, maybe even breaking mass updates into managable chunks... I'm sure that would be a difficult change to make. I tried putting in something close to this in the PROSE Programming Language, which is a language extension on top of an LDAP data model. I provided a way of guaranteeing atomicity when there are multiple add, modify or delete operations to perform on a single object, so that if any single in the list failed then none of the changes are left applied, and I also invented the concept of an "object edit buffer" where you could group together adds, mods and deletes in a single transaction which you commit in a single step. However, this is internal to the language and does not extend to LDAP nor LDIF, was very difficult to implement in a consistent manner, does not encompass changes to multiple objects and has no solution at all that will work with virtual attributes. In summary, what you ask is very hard to do well. Mark. -------------------------------------------------------------------------------- NOTICE: Morgan Stanley is not acting as a municipal advisor and the opinions or views contained herein are not intended to be, and do not constitute, advice within the meaning of Section 975 of the Dodd-Frank Wall Street Reform and Consumer Protection Act. If you have received this communication in error, please destroy all electronic and paper copies and notify the sender immediately. Mistransmission is not intended to waive confidentiality or privilege. Morgan Stanley reserves the right, to the extent permitted under applicable law, to monitor electronic communications. This message is subject to terms available at the following link: http://www.morganstanley.com/disclaimers If you cannot access these links, please notify us by reply message and we will send the contents to you. By communicating with Morgan Stanley you consent to the foregoing and to the voice recording of conversations with personnel of Morgan Stanley.

1 0

Re: OpenLDAP ACL causing error code 49
by Quanah Gibson-Mount 19 Dec '16

19 Dec '16

--On Monday, December 19, 2016 10:33 AM -0500 Matty <matty91(a)gmail.com> wrote: > Does anyone happen to know why "acl_mask: to value by" shows "" > instead of the dn of the user passed to the "-D" option? The > suggestions above work but I am still curious why the anonymous bind > is occurring. There is no way for the LDAP server to know that the connection claiming to be DN "X" is actually that DN until /after/ authentication occurs. Thus, until the point at which authentication is successful, the connection is treated as anonymous. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Constraint violation when swapping two unique attributes
by Howard Chu 19 Dec '16

19 Dec '16

Bannister, Mark wrote: > Hi, > > > > I’m using the unique overlay on OpenLDAP 2.4.30 on Solaris 11.3 like this: > > > > overlay unique > > unique_uri > ldap:///ou=Ethers,dc=mydomain,dc=com?macAddress?sub?objectClass=ieee802Device > > > > to force the macAddress to be unique. > > > > This works well, except if I attempt to swap the macAddress between two > entries in a single LDAP modify operation, like this: > > > > dn: cn=host1-eth0,ou=Ethers,dc=mydomain,dc=com > > changetype: modify > > replace: macAddress > > macAddress: <current host1-eth1 value> > > > > dn: cn=host1-eth1,ou=Ethers,dc=mydomain,dc=com > > changetype: modify > > replace: macAddress > > macAddress: <current host1-eth0 value> That's two separate modify operations, not a single operation. > > > > I get: > > > > ldap_modify: Constraint violation (19) > > additional info: some attributes not unique > > > > Is there a way to swap two values without tripping this error? Seems unlikely. Why don't you rename the entries instead? > > > > Thanks, > > Mark. > > > > ------------------------------------------------------------------------------ > > NOTICE: Morgan Stanley is not acting as a municipal advisor and the opinions > or views contained herein are not intended to be, and do not constitute, > advice within the meaning of Section 975 of the Dodd-Frank Wall Street Reform > and Consumer Protection Act. If you have received this communication in error, > please destroy all electronic and paper copies and notify the sender > immediately. Mistransmission is not intended to waive confidentiality or > privilege. Morgan Stanley reserves the right, to the extent permitted under > applicable law, to monitor electronic communications. This message is subject > to terms available at the following link: > http://www.morganstanley.com/disclaimers If you cannot access these links, > please notify us by reply message and we will send the contents to you. By > communicating with Morgan Stanley you consent to the foregoing and to the > voice recording of conversations with personnel of Morgan Stanley. > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

3 3

Re: OpenLDAP ACL causing error code 49
by Matty 19 Dec '16

19 Dec '16

On Mon, Nov 21, 2016 at 12:45 PM, Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Monday, November 21, 2016 6:41 PM +0100 Michael Ströder > <michael(a)stroeder.com> wrote: > >> Matty wrote: >>> >>> I am testing some OpenLDAP ACLs and stumbled on a weird issue. My >>> configuration has the following ACL defined: >>> >>> access to * >>> by users read >>> by peername.ip=1.2.3.4 read >>> by * none >> >> ^^^^ >> You probably want "auth" in this last <who> clause. >> >> Ciao, Michael. >> > > or: > by anonymous auth > by * none > > may be closer. That works as well but I'm still not real clear why running: $ ldapsearch -b 'dc=foo,dc=com' -x -h ldap1 -W -D 'uid=bingo,ou=users,dc=foo,dc=com' '(objectClass=*)' Results in an anonymous bind: Nov 16 09:50:02 tulip slapd[17803]: => acl_get: [2] attr userPassword Nov 16 09:50:02 tulip slapd[17803]: => acl_mask: access to entry "uid=bingo,ou=users,dc=foo,dc=com", attr "userPassword" requested Nov 16 09:50:02 tulip slapd[17803]: => acl_mask: to value by "", (=0) Does anyone happen to know why "acl_mask: to value by" shows "" instead of the dn of the user passed to the "-D" option? The suggestions above work but I am still curious why the anonymous bind is occurring. Thanks for the awesome feedback, - Ryan

1 0

Constraint violation when swapping two unique attributes
by Bannister, Mark 19 Dec '16

19 Dec '16

Hi, I'm using the unique overlay on OpenLDAP 2.4.30 on Solaris 11.3 like this: overlay unique unique_uri ldap:///ou=Ethers,dc=mydomain,dc=com?macAddress?sub?objectClass=ieee802Device to force the macAddress to be unique. This works well, except if I attempt to swap the macAddress between two entries in a single LDAP modify operation, like this: dn: cn=host1-eth0,ou=Ethers,dc=mydomain,dc=com changetype: modify replace: macAddress macAddress: <current host1-eth1 value> dn: cn=host1-eth1,ou=Ethers,dc=mydomain,dc=com changetype: modify replace: macAddress macAddress: <current host1-eth0 value> I get: ldap_modify: Constraint violation (19) additional info: some attributes not unique Is there a way to swap two values without tripping this error? Thanks, Mark. ________________________________ NOTICE: Morgan Stanley is not acting as a municipal advisor and the opinions or views contained herein are not intended to be, and do not constitute, advice within the meaning of Section 975 of the Dodd-Frank Wall Street Reform and Consumer Protection Act. If you have received this communication in error, please destroy all electronic and paper copies and notify the sender immediately. Mistransmission is not intended to waive confidentiality or privilege. Morgan Stanley reserves the right, to the extent permitted under applicable law, to monitor electronic communications. This message is subject to terms available at the following link: http://www.morganstanley.com/disclaimers If you cannot access these links, please notify us by reply message and we will send the contents to you. By communicating with Morgan Stanley you consent to the foregoing and to the voice recording of conversations with personnel of Morgan Stanley.

1 0

OpenLDAP performance and slapindex
by Real, Elizabeth (392K) 16 Dec '16

16 Dec '16

Hello, I’m running OpenLDAP 2.4.40 on two multi-master servers with replication enabled. Today we switched over to this instance, imported all users from the old ldap server, and configured an ldap client to use this instance. Everything is working well, users are authenticating and able to access their assigned groups. However, we noticed that while on the ldap client and as a regular user we type “w” to see who is logged on this machine, it takes a while before we get a response with the results. If we type “w” again the response is very fast due to caching. In looking at ways to improve performance of ldap, is slapindex a tool to use? Meaning after importing users accounts from an older ldap, should slapindex be ran? Or is this tool is used when you want to modify/add entries found in the slapd (cn=config.ldif) and database ((olcDatabase={2}hdb.ldif) configuration files not when users are added to the ldap database. If slapindex is not a tool to use to monitor performance, what do you recommend? Thank you, Liz

3 2

Re: OpenLDAP performance and slapindex
by Quanah Gibson-Mount 15 Dec '16

15 Dec '16

--On Thursday, December 15, 2016 8:27 PM +0000 "Real, Elizabeth (392K)" <Elizabeth.Real(a)jpl.nasa.gov> wrote: ># less /var/log/ldap.log | grep index > > > > Dec 15 12:22:01 slapd[27852]: <= bdb_equality_candidates: (uid) not > indexed Hi Liz, As I noted previously, you need to look at the actual search being executed. This is because, as Michael noted, indexing is not necessarily always the best solution performance wise. I'd guess that you likely need to add indices on those attributes, but I can't say for certain w/o the corresponding log lines that caused those warnings to be generated. And without those log lines, it is not possible to determine what /type/ of indexing should be used if it is proven necessary. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: OpenLDAP performance and slapindex
by Quanah Gibson-Mount 15 Dec '16

15 Dec '16

--On Wednesday, December 14, 2016 9:05 PM +0000 "Real, Elizabeth (392K)" <Elizabeth.Real(a)jpl.nasa.gov> wrote: > > > Hello, > > > > I'm running OpenLDAP 2.4.40 Upgrade immediately to 2.4.44. The 2.4.40 release was seriously flawed and had numerous critical bugs around replication. > In looking at ways to improve performance of ldap, is slapindex a tool to > use? Meaning after importing users accounts from an older ldap, should > slapindex be ran? Or is this tool is used when you want to modify/add > entries found in the slapd (cn=config.ldif) and database > ((olcDatabase={2}hdb.ldif) configuration files not when users are added > to the ldap database. Stop using back-hdb. Switch to back-mdb. <https://mishikal.wordpress.com/2013/05/16/openldap-a-comparison-of-back-mdb…> If you already had indices defined for the database when you did the import, there is no reason to run slapindex. Slapindex should only be used if you've added a /new/ index to your database. If you are using cn=config and add a new index, there will be a background thread that will eventually index the entire DB. Whether or not you need to add indexing for given attribute(s) can be discovered by examining the logs generated by slapd, which will file a complaint if there is a search performed on an unindexed attribute. You would need to examine the specific search to see what type(s) of indexing may be required. > If slapindex is not a tool to use to monitor performance, what do you > recommend? slapindex has never been a tool to monitor anything. It is purely for (re)generating indices on an existing DB. Hope that helps! Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

3 3

replica consumers and ppolicy overlay values like PwdFailureTime
by John Jasen 15 Dec '16

15 Dec '16

I'm trying to setup OpenLDAP on CentOS7, in a provider/consumer relationship. In general, provider/consumer is working quite well, except when it comes to password policy. Specifically, I want PwdFailureTime to be written to the provider from one of the front end consumers when appropriate. I'm lead to believe this requires: a) ppolicy_foward_updates TRUE (done) b) an appropriate syncrepl configuration for the consumer (I believe done) c) updateref $LDAP-provider-URI (done) d) an appropriate chain overlay on the provider (I think done) e) appropriate ACLs on the provider to allow the consumer bind-user access to manage PwdFailureTime (I believe done) I've attempted all of the above, but the consumer (when run in debugging mode), does not seem to be trying any updates upon authentication failure. It gives no indication of modifying locally, or of trying to contact the provider at all over this. Any idea whats going wrong?

1 1

Re: OpenLDAP performance and slapindex
by Quanah Gibson-Mount 14 Dec '16

14 Dec '16

--On Wednesday, December 14, 2016 9:36 PM +0000 "Real, Elizabeth (392K)" <Elizabeth.Real(a)jpl.nasa.gov> wrote: > > > Thank you for the quick response. > > > > I have spent a lot of time configuring version 2.4.40. Is there a guide > on how to upgrade to 2.4.44 and switch to back-mdb? we rolled out 2.4.40 > today and would need to plan the next upgrade. As long as it is linked to the same BDB libraries as your 2.4.40 build, it is simply a drop in binary upgrade. > What tool do you recommend for monitoring ldap performance? I suggest applying the operation duration patch: <https://github.com/Zimbra/packages/blob/master/thirdparty/openldap/patches/…> That will tell you exactly how long each operation is taking in slapd, as long as you have "stats" logging enabled. Then you can tell if the issue is at the slapd server, or if there is something else in between that is causing the delay that you see. My suspicion would be that there is something else interfering. As for migrating from hdb to mdb, it's generally straight forward. You'd need to export your data database to LDIF, and then export cn=config, and change the HDB specific bits to MDB, and drop the parameters specific to HDB that aren't required for MDB. If you want to see a basic cn=config templated configuration, you can look at: <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=blob_plain;f=test…> where @BACKEND@ can be any of bdb/hdb/mdb, and tweak as necessary from there. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Expanding OpenLDAP use
by Quanah Gibson-Mount 10 Dec '16

10 Dec '16

--On Saturday, December 10, 2016 5:15 PM -0200 xsun <matheus.morais(a)gmail.com> wrote: > > Great! > > > Thank you so far lads. > > > > Matheus Morais The Zimbra product uses OpenLDAP to store numerous data, everything from server configurations to user accounts, etc. It is deployed at sites large and small throughout the world, plenty with many millions of accounts. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Expanding OpenLDAP use
by xsun 10 Dec '16

10 Dec '16

Hi, I'm trying to expanding OpenLDAP use where I work. Right now we use it to handle internal users (about 50000 entries) and organizational data and it work superb. I'm trying to convince my colleagues to also store our customers data but they are worried about the performance since this will be much larger as we have about 4 million customers. I'm looking for some public uses cases for large number of users in OpenLDAP to give more support to my arguments. So, can anyone share some history or point out some information on the web on that particular subject? Thanks, Matheus Morais

2 2

Re: Antw: Replication through BDB
by Howard Chu 10 Dec '16

10 Dec '16

Ulrich Windl wrote: >>>> Rick van Rein <rick(a)openfortress.nl> schrieb am 08.12.2016 um 22:37 in > Nachricht <5849D28D.8050408(a)openfortress.nl>: >> Hello, >> >> I've been thinking about replication schemes lately. I very much like >> SyncRepl, especially that it can be used in master-master mode, but it >> also has a downside -- it returns before a majority of replicated >> servers have agreed on a change. One might say that the change is >> committed before certainty has been established. > > It seems you are mixing a quorum protocol with a synchronisation protocol: RAID1 with sequential (not parallel) writes has the same weaknesses, BTW. > > if a change was committed to one server, the change is there; certainly. What is your "certainty"? > >> >> This is different with the replication scheme that is now built into >> BerkeleyDB, by Oracle; this has a scheme based on majority voting, and >> with automatic resumption after downtime based on this majority. The >> BerkeleyDB will not return cheerfully from a commit until a majority has >> confirmed. > > Generally the majority can be wrong: Assume you have a network-failure in a three-node MMR configuration: You update one node while the other two are unreachable. The communication resumes, do you expect the change on the none node to be reverted to majority, or should the majority be updated from the one node that has more recent data? Indeed. In syncrepl, "voting" is irrelevant. Changes will be accepted by any provider node that a client can reach. When connectivity is restored all nodes will bring each other up to date. In majority-based voting, you will lose any writes to the minority node, which leaves you with unresolvable inconsistencies. I.e., data is removed but the clients believe it was written. >> AFAIK the HDB backend that was once the default for OpenLDAP has been >> replaced with the plain vanilla BerkeleyDB... so it seems that the >> replication scheme of the latter can be used. Is that right / does >> anyone see problems with that / ...? back-hdb and back-bdb both use BerkeleyDB. BerkeleyDB is now deprecated/obsolete, and LMDB is the default backend. BDB's replication is page-oriented, so it would consume far more network resources than syncrepl. We have never recommended its use. At this point, with the licensing incompatibility, it's all moot. > Oracle licensing conditions may be a different thing. > Despite of all that LDAP replication is not done at the database level. > > Was the intention of your message to say: "Oracle has the better databases"? > > Regards, > Ulrich > > > > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

Replication through BDB
by Rick van Rein 09 Dec '16

09 Dec '16

Hello, I've been thinking about replication schemes lately. I very much like SyncRepl, especially that it can be used in master-master mode, but it also has a downside -- it returns before a majority of replicated servers have agreed on a change. One might say that the change is committed before certainty has been established. This is different with the replication scheme that is now built into BerkeleyDB, by Oracle; this has a scheme based on majority voting, and with automatic resumption after downtime based on this majority. The BerkeleyDB will not return cheerfully from a commit until a majority has confirmed. AFAIK the HDB backend that was once the default for OpenLDAP has been replaced with the plain vanilla BerkeleyDB... so it seems that the replication scheme of the latter can be used. Is that right / does anyone see problems with that / ...? Thanks, Rick van Rein for ARPA2.net / InternetWide.org

2 1

Re: Replication through BDB
by Quanah Gibson-Mount 09 Dec '16

09 Dec '16

--On Thursday, December 08, 2016 10:37 PM +0100 Rick van Rein <rick(a)openfortress.nl> wrote: > AFAIK the HDB backend that was once the default for OpenLDAP has been > replaced with the plain vanilla BerkeleyDB... so it seems that the > replication scheme of the latter can be used. Is that right / does > anyone see problems with that / ...? BerkeleyDB6 and later does not have a license that is compatible with OpenLDAP. All support for it as a backend will be removed in the future. I wouldn't base anything on BDB's replication methods. For multimaster, I'd advise using delta-syncrepl replication. I've had numerous clients with multimillion entry DBs where MMR works just fine. For there to really be an issue would require simultaneous updates to the same attribute on the same entry, which could happen theoretically but in practice is not something I've seen occur. And if you're particularly concerned about such things, then the correct route to go would be to set up a load balancer in front of the masters so only one specific master gets write traffic during a given interval, which is referred to as mirror mode in the admin guide. Hope that helps. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Allow to pass on "undefined" filters in back-perl
by W.Siebert＠t-systems.com 06 Dec '16

06 Dec '16

Hi all, Is the issue on the bottom still valid? I have a massive problem with back-perl. LDAP bind often refused with "operation error". My system: Oracle Linux Server release 6.8 Linux oralinux00 2.6.39-400.278.2.el6uek.i686 #1 SMP Wed May 4 13:52:54 PDT 2016 i686 i686 i386 GNU/Linux [root@oralinux00 ~]# cat /proc/version Linux version 2.6.39-400.278.2.el6uek.i686 (mockbuild@x86-ol6-builder-06) (gcc version 4.4.6 20110731 (Red Hat 4.4.6-3) (GCC) ) #1 SMP Wed May 4 13:52:54 PDT 2016 perl, v5.10.1 (*) built for i386-linux-thread-multi openldap-2.4.44 So installed: ./configure --enable-modules=yes --enable-rewrite=yes --enable-ldap=yes --enable-perl=yes --enable-relay=yes --enable-sock=yes --enable-meta=yes --enable-hdb=yes --enable-bdb=yes --enable-overlays=yes CFLAGS="-I/usr/include -I/usr/include/openssl/ -I/usr/include/sasl/" CPPFLAGS="-I/usr/include -I/usr/include/openssl/ -I/usr/include/sasl/" LDFLAGS="-L/usr/lib" Can anyone help me? Kind regards Waldemar [Date Prev<http://www.openldap.org/lists/openldap-devel/200412/msg00031.html>][Date Next<http://www.openldap.org/lists/openldap-devel/200412/msg00033.html>] [Chronological]<http://www.openldap.org/lists/openldap-devel/200412/index.html> [Thread]<http://www.openldap.org/lists/openldap-devel/200412/threads.html> [Top]<http://www.openldap.org/lists/openldap-devel> Success Story: Perl Backend [X] * To: openldap-devel(a)OpenLDAP.org<mailto:openldap-devel%40OpenLDAP.org> * Subject: Success Story: Perl Backend * From: reinhard.e.voglmaier(a)gsk.com<mailto:reinhard.e.voglmaier%40gsk.com> * Date: Tue, 7 Dec 2004 10:11:22 +0100 [X] This just to inform you that I succeeded in install and run the Perl Backend with OpenLDAP 2.17 + SuSE Linux 9.1 / OpenLDAP 2.17 + Sun Solaris 9. The only important thing in the whole story is to compile OpenLDAP with exactly the same Compiler Options ( libraries + include files ) the perl interpreter itself got compiled. Now I am delving a little bit deeper into the Perl Backend. BTW: is there documentation around at some place explaining the data structures OpenLDAP is using ? Just to avoid to understand something by code which could be understood a little bit faster with documentation. cheers Reinhard

1 0

Re: Antw: Re: n-way multi master and mirror mode
by Quanah Gibson-Mount 06 Dec '16

06 Dec '16

--On Tuesday, December 06, 2016 8:47 AM +0100 Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de> wrote: >> That still has absolutely zero to do with MMR replication. There are >> useful and valid reasons for using load balancers across a replicated >> pool. Your reponse however indicates a lack of comprehension of what >> Mirror Mode entails. > > I really missed your negative feedback. It wasn't meant as negative or positive, but a simple summary. If you want to provide feedback, that's great. But please take the time to read up and understand the issues being discussed first. The concept of mirror mode, and how it is expected to be configured, is clearly discussed in the admin guide: <http://www.openldap.org/doc/admin24/replication.html#MirrorMode%20replicati…>. Thanks, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Antw: Re: n-way multi master and mirror mode
by Quanah Gibson-Mount 05 Dec '16

05 Dec '16

--On Monday, December 05, 2016 6:44 PM +0100 Michael Ströder <michael(a)stroeder.com> wrote: > Ulrich Windl wrote: >>>>> Quanah Gibson-Mount <quanah(a)symas.com> schrieb am 05.12.2016 um 04:23 >>>>> in >>> There is zero requirement to put a load balancer in front of an MMR >>> setup. >> >> But it seems to make much sense: In my experience if you configure >> multiple LDAP servers, the NSS resolver always uses the first configured >> server as long as it's reachable; even if it's not, the first configured >> server is tried first. > > This depends very much on the client. E.g. sssd works fairly well even > with simple DNS round-robin. The load is almost equally spread. But again, the point with setting up mirror mode is not to spread the load at all. It is to force all writes to a single master. My point being, this is not a necessary requirement for MMR. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: n-way multi master and mirror mode
by Howard Chu 05 Dec '16

05 Dec '16

Brendan Kearney wrote: > On 12/04/2016 04:49 PM, Quanah Gibson-Mount wrote: >> Again, Mirror Mode is a concept, not a setting. The setting you refer to, >> is, as I previously noted, misnamed. Either your servers are configured to >> do multimaster replication, or they aren't. Mirrormode - the concept - is irrelevant here. All of the official docs show the mirrormode setting being used in N-Way multimaster. > yes, i seem to be in the trap about the mirror mode misnomer. though > ambiguous, your statements indicate that mirror mode the setting is required > for n-way multi master replication. That is what the Admin Guide already says. > > i agree most of my traffic is reads. i have 7 examples of connections with > deferred operations. they are all SRCH's (i.e. reads). I seem to misrember > the source of the deferred connections. bind-dyndb-ldap does not show in my > logs. sssd access is what 6 of 7 examples show. below is one sample. This is just due to sssd being very poorly written. It spews out a bunch of LDAP requests without waiting for replies. It then abandons N-1 of the requests as soon as it reads the first reply. And then it reissues the remaining requests, over and over. Instead it should just wait a little longer for all the replies, instead of abandoning and resubmitting the same requests and wasting redundant work. > ReceivedAt FromHost SysLogTag Message > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 fd=29 ACCEPT from > IP=192.168.88.4:59233 (IP=192.168.88.1:389) > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=0 SRCH base="" > scope=0 deref=0 filter="(objectClass=*)" > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=0 SRCH attr=* > altServer namingContexts supportedControl supportedExtension supportedFeatures > supportedLDAPVersion supportedSASLMechanisms domainControllerFunctionality > defaultNamingContext lastUSN highestCommittedUSN > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=0 SEARCH RESULT > tag=101 err=0 nentries=1 text= > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=1 BIND dn="" > method=163 > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=1 RESULT tag=97 > err=14 text=SASL(0): successful result: > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=2 BIND dn="" > method=163 > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=2 RESULT tag=97 > err=14 text=SASL(0): successful result: > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=3 BIND dn="" > method=163 > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=3 BIND > authcid="host/hypervisor.bpk2.com(a)BPK2.COM" > authzid="host/hypervisor.bpk2.com(a)BPK2.COM" > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=3 BIND > dn="cn=hypervisor,ou=computers,dc=bpk2,dc=com" mech=GSSAPI sasl_ssf=56 ssf=56 > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=3 RESULT tag=97 > err=0 text= > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=4 SRCH > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=4 SRCH > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=8 SRCH > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=8 SRCH > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=9 SRCH > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=9 SRCH > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=10 SRCH > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=10 SRCH > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=6 SRCH > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=6 SRCH > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=7 SRCH > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=7 SRCH > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=5 SRCH > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=5 SRCH > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp > 12/04/16 04:00 PM server1 slapd[5033]: connection_input: conn=2434 > deferring operation: too many executing > 12/04/16 04:00 PM server1 slapd[5033]: connection_input: conn=2434 > deferring operation: too many executing > 12/04/16 04:00 PM server1 slapd[5033]: connection_input: conn=2434 > deferring operation: too many executing > 12/04/16 04:00 PM server1 slapd[5033]: connection_input: conn=2434 > deferring operation: too many executing > 12/04/16 04:00 PM server1 slapd[5033]: connection_input: conn=2434 > deferring operation: too many executing > 12/04/16 04:00 PM server1 slapd[5033]: connection_input: conn=2434 > deferring operation: too many executing > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=11 ABANDON msg=5 > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=12 ABANDON msg=6 > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=13 ABANDON msg=7 > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=14 ABANDON msg=8 > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=15 ABANDON msg=9 > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=16 ABANDON msg=10 > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=17 ABANDON msg=11 > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=19 SRCH > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=18 SRCH > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=18 SRCH > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=19 SRCH > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=20 SRCH > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=20 SRCH > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=21 ABANDON msg=19 > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=22 ABANDON msg=20 > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=23 ABANDON msg=21 > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=24 SRCH > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=24 SRCH > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=26 SRCH > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=26 SRCH > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=27 SRCH > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=27 SRCH > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=25 SRCH > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=25 SRCH > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=28 SRCH > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=28 SRCH > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp > 12/04/16 04:03 PM server1 slapd[5033]: connection_input: conn=2434 > deferring operation: too many executing > 12/04/16 04:03 PM server1 slapd[5033]: connection_input: conn=2434 > deferring operation: too many executing > 12/04/16 04:03 PM server1 slapd[5033]: connection_input: conn=2434 > deferring operation: too many executing > 12/04/16 04:03 PM server1 slapd[5033]: connection_input: conn=2434 > deferring operation: too many executing > 12/04/16 04:03 PM server1 slapd[5033]: connection_input: conn=2434 > deferring operation: too many executing > 12/04/16 04:03 PM server1 slapd[5033]: connection_input: conn=2434 > deferring operation: too many executing > 12/04/16 04:03 PM server1 slapd[5033]: connection_input: conn=2434 > deferring operation: too many executing > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=29 SRCH > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=29 SRCH > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=30 ABANDON msg=25 > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=31 ABANDON msg=26 > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=32 ABANDON msg=27 > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=33 ABANDON msg=28 > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=34 ABANDON msg=29 > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=35 ABANDON msg=30 > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=36 SRCH > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=36 SRCH > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=37 ABANDON msg=37 > 12/04/16 04:07 PM server1 slapd[5033]: conn=2434 op=38 SRCH > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > 12/04/16 04:07 PM server1 slapd[5033]: conn=2434 op=38 SRCH > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp > 12/04/16 04:07 PM server1 slapd[5033]: conn=2434 op=39 ABANDON msg=39 > 12/04/16 04:12 PM server1 slapd[5033]: conn=2434 op=40 SRCH > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > 12/04/16 04:12 PM server1 slapd[5033]: conn=2434 op=41 SRCH > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > 12/04/16 04:12 PM server1 slapd[5033]: conn=2434 op=41 SRCH > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp > 12/04/16 04:12 PM server1 slapd[5033]: conn=2434 op=40 SRCH > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp > 12/04/16 04:12 PM server1 slapd[5033]: conn=2434 op=42 SRCH > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > 12/04/16 04:12 PM server1 slapd[5033]: conn=2434 op=42 SRCH > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp > 12/04/16 04:12 PM server1 slapd[5033]: conn=2434 op=43 ABANDON msg=41 > 12/04/16 04:12 PM server1 slapd[5033]: conn=2434 op=44 ABANDON msg=42 > 12/04/16 04:12 PM server1 slapd[5033]: conn=2434 op=45 ABANDON msg=43 > 12/04/16 04:15 PM server1 slapd[5033]: conn=2434 op=46 UNBIND > 12/04/16 04:15 PM server1 slapd[5033]: conn=2434 fd=29 closed > > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

6 5

ACL advice needed ...
by Zeus Panchenko 05 Dec '16

05 Dec '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 greetings, I'm trying to configure ACL, I belive it is possible to ... but after some attempts I doubt it is ... please, help me to understand where I'm making the mistake/s ... I need to manage possibility for "coadmins" group members to manage all except the objects of "admins" group members forgive me please my long explanation ... so I have: Important: the starting point in my case is auth accounts structure: users do auth with (lets call it) "root" objects (most upper level): uid=<USER>,ou=People,dc=abc - ---[ accounts and groups start ]------------------------------------------- dn: uid=admin1,ou=People,dc=abc dn: uid=admin7,ou=People,dc=abc dn: uid=bil,authorizedService=serviceD,uid=admin7,ou=People,dc=abc dn: uid=coadmin5,ou=People,dc=abc dn: uid=johndoe,authorizedService=serviceA,uid=coadmin5,ou=People,dc=abc dn: uid=coadmin6,ou=People,dc=abc dn: cn=admins,dc=abc memberUid: admin1 - ---[ accounts and groups end ]------------------------------------------- group objects memberUid attribute value contains uid of the "root" objects - ---[ group structure start ]------------------------------------------- dn: cn=coadmins,ou=group,dc=abc memberUid: coadmin5 memberUid: coadmin6 - ---[ group structure end ]------------------------------------------- here is the ACL I managed to work as I want: - ---[ quotation start ]------------------------------------------- access to dn.subtree="dc=abc" attrs=userPassword by set="[cn=admin,ou=group,dc=abc]/memberUid & user/uid" manage by set.exact="this/-2 & user" write by self write by anonymous auth by * break - ---[ quotation end ]------------------------------------------- this allows admins to manage passwords of anybody and for all other users manage passwords of self "root" account and service accounts (look structure of account objects above) and now, I had a hope to do the same to get possibility for coadmins to manage passwords of anybody except admins, and here what I thought about: - ---[ quotation start ]------------------------------------------- access to dn.subtree="dc=abc" attrs=userPassword by set="[cn=admin,ou=group,dc=abc]/memberUid & user/uid" manage by set="(([cn=admin,ou=group,dc=abc]/memberUid & this/uid) | ([cn=admin,ou=group,dc=abc]/memberUid & [this/-2]/uid)) & ([cn=coadmin,ou=group,dc=abc]/memberUid & user/uid)" disclose by set="[cn=coadmin,ou=group,dc=abc]/memberUid & user/uid" manage by set.exact="this/-2 & user" write by self write by anonymous auth by * break - ---[ quotation end ]------------------------------------------- and it doesn't work the initial idea of the second `by set=' row is: for coadmins to disallow all access to userPassword if account belongs to admin am I right to expect: 1.1. "[cn=admin,ou=group,dc=abc]/memberUid & this/uid" is true if uid of current record is member of the group `admin' when `this' is the very "root" account (uid=admin7,ou=People,dc=abc) 1.2. "[cn=admin,ou=group,dc=abc]/memberUid & [this/-2]/uid" uid of the "root" account (uid=admin7,ou=People,dc=abc) is admin group member when `this' is service account like: uid=bil,authorizedService=serviceD,uid=admin7,ou=People,dc=abc `this/-2' trimms it to `uid=admin7,ou=People,dc=abc' and `/uid' have to provide uid value 1.3. "[cn=coadmin,ou=group,dc=abc]/memberUid & user/uid" true if currently loggedin user uid is coadmin group member so ... was I successfull to explain what I want? :) - -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET) -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlhFk1kACgkQr3jpPg/3oyp7XgCggcp9Y909JRQOknE7GkgjmZpw /sYAoIyimb3gcy38qZAjlyHfbF+rH63a =aqts -----END PGP SIGNATURE-----

1 0

Re: Antw: Re: n-way multi master and mirror mode
by Quanah Gibson-Mount 05 Dec '16

05 Dec '16

--On Monday, December 05, 2016 9:07 AM +0100 Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de> wrote: > But it seems to make much sense: In my experience if you configure > multiple LDAP servers, the NSS resolver always uses the first configured > server as long as it's reachable; even if it's not, the first configured > server is tried first. After connection timeout the second server is > tried... We had dhad a case when all LDAP operations were heavily delayed > when two out of three servers had failed (due to rebooting the machine). That still has absolutely zero to do with MMR replication. There are useful and valid reasons for using load balancers across a replicated pool. Your reponse however indicates a lack of comprehension of what Mirror Mode entails. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: n-way multi master and mirror mode
by Quanah Gibson-Mount 05 Dec '16

05 Dec '16

--On Saturday, December 03, 2016 3:13 PM -0500 Brendan Kearney <bpk678(a)gmail.com> wrote: > i have a n-way multi master replicated directory, and i currently have > mirror mode turned on. i am getting events in my logs about deferring > operations (too many executing, etc) and want to know if i am causing > these with mirror mode. the reading i am able to do on the topic seems > to indicate that mirror mode is only necessary in provider/consumer > replication, but i wanted to clarify that. is mirror mode necessary for > n-way multi master replication? am i safe to turn it off, if it not > needed? Mirror-Mode is a concept that has nothing to do with OpenLDAP configuration in and of itself. The parameter in slapd.conf/cn=config is badly misnamed. Either your servers are configured for multi-master replication, or they aren't. Mirror mode is simply where you put a load balancer or similar device in front of your LDAP servers and direct write traffic to only one multi-master configured node at a time. See also <http://www.openldap.org/its/index.cgi/?findid=8511>. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

LibLmdb non string data
by Tim Uckun 05 Dec '16

05 Dec '16

I am writing a wrapper for liblmdb and one thing I was able to do was to store simple integers and floats as the value into the database. This seems to work pretty well but I am wondering if this is somehow against best practice. One bad thing about this is that when you are doing a seek or a cursor operation the code does not know what kind of data is at the record. I have some routines to cast them back from the pointers but the user has to know what to cast them to. It would be very handy if the MDB_val struct had a field for metadata, even if it just a byte. Anyway I am wondering how much trouble I am getting myself with this practice. Thanks.

3 3

Re: n-way multi master and mirror mode
by Howard Chu 05 Dec '16

05 Dec '16

Brendan Kearney wrote: > On 12/04/2016 04:49 PM, Quanah Gibson-Mount wrote: >> Again, Mirror Mode is a concept, not a setting. The setting you refer to, >> is, as I previously noted, misnamed. Either your servers are configured to >> do multimaster replication, or they aren't. Mirrormode - the concept - is irrelevant here. All of the official docs show the mirrormode setting being used in N-Way multimaster. > yes, i seem to be in the trap about the mirror mode misnomer. though > ambiguous, your statements indicate that mirror mode the setting is required > for n-way multi master replication. That is what the Admin Guide already says. > > i agree most of my traffic is reads. i have 7 examples of connections with > deferred operations. they are all SRCH's (i.e. reads). I seem to misrember > the source of the deferred connections. bind-dyndb-ldap does not show in my > logs. sssd access is what 6 of 7 examples show. below is one sample. This is just due to sssd being very poorly written. It spews out a bunch of LDAP requests without waiting for replies. It then abandons N-1 of the requests as soon as it reads the first reply. And then it reissues the remaining requests, over and over. Instead it should just wait a little longer for all the replies, instead of abandoning and resubmitting the same requests and wasting redundant work. You're better off using nslcd or nssov, since they actually implement LDAP queries in a competent fashion. > ReceivedAt FromHost SysLogTag Message > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 fd=29 ACCEPT from > IP=192.168.88.4:59233 (IP=192.168.88.1:389) > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=0 SRCH base="" > scope=0 deref=0 filter="(objectClass=*)" > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=0 SRCH attr=* > altServer namingContexts supportedControl supportedExtension supportedFeatures > supportedLDAPVersion supportedSASLMechanisms domainControllerFunctionality > defaultNamingContext lastUSN highestCommittedUSN > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=0 SEARCH RESULT > tag=101 err=0 nentries=1 text= > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=1 BIND dn="" > method=163 > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=1 RESULT tag=97 > err=14 text=SASL(0): successful result: > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=2 BIND dn="" > method=163 > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=2 RESULT tag=97 > err=14 text=SASL(0): successful result: > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=3 BIND dn="" > method=163 > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=3 BIND > authcid="host/hypervisor.bpk2.com(a)BPK2.COM" > authzid="host/hypervisor.bpk2.com(a)BPK2.COM" > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=3 BIND > dn="cn=hypervisor,ou=computers,dc=bpk2,dc=com" mech=GSSAPI sasl_ssf=56 ssf=56 > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=3 RESULT tag=97 > err=0 text= > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=4 SRCH > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=4 SRCH > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=8 SRCH > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=8 SRCH > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=9 SRCH > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=9 SRCH > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=10 SRCH > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=10 SRCH > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=6 SRCH > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=6 SRCH > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=7 SRCH > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=7 SRCH > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=5 SRCH > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=5 SRCH > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp > 12/04/16 04:00 PM server1 slapd[5033]: connection_input: conn=2434 > deferring operation: too many executing > 12/04/16 04:00 PM server1 slapd[5033]: connection_input: conn=2434 > deferring operation: too many executing > 12/04/16 04:00 PM server1 slapd[5033]: connection_input: conn=2434 > deferring operation: too many executing > 12/04/16 04:00 PM server1 slapd[5033]: connection_input: conn=2434 > deferring operation: too many executing > 12/04/16 04:00 PM server1 slapd[5033]: connection_input: conn=2434 > deferring operation: too many executing > 12/04/16 04:00 PM server1 slapd[5033]: connection_input: conn=2434 > deferring operation: too many executing > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=11 ABANDON msg=5 > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=12 ABANDON msg=6 > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=13 ABANDON msg=7 > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=14 ABANDON msg=8 > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=15 ABANDON msg=9 > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=16 ABANDON msg=10 > 12/04/16 04:00 PM server1 slapd[5033]: conn=2434 op=17 ABANDON msg=11 > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=19 SRCH > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=18 SRCH > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=18 SRCH > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=19 SRCH > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=20 SRCH > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=20 SRCH > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=21 ABANDON msg=19 > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=22 ABANDON msg=20 > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=23 ABANDON msg=21 > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=24 SRCH > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=24 SRCH > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=26 SRCH > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=26 SRCH > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=27 SRCH > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=27 SRCH > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=25 SRCH > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=25 SRCH > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=28 SRCH > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > 12/04/16 04:03 PM server1 slapd[5033]: conn=2434 op=28 SRCH > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp > 12/04/16 04:03 PM server1 slapd[5033]: connection_input: conn=2434 > deferring operation: too many executing > 12/04/16 04:03 PM server1 slapd[5033]: connection_input: conn=2434 > deferring operation: too many executing > 12/04/16 04:03 PM server1 slapd[5033]: connection_input: conn=2434 > deferring operation: too many executing > 12/04/16 04:03 PM server1 slapd[5033]: connection_input: conn=2434 > deferring operation: too many executing > 12/04/16 04:03 PM server1 slapd[5033]: connection_input: conn=2434 > deferring operation: too many executing > 12/04/16 04:03 PM server1 slapd[5033]: connection_input: conn=2434 > deferring operation: too many executing > 12/04/16 04:03 PM server1 slapd[5033]: connection_input: conn=2434 > deferring operation: too many executing > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=29 SRCH > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=29 SRCH > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=30 ABANDON msg=25 > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=31 ABANDON msg=26 > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=32 ABANDON msg=27 > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=33 ABANDON msg=28 > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=34 ABANDON msg=29 > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=35 ABANDON msg=30 > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=36 SRCH > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=36 SRCH > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp > 12/04/16 04:04 PM server1 slapd[5033]: conn=2434 op=37 ABANDON msg=37 > 12/04/16 04:07 PM server1 slapd[5033]: conn=2434 op=38 SRCH > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > 12/04/16 04:07 PM server1 slapd[5033]: conn=2434 op=38 SRCH > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp > 12/04/16 04:07 PM server1 slapd[5033]: conn=2434 op=39 ABANDON msg=39 > 12/04/16 04:12 PM server1 slapd[5033]: conn=2434 op=40 SRCH > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > 12/04/16 04:12 PM server1 slapd[5033]: conn=2434 op=41 SRCH > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > 12/04/16 04:12 PM server1 slapd[5033]: conn=2434 op=41 SRCH > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp > 12/04/16 04:12 PM server1 slapd[5033]: conn=2434 op=40 SRCH > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp > 12/04/16 04:12 PM server1 slapd[5033]: conn=2434 op=42 SRCH > base="ou=SUDO Groups,ou=Roles,dc=bpk2,dc=com" scope=2 deref=0 > filter="(&(objectClass=sudoRole)(modifyTimestamp>=20150104230653Z)(!(modifyTimestamp=20150104230653Z)))" > > 12/04/16 04:12 PM server1 slapd[5033]: conn=2434 op=42 SRCH > attr=objectClass cn sudoCommand sudoHost sudoUser sudoOption sudoRunAs > sudoRunAsUser sudoRunAsGroup sudoNotBefore sudoNotAfter sudoOrder modifyTimestamp > 12/04/16 04:12 PM server1 slapd[5033]: conn=2434 op=43 ABANDON msg=41 > 12/04/16 04:12 PM server1 slapd[5033]: conn=2434 op=44 ABANDON msg=42 > 12/04/16 04:12 PM server1 slapd[5033]: conn=2434 op=45 ABANDON msg=43 > 12/04/16 04:15 PM server1 slapd[5033]: conn=2434 op=46 UNBIND > 12/04/16 04:15 PM server1 slapd[5033]: conn=2434 fd=29 closed > > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: n-way multi master and mirror mode
by Quanah Gibson-Mount 04 Dec '16

04 Dec '16

--On Sunday, December 04, 2016 3:42 PM -0500 Brendan Kearney <bpk678(a)gmail.com> wrote: > my line of thinking was that if mirror mode was not appropriate for multi > master replication, then i would remove the setting and eliminate the > item from my list of potential contributing factors. if mirror mode is > not needed, there are potential efforts and cpu cycles being spent on > doing work that is unnecessary or even detrimental to the performance of > slapd. i am looking make sure mirror mode is safe to remove from my > configs, so i can test the theory. Hi Brendan, Again, Mirror Mode is a concept, not a setting. The setting you refer to, is, as I previously noted, misnamed. Either your servers are configured to do multimaster replication, or they aren't. The only time /any/ type of replication, whether it is multimaster or provider/consumer, is really going to have an impact is if you have a significant amount of sustained writes happening. So far, it sounds like your traffic is almost entirely reads. > ReceivedAt SysLogtag Message > 2016-11-15 20:35:05 slapd[1514]: connection_input: conn=6836 > deferring operation: too many executing > 2016-11-15 20:35:05 slapd[1514]: connection_input: conn=6836 > deferring operation: pending operations > 2016-11-15 20:35:11 slapd[1514]: connection_input: conn=6836 > deferring operation: too many executing > 2016-11-15 20:35:11 slapd[1514]: connection_input: conn=6836 > deferring operation: too many executing > 2016-11-15 20:35:11 slapd[1514]: connection_input: conn=6836 > deferring operation: too many executing > 2016-11-15 20:35:11 slapd[1514]: connection_input: conn=6836 > deferring operation: too many executing > 2016-11-15 20:35:11 slapd[1514]: connection_input: conn=6836 > deferring operation: too many executing > 2016-11-15 20:35:11 slapd[1514]: connection_input: conn=6836 > deferring operation: too many executing > 2016-11-15 20:35:11 slapd[1514]: connection_input: conn=6836 > deferring operation: too many executing > 2016-11-15 20:35:11 slapd[1514]: connection_input: conn=6836 > deferring operation: too many executing > 2016-11-15 20:35:11 slapd[1514]: connection_input: conn=6836 > deferring operation: too many executing > 2016-11-15 20:35:11 slapd[1514]: connection_input: conn=6836 > deferring operation: too many executing Yes, you'd need stats logging, and it appears that all of those were only deferred for fractions of a second, which is why you see multiple messages per second. So there's not really any indication here of a problem that I can see. > i am running OpenLDAP: slapd 2.4.44 on fedora 24 using lmdb. > listener threads are the default of 1, and the value is not set. I was asking about "threads/olcThreads", not the listener threads value. That default is 16. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: n-way multi master and mirror mode
by Quanah Gibson-Mount 04 Dec '16

04 Dec '16

--On Saturday, December 03, 2016 6:42 PM -0500 Brendan Kearney <bpk678(a)gmail.com> wrote: > where do i chase down the source of roughly 10k messages a week, given > that this is my home network? do i have a bottleneck in ldap? is > bind-dyndb-ldap pounding on ldap for some unknown reason? i dont believe > this to an appropriate amount of logs for what seems to be a low volume > network. Hi Brendan, a) This has nothing to do with MMR/Mirror Mode b) It's not uncommon, and it rarely indicates a problem. Again, you would need to show that things are actually being deferred for a significant amount of time. Most often it is only for milliseconds. I.e., it's an informational message that may or may not be indicative of a real issue. Overall, you haven't really provided a lot of the necessary information to help you move forward, such as: OpenLDAP release OpenLDAP backend(s) in use Thread settings concurrency settings Specific messages of the problem etc For example, it could be the application(s) are poorly written, and fail to use persistent connections, causing binds to be constantly be deferred. Or it could be searches being deferred, etc. I.e., we have no idea /which/ operations are being deferred because you haven't provided that information. I personally prefer applying the patch to OpenLDAP that provides timing information for every operation so that I can actually tell whether or not real problems are occurring. If that interests you, I can point you at it. Hope that helps! Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: n-way multi master and mirror mode
by brendan kearney 04 Dec '16

04 Dec '16

so is it intended to indicate or dictate active vs standby status? I would want to maintain active/active status for load sharing. I am also not using a load balancer, and rely on SRV records or configs to share load. any ideas why I am seeing deferred operations, otherwise? On Dec 3, 2016 4:28 PM, "Quanah Gibson-Mount" <quanah(a)symas.com> wrote: > --On Saturday, December 03, 2016 3:13 PM -0500 Brendan Kearney < > bpk678(a)gmail.com> wrote: > > i have a n-way multi master replicated directory, and i currently have >> mirror mode turned on. i am getting events in my logs about deferring >> operations (too many executing, etc) and want to know if i am causing >> these with mirror mode. the reading i am able to do on the topic seems >> to indicate that mirror mode is only necessary in provider/consumer >> replication, but i wanted to clarify that. is mirror mode necessary for >> n-way multi master replication? am i safe to turn it off, if it not >> needed? >> > > Mirror-Mode is a concept that has nothing to do with OpenLDAP > configuration in and of itself. The parameter in slapd.conf/cn=config is > badly misnamed. Either your servers are configured for multi-master > replication, or they aren't. > > Mirror mode is simply where you put a load balancer or similar device in > front of your LDAP servers and direct write traffic to only one > multi-master configured node at a time. > > See also <http://www.openldap.org/its/index.cgi/?findid=8511>. > > Regards, > Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > >

2 1

Re: n-way multi master and mirror mode
by Quanah Gibson-Mount 04 Dec '16

04 Dec '16

--On Saturday, December 03, 2016 4:53 PM -0500 brendan kearney <bpk678(a)gmail.com> wrote: > > so is it intended to indicate or dictate active vs standby status? I > would want to maintain active/active status for load sharing. I am also > not using a load balancer, and rely on SRV records or configs to share > load. > > > any ideas why I am seeing deferred operations, otherwise? That's generally normal. Unless you are seeing them be deferred for a significant amount of time, I wouldn't worry about it. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Having issue with openldap with TLS as a AD proxy
by Patrick.Ouellet＠promutuel.ca 03 Dec '16

03 Dec '16

Hello everyone, I hope Im at the right place for these kind of question, please tell me if I’m wrong. I just installed openldap as a proxy for AD. The proxy in itself works fine, I have made a few ldapsearch and got result I was expecting. Now I want to add TLS to it for security reason. I’m using openldap 2.4.42 on Ubuntu 16.04.1 LTS unfortunately it’s built with gnutls which I don’t know much about I would have preferred it to be built with openssl. So Im trying to make TLS work so I added these to slapd.conf TLSCipherSuite HIGH:!NULL TLSCACertificateFile /etc/SSL/LDAP/certificate_chain.cer.pem.gnutls TLSCertificateFile /etc/SSL/LDAP/p01ldp5001.cer.pem TLSCertificateKeyFile /etc/SSL/LDAP/p01ldp5001.key.pem TLSVerifyClient never security ssf=128 I also used certtool (gnutls tool) to validate my certificate I can verify my certificate_chain.cer.pem.gnutls with certtool so the file in itself is okay. certtool -e --infile certificate_chain.cer.pem.gnutls Loaded 2 certificates, 1 CAs and 0 CRLs Subject: C=CA,ST=Quebec,O=Promutuel CES,OU=Operations,CN=Promutuel HWS Intermediate CA 1 Issuer: C=CA,ST=Quebec,L=Quebec,O=Promutuel CES,OU=Operations,CN=Promutuel HWS Root CA Checked against: C=CA,ST=Quebec,L=Quebec,O=Promutuel CES,OU=Operations,CN=Promutuel HWS Root CA Output: Verified. The certificate is trusted. Chain verification output: Verified. The certificate is trusted. I can also verify the whole chain if I make a file containing the 3 certs, CA, Intermediate and Server certtool -e --infile full_chain.pem --verify-hostname p01ldp5001.services.local --verify-purpose 1.3.6.1.5.5.7.3.1 Loaded 3 certificates, 1 CAs and 0 CRLs Subject: C=CA,ST=Quebec,O=Promutuel CES,OU=Operations,CN=Promutuel HWS Intermediate CA 1 Issuer: C=CA,ST=Quebec,L=Quebec,O=Promutuel CES,OU=Operations,CN=Promutuel HWS Root CA Checked against: C=CA,ST=Quebec,L=Quebec,O=Promutuel CES,OU=Operations,CN=Promutuel HWS Root CA Output: Verified. The certificate is trusted. Subject: C=CA,ST=Quebec,L=Quebec,O=Promutuel CES,OU=Operations,CN=p01ldp5001.services.local Issuer: C=CA,ST=Quebec,O=Promutuel CES,OU=Operations,CN=Promutuel HWS Intermediate CA 1 Checked against: C=CA,ST=Quebec,O=Promutuel CES,OU=Operations,CN=Promutuel HWS Intermediate CA 1 Output: Verified. The certificate is trusted. Chain verification output: Verified. The certificate is trusted. Yet when I try to start the server I get this error main: TLS init def ctx failed: -1 Can someone help me with this? Patrick Ouellet [ligne] Administrateur Linux Operation VPSI [promutuel-assurance] Groupe Promutuel 2000, boulevard Lebourgneuf, 4e étage, Québec (Québec) G2K 0B6 [tel] 418 840-1188, poste 2393 / 1 800 510-4630 [telec] 418 840-9900 promutuelassurance.ca<https://www.promutuelassurance.ca/> Si vous devez imprimer ce document, faites-le recto verso. Si vous n'êtes pas le destinataire de ce message, veuillez le détruire après avoir informé l'expéditeur de son erreur. Par ailleurs, il est interdit de copier ou de modifier tout courriel sans l'autorisation de l'auteur. Promutuel Assurance n'assume aucune responsabilité à l'égard du contenu des messages personnels envoyés par ses employés. If you need to print this document, please print it double-sided. If you are not the intended recipient of this message, please notify the sender of the error and destroy the message. Please further note that it is prohibited to copy or modify any email without the author’s permission. Promutuel Insurance accepts no liability whatsoever with regard to the content of personal messages sent by its employees.

3 2

n-way multi master and mirror mode
by Brendan Kearney 03 Dec '16

03 Dec '16

i have a n-way multi master replicated directory, and i currently have mirror mode turned on. i am getting events in my logs about deferring operations (too many executing, etc) and want to know if i am causing these with mirror mode. the reading i am able to do on the topic seems to indicate that mirror mode is only necessary in provider/consumer replication, but i wanted to clarify that. is mirror mode necessary for n-way multi master replication? am i safe to turn it off, if it not needed? thanks in advance, brendan

1 0

Re: Building OpenLDAP with TLS support
by Quanah Gibson-Mount 02 Dec '16

02 Dec '16

--On Thursday, December 01, 2016 4:58 PM -0800 Tom Leach <leach(a)coas.oregonstate.edu> wrote: > So, as a followup to anyone else who may hit this issue, OpenLDAP 2.4.44 > won't build (without a set of patches) using OpenSSL 1.1.0c. I downloaded > the older OpenSSL 1.0.2j and everything built fine. > Hopefully the patches that allow OpenSSL 1.1.0 will be rolled into > OpenLDAP 2.4.45 but it may be longer as there seem to be a number of > OpenSSL API changes. > Tom Hi Tom, This has already been discussed several times in the last month on the list. ;) <http://www.openldap.org/lists/openldap-technical/201611/msg00016.html> is a recent example. Full support for OpenSSL 1.1 is scheduled for 2.4.45. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: LibLmdb non string data
by Howard Chu 02 Dec '16

02 Dec '16

Hallvard Breien Furuseth wrote: > On 02. des. 2016 12:26, Tim Uckun wrote: >> I am writing a wrapper for liblmdb and one thing I was able to do was to >> store simple integers and floats as the value into the database. This seems >> to work pretty well but I am wondering if this is somehow against best >> practice. >> >> One bad thing about this is that when you are doing a seek or a cursor >> operation the code does not know what kind of data is at the record. I have >> some routines to cast them back from the pointers but the user has to know >> what to cast them to. It would be very handy if the MDB_val struct had a >> field for metadata, even if it just a byte. > > LMDB handles binary data fine. The problem is ordering: > > Use a single datatype for each DB, and mdb_set_compare() > mdb_set_dupsort() to order data in that DB properly. Or > MDB_INTEGERKEY/MDB_INTEGERDUP which do this for unsigned int/size_t. > > If that is not feasible and you are mixing different datatypes in a > single database, you need to tag each data item so the compare function > can figure out how to parse and order them all. Note that a slow > compare function can degrade LMDB's performance. > > Note that the compare functions may receive unaligned values. Though > you can hack alignment 2, 4, or sizeof(size_t) = 4 or 8 by ensuring > *every* key and value in a DB has size = multiple of that alignment. > Keys always have alignment of at least 2. Hmm, I should add some > code so data will too except when both key and data have uneven size. > > Requests to add a user-defined argument to the compare functions have > been rejected. If you need that, maybe your wrapper can emulate it by > setting thread-specific data before calling LMDB, and then your sort > function can read that data. That gets cumbersome, though. > > If this is all generic, maybe define a DB with meta-info where your > wrapper can look up which datatypes (sizes, compare functions, whatever) > are in which database. > Or just stick your own identifier byte at the beginning of each data value. (Or key, if you're trying to use different type'd keys.) -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

Question about LibLmdb MDB_GET_BOTH_RANGE and MDB_SET_RANGE
by Tim Uckun 02 Dec '16

02 Dec '16

I am trying to figure out how these calls work. The SET_RANGE works as expected but I was expecting different behavior fro GET_BOTH_RANGE. I have the following code in my spec file. txn.put(db, "1", "1") txn.put(db, "1", "1.1") txn.put(db, "1", "1.2") txn.put(db, "1", "1.3") txn.put(db, "2", "2") txn.put(db, "2.1", "2.1") txn.put(db, "2.2", "2.2") Then I do a seek like this cur.find_ge(".") #this uses SET_RANGE cur.find_ge(".", "1.2") #this uses GET_BOTH_RANGE The result of the first call is "1", "1" but the second call results in a MDB_NOTFOUND Seems like I am missing something here. Thanks.

2 1

Building OpenLDAP with TLS support
by Tom Leach 02 Dec '16

02 Dec '16

OK, I know I'm missing something since I know people are building OpenLDAP with OpenSSL for TLS/SSL, but when I add the --with-tls flag to configure, it all goes pear shaped. I'm starting with freshly downloaded tarballs of openssl-1.1.0c and openldap-2.4.44 on CentOS 7.2.1511. I've install the packages using yum: yum -y install tcp_wrappers tcp_wrappers-devel tcp_wrappers-libs libtool-ltdl-devel I've built/installed openssl with: ./config shared --prefix=/usr/local;make;make test; make install I then successfully build openldap with: ./configure CPPFLAGS="-I/usr/local/include" LDFLAGS="-L/usr/local/lib -Wl,-rpath,/usr/local/lib" --prefix=/usr/local --enable-wrappers --enable-syncprov=yes --enable-crypt=yes --enable-accesslog=yes --enable-auditlog=yes --enable-constraint=yes --enable-ppolicy=yes --enable-modules --enable-mdb --enable-debug=yes --enable-syslog --enable-slapd --enable-cleartext --enable-monitor --enable-overlays -with-threads --enable-rewrite --enable-syncprov=yes (without TLS support) make depend; make; make distclean I now add the "--with-tls=openssl" option to configure it fails with: ./configure CPPFLAGS="-I/usr/local/include" LDFLAGS="-L/usr/local/lib -Wl,-rpath,/usr/local/lib" --prefix=/usr/local --enable-wrappers --enable-syncprov=yes --enable-crypt=yes --enable-accesslog=yes --enable-auditlog=yes --enable-constraint=yes --enable-ppolicy=yes --enable-modules --enable-mdb --enable-debug=yes --enable-syslog --enable-slapd --enable-cleartext --enable-monitor --enable-overlays -with-threads --enable-rewrite --enable-syncprov=yes --with-tls=openssl <snip> checking for sys/un.h... yes checking openssl/ssl.h usability... yes checking openssl/ssl.h presence... yes checking for openssl/ssl.h... yes checking for SSL_library_init in -lssl... no checking for ssl3_accept in -lssl... no configure: error: Could not locate TLS/SSL package In looking at config.log: configure:15466: checking openssl/ssl.h usability configure:15466: cc -c -g -O2 -I/usr/local/include conftest.c >&5 configure:15466: $? = 0 configure:15466: result: yes configure:15466: checking openssl/ssl.h presence configure:15466: cc -E -I/usr/local/include conftest.c configure:15466: $? = 0 configure:15466: result: yes configure:15466: checking for openssl/ssl.h configure:15466: result: yes configure:15478: checking for SSL_library_init in -lssl configure:15503: cc -o conftest -g -O2 -I/usr/local/include -L/usr/local/lib -L/usr/local/lib64 -Wl,-rpath,/usr/local/lib conftest.c -lssl -lcrypto -lresolv >&5 /tmp/ccpvG28c.o: In function `main': /usr/local/src/openldap-2.4.44/conftest.c:107: undefined reference to `SSL_library_init' collect2: error: ld returned 1 exit status configure:15503: $? = 1 The source for OpenSSL 1.1.0c no longer has SSL_library_init in either the ssl or crypto libraries. It's now a macro in ssh.h which references OPENSSL_init_ssl. Since the OpenLDAP configure script doesn't pull in ssh.h in it's test, it doesn't find SSL_library_init and that test fails. As a hack, I changed the test in configure to use OPENSSL_init_ssl instead of SSL_library_init and OpenLDAP successfully configured but that blows up during make with a whole host of errors. I've also tried adding "-I/usr/local/include/openssl" to the CPPFLAGS environment but that doesn't change anything (as I expected): ./configure CPPFLAGS="-I/usr/local/include -I/usr/local/include/openssl" LDFLAGS="-L/usr/local/lib -Wl,-rpath,/usr/local/lib" --prefix=/usr/local --enable-wrappers --enable-syncprov=yes --enable-crypt=yes --enable-accesslog=yes --enable-auditlog=yes --enable-constraint=yes --enable-ppolicy=yes --enable-modules --enable-mdb --enable-debug=yes --enable-syslog --enable-slapd --enable-cleartext --enable-monitor --enable-overlays -with-threads --enable-rewrite --enable-syncprov=yes --with-tls=openssl So, is my next step to pull the dev version of 2.4.45 from git or am I just being a moron? Tom Leach

1 1

Re: restrict openldap TLS version
by Quanah Gibson-Mount 01 Dec '16

01 Dec '16

--On Thursday, December 01, 2016 6:24 PM +0000 David Ward <daward(a)Brocade.COM> wrote: Hi David, > I'm looking for a test method to restrict the level of TLS used with > slapd. I'm running ver 2.4.40 which supports TLS 1.2. I see the > undocumented command 'TLSProtocolMin' to require minimum strength. I > would like to disable certain version. I'm unclear what you mean by undocumented. It is clearly documented in the slapd.conf(5) man page (for 2.4.44), which you can freely view on the OpenLDAP.org website: TLSProtocolMin <major>[.<minor>] Specifies minimum SSL/TLS protocol version that will be negotiated. If the server doesn't support at least that version, the SSL handshake will fail. To require TLS 1.x or higher, set this option to 3.(x+1), e.g., TLSProtocolMin 3.2 would require TLS 1.1. Specifying a minimum that is higher than that supported by the OpenLDAP implementation will result in it requiring the highest level that it does support. This directive is ignored with GnuTLS. There is not, as far as I know, any way to fine tune things beyond this (I.e., accept TLS 1.1 and TLS 1.3, but not TLS 1.2). Hope that helps! Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

3 3

restrict openldap TLS version
by David Ward 01 Dec '16

01 Dec '16

I'm looking for a test method to restrict the level of TLS used with slapd. I'm running ver 2.4.40 which supports TLS 1.2. I see the undocumented command 'TLSProtocolMin' to require minimum strength. I would like to disable certain version. I saw in the thread 'Re: undocumented TLSProtocolMin' that there is mention of 'SSL_OP_NO_TLSv1_2'. Has this been implemented and how do you configure this in slapd.conf? This would be what I'm looking for in a method to toggle different version of TLS. -David

1 0

Change log timestamp: rsyslog changes don't work
by mdii 01 Dec '16

01 Dec '16

Hi all, I'm trying to change the timestamp appears in my openLDAP logs. Today it's the default timestamp (Nov 22 11:55:02), but for debugging reasons I need to show the milliseconds (something like Nov 22 11:55:02:987 or any other format with milliseconds). The logs output are managed by the /etc/rsyslog.d/openldap.conf file: > #Configuration specifique openldap > local4.* @10.2.32.95:514 > local4.* -/custom/log/openldap.log > local5.* @10.2.32.95:514 > local5.* -/custom/log/openldap-oldschema.log My /etc/rsyslog.conf configuration looks like: > # Use default timestamp format > $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat For testing purposes, I change it to: > # Use default timestamp format > $ActionFileDefaultTemplate RSYSLOG_FileFormat Or even to: > # Use default timestamp format > $template myFormat,"PRI: %pri%, MSG: %msg%\n" > $ActionFileDefaultTemplate myFormat But I see no changes in the timestamp (I restart the rsyslog service at each modification) I also notice that I'm just getting the first instance log (-/custom/log/openldap.log), I'm not seeing the second one (-/custom/log/openldap-oldschema.log). Viewing this I have two questions: - why my second instance doesn't log? - why my log timestamp doesn't change when I change the configuration file? I would like to thank you in advance for all the help, Marc

2 1

Re: slapo-smbk5pwd build fixes
by Quanah Gibson-Mount 29 Nov '16

29 Nov '16

--On Saturday, November 05, 2016 7:30 PM -0700 Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Saturday, November 05, 2016 6:30 PM +0200 Emmanuel Dreyfus > <manu(a)netbsd.org> wrote: > >> Hello >> >> slapo-smbk5pwd does not link with newer OpenSSL,because the old des_* >> API was removed. This simple patch uses the new (but available for a >> long time) DES_* API to fix that: >> http://www.openldap.org/its/index.cgi/Incoming?id=8525;selectid=8525 > > Hi Emmanuel, > > The openldap-devel list would be the appropriate place to raise and > discuss this. I will try and look into it further on Monday. This is now in RE24, scheduled for the 2.4.45 release. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

replicate cn=config with exception of "ACLs"
by Stanislav Kopp 29 Nov '16

29 Nov '16

Hello, at the moment we're using master<->slave setup with slapd 2.4.31 using old slapd.conf. I want to migrate all to "cn=config" and if possible replicate cn=config DB to slaves for sake maintenance simplicity, but with exception ofr ACLs rules, because master and slaves have different ACLs. Is it possible, or ist it a good idea in general? The plus of slapd.conf was that I can deploy the same ACL file on all slaves with some automation (e.g. puppet). Thanks, Stan

1 0

Re: OID syntax and NAMEs
by Howard Chu 29 Nov '16

29 Nov '16

Michael Ströder wrote: > Howard Chu wrote: >> Michael Ströder wrote: >>> Eventual I'd like to have a constraint like this: >>> >>> # check whether appropriate password policy is assigned >>> constraint_attribute structuralObjectClass,pwdPolicySubentry >>> set "this/structuralObjectClass & this/pwdPolicySubentry/aeApplicableSOC" >> >> Not possible without custom code. > > Hmm, are this/structuralObjectClass and this/pwdPolicySubentry generally > unusable in set-constraints? > > Or does it not work because of the different matching rules? Yes, because of the matching rule issue. This seems to be a deficiency in either ASN.1 or the LDAP spec, I'm not sure which. The problem is that numeric OIDs are obviously unique, but there's no guarantee that string names are. Moreover, the same name might apply to the OID of an attribute, or an objectclass, or a syntax, or some other entity, and there's no way to tell the objectIdentifierMatch rule which context is relevant. So, we can only match on numeric OIDs. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

Re: OID syntax and NAMEs
by Howard Chu 28 Nov '16

28 Nov '16

Michael Ströder wrote: > HI! > > I've declared an attribute type like this with LDAP syntax OID: > > ( 1.3.6.1.4.1.5427.1.389.100.4.18 > NAME 'aeApplicableSOC' > DESC 'AE-DIR: structural object classes for which policy is applicable' > EQUALITY objectIdentifierMatch > SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 > X-ORIGIN 'AE-DIR' ) > > Which is pretty similar to this: > > ( 2.5.4.0 > NAME 'objectClass' > DESC 'RFC4512: object classes of the entity' > EQUALITY objectIdentifierMatch > SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 ) > > Now I wonder why I can't use the object class NAMEs instead of the OIDs as > attribute or assertion values, e.g. why I can't find the entries with filter > (aeApplicableSOC=aeUser). > > This reminds me a bit of the similar OID vs. NAME issue with 'pwdAttribute' in > 'pwdPolicy' entries. It's the exact same issue. The objectIdentifierMatch function only works with numeric OIDs. The ppolicy overlay inserts its own matching function to make the name work. > > Eventual I'd like to have a constraint like this: > > # check whether appropriate password policy is assigned > constraint_attribute structuralObjectClass,pwdPolicySubentry > set "this/structuralObjectClass & this/pwdPolicySubentry/aeApplicableSOC" Not possible without custom code. > > Ciao, Michael. > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

Re: Ldap not reachable/tuning
by Quanah Gibson-Mount 28 Nov '16

28 Nov '16

--On Friday, November 25, 2016 7:05 PM +0100 Thomas Hummel <thomas.hummel(a)pasteur.fr> wrote: > Hello, > > I'm using a simple setup on CentOS Linux release 7.2.1511 > (Core)/openldap-servers-2.4.40-9 /cn=config/mdb : one provider with the > syncprov overlay and 2 syncrepl consumers. The DIT itself is about 10000 > dn in size (about 3000 active users). > > Everything works fine except that sometimes, some clients report > (temporary) failure to reach the consumers (NAS servers for instance). Hi Thomas, A few notes: a) The CentOS7 build is hacked to support a broken TLS implementation. b) The version (2.4.40) is quite old, and has numerous known problems (it was a particularly broken release). I would also note the CentOS7 build has on occassion had its own problems introduced by patches from RedHat that do not exist in stock OpenLDAP builds. See <http://www.openldap.org/software/release/changes.html> for a list of changes since 2.4.40 was released. c) Nothing you presented indicates any issue on the server side. It could, for example, be an issue with your clients, a firewall, packet shaper, etc. d) You should fully disable rate limiting for rsyslogd. Then find out what the server side reports during the periods of time when you see issues with the client connections. You may wish to examine the LTB builds (<http://ltb-project.org/wiki/download#openldap>) if you are unable to build OpenLDAP yourself, or if you require support for your OpenLDAP installation, Symas (the company I work for) has support options. Hope this helps! --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

OID syntax and NAMEs
by Michael Ströder 28 Nov '16

28 Nov '16

HI! I've declared an attribute type like this with LDAP syntax OID: ( 1.3.6.1.4.1.5427.1.389.100.4.18 NAME 'aeApplicableSOC' DESC 'AE-DIR: structural object classes for which policy is applicable' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 X-ORIGIN 'AE-DIR' ) Which is pretty similar to this: ( 2.5.4.0 NAME 'objectClass' DESC 'RFC4512: object classes of the entity' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 ) Now I wonder why I can't use the object class NAMEs instead of the OIDs as attribute or assertion values, e.g. why I can't find the entries with filter (aeApplicableSOC=aeUser). This reminds me a bit of the similar OID vs. NAME issue with 'pwdAttribute' in 'pwdPolicy' entries. Eventual I'd like to have a constraint like this: # check whether appropriate password policy is assigned constraint_attribute structuralObjectClass,pwdPolicySubentry set "this/structuralObjectClass & this/pwdPolicySubentry/aeApplicableSOC" Ciao, Michael.

1 0

"attr" Warning in slapcat
by Kilian 26 Nov '16

26 Nov '16

Hi, having a strange warning: # /usr/sbin/slapcat -b dc=foo,dc=bar,com 583422d0 /etc/ldap/slapd.d: line 1: "attr" is deprecated (and undocumented); use "attrs" instead. Then, the normal output of slapcat follows. The thing is, /etc/ldap/slapd.d is a *folder* and in the entire /etc/ldap folder, including subdirs, the string "attr" does not occur. Btw, The contents of /etc/ldap/slapd.d are: -rw------- 1 openldap openldap 2386 Jun 5 13:51 cn=config.ldif drwxr-x--- 6 openldap openldap 4096 Nov 20 20:32 cn=config Can anyone give me a hint, what is going on? Best, Kilian

3 3

Ldap not reachable/tuning
by Thomas Hummel 25 Nov '16

25 Nov '16

Hello, I'm using a simple setup on CentOS Linux release 7.2.1511 (Core)/openldap-servers-2.4.40-9 /cn=config/mdb : one provider with the syncprov overlay and 2 syncrepl consumers. The DIT itself is about 10000 dn in size (about 3000 active users). Everything works fine except that sometimes, some clients report (temporary) failure to reach the consumers (NAS servers for instance). All I see in the logs is that when this happens, the time windows loosely match a moment where log rate limiting is dropping messages (for debugging purpose, I disabled journald ratelimiting and doubled default rsyslog one - still some drops occur on a regular basis). So I assume it happens when slapd is kind of busy... Here are some question about that : - First tuning attempt : ------------------------- I noticed that olcDbMaxReaders value was set to 0 (not by me!) I changed it to olcDbMaxReaders: 512 I thought the problem didn't occur anymore but I was wrong. -> Is there any guideline about how to setup MaxReaders ? - Second tuning attempt : ------------------------- I thought maybe replication was responsible (I'm using refreshAndPersist mode) so I raised the size of the sessionLog (from 100 to 800). I read the doc again and I'd like to know if the following understanding is correct : - thanks to contextCSN and the sync cookies, replication CAN be stateless - if we want it stateless, syncprov HAS TO use the present phase, which basically is like sending the whole DIT except that for unchanged entries, only names are sent - if and ONLY IF a state is used (in the form of a sessionLog), then delete phase can be used (and if the sessionLog can hold enough since the last sync) As a matter of fact, at the opposite of the present phase, in the delete phase, syncprov has to 'remember' (i.e store in a sessionLog) which entries has been deleted. -> this assumes that delete phase is more efficient than the present phase, right ? -> if for some reason (for instance sessionLog being too small, delete phase can not be used) syncprov HAS TO fall back to present phase, correct ? -> does using the sessionLog MAKE SENSE AT ALL when using refreshAndPersist mode ? -> is there any guideline to choose the right size for the sessionLog ? - Third tuning attempt ------------------------- I also raised the checkpoint values. -> Is there any guideline here as well ? Thanks. -- Thomas HUMMEL

1 1

support for openssl-1.1.0c
by A. Schulze 25 Nov '16

25 Nov '16

hello, I played with git://git.openldap.org/openldap.git and wrote a patch to support compilation using openssl-1.1.0c Just created a ITS item: http://www.openldap.org/its/index.cgi/Incoming?id=8533 The patch is available here: ftp://ftp.openldap.org/incoming/andreas-schulze-161125.patch maybe some people want to review the code... Hope that helps to step further for 2.4.45 !? Andreas

1 0

Allow to pass on "undefined" filters in back-perl
by W.Siebert＠t-systems.com 25 Nov '16

25 Nov '16

Hi all, I have now the same problem, but with back-perl. We have so one kind of LDAP broker implemented. Reason is to split authentication and authorization by sending the LDAP-bind to one server(Authentication) and LDAP-search for group membership to another (Authorization). Unfortunately one of 6 authorization server is a Microsoft Active Directory, expects LDAP_MATCHING_RULE_IN_CHAIN, and so I get "Bad filter, "(?=undefined)". It is possible to implement a similar workaround as in the back-meta bellow? I think a generally config option to deactivate the filters sanity check were very useful, not for me only. Kind regards Waldemar ------------------------------------------------------------------------------- Hi all, I had exactly the same problem last June. Pierangelo Masarati helped me understanding the problem. He even provided the code for a contrib module to solve this issue. You can search the list for the subject "back_meta does not like my LDAP_MATCHING_RULE_IN_CHAIN filter". I have "packed" all of it into a github repo at https://github.com/cbueche/openldap-passthru and announced it to the list on 6.6.2014. It would be nice if the maintainer take it over to the official openldap tarball within contrib/slapd-modules/mr_passthru/ so future needs are "officially" covered. I think the LDAP_MATCHING_RULE_IN_CHAIN filters will find their use for many other people. Markus: I can help you for the implementation if needed. Feel free to provide for more functionality. Regs, Charles On 23.10.14 08:17, Markus.Storm(a)t-systems.com wrote: > Hi Howard, > > have you had a chance to look into this? > We're a bit desperate over here, short of alternative solutions. > > Regards > Markus > >> -----Original Message----- >> From: Storm, Markus >> Sent: Thursday, September 18, 2014 8:44 AM >> To: 'Howard Chu'; openldap-technical(a)openldap.org >> Subject: AW: allow to pass on "undefined" filters in meta >> >>> -----Ursprüngliche Nachricht----- >>> Von: Howard Chu [mailto:hyc@symas.com] >>> Gesendet: Mittwoch, 17. September 2014 18:17 >>> An: Storm, Markus; openldap-technical(a)openldap.org >>> Betreff: Re: allow to pass on "undefined" filters in meta >>> >>> Markus.Storm(a)t-systems.com wrote: >>>> Hi >>>> I've run into a problem trying to deploy back-meta in front of an >>>> Active Directory target. >>> What is the exact filter you are trying to use? >> a filter such as >> >> (&(objectclass=user) >> (|(memberOf:1.2.840.113556.1.4.1941:=CN=GRP_AAA_ADM,OU=Groups,OU=AAA,OU=Se >> rvers,DC=lab,DC=net) >> (memberOf:1.2.840.113556.1.4.1941:=CN=GRP_BBB_ADM,OU=Groups,OU=AAA,OU=Serv >> ers,DC=lab,DC=net))) >> >> The problem is with the matching rule to be used :1.2.840.113556.1.4.1941: >> That translates into LDAP_MATCHING_RULE_IN_CHAIN which makes the server >> recursively check for nested group membership. That's a feature in AD but >> not supported in OpenLDAP (or at least not by simply specifying that matching >> rule, and to rework the query is no option). >> >>>> I believe that to resolve it, I need to get a new option implemented. >>>> I need to issue a request through a back-meta proxy . That query >>>> happens to contain a matching rule which is not implemented in >>>> OpenLDAP so slapd does not know to evaluate the query. The target >>> that >>>> the query will ultimately be passed on to (an Active Directory) does >>> know to process the query, though. >>>> OpenLDAP, however, considers the filter to be "undefined" and thus >>>> on relaying the request to the AD target, back-meta replaces a >>>> portion >>> of >>>> the original query with a "(?=undefined)" filter as documented in >>> e.g. >>>> slapd-meta manpage "noundeffilter" option. >>>> But I need the original query to be passed on. It's in fact a >>>> _valid_ LDAP request, just OpenLDAP happens to be unable to parse it. >>>> But at least in my setup, slapd does not have to do _/anything/_ >>>> about the query other than to pass it on, so I find it inacceptable >>>> that it replaces the query just because it doesn't understand it. >>>> Please, can you add an option switch to the code to allow for >>>> passing on original queries *without* replacing undefined portions ? >>>> I have not found any other solution to my problem. I tried to make >>>> OpenLDAP aware of the undefined portion by adding the matching rule >>> to >>>> the schema but I failed. Seems that would need to be planted into >>>> the code, and not being a programmer, that's not as easy as it is >>>> with expanding the schema by some new attributes. >>>> Also, while of course any parser/feature enhancement will always be >>>> appreciated, I would think that to implement the matching rule is >>> not >>>> the best way of fixing things: I believe there will always be >>>> situations where OpenLDAP cannot parse the input while another LDAP >>> server can. >>>> For a proof of concept, I hacked servers/slapd/back-meta/map.c >>> (around >>>> line 581as of 2.4.39) and but - again, I'm not a programmer - I >>> feel >>>> incapable of turning this into a full-blown patch free of side >>>> effects, also I want the modification to become available to anyone. >>>> So I'm hoping for you to implement the switch mentioned above, maybe >>>> as a third possible setting for the "noundeffilter" option. >>>> Thanks a lot in advance, >>>> best regards >>>> Markus Storm

1 0

Sync question
by Singley, Norman 22 Nov '16

22 Nov '16

Hi folks - Just a quick question I couldn't quite find the answer to in the oldap documentation. We have a multi-master oldap with three nodes. One node is on a physical machine, and we are planning on doing a physical to virtual migration soon. All three nodes are part of a DNS round robin. We will take the physical node out of the DNS round robin, do the migration and bring the virtual back in. My question regards synchronization. We are using "refreshandpersist" for syncrepl. For the hour or so it takes to do the migration, users will be changing Passwords - that should be the only oldap changes made in that time. Will the password changes that get written to the two existing nodes sync over to the third node when we bring it back up, or will they be lost and we would be out of sync? Thanks for any clarification. Norman Singley Directory Services University of Montana 406 243 6799 Norman.singley(a)mso.umt.edu

2 1

Can't add "same" mail attribute with different cases.
by Patrick Zacharias 22 Nov '16

22 Nov '16

3 3

Re: reusing transactions in LMDB
by Howard Chu 22 Nov '16

22 Nov '16

Tim Uckun wrote: > Hi. > > Sorry for being so dense but... > The document says > > The transaction handle is freed. It and its cursors must not be used again > after this call, except with mdb_cursor_renew(). > > > I am still very confused about reusing transactions. Keep reading. > If I commit or abort a read write transaction I can't reuse the transaction > but I can re use the cursor? In the cursor documentation it says > > Cursors that are only used in read-only transactions may be re-used, to avoid > unnecessary malloc/free overhead. > > So this indicates only read only cursors can be reused right? Yes. > > So can you confirm my understanding? This is what I get from reading the docs. > > A transaction can either be read write or read only. > > If a transaction is read only you can commit or abort the transaction and then > re-open it again for further use. No. Once a transaction is committed or aborted it is freed and cannot be reused. Period, end of story. Both the commit() and abort() docs are quite explicit about this. > If a transaction is read write then it can't be used again after you commit or > abort the transaction. > > > > > > On Tue, Nov 22, 2016 at 3:17 PM, Howard Chu <hyc(a)symas.com > <mailto:hyc@symas.com>> wrote: > > Tim Uckun wrote: > > > > No. You can perform multiple write operations in a single transaction. > > > But once the commit has been called the next write operation has to be > a newly > opened transaction right? The write transactions can't be re-opened. > > http://lmdb.tech/doc/group__mdb.html#ga846fbd6f46105617ac9f4d76476f6597 > <http://lmdb.tech/doc/group__mdb.html#ga846fbd6f46105617ac9f4d76476f6597> > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: Repairing a lmdb database
by Howard Chu 22 Nov '16

22 Nov '16

Tim Uckun wrote: > The language is Crystal which is still a very young language. It does not have > threading at this time so there should be no issues with mutexes. While > writing the code I never opened up a database but did repeatedly open up the > environment and if the app ran into an error while coding didn't properly > close the environment. I didn't ask about languages, I asked about OS and LMDB version. LMDB uses mutexes internally to serialize write transactions. > > Howard while I have you on the line.... > > The documentation says to be very careful about closing databases and says > it's not normally necessary. I am going to omit those calls from my wrapper. > Is this OK? I will probably omit a bunch of other calls too at least from the > first release but I want to make sure I don't omit anything crucial. Probably a good idea to omit dbi_close. > > Thanks. > > On Tue, Nov 22, 2016 at 7:42 AM, Howard Chu <hyc(a)symas.com > <mailto:hyc@symas.com>> wrote: > > Tim Uckun wrote: > > Hi All. > > I am writing a wrapper for Lmdb for the Crystal language. During the > process > of writing my code started hanging when attempting to open a > transaction. At > first I thought I was calling the C functions wrong but it turned out > to be > some sort of a corruption in the database itself. I deleted the database > directory and the code started working fine again. > > > Sounds like you're not using robust mutexes. Just a guess, since you > didn't provide any info about your OS / platform or LMDB version. > > -- > -- Howard Chu > CTO, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc/ > Chief Architect, OpenLDAP http://www.openldap.org/project/ > <http://www.openldap.org/project/> > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

Re: reusing transactions in LMDB
by Howard Chu 22 Nov '16

22 Nov '16

Tim Uckun wrote: > > > No. You can perform multiple write operations in a single transaction. > > > But once the commit has been called the next write operation has to be a newly > opened transaction right? The write transactions can't be re-opened. > http://lmdb.tech/doc/group__mdb.html#ga846fbd6f46105617ac9f4d76476f6597 -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

Re: reusing transactions in LMDB
by Howard Chu 22 Nov '16

22 Nov '16

Tim Uckun wrote: > Another question regarding my wrapper for lmdb. > > The comments say it's possible to reuse read only transactions but says > nothing about reusing the read write transactions. Does this mean every write > operation needs a fresh transaction? No. You can perform multiple write operations in a single transaction. > Is there any downsides to not > implementing the reuse functions for the wrapper? There is a performance gain from reusing read transactions. > I figure the use case is > quite limited and frankly I would have to manage all the transaction pointers > to make sure they were being used property. > > Also I noticed that every call to mdb_txn_id returns 1 even for different > transactions. Is this normal? http://lmdb.tech/doc/group__internal.html#a26512036328af11cdaeb6c9880859290 > Thanks. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

Re: Repairing a lmdb database
by Howard Chu 21 Nov '16

21 Nov '16

Tim Uckun wrote: > Hi All. > > I am writing a wrapper for Lmdb for the Crystal language. During the process > of writing my code started hanging when attempting to open a transaction. At > first I thought I was calling the C functions wrong but it turned out to be > some sort of a corruption in the database itself. I deleted the database > directory and the code started working fine again. Sounds like you're not using robust mutexes. Just a guess, since you didn't provide any info about your OS / platform or LMDB version. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

RE: Sync question
by Quanah Gibson-Mount 21 Nov '16

21 Nov '16

--On Monday, November 21, 2016 6:20 PM +0000 "Singley, Norman" <Norman.Singley(a)mso.umt.edu> wrote: > That's what I thought. Thanks. We are actually running 2.4.36 at the > moment. You may wish to read over <http://www.openldap.org/software/release/changes.html> then. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Re: Can't add "same" mail attribute with different cases.
by Quanah Gibson-Mount 21 Nov '16

21 Nov '16

--On Thursday, November 17, 2016 11:27 PM +0100 Patrick Zacharias <LittleFighter19(a)web.de> wrote: > The gerrit devs (if I recall correctly) argued that this behavior is > intentional as due to the standard, mails can be case sensitive and get > to different recipients. I would stop using a product written by developers who are so clearly clueless. Zero part of the internet is going to work with them if they treat email as case specific. I would in fact point to rfc1274, which SPECIFICALLY notes that the "mail" attribute is NOT case sensitive. 9.3.3. RFC 822 Mailbox The RFC822 Mailbox attribute type specifies an electronic mailbox attribute following the syntax specified in RFC 822. Note that this attribute should not be used for greybook or other non-Internet order mailboxes. rfc822Mailbox ATTRIBUTE WITH ATTRIBUTE-SYNTAX caseIgnoreIA5StringSyntax (SIZE (1 .. ub-rfc822-mailbox)) ::= {pilotAttributeType 3} I also suggest reading RFC822, section 3.4.7: 3.4.7. CASE INDEPENDENCE Except as noted, alphabetic strings may be represented in any combination of upper and lower case. The only syntactic units August 13, 1982 - 14 - RFC #822 Standard for ARPA Internet Text Messages which requires preservation of case information are: - text - qtext - dtext - ctext - quoted-pair - local-part, except "Postmaster" When matching any other syntactic unit, case is to be ignored. For example, the field-names "From", "FROM", "from", and even "FroM" are semantically equal and should all be treated ident- ically. > Now I'd like to know if it possible to modify the scheme that way so that > mail works case sensitive (because that's also what the standard says). No. > Or if there is a way to force the creation of entries with the "same" > value No. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: Sync question
by Quanah Gibson-Mount 21 Nov '16

21 Nov '16

--On Friday, November 18, 2016 4:49 PM +0000 "Singley, Norman" <Norman.Singley(a)mso.umt.edu> wrote: > My question regards synchronization. We are using > "refreshandpersist" for syncrepl. For the hour or so it takes to do > the migration, users will be changing Passwords – that should be the > only oldap changes made in that time. Will the password changes that get > written to the two existing nodes sync over to the third node when we > bring it back up, or will they be lost and we would be out of sync? The third node should "catch up" with the other masters. I will assume you're running the current OpenLDAP release (2.4.44). --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: reusing transactions in LMDB
by Howard Chu 21 Nov '16

21 Nov '16

Tim Uckun wrote: > Also I noticed that every call to mdb_txn_id returns 1 even for different > transactions. Is this normal? http://lmdb.tech/doc/group__internal.html#gadc82bb5e2127ae99ac0c5fe12b955f25 -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: Alias in LDAP tree
by Quanah Gibson-Mount 21 Nov '16

21 Nov '16

--On Sunday, November 20, 2016 9:19 PM +0300 Bogdan Rudas <brudas(a)exadel.com> wrote: > > > > Hello all! > > I have base prefix like 'dc=company,dc=com' and want to replace it with > 'dc=newcompany,dc=biz'. I can't change base prefix everywhere at once due > to application release cycle, change management policy and so on. > It is hard to confirm that all our LDAP clients have aliases > dereferencing enabled and handles it right way. Are there any kind of > 'request rewrite' or 'transparent proxy' options? > > Thank you. Hi, This <http://www.openldap.org/software/man.cgi?query=slapo-rwm&sektion=5&apropos=…> perhaps? Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Re: Can't add "same" mail attribute with different cases.
by Quanah Gibson-Mount 21 Nov '16

21 Nov '16

--On Monday, November 21, 2016 9:50 AM -0800 Quanah Gibson-Mount <quanah(a)symas.com> wrote: > --On Thursday, November 17, 2016 11:27 PM +0100 Patrick Zacharias > <LittleFighter19(a)web.de> wrote: > >> The gerrit devs (if I recall correctly) argued that this behavior is >> intentional as due to the standard, mails can be case sensitive and get >> to different recipients. > > I would stop using a product written by developers who are so clearly > clueless. Zero part of the internet is going to work with them if they > treat email as case specific. (And yes, I understand technically they're correct). But in practice, virtually no one implements this way, because enforcing this simply won't work with the majority of the world. And for LDAP, it's specifically defined as case-insensitive. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: OpenLDAP ACL causing error code 49
by Quanah Gibson-Mount 21 Nov '16

21 Nov '16

--On Monday, November 21, 2016 6:41 PM +0100 Michael Ströder <michael(a)stroeder.com> wrote: > Matty wrote: >> I am testing some OpenLDAP ACLs and stumbled on a weird issue. My >> configuration has the following ACL defined: >> >> access to * >> by users read >> by peername.ip=1.2.3.4 read >> by * none > ^^^^ > You probably want "auth" in this last <who> clause. > > Ciao, Michael. > or: by anonymous auth by * none may be closer. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

OpenLDAP ACL causing error code 49
by Matty 21 Nov '16

21 Nov '16

I am testing some OpenLDAP ACLs and stumbled on a weird issue. My configuration has the following ACL defined: access to * by users read by peername.ip=1.2.3.4 read by * none When I run the following ldapsearch I get an "Invalid credentials (49)" error: $ ldapsearch -b 'dc=foo,dc=com' -x -h ldap1 -W -D 'uid=bingo,ou=users,dc=foo,dc=com' '(objectClass=*)' Enabling the ACL loglevel produces the following: Nov 16 09:50:02 tulip slapd[17803]: conn=33003 op=0 BIND dn="uid=bingo,ou=users,dc=foo,dc=com" method=128 Nov 16 09:50:02 tulip slapd[17803]: => acl_get: [2] attr userPassword Nov 16 09:50:02 tulip slapd[17803]: => acl_mask: access to entry "uid=bingo,ou=users,dc=foo,dc=com", attr "userPassword" requested Nov 16 09:50:02 tulip slapd[17803]: => acl_mask: to value by "", (=0) Nov 16 09:50:02 tulip slapd[17803]: <= check a_dn_pat: users Nov 16 09:42:24 tulip slapd[17803]: <= check a_peername_path: 1.2.3.4 Nov 16 09:42:24 tulip slapd[17803]: <= check a_dn_pat: * Nov 16 09:42:24 tulip slapd[17803]: <= acl_mask: [5] applying none(=0) (stop) Nov 16 09:42:24 tulip slapd[17803]: <= acl_mask: [5] mask: none(=0) Nov 16 09:42:24 tulip slapd[17803]: => slap_access_allowed: auth access denied by none(=0) Nov 16 09:42:24 tulip slapd[17803]: => access_allowed: no more rules Does anyone happen to know why "acl_mask: to value by" shows "" instead of the dn of the user passed to the "-D" option? Wireshark shows the binddn and password being passed to the directory server so the "" doesn't make a ton of sense. If I add the following ACL to force anonymous users to auth the search completes without issue: access to attrs=userPassword by self write by anonymous auth by users none There must be some subtle item I'm missing here. Thanks, - Ryan

2 1

reusing transactions in LMDB
by Tim Uckun 21 Nov '16

21 Nov '16

Another question regarding my wrapper for lmdb. The comments say it's possible to reuse read only transactions but says nothing about reusing the read write transactions. Does this mean every write operation needs a fresh transaction? Is there any downsides to not implementing the reuse functions for the wrapper? I figure the use case is quite limited and frankly I would have to manage all the transaction pointers to make sure they were being used property. Also I noticed that every call to mdb_txn_id returns 1 even for different transactions. Is this normal? Thanks.

1 0

Repairing a lmdb database
by Tim Uckun 21 Nov '16

21 Nov '16

Hi All. I am writing a wrapper for Lmdb for the Crystal language. During the process of writing my code started hanging when attempting to open a transaction. At first I thought I was calling the C functions wrong but it turned out to be some sort of a corruption in the database itself. I deleted the database directory and the code started working fine again. At this point all my code did was to open an environment, set some parameters (max readers and such) and some flags (specifically NO_TLS). I had not attempted to open a database yet as I need a transaction to open a database. I am a little worried that the database caused a hang like this but I will go forward and continue to write the wrapper and see if it happens again. Does anybody have any clues as to why the environment could have corrupted like this? What do I do if it happens again? Thanks.

1 0

Alias in LDAP tree
by Bogdan Rudas 20 Nov '16

20 Nov '16

Hello all! I have base prefix like 'dc=company,dc=com' and want to replace it with 'dc=newcompany,dc=biz'. I can't change base prefix everywhere at once due to application release cycle, change management policy and so on. It is hard to confirm that all our LDAP clients have aliases dereferencing enabled and handles it right way. Are there any kind of 'request rewrite' or 'transparent proxy' options? Thank you. -- Bogdan Rudas Head of Minsk IT Support Department Exadel Inc. http://www.exadel.com/ E-mail: brudas(a)exadel.com Skype ID: bogdan.rudas -- CONFIDENTIALITY NOTICE: This email and files attached to it are confidential. If you are not the intended recipient you are hereby notified that using, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error please notify the sender and delete this email.

1 0

Re: Logging with LDIF format style
by Sylvain 18 Nov '16

18 Nov '16

Oh yes, why not ? slapo-auditlog overlay seems to be nice too ;) Thanks, Sylvain 2016-11-17 18:47 GMT+01:00 Quanah Gibson-Mount <quanah(a)symas.com>: > --On Thursday, November 17, 2016 3:27 PM +0100 Sylvain < > debian.roxx(a)gmail.com> wrote: > > >> >> >> Hi ! >> >> Is there any way (overlay, script, patch, ...) to have OpenLDAP log with >> LDIF format style for easier debugging ? >> > > man slapo-accesslog ? > > DESCRIPTION > The Access Logging overlay can be used to record all accesses > to a > given backend database on another database. This allows all of > the > activity on a given database to be reviewed using arbitrary > LDAP > queries, instead of just logging to local flat text files. > Configuration options are available for selecting a subset of > operation > types to log, and to automatically prune older log records from > the > logging database. Log records are stored with audit schema (see > below) > to assure their readability whether viewed as LDIF or in raw form. > > --Quanah > > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> > >

1 0

Re: Logging with LDIF format style
by Quanah Gibson-Mount 17 Nov '16

17 Nov '16

--On Thursday, November 17, 2016 3:27 PM +0100 Sylvain <debian.roxx(a)gmail.com> wrote: > > > > Hi ! > > Is there any way (overlay, script, patch, ...) to have OpenLDAP log with > LDIF format style for easier debugging ? man slapo-accesslog ? DESCRIPTION The Access Logging overlay can be used to record all accesses to a given backend database on another database. This allows all of the activity on a given database to be reviewed using arbitrary LDAP queries, instead of just logging to local flat text files. Configuration options are available for selecting a subset of operation types to log, and to automatically prune older log records from the logging database. Log records are stored with audit schema (see below) to assure their readability whether viewed as LDIF or in raw form. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Logging with LDIF format style
by Sylvain 17 Nov '16

17 Nov '16

Hi ! Is there any way (overlay, script, patch, ...) to have OpenLDAP log with LDIF format style for easier debugging ? Sylvain

1 0

Re: PROXIED attributeDescription "<foo>" inserted
by Howard Chu 11 Nov '16

11 Nov '16

btb(a)bitrate.net wrote: > recently i noticed these entries in slapcat output: > >> slapcat -F '/var/lib/ldap/config' -b 'cn=config' -H 'ldap:///cn=config??base' > 5824aae9 PROXIED attributeDescription "OU" inserted. > 5824aae9 PROXIED attributeDescription "DC" inserted. > dn: cn=config > objectClass: olcGlobal > cn: config > olcArgsFile: /var/run/slapd/slapd.args > olcConnMaxPending: 1000 > olcConnMaxPendingAuth: 1000 > olcGentleHUP: FALSE > olcIdleTimeout: 0 > olcPidFile: /var/run/slapd/slapd.pid > olcReadOnly: FALSE > olcReverseLookup: FALSE > olcSaslSecProps: noanonymous > olcTLSCACertificateFile: /etc/pki/trusted_root_authorities/example_corp_ > root_ca-cert.pem > olcTLSCertificateFile: /etc/ldap/pki/dsa1.example.net-cert.pem > olcTLSCertificateKeyFile: /etc/ldap/pki/dsa1.example.net-key.pem > olcTLSVerifyClient: never > olcAttributeTypes: {0}( 2.5.4.11 NAME ( 'ou' 'organizationalUnitName' ) > DESC ' > RFC2256: organizational unit this object belongs to' SUP name ) > olcAttributeTypes: {1}( 0.9.2342.19200300.100.1.25 NAME ( 'dc' > 'domainComponen > t' ) DESC 'RFC1274/2247: domain component' EQUALITY caseIgnoreIA5Match > SUBSTR > caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 > SINGLE-VAL > UE ) > structuralObjectClass: olcGlobal > entryUUID: 65ca1166-8375-102d-9386-497a4dd6665c > creatorsName: cn=config > createTimestamp: 20090130235646Z > contextCSN: 20120805020044.490450Z#000000#000#000000 > contextCSN: 20120317151625.496021Z#000000#001#000000 > olcLogLevel: stats sync > entryCSN: 20161110171407.752985Z#000000#000#000000 > modifiersName: uid=dit_admin,ou=role_accounts,ou=accounts,dc=example,dc=net > modifyTimestamp: 20161110171407Z > > in the past, i'd seen this, due to ou and dc attributes being referenced > before their schema elements were loaded. so, as can be seen above, i > moved the declarations of these attributes to the beginning of the config, > so to speak, at which point, the messages were no longer printed. > > but now they're back, and i'm curious why. there is very little parsed > prior to the attribute declarations, i believe? what am i missing? > presumably, it's as it was before, and something is referencing these attributes, but how can i determine what? It is the cn=config entry itself. The LDIF is parsed into Attributes before the Attributes themselves are processed by the config engine. In this case you can either ignore the message, since it's harmless, or change your admin DNs to avoid using non-core attributes. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

PROXIED attributeDescription "<foo>" inserted
by btb＠bitrate.net 11 Nov '16

11 Nov '16

recently i noticed these entries in slapcat output: > slapcat -F '/var/lib/ldap/config' -b 'cn=config' -H 'ldap:///cn=config??base' 5824aae9 PROXIED attributeDescription "OU" inserted. 5824aae9 PROXIED attributeDescription "DC" inserted. dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/slapd/slapd.args olcConnMaxPending: 1000 olcConnMaxPendingAuth: 1000 olcGentleHUP: FALSE olcIdleTimeout: 0 olcPidFile: /var/run/slapd/slapd.pid olcReadOnly: FALSE olcReverseLookup: FALSE olcSaslSecProps: noanonymous olcTLSCACertificateFile: /etc/pki/trusted_root_authorities/example_corp_ root_ca-cert.pem olcTLSCertificateFile: /etc/ldap/pki/dsa1.example.net-cert.pem olcTLSCertificateKeyFile: /etc/ldap/pki/dsa1.example.net-key.pem olcTLSVerifyClient: never olcAttributeTypes: {0}( 2.5.4.11 NAME ( 'ou' 'organizationalUnitName' ) DESC ' RFC2256: organizational unit this object belongs to' SUP name ) olcAttributeTypes: {1}( 0.9.2342.19200300.100.1.25 NAME ( 'dc' 'domainComponen t' ) DESC 'RFC1274/2247: domain component' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VAL UE ) structuralObjectClass: olcGlobal entryUUID: 65ca1166-8375-102d-9386-497a4dd6665c creatorsName: cn=config createTimestamp: 20090130235646Z contextCSN: 20120805020044.490450Z#000000#000#000000 contextCSN: 20120317151625.496021Z#000000#001#000000 olcLogLevel: stats sync entryCSN: 20161110171407.752985Z#000000#000#000000 modifiersName: uid=dit_admin,ou=role_accounts,ou=accounts,dc=example,dc=net modifyTimestamp: 20161110171407Z in the past, i'd seen this, due to ou and dc attributes being referenced before their schema elements were loaded. so, as can be seen above, i moved the declarations of these attributes to the beginning of the config, so to speak, at which point, the messages were no longer printed. but now they're back, and i'm curious why. there is very little parsed prior to the attribute declarations, i believe? what am i missing? presumably, it's as it was before, and something is referencing these attributes, but how can i determine what? -ben

1 0

Re: delta-synrepl consumer randomly delete objects
by Quanah Gibson-Mount 10 Nov '16

10 Nov '16

--On Thursday, November 10, 2016 1:06 PM +0100 Raffael Sahli <public(a)raffaelsahli.com> wrote: > > On 11/03/2016 04:02 PM, Quanah Gibson-Mount wrote: >> >> If your pulling down an empty replica from a master, then that is not >> using delta-sycnrepl at all. I've never had luck with doing that. I >> only do a slapcat from the master then slapadd to the replica, and >> start from there. > No difference, soon after the whole thing was added with slapadd and > restarted slapd it > started to remove most objects again. Again, your log snippet leaves out /why/ it fell back to syncrepl from delta-syncrepl. That's the first thing you need to identify. Something's clearly broken, either in your data or elsewhere, for it to fall back immediately after a slapadd. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: password sync issues
by Arun Gupta 10 Nov '16

10 Nov '16

Hi Anirudh and all, As might be you have seen that I have 2 tree for single user (one have unix password and another have samba password for same user) which have following DN 1. dn: uid=2011150,ou=User,dc=acer,dc=in 2. dn: uid=test1,ou=samba,dc=acer,dc=in How can be use ldappasswd so that password will be sync in both different different trees. Regards, Arun > > Message: 1 > Date: Fri, 4 Nov 2016 16:30:56 +0530 > From: Anirudh Malhotra <8zero2ops(a)gmail.com> > To: Arun Gupta <arung(a)cdac.in> > Cc: openldap-technical(a)openldap.org > Subject: Re: password sync issues > Message-ID: > <CAK7iNp4kJEs0Db7x04cwD5dkq7UY_jDB-ofT8PWsBQv1uig0tQ(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > Hi, > > Running the command:- > > ldappasswd -H ldap://server_domain_or_IP -x -D "user's_dn" -w old_passwd -a >> old_passwd -s new_passwd > > > In shell of openldap server will change the password of "user dn". > > Hope this helps! > > BR, > Anirudh Malhotra > Mail: 8zero2.in(a)gmail.com > Facebook: www.facebook.com/8zero2 > Twitter: @8zero2_in > Blog: blog.8zero2.in > > On Fri, Nov 4, 2016 at 9:57 AM, Arun Gupta <arung(a)cdac.in> wrote: > >> Hi, >> >> Thanks Anirudh.. for response, as I am newbie in openldap, please let me >> know any already avaliabe script or some tutorial for the same. >> >> Regards, >> Arun >> >> >> and I think it may be also possible if On Thu, 3 Nov 2016, Anirudh >> Malhotra wrote: >> >> Hi, >>> >>> You can write a custom script which whenever the password is set in samba >>> it >>> sets it for the other tree as well, And you can attach this to the >>> password >>> changing app also. >>> >>> BR, >>> Anirudh Malhotra >>> Mail: 8zero2.in(a)gmail.com >>> Facebook: www.facebook.com/8zero2 >>> Twitter: @8zero2_in >>> Blog: blog.8zero2.in >>> >>> On Tue, Nov 1, 2016 at 6:49 PM, Arun Gupta <arung(a)cdac.in> wrote: >>> Hi, >>> >>> I have configured 2 ldap tree, one for unix account (ou=User) >>> (below is sample ldif) >>> >>> >>> dn: uid=2011150,ou=User,dc=acer,dc=in >>> empID: 2011150 >>> username: test1 >>> cn: test1 >>> centre: PN >>> objectClass: inetOrgPerson >>> objectClass: posixAccount >>> objectClass: top >>> objectClass: shadowAccount >>> oldempid: 1150 >>> mail: test1(a)acer.in >>> givenName: test1 >>> uid: 2011150 >>> shadowLastChange: 15590 >>> loginShell: /bin/bash >>> uidNumber: 11150 >>> gidNumber: 11150 >>> homeDirectory: /mbox4.2/test1 >>> userPassword: {SHA}1SrgdEGUPa/U6KM43Kq9xTgnI7A= >>> >>> >>> and another for samba tree (ou=samba) - (below is sample tree) >>> >>> dn: uid=test1,ou=samba,dc=acer,dc=in >>> uid: test1 >>> sambaSID: S-1-5-21-4079184197-2446238136-3299756537-1005 >>> displayName: test1 >>> sambaAcctFlags: [UX ] >>> objectClass: sambaSamAccount >>> objectClass: account >>> sambaLMPassword: C2F63206FC9CF08A1AA818381E4E281B >>> sambaNTPassword: 0242A7FEC5CD294F916925766089E573 >>> >>> and I am able to authenticate with samba configuration. But I am >>> not able to find out how the password will sync means if user >>> change his password then how NT password will reflect (here two >>> different tree). Is it possible to sync, if yes please please >>> help me out. >>> >>> -- >>> >>> Thanks & Regards, >>> >>> Arun Kumar Gupta >>> >> >> >

1 0

Re: delta-synrepl consumer randomly delete objects
by Quanah Gibson-Mount 10 Nov '16

10 Nov '16

--On Thursday, November 03, 2016 1:16 PM +0100 Raffael Sahli <public(a)raffaelsahli.com> wrote: > I have no clue what changed that we have now such problems. > What else is related to (delta)-syncrepl? time? > Could it be wrong/strange slapd configurations? (acl, limits, > syncrepl,...) But actually not much changed and the sync does work for > some time... "time" must be in sync between all nodes, that's well documented. If your pulling down an empty replica from a master, then that is not using delta-sycnrepl at all. I've never had luck with doing that. I only do a slapcat from the master then slapadd to the replica, and start from there. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

4 4

Re: OpenSSL 1.1 Support ?
by Quanah Gibson-Mount 10 Nov '16

10 Nov '16

--On Wednesday, November 09, 2016 3:58 PM -0800 Norm Green <norm.green(a)gemtalksystems.com> wrote: > I could certainly do that. Would that get us closer to a new release of > OpenLDAP? It would make it more likely that OpenSSL 1.1.0 support makes the next release. I've already been working on the 2.4.45 release... Of course, if you check the commit logs, you'd see that. ;) Currently one blocking issue that needs resolution, and some triage on some of the open items. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: OpenSSL 1.1 Support ?
by Quanah Gibson-Mount 10 Nov '16

10 Nov '16

--On Wednesday, November 09, 2016 2:24 PM -0800 Norm Green <norm.green(a)gemtalksystems.com> wrote: > I've asked before and got nothing but crickets so I'm asking again. > > Any idea in what timeframe we will have a release of OpenLDAP that > supports OpenSSL 1.1? 2016? 2017? 2018? Anyone? Bueller? Bueller? Is > this thing even on? Feel free to backport the commits for ITS#8353 and report back on how they work for you. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

OpenSSL 1.1 Support ?
by Norm Green 09 Nov '16

09 Nov '16

I've asked before and got nothing but crickets so I'm asking again. Any idea in what timeframe we will have a release of OpenLDAP that supports OpenSSL 1.1? 2016? 2017? 2018? Anyone? Bueller? Bueller? Is this thing even on? Norm Green

1 0

Re: Pverlay development documentation
by Howard Chu 09 Nov '16

09 Nov '16

Geoff Swan wrote: > I have a need to write an overlay (openldap-2.4.44) and wondered if > there was any documentation for overlay development? servers/slapd/slapover.txt > I have examined the sources in contrib/slapd-modules/ and was hoping to > locate something a bit more descriptive and maybe any must-do's and > gotchas for development. > >>From a development environment perspective, is it advisable to use the > contrib/slapd-modules/ as a build location, using a Makefile based on > one of the existing overlays and also the non-exposed header files (eg > "portable.h") or not? Makes no difference. Do whatever's convenient for you. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Pverlay development documentation
by Geoff Swan 09 Nov '16

09 Nov '16

I have a need to write an overlay (openldap-2.4.44) and wondered if there was any documentation for overlay development? I have examined the sources in contrib/slapd-modules/ and was hoping to locate something a bit more descriptive and maybe any must-do's and gotchas for development. >From a development environment perspective, is it advisable to use the contrib/slapd-modules/ as a build location, using a Makefile based on one of the existing overlays and also the non-exposed header files (eg "portable.h") or not? - Geoff

2 1

slapd-meta
by Fr3ddie 07 Nov '16

07 Nov '16

Hello to the list, I'm trying to configure the slapd-meta OpenLDAP backend on an online cn=config configuration with no luck. Slapd version is 2.4.39 (the maximum I can achieve on the target machines building from vanilla source). The documentation is clear but too concise for me so I will try to explain what I'm trying to do to see if there is anybody that can help me. Currently I have 3 slapd servers that share a common root for the DIT, i.e.: dc=loc1,dc=root dc=loc2,dc=root dc=loc3,dc=root What I would like to achieve is to obtain a fourth server that contains the previous trees, along with its own tree, i.e. a server that contains: dc=loc0,dc=root (locally hosted data) dc=loc1,dc=root (coming from the first server, chasing referrals) dc=loc2,dc=root (coming from the second server, chasing referrals) dc=loc3,dc=root (coming from the third server, chasing referrals) this way, all the clients connecting to this server will be able to retrieve data also from the other three remote servers. As far as I understood, I only need to configure the "loc0" server to access the other three servers and get the data to serve to clients. I have already configured the fourth server with its local DIT and this is the configuration: # cat 'cn=config.ldif' dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/slapd/slapd.args olcPidFile: /var/run/slapd/slapd.pid structuralObjectClass: olcGlobal creatorsName: cn=config olcServerID: 1 olcThreads: 32 olcToolThreads: 8 olcRequires: LDAPv3 olcConnMaxPendingAuth: 100 olcTLSCACertificateFile: /etc/ssl/certs/my_ca_cert.pem olcTLSCertificateFile: /etc/ssl/certs/this-host_x509_cert.pem olcTLSCertificateKeyFile: /etc/ssl/private/this-host_x509_key.key olcTLSVerifyClient: try olcTimeLimit: 600 olcLogLevel: stats2 sync [...] # cat 'cn=module{0}.ldif' dn: cn=module{0} objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib/ldap olcModuleLoad: {0}back_hdb olcModuleLoad: {1}syncprov olcModuleLoad: {2}accesslog structuralObjectClass: olcModuleList [...] Schema files are the following: cn={0}core.ldif cn={1}cosine.ldif cn={2}nis.ldif cn={3}inetorgperson.ldif cn={4}dyngroup.ldif cn={5}kerberos.ldif # cat 'olcDatabase={1}hdb.ldif' dn: olcDatabase={1}hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=loc0,dc=root olcAccess: {0}to attrs=userPassword,shadowLastChange,krbPrincipalKey by dn="cn =admin,dc=loc0,dc=root" write by anonymous auth by self write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by dn="cn=admin,dc=loc0,dc=root" write by * read olcLastMod: TRUE olcRootDN: cn=admin,dc=loc0,dc=root olcRootPW:: xxxxxxxxxxxxxxxxxxxx olcDbCacheSize: 10000 olcDbCheckpoint: 512 10 olcDbConfig: {0}set_cachesize 0 524288000 1 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbConfig: {4}set_flags DB_LOG_AUTOREMOVE olcDbIDLcacheSize: 30000 olcDbIndex: default pres,eq [...] structuralObjectClass: olcHdbConfig olcSyncrepl: {0}rid=0 provider=ldap://second-host.loc0.root bindmethod=s imple binddn="cn=admin,dc=loc0,dc=root" credentials=xxxxxx searchbase="dc=loc0,dc=root" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObj ect)(reqResult=0))" schemachecking=on type=refreshAndPersist retry="60 +" syn cdata=accesslog starttls=yes olcMirrorMode: TRUE [...] On top of this DB I have the "syncprov" and the "accesslog" overlays configured (these are two servers in "MirrorMode", configured following the OpenLDAP admin documentation). I believe this DB is the ones containing the actual "loc0" DIT data... Then I have the accesslog DB for the replica (with the syncprov overlay on top): # cat 'olcDatabase={2}hdb.ldif' dn: olcDatabase={2}hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {2}hdb olcDbDirectory: /var/lib/ldap/accesslog olcSuffix: cn=accesslog olcRootDN: cn=admin,dc=loc0,dc=root olcDbConfig: {0}set_cachesize 0 524288000 1 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbConfig: {4}set_flags DB_LOG_AUTOREMOVE olcDbIndex: default eq olcDbIndex: entryCSN,objectClass,reqEnd,reqResult,reqStart [...] On top of this environment I start loading the needed modules with this LDIF file: version: 1 dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: back_ldap - add: olcModuleLoad olcModuleLoad: back_meta - add: olcModuleLoad olcModuleLoad: rwm and it seems I'm able to load the new modules without errors into the configuration, thus I obtain: # cat 'cn=module{0}.ldif' dn: cn=module{0} structuralObjectClass: olcModuleList objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib/ldap olcModuleLoad: {0}back_hdb olcModuleLoad: {1}syncprov olcModuleLoad: {2}accesslog olcModuleLoad: {3}back_ldap olcModuleLoad: {4}back_meta olcModuleLoad: {5}rwm [...] Now I try to load the slapd-meta directives into a new database using this LDIF: version: 1 dn: olcDatabase={3}meta,cn=config objectClass: olcDatabaseConfig objectClass: olcMetaConfig olcDatabase: {3}meta olcSuffix: dc=root olcDbURI: "ldap://server-loc1.loc1.root/dc=loc1,dc=root" olcDbIdAssertBind: bindmethod=simple binddn="cn=admin,dc=loc1,dc=root" credentials=xxxxxx starttls=yes tls_reqcert=demand olcDbURI: "ldap://server-loc2.loc2.root/dc=loc2,dc=root" olcDbIdAssertBind: bindmethod=simple binddn="cn=admin,dc=loc2,dc=root" credentials=xxxxxx starttls=yes tls_reqcert=demand olcDbURI: "ldap://server-loc3.loc3.root/dc=loc3,dc=root" olcDbIdAssertBind: bindmethod=simple binddn="cn=admin,dc=loc3,dc=root" credentials=xxxxxx starttls=yes tls_reqcert=demand but I obtain an error that sticks me trying various combinations without success: # ldapadd -Y EXTERNAL -H ldapi:/// -f slapd-META-DB-CREATION.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 adding new entry "olcDatabase={3}meta,cn=config" ldap_add: Object class violation (65) additional info: attribute 'olcDbURI' not allowed and: # tail /var/log/openldap/slapd.log Nov 9 19:47:17 server01 slapd[32392]: conn=1025 op=2 ENTRY dn="dc=loc0,dc=root" Nov 9 19:47:29 server01 slapd[32392]: conn=1052 op=2 INTERM oid=1.3.6.1.4.1.4203.1.9.1.4 Nov 9 19:49:47 server01 slapd[32392]: conn=1327 op=2 ENTRY dn="dc=loc0,dc=root" Nov 9 19:52:17 server01 slapd[32392]: conn=1628 op=2 ENTRY dn="dc=loc0,dc=root" Nov 9 19:54:46 server01 slapd[32392]: conn=1929 op=2 ENTRY dn="dc=loc0,dc=root" Nov 9 19:57:07 server01 slapd[32392]: Entry (olcDatabase={3}meta,cn=config), attribute 'olcDbURI' not allowed Into the slapd-meta documentation the "URI" directive is mentioned but the "DbURI" seems to raise a "better error", in fact if I try to modify the above LDIF file using "URI" I obtain: SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 adding new entry "olcDatabase={3}meta,cn=config" ldap_add: Undefined attribute type (17) additional info: olcUri: attribute type undefined Moreover, it is not stated into the slapd-meta docs that the slapd-ldap backend is needed by slapd-meta but, anyway, I think its needed because if I try to load the slapd-meta alone it raises an error (I don't remember exactly which one). At this point I'm stuck to this error and I wasn't able to find any hint on the web to solve this :( The examples I was able to find were related with the static slapd.conf configuration, I counldn't find any "full" configuration example using the cn=config. I'm wondering if I should create a "cn=root" actual DB first and then link the sub-DITs to it, or, maybe, add some other overlay... I really can't understand how it should work :( Can please anybody help me? Thank you very much

3 9

Re: slapo-smbk5pwd build fixes
by Quanah Gibson-Mount 06 Nov '16

06 Nov '16

--On Saturday, November 05, 2016 6:30 PM +0200 Emmanuel Dreyfus <manu(a)netbsd.org> wrote: > Hello > > slapo-smbk5pwd does not link with newer OpenSSL,because the old des_* > API was removed. This simple patch uses the new (but available for a > long time) DES_* API to fix that: > http://www.openldap.org/its/index.cgi/Incoming?id=8525;selectid=8525 Hi Emmanuel, The openldap-devel list would be the appropriate place to raise and discuss this. I will try and look into it further on Monday. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

slapo-smbk5pwd build fixes
by manu＠netbsd.org 05 Nov '16

05 Nov '16

Hello slapo-smbk5pwd does not link with newer OpenSSL,because the old des_* API was removed. This simple patch uses the new (but available for a long time) DES_* API to fix that: http://www.openldap.org/its/index.cgi/Incoming?id=8525;selectid=8525 -- Emmanuel Dreyfus http://hcpnet.free.fr/pubz manu(a)netbsd.org

1 0

Re: password sync issues
by Arun Gupta 04 Nov '16

04 Nov '16

Hi, Thanks Anirudh.. for response, as I am newbie in openldap, please let me know any already avaliabe script or some tutorial for the same. Regards, Arun and I think it may be also possible if On Thu, 3 Nov 2016, Anirudh Malhotra wrote: > Hi, > > You can write a custom script which whenever the password is set in samba it > sets it for the other tree as well, And you can attach this to the password > changing app also. > > BR, > Anirudh Malhotra > Mail: 8zero2.in(a)gmail.com > Facebook: www.facebook.com/8zero2 > Twitter: @8zero2_in > Blog: blog.8zero2.in > > On Tue, Nov 1, 2016 at 6:49 PM, Arun Gupta <arung(a)cdac.in> wrote: > Hi, > > I have configured 2 ldap tree, one for unix account (ou=User) > (below is sample ldif) > > > dn: uid=2011150,ou=User,dc=acer,dc=in > empID: 2011150 > username: test1 > cn: test1 > centre: PN > objectClass: inetOrgPerson > objectClass: posixAccount > objectClass: top > objectClass: shadowAccount > oldempid: 1150 > mail: test1(a)acer.in > givenName: test1 > uid: 2011150 > shadowLastChange: 15590 > loginShell: /bin/bash > uidNumber: 11150 > gidNumber: 11150 > homeDirectory: /mbox4.2/test1 > userPassword: {SHA}1SrgdEGUPa/U6KM43Kq9xTgnI7A= > > > and another for samba tree (ou=samba) - (below is sample tree) > > dn: uid=test1,ou=samba,dc=acer,dc=in > uid: test1 > sambaSID: S-1-5-21-4079184197-2446238136-3299756537-1005 > displayName: test1 > sambaAcctFlags: [UX ] > objectClass: sambaSamAccount > objectClass: account > sambaLMPassword: C2F63206FC9CF08A1AA818381E4E281B > sambaNTPassword: 0242A7FEC5CD294F916925766089E573 > > and I am able to authenticate with samba configuration. But I am > not able to find out how the password will sync means if user > change his password then how NT password will reflect (here two > different tree). Is it possible to sync, if yes please please > help me out. > > -- > > Thanks & Regards, > > Arun Kumar Gupta > > --------------------------------------------------------------------------- > ---------------------------------------------------- > [ C-DAC is on Social-Media too. Kindly follow us at: > Facebook: https://www.facebook.com/CDACINDIA & Twitter: > @cdacindia ] > > This e-mail is for the sole use of the intended recipient(s) and > may > contain confidential and privileged information. If you are not > the > intended recipient, please contact the sender by reply e-mail > and destroy > all copies and the original message. Any unauthorized review, > use, > disclosure, dissemination, forwarding, printing or copying of > this email > is strictly prohibited and appropriate legal action will be > taken. > --------------------------------------------------------------------------- > ---------------------------------------------------- > > > > > -- Thanks & Regards, Arun Kumar Gupta Mail Administrator HPC Infrastructure and Ecosystem Group Centre for Development of Advanced Computing Savitribai Phule Pune University Campus PUNE-Maharastra Phone : +91-20-25704347 WEB : http://www.cdac.in/ ------------------------------------------------------------------------------------------------------------------------------- [ C-DAC is on Social-Media too. Kindly follow us at: Facebook: https://www.facebook.com/CDACINDIA & Twitter: @cdacindia ] This e-mail is for the sole use of the intended recipient(s) and may contain confidential and privileged information. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies and the original message. Any unauthorized review, use, disclosure, dissemination, forwarding, printing or copying of this email is strictly prohibited and appropriate legal action will be taken. -------------------------------------------------------------------------------------------------------------------------------

2 1

Re: delta-synrepl consumer randomly delete objects
by Quanah Gibson-Mount 03 Nov '16

03 Nov '16

--On Wednesday, October 26, 2016 10:07 AM +0200 Raffael Sahli <public(a)raffaelsahli.com> wrote: >> This is not delta-syncrepl, this is syncrepl. What triggered your >> system to fall back to syncrepl? > Tell me, I really don't know. I can't tell you, it would be in your logs. > Is this as designed? Syncrepl as fall back mechanism if delta-syncrepl > failed? (But I don't know why delta-synrepl failed, > how can I verify that delta-syncrepl does work properly) Correct, if there is an issue, things will fall back to syncrepl. Again, you'd have to look at your logs to determine why it fell back. > However this should not happen with syncrepl anyways. How can it be that > I have only 23 objects left on my consumer after > a full re sync with thousands of objects? Because syncrepl can be buggy? --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: Provider-Consumer replication 2.4 OLC (second attempt)
by Quanah Gibson-Mount 01 Nov '16

01 Nov '16

--On Friday, October 28, 2016 9:50 AM -0400 Ted Hyde <laserted(a)gmail.com> wrote: > Quanah - thanks for the response. Sorry to insult if I did - but thank > you, I DID read the admin guide. Which as you have also pointed out uses > slapd.conf examples. Since I am not knee-deep in commercial OpenLdap > configuration every day (I am just a lowly IT admin, not a > paid-to-openldap-person) I would disagree in that your comment that > "conversion to cn=config" process isn't trivial, personally I get quite > swamped by it, but push through as best I can. But if you're offering to > convert my sample configs for me, I'd be happy to share them with you. You can convert your sample configs via the slaptest command, as documented. > Or > perhaps you could help the community by providing some OLC config > examples for the admin guide, that way us peons would be able to use that > as our only official source instead of having to google to find "Random" > help. My point was more that converting examples in the admin guide from slapd.conf to cn=config is fairly trivial. For example, if we look at section 18.3.1.2 in the admin guide: database mdb maxsize 1073741824 suffix dc=Example,dc=com rootdn dc=Example,dc=com directory /var/ldap/db index objectclass,entryCSN,entryUUID eq overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 this is rather trivially converted to: dn: olcDatabase={1}mdb objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb olcSuffix: dc=example,dc=com olcRootDN: dc=example,dc=com olcDbDirectory: /var/ldap/db olcDbIndex: objectClass eq olcDbIndex: entryUUID eq olcDbIndex: entryCSN eq dn: olcOverlay={0}syncprov,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcSpCheckpoint: 100 10 olcSpSessionlog: 100 etc. Converting to cn=config from slapd.conf is not particularly difficult. > I *can* move to refreshAndPersist; but the service provides two > documented options (information I got from reading the admin guide), the > description for refreshOnly best fits my scenario and needs. I didn't > read any reason as to *not* use - perhaps you're aware of a bug report > that refreshOnly is broken? I'm aware that operating in refreshOnly is problematic, and it is advise not to use it. If you want to persist in using it, I certainly can't stop you. ;) If/when I find time to rewrite the admin guide, removing it from the examples will be one of the first steps I take. > Perhaps my research (which I'm sure isn't as broad as yours) just seemed > to point to the fact that openldap will/may be depreciating the > slapd.conf procedures, and that everyone should get on board with OLC as > soon as possible. While I can perform the setup with slapd.conf (as noted > in the admin guide), I was hoping to practice some useful technique I > could use in the future. Again, as noted in the documentation, you can set up one time with slapd.conf, and then move forward with converting it to cn=config via slaptest, and then just use cn=config from that point forward, using ldap* commands to make updates as necessary. If you want some further examples of cn=config, you may like the following: <https://git.zimbra.com/repos/zimbra-foss/ZimbraServer/conf/ldap/config/> Which has a basic cn=config layout for a standalone server with a suffix of "" and a few overlays loaded as a starting point. You may also be interested in the tools I wrote for manipulating cn=config to use as examples: <https://git.zimbra.com/repos/zimbra-foss/ZimbraServer/src/libexec/zmldapena…> <https://git.zimbra.com/repos/zimbra-foss/ZimbraServer/src/libexec/zmldapena…> <https://git.zimbra.com/repos/zimbra-foss/ZimbraServer/src/libexec/zmldaprep…> <https://git.zimbra.com/repos/zimbra-foss/ZimbraServer/src/libexec/zmldapmmr…> etc. While bits of it are specific to Zimbra, the ideas behind updating/modifying cn=config are universal. On the documentation, I would note that it is a community effort, and anyone can contribute updates, etc, via the ITS system. The sad fact is, many people complain about the documentation, but very few ever step up and contribute back, which means that it often languishes. I hope the above helps. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

password sync issues
by Arun Gupta 01 Nov '16

01 Nov '16

Hi, I have configured 2 ldap tree, one for unix account (ou=User) (below is sample ldif) dn: uid=2011150,ou=User,dc=acer,dc=in empID: 2011150 username: test1 cn: test1 centre: PN objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: shadowAccount oldempid: 1150 mail: test1(a)acer.in givenName: test1 uid: 2011150 shadowLastChange: 15590 loginShell: /bin/bash uidNumber: 11150 gidNumber: 11150 homeDirectory: /mbox4.2/test1 userPassword: {SHA}1SrgdEGUPa/U6KM43Kq9xTgnI7A= and another for samba tree (ou=samba) - (below is sample tree) dn: uid=test1,ou=samba,dc=acer,dc=in uid: test1 sambaSID: S-1-5-21-4079184197-2446238136-3299756537-1005 displayName: test1 sambaAcctFlags: [UX ] objectClass: sambaSamAccount objectClass: account sambaLMPassword: C2F63206FC9CF08A1AA818381E4E281B sambaNTPassword: 0242A7FEC5CD294F916925766089E573 and I am able to authenticate with samba configuration. But I am not able to find out how the password will sync means if user change his password then how NT password will reflect (here two different tree). Is it possible to sync, if yes please please help me out. -- Thanks & Regards, Arun Kumar Gupta ------------------------------------------------------------------------------------------------------------------------------- [ C-DAC is on Social-Media too. Kindly follow us at: Facebook: https://www.facebook.com/CDACINDIA & Twitter: @cdacindia ] This e-mail is for the sole use of the intended recipient(s) and may contain confidential and privileged information. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies and the original message. Any unauthorized review, use, disclosure, dissemination, forwarding, printing or copying of this email is strictly prohibited and appropriate legal action will be taken. -------------------------------------------------------------------------------------------------------------------------------

1 0

Re: Public LDAP server, what do I need to know?
by Quanah Gibson-Mount 01 Nov '16

01 Nov '16

--On Sunday, October 16, 2016 3:29 PM -0400 John Lewis <oflameo2(a)gmail.com> wrote: > I want to host a LDAP server that contains a directory that contains the > offices of local Representatives and Public Servants, the issues they > are responsible for, and their names. I would like anyone who wants to > to browse it or put up front ends. > > Is there anything in particular that I should keep in mind? Keep your tree as flat as possible, as deep as necessary, is the guiding wisdom. ;) --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: Antw: openldap 2.4.40 ppolicy module and shadowInactive equivalent
by Real, Elizabeth (392K) 31 Oct '16

31 Oct '16

Ulrich, Yes, I already have nis.ldif loaded. What else do you suggest? Thank you, Liz From: Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de> Date: Monday, October 24, 2016 at 11:17 PM To: "Real, Elizabeth (392K)" <Elizabeth.Real(a)jpl.nasa.gov>, "openldap-technical(a)openldap.org" <openldap-technical(a)openldap.org> Subject: Antw: openldap 2.4.40 ppolicy module and shadowInactive equivalent "Real, Elizabeth (392K)" <Elizabeth.Real(a)jpl.nasa.gov<mailto:Elizabeth.Real@jpl.nasa.gov>> schrieb am 24.10.2016 um 20:43 in Nachricht <0C90A104-2EF4-4AA6-8748-05B07154A54D(a)jpl.nasa.gov<mailto:0C90A104-2EF4-4AA6-8748-05B07154A54D@jpl.nasa.gov>>: Hello, I setup a password policy overlay on my openldap 2.4.40 servers running RHEL7. I need to enforce the following: disable accounts that have been inactive for 180 days. In the past we were able to do this by simply adding the shadowInactive attribute to each account: shadowInactive 180. But with the new openldap, it appears there is no equivalent attribute?? Why didn't you "grep shadowInactive /etc/openldap/schema/*"? It appears in nis.ldif, nis.schema, and rfc2307bis.schema. (I only have SLES11 SP4 here, but there shouldn't be a big difference) Ulrich http://www.openldap.org/doc/admin24/ http://www.zytrax.com/books/ldap/ch6/ppolicy.html Thank you, Liz

1 1

Re: Syncrepl only partially working
by Quanah Gibson-Mount 31 Oct '16

31 Oct '16

--On Sunday, October 30, 2016 11:16 AM +0100 Dieter Klünter <dieter(a)dkluenter.de> wrote: > It is a bit more complicated than that. > syncrepl is a client operation, which requires ldap client > configuration, specified in ldap.conf(5). You can set these specifically for the syncrepl client as a part of your syncrepl configuration stanza, rather than ldap.conf. See slapd.conf(5) or slapd-config(5), the section on syncrepl/olcSyncRepl, the sizelimit and timelimit parameters. But, regardless, the server limits on the master trump any client settings that are higher than the defaults, so as Dieter noted, they must be increased on the master to "unlimited" for at least the replicator DN. This is of course covered in the admin guide. For example, in section 18.3.2, we find: # Let the replica DN have limitless searches limits dn.exact="cn=replicator,dc=symas,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited as one example. etc. Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Defining timeouts in slapd-ldap Backend
by Daniel Betz 31 Oct '16

31 Oct '16

Hi List, i have an problem with slapd-ldap backend and the timeouts. There are many timeouts to configure, but i think they dont work in the tls handshake phase. 5816f773 send_ldap_result: conn=-1 op=0 p=0 5816f773 backend_startup_one: starting "sid=3092,sec=webhosting,o=xxxxxx,c=de" 5816f773 ldap_back_db_open: URI=ldaps://sid3092.int.webslave.xxxxxxx ldap_create ldap_url_parse_ext(ldaps://sid3092.int.webslave.xxxxxxxx) 5816f773 =>ldap_back_getconn: conn=-1 op=0: lc=0x37c2880 inserted refcnt=1 rc=0 ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP sid3092.int.webslave.xxxxxxxxx:636 ldap_new_socket: 256 ldap_prepare_socket: 256 ldap_connect_to_host: Trying 10.xx.xx.xx:636 ldap_pvt_connect: fd: 256 tm: 5 async: 0 ldap_ndelay_on: 256 attempting to connect: connect errno: 115 ldap_int_poll: fd: 256 tm: 5 ldap_is_sock_ready: 256 ldap_ndelay_off: 256 ldap_pvt_connect: 0 TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A And then the slapd hangs and hangs. I know that the consumer ldap is running, but the server itself hangs with an error. In this slapd there are 250 more servers to serve via slapd-ldap, so this will cause an big problem when only one server hangs and the slapd stucks forever. Are there any other timeouts to configure in slapd-ldap backend ? Here´s the slapd.conf: database ldap hidden on suffix "sid=3092,sec=webhosting,o=xxxxxxxx,c=de" rootdn "cn=xxxxxxxx,sid=3092,sec=webhosting,o=xxxxxxxxx,c=de" uri ldaps://sid3092.int.webslave.xxxxxxxxx network-timeout 5 timeout bind=5 lastmod on restrict all acl-bind bindmethod=simple binddn="cn=xxxxxx,sid=3092,sec=webhosting,o=xxxxxx,c=de" credentials="PASSWORD" syncrepl rid=3092 provider=ldapi://%2Fvar%2Frun%2Fldapi binddn="cn=Manager,o=xxxxxxxxxxx,c=de" bindmethod=simple credentials=PASSWORD searchbase="sid=3092,sec=webhosting,o=xxxxxxxxxx,c=de" type=refreshAndPersist retry="10 6 30 +" overlay syncprov Regards, Daniel Freundliche Grüße, Daniel Betz System Design Engineer / Senior Systemadministration ___________________________________ domainfactory GmbH Oskar-Messter-Str. 33 85737 Ismaning Germany Telefon: +49 (0)89 / 55266-364 Telefax: +49 (0)89 / 55266-222 E-Mail: dbetz(a)df.eu<mailto:dbetz@df.eu> Internet: www.df.eu<http://www.df.eu/> Registergericht: Amtsgericht München HRB-Nummer 150294, Geschäftsführer: Tobias Mohr, Stephan Wolfram

1 0

Syncrepl only partially working
by Joshua Schaeffer 30 Oct '16

30 Oct '16

Greetings all, I'm trying to figure out why Syncrepl is only syncing part of my provider's database when I use GSSAPI to connect. Both my provider and consumer are on 2.4.40. Here are all the steps I'm taking: My provider is working fine, I've been using it for months now without any issues. I added this to the provider: dn: olcOverlay={0}syncprov,olcDatabase={1}mdb,cn=config objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpCheckpoint: 100 10 structuralObjectClass: olcSyncProvConfig entryUUID: b32ac160-29e6-1036-8d0a-07ef98fd592e creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20161019012544Z olcSpSessionlog: 100 entryCSN: 20161024233803.817199Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20161024233803Z I also indexed entryCSN and entryUUID on the provider. I have olcAuthzRegexp setup on the provider as well. olcAuthzRegexp: {0}"uid=admin,cn=harmonywave.com,cn=GSSAPI,cn=auth" "cn=admin,dc=harmonywave,dc=com" olcAuthzRegexp: {1}"uid=ldap/admin,cn=harmonywave.com,cn=GSSAPI,cn=auth" "dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" olcAuthzRegexp: {2}"uid=syncprov,cn=harmonywave.com,cn=GSSAPI,cn=auth" "cn=syncprov,dc=harmonywave,dc=com" #not using this. olcAuthzRegexp: {3}"uid=.*\/admin,cn=harmonywave.com,cn=GSSAPI,cn=auth" "cn=admin,dc=harmonywave,dc=com" olcAuthzRegexp: {4}"uid=host\/([^.]*).harmonywave.com,cn=harmonywave.com,cn=GSSAPI,cn=auth" "cn=$1+ipHostNumber=.*,ou=Hosts,dc=harmonywave,dc=com" olcAuthzRegexp: {5}"uid=([^/]*),cn=harmonywave.com,cn=GSSAPI,cn=auth" "uid=$1,ou=End Users,ou=People,dc=harmonywave,dc=com" On the consumer I have slapd installed. The first thing I did was change the olcSuffix on my database. I'm not sure if this is required or not. dn: olcDatabase={1}mdb,cn=config changetype: modify replace: olcSuffix olcSuffix: dc=harmonywave,dc=com - replace: olcRootDN olcRootDN: cn=admin,dc=harmonywave,dc=com Then I'm adding my ldap keytab for the consumer. kadmin: ktadd -k /etc/ldap/ldap.keytab ldap/consumer.harmonywave.com consumer: ~# chown openldap:openldap /etc/ldap/ldap.keytab consumer: ~# chmod 0640 /etc/ldap/ldap.keytab I edited my /etc/default/slapd file and pointed the KRB5_KTNAME environment variable to the new keytab then restarted slapd. Next I installed kstart and created a ticket cache. consumer: ~# k5start -U -f /etc/ldap/ldap.keytab -K 10 -l 24h -k /tmp/krb5cc_108 -o openldap -b I can see the ldap service's keytab with klist. consumer: ~# klist /tmp/krb5cc_108 Ticket cache: FILE:/tmp/krb5cc_108 Default principal: ldap/koprulu.harmonywave.com(a)HARMONYWAVE.COM Valid starting Expires Service principal 10/28/2016 21:18:14 10/29/2016 07:18:14 krbtgt/HARMONYWAVE.COM(a)HARMONYWAVE.COM renew until 10/29/2016 21:18:14 Then I add my olcSaslRealm dn: cn=config changetype: modify add: olcSaslRealm olcSaslRealm: HARMONYWAVE.COM Here is what my database looks like right before I add olcSyncrepl: dn: olcDatabase={1}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb olcDbDirectory: /var/lib/ldap olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonym ous auth by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by * read olcLastMod: TRUE olcRootPW:: ... olcDbCheckpoint: 512 30 olcDbMaxSize: 1073741824 structuralObjectClass: olcMdbConfig entryUUID: 9a091324-2e84-1036-8b7a-73db8891632a creatorsName: cn=admin,cn=config createTimestamp: 20161024222607Z olcSuffix: dc=harmonywave,dc=com olcRootDN: cn=admin,dc=harmonywave,dc=com olcDbIndex: cn,uid eq olcDbIndex: entryCSN eq olcDbIndex: entryUUID eq olcDbIndex: member,memberUid eq olcDbIndex: objectClass eq olcDbIndex: uidNumber,gidNumber eq entryCSN: 20161029033105.691204Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20161029033105Z then I add olcSyncrepl to the consumer. dn: olcDatabase={1}mdb,cn=config changetype: modify add: olcSyncrepl olcSyncrepl: {0}rid=000 provider=ldap://provider.harmonywave.com type=RefreshAndPersist retry="30 10 1800 +" searchbase="dc=harmonywave,dc=com" bindmethod=sasl saslmech=GSSAPI starttls=critical tls_cacert=/etc/ssl/certs/ca.harmonywave.com.pem tls_reqcert=demand After that I slapcat on the consumer and I only see about 1/3 of my data from the provider. When I watch the log on the provider this is what I get: Oct 28 21:39:02 baneling slapd[12540]: conn=4421 fd=36 ACCEPT from IP=10.1.30.19:55992 (IP=0.0.0.0:389) Oct 28 21:39:02 baneling slapd[12540]: conn=4421 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Oct 28 21:39:02 baneling slapd[12540]: conn=4421 op=0 STARTTLS Oct 28 21:39:02 baneling slapd[12540]: conn=4421 op=0 RESULT oid= err=0 text= Oct 28 21:39:02 baneling slapd[12540]: conn=4421 fd=36 TLS established tls_ssf=128 ssf=128 Oct 28 21:39:02 baneling slapd[12540]: conn=1005 op=43768 SRCH base="dc=harmonywave,dc=com" scope=2 deref=0 filter="(&(|(objectClass=krbPrincipalAux)(objectClass=krbPrincipal))(krbPrincipalName=krbtgt/HARMONYWAVE.COM(a)HARMONYWAVE.COM))" Oct 28 21:39:02 baneling slapd[12540]: conn=1005 op=43768 SRCH attr=krbprincipalname krbcanonicalname objectclass krbprincipalkey krbmaxrenewableage krbmaxticketlife krbticketflags krbprincipalexpiration krbticketpolicyreference krbUpEnabled krbpwdpolicyreference krbpasswordexpiration krbLastFailedAuth krbLoginFailedCount krbLastSuccessfulAuth krbLastPwdChange krbLastAdminUnlock krbExtraData krbObjectReferences krbAllowedToDelegateTo Oct 28 21:39:02 baneling slapd[12540]: conn=1005 op=43768 SEARCH RESULT tag=101 err=0 nentries=1 text= Oct 28 21:39:02 baneling slapd[12540]: conn=1005 op=43769 SRCH base="dc=harmonywave,dc=com" scope=2 deref=0 filter="(&(|(objectClass=krbPrincipalAux)(objectClass=krbPrincipal))(krbPrincipalName=ldap/baneling.harmonywave.com(a)HARMONYWAVE.COM))" Oct 28 21:39:02 baneling slapd[12540]: conn=1005 op=43769 SRCH attr=krbprincipalname krbcanonicalname objectclass krbprincipalkey krbmaxrenewableage krbmaxticketlife krbticketflags krbprincipalexpiration krbticketpolicyreference krbUpEnabled krbpwdpolicyreference krbpasswordexpiration krbLastFailedAuth krbLoginFailedCount krbLastSuccessfulAuth krbLastPwdChange krbLastAdminUnlock krbExtraData krbObjectReferences krbAllowedToDelegateTo Oct 28 21:39:02 baneling slapd[12540]: conn=1005 op=43769 SEARCH RESULT tag=101 err=0 nentries=1 text= Oct 28 21:39:02 baneling slapd[12540]: conn=1005 op=43770 SRCH base="dc=harmonywave,dc=com" scope=2 deref=0 filter="(&(|(objectClass=krbPrincipalAux)(objectClass=krbPrincipal))(krbPrincipalName=ldap/koprulu.harmonywave.com(a)HARMONYWAVE.COM))" Oct 28 21:39:02 baneling slapd[12540]: conn=1005 op=43770 SRCH attr=krbprincipalname krbcanonicalname objectclass krbprincipalkey krbmaxrenewableage krbmaxticketlife krbticketflags krbprincipalexpiration krbticketpolicyreference krbUpEnabled krbpwdpolicyreference krbpasswordexpiration krbLastFailedAuth krbLoginFailedCount krbLastSuccessfulAuth krbLastPwdChange krbLastAdminUnlock krbExtraData krbObjectReferences krbAllowedToDelegateTo Oct 28 21:39:02 baneling slapd[12540]: conn=1005 op=43770 SEARCH RESULT tag=101 err=0 nentries=1 text= Oct 28 21:39:02 baneling slapd[12540]: conn=4421 op=1 BIND dn="" method=163 Oct 28 21:39:02 baneling slapd[12540]: conn=4421 op=1 RESULT tag=97 err=14 text=SASL(0): successful result: Oct 28 21:39:02 baneling slapd[12540]: conn=4421 op=2 BIND dn="" method=163 Oct 28 21:39:02 baneling slapd[12540]: conn=4421 op=2 RESULT tag=97 err=14 text=SASL(0): successful result: Oct 28 21:39:02 baneling slapd[12540]: conn=4421 op=3 BIND dn="" method=163 Oct 28 21:39:02 baneling slapd[12540]: conn=4421 op=3 BIND authcid="ldap/koprulu.harmonywave.com(a)HARMONYWAVE.COM" authzid="ldap/koprulu.harmonywave.com(a)HARMONYWAVE.COM" Oct 28 21:39:02 baneling slapd[12540]: conn=4421 op=3 BIND dn="uid=ldap/koprulu.harmonywave.com,cn=harmonywave.com,cn=gssapi,cn=auth" mech=GSSAPI sasl_ssf=56 ssf=128 Oct 28 21:39:02 baneling slapd[12540]: conn=4421 op=3 RESULT tag=97 err=0 text= Oct 28 21:39:02 baneling slapd[12540]: conn=4421 op=4 SRCH base="dc=harmonywave,dc=com" scope=2 deref=0 filter="(objectClass=*)" Oct 28 21:39:02 baneling slapd[12540]: conn=4421 op=4 SRCH attr=* + Oct 28 21:39:02 baneling slapd[12540]: conn=4421 op=5 UNBIND Oct 28 21:39:02 baneling slapd[12540]: conn=4421 fd=36 closed The only thing I really notice from this is near the end of the file. It when it searches the base with attributes "*+", but then immediately unbinds. I've seen people stating that authzid is required, but when I don't provide it I still get a partial sync, so I'm not sure about this. I've restored my consumer to a clean install of slapd and repeated the above steps with minor variations several times but the consumer always syncs the exact same amount of data and then seems to stop. Any help to point me in the right direction would be appreciated. Thanks, Joshua Schaeffer **

3 5

Re: Provider-Consumer replication 2.4 OLC (second attempt)
by Ted Hyde 28 Oct '16

28 Oct '16

1 0

some memberUid in my database are hashed
by Giovanni Biscuolo 28 Oct '16

28 Oct '16

Hi, I've an openldap database I use for auth purposes in which some memberUid is hashed while other not, e.g.: (results given by sudo ldapsearch -LLL -Y EXTERNAL -H ldapi:/// -b ou=Groups,dc=unit,dc=company,dc=net) .......................... dn: cn=GROUP,ou=Groups,dc=unit,dc=company,dc=net objectClass: top objectClass: posixGroup cn: GROUP gidNumber: 1026 memberUid: firstuser memberUid:: IGFyaWFubmE= [...] ........................... I cannot find any documentation about this kind of "memberUid hashed storage", the only differece is the double colon after memberUid please can you point me to the documentation or tell me how to "decode" the memberUid information also, on a client machine configured to use libnss-ldapd, if I list the groups with "sudo getent group" I can see the "clear text" members (e.g. firstuser in the example above) but not the "hashed" one; the same using the "members" command ciao Giovanni -- Giovanni Biscuolo Xelera - IT infrastructures http://xelera.eu/contact-us/

4 5

Changing server FQDN and certificate
by COMBES Julien - SG/SPSSI/CPII/DOSE/ET/PNE ANNUAIRE ET MESSAGERIE 28 Oct '16

28 Oct '16

Hello, Due to a decision of our IT Departement, I have to change the domain name of ours openldap servers and by extention all of their certificates. We have two ldap providers in mirror mode and fourteen ldap consumers. Those servers have ACL based (in part) on IP address to force TLS/SSL for some usages and they're accessed by a lots of ldap clients. I'm looking for a way to make a transition without duplicating all ldap servers during the time we change the fqdn and CA certificate on each client. This transition is quite easy with Apache and virtual host. AFAIK, openldap doesn't provide a Virtual Host system so I have to find an other way. I have tried a solution with stunnel which listens on an other IP address with a new certificate. But, as the connection from the stunnel to the ldap server comes from localhost and not from the original client, this is not working correctly with the ldaps's ACLs. Is someone have do this before or someone has an idea to do it ? Regards, Julien COMBES

2 1

Re: some memberUid in my database are hashed
by Giovanni Biscuolo 27 Oct '16

27 Oct '16

Hi Ulrich, * Ulrich Windl [2016-10-27 09:09:44 +0200]: [...] > > to be a little more clear: "getent group" does not show the base64 encoded > > users (aka listed as "memberUid:: ..." in LDIF) > > Which command did you use? "getent group" as I said :-) > Here (SLES11 SP4) a "getent passwd | grep 'the > entry you are looking for'" gives a corresponding result. me too, but I have issues "just" with memberUid attributes in my groups, not with usernames in general [...] > BTW: Decoding your "IGFyaWFubmE=" gives " arianna". A leading space in the > user name is _very_ experimental! OK let's assume it's _very_ experimental, anyway I just notice that: > > on the other side, "groups <user>" correctly lists all the groups the user > > is member of, despite the base64 encoding of its memberUid attribute so I don't really know why "groups" correctly lists LDAP groups in which user is listed as memberUid (base64 encoded with leading spaces), while "getent passwd" stops processing usernames at first base64 encountered name all I know is that standard unix file permissions and nfsv4 ACLs are working fine with this uncommon memberUid base64 encoded attributes for sure I'd avoid using base64 encoded memberUid attributes, but it happened somehow (still investigating) and it seems that having leading (or trailing?) spaces in that attribute (causing it to be base64 encoded) does not cause any problem to libnss-ldapd (pretty stadard configured) ...so, being very lazy, I'm investigating the possibility to leave the attributes alone and write a simple ldapsearch wrap script for my users to list all available groups and their members best regards Giovanni -- Giovanni Biscuolo Xelera - IT infrastructures http://xelera.eu/contact-us/ **per favore** Quota Bene: http://wiki.news.nic.it/QuotarBene **please** use Inline Reply: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

2 1

Re: Provider-Consumer replication 2.4 OLC (second attempt)
by Quanah Gibson-Mount 27 Oct '16

27 Oct '16

--On Tuesday, October 25, 2016 11:34 AM -0400 Ted Hyde <laserted(a)gmail.com> wrote: > Greets - (first post, second time. Don't know if it's being moderated or > dropped, will keep trying). It ended up in my spam folder for some reason. > After installation, I have two functioning standalone servers. During my > research, I found two conflicting pieces of information. I prefer to > perform "refreshOnly" instead of "refreshAndPersist", so some sources say > ONLY the consumers need configuration, a couple said both sides need > configuration AND a number of additional indices. This is likely where my > problems arise. I strongly advise only using refreshAndPersist. I'm not sure why you are referring to random how-not-to-do things on the interweb. You should use the OpenLDAP admin guide: <http://www.openldap.org/doc/admin24/replication.html> > Any thoughts? Read the admin guide, as noted above. The examples are still slapd.conf, but you can trivially translate those to what are necessary for cn=config. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: Account computer
by Kwame Bahena 27 Oct '16

27 Oct '16

LOL. Don't get upset. You didn't mention at first that you are using samba with OpenLDAP. Take a look at this link http://lmgtfy.com/?q=disable+inactive+accounts+Samba+with+OpenLDAP On Thu, Oct 27, 2016 at 12:33 PM, Itamar S. <immaggoo(a)gmail.com> wrote: > > 2016-10-27 15:32 GMT-02:00 Itamar S. <immaggoo(a)gmail.com>: > >> Fk you. >> >> If I had a CD would have done. I'm using Samba with OpenLDAP. >> > > Fk you. > > If I had a AD would have done. I'm using Samba with OpenLDAP. >

1 0

Account computer
by Itamar S. 27 Oct '16

27 Oct '16

Hello, How can I disable accounts computer that have been inactive for 180 days?

3 2

Proxy cache not work with <attribute not in schema>
by JWD 27 Oct '16

27 Oct '16

slapd 2.4.40 Windows AD as proxy backend. I found any query match <pcacheTemplate>+<pcacheAttrset>+<attribute not in schema> will answer <pcacheAttrset> value only, <attribute not in schema> will be ignored. This is not what I expected, I need <attribute not in schema> too. But query anything else that not in cache, <attribute not in schema> will be cached. Log message like this: 580ec506 PROXIED attributeDescription "PRIMARYGROUPID" inserted. And after that, query match <pcacheTemplate>+<pcacheAttrset>+<attribute not in schema> will answer <attribute not in schema> too. This is what I expected. Do I have to add schema for <attribute not in schema>? Is there any other way to make <attribute not in schema> CACHEABLE? -------------- JWD

2 2

Re: delta-synrepl consumer randomly delete objects
by Quanah Gibson-Mount 26 Oct '16

26 Oct '16

--On Thursday, October 20, 2016 10:19 AM +0200 Raffael Sahli <public(a)raffaelsahli.com> wrote: > Hi > > What can lead a consumer to "randomly" delete ~50% of all objects in his > database? I have this problem now for ~1-2months and on 3 different > master/slave groups. > > The consumer starts to delete objects (but those are all present on the > master): > > Oct 19 17:16:22 ldap-slave002.xxx slapd[8554]: do_syncrep2: rid=999 > LDAP_RES_INTERMEDIATE - SYNC_ID_SET Oct 19 17:16:22 ldap-slave002.xxx This is not delta-syncrepl, this is syncrepl. What triggered your system to fall back to syncrepl? --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

openldap access control order behavior
by vvv jjj 26 Oct '16

26 Oct '16

Hi OpenLDAP team, I'm new to OpenLDAP and trying to learn the configuration from the openldap provided document. Please let me know if I'm posting my question in a wrong form. The question may be trivial but I was looking for the behavior which I'm not clear. My question is, does the access control order effect the behavior. That is, Is there any change in behavior for the below 2 access control commands. 1. access to * by users read by anonymous read access to dn.base=ACL by users read 2. access to dn.base=ACL by users read access to * by users read by anonymous read Please let me know your comments. Let me know if anything is not clear. Thanks for support. Regards J.Visu

2 4

Re: ditContentRule + cn=config
by Quanah Gibson-Mount 25 Oct '16

25 Oct '16

--On Tuesday, October 25, 2016 6:28 PM +0200 Dieter Klünter <dieter(a)dkluenter.de> wrote: > Hi, > it seems that slapd, starting with -F, is not able to read schema > information, prior to cn=config, > ./slapd -h "ldap://:9007/ ldapi:///" -F ../etc/openldap/slapd.d -d256 > 580f76bd config error processing cn=config: olcDitContentRules: > ObjectClass not found: "2.16.840.1.113730.3.2.2" 580f76bd slapd stopped. > > but with -f schema information is read > prior to global and database specific configuration. > ./slapd -h "ldap://:9007/ ldapi:///" -f ../etc/openldap/slapd.conf -d256 > 580f76e4 slapd starting > > Has this been fixed already? although I couldn't find a report in ITS. I doubt it has been fixed. I suggest filing an ITS with configuration(s) that reproduce the issue. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: openldap 2.4.40 ppolicy module and shadowInactive equivalent
by Quanah Gibson-Mount 25 Oct '16

25 Oct '16

Hi Elizabeth, You would likely need to compile it yourself, as I'm not aware of any distributions that ship NSSOV (although some may). There is more information on it here: <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=blob;f=contrib/sl…> Hope that helps! Regards, Quanah --On Tuesday, October 25, 2016 5:09 PM +0000 "Real, Elizabeth (392K)" <Elizabeth.Real(a)jpl.nasa.gov> wrote: > > > Quanah, > > > > I found little information on this contrib nssov overlay: > http://www.openldap.org/doc/admin24/guide.html#nssov > > > > How do you implement it? Is it similar to adding the ppolicy overlay? > > > > > Thank you, > > Liz > > > > From: Quanah Gibson-Mount <quanah(a)symas.com> > Reply-To: Quanah Gibson-Mount <quanah(a)symas.com> > Date: Monday, October 24, 2016 at 6:29 PM > To: "Real, Elizabeth (392K)" <Elizabeth.Real(a)jpl.nasa.gov>, > "openldap-technical(a)openldap.org" <openldap-technical(a)openldap.org> > Subject: Re: openldap 2.4.40 ppolicy module and shadowInactive equivalent > > > > > --On Monday, October 24, 2016 7:43 PM +0000 "Real, Elizabeth (392K)" > > <Elizabeth.Real(a)jpl.nasa.gov> wrote: > > > > > > I setup a password policy overlay on my openldap 2.4.40 servers running > > RHEL7. I need to enforce the following: disable accounts that have been > > inactive for 180 days. In the past we were able to do this by simply > > adding the shadowInactive attribute to each account: shadowInactive 180. > > But with the new openldap, it appears there is no equivalent attribute?? > > > > > > OpenLDAP ppolicy has never supported that attribute, as far as I know. I > > believe you are looking for the contrib nssov overlay, which does support > > it. > > > > Hope that helps! > > > > Regards, > > Quanah > > > > > > > > -- > > > > Quanah Gibson-Mount > > Product Architect > > Symas Corporation > > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > > <http://www.symas.com> > > > > -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: openldap 2.4.40 ppolicy module and shadowInactive equivalent
by Quanah Gibson-Mount 25 Oct '16

25 Oct '16

--On Monday, October 24, 2016 7:43 PM +0000 "Real, Elizabeth (392K)" <Elizabeth.Real(a)jpl.nasa.gov> wrote: > I setup a password policy overlay on my openldap 2.4.40 servers running > RHEL7. I need to enforce the following: disable accounts that have been > inactive for 180 days. In the past we were able to do this by simply > adding the shadowInactive attribute to each account: shadowInactive 180. > But with the new openldap, it appears there is no equivalent attribute?? OpenLDAP ppolicy has never supported that attribute, as far as I know. I believe you are looking for the contrib nssov overlay, which does support it. Hope that helps! Regards, Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

ditContentRule + cn=config
by Dieter Klünter 25 Oct '16

25 Oct '16

Hi, it seems that slapd, starting with -F, is not able to read schema information, prior to cn=config, ./slapd -h "ldap://:9007/ ldapi:///" -F ../etc/openldap/slapd.d -d256 580f76bd config error processing cn=config: olcDitContentRules: ObjectClass not found: "2.16.840.1.113730.3.2.2" 580f76bd slapd stopped. but with -f schema information is read prior to global and database specific configuration. ./slapd -h "ldap://:9007/ ldapi:///" -f ../etc/openldap/slapd.conf -d256 580f76e4 slapd starting Has this been fixed already? although I couldn't find a report in ITS. -Dieter -- Dieter Klünter | Systemberatung http://sys4.de GPG Key ID: E9ED159B 53°37'09,95"N 10°08'02,42"E

1 0

Provider-Consumer replication 2.4 OLC (second attempt)
by Ted Hyde 25 Oct '16

25 Oct '16

1 0

Disk full, 15GB of logfiles containing timestamps
by Dan Hawkes 25 Oct '16

25 Oct '16

We've encountered a issue where openldap seems to be writing huge volumes of logs for authentication failures. Having freed up some space and run `db_recover` (which cleared out the log files), then restarted openldap, it's again written ~120MB of logs for 200 failed authentication requests. The log files are almost entirely timestamps: 0Z20161022152331.314499Z20161022152331.325384Z20161022152331.330788Z201610221523 31.350547Z20161022152331.355448Z20161022152331.369422Z20161022152331.374363Z2016 1022152331.390477Z20161022152331.410878Z20161022152331.427888Z20161022152331.438 814Z20161022152331.445610Z20161022152331.451377Z20161022152331.478571Z2016102215 2331.484278Z20161022152331.500831Z20161022152331.506391Z20161022152331.517584Z20 161022152331.522518Z20161022152331.542621Z20161022152331.547733Z20161022152331.5 66601Z20161022152331.571819Z20161022152331.582696Z20161022152331.588227Z20161022 152331.613213Z20161022152331.618932Z20161022152331.648696Z20161022152331.654433Z 20161022152331.668033Z20161022152331.677784Z20161022152331.685107Z20161022152331 .679736Z20161022152331.710191Z20161022152331.733564 OpenLDAP: slapd 2.4.40 Any ideas why this is happening?

2 1

How do I know proxy cache works or not?
by JWD 25 Oct '16

25 Oct '16

How do I know proxy cache works or not? And what cache hit?what is not? -------------- JWD

3 3

openldap 2.4.40 ppolicy module and shadowInactive equivalent
by Real, Elizabeth (392K) 24 Oct '16

24 Oct '16

Hello, I setup a password policy overlay on my openldap 2.4.40 servers running RHEL7. I need to enforce the following: disable accounts that have been inactive for 180 days. In the past we were able to do this by simply adding the shadowInactive attribute to each account: shadowInactive 180. But with the new openldap, it appears there is no equivalent attribute?? http://www.openldap.org/doc/admin24/ http://www.zytrax.com/books/ldap/ch6/ppolicy.html Thank you, Liz

1 0

Disable Linux commands for LDAP users
by Bernard Fay 24 Oct '16

24 Oct '16

Hi, I would like to able to disable some Linux commands for LDAP users. One of those commands is passwd. Because of some specific needs, when the LDAP users have to change their password a special script has been created for this purpose. They MUST not use passwd but this command is still required by local users. Does one of you might have an idea to disable Linux commands for LDAP users only? Thanks, Bernard

4 4

How to disable referrals when proxy windows AD?
by JWD 24 Oct '16

24 Oct '16

I config a proxy cache, using windows AD as backend. When I run ldapsearch, it always search reference for minuts, like this: # search reference ref: ldap://ForestDnsZones.test.com/DC=ForestDnsZones,DC=test,DC=com # search reference ref: ldap://DomainDnsZones.test.com/DC=DomainDnsZones,DC=test,DC=com # search reference ref: ldap://test.com/CN=Configuration,DC=test,DC=com Infact, there is no reference at all. How to disable proxy cache referrals? Below is my proxy cache config: database ldap suffix "dc=test,dc=com" uri ldap://192.168.127.15/ #uri ldap://192.168.127.15/dc=test,dc=com rootdn "cn=root,dc=test,dc=com" rootpw {SSHA}Hpc7nbJEdos8iCUAzRNa/rs5ffb0/+mD overlay pcache pcache bdb 100000 1 1000 100 #pcacheAttrset 0 name mail sAMAccountName telephonenumber pcacheAttrset 0 name mail telephonenumber pcacheTemplate (cn=) 0 3600 pcacheTemplate (&(sn=)(givenName=)) 0 3600 pcacheTemplate (&(departmentNumber=)(secretary=*)) 0 3600 directory /var/lib/ldap/test CacheSize 1000 DNcacheSize 2000 IDLcacheSize 3000 CacheFree 10 Checkpoint 1024 10 DbConfig set_cachesize 0 104857600 1 DbConfig set_data_dir db DbConfig set_lg_dir logs DbConfig set_lg_regionmax 1048576 DbConfig set_lg_max 20971520 DbConfig set_lg_bsize 2097152 DbConfig set_flags DB_LOG_AUTOREMOVE DbConfig set_flags DB_TXN_NOSYNC index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index entryCSN,entryUUID eq,pres -------------- JWD

2 1

eDirectory LDAP To OpenLDAP Layout
by Shaun Glass 24 Oct '16

24 Oct '16

Good Day, I am having to migrate from eDirectory to OpenLDAP as we getting rid of eDirectory Services. When setting up OpenLDAP I have as example the following : cn=user,ou=Users,ou=Location,o=LDAP,dc=Company,dc=com ... but in eDirectory it was just : cn=user,ou=Users,ou=Location,o=LDAP OpenLDAP Would not let me create as above since I got the following error when not initially creating a dc= : LDAP: error code 53 - no global superior The reason I need this is, is that the user that binds to LDAP on all servers uses the notation : cn=user,ou=Users,ou=Location,o=LDAP ... and we do not want to reconfigure all servers, several hundred of them. Is there some way that we can partition so the above format can still be used ? Regards

3 3

delta-synrepl consumer randomly delete objects
by Raffael Sahli 24 Oct '16

24 Oct '16

Hi What can lead a consumer to "randomly" delete ~50% of all objects in his database? I have this problem now for ~1-2months and on 3 different master/slave groups. The consumer starts to delete objects (but those are all present on the master): Oct 19 17:16:22 ldap-slave002.xxx slapd[8554]: do_syncrep2: rid=999 LDAP_RES_INTERMEDIATE - SYNC_ID_SET Oct 19 17:16:22 ldap-slave002.xxx slapd[8554]: do_syncrep2: rid=999 LDAP_RES_INTERMEDIATE - SYNC_ID_SET Oct 19 17:16:24 ldap-slave002.xxx slapd[8554]: nonpresent_callback: rid=999 nonpresent UUID 9c802b18-7c2c-1033-9f25-2d4a65066d19, dn uid=jasmin.mans,ou=none,o=dd,dc=xxx,dc=xxx Oct 19 17:16:24 ldap-slave002.xxx slapd[8554]: nonpresent_callback: rid=999 nonpresent UUID 650ada00-e996-1035-80ac-a173474274df, dn uid=jasmine.suddr,ou=none,o=dd,dc=xxx,dc=xxx Oct 19 17:16:24 ldap-slave002.xxx slapd[8554]: nonpresent_callback: rid=999 nonpresent UUID ec5c9aa4-7c2c-1033-9fa4-2d4a65066d19, dn uid=jonas.beffrnn,ou=none,o=dd,dc=xxx,dc=xxx Oct 19 17:16:24 ldap-slave002.xxx slapd[8554]: nonpresent_callback: rid=999 nonpresent UUID 7461d22e-e996-1035-80f6-a173474274df, dn uid=juerg.klegegeli,ou=none,o=dd,dc=xxx,dc=xxx Oct 19 17:16:24 ldap-slave002.xxx slapd[8554]: nonpresent_callback: rid=999 nonpresent UUID 758c744c-e996-1035-8100-a173474274df, dn uid=julia.sxgegegea,ou=none,o=dd,dc=xxx,dc=xxx Oct 19 17:16:24 ldap-slave002.xxx slapd[8554]: nonpresent_callback: rid=999 nonpresent UUID 47e4f6b4-7c2d-1033-8015-2d4a65066d19, dn uid=karin.vivwvwe,ou=none,o=dd,dc=xxx,dc=xxx Oct 19 17:16:24 ldap-slave002.xxx slapd[8554]: nonpresent_callback: rid=999 nonpresent UUID 8d26a4f2-7c2d-1033-807b-2d4a65066d19, dn uid=larissa.fewfewf,ou=none,o=dd,dc=xxx,dc=xxx Oct 19 17:16:24 ldap-slave002.xxx slapd[8554]: nonpresent_callback: rid=999 nonpresent UUID 98310aa4-7c2d-1033-808b-2d4a65066d19, dn uid=laura.cfwfew,ou=none,o=dd,dc=xxx,dc=xxx syncrepl config: olcSyncrepl: {0}rid=999 provider=ldap://ldap-master002.xxx.xxx:389 bindmethod=simple timeout=0 network-timeout=10 binddn="uid=replicator,ou=system,o=de,dc=xxx,dc=xxx" credentials="pass" keepalive=0:0:0 starttls=yes tls_cacert="/etc/ssl/certs/SwissSign_Silver_CA_-_G2.pem" tls_reqcert=allow filter="(objectClass=*)" searchbase="dc=xxx,dc=xxx" scope=sub attrs="*,+" syncdata="accesslog" logbase="cn=accesslog_xxx" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" schemachecking=off type=refreshOnly interval="00:00:01:00" retry="10 5 60 +" Misconfiguration? (We've been running this configuration for years...) Workaround is to remove the whole mdb database and restart slapd to let it resync. I've found some posts with a similar problem but those are all related to pre 2.4.21, we're running slapd 2.4.44. Cheers

1 1

Configuring a relatively simple translucent proxy to override/add group memberships.
by Jeff Wiegley 24 Oct '16

24 Oct '16

Hopefully somebody can help as I am new to OpenLDAP and I've spent the whole day being overwhelmed and totally confused by the configration of this beast. (How did it get "Lightweight" as part of its name?) The problem I have is that I have a group of computers in my research lab at a university that I want to allow login to for campus users. I want to authenticate the logins against the campus LDAP server but I want to augment/add group-membership to the results. So for instance the campus LDAP server might authenticate a user named "bob" and a unix groups command for bob when logged in would show {"users", "student", "webuser"} but I want my machines to log him with his same campus credentials but see his group membership as {"users", "student", "webuser", "research", "cloud"}. From what I've read I can do this with the translucent overlay. The problem is that I have no idea how to get this working, let alone interface with the campus LDAP mess. So far I can get users authenticated and logged in with authentication solely against the campus LDAP server but nothing about the local translucent proxy is even understandable yet testable. I have Ubuntu 16.04 and I installed ldap/slapd do by essentially doing: apt-get install ldap-auth-client slapd ldap-utils I see both /etc/ldap/slapd.d and /usr/share/slapd/slapd.conf installed. And, as I said, I've got the machine configured via ldap.conf to authenticate against the campus LDAP server odir.csun.edu. But none of that even requires slapd installed. . I realize I'll eventually need to configure/understand slapd in order to allow it to authenticate against my local server but I'm totally lost in trying to figure that part out.) Couple of questions to start: 1) Should I be making configuration changes in /usr/share/slapd/slapd.conf or should I be using the dynamic config thingy and ldapadd/ldapmodify?? Several things I read say use ldapmodify but then EVERY example about translucent proxies that I can find demonstrate with slapd.conf. In fact almost every tutorial I've read is entrenched in slapd.conf. 2) How do I set up translucent overlay to proxy to the campus ldap server without making any changes to the results? If we could start there than maybe I could start getting a handle on at least a little understanding of how this starts to work. Thanks for any help, Jeff

2 1

Re: Disable Linux commands for LDAP users
by Mauricio Tavares 21 Oct '16

21 Oct '16

I think there was something called ldap-sudo, but there might be other ways to do it. On Oct 21, 2016 4:39 PM, "Bernard Fay" <bernard.fay(a)gmail.com> wrote: Hi, I would like to able to disable some Linux commands for LDAP users. One of those commands is passwd. Because of some specific needs, when the LDAP users have to change their password a special script has been created for this purpose. They MUST not use passwd but this command is still required by local users. Does one of you might have an idea to disable Linux commands for LDAP users only? Thanks, Bernard

1 0

slapo-rwm documentation
by Ralf Mattes 17 Oct '16

17 Oct '16

Dear collected list wisdom, I have successfully set up a relay database with Rwm suffix massaging. Now, for a client app I need to transform gorupOfNames into posixGroups and member attributes into memberUID. I was able to do the objectclass/attribute transformation with olcRwmMaps but now I need to transform the attribute _values_ (i.e. I need to strip the DN-valued member values to get uids). From the existing documentation I can't find out how to restrict a rwm-RewriteRule to (certain) attributes. Any help? TIA Ralf Mattes

1 0

Public LDAP server, what do I need to know?
by John Lewis 16 Oct '16

16 Oct '16

I want to host a LDAP server that contains a directory that contains the offices of local Representatives and Public Servants, the issues they are responsible for, and their names. I would like anyone who wants to to browse it or put up front ends. Is there anything in particular that I should keep in mind?

1 0

openldap 2.4.40 on RHEL7
by Real, Elizabeth (392K) 15 Oct '16

15 Oct '16

Hello, Quick question about replication, I’m setting up an ldapclient to talk to my two LDAP servers which are replicating fine. To be able to talk to both LDAP servers, do I need to scp the server certificate (cert.pem) from both servers into the ldapclient /etc/openldap/cacerts directory? I’m looking at this documentation to configure the ldap client using sssd: https://www.certdepot.net/ldap-client-configuration-authconfig/ Thank you, Liz

2 1

Re: group membership search performance
by Quanah Gibson-Mount 14 Oct '16

14 Oct '16

--On Friday, October 14, 2016 1:13 PM +0200 Rébeli-Szabó Tamás <tamas.rebeli.szabo(a)webvalto.hu> wrote: > Hi Quanah, > > yes, it takes 5–7 seconds for each search. I believe that's a general known issue with very large groups. I personally moved to using dynamic groups via slapo-dynlist for a variety of reasons, performance being one. You may want to test in a dev environment if your issues go away if you move to dynamic groups instead. --Quanah -- Quanah Gibson-Mount Product Engineer Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: group membership search performance
by Quanah Gibson-Mount 14 Oct '16

14 Oct '16

--On Wednesday, October 12, 2016 10:11 PM +0200 Rébeli-Szabó Tamás <tamas.rebeli.szabo(a)webvalto.hu> wrote: > Hi, > > we are on OpenLDAP 2.4.41 + MDB, Oracle Linux 6 (2.6 x86_64). > > In our DIT we have around 300 groups, with tens of thousands of members > in each group. When we want to know which groups a certain user belongs > to, it takes OpenLDAP several seconds to perform such a search. > > Here is a log excerpt showing that it took 6 seconds for the server to > answer: > > Oct 10 15:39:38 ldap-srv1 slapd[14776]: conn=1062 op=1 SRCH > base="ou=groups,dc=tt,dc=hu" scope=1 deref=0 > filter="(&(uniqueMember=uid=o10011,ou=users,dc=tt,dc=hu)(objectClass=grou > pOfUniqueNames))" > Oct 10 15:39:44 ldap-srv1 slapd[14776]: conn=1062 op=1 SEARCH RESULT > tag=101 err=0 nentries=127 text= > > We have eq indices on objectClass and uniqueMember, and the latter is > also listed after sortvals. > > The machine running OpenLDAP has 2 virtual cores of Intel Xeon E5 2637 v2 > (3.5GHz). During such searches, one of the CPU cores is almost fully > loaded, but the system is not overloaded (the average load is around > 0.8). Our whole dataset is under 1 GB, and there are several gigabytes > of free RAM with no swapping. > > Our expectation would be for OpenLDAP to give an answer to a group > membership question under 1 second. Is that a realistic expectation, and > if so, how should we tune OpenLDAP or what do you suggest we change? > Version 2.4.41 is more than a year old, so the question is if there is > any significant performance enhancement (an order of magnitude) possible > with this setup described above, or that's about all we can get from > OpenLDAP+MDB (or perhaps any in-memory LDAP)? Does it always take 6 seconds to return the 127 group entries that match, or is that only on the first search? --Quanah -- Quanah Gibson-Mount Product Engineer Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

OpenLDAP server attack surface analysis shows UDP port 63515 in unknown state
by Sreekanth Sukumaran 14 Oct '16

14 Oct '16

Sorry, I missed to add subject in the last mail. Resending with subject. sorry about spamming the group Hi All, OpenLDAP version : 2.4.39 on windows Tool used : Microsoft Attack surface analyzer We have been doing attack surface analysis on OpenLDAP server, and we have found that there is an UDP port 63515 associated with OpenLDAP server. (state shows "Unknown", not listening or established) [image: Inline image 1] We have not connected any clients to OpenLDAP server, so we cannot think of it as an ephemeral port at server end as well. Has anyone an idea on what this port could be for. Inputs are much appreciated. -- Regards, Sreekanth -- Regards, Sreekanth 09036794524

5 5

syncrepl not working: "no serverID / URL match found"
by Daniel Spannbauer 14 Oct '16

14 Oct '16

Hello, at the moment we have an server running openSuSE 11.4 (lets call in server2), running openldap 2.4.23. Configured is a replication to/from out mainoffice (running openldap 2.4.17, server1). Replication works fine. I wan't to replace server2 with a newer one, running openldap 2.4.33 atm. ---------------------------------------------- Configuration for replication on server2: moduleload syncprov.la serverID 1 "ldap://server1.mainoffice.xxx.de" serverID 2 "ldap://server2.branch.xxx.de" overlay syncprov syncrepl rid=001 provider=ldap://server1.mainoffice.xxx.de:389 binddn="cn=Administrator,dc=xxx,dc=de" bindmethod=simple credentials=somepassowrd searchbase=" dc=marco,dc=de" type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 +" timeout=1 mirrormode TRUE overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE syncprov-checkpoint 1000 60 ---------------------------------------------- This config works fine with the "old" 2.4.23, but on 2.4.33 I get the following error when I start it on the commandline with /usr/lib/openldap/slapd -h ldap:/// -f /etc/openldap/slapd.conf -u ldap -g ldap -o slp=off -d 1 57ff35cc read_config: no serverID / URL match found. Check slapd -h arguments. Any hints about this? regards Daniel -- Daniel Spannbauer Systemadministration marco Systemanalyse und Entwicklung GmbH Tel +49 8333 9233-27 Fax -11 Rechbergstr. 4-6, D 87727 Babenhausen Mobil +49 171 4033220 http://www.marco.de/ Email ds(a)marco.de Geschäftsführer Martin Reuter HRB 171775 Amtsgericht München

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical