- openldap-technical - openldap.org

Re: syncrepl not working: "no serverID / URL match found"
by Quanah Gibson-Mount 14 Oct '16

14 Oct '16

--On Thursday, October 13, 2016 10:22 AM +0200 Daniel Spannbauer <ds(a)marco.de> wrote: > serverID 1 "ldap://server1.mainoffice.xxx.de" > serverID 2 "ldap://server2.branch.xxx.de" > This config works fine with the "old" 2.4.23, but on 2.4.33 I get the > following error when I start it on the commandline with > /usr/lib/openldap/slapd -h ldap:/// -f /etc/openldap/slapd.conf -u > ldap -g ldap -o slp=off -d 1 > > 57ff35cc read_config: no serverID / URL match found. Check slapd -h > arguments. Hi Daniel, As the error message notes, there is no match between what you are passing to -h when slapd starts (ldap:///) and a URI in your serverID config (ldap://server1... ldap://server2...). Adjust your -h option to slapd so that it can be matched against a server ID. Hope that helps! --Quanah -- Quanah Gibson-Mount Product Engineer Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

2 1

Re: LMDB: Ignore SIGPIPE in mdb_env_copythr
by Howard Chu 13 Oct '16

13 Oct '16

Lorenz Bauer wrote: > Hello Hallvard, List, > > I'd like to propose explicitly ignoring SIGPIPE in the copy thread via > pthread_sigmask, and returning EPIPE to the caller instead. Feel free to submit a patch to the ITS, according to http://www.openldap.org/devel/contributing.html Since it seems this is a pretty small change, I suggest your IPR notice should place your changes into the public domain. > > This is a change that makes little sense in the C world, since the > caller can simply adjust the sigmask before calling the function > (which is indeed what the utilities do). However, this amount of > control is not always given, e.g. when using LMDB from Go (which is > what I am doing). > > Due to the way the Go runtime works, using mdb_env_copyfd2 with > CP_COMPACT on a pipe or a network connection will abort the whole > process with SIGPIPE if the reading end of the fd is closed > prematurely. The details why this happens are in [1]. Go has some > additional trickery when dealing with stdin and stdout, so ignoring > SIGPIPE for the whole process is undesirable (details in [2]). > > I understand that you might be reluctant to change the behaviour due > to the constraints of a different runtime. However, I think that even > in the C world it is surprising that calling a library function can > abort your process. > > What are your thoughts regarding this? I think the code changes would > be small, and the API would not change for consumers of the library. > > 1: https://golang.org/pkg/os/signal/#hdr-Go_programs_that_use_cgo_or_SWIG > 2: https://golang.org/pkg/os/signal/#hdr-SIGPIPE > > Best, > Lorenz > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

group membership search performance
by Rébeli-Szabó Tamás 12 Oct '16

12 Oct '16

Hi, we are on OpenLDAP 2.4.41 + MDB, Oracle Linux 6 (2.6 x86_64). In our DIT we have around 300 groups, with tens of thousands of members in each group. When we want to know which groups a certain user belongs to, it takes OpenLDAP several seconds to perform such a search. Here is a log excerpt showing that it took 6 seconds for the server to answer: Oct 10 15:39:38 ldap-srv1 slapd[14776]: conn=1062 op=1 SRCH base="ou=groups,dc=tt,dc=hu" scope=1 deref=0 filter="(&(uniqueMember=uid=o10011,ou=users,dc=tt,dc=hu)(objectClass=groupOfUniqueNames))" Oct 10 15:39:44 ldap-srv1 slapd[14776]: conn=1062 op=1 SEARCH RESULT tag=101 err=0 nentries=127 text= We have eq indices on objectClass and uniqueMember, and the latter is also listed after sortvals. The machine running OpenLDAP has 2 virtual cores of Intel Xeon E5 2637 v2 (3.5GHz). During such searches, one of the CPU cores is almost fully loaded, but the system is not overloaded (the average load is around 0.8). Our whole dataset is under 1 GB, and there are several gigabytes of free RAM with no swapping. Our expectation would be for OpenLDAP to give an answer to a group membership question under 1 second. Is that a realistic expectation, and if so, how should we tune OpenLDAP or what do you suggest we change? Version 2.4.41 is more than a year old, so the question is if there is any significant performance enhancement (an order of magnitude) possible with this setup described above, or that's about all we can get from OpenLDAP+MDB (or perhaps any in-memory LDAP)? Regards, tamas

1 0

Returned mail: Data format error
by dieter＠dkluenter.de 12 Oct '16

12 Oct '16

Dear user openldap-technical(a)openldap.org, Your account has been used to send a huge amount of junk e-mail during this week. Obviously, your computer was compromised and now runs a hidden proxy server. Please follow instructions in order to keep your computer safe. Virtually yours, openldap.org user support team.

1 0

Paged Result support in proxy cache
by laurent2.perrin＠orange.com 10 Oct '16

10 Oct '16

Hello, I have configured a proxy LDAP with cache but when I try to do request with paged results, I can see this error message in logs: Oct 7 14:07:55 ldap-cache slapd[18615]: conn=1017 op=1 SRCH base="dc=***,dc=***,dc=****,dc=**" scope=2 deref=0 filter="(&(memberOf=cn=gg-oab-pa-openstack,ou=profils applicatifs,ou=groupes de securite \28gg\29,ou=***,dc=***,dc=***,dc=***,dc=***)(objectClass=person)(?SAMACCOUNTNAME=*))" Oct 7 14:07:55 ldap-cache slapd[18615]: conn=1017 op=1 SRCH attr=samaccountname userPassword userAccountControl mail description Oct 7 14:07:55 ldap-cache slapd[18615]: conn=1017 op=1: critical pagedResults control disabled with proxy cache. Oct 7 14:07:55 ldap-cache slapd[18615]: conn=1017 op=1: critical control "1.2.840.113556.1.4.1339" not supported. Oct 7 14:07:55 ldap-cache slapd[18615]: send_ldap_result: conn=1017 op=1 p=3 Oct 7 14:07:55 ldap-cache slapd[18615]: send_ldap_result: err=12 matched="" text="" Oct 7 14:07:55 ldap-cache slapd[18615]: send_ldap_response: msgid=2 tag=101 err=12 Oct 7 14:07:55 ldap-cache slapd[18615]: conn=1017 op=1 SEARCH RESULT tag=101 err=12 nentries=0 text= When the cache is not configured, all requests are OK and return results Here is the configuration used: dn: olcDatabase=ldap,cn=config objectClass: olcDatabaseConfig objectClass: olcLDAPConfig olcDatabase: ldap olcSuffix: dc=ad-***,dc=***,dc=***,dc=** olcRootDN: cn=compte_service,OU=***,dc=***,dc=***,dc=***,dc=*** olcRootPW: password olcDbURI: "ldap://ad.local" olcDbChaseReferrals: FALSE olcDbNoRefs: FALSE olcDbNoUndefFilter: FALSE olcDbACLBind: bindmethod=simple binddn="cn= ***,OU=***,dc=***,dc=*,dc=***,dc=***" credentials="password" olcLimits: * size.prtotal=unlimited size.pr=1000 size.hard=5000 dn: olcOverlay=pcache,olcDatabase={2}ldap,cn=config objectClass: olcOverlayConfig objectClass: olcPcacheConfig olcOverlay: pcache olcPcache: hdb 100000 1 1000 100 olcPcacheAttrset: 0 * olcPcacheTemplate: "(sn=)" 0 3600 0 0 0 olcPcacheTemplate: "(memberof=)" 0 3600 dn: olcDatabase=hdb,olcOverlay={0}pcache,olcDatabase={2}ldap,cn=config objectClass: olcHdbConfig objectClass: olcPcacheDatabase olcDatabase: hdb olcDbDirectory: /var/lib/ldap olcDbCacheSize: 200 olcDbIndex: objectClass eq olcDbIndex: cn pres,eq,sub I tried to add size.pr option to the Cache database but it seems to not be supported. So does proxy cache support the use of paged results ? Regards, [cid:image001.gif@01CBF2E5.34FD28F0] Laurent PERRIN Service Infra aux Projets Orange Applications for Business SCE/OAB/DPO/DSPM/IOP tel. +33 4 37 24 62 85 Mob : 07 84 12 78 79 laurent2.perrin(a)orange.com<mailto:laurent2.perrin@orange.com> 139 rue Vendôme 69006 Lyon www.orange-business.com<http://www.orange-business.com/> [cid:image002.gif@01CBF2E5.34FD28F0] _________________________________________________________________________________________________________________________ Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration, Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci. This message and its attachments may contain confidential or privileged information that may be protected by law; they should not be distributed, used or copied without authorisation. If you have received this email in error, please notify the sender and delete this message and its attachments. As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified. Thank you.

2 1

Re: OpenLDAP with OpenSSL 1.1.0
by Quanah Gibson-Mount 07 Oct '16

07 Oct '16

--On Wednesday, October 05, 2016 11:43 AM -0700 Norm Green <norm.green(a)gemtalksystems.com> wrote: > I am trying to build OpenLDAP from source on Linux with OpenSSL 1.1.0. I > first tried version 2.4.44 and found that didn't work due to the API > changes in OpenSSL 1.1.0. I then filed ITS 8488 on the problem, which > was quickly closed with the comment " Already supported in git master. > Closing this ITS.". > > So I then got a copy of the git master and tried a build and it still > fails in configure a follows: > > conftest.c:106: undefined reference to `SSL_library_init' > ... > configure:15618: result: no > configure:15864: error: Could not locate TLS/SSL package > > > This function is no longer present in OpenSSL 1.1.0 so it would appear > the OpenLDAP configure script should be checking the version of OpenSSL > before looking for the SSL_library_init symbol. > > Is this a known problem? Should I file a bug? Or is support for OpenSSL > 1.1.0 known to be incomplete? Follow up to ITS8353, noting that there is more to be done. --Quanah -- Quanah Gibson-Mount Product Engineer Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

Re: User Import Problem with n-way multimaster setup
by Quanah Gibson-Mount 05 Oct '16

05 Oct '16

--On Wednesday, October 05, 2016 12:40 PM +0000 robert.lindner(a)delivion.de wrote: > Hi, > I have a Problem importing a large batch of users into the following > setup: Two Nodes of openldap running n-way multimaster replication with > mdb backend, version is 2.4.44. Everything looks good, replication is > working. > > Now I am trying to import a ldif file with 110362 Users to be added and > 956419 group modify operations: Hi Robert, I would generally suggest using dynamic rather than static groups. You've definitely found the downside to static groups -- They require an excessive number of write ops that could otherwise be avoided. You may want to look into how you're currently implementing your group data and re-adjust. Hope that helps, Quanah -- Quanah Gibson-Mount Product Engineer Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

1 0

OpenLDAP with OpenSSL 1.1.0
by Norm Green 05 Oct '16

05 Oct '16

I am trying to build OpenLDAP from source on Linux with OpenSSL 1.1.0. I first tried version 2.4.44 and found that didn't work due to the API changes in OpenSSL 1.1.0. I then filed ITS 8488 on the problem, which was quickly closed with the comment " Already supported in git master. Closing this ITS.". So I then got a copy of the git master and tried a build and it still fails in configure a follows: conftest.c:106: undefined reference to `SSL_library_init' ... configure:15618: result: no configure:15864: error: Could not locate TLS/SSL package This function is no longer present in OpenSSL 1.1.0 so it would appear the OpenLDAP configure script should be checking the version of OpenSSL before looking for the SSL_library_init symbol. Is this a known problem? Should I file a bug? Or is support for OpenSSL 1.1.0 known to be incomplete? Norm Green

1 0

Re: Syncrepl and missing entries
by Quanah Gibson-Mount 05 Oct '16

05 Oct '16

--On Wednesday, October 05, 2016 12:17 PM +0200 Thomas Hummel <thomas.hummel(a)pasteur.fr> wrote: > I'm answering some parts of my own question : > > as a matter of fact, the entry missing in my replica has an entryCSN > lesser than the contestCSN. I guess that's the reason why it is not > synchronised. > > Does that mean that, if for some reason, the replica gets out of sync in > a similar manner, missing entries will never get synch'ed again unless - > by "chance" - touched (modified) again (in which case they'll get a new > entryCSN) ? Correct > Of course, I still don't undestand why this entry disapeared in the first > place... What release? There are known issues with syncrepl in various releases. --Quanah -- Quanah Gibson-Mount Product Engineer Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: <http://www.symas.com>

3 4

User Import Problem with n-way multimaster setup
by robert.lindner＠delivion.de 05 Oct '16

05 Oct '16

Hi, I have a Problem importing a large batch of users into the following setup: Two Nodes of openldap running n-way multimaster replication with mdb backend, version is 2.4.44. Everything looks good, replication is working. Now I am trying to import a ldif file with 110362 Users to be added and 956419 group modify operations: 1. When both nodes are online and replication is running, after slapd on the importing node quickly starts using all available memory until the kernel oom-killer decides it uses too much and kills the process. This seems to be caused by the group modifications: It did not happen before, when we had an error in the ldif which caused the group modify statements to be ignored, so only users were imported. We tried to circumvent this behavior by adding up to 32GB of Memory, but this only postponed the problem. 2. When I shut down the second node, so no replication is happening, then start the user and group membership import, this runs fine (takes about 10 hours) without exhausting memory, but if I join the second node afterwards none of the new entries is replicated to the second node. Does anyone have an idea what I might be doing wrong? Currently I try to batch import with the ldif split into chunks of 1000 entries, with a 30s pause in between. Best Regards, Robert Lindner Cloud Platform Engineer | Delivion GmbH Nachbarsweg 25a | D-45481 Mülheim an der Ruhr Tel.: [+49] 170 7727967 | Web: www.delivion.de This e-mail message may contain confidential or legally privileged information and is intended only for the use of the intended recipient(s). Any unauthorized disclosure, dissemination, distribution, copying or the taking of any action in reliance on the information herein is prohibited. E-mails are not secure and cannot be guaranteed to be error free as they can be intercepted, amended, or contain viruses. Anyone who communicates with us by e-mail is deemed to have accepted these risks. Company Name is not responsible for errors or omissions in this message and denies any responsibility for any damage arising from the use of e-mail. Any opinion and other statement contained in this message and any attachment are solely those of the author and do not necessarily represent those of the company.

1 0

Syncrepl and missing entries
by Thomas Hummel 05 Oct '16

05 Oct '16

Hello, I'm planning a migration from openldap-2.4.35 (FreeBSD 9.1-RELEASE-p12) to openldap-2.4.40 (CentOS 7). On BSD, I have 3 slapd.conf/hdb servers : one provider and 2 consumers (classical syncprov overlay / syncrepl refreshAndPersist setup). On linux, I've set up 3 new cn=config/lmdb servers in a simliar manner. For a smooth migration, I also configured syncrepl on the linux provider so that it is also a consumer of the BSD provider. So this is a simple BSD provider -> linux provider-and-consumer -> linux consumer chain, not a multi-master setup. Everything worked fine and I could indeed check that modifying, say an attribute of my dn, on the FreeBSD provider was replicated to the BSD consumers, the Linux provider and then the Linux consumers. Unfortunately, I noticed that, after a while (at least it seems that it occurred after a while, I'd swear the entry was there from the start), the sssd entry (cn=sssd,ou=ldap,dc=pasteur,dc=fr) - used by sssd to bind - was missing on the Linux provider-and-consumer. That in itself may be an mystery I must figure out. But more important, I noticed that this entry would not be replicated although it IS present on the BSD provider, even after slapd restarts. Only if I remove the database files and restart from scratch get all the entries - including this one - get replicated from the BSD provider to the linux provider-consumer. Is my setup only supposed to work ? Is the difference of slapd versions a problem ? Is the fact that both providers manage the same rootDSE a problem ? Thanks -- Thomas HUMMEL

1 1

Mapping attribute from ppolicy shemas to shadowaccount
by Alexis Lameire 05 Oct '16

05 Oct '16

Hello, Despite my search I can't find a good solution to my issue. I would like to implement passord policy inside my LDAP server. So I will use the password policy overlay. The policy applyed to the user is located on the pwdPolicySubentry attribute of the user entry. I would like to configure the password expiration warning on my policy. I would also that this warning will be displayed on my linux based server. Due to the deprecation of pam_ldap module on recent system, I'm using SSSD. Despite my search, SSSD is only able to fetch the password expiration attribut inside the shadowAccount objectClass (so on the user entry). To be able to define my policy once, I have to show and rename the ppolicy objectClass attribut referenced by the pwdPolicySubentry dn inside the user entry. with the slapo-rwm I can map the attribute of the same leaf objectClass to another name but I'm not able to follow the pwdPolicySubentry DN and map the value of this object inside the posixAccount objectClass. How to acheave this ? Regards

1 0

Openldap with Active Directory
by Matthew Pulis 03 Oct '16

03 Oct '16

Hi, I have a freeradius server which is authenticating users against Openldap and according to the attribute memberOf is assigned a VLAN (this part works fine). Now I would like to extend this functionality for the users in Active Directory (2012 R2). My OpenLdap's main DN is: dc=seminary,dc=local, and has 5 OU's each with their own users. My Active Direcotry's main ND is: dc=seminary,dc=local too but has only 1 OU which distinguishedName is ou=School,dc=seminary,dc=local. A few questions: 1) Will this be possible? I need only to authenticate the user and that's it - any password modifications will be done only through Active Directory domain. 2) I was thinking to use the back_ldap and rwm Openldap modules. But ended up entering a problem with this ldif: (since the olcDbACLPasswd is deprecated) radius@radius:~$ cat proxy2.ldif dn: olcDatabase={1}mdb,cn=config changetype: add olcdatabase: ldap olcReadOnly: TRUE olcDbProtocolVersion: 3 olcSuffix: dc=seminary,dc=local olcRootDN: ou=school,dc=seminary,dc=local olcDBUri: "ldap://192.168.100.129:389" olcDbRebindAsUser: TRUE olcoverlay: rwm olcRwmMap: attribute cn distinguishedName olcRwmMap: attribute mail mail olcRwmMap: attribute uid sAMAccountName olcRwmMap: objectClass posixAccount person olcRwmMap: objectClass memberUid member olcRwmMap: attribute memberOf memberOf #olcDbIDAssertBind: bindmethod=simple #olcDbIDAssertMode: none olcDbIDAssertBind: cn=Ldap Binder,dc=seminary,dc=local olcDbACLPasswd: PASS! Any idea how I can go through this issue? Will this work after all? Thanks and best regards Matthew Matthew Pulis web: www.matthewpulis.info mob: +356 79539404

1 0

RedHat 6 & 7 disable TLSv1.0
by Gaurav Swami 03 Oct '16

03 Oct '16

Hello, I have Redhat 6 where am trying to disable TLSv1.0 protocol.I have tried below configuration RHEL6 ----------------------------------------- [root@ldap1 ~]# rpm -qa | grep -we openldap -we openssl -we nss krb5-pkinit-openssl-1.10.3-10.el6_4.6.x86_64 openldap-servers-2.4.40-12.el6.x86_64 nss-util-3.21.0-2.el6.x86_64 nss-3.21.0-8.el6.x86_64 openssl-devel-1.0.1e-48.el6_8.1.x86_64 openssl-1.0.1e-48.el6_8.1.x86_64 openldap-clients-2.4.40-12.el6.x86_64 nss-softokn-freebl-3.14.3-23.3.el6_8.x86_64 nss-sysinit-3.21.0-8.el6.x86_64 nss-tools-3.21.0-8.el6.x86_64 openldap-2.4.40-12.el6.x86_64 nss-softokn-3.14.3-23.3.el6_8.x86_64 ---------------------------------------------------------------------------- RHEL6 Configuration ---------------------------------------- TLSProtocolMin 3.2 TLSCipherSuite HIGH ----------------------------------------- But still when I ran third party tool to check offered protocol am getting --> Testing protocols (via sockets except TLS 1.2 and SPDY/NPN) SSLv2 not offered (OK) SSLv3 not offered (OK) TLS 1 offered TLS 1.1 offered TLS 1.2 offered (OK) SPDY/NPN not offered --> Testing ~standard cipher lists TLSv1.0 is still offered ,I want to disable TLSv1.0 also Any suggestiosn? -- Thanks & Regards, **Gaurav Swami**

4 3

Test
by dieter＠dkluenter.de 01 Oct '16

01 Oct '16

1 0

Fine grained access to attributes
by Ralf Mattes 29 Sep '16

29 Sep '16

Just a quick question: isit possible to control access to attributes based on an attribute tag? The idea is to hide certain attributes by adding a "...;x-hidden' tag. TIA Ralf Mattes :wq

4 8

Syncrepl initial sync provider sends entries in wrong order
by Γ. Μηλιώτης 29 Sep '16

29 Sep '16

Hello everyone, I'm wondering if a syncrepl behaviour I'm seeing is correct. My consumer is 4.4.42 and my provider 4.4.40. I'm using refreshOnly replication and when I first create the database entry on the consumer the whole process stops after 5-6 records. I have tested the syncuser and its searches against the provider return >9000 results. So it's not a limit or auth issue. I have matched the schemas on both servers successfully. I believe the issue is that the provider is sending the records in an incorrect order. I get a record with an entryCSN in 20151001 and then a record with an entryCSN before that. So, if I understand it, operating correctly, the consumer complains the record is too old and ignores it, stopping replication. The contextCSN of the provider is in the 2016* range, the consumer's is stuck in 2015* range and the log spams "too old". I'm using the -c rid=XXX option to run slapd and deleting the DB between tests. Shouldn't the provider send the entries in a entryCSN-ascending order during the initial sync? Thanks for any insight you can provide. --GM

1 0

N-Way replication
by rammohan ganapavarapu 28 Sep '16

28 Sep '16

Hi, I have n-way replication setup in ldap version 2.4.43 and i have basic technical question, do we have to specify nth server details in replication config? lets say i have server1 server2 and server3 and i wanted to setup n-way replication among these servers Part of my config looks like this # Global section serverID 1 ldap://server1 serverID 2 ldap://server2 serverID 3 ldap://server3 # database section # syncrepl directive syncrepl rid=001 provider=ldap://server1 syncrepl rid=002 provider=ldap://server2 syncrepl rid=003 provider=ldap://server3 mirrormode on So if i include the nth server itlsef in the replication provider doesn't it try to replicate it self and get it into loop condition? Please advice Thanks, Ram

1 0

Re: Fwd: Using lmdb as a pure in memory store
by Howard Chu 23 Sep '16

23 Sep '16

Russell Haley wrote: > Thanks so much for your response and thanks for the link. I've been > pouring over that documentation off and on. > > The developer currently doing the prototyping has said he ran into an > issue where the use of a very large key value caused the system to > slow down (he didn't give specifics and I didn't have time to ask). He > said it was a sparsely populated record set of about 100,00 rows but > he specifically used a large value for the key as we hope to support > UInt64 for keys (I don't know why, apparently we're indexing > sub-atomic particles?). I saw a setting for MDB_MAXKEYSIZE which was > 0 for computed, but I don't know what that means on an ARM (v6 - 32 > bit) system. Would you have any idea what would cause the performance > hit he was referring too? At a guess, you're slowing down because you're using 64bit values on a 32bit processor and once you exceed the range of a 32bit integer you need twice as many memory accesses to fetch/compare keys. Anyway, if you're using MDB_INTEGERKEY (which you should be, in this case) then you'll never get anywhere near the max keysize. > Sorry if my questions are weird, I'm trying to learn C and embedded > development through osmosis. > > Anyway, on a personal note, I was thoroughly happy to get lmdb working > in Lua through > > https://github.com/shmul/lightningmdb > > and can't wait to try his Mule Round-Robin Database tool > > https://github.com/shmul/mule > > Awesome stuff. > > Russ > > > On Thu, Sep 22, 2016 at 4:25 PM, Howard Chu <hyc(a)symas.com> wrote: >> Russell Haley wrote: >>> >>> Hello, >>> >>> I wasn't fully subscribed when I sent this so I'll send it again. >>> >>> Any input or reference hints would be great. I love reading manuals. :) >> >> >> http://lmdb.tech/doc/ >>> >>> >>> Russ >>> >>> >>> ---------- Forwarded message ---------- >>> From: Russell Haley <russ.haley(a)gmail.com> >>> Date: Tue, Sep 20, 2016 at 4:52 PM >>> Subject: Using lmdb as a pure in memory store >>> To: openldap-technical(a)openldap.org >>> >>> >>> Hi there, >>> >>> We are currently evaluating in memory key value stores for ~100,000 - >>> 200,000 records in an embedded system. I suggested lmdb but it is >>> being discounted for some reasons I thought I'd validate: >>> >>> 1) It is currently thought that a on disk file is REQUIRED for the >>> system. Does MDB_NOSYNC turn off the disk caching? Can it be run as a >>> pure in-memory database? Could the file not just be mapped to a >>> memdisk? >> >> >> A file is required. Whether the file is on-disk or not is irrelevant. It can >> of course be on a RAMdisk (or, in Linux, a tmpfs), which would then make it >> pure in-memory. >> >> MDB_NOSYNC turns off syncing, that's why it is named that. >> >>> 2) Because these values can come very fast, that the use of a lock >>> file would cause delay and too much wear on the nand based disk (SSD). >> >> >> No. That's not how the lock file is used. >> >>> I see a no locking option ( MDB_NOLOCK) that would stop a lock file >>> being written. >> >> >> This option should only be used if you're implementing your own lock >> manager. Hint - no matter what approach you use, any other lock manager you >> use will be slower than LMDB's. >> >>> Again, another option would be mapping the lock file to >>> a memdisk to handle that? >> >> >> Yes. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: Fwd: Using lmdb as a pure in memory store
by Howard Chu 23 Sep '16

23 Sep '16

Russell Haley wrote: > Hello, > > I wasn't fully subscribed when I sent this so I'll send it again. > > Any input or reference hints would be great. I love reading manuals. :) http://lmdb.tech/doc/ > > Russ > > > ---------- Forwarded message ---------- > From: Russell Haley <russ.haley(a)gmail.com> > Date: Tue, Sep 20, 2016 at 4:52 PM > Subject: Using lmdb as a pure in memory store > To: openldap-technical(a)openldap.org > > > Hi there, > > We are currently evaluating in memory key value stores for ~100,000 - > 200,000 records in an embedded system. I suggested lmdb but it is > being discounted for some reasons I thought I'd validate: > > 1) It is currently thought that a on disk file is REQUIRED for the > system. Does MDB_NOSYNC turn off the disk caching? Can it be run as a > pure in-memory database? Could the file not just be mapped to a > memdisk? A file is required. Whether the file is on-disk or not is irrelevant. It can of course be on a RAMdisk (or, in Linux, a tmpfs), which would then make it pure in-memory. MDB_NOSYNC turns off syncing, that's why it is named that. > 2) Because these values can come very fast, that the use of a lock > file would cause delay and too much wear on the nand based disk (SSD). No. That's not how the lock file is used. > I see a no locking option ( MDB_NOLOCK) that would stop a lock file > being written. This option should only be used if you're implementing your own lock manager. Hint - no matter what approach you use, any other lock manager you use will be slower than LMDB's. > Again, another option would be mapping the lock file to > a memdisk to handle that? Yes. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

Fwd: Using lmdb as a pure in memory store
by Russell Haley 22 Sep '16

22 Sep '16

Hello, I wasn't fully subscribed when I sent this so I'll send it again. Any input or reference hints would be great. I love reading manuals. :) Russ ---------- Forwarded message ---------- From: Russell Haley <russ.haley(a)gmail.com> Date: Tue, Sep 20, 2016 at 4:52 PM Subject: Using lmdb as a pure in memory store To: openldap-technical(a)openldap.org Hi there, We are currently evaluating in memory key value stores for ~100,000 - 200,000 records in an embedded system. I suggested lmdb but it is being discounted for some reasons I thought I'd validate: 1) It is currently thought that a on disk file is REQUIRED for the system. Does MDB_NOSYNC turn off the disk caching? Can it be run as a pure in-memory database? Could the file not just be mapped to a memdisk? 2) Because these values can come very fast, that the use of a lock file would cause delay and too much wear on the nand based disk (SSD). I see a no locking option ( MDB_NOLOCK) that would stop a lock file being written. Again, another option would be mapping the lock file to a memdisk to handle that? Thanks! Russ

1 0

How to move from hdb to mdb
by Nikolas Stylianides 22 Sep '16

22 Sep '16

Hi there. Is there a howto move from hdb to mdb? What we need to do is to transfer our directory from hdb to the mdb. Is there a book to learn about openldap? With the new OLC way of doing things? Can i have hdb and mdb running at the same time? Currently I have done the following: 1. Load the Module back_mdb 2. Created a OlcBackend 3. Created a OlcDatabase Thank you in advance -- Δρ. Νικόλας Στυλιανίδης Ηλεκτρολόγος Μηχανικός και Μηχ. Υπολογιστών Nikolas Stylianides, Dr. Dr. Eng. in Electrical & Computer Engineering Contacts ------------- Mobile Tel.: +35796741315 Email: nstylianides(a)leafnet.com.cy, nstylianides(a)gmail.com Skype: nicostyl Affilication --------------- LEAF NET LTD: Research & Development Open University of Cyprus: Research Associate, APPLIED HEALTH INFORMATICS Master Programme Academic Board Member Tο λακωνίζειν εστί φιλοσοφείν / Μηδέν Άγαν - Χίλων ο Λακεδαιμόνιος: Brevity is the soul of wit - Shakespeare William (Hamlet)

5 7

ACL privilege for MOD_INCREMENT
by Michael Ströder 20 Sep '16

20 Sep '16

HI! Considering to use LDAP write operations with MOD_INCREMENT with pre-read-control for uidNumber/gidNumber generation I'd like to reduce write access to an Integer attribute "nextID" to MOD_INCREMENT. (Uniqueness is achieved with slapo-unique anyway but still I'd like to avoid users messing with this attribute). I suspect the ideal solution results in a feature request for a new privilege "i". ;-) access to attrs=nextID by group=... =ri Or at least avoid that someone sets the value to a lower value. Maybe this can be achieved with slapo-constraint. Any more ideas? Ciao, Michael.

1 0

Re: Does everybody end up writing their own directory management programs?
by Shawn McKinney 20 Sep '16

20 Sep '16

> On Sep 18, 2016, at 2:25 PM, John Lewis <oflameo2(a)gmail.com> wrote: > > Right now I am trying to weigh my options for maintaining my POSIX > accounts on an OpenLDAP tree. > > I learned today that ldap templates in ldapscripts really don't work, so > if I want to go on using ldapscripts, I would have to run ldapmodify > after every account is created to get the gecos configured properly and > have a kerberos principal configured. You could use an IdM product like midPoint to manage the RFC2307ish attributes in the directory. https://wiki.evolveum.com/display/midPoint/LDAP+PosixAccount+and+PosixGroup…

4 3

do_syncrep2: rid=001 (32) No such object
by Fabrizio Monti 19 Sep '16

19 Sep '16

Hi, I have configurated two servers centos 7 with openldap-2.4.40-9, provider and Customer. There's an error in the log file with the syncreply: "do_syncrep2: rid=001 (32) No such object", but I cannot understand where's the mistake; could you help me please? thanks in advance provider's log: *Sep 19 12:31:40 ldap slapd[27741]: daemon: epoll: listen=7 active_threads=0 tvp=zero* *Sep 19 12:31:40 ldap slapd[27741]: daemon: epoll: listen=8 active_threads=0 tvp=zero* *Sep 19 12:31:40 ldap slapd[27741]: daemon: epoll: listen=9 active_threads=0 tvp=zero* *Sep 19 12:31:40 ldap slapd[27741]: daemon: epoll: listen=10 active_threads=0 tvp=zero* *Sep 19 12:31:40 ldap slapd[27741]: daemon: epoll: listen=11 active_threads=0 tvp=zero* *Sep 19 12:31:40 ldap slapd[27741]: =>do_syncrepl rid=001* *Sep 19 12:31:40 ldap slapd[27741]: =>do_syncrep2 rid=001* *Sep 19 12:31:40 ldap slapd[27741]: do_syncrep2: rid=001 LDAP_RES_SEARCH_RESULT* *Sep 19 12:31:40 ldap slapd[27741]: do_syncrep2: rid=001 LDAP_RES_SEARCH_RESULT (32) No such object* *Sep 19 12:31:40 ldap slapd[27741]: do_syncrep2: rid=001 (32) No such object* *Sep 19 12:36:40 ldap slapd[27741]: daemon: epoll: listen=7 active_threads=0 tvp=zero* *Sep 19 12:36:40 ldap slapd[27741]: daemon: epoll: listen=8 active_threads=0 tvp=zero* *Sep 19 12:36:40 ldap slapd[27741]: daemon: epoll: listen=9 active_threads=0 tvp=zero* *Sep 19 12:36:40 ldap slapd[27741]: daemon: epoll: listen=10 active_threads=0 tvp=zero* *Sep 19 12:36:40 ldap slapd[27741]: daemon: epoll: listen=11 active_threads=0 tvp=zero* *Sep 19 12:36:40 ldap slapd[27741]: =>do_syncrepl rid=001* *Sep 19 12:36:40 ldap slapd[27741]: =>do_syncrep2 rid=001* *Sep 19 12:36:40 ldap slapd[27741]: do_syncrep2: rid=001 LDAP_RES_SEARCH_RESULT* *Sep 19 12:36:40 ldap slapd[27741]: do_syncrep2: rid=001 LDAP_RES_SEARCH_RESULT (32) No such object* *Sep 19 12:36:40 ldap slapd[27741]: do_syncrep2: rid=001 (32) No such object* customer's log: *Sep 19 12:41:40 ldap2 slapd[618]: daemon: activity on 1 descriptor* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: activity on:* *Sep 19 12:41:40 ldap2 slapd[618]:* *Sep 19 12:41:40 ldap2 slapd[618]: slap_listener_activate(8):* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: epoll: listen=7 active_threads=0 tvp=NULL* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: epoll: listen=8 busy* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: epoll: listen=9 active_threads=0 tvp=NULL* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: epoll: listen=10 active_threads=0 tvp=NULL* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: epoll: listen=11 active_threads=0 tvp=NULL* *Sep 19 12:41:40 ldap2 slapd[618]: >>> slap_listener(ldap:///)* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: listen=8, new connection on 13* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: added 13r (active) listener=(nil)* *Sep 19 12:41:40 ldap2 slapd[618]: conn=1097 fd=13 ACCEPT from IP=192.168.235.45:57122 <http://192.168.235.45:57122> (IP=0.0.0.0:389 <http://0.0.0.0:389>)* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: activity on 2 descriptors* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: activity on:* *Sep 19 12:41:40 ldap2 slapd[618]: 13r* *Sep 19 12:41:40 ldap2 slapd[618]:* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: read active on 13* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: epoll: listen=7 active_threads=0 tvp=NULL* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: epoll: listen=8 active_threads=0 tvp=NULL* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: epoll: listen=9 active_threads=0 tvp=NULL* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: epoll: listen=10 active_threads=0 tvp=NULL* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: epoll: listen=11 active_threads=0 tvp=NULL* *Sep 19 12:41:40 ldap2 slapd[618]: connection_get(13)* *Sep 19 12:41:40 ldap2 slapd[618]: connection_get(13): got connid=1097* *Sep 19 12:41:40 ldap2 slapd[618]: connection_read(13): checking for input on id=1097* *Sep 19 12:41:40 ldap2 slapd[618]: op tag 0x60, time 1474281700* *Sep 19 12:41:40 ldap2 slapd[618]: conn=1097 op=0 do_bind* *Sep 19 12:41:40 ldap2 slapd[618]: >>> dnPrettyNormal: <cn=manager,dc=mydomain,dc=intra>* *Sep 19 12:41:40 ldap2 slapd[618]: <<< dnPrettyNormal: <cn=manager,dc=mydomain,dc=intra>, <cn=manager,dc=mydomain,dc=intra>* *Sep 19 12:41:40 ldap2 slapd[618]: conn=1097 op=0 BIND dn="cn=manager,dc=mydomain,dc=intra" method=128* *Sep 19 12:41:40 ldap2 slapd[618]: do_bind: version=3 dn="cn=manager,dc=mydomain,dc=intra" method=128* *Sep 19 12:41:40 ldap2 slapd[618]: ==> mdb_bind: dn: cn=manager,dc=mydomain,dc=intra* *Sep 19 12:41:40 ldap2 slapd[618]: conn=1097 op=0 BIND dn="cn=manager,dc=mydomain,dc=intra" mech=SIMPLE ssf=0* *Sep 19 12:41:40 ldap2 slapd[618]: do_bind: v3 bind: "cn=manager,dc=mydomain,dc=intra" to "cn=manager,dc=mydomain,dc=intra"* *Sep 19 12:41:40 ldap2 slapd[618]: send_ldap_result: conn=1097 op=0 p=3* *Sep 19 12:41:40 ldap2 slapd[618]: send_ldap_result: err=0 matched="" text=""* *Sep 19 12:41:40 ldap2 slapd[618]: send_ldap_response: msgid=1 tag=97 err=0* *Sep 19 12:41:40 ldap2 slapd[618]: conn=1097 op=0 RESULT tag=97 err=0 text=* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: activity on 1 descriptor* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: activity on:* *Sep 19 12:41:40 ldap2 slapd[618]:* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: epoll: listen=7 active_threads=0 tvp=NULL* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: epoll: listen=8 active_threads=0 tvp=NULL* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: epoll: listen=9 active_threads=0 tvp=NULL* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: epoll: listen=10 active_threads=0 tvp=NULL* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: epoll: listen=11 active_threads=0 tvp=NULL* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: activity on 1 descriptor* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: activity on:* *Sep 19 12:41:40 ldap2 slapd[618]: 13r* *Sep 19 12:41:40 ldap2 slapd[618]:* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: read active on 13* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: epoll: listen=7 active_threads=0 tvp=NULL* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: epoll: listen=8 active_threads=0 tvp=NULL* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: epoll: listen=9 active_threads=0 tvp=NULL* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: epoll: listen=10 active_threads=0 tvp=NULL* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: epoll: listen=11 active_threads=0 tvp=NULL* *Sep 19 12:41:40 ldap2 slapd[618]: connection_get(13)* *Sep 19 12:41:40 ldap2 slapd[618]: connection_get(13): got connid=1097* *Sep 19 12:41:40 ldap2 slapd[618]: connection_read(13): checking for input on id=1097* *Sep 19 12:41:40 ldap2 slapd[618]: op tag 0x63, time 1474281700* *Sep 19 12:41:40 ldap2 slapd[618]: conn=1097 op=1 do_search* *Sep 19 12:41:40 ldap2 slapd[618]: >>> dnPrettyNormal: <>* *Sep 19 12:41:40 ldap2 slapd[618]: <<< dnPrettyNormal: <>, <>* *Sep 19 12:41:40 ldap2 slapd[618]: SRCH "" 2 0* *Sep 19 12:41:40 ldap2 slapd[618]: 0 0 0* *Sep 19 12:41:40 ldap2 slapd[618]: begin get_filter* *Sep 19 12:41:40 ldap2 slapd[618]: PRESENT* *Sep 19 12:41:40 ldap2 slapd[618]: end get_filter 0* *Sep 19 12:41:40 ldap2 slapd[618]: filter: (objectClass=*)* *Sep 19 12:41:40 ldap2 slapd[618]: => get_ctrls* *Sep 19 12:41:40 ldap2 slapd[618]: => get_ctrls: oid="1.3.6.1.4.1.4203.1.9.1.1" (noncritical)* *Sep 19 12:41:40 ldap2 slapd[618]: => get_ctrls: oid="2.16.840.1.113730.3.4.2" (critical)* *Sep 19 12:41:40 ldap2 slapd[618]: <= get_ctrls: n=2 rc=0 err=""* *Sep 19 12:41:40 ldap2 slapd[618]: attrs:* *Sep 19 12:41:40 ldap2 slapd[618]: reqDN* *Sep 19 12:41:40 ldap2 slapd[618]: reqType* *Sep 19 12:41:40 ldap2 slapd[618]: reqMod* *Sep 19 12:41:40 ldap2 slapd[618]: reqNewRDN* *Sep 19 12:41:40 ldap2 slapd[618]: reqDeleteOldRDN* *Sep 19 12:41:40 ldap2 slapd[618]: reqNewSuperior* *Sep 19 12:41:40 ldap2 slapd[618]: entryCSN* *Sep 19 12:41:40 ldap2 slapd[618]:* *Sep 19 12:41:40 ldap2 slapd[618]: conn=1097 op=1 SRCH base="" scope=2 deref=0 filter="(objectClass=*)"* *Sep 19 12:41:40 ldap2 slapd[618]: conn=1097 op=1 SRCH attr=reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN* *Sep 19 12:41:40 ldap2 slapd[618]: send_ldap_result: conn=1097 op=1 p=3* *Sep 19 12:41:40 ldap2 slapd[618]: send_ldap_result: err=10 matched="" text=""* *Sep 19 12:41:40 ldap2 slapd[618]: send_ldap_response: msgid=2 tag=101 err=32* *Sep 19 12:41:40 ldap2 slapd[618]: conn=1097 op=1 SEARCH RESULT tag=101 err=32 nentries=0 text=* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: activity on 1 descriptor* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: activity on:* *Sep 19 12:41:40 ldap2 slapd[618]:* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: epoll: listen=7 active_threads=0 tvp=NULL* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: epoll: listen=8 active_threads=0 tvp=NULL* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: epoll: listen=9 active_threads=0 tvp=NULL* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: epoll: listen=10 active_threads=0 tvp=NULL* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: epoll: listen=11 active_threads=0 tvp=NULL* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: activity on 1 descriptor* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: activity on:* *Sep 19 12:41:40 ldap2 slapd[618]: 13r* *Sep 19 12:41:40 ldap2 slapd[618]:* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: read active on 13* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: epoll: listen=7 active_threads=0 tvp=NULL* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: epoll: listen=8 active_threads=0 tvp=NULL* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: epoll: listen=9 active_threads=0 tvp=NULL* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: epoll: listen=10 active_threads=0 tvp=NULL* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: epoll: listen=11 active_threads=0 tvp=NULL* *Sep 19 12:41:40 ldap2 slapd[618]: connection_get(13)* *Sep 19 12:41:40 ldap2 slapd[618]: connection_get(13): got connid=1097* *Sep 19 12:41:40 ldap2 slapd[618]: connection_read(13): checking for input on id=1097* *Sep 19 12:41:40 ldap2 slapd[618]: op tag 0x42, time 1474281700* *Sep 19 12:41:40 ldap2 slapd[618]: ber_get_next on fd 13 failed errno=0 (Success)* *Sep 19 12:41:40 ldap2 slapd[618]: connection_read(13): input error=-2 id=1097, closing.* *Sep 19 12:41:40 ldap2 slapd[618]: connection_closing: readying conn=1097 sd=13 for close* *Sep 19 12:41:40 ldap2 slapd[618]: connection_close: deferring conn=1097 sd=13* *Sep 19 12:41:40 ldap2 slapd[618]: conn=1097 op=2 do_unbind* *Sep 19 12:41:40 ldap2 slapd[618]: conn=1097 op=2 UNBIND* *Sep 19 12:41:40 ldap2 slapd[618]: connection_resched: attempting closing conn=1097 sd=13* *Sep 19 12:41:40 ldap2 slapd[618]: connection_close: conn=1097 sd=13* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: removing 13* *Sep 19 12:41:40 ldap2 slapd[618]: conn=1097 fd=13 closed* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: activity on 1 descriptor* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: activity on:* *Sep 19 12:41:40 ldap2 slapd[618]:* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: epoll: listen=7 active_threads=0 tvp=NULL* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: epoll: listen=8 active_threads=0 tvp=NULL* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: epoll: listen=9 active_threads=0 tvp=NULL* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: epoll: listen=10 active_threads=0 tvp=NULL* *Sep 19 12:41:40 ldap2 slapd[618]: daemon: epoll: listen=11 active_threads=0 tvp=NULL* ldap's provider configuration: *dn: cn=config* *objectClass: olcGlobal* *cn: config* *olcArgsFile: /var/run/openldap/slapd.args* *olcPidFile: /var/run/openldap/slapd.pid* *olcTLSCACertificatePath: /etc/openldap/certs* *structuralObjectClass: olcGlobal* *entryUUID: ba0ed5ae-0ed2-1036-92e8-a5ac34fa70e0* *creatorsName: cn=config* *createTimestamp: 20160914142444Z* *olcTLSCACertificateFile: /etc/openldap/certs/ca-bundle.crt* *olcTLSCertificateFile: /etc/openldap/certs/server.crt* *olcTLSCertificateKeyFile: /etc/openldap/certs/server.key* *olcLogLevel: -1* *entryCSN: 20160919100502.405082Z#000000#000#000000* *modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth* *modifyTimestamp: 20160919100502Z* *dn: cn=module{0},cn=config* *objectClass: olcModuleList* *cn: module{0}* *olcModuleLoad: {0}/usr/lib64/openldap/smbk5pwd.la <http://smbk5pwd.la>* *structuralObjectClass: olcModuleList* *entryUUID: 02be502a-0eda-1036-8732-67bd148453df* *creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth* *createTimestamp: 20160914151652Z* *entryCSN: 20160914151652.906110Z#000000#000#000000* *modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth* *modifyTimestamp: 20160914151652Z* *dn: cn=module{1},cn=config* *objectClass: olcModuleList* *cn: module{1}* *olcModulePath: /usr/lib64/openldap* *olcModuleLoad: {0}back_mdb* *structuralObjectClass: olcModuleList* *entryUUID: 0500f2f2-0eda-1036-8733-67bd148453df* *creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth* *createTimestamp: 20160914151656Z* *entryCSN: 20160914151656.698287Z#000000#000#000000* *modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth* *modifyTimestamp: 20160914151656Z* *dn: cn=schema,cn=config* *objectClass: olcSchemaConfig* *cn: schema* *structuralObjectClass: olcSchemaConfig* *entryUUID: ba0ede78-0ed2-1036-92e9-a5ac34fa70e0* *creatorsName: cn=config* *createTimestamp: 20160914142444Z* *entryCSN: 20160914142444.483302Z#000000#000#000000* *modifiersName: cn=config* *modifyTimestamp: 20160914142444Z* *..... schema config ...* *dn: olcDatabase={-1}frontend,cn=config* *objectClass: olcDatabaseConfig* *objectClass: olcFrontendConfig* *olcDatabase: {-1}frontend* *structuralObjectClass: olcDatabaseConfig* *entryUUID: ba0f2752-0ed2-1036-92eb-a5ac34fa70e0* *creatorsName: cn=config* *createTimestamp: 20160914142444Z* *entryCSN: 20160914142444.485167Z#000000#000#000000* *modifiersName: cn=config* *modifyTimestamp: 20160914142444Z* *dn: olcDatabase={0}config,cn=config* *objectClass: olcDatabaseConfig* *olcDatabase: {0}config* *olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=extern* * al,cn=auth" manage by * none* *structuralObjectClass: olcDatabaseConfig* *entryUUID: ba0f2d4c-0ed2-1036-92ec-a5ac34fa70e0* *creatorsName: cn=config* *createTimestamp: 20160914142444Z* *olcRootPW:: e1NTSEF9OTlmV1dNQjNFOVA2T3JqdXhUYlpoUjB0N2FmeUc1bjU=* *entryCSN: 20160914143100.069565Z#000000#000#000000* *modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth* *modifyTimestamp: 20160914143100Z* *dn: olcDatabase={1}monitor,cn=config* *objectClass: olcDatabaseConfig* *olcDatabase: {1}monitor* *olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=extern* * al,cn=auth" read by dn.base="cn=Manager,dc=my-domain,dc=com" read by * none* *structuralObjectClass: olcDatabaseConfig* *entryUUID: ba0f33aa-0ed2-1036-92ed-a5ac34fa70e0* *creatorsName: cn=config* *createTimestamp: 20160914142444Z* *entryCSN: 20160914142444.485484Z#000000#000#000000* *modifiersName: cn=config* *modifyTimestamp: 20160914142444Z* *dn: olcDatabase={2}mdb,cn=config* *objectClass: olcDatabaseConfig* *objectClass: olcMdbConfig* *olcDatabase: {2}mdb* *olcDbDirectory: /var/lib/ldap* *olcDbIndex: objectClass eq,pres* *olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub* *olcDbIndex: uidNumber,gidNumber,loginShell eq,pres* *olcDbIndex: uid,memberUid eq,pres,sub* *olcDbIndex: nisMapName,nisMapEntry eq,pres,sub* *structuralObjectClass: olcMdbConfig* *entryUUID: ba0f3e18-0ed2-1036-92ee-a5ac34fa70e0* *creatorsName: cn=config* *createTimestamp: 20160914142444Z* *olcRootDN: cn=Manager,dc=mydomain,dc=intra* *olcSuffix: dc=mydomain,dc=intra* *olcRootPW:: e1NTSEF9RFR4TXZOdlFPdURsejg0akd5NkIvWWduMlBDbEIyeng=* *olcSyncrepl: {0}rid=001 provider=ldap://192.168.235.70/ <http://192.168.235.70/> bindmethod=simple bi* * nddn="cn=Manager,dc=mydomain,dc=intra" credentials=viola99 searchbase="dc* * =mydomain,dc=intra" scope=sub schemachecking=off type=refreshOnly retry="* * 30 5 300 3" interval=00:00:05:00 syncdata=accesslog filter="(objectClass=*)* * " searchbase="dc=mydomain,dc=intra"* *entryCSN: 20160919095751.593118Z#000000#000#000000* *modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth* *modifyTimestamp: 20160919095751Z* *dn: olcOverlay={0}smbk5pwd,olcDatabase={2}mdb,cn=config* *objectClass: olcOverlayConfig* *objectClass: olcSmbK5PwdConfig* *olcOverlay: {0}smbk5pwd* *olcSmbK5PwdEnable: samba* *structuralObjectClass: olcSmbK5PwdConfig* *entryUUID: 079a3618-0eda-1036-8734-67bd148453df* *creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth* *createTimestamp: 20160914151701Z* *entryCSN: 20160914151701.058149Z#000000#000#000000* *modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth* *modifyTimestamp: 20160914151701Z* ldap's customer config: *dn: cn=config* *objectClass: olcGlobal* *cn: config* *olcArgsFile: /var/run/openldap/slapd.args* *olcPidFile: /var/run/openldap/slapd.pid* *olcTLSCACertificatePath: /etc/openldap/certs* *structuralObjectClass: olcGlobal* *entryUUID: b9f29fc8-0df2-1036-8852-c195847901f0* *creatorsName: cn=config* *createTimestamp: 20160913114117Z* *olcTLSCACertificateFile: /etc/openldap/certs/ca-bundle.crt* *olcTLSCertificateFile: /etc/openldap/certs/server.crt* *olcTLSCertificateKeyFile: /etc/openldap/certs/server.key* *olcLogLevel: -1* *entryCSN: 20160919082239.212771Z#000000#000#000000* *modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth* *modifyTimestamp: 20160919082239Z* *dn: cn=module{0},cn=config* *objectClass: olcModuleList* *cn: module{0}* *olcModuleLoad: {0}/usr/lib64/openldap/smbk5pwd.la <http://smbk5pwd.la>* *structuralObjectClass: olcModuleList* *entryUUID: 473085bc-0df3-1036-94a0-ad4331978f4a* *creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth* *createTimestamp: 20160913114513Z* *entryCSN: 20160913114513.995165Z#000000#000#000000* *modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth* *modifyTimestamp: 20160913114513Z* *dn: cn=module{1},cn=config* *objectClass: olcModuleList* *cn: module{1}* *olcModulePath: /usr/lib64/openldap* *olcModuleLoad: {0}back_mdb* *structuralObjectClass: olcModuleList* *entryUUID: 49b832e4-0df3-1036-94a1-ad4331978f4a* *creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth* *createTimestamp: 20160913114518Z* *entryCSN: 20160913114518.239776Z#000000#000#000000* *modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth* *modifyTimestamp: 20160913114518Z* *dn: cn=module{2},cn=config* *objectClass: olcModuleList* *cn: module{2}* *olcModulePath: /usr/lib64/openldap* *olcModuleLoad: {0}syncprov.la <http://syncprov.la>* *structuralObjectClass: olcModuleList* *entryUUID: 2788b796-0ed6-1036-9cc5-a32737359a4d* *creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth* *createTimestamp: 20160914144916Z* *entryCSN: 20160914144916.643685Z#000000#000#000000* *modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth* *modifyTimestamp: 20160914144916Z* *dn: cn=schema,cn=config* *objectClass: olcSchemaConfig* *cn: schema* *structuralObjectClass: olcSchemaConfig* *entryUUID: b9f2b1a2-0df2-1036-8853-c195847901f0* *creatorsName: cn=config* *createTimestamp: 20160913114117Z* *entryCSN: 20160913114117.031222Z#000000#000#000000* *modifiersName: cn=config* *modifyTimestamp: 20160913114117Z* *.....schema config.....* *dn: olcDatabase={-1}frontend,cn=config* *objectClass: olcDatabaseConfig* *objectClass: olcFrontendConfig* *olcDatabase: {-1}frontend* *structuralObjectClass: olcDatabaseConfig* *entryUUID: b9f319d0-0df2-1036-8855-c195847901f0* *creatorsName: cn=config* *createTimestamp: 20160913114117Z* *entryCSN: 20160913114117.033887Z#000000#000#000000* *modifiersName: cn=config* *modifyTimestamp: 20160913114117Z* *dn: olcDatabase={0}config,cn=config* *objectClass: olcDatabaseConfig* *olcDatabase: {0}config* *olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=extern* * al,cn=auth" manage by * none* *structuralObjectClass: olcDatabaseConfig* *entryUUID: b9f32556-0df2-1036-8856-c195847901f0* *creatorsName: cn=config* *createTimestamp: 20160913114117Z* *olcRootPW:: e1NTSEF9OTlmV1dNQjNFOVA2T3JqdXhUYlpoUjB0N2FmeUc1bjU=* *entryCSN: 20160913114223.082994Z#000000#000#000000* *modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth* *modifyTimestamp: 20160913114223Z* *dn: olcDatabase={1}monitor,cn=config* *objectClass: olcDatabaseConfig* *olcDatabase: {1}monitor* *olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=extern* * al,cn=auth" read by dn.base="cn=Manager,dc=my-domain,dc=com" read by * none* *structuralObjectClass: olcDatabaseConfig* *entryUUID: b9f3ec2a-0df2-1036-8857-c195847901f0* *creatorsName: cn=config* *createTimestamp: 20160913114117Z* *entryCSN: 20160913114117.039272Z#000000#000#000000* *modifiersName: cn=config* *modifyTimestamp: 20160913114117Z* *dn: olcDatabase={2}mdb,cn=config* *objectClass: olcDatabaseConfig* *objectClass: olcMdbConfig* *olcDatabase: {2}mdb* *olcDbDirectory: /var/lib/ldap* *olcSuffix: dc=mydomain,dc=intra* *olcDbIndex: objectClass eq,pres* *olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub* *olcDbIndex: uidNumber,gidNumber,loginShell eq,pres* *olcDbIndex: uid,memberUid eq,pres,sub* *olcDbIndex: nisMapName,nisMapEntry eq,pres,sub* *structuralObjectClass: olcMdbConfig* *entryUUID: b9f53e9a-0df2-1036-8858-c195847901f0* *creatorsName: cn=config* *createTimestamp: 20160913114117Z* *olcRootDN: cn=Manager,dc=mydomain,dc=intra* *olcRootPW:: e1NTSEF9aHRPQUVvdVJMeDUxeGloQTdSdlRGc2hTRmhxcG1HQXc=* *entryCSN: 20160913141458.892233Z#000000#000#000000* *modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth* *modifyTimestamp: 20160913141458Z* *dn: olcOverlay={0}smbk5pwd,olcDatabase={2}mdb,cn=config* *objectClass: olcOverlayConfig* *objectClass: olcSmbK5PwdConfig* *olcOverlay: {0}smbk5pwd* *olcSmbK5PwdEnable: samba* *structuralObjectClass: olcSmbK5PwdConfig* *entryUUID: d61bb9f4-0e0c-1036-9b7b-d9c0303e2769* *creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth* *createTimestamp: 20160913144811Z* *entryCSN: 20160913144811.191113Z#000000#000#000000* *modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth* *modifyTimestamp: 20160913144811Z* *dn: olcOverlay={1}syncprov,olcDatabase={2}mdb,cn=config* *objectClass: olcOverlayConfig* *objectClass: olcSyncProvConfig* *olcOverlay: {1}syncprov* *olcSpCheckpoint: 100 10* *olcSpSessionlog: 1000* *structuralObjectClass: olcSyncProvConfig* *entryUUID: 4af82a36-0ed6-1036-9cc6-a32737359a4d* *creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth* *createTimestamp: 20160914145016Z* *entryCSN: 20160914145016.094325Z#000000#000#000000* *modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth* *modifyTimestamp: 20160914145016Z*

2 1

Enable memberOf
by Elias Pereira 19 Sep '16

19 Sep '16

Hello guys, In our infra we using openldap in old style slapd.conf config to centralize users, groups, etc. I like to know how I enable memberOf in openlap old style config? -- Elias Pereira

3 6

Does everybody end up writing their own directory management programs?
by John Lewis 19 Sep '16

19 Sep '16

Right now I am trying to weigh my options for maintaining my POSIX accounts on an OpenLDAP tree. I learned today that ldap templates in ldapscripts really don't work, so if I want to go on using ldapscripts, I would have to run ldapmodify after every account is created to get the gecos configured properly and have a kerberos principal configured. I could: a. run ldapmodify after every account is created to get the gecos configured properly and have a kerberos principle configured b. reverse engineer ldapscripts and patch it and then maintain a branch c. manage users with ldapmodify and have to deal with not having default options for either the account creation or the ldapmodify switch statements d. write and maintain another tool that creates and executes the ldif but has options that would be the same for my directory filled in Every single one of these options seem to be pretty time consuming or error prone. I don't know which way I should go with this one.

1 1

SASL pass-through fails
by Joshua Schaeffer 18 Sep '16

18 Sep '16

Hey all, I've been using OpenLDAP and Kerberos for central authentication for a while now, but I have a couple programs that can't use GSSAPI directly and I want to setup SASL pass-through authentication to allow those services to use my Kerberos passwords, but I'm having trouble getting saslauthd to work correctly. I can authentication as myself using GSSAPI without any issue: jschaeffer@zipmaster07 ~/Downloads $ ldapwhoami SASL/GSSAPI authentication started SASL username: jschaeffer(a)HARMONYWAVE.COM SASL SSF: 56 SASL data security layer installed. dn:uid=jschaeffer,ou=end users,ou=people,dc=harmonywave,dc=com But whenever I run the testsaslauthd command I can't get a successful authentication: root@baneling:~# testsaslauthd -u jschaeffer(a)HARMONYWAVE.COM -p <password> 0: NO "authentication failed" Here are my SASL settings: root@baneling:~# cat /etc/default/saslauthd | grep -v '^$\|^\s*\#' START=yes DESC="SASL Authentication Daemon" NAME="saslauthd" MECHANISMS="kerberos5" MECH_OPTIONS="" THREADS=5 OPTIONS="-c -m /var/run/saslauthd" root@baneling:~# cat /etc/ldap/sasl2/slapd.conf pwcheck_method: saslauthd saslauthd_path: /var/run/saslauthd/mux I can see my saslauthd socket listening and what I find really odd is that I can see a successful authentication attempt from Kerberos's logs: root@baneling:~# netstat -a I | grep sasl unix 2 [ ACC ] STREAM LISTENING 25552431 /var/run/saslauthd/mux I get this immediately after issuing the testsaslauthd command: Sep 17 13:09:13 immortal krb5kdc[1210](info): AS_REQ (6 etypes {18 17 16 23 25 26}) 10.1.30.18: NEEDED_PREAUTH: jschaeffer(a)HARMONYWAVE.COM for krbtgt/HARMONYWAVE.COM(a)HARMONYWAVE.COM, Additional pre-authentication required Sep 17 13:09:13 immortal krb5kdc[1210](info): AS_REQ (6 etypes {18 17 16 23 25 26}) 10.1.30.18: ISSUE: authtime 1474139353, etypes {rep=18 tkt=18 ses=18}, jschaeffer(a)HARMONYWAVE.COM for krbtgt/HARMONYWAVE.COM(a)HARMONYWAVE.COM You can also see it in the slapd logs: Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=197 SRCH base="dc=harmonywave,dc=com" scope=2 deref=0 filter="(&(|(objectClass=krbPrincipalAux)(objectClass=krbPrincipal))(krbPrincipalName=jschaeffer(a)HARMONYWAVE.COM))" Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=197 SRCH attr=krbprincipalname krbcanonicalname objectclass krbprincipalkey krbmaxrenewableage krbmaxticketlife krbticketflags krbprincipalexpiration krbticketpolicyreference krbUpEnabled krbpwdpolicyreference krbpasswordexpiration krbLastFailedAuth krbLoginFailedCount krbLastSuccessfulAuth krbLastPwdChange krbLastAdminUnlock krbExtraData krbObjectReferences krbAllowedToDelegateTo Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=197 SEARCH RESULT tag=101 err=0 nentries=1 text= Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=198 SRCH base="dc=harmonywave,dc=com" scope=2 deref=0 filter="(&(|(objectClass=krbPrincipalAux)(objectClass=krbPrincipal))(krbPrincipalName=krbtgt/HARMONYWAVE.COM(a)HARMONYWAVE.COM))" Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=198 SRCH attr=krbprincipalname krbcanonicalname objectclass krbprincipalkey krbmaxrenewableage krbmaxticketlife krbticketflags krbprincipalexpiration krbticketpolicyreference krbUpEnabled krbpwdpolicyreference krbpasswordexpiration krbLastFailedAuth krbLoginFailedCount krbLastSuccessfulAuth krbLastPwdChange krbLastAdminUnlock krbExtraData krbObjectReferences krbAllowedToDelegateTo Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=198 SEARCH RESULT tag=101 err=0 nentries=1 text= Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=199 SRCH base="cn=default,cn=HARMONYWAVE.COM,cn=krbContainer,dc=harmonywave,dc=com" scope=0 deref=0 filter="(objectClass=krbPwdPolicy)" Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=199 SRCH attr=cn krbmaxpwdlife krbminpwdlife krbpwdmindiffchars krbpwdminlength krbpwdhistorylength krbpwdmaxfailure krbpwdfailurecountinterval krbpwdlockoutduration krbpwdattributes krbpwdmaxlife krbpwdmaxrenewablelife krbpwdallowedkeysalts Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=199 SEARCH RESULT tag=101 err=0 nentries=1 text= Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=200 SRCH base="dc=harmonywave,dc=com" scope=2 deref=0 filter="(&(|(objectClass=krbPrincipalAux)(objectClass=krbPrincipal))(krbPrincipalName=jschaeffer(a)HARMONYWAVE.COM))" Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=200 SRCH attr=krbprincipalname krbcanonicalname objectclass krbprincipalkey krbmaxrenewableage krbmaxticketlife krbticketflags krbprincipalexpiration krbticketpolicyreference krbUpEnabled krbpwdpolicyreference krbpasswordexpiration krbLastFailedAuth krbLoginFailedCount krbLastSuccessfulAuth krbLastPwdChange krbLastAdminUnlock krbExtraData krbObjectReferences krbAllowedToDelegateTo Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=200 SEARCH RESULT tag=101 err=0 nentries=1 text= Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=201 SRCH base="dc=harmonywave,dc=com" scope=2 deref=0 filter="(&(|(objectClass=krbPrincipalAux)(objectClass=krbPrincipal))(krbPrincipalName=krbtgt/HARMONYWAVE.COM(a)HARMONYWAVE.COM))" Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=201 SRCH attr=krbprincipalname krbcanonicalname objectclass krbprincipalkey krbmaxrenewableage krbmaxticketlife krbticketflags krbprincipalexpiration krbticketpolicyreference krbUpEnabled krbpwdpolicyreference krbpasswordexpiration krbLastFailedAuth krbLoginFailedCount krbLastSuccessfulAuth krbLastPwdChange krbLastAdminUnlock krbExtraData krbObjectReferences krbAllowedToDelegateTo Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=201 SEARCH RESULT tag=101 err=0 nentries=1 text= Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=202 SRCH base="cn=default,cn=HARMONYWAVE.COM,cn=krbContainer,dc=harmonywave,dc=com" scope=0 deref=0 filter="(objectClass=krbPwdPolicy)" Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=202 SRCH attr=cn krbmaxpwdlife krbminpwdlife krbpwdmindiffchars krbpwdminlength krbpwdhistorylength krbpwdmaxfailure krbpwdfailurecountinterval krbpwdlockoutduration krbpwdattributes krbpwdmaxlife krbpwdmaxrenewablelife krbpwdallowedkeysalts Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=202 SEARCH RESULT tag=101 err=0 nentries=1 text= Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=203 SRCH base="cn=default,cn=HARMONYWAVE.COM,cn=krbContainer,dc=harmonywave,dc=com" scope=0 deref=0 filter="(objectClass=krbPwdPolicy)" Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=203 SRCH attr=cn krbmaxpwdlife krbminpwdlife krbpwdmindiffchars krbpwdminlength krbpwdhistorylength krbpwdmaxfailure krbpwdfailurecountinterval krbpwdlockoutduration krbpwdattributes krbpwdmaxlife krbpwdmaxrenewablelife krbpwdallowedkeysalts Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=203 SEARCH RESULT tag=101 err=0 nentries=1 text= Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=204 SRCH base="krbPrincipalName=jschaeffer(a)HARMONYWAVE.COM,cn=HARMONYWAVE.COM,cn=krbContainer,dc=harmonywave,dc=com" scope=0 deref=0 filter="(objectClass=*)" Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=204 SRCH attr=objectclass Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=204 SEARCH RESULT tag=101 err=0 nentries=1 text= Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=205 MOD dn="krbPrincipalName=jschaeffer(a)HARMONYWAVE.COM,cn=HARMONYWAVE.COM,cn=krbContainer,dc=harmonywave,dc=com" Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=205 MOD attr=krbLastSuccessfulAuth krbExtraData krbLastAdminUnlock Sep 17 13:10:27 baneling slapd[2166]: conn=1002 op=205 RESULT tag=103 err=0 text= When I debug the saslauthd daemon all i get is this: root@baneling:~# saslauthd -a kerberos5 -m /var/run/saslauthd -n 5 -d saslauthd[1121] :main : num_procs : 5 saslauthd[1121] :main : mech_option: NULL saslauthd[1121] :main : run_path : /var/run/saslauthd saslauthd[1121] :main : auth_mech : kerberos5 saslauthd[1121] :ipc_init : using accept lock file: /var/run/saslauthd/mux.accept saslauthd[1121] :detach_tty : master pid is: 0 saslauthd[1121] :ipc_init : listening on socket: /var/run/saslauthd/mux saslauthd[1121] :main : using process model saslauthd[1121] :have_baby : forked child: 1122 saslauthd[1122] :get_accept_lock : acquired accept lock saslauthd[1121] :have_baby : forked child: 1123 saslauthd[1121] :have_baby : forked child: 1124 saslauthd[1121] :have_baby : forked child: 1125 saslauthd[1122] :rel_accept_lock : released accept lock saslauthd[1124] :get_accept_lock : acquired accept lock saslauthd[1122] :do_auth : auth failure: [user=jschaeffer(a)HARMONYWAVE.COM] [service=imap] [realm=] [mech=kerberos5] [reason=saslauthd internal error] Kinda at a loss at what else I should look at. Any tips would be appreciated. Thanks, Joshua Schaeffer

3 3

Creating suffix aliases with OpenLDAP
by Ralf Mattes 18 Sep '16

18 Sep '16

Dear collectes list wisdom, I'm running a ldap server whose main database holds a X500 style suffix (i.e. o=...,l=...,c=...). The organisations name does contain a non-ascii character 'ü'. So far this never has been a problem but now one of our partner institutions needs to access the server with tomcat/ndi/proprietary code and that fails misserably - no wonder: the send the bind DN with the wrong encoding. While I'm sure there is a solution on the Java/Tomcat side I'd like to provide the possibility to access the data under a different DN (with 'ü' replaced by 'ue'). My first attempt: I created a second database with the alternative suffix and placed an alias object as the topmost entry. That object points to the toplevel organisation object of the real database. But while I can see that object none of the child entries are found. s there any to configure such an "alias suffix"? TIA Ralf Mattes

7 19

Re: SASL pass-through fails
by Howard Chu 17 Sep '16

17 Sep '16

Joshua Schaeffer wrote: > Hey all, > > I've been using OpenLDAP and Kerberos for central authentication for a while > now, but I have a couple programs that can't use GSSAPI directly and I want to > setup SASL pass-through authentication to allow those services to use my > Kerberos passwords, but I'm having trouble getting saslauthd to work correctly. > > I can authentication as myself using GSSAPI without any issue: > > jschaeffer@zipmaster07 ~/Downloads $ ldapwhoami > SASL/GSSAPI authentication started > SASL username: jschaeffer(a)HARMONYWAVE.COM > SASL SSF: 56 > SASL data security layer installed. > dn:uid=jschaeffer,ou=end users,ou=people,dc=harmonywave,dc=com > > But whenever I run the testsaslauthd command I can't get a successful > authentication: > > root@baneling:~# testsaslauthd -u jschaeffer(a)HARMONYWAVE.COM -p <password> > 0: NO "authentication failed" > When I debug the saslauthd daemon all i get is this: > > root@baneling:~# saslauthd -a kerberos5 -m /var/run/saslauthd -n 5 -d > saslauthd[1121] :main : num_procs : 5 > saslauthd[1121] :main : mech_option: NULL > saslauthd[1121] :main : run_path : /var/run/saslauthd > saslauthd[1121] :main : auth_mech : kerberos5 > saslauthd[1121] :ipc_init : using accept lock file: > /var/run/saslauthd/mux.accept > saslauthd[1121] :detach_tty : master pid is: 0 > saslauthd[1121] :ipc_init : listening on socket: /var/run/saslauthd/mux > saslauthd[1121] :main : using process model > saslauthd[1121] :have_baby : forked child: 1122 > saslauthd[1122] :get_accept_lock : acquired accept lock > saslauthd[1121] :have_baby : forked child: 1123 > saslauthd[1121] :have_baby : forked child: 1124 > saslauthd[1121] :have_baby : forked child: 1125 > saslauthd[1122] :rel_accept_lock : released accept lock > saslauthd[1124] :get_accept_lock : acquired accept lock > saslauthd[1122] :do_auth : auth failure: > [user=jschaeffer(a)HARMONYWAVE.COM] [service=imap] [realm=] [mech=kerberos5] > [reason=saslauthd internal error] > > Kinda at a loss at what else I should look at. Any tips would be appreciated. Your testsaslauthd is trying to use the imap service. If you don't have an imap service in your KDC, then of course it will fail. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 2

Using LMDB safely with fork() and exec()
by Lorenz Bauer 17 Sep '16

17 Sep '16

Hello List, The LMDB documentation says the following in its section on caveats: > * Use an MDB_env* in the process which opened it, without fork()ing. > * Do not have open an LMDB database twice in the same process at the same time. Not even from a plain open() call - close()ing it breaks flock() advisory locking. This seems contrary to an earlier thread on this list (1), which suggests that fork/execing a process using LMDB is OK so long as the MDB_env is not used in the forked process. Looking at the flock man pages on FreeBSD and Linux tells me that this indeed should be ok: an flock is released only when all fds pointing to the open file table entry are closed (ignoring explicit unlock). Exec with FD_CLOEXEC set should therefore be OK. Is my interpretation correct? I want to use this to implement graceful restarts in a daemon which uses LMDB: * mdb_env_open() in old process * fork() -> exec() the daemon itself * mdb_env_open() in new process * mdb_env_close() in old process If this works, I'd like to contribute the changes necessary to not leak fds on exec, which are mentioned in the other thread. * Are there contribution guidelines somewhere? How do I submit a patch? * Seems like there is currently no call to SetHandleInformation with HANDLE_FLAG_INHERIT=0 for Winows, should that be added? Best, Lorenz 1: http://www.openldap.org/lists/openldap-technical/201403/msg00149.html

2 9

Documentation Feedback
by Tom Jay 16 Sep '16

16 Sep '16

Hello, I would like to voice my frustration with the quality of the openLDAP documentation. I am compiling openLDAP from source on Debian 7, and have spent about 2-3 continuous days getting to the point where I can add an LDAP user with a UID. I have been close to giving up with the software, but need it for the LDAP functionality, and as very few viable alternatives exist, have been forced to continue with the installation. I have however almost lost confidence in the product, and am concerned that if there are any problems with it in the future, or I want to enable another feature, I will be almost helpless in getting it to work. The main problem is the Quick-Start Guide. This is anything but quick, and forces the user to consult the less-than-succinct Admin guide. The two together are inconsistent, difficult to follow and do a poor job of explaining what each feature does. The accessibility of information is less than optimal, which means that the user has to look elsewhere, consuming even more time. Unfortunately, there is not much relevant information on the Internet, forcing the user to get stuck in an almost endless loop of checking documentation, testing, reading manuals, and searching on the Internet, in order to get some kind of idea how the software works and what needs to be done to get it working. I would offer to contribute to the documentation, but due to its lack of usefulness, do not have an understanding of the basic concepts myself. The best I would be able to do is describe my experience and provide the steps that I followed to get a basic installation working. Hopefully someone can volunteer the time to test the documentation, in the same way a new user would! Tom

8 9

Service slapd fails to start: str2entry: slap_str2undef_ad(-): empty AttributeDescription
by c.monty＠web.de 16 Sep '16

16 Sep '16

Hi, I have installed OpenLdap server. However, starting slapd fails with this error message: Sep 11 11:00:38 vm108-ldap slapd[13641]: UNKNOWN attributeDescription "CHANGETYPE" inserted. Sep 11 11:00:38 vm108-ldap slapd[13641]: UNKNOWN attributeDescription "ADD" inserted. Sep 11 11:00:38 vm108-ldap slapd[13641]: <= str2entry: slap_str2undef_ad(-): empty AttributeDescription Sep 11 11:00:38 vm108-ldap slapd[13641]: slapd stopped. Sep 11 11:00:38 vm108-ldap slapd[13641]: connections_destroy: nothing to destroy. I have started slapd creating a debug file with following command: slapd -d -1 1>/tmp/slapd-debug.log 2>&1 The debug file is attached to this email. How can I fix this issue? THX

2 1

Re: Creating suffix aliases with OpenLDAP
by Howard Chu 15 Sep '16

15 Sep '16

Ralf Mattes wrote: > First, juat to be clear: thank you for your valuable help and please don't take my comments personally. > > Am Donnerstag, 15. September 2016 09:46 CEST, Dieter Klünter <dieter(a)dkluenter.de> schrieb: > >>> >>> I _knew_ I read about that at some time. This (slapd-relay) looks >>> exactly like what I need. Unfortunately this means I need to to dive >>> down into the labyrinth of (not existing) dosumentation. >> >> Just read manual pages slapd-relay(5) and slapo-rwm(5) that is all the >> documentation you should need. > > That's how it should be, but in reality: > > - non of the documentation even mentions the "new" live configuration. > Ironically, every time someone postsher/his old-style slapd configuration > on this very list she/he's told "use the online configuration". > > Oh, and changing from the old style configuration to the new one is _not_ > just an "add 'olc' in front of the parameters". For example I can't find > the rwm-suffixmassage parameter in the olc-Attributes. Online configuration is self-documenting. You are expected to read the objectclass definition from the config schema. > > - The documentation fails to mention some rather important prerequisits: > the need to load 'back_relay', the need to load 'rwm'. Module loading is not specific to back-relay, rwm, or any other backend or overlay, so there is no reason to mention it in their specific documentation. Whether or not your build supports modules is a compile-time decision, made by whoever built your binaries. Module loading is documented in the general slapd config documentation, since it applies to anything, not just specific backends or overlays. > > - The documentation really should mention that a (miss-)configured database > can't be removed from the server. Better get it right the first time ... :-) Never test new configs on a production server. Always use a throwaway test server. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

How to configure Oracle database user authentication using openldap?
by Reddy, Sudheer (CORP) 15 Sep '16

15 Sep '16

Hi: Currently we use oracle OID/LDAP to setup Oracle Database Enterprise User Security. Our management decided to retire oracle OID/LDAP, and enable database authentication using openldap on SUSE linux 11. I am new to LDAP and open LDAP. I greatly appreciate if you can help me understand the process to get this configured. Thanks, Sudheer Reddy ---------------------------------------------------------------------- This message and any attachments are intended only for the use of the addressee and may contain information that is privileged and confidential. If the reader of the message is not the intended recipient or an authorized representative of the intended recipient, you are hereby notified that any dissemination of this communication is strictly prohibited. If you have received this communication in error, notify the sender immediately by return email and delete the message and any attachments from your system.

1 0

Re: Ldap Replication getting delayed for 20 seconds.
by Prashanth P.Nair 15 Sep '16

15 Sep '16

Thank you. 3.Any other parameter needs to be added to fasten this replication? This settings are in place already .But still delay happening. backend hdb database hdb Any other parameter needs to be modified for fastening the replication ? On Tue, Sep 13, 2016 at 3:19 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Monday, September 12, 2016 3:50 PM +0200 "Prashanth P.Nair" < > prashanthppp(a)gmail.com> wrote: > > When i create new record ,its taking 18-20 second to replicate on other >> node. So the application which is reading the records from the second >> node is unable to find those records. >> >> >> 1.Is this normal behavior? >> > > Yes. > > 2.Is there any way to findout how much time took a record to be >> replicated? >> > > Read the information on "loglevel" in the slapd.conf(5) man page. > > 3.Any other paramter needs to be added to fasten this replication? >> >> > backend hdb >> database hdb >> > > Replication is particularly slowed if using back-hdb vs back-mdb. See < > https://mishikal.wordpress.com/2013/05/16/openldap-a-compar > ison-of-back-mdb-and-back-hdb-performance/> and < > https://wiki.zimbra.com/wiki/OpenLDAP_MDB_vs_HDB_performance>. > > --Quanah > > > -- > > Quanah Gibson-Mount >

2 1

How to block bind requests on openLDAP proxy, after number of failed authentication requests?
by Pocoto 14 Sep '16

14 Sep '16

Hi everyone, i am looking for a way an openLDAP proxy can temporarily block bind attempts (by bind-dn), after a number of consecutive failed authentication requests. The solution should work independent from the remote server configuration and with the client request and remote server response information on the proxy only. Is there a working solution or what could be a possible way to accomplish the needs - maybe develop an custom overlay? Thanx in advance, Rüdiger

1 0

enforce TLS 1.2 in OpenLDAP server side
by Steve Zeng 13 Sep '16

13 Sep '16

Hi, all What is the best settings to enforce TLS 1.2 in OpenLDAP server side (openldap-2.4.44-1.el6)? I make the change below: From: olcTLSProtocolMin: 0.0 To: olcTLSProtocolMin: 3.3 However, TLS1.0 still shows up in a lot of tcpdump packets: Secure Sockets Layer TLSv1 Record Layer: Handshake Protocol: Client Hello Content Type: Handshake (22) Version: TLS 1.0 (0x0301) Length: 70 Handshake Protocol: Client Hello Handshake Type: Client Hello (1) Length: 66 Version: TLS 1.0 (0x0301) Random Session ID Length: 0 Cipher Suites Length: 20 Cipher Suites (10 suites) Compression Methods Length: 1 Compression Methods (1 method) Extensions Length: 5 Extension: renegotiation_info Secure Sockets Layer TLSv1 Record Layer: Handshake Protocol: Multiple Handshake Messages Content Type: Handshake (22) Version: TLS 1.0 (0x0301) Length: 1704 Handshake Protocol: Server Hello Handshake Type: Server Hello (2) Length: 77 Version: TLS 1.0 (0x0301) Random Session ID Length: 32 Session ID: 39c37acec27b5f497c3bf4a4c694c4a9cc03ed6371e0fee0... Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f) Compression Method: null (0) Extensions Length: 5 Extension: renegotiation_info Handshake Protocol: Certificate Handshake Type: Certificate (11) Length: 1499 Certificates Length: 1496 Certificates (1496 bytes) Handshake Protocol: Certificate Request Handshake Type: Certificate Request (13) Length: 112 Certificate types count: 3 Certificate types (3 types) Distinguished Names Length: 106 Distinguished Names (106 bytes) Handshake Protocol: Server Hello Done Handshake Type: Server Hello Done (14) Length: 0 Thanks, Steve

5 8

Ldap Replication getting delayed for 20 seconds.
by Prashanth P.Nair 13 Sep '16

13 Sep '16

Hello All I am facing a performance issue on my LDAP nodes. I have two LDAP nodes ,which is syncrepl enabled. When i create new record ,its taking 18-20 second to replicate on other node. So the application which is reading the records from the second node is unable to find those records. 1.Is this normal behavior? 2.Is there any way to findout how much time took a record to be replicated? 3.Any other paramter needs to be added to fasten this replication? Below is my configuration details. ------------------------------------------------------------------------- # This is the main slapd configuration file. See slapd.conf(5) for more # info on the configuration options. ####################################################################### # Global Directives: # Features to permit #allow bind_v2 TLSCACertificateFile /etc/ssl/ldap.pem TLSCertificateKeyFile /etc/ssl/ldap.pem TLSCertificateFile /etc/ssl/ldap.pem include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/sncds.schema pidfile /var/run/slapd/slapd.pid Server 002 argsfile /var/run/slapd/slapd.args loglevel sync stats modulepath /usr/lib/ldap moduleload back_hdb moduleload syncprov SizeLimit 500 tool-threads 8 threads 16 backend hdb database hdb monitoring on cachesize 50000 idlcachesize 50000 suffix "dc=xx,dc=xxx,dc=xx" rootdn "cn=xx,dc=xx,dc=xx,dc=xx" rootpw xx directory "/var/lib/ldap/account" dbconfig set_cachesize 0 167772160 0 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 index objectClass, snAccount, snEnabled, entryCSN, entryUUID eq index cn eq,pres,subany lastmod on checkpoint 5120 30 access to attrs=userPassword,shadowLastChange by dn="cn=xx,ou=xx,dc=xx,dc=xx" write by anonymous auth by self write by * none access to dn.base="" by * read access to * by dn="cn=xx,ou=xx,dc=xx,dc=xx" write by self read by * none limits dn.exact="cn=xx,ou=xx,dc=xx,dc=xx" size=unlimited syncrepl rid=001 provider=ldap://IP bindmethod=simple binddn="cn=xx,ou=xx,dc=xx,dc=xx" credentials=xx searchbase="dc=xx,dc=xx,dc=xx" schemachecking=on type=refreshAndPersist retry="10 +" mirrormode on overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 10000

2 1

LMDB: Ignore SIGPIPE in mdb_env_copythr
by Lorenz Bauer 07 Sep '16

07 Sep '16

Hello Hallvard, List, I'd like to propose explicitly ignoring SIGPIPE in the copy thread via pthread_sigmask, and returning EPIPE to the caller instead. This is a change that makes little sense in the C world, since the caller can simply adjust the sigmask before calling the function (which is indeed what the utilities do). However, this amount of control is not always given, e.g. when using LMDB from Go (which is what I am doing). Due to the way the Go runtime works, using mdb_env_copyfd2 with CP_COMPACT on a pipe or a network connection will abort the whole process with SIGPIPE if the reading end of the fd is closed prematurely. The details why this happens are in [1]. Go has some additional trickery when dealing with stdin and stdout, so ignoring SIGPIPE for the whole process is undesirable (details in [2]). I understand that you might be reluctant to change the behaviour due to the constraints of a different runtime. However, I think that even in the C world it is surprising that calling a library function can abort your process. What are your thoughts regarding this? I think the code changes would be small, and the API would not change for consumers of the library. 1: https://golang.org/pkg/os/signal/#hdr-Go_programs_that_use_cgo_or_SWIG 2: https://golang.org/pkg/os/signal/#hdr-SIGPIPE Best, Lorenz

1 0

UNKNOWN attributeDescription "ATTRIBUTE1" inserted
by PenguinWhispererThe 07 Sep '16

07 Sep '16

Hi all, I've been trying to update a schema with new olcAttributeTypes and modified an existing objectClass (X) so these attributesTypes may be used with it. However after adding these attributes to objectClass X I did a "rollback" (replacing the current olcObjectClasses (replace: olcObjectClasses) with the old definition and the same for the olcAttributes (replace: olcAttributeTypes). I think somewhere along the way something wasn't cleaned up properly. Now when I start slapd service I get: slapd[21335]: UNKNOWN attributeDescription "ATTRIBUTE1 " inserted. slapd[21335]: UNKNOWN attributeDescription "ATTRIBUTE2" inserted. slapd[21335]: [66B blob data] With slapschema: UNKNOWN attributeDescription "ATTRIBUTE1 " inserted. UNKNOWN attributeDescription "ATTRIBUTE2" inserted. UNKNOWN attributeDescription "ATTRIBUTE3 With slapcat I can't find anything that's matching these names. When I grep in the mdb file grep says the binary file is matching. However when I ldapsearch for the attribute I can't find it. Neither with slapcat. Note that I replaced the actual attribute names in the posted output. So I think I might have some data in that mdb that's not linked to anything anymore. So my question is: how can I clean this up? And/or what did/went wrong? Thanks in advance for your help.

3 8

Default LDIF Configuration
by Trent Dierking 07 Sep '16

07 Sep '16

When running slapd with -f etc/openldap/slapd.ldif, I receive the following line 5: unknown directive <dn:> outside backend info and database definitions. By default slapd is using the .conf file instead, which works fine. This is the default ldif file, and line 5 seems to be the same as line 2 (first relevant line) from the configuration guide. I have tried using no options to configure ldap, with the same issues. I understand what the message is saying, but why does this conflict with the guide/default ldif file?

2 1

Re: UNKNOWN attributeDescription "ATTRIBUTE1" inserted
by Howard Chu 07 Sep '16

07 Sep '16

PenguinWhispererThe . wrote: > Once again thanks for taking your time to followup on this. > > I've tried slapcat before to dump to a file and couldn't find the attributes > that were mentioned. > So today I did it again (just to make sure) and the dump doesn't seem to hold > the attributes. You're still not paying attention to Michael's advice. Wipe out your original DB and feed the slapcat output to slapadd. Your current DB files still contain entries with the offending attributes. > What I did get is : The first database does not allow slapcat; using the first > available one (2). Apparently you have more than one database configured. You're probably not slapcat'ing the DB with the offending attributes. > > So then I went to the directory and just grepped for the attribute name and it > seems that it's matching on a binary file: cn=accesslog/log.000000123123 > (changed the number to post). > > This seems a good and a bad thing: good as in the actual data has no issues. > Bad as in when I restart the service we get the message about the attributes. > Is there something slapd does with those log files when it starts that > explains it being printed on the screen/syslog? > > I only have some "spare" time once in a while to further investigate this as > it's not a high priority but I'd like to get rid of it. > > > > 2016-09-04 14:07 GMT+02:00 Michael Ströder <michael(a)stroeder.com > <mailto:michael@stroeder.com>>: > > PenguinWhispererThe . wrote: > > Is "cleaning" my data somewhere like a slapcat and slapadd? This is a > > replicated environment. Will those changes be propagated? I'd think not as > > the import probably keeps the same timestamps. > > You have to start from scratch like after a full restore (cleaning the > databases > before slapadd-ing the sanitized data). > > Ciao, Michael. > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Should I use OpenLDAP or PostgreSQL for this?
by John Lewis 06 Sep '16

06 Sep '16

I want to start a project to document my local government starting at the municipal level and going upwards from there. I want to build an interface to allow people to look up their representatives and their public servants by issue and geographic area or issue and get their contact information back. I want it to to have fast lookups so community organizers will come to my site first they want to find out who does what. I would also like it to be able to scale geographically so I can get local activist could have their own copy of the database on a local server that they can also delegate access to. I would like to delegate updates to a development version of the database to other people similar to Open Street Map, but I would still like to verify changes so there won't be a flood of bad data. The presentation and the data storage will be separate components. Knowing this information could you tell me what data management engine would be more appropriate for the task?

2 1

approximate/phonetic/accent-insensitive search configuration
by clauds2x＠gmail.com 06 Sep '16

06 Sep '16

Hi, I'm trying to figure out the configuration options available for approximate/phonetic/accent-insensitive search on OpenLDAP (2.4). First off, is there any documentation that I might have missed? I only found mention of an approx index without further details... nothing about what needs to be enabled etc. In some older questions (~2002) an option "--enable-phonetic" was mentioned... was this removed respectively is it obsolete (e.g. the default)? I did some tests using the approximate match operator ~= once on a fresh LDAP with no approx index and once with the approx index set and I got the same result... is this expected behaviour that approximate matching also works without defining an index? If it's not necessary, what's the advantage of setting the approx index, improved performance? (Mind that the attributes I search do have other indices set e.g. sub. Maybe approximate search implementation also considers that index?) Since data in our LDAP is mostly French, Italian and German I was wondering if any language specific settings can be made? I came across a related question from 2015 which then was answered with no, is that still true? > Is there any possibility to configure phontic search specially for Austria? ITS is for bug reports/enhancements. Use the openldap-technical mailinglist for help reqests. Anyway: No, soundex/metaphone is hardcoded in slapd approx match. See <openldap source>/servers/slapd/phonetic.c. Clients can do a little of this "by hand" by inserting many variants of a name (e.g. o instead of ö) as invisible attribute values in the directory, see the x-hidden examples in man slapd.conf. http://www.openldap.org/lists/openldap-bugs/201506/msg00002.html Could matching rules be used in any way to influence the search behaviour with regard to localization e.g. using collation? I came across "caseIgnoreOrderingMatch" (RFC 4517) but as far as I can see it's only good for sorting... Is there a way to search only ignoring the order or in other words performing an accent-insensitive search? Any other hints/best practices for configuring OpenLDAP to support approximate/phonetic/accent-insensitive search in general and specifically for languages other than English? Thanks for your consideration. Clauds

1 0

NTLM hashes support for OpenLDAP
by Andrei Valoshyn 06 Sep '16

06 Sep '16

Hello! I have openldap-2.4.31 on ubuntu 14.04 with slapd.conf configuration. Is it possible to store NTLM hashes into it? -- With Best Wishes Andrei Valoshyn Exadel Inc. System Administrator avaloshyn(a)exadel.com -- CONFIDENTIALITY NOTICE: This email and files attached to it are confidential. If you are not the intended recipient you are hereby notified that using, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error please notify the sender and delete this email.

2 1

Documentation Request
by Tom Jay 06 Sep '16

06 Sep '16

Hello, Can I make a request that certain features of the access control documentation are emphasized? I've wasted quite a lot of time on this and some simple rules (which already exist in the documentation) would have been really helpful. These are: 8. Access Control 8.2. Access Control via Static Configuration 8.2.5. Access Control Examples To all attributes except homePhone, an entry can write to itself, entries under example.com entries can search by them, anybody else has no access (implicit by * none) excepting for authentication/authorization (which is always done anonymously). The fact that authentication is always done anonymously, even if anonymous binds are disabled in the configuration, is very important. 8.2.4. Access Control Evaluation Slapd stops with the first <what> selector that matches the entry and/or attribute. This is also very important, as it explains exactly how the access rules are processed. The order of evaluation of access directives makes their placement in the configuration file important. I don't think this is emphasized enough, as it is critical to how the access rules are processed. Also, some mention of the ACL log level would be useful! Thanks. Tom

3 4

Re: Should I use OpenLDAP or PostgreSQL for this?
by Howard Chu 05 Sep '16

05 Sep '16

John Lewis wrote: > I want to start a project to document my local government starting at > the municipal level and going upwards from there. I want to build an > interface to allow people to look up their representatives and their > public servants by issue and geographic area or issue and get their > contact information back. > > I want it to to have fast lookups so community organizers will come to > my site first they want to find out who does what. I would also like it > to be able to scale geographically so I can get local activist could > have their own copy of the database on a local server that they can also > delegate access to. I would like to delegate updates to a development > version of the database to other people similar to Open Street Map, but > I would still like to verify changes so there won't be a flood of bad > data. The presentation and the data storage will be separate components. > > Knowing this information could you tell me what data management engine > would be more appropriate for the task? I have a strong suspicion that OpenLDAP will be the superior solution for this problem, but you can't say definitively, based on a brief description. I would suggest you start to draw out on paper the types of information you plan to store, and group the related items together. This will give you some idea of what your basic DB records will contain. Then draw out what kinds of search operations you plan to support, or what kinds of data you expect users to be able to retrieve. Figure out what natural interconnections and relationships exist between your records. Most real world problem sets don't break down into 100% pure tabular data structures, nor do they break down into 100% pure hierarchical structures. But if you find there's a natural hierarchy like geographic area county municipality as I said before, I would suspect that the hierarchical structure will be a more natural fit. Also, given your requirement to scale out geographically - this is trivial to do with OpenLDAP; it is quite cumbersome to do with SQL servers. > > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

3 2

Authenticating Mac OSX (El Capitan) sign-ons to an OpenLDAP directory?
by Kevin Long 05 Sep '16

05 Sep '16

Greetings, I have a directory I set up for a client that uses OpenLDAP for single sign-on for several web applications and email, but I’m hoping to get it to work for their computer lab as well (All OS X El capitan machines). It’s unclear to me whether I truly need to add the apple/samba schemas to OpenLDAP to appease OS X, or whether I can map more standard attributes from the cosine etc schema to whatever OS X is looking for. I’ve read many blogs posts and have yet to find documentation that I think covers all the bases, including these: http://pig.made-it.com/ldap-mac.html http://vuksan.com/linux/mac-os-x-ldap/openldap-mac-os-x-authentication.html https://hermanbanken.nl/2011/01/22/openldap-server-mac-osx-clients/ http://www.hawaii.edu/askus/1625 It seems like OS X changes may have rendered some of the existing blogs/documents out there outdated. We are willing to hire someone to help with getting this set up. Regards, Kevin Long

2 1

What am I doing wrong with these olcAccess settings?
by A M 04 Sep '16

04 Sep '16

Hello, I just need to allow a simple "bind" user to be able the perform the authenticated searches in the tree, while allowing all other users to consult their data without being able to modify them. So I have set the following primitive access rules: ------------------------------ olcAccess: {0}to attrs=userPassword by self write by dn.base="cn=Manager,dc=example,dc=com" write by anonymous auth by * none" olcAccess: {1}to * by self read by dn.base="cn=Manager,dc=example,dc=com" write by dn="uid=binduser,ou=Users,dc=example,dc=com" read ------------------------------- With these settings, I can in fact perform authenticated searches as dn="uid=binduser,ou=Users,dc=example,dc=com" with filter uid=username. But the weird thing is that all other non-privileged users cannot see their own data, although I have added "to * by self read".. What am I missing? Thanks ahead for any comment! Andy.

2 1

Change Defaulth ssha passoword encryption algorithm
by Net Warrior 04 Sep '16

04 Sep '16

Hi Guys I need some guidance on this, I configured a ppolicy for a DIT which has all the users in plain password, I added to following to the policy changetype: modify replace: olcPPolicyHashCleartext olcPPolicyHashCleartext: FALSE When the user reset it password, it changes from clear password to encrypted using ssha but I want to store them using md5crypt, what do I need to change in my configuration? Thank you very much for your time and support Regards

5 10

contextCSN attribute update on replication
by Óscar Remírez de Ganuza Satrústegui 04 Sep '16

04 Sep '16

Good morning, I am writting from IT Services from Universidad de Navarra. We have recently upgraded our openldap servers from openldap 2.4.34 with BDB 5.3.21 to openldap 2.4.44 with MDB databases. We have got configured replication from the master server [1] to some slave servers [2] (syncrepl refreshAndPersist), and it is working ok. Usually, when a change is made on master server, I can see how it is propagated and applied on the slave server. Using Auditlog Overlay I can see on the slave server: # modify 1470723918 dc=base,dc=com cn=Admin,dc=base,dc=com conn=-1 dn: ... changetype: modify replace: [..] # end modify 1470723918 And just after that, the contextCSN gets updated too: # modify 1470723918 dc=base,dc=com cn=Admin,dc=base,dc=com conn=-1 dn: dc=base,dc=com changetype: modify replace: contextCSN contextCSN: 20160809062518.877725Z#000000#000#000000 - # end modify 1470723918 Is this the normal behaviour? I do not see the contextCSN update on the accesslog database on the master server, nor on his Auditlog. So I do not know if contextCSN has been replicated from the master server, or the slave database is updating it. But I am seeing some weird things from time to time: sometimes, somehow, the contextCSN attribute does not get updated after the modification. Checking its value in the master server, I can see that it has been updated correctly, but not on the slave server. The strange thing is that it happens just like once every tens of changes. Could it be some kind of bad configuration?? On the previous openldap version, we were checking contextCSN value on master and slave servers in order to check the replication status. But right now, although replication is working ok, sometimes the contextCSN does not get updated on the slave sever, so we can not use it in order to check the replication status. Thank you so much for your help. Regards, [1] Master: * Accesslog Database: database mdb maxsize 1073741824 suffix cn=log directory /../openldap/var/accesslog rootdn "cn=Admin,dc=base,dc=com" index objectClass eq index entryCSN eq index reqEnd eq index reqResult eq index reqStart eq index reqDN eq index default eq overlay syncprov syncprov-reloadhint true syncprov-nopresent true * Main Database overlays: overlay syncprov syncprov-checkpoint 1000 60 overlay accesslog logdb cn=log logops writes logsuccess true logpurge 14+00:00 01+00:00 [2] Slave: syncrepl rid=1 provider="ldap://ldap-master.base.com:389/" type=refreshAndPersist retry="60 10 300 +" searchbase="dc=base,dc=com" logbase="cn=log" syncdata=accesslog logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" scope=sub schemachecking=off binddn=... *Oscar Remírez de Ganuza Satrústegui* IT Services Universidad de Navarra Tel. +34 948425600 x803130 http://www.unav.edu/web/it/

3 9

openldap stops responding after some time
by Daniel Betz 31 Aug '16

31 Aug '16

Hello list, i hope you can help me with my problem. To my setup: All servers are OpenLDAP 2.4.42 I have an master LDAP server, which replicates with standard syncrepl to an consumer ldap. On this consumer ldap server i have configured an standalone slapd proxy ldap with slapd-ldap which pushes changes to more than 6000 consumer ldaps. There are more ldap proxys running, with each 500 consumers to reduce startup time. The master and slave are connected via TCP, and the ldap proxys are on the slave via socket. Everything works fine and changes are replicated in realtime to the consumers behind the proxy, but after some time ( about 20 to 30 minutes ) the slave ldap just hangs and isnt responding anymore. A short time before it hangs the changes are pushed with an long delay, before it hangs fully. With debug on ( -d256 ) everything looks fine and no error is displayed, but it hangs. I have tested the standard syncrepl and delta syncrepl with the same result. When strace the process there are only many futex_wait() While i write this mail the error doesnt occur, so i am not able to paste an strace. So then. Has anyone an idea to this problem or an better solution for my setup ? Any hints to debug this, or some tips and tricks would be really nice. Here are the relevant configuration settings of all servers: ## all ldap servers are started with extended limits in systemd LimitCORE=0 LimitNPROC=5000000 LimitNOFILE=65535 LimitSTACK=81920 LimitDATA=infinity LimitMEMLOCK=infinity LimitRSS=infinity LimitAS=infinity and: echo 5000000 > /proc/sys/kernel/threads-max Cause limits in openldap itself i have patched it too: diff -rNu openldap-2.4.42.orig/libraries/libldap_r/tpool.c openldap-2.4.42/libraries/libldap_r/tpool.c --- openldap-2.4.42.orig/libraries/libldap_r/tpool.c 2015-08-31 08:26:55.000000000 +0200 +++ openldap-2.4.42/libraries/libldap_r/tpool.c 2015-08-31 07:39:25.000000000 +0200 @@ -42,10 +42,10 @@ /* Max number of thread-specific keys we store per thread. * We don't expect to use many... */ -#define MAXKEYS 32 +#define MAXKEYS 65535 /* Max number of threads */ -#define LDAP_MAXTHR 1024 /* must be a power of 2 */ +#define LDAP_MAXTHR 65535 /* must be a power of 2 */ /* (Theoretical) max number of pending requests */ #define MAX_PENDING (INT_MAX/2) /* INT_MAX - (room to avoid overflow) */ diff -rNu openldap-2.4.42.orig/servers/slapd/daemon.c openldap-2.4.42/servers/slapd/daemon.c --- openldap-2.4.42.orig/servers/slapd/daemon.c 2015-08-31 08:25:42.000000000 +0200 +++ openldap-2.4.42/servers/slapd/daemon.c 2015-08-31 07:42:02.000000000 +0200 @@ -1635,6 +1635,7 @@ #else /* ! HAVE_SYSCONF && ! HAVE_GETDTABLESIZE */ dtblsize = FD_SETSIZE; #endif /* ! HAVE_SYSCONF && ! HAVE_GETDTABLESIZE */ + dtblsize=8192; /* open a pipe (or something equivalent connected to itself). * we write a byte on this fd whenever we catch a signal. The main And raised the max integer numbers of syncrepl´s rid= ### Master ########### loglevel 0 sizelimit unlimited database mdb suffix "o=company, c=de" rootdn "cn=Manager,o=company,c=de" rootpw "xxxxxxxxxxxxxxxxxxxxxxxx" overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 1000 index DFan,DFname,uid,uidNumber,gidNumber,DFCronjobID eq index entryUUID,entryCSN eq index objectClass eq directory /var/lib/ldap/openldap-mdb maxsize 8500000000 #### Slave ################## loglevel 0 threads 2048 database mdb suffix "o=company, c=de" rootdn "cn=Manager,o=company,c=de" rootpw "xxxxxxxxxxxxxxxxxxxx" # here are all consumer ldap servers one by one access to dn.subtree="sid=240,sec=webhosting,o=company,c=de" by dn.exact="cn=replicator,sid=240,sec=webhosting,o=company,c=de" write by * auth access to dn.subtree="sid=241,sec=webhosting,o=company,c=de" by dn.exact="cn=replicator,sid=241,sec=webhosting,o=company,c=de" write by * auth access to dn.subtree="sid=242,sec=webhosting,o=company,c=de" by dn.exact="cn=replicator,sid=242,sec=webhosting,o=company,c=de" write by * auth ... ... index DFan,DFname,uid,uidNumber,gidNumber,DFCronjobID eq index entryUUID,entryCSN eq index objectClass eq directory /var/lib/ldap/openldap-mdb syncrepl rid=001 provider=ldaps://ldapmaster:636/ binddn="cn=Manager,o=company,c=de" bindmethod=simple credentials=xxxxxxxxxxxxxxxxxxxxxx searchbase="o=company,c=de" type=refreshAndPersist retry="5 5 300 5" overlay syncprov syncprov-checkpoint 1000 60 maxsize 8500000000 maxreaders 12000 ##### SLAPD Proxy ##################### database ldap hidden on suffix "sid=240,sec=webhosting,o=company,c=de" rootdn "cn=replicator,sid=240,sec=webhosting,o=company,c=de" uri ldaps://sid240.int.webslave.company.de:636 lastmod on restrict all acl-bind bindmethod=simple binddn="cn=replicator,sid=240,sec=webhosting,o=company,c=de" credentials="xxxxxxxxxxxxxxxxxxxxx" syncrepl rid=001 provider=ldapi:// binddn="cn=Manager,o=company,c=de" bindmethod=simple credentials=xxxxxxxxxxxxxxxxxxxxxxxxx searchbase="sid=240,sec=webhosting,o=company,c=de" type=refreshAndPersist retry="5 5 300 5" overlay syncprov # next one database ldap hidden on suffix "sid=241,sec=webhosting,o=company,c=de" rootdn "cn=replicator,sid=241,sec=webhosting,o=company,c=de" uri ldaps://sid241.int.webslave.company.de:636 lastmod on restrict all acl-bind bindmethod=simple binddn="cn=replicator,sid=241,sec=webhosting,o=company,c=de" credentials="xxxxxxxxxxxxxxxxxxxxx" syncrepl rid=001 provider=ldapi:// binddn="cn=Manager,o=company,c=de" bindmethod=simple credentials=xxxxxxxxxxxxxxxxxxxxxxxxx searchbase="sid=241,sec=webhosting,o=company,c=de" type=refreshAndPersist retry="5 5 300 5" overlay syncprov ... #### and the 6300 consumers on the end ############### database mdb suffix "sid=240,sec=webhosting,o=company,c=de" rootdn "cn=replicator,sid=240,sec=webhosting,o=company,c=de" rootpw {SSHA}xxxxxxxxxxxxxxxx index DFan,DFname,DFdnumber,sid,uid,uidNumber,gidNumber,DFCronjobID eq index objectClass eq index entryUUID,entryCSN eq directory /var/lib/ldap/openldap-mdb/sid240 updatedn "cn=replicator,sid=240,sec=webhosting,o=company,c=de" maxsize 1073741824 subordinate updateref ldaps://ldapmaster:636 database mdb suffix "o=company,c=de" rootdn "cn=Manager,o=company,c=de" rootpw {SSHA}xxxxxxxxxxxxxxxx index objectClass eq directory /var/lib/ldap/openldap-mdb/rest Regards, Daniel Betz System Design Engineer / Senior Systemadministration ___________________________________ domainfactory GmbH Oskar-Messter-Str. 33 85737 Ismaning Germany Telefon: +49 (0)89 / 55266-364 Telefax: +49 (0)89 / 55266-222 E-Mail: dbetz(a)df.eu Internet: www.df.eu Registergericht: Amtsgericht München HRB-Nummer 150294, Geschäftsführer: Tobias Mohr, Stephan Wolfram

2 2

nslcd listing users and groups twice
by John Lewis 28 Aug '16

28 Aug '16

This is surprisingly non-trivial especially when the nis schema for openldap is more documented than the samba one when I use to run samba-ad-dc. I have the nslcd.conf attatched.

2 5

rootDN problems with slapd-config
by Dave Schneider 28 Aug '16

28 Aug '16

I'm having problems getting the rootDN working when using slapd-config form of configuration, while the "exact" same configuration using slapd.conf works fine. Here are my stripped down test versions of the two configurations (hashed password is 'secret' from slappasswd): slapd.d/cn=e2config.ldif: ------------------------- dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/openldap/run/slapd.args olcPidFile: /var/openldap/run/slapd.pid dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema include: file:///var/openldap/schema/core.ldif include: file:///var/openldap/schema/cosine.ldif dn: olcDatabase=frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: frontend dn: olcDatabase=mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: mdb olcMaxsize: 1073741824 olcSuffix: dc=com olcRootDN: cn=reader,dc=com olcRootPW: {SSHA}RIC5hnBuWr4t857KR+dzTEOF/ekQaIVx olcDbDirectory: /var/openldap/data olcDbIndex: objectClass eq olcDbIndex: dc eq olcDbIndex: cn eq slapd.conf: ----------- include /var/openldap/schema/core.schema include /var/openldap/schema/cosine.schema backend mdb pidfile /var/openldap/run/slapd.pid argsfile /var/openldap/run/slapd.args database mdb maxsize 1073741824 suffix dc=com rootdn cn=reader,dc=com rootpw {SSHA}RIC5hnBuWr4t857KR+dzTEOF/ekQaIVx directory /var/openldap/data index objectClass eq index dc eq index cn eq When I run a simple search for slapd running with the slapd.conf configuration I get: $ ldapsearch -D cn=reader,dc=com -w secret -x -LLL -b dc=com -s base dc=* dn: dc=com objectClass: top objectClass: domain dc: com But when I run the same search with the slapd.d configuration I get: $ ldapsearch -D cn=reader,dc=com -w secret -x -LLL -b dc=com -s base dc=* ldap_bind: Invalid DN syntax (34) additional info: invalid DN Debug output on the server side isn't giving much info in addition to what's already displayed on the client: 57bf52df conn=1000 op=0 do_bind: invalid dn (cn=reader,dc=com) Any help on what I might be doing wrong is greatly appreciated. Oh yeah, I'm using version 2.4.44. Thanks, Dave

3 7

Re: libldap and libldap_r in the same process
by Howard Chu 28 Aug '16

28 Aug '16

Jan Engelhardt wrote: > > On Sunday 2016-08-28 15:03, Howard Chu wrote: >>> * Should Linux distributions make libldap and libldap_r be the same thing? >> >> I'm wary of doing that, but I suppose thread support on Linux today is a lot >> more stable than it was 7-15 years ago. > > The question really just is, will the openldap project combine ldap > and ldap_r, or do distributions have to copy the Debian-style solution? The OpenLDAP Project will not make such a change in the 2.x release family. What distributions decide to do is up to them. There are still embedded devices that use libldap, and have no thread support. We have no reason to make it harder for them to build their own projects. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: libldap and libldap_r in the same process
by Howard Chu 28 Aug '16

28 Aug '16

Jan Engelhardt wrote: > > A given (threaded) program makes use of libldap_r. It now also wants to > make use of, say, libcurl. On certain systems, libcurl happens to be > linked against libldap (not _r). > > Eventually, both libldap and libldap_r end up in the process image of my > program, and a symbol like "ldap_init" may point to the function of > either library file. The threaded program may end up unexpectedly been > given the non-threaded functions, depending on how the runtime linker > loaded said libraries and binds the symbols. (I am seeing crashes in a > large program's initialization because of this.) > > > There is a 7-year old post indicating libldap should get locking/ > be replaced by libldap_r. > http://www.openldap.org/lists/openldap-devel/200909/msg00018.html > To date, openldap still consists of the two libraries. > What are the preferred options to go forward here? > > * Killing non-threaded libldap in openldap for real > If not, > * Should curl have used -lldap_r instead of -lldap? Is curl already multithreaded? On Ubuntu curl is built with libldap_r already. If curl is a threaded program then yes, it should use libldap_r. > * Should Linux distributions make libldap and libldap_r be the same thing? I'm wary of doing that, but I suppose thread support on Linux today is a lot more stable than it was 7-15 years ago. > * Should libldap and libldap_r be augmented by ELF symbol versions? > * All of the above? :) -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

libldap and libldap_r in the same process
by Jan Engelhardt 27 Aug '16

27 Aug '16

A given (threaded) program makes use of libldap_r. It now also wants to make use of, say, libcurl. On certain systems, libcurl happens to be linked against libldap (not _r). Eventually, both libldap and libldap_r end up in the process image of my program, and a symbol like "ldap_init" may point to the function of either library file. The threaded program may end up unexpectedly been given the non-threaded functions, depending on how the runtime linker loaded said libraries and binds the symbols. (I am seeing crashes in a large program's initialization because of this.) There is a 7-year old post indicating libldap should get locking/ be replaced by libldap_r. http://www.openldap.org/lists/openldap-devel/200909/msg00018.html To date, openldap still consists of the two libraries. What are the preferred options to go forward here? * Killing non-threaded libldap in openldap for real If not, * Should curl have used -lldap_r instead of -lldap? * Should Linux distributions make libldap and libldap_r be the same thing? * Should libldap and libldap_r be augmented by ELF symbol versions? * All of the above? :)

1 0

Re: Using LMDB safely with fork() and exec()
by Howard Chu 23 Aug '16

23 Aug '16

Lorenz Bauer wrote: > If this works, I'd like to contribute the changes necessary to not > leak fds on exec, which are mentioned in the other thread. > > * Are there contribution guidelines somewhere? How do I submit a patch? Read http://www.openldap.org/ "Contributing" -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

Re: mirror mode vs multi master
by Howard Chu 23 Aug '16

23 Aug '16

Matwey V. Kornilov wrote: > Hello, > >>From Administrator's guide, it is not completely clear what is the > internal difference between mirror mode and n-way multi master. There is no internal difference. The difference is in how clients use the servers. In mirrormode you arrange for all write ops to only go to one provider. > 1) Can 2-way multi master configuration exist? If so, what should be > difference in slapd.conf between mirror mode and 2-way multi master? There is no difference in slapd configuration. > What is the difference in syncrepl behaviour? Or all difference is > that external proxy/balancer assumed when mirror mode is meant? All difference is in the external proxy. > 2) Is there quorum based consensus when 3-way multi master is used? If > not, how is the conflict resolution performed? No quorums needed. Conflict resolution is based on CSNs. In general, last writer wins. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

mirror mode vs multi master
by Matwey V. Kornilov 23 Aug '16

23 Aug '16

Hello, >From Administrator's guide, it is not completely clear what is the internal difference between mirror mode and n-way multi master. 1) Can 2-way multi master configuration exist? If so, what should be difference in slapd.conf between mirror mode and 2-way multi master? What is the difference in syncrepl behaviour? Or all difference is that external proxy/balancer assumed when mirror mode is meant? 2) Is there quorum based consensus when 3-way multi master is used? If not, how is the conflict resolution performed? -- With best regards, Matwey V. Kornilov http://blog.matwey.name xmpp://0x2207@jabber.ru

1 0

search right and attribute existence
by Emmanuel Dreyfus 22 Aug '16

22 Aug '16

Hello I would like to test if an attribute is set without disclosing it. Using an ACL that grants the search right does it: I can do ldapsearch -b dn attr=*' dn and see if I get a result. Problem: it is still possible to brute force the atribute value, by searching x* with x being the first lette,r, then xy* and so on. Is there a way to address this? -- Emmanuel Dreyfus manu(a)netbsd.org

4 4

Directory structure searching
by Gurjot Kaur 20 Aug '16

20 Aug '16

Hi, I am encountered a problem regarding the checking of the directory structure during ldapsearch request. I did slapadd on my LDAP server (OpenLDAP 2.4.44 with MDB backend) for few entries and found the below error as my top entry "ou=people,dc=my-domain,dc=com" was missing from the DB. ############################################################################### /usr/local/sbin/slapadd -v -c -w -f /usr/local/etc/openldap/slapd.conf -l 2_tmp.ldif 578c3c23 mdb_monitor_db_open: monitoring disabled; configure monitor database to enable added: "ou=Test1,ou=people,dc=my-domain,dc=com" (00000005) added: "ou=Test2,ou=people,dc=my-domain,dc=com" (00000006) added: "ou=Test3,ou=people,dc=my-domain,dc=com" (00000007) added: "ou=Test4,ou=people,dc=my-domain,dc=com" (00000008) _#################### 100.00% eta none elapsed none fast! modified: "(null)" (00000001) Closing DB...Error, entries missing! entry 4: ou=people,dc=my-domain,dc=com ############################################################################### The above error is fine. Do the above entries get added to the DB, though the parent node for these entries was not present? Because when I search for the entry using the below ldapsearch command, this gives me the correct result. ############################################################################### ldapsearch -x -D cn=Manager, dc=my-domain,dc=com -w secret -b ou=Test1,ou=people, dc=my-domain,dc=com -s sub "(&(objectclass=organizationalUnit)(ou=Test1*))" -H ldap://0.0.0.0:2016 # extended LDIF # # LDAPv3 # base <ou=Test1,ou=people,dc=my-domain,dc=com> with scope subtree # filter: (&(objectclass=organizationalUnit)(ou=Test1*)) # requesting: ALL # # Test1, people, my-domain.com dn: ou=Test1,ou=people, dc=my-domain,dc=com ou: Test1 objectClass: organizationalUnit companyName: Test1 # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 ############################################################################### Does this means ldapsearch check just for the specific entry and not the complete directory structure? Thanks in advance. Regards, Gurjot Kaur "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

2 1

Missing user entries after restoring a backup ldif
by Matt Spaulding 20 Aug '16

20 Aug '16

Hello, I restored an ldap database using the command: slapadd -l /my/file.ldif The restore went completely without error. But when I go to do an ldapsearch I find that some of the users that should be in the database are not there. I go back and edit my ldif backup file and search for the uids of the users and confirm that they are in fact in the ldif file. Why would something like this happen? Best Regards, Matt

2 1

Re: Can't modify pwdChangedTime as "admin"
by PenguinWhispererThe . 19 Aug '16

19 Aug '16

Thanks for that good pointer Dieter. Although it will force the user to change his password I'm not sure this will do the trick in our case. We have a custom passwd script that keeps both ldap and nis in sync. With the above I believe the Nis password won't be updated. So is there a way to actually update the pwdChangedTime? (Even out of pure curiosity) Thanks On Aug 17, 2016 11:38, "Dieter Klünter" <dieter(a)dkluenter.de> wrote: Am Wed, 17 Aug 2016 10:46:58 +0200 schrieb "PenguinWhispererThe ." <th3penguinwhisperer(a)gmail.com>: > Hi all, > > I've noticed that after a password reset pwdChangedTime gets updated. > > This is fine. We do have a policy in place that doesn't let you > modify your password again within a few days. > > I'd like to reset/change this pwdChangedTime so the user can reset his > password himself after logging in with the supplied password. However > deleting/modifying pwdChangedTime doesn't work. > > How should I resolve this? > I'm pretty sure this is not an ACL issue as my user matches the first > entry and is allowed to write all. > > I've seen some docs from IBM about removing pwdChangedTime being > possible but that might not apply to openldap. > man slapo-ppolicy(5), read carefully the comments on pwdReset. -Dieter -- Dieter Klünter | Systemberatung http://sys4.de GPG Key ID: E9ED159B 53°37'09,95"N 10°08'02,42"E

3 3

replicator account password encrypted and entries are hidden in ldap viewer
by Kruger, P (Justid) 18 Aug '16

18 Aug '16

We succesfully installed openldap with: - Replication - Password policy After applying config policy with olcPPolicyHashCleartext: TRUE the password the replicator user password gets encrypted with ssha. Although, according to what I've read, the password with simple bind should not be encrypted, it seems that replication still is functioning. Questions: Can anybody tell me if should be expected to cause a problem? How do you handle the replication user and password in regards to encrypted passwords? Second problem we are facing is that the replication OU and underlaying account are not visible anymore. With slapcat the OU is still visible in the LDIF file, but not in the LDAP viewer. If I'm not mistaken, the record is of the type GLUE, which might indicate that it is not properly replicated and therefore not visible? Question: Does anybody know what can be the problem here? Or how to solve this without reinstalling OpenLDAP with a clean database? Thanks in advance, Peter Kruger

2 1

Can't modify pwdChangedTime as "admin"
by PenguinWhispererThe . 17 Aug '16

17 Aug '16

Hi all, I've noticed that after a password reset pwdChangedTime gets updated. This is fine. We do have a policy in place that doesn't let you modify your password again within a few days. I'd like to reset/change this pwdChangedTime so the user can reset his password himself after logging in with the supplied password. However deleting/modifying pwdChangedTime doesn't work. How should I resolve this? I'm pretty sure this is not an ACL issue as my user matches the first entry and is allowed to write all. I've seen some docs from IBM about removing pwdChangedTime being possible but that might not apply to openldap. Thanks in advance!

2 1

Modification of objectClass failing: how can I get details?
by Côme Chilliet 16 Aug '16

16 Aug '16

Hello, I’m trying to modify an LDAP node to change its objectClasses: dn: cn=canon-c5250,ou=printers,ou=systems,dc=xxx,dc=xxx cn: canon-c5250 description:: Q2Fub24gSVIgQURWIEM1MjUwIA== labeledURI: ipp://127.0.0.1 ipHostnumber: 127.0.0.1 macAddress: 12:12:12:12:12:12 objectClass: top objectClass: gotoPrinter I want to remove gotoPrinter objectClass which is flagged as OBSOLETE and instead use fdPrinter, ipHost and ieee802Device. I try with an ldif with the following content: dn: cn=canon-c5250,ou=printers,ou=systems,dc=xxx,dc=xxx changetype: modify replace: objectClass objectClass: fdPrinter objectClass: ieee802Device objectClass: ipHost objectClass: top I get: ldapadd -D cn=admin,dc=xxx,dc=xxx -f modify.ldif -W ldap_modify: Object class violation (65) How can I get more information? I don’t know which violation that could be, as I am able to insert a second object with no problem which looks like what I want: dn: cn=test-print,ou=printers,ou=systems,dc=xxx,dc=xxx changetype: add cn: test-print description: test labeledURI: ipp://127.0.0.1 ipHostnumber: 127.0.0.1 macAddress: 12:22:12:12:22:22 objectClass: fdPrinter objectClass: ieee802Device objectClass: ipHost objectClass: top Here are the classes definitions: objectclass (1.3.6.1.4.1.10098.1.2.1.31 NAME 'gotoPrinter' DESC 'GOto - Gonicus Terminal Concept, objectclass' SUP top STRUCTURAL OBSOLETE MUST ( cn ) MAY ( labeledURI $ description $ l $ gotoPrinterPPD $ macAddress $ ipHostNumber $ gotoUserPrinter $ gotoUserAdminPrinter $ gotoGroupPrinter $ gotoGroupAdminPrinter $ printerWindowsInfFile $ printerWindowsDriverDir $ printerWindowsDriverName) ) objectclass ( 1.3.6.1.4.1.38414.16.2.5 NAME 'fdPrinter' DESC 'FusionDirectory printer class' MUST ( cn ) MAY ( labeledURI $ fdPrinterWindowsInfFile $ fdPrinterWindowsDriverDir $ fdPrinterWindowsDriverName $ fdPrinterUsers $ fdPrinterAdminUsers)) Côme

2 1

RE: OpenLDAP Upgrade from OpenLDAP 2.1 to 2.4 - ACL Issues
by Madden, Joe 10 Aug '16

10 Aug '16

Hi List, I've managed to answer my own question by reading the change log between the versions - Who would have figured the answer would have been there! OpenLDAP 2.4 Introduced the requirement to have search permission on the parent DN when search a subtree. Therefore I had to update my ACL's to this: # Allow a user to update their password access to attrs=userPassword by dn="uid=support,ou=users,dc=oursystem,dc=co,dc=uk" write by dn="uid=backup,ou=users,dc=oursystem,dc=co,dc=uk" write by self write by * auth #As of OpenLDAP 2.4.X you are required to provide search to the DN which you search though to find a attribute. #We have therefore permitted search though the system for any authenticated user. The ACL's below line by dnattr=uniqueMember #Controls what the user can actually read. access to dn="ou=applications, dc=oursystem,dc=co,dc=uk" by users search # Allow write and read access to the applications tree for specific users # Normal users will only be able to see what they are a member of access to dn.subtree="ou=applications,dc=oursystem,dc=co,dc=uk" by dn="uid=support,ou=users,dc=oursystem,dc=co,dc=uk" write by dn="uid=backup,ou=users,dc=oursystem,dc=co,dc=uk" write by dn="uid=tomcat, ou=users,dc=oursystem,dc=co,dc=uk" read by dn="uid=apache, ou=users,dc=oursystem,dc=co,dc=uk" read by dnattr=uniqueMember read # Allow write and read access to the users tree for specific users # Normal users will only be able to their own node access to dn.subtree="ou=users,dc=oursystem,dc=co,dc=uk" by dn="uid=support,ou=users,dc=oursystem,dc=co,dc=uk" write by dn="uid=backup,ou=users,dc=oursystem,dc=co,dc=uk" write by dn="uid=apache,ou=users,dc=oursystem,dc=co,dc=uk" read by self write # Allow write and read access for specific users # Normal users will only be able to their own node access to dn.subtree="dc=oursystem,dc=co,dc=uk" by dn="uid=support,ou=users,dc=oursystem,dc=co,dc=uk" write by dn="uid=backup,ou=users,dc=oursystem,dc=co,dc=uk" write by dn="uid=apache, ou=users,dc=oursystem,dc=co,dc=uk" read by self read The new section added is : #As of OpenLDAP 2.4.X you are required to provide search to the DN which you search though to find a attribute. #We have therefore permitted search though the system for any authenticated user. The ACL's below line by dnattr=uniqueMember #Controls what the user can actually read. access to dn="ou=applications, dc=oursystem,dc=co,dc=uk" by users search Thanks Joe. -----Original Message----- From: Madden, Joe Sent: 09 August 2016 14:55 To: openldap-technical(a)openldap.org Subject: OpenLDAP Upgrade from OpenLDAP 2.1 to 2.4 - ACL Issues Hi List, Hoping someone can help us out with our ACL problems post upgrading on our test system. We've upgraded from OpenLDAP 2.1 to 2.4 with success. The directory is fine and the ACLS below work as expected minus the line [by dnattr=uniqueMember read] Please see our ACL's below: # Allow a user to update their password access to attrs=userPassword by dn="uid=support,ou=users,dc=oursystem,dc=co,dc=uk" write by dn="uid=backup,ou=users,dc=oursystem,dc=co,dc=uk" write by self write by * auth # Allow write and read access to the applications tree for specific users # Normal users will only be able to see what they are a member of access to dn.subtree="ou=applications,dc=oursystem,dc=co,dc=uk" by dn="uid=root,dc=oursystem,dc=co,dc=uk" write by dn="uid=support,ou=users,dc=oursystem,dc=co,dc=uk" write by dn="uid=backup,ou=users,dc=oursystem,dc=co,dc=uk" write by dn="uid=tomcat, ou=users,dc=oursystem,dc=co,dc=uk" read by dn="uid=apache, ou=users,dc=oursystem,dc=co,dc=uk" read by dnattr=uniqueMember read # Allow write and read access to the users tree for specific users # Normal users will only be able to their own node access to dn.subtree="ou=users,dc=oursystem,dc=co,dc=uk" by dn="uid=root,dc=oursystem,dc=co,dc=uk" write by dn="uid=support,ou=users,dc=oursystem,dc=co,dc=uk" write by dn="uid=backup,ou=users,dc=oursystem,dc=co,dc=uk" write by dn="uid=apache,ou=users,dc=oursystem,dc=co,dc=uk" read by self write # Allow write and read access for specific users # Normal users will only be able to their own node access to dn.subtree="dc=oursystem,dc=co,dc=uk" by dn="uid=root,dc=oursystem,dc=co,dc=uk" write by dn="uid=support,ou=users,dc=oursystem,dc=co,dc=uk" write by dn="uid=backup,ou=users,dc=oursystem,dc=co,dc=uk" write by dn="uid=apache, ou=users,dc=oursystem,dc=co,dc=uk" read by self read The apache, tomcat, root, support users work as expected and can access their respective accounts. We have a number of Unique Members who are members of DN's under dc=oursystem,dc=co,dc=uk. For Example: DN: cn=online_application_1,ou=our_online_application_1,ou=applications,dc=oursystem,dc=co,dc=uk We have uniqueMember attribute which contains the dn for users For Example: uid=user1,ou=users,dc=oursystem,dc=co,dc=uk As I understand it by dnattr=uniqueMember read on openldap 2.1 allowed the user to login to the ldap server, search the DN's under the ou=applications,dc=oursystem,dc=co,dc=uk for uniqueMember which contained there own DN. This worked and our applications authenticated on OpenLDAP 2.1. Since upgrading to 2.4 this ACL does not work in this way and I suspect it's by dnattr=uniqueMember read which is the problem. Does anyone have any help to offer on how to proceed? Is there a better way to do the ACL in question? Thanks Joe

1 0

OpenLDAP Upgrade from OpenLDAP 2.1 to 2.4 - ACL Issues
by Madden, Joe 09 Aug '16

09 Aug '16

Hi List, Hoping someone can help us out with our ACL problems post upgrading on our test system. We've upgraded from OpenLDAP 2.1 to 2.4 with success. The directory is fine and the ACLS below work as expected minus the line [by dnattr=uniqueMember read] Please see our ACL's below: # Allow a user to update their password access to attrs=userPassword by dn="uid=support,ou=users,dc=oursystem,dc=co,dc=uk" write by dn="uid=backup,ou=users,dc=oursystem,dc=co,dc=uk" write by self write by * auth # Allow write and read access to the applications tree for specific users # Normal users will only be able to see what they are a member of access to dn.subtree="ou=applications,dc=oursystem,dc=co,dc=uk" by dn="uid=root,dc=oursystem,dc=co,dc=uk" write by dn="uid=support,ou=users,dc=oursystem,dc=co,dc=uk" write by dn="uid=backup,ou=users,dc=oursystem,dc=co,dc=uk" write by dn="uid=tomcat, ou=users,dc=oursystem,dc=co,dc=uk" read by dn="uid=apache, ou=users,dc=oursystem,dc=co,dc=uk" read by dnattr=uniqueMember read # Allow write and read access to the users tree for specific users # Normal users will only be able to their own node access to dn.subtree="ou=users,dc=oursystem,dc=co,dc=uk" by dn="uid=root,dc=oursystem,dc=co,dc=uk" write by dn="uid=support,ou=users,dc=oursystem,dc=co,dc=uk" write by dn="uid=backup,ou=users,dc=oursystem,dc=co,dc=uk" write by dn="uid=apache,ou=users,dc=oursystem,dc=co,dc=uk" read by self write # Allow write and read access for specific users # Normal users will only be able to their own node access to dn.subtree="dc=oursystem,dc=co,dc=uk" by dn="uid=root,dc=oursystem,dc=co,dc=uk" write by dn="uid=support,ou=users,dc=oursystem,dc=co,dc=uk" write by dn="uid=backup,ou=users,dc=oursystem,dc=co,dc=uk" write by dn="uid=apache, ou=users,dc=oursystem,dc=co,dc=uk" read by self read The apache, tomcat, root, support users work as expected and can access their respective accounts. We have a number of Unique Members who are members of DN's under dc=oursystem,dc=co,dc=uk. For Example: DN: cn=online_application_1,ou=our_online_application_1,ou=applications,dc=oursystem,dc=co,dc=uk We have uniqueMember attribute which contains the dn for users For Example: uid=user1,ou=users,dc=oursystem,dc=co,dc=uk As I understand it by dnattr=uniqueMember read on openldap 2.1 allowed the user to login to the ldap server, search the DN's under the ou=applications,dc=oursystem,dc=co,dc=uk for uniqueMember which contained there own DN. This worked and our applications authenticated on OpenLDAP 2.1. Since upgrading to 2.4 this ACL does not work in this way and I suspect it's by dnattr=uniqueMember read which is the problem. Does anyone have any help to offer on how to proceed? Is there a better way to do the ACL in question? Thanks Joe

1 0

openldap client cert validation
by Matwey V. Kornilov 06 Aug '16

06 Aug '16

Hello, I am running openldap 2.4.41 and I've failed to setup client certificate validation. TLS works well until olcTLSVerifyClient is set to demand. Then I see ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) at client side. And connection_read(11): TLS accept failure error=-1 id=1021, closing at the serveri side. So, I've configured /etc/openldap/ldap.conf as the following to provide client TLS certificate paths: TLS_CACERT /path/to/myroot.pem TLS_CACERTDIR /var/lib/ca-certificates/pem/ TLS_CERT /path/to/my.crt TLS_KEY /path/to/my.key However, when I run openssl s_server -Verify 0 -accept 636 ... I see the following: ERROR 140680155473552:error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate:s3_srvr.c:3309: shutting down SSL CONNECTION CLOSED ACCEPT So, this means that ldapsearch doesn't sent out its client certificate. I've also checked with strace tool that it even doesn't access certificate file. So, I am little stuck here. I understand that I am doing something wrong, but I cannot figure out what.

3 4

Re: openldap client cert validation
by Howard Chu 06 Aug '16

06 Aug '16

Matwey V. Kornilov wrote: > After inspecting source code I've just found that TLS_KEY and TLS_CERT > are ignored if located in /etc/openldap/ldap.conf. > Why does it not written in man ldap.conf(5) explicitly? The ldap.conf(5) manpage says clearly "This is a user-only option." > I've spent two days of my precious life to dig it out. Yes, not reading carefully is a sure way to waste time. > Now it works. > > 2016-08-06 16:07 GMT+03:00 Matwey V. Kornilov <matwey.kornilov(a)gmail.com>: >> Hello, >> >> I am running openldap 2.4.41 and I've failed to setup client certificate >> validation. TLS works well until olcTLSVerifyClient is set to demand. >> Then I see >> >> ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) >> >> at client side. >> And >> >> connection_read(11): TLS accept failure error=-1 id=1021, closing >> >> at the serveri side. >> So, I've configured /etc/openldap/ldap.conf as the following to provide >> client TLS certificate paths: >> >> TLS_CACERT /path/to/myroot.pem >> TLS_CACERTDIR /var/lib/ca-certificates/pem/ >> TLS_CERT /path/to/my.crt >> TLS_KEY /path/to/my.key >> >> However, when I run openssl s_server -Verify 0 -accept 636 ... >> I see the following: >> >> ERROR >> 140680155473552:error:140890C7:SSL >> routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a >> certificate:s3_srvr.c:3309: >> shutting down SSL >> CONNECTION CLOSED >> ACCEPT >> >> So, this means that ldapsearch doesn't sent out its client certificate. >> I've also checked with strace tool that it even doesn't access >> certificate file. >> >> So, I am little stuck here. I understand that I am doing something >> wrong, but I cannot figure out what. > > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

How do I allow root to edit mdb database?
by John Lewis 06 Aug '16

06 Aug '16

How do I allow root aka dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external to edit olcDatabase={1}mdb,cn=config. I am trying to configure ldapscripts <https://packages.debian.org/jessie/ldapscripts>, but the idea of having a password in the clear is just disturbing. Ldapscripts is in sbin and needs to be ran by someone with root privileges anyways. The easiest way of getting around having a password in the clear would be SASL binding root and mapping it to olcRootDN: when it binds so root can modify the directory tree when it executes ldapscripts.

6 12

RE: openldap-technical Digest, Vol 105, Issue 2
by Kruger, P (Justid) 03 Aug '16

03 Aug '16

You could check fort he logfiles. But to get logging detailed, you need to set the loglevel. You can save ldap logging to a separate logfile and added logging level. Below is what I've done under Linux to achieve this (nano is the editor, which could also be vi). mkdir /var/log/ldap/ touch /var/log/ldap/ldap.log chown ldap.ldap /var/log/ldap -R nano /etc/rsyslog.conf Add the following rule tot his file # Save LDAP messages to /var/log/ldap/ldap.log local4.* /var/log/ldap/ldap.log Add log rotation to prevent an ever growing log file. nano /etc/logrotate.d/ldap.log /var/log/ldap/ldap.log { missingok } service rsyslog restart Met vriendelijke groet, Peter Kruger Adviseur IT-beheer .................................................................................. Ministerie van Justitie Justitiële Informatiedienst Technologie/IT-beheer Egbert Gorterstraat 6 | 7607 GB | Almelo | 2.15 Postbus 337 | 7600 AH | Almelo .................................................................................. T 088 99 89060 M 06 511 016 92 p.kruger(a)justid.nl www.justid.nl .................................................................................. werkt op: ma, di, wo, do .................................................................................. Van: Côme Chilliet [mailto:come@opensides.be] Verzonden: dinsdag 2 augustus 2016 15:32 Aan: openldap-technical(a)openldap.org Onderwerp: Modification of objectClass failing: how can I get details? Hello, I'm trying to modify an LDAP node to change its objectClasses: dn: cn=canon-c5250,ou=printers,ou=systems,dc=xxx,dc=xxx cn: canon-c5250 description:: Q2Fub24gSVIgQURWIEM1MjUwIA== labeledURI: ipp://127.0.0.1 ipHostnumber: 127.0.0.1 macAddress: 12:12:12:12:12:12 objectClass: top objectClass: gotoPrinter I want to remove gotoPrinter objectClass which is flagged as OBSOLETE and instead use fdPrinter, ipHost and ieee802Device. I try with an ldif with the following content: dn: cn=canon-c5250,ou=printers,ou=systems,dc=xxx,dc=xxx changetype: modify replace: objectClass objectClass: fdPrinter objectClass: ieee802Device objectClass: ipHost objectClass: top I get: ldapadd -D cn=admin,dc=xxx,dc=xxx -f modify.ldif -W ldap_modify: Object class violation (65) How can I get more information? I don't know which violation that could be, as I am able to insert a second object with no problem which looks like what I want: dn: cn=test-print,ou=printers,ou=systems,dc=xxx,dc=xxx changetype: add cn: test-print description: test labeledURI: ipp://127.0.0.1 ipHostnumber: 127.0.0.1 macAddress: 12:22:12:12:22:22 objectClass: fdPrinter objectClass: ieee802Device objectClass: ipHost objectClass: top Here are the classes definitions: objectclass (1.3.6.1.4.1.10098.1.2.1.31 NAME 'gotoPrinter' DESC 'GOto - Gonicus Terminal Concept, objectclass' SUP top STRUCTURAL OBSOLETE MUST ( cn ) MAY ( labeledURI $ description $ l $ gotoPrinterPPD $ macAddress $ ipHostNumber $ gotoUserPrinter $ gotoUserAdminPrinter $ gotoGroupPrinter $ gotoGroupAdminPrinter $ printerWindowsInfFile $ printerWindowsDriverDir $ printerWindowsDriverName) ) objectclass ( 1.3.6.1.4.1.38414.16.2.5 NAME 'fdPrinter' DESC 'FusionDirectory printer class' MUST ( cn ) MAY ( labeledURI $ fdPrinterWindowsInfFile $ fdPrinterWindowsDriverDir $ fdPrinterWindowsDriverName $ fdPrinterUsers $ fdPrinterAdminUsers)) Côme

1 0

Re: password policies not functioning properly
by Kruger, P (Justid) 02 Aug '16

02 Aug '16

Just found the problem and the solution to the problem that policies were not working. It occurred that there was also a (probably mistakenly) second config module activated. The module I had configured with ppolicy, was not used. The extra module that was active, did not have the ppolicy overlay loaded. After correcting this, all seems to work as expected.

1 0

password policies not functioning as expected
by Kruger, P (Justid) 02 Aug '16

02 Aug '16

Just found the problem and the solution. It occurred that there was also a (probably mistakenly) second config module activated. The module I had configured with ppolicy, was not used. The extra module that was active, did not have the ppolicy overlay loaded. After correcting this, all seems to work as expected. -----Oorspronkelijk bericht----- Van: openldap-technical [mailto:openldap-technical-bounces@openldap.org] Namens openldap-technical-request(a)openldap.org Verzonden: donderdag 28 juli 2016 14:00 Aan: openldap-technical(a)openldap.org Onderwerp: openldap-technical Digest, Vol 104, Issue 21 Send openldap-technical mailing list submissions to openldap-technical(a)openldap.org To subscribe or unsubscribe via the World Wide Web, visit http://www.openldap.org/lists/mm/listinfo/openldap-technical or, via email, send a message with subject or body 'help' to openldap-technical-request(a)openldap.org You can reach the person managing the list at openldap-technical-owner(a)openldap.org When replying, please edit your Subject line so it is more specific than "Re: Contents of openldap-technical digest..." Send openldap-technical mailing list submissions to openldap-technical(a)openldap.org When replying, please edit your Subject: header so it is more specific than "Re: openldap-technical digest..." Today's Topics: 1. Re: need to recover slapd password and upgrade openldap (Dan Hyatt) 2. Re: Antw: Intermediate certificates not being sent (Nat Sincheler) 3. Re: sizelimit (Maily Peng) 4. Missing user entries after restoring a backup ldif (Matt Spaulding) 5. password policies not functioning properly (Kruger, P (Justid)) 6. Re: sizelimit (Dieter Kl?nter) 7. Re: Antw: Intermediate certificates not being sent (Ulrich Windl) ---------------------------------------------------------------------- Message: 1 Date: Tue, 26 Jul 2016 12:15:00 -0500 From: Dan Hyatt <dhyatt(a)dsgmail.wustl.edu> To: Aaron Richton <richton(a)nbcs.rutgers.edu>, dhyatt(a)wustl.edu Cc: openldap-technical(a)openldap.org Subject: Re: need to recover slapd password and upgrade openldap Message-ID: <b5a9dc49-8420-ef20-0779-d65ddfcdcad7(a)dsgmail.wustl.edu> Content-Type: text/plain; charset=windows-1252; format=flowed So, a more simple question... Can I install a current version of OpenLDAP on a current RedHat/Centos server (specially built for this purpose. Then use slapcat to export the information from the old server, import it to the new server, where the admin password is not corrupt. Can I import the schemas or are there likely substantial changes to the schemas across versions? My goals are to create a new LDAP server running Centos/Redhat, transfer 20 users and allow them to keep their existing passwords, allow them to access my servers, and allow them authentication to samba. and create an LDAP slave (or cluster) not sure if syncrepl is the current way to go. I have root to the server, but I do not have the admin password to the Openldap 2.2 as it became corrupted somehow. On 07/24/2016 09:15 PM, Aaron Richton wrote: > On Fri, 22 Jul 2016, Dan Hyatt wrote: > >> My admin openLDAP 2.2 password became corrupt in the last week and I >> cannot > [...] >> I found some instructions which seem simple risky and no backout >> strategy. Simply running >> http://techiezone.rottigni.net/2011/12/change-root-dn-password-on-openldap/ >> > > That link (apparently from 2011) doesn't apply to your software from > 2003. There's no back-config in OpenLDAP 2.2. So don't try that... @(#) $OpenLDAP: slapd 2.2.13 (Nov 26 2010 07:45:22) $ mockbuild@x86-003.build.bos.redhat.com:/builddir/build/BUILD/openldap-2.2.13/openldap-2.2.13/build-servers/servers/slapd > > [...] >> Having the LDAP on two separate hyper visors (with local disks) to >> avoid the storage/authentication chicken/egg >> Is there a better upgrade plan > > Are you saying that your one and only LDAP server uses itself for its > own A&A? Authentication and Authorization? The server provides authentication and authorization for my group. The server only does LDAP and home dirs. I want to upgrade it to Centos 6.8 or Centos 7 (that is equal to redhat 6.8 or redhat 7) on a hypervisor with a slave running the current favored release. > > [...] >> I have the log files, is there a way to backout to last week without >> the admin password (which became corrupt last week). > > I'm not sure what you're referring to by "log files." The general-case > OpenLDAP backup tool is slapcat(8). Hopefully you have been running it > routinely. The resulting LDIF can be easily inspected; if you have > enough backups, you might even be able to find one without corruption. We took over responsibility the LDAP in December, there was not a happy handoff... no documenation..just the password and had to move it to the new VLAN. ------------------------------ Message: 2 Date: Tue, 26 Jul 2016 08:20:14 -0700 From: Nat Sincheler <fai1107(a)macrotex.net> To: Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de>, openldap-technical(a)openldap.org Subject: Re: Antw: Intermediate certificates not being sent Message-ID: <991f77f9-fd05-eb9b-7f07-f350c4a7bc68(a)macrotex.net> Content-Type: text/plain; charset=windows-1252; format=flowed On 7/25/2016 11:24 PM, Ulrich Windl wrote: >>>> Nat Sincheler <fai1107(a)macrotex.net> schrieb am 25.07.2016 um 19:06 in > Nachricht <c19c2a3a-3c90-5baa-43c7-800b050ea5b7(a)macrotex.net>: >> We have an OpenLDAP server that is listening on port 636 over ldaps. >> When I run >> >> openssl s_client -showcerts -connect ldap-server:636 >> >> I only see the host certificate. The intermediate and root certificates >> do *not* come through. > > If I di that on one of outr servers, I get: > Root CA > Intermediate CA > Server Certificate > > ... > New, TLSv1/SSLv3, Cipher is AES256-SHA > Server public key is 2048 bit > >> >> For this server I have in the file slapd.d/cn=config.ldif the setting >> >> olcTLSCACertificatePath: /etc/ssl/certs > > Hi! > > Here it works with these settings: > olcTLSCACertificatePath: /etc/ssl/certs > olcTLSCertificateFile: /etc/ssl/servercerts/slapd.pem > olcTLSCertificateKeyFile: /etc/ssl/private/slapd.key > > Could it be a permissions problem? Did you try to check the certificate chain with openssl (preferrable as LDAP user)? When I run the openssl s_client command I get no errors, but I also get no intermediate or root certificates sent. I see this in the output: "No client certificate CA names sent". It appears that OpenLDAP is not sending the intermediate or root certificates. However, if I put all the intermediate and root certificates into a single file and point olcTLSCACertificateFile at this file, those intermediate certificates _are_ sent. So, it appears that olcTLSCACertificateFile sends the certificates but but olcTLSCACertificatePath does not. Am I misunderstanding the purpose olcTLSCACertificatePath? Thanks. > > Regards, > Ulrich > >> >> I checked and all the intermediate and root certificates are in >> /etc/ssl/certs soft-linked via the usual OpenSSL rehash hash, e.g., >> >> lrwxrwxrwx 1 root root 42 Jul 14 19:03 b4261fc2.0 -> >> /etc/ssl/certs/incommon-usertrust-2024.pem >> >> Any idea why the intermediate and root certificates do not get sent to >> the LDAPS client? Is there something in the LDAP log that might give me >> a clue as to what is going on? > > > > ------------------------------ Message: 3 Date: Tue, 26 Jul 2016 19:47:27 +0200 From: Maily Peng <mpeng(a)keyyo.com> To: Frank Swasey <Frank.Swasey(a)uvm.edu> Cc: openldap-technical(a)openldap.org Subject: Re: sizelimit Message-ID: <6fedd3fe-f1c4-9897-0eae-3c77159add6d(a)keyyo.com> Content-Type: text/plain; charset="windows-1252"; Format="flowed" Hello Frank, Nope, the limits directive are unlimited on the provider. First of all, I need to have access to all of the entries on the consumers , in order to check EntryCSN between provider and consumers. I use the python script : check_syncrepl_extended that needs to bind provider and consumer via the same dn. That's why I could not use rootdn . ( not the same between slapd servers) . thank you Le 26/07/2016 ? 19:09, Frank Swasey a ?crit : > You have shown us what the syncrepl, sizelimit and limits look like on > your consumer. Have you got that limits directive also set up on your > provider? It is the provider that needs to allow your replication DN > to obtain unlimited entries. > >

1 0

In-Reply-To: AdHrvUgXFwns0ylwRzawJ6D0CewYvg==
by Kruger, P (Justid) 02 Aug '16

02 Aug '16

Just found the problem and the solution. It occurred that there was also a (probably mistakenly) second config module activated. The module I had configured with ppolicy, was not used. The extra module that was active, did not have the ppolicy overlay loaded. After correcting this, all seems to work as expected. -----Oorspronkelijk bericht----- Van: openldap-technical [mailto:openldap-technical-bounces@openldap.org] Namens openldap-technical-request(a)openldap.org Verzonden: donderdag 28 juli 2016 14:00 Aan: openldap-technical(a)openldap.org Onderwerp: openldap-technical Digest, Vol 104, Issue 21 Send openldap-technical mailing list submissions to openldap-technical(a)openldap.org To subscribe or unsubscribe via the World Wide Web, visit http://www.openldap.org/lists/mm/listinfo/openldap-technical or, via email, send a message with subject or body 'help' to openldap-technical-request(a)openldap.org You can reach the person managing the list at openldap-technical-owner(a)openldap.org When replying, please edit your Subject line so it is more specific than "Re: Contents of openldap-technical digest..." Send openldap-technical mailing list submissions to openldap-technical(a)openldap.org When replying, please edit your Subject: header so it is more specific than "Re: openldap-technical digest..." Today's Topics: 1. Re: need to recover slapd password and upgrade openldap (Dan Hyatt) 2. Re: Antw: Intermediate certificates not being sent (Nat Sincheler) 3. Re: sizelimit (Maily Peng) 4. Missing user entries after restoring a backup ldif (Matt Spaulding) 5. password policies not functioning properly (Kruger, P (Justid)) 6. Re: sizelimit (Dieter Kl?nter) 7. Re: Antw: Intermediate certificates not being sent (Ulrich Windl) ---------------------------------------------------------------------- Message: 1 Date: Tue, 26 Jul 2016 12:15:00 -0500 From: Dan Hyatt <dhyatt(a)dsgmail.wustl.edu> To: Aaron Richton <richton(a)nbcs.rutgers.edu>, dhyatt(a)wustl.edu Cc: openldap-technical(a)openldap.org Subject: Re: need to recover slapd password and upgrade openldap Message-ID: <b5a9dc49-8420-ef20-0779-d65ddfcdcad7(a)dsgmail.wustl.edu> Content-Type: text/plain; charset=windows-1252; format=flowed So, a more simple question... Can I install a current version of OpenLDAP on a current RedHat/Centos server (specially built for this purpose. Then use slapcat to export the information from the old server, import it to the new server, where the admin password is not corrupt. Can I import the schemas or are there likely substantial changes to the schemas across versions? My goals are to create a new LDAP server running Centos/Redhat, transfer 20 users and allow them to keep their existing passwords, allow them to access my servers, and allow them authentication to samba. and create an LDAP slave (or cluster) not sure if syncrepl is the current way to go. I have root to the server, but I do not have the admin password to the Openldap 2.2 as it became corrupted somehow. On 07/24/2016 09:15 PM, Aaron Richton wrote: > On Fri, 22 Jul 2016, Dan Hyatt wrote: > >> My admin openLDAP 2.2 password became corrupt in the last week and I >> cannot > [...] >> I found some instructions which seem simple risky and no backout >> strategy. Simply running >> http://techiezone.rottigni.net/2011/12/change-root-dn-password-on-openldap/ >> > > That link (apparently from 2011) doesn't apply to your software from > 2003. There's no back-config in OpenLDAP 2.2. So don't try that... @(#) $OpenLDAP: slapd 2.2.13 (Nov 26 2010 07:45:22) $ mockbuild@x86-003.build.bos.redhat.com:/builddir/build/BUILD/openldap-2.2.13/openldap-2.2.13/build-servers/servers/slapd > > [...] >> Having the LDAP on two separate hyper visors (with local disks) to >> avoid the storage/authentication chicken/egg >> Is there a better upgrade plan > > Are you saying that your one and only LDAP server uses itself for its > own A&A? Authentication and Authorization? The server provides authentication and authorization for my group. The server only does LDAP and home dirs. I want to upgrade it to Centos 6.8 or Centos 7 (that is equal to redhat 6.8 or redhat 7) on a hypervisor with a slave running the current favored release. > > [...] >> I have the log files, is there a way to backout to last week without >> the admin password (which became corrupt last week). > > I'm not sure what you're referring to by "log files." The general-case > OpenLDAP backup tool is slapcat(8). Hopefully you have been running it > routinely. The resulting LDIF can be easily inspected; if you have > enough backups, you might even be able to find one without corruption. We took over responsibility the LDAP in December, there was not a happy handoff... no documenation..just the password and had to move it to the new VLAN. ------------------------------ Message: 2 Date: Tue, 26 Jul 2016 08:20:14 -0700 From: Nat Sincheler <fai1107(a)macrotex.net> To: Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de>, openldap-technical(a)openldap.org Subject: Re: Antw: Intermediate certificates not being sent Message-ID: <991f77f9-fd05-eb9b-7f07-f350c4a7bc68(a)macrotex.net> Content-Type: text/plain; charset=windows-1252; format=flowed On 7/25/2016 11:24 PM, Ulrich Windl wrote: >>>> Nat Sincheler <fai1107(a)macrotex.net> schrieb am 25.07.2016 um 19:06 in > Nachricht <c19c2a3a-3c90-5baa-43c7-800b050ea5b7(a)macrotex.net>: >> We have an OpenLDAP server that is listening on port 636 over ldaps. >> When I run >> >> openssl s_client -showcerts -connect ldap-server:636 >> >> I only see the host certificate. The intermediate and root certificates >> do *not* come through. > > If I di that on one of outr servers, I get: > Root CA > Intermediate CA > Server Certificate > > ... > New, TLSv1/SSLv3, Cipher is AES256-SHA > Server public key is 2048 bit > >> >> For this server I have in the file slapd.d/cn=config.ldif the setting >> >> olcTLSCACertificatePath: /etc/ssl/certs > > Hi! > > Here it works with these settings: > olcTLSCACertificatePath: /etc/ssl/certs > olcTLSCertificateFile: /etc/ssl/servercerts/slapd.pem > olcTLSCertificateKeyFile: /etc/ssl/private/slapd.key > > Could it be a permissions problem? Did you try to check the certificate chain with openssl (preferrable as LDAP user)? When I run the openssl s_client command I get no errors, but I also get no intermediate or root certificates sent. I see this in the output: "No client certificate CA names sent". It appears that OpenLDAP is not sending the intermediate or root certificates. However, if I put all the intermediate and root certificates into a single file and point olcTLSCACertificateFile at this file, those intermediate certificates _are_ sent. So, it appears that olcTLSCACertificateFile sends the certificates but but olcTLSCACertificatePath does not. Am I misunderstanding the purpose olcTLSCACertificatePath? Thanks. > > Regards, > Ulrich > >> >> I checked and all the intermediate and root certificates are in >> /etc/ssl/certs soft-linked via the usual OpenSSL rehash hash, e.g., >> >> lrwxrwxrwx 1 root root 42 Jul 14 19:03 b4261fc2.0 -> >> /etc/ssl/certs/incommon-usertrust-2024.pem >> >> Any idea why the intermediate and root certificates do not get sent to >> the LDAPS client? Is there something in the LDAP log that might give me >> a clue as to what is going on? > > > > ------------------------------ Message: 3 Date: Tue, 26 Jul 2016 19:47:27 +0200 From: Maily Peng <mpeng(a)keyyo.com> To: Frank Swasey <Frank.Swasey(a)uvm.edu> Cc: openldap-technical(a)openldap.org Subject: Re: sizelimit Message-ID: <6fedd3fe-f1c4-9897-0eae-3c77159add6d(a)keyyo.com> Content-Type: text/plain; charset="windows-1252"; Format="flowed" Hello Frank, Nope, the limits directive are unlimited on the provider. First of all, I need to have access to all of the entries on the consumers , in order to check EntryCSN between provider and consumers. I use the python script : check_syncrepl_extended that needs to bind provider and consumer via the same dn. That's why I could not use rootdn . ( not the same between slapd servers) . thank you Le 26/07/2016 ? 19:09, Frank Swasey a ?crit : > You have shown us what the syncrepl, sizelimit and limits look like on > your consumer. Have you got that limits directive also set up on your > provider? It is the provider that needs to allow your replication DN > to obtain unlimited entries. > >

1 0

password policies not functioning as expected
by Kruger, P (Justid) 01 Aug '16

01 Aug '16

I've set password policies on my OpenLDAP 2.4. Unfortunately things do not work as expected and although extensively searched on forums and Google, I cannot get the proper results. What am I missing in what I did or should have done? What goes wrong: - Password policies seem not to be validated or I do get a failure message The failures depend on pwdinHistory setting to zero (no failure) to > 0 failure like given below 5798c94a <= acl_access_allowed: granted to database root 5798c94a bdb_modify_internal: replace userPassword 5798c94a bdb_modify_internal: replace pwdChangedTime 5798c94a bdb_modify_internal: add pwdHistory 5798c94a bdb_modify_internal: replace pwdChangedTime 5798c94a bdb_modify_internal: add pwdHistory 5798c94a bdb_modify_internal: 20 modify/add: pwdHistory: value #0 already exists 5798c94a hdb_modify: modify failed (20) 5798c94a send_ldap_result: conn=1000 op=18 p=3 5798c94a send_ldap_result: err=20 matched="" text="modify/add: pwdHistory: value #0 already exists" 5798c94a send_ldap_response: msgid=62 tag=103 err=20 ber_flush2: 61 bytes to sd 15 0000: 30 3b 02 01 3e 67 36 0a 01 14 04 00 04 2f 6d 6f 0;..>g6....../mo 0010: 64 69 66 79 2f 61 64 64 3a 20 70 77 64 48 69 73 dify/add: pwdHis 0020: 74 6f 72 79 3a 20 76 61 6c 75 65 20 23 30 20 61 tory: value #0 a 0030: 6c 72 65 61 64 79 20 65 78 69 73 74 73 lready exists ldap_write: want=61, written=61 0000: 30 3b 02 01 3e 67 36 0a 01 14 04 00 04 2f 6d 6f 0;..>g6....../mo 0010: 64 69 66 79 2f 61 64 64 3a 20 70 77 64 48 69 73 dify/add: pwdHis 0020: 74 6f 72 79 3a 20 76 61 6c 75 65 20 23 30 20 61 tory: value #0 a 0030: 6c 72 65 61 64 79 20 65 78 69 73 74 73 lready exists 5798c94a conn=1000 op=18 RESULT tag=103 err=20 text=modify/add: pwdHistory: value #0 already exists 5798c94a slap_graduate_commit_csn: removing 0x7f8a0c107960 20160727144634.392449Z#000000#000#000000 This makes, as far as I tested, no difference with just using a default policy or when using a default and specific policy with pwdPolicySubentry attribute in the user. I've used ACL's on my LDAP schema. My purpose: Use a default policy which basically says to use no policy Add a specific policy for users in a subtree. Below are the steps and LDAP LDIF files used to build the OpenLDAP. Included here are the LDIF files for: config, base and sub part of tree, replication ou and user, application users (service accounts), ldap managers ou, ACL's, OU's needed for application specific content, policy. Excluded here (but done) are the LDIF files for: enable logging, replication, TLS/SSL. The LDIF files first line contains the LDIF filename and the command used to apply them # ldapadd -Y EXTERNAL -H ldapi:/// -f 01_addrootpw.ldif dn: olcDatabase={0}config,cn=config changetype: modify add: olcRootPW olcRootPW: {SSHA}hashhashhashhashhashhash # ldapadd -Y EXTERNAL -H ldapi:/// -f 02_root-base.ldif # change olcRootPW to your Root password # change domain parts to your domain dn: olcDatabase={1}monitor,cn=config changetype: modify replace: olcAccess olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=Manager,ou=ldapbeheerders,dc=example,dc=nl" read by * none dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcSuffix olcSuffix: dc=example,dc=nl dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcRootDN olcRootDN: cn=Manager,ou=ldapbeheerders,dc=example,dc=nl dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcRootPW olcRootPW: {SSHA} hashhashhashhashhashhash dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcAccess olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=Manager,ou=ldapbeheerders,dc=example,dc=nl" write by anonymous auth by self write by * none olcAccess: {1}to dn.base="" by * read # ldapadd -x -D cn=Manager,ou=ldapbeheerders,dc=example,dc=nl -W -f 03_ldap-manager.ldif dn: dc=example,dc=nl objectClass: top objectClass: dcObject objectclass: organization o: example nl dc: example dn: ou=ldapbeheerders,dc=example,dc=nl objectclass: organizationalUnit ou: ldapbeheerders dn: cn=Manager,ou=ldapbeheerders,dc=example,dc=nl objectclass: organizationalRole cn: Manager description: Directory Manager # ldapadd -x -D cn=Manager,ou=ldapbeheerders,dc=example,dc=nl -W -f 04_replication_user.ldif dn: ou=replicatie,dc=example,dc=nl objectclass: organizationalUnit ou: replicatie description: replicatie groep dn: cn=replicator,ou=replicatie,dc=example,dc=nl cn: replicator sn: user objectClass: person userPassword: passwordincleartext # ldapadd -x -D cn=Manager,ou=ldapbeheerders,dc=example,dc=nl -W -f 05_applications.ldif # Create ou generic application scheme dn: ou=applicaties,dc=example,dc=nl objectclass: organizationalUnit ou: applicaties # Aanmaak ou APP1 applicatieschema dn: ou=APP1,dc=example,dc=nl objectclass: organizationalUnit ou: APP1 # Aanmaak ou APP2 applicatieschemas dn: ou=APP2,dc=example,dc=nl objectclass: organizationalUnit ou: APP2 # ldapadd -x -D cn=Manager,ou=ldapbeheerders,dc=example,dc=nl -W -f 06_ServiceAccounts.ldif dn: ou=ServiceAccounts,dc=example,dc=nl objectclass: organizationalUnit ou: ServiceAccounts description: Service Accounts Applicaties #Service account APP1 dn: cn=SAAPP1,ou=ServiceAccounts,dc=example,dc=nl cn: SAAPP1 sn: user objectClass: person userPassword: {SSHA}hashedpassword description: Service Account APP1 #Service account APP2 dn: cn=SAAPP2,ou=ServiceAccounts,dc=example,dc=nl cn: SAAPP2 sn: user objectClass: person userPassword: {SSHA} hashedpassword description: Service Account APP2 # ldapadd -x -D cn=Manager,ou=ldapbeheerders,dc=example,dc=nl -W -f 07_ACL.ldif dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcAccess olcAccess: to attrs=userPassword by anonymous auth by self write by * break olcAccess: to dn="ou=replicatie,dc=example,dc=nl" by self write by * none olcAccess: to * by dn.base="cn=replicator,ou=replicatie,dc=example,dc=nl" read by * break olcAccess: to dn.subtree="cn=default,ou=policies,dc=example,dc=nl" by dn.children="ou=ldapbeheerders,dc=example,dc=nl" write by * none olcAccess: to dn="ou=ldapbeheerders,dc=example,dc=nl" by dn.children="ou=ldapbeheerders,dc=example,dc=nl" write by * none olcAccess: to dn="ou=ServiceAccounts,dc=example,dc=nl" by self search by * none olcAccess: to dn.subtree="ou=applicaties,dc=example,dc=nl" by dn.children="ou=ServiceAccounts,dc=example,dc=nl" write by * none olcAccess: to dn.subtree="ou=APP1,dc=example,dc=nl" by dn.base="cn=SAAPP1,ou=ServiceAccounts,dc=example,dc=nl" write by * none olcAccess: to dn.subtree="ou=APP2,dc=example,dc=nl" by dn.base="cn=SAAPP2,ou=ServiceAccounts,dc=example,dc=nl" write by * none olcAccess: to dn.children="dc=example,dc=nl" by * read olcAccess: to dn.children="dc=nl" by * read # ldapadd -x -D cn=Manager,ou=ldapbeheerders,dc=example,dc=nl -W -f 08_Add-testusers.ldif dn: uid=APP1_1,ou=APP1gebruikers,ou=APP1,dc=example,dc=nl objectClass: inetOrgPerson objectClass: organizationalPerson ObjectClass: person objectClass: top uid: APP1_1 cn: APP1_1 gebruiker sn: gebruiker pwdPolicySubentry: cn=default,ou=policies,ou=APP1,dc=example,dc=nl dn: uid=APP1_2,ou=APP1gebruikers,ou=APP1,dc=example,dc=nl objectClass: inetOrgPerson objectClass: organizationalPerson ObjectClass: person objectClass: top uid: APP1_2 cn: APP1_2 gebruiker sn: gebruiker pwdPolicySubentry: cn=default,ou=policies,ou=APP1,dc=example,dc=nl dn: cn=APP2_1,ou=APP2gebruikers,ou=APP2,dc=example,dc=nl objectClass: inetOrgPerson objectClass: organizationalPerson ObjectClass: person objectClass: top uid: APP2_1 cn: APP2_1 gebruiker sn: gebruiker dn: cn=APP2_2,ou=APP2gebruikers,ou=APP2,dc=example,dc=nl objectClass: inetOrgPerson objectClass: organizationalPerson ObjectClass: person objectClass: top uid: APP2_2 cn: APP2_2 gebruiker sn: gebruiker dn: cn=APP2_3,ou=gebruikers,ou=applicaties,dc=example,dc=nl objectClass: inetOrgPerson objectClass: organizationalPerson ObjectClass: person objectClass: top uid: APP2_3 cn: APP2_3 gebruikercat sn: gebruiker dn: cn=APP2_4,ou=gebruikers,ou=applicaties,dc=example,dc=nl objectClass: inetOrgPerson objectClass: organizationalPerson ObjectClass: person objectClass: top uid: APP2_4 cn: APP2_4 gebruiker sn: gebruiker Below is the part where the password policies are configured. # ldapadd -Y EXTERNAL -H ldapi:/// -f P01_ppolicymodule.ldif dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModuleLoad: ppolicy.la olcModulePath: /usr/lib64/openldap # ldapadd -Y EXTERNAL -H ldapi:/// -f P02_ppolicyoverlay.ldif dn: olcOverlay=ppolicy,olcDatabase={2}hdb,cn=config objectClass: olcPPolicyConfig olcOverlay: ppolicy olcPPolicyDefault: cn=default,ou=policies,dc=example,dc=nl olcPPolicyUseLockout: TRUE olcPPolicyHashCleartext: TRUE # ldapadd -x -D 'cn=Manager,ou=ldapbeheerders,dc=example,dc=nl' -W -f P03_default_ppolicy.ldif dn: ou=policies,dc=example,dc=nl objectClass: top objectClass: organizationalUnit ou: policies dn: cn=default,ou=policies,dc=example,dc=nl objectClass: top objectClass: device objectClass: pwdPolicyChecker objectClass: pwdPolicy cn: default pwdAttribute: userPassword pwdInHistory: 8 pwdMinLength: 8 pwdMaxFailure: 5 pwdFailureCountInterval: 1800 pwdCheckQuality: 1 pwdMustChange: TRUE pwdGraceAuthNLimit: 0 pwdMaxAge: 7776000 pwdExpireWarning: 1209600 pwdLockoutDuration: 900 pwdLockout: TRUE pwdSafeModify: FALSE # ldapadd -x -D 'cn=Manager,ou=ldapbeheerders,dc=example,dc=nl' -W -f P04_APP1_ppolicies.ldif dn: ou=policies,ou=APP1,dc=example,dc=nl ou: policies objectClass: top objectClass: organizationalUnit dn: cn=default,ou=policies,ou=APP1,dc=example,dc=nl objectClass: top objectClass: device objectClass: pwdPolicy cn: default pwdAttribute: userPassword pwdAllowUserChange: TRUE pwdCheckQuality: 0 pwdExpireWarning: 374400 pwdFailureCountInterval: 1800 pwdGraceAuthNLimit: 5 pwdInHistory: 12 pwdLockout: TRUE pwdLockoutDuration: 0 pwdMaxAge: 2592000 pwdMaxFailure: 5 pwdMinAge: 0 pwdMinLength: 8 pwdMustChange: TRUE pwdSafeModify: FALSE

1 0

Directory management best practices?
by John Lewis 01 Aug '16

01 Aug '16

Are there any best practices on managing directories? For Instance, I want to authenticate trusted UNIX users and untrusted Django users in the same directory? What if I made completely different directory to manage contact information, but I want to replicate shards of it and give priority based on geographic location?

1 0

Re: openldap 2.4.44 + ITS 8432 patch still infinitely replicates
by Howard Chu 30 Jul '16

30 Jul '16

Paul B. Henson wrote: >> From: Quanah Gibson-Mount >> Sent: Friday, July 22, 2016 10:40 AM >> >> Also see ITS 8448. > > Ah, thanks much for the heads up on these additional issues. Perhaps it > would be safest for me to stick with 2.4.41 until a 2.4.45 is officially > released with fixes for both the replication loop and possible fallout from > its fix :). We've been pretty lucky with 2.4.41, knock on bits, it's been > very stable with no issues or problems that I've seen while we've been > running it. The bug noted in ITS#8460 is not present in 2.4 at all. Quanah is also running experimental backports of features from 2.5 and forgets to mention that sometimes. This particular issue is from 2.5 (and is now fixed in git). Most likely it's the same issue as #8448. You can disregard both of these. >> --On Thursday, July 21, 2016 5:47 PM -0700 Quanah Gibson-Mount >> <quanah(a)zimbra.com> wrote: >> >>> I would note that I've opened up two new ITSes for problems that only >>> occur on systems that have the ITS8432 fix. Still waiting on fixes for >>> those, which is why I haven't pushed the fix into RE24 yet. >>> >>> ITSes 8460 and 8462. >>> >>> --Quanah >>> >>> --On Thursday, July 21, 2016 2:59 PM -0700 "Paul B. Henson" >>> <henson(a)acm.org> wrote: >>> >>>>> From: Howard Chu >>>>> Sent: Thursday, July 21, 2016 3:36 AM >>>>> >>>>> The fix for #8432 only prevents the redundant mod from being >> processed >>>>> on a particular node. If other nodes are still accepting the redundant >>>>> op >>>> then yes, >>>>> it will continue to propagate. So yes, you need the patched code on > all >>>>> nodes. >>>> >>>> Okay, thanks for the clarification. I usually stage updates to avoid a >>>> complete outage at any given time. It's interesting though that I had >>>> never seen this problem running 2.4.41 until I introduced a 2.4.44 > system >>>> into the mix, and then it went away once I reverted that system back to >>>> 2.4.41. I wonder why that combination caused it to pop up suddenly. > I'll >>>> have to schedule a downtime window and update them all at once and >> see >>>> what happens. >>>> >>>> By any chance have you had the time to look at ITS 8444? The reporter >>>> says he sees a similar circular replication issue when the memberOf >>>> overlay is enabled, which we also use. >>>> >>>> Thanks much. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

4 4

Re: Antw: Intermediate certificates not being sent
by Howard Chu 28 Jul '16

28 Jul '16

Nat Sincheler wrote: > > > On 7/27/2016 11:19 PM, Ulrich Windl wrote: >>>>> Nat Sincheler <fai1107(a)macrotex.net> schrieb am 26.07.2016 um 17:20 in >> Nachricht <991f77f9-fd05-eb9b-7f07-f350c4a7bc68(a)macrotex.net>: >> >>> >>> On 7/25/2016 11:24 PM, Ulrich Windl wrote: >>>>>>> Nat Sincheler <fai1107(a)macrotex.net> schrieb am 25.07.2016 um 19:06 in >>>> Nachricht <c19c2a3a-3c90-5baa-43c7-800b050ea5b7(a)macrotex.net>: >>>>> We have an OpenLDAP server that is listening on port 636 over ldaps. >>>>> When I run >>>>> >>>>> openssl s_client -showcerts -connect ldap-server:636 >>>>> >>>>> I only see the host certificate. The intermediate and root certificates >>>>> do *not* come through. >>>> >>>> If I di that on one of outr servers, I get: >>>> Root CA >>>> Intermediate CA >>>> Server Certificate >>>> >>>> ... >>>> New, TLSv1/SSLv3, Cipher is AES256-SHA >>>> Server public key is 2048 bit >>>> >>>>> >>>>> For this server I have in the file slapd.d/cn=config.ldif the setting >>>>> >>>>> olcTLSCACertificatePath: /etc/ssl/certs >>>> >>>> Hi! >>>> >>>> Here it works with these settings: >>>> olcTLSCACertificatePath: /etc/ssl/certs >>>> olcTLSCertificateFile: /etc/ssl/servercerts/slapd.pem >>>> olcTLSCertificateKeyFile: /etc/ssl/private/slapd.key >>>> >>>> Could it be a permissions problem? Did you try to check the certificate >>> chain with openssl (preferrable as LDAP user)? >>> >>> When I run the openssl s_client command I get no errors, but I also get >>> no intermediate or root certificates sent. I see this in the output: "No >>> client certificate CA names sent". >> >> Hi! >> >> To me it looks like a problem with your certificates. Try to verify them >> using openssl, like this: >> openssl verify -CApath /etc/ssl/certs -verbose /etc/ssl/servercerts/slapd.pem >> /etc/ssl/servercerts/slapd.pem: OK > > % grep -R Certificate *.ldif > > olcTLSCACertificatePath: /etc/ssl/certs > olcTLSCertificateFile: /etc/ssl/certs/server.pem > olcTLSCertificateKeyFile: /etc/ssl/private/server.key > > % directory2:/etc/ldap# openssl verify -CApath /etc/ssl/certs -verbose > /etc/ssl/certs/server.pem > > /etc/ssl/certs/server.pem: OK > > So, the openssl command line can find the certificate chain. Why can't openldap? If your OpenLDAP build is not behaving the same as your OpenSSL build, then most likely your OpenLDAP was not built with OpenSSL. Otherwise, their behavior would match. You never provided essential information such as OS platform and OpenLDAP version, so nobody can give you definitive answers. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

Intermediate certificates not being sent
by Nat Sincheler 28 Jul '16

28 Jul '16

We have an OpenLDAP server that is listening on port 636 over ldaps. When I run openssl s_client -showcerts -connect ldap-server:636 I only see the host certificate. The intermediate and root certificates do *not* come through. For this server I have in the file slapd.d/cn=config.ldif the setting olcTLSCACertificatePath: /etc/ssl/certs I checked and all the intermediate and root certificates are in /etc/ssl/certs soft-linked via the usual OpenSSL rehash hash, e.g., lrwxrwxrwx 1 root root 42 Jul 14 19:03 b4261fc2.0 -> /etc/ssl/certs/incommon-usertrust-2024.pem Any idea why the intermediate and root certificates do not get sent to the LDAPS client? Is there something in the LDAP log that might give me a clue as to what is going on?

3 5

Multimaster syncrepl configuration
by Gurjot Kaur 28 Jul '16

28 Jul '16

Hello, I have a doubt in setting up multimaster syncrepl configuration. I just added syncrepl information for the "dn: olcDatabase={0}config,cn=config" and overlays for "dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config" in both the Master 1 and Master 2 servers. But I didn't add any syncrepl for "dn: olcDatabase={1}mdb,cn=config" for any server. While adding I got this error: modifying entry "olcDatabase={1}mdb,cn=config" ldap_modify: Server is unwilling to perform (53) additional info: shadow context; no update referral Nevertheless, what I am unable to understand is that my data is replicating in both the servers correctly. Is there no difference between adding syncrepl for config database or mdb database. Or adding syncrepl to config database is applicable for all the databases? Thanks, Gurjot Kaur "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

1 0

sizelimit
by Maily Peng 27 Jul '16

27 Jul '16

Hi all, I can not apply a limits directive to my slapd.conf. I need a user (cn=replicator,ou=AppUsers,dc=company,dc=net) to have read access to all entries of a database. The global sizelimits ( 1000) seems to override any other database directive. Each ldapsearch returns a " 4 Size limit exceeded". openldap version : 2.4.42 here is a sample of my slapd.conf ... # Define global ACLs to disable default read access. sizelimit 1000 timelimit 5 tool-threads 8 pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args ####################################################################### # database definitions ####################################################################### ######################################### # Directories DATABASE ######################################### database mdb suffix "ou=Directories,dc=company,dc=net" subordinate checkpoint 1024 5 dbnosync maxsize 10737418240 envflags writemap rootdn "cn=admin,dc=company,dc=net" # Mode 700 recommended. directory /var/lib/openldap/ldap # acl authz-regexp uid=([^,]*),cn=digest-md5,cn=auth ldap:///ou=company,dc=company,dc=net??sub?(&(objectclass=psnDirectoryContact)(cli=sipdefault:$1)) access to * by dn.exact="cn=replicator,ou=AppUsers,dc=company,dc=net" write by * break ........... access to dn.sub="ou=AppUsers,dc=company,dc=net" attrs=userpassword by anonymous auth by * none # Indices to maintain index cn,dc,sn,uid,mail,telephoneNumber pres,eq,sub index arecord,description eq index objectClass,macAddress,custID,locationID,zoneGroupPrefix,entryUUID,entryCSN pres,eq # Sync Repl overlay syncprov # all standard entries in the accesslog that were successful syncrepl rid=0 provider=ldap:// bindmethod=simple binddn="cn=user,ou=login,cn=system" credentials=secret searchbase="ou=Directories,dc=company,dc=net" logbase="cn=accesslog_directories" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" schemachecking=on type=refreshAndPersist retry="60 +" syncdata=accesslog #limits limits dn.exact="cn=replicator,ou=AppUsers,dc=company,dc=net" size=unlimited time=unlimited .... thanks in advance.

3 3

password policies not functioning properly
by Kruger, P (Justid) 27 Jul '16

27 Jul '16

I've set password policies on my OpenLDAP 2.4. Unfortunately things do not work as expected and although extensively searched on forums and Google, I cannot get the proper results. What am I missing in what I did or should have done? What goes wrong: - Password policies seem not to be validated or I do get a failure message The failures depend on pwdinHistory setting to zero (no failure) to > 0 failure like given below 5798c94a <= acl_access_allowed: granted to database root 5798c94a bdb_modify_internal: replace userPassword 5798c94a bdb_modify_internal: replace pwdChangedTime 5798c94a bdb_modify_internal: add pwdHistory 5798c94a bdb_modify_internal: replace pwdChangedTime 5798c94a bdb_modify_internal: add pwdHistory 5798c94a bdb_modify_internal: 20 modify/add: pwdHistory: value #0 already exists 5798c94a hdb_modify: modify failed (20) 5798c94a send_ldap_result: conn=1000 op=18 p=3 5798c94a send_ldap_result: err=20 matched="" text="modify/add: pwdHistory: value #0 already exists" 5798c94a send_ldap_response: msgid=62 tag=103 err=20 ber_flush2: 61 bytes to sd 15 0000: 30 3b 02 01 3e 67 36 0a 01 14 04 00 04 2f 6d 6f 0;..>g6....../mo 0010: 64 69 66 79 2f 61 64 64 3a 20 70 77 64 48 69 73 dify/add: pwdHis 0020: 74 6f 72 79 3a 20 76 61 6c 75 65 20 23 30 20 61 tory: value #0 a 0030: 6c 72 65 61 64 79 20 65 78 69 73 74 73 lready exists ldap_write: want=61, written=61 0000: 30 3b 02 01 3e 67 36 0a 01 14 04 00 04 2f 6d 6f 0;..>g6....../mo 0010: 64 69 66 79 2f 61 64 64 3a 20 70 77 64 48 69 73 dify/add: pwdHis 0020: 74 6f 72 79 3a 20 76 61 6c 75 65 20 23 30 20 61 tory: value #0 a 0030: 6c 72 65 61 64 79 20 65 78 69 73 74 73 lready exists 5798c94a conn=1000 op=18 RESULT tag=103 err=20 text=modify/add: pwdHistory: value #0 already exists 5798c94a slap_graduate_commit_csn: removing 0x7f8a0c107960 20160727144634.392449Z#000000#000#000000 This makes, as far as I tested, no difference with just using a default policy or when using a default and specific policy with pwdPolicySubentry attribute in the user. I've used ACL's on my LDAP schema. My purpose: Use a default policy which basically says to use no policy Add a specific policy for users in a subtree. Below are the steps and LDAP LDIF files used to build the OpenLDAP. Included here are the LDIF files for: config, base and sub part of tree, replication ou and user, application users (service accounts), ldap managers ou, ACL's, OU's needed for application specific content, policy. Excluded here (but done) are the LDIF files for: enable logging, replication, TLS/SSL. The LDIF files first line contains the LDIF filename and the command used to apply them # ldapadd -Y EXTERNAL -H ldapi:/// -f 01_addrootpw.ldif dn: olcDatabase={0}config,cn=config changetype: modify add: olcRootPW olcRootPW: {SSHA}hashhashhashhashhashhash # ldapadd -Y EXTERNAL -H ldapi:/// -f 02_root-base.ldif # change olcRootPW to your Root password # change domain parts to your domain dn: olcDatabase={1}monitor,cn=config changetype: modify replace: olcAccess olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=Manager,ou=ldapbeheerders,dc=example,dc=nl" read by * none dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcSuffix olcSuffix: dc=example,dc=nl dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcRootDN olcRootDN: cn=Manager,ou=ldapbeheerders,dc=example,dc=nl dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcRootPW olcRootPW: {SSHA} hashhashhashhashhashhash dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcAccess olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=Manager,ou=ldapbeheerders,dc=example,dc=nl" write by anonymous auth by self write by * none olcAccess: {1}to dn.base="" by * read # ldapadd -x -D cn=Manager,ou=ldapbeheerders,dc=example,dc=nl -W -f 03_ldap-manager.ldif dn: dc=example,dc=nl objectClass: top objectClass: dcObject objectclass: organization o: example nl dc: example dn: ou=ldapbeheerders,dc=example,dc=nl objectclass: organizationalUnit ou: ldapbeheerders dn: cn=Manager,ou=ldapbeheerders,dc=example,dc=nl objectclass: organizationalRole cn: Manager description: Directory Manager # ldapadd -x -D cn=Manager,ou=ldapbeheerders,dc=example,dc=nl -W -f 04_replication_user.ldif dn: ou=replicatie,dc=example,dc=nl objectclass: organizationalUnit ou: replicatie description: replicatie groep dn: cn=replicator,ou=replicatie,dc=example,dc=nl cn: replicator sn: user objectClass: person userPassword: passwordincleartext # ldapadd -x -D cn=Manager,ou=ldapbeheerders,dc=example,dc=nl -W -f 05_applications.ldif # Create ou generic application scheme dn: ou=applicaties,dc=example,dc=nl objectclass: organizationalUnit ou: applicaties # Aanmaak ou APP1 applicatieschema dn: ou=APP1,dc=example,dc=nl objectclass: organizationalUnit ou: APP1 # Aanmaak ou APP2 applicatieschemas dn: ou=APP2,dc=example,dc=nl objectclass: organizationalUnit ou: APP2 # ldapadd -x -D cn=Manager,ou=ldapbeheerders,dc=example,dc=nl -W -f 06_ServiceAccounts.ldif dn: ou=ServiceAccounts,dc=example,dc=nl objectclass: organizationalUnit ou: ServiceAccounts description: Service Accounts Applicaties #Service account APP1 dn: cn=SAAPP1,ou=ServiceAccounts,dc=example,dc=nl cn: SAAPP1 sn: user objectClass: person userPassword: {SSHA}hashedpassword description: Service Account APP1 #Service account APP2 dn: cn=SAAPP2,ou=ServiceAccounts,dc=example,dc=nl cn: SAAPP2 sn: user objectClass: person userPassword: {SSHA} hashedpassword description: Service Account APP2 # ldapadd -x -D cn=Manager,ou=ldapbeheerders,dc=example,dc=nl -W -f 07_ACL.ldif dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcAccess olcAccess: to attrs=userPassword by anonymous auth by self write by * break olcAccess: to dn="ou=replicatie,dc=example,dc=nl" by self write by * none olcAccess: to * by dn.base="cn=replicator,ou=replicatie,dc=example,dc=nl" read by * break olcAccess: to dn.subtree="cn=default,ou=policies,dc=example,dc=nl" by dn.children="ou=ldapbeheerders,dc=example,dc=nl" write by * none olcAccess: to dn="ou=ldapbeheerders,dc=example,dc=nl" by dn.children="ou=ldapbeheerders,dc=example,dc=nl" write by * none olcAccess: to dn="ou=ServiceAccounts,dc=example,dc=nl" by self search by * none olcAccess: to dn.subtree="ou=applicaties,dc=example,dc=nl" by dn.children="ou=ServiceAccounts,dc=example,dc=nl" write by * none olcAccess: to dn.subtree="ou=APP1,dc=example,dc=nl" by dn.base="cn=SAAPP1,ou=ServiceAccounts,dc=example,dc=nl" write by * none olcAccess: to dn.subtree="ou=APP2,dc=example,dc=nl" by dn.base="cn=SAAPP2,ou=ServiceAccounts,dc=example,dc=nl" write by * none olcAccess: to dn.children="dc=example,dc=nl" by * read olcAccess: to dn.children="dc=nl" by * read # ldapadd -x -D cn=Manager,ou=ldapbeheerders,dc=example,dc=nl -W -f 08_Add-testusers.ldif dn: uid=APP1_1,ou=APP1gebruikers,ou=APP1,dc=example,dc=nl objectClass: inetOrgPerson objectClass: organizationalPerson ObjectClass: person objectClass: top uid: APP1_1 cn: APP1_1 gebruiker sn: gebruiker pwdPolicySubentry: cn=default,ou=policies,ou=APP1,dc=example,dc=nl dn: uid=APP1_2,ou=APP1gebruikers,ou=APP1,dc=example,dc=nl objectClass: inetOrgPerson objectClass: organizationalPerson ObjectClass: person objectClass: top uid: APP1_2 cn: APP1_2 gebruiker sn: gebruiker pwdPolicySubentry: cn=default,ou=policies,ou=APP1,dc=example,dc=nl dn: cn=APP2_1,ou=APP2gebruikers,ou=APP2,dc=example,dc=nl objectClass: inetOrgPerson objectClass: organizationalPerson ObjectClass: person objectClass: top uid: APP2_1 cn: APP2_1 gebruiker sn: gebruiker dn: cn=APP2_2,ou=APP2gebruikers,ou=APP2,dc=example,dc=nl objectClass: inetOrgPerson objectClass: organizationalPerson ObjectClass: person objectClass: top uid: APP2_2 cn: APP2_2 gebruiker sn: gebruiker dn: cn=APP2_3,ou=gebruikers,ou=applicaties,dc=example,dc=nl objectClass: inetOrgPerson objectClass: organizationalPerson ObjectClass: person objectClass: top uid: APP2_3 cn: APP2_3 gebruikercat sn: gebruiker dn: cn=APP2_4,ou=gebruikers,ou=applicaties,dc=example,dc=nl objectClass: inetOrgPerson objectClass: organizationalPerson ObjectClass: person objectClass: top uid: APP2_4 cn: APP2_4 gebruiker sn: gebruiker Below is the part where the password policies are configured. # ldapadd -Y EXTERNAL -H ldapi:/// -f P01_ppolicymodule.ldif dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModuleLoad: ppolicy.la olcModulePath: /usr/lib64/openldap # ldapadd -Y EXTERNAL -H ldapi:/// -f P02_ppolicyoverlay.ldif dn: olcOverlay=ppolicy,olcDatabase={2}hdb,cn=config objectClass: olcPPolicyConfig olcOverlay: ppolicy olcPPolicyDefault: cn=default,ou=policies,dc=example,dc=nl olcPPolicyUseLockout: TRUE olcPPolicyHashCleartext: TRUE # ldapadd -x -D 'cn=Manager,ou=ldapbeheerders,dc=example,dc=nl' -W -f P03_default_ppolicy.ldif dn: ou=policies,dc=example,dc=nl objectClass: top objectClass: organizationalUnit ou: policies dn: cn=default,ou=policies,dc=example,dc=nl objectClass: top objectClass: device objectClass: pwdPolicyChecker objectClass: pwdPolicy cn: default pwdAttribute: userPassword pwdInHistory: 8 pwdMinLength: 8 pwdMaxFailure: 5 pwdFailureCountInterval: 1800 pwdCheckQuality: 1 pwdMustChange: TRUE pwdGraceAuthNLimit: 0 pwdMaxAge: 7776000 pwdExpireWarning: 1209600 pwdLockoutDuration: 900 pwdLockout: TRUE pwdSafeModify: FALSE # ldapadd -x -D 'cn=Manager,ou=ldapbeheerders,dc=example,dc=nl' -W -f P04_APP1_ppolicies.ldif dn: ou=policies,ou=APP1,dc=example,dc=nl ou: policies objectClass: top objectClass: organizationalUnit dn: cn=default,ou=policies,ou=APP1,dc=example,dc=nl objectClass: top objectClass: device objectClass: pwdPolicy cn: default pwdAttribute: userPassword pwdAllowUserChange: TRUE pwdCheckQuality: 0 pwdExpireWarning: 374400 pwdFailureCountInterval: 1800 pwdGraceAuthNLimit: 5 pwdInHistory: 12 pwdLockout: TRUE pwdLockoutDuration: 0 pwdMaxAge: 2592000 pwdMaxFailure: 5 pwdMinAge: 0 pwdMinLength: 8 pwdMustChange: TRUE pwdSafeModify: FALSE

1 0

Re: openldap 2.4.44 + ITS 8432 patch still infinitely replicates
by Howard Chu 26 Jul '16

26 Jul '16

Paul B. Henson wrote: > I upgraded one of the nodes of a four node MMR delta syncrepl openldap > system today to 2.4.44 + the backported ITS 8432 patch (the other three > nodes were still running 2.4.41, which all four had been running for > quite some time with no issues) and within a few hours they started blowing > up with the infinite replication issue referred to in ITS 8432, all the > accesslogs were filled with the same modification repeated over and > over. I ended up having to slapcat the db, restore the upgraded node to > 2.4.41, and then reload the db on all of them to recover. > >>From what I understand the bug was supposed to have existed in versions > before 2.4.44, but I had never seen it in 2.4.41, and backing out > to that version seems to have restored stability. I remember seeing > another ITS regarding an issue even with the 8432 patch applied if > you're using the memberOf overlay (although that number escapes me at > the moment), but I thought that only applied if you were updating group > memberships and the change that blew up my system was a password change. > > Is it possible updating one node to the fixed version somehow triggered > the bug in one of the other nodes? Do I need to upgrade all the nodes at > the same time? Or are there possibly still edge cases where 2.4.44 with > the patch are still broken? I did a test run of the upgrade in my dev > environment, including the staged rollout with temporarily mixed > versions, but it doesn't really have the same load and variety of access > patterns that production sees. The fix for #8432 only prevents the redundant mod from being processed on a particular node. If other nodes are still accepting the redundant op then yes, it will continue to propagate. So yes, you need the patched code on all nodes. > Thanks... > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

3 4

need to recover slapd password and upgrade openldap
by Dan Hyatt 26 Jul '16

26 Jul '16

My admin openLDAP 2.2 password became corrupt in the last week and I cannot log in as admin. I was hoping there was an easy recovery such as lunix has shutting down slapd, removing the hashed password, bringing it back up and resetting the blank password using slappasswd. I can't take a chance unless I know for sure. I have searched Google and read the admin manual. I inherited a system using open ldap server on an old redhat, and the slapd password was corrupted (or locked out by another admin????). this is openldap 2.2 on an old redhat box. I cannot risk having a group of users locked out for more than an hour because LDAP is down. What I need to do today is recover (reset) the slapd password so I can log into the database. I found some instructions which seem simple risky and no backout strategy. Simply running http://techiezone.rottigni.net/2011/12/change-root-dn-password-on-openldap/ After recovery of root. I was planning on 1. shutting down server, making a P2V copy for a hypervisor, then creating another ldap master and slave servers on redhat6 with openldap2.4 once I have this password issue resolved. Having the LDAP on two separate hyper visors (with local disks) to avoid the storage/authentication chicken/egg Is there a better upgrade plan I have the log files, is there a way to backout to last week without the admin password (which became corrupt last week).

3 4

Re: sizelimit
by Maily Peng 26 Jul '16

26 Jul '16

> You have to define the limit for the binddn you use in your syncrepl > definition ( 'cn=user,ou=login,cn=system' here), or change this binddn > to be the one for which you have an unlimited sizeLimit. Thanks for the advice Emmanuel. I finally put these lines on the global limits : /sizelimit size.soft=unlimited size.hard=1000// //timelimit time.soft=unlimited time.hard=5 /Tell me if i'm wrong but the hard limit is the absolute time /size the server will spend processing the request.

1 0

openldap 2.4.44 + ITS 8432 patch still infinitely replicates
by Paul B. Henson 21 Jul '16

21 Jul '16

I upgraded one of the nodes of a four node MMR delta syncrepl openldap system today to 2.4.44 + the backported ITS 8432 patch (the other three nodes were still running 2.4.41, which all four had been running for quite some time with no issues) and within a few hours they started blowing up with the infinite replication issue referred to in ITS 8432, all the accesslogs were filled with the same modification repeated over and over. I ended up having to slapcat the db, restore the upgraded node to 2.4.41, and then reload the db on all of them to recover. >From what I understand the bug was supposed to have existed in versions before 2.4.44, but I had never seen it in 2.4.41, and backing out to that version seems to have restored stability. I remember seeing another ITS regarding an issue even with the 8432 patch applied if you're using the memberOf overlay (although that number escapes me at the moment), but I thought that only applied if you were updating group memberships and the change that blew up my system was a password change. Is it possible updating one node to the fixed version somehow triggered the bug in one of the other nodes? Do I need to upgrade all the nodes at the same time? Or are there possibly still edge cases where 2.4.44 with the patch are still broken? I did a test run of the upgrade in my dev environment, including the staged rollout with temporarily mixed versions, but it doesn't really have the same load and variety of access patterns that production sees. Thanks...

1 0

openldap back-sql mysql wait_timeout
by Simon Ryf 20 Jul '16

20 Jul '16

Dear members, I have timeout issues with back-sql using mysql as backend (read-only). I could successfully setup open-ldap with back-sql querying from a mysql db. However there is a wait_timeout in mysql and if no query is being made for > then wait_timeout the slapd breaks and I have to restart it to connect to mysql again. http://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html As a workaround I could implement a cron-job to execute a query every x hour (depending on wait_timeout). However I would much more like that back-sql is able to (auto-)reconnect. I'm not a developer and have no idea how this can be done - maybe this is in the sql-wrap.c code? executing an ldap query after "wait_timeout" returns slapd.log: Jul 20 17:22:53 STAG-BCC slapd[2054]: ==>backsql_get_db_conn() Jul 20 17:22:53 STAG-BCC slapd[2054]: <==backsql_get_db_conn() Jul 20 17:22:53 STAG-BCC slapd[2054]: ==>backsql_attrlist_add(): adding "objectClass" to list Jul 20 17:22:53 STAG-BCC slapd[2054]: ==>backsql_dn2id("dc=bbn,dc=ch") matched expected Jul 20 17:22:53 STAG-BCC slapd[2054]: backsql_dn2id("dc=bbn,dc=ch"): id_query "SELECT id,keyval,oc_map_id,dn FROM ldap_entries WHERE dn=?" Jul 20 17:22:53 STAG-BCC slapd[2054]: backsql_dn2id("dc=bbn,dc=ch"): error executing query ("SELECT id,keyval,oc_map_id,dn FROM ldap_entries WHERE dn=?", "dc=bbn,dc=ch"): Jul 20 17:22:53 STAG-BCC slapd[2054]: Return code: -1 Jul 20 17:22:53 STAG-BCC slapd[2054]: nativeErrCode=2006 SQLengineState=08S01 msg="[MySQL][ODBC 5.1 Driver][mysqld-5.5.49-0+deb8u1]MySQL server has gone away" Jul 20 17:22:53 STAG-BCC slapd[2054]: <==backsql_dn2id("dc=bbn,dc=ch"): err=80 Any suggestions are most welcome Br Simon I'm using the following setup: ----------------------------- Debian Jessie x86_64 (up to date) Openldap-2.4.44 compiled from source with ./configure --enable-sql libmyodbc 5.1.10-3 mysql 5.5.49-9 odbc.ini: [ldapds] Driver = MySQL Description = BCC MySQL DB SERVER = 127.0.0.1 PORT = 3306 USER = ldap Password = ldap Database = prov_ldap SOCKET = /var/lib/mysql/mysql.sock odbcinst.ini: [MySQL] Description = ODBC for MySQL Driver = /usr/lib/x86_64-linux-gnu/odbc/libmyodbc.so Setup = /usr/lib/x86_64-linux-gnu/odbc/libodbcmyS.so FileUsage = 1 slapd.conf: include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/SIP.schema pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args loglevel any database sql suffix "dc=bbn,dc=ch" rootdn "dc=bbn,dc=ch" rootpw ldap dbname ldapds dbuser ldap dbpasswd ldap subtree_cond "ldap_entries.dn LIKE CONCAT('%',?)" insentry_stmt "INSERT INTO ldap_entries (dn,oc_map_id,parent,keyval) VALUES (?,?,?,?)" has_ldapinfo_dn_ru no #cachesize 0

1 0

is there a bug with SSSD
by Kaveh Ehsani 18 Jul '16

18 Jul '16

I have tried using SSSD to switch between ldap provider and consumer. I have: ldap_uri = provider.example.com ldap_backup_uri = consumer.example.com It works fine, until I stop the provider to see if the clients will look at the consumer. They don't. I set ldap_uri = consume.example.com and clear the cache both via sss_cache -E and deleting all the files in /var/lib/sss/db and restart sssd. Even though it starts fine, I have ldap_uri = provider.example.com inside the journalctl -xe file and complains that can not contact the ldapserver., which is intentionally switched off. Looks like ldap_uri is hard coded some where the first time it is set. I have opened a bug report, but no replies to it at the moment. This is the link for the bug report in case anyone is interested. https://bugs.centos.org/view.php?id=11174

3 2

using mdb backend on centos 7
by Kaveh Ehsani 18 Jul '16

18 Jul '16

I am trying to load the module for openldap mdb backend which is suppose to be located in /usr/lib64/openldap but it is not there. I am trying this ldif; dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulepath: /usr/lib64/openldap olcModuleload: back_mdb ldapadd -Y EXTERNAL -H ldap:/// -f mod-mdb.ldif Of course there re no back_bdb or back_hdb, do I not need to load the module first !? I am using centos 7, Thank you.

2 1

Re: OpenLDAP : ASN1 code compiled with ASNC1 compiler from Objective Systems
by Howard Chu 18 Jul '16

18 Jul '16

Sreekanth Sukumaran wrote: > Hi All, > > Does OpenLDAP uses ASN1 code compiled with the ASNC1 compiler from Objective > Systems? No. OpenLDAP uses its own liblber. In supporting component-based matching, we used the SNACC ASN.1 compiler but most of that code has been unused for several years now. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

OpenLDAP : ASN1 code compiled with ASNC1 compiler from Objective Systems
by Sreekanth Sukumaran 18 Jul '16

18 Jul '16

Hi All, Does OpenLDAP uses ASN1 code compiled with the ASNC1 compiler from Objective Systems? Thanks in advance. . -- Regards, Sreekanth

1 0

OpenLDAP ldapsearch issue
by Shashi Ranjan 18 Jul '16

18 Jul '16

Hi, I have a problem in OpenLDAP 2.4.11 with BDB backend. I search an LDIF entry using ldapsearch command. It is giving me correct result and fetching the entry as given below. ldapsearch -x -D cn=Manager,dc=my-domain,dc=COM -w secret -b ou=TEST,ou=people,dc=my-domain,dc=COM -s sub '(&(objectClass=organizationalUnit)(ou=test*))' -H ldap://localhost:1399 # extended LDIF # # LDAPv3 # base <ou=TEST,ou=people,dc=my-domain,dc=COM> with scope subtree # filter: (objectclass=organizationalUnit) # requesting: ALL # # TEST, people, my-domain.COM dn: ou=TEST,ou=people,dc=my-domain,dc=COM ou: TEST companyName: test objectClass: top objectClass: organizationalUnit # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 But when I am searching the same request from ldapbrowser it is giving me error code 32 - No Such object. Below is the short dump of slapd debugging logs: ############################################################################################ SRCH "ou=people,dc=my-domain,dc=COM" 1 0 20000 3600 0 begin get_filter AND begin get_filter_list begin get_filter EQUALITY ber_scanf fmt ({mm}) ber: ber_dump: buf=0x8f59820 ptr=0x8f59856 end=0x8f59903 len=173 0000: a3 21 04 0b 6f 62 6a 65 63 74 43 6c 61 73 73 04 .!..objectClass. 0010: 12 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 61 6c 55 .organizationalU 0020: 6e 69 74 a4 0c 04 02 6f 75 30 06 80 04 54 4f 55 nit....ou0...TES 0030: 53 30 7a 04 02 6f 75 04 0b 63 6f 6d 70 61 6e 79 T0z..ou..company 0040: 4e 61 6d 65 04 08 63 6f 64 65 44 49 53 45 04 11 Name..codeDISE.. 0050: 66 72 65 65 4c 61 62 65 6c 61 64 64 49 6e 66 6f freeLabeladdInfo 0060: 31 04 11 66 72 65 65 4c 61 62 65 6c 61 64 64 49 1..freeLabeladdI 0070: 6e 66 6f 32 04 11 66 72 65 65 4c 61 62 65 6c 61 nfo2..freeLabela 0080: 64 64 49 6e 66 6f 33 04 11 66 72 65 65 4c 61 62 ddInfo3..freeLab 0090: 65 6c 61 64 64 49 6e 66 6f 34 04 11 66 72 65 65 eladdInfo4..free 00a0: 4c 61 62 65 6c 61 64 64 49 6e 66 6f 35 LabeladdInfo5 end get_filter 0 begin get_filter SUBSTRINGS begin get_ssa ber_scanf fmt ({m) ber: ber_dump: buf=0x8f59820 ptr=0x8f59879 end=0x8f59903 len=138 0000: 00 0c 04 02 6f 75 30 06 80 04 54 4f 55 53 30 7a ....ou0...test0z 0010: 04 02 6f 75 04 0b 63 6f 6d 70 61 6e 79 4e 61 6d ..ou..companyNam 0020: 65 04 08 63 6f 64 65 44 49 53 45 04 11 66 72 65 e..codeDISE..fre 0030: 65 4c 61 62 65 6c 61 64 64 49 6e 66 6f 31 04 11 eLabeladdInfo1.. 0040: 66 72 65 65 4c 61 62 65 6c 61 64 64 49 6e 66 6f freeLabeladdInfo 0050: 32 04 11 66 72 65 65 4c 61 62 65 6c 61 64 64 49 2..freeLabeladdI 0060: 6e 66 6f 33 04 11 66 72 65 65 4c 61 62 65 6c 61 nfo3..freeLabela 0070: 64 64 49 6e 66 6f 34 04 11 66 72 65 65 4c 61 62 ddInfo4..freeLab 0080: 65 6c 61 64 64 49 6e 66 6f 35 eladdInfo5 ber_scanf fmt (m) ber: ber_dump: buf=0x8f59820 ptr=0x8f59881 end=0x8f59903 len=130 0000: 80 04 54 4f 55 53 30 7a 04 02 6f 75 04 0b 63 6f ..test0z..ou..co 0010: 6d 70 61 6e 79 4e 61 6d 65 04 08 63 6f 64 65 44 mpanyName..codeD 0020: 49 53 45 04 11 66 72 65 65 4c 61 62 65 6c 61 64 ISE..freeLabelad 0030: 64 49 6e 66 6f 31 04 11 66 72 65 65 4c 61 62 65 dInfo1..freeLabe 0040: 6c 61 64 64 49 6e 66 6f 32 04 11 66 72 65 65 4c laddInfo2..freeL 0050: 61 62 65 6c 61 64 64 49 6e 66 6f 33 04 11 66 72 abeladdInfo3..fr 0060: 65 65 4c 61 62 65 6c 61 64 64 49 6e 66 6f 34 04 eeLabeladdInfo4. 0070: 11 66 72 65 65 4c 61 62 65 6c 61 64 64 49 6e 66 .freeLabeladdInf 0080: 6f 35 o5 INITIAL end get_ssa end get_filter 0 end get_filter_list end get_filter 0 filter: (&(objectClass=organizationalUnit)(ou=test*)) ber_scanf fmt ({M}}) ber: ber_dump: buf=0x8f59820 ptr=0x8f59887 end=0x8f59903 len=124 0000: 00 7a 04 02 6f 75 04 0b 63 6f 6d 70 61 6e 79 4e .z..ou..companyN 0010: 61 6d 65 04 08 63 6f 64 65 44 49 53 45 04 11 66 ame..codeDISE..f 0020: 72 65 65 4c 61 62 65 6c 61 64 64 49 6e 66 6f 31 reeLabeladdInfo1 0030: 04 11 66 72 65 65 4c 61 62 65 6c 61 64 64 49 6e ..freeLabeladdIn 0040: 66 6f 32 04 11 66 72 65 65 4c 61 62 65 6c 61 64 fo2..freeLabelad 0050: 64 49 6e 66 6f 33 04 11 66 72 65 65 4c 61 62 65 dInfo3..freeLabe 0060: 6c 61 64 64 49 6e 66 6f 34 04 11 66 72 65 65 4c laddInfo4..freeL 0070: 61 62 65 6c 61 64 64 49 6e 66 6f 35 abeladdInfo5 attrs: ou companyName codeDISE freeLabeladdInfo1 freeLabeladdInfo2 freeLabeladdInfo3 freeLabeladdInfo4 freeLabeladdInfo5 conn=1 op=1 SRCH base="ou=people,dc=my-domain,dc=COM" scope=1 deref=0 filter="(&(objectClass=organizationalUnit)(ou=test*))" conn=1 op=1 SRCH attr=ou companyName codeDISE freeLabeladdInfo1 freeLabeladdInfo2 freeLabeladdInfo3 freeLabeladdInfo4 freeLabeladdInfo5 => bdb_search bdb_dn2entry("ou=people,dc=my-domain,dc=com") => access_allowed: disclose access to "dc=my-domain,dc=COM" "entry" requested <= root access granted => access_allowed: disclose access granted by manage(=mwrscxd) send_ldap_result: conn=1 op=1 p=3 send_ldap_result: err=10 matched="dc=my-domain,dc=COM" text="" send_ldap_response: msgid=4803 tag=101 err=32 ber_flush2: 31 bytes to sd 13 0000: 30 1d 02 02 12 c3 65 17 0a 01 20 04 10 64 63 3d 0.....e... ..dc= 0010: 4f 52 41 4e 47 45 2c 64 63 3d 43 4f 4d 04 00 my-domain,dc=COM.. ldap_write: want=31, written=31 0000: 30 1d 02 02 12 c3 65 17 0a 01 20 04 10 64 63 3d 0.....e... ..dc= 0010: 4f 52 41 4e 47 45 2c 64 63 3d 43 4f 4d 04 00 my-domain,dc=COM.. conn=1 op=1 SEARCH RESULT tag=101 err=32 nentries=0 text= daemon: activity on 1 descriptor daemon: activity on: 13r daemon: read active on 13 ############################################################################################ Can you please tell me what is the problem in these two? Thanks Shashi Ranjan "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

3 3

RE: Antw: replication issue with MDB in ldapadd
by Gurjot Kaur 18 Jul '16

18 Jul '16

Yes, I agree with you. My basic question is that how come the same scenario is supported in the older version but not in latest OpenLDAP 2.4.44 with MDB backend. During this scenario, contextCSNs of both the MM1 and MM2 get updated correctly on MDB (OpenLDAP 2.4.44) and BDB (OpenLDAP 2.4.11) See below the contextCSN values of MM1 and MM2. ######################### MM1 on BDB (OpenLDAP 2.4.11) ######################### contextCSN: 20160718052917.405929Z#000000#000#000000 contextCSN: 20160718053109.639168Z#000000#001#000000 contextCSN: 20160718053249.495430Z#000000#002#000000 ######################### MM2 on BDB (OpenLDAP 2.4.11) ######################### contextCSN: 20160718052917.405929Z#000000#000#000000 contextCSN: 20160718053249.495430Z#000000#002#000000 contextCSN: 20160718053109.639168Z#000000#001#000000 ######################### MM1 on MDB (OpenLDAP 2.4.44) ######################### contextCSN: 20160717234101.093387Z#000000#000#000000 contextCSN: 20160717234320.498152Z#000000#001#000000 contextCSN: 20160717234453.544103Z#000000#002#000000 ######################### MM2 on MDB (OpenLDAP 2.4.44) ######################### contextCSN: 20160717234101.093387Z#000000#000#000000 contextCSN: 20160717234320.498152Z#000000#001#000000 contextCSN: 20160717234453.544103Z#000000#002#000000 >From the contextCSNs values on both backends I got that MM1 and MM2 are in sync. When I did slapcat on BDB, I found that LDIF entries with entryCSN equals to three contextCSN with i.e. server id #000, #001 and #002 are present in the LDIF files (attached files 'slapcatExportMM1_BDB.ldif' and 'slapcatExportMM2_BDB.ldif'). When I did slapcat on MDB, I found that LDIF entries with entryCSN equals to contextCSN with i.e. server id #000 and #002 are present in the LDIF file (exported file) but LDIF with entryCSN equals to contextCSN with server id #001 is not present in LDIF files (attached files 'slapcatExportMM1_MDB.ldif' and 'slapcatExportMM2_MDB.ldif'). Is it possible that contextCSN value is updated in the MDB but LDIF entry is not present in the DB corresponding to the same contextCSN? Thanks Gurjot Kaur -----Original Message----- From: Ulrich Windl [mailto:Ulrich.Windl@rz.uni-regensburg.de] Sent: Friday, July 15, 2016 4:56 PM To: Gurjot Kaur <gurjot.kaur(a)aricent.com>; openldap-technical(a)openldap.org Subject: Antw: replication issue with MDB in ldapadd >>> Gurjot Kaur <gurjot.kaur(a)aricent.com> schrieb am 15.07.2016 um 11:39 >>> in Nachricht <KL1PR04MB1205CDDF22D4A812AA099785E1330(a)KL1PR04MB1205.apcprd04.prod.outlook.com> > Hello, > > I have encountered with a problem in OpenLDAP2.4.44 with MDB backend. > I have two LDAP servers in Multi Master Mode MM1 and MM2. I am doing > the following steps: > 1. Both the LDAP DBs MM1 and MM2 have existing LDIF entries. > 2.Start MM1. Stop MM2. > 3. Add an entry A to MM1 using ldapadd. Stop MM1. > 4. Start MM2. Add LDIF entry B to MM2 using ldapadd. > 5. Start MM1. > > I am getting the below result. > The last added entry i.e. B in MM2 gets replicated to MM1. But LDIF > entry A doesn't get replicated to MM2. > But this scenario works fine in OpenLDAP 2.4.11 with BDB backend. It > replicates entry A to MM2 and entry B to MM1 correctly. > > How the above scenario with MBD in 2.4.44 can be avoided? As this is > very common scenario. It is a very common scenario that both LDAP servers are down at the same time? It is very common that one server is down? I think replication basically works like this: If a consumer gets an update from a provider, it is assumed to be up to date regarding that provider. I'm not sure whether your situation can be resolved. Ulrich > > Thanks > Gurjot Kaur > > "DISCLAIMER: This message is proprietary to Aricent and is intended > solely for the use of the individual to whom it is addressed. It may > contain privileged or confidential information and should not be > circulated or used for any purpose other than for what it is intended. > If you have received this message in error, please notify the > originator immediately. If you are not the intended recipient, you are > notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. > Aricent accepts no responsibility for loss or damage arising from the > use of the information transmitted by this email including damage from virus." "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

1 0

sssd.conf bug using parameter ldap_uri
by Kaveh Ehsani 15 Jul '16

15 Jul '16

I have filed this bug report with centos as I believe sssd has a bug with regard to ldap_uri as it does not change value affter initial starting of sssd, another words when I change the ldap_uri to another server and restart sssd it maintains the original value. Wonder if anyone else has the same encountered the same problem. Within sssd.conf on the client side of a ldapserver I have set : ldap_uri = simple-provider.example.com ldap_backup_uri = clone-provider.example.com It works fine, but when I take down the simple-provider.example.com (all are virtual boxes), it fails to change over to the back up or secondary which is clone-provider.example.com. I clean the cahce sss_cache -E, I delete all the files under /var/lib/sss/db, and I even change the ldap_uri = clone-provider.example.com and restart sssd I still have : [838cb2] <group/member="root"> ldap_start_tls_s() failed (uri=ldaps://simple-provider.example.com): Can't contact LDAP server: Transport endpoint It is still looking at the old server simple-provider and not clone-provider. It seems once set, it can not be reconfigured. Steps To Reproduce On a virtual box, inside /etc/sssd/sssd.conf ldap_uri = simple-provider.example.com ldap_backup_uri = clone-provider.example.com initially, and start sssd, then either swith them or simply put ldap_uri = clone-provider.example.com and restart sssd, the uri = .... does not change. Additional Information authconfig --ldapserver=simple-provider.example,clone-provider.example.com has the same issue, but if you switch the two servers it will accept the first one. sssd does not seem to do so. This is the link for authconfig bug report on redhat: https://bugzilla.redhat.com/show_bug.cgi?id=1142830 [^<https://bugzilla.redhat.com/show_bug.cgi?id=1142830>]

1 0

replication issue with MDB in ldapadd
by Gurjot Kaur 15 Jul '16

15 Jul '16

Hello, I have encountered with a problem in OpenLDAP2.4.44 with MDB backend. I have two LDAP servers in Multi Master Mode MM1 and MM2. I am doing the following steps: 1. Both the LDAP DBs MM1 and MM2 have existing LDIF entries. 2.Start MM1. Stop MM2. 3. Add an entry A to MM1 using ldapadd. Stop MM1. 4. Start MM2. Add LDIF entry B to MM2 using ldapadd. 5. Start MM1. I am getting the below result. The last added entry i.e. B in MM2 gets replicated to MM1. But LDIF entry A doesn't get replicated to MM2. But this scenario works fine in OpenLDAP 2.4.11 with BDB backend. It replicates entry A to MM2 and entry B to MM1 correctly. How the above scenario with MBD in 2.4.44 can be avoided? As this is very common scenario. Thanks Gurjot Kaur "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

1 0

ContextCSN doesn't get updated correctly
by Gurjot Kaur 14 Jul '16

14 Jul '16

Hi, I have a doubt in the difference of contextCSN of two OpenLDAP servers where one is installed with BDB backend (version 2.4.11) and the other one is installed with MDB backend (version 2.4.44). An LDIF entry "dn: ou=grp_71,ou=people,dc=my-domain,dc=com" was already existing in both the DBs. The following two LDIF entries were added again using slapadd with -w option enabled. dn: ou=grp_71,ou=people,dc=my-domain,dc=com [ Old entry ] dn: ou=alpha,ou=people,dc=my-domain,dc=com [ New entry ] In BDB backend LDAP server, contextCSN gets updated with the latest added entryCSN ( i.e. entryCSN of "dn: ou=alpha,ou=people,dc=my-domain,dc=com"). But in MDB backend LDAP server, contextCSN doesn't get updated with the latest added entryCSN. Rather it still has the old entryCSN value ( i.e. entryCSN of "dn: ou=grp_71,ou=people,dc=my-domain,dc=com") Please let me know, why is it so? Is this correct? Below is the short dump of slapcat from both the servers. ################################################### BDB backend (version 2.4.11) ################################################### dn: dc=my-domain,dc=com dc: my-domain objectClass: dcObject objectClass: organization o: my-domain structuralObjectClass: organization entryUUID: 3a896474-dba7-1035-95f9-abdba6d92f92 creatorsName: cn=Manager,dc=my-domain,dc=com createTimestamp: 20160711113452Z entryCSN: 20160711113452.876767Z#000000#000#000000 modifiersName: cn=Manager,dc=my-domain,dc=com modifyTimestamp: 20160711113452Z contextCSN: 20160711113900.374218Z#000000#000#000000 dn: cn=Manager,dc=my-domain,dc=com objectClass: organizationalRole cn: Manager structuralObjectClass: organizationalRole entryUUID: 3a8ae100-dba7-1035-95fa-abdba6d92f92 creatorsName: cn=Manager,dc=my-domain,dc=com createTimestamp: 20160711113452Z entryCSN: 20160711113452.886601Z#000000#000#000000 modifiersName: cn=Manager,dc=my-domain,dc=com modifyTimestamp: 20160711113452Z dn: ou=people,dc=my-domain,dc=com ou: people objectClass: organizationalUnit objectClass: top companyName: aricent structuralObjectClass: organizationalUnit entryUUID: 3a8b836c-dba7-1035-95fb-abdba6d92f92 creatorsName: cn=Manager,dc=my-domain,dc=com createTimestamp: 20160711113452Z entryCSN: 20160711113452.890761Z#000000#000#000000 modifiersName: cn=Manager,dc=my-domain,dc=com modifyTimestamp: 20160711113452Z dn: ou=grp_71,ou=people,dc=my-domain,dc=com ou: grp_71 objectClass: organizationalUnit companyName: aricent4 structuralObjectClass: organizationalUnit entryUUID: 9231b848-dba7-1035-9211-3f7458963df7 creatorsName: cn=Manager,dc=my-domain,dc=com createTimestamp: 20160711113719Z entryCSN: 20160711113719.941790Z#000000#000#000000 modifiersName: cn=Manager,dc=my-domain,dc=com modifyTimestamp: 20160711113719Z dn: ou=alpha,ou=people,dc=my-domain,dc=com ou: alpha objectClass: organizationalUnit companyName: aricent2 structuralObjectClass: organizationalUnit entryUUID: ce0e7de2-dba7-1035-86a6-852dc551e076 creatorsName: cn=Manager,dc=my-domain,dc=com createTimestamp: 20160711113900Z entryCSN: 20160711113900.374218Z#000000#000#000000 modifiersName: cn=Manager,dc=my-domain,dc=com modifyTimestamp: 20160711113900Z ################################################### MDB backend (version 2.4.44) ################################################### dn: dc=my-domain,dc=com dc: my-domain objectClass: dcObject objectClass: organization o: my-domain structuralObjectClass: organization entryUUID: 95197aa4-db76-1035-8cd9-9f963a69ea08 creatorsName: cn=Manager,dc=my-domain,dc=com createTimestamp: 20160711054639Z entryCSN: 20160711054639.476247Z#000000#000#000000 modifiersName: cn=Manager,dc=my-domain,dc=com modifyTimestamp: 20160711054639Z contextCSN: 20160711054904.666167Z#000000#000#000000 dn: cn=Manager,dc=my-domain,dc=com objectClass: organizationalRole cn: Manager structuralObjectClass: organizationalRole entryUUID: 951bbbde-db76-1035-8cda-9f963a69ea08 creatorsName: cn=Manager,dc=my-domain,dc=com createTimestamp: 20160711054639Z entryCSN: 20160711054639.491130Z#000000#000#000000 modifiersName: cn=Manager,dc=my-domain,dc=com modifyTimestamp: 20160711054639Z dn: ou=people,dc=my-domain,dc=com ou: people objectClass: organizationalUnit objectClass: top companyName: aricent structuralObjectClass: organizationalUnit entryUUID: 951d7f64-db76-1035-8cdb-9f963a69ea08 creatorsName: cn=Manager,dc=my-domain,dc=com createTimestamp: 20160711054639Z entryCSN: 20160711054639.502690Z#000000#000#000000 modifiersName: cn=Manager,dc=my-domain,dc=com modifyTimestamp: 20160711054639Z dn: ou=grp_71,ou=people,dc=my-domain,dc=com ou: grp_71 objectClass: organizationalUnit companyName: aricent4 structuralObjectClass: organizationalUnit entryUUID: eba3afca-db76-1035-9667-b5e8d6738a99 creatorsName: cn=Manager,dc=my-domain,dc=com createTimestamp: 20160711054904Z entryCSN: 20160711054904.666167Z#000000#000#000000 modifiersName: cn=Manager,dc=my-domain,dc=com modifyTimestamp: 20160711054904Z dn: ou=alpha,ou=people,dc=my-domain,dc=com ou: alpha objectClass: organizationalUnit companyName: aricent2 structuralObjectClass: organizationalUnit entryUUID: 27ed19c6-db77-1035-82e2-f54af7597a9e creatorsName: cn=Manager,dc=my-domain,dc=com createTimestamp: 20160711055045Z entryCSN: 20160711055045.810589Z#000000#000#000000 modifiersName: cn=Manager,dc=my-domain,dc=com modifyTimestamp: 20160711055045Z Please let me know, why is it so? Is this correct? Best Regards, Gurjot Kaur "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

2 2

AttributeType not found but I have this attribute
by Jose Legido 13 Jul '16

13 Jul '16

Hello. I'm trying to modify schema (importing from AD) but i have a problem whith some objectclasses: ldap_initialize( ldapi:///??base ) add olcobjectClasses: ( 1.2.840.113556.1.5.263 NAME 'msImaging-PostScanProcess' SUP top STRUCTURAL MUST ( displayName $ msImaging-PSPIdentifier ) MAY (serverName $ msImaging-PSPString ) ) modifying entry "cn={1}core,cn=schema,cn=config" modify complete But when I do a test: 57850fb8 olcObjectClasses: value #447 olcObjectClasses: AttributeType not found: "displayName" 57850fb8 config error processing cn={1}core,cn=schema,cn=config: olcObjectClasses: AttributeType not found: "displayName" slaptest: bad configuration file! But I have this attribute: ldapsearch -LLL -H ldap://127.0.0.1 -x -s base -b "CN=Subschema" attributetypes -v attributeTypes: ( 2.16.840.1.113730.3.1.241 NAME 'displayName' DESC 'RFC2798: preferred name to be used when displaying entries' EQUALITY caseIgnoreMatch S UBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-V ALUE ) I have openldap 2.4.40 with mode config and inetorgperson.ldif in cn=schema Thank you!

2 2

Do you have any recommendations of utilities for manipulating rfc2307 attributes?
by John Lewis 12 Jul '16

12 Jul '16

I would like to manipulate the attributes described in in rfc2307 https://www.ietf.org/rfc/rfc2307.txt. Do you have any recommendations of utilities that do that?

4 3

ContextCSN showing Junk Characters
by scn_73＠yahoo.com 08 Jul '16

08 Jul '16

Hi, My ldapmaster ContextCSN showing Junk Characters. Please advice how can reset to valid one. contextCSN:: 0CKRuTQrAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA= CentOS 5.8Openldap Version is OpenLDAP: slapd 2.3.43 - Sachin

3 4

How does a client changes from provider to consumer when provider is down
by Kaveh Ehsani 07 Jul '16

07 Jul '16

I have setup a provider/replicator(consumer) with a client and all functioning well. Except when I switch off the provider, the client does not read from the consumer. Of course I have not told the client to do so any where, not sure where to do this. I can set it up manually but there has to be a way for a switch to take place automatically. Thanks, for all the feedbacks.

2 1

MDB data replication issues
by Gurjot Kaur 07 Jul '16

07 Jul '16

Hi, I am using a OpenLDAP 2.4.44 Multi master configuration with two slapd servers, master and replica using MDB backend. I got a problem in replicating when the data is added using slapadd. I have two slapd with ports 2016 and 2017. slapd.conf file for both the servers are attached. Scenario 1: When an LDIF entry is added using ldapadd or deleted using ldapdelete, it gets replicated in the replica server correctly. Below is the ldapsearch result om Master server: GURKES254 linus> ldapsearch -h xx.xx.xx.xx -p 2016 -b "dc=my-domain,dc=com" "ou=Test9" # extended LDIF # # LDAPv3 # base <dc=my-domain,dc=com> with scope subtree # filter: ou=Test9 # requesting: ALL # # Test9, people, my-domain.com dn: ou=Test9,ou=people,dc=my-domain,dc=com ou: Test9 objectClass: organizationalUnit companyName: Test9Grp # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Below is the ldapsearch result om replica server: GURKES254 linus> ldapsearch -h xx.xx.xx.xx -p 2017 -b "dc=my-domain,dc=com" "ou=Test9" # extended LDIF # # LDAPv3 # base <dc=my-domain,dc=com> with scope subtree # filter: ou=Test9 # requesting: ALL # # Test9, people, my-domain.com dn: ou=Test9,ou=people,dc=my-domain,dc=com ou: Test9 objectClass: organizationalUnit companyName: Test9Grp # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Scenario 2: When an LDIF entry is imported using slapadd, it doesn't get replicated in the replica server at all. Below is the ldapsearch result om Master server: GURKES254 linus> ldapsearch -h xx.xx.xx.xx -p 2016 -b "dc=my-domain,dc=com" "ou=Test9" # extended LDIF # # LDAPv3 # base <dc=my-domain,dc=com> with scope subtree # filter: ou=Test9 # requesting: ALL # # Test9, people, my-domain.com dn: ou=Test9,ou=people,dc=my-domain,dc=com ou: Test9 objectClass: organizationalUnit companyName: Test9Grp # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Below is the ldapsearch result om replica server: GURKES254 linus> ldapsearch -h xx.xx.xx.xx -p 2017 -b "dc=my-domain,dc=com" "ou=Test9" # extended LDIF # # LDAPv3 # base <dc=my-domain,dc=com> with scope subtree # filter: ou=Test9 # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 Please let me know in case any other information is required. Br Gurjot Kaur "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

7 18

unclear documentation about openldap ACL definitions
by Florian Best 06 Jul '16

06 Jul '16

Hello, studying the slapd.access man page left me with an open question regarding the control of object creation: * How to allow the creation of objects with a specific objectclass only? For example, I want to prevent that an object with a object class other than 'foobar' is created. Assumming the following LDIF should be valid for an "add" operation: > dn: uid=anton1,cn=settings,dc=ldap,dc=base > objectClass: foobar > uid: anton1 And this one to be invalid: > dn: uid=anton1,cn=settings,dc=ldap,dc=base > objectClass: CourierMailAccount > objectClass: univentionAdminUserSettings > uid: anton1 > uidNumber: 0 > gidNumber: 0 All of the following examples aren't doing their job when *creating* an entry. Most of them (and even more simple ones) work fine when *modifying* an entry: ## 1. a attribute blacklist ## access to dn="cn=settings,dc=ldap,dc=base" attrs="entry,children" by users write by * +0 break access to dn.regex="^uid=([^,]+),cn=settings,dc=ldap,dc=base$" filter="objectClass=foobar" attrs=!foobar by dn.regex="^uid=$1,.*dc=ldap,dc=base$$" none by * +0 break access to dn.regex="^uid=([^,]+),cn=settings,dc=ldap,dc=base$" filter="objectClass=foobar" attrs=entry,@foobar by dn.regex="^uid=$1,.*dc=ldap,dc=base$$" write by * none ################## → does probably not work because "!foobar" also disallows "objectClass"? ## 2. a negative regex blacklist ## access to dn="cn=settings,dc=ldap,dc=base" attrs="entry,children" by users write by * +0 break access to dn.regex="^uid=([^,]+),cn=settings,dc=ldap,dc=base$" attrs=objectClass val.regex="^([^f]|f[^o]|fo[^o]|foo[^b]|foob[^a]|fooba[^r])$" by dn.regex="^uid=$1,.*dc=ldap,dc=base$$" none by * +0 break access to dn.regex="^uid=([^,]+),cn=settings,dc=ldap,dc=base$" filter="objectClass=foobar" attrs=entry,@foobar by dn.regex="^uid=$1,.*dc=ldap,dc=base$$" write by * none ################## ## 3. a whitelist ## access to dn="cn=settings,dc=ldap,dc=base" attrs="entry,children" by users write by * +0 break access to dn.regex="^uid=([^,]+),cn=settings,dc=ldap,dc=base$" attrs=objectClass value="foobar" by dn.regex="^uid=$1,.*dc=ldap,dc=base$$" write by * +0 break access to dn.regex="^uid=([^,]+),cn=settings,dc=ldap,dc=base$" attrs=objectClass by dn.regex="^uid=$1,.*dc=ldap,dc=base$$" none by * +0 break access to dn.regex="^uid=([^,]+),cn=settings,dc=ldap,dc=base$" filter="objectClass=foobar" attrs=entry,@foobar by dn.regex="^uid=$1,.*dc=ldap,dc=base$$" write by * none ################## * Is the filter="…" in the "to" clause of an ACL evaluated when "adding" an entry? * Is the filter="…" when modifying an entry also applied against the modified result or only against the current state of the object? * the manpage says the syntax is "attrs=<attrlist>[ val[/matchingRule][.<attrstyle>]=<attrval>]" → The hardcoded "val" can also be "value" * no multiple value-lists can be used in a single defintion (e.g. access to attrs="objectClass val=foo" attrs="someAttribute val="bar" or attrs="objectClass val=foo,someAttribute val=bar") * "matchingRule" is nowhere defined in the manpage Some further suggestions for the development are: * It would reduce a lot of redundancy if multiple "to" statements could be used in one ACL definition (so that the different by clauses doesn't always need to be copied). * If the "by" clause would also have a filter="" one wouldn't need to use "set"s anymore - sets are slower and doesn't even work with all things (e.g. if you have special characters in the DN). There is no way to escape "]" / "[" and urlencode things which are e.g. used in a LDAP URI filter. This can even lead to security issues. * ACL rules can't be bound to the ldap operation (search, auth, add, modify, delete, ...), you can only remove e.g. some of the permission bits (e.g. access to if-operation="search" ...) * Using backreferences of the DN in the filter="" or attrs="" would also be very handy (how to restrict e.g. the "uid" value to be only what's in the DN of the target/operating user?) Best regards Florian -- Florian Best Open Source Software Engineer Univention GmbH be open Mary-Somerville-Str.1 28359 Bremen Tel.: +49 421 22232-0 Fax : +49 421 22232-99 best(a)univention.de http://www.univention.de Geschäftsführer: Peter H. Ganten HRB 20755 Amtsgericht Bremen Steuer-Nr.: 71-597-02876

3 5

Problem in replicated entries
by Gurjot Kaur 05 Jul '16

05 Jul '16

Hi, I have noticed a problem in OpenLDAP multimaster 2.4.44 with MDB backend. I did the following steps: i) Add four entries into Master 1 (using slapadd with option -w). ii) Configure Master 1 and Master 2 in Multi Master mode. Syncrepl information is given below: ############## Master1 Starts port (2016) ############## syncRepl rid=100 provider=ldap://xx.xx.xx.xx:2017 type=refreshAndPersist retry="5 + 5 +" searchbase="dc=my-domain,dc=com" attrs=* interval=00:00:00:09 schemachecking=off bindmethod=simple binddn="cn=Manager, dc=my-domain,dc=com" credentials=secret mirrormode on overlay syncprov # contextCSN saved to database every 100 updates or ten minutes syncprov-checkpoint 100 10 syncprov-sessionlog 100 ############## Master1 Ends ############## ############## Master2 Starts port (2017) ############## syncRepl rid=100 provider=ldap://xx.xx.xx.xx:2016 type=refreshAndPersist retry="5 + 5 +" searchbase="dc=my-domain,dc=com" attrs=* interval=00:00:00:09 schemachecking=off bindmethod=simple binddn="cn=Manager, dc=my-domain,dc=com" credentials=secret mirrormode on overlay syncprov # contextCSN saved to database every 100 updates or ten minutes syncprov-checkpoint 100 10 syncprov-sessionlog 100 ############## Master2 Ends ############## iii) These four entries get replicated on the Master 2 correctly and are visible from ldap browser accurately. iv) Add three more entries to Master 1. (using slapadd with option -w) v) After restarting both Master 1 and Master 2, on Ldap Browser the new added entries are visible in Master 1 correctly. But in Master 2, all the previous entries got missing. Ldap browser is giving error "No entries returned" ( It seems just like Master 2 DB got empty) vi) But then I execute ldapsearch command on Master 2 as given below: ################################################### ldapsearch -h xx.xx.xx.xx -p 2017 -b "dc=my-domain,dc=com" ################################################### The above command returns all the entries exactly same to the Master 1 with the below search response: # search result search: 2 result: 0 Success # numResponses: 10 # numEntries: 9 Now I am unable to understand how it this possible that the entries exist in the DB but not showing through Ldap browser. ( I have checked Master 2 entries in different ldap browsers too) But it is just showing empty DB. Master 1 entries are showing correctly in Ldap browser. Context CSN for both the servers is same as given below: ################################## ldapsearch -H ldap://xx.xx.xx.xx:2016 -LLL -x -s base -b "dc=my-domain,dc=com" contextCSN dn: "dc=my-domain,dc=com" contextCSN: 20160705065521.205150Z#000000#000#000000 ldapsearch -H ldap://xx.xx.xx.xx:2017 -LLL -x -s base -b "dc=my-domain,dc=com" contextCSN dn: "dc=my-domain,dc=com" contextCSN: 20160705065521.205150Z#000000#000#000000 ################################## Can you please let me know how it can happen and how to solve this problem. Best Regards, Gurjot Kaur "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

1 0

syncrepl constantly desyncing
by Eugene M. Zheganin 05 Jul '16

05 Jul '16

Hi, I'm using a configuration with two slapd servers, master and replica. The problem is that replica is constantly desyncing. I'm monitoring it's number of users and groups and the cound of members of one particular group. Users and group entities are always in sync, but entities like groupOfUniqueNames are desyncing - they are not receiveing deltas from master, keeping their members count constant. My config (done according to the documentation): ===Cut=== overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 syncrepl rid=123 provider=ldap://xx.xx.xx.xx:389 type=refreshAndPersist interval=00:00:10:00 retry="60 10 300 +" filter="(objectClass=*)" searchbase="dc=my,dc=domain" attrs="*,+" schemachecking=off bindmethod=simple binddn="uid=proxy,ou=accounts,ou=internal,dc=my,dc=domain" credentials=XXXXXXXXXXXXXX ===Cut=== I've also tried the refreshOnly method, which gave me same result. In order to resync replica I have to flush the directory contents each time and restart the slapd. I'm also suspecting that this desyncing happens because for some reason replica slapd isn't refreshing attribute values, only entities themselves: today I found a user, which userPassword attributes were out of sync on the replica. As far as I understand the documentation, syncrepl should sync the attributes. And the last question - is there any simple way to enable logging of syncrepl warnings and errors ? My experience with openldap logging tells me there's to mode of logging - "none" and "generate 10Gb of logs per day", but may me it's just me. Thanks. Eugene.

3 4

Caching nested groups (member:1.2.840.113556.1.4.1941)
by Ryan Hammond 01 Jul '16

01 Jul '16

We have an Active Directory domain with >6000 users and several hundred groups. The group hierarchy is usually nested 4-5 levels deep. Queries for the full set of nested groups for a user take > 10 seconds each. We have an app (Nexus OSS) that asks for a user's nested groups on every interaction (e.g. for each dependency needed to perform a maven build) and does not perform local caching. I am trying to implement a slapd + meta + pcache solution that will proxy the LDAP query, cache the results, and significantly speed up user interactions with this app. I have tried many configurations. I can always proxy the request, but I haven't yet been able to fully cache the results. I have had the most success with the passthru module from https://github.com/cbueche/openldap-passthru and rwm. In this configuration, slapd proxies inbound filters like "(member=CN=my name,ou=users,dc=some,dc=structure)" and passes that on to AD as "member:1.2.840.113556.1.4.1941:=CN=my name,ou=userss,dc=some,dc=structure)". AD returns the group DNs but slapd partially caches the result. The cached results are the direct group memberships, not the complete set of nested groups. Is what I want to do possible? If so, can someone please point me in the right direction? Here is my slapd.conf file: ----------------------------- ### Logging ################################################################### loglevel -1 logfile /var/log/openldap.log ### Schema includes ########################################################### include /etc/openldap/schema/microsoftattributetype.schema include /etc/openldap/schema/microsoftattributetypestd.schema include /etc/openldap/schema/corba.schema include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/duaconf.schema include /etc/openldap/schema/dyngroup.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/java.schema include /etc/openldap/schema/misc.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/ppolicy.schema include /etc/openldap/schema/collective.schema include /etc/openldap/schema/microsoftobjectclass.schema ## Module paths ############################################################## modulepath /usr/local/libexec/openldap moduleload back_meta moduleload back_ldap moduleload back_bdb moduleload mr_passthru moduleload pcache moduleload rwm # Main settings ############################################################### pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args ### Database definition (Proxy to AD) ######################################### database meta chase-referrals yes suffix "dc=some,dc=structure" uri "ldap://a.b.c.d:3268/dc=some,dc=structure" readonly yes protocol-version 3 rebind-as-user yes rootdn "CN=zNexus,OU=Service Accounts,OU=myorg,DC=some,DC=structure" rootpw "--obfuscated--" idassert-bind binddn="CN=zNexus,OU=Service Accounts,OU=myorg,DC=some,DC=structure" credentials="--obfuscated--" bindmethod=simple mode=none idassert-authzFrom "*" rewriteEngine on #rewrite searches rewriteContext searchFilter rewriteRule "member=(.*)" "(member:1.2.840.113556.1.4.1941:=%1" ":" rewriteRule "memberOf=(.*)" "(memberOf:1.2.840.113556.1.4.1941:=%1" ":" overlay pcache pcache bdb 100000 2 10000 600 directory /var/tmp/openldap-cache cachesize 20000 pcacheMaxQueries 10000 index objectClass eq,pres index userAccountControl eq index member eq index memberOf eq index ou,cn,mail,surname,givenname eq,pres,sub index objectCategory,sAMAccountName eq,pres,sub pcacheAttrset 0 cn pcacheTemplate (&(objectClass=)(&(cn=)(member=))) 0 600 60 pcacheTemplate (member=) 0 600 60 pcacheTemplate (memberOf=) 0 600 60 pcacheTemplate (&(cn=*)(member=)) 0 600 60 pcacheTemplate (&(objectClass=)(sAMAccountName=)(&(objectCategory=)(userAccountControl=))) 0 600 60 pcacheAttrset 1 sAMAccountName cn mail labeledUri memberOf member objectClass pcacheTemplate (&(objectClass=)(sAMAccountName=)(&(objectCategory=)(userAccountControl=))) 1 600 60 pcacheTemplate (&(objectClass=)(sAMAccountName=*)(&(objectCategory=)(userAccountControl=))) 1 600 60 ----------------------------- Here is what the client sees the first and second time the query is run for a user that is directly in one group but in many groups via nesting. (The group DNs have been obfuscated but in reality they are all unique.) On the first run, ldapsearch correctly returns 158 total (nested and direct) groups. On the second run, ldapsearch only returns the one direct group. ### RUN 1 ### ldap_initialize( ldap://127.0.0.1 ) filter: (member=cn=Some User,ou=Users,ou=External,dc=some,dc=structure) requesting: cn dn: cn=TT-RndGroup-Read,ou=...,ou=External,dc=some,dc=structure cn: TT-RndGroup-Read dn: cn=IO-RndGroup-Read,ou=...,ou=External,dc=some,dc=structure cn: IO-RndGroup-Read dn: cn=Vi-RndGroup-Read,ou=...,ou=External,dc=some,dc=structure cn: Vi-RndGroup-Read dn: cn=SE-RndGroup-Read,ou=...,ou=External,dc=some,dc=structure cn: SE-RndGroup-Read <snip 154 more CNs....> real 0m14.167s user 0m0.003s sys 0m0.025s ### RUN 2 ### ldap_initialize( ldap://127.0.0.1 ) filter: (member=cn=Some User,ou=Users,ou=External,dc=some,dc=structure) requesting: cn dn: cn=Vi-RndGroup-Read,ou=...,ou=External,dc=some,dc=structure cn: Vi-RndGroup-Read real 0m4.310s user 0m0.000s sys 0m0.004s ----------------------------- Thanks, Ryan

2 1

RHEL7 issues maybe???
by Frank Swasey 01 Jul '16

01 Jul '16

Folks, I am working on moving my OpenLDAP 2.4.44 environment from RHEL6 to RHEL7. I want to double check an assumption I have made before I open a report with Red Hat about the quality of their product. I am assuming that with "loglevel sync" and an empty consumer, that there should be one sincrepl_entry line that has "inserted UUID" in the syslog output for every entry created. Is that a valid assumption? Thanks, -- Frank Swasey | http://www.uvm.edu/~fcs Sr Systems Administrator | Always remember: You are UNIQUE, University of Vermont | just like everyone else. "I am not young enough to know everything." - Oscar Wilde (1854-1900)

4 10

Invalid DN
by James Lertora 01 Jul '16

01 Jul '16

Hi all, I know this has probably been answered but please bear with me. I have been hitting a wall for about a week messing with this and cannot seem to find the answer Googling all this time. I have followed several online set guides and even gone through the setup slowly at least a dozen times. I am using Cent 7. OpenLDAP 2.4.40. I can anonymously browse and retrieve DN for my group and two users and do the same with the ldap dn.base user. I have played around with the acl but keep messing it up. It's a vm so I revert back to a clean state after getting lost in the weeds. I keep getting "Error:ldap_bind: Invalid DN syntax (34)" for the users I have added. If I change to the correct DN I get incorrect password. Any pointers will be much appreciated. Thanks, fastpackets

2 3

openLDAP multi-master replication
by Boris Servo 29 Jun '16

29 Jun '16

Hello, I am trying to do openLDAP multi-master replication in centOS version 6.8 and openLDAP 2.4.40. So the openLDAP config is straight forward, the replication is the one that I am having some issues. Attached to this email are the config files that I am using for the openLDAP and the replication. Thank you in advance. Kindest regards, Boris Servo

2 2

first time user
by Kaveh Ehsani 28 Jun '16

28 Jun '16

Hi Everyone, I am using this for the first time so if there are protocols to follow please let me know. I have a problem with binding from my client to provider as the provider does not allow anonymous binding, I am also new to openldap, and it is centos 7 I am using which no longer uses slapd.conf. I initially used this to change the monitor ACL: ldapmodify -H ldapi:/// -x -D "cn=config" -W <<EOF dn: olcDatabase={1}monitor,cn=config changetype: modify replace: olcAccess olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=Manager,dc=${MYDOMAIN},dc=${MYTLD}" read by * none EOF Which worked fined. Then tried to modifying it by adding: 'by anonymous search' and try to run the same ldapmodify as: ldapmodify -H ldapi:/// -x -D "cn=config" -W <<EOF dn: olcDatabase={1}monitor,cn=config changetype: modify replace: olcAccess olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=Manager,dc=${MYDOMAIN},dc=${MYTLD}" read by anonymous search EOF and I get this error: ldap_start_tls: Can't contact LDAP server (-1) I think my binding inside sssd.conf on the client side is incorrect for the newuser01 I have added to the ldapserver Useldap_default_bind_dn = cn=newuser01,dc=example,dc=com Thanks for all the feed backs.

2 2

Need help in design for users with multiple posixAccounts
by Bastian Tweddell 27 Jun '16

27 Jun '16

Dear all, Currently, I am in the process of rethinking the way we have structured our posixAccounts in the LDAP DB. We have a centralized storage cluster which is attached to a number of compute clusters. Thus, we need to provide the same uids/gids everywhere. Whereas the homedirectory for an user may vary depending on the local mount points of the shared files systems in the cluster. By now, this problem was solved by introducing objectClasses which basically implement posixAccounts. One oc for each compute cluster we have. Because maintaining the schema extensions on an increasingly fluctuating environment is tough work, I would like to get rid of these oc-extensions by doing the following: - ou=TOP - ou=users: Keep attributes uid, uidNumber, gidNumber. They are unique for our site and should be used everywhere. - ou=systemA - ou=users: Keep attributes which extends entries from ou=TOP,ou=users by adding homedirectory and loginShell. They depend on the cluster configuration. I ended up with the idea to use dynlist which automatically fetches the unique attributes from entries beneath ou=TOP,ou=users and specific attributes from the entry beneath the ou=systemA branch. --- example ldif: --- uid=user01,ou=users,ou=TOP objectClass: posixAccount uid: user01 uidNumber: 10000 gidNumber: 10000 cn: Some Name homedirectory: n/a uid=user01,ou=users,ou=systemA,ou=TOP objectClass: posixAccount objectClass: x-extendUnique x-extendURI: ldap:///ou=TOP,ou=users?uid,uidNumber,gidNumber?one?(uid=user01) homedirectory: /local/mount/home4711/user01 loginShell: /bin/ksh --- eop --- --- draft slapd.conf --- overlay dynlist dynlist-attrset x-extendUnique x-extendURI --- eop --- So the idea is, when searching for a user beneath the systemA branch, the resulting entry should be completed by attributes in the top users' branch. Before playing around with that, I would like to ask if the way I intend to use dynlist is the proposed way? Is there another neat way to implement that? Meaning, that a search result entry is combined from two different entries? I really would like to avoid having copies of the unique attributes at many locations in the tree. How does schemachecking work on dynlist? How would dynlist respond to single-valued attributes which are imported but already present in the entry? Would it overwrite the existing attribute? Do you think, keeping multiple entries for an user is too much overhead compared to use only one entry with multiple objectClasses? Many thanks, -- Bastian Tweddell Juelich Supercomputing Centre phone: +49 (2461) 61-6586 HPC in Neuroscience

1 0

mdb backup via slapcat
by Bastian Tweddell 27 Jun '16

27 Jun '16

Dear all, I am used to run slapcat to create backups of the backend database _while_ slapd is running. Recently I migrated from bdb to mdb. Now I read that using slapcat on a running slapd is only safe for bdb and hdb backends [1]. 1: http://www.openldap.org/faq/data/cache/287.html Question: - Is that still true? - In which situation could data corruption occur? - Is that supposed to change in the future? Many thanks, -- Bastian Tweddell Juelich Supercomputing Centre phone: +49 (2461) 61-6586 HPCNS, HPS ------------------------------------------------------------------------------------------------ ------------------------------------------------------------------------------------------------ Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Dr. Karl Eugen Huthmacher Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Prof. Dr.-Ing. Harald Bolt, Prof. Dr. Sebastian M. Schmidt ------------------------------------------------------------------------------------------------ ------------------------------------------------------------------------------------------------

2 2

Re: LMDB data growth - overflow pages
by Christian Sell 26 Jun '16

26 Jun '16

Hi, as far as my scenario goes, I shortly afterward detected serious errors in my setup that were responsible to the buildup. There is an article on the symas website (https://symas.com/understanding-lmdb-database-file-sizes-and-memory-utiliza…) that adresses the question/issue of database growth, I assume you have read that. Crashes sould of course not happen, but what exactly do you mean by "crash" anyway? regards, Christian > salesman1 IIS Advertising <sales-iss(a)outlook.com> hat am 26. Juni 2016 um > 00:59 geschrieben: > > > Re: I HAVE THE SAME PROBLEMS, TOO ! > > > from your comments > > http://www.openldap.org/lists/openldap-technical/201511/msg00201.html > > > > I noticed the following using lmdb. Tested version is up-to-date 0.9.18, from > 2016. > > > Database grows much larger than expected in many use cases, and eventually > crashes, also was > > not a well-behaved database when simple, missing or misbehaved client code > executes it. > > . > > Do you think the same ? > > > Maybe lbmd is was fine-tuned for other especific needs, or is a toy database, > or a complicated > > case of application in our scenario. Unfortunatelly is not like Redis yet. > > We can not throw anything special on it without some effort. > > > > We really want do use lbmd, it's fast, but can't get it to work as expected. > Lmbd may be incomplete, > > buggy for (the common coder) or || (the experienced coder) who tries do use > it for other needs > > than designed. So it's now a dream but not easily realistic. Needs an expert. > > > > > 1. Database size grows 3x the data we put in, than stops growing - when > records (key+data) from 410 to 4010 bytes are added. > > -> and consumed much more space than expected for 5000*400 bytes = 2.000.000 > bytes > > > 2. Second, when we put key+data > 4096 bytes, database grows much larger and > crashes a lot of times, with a number > > of page overflows shown on 'mdb_dump ./testdb' > > > We made keys ("k:%d", i%5000) for (i=0; i < 1000000; i++) // so there are > 5000 keys, else is overwriting; > > Data is random ascii or fixed memset( 'x',400 ) > > > Program name: sample2 > > We are overwriting old values AND NOT appending, but it grows anyway. Larger > data than 4096 bytes per key-value > > seems impossible or non-sense at this time. Are we using wrong flags or > program structure ? > > > > trials - first run goes fine: #./sample2 > > > [root@ip-172-31-13-74 liblmdb]# ./sample2; ls ./testdb/* -l > Start > Init done > written 100000 pairs of len=400 bytes > -rw-r--r-- 1 root root 2584576 Jun 25 21:43 ./testdb/data.mdb > -rw-r--r-- 1 root root 8192 Jun 25 21:43 ./testdb/lock.mdb > [root@ip-172-31-13-74 liblmdb]# ./sample2; ls ./testdb/* -l > Start > Init done > written 100000 pairs of len=400 bytes > -rw-r--r-- 1 root root 5173248 Jun 25 21:43 ./testdb/data.mdb > -rw-r--r-- 1 root root 8192 Jun 25 21:43 ./testdb/lock.mdb > [root@ip-172-31-13-74 liblmdb]# ./sample2; ls ./testdb/* -l > Start > Init done > written 100000 pairs of len=400 bytes > -rw-r--r-- 1 root root 7761920 Jun 25 21:43 ./testdb/data.mdb > -rw-r--r-- 1 root root 8192 Jun 25 21:43 ./testdb/lock.mdb > [root@ip-172-31-13-74 liblmdb]# > > > > Looks like it's not replacing old keys and have a page/data size problem, > > > Any suggestions ? > > > REGARDS !! > > Fabio Martinez - Buenos Aires and São Paulo > > gcc developer > > Brazil > > > -- > > > > > Hello, > > I am trying to use LMDB to store large (huge) amounts of binary data which, > for the reason of limiting memory footprint, are split into chunks. Each chunk > ist stored under a separate key, made up of [collectionId, chunkId], so that I > can later iterate the chunks using a LMDB cursor. Chunk size is configurable. > > During my tests, I encountered a strange scenario where, after inserting some > 2000 chunks consisting of 512KB each, the database size had grown to a value > that was roughly 135 times the calculated size of the data. I ran stat over > the db and saw that there were > 12000 overflow pages vs. approx. 2000 data > pages. When I reduced the chunk size to 4060 bytes, the number of overflow > pages went down to 1000, and the database size went down to the expected > number (I experimented with different sizes, this was the best result). I did > not find any documentation that would explain this behavior, or how to deal > with it. Of course it makes me worry about database bloat and the > consequences. Can anyone shed light on this? > > thanks, > Christian >

1 0

Re: Antw: Re: openldap 2.4.44 - delta-syncrepl fails on auditContext
by Frank Swasey 24 Jun '16

24 Jun '16

Today at 6:09am, Ulrich Windl wrote: > I wonder why you configure accesslog on one node, but not on the other. Here we use same configuration on every node. I am continuing the practice of having a master and slaves. The masters are set up with MMR and do have accesslog configured on them. The slaves are set up to delta-syncrepl the main database from and force all updates to go to the MMR masters. I have a second set of slaves that are used for mail only, and they replicate just the mail related data from the MMR masters. -- Frank Swasey | http://www.uvm.edu/~fcs Sr Systems Administrator | Always remember: You are UNIQUE, University of Vermont | just like everyone else. "I am not young enough to know everything." - Oscar Wilde (1854-1900)

1 0

ldapsearch + read-only domain controller: cannot bind
by l＠avc.su 24 Jun '16

24 Jun '16

3 8

openldap 2.4.44 - delta-syncrepl fails on auditContext
by Frank Swasey 22 Jun '16

22 Jun '16

Delta-Syncrepl has started failing to actually replicate the consumer starting with an empty database, it fails with code 0x50 because of the auditContext attribute that is present in the suffix entry on the master server due to the accesslog overlay being used. I can make it work if I load the accesslog overlay in the replica's configuration (without actually configuring it). This appears to be new behavior since 2.4.42. Is this expected, and now required with 2.4.44, or should I open an ITS? -- Frank Swasey | http://www.uvm.edu/~fcs Sr Systems Administrator | Always remember: You are UNIQUE, University of Vermont | just like everyone else. "I am not young enough to know everything." - Oscar Wilde (1854-1900)

4 15

Schema's not importing correctly?
by Trent Dierking 22 Jun '16

22 Jun '16

Per the quickstart guide, I am trying to import an ldif file with the following: dn: dc=example,dc=com objectclass: dcObject objectclass: organization o: Example Company dc: example dn: cn=Manager,dc=example,dc=com objectclass: organizationalRole cn: Manager However, I receive errors indicating something is wrong about the object class. So I tried the first two lines only, and receive: ldap_add: Object class violation (65) additional info: no structural object class provided The common error faq indicates this is because my objectclass is not valid. Since this is the quickstart guide, and dcObject comes from core.schema (which is included by default), what the hell is going on? My best guess is that the schema is not being correctly imported, but I'm not sure why.

2 1

Re: Odd MMR behaviour with delta-syncrepl and refreshAndPersist
by Quanah Gibson-Mount 21 Jun '16

21 Jun '16

--On Wednesday, June 15, 2016 1:59 PM +0100 Mark Cairney <Mark.Cairney(a)ed.ac.uk> wrote: > Hi Quanah, > > I can confirm I still see the issue when deleting and adding user > objects and groups using 3-way delta-MMR. Please keep replies on the list. > From one of the servers receiving the change: > [snip] > I spotted the reference to "cn=marksgroup2" in the log above so decided > to try it with an objectclass that has no group memberships managed by > the memberOf overlay (simplesecurityobject) and it worked as expected: > > Again from the consumer I see the following logged: [snip] > So it looks like there's possibly an additional effect being caused by > the memberOf overlay but as about 90% of our LDAP writes are the > creation/modification/deletion of users and groups this could be a pain > on a production system :-) > > Is this enough for you to go on? If there's any additional logging or > details of my config I'm happy to pass them on. I dropped your replication log bits in case there was anything sensitive in there. I agree, it looks like the memberof overlay is breaking replication in your case. I would suggest filing an ITS with details on your setup, and the logging you provided, obfuscated as necessary. --Quanah -- Quanah Gibson-Mount Platform Architect Manager, Systems Team Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration A division of Synacor, Inc

3 3

Give user only access to a few entries that he "owns"
by PenguinWhispererThe . 21 Jun '16

21 Jun '16

Hi all, I'm not very experienced with ldap. I've been looking into the access controls documentation but I'm unsure on what the proper way to handle this is. So let me expain what I want to accomplish: a user entry (posixAccount, password, givenName, ...) can update his own password by using the "self" keyword. All good there. But a user has some assets he owns. For example a host (in Common tree). I want the user to be able to update one attribute of this host. "self" keyword doesn't work here as the user doesn't bind to it. So I added an owner attribute to the host and with that attribute I reference to the user. Now I need some kind of "glue" to verify that the user is allowed to write to the attribute. Do I need a filter? Wouldn't this just filter out a specific attribute? Or will it only filter entries based on the filter match? In the latter case (which seems like a logical way for openldap to handle this) I would need: - attr: to select what attribute the user access is modified - filter: to only apply on the user his host - by: variable definition for this clause to only apply on the binded user I've read about dnattr but I'm unsure this is accomplishes what I want. Could anyone share an example? Thanks

2 3

cn=config database setup
by Trent Dierking 21 Jun '16

21 Jun '16

Following the quickstart guide at http://www.openldap.org/doc/admin24/quickstart.html and the following happens # ./sbin/slapadd -F etc/'cn=config' -l etc/openldap/slapd.ldif 57680d0f invalid config directory etc/cn=config, error 2 slapadd: bad configuration directory! # mkdir -p 'etc/cn=config' # ./sbin/slapadd -F etc/'cn=config' -l etc/openldap/slapd.ldif Available database(s) do not allow slapadd I've ensured the appropriate var/openldap-data directory exists. I've tried adding the maxsize key shown on the guide. I am not sure what else could cause this, as this is for the hardcoded cn=config database.

2 1

auditContext attribute ?
by Frank Swasey 20 Jun '16

20 Jun '16

I have discovered (on my test environment running 2.4.44 on RHEL7) that when I slapcat from either of the MMR syncing masters the suffix base entry has the auditContext attribute. If I take the generated LDIF to my replica server, it will not slapadd unless I delete the auditContext attribute. I assume this is something that I have accidentally turned on in the slapd configuration or is new in 2.4.44. I'm confused and not finding any documentation of this attribute and why it is getting included in the slapcat output - can anyone guide me to an answer? -- Frank Swasey | http://www.uvm.edu/~fcs Sr Systems Administrator | Always remember: You are UNIQUE, University of Vermont | just like everyone else. "I am not young enough to know everything." - Oscar Wilde (1854-1900)

2 2

ldap user login attempt kills slapd service
by Real, Elizabeth (392K) 16 Jun '16

16 Jun '16

Openldap gurus: Here is my setup, LDAPSERVERS: I have two ldap servers running RHEL7.2 and openldap 2.4.40. Both servers are configured with multi-master replication. Ldaps is enabled and a ppolicy applied. LDAPCLIENT: My ldap client is running RHEL7.2 as well, sssd 1.13.0, and openldap client 2.4.40. I have been troubleshooting this problem for a while and can’t figure out why everytime I try to login to an ldap client with a test user account the slapd service on only one of my ldap servers gets killed. Both getent and ldapsearch return the expected information when ran on the ldap client: ldapclient ~]# getent passwd realtest realtest:*:1004:312:Liz RealTest:/home/real:/bin/tcsh ldapclient ~]# ldapsearch -x -s sub -b 'ou=People,dc=cluster,dc=sec312' '(uid=realtest)' # extended LDIF # # LDAPv3 # base <ou=People,dc=cluster,dc=sec312> with scope subtree # filter: (uid=realtest) # requesting: ALL # # realtest, People, cluster.sec312 dn: uid=realtest,ou=People,dc=cluster,dc=sec312 gidNumber: 312 objectClass: account objectClass: top objectClass: posixAccount objectClass: shadowAccount uid: realtest loginShell: /bin/tcsh homeDirectory: /home/real cn: Liz RealTest uidNumber: 1004 # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 LDAP SERVER /VAR/LOG/SECURE: serverA journal: Suppressed 19192 messages from /system.slice/slapd.service serverA journal: Suppressed 8449 messages from /system.slice/slapd.service serverA systemd: slapd.service: main process exited, code=killed, status=6/ABRT serverA systemd: Unit slapd.service entered failed state. serverA systemd: slapd.service failed. LDAP CLIENT /VAR/LOG/SECURE: ldapclient sshd[122938]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=node12.cluster.sec312 user=realtest ldapclient sshd[122938]: pam_sss(sshd:auth): received for user realtest: 7 (Authentication failure) ldapclient sshd[122938]: pam_ldap(sshd:auth): Authentication failure; user=realtest ldapclient sshd[122936]: error: PAM: Authentication failure for realtest from node12.cluster.sec312 ATTEMPT TO SSH AS TEST USER TO LDAP CLIENT: % ssh -v realtest@ldapclient OpenSSH_6.6.1, OpenSSL 1.0.1e-fips 11 Feb 2013 debug1: Reading configuration data /etc/ssh/ssh_config debug1: /etc/ssh/ssh_config line 60: Applying options for * debug1: Connecting to ldapclient [] port 22. debug1: Connection established. debug1: could not open key file '/etc/ssh/ssh_host_key': Permission denied debug1: could not open key file '/etc/ssh/ssh_host_dsa_key': Permission denied debug1: could not open key file '/etc/ssh/ssh_host_ecdsa_key': Permission denied debug1: could not open key file '/etc/ssh/ssh_host_rsa_key': Permission denied debug1: could not open key file '/etc/ssh/ssh_host_ed25519_key': Permission denied debug1: could not open key file '/etc/ssh/ssh_host_dsa_key': Permission denied debug1: could not open key file '/etc/ssh/ssh_host_ecdsa_key': Permission denied debug1: could not open key file '/etc/ssh/ssh_host_rsa_key': Permission denied debug1: could not open key file '/etc/ssh/ssh_host_ed25519_key': Permission denied debug1: identity file /home/real/.ssh/id_rsa type -1 debug1: identity file /home/real/.ssh/id_rsa-cert type -1 debug1: identity file /home/real/.ssh/id_dsa type -1 debug1: identity file /home/real/.ssh/id_dsa-cert type -1 debug1: identity file /home/real/.ssh/id_ecdsa type -1 debug1: identity file /home/real/.ssh/id_ecdsa-cert type -1 debug1: identity file /home/real/.ssh/id_ed25519 type -1 debug1: identity file /home/real/.ssh/id_ed25519-cert type -1 debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_6.6.1 debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1 debug1: match: OpenSSH_6.6.1 pat OpenSSH_6.6.1* compat 0x04000000 debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: server->client aes128-ctr hmac-md5-etm(a)openssh.com none debug1: kex: client->server aes128-ctr hmac-md5-etm(a)openssh.com none debug1: kex: curve25519-sha256(a)libssh.org need=16 dh_need=16 debug1: kex: curve25519-sha256(a)libssh.org need=16 dh_need=16 debug1: sending SSH2_MSG_KEX_ECDH_INIT debug1: expecting SSH2_MSG_KEX_ECDH_REPLY debug1: Server host key: ECDSA 14:c5:c2:60:29:ce:99:aa:67:41:a6:6a:11:2c:ca:86 debug1: Host 'ldapclient' is known and matches the ECDSA host key. debug1: Found key in /home/real/.ssh/known_hosts:22 debug1: ssh_ecdsa_verify: signature correct debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug1: SSH2_MSG_NEWKEYS received debug1: Roaming not allowed by server debug1: SSH2_MSG_SERVICE_REQUEST sent debug1: SSH2_MSG_SERVICE_ACCEPT received debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive,hostbased debug1: Next authentication method: gssapi-keyex debug1: No valid Key exchange context debug1: Next authentication method: gssapi-with-mic debug1: Unspecified GSS failure. Minor code may provide more information No Kerberos credentials available debug1: Unspecified GSS failure. Minor code may provide more information No Kerberos credentials available debug1: Unspecified GSS failure. Minor code may provide more information debug1: Unspecified GSS failure. Minor code may provide more information No Kerberos credentials available debug1: Next authentication method: hostbased debug1: No more client hostkeys for hostbased authentication. debug1: Next authentication method: publickey debug1: Trying private key: /home/real/.ssh/id_rsa debug1: Trying private key: /home/real/.ssh/id_dsa debug1: Trying private key: /home/real/.ssh/id_ecdsa debug1: Trying private key: /home/real/.ssh/id_ed25519 debug1: Next authentication method: keyboard-interactive Password: debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive,host based Any help will be greatly appreciated! Thank you, Liz

3 6

Checking that account is locked
by Radovan Semancik 16 Jun '16

16 Jun '16

Hi, I was exploring account lockout functionality of password policy overlay. I would like to know how to reliably check whether particular account is locked or not (e.g. for use by a helpdesk application). It looks like from the documentation that this is not possible to do by just examining the account LDAP entry. Is that right? The locked account contains pwdAccountLockedTime that indicates the time when the account was locked. But I also need to determine whether the lock has not expired. For that I need the value of pwdLockoutDuration from the password policy. But how to determine what entry contains a default password policy? For that I need access to cn=config, right? So if my helpdesk application does not have access to the cn=config then I'm pretty much out of luck. Is my thinking OK or have I overlooked something? -- Radovan Semancik Software Architect evolveum.com

4 5

Assertion failed
by mdii 14 Jun '16

14 Jun '16

Hi, I'm having some trouble when starting a openLDAP 2.4.35. In the log files I have the message: ** ld 0x7f11e4100910 Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ld 0x7f11e4100910 request count 1 (abandoned 0) ** ld 0x7f11e4100910 Response Queue: Empty ld 0x7f11e4100910 response count 0 ldap_chkResponseList ld 0x7f11e4100910 msgid 2 all 0 *slapd: ./../../../libraries/liblmdb/mdb.c:4025: mdb_page_search_root: Assertion `(((mp)->mp_pb.pb.pb_lower - ((unsigned) __builtin_offsetof (MDB_page, mp_ptrs))) >> 1) > 1' failed.* ldap_chkResponseList returns ld 0x7f11e4100910 NULL ldap_int_select read1msg: ld 0x7f11e4100910 msgid 2 all 0 ber_get_next tls_read: want=5, got=5 0000: 17 03 03 02 90 ..... tls_read: want=656, got=656 0000: 39 eb 87 92 b0 b2 1d f6 e2 b9 bc 4e 80 08 88 47 9..........N...G 0010: bc 01 92 5e e1 b4 a7 19 ae 42 2b 07 b9 f9 ae b9 ...^.....B+..... 0020: 3f e3 ec 58 ca cc d2 28 89 f8 5b d1 a1 c9 00 bf ?..X...(..[..... 0030: 17 87 0a f6 e3 56 24 e8 6b 58 98 f5 95 c2 3d 2b .....V$.kX....=+ 0040: aa e4 3b a6 09 0e 2b bd a4 c5 16 31 e6 7d cf 88 ..;...+....1.}.. 0050: 33 91 cd 9b 00 e8 37 66 64 0f a0 70 35 c9 5a 42 3.....7fd..p5.ZB 0060: 3e 62 f1 61 b0 7b 1f 24 89 3f ef 08 bb df 11 f8 >b.a.{.$.?...... 0070: 43 8e f4 6a 67 d0 d5 e0 13 18 11 7a c1 ba 40 60 C..jg......z..@` 0080: 2b ba 0d ad 6f 64 f0 95 dc e6 7d 37 f4 b4 47 39 +...od....}7..G9 0090: 88 7f 2a 16 5c 78 37 d2 4b e9 be f8 b2 fd aa db ..*.\x7.K....... 00a0: b6 5c 50 f2 68 24 48 09 46 cf a9 e3 f0 b3 0a a7 .\P.h$H.F....... 00b0: f7 4c 25 9f 92 26 31 fe 19 f3 af c3 d9 33 e3 38 .L%..&1......3.8 00c0: a4 b1 bd b6 e4 48 07 3d dd 6f f5 96 8f 78 c6 f0 .....H.=.o...x.. 00d0: 11 bc 2a f2 08 98 3e 50 d0 d5 5c e0 06 1c 43 ea ..*...>P..\...C. 00e0: 07 cf fb 64 95 5d 55 12 e5 85 d0 28 af 47 fa 5c ...d.]U....(.G.\ ... 0260: 4a 62 da 51 4c 37 2e c6 87 e9 a3 04 29 a4 4b e4 Jb.QL7......).K. 0270: 1f 3b ef f9 4f 2a 88 d4 56 53 7f 92 e3 51 88 c1 .;..O*..VS...Q.. 0280: cf a3 90 52 4e a5 98 72 51 20 2f f7 7f c0 aa be ...RN..rQ /..... ldap_read: want=8, got=8 0000: 30 82 02 66 02 01 02 64 0..f...d ldap_read: want=610, got=610 0000: 82 02 28 04 15 6f 75 3d 67 72 6f 75 70 65 73 2c ..(..ou=groupes, 0010: 6f 3d 6d 61 6e 70 6f 77 65 72 30 82 02 0d 30 28 o=manpower0...0( 0020: 04 0b 6f 62 6a 65 63 74 43 6c 61 73 73 31 19 04 ..objectClass1.. 0030: 03 74 6f 70 04 12 6f 72 67 61 6e 69 7a 61 74 69 .top..organizati 0040: 6f 6e 61 6c 55 6e 69 74 30 0f 04 02 6f 75 31 09 onalUnit0...ou1. 0050: 04 07 67 72 6f 75 70 65 73 30 2d 04 15 73 74 72 ..groupes0-..str 0060: 75 63 74 75 72 61 6c 4f 62 6a 65 63 74 43 6c 61 ucturalObjectCla 0070: 73 73 31 14 04 12 6f 72 67 61 6e 69 7a 61 74 69 ss1...organizati 0080: 6f 6e 61 6c 55 6e 69 74 30 33 04 0c 63 72 65 61 onalUnit03..crea 0090: 74 6f 72 73 4e 61 6d 65 31 23 04 21 63 6e 3d 61 torsName1#.!cn=a 00a0: 64 6d 69 6e 2c 6f 75 3d 70 72 6f 67 72 61 6d 6d dmin,ou=programm 00b0: 65 73 2c 6f 3d 6d 61 6e 70 6f 77 65 72 30 33 04 es,o=manpower03. 00c0: 09 65 6e 74 72 79 55 55 49 44 31 26 04 24 32 65 .entryUUID1&.$2e *Aborted* I already try to delete de lock.mdb and data.mdb files in order to recreate then (in case of a db corruption), but the error continues to pop... I also saw the thread "(ITS#7756) LMDB assertion failed in mdb_page_search_root ( http://www.openldap.org/lists/openldap-bugs/201311/msg00054.html). Is there anyway to bypass this error ? Thanks in advance for your help, Marc

2 1

MMR: How do you tell that the MMR servers are in sync?
by Frank Swasey 13 Jun '16

13 Jun '16

I am a newbie with MMR. I've just set up my first test of this. I have found it to be almost impossible to determine (via the contextCSN values) if the masters (let alone all the replicas) are actually synched. How are you folks, who are already using MMR, checking/verifying that the MMR participants (and their replicas) are actually in sync? Thanks, -- Frank Swasey | http://www.uvm.edu/~fcs Sr Systems Administrator | Always remember: You are UNIQUE, University of Vermont | just like everyone else. "I am not young enough to know everything." - Oscar Wilde (1854-1900)

7 13

Maximum number of uniqueMembers
by Rébeli-Szabó Tamás 10 Jun '16

10 Jun '16

Hi all, is there a limit for the number of attributes for entries? Specifically, I want to have 500,000 uniqueMembers for a group entry, but I cannot add more than 359,000. When I try to add 360,000 or more, I get: "ldapadd: update failed ... ldap_add: Can't contact LDAP server (-1)" The group entry look like this: dn: cn=biggroup,ou=groups,dc=test,dc=com objectClass:top objectClass: groupOfUniqueNames cn: Ah, big group uniqueMember: uid=user1,ou=users,dc=test,dc=com uniqueMember: uid=user2,ou=users,dc=test,dc=com ... uniqueMember: uid=user359000,ou=users,dc=test,dc=com I have 1 million users in ou=users,dc=test,dc=com (so I haven't run into a limit here). I am on 2.4.41, LMDB with 4G maxsize (RHEL 5.10; 2.6.39). I have no limits set in slapd.conf. Another, related issue: If I add 359k members to a group, and then I try to modify the group to add another member, ldapadd hangs. When I trace it, all I can see is continual ldap_result calls, that is, the client is waiting for the update operation to end on the server, and slapd is using nearly 100% of CPU. If I restart the server, I can add one member, but I cannot add say a hundred thousand more. Any hint is appreciated. Regards, tamas <tel:+36%2030%202100%20873>

2 3

LMDB Hanging Problem in Multi-Threaded Application
by Yahoo! 10 Jun '16

10 Jun '16

Hello, I successfully ran a multi-threaded application using LMDB 0.9.10-1 on a 64-bit Ubuntu 14.04 machine with 4x10-core Xeon E5-2660 v3 CPUs and 132 GB RAM. I then attempted to run the same application on a CentOS 6.7 box with 2x4-core i7-4790K CPUs and 32 GB RAM, where I tried two versions of LMDB: first EPEL RPM package version 0.9.18-1, and then the latest version 0.9.70 which I downloaded and compiled from GitHub sources on 4/27/2016. On the CentOS system with fewer cores, my application started to hang. I have traced the problem to a periodic commit, after which a new transaction must be created. I commit periodically to avoid a long delay when the application shuts down, at which point a 2 GB database is flushed to disk. I have a single write transaction, which is protected by a mutex when calling mdb_txn_commit(), mdb_txn_begin() and mdb_put(). The threads are created by TBB using parallel_for, and each thread has access to the single MDB_dbi and associated MDB_txn for writing. When a counter hits a certain value, we lock a mutex and call mdb_txn_commit(), and then we create a new MDB_txn to replace the invalidated one. Other threads try to acquire the same mutex before attempting to call mdb_put(). After a new write transaction is created, the next call the mdb_put() works fine on my 40-core Ubuntu box and the database is created successfully, but the application hangs on my 8-core CentOS box. My only guess is that I am encountering a race condition that is somehow avoided on the faster machine. Is the above valid LMDB usage? I have tried to find information about multi-threaded writing, and I have not found any definitive answers. I would be happy to share the relevant code, but I need to first strip out a great deal of project-specific ancillary code, which will take some time. Thanks, Alex

4 5

Re: Re: ldapdelete: Use wild card to delete multiple enetries
by Parveen Verma 09 Jun '16

09 Jun '16

Thanks for your answer. So I take it that we can't give wild card/regular expression in ldapdelete. I have just installed an OpenLDAP with LMDB only [ without bdb/hdb]. ./configure --prefix=/my/home/directory/parveen/OpenLDAP_LMDB --exec-prefix=/my/home/directory/parveen/OpenLDAP_LMDB --enable-bdb=no --enable-hdb=no So I was adding and deleting entries and it was taking time. For addition, I switch from ldapadd to slapadd [stoping slapd for a while]. For deletion, I was thinking of some wild card like things to see if timing can be improved. I was adding some 100K entries and deleting them, it was taking time, so I thought it could be faster if we give command in one go and then ldapdelete just receives the output and send to STDOUT/STDERR. To Others, Is there any plan for adding wild cards or its in my fantasy only? The GURU has well decided not to provide such things as ldapdelete is destructive and a little misunderstanding in handling wildcards/regular expression can delete the DB. Thanks anyways!! ---------------- Hi, you cannot use wildcards in deletes as per my understanding. You can, however, use wildcards in search filters. If you are on a Unix-like system, you can feed the output of a search with a bit of transformation into ldapmodify. You may want to try something like this (I ran this on Linux): ldapmodify -f <(ldapsearch -b "dc=ALCATEL,dc=FR" "(cn=Parveen30*)" | grep dn: | sed 's/$/\nchangetype:delete\n'/) Regards, tamás On Wed, Jun 8, 2016 at 5:54 PM, Parveen Verma <parveen.subs(a)gmail.com> wrote: > Hello All, > > Is there a Way to delete multiple LDAP entries by using some wildcards or > regular expression. > Like I have below entries. > dn: cn=Parveen20,dc=ALCATEL,dc=FR > dn: cn=Parveen200,dc=ALCATEL,dc=FR > dn: cn=Parveen201,dc=ALCATEL,dc=FR > dn: cn=Parveen202,dc=ALCATEL,dc=FR > dn: cn=Parveen203,dc=ALCATEL,dc=FR > dn: cn=Parveen204,dc=ALCATEL,dc=FR > dn: cn=Parveen205,dc=ALCATEL,dc=FR > dn: cn=Parveen206,dc=ALCATEL,dc=FR > dn: cn=Parveen207,dc=ALCATEL,dc=FR > dn: cn=Parveen208,dc=ALCATEL,dc=FR > dn: cn=Parveen209,dc=ALCATEL,dc=FR > dn: cn=Parveen30,dc=ALCATEL,dc=FR > dn: cn=Parveen300,dc=ALCATEL,dc=FR > dn: cn=Parveen301,dc=ALCATEL,dc=FR > dn: cn=Parveen302,dc=ALCATEL,dc=FR > dn: cn=Parveen303,dc=ALCATEL,dc=FR > dn: cn=Parveen304,dc=ALCATEL,dc=FR > dn: cn=Parveen305,dc=ALCATEL,dc=FR > dn: cn=Parveen306,dc=ALCATEL,dc=FR > dn: cn=Parveen307,dc=ALCATEL,dc=FR > dn: cn=Parveen308,dc=ALCATEL,dc=FR > dn: cn=Parveen309,dc=ALCATEL,dc=FR > > > I want to delete entries with 301,302,303.... > So how can I give this, except putting all these in a LDIF file. > > or how can below work > > cn=Parveen30*,dc=ALCATEL,dc=FR > >

1 0

Problem with ppolicy
by Il Neofita 09 Jun '16

09 Jun '16

Hi there, I have a problem with ppolicy and got stuck finding a solution. I am using openldap-2.4.40-9 Oracle 7.2, the lock seems to be ignored. This what I have configured dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModuleLoad: ppolicy.la olcModulePath: /usr/lib64/openldap dn: olcOverlay=ppolicy,olcDatabase={2}hdb,cn=config objectClass: olcPPolicyConfig olcOverlay: ppolicy olcPPolicyDefault: cn=ppolicy,ou=policies,dc=ddd olcPPolicyUseLockout: TRUE olcPPolicyHashCleartext: TRUE dn: cn=ppolicy,ou=policies,dc=ddd objectClass: top objectClass: device objectClass: pwdPolicyChecker objectClass: pwdPolicy cn: ppolicy pwdAttribute: userPassword pwdAllowUserChange: TRUE pwdInHistory: 4 pwdMinLength: 8 pwdMaxFailure: 6 pwdFailureCountInterval: 1800 pwdCheckQuality: 1 pwdMustChange: TRUE pwdGraceAuthNLimit: 3 pwdMaxAge: 3600 pwdExpireWarning: 31536000 pwdLockoutDuration: 900 pwdLockout: TRUE pwdCheckModule: pwcheck.la and I tried to add the attribute pwdReset: TRUE and pwdAccountLockedTime: 20110214195250Z in a specific user, however, the user is not locked and I do not even been ask to change the password Here is what happens ldapwhoami -e ppolicy -x -D "uid=ldap001,ou=People,dc=ddd" -W -h localhost Enter LDAP Password: dn:uid=ldap001,ou=People,dc=ddd Any idea what I should check

1 0

ldapdelete: Use wild card to delete multiple enetries
by Parveen Verma 08 Jun '16

08 Jun '16

Hello All, Is there a Way to delete multiple LDAP entries by using some wildcards or regular expression. Like I have below entries. dn: cn=Parveen20,dc=ALCATEL,dc=FR dn: cn=Parveen200,dc=ALCATEL,dc=FR dn: cn=Parveen201,dc=ALCATEL,dc=FR dn: cn=Parveen202,dc=ALCATEL,dc=FR dn: cn=Parveen203,dc=ALCATEL,dc=FR dn: cn=Parveen204,dc=ALCATEL,dc=FR dn: cn=Parveen205,dc=ALCATEL,dc=FR dn: cn=Parveen206,dc=ALCATEL,dc=FR dn: cn=Parveen207,dc=ALCATEL,dc=FR dn: cn=Parveen208,dc=ALCATEL,dc=FR dn: cn=Parveen209,dc=ALCATEL,dc=FR dn: cn=Parveen30,dc=ALCATEL,dc=FR dn: cn=Parveen300,dc=ALCATEL,dc=FR dn: cn=Parveen301,dc=ALCATEL,dc=FR dn: cn=Parveen302,dc=ALCATEL,dc=FR dn: cn=Parveen303,dc=ALCATEL,dc=FR dn: cn=Parveen304,dc=ALCATEL,dc=FR dn: cn=Parveen305,dc=ALCATEL,dc=FR dn: cn=Parveen306,dc=ALCATEL,dc=FR dn: cn=Parveen307,dc=ALCATEL,dc=FR dn: cn=Parveen308,dc=ALCATEL,dc=FR dn: cn=Parveen309,dc=ALCATEL,dc=FR I want to delete entries with 301,302,303.... So how can I give this, except putting all these in a LDIF file. or how can below work cn=Parveen30*,dc=ALCATEL,dc=FR

2 1

OpenLDAP 2.4.44 and Berkley DB version
by Parveen Verma 06 Jun '16

06 Jun '16

Hello All, We are using OpenLDAP 2.4.44 in our project, but facing a dilemma over the Berkley DB version. Which version we should use or it is not required at all now as we have LMDB. Moreover Oracle has removed some links for downloading the older Berkley DB version. OS : RHEL cat /etc/redhat\-release Red Hat Enterprise Linux Server release 6.5 (Santiago) I referred the Online guide, but was not able to conclude. 4.2.4. Database Software OpenLDAP's *slapd*(8) MDB primary database backend uses the LMDB software included with the OpenLDAP source. There is no need to download any additional software to have *MDB* support. OpenLDAP's *slapd*(8) BDB and HDB deprecated database backends require Oracle Corporation <http://www.oracle.com/>'s Berkeley DB. If not available at configure time, you will not be able to build *slapd*(8) with these deprecated database backends. Your operating system may provide a supported version of Berkeley DB in the base system or as an optional software component. If not, you'll have to obtain and install it yourself. Berkeley DB is available from Oracle Corporation <http://www.oracle.com/>'s Berkeley DB download page if required. There are several versions available from Oracle Corporation <http://www.oracle.com/>. Berkeley DB version 6.0.20 and later uses a software license that is incompatible with LDAP technology and should not be used with OpenLDAP. ------------------------------ *Note: *Please see Recommended OpenLDAP Software Dependency Versions <http://www.openldap.org/doc/admin24/guide.html#Recommended OpenLDAP Software Dependency Versions> for more information.

2 4

Error message nonpresent_callback in replication
by Michael Wuensche 06 Jun '16

06 Jun '16

Hello, We recently upgraded our Openldap installation to a current version. Our installation consists of 2 servers with several databases, of which a few are replicated in mirror mode. Together with the upgrade process we reconfigured which data gets replicated and which not and modified the databases accordingly. Now, when we synchronize data between the nodes the intial replication works just fine. But replication of changes afterwards fails and we get these error messages: Jun 3 16:36:09 wam01 slapd[19027]: [ID 795510 local4.debug] do_syncrep2: rid=025 LDAP_RES_INTERMEDIATE - SYNC_ID_SET Jun 3 16:36:09 wam01 last message repeated 29 times Jun 3 16:36:09 wam01 slapd[19027]: [ID 365351 local4.debug] do_syncrep2: rid=025 LDAP_RES_SEARCH_RESULT Jun 3 16:36:09 wam01 slapd[19027]: [ID 385048 local4.debug] do_syncrep2: rid=025 cookie=rid=025,csn=20160603143607.847747Z#000000#000#000000 Jun 3 16:36:10 wam01 slapd[19027]: [ID 338579 local4.debug] nonpresent_callback: rid=025 present UUID 6c782570-d2b6-1033-84c4-3d93063e27ca, dn ou=Directories,o=lpfroot Any idea what may have gone wrong here? The suffix o=lpfroot is in a non-replicated database, the glued sub-suffix ou=Directories,o=lpfroot is in a replicated database. The databases are still bdb as before. Best regards, Michael -- Michael Wünsche Principal Consultant Identity & Access Management Tel.: +49 (6151) 868-7251 Fax: +49 (6151) 868-7264 Michael.Wuensche(a)devoteam.com Devoteam GmbH, Gutenbergstraße 10, 64331 Weiterstadt, Germany URL: www.devoteam.de ------------------------------------------------------------------------------------------------------------ Geschäftsführer: Jürgen Hatzipantelis; Sitz der Gesellschaft: Weiterstadt; Amtsgericht Darmstadt HRB 6450; Umsatzsteuer-ID Nr.: DE 172 993 071

2 1

Issues with pcache overlay purging entries
by Andrew Widdersheim 03 Jun '16

03 Jun '16

Hello, Seeing strange issues when using the pcache overlay as a caching method on some servers. More specifically, not seeing results getting purged from the cache even though the TTL has expired. I have been able to reproduce on the following: Ubuntu 16.04 running slapd 2.4.42+dfsg-2ubuntu3.1 Ubuntu 14.04 running slapd 2.4.31-1+nmu2ubuntu8 Here are the steps that I am taking in order to reproduce the issue. First, I'm running a query similar to this: ldapsearch -x -LLL -h localhost -b 'dc=foo,dc=com' '(isphoneoperator=TRUE)' uid | grep "uid:" | grep someuser When I set the "isphoneoperator" attribute to TRUE the user shows up and everything is great. If I then go and set the attribute to FALSE and restart slapd *before* the TTL of the query expires on it's own naturally then that user remains in the cache forever and the only way to correct the issue is to stop slapd, delete all the caching databases and start slapd again. There are a few things I've noticed in the logs that I don't quite understand. When starting slapd for the first time with a fresh set of cache databases the logs look like the ones below and will repeat every time the TTL expires: Jun 1 20:34:31 vagrant slapd[10042]: ENTRY ADDED/MERGED, CACHED ENTRIES=1 Jun 1 20:34:31 vagrant slapd[10042]: ENTRY ADDED/MERGED, CACHED ENTRIES=2 Jun 1 20:34:31 vagrant slapd[10042]: ENTRY ADDED/MERGED, CACHED ENTRIES=3 Jun 1 20:34:31 vagrant slapd[10042]: ENTRY ADDED/MERGED, CACHED ENTRIES=4 Jun 1 20:34:31 vagrant slapd[10042]: ENTRY ADDED/MERGED, CACHED ENTRIES=5 Jun 1 20:34:31 vagrant slapd[10042]: ENTRY ADDED/MERGED, CACHED ENTRIES=6 Jun 1 20:34:31 vagrant slapd[10042]: ENTRY ADDED/MERGED, CACHED ENTRIES=7 Jun 1 20:34:31 vagrant slapd[10042]: ENTRY ADDED/MERGED, CACHED ENTRIES=8 Jun 1 20:34:31 vagrant slapd[10042]: ENTRY ADDED/MERGED, CACHED ENTRIES=9 However, when I restart slapd the logs change to look like this: Jun 1 20:44:55 vagrant slapd[11817]: message repeated 32 times: [ ENTRY ADDED/MERGED, CACHED ENTRIES=0] Jun 1 20:45:25 vagrant slapd[11817]: ENTRY ADDED/MERGED, CACHED ENTRIES=0 Jun 1 20:45:25 vagrant slapd[11817]: message repeated 32 times: [ ENTRY ADDED/MERGED, CACHED ENTRIES=0] Jun 1 20:45:55 vagrant slapd[11817]: ENTRY ADDED/MERGED, CACHED ENTRIES=0 Jun 1 20:45:55 vagrant slapd[11817]: message repeated 32 times: [ ENTRY ADDED/MERGED, CACHED ENTRIES=0] Jun 1 20:46:26 vagrant slapd[11817]: ENTRY ADDED/MERGED, CACHED ENTRIES=0 Jun 1 20:46:26 vagrant slapd[11817]: message repeated 32 times: [ ENTRY ADDED/MERGED, CACHED ENTRIES=0] Jun 1 20:46:56 vagrant slapd[11817]: ENTRY ADDED/MERGED, CACHED ENTRIES=0 Jun 1 20:46:56 vagrant slapd[11817]: message repeated 32 times: [ ENTRY ADDED/MERGED, CACHED ENTRIES=0] Jun 1 20:47:26 vagrant slapd[11817]: ENTRY ADDED/MERGED, CACHED ENTRIES=0 Jun 1 20:47:26 vagrant slapd[11817]: message repeated 32 times: [ ENTRY ADDED/MERGED, CACHED ENTRIES=0] I find this to be pretty odd and I'm not sure I quite understand the reason for this behavior. Also, when I run slapd in the foreground with (-d -1 for example) I notice some differences there as well. For example, with a fresh set of cache databases I'll see messages like: 57503573 ==> hdb_delete: uid=someuser,ou=users,dc=foo,dc=com However, when I restart slapd I never see these again. I have noticed that if I set pcachePersist to TRUE both my issue above where users are never purged and this logging inconsistency go away and everything works great. I guess I don't really understand what the pcachePersist parameter does. I've read the man pages for slapo-pcache(5) and I also found the following mailing list post and it is all a bit confusing to me: http://www.openldap.org/cgi-bin/wilma_hiliter/openldap-technical/201007/msg… I've looked for fixed bugs or any other posts that might indicate what is going on here but haven't turned up anything relevant that might be affecting the versions of slapd I'm running. I guess I'm wondering a few things: 1. Have a stumbled upon a bug? 2. Is this logging inconsistency normal? 3. What does pcachePersist do? 4. Is there a way to forcefully clear the cache other than deleting the database files or do you have to wait for the TTL to expire? Thanks, Andrew

1 0

Virtual list view problem
by Venish Khant 31 May '16

31 May '16

Hi all I am using cpan Net::LDAP module to access LDAP entries. I want to search LDAP entries using Net::LDAP search method. When I do search, I want some limited number of entries from search result, for this(searching) process I am using Net::LDAP::Control::VLV module. But I get error on VLV response control. Please, any one have idea about this error. * Error:* Died at vlv.pl line 50, This is my example. I changed the font style of line 50 #!/usr/bin/perl -w use Net::LDAP; use Net::LDAP::Control::VLV; use Net::LDAP::Constant qw( LDAP_CONTROL_VLVRESPONSE ); use Net::LDAP::Control::Sort; sub procentry { my ( $mesg, $entry) = @_; # Return if there is no entry to process if ( !defined($entry) ) { return; } print "dn: " . $entry->dn() . "\n"; @attrs = $entry->attributes(); foreach $attr (@attrs) { #printf("\t%s: %s\n", $attr, $entry->get_value($attr)); $attrvalue = $entry->get_value($attr,asref=>1); #print $attr.":". $entry->get_value($attr)."\n"; foreach $value(@$attrvalue) { print "$attr: $value\n"; } } $mesg->pop_entry; print "\n"; } $ldap = Net::LDAP->new( "localhost" ); # Get the first 20 entries $vlv = Net::LDAP::Control::VLV->new( before => 0, # No entries from before target entry after => 19, # 19 entries after target entry content => 0, # List size unknown offset => 1, # Target entry is the first ); my $sort = Net::LDAP::Control::Sort->new( order => 'cn' ); @args = ( base => "dc=example,dc=co,dc=in", scope => "subtree", filter => "(objectClass=inetOrgPerson)", callback => \&procentry, # Call this sub for each entry control => [ $sort, $vlv ], ); $mesg = $ldap->search( @args ); # Get VLV response control *($resp) = $mesg->control( LDAP_CONTROL_VLVRESPONSE ) or die;* $vlv->response( $resp ); # Set the control to get the last 20 entries $vlv->end; $mesg = $ldap->search( @args ); # Get VLV response control ($resp) = $mesg->control( LDAP_CONTROL_VLVRESPONSE ) or die; $vlv->response( $resp ); # Now get the previous page $vlv->scroll_page( -1 ); $mesg = $ldap->search( @args ); # Get VLV response control ($resp) = $mes # Now page with first entry starting with "B" in the middle $vlv->before(9); # Change page to show 9 before $vlv->after(10); # Change page to show 10 after $vlv->assert("B"); # assert "B" $mesg = $ldap->search( @args );g->control( LDAP_CONTROL_VLVRESPONSE ) or die; $vlv->response( $resp ); -- Venish Khant www.deeproot.co.in

4 11

Re: Documentation
by Daniel Howard 30 May '16

30 May '16

My recent experience is OpenLDAP on Ubuntu. I thought I would go with OpenLDAP's guide because they should know better, but the quick start was for older versions or something and hadn't been updated. I like documentation systems that allow for user feedback, comments, or patches via github. If you want community improvements then maybe low hanging fruit is a link in the doc template on how to interact with the documentation.... If the current docs platform has no mechanism for feedback and comments on a specific document, the source code/ build process is obscure ... Maybe consider porting even a "fork " to github and solicit community feedback (you can file issues in a familiar mechanism, and take in patches from dudes like me...) For what it's worth, the Ubuntu OpenLDAP quick start guide and only a few minor hiccups, and I would recommend that resource for anyone looking to implement or update a quickstart guide. The Faq-o-Matic ... Man a modern stack overflow site might be nice but a question in the back of my mind is whether the advice is still useful. I don't know if the FoM does this but if the answers showed dates then I could evaluate an answer that's say 2-4 years old with greater confidence than say something 12 years old ... One of the challenges of a venerable, old and mature project like OpenLDAP. I guess what I'm trying to say, from my mobile phone, is if the documentation were more "agile" in engaging the community for identifying issues and taking in corrections, we may all be happier. I would be open to volunteering to port docs... Thanks, -Danny -- Sent from my Western Electric Model 500 On Apr 29, 2016 5:01 PM, "Gavin Henry" <ghenry(a)openldap.org> wrote: Hi all, List what you love about our docs: List what you hate: List what you'd love to see: List what you can help with: Thanks. -- Kind Regards, Gavin Henry.

6 9

slapadd hang in bdb_tool_entry_close / ldap_pvt_thread_cond_wait
by Bannister, Mark 27 May '16

27 May '16

Hi, Can anyone shed light on why my slapadd process on Solaris 11 was hanging (slapd 2.4.30)? I was piping 'gunzip -c' through to slapadd (from an overnight cron job). This usually works fine. I'm guessing perhaps the gunzip process encountered an error, maybe an EPIPE was sent, but the stack trace many days later from slapadd doesn't look right. Only 2 threads, and both of them in ldap_pvt_thread_cond_wait(), but no other threads so what are they waiting for exactly? # pstack /var/tmp/cores/core.slapd.0.16189.1463492837 core '/var/tmp/cores/core.slapd.0.16189.1463492837' of 16189: /usr/sbin/slapadd -q -f /etc/openldap/slapd.conf ------------ lwp# 1 / thread# 1 --------------- 07ff7af9 lwp_park (0, 0, 0) 07ff1193 cond_wait_queue (82ed048, 82ed020, 0, 7ff16b0) + 63 07ff1728 __cond_wait (82ed048, 82ed020, f5a685c8, 7ff1771) + 89 07ff177f cond_wait (82ed048, 82ed020, f5a685f8, 7ff17b7) + 27 07ff17cc pthread_cond_wait (82ed048, 82ed020, f5a68618, 7e56137) + 24 07e5614c ldap_pvt_thread_cond_wait (82ed048, 82ed020, f5a68648, 81b7e29) + 24 081b7e7a bdb_tool_entry_close (8e9d398, ffffffff, f5a68698, 82ecc38) + 62 081a38ec slapadd (4, f5a68bbc, f5a68bbc, 80dccb1) + cb8 080dcd2c main (4, f5a68bbc, f5a68bd0, ef60f968) + ac 080dc86d _start (4, f5a68c8e, f5a68ca0, f5a68ca3, f5a68ca6, 0) + 7d ------------ lwp# 2 / thread# 2 --------------- 07ff7af9 lwp_park (0, 0, 0) 07ff1193 cond_wait_queue (8e6b0e4, 8e6b0cc, 0, 7ff16b0) + 63 07ff1728 __cond_wait (8e6b0e4, 8e6b0cc, d7dffdb8, 7ff1771) + 89 07ff177f cond_wait (8e6b0e4, 8e6b0cc, 8e6b0c8, 7ff17b7) + 27 07ff17cc pthread_cond_wait (8e6b0e4, 8e6b0cc, 0, 7e56137) + 24 07e5614c ldap_pvt_thread_cond_wait (8e6b0e4, 8e6b0cc, d7dfffc8, 7e54bfc) + 24 07e54d66 ldap_int_thread_pool_wrapper (8e6b0c8, 803a000, d7dfffe8, 7ff7769) + 242 07ff77bc _thrp_setup (ee1e0240) + 9d 07ff7aa0 _lwp_start (ee1e0240, 0, 0, 0, 0, 0) Thanks, Mark. ________________________________ NOTICE: Morgan Stanley is not acting as a municipal advisor and the opinions or views contained herein are not intended to be, and do not constitute, advice within the meaning of Section 975 of the Dodd-Frank Wall Street Reform and Consumer Protection Act. If you have received this communication in error, please destroy all electronic and paper copies; do not disclose, use or act upon the information; and notify the sender immediately. Mistransmission is not intended to waive confidentiality or privilege. Morgan Stanley reserves the right, to the extent permitted under applicable law, to monitor electronic communications. This message is subject to terms available at the following link: http://www.morganstanley.com/disclaimers If you cannot access these links, please notify us by reply message and we will send the contents to you. By messaging with Morgan Stanley you consent to the foregoing.

2 7

Improved handling for large number of databases / Access newly opened database from another transaction
by Jürg Bircher 27 May '16

27 May '16

Hello Improved handling for large number of databases =============================================== There is a increased performance penalty the more databases are created within the same environment. I was looking for a way the improve that by keeping the simplicity of tracking databases within a list with direct access by index (MDB_dbi). mdb_dbi_open() is however not improved with the assumption that the database handle (dbi) is cached in the application. So mdb_dbi_open() should happen only once for each database during the life time of an application. One issue is that mdb_txn_begin() (for read-only transactions) calloc the sizeof(MDB_txn) + me_maxdbs * sizeof(MDB_db + 1). The plus 1 for the dbflags. However it is sufficient only to malloc that size and clear the sizeof(MDB_txn) memset(txn, 0, sizeof(MDB_txn) After that the data beyond the MDB_txn is not initialized which is ok for the moment. The next improvement happens in mdb_txn_renew0() where the dbflags are only set to DB_UNUSED (a new flag) for each database currently opened in the environment. memset(txn->mt_dbflags, DB_UNUSED, txn->mt_numdbs); The former code used to to loop through each database to calculate the dbflags. This is still done but lazily for each accessed database with the assumption that a read only transaction rarely uses all databases of the environment. The lazy initialization of the dbflag happens in the macro TXN_DBI_EXIST which is always used when a database handle (dbi) is passed to an function. The flags are updated in mdb_setup_db_info() once a database is access which is marked as unused (DB_UNUSED). static int mdb_setup_db_info(MDB_txn *txn, MDB_dbi dbi) { /* Setup db info */ uint16_t x = txn->mt_env->me_dbflags[dbi]; txn->mt_dbs[dbi].md_flags = x & PERSISTENT_FLAGS; txn->mt_dbflags[dbi] = (x & MDB_VALID) ? DB_VALID|DB_USRVALID|DB_STALE : 0; return (txn->mt_dbflags[dbi] & validity); } /** Check \b txn and \b dbi arguments to a function and initialize db info if needed */ #define TXN_DBI_EXIST(txn, dbi, validity) \ ((txn) && (dbi)<(txn)->mt_numdbs && (((txn)->mt_dbflags[dbi] & (validity)) || (((txn)->mt_dbflags[dbi] & DB_UNUSED) && mdb_setup_db_info((txn), (dbi), (validity))))) The next improvement is done in any function which needs to loop through the databases for example in mdb_cursors_close(). Again the more databases in the environment the longer the execution time. It should be best if looping only through dbflags and searching for those databases which are used (!DB_UNUSED). This could be done byte wise or more efficient in 8/4 byte steps comparing with an extended mask DB_UNUSED_LONG instead of DB_UNUSED. So we can skip 8 or 4 (32 bit) unused databases in one step (still with the assumption that a transaction rarely uses all databases of the environment). So the loop looks as follows always starting at the lower index to avoid alignment issues with ARM prior v6. #define DB_UNUSED 0x20 /**< DB not used in this txn */ #ifdef MDB_VL32 #define DB_UNUSED_LONG 0x20202020 /* DB_UNUSED long mask for fast tracking */ #else #define DB_UNUSED_LONG 0x2020202020202020 /* DB_UNUSED long mask for fast tracking */ #endif #ifdef MDB_VL32 #define MDB_WORD unsigned int #else #define MDB_WORD unsigned long long #endif MDB_dbi n = src->mt_numdbs; MDB_dbi i = 0; while (1) { unsigned int upper = i + sizeof(MDB_WORD); if (upper < n) { // skip unused if ((*(MDB_WORD *)(tdbflags + i)) == DB_UNUSED_LONG) { i = upper; continue; } } else { upper = n; } for (; i < upper; i++) { // any other filter criteria appropriate to the function .... } if (i >= n) { break; } } Access newly opened database from another transaction ======================================================= A transaction tracks newly opened databases and if the transaction is committed the newly opened databases are propagated to the list of open databases of the environment. However if the read only transaction is aborted the databases are not propagated. If database handles (MDB_dbi) are cached in the application to avoid calling mdb_dbi_open() there might be the situation of two threads running a read only transaction concurrently. First threads opens the database and commits the read-only transaction. The database is added to the list of open databases in the environment. The returned dbi is globally cached in the application. The second thread also wants to access the same database and finds the database handle in the global application cache. The database handle however is not valid as the transaction only uses a snapshot of open databases. So the second thread gets an EINVAL when using that database handle. This should not happen as the database is open and added to the environment. The following should fix this issue by updating the mt_numdbs and marking the delta with DB_UNUSED static int mdb_update_db_info(MDB_txn *txn, MDB_dbi dbi) { /* propagate newly opened db from env to current txn. Mark them as unused */ if (txn->mt_numdbs < txn->mt_env->me_numdbs) { memset(txn->mt_dbflags + txn->mt_numdbs, DB_UNUSED, txn->mt_env->me_numdbs - txn->mt_numdbs); } txn->mt_numdbs = txn->mt_env->me_numdbs; return dbi < txn->mt_numdbs; } /** Check \b txn and \b dbi arguments to a function and initialize db info if needed */ #define TXN_DBI_EXIST(txn, dbi, validity) \ ((txn) && ((dbi)<(txn)->mt_numdbs || mdb_update_db_info((txn), (dbi))) && (((txn)->mt_dbflags[dbi] & (validity)) || (((txn)->mt_dbflags[dbi] & DB_UNUSED) && mdb_setup_db_info((txn), (dbi), (validity))))) If interested let me know how to contribute. Hope it is useful! Regards Juerg

2 5

memberOf group searches very slow
by Jason Whitener 27 May '16

27 May '16

We have some groups that contain over 250,000 members. Are there any general tips for improving performance when applications/code attempts to lookup memberOf values in the ldap? For example, I have something like ou=SomeGroup,ou=Groups,o=ourOrg. ou=SomeGroup has over 250,000 memberOf: values. Attempting to modify, search, insert, etc.. into that memberOf multivalue field takes over 20 seconds per user.

2 1

problems connecting to ldaps:// under high load with ppc64 client
by Matthias Leopold 27 May '16

27 May '16

hi, i'm operating an owncloud server that connects to an IBM Tivoli Directory Server as LDAP backend. the ldap admin tells me he is seeing "null binds" from my owncloud server in his logs: 2016-05-24T14:32:56.349452+2:00 srvr_ssl_read: EIO in handshake. EWOULDBLOCK timeout. Read: -2 of 0 2016-05-24T14:32:56.350445+2:00 GLPSSL019E The SSL layer has reported an unidentified internal error, SSL extended error code:406. 2016-05-24T14:32:56.351813+2:00 GLPSRV022E Failed to initialize secure connection from client (connection ID: 61786, IP address: x.x.x.x, Port: 59921). 2016-05-24T14:32:56.357220+2:00 GLPSRV044W Client connection from x.x.x.x bound as NULL closed by server. i investigated on my server and noticed that it has problems connecting to the ldaps://ldap.example.com uri (which is the ITDS server) under high client system load, whereas connection to ldap://ldap.example.com is ok. $ ldapsearch -v -x -z 0 -H ldaps://ldap.example.com -b "ou=groups,dc=example,dc=com" -v "objectClass=posixGroup" ldap_initialize( ldaps://ldap.example.com:636/??base ) ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) my server (RHEL 7 on a ppc64 LPAR) is using the openldap clients/libraries. the high load that is causing the problems is on _my_ server. is there any specific tuning (besides increasing RAM/CPU) i can do to optimize ldaps client queries? i'm thinking of tuning the tcp stack or something similar, but i'm not an expert on this. where can i look for debug info? i have strace and tcpdump output thx matthias

3 2

Use OpenLDAP for some users and as a proxy for another set of users?
by Siebrand Mazeland 26 May '16

26 May '16

Hi. I'm a first time poster, new to OpenLDAP, and I have identified this list as the (hopefully) best place for my question. I have an Active Directory that contains accounts and groups for employees. Besides that, there is a group of around 1000 people that also need to authenticated and authorized (based on group membership). I'm trying to assess if OpenLDAP can be used for a scenario to avoid Windows CAL license costs. Is it possible to administer and authenticate the non-employees in OpenLDAP, and proxy requests about users that are not found in OpenLDAP to an AD? The information needed by the applications using OpenLDAP would be UPN, sAMAccountName, email address and group membership of the authenticated users. If this can be accomplished with OpenLDAP, that would a) be very nice, and b) I would like you to explain this in brief here, and approach me off-list to help me accomplish this. If there's no ready-made recipe for this, and it can be done, I'm willing to publish the configuration so others can benefit from the work, too. Thanks. -- Siebrand Mazeland

2 1

ABI report for LMDB
by Ponomarenko Andrey 26 May '16

26 May '16

Hello, The LMDB library is now tracked by the ABI tracker project: http://abi-laboratory.pro/tracker/timeline/lmdb/ One can look at the recent changes in the API/ABI and analysis of backward compatibility and navigate over the history of API/ABI changes in the library. The reports are generated daily by the abi-compliance-checker and abi-tracker tools: https://github.com/lvc/abi-tracker Thank you.

1 0

Re: entryCSN is larger (later) in consumer node than in provider node
by Frank Luo 25 May '16

25 May '16

same error if I try to update this ppolicy attribute "changetype: modify replace: pwdMinLength pwdMinLength: 9" ldap_modify: Server is unwilling to perform (53) additional info: shadow context; no update referral On Wed, May 25, 2016 at 4:26 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Wednesday, May 25, 2016 5:21 PM -0400 Frank Luo <frank.luoy(a)gmail.com> > wrote: > >> yes >> >> overlay ppolicy > > > So ppolicy maintains various data internally to the server. That's likely > what is giving you #000# items. > > --Quanah > > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > A division of Synacor, Inc

1 0

Re: entryCSN is larger (later) in consumer node than in provider node
by Frank Luo 25 May '16

25 May '16

yes overlay ppolicy and overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 So it looks like on node 3 I have both syncprov and syncrepl defined? "overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 syncrepl rid=003 ..... " But actully when I try to write to node 3 directly, I have a error like this, "ldap_modify: Server is unwilling to perform (53) additional info: shadow context; no update referral " Thanks Frank On Tue, May 24, 2016 at 7:31 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > Do you have any overlays on the replicas? > > --Quanah > > --On Tuesday, May 24, 2016 4:55 PM -0400 Frank Luo <frank.luoy(a)gmail.com> > wrote: > >> but we always have two masters - and you can tell that this is pretty >> current time tag. >> >> contextCSN: 20160521215740.310825Z#000000#000#000000 >> >> Does this mean the slave gets updated from some other source in >> additional to the two masters. >> >> I am attache the replication portion of the slaver sever 3, >> server2.u.com is one of the two masters >> >> >> syncrepl rid=003 >> provider=ldap://server2.u.com >> bindmethod=simple >> binddn="cn=Manager,dc=u,dc=com" >> credentials=password >> searchbase="dc=u,dc=com" >> schemachecking=on >> type=refreshAndPersist >> retry="60 +" >> >> Thanks >> >> Frank >> >> >> >> On Tue, May 24, 2016 at 12:54 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> >> wrote: >>> >>> Sure -- 000 is from when things were single master. >>> >>> --Quanah >>> >>> --On Tuesday, May 24, 2016 12:37 PM -0400 Frank Luo >>> <frank.luoy(a)gmail.com> wrote: >>> >>>> Thanks. The two servers were off by 15 seconds >>>> >>>> I also checked contextCSN and see there were more than 1 values - any >>>> idea there are multiple? >>>> >>>> To help you understand we have a multiple(2) masters and three slaves. >>>> >>>> on two masters (node1 and node 2), each has two contextCSN like this, >>>> I can understand since they are in mirror mode, it get updates from >>>> each other >>>> >>>> node 1: >>>> contextCSN: 20160524152519.525094Z#000000#001#000000 >>>> contextCSN: 20160524152340.159717Z#000000#002#000000 >>>> >>>> node 2: >>>> contextCSN: 20160524152519.525094Z#000000#001#000000 >>>> contextCSN: 20160524152340.159717Z#000000#002#000000 >>>> >>>> >>>> on three slavers (nodes3,4 and5), each has 3 contextCSN. Where does >>>> the third contextCSN come from - you can see the third one is out of >>>> sync with each other. >>>> >>>> node 3: >>>> contextCSN: 20160524152519.525094Z#000000#001#000000 >>>> contextCSN: 20160521215740.310825Z#000000#000#000000 >>>> contextCSN: 20160524152340.159717Z#000000#002#000000 >>>> >>>> node 4: >>>> contextCSN: 20160524152519.525094Z#000000#001#000000 >>>> contextCSN: 20160524152558.806951Z#000000#000#000000 >>>> contextCSN: 20160524152340.159717Z#000000#002#000000 >>>> >>>> node 5: >>>> contextCSN: 20150723095205.352520Z#000000#000#000000 >>>> contextCSN: 20160524152519.525094Z#000000#001#000000 >>>> contextCSN: 20160524152340.159717Z#000000#002#000000 >>>> >>>> THanks >>>> >>>> Frank >>>> >>>> >>>> On Mon, May 23, 2016 at 5:11 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> >>>> wrote: >>>>> >>>>> >>>>> --On Monday, May 23, 2016 5:56 PM -0400 Frank Luo >>>>> <frank.luoy(a)gmail.com> wrote: >>>>> >>>>>> All, >>>>>> >>>>>> I am having a out-of sync situation now with some entries' entryCSN >>>>>> is larger (later) in consumer node than in provider node. So the >>>>>> consumer never gets updated since it thinks it has the latest value. >>>>> >>>>> >>>>> >>>>> >>>>> Check the clocks on each server. It is required that your clocks be >>>>> tightly sync'd. >>>>> >>>>> --Quanah >>>>> >>>>> >>>>> -- >>>>> >>>>> Quanah Gibson-Mount >>>>> Platform Architect >>>>> Zimbra, Inc. >>>>> -------------------- >>>>> Zimbra :: the leader in open source messaging and collaboration >>>>> A division of Synacor, Inc >>> >>> >>> >>> >>> >>> -- >>> >>> Quanah Gibson-Mount >>> Platform Architect >>> Zimbra, Inc. >>> -------------------- >>> Zimbra :: the leader in open source messaging and collaboration >>> A division of Synacor, Inc > > > > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > A division of Synacor, Inc

2 1

Partial SyncRepl replication
by Frank Swasey 25 May '16

25 May '16

I am running OpenLDAP 2.4.44 locally built on RHEL7 using mdb as the database backend. I am attempting to replicate just the inetLocalMailRecipient objectclass and the DSA attributes to a new set of replicas that will be in charge of delivering mail. I would like the DSA attributes (creator, modifier, contextCSN, entryCSN, entryUUID - etc) to be included, so I can more easily tell if the partial replica is actually staying sync'd to the master. My reading of the man pages for slapd.conf and slapd.access have me part way there, but setting up a replication DN and using acls to limit its access to the inetLocalMailRecipient objectclass. What I'm not finding is a way to specify all of (what I'm calling) the DSA attributes (without naming them all individually) - have I missed something in the man pages or is the source code (or the benevolence of one of you good folks) my only hope? -- Frank Swasey | http://www.uvm.edu/~fcs Sr Systems Administrator | Always remember: You are UNIQUE, University of Vermont | just like everyone else. "I am not young enough to know everything." - Oscar Wilde (1854-1900)

4 8

Re: entryCSN is larger (later) in consumer node than in provider node
by Frank Luo 25 May '16

25 May '16

but we always have two masters - and you can tell that this is pretty current time tag. contextCSN: 20160521215740.310825Z#000000#000#000000 Does this mean the slave gets updated from some other source in additional to the two masters. I am attache the replication portion of the slaver sever 3, server2.u.com is one of the two masters syncrepl rid=003 provider=ldap://server2.u.com bindmethod=simple binddn="cn=Manager,dc=u,dc=com" credentials=password searchbase="dc=u,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" Thanks Frank On Tue, May 24, 2016 at 12:54 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > Sure -- 000 is from when things were single master. > > --Quanah > > --On Tuesday, May 24, 2016 12:37 PM -0400 Frank Luo <frank.luoy(a)gmail.com> > wrote: > >> Thanks. The two servers were off by 15 seconds >> >> I also checked contextCSN and see there were more than 1 values - any >> idea there are multiple? >> >> To help you understand we have a multiple(2) masters and three slaves. >> >> on two masters (node1 and node 2), each has two contextCSN like this, >> I can understand since they are in mirror mode, it get updates from >> each other >> >> node 1: >> contextCSN: 20160524152519.525094Z#000000#001#000000 >> contextCSN: 20160524152340.159717Z#000000#002#000000 >> >> node 2: >> contextCSN: 20160524152519.525094Z#000000#001#000000 >> contextCSN: 20160524152340.159717Z#000000#002#000000 >> >> >> on three slavers (nodes3,4 and5), each has 3 contextCSN. Where does >> the third contextCSN come from - you can see the third one is out of >> sync with each other. >> >> node 3: >> contextCSN: 20160524152519.525094Z#000000#001#000000 >> contextCSN: 20160521215740.310825Z#000000#000#000000 >> contextCSN: 20160524152340.159717Z#000000#002#000000 >> >> node 4: >> contextCSN: 20160524152519.525094Z#000000#001#000000 >> contextCSN: 20160524152558.806951Z#000000#000#000000 >> contextCSN: 20160524152340.159717Z#000000#002#000000 >> >> node 5: >> contextCSN: 20150723095205.352520Z#000000#000#000000 >> contextCSN: 20160524152519.525094Z#000000#001#000000 >> contextCSN: 20160524152340.159717Z#000000#002#000000 >> >> THanks >> >> Frank >> >> >> On Mon, May 23, 2016 at 5:11 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> >> wrote: >>> >>> --On Monday, May 23, 2016 5:56 PM -0400 Frank Luo <frank.luoy(a)gmail.com> >>> wrote: >>> >>>> All, >>>> >>>> I am having a out-of sync situation now with some entries' entryCSN >>>> is larger (later) in consumer node than in provider node. So the >>>> consumer never gets updated since it thinks it has the latest value. >>> >>> >>> >>> Check the clocks on each server. It is required that your clocks be >>> tightly sync'd. >>> >>> --Quanah >>> >>> >>> -- >>> >>> Quanah Gibson-Mount >>> Platform Architect >>> Zimbra, Inc. >>> -------------------- >>> Zimbra :: the leader in open source messaging and collaboration >>> A division of Synacor, Inc > > > > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > A division of Synacor, Inc

3 2

Re: entryCSN is larger (later) in consumer node than in provider node
by Frank Luo 24 May '16

24 May '16

Thanks. The two servers were off by 15 seconds I also checked contextCSN and see there were more than 1 values - any idea there are multiple? To help you understand we have a multiple(2) masters and three slaves. on two masters (node1 and node 2), each has two contextCSN like this, I can understand since they are in mirror mode, it get updates from each other node 1: contextCSN: 20160524152519.525094Z#000000#001#000000 contextCSN: 20160524152340.159717Z#000000#002#000000 node 2: contextCSN: 20160524152519.525094Z#000000#001#000000 contextCSN: 20160524152340.159717Z#000000#002#000000 on three slavers (nodes3,4 and5), each has 3 contextCSN. Where does the third contextCSN come from - you can see the third one is out of sync with each other. node 3: contextCSN: 20160524152519.525094Z#000000#001#000000 contextCSN: 20160521215740.310825Z#000000#000#000000 contextCSN: 20160524152340.159717Z#000000#002#000000 node 4: contextCSN: 20160524152519.525094Z#000000#001#000000 contextCSN: 20160524152558.806951Z#000000#000#000000 contextCSN: 20160524152340.159717Z#000000#002#000000 node 5: contextCSN: 20150723095205.352520Z#000000#000#000000 contextCSN: 20160524152519.525094Z#000000#001#000000 contextCSN: 20160524152340.159717Z#000000#002#000000 THanks Frank On Mon, May 23, 2016 at 5:11 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Monday, May 23, 2016 5:56 PM -0400 Frank Luo <frank.luoy(a)gmail.com> > wrote: > >> All, >> >> I am having a out-of sync situation now with some entries' entryCSN >> is larger (later) in consumer node than in provider node. So the >> consumer never gets updated since it thinks it has the latest value. > > > Check the clocks on each server. It is required that your clocks be tightly > sync'd. > > --Quanah > > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > A division of Synacor, Inc

2 1

back-ldap and Proxy operation retry failed
by Abdelkader Chelouah 24 May '16

24 May '16

(Sorry for posting this message again, but it's better with a Subject) OpenLDAP 2.4.44 under RHEL 7.1 I'm using back-ldap to proxy a back-mdb instance with 1K users. The relevant part of the proxy configuration is dn: olcDatabase={2}ldap,cn=config objectClass: olcDatabaseConfig objectClass: olcLDAPConfig olcDatabase: {2}ldap olcSuffix: dc=example,dc=com olcDbURI: "ldap://ldap-server.example.com:389/" olcDbIDAssertBind: bindmethod=none olcDbIDAssertAuthzFrom: {0}"*" olcDbRebindAsUser: TRUE olcDbChaseReferrals: TRUE I'm using slamd for doing performance tests. According to the back-ldap man page, sessions that explicitly Bind to the back-ldap database always create their own private connection to the remote LDAP server. However, it seems that the private connections are not reused for further BIND with the same user since the available file descriptors (8192) on remote server are quickly exhausted (recall that my LDAP server has only 1K users, BINDs with slamd are performed randomly). The private connections are closed after the remote LDAP server idletimeout (15mn), but remain stuck in a CLOSE_WAIT status. Using the parameter olcDbSingleConn: TRUE improves the situation (the number of connections open on the remote server and the proxy are more or less identical), but slapd logs show errors 2016-05-23T11:18:50.100499+02:00 proxy-ldap slapd-proxy_ldap[18402]: conn=1419 op=7201 ldap_back_retry: retrying URI="ldap:// mirror.example.com:389" DN="" 2016-05-23T11:18:50.100542+02:00 proxy-ldap slapd-proxy_ldap[18402]: conn=1419 op=7201 RESULT tag=97 err=52 text=Proxy operation retry failed The encountred problem seems to be related to ITS#4387 ( http://www.openldap.org/its/index.cgi/Archive.Software%20Bugs?id=4387;selec…) and ITS#4420 ( http://www.openldap.org/its/index.cgi/Archive.Incoming?id=4420;selectid=442… ) Do I have to file an ITS ?

1 0

issue with filter string for numerical uid
by Rene Zeipelt 24 May '16

24 May '16

Hello , I hope this is the right point for my problem: we have a 2.4.40 slapd running on Debian Jessie with inetOrgPerson entries that have (indexed) numerical uid values. No problems if the user login on our web app (moodle) but some users get input mistakes and use superscripted first letter which also works. Here an example: uid=1228849 and uid=¹228849 works also. If I check the debug output for the superscripted version I got: May 24 09:44:23 rldapd slapd[600]: begin get_filter May 24 09:44:23 rldapd slapd[600]: EQUALITY May 24 09:44:23 rldapd slapd[600]: end get_filter 0 May 24 09:44:23 rldapd slapd[600]: filter: (uid=1228849) May 24 09:44:23 rldapd slapd[600]: attrs: If I trace the network traffic data there is a difference between the queries 0x0090: 0375 6964 0407 3132 3238 3834 3930 00 .uid..12288490. 0x0090: 0375 6964 0408 c2b9 3232 3838 3439 3000 .uid....2288490. The command line tool "ldapsearch" do the same. So for the web app the superscripted version is a different user and for slapd it is not. Why slapd is interpreted the superscripted 1 as 1? Is this a bug or must check the input before it is send to slapd? Thanks for any help. Best regards Rene --

1 0

entryCSN is larger (later) in consumer node than in provider node
by Frank Luo 23 May '16

23 May '16

All, I am having a out-of sync situation now with some entries' entryCSN is larger (later) in consumer node than in provider node. So the consumer never gets updated since it thinks it has the latest value. provider: entryCSN: 20160520164908.960158Z#000000#001#000000 consumer: entryCSN: 20160521191401.646572Z#000000#000#000000 slapd.conf in consumer: overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 syncrepl rid=003 provider=ldap://server.u.edu bindmethod=simple binddn="cn=Manager,dc=u,dc=com" credentials=password searchbase="dc=u,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" Any hint about this? Thanks a lot! Frank

2 1

(no subject)
by Abdelkader Chelouah 23 May '16

23 May '16

OpenLDAP 2.4.44 under RHEL 7.1 I'm using back-ldap to proxy a back-mdb instance with 1K users. The relevant part of the proxy configuration is dn: olcDatabase={2}ldap,cn=config objectClass: olcDatabaseConfig objectClass: olcLDAPConfig olcDatabase: {2}ldap olcSuffix: dc=example,dc=com olcDbURI: "ldap://ldap-server.example.com:389/" olcDbIDAssertBind: bindmethod=none olcDbIDAssertAuthzFrom: {0}"*" olcDbRebindAsUser: TRUE olcDbChaseReferrals: TRUE I'm using slamd for doing performance tests. According to the back-ldap man page, sessions that explicitly Bind to the back-ldap database always create their own private connection to the remote LDAP server. The private connections are closed after the remote LDAP server idletimeout (15mn), but remain stuck in a CLOSE_WAIT status. Moreover, it seems that the private connections are not reused for further BIND with the same user since the available file descriptors (8192) on remote server are quickly exhausted (only 1K users). Using the parameter olcDbSingleConn: TRUE improves the situation (the number of connections open on the remote server and the proxy are more or less identical), but slapd logs show errors 2016-05-23T11:18:50.100499+02:00 proxy-ldap slapd-proxy_ldap[18402]: conn=1419 op=7201 ldap_back_retry: retrying URI="ldap:// mirror.example.com:389" DN="" 2016-05-23T11:18:50.100542+02:00 proxy-ldap slapd-proxy_ldap[18402]: conn=1419 op=7201 RESULT tag=97 err=52 text=Proxy operation retry failed The encountred problem seems to be related to ITS#4387 ( http://www.openldap.org/its/index.cgi/Archive.Software%20Bugs?id=4387;selec…) and ITS#4420 ( http://www.openldap.org/its/index.cgi/Archive.Incoming?id=4420;selectid=442… )

1 0

Translucent problem
by Frank Rust 22 May '16

22 May '16

Hi all, I want to try a translucent configuration: The local ldap shall overlay the central ldap with local information on mail routing. I only have read access to the central ldap server. Generally it works fine, when using bind with a locally known user. But when I try bind with a user of the central ldap (for mail user authentication) it fails. Example: $ ldapsearch -LLL -w pass -b cn=sendmail,dc=some,dc=local,dc=company,dc=de -H ldap://localhost/ -b ou=People,dc=company,dc=de uid=myUID cn uid mailLocalAddress returns me absolutely correct: dn: uid=myUID,ou=people,dc=company,dc=de uid: nyUID cn: Firstname Name mailLocalAddress: firstname.name(a)some.local.company.de mailLocalAddress: f.name(a)some.local.company.de mailLocalAddress: myUID(a)some.local.company.de $ ldapsearch -LLL -w myPass -b uid=myUID,ou=People,dc=company,dc=de -H ldap://localhost/ -b ou=People,dc=company,dc=de uid=myUID cn did mailLocalAddress returns no results. When tcpdumping network traffic to central ldap I can see that the correct result is returned. What am I possibly doing wrong? Thanks in advance for any hints. Best regards, Frank ### Relevant parts of my configuration: # {2}mdb, config dn: olcDatabase={2}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {2}mdb olcDbDirectory: /var/lib/ldap/translucent olcSuffix: ou=People,dc=company,dc=de olcRootDN: cn=local-admin,ou=People,dc=company,dc=de olcRootPW:: secret... olcDbIndex: objectClass eq olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonym ous auth by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to dn.children="ou=People,dc=company,dc=de" by dn="cn=sendmail,dc =some,dc=local,dc=company,dc=de" read # {0}translucent, {2}mdb, config dn: olcOverlay={0}translucent,olcDatabase={2}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcTranslucentConfig olcOverlay: {0}translucent olcTranslucentLocal: mailLocalAddress,mailRoutingAddress,mailHost # {0}ldap, {0}translucent, {2}mdb, config dn: olcDatabase={0}ldap,olcOverlay={0}translucent,olcDatabase={2}mdb,cn=config objectClass: olcLDAPConfig objectClass: olcTranslucentDatabase olcDatabase: {0}ldap olcDbURI: "ldap://ldap.company.de" olcDbStartTLS: none starttls=no olcDbRebindAsUser: FALSE olcDbChaseReferrals: TRUE olcDbTFSupport: no olcDbProxyWhoAmI: FALSE olcDbProtocolVersion: 3 olcDbSingleConn: FALSE olcDbCancel: abandon olcDbUseTemporaryConn: FALSE olcDbConnectionPoolMax: 16 olcDbSessionTrackingRequest: FALSE olcDbNoRefs: FALSE olcDbNoUndefFilter: FALSE olcDbOnErr: continue olcDbKeepalive: 0:0:0 ### Logfile on failed request: May 22 13:46:24 ldap slapd[493]: daemon: activity on 1 descriptor May 22 13:46:24 ldap slapd[493]: daemon: activity on: May 22 13:46:24 ldap slapd[493]: May 22 13:46:24 ldap slapd[493]: slap_listener_activate(10): May 22 13:46:24 ldap slapd[493]: daemon: epoll: listen=9 active_threads=0 tvp=zero May 22 13:46:24 ldap slapd[493]: daemon: epoll: listen=10 busy May 22 13:46:24 ldap slapd[493]: daemon: epoll: listen=11 active_threads=0 tvp=zero May 22 13:46:24 ldap slapd[493]: daemon: epoll: listen=12 active_threads=0 tvp=zero May 22 13:46:24 ldap slapd[493]: daemon: epoll: listen=13 active_threads=0 tvp=zero May 22 13:46:24 ldap slapd[493]: >>> slap_listener(ldap:///) May 22 13:46:24 ldap slapd[493]: daemon: listen=10, new connection on 22 May 22 13:46:24 ldap slapd[493]: daemon: added 22r (active) listener=(nil) May 22 13:46:24 ldap slapd[493]: conn=1874 fd=22 ACCEPT from IP=[::1]:49124 (IP=[::]:389) May 22 13:46:24 ldap slapd[493]: daemon: activity on 1 descriptor May 22 13:46:24 ldap slapd[493]: daemon: activity on: May 22 13:46:24 ldap slapd[493]: May 22 13:46:24 ldap slapd[493]: daemon: epoll: listen=9 active_threads=0 tvp=zero May 22 13:46:24 ldap slapd[493]: daemon: epoll: listen=10 active_threads=0 tvp=zero May 22 13:46:24 ldap slapd[493]: daemon: epoll: listen=11 active_threads=0 tvp=zero May 22 13:46:24 ldap slapd[493]: daemon: epoll: listen=12 active_threads=0 tvp=zero May 22 13:46:24 ldap slapd[493]: daemon: epoll: listen=13 active_threads=0 tvp=zero May 22 13:46:24 ldap slapd[493]: daemon: activity on 1 descriptor May 22 13:46:24 ldap slapd[493]: daemon: activity on: May 22 13:46:24 ldap slapd[493]: 22r May 22 13:46:24 ldap slapd[493]: May 22 13:46:24 ldap slapd[493]: daemon: read active on 22 May 22 13:46:24 ldap slapd[493]: daemon: epoll: listen=9 active_threads=0 tvp=zero May 22 13:46:24 ldap slapd[493]: daemon: epoll: listen=10 active_threads=0 tvp=zero May 22 13:46:24 ldap slapd[493]: daemon: epoll: listen=11 active_threads=0 tvp=zero May 22 13:46:24 ldap slapd[493]: daemon: epoll: listen=12 active_threads=0 tvp=zero May 22 13:46:24 ldap slapd[493]: daemon: epoll: listen=13 active_threads=0 tvp=zero May 22 13:46:24 ldap slapd[493]: connection_get(22) May 22 13:46:24 ldap slapd[493]: connection_get(22): got connid=1874 May 22 13:46:24 ldap slapd[493]: connection_read(22): checking for input on id=1874 May 22 13:46:24 ldap slapd[493]: op tag 0x60, time 1463917584 May 22 13:46:24 ldap slapd[493]: conn=1874 op=0 do_bind May 22 13:46:24 ldap slapd[493]: >>> dnPrettyNormal: <uid=myUID,ou=People,dc=company,dc=de> May 22 13:46:24 ldap slapd[493]: <<< dnPrettyNormal: <uid=myUID,ou=People,dc=company,dc=de>, <uid=myUID,ou=people,dc=company,dc=de> May 22 13:46:24 ldap slapd[493]: conn=1874 op=0 BIND dn="uid=myUID,ou=People,dc=company,dc=de" method=128 May 22 13:46:24 ldap slapd[493]: do_bind: version=3 dn="uid=myUID,ou=People,dc=company,dc=de" method=128 May 22 13:46:24 ldap slapd[493]: translucent_bind: <uid=myUID,ou=People,dc=company,dc=de> method 128 May 22 13:46:24 ldap slapd[493]: =>ldap_back_getconn: conn=1874 op=0: lc=0x7f3d44133a60 inserted refcnt=1 rc=0 May 22 13:46:24 ldap slapd[493]: daemon: activity on 1 descriptor May 22 13:46:24 ldap slapd[493]: daemon: activity on: May 22 13:46:24 ldap slapd[493]: May 22 13:46:24 ldap slapd[493]: daemon: epoll: listen=9 active_threads=0 tvp=zero May 22 13:46:24 ldap slapd[493]: daemon: epoll: listen=10 active_threads=0 tvp=zero May 22 13:46:24 ldap slapd[493]: daemon: epoll: listen=11 active_threads=0 tvp=zero May 22 13:46:24 ldap slapd[493]: daemon: epoll: listen=12 active_threads=0 tvp=zero May 22 13:46:24 ldap slapd[493]: daemon: epoll: listen=13 active_threads=0 tvp=zero May 22 13:46:25 ldap slapd[493]: conn=1874 op=0 BIND dn="uid=myUID,ou=People,dc=company,dc=de" mech=SIMPLE ssf=0 May 22 13:46:25 ldap slapd[493]: do_bind: v3 bind: "uid=myUID,ou=People,dc=company,dc=de" to "uid=myUID,ou=People,dc=company,dc=de" May 22 13:46:25 ldap slapd[493]: send_ldap_result: conn=1874 op=0 p=3 May 22 13:46:25 ldap slapd[493]: send_ldap_result: err=0 matched="" text="" May 22 13:46:25 ldap slapd[493]: send_ldap_response: msgid=1 tag=97 err=0 May 22 13:46:25 ldap slapd[493]: conn=1874 op=0 RESULT tag=97 err=0 text= May 22 13:46:25 ldap slapd[493]: daemon: activity on 1 descriptor May 22 13:46:25 ldap slapd[493]: daemon: activity on: May 22 13:46:25 ldap slapd[493]: 22r May 22 13:46:25 ldap slapd[493]: May 22 13:46:25 ldap slapd[493]: daemon: read active on 22 May 22 13:46:25 ldap slapd[493]: daemon: epoll: listen=9 active_threads=0 tvp=zero May 22 13:46:25 ldap slapd[493]: daemon: epoll: listen=10 active_threads=0 tvp=zero May 22 13:46:25 ldap slapd[493]: daemon: epoll: listen=11 active_threads=0 tvp=zero May 22 13:46:25 ldap slapd[493]: daemon: epoll: listen=12 active_threads=0 tvp=zero May 22 13:46:25 ldap slapd[493]: daemon: epoll: listen=13 active_threads=0 tvp=zero May 22 13:46:25 ldap slapd[493]: connection_get(22) May 22 13:46:25 ldap slapd[493]: connection_get(22): got connid=1874 May 22 13:46:25 ldap slapd[493]: connection_read(22): checking for input on id=1874 May 22 13:46:25 ldap slapd[493]: op tag 0x63, time 1463917585 May 22 13:46:25 ldap slapd[493]: conn=1874 op=1 do_search May 22 13:46:25 ldap slapd[493]: >>> dnPrettyNormal: <ou=People,dc=company,dc=de> May 22 13:46:25 ldap slapd[493]: <<< dnPrettyNormal: <ou=People,dc=company,dc=de>, <ou=people,dc=company,dc=de> May 22 13:46:25 ldap slapd[493]: SRCH "ou=People,dc=company,dc=de" 2 0 May 22 13:46:25 ldap slapd[493]: 0 0 0 May 22 13:46:25 ldap slapd[493]: begin get_filter May 22 13:46:25 ldap slapd[493]: EQUALITY May 22 13:46:25 ldap slapd[493]: end get_filter 0 May 22 13:46:25 ldap slapd[493]: filter: (uid=myUID) May 22 13:46:25 ldap slapd[493]: attrs: May 22 13:46:25 ldap slapd[493]: cn May 22 13:46:25 ldap slapd[493]: uid May 22 13:46:25 ldap slapd[493]: mailLocalAddress May 22 13:46:25 ldap slapd[493]: userPassword May 22 13:46:25 ldap slapd[493]: May 22 13:46:25 ldap slapd[493]: conn=1874 op=1 SRCH base="ou=People,dc=company,dc=de" scope=2 deref=0 filter="(uid=myUID)" May 22 13:46:25 ldap slapd[493]: conn=1874 op=1 SRCH attr=cn uid mailLocalAddress userPassword May 22 13:46:25 ldap slapd[493]: ==> limits_get: conn=1874 op=1 self="uid=myUID,ou=people,dc=company,dc=de" this="ou=people,dc=company,dc=de" May 22 13:46:25 ldap slapd[493]: ==> translucent_search: <ou=People,dc=company,dc=de> (uid=myUID) May 22 13:46:25 ldap slapd[493]: =>ldap_back_getconn: conn 0x7f3d44133a60 fetched refcnt=1. May 22 13:46:25 ldap slapd[493]: => ldap_back_munge_filter "(uid=myUID)" May 22 13:46:25 ldap slapd[493]: <= ldap_back_munge_filter "(uid=myUID)" (0) May 22 13:46:25 ldap slapd[493]: daemon: activity on 1 descriptor May 22 13:46:25 ldap slapd[493]: daemon: activity on: May 22 13:46:25 ldap slapd[493]: May 22 13:46:25 ldap slapd[493]: daemon: epoll: listen=9 active_threads=0 tvp=zero May 22 13:46:25 ldap slapd[493]: daemon: epoll: listen=10 active_threads=0 tvp=zero May 22 13:46:25 ldap slapd[493]: daemon: epoll: listen=11 active_threads=0 tvp=zero May 22 13:46:25 ldap slapd[493]: daemon: epoll: listen=12 active_threads=0 tvp=zero May 22 13:46:25 ldap slapd[493]: daemon: epoll: listen=13 active_threads=0 tvp=zero May 22 13:46:25 ldap slapd[493]: >>> dnPrettyNormal: <uid=myUID,ou=people,dc=company,dc=de> May 22 13:46:25 ldap slapd[493]: <<< dnPrettyNormal: <uid=myUID,ou=people,dc=company,dc=de>, <uid=myUID,ou=people,dc=company,dc=de> May 22 13:46:25 ldap slapd[493]: >>> dnPretty: <cn=ldaproot,dc=company,dc=de> May 22 13:46:25 ldap slapd[493]: <<< dnPretty: <cn=ldaproot,dc=company,dc=de> May 22 13:46:25 ldap slapd[493]: >>> dnNormalize: <cn=ldaproot,dc=company,dc=de> May 22 13:46:25 ldap slapd[493]: <<< dnNormalize: <cn=ldaproot,dc=company,dc=de> May 22 13:46:25 ldap slapd[493]: >>> dnPretty: <cn=ldaproot,dc=company,dc=de> May 22 13:46:25 ldap slapd[493]: <<< dnPretty: <cn=ldaproot,dc=company,dc=de> May 22 13:46:25 ldap slapd[493]: >>> dnNormalize: <cn=ldaproot,dc=company,dc=de> May 22 13:46:25 ldap slapd[493]: <<< dnNormalize: <cn=ldaproot,dc=company,dc=de> May 22 13:46:25 ldap slapd[493]: ==> translucent_search_cb: uid=myUID,ou=people,dc=company,dc=de May 22 13:46:25 ldap slapd[493]: => mdb_entry_get: ndn: "uid=myUID,ou=people,dc=company,dc=de" May 22 13:46:25 ldap slapd[493]: => mdb_entry_get: oc: "(null)", at: "(null)" May 22 13:46:25 ldap slapd[493]: mdb_dn2entry("uid=myUID,ou=people,dc=company,dc=de") May 22 13:46:25 ldap slapd[493]: => mdb_dn2id("uid=myUID,ou=people,dc=company,dc=de") May 22 13:46:25 ldap slapd[493]: <= mdb_dn2id: got id=0x2 May 22 13:46:25 ldap slapd[493]: => mdb_entry_decode: May 22 13:46:25 ldap slapd[493]: <= mdb_entry_decode May 22 13:46:25 ldap slapd[493]: => mdb_entry_get: found entry: "uid=myUID,ou=people,dc=company,dc=de" May 22 13:46:25 ldap slapd[493]: mdb_entry_get: rc=0 May 22 13:46:25 ldap slapd[493]: => test_filter May 22 13:46:25 ldap slapd[493]: EQUALITY May 22 13:46:25 ldap slapd[493]: => access_allowed: search access to "uid=myUID,ou=people,dc=company,dc=de" "uid" requested May 22 13:46:25 ldap slapd[493]: => dn: [2] May 22 13:46:25 ldap slapd[493]: => dn: [3] ou=people,dc=company,dc=de May 22 13:46:25 ldap slapd[493]: => acl_get: [3] matched May 22 13:46:25 ldap slapd[493]: => acl_get: [3] attr uid May 22 13:46:25 ldap slapd[493]: => acl_mask: access to entry "uid=myUID,ou=people,dc=company,dc=de", attr "uid" requested May 22 13:46:25 ldap slapd[493]: => acl_mask: to value by "uid=myUID,ou=people,dc=company,dc=de", (=0) May 22 13:46:25 ldap slapd[493]: <= check a_dn_pat: cn=sendmail,dc=some,dc=local,dc=company,dc=de May 22 13:46:25 ldap slapd[493]: <= acl_mask: no more <who> clauses, returning =0 (stop) May 22 13:46:25 ldap slapd[493]: => slap_access_allowed: search access denied by =0 May 22 13:46:25 ldap slapd[493]: => access_allowed: no more rules May 22 13:46:25 ldap slapd[493]: <= test_filter 50 May 22 13:46:25 ldap slapd[493]: send_ldap_result: conn=1874 op=1 p=3 May 22 13:46:25 ldap slapd[493]: send_ldap_result: err=0 matched="" text="" May 22 13:46:25 ldap slapd[493]: send_ldap_response: msgid=2 tag=101 err=0 May 22 13:46:25 ldap slapd[493]: conn=1874 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= May 22 13:46:25 ldap slapd[493]: daemon: activity on 1 descriptor May 22 13:46:25 ldap slapd[493]: daemon: activity on: May 22 13:46:25 ldap slapd[493]: 22r May 22 13:46:25 ldap slapd[493]: May 22 13:46:25 ldap slapd[493]: daemon: read active on 22 May 22 13:46:25 ldap slapd[493]: daemon: epoll: listen=9 active_threads=0 tvp=zero May 22 13:46:25 ldap slapd[493]: daemon: epoll: listen=10 active_threads=0 tvp=zero May 22 13:46:25 ldap slapd[493]: daemon: epoll: listen=11 active_threads=0 tvp=zero May 22 13:46:25 ldap slapd[493]: daemon: epoll: listen=12 active_threads=0 tvp=zero May 22 13:46:25 ldap slapd[493]: daemon: epoll: listen=13 active_threads=0 tvp=zero May 22 13:46:25 ldap slapd[493]: connection_get(22) May 22 13:46:25 ldap slapd[493]: connection_get(22): got connid=1874 May 22 13:46:25 ldap slapd[493]: connection_read(22): checking for input on id=1874 May 22 13:46:25 ldap slapd[493]: op tag 0x42, time 1463917585 May 22 13:46:25 ldap slapd[493]: ber_get_next on fd 22 failed errno=0 (Success) May 22 13:46:25 ldap slapd[493]: connection_read(22): input error=-2 id=1874, closing. May 22 13:46:25 ldap slapd[493]: connection_closing: readying conn=1874 sd=22 for close May 22 13:46:25 ldap slapd[493]: connection_close: deferring conn=1874 sd=22 May 22 13:46:25 ldap slapd[493]: conn=1874 op=2 do_unbind May 22 13:46:25 ldap slapd[493]: conn=1874 op=2 UNBIND May 22 13:46:25 ldap slapd[493]: connection_resched: attempting closing conn=1874 sd=22 May 22 13:46:25 ldap slapd[493]: connection_close: conn=1874 sd=22 May 22 13:46:25 ldap slapd[493]: translucent_connection_destroy May 22 13:46:25 ldap slapd[493]: =>ldap_back_conn_destroy: fetching conn 1874 May 22 13:46:25 ldap slapd[493]: =>ldap_back_conn_destroy: destroying conn 1874 refcnt=0 flags=0x00000101 May 22 13:46:25 ldap slapd[493]: daemon: removing 22 May 22 13:46:25 ldap slapd[493]: conn=1874 fd=22 closed May 22 13:46:25 ldap slapd[493]: daemon: activity on 1 descriptor May 22 13:46:25 ldap slapd[493]: daemon: activity on: May 22 13:46:25 ldap slapd[493]: May 22 13:46:25 ldap slapd[493]: daemon: epoll: listen=9 active_threads=0 tvp=zero May 22 13:46:25 ldap slapd[493]: daemon: epoll: listen=10 active_threads=0 tvp=zero May 22 13:46:25 ldap slapd[493]: daemon: epoll: listen=11 active_threads=0 tvp=zero May 22 13:46:25 ldap slapd[493]: daemon: epoll: listen=12 active_threads=0 tvp=zero May 22 13:46:25 ldap slapd[493]: daemon: epoll: listen=13 active_threads=0 tvp=zero

1 0

[LMDB] New product using LMDB
by Christian Sell 21 May '16

21 May '16

Hello all, I would like to introduce another product/tool that is based on LMDB and might be useful to some. Enter "LightningObjects", the High Performance embedded C++ Object Storage solution. LO is a template based mapping layer that turns LMDB (or any other key/value store that can be adapted to the internal abstract storage API) into a transactional C++ object store. Code is available at https://github.com/gsvitec/lightning-objects. Currently in alpha state, but used in a large commercial project already. I look forward to anyone's comments. regards, Christian Sell

2 1

pw-sha2, olcPasswordHash, SSHA512 & with cn=config
by Patrick Ohearn 17 May '16

17 May '16

Hi, I am running into an issue with changing olcPasswordHash to SSHA512, in cn=config . OpenLDAP appears not to load the pw-sha2 module from contrib, until after it reads cn=config, causing slaptest to fail. This looks to have already been reported in ITS 7802, however the ticket is closed and I don't see any obvious resolution to the issue. -- Email: pat(a)ge3k.net IM: pat(a)ge3k.net Site: http://ge3k.net

2 1

SLAPD WON'T START ON ONE OF THE MULTIMASTERS
by Borresen, John - 0444 - MITLL 16 May '16

16 May '16

We have a 3-way multimaster configuration running on CentOS 5.11, OpenLDAP 2.4.40. All three have been up for years, until the other day: Slapd is running on two of the three (server names: ldapserver1, ldapserver2, and ldapserver3). Slapd stopped and won't restart on ldapserver2. >From Logs on ldapserver2: May 10 04:02:13 gp42-admin4 slapd[4541]: slapd shutdown: waiting for 0 operations/tasks to finish May 10 04:02:19 gp42-admin4 slapd[15633]: @(#) $OpenLDAP: slapd 2.4.40 (Sep 30 2014 16:49:45) $#012#011clement@localhost.localdomain:/home/clement/build/BUILD/openldap-2. 4.40/servers/slapd May 10 04:02:19 gp42-admin4 slapd[15633]: nss-ldap: do_open: do_start_tls failed:stat=-1 May 10 04:02:19 gp42-admin4 slapd[15633]: nss_ldap: reconnected to LDAP server ldap://ldapserver1.example.com May 10 04:02:21 gp42-admin4 slapd[15634]: bdb_db_open: database "cn=accesslog": database already in use. May 10 04:02:21 gp42-admin4 slapd[15634]: backend_startup_one (type=bdb, suffix="cn=accesslog"): bi_db_open failed! (-1) May 10 04:02:21 gp42-admin4 slapd[15634]: slapd stopped. May 10 04:02:22 gp42-admin4 slapd[4541]: slapd stopped. When attempting to restart slapd on server2: May 13 10:13:54 gp42-admin4 slapd[12085]: @(#) $OpenLDAP: slapd 2.4.40 (Sep 30 2014 16:49:45) $#012#011clement@localhost.localdomain:/home/clement/build/BUILD/openldap-2. 4.40/servers/slapd May 13 10:13:54 gp42-admin4 slapd[12085]: nss-ldap: do_open: do_start_tls failed:stat=-1 May 13 10:13:54 gp42-admin4 slapd[12085]: nss_ldap: reconnected to LDAP server ldap://ldapserver1.example.com May 13 10:13:56 gp42-admin4 slapd[12086]: slapd starting May 13 10:13:56 gp42-admin4 slapd[12086]: do_syncrep2: rid=002 (4096) Content Sync Refresh Required May 13 10:13:56 gp42-admin4 slapd[12086]: do_syncrep2: rid=001 (4096) Content Sync Refresh Required May 13 10:13:57 gp42-admin4 slapd[12086]: => bdb_idl_insert_key: c_put id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30995) May 13 10:13:57 gp42-admin4 slapd[12086]: => bdb_dn2id_add 0xfc6: parent (cn=accesslog) insert failed: -30995 May 13 10:13:57 gp42-admin4 slapd[12086]: => bdb_idl_delete_key: c_del id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30995) May 13 10:13:57 gp42-admin4 slapd[12086]: => bdb_dn2id_delete 0xf50: parent (cn=accesslog) delete failed: -30995 May 13 10:15:55 gp42-admin4 slapd[12106]: @(#) $OpenLDAP: slapd 2.4.40 (Sep 30 2014 16:49:45) $#012#011clement@localhost.localdomain:/home/clement/build/BUILD/openldap-2. 4.40/servers/slapd May 13 10:15:55 gp42-admin4 slapd[12106]: nss-ldap: do_open: do_start_tls failed:stat=-1 May 13 10:15:55 gp42-admin4 slapd[12106]: nss_ldap: reconnected to LDAP server ldap://ldapserver1.example.com May 13 10:15:55 gp42-admin4 slapd[12106]: bdb_db_open: database "dc=example,dc=ldap": unclean shutdown detected; attempting recovery. May 13 10:15:57 gp42-admin4 slapd[12106]: bdb_db_open: database "cn=accesslog": unclean shutdown detected; attempting recovery. May 13 10:15:58 gp42-admin4 slapd[12106]: slapd starting May 13 10:28:49 gp42-admin4 slapd[12255]: @(#) $OpenLDAP: slapd 2.4.40 (Sep 30 2014 16:49:45) $#012#011clement@localhost.localdomain:/home/clement/build/BUILD/openldap-2. 4.40/servers/slapd May 13 10:28:49 gp42-admin4 slapd[12255]: nss-ldap: do_open: do_start_tls failed:stat=-1 May 13 10:28:49 gp42-admin4 slapd[12255]: nss_ldap: reconnected to LDAP server ldap://ldapserver1.example.com May 13 10:28:50 gp42-admin4 slapd[12255]: bdb_db_open: database "dc=example,dc=com": unclean shutdown detected; attempting recovery. May 13 10:28:50 gp42-admin4 slapd[12255]: bdb_db_open: database "cn=accesslog": unclean shutdown detected; attempting recovery. May 13 10:28:52 gp42-admin4 slapd[12255]: slapd starting May 13 10:29:24 gp42-admin4 slapd[12264]: @(#) $OpenLDAP: slapd 2.4.40 (Sep 30 2014 16:49:45) $#012#011clement@localhost.localdomain:/home/clement/build/BUILD/openldap-2. 4.40/servers/slapd May 13 10:29:24 gp42-admin4 slapd[12264]: nss-ldap: do_open: do_start_tls failed:stat=-1 May 13 10:29:24 gp42-admin4 slapd[12264]: nss_ldap: reconnected to LDAP server ldap://ldapserver1.example.com May 13 10:29:24 gp42-admin4 slapd[12264]: bdb_db_open: database "dc=example,dc=ldap": unclean shutdown detected; attempting recovery. May 13 10:29:24 gp42-admin4 slapd[12264]: bdb_db_open: database "cn=accesslog": unclean shutdown detected; attempting recovery. May 13 10:29:24 gp42-admin4 slapd[12264]: slapd starting May 13 10:29:53 gp42-admin4 slapd[12280]: @(#) $OpenLDAP: slapd 2.4.40 (Sep 30 2014 16:49:45) $#012#011clement@localhost.localdomain:/home/clement/build/BUILD/openldap-2. 4.40/servers/slapd May 13 10:29:53 gp42-admin4 slapd[12280]: nss-ldap: do_open: do_start_tls failed:stat=-1 May 13 10:29:53 gp42-admin4 slapd[12280]: nss_ldap: reconnected to LDAP server ldap://ldapserver1.example.com May 13 10:29:53 gp42-admin4 slapd[12280]: bdb_db_open: database "dc=example,dc=ldap": unclean shutdown detected; attempting recovery. May 13 10:29:53 gp42-admin4 slapd[12280]: bdb_db_open: database "cn=accesslog": unclean shutdown detected; attempting recovery. May 13 10:29:53 gp42-admin4 slapd[12280]: slapd starting May 13 10:32:35 gp42-admin4 slapd[12345]: @(#) $OpenLDAP: slapd 2.4.40 (Sep 30 2014 16:49:45) $#012#011clement@localhost.localdomain:/home/clement/build/BUILD/openldap-2. 4.40/servers/slapd Attempting to restart slapd from the command-line: 5735ed50 slapd starting 5735ed50 => bdb_entry_get: ndn: "cn=accesslog" 5735ed50 => bdb_entry_get: oc: "(null)", at: "(null)" 5735ed50 bdb_idl_fetch_key: %cn=accesslog 5735ed50 bdb_idl_fetch_key: [b49d1940] 5735ed50 bdb_idl_fetch_key: 5735ed50 send_ldap_result: err=0 matched="" text="" 5735ed50 => bdb_entry_get: ndn: "dc=example,dc=com" 5735ed50 => bdb_entry_get: oc: "(null)", at: "contextCSN" ldap_build_search_req ATTRS: reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN ldap_build_search_req ATTRS: reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN => ldap_bv2dn(uid=jdoe,ou=Users,dc=example,dc=com,0) <= ldap_bv2dn(uid=jdoe,ou=Users,dc=example,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=jdoe,ou=Users,dc=example,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=jdoe,ou=Users,dc=example,dc=com)=0 => ldap_bv2dn(uid=jdoe,ou=Users,dc=example,dc=com,0) <= ldap_bv2dn(uid=jdoe,ou=Users,dc=example,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=jdoe,ou=Users,dc=example,dc=com)=0 => ldap_bv2dn(uid=jdoe,ou=Users,dc=example,dc=com,0) <= ldap_bv2dn(uid=jdoe,ou=Users,dc=example,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=jdoe,ou=Users,dc=example,dc=com)=0 5735ed50 => bdb_entry_get: ndn: "uid=jdoe,ou=Users,dc=example,dc=com" 5735ed50 => bdb_entry_get: oc: "(null)", at: "(null)" slapd: search.c:1125: oc_filter: Assertion `f != ((void *)0)' failed. Aborted I have run db_recover on the dbase(s) on ldapserver2 but to no avail. Does anyone have any suggestions? Thank you in advance for any assistance. John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Humanitarian Assistance and Disaster Relief (HADR) Systems 244 Wood St Lexington, MA 02420 Email: <mailto:john.borresen@ll.mit.edu> john.borresen(a)ll.mit.edu

2 7

SLAPD won't start
by Borresen, John - 0444 - MITLL 13 May '16

13 May '16

This is a resend as the original did not go out for some reason. We have a 3-way multimaster configuration running on CentOS 5.11, OpenLDAP 2.4.40. All three have been up for years, until the other day: Slapd is running on two of the three (server names: ldapserver1, ldapserver2, and ldapserver3). Slapd stopped and won't restart on ldapserver2. >From Logs on ldapserver2: May 10 04:02:13 gp42-admin4 slapd[4541]: slapd shutdown: waiting for 0 operations/tasks to finish May 10 04:02:19 gp42-admin4 slapd[15633]: @(#) $OpenLDAP: slapd 2.4.40 (Sep 30 2014 16:49:45) $#012#011clement@localhost.localdomain:/home/clement/build/BUILD/openldap-2. 4.40/servers/slapd May 10 04:02:19 gp42-admin4 slapd[15633]: nss-ldap: do_open: do_start_tls failed:stat=-1 May 10 04:02:19 gp42-admin4 slapd[15633]: nss_ldap: reconnected to LDAP server ldap://ldapserver1.example.com May 10 04:02:21 gp42-admin4 slapd[15634]: bdb_db_open: database "cn=accesslog": database already in use. May 10 04:02:21 gp42-admin4 slapd[15634]: backend_startup_one (type=bdb, suffix="cn=accesslog"): bi_db_open failed! (-1) May 10 04:02:21 gp42-admin4 slapd[15634]: slapd stopped. May 10 04:02:22 gp42-admin4 slapd[4541]: slapd stopped. When attempting to restart slapd on server2: May 13 10:13:54 gp42-admin4 slapd[12085]: @(#) $OpenLDAP: slapd 2.4.40 (Sep 30 2014 16:49:45) $#012#011clement@localhost.localdomain:/home/clement/build/BUILD/openldap-2. 4.40/servers/slapd May 13 10:13:54 gp42-admin4 slapd[12085]: nss-ldap: do_open: do_start_tls failed:stat=-1 May 13 10:13:54 gp42-admin4 slapd[12085]: nss_ldap: reconnected to LDAP server ldap://ldapserver1.example.com May 13 10:13:56 gp42-admin4 slapd[12086]: slapd starting May 13 10:13:56 gp42-admin4 slapd[12086]: do_syncrep2: rid=002 (4096) Content Sync Refresh Required May 13 10:13:56 gp42-admin4 slapd[12086]: do_syncrep2: rid=001 (4096) Content Sync Refresh Required May 13 10:13:57 gp42-admin4 slapd[12086]: => bdb_idl_insert_key: c_put id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30995) May 13 10:13:57 gp42-admin4 slapd[12086]: => bdb_dn2id_add 0xfc6: parent (cn=accesslog) insert failed: -30995 May 13 10:13:57 gp42-admin4 slapd[12086]: => bdb_idl_delete_key: c_del id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30995) May 13 10:13:57 gp42-admin4 slapd[12086]: => bdb_dn2id_delete 0xf50: parent (cn=accesslog) delete failed: -30995 May 13 10:15:55 gp42-admin4 slapd[12106]: @(#) $OpenLDAP: slapd 2.4.40 (Sep 30 2014 16:49:45) $#012#011clement@localhost.localdomain:/home/clement/build/BUILD/openldap-2. 4.40/servers/slapd May 13 10:15:55 gp42-admin4 slapd[12106]: nss-ldap: do_open: do_start_tls failed:stat=-1 May 13 10:15:55 gp42-admin4 slapd[12106]: nss_ldap: reconnected to LDAP server ldap://ldapserver1.example.com May 13 10:15:55 gp42-admin4 slapd[12106]: bdb_db_open: database "dc=example,dc=ldap": unclean shutdown detected; attempting recovery. May 13 10:15:57 gp42-admin4 slapd[12106]: bdb_db_open: database "cn=accesslog": unclean shutdown detected; attempting recovery. May 13 10:15:58 gp42-admin4 slapd[12106]: slapd starting May 13 10:28:49 gp42-admin4 slapd[12255]: @(#) $OpenLDAP: slapd 2.4.40 (Sep 30 2014 16:49:45) $#012#011clement@localhost.localdomain:/home/clement/build/BUILD/openldap-2. 4.40/servers/slapd May 13 10:28:49 gp42-admin4 slapd[12255]: nss-ldap: do_open: do_start_tls failed:stat=-1 May 13 10:28:49 gp42-admin4 slapd[12255]: nss_ldap: reconnected to LDAP server ldap://ldapserver1.example.com May 13 10:28:50 gp42-admin4 slapd[12255]: bdb_db_open: database "dc=example,dc=com": unclean shutdown detected; attempting recovery. May 13 10:28:50 gp42-admin4 slapd[12255]: bdb_db_open: database "cn=accesslog": unclean shutdown detected; attempting recovery. May 13 10:28:52 gp42-admin4 slapd[12255]: slapd starting May 13 10:29:24 gp42-admin4 slapd[12264]: @(#) $OpenLDAP: slapd 2.4.40 (Sep 30 2014 16:49:45) $#012#011clement@localhost.localdomain:/home/clement/build/BUILD/openldap-2. 4.40/servers/slapd May 13 10:29:24 gp42-admin4 slapd[12264]: nss-ldap: do_open: do_start_tls failed:stat=-1 May 13 10:29:24 gp42-admin4 slapd[12264]: nss_ldap: reconnected to LDAP server ldap://ldapserver1.example.com May 13 10:29:24 gp42-admin4 slapd[12264]: bdb_db_open: database "dc=example,dc=ldap": unclean shutdown detected; attempting recovery. May 13 10:29:24 gp42-admin4 slapd[12264]: bdb_db_open: database "cn=accesslog": unclean shutdown detected; attempting recovery. May 13 10:29:24 gp42-admin4 slapd[12264]: slapd starting May 13 10:29:53 gp42-admin4 slapd[12280]: @(#) $OpenLDAP: slapd 2.4.40 (Sep 30 2014 16:49:45) $#012#011clement@localhost.localdomain:/home/clement/build/BUILD/openldap-2. 4.40/servers/slapd May 13 10:29:53 gp42-admin4 slapd[12280]: nss-ldap: do_open: do_start_tls failed:stat=-1 May 13 10:29:53 gp42-admin4 slapd[12280]: nss_ldap: reconnected to LDAP server ldap://ldapserver1.example.com May 13 10:29:53 gp42-admin4 slapd[12280]: bdb_db_open: database "dc=example,dc=ldap": unclean shutdown detected; attempting recovery. May 13 10:29:53 gp42-admin4 slapd[12280]: bdb_db_open: database "cn=accesslog": unclean shutdown detected; attempting recovery. May 13 10:29:53 gp42-admin4 slapd[12280]: slapd starting May 13 10:32:35 gp42-admin4 slapd[12345]: @(#) $OpenLDAP: slapd 2.4.40 (Sep 30 2014 16:49:45) $#012#011clement@localhost.localdomain:/home/clement/build/BUILD/openldap-2. 4.40/servers/slapd Attempting to restart slapd from the command-line: 5735ed50 slapd starting 5735ed50 => bdb_entry_get: ndn: "cn=accesslog" 5735ed50 => bdb_entry_get: oc: "(null)", at: "(null)" 5735ed50 bdb_idl_fetch_key: %cn=accesslog 5735ed50 bdb_idl_fetch_key: [b49d1940] 5735ed50 bdb_idl_fetch_key: 5735ed50 send_ldap_result: err=0 matched="" text="" 5735ed50 => bdb_entry_get: ndn: "dc=example,dc=com" 5735ed50 => bdb_entry_get: oc: "(null)", at: "contextCSN" ldap_build_search_req ATTRS: reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN ldap_build_search_req ATTRS: reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN => ldap_bv2dn(uid=jdoe,ou=Users,dc=example,dc=com,0) <= ldap_bv2dn(uid=jdoe,ou=Users,dc=example,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=jdoe,ou=Users,dc=example,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=jdoe,ou=Users,dc=example,dc=com)=0 => ldap_bv2dn(uid=jdoe,ou=Users,dc=example,dc=com,0) <= ldap_bv2dn(uid=jdoe,ou=Users,dc=example,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=jdoe,ou=Users,dc=example,dc=com)=0 => ldap_bv2dn(uid=jdoe,ou=Users,dc=example,dc=com,0) <= ldap_bv2dn(uid=jdoe,ou=Users,dc=example,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=jdoe,ou=Users,dc=example,dc=com)=0 5735ed50 => bdb_entry_get: ndn: "uid=jdoe,ou=Users,dc=example,dc=com" 5735ed50 => bdb_entry_get: oc: "(null)", at: "(null)" slapd: search.c:1125: oc_filter: Assertion `f != ((void *)0)' failed. Aborted I have run db_recover on the dbase(s) on ldapserver2 but to no avail. Does anyone have any suggestions? Thank you in advance for any assistance. John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Humanitarian Assistance and Disaster Relief (HADR) Systems 244 Wood St Lexington, MA 02420 Email: john.borresen(a)ll.mit.edu John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Humanitarian Assistance and Disaster Relief (HADR) Systems 244 Wood St Lexington, MA 02420 Ph: (781) 981-1609 Cell: (781) 382-5195 Email: <mailto:john.borresen@ll.mit.edu> john.borresen(a)ll.mit.edu

1 0

OpenLDAP logging and rsyslog
by jeevan kc 12 May '16

12 May '16

Hello everyone,We're migrating our LDAP servers to new RHEL 7. Previously we had RHEL 5.2 and Openldap logging was working just fine with the following config using syslog.· Set up OpenLDAP logging: o (as root user) mkdir /var/log/openldap o (as root user) chmod 755 /var/log/openldap o (as root user) touch /var/log/openldap/openldap.log o (as root user) vi /etc/syslog.conf § Add the line “Local6.* /var/log/openldap/openldap.log” o (as root user) kill –HUP <process ID of syslogd> The new servers have rsyslog instead of syslog and I did the same procedures in rsyslog.conf file, set olcloglevel as sync stats same as in the old server and restarted rsyslog with systemctl restart rsyslog.service .The openldap.log file is empty. I have tried local4 too and same result. My rsyslog.conf file looks like this . Can someone please help me with this? Any help is appreciated. # rsyslog v5 configuration file # For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html# If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html #### MODULES #### $ModLoad imuxsock # provides support for local system logging (e.g. via logger command)$ModLoad imklog # provides kernel logging support (previously done by rklogd)$ModLoad immark # provides --MARK-- message capability # Provides UDP syslog reception$ModLoad imudp$UDPServerRun 514 # Provides TCP syslog reception$ModLoad imtcp$InputTCPServerRun 514 #### GLOBAL DIRECTIVES #### # Use default timestamp format$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat # File syncing capability is disabled by default. This feature is usually not required,# not useful and an extreme performance hit#$ActionFileEnableSync on # Include all config files in /etc/rsyslog.d/$IncludeConfig /etc/rsyslog.d/*.conf #### RULES #### # Log all kernel messages to the console.# Logging much else clutters up the screen.#kern.* /dev/console # Log anything (except mail) of level info or higher.# Don't log private authentication messages!*.info;mail.none;authpriv.none;cron.none /var/log/messages # The authpriv file has restricted access.authpriv.* /var/log/secure # Log all the mail messages in one place.mail.* -/var/log/maillogdaemon.* /var/log/daemon.logkern.* /var/log/kern.logsyslog.* /var/log/syslog # Log cron stuffcron.* /var/log/cron # Everybody gets emergency messages*.emerg * # Save news errors of level crit and higher in a special file.uucp,news.crit /var/log/spooler # Save boot messages also to boot.loglocal7.* /var/log/boot.log #OpenLDAP logginglocal6.* /var/log/openldap/openldap.log # ### begin forwarding rule #### The statement between the begin ... end define a SINGLE forwarding# rule. They belong together, do NOT split them. If you create multiple# forwarding rules, duplicate the whole block!# Remote Logging (we use TCP for reliable delivery)## An on-disk queue is created for this action. If the remote host is# down, messages are spooled to disk and sent when it is up again.#$WorkDirectory /var/lib/rsyslog # where to place spool files#$ActionQueueFileName fwdRule1 # unique name prefix for spool files#$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible)#$ActionQueueSaveOnShutdown on # save messages to disk on shutdown#$ActionQueueType LinkedList # run asynchronously#$ActionResumeRetryCount -1 # infinite retries if host is down# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional#*.* @@remote-host:514# ### end of the forwarding rule ### ## Nessus/CIS compliance items## Send everything to Unix syslog host## Following setting is per Chris Humphrey 6/19/2013*.err;kern.notice;auth.notice;auth.crit;daemon.notice @siem-unix.abc.com## Send httpd logs to Apache syslog host - requires additional apache configdaemon.notice @@SIEM-apache.abc.comauth,user.* /var/log/messages # A template to for higher precision timestamps + severity logging$template SpiceTmpl,"%TIMESTAMP%.%TIMESTAMP:::date-subseconds% %syslogtag% %syslogseverity-text%:%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n" Jeevan

2 2

debugging schema error
by Olivier 12 May '16

12 May '16

Hi, I have to modify the schema used by Mac OS X to access LDAP. What I am trying to do get slapd to fail starting, but I do not get a single error message: in /var/log/debug: May 12 13:08:33 ldap slapd[42028]: @(#) $OpenLDAP: slapd 2.4.41 (Aug 27 2015 15:14:47) $ root@ldap.cs.ait.ac.th:/usr/ports/net/openldap24-server/work/openldap-2.4.41/servers/slapd May 12 13:08:33 ldap slapd[42028]: DIGEST-MD5 common mech free May 12 13:08:33 ldap slapd[42028]: slapd stopped. May 12 13:08:33 ldap slapd[42028]: connections_destroy: nothing to destroy. in /var/log/messages May 12 13:08:33 ldap on: /usr/local/etc/rc.d/slapd: WARNING: failed to start slapd I cannot diagnose much out of that; what can I do to get some proper debug/error information? Best regards, Olivier --

1 0

Re: Cannot re-enable synchronization
by Olivier Nicole 11 May '16

11 May '16

Hi, On Monday I had a major issue, my root CA (for all my encryption) expired, so my LDAP server number 1 became inaccessible. I have a server number 2, running from another root certificate, that did not expire and that was properly replicating from the server number 1, using: syncrepl rid=0 provider=ldaps://ldap server 1/ type=refreshAndPersist bindmethod=simple binddn=cn=Manager,dc=xxx credentials="XXX" searchbase=dc=xxx tls_reqcert=try starttls=yes retry="60 10 300 +" But since I updated the root certificate on server 1, I cannot get the replication. I can still ldapsearch from server 2 to server 1. In the log of server 1 I see a proper connection, but I don't know how to further debug the replication. Best regards, Olivier

1 0

require authc and SASL GSSAPI
by Christian 09 May '16

09 May '16

Dear list, I use Kerberos/GSSAPI for authentication, and I recently locked down my ldap servers with "require authc". With Kerberos tickets, I used to be able to just enter ldapsearch on the command line. Now I have to do ldapsearch -Y GSSAPI I assume this is because ldapsearch has to do a nonauthenticated bind to find out about the SASL auth mechanisms (by looking for supportedSASLMechanisms), and that fails now. So it would be great if I had a way of setting the default SASL auth mechanism on a machine for all users. However, man ldap.conf tells me that the setting for SASL_MECH is a per user setting only. Is there any other way to achieve this, or am I doing the wrong thing by requiring authc? Thanks, Christian

3 5

Access auth granularity?
by Dora Paula 09 May '16

09 May '16

Dear List, I've two subtrees that contain user-accounts: ou=usersA,dc=example,dc=com and ou=usersB,dc=example,dc=com. Goal: Users below ou=userA,... should only be allowed to bind using sasl_bind, but not with simple_bind. Whereas users below ou=usersB,... should be allowed to bind using both (or any kind of bind). I searched the documentation but without success. All I found was disallow simplebind and sasl_ssf, but both seem to make no sense in this case: While the first disallows simple_binds globally, the combination of sasl_ssf and access auth is or at least seems contradicting to me. Question: Is it possible to achieve this goal using current openldap release? Thank you very much Dora

3 9

Any naming conventions to be followed wile creating groups/organizations
by Chaitanya Kumar Ch 09 May '16

09 May '16

Hi All, I would like to request you to provide naming conventions document if available. I am looking for better approach to name groups/organizations names with multiple words. For example: Computer Science group can be named as cs, Computer Science, ComputerScience, computer science, computer-science. what is the better way? -- Thank You, Chaitanya Kumar Ch, +91 9550837582

1 0

openldap pwdReset=True pam_authz HP-UX
by Campbell, Courtney 05 May '16

05 May '16

Hopefully someone can help out. I am currently running openldap 2.4 with a provider and two consumers. I have a few Linux hosts and a few HP-UX hosts setup for authentication and sudo. For the most part everything works well. I actually have no issues with Linux hosts. On my HP-UX hosts, I have LDAP-UX integration setup. I am able to authenticate fine. Sudo also works well. My issue is when I set pwdReset=TRUE. Basically The HP-UX boxes just keep prompting for the password again., but never prompting for a new authtok. As part of the implementation on the HP-UX servers, I use pam_authz. I have the following entry set. PAM_NEW_AUTHTOK_REQD:ldap_filter:(pwdReset=TRUE) The way it should work is that it reads and finds that pwdReset is set to true and passes PAM_NEW_AUTHTOK_REQD. But instead I see this entry in the syslog file: error: PAM: Authentication token manipulation error for userXYZ from serverXYZ I take that as actually being PAM_AUTHTOK_ERR being returned. I am not sure if anyone else has any experience with HP-UX LDAP-UX integration and getting it to work with openldap. I feel it is probably something trivial that I am overlooking. Any help would be appreciated. ________________________________ This message (including any attachments) is confidential and intended for a specific individual and purpose. If you are not the intended recipient, please notify the sender immediately and delete this message.

1 0

ACL needed write privilege to all subtree of "dc=exadel,dc=com"
by Andrei Valoshyn 05 May '16

05 May '16

Hello guys, Currently I have ACL in my slapd.conf file: access to attrs=userPassword,userPKCS12 by self write by * auth access to attrs=shadowLastChange by self write by * read access to * by peername.ip=10.206.179.0%255.255.255.0 read ..... I need write privilege for my group. I made some changes: access to attrs=userPassword,userPKCS12 by group.exact="cn=LDAP_admins,ou=Roles,ou=Groups,dc=exadel,dc=com" write by self write by * auth access to attrs=shadowLastChange by group.exact="cn=LDAP_admins,ou=Roles,ou=Groups,dc=exadel,dc=com" write by self write by * read access to dn.subtree="dc=exadel,dc=com" by group.exact="cn=LDAP_admins,ou=Roles,ou=Groups,dc=exadel,dc=com" write by peername.ip=206.169.37.147 read access to * by peername.ip=10.206.179.0%255.255.255.0 read After that users from LDAP_admins group can edit all. But our Password Change System, where users can change their passwords stopping work properly because users can't login. After I delete access to dn.subtree="dc=exadel,dc=com" by group.exact="cn=LDAP_admins,ou=Roles,ou=Groups,dc=exadel,dc=com" write by peername.ip=206.169.37.147 read Password Change System start work well, but user from LDAP_admin group lose their write permissions. After that I tried a big amount of configurations options, but have the problem. Please help! -- With Best Wishes Andrei Valoshyn Exadel Inc. System Administrator avaloshyn(a)exadel.com -- CONFIDENTIALITY NOTICE: This email and files attached to it are confidential. If you are not the intended recipient you are hereby notified that using, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error please notify the sender and delete this email.

2 1

Resolved: SASL search-based username mapping succeeds, but auth fails!?
by William B. Clay 05 May '16

05 May '16

I document the resolution here in the hope it may save others from similar embarrassment. Short form: The ldapsearch error termination message: user not found: unable to canonify user and get auxprops meant, at least in this case, that the SASL password database (/etc/ldap/sasl2/sasldb2) did not contain the userid specified by option "-U". This message is distinct from the message issued on a password error for a userid that is present in the database: authentication failure: client response doesn't match what we generated (tried bogus) TLDR: My perplexity was caused by two reasonable (to me at least) misconceptions that falsely reinforced each other: 1. "unable to canonify user" meant a problem more complex than simply "user not found" in the SASL database itself. 2. Execution of a SASL AuthzRegexp LDAP lookup proved that the SASL user password had been successfully checked (i.e., that a -U userid SASL password is checked PRIOR to AuthzRegexp processing). The root cause blunder: omitting the saslpasswd2 option "-f /etc/ldap/sasl2/sasldb2" when creating the SASL userid. This created the ID in /etc/sasldb2 instead. Verifying existence of the ID with sasldblistusers2 (also forgetting option "-f", of course) confirmed that the ID in question was present ... in the wrong place. I apologize to the list for the mistaken post. Bill Clay

1 0

add/load syncprov overlay
by Real, Elizabeth (392K) 05 May '16

05 May '16

Hello, I am setting up multi-master replication between two openldap servers and when I try to add syncprov overlay to my second server I get this error: # ldapmodify -Y EXTERNAL -H ldapi:/// -f 5_addSyncProv.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 adding new entry "olcOverlay=syncprov,olcDatabase={0}config,cn=config" ldap_add: Invalid syntax (21) additional info: objectClass: value #1 invalid per syntax Per the documentation (http://www.openldap.org/doc/admin24/replication.html#N-Way Multi-Master) you are supposed to add syncprov to the configuration. Here are the contents of the ldif file: dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov Both servers are running RHEL7 and openldap 2.4.40. Please advise! Thank you, Liz Elizabeth.real(a)jpl.nasa.gov

2 2

Enable memberOf attribute
by Chaitanya Kumar Ch 04 May '16

04 May '16

Hi All, I am new to openLDAP. I am trying to enable memberOf attribute for users. I have followed this <http://www.schenkels.nl/2013/03/how-to-setup-openldap-with-memberof-overlay…> link but but I am not getting memberOf result whilesearching for attribute using below query: ldapsearch -LL -Y EXTERNAL -H ldapi:/// "(uid=ddharma)" -b dc=test,dc=com memberO *Query Result*: SASL/EXTERNAL authentication started SASL username: gidNumber=1000+uidNumber=1000,cn=peercred,cn=external,cn=auth SASL SSF: 0 version: 1 dn: cn=dharma,ou=people,dc=test,dc=com *Please find the below attachments:* 1. ldap-structure.PNG : My ldap architecture. user "dharma" is member of twitter, historical, powertarck groups. 2. backend.memberof.ldif 3. backend.refint.ldif Please help me. -- Thank You, Chaitanya Kumar Ch, +91 9550837582

1 0

This week's OpenSSL vulnerabilities
by Howard Chu 04 May '16

04 May '16

If you haven't read https://openssl.org/news/secadv/20160503.txt yet, it's worth taking a look. The ASN.1-related bugs have no impact on OpenLDAP since we use our own liblber for parsing and encoding, and our encoder/decoder are known to be bug-free. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Documentation
by Daniel Howard 02 May '16

02 May '16

Hello, Some thoughts I have had about OpenLDAP Documentation over the weekend .... My overarching concern is one of process. My day job is Ops, and especially at scale a documentation process is critical to success. And what this boils down to is that: - checking documentation is a part of the routine Ops process - refining that documentation so that it is on-point, concise, and relevant is part of the Ops process - when the documentation proves insufficient, the matter can quickly be escalated with Experts - review of documentation is a routine duty of the Experts, and is part of the process of deploying new infrastructure With this framework (paraphrasing ITIL <https://en.wikipedia.org/wiki/Problem_management#Problem_investigation_and_…> and KCS <http://library.serviceinnovation.org/KCS_Practices_Guide_v6>) in mind, some reactions to my experiences with your community and the recent thread: *Efficient Knowledgebase* This is always a tricky nut to crack ... people love Stack Overflow these days ... there's an existing corpus in the mailing lists. One thing I have done in the past is tie in resources with Google ... might be helpful to if this page <http://www.openldap.org/lists/> had a Google custom site search .. I just tried setting one up <https://cse.google.com/cse/create/congrats?cx=015007933238430841659%3Auvkt3…> to search all of the mailing list archives, issue tracker, F-o-M, stackexchange and serverfault "openldap" keywords ... I am underwhelmed at the results but you folks might have some better idea of "hot topics" and strong resources to try. Howard Chu pointed out that he has configured F-o-M to show *him* dates ... maybe this can be the default? ;) If you can get something good running, it makes answering some dumb questions on the list easier .. you can politely point them to the search with the appropriate keywords .. a la "let me google that for you" and the clever ones will catch on ... if you find the search mechanism less than clear, then maybe some of the docs can be tweaked a bit for keyword-matching, or be revised to cover a more general case or an example ... when a user asks me a dumb question, I try to step through how they would get the answer ... sometimes that stepping needs some help on my part, but on a good day I teach a user to fish ... *Ease of Updating Documentation* I had no idea but it looks like anyone can contribute to F-o-M. Nice. Let us, say, however, I had questions or amendments or heck contributions to the quick start guide? http://www.openldap.org/doc/admin24/quickstart.html There's a footer at the bottom that implies the content is five years old and I'd bet $2 based on personal experience that I am not getting good answers from info(a)OpenLDAP.org. A contrast I dealt with recently is, say, this Ansible tutorial <https://github.com/leucos/ansible-tuto> ... at first, it seemed weird to host documentation on github but there on the top page they get to explaining that they are open to community contributions: fork, pull request, &c. I made some modest contribution myself: one of the first pull requests I ever made. Felt great. I then made some amendments to the GWM project, as their documentation is similarly hosted in a format I already know how to contribute to. :) So, Howard Chu says OpenLDAP will never rely on github. Fair enough ... as an aside, I have seen at least one project maintain a github repo as sort of a managed two-way mirror to their traditional repo: this was done by contributors who wanted to hack around on the code in a convenient tool, and then patches are evaluated and brought into not-git core ... which is to say you could, if you desired, use github without relying on it ... but anyway ... this comprehensive document <http://www.openldap.org/doc/admin24/> could have a section on engaging the authors and the process of contributing amendments, maybe linked from the footer, which could have a dynamic bit of code that shows the current year (or last modified year?) so as not to scare anyone that the living documentation is crazy stale. *Documentation as Part of Deployment* This struck me in my recent discussion around troubles with the Quickstart guide: when I went to use the quickstart guide, the documentation did not match the software, because the software had recently been changed. Best practice would be to bundle documentation updates in to the release. If, in my own Operations, I deployed changes to a service without reviewing and amending the Operational documentation, the nicest word I could use to describe that is "messy." *Tone* The attitude I have witnessed and experienced on the mailing list is off-putting. For example, I recently needed to re-order ACL rules, but as part of that I would be changing the order of rules I depended on to make the modification. Classic "lock yourself out of the firewall" setup. So, I used Google, dug around in the documentation, hoped that such a reasonable question would be covered in the F-o-M .. nada .. so, resort to mailing list. At least in this case, I did get a workable answer: <http://www.openldap.org/lists/openldap-technical/201603/msg00057.html> "the operations are atomic. Read this link where I condescendingly link to a decade-old draft spec .. ya moron." In olden times, I was told to go RTFM more politely <http://www.openldap.org/lists/openldap-software/200102/msg00345.html>: "base64 just makes the answer look different, see the mailing list for previous discussions (although you've already tried and failed to find the discussions alluded to..)" People ask questions. Some are lazy or ignorant, perhaps, or really suck at asking useful questions. Some mean well, just don't know where to find the answer, but put some effort into trying to engage constructively ... I deal with folks on this spectrum all the time in my day job, and yes sometimes I want to bite someone's head off, but it doesn't help. It takes some patience and a deep breath and a lot of effort that may not seem worthwhile but when you offer offer friendly advice you gain allies who might stick around and contribute ... if you want to be a surly curmudgeon then you don't gain allies ... My own take would be if a question just looks like lazy crud, offer some gentle advice as to the process of figuring it out "here's a link to our getting support guide" ... if a question sounds like it has been covered somewhat, ask how would that answer be revealed ... how would you search that the questioner did not ... maybe you've got half an answer but it really ought to be fleshed out ... you can task the person asking that once they figure it out, they post the solution in the F-o-M ... Cheers, -danny -- http://dannyman.toldme.com

2 1

Split ldap tree
by Frank Rust 02 May '16

02 May '16

Hi all, I try to create a new ldap-server which shall only store local attributes of global users. There is a company ldap server, say ldap.example.com containing some default user tree with dn: ou=People,dc=example,dc=com containing dn: uid=<login>,ou=People,dc=example,dc=com with all objectClasses of person, inetOrgPerson, posixAccount, sambaAccount I want to create a local ldap server, say ldap.division.example.com which shall use the existing tree of the company server in my local tree with dn: ou=People,dc=division,dc=example,dc=com containing dn: uid=<login>,ou=People,dc=division,dc=example,dc=com with local objectClass of mailRecipient, mailAlias, pkiUser and all information of the company servers uid=<login>,ou=People,dc=example,dc=com This redirection/proxying shall be invisible to connected clients. How could I do this?? Thanks in advance, Frank

1 0

Re: Documentation
by Daniel Howard 30 Apr '16

30 Apr '16

On Apr 30, 2016 1:03 PM, "Quanah Gibson-Mount" <quanah(a)zimbra.com> wrote: > > --On Saturday, April 30, 2016 11:41 AM -0700 Daniel Howard < dannyman(a)toldme.com> wrote: > >> >> My recent experience is OpenLDAP on Ubuntu. I thought I would go with >> OpenLDAP's guide because they should know better, but the quick start was >> for older versions or something and hadn't been updated. > > > Apparently you haven't read the quickstart guide in a while. About March-April, if memory serves. Feels like longer. -Danny

2 1

Documentation
by Gavin Henry 30 Apr '16

30 Apr '16

Hi all, List what you love about our docs: List what you hate: List what you'd love to see: List what you can help with: Thanks. -- Kind Regards, Gavin Henry.

1 0

Re: Export issue after an DN change
by mdii 30 Apr '16

30 Apr '16

Thanks for the reply. The OpenLDAP version is *2.4.35*. For the backend, I'm not really sure where to look at, but I found the attribute *olcDbDirectory *in the *olcDatabase={1}mdb,cn=config* entry. It points at the folder */custom/data/openldap-data-oldschema*, where I saw two .mdb files (*lock.mdb* and *data.mdb*). Is it possible that this two MSAccess (?) files are my OpenLDAP backend ? It is running over a Red Hat 6 system. I did an ldapsearch and a slapcat and both of then returned all entries. When I use the Java unboundID framework, if I do a "large" search, some entries doesn't show up, but if I do a specific search, the missing entry is found. Both queries were made par the same framework method... 2016-04-22 21:33 GMT+02:00 Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Friday, April 22, 2016 4:57 PM +0200 mdii <mdii.alias(a)gmail.com> > wrote: > > >> I'm having a weird issue with my OpenLDAP directory, maybe some of you >> had a similar issue in the past and can point me in the right direction, >> at the moment I have no idea where to start looking... >> > > OpenLDAP version? OpenLDAP backend? What results do you get from slapcat? > > --Quanah > > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > A division of Synacor, Inc >

2 1

Q: "dn: cn=Uptime,cn=Time,cn=Monitor" non-monotonic occasionally?
by Ulrich Windl 29 Apr '16

29 Apr '16

Hi! I'm running a NRPE monitor that monitors openLDAP. To compute delta values, the NRPE plugin stores the "dn: cn=Uptime,cn=Time,cn=Monitor" reported by openLDAP to compare it with the current value (to build the time difference). If the time difference is negative, the plugin reports a "server restart" event. So far, so good... However, very rarely (once every few weeks) a false server restart is reported. Viewing the historic logs, I can only assume that openLDAP reports a bad uptime value now and then. Could this be? Example plugin logs: 2016/04/28 10:25:14 LDAP: Operations Rate OK HARD 1 OK: [Lock.Delay=0.246], [3 searches with 12 entries in 0.057s], 2340577, 0.10084, 0.07563, 0.35294, 0, 0, 0, 0, 0, 0, 0.08403, 0.61345 2016/04/28 10:23:14 LDAP: Operations Rate OK HARD 1 OK: [Lock.Delay=0.288], [3 searches with 12 entries in 0.052s], 2340458, 0.09917, 0.08264, 0.32231, 0, 0, 0, 0, 0, 0, 0.08264, 0.58678 2016/04/28 10:21:14 LDAP: Operations Rate UNKNOWN HARD 1 UNKNOWN: [Lock.Delay=0.221], [3 searches with 12 entries in 0.052s], 2340337, [Operations.Bind.i: restart detected (2340337 - 2340341 == -4)], 284553, [Operations.Unbind.i: restart detected (2340337 - 2340341 == -4)], 205927, [Operations.Search.i: restart detected (2340337 - 2340341 == -4)], 985106, [Operations.Compare.i: restart detected (2340337 - 2340341 == -4)], 0, [Operations.Modify.i: restart detected (2340337 - 2340341 == -4)], 0, [Operations.Modrdn.i: restart detected (2340337 - 2340341 == -4)], 0, [Operations.Add.i: restart detected (2340337 - 2340341 == -4)], 0, [Operations.Delete.i: restart detected (2340337 - 2340341 == -4)], 0, [Operations.Abandon.i: restart detected (2340337 - 2340341 == -4)], 4, [Operations.Extended.i: restart detected (2340337 - 2340341 == -4)], 245199, [Operations.i: restart detected (2340337 - 2340341 == -4)], 1720790 2016/04/28 10:19:14 LDAP: Operations Rate OK HARD 1 OK: [Lock.Delay=0.501], [3 searches with 12 entries in 0.060s], 2340341, 0.13333, 0.09167, 0.65000, 0, 0, 0, 0, 0, 0, 0.11667, 0.99167 (The first number after the messages in square brackets is the uptime, then come the operations rate for several LDAP operations) At 10:19:14 the uptime was 2340341, and at 10:25:14 the uptime was 2340577. That could be OK, but at 10:21:14 the uptime was reported as 2340337 which is less than reported at 10:19:14. Has there ever been such an issue with uptime? Regards, Ulrich

4 11

ACLs: restrict by IP and user
by Janne Peltonen 28 Apr '16

28 Apr '16

Hi! I was thinking about giving the users a different set of their own attributes, depending on whether they accessed the server from a well-known IP address or not. Is this possible using OpenLDAP? I know how to form a WHO clause to grant access to self; I know how to form a WHO clause to grant access from a certain IP address; what I don't know is how to grant access to "self if and only if it hails from a certain IP address", i.e. so that the given rights would require both that we're considering "self" and "IP address" at the same time, but if either doesn't match, then the clause wouldn't apply. I'be glad if anybody could provide any help upon this. Also a simple "can't be done" would be appreciated. --Janne Peltonen University of Helsinki

2 8

Offline modification in replicated environment
by Ryan Tandy 23 Apr '16

23 Apr '16

When my (Debian's) users upgrade to 2.4.43 or later, if they use the ppolicy overlay and cn=config, I have to add the pwdMaxRecordedFailure attribute to the schema, otherwise slapd can't start. Basic steps: slapcat the config database; a few lines of perl to add the new attribute, update the pwdPolicy object class, and strip out modifiersName and modifyTimestamp so they get regenerated; slapadd it back. No problem for a standalone system. The config database might be replicated, though. For that, I'm also removing entryCSN from the schema entry I modify, and letting slapadd regenerate it. I'm not using -S with slapadd, so the reloaded entry is getting sid 000 every time. I've tested master-slave and master-master setups, and this seems to be working as intended. But I'd like to ask the people here who have more experience with replication than I do: is this a bad plan? What could go wrong? thanks, Ryan

2 1

Export issue after an DN change
by mdii 22 Apr '16

22 Apr '16

I'm having a weird issue with my OpenLDAP directory, maybe some of you had a similar issue in the past and can point me in the right direction, at the moment I have no idea where to start looking... In my directory, the entities are listed in the ou=organisation branch, where the key is the entity label and they have a hierarchic structure, for example: - ou=organisation - ou=entity1,ou=organisation - ou=entity2,ou=entity1,ou=organisation - ou=entity3,ou=entity1,ou=organisation - ou=entity4,=entity3,ou=entity1,ou=organisation - ou=entity5,ou=organisation - ... The issue appears when there is a label change in one of the entities. In this example I will change entity3 by entity33: - ou=organisation - ou=entity1,ou=organisation - ou=entity2,ou=entity1,ou=organisation - ou=entity33,ou=entity1,ou=organisation - ou=entity4,=entity33,ou=entity1,ou=organisation - ou=entity5,ou=organisation - ... When I'm using a directory browser, let's say ApacheDS, I have no trouble, I can see the entire directory tree (as above). My issue is the following: - If I do a LDIF export (using the same ApacheDS), it doesn't export the entity4 entry (or any other entity under entity33) - If I do a Java application that uses a LDAP framework (Spring or UnboundID in my case), I have the same problem, it doesn't see the entity4 entry - I can do an entity4 LDIF export, it works well Meanwhile there is a solution to this issue. If I do the series of operations: - LDIF export of entity4 - LDIF export of entity33 - LDIF export of entity1 - suppression of entity33 (witch includes all entries under it) - Import of entity1 - Import of entity33 - Import of entity4 Once these operations completed, everything goes normal and entity4 will be exported when I do an entity33 LDIF export. One last detail, when I enter the enterprise, the issue was known, and it was told me to export the parent entity of the one that had the label change, that’s why I do the enetity1 export/suppression/import (not only the entity33). Do you have any idea of what's going on? At the moment I have no idea where to start looking at, if I can change some settings or if it's an OpenLDAP know bug. I would like to thank you in advance for any help, Best regards, Marc

2 1

Query regarding Openldap implementation
by Samrin S.N 21 Apr '16

21 Apr '16

Hi There, I have a query on ldap_search_ext_s() API being used. This API is returning operations error and by default the option LDAP_OPT_REFERRALS is default to 1. I feel when we use this API, it tries and finds other referrals present in the AD server configuration forest. Can you please help me in understanding this API behaviour. I have found that even though the requested user is found at one of the referral, again the search is done on other referrals for the same user. What is the significance of trying to search the node in other referrals. Your help is highly appreciated. -- Thanks, Samrin

1 1

How to enable search using wildcard characters
by PRATIK SINGAL 20 Apr '16

20 Apr '16

Hello All, Can any one please help me how can i search using wild card character. My base dn is "dc=example,dc=com" and i want to search all the records having "telephone" attribute whose value is starting from 256* Am using below verion of openldap $OpenLDAP: slapd 2.4.40 Is there any changes which needs to be done in slapd.conf to enable wildcard search Regards, Pratik

3 2

Re: Openldap vs 389
by Shawn McKinney 20 Apr '16

20 Apr '16

> On Apr 19, 2016, at 16:34:27,Achilleas Mantzios wrote: > > I admit I haven’t done my homework regarding the standards (the literature is just huge), maybe I was hasty in using the term RBAC above, but anyway what does Fortress/RBAC give out of the box that our solution wouldn’t, I mean you wouldn’t mind giving a very rough overview ? Not knowing what your solution provides it's not possible for me to give you a comparison and in any case that’s a question for you to decide. If you want to understand fortress, first understand its apis, there are links to javadoc descs at the bottom of this page: https://directory.apache.org/fortress/overview.html If after that you are still interested, checkout the tutorials: - http://github.com/shawnmckinney/apache-fortress-demo - http://github.com/shawnmckinney/role-engineering-sample - http://github.com/shawnmckinney/wicket-sample - http://github.com/shawnmckinney/fortress-saml-demo or some of the collateral that is here: - http://iamfortress.net/2015/06/11/what-is-delegated-administration/ - http://iamfortress.net/2015/03/13/enabling-java-ee-and-fortress-security-in… - http://iamfortress.net/2015/03/05/the-seven-steps-of-role-engineering/ - http://iamfortress.net/2015/02/16/apache-fortress-end-to-end-security-tutor… - http://iamfortress.net/2014/11/24/using-role-for-access-control-is-not-rbac/ Shawn

2 1

memberuid value should be DN or RDN or both woks
by scn_73＠yahoo.com 20 Apr '16

20 Apr '16

All, Openldap is complaining invalid dn. I doubt, it's for group members those memberuid don't have have DN and added as RDN. Like to know does memberuid should be DN or RDN works too. slapd[4892]: conn=1629448 op=2180 do_search: invalid dn (member1) slapd[4892]: conn=1629448 op=2181 do_search: invalid dn (memver2) slapd[4892]: conn=1629448 op=2182 do_search: invalid dn (member2) objectClass: posixGroup objectClass: top cn: g1 gidNumber: xxxx memberUid: member1 memberUid: member2 memberUid: member3 - Sachin

2 1

Best method to swap TLS cert/key/CA files
by ML mail 19 Apr '16

19 Apr '16

Hello, I would like to swap my self signed certificate including CA, cert and key with a new set of CA, cert and key files on my OpenLDAP 2.4.31 master and replica servers. What would be the best way to achieve that? Can I simply run an ldapmodify with the new values and then restart slapd? Is it as easy as that or are there any pitfalls I should take care of? Thank you in advance for your comments. Regards ML

2 2

passwd, proxying, and idassert-authzFrom
by David Magda 19 Apr '16

19 Apr '16

Hello, I have a master OpenLDAP server, with a bunch of slaves, and then Linux clients talking to the slaves. We've used olcUpdateRef/updateref for a while, but have a situation where we need to proxy connection on behalf of clients via the slaves. So we have configured a slapo-chain(5) overlay, with the following settings: olcDbURI: ldap://10.0.0.555/ olcDbIDAssertBind: bindmethod=simple \ binddn="cn=update,dc=example,dc=ca" \ credentials=s3cr3t mode=self olcDbRebindAsUser: TRUE However, when users try to run passwd(1) (with pam_ldap.conf(5) having the "pam_password exop" setting) they get: > LDAP password information update failed: Strong(er) authentication required only authenticated users may change passwords > passwd: Permission denied > passwd: password unchanged On the master, we have: > Apr 12 13:14:00 ops slapd[26119]: conn=16 fd=32 ACCEPT from IP=111.222.333.444:59985 (IP=0.0.0.0:389) > Apr 12 13:14:00 ops slapd[26119]: conn=16 op=0 BIND dn="" method=128 > Apr 12 13:14:00 ops slapd[26119]: conn=16 op=0 RESULT tag=97 err=0 text= > Apr 12 13:14:00 ops slapd[26119]: conn=16 op=1 EXT oid=1.3.6.1.4.1.4203.1.11.1 > Apr 12 13:14:00 ops slapd[26119]: conn=16 op=1 PASSMOD > Apr 12 13:14:00 ops slapd[26119]: conn=16 op=1 RESULT oid= err=8 text=only authenticated users may change passwords The (cn=update...) DN has an "authzTo" attribute set to "{0}dn.regex:^uid=[^,]+,ou=People,dc=example,dc=ca". I'm guessing I may need to set idassert-authzFrom (olc equiv?) to something. Is this correct? If so, should it be restricted to ou=People? If not, what am I missing? Thanks for any info. Regards, David

1 1

Re: Openldap vs 389
by Achilleas Mantzios 19 Apr '16

19 Apr '16

On 19/04/2016 13:41, Emmanuel Lécharny wrote: > Le 19/04/16 11:39, Achilleas Mantzios a écrit : >> On 19/04/2016 12:20, Emmanuel Lécharny wrote: >>> Le 19/04/16 10:47, Achilleas Mantzios a écrit : >>>> Hello, >>>> >>>> I have been testing sporadically openldap two years now, including >>>> many advanced features, sql, ppolicy, etc we are currently evaluating >>>> openldap along with redhat's 389 for enterprise use as RBAC, on which >>>> we will built upon our existing infrastructure. We want to have full >>>> password policy enabled, in order to meet requirements for passing SOX >>>> (Sarbanes Oxley) compliance. >>>> 389's documentation is lousy, I haven't tried anything exotic (sql, >>>> etc) with it, the reason we are looking at it is because it is favored >>>> by kolab.org and likely to come as standard in future kolab versions. >>>> So I would like your opinion on this. Pros/Cons to choose openldap or >>>> 389 directory server as our long term strategic decision? >>>> >>> If you are interested in RBAC, know that there is a Java API that >>> implements RBAC at http://directory.apache.org/fortress/ (1.0.0 have >>> just been released last week). It works with OpenLDAP as a backend (and >>> some other LDAP server too). >> Hi I had talked with a SYMAS person some years ago regarding fortress, >> this is also hosted by openldap : http://www.openldap.org/fortress/ >> So who manages fortress? > It has moved to the Apache Foundation 2 years ago. Thanx for the insight. > > >> By the test we had done with openldap it seemed that marginally we >> could meet our password policy requirements. > Here, you will have to tell us more about your requirements. Right, we have an inhouse application running on Java EE, which we have been developing for the last 16 years. We use mostly classic form-based j2ee declarative security. We have been using IBM Lotus Notes Domino Server and its bundled LDAP server, by writing our own login module for Jboss. But lotus's LDAP is of limited potential. Now we need to have the following features : - support password strength and also communicate relevant error codes/messages back to the calling client (e.g. jboss login module) - handle correctly while in period of passwd expiration warning (error codes/messages) - handle correctly after period of passwd expiration, but within the grace limit (error codes/messages) - support password history (error codes/messages) - handle correctly after period of passwd expiration, and also after grace limit (error codes/messages) - account explicitly locked (error codes/messages) - handle pwdMustChange & pwdReset (error codes/messages) - account explicitly locked after pwdMaxFailure (error codes/messages) According to some tests we had done back in 2014, we had it all covered, in theory. Our idea was to have some supplementary roles assigned to the user, denoting of any outstanding state of the account, and then add this role to the user, inside the login module, and then use an hybrid approach of declarative security + some filters + some programmatic security to allow the user to have a full RBAC experience -- Achilleas Mantzios IT DEV Lead IT DEPT Dynacom Tankers Mgmt

2 2

Re: Openldap vs 389
by Achilleas Mantzios 19 Apr '16

19 Apr '16

On 19/04/2016 12:20, Emmanuel Lécharny wrote: > Le 19/04/16 10:47, Achilleas Mantzios a écrit : >> Hello, >> >> I have been testing sporadically openldap two years now, including >> many advanced features, sql, ppolicy, etc we are currently evaluating >> openldap along with redhat's 389 for enterprise use as RBAC, on which >> we will built upon our existing infrastructure. We want to have full >> password policy enabled, in order to meet requirements for passing SOX >> (Sarbanes Oxley) compliance. >> 389's documentation is lousy, I haven't tried anything exotic (sql, >> etc) with it, the reason we are looking at it is because it is favored >> by kolab.org and likely to come as standard in future kolab versions. >> So I would like your opinion on this. Pros/Cons to choose openldap or >> 389 directory server as our long term strategic decision? >> > If you are interested in RBAC, know that there is a Java API that > implements RBAC at http://directory.apache.org/fortress/ (1.0.0 have > just been released last week). It works with OpenLDAP as a backend (and > some other LDAP server too). Hi I had talked with a SYMAS person some years ago regarding fortress, this is also hosted by openldap : http://www.openldap.org/fortress/ So who manages fortress? By the test we had done with openldap it seemed that marginally we could meet our password policy requirements. > > Regarding OpenLDAP, obviously, this list is clearly biased. Now, let's > see what you can find on the Internet : > > http://www.slideshare.net/ldapcon/benchmarks-on-ldap-directories > Thanx! > -- Achilleas Mantzios IT DEV Lead IT DEPT Dynacom Tankers Mgmt

1 0

Openldap vs 389
by Achilleas Mantzios 19 Apr '16

19 Apr '16

Hello, I have been testing sporadically openldap two years now, including many advanced features, sql, ppolicy, etc we are currently evaluating openldap along with redhat's 389 for enterprise use as RBAC, on which we will built upon our existing infrastructure. We want to have full password policy enabled, in order to meet requirements for passing SOX (Sarbanes Oxley) compliance. 389's documentation is lousy, I haven't tried anything exotic (sql, etc) with it, the reason we are looking at it is because it is favored by kolab.org and likely to come as standard in future kolab versions. So I would like your opinion on this. Pros/Cons to choose openldap or 389 directory server as our long term strategic decision? -- Achilleas Mantzios IT DEV Lead IT DEPT Dynacom Tankers Mgmt

2 2

LMDB: file size increase (due to new free pages) even though write transaction does not add/update items
by Argyrios Kyrtzidis 18 Apr '16

18 Apr '16

Hi, Thank you for making LMDB available. I’m using LMDB on OSX (without MDB_WRITEMAP, so the database file size is relative to the stored data, not the max mapsize). I’ve noticed that write transactions that have a large number of ‘attempted’ updates, but that do not actually make any updates due to MDB_NOOVERWRITE / MDB_NODUPDATA, cause an increase in the database file size, which mdb_stat attributes to an increased number of free pages. This is with latest master of the github mirror. I’m wondering if you have any hints on what I may be doing wrong ? I’d like if possible to avoid the database size increasing if the write pass did not make any updates.

2 5

IP based and FQDN based certificate on same LDAP node
by Prashanth P.Nair 18 Apr '16

18 Apr '16

Hi Currently my LDAP server is having self signed FQDN based SSL certificate .I would like to have IP based SSL certificate for the same node.IS that feasible ? Below certificate issued to FQDN i.e CN=FQN. TLSCACertificateFile /etc/ssl/ldap.pem TLSCertificateKeyFile /etc/ssl/ldap.pem TLSCertificateFile /etc/ssl/ldap.pem Br/Prashanth.

2 1

ldap_sync(3) function usage
by Frank Crow 18 Apr '16

18 Apr '16

I'm wanting to write a client in C/C++ that does a "refresh and persist" sync search on an entry. I'm looking at the ldap_sync(3) man page and that looks like it would do most things that I need. I can't find any example code that is using that interface, so if somebody could point me to any that does, I'd really appreciate it. I do understand that I need to initialize the API with the ldap_sync_initialize() to get an ldap_sync_t structure. The members of the structure seem straightforward enough but I don't understand how I connect my ldap connection (LDAP*) to this API. How does that work?? Also, I don't understand how the different function typedefs work. I mean that I understand that I need four functions: ldap_sync_search_entry_f my_search_entry(...); ldap_sync_search_reference_function_f my_search_reference(...); ldap_sync_search_intermediate_f my_search_intermediate(...); ldap_sync_search_result_f my_search_result(...); But how does the ldap_sync(3) API become aware of those functions? Or... is there an easier way to do what I want? Looks like the ldapsearch command line tool just adds a control to the search (-E sync=rp) and handles the resulting messages as necessary. Should I be trying to do that instead of using ldap_sync(3)? Thanks, -- Frank

2 1

Possible to have IP based and FQDN based certificate on same LDAP node ??
by Prashanth P.Nair 18 Apr '16

18 Apr '16

Hi All Currently my LDAP server is having self signed FQDN based SSL certificate .I would like to have IP based SSL certificate for the same node.IS that feasible ? Below certificate issued to FQDN i.e CN=FQN. TLSCACertificateFile /etc/ssl/ldap.pem TLSCertificateKeyFile /etc/ssl/ldap.pem TLSCertificateFile /etc/ssl/ldap.pem Please advise on the same. Br/Prashanth.P

2 2

Question about MDB_INTEGERKEY flag
by Greg Heinrich 16 Apr '16

16 Apr '16

Hello, sorry for being a noob but I have a question regarding the MDB_INTEGERKEY flag. I am using the LMDB library through Lua wrappers from https://github.com/shmul/lightningmdb. I have an LMDB file which was created with keys that are named "key0", "key1", ... When I open the database with mdb_dbi_open(txn, NULL, MDB_INTEGERKEY, & dbi) and enumerate keys with successive calls to mdb_cursor_get(cursor, &key, &val, MDB_NEXT) the key values that I read are the same as in the LMDB (i.e. "key0", ...). Since I am using the MDB_INTEGERKEY flag I was hoping to read keys as 1,2,3, etc. And I thought I would then be able to retrieve entries doing e.g. mdb_get(txn, dbi, "1", &data). Am I doing anything wrong or is MDB_INTEGERKEY just used to enforce integer keys when putting entries? To give my question some background: what I am trying to achieve is to read entries in my LMDB file in random/arbitrary order. Since I have may 10 million entries or more, I do not want to store keys in memory. I'd rather retrieve entries using an index. Is that possible? Note that I do not have control over the key naming convention so keys could be named anything. Thanks! Greg.

2 1

Q: accesslog and replicated changes
by Ulrich Windl 15 Apr '16

15 Apr '16

Hello! I have configured accesslog to log all changes to an LDAP server, and that seems to work for months. Recently I noticed that that there wee no new entries for more than a week. Usually there are several entries per day, because with password policy every bad login attempt is logged. As we have three multi-master servers, I wonder whether changes made to other servers and replicated to the local server will be logged by accesslog also. Are the password policy updates (which are somewhat special) also replicated to all servers? As a matter of fact, I got some new entries today (as if the system knew I wanted to report the problem today ;-)) But he first entry for this month was stamped "20160413051836.000002Z", so there were no entries for almost two weeks. The server has connections from 9 clients with each client having 1 to 64 connections to the server open (so the server does not seem to be very idle). Can anybody share some insights on that? As we use BDB for accesslog, I had a look yesterday, and the "*.bdb" files had an "old date", while the redo log and the "__db.*" files had a current date. I learned that changes done to a file via mmap() doesn't update the modification time of the file on Linux, so maybe the file date doesn't say much. At least the redo log's timestamp of the main database seems to match that of the acesslog database (which seems good). Regards, Ulrich

3 3

Re: ldapdelete recursive (-r) with syncrepl
by Frank Crow 13 Apr '16

13 Apr '16

OK, thanks for the clarification and correction. Doing so makes the restore process slightly more of pain but, on the bright side, I won't need to worry about SIDs. So that nice. Also on the bright side, working through this I managed to move to delta-syncrepl which appears to be a better solution. And yeah, I will move to mdb if I can get these guys to bite on upgrading. Thanks for all the info and advice, Frank On Wed, Apr 13, 2016 at 12:29 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Wednesday, April 13, 2016 10:20 AM -0700 Quanah Gibson-Mount < > quanah(a)zimbra.com> wrote: > > --On Wednesday, April 13, 2016 1:16 PM -0400 Frank Crow >> <fjcrow2008(a)gmail.com> wrote: >> >> >>> Then just slapcat the data first, do your destructive tests, and then >>>> restore from slapadd. Doing repetitive ldap deletes/adds will just >>>> causes massive database growth. >>>> >>> >>> >>> OK, but I just want to be clear - I'm still not. Does that mean that >>> I need to nuke /var/lib/ldap on every master replica prior to restoring >>> the DIT? >>> >> >> Yes. >> > > Or I should say, depends on what you've done. If all masters are in a > "bad" state (which would be likely given your test scenario), then yes, you > want to reload them all from the same slapcat dump that was taken, so their > DBs are identical after restore. > > > --Quanah > > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > A division of Synacor, Inc > -- Frank

1 0

Re: ldapdelete recursive (-r) with syncrepl
by Frank Crow 13 Apr '16

13 Apr '16

> Then just slapcat the data first, do your destructive tests, and then restore from slapadd. Doing repetitive ldap deletes/adds will just causes massive database growth. OK, but I just want to be clear - I'm still not. Does that mean that I need to nuke /var/lib/ldap on every master replica prior to restoring the DIT? Also, another question, if I do that will I have to know the server ID (for "-w -S <SID>") in order to properly reload? I'm asking because then my testers need to know which master is which - and there is no guaranteed order at the moment with our configuration. Thanks, Frank On Wed, Apr 13, 2016 at 11:51 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Wednesday, April 13, 2016 12:29 PM -0400 Frank Crow < > fjcrow2008(a)gmail.com> wrote: > > >> Well, OK. Our formal test procedures (created and executed by a >> separate team) will intentionally do all manner of destructive changes to >> the DIT after taking a snapshot. After which they want to clean and >> reload the entire DIT in order to: 1) be able to run the tests multiple >> times with the same data, and 2) restore the DIT for normal (non-OpenLDAP >> related) testing that does need the DIT intact. >> > > Then just slapcat the data first, do your destructive tests, and then > restore from slapadd. Doing repetitive ldap deletes/adds will just causes > massive database growth. > > During production use, we would not be doing that. For that, I think >> the individual node repair (slapadd/slapcat) would be exactly what we >> need. >> >> >> I took your suggestion and forwarded the list of changes since 2.4.40 >> (with the syncrepl fixes highlighted) to the important people up the >> "flag pole" this morning. I am "fighting the good fight" with them but >> they are hesitant to move without strenuous "encouragement!" ;-) >> > > I guess it just depends on whether or not they consider data loss > acceptable. If they do find it acceptable, by all means, stay on 2.4.40. ;) > > Also not sure which database backend you're using, but I'd strongly advise > back-mdb once you get to 2.4.44. > > > --Quanah > > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > A division of Synacor, Inc > -- Frank

2 2

Re: ldapdelete recursive (-r) with syncrepl
by Frank Crow 13 Apr '16

13 Apr '16

Well, OK. Our formal test procedures (created and executed by a separate team) will intentionally do all manner of destructive changes to the DIT after taking a snapshot. After which they want to clean and reload the entire DIT in order to: 1) be able to run the tests multiple times with the same data, and 2) restore the DIT for normal (non-OpenLDAP related) testing that does need the DIT intact. During production use, we would not be doing that. For that, I think the individual node repair (slapadd/slapcat) would be exactly what we need. I took your suggestion and forwarded the list of changes since 2.4.40 (with the syncrepl fixes highlighted) to the important people up the "flag pole" this morning. I am "fighting the good fight" with them but they are hesitant to move without strenuous "encouragement!" ;-) Thanks, Frank On Wed, Apr 13, 2016 at 11:17 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Wednesday, April 13, 2016 11:51 AM -0400 Frank Crow < > fjcrow2008(a)gmail.com> wrote: > > >> I did see that and do know how to do slapadd/slapcat backups. What >> I'm not clear on is how that works with N-Way MMR. Wouldn't I have >> to go and delete the the /var/lib/ldap on every master replica machine >> prior to loading the backup with slapadd? Or is that not necessary? >> > > Is your intent to drop the database and reload it on every master? That > would seem to indicate you've got significant issues with how you manage > your servers. > > You can trivially recover any one given server with the backup from > another MMR node. I.e., say you want to take down node 3... slapcat node1 > or node2, and load that onto node 3... > > Again, more information on what it is you're really trying to do here > would be useful. > > > In any case, I did update my syncrepl to use cn=accesslog and I no longer >> have any issues with bulk operations being propagated to the other master >> replicas. >> > > Good, delta-syncrepl's definitely better. But this doesn't resolve the > many replication problems that still exist in 2.4.40. > > > --Quanah > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > A division of Synacor, Inc > -- Frank

2 1

Re: ldapdelete recursive (-r) with syncrepl
by Frank Crow 13 Apr '16

13 Apr '16

I did see that and do know how to do slapadd/slapcat backups. What I'm not clear on is how that works with N-Way MMR. Wouldn't I have to go and delete the the /var/lib/ldap on every master replica machine prior to loading the backup with slapadd? Or is that not necessary? In any case, I did update my syncrepl to use cn=accesslog and I no longer have any issues with bulk operations being propagated to the other master replicas. Thanks, Frank On Wed, Apr 13, 2016 at 2:15 AM, Michael Ströder <michael(a)stroeder.com> wrote: > Please stay on the list so others can answer and learn as well. > > > Frank Crow wrote: > > OK, if I do a backup with slapcat, I still would want to wipe the > existing > > contents of the DIT first, right? > > That's why I wrote... > > > On Tue, Apr 12, 2016 at 5:47 PM, Michael Ströder <michael(a)stroeder.com> > > wrote: > > > >> Frank Crow wrote: > >>> I'm trying to create backup and restore scripts using LDAP command line > >>> tools. > >> > >> For various reasons backup and restore should be done with command-line > >> tools > >> slapcat and slapadd which operate directly on the database files. > >> > >> And yes, with recent backend modules like back-mdb and back-hdb you can > do > >> hot > >> backup while slapd is running. > >> > >> Of course, before a restore you have to stop slapd and remove the DB > files. > > ^^^^^^^^^^^^^^^^^^^ > ...to remove the database files. > > >> After using slapadd you should check whether ownership/permissions are > >> still > >> correct. > > Please read the responses carefully. > > Ciao, Michael. > > -- Frank

2 1

Re: ldapdelete recursive (-r) with syncrepl
by Frank Crow 13 Apr '16

13 Apr '16

Well, I can strongly suggest that we upgrade past that but I know that I'll get push back on it. I'll change the syncrepl to use refreshAndPersist. Thanks, Frank On Tue, Apr 12, 2016 at 7:04 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, April 12, 2016 7:33 PM -0400 Frank Crow < > fjcrow2008(a)gmail.com> wrote: > > >> OpenLDAP 2.4.40 >> > > Upgrade. There are serious MMR issues in that release. > > > Syncrepl configuration: >> >> olcSyncUseSubentry: FALSE >> olcSyncrepl: {0}rid=101 provider=ldap://server1 >> searchbase="o=xxx,dc=yyy, >> dc=zzz" type=refreshOnly bindmethod=sasl saslmech=EXTERNAL >> > > I strongly advise against using refreshOnly. There's virtually no > instance where that is the correct option. > > > --Quanah > > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > A division of Synacor, Inc > -- Frank

2 1

Re: ldapdelete recursive (-r) with syncrepl
by Frank Crow 13 Apr '16

13 Apr '16

OpenLDAP 2.4.40 Syncrepl configuration: olcSyncUseSubentry: FALSE > olcSyncrepl: {0}rid=101 provider=ldap://server1 searchbase="o=xxx,dc=yyy, > dc=zzz" type=refreshOnly bindmethod=sasl saslmech=EXTERNAL > tls_cert=/etc/openldap/certs/xxxxx.crt > tls_key=/etc/openldap/certs/xxxxx.key > tls_cacert=/etc/openldap/certs/cacert.pem interval=00:00:00:10 > retry="5 10 10 10 30 +" timeout=1 starttls=critical > olcSyncrepl: {1}rid=102 provider=ldap://server2 > searchbase="o=xxx,dc=yyyy, > dc=zzz" type=refreshOnly bindmethod=sasl saslmech=EXTERNAL > tls_cert=/etc/openldap/certs/ldapadmin.crt > tls_key=/etc/openldap/certs/xxxxx.key > tls_cacert=/etc/openldap/certs/cacert.pem interval=00:00:00:10 > retry="5 10 10 10 30 +" timeout=1 starttls=critical > olcMirrorMode: TRUE BTW, I just tried addinging: dn: olcOverly={3}syncprov,olcDatabase={2},cn=config > changetype: modify > replace: olcSpCheckpoint > olcSpCheckpoint: 1024 > - > add: olcSpSessionlog > olcSpSessionlog: 1024 > - > add: olcSpReloadhint > olcSpReloadhint: TRUE And that seemed to fix it! Maybe it was just the checkpoint being "1 1" that was messing it up? Or maybe I needed the session log. I realize that this is the deprecated approach. I probably put in cn=changelog instead if there's a good reason to do so. -Frank On Tue, Apr 12, 2016 at 6:26 PM, Frank Crow <fjcrow2008(a)gmail.com> wrote: > OK, if I do a backup with slapcat, I still would want to wipe the existing > contents of the DIT first, right? > > Also, I just tried doing a list of deleted uid entries using "ldapdelete > -ZZ -f /file.ldif" and although the command did not complain, not all of > the entries in the file.ldif were deleted from all replicas. I really > think there is something wrong with my configuration! I suppose that I'll > try cn=changelog next. > > Thanks, > Frank > > > On Tue, Apr 12, 2016 at 5:47 PM, Michael Ströder <michael(a)stroeder.com> > wrote: > >> Frank Crow wrote: >> > I'm trying to create backup and restore scripts using LDAP command line >> > tools. >> >> For various reasons backup and restore should be done with command-line >> tools >> slapcat and slapadd which operate directly on the database files. >> >> And yes, with recent backend modules like back-mdb and back-hdb you can >> do hot >> backup while slapd is running. >> >> Of course, before a restore you have to stop slapd and remove the DB >> files. >> After using slapadd you should check whether ownership/permissions are >> still >> correct. >> >> Ciao, Michael. >> >> > > > -- > Frank > -- Frank

2 1

Re: ldapdelete recursive (-r) with syncrepl
by Frank Crow 13 Apr '16

13 Apr '16

Oops... sorry... had inadvertently used "reply" rather than "reply all"! Seems that if I used "ldapdelete -ZZ <dn>" on a single entry e.g., "uid=someuser,ou=Users,o=xxx,dc=yyy,dc=zzz" that propagates fine. But if I delete the parent in bulk "ldapdelete -ZZ ou=Users,o=xxx,dc=yyy,dc=zzz" then none of the "delete entry" actions get propagated to the other masters. They still have the entire tree. Is that the expected behavior? Should I only ever delete children nodes and not containers? Thanks, Frank On Tue, Apr 12, 2016 at 5:33 PM, Frank Crow <fjcrow2008(a)gmail.com> wrote: > The interesting thing to me, is that a single "ldapdelete -ZZ <dn>" works > and propagates no problem. That's really why I'm wondering if there is > something non-obvious about "ldapdelete -ZZ *-r* <dn>" (recursive). Or > is it that there is some issue in my configuration? > > Well, anyway, my test is going to do "higher up the tree" bulk deletes and > see if I have any different results. > > Thanks, > Frank > > > On Tue, Apr 12, 2016 at 4:49 PM, Frank Crow <fjcrow2008(a)gmail.com> wrote: > >> I'm trying to use ldapsearch and ldapadd for backup and restore with >> N-Way MMR on the backend. Maybe it's just my MMR config that's incorrect?? >> >> And I still need to have "delete entry" propagate to all masters. We >> have formal tests that will be exercising that capability with our users, >> roles, perms, etc. We have GUIs that add/change/delete entries for >> administration, etc. I can even expect "bulk" deletes from those GUIs. >> >> I'll be doing various experiments to change the replication parameters >> and probably add a session log, etc. I was just hoping that someone could >> point me to how/where I can better understand this. (I have and am >> reading the Admin Guide, man pages, and even "Mastering LDAP", etc., just >> BTW.) I must have missed something somewhere. >> >> Thanks, >> Frank >> >> >> >> On Tue, Apr 12, 2016 at 4:11 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> >> wrote: >> >>> --On Tuesday, April 12, 2016 4:49 PM -0400 Frank Crow < >>> fjcrow2008(a)gmail.com> wrote: >>> >>> >>>> I'm trying to create backup and restore scripts using LDAP command line >>>> tools. Creating a suitable backup and loading it are no problem. >>>> However, if I attempt to: >>>> >>> >>> Generally one does backup and restore using slapcat & slapadd. What are >>> you trying to accomplish? >>> >>> --Quanah >>> >>> >>> -- >>> >>> Quanah Gibson-Mount >>> Platform Architect >>> Zimbra, Inc. >>> -------------------- >>> Zimbra :: the leader in open source messaging and collaboration >>> A division of Synacor, Inc >>> >> >> >> >> -- >> Frank >> > > > > -- > Frank > -- Frank

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical