- openldap-technical - openldap.org

ldapdelete recursive (-r) with syncrepl
by Frank Crow 12 Apr '16

12 Apr '16

I'm trying to create backup and restore scripts using LDAP command line tools. Creating a suitable backup and loading it are no problem. However, if I attempt to: # ldapdelete -ZZ -r o=xxx,dc=yyyy,dc=zzz It appears to work fine on the master replica where the command was run, but the other (MMR) master still maintains the entire DIT fragment. It doesn't ever seem to delete any of the entries. Is there anything unique about the (-r) recursive ldapdelete? Is this behavior unique to "refreshOnly"? Should I use "refreshAndPersist"? Or do I need to implement a session log? Thanks for any help or advice, -- Frank

3 2

Re: slapd ACL - limit bind to employeeType=<various>
by Tim Watts 12 Apr '16

12 Apr '16

On 12/04/16 18:32, Michael Ströder wrote: > Tim Watts wrote: >> "Delete" - they vanish from libnss and other places, but we still hold their >> LDAP record for easy resurrection (this happens a lot - we have a class of >> nomadic users - they work on a project, go away, then come back on another >> project 2 years later). > > That state I'd call "inactive" or similar. But that's cosmetic. > > In my systems there's always exactly one status "active" for which I allow > "auth" on "userPassword". > > E.g. in Æ-DIR the attribute 'aeStatus' can have this Integer values: > > -1: requested > 0: active > 1: deactivated > 2: archived > > I suspect you're overloading the semantics of 'employeeType' by putting two > meaning into one attribute. > > Ciao, Michael. > Yes - I think I am. It was partly convenience (I'm using the LAM web front end to manage, with ldapvi where LAM cannot cope (odd problems with empty mail attributes). But also I did not think of your idea - it's pretty cool. I'd have to admit to being more of an LDAP n00b (we populated /etc/passwd directly from postgresql in my last place). -- Tim Watts Tel (VOIP): +44 (0)1580 848360 Systems Manager Kings Digital Lab (KDL), King's College London Systems Messages and Notifications: https://systemsblog.cch.kcl.ac.uk/

1 0

Re: slapd ACL - limit bind to employeeType=<various>
by Tim Watts 12 Apr '16

12 Apr '16

Sir, you are a genius :) On 11/04/16 07:31, Michael Ströder wrote: > # some entries matching filter > access to > attrs=userPassword > filter=(!(employeeType=Archive)(employeeType=Delete)) > by ..some who clauses for setting password > by * auth > > # all other entries > access to > attrs=userPassword > by * none Very slight tweak to the syntax (with huge thanks - I would not have guessed this was the required technique - I was concentrating on finding an "auth" ACL when I was googling.) This is the full ACL list for context, should anyone find this useful. The nice thing is that I can add new employeeTypes (eg "BA" for undergrads) without breaking the core logic. Also, this should be fundamentally more secure as we can now disable accounts in one place. In case anyone is wondering the difference between "Archive" and "Delete", they are as follows: "Archive" - keep the user in the libnss lists (eg getent passwd still returns them, so that file UIDs resolve). User cannot log in. "Delete" - they vanish from libnss and other places, but we still hold their LDAP record for easy resurrection (this happens a lot - we have a class of nomadic users - they work on a project, go away, then come back on another project 2 years later). =========================================== access to attrs=userPassword filter=(&(!(employeeType=Archive))(!(employeeType=Delete))) by peername.path="/var/run/slapd/ldapi" manage by set="user/uid & [cn=sysadmin,ou=groups,dc=dighum,dc=kcl,dc=ac,dc=uk ]/memberUid" manage by self write by * auth access to attrs=userPassword by * none # Certain attributes that should not be publicly readable access to attrs=bindTimestamp,modifyTimestamp,modifiersName,creatorsName,creat eTimestamp by peername.path="/var/run/slapd/ldapi" manage by set="user/uid & [cn=sysadmin,ou=groups,dc=dighum,dc=kcl,dc=ac,dc=uk ]/memberUid" manage by self read by * none # The admin dn has full write access, everyone else # can read everything. Local unix domain socket (root only) # Can do everything access to * by peername.path="/var/run/slapd/ldapi" manage by set="user/uid & [cn=sysadmin,ou=groups,dc=dighum,dc=kcl,dc=ac,dc=uk ]/memberUid" manage by * read =========================================== I'll do some more testing and have a look at that "set=" inefficiency too. Thanks very much for your help :) Tim -- Tim Watts Tel (VOIP): +44 (0)1580 848360 Systems Manager Kings Digital Lab (KDL), King's College London Systems Messages and Notifications: https://systemsblog.cch.kcl.ac.uk/

2 4

Re: slapd ACL - limit bind to employeeType=<various>
by Tim Watts 12 Apr '16

12 Apr '16

On 12/04/16 10:54, Michael Ströder wrote: > Writing OpenLDAP ACLs is a bit like functional > programming - at least to what I vaguely remember > from my time at University many years ago. > > I'd recommend to look into the OpenLDAP FAQ to > find some more not so obvious examples. :) It's something that takes time to "get" - bit like exim configuration. Very powerful, but a little bit of an art that's not quite like anything else! -- Tim Watts Tel (VOIP): +44 (0)1580 848360 Systems Manager Kings Digital Lab (KDL), King's College London Systems Messages and Notifications: https://systemsblog.cch.kcl.ac.uk/

1 0

Help needed to migrate htpasswd APR1 hash to OpenLdap
by Michel Jouvin 11 Apr '16

11 Apr '16

Hi, We recently upgraded one of our Apache server from an htpasswd-based authentication to an OpenLdap-based one. As part of this, we had to move users identified by a username+password and faced the problem of converting the APR1 (Apache salted-MD5) hashes to OpenLDAP. We managed to migrate crypt and MD5 ($1$) hashes successfully as they are successfully managed by OpenLdap standard componenents. This is not the case for APR1 hashes, AFAIK. As documented on OpenLdap site, we built, installed and loaded pw-apr1.so from contrib/ in sources. With Perl Digest::MD5 + MIME::Base64::encode_base64, I have been able to generate a MD5 hash ({MD5} prefix in userPassword) that works with {MD5} so I'm pretty confident that pw-apr1.so works properly. But I'm stucked with APR1 password as I don't understand what should be done to transform a $apr1$... has into the {APR1}... format. According to an example given in the issue http://www.openldap.org/its/index.cgi/Contrib?id=7869;page=9;statetype=-1 (related to a former bug in apr1.c), $apr1$pepperon$VBD3GaYfoFXuIcZrTw/Y// should transform into {APR1}FK7q3pAf80k0Wh9BYZJ0FHBlcHBlcm9u but I have no clue how to get such a transformation done (does not seem to be a trivial encoding to base64). Any help would be very much appreciated! Cheers, Michel

3 3

Re: slapd ACL - limit bind to employeeType=<various>
by Tim Watts 11 Apr '16

11 Apr '16

Hi Michael, On 11/04/16 09:11, Michael Ströder wrote: >> >> OK - I'm going to have to get my head around that :) On a test >> platform... Am I right in thinking the job of the 2nd ACL is because >> if employeeType is Archive|Delete, the first ACL will simple fall >> through - so the second ACL is semantically a "Deny All"? > > Yepp. Thanks! That's clearer now. >> One other thing - I did not mention, which is retrospect might be >> important: >> >> I don't let slapd store password hashes - it passes through to >> Kerberos via saslauthd. So the attribute is of this form: >> >> userPassword: {SASL}someuser(a)MY.KERB.REALM >> >> I presume that blocking access to userPassword will still cause >> authentication to fail in this case as it won't be able to do that >> lookup? > > Yes, I think so. But I never used saslauthd myself. I'll set up a test and confirm to this list (to make the archive of this thread more useful to someone else). >> I thought you'd say that :) I'm OK with limiting access to the parent >> directory (in this case to the slapd user and root). For me, it feels >> simpler. You may disagree, but I just wanted to say it wasn't an >> oversight. > > Your server, your attack vectors... :) Cheers! Tim -- Tim Watts Tel (VOIP): +44 (0)1580 848360 Systems Manager Kings Digital Lab (KDL), King's College London Systems Messages and Notifications: https://systemsblog.cch.kcl.ac.uk/

1 0

Re: slapd ACL - limit bind to employeeType=<various>
by Tim Watts 11 Apr '16

11 Apr '16

Hi Michael, On 11/04/16 07:31, Michael Ströder wrote: > Tim Watts wrote: > # some entries matching filter > access to > attrs=userPassword > filter=(!(employeeType=Archive)(employeeType=Delete)) > by ..some who clauses for setting password > by * auth > > # all other entries > access to > attrs=userPassword > by * none > > The second ACL is important! OK - I'm going to have to get my head around that :) On a test platform... Am I right in thinking the job of the 2nd ACL is because if employeeType is Archive|Delete, the first ACL will simple fall through - so the second ACL is semantically a "Deny All"? One other thing - I did not mention, which is retrospect might be important: I don't let slapd store password hashes - it passes through to Kerberos via saslauthd. So the attribute is of this form: userPassword: {SASL}someuser(a)MY.KERB.REALM I presume that blocking access to userPassword will still cause authentication to fail in this case as it won't be able to do that lookup? >> Current ACLs are fairly simple: >> >> access to dn.base="" by * read >> >> access to attrs=userPassword >> by peername.path="/var/run/slapd/ldapi" manage > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > This is somewhat dangerous because it gives any process which has write access > to the LDAPI socket *manage* rights. I'd recommend not to do that. Rather use > authz-regexp mappings to explicitly map certain OS accounts to real LDAP entries. I thought you'd say that :) I'm OK with limiting access to the parent directory (in this case to the slapd user and root). For me, it feels simpler. You may disagree, but I just wanted to say it wasn't an oversight. >> by set="user/uid & >> [cn=sysadmin,ou=groups,dc=dighum,dc=kcl,dc=ac,dc=uk]/memberUid" manage > > Set-ACLs are slow. I'd recommend to use groupOfNames entries to achieve this. OK - I will have to study that - thanks for pointing it out. Off to clone a test server off the production one.... I could have done with getting a bit more of this right the first time, but it was sadly a rush job at the time. Now seems like a good time to put some polish on it. All that best! Tim -- Tim Watts Tel (VOIP): +44 (0)1580 848360 Systems Manager Kings Digital Lab (KDL), King's College London Systems Messages and Notifications: https://systemsblog.cch.kcl.ac.uk/

2 1

slapd ACL - limit bind to employeeType=<various>
by Tim Watts 11 Apr '16

11 Apr '16

Hi, Sorry - this is probably very basic, but I cannot get my head around how to write an ACL that prevents "auth" unless the user's employeeType attribute is in a particular list (or NOT in a shorter list). I have a slapd config line: constraint_attribute employeeType regex ^(Staff|External|MA|PhD|Intern|System|Archive|Delete)$ However, I'd like to limit the ability to bind (auth) to those users whose employeeType is NOT [regex ^(Archive|Delete)$] or, less preferable, IS Staff|External|MA|PhD|Intern|System At the moment I apply the constrain in pam-ldap, but that's not terribly elegant and of course does not work if apache2's mod_authnz_ldap checks directly with the LDAP server. Many thanks for pointers :) Tim PS Current ACLs are fairly simple: access to dn.base="" by * read access to attrs=userPassword by peername.path="/var/run/slapd/ldapi" manage by set="user/uid & [cn=sysadmin,ou=groups,dc=dighum,dc=kcl,dc=ac,dc=uk]/memberUid" manage by self write by * auth # Certain attributes that should not be publically readable access to attrs=bindTimestamp,modifyTimestamp,modifiersName,creatorsName,c reateTimestamp by peername.path="/var/run/slapd/ldapi" manage by set="user/uid & [cn=sysadmin,ou=groups,dc=dighum,dc=kcl,dc=ac,dc=uk]/memberUid" manage by self read by * none -- Tim Watts Tel (VOIP): +44 (0)1580 848360 Systems Manager Kings Digital Lab (KDL), King's College London Systems Messages and Notifications: https://systemsblog.cch.kcl.ac.uk/

3 2

LDAPI mechanism too weak for this user
by Frank Crow 08 Apr '16

08 Apr '16

I have locked down my server to disallow anonymous binds and set the SSF=128. I also have SaslSecProps: noplain,noanonymous,minssf=128 Which all seems to work fine for my usage with one exception. If I try to use any of the command line tools with "-Y EXTERNAL -H ldapi:///", I now get: additional info: SASL(-15): mechanism too weak for this user: mech EXTERNAL is too weak Is there some configuration item that I can change to allow that work while maintaining my existing policy of no anonymous binds for everything else, etc? Thanks, -- Frank

4 3

TLS error/warning messages output
by Frank Crow 07 Apr '16

07 Apr '16

I'm writing a "C" client that connects with SASL EXTERNAL and yesterday, when it ran it output the following: SASL/EXTERNAL authentication started > SASL username: cn=xxxx,ou=yyyy,ou=zzz,o=aaa,dc=bbbb,dc=ccc > SASL SSF: 0 Which is exactly what I was expecting. Actually is still what I'm expecting. So some changes occurred on the server and the client which resulted in this now being output: TLS: error: the certificate '/etc/openldap/certs/xxxxx.crt' could not be > found in the database - error -12285:Unable to find the certificate or key > necessary for authentication.. > TLS: certificate '/etc/openldap/certs/xxxxx.crt' successfully loaded from > PEM file. > TLS: no unlocked certificate for certificate > 'CN=xxxx,OU=yyyy,OU=zzz,O=aaa,DC=bbbb,DC=ccc'. > SASL/EXTERNAL authentication started > SASL username: cn=xxxx,ou=yyyy,ou=zzz,o=aaa,dc=bbbb,dc=ccc > SASL SSF: 0 I have verified that I am not setting LDAP_OPT_DEBUG_LEVEL and I even tried setting it to "0" explicitly but I still get the same thing! I have seen that before when I set debugging to ANY but I really rather not have this warning output if possible. Does anyone know why this would be occurring or what I can do to turn off those TLS warning/error messages? Thanks, -- Frank

1 0

Re: using ldap_sasl_interactive_bind_s() with EXTERNAL only
by Frank Crow 06 Apr '16

06 Apr '16

Oh cool! I'll give that a try! Thanks, Frank On Tue, Apr 5, 2016 at 5:37 PM, David Hawes <dhawes(a)vt.edu> wrote: > On 5 April 2016 at 16:44, Frank Crow <fjcrow2008(a)gmail.com> wrote: > > Hi, > > > > I'm only ever going to use sasl_mech="EXTERNAL" with my client code. I > > tried using ldap_sasl_bind_s() but that returned with > > LDAP_SASL_BIND_IN_PROGRESS. > > > > I then used ldap_sasl_interactive_bind_s() based on the example in > > clients/tools/common.c more or less. I don't actually need the > defaults > > struct, so I pass defaults=NULL and therefore don't use anything like > > lutil_sasl_defaults(), etc. > > > > I implemented a LDAP_SASL_INTERACT_PROC using the example in > > libraries/liblutil/sasl.c which is very similar to lutil_sasl_interact() > > except that it doesn't support LDAP_SASL_INTERACTIVE and my version of > the > > interaction() function does nothing but return LDAP_SUCCESS. > > > > Looking at it, I could probably shorten my version of the > > lutil_sasl_interact() to simply return LDAP_SUCCESS and not even bother > with > > an interaction() function. > > > > It appears to work just fine and the debug output says: > > > >> ldap_sasl_interactive_bind: user selected: EXTERNAL > >> ldap_int_sasl_bind: EXTERNAL > >> ldap_int_sasl_open: host=server1.paxriver.progeny.net > >> => ldap_dn2bv(16) > >> <= ldap_dn2bv(cn=xxxxxxx,ou=xxxxxxx,ou=xxx,o=xxx,dc=xxxx,dc=xxx)=0 > >> SASL/EXTERNAL authentication started > >> sasl_interact() > >> ldap_sasl_bind > >> ldap_send_initial_request > >> ldap_send_server_request > >> ldap_msgfree > >> ldap_result ld 0x1366940 msgid 2 > > > > > > So my questions: > > > > 1. Is there anything wrong with that approach? > > 2. Is there a better (simpler/easier) way to do this? > > Yes. Pass an empty cred to ldap_sasl_bind_s(): > > cred.bv_val = ""; > cred.bv_len = 0; > ldap_sasl_bind_s(ldap, NULL, "EXTERNAL", &cred, NULL, NULL, NULL); > -- Frank

1 1

Using slapo-rwm to change attribute
by Roel van Meer 06 Apr '16

06 Apr '16

Hi! I have an application that uses the 'c' attribute to store a string describing a country name. The syntax of 'c' only allows a two-letter country code, but the application uses full country names. Therefore the attribute it *should* be using is 'co', or 'friendlyCountryName'. Unfortunately I cannot change this application. (It's Mozilla). I have tried using the rwm overlay to map 'c' onto 'co', which works, but then the syntax of 'c' is still enforced. I can, of course, change the schema definition of 'c' to that of 'co', but that seems bad practice. I could also disable schema schecking, but that is even worse. Are there better ways to work around this? Thanks a lot, Roel

1 0

ldap_set_options() not working but environment variables do work
by Frank Crow 06 Apr '16

06 Apr '16

Hi, I've got some code that uses ldap_start_tls_s() and the server requires client-side certificates. If I set them in the environment, e.g., # export LDAPTLS_CERT="/etc/openldap/some.crt" > # export LDAPTLS_KEY="/etc/openldap/some.key" Then everything works fine. However, if I use: const char* tls_cert="/etc/openldap/some.crt"; > const char* tls_key="/etc/openldap/some.key"; > ldap_set_option( ld, LDAP_OPT_X_TLS_CERTFILE, tls_cert ); > ldap_set_option( ld, LDAP_OPT_X_TLS_KEYFILE, tls_key ); Then it doesn't work. What am I doing wrong? Should it be "&tls_cert" and "&tls_key"? I did do an ldap_get_option() using both methods to verify and I get the value that I'm expecting either way. Thanks, -- Frank

1 1

using ldap_sasl_interactive_bind_s() with EXTERNAL only
by Frank Crow 05 Apr '16

05 Apr '16

Hi, I'm only ever going to use sasl_mech="EXTERNAL" with my client code. I tried using ldap_sasl_bind_s() but that returned with LDAP_SASL_BIND_IN_PROGRESS. I then used ldap_sasl_interactive_bind_s() based on the example in clients/tools/common.c more or less. I don't actually need the defaults struct, so I pass defaults=NULL and therefore don't use anything like lutil_sasl_defaults(), etc. I implemented a LDAP_SASL_INTERACT_PROC using the example in libraries/liblutil/sasl.c which is very similar to lutil_sasl_interact() except that it doesn't support LDAP_SASL_INTERACTIVE and my version of the interaction() function does nothing but return LDAP_SUCCESS. Looking at it, I could probably shorten my version of the lutil_sasl_interact() to simply return LDAP_SUCCESS and not even bother with an interaction() function. It appears to work just fine and the debug output says: ldap_sasl_interactive_bind: user selected: EXTERNAL > ldap_int_sasl_bind: EXTERNAL > ldap_int_sasl_open: host=server1.paxriver.progeny.net > => ldap_dn2bv(16) > <= ldap_dn2bv(cn=xxxxxxx,ou=xxxxxxx,ou=xxx,o=xxx,dc=xxxx,dc=xxx)=0 > SASL/EXTERNAL authentication started > sasl_interact() > ldap_sasl_bind > ldap_send_initial_request > ldap_send_server_request > ldap_msgfree > ldap_result ld 0x1366940 msgid 2 So my questions: 1. Is there anything wrong with that approach? 2. Is there a better (simpler/easier) way to do this? Any advice is highly appreciated! Thanks, Frank

1 0

Openldap 2.4.44 syncprov delays
by Frank Swasey 04 Apr '16

04 Apr '16

Folks, I have recently upgraded my ldap servers (RHEL6, locally built RPM) from 2.4.42 to 2.4.44. After several days of chasing why our nagios checks for syncrepl performance were reporting long delays, I gave up and rolled the primary server back to 2.4.42. This week I have built a primary and replica on RHEL7 with 2.4.44 (again locally built) and have just discovered through some intensive testing and log crawling that the syncprov log entries (with loglevel sync) show up lacking the csn about every hour, and if there are outstanding changes to be replicated when that happens, the syncrepl check on the replica server starts reporting it has fallen behind. This behavior does not exhibit with the 2.4.42 code base. Is this the new normal? Is there something (that has not yet made it into the guide) that I need to change in my syncprov/syncrepl configuration to get around this? This is a “normal” syncprov log entry: Apr 1 18:18:40 ldap7p slapd[10061]: syncprov_sendresp: cookie=rid=100,csn=20160401221840.842942Z#000000#000#000000 This is one of the new ones: Apr 1 18:14:28 ldap7p slapd[10061]: syncprov_sendresp: cookie=rid=100 -- Frank Swasey Sr Systems Administrator Systems Architecture & Administration University of Vermont

2 4

Securing an LADP server.
by Jerry 01 Apr '16

01 Apr '16

I am looking for easy to implement suggestions for securing an LDAP server. First, this is an OpenLDAP-2.4 server running on a FreeBSD-11 machine. The two laptops I carry are both running Windows 10 PRO. I want to be able to access the LDAP server from these machines when I am traveling; however, I want to make sure that not just anyone could gain access to the LDAP server. Primarily, the server would be accessed by my MUA to lookup email addresses. -- Jerry

2 1

OpenLDAP log file ownership getting modified automatically.
by Prashanth P.Nair 01 Apr '16

01 Apr '16

Hello Am using OpenLDAP 'openldap-2.4.31' on debian. I have configured syncrepl .Everything work’s normal. But frequently am getting below Error. The log file ownership is getting changed any one of the node automatically . here is the Error From syslog. Mar 29 12:14:26 xxx slapd[29405]: conn=5774 op=40651 SEARCH RESULT tag=101 err=0 nentries=1 text= Mar 29 12:14:29 xxx slapd[29405]: bdb(dc=xxx,dc=xxx,dc=xxx): /var/lib/ldap/xxx/log.0000000883: log xxxle unreadable: Permission denied Mar 29 12:14:29 xxx slapd[29405]: bdb(dc=xxx,dc=xxx,dc=xxx): PANIC: Permission denied Mar 29 12:14:29 xxx slapd[29405]: bdb(dc=xxx,dc=xxx,dc=xxx): DB_ENV->log_newfh: 883: DB_RUNRECOVERY: Fatal error, run database recovery Mar 29 12:14:29 xxx slapd[29405]: bdb(dc=xxx,dc=xxx,dc=xxx): txn_checkpoint: log failed at LSN [883 68682]: DB_RUNRECOVERY: Fatal error, run database recovery Mar 29 12:14:30 xxx slapd[29405]: conn=5774 op=40652 SRCH base="" scope=0 deref=3 xxxlter="(objectClass=*)" Mar 29 12:14:30 xxx slapd[29405]: conn=5774 op=40652 SRCH attr=objectclass Any idea what is going wrong here? LDAP is running as below user . openldap:x:106:108:OpenLDAP Server Account,,,:/var/lib/ldap:/bin/false $ id openldap uid=106(openldap) gid=108(openldap) groups=108(openldap) I dont find any logs for open file issue.But still i pasted below settings. open file limit settings openldap soft nofile 65536 openldap hard nofile 65536 slapd.conf settings loglevel sync stats modulepath /usr/lib/ldap moduleload back_hdb moduleload syncprov sizelimit 500 tool-threads 8 threads 16 backend hdb database hdb monitoring on cachesize 50000 idlcachesize 50000 directory "/var/lib/ldap/account" dbconfig set_cachesize 0 167772160 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 index objectClass,snAccount,snEnabled,entryCSN,entryUUID eq index cn eq,pres,subany lastmod on checkpoint 5120 30 access to dn.base="" by * read syncrepl rid=001 provider=ldap://xx.xx.xxx.xxx bindmethod=simple binddn="cn=xxx,ou=administrators,dc=test,dc=IN" credentials=xxx searchbase="dc=account,dc=test,dc=IN" schemachecking=on type=refreshAndPersist retry="10 +" mirrormode on overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 10000 Br/Prashanth

3 8

Re: Making a full replica: slapd -c "rid=xxx" doesn't seem to work
by Jephte Clain 01 Apr '16

01 Apr '16

hello, I haven't tried full (config + data) replication from a multimaster setup, but I think that doing so, the slave would become a master like the other from which it replicate, wouldn't it? cc-ing the list to have the opinion of the real experts :-) by the way, as I write this, I recall an advice from Michael Ströder: if the slaves are to replicate everything from the masters, why wouldn't you make them masters like the others? multi-master replication also work for more than two masters. best regards, Jephté Clain 2016-04-01 18:32 GMT+04:00 Jussi Sallinen <jussi(a)synack.fi>: > Ah, > > This is two multimaster servers so I guess that approach doesn't work, as it's meant for master/slave? > > -- > -Jussi Sallinen | UNIX System Administrator > jussi(a)synack.fi | Syn Ack > +358 40 700 7600 | Helsinki, Finland > >> On 1.4.2016, at 11.08, Jephte Clain <jephte.clain(a)univ-reunion.fr> wrote: >> >> hello, >> >> one more thing: make sure to have the proper syncprov overlay AND >> syncrepl directive pointing to the master slapd on the master, at >> least on olcDatabase={0}config and olcDatabase={1}mdb (or whatever is >> the first database that contains the data), e.g: >> >> dn: olcDatabase={0}config,cn=config >> olcSyncrepl: {0}rid=0 provider="ldap://master/" searchbase=cn=config ... >> olcUpdateRef: ldap://master/ >> ... >> >> dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config >> ... >> >> dn: olcDatabase={1}mdb,cn=config >> olcSuffix: dc=univ-reunion,dc=fr >> olcSyncrepl: {0}rid=1 provider="ldap://master/" searchbase=dc=univ-reunion,dc=fr >> olcUpdateRef: ldap://master/ >> ... >> >> dn: olcOverlay={0}syncprov,olcDatabase={1}mdb,cn=config >> ... >> >> the syncrepl directive does nothing on the master, but as this >> configuration is replicated on the slave, the slave knows it has to >> replicate from the master (I hope it's clear enough) >> >> >> >> 2016-04-01 11:06 GMT+04:00 Jussi Sallinen <jussi(a)synack.fi>: >>> Hi, >>> >>> Thank you for the reply! >>> That's what I thought could be the answer. >>> >>> I will now need to try out how this works with our actual database dc=synack,dc=fi >>> >>> Basicly since this will be a new replica without even the dcDomain object in the initial database it should pick up all the data from existing multimaster replica (empty database is without csn etc and contains no update timestamp). >>> >>> -- >>> -Jussi Sallinen | UNIX System Administrator >>> jussi(a)synack.fi | Syn Ack >>> +358 40 700 7600 | Helsinki, Finland >>> >>>> On 1.4.2016, at 8.27, Jephte Clain <jephte.clain(a)univ-reunion.fr> wrote: >>>> >>>> Le 01/04/2016 01:26, Jussi Sallinen a écrit : >>>>> Hi, >>>>> >>>>> How you managed to get this working or did you come up with a workaround: http://www.openldap.org/lists/openldap-technical/201201/msg00205.html >>>>> >>>>> I have a similar situation where I'm doing a reprovision of my 2nd multimaster replica virtualhost and adding base config etc. with ldapadd (we build it from scratch with Ansible during reprovisioning). >>>>> After the new multimaster replica comes up it has newer timestamps than the current up & running replica from where this new one is supposed to replicate everything as we use ldapadd during the reprovision phase with Ansible. >>>> >>>> hello, >>>> >>>> after you create the seed replica, you just have to "touch" the master to ensure the timestamp on the master is newer than on the replica. >>>> >>>> As the seed configuration only contains 3 objects: cn=config, olcDatabase={-1}frontend,cn=config and olcDatabase={0}config,cn=config, I do it that way: >>>> >>>> $ ldapmodify -H ldap://master ...credentials... <<EOF >>>> dn: cn=config >>>> changetype: modify >>>> >>>> dn: olcDatabase={-1}frontend,cn=config >>>> changetype: modify >>>> >>>> dn: olcDatabase={0}config,cn=config >>>> changetype: modify >>>> EOF >>>> >>>> best regards, >>>> Jephté Clain >>>> >>>> -- >>>> *Jephté CLAIN | Développeur, Intégrateur d'applications* >>>> Service Systèmes d'Information >>>> Direction des Systèmes d'Information <http://dsi.univ-reunion.fr> >>>> Tél: +262 262 93 86 31 <tel:+262262938631> || Gsm: +262 692 29 58 24 <tel:+262692295824> >>>> www.univ-reunion.fr <http://www.univ-reunion.fr> || Facebook <http://www.facebook.com/pages/Universit%C3%A9-de-La-R%C3%A9union-OFFICIEL/1…> || Twitter <http://twitter.com/univ_reunion> >> >> >> >> -- >> Jephté CLAIN | Développeur, Intégrateur d'applications >> Service Système d'Information >> Direction des Systèmes d'Information >> Tél: +262 262 93 86 31 || Gsm: +262 692 29 58 24 >> > -- Jephté CLAIN | Développeur, Intégrateur d'applications Service Système d'Information Direction des Systèmes d'Information Tél: +262 262 93 86 31 || Gsm: +262 692 29 58 24

1 0

Need help unpicking stats logging
by Philip Colmer 01 Apr '16

01 Apr '16

I've currently got stats logging turned on while I try to troubleshoot an application and I've noticed some rather strange searches going on. Strange in that the searches are for very high uidNumber values or for uid values that don't exist ... suggesting that someone might be trying to grab data from our server. What I'm struggling with is trying to figure out from the logs (a) the IP address that these queries are coming from and/or (b) the authenticated account being used (even if anonymous). For example, if I have a log line like this: conn=1928683 op=24 SRCH base="ou=accounts,dc=linaro,dc=org" scope=2 deref=0 filter="(&(uid=tftp)(objectClass=posixAccount)(&(uidNumber=*)(!(uidNumber=0))))" is there anything I can do with the conn or op values to connect that particular search query to an earlier logged BIND log entry? Or is there a different/better way for me to try and get the information I'm after? Thanks. Philip

2 1

Re: Need help unpicking stats logging
by Philip Colmer 01 Apr '16

01 Apr '16

Many thanks, Emmanuel, for your quick reply. That is certainly helping me figure out what is going on. It looks like one or two of the client systems aren't correctly configured and this is helping me pin them down. Regards Philip On 1 April 2016 at 11:49, Emmanuel Lécharny <elecharny(a)gmail.com> wrote: > Le 01/04/16 12:45, Philip Colmer a écrit : >> I've currently got stats logging turned on while I try to troubleshoot >> an application and I've noticed some rather strange searches going on. >> Strange in that the searches are for very high uidNumber values or for >> uid values that don't exist ... suggesting that someone might be >> trying to grab data from our server. >> >> What I'm struggling with is trying to figure out from the logs (a) the >> IP address that these queries are coming from and/or (b) the >> authenticated account being used (even if anonymous). >> >> For example, if I have a log line like this: >> >> conn=1928683 op=24 SRCH base="ou=accounts,dc=linaro,dc=org" scope=2 >> deref=0 filter="(&(uid=tftp)(objectClass=posixAccount)(&(uidNumber=*)(!(uidNumber=0))))" >> >> is there anything I can do with the conn or op values to connect that >> particular search query to an earlier logged BIND log entry? > > Just grep your log for 'conn=1928683', it will give you all the history > for the 'user' that did the search. > > Now, FTR, that serach really looks like a PAM LDAP or a SSSD search. > Pretty standard. >

1 0

Re: Making a full replica: slapd -c "rid=xxx" doesn't seem to work
by Jephte Clain 01 Apr '16

01 Apr '16

hello, one more thing: make sure to have the proper syncprov overlay AND syncrepl directive pointing to the master slapd on the master, at least on olcDatabase={0}config and olcDatabase={1}mdb (or whatever is the first database that contains the data), e.g: dn: olcDatabase={0}config,cn=config olcSyncrepl: {0}rid=0 provider="ldap://master/" searchbase=cn=config ... olcUpdateRef: ldap://master/ ... dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config ... dn: olcDatabase={1}mdb,cn=config olcSuffix: dc=univ-reunion,dc=fr olcSyncrepl: {0}rid=1 provider="ldap://master/" searchbase=dc=univ-reunion,dc=fr olcUpdateRef: ldap://master/ ... dn: olcOverlay={0}syncprov,olcDatabase={1}mdb,cn=config ... the syncrepl directive does nothing on the master, but as this configuration is replicated on the slave, the slave knows it has to replicate from the master (I hope it's clear enough) 2016-04-01 11:06 GMT+04:00 Jussi Sallinen <jussi(a)synack.fi>: > Hi, > > Thank you for the reply! > That's what I thought could be the answer. > > I will now need to try out how this works with our actual database dc=synack,dc=fi > > Basicly since this will be a new replica without even the dcDomain object in the initial database it should pick up all the data from existing multimaster replica (empty database is without csn etc and contains no update timestamp). > > -- > -Jussi Sallinen | UNIX System Administrator > jussi(a)synack.fi | Syn Ack > +358 40 700 7600 | Helsinki, Finland > >> On 1.4.2016, at 8.27, Jephte Clain <jephte.clain(a)univ-reunion.fr> wrote: >> >> Le 01/04/2016 01:26, Jussi Sallinen a écrit : >>> Hi, >>> >>> How you managed to get this working or did you come up with a workaround: http://www.openldap.org/lists/openldap-technical/201201/msg00205.html >>> >>> I have a similar situation where I'm doing a reprovision of my 2nd multimaster replica virtualhost and adding base config etc. with ldapadd (we build it from scratch with Ansible during reprovisioning). >>> After the new multimaster replica comes up it has newer timestamps than the current up & running replica from where this new one is supposed to replicate everything as we use ldapadd during the reprovision phase with Ansible. >> >> hello, >> >> after you create the seed replica, you just have to "touch" the master to ensure the timestamp on the master is newer than on the replica. >> >> As the seed configuration only contains 3 objects: cn=config, olcDatabase={-1}frontend,cn=config and olcDatabase={0}config,cn=config, I do it that way: >> >> $ ldapmodify -H ldap://master ...credentials... <<EOF >> dn: cn=config >> changetype: modify >> >> dn: olcDatabase={-1}frontend,cn=config >> changetype: modify >> >> dn: olcDatabase={0}config,cn=config >> changetype: modify >> EOF >> >> best regards, >> Jephté Clain >> >> -- >> *Jephté CLAIN | Développeur, Intégrateur d'applications* >> Service Systèmes d'Information >> Direction des Systèmes d'Information <http://dsi.univ-reunion.fr> >> Tél: +262 262 93 86 31 <tel:+262262938631> || Gsm: +262 692 29 58 24 <tel:+262692295824> >> www.univ-reunion.fr <http://www.univ-reunion.fr> || Facebook <http://www.facebook.com/pages/Universit%C3%A9-de-La-R%C3%A9union-OFFICIEL/1…> || Twitter <http://twitter.com/univ_reunion> > -- Jephté CLAIN | Développeur, Intégrateur d'applications Service Système d'Information Direction des Systèmes d'Information Tél: +262 262 93 86 31 || Gsm: +262 692 29 58 24

1 0

Re: Making a full replica: slapd -c "rid=xxx" doesn't seem to work
by Jephte Clain 01 Apr '16

01 Apr '16

Le 01/04/2016 01:26, Jussi Sallinen a écrit : > Hi, > > How you managed to get this working or did you come up with a > workaround: > http://www.openldap.org/lists/openldap-technical/201201/msg00205.html > > I have a similar situation where I'm doing a reprovision of my 2nd > multimaster replica virtualhost and adding base config etc. with > ldapadd (we build it from scratch with Ansible during reprovisioning). > After the new multimaster replica comes up it has newer timestamps > than the current up & running replica from where this new one is > supposed to replicate everything as we use ldapadd during the > reprovision phase with Ansible. hello, after you create the seed replica, you just have to "touch" the master to ensure the timestamp on the master is newer than on the replica. As the seed configuration only contains 3 objects: cn=config, olcDatabase={-1}frontend,cn=config and olcDatabase={0}config,cn=config, I do it that way: $ ldapmodify -H ldap://master ...credentials... <<EOF dn: cn=config changetype: modify dn: olcDatabase={-1}frontend,cn=config changetype: modify dn: olcDatabase={0}config,cn=config changetype: modify EOF best regards, Jephté Clain -- *Jephté CLAIN | Développeur, Intégrateur d'applications* Service Systèmes d'Information Direction des Systèmes d'Information <http://dsi.univ-reunion.fr> Tél: +262 262 93 86 31 <tel:+262262938631> || Gsm: +262 692 29 58 24 <tel:+262692295824> www.univ-reunion.fr <http://www.univ-reunion.fr> || Facebook <http://www.facebook.com/pages/Universit%C3%A9-de-La-R%C3%A9union-OFFICIEL/1…> || Twitter <http://twitter.com/univ_reunion>

1 0

Should I be able to select an 'orphaned' DN from a translucent overlap proxy?
by Sullivan, Daniel [AAA] 31 Mar '16

31 Mar '16

Hi, I am writing to confirm the expected behavior of a translucent overlay proxy. I have the proxy working and can filter from the local database using the olcTranslucentLocal configuration option (I can see a merged record). My question pertains to ‘orphaned data’. For example, I can arbitrarily add a record to the local database by DN using ldapadd, the glue records are created and I can see the record in the output of slapcat. My problem is that a search via ldapsearch does not return this record unless their is a matching DN in the remote database, even if I am filtering by an attribute specifed in olcTranslucentLocal . Is this the expected behavior? There is more that one reason why I want to do this, but the lowest common denominator is that people are going to be moving records around upstream and I’d like to keep the local database tidy by blowing away records that no longer have a matching remote DN. On that note, the second reason why I’m interested in doing this is to create an individual default group for each user in the local database. I was planning on creating an actual group for each user programmatically, and have no problem doing this. Is there a more elegant best practice way to facilitate this sort of thing (i.e. an overlay solution), or is just creating the groups the way to go? I am using openldap-ltb.x86_64 2.4.44-2.el6. I appreciate your time and expertise. Dan ******************************************************************************** This e-mail is intended only for the use of the individual or entity to which it is addressed and may contain information that is privileged and confidential. If the reader of this e-mail message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is prohibited. If you have received this e-mail in error, please notify the sender and destroy all copies of the transmittal. Thank you University of Chicago Medicine and Biological Sciences ********************************************************************************

1 0

Question about ldap_init()/ldap_initialize() behavior with OpenLDAP
by Frank Crow 31 Mar '16

31 Mar '16

I'm not clear on whether I'm allowed to ask "C" API questions here. If not, I apologize in advance and please disregard in that case. However, the question is more about configuration than coding. I'm seeing that the ldap_init() function allows the hostname parameter to be null or a list of hosts. If it is null, the function attempts to determine the default ldap host. How does it determine the default LDAP host when the hostname parameter is null? Does it load the list of hosts from the ldap.conf URI parameter? And/or does it use the LDAPURI environment variable? Thanks, -- Frank

4 7

CSN is matching but entries count differs in master and slaves
by scn_73＠yahoo.com 31 Mar '16

31 Mar '16

Hello all, CSN is matching with master and slaves but if i count number of entries it's different. I am replicating complete DIT so count should be equal in Master and slave. Should i diff the missed entries and catch them in replications logs. Please suggest .. $ ldapsearch -H ldaps://ldapmaster -D "cn=manager,dc=xxx,dc=com" -x -xxx -s base contextCSN -LLL dn: dc=xxx,dc=com contextCSN: 20160326180539Z#000006#00#000000 $ ldapsearch -H ldaps://ldap-slave -D "cn=manager,dc=xxx,dc=com" -x -wxx -s base contextCSN -LLL dn: dc=xxx,dc=com contextCSN: 20160326180539Z#000006#00#000000 $ ldapsearch -H ldaps://ldapmaster -D "cn=manager,dc=xxx,dc=com" -x -wxx -s sub "objectclass=*" | tail -2 # numResponses: 28751 # numEntries: 28750 $ ldapsearch -H ldaps://ldap-slave "cn=manager,dc=xxx,dc=com" -x -wxxx -s sub "objectclass=*" | tail -2 # numResponses: 28772 # numEntries: 28771

3 4

ACL problem
by Cole 29 Mar '16

29 Mar '16

Hi, I am using OLC and ACL's to limit response from LDAP based on IP address, and this is working fine if I have a single ACL. When I add a second ACL, with a different IP address, the new ACL works, but the previous one does not. Example: Entries in LDAP: # 10.0.0.92, servers, test.com dn: cn=10.0.0.92,ou=servers,dc=test,dc=com objectClass: groupOfNames cn: 10.0.0.92 description: Allowed access member: uid=aaa,dc=test,dc=com # 10.0.0.94, servers, test.com dn: cn=10.0.0.94,ou=servers,dc=test,dc=com objectClass: groupOfNames cn: 10.0.0.94 description: Allowed access member: uid=aaa,dc=test,dc=com # aaa, test.com dn: uid=aaa,dc=test,dc=com objectClass: inetOrgPerson objectClass: posixAccount objectClass: ldapPublicKey objectClass: shadowAccount uid: aaa uidNumber: 10005 gidNumber: 10005 homeDirectory: /home/aaa loginShell: /usr/local/bin/bash mail: a(a)test.com ou: users cn: User A sn: A userPassword:: xxx OLC entries: # {1}ldif, config dn: olcDatabase={1}ldif,cn=config objectClass: olcLdifConfig olcDatabase: {1}ldif olcDbDirectory: /var/pq/0/mount/resolve/installations/entities/vmi/location/za /parts/new/instances/test/openldap-data olcSuffix: dc=test,dc=com olcAccess: {0}to filter=(|(&(objectClass=inetOrgPerson)(memberOf=cn=10.0.0.92, ou=servers,dc=test,dc=com))(objectClass=posixGroup)) by self read by peername .ip="10.0.0.92" read by * none olcAccess: {1}to * by self write by peername.ip="127.0.0.1" write by * none olcRootDN: cn=Manager,dc=test,dc=com olcRootPW: test At this point, running ldapsearch from the computer with ip address 10.0.0.92 works correctly, and only the filtered results are returned. If I then add a second ACL: # {1}ldif, config dn: olcDatabase={1}ldif,cn=config objectClass: olcLdifConfig olcDatabase: {1}ldif olcDbDirectory: /var/pq/0/mount/resolve/installations/entities/vmi/location/za /parts/new/instances/test/openldap-data olcSuffix: dc=test,dc=com olcAccess: {0}to filter=(|(&(objectClass=inetOrgPerson)(memberOf=cn=10.0.0.94, ou=servers,dc=test,dc=com))(objectClass=posixGroup)) by self read by peername .ip="10.0.0.94" read by * none olcAccess: {1}to filter=(|(&(objectClass=inetOrgPerson)(memberOf=cn=10.0.0.92, ou=servers,dc=test,dc=com))(objectClass=posixGroup)) by self read by peername .ip="10.0.0.92" read by * none olcAccess: {2}to * by self write by peername.ip="127.0.0.1" write by * none olcRootDN: cn=Manager,dc=test,dc=com olcRootPW: test The computer with IP 10.0.0.94 can now query LDAP, and receives the correct filtered results, however the computer with IP 10.0.0.92 receives a blank result: $ ldapsearch -x -h 10.0.0.91 -b dc=test,dc=com # extended LDIF # # LDAPv3 # base <dc=test,dc=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 Is this the way that ACLs work in openldap? Or have I missed a configuration setting somewhere? Thanks /Cole

1 1

Transparent Overlay proxy not returning memberOf
by Sullivan, Daniel [AAA] 29 Mar '16

29 Mar '16

Hi, I apologize if this is a silly question; I’ve done a preliminary search of the mailing list archives and read through the documentation in as much detail as I can muster for the moment. I can’t seem to find an answer to this seemingly simple question. My question is this; I am implementing an Overlay Proxy against Active Directory. I have it working (i.e. I can query the local and remote databases and get a composite LDIF record returned that merges my added attributes). My problem is that the returned record doesn’t appear to contain the complete attribute set from the remote server. For example, if I use ldapsearch to query Active Directory directly, I see a bunch of memberOf: attributes for the user object returned. When I query the proxy, I clearly see the brunt of AD attributes for my user object, although the memberOf attributes are missing. Is there a reason for this? My configuration is very basic, and I don’t understand why attributes would be filtered by the proxy. My configuration is probably as simple as it can get (for the proxy): dn: olcOverlay={0}translucent,olcDatabase={2}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcTranslucentConfig olcOverlay: {0}translucent olcTranslucentLocal: uidNumber structuralObjectClass: olcTranslucentConfig dn: olcDatabase={0}ldap,olcOverlay={0}translucent,olcDatabase={2}bdb,cn=conf ig objectClass: olcLDAPConfig objectClass: olcTranslucentDatabase olcDatabase: {0}ldap olcDbURI: ldap://domaincontroller:389 olcDbACLBind: bindmethod=simple timeout=0 network-timeout=0 binddn="cn=s.a aa.ldapsearch,ou=SrvcAccts,ou=AAA,dc=somedomain,dc=uchicago,dc=edu" credentials =“secret" tls_reqcer t=never olcDbIDAssertBind: bindmethod=simple binddn="cn=s.aaa.ldapsearch,ou=SrvcAcc ts,ou=AAA,dc=somedomain,dc=uchicago,dc=edu" credentials=“secret" mode=none tls_reqcert=never olcDbIDAssertAuthzFrom: {0}dn.regex:.* olcDbRebindAsUser: TRUE structuralObjectClass: olcLDAPConfig I’ve turned on debug logging for slapd and it looks like the memberOf attributes are being served up by AD. If anybody could provide insight as to why this would be occurring I would greatly appreciate it. Thank you, Dan Sullivan ******************************************************************************** This e-mail is intended only for the use of the individual or entity to which it is addressed and may contain information that is privileged and confidential. If the reader of this e-mail message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is prohibited. If you have received this e-mail in error, please notify the sender and destroy all copies of the transmittal. Thank you University of Chicago Medicine and Biological Sciences ********************************************************************************

1 1

ITS 7345 (Add Connection Information in Access Log Entries)
by Dario Zanzico 29 Mar '16

29 Mar '16

I've been using the patch attached to ITS 7345 for a couple months without any problem, and I find it necessary for working a comprehensive audit system. Can any work be done to make it acceptable for merging? thanks, dario

1 0

Syncrepl TLS woes
by Xavier Landreville 28 Mar '16

28 Mar '16

Hello, I am currently in the grips of trying to get syncrepl replication working with StartTLS. It was working fine until recently. The only change that occurred over the last 12 months (that relates to OpenLDAP) is that I've started requiring TLS for connections. My provider is running OpenLDAP 2.4.31 on Ubuntu 14.04, while one consumer is running the exact same version on a Ubuntu 14.04 machine and the other consumer is running OpenLDAP 2.4.28 on Ubuntu 12.04. The provider has, AFAIK, a correct TLS configuration, given that I can connect and search using the ldapsearch -ZZ utility from any of the servers. The syncprov overlay is loaded and configured on the provider. The consumers have the following (redacted, with unique rid values) olcSyncRepl: olcSyncrepl: {0}rid=1 provider=ldap://[LDAP_DNS] bindmethod=simple bi nddn="[SYNC_USER]" credentials=[SYNC_PASS] searchbase="[L DAP_BASE]" logbase="cn=accesslog" logfilter="(&(objectClass=auditWr iteObject)(reqResult=0))" schemachecking=on type=refreshAndPersist retry="60 +" syncdata=accesslog starttls=critical tls_reqcert=demand Unfortunately, on both consumers can't seem to be able to actually start the TLS connection: slapd[1257]: slap_client_connect: URI=ldap://[LDAP_DNS] Error, ldap_start_tls failed (-11) slapd[1257]: do_syncrepl: rid=001 rc -11 retrying And the provider shows the following errors: slapd[2126]: conn=1586 fd=100 ACCEPT from IP=[CONSUMER_IP]:35500 (IP=0.0.0.0:389) slapd[2126]: conn=1586 op=0 EXT oid=1.3.6.1.4.1.1466.20037 slapd[2126]: conn=1586 op=0 STARTTLS slapd[2126]: conn=1586 op=0 RESULT oid= err=0 text= slapd[2126]: conn=1586 fd=100 closed (TLS negotiation failure) Is there anything that I'm missing? Cheers, -- Xavier

3 2

LDAP authentication with uid
by Mary Kao 23 Mar '16

23 Mar '16

Hello, This is a real newbie question ::) I have configured apache httpd to use LDAP for basic authentication (userid and password). I am not sure what the directory DN should look like when using "uid" rather than "cn"? In my LDAP directory I have: dn: cn=Christine Smith,ou=ELOGAccounts,ou=RavenApps,dc=my-domain,dc=com objectClass: top objectClass: person objectClass: organizationalPerson objectClass: uidObject cn: Christine Smith sn: Smith uid: christine userPassword:: Y2hyaXN0aW5l Where do I put the "uid" so that when the httpd sends over the uid the ldap server will search on it? Thank you,Mary

4 4

Safely Allow Users to Write self Attributes
by Daniel Howard 23 Mar '16

23 Mar '16

I would like to allow users to ldapmodify a few of their attibutes ... sshPublicKey,gecos .. This does not appear to do the trick: 0-14:08 djh@ldap0 ~$ *sudo ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b \> cn=config '(olcDatabase={1}hdb)' olcAccess* dn: olcDatabase={1}hdb,cn=config olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymou s auth by dn="cn=admin,dc=example,dc=com" write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by dn="cn=admin,dc=example,dc=com" write by * read olcAccess: {3}to attrs=sshPublicKey,gecos by self write Why? I would guess the {2} rule "to * by * read" has precedence. As I understand it, if I wanted to re-order those rules, I would delete and rewrite the rules. This would require me to delete the rule that gives admin the access to write the rules in the first place ... sounds like a way to lock myself out of my LDAP database? So, my guess is that I want and LDIF like so: dn: olcDatabase={1}hdb,cn=config changetype: modify remove: olcAccess olcAccess: {3}to attrs=sshPublicKey,gecos by self write - add: olcAccess olcAccess: {2}to attrs=sshPublicKey,gecos by self write - add: olcAccess olcAccess: {3}to * by dn="cn=admin,dc=example,dc=com" write by * read - remove: olcAccess olcAccess: {2}to * by dn="cn=admin,dc=example,dc=com" write by * read If I run this as cn=admin then it should: 1) Remove ineffective {3} 2) Add an effective {2} (now there are two {2}s..) 3) Add a new {3} to match incumbent {2} 4) Remove incumbent {2} I shouldn't lock myself out because I add a new rule for admin access before deleting the old rule, and as far as LDAP is superficially concerned, all these olcAccess attributes are just unique records, so the conflicting number rules aren't going to be a problem .. ? Am I on the right track? Thanks, -danny -- http://dannyman.toldme.com

2 2

Translucent proxy and changing upstream DNs
by Sullivan, Daniel [AAA] 23 Mar '16

23 Mar '16

Hi, Please forgive my ignorance if this is a stupid question; I have only been messing around with OpenLDAP for a few days, but I believe I hit a roadblock that somebody must have seen somewhere. Basically, I am planning on using a translucent proxy to augment the attribute set served up by an external LDAP provider. Specifically I am provisioning uidNumber and gidNumbers for AD accounts. I cannot populate the upstream RFC2307 attributes. My problem is this; it is my understanding that a translucent proxy is going to match records in the local and remote databases based on DN. Admins are going to be moving user and group objects around upstream, which will reliably break the mapping between local and remote databases after the objects with uidNumber and gidNumbers are populated into the local database. I can think of a couple of algorithms that would reconcile this, although they would require custom coding and maintaining a localized external view of the data (i.e. in a SQL database). So, I suppose my question is this; Is there an elegant way to solve this problem, for example, having the translucent proxy map by an attribute other than DN, such as an AD SID? I appreciate your time and input :-) Thank you, Dan Sullivan ******************************************************************************** This e-mail is intended only for the use of the individual or entity to which it is addressed and may contain information that is privileged and confidential. If the reader of this e-mail message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is prohibited. If you have received this e-mail in error, please notify the sender and destroy all copies of the transmittal. Thank you University of Chicago Medicine and Biological Sciences ********************************************************************************

2 4

cn=config (MMR) replication causes ldapsearch -ZZ to hang on RHEL 6.7
by Frank Crow 22 Mar '16

22 Mar '16

I'm trying to move my OpenLDAP MMR configuration from RHEL 6.5 (OpenLDAP 2.4.23) to RHEL 6.7 (OpenLDAP 2.4.40). On RHEL 6.5 it is working no with no problems. On RHEL 6.7, the configuration causes "ldapsearch -ZZ" to hang indefinitely. The cn=config section in slapd.conf looks like this: # sync provider configuration overlay syncprov syncprov-checkpoint 1 1 syncrepl rid=001 provider=ldap://server1 searchbase="cn=config" filter="(|(objectClass=olcDatabaseConfig)(objectClass=olcOverlayConfig))" bindmethod=sasl saslmech=EXTERNAL starttls=critical tls_cert=/etc/openldap/csa-certs/config.crt tls_key=/etc/openldap/csa-certs/config.key tls_cacert=/etc/openldap/csa-certs/cacert.pem tls_reqcert=demand type=refreshAndPersist retry="5 10 10 10 30 +" timeout=1 syncrepl rid=002 provider=ldap://server2 searchbase="cn=config" filter="(|(objectClass=olcDatabaseConfig)(objectClass=olcOverlayConfig))" bindmethod=sasl saslmech=EXTERNAL starttls=critical tls_cert=/etc/openldap/csa-certs/config.crt tls_key=/etc/openldap/csa-certs/config.key tls_cacert=/etc/openldap/csa-certs/cacert.pem tls_reqcert=demand type=refreshAndPersist retry="5 10 10 10 30 +" timeout=1 mirrormode on If I comment out that section in slapd.conf then "ldapsearch -ZZ" works but (obviously) I don't get cn=config replication. Am I doing something wrong in the configuration? Is it a fluke that it is working on 2.4.23 in the first place? Or does anyone know what may have changed (or is more strict or whatever) in the 2.4.40 release? Should I try to just remove RHEL's version of OpenLDAP and install the latest from openldap.org instead? Any assistance is highly appreciated! Thanks, -- Frank

3 2

how to provide a way to user to change their password
by MichaelLeung 22 Mar '16

22 Mar '16

hi list i am wonder how to provide a way to LDAP user to change their password

3 3

Openldap allows to break schema (and doesn't start ever after)
by Daniel Fenert 21 Mar '16

21 Mar '16

Hi, I've accidentally broken my openldap schema when I've changed one of objectClass definitions. For example I have two objectClasses and one is a parent for second: olcObjectClasses: {0}( 1.2.3.4 NAME 'foo' DESC '' SUP top AUXILIARY X-ORIGIN 'user defined' ) olcObjectClasses: {1}( 1.2.3.5 NAME 'bar' DESC '' SUP foo AUXILIARY X-ORIGIN 'user defined' ) I've changed definition of foo - I've delete this object and (my mistake) put it without any number at bottom of all classes: dn: cn=config changetype: modify delete: olcObjectClasses olcObjectClasses: {0} - add: olcObjectClasses olcObjectClasses: ( 1.2.3.4 NAME 'foo' DESC '' SUP top AUXILIARY X-ORIGIN 'user defined' ) So now I have class bar at top of schema and foo at bottom. After restart slapd won't start. Slapcat says: 56d4678f olcObjectClasses: value #5 olcObjectClasses: ObjectClass not found: "foo" 56d4678f config error processing cn=config: olcObjectClasses: ObjectClass not found: "foo" slapcat: bad configuration file! I know that is my mistake, but I think openldap shouldn't allow to make something that could break schema. I think that there are should constraints that do not allow to remove objectClass which is parent for another class. Is it a known bug, or anyone has stumbled upon this and has a solution to start slapd afterwards? -- Daniel Fenert

1 0

looking for a graphic tool for openldap
by MichaelLeung 21 Mar '16

21 Mar '16

i am wondering is there a graphic openldap admin tool that run under Linux ?

9 12

slapd + bdb backend , some queries failing with "Internal error on get_nextid"
by Tobias Gierke 18 Mar '16

18 Mar '16

Hi, Recently we all of a sudden started getting this error message on certain queries (but not all of them). I had a brief look at back-bdb/search.c but unfortunately there are no comments that point to a possible cause. Does this mean the database is corrupted ? Can this be fixed with db_recover ? Thanks, Tobias P.S. We're running ClearOS 6.7.0 with openldap-servers-2.4.4.0-7-v6 on x64 -- Tobias Gierke Development VOIPFUTURE GmbH Wendenstraße 4 20097 Hamburg, Germany Phone +49 40 688 900 164 Fax +49 40 688 900 199 Email tobias.gierke(a)voipfuture.com Web http://www.voipfuture.com CEO Jan Bastian Commercial Court AG Hamburg HRB 109896, VAT ID DE263738086

2 3

Error with :mozillaOrgPerson removed from template as it is not defined in the schema
by MichaelLeung 18 Mar '16

18 Mar '16

hi list i got these two error, Courier Mail: Account: *courierMailAccount* removed from template as it is not defined in the schema Thunderbird: Address Book Entry: *mozillaOrgPerson* removed from template as it is not defined in the schema seems my phpadminldap lack of the schema. does any one have the schema for openldap ? or give me a link so that i can download it.

3 6

Re: After power reset, LMDB sub-DBs' key-pairs are missing
by Arto Bendiken 16 Mar '16

16 Mar '16

Hi Ulrich, On Tue, Mar 15, 2016 at 9:00 AM, Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de> wrote: >>>> Arto Bendiken <arto(a)bendiken.net> schrieb am 14.03.2016 um 17:30 in Nachricht > <CAE7aNuS4=5ENrgL7w=zDqUe2dE7WH01nkAkAX76Msuw_uj=xug(a)mail.gmail.com>: >> Here's a curious case that I had not encountered with LMDB as yet previously: >> >> 1. There was a power reset of a virtual machine with an active LMDB >> writer process (standalone use, not OpenLDAP) on an LMDB file >> containing three sub-DBs. > [...] > > Hi! > > What is a "power reset of a virtual machine"? A virtual power reset (i.e. reset), or a power reset of the host? > In the latter case some writes that the VM considers done may not be committed on the host, depending on the exact configuration. You didn't give any details on that, so I can only guess... The latter, with the VM's virtio disks being LVM volumes assigned and dedicated to it using libvirt--a run-of-the-mill configuration. -- Arto Bendiken | @bendiken | http://ar.to

2 1

Re: olcAccess/olcLimits modifications
by PenguinWhispererThe . 15 Mar '16

15 Mar '16

It's still weird that adding and deleting works with the index but the replace not. No consistent usage there. Probably the devs had better things to do ;) Anyway. Thanks for clarifying indexes and where I can and can't use them ;) <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> 0 viruses found. www.avast.com <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> <#DDB4FAA8-2DD7-40BB-A1B8-4E2AA1F9FDF2> 2016-03-15 17:19 GMT+01:00 Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Tuesday, March 15, 2016 1:58 PM +0200 Cole <cole(a)opteqint.net> wrote: > > To replace the 12th index, you could do: >>> >>> changetype: modify >>> delete: olcAccess >>> olcAccess: {11} >>> >>> ^ deletes the 12th index, since it is ZERO based. If you want the 13th >>> index ({12}), adjust appropriately. >>> >>> changetype: modify >>> add: olcAccess >>> olcAccess: {11} <new rule> >>> >> >> So in order to modify olcAccess: {11}, you first have to delete it and >> then re-add it? There is no way to modify it in place and change its >> contents? >> > > No. What I generally do is read the value, store that, tweak it how I > want, and then write it back (delete, add modified value). What's handed > with the way things are ordered in cn=config is that you don't have to run > the delete command against the full exact value, but only the index. > > > --Quanah > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > A division of Synacor, Inc >

2 1

Re: olcAccess/olcLimits modifications
by Cole 15 Mar '16

15 Mar '16

> The poster who gave you that advice is wrong. "replace" replaces the entire > entry with what you've added. You want add: value, not replace: value, like > you originally had. Thanks Quanah for providing the correct answer. I could not find an example, and did not have a ldap server handy in order to test. > > To replace the 12th index, you could do: > > changetype: modify > delete: olcAccess > olcAccess: {11} > > ^ deletes the 12th index, since it is ZERO based. If you want the 13th > index ({12}), adjust appropriately. > > changetype: modify > add: olcAccess > olcAccess: {11} <new rule> So in order to modify olcAccess: {11}, you first have to delete it and then re-add it? There is no way to modify it in place and change its contents? Thanks /Cole > > --Quanah > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > A division of Synacor, Inc

2 1

Error 80 with ldapmodify
by Christian Schmidt 15 Mar '16

15 Mar '16

Hi all, we're running Debian Jessie with slapd-2.4.40+dfsg-1+deb8u2 and ldap-utils-2.4.40+dfsg-1+deb8u2. No special modifications have been taken to slapd's configuration and/or the directory itself , and trying to add the following ldif file... dn: cn=config changetype: modify add: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/ldap/ssl/ldap.gnutls.key - add: olcTLSCertificateFile olcTLSCertificateFile: /etc/ldap/ssl/ldap.gnutls.crt - add: olcTLSCACertificateFile olcTLSCACertificateFile: /etc/ldap/ssl/intermediate.pem ...results in error 80: # ldapmodify -Y EXTERNAL -H ldapi:/// -f ./ssl.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "cn=config" ldap_modify: Other (e.g., implementation specific) error (80) All the files are readable for the user slapd is running as. Invoking slapd with debug level 255 shows: [..] 56e2e677 => slap_access_allowed: add access granted by manage(=mwrscxd) 56e2e677 => access_allowed: add access granted by manage(=mwrscxd) 56e2e677 oc_check_required entry (cn=config), objectClass "olcGlobal" 56e2e677 oc_check_allowed type "objectClass" 56e2e677 oc_check_allowed type "cn" 56e2e677 oc_check_allowed type "olcArgsFile" 56e2e677 oc_check_allowed type "olcLogLevel" 56e2e677 oc_check_allowed type "olcPidFile" 56e2e677 oc_check_allowed type "olcToolThreads" 56e2e677 oc_check_allowed type "structuralObjectClass" 56e2e677 oc_check_allowed type "entryUUID" 56e2e677 oc_check_allowed type "creatorsName" 56e2e677 oc_check_allowed type "createTimestamp" 56e2e677 oc_check_allowed type "olcTLSCertificateKeyFile" 56e2e677 oc_check_allowed type "olcTLSCertificateFile" 56e2e677 oc_check_allowed type "olcTLSCACertificateFile" 56e2e677 oc_check_allowed type "entryCSN" 56e2e677 oc_check_allowed type "modifiersName" 56e2e677 oc_check_allowed type "modifyTimestamp" 56e2e677 send_ldap_result: conn=1002 op=1 p=3 56e2e677 send_ldap_result: err=80 matched="" text="" 56e2e677 send_ldap_response: msgid=2 tag=103 err=80 <---- Error 80 ber_flush2: 14 bytes to sd 12 0000: 30 0c 02 01 02 67 07 0a 01 50 04 00 04 00 0....g...P.... ldap_write: want=14, written=14 0000: 30 0c 02 01 02 67 07 0a 01 50 04 00 04 00 0....g...P.... 56e2e677 conn=1002 op=1 RESULT tag=103 err=80 text= [..] What's wrong there? I couldn't find anything useful to feed $SEARCHENGINE with. Thanks & Regards, Christian -- No signature available.

3 6

Replication Failing with TLS ... Sneaky Little Config Error
by Daniel Howard 15 Mar '16

15 Mar '16

I have set up OpenLDAP per the nice tutorial at https://help.ubuntu.com/lts/serverguide/openldap-server.html and on my previous run-throughs, I succeeded at setting up replication via TLS. But now that I'm implementing on the dedicated hardware, I am not able to replicate via TLS. SOLUTION: It turns out the solution was to add a space to an LDIF file ... On PROVIDER I will see, for example: Mar 14 16:13:15 ldap0 slapd[1536]: conn=1392 fd=49 ACCEPT from IP= 10.10.3.117:60277 (IP=0.0.0.0:389) Mar 14 16:13:15 ldap0 slapd[1536]: conn=1392 op=0 BIND dn="" method=128 Mar 14 16:13:15 ldap0 slapd[1536]: conn=1392 op=0 RESULT tag=97 err=0 text= Mar 14 16:13:15 ldap0 slapd[1536]: conn=1392 op=1 SRCH base="dc=qxxxxxxxxd,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uidNumber=2043))" Mar 14 16:13:15 ldap0 slapd[1536]: conn=1392 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass Mar 14 16:13:15 ldap0 slapd[1536]: <= bdb_equality_candidates: (uidNumber) not indexed Mar 14 16:13:15 ldap0 slapd[1536]: conn=1392 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Mar 14 16:13:15 ldap0 slapd[1536]: conn=1392 op=2 SRCH base="dc=qxxxxxxxxd,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=djh))" Mar 14 16:13:15 ldap0 slapd[1536]: conn=1392 op=2 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass Mar 14 16:13:15 ldap0 slapd[1536]: conn=1392 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text= Mar 14 16:13:16 ldap0 slapd[1536]: conn=1392 op=3 UNBIND While on CONSUMER: Mar 14 16:13:15 ldap1 slapd[3672]: @(#) $OpenLDAP: slapd (Ubuntu) (Sep 15 2015 18:19:13) $#012#011buildd@lgw01-53 :/build/openldap-2QUgtL/openldap-2.4.31/debian/build/servers/slapd Mar 14 16:13:16 ldap1 slapd[3673]: slapd starting Mar 14 16:13:16 ldap1 slapd[3673]: do_syncrepl: rid=317 rc -1 retrying Mar 14 16:13:16 ldap1 sudo: pam_unix(sudo:session): session closed for user root Mar 14 16:13:23 ldap1 slapd[3673]: conn=1000 fd=13 ACCEPT from IP= 10.10.5.3:15197 (IP=0.0.0.0:389) Mar 14 16:13:23 ldap1 slapd[3673]: conn=1000 fd=13 closed (connection lost) I *CAN* to TLS from consumer to master: 0-16:18 djh@ldap1 ~$ *ldapsearch -LLL -x -ZZ -H ldap://ldap0.mtv.**qxxxxxxxxd.com uid=djh cn* dn: uid=djh,ou=People,dc=qxxxxxxxxd,dc=com cn: djh So, I increase olcLogLevel to add sync: Mar 14 16:22:09 ldap1 slapd[4133]: @(#) $OpenLDAP: slapd (Ubuntu) (Sep 15 2015 18:19:13) $#012#011buildd@lgw01-53 :/build/openldap-2QUgtL/openldap-2.4.31/debian/build/servers/slapd Mar 14 16:22:10 ldap1 slapd[4134]: slapd starting Mar 14 16:22:10 ldap1 sudo: pam_unix(sudo:session): session closed for user root Mar 14 16:22:10 ldap1 slapd[4134]: do_syncrep2: rid=317 cookie=rid=317,csn=20160314224255.836334Z#000000#000#000000 Mar 14 16:22:10 ldap1 slapd[4134]: slap_queue_csn: queing 0x7f0c5c114995 20160314224255.836334Z#000000#000#000000 Mar 14 16:22:10 ldap1 slapd[4134]: slap_graduate_commit_csn: removing 0x7f0c5c114d10 20160314224255.836334Z#000000#000#000000 Mar 14 16:22:10 ldap1 slapd[4134]: do_syncrepl: rid=317 rc -1 retrying THAT is the contextCSN on the provider! 0-16:24 djh@ldap0 ~$ *ldapsearch -z1 -LLLQY EXTERNAL -H ldapi:/// -s base -b dc=qxxxxxxxxd,dc=com contextCSN # provider* dn: dc=qxxxxxxxxd,dc=com contextCSN: 20160314224255.836334Z#000000#000#000000 0-16:22 djh@ldap1 ~$ *ldapsearch -z1 -LLLQY EXTERNAL -H ldapi:/// -s base -b dc=qxxxxxxxxd,dc=com contextCSN # consumer* dn: dc=qxxxxxxxxd,dc=com contextCSN: 20160314224152.708568Z#000000#000#000000 As best I can tell, the connection works, the replication works, but the consumer is not asking for TLS. 0-16:29 djh@ldap1 ~$ *sudo ldapsearch -Q -Y EXTERNAL -H ldapi:/// -LLL -b cn=config olcDatabase={1}hdb olcSyncRepldn: olcDatabase={1}hdb,cn=config* olcSyncrepl: {0}rid=317 provider=ldap://ldap0.mtv.qxxxxxxxxd.com bindmethod=si mple binddn="cn=admin,dc=qxxxxxxxxd,dc=com" credentials=secret searchbase ="dc=qxxxxxxxxd,dc=com" logbase="cn=accesslog" logfilter="(&(objectClass=audi tWriteObject)(reqResult=0))" schemachecking=on type=refreshAndPersist retry=" 60 +" syncdata=accesslogstarttls=critical tls_reqcert=demand If I rip out starttls=critical tls_reqcert=demand then sync works no problem. If I enable logging on the PROVIDER I see: Mar 14 16:35:46 ldap0 slapd[6838]: @(#) $OpenLDAP: slapd (Ubuntu) (Sep 15 2015 18:19:13) $#012#011buildd@lgw01-53 :/build/openldap-2QUgtL/openldap-2.4.31/debian/build/servers/slapd Mar 14 16:35:46 ldap0 slapd[6839]: slapd starting Mar 14 16:35:46 ldap0 sudo: pam_unix(sudo:session): session closed for user root Mar 14 16:35:49 ldap0 slapd[6839]: conn=1000 fd=27 ACCEPT from IP= 10.10.5.3:17876 (IP=0.0.0.0:389) Mar 14 16:35:49 ldap0 slapd[6839]: conn=1000 fd=27 closed (connection lost) Mar 14 16:35:55 ldap0 slapd[6839]: conn=1001 fd=27 ACCEPT from IP= 10.10.3.117:60312 (IP=0.0.0.0:389) Mar 14 16:35:55 ldap0 slapd[6839]: conn=1001 op=0 BIND dn="cn=admin,dc= *qxxxxxxxxd*,dc=com" method=128 Mar 14 16:35:55 ldap0 slapd[6839]: conn=1001 op=0 BIND dn="cn=admin,dc= *qxxxxxxxxd*,dc=com" mech=SIMPLE ssf=0 Mar 14 16:35:55 ldap0 slapd[6839]: conn=1001 op=0 RESULT tag=97 err=0 text= Mar 14 16:35:55 ldap0 slapd[6839]: conn=1001 op=1 SRCH base="cn=accesslog" scope=2 deref=0 filter="(&(objectClass=auditWriteObject)(reqResult=0))" Mar 14 16:35:55 ldap0 slapd[6839]: conn=1001 op=1 SRCH attr=targetDN changeType changes newRDN deleteOldRDN newSuperior entryCSN Mar 14 16:35:55 ldap0 slapd[6839]: Entry reqStart=20160314224152.000005Z,cn=accesslog CSN 20160314224152.708568Z#000000#000#000000 older or equal to ctx 20160314224152.708568Z#000000#000#000000 Mar 14 16:35:55 ldap0 slapd[6839]: syncprov_search_response: cookie=rid=317,csn=20160314224255.836334Z#000000#000#000000 Mar 14 16:35:55 ldap0 slapd[6839]: conn=1001 op=2 UNBIND Mar 14 16:35:55 ldap0 slapd[6839]: conn=1001 fd=27 closed So .......... it looks like ... sync works until it doesn't because ... we're not binding consumer to provider TLS because .. ? WAIT A GOSH DARN SECOND HERE .... 0-16:41 djh@ldap1 ~$ *sudo ldapsearch -Q -Y EXTERNAL -H ldapi:/// -LLL -b cn=config olcDatabase={1}hdb olcSyncRepldn: olcDatabase={1}hdb,cn=config* olcSyncrepl: {0}rid=317 provider=ldap://ldap0.mtv.qxxxxxxxxd.com bindmethod=si mple binddn="cn=admin,dc=qxxxxxxxxd,dc=com" credentials=secret searchbase ="dc=qxxxxxxxxd,dc=com" logbase="cn=accesslog" logfilter="(&(objectClass=audi tWriteObject)(reqResult=0))" schemachecking=on type=refreshAndPersist retry=" 60 +" *syncdata=accesslogstarttls=critical* tls_reqcert=demand Yeah ... 0-16:43 djh@ldap1 ~$ *cat consumer_sync_tls.ldif* dn: olcDatabase={1}hdb,cn=config replace: olcSyncRepl olcSyncRepl: rid=317 provider=ldap://ldap0.mtv.qxxxxxxxxd.com bindmethod=simple binddn="cn=admin,dc=qxxxxxxxxd,dc=com" credentials=secret searchbase="dc=qxxxxxxxxd,dc=com" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" schemachecking=on type=refreshAndPersist retry="60 +" syncdata=accesslog starttls=critical tls_reqcert=demand 0-16:43 djh@ldap1 ~$ *sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f consumer_sync_tls.ldifSASL/EXTERNAL authentication started* SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "olcDatabase={1}hdb,cn=config" No errors ... **edit consumer_sync_tls.ldif, add a space to the end of the line ending in syncdata=accesslog** 0-16:45 djh@ldap1 ~$ *sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f consumer_sync_tls.ldifSASL/EXTERNAL authentication started* SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "olcDatabase={1}hdb,cn=config" Same result, no errors, aaand: 0-16:46 djh@ldap1 ~$ *ldapsearch -z1 -LLLQY EXTERNAL -H ldapi:/// -s base -b dc=**qxxxxxxxxd,dc=com contextCSN # consumer* dn: dc=qxxxxxxxxd,dc=com contextCSN: 20160314224255.836334Z#000000#000#000000 Well, I just paid some dues. I want to add olcLogLevel config perhaps? Would that have helped me here? Thanks ... -danny -- http://dannyman.toldme.com

1 0

Re: olcAccess/olcLimits modifications
by PenguinWhispererThe . 15 Mar '16

15 Mar '16

I tried exactly that notation however that replaced the whole entry (so only one index left). I only wanted to replace the 12th index. On Mar 14, 2016 15:12, "Cole" <cole(a)opteqint.net> wrote: > Hi, > Yes, it should be possible, so from your first example: > > dn: olcDatabase={2}mdb,cn=config > changetype:modify > add: olcAccess > olcAccess: {0}full accessrule > > > Change that to: > > dn: olcDatabase={2}mdb,cn=config > changetype:modify > replace: olcAccess > olcAccess: {0}full accessrule > > > Notice the use of "replace" instead of "add". > > Regards > /Cole > > On 14 March 2016 at 15:01, PenguinWhispererThe . < > th3penguinwhisperer(a)gmail.com> wrote: > >> I was successfully able to modify the olcLimits and olcAccess. >> >> What I still wonder if it's possible to just replace one index. I've >> tried but all the indexes got removed and replaced with the one I put. >> >> >> Thanks in advance! >> >> 2016-03-11 16:27 GMT+01:00 Cole <cole(a)opteqint.net>: >> >>> Hi, >>> >>> That is correct. Also if you leave out the {#} entry, the value will be >>> added at the end of any current values. >>> >>> I learnt most of these details from the zytrax book on openldap, as it >>> contained non-trivial examples. This section: >>> http://www.zytrax.com/books/ldap/ch6/slapd-config.html#use-security >>> describes the {} functionality. >>> >>> Regards >>> /Cole >>> >>> On 10 March 2016 at 22:56, PenguinWhispererThe . < >>> th3penguinwhisperer(a)gmail.com> wrote: >>> >>>> > That's completely missing the point of these ordering prefixes. >>>> I honestly don't see a lot of mentioning about this except for replace >>>> and deletes. Maybe it was my use of keywords. >>>> >>>> I did some tries but I failed. I couldn't find any clear examples on >>>> doing what I wanted. I mostly saw add/replace options but without the {} >>>> ordering. I'm very new to this. >>>> >>>> I'll try again tomorrow. >>>> >>>> So from the IETF I understand I should be using something like this to >>>> insert a row at the beginning: >>>> >>>> dn: olcDatabase={2}mdb,cn=config >>>> changetype:modify >>>> add: olcAccess >>>> olcAccess: {0}full accessrule >>>> >>>> >>>> Thanks for your responses! Greatly appreciated! >>>> >>>> >>>> <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> 0 >>>> viruses found. www.avast.com >>>> <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> >>>> <#1102690717_582214293_-541461954_-448044489_DDB4FAA8-2DD7-40BB-A1B8-4E2AA1F9FDF2> >>>> >>>> 2016-03-10 18:39 GMT+01:00 Ryan Tandy <ryan(a)nardis.ca>: >>>> >>>>> On Thu, Mar 10, 2016 at 05:18:01PM +0100, PenguinWhispererThe . wrote: >>>>> >>>>>> I've been looking for examples for inserting in between but couldn't >>>>>> find >>>>>> any. Maybe I use the wrong keywords in our favorite search engine. >>>>>> >>>>>> Is this deleting and adding or replacing the way to go to make these >>>>>> changes? >>>>>> Are there alternatives? >>>>>> >>>>> >>>>> You can add a new entry with the index {n} specified. Existing entries >>>>> will be re-numbered (their index incremented) to make room. >>>>> >>>> >>>> >>> >> >

3 2

After power reset, LMDB sub-DBs' key-pairs are missing
by Arto Bendiken 14 Mar '16

14 Mar '16

Here's a curious case that I had not encountered with LMDB as yet previously: 1. There was a power reset of a virtual machine with an active LMDB writer process (standalone use, not OpenLDAP) on an LMDB file containing three sub-DBs. 2. After rebooting, the previously-populated LMDB file (~7 GB in size) appears mostly empty, including when examined with mdb_stat or mdb_dump. Mostly empty meaning that each of three sub-DBs now has only one K/V entry, instead of 7M+ as they used to. In addition, the main DB now indicates six entries instead of the expected three (for the sub-DBs). 3. mdb_copy (with or without -c) does not remedy the situation, producing a mostly (logically) empty database. This is with LMDB release 0.9.18 running on Ubuntu 14.04.4 (kernel 3.13.0-79-generic) on an ext4 partition (noatime,nodev,nosuid,noexec) on Intel SSD storage in SW RAID-1 configuration. As mentioned, the LMDB file had three sub-DBs, each with 7M+ entries (as of last backup). No new sub-DBs are created after the database is initially initialized. After initial creation, these three sub-DBs only ever get appended to with new key/value pairs, no code ever deletes or modifies key/value pairs in them. The writer code inserts new entries one at a time, commits the LMDB transaction, and syncs to disk. I've enclosed mdb_stat output from before/after (before being from a backup, after which numerous more writes had been done). I've also included mdb_dump output of the main DB and three sub-DBs. The mdb_dump output for the sub-DBs indicates that they each now contain only a single entry (instead of 7M+), that entry being in each case the first key/value pair that was ever inserted into that sub-DB (ages ago). The mdb_dump output for the main DB is baffling--instead of the three expected entries, or the six that mdb_stat indicates after the reboot, the output includes a multitude of entries--some 2,590. (I've omitted most of them in the attached, but can provide a copy privately.) What are my options for recovering an LMDB database in this state, to the extent possible? Has anyone else experienced a similar scenario? Thanks, Arto -- Arto Bendiken | @bendiken | http://ar.to

2 4

How to find master server in dual master replica setup
by Kartik Vashishta 14 Mar '16

14 Mar '16

Hi, I followed this: http://www.server-world.info/en/note?os=CentOS_7&p=openldap&f=6 to set up Master-Master replica's. Now the ldif files in the tmp directory are gone and I need to figure out which one was the Master in the replica setup. I only have access to the replicated master server. I need to know the hostname of the "main" master server. Thanks in advance. Regards, Kartik Vashishta

1 0

Why is MDB_USE_PWRITEV disabled by default?
by Bryan Matsuo 13 Mar '16

13 Mar '16

I have tried to find information on the internet about the flag MDB_USE_PWRITEV but haven't had much luck. I was a little surprised to find that the pwritev() system call is never used by default (in liblmdb or openldap itself AFAICT). Because a naive analysis would suggest that pwritev() is always better than the alternative. The Makefile for liblmdb suggests that the defaults for flags should be correct for most platforms. So I am just left wondering why the default on all systems is to avoid pwritev(). Can anyone provide some insight on this matter for me? I maintain some bindings for the Go language and it has been asked that this flag be applied to all Linux builds by default. I am trying to make the most appropriate decision for general use of the library. Thanks, - Bryan

1 0

Enable memberof in static mode configuration
by Elias Pereira 12 Mar '16

12 Mar '16

Hello guys, In all searches that I did, I found only how to make in the dynamic configuration (cn=config). How do I enable the attribute in the old way (slapd.conf)? -- Elias Pereira

2 1

olcAccess/olcLimits modifications
by PenguinWhispererThe . 11 Mar '16

11 Mar '16

Good day to all, I'm currently looking into openldap and want to do some changes on an existing openldap directory. I've been able to apply my changes using delete and add in an ldif. For example: 10 olcLimits rules. Mine needs to be placed before the last olcLimit. - Delete current last line (with {10} specificier) - Add wanted line - Add previously deleted line This results in the intended config. However this looks like a hassle to me. For example in the case I had to insert on the 5th line I would have to delete 5 lines first, then add the line I want and then again add those 5 lines. Or I should use replace for replacing the whole list (what's the correct terminology for a list with {0}, {1}, ... ?). I need to copy paste all that data over to just add 1 new line(in case of olcLimits and olcAccess). I've been looking for examples for inserting in between but couldn't find any. Maybe I use the wrong keywords in our favorite search engine. Is this deleting and adding or replacing the way to go to make these changes? Are there alternatives? Thanks in advance for your responses. <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> 0 viruses found. www.avast.com <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> <#DDB4FAA8-2DD7-40BB-A1B8-4E2AA1F9FDF2>

4 4

[ LMBD ] Performance degradation
by nicolas prochazka 11 Mar '16

11 Mar '16

Hello, we are using lmbd in our product as database backend to save big key value ( 16K ) . First at all, lmbd is the best database in performance comparaison ( read / write) that we have tested. My question : # Databases data_dir:/data/cache/data lmdb version:LMDB 0.9.16: (August 14, 2015) db page size:4096 b-tree depath:4 branch pages:527 leaf pages:29287 overflow oages:6659875 data items:1331990 We have a lot of leaf pages, this is due to our big value size. When the database is empty, write and read are very fast, but when we delete all keys or a big part of keys, write and read (new keys) becomes very poor in performance ( / 100 ) . Is it a normal due to our big values ? The only solution we have found is to destroy database file rather than deleting keys Regards, Nicolas Prochazka

2 2

Collaborative work of MirrorMode replication and LDAP Sync Replication
by Andrei Valoshyn 10 Mar '16

10 Mar '16

Hello! slapd.conf configuration used *1.* I have test LDAP master and a consumer with LDAP Sync Replication type: Master: / overlay syncprov// // syncprov-checkpoint 100 10// // syncprov-sessionlog 100 /Consumer: syncrepl rid=115 provider=ldaps://master \ type=refreshOnly \ interval=00:00:00:30 \ scope=sub \ schemachecking=off \ searchbase="dc=exadel,dc=com" \ bindmethod=simple \ binddn="dc=exadel,dc=com" \ credentials=password \ retry="60 10 300 10" Sync is work. *2.* After that I have switched to MirrorMode replication via reconfiguring Master and Consumer: Master1(Master): /serverID 1/ / overlay syncprov// // syncprov-checkpoint 100 10// // syncprov-sessionlog 100 / / syncrepl rid=001 provider=ldaps://Master2 \// // bindmethod=simple \// // interval=00:00:00:30 \// // scope=sub \// // binddn="dc=exadel,dc=com" \// // credentials=password \// // searchbase="dc=exadel,dc=com" \// // schemachecking=off \// // type=refreshOnly \// // retry="60 +"// // // mirrormode on// / Master2(Consumer): /serverID 2/ / overlay syncprov// // syncprov-checkpoint 100 10// // syncprov-sessionlog 100 / / syncrepl rid=002 provider=ldaps://Master1 \// // bindmethod=simple \// // interval=00:00:00:30 \// // scope=sub \// // binddn="dc=exadel,dc=com" \// // credentials=password \// // searchbase="dc=exadel,dc=com" \// // schemachecking=off \// // type=refreshOnly \// // retry="60 +"// // // mirrormode on// / In this case SYNC is work(between Master1 -> Master2(NOT in Master2) -> Master1 direction) and other consumer pointed to Master1 or Master2) *3.* For fun I change configuration on Master1(Master) to previous state(Case 1) Master1: / overlay syncprov// // syncprov-checkpoint 100 10// // syncprov-sessionlog 100 / /Master2(Consumer): /serverID 2/ / overlay syncprov// // syncprov-checkpoint 100 10// // syncprov-sessionlog 100 / / syncrepl rid=002 provider=ldaps://Master1 \// // bindmethod=simple \// // interval=00:00:00:30 \// // scope=sub \// // binddn="dc=exadel,dc=com" \// // credentials=password \// // searchbase="dc=exadel,dc=com" \// // schemachecking=off \// // type=refreshOnly \// // retry="60 +"// // // mirrormode on// //In this case we have the same situation with SYNC as in CASE 2 - all work fine. Is it good working SYNC schema? What chance of breaking down db on Master1 I have? -- With Best Wishes Andrei Valoshyn Exadel Inc. System Administrator avaloshyn(a)exadel.com -- CONFIDENTIALITY NOTICE: This email and files attached to it are confidential. If you are not the intended recipient you are hereby notified that using, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error please notify the sender and delete this email.

2 4

SASL2 and Openldap
by Jerry 10 Mar '16

10 Mar '16

I just started creating a new server with FreeBSD 11. I installed the openldap port. Now I am trying to figure out how to get sasl2 up and running. Openldap is running fine now without it, but I want to secure it further. Can anyone suggest a good "How to" on how to accomplish this on a FreeBSD OS (if that makes any difference). Examples are welcomed :) -- Jerry

3 4

Re: Antw: delta sync and strictrefresh
by Quanah Gibson-Mount 10 Mar '16

10 Mar '16

--On Thursday, March 10, 2016 8:27 AM +0100 Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de> wrote: >>>> Quanah Gibson-Mount <quanah(a)zimbra.com> schrieb am 10.03.2016 um 04:49 >>>> in > Nachricht <07CEB0B0E429A934BA46C978(a)[192.168.1.9]>: >> --On Wednesday, March 09, 2016 8:46 AM +0100 Ulrich Windl >> <Ulrich.Windl(a)rz.uni-regensburg.de> wrote: >>>> >>>> Sometimes it happen the consumer go out of sync. Convenient solution: >>> >>> What you describe is not a database out of sync, but a corrupted >>> database. You never have to delete a database that is out of sync; >>> you'll just have to refresh it, and that should be automatic if >>> configured and working correctly >> >> Except, as is often the case, you're generally wrong. Unfortunately, >> every > > You like being personal and inpolite? I really missed that! ;-) Generally, no, but unfortunately your answers to people's questions fall more on the incorrect side of things than the correct side of things, causing confusion and other problems. I appreciate that you want to participate and be helpful, but giving out advice that is wrong is not helpful at all. --Quanah -- Quanah Gibson-Mount Platform Architect Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration A division of Synacor, Inc

1 0

Experience with LDAP monitoring (cn=monitor)
by Ulrich Windl 10 Mar '16

10 Mar '16

Hi! I'd like to inform you about my experience with LDAP monitoring using the cn=monitor DN to query openLDAP. I wrote a NRPE-plugin used from Nagios/Centreon to gather performance data. So my experience is this: Issues with LDAP Monitoring "Uptime" is in whole seconds only (minor issue). SNMP uptime has a finer resolution (but limited range, unfortunately). Detailed data per peer can only be retrieved through the "Connections", but that's a moment's view only: So if a client opens a connection, does a few operations, then closes the connection, a polling client of the monitor will never see those client operations. Also when needing a cumulative count of operations per peer (or just the number of connections per peer (for a rate)), a monitor client will have to accumulate the numbers from all peer connections. If a connection (with significant operations being done) was closed since the last poll, the total number will look negative. So the monitor client will have to store accumulated numbers for closed connections per peer also (Keeping numbers for all closed connections seems inefficient). "Current Connections" is returned as monitor _counter_ object (monitorCounter), where in fact it's of type "gauge", opposed to "Total Connections" (which is also returned as monitor counter) which is actually a counter. This makes the code harder than necessary. What I'm missing are some database (BDB/HDB) runtime statistics. Ok, I'll attach four PNG graphs to let you see how far I got. Regards, Ulrich

4 4

log_rdns.patch
by A. Schulze 10 Mar '16

10 Mar '16

Hi again, this is my third and last patch I send today :-) I compiled openldap with '--enable-rlookups' and set 'reverse-lookup on' in slapd.conf I like to see the remote hostname logged. That didn't work somehow. ( I wrote this patch months ago and could not describe the real problem anymore) Anyway: the patch modify log output: reverse-lookup off: conn=4846 fd=42 ACCEPT from IP=127.0.0.1:46058 (IP=127.0.0.1:389) reverse-lookup on: conn=4191 fd=18 ACCEPT from localhost (IP=127.0.0.1:389) I never tested with ldapi:// connections. Also I expect the patch is not optimal for performance. But it works here in a small environment. Andreas

6 9

delta sync and strictrefresh
by A. Schulze 10 Mar '16

10 Mar '16

Hello, I'm a longtime openldap and syncreplica user. Now I learned about delta replication and the option "strictrefresh". But it doesn't work as promised. Maybe my expectation is simply wrong... Let's describe my use case: One ore two provider serve data to numerous consumer. Application running on the consumer host are configured to query the local consumer first and fall back to the provider. A typical LDAP-URI looks like "ldap://localhost ldaps://provider1 ldaps://provider2" Application only /read/ data. Sometimes it happen the consumer go out of sync. Convenient solution: delete the consumer ldap database and restart slapd. Now it take some time to fetch the whole data from provider to consumer server. Just in this time frame the application may query ldap://localhost and get an answer which is simply wrong because the data transfer is still in progress. That's what I want to avoid. Is that possible with openldap at all Thanks, Andreas

4 4

Patch: CIPHER_SERVER_PREFERENCE
by A. Schulze 09 Mar '16

09 Mar '16

Hello, The patch implement a feature similar to http://www.postfix.org/postconf.5.html#tls_preempt_cipherlist Not perfect, not configurable but works here without problems. Andreas

2 1

man page patches
by A. Schulze 09 Mar '16

09 Mar '16

Hello, here is my second patch set. They modify mostly man pages and spelling errors found by Debian lintain ( https://packages.debian.org/jessie/lintian) Andreas

2 1

Re: DB_LOG_AUTOREMOVE fails to suppress the log files
by jupiter 09 Mar '16

09 Mar '16

Thanks Quanah, you are right, the solution is to switch to mdb. Thank you very much. - jupiter On Tue, Mar 8, 2016 at 7:36 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Monday, March 07, 2016 9:35 PM +1100 jupiter <jupiter.hce(a)gmail.com> > wrote: > > The logsize is set to 10 MB, it creates a 10 MB log file every 2 - 3 >> minutes (it grows so fast, like the movie "Evolution" :-)), I ran the >> db_archive -d 10 hours ago when the disk was full, and I have run the >> db_archive -d now as the disk is full again despite the server is not too >> busy. Why doesn't the slapd do it automatically? Apart that issue, the >> ldap is running very well. I really want to figure out what is going on, >> but if I cannot find a solution, I have no choice but run a cron job to >> call db_archive -d every 8 hours. I guess that should not cause ldap any >> side effect, right? >> > > The real solution, again, is to dump the broken RH build and switch to > MDB. Then there will no longer be any pointless log files created, and your > system will be both more secure and faster (and take a smaller footprint). > > > --Quanah > > > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > A division of Synacor, Inc >

1 0

Returned mail: see transcript for details
by dieter＠dkluenter.de 08 Mar '16

08 Mar '16

Message could not be delivered

1 0

No "known good" password found for the user. Not setting Auth-Type
by MichaelLeung 08 Mar '16

08 Mar '16

hi list i was trying to deploy freeradius + openldap ,and got warning like this (0) ldap : Processing user attributes (0) WARNING: ldap : No "known good" password added. Ensure the admin user has permission to read the password attribute (0) WARNING: ldap : PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) rlm_ldap (ldap): Released connection (4) (0) [ldap] = ok (0) [expiration] = noop (0) [logintime] = noop (0) WARNING: pap : No "known good" password found for the user. Not setting Auth-Type (0) WARNING: pap : Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject the ldap account i added to radius configuration file was not the LDAP Manager account , but when i change the account to LDAP Manager user , the warning would not be shown again , and the pass authentication challenge. how can i authorize a normal ldap account can read userPassword attribute , then i can add the account to those system which need LDAP .

1 0

DB_LOG_AUTOREMOVE fails to suppress the log files
by jupiter 07 Mar '16

07 Mar '16

Hi, I am running openldap servers 2.4.40 with bdb on CentOS 6, it creates 10 MB log file in every 2 - 3 minutes, no surprisingly, it fills up the disk quickly. To fix the issue, I added following statement to DB_CONFIG, restarted splapd, but it does not seem work, the log files are still glowing and creating. Could anyone help please why the DB_LOG_AUTOREMOVE is unable to stop log files? Sorry for posting it to different lists as we are not be able to run the ldap server when it fills up the disk so quickly. set_flags DB_LOG_AUTOREMOVE Thanks for your helps. Kind regards,

3 7

storing HA1 password hash for HTTP DIGEST, SIP, TURN
by Daniel Pocock 07 Mar '16

07 Mar '16

Hi all, There are a few protocols that use a HA1[1] password hash, such as HTTP DIGEST[1], SIP DIGEST[2] and TURN[3] (which uses HMAC rather than DIGEST) Is there a standard LDAP attribute name for storing a HA1 value or should it be stored in a regular userPassword attribute as described in the manual[4]? I came across smbk5pwd for keeping SMB password attributes in sync. Is there a similar facility for keeping HA1 passwords in sync when a user changes the password or how could a developer go about adding that, would the smbk5pwd source be a useful model? Regards, Daniel 1. http://tools.ietf.org/html/rfc2617#section-3 2. https://tools.ietf.org/html/rfc3261#section-22.4 3. https://tools.ietf.org/html/rfc5389#section-15.4 4. http://www.openldap.org/doc/admin24/security.html#Password%20Storage

3 5

rewrite overlay to combine multiple OUs
by Nick Couchman 06 Mar '16

06 Mar '16

Well, I have a situation (a particular application, actually), that is so arcane in its configuration that it requires that all of the users for the application be in the same OU. So, the config for the app is something like: CN=%USERNAME%,ou=Users,dc=example,dc=com So, the application substitutes in the %USERNAME% value with the actual username, and then does a bind with the supplied password. My tree is a little more complicated than that - another dc level or two and several different ou=People places - something like this: ou=People,dc=engineering,dc=example,dc=com ou=People,dc=administration,dc=example,dc=com ou=People,dc=operations,dc=example,dc=com etc. with all of the users located under the ou=People branches of the tree. What I'm hoping is that there's some way that I can virtually combine the ou=People locations in my LDAP tree such that, when the application requests cn=Nick,ou=users,dc=example,dc=com, it goes out and searches through either the entire dc=example,dc=com tree or goes through and looks at each of the ou=People locations until it finds it and transparently redirects, allowing this application to function correctly in its stupid configuration, but without me having to create a bunch of aliases in a single location in my tree, or, worse, actually reorganize my tree. I'm thinking there's probably a way to do this with the rewriteRule and some regular expressions, but I can't find quite the combination of rules/expressions to accomplish this. Any ideas? Or am I stuck making aliases? Thanks, Nick == This e-mail may contain SEAKR Engineering (SEAKR) Confidential and Proprietary Information. If this message is not intended for you, you are strictly prohibited from using this message, its contents or attachments in any way. If you have received this message in error, please delete the message from your mailbox. This e-mail may contain export-controlled material and should be handled accordingly.

2 4

Replication of local entries with translucent overlay
by Igor 04 Mar '16

04 Mar '16

Hello, I have an openLDAP proxy server which uses the translucent overlay to supplement Active Directory records with additional attributes. I wanted to set up replication for my translucent entries (specifically, push-based provider/consumer scheme, refreshAndPersist mode). Since slapo-translucent turns off maintenance of the entryCSN and entryUUID attributes (turns off the lastmod option in the translucent_db_init function), it cannot be used with slapo-syncprov (which requires entryCSN and entryUUID attributes). I understand that to make these two overlays work together in all scenarios may not be trivial. However, for my specific scenario, it seems to be enough to just comment out that line which turns off lastmod: ============== --- servers/slapd/overlays/translucent.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/servers/slapd/overlays/translucent.c b/servers/slapd/overlays/translucent.c index 48cca49..45b45a0 100644 --- a/servers/slapd/overlays/translucent.c +++ b/servers/slapd/overlays/translucent.c @@ -1282,7 +1282,7 @@ static int translucent_db_init(BackendDB *be, ConfigReply *cr) { return 1; } SLAP_DBFLAGS(be) |= SLAP_DBFLAG_NO_SCHEMA_CHECK; - SLAP_DBFLAGS(be) |= SLAP_DBFLAG_NOLASTMOD; +// SLAP_DBFLAGS(be) |= SLAP_DBFLAG_NOLASTMOD; return 0; } -- 1.7.1 ============== Everything replicates correctly after that. I don't expect anyone to scour the openLDAP code to come up with an exhaustive list of potential bugs that may arise because of this. I assume the risks that come with such a solution. Having said that, can anyone think of any issues with commenting that line in translucent_db_init, and setting entryCSN, entryUUID, contextCSN attributes to be searched in local glue records only (via olcTranslucentLocal)? Thanks, -Igor

2 1

Users with multiple passwords?
by dev 03 Mar '16

03 Mar '16

Hello All, I have OpenLDAP (2.4.31-1+nmu2ubuntu8.2) setup to authenticate users on our LAN with ActiveDirectory using SASL passthrough. I want to give some of these users access to VPN (OpenVPN) services (auth with the same OpenLDAP server above) however I want to give them an {SHA1} password to access the VPN. I've created another OU (OU=vpnuser) and simply duplicated the entire user entry into it. I have the VPN server using a searchbase of "OU=vpnuser.." and things are working as I want... sort of.. Some software on the LAN finds two users in ldap now so I explicitly exclude OU=vpnuser from searchbases (!OU=vpnuser). ugh.. Is there a better way to accomplish what I am trying to do? Give the same user two different passwords in the ldap tree? Thanks

2 1

Re: ldapmodify hangs, slapd appears to be looping
by Quanah Gibson-Mount 03 Mar '16

03 Mar '16

If you're artificially stuck using RH's builds, then you'll need to contact them for support. --Quanah --On Thursday, March 03, 2016 3:42 PM +0000 "Heinemann, Peter" <phei(a)isc.upenn.edu> wrote: > True, but unfortunately recommended practice collides with (artificial) > standards.... > > ________________________________________ > From: Quanah Gibson-Mount <quanah(a)zimbra.com> > Sent: Thursday, March 3, 2016 10:37 AM > To: Heinemann, Peter; openldap-technical(a)openldap.org > Subject: Re: ldapmodify hangs, slapd appears to be looping > > --On Thursday, March 03, 2016 3:23 PM +0000 "Heinemann, Peter" > <phei(a)isc.upenn.edu> wrote: > >> >> >> >> >> Openldap 2.4.40-6.el6_7 > > As has been repeatedly mentioned on the list, please don't use RH's > OpenLDAP builds. Please do use a current release. You may wish to look > into using a build from the LTB project or Symas. > > <http://ltb-project.org/wiki/download#openldap> > <https://symas.com/products/openldap-directory/> > > There were some known issues with mdb in 2.4.40 and 2.4.41 you may be > triggering here. > > --Quanah > > > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > A division of Synacor, Inc -- Quanah Gibson-Mount Platform Architect Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration A division of Synacor, Inc

1 0

ldapmodify hangs, slapd appears to be looping
by Heinemann, Peter 03 Mar '16

03 Mar '16

Openldap 2.4.40-6.el6_7 RHEL 6.7 mdb backend ldapmodify is hanging; the hang first evidenced itself in a bulk update. The hang occurs even for a simple update -- with debug set to 1 on the ldapmodify statement (using interactive mode) the block of output listed at below repeats endlessly with no change to the values displayed. The slapd audit log shows no update for the intended record. The problem started after I added a significant amount of data; not new structural objects (OUs) but many entries under them. Have I reached some sort of threshold? I have: - stopped/started slapd; - run a full slapcat and slapadd to a new database I am running the monitor database; would there be data of value there about this condition? mdb_stats output: sudo mdb_stat -ef /etc/openldap/openldap-data Environment Info Map address: (nil) Map size: 8589934592 Page size: 4096 Max pages: 2097152 Number of pages used: 618975 Last transaction ID: 3647 Max readers: 126 Number of readers used: 0 Freelist Status Tree depth: 1 Branch pages: 0 Leaf pages: 1 Overflow pages: 11 Entries: 7 Free pages: 5233 Status of Main DB Tree depth: 1 Branch pages: 0 Leaf pages: 1 Overflow pages: 0 Entries: 16 debug output from ldapmodify: ** ld 0x1ed4e30 Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ld 0x1ed4e30 request count 1 (abandoned 0) ** ld 0x1ed4e30 Response Queue: Empty ld 0x1ed4e30 response count 0 ldap_chkResponseList ld 0x1ed4e30 msgid 2 all 1 ldap_chkResponseList returns ld 0x1ed4e30 NULL ldap_int_select ldap_result ld 0x1ed4e30 msgid 2 wait4msg ld 0x1ed4e30 msgid 2 (timeout 100000 usec) wait4msg continue ld 0x1ed4e30 msgid 2 all 1 ** ld 0x1ed4e30 Connections: * host: localhost port: 389 (default) refcnt: 2 status: Connected last used: Thu Mar 3 10:04:05 2016 ** ld 0x1ed4e30 Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ld 0x1ed4e30 request count 1 (abandoned 0) ** ld 0x1ed4e30 Response Queue: Empty ld 0x1ed4e30 response count 0 ldap_chkResponseList ld 0x1ed4e30 msgid 2 all 1 ldap_chkResponseList returns ld 0x1ed4e30 NULL ldap_int_select ldap_result ld 0x1ed4e30 msgid 2 wait4msg ld 0x1ed4e30 msgid 2 (timeout 100000 usec) wait4msg continue ld 0x1ed4e30 msgid 2 all 1 ** ld 0x1ed4e30 Connections: * host: localhost port: 389 (default) refcnt: 2 status: Connected last used: Thu Mar 3 10:04:05 2016 ...etc

2 1

OpenLDAP 2.4x Syncrepl setup
by Ted Hyde (RSI) 03 Mar '16

03 Mar '16

Greets - I'm trying to set up a new slave (consumer) server that would test against an existing (read: legacy) Samba4 AD controller for LDAP auth. The intent is to have the consumers as distributed HA-like setups in the event that VPNs or full off-site network connectivity was lost, users could still authenticate against the local LDAP services. (The application auth is really quite simple in this case, just some php grabbing a bunch of groups, not full AD work). In "ye olde days", I could do this with slapd.conf, but I'm trying to upgrade my own brain-software to understand OLC better, and am hitting a brick wall. I'd really like to just have the following on each consumer server: syncrepl rid=1 provider=ldap://ldap.example.com type=refreshOnly interval=00:00:00:30 searchbase="dc=example,dc=com" filter="(objectClass=*)" attrs="*" scope=sub schemachecking=off bindmethod=simple binddn="cn=root,dc=example,dc=com" credentials=secret updateref ldap://ldap.example.com tailed to the end of what would have been a few more lines describing the db for the consumer, but I've not found anywhere how to describe the above snippet into an ldif file. I ran this snippet (names corrected of course) through slaptest just to see if it could handle a partial, and of course it failed (missing db schema) - but if I add the db schema as a header, it fails because of the existing slapd.d directory. If I delete the slapd.d directory and place this old format into slapd.conf, restarting the service fails with a db import error. Yet, some of my old 2.2 configs run fine on 2.2 but fail on 2.4 The service does run, in that I can plow out an old config, start clean, add sample users by hand etc, so at least it's a working server, it just won't join to an existing one or pull a directory from another place. The 2.4 Admin docs say to add the old schema to the slapd.conf file (as I attempted above), but doesn't explore how to do it with OLC. The goal would be to have consumer slapd's running at my off-sites that act in the refreshOnly mode; push up technology is NOT required. Or wanted, actually. Suggestions welcome! Thanks, Ted.

4 3

O: Oracle/SAP and LDAP connections
by Ulrich Windl 25 Feb '16

25 Feb '16

Hi! I noticed that one of our servers running SAP Solution Manager with Oracle has more than 70 established connections to one of our LDAP servers. According to lsof most connections belong to Oracle processes; each process seems to have its own connection: oracle 8447 oracsm 10u IPv4 16950 0t0 TCP 172.20.16.33:42599->172.20.17.200:ldap oracle 8449 oracsm 10u IPv4 16964 0t0 TCP 172.20.16.33:42699->172.20.17.200:ldap oracle 8451 oracsm 10u IPv4 16979 0t0 TCP 172.20.16.33:42799->172.20.17.200:ldap oracle 8453 oracsm 10u IPv4 16994 0t0 TCP 172.20.16.33:42843->172.20.17.200:ldap oracle 8455 oracsm 10u IPv4 17009 0t0 TCP 172.20.16.33:42899->172.20.17.200:ldap oracle 8457 oracsm 10u IPv4 17024 0t0 TCP 172.20.16.33:42999->172.20.17.200:ldap oracle 8465 oracsm 10u IPv4 17106 0t0 TCP 172.20.16.33:43499->172.20.17.200:ldap oracle 8467 oracsm 10u IPv4 17120 0t0 TCP 172.20.16.33:43532->172.20.17.200:ldap oracle 8469 oracsm 10u IPv4 17122 0t0 TCP 172.20.16.33:43599->172.20.17.200:ldap oracle 8471 oracsm 10u IPv4 17123 0t0 TCP 172.20.16.33:43699->172.20.17.200:ldap oracle 8478 oracsm 10u IPv4 17127 0t0 TCP 172.20.16.33:43899->172.20.17.200:ldap oracle 10172 oracsm 10u IPv4 18911 0t0 TCP 172.20.16.33:45598->172.20.17.200:ldap oracle 10197 oracsm 10u IPv4 18920 0t0 TCP 172.20.16.33:45599->172.20.17.200:ldap CSM_70_BT 10412 csmadm 5u IPv4 1348471 0t0 TCP 172.20.16.33:60332->172.20.17.200:ldap sapstarts 11352 csmadm 8u IPv4 20890 0t0 TCP 172.20.16.33:45799->172.20.17.200:ldap ms.sapCSM 11698 csmadm 6u IPv4 21277 0t0 TCP 172.20.16.33:48199->172.20.17.200:ldap CSM_70_DP 11699 csmadm 5u IPv4 21424 0t0 TCP 172.20.16.33:48299->172.20.17.200:ldap gwrd 11737 csmadm 9u IPv4 21480 0t0 TCP 172.20.16.33:48354->172.20.17.200:ldap icman 11738 csmadm 10u IPv4 23751 0t0 TCP 172.20.16.33:48399->172.20.17.200:ldap CSM_70_DI 11740 csmadm 5u IPv4 23815 0t0 TCP 172.20.16.33:48699->172.20.17.200:ldap CSM_70_DI 11741 csmadm 5u IPv4 23801 0t0 TCP 172.20.16.33:48499->172.20.17.200:ldap CSM_70_DI 11742 csmadm 5u IPv4 23806 0t0 TCP 172.20.16.33:48599->172.20.17.200:ldap CSM_70_DI 11743 csmadm 5u IPv4 23817 0t0 TCP 172.20.16.33:48899->172.20.17.200:ldap CSM_70_DI 11744 csmadm 5u IPv4 23816 0t0 TCP 172.20.16.33:48799->172.20.17.200:ldap CSM_70_DI 11745 csmadm 5u IPv4 19863 0t0 TCP 172.20.16.33:55488->172.20.17.200:ldap CSM_70_DI 11746 csmadm 5u IPv4 19856 0t0 TCP 172.20.16.33:55484->172.20.17.200:ldap CSM_70_DI 11747 csmadm 5u IPv4 19900 0t0 TCP 172.20.16.33:55498->172.20.17.200:ldap CSM_70_DI 11748 csmadm 5u IPv4 19880 0t0 TCP 172.20.16.33:55493->172.20.17.200:ldap CSM_70_DI 11749 csmadm 5u IPv4 19878 0t0 TCP 172.20.16.33:55489->172.20.17.200:ldap CSM_70_UP 11750 csmadm 5u IPv4 19862 0t0 TCP 172.20.16.33:55487->172.20.17.200:ldap CSM_70_EN 11751 csmadm 5u IPv4 19889 0t0 TCP 172.20.16.33:55494->172.20.17.200:ldap CSM_70_SP 11755 csmadm 5u IPv4 23865 0t0 TCP 172.20.16.33:51634->172.20.17.200:ldap CSM_70_UP 11756 csmadm 5u IPv4 19941 0t0 TCP 172.20.16.33:55522->172.20.17.200:ldap oracle 11778 oracsm 7u IPv4 23927 0t0 TCP 172.20.16.33:55477->172.20.17.200:ldap oracle 11780 oracsm 7u IPv4 23943 0t0 TCP 172.20.16.33:55478->172.20.17.200:ldap oracle 11782 oracsm 7u IPv4 23983 0t0 TCP 172.20.16.33:55482->172.20.17.200:ldap oracle 11784 oracsm 7u IPv4 23981 0t0 TCP 172.20.16.33:55479->172.20.17.200:ldap oracle 11786 oracsm 7u IPv4 23984 0t0 TCP 172.20.16.33:55483->172.20.17.200:ldap oracle 11792 oracsm 7u IPv4 19879 0t0 TCP 172.20.16.33:55492->172.20.17.200:ldap oracle 11794 oracsm 7u IPv4 19959 0t0 TCP 172.20.16.33:55524->172.20.17.200:ldap oracle 11797 oracsm 7u IPv4 24100 0t0 TCP 172.20.16.33:55538->172.20.17.200:ldap oracle 11800 oracsm 7u IPv4 19990 0t0 TCP 172.20.16.33:55528->172.20.17.200:ldap oracle 11807 oracsm 7u IPv4 20023 0t0 TCP 172.20.16.33:55532->172.20.17.200:ldap oracle 11810 oracsm 7u IPv4 20059 0t0 TCP 172.20.16.33:55533->172.20.17.200:ldap oracle 11813 oracsm 7u IPv4 20062 0t0 TCP 172.20.16.33:55534->172.20.17.200:ldap oracle 11815 oracsm 7u IPv4 20064 0t0 TCP 172.20.16.33:55537->172.20.17.200:ldap oracle 11820 oracsm 7u IPv4 20081 0t0 TCP 172.20.16.33:55539->172.20.17.200:ldap CSM_70_BT 11963 csmadm 5u IPv4 1355947 0t0 TCP 172.20.16.33:61710->172.20.17.200:ldap sapstarts 14502 csmadm 8u IPv4 26768 0t0 TCP 172.20.16.33:57594->172.20.17.200:ldap ms.sapCSM 14870 csmadm 6u IPv4 27174 0t0 TCP 172.20.16.33:57659->172.20.17.200:ldap en.sapCSM 14871 csmadm 9u IPv4 27215 0t0 TCP 172.20.16.33:58272->172.20.17.200:ldap oracle 14882 oracsm 10u IPv4 27217 0t0 TCP 172.20.16.33:58273->172.20.17.200:ldap jlaunch 14890 csmadm 14u IPv4 27282 0t0 TCP 172.20.16.33:58283->172.20.17.200:ldap jlaunch 14891 csmadm 14u IPv4 27688 0t0 TCP 172.20.16.33:58284->172.20.17.200:ldap jlaunch 14892 csmadm 14u IPv4 27678 0t0 TCP 172.20.16.33:58282->172.20.17.200:ldap nscd 15591 root 13u IPv4 28333 0t0 TCP 172.20.16.33:60503->172.20.17.200:ldap CSM_70_BT 31006 csmadm 5u IPv4 1293312 0t0 TCP 172.20.16.33:63365->172.20.17.200:ldap Other machines (running the same OS and SAP also) just have one connection established to an LDAP server. Does anybody know why Oracle uses that many connections, and possibly whether there is a configurable parameter to avoid that many connections. Regards, Ulrich

1 0

LMDB compiler warning
by John GM44 25 Feb '16

25 Feb '16

Hello.. First, thank you for the effort to provide LMDB to the community. I'm compiling LMDB 0.9.17 using msvc2013 x64 and it compiled successfully with only one warning: mdb.c(7224): warning C4333: '>>' : right shift by too large amount, data loss. Is this something I need to correct and if so, how would I go about it please? Thank you, John

3 2

PasswordHash
by Borresen, John - 0444 - MITLL 24 Feb '16

24 Feb '16

All, I found Quanah's response to a post (http://www.openldap.org/lists/openldap-devel/201411/msg00012.html), which brought up a question(s). 1) I have the olcModule pw-sha2.la loaded in "cn=module{0},cn=config" 2) Looking at Quanahs reply, in the link above, he states: now, if you want to make something like say, SHA512 the default, then you need to modify the frontend config db: dn: olcDatabase={-1},cn=config changetype: modify replace: olcPasswordHash olcPasswordHash: {SSHA512} Now, if I add, something like the above, and the current olcRootPW attribute shows {SSHA}, is that going to modify current password hashes or only going forward? I tried the above, on cn=config, but received the following error "According to the schema attribute olcPasswordHash is not allowed" Thanks in advance, John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Email: <mailto:john.borresen@ll.mit.edu> john.borresen(a)ll.mit.edu

2 4

Re: LDIF?
by Quanah Gibson-Mount 24 Feb '16

24 Feb '16

--On Wednesday, February 24, 2016 12:50 AM +0100 Emmanuel Lécharny <elecharny(a)gmail.com> wrote: >> > No to mention there is a missing dc Attribute in the entry. Good point. It's unlikely the author meant to combine the two objectClasses. --Quanah -- Quanah Gibson-Mount Platform Architect Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration A division of Synacor, Inc

2 1

Re: Regarding lmdb
by Howard Chu 24 Feb '16

24 Feb '16

Hor Meng Yoong wrote: > Dear Howard > > Thank you for your great effort in creating lmdb. > > I am looking a solution that can sync multiple lmdb slaves to one lmdb master. > Changes from the each lmdb slave are also updated to other lmdb slaves via the > lmdb master. > > Any up-to-date, up-and-running lmdb slaves can vote among themsleves to become > he next master in the event that the master fails. To prevent islanding and > multiple masters, vote is only allowed if there are at least a minimum numbers > (configurable) of interconnected lmdb slaves. > > To improve efficiency, data protection, a master table inside the lmdb master > decides which lmdb slaves should be updated, such as frequency of update, > tables to be updated. Drastic database operation (e.g., table creation and > deletion) shall only be initiated from he master. > > Bases on current design architecture and future design plan, what is the best > way for this to be implemented. Replication is a non-goal for LMDB. In OpenLDAP we already have a multimaster replication protocol built on LDAP; we don't need replication in the database engine. Projects that aim to build replication as an LMDB feature are misguided. An embedded database engine's only job is to store and retrieve bytes using local storage. Nothing else. What you're talking about belongs at a higher abstraction layer and has nothing to do with the DB engine. Whatever system you are trying to design is orthogonal to the storage engine. I suggest you look into Dynomite using memcacheDB. http://techblog.netflix.com/2014/11/introducing-dynomite.html https://github.com/LMDB/memcachedb Note that any time you start dealing with network services, you immediately incur the need for authentication, authorization, and privacy controls. Please don't be like the rest of the NoSQL crowd and only realize this after the fact. You will need a proper network protocol, one that's designed to be efficient and secure. You'll also need a decent data model for serializing data over the wire. Most of what you'll need has already been invented and formalized in a spec - we call it LDAP. > Besr regards > Hor Meng > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

How to monitor and test write ldap?
by jupiter 24 Feb '16

24 Feb '16

Hi, I am setting a nagios scripts to monitor the LDAP server. While I can run ldapsearch to check and read data from LDAP, I also want to write dummy data to LDAP database to make sure both read / write are functional well. What is the proper way to run come command in nagios script to write dummy data to LDAP? Or if you have good solution to check write process? Thank you. Kind regards, - jupiter

2 1

LDIF?
by Mary Kao 23 Feb '16

23 Feb '16

Hello, I am trying to add an 'ou' entry to a directory (just a sample), and keep getting the following error. Would appreciate any pointers as to why this is happening: > ldapadd -x -D "cn=Manager,dc=my-domain,dc=com" -W -f users-example.ldif Enter LDAP Password: adding new entry "ou=RavenApps,dc=my-domain,dc=com" ldap_add: Invalid syntax (21) additional info: objectclass: value #1 invalid per syntax I have an LDIF file called "users-example.ldif" with the contents:dn: ou=RavenApps,dc=my-domain,dc=com objectclass: dcObject objectClass: organizationUnit ou: RavenApps Presently, in the directory I have: > ldapsearch -x -b 'dc=my-domain,dc=com' '(objectClass=*)' # extended LDIF # # LDAPv3 # base <dc=my-domain,dc=com> with scope subtree # filter: (objectClass=*) # requesting: ALL # # my-domain.com dn: dc=my-domain,dc=com objectClass: dcObject objectClass: organization o: Raven dc: my-domain # Manager, my-domain.com dn: cn=Manager,dc=my-domain,dc=com objectClass: organizationalRole cn: Manager # search result search: 2 result: 0 Success # numResponses: 3 # numEntries: 2 Thank you!

3 2

SASL EXTERNAL auth issues
by Penza Kenneth at MITA 23 Feb '16

23 Feb '16

Hi, I am using RHEL7 and openldap from LTB project(to test out SSHA password hashing). Currently I am having issues to configure SASL EXTERNAL auth. Maybe I am missing something, any pointers would be appreciated. [root@oldp4-dk-vm ~]# /usr/local/openldap/libexec/slapd -V @(#) $OpenLDAP: slapd 2.4.44 (Feb 15 2016 11:14:35) $ clement@centos7.unix.example.com:/home/clement/build/BUILD/openldap-2.4.44/servers/slapd [root@oldp4-dk-vm ~]# After adding the ldapi:/// listener to the startup script, I verified its working using lsof. [root@oldp4-dk-vm ~]# lsof | grep ldap | grep -e '$unix\|LISTEN$' slapd 7988 ldap 3u unix 0xffff880077fc23c0 0t0 603136 socket slapd 7988 ldap 7u IPv4 603140 0t0 TCP *:ldap (LISTEN) slapd 7988 ldap 8u IPv6 603141 0t0 TCP *:ldap (LISTEN) slapd 7988 ldap 9u IPv4 603144 0t0 TCP *:ldaps (LISTEN) slapd 7988 ldap 10u IPv6 603145 0t0 TCP *:ldaps (LISTEN) slapd 7988 ldap 11u unix 0xffff880077fc2000 0t0 603146 /usr/local/openldap/var/run/ldapi slapd 7988 7989 ldap 3u unix 0xffff880077fc23c0 0t0 603136 socket slapd 7988 7989 ldap 7u IPv4 603140 0t0 TCP *:ldap (LISTEN) slapd 7988 7989 ldap 8u IPv6 603141 0t0 TCP *:ldap (LISTEN) slapd 7988 7989 ldap 9u IPv4 603144 0t0 TCP *:ldaps (LISTEN) slapd 7988 7989 ldap 10u IPv6 603145 0t0 TCP *:ldaps (LISTEN) slapd 7988 7989 ldap 11u unix 0xffff880077fc2000 0t0 603146 /usr/local/openldap/var/run/ldapi slapd 7988 7991 ldap 3u unix 0xffff880077fc23c0 0t0 603136 socket slapd 7988 7991 ldap 7u IPv4 603140 0t0 TCP *:ldap (LISTEN) slapd 7988 7991 ldap 8u IPv6 603141 0t0 TCP *:ldap (LISTEN) slapd 7988 7991 ldap 9u IPv4 603144 0t0 TCP *:ldaps (LISTEN) slapd 7988 7991 ldap 10u IPv6 603145 0t0 TCP *:ldaps (LISTEN) slapd 7988 7991 ldap 11u unix 0xffff880077fc2000 0t0 603146 /usr/local/openldap/var/run/ldapi [root@oldp4-dk-vm ~]# Checking for supported sasl methods: [root@oldp4-dk-vm ~]# ldapsearch -x -H ldapi:/// -b "" -LLL -s base supportedSASLMechanisms dn: supportedSASLMechanisms: EXTERNAL supportedSASLMechanisms: LOGIN supportedSASLMechanisms: PLAIN [root@oldp4-dk-vm ~]# Attempting to bind using sasl [root@oldp4-dk-vm ~]# ldapsearch -LLL -Y EXTERNAL -H ldapi:/// -b dn -vv -d 5 ldap_url_parse_ext(ldapi:///) ldap_initialize( ldapi:///??base ) ldap_create ldap_url_parse_ext(ldapi:///??base) ldap_sasl_interactive_bind: user selected: EXTERNAL ldap_int_sasl_bind: EXTERNAL ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_path ldap_new_socket: 3 ldap_connect_to_path: Trying /usr/local/openldap/var/run/ldapi ldap_connect_timeout: fd: 3 tm: -1 async: 0 ldap_ndelay_on: 3 ldap_ndelay_off: 3 ldap_msgfree ldap_err2string ldap_sasl_interactive_bind_s: Local error (-2) ldap_free_connection 1 1 ldap_send_unbind ber_flush2: 7 bytes to sd 3 ldap_free_connection: actually freed [root@oldp4-dk-vm ~]# Configuration: [root@oldp4-dk-vm ~]# cat config.ldif dn: cn=config objectClass: olcGlobal cn: config olcConfigFile: /usr/local/openldap/etc/openldap/slapd.conf.bak olcConfigDir: /usr/local/openldap/etc/openldap/slapd.d olcAllows: bind_v2 olcArgsFile: /usr/local/openldap/var/run/slapd.args olcAttributeOptions: x-hidden lang- olcAuthzPolicy: none olcConcurrency: 0 olcConnMaxPending: 100 olcConnMaxPendingAuth: 1000 olcGentleHUP: FALSE olcIdleTimeout: 0 olcIndexSubstrIfMaxLen: 4 olcIndexSubstrIfMinLen: 2 olcIndexSubstrAnyLen: 4 olcIndexSubstrAnyStep: 2 olcIndexIntLen: 4 olcLocalSSF: 71 olcPidFile: /usr/local/openldap/var/run/slapd.pid olcReadOnly: FALSE olcReverseLookup: FALSE olcSaslSecProps: noplain,noanonymous olcSockbufMaxIncoming: 262143 olcSockbufMaxIncomingAuth: 16777215 olcThreads: 16 olcTLSCACertificateFile: /usr/local/openldap/etc/openldap/certs/ca-chain.cert.pem olcTLSCertificateFile: /usr/local/openldap/etc/openldap/certs/server.pem olcTLSCertificateKeyFile: /usr/local/openldap/etc/openldap/certs/server.key.pem olcTLSVerifyClient: never olcToolThreads: 1 olcWriteTimeout: 0 structuralObjectClass: olcGlobal dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema include: file:///usr/local/openldap/etc/openldap/schema/core.ldif include: file:///usr/local/openldap/etc/openldap/schema/cosine.ldif include: file:///usr/local/openldap/etc/openldap/schema/inetorgperson.ldif include: file:///usr/local/openldap/etc/openldap/schema/nis.ldif ## We serve small clients that do not handle referrals, ## so handle remote lookups on their behalf. #dn: olcDatabase=ldap,cn=config #objectClass: olcDatabaseConfig #objectClass: olcLdapConfig #olcDatabase: ldap #olcSuffix: "" #olcDbUri: ldap://ldap.some-server.com/ dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAddContentAcl: TRUE olcAccess: to attrs=name;x-hidden by * =cs olcAccess: to attrs=userPassword by * auth olcAccess: to * by * read olcLastMod: TRUE olcMaxDerefDepth: 0 olcReadOnly: FALSE olcSchemaDN: cn=Subschema olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * none olcAddContentAcl: TRUE olcRootPW: {SSHA}dWIRB+xNhhBABixGgVrRKv7/J93NrgW7 olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=config olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig dn: olcDatabase={1}monitor,cn=config objectClass: olcDatabaseConfig olcDatabase: {1}monitor olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=manager,dc=myds,dc=example,dc=com" read by * none olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig dn: olcDatabase={2}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcAccess: {0} to attrs=userPassword,shadowLastChange by self write by anonymous auth by dn="cn=manager,dc=myds,dc=example,dc=com" write by * none olcAccess: {1} to dn.base="" by * read olcAccess: {2} to * by self write by dn="cn=manager,dc=myds,dc=example,dc=com" write by * read olcAddContentAcl: FALSE olcDatabase: {2}hdb olcDbCacheFree: 1 olcDbCacheSize: 1000 olcDbCheckpoint: 512 15 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 3000 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbDirectory: /usr/local/openldap/var/openldap-data olcDbDirtyRead: FALSE olcDbDNcacheSize: 0 olcDbIDLcacheSize: 3000 olcDbIndex: cn,sn,mail pres,eq,approx,sub olcDbIndex: objectClass eq olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbNoSync: FALSE olcDbSearchStack: 16 olcDbShmKey: 0 olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=manager,dc=myds,dc=example,dc=com olcRootPW: {SSHA}dWIRB+xNhhBABixGgVrRKv7/J93NrgW7 olcSuffix: dc=myds,dc=example,dc=com structuralObjectClass: olcHdbConfig [root@oldp4-dk-vm ~]# Regards Kenneth

2 4

ppolicy overlay and disk space exhaution
by Bruncko Michal 23 Feb '16

23 Feb '16

Hello list We use ppolicy overlay for enforcing password lifecycle. Recently we faced with following issue and now I am trying to do some countermeasures to minimize risk of issue reoccurring. We use openldap server for user authentication. Here we store objects of real users as well as system users (for daemons and so on). We use redundant setup with two openldap servers running in mirror mode (multi-master). - Few days ago I find out that I wasn't able to log into service which uses this LDAP as authentication backend. - I find out that BOTH openldap servers are down (simply process wasn't listening) - checked LDAP database partition (dedicated partition for storing both DB and LOG BDB transaction files) and it was exhausted on both servers - reason of this exhaustion was a couple of BDB log files created just within last few minutes before daemon went down - based on slapd logs it seems that one system user (used by Nagios) had expired password - for which I forgot to set no password expiration - and it seems that those failed authentication tries caused this transaction logs to exhaust partition, as because for each failed bind, new "pwdFailureTime" value was added into object which is basically normal ldap modify operation causing transaction log to involve. - and as because that system user was used by Nagios for various purposes and LDAP BIND rate was really high, it effectively behave like DoS to kill my ldap servers due partition space exhausting obviously I have fixed policy for that system user to keep password with unlimited expiration time. but anyway this DoS can be basically reproduced by any real user from outside to effectively kill those ldap servers. Redundancy with multiple servers does not provide any benefit as modifying pwdFailureTime is propagated over all cluster servers with same result to disk space. Also expanding partition will not help - it only extends service availability based on allocated space - and bdb log consuming was really huge - 15 log files (each with 10MB size) was created just within two minutes!! now the question: did anybody considered this "effect" of using "pwdFailureTime" attribute? If so, what can I do to avoid this behavior to occur? Or how you are facing with this potential kind of issues? On one side it is fine to see some failure attempt history. Also keeping pwdFailureTime limited to some max number of values will not help as the LDAP modify operation have to be done anyway. For me the only useful possibility is to NOT use this attribute pwdFailureTime at all, but how to do it? I haven't found any possibility to disable using this attribute. openldap-2.4.40/Centos6 many thanks for help michal

4 10

"LDAP ease modify restrictions" support
by Radovan Semancik 22 Feb '16

22 Feb '16

Hi, I was wondering whether OpenLDAP supports "LDAP ease modify restrictions" control (1.2.840.113556.1.4.1413). I was not able to find any information or documentation except for some vague clue that it might have been supported in OpenLDAP 2.2/2.3 times. The control is definitely not present in root DSE of my stock OpenLDAP 2.4.41. So I was wondering if there is some module/overlay that is needed to enable support for that. Thanks -- Radovan Semancik Software Architect evolveum.com

4 16

how to add users to LDAP and test authentication?
by Mary Kao 22 Feb '16

22 Feb '16

Hello, Would appreciate being pointed to good documentation for adding users to LDAP directory and testing user authentication? Thank you!

5 8

Odd LDAP Behavior
by Borresen, John - 0444 - MITLL 22 Feb '16

22 Feb '16

Getting, for me, some strange LDAP errors/indicators. This is a OpenLDAP 2.4.40 on CentOS7. The sudoers rules are being "seen" but not implemented: # sudo -l -U jdoe Matching Defaults entries for jdoe on this host: requiretty, !visiblepw, always_set_home, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE", env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY", secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin User jdoe may run the following commands on this host: (root) /usr/sbin/tcpdump (root) ALL (ALL) ALL When user jdoe tries to run a sudo command: # sudo su - sudo: ldap_set_option: debug -> 0 sudo: ldap_set_option: tls_checkpeer -> 0 sudo: ldap_set_option: tls_cacertfile -> /etc/openldap/CA/cacert.pem sudo: ldap_set_option: tls_cacert -> /etc/openldap/CA/cacert.pem sudo: ldap_set_option: ldap_version -> 3 sudo: ldap_set_option(LDAP_OPT_NETWORK_TIMEOUT, 30) sudo: ldap_start_tls_s() ok sudo: ldap_sasl_bind_s() ok sudo: Looking for cn=defaults: cn=defaults sudo: no default options found in ou=sudoers,dc=example,dc=com sudo: ldap search '(|(sudoUser=jdoe)(sudoUser=#12345)(sudoUser=%Example)(sudoUser=%#12345)(sud oUser=%Admin)(sudoUser=%Group1)(sudoUser=%GROUP2)(sudoUser=%GROUP3)(sudo User=%GROUP4(sudoUser=ALL))' sudo: searching from base 'ou=sudoers,dc=example,dc=com' sudo: adding search result sudo: result now has 1 entries sudo: ldap search '(sudoUser=+*)' sudo: searching from base 'ou=sudoers,dc=example,dc=com' sudo: adding search result sudo: result now has 1 entries sudo: sorting remaining 1 entries sudo: searching LDAP for sudoers entries sudo: Command allowed sudo: LDAP entry: 0x7fdfb8bc2260 sudo: done with LDAP searches sudo: user_matches=1 sudo: host_matches=1 sudo: sudo_ldap_lookup(0)=0x02 Sorry, try again. Sorry, try again. Sorry, try again. sudo: 3 incorrect password attempts Also seeing in the log files, that bdb_substring_candidates: (sudoHost) not indexed But, it is indexed: oldDbIndex sudoHost eq Thanks in advance for assistance. This is a new environment, that is mimicking another LDAP environment running 2.4.39 on CentOS 5.12 which is running flawlessly. John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Email: <mailto:john.borresen@ll.mit.edu> john.borresen(a)ll.mit.edu

2 1

Invalid credentials
by Dave Beach 21 Feb '16

21 Feb '16

I'm trying to debug a new openldap install on Debian Jessie. Password has been set with slappasswd, no command line options. I get a {SSHA} hash returned - what am I putting in slapd.conf for the admin password: the hashed (as rootpw {SSHA} password) or unhashed (as rootpw password) password? Either returns ldap_bind: Invalid credentials (49) when I restart slapd and perform an ldapsearch. Rootdn has been correctly set in slapd.conf. What can I provide in terms of output or log info to help some kind soul help me?

5 16

Known uses of LMDB outside OpenLDAP
by Ethan Hamilton 21 Feb '16

21 Feb '16

Hi My name is Ethan Hamilton. I work as software engineer for TIBCO Software, http://www.tibco.com/ . As part of my current activities, I am evaluating embedded databases for use in a system of record scenario. LMDB is one of the several good databases that has picked our attention. There is lots of information available in the internet but we find lacking, especially when compared with the information available for other databases like RocksDB, is information about production uses outside OpenLDAP. Facebook makes a lot of information available about how they use RocksDB. They also have a lot of other companies presenting in their meetups on how they currently use (or plan to use) RocksDB. I am seeking information about uses of LMDB in system of record kind of situations, especially in large, replicated clusters where LMDB is used as the persistence layer to store mission critical data. Thank you in advance, Ethan

2 1

ssf settings for SASL and TLS
by Joshua Schaeffer 21 Feb '16

21 Feb '16

What is the proper way to setup SASL and TLS with different security strength factors? I've setup SASL on my OpenLDAP server so that it can connect to my Kerberos server using GSSAPI. I also have TLS setup for simple auth. My database config is below: root@baneling:~/ldif_files# slapcat -H "ldap:///olcDatabase={1}mdb,cn=config??base?" dn: olcDatabase={1}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=harmonywave,dc=com olcAccess: {0}to attrs=userPassword,shadowLastChange,krbPrincipalKey by self write by anonymous auth by dn="cn=admin,dc=harmonywave,dc=com" write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by * read olcLastMod: TRUE olcRootDN: cn=admin,dc=harmonywave,dc=com olcRootPW:: e1NTSEF9dUhDcE1jUUJoWlpuc0twRHBNQkVCUGtmTFA5SC9EYUU= olcDbCheckpoint: 512 30 olcDbIndex: objectClass eq olcDbIndex: cn,uid eq olcDbIndex: uidNumber,gidNumber eq olcDbIndex: member,memberUid eq olcDbIndex: sudoUser eq olcDbIndex: krbPrincipalName eq,pres,sub olcDbMaxSize: 1073741824 structuralObjectClass: olcMdbConfig entryUUID: caa04334-6857-1035-9fbb-dd6671002504 creatorsName: cn=admin,cn=config createTimestamp: 20160215174631Z olcSecurity: sasl=56 simple_bind=256 ssf=256 entryCSN: 20160218030327.503814Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20160218030327Z When I set the security to "olcSecurity: sasl=56 simple_bind=256" then I can bind with SASL or simple auth. However if I set ssf=256 (or really anything higher then 56), like in the above configuration, I get an error when trying to bind with SASL: root@baneling:~/ldif_files# ldapsearch -LLL -Y GSSAPI -H ldapi:/// -b dc=harmonywave,dc=com -s base SASL/GSSAPI authentication started SASL username: jschaeffer(a)HARMONYWAVE.COM SASL SSF: 56 SASL data security layer installed. Confidentiality required (13) Additional information: stronger confidentiality required If I set tls instead of ssf to any number (tls=1 or greater) then I get a slightly different error message when trying to bind with SASL: root@baneling:~/ldif_files# ldapsearch -LLL -Y GSSAPI -H ldapi:/// -b dc=harmonywave,dc=com -s base SASL/GSSAPI authentication started SASL username: jschaeffer(a)HARMONYWAVE.COM SASL SSF: 56 SASL data security layer installed. Confidentiality required (13) Additional information: TLS confidentiality required It looks like slapd has its own preference when parsing through olcSecurity. I'm really just trying to understand the preferred method for setting this up. Perhaps this isn't a real-world situation or perhaps I already answered my own question by setting just sasl and simple_bind. Thanks, Joshua

4 9

can find slapd.conf fine in /etc/openldap under Centos7
by MichaelLeung 20 Feb '16

20 Feb '16

hi all i am not so sure it is the correct place to issue my problem but i really need some help sine i upgrade to Centos7 and install openldap-2.4.4 on it, i would not find slapd.conf in /etc/openldap, the only related file i can find is slapd.ldif . though i still can start slapd services does openldap need slapd.conf any more ?

2 1

chain-uri with a blank?
by Marc Patermann 18 Feb '16

18 Feb '16

Hi, should chain-uri work with an URI with a blank the DIT path? like in: chain-uri "ldap://servername/ou=far bar,c=de" I'm getting a parsing error here with 2.4.43. Feb 17 18:35:01 slapd[1765]: /etc/openldap/slapd.conf: line 156 (chain-uri "ldap://servername/ou=foo bar,c=de") Feb 17 18:35:01 slapd[1765]: /etc/openldap/slapd.conf: line 156: unable to parse uri "(null)" in "uri <uri>" line: URL doesn't begin with "[c]ldap[si]://". Is this a bug? Marc

5 6

slapo-accesslog: wrong timestamp microseconds
by Dario Zanzico 18 Feb '16

18 Feb '16

In adding an accesslog overlay I noticed something strange with the reqstart and reqend fields: the fractional part always begins with 000 and has this strange distribution. > $ ldapsearch ..... | awk -F . '/^reqStart: / {print $2}'| sort | uniq > -c 2 000000Z 351 000001Z 73 000002Z 70 000003Z 308 000004Z 81 000005Z > 97 000006Z 312 000007Z 97 000008Z 97 000009Z 297 000010Z 105 000011Z > 92 000012Z 294 000013Z 108 000014Z 95 000015Z 271 000016Z 128 000017Z > 97 000018Z 252 000019Z 126 000020Z 113 000021Z 240 000022Z 132 000023Z > 110 000024Z 230 000025Z 155 000026Z 118 000027Z 209 000028Z 150 > 000029Z 111 000030Z 193 000031Z 161 000032Z 103 000033Z 187 000034Z > 152 000035Z 117 000036Z 174 000037Z 145 000038Z 117 000039Z 140 > 000040Z 126 000041Z 94 000042Z 89 000043Z 98 000044Z 72 000045Z 51 > 000046Z 49 000047Z 27 000048Z 27 000049Z 26 000050Z 12 000051Z 13 > 000052Z 12 000053Z 9 000054Z 7 000055Z 6 000056Z 8 000057Z 10 > 000058Z 5 000059Z 3 000060Z 3 000061Z 5 000062Z 3 000063Z 7 > 000064Z 3 000065Z 7 000066Z 8 000067Z 1 000068Z 6 000069Z 5 > 000070Z 5 000071Z 4 000072Z 8 000073Z 2 000074Z 3 000075Z 11 > 000076Z 1 000077Z 4 000078Z 7 000079Z 6 000080Z 5 000081Z 6 > 000082Z 5 000083Z 2 000084Z 8 000085Z 3 000086Z 1 000087Z 9 > 000088Z 3 000089Z 3 000090Z 6 000091Z 3 000092Z 6 000093Z 5 > 000094Z 4 000095Z 4 000096Z 3 000097Z 4 000098Z 3 000099Z 4 > 000100Z 3 000101Z 6 000102Z 8 000103Z 1 000104Z 3 000105Z 4 > 000106Z 5 000107Z 2 000108Z 4 000109Z 4 000111Z 10 000112Z 5 > 000113Z 2 000114Z 3 000115Z 2 000116Z 4 000117Z 3 000118Z 4 > 000119Z 1 000120Z 4 000121Z 2 000122Z 4 000123Z 8 000124Z 3 > 000125Z 4 000126Z 4 000127Z 2 000128Z 3 000129Z 4 000130Z 5 > 000131Z 2 000132Z 5 000133Z 1 000134Z 5 000135Z 3 000136Z 2 > 000137Z 1 000138Z 2 000139Z 3 000140Z 2 000141Z 4 000142Z 1 > 000143Z 4 000144Z 4 000145Z 3 000146Z 4 000147Z 1 000148Z 1 > 000149Z 1 000150Z 2 000151Z 2 000152Z 2 000153Z 2 000154Z 3 > 000155Z 3 000156Z 2 000157Z 2 000158Z 1 000160Z 1 000161Z 1 > 000165Z 1 000166Z 1 000169Z 1 000171Z 1 000177Z This is on the last 10 minutes of entries, which I expected to be 'kind of' randomly distributed; Instead no entry has a reqstart with a fractional part bigger than .000177, and the vast majority of them has it < .000050 Anybody knows what can be the cause of this, and how to correct it? Thanks, dario

2 3

ACL and set problem
by Cole 18 Feb '16

18 Feb '16

Hi, I have setup openldap and managed to get everything working, except for limiting access using an ACL with a set. Here is the output of the database and config: https://gist.github.com/onslauth/d6502df4d395dbdf9b19 What I want to achieve, is to limit ssh access to a computer, by adding users or groups to the cn=10.0.0.92,ou=servers group. When I try to bind to openldap with a user in the afore mentioned group, I get "Invalid credentials" error. I have included at the bottom of the gist the ACL log level output. As you can see, the set seems to be expanded correctly, but it doesn't seem to match the 'user' used for the bind. Can anyone see anything wrong with my setup? Thanks /Cole

1 0

LDAPMODIFY Error
by Borresen, John - 0444 - MITLL 17 Feb '16

17 Feb '16

All, New ldap server, running OpenLDAP (v 2.4.40), running CentOS 7. Trying to add/modify the Netgroup. # ldapmodify -d 4 -x -W -H ldap://ldapserver.ldap.net Enter Password Dn: cn=admin,ou=Netgroup,dc=ldap,dc=net Changetype: modify Add: nisNetgroupTriple nisNetgroupTriple: (lenldap,,) . Ldap_modify: Inappropriate matching(18) Additional info: modify/add: nisNetgroupTriple: no equality matching rule I've been googling, one suggestion was to restart slapd, which was done to no avail. Any help would be appreciated. John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Email: <mailto:john.borresen@ll.mit.edu> john.borresen(a)ll.mit.edu

2 3

Re: SSL/TLS passphrase not being prompted for at startup
by Raja T Nair 17 Feb '16

17 Feb '16

Hello Quanah, Thanks for the help. LTB build works superbly. It would be great if you can give me some hint about doing such background check as the broken mozNSS lib issue you mentioned.. Warm Regards, Raja. On 16 February 2016 at 21:56, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, February 16, 2016 8:28 PM +0530 Raja T Nair < > rtnair(a)gmail.com> wrote: > > >> >> >> >> >> Hi Quanah, >> >> Thanks for the response. I will try LTB builds. >> >> But just curious, I am using centos. are centos builds also known to be >> buggy? >> > > Yes. They are essentially the same thing as the RHEL builds. > > > --Quanah > > > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > A division of Synacor, Inc > -- :^)

2 1

Work Queues, MDB_NOTLS, MDB_NOLOCK, and Concurrent Map() Over Sub Database
by A R 17 Feb '16

17 Feb '16

Hello, I’m using a work queue to manage concurrency. Currently jobs manage their own transactions, and barriers are used to enforce exclusive writer access. Naturally, MDB_NOTLS and MDB_NOLOCK are set on the environment. However, I need to implement a concurrent map algorithm over a sub database. The algorithm would be simple: a reader would enqueue worker jobs–each having a strong, immutable reference to the transaction and cursor, and copies of the key and value pointers. The transaction and cursor would only be destroyed after all of the sibling jobs have completed/canceled/failed. I’ve read that transactions and cursors should not be shared between threads, but in this use case, the creation and destruction operations are atomic since only 1 thread, or 2 distinct threads, receive the “beginReadTransaction” and “endReadTransaction” jobs at two distinct moments in time, in a guaranteed order. Are there any caveats in this approach? Thanks, A. Robinson

1 0

Shutting down some slapd listeners
by Hallvard Breien Furuseth 16 Feb '16

16 Feb '16

Sometimes I want slapd to stop listening for new connections to ldap:// and ldaps://, but keep listening to ldapi://, for maintenance before shutdown. One way would be to extend the 'gentlehup' config option with a list of which URIs it should affect. Or we could add some sort of 'command language' to cn=config/cn=monitor. Or should I play some temporary tricks with iptables or whatever, so new connections never reach slapd? I've never tried that. -- Hallvard

3 2

Re: SSL/TLS passphrase not being prompted for at startup
by Raja T Nair 16 Feb '16

16 Feb '16

Hi Quanah, Thanks for the response. I will try LTB builds. But just curious, I am using centos. are centos builds also known to be buggy? Warm Regards, Raja. On 16 February 2016 at 03:21, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Monday, February 15, 2016 11:34 PM +0530 Raja T Nair < > rtnair(a)gmail.com> wrote: > > >> >> >> Hi, >> >> >> OpenLDAP version: 2.4.40-8.el7.x86_64 >> >> OS: CentOS 7.0.1406 >> > > Builds from RedHat link to the very broken MozNSS libraries, which are > likely the source of your issue. You should avoid their broken builds > entirely. I would suggest getting the LTB project builds that are sanely > linked to OpenSSL. > > <http://ltb-project.org/wiki/download#openldap> > > --Quanah > > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > A division of Synacor, Inc > -- :^)

2 1

Disallow ldap operations without start_tls
by Joshua Schaeffer 16 Feb '16

16 Feb '16

I have setup my OpenLDAP server to use TLS and I can successfully bind/search/update/etc over a TLS connection. I have also set olcSecurity. Here is my database: root@baneling:~/ldif_files# slapcat -F /etc/ldap/slapd.d -s olcDatabase={1}mdb,cn=config dn: olcDatabase={1}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=harmonywave,dc=com olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonym ous auth by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by * read olcLastMod: TRUE olcRootDN: cn=admin,dc=harmonywave,dc=com olcRootPW:: e1NTSEF9dUhDcE1jUUJoWlpuc0twRHBNQkVCUGtmTFA5SC9EYUU= olcDbCheckpoint: 512 30 olcDbIndex: objectClass eq olcDbIndex: cn,uid eq olcDbIndex: uidNumber,gidNumber eq olcDbIndex: member,memberUid eq olcDbMaxSize: 1073741824 structuralObjectClass: olcMdbConfig entryUUID: caa04334-6857-1035-9fbb-dd6671002504 creatorsName: cn=admin,cn=config createTimestamp: 20160215174631Z olcSecurity: simple_bind=256 olcSecurity: ssf=256 entryCSN: 20160215210910.287865Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20160215210910Z When I try to do any sort of ldap operation without the -ZZ option then slapd returns a "TLS confidentiality required" message as it should and as I expect. However, If I sniff the wire, I still see the attempted bind request with my DN and password in plaintext. Is there any way to force clients to use start_tls without sending any credentials over the wire (a.k.a. return an error message before a bind request is actually submitted) or does this have to be controlled outside of OpenLDAP? Thanks, Joshua

4 7

SSL/TLS passphrase not being prompted for at startup
by Raja T Nair 15 Feb '16

15 Feb '16

Hi, OpenLDAP version: 2.4.40-8.el7.x86_64 OS: CentOS 7.0.1406 While starting openldap service with command line: systemctl start slapd, it does start well, but does not ask for passphrase of the TLS certificate included. The service listens on ports 636 and 389. When the first request over port 636 is received, the server prompts for passphrase in the console. While this behavior is fine when I run slapd on an attached console, it stops me from running it as a system startup service. Can somebody help me to make slapd to prompt for passphrase during startup? Thanks and Regards, Raja. -- :^)

2 1

Incomplete members from dynlist group when Paged Results control is specified
by Kartik Subbarao 15 Feb '16

15 Feb '16

I'm using Google Apps Directory Sync (GADS) to synchronize group memberships from an OpenLDAP (2.4.41) directory. GADS uses the Paged Results control (1.2.840.113556.1.4.319) to retrieve results in batches of 1000. One of the searches that it does is as follows: base: ou=groups,dc=example,dc=com filter: (mail=*(a)example.com) attributes requested: member owner [and some others] There are more than 1000 groups that match, so it returns the results in batches as expected. Some of these groups are dynlist groups that have memberURL attributes set, which dynamically expand the member attribute when retrieved. For dynlist groups that show up in the first page of results, their members are properly retrieved. But after the first page, the results for dynlist groups only return a subset of the proper membership. As a result, an incomplete membership is being synced to Google for those subsequent groups, and the missing members are causing problems. To rule out GADS from being the root cause of the problem, I ran a standalone perl script to search with the Paged Results control, with the page size set to a small number of entries. Just as with GADS, after the first page of results, the entries started to return fewer members from dynlist groups than should be returned. With a page size of 1, the second dynlist group started to show fewer members (125 vs 127). My guess is that the dynlist code is somehow getting confused by the presence of the Paged Results control in the top-level search, when it does its internal searches to retrieve the individual group memberships. I wanted to ask whether this is enough detail to file an ITS, or whether more information was desired. It could take some more time to put together a generically reproducible LDIF file, so I figured I would post this now in case someone familiar with the dynlist code might recognize this and see how the presence of the Paged Results control might be interfering with its behavior. Thanks, -Kartik

1 1

LDAP log lags in the ldap.log
by Daniel Jung 12 Feb '16

12 Feb '16

based on the timestamp in the ldap.log, it is about 10-15 minutes older than current time. I see a lot of ABANDON msgs which i suspect that there are way too many queries (not ldap connection itself) in a connection. Also, the log shows the constant logs of follwing as well: connection_input: conn=321629 deferring operation: pending operations connection_input: conn=318818 deferring operation: too many executing Looking thru the archive that this is an issue on the client side, and I believe that's true based on the ABANDON msgs on long lasted session ids. I was using logging set to stats, sync . I have changed to none and the symptom of lagging of log timestamp has disappeared and queries are working properly again. My question is, is there a way to safely log stats without hampering performance to the point queries are not returing at all ? I am using openldap-2.4.39 ( yes i should upgrade soon :( ) Thanks

2 1

Member of nested groups of different classes
by Chris 12 Feb '16

12 Feb '16

Dear All, some users are member of a groupOfNames (RFC2307bis Schema). This group is member of a mailGroup (Postfix Schema). This mailGroup is member of another mailGroup. (Nested) membership in this last group defines access rights for an application. My question: is the memberOf overlay able to recursively find all groups one is member of, if they use all the same "member" attribute (memberof.member-ad), but have different structural classes (memberof-group-oc)? Is there a (perl?) script that is able to find all groups one is member-of? - Chris

2 1

Re: rebuilding the DIT
by Timothy Keith 12 Feb '16

12 Feb '16

On Thu, Feb 11, 2016 at 7:05 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > If you want answers, keep your replies on the list. > > Thanks. > > > > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > A division of Synacor, Inc I used this slapcat, I did not specific a config database. slapcat -v -l backup.ldif Tim

3 3

paged results control results in full db search?
by Geert Hendrickx 12 Feb '16

12 Feb '16

Hi, We found an odd issue when using LDAP Admin (www.ldapadmin.org), which by defaults uses the paged results control (RFC 2696) to limit search results. This client initially issues an objectclass=* search with one-level scope to list the first-level objects/trees on the LDAP DIT, which you can then browse/expand by clicking on them. On a large db, we noticed this initial search hits the timelimit, even though the equivalent command line search is instant. I found the difference is in using the paged result control: ldapsearch -s one -E \!pr=100 objectclass=\* objectclass => slow ldapsearch -s one objectclass=\* objectclass => fast The slapd stats+trace logging of each is in attachment. Notice the large number of objects being skipped with "scope not okay" in the first, where this does not happen in the second. This slows down the search, and on a very large db, makes it exceed the configured 60 seconds timelimit. A third variant, setting the sizelimit explicitly, avoids the issue: ldapsearch -s one -E \!pr=100 -z 100 objectclass=\* objectclass => fast Is this expected behaviour? Geert -- geert.hendrickx.be :: geert(a)hendrickx.be :: PGP: 0xC4BB9E9F This e-mail was composed using 100% recycled spam messages!

1 0

Re: rebuilding the DIT
by Timothy Keith 12 Feb '16

12 Feb '16

On Thu, Feb 11, 2016 at 4:46 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, February 11, 2016 4:38 PM -0600 Timothy Keith > <timothy.g.keith(a)gmail.com> wrote: > >> I don't know how to fix this. If I could reinitialize the dc=pubsys, >> dc=com that would be okay too as there are relatively few users to >> add. > > > It's saying that you're missing a schema file for inetOrgPerson. Schema is > stored in the config database. I.e., if your slapd is passed an option of > -F /path/to/configdb then slapadd (and slapcat) should both also be passed > an option to the same location. > > It would generally be impossible for you to be able to create entries in > openldap that used inetorgPerson without the schema actually being present. > So this would indicate that you're not providing the correct options to > slapadd. You provide virtually no useful information at what you're doing, > so it becomes rather difficult to do anything but guess at what the causes > of your issues are. > > > --Quanah > > > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > A division of Synacor, Inc This is the slapadd request : slapadd -F /etc/openldap/slapd.d -l slapcat_backup.ldif 56bd1acf The first database does not allow slapadd; using the first available one (2) 56bd1acf bdb_db_open: warning - no DB_CONFIG file found in directory /var/lib/ldap: (2). Expect poor performance for suffix "dc=example,dc=com". slapadd: line 1: database #2 (dc=example,dc=com) not configured to hold "dc=pubsys,dc=com"; no database configured for that naming context _# 5.10% eta none elapsed none spd 2.7 M/s Closing DB... Tim

2 1

Re: rebuilding the DIT
by Timothy Keith 11 Feb '16

11 Feb '16

On Thu, Feb 11, 2016 at 2:30 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, February 11, 2016 12:29 PM -0800 Quanah Gibson-Mount > <quanah(a)zimbra.com> wrote: > >> --On Thursday, February 11, 2016 2:18 PM -0600 Timothy Keith >> <timothy.g.keith(a)gmail.com> wrote: >> >>> When the slapadd loaded the backup ldif it prints : >>> >>> slapadd: dn="uid=tkeith,ou=Group,dc=pubsys,dc=com" (line=55): (65) >>> unrecognized objectClass 'inetOrgPerson' >> >> >> Sounds like you failed to restore your config database properly. > > > Or, you failed to point slapadd at the actual config database it should be > using for the import. > > > --Quanah > > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > A division of Synacor, Inc I don't know how to fix this. If I could reinitialize the dc=pubsys, dc=com that would be okay too as there are relatively few users to add. Tim

2 1

Re: rebuilding the DIT
by Timothy Keith 11 Feb '16

11 Feb '16

On Thu, Feb 11, 2016 at 12:55 PM, Albert Braden <abraden(a)about.com> wrote: > Do you use IRC? I've had good luck getting help on FreeNode, in #ldap and #openldap > > Even there, people will likely ask you to read the documentation so that you can ask intelligent questions. They're helpful, but they don't want to do your work for you. If you haven't already done so, I would read a lot of this site: > > http://www.openldap.org/doc/admin24/ > > For diagnostic purposes, I recommend using ldapsearch and other command-line tools instead of a GUI client. A question likely to receive a helpful response would look something like this: > > I'm running OpenLDAP version X on <OS>, and when I run this command: > > XXX > > I see this error: > > YYY > > And this appears in slapd.log: > > ZZZ > > Here's the relevant section of my config: > > AAA > > -----Original Message----- > From: openldap-technical [mailto:openldap-technical-bounces@openldap.org] On Behalf Of Timothy Keith > Sent: Thursday, February 11, 2016 1:35 PM > To: openldap-technical(a)openldap.org > Subject: Re: rebuilding the DIT > > On Tue, Feb 9, 2016 at 7:02 PM, Timothy Keith <timothy.g.keith(a)gmail.com> wrote: >> I used slapcat followed by slapadd. The Perl Net::LDAP sounds useful. >> >> Tim > > > Is there a good forum for newbie openlap questions? > > I saved another DIT using slapcat, then loaded using slapadd. But, > that is now returning error code 49 : invalid credentials ( in > JXplorer ). I'm using the rootpw password that > is defined in /etc/openldap/ldap.conf > > Tim > I stopped the service, and then restarted slapd with the -d 1 ( debug ) and also used the -f /etc/openldap/ldap.conf. Now, it is accepting the password for rootdn ( which I have never explicitly changed ) Tim

2 3

Re: rebuilding the DIT
by Timothy Keith 11 Feb '16

11 Feb '16

I used slapcat followed by slapadd. The Perl Net::LDAP sounds useful. Tim

1 1

Re: make posixGroup auxiliary in 2.4.40
by Chris 11 Feb '16

11 Feb '16

Quanah Gibson-Mount wrote: > --On Tuesday, February 09, 2016 10:42 PM +0100 Chris > <chris2014(a)postbox.xyz> wrote: >> Nevertheless, is there a way to use rfc2307bis with dynamic >> configuration? > > Sure. Use slapcat to export your config DB, remove the problem schema, and > reload with slapadd. Ok. I thought this wasn't possible, because some attribute types are marked as builtin in nis.schema: # builtin #attributetype ( 1.3.6.1.1.1.1.1 NAME 'gidNumber' # DESC 'An integer uniquely identifying a group in an administrative domain' # EQUALITY integerMatch # SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) - Chris

2 2

ldap client library
by Friedrich Locke 11 Feb '16

11 Feb '16

Hi folks! i am in need to write a small subset of ldap client library. Currently i need Write a function to encode a bind request Write a function to decode a bind response Write a function to encode a entry request (for instance: retrieve all attributes for entry posixuser uid=sioux,ou=people,dn=x,dn=y) Write a function to decode a entry search response May you point me what are the messages in the ldap library RFC i shoud implement as also the tag values for the ASN objects ? Thanks in advance.

1 0

LMDB and Referential transparency
by Pierre-Étienne Meunier 11 Feb '16

11 Feb '16

Hi, I love LMDB, thanks for writing it! I wonder whether it would be possibly to add the following feature: When I change one of the databases (called for instance A) in my environment, I'd like to be able to still keep a copy of A as it was before, and make a new copy B, that would share all its memory with A, except the changes. In other words, I'd like to have a function like: int mdb_fork_db(MDB_txn* txn, MDB_dbi dbi_a, char* B, int open_dbi_flags, MDB_dbi* dbi_b), which would open a new database dbi_b with name B, and copy the B-Tree root of database "dbi_a" as the root of "dbi_b". After this, any put/delete on A would update A only, and any put/delete on new_name would update new_name only. Cheers, Pierre Here is an example of the semantics I would find really great: #include<lmdb.h> void main(){ MDB_env *env; mdb_env_create(&env); mdb_env_open(env,"/tmp/test.lmdb",0,0755); MDB_txn *txn; mdb_env_set_maxdbs(env,2); mdb_txn_begin(env,NULL,0,&txn); MDB_dbi db_a; mdb_dbi_open(txn,"A",MDB_CREATE,&db_a); { char*k_="shared1"; char*v_="value 1"; MDB_val k = { mv_data:k_,mv_size:sizeof(k_) }; MDB_val v = { mv_data:v_,mv_size:sizeof(v_) }; mdb_put(txn,db_a,&k,&v,0); } { char*k_="shared2"; char*v_="value 2"; MDB_val k = { mv_data:k_,mv_size:sizeof(k_) }; MDB_val v = { mv_data:v_,mv_size:sizeof(v_) }; mdb_put(txn,db_a,&k,&v,0); } MDB_dbi db_b; mdb_fork_db(txn,db,"B",MDB_CREATE,&db_b); { char*k_="BKey"; char*v_="Value B"; MDB_val k = { mv_data:k_,mv_size:sizeof(k_) }; MDB_val v = { mv_data:v_,mv_size:sizeof(v_) }; mdb_put(txn,db_b,&k,&v,0); } { char*k_="AKey"; char*v_="Value A"; MDB_val k = { mv_data:k_,mv_size:sizeof(k_) }; MDB_val v = { mv_data:v_,mv_size:sizeof(v_) }; mdb_put(txn,db_a,&k,&v,0); } // Now, A has {shared1, shared2, AKey}, and B has {shared1,shared2,BKey}. { char*k_="shared1"; MDB_val k = { mv_data:k_,mv_size:sizeof(k_) }; mdb_del(txn,db_b,&k,NULL); } // Now, A has {shared1, shared2, AKey}, and B has {shared2,BKey}. mdb_drop(db_a); // Now, the environment has just a single database B, with keys {shared2, BKey}. mdb_txn_commit(txn); mdb_env_close(env); }

3 2

chaining for a single backend?
by Marc Patermann 11 Feb '16

11 Feb '16

Hi, I want to activate chaining for a single backend. The server is a replication consumer and has a few glued database backends. Only one is containing linux accounts with ppolicy overlay. This should use chaining to replicate the ppolicy changes which otherwise stay local. Can this be achieved? Marc

4 6

Unable to do ldapsearch, but testsaslauthd works in OpenLDAP 2.4
by Ravi K Althuru 11 Feb '16

11 Feb '16

We have OpenLDAP 2.3 running on Linux. It is set up in SASL mode authenticating against multiple ADs. Everything works fine there, which is our Production env. We recently installed a new instance of OpenLDAP 2.4.23 running on RedHat Linux 6 in our Dev and QA env. Then, we moved the slapd.conf and slapd-meta.conf file to the new instance, and created the required users. When we run testsaslauthd, we are successfully able to authenticate against the appropriate AD that the user is under. testsaslauthd -u ravi@SONEPAR -p secret - WORKS ldapsearch -x -D uid=ravi,ou=People,ou=company,dc=inside,dc=devserver,dc=com -w secret results in: ldap_bind: Invalid credentials (49) But when we do a ldap search or connect using LDAP Browser, the user is not able to get autheticated. We are not able to bind to the OpenLDAP by using the same credentials. I get a Invalid credentials err 49, which indcates either credentials are incorrect, which in this case its not, or the bind info is incorrect. I seems as though the user is not able to bind to OpenLDAP 2.4 or it does not know how to. When I change the password form {SASL}ralthuru@SONEPAR to a text say "secret", it works fine. Here is the log output from the same user authetication in OpenLDAP 2.3 and OpenLDAP 2.4: SUCCESS - QA 2.4 - testsaslauthd -u ralthuru@SONEPAR -p secret Feb 2 16:42:44 pabeldapd01-new slapd[65327]: conn=1000 fd=8 ACCEPT from IP=127.0.0.1:44500 (IP=127.0.0.1:391) Feb 2 16:42:44 pabeldapd01-new slapd[65327]: conn=1000 op=0 BIND dn="cn=Manager,dc=local" method=128 Feb 2 16:42:44 pabeldapd01-new slapd[65327]: conn=1000 op=0 BIND dn="cn=Manager,dc=local" mech=SIMPLE ssf=0 Feb 2 16:42:44 pabeldapd01-new slapd[65327]: conn=1000 op=0 RESULT tag=97 err=0 text= Feb 2 16:42:44 pabeldapd01-new slapd[65327]: conn=1000 op=1 SRCH base="ou=SONEPAR,dc=local" scope=2 deref=0 filter="(|(uid=ralthuru)(?SMACCOUNTNAME=ralthuru))" Feb 2 16:42:44 pabeldapd01-new slapd[65327]: conn=1000 op=1 SRCH attr=dn Feb 2 16:42:44 pabeldapd01-new slapd[65327]: conn=1000 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Feb 2 16:42:44 pabeldapd01-new slapd[65327]: conn=1000 op=2 BIND anonymous mech=implicit ssf=0 Feb 2 16:42:44 pabeldapd01-new slapd[65327]: conn=1000 op=2 BIND dn="cn=Ravi Althuru,cn=Users,ou=SONEPAR,dc=local" method=128 Feb 2 16:42:44 pabeldapd01-new slapd[65327]: conn=1000 op=2 BIND dn="cn=Ravi Althuru,cn=Users,ou=SONEPAR,dc=local" mech=SIMPLE ssf=0 Feb 2 16:42:44 pabeldapd01-new slapd[65327]: conn=1000 op=2 RESULT tag=97 err=0 text= SUCCESS - QA 2.4 - login as cn=Manager/Password1 from LDAP Browser Feb 2 16:43:09 pabeldapd01-new slapd[65323]: conn=1004 fd=12 ACCEPT from IP=10.108.138.66:64931 (IP=0.0.0.0:389) Feb 2 16:43:09 pabeldapd01-new slapd[65323]: conn=1004 op=0 BIND dn="cn=Manager,dc=inside,dc=sdusadevl,dc=com" method=128 Feb 2 16:43:09 pabeldapd01-new slapd[65323]: conn=1004 op=0 BIND dn="cn=Manager,dc=inside,dc=sdusadevl,dc=com" mech=SIMPLE ssf=0 Feb 2 16:43:09 pabeldapd01-new slapd[65323]: conn=1004 op=0 RESULT tag=97 err=0 text= Feb 2 16:43:12 pabeldapd01-new slapd[65323]: conn=1004 op=1 UNBIND Feb 2 16:43:12 pabeldapd01-new slapd[65323]: conn=1004 fd=12 closed FAIL - QA 2.4 - login as uid=ralthuru/Sonepar123 from LDAP Browser Feb 2 16:43:35 pabeldapd01-new slapd[65323]: conn=1005 fd=12 ACCEPT from IP=10.108.138.66:64939 (IP=0.0.0.0:389) Feb 2 16:43:35 pabeldapd01-new slapd[65323]: conn=1005 op=0 BIND dn="uid=ralthuru,ou=Sonepar,ou=People,dc=inside,dc=sdusadevl,dc=com" mthod=128 Feb 2 16:43:35 pabeldapd01-new slapd[65323]: conn=1005 op=0 RESULT tag=97 err=49 text= Feb 2 16:43:35 pabeldapd01-new slapd[65323]: conn=1005 op=1 UNBIND Feb 2 16:43:35 pabeldapd01-new slapd[65323]: conn=1005 fd=12 closed SUCCESS - PRODUCTION 2.3 - testsaslauthd -u ralthuru@SONEPAR -p secret Feb 3 10:07:35 pavfldapp01 slapd[6375]: conn=94 op=22 BIND anonymous mech=implicit ssf=0 Feb 3 10:07:35 pavfldapp01 slapd[6375]: conn=94 op=22 BIND dn="cn=Manager,dc=local" method=128 Feb 3 10:07:35 pavfldapp01 slapd[6375]: conn=94 op=22 BIND dn="cn=Manager,dc=local" mech=SIMPLE ssf=0 Feb 3 10:07:35 pavfldapp01 slapd[6375]: conn=94 op=22 RESULT tag=97 err=0 text= Feb 3 10:07:35 pavfldapp01 slapd[6375]: conn=94 op=23 SRCH base="ou=SONEPAR,dc=local" scope=2 deref=0 filter="(|(uid=ralthuru)(SAMACCOUNTNAME=ralthuru))" Feb 3 10:07:35 pavfldapp01 slapd[6375]: conn=94 op=23 SRCH attr=dn Feb 3 10:07:35 pavfldapp01 slapd[6375]: conn=94 op=23 SEARCH RESULT tag=101 err=0 nentries=1 text= Feb 3 10:07:35 pavfldapp01 slapd[6375]: conn=94 op=24 BIND anonymous mech=implicit ssf=0 Feb 3 10:07:35 pavfldapp01 slapd[6375]: conn=94 op=24 BIND dn="cn=Althuru\2C Ravi,ou=Accenture,ou=Consultants,ou=SONEPAR,dc=local" method=128 Feb 3 10:07:35 pavfldapp01 slapd[6375]: conn=94 op=24 BIND dn="cn=Althuru\2C Ravi,ou=Accenture,ou=Consultants,ou=SONEPAR,dc=local" mech=SIMPLE ssf=0 Feb 3 10:07:35 pavfldapp01 slapd[6375]: conn=94 op=24 RESULT tag=97 err=0 text= SUCCESS - PRODUCTION 2.3 - login as uid=ralthuru/secret from LDAP Browser eb 3 10:44:45 pavfldapp01 slapd[4806]: conn=50825 fd=15 ACCEPT from IP=10.108.138.66:54298 (IP=0.0.0.0:389) Feb 3 10:44:45 pavfldapp01 slapd[4806]: conn=50825 op=0 BIND dn="uid=ralthuru,ou=Sonepar,ou=People,dc=inside,dc=sonepar-us,dc=com" method=128 Feb 3 10:44:45 pavfldapp01 slapd[6375]: conn=94 op=25 BIND anonymous mech=implicit ssf=0 Feb 3 10:44:45 pavfldapp01 slapd[6375]: conn=94 op=25 BIND dn="cn=Manager,dc=local" method=128 Feb 3 10:44:45 pavfldapp01 slapd[6375]: conn=94 op=25 BIND dn="cn=Manager,dc=local" mech=SIMPLE ssf=0 Feb 3 10:44:45 pavfldapp01 slapd[6375]: conn=94 op=25 RESULT tag=97 err=0 text= Feb 3 10:44:45 pavfldapp01 slapd[6375]: conn=94 op=26 SRCH base="ou=SONEPAR,dc=local" scope=2 deref=0 filter="(|(uid=ralthuru)(SAMACCOUNTNAME=ralthuru))" Feb 3 10:44:45 pavfldapp01 slapd[6375]: conn=94 op=26 SRCH attr=dn Feb 3 10:44:45 pavfldapp01 slapd[6375]: conn=94 op=26 SEARCH RESULT tag=101 err=0 nentries=1 text= Feb 3 10:44:45 pavfldapp01 slapd[6375]: conn=94 op=27 BIND anonymous mech=implicit ssf=0 Feb 3 10:44:45 pavfldapp01 slapd[6375]: conn=94 op=27 BIND dn="cn=Althuru\2C Ravi,ou=Accenture,ou=Consultants,ou=SONEPAR,dc=local" method=128 Feb 3 10:44:45 pavfldapp01 slapd[6375]: conn=94 op=27 BIND dn="cn=Althuru\2C Ravi,ou=Accenture,ou=Consultants,ou=SONEPAR,dc=local" mech=SIMPLE ssf=0 Feb 3 10:44:45 pavfldapp01 slapd[6375]: conn=94 op=27 RESULT tag=97 err=0 text= Feb 3 10:44:45 pavfldapp01 slapd[4806]: conn=50825 op=0 BIND dn="uid=ralthuru,ou=Sonepar,ou=People,dc=inside,dc=sonepar-us,dc=com" mech=SIMPLE ssf=0 Feb 3 10:44:45 pavfldapp01 slapd[4806]: conn=50825 op=0 RESULT tag=97 err=0 text= Feb 3 10:44:47 pavfldapp01 slapd[4806]: conn=50825 op=1 UNBIND SUCCESS - PRODUCTION 2.3 - LDAP Search command as uid=ralthuru/secret Feb 3 10:48:54 pavfldapp01 slapd[4806]: conn=50831 fd=15 ACCEPT from IP=10.199.204.205:44578 (IP=0.0.0.0:389) Feb 3 10:48:54 pavfldapp01 slapd[4806]: conn=50831 op=0 BIND dn="uid=ralthuru,ou=Sonepar,ou=People,dc=inside,dc=sonepar-us,dc=com" method=128 Feb 3 10:48:54 pavfldapp01 slapd[6375]: conn=94 op=28 BIND anonymous mech=implicit ssf=0 Feb 3 10:48:54 pavfldapp01 slapd[6375]: conn=94 op=28 BIND dn="cn=Manager,dc=local" method=128 Feb 3 10:48:54 pavfldapp01 slapd[6375]: conn=94 op=28 BIND dn="cn=Manager,dc=local" mech=SIMPLE ssf=0 Feb 3 10:48:54 pavfldapp01 slapd[6375]: conn=94 op=28 RESULT tag=97 err=0 text= Feb 3 10:48:54 pavfldapp01 slapd[6375]: conn=94 op=29 SRCH base="ou=SONEPAR,dc=local" scope=2 deref=0 filter="(|(uid=ralthuru)(SAMACCOUNTNAME=ralthuru))" Feb 3 10:48:54 pavfldapp01 slapd[6375]: conn=94 op=29 SRCH attr=dn Feb 3 10:48:54 pavfldapp01 slapd[6375]: conn=94 op=29 SEARCH RESULT tag=101 err=0 nentries=1 text= Feb 3 10:48:54 pavfldapp01 slapd[6375]: conn=94 op=30 BIND anonymous mech=implicit ssf=0 Feb 3 10:48:54 pavfldapp01 slapd[6375]: conn=94 op=30 BIND dn="cn=Althuru\2C Ravi,ou=Accenture,ou=Consultants,ou=SONEPAR,dc=local" method=128 Feb 3 10:48:54 pavfldapp01 slapd[6375]: conn=94 op=30 BIND dn="cn=Althuru\2C Ravi,ou=Accenture,ou=Consultants,ou=SONEPAR,dc=local" mech=SIMPLE ssf=0 Feb 3 10:48:54 pavfldapp01 slapd[6375]: conn=94 op=30 RESULT tag=97 err=0 text= Feb 3 10:48:54 pavfldapp01 slapd[4806]: conn=50831 op=0 BIND dn="uid=ralthuru,ou=Sonepar,ou=People,dc=inside,dc=sonepar-us,dc=com" mech=SIMPLE ssf=0 Feb 3 10:48:54 pavfldapp01 slapd[4806]: conn=50831 op=0 RESULT tag=97 err=0 text= Feb 3 10:48:54 pavfldapp01 slapd[4806]: conn=50831 op=1 SRCH base="dc=inside,dc=sonepar-us,dc=com" scope=2 deref=0 filter="(objectClass=*)" Feb 3 10:48:54 pavfldapp01 slapd[4806]: conn=50831 op=1 SEARCH RESULT tag=101 err=4 nentries=500 text= Feb 3 10:48:54 pavfldapp01 slapd[4806]: conn=50831 op=2 UNBIND Feb 3 10:48:54 pavfldapp01 slapd[4806]: conn=50831 fd=15 closed Here is the ldap.conf URI ldap://10.99.19.179 BASE dc=inside,dc=sdusadevl,dc=com TLS_REQCERT never Here is the slapd.conf, only the relevant info: include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/schema_extension.schema allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args modulepath /usr/lib64/openldap loglevel 256 ####################################################################### # ldbm and/or bdb database definitions ####################################################################### database bdb suffix "dc=inside,dc=sdusadevl,dc=com" rootdn "cn=Manager,dc=inside,dc=sdusadevl,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw xyz123 # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index uniqueMember eq,pres # Replicas of this database #replogfile /var/lib/ldap/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com(a)EXAMPLE.COM # adding to ignore error for slaptest cachesize 2000 sasl-host localhost sasl-secprops none ---------------------- Here is the slapd-meta.conf containing the AD where the user ralthuru is autheticating to: uri ldap://sdusa-dc-01.sdusadevl.com:3268/ou=SONEPAR,dc=local lastmod off suffixmassage "ou=SONEPAR,dc=local" "dc=sdusadevl,dc=com" idassert-bind bindmethod=simple binddn="CN=Vignette\\, Service Account,OU=Vignette Service,OU=Vignette,OU=Enterpise Systems,DC=sdusadevl,DC=com" credentials="hiddenpassword" mode=none flags=non-prescriptive idassert-authzFrom "dn.exact:cn=Manager,dc=local" I have searched across many forums, compared the set up on the OpenLDAP 2.3 and OpenLDAP 2.4 instances and cannot find any differences. Any suggestions on how to resolve this is appreciated!

4 7

Nested groups and sssd filters
by Miltos Tereres 11 Feb '16

11 Feb '16

Hello, I have a groupOfUniqueNames in my ldap (xv64ut09), which has as a uniqueMember the DN of another groupOfUniqueNames. In this last group are my user values. In my sssd configuration I use a filter like this: ldap_user_search_base = ou=people,dc=fu,dc=bar,dc=com??(&(memberOf=cn=xv64ut09,ou=groups,dc=fu,dc=bar,dc=com)(objectClass=*)) The problem is that this doesn't work if the user values are in a nested group, it only works if the users are in my main group (xv64ut09). I would guess that linux / sssd can support this type of nesting. Is there a change that needs to be done from the ldap server side, in the schema, or maybe something else that I have missed? I am using the rfc2307bis... Thanks.

4 3

Replication between 2.4.21 and 2.4.31
by Jason J. W. Williams 11 Feb '16

11 Feb '16

Hello, For various reasons we may need to set up N-way multimaster replication between OpenLDAP 2.4.21 and 2.4.31. Do folks see problems running different patch releases in the same replication group? -J

2 1

Crash on ldap 2.4.41 on RedHat using mdb.
by ping-shin ching 11 Feb '16

11 Feb '16

Hi Folks, I upload data approx (15 million entries) using slapadd. Then start the server and run some searches. Not all searches crash- only some. I get some results before before slapd core dumps. Do I need to furnish any more information? gcc (GCC) 4.4.7 20120313 (Red Hat 4.4.7-3) Configure options... --without-cyrus-sasl \ --disable-bdb \ --disable-hdb \ --enable-ldap \ --enable-mdb \ --enable-constraint \ --enable-accesslog; \ backtrace... Core was generated by `./slapd -h ldap://:1389 -f /data/openldap24/etc/openldap/slapd.conf'. Program terminated with signal 11, Segmentation fault. #0 0x00000000004940fa in mdb_node_read (txn=0x7f9dec102b00, leaf=0x7f9e3914c736, data=0x7f9df15f6020) at ./../../../libraries/liblmdb/mdb.c:5350 5350 data->mv_size = NODEDSZ(leaf); Missing separate debuginfos, use: debuginfo-install glibc-2.12-1.166.el6_7.3.x86_64 (gdb) where #0 0x00000000004940fa in mdb_node_read (txn=0x7f9dec102b00, leaf=0x7f9e3914c736, data=0x7f9df15f6020) at ./../../../libraries/liblmdb/mdb.c:5350 #1 0x00000000004978db in mdb_cursor_set (mc=0x7f9dec104480, key=0x7f9df366c320, data=0x7f9df15f6020, op=MDB_SET, exactp=<value optimized out>) at ./../../../libraries/liblmdb/mdb.c:5787 #2 0x000000000049818a in mdb_cursor_get (mc=0x7f9dec104480, key=0x7f9df366c320, data=0x7f9df15f6020, op=<value optimized out>) at ./../../../libraries/liblmdb/mdb.c:5952 #3 0x00000000004a2c81 in mdb_waitfixup (op=0x7f9dec102570, ww=0x7f9df37fc460, mci=<value optimized out>, mcd=0x7f9dec104480, scopes=0x7f9df12f5010) at search.c:377 #4 0x00000000004a52bc in mdb_search (op=0x7f9dec102570, rs=<value optimized out>) at search.c:1114 #5 0x000000000048179e in overlay_op_walk (op=0x7f9dec102570, rs=0x7f9df37fda30, which=<value optimized out>, oi=0x214ca50, on=0x0) at backover.c:677 #6 0x0000000000482213 in over_op_func (op=0x7f9dec102570, rs=<value optimized out>, which=<value optimized out>) at backover.c:730 #7 0x000000000041f871 in fe_op_search (op=0x7f9dec102570, rs=0x7f9df37fda30) at search.c:402 #8 0x000000000042009c in do_search (op=0x7f9dec102570, rs=0x7f9df37fda30) at search.c:247 #9 0x000000000041d959 in connection_operation (ctx=0x7f9df37fdb70, arg_v=0x7f9dec102570) at connection.c:1155 #10 0x000000000041e0cd in connection_read_thread (ctx=0x7f9df37fdb70, argv=<value optimized out>) at connection.c:1291 #11 0x00000000004ef7a0 in ldap_int_thread_pool_wrapper (xpool=0x20af380) at tpool.c:696 #12 0x00000034a7c079d1 in start_thread () from /lib64/libpthread.so.0 #13 0x00000034a78e8b5d in epoll_pwait () from /lib64/libc.so.6 #14 0x0000000000000000 in ?? ()

2 2

ldap separate OU-administrator account
by Gary Spencer 10 Feb '16

10 Feb '16

Hi, I need some guidance, I have a simple DIT with users in the users OU, and a separate OU for admins. In addition to the Manager, I have created an admin2 account in the admins OU, however default permissions don't allow the admin2.admins.domain.tld to create users in the users.domain.tld OU. I also don't want admin2 to have equal permissions to Manager, I am giving that account away to our users administrator and they only need access to create/modify/delete users under the users OU (on basis of least privilege I don't want them to have full access). I am using dynamic ldap, I have already created the users and admin accounts, I just need guidance on adding the ACL's. I am a complete novice with openldap, what do I need to do to grant the correct olcAccess so that the admin2 account can create users in the users.domain.tld OU ? I'd also like a read-only admin in the admins OU that can view all details for all users under users OU ? And cream on top of the cake, I'd like to prohibit accounts in the users OU from looking at any of the rest of the LDAP objects other than self ? I think I'm right I need to modify the olcAccess access rules, but don't know how, current olcAccess rules follow:- dn: olcDatabase={2}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {2}hdb <... CUT ...> olcSuffix: dc=domain,dc=tld olcRootDN: cn=Manager,dc=domain,dc=tld olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=Manager,dc=domain,dc=tld" write by anonymous auth by self write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by dn="cn=Manager,dc=domain,dc=tld" write by * read (I have tweaked the text output to replace our domain, please ignore any typos I may have inadvertently introduced) I have read the admin guides and man pages, but I can't see clearly see what ldif stanzas I need to construct ? Thanks in advance. Gary Spencer [cid:image001.jpg@01D16412.92EB2D10]<http://www.sis.tv/distribution/> Whitehall Avenue | Kingston | Milton Keynes | MK10 0AX www.sis.tv<http://www.sis.tv> ********************************************************************** Satellite Information Services Limited. Registered Office: Whitehall Avenue, Kingston, Milton Keynes, Buckinghamshire, MK10 0AX. Company No. 4243307 SIS LIVE Limited. Registered Office: Whitehall Avenue, Kingston, Milton Keynes, Buckinghamshire, MK10 0AX. Company No. 5075598 The information in this email (which includes any files transmitted with it) is confidential and is intended for the addressee only. Unauthorized recipients are required to maintain confidentiality. If you have received this email in error please notify the sender immediately, destroy any copies and delete it from your computer system. **********************************************************************

1 0

Using TLS not seeing EXTERNAL as Using TLS not seeing EXTERNAL as supported SASL mechanism
by Bill MacAllister 10 Feb '16

10 Feb '16

I am working on using TLS on an OpenLDAP server and having issues. Basically I can make a TLS connection, but I don't see EXTERNAL as one of the supportedSASLMechanisms. (slapd 2.4.41+dfsg-1ubuntu2~dbp0 built with openssl) Here is my ldapsearch: $ ldapsearch -h ldap-test-master1.corp.dropbox.com -x -ZZ -b '' -s base supportedSASLMechanisms # extended LDIF # # LDAPv3 # base <> with scope baseObject # filter: (objectclass=*) # requesting: supportedSASLMechanisms # # dn: supportedSASLMechanisms: GS2-IAKERB supportedSASLMechanisms: GS2-KRB5 supportedSASLMechanisms: SCRAM-SHA-1 supportedSASLMechanisms: GSSAPI supportedSASLMechanisms: DIGEST-MD5 supportedSASLMechanisms: CRAM-MD5 supportedSASLMechanisms: NTLM supportedSASLMechanisms: LOGIN supportedSASLMechanisms: PLAIN # search result search: 3 result: 0 Success # numResponses: 2 Here is what I see in the server log: 2016-02-09T02:40:00.797598+00:00 ldap-test-master1 slapd[22379]: conn=1008 fd=14 ACCEPT from IP=172.17.8.240:47231 (IP=0.0.0.0:389) 2016-02-09T02:40:00.797640+00:00 ldap-test-master1 slapd[22379]: conn=1008 op=0 EXT oid=1.3.6.1.4.1.1466.20037 2016-02-09T02:40:00.797646+00:00 ldap-test-master1 slapd[22379]: conn=1008 op=0 STARTTLS 2016-02-09T02:40:00.797686+00:00 ldap-test-master1 slapd[22379]: conn=1008 op=0 RESULT oid= err=0 text= 2016-02-09T02:40:00.804071+00:00 ldap-test-master1 slapd[22379]: conn=1008 fd=14 TLS established tls_ssf=256 ssf=256 2016-02-09T02:40:00.804540+00:00 ldap-test-master1 slapd[22379]: conn=1008 op=1 BIND dn="" method=128 2016-02-09T02:40:00.804590+00:00 ldap-test-master1 slapd[22379]: conn=1008 op=1 RESULT tag=97 err=0 text= 2016-02-09T02:40:00.804931+00:00 ldap-test-master1 slapd[22379]: conn=1008 op=2 SRCH base="" scope=0 deref=0 filter="(objectClass=*)" 2016-02-09T02:40:00.804941+00:00 ldap-test-master1 slapd[22379]: conn=1008 op=2 SRCH attr=supportedSASLMechanisms 2016-02-09T02:40:00.805056+00:00 ldap-test-master1 slapd[22379]: conn=1008 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text= 2016-02-09T02:40:00.805483+00:00 ldap-test-master1 slapd[22379]: conn=1008 op=3 UNBIND 2016-02-09T02:40:00.805587+00:00 ldap-test-master1 slapd[22379]: conn=1008 fd=14 closed What should I be looking at? What am I missing? Thanks in advance, Bill

2 2

openldap 2.4.44 does not provide an slapd.d
by Mary Kao 10 Feb '16

10 Feb '16

Hello, I compiled openldap 2.4.44 on scientific linux and discovered it didn't create a slapd.d directory. There is however, a slapd.conf file. Is this right? If so, I would need to convert the slapd.conf file to slapd.d? Thanks!

2 1

Re: make posixGroup auxiliary in 2.4.40
by Chris 10 Feb '16

10 Feb '16

Michael StrÃ¶der wrote: > Chris wrote: >> I'm moving from OpenLDAP 2.2.x to 2.4.40 and have wasted hours trying to >> achieve the following: >> mailGroup (Postfix) is used as structural class, posixGroup (NIS) as auxiliary. >> Anyway. I can't add rfc2307bis schema, because NIS is already included. I've tried different methods to get rid of NIS, but they're not working. >> Is there any way to make posixGroup auxiliary? > Are you using static or dynamic configuration? > If you're using static configuration you simply omit nis.schema. I'm using dynamic configuration (Debian Jessie). > Note that rfc2307bis.schema requires a migration from old posixGroup entries > because the membership attribute also changes. They have already used rfc2307bis with static configuration and commented NIS out. They didn't use NIS, my bad. Nevertheless NIS is "included" in dynamic configuration. NIS and rfc2307 are mutually exclusive. The issue eased, since I can do without the rfc2307bis attributes, essentially posixGroup and gidNumber. Nevertheless, is there a way to use rfc2307bis with dynamic configuration? Should one switch to static config. in this case? - Chris

2 1

rebuilding the DIT
by Timothy Keith 09 Feb '16

09 Feb '16

How can I recreate the DIT using the output from slapcat ? I want to change the suffix when I do this. First, I ran slapcat: slapcat -v -l slapcat_backup.ldif Or just point me to the appropriate documentation. Tim

3 2

Authenticating mac users on ldap
by robert k Wild 09 Feb '16

09 Feb '16

Hi all, I want to know or if anyone has done it, i want to be able to login via my ldap user on a mac I know it works on linux as i have been able to login via ldap on my centos machine Also i have mounted my ldap server, (where all the home shares are) via autofs How can i get this to work Many thanks Rob

1 0

BINDDN in ~/.ldaprc ignored(?)
by Frank Thommen 09 Feb '16

09 Feb '16

Hi, BINDDN in ~/.ldaprc seems to be ignored or I'm doing something wrong. /etc/openldap/ldap.conf is empty. ~/.ldaprc is: $ cat ~/.ldaprc BINDDN <myBindDN> BASE <myBaseDN> URI ldaps://<myLDAPServer> TLS_REQCERT never $ ldapsearch returns an error if I don't declare the bindDN on the commandline: $ ldapsearch -W -v cn=xyz ldap_initialize( <DEFAULT> ) Enter LDAP Password: SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Local error (-2) additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (No Kerberos credentials available) $ Using strace I can see, that ~/.ldaprc is accessed by ldapsearch. So either BINDDN is ignored or I am doing something wrong. but works happily with the bindDN on the commandline: $ ldapsearch -D <myBindDN> -W -v cn=xyz ldap_initialize( <DEFAULT> ) Enter LDAP Password: [... ldapsearch results ...] $ Using strace I can see, that ~/.ldaprc is accessed by ldapsearch. So either BINDDN is ignored or I am doing something wrong. This is with openSUSE 13.1 and ldapsearch 2.4.33. Cheers Frank

3 3

Re: BINDDN in ~/.ldaprc ignored(?)
by Frank Thommen 09 Feb '16

09 Feb '16

On 02/09/2016 02:22 PM, Michael Wandel wrote: > On 09.02.2016 10:28, Frank Thommen wrote: >> Hi, >> >> BINDDN in ~/.ldaprc seems to be ignored or I'm doing something wrong. >> >> /etc/openldap/ldap.conf is empty. >> >> ~/.ldaprc is: >> >> $ cat ~/.ldaprc >> BINDDN <myBindDN> >> BASE <myBaseDN> >> URI ldaps://<myLDAPServer> >> TLS_REQCERT never >> $ >> >> >> ldapsearch returns an error if I don't declare the bindDN on the >> commandline: >> >> $ ldapsearch -W -v cn=xyz >> ldap_initialize( <DEFAULT> ) >> Enter LDAP Password: >> SASL/GSSAPI authentication started >> ldap_sasl_interactive_bind_s: Local error (-2) >> additional info: SASL(-1): generic failure: GSSAPI Error: >> Unspecified GSS failure. Minor code may provide more information (No >> Kerberos credentials available) >> $ >> > > can you please check if > > ldapsearch -x -W -v cn=xyz > > is working ? That works fine f. > > best regards > michael > >> Using strace I can see, that ~/.ldaprc is accessed by ldapsearch. So >> either BINDDN is ignored or I am doing something wrong. >> >> but works happily with the bindDN on the commandline: >> >> $ ldapsearch -D <myBindDN> -W -v cn=xyz >> ldap_initialize( <DEFAULT> ) >> Enter LDAP Password: >> [... ldapsearch results ...] >> $ >> >> Using strace I can see, that ~/.ldaprc is accessed by ldapsearch. So >> either BINDDN is ignored or I am doing something wrong. >> >> This is with openSUSE 13.1 and ldapsearch 2.4.33. >> >> >> Cheers >> Frank >> > > -- Frank Thommen | HD-HuB / DKFZ Heidelberg | f.thommen(a)dkfz-heidelberg.de | TP3: +49-6221-42-3562 (Mo+Di) | IPMB: +49-6221-54-5823 (Mi-Do)

1 0

make posixGroup auxiliary in 2.4.40
by Chris 09 Feb '16

09 Feb '16

Dear All, I'm moving from OpenLDAP 2.2.x to 2.4.40 and have wasted hours trying to achieve the following: mailGroup (Postfix) is used as structural class, posixGroup (NIS) as auxiliary. Anyway. I can't add rfc2307bis schema, because NIS is already included. I've tried different methods to get rid of NIS, but they're not working. Is there any way to make posixGroup auxiliary? Thank you in advance. - Chris

2 1

Re: [OpenLDAP][Authentication] SASL
by Timothy Keith 09 Feb '16

09 Feb '16

On Mon, Feb 8, 2016 at 6:07 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Monday, February 08, 2016 6:04 PM -0600 Timothy Keith > <timothy.g.keith(a)gmail.com> wrote: > >> On Sun, Feb 7, 2016 at 6:55 AM, Michael Ströder <michael(a)stroeder.com> >> wrote: >>> >>> Timothy Keith wrote: >>>> >>>> How can I know that slapd was built with -enable-spasswd ? >>> >>> >>> By looking at the configure command in the build script, spec file in >>> source RPM or whatever produced the binary builds you're using. >>> >>> Ciao, Michael. >>> >> >> I extracted the files from the yum binary packages. It is 2.4.40-7. >> I don't think there is a way to determine what the configure options >> were at build time. > > > You need to download the *source* RPM not the *binary* RPM, as the source > RPM includes the SPEC file used to build OpenLDAP. > > --Quanah > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > A division of Synacor, Inc This was found in a spec file from the src RPM : ./openldap-2/openldap.spec %configure \ --enable-rlookups \ \ --with-tls=moznss \ --with-cyrus-sasl \ \ --enable-wrappers \ \ --enable-passwd \ \ --enable-cleartext \ --enable-crypt \ --enable-spasswd \ --disable-lmpasswd \ --enable-modules \ --disable-sql \ \ --libexecdir=%{_libdir} \ $@ Looks okay for pass-through. Thanks, Tim

1 0

Re: [OpenLDAP][Authentication] SASL
by Timothy Keith 09 Feb '16

09 Feb '16

The first attempt fails : ldapwhoami -v -ZZ -Y EXTERNAL ldap_initialize( <DEFAULT> ) ldap_start_tls: Connect error (-11) additional info: TLS: hostname does not match CN in peer certificate This also fails : ldapsearch -LLL -Y EXTERNAL -H ldaps:/// -b "" -s base + ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) Tim On Thu, Jan 21, 2016 at 7:43 PM, Sergio NNX <sfhacker(a)hotmail.com> wrote: >> My scenario is relatively simple. > Simple, but it doesn't work, right? > > Are you after something similar to the output below? > > ldapwhoami -v -ZZ -Y EXTERNAL > > SASL/EXTERNAL authentication started > SASL username: 2.5.4.13=End User Certificate (OpenLDAP > 2.4.43),2.5.4.5=1234-2015 > -UK,title=Mr,ou=Finance Department,o=MateAR.eu IT > Solutions,l=Westminster,st=Lon > don,c=GB,email=info(a)matear.eu,0.9.2342.19200300.100.1.1=Administrator,dc=EU,cn=A > dministrator > SASL SSF: 0 > dn:description=end user certificate (openldap > 2.4.43),serialNumber=1234-2015-uk, > title=mr,ou=finance department,o=matear.eu it > solutions,l=westminster,st=london, > c=gb,email=info(a)matear.eu,uid=administrator,dc=eu,cn=administrator > Result: Success (0) > > > ldapsearch -LLL -Y EXTERNAL -H ldaps:/// -b "" -s base + > > SASL/EXTERNAL authentication started > SASL username: 2.5.4.13=End User Certificate (OpenLDAP > 2.4.43),2.5.4.5=1234-2015 > -UK,title=Mr,ou=Finance Department,o=MateAR.eu IT > Solutions,l=Westminster,st=Lon > don,c=GB,email=info(a)matear.eu,0.9.2342.19200300.100.1.1=Administrator,dc=EU,cn=A > dministrator > SASL SSF: 0 > dn: > structuralObjectClass: OpenLDAProotDSE > configContext: cn=config > monitorContext: cn=Monitor > namingContexts: dc=my-domain,dc=com > supportedControl: 1.3.6.1.4.1.4203.1.9.1.1 > supportedControl: 2.16.840.1.113730.3.4.18 > supportedControl: 2.16.840.1.113730.3.4.2 > supportedControl: 1.3.6.1.4.1.4203.1.10.1 > supportedControl: 1.3.6.1.1.22 > supportedControl: 1.2.840.113556.1.4.319 > supportedControl: 1.2.826.0.1.3344810.2.3 > supportedControl: 1.3.6.1.1.13.2 > supportedControl: 1.3.6.1.1.13.1 > supportedControl: 1.3.6.1.1.12 > supportedExtension: 1.3.6.1.4.1.1466.20037 > supportedExtension: 1.3.6.1.4.1.4203.1.11.1 > supportedExtension: 1.3.6.1.4.1.4203.1.11.3 > supportedExtension: 1.3.6.1.1.8 > supportedFeatures: 1.3.6.1.1.14 > supportedFeatures: 1.3.6.1.4.1.4203.1.5.1 > supportedFeatures: 1.3.6.1.4.1.4203.1.5.2 > supportedFeatures: 1.3.6.1.4.1.4203.1.5.3 > supportedFeatures: 1.3.6.1.4.1.4203.1.5.4 > supportedFeatures: 1.3.6.1.4.1.4203.1.5.5 > supportedLDAPVersion: 3 > supportedSASLMechanisms: SRP > supportedSASLMechanisms: SCRAM-SHA-1 > supportedSASLMechanisms: GSSAPI > supportedSASLMechanisms: GSS-SPNEGO > supportedSASLMechanisms: DIGEST-MD5 > supportedSASLMechanisms: EXTERNAL > supportedSASLMechanisms: OTP > supportedSASLMechanisms: CRAM-MD5 > supportedSASLMechanisms: NTLM > supportedSASLMechanisms: LOGIN > supportedSASLMechanisms: PLAIN > entryDN: > subschemaSubentry: cn=Subschema >

5 10

OpenLDAP 2.4.44 RPM packages available on LTB project
by Clément OUDOT 08 Feb '16

08 Feb '16

Hi, LTB RPM packages for OpenLDAP 2.4.44 are available: http://ltb-project.org/wiki/download#packages_for_red_hatcentos Debian packages should follow soon. -- Clément OUDOT Consultant en logiciels libres, Expert infrastructure et sécurité Savoir-faire Linux

1 0

LMDB mmap usage
by Kristoffer Sjögren 06 Feb '16

06 Feb '16

Hi Our application do lots of caching using vmtouch, up to a point where there isn't a lot of memory left on the machine. We would like to use LMDB on the same machine to store around 40GiB data of a few hundred million entries. How can we best understand the interaction and behavior of the OS cache and sharing of memory between processes? Is LMDB doing something to help the OS? Cheers, -Kristoffer

3 7

openSUSE packages (was: OpenLDAP 2.4.44 available)
by Michael Ströder 06 Feb '16

06 Feb '16

OpenLDAP Project wrote: > OpenLDAP 2.4.44 is now available for download For the impatient the updated openSUSE packages for OpenLDAP 2.4.44 are available in my build service home project: https://build.opensuse.org/package/show/home:stroeder:branches:network:ldap… The download repos for various versions: http://download.opensuse.org/repositories/home:/stroeder:/branches:/network… Ciao, Michael.

1 0

slapo-auditlog parsing tools?
by Chris Cook 05 Feb '16

05 Feb '16

I’m looking for a parsing tool for the logs generated by the auditlog overlay. Something more contextually aware and multiline then the string of greps I’ve accustomed myself to, but nothing as deep as a full ELK stack. Thanks Chris

2 1

LDAP and SELINUX
by Borresen, John - 0444 - MITLL 03 Feb '16

03 Feb '16

Does anyone out there in OpenLDAP land have experience with working with OpenLDAP and SELINUX? Running OpenLDAP 2.4.43 on a CentOS 7 VM. SELINUX is squashing client authentication connectivity - with SELINUX in enforcing, and a user fails login (No Such User) - nothing at all in the LDAP logs the only error is in the system auth.log. It acts as if the system authentication process does not pass off to LDAP when the user is not found locally; with SELINUX in Permissive, the user authenticates with the LDAP Server with no problems. If there is anyone who has been down this road it would be very much appreciated. Sincerely, John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Email: <mailto:john.borresen@ll.mit.edu> john.borresen(a)ll.mit.edu

2 2

problem with slapadd in migrating LDAP servers
by k j 02 Feb '16

02 Feb '16

Hello to all. My situation is the following. Migrating from an older Suse server : # rpm -qa | grep -i openldap openldap2-2.4.12-7.19.1 openldap2-client-2.4.12-7.19.1 to a New RHEL 6.6 server: # rpm -qa |grep ldap mod_authz_ldap-0.26-16.el6.x86_64 sssd-ldap-1.11.6-30.el6_6.4.x86_64 apr-util-ldap-1.3.9-3.el6_0.1.x86_64 openldap-clients-2.4.39-8.el6.x86_64 openldap-2.4.39-8.el6.x86_64 openldap-servers-2.4.39-8.el6.x86_64 compat-openldap-2.3.43-2.el6.x86_64 My exported information looks to be in order, has 47,000 lines but when I try to import it I run into trouble. ldapadd -x -D "cn=administrator,dc=mydomain,dc=com" -W -f nis.ldif.ldapDump When prompted for a password I am using the password from the old server (Suse) and that fails, thinking that no password has been setup on the new server I tried an empty password and that also failed. Next I tried setting a new password 'ldappasswd Testing123' but that gave a SASL failure GSSAPI error :( additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Ticket expired) Am I going down the wrong road or what? Thanks for any help,KJ

2 5

Fwd: openldap.org mailing list memberships reminder
by Phill Edwards 02 Feb '16

02 Feb '16

I received this today and was shocked to see my password in the email. In this day and age a technology group like this should know far better than to do that. It's bad enough you keep unencrypted passwords, but then to send them our in an email is reckless and irresponsible. Regards, Phill Edwards ---------- Forwarded message ---------- From: <mailman-owner(a)openldap.org> Date: 1 Feb 2016 4:24 PM Subject: openldap.org mailing list memberships reminder To: <philledwards(a)gmail.com> Cc: > This is a reminder, sent out once a month, about your openldap.org > mailing list memberships. It includes your subscription info and how > to use it to change it or unsubscribe from a list. > > You can visit the URLs to change your membership status or > configuration, including unsubscribing, setting digest-style delivery > or disabling delivery altogether (e.g., for a vacation), and so on. > > In addition to the URL interfaces, you can also use email to make such > changes. For more info, send a message to the '-request' address of > the list (for example, mailman-request(a)openldap.org) containing just > the word 'help' in the message body, and an email message will be sent > to you with instructions. > > If you have questions, problems, comments, etc, send them to > mailman-owner(a)openldap.org. Thanks! > > Passwords for philledwards(a)gmail.com: > > List Password // URL > ---- -------- > openldap-technical(a)openldap.org <removed> > http://www.openldap.org/lists/mm/options/openldap-technical/philledwards%40…

4 3

openldap on scientific linux
by Mary Kao 01 Feb '16

01 Feb '16

Hello, I am setting up Openldap on scientific linux version 6.7. Is it better to use the install packages e.g. yum install openldap-servers openldap-clients or to download the openldap source, and compile on my system? Thank you.

2 1

Re: Removing olcAccess entry
by Katherine Faella 01 Feb '16

01 Feb '16

On Tue, Jan 12, 2016 at 2:47 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, January 12, 2016 2:38 PM -0500 Katherine Faella <kmf(a)uri.edu> > wrote: > > Which is where I am having trouble. I believe that deleting the {0} >> element should keep the {1} and move it up to the correct position. >> > > I do this extensively, and it works fine. What OpenLDAP release are you > on? > > --Quanah > > > I was afraid you were going to ask that. We are running the Redhat 6 supported 2.4.40-7.el6_7. We have a policy here of sticking with the redhat supported releases of packages since our staff is so small. I really need to resolve this for an important project here. Of course the project is behind schedule and I am left with little time to get my stuff working. I was hoping my syntax was just incorrect. The only other way I can image fixing this is to revert to slapd.conf .... I guess the good news is that my steps and syntax look okay to you. If you have any other thoughts I would happily accept them. Thanks, Kathy -- Katherine Faella tel: (401) 874-4469 Senior Technical Programmer kmf(a)uri.edu University of Rhode Island University Computing Systems(UCS) 210 Flagg Road Kingston, Rhode Island

2 2

Re: [OpenLDAP][Authentication] SASL
by Timothy Keith 01 Feb '16

01 Feb '16

My scenario is relatively simple. The user authentication and LDAP directory for our local application is managed on corporate servers for which we lack administrative rights. We wish to maintain a local view of the LDAP directory for the information that our local application requires, but not alter the user authentication on the corporate servers. Tim On Thu, Jan 21, 2016 at 6:21 PM, Sergio NNX <sfhacker(a)hotmail.com> wrote: >> I am new at LDAP , that is obvious I guess. But, I've been around Unix >> for 30 years. > > Are we still having issues? We might be able to assist you if you describe > your set up and your goal in more detail. > > Cheers, > > Ser. > >> Date: Thu, 21 Jan 2016 14:31:28 -0600 >> From: dwhite(a)cafedemocracy.org >> To: timothy.g.keith(a)gmail.com >> Subject: Re: pass-through authentication >> CC: dwhite(a)cafedemocracy.org; openldap-technical(a)openldap.org >> >> You can view your config with: >> >> slapcat -n0 >> >> And verify that object exists. >> >> If you're receiving this error due to an ACL problem, verify you >> have the proper configuration in place to authenticate as the rootdn using >> sasl/external. See the slapd-config manpage, and see section 15.2 (and in >> particular 15.2.5) of the Administrator's guide, and reference your >> OS/distro documentation. >> >> On 01/21/16 12:35 -0600, Timothy Keith wrote: >> >I commented the mech_list in slapd.conf >> > >> >The ldapsearch result is now No such object >> > >> >ldapsearch -LLLQY EXTERNAL -H ldapi:/// -b cn=config >> >"(|(cn=config)(olcDatabase={1}hdb))" >> >No such object (32) >> > >> >On Fri, Jan 8, 2016 at 2:34 PM, Dan White <dwhite(a)cafedemocracy.org> >> > wrote: >> >> On 01/07/16 17:24 -0600, Timothy Keith wrote: >> >>> >> >>> ldapsearch -LLLQY EXTERNAL -H ldapi:/// -b cn=config >> >>> "(|(cn=config)(olcDatabase={1}hdb))" >> >>> ldap_sasl_interactive_bind_s: Authentication method not supported (7) >> >>> additional info: SASL(-4): no mechanism available: >> >> >> >> >> >> I'm missing some context here. Most likely you have a mech_list hard >> >> coded >> >> in your slapd.conf sasl, which does not include the external mech. >>

2 1

openldap and slapd.conf file
by Mary Kao 29 Jan '16

29 Jan '16

Hello, I've seen information indicating that slapd.conf is no longer in use in OpenLDAP, however the release 2.4.xx comes with a slapd.conf. Can someone please clarify what this file is used for in release 2.4.xx? Would be greatly appreciated. Thank you!

2 1

Lastbind
by Lindolfo Meira 29 Jan '16

29 Jan '16

I noticed the lastbind module won't log public key authentications. Is this the expected behavior? I'm using OpenLDAP 2.4.33. Cheers, L. Meira.

2 1

ldap client login
by Lane 29 Jan '16

29 Jan '16

I'm trying to log into an LDAP client. Below I show a login from the ldap server to the ldap client, and another from a normal workstation on the same subnet to the ldap client. The workstation is able to login, but am not able to login from the ldap server. server: OpenLDAP 2.4.43 clients: nss-pam-ldapd 0.9.6 Any help much appreciated. --- from ldap server to ldap client (fails) $ ssh -l james 10.0.1.2 Enter passphrase for key '/home/james/.ssh/id_rsa': You are required to change your password immediately (root enforced) WARNING: Your password has expired. You must change your password now and login again! New password: Retype new password: password change failed: Server is unwilling to perform passwd: password updated successfully Connection to 10.0.1.2 closed. --- from worstation to ldap client (succeeds) $ ssh node-2 Password: You are required to change your password immediately (root enforced) need a new password New password: Retype new password: password change failed: Insufficient access node-2(james):~$ $ ldapsearch -x -b 'dc=my,dc=example,dc=com' '(objectclass=*)' # extended LDIF # # LDAPv3 # base <dc=my,dc=example,dc=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # my.example.com dn: dc=my,dc=example,dc=com dc: cem objectClass: dcObject objectClass: organization o: CEM # manager, my.example.com dn: cn=manager,dc=my,dc=example,dc=com objectClass: organizationalRole cn: Manager description: LDAP Admin # groups, my.example.com dn: ou=groups,dc=my,dc=example,dc=com ou: groups description: Groups objectClass: organizationalUnit # users, my.example.com dn: ou=users,dc=my,dc=example,dc=com ou: users description: Users objectClass: organizationalUnit # james, groups, my.example.com dn: cn=james,ou=groups,dc=my,dc=example,dc=com cn: james objectClass: top objectClass: posixGroup gidNumber: 1000 # james, users, my.example.com dn: uid=james,ou=users,dc=my,dc=example,dc=com cn: James uid: james uidNumber: 1000 gidNumber: 1000 sn: James homeDirectory: /home/james mail: james(a)example.com objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount loginShell: /bin/bash gecos: james shadowLastChange: 0 userPassword:: e1NTSEF9ZjhRMGwwaDk1ek9mMUViaDhreDNlUEsvdFhFb29wV3I= shadowMax: 9999 shadowWarning: 14 # search result search: 2 result: 0 Success # numResponses: 7 # numEntries: 6 /etc/pam.d/system-auth --- auth required pam_env.so auth sufficient pam_unix.so try_first_pass likeauth nullok auth sufficient pam_ldap.so use_first_pass auth required pam_deny.so account required pam_unix.so account [default=bad success=ok user_unknown=ignore] pam_ldap.so account optional pam_permit.so password required pam_cracklib.so difok=2 minlen=8 dcredit=2 ocredit=2 retry=3 password sufficient pam_unix.so try_first_pass use_authtok nullok sha512 shadow password sufficient pam_ldap.so use_authtok use_first_pass password optional pam_permit.so session required pam_limits.so session required pam_env.so session optional pam_ldap.so session required pam_unix.so session optional pam_permit.so

1 0

OCSP for LDAP Client
by Jason Talley 29 Jan '16

29 Jan '16

I've been asked to enable OCSP checking in our client (connecting to any LDAP server) . The client uses OpenLdap api's for managing the connection to the server. From my recent birth-by-fire education on certs and security, OCSP checking appears more or less to be a manual process rather than having OpenSSL do all the work auto-magically as part of the handshake (ignoring ocsp stapling which I'm avoiding). I don't see any options in openssl s_client (for testing) to enable OCSP -- only a separate utility to manually check based on captured client certs. Storing the CRL in the LDAP DB isn't an option. For whatever reason, OCSP is required. Is there any way to enable OCSP checking via the current LDAP API? Assuming the answer is no, then would a reasonable approach be to manually query the server URL from time to time, and verify the certificate in the background? Traffic from our client should be relatively minimal, so even at a rate of one verification an hour should have a minimal risk window of the cert being expired. Using this method I can more or less follow the same logic as the openssl utilities (s_client and ocsp). TIA.

3 2

simple question
by Aleksandar Karalejić 28 Jan '16

28 Jan '16

Hi OpenLDAP team, I have a question, simple I hope, for you - I need to send client certificate to the server openldap server (by using openldap api and openSSL). For completing this job, first I initalized ldap with url containing ldaps in the url scheme (ldaps://fqdn_of_ldap_server:636). I have set LDAP_OPT_PROTOCOL_VERSION -> LDAP_VERSION3 LDAP_OPT_X_TLS_PROTOCOL_MIN -> LDAP_OPT_X_TLS_PROTOCOL_TLS1_2 LDAP_OPT_X_TLS_REQUIRE_CERT -> LDAP_OPT_X_TLS_DEMAND LDAP_OPT_X_TLS_CONNECT_ARG -> fqdn_of_ldap_server LDAP_OPT_X_TLS_CONNECT_CB -> my_tsl_verify_callback and then I called ldap_sasl_bind: ldap_sasl_bind(mLdapObj, NULL, "EXTERNAL", NULL, NULL, NULL, &msgid); What I saw is that certficate from the server was received, but how to send client certifikate. I played arround with LDAP_OPT_X_TLS_CERTFILE (sending the abs path to the .pem file) but nothing. Also, I saw that this parameter was not taken into account - it looks like ssl_ctx object used for ssl_connect does not include path to the file (like two global structures used for setting up ctx know nothing about each other.) Can you, help me with this? Regards, Aleksandar

2 4

OpenLdap + Cyrus SASL + MIT Kerberos credentials cache
by Petar Kovačević 28 Jan '16

28 Jan '16

Hi All, I'm working on Windows application that uses libldap built with cyrus sasl and MIT Kerberos and I'm having issues with Kerberos authentication on AD. I have tested with various applications and Kerberos is working properly on server. In my app I'm using ldap_sasl_interactive_bind_s(mLdapObj, NULL, "GSSAPI", NULL, NULL, LDAP_SASL_INTERACTIVE, my_ldap_sasl_interact, defaults) in order to bind with server, but I get error -2 (Local error). I have debugged the app and I have found that there is an issue with Keberos Credentials Cache. Because I haven't set credentials cache location, Kerberos reads this location from KRB5CCNAME environment variable. So my first question is : Is there any API in libldap, so we can set our own contact cache location? But even when I set this variable, I get same error when I try to bind. After some more debugging I found that Kerberos expects that I already have credentials cache file created, and that there is a ticket in it(as a I have called kinit before bind). Is there an API in libldap, that will call Kerberos API for credentials cache and ticket obtaining operations, which we can call before bind, or we need to call Kerberos API directly ? Thank you for your help. Best Regards, Petar Kovacevic

2 3

Re: [OpenLDAP][Authentication] SASL
by Timothy Keith 28 Jan '16

28 Jan '16

I don't yet have access to the corporate LDAP service on the production Unix servers. To serve that purpose for testing I am using Apache Directory server on Windows. The test example I'm using is for Active Directory, but I think the pass-through tutorial ought to work basically the same for evaluation purposes. Tim

1 0

Re: acl bug?
by BÖSCH Christian 27 Jan '16

27 Jan '16

> On 26 Jan 2016, at 14:34 , julien soula <julien.soula(a)univ-lille2.fr> wrote: > > On Tue, Jan 26, 2016 at 11:43:59AM +0000, BÖSCH Christian wrote: >> >> Jan 26 12:35:46 openldap1 slapd[84283]: => mdb_entry_get: found entry: "uid=user1,ou=people,o=abc.net" >> Jan 26 12:35:46 openldap1 slapd[84283]: => mdb_entry_get: found entry: "cn=group,ou=groups,o=abc.net" > > are you sure that "uid=user1,ou=people,o=abc.net" is a member of > "cn=group,ou=groups,o=abc.net” ? yes i am. to me it seems that filter= following with attrs= (tested with several filters and attributes) does not work. if i omit attrs= it works to hide the whole entry. if i use a dn instead of filter i can use the attrs= to hide a single attribute. christian > > cdt, > -- > Julien > << Vous n'avez rien a dire... Parlons-en! >>

2 3

Problems with log entries order
by Dario Zanzico 27 Jan '16

27 Jan '16

Writing a script for parsing openldap logs I found that, for some of my connections, the BIND log entry precedes the corresponding ACCEPT entry (which as far as i understand must logically precede the BIND) example: 2016-01-25T12:54:02.131094+01:00 HOSTNAME slapd[15258]: conn=91596 op=0 BIND dn="" method=128 2016-01-25T12:54:02.131099+01:00 HOSTNAME slapd[15258]: conn=91596 op=0 RESULT tag=97 err=0 text= 2016-01-25T12:54:02.131103+01:00 HOSTNAME slapd[15258]: conn=91596 fd=93 ACCEPT from [CUT] slapd is started with the '-l local4' parameter, and rsyslogd is configured to send local4.* to the openldap.log file suspecting some rsyslogd problems i tried running slapd using the "-d 256" parameter, but in the output i found 56a6202b conn=1004 op=0 BIND dn="" method=128 56a6202b conn=1004 op=0 RESULT tag=97 err=0 text= 56a6202b conn=1004 fd=13 ACCEPT from [CUT] Is there any way to guarantee openldap to generate ordered logs? thanks, dario

2 2

Updating Symas LMDB page to add Nim Binding?
by Paul Jackson 26 Jan '16

26 Jan '16

Hi, How would I go about, or to whom would I suggest, adding Nim to the list of languages with LMDB wrappers to the page http://symas.com/mdb/. There is a Nim wrapper for LMDB at https://github.com/fowlmouth/lmdb.nim (Caveat: I cannot vouch for the quality of this wrapper, being new to both Nim and LMDB.) Thanks. -- Paul Jackson pj(a)usa.net

2 1

acl bug?
by BÖSCH Christian 26 Jan '16

26 Jan '16

hi, i’m using this acl: {0}to filter=(objectclass=person) attrs=Hidden by group.exact=“cn=group,ou=groups,o=abc.net” none but members of the group can still access the attribute Hidden. with any filter it does not work. if i use a single dn it works. seems to me filters do not work? chris

2 3

missing init script
by Chuck Theobald 26 Jan '16

26 Jan '16

I'm building OpenLDAP version 2.4.40 from source but am unable to locate the init script. It does not install with 'make install'. Should this script be part of the source distribution? Thanks, -- Chuck Theobald System Administrator The Robert and Beverly Lewis Center for Neuroimaging University of Oregon P: 541-346-0343 F: 541-346-0345

5 5

Re: Problems with log entries order
by Dario Zanzico 25 Jan '16

25 Jan '16

On Mon, Jan 25, 2016, at 03:16 PM, Леонид Юрьев wrote: > In general it is impossible, but only if build slapd without > multithreading. You mean an instance built with --without-threads? > On the other hand, you can try ReOpenLDAP fork - it adds thread-id > prefix for each log-record. > Therefore is possible to filter/split syslog per thread-id, e.g. get > an ordered log for the each slapd-thread. I'll keep this in mind, thanks again > Leonid. dario

1 0

problems with acl
by BÖSCH Christian 25 Jan '16

25 Jan '16

Hi, I want to hide an attribute to members of a group by each other but allowing these members to see this attribute of all other users. So I use this ACLs: olcAccess: {0}to filter=(memberof=cn=group,ou=special,o=abc.net) attrs=PrivateAttr by group.exact="cn=group,ou=special,o=abc.net" none by * break olcAccess: {1}to attrs=PrivateAttr by group.exact="cn=group,ou=special,o=abc.net" ssf=128 read olcAccess: {2}to attrs=userPassword by self write by anonymous auth by * none olcAccess: {3}to * by * read uid=user1,ou=people,o=abc.net <http://abc.net/> and uid=user2,ou=people,o=abc.net <http://abc.net/> are both members of cn=group,ou=special,o=abc.net <http://abc.net/> and the memberOf overlay seems to work also the filter in acl#0: dn: uid=user1,ou=people,o=abc.net memberOf: cn=group,ou=special,o=abc.net dn: uid=user2,ou=people,o=abc.net memberOf: cn=group,ou=special,o=abc.net but if user2 searches for PrivateAttr of user1 it gets the attribute. can anyone give me a hint what’s wrong? many thanks, christian here the log: Jan 25 09:16:56 openldap1 slapd[58851]: => mdb_entry_get: found entry: "uid=user2,ou=people,o=abc.net" Jan 25 09:16:56 openldap1 slapd[58851]: => access_allowed: search access to "o=abc.net" "entry" requested Jan 25 09:16:56 openldap1 slapd[58851]: => acl_get: [4] attr entry Jan 25 09:16:56 openldap1 slapd[58851]: => acl_mask: access to entry "o=abc.net", attr "entry" requested Jan 25 09:16:56 openldap1 slapd[58851]: => acl_mask: to all values by "uid=user2,ou=people,o=abc.net", (=0) Jan 25 09:16:56 openldap1 slapd[58851]: <= check a_dn_pat: * Jan 25 09:16:56 openldap1 slapd[58851]: <= acl_mask: [1] applying read(=rscxd) (stop) Jan 25 09:16:56 openldap1 slapd[58851]: <= acl_mask: [1] mask: read(=rscxd) Jan 25 09:16:56 openldap1 slapd[58851]: => slap_access_allowed: search access granted by read(=rscxd) Jan 25 09:16:56 openldap1 slapd[58851]: => access_allowed: search access granted by read(=rscxd) Jan 25 09:16:56 openldap1 slapd[58851]: => access_allowed: search access to "uid=user1,ou=people,o=abc.net" "uid" requested Jan 25 09:16:56 openldap1 slapd[58851]: => acl_get: [4] attr uid Jan 25 09:16:56 openldap1 slapd[58851]: => acl_mask: access to entry "uid=user1,ou=people,o=abc.net", attr "uid" requested Jan 25 09:16:56 openldap1 slapd[58851]: => acl_mask: to value by "uid=user2,ou=people,o=abc.net", (=0) Jan 25 09:16:56 openldap1 slapd[58851]: <= check a_dn_pat: * Jan 25 09:16:56 openldap1 slapd[58851]: <= acl_mask: [1] applying read(=rscxd) (stop) Jan 25 09:16:56 openldap1 slapd[58851]: <= acl_mask: [1] mask: read(=rscxd) Jan 25 09:16:56 openldap1 slapd[58851]: => slap_access_allowed: search access granted by read(=rscxd) Jan 25 09:16:56 openldap1 slapd[58851]: => access_allowed: search access granted by read(=rscxd) Jan 25 09:16:56 openldap1 slapd[58851]: => access_allowed: read access to "uid=user1,ou=people,o=abc.net" "entry" requested Jan 25 09:16:56 openldap1 slapd[58851]: => acl_get: [4] attr entry Jan 25 09:16:56 openldap1 slapd[58851]: => acl_mask: access to entry "uid=user1,ou=people,o=abc.net", attr "entry" requested Jan 25 09:16:56 openldap1 slapd[58851]: => acl_mask: to all values by "uid=user2,ou=people,o=abc.net", (=0) Jan 25 09:16:56 openldap1 slapd[58851]: <= check a_dn_pat: * Jan 25 09:16:56 openldap1 slapd[58851]: <= acl_mask: [1] applying read(=rscxd) (stop) Jan 25 09:16:56 openldap1 slapd[58851]: <= acl_mask: [1] mask: read(=rscxd) Jan 25 09:16:56 openldap1 slapd[58851]: => slap_access_allowed: read access granted by read(=rscxd) Jan 25 09:16:56 openldap1 slapd[58851]: => access_allowed: read access granted by read(=rscxd) Jan 25 09:16:56 openldap1 slapd[58851]: => access_allowed: result not in cache (PrivateAttr) Jan 25 09:16:56 openldap1 slapd[58851]: => access_allowed: read access to "uid=user1,ou=people,o=abc.net" "PrivateAttr" requested Jan 25 09:16:56 openldap1 slapd[58851]: => access_allowed: search access to "uid=user1,ou=people,o=abc.net" "memberOf" requested Jan 25 09:16:56 openldap1 slapd[58851]: => acl_get: [2] attr PrivateAttr Jan 25 09:16:56 openldap1 slapd[58851]: => acl_mask: access to entry "uid=user1,ou=people,o=abc.net", attr "PrivateAttr" requested Jan 25 09:16:56 openldap1 slapd[58851]: => acl_mask: to value by "uid=user2,ou=people,o=abc.net", (=0) Jan 25 09:16:56 openldap1 slapd[58851]: <= check a_group_pat: cn=group,ou=special,o=abc.net Jan 25 09:16:56 openldap1 slapd[58851]: => mdb_entry_get: found entry: "cn=group,ou=special,o=abc.net" Jan 25 09:16:56 openldap1 slapd[58851]: <= check a_authz.sai_ssf: ACL 128 > OP 256 Jan 25 09:16:56 openldap1 slapd[58851]: <= acl_mask: [1] applying read(=rscxd) (stop) Jan 25 09:16:56 openldap1 slapd[58851]: <= acl_mask: [1] mask: read(=rscxd) Jan 25 09:16:56 openldap1 slapd[58851]: => slap_access_allowed: read access granted by read(=rscxd) Jan 25 09:16:56 openldap1 slapd[58851]: => access_allowed: read access granted by read(=rscxd) Jan 25 09:16:56 openldap1 slapd[58851]: connection_read(35): no connection!

1 0

Re: [OpenLDAP][Authentication] SASL
by Timothy Keith 22 Jan '16

22 Jan '16

The supported SASL mechanisms are CRAM-MD5 and DIGEST-MD5 [tkeith@kif ~]$ ldapsearch -x -H ldap://localhost -b "" -s base supportedSASLMechanisms # extended LDIF # # LDAPv3 # base <> with scope baseObject # filter: (objectclass=*) # requesting: supportedSASLMechanisms # # dn: supportedSASLMechanisms: CRAM-MD5 supportedSASLMechanisms: DIGEST-MD5 # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 But this returns : no mechanism available: ldapwhoami -v -ZZZ -Y EXTERNAL -h localhost ldap_initialize( ldap://localhost ) SASL/EXTERNAL authentication started ldap_sasl_interactive_bind_s: Unknown authentication method (-6) additional info: SASL(-4): no mechanism available: Tim On Fri, Jan 22, 2016 at 11:36 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > Please keep replies to the list. > > --Quanah > > > --On Friday, January 22, 2016 11:26 AM -0600 Timothy Keith > <timothy.g.keith(a)gmail.com> wrote: > >> ldapwhoami -v -ZZ -Y EXTERNAL -h localhost >> ldap_initialize( ldap://localhost ) >> SASL/EXTERNAL authentication started >> ldap_sasl_interactive_bind_s: Unknown authentication method (-6) >> additional info: SASL(-4): no mechanism available: >> >> >> ldapsearch -h localhost -LLL -Y EXTERNAL -b "" -s base + >> SASL/EXTERNAL authentication started >> ldap_sasl_interactive_bind_s: Unknown authentication method (-6) >> additional info: SASL(-4): no mechanism available: >> >> >> Tim >> >> On Fri, Jan 22, 2016 at 10:10 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> >> wrote: >>> >>> --On Friday, January 22, 2016 9:38 AM -0600 Timothy Keith >>> <timothy.g.keith(a)gmail.com> wrote: >>> >>>> The first attempt fails : >>>> >>>> ldapwhoami -v -ZZ -Y EXTERNAL >>>> ldap_initialize( <DEFAULT> ) >>>> ldap_start_tls: Connect error (-11) >>>> additional info: TLS: hostname does not match CN in peer >>>> certificate >>> >>> >>> >>> Why do you expect this to work? You failed to supply -H with a valid >>> ldap:// URI. >>> >>>> This also fails : >>>> >>>> ldapsearch -LLL -Y EXTERNAL -H ldaps:/// -b "" -s base + >>>> ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) >>> >>> >>> >>> Why do you expect this to work? You passed -H without providing a host. >>> >>> --Quanah >>> >>> >>>> >>>> Tim >>>> >>>> >>>> On Thu, Jan 21, 2016 at 7:43 PM, Sergio NNX <sfhacker(a)hotmail.com> >>>> wrote: >>>>>> >>>>>> >>>>>> My scenario is relatively simple. >>>>> >>>>> >>>>> Simple, but it doesn't work, right? >>>>> >>>>> Are you after something similar to the output below? >>>>> >>>>> ldapwhoami -v -ZZ -Y EXTERNAL >>>>> >>>>> SASL/EXTERNAL authentication started >>>>> SASL username: 2.5.4.13=End User Certificate (OpenLDAP >>>>> 2.4.43),2.5.4.5=1234-2015 >>>>> -UK,title=Mr,ou=Finance Department,o=MateAR.eu IT >>>>> Solutions,l=Westminster,st=Lon >>>>> don,c=GB,email=info(a)matear.eu,0.9.2342.19200300.100.1.1=Administrator, >>>>> dc =EU,cn=A dministrator >>>>> SASL SSF: 0 >>>>> dn:description=end user certificate (openldap >>>>> 2.4.43),serialNumber=1234-2015-uk, >>>>> title=mr,ou=finance department,o=matear.eu it >>>>> solutions,l=westminster,st=london, >>>>> c=gb,email=info(a)matear.eu,uid=administrator,dc=eu,cn=administrator >>>>> Result: Success (0) >>>>> >>>>> >>>>> ldapsearch -LLL -Y EXTERNAL -H ldaps:/// -b "" -s base + >>>>> >>>>> SASL/EXTERNAL authentication started >>>>> SASL username: 2.5.4.13=End User Certificate (OpenLDAP >>>>> 2.4.43),2.5.4.5=1234-2015 >>>>> -UK,title=Mr,ou=Finance Department,o=MateAR.eu IT >>>>> Solutions,l=Westminster,st=Lon >>>>> don,c=GB,email=info(a)matear.eu,0.9.2342.19200300.100.1.1=Administrator, >>>>> dc =EU,cn=A dministrator >>>>> >>>>> >>>>> SASL SSF: 0 >>>>> dn: >>>>> structuralObjectClass: OpenLDAProotDSE >>>>> configContext: cn=config >>>>> monitorContext: cn=Monitor >>>>> namingContexts: dc=my-domain,dc=com >>>>> supportedControl: 1.3.6.1.4.1.4203.1.9.1.1 >>>>> supportedControl: 2.16.840.1.113730.3.4.18 >>>>> supportedControl: 2.16.840.1.113730.3.4.2 >>>>> supportedControl: 1.3.6.1.4.1.4203.1.10.1 >>>>> supportedControl: 1.3.6.1.1.22 >>>>> supportedControl: 1.2.840.113556.1.4.319 >>>>> supportedControl: 1.2.826.0.1.3344810.2.3 >>>>> supportedControl: 1.3.6.1.1.13.2 >>>>> supportedControl: 1.3.6.1.1.13.1 >>>>> supportedControl: 1.3.6.1.1.12 >>>>> supportedExtension: 1.3.6.1.4.1.1466.20037 >>>>> supportedExtension: 1.3.6.1.4.1.4203.1.11.1 >>>>> supportedExtension: 1.3.6.1.4.1.4203.1.11.3 >>>>> supportedExtension: 1.3.6.1.1.8 >>>>> supportedFeatures: 1.3.6.1.1.14 >>>>> supportedFeatures: 1.3.6.1.4.1.4203.1.5.1 >>>>> supportedFeatures: 1.3.6.1.4.1.4203.1.5.2 >>>>> supportedFeatures: 1.3.6.1.4.1.4203.1.5.3 >>>>> supportedFeatures: 1.3.6.1.4.1.4203.1.5.4 >>>>> supportedFeatures: 1.3.6.1.4.1.4203.1.5.5 >>>>> supportedLDAPVersion: 3 >>>>> supportedSASLMechanisms: SRP >>>>> supportedSASLMechanisms: SCRAM-SHA-1 >>>>> supportedSASLMechanisms: GSSAPI >>>>> supportedSASLMechanisms: GSS-SPNEGO >>>>> supportedSASLMechanisms: DIGEST-MD5 >>>>> supportedSASLMechanisms: EXTERNAL >>>>> supportedSASLMechanisms: OTP >>>>> supportedSASLMechanisms: CRAM-MD5 >>>>> supportedSASLMechanisms: NTLM >>>>> supportedSASLMechanisms: LOGIN >>>>> supportedSASLMechanisms: PLAIN >>>>> entryDN: >>>>> subschemaSubentry: cn=Subschema >>>>> >>>> >>> >>> >>> >>> -- >>> >>> Quanah Gibson-Mount >>> Platform Architect >>> Zimbra, Inc. >>> -------------------- >>> Zimbra :: the leader in open source messaging and collaboration > > > > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration

1 0

Re: pass-through authentication
by Timothy Keith 21 Jan '16

21 Jan '16

saslauthd -v saslauthd 2.1.23 authentication mechanisms: getpwent kerberos5 pam rimap shadow ldap Tim

2 5

LDAP with MySQL Support and Radius
by Alexandre Vilarinho 20 Jan '16

20 Jan '16

Hello all I'm trying to install LDAP wirh mysql support to authenticate users radius account and I'm having problems finding documentation explaining how to do it. Does any implemented an environment link I'm willing to do? It is possible to share this documentation? Is there a step-by-step explaining how to do it? Regards Alex

2 1

Using LMDB without memory mapped files
by José Felix Torre Santos 20 Jan '16

20 Jan '16

Hello. I am using LMDB in an investigation project. It works perfectly with persistence and concurrent processes. But in some occasions I want to run an standalone process without persistence and as fast as possible. I could do it with other binary-tree libraries written in C, but I’d like not to rewrite mi code. Is there any way to configure or modify LMDB code to work in main memory instead memory mapped files? Thanks in advance. [cid:image9234d9.PNG@cd3fba1a.44af0ea3]<http://www.semantic-systems.com> José Felix Torre Santos Responsable de Plataforma Repcon jts(a)semantic-systems.com T: +34 94 454 55 50 SOPORTE: +34 902 310 123 www.semantic-systems.com<http://www.semantic-systems.com> [cid:imaged7b0f2.PNG@4b89a6f6.41bfb648] ________________________________ Este correo electrónico y en su caso cualquier fichero adjunto al mismo contienen información de carácter confidencial exclusivamente dirigida a sus destinatarios. Queda prohibida su divulgación, copia o distribución a terceros sin la previa autorización escrita de SEMANTIC SYSTEMS, S.L. En el caso de haber recibido este correo electrónico por error, rogamos nos notifique inmediatamente esta circunstancia mediante su reenvío a la dirección electrónica del remitente. Los datos personales que Ud. nos haya facilitado y, especialmente su dirección de correo electrónico, figuran incorporados a un fichero con el fin de gestionar nuestras relaciones y cuya responsabilidad corresponde a SEMANTIC SYSTEMS, S.L., que garantiza el tratamiento de sus datos de carácter personal de conformidad con la Ley Orgánica 15/1999, de Protección de Datos de Carácter Personal. Ud. podrá ejercitar sus derechos de acceso, rectificación, cancelación y oposición ante SEMANTIC SYSTEMS, S.L., en la Avenida del Txoriherri nº 9 2º planta – Derio (48160) Vizcaya The information contained in and/or attached to this e-mail message is intended solely for the use of the addressees. It is not to be disclosed, copied or distributed to any third party without the prior written permission of SEMANTIC SYSTEMS, S.L. If you have received this email in error, please immediately notify us by forwarding to the sender's email address. Personal data provided to us and especially your email address, are stored in a file in order to manage our relationships and SEMANTIC SYSTEMS, S.L. is the responsible, ensuring the processing of your personal data in accordance with the Organic Law 15/1999 of 13 December on the Protection of Personal Data. You can exercise your rights of access, rectification, cancellation and opposition to SEMANTIC SYSTEMS, S.L., Avenida del Txoriherri nº 9 2º planta – Derio (48104) Vizcaya

2 1

slapd dying with mdb databases
by Angel L. Mateo 19 Jan '16

19 Jan '16

Hello, After changing my databases from hdb to mdb I'm having problems with it. My problem is that after a few days of slapd running without any problem (this time it has been more than a week), then it suddenly dies and whenever I restart it, it dies immediately. I have run slapd with -d 16000 and last debug message it shows is: 569decb8 <= root access granted 569decb8 => access_allowed: search access granted by manage(=mwrscxd) ../../../../../servers/slapd/back-mdb/../../../libraries/liblmdb/mdb.c:5276: Assertion 'NUMKEYS(mp) > 1' failed in mdb_page_search_root() In order to be able to run again, I have to delete the database and start slapd with no db (so it reloads it completely with syncrepl). I'm running openldap 2.4.43 (compiled by me) in a ubuntu 14.04 server. Any help? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868887590 Fax: 868888337

2 1

Output differs when searching via translucent proxy
by M. P. 15 Jan '16

15 Jan '16

Hello all, We have an installation of openldap like this: master <- slave <- translucent proxy. All the installation is on debian Jessie 8.2 with slapd version 2.4.40+dfsg-1+deb8u1. When searching/binding with ldapsearch everything seems ok. I mean I have the results I expect. We have an application called CAS to authenticate users on web appplications and there is where things start to be strange. When configuring CAS to communicate with the slave, there is no problem, users can authenticate without issue. But when CAS is configured to communicate with the translucent proxy, there is not possible for users to be authenticated. I looked a different places, changed different parameters playing with ldap protocol, search reference responses, automatic referral chasing, ... but can't make it work. In the logs I have this: ldapsearch request: the output is ok from client to translucent proxy: slapd[8845]: conn=1019 fd=13 ACCEPT from IP=10.93.64.180:57730 (IP=0.0.0.0:389) slapd[8845]: conn=1019 op=0 BIND dn="uid=cas-auth,ou=SI,ou=access,dc=domain,dc=com" method=128 slapd[8845]: conn=1019 op=0 BIND dn="uid=cas-auth,ou=SI,ou=access,dc=domain,dc=com" mech=SIMPLE ssf=0 slapd[8845]: conn=1019 op=0 RESULT tag=97 err=0 text= slapd[8845]: conn=1019 op=1 SRCH base="ou=people,dc=domain,dc=com" scope=2 deref=3 filter="(uid=myuser)" slapd[8845]: conn=1019 op=1 SRCH attr=1.1 slapd[8845]: conn=1019 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= slapd[8845]: conn=1019 op=2 UNBIND slapd[8845]: conn=1019 fd=13 closed from tranlucent proxy to slave: slapd[6491]: conn=1759 fd=25 ACCEPT from IP=10.93.64.207:37513 (IP=0.0.0.0:389) slapd[6491]: conn=1759 op=0 [IP=10.93.64.180 USERNAME=uid=cas-auth,ou=SI,ou=access,dc=domain,dc=com] BIND dn="uid=cas-auth,ou=SI,ou=access,dc=domain,dc=com" method=128 slapd[6491]: conn=1759 op=0 [IP=10.93.64.180 USERNAME=uid=cas-auth,ou=SI,ou=access,dc=domain,dc=com] BIND dn="uid=cas-auth,ou=SI,ou=Access,dc=domain,dc=com" mech=SIMPLE ssf=0 slapd[6491]: conn=1759 op=0 [IP=10.93.64.180 USERNAME=uid=cas-auth,ou=SI,ou=access,dc=domain,dc=com] RESULT tag=97 err=0 text= slapd[6491]: conn=1759 op=1 [IP=10.93.64.180 USERNAME=uid=cas-auth,ou=SI,ou=access,dc=domain,dc=com] SRCH base="ou=people,dc=domain,dc=com" scope=2 deref=3 filter="(uid=myuser)" slapd[6491]: conn=1759 op=1 [IP=10.93.64.180 USERNAME=uid=cas-auth,ou=SI,ou=access,dc=domain,dc=com] SRCH attr=* + slapd[6491]: conn=1759 op=1 [IP=10.93.64.180 USERNAME=uid=cas-auth,ou=SI,ou=access,dc=domain,dc=com] SEARCH RESULT tag=101 err=0 nentries=1 text= slapd[6491]: conn=1759 op=2 UNBIND slapd[6491]: conn=1759 fd=25 closed CAS request: I don't have the output I expect from client to translucent proxy: slapd[8845]: conn=1017 fd=13 ACCEPT from IP=10.93.64.180:57109 (IP=0.0.0.0:389) slapd[8845]: conn=1017 op=0 BIND dn="uid=cas-auth,ou=si,ou=access,dc=domain,dc=com" method=128 slapd[8845]: conn=1017 op=0 BIND dn="uid=cas-auth,ou=si,ou=access,dc=domain,dc=com" mech=SIMPLE ssf=0 slapd[8845]: conn=1017 op=0 RESULT tag=97 err=0 text= slapd[8845]: conn=1017 op=1 SRCH base="ou=People,dc=domain,dc=com" scope=2 deref=3 filter="(uid=myuser)" slapd[8845]: conn=1017 op=1 SRCH attr=1.1 slapd[8845]: conn=1017 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= slapd[8845]: conn=1017 fd=13 closed (connection lost) from tranlucent proxy to slave: slapd[6491]: conn=1747 fd=13 ACCEPT from IP=10.93.64.207:35881 (IP=0.0.0.0:389) slapd[6491]: conn=1747 op=0 [IP=10.93.64.180 USERNAME=uid=cas-auth,ou=si,ou=access,dc=domain,dc=com] BIND dn="uid=cas-auth,ou=si,ou=access,dc=domain,dc=com" method=128 slapd[6491]: conn=1747 op=0 [IP=10.93.64.180 USERNAME=uid=cas-auth,ou=si,ou=access,dc=domain,dc=com] BIND dn="uid=cas-auth,ou=SI,ou=Access,dc=domain,dc=com" mech=SIMPLE ssf=0 slapd[6491]: conn=1747 op=0 [IP=10.93.64.180 USERNAME=uid=cas-auth,ou=si,ou=access,dc=domain,dc=com] RESULT tag=97 err=0 text= slapd[6491]: conn=1747 op=1 UNBIND slapd[6491]: conn=1747 fd=13 closed The configuration part relative to translucent: # Entry 1: olcOverlay={3}translucent,olcDatabase={2}mdb,cn=config dn: olcOverlay={3}translucent,olcDatabase={2}mdb,cn=config objectclass: olcConfig objectclass: olcOverlayConfig objectclass: olcTranslucentConfig objectclass: top olcoverlay: {3}translucent olctranslucentbindlocal: TRUE # Entry 2: olcDatabase={0}ldap,olcOverlay={3}translucent,olcDatabase={2}m... dn: olcDatabase={0}ldap,olcOverlay={3}translucent,olcDatabase={2}mdb,cn=conf ig objectclass: olcConfig objectclass: olcLDAPConfig objectclass: olcTranslucentDatabase objectclass: olcDatabaseConfig olcdatabase: {0}ldap olcdbchasereferrals: TRUE olcdbidassertauthzfrom: {0}* olcdbidassertbind: bindmethod="simple" binddn="uid=roaccess,ou=access,dc=dom ain,dc=com" credentials="hideme" mode="self" olcdbsessiontrackingrequest: TRUE olcdburi: ldap://ldap-data.domain.it I do not really know where to look else. I'll continue to try different things to make it work but any idea/suggestion/correction is welcome. Thank you in advance for your time. -- ------------ M. P.

1 1

Merging databases with translucent
by M. P. 14 Jan '16

14 Jan '16

Hi, We are on a process of merging datas from a remote database to a local database. The two databases have the same base dn. To ease this process, I thought for a way to make a union of the remote database and the local database until remote datas are merged to local database. From my reading I found this thread http://thread.gmane.org/gmane.network.openldap.technical/11893 that is something that correspond I think to what I want. The practical part is done on a debian jessie 8.2 with openldap 2.4.40+dfsg-1+deb8u1 version. The local database definition is like this. # Entry 1: olcDatabase={2}mdb,cn=config dn: olcDatabase={2}mdb,cn=config objectclass: olcDatabaseConfig objectclass: olcMdbConfig olcaccess: ... olcdatabase: {2}mdb olcdbdirectory: /var/lib/ldap/base_dn olcdbindex: ... olcdbmaxsize: 104857600 olclimits: ... olcrootdn: cn=admin,dc=base,dc=dn olcrootpw: {SSHA}....... olcsuffix: dc=base,dc=dn olcsyncrepl: ... olcupdateref: ldap://master.ldap.server/ To this database definition I have added this part to make translucent work. # ldapadd -Y EXTERNAL -H ldapi:/// << EOF dn: olcOverlay=translucent,olcDatabase={2}mdb,cn=config objectClass: olcConfig objectClass: olcOverlayConfig objectClass: olcTranslucentConfig objectClass: top olcOverlay: translucent EOF # ldapadd -Y EXTERNAL -H ldapi:/// << EOF dn: olcDatabase=ldap,olcOverlay={3}translucent,olcDatabase={2}mdb,cn=config objectClass: olcConfig objectClass: olcLDAPConfig objectClass: olcTranslucentDatabase objectClass: olcDatabaseConfig olcDbURI: ldap://remote-ldap.server olcDbIDAssertBind: bindmethod="simple" binddn="cn=binddn,dc=base,dc=dn" credentials="onepassword" mode="self" EOF With this configuration, I can see on the local server, the entries that are available on the remote server only, an ldapsearch does not return entries available on the local server. Is this the normal behavior ? Another problem is that when I restart slapd, I have an error like this slapd[3440]: @(#) $OpenLDAP: slapd (Sep 11 2015 15:11:55) $#012#011buildd@babin:/build/openldap-nFTO9j/openldap-2.4.40+dfsg/debian/build/servers/slapd slapd[3441]: syncprov_db_open: invalid config, lastmod must be enabled slapd[3441]: backend_startup_one (type=mdb, suffix="dc=linkeo,dc=com"): bi_db_open failed! (-1) slapd[3441]: DIGEST-MD5 common mech free slapd[3441]: slapd stopped. I have to reload config without dn: olcOverlay=translucent,olcDatabase={2}mdb,cn=config and dn: olcDatabase=ldap,olcOverlay={3}translucent,olcDatabase={2}mdb,cn=config entries to make slapd start properly. Can somebody tell me what I have done wrong ? Thanks, -- ------------ M. P.

3 6

LMBD questions (stat & copy)
by Bruno Freudensprung 14 Jan '16

14 Jan '16

Hi, I am trying to detect MDB_MAP_FULL based on mdb_stat(txn, dbi, &stat) results and I am wondering if I am on the right track or doing things correctly. I have a small and simple test program (http://pastebin.com/SPCYgWMC) exhibiting the following behavior (consistent between Windows 7 64-bit and Ubuntu 15.10 64-bit - latest version of lmdb cloned and recompiled on Linux): * Inserting 20990 key value pairs in a database is OK when using one transaction. Just before commiting the write transaction, mdb_stat(txn, dbi, &stat) shows that the total number of pages (253) is very close the the number of pages of the map (256). Indeed, adding another entry leads to MDB_MAP_FULL. To put it shortly, this scenario looks OK (I am assuming there might be 3 "internal-purpose" pages not shown by mdb_stat) and can be tested by setting the stat_test variable to 0 at line 20 of the test program. * Inserting same 20990 key value pairs in a database fails (MDB_MAP_FULL encountered at 19357) when using two consecutive write transactions. Just before MDB_MAP_FULL, mdb_stat(txn, dbi, &stat) shows that the total number of pages (232) is "quite far" from the the number of pages of the map (256), leading my MDB_MAP_FULL detection heuristic to fail. It means that only 92% of the total amount of data can be sucessfully added to the database. Other scenarii (with same key/value lengths though) stop at 85% only. This can be tested by setting the stat_test variable to 1 (line 20). By "total number of pages" I mean ms_branch_pages + ms_leaf_pages + ms_overflow_pages. Do you think I am on a wrong track? (maybe mdb_stat does not show 24 "internal-purpose" pages in the second case? or I am forgetting something?). One last remark: it seems that mdb_env_copy(db, copy_dir) is possible during a write transaction on Windows (like stated in the documentation), but not on Linux (the test program seems to be stopped on a mutex at line 62). This can be tested by changing the copy_test variable to 1 at line 19. Is it expected given my program? Best regards, Bruno.

2 7

slapd dies
by BÖSCH Christian 14 Jan '16

14 Jan '16

hi, i have two openldap servers 2.4.43 on freebsd 10.2 with multimaster replication. if i add on one node a dynamicobject, the other node dies immediatly. has anybody an idea? regards,chris --- added this: dn: uid=vkw-guest,ou=people,o=abc.net sn: VKW Guest objectClass: organizationalPerson objectClass: person objectClass: dynamicObject objectClass: inetLocalMailRecipient objectClass: inetOrgPerson objectClass: top uid: vkw-guest cn: VKW Guest the log says: Jan 13 13:08:40 openldap2 slapd[75017]: daemon: activity on 1 descriptor Jan 13 13:08:40 openldap2 slapd[75017]: daemon: activity on: Jan 13 13:08:40 openldap2 slapd[75017]: 30r Jan 13 13:08:40 openldap2 slapd[75017]: Jan 13 13:08:40 openldap2 slapd[75017]: daemon: read activity on 30 Jan 13 13:08:40 openldap2 slapd[75017]: daemon: select: listen=6 active_threads=0 tvp=zero Jan 13 13:08:40 openldap2 slapd[75017]: daemon: select: listen=7 active_threads=0 tvp=zero Jan 13 13:08:40 openldap2 slapd[75017]: daemon: select: listen=8 active_threads=0 tvp=zero Jan 13 13:08:40 openldap2 slapd[75017]: daemon: select: listen=9 active_threads=0 tvp=zero Jan 13 13:08:40 openldap2 slapd[75017]: daemon: select: listen=10 active_threads=0 tvp=zero Jan 13 13:08:40 openldap2 slapd[75017]: connection_get(30) Jan 13 13:08:40 openldap2 slapd[75017]: connection_get(30): got connid=0 Jan 13 13:08:40 openldap2 slapd[75017]: =>do_syncrepl rid=021 Jan 13 13:08:40 openldap2 slapd[75017]: =>do_syncrep2 rid=021 Jan 13 13:08:40 openldap2 slapd[75017]: do_syncrep2: rid=021 cookie=rid=021,sid=001,csn=20160113120840.025550Z#000000#001#000000 Jan 13 13:08:40 openldap2 slapd[75017]: syncrepl_message_to_entry: rid=021 DN: uid=vkw-guest,ou=people,o=abc.net, UUID: 2074bc1e-4e3a-1035-92a1-ed72d2e7074a Jan 13 13:08:40 openldap2 slapd[75017]: >>> dnPrettyNormal: <uid=vkw-guest,ou=people,o=abc.net> Jan 13 13:08:40 openldap2 slapd[75017]: <<< dnPrettyNormal: <uid=vkw-guest,ou=people,o=abc.net>, <uid=vkw-guest,ou=people,o=abc.net> Jan 13 13:08:40 openldap2 slapd[75017]: >>> dnPretty: <cn=admin,o=xyz.net> Jan 13 13:08:40 openldap2 slapd[75017]: <<< dnPretty: <cn=admin,o=xyz.net> Jan 13 13:08:40 openldap2 slapd[75017]: >>> dnNormalize: <cn=admin,o=xyz.net> Jan 13 13:08:40 openldap2 slapd[75017]: <<< dnNormalize: <cn=admin,o=xyz.net> Jan 13 13:08:40 openldap2 slapd[75017]: >>> dnPretty: <cn=admin,o=xyz.net> Jan 13 13:08:40 openldap2 slapd[75017]: <<< dnPretty: <cn=admin,o=xyz.net> Jan 13 13:08:40 openldap2 slapd[75017]: >>> dnNormalize: <cn=admin,o=xyz.net> Jan 13 13:08:40 openldap2 slapd[75017]: <<< dnNormalize: <cn=admin,o=xyz.net> Jan 13 13:08:40 openldap2 slapd[75017]: >>> dnPretty: <uid=vkw-guest,ou=people,o=abc.net> Jan 13 13:08:40 openldap2 slapd[75017]: <<< dnPretty: <uid=vkw-guest,ou=people,o=abc.net> Jan 13 13:08:40 openldap2 slapd[75017]: >>> dnNormalize: <uid=vkw-guest,ou=people,o=abc.net> Jan 13 13:08:40 openldap2 slapd[75017]: <<< dnNormalize: <uid=vkw-guest,ou=people,o=abc.net> Jan 13 13:08:40 openldap2 slapd[75017]: >>> dnPretty: <cn=Subschema> Jan 13 13:08:40 openldap2 slapd[75017]: <<< dnPretty: <cn=Subschema> Jan 13 13:08:40 openldap2 slapd[75017]: >>> dnNormalize: <cn=Subschema> Jan 13 13:08:40 openldap2 slapd[75017]: <<< dnNormalize: <cn=subschema> Jan 13 13:08:40 openldap2 slapd[75017]: syncrepl_entry: rid=021 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Jan 13 13:08:40 openldap2 slapd[75017]: => mdb_search Jan 13 13:08:40 openldap2 slapd[75017]: mdb_dn2entry("o=abc.net") Jan 13 13:08:40 openldap2 slapd[75017]: => mdb_dn2id("o=abc.net") Jan 13 13:08:40 openldap2 slapd[75017]: <= mdb_dn2id: got id=0x1 Jan 13 13:08:40 openldap2 slapd[75017]: => mdb_entry_decode: Jan 13 13:08:40 openldap2 slapd[75017]: <= mdb_entry_decode Jan 13 13:08:40 openldap2 slapd[75017]: => access_allowed: search access to "o=abc.net" "entry" requested Jan 13 13:08:40 openldap2 slapd[75017]: <= root access granted Jan 13 13:08:40 openldap2 slapd[75017]: => access_allowed: search access granted by manage(=mwrscxd) Jan 13 13:08:40 openldap2 slapd[75017]: search_candidates: base="o=abc.net" (0x00000001) scope=2 Jan 13 13:08:40 openldap2 slapd[75017]: => mdb_filter_candidates Jan 13 13:08:40 openldap2 slapd[75017]: EQUALITY Jan 13 13:08:40 openldap2 slapd[75017]: => mdb_equality_candidates (entryUUID) Jan 13 13:08:40 openldap2 slapd[75017]: => key_read Jan 13 13:08:40 openldap2 slapd[75017]: mdb_idl_fetch_key: [5ec43656] Jan 13 13:08:40 openldap2 slapd[75017]: <= mdb_index_read: failed (-30798) Jan 13 13:08:40 openldap2 slapd[75017]: <= mdb_equality_candidates: id=0, first=0, last=0 Jan 13 13:08:40 openldap2 slapd[75017]: <= mdb_filter_candidates: id=0 first=0 last=0 Jan 13 13:08:40 openldap2 slapd[75017]: mdb_search_candidates: id=0 first=0 last=0 Jan 13 13:08:40 openldap2 slapd[75017]: mdb_search: no candidates Jan 13 13:08:40 openldap2 slapd[75017]: send_ldap_result: conn=-1 op=0 p=0 Jan 13 13:08:40 openldap2 slapd[75017]: send_ldap_result: err=0 matched="" text="" Jan 13 13:08:40 openldap2 slapd[75017]: syncrepl_entry: rid=021 be_search (0) Jan 13 13:08:40 openldap2 slapd[75017]: syncrepl_entry: rid=021 uid=vkw-guest,ou=people,o=abc.net Jan 13 13:08:40 openldap2 slapd[75017]: slap_queue_csn: queueing 0x846348780 20160113120840.025550Z#000000#001#000000 Jan 13 13:08:40 openldap2 slapd[75017]: ==> unique_add <uid=vkw-guest,ou=people,o=abc.net> Jan 13 13:08:40 openldap2 slapd[75017]: => access_allowed: manage access to "uid=vkw-guest,ou=people,o=abc.net" "entry" requested Jan 13 13:08:40 openldap2 slapd[75017]: <= root access granted Jan 13 13:08:40 openldap2 slapd[75017]: => access_allowed: manage access granted by manage(=mwrscxd) Jan 13 13:08:40 openldap2 slapd[75017]: unique_add: administrative bypass, skipping Jan 13 13:08:40 openldap2 slapd[75017]: => mdb_entry_get: ndn: "ou=people,o=abc.net" Jan 13 13:08:40 openldap2 slapd[75017]: => mdb_entry_get: oc: "dynamicObject", at: "(null)" Jan 13 13:08:40 openldap2 slapd[75017]: mdb_dn2entry("ou=people,o=abc.net") Jan 13 13:08:40 openldap2 slapd[75017]: => mdb_dn2id("ou=people,o=abc.net") Jan 13 13:08:40 openldap2 slapd[75017]: <= mdb_dn2id: got id=0x3 Jan 13 13:08:40 openldap2 slapd[75017]: => mdb_entry_decode: Jan 13 13:08:40 openldap2 slapd[75017]: <= mdb_entry_decode Jan 13 13:08:40 openldap2 slapd[75017]: => mdb_entry_get: found entry: "ou=people,o=abc.net" Jan 13 13:08:40 openldap2 slapd[75017]: <= mdb_entry_get: failed to find objectClass dynamicObject Jan 13 13:08:40 openldap2 slapd[75017]: mdb_entry_get: rc=16

3 4

add sortvals after database loaded?
by Phil Pishioneri 14 Jan '16

14 Jan '16

Environment: slapd: openldap-ltb-2.4.42-1.el6.x86_64 config: slapd.conf (file) database: mdb After a database has been loaded, can the sortvals option be added/changed without having to dump and reload the database? The slapd.conf (and slapd-config) man page doesn't mention any need for a reload, but wanted to verify. -Phil

2 2

Removing olcAccess entry
by Katherine Faella 12 Jan '16

12 Jan '16

For the life of me I can not figure out the syntax for performing this. Here is my snippet of config.ldif: dn: olcDatabase={1}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcSuffix: dc=sakai,dc=uri,dc=edu olcAccess: {0}to * by peername.ip="131.128.1.0%255.255.255.0" +0 break by peername.ip="131.128.122.0%255.255.255.0" +0 break by peername.ip="158.123 .255.8%255.255.255.248" +0 break by peername.ip="127.0.0.1" +0 break olcAccess: {1}to * by dn.regex="^URIEduauthid=.+,dc=sakai,dc=uri,dc=edu$$" read by * auth olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=Manager,dc=sakai,dc=uri,dc=edu ..... I need to remove the olcAccess {0} as we need to access this server from new ips. We are using a firewall to protect the server going forward. I have created the file removeips containing: dn: olcDatabase={1}hdb,cn=config changetype: modify delete: olcAccess olcAccess: {1} Running the command ldapmodify -W -x -h antons.uri.edu -D "cn=admin,cn=config" -f /root/ldapscripts/removeips gives me: modifying entry "olcDatabase={1}hdb,cn=config" ldap_modify: No such attribute (16) additional info: modify/delete: olcAccess: no such attribute What am I doing wrong? Thanks, Kathy -- Katherine Faella tel: (401) 874-4469 Senior Technical Programmer kmf(a)uri.edu University of Rhode Island University Computing Systems(UCS) 210 Flagg Road Kingston, Rhode Island

4 4

lmdb VL32 high virtual address usage
by Jeremiah Morrill 11 Jan '16

11 Jan '16

This sort of coincides with ITS issue 8347 I just reported. With ldmb VL32, I’ve noticed that it can eat up a lot of memory space. Sometimes ~500mb for an 800mb db after reading every record, one by one using the same readonly transaction/cursor. I found that modifying MDB_ERPAGE_SIZE from 16384 to 256 brought virtual memory usage down substantially (~30megs). I have not noticed any adverse effects from this change or MDB_MAP_FULL. The mapped address spaces to seem to get deallocated on the close of the environment, not the transaction, which sounds like its being cached in the env->me_rpages for reasons explained in mdb_rpage_get comments. Is the mem map cache supposed to be this aggressive by design, or just because this area of the code is so new...or simply a usage error on my part? If it’s by design, could there be a consideration to make MDB_ERPAGE_SIZE a #define’able value in the public lmdb.h so one could tweak the behavior? -Jer

2 1

Re: what databases are to be replicated for a slave?
by Jephte Clain 09 Jan '16

09 Jan '16

2015-12-29 20:38 GMT+04:00 Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Tuesday, December 29, 2015 12:48 PM +0400 Jephte Clain > <jephte.clain(a)univ-reunion.fr> wrote: > > > >>> No. Replicas do not accept writes. Replicas do not have a master >>> configuration for cn=config. Replica's do not have server IDs. >> >> ok I guess I understand. this is the reason why I usually call them >> "slaves", not replicas (but I messed things up and called them replicas >> this time ^^) >> I also have replicas that only replicate data (or a subset of data) for >> some services > > > No. The terms replica and slave are interchangeable. As are master and > provider. Given the very negative connotations of the concept of masters > and slaves, the preferred terms are "provider" instead of "master" and > "replica" instead of "slaves". Aaargh, now I can't help thinking about "providers" whipping "replicas". slapd can be so cruel sometimes :-) And in case you wonder, here in reunion island we have a (relatively) long history of slavery. We even have a day to commemorate abolition of slavery: december 20th > > >> the slaves are there in case of catastrophic failure of both masters (we >> had one of these failure for another service due to a problem with the >> shared storage. No one want to have this kind of emergency...) >> If the master(s) crash, I just have to choose a slave as the new master, >> slapcat the cn=config database, update the provider address, slapadd the >> updated config, and update the loadbalancer settings. this is a bit of >> work but at least we can restore service in a (relatively) small amount >> of time. > > > If they accept writes, they are not slaves/replicas. If you are replicating > cn=config across all the systems, then they must all be masters. Your > general description above sounds like you do not correctly understand how > MMR functions. OK... I finally understand what was bothering you My replicas do _not_ accept writes. Sorry to have let you think so I have two setups: - a "legacy" one, with one master accessible to the applications that can write, and two complete replicas (data + cn=config) behind a loadbalancer for the reads. One of these replicas could become the new master if the needs arise. And there are a bunch of partial replicas (only a subset of data) for some specific services. The reason is on our vmware farm, network access is regularly cut (don't know why, the system guy neither), and these services cannot reconnect on their own... piece of #$*! software :( - a "new" one, with two masters in mirror mode (only one get the writes at anytime thanks to the loadbalancer), and two replicas (only data) which get all the reads. I feel like configuring chaining to be able to write from the replicas, but I have no experience of the benefits of this configuration... I have read the admin guide several times, but I am open to any suggestion to improve my skills > >>> Accesslog is unique to a given master. >> >> Ok that's what I wanted to know for sure >> >> Shouldn't the doc stat this clearly? > > > Please file an ITS noting the docs should be updated on this point. Ok. I may even provide a patch. I'll do it tomorrow. Have a nice day/night (don't know where you live ^^) Regards, Jephté -- Jephté CLAIN | Développeur, Intégrateur d'applications Service Système d'Information Direction des Systèmes d'Information Tél: +262 262 93 86 31 || Gsm: +262 692 29 58 24

2 2

Out of ideas when troubleshooting TLS negotiation failure
by Graham Allan 08 Jan '16

08 Jan '16

This feels like a lame question, but I'm out of ideas, so... I'm moving samba service between a couple of FreeBSD systems (9.3 to 10.2), and I'm stuck on getting samba on the new machine to connect to our openldap server over ssl - frustrating since I've been running samba+ldap for 15 years or so; feel sure I'm missing something basic! The smbd-to-ldap connection works fine with no encryption, but I get errors when using either TLS to port 389 ("Failed to issue the StartTLS instruction: Connect error") or SSL to 636. However I'm pretty certain it's not a certificate or CA validation issue. All my other ldap clients on that server are working as expected, including a simple "ldapsearch -ZZ". Both openssl s_client and gnutls-cli show the ldap server certificate validating. Maximum debugging on the ldap server gave me: connection_read(3): TLS accept failure error=-1 id=1042, closing conn=1042 fd=3 closed (TLS negotiation failure) Running smbd under gbd shows ldap_start_tls_s (ldap_struct, NULL, NULL) in smb_ldap_start_tls is returning -11 (LDAP_CONNECT_ERROR). That doesn't give me any ideas, sadly! Capturing the packet exchange between smbd and slapd, I'm seeing the (smbd) client sends a "decrypt error" (TLS alert code 51) to the ldap server after receiving the certificate, while the working "ldapsearch -ZZ" moves on to client key exchange etc. Besides all my other ldap clients working successfully, I think I'd expect to see a TLS alert more like 42-48 if it were a cert validation problem. I'm not sure where to try looking next for the cause, would welcome any suggestions... Thanks, Graham

3 5

Knowing free mdb space
by Angel L. Mateo 08 Jan '16

08 Jan '16

Hello, I have recently migrated my openldap server from hdb to mdb. In this kind of database you configure the maximal database size with maxsize option. Although I have configure this option with 8GB, more than the double of my actual database size, I would like to know if there is any way to calculate the remaining size. According to [1] you can get the actual size with a du. But my problem is that I'm using zfs with a compressed file system, so du reports the compressed size, not the real one. Is there any way to get this value? Or my real maximum size is 8GB after compression? [1] https://wiki.zimbra.com/wiki/OpenLDAP_Performance_Tuning_8.0 -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868887590 Fax: 868888337

4 5

LMDB ITS 8324 WriteMap performance on Windows
by Victor Baybekov 05 Jan '16

05 Jan '16

Hi, Thanks a lot for ITS#8324! For embedded, not server, use case that change adds much convenience. I have tested the master from .NET via P/Invoke and do not see any major slowdown with default options. To insert 10M <int32,int32> pairs inside a single transaction v.0.9.14 takes minimum 3400 msec, latest master takes minimum 3750 msec. This is not scientific, just best result from 10 runs. Sometimes both timings increase to 5000+ msecs. On average slowdown is visible but tolerable - from 2.9 Mops to 2.6 Mops (absolute numbers are still awesome!). With Append and NoSync I could get 3.45 Mops on the same test with master build. However, with WriteMap performance of master drops 3x to 10000 msec or just 1 Mops, while for the v.0.9.14 performance with WriteMap improves to 2350 msec or 4.25 Mops. Is this the cost of convenience or it could be fixed so that WriteMap still "is faster and uses fewer mallocs" as the docs say? Best regards, Victor

3 5

2.4.43 "make test" hanging in "test039-glue-ldap-concurrency" on Solaris 10
by Greg Earle 05 Jan '16

05 Jan '16

Forgive me if this is the wrong place (maybe openldap-build?). I've built OpenLDAP 2.4.43 on Solaris 10 1/13 OK, but when I run the "make test" phase it hangs in the "test039-glue-ldap-concurrency" test: -- >>>>> Starting test039-glue-ldap-concurrency for bdb... running defines.sh Starting slapd on TCP/IP port 9011... Using ldapsearch to check that slapd is running... Using ldapadd to populate the database... Starting slapd on TCP/IP port 9012... Using ldapsearch to check that slapd is running... Using ldapadd to populate the database... Starting slapd on TCP/IP port 9013... Using ldapsearch to check that slapd is running... MONITORDB yes SRCDIR /usr/local/src/networking/OpenLDAP/openldap-2.4.43/tests/testrun/./testdata DSTDIR /usr/local/src/networking/OpenLDAP/openldap-2.4.43/tests/testrun pwd /usr/local/src/networking/OpenLDAP/openldap-2.4.43/tests Using tester for concurrent server access... PID=16664 - Read(1000): entry="cn=Barbara Jensen,ou=Information Technology Division,ou=People,o=Example,c=US". [... blah blah etc. ...] PID=17066 - Bind(1000): dn="cn=Barbara Jensen,ou=Information Technology Division,ou=People,o=Example,c=US". PID=17080 - Search(500): base="cn=Monitor" scope=sub filter="(objectClass=*)" attrs=cn (more...). PID=17096 - Read(1000): entry="cn=Somewhere,ou=Meta,o=Example,c=US". slapd-bind PID=17066: ldap_sasl_bind_s: Invalid credentials (49) PID=17102 - Bind(1000): dn="cn=Bjorn Jensen,ou=Information Technology Division,ou=People,o=Example,c=US". PID=17112 - Search(500): base="cn=Monitor" scope=sub filter="(objectClass=*)" attrs=cn (more...). PID=17118 - Read(1000): entry="cn=Backend 1,cn=Backends,cn=Monitor". PID=17135 - Bind(1000): base="ou=People,o=Example,c=US", filter="(userPassword=*)" attr="userPassword". PID=17135 - Bind base="ou=People,o=Example,c=US" filter="(userPassword=*)" got 3 values. -- This is the last output I get. "ps" shows several test servers running as well as the test harness clients; "lsof" shows the clients stuck in poll() and doing nothing. They all have ESTABLISHED connections to their servers. -- zorro:1:1014 [/] # truss -p 17118 pollsys(0x0002CEFC, 1, 0x00000000, 0x00000000) (sleeping...) ^C zorro:1:1015 [/] # truss -p 17135 pollsys(0x0002C39C, 1, 0x00000000, 0x00000000) (sleeping...) -- I did a "gcore" and it says it's waiting in ldap_int_select(): -- (dbx) where [1] __pollsys(0x2c39c, 0x1, 0x0, 0x0, 0xfef523f0, 0x0), at 0xfeede7ac [2] _pollsys(0x2c39c, 0x1, 0x0, 0x0, 0x0, 0x2bb00), at 0xfeece490 [3] _poll(0x2c39c, 0x1, 0xffffffff, 0xffbfed8c, 0xff3ec2cc, 0x0), at 0xfee74ccc =>[4] ldap_int_select(ld = 0x289d0, timeout = (nil)), line 1139 in "os-ip.c" [5] wait4msg(ld = 0x289d0, msgid = 3, all = 1, timeout = (nil), result = 0xffbfef30), line 312 in "result.c" [6] ldap_result(ld = 0x289d0, msgid = 3, all = 1, timeout = (nil), result = 0xffbfef30), line 117 in "result.c" [7] ldap_sasl_bind_s(ld = 0x289d0, dn = 0x2ba58 "cn=Barbara Jensen,ou=Information Technology Division,ou=People,o=Example,c=US", mechanism = (nil), cred = 0xffbff080, sctrls = (nil), cctrls = (nil), servercredp = (nil)), line 210 in "sasl.c" -- Why are these things just sitting here instead of completing and exiting? BTW I am using the Solaris robust mutex fix patch (it wouldn't build otherwise) posted a few weeks back. Configured via ./configure --prefix=/opt/openldap --enable-modules --with-ldap-module=dynamic\ --enable-bdb --enable-rlookups --enable-wrappers --enable-dynamic \ --enable-ldap --disable-ipv6 --enable-overlays --with-threads --enable-relay\ --enable-syslog Puzzled in Pasadena, - Greg P.S. Here's the "ps" output if it matters zorro:1:1011 [/] # ps -ax PID TT S TIME COMMAND [...] 4413 pts/5 S 0:00 make test 4414 pts/5 S 0:00 sh -ce cd tests; make test 4415 pts/5 S 0:00 make test 4416 pts/5 S 0:00 make bdb 4418 pts/5 S 0:00 /bin/sh ./run -b bdb all 4429 pts/5 S 0:00 /bin/sh ./scripts/all 13917 pts/5 S 0:00 -sh 13922 pts/5 S 0:00 -csh 16491 pts/5 S 0:00 /bin/sh ./scripts/test039-glue-ldap-concurrency 16502 pts/5 S 0:44 /usr/local/src/networking/OpenLDAP/openldap-2.4.43/servers/slapd/.libs/slapd -s0 -f /usr/local/src/networking/OpenLDAP 16560 pts/5 S 0:05 /usr/local/src/networking/OpenLDAP/openldap-2.4.43/servers/slapd/.libs/slapd -s0 -f /usr/local/src/networking/OpenLDAP 16604 pts/5 S 2:05 /usr/local/src/networking/OpenLDAP/openldap-2.4.43/servers/slapd/.libs/slapd -s0 -f /usr/local/src/networking/OpenLDAP 16649 pts/5 S 0:00 /usr/local/src/networking/OpenLDAP/openldap-2.4.43/tests/progs/.libs/slapd-tester -P ./progs -d /usr/local/src/network 16668 pts/5 S 0:00 /usr/local/src/networking/OpenLDAP/openldap-2.4.43/tests/progs/.libs/slapd-bind -h localhost -p 9013 -l 1000 -L 16674 pts/5 S 0:00 /usr/local/src/networking/OpenLDAP/openldap-2.4.43/tests/progs/.libs/slapd-bind -h localhost -p 9013 -l 1000 -L 16677 pts/5 S 0:00 /usr/local/src/networking/OpenLDAP/openldap-2.4.43/tests/progs/.libs/slapd-modrdn -h localhost -p 9013 -D cn=Man 16680 pts/5 S 0:00 /usr/local/src/networking/OpenLDAP/openldap-2.4.43/tests/progs/.libs/slapd-bind -h localhost -p 9013 -l 1000 -L 16943 pts/5 S 0:00 /usr/local/src/networking/OpenLDAP/openldap-2.4.43/tests/progs/.libs/slapd-modrdn -h localhost -p 9013 -D cn=Man 16957 pts/5 S 0:00 /usr/local/src/networking/OpenLDAP/openldap-2.4.43/tests/progs/.libs/slapd-modify -h localhost -p 9013 -D cn=Man 16959 pts/5 S 0:00 /usr/local/src/networking/OpenLDAP/openldap-2.4.43/tests/progs/.libs/slapd-addel -h localhost -p 9013 -D cn=Mana 16981 pts/5 S 0:00 /usr/local/src/networking/OpenLDAP/openldap-2.4.43/tests/progs/.libs/slapd-bind -h localhost -p 9013 -l 1000 -L 17005 pts/5 S 0:00 /usr/local/src/networking/OpenLDAP/openldap-2.4.43/tests/progs/.libs/slapd-search -h localhost -p 9013 -D cn=Man 17017 pts/5 S 0:00 /usr/local/src/networking/OpenLDAP/openldap-2.4.43/tests/progs/.libs/slapd-read -h localhost -p 9013 -D cn=Manag 17033 pts/5 S 0:00 /usr/local/src/networking/OpenLDAP/openldap-2.4.43/tests/progs/.libs/slapd-bind -h localhost -p 9013 -l 1000 -L 17047 pts/5 S 0:00 /usr/local/src/networking/OpenLDAP/openldap-2.4.43/tests/progs/.libs/slapd-search -h localhost -p 9013 -D cn=Man 17061 pts/5 S 0:00 /usr/local/src/networking/OpenLDAP/openldap-2.4.43/tests/progs/.libs/slapd-read -h localhost -p 9013 -D cn=Manag 17066 pts/5 S 0:00 /usr/local/src/networking/OpenLDAP/openldap-2.4.43/tests/progs/.libs/slapd-bind -h localhost -p 9013 -l 1000 -L 17080 pts/5 S 0:00 /usr/local/src/networking/OpenLDAP/openldap-2.4.43/tests/progs/.libs/slapd-search -h localhost -p 9013 -D cn=Man 17096 pts/5 S 0:00 /usr/local/src/networking/OpenLDAP/openldap-2.4.43/tests/progs/.libs/slapd-read -h localhost -p 9013 -D cn=Manag 17102 pts/5 S 0:00 /usr/local/src/networking/OpenLDAP/openldap-2.4.43/tests/progs/.libs/slapd-bind -h localhost -p 9013 -l 1000 -L 17112 pts/5 S 0:00 /usr/local/src/networking/OpenLDAP/openldap-2.4.43/tests/progs/.libs/slapd-search -h localhost -p 9013 -D cn=Man 17118 pts/5 S 0:00 /usr/local/src/networking/OpenLDAP/openldap-2.4.43/tests/progs/.libs/slapd-read -h localhost -p 9013 -D cn=Manag 17135 pts/5 S 0:00 /usr/local/src/networking/OpenLDAP/openldap-2.4.43/tests/progs/.libs/slapd-bind -h localhost -p 9013 -l 1000 -L

1 0

Re: pass-through authentication
by Dan White 04 Jan '16

04 Jan '16

On 12/17/15 18:32 -0600, Timothy Keith wrote: >We are attempting to set up an LDAP server which will answer queries >from an application. The database will contain metadata on a set of >users in the application. The application will also query the server >to authenticate the user’s password, however, this server will not >house the password. That resides on another server, which our server >will query. We do not have administrative rights to the other >server. > > The difficulty we are having now is setting up the pass-through >authentication for the passwords. Any pointers in how to proceed with >this would be greatly appreciated. On 12/21/15 17:24 -0600, Timothy Keith wrote: >We have limited access to the servers. Same company, different IT >organization. Our LDAP requirement must be transparent to those servers. >We want to inherit the LDAP directory information from the Unix servers - >mostly the user Id and passwords, and add information that is needed by >applications that our servers will manage. On 12/31/15 09:51 -0600, Timothy Keith wrote: > On Wed, Dec 30, 2015 at 7:04 PM, Dan White <dwhite(a)cafedemocracy.org> wrote: >> On 12/30/15 18:51 -0600, Timothy Keith wrote: >> >>> This is tail of the latest saslauthd debug output : >>> >>> ldap_sasl_interactive_bind: user selected: DIGEST-MD5 >>> >> >> res_errno: 7, res_error: <SASL(-4): no mechanism available: >, res_matched: >>> <> >>> ldap_free_request (origid 1, msgid 1) >>> ldap_int_sasl_bind: DIGEST-MD5 >>> ldap_parse_sasl_bind_result >>> ldap_parse_result >>> ldap_msgfree >>> ldap_err2string >>> >> >> Is DIGEST-MD5 available on your ldap server? Try: >> >> ldapsearch -LLL -x -H ldap://1.2.3.4 -s "base" -b "" >> supportedSASLMechanisms >> Which should list the advertised sasl mechanisms. >> >> Verify the digest-md5 mechanism is installed with >> saslpluginviewer/pluginviewer. > >Dan, that ldapsearch returns : >dn: >supportedSASLMechanisms: PLAIN The server is only offering the PLAIN mechanism to you. It appears you're using saslauthd's ldap backend, and have explicitly configured 'ldap_mech: digest-md5' in your corresponding config. If that's correct, you could change that to PLAIN instead. Consider protecting the bind with tls if available. slapo-pbind may be a simpler alternative (to pass-through sasl authentication), depending on the specifics of your setup. -- Dan White

3 8

Re: openldap 2.4.43 keeps crashing
by Jephte Clain 04 Jan '16

04 Jan '16

2015-12-30 22:51 GMT+04:00 Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Wednesday, December 30, 2015 10:36 PM +0400 Jephte Clain > <jephte.clain(a)univ-reunion.fr> wrote: > >> 2015-12-29 20:47 GMT+04:00 Quanah Gibson-Mount <quanah(a)zimbra.com>: >>> >>> --On Monday, December 28, 2015 10:18 PM -0800 Quanah Gibson-Mount >>> <quanah(a)zimbra.com> wrote: >>> >>>> David, >>>> >>>> Why haven't you reported this to the ITS? >>> >>> >>> >>> Discussed with Howard. It isn't in 0.9 yet because it hasn't been >>> confirmed if the fix is good or not. David, if that fix has resolved >>> the issue, *please* follow up with the ITS noting that to be the case. >>> >> >> Hello, >> >> I can confirm this is the problem I have. Starting slapd in debug >> mode, it dies after some time: >> >> /tmp/buildd/openldap-2.4.43/servers/slapd/back-mdb/../../../libraries/lib >> lmdb/mdb.c:5276: Assertion 'NUMKEYS(mp) > 1' failed in >> mdb_page_search_root() >> /usr/local/slaptools/lib/functions: line 44: 30232 Abandon >> /usr/sbin/slapd -h "$SLAPD_SERVICES" -g "$SLAPD_GROUP" -u >> "$SLAPD_USER" -F "$SLAPDD" -d "$dlevel" "$@" >> >> I didn't notice it because it doesn't dump core. And somehow, the >> initscript I use eats the stderr output of slapd (I'll fix it for >> future errors) >> >> For now, I'll revert to the previous working version, but I'm willing >> to test any fix >> The funny part is only the replica dies regularly, not the master >> although it is the one to receive the writes > > > You can apply the patch that was made to mdb.master to the 2.4.43 source > tree, and see if it resolves the problem or not. ;) Hmmm... I really need some holidays... I couldn't manage to find the commit today (too tired?) and now I remember grep is my friend $ git checkout mdb.master $ git log --pretty=oneline | grep 8336 58d1fd4c73c96ef3097816e975b3d421ead4d86e ITS#8336 fix page_search_root assert on FreeDB I'll have a look tomorrow. Thanks. Regards, Jephté -- Jephté CLAIN | Développeur, Intégrateur d'applications Service Système d'Information Direction des Systèmes d'Information Tél: +262 262 93 86 31 || Gsm: +262 692 29 58 24

2 2

Re: users don't get prompt to change password (pwdMustChange attribute)
by Rajagopal Rc 01 Jan '16

01 Jan '16

Hi All, Can any one help me on this please Thanks From: Rajagopal Rc/BLR/TCS To: openldap-technical(a)openldap.org Date: 12/24/2015 12:07 PM Subject: users don't get prompt to change password (pwdMustChange attribute) Hello, I am trying to force user to change their password at first logon and on password reset. OS RHEL7 Openldap version 2.4.39-7.el7_1.x86_64 I have tried the following 1) I have set the pwdMustChange attribute to TRUE in ppolicy, but when user logon to client at first time or after resetting password, it just allow suer to logon without prompting to change the password, 2) I have set the pwdReset attribute to TRUE in user attribute for particular user, this doesn't allow user to login at all and keep prompting for password without allowing to login. Also i red in blogs this is not correct way, but couldn't find more information on this. is there any way to force users to change their password at first logon and after resetting password by admin. ? Current ppolicy Thanks & Regards Raj =====-----=====-----===== Notice: The information contained in this e-mail message and/or attachments to it may contain confidential or privileged information. If you are not the intended recipient, any dissemination, use, review, distribution, printing or copying of the information contained in this e-mail message and/or attachments to it are strictly prohibited. If you have received this communication in error, please notify us by reply e-mail or telephone and immediately and permanently delete the message and any attachments. Thank you

1 0

LDAP ACL for restricting applications with same user dn
by Geo P.C. 01 Jan '16

01 Jan '16

Currently we need to configure Group based LDAP login for our custom applications. We have applications named app1, app2 etc. For restricting users to login for a particular application for eg app1 then for that user it should have attribute named *allowedService = app1*, for login to app2 that user need *allowedService = app2* So in that way we created users. Now for binding applications to ldap we created users like *cn=app1,ou=Applications,dc=prime,dc=ds,dc=geo,dc=com cn=app2,ou=Applications,dc=prime,dc=ds,dc=geo,dc=com* Now we configured LDAP ACL as follows: olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by > anonymous auth by dn="cn=admin,dc=ds,dc=geo,dc=com" write by * none > olcAccess: {1}to dn.base="" by * read > olcAccess: {2}to dn.subtree="ou=People,dc=prime,dc=ds,dc=geo,dc=com" > filter="(allowedService=app1)" by > dn.exact="cn=app1,ou=Applications,dc=prime,dc=ds,dc=geo,dc=com" read by * > break > olcAccess: {3}to dn.subtree="ou=People,dc=prime,dc=ds,dc=geo,dc=com" > filter="(allowedService=app2)" by > dn.exact="cn=app2,ou=Applications,dc=prime,dc=ds,dc=geo,dc=com" read by * > break > olcAccess: {4}to dn.subtree="ou=People,dc=prime,dc=ds,dc=geo,dc=com" > attrs="entry" by dn.sub="ou=Applications,dc=prime,dc=ds,dc=geo,dc=com" read > by dn="cn=admin,dc=ds,dc=geo,dc=com" write by self read by * break > olcAccess: {5}to dn.subtree="ou=People,dc=prime,dc=ds,dc=geo,dc=com" > by dn.exact="cn=app3,ou=Applications,dc=prime,dc=ds,dc=geo,dc=com" read by > users read > olcAccess: {6}to dn.subtree="dc=prime,dc=ds,dc=geo,dc=com" by > anonymous write > But when any application that doesn't support filter (Like suiteCRM) we created rule *olcAccess: {5}* and bind it with *app3* user but then the whole ACL is not working and all users can login to all application. So can anyone please help us on it Thanks Geo

1 1

Re: pass-through authentication
by Timothy Keith 31 Dec '15

31 Dec '15

ldapsearch -LLL -x -H ldap://1.2.3.4 -s "base" -b "" supportedSASLMechanisms That ldapsearch returns : dn: supportedSASLMechanisms: PLAIN I tried this as well : ldapsearch -h localhost -Y digest-md5 -U my_userid -w my_password -v '(objectClass=*)' ldap_initialize( ldap://localhost ) SASL/DIGEST-MD5 authentication started ldap_sasl_interactive_bind_s: Authentication method not supported (7) additional info: SASL(-4): no mechanism available: Tim On Thu, Dec 31, 2015 at 9:51 AM, Timothy Keith <timothy.g.keith(a)gmail.com> wrote: > Dan, that ldapsearch returns : > dn: > supportedSASLMechanisms: PLAIN > > On Wed, Dec 30, 2015 at 7:04 PM, Dan White <dwhite(a)cafedemocracy.org> > wrote: > >> On 12/30/15 18:51 -0600, Timothy Keith wrote: >> >>> This is tail of the latest saslauthd debug output : >>> >>> ldap_sasl_interactive_bind: user selected: DIGEST-MD5 >>> >> >> res_errno: 7, res_error: <SASL(-4): no mechanism available: >, >>> res_matched: >>> <> >>> ldap_free_request (origid 1, msgid 1) >>> ldap_int_sasl_bind: DIGEST-MD5 >>> ldap_parse_sasl_bind_result >>> ldap_parse_result >>> ldap_msgfree >>> ldap_err2string >>> >> >> Is DIGEST-MD5 available on your ldap server? Try: >> >> ldapsearch -LLL -x -H ldap://1.2.3.4 -s "base" -b "" >> supportedSASLMechanisms >> Which should list the advertised sasl mechanisms. >> >> Verify the digest-md5 mechanism is installed with >> saslpluginviewer/pluginviewer. >> >> -- >> Dan White >> > >

1 0

Re: pass-through authentication
by Timothy Keith 31 Dec '15

31 Dec '15

I'm still having troubles with pass-through SASL on RHEL testsaslauthd produces this message : 0: NO "authentication failed" With this in the system log : saslauthd logs reason=Unknown When saslauthd is launched in verbose mode and followed by testsaslauthd it prints : connect() : No such file or directory Tim On Thu, Dec 24, 2015 at 1:46 PM, Timothy Keith <timothy.g.keith(a)gmail.com> wrote: > As per my ongoing LDAP SASL design question, can anyone recommend a good > tutorial for pass-through authentication ? > > Tim > > On Tue, Dec 22, 2015 at 2:47 PM, Timothy Keith <timothy.g.keith(a)gmail.com> > wrote: > >> Uwe, your assistance could be very helpful. I followed Open LDAP >> tutorials but could not determine why the SASL requests fail. I am a >> newcomer to LDAP. >> >> Tim >> >> On Mon, Dec 21, 2015 at 12:04 PM, Hering, Uwe <uwe.hering(a)cgi.com> wrote: >> >>> Hello Tim, >>> >>> we have set up such a setup where one can authenticate against OpenLDAP >>> which redirects the request via saslauthd/kerberos to an AD server. Within >>> the AD a service account with corresponding keytab will be necessary. >>> >>> If you are interested I can try to get the pieces of information >>> together again. >>> >>> Regards, >>> >>> Uwe >>> >>> -----Ursprüngliche Nachricht----- >>> Von: openldap-technical [mailto:openldap-technical-bounces@openldap.org] >>> Im Auftrag von Timothy Keith >>> Gesendet: Freitag, 18. Dezember 2015 01:33 >>> An: openldap-technical(a)openldap.org >>> Betreff: pass-through authentication >>> >>> We are attempting to set up an LDAP server which will answer queries >>> from an application. The database will contain metadata on a set of users >>> in the application. The application will also query the server to >>> authenticate the user’s password, however, this server will not house the >>> password. That resides on another server, which our server >>> will query. We do not have administrative rights to the other >>> server. >>> >>> The difficulty we are having now is setting up the pass-through >>> authentication for the passwords. Any pointers in how to proceed with this >>> would be greatly appreciated. >>> >>> Regards, >>> >>> Tim >>> >>> >> >

2 3

Re: openldap 2.4.43 keeps crashing
by Jephte Clain 30 Dec '15

30 Dec '15

2015-12-29 20:47 GMT+04:00 Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Monday, December 28, 2015 10:18 PM -0800 Quanah Gibson-Mount > <quanah(a)zimbra.com> wrote: > >> David, >> >> Why haven't you reported this to the ITS? > > > Discussed with Howard. It isn't in 0.9 yet because it hasn't been confirmed > if the fix is good or not. David, if that fix has resolved the issue, > *please* follow up with the ITS noting that to be the case. > Hello, I can confirm this is the problem I have. Starting slapd in debug mode, it dies after some time: /tmp/buildd/openldap-2.4.43/servers/slapd/back-mdb/../../../libraries/liblmdb/mdb.c:5276: Assertion 'NUMKEYS(mp) > 1' failed in mdb_page_search_root() /usr/local/slaptools/lib/functions: line 44: 30232 Abandon /usr/sbin/slapd -h "$SLAPD_SERVICES" -g "$SLAPD_GROUP" -u "$SLAPD_USER" -F "$SLAPDD" -d "$dlevel" "$@" I didn't notice it because it doesn't dump core. And somehow, the initscript I use eats the stderr output of slapd (I'll fix it for future errors) For now, I'll revert to the previous working version, but I'm willing to test any fix The funny part is only the replica dies regularly, not the master although it is the one to receive the writes Thanks to all for your precious help. Very best regards, Jephté -- Jephté CLAIN | Développeur, Intégrateur d'applications Service Système d'Information Direction des Systèmes d'Information Tél: +262 262 93 86 31 || Gsm: +262 692 29 58 24

2 1

SASL Passthrough no request
by Küchler, Simon 30 Dec '15

30 Dec '15

Hello, I need help with the following problem. Our password authetication should use SASL but we don't see any requests in our Logs or by tcpdump. The password authentication should work as follows - userPassword-Attribute: {SASL}User@Domain - saslauthd -> use PAM - PAM -> use kerberos - kerberos -> send request to Active-Directory Server RPM list: --------------------- lshxx0693:~ # rpm -qa | grep sasl cyrus-sasl-gssapi-32bit-2.1.22-182.20.1 cyrus-sasl-gssapi-2.1.22-182.20.1 cyrus-sasl-2.1.22-182.20.1 cyrus-sasl-32bit-2.1.22-182.20.1 cyrus-sasl-digestmd5-2.1.22-182.20.1 cyrus-sasl-digestmd5-32bit-2.1.22-182.20.1 cyrus-sasl-devel-2.1.22-182.20.1 cyrus-sasl-saslauthd-2.1.22-182.19 lshxx0693:~ # rpm -qa | grep krb krb5-1.6.3-133.49.64.1 krb5-32bit-1.6.3-133.49.64.1 pam_krb5-2.3.1-47.12.1 pam_krb5-32bit-2.3.1-47.12.1 krb5-doc-1.6.3-133.49.64.1 krb5-plugin-kdb-ldap-1.6.3-133.49.64.1 krb5-server-1.6.3-133.49.64.1 krb5-client-1.6.3-133.49.64.1 lshxx0693:~ # rpm -qa | grep ldap openldap2-2.4.26-0.28.5 openldap2-client-2.4.26-0.28.5 openldap2-devel-2.4.26-0.28.5 pam_ldap-184-147.20 pam_ldap-32bit-184-147.20 nss_ldap-262-11.32.39.1 nss_ldap-32bit-262-11.32.39.1 libldap-2_4-2-2.4.26-0.28.5 libldap-2_4-2-32bit-2.4.26-0.28.5 libldapcpp1-0.3.0-0.9.29 libevoldap-2_4-2-2.4.12-4.19 yast2-ldap-2.17.8-0.7.61 yast2-ldap-client-2.17.38-0.7.2 yast2-ldap-server-2.17.44-0.5.1 lshxx0693:~ # rpm -qa | grep cyrus cyrus-sasl-gssapi-2.1.22-182.20.1 cyrus-sasl-gssapi-32bit-2.1.22-182.20.1 cyrus-sasl-saslauthd-2.1.22-182.19 cyrus-sasl-devel-2.1.22-182.20.1 cyrus-sasl-2.1.22-182.20.1 cyrus-sasl-32bit-2.1.22-182.20.1 cyrus-sasl-digestmd5-2.1.22-182.20.1 cyrus-sasl-digestmd5-32bit-2.1.22-182.20.1 Configuration files: ---------------------------- lshxx0693:~ # cat /etc/sasl2/slapd.conf mech_list: plain login pwcheck_method: saslauthd lshxx0693:~ # cat /etc/sysconfig/saslauthd SASLAUTHD_AUTHMECH=pam SASLAUTHD_THREADS=5 SASLAUTHD_PARAMS="-r" lshxx0693:~ # cat /etc/pam.d/ldap auth required pam_krb5.so no_user_check account required pam_permit.so lshxx0693:/etc/pam.d/ # cat common-account | egrep -v "^#" account requisite pam_unix2.so account sufficient pam_localuser.so account required pam_ldap.so use_first_pass lshxx0693:/etc/pam.d/ # cat common-account-pc | egrep -v "^#" account requisite pam_unix2.so account sufficient pam_localuser.so account required pam_ldap.so use_first_pass lshxx0693:/etc/pam.d/ # cat common-auth | egrep -v "^#" auth required pam_env.so auth sufficient pam_unix2.so auth required pam_ldap.so use_first_pass lshxx0693:/etc/pam.d/ # cat common-auth-pc | egrep -v "^#" auth required pam_env.so auth sufficient pam_unix2.so auth required pam_ldap.so use_first_pass shxx0693:/etc/pam.d/ # cat common-password | egrep -v "^#" password requisite pam_pwcheck.so nullok cracklib password sufficient pam_unix2.so use_authtok nullok password required pam_ldap.so try_first_pass use_authtok lshxx0693:/etc/pam.d/ # cat common-session | egrep -v "^#" session optional pam_mkhomedir.so session required pam_limits.so session required pam_unix2.so session optional pam_ldap.so session optional pam_umask.so lshxx0693:/etc/pam.d/ # cat common-session-pc | egrep -v "^#" session optional pam_mkhomedir.so session required pam_limits.so session required pam_unix2.so session optional pam_ldap.so session optional pam_umask.so lshxx0693:/etc/pam.d/ # cat common-password-pc | egrep -v "^#" password requisite pam_pwcheck.so nullok cracklib password sufficient pam_unix2.so use_authtok nullok password required pam_ldap.so try_first_pass use_authtok lshxx0693:~ # pam-config --verify lshxx0693:~ # lshxx0693:~ # cat /etc/krb5.conf [libdefaults] default_realm = INT.IT.DPP dns_lookup_kdc = true [realms] INT.IT.DPP = { kdc = 10.150.10.10 kdc = 10.150.10.10 } [logging] default = SYSLOG:NOTICE:DAEMON lshxx0693:~ # cat /etc/nsswitch.conf | egrep -v "#" passwd: compat group: files ldap hosts: files dns networks: files dns services: files ldap protocols: files rpc: files ethers: files netmasks: files netgroup: files ldap publickey: files bootparams: files automount: files nis aliases: files ldap passwd_compat: ldap Tell me, if you need more informations, please. I would like to thank you in advance for your help. Best wishes S. Kuechler

2 1

Re: Can't open env with required mapsize on windows .
by Howard Chu 30 Dec '15

30 Dec '15

Mohammed Muneer wrote: > > "Windows is like that." > > I know. Please keep your replies on the mailing list. > "Have no idea what you're actually doing, so it's impossible to answer. > Learn to ask better questions and provide better information." > > Sorry that I didn't sound intelligent. I was in a hurry when I wrote it. > I will now try to give you a detailed account of what I am doing. > > > "What revision of LMDB?" > > The latest hosted at https://github.com/LMDB/lmdb. "The latest" in which branch? Note that mdb.master is the main development branch and contains work-in-progress code that is probably not stable. As a non-LMDB-developer you should only be using actual tagged releases. You may occasionally want to use the mdb.RE/xx release engineering branches if they contain a fix for a specific issue that you encountered. > "Which version of Windows?" > > All are Windows 7 Ultimate x64 > > > "How much free disk space is there?" > > Machine 1 has around 26 GB free. Machine 2 has around 40 GB free. > Virtualbox guest has only has around 10 GB free. > > > "What else is your application code doing?" > > This is silly. My application was trying to open an env on windows. Here > is the code for it. > > > #define MB * 1024 * 1024 > #define GB * 1024 * 1024 * 1024 > > MDB_env *env = 0; > > bool openEnv() { > mdb_size_t mapSize = 390 MB; > MDB_dbi maxNamedDatabases = 100; > > > if (mdb_env_create(&env) != MDB_SUCCESS) > return false; > > if (mdb_env_set_mapsize(env, mapSize) != MDB_SUCCESS) > return false; > > if (mdb_env_set_maxdbs(env, maxNamedDatabases) != MDB_SUCCESS) > return false; > > int err = mdb_env_open(env, "test", 0, 0664); > > if (err != MDB_SUCCESS) { > fprintf(stderr, "Error opening env %i", err); > return false; > } > fprintf(stderr, "Success opening env %i", err); > > return true; > } > > int main() { > > if (!openEnv()) > return 1; > > } > > > > > "How do you know that only XX MB were "opened" > > Trial and error on windows showed that mdb_env_open returns success when > I give a mapSize of 390 MB on Machine 1, etc... > But on further testing, we can open 2 GB sometimes. But after a system > restart, situation is still the same. > > > "what stats are you checking? " > > Well as you can see from the above code, I am checking the return value > of mdb_env_open(). > > > > "What other differences exist between machine 1 and machine 2?" > > Not much. One being a core-i3 and the other core-i5. Both have 4 GB RAM. > Both are similiar in that none of them have > so many applications installed and all have used memory around 500 MB > > > > "What other processes are running," > > As I stated its mostly a default installation of Windows x64 on all > machines. > > > > "how much memory are they consuming on each machine?" > > Are you referring to other processes or my application. Assuming you are > talking about my application, it is just a > main function. So that might be irrelevant > > > > "Note that just because you create a 1GB memory map of a file doesn't > mean that it will actually consume 1GB of RAM. > That's not how memory mapping works." > > Never said that. Didn't even imply it. Don't know where you are getting > this. I know how memory map works. Having implemented > one in a custom hobby OS 5 years ago. Your implementation leveraging COW > along with performance and MVCC was the whole reason I was > interested in your project. > > > > "Read your Windows developer documentation, MSDN is always there for you > to read. We're not here to teach you how your OS works." > > You don't have to teach me how my OS works. Sorry if I gave you that > impression. Apparently we do. See below. > "Hangs where, exactly? Have you gotten a stack trace from such a hang? > That's the obvious first step that any application developer should know to do." > > On windows, if I dont set env_set_mapsize(env, 0) just before beginning > a write transaction, then first insert will complete successfully. On the second > write transaction while the application is running, and we try to for > eg: mdb_cursor_get(), it doesn't return. This can be reproduced with the below > stated toolchain. > > > ----------- > > For further notes, I am using official QtSDK-mingw on windows which is a > 32 bit compiler. But sometimes I can get LMDB to open the env > succesffully for 2 gb, etc. But on a system restart, the situation is > still the same. You can't address more than 2GB of memory in 32 bit code. You generally won't be able to create a 2GB mmap in a 32 bit process because other DLLs will already be occupying large chunks of the 32 bit address space. > But I downloaded an unofficial QtSDK-mingw-64 with the same result. But > when I change > mdb_size_t mapSize = 2147483648; // 2 GB > to > mdb_size_t mapSize = 2147483648LL; > > it works. > > > But setting 2147483648LL does not work (meaning does not return > MDB_SUCCESS) most of the times on mingw-32-bit That is expected. Again, you should already know how your OS works. > So the quesstion really is how to get it working when compiled on a > 32-bit compiler and executed on both 32 and 64 bit Windows? > > Note: I am not referring to vl32 branch because I don't want to have to > use more than 2GB as the size of my env file. It can't be done. > > > On Mon, Dec 28, 2015 at 2:17 PM, Howard Chu <hyc(a)symas.com > <mailto:hyc@symas.com>> wrote: > > Mohammed Muneer wrote: > > > I can env_set_mapsize(env, 1 GB) without any problems in linux. > > But on windows, it is a different story > > > Windows is like that. > > Machine 1) Windows 64 only opens with upto 10 MB (apporx) > Machine 2 Windows 64 only opens with upto 500 MB (apporx) > Machine 3) Virtual box Windows 64 running on linux works with 1 GB > > Q1) So why is this happening. Am I doing anything wrong. > > > Have no idea what you're actually doing, so it's impossible to answer. > Learn to ask better questions and provide better information. > > What revision of LMDB? Which version of Windows? How much free disk space > is there? What else is your application code doing? How do you know that > only XX MB were "opened", what stats are you checking? What other > differences exist between machine 1 and machine 2? > > What other processes are running, how much memory are they consuming on > each machine? Note that just because you create a 1GB memory map of a file > doesn't mean that it will actually consume 1GB of RAM. That's not how > memory mapping works. Read your Windows developer documentation, MSDN is > always there for you to read. We're not here to teach you how your OS works. > > Q2) And setting env_set_mapsize before calling open is not enough. I > need to set > env_set_mapsize(env, 0) just before beginning a write transaction > inorder to > insert something or otherwise the application indefinitely > hangs on the > second insert transaction. > > > Hangs where, exactly? Have you gotten a stack trace from such a hang? > That's the obvious first step that any application developer should know > to do. > > > Both the above questions concerns just Windows. Everything is fine > with linux. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 3

Re: Regarding ITS 8268 slapd-ldap quarantine
by Nikos Voutsinas 29 Dec '15

29 Dec '15

On Tuesday, 29 December 2015, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, December 29, 2015 5:22 PM +0200 Nikos Voutsinas < > nvoutsin(a)gmail.com> wrote: > > >> >> >> Hi, >> >> >> May I ask how come and ITS 8268 never made it to software bugs? Isn't the >> case well described? >> > > OpenLDAP is a volunteer project. People work on items as they have > time/availability. If you feel an issue is urgent, you may wish to provide > a fix/patch as per the contribution guidelines, or engage support with a > company such as Symas. > > --Quanah > > > Understood, no need to clarify this. Obviously not so many from the community are using slapd-ldap quarantine. Anyway, let's say that the first step has been made and a bug report has been filed. That would have saved me some time, if someone else had done it before. Best Regards, Nikos

1 0

Re: openldap 2.4.43 keeps crashing
by Jephte Clain 29 Dec '15

29 Dec '15

Le 29/12/2015 00:55, David Hawes a écrit : > On 28 December 2015 at 01:31, Jephte Clain <jephte.clain(a)univ-reunion.fr> wrote: >> hello all, >> >> I upgraded to OpenLDAP 2.4.43 three weeks ago. It runs on debian squeeze >> 64bits lts >> it is built from sources with the fix from ITS#8330 >> >> Since the upgrade, it keeps crashing regularly (I would say once every 2 to >> 5 days) >> However, there isn't anything in the logs: no message, no error, no nothing >> >> slapd no longer runs, I restart it, and it runs ok until the next crash >> >> now I don't know how to debug that. >> I could downgrade to the previous version (2.4.41) which worked fine, but as >> our university is closed until 01/11, this is the perfect time to >> investigate. I still don't know if it's a bug in 2.4.43 or a >> misconfiguration for which previous versions was forgiving >> >> What are your advice to track down the cause for the crash? >> >> PS: here is a bit of context: >> one master with 2 mdb databases: one accesslog, one for the data >> two slaves (I mean complete replication, even cn=config) >> the master has crashed only once >> the slaves keep crashing regularly >> the slaves are complete replicas of the master, and I wonder if it could be >> a source of problems: I'll give details in another thread > Do you have accesslog purge configured? > > I ran into this on an accesslog purge with 2.4.43: > > http://www.openldap.org/its/index.cgi/Software%20Bugs?id=8336;selectid=8336 > > If you start slapd with '-d 1', you should be able to see if it is the issue. > > The fix referenced in that ITS worked for me. hello, thanks for the response. no, purge is not configured, but this is a nice suggestion... without purge, I guess the accesslog database would keep growing forever :-( thanks again, regards, Jephté CLAIN -- *Jephté CLAIN | Développeur, Intégrateur d'applications* Service Systèmes d'Information Direction des Systèmes d'Information <http://dsi.univ-reunion.fr> Tél: +262 262 93 86 31 <tel:+262262938631> || Gsm: +262 692 29 58 24 <tel:+262692295824> www.univ-reunion.fr <http://www.univ-reunion.fr> || Facebook <http://www.facebook.com/pages/Universit%C3%A9-de-La-R%C3%A9union-OFFICIEL/1…> || Twitter <http://twitter.com/univ_reunion>

2 3

Regarding ITS 8268 slapd-ldap quarantine
by Nikos Voutsinas 29 Dec '15

29 Dec '15

Hi, May I ask how come and ITS 8268 never made it to software bugs? Isn't the case well described? Anyway, while we have already worked around the problem, actually by disabling the feature, I was curious if the dev team or anyone else has tested slapd-ldap quarantine with a recent Openldap version ( we have noticed similar behavior both with 2.4.41 and 2.4.42) http://www.openldap.org/its/index.cgi/Incoming?id=8268 Best Regards, Nikos

2 1

what databases are to be replicated for a slave?
by Jephte Clain 29 Dec '15

29 Dec '15

hello, I've had problems with an upgrade to openldap 2.4.43, and I reviewed my configuration to check for errors I have two slaves which replicate all databases from the master, including cn=config. My reasoning is in case of a severe crash, I'd like one of the slaves to be able to become the new master. To allow such a scenario, each database in the master have a syncrepl directive to replicate from itself. It obviously have no effect on the master, but the slave that replicate this configuration get the right directives to replicate from the master. so far so good... now this is my question: should/could the accesslog configured this way? or should the accesslog be strictly local to a server? I mean, should I remove the syncrepl directive from the accesslog database? This configuration have run without errors until 2.4.41, but I got a weird error about accesslog corruption when I upgraded to 2.4.43 (sorry I didn't write the error down), hence my question Thanks in advance for any response. best regards, Jephté CLAIN PS: I hope it's clear enough. English is not my native language -- *Jephté CLAIN | Développeur, Intégrateur d'applications* Service Systèmes d'Information Direction des Systèmes d'Information <http://dsi.univ-reunion.fr> Tél: +262 262 93 86 31 <tel:+262262938631> || Gsm: +262 692 29 58 24 <tel:+262692295824> www.univ-reunion.fr <http://www.univ-reunion.fr> || Facebook <http://www.facebook.com/pages/Universit%C3%A9-de-La-R%C3%A9union-OFFICIEL/1…> || Twitter <http://twitter.com/univ_reunion>

2 5

openldap 2.4.43 keeps crashing
by Jephte Clain 29 Dec '15

29 Dec '15

hello all, I upgraded to OpenLDAP 2.4.43 three weeks ago. It runs on debian squeeze 64bits lts it is built from sources with the fix from ITS#8330 Since the upgrade, it keeps crashing regularly (I would say once every 2 to 5 days) However, there isn't anything in the logs: no message, no error, no nothing slapd no longer runs, I restart it, and it runs ok until the next crash now I don't know how to debug that. I could downgrade to the previous version (2.4.41) which worked fine, but as our university is closed until 01/11, this is the perfect time to investigate. I still don't know if it's a bug in 2.4.43 or a misconfiguration for which previous versions was forgiving What are your advice to track down the cause for the crash? PS: here is a bit of context: one master with 2 mdb databases: one accesslog, one for the data two slaves (I mean complete replication, even cn=config) the master has crashed only once the slaves keep crashing regularly the slaves are complete replicas of the master, and I wonder if it could be a source of problems: I'll give details in another thread -- *Jephté CLAIN | Développeur, Intégrateur d'applications* Service Systèmes d'Information Direction des Systèmes d'Information <http://dsi.univ-reunion.fr> Tél: +262 262 93 86 31 <tel:+262262938631> || Gsm: +262 692 29 58 24 <tel:+262692295824> www.univ-reunion.fr <http://www.univ-reunion.fr> || Facebook <http://www.facebook.com/pages/Universit%C3%A9-de-La-R%C3%A9union-OFFICIEL/1…> || Twitter <http://twitter.com/univ_reunion>

4 6

RE: lmdb Handle Leak with VL32 on Windows
by Jeremiah Morrill 28 Dec '15

28 Dec '15

Submitted (seems like #8342). Apologies for not doing this before. I will go through ITS with reports in the future. -Jer From: Howard Chu<mailto:hyc@symas.com> Sent: Monday, December 28, 2015 12:12 AM To: Jeremiah Morrill<mailto:Jeremiah.Morrill@econnect.tv>; openldap-technical(a)openldap.org<mailto:openldap-technical@openldap.org> Subject: Re: lmdb Handle Leak with VL32 on Windows Jeremiah Morrill wrote: > I noticed what I believe may be a handle leak against the latest (commit > 7b9928c) on github, with the MDB_VL32 on Windows. After some poking around, > it seems to be the file mapping handle, env->me_fmh. I threw it to a > CloseHandle in the env_close0(…) and it seemed to resolve it. Please submit this to the ITS. > > Here’s a quick diff: > > diff --git a/src/lmdb.c b/src/mdb.c > > index a564d40..190c860 100644 > > --- a/src/mdb.c > > +++ b/src/mdb.c > > @@ -5350,6 +5350,7 @@ mdb_env_close0(MDB_env *env, int excl) > > } > > #ifdef MDB_VL32 > > #ifdef _WIN32 > > + if (env->me_fmh) CloseHandle(env->me_fmh); > > if (env->me_rpmutex) CloseHandle(env->me_rpmutex); > > #else > > pthread_mutex_destroy(&env->me_rpmutex); > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Can't open env with required mapsize on windows .
by Mohammed Muneer 28 Dec '15

28 Dec '15

I can env_set_mapsize(env, 1 GB) without any problems in linux. But on windows, it is a different story Machine 1) Windows 64 only opens with upto 10 MB (apporx) Machine 2 Windows 64 only opens with upto 500 MB (apporx) Machine 3) Virtual box Windows 64 running on linux works with 1 GB Q1) So why is this happening. Am I doing anything wrong. Q2) And setting env_set_mapsize before calling open is not enough. I need to set env_set_mapsize(env, 0) just before beginning a write transaction inorder to insert something or otherwise the application indefinitely hangs on the second insert transaction. Both the above questions concerns just Windows. Everything is fine with linux.

2 2

lmdb Handle Leak with VL32 on Windows
by Jeremiah Morrill 28 Dec '15

28 Dec '15

I noticed what I believe may be a handle leak against the latest (commit 7b9928c) on github, with the MDB_VL32 on Windows. After some poking around, it seems to be the file mapping handle, env->me_fmh. I threw it to a CloseHandle in the env_close0(…) and it seemed to resolve it. Here’s a quick diff: diff --git a/src/lmdb.c b/src/mdb.c index a564d40..190c860 100644 --- a/src/mdb.c +++ b/src/mdb.c @@ -5350,6 +5350,7 @@ mdb_env_close0(MDB_env *env, int excl) } #ifdef MDB_VL32 #ifdef _WIN32 + if (env->me_fmh) CloseHandle(env->me_fmh); if (env->me_rpmutex) CloseHandle(env->me_rpmutex); #else pthread_mutex_destroy(&env->me_rpmutex);

2 1

Authenticating clients
by bluethundr＠gmail.com 25 Dec '15

25 Dec '15

Hey guys, I've recently disabled anonymous binds and required TLS on my OpenLDAP sever in order to log in. Back when I was testing and anonymous binds were enabled and TLS was off I could get LDAP accounts to login to the servers. And using a simple tool like "authconfig-tui" under CentOS was all I needed to use to set that up. Where can I find the docs to configure a client server to allow LDAP account logins with anonymous binds disabled and TLS required on the OpenLDAP server? I need to do this for both Red Hat/CentOS machines and Ubuntu clients as well. I've been googling and haven't found anything helpful for both types. Thanks, Tim Sent from my iPhone

2 1

users don't get prompt to change password (pwdMustChange attribute)
by Rajagopal Rc 24 Dec '15

24 Dec '15

Hello, I am trying to force user to change their password at first logon and on password reset. OS RHEL7 Openldap version 2.4.39-7.el7_1.x86_64 I have tried the following 1) I have set the pwdMustChange attribute to TRUE in ppolicy, but when user logon to client at first time or after resetting password, it just allow suer to logon without prompting to change the password, 2) I have set the pwdReset attribute to TRUE in user attribute for particular user, this doesn't allow user to login at all and keep prompting for password without allowing to login. Also i red in blogs this is not correct way, but couldn't find more information on this. is there any way to force users to change their password at first logon and after resetting password by admin. ? Current ppolicy Thanks & Regards Raj =====-----=====-----===== Notice: The information contained in this e-mail message and/or attachments to it may contain confidential or privileged information. If you are not the intended recipient, any dissemination, use, review, distribution, printing or copying of the information contained in this e-mail message and/or attachments to it are strictly prohibited. If you have received this communication in error, please notify us by reply e-mail or telephone and immediately and permanently delete the message and any attachments. Thank you

1 0

Issue while changing user password by self
by Rajagopal Rc 24 Dec '15

24 Dec '15

Hello, I am trying to allow users to change their own passwords OS RHEL7 Openldap version 2.4.39-7.el7_1.x86_64 ACL in slapd.conf disallow bind_anon access to attrs=userPassword by self write by dn.base="cn=mirrormode,dc=rnd,dc=com" read by dn.base="cn=binduser,dc=rnd,dc=com" read by * auth access to * by dn.base="cn=mirrormode,dc=rnd,dc=com" read by dn.base="cn=binduser,dc=rnd,dc=com" read by * break access to * by dn="cn=Manager,dc=rnd,dc=com" by users read by self write by * auth from client machine 'user5' is trying to change own password and getting following error $ ldappasswd -H ldaps://ldapdev.rnd.com:636 -x -D "cn=user 5,ou=people,dc=rnd,dc=com" -W -A -S Old password: Re-enter old password: New password: Re-enter new password: Enter LDAP Password: Result: Insufficient access (50) Additional info: User alteration of password is not allowed This error looks like issue with permissions, yet i have already allowed access to attrs=userPassword by self write in slapd.conf, please let me know if there is any thing wrong in above ACL and why i am getting this error Thanks & Regards Raj =====-----=====-----===== Notice: The information contained in this e-mail message and/or attachments to it may contain confidential or privileged information. If you are not the intended recipient, any dissemination, use, review, distribution, printing or copying of the information contained in this e-mail message and/or attachments to it are strictly prohibited. If you have received this communication in error, please notify us by reply e-mail or telephone and immediately and permanently delete the message and any attachments. Thank you

4 6

Segmentation fault (core dumped) on ldapmodify
by Tim Dunphy 24 Dec '15

24 Dec '15

Hey guys, I have these options set for SSL in my cn=config setup: [root@ldap1:~] #ldapsearch -Y EXTERNAL -H ldapi:/// -b cn=config|grep ssl SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 olcTLSCACertificateFile: /etc/ssl/certs/ldap-ca-cert.pem olcTLSCertificateFile: /etc/ssl/certs/ldap-server.crt olcTLSCertificateKeyFile: /etc/ssl/certs/ldap-server.key And I want to change the settings to the contents of this ldif file: [root@ldap1:~] #cat addcerts.ldif dn: cn=config changetype: modify add: olcTLSCACertificateFile olcTLSCACertificateFile: /etc/pki/CA/certs/ca.crt - add: olcTLSCertificateFile olcTLSCertificateFile: /etc/ldap/ssl/ldap1.example.com.crt - add: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/ldap/ssl/ldap1.example.com.key But when I try to do that I get an error: [root@ldap1:~] #ldapmodify -H ldapi:// -Y EXTERNAL -f addcerts.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 Segmentation fault (core dumped) I wonder if I could be running low on memory: [root@ldap1:~] #free -m total used free shared buffers cached Mem: 992 815 177 10 140 445 -/+ buffers/cache: 229 762 Swap: 0 0 0 Could this be causing the error? How can I make this change without encountering the segmentation fault? Thanks, Tim -- GPG me!! gpg --keyserver pool.sks-keyservers.net --recv-keys F186197B

3 4

pwdChangedTime Undefined Attribute
by Borresen, John - 0444 - MITLL 24 Dec '15

24 Dec '15

All, The "ppolicy" overlay has been loaded to my bdb. The cn=default,ou=pwpolicies,dc=group,dc=ldap has been defined. The pwdPolicySubentry operational attribute was added to uid=jdoe,ou=Users,dc=group,dc=ldap, as well. Now, trying to add the pwdChangedTime attribute to the jdoe UID. Ran "ldapadd" from the command-line: # ldapmodify -d 4 -x -W -H ldap://ldapsrvr.group.ldap -D cn=ldapadmin,dc=group,dc=ldap Enter LDAP Password: ############ dn: uid=jdoe,ou=Users,dc=group,dc=ldap changetype: add add: pwdChangedTime pwdChangedTime: 201512231458Z adding new entry "uid=jdoe,ou=Users,dc=group,dc=ldap" ldap_add: Undefined attribute type (17) additional info: add: attribute type undefined >From my reading, this should be an Operational Attribute that isn't constrained or defined by an ObjectClass. Thanks for the help in advance. Btw, I am running OpenLDAP 2.4.40. John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Humanitarian Assistance and Disaster Relief (HADR) Systems 244 Wood St Lexington, MA 02420 Email: <mailto:john.borresen@ll.mit.edu> john.borresen(a)ll.mit.edu

2 4

LMDB many dup fixed size elements
by Simon Majou 23 Dec '15

23 Dec '15

Hello, I want to allow users to create tables with dup fixed size. A solution would be to create named databases, but that would make potentially a lot of tables (for instance millions), and doesn't seem ok cf the comment on function mdb_env_set_maxdbs. Another solution would be to create one DB for each fixed size and insert the users and their tables inside. Would it be better ? -- Best regards, Simon

1 0

openldap newbie - olcAccess ACL configuration
by Gary Spencer 23 Dec '15

23 Dec '15

Hi, I have deployed a new OpenLDAP server (RHEL 7.1 / openldap-2.4) and have read Matt Butcher's 'Mastering ...' book and the OpenLDAP-Admin-Guide but I'm continuing to struggle to find the information I need to satisfactorily configure using the dynamic way of working instead of using the legacy slapd.conf method. (Any reference to administering ldap using dynamic method would be appreciated) I have OpenLDAP basically configured to answer queries using the Manager object, but I want to remove current privileges and have just two accounts in the system ou - one with read only to the users ou and all objects therein, and one with the equivalent of Manager rights to the users OU that I can give to my devs to create their own users. I would retain the Manager account for full access, but would just like to give out the readonly and readwrite accounts in system OU permissions to users OU, and remove users permissions to anything but themselves. My intention is to delete the existing olcAccess rules and implement a new set, but I can't get rid of the old rules as it's not letting me. When I try 'ldapmodify -x -W -H "ldap://HOSTNAME" -D "cn=Manager,dc=SUBDOMAIN,dc=DOMAIN,dc=TLD" -f acl_delete_file.ldif' I receive :- 'modifying entry "olcDatabase={2}hdb,cn=config" ldap_modify: Insufficient access (50)' The delete ldif looks like this :- # {2}hdb, config dn: olcDatabase={2}hdb,cn=config delete: olcAccess I am using the default hdb database. I understood 'Manager' had full access to everything regardless, can anyone shed any light on why this request would be refused ? Gary Spencer Infrastructure Project Engineer [http://www.sis.tv/contentAsset/raw-data/369d823c-5153-4089-a9b6-4d868930a68…]<http://www.sis.tv/contact/streaming-from-sis.html> ********************************************************************** Satellite Information Services Limited. Registered Office: Whitehall Avenue, Kingston, Milton Keynes, Buckinghamshire, MK10 0AX. Company No. 4243307 The information in this email (which includes any files transmitted with it) is confidential and is intended for the addressee only. Unauthorized recipients are required to maintain confidentiality. If you have received this email in error please notify the sender immediately, destroy any copies and delete it from your computer system. **********************************************************************

2 1

Server Side Searching Overlay
by Michael 23 Dec '15

23 Dec '15

So I have a request from developers to enable the sssvlv overlay. They would like the server to return sorted searches on I enabled the overlay and then to test the functionality I added the following "ordering" rule to the core.schema. attributetype ( 2.5.4.4 NAME ( 'sn' 'surname' ) DESC 'RFC2256: last (family) name(s) for which the entity is known by' ORDERING caseIgnoreOrderingMatch SUP name ) The following ldapsearch works as expected and returns the "sn" attribute in alphabetical order. ldapsearch -x -ZZ -D cn=root,dc=testlott,dc=lott -w password objectclass=person -E sss=sn sn Based on this information I have several questions. 1. Will I be violating any RFC by modifying the core.schema?2. The developers want the same functionality with the "cn" attribute. Is this supported or even possible?3. They also request this functionality on a couple of attributes in a custom schema. Is adding an "ordering" rule as I did with the "sn" attribute the proper way to do this? Thanks.

3 8

access log or last bind overlay working with bind_anon?
by Tan, Eric 22 Dec '15

22 Dec '15

Hello, I have been doing a lot of research into OpenLDAP and it’s functionalities.. While I have set up a few OpenLDAP servers before, there are many facets of the software I am unfamiliar with. Recently, I was asked to find a way to obtain a list of users and their last login for auditing reasons (We need to disable the users after a certain amount of time of inactivity) I have looked into a few different solutions but have been unable to reach anyone with enough knowledge for some reason so here is an email with some hope as to get some information to point me in the right direction. I think there are two things that may work for my purposes.. The last bind overlay or the access log overlay. For the Lastbind overlay, since we are using anonymous bind, do you know if this will still work for us? For the access log, how would I pull this specific information out of the database? According to the man pages: logops <operations> Specify which types of operations to log. The valid operation types are abandon, add, bind, compare, delete, extended, modify, modrdn, search, and unbind. Aliases for common sets of operations are also available: writes add, delete, modify, modrdn reads compare, search Session Would this work if are using anonymous binding as well? Any help would be greatly appreciated! -Eric

1 0

Bug in last LMDB GitHub commit (Windows + VL32)
by Jeremiah Morrill 22 Dec '15

22 Dec '15

Pretty excited about the 32bit support! I was just kicking the tires on it today and I realize this is still a work in progress, but I wanted to report a possible bug with VL32/Windows. When I open a database with MDB_RDONLY and seek a cursor to MDB_LAST, I get a system error code of 0xc000004e (STATUS_SECTION_PROTECTION) from NtMapViewOfSection. This is presumably because of the MEM_RESERVE_FLAG is present on the open of the db when MDB_RDONLY is used. After patching up the NtMapViewOfSection, I get a 0xc000001f(STATUS_INVALID_VIEW_SIZE) from NtMapViewOfSection. I believe this happens because it is requesting a view that goes beyond the size of the db. A quick adjustment on the “len” being requested seems to have “fixed” it. I have included a diff patch below. I realize this is a naïve hack, but hoped it could be useful in reproducing and fixing. -Jer diff --git a/src/lmdb/mdb.c b/src/lmdb/mdb.c index 297d3e3..d594a6f 100644 --- a/src/lmdb/mdb.c +++ b/src/lmdb/mdb.c @@ -5655,7 +5655,7 @@ mdb_rpage_get(MDB_txn *txn, pgno_t pg0, MDB_page **ret) #define MAP(rc,env,addr,len,off) \ addr = NULL; \ rc = NtMapViewOfSection(env->me_fmh, GetCurrentProcess(), &addr, 0, \ - len, &off, &len, ViewUnmap, MEM_RESERVE, PAGE_READONLY) + len, &off, &len, ViewUnmap, ((env->me_flags & MDB_RDONLY) == 0) ? MEM_RESERVE : 0, PAGE_READONLY) #else off_t off; size_t len; @@ -5835,6 +5835,14 @@ retry: } } SET_OFF(off, pgno * env->me_psize); + +#ifdef MDB_VL32 + if(off.QuadPart + len > env->me_mapsize) + { + len = env->me_mapsize - off.QuadPart; + } +#endif + MAP(rc, env, id3.mptr, len, off); if (rc) { fail:

2 1

Re: pass-through authentication
by Chuck Theobald 22 Dec '15

22 Dec '15

Sounds like a SASL2 pass-through solution could work, esp. if you can get an account there with query capabilities. I will look for some references that could get you started. Chuck Sent from my Verizon Wireless 4G LTE DROID Timothy Keith <timothy.g.keith(a)gmail.com> wrote: >We have limited access to the servers. Same company, different IT organization. Our LDAP requirement must be transparent to those servers. We want to inherit the LDAP directory information from the Unix servers - mostly the user Id and passwords, and add information that is needed by applications that our servers will manage. > > >Tim > > >On Fri, Dec 18, 2015 at 4:01 PM, Chuck Theobald <chuckt(a)uoregon.edu> wrote: > >Details of your authn server would be helpful. Do you have access to the admins of that server? Are they cooperative? > >I tried to set this up using SASL to communicate with the campus Active Directory. Reliability is a bit suspect, it will typically take 3-4 attempts to get a successful authentication. Also, the setup requires an account on AD that is capable of making queries. The particulars of our installation force me to use my own - not ideal. > >Anyway, your situation may vary, so send us some details on what you are trying to talk to for autn. > >Chuck > > > > >On 12/17/2015 04:32 PM, Timothy Keith wrote: > >We are attempting to set up an LDAP server which will answer queries >from an application. The database will contain metadata on a set of >users in the application. The application will also query the server >to authenticate the user’s password, however, this server will not >house the password. That resides on another server, which our server >will query. We do not have administrative rights to the other >server. > > The difficulty we are having now is setting up the pass-through >authentication for the passwords. Any pointers in how to proceed with >this would be greatly appreciated. > >Regards, > >Tim > > > >-- >Chuck Theobald >System Administrator >The Robert and Beverly Lewis Center for Neuroimaging >University of Oregon >P: 541-346-0343 >F: 541-346-0345 > > >

1 0

LMDB: question about MDB_RESERVE
by Christian Sell 21 Dec '15

21 Dec '15

Hello all, I have a question about the MDB_RESERVE flag. The documentation in some places says "reserve space for data of the given size, but don't copy the given data. Instead, return a pointer to the reserved space, which the caller can fill in later - before the next update operation or the transaction ends." My question is specifically about the "before the next update operation or the transaction ends" part. Does this mean the reserved buffer becomes unusable as soon as another put is executed? What exactly happens? This statement does not appear consistently, which is why I am doubting.. thanks + happy holidays, Chris

3 3

Regarding Transactions that span Multiple files
by Mohammed Muneer 21 Dec '15

21 Dec '15

Create Env - staff Create Env - payroll Create Txn_staff Create Txn_payroll Begin write transaction for Txn_staff Insert staff data Set Txn_payroll parent to Txn_staff Begin write transaction for Txn_payroll Insert payroll data Commit Txn_payroll Commit Txn_staff ------------------------------------------------------------------ Can the above Pseudocode work in lmdb ? Or in other words can a transactions span multiple env's? Thanks.

2 1

pass-through authentication
by Timothy Keith 21 Dec '15

21 Dec '15

We are attempting to set up an LDAP server which will answer queries from an application. The database will contain metadata on a set of users in the application. The application will also query the server to authenticate the user’s password, however, this server will not house the password. That resides on another server, which our server will query. We do not have administrative rights to the other server. The difficulty we are having now is setting up the pass-through authentication for the passwords. Any pointers in how to proceed with this would be greatly appreciated. Regards, Tim

3 3

Attribute pwdPolicySubentry
by Borresen, John - 0444 - MITLL 19 Dec '15

19 Dec '15

I've been reading the Password Policy section of the Admin Guide. I am currently at this portion of the setup (the default policy is set up) You can create additional policy objects as needed. There are two ways password policy can be applied to individual objects: 1. The pwdPolicySubentry in a user's object - If a user's object has a pwdPolicySubEntry attribute specifying the DN of a policy object, then the policy defined by that object is applied. 2. Default password policy - If there is no specific pwdPolicySubentry set for an object, and the password policy module was configured with the DN of a default policy object and if that object exists, then the policy defined in that object is applied. When trying to add the pwdPolicySubentry attribute, I receive the following: "According to the schema attribute pwdPolicySubentry is not allowed." First, can someone explain the meaning of #2. The way, that I read that is that if the "pwdPolicySubentry" is not available, and the policy was created.then the policy is applied. Is that correct? My policy looks like: dn: cn=default,ou=pwpolicies,dc=example,dc=ldap objectClass: top objectClass: organizationalRole objectClass: pwdPolicy cn: default pwdAttribute: 2.5.4.35 pwdAllowUserChange: TRUE pwdExpireWarning: 14 pwdLockout: TRUE pwdLockoutDuration: 300 pwdMaxAge: 15552000 pwdMaxFailure: 5 pwdFailureCountInterval: 0 pwdMinAge: 1 pwdMinLength: 9 pwdMustChange: TRUE Thanks in advance. John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Humanitarian Assistance and Disaster Relief (HADR) Systems 244 Wood St Lexington, MA 02420 Email: <mailto:john.borresen@ll.mit.edu> john.borresen(a)ll.mit.edu

7 15

Re: Attribute pwdPolicySubentry
by Michael Ströder 19 Dec '15

19 Dec '15

Emmanuel Lécharny wrote: > Le 19/12/15 12:44, Michael Ströder a écrit : >> Howard Chu wrote: >>> Michael Ströder wrote: >>>> Borresen, John - 0444 - MITLL wrote: >>>>> Interesting! I was able to add it via command-line with ldapadd. But, when >>>>> viewing it in Apache Directory Studio, it still didn't show up -- that is >>>>> until I enabled Operational Attributes. >>>> Attribute 'pwdPolicySubentry' is somewhat special because it's not referenced by >>>> any object class. You can simply add it to any entry. >>> It is an operational attribute, so by definition, it can be added to any entry. >> But 'pwdPolicySubentry' is the only attribute typically set by a LDAP client in >> opposite to all other operational attributes like 'createTimestamp' etc. >> >> So it's special for schema-aware LDAP GUI clients. > That's irrelevant. > > It's an operational attribute that can be set by the users, which is > perfectly legit. There is nothing 'special' about it. As said: It's not special in regard to RFC 4512. But it's not that easy to implement a generic UI which guides the user to always do the right thing. And obviously there are some generic LDAP UIs out there which prevents the user from setting this attribute by false client-side schema check. > Re-read RFC 4512 section 3.4. Nothing in there describes how a client could find out which operational attribute(s) to always present in an input form. One could display input fields for all operational attrs which does not have NO-USER-MODIFICATION set. But not all servers use that consequently enough. (Not to speak of "experimental" schema used for years being hidden by errornous .666 OID policy making schema look incomplete at the client side.) Ciao, Michael.

1 0

Re: openldap-technical Digest, Vol 97, Issue 15
by Andrei Valoshyn 18 Dec '15

18 Dec '15

>> >Hello guys! >> >I tried to deploy openldap replica on Ubuntu 14.04. I copy database >> >via slapcat(slapadd) and slapd.conf from another replica(Centos 6.7 >> >with OpenLDAP: slapd 2.4.40). >> >After all slaptest errors were fixed slapd service run once, but >> >after 5 minutes without any changes it's failed to start again and >> >currently it's still doesn't work. I can't find any ldap log. >> > >> >May be somebody faced with such kind of the problem. Will be very >> >appreciate for any advices >> > > run both slapd(8) in debugging mode and level stats sync > > -Dieter > > -- Dieter Kl?nter | Systemberatung http://sys4.de GPG Key ID: E9ED159B > 53?37'09,95"N 10?08'02,42"E In debug slapd -d -1 output I saw that ldap is trying to load from /etc/ldap/slap.d/ directory although i had put "SLAPD_CONF=/etc/ldap/slapd.conf" to /etc/default/slapd. After I clean up /etc/ldap/slap.d/ directory ldap starting load db and schema, but still can't start with error: " TLS: could not set cipher list HIGH:+TLSv1:+SSLv2:+SSLv3. 56728db6 main: TLS init def ctx failed: -1 56728db6 slapd destroy: freeing system resources. 56728db6 syncinfo_free: rid=115 56728db6 slapd stopped. 56728db6 connections_destroy: nothing to destroy. " When I try "openssl ciphers -v HIGH:+TLSv1:+SSLv2:+SSLv3" it's work fine without any error On 12/16/2015 03:00 PM, openldap-technical-request(a)openldap.org wrote: -- With Best Wishes Andrei Valoshyn Exadel Inc. System Administrator avaloshyn(a)exadel.com -- CONFIDENTIALITY NOTICE: This email and files attached to it are confidential. If you are not the intended recipient you are hereby notified that using, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error please notify the sender and delete this email.

3 4

(LMDB) Correct use of mdb_env_sync
by Pierre Chapuis 16 Dec '15

16 Dec '15

I am having a hard time understanding how exactly mdb_env_sync should be used. Suppose I have an environment with MDB_NOSYNC and I do not use MDB_WRITEMAP. I still want to sync at some points, which is why mdb_env_sync exists. But I wonder: - How does it interact with transactions? Is it safe (or necessary) to call it outside of a transaction? During a read-only transaction? During a write transaction? - What about thread safety? Can it be called concurrently with writes? Can it be called concurrently with another mdb_env_sync in another thread? -- Pierre Chapuis

3 2

Ubuntu Server 14.04.3 LTS and openldap-2.4.41 with static slapd.conf configuration
by Andrei Valoshyn 16 Dec '15

16 Dec '15

Hello guys! I tried to deploy openldap replica on Ubuntu 14.04. I copy database via slapcat(slapadd) and slapd.conf from another replica(Centos 6.7 with OpenLDAP: slapd 2.4.40). After all slaptest errors were fixed slapd service run once, but after 5 minutes without any changes it's failed to start again and currently it's still doesn't work. I can't find any ldap log. May be somebody faced with such kind of the problem. Will be very appreciate for any advices -- With Best Wishes Andrei Valoshyn Exadel Inc. System Administrator avaloshyn(a)exadel.com -- CONFIDENTIALITY NOTICE: This email and files attached to it are confidential. If you are not the intended recipient you are hereby notified that using, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error please notify the sender and delete this email.

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical