- openldap-technical - openldap.org

Import/include schema file
by David Gabriel 15 Dec '15

15 Dec '15

Hi, I am new to use OpenLdap and I want to import/include new .schema file into my OpenLdap database but I don't how. Could you please point some useful links dealing with this issue or tell me how shall I proceede ? Thanks in advance. Regards

4 6

ldapmodify failing with large attribute
by Geoff Swan 15 Dec '15

15 Dec '15

I have a problem appearing where a large (16.6MB approx) value is to be saved to an attribute (certificateRevocationList). Prior to the value being this large, ldapmodify had no problems updating it. However it appears to have crossed some magic threshold where it will no longer be accepted, and aborts with: ldap_modify: Can't contact LDAP server (-1) The ldapmodify operation is being performed on the ldap host machine using the ldap root user with simple password authentication. Openldap version is 2.4.30 using back-bdb with Linux OS (2.6.32 64 bit). There is no replication configured. It's a fairly simple setup. I've seen a couple of similar threads alluding to the same problme, however without any solution. http://www.openldap.org/lists/openldap-software/200905/msg00062.html http://www.openldap.org/lists/openldap-technical/201501/msg00006.html I'm curious to know where the limit is that is causing the sudden inability for ldapmodify to complete. Nothing was immediately apparent after a quick look through some of the source. Also, if the issue is a known one, was it addressed in a newer release? I can run the same test on a machine with openldap-2.4.40 to see if it persists if that is of any help. Thanks, Geoff

2 2

Error updating olcDbConfig
by Angel L. Mateo 14 Dec '15

14 Dec '15

Hello, I have a few ubuntu 14.04 servers running slapd 2.4.31 installed from ubuntu packages. Now I want to upgrade these servers to last openldap version, so I I have downloaded 2.4.43 and compiled from myself. Since then, whenever I tri to make a change in the config, slapd crashes with: Dec 11 08:34:56 canis30 slapd[9640]: conn=1000 op=0 RESULT tag=97 err=0 text= Dec 11 08:34:56 canis30 slapd[9640]: conn=1000 op=1 MOD dn="olcDatabase={3}hdb,cn=config" Dec 11 08:34:56 canis30 slapd[9640]: conn=1000 op=1 MOD attr=olcDbcheckpoint olcDbindex olcDbNosync olcDbcachesize olcDbidlcachesize olcDbConfig olcDbNosync olcDbshmkey olcDbcachesize olcDbcheckpoint olcDbidlcachesize olcDbConfig olcDbindex Dec 11 08:34:56 canis30 slapd[9640]: bdb(dc=Telematica): BDB4511 Error: closing the transaction region with active transactions Dec 11 08:34:56 canis30 slapd[9640]: bdb_db_close: database "dc=Telematica": close failed: Invalid argument (22) Dec 11 08:34:56 canis30 slapd[9640]: hdb_cf_cleanup: failed to reopen database, rc=22 Dec 11 08:34:56 canis30 slapd[9640]: daemon: abnormal condition, shutdown initiated. Dec 11 08:34:56 canis30 slapd[9640]: slapd shutdown: waiting for 1 operations/tasks to finish Dec 11 08:34:56 canis30 slapd[9640]: conn=1000 op=1 RESULT tag=103 err=80 text=failed to reopen database, rc=22 Dec 11 08:34:56 canis30 slapd[9640]: conn=1000 fd=13 closed (slapd shutdown) Dec 11 08:34:56 canis30 kernel: [ 876.777046] slapd[9640]: segfault at e0 ip 00007f7efcd86ac2 sp 00007ffd843c2fe0 error 4 in libdb-5.3.so[7f7efcc39000+19b000] I have tried with my own openldap compilation and with the package installed from rtandy ppa, with the same results. Although the upgrade procedure recreate the databases, I have also tried to completely remove the database (dc=telematica), but it fails too. I have tried with different ldifs, and the problem seems to happen whenever a try to make a modification for the olcDbConfig attributes. -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868887590 Fax: 868888337

2 2

relax control
by Marc Patermann 11 Dec '15

11 Dec '15

Hi, according to this list a change of a structural object class should work with: # ldapmodify -E relax OID of relax control is 1.3.6.1.4.1.4203.666.5.12, right? My servers do not advertise this control, do they? # extended LDIF # # LDAPv3 # base <> with scope baseObject # filter: (objectClass=*) # requesting: + # # dn: structuralObjectClass: OpenLDAProotDSE configContext: cn=config namingContexts: ou=foo namingContexts: cn=log monitorContext: cn=Monitor supportedControl: 1.3.6.1.4.1.4203.1.9.1.1 supportedControl: 2.16.840.1.113730.3.4.18 supportedControl: 2.16.840.1.113730.3.4.2 supportedControl: 1.3.6.1.4.1.4203.1.10.1 supportedControl: 1.2.840.113556.1.4.319 supportedControl: 1.2.826.0.1.3344810.2.3 supportedControl: 1.3.6.1.1.13.2 supportedControl: 1.3.6.1.1.13.1 supportedControl: 1.3.6.1.1.12 supportedExtension: 1.3.6.1.4.1.1466.20037 supportedExtension: 1.3.6.1.4.1.4203.1.11.1 supportedExtension: 1.3.6.1.4.1.4203.1.11.3 supportedExtension: 1.3.6.1.1.8 supportedFeatures: 1.3.6.1.1.14 supportedFeatures: 1.3.6.1.4.1.4203.1.5.1 supportedFeatures: 1.3.6.1.4.1.4203.1.5.2 supportedFeatures: 1.3.6.1.4.1.4203.1.5.3 supportedFeatures: 1.3.6.1.4.1.4203.1.5.4 supportedFeatures: 1.3.6.1.4.1.4203.1.5.5 supportedLDAPVersion: 3 supportedSASLMechanisms: DIGEST-MD5 supportedSASLMechanisms: GSSAPI entryDN: subschemaSubentry: cn=Subschema Do I have to activate the relax control on any way to get this working? Marc

2 2

(LMDB) read-only transactions and DBI handles
by Viacheslav Usov 11 Dec '15

11 Dec '15

I have a question about mdb_dbi_open and the handles it returns. The official documentation suggests to me that mdb_dbi_open is supposed to be called early on and then the obtained handle should just be reused by other transactions without any further calls to mdb_dbi_open and mdb_dbi_close. The code in sample-mdb.txt does that (ignoring the final close-all sequence). The sample also uses mdb_txn_abort to end a read-only transaction, which I take as the recommended way to end read-only transactions. The docs state that if a transaction aborts, then the associated DBI handles are closed, and so mdb_dbi_open must be used again to obtain a valid handle, which, as far as I can tell, requires a process-wide serialization of transactions with calls to mdb_dbi_open. Which feels contrary to the style described above, and, more importantly, just wrong with read-only transactions, because the need to serialize them would negate the benefits of LMDB's lock-free paradigm. Which probably means I misunderstand something. Can read-only transactions keep DBI handles reusable? How? Thanks, V.

3 10

LMDB transcations - how
by Christian Sell 11 Dec '15

11 Dec '15

Hello, I am looking for advice about how to best handle LMDB transactions and to avoid pitfalls. Our application is multi-threaded, with several threads accessing persistent data in a streaming fashion (reading lots of data sequentially). I am also not sure that it will be practical to stick with one transaction per thread, so MDB_NOTLS may be needed. In this scenario, there are few "natural" transaction boundaries, which is why I am asking when or how often a commit/abort (or reset/renew) should be issued. Also, is there any issue with multiple individual read transactions being opened from different places in the application? thanks, Christian

2 1

Ubuntu PPA of OpenLDAP?
by Khitai Pang 10 Dec '15

10 Dec '15

Hi, Is there any well maintained Ubuntu (14.04) PPA for OpenLDAP? I didn't find any. I want the latest stable OpenLDAP server. Thanks Khitai

3 2

Checksum query
by Penza Kenneth at MITA 10 Dec '15

10 Dec '15

Hi, I am configuring an openldap 2.4.40 on RHEL7 x86_64 and want to enable database checksum. Below please find the steps I am following: [root@host01 mail]# cat config.ldif dn: cn=config objectClass: olcGlobal cn: config olcConfigFile: /etc/openldap/slapd.conf.bak olcConfigDir: /etc/openldap/slapd.d olcAllows: bind_v2 olcArgsFile: /var/run/openldap/slapd.args olcAttributeOptions: x-hidden lang- olcAuthzPolicy: none olcConcurrency: 0 olcConnMaxPending: 100 olcConnMaxPendingAuth: 1000 olcGentleHUP: FALSE olcIdleTimeout: 0 olcIndexSubstrIfMaxLen: 4 olcIndexSubstrIfMinLen: 2 olcIndexSubstrAnyLen: 4 olcIndexSubstrAnyStep: 2 olcIndexIntLen: 4 olcLocalSSF: 71 olcPidFile: /var/run/openldap/slapd.pid olcReadOnly: FALSE olcReverseLookup: FALSE olcSaslSecProps: noplain,noanonymous olcSockbufMaxIncoming: 262143 olcSockbufMaxIncomingAuth: 16777215 olcThreads: 16 olcTLSCACertificatePath: /etc/openldap/certs olcTLSCertificateFile: "OpenLDAP Server" olcTLSCertificateKeyFile: /etc/openldap/certs/password olcTLSVerifyClient: never olcToolThreads: 1 olcWriteTimeout: 0 structuralObjectClass: olcGlobal dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema include: file:///etc/openldap/schema/core.ldif include: file:///etc/openldap/schema/cosine.ldif include: file:///etc/openldap/schema/inetorgperson.ldif include: file:///etc/openldap/schema/nis.ldif dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAddContentAcl: TRUE olcAccess: to attrs=name;x-hidden by * =cs olcAccess: to attrs=userPassword by * auth olcAccess: to * by * read olcLastMod: TRUE olcMaxDerefDepth: 0 olcReadOnly: FALSE olcSchemaDN: cn=Subschema olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * none olcAddContentAcl: TRUE olcRootPW: {SSHA}C6JfIRI6XajtZcjabtSJZyi1rArPsy1j olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=config olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig dn: olcDatabase={1}monitor,cn=config objectClass: olcDatabaseConfig olcDatabase: {1}monitor olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=manager,dc=example,dc=com" read by * none olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig dn: olcDatabase={2}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcAccess: {0} to attrs=userPassword,shadowLastChange by self write by anonymous auth by dn="cn=manager,dc=example,dc=com" write by * none olcAccess: {1} to dn.base="" by * read olcAccess: {2} to * by self write by dn="cn=manager,dc=example,dc=com" write by * read olcAddContentAcl: FALSE olcDatabase: {2}hdb olcDbCacheFree: 1 olcDbCacheSize: 1000 olcDbCheckpoint: 512 15 olcDbChecksum: true olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 3000 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbDirectory: /var/lib/ldap olcDbDirtyRead: FALSE olcDbDNcacheSize: 0 olcDbIDLcacheSize: 3000 olcDbIndex: cn,sn,mail pres,eq,approx,sub olcDbIndex: objectClass eq olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbNoSync: FALSE olcDbSearchStack: 16 olcDbShmKey: 0 olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=manager,dc=example,dc=com olcRootPW: {SSHA}C6JfIRI6XajtZcjabtSJZyi1rArPsy1j olcSuffix: dc=example,dc=com structuralObjectClass: olcHdbConfig [root@host01 mail]# [root@host01 mail]# slapadd -v -F slapd.d -n 0 -l config.ldif added: "cn=config" (00000001) added: "cn=schema,cn=config" (00000001) added: "cn={0}core,cn=schema,cn=config" (00000001) added: "cn={1}cosine,cn=schema,cn=config" (00000001) added: "cn={2}inetorgperson,cn=schema,cn=config" (00000001) added: "cn={3}nis,cn=schema,cn=config" (00000001) added: "olcDatabase={-1}frontend,cn=config" (00000001) added: "olcDatabase={0}config,cn=config" (00000001) added: "olcDatabase={1}monitor,cn=config" (00000001) 56617865 Entry (olcDatabase={2}hdb,cn=config), attribute 'olcDbChecksum' not allowed slapadd: dn="olcDatabase={2}hdb,cn=config" (line=1079): (65) attribute 'olcDbChecksum' not allowed _#################### 100.00% eta none elapsed none fast! Closing DB... [root@host01 mail]# >From the github sources back-bdb/config.c 78 { "checksum", NULL, 1, 2, 0, ARG_ON_OFF|ARG_MAGIC|BDB_CHECKSUM, 79 bdb_cf_gen, "( OLcfgDbAt:1.16 NAME 'olcDbChecksum' " 80 "DESC 'Enable database checksum validation' " I tried olcDbChecksum: true, olcDbChecksum: TRUE, olcDbChecksum: 1, olcDbChecksum: ON without any success. Do you have any ideas on how I get around this ? Regards Kenneth

2 2

providers in mirror mode replication issue
by Jean-Luc Bourguignon 09 Dec '15

09 Dec '15

Hi all, I've 2 ldap instance in mirror mode which each one has its consumer. Since a few days, even if contextCSN attributs gave me the info that all instance are in sync (as shown below), this is not the case !! I did ldapsearch against the 2 provider for one branch and I found difference in number of entries. I also did it against consumer and I saw a difference between consumer/provider for sys1 but not for consumer/provider for sys2 which were in sync. !! very strange ... sys1 - 389 (consumer) contextCSN: 20151208154738.903128Z#000000#001#000000 contextCSN: 20151208154739.102248Z#000000#002#000000 sys1 - 3892 (provider) contextCSN: 20151208154738.903128Z#000000#001#000000 contextCSN: 20151208154739.102248Z#000000#002#000000 sys2 - 389 (consumer) contextCSN: 20151208154738.903128Z#000000#001#000000 contextCSN: 20151208154739.102248Z#000000#002#000000 sys2 - 3892 (provider) contextCSN: 20151208154738.903128Z#000000#001#000000 contextCSN: 20151208154739.102248Z#000000#002#000000 I also did a stop/start of providers to force the replication process from difference because of the stop, but even they have done some replication between them, the difference in that concerned branch doesn't disappeared. Can you help me to find out the root cause of this unsync mirrored systems ? How can I check it deeper ? Where do have I to check why I get this difference ? Can It be related to system performance ? (memory ..) Thx in advance for your help. Brgds, J-L. PS. We use openldap version 2.4.35 under solaris 5.10 (zone systems) ============================================================================================================================ Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review the policy at http://www.techmahindra.com/Disclaimer.html externally http://tim.techmahindra.com/tim/disclaimer.html internally within TechMahindra. ============================================================================================================================

1 0

disable TLS compression with openssl?
by Paul B. Henson 09 Dec '15

09 Dec '15

We're currently running through all of our SSL/TLS using apps to disable SSLv3 and update the accepted ciphers list, as well as other current best practices. I don't see any way to disable SSL compression in openldap? Does SSL compression with ldap traffic not lead to the same issue as it does in web traffic? Also, are there any plans to support ECDHE ciphers in openldap? I see there's an ITS ticket about it, it's rather old and the last update questioned whether those ciphers should be avoided due to potential NSA meddling in their design. Thanks...

4 5

Binding through a chaining. It's possible?
by Maximiliano Boscovich 09 Dec '15

09 Dec '15

Hello, I'm having trouble making binding through a chaining. I have 2 servers, server 1 has a referral ou pointing to a another server (server2). Server1 has the following configuration: dn: olcOverlay=chain,olcDatabase={-1}frontend,cn=config objectClass: olcOverlayConfig objectClass: olcChainConfig objectClass: top olcOverlay: chain olcChainCacheURI: FALSE olcChainMaxReferralDepth: 1 olcChainReturnError: TRUE dn: olcDatabase=ldap,olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config objectClass: olcLDAPConfig objectClass: olcChainDatabase olcDatabase: ldap olcDbURI: "ldap://server2" olcDbStartTLS: none starttls=no olcDbIDAssertBind: mode=self flags=prescriptive,proxy-authz-non-critical bindmethod=simple timeout=0 network-timeout=0 binddn="cn=admin,dc=example,dc=ar" credentials="password" keepalive=0:0:0 olcDbRebindAsUser: FALSE olcDbChaseReferrals: TRUE olcDbTFSupport: no olcDbProxyWhoAmI: FALSE olcDbProtocolVersion: 3 olcDbSingleConn: FALSE olcDbCancel: abandon olcDbUseTemporaryConn: FALSE olcDbConnectionPoolMax: 16 olcDbNoRefs: FALSE olcDbNoUndefFilter: FALSE >From the server1 I can make changes and searches without problems to entries on server2 (the chaining works fine for this), but when I want to make a binding, it gives me invalid credentials. For instance: mboscovich@mambo-tango:~$ ldapwhoami -vvv -h server1 -x -D "uid=useronserver02,ou=users,dc=example,dc=ar" -W ldap_initialize( ldap://server1:389 ) Enter LDAP Password: ldap_bind: Invalid credentials (49) If I make the same query but to the server2 where is hosted the entry (so not the chaining is used) the binding runs smoothly: mboscovich@mambo-tango:~$ ldapwhoami -vvv -h server2 -x -D "uid=useronserver02,ou=users,dc=example,dc=ar" -W ldap_initialize( ldap://server2:389 ) Enter LDAP Password: dn:uid=useronserver02,ou=users,dc=example,dc=ar" Result: Success (0) The logs on server1 when it's fail, show this: Dec 8 19:19:55 server1 slapd[2219]: conn=1014 fd=20 ACCEPT from IP= 10.0.2.2:52358 (IP=0.0.0.0:389) Dec 8 19:19:55 server1 slapd[2219]: conn=1014 op=0 BIND dn="uid=useronserver2,dc=example,dc=ar" method=128 Dec 8 19:19:55 server1 slapd[2219]: conn=1014 op=0 RESULT tag=97 err=49 text= Dec 8 19:19:55 server1 slapd[2219]: conn=1014 op=1 UNBIND Dec 8 19:19:55 server1 slapd[2219]: conn=1014 fd=20 closed and on the server02 i couldn't see any log in this case. What am I doing wrong?. Regards Maximiliano Boscovich

1 0

Samba auth on replicated LDAP: no admin user
by Paul van der Vlis 08 Dec '15

08 Dec '15

Hello, I have a replicated LDAP and a few Windows PC's what want to authenticate using Samba. Normally I use "smbpasswd -w" to give the ldap admin dn, but because it's replicated there is no ldap admin! Is there a way to authenticate using a replicated LDAP? The users are created on the master. I am using the "refreshAndPersist" type of replication. With regards, Paul van der Vlis. -- Paul van der Vlis Linux systeembeheer Groningen https://www.vandervlis.nl/

5 13

Fwd: (ITS#8331) Download mirror list needs updating
by Howard Chu 07 Dec '15

07 Dec '15

A number of the mirror sites have gone offline over the years. Anyone interested in running a new mirror for us? -------- Forwarded Message -------- Subject: (ITS#8331) Download mirror list needs updating Date: Fri, 04 Dec 2015 10:01:12 +0000 From: andrew.findlay(a)skills-1st.co.uk To: openldap-its(a)OpenLDAP.org Full_Name: Andrew Findlay Version: OS: URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (2001:8b0:8d0:f7e1::94) The Netherlands mirror has vanished: ftp.nl.uu.net does not resolve in DNS.

2 1

Growing an LMDB database after MDB_MAP_FULL
by Bruno Freudensprung 07 Dec '15

07 Dec '15

Hi, I have a question regarding growing an LMDB database when a write transaction hits MDB_MAP_FULL. I would like to avoid defining a high mapsize value because my application will contain many MDB_envs, and because I have Windows users (Windows allocates the whole file on the disk). Based on the intuition that MDB_MAP_FULL should not leave the database in a weird state, I have made the following little experiment. When MDB_MAP_FULL is encountered I tried to: * copy the current env (mdb_env_copy) into another directory (fine: it does not seem to contain uncommited data) * reset the transaction < error bit > (modified LMDB code to introduce a < txn->mt_flags &= ~MDB_TXN_ERROR > somewhere) * commit the transaction * close the database * close the env * reopen it with a higher mapsize value * reopen the database * create another transaction * continue writing ... and it seems to be working pretty well. Assuming I am ready to < relax > some of the ACID requirements, does it sound reasonable to think that MDB_MAP_FULL does not leave LMDB is a weird state? And that the < trick > described above should always be working? By < working > I mean: the copied environment will never contain uncommitted data (so I can rely on it to implement a kind of rollback), the reopened environment will always be valid and contain the expected data (data written before hitting MDB_MAP_FULL)? Thanks in advance for any insight, Best regards, Bruno.

2 4

TOTP configuration
by PRAJITH 05 Dec '15

05 Dec '15

Hi, Could you please add more info about the TOTP modul? I could not find any single article about this.

2 1

options to maintain computed attributes?
by Jephte Clain 04 Dec '15

04 Dec '15

hello, I may have a need soon to implement "computed" attributes in LDAP, to accommodate dumb clients that are unable to properly update the database for example, an attribute masterAttr may have values like "A:B" (its value updated by the dumb client), but other clients need the A or B part separately. So whenever masterAttr is updated with value "A:B", firstPartAttr have to be updated with "A" and secondPartAttr with "B" what are my options to achieve this? - is there an overlay like slapo-rwm but for attribute values? I searched but did not found anything. So I guess the answer is no. - using a combination of back-perl, back-relay and slapo-translucent? is that even possible - using back-sock as an overlay to monitor modifications and update the modified objects accordingly? - a script that monitor the accesslog database and update the modified objects accordingly? - biting the bullet and writing an overlay myself? before diving too deep into this issue (and possibly drowning), I figured I would ask. any thoughts? ideas? thanks in advance, best regards, Jephté CLAIN -- *Jephté CLAIN | Développeur, Intégrateur d'applications* Service Systèmes d'Information Direction des Systèmes d'Information <http://dsi.univ-reunion.fr> Tél: +262 262 93 86 31 <tel:+262262938631> || Gsm: +262 692 29 58 24 <tel:+262692295824> www.univ-reunion.fr <http://www.univ-reunion.fr> || Facebook <http://www.facebook.com/pages/Universit%C3%A9-de-La-R%C3%A9union-OFFICIEL/1…> || Twitter <http://twitter.com/univ_reunion>

2 4

RE24 testing call (2.4.43)
by Quanah Gibson-Mount 04 Dec '15

04 Dec '15

If you know how to build OpenLDAP manually, and would like to participate in testing the next set of code for the 2.4.43 release, please do so. Generally, get the code for RE24: <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> Configure & build. Execute the test suite (via make test) after it is built. Thanks! --Quanah -- Quanah Gibson-Mount Platform Architect Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

5 7

Strange LDAP searches for time, IP address and system users
by MI 03 Dec '15

03 Dec '15

I see very strange searches in my slapd.log, and wonder what I my have misconfigured. On every SSH connection (with ssh key, not password) : Search for the TTY: slapd[3183]: conn=1000 op=307 SRCH base="dc=mydomain,dc=lan" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=pts/2))" slapd[3183]: conn=1000 op=307 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass For the date: slapd[3183]: conn=1000 op=308 SRCH base="dc=mydomain,dc=lan" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=2015-12-03))" The time: slapd[3183]: conn=1000 op=309 SRCH base="dc=mydomain,dc=lan" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=16:28))" The IP: slapd[3183]: conn=1000 op=310 SRCH base="dc=mydomain,dc=lan" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=\28192.168.99.206\29))" (But I don't see "uid=root" when logging in over SSH with a key.) I wouldn't expect to see a search for "root", since it's a system account, and I use a key, so I would expect LDAP to be completely out of the picture. However, I do see many searches in the logs for other system accounts: filter="(&(objectClass=posixAccount)(uid=www-data))" filter="(&(objectClass=posixAccount)(uid=man))" filter="(&(objectClass=posixAccount)(uid=root))" filter="(&(objectClass=posixAccount)(uid=postfix))" filter="(&(objectClass=posixAccount)(uid=debian-spamd))" filter="(&(objectClass=posixAccount)(uid=amavis))" filter="(&(objectClass=posixAccount)(uid=\2A))" ... Most seem to be triggered by the standard system cron jobs or service restarts etc. The system is Debian 8.2 "Jessie". The following packages related to ldap or pam are installed: ldap-utils 2.4.40+dfsg-1+deb8u1 libaprutil1-ldap:amd64 1.5.4-1 libldap-2.4-2:amd64 2.4.40+dfsg-1+deb8u1 libnss-ldap:amd64 265-3+b1 libpam0g:amd64 1.1.8-3.1 libpam-ldap:amd64 184-8.7+b1 libpam-modules:amd64 1.1.8-3.1 libpam-modules-bin 1.1.8-3.1 libpam-runtime 1.1.8-3.1 nscd 2.19-18+deb8u1 slapd 2.4.40+dfsg-1+deb8u1 At this point, it's difficult for me to know what may be relevant, so I'm afraid I have to paste a lot of stuff here in the hope that it includes some clue for someone... # egrep 'cache|check' /etc/nscd.conf enable-cache passwd yes check-files passwd yes enable-cache group yes check-files group yes enable-cache hosts yes check-files hosts yes enable-cache services yes check-files services yes enable-cache netgroup yes check-files netgroup yes # grep ldap /etc/nsswitch.conf passwd: compat ldap group: compat ldap shadow: compat ldap # listconf /etc/pam_ldap.conf host 127.0.0.1 base dc=mydomain,dc=lan ldap_version 3 rootbinddn cn=admin,dc=mydomain,dc=lan pam_password crypt # listconf /etc/pam.d/common-auth auth [success=2 default=ignore] pam_unix.so nullok_secure auth [success=1 default=ignore] pam_ldap.so use_first_pass auth requisite pam_deny.so auth required pam_permit.so # listconf /etc/pam.d/common-account account [success=2 new_authtok_reqd=done default=ignore] pam_unix.so account [success=1 default=ignore] pam_ldap.so account requisite pam_deny.so account required pam_permit.so # listconf /etc/pam.d/common-password password [success=2 default=ignore] pam_unix.so obscure sha512 password [success=1 user_unknown=ignore default=die] pam_ldap.so use_authtok try_first_pass password requisite pam_deny.so password required pam_permit.so # listconf /etc/pam.d/common-session session [default=1] pam_permit.so session requisite pam_deny.so session required pam_permit.so session required pam_unix.so session optional pam_ldap.so My LDAP olcLogLevel is "filter stats sync". Please let me know if the other lines of that log may be useful, or if other log levels should be enabled (I tried, but didn't notice anything interesting). Well, if you have read so far, now is the time to tell me that this is all useless and that I should have posted that other essential config file which I missed ... :-) Thanks for any help in solving this mystery, MI

1 0

RE: RE24 testing call #3 (2.4.43) LMDB RE0.9 testing call #3 (0.9.17)
by Sergio NNX 02 Dec '15

02 Dec '15

> What git revision of LMDB did you test? The last tag from git repository, 0.9.16 Thanks. > Subject: Re: RE24 testing call #3 (2.4.43) LMDB RE0.9 testing call #3 (0.9.17) > To: sfhacker(a)hotmail.com > From: hyc(a)symas.com > Date: Wed, 25 Nov 2015 13:02:44 +0000 > > Sergio NNX wrote: > > Ciao, > > > > We are testing the latest version of Cyrus SASL against LMDB (on Windows, > > built from source) and when we run the testsuite app, we get a runtime > > exception shown below: > > Please use the -technical mailing list for LMDB discussions. > > > > > ... > > ... > > Testing sasl_listmech()... ok > > Testing serverstart... All memory accounted for! > > ok > > Testing client-first/no-server-last correctly... > > SRP --> start > > > > Program received signal SIGSEGV, Segmentation fault. > > 0x00000000 in ?? () > > (gdb) bt > > #0 0x00000000 in ?? () > > #1 0x00432a4d in mdb_node_search (mc=mc@entry=0x289608, > > key=key@entry=0x289850, exactp=exactp@entry=0x289604) at mdb.c:4943 > > #2 0x004361bc in mdb_cursor_set (mc=mc@entry=0x289608, > > key=key@entry=0x289850, data=data@entry=0x289858, op=op@entry=MDB_SET, > > exactp=exactp@entry=0x289604) at mdb.c:5725 > > #3 0x0043667c in mdb_get (txn=0x35c7b0, dbi=1, key=0x289850, data=0x289858) > > at mdb.c:5391 > > #4 0x00431a55 in _sasldb_getdata () > > #5 0x0042fda3 in sasldb_auxprop_lookup () > > #6 0x004119f7 in _sasl_auxprop_lookup () > > #7 0x00413a6c in _sasl_canon_user_lookup () > > #8 0x0042ea7e in srp_server_mech_step () > > #9 0x0040cddd in sasl_server_step () > > #10 0x0040d361 in sasl_server_start () > > #11 0x0040458f in doauth () > > #12 0x004060d6 in test_clientfirst () > > #13 0x00406405 in foreach_mechanism () > > #14 0x00733d1f in main () > > (gdb) > > > > > > Building SASL against Berkeley DB does not show the same issue. > > > > Any pointers will be greatly appreciated. > > > > Thanks. > > > > Sergio.

2 2

memberOf-overlay and custom schema (slapd.logs attched)
by Dora Paula 02 Dec '15

02 Dec '15

Hi, I want to have some kind of dn-based association between two custom entries (e.g. account<--dn-->device). Therefore I use a combination of the memberOf- and refint overlay (configuration inspired by test057). I use a custom schema: An auxiliary objectClass called "association". It has only one may-attribute called "associate". The custom 'memberOf'-Attribute is called "associationOf", which is a may-attribute of the objectClass "myAccount" (derived from account): OpenLDAP Version: git OPENLDAP_REL_ENG_2_4 #example.com.schema # attributeType ( 1.3.6.1.4.1.9999999.10.1.1 NAME 'associate' DESC 'an associate' SUP distinguishedName ) attributeType ( 1.3.6.1.4.1.9999999.10.1.2 NAME 'associateOf' DESC 'associate of' SUP distinguishedName ) objectClass ( 1.3.6.1.4.1.9999999.10.2.1 NAME 'association' DESC 'association' SUP top AUXILIARY MAY ( associate ) ) objectClass ( 1.3.6.1.4.1.9999999.10.2.2 NAME 'myAccount' DESC 'my account' SUP account STRUCTURAL MAY ( associateOf ) ) #slapd.conf # include /opt/slapd_example.com/etc/openldap/schema/core.schema include /opt/slapd_example.com/etc/openldap/schema/cosine.schema include /opt/slapd_example.com/etc/openldap/schema/ppolicy.schema include /opt/slapd_example.com/etc/example.com.schema pidfile /opt/slapd_example.com/var/run/slapd.pid argsfile /opt/slapd_example.com/var/run/slapd.args loglevel none password-hash {CLEARTEXT} attributeOptions lang- access to dn.base="" by * read access to dn.base="cn=Subschema" by * read database config rootdn "cn=admin,dc=example,dc=com" database mdb suffix "dc=example,dc=com" rootdn "cn=admin,dc=example,dc=com" rootpw "admin" directory /opt/slapd_example.com/var/openldap-data index objectClass,cn,ou,o,dc eq add_content_acl on overlay memberof memberof-group-oc association memberof-member-ad associate memberof-memberof-ad associateOf memberof-dangling ignore memberof-refint FALSE memberof-dn olcOverlay={1}memberof,olcDatabase={2}mdb,cn=config overlay refint refint_attributes associate associateOf refint_nothing olcOverlay={0}refint,olcDatabase={2}mdb,cn=config refint_modifiersname olcOverlay={0}refint,olcDatabase={2}mdb,cn=config #After starting the server, first I add a custom account: # cat << EOF | ldapmodify -x -H "ldap://localhost:2389/" -D "cn=admin,dc=example,dc=com" -w admin dn: uid=myAccount,dc=example,dc=com changetype: add objectClass: top objectClass: myAccount uid: myAccount EOF #Then I add a naked device: # cat << EOF | ldapmodify -x -H "ldap://localhost:2389/" -D "cn=admin,dc=example,dc=com" -w admin dn: cn=device,dc=example,dc=com changetype: add objectClass: top objectClass: device cn: device EOF Now I try to associate them using a single modify operation (adding the aux-objectClass association and the associate attribute). This approach fails, that means: The operation passes without error, but the account's associationOf attribute isn't added. #This modify operation seems to be ignored by memberOf-overlay: # cat << EOF | ldapmodify -x -H "ldap://localhost:2389/" -D "cn=admin,dc=example,dc=com" -w admin dn: cn=device,dc=example,dc=com changetype: modify add: objectClass objectClass: association - add: associate associate: uid=myAccount,dc=example,dc=com - EOF #slapd-log (loglevel -1), see attached all-inclusive-modify.log #Checking the results: # ldapsearch -x -H "ldap://localhost:2389/" -D "cn=admin,dc=example,dc=com" -w admin -b "dc=example,dc=com" -s one '(objectClass=*)' # extended LDIF # # LDAPv3 # base <dc=example,dc=com> with scope oneLevel # filter: (objectClass=*) # requesting: ALL # # device, example.com dn: cn=device,dc=example,dc=com objectClass: top objectClass: device objectClass: association cn: device associate: uid=myAccount,dc=example,dc=com # myAccount, example.com dn: uid=myAccount,dc=example,dc=com objectClass: top objectClass: myAccount uid: myAccount # search result search: 2 result: 0 Success # numResponses: 3 # numEntries: 2 The second approach (resetting the device and myAccount entry and split the above modify operation into two operations works fine. Details see here: #Splitting the previous modify operation into two works fine: # cat << EOF | ldapmodify -x -H "ldap://localhost:2389/" -D "cn=admin,dc=example,dc=com" -w admin dn: cn=device,dc=example,dc=com changetype: modify add: objectClass objectClass: association EOF cat << EOF | ldapmodify -x -H "ldap://localhost:2389/" -D "cn=admin,dc=example,dc=com" -w admin dn: cn=device,dc=example,dc=com changetype: modify add: associate associate: uid=myAccount,dc=example,dc=com EOF #slapd-log (loglevel -1), see attached split-modify.log #Checking the results: # ldapsearch -x -H "ldap://localhost:2389/" -D "cn=admin,dc=example,dc=com" -w admin -b "dc=example,dc=com" -s one '(objectClass=*)' # extended LDIF # # LDAPv3 # base <dc=example,dc=com> with scope oneLevel # filter: (objectClass=*) # requesting: ALL # # device, example.com dn: cn=device,dc=example,dc=com objectClass: top objectClass: device objectClass: association cn: device associate: uid=myAccount,dc=example,dc=com # myAccount, example.com dn: uid=myAccount,dc=example,dc=com objectClass: top objectClass: myAccount uid: myAccount associateOf: cn=device,dc=example,dc=com # search result search: 2 result: 0 Success # numResponses: 3 # numEntries: 2 Long story, short question: Is this the intended behaviour? If not is it caused by a misconfiguration or a bug? Thank you very much for your help! Best regards Dora

2 1

OpenLDAP 2.4.43 packages for RedHat/CentOS
by Clément OUDOT 02 Dec '15

02 Dec '15

Hi all, you can find RPM packages for OpenLDAP 2.4.43 on LTB project : http://ltb-project.org/wiki/download?&#packages_for_red_hatcentos Debian packages should be available soon. -- Clément OUDOT Consultant en logiciels libres, Expert infrastructure et sécurité Savoir-faire Linux

1 0

updated my openSUSE packages (was: OpenLDAP 2.4.43 available)
by Michael Ströder 01 Dec '15

01 Dec '15

OpenLDAP Project wrote: > OpenLDAP 2.4.43 is now available for download as detailed on our download page: > > http://www.openldap.org/software/download/ Thanks to OpenLDAP team for the new release. I've updated my private openSUSE packages to this release. The OBS source: https://build.opensuse.org/package/show/home:stroeder:branches:network:ldap… Repos for various SUSE versions: http://download.opensuse.org/repositories/home:/stroeder:/branches:/network… Please test. Ciao, Michael.

2 2

OpenLdap Clear-text Password in Debug Mode
by Rich Alford 01 Dec '15

01 Dec '15

Hi All: I'm not sure if this issue results from my ignorance of OpenLdap, or it's not capable of resolving. Regardless, any direction you can provide would be greatly appreciated: I have a basic OpenLdap installation with TLS encryption. Passwords are hashed in the ldap directory. The user password travels from client to server encrypted as it should, then gets unencrypted by slapd, and IF IN DEBUG MODE gets displayed in *clear-text*. Theoretically, the password should be hashed on the client, sent across the network, to be compared against the hashed passwords in the database. What am I missing?? Thank you, Rich

3 3

playing with ldap protocol
by Friedrich Locke 28 Nov '15

28 Nov '15

i am trying to understand ldap protocol! i have read the RFC 4511 (i believe) about it. In order to understand it better, i wrote a program that reads from internet and writes to an output file. I have issued the following ldapsearch command: ldapsearch -x -h localhost -p 2000 -D ou=ufv,dc=br -w 123456 What i got on the output file was: sioux@scallop$ hexdump -C o 00000000 30 1e 02 01 01 60 19 02 01 03 04 0c 6f 75 3d 75 |0....`......ou=u| 00000010 66 76 2c 64 63 3d 62 72 80 06 31 32 33 34 35 36 |fv,dc=br..123456| 00000020 I have the following understanding o f the protocol: 60 19 [02 01 [3] 04 0c [ou=ufv,dc=br] 80 06 [123456]] What about the first "30 1e 02 01 01" ? 1e means the size is bigger than 30 and 2 bytes is specified ? Is it for the message id ? What about the rest of 27 bytes of message what is not accounted ? Shoud it not account for the 27 bytes length ? Thanks in advance. BTW: what is the message id for the message sent ?

4 3

LMDB overflow pages - MDB_RESERVE
by Christian Sell 27 Nov '15

27 Nov '15

I forgot to mention: I am using MDB_RESERVE to avoid extra memcpy. Could it be that this is the cause for the extreme database bloat? > Hello, > > something wrong with the question below? > > I am trying to use LMDB to store large (huge) amounts of binary data which, > for > the reason of limiting memory footprint, are split into chunks. Each chunk ist > stored under a separate key, made up of [collectionId, chunkId], so that I can > later iterate the chunks using a LMDB cursor. Chunk size is configurable. > > During my tests, I encountered a strange scenario where, after inserting some > 2000 chunks consisting of 512KB each, the database size had grown to a value > that was roughly 135 times the calculated size of the data. I ran the stat > utility over the db and saw that there were > 12000 overflow pages vs. approx. > 2000 data pages. When I reduced the chunk size to 4060 bytes, the number of > overflow pages went down to 1000, and the database size went down to the > expected number (I experimented with different sizes, this was the best > result). > I did not find any documentation to explain this behaviour, or how to deal > with > it. Of course it makes me worry about database bloat and the consequences. Can > anyone shed light on this? > > thanks, > Christian > Christian Sell

1 1

Getting around the single-threaded syncrepl model?
by Bannister, Mark 25 Nov '15

25 Nov '15

I was speaking with Howard in person last week at LDAPCon about the problems I might hit if I wanted to run hundreds of replicas off a single master. If I heard right, Howard told me that OpenLDAP uses a single thread for replication, and therefore processes each replica in a serial fashion, one at a time. If any replica is going slowly (high network latency for example), it would have a knock-on effect to the time it takes to get changes replicated across the whole estate. We have an aggressive target to meet - updates out in 5 minutes. Updates are small, but alarm bells are now ringing in my head about OpenLDAP's ability to deliver this. This leads to a couple of questions: 1 - How easy would it be to patch OpenLDAP 2.4 to get the master to use multiple threads for replication? Is that a reasonably straightforward fix, or is this quite a sizeable architectural change? 2 - If my master server has 40 cores, would there be mileage in setting up a number of slapd processes (say 10) on the same host, bound to different sockets, all acting as first-level replicas, and then all the replicas fanning out across the WAN synchronise from these processes rather than from the master process? That would be a way, I suppose, of getting the master server to make better use of the available cores to get updates out quicker? Thanks, Mark. ________________________________ NOTICE: Morgan Stanley is not acting as a municipal advisor and the opinions or views contained herein are not intended to be, and do not constitute, advice within the meaning of Section 975 of the Dodd-Frank Wall Street Reform and Consumer Protection Act. If you have received this communication in error, please destroy all electronic and paper copies; do not disclose, use or act upon the information; and notify the sender immediately. Mistransmission is not intended to waive confidentiality or privilege. Morgan Stanley reserves the right, to the extent permitted under applicable law, to monitor electronic communications. This message is subject to terms available at the following link: http://www.morganstanley.com/disclaimers If you cannot access these links, please notify us by reply message and we will send the contents to you. By messaging with Morgan Stanley you consent to the foregoing.

8 16

Sync replication halted
by espeake＠oreillyauto.com 25 Nov '15

25 Nov '15

We are run a 3 node MMR with Openldap 2.4.39 on Ubuntu 14.04 (trusty) Everything runs great with an occasional hiccup like this. I see the following in the logs that appear to be searches on the RID numbers that are used for config replicationL Nov 25 04:31:22 tn-ldap-a-2 slapd[5931]: syncprov_matchops: skipping relayed sid 003 Nov 25 04:31:22 tn-ldap-a-2 slapd[5931]: syncprov_matchops: skipping original sid 001 Nov 25 04:31:22 tn-ldap-a-2 slapd[5931]: syncprov_matchops: skipping relayed sid 003 Nov 25 04:31:22 tn-ldap-a-2 slapd[5931]: syncprov_matchops: skipping original sid 001 Imeadiately after this all changes show csn_too_old errors: Nov 25 04:31:22 tn-ldap-a-2 slapd[5931]: do_syncrep2: rid=004 cookie=rid=004,sid=001,csn=20151125103121.701210Z#000000#001#000000 Nov 25 04:31:22 tn-ldap-a-2 slapd[5931]: do_syncrep2: rid=004 CSN too old, ignoring 20151125103121.701210Z#000000#001#000000 (uid=JRIVAS21,ou=Users,dc=oreillyauto,dc=com) Nov 25 04:31:22 tn-ldap-a-2 slapd[5931]: do_syncrep2: rid=004 cookie=rid=004,sid=001,csn=20151125103121.705110Z#000000#001#000000 Nov 25 04:31:22 tn-ldap-a-2 slapd[5931]: do_syncrep2: rid=004 CSN too old, ignoring 20151125103121.705110Z#000000#001#000000 (uid=JRIVAS21,ou=Users,dc=oreillyauto,dc=com) Nov 25 04:31:22 tn-ldap-a-2 slapd[5931]: do_syncrep2: rid=004 cookie=rid=004,sid=001,csn=20151125103121.713760Z#000000#001#000000 Nov 25 04:31:22 tn-ldap-a-2 slapd[5931]: do_syncrep2: rid=004 CSN too old, ignoring 20151125103121.713760Z#000000#001#000000 (uid=ACERVANT4,ou=Users,dc=oreillyauto,dc=com) Nov 25 04:31:22 tn-ldap-a-2 slapd[5931]: do_syncrep2: rid=004 cookie=rid=004,sid=001,csn=20151125103121.718018Z#000000#001#000000 Nov 25 04:31:22 tn-ldap-a-2 slapd[5931]: do_syncrep2: rid=004 CSN too old, ignoring 20151125103121.718018Z#000000#001#000000 (uid=ACERVANT4,ou=Users,dc=oreillyauto,dc=com) Nov 25 04:31:22 tn-ldap-a-2 slapd[5931]: do_syncrep2: rid=004 cookie=rid=004,sid=001,csn=20151125103121.726847Z#000000#001#000000 Nov 25 04:31:22 tn-ldap-a-2 slapd[5931]: do_syncrep2: rid=004 CSN too old, ignoring 20151125103121.726847Z#000000#001#000000 (uid=KCOOPER10,ou=Users,dc=oreillyauto,dc=com) This happened on one node. The third node had the same replication error for a few miliseconds and then recovered. I am attaching the database config file as well. Thank you, Eric Speake Senior Systems Administrator Information Systems O'Reilly Auto Parts (417) 862-2674 Ext. 1975 (See attached file: olcDatabase={1}mdb.ldif)This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

1 0

LMDB: successive fillups and drops break the DB after a while
by Dominik Taborsky 25 Nov '15

25 Nov '15

Hello, I've tried stress-testing LMDB in our use case and I've discovered something I consider a bug. In our use case we need to keep inserting to the DB until it's full, flush it and repeat. We've designed the insert function to fail if there are not enough headroom pages for safe delete / DB drop. During the tests the DB works correctly for some amount of repeats, but then it suddenly refuses to insert anything. It seems LMDB doesn't clear or reuse all of its pages. I would like to get anyone's opinion on this. I have attached the source file containing the test. The DB size is set to 20MB, the inserted values have by default 25kB. In the first run the DB accepts 365 inserts, which decreases over time and stabilizes at 280. After 18 repeats the DB does not accept any inserts at all: ok 1 - pass #1 fillup run (365 inserts) ok 2 - pass #2 fillup run (300 inserts) ok 3 - pass #3 fillup run (286 inserts) ok 4 - pass #4 fillup run (283 inserts) ok 5 - pass #5 fillup run (281 inserts) ok 6 - pass #6 fillup run (280 inserts) ok 7 - pass #7 fillup run (280 inserts) ok 8 - pass #8 fillup run (280 inserts) ok 9 - pass #9 fillup run (280 inserts) ok 10 - pass #10 fillup run (280 inserts) ok 11 - pass #11 fillup run (280 inserts) ok 12 - pass #12 fillup run (280 inserts) ok 13 - pass #13 fillup run (280 inserts) ok 14 - pass #14 fillup run (280 inserts) ok 15 - pass #15 fillup run (280 inserts) ok 16 - pass #16 fillup run (280 inserts) ok 17 - pass #17 fillup run (280 inserts) ok 18 - pass #18 fillup run (108 inserts) not ok 19 - pass #19 fillup run (0 inserts) not ok 20 - pass #20 fillup run (0 inserts) The test is run 4 times with different approaches that we thought could have had some impact. These approaches combine opening the DB per insert or per single fillup, and reopening the DB just for the DB drop. In this case these options have no effect and the results are the same, but originally a unit test that this originates from had some differences so I kept them in. Note that I also tried calling mdb_drop with "1" as the last parameter, but it had no effect on the result. I am linking against the latest LMDB from sources. I also tried adding a constant number of pages to the reserve before the insert function fails. This only changes the amount of inserted items but doesn't change the functionality. If you compile the program you can supply it with an argument to change the default size of the item value size. Lower values break the DB sooner (20kB requires only 12 repeated fillups and drops). If anyone has any idea what might be the issue, please let me know. I know deleting the DB from filesystem and creating a new one would work, but that's a hack, not a fix. Thanks. Dominik

2 4

rwm overlay
by BÖSCH Christian 25 Nov '15

25 Nov '15

Hi, I configured rwm overlay like the example in the man page to allow binds with the email address. dn: olcOverlay={0}rwm,olcDatabase={-1}frontend,cn=config objectClass: olcOverlayConfig objectClass: olcRwmConfig olcOverlay: {0}rwm olcRwmRewrite: {0}rwm-rewriteEngine "on" olcRwmRewrite: {1}rwm-rewriteMap "ldap" "attr2dn" "ldap://localhost/dc=abcd,dc =net?dn?sub" olcRwmRewrite: {2}rwm-rewriteContext "bindDN" olcRwmRewrite: {3}rwm-rewriteRule "^mail=[^,]+@[^,]+$" "${attr2dn($0)}" ":@I" olcRwmTFSupport: false olcRwmNormalizeMapped: FALSE But I get the error message the the DN is invalid: ldapsearch -x -D "cb(a)abcd.net" -W -b 'dc=abcd,dc=net' -H ldap://openldap1.abcd.net/ 'uid=cb' Enter LDAP Password: ldap_bind: Invalid DN syntax (34) additional info: invalid DN Is there something missing or wrong? Thanks, Chris

2 2

LMDB overflow pages
by Christian Sell 24 Nov '15

24 Nov '15

Hello, something wrong with the question below? I am trying to use LMDB to store large (huge) amounts of binary data which, for the reason of limiting memory footprint, are split into chunks. Each chunk ist stored under a separate key, made up of [collectionId, chunkId], so that I can later iterate the chunks using a LMDB cursor. Chunk size is configurable. During my tests, I encountered a strange scenario where, after inserting some 2000 chunks consisting of 512KB each, the database size had grown to a value that was roughly 135 times the calculated size of the data. I ran the stat utility over the db and saw that there were > 12000 overflow pages vs. approx. 2000 data pages. When I reduced the chunk size to 4060 bytes, the number of overflow pages went down to 1000, and the database size went down to the expected number (I experimented with different sizes, this was the best result). I did not find any documentation to explain this behaviour, or how to deal with it. Of course it makes me worry about database bloat and the consequences. Can anyone shed light on this? thanks, Christian

1 0

Re: ERR_employeeadd {'info': 'modifications require authentication', 'desc': 'Strong(er) authentication required'}
by Andrei Valoshyn 24 Nov '15

24 Nov '15

Le 19/11/2015 19:43, Andrei Valoshyn a écrit : Hello! I have slapd 2.4.39 and python 2.6 I tried to create an user via python when I tried do that with rootpermission - it's OK. But when I did this with config in slapd.conf"access to * bygroup.exact="cn=LDAP_admins,ou=Roles,ou=Groups,dc=exadel,dc=com" write"I have an error " ERR_employeeadd {'info': 'modifications requireauthentication', 'desc': 'Strong(er) authentication required'} " I tried to use " l.protocol_version = ldap.VERSION{2,3} " via 389 port My function for adding ldif is : l = ldap.initialize(server) l.simple_bind(username, ldapsrvpassword) def employeeadd(): ldif = modlist.addModlist(attrs) l.add_s(dn,ldif) Will be very appreciate for any help Hello Andrei, I suppose that the username you use is a member ofcn=LDAP_admins,ou=Roles,ou=Groups,dc=exadel,dc=com, but whichobjectClass did you use in your group? By default, the OpenLDAP ACLsystem will use groupOfNames, searching user in the member attribute. Ifyou have for example a groupOfUnixNames, you need to set your ACL likethis:access to * bygroup/groupOfUniqueNames/uniqueMember.exact="cn=LDAP_admins,ou=Roles,ou=Groups,dc=exadel,dc=com"write Hello *Clément*, Thank you for reply! I have groupOfNames and posixGroup objectClass. But at that moment this problem was fixed. The matter of fact Python had some problem. It was reinstalled. Thank you! -- CONFIDENTIALITY NOTICE: This email and files attached to it are confidential. If you are not the intended recipient you are hereby notified that using, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error please notify the sender and delete this email.

1 0

Multiple certificates in slapd
by Olivier Nicole 24 Nov '15

24 Nov '15

Hi, I am planing a transition of the certificate I use in OpenLDAP for LDAP over SSL (port 636). My selft signed certificate is quite old and has become obsolete/not recognized on some systems (for example Mac OS 10.11) so it is time to update. But I have many systems that use LDAP and updating all of them cannot be done at once. So I was wondering if it is possible to have one single slapd process running with several posut open over SSL, keeping port 636 with the old certificate and opening port 637 with the new certificate. That way, i can transition the clients at my onw pace, not needing to do all at same time. I know that I could set-up a slave server, but that would be not as transparent s0 I'd prefer my idea of havingslapd -h ldaps://192.168.10.1:636/ ldaps:/192.168.10.1:637/ each using a different certificate. Thanks in advance, Olivier --

2 1

Re: Trying to set up multimaster syncrepl, error attribute 'olcTLSCertificateFile' not allowed , why?
by Betsy Schwartz 24 Nov '15

24 Nov '15

On Sat, Nov 21, 2015 at 2:00 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > > I would suggest using slapcat to export the config database and clean up > the invalid attribute values that were incorrectly added to the bdb > database. > > Thank you very much! I have made progress but am now in an entertaining new place (having *overwritten* my database with my overlay files). But I'm going to go RTFM and see if I can't dig myself out of that one. > a) Upgrading to a current openldap release > b) Switching to back-mdb, assuming a 64-bit OS. > Thank you! Sigh, 2.4.40 seems to be the latest in the Oracle repo (we are using Oracle's version of RHEL6). It looks like there have been some good bug fixes and I'll make the case for going outside the repo. Sometime in the next couple months these two new servers will become the primary production servers and then we'll be able to do what we want with them. The two old servers, current production, are running 2.4.39 and 2.4.23 (and not syncing with each other!) . I've been hoping that I could sync data between at least these two new servers and the 2.4.39 server, is that possible or a foolish hope? Again, once these new ones become primary I'll be able to keep them identical to each other, but I don't really 'own' the old ones and don't want to break them. I'm still working through the manual and the configuration settings. One more question - still trying to understand what was done on these old servers - on these servers the config database is 0, the monitor database is 1 and the bdb database is 2. I can't slapcat the monitor database, is that normal? I get slapcat -n 1 slapcat: database doesn't support necessary operations. I had a little trouble with this particular section of the manual which reads simply: 20.1. Monitor configuration via cn=config(5) This section has yet to be written. thanks again Betsy

2 1

questions about memberof-refint option
by M. P. 23 Nov '15

23 Nov '15

Hi, I'm playing with memberof overlay. For my tests, I use the default database (numbered 1) from slapd installation with suffix dc=nodomain. The tests are running on debian jessie 8.2 and slapd version 2.4.40+dfsg-1 Activating the module in cn=module entry and activating the overlay for the database, I have something that works like (I think) it should. I mean adding a user (attribute member) in a group creates an attribute memberOf for the user and deleting a user from the group deletes the user's memberOf attribute. That's great. There is nothing special configured. # Entrée 1: olcOverlay={0}memberof,olcDatabase={1}mdb,cn=config dn: olcOverlay={0}memberof,olcDatabase={1}mdb,cn=config objectclass: olcConfig objectclass: olcOverlayConfig objectclass: olcMemberOf objectclass: top olcoverlay: {0}memberof Reading the man page, I saw memberof-refint option. From what I understand, when set to true, you can alter the user's "is member of" attribute and that would be reflected in the group's "member" attribute. Right ? But, the member attribute is an operational attribute and can't be modified. So I started to search for an alternative and found the eduMember schema from here https://spaces.internet2.edu/display/macedir/OpenLDAP+eduMember. Once added to the installation I could use it for objects. It adds isMemberOf and hasMember attributes that can be setable for users and groups. But can't make it work with memberof overlay. When trying to add isMemberOf as memberof-memberof-ad it was rejected with member attribute=”isMemberOf” must either have DN (1.3.6.1.4.1.1466.115.121.1.12) or nameUID (1.3.6.1.4.1.1466.115.121.1.34) syntax And the same error was reported with hasMember as memberof-member-ad. To make it work together I modified the attribute's definitions and reimported them to openldap. So I can now set isMemberOf as memberof-memberof-ad and the same for hasMember as memberof-member-ad. The configuration then was like this # Entrée 1: olcOverlay={0}memberof,olcDatabase={1}mdb,cn=config dn: olcOverlay={0}memberof,olcDatabase={1}mdb,cn=config objectclass: olcConfig objectclass: olcOverlayConfig objectclass: olcMemberOf objectclass: top olcmemberofmemberofad: isMemberOf olcoverlay: {0}memberof Now that works like (I think) it should. I mean adding a user (attribute member) in a group creates an attribute isMemberOf for the user and deleting a user from the group deletes the user's isMemberOf attribute. That's great. isMemberOf is a modifiable attribute so it's time to test the memberof-refint and set it to TRUE # Entrée 1: olcOverlay={0}memberof,olcDatabase={1}mdb,cn=config dn: olcOverlay={0}memberof,olcDatabase={1}mdb,cn=config objectclass: olcConfig objectclass: olcOverlayConfig objectclass: olcMemberOf objectclass: top olcmemberofmemberofad: isMemberOf olcmemberofrefint: TRUE olcoverlay: {0}memberof And this is where things do not work. I mean what was working before is still working. If I add a member in a group an atttribute isMemberOf is created for the user. But if I add a second attribute isMemberOf with a second group, no new member is created on the second group. And if I delete the attribute isMemberOf from the user's entry, it is still visible on the group. Does anybody have any idea why the modifications made on the user (with the deletion of isMemberOf) are not applied to the group ? Is there something I'm doing wrong ? Thanks. -- ------------ M. P.

4 11

LMDB data growth - overflow pages
by Christian Sell 22 Nov '15

22 Nov '15

Hello, I am trying to use LMDB to store large (huge) amounts of binary data which, for the reason of limiting memory footprint, are split into chunks. Each chunk ist stored under a separate key, made up of [collectionId, chunkId], so that I can later iterate the chunks using a LMDB cursor. Chunk size is configurable. During my tests, I encountered a strange scenario where, after inserting some 2000 chunks consisting of 512KB each, the database size had grown to a value that was roughly 135 times the calculated size of the data. I ran stat over the db and saw that there were > 12000 overflow pages vs. approx. 2000 data pages. When I reduced the chunk size to 4060 bytes, the number of overflow pages went down to 1000, and the database size went down to the expected number (I experimented with different sizes, this was the best result). I did not find any documentation that would explain this behavior, or how to deal with it. Of course it makes me worry about database bloat and the consequences. Can anyone shed light on this? thanks, Christian

1 0

Human-friendly olcAccess management
by Bogdan Rudas 22 Nov '15

22 Nov '15

Hello all, I would like to start use of olcAccess rules, are there human-friendly editor for that ACLs? I can't even use line breaks in ldif file to make my restrictions a bit more readable! I strongly dislike very long string values, one day this will cause mistake and access violation. I've tried with Apache DS, ldif import and few puppet modules, everything require huge line ACL. Any help will be welcome. -- Bogdan Rudas Head of Minsk IT Support Department Exadel Inc. http://www.exadel.com/ E-mail: brudas(a)exadel.com <mandrushkevich(a)exadel.com> Skype ID: bogdan.rudas -- CONFIDENTIALITY NOTICE: This email and files attached to it are confidential. If you are not the intended recipient you are hereby notified that using, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error please notify the sender and delete this email.

4 3

Tuning number of entries sent during syncrepl?
by Bannister, Mark 22 Nov '15

22 Nov '15

It takes about 10 minutes to synchronise about 300,000 entries across the WAN, but the WAN isn't that slow here, I can transfer an LDIF file much faster than that over NFS. Before LDAPCon last week, I had been working on a solution to this problem, where I would get the master server to dump its contents once a day to NFS, and then replicas could build initially from that. It was taking quite a bit of work, and it was slightly annoying that I needed to jump through these hoops. Last week I was speaking with someone at LDAPCon who told me he had come across the same problem, and it turned out to be something to do with the maximum number of entries that can be transferred in one go? - although I may have misheard this, so please forgive me if details are not entirely accurate. But apparently this is tunable, and if I increase it, my 300,000 entries will replicate much much faster. Any ideas? Sorry I'm a bit sketchy on details. Thanks, Mark. ________________________________ NOTICE: Morgan Stanley is not acting as a municipal advisor and the opinions or views contained herein are not intended to be, and do not constitute, advice within the meaning of Section 975 of the Dodd-Frank Wall Street Reform and Consumer Protection Act. If you have received this communication in error, please destroy all electronic and paper copies; do not disclose, use or act upon the information; and notify the sender immediately. Mistransmission is not intended to waive confidentiality or privilege. Morgan Stanley reserves the right, to the extent permitted under applicable law, to monitor electronic communications. This message is subject to terms available at the following link: http://www.morganstanley.com/disclaimers If you cannot access these links, please notify us by reply message and we will send the contents to you. By messaging with Morgan Stanley you consent to the foregoing.

2 2

Problem making refint_nothing working
by katgb 21 Nov '15

21 Nov '15

Hi all, I tried for some days to make refint overlay work with refint_nothing filled. The slapo-refint man page says : refint_nothing <string> Specify an arbitrary value to be used as a placeholder when the last value would otherwise be deleted from an attribute. This can be useful in cases where the schema requires the existence of an attribute for which referential integrity is enforced. The attempted deletion of a required attribute will otherwise result in an Object Class Violation, causing the request to fail. The string must be a valid DN. but each time I try to delete the last member from a groupOfNames group, the deletion is refused because of schema violation. That's ok without refint_nothing but with the string set it should replace last member, right ? I tried to increase loglevel to 16383 but can't see any debug for refint overlay. So I'm not sure if refint is working or not. Is there another way to have some debug information from refint ? I have included my configuration, ldap tree and log content below. For the logs, I have snipped the content to the error directly but can provide full log if required. The tests are running on debian jessie 8.2 and slapd version 2.4.40+dfsg-1. And I know I can place the placeholder manually but doing it by hand each time is not what I want and, more important, I want to understand why the module is not worrking like it should. I hope I have posted to the right list and if there is something missing please ask. Thanks for help. ######### START CONF LDIF ######## dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/slapd/slapd.args olcPidFile: /var/run/slapd/slapd.pid olcToolThreads: 1 structuralObjectClass: olcGlobal entryUUID: a00e3106-20ce-1035-8943-a9586533ca5e creatorsName: cn=config createTimestamp: 20151116165546Z olcLogLevel: 16383 entryCSN: 20151116173108.585343Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20151116173108Z dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib/ldap olcModuleLoad: {0}back_mdb olcModuleLoad: {1}refint olcModuleLoad: {2}memberof.la structuralObjectClass: olcModuleList entryUUID: a00edd9a-20ce-1035-894b-a9586533ca5e creatorsName: cn=admin,cn=config createTimestamp: 20151116165546Z entryCSN: 20151116172537.271031Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20151116172537Z dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema structuralObjectClass: olcSchemaConfig entryUUID: a00e5a96-20ce-1035-8946-a9586533ca5e creatorsName: cn=admin,cn=config createTimestamp: 20151116165546Z entryCSN: 20151116165546.131180Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20151116165546Z ... schema listing skipped as they are not modified ... dn: olcBackend={0}mdb,cn=config objectClass: olcBackendConfig olcBackend: {0}mdb structuralObjectClass: olcBackendConfig entryUUID: a00ef6cc-20ce-1035-894c-a9586533ca5e creatorsName: cn=admin,cn=config createTimestamp: 20151116165546Z entryCSN: 20151116165546.135178Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20151116165546Z dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=extern al,cn=auth manage by * break olcAccess: {1}to dn.exact="" by * read olcAccess: {2}to dn.base="cn=Subschema" by * read olcSizeLimit: 500 structuralObjectClass: olcDatabaseConfig entryUUID: a00e4ec0-20ce-1035-8944-a9586533ca5e creatorsName: cn=config createTimestamp: 20151116165546Z entryCSN: 20151116165546.130875Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20151116165546Z dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=extern al,cn=auth manage by * break olcRootDN: cn=admin,cn=config structuralObjectClass: olcDatabaseConfig entryUUID: a00e5654-20ce-1035-8945-a9586533ca5e creatorsName: cn=config createTimestamp: 20151116165546Z olcRootPW:: e1NTSEF9NkdpY3VMWFhTUGpBa1IzM3UzcnkxVm1qY2N2ZVZXNHY= entryCSN: 20151116170655.978168Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20151116170655Z dn: olcDatabase={1}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=nodomain olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonym ous auth by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by * read olcLastMod: TRUE olcRootDN: cn=admin,dc=nodomain olcDbCheckpoint: 512 30 olcDbIndex: objectClass eq olcDbIndex: cn,uid eq olcDbIndex: uidNumber,gidNumber eq olcDbIndex: member,memberUid eq olcDbMaxSize: 1073741824 structuralObjectClass: olcMdbConfig entryUUID: a00efa64-20ce-1035-894d-a9586533ca5e creatorsName: cn=admin,cn=config createTimestamp: 20151116165546Z olcRootPW:: e1NTSEF9SlExdmxnN1E0a0hNTTZtanZzdEtIcHBSYjBmNHJyaGI= entryCSN: 20151116170852.768823Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20151116170852Z dn: olcOverlay={0}refint,olcDatabase={1}mdb,cn=config objectClass: olcConfig objectClass: olcOverlayConfig objectClass: olcRefintConfig objectClass: top olcOverlay: {0}refint structuralObjectClass: olcRefintConfig entryUUID: cd95de54-20d2-1035-86bf-517b01ed1806 creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20151116172540Z olcRefintNothing: uid=myuser2,ou=users,dc=nodomain olcRefintAttribute: member entryCSN: 20151116174304.336010Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20151116174304Z ######### END CONF LDIF ######## ######### START DB LDIF ######## dn: dc=nodomain objectClass: top objectClass: dcObject objectClass: organization o: nodomain dc: nodomain structuralObjectClass: organization entryUUID: a01fd816-20ce-1035-8deb-e11fbfc8d840 creatorsName: cn=admin,dc=nodomain createTimestamp: 20151116165546Z entryCSN: 20151116165546.245753Z#000000#000#000000 modifiersName: cn=admin,dc=nodomain modifyTimestamp: 20151116165546Z dn: cn=admin,dc=nodomain objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator userPassword:: e1NTSEF9Z2doUHZPQVo2dnV5NzVSY1dFLzhhUFNGQjVZY1FXRHY= structuralObjectClass: organizationalRole entryUUID: a02629b4-20ce-1035-8dec-e11fbfc8d840 creatorsName: cn=admin,dc=nodomain createTimestamp: 20151116165546Z entryCSN: 20151116165546.287209Z#000000#000#000000 modifiersName: cn=admin,dc=nodomain modifyTimestamp: 20151116165546Z dn: ou=groups,dc=nodomain objectClass: organizationalUnit objectClass: top ou: groups structuralObjectClass: organizationalUnit entryUUID: 25ff55cc-20d1-1035-86b9-517b01ed1806 creatorsName: cn=admin,dc=nodomain createTimestamp: 20151116171349Z entryCSN: 20151116171349.840889Z#000000#000#000000 modifiersName: cn=admin,dc=nodomain modifyTimestamp: 20151116171349Z dn: ou=users,dc=nodomain objectClass: organizationalUnit objectClass: top ou: users structuralObjectClass: organizationalUnit entryUUID: 351d4e6a-20d1-1035-86ba-517b01ed1806 creatorsName: cn=admin,dc=nodomain createTimestamp: 20151116171415Z entryCSN: 20151116171415.203147Z#000000#000#000000 modifiersName: cn=admin,dc=nodomain modifyTimestamp: 20151116171415Z dn: uid=myuser1,ou=users,dc=nodomain cn: myuser1 objectClass: inetOrgPerson objectClass: top sn: myuser1 uid: myuser1 structuralObjectClass: inetOrgPerson entryUUID: bba534d4-20d1-1035-86bb-517b01ed1806 creatorsName: cn=admin,dc=nodomain createTimestamp: 20151116171800Z entryCSN: 20151116171800.908475Z#000000#000#000000 modifiersName: cn=admin,dc=nodomain modifyTimestamp: 20151116171800Z dn: uid=myuser2,ou=users,dc=nodomain cn: myuser2 objectClass: inetOrgPerson objectClass: top sn: myuser2 uid: myuser2 structuralObjectClass: inetOrgPerson entryUUID: d175bac2-20d1-1035-86bc-517b01ed1806 creatorsName: cn=admin,dc=nodomain createTimestamp: 20151116171837Z entryCSN: 20151116171837.507205Z#000000#000#000000 modifiersName: cn=admin,dc=nodomain modifyTimestamp: 20151116171837Z dn: cn=mygroup1,ou=groups,dc=nodomain cn: mygroup1 member: uid=myuser1,ou=users,dc=nodomain objectClass: groupOfNames objectClass: top structuralObjectClass: groupOfNames entryUUID: f9657978-20d1-1035-86bd-517b01ed1806 creatorsName: cn=admin,dc=nodomain createTimestamp: 20151116171944Z entryCSN: 20151116171944.509541Z#000000#000#000000 modifiersName: cn=admin,dc=nodomain modifyTimestamp: 20151116171944Z ######### END DB LDIF ######## ######### START LOG ######## ... Nov 16 18:43:31 vm-rt1 slapd[15110]: daemon: read active on 13 Nov 16 18:43:31 vm-rt1 slapd[15110]: daemon: epoll: listen=9 active_threads=0 tvp=zero Nov 16 18:43:31 vm-rt1 slapd[15110]: daemon: epoll: listen=10 active_threads=0 tvp=zero Nov 16 18:43:31 vm-rt1 slapd[15110]: daemon: epoll: listen=11 active_threads=0 tvp=zero Nov 16 18:43:31 vm-rt1 slapd[15110]: connection_get(13) Nov 16 18:43:31 vm-rt1 slapd[15110]: connection_get(13): got connid=1154 Nov 16 18:43:31 vm-rt1 slapd[15110]: connection_read(13): checking for input on id=1154 Nov 16 18:43:31 vm-rt1 slapd[15110]: op tag 0x66, time 1447695811 Nov 16 18:43:31 vm-rt1 slapd[15110]: conn=1154 op=4 do_modify Nov 16 18:43:31 vm-rt1 slapd[15110]: conn=1154 op=4 do_modify: dn (cn=mygroup1,ou=groups,dc=nodomain) Nov 16 18:43:31 vm-rt1 slapd[15110]: >>> dnPrettyNormal: <cn=mygroup1,ou=groups,dc=nodomain> Nov 16 18:43:31 vm-rt1 slapd[15110]: <<< dnPrettyNormal: <cn=mygroup1,ou=groups,dc=nodomain>, <cn=mygroup1,ou=groups,dc=nodomain> Nov 16 18:43:31 vm-rt1 slapd[15110]: conn=1154 op=4 modifications: Nov 16 18:43:31 vm-rt1 slapd[15110]: #011replace: member Nov 16 18:43:31 vm-rt1 slapd[15110]: #011#011no values Nov 16 18:43:31 vm-rt1 slapd[15110]: conn=1154 op=4 MOD dn="cn=mygroup1,ou=groups,dc=nodomain" Nov 16 18:43:31 vm-rt1 slapd[15110]: conn=1154 op=4 MOD attr=member Nov 16 18:43:31 vm-rt1 slapd[15110]: mdb_modify: cn=mygroup1,ou=groups,dc=nodomain Nov 16 18:43:31 vm-rt1 slapd[15110]: mdb_dn2entry("cn=mygroup1,ou=groups,dc=nodomain") Nov 16 18:43:31 vm-rt1 slapd[15110]: => mdb_dn2id("cn=mygroup1,ou=groups,dc=nodomain") Nov 16 18:43:31 vm-rt1 slapd[15110]: <= mdb_dn2id: got id=0x7 Nov 16 18:43:31 vm-rt1 slapd[15110]: => mdb_entry_decode: Nov 16 18:43:31 vm-rt1 slapd[15110]: <= mdb_entry_decode Nov 16 18:43:31 vm-rt1 slapd[15110]: mdb_modify_internal: 0x00000007: cn=mygroup1,ou=groups,dc=nodomain Nov 16 18:43:31 vm-rt1 slapd[15110]: <= acl_access_allowed: granted to database root Nov 16 18:43:31 vm-rt1 slapd[15110]: mdb_modify_internal: replace member Nov 16 18:43:31 vm-rt1 slapd[15110]: mdb_modify_internal: replace entryCSN Nov 16 18:43:31 vm-rt1 slapd[15110]: mdb_modify_internal: replace modifiersName Nov 16 18:43:31 vm-rt1 slapd[15110]: mdb_modify_internal: replace modifyTimestamp Nov 16 18:43:31 vm-rt1 slapd[15110]: oc_check_required entry (cn=mygroup1,ou=groups,dc=nodomain), objectClass "groupOfNames" Nov 16 18:43:31 vm-rt1 slapd[15110]: Entry (cn=mygroup1,ou=groups,dc=nodomain): object class 'groupOfNames' requires attribute 'member' Nov 16 18:43:31 vm-rt1 slapd[15110]: entry failed schema check: object class 'groupOfNames' requires attribute 'member' Nov 16 18:43:31 vm-rt1 slapd[15110]: mdb_modify: modify failed (65) Nov 16 18:43:31 vm-rt1 slapd[15110]: send_ldap_result: conn=1154 op=4 p=3 Nov 16 18:43:31 vm-rt1 slapd[15110]: send_ldap_result: err=65 matched="" text="object class 'groupOfNames' requires attribute 'member'" Nov 16 18:43:31 vm-rt1 slapd[15110]: send_ldap_response: msgid=5 tag=103 err=65 Nov 16 18:43:31 vm-rt1 slapd[15110]: conn=1154 op=4 RESULT tag=103 err=65 text=object class 'groupOfNames' requires attribute 'member' Nov 16 18:43:31 vm-rt1 slapd[15110]: daemon: activity on 1 descriptor Nov 16 18:43:31 vm-rt1 slapd[15110]: daemon: activity on: Nov 16 18:43:31 vm-rt1 slapd[15110]: Nov 16 18:43:31 vm-rt1 slapd[15110]: daemon: epoll: listen=9 active_threads=0 tvp=zero Nov 16 18:43:31 vm-rt1 slapd[15110]: daemon: epoll: listen=10 active_threads=0 tvp=zero Nov 16 18:43:31 vm-rt1 slapd[15110]: daemon: epoll: listen=11 active_threads=0 tvp=zero Nov 16 18:43:31 vm-rt1 slapd[15110]: daemon: activity on 1 descriptor Nov 16 18:43:31 vm-rt1 slapd[15110]: daemon: activity on: ######### END LOG ########

4 6

Trying to set up multimaster syncrepl, error attribute 'olcTLSCertificateFile' not allowed , why?
by Betsy Schwartz 21 Nov '15

21 Nov '15

I inherited a pair of (interestingly configured) ldap servers from a previous owner and I'm trying to get them to replicate to each other (actually, starting with two new VM copies, with the goal of ending up with four masters spread over two data centers). The VM's are running RHEL6 and openldap 2.4.40. When I try to add replication using the ldif included at the bottom of this post , I get this error and then cannot restart slapd -- [root@ldap01 tmp]# ldapmodify -Y EXTERNAL -H ldapi:/// -f /tmp/repl.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "cn=config" adding new entry "olcOverlay=syncprov,olcDatabase={2}bdb,cn=config" modifying entry "olcDatabase={2}bdb,cn=config" ldap_modify: Object class violation (65) additional info: attribute 'olcTLSCertificateFile' not allowed -- slapd restart error in the log is read_config: no serverID / URL match found. Check slapd -h arguments. (I assume this is coming from my three new syncprov providers which have nothing to provide?) The only reference I found to TLS anywhere was here [root@ldap01 tmp]# slapcat -s olcDatabase=\{2}bdb,cn=config |grep TLS olcTLSCertificateFile: /etc/pki/tls/certs/foobar_cert.pem olcTLSCertificateKeyFile: /etc/pki/tls/certs/foobar_key.pem Those files do not exist, never have! (I admit I tried, and failed, to delete the reference) What can I do to fix the TLS error? Where is there a TLS dependency in this picture? Thank you for any clues! [root@ldap01 tmp]# cat post.ldif olcServerID: 1 ldap://ldap02.example.com olcServerID: 2 ldap://ldap2.example.com olcServerID: 3 ldap://ldap.example.com dn: olcOverlay=syncprov,olcDatabase={2}bdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov dn: olcDatabase={2}bdb,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=ldap://ldap02.example.com binddn="uid=Manager,dc=example,dc=com" bindmethod=simple credentials="managerpassword" searchbase="dc=example,dc=com" type=refreshAndPersist retry="60 +" timeout=1 olcSyncRepl: rid=002 provider=ldap://ldap2.example.com binddn="uid=Manager,dc=example,dc=com" bindmethod=simple credentials="managerpassword" searchbase="dc=example,dc=com" type=refreshAndPersist retry="60 1 300 12 7200 +" timeout=1 olcSyncRepl: rid=003 provider=ldap://ldap.example.com binddn="uid=Manager,dc=example,dc=com" bindmethod=simple credentials="managerpassword" searchbase="dc=example,dc=com" type=refreshAndPersist retry="60 1 300 12 7200 +" timeout=1 - add: olcMirrorMode olcMirrorMode: TRUE thank you very much!

2 1

replicating cn=config generates LDAP_NOT_ALLOWED_ON_RDN
by Chris Cook 21 Nov '15

21 Nov '15

Openldap 2.4.31 I create my read-only ldap hosts with a stub config that contains a syncrepl statement: olcSyncrepl: {0}rid=001 provider=ldaps://ldap.savagebeast.com binddn="cn= admin,cn=config,cn=slave" bindmethod=simple credentials=$PW searchbase="cn= config,cn=slave" type=refreshAndPersist retry="60 +" timeout=3 suffixmassage= "cn=config" schemachecking=off That on first run with a –c ‘rid=001’ flag syncs the rest of the configs and associated databases from the primary servers. Leaving the config database as: # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 3c65cc7d dn: olcDatabase={0}config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootDN: cn=admin,cn=config olcUpdateRef: ldaps://ldap.savagebeast.com structuralObjectClass: olcDatabaseConfig entryUUID: fee78e38-2723-1030-8342-0d5a80dcc32a creatorsName: cn=admin,cn=config createTimestamp: 20110609203711Z olcRootPW:: x== olcSyncrepl: {0}rid=001 provider=ldaps://guess-who.savagebeast.com binddn="cn= admin,cn=config,cn=slave" bindmethod=simple credentials=x searchbase ="cn=config,cn=slave" schemachecking=off type=refreshAndPersist retry="60 +" timeout=3 suffixmassage="cn=config" entryCSN: 20151119013205.450738Z#000000#000#000000 modifiersName: cn=admin,dc=savagebeast,dc=com modifyTimestamp: 20151119013205Z This works great for the first run, but subsequent changes to the cn=config,cn=slave entries on the primary servers generate a replication error on the downstream hosts. 564fc719 syncrepl_entry: rid=001 be_search (0) 564fc719 syncrepl_entry: rid=001 olcDatabase={2}hdb,cn=config 564fc719 <= acl_access_allowed: granted to database root 564fc719 send_ldap_result: conn=-1 op=0 p=3 564fc719 send_ldap_result: err=67 matched="" text="Use modrdn to change the entry name" 564fc719 null_callback : error code 0x43 564fc719 syncrepl_entry: rid=001 be_modify olcDatabase={2}hdb,cn=config (67) 564fc719 syncrepl_entry: rid=001 be_modify failed (67) Which is LDAP_NOT_ALLOWED_ON_RDN. The only change to be synced was the addition of an olcDbIndex to one of the databases. The suffix massage seems to still be in place: 564fc719 syncrepl_message_to_entry: rid=001 DN: olcDatabase={2}hdb,cn=config,cn=slave, UUID: ef2a6d04-b2cf-1033-9ca0-37a633abeda5 564fc719 ==> rewrite_context_apply [depth=1] string='olcDatabase={2}hdb,cn=config,cn=slave' 564fc719 ==> rewrite_rule_apply rule='(.*)cn=config,cn=slave$' string='olcDatabase={2}hdb,cn=config,cn=slave' [1 pass(es)] 564fc719 ==> rewrite_context_apply [depth=1] res={0,'olcDatabase={2}hdb,cn=config'} 564fc719 >>> dnPrettyNormal: <olcDatabase={2}hdb,cn=config> Any pointers on how to troubleshoot why this error is called?

1 0

Building for windows. Again.
by Kristoffer Sjögren 20 Nov '15

20 Nov '15

Hi I'm trying to build LMDB with Java/JNI bindings with Visual C++ Project Builder 9.00.30729 (vcbuild). Unfortunately, vcbuild don't ship with inttypes.h, stdint.h, or a sane ssize_t. So I searched around and found a few candidates [1] of inttypes.h and stdint.h that seems to be working for py-lmdb. However, unistd.h seems broken for windows - and the python guys use python.h instead. Any ideas where I might find a good unistd.h? Cheers, -Kristoffer [1] https://github.com/deephacks/lmdbjni/tree/master/lmdbjni-win64/headers

2 16

multi-value attribute virtual view of single attribute
by Jason Whitener 20 Nov '15

20 Nov '15

If I had a multi-valued attribute like cn: var0:value cn: var2:value cn: var3:value is there a way to expose each varX as if it were an attribute for search filter purposes? For instance, ldapsearch.....&((objectclass=person)(var0=value)) I started looking into slapo-rwm. Is that the best way to accomplish this?

5 8

ERR_employeeadd {'info': 'modifications require authentication', 'desc': 'Strong(er) authentication required'}
by Andrei Valoshyn 20 Nov '15

20 Nov '15

Hello! I have slapd 2.4.39 and python 2.6 I tried to create an user via python when I tried do that with root permission - it's OK. But when I did this with config in slapd.conf "access to * by group.exact="cn=LDAP_admins,ou=Roles,ou=Groups,dc=exadel,dc=com" write" I have an error " ERR_employeeadd {'info': 'modifications require authentication', 'desc': 'Strong(er) authentication required'} " I tried to use " l.protocol_version = ldap.VERSION{2,3} " via 389 port My function for adding ldif is : l = ldap.initialize(server) l.simple_bind(username, ldapsrvpassword) def employeeadd(): ldif = modlist.addModlist(attrs) l.add_s(dn,ldif) Will be very appreciate for any help -- With Best Wishes Andrei Valoshyn Exadel Inc. System Administrator avaloshyn(a)exadel.com -- CONFIDENTIALITY NOTICE: This email and files attached to it are confidential. If you are not the intended recipient you are hereby notified that using, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error please notify the sender and delete this email.

2 1

sasl-auxprop (and sasl/slapd.conf)
by Simone Piccardi 18 Nov '15

18 Nov '15

I'm trying to understand which values I can use for the sasl-auxprop directives and how to configure (if possible) sasl/slapd.conf. I was trying to use the users created with slappasswd2 -c (as written in the Administration guide) but no sasldb file was open by the server (I straced out a full session). I tried to put an explicit configuration in sasl/slapd.conf, and stracing the server I saw it was open and read, but the configuration inside is just ignored. Reading the manpage I found it says that sasl-auxprops "Specify which auxprop plugins to use for authentication lookups." and that the default is use the slapd internal support. But I did not define this one, and sasl/slapd.conf still seems to be ignored. And no possible values for the available plugins to use as sasl-auxprops parameter are listed. I could get DIGEST-MD5 authentication working putting the password inside the server (userPassword in CLEARTEXT), so it seems that the default is used anyway. But I'd like to have it working using using sasldb or configuring sasl/slapd.conf to use saslauthd. Regards Simone -- Simone Piccardi Truelite Srl piccardi(a)truelite.it (email/jabber) Via Monferrato, 6 Tel. +39-347-1032433 50142 Firenze http://www.truelite.it Tel. +39-055-7879597 Fax. +39-055-7333336

2 2

OpenLDAP installation. Am I missing something?
by Sherman Lilly 18 Nov '15

18 Nov '15

I may have this totally wrong but why is there no installation documentation that tells somebody how to setup OpenLDAP the right way. After installing OpenLDAP you have no slapd.conf file so that direction is not happening. If you modify any file in the slapd.d directory, startup will complain about bad checksum. Yes I know you can regenerate the checksum and fix that but why? I can't find any where that tells you how to modify the base dn, rootdn, and root password without editing the files in the slapd.d manually. Am I missing something? I have check Google, Youtube, and other places and they all say manually edit files in slapd.d. That can't be the right way if openldap server is complaining about doing it. Sherman Lilly

4 6

Searches with dereferncing causing high CPU load.
by Mark Cairney 18 Nov '15

18 Nov '15

Hi, We're having severe performance issues for any query with alias dereferencing set to "always". Any query with this causes the CPU to spin up to 100% and if we have a number of these concurrently the machine will become unresponsive. We're using OpenLDAP 2.4.42 with the old hdb backend. We do have a large number of aliases (~63,000). Could this be the cause? Our olcMaxDerefDepth is currently set to "1" -- /**************************** Mark Cairney ITI UNIX Section Information Services University of Edinburgh Tel: 0131 650 6565 Email: Mark.Cairney(a)ed.ac.uk PGP: 0x435A9621 *******************************/ The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336.

4 9

Integrate Openldap and Windows Active Directory Server
by Kaushal Shriyan 17 Nov '15

17 Nov '15

Hi, Is there a way to integrate Openldap ldap server with Windows Server Active Directory wherein AD will act as Authentication and Openldap will be setup for Authorization? Any help will be highly appreciable. Regards, Kaushal

4 4

Keeping mdb files opened while mmapped
by Shlomi Vaknin 17 Nov '15

17 Nov '15

Hey, I am using lmdb as a backend to a big database (and its awesome, thanks!). While trying to understand memory consumption of my process I came across something interesting I'd like to get an expert's opinion about. I am seeing that the "Virtual" memory is quite large, larger than I expected, and it *might* be a problem in my case, I am being hit with lots of page ins/outs (I have a 500GB RAM machines). When I lsof my process, I am seeing that each mdb file is appearing twice (I use many), eg: _ lsof -p 59709 | grep 86510580 test 59709 vaknin mem REG 8,17 625500160 86510580 /fs/test1.mdb test 59709 vaknin 239r REG 8,17 625500160 86510580 /fs/test1.mdb I know that after mmaping a file, it is not needed to be kept open, and it seems it is in lmdb. I then tried to see if this actually uses memory, and I used memstat for this: _ memstat -p 59709 -w | grep 86510580 1221680k(1221680k): [08:11]:86510580 59709 >From this it seems that the file is indeed using twice as much (virtual) memory as it should.. 2*625500160 ≈ 1221680000 (this test was repeated for many different files, all have a factor of ≈2) I know this might simply be an artifact and might not actually be a contributing reason for my swap ins/outs, but I wanted to hear what do you think about it? Why does lmdb keep the file handles open? By the way the swap ins/outs are happening later in the process, after querying lmdb and processing its results. Thanks!

2 1

LMDB file size, again
by Christian Sell 16 Nov '15

16 Nov '15

Hello, following up to my previous question regarding file size, I would like to ask about the recommended approach: 1. set a low file size initially, watch for MDB_MAP_FULL return codes and increase the file/map size stepwise as needed 2. choose a large file size and reduce the size by doing a mdb_copy when the application shuts down or maybe a combination of the two? How does SQLightning handle this (2. doesn't sound practical)? thanks, Christian

4 11

looking for example config olc for totp module.
by René van Dorst 15 Nov '15

15 Nov '15

Hi, I am looking a olc config example for totp module. I like to try TOTP module. But I don't get it to work. Because I am not sure how to load it and set it up. Also I don't no what to except once it loaded. I using Ubuntu Wily 64-bit server which used on-line configuration (OLC). Compiled it from git. Used tag OPENLDAP_REL_ENG_2_4_42 and cherry-pick the totp directory from HEAD. ./configure --prefix=/usr/local/openldap --enable-overlays=yes --enable-ldap --enable-spasswd --enable-modules Also compiled the totp module in the directory self and installed. ls -al /usr/local/libexec/openldap -rw-r--r-- 1 root root 93234 Nov 13 22:51 pw-sha2.a -rw-r--r-- 1 root root 928 Nov 13 22:51 pw-sha2.la lrwxrwxrwx 1 root root 16 Nov 13 22:51 pw-sha2.so -> pw-sha2.so.0.0.0 lrwxrwxrwx 1 root root 16 Nov 13 22:51 pw-sha2.so.0 -> pw-sha2.so.0.0.0 -rwxr-xr-x 1 root root 72512 Nov 13 22:51 pw-sha2.so.0.0.0 -rw-r--r-- 1 root root 102352 Nov 13 22:50 pw-totp.a -rw-r--r-- 1 root root 928 Nov 13 22:50 pw-totp.la lrwxrwxrwx 1 root root 16 Nov 13 22:50 pw-totp.so -> pw-totp.so.0.0.0 lrwxrwxrwx 1 root root 16 Nov 13 22:50 pw-totp.so.0 -> pw-totp.so.0.0.0 -rwxr-xr-x 1 root root 69696 Nov 13 22:50 pw-totp.so.0.0.0 I modfied the config file /etc/ldap/slapd.d/cn\=config/cn\=module\{0\}.ldif. Which look like this. dn: cn=module{0} objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib/ldap olcModuleLoad: {0}back_hdb structuralObjectClass: olcModuleList entryUUID: 628d5926-2244-1034-90e2-d7e1d71167a8 creatorsName: cn=config createTimestamp: 20141227184617Z entryCSN: 20141227184617.050515Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20141227184617Z dn: cn=module objectClass: olcModuleList cn: module olcModulePath: /usr/local/libexec/openldap olcModuleLoad: pw-totp dn: olcOverlay=totp,olcDatabase=hdb,cn=config olcOverlay: totp I can run it with /usr/local/openldap/libexec/slapd -u openldap -g openldap -F /etc/ldap/slapd.d -d config. Again I don't know what to expect if the modules is load. Who can help me futher. Greats, René van Dorst.

3 2

Syncrepl Error : critical extension is not recognized
by David Gabriel 13 Nov '15

13 Nov '15

Dears, I am new in OpenLDAP world ! I want to use syncrepl in order to synchronize my consumer which is a Python application. I configured the server side based on this tutorial <http://www.openldap.org/doc/admin24/replication.html>, I restart my server but I get the following error when I run my python application <https://github.com/rbarrois/python-ldap/blob/master/Demo/pyasn1/syncrepl.py> : 'info': 'critical extension is not recognized', 'desc': 'Critical extension is unavailable' NB: I didn't consider the "Set up the consumer slapd" section because I am relying on the python consumer application <https://github.com/rbarrois/python-ldap/blob/master/Demo/pyasn1/syncrepl.py> . Please tell me what shall I do ? Any help from your side is welcome ? Thanks in advance. Regards

1 0

startup failed
by BÖSCH Christian 11 Nov '15

11 Nov '15

Hi, I set up an openldap server with all desired configs (cn=config, mmr, etc etc) as node 1. Then I start it up, which is quite slow (I think it waits on node 2 which is not available yet). Then I add an empty base tree: dn: dc=example,dc=net objectClass: dcObject objectClass: organization o: ORG1 o: ORG2 dc: example dn: cn=admin,dc=example,dc=net objectClass: organizationalRole cn: LDAP Admin cn: admin dn: o=org1,dc=example,dc=net o: ORG1 objectClass: organization objectClass: top dn: o=org2,dc=example,dc=net o: ORG2 objectClass: organization objectClass: top After that restarting slapd always fails. That’s in debug log: Nov 11 08:35:00 openldap1 slapd[27812]: slapd startup: initiated. Nov 11 08:35:00 openldap1 slapd[27812]: backend_startup_one: starting "cn=config" Nov 11 08:35:00 openldap1 slapd[27812]: config_back_db_open Nov 11 08:35:00 openldap1 slapd[27812]: backend_startup_one: starting "dc=example,dc=net" Nov 11 08:35:00 openldap1 slapd[27812]: mdb_db_open: database "dc=example,dc=net": dbenv_open(/var/db/openldap-data). Nov 11 08:35:00 openldap1 slapd[27812]: => mdb_search Nov 11 08:35:00 openldap1 slapd[27812]: mdb_dn2entry("dc=example,dc=net") Nov 11 08:35:00 openldap1 slapd[27812]: => mdb_dn2id("dc=example,dc=net") Nov 11 08:35:00 openldap1 slapd[27812]: <= mdb_dn2id: got id=0x1 Nov 11 08:35:00 openldap1 slapd[27812]: => mdb_entry_decode: Nov 11 08:35:00 openldap1 slapd[27812]: <= mdb_entry_decode Nov 11 08:35:00 openldap1 slapd[27812]: search_candidates: base="dc=example,dc=net" (0x00000001) scope=2 Nov 11 08:35:00 openldap1 slapd[27812]: => mdb_equality_candidates (objectClass) Nov 11 08:35:00 openldap1 slapd[27812]: => key_read Nov 11 08:35:00 openldap1 slapd[27812]: <= mdb_index_read: failed (-30798) Nov 11 08:35:00 openldap1 slapd[27812]: <= mdb_equality_candidates: id=0, first=0, last=0 Nov 11 08:35:00 openldap1 slapd[27812]: => mdb_equality_candidates (objectClass) Nov 11 08:35:00 openldap1 slapd[27812]: => key_read Nov 11 08:35:00 openldap1 slapd[27812]: <= mdb_index_read: failed (-30798) Nov 11 08:35:00 openldap1 slapd[27812]: <= mdb_equality_candidates: id=0, first=0, last=0 Nov 11 08:35:00 openldap1 slapd[27812]: mdb_search_candidates: id=0 first=0 last=0 Nov 11 08:35:00 openldap1 slapd[27812]: mdb_search: no candidates Nov 11 08:35:00 openldap1 slapd[27812]: send_ldap_result: conn=-1 op=0 p=0 Does anybody see the problem? King regards, Chris

3 4

Re: RE24 testing call #3 (2.4.43) LMDB RE0.9 testing call #3 (0.9.17)
by Howard Chu 11 Nov '15

11 Nov '15

Volker Lendecke wrote: > On Wed, Nov 11, 2015 at 09:49:49AM +0000, Howard Chu wrote: >> Volker Lendecke wrote: >>> On Wed, Nov 11, 2015 at 12:09:51AM +0000, Howard Chu wrote: >>>> Unfortunately, PTHREAD_MUTEX_ROBUST_NP is an enum, not a macro, so >>>> #ifdef won't work to detect it. >>>> >>>> The attached patch should work. Please report back; I won't merge it >>>> unless we know it actually helps. >>> >>> Not sure you're aware, but there's RHEL5 (and thus Centos5 I >>> believe) versions where glibc announces robust mutexes but >>> the kernel is buggy: They are just not robust. tdb has a >>> runtime check for this. Are you interested? >> >> Sure, post a link to more info. >> >> I found this since you mentioned it. >> >> https://bugzilla.redhat.com/show_bug.cgi?id=628608 >> >> But it only affects a mutex that was locked in a process that >> subsequently forks a child. The LMDB docs already say explicitly >> that a process must not fork with an open LMDB environment so this >> particular issue doesn't affect us. > > Nope, this was properly ordered. Fork, then lock, then > exit, and the subsequent locker did not get EOWNERDEAD. Not > sure about the exact behavior anymore though. > > https://git.samba.org/?p=samba.git;a=blob;f=lib/tdb/common/mutex.c;h=fae43d… > > has the tdb_runtime_check_for_robust_mutexes that verifies > we're in a sane environment. Thanks. I still see your test doing a fork after init'ing the mutex. That's the condition that triggered the above bug - not the timing of the actual mutex_lock. This was fixed in June 2011, glibc 2.15. And as before, it doesn't affect LMDB. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: RE24 testing call #3 (2.4.43) LMDB RE0.9 testing call #3 (0.9.17)
by Howard Chu 11 Nov '15

11 Nov '15

Volker Lendecke wrote: > On Wed, Nov 11, 2015 at 12:09:51AM +0000, Howard Chu wrote: >> Unfortunately, PTHREAD_MUTEX_ROBUST_NP is an enum, not a macro, so >> #ifdef won't work to detect it. >> >> The attached patch should work. Please report back; I won't merge it >> unless we know it actually helps. > > Not sure you're aware, but there's RHEL5 (and thus Centos5 I > believe) versions where glibc announces robust mutexes but > the kernel is buggy: They are just not robust. tdb has a > runtime check for this. Are you interested? Sure, post a link to more info. I found this since you mentioned it. https://bugzilla.redhat.com/show_bug.cgi?id=628608 But it only affects a mutex that was locked in a process that subsequently forks a child. The LMDB docs already say explicitly that a process must not fork with an open LMDB environment so this particular issue doesn't affect us. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

LMDB physical file size
by Christian Sell 10 Nov '15

10 Nov '15

Hello, we are using LMDB as the underlying storage engine for a lightweight + high performance special-purpose object + mass data database. I have 2 questions about the size of the physical file used by LMDB: To create the environment, we are using a mapsize of 1 GiB and the flags MDB_NOSUBDIR | MDB_NOLOCK. Under Linux, this results in one file with a size that seems to correspond to the size of the data actually stored. However, under Windows, the file size is the same as the mapsize, namely 1 GiB. We are currently using env_copy2 and MDB_COMPACT to push this down every time the env is closed, but I fear that this will become very slow with large databases. The same issue surfaced under Linux when we were recently experimenting with the MDB_WRITEMAP option to improve performance when dealing with very large data sets. This option caused also the Linux file size to go up to 1 GiB, even though the actual data was < 50 K. We'd like to hear if there are ways to improve this. thanks, Christian

5 5

PPolicy, syncrepl
by RDSYS 10 Nov '15

10 Nov '15

Hello, I am new to this list and more or less to OpenLdap also. We use OpenLdap $OpenLDAP: slapd (Sep 11 2015 15:11:55) $#012#011buildd@babin:/build/openldap-nFTO9j/openldap-2.4.40+dfsg/debian/build/servers/slapd on the master running DEBIAN "jessie" and $OpenLDAP: slapd (Sep 11 2015 15:18:38) $#012#011buildd@binet:/build/openldap-kFav7u/openldap-2.4.31/debian/build/servers/slapd on the consumer running DEBIAN "wheezy" I had a working Master-Slave sync up to the moment when I configured PPolicy on master and slave. From that time on the sync to the consumer did not work any more. The log on the consumer say: syncrepl_message_to_op: rid=001 mods check (pwdChangedTime: multiple values provided) do_syncrepl: rid=001 rc 19 retrying The log on the master state: send_search_entry: conn 1654 ber write failed. What can be the reason? Any help would be appreciated. Thanks Reiner

2 1

Controlling rootdn access
by Michael Hierweck 10 Nov '15

10 Nov '15

Hi all, I'm trying to improve security by restricting rootdn access to localhost. See: http://www.openldap.org/doc/admin24/access-control.html#Controlling%20rootd… But I can't delete the olcRootPW attribute from the olcDatabase object: ldap_modify: Inappropriate matching (18) additional info: modify/delete: olcRootPW: no equality matching rule I suppose the access restriction to the rootdn's userPassword attribute does not take effect as the provided password will be compared against the olcRootPW attribute (directly). Thanks in advance Michael

4 7

modify ldap conn=-1
by Daniel Jung 10 Nov '15

10 Nov '15

Hi, Typically conn represents external connection number? Sometimes i see conn=-1. Does this mean this is local or sycnrepl connection modification? thanks

2 1

Synchronization/replication and testing with ldapsearch
by Rebecka Gulliksson 10 Nov '15

10 Nov '15

Hi! I’m trying to setup an instance of slapd that supports RFC4533 (Content Synchronization Operation) for use with a consumer that is *not* another slapd instance. So right now I want to test my slapd instance with ‘ldapsearch' instead of in an master-slave setup. I’m on Mac OS X with the following in my slapd.conf: overlay syncprov syncprov-checkpoint 100 1 syncprov-sessionlog 100 Then I use ldapsearch ldapsearch -x -h localhost -Esync=ro but I get no syncCookie. Essentially I want to achieve what has been asked (but not answered) here: http://www.openldap.org/lists/openldap-software/200907/msg00045.html. Is there anything else I need to add to slapd.conf or is my ldapsearch command missing something? Any pointers to documentation of how to set it up? Regards, --- Rebecka Gulliksson ICT Services and System Development (ITS) Umeå University SE-901 87 Umeå, Sweden rebecka.gulliksson(a)umu.se www.its.umu.se

2 2

OTP broken?
by Emmanuel Dreyfus 09 Nov '15

09 Nov '15

Hello It seems OTP was broken at some time, I wonder if it is just me (and why), or if it is more genral. I have a user with: cmusaslsecretOTP: sha1 0499 se2124 xxxxxxxxxxxxxxxx 00000000 slapd.conf contains: access to dn.regex="^uid=.+,dc=example,dc=net$" attrs=cmusaslsecretOTP by anonymous auth stop by self write stop by * none stop I try: $ ldapwhomai -Y OTP -X dn:${user_dn} SASL/OTP authentication started (delay) ldap_sasl_interactive_bind_s: Server is unavailable (52) additional info: SASL(-8): transient failure (e.g., weak key): simultaneous OTP authentications not permitted This is: OpenLDAP 2.4.42 Cyrusl SASL 2.1.26 While there, this uses sha1. Is there some new specs about doing it with sha256? Patching cyrus-sasl to add a new hashing algorithme is just a one liner. -- Emmanuel Dreyfus manu(a)netbsd.org

7 15

OpenLDAP & SSSD Question
by Borresen, John - 0444 - MITLL 08 Nov '15

08 Nov '15

Hopefully someone out there can shed some light on this. Running OpenLDAP 2.4.40 on our CentOS 5 servers, with an assortment of CentOS 5, 6, 7; Fedora20+, Ubuntu 12.04 to 14.04. The CentOS 5's are running as straight LDAP clients. The others are using SSSD / LDAP. On the CentOS 5, when running "getent hosts", it will return the entire LDAP Hosts dbase; which is the behavior we want. On all the systems running SSSD, they only return the local hosts file. If explicitly adding a host to the command "getent hosts some_host", it will only return if the host is in the local hosts file or DNS; never searching (watching the logs) either the LDAP or SSSD. Debug is at maximum. Again any help is appreciated. Thanks, JD Borresen

3 4

val/integerMatch="0"
by Michael Ströder 08 Nov '15

08 Nov '15

HI! Maybe I'm doing something obviously wrong but I don't see it. I want to limit the right to reset a counter value solely to zero with this ACL directive: add_content_acl yes [..] access to dn.subtree="ou=ae-dir" filter="(aeStatus=0)" attrs=oathHOTPCounter val/integerMatch="0" by group/aeGroup/member="cn=2fa admins,cn=2fa,ou=ae-dir" write by * break [..] The modify request looks like this (old value is 10): dn: serialNumber=yubikey-23,cn=2fa,ou=ae-dir changetype: modify replace: oathHOTPCounter oathHOTPCounter: 0 - It seems the ACL does not trigger, without the val= part the modification is allowed (but to any value). I also tried other forms: val="0" val=0 val.regex="^0$" Can somebody help me? Thanks in advance. Ciao, Michael.

2 3

ldiftopasswd: Can it be done with SSHA hashes?
by Chuck Peters 06 Nov '15

06 Nov '15

Can I convert the ldif's userPassword:: "salted hash, aka SSHA" to "hash type$salt$hash" format of shadow passwords? Or do I need to force those users with SSHA hashed passwords to change their password? Most of the users passwords are in crypt format. I found a perl one liner to base64 decode those passwords hashes. (1) I'm attempting to create shadow passwd files with an old Debian 6.0.10 (squeeze) LDAP installation and Debian's slapd package (2.4.23-7.3+deb6u2 squeeze-lts patched oldoldstable) includes a perl script ldiftopasswd, which I thought came from upstream, but it's not included in the most recent source of openldap. If my reading of the perl is correct, it was meant for earlier iterations of shadow passwords that did not include hash format or salt. I'm not having any success using the script this far. 1. http://www.perlmonks.org/bare/?node_id=963814 alias ldapdecode="perl -MMIME::Base64 -n -00 -e 's/\n //g;s/(?<=:: )(\S+)/decode_base64(\$1)/eg;print'" and just do ldapsearch | ldapdecode Thanks, Chuck

4 4

accesslog purge starves kerberos kdc authentications
by Paul B. Henson 05 Nov '15

05 Nov '15

We're running MIT kerberos with the ldap backend, specifically 3 openldap servers doing delta syncrepl. We started having a problem a while back where once a day the kdc would time out authentication requests, and finally tracked it down to openldap purging the accesslog. We currently have the accesslog overlay configured to delete entries over 7 days old once a day, and it seems that while openldap is processing the purge the kdc is starved out and unable to process authentications in a timely fashion. We do (thanks to our ISO) have account lockout enabled, so every authentication involves not only a read but a write. Is it expected for the accesslog purge to be so disruptive? Is there any way to tune it so it doesn't overwhelm the system to the point of being unresponsive? Would it be better to purge the accesslog more frequently as to amortize the work across multiple intervals rather than being concentrated once a day? Thanks for any suggestions...

5 10

*** Error in `/usr/sbin/slapd': double free or corruption (top): 0x00007f2f9503a610 ***
by Andrei Valoshyn 04 Nov '15

04 Nov '15

Hello! I have ubuntu 14.04 and openldap-2.4.31 server which I had installed via apt-get. I tried configure it via slapd.conf configuration file. After all configurations steps and success config test I faced with: / root@v122:~# /etc/init.d/slapd start// // * Starting OpenLDAP slapd // // *** Error in `/usr/sbin/slapd': double free or corruption (top): 0x00007f2f9503a610 ***// //Aborted (core dumped)/ I can't find any reported bug about this issue. Please help! -- With Best Wishes Andrei Valoshyn Exadel Inc. System Administrator avaloshyn(a)exadel.com -- CONFIDENTIALITY NOTICE: This email and files attached to it are confidential. If you are not the intended recipient you are hereby notified that using, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error please notify the sender and delete this email.

3 2

library
by Friedrich Locke 04 Nov '15

04 Nov '15

Hi folks, i would like to write a library that implements ldap client connection to the server, as usual, the default routines: connect bind search unbind etc ... I wonder if there is a documentation showing how data is encoded with asn.1 ber encoding. Thanks a lot.

3 2

Question from a LMDB user
by Tao Chen 04 Nov '15

04 Nov '15

Hi Sir/Madam, Recently I'm trying to use LMDB to store and randomly acess large amount of features. Each feature blob is 16kB. Before trying LMDB, I just stack all the features together into one huge binay file, and use seek function in C++ to access each feature. Since the feature size is fixed, I can easily compute the address of each feature in the file. Then I tried LMDB. The value is the feature as it is. The key is "1", "2", "3", .... Since 16kB is exactly 4 x page_size, adding the key and header, each feature will occupy 5 x page_size, so the db file on disk is about 1.25 times of the previous binary file, this is already a disadvantage for LMDB, but I still hope there can be some efficiency trade-off. I use LDMB++ C++ wrapper to access features. Next, I compared two approach by accessing the same random 1% features from about 300k features. Before the test, I use vmtouch to evict both files from memory cache. The result is surprising. The one use LMDB is 1.5 times slower than the raw binary file (30s vs 20s). Is this because the size of feature (exactly 4 pages)? Do I understand the use of LMDB incorrectly? Thank your for your time! Best Regards, Tao Chen

2 1

Developing modules
by dev 04 Nov '15

04 Nov '15

Hi, I'd like to take a stab at porting the radius contrib module to FreeRadius. Can someone point me in the direction of documentation for the openldap module format? I see there is init_module() and term_module() defined in the source for the modules I've looked at but the rest is guesswork. I've poked around Google a bit but only so far ran across a post in 2011 asking the same question. Thanks

2 1

ldapsearch over SSL can not bind
by Matthias Apitz 02 Nov '15

02 Nov '15

Hello, I'm trying to make from FreeBSD a LDAPsearch in some Novell eDirectory with the following command: $ ldapsearch -Z -H ldaps://romega:1027 -b 'ou=person,o=uni' -D 'cn=XXXXXXXXXX,ou=service,o=uni' -w XXXXXXXXXX ldap_start_tls: Can't contact LDAP server (-1) additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (self signed certificate in certificate chain) ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) The credentials are fine and are working without any problem, for example from Windos clients (JXplore) or from a Java written client running on my laptop. Openssl can connect fine too. Any ideas what could be wrong? Btw: Someone here who managed to work JXplore in FreeBSD? There is an installer for it which can not find libstdc++.so.4 on my system (I have libstdc++.so.6). Vy 73 matthias -- Matthias Apitz, ✉ guru(a)unixarea.de, 🌐 http://www.unixarea.de/ ☎ +49-176-38902045

4 3

retrieving information about deleted objects
by Matthias Apitz 02 Nov '15

02 Nov '15

Hello, We produce for production environments an IDMsystem which is able to publish/dublicate changes in OpenLDAP/LDAP directories to other management databases and vice versa. This works fine in most of the cases of changes in LDAP. The only problem we see, is get information about deletion of objects (users) which were done while the IDMsystem was either down or network not available. What is the correct way to search for deleted objects. We have read about a filter search, based on 'isDeleted=*' or 'isDeleted=TRUE. But we can not get any result with this. Thanks for some hints about this. matthias -- Matthias Apitz, ✉ guru(a)unixarea.de, 🌐 http://www.unixarea.de/ ☎ +49-176-38902045

4 3

Consumer not Sync'ing
by Kartik Vashishta 02 Nov '15

02 Nov '15

Team, Consumer is connecting to master but not sync'ing. I am a newbie so any ideas will be appreciated. "test3" is the consumer "elasticsearch1" is the master [root@test3 tmp]# netstat -anlp | grep 389 tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 6745/slapd tcp 0 0 192.168.1.51:53121 192.168.1.196:389 TIME_WAIT - tcp 0 0 192.168.1.51:53120 192.168.1.196:389 TIME_WAIT - tcp 0 0 192.168.1.51:53113 192.168.1.196:389 TIME_WAIT - tcp 0 0 192.168.1.51:53118 192.168.1.196:389 TIME_WAIT - tcp 0 0 192.168.1.51:53119 192.168.1.196:389 TIME_WAIT - tcp 0 0 192.168.1.51:53122 192.168.1.196:389 TIME_WAIT - tcp 0 0 192.168.1.51:53124 192.168.1.196:389 TIME_WAIT - tcp 0 0 192.168.1.51:53123 192.168.1.196:389 TIME_WAIT - tcp6 0 0 :::389 :::* LISTEN 6745/slapd [root@test3 tmp]# I am following this document: http://www.server-world.info/en/note?os=CentOS_7&p=openldap&f=5 Regards, Kartik Vashishta

2 1

"memberof" function for memberUid attribute.
by Andi Zulfadli 01 Nov '15

01 Nov '15

Dear Master. Please help, What is the format for filter the member of group? we know that "memberof" format works in member attribute in openldap group entry format. example attribute : dn: cn=Admins,ou=Users,o=<org-id>,dc=jumpcloud,dc=com *member: uid=john,ou=Users,o=<org-id>,dc=jumpcloud,dc=commember: uid=mary,ou=Users,o=<org-id>,dc=jumpcloud,dc=com*objectClass: top objectClass: groupOfNames description: tagGroup cn: Admins ou: Admins example filter : example: (&(objectClass=person)(memberOf=CN=name-of-the-group,OU=xample,DC=com)) But how about if my openldap group member attribute using memberUid as attibute member's group. dn: cn=Admins,ou=Users,o=<org-id>,dc=jumpcloud,dc=com *memberUid: johnmemberUid: mary*objectClass: top objectClass: groupOfNames description: tagGroup cn: Admins ou: Admins How can i use "memberof" filter format in my openLDAP? Thank you very much. iam sorry for my ambiguity.

2 4

When is it ok to call MDB_NEXT_MULTIPLE?
by Bryan Matsuo 01 Nov '15

01 Nov '15

The docs imply that the MDB_NEXT_MULTIPLE cursor operation may only be used following MDB_GET_MULTIPLE (or another MDB_NEXT_MULTIPLE). Is that the case? In my experience MDB_NEXT_MULTIPLE has behaved the same as MDB_GET_MULTIPLE following MDB_NEXT_NODUP. That was a desirable thing in my case. I am wondering if that behavior can be depended on. The documentation for MDB_NEXT_MULTIPLE is probably technically correct. But it is vague. I don't understand what "preparing the cursor" entails.

1 0

Binding mdb_set_compare with Go
by Bryan Matsuo 01 Nov '15

01 Nov '15

openldap-technical, I am working on some Go (golang) bindings[1] for the LMDB library and I have some interest in exposing the functionality of mdb_set_compare (and mdb_set_dupsort). But it is proving difficult and I have a question about the function(s). Calling mdb_set_compare from the Go runtime is challenging. Using C APIs with callbacks comes with restrictions[2][3]. I believe it impossible to bind these functions way that is flexible, as one would expect. A potential change to LMDB that would make binding drastically easier is having MDB_cmp_func to take a third "context" argument with type void*. Then a binding could safely use an arbitrary Go function for comparisons. Is it possible for future versions of LMDB to add a third argument to the MDB_cmp_func signature? Otherwise would it be acceptable for a variant API to be added using a different function type, one accepting three arguments? Thanks for the consideration. Cheers, - Bryan [1] Go bindings -- https://github.com/bmatsuo/lmdb-go [2] Cgo pointer restrictions -- https://github.com/golang/proposal/blob/master/design/12416-cgo-pointers.md [3] Cgo documentation -- https://golang.org/cmd/cgo/

4 10

Re: Unable to build LMDB on SUSE Linux: undefined reference to pthread_mutexattr_setrobust / pthread_mutex_consistent
by Howard Chu 31 Oct '15

31 Oct '15

> Hello, > > I am trying to build LMDB libraries from source on SUSE Linux using gcc 4.7.2 to try for an experimental project at work. I am getting some build errors. I see pthread.h and libpthread.{a/so} installed in /usr/include and /usr/lib64, respectively. But I do not see these functions in the header file or in the library. Maybe the pthread library version is old. I am not sure. I tried searching on the web, but I was not able to understand how to install a different version of the pthread library (it seems to come packaged with the OS?). I do not have admin rights so I would try installing in my local area. > > Can someone please advise on things I can try to resolve this issue? Thank you for your time and help. You're not using a released branch of LMDB code. When you use a development branch you're expected to actually know how your development environment works. > (P.S. I had built LMDB successfully on a Mac OS X machine (home computer) without any issues) > > $ make > gcc -pthread -O2 -g -W -Wall -Wno-unused-parameter -Wbad-function-cast -Wuninitialized -c mdb.c > mdb.c: In function ‘mdb_mutex_failed’: > mdb.c:9827:4: warning: implicit declaration of function ‘pthread_mutex_consistent’ [-Wimplicit-function-declaration] > gcc -pthread -O2 -g -W -Wall -Wno-unused-parameter -Wbad-function-cast -Wuninitialized -c midl.c > ar rs liblmdb.a mdb.o midl.o > ar: creating liblmdb.a > gcc -pthread -O2 -g -W -Wall -Wno-unused-parameter -Wbad-function-cast -Wuninitialized -fPIC -c mdb.c -o mdb.lo > mdb.c: In function ‘mdb_mutex_failed’: > mdb.c:9827:4: warning: implicit declaration of function ‘pthread_mutex_consistent’ [-Wimplicit-function-declaration] > gcc -pthread -O2 -g -W -Wall -Wno-unused-parameter -Wbad-function-cast -Wuninitialized -fPIC -c midl.c -o midl.lo > gcc -pthread -shared -o liblmdb.so mdb.lo midl.lo > gcc -pthread -O2 -g -W -Wall -Wno-unused-parameter -Wbad-function-cast -Wuninitialized -c mdb_stat.c > gcc -pthread -O2 -g -W -Wall -Wno-unused-parameter -Wbad-function-cast -Wuninitialized mdb_stat.o liblmdb.a -o mdb_stat > liblmdb.a(mdb.o): In function `mdb_env_setup_locks': > /nfs/pdx/proj/dt/tctg03/pgupta6/lmdb-mdb.master/libraries/liblmdb/mdb.c:4642: undefined reference to `pthread_mutexattr_setrobust' > liblmdb.a(mdb.o): In function `mdb_mutex_failed': > /nfs/pdx/proj/dt/tctg03/pgupta6/lmdb-mdb.master/libraries/liblmdb/mdb.c:9827: undefined reference to `pthread_mutex_consistent' > collect2: error: ld returned 1 exit status > make: *** [mdb_stat] Error 1 > > My environment is as follows: > > $ more /etc/SuSE-release > SUSE Linux Enterprise Server 11 (x86_64) > VERSION = 11 > PATCHLEVEL = 2 > > $ uname -a > Linux 3.0.101-0.7.29.1.8482.4.PTF-default #1 SMP Tue May 5 16:00:34 UTC 2015 () x86_64 x86_64 x86_64 GNU/Linux SUSE Linux Enterprise Server 11 definitely supports robust mutexes, since they actually list bug fixes for that feature. https://www.suse.com/support/update/announcement/2013/suse-su-20131852-1.ht… But it's possible that the function definitions are hidden or renamed. Look for them in /usr/include/pthread.h and then supply the appropriate preprocessor flags to expose their definitions. You may need to adjust the LMDB code to use pthread_mutexattr_setrobust_np and pthread_mutex_consistent_np. If you don't know how to do this, stick with the actual release branch. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Ch

1 0

Attribute syntax and search filters
by Michael 31 Oct '15

31 Oct '15

I originally had a request from developers to allow substr searches on the "drawId" integer attribute you see below. As you know, substr searches on integers are not supported so I changed the schema and modified the attribute type to a numeric string. This worked as expected but now they are coming back to me asking why negative numbers are not being matched in their search filters. After some reading I understand the numeric string syntax is used to hold strings comprised of one or more ASCII numeric digits digits and/or space characters. The hyphen is not allowed, so it is not possible to represent negative values. Is there any alternative here? Original schema entry attributetype ( 3.0.0.3 NAME 'drawId' DESC 'ID of the retailer a user is assigned to' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) Current schema entry. attributetype ( 3.0.0.3 NAME 'drawId' DESC 'ID of the retailer a user is assigned to' EQUALITY numericStringMatch SUBSTR numericStringSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.36 SINGLE-VALUE )

2 2

Migrate from openldap 2.2 to 2.4 issue
by DEVARIEUX Alain 30 Oct '15

30 Oct '15

Hi! First excuse me for my approximative english. I'm trying to migrate from an old Redhat server running openldap 2.2 to a brand new one using Centos 7 and openldap 2.4. Using slapcat / sldapadd I can't have my new server running with an olc config. I'd like to know what I'm doing wrong during this process : # To remove entryUUID lines because they're not usable with openldap 2.4 sed -i -e "/entryUUID/d" /root/myslapcat.ldif # Running slapadd with a 'cleaned' version of my old slapd.conf slapadd -f /tpm/oldserver/slapd.conf -F /etc/openldap/slapd.d/ -c -u -o schema-check=yes -l /root/myslapcat.ldif # moving from file configuration to olc : slaptest -f /tmp/oldserver/slapdb.conf -F /etc/openldap/slapd.d/ # now, I can start the service without problem : systemctl start slapd But, when I try to access the diectory, here is the error messages I have : Oct 29 16:02:57 ldap01-qualif slapd[12351]: conn=1002 fd=11 ACCEPT from IP=10.35.100.87:49238 (IP=0.0.0.0:389) Oct 29 16:02:57 ldap01-qualif slapd[12351]: conn=1002 op=0 BIND dn="cn=Manager,dc=mydomain,dc=fr" method=128 Oct 29 16:02:57 ldap01-qualif slapd[12351]: conn=1002 op=0 BIND dn="cn=Manager,dc=mydomain,dc=fr" mech=SIMPLE ssf=0 Oct 29 16:02:57 ldap01-qualif slapd[12351]: conn=1002 op=0 RESULT tag=97 err=0 text= Oct 29 16:02:57 ldap01-qualif slapd[12351]: conn=1002 op=1 SRCH base="dc=mydomain,dc=fr" scope=1 deref=0 filter="(objectClass=*)" Oct 29 16:02:57 ldap01-qualif slapd[12351]: conn=1002 op=1 SRCH attr=objectclass Oct 29 16:02:57 ldap01-qualif slapd[12351]: bdb(dc=mydomain,dc=fr): BDB0060 PANIC: fatal region error detected; run recovery Oct 29 16:02:57 ldap01-qualif slapd[12351]: bdb(dc=mydomain,dc=fr): BDB0060 PANIC: fatal region error detected; run recovery Oct 29 16:02:57 ldap01-qualif slapd[12351]: bdb(dc=mydomain,dc=fr): BDB0060 PANIC: fatal region error detected; run recovery Oct 29 16:02:57 ldap01-qualif slapd[12351]: bdb(dc=mydomain,dc=fr): BDB0060 PANIC: fatal region error detected; run recovery Oct 29 16:02:57 ldap01-qualif slapd[12351]: conn=1002 op=1 SEARCH RESULT tag=101 err=80 nentries=0 text=internal error But, if a launch slapd like telling it the configuration file to use, everything works well (ie : I can bind to server and view all entries) slapd -u ldap -f /tmp/oldserver/slapd.conf Am I missing something obvious? I'm new to openldap... Regards, -- Alain Devarieux Pôle Infrastructures GIP SIB

3 3

Re: [LMDB] What pointer is returned with combination of MDB_WRITEMAP and MDB_RESERVE?
by Victor Baybekov 30 Oct '15

30 Oct '15

Thanks a lot! My proof-of-concept code works OK. I do not understand all subtle details of mmap reliability, could you please help with these two: If I write data to a pointer to an opaque blob as discussed above, and my process crashes before mdb_env_sync, but OS doesn't crash - will that data be secure in the mmap file? Also, am I correct that mdb_env_sync synchronizes all dirty pages in the mmap file as seen by a file system, regardless how they were modified - either via LMDB API or via a direct pointer writes? As for "you could at least set a callback to notify you that a block has moved" - if that is implemented, it would be nice to have a notification *before* a block is moved (with old and new address, so that right after the callback it is OK to use the new address), otherwise this non-intended but convenient use of LMDB won't work anymore. Best regards, Victor On Sat, Oct 3, 2015 at 1:27 AM, Howard Chu <hyc(a)symas.com> wrote: > Howard Chu wrote: > >> Victor Baybekov wrote: >> >>> Thank you! I understand this copy-on-write behavior, but am interested >>> if I >>> could control it a little. What if I use records that are always much >>> bigger >>> than a single page, e.g. 100 kb with 4kb pages, and make sure that a >>> record is >>> never updated (via LMDB means) during a lifetime of an environment, - is >>> there >>> any scenario that the location of such a big record could be changed >>> during a >>> lifetime of an environment, without updating the record? >>> >> >> At this point in time, no, if you don't update a large record there is no >> reason that it will move. That is not to say that this won't change in the >> future. The documentation tells you what promises we are willing to make. >> Relying on any non-documented behavior is your own responsibility. >> > > Note that the relocation functions in LMDB are intended to accommodate > blocks being moved around. The actual guts of that API haven't been > implemented, but probably in 1.x we'll flesh them out. Given that support, > you could at least set a callback to notify you that a block has moved. But > currently, overflow pages don't move if they're not modified. > > >>> >>> >>> On Fri, Oct 2, 2015 at 4:38 PM, Howard Chu <hyc(a)symas.com >>> <mailto:hyc@symas.com>> wrote: >>> >>> Victor Baybekov wrote: >>> >>> Hi, >>> >>> Docs for MDB_RESERVE say that a returned pointer to the reserved >>> space is >>> valid "before the next update operation or the transaction >>> ends." Docs >>> for MDB_WRITEMAP say that it "writes directly to the mmap >>> instead of >>> using >>> malloc for pages." Does combining the two options return a >>> pointer >>> directly to >>> a place in a mmap >>> >>> >>> Yes. >>> >>> so that this pointer could be used after a transaction ends >>> or after the next update? >>> >>> >>> No. >>> >>> Longer answer: maybe. >>> >>> Full answer: LMDB is copy-on-write. If you update another record on >>> the >>> same page, in a later transaction, the contents of that page will be >>> copied to a new page and the original page will go onto the >>> freelist. In >>> that case, the pointer you got must not be used again. >>> >>> If you don't directly update that page and cause it to be copied, >>> then you >>> might get lucky and be able to use the pointer for a while. It all >>> depends >>> on what other modifications you do and how they affect that node or >>> neighboring nodes. >>> >>> >>> I have a use case where I want to somewhat abuse LMDB safety for >>> convenience. >>> If I could get a pointer to a place inside a mmap I could work >>> with >>> LMDB value >>> as opaque blob or as a region inside the single big mmap. This >>> could >>> be more >>> convenient than creating and opening hundreds of temporary memory >>> mapped files >>> and keeping open handles to them. For example, Aeron terms could >>> be >>> stored >>> like this: a stream id per an LMDB db and a term id for a key in >>> the >>> db. >>> >>> >>> Thanks! >>> Victor >>> >>> >>> >>> -- >>> -- Howard Chu >>> CTO, Symas Corp. http://www.symas.com >>> Director, Highland Sun http://highlandsun.com/hyc/ >>> Chief Architect, OpenLDAP http://www.openldap.org/project/ >>> >>> >>> >> >> > > -- > -- Howard Chu > CTO, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc/ > Chief Architect, OpenLDAP http://www.openldap.org/project/ >

2 1

Re: (ITS#8290) Our system has occured "Server is unwilling to perform" from slapd when syncrepl rid was changed.
by Andrew Findlay 30 Oct '15

30 Oct '15

On Tue, Oct 27, 2015 at 02:55:11AM +0000, t-ogura(a)az.jp.nec.com wrote: > Subject: (ITS#8290) Our system has occured "Server is unwilling to perform" This does not look like a bug report, so you should direct it to the openldap-technical mailing-list rather than the ITS. > Master server connect two slave nodes , A and B. And, LDAP syncronization > configure as below. > > B server <---> Master server <---> A server > rid=27 rid=30 rid=32 > > Master server is set for LDAP syncronization in slapd.conf. Remember that the syncrepl directive only configures a replication consumer. Servers A and B also need syncrepl directives. All three servers also need the syncprov overlay, and I suspect that this is missing in your case leading to the error that you mentioned. Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

1 0

pwdHistory, encrypted passwords and selfservice application
by Bogdan Rudas 30 Oct '15

30 Oct '15

Hello all, I'm working on Self-service application and want to prevent user from re-using old passwords. What is correct way to chage password takin in mind password history? I guess it is: 1. Bind with special user and check if specified uid exists 2. Bind using user-supplied uid and password 3. Get password policy, history etc. and validate on selfservice-side 4. Execute LDAP modifyRequest with single item: userPassword and value of new hashed password. In my case same password gives same hash. Are there any way to force encrypted password history validation on server side? Thank you. -- Bogdan Rudas Head of Minsk IT Support Department Exadel Inc. http://www.exadel.com/ E-mail: brudas(a)exadel.com <mandrushkevich(a)exadel.com> Skype ID: bogdan.rudas -- CONFIDENTIALITY NOTICE: This email and files attached to it are confidential. If you are not the intended recipient you are hereby notified that using, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error please notify the sender and delete this email.

4 3

Millions of users linked into a single group
by Alessandro Lasmar Mourão 28 Oct '15

28 Oct '15

Hello, I wonder if there is any limitation on the number of users linked to a group groupOfUniqueNames type? We will provide an application on the Internet for more than 10 million users, and all these users belong (uniqueMember) to a single group. Our support reported that it is recommended that the user group should not have more than 16,000 members, this information accurate? Regards, Alessandro Lasmar Mourão

6 6

syncrepl without cleartext password.
by Prakash Padadune 27 Oct '15

27 Oct '15

I want to implement syncrepl without having cleartext password in the slapd.conf. How this can be achieved? ~~~ *Prakash*

3 2

I don't want to use GSSAPI !?
by Olivier 26 Oct '15

26 Oct '15

Hello everyone, authentication over ldap doesn't work on one of my linux box. Trying to query the ldap server from this machine with ldapsearch, I get this : $ ldapsearch -ZZZ -h ldap1.example:389 -D uid=olivier,dc=example,dc=fr -b dc=example,dc=fr -W Enter LDAP Password: SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Local error (-2) additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (No credentials cache found) Do you know why ldapsearch tries to authenticate using GSSAPI ? I don'use such a mechanism (nor kerberos) and I don't remember that I configured any such a thing. Any idea to desactivate the attempt to use GSSAPI to authenticate ? (note: the ldap client is a linux redhat5) Thanks, --- Olivier

3 8

Exclude ppolicy attributes from accesslog
by Angel L. Mateo 26 Oct '15

26 Oct '15

Hello, I have an openldap server as an authentication backend for my organization. I have a database with my users information. Is this database, I'm using the ppolicy overlay to control my users passwords. I'm also using the acceslog overlay (with its related cn=log database) to keep a log of modifications. With the ppolicy overlay every mistake of a user in an authentication process triggers a modification in the user entry (for the pwdFailureTime attribute) and this modification triggers a new entry the accesslog database. My problem is that this accesslog database is storing a huge amount of this entries and I would like to not store these kind of updates. So my question is if there is any way to exclude some attributes from the accesslog tracking. -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868887590 Fax: 868888337

1 0

sets: user and this during bind
by Michael Ströder 25 Oct '15

25 Oct '15

HI! Does "user" or "this" have any meaning during simple bind operation? E.g. when using a back-sock listener the BIND operation contains the bind-DN in 'dn' (let's call it request DN). Is "this" in a set-clause also the bind-DN during the bind operation? Background: I'd like to restrict access to userPassword during processing simple bind operation to peername (IP or path) found in the user's entry (referenced by the bind-DN). Or is there a non-set solution (besides implementing a dynacl module)? Ciao, Michael.

1 0

Q: Requesting parent OU doesn't seem to work right with Meta-Backend OU as child
by Zalewski, Marvyn-Stephano 22 Oct '15

22 Oct '15

Hey guys, I got a huge problem here. I’ve been trying to merge users from a local LDAP (ou=local-users,ou=accounts,dc=domain: which authenticates against a remote active directory (which is not ldap://remote.site) with sasl) with local users who use a local stored password and with users from a remote active directory without storing them locally. Let’s say i have the following structure: Local-LDAP (ldap://localhost): * dc=domain * ou=accounts * ou=local-users (with sasl) * ou=remote-users (Meta-Backend Proxy to ldap://remote.site – ou=accounts,dc=remote-domain) * ou=users (without sasl; password is stored locally) Remote-AD (ldap://remote.site): * dc=remote-domain * ou=accounts * <All Users are stored in this OU> The local LDAP structure works as expected. When i request ou=accounts,dc=domain i get all users located in ou=local-users and ou=users. And now i point out the problem: I only get the object ou=remote-users without the users from ou=accounts,dc=remote-domain so the ou=remote-users seems to be empty. But when i explicit request the full DN of ou=remote-users (ou=remote-user,ou=accounts,dc=domain) i get the full list of all users located in ou=accounts,dc=remote-domain. Here’s my slapd.conf: ####################################################################### # Global Directives: ####################################################################### # Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/inetorgperson.schema # Where the pid file is put. The init.d script # will not stop the server if you change this. pidfile /var/run/slapd/slapd.pid # List of arguments that were passed to the server argsfile /var/run/slapd/slapd.args # Read slapd.conf(5) for possible values logfile /etc/ldap/slapd.log loglevel 1 sasl-host localhost sasl-secprops none ####################################################################### # Dynamic Module Directives ####################################################################### # Base Path and individual modules. modulepath /usr/lib/ldap moduleload back_hdb.so moduleload refint.so moduleload memberof.so moduleload back_meta.so moduleload rwm.so # Defining referral integrity module to make sure the group relations are automatically updated. NOTE: Only when a 'delete' or 'edit' command has been issued. overlay refint refint_attributes member uniqueMember seeAlso refint_nothing cn=EMPTY # Defining memberof module which make sure to update the group affiliation for each user. NOTE: Added an own attribute to all users named: 'memberOf' which contains all groups. overlay memberof ####################################################################### # Database Directives: ####################################################################### database meta suffix "ou=remote-users,ou=accounts,dc=domain" readonly off lastmod off uri "ldap://remote.site/ou=remote-users,ou=accounts,dc=domain" suffixmassage "ou=remote-users,ou=accounts,dc=domain“ „ou=accounts,dc=remote-domain" idassert-bind bindmethod=simple binddn=„cn=root,dc=remote-domain" credentials=„root" mode=none flags=non-prescriptive idassert-authzFrom „dn.exact:cn=root,dc=remote-domain" database hdb directory /var/lib/ldap suffix „dc=domain" rootdn "cn=root,dc=domain" rootpw root index objectclass eq index uid eq,sub lastmod off readonly off My Search Results at parent OU: #### ldapsearch -M -a always -D "cn=root,dc=domain" -w root -b "ou=accounts,dc=domain“ dn # extended LDIF # # LDAPv3 # base <ou=accounts,dc=domain> with scope subtree # filter: (objectclass=*) # requesting: dn # with manageDSAit control # # accounts, domain dn: ou=accounts,dc=domain # local-users, accounts, domain dn: ou=local-users,ou=accounts,dc=domain # frank, local-users, accounts, domain dn: cn=frank,ou=local-users,ou=accounts,dc=domain # remote-users, accounts, domain dn: ou=remote-users,ou=accounts,dc=domain # users, accounts, domain dn: ou=users,ou=accounts,dc=domain # peter, users, accounts, domain dn: cn=peter,ou=users,ou=accounts,dc=domain My Search Results at child and proxied OU: #### ldapsearch -M -a always -D "cn=root,dc=domain" -w root -b „ou=remote-accounts,ou=accounts,dc=domain“ dn # extended LDIF # # LDAPv3 # base <ou=remote-users,ou=accounts,dc=domain> with scope subtree # filter: (objectclass=*) # requesting: dn # with manageDSAit control # # remote-users, accounts, domain dn: ou=remote-users,ou=accounts,dc=domain dn: cn=albert,ou=remote-users,ou=accounts,dc=domain I hope you guys can help me out. If you have further question, please leave a mail. Kind regards, Marvyn :)

1 0

Openldap - ldap user can't add entry: Insufficient access (no write access to parent)
by Ervin Hegedüs 22 Oct '15

22 Oct '15

Hello, (I'm not an LDAP guru - sorry for lame question(s)) I'ld like to make an addressbook in LDAP (for mailing clients, in first step for my RoundCube). Server is Debian 7.9, slapd 2.4.31 (OpenLDAP). After the successfully installation, I've created a subtree for the addressbook: dn: ou=rcabook,dc=mydomain,dc=com ou: rcabook objectClass: top objectClass: organizationalUnit dn: ou=public,ou=rcabook,dc=mydomain,dc=com ou: public objectClass: top objectClass: organizationalUnit dn: ou=private,ou=rcabook,dc=mydomain,dc=com ou: private objectClass: top objectClass: organizationalUnit and a regular user for RoundCube: dn: cn=rcuser,ou=rcabook,dc=mydomain,dc=com cn: rcuser objectClass: organizationalRole objectClass: simpleSecurityObject userPassword:: e1f2g3....x3y2z1 But when I want to make a new entry as rcuser, I've got this error: ldapadd -f entry.ldif -D cn=rcuser,ou=rcabook,dc=mydomain,dc=com -W Enter LDAP Password: adding new entry "cn=DOMAIN IT,ou=public,ou=rcabook,dc=mydomain,dc=com" ldap_add: Insufficient access (50) additional info: no write access to parent The ou=public,ou=rcabook subtree has a special access in config: # slapcat -n0 dn: olcDatabase={1}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=mydomain,dc=com olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymou s auth by dn="cn=admin,dc=mydomain,dc=com" write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by dn="cn=admin,dc=mydomain,dc=com" write by * read olcAccess: {3}to dn.subtree="ou=public,ou=rcabook,dc=mydomain,dc=com" by users writ e olcLastMod: TRUE ... Which privileges do I need to add, for all user would add the entries to subtree? Thanks, a. -- I � UTF-8

2 1

ldapcompare for booleans ?
by Croesus Kall 21 Oct '15

21 Oct '15

Hi, I am trying to use the ldapcompare command to evaluate a boolean value. Namely I want to check if the olcMirrorMode attribute is set to false. The command and result is: ldapcompare -Y EXTERNAL -H ldapi:/// olcDatabase={0}config,cn=config "olcMirrorMode:FALSE" SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 Compare Result: Inappropriate matching (18) Additional info: inappropriate matching request UNDEFINED Is there a way to tell the ldapcompare command that this is a boolean comparison ? The attribute itself: olcMirrorMode / 1.3.6.1.4.1.4203.1.12.2.3.2.0.16 has a "booleanMatch" matching rule, so I'm guessing this should be possible ?

2 2

configuring ldap-client to use TLS (Certificate not found in database)
by Sridhar Acharya Malkaram 21 Oct '15

21 Oct '15

I am a novice to linux administration. Recently I had to configure a system to authenticate using LDAP with TLS. I have read guides from several websites. But I still could configure it. There seem to be several reasons for the failure. I tried many suggestions, but with no success. I don’t have access to the LDAP server. So I have been just playing with config on the client. The LDAP server is sso.abcdef.edu <http://sso.abcdef.edu/> My ldap.conf content is below BASE dc=abcdef,dc=edu TLS_REQCERT allow TLS_CACERT /etc/openldap/cacerts/sso.abcdef.edu.crt uri ldap://sso.abcdef.edu <ldap://sso.abcdef.edu> TLS_CACERTDIR /etc/openldap/cacerts I could issue a ldapsearch -x which returns several entries. However, when I couldn’t do using TLS. The following command shows some errors. Could you suggest me possible directions to resolve this. The directory /etc/openldap/cacerts/ contains the server certificate sso.abcdef.edu <http://sso.abcdef.edu/>.crt. I also made a copy of it with name sso.abcdef.edu <http://sso.abcdef.edu/>.pem. I am not sure whether this pem file should be that of the server or the client. Another question, should the client also have a ca (or self-signed ) certificate and it whether it should be uploaded onto the LDAP server? Could anyone please describe the basic essential steps in configuring LDAP client with TLS (without necessarily including the commands). (Several guides suggest changing configs at several places (like, pam_ldap.con, auth.conf) etc. But centOS documentation on LDAP describes configuration only for the ldap.conf (which I couldn’t follow completely).) /etc/openldap/cacerts root(a)wserver[0.5]5019 > ldapsearch -ZZZ -h sso.abcdef.edu <http://sso.abcdef.edu/> -d -1 ldap_create ldap_url_parse_ext(ldap://sso.abcdef.edu <ldap://sso.abcdef.edu>) ldap_extended_operation_s ldap_extended_operation ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP sso.abcdef.edu <http://sso.abcdef.edu/>:389 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 10.71.31.15:389 ldap_pvt_connect: fd: 3 tm: -1 async: 0 attempting to connect: connect success ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_dump: buf=0x15ea5b0 ptr=0x15ea5b0 end=0x15ea5cf len=31 0000: 30 1d 02 01 01 77 18 80 16 31 2e 33 2e 36 2e 31 0....w...1.3.6.1 0010: 2e 34 2e 31 2e 31 34 36 36 2e 32 30 30 33 37 .4.1.1466.20037 ber_scanf fmt ({) ber: ber_dump: buf=0x15ea5b0 ptr=0x15ea5b5 end=0x15ea5cf len=26 0000: 77 18 80 16 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e w...1.3.6.1.4.1. 0010: 31 34 36 36 2e 32 30 30 33 37 1466.20037 ber_flush2: 31 bytes to sd 3 0000: 30 1d 02 01 01 77 18 80 16 31 2e 33 2e 36 2e 31 0....w...1.3.6.1 0010: 2e 34 2e 31 2e 31 34 36 36 2e 32 30 30 33 37 .4.1.1466.20037 ldap_write: want=31, written=31 0000: 30 1d 02 01 01 77 18 80 16 31 2e 33 2e 36 2e 31 0....w...1.3.6.1 0010: 2e 34 2e 31 2e 31 34 36 36 2e 32 30 30 33 37 .4.1.1466.20037 ldap_result ld 0x15e1090 msgid 1 wait4msg ld 0x15e1090 msgid 1 (infinite timeout) wait4msg continue ld 0x15e1090 msgid 1 all 1 ** ld 0x15e1090 Connections: * host: sso.abcdef.edu <http://sso.abcdef.edu/> port: 389 (default) refcnt: 2 status: Connected last used: Tue Oct 20 20:50:52 2015 ** ld 0x15e1090 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x15e1090 request count 1 (abandoned 0) ** ld 0x15e1090 Response Queue: Empty ld 0x15e1090 response count 0 ldap_chkResponseList ld 0x15e1090 msgid 1 all 1 ldap_chkResponseList returns ld 0x15e1090 NULL ldap_int_select read1msg: ld 0x15e1090 msgid 1 all 1 ber_get_next ldap_read: want=8, got=8 0000: 30 0c 02 01 01 78 07 0a 0....x.. ldap_read: want=6, got=6 0000: 01 00 04 00 04 00 ...... ber_get_next: tag 0x30 len 12 contents: ber_dump: buf=0x15eba20 ptr=0x15eba20 end=0x15eba2c len=12 0000: 02 01 01 78 07 0a 01 00 04 00 04 00 ...x........ read1msg: ld 0x15e1090 msgid 1 message type extended-result ber_scanf fmt ({eAA) ber: ber_dump: buf=0x15eba20 ptr=0x15eba23 end=0x15eba2c len=9 0000: 78 07 0a 01 00 04 00 04 00 x........ read1msg: ld 0x15e1090 0 new referrals read1msg: mark request completed, ld 0x15e1090 msgid 1 request done: ld 0x15e1090 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_parse_extended_result ber_scanf fmt ({eAA) ber: ber_dump: buf=0x15eba20 ptr=0x15eba23 end=0x15eba2c len=9 0000: 78 07 0a 01 00 04 00 04 00 x........ ldap_parse_result ber_scanf fmt ({iAA) ber: ber_dump: buf=0x15eba20 ptr=0x15eba23 end=0x15eba2c len=9 0000: 78 07 0a 01 00 04 00 04 00 x........ ber_scanf fmt (}) ber: ber_dump: buf=0x15eba20 ptr=0x15eba2c end=0x15eba2c len=0 ldap_msgfree TLS: loaded CA certificate file /etc/openldap/cacerts/sso.abcdef.edu.crt. TLS: error: the certificate '/etc/openldap/cacerts/sso.abcdef.edu.pem' could not be found in the database - error -12285:Unable to find the certificate or key necessary for authentication.. TLS: certificate '/etc/openldap/cacerts/sso.abcdef.edu.pem' successfully loaded from PEM file. TLS: could not add the private key '/etc/openldap/cacerts/sso.abcdef.edu.pem' - error -8018:Unknown PKCS #11 error.. TLS: error: could not initialize moznss security context - error -8018:Unknown PKCS #11 error. TLS: can't create ssl handle. ldap_err2string ldap_start_tls: Connect error (-11) ldap_free_connection 1 1 ldap_send_unbind ber_flush2: 7 bytes to sd 3 0000: 30 05 02 01 02 42 00 0....B. ldap_write: want=7, written=7 0000: 30 05 02 01 02 42 00 0....B. ldap_free_connection: actually freed

2 1

Delta-syncrepl not syncing entire directory: Entry CSN greater than snapshot
by Pedro Roger 21 Oct '15

21 Oct '15

Hello, i'm trying to setup a master/slave replication via delta-syncrepl, but for the most of the entries i get the message: "Entry CSN greater than snapshot". I had search in the archive of the mail list but i couldn't get a solution for this. Any help is appreciate. Some entrie i get in the syslog: Oct 20 20:23:57 temperance slapd[7645]: Entry uid=ari_oliveira,ou=uvanet.br,ou=mail,dc=uvanet,dc=br CSN 20151015141738.689470Z#000000#000#000000 greater than snapshot 20150709142425.146445Z#000000#000#000000 Oct 20 20:23:57 temperance slapd[7645]: Entry cn=SAPLIC,ou=groupOfNames,ou=intranet,dc=uvanet,dc=br CSN 20151020152042.450209Z#000000#000#000000 greater than snapshot 20150709142425.146445Z#000000#000#000000 Oct 20 20:23:57 temperance slapd[7645]: Entry cn=SIGU,ou=groupOfNames,ou=intranet,dc=uvanet,dc=br CSN 20151020152042.636081Z#000000#000#000000 greater than snapshot 20150709142425.146445Z#000000#000#000000 I have the following config in the provider (slapd 2.4.23): ... moduleload accesslog.la moduleload syncprov.la database hdb suffix cn=accesslog directory /opt/ldap/accesslog rootdn cn=accesslog index default eq index entryCSN,objectClass,reqEnd,reqResult,reqStart eq dbconfig set_cachesize 0 2097152 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE database hdb suffix "dc=uvanet,dc=br" rootdn "xxxxxx" directory "/var/lib/ldap" overlay syncprov syncprov-checkpoint 1000 60 #syncprov-checkpoint 500 30 syncprov-reloadhint TRUE syncprov-sessionlog 500 # accesslog overlay definitions for primary db overlay accesslog logdb cn=accesslog logops writes logsuccess TRUE # scan the accesslog DB every day, and purge entries older than 7 days logpurge 07+00:00 01+00:00 index objectClass eq,pres index ou,cn,sn,mail,givenname eq,pres,sub index uidNumber,gidNumber,memberUid eq,pres index loginShell eq,pres index memberOf eq ## required to support pdb_getsampwnam index uid pres,sub,eq # required to support pdb_getsambapwrid() index displayName pres,sub,eq index nisMapName,nisMapEntry eq,pres,sub index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq index default sub index uniqueMember eq index sambaGroupType eq index sambaSIDList eq # syncprov specific indexing index entryUUID eq index entryCSN eq overlay memberof In the consumer server we have: syncrepl rid=1 provider=ldap://X.X.X.X type=refreshAndPersist retry="5 + 5 +" interval=00:00:00:01 searchbase="dc=uvanet,dc=br" filter="(objectClass=*)" scope=sub starttls=no logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" syncdata=accesslog attrs="*" schemachecking=on bindmethod=simple binddn="XXXX" credentials="XXXX" # Refer updates to the master updateref ldap://X.X.X.X Thanks in advance -- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Pedro Roger Magalhães Vasconcelos http://www.proger.eti.br

2 1

openldap chain overlay: does not seem to be functioning/referenced
by Peter Heinemann 21 Oct '15

21 Oct '15

openldap 2.4-39 RHEL 6.5 I'm trying to get one ldap server configured to chain queries to a second server when specific OUs that are on the 2nd server (but not the 1st) are referenced in a query/ldapsearch. Note that these are read-only consumers, so I am not dealing with modifications, only searches. Both servers share the top level suffix. An ldapsearch against the first server involving an OU that is on the second server returns "no such Object"; and the logfile on the first server (loglevel 1) shows no reference to the chain-uri or attempt to search outside the first server. overlay chain chain-uri ldap://chained-server.domain.com chain-idassert-bind bindmethod="simple" binddn="cn=admin,dc=domain,dc=com" credentials="<password>" mode="self" chain-tls start chain-return-error TRUE slapd.conf is valid per slaptest, and starts successfully. However, an ldapsearch against the initial target server simply returns "No such object", because it appears the chain is never followed or these directives are inactive. In the local4.log with loglevel set to 1, there's never any attempt/reference to the chain-uri, and no subsequent entry in the log file for the second server. - should there be logfile entries on the first server referencing the chain-uri (or on the client ldapsearch with -d1)? - is there a missing directive or incorrect configuration? Thanks for any assistance. Peter

1 1

OpenLDAP as a Caching Proxy server
by Christian Tardif 21 Oct '15

21 Oct '15

Hi, I've been trying to setup a caching proxy server with OpenLDAP for quite a long time, and it seems, from what I can see right now, that the proxy stuff is working (I can log on on a server that points to the proxy as its LDAP server), but the caching stuff doesn't seem to work at all. EVERY request I'm doing is transferred to the AD (the real LDAP server) behind the proxy LDAP. Here's how my pcache module is set. Not too sure though, how to setup pcacheTemplates. Maybe that my error. One thing to note is that no database is even created in /var/tmp/cache directory, as I would expect. moduleload pcache.la overlay pcache pcache bdb 100000 3 1000 60 directory /var/tmp/cache cachesize 150 index objectClass eq index sAMAccountName eq pcacheMaxQueries 100 pcacheAttrset 0 objectClass name objectSid pcacheAttrset 1 objectClass sAMAccountName pcacheAttrset 2 * pcacheTemplate (&(member=)(objectClass=)(name=)) 0 60 pcacheTemplate (objectClass=) 0 60 pcacheTemplate (&(objectSid=)(objectClass=)(name=)) 0 60 pcacheTemplate (&(?sAMAccountName=)(?objectClass=)(sAMAccountName=)(objectSid=)) 2 60 pcacheTemplate (sAMAccountName=) 2 60 pcachePersist true -- CHRISTIAN TARDIF -------------------------

2 3

slapd: No database support for /var/heimdal/heimdal
by Francesco Malvezzi 16 Oct '15

16 Oct '15

hi all, while adding the smbk5pwd overlay 1) to a mdb database, on ldapmodify command slapd dies suddently with the following last lines: [...] 5620d62f >>> dnPrettyNormal: <olcOverlay={3}smbk5pwd,olcDatabase={1}mdb,cn=config> 5620d62f <<< dnPrettyNormal: <olcOverlay={3}smbk5pwd,olcDatabase={1}mdb,cn=config>, <olcOverlay={3}smbk5pwd,olcDatabase={1}mdb,cn=config> 5620d62f oc_check_required entry (olcOverlay={3}smbk5pwd,olcDatabase={1}mdb,cn=config), objectClass "olcSmbK5PwdConfig" 5620d62f oc_check_allowed type "objectClass" 5620d62f oc_check_allowed type "olcOverlay" 5620d62f oc_check_allowed type "olcSmbK5PwdEnable" 5620d62f oc_check_allowed type "structuralObjectClass" slapd: No database support for /var/heimdal/heimdal openldap is 2.4.42 compiled on debian jessie, heimdal is compiled too (heimdal-1-5-branch). The module in contrib/slapd-modules/smbk5pwd compiles fine apart a few warnings. I think I am missing a library, but I am not able to figure out which one. thank you, Francesco 1) dn: olcOverlay={3}smbk5pwd,olcDatabase={1}mdb,cn=config changetype: add objectClass: olcSmbK5PwdConfig objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top olcOverlay: {3}smbk5pwd olcSmbK5PwdEnable: samba olcSmbK5PwdEnable: krb5

1 1

Can a ppolicy be applied to a subtree?
by Campbell, Courtney 15 Oct '15

15 Oct '15

I am curious if a ppolicy can be applied to a subtree so that it is added to a user account when newly created? ________________________________ This message (including any attachments) is confidential and intended for a specific individual and purpose. If you are not the intended recipient, please notify the sender immediately and delete this message.

3 3

Allowing users to update their passwords
by Kartik Vashishta 13 Oct '15

13 Oct '15

Team, I am not anything but new to ldap. I have however successfully installed and configured Openldap on CentOS7. Online material was a BIG help. I am trying to figure out how to allow users to change their own passwords. Googling pointed me out to this: access to attrs=userPassword by self write by anonymous auth by users none access to * by * read But where and how does this get input into the ldap db. There is no more a slapd.conf. Please advise. Regards, Kartik Vashishta

3 2

bind/queries through multiple backends
by Steffen Kaiser 10 Oct '15

10 Oct '15

Hi, I currently have a local OpenLDAP v2.4.40 with a bdb backend and another instance with a ldap backend proxying binds and queries to an AD. The bdb backend serves just one suffix: dc=example,dc=com The AD serves several suffixes: dc=example,dc=com (same as local one) dc=example,dc=net dc=otherexample,dc=com dc=anotherexample,dc=net I would like to merge both configurations. The entries of the suffix dc=example,dc=com, which is served by both servers, are disjunct. There is no DN, which is located on both servers. There will be some name problems, but these can be handled by organisational means. ==== My first problem is that I cannot make bind work for DNs with suffix dc=example,dc=com, which are located on the 2nd backend. In fact, there are very few DNs of that suffix on the 2nd server, but there are. I would like that bind first tries the first (local) server and, if the DN is missing there, the second server (the proxy). Currently, only the local backend is queried. ==== What would be the best solution to forward a bunch of suffixes to the LDAP backend? -- Steffen Kaiser

2 1

empty ldapmodify refused with slapo-unique
by Geert Hendrickx 08 Oct '15

08 Oct '15

When slapo-unique constraints are in effect, it seems empty updates are no longer allowed: > $ ldapmodify -x -h localhost -D cn=Manager,dc=my-domain,dc=com -w secret > dn: cn=test1,dc=my-domain,dc=com > changetype: modify > > modifying entry "cn=test1,dc=my-domain,dc=com" > ldap_modify: Invalid syntax (21) > additional info: unique_modify() got null op.orm_modlist Why is this considered invalid syntax? Without slapo-unique constraint, empty updates like these are accepted. Geert -- geert.hendrickx.be :: geert(a)hendrickx.be :: PGP: 0xC4BB9E9F This e-mail was composed using 100% recycled spam messages!

2 2

SSL based LDAP client verification
by Aneela Saleem 08 Oct '15

08 Oct '15

Hi all, I have followed this link <http://www.openldap.org/faq/data/cache/185.html> to generate self-signed certificates. I have successfully performed server side validation. What if i want to access LDAPS:// from other client. I have copied servercrt.pem and serverkey.pem file on client machine, also added servercrt.pem file to client trust store. I'm using LDAPjs client for authentication. I have provided trust store path and serverkey.pem file in the code, but i still get the following error: crypto.js:104 if (options.cert) c.context.setCert(options.cert); ^ Error: error:0906D06C:PEM routines:PEM_read_bio:no start line at Object.exports.createCredentials (crypto.js:104:31) at Object.exports.connect (tls.js:1334:27) at Client._connect (/home/aneela/node_modules/ldapjs/lib/client/client.js:736:18) at new Client (/home/aneela/node_modules/ldapjs/lib/client/client.js:247:22) at Object.createClient (/home/aneela/node_modules/ldapjs/lib/client/index.js:60:12) at authDN (/home/aneela/client-ldapjs/app.js:15:21) at Object.<anonymous> (/home/aneela/client-ldapjs/app.js:90:1) at Module._compile (module.js:456:26) at Object.Module._extensions..js (module.js:474:10) at Module.load (module.js:356:32) Please guide me if i'm doing something wrong. Which PEM files need to be copied on client machine? Or i need to create client side certificates separately as well?

2 1

slapd-ldap quarantine, manual slapd restart is required
by Nikos Voutsinas 08 Oct '15

08 Oct '15

Hi, I am using the quarantine option of back-ldap, using the following setting: olcDbQuarantine 10,30;60,+ which AFAIK it means that proxy ldap will try to unset the quarantine in 10 seconds for 30 times, and then will try every 60 seconds, forever. In my case when proxy ldap put the backend target into quarantine the following lines were written in slapd.log, and after that proxy ldap never managed to remove the target from quarantine. Oct 7 21:30:58 proxy slapd[330]: conn=632725 op=0 ldap_back_retry: retrying URI="ldap://back01 ldap://back02" DN="" Oct 7 21:30:58 proxy slapd[330]: conn=632725 op=0: ldap_back_quarantine enter. Oct 7 21:31:08 proxy slapd[330]: conn=632759 op=0: ldap_back_getconn quarantine retry block #0 try #0. It seems to me that back ldap tried once to check the target status in 10 seconds, and after that nothing..... 1. Is the config syntax correct? 2. Is there any case this to be a regression of ITS#5592 Thanks, Nikos

2 1

SSL based ldap server
by Aneela Saleem 07 Oct '15

07 Oct '15

Hi all, I have implemented LDAP over ssl. FQDN of LDAP server is "platalytics.com" and same is CN in the SSL certificate. But why is it so that when i run following command it works fine i.e., ldapsearch -x -D "cn=aneela,ou=users,dc=platalytics,dc=com" -W -H ldap:// 127.0.0.1:389 -b "dc=platalytics,dc=com" -s sub 'cn=aneela' but in case of ldaps, i have to provide FQDN as the hostname i.e., ldapsearch -x -D "cn=aneela,ou=users,dc=platalytics,dc=com" -W -H ldaps:// platalytics.com:636 -b "dc=platalytics,dc=com" -s sub 'cn=aneela' because following command does not work i.e., ldapsearch -x -D "cn=aneela,ou=users,dc=platalytics,dc=com" -W -H ldaps:// 127.0.0.1:636 -b "dc=platalytics,dc=com" -s sub 'cn=aneela'

4 9

New User unable to authenticate on new client
by Varadi, Louis - 0442 - MITLL 06 Oct '15

06 Oct '15

I have a new OpenLDAP server. I am also using it as a Ldap Client. I have added a user but cannot authenticate. I have spent a lot of time researching this issue. All the suggestions are very different - ACL issues, slapd pointing the incorrect config files, Ldap.conf file is incorrect, nsswitch is incorrect, incorrect password. Is there a straight forward way to troubleshoot this issue. What are the configs files that are involved with this failure? Your help is greatly appreciated. This user works [root@ldapservrer]# ldapwhoami -x -D cn=ldapadmin,dc=group1,dc=ldap -W Enter LDAP Password: dn:cn=ldapadmin,dc=group1,dc=ldap This user fails [root@ldapserver]# ldapwhoami -x -D cn=lou,dc=group1,dc=ldap -W Enter LDAP Password: ldap_bind: Invalid credentials (49) 5612e45a conn=1051 fd=12 ACCEPT from IP=192.168.0.101:59308 (IP=192.168.0.a0a:389) 5612e45a conn=1051 op=0 BIND dn="cn=lou,dc=group1,dc=ldap" method=128 5612e45a conn=1051 op=0 RESULT tag=97 err=49 text= 5612e45a conn=1051 op=1 UNBIND 5612e45a conn=1051 fd=12 closed Oct 5 16:03:32 ldapserver sshd[1432]: Received disconnect from 9.9.9.9: 11: disconnected by user Oct 5 16:03:36 ldapserver sshd[1528]: Invalid user lou from 9.9.9.9 Oct 5 16:03:36 ldapserver sshd[1529]: input_userauth_request: invalid user lou Oct 5 16:03:53 ldapserver sshd[1528]: Failed password for invalid user lou from 9.9.9.9 port 33968 ssh2 _______________________________ [root@ldapserver man1]# su - lou su: user lou does not exis 5612ebc3 conn=1053 fd=12 ACCEPT from IP=192.168.0.101:59310 (IP=192.168.0.101:389) 5612ebc3 conn=1053 op=0 SRCH base="" scope=0 deref=0 filter="(objectClass=*)" 5612ebc3 conn=1053 op=0 SRCH attr=* altServer namingContexts supportedControl supportedExtension supportedFeatures supportedLDAPVersion supportedSASLMechanisms domainControllerFunctionality defaultNamingContext lastUSN highestCommittedUSN 5612ebc3 conn=1053 op=0 SEARCH RESULT tag=101 err=0 nentries=0 text= 5612ebc3 conn=1053 op=1 SRCH base="dc=group1,dc=ldap" scope=2 deref=0 filter="(&(uid=lou)(objectClass=posixAccount)(uid=*)(&(uidNumber=*)(!(uidNum ber=0))))" 5612ebc3 conn=1053 op=1 SRCH attr=objectClass uid userPassword uidNumber gidNumber gecos homeDirectory loginShell krbPrincipalName cn modifyTimestamp modifyTimestamp shadowLastChange shadowMin shadowMax shadowWarning shadowInactive shadowExpire shadowFlag krbLastPwdChange krbPasswordExpiration pwdAttribute authorizedService accountExpires userAccountControl nsAccountLock host loginDisabled loginExpirationTime loginAllowedTimeMap sshPublicKey 5612ebc3 conn=1053 op=1 SEARCH RESULT tag=101 err=50 nentries=0 text= 5612ebc3 conn=1053 op=2 UNBIND 5612ebc3 conn=1053 fd=12 closed __________________________ ssh lou(a)192.168.101 5612ed15 conn=1107 fd=12 ACCEPT from IP=192.168.0.101:59364 (IP=192.168.0.101:389) 5612ed15 conn=1107 op=0 SRCH base="" scope=0 deref=0 filter="(objectClass=*)" 5612ed15 conn=1107 op=0 SRCH attr=* altServer namingContexts supportedControl supportedExtension supportedFeatures supportedLDAPVersion supportedSASLMechanisms domainControllerFunctionality defaultNamingContext lastUSN highestCommittedUSN 5612ed15 conn=1107 op=0 SEARCH RESULT tag=101 err=0 nentries=0 text= 5612ed15 conn=1107 op=1 SRCH base="dc=group1,dc=ldap" scope=2 deref=0 filter="(&(uid=lou)(objectClass=posixAccount)(uid=*)(&(uidNumber=*)(!(uidNum ber=0))))" 5612ed15 conn=1107 op=1 SRCH attr=objectClass uid userPassword uidNumber gidNumber gecos homeDirectory loginShell krbPrincipalName cn modifyTimestamp modifyTimestamp shadowLastChange shadowMin shadowMax shadowWarning shadowInactive shadowExpire shadowFlag krbLastPwdChange krbPasswordExpiration pwdAttribute authorizedService accountExpires userAccountControl nsAccountLock host loginDisabled loginExpirationTime loginAllowedTimeMap sshPublicKey 5612ed15 conn=1107 op=1 SEARCH RESULT tag=101 err=50 nentries=0 text= 5612ed15 conn=1107 op=2 UNBIND 5612ed15 conn=1107 fd=12 closed [root@ldapserver ]# ldapsearch -H ldap://ldapserver.group1.ldap -d 256 -D cn=ldapadmin,dc=group1,dc=ldap -W -b ou=Users,dc=group1,dc=ldap Enter LDAP Password: # extended LDIF # # LDAPv3 # base <ou=Users,dc=group1,dc=ldap> with scope subtree # filter: (objectclass=*) # requesting: ALL # # Users, group1.ldap dn: ou=Users,dc=group1,dc=ldap ou: Users objectClass: organizationalUnit # lou, Users, group.ldap dn: uid=lou,ou=Users,dc=group1,dc=ldap uid: lou mail: louxxxxxxxxxxx sn: xxxx pwdAttribute: xxxxxxx telephoneNumber: xxxxxxxxxx roomNumber: xxxx uidNumber: xxxx gidNumber: xxxxx employeeNumber: xxxxx cn: Louis xxxxx loginShell: /bin/bash gecos: Lou xxxx homeDirectory: /home/xxxx objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: pwdPolicy objectClass: shadowAccount userPassword:: xxxxxxx # search result search: 2 result: 0 Success # numResponses: 3 # numEntries: 2

2 2

Re: OS X Yosemite clients
by oldap＠mountainlake.k12.mn.us 06 Oct '15

06 Oct '15

I have this problem resolved. It isn't related to the OpenLDAP code at all, but has to do with the password formatting. What I found was the passwords in OpenLDAP were in this format: {MD5}<base 64 encoded md5 digest><newline character> The base64 encoder on the Linux server always adds a a newline character (\n) to the end of the encoding. Multiple platforms have always ignored that character until OS X 10.10.5. Simply removing the newline before inserting the encoded password into the OpenLDAP database allows 10.10.5 and later to authenticate against that password. -- Jon

2 1

Allow users to change ldap password with passwd
by Real, Elizabeth (392K) 06 Oct '15

06 Oct '15

This is my setup: Server: Openldap 2.4.39 installed on RHEL7 Ldap clients: RHEL7 and RHEL5 I set up this directive on the ldap clients (/etc/sssd/sssd.conf) to prevent users with expired accounts to login: ldap_pwd_policy = shadow. This works as expected. Now I need to allow users to reset their ldap password after logging in to an ldap client. This is what is logged when a user attempts to reset their password using passwd: rhel7 ldap client: # passwd Changing password for user real Current password: New password: Retype new password: passwd: Authentication token manipulation error rhel7 ldap server: /var/log/secure pam_unix(passwd:chauthtok): user “real” does not exist in the /etc/passwd pam_sss(passwd:chauthtok): Password change failed for user real: 28 (Module is unknown) Gkr-pam: couldn’t update the login keyring password: no old password was Entered In an attempt to allow users to change their ldap password, i edited my ACL on the ldap server and added 'shadowLastChange': dn: olcDatabase={2}hdb,cn=config add: olcAccess olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by dn.base="cn=Alien,dc=cluster,dc=sec312" write by anonymous auth by * none olcAccess: {1}to * by self write by dn.base="cn=Alien,dc=cluster,dc=sec312" write by * read However that did not work, on the ldap clients I get this on the logs: pam_unix(sshd:auth): authentication failure pam_sss(sshd:auth): authentication failure pam_sss(sshd:auth): received for user reaL 4 (System error) This is the /etc/pam.d/system-auth file on the rhel7 ldap client: #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth sufficient pam_fprintd.so auth sufficient pam_unix.so try_first_pass auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth sufficient pam_sss.so use_first_pass auth required pam_deny.so account required pam_unix.so broken_shadow account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 1000 quiet account [default=bad success=ok user_unknown=ignore] pam_sss.so account required pam_permit.so password requisite pam_pwquality.so try_first_pass local_users_only retry=3 minlen=8 lcredit=-1 ucredit=-1 dcredit=-1 ocredit=-1 authtok_type= password sufficient pam_unix.so sha512 shadow try_first_pass use_authtok password sufficient pam_sss.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_systemd.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_sss.so ~ What other directive do I need to set to allow users to reset their ldap password when they call passwd? Thank you, Liz

4 14

olcAccess with combined "by who" condition
by rss ln 06 Oct '15

06 Oct '15

Hello, Is it possible to combine olcAccess "by who" condition for DN and IP address, that both conditions must by true? Something like: to dn.subtree="ou=test,dc=domain,dc=com" by dn="uid=someuser,ou=users,dc=domain,dc=com" & peername.ip=10.10.10.10 read So, it should be possible to read the subtree for the user only from the specific IP address. I tried also use "set=(...)" but without success. Any chance to do that?

2 1

implementation specific error trying to modify olcSyncProvConfig object
by Angel L. Mateo 05 Oct '15

05 Oct '15

Hello, I am trying to modify an already existing configuration in my openldap servers (I have tried with 2.4.31 an 2.4.41). Its current ldif is: dn: olcOverlay={0}syncprov objectClass: olcConfig objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov structuralObjectClass: olcSyncProvConfig entryUUID: ef486ea8-bf26-1034-850e-938b6f4c1ac2 creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20150715102100Z entryCSN: 20151002093808.730729Z#000000#01e#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20151002093808Z Now, I'm trying to add olcSpSessionlog and olcCheckpoint attributes, so I have this update ldif: dn: olcOverlay={0}syncprov,olcDatabase={2}hdb,cn=config changetype: modify replace: olcSpCheckpoint olcSpCheckpoint: 100 10 - replace: olcSpSessionlog olcSpSessionlog: 100 (I know I could use add operations instead of replace, but the ldif is generated from a configuration system). When I try to run this ldif I get: # /usr/bin/ldapmodify -Y EXTERNAL -H ldapi:/// -f /tmp/update.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "olcOverlay={0}syncprov,olcDatabase={2}hdb,cn=config" ldap_modify: Other (e.g., implementation specific) error (80) This is a rare behaviour, because I have tried changing the order of the modifications and it works: # /usr/bin/ldapmodify -Y EXTERNAL -H ldapi:/// -f /tmp/update.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "olcOverlay={0}syncprov,olcDatabase={2}hdb,cn=config" I have also tried separating the modifications in two different operations (first with olcSpCheckpoint) and then I get a "no such attribute" error: # /usr/bin/ldapmodify -Y EXTERNAL -H ldapi:/// SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 dn: olcOverlay={0}syncprov,olcDatabase={2}hdb,cn=config changetype: modify replace: olcSpCheckpoint olcSpCheckpoint: 100 10 modifying entry "olcOverlay={0}syncprov,olcDatabase={2}hdb,cn=config" dn: olcOverlay={0}syncprov,olcDatabase={2}hdb,cn=config changetype: modify replace: olcSpSessionlog olcSpSessionlog: 100 modifying entry "olcOverlay={0}syncprov,olcDatabase={2}hdb,cn=config" ldap_modify: Other (e.g., implementation specific) error (80) additional info: modify/delete: olcSpSessionlog: no such attribute The same operation but trying to update first the olcSpSessionlog attribute also errors with "no such attribute": # /usr/bin/ldapmodify -Y EXTERNAL -H ldapi:/// SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 dn: olcOverlay={0}syncprov,olcDatabase={2}hdb,cn=config changetype: modify replace: olcSpSessionlog olcSpSessionlog: 100 modifying entry "olcOverlay={0}syncprov,olcDatabase={2}hdb,cn=config" ldap_modify: Other (e.g., implementation specific) error (80) additional info: modify/delete: olcSpSessionlog: no such attribute Is this a bug? If not, why I'm having this error? Any idea? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868887590 Fax: 868888337

2 1

RBAC
by Aneela Saleem 05 Oct '15

05 Oct '15

Hi all, Can anyone please provide me with some useful tutorials about "How can we implement RBAC in LDAP" ? I have mostly seen research papers only. I want to see some implementation examples. Thanks

2 3

Complex multi-master topology
by Patrick 04 Oct '15

04 Oct '15

I've been trying to create a complex multi-master replication of cn=config for a week now... I'm using the core debian package: slapd 2.4.40+dfsg-1+deb8u1 I've seen someone claiming it could work but cannot find configs related to this kind of topology. http://www.slideshare.net/ghenry/openldap-replication-strategies (slide #24) When building a simple multimaster (two or three nodes) everything works as planned. But in the case some nodes cannot talk to others, i cannot find a way to make it works. Let's take this example +-------+ +-------+ +-------+ | ldap1 | <---> | ldap2 | <---> | ldap3 | +-------+ +-------+ +-------+ and say: olcSyncRepl: rid=001 searchbase="cn=config" type=refreshAndPersist provider=ldap://ldap1 olcSyncRepl: rid=002 searchbase="cn=config" type=refreshAndPersist provider=ldap://ldap2 olcSyncRepl: rid=003 searchbase="cn=config" type=refreshAndPersist provider=ldap://ldap3 Where initialy: ldap1 have rid=002 ldap2 have rid=001 and rid=003 ldap3 have rid=002 Soon everyone get rid=001 rid=002 rid=003 and ldap3 cannot talk to ldap1 and it does not work... And even if i don't care about the connexion between ldap1 and ldap3 failing, the replication does not work either... if ldap1 change something, it gets replicated to ldap2 but not ldap3. Also, i've been trying to use exattrs=Syncrepl but if someone change his Syncrepl, it get deleted on the other node... Someone seems to have seen this with memberof overlay ? http://www.openldap.org/lists/openldap-technical/201505/msg00124.html Anyone have references to help me get to my goal? -- Patrick Brideau Administrateur Système Kronos Technologies - http://www.kronos-web.com tel: 418 877-5400 p.216

5 10

BP build OpenLDAP and lmdb packages
by Michael Ströder 03 Oct '15

03 Oct '15

HI! I wonder what's considered best practice for building OpenLDAP and lmdb packages e.g. for a Linux distribution. Fortunately lmdb seems to be leveraged by more and more other software. So Linux distributions start to ship lmdb libs and tools as separate packages. 1. Do I have a chance to build OpenLDAP against those packages? Which releases have to be aligned? 2. Or should I link back-mdb statically into slapd when producing OpenLDAP packages? This would probably also require to build separate version of the mdb tools. Of course personally I'd prefer 1. Ciao, Michael.

5 8

[LMDB] What pointer is returned with combination of MDB_WRITEMAP and MDB_RESERVE?
by Victor Baybekov 03 Oct '15

03 Oct '15

Hi, Docs for MDB_RESERVE say that a returned pointer to the reserved space is valid "before the next update operation or the transaction ends." Docs for MDB_WRITEMAP say that it "writes directly to the mmap instead of using malloc for pages." Does combining the two options return a pointer directly to a place in a mmap so that this pointer could be used after a transaction ends or after the next update? I have a use case where I want to somewhat abuse LMDB safety for convenience. If I could get a pointer to a place inside a mmap I could work with LMDB value as opaque blob or as a region inside the single big mmap. This could be more convenient than creating and opening hundreds of temporary memory mapped files and keeping open handles to them. For example, Aeron terms could be stored like this: a stream id per an LMDB db and a term id for a key in the db. Thanks! Victor

2 3

parent DN and deref control
by Michael Ströder 02 Oct '15

02 Oct '15

Hmm... I have a use-case where it would be handy to use the deref control to request attributes from an entry's parent entry. But this would require kind of a pseudo-attribute 'parentDN' (similar to 'entryDN'). Anybody aware whether such a thing is already available? [1] https://tools.ietf.org/html/draft-masarati-ldap-deref-00 Nope, I don't want to use collective attributes. Ciao, Michael.

3 5

cannot delete pwdFailureTime attribute
by David Magda 01 Oct '15

01 Oct '15

Hello, How do I delete the pwdFailureTime attribute on a slave? I have a DN where pwdFailureTime entries are growing and its slowly filling up /var/lib/ldap/. Ive tried the following LDIF: dn: uid=foo,ou=People,dc=example,dc=com changetype: modify delete: pwdFailureTime But since the system is slave, its giving ldapmodify(1) a redirect to the master. I've also tried the script in ITS#8185: http://www.openldap.org/lists/openldap-bugs/201507/msg00012.html that connects to ldapi:///, and that also referral/redirects (since we have olcUpdateRef configured). We are not using the slapo-chain(5) funcionality. Is there any way to manipulate pwdFailureTime on the slaves without going into the raw databases files? Or do we have to enable slapo-chain(5) when using slapo-ppolicy(5) and then do things on the master? Thanks for any info. Regards, David

2 2

How to build contrib pw-radius?
by dev 01 Oct '15

01 Oct '15

Hi, I'm trying to build the pw-radius module in the contrib directory but can't seem to find the right library to add to the incantation. I've tried installing the freeradius-dev package as well as the libradiusclient-ng-dev but still no radlib.h. A google on the error message[1] returns *exactly* two results so I'm kind of at a loss. Can someone point me in the direction of the correct radius package to install to get this built? [1] test# gcc -shared -I../../../include -Wall -g -o pw-radius.so radius.c -lradius radius.c:27:20: fatal error: radlib.h: No such file or directory compilation terminated.

3 3

Is it possible to create something like an alias or mapping
by Christian Balz 01 Oct '15

01 Oct '15

Hi for all, We have an application that search an attribute named 'manager', however in our OpenLDAP this attribute is called 'DomainGestor'. Is it possible to create something like an alias or mapping. So, when the application is called the attribute 'manager' the ldap return the value of 'DomainGestor' DomainGestor uid=userX,cn=u,cn=users,dc=mydomain,dc=com Regards Christian

3 3

SSHA hash are stores as '{ssha}......' and '{SSHA}......'
by Matthias Apitz 30 Sep '15

30 Sep '15

Hello, We are authenticating from some Java written software against an OpenLDAP system by reading the users 'userPassword' LDAP attribute, calculating the clear text password against the SSHA hash string. It turned out that some (a few number) of these hash are stored in the form: userPassword:: e3NzaGF9R2tSOU91SGhOakFoZzBWeVNtY0JHRUE5b2NMVU5GZWZnY0VaMXc9PQ== which decodes to: $ echo 'e3NzaGF9R2tSOU91SGhOakFoZzBWeVNtY0JHRUE5b2NMVU5GZWZnY0VaMXc9PQ==' | openssl base64 -d {ssha}GkR9OuHhNjAhg0VySmcBGEA9ocLUNFefgcEZ1w== i.e. with SSHA in small letters. It's only 1 of thousand users having the tag as '{ssha}'. Why is this? Thanks matthias -- Matthias Apitz, ✉ guru(a)unixarea.de, 🌐 http://www.unixarea.de/ ☎ +49-176-38902045 No! Nein! ¡No! Όχι! -- Ευχαριστούμε!

4 4

ACL issue
by Varadi, Louis - 0442 - MITLL 30 Sep '15

30 Sep '15

Hello, I could please use your help regarding issues I am seeing with user access authenticating to my new LDAP server. I am new to LDAP, and am building my first server. I have created a new user (lou) and client (ldapServer) and am trying to authenticate the user through the client. I have configured the LDAP server to also be the LDAP test client. I am seeing the following errors in the /var/log/sssd/sssd_default.log when I run: getent passwd lou or su - lou (Fri Sep 25 16:43:15 2015) [sssd[be[default]]] [fo_resolve_service_send] (0x0100): Trying to resolve service 'LDAP' (Fri Sep 25 16:43:15 2015) [sssd[be[default]]] [sdap_get_rootdse_done] (0x0040): RootDSE could not be retrieved. Please check that anonymous access to RootDSE is allowed (Fri Sep 25 16:43:15 2015) [sssd[be[default]]] [sdap_cli_auth_step] (0x0100): expire timeout is 900 (Fri Sep 25 16:43:15 2015) [sssd[be[default]]] [fo_set_port_status] (0x0100): Marking port 389 of server 'IP_Address' as 'working' (Fri Sep 25 16:43:15 2015) [sssd[be[default]]] [set_server_common_status] (0x0100): Marking server 'IP_Address' as 'working' (Fri Sep 25 16:43:15 2015) [sssd[be[default]]] [sdap_get_generic_op_finished] (0x0040): Unexpected result from ldap: Insufficient access(50), no errmsg set (Fri Sep 25 16:43:15 2015) [sssd[be[default]]] [generic_ext_search_handler] (0x0040): sdap_get_generic_ext_recv failed [5]: Input/output error (Fri Sep 25 16:43:15 2015) [sssd[be[default]]] [sdap_get_users_done] (0x0040): Failed to retrieve users According to the doc for common-errors doc. http://www.openldap.org/doc/admin24/appendix-common-errors.html I believe I am having an issue with the Default ACLs. I have been doing much reading and am coming up short. My questions are: First: how to delete the current default ACLs using a command line entry, or using a ldapmodify on a .ldif file Second: how to add a new ACL allowing all users access using a command line entry or .ldif file. Once I get the user lou (and other test users) to connect, I will change the ACL access rules for restriction. I need to get it working first. Also, is there a step by step beginners guide for the ACL process? Any help is greatly appreciated. Thank you - Lou

2 1

Issues with Openldap upgrade 2.4.21 to 2.4.31
by Laurent Dumont 30 Sep '15

30 Sep '15

Hi gents, I'm currently trying to upgrade my "aging" Ubuntu 10.04 physical server with OpenLdap 2.4.21 to a brand new VM running 2.4.31 (which seems to be provided by default with the standard repository while being somewhat old?). That said, I'm running into a few issues. Am I correct in assuming that a standard migration would go something like this : #On the original LDAP server sudo slapcat -l /root/ldapdump #Copy that file over to the new LDAP server sudo slapadd -v -d 1 -l ldapdump Unfortunately, that's where it fails. I see : 560ade84 str2entry: invalid value for attributeType objectClass #2 (syntax 1.3.6.1.4.1.1466.115.121.1.38) slapadd: could not parse entry (line=1) It seems that I'm missing something pretty obvious here. Anyone has any pointers? Thanks

2 1

basic ldap functions
by Friedrich Locke 28 Sep '15

28 Sep '15

Hi folks! i would like to implement a simple interface ldap to connect my client programs to the sever ldap machine in my job. I would like to implement only the necessary in order to my client app to handle ldap. My listing of function goes below: 0. Connecting, disconnecting, authenticating ldap_connect, ldap_open, ldap_bind and ldap_unbind. 1. Searching and retrieving entries ldap_search, ldap_first_entry and ldap_next_entry. 2. Manipulating entries ldap_add, ldap_modify, ldap_modrdn, ldap_delete and ldap_compare. What are the RFC for this function (of course i will implement in ANSI C) ? How to organize data to be sent to the ldap server ? How to decode the data from the ldap server ? etc ..... Thanks a lot for your time and cooperation. Best regards, Fried.

3 2

Net::LDAPapi syncrepl working only intermittently in 2.4.42
by Nat Sincheler 28 Sep '15

28 Sep '15

I have Perl script that implements a syncrepl listener using the listen_for_changes method from Net::LDAPapi (3.0.3). The listener works well with OpenLDAP 2.4.40 but I am having trouble getting it to work consistently with 2.4.42. The code looks something like this: # $LDAP is bound using GSSAPI my $msgid = $LDAP->listen_for_changes( -basedn => "cn=accesslog", -scope => LDAP_SCOPE_SUBTREE, -filter => "objectclass=*", -cookie => "/var/run/sync.cookie"); while (1) { my @entries; while (@entries = $LDAP->next_changed_entries($msgid, 0, -1))) { ... } Most of the time (but not _all_ of the time) the listener fails to pick up any entries from the accesslog and I see these messages in my logs: 2015-09-09T08:32:20.926931-07:00 ldap-jessie0 slapd[631]: conn=1161 op=4 SEARCH RESULT tag=101 err=2 nentries=0 text=Sync control : mode decoding error 2015-09-09T08:32:20.927211-07:00 ldap-jessie0 slapd[631]: conn=1161 op=4 do_search: get_ctrls failed (Fuller log output included below). I know that the credentials can read the access log as I run a simple search against cn=accesslog before the list_for_changes just to be sure the issue is not related to my credentials. What does "Sync control : mode decoding error" mean? Any suggestions on next steps for troubleshooting? #################################################################### 2015-09-09T08:32:20.902032-07:00 ldap-jessie0 slapd[631]: conn=1161 fd=14 ACCEPT from IP=171.67.214.66:39646 (IP=0.0.0.0:389) 2015-09-09T08:32:20.902108-07:00 ldap-jessie0 slapd[631]: conn=1161 op=0 SRCH base="" scope=0 deref=0 filter="(objectClass=*)" 2015-09-09T08:32:20.902207-07:00 ldap-jessie0 slapd[631]: conn=1161 op=0 SRCH attr=supportedSASLMechanisms 2015-09-09T08:32:20.902262-07:00 ldap-jessie0 slapd[631]: conn=1161 op=0 SEARCH RESULT tag=101 err=0 nentries=1 text= 2015-09-09T08:32:20.910842-07:00 ldap-jessie0 slapd[631]: conn=1161 op=1 BIND dn="" method=163 2015-09-09T08:32:20.914261-07:00 ldap-jessie0 slapd[631]: conn=1161 op=1 RESULT tag=97 err=14 text=SASL(0): successful result: mech EXTERNAL is too weak 2015-09-09T08:32:20.917754-07:00 ldap-jessie0 slapd[631]: conn=1161 op=2 BIND dn="" method=163 2015-09-09T08:32:20.917798-07:00 ldap-jessie0 slapd[631]: conn=1161 op=2 RESULT tag=97 err=14 text=SASL(0): successful result: mech EXTERNAL is too weak 2015-09-09T08:32:20.918060-07:00 ldap-jessie0 slapd[631]: conn=1161 op=3 BIND dn="" method=163 2015-09-09T08:32:20.918102-07:00 ldap-jessie0 slapd[631]: conn=1161 op=3 BIND authcid="service/ldap-jessie0(a)stanford.edu" authzid="service/ldap-jessie0(a)stanford.edu" 2015-09-09T08:32:20.918188-07:00 ldap-jessie0 slapd[631]: conn=1161 op=3 BIND dn="cn=ldap-jessie0,cn=service,cn=applications,dc=stanford,dc=edu" mech=GSSAPI sasl_ssf=56 ssf=56 2015-09-09T08:32:20.918240-07:00 ldap-jessie0 slapd[631]: conn=1161 op=3 RESULT tag=97 err=0 text= 2015-09-09T08:32:20.926931-07:00 ldap-jessie0 slapd[631]: conn=1161 op=4 SEARCH RESULT tag=101 err=2 nentries=0 text=Sync control : mode decoding error 2015-09-09T08:32:20.927211-07:00 ldap-jessie0 slapd[631]: conn=1161 op=4 do_search: get_ctrls failed

3 5

unique contraint bypassed by java modify (and correctly enforced by pytho/ldapmodify)
by Alessandro Dentella 28 Sep '15

28 Sep '15

Hi, i have been stryggling with a unique contraint that i being constrantly bypassed by a java script. I setup the ldap server and unique layer and I virified that the uniquened on a field is correctly enforce using ldapmodify, ldapvi, python and one more widget tool. There is a java program I have not written (I don't know java) that constantly bypasses the constraint and I can't really understand how it can. It seems to perform the same operation I do: given an existing item, change mail field. What can it be that is different from one and the other situation? All programs connect with simple authentication + tls. Thanks for any possible hints sandro *:-) PS: I thought to bypass this problem switching to back-sql + PostgreSQL so that I openned up to other problems, subject of a separate email...

5 6

OS X Yosemite clients
by oldap＠mountainlake.k12.mn.us 25 Sep '15

25 Sep '15

I am not able to authenticate users on OS X Yosemite (10.10.5) using OpenLDAP on a Linux server running slapd 2.4.40. This has worked with other versions (10.9, 10.7, etc) going back a very long time. The logs and other tests (such as "id user") show that it is successfully accessing the LDAP data. It just won't authenticate with the password. Has anyone successfully transitioned from OS 10.9 to 10.10 Yosemite with respect to authenticating off of OpenLDAP? What is the best forum for me to start digging into this problem? -- Jon

1 0

back-sql: trasnlating examples from slapd.cong to slapd.d
by Alessandro Dentella 25 Sep '15

25 Sep '15

Hi, I'm trying to configure slapd with back-sql (specifically postgresql backend). All documents I found (Postgresq LDAP Howto seems to be more complete) are related to old configuration that use slapd.conf while I need to use the news slapd.d dynamic one. I can't understand how I should add the entry in the configuration. What I currenty tried is: dn: olcDatabase={1}sql,cn=config objectClass: olcDatabaseConfig objectClass: olcSqlConfig olcSuffix: dc=vega,dc=com olcDatabase: sql olcDbName: mytest But when I run ldapmify I get the error: root@argo-jessie:~# ldapmodify -x -D cn=admin,cn=config -W -f ,ldapvi-argo-jessie-7228.ldif Enter LDAP Password: adding new entry "olcDatabase={1}sql,cn=config" ldap_add: Other (e.g., implementation specific) error (80) additional info: <olcSuffix> failed startup And at 254 debugLevel I get: Sep 23 16:34:18 localhost slapd[5650]: olcSuffix: value #0: <olcSuffix> failed startup (dc=vega,dc=com)! Sep 23 16:34:18 localhost slapd[5650]: send_ldap_result: err=80 matched="" text="<olcSuffix> failed startup" I'm making the test on Debian Jessie with slapd versione 2.4.40 sandro *:-) I opended a question on serverfault: http://serverfault.com/questions/724329/slapd-configuration-for-back-sql-ho… -- Sandro Dentella *:-) http://www.reteisi.org Soluzioni libere per le scuole http://sqlkit.argolinux.org SQLkit home page - PyGTK/python/sqlalchemy

2 1

ACLs whont work
by Fischer, Johannes 23 Sep '15

23 Sep '15

Hi @all, I struggle with the ACLs, I whant a special account to check the username and PW of the entries on the LDAP-server. Therefore I’ve written the following in the slapd.conf file: access to attrs=userPassword by dn="cn=authenticate,dc=vfk,dc=ldap,dc=com" write by self write by anonymous none access to * by * write by anonymous none But I can’t authenticate to the LDAP server, does somebody know why? Greetings John

4 4

Translucent overlay search fails with TLS "cannot find private key for certificate"
by Ernie Kovak 22 Sep '15

22 Sep '15

Hello - I'm running openldap 2.4.39 on centos 7, using the translucent overlay and moznss for connections to the backend Active Directory server. When I issue a search request for users in the backend directory I get no results and a "server not available" error - see the debug output below. The same slapd.conf configuration, but on centos 5.10 and using OpenSSL, works correctly. So, I imagine it's related to moznss. I've verified (firewall logs) that openldap successfully connects to the backend on startup, but not when the search request is submitted. It looks like it's trying to use client-authenticated TLS, even though the backend is not set up for that?? Any ideas? Thanks! Ernie =============================================================================================== slapd.conf =============================================================================================== include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/ppolicy.schema include /etc/openldap/schema/we_person_and_npe.schema pidfile /var/run/openldap/slapd.pid loglevel stats #loglevel -1 #loglevel trace conns filter stats # Path to dynamic modules: modulepath /usr/lib64/openldap moduleload back_mdb moduleload back_ldap moduleload translucent moduleload accesslog moduleload auditlog moduleload valsort moduleload ppolicy moduleload memberof # TLS server certs (TLS client config is in ldap.conf) #TLSCACertificateFile /opt/acme/global/certs/ca/ca.pem #TLSCertificateFile /opt/acme/global/certs/server-cert.pem #TLSCertificateKeyFile /opt/acme/global/certs/server-key.pem # not working in our docker container since openldap is linked against NSS and not OpenSSL #TLSCipherSuite TLSv1.2+FIPS:kRSA+FIPS:!eNULL:!aNULL:!SSLv2 # path of the directory containing the NSS certificate and key database files TLSCACertificatePath /opt/acme/local/certs/nssdb/ # specifies the name of the certificate to use TLSCertificateFile server # name of a file that contains the password for the key for the certificate specified with TLSCertificateFile TLSCertificateKeyFile /opt/acme/local/certs/.nss_tmp_pwd (contains clear text pasword for keystore and server cert private key) access to dn.base="" by * read access to dn.base="cn=Subschema" by * read access to attrs=clearance,citizenship,sciControl by dn="cn=npe-user-mgmt,ou=NPEs,ou=Native,dc=acme,dc=com" write by dn="cn=npe-sts,ou=NPEs,ou=Native,dc=acme,dc=com" read access to attrs=gimmeeOrg,gimmeeRegion,gimmeeTopic,gimmeeIsAICP,gimmeeGroup,gimmeeProject,gimmeeProjectGroup by dn="cn=npe-user-mgmt,ou=NPEs,ou=Native,dc=acme,dc=com" write by dn="cn=npe-sts,ou=NPEs,ou=Native,dc=acme,dc=com" read access to attrs=UUID by dn="cn=npe-user-mgmt,ou=NPEs,ou=Native,dc=acme,dc=com" write by users read access to attrs=userPassword by dn="cn=npe-user-mgmt,ou=NPEs,ou=Native,dc=acme,dc=com" write by self write by anonymous auth access to attrs=currentLoginDate,lastLoginDate,lastFailedLoginDate,currentLoginIpAddr,lastLoginIpAddr,lastFailedLoginIpAddr by dn="cn=npe-user-mgmt,ou=NPEs,ou=Native,dc=acme,dc=com" write by dn="cn=npe-openid,ou=NPEs,ou=Native,dc=acme,dc=com" write by users read access to * by dn="cn=npe-user-mgmt,ou=NPEs,ou=Native,dc=acme,dc=com" write by users read by anonymous auth ####################################################################### # Database for Native accounts (NPEs and users) ####################################################################### database mdb suffix "ou=Native,dc=acme,dc=com" rootdn "cn=weAdmin,dc=acme,dc=com" directory "/opt/acme/global/data/openldap/db/native-user-db" subordinate index objectClass eq,pres index ou,cn,mail,surname eq,pres,sub index clearance,scicontrol eq,pres,sub index citizenship eq,pres,sub password-hash {SSHA} # Apply password policy overlay to Native accounts, with a default policy. overlay ppolicy ppolicy_default "cn=default,ou=Policies,ou=Native,dc=acme,dc=com" ppolicy_use_lockout ppolicy_hash_cleartext ####################################################################### # Database for additional attributes for enterprise accounts. ####################################################################### database mdb suffix "dc=acme,dc=com" rootdn "cn=weAdmin,dc=acme,dc=com" rootpw {SSHA}73M5MnfH97O8KAN8anAbneD2wf0C6VSg directory "/opt/acme/global/data/openldap/db/enterprise-user-db" index objectClass eq,pres index ou,cn,mail,surname eq,pres,sub index clearance,scicontrol eq,pres,sub index citizenship eq,pres,sub ####################################################################### # Translucent LDAP proxy to Active Directory ####################################################################### overlay translucent uri "ldaps://atlas.acme.com:636" chase-referrals no idassert-bind bindmethod=simple binddn="cn=devadmin,ou=Users,ou=System Accounts,ou=Acme,dc=acme,dc=com" credentials="******" mode=none tls_cacert=/opt/acme/global/certs/ca/gd-class2-root-2.pem tls_reqcert=demand # Attributes to be searched for in local database. Only the classes that # apply to proxied accounts are candidates for translucent_local: # local wePerson attributes: translucent_local objectClass translucent_local UUID,accountStatus translucent_local rank,grade,position,command,agency translucent_local DSN translucent_local weGrp,weOrg translucent_local clearance,citizenship,scicontrol # wePerson attributes pulled from remote directory: translucent_remote objectClass translucent_remote cn,givenName,sn,mail,o,mobile translucent_remote displayName,sAMAccountName,userPrincipalName =============================================================================================== >From output when setting SLAPD_OPTIONS="-d 65535" =============================================================================================== <snip> loads slapd.conf 55f854a6 config_build_entry: "olcDatabase={2}mdb" 55f854a6 config_build_entry: "olcOverlay={0}translucent" 55f854a6 ==> translucent_cfadd 55f854a6 config_build_entry: "olcDatabase={0}ldap" 55f854a6 config_build_entry: "olcOverlay={1}glue" 55f854a6 backend_startup_one: starting "ou=Native,dc=acme,dc=com" 55f854a6 mdb_db_open: "ou=Native,dc=acme,dc=com" 55f854a6 mdb_db_open: database "ou=Native,dc=acme,dc=com": dbenv_open(/opt/acme/global/data/openldap/db/native-user-db). 55f854a6 mdb_monitor_db_open: monitoring disabled; configure monitor database to enable 55f854a6 backend_startup_one: starting "dc=acme,dc=com" 55f854a6 mdb_db_open: "dc=acme,dc=com" 55f854a6 mdb_db_open: database "dc=acme,dc=com": dbenv_open(/opt/acme/global/data/openldap/db/enterprise-user-db). 55f854a6 ==> translucent_db_open 55f854a6 backend_startup_one: starting "dc=acme,dc=com" 55f854a6 ldap_back_db_open: URI=ldaps://atlas.acme.com:636 55f854a6 ldap_back_monitor_db_open: monitoring disabled; configure monitor database to enable 55f854a6 slapd starting <snip> 55f876ea ==> translucent_search: <dc=acme,dc=com> (sAMAccountName=admin) ldap_create ldap_url_parse_ext(ldaps://atlas.acme.com:636) 55f876ea =>ldap_back_getconn: conn=1000 op=1: lc=0x7f3e581a9950 inserted refcnt=1 rc=0 ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP atlas.acme.com:636 55f876ea daemon: activity on 1 descriptor 55f876ea daemon: activity on:55f876ea 55f876ea daemon: epoll: listen=6 active_threads=0 tvp=NULL 55f876ea daemon: epoll: listen=7 active_threads=0 tvp=NULL ldap_new_socket: 17 ldap_prepare_socket: 17 ldap_connect_to_host: Trying 172.12.3.45:636 ldap_pvt_connect: fd: 17 tm: -1 async: 0 attempting to connect: connect success TLS: certdb config: configDir='/opt/acme/local/certs/nssdb/' tokenDescription='ldap(1)' certPrefix='' keyPrefix='' flags=readOnly TLS: using moznss security dir /opt/acme/local/certs/nssdb/ prefix . TLS: loaded CA certificate file /opt/acme/global/certs/ca/gd-class2-root-2.pem. TLS: certificate 'server' successfully loaded from moznss database. TLS: no unlocked certificate for certificate 'CN=mv22.acme.com ,OU=Development,O=Acme,L=Denver,ST=Colorado,C=US'. TLS: cannot find private key for certificate 'CN=mv22.acme.com,OU=Development,O=Acme,L=Denver,ST=Colorado,C=US' (error -12285: Unable to find the certificate or key necessary for authentication.) TLS: error: unable to set up client certificate authentication for certificate named CN=mv22.acme.com ,OU=Development,O=Acme,L=Denver,ST=Colorado,C=US TLS: error: unable to set up client certificate authentication using 'CN= mv22.acme.com,OU=Development,O=Acme,L=Denver,ST=Colorado,C=US' TLS: error: could not initialize moznss security context - error -12285:Unable to find the certificate or key necessary for authentication. TLS: can't create ssl handle. 55f876ea send_ldap_result: conn=1000 op=1 p=3 55f876ea send_ldap_result: err=52 matched="" text="Proxy operation retry failed"

1 2

funny error
by Fischer, Johannes 22 Sep '15

22 Sep '15

Hi, I’ve just had some funny moments with openldap. I had some bad written code (from my self ☺) where I’ve tried to set a description (2.5.4.13) attribute with an empty string (“”). The result was a error massage: description: value #0 invalid per syntax the best Thing about that is, that the Spring security framework interpreted the error for a following Boolean attribute. This is only for your amusement and to help other with similar problems Greetings John

2 1

seg faults with slapd and libc?
by jason cafarelli 19 Sep '15

19 Sep '15

Hello, centos 6.5 with a basic slapd setup; internal LDAP and proxy to external LDAP Getting segaults every 6 hours or so when I let QA on system and generate some typical user load. All 32 threads halt; ldapsearch stops responding. Typically no logs; last one dropped this: ie: Sep 18 07:47:58 maryann2 kernel: slapd[53754]: segfault at 7f3083ffff98 ip 00007f3104cc3532 sp 00007f30a5ff9660 error 6 in libc-2.12.so [7f3104c4a000+18b000] Should i just sledgehammer a yum update and get off centos 6.5? *Jason K Cafarelli* Desk: (508) 637-5705 (primary) Mobile: (508) 215-9712 jason.cae(a)gmail.com

2 2

HDB compared with LMDB
by Philip Colmer 17 Sep '15

17 Sep '15

We're currently using OpenLDAP 2.4.38 on our production server using HDB as the database type. I wanted to upgrade to the latest version and take advantage of LMDB as the database type so I've built a second server and transferred the data. Before making that server the production server, we're running performance comparisons, using ldclt[1] as a stress test tool. I don't know if anyone else has got any experience of using this tool; the output we're getting when running the tool doesn't show significant differences in performance, but I'm not sure if it is just the test type we're running or the fact that, actually, we shouldn't be expecting significant differences ... I've included the output below. I've removed the details of our servers from the command line. Can someone who has made a transition from HDB to LMDB give an indication of whether or not we should see a performance difference on LDAP queries and, if yes, by what sort of factor? If you are familiar with ldclt, should we be running different tests to get a better insight into how the two servers compare? Thanks. Philip [1] http://docs.oracle.com/cd/E19957-01/816-6400-10/ldclt.html 2.4.38 with HDB: ldclt -f uid=testXXXXX -e esearch,random -r0 -R99999 -I 32 ldclt version 4.23 ldclt[1979]: Starting at Thu Sep 17 11:28:51 2015 ldclt[1979]: Average rate: 109.70/thr ( 109.70/sec), total: 1097 ldclt[1979]: Average rate: 114.80/thr ( 114.80/sec), total: 1148 ldclt[1979]: Average rate: 115.00/thr ( 115.00/sec), total: 1150 ldclt[1979]: Average rate: 111.90/thr ( 111.90/sec), total: 1119 ldclt[1979]: Average rate: 115.20/thr ( 115.20/sec), total: 1152 ldclt[1979]: Average rate: 114.80/thr ( 114.80/sec), total: 1148 ldclt[1979]: Average rate: 113.70/thr ( 113.70/sec), total: 1137 ldclt[1979]: Average rate: 111.20/thr ( 111.20/sec), total: 1112 ldclt[1979]: Average rate: 114.80/thr ( 114.80/sec), total: 1148 ldclt[1979]: Global average rate: 1021.10/thr (113.46/sec), total: 10211 2.4.41 with MDB: ldclt -f uid=testXXXXX -e esearch,random -r0 -R99999 -I 32 ldclt version 4.23 ldclt[1967]: Starting at Thu Sep 17 11:26:55 2015 ldclt[1967]: Average rate: 109.70/thr ( 109.70/sec), total: 1097 ldclt[1967]: Average rate: 111.00/thr ( 111.00/sec), total: 1110 ldclt[1967]: Average rate: 112.20/thr ( 112.20/sec), total: 1122 ldclt[1967]: Average rate: 113.00/thr ( 113.00/sec), total: 1130 ldclt[1967]: Average rate: 112.70/thr ( 112.70/sec), total: 1127 ldclt[1967]: Average rate: 112.50/thr ( 112.50/sec), total: 1125 ldclt[1967]: Average rate: 113.00/thr ( 113.00/sec), total: 1130 ldclt[1967]: Average rate: 112.80/thr ( 112.80/sec), total: 1128 ldclt[1967]: Average rate: 112.30/thr ( 112.30/sec), total: 1123 ldclt[1967]: Average rate: 112.90/thr ( 112.90/sec), total: 1129 ldclt[1967]: Global average rate: 1122.10/thr (112.21/sec), total: 11221

2 2

ldap_result timeout not working?
by Ilja Maki 17 Sep '15

17 Sep '15

Hi, What am I missing as the ldap_result function does not seem to care at all about the timeout value given to it? I would need polling behavior and I have tried to give it a timeval of zero, 2 seconds and other small values but often it does not return until over a minute has passed. I have also tried to call ldap_set_option( m_ldap, LDAP_OPT_TIMEOUT, &timeout ) first where the timeout has been zero, 2 seconds etc. but it does not have any effect either. Sometimes ldap_result takes very long also after a call to ldap_simple_bind but usually this happens after a call to ldap_search_ext. Also abandoning a lengthy ldap_result operation is not an option as ldap_result will throw an access violation if it is given an abandoned message identifier. And without access to the internals of the ldap library I cannot synchronize the abandoning so that it would take place only after ldap_result has proceeded so far that it is ok for it to abandon the identifier. My code used OpenLDAP version 1.168.2.16 where this issue occurred, then I upgraded it to version 2.4.42 to see if it behaves differently (with #define LDAP_DEPRECATED 1 for now for simplicity) but the same issue seems to be there. I am developing and testing with Windows 8.1 but the same issue is also at least in Mac OS. Any help will be greatly appreciated. Thanks! - Ilja -- Learn why you should attend BroadSoft Connections 2015 <http://www.broadsoftconnections.com> This email is intended solely for the person or entity to which it is addressed and may contain confidential and/or privileged information. If you are not the intended recipient and have received this email in error, please notify BroadSoft, Inc. immediately by replying to this message, and destroy all copies of this message, along with any attachment, prior to reading, distributing or copying it.

1 0

Strange aliases behavior
by Karol Chrapek 17 Sep '15

17 Sep '15

I have a problem with Slapd and Alias dereferencing. In the ldap we have created a special subtree that allocate logical structure for our application. For this purpose we use the aliases. They allow us in one subtree have normal structure used by our internal services and for second subtree has a dedicate logical structure for special apps. Currently we tested different version of ldap: - 2.4.28 with HDB - 2.4.31 with HDB and MBD - 2.4.41 with mdb - 2.4.42 with MDB <--- this version we are currently using On all version the dereferencing aliases is works very fast when we have about 2000 aliases and about 200000 entries in the Database. When we add additional 2000 aliases each search with aliases dereferencing hangs for 3 second. When we add additional 2000 (so 6000 alieases in DB) the search time increase for next 3 seconds. I.E. search time for filter objectclass=user with -a always for: -2000 aliases in DB is about 0,031s -4000 aliases in DB is about 3,031s -6000 aliases in DB is about 6,123s And this search time was increase even if we add additional 2000 aliases outside the search base dn. We observed that during this 3, 6 second hangs one CPU core is about 100%, system does not wait for resources, memory is on the same level. In the log I saw that slapd very fast dereferencing all aliases in subtree, hang for 3,6,9 seconds depends of aliases count and after that I saw: mdb_dn2entry("cn=.....") Sep 4 14:53:50 ds1 slapd[4280]: => mdb_dn2id("cn=....") Sep 4 14:53:50 ds1 slapd[4280]: <= mdb_dn2id: got id=0x231 Sep 4 14:53:50 ds1 slapd[4280]: => mdb_entry_decode: Sep 4 14:53:50 ds1 slapd[4280]: <= mdb_entry_decode Sep 4 14:53:50 ds1 slapd[4280]: => mdb_filter_candidates Sep 4 14:53:50 ds1 slapd[4280]: #011OR Sep 4 14:53:50 ds1 slapd[4280]: => mdb_list_candidates 0xa1 Sep 4 14:53:50 ds1 slapd[4280]: => mdb_filter_candidates Sep 4 14:53:50 ds1 slapd[4280]: #011EQUALITY Sep 4 14:53:50 ds1 slapd[4280]: => mdb_equality_candidates (objectClass) Sep 4 14:53:50 ds1 slapd[4280]: => key_read Sep 4 14:53:50 ds1 slapd[4280]: <= mdb_index_read: failed (-30798) Sep 4 14:53:50 ds1 slapd[4280]: <= mdb_equality_candidates: id=0, first=0, last=0 Sep 4 14:53:50 ds1 slapd[4280]: <= mdb_filter_candidates: id=0 first=0 last=0 Sep 4 14:53:50 ds1 slapd[4280]: => mdb_filter_candidates Sep 4 14:53:50 ds1 slapd[4280]: #011EQUALITY Sep 4 14:53:50 ds1 slapd[4280]: => mdb_equality_candidates (objectClass) Sep 4 14:53:50 ds1 slapd[4280]: => key_read Sep 4 14:53:50 ds1 slapd[4280]: <= mdb_index_read 3585 candidates Sep 4 14:53:50 ds1 slapd[4280]: <= mdb_equality_candidates: id=3585, first=18960, last=239706 Sep 4 14:53:50 ds1 slapd[4280]: <= mdb_filter_candidates: id=3585 first=18960 last=239706 Sep 4 14:53:50 ds1 slapd[4280]: <= mdb_list_candidates: id=3585 first=18960 last=239706 Sep 4 14:53:50 ds1 slapd[4280]: <= mdb_filter_candidates: id=3585 first=18960 last=239706 Sep 4 14:53:50 ds1 slapd[4280]: mdb_search_candidates: id=3585 first=18960 last=239706 Sep 4 14:53:50 ds1 slapd[4280]: => mdb_entry_decode: Sep 4 14:53:50 ds1 slapd[4280]: <= mdb_entry_decode Sep 4 14:53:50 ds1 slapd[4280]: => test_filter Sep 4 14:53:50 ds1 slapd[4280]: EQUALITY Sep 4 14:53:50 ds1 slapd[4280]: => access_allowed: search access to "cn......." "objectClass" requested Sep 4 14:53:50 ds1 slapd[4280]: <= root access granted After that ldap start return object that is also very fast. When the query was finished I saw in log this info: Sep 4 14:53:50 ds1 slapd[4280]: mdb_search: 18985 scope not okay Sep 4 14:53:50 ds1 slapd[4280]: mdb_search: 18986 scope not okay All other query that not derf. aliases are processed very fast. Search time about 32k entries in subtree without aliases is about 0,526s. Our server DB and indexing settings: maxsize 10737418240 checkpoint 1024 10 sizelimit 100000 maxderefdepth 2 searchstack 10 index accountid eq index objectClass eq index cn eq index id eq index name eq index entryCSN eq index entryUUID eq Do you have any idea how we can tune search with aliases? Regards Karol

3 3

OpenLDAP wildcard searches.
by Michael 16 Sep '15

16 Sep '15

Hello all, I've come across an issue where java developers using one of our LDAP environments want to be able to do wildcard searches on non-standard LDAP attributes. They are using a custom schema in the LDAP environment which contains the following attributes for example. retailerId:jurisdictionID: They want to be able to perform the following search filter to pull all entries with 21 as the jurisdictionID and any wildcard for the retailerID. '(&(retailerId=*)(jurisdictionID=21))' works as expected but of course this returns all objects with any retailerID. They would like to narrow the search results using the filters below. Is there something that needs to be added to the custom schema to allow this to work like it does for the standard LDAP attributes like cn,sn,mail etc? '(&(retailerId=177*)(jurisdictionID=21))' returns zero results'(&(retailerId=*389)(jurisdictionID=21))' returns zero results'(&(retailerId=1*389)(jurisdictionID=21))' returns zero results

5 9

Configuring OpenLDAP server with Linux groups information
by JC 15 Sep '15

15 Sep '15

I have a CentOS system where authentication over the SSH interface is delegated to an OpenLDAP server by means of PAM. This works fine. However, when the authentication succeeds, I would like for the OpenLDAP server to send back group information as well to the CentOS system. That is, the OpenLDAP server should send back a list of groups that the authenticated user will belong to when a shell is created for it in the CentOS box. This information should supersede what groups information local to the CentOS box. I have an LDAP schema in the OpenLDAP server system that almost achieves what I want - but not quite. In the CentOS system I currently have a file named mysite.ldif with the following contents: # extended LDIF## LDAPv3# base <dc=mysite,dc=com> with scope subtree# filter: (objectclass=*)# requesting: ALL# # mysite.comdn: dc=mysite,dc=comobjectClass: topobjectClass: dcObjectobjectClass: organizationo: MySitedc: mysite # People, mysite.comdn: ou=People,dc=mysite,dc=comou: PeopleobjectClass: organizationalUnit # Group, mysite.comdn: ou=Group,dc=mysite,dc=comou: GroupobjectClass: organizationalUnit # firstgroup, Group, mysite.comdn: cn=firstgroup,ou=Group,dc=mysite,dc=comobjectClass: posixGroupobjectClass: topcn: onegroupuserPassword:: e2NyeXB0fXg=gidNumber: 1001memberUid: FirstUsermemberUid: SecondUser # secondgroup, Group, mysite.comdn: cn=secondgroup,ou=Group,dc=mysite,dc=comobjectClass: posixGroupobjectClass: topcn: twogroupuserPassword:: e2NyeXB0fXg=gidNumber: 1002memberUid: FirstUser # FirstUser, People, mysite.comdn: uid=FirstUser,ou=People,dc=mysite,dc=comuid: FirstUsercn: FirstUserobjectClass: accountobjectClass: posixAccountobjectClass: topobjectClass: shadowAccountshadowLastChange: 14250shadowMax: 99999shadowWarning: 7loginShell: /bin/bashuidNumber: 1014gidNumber: 1014homeDirectory: /home/FirstUsergecos: ,,,userPassword:: TXlQYXNzd29yZAo= # SecondUser, People, mysite.comdn: uid=SecondUser,ou=People,dc=mysite,dc=comuid: SecondUsercn: SecondUserobjectClass: accountobjectClass: posixAccountobjectClass: topobjectClass: shadowAccountshadowLastChange: 14002shadowMax: 99999shadowWarning: 7loginShell: /bin/bashuidNumber: 1005gidNumber: 1005homeDirectory: /home/SecondUsergecos: ,,,userPassword:: T3RoZXJQYXNzd29yZAo= After starting my OpenLDAP server, I load this information into the OpenLDAP server's database with ldapadd -D uid=root,ou=People,dc=mysite,dc=com -x -w ThePassword -f mysite.ldif Now assuming that LDAP authentication is enabled in the Linux server, and that PAM in this system will delegate its authentication to the OpenLDAP server above, the authentication works fine (assuming the correct password is entered, of course) but the groups information does not seem to be extracted correctly. After successfully logging in as users FirstUser, if from the command line I invoke groups FirstUser I get the following output: FirstUser : user onegroup onegroup twogroup twogroup I do not understand why 'onegroup' and 'twogroup' are repeated. For completeness, the /etc/nsswitch.conf file in the CentOS system contains (among other things) the following line: group: ldap [SUCCESS=return] files Any feedback on this issue will be welcome. It should be clear by now that I am not, by any means, an expert on things LDAP; my apologies if I am doing something stupid or misguided.

2 1

Re: ldapmodrdn accented characters with windows client
by Michael Ströder 14 Sep '15

14 Sep '15

LAROCHETTE Philippe wrote: > i don't know if it is a utf8 problem because i make several tests with some utf8 conversion with notepad++ of the .bat script file or of the ldiff file and nothing work exept the replacement of the character by the escape sequence \c3\a9 > > The problem is the same in windows Seven... > > The application is an access process that produce some ldif files that are launched with a .bat file, a solution is to move the script process of the ldif files on the linux plateform but other process are managed with windows server planified tasks.. but it is a solution... > > I found a solution, it's working if i use ldapmodify with -f and use "newrdn" and "new superior" in the ldif file... i encode the ldif file in UTF-8 without BOM > > Thank you for the idea of iconv, i try the same thing with notepad++ and now it's working, the problem was the difference between UTF8 withous BOM and UTF8 for the encoding. > > UTF8 without BOM it's ok but the native format UTF8 of the basic windows notepad don't work. The best solution for such issues is not to muck around with command-line tools but to use a full-blown scripting language with a decent LDAP module. Ciao, Michael.

1 0

OpenLDAP error - ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)
by Varadi, Louis - 0442 - MITLL 14 Sep '15

14 Sep '15

Hello, I am new to OpenLDAP and could please use your help. I just created a brand new install of the latest OpenLDAP server - openldap-ltb.x86_64 0:2.4.42-1.el6 on Centos 6.7 There are no entries in the bdb database as this is a new install. I am getting the error when running to following command. ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) # ldapsearch -x -d 1 -LLL ldap_create ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP localhost:389 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying ::1 389 ldap_pvt_connect: fd: 3 tm: -1 async: 0 attempting to connect: connect errno: 111 ldap_close_socket: 3 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 127.0.0.1:389 ldap_pvt_connect: fd: 3 tm: -1 async: 0 attempting to connect: connect errno: 110 ldap_close_socket: 3 ldap_err2string ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) Any help would be greatly appreciated. I came up very short with my google searches. Thank you - Lou

3 4

uniqueness unique_uri specification help
by Peter Heinemann 14 Sep '15

14 Sep '15

Good Day, openldap 2.4.39 RHEL 6.5 Working with an ldap implementation that builds the dit from scratch daily using extracts from an RDBMS. The nature of the source data/tables and the code that creates the extracts builds an ldif (imported via slapadd) that has some multi-value attributes, specifically cn, sn, and givenName because the RDBMS does no case checking. Stanzas like this can occur in the ldif: dn: uid=aperson,ou=people,dc=school,dc=edu cn: Andrew Person cn: ANDREW PERSON sn: Person sn: PERSON givenName: Andrew givenName: ANDREW and slapadd will happily write them all, but ldapmodify etc. can (and do) return errors when encountering these entries. What I'd like to do is use ldapadd under the uniqueness overlay instead of slapadd. But I'm unsure of the specific syntax for the unique_uri specification so that that cn, sn, and givenName attributes are unique under/in each DN. Most of the examples I've found are how to enforce uniqueness over an entire branch. Still reading the specifics about uri specification but would appreciate any assistance. Peter

2 1

Building OpenLDAP for Windows
by Ilja Maki 14 Sep '15

14 Sep '15

Hi, I have googled and browsed your mailing list archives for instructions on how to build OpenLDAP for Windows but haven’t found any up-to-date information on it. Is such a thing still supported? I found out that at least Visual Studio workspace files were dropped away some years and versions ago. I would need an OpenLDAP lib that can be linked by Visual Studio 2013 (and probably by later VS versions in the future). I have Windows 8.1, Cygwin 1.7.35(0.287/5/3) and MinGW. I have tried to do according to this: http://www.openldap.org/faq/data/cache/897.html but ran into issues already in the ./configure phase (btw, it says “WARNING: unrecognized options: --disable-slurpd”). The final error in running that is this: configure: error: select() required. I’m not familiar with Unixes but Google told me that select() is a native Unix command. Is that correct and if so, what should I do with a Windows machine to handle that? Or should I do the whole building task according to some completely different instructions? I need only the client side of OpenLDAP. Thanks for any help in advance! Ps. Just in case it matters, this is the corresponding part extracted from my config.log: | /* Override any GCC internal prototype to avoid an error. | Use char because int might match the return type of a GCC | builtin and then its argument prototype would still apply. */ | #ifdef __cplusplus | extern "C" | #endif | char select (); | /* The GNU C library defines this for functions which it implements | to always fail with ENOSYS. Some functions are actually named | something starting with __ and the normal name is an alias. */ | #if defined __stub_select || defined __stub___select | choke me | #endif | | int | main () | { | return select (); | ; | return 0; | } configure:14150: result: no configure:14154: error: select() required. -- Learn why you should attend BroadSoft Connections 2015 <http://www.broadsoftconnections.com> This email is intended solely for the person or entity to which it is addressed and may contain confidential and/or privileged information. If you are not the intended recipient and have received this email in error, please notify BroadSoft, Inc. immediately by replying to this message, and destroy all copies of this message, along with any attachment, prior to reading, distributing or copying it.

4 5

Re: send_search_entry: conn xxx ber write failed
by Édnei Rodrigues 10 Sep '15

10 Sep '15

Hey Quanah, thank you for your answer. I will ask to application team to update openldap client. Regards. Em 10/09/2015 15:19, "Quanah Gibson-Mount" <quanah(a)zimbra.com> escreveu: > --On Thursday, September 10, 2015 1:04 PM -0300 Édnei Rodrigues < > ednei.felipe.rodrigues(a)gmail.com> wrote: > > >> Good morning. How are you doing ? >> >> Guys, I have a application that do many connections to my ldap server and >> I am getting the error "send_search_entry: conn xxx ber write failed." >> and "(connection lost on write)". >> >> This error occur only with that application, but The noise is large, >> because this one is very importante. >> >> > So, Do this message mean a problem with my LDAP Server? Will I need >> deploy a other LDAP server and balance these connections ? >> > > IIRC, this generally occurs when a client has disconnected w/o telling the > server it has done so. I.e., this is caused by the client, not the server. > > --Quanah > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

2.4.42 RPMs for openSUSE
by Michael Ströder 10 Sep '15

10 Sep '15

HI! I've updated my OpenLDAP builds for openSUSE and SLES12 to release 2.4.42. Build status and files: <https://build.opensuse.org/package/show/home:stroeder:branches:network:ldap…> Important note: If you're using the openldap packages shipped with openSUSE make sure to read the .changes files to see whether something could break your current setup. As usual I've tested the packages openSUSE Tumbleweed x86_64 and Factory_ARM on rasperry pi. The download repos are here: <http://download.opensuse.org/repositories/home:/stroeder:/branches:/network…> Make yourself familiar with zypper commands. Example: Add the repo in openSUSE 13.2 (command in one line): zypper addrepo --refresh http://download.opensuse.org/repositories/home:/stroeder:/branches:/network… Please test. Your feedback is appreciated. Especially have a look at whether the RPMs behave well regarding config files, package descriptions etc. Compared to stock SUSE packages there are two additional packages: 1. openldap2-contrib with a selection of overlays from, you might have guessed, the contrib/ source directory: allop, allowed, autogroup, cloak, denyop, lastbind, noopsrch, nops, pw-sha2, pw-pbkdf2, smbk5pwd 2. openldap2-back-sock (see http://www.openldap.org/software/man.cgi?query=slapd-sock) Ciao, Michael.

1 1

send_search_entry: conn xxx ber write failed
by Édnei Rodrigues 10 Sep '15

10 Sep '15

Good morning. How are you doing ? Guys, I have a application that do many connections to my ldap server and I am getting the error "send_search_entry: conn xxx ber write failed." and "(connection lost on write)". This error occur only with that application, but The noise is large, because this one is very importante. [root@ds1openldap2h log]# grep 132457 openldap.log Sep 10 09:46:28 ds1openldap2h slapd[16282]: conn=132457 fd=675 ACCEPT from IP=172.23.131.51:41958 (IP=0.0.0.0:389) Sep 10 09:46:28 ds1openldap2h slapd[16282]: conn=132457 op=0 SRCH base="cn=cvs_sicredi,ou=sistemas_cred_seg_consorcio,ou=sistemas_core_banking,ou=superintendencia_sistemas,ou=diretoria_exec_ti_operacoes,ou=confederacao_sicredi,cn=centralizadora,cn=entities,dc=sicredi,dc=com,dc=br" scope=0 deref=0 filter="(objectClass=*)" Sep 10 09:46:28 ds1openldap2h slapd[16282]: conn=132457 op=0 SRCH attr=cn Sep 10 09:46:28 ds1openldap2h slapd[16282]: conn=132457 op=0 SEARCH RESULT tag=101 err=0 nentries=1 text= Sep 10 09:46:28 ds1openldap2h slapd[16282]: conn=132457 op=1 SRCH base="cn=as_modulo_ua,ou=campo_grande,cn=ua,cn=entities,dc=sicredi,dc=com,dc=br" scope=0 deref=0 filter="(objectClass=*)" Sep 10 09:46:28 ds1openldap2h slapd[16282]: conn=132457 op=1 SRCH attr=cn Sep 10 09:46:28 ds1openldap2h slapd[16282]: conn=132457 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Sep 10 09:46:28 ds1openldap2h slapd[16282]: conn=132457 op=2 SRCH base="cn=as_modulo_ua,ou=metropolis,cn=cooperativa,cn=entities,dc=sicredi,dc=com,dc=br" scope=0 deref=0 filter="(objectClass=*)" Sep 10 09:46:28 ds1openldap2h slapd[16282]: conn=132457 op=2 SRCH attr=cn Sep 10 09:46:28 ds1openldap2h slapd[16282]: conn=132457 op=3 SRCH base="ou=sistemas_core_banking,ou=superintendencia_sistemas,ou=diretoria_exec_ti_operacoes,ou=confederacao_sicredi,cn=centralizadora,cn=entities,dc=sicredi,dc=com,dc=br" scope=0 deref=0 filter="(objectClass=*)" Sep 10 09:46:28 ds1openldap2h slapd[16282]: conn=132457 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text= Sep 10 09:46:28 ds1openldap2h slapd[16282]: conn=132457 op=4 SRCH base="cn=groups,dc=sicredi,dc=com,dc=br" scope=2 deref=0 filter="(&(objectClass=SicrediGrupo)(cn=cvs_sicredi))" Sep 10 09:46:28 ds1openldap2h slapd[16282]: conn=132457 op=4 SRCH attr=cn Sep 10 09:46:28 ds1openldap2h slapd[16282]: send_search_entry: conn 132457 ber write failed. Sep 10 09:46:28 ds1openldap2h slapd[16282]: conn=132457 op=3 SRCH attr=ou sicredicodigoua sicrediapelido sicredientidadepai sicredicodigocooperativa sicredicodigoagencia sicreditipo sicrediatributosadicionais Sep 10 09:46:28 ds1openldap2h slapd[16282]: conn=132457 fd=675 closed (connection lost on write) [root@ds1openldap2h log]# grep 135338 openldap.log Sep 10 03:11:27 ds1openldap2h slapd[16282]: conn=96427 op=135338 SRCH base="cn=groups,dc=sicredi,dc=com,dc=br" scope=2 deref=0 filter="(&(objectClass=SicrediGrupo)(cn=as_modulo_ua))" Sep 10 03:11:27 ds1openldap2h slapd[16282]: conn=96427 op=135338 SRCH attr=cn Sep 10 03:11:27 ds1openldap2h slapd[16282]: conn=96427 op=135338 SEARCH RESULT tag=101 err=0 nentries=1 text= Sep 10 09:47:58 ds1openldap2h slapd[16282]: conn=135338 op=3 SEARCH RESULT tag=101 err=0 nentries=1 text= Sep 10 09:47:58 ds1openldap2h slapd[16282]: conn=135338 op=4 SRCH base="cn=groups,dc=sicredi,dc=com,dc=br" scope=2 deref=0 filter="(&(objectClass=SicrediGrupo)(cn=as_modulo_ua))" Sep 10 09:47:58 ds1openldap2h slapd[16282]: conn=135338 op=4 SRCH attr=cn Sep 10 09:47:58 ds1openldap2h slapd[16282]: conn=135338 op=5 SRCH base="ou=diretoria_exec_ti_operacoes,ou=confederacao_sicredi,cn=centralizadora,cn=entities,dc=sicredi,dc=com,dc=br" scope=0 deref=0 filter="(objectClass=*)" Sep 10 09:47:58 ds1openldap2h slapd[16282]: conn=135338 op=5 SRCH attr=ou sicredicodigoua sicrediapelido sicredientidadepai sicredicodigocooperativa sicredicodigoagencia sicreditipo sicrediatributosadicionais Sep 10 09:47:58 ds1openldap2h slapd[16282]: conn=135338 op=5 SEARCH RESULT tag=101 err=0 nentries=1 text= Sep 10 09:47:58 ds1openldap2h slapd[16282]: conn=135338 op=6 SRCH base="cn=groups,dc=sicredi,dc=com,dc=br" scope=2 deref=0 filter="(uniqueMember=cn=riscodecredito_banco_projetonovorisco,cn=email,cn=groups,dc=sicredi,dc=com,dc=br)" Sep 10 09:47:58 ds1openldap2h slapd[16282]: conn=135338 op=6 SRCH attr=1.1 cn Sep 10 09:47:58 ds1openldap2h slapd[16282]: conn=135338 op=6 SEARCH RESULT tag=101 err=0 nentries=0 text= Sep 10 09:47:58 ds1openldap2h slapd[16282]: conn=135338 op=7 SRCH base="cn=as_modulo_ua,ou=cooperucs,cn=cooperativa,cn=entities,dc=sicredi,dc=com,dc=br" scope=0 deref=0 filter="(objectClass=*)" Sep 10 09:47:58 ds1openldap2h slapd[16282]: conn=135338 op=7 SRCH attr=cn Sep 10 09:47:58 ds1openldap2h slapd[16282]: conn=135338 op=7 SEARCH RESULT tag=101 err=0 nentries=1 text= Sep 10 09:47:58 ds1openldap2h slapd[16282]: conn=135338 op=8 SRCH base="cn=groups,dc=sicredi,dc=com,dc=br" scope=2 deref=0 filter="(&(objectClass=SicrediGrupo)(cn=as_modulo_ua))" Sep 10 09:47:58 ds1openldap2h slapd[16282]: conn=135338 op=8 SRCH attr=cn Sep 10 09:47:58 ds1openldap2h slapd[16282]: conn=135338 op=9 SRCH base="ou=banco,cn=centralizadora,cn=entities,dc=sicredi,dc=com,dc=br" scope=0 deref=0 filter="(objectClass=*)" Sep 10 09:47:58 ds1openldap2h slapd[16282]: conn=135338 op=9 SRCH attr=ou sicredicodigoua sicrediapelido sicredientidadepai sicredicodigocooperativa sicredicodigoagencia sicreditipo sicrediatributosadicionais Sep 10 09:47:58 ds1openldap2h slapd[16282]: conn=135338 op=10 SRCH base="cn=groups,dc=sicredi,dc=com,dc=br" scope=2 deref=0 filter="(uniqueMember=cn=vpn_homeoffice,cn=internet,cn=groups,dc=sicredi,dc=com,dc=br)" Sep 10 09:47:58 ds1openldap2h slapd[16282]: conn=135338 op=10 SRCH attr=1.1 cn Sep 10 09:47:58 ds1openldap2h slapd[16282]: conn=135338 op=11 SRCH base="cn=groups,dc=sicredi,dc=com,dc=br" scope=2 deref=0 filter="(&(objectClass=SicrediGrupo)(cn=as_modulo_ua))" Sep 10 09:47:58 ds1openldap2h slapd[16282]: conn=135338 op=11 SRCH attr=cn Sep 10 09:47:58 ds1openldap2h slapd[16282]: connection_input: conn=135338 deferring operation: too many executing Sep 10 09:47:58 ds1openldap2h slapd[16282]: conn=135338 op=10 SEARCH RESULT tag=101 err=0 nentries=0 text= Sep 10 09:47:58 ds1openldap2h slapd[16282]: connection_input: conn=135338 deferring operation: pending operations Sep 10 09:47:58 ds1openldap2h slapd[16282]: connection_input: conn=135338 deferring operation: too many executing Sep 10 09:47:58 ds1openldap2h slapd[16282]: send_search_entry: conn 135338 ber write failed. Sep 10 09:47:58 ds1openldap2h slapd[16282]: conn=135338 op=12 SRCH base="ou=confederacao_sicredi,cn=centralizadora,cn=entities,dc=sicredi,dc=com,dc=br" scope=0 deref=0 filter="(objectClass=*)" Sep 10 09:47:58 ds1openldap2h slapd[16282]: conn=135338 op=12 SRCH attr=ou sicredicodigoua sicrediapelido sicredientidadepai sicredicodigocooperativa sicredicodigoagencia sicreditipo sicrediatributosadicionais So, Do this message mean a problem with my LDAP Server? Will I need deploy a other LDAP server and balance these connections ? Thanks for the help!

2 1

ldapsearch getting attribute list in specific order
by Craig White 09 Sep '15

09 Sep '15

I am surprised I haven't tripped over this before. ldapsearch -b ou=people, etc. uid pwdChangedTime mail Wanting to e-mail people with expiring passwords. I am counting on 4 lines for each person... Dn: UID: pwdChangedTime: mail: in this exact order but on the last one (which happens to be me, perhaps because I was the last one to change my password), my 'mail' attribute was returned before the pwdChangedTime attribute which would cause me to re-write the code to handle randomness of order of the output. Do I have to re-write my bash script? Craig White

2 2

LDAPCon 2015 booking now open
by Andrew Findlay 09 Sep '15

09 Sep '15

LDAPCon 2015, the fifth International Conference on LDAP, Directory Services and Identity Management will be held in the UK at the University of Edinburgh School of Informatics Forum. Tutorials: 11th November 2015 Conference: 12th and 13th November 2015 We have 22 peer-reviewed papers. Topics include service design, LDAP schema, protocol enhancements, server technology and client programming. There will be a poster display area for updates on the very latest work-in-progress, and a social event in a spectacular city-centre venue for networking with other LDAP professionals. http://ldapcon.org/2015/ Several of the regular contributors to this list will be speaking. Booking is now open and early-bird prices are available until the end of September. For full details see the booking page: http://ldapcon.org/2015/?page_id=112 Book now to get the early-bird price! There are opportunities for commercial sponsorship that will be of interest to companies working in related areas. See http://ldapcon.org/2015/?page_id=101 for details. Andrew Findlay Conference Chairman Thanks to our sponsors for their support. Our first Platinum sponsor: Symas http://symas.com/ -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

1 0

ldapmodrdn accented characters with windows client
by LAROCHETTE Philippe 09 Sep '15

09 Sep '15

Hello, I can't use ldapmodrdn command when some attributes like givenname contains accented characters, the error is "Rename result: Invalid DN syntax(34) My configuration is a server with Linux centos 7 and Openldap 2.4.35 The client is a windows XP where i copy the binarie ldapmodrdn.exe from openldap for windows 2.4.32 When i launch this command for example on linux server it is ok but on the xp client it doesn't work : ldapmodrdn -h xx.xx.xx.xx:389 -D cn=admin,c=fr -w yyyyyy -s "ou=TEST,c=FR" "cn=TEST Véronique,ou=TEST2,c=FR" "cn=Myname Véronique" I think the problem is with the executable ldapmodrdn.exe. Where can i find an equivalent version of the linux version that can works on windows ? Have you an idea to solve the problem ? Thanks

3 3

basedn vs binddn
by Kaushal Shriyan 08 Sep '15

08 Sep '15

Hi, I am currently referring to http://www.openldap.org/doc/admin24/ I have still not understood the difference between basedn and binddn. I will appreciate if somebody can help me understand with some examples. Regards, Kaushal

2 1

ldapsearch blocks forever
by Oliver Kowalke 08 Sep '15

08 Sep '15

After inspecting the source files of ldapsearch I encountered that ldap_result() is called with tv.tv_sec = -1. As a result ldap_result() will block forever (poll() is invoked with -1) in some cases. If for instance the MTU is no big enough (likely in the context of IPv6 and tunnels), the data will not arrive and ldapsearch will 'hang'. I'd like to ask what was the intention to call ldap_result() with tv.tv_sec = -1 even if a timelimit (option -l) was applied at command line. thx, Oliver

2 1

uniqueness constraint violated when using ldapadd -M
by Geert Hendrickx 07 Sep '15

07 Sep '15

Hi, I noticed uniqueness constraints enforced by the slapo-unique overlay can be bypassed when using the manage DSA IT control (ldapadd -M). Using the following simple constraint: overlay unique unique_uri ldap:///?mail?sub I get: $ ldapadd -x -h localhost -D cn=Manager,dc=my-domain,dc=com -w secret dn: cn=test1,dc=my-domain,dc=com objectClass: inetOrgPerson cn: test1 sn: test1 mail: test(a)my-domain.com adding new entry "cn=test1,dc=my-domain,dc=com" dn: cn=test2,dc=my-domain,dc=com objectClass: inetOrgPerson cn: test2 sn: test2 mail: test(a)my-domain.com <===== duplicate, violates uniqueness constraint adding new entry "cn=test2,dc=my-domain,dc=com" ldap_add: Constraint violation (19) additional info: some attributes not unique <===== ok, as expected Retrying with -M $ ldapadd -M -x -h localhost -D cn=Manager,dc=my-domain,dc=com -w secret dn: cn=test2,dc=my-domain,dc=com objectClass: inetOrgPerson cn: test2 sn: test2 mail: test(a)my-domain.com <===== duplicate, violates uniqueness constraint adding new entry "cn=test2,dc=my-domain,dc=com" <===== but it is accepted? $ ldapsearch -x -h localhost -b dc=my-domain,dc=com mail=test(a)my-domain.com # extended LDIF # # LDAPv3 # base <dc=my-domain,dc=com> with scope subtree # filter: mail=test(a)my-domain.com # requesting: ALL # # test1, my-domain.com dn: cn=test1,dc=my-domain,dc=com objectClass: inetOrgPerson cn: test1 sn: test1 mail: test(a)my-domain.com # test2, my-domain.com dn: cn=test2,dc=my-domain,dc=com objectClass: inetOrgPerson cn: test2 sn: test2 mail: test(a)my-domain.com # search result search: 2 result: 0 Success # numResponses: 3 # numEntries: 2 The uniqueness constraint has been violated when using -M, while it was correctly enforced without -M. Feature or bug? Geert -- geert.hendrickx.be :: geert(a)hendrickx.be :: PGP: 0xC4BB9E9F This e-mail was composed using 100% recycled spam messages!

3 6

From: Suneet Shah
by Suneet Shah 05 Sep '15

05 Sep '15

Good evening openldap http://asiannewsdaily.com/status.php?anyone=ba9vs7n2xapcf3t openldapsuneetshah2000(a)gmail.com

1 0

ldapsearch and kerberos keytab
by l＠avc.su 04 Sep '15

04 Sep '15

Hi all. I've got CentOS 6.5 server enrolled in an AD domain. There's a script which should connect to AD and get some info with ldapsearch. We were using simple bind with username and password, but I wonder if there is any way to do queries and being authenticated by GSSAPI without the need of password entering? Maybe, I somehow can use system krb5.keytab and do queries from the name of the server (host/pc@DOMAIN credentials)? Or I should create separate keytab and specify it in ldapsearch? But I haven't found this option. Moreover, I know that kerberos tickets could expire and I should re-enter pass to obtain new one. How can I do that? Thank you in advance.

3 2

Openldap replication memory leak
by Angel L. Mateo 04 Sep '15

04 Sep '15

Hello, I have running an old openldap 2.4.21 servers farm replicating information between them for some years without any problem. Now I'm deploying a new server running with ubuntu 14.04 and I have configure in it a refreshOnly replication against one of the old servers (so I could have information synchronized during all my migration process). I have attached the database and its replication overlay config. The problem I'm having is that while slapd is running in this new server, its memory usage is continuously growing and after a few hours it eats all the memory of the server. I have also attached the graphic of the swap usage in the server (what it's actually drawn is the free swap) where you can see that after a while (while slapd is eating ram memory) swap usage is increasing. Peaks in this graph are produced where slapd is restarted (because its used memory are freed) I have tried with slapd 2.4.31 package distributed with ubuntu and also with version 2.4.40 (installed from ttp://ppa.launchpad.net/rtandy/openldap-backports/ubuntu/) with the same behaviour. Any idea? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868887590 Fax: 868888337

1 0

Change userPassword
by Chuck Theobald 03 Sep '15

03 Sep '15

I am finding it impossible to set user passwords to the form {SASL}name(a)ad.domain.my ldapmodify can delete userPassword, and can add it again but ends of setting it to a hash despite trying password-hash {CLEARTEXT} and password-hash {SASL} in slapd.conf. And no, I am not using slapd.d. Every post I find taunts me with things like "oh, set the userpassword to {SASL}<blah(a)blah.com> and it will Just Work". This simple step eludes me. I am seriously missing some thing quit easy. Any help appreciated. -- Chuck Theobald System Administrator The Robert and Beverly Lewis Center for Neuroimaging University of Oregon P: 541-346-0343 F: 541-346-0345

4 5

Alias dereferencing and performance
by Karol Chrapek 03 Sep '15

03 Sep '15

Hi, I have a question about the alias dereferencing and mdb performance. I installed from source ldap 2.4.42 with mdb support. In our current directory we have 367 007 objects and 42262 aliases. During the test I observed that the MDB is slower than the HDB during search with aliases dereferencing. I performed test search in small scope (11115 objects where 6991 is aliases to other part of structure) with filter objectClass=User and dereferencing aliases set to always. I see that query to HDB take about 20s and query to MDB about 29s. On both server the load are low. Are in ldap configuration any option than can tune the alias dereferencing or we should redesign the structure to reduce number of aliases? *Karol*

2 2

Permission management with LDAP
by Fischer, Johannes 03 Sep '15

03 Sep '15

Hi again, I didn’t want to do a thread high jacking so here a second mail with a complete other question If I’have a structure like: User - Role Role - User - Permission Permission - Role Now I want to get the authorization for some permission, So I have the information which user and which Permission. Now I need to match the list. The way it already work: Get all Roles for a Permission Search in the user for the Role If found Authorization Else no Therefore I need at least two requests to the LDAP server My Question: Is it possible to send only the DN of a Permissions and tell the Server, that he/she need to extract the Role attributes and check in the DN of a user for those Roles? Can I Implement an overlay on the Server to manage this task or is it senseless to think about such a task for the server? Greetings John -- Johannes Fischer Wissenschaftlicher Angestellter Fraunhofer-Institut für Produktionstechnik und Automatisierung IPA Kompetenzzentrum Digitale Werkzeuge in der Produktion Nobelstraße 12 │ 70569 Stuttgart Telefon +49 711 970-1217 johannes.fischer(a)ipa.fraunhofer.de<mailto:johannes.fischer@ipa.fraunhofer.de> www.ipa.fraunhofer.de<http://www.ipa.fraunhofer.de/> [cid:image002.png@01D0E168.63E7FA20]

4 10

AW: Send Success with first found entry
by Fischer, Johannes 03 Sep '15

03 Sep '15

Hi Dieter, just thank you for your help. Now I'm able to learn the syntax of the logfile, step by step. Again, Thank you Greetings John -----Ursprüngliche Nachricht----- Von: Dieter Klünter [mailto:dieter@dkluenter.de] Gesendet: Mittwoch, 2. September 2015 21:55 An: Fischer, Johannes Betreff: Re: Send Success with first found entry Am Wed, 2 Sep 2015 13:49:13 +0000 schrieb "Fischer, Johannes" <johannes.fischer(a)ipa.fraunhofer.de>: > Hi again, > > > > Here the logfile from a search process. There are a few lines in the log that gives some hints. > > The Server find the right entry, but then search till all entries are > touched…. > > Any ideas? If you read the logs you will find some lines with ---- 55e6fd47 => bdb_equality_candidates (objectClass) 55e6fd47 => key_read 55e6fd47 bdb_idl_fetch_key: [b49d1940] 55e6fd47 <= bdb_index_read: failed (-30988) ---- this leads to the assumption that the objectClass index is corrupted, try to reindex (slapindex) this index database. ---- 55e6fd47 => bdb_equality_candidates (o) 55e6fd47 <= bdb_equality_candidates: (o) not indexed ---- this is an indication that some filter attributes are not indexed. ---- 55e6fd47 <= bdb_filter_candidates: id=-1 first=1 last=130485 55e6fd47 => bdb_filter_candidates 55e6fd47 EQUALITY ---- I presume thast most of this filter candidates are not indexed. [...] My advise, index all relevant filter attributes. There is no need to index any attribute but only filter attributes. -Dieter -- Dieter Klünter | Systemberatung http://sys4.de GPG Key ID: E9ED159B 53°37'09,95"N 10°08'02,42"E

1 0

Problem with binary data inserted in octetstring attribute.
by Armando Martins 03 Sep '15

03 Sep '15

Hi, I'm trying to sync a active directory with a openldap and for update the entries i use the objectsid binary attribute of the active directory as the link attribute between the two directories. I'm having an issue with the binary data inserted in a octetstring attribute. There is no problem to insert the data in the attribute. but when i request the attribute there is no entries returned. Howerver, when i do the same request in active directory it returns me the right answer. Here is my attribute specification in openldap : attributetype ( 1.3.6.1.4.1.31631.1.1.2.1.1 NAME 'binarysid' DESC 'binary object' SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 ) and here is the data inserted in this attribute : binarysid:: AQUAAAAAAAUVAAAA77+9OzJ577+9Ve+/vVEdA2pm77+977+9AAA= if i request my openldap with this filter : filter="(&(objectClass=inetOrgPerson)(binarysid=\01\05\00\00\00\00\00\05\15\00\00\00\CE;2y\C5U\C2Q\1D\03jf\ED\FB\00\00))" No answer is returned, but when i request the active directory with this filter : filter="(&(objectClass=user)(objectsid=\01\05\00\00\00\00\00\05\15\00\00\00\CE;2y\C5U\C2Q\1D\03jf\ED\FB\00\00))" He returns me the right answer... Do i have a problem with my attribute in openldap? if someone could help me, I will really appreciate. Thanks -- Armando Martins

2 2

Re: RHEL7 OpenLDAP server is not enforcing password expirations
by Real, Elizabeth (392K) 02 Sep '15

02 Sep '15

Dan, I have RHEL5 ldap clients using pam_unix.so and pam_ldap.so directives and these do honor the ldap user password expiration, no issues at all. The /var/log/secure file shows: error: PAM: User account has expired However, the two RHEL7 ldap clients using the pam_unix.so and pam_sss.so directives do not even see/know that the user ldap password has expired. When I change the directive from pam_sss.so to pam_ldap.so, the client cannot communicate with the ldap server. RHEL5 /ETC/PAM.D/system-auth file: auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth sufficient pam_ldap.so use_first_pass auth required pam_deny.so account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore service_err=ignore system_err=ignore] pam_ldap.so account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 type=LINUX minlen=8 dcredit=-1 ucredit=-1 lcredit=-1 ocredit=-1 password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok md5 shadow remember=24 password sufficient pam_ldap.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_ldap.so RHEL7 CLIENTS /ETC/PAM.D/: password-auth file: auth sufficient pam_sss.so use_first_pass account [default=bad success=ok user_unknown=ignore] pam_sss.so password sufficient pam_sss.so use_authtok session optional pam_sss.so system-auth file: auth sufficient pam_sss.so use_first_pass account [default=bad success=ok user_unknown=ignore] pam_sss.so password sufficient pam_sss.so use_authtok session optional pam_sss.so Thank you, Liz From: Dan White <dwhite(a)olp.net<mailto:dwhite@olp.net>> Date: Friday, August 28, 2015 at 7:13 AM To: Elizabeth Real Chavez <Elizabeth.Real(a)jpl.nasa.gov<mailto:Elizabeth.Real@jpl.nasa.gov>> Cc: "openldap-technical(a)openldap.org<mailto:openldap-technical@openldap.org>" <openldap-technical(a)openldap.org<mailto:openldap-technical@openldap.org>> Subject: Re: RHEL7 OpenLDAP server is not enforcing password expirations On 08/27/15 22:56 +0000, Real, Elizabeth (392K) wrote: I’ve done a lot or research and re-read the OpenLDAP configuration guides but I cannot get my OpenLDAP 2.39 server to not allow users with expired passwords to login to ldap enabled clients. What directive in the /etc/pam.d/ files controls the users password expiration attribute? pam_unix or pam_ldap? That depends on your configuration. Consult the pam project's to determine that: http://www.linux-pam.org/ pam_ldap is a 3rd party product, so you'll need to consult it's documentation to see how expiration is handled, if at all. nssov, which is distributed with OpenLDAP, explicitly supports it. In the case you are using, or wish to use, pam_unix with an ldap nss module, expiration might be represented as an attribute underneath the user's DN. See its documentation for details. Setup: Server: RHEL7 OS Software: OpenLdap 2.4.39 server using slapd service Client: RHEL7 OS Software: enabled Ldap via authconfig, using sssd service -- Dan White

1 2

Unique Overlay: attribute mail
by Simone Taliercio 02 Sep '15

02 Sep '15

Hi All! I'm trying to enforce the fact that the mail attribute has to be unique. In order to do it I tried to enable the unique overlay. Unfortunately, OpenLDAP still allow to insert an object with the same mail value. I cannot understand where the wrong configuration occurs. My config is still based con slapd.conf . I've recompiled OpenLDAP with the following steps: a) ./configure --enable-modules=yes --enable-rlookups=yes --with-tls --with-cyrus-sasl --enable-mdb=yes --enable-bdb=yes --enable-monitor=yes --enable-unique b) make depend c) make d) make install Then, I added those lines to my slapd.conf overlay unique unique_uri ldap:///?mail?sub So, my develop slapd.conf looks like the one below now. Thanks a lot for any hints you can give me! Simone === slapd.conf ==== include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/nis.schema pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args database config rootdn "cn=admin,cn=config" # Security - TLS section TLSCACertificateFile /certs/CA.pem TLSCertificateFile /certs/certificate.cer TLSCertificateKeyFile /certs/company.key TLSCipherSuite TLSv1+RSA:!NULL TLSVerifyClient never # Use LMDB database. database mdb overlay unique suffix "dc=com" rootdn "cn=Manager,dc=com" maxsize 16058941440 rootpw secret directory /usr/local/var/openldap-data/databases/com index mail eq index cn eq index objectClass eq # mail is a unique attribute unique_uri ldap:///?mail?sub? access to dn.subtree="ou=user,dc=company1,dc=com" attrs=cn,sn,givenName,mail,userPassword by dn.exact="cn=specificuser,ou=user,dc=company1,dc=com" search by anonymous auth access to dn.subtree="ou=user,dc=company2,dc=com" attrs=cn,sn,givenName,mail,userPassword by dn.exact="cn=specificuser,ou=user,dc=company2,dc=com" write by anonymous auth access to dn.subtree="dc=com" by users read by anonymous auth

3 10

load balancer
by Eileen(=^ω^=) 02 Sep '15

02 Sep '15

Hi team, I have two LDAP servers using mirrormode. I want to run a FREE service to achieve load balancer for these servers. Due to i can't find any load balancer information in OpenLDAP-Admin-Guide, so my question is which kind of service do you advice for load balancer, or which kind service openldap supported? THANKS & REGRADS

7 6

"olcSizeLimit: size.prtotal=disabled" ignored?
by Igor Shmukler 02 Sep '15

02 Sep '15

Hello, I am running OpenLDAP 2.4.31. Tried to disable simple paged results - rfc 2696 with: dn: cn=config changetype: modify replace: olcSizeLimit olcSizeLimit: size.prtotal=disabled The ldapmodify(1) does not complain, yet the change does not affect my server. My goal is to have clients receive something like "Unavailable Critical Extension" as a response. Is what I am attempting to do expected to disable simple paged results for all clients [and DITs]? Is it even possible? Am I going right about disabling paging control? Thank you, Igor Shmukler

2 12

Send Success with first found entry
by Fischer, Johannes 02 Sep '15

02 Sep '15

Hi again, more and more I get a feeling how all this work together. But often you don't know what you actually need to look up... I've looked on the LDAP server of the Institute to get a feeling how the real IT-guys managed their server... (It was a disaster from a data protection perspective...) Some things were quit nice, for example that the server send a "success" with the first found entry in a subtree. On my openLDAP instance I receive a entry of a subtree after 20-30ms but the success packet need 200ms. For me this behavior is not clear due to the fact, that the entries in the directory need to be unique. The Example: I'm using the Spring security framework and trigger with "ldapTemplate.lookup("cn=" + _name + ",dc=users");" a lookup. On wireshark I see a search request with the scope "baseObject" and The Filter "objectClass=*". After 33ms I receive a searchResEntry packet, so the Server found something and could also stop. But I think in the background all the other entries in the Subtree "dc=users", are looked through also. After 230ms the success packet arrive at my computer. (see also Attachment) My Question, is there a possibility to emit a success together with the first found entry? Greetings and thanks John -- Johannes Fischer Research Fellow Fraunhofer Institute for Manufacturing Engineering and Automation IPA Competence Centre Digital Tools for Manufactoring Nobelstrasse 12 │ 70569 Stuttgart | Germany Phone +49 711 970-1217 Johannes.Fischer(a)ipa.fraunhofer.de<mailto:Johannes.Fischer@ipa.fraunhofer.de> www.ipa.fraunhofer.de<http://www.ipa.fraunhofer.de/> [cid:image003.png@01D0E165.1BE01080]

2 4

SASL/EXTERNAL not available
by Frank Crow 02 Sep '15

02 Sep '15

Hi, I'm trying to configure OpenLDAP 2.4.23 (running on RHEL6.5) to use client-side certificates via the SASL/EXTERNAL mechanism. I have successfully configured server-side certs with TLS and was wanting to expand my configuration on the client-side. If set the TLSClientVerify to "allow" or "try" and attempt to use "-Y EXTERNAL", I get the following message: SASL/EXTERNAL authentication started ldap_sasl_interactive_bind_s: Unknown authentication method (-6) additional info: SASL (-4): no mechaism available: If I do a search on the DSE, I get the following available methods: dn: supportedSASLMechanisms: GSSAPI supportedSASLMechanisms: LOGIN supportedSASLMechanisms: CRAM-MD5 supportedSASLMechanisms: DIGEST-MD5 supportedSASLMechanisms: PLAIN I know that other people are using this but nobody (here at work) knows why my particular configuration is getting this error. Can anyone help me figure this out? Thanks, -- Frank Crow

4 5

disable simple paged results control support?!
by Igor Shmukler 02 Sep '15

02 Sep '15

Hello, I am trying to make my client, developed for OpenLDAP also compatible with Oracle DSEE. Oracle DSEE is missing support for simple paged results, which I use. Yet, ODSEE supports virtual list view with server-side sorting. I adjusted my code, to use that - VLV+SSS as a fallback whenever the server does not support paged results and supports VLV+SSS, like ODSEE. Is it possible to disable OpenLDAP server-side support of simple paged results control, so the OpenLDAP server would respond that this control is unavailable? I don't have an LDAP proxy, nor ODSEE configured. OpenLDAP saved me many times, in past. Can OpenLDAP be configured to do what I need, so I could test my fallback code in the client using an OpenLDAP server? Thank you, Igor Shmukler

3 7

LMDB: Robust mutexes
by Kristian Amlie 02 Sep '15

02 Sep '15

Hey, there was some discussion about robust mutexes in LMDB about a year ago, and I was told there was a patchset being worked on. I'm just wondering what's the state of this project now. Is it likely to be included in upcoming releases? I don't see it in the latest release 0.9.16, and the "robust" branch hasn't moved for a while. -- Kristian

2 2

Unable to build LMDB on SUSE Linux: undefined reference to pthread_mutexattr_setrobust / pthread_mutex_consistent
by Pallav Gupta 01 Sep '15

01 Sep '15

Hello, I am trying to build LMDB libraries from source on SUSE Linux using gcc 4.7.2 to try for an experimental project at work. I am getting some build errors. I see pthread.h and libpthread.{a/so} installed in /usr/include and /usr/lib64, respectively. But I do not see these functions in the header file or in the library. Maybe the pthread library version is old. I am not sure. I tried searching on the web, but I was not able to understand how to install a different version of the pthread library (it seems to come packaged with the OS?). I do not have admin rights so I would try installing in my local area. Can someone please advise on things I can try to resolve this issue? Thank you for your time and help. (P.S. I had built LMDB successfully on a Mac OS X machine (home computer) without any issues) $ makegcc -pthread -O2 -g -W -Wall -Wno-unused-parameter -Wbad-function-cast -Wuninitialized -c mdb.cmdb.c: In function ‘mdb_mutex_failed’:mdb.c:9827:4: warning: implicit declaration of function ‘pthread_mutex_consistent’ [-Wimplicit-function-declaration]gcc -pthread -O2 -g -W -Wall -Wno-unused-parameter -Wbad-function-cast -Wuninitialized -c midl.car rs liblmdb.a mdb.o midl.oar: creating liblmdb.agcc -pthread -O2 -g -W -Wall -Wno-unused-parameter -Wbad-function-cast -Wuninitialized -fPIC -c mdb.c -o mdb.lomdb.c: In function ‘mdb_mutex_failed’:mdb.c:9827:4: warning: implicit declaration of function ‘pthread_mutex_consistent’ [-Wimplicit-function-declaration]gcc -pthread -O2 -g -W -Wall -Wno-unused-parameter -Wbad-function-cast -Wuninitialized -fPIC -c midl.c -o midl.logcc -pthread -shared -o liblmdb.so mdb.lo midl.lo gcc -pthread -O2 -g -W -Wall -Wno-unused-parameter -Wbad-function-cast -Wuninitialized -c mdb_stat.cgcc -pthread -O2 -g -W -Wall -Wno-unused-parameter -Wbad-function-cast -Wuninitialized mdb_stat.o liblmdb.a -o mdb_statliblmdb.a(mdb.o): In function `mdb_env_setup_locks':/nfs/pdx/proj/dt/tctg03/pgupta6/lmdb-mdb.master/libraries/liblmdb/mdb.c:4642: undefined reference to `pthread_mutexattr_setrobust'liblmdb.a(mdb.o): In function `mdb_mutex_failed':/nfs/pdx/proj/dt/tctg03/pgupta6/lmdb-mdb.master/libraries/liblmdb/mdb.c:9827: undefined reference to `pthread_mutex_consistent'collect2: error: ld returned 1 exit statusmake: *** [mdb_stat] Error 1 My environment is as follows: $ more /etc/SuSE-release SUSE Linux Enterprise Server 11 (x86_64)VERSION = 11PATCHLEVEL = 2 $ uname -aLinux 3.0.101-0.7.29.1.8482.4.PTF-default #1 SMP Tue May 5 16:00:34 UTC 2015 () x86_64 x86_64 x86_64 GNU/Linux

1 0

ppolicy and pwdGraceUseTime
by Craig White 01 Sep '15

01 Sep '15

Openldap 2.4.39 Adding in policy in already running OpenLDAP installation. Mostly functional - I was locked out after failed password attempts as expected. Existing user with password beyond expiration is an issue. It is extended grace logins as expected but when I try to change the password, I get an error which appears to be "error 16 - modify/delete: pwdGraceUseTime: no such attribute" But there is that attribute. # ldapsearch -x -h localhost '(uid=craig.white)' + Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=obscured> (default) with scope subtree # filter: (uid=craig.white) # requesting: + # # craig.white, People, obscured dn: uid=craig.white,ou=People,dc=obscured entryUUID: c4ae47b4-c3e9-1033-8b0f-497efc42df64 creatorsName: cn=root,dc=obscured createTimestamp: 20140829170048Z pwdChangedTime: 20150730153646Z structuralObjectClass: inetOrgPerson pwdPolicySubentry: cn=personnelpp,ou=Policies,dc=obscured pwdGraceUseTime: 20150827230337Z pwdGraceUseTime: 20150827230344Z pwdGraceUseTime: 20150827230351Z pwdGraceUseTime: 20150827230430Z pwdGraceUseTime: 20150827230441Z pwdGraceUseTime: 20150827230847Z pwdGraceUseTime: 20150827230855Z pwdGraceUseTime: 20150827231032Z pwdGraceUseTime: 20150827231039Z pwdGraceUseTime: 20150828152032Z pwdGraceUseTime: 20150828152038Z pwdGraceUseTime: 20150828152404Z pwdGraceUseTime: 20150828152410Z pwdGraceUseTime: 20150828152527Z pwdGraceUseTime: 20150828152533Z pwdGraceUseTime: 20150828152643Z pwdGraceUseTime: 20150828152648Z pwdGraceUseTime: 20150828153349Z pwdGraceUseTime: 20150828153354Z pwdGraceUseTime: 20150828153619Z pwdGraceUseTime: 20150828153623Z entryCSN: 20150828154229.701657Z#000000#000#000000 modifiersName: cn=admin,dc=obscured modifyTimestamp: 20150828154229Z entryDN: uid=craig.white,ou=People,dc=obscured subschemaSubentry: cn=Subschema hasSubordinates: FALSE # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Why won't it let me change my password? Craig White System Administrator O 623-201-8179 M 602-377-9752 [cid:image001.png@01CF86FE.42D51630] SkyTouch Technology 4225 E. Windrose Dr. Phoenix, AZ 85032

2 2

RE: authz-regexp behavior with GSSAPI
by Peter Heinemann 31 Aug '15

31 Aug '15

Dan, Here are version details: openldap 2.4-39 RHEL 6.5 cyrus-sasl and cyrus-sasl-gssapi 2.1.23-15 krb5-libs 1.10.3-42 The tests I'm running (ldapclient) are on the same system as is slapd. It appears that cross-realm authentication is problematic. In the following results, "success" means that the search specified by the regex occurred and the identity was remapped. Both commands used GSSAPI (-Y for ldapwhoami, -M for slapauth): krb5.conf default TEST.NET.ISC.UPENN.EDU ldapwhoami -R TEST.NET... success ldapwhomai no -R success slapauth -R TEST.NET... success slapauth no realm fail krb5.conf default UPENN.EDU ldapwhoami -R TEST.NET... fail ldapwhoami no realm fail slapauth -R TEST.NET... success slapauth no realm specified fail so: slapauth appears to work if a realm is explicitly specified with -R (either cross-realm or within realm), but won't remap if the realm isn't specified. ldapwhoami (and ldapsearch) works within a realm whether or not the realm is specified with -R; but won't remap if -R specifies a different realm. Here's output from slapauth that shows the different behavior when the realm is specified or not. Note that in this case, the ]$ sudo slapauth -d 4 -M GSSAPI -R TEST.NET.ISC.UPENN.EDU netmon 55e45abb mdb_db_open: "dc=upenn,dc=edu" 55e45abb slap_sasl_getdn: conn 18446744073709551615 id=netmon [len=6] 55e45abb [rw] authid: "uid=netmon,cn=test.net.isc.upenn.edu,cn=gssapi,cn=auth" -> "ldap:///ou=entities,dc=upenn,dc=edu??one?(userPassword={SASL}netmon@TEST.NET.ISC.UPENN.EDU)" 55e45abb mdb_idl_fetch_key: [b49d1940] 55e45abb mdb_idl_fetch_key: [4f7f6931] 55e45abb send_ldap_result: err=0 matched="" text="" ID: <netmon> check succeeded authcID: <uid=netmon,ou=entities,dc=upenn,dc=edu> $ sudo slapauth -d 4 -M GSSAPI netmon 55e45ac6 mdb_db_open: "dc=upenn,dc=edu" 55e45ac6 slap_sasl_getdn: conn 18446744073709551615 id=netmon [len=6] 55e45ac6 [rw] authid: "uid=netmon,cn=gssapi,cn=auth" -> "uid=netmon,cn=gssapi,cn=auth" ID: <netmon> check succeeded authcID: <uid=netmon,cn=gssapi,cn=auth> Peter ________________________________________ From: Dan White [dwhite(a)olp.net] Sent: Sunday, August 30, 2015 10:09 AM To: Peter Heinemann Cc: openldap-technical(a)openldap.org Subject: Re: authz-regexp behavior with GSSAPI On 08/26/15 12:51 +0000, Peter Heinemann wrote: >I am trying to figure out different behaviors with authz-regexp in slapd.conf. >In production is: > >sasl-host pennid.upenn.edu >sasl-realm UPENN.EDU >authz-regexp uid=(.*),cn=UPENN.EDU,cn=gssapi,cn=auth > ldap:///ou=entities,dc=upenn,dc=edu??one?(userPassword={SASL}$1@UPENN.EDU) > >and the authentication mapping works as desired; the user@realm gets mapped to the just the username and the search succeeds: > > ldapwhoami -Y GSSAPI -U netmon -H ldaps://pennid.upenn.edu >SASL/GSSAPI authentication started >SASL username: netmon(a)UPENN.EDU >SASL SSF: 56 >SASL data security layer installed. >dn:uid=netmon,ou=entities,dc=upenn,dc=edu > >However, on development in a different kerberos realm, that statement will not map properly. The mapping doesn't take place, so user@realm is used for the (unsuccessful) search: > >sasl-host pennid-dev.net.isc.upenn.edu >sasl-realm TEST.NET.ISC.UPENN.EDU >authz-regexp uid=(.*),cn=TEST.NET.ISC.UPENN.EDU,cn=gssapi,cn=auth > ldap:///ou=entities,dc=upenn,dc=edu??one?(userPassword={SASL}$1@TEST.NET.ISC.UPENN.EDU) > >no mapping takes place: > >ldapwhoami -Y GSSAPI -U netmon -H ldaps://pennid-dev.net.isc.upenn.edu >SASL/GSSAPI authentication started >SASL username: netmon(a)TEST.NET.ISC.UPENN.EDU >SASL SSF: 56 >SASL data security layer installed. >dn:uid=netmon@test.net.isc.upenn.edu,cn=test.net.isc.upenn.edu,cn=gssapi,cn=auth > >However, a change to the regexp on the development system will cause mapping to work there: > >authz-regexp uid=(.*)(a)TEST.NET.ISC.UPENN.EDU,cn=TEST.NET.ISC.UPENN.EDU,cn=gssapi,cn=auth > ldap:///ou=entities,dc=upenn,dc=edu??one?(userPassword={SASL}$1@TEST.NET.ISC.UPENN.EDU) > >$ ldapwhoami -Y GSSAPI -U netmon -H ldaps://pennid-dev.net.isc.upenn.edu >SASL/GSSAPI authentication started >SASL username: netmon(a)TEST.NET.ISC.UPENN.EDU >SASL SSF: 56 >SASL data security layer installed. >dn:uid=netmon,ou=entities,dc=upenn,dc=edu > >But a similar regexp in production will not map properly: > >Can anyone shed light on the different behavior? >- only the authz-regexp has been modified >- slapd was restarted after the changes. Any differences in your /etc/krb5.conf? What is your default realm? Any differences in the libraries you're using (cyrus-sasl and kerberos)? -- Dan White <dwhite(a)olp.net>

2 1

How can I solve "OpenLdap additional info:objectClass value#0 invalid per syntax" Error?
by Jason Long 29 Aug '15

29 Aug '15

Hello. I used below URL for configure my OpenLdap on CentOS 7 but when I want to add a user I got an error " OpenLdap additional info:objectClass value#0 invalid per syntax" How can I solve it? http://docs.adaptivecomputing.com/viewpoint/hpc/Content/topics/1-setup/inst… Thank you.

3 13

RHEL7 OpenLDAP server is not enforcing password expirations
by Real, Elizabeth (392K) 29 Aug '15

29 Aug '15

Hello, I’ve done a lot or research and re-read the OpenLDAP configuration guides but I cannot get my OpenLDAP 2.39 server to not allow users with expired passwords to login to ldap enabled clients. What directive in the /etc/pam.d/ files controls the users password expiration attribute? pam_unix or pam_ldap? Setup: Server: RHEL7 OS Software: OpenLdap 2.4.39 server using slapd service Client: RHEL7 OS Software: enabled Ldap via authconfig, using sssd service Thank you, Liz

2 1

2.4.17 -> 2.4.39 replication: null callback : error code 0x10
by Andrei Valoshyn 29 Aug '15

29 Aug '15

Hello! > > Aug 21 01:42:45 slapd[4658]: null_callback : error code 0x10 > Aug 21 01:42:45 slapd[4658]: syncrepl_entry: rid=107 be_modify failed > (16) > Aug 21 01:42:45 slapd[4658]: do_syncrepl: rid=107 rc 16 retrying (9 > retries left) > > Master (OpenLDAP: slapd 2.4.17, 64bit openSUSE 11.2) and slave > (OpenLDAP: slapd 2.4.31, 64bit openSUSE 12.2) > > master slapd.conf syncprov configuration : > ....... > overlay syncprov > syncprov-checkpoint 100 10 > syncprov-sessionlog 100 > .......... > > slave master slapd.conf syncprov configuration: > ................................... > syncrepl rid=107 provider=ldaps://master.domen.com \ > type=refreshOnly \ > interval=00:00:02:00 \ > scope=sub \ > schemachecking=off \ > searchbase="dc=domen,dc=com" \ > bindmethod=simple \ > binddn="dc=domen,dc=com" \ > credentials=**** \ > retry="60 10 300 10" > ...................... > > I have these errors on all my slaves. What may be the cause of those > errors? I have no idea about that. Please HELP! > >

2 1

openLDAP upgrate
by mdii 28 Aug '15

28 Aug '15

Hi all, I'm starting as an openLDAP administrator, and here in my company they are running the openLDAP 2.4.35. - I found this avec la commande ldapsearch -VV I want to upgrade to the letest version available (2.4.42), how should I procede ? I read that I just need to download the new package, stop the server, install the new version and then restart the server, is that all? Thanks in advance for your help, Marc

2 1

disable unique overlay from member attributes
by Fischer, Johannes 27 Aug '15

27 Aug '15

Hi @all, I try to allow double entries for the attribute member. I’ve tried it with the ldif: dn: olcOverlay=unique,olcDatabase={1}hdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcUniqueConfig olcOverlay: unique olcUniqueUri: ignore ldap:///?members?sub but when I load it to the config with: ldapmodify the Error: ldap_add: invalid syntax (21) additional info: objectClass: value #1 invalid per syntax What is going wrong here? Greetings John -- Johannes Fischer Wissenschaftlicher Angestellter Fraunhofer-Institut für Produktionstechnik und Automatisierung IPA Kompetenzzentrum Digitale Werkzeuge in der Produktion Nobelstraße 12 │ 70569 Stuttgart Telefon +49 711 970-1217 johannes.fischer(a)ipa.fraunhofer.de<mailto:johannes.fischer@ipa.fraunhofer.de> www.ipa.fraunhofer.de<http://www.ipa.fraunhofer.de/> [cid:image001.png@01D0DE8D.A482B990]

3 3

Mail attribute: how to make it mandatory.
by Simone Taliercio 27 Aug '15

27 Aug '15

Hi again :p Since there's a lot of posting about attributes and unique overlay then I decided to make it even worse ;) I'm using OpenLDAP for storing entries which have *inetOrgPerson* as objectclass. What would be required to switch the "mail" attribute from optional to mandatory ? Thanks a lot for the support! Simone

2 4

authz-regexp behavior with GSSAPI
by Peter Heinemann 26 Aug '15

26 Aug '15

Good day, I am trying to figure out different behaviors with authz-regexp in slapd.conf. openldap 2.4-39 RHEL 6.5 cyrus-sasl and cyrus-sasl-gssapi 2.1.23-15 krb5-libs 1.10.3-42 We're mapping based on a search for the presence of the userPassword attribute. In production is: sasl-host pennid.upenn.edu sasl-realm UPENN.EDU authz-regexp uid=(.*),cn=UPENN.EDU,cn=gssapi,cn=auth ldap:///ou=entities,dc=upenn,dc=edu??one?(userPassword={SASL}$1@UPENN.EDU) and the authentication mapping works as desired; the user@realm gets mapped to the just the username and the search succeeds: ldapwhoami -Y GSSAPI -U netmon -H ldaps://pennid.upenn.edu SASL/GSSAPI authentication started SASL username: netmon(a)UPENN.EDU SASL SSF: 56 SASL data security layer installed. dn:uid=netmon,ou=entities,dc=upenn,dc=edu However, on development in a different kerberos realm, that statement will not map properly. The mapping doesn't take place, so user@realm is used for the (unsuccessful) search: sasl-host pennid-dev.net.isc.upenn.edu sasl-realm TEST.NET.ISC.UPENN.EDU authz-regexp uid=(.*),cn=TEST.NET.ISC.UPENN.EDU,cn=gssapi,cn=auth ldap:///ou=entities,dc=upenn,dc=edu??one?(userPassword={SASL}$1@TEST.NET.ISC.UPENN.EDU) no mapping takes place: ldapwhoami -Y GSSAPI -U netmon -H ldaps://pennid-dev.net.isc.upenn.edu SASL/GSSAPI authentication started SASL username: netmon(a)TEST.NET.ISC.UPENN.EDU SASL SSF: 56 SASL data security layer installed. dn:uid=netmon@test.net.isc.upenn.edu,cn=test.net.isc.upenn.edu,cn=gssapi,cn=auth However, a change to the regexp on the development system will cause mapping to work there: authz-regexp uid=(.*)(a)TEST.NET.ISC.UPENN.EDU,cn=TEST.NET.ISC.UPENN.EDU,cn=gssapi,cn=auth ldap:///ou=entities,dc=upenn,dc=edu??one?(userPassword={SASL}$1@TEST.NET.ISC.UPENN.EDU) $ ldapwhoami -Y GSSAPI -U netmon -H ldaps://pennid-dev.net.isc.upenn.edu SASL/GSSAPI authentication started SASL username: netmon(a)TEST.NET.ISC.UPENN.EDU SASL SSF: 56 SASL data security layer installed. dn:uid=netmon,ou=entities,dc=upenn,dc=edu But a similar regexp in production will not map properly: authz-regexp uid=(.*)(a)UPENN.EDU,cn=UPENN.EDU,cn=gssapi,cn=auth ldap:///ou=entities,dc=upenn,dc=edu??one?(userPassword={SASL}$1@UPENN.EDU) ldapwhoami -Y GSSAPI -U netmon -H ldaps://pennid.upenn.edu SASL/GSSAPI authentication started SASL username: netmon(a)UPENN.EDU SASL SSF: 56 SASL data security layer installed. dn:uid=netmon,cn=upenn.edu,cn=gssapi,cn=auth Can anyone shed light on the different behavior? - only the authz-regexp has been modified - slapd was restarted after the changes. Thanks, Peter

1 0

Re: Slapd is coming down
by Édnei Rodrigues 25 Aug '15

25 Aug '15

I have two process because I am replicating the production three to this environment ( dev, port 1389) and I have a translucent service to overlap a few attributes (port 389 ). Thanks. Em 20/08/2015 15:43, "Quanah Gibson-Mount" <quanah(a)zimbra.com> escreveu: > --On Thursday, August 20, 2015 4:00 PM -0300 Édnei Rodrigues < > ednei.felipe.rodrigues(a)gmail.com> wrote: > > >> Hello quanah! >> Yes, I know, my SO killed the slapd because it was configured. >> But I don't have any other service in the server, only the openldap. >> > > Why do you have two slapd processes on the server? Your setup seems > somewhat odd. > > --Quanah > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 1

How to create multiple schema at the same level in openldap
by PRATIK SINGAL 25 Aug '15

25 Aug '15

Hello all, Can any one help me on how the schema files will be created where multiple schema can be present at the same level.Below is the diagram where Schema C And Schema D are two Schema which needs to be present at the same third level under Schema B. Schema A | Schema B | | Schema C Schema D Regards, Pratik

2 1

Centos 7/openldap/samba
by Alex Moen 25 Aug '15

25 Aug '15

Setting up a new openldap server on Centos 7. I am trying to add the samba.schema that comes with samba. I got the schema file from the newest distribution of Samba, copied it to /etc/openldap/schema, and ran "ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/samba.schema". This command worked perfectly with the cosine and inetorgperson schema files, but I got an 'invalid format (line 1) entry: ""' response. I grepped the internet for this response, and found that some people have needed to change all "attryibutetype" entries to "attributetype:". So, I did that. It got me to line 2, where the leading descriptor is "DESC". I changed all the "DESC" to "DESC:", which was also helpful and moved me on to line 3, and so on. So, now I have gotten to line 236, which is an objectclass statement, so I am lost. None of the other files that worked with this exact same command syntax has any of the colons on the descriptors (IDK what they are really called), so I wonder if I'm not barking up the wrong tree. I also can't find anything on the net that speaks to this issue, so I am guessing that I probably have some other problem with the server. Any suggestions??? TIA! Alex -- Alex Moen NSTII North Dakota Telephone Company 701-662-6481

3 2

Group of groups wiith posfix
by Jose Legido 25 Aug '15

25 Aug '15

Hello I have debian machine configured sudo with ldap group. The ldap group is objectclass posixGroup and the users memberUid. I want to put groups instead of users. It's possible? Thank you

1 0

LDAP proxy issue
by jason cafarelli 25 Aug '15

25 Aug '15

note: Apologize if this dupes; think i sent original out before i was approved on mailing list. A bit stuck; bear with me; somewhat of a LDAP nubbie; sure i am missing something simple, Trying to get a local server to AUTH locally to its own openldap-server and then proxy to corporate LDAP if user is not found locally. 1. Local users work 2. AUTH to local LDAP server works 3. AUTH to corporate LDAP does NOT work 4. LDAP search to corporate works when using local server (ack!?!) user = corporate LDAP account internal ldap = users - internal.com corporate ldap = people - datacenter.corporate.com note: anonymous bind is enabled on corporate. oot@ sssd]# ldapsearch -h 127.0.0.1 -x -b "uid=user,ou=people,dc=datacenter,dc=corporate,dc=com" # extended LDIF # # LDAPv3 # base <uid=user,ou=people,dc=datacenter,dc=corporate,dc=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # user, People, datacenter.corporate.com dn: uid=user,ou=People,dc=datacenter,dc=corporate,dc=com uid: user cn: objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount shadowMax: shadowWarning: loginShell: /bin/bash uidNumber: gidNumber: homeDirectory: /home/users/user gecos: user shadowLastChange: 16461 # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Setup slap.d; ####################################################################### # database definitions ####################################################################### database bdb suffix "dc=internal,dc=com" checkpoint 1024 15 rootdn "cn=adm,dc=internal,dc=com" rootpw {SSHA}aaaaa directory /var/lib/ldap # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub # Replicas of this database #replogfile /var/lib/ldap/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com(a)EXAMPLE.COM #proxy ldap database ldap suffix "ou=People,dc=datacenter,dc=corp,dc=com" uri "ldap://1.1.1.1:389/" idassert-bind bindmethod=none ldap.conf URI ldap://127.0.0.1 BASE dc=internal,dc=com

1 0

OpenLDAP 2.4.42 RPMs for Red Hat / CentOS
by Clément OUDOT 24 Aug '15

24 Aug '15

Hi, OpenLDAP 2.4.42 RPMs for Red Hat / CentOS are available on LDAP Tool Box project : http://ltb-project.org/wiki/download#packages_for_red_hatcentos You can see packages description here: http://ltb-project.org/wiki/documentation/openldap-rpm -- Clément OUDOT Consultant en logiciels libres, Expert infrastructure et sécurité Savoir-faire Linux 87, rue de Turbigo - 75003 PARIS

1 0

Re: How to let users change passwords
by robert k Wild 24 Aug '15

24 Aug '15

i feel such a donut! it was because i had a space inbetween the lines of "modify time stamp" and the first "olcaccess", i deleted the space restarted slapd and on the client when i run the command passwd i can successfully change the user password

1 0

How to let users change passwords
by robert k Wild 24 Aug '15

24 Aug '15

Hi all, I have an openldap server (centos 6.6) and created a user account and given the user a generic password eg "password123" when my end user logs in there client (centos 6.6) How can i give them an option if they want to, to change their own password or for them to change their password when they login Many thanks Rob -- Regards, Robert K Wild.

1 0

How can I Modify OpenLdap database?
by Jason Long 22 Aug '15

22 Aug '15

Hello. I added some entries to OpenLdap but I want edit them. How can I do it? my "slapcat" output is : # slapcat 55d45334 ldif_read_file: checksum error on "/etc/openldap/slapd.d/cn=config/olcDatabase={1}monitor.ldif" 55d45334 ldif_read_file: checksum error on "/etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb.ldif" 55d45334 The first database does not allow slapcat; using the first available one (2) 55d45334 hdb_db_open: warning - no DB_CONFIG file found in directory /var/lib/ldap: (2). Expect poor performance for suffix "dc=linux,dc=dj". dn: dc=linux-d,dc=j objectClass: dcObject objectClass: organization dc: linux-d o: linux-d structuralObjectClass: organization entryUUID: 1c4fa7b0-da8c-1034-91a3-f90dc6355c19 creatorsName: cn=Manager,dc=linux-d,dc=j createTimestamp: 20150819070316Z entryCSN: 20150819070316.921292Z#000000#000#000000 modifiersName: cn=Manager,dc=linux-d,dc=j modifyTimestamp: 20150819070316Z dn: ou=Users,dc=linux-d,dc=j objectClass: organizationalUnit ou: Users structuralObjectClass: organizationalUnit entryUUID: c3dbe28c-da8c-1034-91a4-f90dc6355c19 creatorsName: cn=Manager,dc=linux-d,dc=j createTimestamp: 20150819070758Z entryCSN: 20150819070758.019816Z#000000#000#000000 modifiersName: cn=Manager,dc=linux-d,dc=j modifyTimestamp: 20150819070758Z I want to change "linux-d" to "linux". I edited "/tmp/users.ldif" file and used "ldapmodify -a -D cn=Manager,dc=linux,dc=dj -w hack3rcon -f /tmp/users.ldif" but "slapcat" output still is : slapcat 55d4568e ldif_read_file: checksum error on "/etc/openldap/slapd.d/cn=config/olcDatabase={1}monitor.ldif" 55d4568e ldif_read_file: checksum error on "/etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb.ldif" 55d4568e The first database does not allow slapcat; using the first available one (2) 55d4568e hdb_db_open: warning - no DB_CONFIG file found in directory /var/lib/ldap: (2). Expect poor performance for suffix "dc=linux,dc=dj". dn: dc=linux-d,dc=j objectClass: dcObject objectClass: organization dc: linux-d o: linux-d structuralObjectClass: organization entryUUID: 1c4fa7b0-da8c-1034-91a3-f90dc6355c19 creatorsName: cn=Manager,dc=linux-d,dc=j createTimestamp: 20150819070316Z entryCSN: 20150819070316.921292Z#000000#000#000000 modifiersName: cn=Manager,dc=linux-d,dc=j modifyTimestamp: 20150819070316Z dn: ou=Users,dc=linux-d,dc=j objectClass: organizationalUnit ou: Users structuralObjectClass: organizationalUnit entryUUID: c3dbe28c-da8c-1034-91a4-f90dc6355c19 creatorsName: cn=Manager,dc=linux-d,dc=j createTimestamp: 20150819070758Z entryCSN: 20150819070758.019816Z#000000#000#000000 modifiersName: cn=Manager,dc=linux-d,dc=j modifyTimestamp: 20150819070758Z dn: dc=linux,dc=dj objectClass: dcObject objectClass: organization dc: linux o: linux structuralObjectClass: organization entryUUID: e1968706-daa4-1034-82a7-470596994b9c creatorsName: cn=Manager,dc=linux,dc=dj createTimestamp: 20150819100035Z entryCSN: 20150819100035.818429Z#000000#000#000000 modifiersName: cn=Manager,dc=linux,dc=dj modifyTimestamp: 20150819100035Z dn: ou=Users,dc=linux,dc=dj objectClass: organizationalUnit ou: Users structuralObjectClass: organizationalUnit entryUUID: 2a1a366c-daa5-1034-82a8-470596994b9c creatorsName: cn=Manager,dc=linux,dc=dj createTimestamp: 20150819100237Z entryCSN: 20150819100237.477397Z#000000#000#000000 modifiersName: cn=Manager,dc=linux,dc=dj modifyTimestamp: 20150819100237Z As you see, I have "linux-d" . How can I solve it?

2 5

OLC ppolicy
by Jeremy Trammell - DLA 22 Aug '15

22 Aug '15

Greetings, I'm trying to set up a very simple LDAP server using OpenLDAP (via OLC) and it seems hopeless. The sticking point is ppolicy. I have followed several online guides (http://www.ryanfrantz.com/posts/openldap-implementing-the-password-policy-o…, https://www.oostergo.net/node/85, to name a few), all of which seem to essentially detail the same procedure, and have met with no success. Whilst following those instructions, I receive no error messages. All commands complete successfully and do not indicate failures of any kind. Looking at the cn=config and target DITs, all data seems to have been imported as expected. Despite that fact, passwd follows a "mystery policy" which bears no resemblance to the policy that I have specified, and ldappasswd follows "no policy at all you can do whatever you want". Is there some way for me to empirically determine what these commands are doing, and why my policy does nothing? Thanks in advance... cn=module{0},cn=config > objectClass: olcModuleList > cn: module{0} > olcModuleLoad: {0}ppolicy.la > olcModuleLoad: {1}back_hdb > olcModuleLoad: {2}ppolicy > olcModulePath: /usr/lib/ldap olcDatabase={1}hdb,cn=config > objectClass: olcDatabaseConfig > objectClass: olcHdbConfig > olcDatabase: {1}hdb > olcDbDirectory: /var/lib/ldap > olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by > anonymous auth by dn="cn=admin,dc=dla" write by * none > olcAccess: {1}to dn.base="" by * read > olcAccess: {2}to * by self write by dn="cn=admin,dc=dla" write by * read > olcDbCheckpoint: 512 30 > olcDbConfig: {0}set_cachesize 0 2097152 0 > olcDbConfig: {1}set_lk_max_objects 1500 > olcDbConfig: {2}set_lk_max_locks 1500 > olcDbConfig: {3}set_lk_max_lockers 1500 > olcDbIndex: objectClass eq > olcLastMod: TRUE > olcSuffix: dc=dla olcOverlay={0}ppolicy,olcDatabase={1}hdb,cn=config > objectClass: olcOverlayConfig > objectClass: olcPPolicyConfig > olcOverlay: {0}ppolicy > olcPPolicyDefault: cn=passwordDefault,ou=policies,dc=dla > olcPPolicyForwardUpdates: FALSE > olcPPolicyHashCleartext: TRUE > olcPPolicyUseLockout: FALSE cn=passwordDefault,ou=policies,dc=dla > objectClass: person > objectClass: pwdPolicy > objectClass: pwdPolicyChecker > objectClass: top > cn: passwordDefault > pwdAttribute: 2.5.4.35 > sn: passwordDefault > pwdMinLength: 12

3 5

Multi-master syncrepl config: excluding olcSaslHost from replication
by Kyle Brantley 22 Aug '15

22 Aug '15

I'm working on a full multi-master slapd setup, where both the cn=config database as well as the actual database are fully replicated. All access to the slapd instances is gated with GSSAPI (the only notable exception being the syncrepl users, which I'm working on converting over to GSSAPI anyway). However, I need to be able to configure olcSaslHost on a per-server basis. Server A will have a different value for olcSaslHost than server B will. While I want to replicate cn=config, I don't want to replicate the olcSaslHost attribute. I've tried two things, and neither have worked: 1) Configuring exattrs="olcSaslHost" in the olcSyncrepl statements for cn=config. * This allows me to configure the attribute, but as soon as there is any other change to cn=config, it wipes the attribute out across all of the nodes. 2) Updating the ACL for the syncrepl user to not have access to the olcSaslHost attribute. * Unfortunately, this has similar behavior to the above: making a change on one node will wipe the olcSaslHost attribute out of all of the nodes. How best can I go about doing this? I was hoping that olcSaslRealm was multi-value and could be configured in a manner similar to olcServerID, but that isn't the case. I was hoping that denying access to the attributes (via ACL or olcSynrepl config) would make the syncrepl engine ignore the attribute, but because it can't see it on the node where the attribute was changed, but it can see it on the downstream nodes, it wipes the attribute out entirely. Any help / suggestions welcome. Thanks, --Kyle

3 2

Segmentation fault when overwriting a k/v with MDB_RESERVE ?
by Simon Majou 21 Aug '15

21 Aug '15

Hello, I wonder, why do I get a Segmentation fault when I use mdb_put with MDB_RESERVE on a key that already exists ? -- Best regards, Simon Majou

2 9

ClearText Passwords in slapcat: please provide some inputs
by Manuel Afonso 21 Aug '15

21 Aug '15

Hi people, I am using ubuntu and phpldapadmin to manage openldap. I have here a big issue: when using phpldapadmin/openldap, all the times there is (for each user/entry) a field with cleartextPassword: <cleartextpassword> (this is seen in slapcat output) What I want is to put in place a mechanism where there is no plain text field with the password in clear in each entry of openldap. I have read about ppolicy overlay, slappasswd and so on but so far I was not able to figure out how to avoid this annoying clear text password available when I do a slapcat (as root of course) Does anybody had such an issue ? Any ideas or links to point for a solution? Another question: is it possible that this clear text password is somehow needed for the correct operation of openldap? Thanks a lot for your time and (I hope) help. Kind regards, Manuel - Lisbon PT This is what I got for the user mafonso (me) when doing a slapcat > output : (as can be seen there is the field cleartextPassword: with pass in clear text) dn: cn=mafonso,ou=***,dc=***,dc=***,dc=***,dc=pt objectClass: ****Person objectClass: mailAccount objectClass: sambaSamAccount objectClass: posixAccount objectClass: top givenName: Manuel sn: Afonso displayName: Manuel Afonso cn: mafonso mailacceptinguser: 1 maildrop: mafonso(a)***.pt intranetRole: cn=**,ou=**,ou=**,dc=**,dc=**,dc=**,dc=pt ... portalRole: *** ... gidNumber: 516 sambaSID: *** uidNumber: 1399 uid: mafonso homeDirectory: /home/mafonso intranetStatus: U sambaAcctFlags: [UX] loginShell: /bin/false mailacceptinggeneralid: mafonso@**** mailacceptinggeneralid: ***(a)**.**.**.pt userPassword:: e1N.... cleartextPassword: <cleartextpassword> sambaNTPassword: D6... sambaLMPassword: 45...

3 2

LDAP over SSL ( ldaps )
by Aneela Saleem 20 Aug '15

20 Aug '15

Hi all, Can anyone please provide me some link for enabling "ldaps" i have followed many links but continuously failing to do so. I have also tried "startTLS" but its not compatible with Apache Knox. Any help would be appreciated. Thanks

5 28

Re: Slapd is coming down
by Édnei Rodrigues 20 Aug '15

20 Aug '15

Hello quanah! Yes, I know, my SO killed the slapd because it was configured. But I don't have any other service in the server, only the openldap. Quanah, below follow the information: - Openldap-syncrepl: 2 GB - Openldap-translucent: 567 MB Now, about the slapd process. The strange is the size in the memory: - Server 1 Tasks: 110 total, 1 running, 109 sleeping, 0 stopped, 0 zombie Cpu(s): 0.3%us, 0.3%sy, 0.0%ni, 99.2%id, 0.2%wa, 0.0%hi, 0.0%si, 0.0%st Mem: 12248128k total, 5686580k used, 6561548k free, 223244k buffers Swap: 2097148k total, 88940k used, 2008208k free, 4488408k cached PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 4965 ldap 20 0 4692m 777m 527m S 1.0 6.5 101:16.12 slapd 1460 ldap 20 0 9700m 2.1g 1.9g S 0.3 18.0 1174:58 slapd ldap 1460 1 2 Jul12 ? 19:34:58 /usr/local/openldap/libexec/slapd -h ldap://127.0.0.1:1389 ldaps:// 127.0.0.1:1636 -f /usr/local/openldap/etc/openldap/slapd-syncrepl.conf -u ldap -g ldap -l local3 ldap 4965 1 10 Aug19 ? 01:41:19 /usr/local/openldap/libexec/slapd -h ldap://*:389 ldaps://*:636 -f /usr/local/openldap/etc/openldap/slapd.conf -u ldap -g ldap -l local4 root 14399 14157 0 09:12 pts/0 00:00:00 grep ldap - Server 2 Tasks: 113 total, 1 running, 112 sleeping, 0 stopped, 0 zombie Cpu(s): 0.0%us, 0.2%sy, 0.0%ni, 99.7%id, 0.2%wa, 0.0%hi, 0.0%si, 0.0%st Mem: 12194476k total, 8111400k used, 4083076k free, 213632k buffers Swap: 2097148k total, 7344k used, 2089804k free, 7225108k cached PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 30907 ldap 20 0 8832m 2.3g 2.2g S 0.0 19.9 11:10.55 slapd 30956 ldap 20 0 4486m 502m 339m S 0.0 4.2 7:34.95 slapd ldap 30907 1 1 Aug19 ? 00:11:10 /usr/local/openldap/libexec/slapd -h ldap://127.0.0.1:1389 ldaps:// 127.0.0.1:1636 -f /usr/local/openldap/etc/openldap/slapd-syncrepl.conf -u ldap -g ldap -l local3 ldap 30956 1 0 Aug19 ? 00:07:39 /usr/local/openldap/libexec/slapd -h ldap://*:389 ldaps://*:636 -f /usr/local/openldap/etc/openldap/slapd.conf -u ldap -g ldap -l local4 Otherwise, in the few days, the slapd process increase the consumption until remain nothing! And it is the why the oom-killer kill the slapd, because your bad score. Why is the slapd consuming many memory? Do you need more information? Thank you! Em 19/08/2015 14:11, "Quanah Gibson-Mount" <quanah(a)zimbra.com> escreveu: > --On Wednesday, August 19, 2015 2:39 PM -0300 Édnei Rodrigues < > ednei.felipe.rodrigues(a)gmail.com> wrote: > > >> Hello Guys, how are you doing ? >> > > Aug 19 09:51:44 ds1openldap2h kernel: Out of memory: Kill process 21760 >> (slapd) score 957 or sacrifice child >> Aug 19 09:51:44 ds1openldap2h kernel: Killed process 21760, UID 55, >> (slapd) total-vm:18314360kB, anon-rss:11646816kB, file-rss:680kB >> > > Your OS killed it, slapd didn't "come down". You don't give any useful > information, so it's hard to provide guidance. I've often seen this when > other processes (particularly java based) are using up memory, and slapd > goes to alloc new memory, so the OS kills it. Useful details besides your > version (2.4.39, per the log) would be: > > database backend > database size > slapd process size after DB is fully in memory > > etc > > --Quanah > > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

ACL rule: getting crazy with it.
by Simone Taliercio 20 Aug '15

20 Aug '15

Hi All, I've Jasig CAS connected to OpenLDAP for users authentication. My LDAP Schema is the following: dc=com dc=companyA,dc=com ou=user,dc=companyA,dc=com dc=companyB,dc=com ou=user,dc=companyB,dc=com I would like to give to a specific user (cn=admin,ou=user,dc=companyB,dc=com) the ability to create inetOrgPerson objetcs under ou=user,dc=companyA,dc=com and the restriction to have only search access to ou=user,dc=companyB,dc=com where actually some attributes should be hidden (such as userPassword). I tried several ACL but always with one strange problem: a user is able to login via CAS. Then, he/she logouts and if try with a different account then LDAP returns DN_RESOLUTION_FAILURE. That issue is occurring even with a simple ACL such as: access to * by self write by anonymous auth by users search The only way to workaround that issue is removing any ACL or leaving "by users read". As DN bind I'm using dc=com. Any suggestion? I cannot understand if focusing on CAS for this issue, or ACL LDAP side. Thanks a LOT for the support! Simone

2 2

Slapd is coming down
by Édnei Rodrigues 19 Aug '15

19 Aug '15

Hello Guys, how are you doing ? In the last weeks, my openldaps servers were suffering with many come down. I have a peak about the 400 connections per peer ( We have 2 ldap servers ). Although I has added more memory (4 GB), the problem decreased, but not resolved. So, How Could I troubleshooting it ? My enviroment: - Two Red Hat Enterprise Linux Server release 6.6 (Santiago) - Two processors and 12 GB of RAM - Both environments are virtualized. *************************************** My slapd.conf: moduleload back_ldap moduleload translucent moduleload dynlist moduleload back_monitor backend mdb backend ldap allow bind_v2 allow bind_anon_dn database mdb directory /usr/local/openldap/var/openldap-translucent suffix "*****" rootdn "*************" rootpw **************************** maxsize 4294967296 sizelimit 100000 overlay translucent uri "ldap://localhost:1389/" translucent_bind_local on translucent_pwmod_local on translucent_local ****************************** idassert-bind bindmethod=none overlay dynlist dynlist-attrset groupOfURLs memberURL member:uniqueMember ************************** My slapd-syncrepl.conf: allow bind_v2 allow bind_anon_dn moduleload syncprov moduleload dynlist # Definicoes da base primaria database mdb suffix "**" rootdn "******" directory /usr/local/openldap/var/openldap-syncrepl rootpw ****** sizelimit 100000 maxsize 8589934592 overlay dynlist dynlist-attrset groupOfURLs memberURL member:uniqueMember loglevel sync stats idletimeout 0 # ACLs include /usr/local/openldap/etc/openldap/schema/sicredi.acl overlay syncprov # Começo do Consumidor index entryUUID eq # syncrepl directives syncrepl rid=0 provider=ldap://MASTER_Production:389 bindmethod=simple binddn="************" credentials=**** searchbase="****" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" type=refreshAndPersist retry="60 +" syncdata=accesslog # Refer updates to the master updateref ldap://MASTER_Production:389 ***** My openldap version: openldap-ltb-2.4.39-1.el6.x86_64 And What I saw in the logs: Aug 19 09:51:43 ds1openldap2h kernel: slapd invoked oom-killer: gfp_mask=0x201da, order=0, oom_adj=0, oom_score_adj=0 Aug 19 09:51:43 ds1openldap2h kernel: slapd cpuset=/ mems_allowed=0 Aug 19 09:51:43 ds1openldap2h kernel: Pid: 4233, comm: slapd Not tainted 2.6.32-504.23.4.el6.x86_64 #1 Aug 19 09:51:43 ds1openldap2h kernel: Call Trace: Aug 19 09:51:44 ds1openldap2h kernel: [<ffffffff810d4241>] ? cpuset_print_task_mems_allowed+0x91/0xb0 Aug 19 09:51:44 ds1openldap2h kernel: [<ffffffff81127500>] ? dump_header+0x90/0x1b0 Aug 19 09:51:44 ds1openldap2h kernel: [<ffffffff8122ee7c>] ? security_real_capable_noaudit+0x3c/0x70 Aug 19 09:51:44 ds1openldap2h kernel: [<ffffffff81127982>] ? oom_kill_process+0x82/0x2a0 Aug 19 09:51:44 ds1openldap2h kernel: [<ffffffff811278c1>] ? select_bad_process+0xe1/0x120 Aug 19 09:51:44 ds1openldap2h kernel: [<ffffffff81127dc0>] ? out_of_memory+0x220/0x3c0 Aug 19 09:51:44 ds1openldap2h kernel: [<ffffffff811346ff>] ? __alloc_pages_nodemask+0x89f/0x8d0 Aug 19 09:51:44 ds1openldap2h kernel: [<ffffffff8116c9aa>] ? alloc_pages_current+0xaa/0x110 Aug 19 09:51:44 ds1openldap2h kernel: [<ffffffff811248f7>] ? __page_cache_alloc+0x87/0x90 Aug 19 09:51:44 ds1openldap2h kernel: [<ffffffff811242de>] ? find_get_page+0x1e/0xa0 Aug 19 09:51:44 ds1openldap2h kernel: [<ffffffff81125897>] ? filemap_fault+0x1a7/0x500 Aug 19 09:51:44 ds1openldap2h kernel: [<ffffffff8114ed04>] ? __do_fault+0x54/0x530 Aug 19 09:51:44 ds1openldap2h kernel: [<ffffffff8114f2d7>] ? handle_pte_fault+0xf7/0xb00 Aug 19 09:51:44 ds1openldap2h kernel: [<ffffffff8109ec20>] ? autoremove_wake_function+0x0/0x40 Aug 19 09:51:44 ds1openldap2h kernel: [<ffffffff8114ff79>] ? handle_mm_fault+0x299/0x3d0 Aug 19 09:51:44 ds1openldap2h kernel: [<ffffffff8104d096>] ? __do_page_fault+0x146/0x500 Aug 19 09:51:44 ds1openldap2h kernel: [<ffffffff81529a1e>] ? thread_return+0x4e/0x7d0 Aug 19 09:51:44 ds1openldap2h kernel: [<ffffffff8153001e>] ? do_page_fault+0x3e/0xa0 Aug 19 09:51:44 ds1openldap2h kernel: [<ffffffff8152d3d5>] ? page_fault+0x25/0x30 Aug 19 09:51:44 ds1openldap2h kernel: Mem-Info: Aug 19 09:51:44 ds1openldap2h kernel: Node 0 DMA per-cpu: Aug 19 09:51:44 ds1openldap2h kernel: CPU 0: hi: 0, btch: 1 usd: 0 Aug 19 09:51:44 ds1openldap2h kernel: CPU 1: hi: 0, btch: 1 usd: 0 Aug 19 09:51:44 ds1openldap2h kernel: Node 0 DMA32 per-cpu: Aug 19 09:51:44 ds1openldap2h kernel: CPU 0: hi: 186, btch: 31 usd: 0 Aug 19 09:51:44 ds1openldap2h kernel: CPU 1: hi: 186, btch: 31 usd: 0 Aug 19 09:51:44 ds1openldap2h kernel: Node 0 Normal per-cpu: Aug 19 09:51:44 ds1openldap2h kernel: CPU 0: hi: 186, btch: 31 usd: 10 Aug 19 09:51:44 ds1openldap2h kernel: CPU 1: hi: 186, btch: 31 usd: 0 Aug 19 09:51:44 ds1openldap2h kernel: active_anon:2571953 inactive_anon:399686 isolated_anon:0 Aug 19 09:51:44 ds1openldap2h kernel: active_file:305 inactive_file:604 isolated_file:0 Aug 19 09:51:44 ds1openldap2h kernel: unevictable:0 dirty:1 writeback:0 unstable:0 Aug 19 09:51:44 ds1openldap2h kernel: free:29811 slab_reclaimable:2307 slab_unreclaimable:7010 Aug 19 09:51:44 ds1openldap2h kernel: Node 0 DMA free:15276kB min:80kB low:100kB high:120kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:14884kB mlocked:0kB dirty:0kB writeback:0kB mapped:0kB shmem:0kB slab_reclaimable:0kB slab_unreclaimable:0kB kernel_stack:0kB pagetables:0kB unstable:0kB bounce:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? yes Aug 19 09:51:44 ds1openldap2h kernel: lowmem_reserve[]: 0 3000 12090 12090 Aug 19 09:51:44 ds1openldap2h kernel: Node 0 DMA32 free:53124kB min:16748kB low:20932kB high:25120kB active_anon:2127764kB inactive_anon:559804kB active_file:0kB inactive_file:152kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3072096kB mlocked:0kB dirty:0kB writeback:0kB mapped:128kB shmem:0kB slab_reclaimable:8kB slab_unreclaimable:12kB kernel_stack:0kB pagetables:900kB unstable:0kB bounce:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no Aug 19 09:51:44 ds1openldap2h kernel: lowmem_reserve[]: 0 0 9090 9090 Aug 19 09:51:44 ds1openldap2h kernel: Node 0 Normal free:51016kB min:50752kB low:63440kB high:76128kB active_anon:8160048kB inactive_anon:1038940kB active_file:1224kB inactive_file:2052kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:9308160kB mlocked:0kB dirty:4kB writeback:0kB mapped:1288kB shmem:0kB slab_reclaimable:9220kB slab_unreclaimable:28028kB kernel_stack:1392kB pagetables:44504kB unstable:0kB bounce:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no Aug 19 09:51:44 ds1openldap2h kernel: lowmem_reserve[]: 0 0 0 0 Aug 19 09:51:44 ds1openldap2h kernel: Node 0 DMA: 1*4kB 1*8kB 2*16kB 2*32kB 1*64kB 0*128kB 1*256kB 1*512kB 0*1024kB 1*2048kB 3*4096kB = 15276kB Aug 19 09:51:44 ds1openldap2h kernel: Node 0 DMA32: 2599*4kB 1163*8kB 354*16kB 75*32kB 28*64kB 15*128kB 9*256kB 12*512kB 9*1024kB 0*2048kB 1*4096kB = 53236kB Aug 19 09:51:44 ds1openldap2h kernel: Node 0 Normal: 846*4kB 640*8kB 413*16kB 236*32kB 119*64kB 48*128kB 28*256kB 10*512kB 2*1024kB 0*2048kB 0*4096kB = 50760kB Aug 19 09:51:44 ds1openldap2h kernel: 5598 total pagecache pages Aug 19 09:51:44 ds1openldap2h kernel: 4605 pages in swap cache Aug 19 09:51:44 ds1openldap2h kernel: Swap cache stats: add 1173695, delete 1169090, find 121530/123860 Aug 19 09:51:44 ds1openldap2h kernel: Free swap = 0kB Aug 19 09:51:44 ds1openldap2h kernel: Total swap = 2097148kB Aug 19 09:51:44 ds1openldap2h kernel: 3145712 pages RAM Aug 19 09:51:44 ds1openldap2h kernel: 97157 pages reserved Aug 19 09:51:44 ds1openldap2h kernel: 797 pages shared Aug 19 09:51:44 ds1openldap2h kernel: 3014707 pages non-shared Aug 19 09:51:44 ds1openldap2h kernel: [ pid ] uid tgid total_vm rss cpu oom_adj oom_score_adj name Aug 19 09:51:44 ds1openldap2h kernel: [ 441] 0 441 2795 0 0 -17 -1000 udevd Aug 19 09:51:44 ds1openldap2h kernel: [ 1251] 0 1251 47346 150 0 0 0 vmtoolsd Aug 19 09:51:44 ds1openldap2h kernel: [ 1290] 0 1290 23283 37 1 -17 -1000 auditd Aug 19 09:51:44 ds1openldap2h kernel: [ 1326] 65 1326 107809 573 1 0 0 nslcd Aug 19 09:51:44 ds1openldap2h kernel: [ 1340] 0 1340 62279 388 1 0 0 rsyslogd Aug 19 09:51:44 ds1openldap2h kernel: [ 1353] 0 1353 2707 46 0 0 0 irqbalance Aug 19 09:51:44 ds1openldap2h kernel: [ 1369] 32 1369 4744 15 1 0 0 rpcbind Aug 19 09:51:44 ds1openldap2h kernel: [ 1380] 81 1380 5881 36 1 0 0 dbus-daemon Aug 19 09:51:44 ds1openldap2h kernel: [ 1413] 0 1413 1020 0 1 0 0 acpid Aug 19 09:51:44 ds1openldap2h kernel: [ 1423] 68 1423 10041 151 0 0 0 hald Aug 19 09:51:44 ds1openldap2h kernel: [ 1424] 0 1424 5100 2 1 0 0 hald-runner Aug 19 09:51:44 ds1openldap2h kernel: [ 1456] 0 1456 5630 2 1 0 0 hald-addon-inpu Aug 19 09:51:44 ds1openldap2h kernel: [ 1470] 68 1470 4502 2 1 0 0 hald-addon-acpi Aug 19 09:51:44 ds1openldap2h kernel: [ 1510] 55 1510 2488944 50131 1 0 0 slapd Aug 19 09:51:44 ds1openldap2h kernel: [ 1572] 28 1572 241540 244 1 0 0 nscd Aug 19 09:51:44 ds1openldap2h kernel: [ 1597] 0 1597 16081 20 1 -17 -1000 sshd Aug 19 09:51:44 ds1openldap2h kernel: [ 1606] 38 1606 6566 72 1 0 0 ntpd Aug 19 09:51:44 ds1openldap2h kernel: [ 1629] 0 1629 28188 2 0 0 0 abrtd Aug 19 09:51:44 ds1openldap2h kernel: [ 1637] 0 1637 28131 23 1 0 0 abrt-dump-oops Aug 19 09:51:44 ds1openldap2h kernel: [ 1651] 0 1651 51804 2959 1 0 0 osad Aug 19 09:51:44 ds1openldap2h kernel: [ 1661] 0 1661 28742 18 1 0 0 crond Aug 19 09:51:44 ds1openldap2h kernel: [ 1771] 497 1771 257947 665 1 0 0 icinga2 Aug 19 09:51:44 ds1openldap2h kernel: [ 1795] 0 1795 25232 26 1 0 0 rhnsd Aug 19 09:51:44 ds1openldap2h kernel: [ 1804] 0 1804 27085 23 0 0 0 rhsmcertd Aug 19 09:51:44 ds1openldap2h kernel: [ 1818] 0 1818 1016 1 0 0 0 mingetty Aug 19 09:51:44 ds1openldap2h kernel: [ 1820] 0 1820 1016 1 0 0 0 mingetty Aug 19 09:51:44 ds1openldap2h kernel: [ 1822] 0 1822 1016 1 0 0 0 mingetty Aug 19 09:51:44 ds1openldap2h kernel: [ 1824] 0 1824 1016 1 0 0 0 mingetty Aug 19 09:51:44 ds1openldap2h kernel: [ 1826] 0 1826 1016 1 0 0 0 mingetty Aug 19 09:51:44 ds1openldap2h kernel: [ 1828] 0 1828 2794 0 1 -17 -1000 udevd Aug 19 09:51:44 ds1openldap2h kernel: [ 1829] 0 1829 2794 0 1 -17 -1000 udevd Aug 19 09:51:44 ds1openldap2h kernel: [ 1830] 0 1830 1016 1 0 0 0 mingetty Aug 19 09:51:44 ds1openldap2h kernel: [21760] 55 21760 4578590 2911874 1 0 0 slapd Aug 19 09:51:44 ds1openldap2h kernel: [16962] 0 16962 3105 113 1 0 0 nmon_x86_64_rhe Aug 19 09:51:44 ds1openldap2h kernel: [20314] 0 20314 3059 113 0 0 0 nmon_x86_64_rhe Aug 19 09:51:44 ds1openldap2h kernel: Out of memory: Kill process 21760 (slapd) score 957 or sacrifice child Aug 19 09:51:44 ds1openldap2h kernel: Killed process 21760, UID 55, (slapd) total-vm:18314360kB, anon-rss:11646816kB, file-rss:680kB Thanks for your attention. -- Atenciosamente, Édnei Rodrigues

2 1

0.9.16 build problems for android
by Kristoffer Sjögren 19 Aug '15

19 Aug '15

Hi This is a long shot. Just upgraded LMDB to 0.9.16 for lmdbjni (Java bindings for LMDB) and when building for android-ndk-r10e I get a build error complaing about undeclared PTHREAD_MUTEX_ROBUST [1]. The build procedure uses automake and is quite complex because of Java JNI bindings but maybe the build error/output rings a bell anyway? The build works fine with LMDB 0.9.15. Cheers, -Kristoffer [1] src/mdb.c:4636:49: error: 'PTHREAD_MUTEX_ROBUST' undeclared (first use in this function) [2] Full build output - http://pastebin.com/JwreP0dZ [3] agcc #!/bin/bash $NDK/toolchains/arm-linux-androideabi-4.9/prebuilt/linux-x86_64/bin/arm-linux-androideabi-gcc --sysroot=$NDK/platforms/android-19/arch-arm -DMDB_DSYNC=O_SYNC $@

2 2

Upgrading OpenLDAP from 2.4.39 to 2.4.41
by Brian Wright 18 Aug '15

18 Aug '15

We have a 2-way master production cluster actively running 2.4.39. We are wanting to upgrade to 2.4.41 (we haven't yet internally certified 42). What is the best practices around upgrading this cluster while keeping at least one of the servers online? Is it replication-safe to have one node on 2.4.39 and one on 2.4.41 for a short period? If not, I can temporarily comment out the syncrepl statements until both servers are on 2.4.41 and then reenable replication after both are upgraded. We can live with short inconsistency period between the servers during the upgrade of the servers until we can resume replication. Also, is the DB format fully compatible between these two versions or would it be better to reload the DB new from an LDIF backup on 2.4.41? Is there an upgrade doc somewhere that discusses these issues? Thanks. -- Signature *Brian Wright* *Sr. UNIX Systems Engineer * 901 Mariners Island Blvd Suite 200 San Mateo, CA 94404 USA *Email *brianw(a)marketo.com <mailto:brianw@marketo.com> *Phone *+1.650.539.3530** *****www.marketo.com <http://www.marketo.com/>* Marketo Logo

3 4

OpenLDAP proxy referral via SSL
by Declan O'Doherty 18 Aug '15

18 Aug '15

I am trying to set up an OpenLDAP server (2.40) on CentOS 6 that uses a proxy referral to another LDAP server (OpenDJ) , all via SSL/TLS The referral works if I do not use SSL but when I configure slapd.conf to require certs, I get an invalid password error: res_errno: 49, res_error: <Invalid password.>, res_matched: <> The proxy is configured to use SASL EXTERNAL binding but when connecting to the OpenDJ service, it binds anonymously: ldap_back_dobind_int: DN="<certificate DN>" without creds, binding anonymouslyldap_sasl_bind The same configuration works on Windows using OpenLDAP 2.38 Here is the configuration for the ldap backend in slapd.conf: database ldap suffix "ou=organization unit, o=organization" uri "ldaps://test.ldap.com:636/" chase-referrals yes idassert-bind bindmethod=sasl saslmech=EXTERNAL binddn="O=ORG,OU=ORGUNIT,C=US" tls_cacert="/path/to/ca cert.pem" tls_cert="/path/to/server cert.pem" tls_key="/path/to/server key.pem" tls_reqcert=demand mode=self Thank you

1 0

LMDB docs unavailable: 403
by Kristoffer Sjögren 17 Aug '15

17 Aug '15

Hi The link to the documentation for LMDB is broken. http://symas.com/mdb/doc Cheers, -Kristoffer

2 1

LMDB docs refresh?
by Arto Bendiken 17 Aug '15

17 Aug '15

Perhaps the generated Doxygen output at http://symas.com/mdb/doc/ might use a refresh for the latest LMDB release? The docs currently published there are 11 months old, and do not include e.g. any information on the recently-added mdb_txn_id() function--a good function to have, by the way. -- Arto Bendiken | @bendiken | http://ar.to

2 3

ACL to allow all but one OU
by Olaf Hopp 17 Aug '15

17 Aug '15

Hi listers, I have ~40 departments in several ou's and I need an ACL to allow access for one user to all but one OU. I do not want to forbid that ou in question and thus implicitly allowing all the others. I want to formulate this explicitly, so I can directly see what is allowed. Moreover the names of the ou's are very similar to each other, something like: ou=aaaa,dc=... ou=abaa,dc=... ou=bbaa,dc=... ou=bbbb,dc=... and suppose I want to disallow access to the ou=abaa. I ended up with two ACLs: the first one to forbid ou=abaa: access to dn.sub=ou=abaa,dc=.... \ attrs=entry by dn=uid=foo,dc=.... none by * break and then allowing access to all ou's with access to dn.regex=ou=[^,]+,dc=... \ attrs=.... by dn=uid=foo,dc=... by * break Is it possible to formulate this with just one ACL ? I tried something like "ou=!abaa" with just the second ACL but failed. Then I tried ou=[^a][^b][^a][^a] but this matches also the ou=bbbb to wich the uid=foo should have access. Thanks, Olaf -- Karlsruher Institut für Technologie (KIT) ATIS - Abt. Technische Infrastruktur, Fakultät für Informatik Dipl.-Geophys. Olaf Hopp - Leitung IT-Dienste - Am Fasanengarten 5, Gebäude 50.34, Raum 009 76131 Karlsruhe Telefon: +49 721 608-43973 Fax: +49 721 608-46699 E-Mail: Olaf.Hopp(a)kit.edu atis.informatik.kit.edu www.kit.edu KIT - Universität des Landes Baden-Württemberg und nationales Forschungszentrum in der Helmholtz-Gemeinschaft Das KIT ist seit 2010 als familiengerechte Hochschule zertifiziert.

1 1

Replication speed and data sizing (mdb)
by Brian Wright 15 Aug '15

15 Aug '15

We are using 2.4.39. I realize there are newer versions available, but at the time when we started our LDAP project, this was the version available. We are testing n-way master replication along with a large number of records using lmdb. Here's the config: * 8 way replication with 8 nodes (each node having 7 other connections) * 50k records * Inserting the records into one cluster node to replicate to all the rest The problems obvserved: * Some nodes are faster at replication than others. In general, the time to complete replication is slower than expected. In my test environment I found that 50k records can take up to 2 hours for some nodes to complete. The fastest nodes complete in 1.5 hours. Because these records are brand new insertions, delta based replication wouldn't help here. * When the replication is completed, some of the data.mdb files are larger than others (sometimes by an order of magnitude). We would like to understand the reason behind these two problems above. First, the replication system seems unusually slow. Second, we need to understand why the data.mdb file grows sometimes far larger on one node than the rest of the nodes. For example, in our production environment, while most nodes were around 1GB in data size, one node stored in excess of 40GB in data.mdb. In my testing lab, my the 50k record insertion left most nodes with a data.mdb size of 150MB. On one of the nodes, the data size was 262MB. Note that I've also tried alternative replication connectivity approaches to attempt to reduce the number of connections per server, but that did not improve replication performance or the varying data sizes in the end. If updating to a newer version helps resolve the above observed problems, please let me know. Any tuning or debugging advice here would be appreciated. Thanks. -- Signature *Brian Wright* *Sr. UNIX Systems Engineer * 901 Mariners Island Blvd Suite 200 San Mateo, CA 94404 USA *Email *brianw(a)marketo.com <mailto:brianw@marketo.com> *Phone *+1.650.539.3530** *****www.marketo.com <http://www.marketo.com/>* Marketo Logo

4 6

Adding Members to Groups
by Aneela Saleem 12 Aug '15

12 Aug '15

Hi all, I have used 'posixGroup' objectClass for creating groups, and 'posixAccount' object class for creating users, which uses 'gidNumber' property to associate to a specific group (created by posixGroup). I have to sync LDAP users/groups in Apache Ranger, that uses 'groupOfNames' object class and 'member/memberof' property in user object. But in 'groupOfNames' objectClass we have to add members at the time of creation of group. Is there any way that we can add members to already created groups later on?

4 6

Re: LDAP - Unix sync
by Mauricio Tavares 12 Aug '15

12 Aug '15

On Wed, Aug 12, 2015 at 11:31 AM, Aneela Saleem <aneela(a)platalytics.com> wrote: > Yes ldap works. and running ssh in verbose mode gives i.e., ssh -v > admin(a)127.0.0.1 > > OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014 > debug1: Reading configuration data /etc/ssh/ssh_config > debug1: /etc/ssh/ssh_config line 19: Applying options for * > debug1: Connecting to 127.0.0.1 [127.0.0.1] port 22. > debug1: Connection established. > debug1: permanently_set_uid: 0/0 > debug1: identity file /root/.ssh/id_rsa type 1 > debug1: identity file /root/.ssh/id_rsa-cert type -1 > debug1: identity file /root/.ssh/id_dsa type 2 > debug1: identity file /root/.ssh/id_dsa-cert type -1 > debug1: identity file /root/.ssh/id_ecdsa type -1 > debug1: identity file /root/.ssh/id_ecdsa-cert type -1 > debug1: identity file /root/.ssh/id_ed25519 type -1 > debug1: identity file /root/.ssh/id_ed25519-cert type -1 > debug1: Enabling compatibility mode for protocol 2.0 > debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2 > debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1p1 > Ubuntu-2ubuntu2 > debug1: match: OpenSSH_6.6.1p1 Ubuntu-2ubuntu2 pat OpenSSH_6.6.1* compat > 0x04000000 > debug1: SSH2_MSG_KEXINIT sent > debug1: SSH2_MSG_KEXINIT received > debug1: kex: server->client aes128-ctr hmac-md5-etm(a)openssh.com none > debug1: kex: client->server aes128-ctr hmac-md5-etm(a)openssh.com none > debug1: sending SSH2_MSG_KEX_ECDH_INIT > debug1: expecting SSH2_MSG_KEX_ECDH_REPLY > debug1: Server host key: ECDSA > 8e:24:39:c6:46:e1:03:31:b9:bb:7a:d4:89:16:72:6b > debug1: Host '127.0.0.1' is known and matches the ECDSA host key. > debug1: Found key in /root/.ssh/known_hosts:8 > debug1: ssh_ecdsa_verify: signature correct > debug1: SSH2_MSG_NEWKEYS sent > debug1: expecting SSH2_MSG_NEWKEYS > debug1: SSH2_MSG_NEWKEYS received > debug1: Roaming not allowed by server > debug1: SSH2_MSG_SERVICE_REQUEST sent > debug1: SSH2_MSG_SERVICE_ACCEPT received > debug1: Authentications that can continue: publickey,password Poor ssh in the machine you are connecting to is completely oblivious to ldap. As of now it only knows about publickey and password. Try setting up sshd to use pam and then get ldap from there > debug1: Next authentication method: publickey > debug1: Offering RSA public key: /root/.ssh/id_rsa > debug1: Authentications that can continue: publickey,password > debug1: Offering DSA public key: /root/.ssh/id_dsa > debug1: Authentications that can continue: publickey,password > debug1: Trying private key: /root/.ssh/id_ecdsa > debug1: Trying private key: /root/.ssh/id_ed25519 > debug1: Next authentication method: password > admin(a)127.0.0.1's password: > debug1: Authentications that can continue: publickey,password > Permission denied, please try again. > admin(a)127.0.0.1's password: > > > On Wed, Aug 12, 2015 at 7:56 PM, Mauricio Tavares <raubvogel(a)gmail.com> > wrote: >> >> On Wed, Aug 12, 2015 at 10:37 AM, Aneela Saleem <aneela(a)platalytics.com> >> wrote: >> > Hi Aaron! >> > >> > Actually i'm trying to login LDAP users as local users from command >> > line. >> > >> > I have followed this guide but unable to perform 'ssh' >> > >> I think we need more than "unable to perform 'ssh'." Have you >> done the usual stuff like ssh in verbose mode and check the logs? Have >> you checked that ldap works in said machine? >> >> > On Wed, Aug 12, 2015 at 7:23 PM, Aaron Richton >> > <richton(a)nbcs.rutgers.edu> >> > wrote: >> >> >> >> On Wed, 12 Aug 2015, Aneela Saleem wrote: >> >> >> >>> Hi all, Can anyone please tell me how can i pull users from LDAP >> >>> server >> >>> and treat them as local users? So that i can login as an ldap user and >> >>> test >> >>> whether particular user have permissions to particular HDFS commands >> >>> or not. >> >> >> >> >> >> I'm not sure what you're referring to by "pull." In a typical *ix >> >> setup, >> >> you'd configure the system name services and/or authentication services >> >> to >> >> include an LDAP backend. >> >> >> >> The precise details and options depend on the exact flavor of the >> >> system >> >> you're using. nss_ldap, nss-pam-ldapd, and nssov are likely candidates >> >> on >> >> the name service side; nss-pam-ldapd also provides a pam_ldap on the >> >> authentication side. But again, this is somewhat system-dependent (no >> >> NSS on >> >> OS X/Darwin, for example). >> >> >> >> For nssov, see the LDAPCon paper >> >> http://ldapcon.org/2011/downloads/cheng-paper.pdf for starters. >> >> >> > > >

1 0

LDAP - Unix sync
by Aneela Saleem 12 Aug '15

12 Aug '15

Hi all, Can anyone please tell me how can i pull users from LDAP server and treat them as local users? So that i can login as an ldap user and test whether particular user have permissions to particular HDFS commands or not.

3 3

Is Openldap a Authorization or Authentication system?
by Kaushal Shriyan 11 Aug '15

11 Aug '15

Hi, I am not sure if i understand the difference between Authorization and Authentication. Does Openldap support both or it supports or configured as Authorization or Authentication server? I will appreciate if somebody can help me understand with some examples. Regards, Kaushal

5 5

When using the rwm, openldap down
by デージーネット大野公善 08 Aug '15

08 Aug '15

Hi. When I changed configuration for openldap, openldap stopped. (Aborted) I was carried out the following operations. (1) I created the following environment. ---- ---- ---- ---- # ldapsearch -LLL -Y EXTERNAL -b 'olcOverlay={0}rwm,olcDatabase={1}bdb,cn=config' -H ldapi:/// SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 dn: olcOverlay={0}rwm,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcRwmConfig olcOverlay: {0}rwm olcRwmRewrite: {0}rwm-rewriteEngine on olcRwmRewrite: {1}rwm-rewriteContext searchFilter olcRwmRewrite: {2}rwm-rewriteRule "aaa" "111" ":@" olcRwmRewrite: {3}rwm-rewriteRule "bbb" "222" ":@" ---- ---- ---- ---- (2) I created the following ldif file. ---- ---- ---- ---- dn: olcOverlay={0}rwm,olcDatabase={1}bdb,cn=config changetype: modify delete: olcRwmRewrite olcRwmRewrite: rwm-rewriteRule "aaa" "111" ":@" - ---- ---- ---- ---- (3) I was carried out ldapmodify. ---- ---- ---- ---- # ldapmodify -Y EXTERNAL -H ldapi:/// -f down.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "olcOverlay={0}rwm,olcDatabase={1}bdb,cn=config" ldap_result: Can't contact LDAP server (-1) ---- ---- ---- ---- In this case, openldap has stopped. : : 55c45c8b connection_get(16) 55c45c8b ==> sasl_bind: dn="" mech=EXTERNAL datalen=0 55c45c8b SASL Canonicalize [conn=1000]: authcid="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" 55c45c8b slap_sasl_getdn: conn 1000 id=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth [len=55] 55c45c8b SASL Canonicalize [conn=1000]: slapAuthcDN="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" 55c45c8b SASL proxy authorize [conn=1000]: authcid="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" authzid="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" 55c45c8b connection_get(16) 55c45c8b conn=1000 op=1 do_modify: dn (olcOverlay={0}rwm,olcDatabase={1}bdb,cn=config) => ldap_bv2dn(olcOverlay={0}rwm,olcDatabase={1}bdb,cn=config,0) <= ldap_bv2dn(olcOverlay={0}rwm,olcDatabase={1}bdb,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcOverlay={0}rwm,olcDatabase={1}bdb,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcOverlay={0}rwm,olcDatabase={1}bdb,cn=config)=0 55c45c8b conn=1000 op=1 modifications: 55c45c8b delete: olcRwmRewrite 55c45c8b one value, length 32 55c45c8b [slapd:0] unknown command '' slapd: rwm.c:2195: rwm_cf_gen: Assertion `rc == 0' failed. Aborted Is this openldap BUG? -- Regards, Kimiyoshi Ohno DesigNET.INC.

3 2

Re: Manager Attribute
by mlstarling31＠hotmail.com 06 Aug '15

06 Aug '15

------ Original message------From: Michael StröderDate: Thu, Aug 6, 2015 2:30 PMTo: mlstarling31@hotmail.com;openldap-technical@openldap.org;Subject:Re: Manager Attribute mlstarling31(a)hotmail.com wrote:> could you expound on your statement below?"Think twice:> - namespace> - obsolete information, referential integrity> etc."Pretty soon free-form text fields tend to contain malformed and obsolete dataand hence are pretty unuseful.Ciao, Michael.I see. Thank you.

1 0

New Listmember with a olcAccess question
by Fischer, Johannes 06 Aug '15

06 Aug '15

Hi @all, I've tried to implement a olcAccess via regex for multiple directory entries. The goal was to group different users in two standard groups. Each group does have other access rules. I didn't what to do such a thing for every entry, so I thought that I'm able to do that with regexes. But my olcAccess rules doesn't work. I've already posted the question to stackoverflow, but no answers till now. Here the link: http://stackoverflow.com/questions/31693040/ldap-olcaccess-regex-are-not-wo… And here the rule for a regex access: olcAccess: {1}to dn.regex="^o(.+),dc=organizations,dc=example,dc=ldap$" attrs=children by group.exact="cn=ADMINS,o=[$1],dc=organizations,dc=example,dc=ldap$" write by group.exact="cn=USER,o=[$1],dc=organizations,dc=example,dc=ldap$" read by * none Does somebody can help me? Or is such a thing not possible to do? Greetings John PS: the content from Stackoverflow: ---------------------------------------------------------------------------------------- I have a LDAP server runnign with the Structure: dc=example,dc=ldap dc=organisations o=orga1 (objectClasses top/organisation/dcObject) cn=ADMINS (objectClasses top/groupOfNames) cn=USER o=orga2 cn=ADMIN cn=USER cn=users (objectClasses top/organisation/dcObject) cn=user1 (objectClasses top/person) cn=user2 Now I whant to add some rules that only the users in the organisation groups are able to see the organisation. the hard coded approach was quite easy to implement: olcAccess: {1}to dn.subtree="o=orga1,dc=organizations,dc=example,dc=ldap" by group.exact="cn=ADMINS,o=orga1,dc=organizations,dc=example,dc=ldap" write by group.exact="cn=USER,o=orga1,dc=organizations,dc=example,dc=ldap" read by * none (It is important to write TWO spaces in front of the 'by' [It was an problem for a long time for me]) But I don't whant to implement these rules for every new organisation, so I tried to implement the rule with some regex magig. But I failed misserably: olcAccess: {1}to dn.regex="^o(.+),dc=organizations,dc=example,dc=ldap$" attrs=children by group.exact="cn=ADMINS,o=[$1],dc=organizations,dc=example,dc=ldap$" write by group.exact="cn=USER,o=[$1],dc=organizations,dc=example,dc=ldap$" read by * none This rule affects nothing. So does someone have some idea to fix my problematic? Or is it not possible to group the members like I did? Thanks again -- Johannes Fischer Research Fellow Fraunhofer Institute for Manufacturing Engineering and Automation IPA Competence Centre Digital Tools for Manufactoring Nobelstrasse 12 │ 70569 Stuttgart | Germany Phone +49 711 970-1217 Johannes.Fischer(a)ipa.fraunhofer.de<mailto:Johannes.Fischer@ipa.fraunhofer.de> www.ipa.fraunhofer.de<http://www.ipa.fraunhofer.de/> [cid:image001.png@01D0D01E.D4211AC0]

3 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical