- openldap-technical - openldap.org

build ldap tree with same meta and db suffix
by Aleks 06 Aug '15

06 Aug '15

Hi dear list members. I need to create the following ldap-tree #### dc=example dc=customers-ext,dc=example dc=MetaOrgTree01,dc=customers-ext,dc=example dc=MetaOrgTree02,dc=customers-ext,dc=example ... dc=MetaOrgTree0n dc=customers,dc=example dc=MetaOrgTree01,dc=customers,dc=example dc=MetaOrgTree02,dc=customers,dc=example ... dc=MetaOrgTree0n dc=appuser,dc=example # < this is a mdb uid=bindUser ############### I was able to create the base setup with the following commands. export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/opt/local/BDB/lib /opt/local/openldap-2.4.41/sbin/slapadd -F /opt/local/conf/openldap/ldap.example.at/ -l ldifs/initial_ldap.example.at.ldif -n0 /opt/local/openldap-2.4.41/libexec/slapd -l local5 -F /opt/local/conf/openldap/ldap.example.at/ -h "ldap://0.0.0.0:10689 ldapi://%2fvar%2fopt%2fopenldap%2frun%2fslapd-ldap.sock" /opt/local/openldap-2.4.41/bin/ldapmodify -D 'cn=config' -w <PASSWORD> -H ldapi://%2fvar%2fopt%2fopenldap%2frun%2fslapd-ldap.sock -v -f meta-ldifs/MetaOrgTree01_meta.ldif and now I'm not able to create the dc tree ( add_and_build_root_dc_tree.ldif ) /opt/local/openldap-2.4.41/bin/ldapmodify -D 'cn=config' -w <PASSWORD> -H ldapi://%2fvar%2fopt%2fopenldap%2frun%2fslapd-ldap.sock -v -f add_and_build_root_dc_tree.ldif ldap_initialize( ldapi://%2fvar%2fopt%2fopenldap%2frun%2fslapd-ldap.sock/??base ) add objectClass: top dcObject organization add o: example add description: MyOrg add dc: parent adding new entry "dc=example" ldap_add: Server is unwilling to perform (53) additional info: no global superior knowledge ################## When I create a "olcDatabase=mdb,cn=config" with olcSuffix: dc=example I'm able to create everything but when I try to add another meta target in the db suffix I get the message following message adding new entry "olcDatabase={5}meta,cn=config" ldap_add: Other (e.g., implementation specific) error (80) additional info: <olcSuffix> namingContext "dc=MetaOrgTree02,dc=customers,dc=example" already served by a preceding mdb database Which is clear as the doc say this. http://www.openldap.org/software/man.cgi?query=slapd-meta&sektion=5&apropos… ######### These slapd.conf options apply to the META backend database. That is, they must follow a "database meta" line and come before any subsequent "backend" or "database" lines. ######### But how was expected to add another meta entry in a running and working system? Please can anyone help me to find a working solution. The used ldifs: http://download.none.at/initial_ldap.example.at.ldif http://download.none.at/MetaOrgTree01_meta.ldif http://download.none.at/add_and_build_root_dc_tree.ldif openldap: ##### openldap-2.4.41 ./configure --enable-bdb --enable-ldap --enable-meta --prefix=/opt/local/openldap-2.4.41 --enable-dynlist --enable-memberof --with-tls=openssl --enable-rwm --enable-accesslog --enable-syncprov LDFLAGS="-L/opt/local/BDB/lib -L/usr/sfw/lib -R/usr/sfw/lib" CPPFLAGS="-I/opt/local/BDB/include -I/opt/local/build/openssl-0.9.7a/include/" SunOS 5.10 sun4v sparc SUNW,Sun-Fire-T200 ########### I hope I have explained the setup and the question understandable. Maybe I think not ldap-isch enough Thanks everybody for help. Best regards Aleks

1 0

Re: Manager Attribute
by mlstarling31＠hotmail.com 06 Aug '15

06 Aug '15

------ Original message------From: Michael StröderDate: Thu, Aug 6, 2015 12:52 PMTo: Michael;openldap;Subject:Re: Manager Attribute Michael wrote:> Looking at the OpenLDAP schema it appears to use the "manager" attribute> the filed requires the dn: of the object.Yes.> Is there another attribute similar to the manager attribute that will take> a simple syntax such as "John Doe".AFAIK not in schema shipped with OpenLDAP.> There are a good deal of managers in our organization that don't have LDAP> accounts and therefore naturally don't have a DN to specify in this field.> I don't want the extra overhead of creating these DN's just for the sake of> using this this attribute if I don't have to.Think twice:- namespace- obsolete information, referential integrityetc.If you really need a freeform text field for arbitrary names then simplydefine your own schema:http://www.openldap.org/faq/data/cache/219.htmlCiao, Michael. Thanks Michael.Could you expound on your statement below?"Think twice: - namespace - obsolete information, referential integrity etc."

2 1

Re: About issues with syncprov configuration
by Édnei Rodrigues 06 Aug '15

06 Aug '15

Ahh, right. Understood. Thank you for your explanation. Good day. Em 06/08/2015 13:59, "Quanah Gibson-Mount" <quanah(a)zimbra.com> escreveu: > --On Thursday, August 06, 2015 2:01 PM -0300 Édnei Rodrigues < > ednei.felipe.rodrigues(a)gmail.com> wrote: > > >> Thank you for your answer. >> >> So, I need to enable the lastmod overlay in the primary db? Why? >> > > Lastmod overlay? no. > > Lastmod? yes > > olcLastMod: TRUE | FALSE > Controls whether slapd will automatically maintain > the > modifiersName, modifyTimestamp, creatorsName, and > createTimestamp attributes for entries. It also controls > the > entryCSN and entryUUID attributes, which are needed by > the > syncrepl provider. By default, olcLastMod is TRUE. > > --Quanah > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

Re: About issues with syncprov configuration
by Édnei Rodrigues 06 Aug '15

06 Aug '15

Thank you for your answer. So, I need to enable the lastmod overlay in the primary db? Why? Em 06/08/2015 12:44, "Quanah Gibson-Mount" <quanah(a)zimbra.com> escreveu: > --On Thursday, August 06, 2015 9:40 AM -0300 Édnei Rodrigues < > ednei.felipe.rodrigues(a)gmail.com> wrote: > > 55c25369 syncprov_db_open: invalid config, lastmod must be enabled >> 55c25369 backend_startup_one (type=mdb, suffix="dc=br"): bi_db_open >> failed! (-1) >> slap_startup failed (test would succeed using the -u switch) >> >> >> >> What is wrong ? >> > > It says you need to enable lastmod, that seems fairly plain? > > --Quanah > > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

Manager Attribute
by Michael 06 Aug '15

06 Aug '15

Looking at the OpenLDAP schema it appears to use the "manager" attribute the filed requires the dn: of the object. Is there another attribute similar to the manager attribute that will take a simple syntax such as "John Doe". There are a good deal of managers in our organization that don't have LDAP accounts and therefore naturally don't have a DN to specify in this field. I don't want the extra overhead of creating these DN's just for the sake of using this this attribute if I don't have to. Thanks.

2 1

ldap proxy to AD with local ACLs
by Meike Stone 06 Aug '15

06 Aug '15

Hello, it is me again regarding the ldap-backend. As told, I've installed a openldap as proxy in a DMZ for authentication forwarding to an Active Directoy. The Proxy is used by a VPN gateway. That all works very well. But now, I want to protect the AD from modifying. Only password changes from the user by self should be allowed. But as I see or understand, ACLs from a backend are used, AFTER the result from remote LDAP (AD) are coming back?! See second sentence from http://www.openldap.org/faq/data/cache/532.html: "It allows the common configuration directives as suffix, which is used to select it when a request is received by the server, *ACLs, which are applied to search results*, size and time limits, and so on. " So is it (and how is it) possible, to "switch" the ldap-backend in "read only mode" and only pass the the password change (modify: DEL/ADD)? Thanks Meike

2 3

About issues with syncprov configuration
by Édnei Rodrigues 06 Aug '15

06 Aug '15

Hey Guys, how are you doing ? Well, I have the follow environment: **Server 1: /etc/openldap/slapd.conf ( Port 389 ) modulepath /usr/local/openldap/lib64/ moduleload back_ldap moduleload translucent moduleload dynlist moduleload back_monitor backend mdb backend ldap allow bind_v2 allow bind_anon_dn database mdb directory /usr/local/openldap/var/openldap-translucent suffix "dc=br" rootdn "ZZZZZZ" rootpw ZZZZZZZ maxsize 4294967296 sizelimit 100000 overlay translucent uri "ldap://localhost:1389/" translucent_bind_local on translucent_pwmod_local on translucent_local XXXXX idassert-bind bindmethod=none overlay dynlist dynlist-attrset groupOfURLs memberURL member:uniqueMember In the port 1389: /etc/openldap/slapd-syncrepl.conf # syncrepl directives syncrepl rid=0 provider=ldap://Production_Server:389 bindmethod=simple binddn="ZZZZZZZZZZZZZZZ" credentials=XXXXXXXXX searchbase="dc=br" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" type=refreshAndPersist retry="60 +" syncdata=accesslog # Refer updates to the master updateref ldap://Production_Server:389 **Server 2: Same Configuration Now, I need to add a new server, but without a translucent configuration, only a consumer. So, I tried this: modulepath /usr/local/openldap/lib64/ moduleload back_ldap moduleload translucent moduleload dynlist moduleload back_monitor backend mdb backend ldap allow bind_v2 allow bind_anon_dn # Modulos para Delta-syncrepl modulepath /usr/local/openldap/lib64 moduleload accesslog moduleload syncprov moduleload dynlist moduleload back_hdb database hdb suffix cn=accesslog directory /usr/local/openldap/var/openldap-accesslog rootdn cn=accesslog rootpw XXXXXXXXXXXXXXXXXXXXXXXXX checkpoint 256 30 index default eq index entryCSN,objectClass,reqEnd,reqResult,reqStart # Replication overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE limits dn.exact="XXXXXXXX" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited database mdb directory /usr/local/openldap/var/openldap-translucent suffix "dc=br" rootdn "XXXXXXXXXXXXX" rootpw XXXXXXXXXXXXXXXXXXXXX maxsize 4294967296 sizelimit 100000 checkpoint 256 30 overlay translucent uri "ldap://localhost:1389/" translucent_bind_local on translucent_pwmod_local on translucent_local XXXXXXXXXXXXXXXXXXXXXXXXX idassert-bind bindmethod=none overlay dynlist dynlist-attrset groupOfURLs memberURL member:uniqueMember # syncrepl Provider for primary db overlay syncprov syncprov-checkpoint 1000 60 # accesslog overlay definitions for primary db overlay accesslog logdb cn=accesslog logops writes logsuccess TRUE logpurge 07+00:00 01+00:00 But, I got this error: 55c25369 hdb_db_open: "cn=accesslog" 55c25369 hdb_db_open: database "cn=accesslog": unclean shutdown detected; attempting recovery. 55c25369 hdb_db_open: warning - no DB_CONFIG file found in directory /usr/local/openldap/var/openldap-accesslog: (2). Expect poor performance for suffix "cn=accesslog". 55c25369 hdb_db_open: database "cn=accesslog": recovery skipped in read-only mode. Run manual recovery if errors are encountered. 55c25369 mdb_db_open: "dc=br" 55c25369 syncprov_db_open: invalid config, lastmod must be enabled 55c25369 backend_startup_one (type=mdb, suffix="dc=br"): bi_db_open failed! (-1) slap_startup failed (test would succeed using the -u switch) What is wrong ?

2 1

Issues about replication
by Édnei Rodrigues 05 Aug '15

05 Aug '15

Hey Guys, how are you doing ? Well, I have the follow environment: **Server 1: /etc/openldap/slapd.conf ( Port 389 ) modulepath /usr/local/openldap/lib64/ moduleload back_ldap moduleload translucent moduleload dynlist moduleload back_monitor backend mdb backend ldap allow bind_v2 allow bind_anon_dn database mdb directory /usr/local/openldap/var/openldap-translucent suffix "dc=br" rootdn "ZZZZZZ" rootpw ZZZZZZZ maxsize 4294967296 sizelimit 100000 overlay translucent uri "ldap://localhost:1389/" translucent_bind_local on translucent_pwmod_local on translucent_local XXXXX idassert-bind bindmethod=none overlay dynlist dynlist-attrset groupOfURLs memberURL member:uniqueMember In the port 1389: /etc/openldap/slapd-syncrepl.conf # syncrepl directives syncrepl rid=0 provider=ldap://Production_Server:389 bindmethod=simple binddn="ZZZZZZZZZZZZZZZ" credentials=XXXXXXXXX searchbase="dc=br" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" type=refreshAndPersist retry="60 +" syncdata=accesslog # Refer updates to the master updateref ldap://Production_Server:389 **Server 2: Same Configuration Now, I need to add a new server, but without a translucent configuration, only a consumer. So, I tried this: modulepath /usr/local/openldap/lib64/ moduleload back_ldap moduleload translucent moduleload dynlist moduleload back_monitor backend mdb backend ldap allow bind_v2 allow bind_anon_dn # Modulos para Delta-syncrepl modulepath /usr/local/openldap/lib64 moduleload accesslog moduleload syncprov moduleload dynlist moduleload back_hdb database hdb suffix cn=accesslog directory /usr/local/openldap/var/openldap-accesslog rootdn cn=accesslog rootpw XXXXXXXXXXXXXXXXXXXXXXXXX checkpoint 256 30 index default eq index entryCSN,objectClass,reqEnd,reqResult,reqStart # Replication overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE limits dn.exact="XXXXXXXX" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited database mdb directory /usr/local/openldap/var/openldap-translucent suffix "dc=br" rootdn "XXXXXXXXXXXXX" rootpw XXXXXXXXXXXXXXXXXXXXX maxsize 4294967296 sizelimit 100000 checkpoint 256 30 overlay translucent uri "ldap://localhost:1389/" translucent_bind_local on translucent_pwmod_local on translucent_local XXXXXXXXXXXXXXXXXXXXXXXXX idassert-bind bindmethod=none overlay dynlist dynlist-attrset groupOfURLs memberURL member:uniqueMember # syncrepl Provider for primary db overlay syncprov syncprov-checkpoint 1000 60 # accesslog overlay definitions for primary db overlay accesslog logdb cn=accesslog logops writes logsuccess TRUE logpurge 07+00:00 01+00:00 But, I got this error: 55c25369 hdb_db_open: "cn=accesslog" 55c25369 hdb_db_open: database "cn=accesslog": unclean shutdown detected; attempting recovery. 55c25369 hdb_db_open: warning - no DB_CONFIG file found in directory /usr/local/openldap/var/openldap-accesslog: (2). Expect poor performance for suffix "cn=accesslog". 55c25369 hdb_db_open: database "cn=accesslog": recovery skipped in read-only mode. Run manual recovery if errors are encountered. 55c25369 mdb_db_open: "dc=br" 55c25369 syncprov_db_open: invalid config, lastmod must be enabled 55c25369 backend_startup_one (type=mdb, suffix="dc=br"): bi_db_open failed! (-1) slap_startup failed (test would succeed using the -u switch) What is wrong ? Thanks!

1 0

search with a wildcard works, with exactly matching string it doesn't
by Gregory House 05 Aug '15

05 Aug '15

Hi If I run a query against my directory with this filter: "(myDeviceId=ZZZ-07430.08.12345678*)" it returns a match showing precisely that myDeviceId = "ZZZ-07430.08.12345678" If I use this filter, without the wildcard and just the actual value "(myDeviceId=ZZZ-07430.08.12345678)" it returns no match. Even if I change the attribute value to something very simple like "x" I still need to include a wildcard in my filter to get any match. This works however: "(myDeviceId:caseExactMatch:=ZZZ-07430.08.12345678)" What gives here? The specific attribute is defined in the schema file as follows: attributetype ( 1.3.6.1.4.1.36200.255.0.17 NAME 'myDeviceId' DESC 'Identifies a device' SUP uid EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) I am no expert, but this makes no sense to me? I feel I am missing something, but what? I am using openldap on CentOS 6 and workign via command-line tools (e.g. ldapsearch). The backend is mdb if that matters. # rpm -qa | grep openldap openldap-clients-2.4.39-8.el6.x86_64 openldap-2.4.39-8.el6.x86_64 openldap-servers-2.4.39-8.el6.x86_64 Thanks for any ideas/suggestions. Best, GH

2 2

question on write transaction
by Shu, Xinxin 04 Aug '15

04 Aug '15

Hi list, recently I wrote app on LMDB, found that for every write , lmdb lock a global lock when transaction is created , and release this lock in mdb_txn_commit, on Ubuntu, this lock is implemented by pthread_mutext_t. in my app, I create write transaction in a thread, then commit this write transaction in another thread, since lmdb use pthread_mutex_unlock to release this lock, according to manual , attempting to unlock the mutex if it was not locked by the calling thread results in undefined behavior, then my app cannot create write transaction . So does this issue known to community or is there any way to work around? Cheers, xinxin

2 2

I want to use memberof overlay but I do not have a clue on how to even look at it.
by Eliezer Croitoru 01 Aug '15

01 Aug '15

I want to use memberof overlay but I do not have a clue on how to even look at it. I have tried to use this: http://www.schenkels.nl/2013/03/how-to-setup-openldap-with-memberof-overlay… which kind of worked and it has added something to my database. Now I have tried to run some search but either I am doing something wrong or the memberof is not loaded. So first, how do check that it is loaded? I was thinking about : ldapsearch -x -H ldap:/// -b cn=module but again I am unsure since it won't give results. I am trying to use memberof for squid to match a group membership. Any hints? directions to understand? I understand the basics of LDAP but this is something above basic LDAP. Thanks, Eliezer

2 1

Increasing memory usage on successive LMDB reads
by Rohit Girdhar 31 Jul '15

31 Jul '15

Hi I'm using LMDB (original C interface) to store and read some data. However, I notice that my resident memory usage (RES in `htop`) keeps rising with each call to mdb_get with unique keys. It does not change if I do a repeated call to mdb_get with a key I've used before. It looks like mdb_get is caching the reads, but I want to make sure what effect it is really having on my system. Is there some way to limit the amount of memory lmdb can use for this? Or is it something strange and should not be happening? Thanks Rohit

2 2

Slapd-meta and multiple uri
by Nicolas RENAULT 31 Jul '15

31 Jul '15

Hello , I have a problem with meta and multiple uri : Two AD server opensuse 13.1 openldap 2.4.39 (install from repo) make a meta backend that work but I when I configure it I use this directive , try to make a failover conf : uri ldap://172.17.150.47:3268/ou=AD,ou=TOUT,dc=example,dc=fr ldap://172.17.150.48:3268/ Work like a charm until 172.17.150.47 go down --> slapd never try to contact 172.17.150.48 ... slapd.conf ( relevant part ) ---------------------------------------------------------- network-timeout 1 timeout 3 idletimeout 10 writetimeout 10 database meta suffix "ou=AD,ou=TOUT,dc=example,dc=fr" uri ldap://172.17.150.47:3268/ou=AD,ou=TOUT,dc=example,dc=fr ldap://172.17.150.48:3268/ suffixmassage "ou=AD,ou=TOUT,dc=example,dc=fr" "dc=example,dc=fr" idassert-bind bindmethod=simple binddn="cn=xxxxxx,cn=Users,dc=example,dc=fr" credentials=<secret> mode=none idassert-authzFrom "dn.regex:.*" -------------------------------------------------------------- I search on the list and found this : http://www.openldap.org/lists/openldap-technical/201208/msg00231.html (one post on the thread, I read all of them) The problem is exactly the same : if I start slapd and 172.17.150.47 not present (iptable output drop or reject) never ask 172.17.150.48 (tcpdump on the interface of slapd server) in http://www.openldap.org/lists/openldap-technical/201208/msg00247.html (same thread) Howard Chu : Sounds like you should file an ITS. Pierangelo: looking at libldap/request.c and libldap/.open.c, it appears that request.c:ldap_new_connection() expects open.c:ldap_int_open_connection() to return -2 on an asynch open, but ldap_int_open_connection() unconditionally returns 0. This is probably interfering with back-meta's urllist_proc. -- -- Howard Chu CTO, Symas Corp.http://www.symas.com Director, Highland Sunhttp://highlandsun.com/hyc/ Chief Architect, OpenLDAPhttp://www.openldap.org/project/ so I look to the ITS 7372 http://www.openldap.org/its/index.cgi/Incoming?id=7372;selectid=7372 But no answers, and no trace on changelog it's something wrong in my conf (if so tell me what) and if no can some of the dev take a look at the problem ? Thank's and have a good day. Nicolas

2 2

Re: Integrate LDAP in Hadoop
by Dieter Klünter 31 Jul '15

31 Jul '15

Am Fri, 31 Jul 2015 14:23:27 +0500 schrieb Aneela Saleem <aneela(a)platalytics.com>: > But my directory is already running. > > What do you mean by object class=person is not part of published LDAP? That's been a mental error, I was thinking of objectclass=user. If your directory is running, what is your problem? I have integrated Hadoop and Jenkins into my directory without any problems. You should probably run slapd in debugging mode while trying hadoop to connect to the directory. -Dieter > > Regards, > Aneela Saleem > On Jul 31, 2015 11:48 AM, "Dieter Klünter" <dieter(a)dkluenter.de> > wrote: > > > Am Thu, 30 Jul 2015 20:06:44 +0500 > > schrieb Aneela Saleem <aneela(a)platalytics.com>: > > > > > Hi all, > > > > > > I want to integrate LDAP in my HDFS, i have changed core-site.xml > > > Attached is my core-site.xml file. > > > > > > Can anyone please send me complete steps, how to integrate LDAP > > > with HDFS ? > > > > > > i have followed this link: > > > > > > http://hortonworks.com/blog/hadoop-groupmapping-ldap-integration/ > > > > > > but the *services.ldif *file is missing in the link. > > > > Get your directory running first, and then you may attach hadoop > > to this directory. > > Please note that objectclass=person is not part of a published LDAP > > schema. > > > > -Dieter > > > > -- > > Dieter Klünter | Systemberatung > > http://sys4.de > > GPG Key ID: E9ED159B > > 53°37'09,95"N > > 10°08'02,42"E > > > > -- Dieter Klünter | Systemberatung http://sys4.de GPG Key ID: E9ED159B 53°37'09,95"N 10°08'02,42"E

1 0

ldap proxy to AD - UnicodePwd: attribute type undefined
by Meike Stone 31 Jul '15

31 Jul '15

Hello I've installed a openldap as proxy in a DMZ for authentication forwarding to an Active Directoy. The Proxy is used by a VPN gateway. That all works very well, but password change from client fails with following error: slapd[30661]: conn=1001 op=5 do_modify slapd[30661]: conn=1001 op=5 do_modify: dn (cn=XPTEST5,ou=Users,dc=myorg,dc=net) slapd[30661]: >>> dnPrettyNormal: <cn=TEST5,ou=Users,dc=myorg,dc=net> slapd[30661]: <<< dnPrettyNormal: <cn=TEST5,ou=Users,dc=myorg,dc=net>, <cn=xptest5,ou=users,dc=myorg,dc=net> slapd[30661]: conn=1001 op=5 modifications: slapd[30661]: delete: UnicodePwd slapd[30661]: one value, length 26 slapd[30661]: add: UnicodePwd slapd[30661]: one value, length 26 slapd[30661]: conn=1001 op=5 MOD dn="cn=TEST5,ou=Users,dc=myorg,dc=net" slapd[30661]: conn=1001 op=5 MOD attr=UnicodePwd UnicodePwd slapd[30661]: send_ldap_result: conn=1001 op=5 p=3 slapd[30661]: send_ldap_result: err=17 matched="" text="UnicodePwd: attribute type undefined" slapd[30661]: send_ldap_response: msgid=6 tag=103 err=17 slapd[30661]: conn=1001 op=5 RESULT tag=103 err=17 text=UnicodePwd: attribute type undefined slapd[30661]: daemon: activity on 1 descriptor slapd[30661]: daemon: activity on: slapd[30661]: slapd[30661]: daemon: epoll: listen=7 active_threads=0 tvp=zero slapd[30661]: daemon: activity on 1 descriptor slapd[30661]: daemon: activity on: As I understand, UnicodePwd is a proprietary "standard" MS attribute in AD to store the password but the RFC attribute is the userPassword. Is it possible, to get the proxy working to process this MOD request, may be that openldap proxy pass through the MOD operation with the attribute UnicodePwd from the VPN-gateway? I use openldap 2.4.40, here is my configuration: ============================================================== include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/rfc2307bis.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args modulepath /usr/lib/openldap/modules moduleload back_ldap disallow bind_anon require authc TLSCACertificateFile /etc/openldap/certs/myorg.net.root.pem TLSCertificateFile /etc/openldap/certs/proxy1.myorg.net.pem TLSCertificateKeyFile /etc/openldap/certs/proxy1.myorg.net.pem.key TLSVerifyClient never TLSCipherSuite ALL:!DH:!EDH database ldap security tls=256 rebind-as-user yes suffix "dc=myorg,dc=net" uri "ldap://dc1.myorg.net ldap://dc2.myorg.net" tls start tls_cacert=/etc/openldap/certs/adroot.pem chase-referrals no protocol-version 3 loglevel -1 ============================================================== Thanks for help!! Meike

2 2

Integrate LDAP in Hadoop
by Aneela Saleem 31 Jul '15

31 Jul '15

Hi all, I want to integrate LDAP in my HDFS, i have changed core-site.xml Attached is my core-site.xml file. Can anyone please send me complete steps, how to integrate LDAP with HDFS ? i have followed this link: http://hortonworks.com/blog/hadoop-groupmapping-ldap-integration/ but the *services.ldif *file is missing in the link.

2 1

docker and openldap
by Aleks 24 Jul '15

24 Jul '15

Dear openldapers. What is your opinion about the different docker information out there. https://github.com/osixia/docker-openldap https://github.com/Enalean/docker-ldap ... My Question goes primary for the data persistency issue and replication setup. I think that a good sync setup (olcSyncrepl)and the dynamic slapd-config http://www.openldap.org/software/man.cgi?query=slapd-config&sektion=5&aprop… could be enough for a docker setup? Due to the fact that I'm not aware that openldap have a storage back-end for the hadoop universe https://hadoop.apache.org/ or any other cloud methods except the olcSyncrepl. Thank you for your time. Best Reagards Aleks

1 0

LMDB Replication
by Kristoffer Sjögren 23 Jul '15

23 Jul '15

Hi Are there any battle-tested good practices for incrementally replicating LMDB? Cheers, -Kristoffer

2 3

Issue renewing my TLSCertificateFile(s)
by Olivier 22 Jul '15

22 Jul '15

Hi everyone Question : are there some limitations (key size, encryption algorithm, etc.) for certificates used by openldap to manage TLS connexions ? See below why I ask : I have used the following configuration in my slapd servers for quite a while without any problem : olcTLSCACertificateFile: /etc/openldap/cacerts/CA.crt olcTLSCertificateFile: /etc/openldap/cacerts/server.crt olcTLSCertificateKeyFile: /etc/openldap/cacerts/server.key olcTLSCipherSuite: HIGH olcTLSVerifyClient: allow See for example my configuration for syncrepl (see: tls_reqcert=demand) : olcSyncrepl: {0}rid=411 provider=ldap://ldap1.example.fr bindmethod=sasl sizelimit=unlimited timeout=0 network-timeout=0 saslmech=external type =refreshAndPersist retry="5 +" starttls=yes tls_cacert=/etc/openldap/cacer ts/CA.crt tls_cert=/etc/openldap/cacerts/replicator.crt tls_key=/etc/openldap /cacerts/replicator.key scope=sub schemachecking=on keepalive=0:0:0 fil ter="(objectclass=*)" searchbase="dc=example,dc=fr" tls_reqcert=demand -> I have used this for couple of years on my multimastered ldap servers, and until yesterday that worked perfectly : replication was working properly and clients talked with the servers using TLS without any problem. But I since my certicates were too weak (see this : sha1, 512 bit) : $ openssl x509 -text -in server.crt Certificate: Data: Version: 1 (0x0) Serial Number: 13998752034197585248 (0xc2458ece791fbd60) Signature Algorithm: sha1WithRSAEncryption Issuer: C=fr, ST=IDF, L=Town, O=example, OU=IT, CN=ldap/emailAddress=ldap(a)example.fr Validity Not Before: Dec 29 15:41:56 2011 GMT Not After : Jul 29 15:41:56 2021 GMT Subject: C=fr, ST=IDF, L=Town, O=example, OU=IT,CN= ldap1.example.fr/emailAddress=ldap(a)example.fr Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (512 bit) I have renewed them using the same self signed authority to validate them, and of course using exactly the same subject. My new certificate look like this : $ openssl x509 -text -in server.crt (see this : sha2, 4096 bit) : Certificate: Data: Version: 1 (0x0) Serial Number: 10208063777793278590 (0x8daa53ebd7e6827e) Signature Algorithm: sha256WithRSAEncryption Issuer: C=fr, ST=IDF, L=Town, O=example, OU=IT, CN=ldap/emailAddress=ldap(a)example.fr Validity Not Before: Jul 22 15:24:50 2015 GMT Not After : Feb 19 15:24:50 2025 GMT Subject: C=fr, ST=IDF, L=Town, O=example, OU=IT,CN= ldap1.example.fr/emailAddress=ldap(a)example.fr Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (4096 bit) Modulus: I installed my new certificate on ldap1 without changing the configuration, and restarting the server here is what I get on ldap4 logs (loglevel = sync ) : $ tail -f /var/log/ldap.log ... Jul 22 17:31:10 ldap4 slapd[53489]: slap_client_connect: URI=ldap:// ldap1.example.fr Warning, ldap_start_tls failed (-11) Jul 22 17:31:10 ldap4 slapd[53489]: slap_client_connect: URI=ldap:// ldap1.example.fr ldap_sasl_interactive_bind_s failed (-2) Jul 22 17:31:10 ldap4 slapd[53489]: do_syncrepl: rid=432 rc -2 retrying Jul 22 17:31:15 ldap4 slapd[53489]: slap_client_connect: URI=ldap://ldap1.example.fr Warning, ldap_start_tls failed (-11) Jul 22 17:31:15 ldap4 slapd[53489]: slap_client_connect: URI=ldap:// ldap1.example.fr ldap_sasl_interactive_bind_s failed (-6) Jul 22 17:31:15 ldap4-mrs slapd[53489]: do_syncrepl: rid=432 rc -6 retrying When reinstalling the previous certificates and restarting ldap1 the server I see this appearing in ldap4 logs : ... Jul 22 17:31:20 ldap4-mrs slapd[53489]: do_syncrep2: rid=432 LDAP_RES_INTERMEDIATE - REFRESH_DELETE Question : are there some limitations (key size, encryption algorithm, etc.) for certificates used by openldap to manage TLS connexions ? Does openldap tls connections work with certificates sha 256 With RSA Encryption using a 4096 public key length ? May be I missed something ? (note : I use openssl to manage my certificates) Thanks for any help. --- Olivier

2 1

Multi Master Openldap replication
by Kaushal Shriyan 21 Jul '15

21 Jul '15

Hi, I have a Multi Master Openldap replication setup and when i create user on the Primary Master Node and while i query it on the secondary master node i do not see the user. Any thing specific i need to look at and please do let me know if anyone wants the config files? Any help will be highly appreciable. Regards, Kaushal

2 1

OpenLDAP and DH parameter size / LogJam vulnerability
by Jens Vagelpohl 19 Jul '15

19 Jul '15

Hi all, In my setup (CentOS7, OpenLDAP 2.4.41 from the LDAP Tool Box project) I am using the following slapd.conf parameters for SSL-related configuration: TLSProtocolMin 3.1 TLSCertificateFile /etc/pki/tls/certs/NNN.crt TLSCertificateKeyFile /etc/pki/tls/private/NNN.key TLSCACertificateFile /etc/pki/tls/certs/NNN.ca.pem TLSDHParamFile /usr/local/openldap/etc/openldap/dh_2048.pem TLSCipherSuite AESGCM:!RSA:!DSS:!ADH:!aECDH The file /usr/local/openldap/etc/openldap/dh_2048.pem is a valid DH parameter file with size 2048: <snip> # openssl dh -in /usr/local/openldap/etc/openldap/dh_2048.pem -text -noout PKCS#3 DH Parameters: (2048 bit) prime: </snip> I am now testing the actual DH parameter size used during a TLS connection with instructions from https://bettercrypto.org/blog/2015/05/20/tls-logjam/ and it only shows DH parameter size 1024: <snip> $ echo | openssl s_client -connect alias01.alias.ooo:636 -cipher "EDH" 2>/dev/null … much output … No client certificate CA names sent Peer signing digest: SHA512 Server Temp Key: DH, 1024 bits </snip> I was expecting "Server Temp Key: DH, 2048 bits”. Am I just testing this the wrong way or is there an issue with DH parameter configurations in OpenLDAP? Thanks for any help! jens

5 13

Strategy for using ldapsearch and security
by Rhodes, Neal A 17 Jul '15

17 Jul '15

So, I'm trying to implement a login running inside Webspeed inside Apache inside linux. There are good reasons to do this inside this application program and not just let Apache do it. (inactivity timeouts, daily quotas, IP reasonability, etc) So, what I get from user is network-user-id (let's call him "bob") and password. What I need to know is: Does this userid exist (samaccountname=%s), is the password provided correct? if above is good, is this user memberof a specific group? What I've got working as proof-of-concept is: A. Do a simple bind to LDAP with an admin/service account as a DN, and search for this user-id (samaccountname=bob), and get back the DN for user "bob". Using $OpenLDAP: ldapsearch 2.4.39 ldapsearch -v -d 0 -P 3 -D "CN=rslXXXXXXXreq,OU=Service Accou....................................DC=com" -w "XXXXXXXX" -oldif-wrap=no -s sub '(&(objectclass=*)(samaccountname=rhodesne))' cn userAccountControl objectclass userPrincipalName B. Then do ANOTHER simple bind to LDAP using "bob"s as DN, and "bob"s password, and return the memberof attribute. That fails if I don't give it the correct password. ldapsearch -P 3 -D "CN=Rhodes\, Neal A,OU=............C=COM" -w "BobsPasswd" -oldif-wrap=no -s sub '(&(objectclass=*)(samaccountname=rhodesne))' cn userAccountControl objectclass memberOf userPrincipalName manager OK, it works. I can walk through the results and confirm that Bob is in a desired group. I don't claim to know LDAP; but isn't this convoluted? Is there a way to do this in one shot with the ldapsearch command? I can do it this way, but it seems clunky. I don't know how to search in one shot given just samaccountname and passwd. The other topic is security: I was intending to invoke the ldapsearch from inside the Apache/Webspeed/Progress/ABL application as a "input-output through", meaning we run this and read/write its STDIn/StdOut. Since Progress ABL is an interpreted DB language this makes some sense. It also provides portability between Linux and Solaris that we don't have if we try to call the shared C libraries. And the C libraries calls are locking up. Best practices would indicate we'd want to hide the passwords. We don't want some administrator doing a 'top' command seeing passwords. Unfortunately, this does not seem readily possible without jumping through hoops. The openldap ldapsearch has a -W option to prompt for passwd, but that appears to not read StdIn, but rather /dev/tty. So I cannot feed it passwords that way. There is a "-f" option, which offers a - flavor to read StdIn, but I don't see any examples of what the input to -f looks like, eg: can I specify password there. There is a -y option to specify a file which contains the password. ok, I could write the file, put it somewhere not readable by anybody but Apache, run ldapsearch, and then delete the file. Still, that doesn't smell like best practices to me. Today I tried making the file a named pipe; that also works if I get the timing just right. I guess I could do that if there isn't a better way. So, it seems like either I'm missing something or the use of ldapsearch for password validation opens up holes and less than best practices. Yes, I could dork around with calling shared libraries, and then fight that portability battle between linux and Solaris. Why is it so hard? For a contents, this is a low volume, probably 200-400 people, one time in the morning, each day. Neal Rhodes | Software Engineer - REALServicing(r) Development Altisource(tm) P: (770)933-6625 extension 256625 F: (770)644-7420 Neal.Rhodes(a)altisource.com<mailto:Laura.Carrozza@altisource.com>| www.altisource.com<http://www.altisource.com/> Progress and Enterprise RDBMS OpenEdge are trademarks or registered trademarks of Progress Software Corporation in the U.S. and other countries. Citrix, GoToAssist, GoToMeeting, GoToMyPC, GoToTraining, GoToWebinar, Podio and Sharefile are trademarks of Citrix Systems, Inc. or a subsidiary thereof, and are or may be registered in the U.S. Patent and Trademark Office and other countries. Windows is a registered trademark of Microsoft Corporation in the United States and other countries. Any other trademarks contained herein are the property of their respective owners. *********************************************************************************************************************** This email message and any attachments are intended solely for the use of the addressee. If you are not the intended recipient, you are prohibited from reading, disclosing, reproducing, distributing, disseminating or otherwise using this transmission. If you have received this message in error, please promptly notify the sender by reply email and immediately delete this message from your system. This message and any attachments may contain information that is confidential, privileged or exempt from disclosure. Delivery of this message to any person other than the intended recipient is not intended to waive any right or privilege. Message transmission is not guaranteed to be secure or free of software viruses. ***********************************************************************************************************************

2 1

How to import user certificates in OpenLDAP?
by Vaclav Barta 16 Jul '15

16 Jul '15

Hi, I'd like to have a test setup for a module I'm maintaining, which basically authenticates IIS users against an LDAP server. I've installed OpenLDAP (OpenLDAP for Windows, 64-bit, version 2.4.40, to be specific) and added some user accounts to it, which worked, except I'm having trouble including X.509 certificates in the user definitions (which the tested module is supposed to check). I've found "Publishing digital certificates with LDAP" at http://www.tldp.org/HOWTO/archived/LDAP-Implementation-HOWTO/certificates.h… , which sounds like what I need, but it's old, and recommends "using the ldif utility provided with OpenLDAP" - which the latest OpenLDAP for Windows (nor any other OpenLDAP packages I've checked) doesn't have. How do I publish digital certificates with OpenLDAP? Bye Vaclav -- http://www.mangrove.cz

5 10

2.4.41 RPMs for openSUSE
by Michael Ströder 16 Jul '15

16 Jul '15

HI! I've updated my OpenLDAP builds for openSUSE and SLES12 to release 2.4.41. Build status and files: https://build.opensuse.org/package/show/home:stroeder:branches:network:ldap… If you're using the openldap packages shipped with openSUSE make sure to read the .changes files to see whether something could break your current setup. I've tested openSUSE Tumbleweed x86_64 and Factory_ARM on rasperry pi. The download repos are here: http://download.opensuse.org/repositories/home:/stroeder:/branches:/network… Make yourself familiar with zypper commands. Example: Add the repo in openSUSE 13.1 (command in one line): zypper addrepo --refresh http://download.opensuse.org/repositories/home:/stroeder:/branches:/network… Please test. Your feedback is appreciated. Especially have a look at whether the RPMs behave well regarding config files, package descriptions etc. Compared to stock SUSE packages there are two additional packages 1. openldap2-contrib with a selection of overlays from, you might have guessed, the contrib/ source directory. 2. openldap2-back-sock (see http://www.openldap.org/software/man.cgi?query=slapd-sock) Ciao, Michael.

2 1

Re: Optimization for OpenLdap 2.4.40
by PRATIK SINGAL 15 Jul '15

15 Jul '15

Hello all, Below are my db_stat -m and db_stat -c ouptput. Can any one help me if there is any problem with my BDB database perfromance. [root@AlepoHSS1 openldap-data]# db_stat -c 193 Last allocated locker ID 0x7fffffff Current maximum unused locker ID 9 Number of lock modes 1000 Maximum number of locks possible 1000 Maximum number of lockers possible 1000 Maximum number of lock objects possible 80 Number of lock object partitions 3 Number of current locks 796 Maximum number of locks at any one time 10 Maximum number of locks in any one bucket 1 Maximum number of locks stolen by for an empty partition 1 Maximum number of locks stolen for any one partition 58 Number of current lockers 76 Maximum number of lockers at any one time 3 Number of current lock objects 331 Maximum number of lock objects at any one time 4 Maximum number of lock objects in any one bucket 0 Maximum number of objects stolen by for an empty partition 0 Maximum number of objects stolen for any one partition 996M Total number of locks requested (996002179) 995M Total number of locks released (995952531) 0 Total number of locks upgraded 20 Total number of locks downgraded 551604 Lock requests not available due to conflicts, for which we waited 49643 Lock requests not available due to conflicts, for which we did not wait 0 Number of deadlocks 0 Lock timeout value 0 Number of locks that have timed out 0 Transaction timeout value 0 Number of transactions that have timed out 744KB The size of the lock region 527185 The number of partition locks that required waiting (0%) 104625 The maximum number of times any partition lock was waited for (0%) 535 The number of object queue operations that required waiting (0%) 330905 The number of locker allocations that required waiting (0%) 11 The number of region locks that required waiting (0%) 4 Maximum hash bucket length [root@AlepoHSS1 openldap-data]# [12:35:48] Bhushan Gaikar: ##################### [12:35:48] Bhushan Gaikar: [root@AlepoHSS1 openldap-data]# db_stat -m 320MB 2KB 24B Total cache size 1 Number of caches 1 Maximum number of caches 320MB 8KB Pool individual cache size 0 Maximum memory-mapped file size 0 Maximum open file descriptors 0 Maximum sequential buffer writes 0 Sleep after writing maximum sequential buffers 0 Requested pages mapped into the process' address space 59M Requested pages found in the cache (98%) 849192 Requested pages not found in the cache 0 Pages created in the cache 849190 Pages read into the cache 285976 Pages written from the cache to the backing file 816982 Clean pages forced from the cache 0 Dirty pages forced from the cache 0 Dirty pages written by trickle-sync thread 31916 Current total page count 31863 Current clean page count 53 Current dirty page count 32771 Number of hash buckets used for page location 60M Total number of times hash chains searched for a page (60607061) 5 The longest hash chain searched for a page 95M Total number of hash chain entries checked for page (95749492) 250939 The number of hash bucket locks that required waiting (0%) 41624 The maximum number of times any hash bucket lock was waited for (0%) 81360 The number of region locks that required waiting (3%) 0 The number of buffers frozen 0 The number of buffers thawed 0 The number of frozen buffers freed 902887 The number of page allocations 2022291 The number of hash buckets examined during allocations 93 The maximum number of hash buckets examined for an allocation 817263 The number of pages examined during allocations 40 The max number of pages examined for an allocation 105981 Threads waited on page I/O Pool File: dn2id.bdb 4096 Page size 0 Requested pages mapped into the process' address space 5052618 Requested pages found in the cache (98%) 86602 Requested pages not found in the cache 0 Pages created in the cache 86603 Pages read into the cache 0 Pages written from the cache to the backing file Pool File: id2entry.bdb 16384 Page size 0 Requested pages mapped into the process' address space 34M Requested pages found in the cache (98%) 445111 Requested pages not found in the cache 0 Pages created in the cache 445111 Pages read into the cache 285976 Pages written from the cache to the backing file Pool File: objectClass.bdb 4096 Page size 0 Requested pages mapped into the process' address space 299999 Requested pages found in the cache (99%) 2 Requested pages not found in the cache 0 Pages created in the cache 2 Pages read into the cache 0 Pages written from the cache to the backing file Regards, Pratik On Fri, Jul 10, 2015 at 3:49 PM, PRATIK SINGAL <pratik.singal13(a)gmail.com> wrote: > Hello all, > > Can any one help to with the parameters which can optimize the openldap > performance. > > We are having high end machines(rhel 6.5 ,RAM-32GB) but could not achieve > more than 1000 TPS. > > Kindly help me with all the tuning parameters which will firstly improve > the ldap performance. > > Regards, > Pratik >

1 0

LDAP over TLS
by Aneela Saleem 14 Jul '15

14 Jul '15

Hi all, I have followed the following link to configure LDAP with TLS: https://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/ch-ldap-tls.htm… but when i run the search command: i.e., *ldapsearch -x -b "dc=platalytics,dc=com" -H 'ldap://localhost:389' -ZZ* i get the following error: ldap_start_tls: Protocol error (2) additional info: unsupported extended operation Following is my *ldap.conf* file: # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. BASE dc=platalytics,dc=com URI ldap://127.0.0.1:389 #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never # TLS certificates (needed for GnuTLS) TLS_CACERT /etc/ldap/cacert.pem TLS_REQCERT allow TLSVerifyClient never Following is my *cn=config.ldif* file: # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 0cd16f20 dn: cn=config objectClass: olcGlobal cn: config *TLSCertificateFile: /etc/ldap/servercrt.pem* *TLSCertificateKeyFile: /etc/ldap/serverkey.pem* *TLSCACertificateFile: /etc/ldap/cacert.pem* olcArgsFile: /var/run/slapd/slapd.args olcLogLevel: none olcPidFile: /var/run/slapd/slapd.pid olcToolThreads: 1 structuralObjectClass: olcGlobal entryUUID: 59729584-bdf0-1034-90b9-fdf431101d87 creatorsName: cn=config createTimestamp: 20150713211745Z entryCSN: 20150713211745.443612Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20150713211745Z Can anyone please help what could be the issue?

3 7

Columnar databases
by Kristoffer Sjögren 13 Jul '15

13 Jul '15

Hi I'm doing some experiments with LMDB trying to emulate a columnar storage database using roaring bitmaps and other tricks. The initial results are promising, but I ask myself, is a row based storage like LMDB appropriate for implementing a columnar database or are there better, more efficient ways/formats? Cheers, -Kristoffer

2 3

MODRDN with same RDN and delold: 0 and slapo-constraint
by Michael Ströder 11 Jul '15

11 Jul '15

HI! When bulk-renaming entries in web2ldap I do *not* alter the RDN of the entry but also send delold: 0 in the MODRDN operation. IMO this is most minimal invasive approach. This works ok in most setups. But in a more strict setup (release 2.4.41) with slapo-constraint and constraints on the RDN's characteristic attribute those MODRDN requests trigger a constraint and fails with 'Constraint violation' although the RDN value is not changed. I can't tell whether this was different with older OpenLDAP releases. Even more strange: It works with delold: 1. So I could easily alter web2ldap's behaviour to send delold: 1. But I'm not sure whether that's the right general approach especially when thinking about all the other LDAP servers out there. So the question is: Is this an overzealous misbehaviour of slapo-constraint and should it be fixed therein? Ciao, Michael.

1 0

Crash while aborting connection on timeout...
by Emilio Pombo 11 Jul '15

11 Jul '15

Hi everyone! I'm working on a project using openLDAP C API (version 2.4.36) in a asynchronous way. Everything works quite well after two years of development cycles and product evolution. Since a year ago we have a few clients successfully running our LDAP module on their servers. Recently I've received a core dump file from one of our clients, with this stack frames: ... libc frames ... #6 0x00007f68887d3068 in ldap_int_bisect_find (v=<value optimized out>, n=<value optimized out>, id=<value optimized out>, idxp=<value optimized out>) at abandon.c:334 #7 0x00007f68887d32d2 in do_abandon (ld=0x7f67dcb0bbe0, origid=-1, msgid=-1, sctrls=<value optimized out>, sendabandon=1) at abandon.c:300 ... my application frames ... >From my code, I'm calling openldap_ldap_abandon_ext(ld, msgid, NULL, NULL) because a timeout has been reached after doing a openldap_ldap_sasl_bind(...) and getting LDAP_X_CONNECTING state, while waiting for the result of an LDAP_SUCCESS. As I've read on *abandon.c*, the assert( id >= 0 ) is executed only on certain flows, I guess... those which are involved in communication handshake with the server in advanced stages. So I think, I'm calling openldap_ldap_abandon_ext(...) at the wrong time. My question is: can I use something from the API (ldap.h) to prevent calling openldap_ldap_abandon_ext on this specific situation? I think I may add code in my application to prevent crashing, but also ensure aborting the connection correctly, as I have to respect my timeout policy. BTW, the calls to the openLDAP API in my code are all protected with the same boost::unique_lock<boost::mutex> to ensure thread safety. Logs shows that my module was under heavy load when the application crashed. I've only this core information, and I haven't been able to reproduce this situation on my integration tests, even doing a simulation of a slowdown in networking communications and shrinking timeouts. Thanks in advance for your help!

1 0

Re[2]: Replication mode - glibc detected *** slapd: double free or corruption
by Sterling Sahaydak 09 Jul '15

09 Jul '15

Thanks Quanah for the prompt reply as you've always provided on this list. Yes, just after I sent this, I realized the next question was going to be what version of OpenLDAP, which is, "OpenLDAP: slapd 2.4.39 " Yes, I'm using hdb: database hdb suffix "dc=example,dc=com" checkpoint 1024 15 rootdn "cn=Manager,dc=example,dc=com" So, with 2.4.39 I should use ??? bdb or mdb? or? And as mentioned about slapo-rwm, I'm using ldap proxy to Active Directory mapping to: overlay rwm rwm-map objectclass posixAccount user rwm-map attribute uid sAMAccountName rwm-map attribute cn cn rwm-map attribute sn sn rwm-map attribute uidNumber uidNumber rwm-map attribute gidNumber gidNumber rwm-map attribute homeDirectory unixHomeDirectory rwm-map attribute loginShell loginShell rwm-map attribute mail mail rwm-map attribute * Is there a better way instead? Thanks a bunch! Sterling ------ Original Message ------ From: "Quanah Gibson-Mount" <quanah(a)zimbra.com> To: "Sterling Sahaydak" <sterling.sahaydak(a)pi-coral.com>; openldap-technical(a)openldap.org Sent: 7/9/2015 5:18:44 PM Subject: Re: Replication mode - glibc detected *** slapd: double free or corruption >--On Thursday, July 09, 2015 9:53 PM +0000 Sterling Sahaydak ><sterling.sahaydak(a)pi-coral.com> wrote: > >> >>I've had replication working for the last few months and now running >>into >>the following when I run: >>slapd -h "ldapi:/// ldap:/// ldaps:///" -d 4 >> >>I installed GIT on the server, version 1.7.1 which is a couple years >>old, >>but was wondering would that have anything causing replication to stop >>working? > >The openldap version is what is important, not the version of git. >However, it looks like you have a corrupt database: > >559edda4 hdb_db_open: database "dc=pi-coral,dc=com": unclean shutdown >detected; attempting recovery. > >back-hdb is deprecated in current OpenLDAP, and back-mdb is the >supported backend. I also note you appear to be using slapo-rwm, which >is known to have a variety of issues. > >--Quanah > > >-- > >Quanah Gibson-Mount >Platform Architect >Zimbra, Inc. >-------------------- >Zimbra :: the leader in open source messaging and collaboration

1 0

Replication mode - glibc detected *** slapd: double free or corruption
by Sterling Sahaydak 09 Jul '15

09 Jul '15

I've had replication working for the last few months and now running into the following when I run: slapd -h "ldapi:/// ldap:///ldaps:///" -d 4 I installed GIT on the server, version 1.7.1 which is a couple years old, but was wondering would that have anything causing replication to stop working? ... <= ldap_bv2dn(cn=Database 3,cn=Databases,cn=Monitor)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=database 3,cn=databases,cn=monitor)=0 559edda4 hdb_db_open: "dc=pi-coral,dc=com" 559edda4 hdb_db_open: database "dc=pi-coral,dc=com": unclean shutdown detected; attempting recovery. 559edda4 => bdb_entry_get: ndn: "dc=pi-coral,dc=com" 559edda4 => bdb_entry_get: oc: "(null)", at: "contextCSN" 559edda4 bdb_idl_fetch_key: 559edda4 bdb_idl_fetch_key: 559edda4 send_ldap_result: err=0 matched="" text="" 559edda4 [rw] searchDN: "ou=Users,ou=example,dc=ad,dc=example,dc=com" -> "ou=Users,ou=example,dc=ad,dc=example,dc=com" *** glibc detected *** slapd: double free or corruption (out): 0x00007f3382f44bb0 *** ======= Backtrace: ========= /lib64/libc.so.6(+0x75e66)[0x7f339ab17e66] /lib64/libc.so.6(+0x789b3)[0x7f339ab1a9b3] slapd(filter_free_x+0x13a)[0x7f339ebd72da] /usr/lib64/openldap/rwm-2.4.so.2(+0xb34d)[0x7f3397d0c34d] /usr/lib64/openldap/rwm-2.4.so.2(rwm_filter_map_rewrite+0x2b)[0x7f3397d0c99b] /usr/lib64/openldap/rwm-2.4.so.2(+0x6c3a)[0x7f3397d07c3a] slapd(overlay_op_walk+0x4a)[0x7f339ec41efa] slapd(+0xbaa3b)[0x7f339ec42a3b] slapd(+0xb87ab)[0x7f339ec407ab] slapd(overlay_op_walk+0x4a)[0x7f339ec41efa] slapd(+0xbaa3b)[0x7f339ec42a3b] /usr/lib64/openldap/syncprov-2.4.so.2(+0x70ae)[0x7f3397afb0ae] /usr/lib64/openldap/syncprov-2.4.so.2(+0x72a0)[0x7f3397afb2a0] /lib64/libpthread.so.0(+0x79d1)[0x7f339b0489d1] /lib64/libc.so.6(clone+0x6d)[0x7f339ab8a8fd] ======= Memory map: ======== 7f337c000000-7f337c021000 rw-p 00000000 00:00 0 7f337c021000-7f3380000000 ---p 00000000 00:00 0 7f3381743000-7f3382745000 rw-p 00000000 00:00 0 7f3382745000-7f3382746000 ---p 00000000 00:00 0 7f3382746000-7f3382f46000 rw-p 00000000 00:00 0 7f3382f46000-7f3382f4e000 rw-s 00000000 ca:01 795307 /var/lib/ldap/__db.006 7f3382f4e000-7f3383006000 rw-s 00000000 ca:01 795306 /var/lib/ldap/__db.005 7f3383006000-7f3383246000 rw-s 00000000 ca:01 794767 /var/lib/ldap/__db.004 7f3383246000-7f3397248000 rw-s 00000000 ca:01 794749 /var/lib/ldap/__db.003 7f3397248000-7f3397af4000 rw-s 00000000 ca:01 794744 /var/lib/ldap/__db.002 7f3397af4000-7f3397b00000 r-xp 00000000 ca:01 538738 /usr/lib64/openldap/syncprov-2.4.so.2.10.2 7f3397b00000-7f3397cff000 ---p 0000c000 ca:01 538738 /usr/lib64/openldap/syncprov-2.4.so.2.10.2 7f3397cff000-7f3397d00000 r--p 0000b000 ca:01 538738 /usr/lib64/openldap/syncprov-2.4.so.2.10.2 ... 7f339f6ac000-7f339f9ee000 rw-p 00000000 00:00 0 [heap] 7fff8ad37000-7fff8ad4c000 rw-p 00000000 00:00 0 [stack] 7fff8ad84000-7fff8ad85000 r-xp 00000000 00:00 0 [vdso] ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall] Aborted

2 1

mdb wont replicate
by Brendan Kearney 08 Jul '15

08 Jul '15

at some point in the past, i wound up taking drastic measures and rebuilt my two ldap boxes after taking a backup of the data. i think my process could use some fine tuning and polishing, as a weird nuance has found its way into my environment. i am replicating, using MMR, both config and data between two servers. the config and schemas replicate without issue, as well as the data in the mdb, but not any of the settings for the mdb. if i try, for example, to add an ACL or Index to the mdb, i get an error "ObjectClass modifications are not allowed". i think the root of my issue is that i backed up one of the two boxes and restored the one backup to both boxes while they were both offline. i believe that because they both have the same backed up data on them, some of the internal attributes are identical and therefore conflict. i have seen logs about ContextCSNs being identical, but haven't had time to investigate those messages till now. in any case, whatever i did wrong now does not allow the mdb settings to be replicated between the boxes. what i am looking to understand is how to i correct the situation. i am looking to avoid recreating all of the data, so using backups, exports, etc is something i want to do, and do correctly. would i need to capture slapcat output to a file, or is ldapsearch the correct way to export the data for backup/restore needs? do i need to follow a destructive path to correct this issue or will surgery on the mdb correct my issue? i am running 2.4.39 on Fedora 20. any pointers would be appreciated. brendan

3 7

LDIF modify in a replication server
by mdii 08 Jul '15

08 Jul '15

Hi all, I'm trying to do a LDIF import (via Apache Directory Studio) after a replication issue. The goal is to correct a replication error. The problem is that when I try to import the LDIF file, I'm receiving the following error : > #!ERROR [LDAP: error code 53 - shadow context; no update referral] > I found that is related to the replication, and probably the server is in read-only mode. I also saw several solutions, as changing the olcMirrorMode to FALSE or even delete it from the slapd.conf file. My problem is that I can't find the olcMirrorMod in my slapd.conf file, I just found it in the file \openldap\slapd-oldschema.d\cn=config\cn=schema.ldif. Here is my slapd.conf file (without the comments): > include /usr/local/openldap/etc/openldap/schema/core.schema > include /usr/local/openldap/etc/openldap/schema/cosine.schema > include > /usr/local/openldap/etc/openldap/schema/inetorgperson.schema > include /usr/local/openldap/etc/openldap/schema/nis.schema > > pidfile /usr/local/openldap/var/run/slapd.pid > argsfile /usr/local/openldap/var/run/slapd.args > > ####################################################################### > # MDB database definitions > ####################################################################### > database mdb > suffix "o=xxxxxxxxxx" > rootdn "cn=admin,ou=programmes,o=xxxxxxxxxxxxx" > > rootpw secret > > directory /custom/data/openldap-data > maxsize 5368709120 > > > index objectClass eq > database monitor > > database config > > rootdn "cn=admin,cn=config" > rootpw secret > And here is the LDIF file that I'm trying to import: > version: 1 > > dn: xxxxxxxxxxxxxxxxxxxxxxxxxxxxx > objectClass: top > objectClass: organizationalUnit > objectClass: organizationalentity > ou: xxxxxxxxxxxxxxxxxxxxxxxxxxxxx > additionalmail: xxxxxxxxxxxxxx > businessCategory: xxxxxxxxxxxxxx > codecommune: xxxxxxx > codespecialite: xxxxxxxxxxxxxxx > codetypologie: xxxxxxxxxxx > cta: xxxxxxxxxxxxxxxxx > department: xxxxxxxxxxxxxxxxx > departmentNumber: xxxxxxxxxxxxx > destinationIndicator: xxxxxxxxxx > facsimileTelephoneNumber: xxxxxxxxxxxxxx > financialcode: xxxxxxxxxxxxxx > l: xxxxxxxxxxxxxxx > mail: xxxxxxxxxxxxxx > postalAddress: xxxxxxxxx > postalCode: xxxxxxxxxx > seeAlso: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx > > > Are these information correct ? Do you think I can try to log onto ApacheDS avec le compte root (cn=admin,cn=config / secret) to try the import ? If not, is there anyway to see why my replication is not changing these particular entry? Thanks in advance for all the help, Marc

1 0

ldap.conf not being used for TLS_CERT/TLS_KEY
by Deon George 06 Jul '15

06 Jul '15

Hi, Looking for feedback on why this is not working, or if it is a bug. The details of my configuration are here: http://serverfault.com/questions/702739 <http://serverfault.com/questions/702739> I discovered (and proved), that ldapsearch is not honouring TLS_CERT/TLS_KEY in /etc/openldap/ldap.conf. I’m running the query as “root” and selinux is disabled. If however, I put the TLS_CERT/TLS_KEY in my ~/ldaprc or ~/.ldaprc, then they are honoured. Is this a bug? What is stopping the “global default” of TLS_CERT/TLS_KEY from being read? …deon

3 2

relax rules control and MMR
by Michael Ströder 03 Jul '15

03 Jul '15

HI! It seems that some issues with relax rules control and delta-syncrepl-MMR have been fixed in 2.4.41. But I vaguely remember that there was another issue with MMR in case the relax rules control is used. I did not find anything else related in ITS in state non-closed. Should updating the attributes 'authTimestamp' and 'pwdFailureTime' work with relax rules control also with MMR? Ciao, Michael.

2 1

gidNumber uniqueness
by Ferenc Wagner 03 Jul '15

03 Jul '15

Hi, We use (among others) this unique domain in a database: olcUniqueURI: ldap:///?gidNumber?sub?objectClass=posixGroup so that we can't create two groups with the same gidNumber. The problem is that this rule also denies the creation of a posixAccount belonging to an already existing posixGroup. Of course there is no problem creating the account first and the group later. How could we overcome this ordering limitation? -- Thanks, Feri.

2 2

ACL filter and posix group
by Nicolas RENAULT 03 Jul '15

03 Jul '15

Hi, I search a lot but can't find solution so I post here : I have to allow a user to get informations from internal ldap for enterprise external software (cloud backup for laptop). only some accounts have to be retreive by this external user. I create a group (posixgroup) and add members to this one (memberUid) I create the posixAccount that will be used by external software to get informations on the member of the new group. (uid,userPassword,mail,givenName,sn) so I want to make an acl that limit access for the create account to read only informations of users from the created group. I already test overlay memberOf but it's not working with memberUid (not dn style) info openldap server 2.4.40+dfsg-1 on debian jessie simple ldap ou=Users,dc=exemple,dc=com <-- all my users uid=readers,ou=Users,dc=exemple,dc=com <-- the user i want to use to see only cn=externalgroupaccess ou=Groups,dc=exemple,dc=com <-- posixGroup with memberUid cn=arcaboxUser,ou=Groups,dc=exemple,dc=com <-- the group that users have to be visible. acl : access to dn.subtree="dc=Comptes,dc=com" attrs=entry,uid,userPassword,mail,givenName,sn filter=() by dn="uid=readers,ou=Users,dc=exemple,dc=com" read by * break access to dn.subtree="dc=Comptes,dc=com" by dn="readers,ou=Users,dc=exemple,dc=com" search by * break My problem is on the filter (I think) if I use this : filter=(uid=accountuid) the user "readers" can see the information from accountuid and not from others. but cn=arcaboxUser,ou=Groups,dc=exemple,dc=com wil have more than 200 accounts. Question : Someone have an idea to build a filter that containt all cn=arcaboxUser,ou=Groups,dc=exemple,dc=com memberUid value ? I see "set" but if I understand this : http://www.openldap.org/faq/data/cache/1133.html , set is only use in by statement of acl not in filter. Thank you Nicolas (sorry for bad english) I want to make an acl that limit access for a account to read only informations of users from one group

1 0

Problems with openLDAP + GSSAPI + JAVA
by Andreas Laesser 03 Jul '15

03 Jul '15

Hi @all I have a (maybe) a problem with my openldap server authenticating over a JAVA tool (Apache Directory Studio LDAP Browser V2.0.0.v20130628, jXplorer) via GSSAPI. When I do a ldapsearch from command line via GSSAPI it works fine... ~ % klist Ticket cache: FILE:/tmp/krb5cc_1086_lR4Nxxxxrs Default principal: admin(a)SPSC.TUGRAZ.AT Valid starting Expires Service principal 30/06/2015 10:54 02/07/2015 10:54 krbtgt/SPSC.TUGRAZ.AT(a)SPSC.TUGRAZ.AT renew until 10/07/2015 10:54 30/06/2015 10:54 02/07/2015 10:54 ldap/ldap1.spsc.tugraz.at(a)SPSC.TUGRAZ.AT renew until 10/07/2015 10:54 ~ % ldapsearch -H ldaps://ldap1.spsc.tugraz.at -b "dc=SPSC,dc=TUGRAZ,dc=AT" This works well.... but if I try the same from one of the two tools mentioned above it simply not bind or connects.... Does anybody had the same problems, or knows a solution? Thanks for help regards Andreas -- ========================================================================= _____________ / ___________/ Andreas Laesser / //_// /____/ Signal Proc.& Speech Communication Lab. __/ /___/ / __ Graz University of Technology /___//____//___/ Inffeldgasse 16c/EG | A-8010 Graz | Austria http://www.spsc.tugraz.at Tel: +43 (0)316 873 -4443 Fax: DW 104439 =========================================================================

4 4

luseradd 30 minutes after restore ldif backup.
by Fabián M Sales 02 Jul '15

02 Jul '15

I install a new server with LDAP: slapd 2.4.39 And database "MDB". After installation, I use luseradd and adds the user very quickly. But if I restored a backup file BKP.LDIF another server you are running with bdb. /etc/init.d/slapd stop rm -f / var / lib / ldap / * -v -l slapadd /root/BKP.LDIF slapindex -v ldap.ldap chown -R / var / lib / ldap / /etc/init.d/slapd start Luseradd command takes more than 30 minutes. I starting the slapd service with the option "-d 1" I see this: 55957574 mdb_search: 38848 does not match filter 55957574 => mdb_entry_decode: 55957574 <= mdb_entry_decode 55957574 mdb_search: 38854 does not match filter 55957574 => mdb_entry_decode: 55957574 <= mdb_entry_decode 55957574 mdb_search: 38860 does not match filter 55957574 => mdb_entry_decode: 55957574 <= mdb_entry_decode 55957574 mdb_search: 38868 does not match filter No it should be. I need to index any field indexed? /etc/openldap/slapd.conf in my file I have: objectclass index, entryCSN, entryUUID, eq cn Any help? -- Firma Institucional *Fabián* *M. Sales *Soporte Técnico & I.T.I Linux *DonWeb * La Actitud Es Todo www.DonWeb.com ------------------------------------------------------------------------ Nota de confidencialidad: Este mensaje y archivos adjuntos al mismo son confidenciales, de uso exclusivo para el destinatario del mismo. La divulgación y/o uso del mismo sin autorización por parte de DonWeb.com queda prohibida. DonWeb.com no se hace responsable del mensaje por la falsificación y/o alteración del mismo. De no ser Ud el destinatario del mismo y lo ha recibido por error, por favor, notifique al remitente y elim?elo de su sistema. Confidentiality Note: This message and any attachments (the message) are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited by DonWeb.com. DonWeb.com shall not be liable for the message if altered or falsified. If you are not the intended addressee of this message, please cancel it immediately and inform the sender Nota de Confidencialidade: Esta mensagem e seus eventuais anexos podem conter dados confidenciais ou privilegiados. Se você os recebeu por engano ou não é um dos destinatários aos quais ela foi endereçada, por favor destrua-a e a todos os seus eventuais anexos ou copias realizadas, imediatamente. É proibida a retenção, distribuição, divulgação ou utilização de quaisquer informações aqui contidas. Por favor, informenos sobre o recebimento indevido desta mensagem, retornando-a para o autor.

1 0

A new open-source TLS implementation
by Andrew Findlay 02 Jul '15

02 Jul '15

Amazon have just announced a completely new implementation of TLS. By avoiding all the history and ignoring features that they don't need the code has been cut by a factor of 10 when compared with the equivalent part of OpenSSL. OpenSSL or some other crypto library is still needed, but this is surely worth a look for future use with LDAP: http://blogs.aws.amazon.com/security/post/TxCKZM94ST1S6Y/Introducing-s2n-a-… https://github.com/awslabs/s2n/blob/master/README.md Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

4 3

Search object exception
by jupiter 02 Jul '15

02 Jul '15

Hi, I have a django application which using Python LDAP API to search LDAP objects and throws object DoesNotExist exception. I thought the search function should catch the exception, but the owner of the software said, the try / except should not be used, if it throws an exception, it is LDAP configuration problem, must fix the LDAP configuration. Is it possible to configure LDAP not throwing exception for searching non-existing objects? Thank you. hce

2 1

Thread cursor sharing
by Kristoffer Sjögren 02 Jul '15

02 Jul '15

Hi Simple question, is thread cursor sharing allowed? Cheers, -Kristoffer

1 2

OpenLDAP and dynalogin (two-factor auth with HOTP)
by Daniel Pocock 29 Jun '15

29 Jun '15

Some time ago I created the dynalogin ( http://www.dynalogin.org ) solution for two-factor authentication. I'm just contemplating how to make it easier to integrate, and making it convenient to use with OpenLDAP seems like a good strategy: can anyone comment on that? The initial thoughts that I have about the subject: - SASL based solution (dynalogin has digest capability already, so it could be adapted for SASL PLAIN or DIGEST-MD5) - should not prevent password logins (user should be able to use either password or HOTP code) - should enable people to use it indirectly (e.g. if someone already has pam_ldap working, they should be able to add dynalogin to their OpenLDAP server and get immediate benefit) - use cases: UNIX login, high-security webmail login, VPN and OpenID provider backed by OpenLDAP I know that SASL already supports OTP, but that is not HOTP, it is OPIE (or S/Key) RFC 2289: http://tools.ietf.org/html/rfc2289 whereas HOTP is RFC 4226: http://www.ietf.org/rfc/rfc4226.txt HOTP is considered more secure and more widely implemented.

5 6

slapo-sock
by Lalot Dominique 26 Jun '15

26 Jun '15

Hello, I am trying to understand how the sock overlay works. I'am partly successfull in getting the entries, so the unix socket is working. What I want to do, is acting as a trigger each time an entry is added I receive the data, but I don't know how to say; "that's OK add it" to mdm backend I just answer "RESULT\n"; So the ldapadd is considered successfull, but in fact no entry is added. Is there a way to do that? I have some difficulties to understand the way it works Thanks Dom

3 10

db_stat find high cpu usage
by Fabián M Sales 26 Jun '15

26 Jun '15

Hello list. I have a server not performing well - openldap shows high cpu usage and iowait of server is high db_stat -h /var/lib/ldap -c 555 Last allocated locker ID 0x7fffffff Current maximum unused locker ID 9 Number of lock modes 1000 Maximum number of locks possible 1000 Maximum number of lockers possible 1000 Maximum number of lock objects possible 40 Number of lock object partitions 10 Number of current locks 645 Maximum number of locks at any one time 18 Maximum number of locks in any one bucket 0 Maximum number of locks stolen by for an empty partition 0 Maximum number of locks stolen for any one partition 141 Number of current lockers 152 Maximum number of lockers at any one time 10 Number of current lock objects 623 Maximum number of lock objects at any one time 6 Maximum number of lock objects in any one bucket 0 Maximum number of objects stolen by for an empty partition 0 Maximum number of objects stolen for any one partition 1237M Total number of locks requested (1237918767) 1237M Total number of locks released (1237917421) 0 Total number of locks upgraded 103 Total number of locks downgraded 492M Lock requests not available due to conflicts, for which we waited (492996269) 1336 Lock requests not available due to conflicts, for which we did not wait 0 Number of deadlocks 0 Lock timeout value 0 Number of locks that have timed out 0 Transaction timeout value 0 Number of transactions that have timed out 736KB The size of the lock region 3685M The number of partition locks that required waiting (135%) 3665M The maximum number of times any partition lock was waited for (108%) 19810 The number of object queue operations that required waiting (0%) 2443M The number of locker allocations that required waiting (58%) 0 The number of region locks that required waiting (0%) 6 Maximum hash bucket length Are the lines in red really correct or just side effects ? How do I go about it ? I can have anything else? Increase cache? How? db_stat -h /var/lib/ldap -m 12MB 514KB 24B Total cache size 1 Number of caches 1 Maximum number of caches 12MB 520KB Pool individual cache size 0 Maximum memory-mapped file size 0 Maximum open file descriptors 0 Maximum sequential buffer writes 0 Sleep after writing maximum sequential buffers 0 Requested pages mapped into the process' address space 788M Requested pages found in the cache (21%) 2867M Requested pages not found in the cache (2867396236) 740 Pages created in the cache 2863M Pages read into the cache (2863007508) 228732 Pages written from the cache to the backing file 2865M Clean pages forced from the cache (2865409816) 206860 Dirty pages forced from the cache 0 Dirty pages written by trickle-sync thread 681 Current total page count 681 Current clean page count 0 Current dirty page count 2053 Number of hash buckets used for page location 1567M Total number of times hash chains searched for a page (1567726752) 6 The longest hash chain searched for a page 597M Total number of hash chain entries checked for page (597110368) 2479M The number of hash bucket locks that required waiting (61%) 2211M The maximum number of times any hash bucket lock was waited for (771%) 73M The number of region locks that required waiting (4%) 0 The number of buffers frozen 0 The number of buffers thawed 0 The number of frozen buffers freed 2867M The number of page allocations (2867487657) 2436M The number of hash buckets examined during allocations (2436374360) 4110 The maximum number of hash buckets examined for an allocation 2867M The number of pages examined during allocations (2867478740) 17 The max number of pages examined for an allocation 76217 Threads waited on page I/O Thanks very Much. -- Firma Institucional *Fabián* *M. Sales *Soporte Técnico & I.T.I Linux *DonWeb * La Actitud Es Todo www.DonWeb.com ------------------------------------------------------------------------ Nota de confidencialidad: Este mensaje y archivos adjuntos al mismo son confidenciales, de uso exclusivo para el destinatario del mismo. La divulgación y/o uso del mismo sin autorización por parte de DonWeb.com queda prohibida. DonWeb.com no se hace responsable del mensaje por la falsificación y/o alteración del mismo. De no ser Ud el destinatario del mismo y lo ha recibido por error, por favor, notifique al remitente y elim?elo de su sistema. Confidentiality Note: This message and any attachments (the message) are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited by DonWeb.com. DonWeb.com shall not be liable for the message if altered or falsified. If you are not the intended addressee of this message, please cancel it immediately and inform the sender Nota de Confidencialidade: Esta mensagem e seus eventuais anexos podem conter dados confidenciais ou privilegiados. Se você os recebeu por engano ou não é um dos destinatários aos quais ela foi endereçada, por favor destrua-a e a todos os seus eventuais anexos ou copias realizadas, imediatamente. É proibida a retenção, distribuição, divulgação ou utilização de quaisquer informações aqui contidas. Por favor, informenos sobre o recebimento indevido desta mensagem, retornando-a para o autor.

2 5

authenticate LDAP to email server
by robert k Wild 26 Jun '15

26 Jun '15

sorry im posting again as my first post i wasnt subscribed to this mailing list but now i am hi all, i have installed dovecot+ postfix email server and a LDAP server, if i create users on the LDAP server can dovecot pick up the usernames and create a mailbox for the individual users as atm if i want to create an email address for users i add the user to the email server and make a directory for the users mailbox and have to chmod and chown also just another question, can i set up mail groups on dovecot? cheers rob -- Regards, Robert K Wild.

3 2

Overlay for applying business logic filters to LDAP modifies/deletes
by Bannister, Mark 26 Jun '15

26 Jun '15

Hi, I'm setting up a new OpenLDAP infrastructure on Solaris, where the directory will be critical and we need to keep a tight control on the changes made to it. The changes will come from an external feed, and as an extra safety measure to protect against software bugs that could otherwise cripple our infrastructure, we would like to put an overlay into the directory server that will make sure that the changes being made to the directory do not break some basic business rules we are defining. The rules will be along these lines: - Do not allow more than 10% of entries underneath a given DIT to be modified in less than a 24 hour period - Entries underneath a given DIT must have a specified list of object classes and attributes defined - Do not permit modrdn under a given DIT - Attribute values match a particular defined set of REs (I can do this with the constraint overlay) - Some critical entries cannot be modified or removed (I can do this with access control lists) - Some attributes not used in the DN must be unique (I can do this with the unique overlay) So I'm ok with the last three, but any suggestions for the first three? Has anyone else implemented similar overlays already? Thanks & regards, Mark Bannister. ________________________________ NOTICE: Morgan Stanley is not acting as a municipal advisor and the opinions or views contained herein are not intended to be, and do not constitute, advice within the meaning of Section 975 of the Dodd-Frank Wall Street Reform and Consumer Protection Act. If you have received this communication in error, please destroy all electronic and paper copies; do not disclose, use or act upon the information; and notify the sender immediately. Mistransmission is not intended to waive confidentiality or privilege. Morgan Stanley reserves the right, to the extent permitted under applicable law, to monitor electronic communications. This message is subject to terms available at the following link: http://www.morganstanley.com/disclaimers If you cannot access these links, please notify us by reply message and we will send the contents to you. By messaging with Morgan Stanley you consent to the foregoing.

2 1

Waiting for initial replication to complete
by Bannister, Mark 26 Jun '15

26 Jun '15

Hi, When I first set-up a new OpenLDAP consumer (syncrepl) it can take 5-10 minutes to sync the data from the master server. The script I've written that configures the replica needs to know when the initial full replication is complete. At the moment I'm testing to see if all the top-level containers are in place, and then waiting a little longer, but this seems pretty fragile to me. Is there a more accurate way of determining once the initial syncrepl is complete? Thanks, Mark. ________________________________ NOTICE: Morgan Stanley is not acting as a municipal advisor and the opinions or views contained herein are not intended to be, and do not constitute, advice within the meaning of Section 975 of the Dodd-Frank Wall Street Reform and Consumer Protection Act. If you have received this communication in error, please destroy all electronic and paper copies; do not disclose, use or act upon the information; and notify the sender immediately. Mistransmission is not intended to waive confidentiality or privilege. Morgan Stanley reserves the right, to the extent permitted under applicable law, to monitor electronic communications. This message is subject to terms available at the following link: http://www.morganstanley.com/disclaimers If you cannot access these links, please notify us by reply message and we will send the contents to you. By messaging with Morgan Stanley you consent to the foregoing.

2 1

Remove bdb log files automatically
by PRATIK SINGAL 24 Jun '15

24 Jun '15

Hello Can any one suggest me the configuration to remove the old log files automatically . And also if we will need to set a checkpoint variable in slapd.conf

3 3

Replacement for ldap_sort_entries
by Côme BERNIGAUD 24 Jun '15

24 Jun '15

Hello, I’m trying to get rid of the -DLDAP_DEPRECATED=1 option when building the php-ldap module. For other functions it went fine but the php function ldap_sort is using ldap_sort_entries which is deprecated with no replacement. As I can’t remove ldap_sort from PHP API, I need to find a way to replace this function call if I want to get rid of deprecated calls. I tried copy/pasting the function code to see if I could built it myself but then it complains about incomplete type for LDAPMessage, which seems internal to libldap. Any idea about a replacement for this function? Côme

3 4

mulitple URI for failed TLS connection
by Daniel Jung 22 Jun '15

22 Jun '15

Hi, Using openldap-2.4.39. Just want to confirm that its normal behaviour for ldapsearch(CLI) to fail on the first attempt and not to use the next server in URI setting? I can see the SSSD handles TLS failure better by querying the next server in the URI. Cheers,

1 0

group email addresses
by Brendan Kearney 22 Jun '15

22 Jun '15

i have done some reading, and it seems that no official standard exists for group email addresses. to that end, i am looking to enlighten myself about what is done to provide mail addresses for groupOfNames groups. i would imagine there is some overlap between what many or most folks do and that would be a good starting point for me. i figure its something like "you have 7 steps to perform, and everyone does step 1,2,3 and 5 the same way. the rest, you are on your own for." i want to setup mailboxes for these groups, for example: cn=ldapAdmins,ou=domainGroups,ou=Groups,dc=bpk2,dc=com cn=ldapEngineers,ou=domainGroups,ou=Groups,dc=bpk2,dc=com these are groupOfNames structural groups, with top and posixGroup classes as aux. where do most folks begin, when setting up group mailboxes? i found a schema that is not official and has been extended with the same names but different numerical OIDs. I am not sure if this is the right path to follow, or if something more "standards focused" is appropriate. any help is appreciated. thanks, brendan

5 7

LDAPCon 2015 submission deadline approaching
by Andrew Findlay 19 Jun '15

19 Jun '15

LDAPCon 2015 will be held in Edinburgh on 11-13 November. The submission deadline for paper and tutorial proposals is 28th June so you have just one week to send us your ideas: http://ldapcon.org/2015/?page_id=5 Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

1 0

best attr for multiple fields in one TAB-separated field ..
by lejeczek 18 Jun '15

18 Jun '15

.. which would be mail related, can somebody recommend? many thanks. P.

1 0

does slapd store/cache TLS certs
by lejeczek 18 Jun '15

18 Jun '15

hi everybody, I could not connect to slapd, command would fail with infamous: TLS: error: connect - force handshake failure: errno 0 - moznss error -5938 TLS: can't connect: TLS error -5938:Encountered end of file. ldap_err2string ldap_start_tls: Connect error (-11) additional info: TLS error -5938:Encountered end of file I was positive about certs, restarted daemons, looked at other obvious places, etc. - nothing. Only after I removed database & config files, recreated/restarted the whole slap it worded. Would it be that slapd caches certificates somewhere and does not re-read those upon restart? many thanks

2 2

open ldap meta backend empty search
by Pierluca Marino 17 Jun '15

17 Jun '15

Hi, I have a problem with meta backend feature. I need to get data from two different LDAP under a unique dn. The two ldap are an active directory and another ldap that should be on the same Open LDAP instance of the meta backend. Actually to test the solution I'm usind Open LDAP Windows version. This is my sladp config: # LDIF Backend configuration file # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. ucdata-path ./ucdata include ./schema/core.schema include ./schema/cosine.schema include ./schema/nis.schema include ./schema/inetorgperson.schema include ./schema/openldap.schema include ./schema/dyngroup.schema pidfile ./run/slapd.pid argsfile ./run/slapd.args # Enable TLS if port is defined for ldaps TLSVerifyClient never TLSCipherSuite HIGH:MEDIUM:-SSLv2 TLSCertificateFile ./secure/certs/server.pem TLSCertificateKeyFile ./secure/certs/server.pem TLSCACertificateFile ./secure/certs/server.pem ####META database meta suffix "dc=proxy,dc=company,dc=it" rootdn "cn=Manager,dc=proxy,dc=company,dc=it" rootpw "secret" uri "ldap://adhost:390/dc=proxy,dc=company,dc=it" suffixmassage "dc=proxy,dc=company,dc=it" "dc=company,dc=cosmag,dc=it" lastmod off idassert-bind bindmethod=simple binddn="cn=Manager,dc=company,dc=cosmag,dc=it" credentials="password" mode=none flags=non-prescriptive idassert-authzFrom "dn.exact:cn=Manager,dc=proxy,dc=company,dc=it" acl-authcDN "cn=Manager,dc=company,dc=cosmag,dc=it" acl-passwd "password" uri "ldap://localhost:389/dc=proxy,dc=company,dc=it" suffixmassage "dc=proxy,dc=company,dc=it" "dc=portal,dc=company,dc=it" lastmod off idassert-bind bindmethod=simple binddn="cn=Manager,dc=portal,dc=company,dc=it" credentials="secret" mode=none flags=non-prescriptive idassert-authzFrom "dn.exact:cn=Manager,dc=proxy,dc=company,dc=it" acl-authcDN "cn=Manager,dc=portal,dc=company,dc=it" acl-passwd "secret" ####################################################################### # ldif database definitions ####################################################################### database ldif directory ./ldifdata suffix "dc=portal,dc=company,dc=it" rootdn "cn=Manager,dc=portal,dc=company,dc=it" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw {SSHA}Bww72HPj9nrNxrLAQxuTqP1Z0zuafPPd The server start normally, but when I do a search starting from base dn "dc=proxy,dc=company,dc=it" nothing is returned: ldapsearch -H ldap://localhost:389 -x -D "cn=Manager,dc=proxy,dc=company,dc=it" -W -b "dc=proxy,dc=company,dc=it" -s base -a always -z 1 "(objectClass=*)" "hasSubordinates" "objectClass" # baseObject : dc=proxy,dc=company,dc=it # scope : baseObject (0) # derefAliases : derefAlways (3) # sizeLimit : 1 # timeLimit : 0 # typesOnly : False # filter : (objectClass=*) # attributes : hasSubordinates objectClass #!SEARCH RESULT DONE (32) OK #!CONNECTION ldap://localhost:389 #!DATE 2015-06-16T07:38:21.970 # numEntries : 0 Server log returns: conn=1000 op=6 <<< meta_back_search_start[1]=0 conn=1000 op=6 meta_back_search: ncandidates=0 cnd="**" conn=1000 op=6 meta_back_search: base="dc=proxy,dc=company,dc=it" scope=0: no candidate could be selected send_ldap_result: conn=1000 op=6 p=3 send_ldap_response: msgid=7 tag=101 err=52 Where is my mistake? There is something that I have missed in configuration? Best Regards Pierluca

1 0

proxy to AD does not work during login client machine
by Leo Xiao 17 Jun '15

17 Jun '15

Hi technical, I hit a problem during configure proxy to AD. I can run command: $ldapsearch -x -h localhost -LLL -b dc=mydomain,dc=local -D cn=open,cn=users,dc=mydomain,dc=local -W "(cn=open1)" cn sAMAccountName which return the SAMACCOUNTNAME:open successfully. --- This may mean the proxy works well. But if I run command with out -D -D cn=open,cn=users,dc=mydomain,dc=local. The search will failed. when I try to login my client machine with AD user. It always failed. --- I can login with openldapuser successfully. I think I need some configuration to force the -D in slapd.con. Is there any problems with my slapd.conf? Or any trouble shooting comments? Appreciate it very much. Below is my slapd.conf: ####################################################################### # database definitions ####################################################################### database ldap suffix "DC=mydomain,DC=local" uri ldap://dc-ad.mydomain.local/ chase-referrals no rebind-as-user yes idassert-bind bindmethod=simple binddn="CN=open,OU=users,DC=mydomain,DC=local" credentials=open mode=none flags=non-prescriptive idassert-authzFrom "*" Thanks, Leo

2 4

authentication with SSL
by Bharath K 17 Jun '15

17 Jun '15

i am trying to accesses on specific web pages and use LDAP users for authentication with SSL connection.but i am getting error like my username which is stored in ldap database user name:cdac password:cdac123 but when i authenticate i am getting below error user cdac: authentication failure for "/": Password Mismatch [2446] auth_ldap authenticate: user test1 authentication failed; URI / [LDAP: ldap_simple_bind_s() failed][Invalid credentials] please help me..............

1 0

problem using redundant ldap servers with keystone
by Chris Card 15 Jun '15

15 Jun '15

Hi, I have an HA OpenStack installation with a keystone domain backed by an LDAP server. I want to make the installation resilient in the case of an LDAP server failure, so I have configured keystone with a space-separated list of LDAP server urls in the [ldap] url option. This configuration appears to work well if I e.g. stop slapd on one of the LDAP servers - I can login to horizon as a user from the LDAP directory as long as one of the LDAP servers is running slapd. But if I shutdown one of the LDAP servers, login to horizon fails and the browser (chrome in this case) says "No data received". I've turned on debug logging in keystone, and as far as I can see the LDAP requests are still working; indeed cli commands like "openstack user list --domain <domain>" which get data from LDAP still work. Any ideas? [openstack juno, centos 7, keystone and horizon running as wsgi apps under Apache] Chris

1 1

AW: problem with olcAccess - can not change own userPassword field
by Stefan Bauer 15 Jun '15

15 Jun '15

Hi Ryan, thank you. Stefan -----Ursprüngliche Nachricht----- Von: Ryan Tandy <ryan(a)nardis.ca> Gesendet: Son 14 Juni 2015 00:59 An: Stefan Bauer <sb(a)plzk.de> CC: openldap-technical(a)openldap.org Betreff: Re: problem with olcAccess - can not change own userPassword field On Thu, Jun 11, 2015 at 02:12:19PM +0200, Stefan Bauer wrote: >olcAccess: {0}to * by * read by * break "by * read" matches everyone, and stops. "by * break" is never reached. >olcAccess: {1}to dn.subtree="ou=Benutzer,dc=example,dc=com" attrs=userPassword by self write by * break This rule is never reached, because everyone is matched by "by * read" (with "stop" implicit) above.

1 0

Re: Syncrepl issue with one node
by Quanah Gibson-Mount 15 Jun '15

15 Jun '15

--On Tuesday, June 09, 2015 8:50 AM -0500 espeake(a)oreillyauto.com wrote: > > We are running openLDAP 2.4.39 in an MMR replication on Ubuntu 14.04. I > have one node that is not wanting to sync with other nodes giving the > following error: > > Jun 9 06:51:35 tn-ldap-a-1 slapd[3138]: do_syncrep2: rid=005 CSN too old, > ignoring 20150609115135.153480Z#000000#003#000000 > > As you can see the CSN shows the exact same time the time that is being > logged. We are in the U.S. Central timezone. I have checked our ntp > service on my three nodes. All three are pointed to the same ntp and are > in sync. Would be possible that one node might still be just a few > miliseconds too fast and the csn timestamp would appear wrong? Is there a > logging level I can set for that specific issue? I am currently logging > the sync records. I can go to debug in needed. a) Please don't resend your emails to the list. The first one got through fine, which you could easily verify by looking at the list archives. b) Not enough information provided here to go on. Are all server IDs unique? Are all syncrepl clauses unique per DB? Personally I've never found ntpd particularly good at keeping clocks in sync. I've generally resorted to running ntpdate frequently out of cron, particularly for VMs. --Quanah -- Quanah Gibson-Mount Platform Architect Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

3 3

why is userPassword transferred binary?
by Jephte Clain 15 Jun '15

15 Jun '15

hello, just wondering: when I ldapsearch the userPassword attribute, it is returned as binary: $ ldapsearch -LLL -H "ldap://xxx:389/" -x -D xxx -W "(uid=xxx)" userPassword dn: uid=xxx,dc=domain,dc=tld userPassword:: Z290Y2hhCg== however, I created a new attribute with the same schema as userPassword: attributetype ( runUniv:1.1.2 NAME 'runUnivPassword' DESC 'RFC2256/2307 password for special needs' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40{128} ) when I search this attribute, it is returned as text: $ ldapsearch -LLL -H "ldap://xxx:389/" -x -D xxx -W "(uid=xxx)" runUnivPassword dn: uid=xxx,dc=domain,dc=tld runUnivPassword: gotcha so my question is: does ldapsearch process userPassword as a special case and ask for binary transfer type? or does slapd return userPassword as binary by default? if so, how do I configure runUnivPassword to be handled the same? thanks in advance. best regards, -- *Jephté CLAIN | Développeur, Intégrateur d'applications* Service Systèmes d'Information Direction des Systèmes d'Information <http://numerique.univ-reunion.fr> Tél: +262 262 93 86 31 <tel:+262262938631> || Gsm: +262 692 29 58 24 <tel:+262692295824> www.univ-reunion.fr <http://www.univ-reunion.fr> || Facebook <http://www.facebook.com/pages/Universit%C3%A9-de-La-R%C3%A9union-OFFICIEL/1…> || Twitter <http://twitter.com/univ_reunion>

3 4

problem with olcAccess - can not change own userPassword field
by Stefan Bauer 14 Jun '15

14 Jun '15

Dear Users, I'm trying to change my own password in field userPassword with some gui and receive access denied - permission denied message. The access rules are .. and I'm binding with "cn=benutzer1,ou=Benutzer,dc=example,dc=com" olcAccess: {0}to * by * read by * break olcAccess: {1}to dn.subtree="ou=Benutzer,dc=example,dc=com" attrs=userPassword by self write by * break What do i miss? # benutzer1, Benutzer, example.com dn: cn=benutzer1,ou=Benutzer,dc=example,dc=com cn: benutzer1 objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person objectClass: top objectClass: posixAccount sn: Mustermann gidNumber: 777 homeDirectory: /home/benutzer1 uid: benutzer1 uidNumber: 777 loginShell: /bin/bash userPassword:: known # {2}bdb, config dn: olcDatabase={2}bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {2}bdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=example,dc=com olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=Manager,dc=example,dc=com olcRootPW:: known olcSyncUseSubentry: FALSE olcMonitoring: TRUE olcDbCacheSize: 1000 olcDbCheckpoint: 1024 15 olcDbNoSync: FALSE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 0 olcDbIndex: objectClass pres,eq olcDbIndex: cn pres,eq,sub olcDbIndex: uid pres,eq,sub olcDbIndex: uidNumber pres,eq olcDbIndex: gidNumber pres,eq olcDbIndex: mail pres,eq,sub olcDbIndex: ou pres,eq,sub olcDbIndex: loginShell pres,eq olcDbIndex: sn pres,eq,sub olcDbIndex: givenName pres,eq,sub olcDbIndex: memberUid pres,eq,sub olcDbIndex: nisMapName pres,eq,sub olcDbIndex: nisMapEntry pres,eq,sub olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 olcAccess: {0}to * by * read by * break olcAccess: {1}to dn.subtree="ou=Benutzer,dc=example,dc=com" attrs=userPassword by self write by * break

2 1

process slapd 99 % CPU
by Fabián M Sales 11 Jun '15

11 Jun '15

Hello, I have problem with My LDAP-server. The process /usr/sbin/slapd the process consumes 99% cpu, As you can see it? I enable the logs but can not find the problem, because this sometimes 99% and sometimes remains low. It is at times. Sorry for My poor English, -- Firma Institucional *Fabián* *M. Sales *Soporte Técnico & I.T.I Linux *DonWeb * La Actitud Es Todo www.DonWeb.com ------------------------------------------------------------------------ Nota de confidencialidad: Este mensaje y archivos adjuntos al mismo son confidenciales, de uso exclusivo para el destinatario del mismo. La divulgación y/o uso del mismo sin autorización por parte de DonWeb.com queda prohibida. DonWeb.com no se hace responsable del mensaje por la falsificación y/o alteración del mismo. De no ser Ud el destinatario del mismo y lo ha recibido por error, por favor, notifique al remitente y elim?elo de su sistema. Confidentiality Note: This message and any attachments (the message) are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited by DonWeb.com. DonWeb.com shall not be liable for the message if altered or falsified. If you are not the intended addressee of this message, please cancel it immediately and inform the sender Nota de Confidencialidade: Esta mensagem e seus eventuais anexos podem conter dados confidenciais ou privilegiados. Se você os recebeu por engano ou não é um dos destinatários aos quais ela foi endereçada, por favor destrua-a e a todos os seus eventuais anexos ou copias realizadas, imediatamente. É proibida a retenção, distribuição, divulgação ou utilização de quaisquer informações aqui contidas. Por favor, informenos sobre o recebimento indevido desta mensagem, retornando-a para o autor.

2 1

bdb_equality_candidates: (uniqueMember) not indexed
by Fabián M Sales 11 Jun '15

11 Jun '15

Hello list. :) I have got this error y My logs: bdb_equality_candidates: (uniqueMember) not indexed How create this index uniqueMember? I create a ldif file, as it should be? Steps anyone know? Thanks- -- Firma Institucional *Fabián* *M. Sales *Soporte Técnico & I.T.I Linux *DonWeb * La Actitud Es Todo www.DonWeb.com ------------------------------------------------------------------------ Nota de confidencialidad: Este mensaje y archivos adjuntos al mismo son confidenciales, de uso exclusivo para el destinatario del mismo. La divulgación y/o uso del mismo sin autorización por parte de DonWeb.com queda prohibida. DonWeb.com no se hace responsable del mensaje por la falsificación y/o alteración del mismo. De no ser Ud el destinatario del mismo y lo ha recibido por error, por favor, notifique al remitente y elim?elo de su sistema. Confidentiality Note: This message and any attachments (the message) are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited by DonWeb.com. DonWeb.com shall not be liable for the message if altered or falsified. If you are not the intended addressee of this message, please cancel it immediately and inform the sender Nota de Confidencialidade: Esta mensagem e seus eventuais anexos podem conter dados confidenciais ou privilegiados. Se você os recebeu por engano ou não é um dos destinatários aos quais ela foi endereçada, por favor destrua-a e a todos os seus eventuais anexos ou copias realizadas, imediatamente. É proibida a retenção, distribuição, divulgação ou utilização de quaisquer informações aqui contidas. Por favor, informenos sobre o recebimento indevido desta mensagem, retornando-a para o autor.

3 3

olcMirrorMode FALSE - yet - error code 53 - shadow context; no update referral
by lejeczek 11 Jun '15

11 Jun '15

hi everybody one of databases in my slapd has nor referrals and olcMirrorMode=FALSE in config yet I get infamous: - [LDAP: error code 53 - shadow context; no update referral] why would it be, something I am missing in the config of that database? other databases configs affect this one somehow? many thanks

4 5

OpenLDAP storing password in SSHA
by parakrama55 . 11 Jun '15

11 Jun '15

Hi Guys Im adding users data to the ldap from external program or client , There im sending UserPasswrd in clear text . So Is there any configuration directive in opendap where we can force openldap to store receiving clear text password in SSHA format . Please advice Thank You Dhanushka

3 2

Error: ldap_back_is_proxy_authz returned 0
by Dominique Voest 11 Jun '15

11 Jun '15

Hi everyone, I have been testing and debugging a lot lately and cannot come to a solution, maybe you can help. I recently installed a new OpenLDAP Server (Debian Jessy) (OpenLDAP Version 2.4.40) which is used to proxy parts of the Active Directory. However, from time to time it is not able to get Entries (does not answer to querys but returns success) from the Active Directory. What I see in the logs is the following: Jun 10 11:37:38 openldap-proxy slapd[41657]: conn=1166 op=1 ldap_back_retry: retrying URI="ldaps://dc.ourdomain.com" DN="cn=ldap-binder,ou=serviceaccounts,dc= ourdomain,dc=com" Jun 10 11:37:38 openldap-proxy slapd[41657]: Error: ldap_back_is_proxy_authz returned 0, misconfigured URI? First of all, the URI is correct and the System works well during most of the time(except for this error), those "errors" only happen from time to time. The Strange thing is, that this new LDAP Server is running via the exactly same configuration as another OpenLDAP-Server which has been running over 2 Years now and the old OpenLDAP Server (Debian Wheezy) (OpenLDAP Version 2.4.31) does also show the first Log Entry from time to time (the ldap_back_retry one), But does not show the ldap_back_is_proxy_authz error afterwards. Furthermore it does also always return the right answer. For Debugging reasons I tried Wiresharking the Domain Controller, TCP-Dumping the LDAP-Server and the Client. The Traffic looks okay, in case of that error the OpenLDAP Server simply is asking the Domain Controller which returns Success but no results. Might it be Possible that the LDAP-Bind from the OpenLDAP System to the Active Directory expired and the OpenLDAP is not able to re-establish a new bind via the current Query? Since once this error occurs, the query right after the error works and then it takes some time until that error occurs again and due to the fact that in the older OpenLDAP Version it is working, could it be a Bug in the new OpenLDAP Version? I also looked in the Logs of the Domain Controller, everything is fine there. Furthermore I installed test OpenLDAP Systems (Centos[yum], OpenBSD[pkg] and one via compilation from sources via minimal module configuration) (2.4.40) and tried the same configuration there, same Problem. While googling and searching for a solution I stumbled across a guy having the same problem, reporting this 2013 to this mailing list. Someone suggested to add the Active Directory Schema to the OpenLDAP, which I did and which did not solve this issue. I tried adding the full schema as well as adding only Attributes and Object classes that are used. Problem still persists. Anyone of you has any suggestions? Does anyone have similar problems? Thank you for your time. Best Regards, Dominique Voest

1 0

Syncrepl issue with one node
by espeake＠oreillyauto.com 10 Jun '15

10 Jun '15

We are running openLDAP 2.4.39 in an MMR replication on Ubuntu 14.04. I have one node that is not wanting to sync with other nodes giving the following error: Jun 9 06:51:35 tn-ldap-a-1 slapd[3138]: do_syncrep2: rid=005 CSN too old, ignoring 20150609115135.153480Z#000000#003#000000 As you can see the CSN shows the exact same time the time that is being logged. We are in the U.S. Central timezone. I have checked our ntp service on my three nodes. All three are pointed to the same ntp and are in sync. Would be possible that one node might still be just a few miliseconds too fast and the csn timestamp would appear wrong? Is there a logging level I can set for that specific issue? I am currently logging the sync records. I can go to debug in needed. Thank you, Eric Speake Senior Systems Administrator Information Systems O'Reilly Auto Parts (417) 862-2674 Ext. 1975 This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

1 1

Get the decoded ldap password for openldap2.4.40
by PRATIK SINGAL 10 Jun '15

10 Jun '15

Hello Can any one help me to get the plain text password for ldap. While configuring ldap i have used the slappasswd to get teh encrypted value and stored in slapd.conf Is there any way to get the palin password based the encrypted one.I am using openldap 2.4.40 Regards, Pratik

3 2

Ldap-Back-SQL custom mysql
by Roger Ham 09 Jun '15

09 Jun '15

Hello all, this is my fisrt time. I hope you excume for my bad English. so, now my question I have a dhcp server who make queries to ldap, and ask for 2 fields: "sn" and "businessCategory" so I try to build a simple ldap schema on my poor experience i make a file.ldif like this: #################### dn: cn=00:03:13:bc:ba:10,ou=Customers,dc=atomsapp,dc=com sn: 1,6,00:03:13:bc:ba:10 businessCategory: 512kbps objectClass: inetOrgPerson #################### What I need to do or at least to get answer if is possible is know if I can make a unique mysql table to storage many data from customer, but 2 fiedls from the table are link to ldap "sn" and "businessCategory" I hope my explication was enoght about what I need. Thank you. -- Saludos! Atte. Roger Ham

1 0

Memory leak happening while using open ldap with free-radius and samba
by Adarsha S 08 Jun '15

08 Jun '15

Hi, I've integrated openldap-2.4.25 with free-radius 2.23 and samba 3.5.1 I've a setup where I used windows 2003 server for LDAP and debian Linux machine as radius server. when ever chase-referral is enabled, on restarting of windbind process, there is a memory jump happening in radiusd process. On disabling chase-refferal, the radiusd process works fine with no memory jump. radiusd process is using openlad 2.4.25 function calls for binding to LDAP server and search Please guide me how to identify this memory leak? Thanks, Adarsha

4 7

deleting pwdFailureTime attribute on slave
by David Magda 08 Jun '15

08 Jun '15

Hello, How do I delete the “pwdFailureTime” attribute on a slave? I have a DN where there are a bazillion pwdFailureTime entries and it’s filling up /var/lib/ldap/. I’ve tried the following LDIF: dn: uid=foo,ou=People,dc=example,dc=com changetype: modify delete: pwdFailureTime But since the system is slave, it’s giving ldapmodify(1) a redirect to the master. I’ve tried both the “-M” and “-e manageDSAit” options, and the redirects still occur. This is with 2.4.23 on Debian 6. Thanks for any info. Regards, David

1 0

slapo-accesslog and extended operations
by Michael Ströder 08 Jun '15

08 Jun '15

HI! First of all: For me slapo-accesslog is one of OpenLDAP's killer features. I'm currently wondering about logging of extended operations in particular Password Modify ext. op. I see the resulting auditModify entries but I'd also like to see eventually refused auditExtended entries (e.g. to see the Session Tracking Control sent by the client). Reading access.c it seems that this is currently not supported. Is that right? With a config directive logops writes extended(1.3.6.1.4.1.4203.1.11.1) like described in slapo-accesslog(5) slapd does not even start. Ciao, Michael.

1 0

DIT and ALC: design phase.
by Simone Taliercio 07 Jun '15

07 Jun '15

Hi all, I'm still a newbie about openLDAP, but I need already to get the right choice in this design phase in order to avoid terrible troubles in the next future :) *How would you map the following scenario as for DIT and ACL (olc) ?* We have two companies: *wiki.com <http://wiki.com>* and *grape.jp <http://grape.jp>*. # Data set a) *wiki.com <http://wiki.com>* is the one hosting openLDAP and has several user accounts registered into. b) *grape.jp <http://grape.jp>* can create user accounts in the same openLDAP hosted by *wiki.com <http://wiki.com>* # Authorization c) *wiki.com <http://wiki.com> *can see and manage all the user accounts. d) *grape.jp <http://grape.jp>* can manage only user accounts created by itself. I'm thinking at the following configuration: one database called "dn=wiki,dn=com" which requires objects with following schema dn: mail=user1(a)wiki.com <http://wikitude.com/>,dc=wiki,dc=com objectclass: inetOrgPerson cn: <user1 nickname> givenname: <user1 first name> mail: user1(a)wiki.com <test.fromcmdline(a)wikitude.com> sn: <user1 surname> userPassword: aNiceEncryptedPassword o:<either wiki.com or grape.jp depending on who has created the user> and then setting a proper ACL (olc) on the attribute '*o*' in order to defined who can access what (but on this side I need still to understand A LOT). My configuration is driven from the fact I need also to integrate Liferay 6.1 which needs to see all the user accounts :-( Let me thank you for having read till here! Any suggestion and/or reference would be highly appreciated. Best Regards, Simone P.s. I was looking also for a good guide/book on Amazon, but everything looks quite outdated...

1 0

how do I add olcDbCachesize to my ldap
by Greg Jetter 04 Jun '15

04 Jun '15

Greetings: I'm running openldap 2.4.31 on ubuntu 12.04 , I want to set the cache size for entries to 200,000 I created a ldif : -- leading blank line -- dn: olcDatabase={1},cn=config changetype: modify add: olcDbCachesize olcDbCacheSize: 200000 I get the following : greg@Catbert:~/LDAP3$ sudo ldapadd -Q -Y EXTERNAL -H ldapi:/// -f AddCatchSize.ldif modifying entry "olcDatabase={1},cn=config" ldap_modify: No such object (32) matched DN: cn=config I tried a ldap modify as well : greg@Catbert:~/LDAP3$ sudo ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f AddCatchSize.ldif [sudo] password for greg: modifying entry "olcDatabase={1},cn=config" ldap_modify: No such object (32) matched DN: cn=config The back end is "hdb" , with 140,000 entries ... my olcDatabase ldif is : # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 05be5fce dn: olcDatabase={1}hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=acsalaska,dc=net olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymou s auth by dn="cn=admin,dc=acsalaska,dc=net" write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by self write by dn="cn=admin,dc=acsalaska,dc=net" write by * read olcLastMod: TRUE olcRootDN: cn=admin,dc=acsalaska,dc=net olcRootPW:: ***** removed ********* olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq olcDbIndex: cdmadauserstatus eq,pres,sub olcDbIndex: cdmadamdn eq,pres,sub olcDbIndex: cdmadamin eq,pres,sub olcDbIndex: cdmaesn eq,pres,sub olcDbIndex: cdmamin eq,pres,sub olcDbIndex: cdmadaTetherAccess eq,pres olcDbIndex: username eq,pres,sub olcDbIndex: cdmameid eq,pres,sub olcDbIndex: cdmadaroamstatus eq,pres,sub olcDbIndex: uid eq,pres,sub structuralObjectClass: olcHdbConfig entryUUID: 1da37b42-815d-1034-96f3-b93aabbbf11e creatorsName: cn=config createTimestamp: 20150427191239Z entryCSN: 20150428201620.191818Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20150428201620Z What am I doing wrong ? all the documentation I have read says olcDbCachesize object should exist ... any thoughts would be greatly appreciated Than you Greg Jetter.

3 6

OpenLDAP with SASL not working
by Don Fike 04 Jun '15

04 Jun '15

Greetings, I am using OpenLDAP 2.4.39 with SASL 2.1.23 on CentOS 6.6. I have setup this CentOS server with the same configuration as I have on a working RedHat 6.6 server. However with this CentOS server the SASL combination is not working. Using LDAP without SASL with a SSHA password authentication works. When using pass-through SASL I see a err=49 in the slapd output and the client sees Invalid Credentials. I see no output in saslauthd when run in debug when using LDAP. Running testsaslauthd alone works as expected and this does generate output in the saslauthd debug terminal. It appears that saslauthd never gets the request from slapd. Any suggestions on how to debug this further in order to determine why it is not working appreciated. Thanks,

3 4

AW: OLC permissions - general beginner question
by Stefan Bauer 04 Jun '15

04 Jun '15

Hi, why is cn=Manager,dc=example,dc=com not able to access cn=config with the second ACL? According to manpage the asterisk means any so also cn=config. is dn: olcDatabase={1}monitor,cn=config above the rule some kind of limitation or context? # {0}config, config dn: olcDatabase={0}config,cn=config olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * none # {1}monitor, config dn: olcDatabase={1}monitor,cn=config olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=Manager,dc=example,dc=com" read by * none Thank you in advance. Stefan

2 1

Log of deleted accounts
by Elias Pereira 04 Jun '15

04 Jun '15

Hi everyone! If no log setting in slapd.conf, I can check in the syslog who deleted a certain user account? -- Elias Pereira

3 2

OLC permissions - general beginner question
by Stefan Bauer 03 Jun '15

03 Jun '15

Dear Users, for research purposes i have installed a RHEL6 system to test the new OLC feature. I only have the cn=config DIT available. The ACLS are: # ldapsearch -Y EXTERNAL -H ldapi:/// -b 'cn=config' '(olcAccess=*)' olcAccess SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 # extended LDIF # # LDAPv3 # base <cn=config> with scope subtree # filter: (olcAccess=*) # requesting: olcAccess # # {0}config, config dn: olcDatabase={0}config,cn=config olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * none # {1}monitor, config dn: olcDatabase={1}monitor,cn=config olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=manager,dc=my-domain,dc=com" read by * none so it looks like only UID=0 (root) should be able to interoperate with the directory. However all local users can connect but do not have access to cn=config (this is expected). [user@host ~]$ ldapsearch -Y EXTERNAL -H ldapi:/// -b 'cn=config' SASL/EXTERNAL authentication started SASL username: gidNumber=501+uidNumber=501,cn=peercred,cn=external,cn=auth SASL SSF: 0 # extended LDIF # # LDAPv3 # base <cn=config> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 32 No such object # numResponses: 1 So why am i even able to logon and state a query? Regards,

3 3

AW: OLC permissions - general beginner question
by Stefan Bauer 03 Jun '15

03 Jun '15

-----Ursprüngliche Nachricht----- Von: Ferenc Wagner <wferi(a)niif.hu> > You do not "logon", you use external authentication, which means there's > no separate BIND step, like with simple bind (-x) for example. External > authenication is not done by slapd (hence its name; it's done by the > kernel in the above case), thus slapd can't fail it. The only LDAP > operation it sees is a search, and the authenticated DN > (gidNumber=X+uidNumber=Y,...) is not authorized for that, so the result > is "No such object". As ACLs belong to target objects, they are not > suitable for forcing server disconnection as soon as the authenticated > DN is known. Maybe LDAP doesn't even allow such behaviour. Hi, thank you for clarification. Stefan

1 0

Next Release of LMDB
by Vishesh Handa 03 Jun '15

03 Jun '15

Hey guys Is there some kind of rough timeline for when the next version of LMDB will be released? We're using it in KDE and we need the patch for robust mutexes, which is currently in git. I'm not too comfortable in asking all the distributions to have that patch, though opensuse already does that. -- Vishesh Handa

2 2

deleting pwdPolicySubentry attribute
by David Magda 03 Jun '15

03 Jun '15

Hello, "pwdPolicySubentry" is an operational attribute per slapo-ppolicy(5). I was able to add it quite easily, but I can't seem to delete it so an account goes back to using the default policy: $ ldapsearch -H ldap://master -W -D 'cn=admin,dc=example,dc=com' -b 'dc=example,dc=com' '(uid=dmagda)' + Enter LDAP Password: # dmagda, People, example.com dn: uid=dmagda,ou=People,dc=example,dc=com structuralObjectClass: inetOrgPerson entryUUID: 1b0d0b6c-1115-1030-8396-1ba5239e5e7d creatorsName: cn=admin,dc=example,dc=com createTimestamp: 20110512185510Z pwdPolicySubentry: cn=service,ou=pwpolicies,dc=example,dc=com entryCSN: 20150602173051.854144Z#000000#000#000000 modifiersName: cn=admin,dc=example,dc=com modifyTimestamp: 20150602173051Z entryDN: uid=dmagda,ou=People,dc=example,dc=com subschemaSubentry: cn=Subschema hasSubordinates: FALSE $ cat del.ldif dn: uid=dmagda,ou=People,dc=example,dc=com changetype: modify delete: pwdPolicySubentry $ ldapsearch -H ldap://master -W -D 'cn=admin,dc=example,dc=com' -f del.ldif Enter LDAP Password: [...] # search result search: 2 result: 32 No such object Given that I could add the attribute, was thought that it could be deleted as well. Thanks for any info. Regards, David

2 2

Where to find attribute description for dn in core.schema
by Stefan Bauer 02 Jun '15

02 Jun '15

Dear Users, I'm trying to understand the LDIF format and wonder in which schema file the attribute 'dn' is defined? I can only find the long form distinguishedName in core.schema. This is the example I'm using for research: dn: dc=structure-net, dc=de objectclass: organization objectclass: top o: Structure Net l: Hamburg postalcode: 21033 streetaddress: Billwiese 22 Any help is greatly appreciated. Regards, Stefan

3 3

Re: read openldap log file
by Luo, Frank 02 Jun '15

02 Jun '15

Can anybody give me a hint about the lines with a "r" in the end? I see a lot of them now. Thanks! Frank Jun 1 09:40:27 slapd[4049]: daemon: epoll: listen=7 active_threads=0 tvp=zero Jun 1 09:40:27 slapd[4049]: daemon: removing 62 Jun 1 09:40:27 slapd[4049]: daemon: activity on 125 descriptors Jun 1 09:40:27 slapd[4049]: daemon: activity on: Jun 1 09:40:27 slapd[4049]: 115r Jun 1 09:40:27 slapd[4049]: conn=274354 fd=62 closed Jun 1 09:40:27 slapd[4049]: 162r Jun 1 09:40:27 slapd[4049]: 148r Jun 1 09:40:27 slapd[4049]: 196r Jun 1 09:40:27 slapd[4049]: 86r Jun 1 09:40:27 slapd[4049]: 201r Jun 1 09:40:27 slapd[4049]: 241r Jun 1 09:40:27 slapd[4049]: 316r Jun 1 09:40:27 slapd[4049]: 143r Jun 1 09:40:27 slapd[4049]: 320r On Mon, Jun 1, 2015 at 10:12 AM, Luo, Frank <luoy(a)miamioh.edu> wrote: > Can anybody give me a hint about the lines with a "r" in the end? I see a > lot of them now. > > Thanks! > > Frank > > > Jun 1 09:40:27 slapd[4049]: daemon: epoll: listen=7 active_threads=0 > tvp=zero > Jun 1 09:40:27 slapd[4049]: daemon: removing 62 > Jun 1 09:40:27 slapd[4049]: daemon: activity on 125 descriptors > Jun 1 09:40:27 slapd[4049]: daemon: activity on: > Jun 1 09:40:27 slapd[4049]: 115r > Jun 1 09:40:27 slapd[4049]: conn=274354 fd=62 closed > Jun 1 09:40:27 slapd[4049]: 162r > Jun 1 09:40:27 slapd[4049]: 148r > Jun 1 09:40:27 slapd[4049]: 196r > Jun 1 09:40:27 slapd[4049]: 86r > Jun 1 09:40:27 slapd[4049]: 201r > Jun 1 09:40:27 slapd[4049]: 241r > Jun 1 09:40:27 slapd[4049]: 316r > Jun 1 09:40:27 slapd[4049]: 143r > Jun 1 09:40:27 slapd[4049]: 320r > > >

2 1

slapadd 4096-character LDIF line length limitation
by Kartik Subbarao 01 Jun '15

01 Jun '15

I wanted to ask if someone could shed some light on the 4096 character LDIF line length limitation, which seems to have been introduced sometime after 2.4.25. I learned about this the hard way, while trying to slapadd an LDIF file with long jpegPhoto attributes (e.g. 50K+) which loaded just fine on 2.4.25. Now, I get this error: ldif_parse_line: jpegPhoto: invalid base64 encoding char (556b9f15 <= str2entry: str2ad(....) slapadd: could not parse entry (line=14) When I need to preprocess LDIF files before loading them with slapadd, I often remove line continuations in order to simplify pattern matching. So of course from my perspective, it would be great to have the previous behavior back again. But if there are compelling reasons for the current behavior, I'd like to suggest that the code print a better error message that explicitly mentions the line length limit. Regards, -Kartik

2 2

nss_ldap: failed to bind to LDAP ser
by Gokan Atmaca 01 Jun '15

01 Jun '15

I installed OpenLDAP. "ldapsearch -x" comes with everything. However, I get an error when I try to connect to the client as follows: Ldapcliet: (/var/log/auth.log) 02:49:58 debian8 nscd: nss_ldap: reconnecting to LDAP server (sleeping 1 seconds)... May 31 02:49:59 debian8 nscd: nss_ldap: could not connect to any LDAP server as (null) - Can't contact LDAP server May 31 02:49:59 debian8 nscd: nss_ldap: failed to bind to LDAP server ldapi://ldap01.gokan.local: Can't contact LDAP server May 31 02:49:59 debian8 nscd: nss_ldap: could not search LDAP server - Server is unavailable ====================== Ldapserver; # ldapsearch -x # extended LDIF # # LDAPv3 # base <dc=gokan,dc=local> (default) with scope subtree # filter: (objectclass=*) # requesting: ALL # # gokan.local dn: dc=gokan,dc=local objectClass: top objectClass: dcObject objectClass: organization o: gokan dc: gokan # admin, gokan.local dn: cn=admin,dc=gokan,dc=local objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator # IT, gokan.local dn: ou=IT,dc=gokan,dc=local objectClass: organizationalUnit objectClass: top ou: IT # Genel, IT, gokan.local dn: cn=Genel,ou=IT,dc=gokan,dc=local gidNumber: 500 cn: Genel objectClass: posixGroup objectClass: top # Gokhan Atmaca, Genel, IT, gokan.local dn: cn=Gokhan Atmaca,cn=Genel,ou=IT,dc=gokan,dc=local cn: Gokhan Atmaca givenName: Gokhan gidNumber: 500 homeDirectory: /home/users/gokhana sn: Atmaca loginShell: /bin/sh objectClass: inetOrgPerson objectClass: posixAccount objectClass: top uidNumber: 1000 uid: gokhana # search result search: 2 result: 0 Success # numResponses: 7 # numEntries: 6 ====================== Listening to the socket. tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 4409/slapd tcp6 0 0 :::389 :::* LISTEN 4409/slapd What could be the problem?

2 1

LDAP schema issue
by Leander Schäfer 01 Jun '15

01 Jun '15

Hi This is the current relevant part of my schema: attributetype ( objectClassAccount:1.1 NAME 'mailAddress' DESC 'The hosted mail addresses' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} SINGLE-VALUE ) 1. How can I achieve, that upper case will always and only be stored as lower case? 2. How do I achieve a validation check whether the value is actually a valid email addres - very simple: user(a)domain.tld? Thanks & Best regards Leander

3 2

Create Mailing List
by Jerry 01 Jun '15

01 Jun '15

Is it possible to create a "mailing list" in openldap? My MUA allows me to create an alias like "MyGroup" that would then contain all the email addresses of the people in the group. I can then simply type that alias and it is replaced by the actual email addresses. I am looking for something like that in openldap. I realize that I can associate multiple email addresses to a single name; however, only one address can be chosen at a time. -- Jerry

4 3

filling up, flushing and inserting again sometimes fails
by Dominik Taborsky 29 May '15

29 May '15

Hello, I'm playing around with LMDB and I'd like to know more about how it deletes items and reclaims space. I've been having some problems with this lately. For simplicity I'm testing smaller 20MiB DBs with data values of sizes from 40B to 4000B. The test checks all kinds of stuff, but mainly tries to do a few fillups and flushes in short sequence. The first cycle slowly increases the size of the data until the DB is full, then it flushes. Then 10 cycles of fillup-flush of static-sized data follow. For flushing I've been doing both mdb_drop and removing batches of stored data. I've tried batches of sizes between 2 and 100 items. The results differ very much, depending on all these parameters: (only the 10 equal cycles counted): batch:2, data size: 40B first three runs pass, 7 fail batch:50, data size: 40B first three runs pass, 7 fail batch:100, data size: 40B first three runs pass, 7 fail mdb_drop, data size: 40B first run only passes, all other 9 fail batch:20, data size: 400B all runs pass batch:100, data size: 400B all runs pass mdb_drop, data size: 400B all runs pass batch:2, data size: 4000B all runs pass batch:50, data size: 4000B first run only passes, all other 9 fail batch:100, data size: 4000B first run only passes, all other 9 fail mdb_drop, data size: 4000B all odd runs pass, all even runs fail Note: I've implemented a simple protection from hitting MDB_MAP_FULL by some arithmetic over fields in MDB_stat and MDB_envinfo structures. The protection reserves at least 32 pages - every insert checks whether it would violate this reservation and if so returns with an error. I've read through a previous thread[1] which was similar in its nature. From that I gathered I need 3 cleanup commits to reclaim all that space. This would explain why the 4000-byte runs succeeded only when flushing using batches of 2 (about 40 4KB-sized items fit into the DB). But it doesn't explain the 40-byte runs which should all succeed apart from the mdb_drop version. And I have no idea why mdb_drop works well in the 400-byte-sized case. Can anybody shed some light into this for me, please? What can I do about it? I need to provide some guarantee the DB will stay functional after fillup. Thanks, Dominik [1] http://www.openldap.org/lists/openldap-technical/201306/msg00116.html

1 1

H350
by Charles Hindmarsh 28 May '15

28 May '15

Good afternoon I'm new to the Open LDAP software, but I have configured it on a windows server and all looks good. I now need to add a h350 schema to the installation and wondered if anyone had come across or developed a h350 schema file. I did try and follow some instructions found here : http://www.manualslib.com/manual/666642/Tandberg-Vcs.html?page=182 however the process failed under the first instruction : dn: commUniqueld=LeedsMeetingroom1, ou=h350, dc=TTGROUP, dc=com I am able to add other user objects etc, so the LDAP service is working. I am guessing that the dn "commUniqueld" value is misunderstood by openLdap and therefore fails. Any help would be greatly appreciated. Charles Hindmarsh Turner & Townsend Turner & Townsend plc Queen’s Award for Enterprise: International Trade 2014 Construction Consultant of the Year | Building Awards 2014, 2013 Global Consultant of the Year | NCE/ACE Consultants of the Year 2013 Outstanding International Business | British Expertise International Awards 2013 For further information and registration details visit our website http://www.turnerandtownsend.com This email and any attachments (“the email”) is confidential and may also be privileged, is subject to copyright and may be read, copied and used only by the intended recipient. The recipient is responsible for virus checking this email. If you are not the intended recipient please immediately notify us, delete and do not use, disclose, distribute, copy, print or rely on this email or any part of it. Turner & Townsend does not accept any liability for any loss or damage from your receipt or use of this email. Please consider the environment before printing this email.

4 5

hiding a naming context
by Craig White 26 May '15

26 May '15

Back with a further clarification and trying to solve a problem for our programmers. ldapsearch -x -H ldapi:/// -s base -b '' namingContext "*" + -D $ROOTDN -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <> with scope baseObject # filter: (objectclass=*) # requesting: namingContext * + # # dn: objectClass: top objectClass: OpenLDAProotDSE structuralObjectClass: OpenLDAProotDSE configContext: cn=config namingContexts: cn=accesslog namingContexts: dc=example,dc=com monitorContext: cn=Monitor supportedControl: 1.3.6.1.4.1.4203.1.9.1.1 supportedControl: 2.16.840.1.113730.3.4.18 supportedControl: 2.16.840.1.113730.3.4.2 supportedControl: 1.3.6.1.4.1.4203.1.10.1 supportedControl: 1.2.840.113556.1.4.319 supportedControl: 1.2.826.0.1.3344810.2.3 supportedControl: 1.3.6.1.1.13.2 supportedControl: 1.3.6.1.1.13.1 supportedControl: 1.3.6.1.1.12 supportedExtension: 1.3.6.1.4.1.1466.20037 supportedExtension: 1.3.6.1.4.1.4203.1.11.1 supportedExtension: 1.3.6.1.4.1.4203.1.11.3 supportedExtension: 1.3.6.1.1.8 supportedFeatures: 1.3.6.1.1.14 supportedFeatures: 1.3.6.1.4.1.4203.1.5.1 supportedFeatures: 1.3.6.1.4.1.4203.1.5.2 supportedFeatures: 1.3.6.1.4.1.4203.1.5.3 supportedFeatures: 1.3.6.1.4.1.4203.1.5.4 supportedFeatures: 1.3.6.1.4.1.4203.1.5.5 supportedLDAPVersion: 3 supportedSASLMechanisms: GSSAPI supportedSASLMechanisms: PLAIN supportedSASLMechanisms: LOGIN supportedSASLMechanisms: EXTERNAL entryDN: subschemaSubentry: cn=Subschema # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 So our programmers want me to filter out 'namingContexts: cn=accesslog' for them (please don't ask). # cat naming_context.ldif dn: olcDatabase={-1}frontend,cn=config changetype: modify add: olcAccess olcAccess: {0}to dn.exact="" attrs=namingContext val/distinguishedNameMatch="cn=accesslog transitional" by * none ldapmodify -H ldapi:/// -Y EXTERNAL -f naming_context.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "olcDatabase={-1}frontend,cn=config" ldap_modify: Other (e.g., implementation specific) error (80) additional info: <olcAccess> handler exited with 1 Anyone want to hit me with a clue stick so I can hide the 'cn=accesslog' database from my programmers so they don't have to rewrite code?

4 9

How to check the login history of users on openldap
by Peng Yu 25 May '15

25 May '15

Hi, I setup ubuntu servers to use an openldap for login authentication. I want to check who have logged in all the servers. A logic place to check is at the central openldap server. But I am not sure how to do. Could any of you let me know? -- Regards, Peng

3 5

How to add a user with root permission?
by Peng Yu 25 May '15

25 May '15

Hi, I using openldap to manage users of a number of ubnutu servers. But I don't find a way to give users root permission on these servers? Could anybody show me how to do this with openldap? Thanks. -- Regards, Peng

2 2

rfc2252 big integer
by Raffael Sahli 21 May '15

21 May '15

Hi Which syntax should I use if 1.3.6.1.4.1.1466.115.121.1.27 is not big enough? 1.3.6.1.4.1.1466.115.121.1.36? (I don't see a kind of big integer) Thanks -- Raffael Sahli

2 1

openldap: 3+ multi datacentre replication
by hab 20 May '15

20 May '15

Could you share any experience setting-up/expanding (large) ldap server to multi data centres(DC)? What strategy do you use - mesh or ring topology? Looking for examples where 3+ DCs with failover(master/master or master/slave) ldap setup in each DC. Is ring topology better than mesh as ldap has to only deal with less connections? Would be nice if you can mention any scaling issues?

2 1

Re: RE24 testing call (2.4.41)
by Jephte Clain 19 May '15

19 May '15

hello, it builds fine on debian squeeze LTS 64bits, and the tests are ok FYI, configure was run with the debian defaults: ./configure --prefix=/usr --libexecdir='${prefix}/lib' --sysconfdir=/etc --localstatedir=/var --mandir='${prefix}/share/man' --enable-debug --enable-dynamic --enable-syslog --enable-proctitle --enable-ipv6 --enable-local --enable-slapd --enable-dynacl --enable-aci --enable-cleartext --enable-crypt --disable-lmpasswd --enable-spasswd --enable-modules --enable-rewrite --enable-rlookups --enable-slapi --enable-slp --enable-wrappers --enable-backends=mod --disable-ndb --enable-overlays=mod --with-subdir=ldap --with-cyrus-sasl --with-threads --with-tls=openssl --with-odbc=unixodbc regards, 2015-05-01 0:21 GMT+04:00 Quanah Gibson-Mount <quanah(a)zimbra.com>: > If you know how to build OpenLDAP manually, and would like to participate in > testing the next set of code for the 2.4.41 release, please do so. > > Generally, get the code for RE24: > > <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> > > Configure & build. > > Execute the test suite (via make test) after it is built. > > Thanks! > > --Quanah > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Jephté CLAIN | Développeur, Intégrateur d'applications Service Système d'Information Direction des Systèmes d'Information Tél: +262 262 93 86 31 || Gsm: +262 692 29 58 24

1 0

syncrepl and memberof do not work well together
by John Alex. 19 May '15

19 May '15

I am not sure if this is by design or a bug so I am posting here first. I have a provider-consumer configuration (both at version 2.4.40) where the consumer uses simple syncrepl (no delta sync). I am using the memberof overlay in the provider, and, having read the slapo-memberof manpage and ITS#7400, I made sure to exclude "memberof" from the synced attributes, and configured the memberof overlay in the consumer too. When I add or remove a user from a group, the user entry is correctly updated in both provider and consumer with the addition or removal of the corresponding "memberof" value. The problem occurs when a user entry is modified in any way, e.g. by changing a password, adding a description, etc. From what I understand, when a change occurs in an entry, non-delta syncrepl causes the entire entry to be resynced, not just the modified attributes. The result is that the "memberof" attributes of this entry on the consumer are removed. Is this the intended behavior? Shouldn't the "memberOf" values be restored after the entry is updated, since no group membership was modified?

2 4

debugging
by Craig White 19 May '15

19 May '15

Trying to figure out if this search is being denied. I wouldn't think so but the last 3 lines at the end suggest otherwise. 5552876b conn=1000 fd=21 ACCEPT from IP=172.29.34.47:42310 (IP=0.0.0.0:389) 5552876b conn=1000 op=0 BIND dn="uid=an_admin,ou=People,dc=doesn't_matter,dc=com" method=128 5552876b => bdb_entry_get: found entry: "uid=an_admin,ou=people,dc=doesn't_matter,dc=com" 5552876b => bdb_entry_get: found entry: "cn=defaultpp,ou=policies,dc=doesn't_matter,dc=com" 5552876b => access_allowed: result not in cache (userPassword) 5552876b => access_allowed: auth access to "uid=an_admin,ou=People,dc=doesn't_matter,dc=com" "userPassword" requested 5552876b => acl_get: [1] attr userPassword 5552876b => acl_mask: access to entry "uid=an_admin,ou=People,dc=doesn't_matter,dc=com", attr "userPassword" requested 5552876b => acl_mask: to value by "", (=0) 5552876b <= check a_dn_pat: self 5552876b <= check a_dn_pat: anonymous 5552876b <= acl_mask: [2] applying auth(=xd) (stop) 5552876b <= acl_mask: [2] mask: auth(=xd) 5552876b => slap_access_allowed: auth access granted by auth(=xd) 5552876b => access_allowed: auth access granted by auth(=xd) 5552876b conn=1000 op=0 BIND dn="uid=an_admin,ou=People,dc=doesn't_matter,dc=com" mech=SIMPLE ssf=0 5552876b => bdb_entry_get: found entry: "uid=an_admin,ou=people,dc=doesn't_matter,dc=com" 5552876b conn=1000 op=0 RESULT tag=97 err=0 text= 5552876b conn=1000 op=1 BIND anonymous mech=implicit ssf=0 5552876b conn=1000 op=1 BIND dn="uid=an_admin,ou=People,dc=doesn't_matter,dc=com" method=128 5552876b => bdb_entry_get: found entry: "uid=an_admin,ou=people,dc=doesn't_matter,dc=com" 5552876b => bdb_entry_get: found entry: "cn=defaultpp,ou=policies,dc=doesn't_matter,dc=com" 5552876b => access_allowed: result not in cache (userPassword) 5552876b => access_allowed: auth access to "uid=an_admin,ou=People,dc=doesn't_matter,dc=com" "userPassword" requested 5552876b => acl_get: [1] attr userPassword 5552876b => acl_mask: access to entry "uid=an_admin,ou=People,dc=doesn't_matter,dc=com", attr "userPassword" requested 5552876b => acl_mask: to value by "", (=0) 5552876b <= check a_dn_pat: self 5552876b <= check a_dn_pat: anonymous 5552876b <= acl_mask: [2] applying auth(=xd) (stop) 5552876b <= acl_mask: [2] mask: auth(=xd) 5552876b => slap_access_allowed: auth access granted by auth(=xd) 5552876b => access_allowed: auth access granted by auth(=xd) 5552876b conn=1000 op=1 BIND dn="uid=an_admin,ou=People,dc=doesn't_matter,dc=com" mech=SIMPLE ssf=0 5552876b => bdb_entry_get: found entry: "uid=an_admin,ou=people,dc=doesn't_matter,dc=com" 5552876b conn=1000 op=1 RESULT tag=97 err=0 text= 5552876b begin get_filter 5552876b PRESENT 5552876b end get_filter 0 5552876b conn=1000 op=2 SRCH base="" scope=0 deref=0 filter="(objectClass=*)" 5552876b conn=1000 op=2 SRCH attr=* + altServer changelog firstChangeNumber lastChangeNumber lastPurgedChangeNumber namingContexts subschemaSubentry supportedAuthPasswordSchemes supportedControl supportedExtension supportedFeatures supportedLDAPVersion supportedSASLMechanisms vendorName vendorVersion 5552876b => test_filter 5552876b PRESENT 5552876b => access_allowed: search access to "" "objectClass" requested 5552876b => slap_access_allowed: backend default search access granted to "uid=an_admin,ou=People,dc=doesn't_matter,dc=com" 5552876b => access_allowed: search access granted by read(=rscxd) 5552876b <= test_filter 6 5552876b => access_allowed: read access to "" "entry" requested 5552876b => slap_access_allowed: backend default read access granted to "uid=an_admin,ou=People,dc=doesn't_matter,dc=com" 5552876b => access_allowed: read access granted by read(=rscxd) 5552876b => access_allowed: result not in cache (objectClass) 5552876b => access_allowed: read access to "" "objectClass" requested 5552876b => slap_access_allowed: backend default read access granted to "uid=an_admin,ou=People,dc=doesn't_matter,dc=com" 5552876b => access_allowed: read access granted by read(=rscxd) 5552876b => access_allowed: result was in cache (objectClass) 5552876b => access_allowed: result not in cache (structuralObjectClass) 5552876b => access_allowed: read access to "" "structuralObjectClass" requested 5552876b => slap_access_allowed: backend default read access granted to "uid=an_admin,ou=People,dc=doesn't_matter,dc=com" 5552876b => access_allowed: read access granted by read(=rscxd) 5552876b => access_allowed: result not in cache (configContext) 5552876b => access_allowed: read access to "" "configContext" requested 5552876b => slap_access_allowed: backend default read access granted to "uid=an_admin,ou=People,dc=doesn't_matter,dc=com" 5552876b => access_allowed: read access granted by read(=rscxd) 5552876b => access_allowed: result not in cache (namingContexts) 5552876b => access_allowed: read access to "" "namingContexts" requested 5552876b => slap_access_allowed: backend default read access granted to "uid=an_admin,ou=People,dc=doesn't_matter,dc=com" 5552876b => access_allowed: read access granted by read(=rscxd) 5552876b => access_allowed: result was in cache (namingContexts) 5552876b => access_allowed: result not in cache (monitorContext) 5552876b => access_allowed: read access to "" "monitorContext" requested 5552876b => slap_access_allowed: backend default read access granted to "uid=an_admin,ou=People,dc=doesn't_matter,dc=com" 5552876b => access_allowed: read access granted by read(=rscxd) 5552876b => access_allowed: result not in cache (supportedControl) 5552876b => access_allowed: read access to "" "supportedControl" requested 5552876b => slap_access_allowed: backend default read access granted to "uid=an_admin,ou=People,dc=doesn't_matter,dc=com" 5552876b => access_allowed: read access granted by read(=rscxd) 5552876b => access_allowed: result was in cache (supportedControl) 5552876b => access_allowed: result was in cache (supportedControl) 5552876b => access_allowed: result was in cache (supportedControl) 5552876b => access_allowed: result was in cache (supportedControl) 5552876b => access_allowed: result was in cache (supportedControl) 5552876b => access_allowed: result was in cache (supportedControl) 5552876b => access_allowed: result was in cache (supportedControl) 5552876b => access_allowed: result was in cache (supportedControl) 5552876b => access_allowed: result not in cache (supportedExtension) 5552876b => access_allowed: read access to "" "supportedExtension" requested 5552876b => slap_access_allowed: backend default read access granted to "uid=an_admin,ou=People,dc=doesn't_matter,dc=com" 5552876b => access_allowed: read access granted by read(=rscxd) 5552876b => access_allowed: result was in cache (supportedExtension) 5552876b => access_allowed: result was in cache (supportedExtension) 5552876b => access_allowed: result was in cache (supportedExtension) 5552876b => access_allowed: result not in cache (supportedFeatures) 5552876b => access_allowed: read access to "" "supportedFeatures" requested 5552876b => slap_access_allowed: backend default read access granted to "uid=an_admin,ou=People,dc=doesn't_matter,dc=com" 5552876b => access_allowed: read access granted by read(=rscxd) 5552876b => access_allowed: result was in cache (supportedFeatures) 5552876b => access_allowed: result was in cache (supportedFeatures) 5552876b => access_allowed: result was in cache (supportedFeatures) 5552876b => access_allowed: result was in cache (supportedFeatures) 5552876b => access_allowed: result was in cache (supportedFeatures) 5552876b => access_allowed: result not in cache (supportedLDAPVersion) 5552876b => access_allowed: read access to "" "supportedLDAPVersion" requested 5552876b => slap_access_allowed: backend default read access granted to "uid=an_admin,ou=People,dc=doesn't_matter,dc=com" 5552876b => access_allowed: read access granted by read(=rscxd) 5552876b => access_allowed: result not in cache (supportedSASLMechanisms) 5552876b => access_allowed: read access to "" "supportedSASLMechanisms" requested 5552876b => slap_access_allowed: backend default read access granted to "uid=an_admin,ou=People,dc=doesn't_matter,dc=com" 5552876b => access_allowed: read access granted by read(=rscxd) 5552876b => access_allowed: result not in cache (entryDN) 5552876b => access_allowed: read access to "" "entryDN" requested 5552876b => slap_access_allowed: backend default read access granted to "uid=an_admin,ou=People,dc=doesn't_matter,dc=com" 5552876b => access_allowed: read access granted by read(=rscxd) 5552876b => access_allowed: result was in cache (entryDN) 5552876b => access_allowed: result not in cache (subschemaSubentry) 5552876b => access_allowed: read access to "" "subschemaSubentry" requested 5552876b => slap_access_allowed: backend default read access granted to "uid=an_admin,ou=People,dc=doesn't_matter,dc=com" 5552876b => access_allowed: read access granted by read(=rscxd) 5552876b => access_allowed: result was in cache (subschemaSubentry) 5552876b conn=1000 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text= 5552876b begin get_filter 5552876b EQUALITY 5552876b end get_filter 0 5552876b conn=1000 op=3 SRCH base="cn=accesslog" scope=2 deref=0 filter="(uid=global.admin)" 5552876b => access_allowed: search access to "cn=accesslog" "entry" requested 5552876b => acl_get: [1] attr entry 5552876b => acl_mask: access to entry "cn=accesslog", attr "entry" requested 5552876b => acl_mask: to all values by "uid=an_admin,ou=people,dc=doesn't_matter,dc=com", (=0) 5552876b <= check a_dn_pat: cn=admin,dc=doesn't_matter,dc=com 5552876b <= check a_dn_pat: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth 5552876b <= acl_mask: no more <who> clauses, returning =0 (stop) 5552876b => slap_access_allowed: search access denied by =0 5552876b => access_allowed: no more rules 5552876b conn=1000 op=3 SEARCH RESULT tag=101 err=32 nentries=0 text= So the application is a java application and the developers haven't a clue on how to debug the java ldap side. I am not sure why it's looking at accesslog in the context of this connection, and it shouldn't have access to accesslog but it shouldn't matter anyway, accesslog is database{1} and the actual suffix to be searched is database{3} User uid=an_admin,ou=People,dc=doesn't_matter,dc=com is pretty much allowed to do anything in the suffixed database {dc=doesn't_matter,dc=com} My contention is that there isn't an error here but the application isn't happy with the new setup and as I said, they are not knowledgeable about how to debug from the java side. Does this log indicate an error? (I know err=32 is no such object) Craig

4 7

search in ldap from java is getting stuck
by PRATIK SINGAL 18 May '15

18 May '15

Hi can anyone help me with java code which will return all the number of data present in the object class. Currently search gets stuck when there are more than 3 lakh of data in the object class. The java thread becomes dead i guess. Regards, Pratik

1 0

ACL sanity check
by Brendan Kearney 17 May '15

17 May '15

i am looking to improve my access controls, and wanted to make sure the below passes muster and sanely implements what i am looking for. 0 - ldap admins get access to the entire directory {0}to dn.subtree="dc=bpk2,dc=com" by group.exact="cn=ldapAdmins,ou=domainGroups,ou=Groups,dc=bpk2,dc=com" manage by anonymous auth by * none 1 - kerberos id get only the access they need {1}to dn.subtree="cn=BPK2.COM,dc=bpk2,dc=com" by dn="cn=kadmin,dc=bpk2,dc=com" write by dn="cn=kdc,dc=bpk2,dc=com" read by * none 2 - dns engineers, admins and dns process accounts get access {2}to dn.subtree="cn=dns,ou=Daemons,dc=bpk2,dc=com" by group.exact="cn=dnsEngineers,ou=domainGroups,ou=Groups,dc=bpk2,dc=com" manage by group.exact="cn=dnsAdmins,ou=domainGroups,ou=Groups,dc=bpk2,dc=com" write by group.exact="cn=dnsProcesses,ou=processGroups,ou=Groups,dc=bpk2,dc=com" write by * none 3 - dhcp engineers, admins and dhcp process accounts get access {3}to dn.subtree="cn=DHCP Config,ou=Daemons,dc=bpk2,dc=com" by group.exact="cn=dhcpEngineers,ou=domainGroups,ou=Groups,dc=bpk2,dc=com" manage by group.exact="cn=dhcpAdmins,ou=domainGroups,ou=Groups,dc=bpk2,dc=com" write by group.exact="cn=dhcpProcesses,ou=processGroups,ou=Groups,dc=bpk2,dc=com" read by * none 4 - dhcp engineers, admins and dhcp process accounts get access {4}to dn.subtree="cn=DHCP Servers,ou=Daemons,dc=bpk2,dc=com" by group.exact="cn=dhcpEngineers,ou=domainGroups,ou=Groups,dc=bpk2,dc=com" manage by group.exact="cn=dhcpAdmins,ou=domainGroups,ou=Groups,dc=bpk2,dc=com" write by group.exact="cn=dhcpProcesses,ou=processGroups,ou=Groups,dc=bpk2,dc=com" read by * none 5 - users can read this ou {5}to dn.subtree="ou=Computers,dc=bpk2,dc=com" by users read by * none 6 - users can read this ou {6}to dn.subtree="ou=Groups,dc=bpk2,dc=com" by users read by * none 7 - users can read this ou {7}to dn.subtree="ou=Networks,dc=bpk2,dc=com" by users read by * none 8 - users can read this ou {8}to dn.subtree="ou=Users,dc=bpk2,dc=com" by users read by * none are there any specific ACLs that i should have? are there any glaring issues with the above proposed ACLs?

3 2

Openldap password problems
by jeevan kc 17 May '15

17 May '15

Hello all,We've just noticed that when a user authenticates via LDAP, it ignores characters after the right password. For example a user jkc900 has Password Welcome1 But the user can type in Welcome1111 or Welcome12 etc and still can get into the application. Its just checking the first Welcome1 and they can type anything after that and still can log in. We've tested at least 50 users and they all have the same issues. Any clues/ solution for this? Your inputs are highly appreciated. Jeevan

8 19

How to add index for particular attribute in openldap 2.4.40
by PRATIK SINGAL 16 May '15

16 May '15

Hi Can anyone help me on how to add index for entire object class and as well as for the particular attribute of objectclass . Here am using berkerly DB(bdb).

2 1

OpenLDAP - 2.4.39 , 2-way multimaster replication freezes
by shashidhar v 16 May '15

16 May '15

Hi , I am trying to configure and use the openldap 2-WAY Multimaster Replication setup for high availability(HA), but the HA solution used to freeze very often. Using ansible tool I have automated the installation and configuration steps. I tried with manual steps too before using the ansible for the actual deployment Following are the env. details used for installation and configuration Two nodes ldap-test1 and ldap-test2 are running with base OS RHEL7 LDAP rpms installed: openldap-clients-2.4.39-6.el7.x86_64 openldap-servers-2.4.39-6.el7.x86_64 openldap-2.4.39-6.el7.x86_64 Configuration steps: 1. Added the nis, cosine schemas ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f cosine.ldif ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f nis.ldif 2. Send the new global configuration settings to slapd 'ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/global_config.ldif # cat global_config.ldif dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModuleLoad: syncprov dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcSuffix olcSuffix: dc=example,dc=com dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcRootDN olcRootDN: cn=Manager,dc=example,dc=com dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcRootPW olcRootPW: {SSHA}vAp3OToPGMYnWEkh+76RJEVyfCIdnsDg dn: cn=config changetype: modify replace: olcTLSCACertificateFile olcTLSCACertificateFile: /etc/openldap/certs/cacert.pem dn: cn=config changetype: modify replace: olcTLSCertificateFile olcTLSCertificateFile: /etc/openldap/certs/slapdcert.pem dn: cn=config changetype: modify replace: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/openldap/certs/slapdkey.pem dn: cn=config changetype: modify replace: olcLogLevel olcLogLevel: -1 dn: olcDatabase={1}monitor,cn=config changetype: modify replace: olcAccess olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=Manager,dc=example,dc=com" read by * none dn: cn=config changeType: modify add: olcServerID olcServerID: 1 dn: olcDatabase={0}config,cn=config changetype: modify add: olcRootDN olcRootDN: cn=admin,cn=config dn: cn=config changetype: modify dn: olcDatabase={0}config,cn=config changetype: modify replace: olcRootPW olcRootPW: {SSHA}vAp3OToPGMYnWEkh+76RJEVyfCIdnsDg dn: cn=config changetype: modify replace: olcServerID olcServerID: 1 ldaps://ldap-test1 olcServerID: 2 ldaps://ldap-test2 3. Load base.ldif ldapadd -x -w redhat7 -D cn=Manager,dc=example,dc=com -f /etc/openldap/base.ldif # cat base.ldif dn: dc=example,dc=com dc: example objectClass: top objectClass: domain dn: ou=People,dc=example,dc=com ou: People objectClass: top objectClass: organizationalUnit dn: ou=Group,dc=example,dc=com ou: Group objectClass: top objectClass: organizationalUnit 4. Load hdb_config.ldif ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/hdb_config.ldif #cat hdb_config.ldif dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcSuffix olcSuffix: dc=example,dc=com dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcRootDN olcRootDN: cn=Manager,dc=example,dc=com dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcRootPW olcRootPW: {{ ldap_root_password.stdout }} dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcDbIndex olcDbIndex: entryCSN eq olcDbIndex: entryUUID eq 5. Load replication.ldif ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/replication.ldif cat replication.ldif dn: olcOverlay=syncprov,olcDatabase={2}hdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcSyncRepl olcSyncRepl: rid=101 provider=ldaps://ldap-test1 binddn="cn=Manager,dc=example,dc=com" bindmethod=simple credentials=redhat7 searchbase="dc=example,dc=com" type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcSyncRepl: rid=102 provider=ldaps://ldap-test2 binddn="cn=Manager,dc=example,dc=com" bindmethod=simple credentials=redhat7 searchbase="dc=example,dc=com" type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 5" timeout=1 - replace: olcMirrorMode olcMirrorMode: TRUE dn: olcDatabase={0}config,cn=config changetype: modify replace: olcSyncRepl olcSyncRepl: rid=101 provider=ldaps://ldap-test1 binddn="cn=admin,cn=config" bindmethod=simple credentials=redhat7 searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncRepl: rid=102 provider=ldaps://ldap-test2 binddn="cn=admin,cn=config" bindmethod=simple credentials=redhat7 searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 - replace: olcMirrorMode olcMirrorMode: TRUE Above configuration steps 1 to 4 are executed parallely on both nodes , only step 5 ie. replication.ldif was executed serially one node after the other because parallel execution of step 5 causing the solution to freeze Parallel execution on both nodes : 1. Added the nis, cosine schemas 2. Send the new global configuration settings to slapd 3. Load base.ldif 4. Load hdb_config.ldif , executed on any one of two nodes assuming that content will replicated automatically on other node once the servers are replicated Serial execution : Executed on both nodes one after the other 5. Load replication.ldif Sometimes LDAP replication is causing the solution to freeze and it may hung during the deployment , after deployment or while executing some basic ldap operations like ldapadd/modify/delete etc 1. First thing I would like to know Is there any specific order we need to follow to avoid solution freeze or ldapadd command hung with two nodes configuring parallely ? 2. Anything wrong with the configuration attributes used ? If so what attributes I need to add/update to avoid the command/service hung during configuration or after the deployment ? 3. To verify the high availability I used to stop ldap service any one of the two nodes and send the ldap requests to other node, but sometimes the restart of the service not bringing back the two nodes in Sync. And for replication I am verifying based on number of connections established between two servers ( min. 4 , 2 for config replication and 2 for db replication ) And unittest to verify db replication by creating an ldap user on one node and search & delete operations on the other node. 4. Whenever the basic ldap commands add/modify etc hung on any one node , I used to restart the slapd service on the corresponding node, Is it the right way ? HA solution is working fine by configuring above steps in the given order, ldap services are restarted and in Sync, but sometimes the solution used to freeze when executing basic ldapadd commond on any one node There are no specific error messages in the logs to understand the reason for hung. May 15 22:20:17 ldap-test2 slapd[8538]: daemon: epoll: listen=7 active_threads=0 tvp=zero May 15 22:20:17 ldap-test2 slapd[8538]: daemon: epoll: listen=8 active_threads=0 tvp=zero Always a single restart is also not helping to bring the servers back to sync and available, sometimes the number of tcp connections are 3 instead of required 4 connections [root@ldap-test1 openldap]# netstat -a | grep ldaps tcp 0 0 ldap-test1:ldaps 0.0.0.0:* LISTEN tcp 0 0 ldap-test1:34854 ldap-test2:ldaps ESTABLISHED tcp 0 0 ldap-test1:ldaps ldap-test2:48493 ESTABLISHED tcp 0 0 ldap-test1:34856 ldap-test2:ldaps ESTABLISHED Used to restart couple of times until 4 tcp connections are established and servers are replicated properly 5. Can someone please help me to get rid of this situation ? I didn't find any clue in the archived messages etc for similar kind of problems. Thanks & Regards, Shashi

1 0

Server is unwilling to perform trying to remove an overlay
by Angel L. Mateo 15 May '15

15 May '15

Hello, I have a 2.4.31 openldap server (running in an ubuntu server 14.04) using cn=config for configuration. Now, I'm trying to remove an overlay from my database (ppolicy overlay to be specific) and whenever I run the ldapmodify deleting the entry I get ldap_delete: Server is unwilling to perform (53) I have read in older posts in this list that delete operation is not implemented in cn=config database. Is this still not implemented? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868887590 Fax: 868888337

2 1

openldap 2.4.40 ldapserach limit
by PRATIK SINGAL 15 May '15

15 May '15

Hello can any one help me out where to increase the ldapseach size limit.In 2.4.23 there was no issue when i used to search 100000 records but in 2.4.40 it gives me a error [root@localhost ~]# ldapsearch -x -LLL -b "dc=example,dc=com" -s one "objectclass" | grep ^dn: | wc -l Size limit exceeded (4) 500

2 2

ppolicy and ACL question
by Harmandeep Kaur 14 May '15

14 May '15

Hello folks, I have a quick query, I'm using openldap with ppolicy. I'm using following ACL just to test things right, I came across the issue, for which I'm unable to find appropriate answers: ACL used: --- access to * by * manage --- 1. How to restrict ldappasswd command to clear the pwdReset flag to user's entry ? 2. Can some other users (member of group) can work rootdn (bypass ppolicy like rootdn but it should apply to their account itself) ? 3. Other question is about ACL is "What's the difference between ACL "write" and "manage" access" write =wrscdx needed to modify/rename manage =mwrscdx needed to manage I'm not able to determine what access "manage" gives over and above "write" access. I didn't find much info at openldap.org access-control section. Thank you. Regards,

2 1

Subject: Re: Fast key range iteration
by James Rouzier 13 May '15

13 May '15

Here is a faster to do way to do what you want. Just get the last key of your range and while iterating compare the data pointer of the last key to see if you reach the end instead of the it's content. As long as you are in the same transaction the data pointer of the last key should never change. (Someone correct me if I am wrong). Here is a quick example of what I mean. MDB_cursor *cursor; MDB_val first_key, key, data; MDB_val last_key1, last_key2, last_data; int rc; //Get the last key rc = mdb_cursor_get (cursor, &last_key1, &last_data, MDB_SET_RANGE); //If the current position is not equal move back one spot if (rc == MDB_SUCCESS && mdb_cmp (mdb_cursor_txn (cursor), mdb_cursor_dbi (cursor), &last_key1, &last_key2)) { rc = mdb_cursor_get (cursor, &last_key1, &last_data, MDB_PREV); } //This means that nothing is equal or greater than the last key or the last key is at the first position if (rc) { last_data.mv_data = NULL; } //Get the first key rc = mdb_cursor_get (cursor, &first_key, &data, MDB_SET_RANGE); if(rc == MDB_SUCCESS) { do { } while (mdb_cursor_get (cursor, &key, &data, MDB_NEXT) == MDB_SUCCESS && data.mv_data != last_data.mv_data); } > Hi all! > Is there a way to iterate with all key-value pairs in LMDB database, where all keys is in specified range? > I'm trying to use mdb_cursor_get() with MDB_SET_RANGE to search first pair. > Then I see only one way - use mdb_cursor_get() with MDB_NEXT and compare key by memcmp(). > But it seems absolutely not effective. > > Is there another solution for my task? > > Thanks!

3 3

Re: insert utf-8 data with c api (solved)
by yvan vander sanden 13 May '15

13 May '15

Just found out what was wrong. The code was also propagating the displayName value to gecos. We used gecos as an extra copy of displayName because of one client application which only did work with gecos. The error wasn't noticed before because now for the first time we had a user with an umlaut in his name. We could just remove gecos from the directory altogether because the program in question isn't in use any more. But isn't a gecos value supposed to hold a full name? It being unable to hold an utf8 value seems somehow wrong, no? Regards, yvan -- ==- yvan vander sanden -== * composer, programmer * >>> http://mutecode.com -* MUTE software development* >>> http://attr-x.net - *online interactive soundscape* >>> http://code.google.com/p/yse-soundengine/ - *advanced 3D sound engine* >>> http://youngmusic.org - *personal website* >>> http://www.matrix-new-music.be/componist/vander-sanden-yvan-1972 - *bio @ matrix* <http://youngmusic.org>

2 1

MMR (delta-syncrepl): CPU at 100% after replication
by Liam Gretton 12 May '15

12 May '15

I'm building a new setup with the latest OpenLDAP built from source, using mdb, MMR delta-syncrepl over TLS. I'm using very recent sources, I have two hosts and I'm finding that once the secondary host has synchronised with the first (this takes about 10 minutes for around 40000 entries), slapd on each of the peers remains at close to 100%. Replication is working though. The sync logs at this point on the first system in the set (where the original data was slapadded) is showing the following entries endlessly: 554fbe2c do_syncrep2: rid=002 CSN too old, ignoring 20131221210532.737643Z#000000#001#000000 (reqStart=20150509214300.000163Z,cn=log) contextCSN on both systems looks good. ldap1 is serverID 1, rid 1; ldap2 is serverID 2, rid 2. I guess the SID 0 comes from the original data that was imported into ldap1. # ldap1search -s base contextCSN dn: dc=example,dc=com contextCSN: 20150511090001.208713Z#000000#000#000000 contextCSN: 20150511091334.137305Z#000000#001#000000 # ldap2search -s base contextCSN dn: dc=example,dc=com contextCSN: 20150511090001.208713Z#000000#000#000000 contextCSN: 20150511091334.137305Z#000000#001#000000 On ldap2 the stats log shows very many corresponding searches of the log DB: 5550763e conn=1000 op=11653 SRCH base="dc=example,dc=com" scope=2 deref=0 filter="(objectClass=*)" 5550763e conn=1000 op=11653 SRCH attr=* + 5550763e conn=1000 op=11653 SEARCH RESULT tag=101 err=0 nentries=0 text= 5550763e conn=1000 op=11654 SRCH base="cn=log" scope=2 deref=0 filter="(&(objectClass=auditWriteObject)(reqResult=0))" 5550763e conn=1000 op=11654 SRCH attr=reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN 5550763e conn=1000 op=11655 ABANDON msg=11655 Both systems have the host name specified in the -h option to slapd. Clocks are synchronised, DNS is working etc. I can't get to the bottom of this at all. No doubt I've made an error in my MMR config. Does anyone have a clue as to why this could be happening? I'd be very grateful for any ideas. Here's (most of) the slapd.conf file, which is identical on both. I must admit I'm not sure whether the serverID settings are global or per-database. Moving them into the mdb section doesn't change the behaviour though. # Server IDs for replication serverID 1 ldap://ldap1 serverID 2 ldap://ldap2 ############################################################# # # Access log database configuration # # This is also used for delta-syncrepl replication # # See slapd-accesslog(5) for details # ############################################################# database mdb maxsize 209715200 suffix cn=log directory /db/ldap/accesslog rootdn cn=log rootpw secret index entryCSN eq index objectClass eq index reqEnd eq index reqResult eq index reqStart eq overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE limits dn.exact="cn=replication,ou=special users,dc=example,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited # Replication user can read (not write) everything access to * by dn.exact="cn=replication,ou=special users,dc=example,dc=com" read by * none break ############################################################# # # Database configuration # # see slapd-mdb(5) for details # ############################################################# database mdb monitoring on suffix dc=example,dc=com directory /db/ldap/example rootdn "cn=administrator,ou=special users,dc=example,dc=com" maxsize 209715200 # Default password hashing scheme password-hash {SSHA} # memberOf overlay provides reverse-lookups of group membership overlay memberof # sssvlv overlay provides server-side sorting # Used mainly to allow easy sorting of uidNumber/gidNumber values overlay sssvlv sssvlv-max 4 sssvlv-maxkeys 5 sssvlv-maxperconn 4 # unique overlay provides attribute uniqueness # We use this to enforce unique uidNumber/gidNumber values overlay unique unique_uri ldap:///ou=people,dc=example,dc=com?uidNumber?one? unique_uri ldap:///ou=group,dc=example,dc=com?gidNumber?one? ### CONSUMER configuration syncrepl rid=1 provider=ldap://ldap1 type=refreshAndPersist bindmethod=simple binddn="cn=replication,ou=special users,dc=example,dc=com" credentials=password syncdata=accesslog interval=00:00:00:10 retry="20 10 60 10 120 +" timeout=1 logbase="cn=log" searchbase="dc=example,dc=com" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" sizelimit=unlimited timelimit=unlimited schemachecking=on starttls=yes syncrepl rid=2 provider=ldap://ldap2 type=refreshAndPersist bindmethod=simple binddn="cn=replication,ou=special users,dc=example,dc=com" credentials=password syncdata=accesslog interval=00:00:00:10 retry="20 10 60 10 120 +" timeout=2 logbase="cn=log" searchbase="dc=example,dc=com" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" sizelimit=unlimited timelimit=unlimited schemachecking=on starttls=yes ### PROVIDER configuration overlay syncprov syncprov-checkpoint 5 5 syncprov-sessionlog 50 mirrormode on # Access log - used for delta-syncrepl too overlay accesslog logdb cn=log logops writes logold (objectClass=*) logsuccess TRUE logpurge 28+00:00 1+00:00 # Allow unlimited access for replication user limits dn.exact="cn=replication,ou=special users,dc=example,dc=com" size=unlimited time=unlimited -- Liam Gretton liam.gretton(a)le.ac.uk Systems Specialist http://www.le.ac.uk/its/ IT Services Tel: +44 (0)116 2522254 University Of Leicester, University Road Leicestershire LE1 7RH, United Kingdom

2 4

TLS failing?
by Albert Braden 11 May '15

11 May '15

I'm setting up new LDAP servers with replication, and I configured TLS, but I see this in my log: May 11 14:29:07 nyprldap1 slapd[8867]: conn=2572 op=1 BIND dn="cn=manager,dc=about,dc=com" method=128 May 11 14:29:07 nyprldap1 slapd[8867]: conn=2572 op=1 BIND dn="cn=manager,dc=about,dc=com" mech=SIMPLE ssf=0 Does this mean that TLS is failing and it is falling back to ssf=0? I think my master is configured to not allow unencrypted connections: disallow bind_anon require bind security simple_bind=128 Albert Braden About.com Systems Operations 1500 Broadway 6th Floor New York, NY 10036 desk: 212-204-1448 | mobile: 917-480-1090 aim:albertatabout

2 4

Initial Replication is not working
by Gokulnath Arjunan 11 May '15

11 May '15

Hi, I have setup replication on openldap. Ldap startup is fine but I am not seeing it is getting replicated. Find the logs below. Please advice what needs to be changed. Master log: May 10 00:02:00 ldap slapd[12811]: conn=1031 fd=17 ACCEPT from IP=<IP>:49249 (IP=0.0.0.0:389) May 10 00:02:00 ldap slapd[12811]: conn=1031 op=0 BIND dn="cn=admin,dc=******,dc=com" method=128 May 10 00:02:00 ldap slapd[12811]: conn=1031 op=0 BIND dn="cn=admin,dc=******,dc=com" mech=SIMPLE ssf=0 May 10 00:02:00 ldap slapd[12811]: conn=1031 op=0 RESULT tag=97 err=0 text= May 10 00:02:00 ldap slapd[12811]: conn=1031 op=1 SRCH base="dc=*******,dc=com" scope=2 deref=0 filter="(objectClass=*)" May 10 00:02:00 ldap slapd[12811]: conn=1031 op=1 SRCH attr=* + May 10 00:02:00 ldap slapd[12811]: send_search_entry: conn 1031 ber write failed. May 10 00:02:00 ldap slapd[12811]: conn=1031 fd=17 closed (connection lost on write) May 10 00:02:45 ldap slapd[12811]: do_syncrep2: rid=002 LDAP_RES_SEARCH_RESULT (32) No such object May 10 00:02:45 ldap slapd[12811]: do_syncrep2: rid=002 (32) No such object May 10 00:02:45 ldap slapd[12811]: do_syncrepl: rid=002 rc -2 retrying Slave Log: May 10 00:02:00 TGAPPSRV07 slapd[40811]: findbase failed! 32 May 10 00:02:00 TGAPPSRV07 slapd[40811]: conn=1031 op=1 SEARCH RESULT tag=101 err=32 nentries=0 text= May 10 00:02:00 TGAPPSRV07 slapd[40811]: do_syncrep2: rid=002 LDAP_RES_SEARCH_RESULT (32) No such object May 10 00:02:00 TGAPPSRV07 slapd[40811]: do_syncrep2: rid=002 (32) No such object May 10 00:02:00 TGAPPSRV07 slapd[40811]: do_syncrepl: rid=002 rc -2 retrying May 10 00:02:00 TGAPPSRV07 slapd[40811]: conn=1031 op=2 UNBIND May 10 00:02:00 TGAPPSRV07 slapd[40811]: conn=1031 fd=20 closed May 10 00:02:00 TGAPPSRV07 slapd[40811]: syncrepl_message_to_entry: rid=001 mods check (objectClass: value #2 invalid per syntax) May 10 00:02:00 TGAPPSRV07 slapd[40811]: do_syncrepl: rid=001 rc 21 retrying Thanks Gokul

2 1

insert utf-8 data with c api
by yvan vander sanden 09 May '15

09 May '15

Hello. I have trouble inserting data in openldap when it contains utf8 characters. My code works as long as only ascii characters are present, but when a name has an accent or umlaut in it, the modify operation fails with an operations error. Even reading a string with such a character from an existing entry and pushing the same string back to ldap with ldap_modify_ext_s gives me this error. And while debugging I can see that the string in question really contains the correct uft8 values. Are there perhaps any options that have to be enabled? The only one I am using now is: int version = LDAP_VERSION3; ldap_set_option(_server, LDAP_OPT_PROTOCOL_VERSION, &version); Regards, yvan vander sanden -- ==- yvan vander sanden -== * composer, programmer * >>> http://mutecode.com -* MUTE software development* >>> http://attr-x.net - *online interactive soundscape* >>> http://code.google.com/p/yse-soundengine/ - *advanced 3D sound engine* >>> http://youngmusic.org - *personal website* >>> http://www.matrix-new-music.be/componist/vander-sanden-yvan-1972 - *bio @ matrix* <http://youngmusic.org>

1 0

Data is not getting replicated correctly in multimaster configuration
by Gurjot Kaur 08 May '15

08 May '15

Hi, I have configured two instances of LDAP in multimaster mode. I am creating 100 members and wait for 5 seconds and then deleting those 100 members. In case of creation the data is getting replicated correctly. But in deletion, all the 100 members are getting deleted from primary, but not from secondary server. As a result the data is inconsistent in both the instances. Please give any suggestion. Thanks and Regards, Gurjot Kaur Sofware Engineer gurjot.kaur(a)aricent.com [http://static.johnmcneilstudio.com/aricent/email_signature/aricent-footer-e…] "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

5 13

large write amplification
by Shu, Xinxin 07 May '15

07 May '15

Hi list, Recently I run micro tests on LMDB on DC3700 (200GB), I use bench code https://github.com/hyc/leveldb/tree/benches , I tested fillrandsync mode and collected iostat data, found that write amplification is large For fillrandsync case: IOPS : 1020 ops/sec Iostat data shows that w/s on that SSD is 8093, and avgqu-sz is ~ 1, await time is about 0.16 ms, so the write amplification is ~8, which is large to me, can someone help explain why write amplification is so large? thanks Cheers, xinxin

3 7

olcAuthzRegexp not matching
by Brendan Kearney 06 May '15

06 May '15

i am trying to get kerberos id <--> ldap object mapping down for dovecot, and seem to have hit a wall. i have the kerberos service principal created and a keytab populated. i can successfully kinit using the keytab and get a TGT for the imap/test.bpk2.com(a)BPK2.COM id. when i run ldapwhoami i get: SASL/GSSAPI authentication started SASL username: imap/test.bpk2.com(a)BPK2.COM SASL SSF: 56 SASL data security layer installed. dn:uid=imap/test.bpk2.com,ou=domainusers,ou=users,dc=bpk2,dc=com the olcAuthzRegexp i am trying to use is not matching and the mapping falls through to the regular user mappings. i have tried all the permutations i can thing of in the RegEx, but cannot get the match to occur. as a reference, i looked at the matching i do for the computer accounts, and there is nothing obviously wrong. olcAuthzRegexp attempts: {2}uid=imap\/(.*).bpk2.com,cn=bpk2.com,cn=gssapi,cn=auth uid=mda,ou=processUsers,ou=Users,dc=bpk2,dc=com {2}uid=imap\/(.*),cn=bpk2.com,cn=gssapi,cn=auth uid=mda,ou=processUsers,ou=Users,dc=bpk2,dc=com {2}uid=imap\/(.*),cn=gssapi,cn=auth uid=mda,ou=processUsers,ou=Users,dc=bpk2,dc=com {2}uid=imap\/(.*),cn=auth uid=mda,ou=processUsers,ou=Users,dc=bpk2,dc=com klist output: Ticket cache: KEYRING:persistent:0:0 Default principal: imap/test.bpk2.com(a)BPK2.COM Valid starting Expires Service principal 05/06/2015 11:42:08 05/07/2015 11:40:16 ldap/server2.bpk2.com(a)BPK2.COM renew until 05/13/2015 11:40:16 05/06/2015 11:40:16 05/07/2015 11:40:16 ldap/server1.bpk2.com(a)BPK2.COM renew until 05/13/2015 11:40:16 05/06/2015 11:40:16 05/07/2015 11:40:16 krbtgt/BPK2.COM(a)BPK2.COM renew until 05/13/2015 11:40:16 how do i find what i am doing wrong? note the below olcAuthzRegexp works to map hosts to computer accounts: {0}uid=host\/(.*).bpk2.com,cn=bpk2.com,cn=gssapi,cn=auth cn=$1,ou=Computers,dc=bpk2,dc=com thanks, brendan

3 5

Openldap Replication issues
by PRATIK SINGAL 06 May '15

06 May '15

Hello all, I have installed openldap on two machines and tried to setup multi-way replication.I am able to perform the multi-way replication (Add/Update/delete) when both the machines are up and ldap is running. But when my one machine goes down(server2) and records are added,deleted,modified on (server1) are not getting replicated on server2 when its is up and ldap service is running. **Below are the machine on which ldap is installed:** [root@localhost openldap]# cat /etc/*-release LSB_VERSION=base-4.0-amd64:base-4.0-noarch:core-4.0-amd64:core-4.0-noarch:graphics-4.0-amd64:graphics-4.0-noarch:printing-4.0-amd64:printing-4.0-noarch Red Hat Enterprise Linux Server release 6.4 (Santiago) Red Hat Enterprise Linux Server release 6.4 (Santiago) **Openldap version:** [root@localhost openldap]# slapd -V @(#) $OpenLDAP: slapd 2.4.23 (Oct 31 2012 08:14:14) $ mockbuild@x86-022.build.eng.bos.redhat.com:/builddir/build/BUILD /openldap-2.4.23/openldap-2.4.23/build-servers/servers/slapd Attaching the complete logs and conf file used. Kindly let me know where am making mistake Regards, Pratik

2 1

About RDN values starting with #
by Pofelski, Lech 06 May '15

06 May '15

Hello openLDAP gurus, According to the RFC 4514, an RDN value may start with # and to be followed by a number of "hex pair" (pairs of hexadecimal values), representing octets of some binary value. There are two use cases involving such RDN syntax: · Case 1, where the RDN is of the form: <attribute OID (called also as attribute desc in dotted form)>=#<BER encoded attribute value in form of a sequence of hex pairs > · Case 2, where the RDN is of the form: <attribute name>=#<attribute value in form of a sequence of hex pairs> Case 1 is explicitly illustrated in the RFC 4514 by the example: 1.3.6.1.4.1.1466.0=#04024869 Although Case 2 is not explicitly illustrated in the RFC4514, it is implicitly correct, as it is in the conformity with the RDN syntax provided by this RFC. The example of Case2 equivalent to the example of Case1 given in the RFC would be: <name of the attribute with OID 1.3.6.1.4.1.1466.0>=#4869 I have tested using openLDAP 2.4.39 a number of cases involving RDNs starting with #, including an example very close to the example from the RFC. The results show that: · If RDN value is provided as e.g. string value, LDAP operations like add, search and delete work well · If RDN value is provided as # prefixed hexadecimal value corresponding to the cases 1 and 2, none of this cases work and in all the cases I get the error "Invalid DN syntax" The schema file, scripts used to run the test and the test results are in the attached zip file. I would like to know: · If you share our understanding of the problem and in particular our interpretation of the Case2, for which there is no explicit example in the RFC4514. · If this is a known limitation in openLDAP. · If there is already a plan to fix the problem. If not, I'd be glad to contribute to fixing it. Thanks in advance for your answer. Regards, Lech POFELSKI Lech POFELSKI, Software Development Engineer Hewlett-Packard Centre de Compétences France 5 Avenue Raymond Chanas 38320 Eybens - France lech.pofelski(a)hp.com<mailto:lech.pofelski@hp.com>

2 6

HP-UX: mdb_txn_commit and MDB_WRITEMAP
by Kristian Amlie 06 May '15

06 May '15

We have enabled MDB_WRITEMAP on our HP-UX 11.23 Itanium after previous discussions on the list, and that worked nicely for the most part. However now we face a different issue: Occasionally, mdb_txn_commit will return "Resource temporarily unavailable". I have not been able to determine exactly which resource it's talking about; I suspected shared memory limits, but raising this limit did not solve the problem. This issue did not occur without MDB_WRITEMAP. Any idea what else it could be? I can probably insert debug code into LMDB if that's needed. -- Kristian

2 2

RE24 testing call (2.4.41)
by Quanah Gibson-Mount 05 May '15

05 May '15

If you know how to build OpenLDAP manually, and would like to participate in testing the next set of code for the 2.4.41 release, please do so. Generally, get the code for RE24: <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> Configure & build. Execute the test suite (via make test) after it is built. Thanks! --Quanah -- Quanah Gibson-Mount Platform Architect Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

5 6

Need migrationhelp for 1.3.6.1.4.1.1466.115.121.1.5 because of bug in slapcat
by Frank Offermanns 05 May '15

05 May '15

Hello, in our custom schema we have used several attributes with the syntax: 1.3.6.1.4.1.1466.115.121.1.5 attributetype ( myAttributeType:106 NAME ( 'casFileContent' ) DESC 'Contains the file' SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 SINGLE-VALUE ) We defined this schema before this syntax was dropped. Everything worked for a long time. Now with OpenLDAP Version 2.4.39 and newer a slapcat does no longer export this attributes as MimeContent, but as plain text. So the ldif can't be used for importing. So I started a research why and found that this syntax was dropped. But for downward compatibility shouldn't it still export this syntax as mime content, shouldt it? This would be important, since in inetorgperson.schema the 2 attributes userSMIMECertificate and userPKCS12 still use it. What syntax should I use for files stored in LDAP? And even more important, how can I change the syntax of a attribute. Is there a migration strategy to change the syntax of a attribute? Regards, Frank

4 10

Fast key range iteration
by Александр Киранов 05 May '15

05 May '15

Hi all! Is there a way to iterate with all key-value pairs in LMDB database, where all keys is in specified range? I'm trying to use mdb_cursor_get() with MDB_SET_RANGE to search first pair. Then I see only one way - use mdb_cursor_get() with MDB_NEXT and compare key by memcmp(). But it seems absolutely not effective. Is there another solution for my task? Thanks!

3 2

Try out our new most advanced medication aimed to conquer you erectile dysfunction!
by Anibal 05 May '15

05 May '15

These simple medicines will bring you back to life in the bedroom Your boner will be back in no time with these low prices We will fill your life with joy! Free tablets this week! http://zzb.bz/34vXj World Anti-ED from FDA

1 0

[LMDB] Two API questions
by Klaus Malorny 04 May '15

04 May '15

Hi, during the implementation of my first project using LMDB I got two questions: 1. I wanted to write a small utility function that determines a rough estimation of the free space, using the mdb_env_stat, mdb_env_info and mdb_stat functions, summing up the block counts, multiplying it with the block size and putting this in relation to the map size. Typically I know which databases exist, but I wondered whether there would be a possibility to enumerate the existing databases and did not find anything. Is it correct that currently there is no way to get the names? 2. For one task, I needed to walk through a subset of the keys with a cursor and to delete key/value pairs that meet some criteria. From the documentation, it is unclear to me how to proceed after a deletion, i.e. which cursor operation should be used to access the next key/value pair. Both MDB_GET_CURRENT and MDB_NEXT seemed to work. Which one is preferred or the "officially" correct way? I guess MDB_NEXT. Thanks a lot. Regards, Klaus

2 1

OpenLDAP referrals and kerberos error for MAC
by Aimee He 04 May '15

04 May '15

Dear Technical of openLDAP, I use OpenLDAP development on the Mac platform, run into the following 2 questions, find a lot of information, still not resolved. Could you help me, Thank you. 1. Referrals error, Code flow: ld = ldap_init(host, port); rc = ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &version); rc = ldap_set_option(ld, LDAP_OPT_REFERRALS, LDAP_OPT_ON); rc = ldap_set_rebind_proc(ld, bind_prompt, NULL); rc = ldap_set_option(ld, LDAP_OPT_SIZELIMIT,&sizelimit); rc = ldap_simple_bind_s(ld, adminDN, adminPwd); rc = ldap_search_s(ld, findDN, LDAP_SCOPE_ONELEVEL, [filter UTF8String], attrs, 0, &result); CallBack function： static int bind_prompt(LDAP *ld,LDAP_CONST char *url,ber_tag_t request, ber_int_t msgid, void *params) { static char *dnsuffix; static char dn[256],password[256]; int authmethod; NSLog(@"rebind for request=%ld,msgid=%ld,url=%s\n",request,(long)msgid,url); authmethod = LDAP_AUTH_SIMPLE; NSLog(@"re-bind dn?"); strcat(dn, dnsuffix); if (authmethod == LDAP_AUTH_SIMPLE && dn[0] != '\0') { NSLog(@"re-bind password?"); } else { password[0] = '\0'; } return ldap_bind_s(ld, dn, password, authmethod); } Description of the problem:ldap_search_s() return value is 10, which is LDAP_REFERRAL,an it did not call the function “bind_prompt()”. 2. Kerberos error, Code flow： ld = ldap_init(host, port); rc = ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &version); rc = ldap_set_option(ld, LDAP_OPT_REFERRALS, LDAP_OPT_OFF); rc = ldap_set_option(ld, LDAP_OPT_SIZELIMIT,&sizelimit); rc = ldap_set_rebind_proc(ld, bind_prompt, NULL); rc = ldap_bind_s(ld, adminDN, adminPwd, LDAP_AUTH_KRBV4); Description of the problem:LDAP_AUTH_KRBV4,LDAP_AUTH_KRBV41,LDAP_AUTH_KRBV42,ldap_bind_s return value is -6, which is LDAP_AUTH_UNKNOWN. Windows Client with the same configuration connected to openLDAP server successfully. Does my code or interface call for errors. Regards! Aimee He Tel:15658 Confidential Information:This message is sent to the intended recipient and may contain privileged or confidential information. If you received this transmission in error, please notify the sender with a replying e-mail and delete the message and any attachment.Transmission Caveat and Virus Alert: Internet communications cannot be guaranteed to be timely, secure, error or virus-free. The sender does not accept liability for any errors or omissions.

1 0

idassert-bind seems to ignore binddn
by Ryan Lovett 01 May '15

01 May '15

Hello, I've setup a simple proxy so that local LDAP clients can get access to protected attributes on a remote server. My proxy is slapd 2.4.31 with this slapd.conf: include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel none modulepath /usr/lib/ldap moduleload back_ldap sizelimit 500 tool-threads 1 backend ldap database ldap suffix "dc=company,dc=com" uri ldap://ldap.company.com:389 idassert-bind bindmethod=simple binddn="uid=my_id,ou=my_dept,dc=company,dc=com" credentials="mypass" authcId="dn:uid=my_id,ou=my_dept,dc=company,dc=com" mode=legacy ldap.company.com permits the my_id DN to access privileged attributes that anonymous users cannot. I can run ldapsearch against ldap.company.com with simple auth, binding as my_id, and view the privileged attributes. ldapsearch -H ldap://ldap.company.com:389 -LLL -x \ -b ou=users,dc=company,dc=com \ -W -D uid=my_id,ou=my_dept,dc=company,dc=com \ "(uid=12345)" When I run ldapsearch against my proxy slapd with the above slapd.conf however... ldapsearch -H ldap://myproxy.company.com:389 -LLL -x \ -b ou=users,dc=company,dc=com \ "(uid=12345)" ... a packet trace shows that slapd is connecting to ldap.company.com without binding as my_id: LDAPMessage bindRequest(1) "<ROOT>" simple messageID: 1 protocolOp: bindRequest (0) bindRequest version: 3 name: authentication: simple (0) simple: <MISSING> As a result I do not see the privileged attributes. Based on the docs <http://manpages.ubuntu.com/manpages/trusty/man5/slapd-ldap.5.html>, I've chosen mode=legacy because I'd like for the proxy to "perform a simple bind as the authcDN ... and assert the client's identity when it is not anonymous." I've also tried following the advice at http://www.openldap.org/faq/data/cache/532.html which states: If no authzID is given, and mode is set to none (for instance because the > remote server does not support the proxyAuthz control), the clients will be > authorized as "cn=Proxy,dc=example,dc=com" even if they actually connected > anonymously to the proxy. yielding: idassert-bind bindmethod=simple binddn="uid=my_id,ou=my_dept,dc=company,dc=com" credentials="mypass" mode=none But an ldapsearch of my proxy then reports "Inappropriate authentication (48)" which I don't understand because client-to-proxy and proxy-to-remote all use simple auth. What am I doing wrong? Any advice is greatly appreciated! Ryan

4 7

Significance of name forms.
by dE 01 May '15

01 May '15

Suppose a name form is attached to a structural object class. Then, when referring to entries belonging to that object class (which has no DIT Structure Rules associated to it), is using the MUST attributes as defined in the name form to construct AVA still necessary? No DIT Structure Rules refer to this name form.

3 15

Re: idassert-bind seems to ignore binddn
by Ryan Lovett 01 May '15

01 May '15

Thanks for your response. I'm surprised Ubuntu's most recent LTS is shipping such an old version of OpenLDAP! I just built and installed 2.4.40 packages on Ubuntu 14.04 from Debian Jesse's 2.4.40 source. Unfortunately slapd returns the same results as 2.4.31 and a packet capture shows the same binding behavior. Ryan On Thu, Apr 30, 2015 at 6:25 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, April 30, 2015 6:32 PM -0700 Ryan Lovett <rylo(a)berkeley.edu> > wrote: > > >> Hello, >> >> >> I've setup a simple proxy so that local LDAP clients can get access to >> protected attributes on a remote server. My proxy is slapd 2.4.31 with >> >> What am I doing wrong? Any advice is greatly appreciated! >> > > The first thing you're doing wrong is running a version of OpenLDAP that > is so ancient. > > OpenLDAP 2.4.31 Release (2012/04/21) > > I.e., it's over 3 years old. > > There have been multiple fixes to slapd-ldap since that release. This one > in particular may be related: > > OpenLDAP 2.4.33 Release (2012/10/10) > Fixed slapd-ldap idassert bind handling (ITS#7403) > > --Quanah > > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

getent passwd only catch local user passwd
by Yingbo Li 30 Apr '15

30 Apr '15

Hi, I am new to LDAP. The company's IT own LDAP server, I tried to configure openldap client but failed. My OS is CentOS 7, openldap is 2.4.39. I configured ldap and ldaps. I can use ldapsearch to find out full ldap info of my LDAP account. I configured with authconfig-tui. I also modified /etc/pam.d/system-auth and password-auth, change pam_sss.so to pam_ldap.so. While when I tried getent passwd, I can only find local users. I cannot su to my LDAP account. Why? I google online it looks like CentOS 7 has problem to configure ldap client. Cent0S 7 does not have pam_ldap module. But I can find pam_ldap.so in the system. What should I do to fix it? Switch to CentOS 6.6? Your help is really appreciated! Thank you! Yingbo

5 10

Ldap challenge
by Ross, Daniel B. 30 Apr '15

30 Apr '15

Ok I have looked a couple options but I really dont know how to accomplish what I need to do. Here is what I am trying to do. I have a greater organization that is stuck on using Microsoft products namely Microsoft LDS. To make matters worse they present the data to my linux servers in a completely non-standard way. Its driving my solaris and linux box nuts and they simply dont want to work with it. What i need to do is continue to use the campus usernames and passwords but present the Data in a format that my linux/unix hosts can use. Is this possible? i.e. userid would still be samwise but instead of a bizzarre OU=monkeypeople,dc=example,dc=com I want it to present as people,dc=example,dc=com. I looked at referral and aliasing but it does not seem to be doing what I am trying to do. Passthrough authentication looks close but I cant find sufficient documentation to actually configure a system to use it. Thanks Daniel

8 12

Re: modifying cn=config with ldapmodify
by Abdelhamid Meddeb 29 Apr '15

29 Apr '15

Hi, In your ssl.ldif file there is a *blank* line too after changetype: modify This is not reported in your first post but it apear in seconde one. I have reproduced the same symptoms with this empty line More details bellow Cheers. Le 29/04/2015 12:56, Robert Munn a écrit : > My replies inline... > > On Apr 26, 2015, at 2:28 AM, Abdelhamid MEDDEB <abdelhamid(a)meddeb.net > <mailto:abdelhamid@meddeb.net>> wrote: > >> Hi, >> >> >> Le 25/04/2015 15:10, Robert Munn a écrit : >>> I have been trying to replace the SSL cert settings on my OpenLDAP >>> instance running on Ubuntu using ldapmodify. >>> >>> >>> I followed directions on the Ubuntu wiki: >>> >>> https://help.ubuntu.com/lts/serverguide/openldap-server.html#openldap-tls >>> >>> using a modified ldif file for the replace: >>> >>> |dn: cn=config >>> changetype: modify >>> replace: olcTLSCACertificateFile >>> olcTLSCACertificateFile: /etc/ssl/certs/cacert.pem >>> - >>> replace: olcTLSCertificateFile >>> olcTLSCertificateFile: /etc/ssl/certs/ldap01_slapd_cert.pem >>> - >>> replace: olcTLSCertificateKeyFile >>> olcTLSCertificateKeyFile: /etc/ssl/private/ldap01_slapd_key.pem| >> |All right| Empty line is not reported here. >>> When it didn’t work on my existing instance I built a new instance >>> in a new Ubuntu VM (14.04) and tried the original directions from >>> Ubuntu. That did not work either. >> May be you've missed some settings at build time like --with-tls > > I installed OpenLDAP using apt. The .deb package must include TLS > because I added the certificates manually. > > >>> >>> The ldapmodify command executes correctly but it seems that the >>> change is not registered by the server. This is the case in both the >>> new instance and the old instance of OpenLDAP. >> No error message like "Insufficient access (50)" ? and you should >> check the write (manage)rights to cn=config database. > > The command I ran (as sudo) and the message: > > ldapmodify -Y EXTERNAL -H ldapi:/// -f ssl.ldif > SASL/EXTERNAL authentication started > SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth > SASL SSF: 0 > modifying entry "cn=config” > > and ssl.ldif : > > dn: cn=config > changetype:modify > > replace: olcTLSCACertificateFile > olcTLSCACertificateFile: /etc/ssl/certs/CAcert > - > replace: olcTLSCertificateFile > olcTLSCertificateFile: /etc/ssl/certs/cert > - > replace: olcTLSCertificateKeyFile > olcTLSCertificateKeyFile: /etc/ssl/private/cert.key > But we show it here, and content changes (strangely) the cn=config.ldif last modified timestamp, but do nothing realy > cn=config.ldif is being modified by the ldapmodify process, I verified > that by changing file permissions on cn=config.ldif, running the > ldapmodify command, and then checking cn=config.ldif. ldapmodify > updated the timestamp and file permissions on the file. The file > changed, but the configuration changes in ssl.ldif were not made in > cn=config.ldif. > > >>> I ended up replacing the values (or adding them in the new instance) >>> in the /etc/ldap/slapd.d/cn=config.ldif file manually. Making the >>> changes manually and restarting slapd works, but my understanding >>> was that changes to cn=config should be made through ldapmodify. >> Bad practice, it's best to avoid. > > Yes, and when I can modify the configuration using ldapmodify, I will > no longer make the changes manually. > > I found a note about enabling logging using ldapmodify: > > https://help.ubuntu.com/lts/serverguide/openldap-server.html > > logging.ldif: > > dn: cn=config > changetype: modify > replace: olcLogLevel > olcLogLevel: stats > > ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f logging.ldif > > I executed this command on my first instance and it added the logging > to cn=config. I executed this command on the second instance, where > olcLogLevel already existed, and it did not alter the log level. > > I have also been experimenting with this script: > > https://github.com/cepharum/slapd-config > > With it, I was able to delete the TLS entries from cn=config: > > slapd-config raw delete cn=config olcTLSCACertificateFile 1 > > but when I tried to add the entries back, I got this error: > > slapd-config raw insert cn=config olcTLSCACertificateFile 1 > "/etc/ssl/certs/cert.pem" > modifying entry "" > ldap_modify: Server is unwilling to perform (53) > additional info: modify upon the root DSE not supported > I have not looked at the details but it seems that there is a bug in this script. (modifying entry "") > > I was able to change the olcLogLevel back to its original state vi > ldapmodify, so maybe there is something particular about the TLS > entries, perhaps having to do with permissions on the certs and keys > themselves? > > I have come across this bug in several forums and have yet to see > someone who solved it in the “correct” manner using ldapmodify. > > > Robert > > > >>> >>> I also found a tech note at CentOS: >>> >>> https://www.centos.org/docs/5/html/CDS/cli/8.0/Configuration_Command_File_R… >>> in section 2.2.2.2 that indicates changes to cn=config will be ignored: >>> >>> "If an attribute is added to |cn=config|, the server ignores it." >>> >>> >>> So am I mistaken? Do I need to do something different? I would >>> prefer to manage the config with ldapmodify, but since I don’t >>> change cn=config that often, I can change it manually. >>> >>> >>> >>> Robert >>> >>> >> >> Cheers, >> -- >> *Abdelhamid MEDDEB* >> http://www.meddeb.net > -- *Abdelhamid Meddeb* http://www.meddeb.net

1 0

Objectclass not enabled in PHPldapadmin
by Gokulnath Arjunan 29 Apr '15

29 Apr '15

Hi, I have installed LDAP 2.4 version and using phpldapadmin to manage it. I am not seeing all the options enabled in create object page. Like I can see "Generic: Organisational Role" and "Generic: Organisational Unit" but other options like "Generic: Address Book Entry, Generic: Posix Group, Generic: User Account" are in disabled mode. I want them to be available to create group and users. Please guide me how to resolve this issue. I noticed below errors/warning during login to phpldapadmin and not sure about it. Samba: Group Mapping: posixGroup removed from template as it is not defined in the schema Alias: inetOrgPerson removed from template as it is not defined in the schema Thanks Gokulnath

1 0

query across ou
by Chuck Theobald 29 Apr '15

29 Apr '15

Is there a way to perform a single query an LDAP database such that I can retrieve the group name (cn) from a user's full name (cn). My structure holds user accounts in ou=People and groups in ou=Group. I know I can ask for gidNumber from the People tree, then reference the group in the Group tree, but with an SQL background, I would like a single query. Thanks, -- Chuck Theobald System Administrator The Robert and Beverly Lewis Center for Neuroimaging University of Oregon P: 541-346-0343 F: 541-346-0345

3 2

Re: Antw: Re: All entries belong to the top object class?
by dE 29 Apr '15

29 Apr '15

On 04/21/15 11:43, Ulrich Windl wrote: >>>> dE <de.techno(a)gmail.com> schrieb am 20.04.2015 um 07:36 in Nachricht > <55349047.7020907(a)gmail.com>: >> On 04/20/15 00:59, Ryan Tandy wrote: >>> On Sun, Apr 19, 2015 at 11:42:16AM +0530, dE wrote: >>>> As per https://tools.ietf.org/html/rfc4512#section-3.3 >>>> >>>> When creating an entry or adding an 'objectClass' value to an entry, >>>> all superclasses of the named classes SHALL be implicitly added as >>>> well if not already present. >>>> >>>> That means the top object class will always be there. >>> Basically correct. Note "implicitly" means it's treated as present, >>> even if the entry doesn't actually contain "objectClass: top". >>> >>>> Or is it that only the most subordinate object class in the >>>> multivalued attribute is considered by the client and server? >>> The following facts may answer your question: >>> >>> - every entry satisfies the filter "(objectClass=top)". >>> >>> - an entry with "objectClass: inetOrgPerson" satisfies the filter >>> "(objectClass=person)". >>> >> I'm concerned about the attributes. Does adding of the top object class >> (or person) add all attributes to the entry? > I'd say: It adds no attributes at all to the entry automagically, but the MUST attributes have to be provided while the MAY attributes may be provided. If an entry is created, it will contain all the valid attributes you provide (no entry is created if you supply invalid attributes). > > Regards, > Ulrich Yes, so subclasses do not define MAY; it's defined by the MAY of the top object class.

3 3

Re: Antw: Re: Slapd running very slow
by Geoff Swan 29 Apr '15

29 Apr '15

On 2015-04-23 4:07 PM, Ulrich Windl wrote: >>>> Geoff Swan <gswan3(a)bigpond.net.au> schrieb am 22.04.2015 um 23:18 in Nachricht > <5538100A.3060301(a)bigpond.net.au>: > > [...] >> Free stats look fine to me. No swap is being used, or has been used yet >> on this system. >> >> total used free shared buffers cached >> Mem: 132005400 21928192 110077208 10612 363064 19230072 >> -/+ buffers/cache: 2335056 129670344 >> Swap: 8388604 0 8388604 >> >> The effect I am seeing is that despite a reasonably fast disc system, >> the kernel writing of dirty pages is painfully slow. > So disk I/O stats is also available via sar. May we see them? Finally there's blktrace where you can follow the timing and positions of each individual block being written, but that's not quite easy to run and analyze (unless I missed the easy way). > > I suspect scattered writes that bring your I/O rate down. > > Regards, > Ulrich > sysstat (and sar) is not installed on this system, so I can't give you that output.

3 8

OpenLDAP keeps on dying sporadically
by Leander Schäfer 28 Apr '15

28 Apr '15

Hi fellows my OpenLDAP keeps on dying sporadically. Unfortunately it doesn't leave ANY trace of why it crashes. It stays alive for a while .... takes a couple of queries as expected ... and then suddenly it dies after another request. This could mean working perfectly for a day or working only for a couple of minutes before it crashes. The requests are all known to work (Dovecot auth and system PAM auth). At first I thought it could be related to newsyslog(8) ... I did some testing - unfortunately this doesn't change anything at all. It keeps on dying sporadically even if newsyslog is completely deactivated for the slapd(8) log file. I experenced this behauviour since I first used OpenLDAP approximately 5 years ago. My OpenLDAP configurations have been changed many times and quite a lot over those 5 years. Unfortunately I was never able to figure out what the sudden crashes caused - so I wrote a supervisor script , which periodically checks if the slapd(8) is still running. If slapd(8) is not running, then my supervisor script starts it automatically again. Of course with every major change in the configuration of OpenLDAP, I also tried to debug this problem of the sudden crashes - but as I said: even with all debug levels activated - slapd(8) didn't want to share its root of the pain. This workaround was the only way I could use OpenLDAP at all over the past five years. Two days ago I got to the point where my workaround came to its capacity boundary. The time between the slapd(8) crashes has become so little, so my script can't handle them anylonger. I would have two options now: a) Fix my supervisor script, so it detects and starts slapd(8) even if the time between crashes is less than 3 sec. b) I ask for help in order to discover this mysterious cause of the crashes and FINALLY fix it FOREVER. So this time I set my foot down and go for b). This is why I decided to contact you. The following link containes a more detailed debugging of the problem: https://forums.freebsd.org/threads/openldap-slapd-dies-sporadically.47634/ And this is the current / latest configuration I deploy on my servers. Also, it doesn't make a difference whether I have monitoring activated or not. It keeps on dieing the same as before. The very same ocours to the "ldapab.schema" - it doesn't make a difference for the crashes to happen whether it is commented out or activated. Logging hapens through syslogd(8). # ============================================================ # #======================================# # slapd.conf # #======================================# # LDAP Attribut Schema Definitions: include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/nis.schema include /usr/local/etc/openldap/schema/ldapab.schema include /usr/local/etc/openldap/schema/mail.schema #include /usr/local/etc/openldap/schema/qouta.schema # Logging loglevel 256 # If "logfile" is activated, then newsyslog must restart slapd after rotation #logfile /var/log/slapd.log # Important Files pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Allow LDAPv2 client connections. This is required for iOS suppoprt via SSL. #allow bind_v2 # Time limits #idletimeout 0 #writetimeout 0 #timelimit 3600 # Dynamic Modules: modulepath /usr/local/libexec/openldap moduleload back_mdb moduleload back_monitor # Access from 127.0.0.1 without encryption access to dn.subtree="dc=MyDomain,dc=local" by peername.ip=127.0.0.1 write by * none break # Access from other than 127.0.0.1 requires TLS # encryption with min. 128 bit encryption access to dn.subtree="dc=MyDomain,dc=local" by ssf=128 write by * none # TLS-Certificate TLSCertificateFile /etc/ssl/PKI/CA/Signing-CA/Certs/WM-01.MyDomain.Local.crt TLSCertificateKeyFile /etc/ssl/PKI/CA/Signing-CA/Private/WM-01.MyDomain.Local.key TLSVerifyClient allow # Restrict write access for password attributes to root user only by dn="uid=dovecot,ou=systemuser,ou=mail,dc=MyDomain,dc=Local" access to attrs=userPassword by self write by anonymous auth by * none # All the other atributes can be read by everyone else access to * by * read # ================================== # # Internal Monitoring # # ================================== # # DB type database monitor # Name of Administrator rootdn "cn=monitoring,cn=Monitor" # Password of Administrators rootpw {SSHA}SomeHash # ACL for moitoring access to dn.subtree="cn=Monitor" by dn.exact="cn=admin,dc=MyDomain,dc=local" write by peername.ip=127.0.0.1 read by users read by * none # ================================== # # Lightning Memory-Mapped Database # # ================================== # # Datenbanktyp database mdb # DB location on FS directory /var/db/openldap-data # Datenbank-Pfad suffix "dc=MyDomain,dc=local" # Name of Administrator rootdn "cn=admin,dc=MyDomain,dc=local" # Password of Administrators rootpw {SSHA}SomeHash # Max size of DB in Byte [ 5368709120 Byte => 5 GB ] maxsize 5368709120 # Index search related attributes index objectClass eq index uid eq index uidNumber eq index uniqueMember eq index gidNumber eq index cn eq index memberUid eq index mailAccountStatus eq index mailAddress eq index associatedDomain eq # ============================================================= # I compiled OpenLDAP from FreeBSD ports with following options: - DYNAMIC_BACKENDS - MDB - PPOLICY - SYNCPROV - TCP_WRAPPERS Please let me know what kind of further information I could deliver to you in order to detect the root of the problem. Thank you Best regards Leander

5 15

All entries belong to the top object class?
by dE 28 Apr '15

28 Apr '15

As per https://tools.ietf.org/html/rfc4512#section-3.3 When creating an entry or adding an 'objectClass' value to an entry, all superclasses of the named classes SHALL be implicitly added as well if not already present. That means the top object class will always be there. Or is it that only the most subordinate object class in the multivalued attribute is considered by the client and server?

6 11

uidNumber=4294967295 is being appearing in the log frequently
by Majid Khan 28 Apr '15

28 Apr '15

Dear Techies, I'm not sure if this is the right forum to discuss this but I am getting the following from some of the clients machine I'm not sure why some of them sending this info otherwise my authentication and login all is working fine but I'm concern why its happening and my log is full of the following kind of message: If this is not the right forum then I apologies and please direct me to that right group: Apr 28 05:58:44 server1 slapd[23003]: conn=5235 op=22 SRCH base="dc=example,dc=com" scope=2 deref=0 filter="(&(uidNumber=4294967295)(objectClass=posixAccount)(uid=*)(&(uidNumber=*)(!(uidNumber=0))))"Apr 28 05:58:44 server1 slapd[23003]: conn=5235 op=22 SRCH attr=objectClass uid userPassword uidNumber gidNumber gecos homeDirectory loginShell krbPrincipalName cn modifyTimestamp modifyTimestamp shadowLastChange shadowMin shadowMax shadowWarning shadowInactive shadowExpire shadowFlag krbLastPwdChange krbPasswordExpiration pwdAttribute authorizedService accountExpires userAccountControl nsAccountLock host loginDisabled loginExpirationTime loginAllowedTimeMap Server info: CentOS release 6.6LDAP version: openldap-2.4.40 Client info: CentOS release 6.2Client using SSSD: sssd-1.11.6 Thanks. Best regards, Majid.

2 2

top object class contains all possible attributes?
by dE 28 Apr '15

28 Apr '15

From https://tools.ietf.org/html/rfc4512 it can be said that an object class inherits the sets of *allowed* and required attributes from its superclasses Therefore the top object class contains all possible attributes? OR A subclasses cannot contain any attribute which is not included in it's superclass? I'm running Apache directory studio, and I don't see that happening.

4 4

Re: All entries belong to the top object class?
by dE 28 Apr '15

28 Apr '15

On 04/20/15 22:56, Michael Ströder wrote: > dE wrote: >> Does adding of the top object class (or >> person) add all attributes to the entry? > > Nope. Which text in RFC 4512 leads to your presumption? > > Ciao, Michael. > > Sorry for the late response. I was out of town. From the responses, it appears the question has not been understood correctly, I what I meant to ask was -- Does adding of the top object class (implicitly) make it possible to add all attributes in the DIT to the entry? I'm talking about attributes which are out of the 'MAY' in the most subordinate object class the entry belong to.

7 15

LMDB:Transaction across multiple enviroments
by Daniel, Sabu 28 Apr '15

28 Apr '15

Hi, I am trying to use LMDB and I would like to know if there a way to define a transaction across multiple environments? Thanks, Sabu Daniel

2 1

separate loglevels for different databases?
by Meike Stone 27 Apr '15

27 Apr '15

Hello, I've configured two different databases (one ldap, one bdb) in openLDAP. Is it possible, to configure separate loglevels for each database? Thanks Meike

3 4

LMDB space amplification
by Shu, Xinxin 27 Apr '15

27 Apr '15

Hi list, Recently I have integrated lmdb into ceph , got intial results , I dump all records of lmdb, there are several different size key-value pairs, 1. key size : 45 byte, value size = 124 byte 2. key size : 85 byte, value size = 1187 byte 3. key size : 57 byte, value size = 135 byte 4. key size : 64 byte, value size = 182 byte 5. key size : 33 byte, value size = 4096 byte (used for real data, about 80 %) this db contains about ~ 10000000 records, about 80 percent of records are the last key-value pairs (key size 33 byte, value size 4096 byte), I calculate size of all key-value pairs, about 33GB , but on-disk size is about 63GB, so space amplification is ~ 2, is this amplification reasonable ? In which situation can lmdb get such large space amplification? How can I reduce this amplification? If you need any other details , please email me , any tips will be appreciate. Cheers, xinxin

2 3

[WIP] WiredTiger Backend
by HAMANO Tsukasa 27 Apr '15

27 Apr '15

Hi, I'm writing OpenLDAP WiredTiger backend. It will get high write throughput and high concurrency performance. Now this backend module is incomplete but basic feature is working, So I publish the code. https://www.osstech.co.jp/download/hamano/openldap/0001-OpenLDAP-WiredTiger… Some note: * slapadd, slapcat, slapindex will works. * LDAP BIND, ADD, DELETE, SEARCH will works. * MODIFY, MODRDN does not implement yet. * deref search does not implement yet. * WiredTiger is not support multiprocess access yet. It mean that we can't to do slatcat while running slapd. It will be supported in the future. * This backend module may have a issue about licensing when distributing whole binary under OpenLDAP Public Licence. Now WiredTiger, Inc are working cooperatively toward a resolve the issue. I'm glad if you get to try it and give me advice. Thank you. -- Open Source Solution Technology Corporation HAMANO Tsukasa <hamano(a)osstech.co.jp> fingerprint = 2285 2111 6D34 3816 3C2E A5B9 16BE D101 6069 BE55

2 1

modifying cn=config with ldapmodify
by Robert Munn 26 Apr '15

26 Apr '15

I have been trying to replace the SSL cert settings on my OpenLDAP instance running on Ubuntu using ldapmodify. I followed directions on the Ubuntu wiki: https://help.ubuntu.com/lts/serverguide/openldap-server.html#openldap-tls using a modified ldif file for the replace: dn: cn=config changetype: modify replace: olcTLSCACertificateFile olcTLSCACertificateFile: /etc/ssl/certs/cacert.pem - replace: olcTLSCertificateFile olcTLSCertificateFile: /etc/ssl/certs/ldap01_slapd_cert.pem - replace: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/ssl/private/ldap01_slapd_key.pem When it didn’t work on my existing instance I built a new instance in a new Ubuntu VM (14.04) and tried the original directions from Ubuntu. That did not work either. The ldapmodify command executes correctly but it seems that the change is not registered by the server. This is the case in both the new instance and the old instance of OpenLDAP. I ended up replacing the values (or adding them in the new instance) in the /etc/ldap/slapd.d/cn=config.ldif file manually. Making the changes manually and restarting slapd works, but my understanding was that changes to cn=config should be made through ldapmodify. I also found a tech note at CentOS: https://www.centos.org/docs/5/html/CDS/cli/8.0/Configuration_Command_File_R… in section 2.2.2.2 that indicates changes to cn=config will be ignored: "If an attribute is added to cn=config, the server ignores it." So am I mistaken? Do I need to do something different? I would prefer to manage the config with ldapmodify, but since I don’t change cn=config that often, I can change it manually. Robert

2 1

EXOP patches for PHP LDAP module
by Emmanuel Dreyfus 25 Apr '15

25 Apr '15

Hello For whoever is interested, I updated Pierangelo Masarati's patch to support EXOP in PHP LDAP module. Patches for PHP 5.4, 5.5 and 5.6 can be found here: http://cvsweb.netbsd.org/bsdweb.cgi/pkgsrc/databases/php-ldap/files/ Previous patch for PHP 5.3 and PHP 5.2 is in the Attic. -- Emmanuel Dreyfus manu(a)netbsd.org

3 5

Re: Antw: LMDB usage with long or variable length keys
by Alex V. 25 Apr '15

25 Apr '15

On 4/24/2015 10:45 AM, Ulrich Windl wrote: >>>> "Alex V."<alex.v.odesk(a)gmail.com> schrieb am 24.04.2015 um 08:54 in Nachricht > <5539E88C.3080006(a)gmail.com>: >> On 4/24/2015 9:02 AM, Ulrich Windl wrote: >>> I think this depends very much on your access patterns (which you didn't >> explain). >>> Regards, >>> Ulrich >> What required is `get(key)` and `set(key, val)`. And, optional but not >> unwanted, range lookup. > Still unclear: What is the expected ratio between get and set for a specific key? Do you ever delete keys? If so, how many accesses do you expect before deleting a key? > > You could hash your keys using MD5 or SHA, and use the first 16 bytes as key. As your access pattern does not include enumerating the original keys, that would work, saving space vs. consuming some extra CPU cycles. I can think of other algorithms, but you were not specific with your access pattern. > > Regards, > Ulrich > I haven't figured all the details yet, I am just looking for different possibilities. number of `get`s is probably many times higher than number of `set`s or `delete`s. One possible usage case is database that stores source files metadata(symbols) for autocompletion/navigation, something like "source navigator ng"(it uses bdb). Another use case is almost the same, with urls as keys and word index as metadata. Looks like basename/url parts hierarchy will do, I am going to test it some day.

1 0

Re: Different contextCSN on multi-master replication servers
by NICOLAS KOVAC NEUMANN 24 Apr '15

24 Apr '15

Thank you both Howard and Leonid. Yes, you're right, it happened the other way around; the modification was made on the second server and propagated back to the first one. However, I don't know why the change was in turn returned to the second server - SIDs are ok as far as I know. However, as Leonid mentioned, both servers weren't synchronized correctly anyway. Turns out that yesterday we upgraded to 2.4.39-6 (as I stated in my first mail). Previously, we were using 2.4.39-3 and it seemed to work fine. We also noted that 2.4.39-6 produced some additional issues (like client and syncrepl sockets dying without any apparent reason), so today we downgraded back to 2.4.39-3 and everything seems to work just fine again. We had a look at the changelog from 2.4.39-3 to 2.4.39-6 and no change seems to be explicitly syncrepl related, but rather related to LDAPS (strange, as we use the LDAP protocol for syncrepl instead of LDAPS). Anyway, we'll keep version 2.4.39-3 as far as it works well. Thanks. Regards. 2015-04-21 23:53 GMT+01:00 Леонид Юрьев <leo(a)yuriev.ru>: > Hi Nicolás, > > 1) If contextCSN(s) are differs on servers, then are still not > syncronized (or has a glitches). > http://www.openldap.org/lists/openldap-technical/201108/threads.html#00001 > > 2) Replication takes a some time. Therefore contextCSN(s) may be equals > only when some time was no any changes. > > 3) Make sure that the time is synchronized on servers (e.g. by using > ntpdate). > > 4) Unfortunatelly, all current releases (include 2.4.39 and 2.4.40) have > enough bugs in replication code. > For example, by ITS#8081 ( > http://www.openldap.org/its/index.cgi/Software%20Bugs?id=8081) you could > get segfault, but also lost (like undo) some changes by a replication. > > 5) We made a fork of OpenLDAP project for our usecase (highload > TELCO-aware multi-master), it called ReOpenLDAP. > If you decide to build slapd from sources, I recommend use our ReOpenLDAP > ;) > > New features yet not documented in english man-pages, by you can translate > by Google: > https://github.com/ReOpen/ReOpenLDAP/releases/tag/ReOpenLDAP-2.4.41-rc > > https://github.com/ReOpen/ReOpenLDAP/commit/4fc4bc18dd4bd80909aa80700c5c19b… > > https://github.com/ReOpen/ReOpenLDAP/commit/95808b156ee36a886523b7096a75d50… > > https://github.com/ReOpen/ReOpenLDAP/commit/1c94bc17ec285388e8a8299399ed537… > > Leonid. > > 2015-04-21 16:01 GMT+03:00 Nicolás Kovac Neumann <nkovacne(a)ull.edu.es>: > >> Hi, >> >> We're currently using N-way multimaster replication on two servers for >> our LDAP directory, both for the config and the hdb databases. It's working >> fine mostly, but we've run into a possible issue with the syncrepl engine >> which we would like to cast light on. We're using CentOS 7 with >> openldap-servers version 2.4.39-6. >> >> We made an update on one of the entries (server1, in this case), so >> server2 replicated that change (as shown below in the log): >> >> ==> server1/ldap.log <== >> Apr 21 13:38:55 server1 slapd[1835]: do_syncrep2: rid=002 >> cookie=rid=002,sid=002,csn=20150421123855.643239Z#000000#002#000000 >> Apr 21 13:38:55 server1 slapd[1835]: syncrepl_message_to_entry: >> rid=002 DN: uid=user1,cn=subtree,dc=example,dc=org, UUID: >> 18a2436c-73ce-1030-95dd-b52dc05ced13 >> Apr 21 13:38:55 server1 slapd[1835]: syncrepl_entry: rid=002 >> LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_MODIFY) >> Apr 21 13:38:55 server1 slapd[1835]: syncrepl_entry: rid=002 >> be_search (0) >> Apr 21 13:38:55 server1 slapd[1835]: syncrepl_entry: rid=002 >> uid=user1,cn=subtree,dc=example,dc=org >> Apr 21 13:38:55 server1 slapd[1835]: slap_queue_csn: queing >> 0x7ff8f42789f0 20150421123855.643239Z#000000#002#000000 >> Apr 21 13:38:55 server1 slapd[1835]: slap_graduate_commit_csn: >> removing 0x7ff8f435e770 20150421123855.643239Z#000000#002#000000 >> Apr 21 13:38:55 server1 slapd[1835]: syncrepl_entry: rid=002 >> be_modify uid=user1,cn=subtree,dc=example,dc=org (0) >> Apr 21 13:38:55 server1 slapd[1835]: syncprov_sendresp: >> cookie=rid=001,sid=001,csn=20150421123855.643239Z#000000#002#000000 >> Apr 21 13:38:55 server1 slapd[1835]: slap_queue_csn: queing >> 0x7ff8f42789f0 20150421123855.643239Z#000000#002#000000 >> Apr 21 13:38:55 server1 slapd[1835]: slap_graduate_commit_csn: >> removing 0x7ff8f41b7b90 20150421123855.643239Z#000000#002#000000 >> >> ==> server2/ldap.log <== >> Apr 21 13:38:55 server2 slapd[1948]: slap_queue_csn: queing >> 0x7f897affb220 20150421123855.643239Z#000000#002#000000 >> Apr 21 13:38:55 server2 slapd[1948]: syncprov_sendresp: to=001, >> cookie=rid=002,sid=002,csn=20150421123855.643239Z#000000#002#000000 >> Apr 21 13:38:55 server2 slapd[1948]: slap_graduate_commit_csn: >> removing 0x7f89307f42a0 20150421123855.643239Z#000000#002#000000 >> >> Nothing strange up to now, however, if we query the contextCSN, it >> differs on both servers. >> >> For server1, we have: >> >> contextCSN: 20150421123523.281736Z#000000#001#000000 >> contextCSN: 20150421123417.889477Z#000000#002#000000 >> >> For server2, the value for server ID 001 differs: >> >> contextCSN: 20150421115324.003502Z#000000#001#000000 >> contextCSN: 20150421123417.889477Z#000000#002#000000 >> >> However, the entry seems to replicate the entryCSN correctly on both >> servers: >> >> entryCSN: 20150421123417.889477Z#000000#002#000000 >> >> Is this the expected behavior? Shouldn't both contextCSN values match on >> both servers? >> >> Thanks! >> >> Regards, >> >> Nicolás >> >> >

2 1

LMDB usage with long or variable length keys
by Alex V. 24 Apr '15

24 Apr '15

I am new to key-value stores. I would like to use it like big persistent associative array and I want to be able to use long length keys. For example file path or URL. What technique should I use to implement such dictionary on top of LMDB? Probably some kind of hashing and collision resolution? Or just recompile with MDB_MAXKEYSIZE=2047 or something like this? Or LMDB is a wrong tool for this job?

5 7

ldap configuration question
by Ross, Daniel B. 24 Apr '15

24 Apr '15

I have looked a couple options, and read the openldap documentation, but I really dont know how to accomplish what I need to do. Here is what I am trying to do. I have a greater organization that is stuck on using Microsoft products namely Microsoft LDS. To make matters worse they present the data to my linux servers in a completely non-standard way. Its driving my solaris and linux box nuts and they simply dont want to work with it. What i need to do is continue to use the campus usernames and passwords but present the Data in a format that my linux/unix hosts can use. Is this possible? i.e. userid would still be samwise but instead of a bizzarre OU=monkeypeople,dc=example,dc=com I want it to present as people,dc=example,dc=com. The mismatches are far more and I need to add things like nfs mounts and it would be nice to allow users on only certain hosts, none of which their LDS can do, or even if it can they are not willing to do. I looked at referral and aliasing but it does not seem to be doing what I am trying to do. Passthrough authentication looks close but I cant find sufficient documentation to actually configure a system to use it. So what I want to do is use campus for the username and password authentication, but the local ldap for everything else, groups, dns, etc, etc. Thanks Daniel

1 0

Re: Antw: Re: Different contextCSN on multi-master replication servers
by Nicolás Kovac Neumann 24 Apr '15

24 Apr '15

Hi Ulrich, El 24/04/15 a las 07:07, Ulrich Windl escribió: > [...] > After haveing had such problems, I recommand exporting the databases of both > servers and compare the contents: If the mismatch, I'd import one database from > the other server's dump... > > Regards, > Ulrich That's the approach we've been using years ago but as this is a patchy workaround we rather preferred get syncrepl working correctly. After downgrading the package to 2.4.39-3 again it seems to work again, so I think we'll apply the old and good advise "If it works, don't fix it". At least not until a certain time. Thanks. Regards, Nicolás.

1 0

moznss, gnutls, openssl
by Chuck Theobald 24 Apr '15

24 Apr '15

What is the current wisdom regarding which tls library to use? I've got a version 2.4.39 installation on RHEL 6.6 for which I cannot get tls to work. I end up with the "TLS: can't connect: TLS error -5938:Encountered end of file." error. Likely a misconfiguration of moznss, though I followed one set of directions using certutil, but lack the proper setting for my ldap TLSCACertificateFile. My Debian-based ldap servers run with either openssl or gnutls. Thanks, -- Chuck Theobald System Administrator The Robert and Beverly Lewis Center for Neuroimaging University of Oregon P: 541-346-0343 F: 541-346-0345

3 2

solaris ssh key passwordless login openldap,
by Csaba Dobo 24 Apr '15

24 Apr '15

Hi, I am curerntly putting together a system to create a central authentication and have a problem with solaris machines to log in to openldap with sshkey that are stored in openldap. I have found a thread: http://www.openldap.org/lists/openldap-software/200710/msg00041.html that talks about the issue: it seems as if this control is needed in the rootdse request control has an OID of 1.3.6.1.4.1.42.2.27.9.5.8 Problem is I have no idea how to put that in? Do I have to create a special ppolicy? If yes, could you please help? Got any idea? many thanks, Csaba http://man7.org/linux/man-pages/man5/slapo-ppolicy.5.html

2 1

Re: Antw: LMDB usage with long or variable length keys
by Alex V. 24 Apr '15

24 Apr '15

On 4/24/2015 9:02 AM, Ulrich Windl wrote: > > I think this depends very much on your access patterns (which you didn't explain). > > Regards, > Ulrich What required is `get(key)` and `set(key, val)`. And, optional but not unwanted, range lookup.

1 0

mis-identified self-signed cert
by Chuck Theobald 24 Apr '15

24 Apr '15

Built openldap 2.4.40 from source, trying to replicate the directory structure used by RHEL, but using openssl instead of nss. Various dir-placement options to configure got me to a standard RHEL (and typical Linux) structure. I am now trying to start using the /etc/init.d/slapd script from a mostly-working (sans TLS) RHEL installation, but startup fails. Silently. This may be because slapd cannot read the private server key file, but should this not be read before changing the effective running user to ldap? I would like my slapd to be running as something other than user 0. Anyway, I managed to prop up a server from the command line: slapd -F ./slapd.d but now cannot talk to it with TLS enabled: TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 3, err: 19, subject: /C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root, issuer: /C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root TLS certificate verification: Error, self signed certificate in certificate chain TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (self signed certificate in certificate chain). ldap_err2string ldap_start_tls: Connect error (-11) additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (self signed certificate in certificate chain) Enter LDAP Password: The server cert and ca certs I am using are not self-signed, at least by me, and were obtained through Internet2 via our University's central IS department. The same certs are working fine with the web server on my machine. I think the key clue is the "unknown CA" in the messages above. But, how to solve? -- Chuck Theobald System Administrator The Robert and Beverly Lewis Center for Neuroimaging University of Oregon P: 541-346-0343 F: 541-346-0345

2 1

Re: Antw: Re: Slapd running very slow
by Geoff Swan 22 Apr '15

22 Apr '15

On 2015-04-22 11:45 PM, Ulrich Windl wrote: >>>> Geoff Swan <gswan3(a)bigpond.net.au> schrieb am 22.04.2015 um 14:06 in Nachricht > <55378EE0.40103(a)bigpond.net.au>: > >> On 2015-04-22 4:49 PM, Ulrich Windl wrote: > [...] >>>> Are there any clues about key factors affecting this? Linux, in this >>>> case, has vm.swappiness set to 10, vm.dirty_ratio at 12 and >>>> vm.dirty_background at 3. However I've noticed that when dirty pages are >>>> flushed to disc, the system stalls. And that operation appears to take a >>>> relatively long time. Disc write speed should be close to 130MB/s (file >>>> copy, dd test etc) however it appears to be much slower than this with >>>> the page flush. >>> Did you try NOT tuning those? A swapped in-memory database is not the thing >> you usually want. >> Swappiness for an out-of-the-box kernel was 60, which sounds way too >> high. So I reduced it to 10. > Did we see your "free" stats? On a server running SLES11 SP3 (kernel 3.0.101) with similar memory (no slapd, but a huge Oracle and a NFS Server) I have: > # free > total used free shared buffers cached > Mem: 132156276 131202644 953632 40317620 5219804 95059508 > -/+ buffers/cache: 30923332 101232944 > Swap: 20956756 165852 20790904 > > I believe what the system pages out is really "dead meat". According to sar there is little actual paging: > > 00:00:01 pgpgin/s pgpgout/s fault/s majflt/s pgfree/s pgscank/s pgscand/s pgsteal/s %vmeff > 11:00:01 12671.34 1979.03 4469.13 0.00 3412.08 0.00 0.00 0.00 0.00 > 11:10:01 11598.11 1693.74 4949.54 0.01 3466.14 0.00 0.00 0.00 0.00 > 11:20:01 12141.05 4759.01 4219.09 0.02 3753.33 0.00 0.00 0.00 0.00 > 11:30:01 14619.11 1562.84 4185.04 0.00 3134.25 0.00 0.00 0.00 0.00 > > (Most "fage faults" are due to processes staring and ending with demand paging, I guess) > > Regards, > Ulrich > Free stats look fine to me. No swap is being used, or has been used yet on this system. total used free shared buffers cached Mem: 132005400 21928192 110077208 10612 363064 19230072 -/+ buffers/cache: 2335056 129670344 Swap: 8388604 0 8388604 The effect I am seeing is that despite a reasonably fast disc system, the kernel writing of dirty pages is painfully slow.

1 0

Re: Antw: Re: Slapd running very slow
by Geoff Swan 22 Apr '15

22 Apr '15

On 2015-04-22 4:49 PM, Ulrich Windl wrote: >>>> Geoff Swan <gswan3(a)bigpond.net.au> schrieb am 21.04.2015 um 23:19 in Nachricht > <5536BEC9.3040902(a)bigpond.net.au>: > >> On 2015-04-22 6:04 AM, Howard Chu wrote: >>> Brian Reichert wrote: >>>> On Tue, Apr 21, 2015 at 08:23:31AM -0700, Quanah Gibson-Mount wrote: >>>>> --On Tuesday, April 21, 2015 11:54 AM -0400 Brian Reichert >>>>> <reichert(a)numachi.com> wrote: >>>>>> What does your config file look like? >>>>>> >>>>>> In particular, what does this setting look like for you: >>>>>> >>>>>> # Threads - four per CPU >>>>>> threads 8 >>>>> According to his summary, he's using 48 threads. >>>> Thanks for pointing that out; I should finish my coffee before >>>> posting. :) >>>> >>>>> 4 per CPU/core was a good >>>>> rule of thumb with bdb/hdb. So far in playing with back-mdb, it's >>>>> seemed >>>>> closer to 2 per CPU/core for me in benchmarking. >> Interesting. What is the relationship between the number of threads and >> the number of concurrent bind operations? >> If I have, say, 500 clients wanting access to perform simple >> authentication/bind and perform some read/write operation, how is this >> usually handled within slapd? >> >>>> Useful to note. Has this detail ended up in any docs yet? >>> No, nor should it. Performance depends on system environment and >>> workload - the right value is one that each site must discover for >>> themselves in their own deployment. >>> >> Are there any clues about key factors affecting this? Linux, in this >> case, has vm.swappiness set to 10, vm.dirty_ratio at 12 and >> vm.dirty_background at 3. However I've noticed that when dirty pages are >> flushed to disc, the system stalls. And that operation appears to take a >> relatively long time. Disc write speed should be close to 130MB/s (file >> copy, dd test etc) however it appears to be much slower than this with >> the page flush. > Did you try NOT tuning those? A swapped in-memory database is not the thing you usually want. > Swappiness for an out-of-the-box kernel was 60, which sounds way too high. So I reduced it to 10. >

2 2

Slapd running very slow
by Geoff Swan 22 Apr '15

22 Apr '15

I have an ldap server that appears to slow down significantly even under moderate load, and wondered if there were any suggestions as to where to look. Using openldap-2.4.40 with mdb backend, on a dual Xeon (6 cores each) server with 128GB ram. Linux kernel 3.13, separate ext4 db volume (SAS). Slapd configured with 48 threads. The problem appears that as soon as there are a handful of write operations, slapd appears to stall. Binding to the ldap port takes many seconds (instead of instant), and the slapd process appear to occupy 100% of a single CPU core.

4 7

Different contextCSN on multi-master replication servers
by Nicolás Kovac Neumann 21 Apr '15

21 Apr '15

Hi, We're currently using N-way multimaster replication on two servers for our LDAP directory, both for the config and the hdb databases. It's working fine mostly, but we've run into a possible issue with the syncrepl engine which we would like to cast light on. We're using CentOS 7 with openldap-servers version 2.4.39-6. We made an update on one of the entries (server1, in this case), so server2 replicated that change (as shown below in the log): ==> server1/ldap.log <== Apr 21 13:38:55 server1 slapd[1835]: do_syncrep2: rid=002 cookie=rid=002,sid=002,csn=20150421123855.643239Z#000000#002#000000 Apr 21 13:38:55 server1 slapd[1835]: syncrepl_message_to_entry: rid=002 DN: uid=user1,cn=subtree,dc=example,dc=org, UUID: 18a2436c-73ce-1030-95dd-b52dc05ced13 Apr 21 13:38:55 server1 slapd[1835]: syncrepl_entry: rid=002 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_MODIFY) Apr 21 13:38:55 server1 slapd[1835]: syncrepl_entry: rid=002 be_search (0) Apr 21 13:38:55 server1 slapd[1835]: syncrepl_entry: rid=002 uid=user1,cn=subtree,dc=example,dc=org Apr 21 13:38:55 server1 slapd[1835]: slap_queue_csn: queing 0x7ff8f42789f0 20150421123855.643239Z#000000#002#000000 Apr 21 13:38:55 server1 slapd[1835]: slap_graduate_commit_csn: removing 0x7ff8f435e770 20150421123855.643239Z#000000#002#000000 Apr 21 13:38:55 server1 slapd[1835]: syncrepl_entry: rid=002 be_modify uid=user1,cn=subtree,dc=example,dc=org (0) Apr 21 13:38:55 server1 slapd[1835]: syncprov_sendresp: cookie=rid=001,sid=001,csn=20150421123855.643239Z#000000#002#000000 Apr 21 13:38:55 server1 slapd[1835]: slap_queue_csn: queing 0x7ff8f42789f0 20150421123855.643239Z#000000#002#000000 Apr 21 13:38:55 server1 slapd[1835]: slap_graduate_commit_csn: removing 0x7ff8f41b7b90 20150421123855.643239Z#000000#002#000000 ==> server2/ldap.log <== Apr 21 13:38:55 server2 slapd[1948]: slap_queue_csn: queing 0x7f897affb220 20150421123855.643239Z#000000#002#000000 Apr 21 13:38:55 server2 slapd[1948]: syncprov_sendresp: to=001, cookie=rid=002,sid=002,csn=20150421123855.643239Z#000000#002#000000 Apr 21 13:38:55 server2 slapd[1948]: slap_graduate_commit_csn: removing 0x7f89307f42a0 20150421123855.643239Z#000000#002#000000 Nothing strange up to now, however, if we query the contextCSN, it differs on both servers. For server1, we have: contextCSN: 20150421123523.281736Z#000000#001#000000 contextCSN: 20150421123417.889477Z#000000#002#000000 For server2, the value for server ID 001 differs: contextCSN: 20150421115324.003502Z#000000#001#000000 contextCSN: 20150421123417.889477Z#000000#002#000000 However, the entry seems to replicate the entryCSN correctly on both servers: entryCSN: 20150421123417.889477Z#000000#002#000000 Is this the expected behavior? Shouldn't both contextCSN values match on both servers? Thanks! Regards, Nicolás

2 1

C++11 wrapper for LMDB
by Arto Bendiken 21 Apr '15

21 Apr '15

Figured I'd announce this here in case it might be useful to others working with LMDB from C++: https://github.com/bendiken/lmdbxx This is a <lmdb++.h> header file that implements a comprehensive C++ wrapper for LMDB, offering both an error-checked procedural interface and an object-oriented resource interface with RAII semantics. See here for a basic example program using this wrapper: https://github.com/bendiken/lmdbxx/blob/master/example.cc#L1 A quick summary of features (read the README for more information): • Designed to be entirely self-contained as a single <lmdb++.h> header file that can be dropped into a project. • Implements a straightforward mapping from C to C++, with consistent naming. • Provides both a procedural interface and an object-oriented RAII interface. • Simplifies error handling by translating error codes into C++ exceptions. • Carefully differentiates logic errors, runtime errors, and fatal errors. • Exception strings include the name of the LMDB function that failed. • Plays nice with others: all symbols are placed into the lmdb namespace. • 100% free and unencumbered public domain software. The <lmdb++.h> header file requires a C++11 compiler and standard library. Recent releases of Clang or GCC will work fine. The wrapper is pretty complete at this point and is used in a production setting in the implementation of an RDF graph database. Next steps would be to figure out a versioning policy (vis-a-vis LMDB), package it up as a tarball release, and publish the generated Doxygen HTML documentation somewhere. Best regards from springtime Berlin, Arto -- Arto Bendiken | @bendiken | http://ar.to

1 0

slapd verifyclient fails on demand
by E.therepa 21 Apr '15

21 Apr '15

Dear Tech list, I'd like to use CRL's to regulate client connections to my slapd server. So i've build working certs and keys with gnutls. The whole keysetup is tested and working properly, by invoking gnu-serv and gnu-cli i could succesfully create connections and drop clients in my revocation list. In order to use this in slapd/ldap utils i use this settings, slapd.conf, TLSCACertificateFile /etc/ldap/ssl/ca-cert.pem TLSCertificateFile /etc/ldap/ssl/clients/lrc-ldap.crt TLSCertificateKeyFile /etc/ldap/ssl/clients/lrc-ldap.key TLSCRLFile /etc/ldap/ssl/crl.pem TLSCipherSuite SECURE256:-VERS-SSL3.0 TLSVerifyClient hard ldap.conf # TLS certificates (needed for GnuTLS) TLS_CACERT /etc/ldap/ssl/ca-cert.pem TLS_CERT /etc/ldap/ssl/clients/lrc-ldapsearch.crt TLS_KEY /etc/ldap/ssl/clients/lrc-ldapsearch.key TLS_REQCERT hard Slapd debug, 55353d59 slapd starting 55353d5b conn=1000 fd=16 ACCEPT from IP=10.50.2.12:50764 (IP=0.0.0.0:636) TLS: can't accept: No certificate was found.. 55353d5b conn=1000 fd=16 closed (TLS negotiation failure) ldapsearch debug, ldap_start_tls: Can't contact LDAP server (-1) ldap_free_connection 1 1 ldap_send_unbind ber_flush2: 7 bytes to sd 4 0000: 30 05 02 01 02 42 00 0....B. ldap_write: want=7 error=Broken pipe ldap_free_connection: actually freed As far as i can see and found info my client and servers TLS settings are configured properly. What i really don't get is that the client doesnt send his certs to the server. Best regards, E.therepa

6 6

Re: R: Antw: Re: Elapsed Time logging
by Quanah Gibson-Mount 21 Apr '15

21 Apr '15

--On Tuesday, April 21, 2015 1:16 PM +0200 Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de> wrote: >>>> "fabymoscarella(a)virgilio.it" <fabymoscarella(a)virgilio.it> schrieb am >>>> 21.04.2015 > um 11:23 in Nachricht <14cdb4a4678.fabymoscarella(a)virgilio.it>: >> Hi, >> thank you for your interest. I was mistakenly sure of the field's >> availability. >> >> I would have liked to use the "etime" field to monitor OpenLDAP >> dependability through my SIEM platform, by identifying long lasting >> operations. >> Could you please give me some pointers about monitoring "operations >> completed" or any other useful parameter? > ># if you configured monitoring... ># just querying "search" operations here... > e.g. ldapsearch -Y EXTERNAL -H ldapi:/// -b 'cn=operations,cn=monitor' -s > sub '(cn=Search)' monitorOpCompleted As Ulrich notes, simply enable the monitoring backend. I suggest reading up on the slapd-monitor(5) man page. Btw, I've patched my openldap build with the ITS noted, and it's working just fine, although the term is "duration" not "etime". --Quanah -- Quanah Gibson-Mount Platform Architect Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

LDAPCon 2015
by Andrew Findlay 21 Apr '15

21 Apr '15

LDAPCon 2015 ============ **** Please note the new submissions address **** The fifth International Conference on LDAP and Directory Services will be held in the UK at the University of Edinburgh School of Informatics Forum. Tutorials: 11th November 2015 Conference: 12th and 13th November 2015 Call for papers and tutorials ============================= Topics You are using LDAP in interesting projects? You do LDAP client or server development? You have used LDAP in a new way? You do identity and access management on top of LDAP? Why not share your ideas and experiences with others? We are looking for speakers who are willing to talk about any topic related to LDAP and identity management, including: LDAP technology implementation (Servers, API, User interfaces etc.) LDAP Usage (Schema, Security, Operations, Scaling, big data, etc.) LDAP related technologies (PKI, XACML, SAML, etc.) LDAP and Beyond (IAM, Identity Federation, Authentication on the web, etc.) Best Practices for directory services. Accepted talks will be grouped into tracks such as a standards/development and deployment/administration. Deadlines & Important Dates Submission Deadline: 28th June Author Notification: 10th July Final Papers due: 10th October 2015 Tutorials: 11th November 2015 Conference: 12th-13th November 2015 Talk Submissions Main presentations should last about 45 minutes including discussion; we will also provide smaller slots of 15 minutes and 5 minutes for poster presentations or lightning talks. Please tell us which duration you prefer when proposing your talk. The talk must be in English. The one and only way to submit your abstract (approximately 200-800 words, accompanied by your biography of about 100-300 words) is via email to submissions2015(a)lists.ldapcon.org. Abstracts must reach the Program Committee by 28th June 2015. Early submission is encouraged. We already have several papers. All abstracts will be reviewed by the program committee. For accepted talks we expect you to submit slides and/or a paper of approximately 2-10 pages (A4 or US Letter format, 25mm borders, preferably LaTeX source or OpenOffice). For 5-minute talks, a brief abstract is required. A short paper, slides or a poster should be provided for accepted talks. We will provide display boards for posters throughout the conference. By submitting a paper you grant the conference organizers the non-exclusive right to publish your paper in the conference proceedings and on the website; you maintain the right to publish it elsewhere at your discretion. Tutorial Submissions We are looking for high-quality tutorials on LDAP and related subjects, at any level from introductory to advanced. Tutorial length can range from an hour to a full day. Wireless Internet access will be available if required. The purpose of the tutorials is focussed education, so they should cover established topics and best practice rather than presenting new work. Tutorials will be on Wednesday 11th November 2015. The Programme Committee has an open mind about the format of the tutorial day, but has a limited number of rooms available. Make your proposal early and we will aim to build an attractive programme for the day. Expenses Speakers get free access to the conference, including the social event. If requested in advance we will provide accommodation for speakers. Travel expenses might also be covered in special cases. If you need this, please contact us early so we can try to arrange it. Website http://ldapcon.org/2015/ Contacts General enquiries: enquiries(a)lists.ldapcon.org Paper/Tutorial submissions: submissions2015(a)lists.ldapcon.org -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

1 0

R: Antw: Re: Elapsed Time logging
by fabymoscarella＠virgilio.it 21 Apr '15

21 Apr '15

Hi, thank you for your interest. I was mistakenly sure of the field's availability. I would have liked to use the "etime" field to monitor OpenLDAP dependability through my SIEM platform, by identifying long lasting operations. Could you please give me some pointers about monitoring "operations completed" or any other useful parameter? Regards, Fabiano ----Messaggio originale---- Da: Ulrich.Windl(a)rz.uni-regensburg.de Data: 21-apr-2015 8.28 A: <openldap-technical(a)openldap.org>, <fabymoscarella(a)virgilio.it>, "Quanah Gibson-Mount"<quanah(a)zimbra.com> Ogg: Antw: Re: Elapsed Time logging If it's enough to know the average, he could monitor "operations completed" and divide those by elapsed time...

1 0

How to disable SSF (integrity) on GSSAPI mech?
by Osipov, Michael 21 Apr '15

21 Apr '15

Hi folks, I am binding against Active Directory with GSSAPI mech and would like to disable SASL integrity for debugging purposes with Wireshark. Unfortunately, this call fails: char *secprops = "minssf=0,maxssf=0"; rc = ldap_set_option(ld, LDAP_OPT_X_SASL_SECPROPS, secprops); with: Diagnostic message: SASL(-1): generic failure: GSSAPI Error: A required input parameter could not be read (Unknown error) Result code: -2 I am used to this with Java's SASL client where I can set SASL QOP with auth, auth-int, auth-conf. Is that not possible with OpenLDAP along with CyrusSASL? For what it is worth, I am on FreeBSD 9.3 with latest OpenLDAP and CyrusSASL from the ports tree. Regards, Michael

3 5

Elapsed Time logging
by fabymoscarella＠virgilio.it 20 Apr '15

20 Apr '15

Hi everyone, my name is Fabiano and I'm an italian IT Security professional involved in a IAM project which comprises several OpenLDAP instances. I'm using OpenLDAP 2.4.40 on a x86_64 Red Hat Enterprise Linux Server release 6.5 and my target is logging LDAP operations elapsed time. I configured logging through RSyslog but I can't see an "etime" field in my logfiles; below is a sample log row: Apr 20 17:46:56 hostname slapd[9884]: conn=1019 op=0 RESULT tag=97 err=0 text= I'm not using OLC and tried without specifying a "loglevel" parameter in my slapd.conf (default should be 256, shoulndn't it?) and later with several "loglevel" values, but no "etime" field appeared. Could you please help and tell me what am I doing wrong? Thank you in advice, Fabiano Moscarella

2 1

how to check user lock status
by rockwang 20 Apr '15

20 Apr '15

Hi, all I set policy for user as following # default, policies, abc.com dn: cn=default,ou=policies,dc=abc,dc=com objectClass: top objectClass: device objectClass: pwdPolicy cn: default pwdAttribute: userPassword pwdMaxAge: 7776002 pwdExpireWarning: 432000 pwdInHistory: 3 pwdCheckQuality: 1 pwdMinLength: 8 pwdMaxFailure: 5 pwdLockout: TRUE pwdLockoutDuration: 900 pwdGraceAuthNLimit: 0 pwdFailureCountInterval: 0 pwdMustChange: TRUE pwdAllowUserChange: TRUE pwdSafeModify: FALSE my question is how to check user lock status. Another question is pwdMustChange doesn't work in linux client when user first login. Rock.wang

4 4

Structural object class rules
by dE 20 Apr '15

20 Apr '15

"An object or alias entry is characterized by precisely one structural object class superclass chain which has a single structural object class as the most subordinate object class. This structural object class is referred to as the structural object class of the entry." There's a bit of ambiguity with this "which has a single structural object class as the most subordinate object class" What do you mean by 'most subordinate'? Is it that there must be no parallel entries at the same level in the hierarchy?

3 9

Auxiliary object class practically of no use?
by dE 20 Apr '15

20 Apr '15

According to RFC 4512 An entry can belong to any subset of the set of auxiliary object classes allowed by the DIT content rule associated with the structural object class of the entry. From what I understand, this means auxiliary classes do not 'augment'; the no. of attributes which are possible in an entry must be a subset of the structural object class the entry belongs to.

4 8

Help: LDAP using alias to reference value of another attribute
by Poul Etto 17 Apr '15

17 Apr '15

Hi, As we store a lot of information in our LDAP server, we are looking to simplify and optimize our LDAP strucutre. Actually we have plenty OUs (like people and vpn shown hereunder) and lot of fields are duplicate (same fields with same content in different OUs). As this is not optimum and makes us push any change for a user into all concerned OUs, we woul like to use aliasing to avoid duplicating entries: This is an example of what a user would look like: dn: uid=1,ou=people,dc=red,dc=com objectClass: organizationalPerson objectClass: person objectClass: top objectClass: extensibleObject cn: Frank sn: Moses givenName: Frank Moses mail: frank.moses(a)red.com userPassword: {SSHA}XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX uid: 1 This is an example of what is to be found in the vpn account of the same user (we have home made schemas, so there are some special attributes): dn: uid=1,ou=vpn,dc=red,dc=com objectClass: top objectClass: openvpn objectClass: extensibleObject uid: 1 cn: Frank sn: Moses userUid: 1 vpnEnabled: TRUE mail: frank.moses(a)red.com userPassword: {SSHA}XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX As you can see fields cn, sn, mail are the same in both... We would like to change this to make our LDAP more dynamic. Therefore, we changed the vpn account to: dn: uid=1,ou=vpn,dc=red,dc=com objectClass: top objectClass: openvpn objectClass: extensibleObject objectClass: alias uid: 1 aliasedObjectName: uid=1,ou=people,dc=red,dc=com userUid: 1 vpnEnabled: TRUE But when requesting the server with ldapsearch it seems not to work, or maybe we just are missing someting...! For example when requesting the cn of the vpn user we would like to have the cn field in the "uid=1,ou=people,dc=red,dc=com" account. Our search: ldapsearch -W -D "cn=admin,dc=red,dc=com" -x -b 'uid=1,ou=vpn,dc=red,dc=com' cn Gives: # extended LDIF # # LDAPv3 # base <uid=1,ou=vpn,dc=red,dc=com> with scope subtree # filter: (objectclass=*) # requesting: cn # # 1, vpn, red.com dn: uid=1,ou=vpn,dc=red,dc=com # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 But no "cn" value returned... What are we doing wrong ? Thank you, Best regards, ZP

4 16

Re: catch size and performance
by Quanah Gibson-Mount 17 Apr '15

17 Apr '15

--On Thursday, April 16, 2015 8:59 PM +0000 Greg Jetter <gjetter(a)gci.com> wrote: > Hello: > > I, running a openldap setup with one provider and 3 consumers , I am > seeing intermittent problems of replication not happening "Until" the > consumers are re started . This cures the problem. replication starts up > and continues for a while . > > The servers have very large amount of memory , 256 gigs .. > > I configured the hdb backend 'DB_CONFIG' , to have 4 gigs of catch , > could this be causing the replication problem ? > > whats the optional size that keeps openldap happy ? OpenLDAP version? --Quanah -- Quanah Gibson-Mount Platform Architect Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 2

olcHidden breaks slapcat? possible bug in slapcat(8)?
by Igor Shmukler 17 Apr '15

17 Apr '15

Hello, I use olcHidden and set it to true in some instances. This seems to work, yet it breaks slapcat(8) as below: $ sudo slapcat -n 0 5530b282 olcRootPW: value #0: <olcRootPW> can only be set when rootdn is under suffix 5530b282 config error processing olcDatabase={2}hdb,cn=config: <olcRootPW> can only be set when rootdn is under suffix slapcat: bad configuration file! Is this a bug, or the desired behavior? Sincerely, Igor Shmukler

2 1

catch size and performance
by Greg Jetter 17 Apr '15

17 Apr '15

Hello: I, running a openldap setup with one provider and 3 consumers , I am seeing intermittent problems of replication not happening "Until" the consumers are re started . This cures the problem. replication starts up and continues for a while . The servers have very large amount of memory , 256 gigs .. I configured the hdb backend 'DB_CONFIG' , to have 4 gigs of catch , could this be causing the replication problem ? whats the optional size that keeps openldap happy ? thanks Greg

2 1

Fwd: 2.4.40 memory leak?
by Sergey Esin 17 Apr '15

17 Apr '15

Hi all, We're running OpenLDAP 2.4.40 (the latest available release) with just one replica server (connected via TLS) and have the following picture - http://i.imgur.com/om0lMiy.png On the graph you can see memory consumption of the slapd process on the host: in the beginngin it started without replica, then replica server was connected (memory consumption became around 4 Gigs) and then OOM (out-of-memory) killer on linux machine just killed the process. There are ~400 000 users in our ldap database. OpenLDAP was compiled from sources using "./configure --prefix=/ldap2440 --with-tls --enable-slapd". Are there any ways to understand what's is going wrong and how to fix it? This server is really important for us, please share any ideas how to make it stable! My DB_CONFIG is like below: set_flags DB_LOG_AUTOREMOVE set_cachesize 0 524288000 5 set_lg_regionmax 1048576 set_lg_max 10485760 set_lg_bsize 2097512 set_lk_max_locks 23000 set_lk_max_lockers 2300 set_lk_max_objects 2300 -- Regards, Sergey

2 4

Re: olcHidden breaks slapcat? possible bug in slapcat(8)?
by Igor Shmukler 17 Apr '15

17 Apr '15

Hello Ulrich, Not to me, it does not answer the question. How do I connect olcHIdden set to TRUE throwing an error, and FALSE does not? Would you mind making the connection for me, please. Sincerely, Igor Shmukler On Fri, Apr 17, 2015 at 9:38 AM, Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de> wrote: >>>> Igor Shmukler <igor.shmukler(a)gmail.com> schrieb am 17.04.2015 um 09:16 in > Nachricht > <CAA1SNA3DMtE+1ZnzCu_NxeX164ZK3aZ-G7o0q-Dx8KXc5QBxDA(a)mail.gmail.com>: >> Hello, >> >> I use olcHidden and set it to true in some instances. >> This seems to work, yet it breaks slapcat(8) as below: >> $ sudo slapcat -n 0 >> 5530b282 olcRootPW: value #0: <olcRootPW> can only be set when rootdn >> is under suffix >> 5530b282 config error processing olcDatabase={2}hdb,cn=config: >> <olcRootPW> can only be set when rootdn is under suffix >> slapcat: bad configuration file! > > In a message Igor sent to be before, it showed that he has a oldRootPW set, but no olcRootDN. > I guess it answered the question, right? > >> >> Is this a bug, or the desired behavior? >> >> Sincerely, >> >> Igor Shmukler > > > >

1 0

Re: Re: Can domain admins be filtered out with ACLs?
by Igor Shmukler 17 Apr '15

17 Apr '15

Hello Ulrich, I do not doubt that you are right, yet what to understand. Why would be rootdn necessary to fix ACLs when we have the config database without RootDN and therefore that one is cannot be messed up by applying a filter to the RootDN? Not that I doubt wisdom of the design decisions. For my goal, I am going to use olcHidden to achieve what I need instead. If I cannot properly suspend a DIT, I get close to desired results by hiding the database. Sincerely, Igor Shmukler On Fri, Apr 17, 2015 at 8:15 AM, Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de> wrote: >>>> Quanah Gibson-Mount <quanah(a)zimbra.com> schrieb am 16.04.2015 um 20:38 in > Nachricht <C40A1A2544EECEE4E75EA494(a)[192.168.1.9]>: > [...] >>>From the slapd.access(5) man page: >> >> Be warned: the rootdn can always read and write EVERYTHING! > > ...and that is very helpful if you messed up your ACLs... > > [...] > > Regards, > Ulrich > >

1 0

Can domain admins be filtered out with ACLs?
by Igor Shmukler 16 Apr '15

16 Apr '15

Hello, I tried to filter out everyone except cn=config when my ACL filter rule is true (a NAME type attribute matches a value), so that password authentication for filtered-out users would fail. It works for regular users, and does not for admins. Is this because my ACL rules are wrong, or is this a feature of OpenLDAP? Why no matter what I do My LDIF is below: dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcAccess olcAccess: {0}to attrs=userPassword,shadowLastChange filter=(serviceLevel=suspended) by dn="cn=config" write by * none olcAccess: {1}to attrs=userPassword,shadowLastChange filter=(!(serviceLevel=suspended)) by self write by anonymous auth by dn="cn=admin,dc=directory,dc=com" write by dn="cn=config" write by * none olcAccess: {2}to dn.base="" by * read olcAccess: {3}to * filter=(serviceLevel=suspended) by dn="cn=config" write by * none olcAccess: {4}to * filter=(!(serviceLevel=suspended)) by self write by dn="cn=admin,dc=directory,dc=com" write by dn="cn=config" write by * read Is there something special about LDAP administrator, by design? Thank you, Igor Shmukler

2 2

Re: integrate Openldap and Windows Active Directory server 2003
by Clément OUDOT 15 Apr '15

15 Apr '15

2015-04-15 17:48 GMT+02:00 Kaushal Shriyan <kaushalshriyan(a)gmail.com>: > Hi Clement, > > LSC, We proposed a synchronisation mechanism but was rejected since gives a > lot of privileges to the OpenLDAP to change customer data in AD. the > customer don't want it. Is there a way to get over with this specific use > case? > You just need a read-only AD account if you need to sync from AD to OpenLDAP. Clément.

1 0

integrate Openldap and Windows Active Directory server 2003
by Kaushal Shriyan 15 Apr '15

15 Apr '15

Hi, Is there a way to integrate Openldap and Windows Active Directory server 2003 and sync all the Windows AD users in Openldap? Regards, Kaushal

2 1

multiples syncrepl from same host and DB
by julien soula 15 Apr '15

15 Apr '15

hello, I wanted to synchronize 2 branches of a master DB (slapd-2.4.38). So I created 2 olcSyncrepl on the slave : olcSyncrepl: {0}rid=201 provider=ldap://master searchbase="cn=branch1,suffixDB" scope=sub olcSyncrepl: {1}rid=202 provider=ldap://master searchbase="cn=branch2,suffixDB" scope=sub Unfortunatly, it doesn't work. A change on branch2 on the master produces often a "CSN too old" on the slave. After investigating, it seems that the pb comes from the fact there is one contextCSN by DB. So if the sync task on branch1 is the first to process, it updates the contextCSN and therefore the sync task on branch2 thinks that change is not newer. Am I right ? So is there a proper way to achieve what I want ? Thank for any hints, -- Julien << Vous n'avez rien a dire... Parlons-en! >>

3 3

Re: Antw: multiples syncrepl from same host and DB
by julien soula 15 Apr '15

15 Apr '15

On Wed, Apr 15, 2015 at 02:40:37PM +0200, Ulrich Windl wrote: > >>> julien soula <jsoula(a)univ-lille2.fr> schrieb am 15.04.2015 um 13:29 in > Nachricht <20150415112905.GB3225(a)nickel.univ-lille2.fr>: > > hello, > > > > I wanted to synchronize 2 branches of a master DB (slapd-2.4.38). So I > > created 2 olcSyncrepl on the slave : > > > > olcSyncrepl: {0}rid=201 provider=ldap://master > > searchbase="cn=branch1,suffixDB" scope=sub > > olcSyncrepl: {1}rid=202 provider=ldap://master > > searchbase="cn=branch2,suffixDB" scope=sub > > > > Unfortunatly, it doesn't work. A change on branch2 on the master > > produces often a "CSN too old" on the slave. > > > > After investigating, it seems that the pb comes from the fact there is > > one contextCSN by DB. So if the sync task on branch1 is the first to > > process, it updates the contextCSN and therefore the sync task on > > branch2 thinks that change is not newer. Am I right ? > > If the message you are talking about is like this: > slapd[3965]: do_syncrep2: rid=001 CSN too old, ignoring 20150409131449.846699Z#000000#001#000000 (olcDatabase={1}hdb,cn=config) yes > _and_ the CSN received is the CSN sent,... yes > ... then just ignore the message. That is the same server said before: > slapd[3965]: slap_queue_csn: queing 0x7f5f30afcf20 20150409131449.846699Z#000000#001#000000 > > > > > So is there a proper way to achieve what I want ? > > Did you check the databases before and after sync? Are there differences, or are you just worried about the messages? In fact, I first noticed the no-change of the slave then I took a look to the log and saw this message (the only suspect I saw). Is this config supposed to work ? sincerly, -- Julien << Vous n'avez rien a dire... Parlons-en! >>

1 1

Re: multiples syncrepl from same host and DB
by Abdelhamid MEDDEB 15 Apr '15

15 Apr '15

Hi, I don't think so. Try instead: olcSyncrepl: {0}rid=201 provider=ldap://master searchbase="suffixDB" filter="(<a filter who return data in both branch1 and 2>)" ... Reset the data in slave before trying again Maybe it would be better Cheers Le 15/04/2015 14:00, openldap-technical-request(a)openldap.org a écrit : hello, I wanted to synchronize 2 branches of a master DB (slapd-2.4.38). So I created 2 olcSyncrepl on the slave : olcSyncrepl: {0}rid=201 provider=ldap://master searchbase="cn=branch1,suffixDB" scope=sub olcSyncrepl: {1}rid=202 provider=ldap://master searchbase="cn=branch2,suffixDB" scope=sub Unfortunatly, it doesn't work. A change on branch2 on the master produces often a "CSN too old" on the slave. After investigating, it seems that the pb comes from the fact there is one contextCSN by DB. So if the sync task on branch1 is the first to process, it updates the contextCSN and therefore the sync task on branch2 thinks that change is not newer. Am I right ? So is there a proper way to achieve what I want ? -- *Abdelhamid MEDDEB* http://www.meddeb.net

1 0

Re: Help: LDAP using alias to reference value of another attribute
by Quanah Gibson-Mount 14 Apr '15

14 Apr '15

--On Tuesday, April 14, 2015 5:52 PM +0400 Poul Etto <zepouletto(a)gmail.com> wrote: > There are "u" user accounts on the ldap server > We have a number of "s" services that use LDAP to manage user account. > Each service has particular attributes > Each service must be able to access only it's information > Basic services use only the information contained in the standard LDAP > useraccount > Advanced services have dedicated OUs with special attributes > > It is important that each service can accees in RO (no modification) to > only it's information. > That's why we made our LDAP as it is in the attached picture. This is what custom objectClasses and ACLs are for. Here's an example of a directory set up correctly: <https://itservices.stanford.edu/service/directory/datadefs/accounts> Where services are tied to the user object, with their own specific attributes. ACLs can be used to restrict what data a given service can retrieve. --Quanah -- Quanah Gibson-Mount Platform Architect Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

can't chang ldap user passwd by self
by rockwang 14 Apr '15

14 Apr '15

hi,guys I just setup a openldap server via compile command as following. ./configure --prefix=/opt/openldap --enable-overlays=mod --enalbe-dynamic=yes --enable-modules=yes --enable-ppolicy=yes slapd.conf as below include /opt/openldap/etc/openldap/schema/core.schema include /opt/openldap/etc/openldap/schema/cosine.schema include /opt/openldap/etc/openldap/schema/inetorgperson.schema include /opt/openldap/etc/openldap/schema/nis.schema include /opt/openldap/etc/openldap/schema/openldap.schema include /opt/openldap/etc/openldap/schema/ppolicy.schema pidfile /opt/openldap/var/run/slapd.pid argsfile /opt/openldap/var/run/slapd.args access to attrs=userPassword by self write by anonymous auth by dn.base="cn=Manager,dc=abc,dc=com" by * none access to * by self write by dn.base="cn=Manager,dc=abc,dc=com" by * read by * none database bdb suffix "dc=abc,dc=com" rootdn "cn=Manager,dc=abc,dc=com" rootpw 12345678 directory /opt/openldap/var/openldap-data index cn,sn,uid pres,eq,approx,sub index objectClass eq loglevel -1 my question is user can't change his own password. I use following command so I have different result. when not add -x is there error in my config file about acl. I have set pwdRest is true. I need help. thks

4 6

Where are 'attribute names' in the RFC?
by dE 12 Apr '15

12 Apr '15

I was reading https://tools.ietf.org/html/rfc4512; there is a mention of attribute description, but there is no mention of 'attribute name'; or the name using which attributes are referred to. Does such a thing exist or is one of the attribute options used as the name to refer to it or is it in the attribute description?

1 1

ldap_sasl_interactive_bind_s works while ldap_sasl_bind_s does not (GSSAPI bind)
by Osipov, Michael 10 Apr '15

10 Apr '15

Hi folks, I am trying to perform a SASL bind against Active Directory with GSSAPI mech. I wrote a very simple C client which should serve as a proof of concept. I read the man page about both methods [1] and decided to try ldap_sasl_bind_s first. I saw that ldap_sasl_bind_s never sends a Kerberos token to the server (Wireshark capture). Then I tried ldap_sasl_interactive_bind_s as in ldapsearch after fiddler with interact and defaults, which is by the way not very helpful described in the man page, though [2] helped a lot. This one works flawlessly. The difference between both is not really clear to me because we aren't going to use any interactive code. Our goal is to write attribute retrieval for headless libs. A day after, I have downloaded the source tarball and saw that ldap_sasl_bind_s never calls sasl_client_start where ldap_sasl_interactive_bind_s actually does. Additionally, I have found gssapi.c with ldap_int_gss_spnego_bind_s and ldap_gssapi_bind_s where both init the GSS context and loop over the tokens with ldap_sasl_bind_s. Does that ultimately mean that one should avoid ldap_sasl_bind_s altogether and work with ldap_sasl_interactive_bind_s regardless of the mech(s) used? [1] http://www.openldap.org/software/man.cgi?query=ldap_sasl_bind_s&sektion=3&a… [2] http://adam.younglogic.com/2012/02/exteranl-sasl/ Regards, Michael

1 0

can't chang password via simple authentication
by rockwang 09 Apr '15

09 Apr '15

hi,guys I can't chang user password via simple authentication at ldap client. I have set acl rule in slapd.conf. access to attr=userPassword by self write by anonymous auth by dn.base="cn=Manager,dc=abc,dc=com" write by * none access to * by self write by dn.base"cn=Manager,dc=abc,dc=com" write by * read ldappasswd -x -D "uid=bobliu,ou=it,dc=abc,dc=com" -W -S New password: Re-enter new password: Enter LDAP Password: ldap_bind: Invalid credentials (49) but can use ldapsearch via simple authentication. what about problem. thks

2 1

Re: Very slow ldapserach
by Saša-Stjepan Bakša 09 Apr '15

09 Apr '15

On 9 April 2015 at 17:57, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, April 09, 2015 10:21 AM +0200 Saša-Stjepan Bakša < > ssbaksa(a)gmail.com> wrote: > >> And search for all still crashes openldap server >> >> ldapsearch -h 10.14.252.103 -p 389 -D cn=admin,dc=spr -w siemens -s sub >> -a always -b dc=SPR objectClass=* >> >> >> I must wait for 2.4.41 release then. In the mean time I will use LTB >> project build with HDB to see can I have that version in working state >> for my colleagues test suite. >> > > Hi Sasa, > > Thanks for checking. Looks like there is some more work to do in this > area before 2.4.41 releases. I wil be asking you to do further testing in > the near future. If it were possible for you to provide me an example DB > and your slapd configuration that replicates this behavior, it would help > with a resolution. > > --Quanah Hi Quanah, I will be more than happy to provide help with testing. I am at home now but tomorrow morning (8:00 CET) I will provide as much data as I can to you. As some of data can be of sensitive nature, may be I will be obliged to send it directly to you. Is that Ok with you? Best regards, Sasa

1 0

Re: Very slow ldapserach
by Saša-Stjepan Bakša 09 Apr '15

09 Apr '15

On 9 April 2015 at 17:57, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, April 09, 2015 10:21 AM +0200 Saša-Stjepan Bakša < > ssbaksa(a)gmail.com> wrote: > >> And search for all still crashes openldap server >> >> >> >> I must wait for 2.4.41 release then. In the mean time I will use LTB >> project build with HDB to see can I have that version in working state >> for my colleagues test suite. >> > > Hi Sasa, > > Thanks for checking. Looks like there is some more work to do in this > area before 2.4.41 releases. I wil be asking you to do further testing in > the near future. If it were possible for you to provide me an example DB > and your slapd configuration that replicates this behavior, it would help > with a resolution. > > --Quanah > > And again I did stupid thing to send withoth checking recipient. I hate this Gmail web interface. Sorry.

1 0

Bug with MDB backend and onelevel scope
by Côme BERNIGAUD 09 Apr '15

09 Apr '15

Hello, I got this weird behavior: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=782212 Summary: # LDAPv3 # base <ou=wheezy,ou=debian,ou=fai,ou=configs,ou=systems,dc=mcmic,dc=test> with scope oneLevel # filter: objectClass=FAIbranch # requesting: ALL # # wheezy, debian, fai, configs, systems, mcmic.test dn: ou=wheezy,ou=debian,ou=fai,ou=configs,ou=systems,dc=mcmic,dc=test This dn should not be in the results as it’s the base and the scope is oneLevel. As I managed to build slapd from http://www.openldap.org/software/download/ and reproduce the problem I thought I should ask here if anyone already encountered this kind of problems. It only happens with MDB, with this particular base and filter (filter "ou=wheezy" for instance works correctly). Any idea what the root of this problem could be?

3 2

Re: Very slow ldapserach
by Saša-Stjepan Bakša 09 Apr '15

09 Apr '15

On 9 April 2015 at 02:37, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Wednesday, April 08, 2015 8:51 PM +0200 Saša-Stjepan Bakša < > ssbaksa(a)gmail.com> wrote: > > I am sorry for this mistake with answering to you and not to the group. >> It was unintentional mistake. >> >> >> Ok, I will check ITS#7657. >> > > Please try current RE24 code. It is believed the fixes for ITS#8011 which > are scheduled to be part of the 2.4.41 relase should resolve the issue. > > Thanks, > > Quanah > > At 8:00 local time: git checkout OPENLDAP_REL_ENG_2_4 git pull Build + test root@test:~# date; ldapsearch -h 10.14.252.103 -p 389 -D cn=admin,dc=spr -w siemens -s sub -a always -b msisdn=385212000009,dc=MSISDN,dc=SPR objectClass=*; date *Thu Apr 9 08:22:46 CEST 2015* # extended LDIF # # LDAPv3 # base <msisdn=385212000009,dc=MSISDN,dc=SPR> with scope subtree # filter: objectClass=* # requesting: ALL # ----- cut------ # search result search: 2 result: 0 Success # numResponses: 9 # numEntries: 8 *Thu Apr 9 08:23:38 CEST 2015* Nothing changed yet - 52 seconds And search for all still crashes openldap server ldapsearch -h 10.14.252.103 -p 389 -D cn=admin,dc=spr -w siemens -s sub -a always -b dc=SPR objectClass=* 552641e7 >>> dnPrettyNormal: <dc=SPR> 552641e7 <<< dnPrettyNormal: <dc=SPR>, <dc=spr> ber_scanf fmt (m) ber: ber_scanf fmt ({M}}) ber: 552641e7 => mdb_search 552641e7 mdb_dn2entry("dc=spr") 552641e7 => mdb_dn2id("dc=spr") 552641e7 <= mdb_dn2id: got id=0x1 552641e7 => mdb_entry_decode: 552641e7 <= mdb_entry_decode 552641e7 search_candidates: base="dc=spr" (0x00000001) scope=2 552641e7 => mdb_equality_candidates (objectClass) 552641e7 => key_read 552641e7 <= mdb_index_read 10000000 candidates 552641e7 <= mdb_equality_candidates: id=-1, first=16, last=10000015 Segmentation fault I must wait for 2.4.41 release then. In the mean time I will use LTB project build with HDB to see can I have that version in working state for my colleagues test suite. Br Sasa

2 1

LMDB and HP-UX Itanium
by Kristian Amlie 09 Apr '15

09 Apr '15

I'm wondering if the LMDB database has been tested on HP-UX with the Itanium processor? We are trying to use the database there and are seeing strange errors that don't occur on other platforms. Examples are assertions when trying to do cross process access and values not making it into the database correctly. I can provide more details, but I thought I would ask about the current status first. -- Kristian

3 11

LMDB error
by Shu, Xinxin 09 Apr '15

09 Apr '15

Hi list , I am working on intergrating LMDB with ceph, I met follow error "Invalid argument" when I commit transaction to LMDB, details are descripted as following. Two threads operate on LMDB, each thread is responsible for create write transaction and read transaction , the write transaction will update LMDB, and read transaction is for iterator that read values from LMDB, the two threads share same MDB_env. I check mdb_txn_commit source code , there are two places to return "EINVAL", 1. if (txn == NULL || txn->mt_env == NULL) return EINVAL; 2. if (txn != env->me_txn) { DPUTS("attempt to commit unknown transaction"); rc = EINVAL; goto fail; } I check txn and txn->mt_env and rule out the first case , so only the second case cause "EINVAL", and variable env->me_txn is only initialized when you start a write transaction with mdb_txn_open, and there is a lock to prevent several writer from operating on LMDB. Btw , I tried to add lock to synchronize the two threads , everything seems ok. My question is in what situation can cause "txn != env-> me_txn",. I'm very new to LMDB, if there is anything wrong, please correct me. Cheers, xinxin

2 1

Re: Very slow ldapserach
by Saša-Stjepan Bakša 09 Apr '15

09 Apr '15

On 8 April 2015 at 18:05, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Wednesday, April 08, 2015 11:58 AM +0200 Saša-Stjepan Bakša < > ssbaksa(a)gmail.com> wrote: > > >> >> I have tested search with your suggestion. No crash - slapd crashes only >> when deref is on or in best case it is slow (10 to 20 seconds for >> answer). As I have said, when database is small (relative size) it is >> quick as we expected. >> >> >> So, which alternatives do I have? Back to hdb? Uh, I don't like it to >> much. >> >> Is this long standing issue a big problem to solve? I am not developer so >> maybe this was a rude question (sorry!). >> > > Please keep replies on the list if you want help. > > My guess is this is ITS#7657. > > > --Quanah > > I am sorry for this mistake with answering to you and not to the group. It was unintentional mistake. Ok, I will check ITS#7657. Sasa

2 1

two namingContexts problem
by Wang, Hui 09 Apr '15

09 Apr '15

Hi, All, I got two nameContexts, but I only set up one in slapd.conf which is o=csun. Is there any way to find out where the other nameContexts coming from? Is this normal? I also searched all the files on Linux, I didn’t find any file contains “cn=changelog” in the file content. [root@oldaptest01 init.d]# ldapsearch -x -b '' -s base '(objectclass=*)' namingContexts # extended LDIF # # LDAPv3 # base <> with scope baseObject # filter: (objectclass=*) # requesting: namingContexts # # dn: namingContexts: cn=changelog namingContexts: o=csun # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 # find -name "*.conf" -print | xargs grep -i "cn=change" No result Thank you Hui

1 0

[lmdb] MDB_BAD_DBI error upon mdb_txn_commit (newbie question)
by HLaw 08 Apr '15

08 Apr '15

Dear list, I am new to lmdb and my apologies if this is on something obvious. I encountered the MDB_BAD_DBI error in a simple single process, multi-threaded program using lmdb. The scenario is : * One thread doing a relatively long write transaction mdb_txn_begin -> mdb_dbi_open on several database -> (write) -> mdb_txn_commit * Another thread (or other threads) of the same process doing short read-only transactions mdb_txn_begin -> mdb_dbi_open on some of the database above -> (read) -> mdb_txn_commit As per the advice in the document I do not close the database directly. Also the environment created / opened is shared by all threads, being in the same process. All is fine when these threads execute separately, but if the read transaction thread(s) open the database and commit within the time span of the write transaction in another thread, the above error occurs upon attempt to commit the write transaction. I have done a search on the MDB_BAD_DBI error and noticed the commit below. https://gitorious.org/mdb/mdb/commit/0401f2deed75a83d2de790b8a1313e1792e5a0… Upon a brief look into this and the source of lmdb, my understanding is that the error is due to the increment of lmdb's internal sequence numbers of the database kept by the environment (by the read thread when the read transaction commits). When the write thread subsequently tries to commit, the database sequence number kept privately by the write transaction (copied from the environment when the transaction began) does not match that of the environment, causing the error. To avoid this in a single process multi-threaded environment, it seems that no read transactions could commit on databases while they are involved in a write transaction, i.e. I need to complete all read transactions before a write transaction on the same database could begin. Alternatively, to have concurrent read transactions with a write transaction, the read transactions have to take place in a separate process (such that they would not share the same environment and caught by the above error). Grateful if anyone could kindly enlighten me on whether the understanding is correct, or if I am doing something contrary to the how lmdb should be used. Thank you very much. - H Law

4 5

Re: Very slow ldapserach
by Quanah Gibson-Mount 08 Apr '15

08 Apr '15

--On Wednesday, April 08, 2015 11:58 AM +0200 Saša-Stjepan Bakša <ssbaksa(a)gmail.com> wrote: > > > > > > On 7 April 2015 at 21:14, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > > --On Tuesday, April 07, 2015 1:10 PM -0700 Quanah Gibson-Mount > <quanah(a)zimbra.com> wrote: > > > > ldapsearch -h 10.14.252.104 -p 389 -D cn=admin,dc=spr -w password -s sub > -a always -b dc=SPR objectClass=* > > > Sounds like there's something wrong with your openldap build or server. > Zimbra has clients with DBs of various sizes and entry counts, often in > the multi-GBs, and we're not seeing any such issues. > > > Actually, you are doing alias deref. I believe there's a known issue > with back-mdb and alias deref. Do you see the same behavior if you > select -a never instead? > > > > --Quanah > > > > > Yes, we are depending on aliases. Without them we will need at least 2 > searches to get data we need. In new version even more because we have > data which is similar to many users and we use another aliases inside > each user to fetch that data for particular user. Let we say that each > user have 3 aliases to 3 groups of data which can have at leas 30 > different possibilities for each user. Without aliases data size for each > user will be to big and in summary database will be huge. > > > I have tested search with your suggestion. No crash - slapd crashes only > when deref is on or in best case it is slow (10 to 20 seconds for > answer). As I have said, when database is small (relative size) it is > quick as we expected. > > > So, which alternatives do I have? Back to hdb? Uh, I don't like it to > much. > > Is this long standing issue a big problem to solve? I am not developer so > maybe this was a rude question (sorry!). Please keep replies on the list if you want help. My guess is this is ITS#7657. --Quanah -- Quanah Gibson-Mount Platform Architect Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Openldap NON responsive frequently
by MOHAMED Akbar 08 Apr '15

08 Apr '15

Hello, Current openldap setup is REPLICATION, with MirrorMode on. Host is solaris11. Frequently the clients(mostly solaris10), complain of : libsldap: Status: 91 Mesg: openConnection: simple bind failed - Can't connect to the LDAP server Restarting the opeldap service fixes this How can I fix this issue? ******************************* This e-mail contains information for the intended recipient only. It may contain proprietary material or confidential information. If you are not the intended recipient you are not authorised to distribute, copy or use this e-mail or any attachment to it. Murex cannot guarantee that it is virus free and accepts no responsibility for any loss or damage arising from its use. If you have received this e-mail in error please notify immediately the sender and delete the original email received, any attachments and all copies from your system.

2 1

Definition of an object.
by dE 08 Apr '15

08 Apr '15

Hi! I was reading RFC 4512, here there is a mention of 'object' for the first time in "Object identifiers (OIDs) [X.680] are represented in....". Question is what is an object? Is it an entry (aka directory) in the server?

2 2

Very slow ldapserach
by Saša-Stjepan Bakša 07 Apr '15

07 Apr '15

Hi, Year ago we have tested openldap with back_mdb and it was fantastic. Search worked as a charm. Database was filled with 20 mil. users and serach returned some 20 k results per sec (my colegue did the test). Now we need that setup for some tests and we encountered very slow response - 1 search for user data with some aliased data need 8 to 20 seconds to be retrieved. ldapsearch -h 10.14.252.104 -p 389 -D cn=admin,dc=spr -w test -s sub -a always -b num=1234563123,dc=num,dc=SPR ObjectClass=* num=1234563123,dc=num,dc=SPR is alias to uid aliasedObjectName: uid=1234563123,ds=USERS,o=STANDARD,dc=spr We build our openldap from git source. We have tried new as older versions as well and no change is seen. Hardware: SuperMicro, 2xQuad core, 32 GB RAM, RAID 10 storage. HP blade 2xQuad core, 64 GB RAM sorage 2 disks in mirror. Results are the same and not depending on hardware. Openldap ver: root@centdevel openldap# git log commit 68d9aa207f51b4d1ef29bb9876e7da8c7eaf0eee Author: Quanah Gibson-Mount <quanah(a)openldap.org> Date: Tue Apr 8 21:16:52 2014 -0500 ITS#7430, ITS#6359 OS is Centos 6.4 (also tryed on Centos 6.6)numx mdb config part is: [root@spr2 cn=config]# cat olcDatabase\=\{1\}mdb.ldif # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 2c245069 dn: olcDatabase={1}mdb objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb olcDbDirectory: /opt/openldap/var/openldap-data olcSuffix: dc=spr olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymou s auth by dn="cn=admin,dc=spr" write by * none olcAccess: {1}to attrs=shadowLastChange by self write by * read olcAccess: {2}to dn.base="" by * read olcAccess: {3}to * by self write by dn="cn=admin,dc=spr" write by * read olcLastMod: TRUE olcRootDN: cn=admin,dc=spr olcRootPW:: xyzdgsdsadeew olcDbCheckpoint: 4096 10 olcDbNoSync: TRUE olcDbIndex: objectClass eq olcDbIndex: uid eq olcDbIndex: num eq olcDbIndex: numx eq olcDbIndex: Username eq olcDbIndex: entryCSN eq olcDbIndex: entryUUID eq olcDbIndex: contextCSN eq olcDbMaxSize: 16106127360 structuralObjectClass: olcMdbConfig entryUUID: 21ac150c-6b30-1034-9009-81396a683c5e creatorsName: cn=admin,cn=config createTimestamp: 20150330135513Z entryCSN: 20150330135513.544218Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20150330135513Z MDB database stat: [root@spr2 openldap]# /opt/openldap/sbin/mdb_stat /opt/openldap/var/openldap-data/ -e -rr -a Environment Info Map address: (nil) Map size: 16106127360 Page size: 4096 Max pages: 3932160 Number of pages used: 1523336 Last transaction ID: 16058165 Max readers: 126 Number of readers used: 0 Reader Table Status (no active readers) 0 stale readers cleared. (no active readers) Status of Main DB Tree depth: 1 Branch pages: 0 Leaf pages: 1 Overflow pages: 0 Entries: 11 Status of ad2i Tree depth: 1 Branch pages: 0 Leaf pages: 1 Overflow pages: 0 Entries: 38 Status of contextCSN Tree depth: 0 Branch pages: 0 Leaf pages: 0 Overflow pages: 0 Entries: 0 Status of dn2i Tree depth: 4 Branch pages: 2937 Leaf pages: 333338 Overflow pages: 0 Entries: 16000069 Status of entryCSN Tree depth: 3 Branch pages: 3 Leaf pages: 307 Overflow pages: 0 Entries: 8000034 Status of entryUUID Tree depth: 3 Branch pages: 259 Leaf pages: 62932 Overflow pages: 0 Entries: 8000034 Status of id2e Tree depth: 4 Branch pages: 4446 Leaf pages: 1000005 Overflow pages: 0 Entries: 8000034 Status of numx Tree depth: 3 Branch pages: 128 Leaf pages: 22295 Overflow pages: 0 Entries: 2000004 Status of num Tree depth: 3 Branch pages: 129 Leaf pages: 22325 Overflow pages: 0 Entries: 2000004 Status of objectClass Tree depth: 1 Branch pages: 0 Leaf pages: 1 Overflow pages: 0 Entries: 29 Status of Username Tree depth: 0 Branch pages: 0 Leaf pages: 0 Overflow pages: 0 Entries: 0 Status of uid Tree depth: 3 Branch pages: 34 Leaf pages: 7883 Overflow pages: 0 Entries: 1000004 Build config: make clean ./configure --enable-hdb=no \ --enable-bdb=no \ --enable-monitor=yes \ --prefix=/opt/openldap \ --enable-local=yes \ --enable-accesslog=yes \ --enable-syncprov=yes \ --enable-debug=yes make depend make #STRIP='' rm -r /opt/openldap/etc/openldap/schema make install #STRIP='' removing debug has no efect Do you have any hint for us? Br Sasa

4 8

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical