- openldap-technical - openldap.org

Multiple programs not able to read LMDB concurrently
by Sravan Kumar Reddy Javaji 02 Apr '15

02 Apr '15

Hello Everyone, I am trying to access same LMDB source using multiple programs at the same time. I set max_readers to 2 at the time of creating environment by the first program, but still second program is not able to read the LMDB. Could some one please let me know how could I implement this feature? - Thanks and Regards, Sravan

2 2

how to enable debug message
by Shu, Xinxin 02 Apr '15

02 Apr '15

Hi list , I want to enable debug message for lmdb, I have noticed MDB_DEBUG Macro, and I define MDB_DEBUG when compiling lmdb, but did not get any debug message, how can I enable debug message ?

2 1

mirror entries with rewrite?
by Christian Bösch 01 Apr '15

01 Apr '15

Hi, I want to mirror entries from a subtree to another virtual tree. I tried with rwm-rewrite which works for rewriting but I want to keep the real entries. Is therefor rwm-rewrite the wrong approach or is that possible? Thanks in advance, Chris

1 0

Sorting the NAME Attribute
by Tim Gustafson 01 Apr '15

01 Apr '15

In the following post: http://www.openldap.org/cgi-bin/wilma_hiliter/openldap-technical/201001/msg… Quanah said: > However, I will note, the definitions of these attributes are RFC > defined. They have no ORDERING rule on purpose. I was not able to find what that purpose was. Does anyone have any idea why it was decided that something as critical as "name" attributes shouldn't have an ORDERING rule? In my case, I have users who have a lower-case first-letter in their last name, which makes them appear at the bottom of all lists of people when sorted on the LDAP server. Needless to say, this makes them unhappy. For most of my purposes, I simply sort the data in my code once it is retrieved from the LDAP server, but in some cases I don't have control over the software being used and therefore can't change it, and in other cases this is terribly inefficient or impractical. Other than "because the RFC says so", what's the reasoning behind not defining an ORDERING rule for "name" attributes", preferably one that is case-insensitive? Could it at least be made a build option to enable or disable an ORDERING rule on at least that attribute (or perhaps in a more general configurable way for other attributes as well), even if it's not truly RFC-compliant? -- Tim Gustafson tjg(a)ucsc.edu 831-459-5354 Baskin Engineering, Room 313A

1 1

disable logins with ACLs
by Igor Shmukler 31 Mar '15

31 Mar '15

Hello, I am trying to disable user logins for expired trial users. After searching online, finally found a useful thread from this very list archived http://www.openldap.org/lists/openldap-technical/201111/msg00165.html I accidentally tried to mess with userPassword hash, but it did not work me. Since in that thread Michael showed/shared a better way to achieve the same goal of disabling users with ACLs, I am trying to copy his method. I attempted to follow Michael's example. It has not worked yet. Below is my script: dn: olcDatabase={3}hdb,cn=config changetype: modify replace: olcAccess olcAccess: {0}to attrs=userPassword,shadowLastChange filter=(&(objectClass=inetOrgPerson)(serviceLevel=suspended)) by dn="cn=config" write by * none olcAccess: {1}to attrs=userPassword,shadowLastChange filter=(&(objectClass=inetOrgPerson)(!(serviceLevel=suspended))) by self write by anonymous auth by dn="cn=admin,dc=directory,dc=apple,dc=com" write by dn="cn=config" write by * none olcAccess: {2}to dn.base="" by * read olcAccess: {3}to * filter=(&(objectClass=inetOrgPerson)(serviceLevel=suspended)) by dn="cn=config" write by * none olcAccess: {4}to * filter=(&(objectClass=inetOrgPerson)(!(serviceLevel=suspended))) by self write by dn="cn=admin,dc=directory,dc=apple,dc=com" write by dn="cn=config" write by * read Currently, ldapmodify(1) is failing with an implementation specific error, likely due to messed-up syntax or something. The additional info: <olcAccess> handler exited with 1 Michael's example is not written for OLC, so I managed to do something wrong. Any ideas? Thank you, Igor Shmukler

1 0

sane ppolicy choices
by Igor Shmukler 31 Mar '15

31 Mar '15

Hello, I am trying to implement a trial [period] for new customers, using the OpenLDAP password policy overlay. I was thinking about setting a combination of pwdMaxAge, pwdMustChange and pwdAllowUserChange. Basically, the best idea I have had is to set MaxAge to the length of trial [in seconds] then in a user changes the password while in trial mode, calculate MaxAge as (trial_length - time_passed), then at the end setting MustChange to true and AllowUserChange to false [until the trial has been converted]. Is that a sane policy? Should I be doing something totally different? Please advise. Sincerely, Igor Shmukler

3 5

Re: Q: different SSF settings for ldapi:// than for ldap:
by Michael Ströder 30 Mar '15

30 Mar '15

Ulrich Windl wrote: > Isn't the SSF strength for ldapi:// zero? The SSF strength of ldapi:// is whatever you set with configuration directive localSSF. It's your local security policy decision. Personally on my systems I don't see any problem with setting it to an equal strength like a strongly encrypted TLS connection. YMMV. Ciao, Michael.

1 0

Re: Antw: Re: Q: different SSF settings for ldapi:// than for ldap:
by Michael Ströder 30 Mar '15

30 Mar '15

Ulrich Windl wrote: >>>> Michael Ströder<michael(a)stroeder.com> schrieb am 30.03.2015 um 11:24 in > Nachricht <55191633.90204(a)stroeder.com>: >> Ulrich Windl wrote: >>>>>> Michael Ströder<michael(a)stroeder.com> schrieb am 29.03.2015 um 12:12 in >>>> I have this in my config: >>>> >>>> # SSF value for ldapi:// >>>> localSSF 256 >>> >>> What I don't understand here is: Doesn't "256" _require_ encryption for >>> ldapi:// then? >> >> There is a reason for everything I write, especially this sentence: >> >> >> See slapd.conf(5) for details. >> >> Learn to read the fine docs. > > What really annoys me in this list are answers like "I know, you dont't. Try > to find out yourself!". Is it really too demanding to look up the text yourself when I point out a particular configuration directive *and* point to the relevant man page? My impression was that you did not read the text before asking back. > Here's what the manual page says: > -- > localSSF <SSF> > Specifies the Security Strength Factor (SSF) to be given > local > LDAP sessions, such as those to the ldapi:// listener. For > a > description of SSF values, see sasl-secprops's minssf > option > description. The default is 71. > -- > So where is the answer what 255 means? And what is the meaning of 71? (I guess > 71 bit encryption; so I guess 255 means 255-bit encryption, but you say I'm > wrong) Yes, the default is 71 which is lower than what you specified as minssf. Ciao, Michael.

1 0

Re: Antw: Re: external authentication source
by Hallvard Breien Furuseth 30 Mar '15

30 Mar '15

On 23. mars 2015 12:45, Ulrich Windl wrote: > Related question: If the command above fails with "stronger confidentiality required", and adding "-ZZ" fails with " TLS: hostname does not match CN in peer certificate", how should a proper certificate look like? Read the OpenLDAP Admin Guide, section 16 (TLS). In particular 16.1.1. Server Certificates. -- Hallvard

3 3

installing slapd no_configuration true
by Igor Shmukler 30 Mar '15

30 Mar '15

Hello, I have been trying to install slapd without configuration, so I could do the configuration manually [specifically to customize my "organization" objectClass]. I have been using debconf-set-selections and noninteractive install. It worked fine when I would do non interactive config database configuration and also DIT database configuration. When I set "slapd slapd/no_configuration boolean true" setup fails. The error is below: Omitting slapd configuration as requested. * No configuration file was found for slapd at /etc/ldap/slapd.conf. invoke-rc.d: initscript slapd, action "start" failed. dpkg: error processing package slapd (--configure): subprocess installed post-installation script returned error exit status 1 Processing triggers for ureadahead (0.100.0-16) ... Processing triggers for ufw (0.34~rc-0ubuntu2) ... Errors were encountered while processing: slapd E: Sub-process /usr/bin/dpkg returned an error code (1) I understand that the issue might be debian-related and have little to do with OpenLDAP, per say. Still, to be sure that I did not do something completely wrong, and to tap into collective wisdom; I would love for someone experienced to comment. What would be the easiest way to install slapd, ideally with config database setup, without a DIT database? I want to manually add DIT database[s] later. I got that part down. Sincerely, Igor Shmukler

5 6

Re: Q: different SSF settings for ldapi:// than for ldap:
by Michael Ströder 30 Mar '15

30 Mar '15

Ulrich Windl wrote: >>>> Michael Ströder<michael(a)stroeder.com> schrieb am 29.03.2015 um 12:12 in >> I have this in my config: >> >> # SSF value for ldapi:// >> localSSF 256 > > What I don't understand here is: Doesn't "256" _require_ encryption for > ldapi:// then? There is a reason for everything I write, especially this sentence: >> See slapd.conf(5) for details. Learn to read the fine docs. Ciao, Michael.

1 0

Re: Antw: Re: external authentication source
by Dirk Kastens 30 Mar '15

30 Mar '15

Hi Ulrich, > Thanks for the hint, but I fail to use it: > > First it seems I cannot use it in olcSecurity (as I can use update_ssf), and then I fail to set it at the database level: It's a global option. Just set it as an attribute of cn=config. dn: cn=config olcLocalSSF: 256 Then use ldapsearch without TLS. This should work. Regards, Dirk

1 0

LMDB use of sparse or non-sparse data file
by Geoff Swan 30 Mar '15

30 Mar '15

I had to duplicate an LMDB database for replication recently, and used mdb_copy to do so. One server is using the original data.mdb database (which is sparse) and the other is using the mdb_copy non-sparse data.mdb file. The two servers are identical (hardware, OS, software and configuration). OpenLDAP-2.4.39 is being used, 64 bit Linux OS. mdb_stat shows the map size as the same, which is expected. Will the use of the non-sparse file cause any performance issues? The reason for asking is that I am seeing a difference in search times between the two. With 20 million objects, a search on modifyTimestamp (which is indexed) gives: server 1: approx 1s server 2: approx 60s server 2 started with the same search time as server 1 when the databases were originally copied, but has slowly increased its search time over about a week for this same search.

3 7

Re: LMDB use of sparse or non-sparse data file
by Quanah Gibson-Mount 29 Mar '15

29 Mar '15

--On Wednesday, March 25, 2015 5:11 PM +1100 Geoff Swan <gswan3(a)bigpond.net.au> wrote: >> Question is irrelevant since both are sparse files. > Thanks for the clarification Howard. > The data file from the mdb_copy snapshot was transferred over the > network to the other server using scp, which I understand does not > recognise sparse files, so the copy is likely to be non-sparse. I guess > this would be considered a corruption and best to start with a fresh copy? I've had no issue scp'ing files created from mdb_copy. Original host: zimbra@zre-ldap002:~/data/ldap/mdb/db$ ls -l total 432 -rw------- 1 zimbra zimbra 85899345920 Mar 25 14:53 data.mdb -rw------- 1 zimbra zimbra 8192 Mar 25 14:54 lock.mdb zimbra@zre-ldap002:~/data/ldap/mdb/db$ mkdir /tmp/mdb/ zimbra@zre-ldap002:~/data/ldap/mdb/db$ mdb_copy . /tmp/mdb zimbra@zre-ldap002:~/data/ldap/mdb/db$ ls -l /tmp/mdb/ total 428 -rw-r--r-- 1 zimbra zimbra 438272 Mar 25 14:54 data.mdb Destination host: [build@zre-ldap003 zcs-NETWORK-8.7.0_BETA1_1149.RHEL6_64.20150324181030]$ scp build@zre-ldap002:/tmp/mdb/data.mdb /tmp/mdb.002/ data.mdb 100% 428KB 428.0KB/s 00:00 [build@zre-ldap003 zcs-NETWORK-8.7.0_BETA1_1149.RHEL6_64.20150324181030]$ su Password: [root@zre-ldap003 zcs-NETWORK-8.7.0_BETA1_1149.RHEL6_64.20150324181030]# chmod a+rx /tmp/mdb.002 [root@zre-ldap003 zcs-NETWORK-8.7.0_BETA1_1149.RHEL6_64.20150324181030]# chmod a+r /tmp/mdb.002/data.mdb [root@zre-ldap003 zcs-NETWORK-8.7.0_BETA1_1149.RHEL6_64.20150324181030]# su - zimbra [zimbra@zre-ldap003 ~]$ cd data/ldap/mdb [zimbra@zre-ldap003 mdb]$ ls db.orig [zimbra@zre-ldap003 mdb]$ mkdir db [zimbra@zre-ldap003 mdb]$ ls db db.orig [zimbra@zre-ldap003 mdb]$ cd db [zimbra@zre-ldap003 db]$ cp /tmp/mdb.002/data.mdb . [zimbra@zre-ldap003 db]$ ls -l total 428 -rw-r-----. 1 zimbra zimbra 438272 Mar 25 14:57 data.mdb [zimbra@zre-ldap003 db]$ ldap start Started slapd: pid 32518 [zimbra@zre-ldap003 db]$ ls -l total 432 -rw-r-----. 1 zimbra zimbra 85899345920 Mar 25 14:57 data.mdb -rw-------. 1 zimbra zimbra 8192 Mar 25 14:57 lock.mdb --Quanah -- Quanah Gibson-Mount Platform Architect Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 2

Questionable log entries
by Timo Eissler 29 Mar '15

29 Mar '15

Hello, i have found some weird messages in my syslog since i setup openldap and switched my users from local passwd/shadow to openldap. I have two notebooks using sssd and the openldap server is configured with pam_ldap/nss_ldap authentication. I didn't have any problems, but i'm unsure why those message are logged and so i decided to ask this on the list. Those are the messages in question: Mar 22 20:10:01 foobarsrv1 slapd[16923]: connection_input: conn=12652 deferring operation: binding Mar 22 15:36:33 foobarsrv1 slapd[16923]: connection_read(29): no connection! Mar 22 15:37:36 foobarsrv1 slapd[16923]: conn=10375 op=6 ABANDON msg=6 Mar 15 09:00:59 foobarsrv1 slapd[28731]: connection_input: conn=16081 deferring operation: too many executing Mar 12 18:33:54 foobarsrv1 slapd[699]: slap_global_control: unrecognized control: 1.3.6.1.4.1.42.2.27.8.5.1 I have tried to find a solution or reason for this since two weeks or so, but i couldn't find the answer/solution. Regarding the "deferring operation: binding" message i'm just concerned, because their is absolutely no load on the system and i'm not sure what would happen if i had more than 3 clients (including the server) which use ldap. I already tried to match those messages with other things going on on the system, but i could get any match. Currently i get the "deferring operation: binding" anything between 2 and 10 times a day. I know that this may be more than one issue, but i hope that you are willing to help me solve this. This is my slapd.conf: Konsole output include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/misc.schema include /etc/openldap/schema/samba.schema pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args security tls=1 simple_bind=128 access to dn.base="" by * read access to dn.base="cn=Subschema" by * read access to attrs=userPassword by self write by anonymous auth by * none access to * by self write by * read access to * by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * none TLSCipherSuite HIGH:MEDIUM:-SSLv2:-SSLv3 TLSCertificateFile /etc/openldap/ssl/slapdcert.pem TLSCertificateKeyFile /etc/openldap/ssl/slapdkey.pem database hdb suffix "dc=foobar,dc=local" checkpoint 32 30 rootdn "cn=Manager,dc=foobar,dc=local" rootpw {SSHA}XXXX directory /var/lib/openldap-data index objectClass eq index uid pres,eq index memberUid pres,eq index uidNumber pres,eq index gidNumber pres,eq index uniqueMember pres,eq index sambaSID pres,eq index mail pres,sub,eq index cn pres,sub,eq index sn pres,sub,eq index dc eq database config My /etc/ldap.conf Konsole output host 127.0.0.1 base dc=foobar,dc=local uri ldap://localhost/ ldap_version 3 scope one bind_policy soft idle_timelimit 3600 pam_filter objectclass=posixAccount pam_member_attribute memberuid pam_min_uid 1000 pam_password exop nss_base_passwd ou=People,dc=foobar,dc=local?one nss_base_shadow ou=People,dc=foobar,dc=local?one nss_base_group ou=Groups,dc=foobar,dc=local?one nss_base_hosts ou=Hosts,dc=foobar,dc=local?one ssl start_tls nss_initgroups_ignoreusers root,bin,daemon,adm,lp,sync,shutdown,halt,news,uucp,operator,portage,nobody,man,sshd,cron,mail,postmaster,ldap,m ysql,mediatomb,dovecot,dovenull,apache,openvpn,clamav,bacula,asterisk,ntp The openldap server is an up to date Gentoo system. If you need more informations just let me know. Kind regards, Timo -- Timo Eissler Senior Project Engineer / Consultant Am Zuckerberg 54 D-71640 Ludwigsburg Tel.: +49 7141 4094003 Mobil.: +49 151 20650311 Email: timo(a)teissler.de

3 10

Q: different SSF settings for ldapi:// than for ldap:
by Ulrich Windl 29 Mar '15

29 Mar '15

Hi! I've configured slapd to require excryption (confidentiality). Now connections via ldapi:// fail with "13 Confidentiality required". When adding "-ZZ" for ldapsearch (e.g.), the connection fails, because the certificate does not match ldapi:// (I asked about that before, but got no answer). How can I configure slapd not to require confidentiality? Regards, Ulrich

2 1

still can't run ldapadd command after install openldap
by Wang, Hui 28 Mar '15

28 Mar '15

Hi, All Sorry to bother everyone on this list. I am new to OPENLDAP server and also this is first time I work as a linux admin to install something by myself. My openldap 2.4.40 is up and running, and I also I found the ldapadd commend under /opt/bin, is there anything else I missed which caused the ldapadd doesn't run? Thank you all Hui Wang from CSUN [root@oldaptest01 bin]# ps auxww | grep slapd root 3094 0.0 6.7 1411584 129248 ? Ssl Mar25 0:00 /opt/libexec/slapd root 32481 0.0 0.0 103252 840 pts/0 S+ 13:40 0:00 grep slapd [root@oldaptest01 bin]# pwd /opt/bin [root@oldaptest01 bin]# ls -l total 2268 lrwxrwxrwx 1 root root 10 Mar 25 10:34 ldapadd -> ldapmodify -rwxr-xr-x 1 root root 264824 Mar 25 10:34 ldapcompare -rwxr-xr-x 1 root root 265432 Mar 25 10:34 ldapdelete -rwxr-xr-x 1 root root 265624 Mar 25 10:34 ldapexop -rwxr-xr-x 1 root root 277336 Mar 25 10:34 ldapmodify -rwxr-xr-x 1 root root 265016 Mar 25 10:34 ldapmodrdn -rwxr-xr-x 1 root root 264216 Mar 25 10:34 ldappasswd -rwxr-xr-x 1 root root 287864 Mar 25 10:34 ldapsearch -rwxr-xr-x 1 root root 155256 Mar 25 10:34 ldapurl -rwxr-xr-x 1 root root 262648 Mar 25 10:34 ldapwhoami [root@oldaptest01 bin]# [root@oldaptest01 bin]# ldapadd -x -D "cn=Directory Manager,o=csun" -W -f example.ldif -bash: ldapadd: command not found [root@oldaptest01 bin]#

4 4

From: Suneet Shah
by Suneet Shah 27 Mar '15

27 Mar '15

Hi openldap http://malicemud.com/husband.php?dead=6ysg8ks7mhbhm2 suneetshah2000(a)gmail.com Sent from my iPhone

1 0

Re: can't run ldapsearch and slapadd command after install openldap
by Igor Shmukler 26 Mar '15

26 Mar '15

Sorry. I misunderstood your message. Thought that you were missing slapd. Did you install ldap-utils? I believe that ldapsearch(1) might a part of ldap-utils package [probably depends on the distro], and it is installed separately. On Thu, Mar 26, 2015 at 12:01 AM, Wang, Hui <holly.wang(a)csun.edu> wrote: > Igor > > What file I should look for under /usr/sbin? I got this > > [root@oldaptest01 sbin]# pwd > /usr/sbin > [root@oldaptest01 sbin]# ldapsearch > -bash: ldapsearch: command not found > > [root@oldaptest01 sbin]# ps auxww | grep slapd > root 3094 0.0 24.3 1411584 468476 ? Ssl 11:10 0:00 /opt/libexec/slapd > root 7574 0.0 0.0 103252 840 pts/0 S+ 14:59 0:00 grep slapd > > > > -----Original Message----- > From: Igor Shmukler [mailto:igor.shmukler@gmail.com] > Sent: Wednesday, March 25, 2015 12:40 PM > To: Wang, Hui > Subject: Re: can't run ldapsearch and slapadd command after install openldap > > Hello, > > Try: $ ps auxww | grep slapd > > BTW, did you check /usr/sbin as to whether binaries are there? On my machine they are in the /usr/sbin directory. > > Sincerely, > > Igor Shmukler > > On Wed, Mar 25, 2015 at 9:06 PM, Wang, Hui <holly.wang(a)csun.edu> wrote: >> Hi, All >> >> I am still working on set up a new openldap server on redhat linux machine. I am following the steps offered in following site: >> >> https://urldefense.proofpoint.com/v2/url?u=http-3A__www.openldap.org_d >> oc_admin24_quickstart.html&d=AwIBaQ&c=Oo8bPJf7k7r_cPTz1JF7vEiFxvFRfQtp >> -j14fFwh71U&r=GJzNE-na5kc9aOr5JDyH43J-pL3ONUA5CuZ1SXkuaxM&m=GBtUhh13Xy >> aRZP5tODMNFbEJJAg_qvoUiAUFCjZDrSU&s=MSNLQQwkvXAf76wBrcbRiZ0QF7U2GBM-Zd >> LZjQ5LAL8&e= >> >> I am at step 9, I started the slapd, but can't do LDAP search. I can't run slapadd command either. >> >> You can see my slapd is up and running, but there are nothing installed in /usr/local/bin. What should I install and how can I make ldapsearch and slapadd command run? >> >> Thanks >> >> >> >> [root@oldaptest01 sbin]# pgrep slapd >> 3094 >> [root@oldaptest01 openldap-2.4.40]# cd /usr/local/bin >> [root@oldaptest01 bin]# ldapsearch >> -bash: ldapsearch: command not found >> [root@oldaptest01 bin]# cd /usr/local/sbin >> [root@oldaptest01 sbin]# slapadd >> -bash: slapadd: command not found >> >> >> >> >> Hui Wang >>

2 1

can't run ldapsearch and slapadd command after install openldap
by Wang, Hui 25 Mar '15

25 Mar '15

Hi, All I am still working on set up a new openldap server on redhat linux machine. I am following the steps offered in following site: http://www.openldap.org/doc/admin24/quickstart.html I am at step 9, I started the slapd, but can't do LDAP search. I can't run slapadd command either. You can see my slapd is up and running, but there are nothing installed in /usr/local/bin. What should I install and how can I make ldapsearch and slapadd command run? Thanks [root@oldaptest01 sbin]# pgrep slapd 3094 [root@oldaptest01 openldap-2.4.40]# cd /usr/local/bin [root@oldaptest01 bin]# ldapsearch -bash: ldapsearch: command not found [root@oldaptest01 bin]# cd /usr/local/sbin [root@oldaptest01 sbin]# slapadd -bash: slapadd: command not found Hui Wang

2 1

changing objectClass in 2.4
by Igor Shmukler 25 Mar '15

25 Mar '15

Hello, I would like to change the objectClass for an existing record - specifically I want to replace dcObject for a custom one, so instead of: objectClass: top objectClass: dcObject objectClass: organization I would have: objectClass: top objectClass: myDcObject objectClass: organization I found a thread where Kurt mentions that back in day, there was planned support for 2.4 to offer such functionality. [ http://www.openldap.org/lists/openldap-software/200604/msg00074.html ] Was this done? It is working now? Is there a specific issue deleting the organization object? From the same email, I know that older OpenLDAP releases did not support modifying objectClass. I tried to delete the entry so the recreate it the I want it to look. Unfortunately, it is not working. I get an error as below: $ ldapdelete -D cn=config -W -x dc=directory,dc=com I am able to delete regular entries, fine. Sincerely, Igor Shmukler

3 2

olcObjectClasses: user-defined ObjectClass has inappropriate SUPerior: "dcObject"
by Igor Shmukler 24 Mar '15

24 Mar '15

Hello, I could not find anything exactly relevant quickly. Sorry to bother you good folks, again. I am trying to extend dcObject class in order to support a couple of additional attributes. It is not working, and it appears that the problem is not syntax-related. Is what I am trying to do legal? Is dcObject a good way to go about my goal of adding a DIT-level attributes? Should I instead create another class unrelated to dcObject? If yes, why? Below is my LDIF: olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.100.129 NAME ( 'serviceLevel' ) DESC 'directory service mode. valid values are: trial, standard and premium' SUP name ) olcObjectClasses: ( 1.3.6.1.4.1.4203.666.100.2 NAME 'customDcObject' DESC 'Directory Domain Description' SUP dcObject STRUCTURAL MAY ( serviceLevel ) ) I should probably replace the last MAY for MUST. My attribute should be mandatory. Yet, it is probably not the reason for the error, is it?! Please advise, Sincerely, Igor Shmukler

2 2

Re: How to use ldapsearch -Esync ?
by Thomas Cort 24 Mar '15

24 Mar '15

> I'm writing a script that acts on changes in LDAP. I've abandoned this idea. The ldapsearch utility doesn't decode SyncInfo messages which provide valuable information. Instead, it simply prints "SyncInfo Received". This is worse than printing nothing at all because it causes my LDIF parser to choke. I think either the slapd-perl or slapd-shell backends are better suited to my needs than tailing the output of ldapsearch -Esync/rp Thomas

4 3

are patches important for the openldap installation?
by Wang, Hui 23 Mar '15

23 Mar '15

Hi, all My system admin installed openldap 2.4.40 for me but the slapadd command doesn't work. It seems like the ldap package and slapd package weren't installed. I am installing openldap 2.4.40 on redhat linux server following this direction: http://www.linuxfromscratch.org/blfs/view/svn/server/openldap.html I can't install patch successfully. It only patch a few files then stops. But the make test goes fine. Will there be a problem if the patch doesn't goes fine? You are welcomed for any input. I am very new to openldap. Hui Wang (Holly) CSUN IT Department Identity and Directory Service 818-677-2031 holly.wang(a)csun.edu

3 3

Re: Re: what is wrong with my permissions?
by Igor Shmukler 23 Mar '15

23 Mar '15

Hello Ulrich, Thank you. I finally figured out my problem. I did not notice/realize that permissions were being given in stages: userPassword, dn.base then *. Once I added dn="cn=config" to the correct line, things started working. I appreciate your help. [This is already, at least, the second time.] Sincerely, Igor Shmukler On Mon, Mar 23, 2015 at 4:43 PM, Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de> wrote: >>>> Igor Shmukler <igor.shmukler(a)gmail.com> schrieb am 19.03.2015 um 15:03 in > Nachricht > <CAA1SNA1h-FRxM=+MHqnTVncZscj-CS5avHbT4NvqcRMnh+_zMA(a)mail.gmail.com>: >> Hi Ferenc, >> >> I am still getting the same error with both by and your versions. Please >> advise: >> >> $ cat set_config_passwd.ldif >> dn: olcDatabase={0}config,cn=config >> changetype: modify >> replace: olcAccess >> olcAccess: {0}to * by >> dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external >> ,cn=auth manage by * break >> olcAccess: {1}to * by dn.exact=cn=config >> >> $ sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f set_config_passwd.ldif >> SASL/EXTERNAL authentication started >> SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth >> SASL SSF: 0 >> modifying entry "olcDatabase={0}config,cn=config" > > Igor, > > you allow cn=config to manage the config database, but below you remove an entry from another database with cn=config credentials. > >> >> $ ldapdelete -x -D cn=config -W cn=john,dc=directory,dc=com >> ldap_delete: Insufficient access (50) >> additional info: no write access to parent >> >> I even tried stripping the first line, so the rule was: {0}to * by >> dn.exact=cn=config >> Still gives me the same error. > > Check the ACL in the other database! > >> >> Please advise, >> >> Igor Shmukler >> >> >> On Thu, Mar 19, 2015 at 2:54 PM, Ferenc Wagner <wferi(a)niif.hu> wrote: >>> Igor Shmukler <igor.shmukler(a)gmail.com> writes: >>> >>>> I want it to be something like: >>>> olcAccess: {1}to * by dn="cn=config" manage >>>> >>>> Basically, I want dn=cn=config to have full root access over >>>> everything. I also want this password ideally to be password >>>> protected. >>>> >>>> Does it make sense? Can it be done? >>> >>> Sure. Add this olcAccess attribute to all the databases. Or to the >>> frontend database, but check man slapd.access for the priorities and >>> defaults. For what it's worth, I use the syntax >>> >>> to * by dn.exact=cn=config >>> >>> (which should be equivalent to yours). >>> -- >>> Feri. > > > >

1 0

LMDB error
by Shu, Xinxin 23 Mar '15

23 Mar '15

Hi list, I'm now working on integrating LMDB with ceph, now I encounter the follow error when initialize transaction : MDB_BAD_RSLOT: Invalid reuse of reader locktable slot What I want to know is in which situation this error occur? thanks Cheers, xinxin

2 1

git problems
by Mattes 23 Mar '15

23 Mar '15

Hello list, while upgrading my local git checkout I just realized that the repository contains serveral files under contrib/ldapc++ that should never be put under version control: l$ git pull Updating 7a7d941..ff7c0e5 error: Your local changes to the following files would be overwritten by merge: contrib/ldapc++/Makefile.in contrib/ldapc++/configure contrib/ldapc++/examples/Makefile.in contrib/ldapc++/src/Makefile.in all these files are generated during the build process (by automake/autoconf) Can someone with commit permission please fix this? TIA Ralf Mattes

2 1

OpenLDAP permissions question
by Igor Shmukler 21 Mar '15

21 Mar '15

Hello, I have been spamming this list, looking for insights into why I cannot configure OpenLDAP to use cn=config to delete an entry inside a DIT. Sorry. Just now thought of and conducted another experiment. The results surprised me. If someone can please explain why OpenLDAP behaves this way, and whether this can be altered through configuration, it would certainly get me further on my way. When I try to delete an entry using LDAPI as below: $ sudo ldapdelete -Y external -H ldapi:/// cn=john,dc=directory,dc=com ldap_delete: Insufficient access (50) additional info: no write access to parent I do the same using domain administrator credentials and below and it works fine: $ ldapdelete -D cn=admin,dc=directory,dc=google,dc=com -W -x cn=john,dc=directory,dc=com Why LDAPI does not work? What can be done? Thank you, Igor Shmukler

8 21

Schema error: attributeType ...
by Zhang,Jun 20 Mar '15

20 Mar '15

This error with a yellow exclamation point caused nothing to be shown on the right panel of the phpldapadmin console. Schema error: attributeType "olmdburilist" inherits from "managedInfo", but attributeType "managedInfo" does not exist. OpenLDAP 2.4.23 RHEL 6 Putting phpldapadmin in debug mode, I did not find anything related to the error message. Jun

2 2

slapd does not log neither to syslog nor systemd' sjournal
by lejeczek 20 Mar '15

20 Mar '15

hi everybody on rhel 7 when I start slapd I see it is running: /usr/sbin/slapd -u ldap -h ldapi:/// ldap://192.168.2.33/ ldaps://192.168.2.33/ -s 160 and yet I don't get anything in rsyslog logs nor in systemd's journal When I stick slapd to terminal with only -d instead of -s everything is as expected. weird, right? any suggestions very appreciated.

1 1

Re: OpenLDAP permissions question
by Marc Patermann 20 Mar '15

20 Mar '15

Igor, Igor Shmukler schrieb (20.03.2015 11:21 Uhr): > Unfortunately, your email does not clear anything, FOR ME. It does not > mean you are not 100% correct. I am just slow, I guess. Sorry. do simple things first! Do more complex things later! - Configure a rootdn with rootpw for each database. Use this to authenticate to slapd und modify things. This works? Fine, go on. - Create a user entry inside your DIT. Use this entry as rootdn. This works? Fine, go on. - Map this user entry from your local unix user with olcAuthzRegexp to use with ldapi and EXTERNAL. This works? Fine, go on. - or make your first steps with ACLs and another user entry. > I don't see why/how Michael's suggestion with olcAuthzRegexp could > work. The way that could have worked - multiple remaps, different for > each database is not allowed. Read again what Michael said: "authz-regexp is a global configuration option." > The one permitted - inside config > database, as far as I understand, does not do what I need. Do you need multiple mappings? As you are one user on your system, this maps to one user in ldap with olcAuthzRegexp. As Micheal already posted: authz-regexp "gidNumber=0\\+uidNumber=0,cn=peercred,cn=external,cn=auth" "cn=root,dc=example,dc=com" uid 0 (from your system) maps to ldap entry cn=root,dc=example,dc=com. Marc

2 6

back-meta: dependency on ldap.conf
by Liam Gretton 20 Mar '15

20 Mar '15

OpenLDAP 2.4.40, SLES x86_64. This will seem crazy, but it looks to me that back-meta uses /etc/openldap/ldap.conf for its TLS configuration instead of the tls_options set explicitly within slapd.conf. Within my meta configuration I have the following for idassert-bind: idassert-bind bindmethod=simple binddn="cn=user,dc=example,dc=com credentials="password" flags=prescriptive tls_cacert=/etc/ssl/certs/ca.pem tls_cacertdir=/etc/ssl/certs tls_reqcert=demand None of the TLS options seem to have any effect here at all (I can put nonsensical values to the tls options here and slapd doesn't complain at all). Instead it's necessary to use /etc/openldap/ldap.conf for back-meta to bind over SSL/TLS: tls_cacert /etc/ssl/certs/ca.pem tls_cacertdir /etc/ssl/certs Any changes to ldap.conf get picked up by back-meta on a restart. This can't be right, surely? As an aside, I can't see why it's necessary to have to specify both tls_cacert (pointing at the last CA in the chain) as well as tls_cacertdir, but it is. -- Liam Gretton liam.gretton(a)le.ac.uk Systems Specialist http://www.le.ac.uk/its/ IT Services Tel: +44 (0)116 2522254 University Of Leicester, University Road Leicestershire LE1 7RH, United Kingdom

1 2

OpenLDAP freeze
by Cyril Grosjean 20 Mar '15

20 Mar '15

I've an OpenLDAP 2.4.32 server with millions of entries, which uses to serve tens of requests per second. It works as a stand-alone master server (replication is setup but the slave server is down) I noticed several times, at different times and dates, that no lines are logged in the OpenLDAP access log for a few minutes, as if it was frozen. I try to figure out what could explain that ? I checked the usual system counters (CPU, IO, Memory, free disk space, ...) as well as the running processes, but did not notice anything suspicious. Since the OpenLDAP server runs in a virtual machine, I'm currently trying to monitor the ESX hypervisor. Any idea of what could go wrong ?

2 2

FW: questions about LMDB
by Shu, Xinxin 20 Mar '15

20 Mar '15

CC technical list Cheers, xinxin -----Original Message----- From: openldap-devel [mailto:openldap-devel-bounces@openldap.org] On Behalf Of Shu, Xinxin Sent: Friday, March 20, 2015 8:50 AM To: Howard Chu; openldap-devel(a)openldap.org Subject: RE: questions about LMDB Sorry for the wrong mail list , I will forward this request to technical list Cheers, xinxin -----Original Message----- From: Howard Chu [mailto:hyc@symas.com] Sent: Thursday, March 19, 2015 11:52 PM To: Shu, Xinxin; openldap-devel(a)openldap.org Subject: Re: questions about LMDB Shu, Xinxin wrote: > Several other questions about lmdb > > 1) does lmdb store one key-value pair in a single page? How lmdb organizes these key-value pairs in a single page > 2) if size is larger than single page size , how lmdb process this request? This list is for developers to discuss actual coding issues inside the OpenLDAP code; your questions are too elementary and don't belong here. Use the -technical list for user-oriented questions. > > Any help will be appreciated ? thanks > > Cheers, > xinxin > > -----Original Message----- > From: Shu, Xinxin > Sent: Thursday, March 19, 2015 3:49 PM > To: openldap-devel(a)openldap.org > Cc: Shu, Xinxin > Subject: questions about LMDB > > Hi list , > > Recently I read docs about lmdb , there are two sentences > 1) readers do not block writers > 2) writers do not block readers > I can understand 'readers do not block writers' , but cannot understand the second one , can someone help explain , how lmdb achieve 'writers do not block readers', below is my understandings , please correct me if anything wrong. > if the access pattern is write - read, since lmdb only support two version of data , when the write has been started but not committed , the concurrent read may read stale data since write has not been committed. > > Cheers, > xinxin > > > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

file descriptor setting
by Daniel Jung 20 Mar '15

20 Mar '15

Hi, Running 2.4.39 on centos 6. I set the open file limit to 200000 today as part of testing and it ran fine for a while and then an hour or so later the daemon died with no trace in the logs. I am running stats and sync at the moment. Would i need to run args to capture issue like this? Thanks

1 0

what is wrong with my permissions?
by Igor Shmukler 19 Mar '15

19 Mar '15

Hello, Sorry. I need help, again! I am trying to configure my OpenLDAP so that cn=config has full over-the-network write-access with a password.I thought at one point that I got the permissions working. It turns out, those are not working, now. Please say what I am doing wrong. Last time, I had a similar problem with policy. Michael S. saved me a bunch of time by advising to load ppolicy.ldif [with the appropriate schema]. This is obviously no indicator of any kind, yet the problem might be not in the LDIFs or ... I understood that manage is the LDIF version of full permissions. Found olcAccess syntax as "olcAccess: to <what> [ by <who> [<accesslevel>] [<control>] ]+" My OLC directives for ldapmodify(1) are below: dn: olcDatabase={0}config,cn=config changetype: modify replace: olcAccess olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth manage by * break olcAccess: {1}to * by self write by dn="cn=config" write by * read dn: olcDatabase={0}config,cn=config changetype: modify add: olcRootPW olcRootPW: {SSHA}HyVltU836iL4aR0P0C6O8eHkOJt8nYGK I tried various combinations, like: olcAccess: {1}to * by dn=cn=config manage by * read The old commands are valid, yet do not result in the desired configuration. Instead, when ldapdelete(1) is invoked, I get: ldap_delete: Insufficient access (50) additional info: no write access to parent Please advise. I thank everyone on who has been reading my messages. People on this list have been extremely helpful. Sincerely, Igor Shmukler

2 9

Are sets "production ready"?
by Tomasz Lesniewski 19 Mar '15

19 Mar '15

Hi. I would like to use sets in my openldap ACLs, but i'm worried about "Sets are considered experimental"as is written in docs (http://www.openldap.org/doc/admin24/access-control.html#Sets%20-%20Granting…) Is anybody using sets in production environment without problems? Are there any known issues with sets? Or is known when sets will be ready to use? -- Pozdrawiam/Best regards Tomasz Leśniewski

3 3

ppolicy: pwdInHistory attribute
by Esther Garcia 19 Mar '15

19 Mar '15

Hello, We have installed an openldap server 2.4.23-34 on RHEL 6.5 with ppolicy enabled. # Standard, Policies dn: cn=Standard,ou=Policies,dc=test,dc=es cn: Standard description: Standard password policy. pwdAttribute: userPassword pwdCheckQuality: 1 pwdMinLength: 8 pwdLockout: TRUE pwdMustChange: TRUE pwdAllowUserChange: TRUE objectClass: device objectClass: pwdPolicy pwdSafeModify: FALSE pwdFailureCountInterval: 3 pwdGraceAuthNLimit: 0 pwdLockoutDuration: 1200 pwdMaxFailure: 10 pwdMinAge: 10 pwdMaxAge: 31536000 pwdExpireWarning: 0 pwdInHistory: 5 All ppolicy attributtes except pwdInHistory are working. We store passwords encrypted in the directory. Is there any way to have pwdInHistory attribute working with encrypted passwords stored in the directory? Thanks! Esther

2 4

default behavior of server certificate validation
by Bin Lu 19 Mar '15

19 Mar '15

Hi, In connecting the LDAP server with LDAPs or (start)TLS, what is the default behavior of the server certificate validation? How can I disable the default behavior? Thanks, -binlu

2 2

Error while integrating OpenLDAP and Kerberos
by Verónica Ovando 19 Mar '15

19 Mar '15

I am trying to set up Kerberos with OpenLDAP backend. I followed this doc http://web.mit.edu/Kerberos/www/krb5-1.12/doc/admin/conf_ldap.htmland this https://help.ubuntu.com/lts/serverguide/kerberos-ldap.html#kerberos-ldap-op… My |krb5.conf|file looks like this: |[libdefaults] default_realm = EXAMPLE.TEST dns_lookup_realm = false dns_lookup_kdc = false rdns = false [kdcdefaults] restrict_anonymous_to_tgt = true # The following krb5.conf variables are only for MIT Kerberos. krb4_config = /etc/krb.conf krb4_realms = /etc/krb.realms kdc_timesync = 1 ccache_type = 4 forwardable = true proxiable = true # The following libdefaults parameters are only for Heimdal Kerberos. v4_instance_resolve = false v4_name_convert = { host = { rcmd = host ftp = ftp } plain = { something = something-else } } fcc-mit-ticketflags = true [realms] #configuracion para mi reino EXAMPLE.TEST = { kdc = krb1.example.test:88 kdc = krb2.example.test:88 admin_server = krb1.example.test default_domain = example.test database_module = openldap_ldapconf } [domain_realm] #configuracion para mi servidor .example.test = EXAMPLE.TEST EXAMPLE.test = EXAMPLE.TEST [dbdefaults] ldap_kerberos_container_dn = cn=krbContainer,dc=example,dc=test [dbmodules] openldap_ldapconf = { db_library = kldap ldap_kdc_dn = "cn=krbadmin,dc=example,dc=test" # this object needs to have read rights on # the realm container, principal container and realm sub-trees ldap_kadmind_dn = "cn=krbadmin,dc=example,dc=test" # this object needs to have read and write rights on # the realm container, principal container and realm sub-trees ldap_service_password_file = /etc/krb5kdc/service.keyfile ldap_servers = ldap://127.0.0.1 ldap_conns_per_server = 5 } [login] # krb4_convert = true # krb4_get_tickets = false [logging] kdc = FILE:/var/log/kerberos/krb5kdc.log admin_server = FILE:/var/log/kerberos/kadmin.log default = FILE:/var/log/kerberos/krb5lib.log | I added the krbPrincipalName index: |dn: olcDatabase={1}hdb,cn=config add: olcDbIndex olcDbIndex: krbPrincipalName eq,pres,sub | I gave permissions to the kadmind and krb5kdc for reading a writing in the LDAP database: |dn: olcDatabase={1}hdb,cn=config replace: olcAccess olcAccess: to attrs=userPassword,shadowLastChange,krbPrincipalKey by dn="cn=krbadmin,dc=example,dc=com" write by anonymous auth by self write by * none - add: olcAccess olcAccess: to dn.base="" by * read - add: olcAccess olcAccess: to * by dn="cn=krbadmin,dc=example,dc=com" write by * read | When i try to restart the krb5-admin-server I get this error: *[....] Restarting Kerberos administrative servers: kadmindkadmind: Invalid credentials while initializing, aborting failed!* Any suggestion for solving this problem? I thinks there is a missing configuration on my LDAP, but I am not sure. Thanks in advance. -- Verónica Ovando

2 1

olcAccess syntax
by Igor Shmukler 18 Mar '15

18 Mar '15

Hello, Sorry. This is repost. I was unable to figure out what is wrong my olcAccess configuration! I am trying to configure my OpenLDAP so that cn=config has full over-the-network write-access with a password.I thought at one point that I got the permissions working. It turns out, those are not working, now. Please say what I am doing wrong. Last time, I had a similar problem with policy. Michael S. saved me a bunch of time by advising to load ppolicy.ldif [with the appropriate schema]. This is obviously no indicator of any kind, yet the problem might be not in the LDIFs or ... I understood that manage is the LDIF version of full permissions. Found olcAccess syntax as "olcAccess: to <what> [ by <who> [<accesslevel>] [<control>] ]+" My OLC directives for ldapmodify(1) are below: dn: olcDatabase={0}config,cn=config changetype: modify replace: olcAccess olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth manage by * break olcAccess: {1}to * by self write by dn="cn=config" write by * read dn: olcDatabase={0}config,cn=config changetype: modify add: olcRootPW olcRootPW: {SSHA}HyVltU836iL4aR0P0C6O8eHkOJt8nYGK I tried various combinations, like: olcAccess: {1}to * by dn=cn=config manage by * read The command syntax is valid. Yet my configuration not result in the desired access rights. Instead, when ldapdelete(1) is invoked with -D cn=config on records inside non-config databases, I get: ldap_delete: Insufficient access (50) additional info: no write access to parent Please advise. I thank everyone on the openldap-technical who has been reading my messages. People on this list have been extremely helpful. Sorry to continue being a nag. Sincerely, Igor Shmukler

1 0

openldap MMR "read_config: no serverID / URL match found"
by Divya Vikraman 18 Mar '15

18 Mar '15

Hi, I am using openldap 2.4.39 version and trying to set up multi master replication. This is my configuration ServerID 1 "ldap://ldap1-test.com" ServerID 2 "ldap://ldap2-test.com" overlay syncprov syncprov-checkpoint 10 1 syncprov-sessionlog 100 syncrepl rid=1 provider="ldap://ldap1-test.com" binddn="uid=replication,ou=People,dc=ldap,dc=nqa,dc=test,dc=com" bindmethod=simple credentials="xyzabc" searchbase="dc=ldap,dc=nqa,dc=test,dc=com" type=refreshAndPersist interval=00:00:00:10 retry="5 10 60 +" timeout=1 schemachecking=off scope=sub syncrepl rid=2 provider="ldap://ldap2-test.com" binddn="uid=replication,ou=People,dc=ldap,dc=nqa,dc=test,dc=com" bindmethod=simple credentials="xyzabc" searchbase="dc=ldap,dc=nqa,dc=test,dc=com" type=refreshAndPersist interval=00:00:00:10 retry="5 10 60 +" timeout=1 schemachecking=off scope=sub MirrorMode on I have put the below entries in /etc/default/slap on server 1 SLAPD_SERVICES="ldapi:// ldap://ldap1-test.com" and server 2 SLAPD_SERVICES="ldapi:// ldap://ldap2-test.com" After this I am not able to start the service and when I do a slapd -d sync , I get the error "read_config: no serverID / URL match found" I have seen a similar issue posted in an earlier thread but could not find a solution. Thanks, Divya

3 3

nssov not working after upgrading nss-pam-ldapd
by btb＠bitrate.net 18 Mar '15

18 Mar '15

i use the nss and pam stub libraries from nss-pam-ldapd [no nslcd] with nssov. i've just upgraded nss-pam-ldapd from 0.8.13 to 0.9.4. at the moment, i'm using openldap version 2.4.31. after upgrading nss-pam-ldapd, nss and pam stopped working with ldap, and i see this in slapd's debug log: 54acaf72 daemon: activity on 1 descriptor 54acaf72 daemon: activity on:54acaf72 13r54acaf72 54acaf72 daemon: read active on 13 54acaf72 daemon: epoll: listen=7 active_threads=0 tvp=NULL 54acaf72 daemon: epoll: listen=8 active_threads=0 tvp=NULL 54acaf72 connection_get(13) 54acaf72 connection_get(13): got connid=0 54acaf72 daemon: activity on 1 descriptor 54acaf72 daemon: activity on:54acaf72 54acaf72 daemon: epoll: listen=7 active_threads=0 tvp=NULL 54acaf72 daemon: epoll: listen=8 active_threads=0 tvp=NULL 54acaf72 nssov: connection from uid=0 gid=0 54acaf72 nssov: wrong nslcd version id (33554432) how can i find out what nslcd version id is required, and what version is present in each of the components? thanks -ben

3 5

Update custom schema
by Gremaud Cyrill 17 Mar '15

17 Mar '15

Hello everybody. I have an openldap 2.4+ and I added a custom schema. In my ldap I have a lot of entries which use this schema. I just want to know how can add fields (update) to this schema ? My first idea is to create a new ldif file containing the new schema description, stopping the server, removing the old schema and replace it by the new one and then try to restart the server but I don't know if there is a better way to do this. Thanks you very much for your help. Cyrill Gremaud

2 2

LMDB sequential read from a ">>RAM" database caffe use case
by Brian 16 Mar '15

16 Mar '15

Hi, all I am a caffe user. In my use case, I am reading from a ~300GB lmdb sequentially, reading one element and never accessing again until I read every other element in the db and loops around again. It seems that lmdb will page cache every element. This becomes a problem as the dataset is read in fairly fast and it takes 1 hour before nearly 60% of the RAM is devoted to my lmdb page caches. Then it runs out of unmapped memory to use, so it starts kicking out the page frames of processes of other users, many of which have not been accessed in the last hour. So the system will prefer to kick out those page frames instead of page frames mapped at the beginning of the run. This behavior is entirely understandable but it causes extremely severe thrashing and unresponsive system, as those page frames of other user's comes into use very soon. Does my diagnosis of the situation seem reasonable? As many of our caffe use case is a similar sequential read of a dataset much greater than available RAM, many other caffe users besides me reports a similar issue. They all report their system becoming unresponsive, presumably due to the same thrashing. "training is freezing for multiple hours" https://github.com/BVLC/caffe/issues/1412 "Caffe memory increases with time(iterations?)" https://github.com/BVLC/caffe/issues/1377 "Random freezes" https://github.com/BVLC/caffe/issues/1807 Is there some option that I missed that can inform lmdb that for a certain read-only transaction is going to be purely sequential, so it shouldn't bother to cache the already read elements? If not, is there a plan to include such a feature? Or is there an option I can limit the maximum memory a single lmdb transaction is going to use to cache? Or is there some other possible solution to this problem? ----- I have been using a hack based on this fork https://github.com/raingo/lmdb-fork/commit/091ff5e8be35c2f2336e37c0db4c392f… to avoid this issue. However, I would love to know if there is any less hacky way to solve this problem. ----- I have seen this thread http://www.openldap.org/lists/openldap-devel/201502/msg00052.html but it looks like it is for multiple readers. ----- Any advice on this will be much appreciated!

2 1

Question about ldap_search_ext_s and memory leak
by Jean-Marc Choulet 16 Mar '15

16 Mar '15

Hello, I have a little with this very simple program : #include <iostream> #include <stdlib.h> #define LDAP_DEPRECATED 1 #include <ldap.h> using namespace std; const char* server = "ldap://ldap.xxxx.fr"; const char* cacert_file = "cacert.pem"; const char* root_dn = "cn=replicator,ou=DSA,dc=xxxx,dc=fr"; const char* root_pw = "xxxx"; const char* aliased_people_dn ="ou=AliasedPeople,dc=xxxx,dc=fr"; int main(int argc, char *argv[]) { if (argc != 3) { cerr << "Usage: " << argv[0] << " username password" << endl; return 1; } LDAP *ld; int version = LDAP_VERSION3; int rc; if ((rc = ldap_initialize(&ld, server)) != LDAP_SUCCESS) { cerr << "ldap_initialize: " << server << endl; return EXIT_FAILURE; } if ((rc = ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &version)) != LDAP_OPT_SUCCESS) { cerr << "ldap_set_option error: " << ldap_err2string(rc) << endl; return EXIT_FAILURE; } if ((rc = ldap_set_option(NULL, LDAP_OPT_X_TLS_CACERTFILE, cacert_file)) != LDAP_OPT_SUCCESS ) { cerr << "ldap_set_option error: " << ldap_err2string(rc) << endl; return EXIT_FAILURE; } if ((rc = ldap_start_tls_s(ld, NULL, NULL)) != LDAP_SUCCESS) { cerr << "ldap_start_tls_s error: " << ldap_err2string(rc) << endl; return EXIT_FAILURE; } if ((rc = ldap_bind_s(ld, root_dn, root_pw, LDAP_AUTH_SIMPLE)) != LDAP_SUCCESS) { cerr << "ldap_bind_s: " << ldap_err2string(rc) << endl; return EXIT_FAILURE; } cout << "user replicator authenticated :)." << endl; LDAPMessage *pResult; struct berval cred; char *pDN; std::string filter("uid=" + string(argv[1])); rc = ldap_search_ext_s(ld, aliased_people_dn, LDAP_SCOPE_SUBTREE, filter.c_str(), NULL, 0, NULL, NULL, NULL, LDAP_NO_LIMIT, &pResult); if (rc != LDAP_SUCCESS) { cerr << "ldap_search_ext_s error: " << ldap_err2string(rc) << endl; ldap_unbind_s(ld); return EXIT_FAILURE; } struct berval **vals; LDAPMessage *pEntry; string user_dn; if (ldap_count_entries(ld, pResult) == 1) { pEntry = ldap_first_entry(ld, pResult); pDN = ldap_get_dn(ld, pEntry); vals = ldap_get_values_len(ld, pEntry, "aliasedObjectName"); if (vals) { user_dn = vals[0]->bv_val; ldap_value_free_len(vals); } ldap_memfree(pDN); } else { cout << "aliasedObjectName attribute not found" << endl; ldap_unbind_s(ld); return EXIT_FAILURE; } ldap_memfree(pResult); if ((rc = ldap_bind_s(ld, user_dn.c_str(), argv[2], LDAP_AUTH_SIMPLE)) != LDAP_SUCCESS) { cerr << "user " << argv[1] << " not authenticated" << endl; ldap_unbind_s(ld); return EXIT_FAILURE; } cout << "user " << argv[1] << " (" << user_dn << ") authenticated" << endl; ldap_unbind_s(ld); return EXIT_SUCCESS; } My program works fine but, if I use valgrind, I have memory leaks : valgrind --leak-check=full ./ldapauth.exe toto secret ==13616== Memcheck, a memory error detector ==13616== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al. ==13616== Using Valgrind-3.10.0.SVN and LibVEX; rerun with -h for copyright info ==13616== Command: ./ldapauth.exe toto secret ==13616== user replicator authenticated :). user toto (uid=toto,ou=People,ou=17,dc=xxxx,dc=fr) authenticated ==13616== Warning: invalid file descriptor -1 in syscall write() ==13616== ==13616== HEAP SUMMARY: ==13616== in use at exit: 260,453 bytes in 1,157 blocks ==13616== total heap usage: 13,835 allocs, 12,678 frees, 2,138,249 bytes allocated ==13616== ==13616== 149 (56 direct, 93 indirect) bytes in 1 blocks are definitely lost in loss record 65 of 84 ==13616== at 0x4C2CC70: calloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==13616== by 0x596E604: ber_memcalloc_x (in /usr/lib/x86_64-linux-gnu/liblber-2.4.so.2.8.3) ==13616== by 0x4E48687: ldap_result (in /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2.8.3) ==13616== by 0x4E4ACA6: ldap_pvt_search_s (in /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2.8.3) ==13616== by 0x4E4AD4F: ldap_search_ext_s (in /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2.8.3) ==13616== by 0x4016D4: main (ldapauth.cpp:72) ==13616== ==13616== 271 (80 direct, 191 indirect) bytes in 1 blocks are definitely lost in loss record 69 of 84 ==13616== at 0x4C2CC70: calloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==13616== by 0x596E604: ber_memcalloc_x (in /usr/lib/x86_64-linux-gnu/liblber-2.4.so.2.8.3) ==13616== by 0x596D031: ber_alloc_t (in /usr/lib/x86_64-linux-gnu/liblber-2.4.so.2.8.3) ==13616== by 0x4E5AA22: ldap_alloc_ber_with_options (in /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2.8.3) ==13616== by 0x4E48BB7: ldap_result (in /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2.8.3) ==13616== by 0x4E4ACA6: ldap_pvt_search_s (in /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2.8.3) ==13616== by 0x4E4AD4F: ldap_search_ext_s (in /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2.8.3) ==13616== by 0x4016D4: main (ldapauth.cpp:72) ==13616== ==13616== LEAK SUMMARY: ==13616== definitely lost: 136 bytes in 2 blocks ==13616== indirectly lost: 284 bytes in 3 blocks ==13616== possibly lost: 0 bytes in 0 blocks ==13616== still reachable: 260,033 bytes in 1,152 blocks ==13616== suppressed: 0 bytes in 0 blocks ==13616== Reachable blocks (those to which a pointer was found) are not shown. ==13616== To see them, rerun with: --leak-check=full --show-leak-kinds=all ==13616== ==13616== For counts of detected and suppressed errors, rerun with: -v ==13616== ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 0 from 0) I don't understand why. Do you have a idea ? I work on Ubuntu 14.04. The OpenLDAP version is 2.4.31. Thanks, Jean-Marc.

2 2

How to use ldapsearch -Esync ?
by Thomas Cort 16 Mar '15

16 Mar '15

Hi, I'm writing a script that acts on changes in LDAP. I want it to watch the stream of changes, and if the script gets restarted, pick up where it left off. I'm hoping to just be able to pipe ldapsearch -Esync into an LDIF parser -- instead of using the C API. I can get all of the changes with the -Esync=ro option and stream the changes with -Esync=rp, but I can't seem to find the magic combination to pick up where it left off. I tried the command mentioned in the "Replication from OpenLDAP to Fedora 389 DS" thread[1], but no matter what cookie I use (the final control value either as a base64 string or decoded) I can't seem to get it to pick up where it left off. Is my understanding wrong or am I missing something? This is how I understand/expect it to work: ldapsearch ... -Esync=ro # get everything, plus a cookie at the end. # feed the cookie to the next command ldapsearch ... -Esync=ro/cookie # get everything since the last search Any help would be greatly appreciated. Thanks, Thomas [1] http://www.openldap.org/lists/openldap-technical/201402/msg00327.html

1 0

external authentication source
by Dieter Klünter 16 Mar '15

16 Mar '15

Hi, rfc-4422 describes an EXTERNAL mechanism. Is there any means of defining and configuring an external authentication and authorization source, like an external sasl server? Or is this just confined to the client to provide an appropriate authorization string? -Dieter -- Dieter Klünter | Systemberatung http://sys4.de GPG Key ID: E9ED159B 53°37'09,95"N 10°08'02,42"E

3 3

openldap mirror mode replication does the versions of client matter
by Rakesh Rajasekharan 14 Mar '15

14 Mar '15

Hi, I have set up mirror mode replication with both my masters running 2.4.39 version. I have around 1000 clients connecting. The versions of openldap on these clients varies from 2.3.43( thats really old I know) , 2.4.23 and few have 2.4.39. My problem is the ldap servers almost hangs or freezes when the clients start connecting. In the error logs , I see this pattern " conn=6005 fd=4199 closed (TLS negotiation failure " Is this something to do with the client versions and will upgrading help. I was skeptical as this is in production. One more question, In mirror mode is it ok to have more than 2 masters. Thanks, Rakesh

2 1

Is CA issued certificate using OpenSSL as good as GoDaddy
by jeevan kc 12 Mar '15

12 Mar '15

I followed the below OpenLDAP guide to create CA issued certificate using OpenSSL and was able to enable SSL in the ldap server and applications can connect via ldaps:// port 636. Now I have some questions from the management where this certificate is as safe as the commercial certificates out there. Can someone clarify this? I would appreciate it. I followed the same procedures mentioned in the guide. 4.2 CA Issued CertificateIf you have access to a trusted Certificate Authority (CA), then step through the CA process to get a CA certificate, server certificate and server private key. See section 5.0 for info on how to configure your server with these items.However, if a trusted CA is not available, OpenSSL makes the same process quick and easy.The steps: 1. Create any directory for creating and signing your certificates. For example, /var/myca.% mkdir /var/myca2. Change to /var/myca and run the OpenSSL CA script (in /usr/share/ssl/misc/ on my box):% cd /var/myca/ % /usr/share/ssl/misc/CA.sh -newca CA certificate filename (or enter to create) <enter> Making CA certificate ... Using configuration from /etc/ssl/openssl.cnf Generating a 1024 bit RSA private key ..........................++++++ .........................++++++ writing new private key to './demoCA/private/./cakey.pem' Enter PEM pass phrase: <ca pass> Verifying password - Enter PEM pass phrase: <ca pass again> ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:US State or Province Name (full name) [Some-State]:Texas Locality Name (eg, city) []:Austin Organization Name (eg, company) [Internet Widgits Pty Ltd]:Example Org Organizational Unit Name (eg, section) []:Example Unit Common Name (eg, YOUR name) []:example.com Email Address []:. %This creates demoCA/cacert.pem and demoCA/private/cakey.pem (CA cert and private key).3. Make your server certificate signing request (CSR):% openssl req -newkey rsa:1024 -nodes -keyout newreq.pem -out newreq.pem Using configuration from /etc/ssl/openssl.cnf Generating a 1024 bit RSA private key ..............++++++ ..........................++++++ writing new private key to 'newreq.pem' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:US State or Province Name (full name) [Some-State]:Texas Locality Name (eg, city) []:Austin Organization Name (eg, company) [Internet Widgits Pty Ltd]:Example Org Organizational Unit Name (eg, section) []:Example Org Unit Common Name (eg, YOUR name) []:myserver.com Email Address []:ldap@myserver.com Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: <pass> An optional company name []:. %The result is newreq.pem.4. Have the CA sign the CSR:% /usr/share/ssl/misc/CA.sh -sign Using configuration from /etc/ssl/openssl.cnf Enter PEM pass phrase: <ca pass> Check that the request matches the signature Signature ok The Subjects Distinguished Name is as follows countryName :PRINTABLE:'US' stateOrProvinceName :PRINTABLE:'Texas' localityName :PRINTABLE:'Austin' organizationName :PRINTABLE:'Example Org' organizationalUnitName:PRINTABLE:'Example Org Unit' commonName :PRINTABLE:'myserver.com' emailAddress :IA5STRING:'ldap(a)myserver.com' Certificate is to be certified until Apr 10 18:58:58 2004 GMT (365 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated Certificate: Data: Version: 3 (0x2) Serial Number: 1 (0x1) Signature Algorithm: md5WithRSAEncryption Issuer: C=US, ST=Texas, L=Austin, O=Example Org, OU=Example Unit, CN=example.com Validity Not Before: Apr 11 18:58:58 2003 GMT Not After : Apr 10 18:58:58 2004 GMT Subject: C=US, ST=Texas, L=Austin, O=Example Org, OU=Example Org Unit, CN=myserver.com/Email=ldap@myserver.com Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (1024 bit) Modulus (1024 bit): < ... > Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: D0:C0:9D:46:30:65:2A:9C:63:63:6A:E6:FE:E4:AC:F7:21:F8:33:61 X509v3 Authority Key Identifier: keyid:31:2E:0D:FB:A0:74:5A:0B:4B:C5:C4:E0:69:7F:32:6D:AF:46:82:F1 DirName:/C=US/ST=Texas/L=Austin/O=Example Org/OU=Example Unit/CN=example.com serial:00 Signature Algorithm: md5WithRSAEncryption < ... > -----BEGIN CERTIFICATE----- < ... > -----END CERTIFICATE----- Signed certificate is in newcert.pem %This creates newcert.pem (server certificate signed by CA) with private key, newreq.pem.5. Now the certificates can be moved to the desired certificate repository and renamed. I prefer /usr/var/openldap-data as my certificate directory.% cp demoCA/cacert.pem /usr/var/openldap-data/cacert.pem % mv newcert.pem /usr/var/openldap-data/servercrt.pem % mv newreq.pem /usr/var/openldap-data/serverkey.pem % chmod 400 /usr/var/openldap-data/serverkey.pem

3 2

Re: external authentication source
by Hallvard Breien Furuseth 12 Mar '15

12 Mar '15

On 12. mars 2015 14:13, Mattes wrote: > Wouldn't "lapwhoami -Y EXTERNAL -H ldapi://" be more usefull? Duh, right. (ldapwhoami) -- Hallvard

1 0

question about binding to our new openldap server
by Wang, Hui 11 Mar '15

11 Mar '15

Hi We just upgrade our OS system and installed the most recent openldap version: 2.4.4. I moved the config file and related openldap data files from older version 2.3.4 onto this new server. I can't make successful binding at this moment. The following is from the log file. Should I install the same version of openldap on this new box since I am trying to binding with old data file? Thank you all. Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 fd=10 ACCEPT from IP=130.*.*.*:61404 (IP=0.0.0.0:389) Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 op=0 BIND dn="" method=128 Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 op=0 RESULT tag=97 err=0 text= Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 op=1 SRCH base="ou=Auth,o=csun" scope=0 deref=0 filter="(objectClass=*)" Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 op=1 SRCH attr=1.1 Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 op=1 SEARCH RESULT tag=101 err=32 nentries=0 text= Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 op=2 SRCH base="ou=Auth,o=csun" scope=0 deref=0 filter="(objectClass=*)" Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 op=2 SEARCH RESULT tag=101 err=32 nentries=0 text= Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 op=3 SRCH base="ou=Auth,o=csun" scope=1 deref=0 filter="(objectClass=*)" Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 op=3 SRCH attr=objectclass subschemaSubentry Mar 11 13:21:47 oldaptest01 slapd[28623]: conn=1039 op=3 SEARCH RESULT tag=101 err=32 nentries=0 text= Mar 11 13:22:05 oldaptest01 slapd[28623]: conn=1040 fd=13 ACCEPT from IP=130.*.*.*:62211 (IP=0.0.0.0:389) Mar 11 13:22:05 oldaptest01 slapd[28623]: conn=1040 op=0 BIND dn="cn=directory manager,o=csun" method=128 Mar 11 13:22:05 oldaptest01 slapd[28623]: conn=1040 op=0 RESULT tag=97 err=49 text= Mar 11 13:22:07 oldaptest01 slapd[28623]: conn=1040 op=1 UNBIND Mar 11 13:22:07 oldaptest01 slapd[28623]: conn=1040 fd=13 closed Mar 11 13:22:08 oldaptest01 slapd[28623]: conn=1041 fd=13 ACCEPT from IP=130.*.*.*:62213 (IP=0.0.0.0:389) Mar 11 13:22:08 oldaptest01 slapd[28623]: conn=1041 op=0 BIND dn="cn=directory manager,o=csun" method=128 Mar 11 13:22:08 oldaptest01 slapd[28623]: conn=1041 op=0 RESULT tag=97 err=49 text= Mar 11 13:22:09 oldaptest01 slapd[28623]: conn=1041 op=1 UNBIND Mar 11 13:22:09 oldaptest01 slapd[28623]: conn=1041 fd=13 closed Hui Wang CSUN IT department

3 2

could not bind to openldap
by Wang, Hui 11 Mar '15

11 Mar '15

Hi We just installed openldap on a new server. I could not bind to it. I tried with anonymous user and also the user from the default conf file. But doesn't work. Can anyone help? Here is my conf file and my logs database bdb suffix "dc=my-domain,dc=com" rootdn "cn=Manager,dc=my-domain,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. # directory /usr/local/var/openldap-data directory /usr/local/var/openldap-data/defaultFromServerInstall # Indices to maintain index objectClass eq from log file: Mar 11 13:45:36 oldaptest01 slapd[27984]: slapd starting Mar 11 13:47:25 oldaptest01 slapd[27984]: conn=1000 fd=10 ACCEPT from IP=130.*.*.*:54015 (IP=0.0.0.0:389) Mar 11 13:47:25 oldaptest01 slapd[27984]: conn=1000 op=0 BIND dn="" method=128 Mar 11 13:47:25 oldaptest01 slapd[27984]: conn=1000 op=0 RESULT tag=97 err=0 text= Mar 11 13:47:25 oldaptest01 slapd[27984]: conn=1000 op=1 SRCH base="dc=my-domain,dc=com" scope=0 deref=0 filter="(objectClass=*)" Mar 11 13:47:25 oldaptest01 slapd[27984]: conn=1000 op=1 SRCH attr=1.1 Mar 11 13:47:25 oldaptest01 slapd[27984]: conn=1000 op=1 SEARCH RESULT tag=101 err=32 nentries=0 text= Mar 11 13:47:25 oldaptest01 slapd[27984]: conn=1000 op=2 SRCH base="dc=my-domain,dc=com" scope=0 deref=0 filter="(objectClass=*)" Mar 11 13:47:25 oldaptest01 slapd[27984]: conn=1000 op=2 SEARCH RESULT tag=101 err=32 nentries=0 text= Mar 11 13:47:25 oldaptest01 slapd[27984]: conn=1000 op=3 SRCH base="dc=my-domain,dc=com" scope=1 deref=0 filter="(objectClass=*)" Mar 11 13:47:25 oldaptest01 slapd[27984]: conn=1000 op=3 SRCH attr=objectclass subschemaSubentry Mar 11 13:47:25 oldaptest01 slapd[27984]: conn=1000 op=3 SEARCH RESULT tag=101 err=32 nentries=0 text= Mar 11 13:50:52 oldaptest01 slapd[27984]: conn=1001 fd=13 ACCEPT from IP=130.*.*.*:62744 (IP=0.0.0.0:389) Mar 11 13:50:52 oldaptest01 slapd[27984]: conn=1001 op=0 BIND dn="cn=Manager,dc=my-domain,dc=com" method=128 Mar 11 13:50:52 oldaptest01 slapd[27984]: conn=1001 op=0 RESULT tag=97 err=49 text= Mar 11 13:50:53 oldaptest01 slapd[27984]: conn=1001 op=1 UNBIND Mar 11 13:50:53 oldaptest01 slapd[27984]: conn=1001 fd=13 closed Hui Wang (Holly) CSUN IT Department Identity and Directory Service 818-677-2031 holly.wang(a)csun.edu

1 0

ppolicy configuration
by Igor Shmukler 10 Mar '15

10 Mar '15

Hello, I am trying to apply per domain password policy. [At some point, it seems, these scripts worked for me, but I must have messed something up either in the setup or the scripts.] I managed to load ppolicy.la and from lsof(8), I can see it. Now, I want to be able to turn password policy on each domain. I have a simple script invoked as: $sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f ppolicy.ldif The ppolicy.ldif is: dn: olcOverlay=ppolicy,olcDatabase={2}hdb,cn=config changetype: add objectClass: olcPPolicyConfig olcOverlay: ppolicy olcPPolicyDefault: cn=ppolicy,ou=policies,dc=example,dc=com olcPPolicyUseLockout: TRUE olcPPolicyHashCleartext: TRUE When I try to add the online configuration, I get: SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 adding new entry "olcOverlay=ppolicy,olcDatabase={2}hdb,cn=config" ldap_add: Other (e.g., implementation specific) error (80) additional info: User Schema load failed for attribute "pwdAttribute". Error code 17: attribute type undefined I also have an LDIF for default policy, added as: $ldapadd -x -D cn=admin,dc=example,dc=com -W -f default_ppolicy.ldif It contains: dn: ou=policies,dc=example,dc=com objectClass: top objectClass: organizationalUnit ou: policies dn: cn=ppolicy,ou=policies,dc=example,dc=com objectClass: top objectClass: device objectClass: pwdPolicyChecker objectClass: pwdPolicy cn: ppolicy pwdAttribute: userPassword pwdInHistory: 8 pwdMinLength: 8 pwdMaxFailure: 3 pwdFailureCountInterval: 1800 pwdCheckQuality: 0 pwdMustChange: TRUE pwdGraceAuthNLimit: 0 pwdMaxAge: 7776000 pwdExpireWarning: 1209600 pwdLockoutDuration: 900 pwdLockout: TRUE When I try to add default_ppolicy.ldif, I get: adding new entry "ou=policies,dc=example,dc=com" adding new entry "cn=ppolicy,ou=policies,dc=example,dc=com" ldap_add: Invalid syntax (21) additional info: objectClass: value #2 invalid per syntax It seems that OU=policies is created, but CN=ppolicy is not created. Is that right? I have four (4) values for objectClass. How can I find out which one is triggering the error? Any suggestions where I should start looking?! Thank you, Igor Shmukler

3 7

ldap_sasl_bind_s question
by Markus Moeller 05 Mar '15

05 Mar '15

Hi, I try to replace deprecated ldap_bind_s with ldap_sasl_bind_s but I am missing some details about how to do that. With ldap_bind_s I have method as a int and ldap.h has the following defined /* authentication methods available */ #define LDAP_AUTH_NONE ((ber_tag_t) 0x00U) /* no authentication */ #define LDAP_AUTH_SIMPLE ((ber_tag_t) 0x80U) /* context specific + primitive */ #define LDAP_AUTH_SASL ((ber_tag_t) 0xa3U) /* context specific + constructed */ #define LDAP_AUTH_KRBV4 ((ber_tag_t) 0xffU) /* means do both of the following */ #define LDAP_AUTH_KRBV41 ((ber_tag_t) 0x81U) /* context specific + primitive */ #define LDAP_AUTH_KRBV42 ((ber_tag_t) 0x82U) /* context specific + primitive */ but in ldap_sasl_bind_s it is a char variable and I do not know what the value would be for the above auth methods. Where can I find them documented ? int ldap_sasl_bind_s(LDAP *ld, const char *dn, const char *mechanism, struct berval *cred, LDAPControl *sctrls[], LDAPControl *cctrls[], struct berval **servercredp); Thank you Markus

3 5

ldap specifying host attribute
by Rakesh Rajasekharan 04 Mar '15

04 Mar '15

Hi, I am trying to set up a host based authentication. For that ,am modifying the host attribute of existing users through an ldif file as below dn: uid=sam,ou=People,dc=example,dc=com changetype: modify add: objectClass objectClass: hostObject - add: host host: abc host: xyz Is there a way I can put the lidt of hosts in a single line something like this host: xyz abc Thanks, Rakesh

2 3

Re: ACLs using dynlist overlay
by Michael Ströder 04 Mar '15

04 Mar '15

Mattes wrote: > Setting olcLogLevel should do it without restarting. But that will trace _all_ requests, not really > an option on a production system. Looks like I have to clone the database to debug the ACLs. You're testing new ACLs on a production system without having tested them on an isolated test system? This is asking for trouble! Ciao, Michael.

1 0

Error while instaling slapd
by Verónica Ovando 04 Mar '15

04 Mar '15

I need some help for solving this problem when I try to install slapd package on Debian from testing repositories. |Leyendo lista de paquetes... Hecho Creando árbol de dependencias Leyendo la información de estado... Hecho Se instalarán los siguientes paquetes NUEVOS: slapd 0 actualizados, 1 se instalarán, 0 para eliminar y 2 no actualizados. Necesito descargar 1.344 kB de archivos. Se utilizarán 4.091 kB de espacio de disco adicional después de esta operación. Des:1 http://debian.linuxmint.com/latest/ testing/main slapd amd64 2.4.31-1+nmu2+b1 [1.344 kB] Descargados 1.344 kB en 50seg. (26,4 kB/s) Preconfigurando paquetes ... Seleccionando el paquete slapd previamente no seleccionado. (Leyendo la base de datos ... 260763 ficheros o directorios instalados actualmente.) Desempaquetando slapd (de .../slapd_2.4.31-1+nmu2+b1_amd64.deb) ... Procesando disparadores para man-db ... Configurando slapd (2.4.31-1+nmu2+b1) ... Omitting slapd configuration as requested. insserv: warning: script 'K01subversion' missing LSB tags and overrides insserv: warning: script 'subversion' missing LSB tags and overrides [warn] No configuration file was found for slapd at /etc/ldap/slapd.conf. ... (warning). invoke-rc.d: initscript slapd, action "start" failed. dpkg: error al procesar slapd (--configure): el subproceso instalado el script post-installation devolvió el código de salida de error 1 Se encontraron errores al procesar: slapd E: Sub-process /usr/bin/dpkg returned an error code (1) | I do not understand why is trying to find the slapd.conf file, because this versión of slapd(2.4.31) uses cn=config. Thanks in advance.

3 3

problems adding indexs
by Greg Jetter 04 Mar '15

04 Mar '15

Hello: I'm new to openldap and just finished installing it from the ubuntu repository , I added a set of records and now would like to add indexing on some of the record attributes . I read extensively on how to do this , however every attempt ends in failure , I'm not grasping the procedures correctly. I'm using Openldap 2.4 that uses the cn=config method of configuration instead of the slapd.conf file. I created an ldif file containing : dn: olcDatabase={1}hdb,cn=config add: olcDbIndex olcDbIndex: cdmadauserstatus eq using : sudo ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f AddIndexs.ldif it respons with : ldapmodify: wrong attributeType at line 3, entry "olcDatabase={1}hdb,cn=config" Can someone please show me a example of the correct syntax and proper commands to add indexs ? The documentation is pretty clear how to do it using the older method of the config file , but I can't seem to find any working examples of using the new dynamic way . My time is running out I'll have to dump every thing and start with a re build from source if I can't find an answer. thank you for your assistance. Greg contents of olcDatabase={1},cn=config : # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 29ec482d dn: olcDatabase={1}hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=acsalaska,dc=net olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymou s auth by dn="cn=admin,dc=acsalaska,dc=net" write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by self write by dn="cn=admin,dc=acsalaska,dc=net" write by * read olcLastMod: TRUE olcRootDN: cn=admin,dc=acsalaska,dc=net olcRootPW:: e1NTSEF9cHFUS2t1RWorRjYvZk5wYWZveEZVSCtCQk8xclQzc20= olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq olcDbIndex: uid eq,pres,sub structuralObjectClass: olcHdbConfig entryUUID: 61596770-3b76-1034-8c70-dd19f7d221e0 creatorsName: cn=config createTimestamp: 20150128201708Z entryCSN: 20150128214111.474826Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20150128214111Z

4 4

ACLs using dynlist overlay
by Mattes 04 Mar '15

04 Mar '15

Dear collected list wisdom, I'm trying to set up access control using membership in a dynamic list.I've activated the dynlist overlay and configured it like this: olcDlAttrSet: groupOfURLs memberURL member and installed an ACL: olcAccess: to dn.regex=".+,<some base>" by self read by group/groupOfURLs/member="<group DN>" search Browsing the directory I can see the member attributes being added to the group, but testing access with slapacl I encounter the following error:54ef3976 => bdb_entry_get: found entry: "<group DN>" 54ef3976 <= bdb_entry_get: failed to find attribute member What am I doing wrong? N.B.: I _did_ add member to the list of allowed attributes for a groupOfURLs ... TIA Ralf Mattes

4 9

OpenLDAP/LMDB at QCon London
by Howard Chu 03 Mar '15

03 Mar '15

For those of you around the UK, I'll be giving a talk at QCon London this Thursday. http://qconlondon.com/presentation/ldap-lightning-speed -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Centos yum repo for openldap 2.4.40
by Divya Vikraman 02 Mar '15

02 Mar '15

Hi, Is there a centos yum repo for openldap 2.4.40. I am planning to upgrade my openldap versions from 2.4.39 ( that are currently available from yum) to 2.4.40. Since I have to configure on many hosts , was trying to avoid compiling. Thanks, Divya

2 1

multiple password policies and pwdPolicySubentry
by Guruprasad Kulkarni 02 Mar '15

02 Mar '15

Hi, I am running openldap 2.4.40 on Ubuntu 12.04 I need to use N-way multi master replication and there are only 2 masters I am using syncrepl configuration and for the sake of security I didn't want to use the rootdn credentials for replication (I didnt want slapd.conf to have its password in plain text in syncrepl section) So I created a ldapreplicator account on both masters just for replication and only has read privileges I also have a default password policy on the ldap which has requirements that all passwords should expire in 30 days, have lockout duration, etc. The problem is the password policy is also applied to the ldapreplicator account and due to this, the synchronization fails once the password expires. I tried to add a different password policy to ldapreplicator using pwdPolicySubentry but keep getting error 21 invalid syntax. I looked into the documentation and online as well, but I am not sure why I keep getting the invalid syntax error. To keep this post short, I am attaching the slapd.conf, the password policies (default and for replicator), the ldif containing instructions for adding password policy to ldapreplicator and log output I am sure I am missing something, any help would be greatly appreciated -- -Guruprasad

2 3

using cn=config to retrieve DIT records
by Igor Shmukler 02 Mar '15

02 Mar '15

Hello, I have a multi-tenant [multiple DITs] LDAP directory setup. One of things that I need to be able to do, is to retrieve records from individual domain [DIT] -level databases using "superuser" credentials. I am able to do what I need using Unix sockets, as in: $sudo ldapsearch -Y EXTERNAL -H ldapi:/// -b dc=example,dc=com I want to use network credentials and network library to retrieve my information. I am currently able to do this using DIT -level credentials. If I set salt the config password, is there something that would fundamentally prevent the below from working? $ldapsearch -D cn=config -h IPADRRESS -W -b dc=example,dc=com Suggestions? Sincerely, Igor Shmukler

2 3

Re: RE24 testing call (2.4.41)
by devzero2000 02 Mar '15

02 Mar '15

On Wed, Feb 18, 2015 at 1:53 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > If you know how to build OpenLDAP manually, and would like to participate > in testing the next set of code for the 2.4.41 release, please do so. > > Generally, get the code for RE24: > > <http://www.openldap.org/devel/gitweb.cgi?p=openldap. > git;a=snapshot;h=refs/heads/OPENLDAP_REL_ENG_2_4;sf=tgz> > > Configure & build. > > Execute the test suite (via make test) after it is built. > > Thanks! > > Platform : lsb_release -a LSB Version: :core-4.1-amd64:core-4.1-noarch:cxx-4.1-amd64:cxx-4.1-noarch:desktop-4.1-amd64:desktop-4.1-noarch:languages-4.1-amd64:languages-4.1-noarch:printing-4.1-amd64:printing-4.1-noarch Distributor ID: RedHatEnterpriseServer Description: Red Hat Enterprise Linux Server release 7.0 (Maipo) Release: 7.0 Codename: Maipo Test RESULT OK --Quanah > > > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > >

1 0

RE24 testing call (2.4.41)
by Quanah Gibson-Mount 02 Mar '15

02 Mar '15

If you know how to build OpenLDAP manually, and would like to participate in testing the next set of code for the 2.4.41 release, please do so. Generally, get the code for RE24: <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> Configure & build. Execute the test suite (via make test) after it is built. Thanks! --Quanah -- Quanah Gibson-Mount Platform Architect Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

Case Sensitive Binds
by Bram Cymet 27 Feb '15

27 Feb '15

Hi, I am using openldap 2.4.26. My system ignores case when doing binds: Feb 27 16:08:08 devauth slapd[2437]: conn=2723 op=1 BIND dn="uid=Bcymet(a)cbnco.com,ou=test_websales_users,dc=ls,dc=cbn" method=128 Feb 27 16:08:08 devauth slapd[2437]: => bdb_entry_get: found entry: "uid=bcymet(a)cbnco.com,ou=test_websales_users,dc=ls,dc=cbn" So this happily binds with bcymet(a)cbnco.com or Bcymet(a)cbnco.com and returns the same entry. Is this a configuration error on my part? Is it possible to have case sensitive binds and if so what do I have to change? Thanks, -- Bram Cymet Software Developer Canadian Bank Note Co. Ltd. 613-608-9752

3 2

main: TLS init def ctx failed: -1
by jeevan kc 27 Feb '15

27 Feb '15

Hi all,I followed the TLS directives and was able to generate cacert, servercert and server key and also sign it. I also did the configuration o to /usr/local/etc/openldap/slapd.d/cn=config.ldif: § olcTLSCACertificateFile: /usr/local/etc/openldap/cacert.pem § olcTLSCertificateFile: /usr/local/etc/openldap/servercrt.pem § olcTLSCertificateKeyFile: /usr/local/etc/openldap/serverkey.pem Everything was working fine but when I shut down slapd, it doesn't start and gives me this error daemon: IPv6 socket() failed errno=97 (Address family not supported by protocol)Feb 26 15:28:56 lap00551 slapd[14775]: main: TLS init def ctx failed: -1 Can Someone please tell me what the error is and how I fix the issue? Thanks Jeevan

3 4

openldap 2.4.23 password reset sync issue
by Rakesh Rajasekharan 27 Feb '15

27 Feb '15

Hi There, I am using openldap 2.4.23 and trying to set up mirror mode replciation with 2 masters I have been able to set this up and the sync initially appeared to work fine . However, i noticed that the password resets are not getting synced . I am able to login to one of the master server on which I did the change but not on the other and any of the clients. Heres my slapd.conf serverID 1 database bdb suffix "dc=ldap,dc=qa,dc=test,dc=com" checkpoint 1024 15 rootdn "cn=ldapadmin,dc=ldap,dc=qa,dc=test,dc=com" loglevel 256 sizelimit 500 rootpw secret overlay ppolicy ppolicy_default "cn=default,ou=policies,dc=ldap,dc=qa,dc=test,dc=com" ppolicy_use_lockout ppolicy_hash_cleartext directory /mnt1/ldapdata index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index entryCSN,entryUUID eq syncrepl rid=001 provider="ldaps://ldap1-test" binddn="uid=syncrepl,ou=People,dc=ldap,dc=qa,dc=test,dc=com" bindmethod=simple credentials="secret" searchbase="dc=ldap,dc=qa,dc=test,dc=com" type=refreshAndPersist interval=00:00:00:10 retry="5 10 60 +" timeout=1 schemachecking=off scope=sub tls_cacert=/etc/openldap/sslcerts/Standby.pem mirrormode true overlay syncprov syncprov-checkpoint 50 10 syncprov-sessionlog 100 any inputs on how can i get through this issue. Thanks, Rakesh

3 3

ldapsearch gives partial results
by Emmanuel Dreyfus 26 Feb '15

26 Feb '15

Hello I have a problem with ldapsearch sometimes returning partial results. The result code is still 0 (success), but the list of object is limited to 63 or 127 (it seems there is a 2^n-1 pattern) items instead of expected 136. It will happen after 10 to 15 requests that return the complete result. The filter is below. It can happen even if only DN are requested (no attributes): (&(|(ou=example1)(ou=example2))(objectClass=netExamplePerson) (!(netExampleHidden=TRUE))(netExempleActive=TRUE)) This is OpenLDAP 2.4.40, BDB 4.8.30. All attributes in the filter are indexed, and it happens after the openldap-data directory has been cleared and everything has been reconstructed from scratch. -- Emmanuel Dreyfus manu(a)netbsd.org

4 8

Can't get certificates installed on new server
by Philip Colmer 26 Feb '15

26 Feb '15

I'm getting a generic error 80 when I try to use ldapmodify to configure my LDAP server to use a SSL certificate. Here is the LDIF I'm using: dn: cn=config changetype: modify add: olcTLSCACertificateFile olcTLSCACertificateFile: /etc/ssl/certs/gd_bundle-g2-g1.pem - add: olcTLSCertificateFile olcTLSCertificateFile: /etc/ssl/private/wildcard.linaro.org.key - add: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/ssl/certs/wildcard.linaro.org.crt and the command: ldapmodify -v -x -H ldapi:/// -f certinfo.ldif -D cn=admin,cn=config -W Running logging at the highest level doesn't seem to give me much to go on ... Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: daemon: epoll: listen=8 active_threads=0 tvp=NULL Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: daemon: epoll: listen=9 active_threads=0 tvp=NULL Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: daemon: epoll: listen=10 active_threads=0 tvp=NULL Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: daemon: epoll: listen=11 active_threads=0 tvp=NULL Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: conn=1001 op=1 do_modify Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: conn=1001 op=1 do_modify: dn (cn=config) Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: >>> dnPrettyNormal: <cn=config> Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: <<< dnPrettyNormal: <cn=config>, <cn=config> Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: conn=1001 op=1 modifications: Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: #011add: olcTLSCACertificateFile Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: #011#011one value, length 34 Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: #011add: olcTLSCertificateFile Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: #011#011one value, length 40 Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: #011add: olcTLSCertificateKeyFile Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: #011#011one value, length 38 Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: conn=1001 op=1 MOD dn="cn=config" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: conn=1001 op=1 MOD attr=olcTLSCACertificateFile olcTLSCertificateFile olcTLSCertificateKeyFile Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: <= acl_access_allowed: granted to database root Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_required entry (cn=config), objectClass "olcGlobal" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "objectClass" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "cn" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcConfigFile" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcConfigDir" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcArgsFile" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcAttributeOptions" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcAuthzPolicy" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcConcurrency" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcConnMaxPending" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcConnMaxPendingAuth" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcGentleHUP" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcIdleTimeout" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcIndexSubstrIfMaxLen" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcIndexSubstrIfMinLen" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcIndexSubstrAnyLen" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcIndexSubstrAnyStep" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcIndexIntLen" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcListenerThreads" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcLocalSSF" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcLogLevel" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcPidFile" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcReadOnly" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcReverseLookup" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcSaslSecProps" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcSockbufMaxIncoming" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcSockbufMaxIncomingAuth" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcThreads" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcTLSVerifyClient" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcTLSProtocolMin" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcToolThreads" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcWriteTimeout" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "structuralObjectClass" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "entryUUID" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "creatorsName" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "createTimestamp" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcTLSCACertificateFile" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcTLSCertificateFile" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "olcTLSCertificateKeyFile" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "entryCSN" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "modifiersName" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: oc_check_allowed type "modifyTimestamp" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: send_ldap_result: conn=1001 op=1 p=3 Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: send_ldap_result: err=80 matched="" text="" Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: send_ldap_response: msgid=2 tag=103 err=80 Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: conn=1001 op=1 RESULT tag=103 err=80 text= Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: daemon: activity on 1 descriptor Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: daemon: activity on: Feb 25 14:03:08 ip-10-166-134-219 slapd[1651]: 14r I've checked that the user that slapd is running under can read the three files. Any suggestions or clarification on what I've overlooked? Thanks. Regards Philip

4 4

LMDB set range to return less than or equal key
by Victor Baybekov 25 Feb '15

25 Feb '15

Hi! In my use case I have found that MDB_SET_RANGE and MDB_GET_BOTH_RANGE queries are much more useful, in 90+% cases, when they return less than or equal key, not greater or equal. I have tested a quick implementation of "get less or equal", and it is c.50% slower in memory. I must say that if someone told me, before I learned about LMDB, that even with 50% less than original performance such numbers are possible, I would not believe - both are millions ops per seconds in my isolated in-memory microbenchmark. But still, such queries are building blocks of N operations that could require non-linear (N^x, x > 1) number of queries and I am interested if I could easily speed this up closer to the built-in MDB_SET_RANGE. The C code is in this gist <https://gist.github.com/buybackoff/59dabc70fa5ec8351bbe#file-mdb_cursor_get…>. I call it from C# via P/Invoke, the test code is here <https://gist.github.com/buybackoff/59dabc70fa5ec8351bbe#file-c-test-via-pin…>. I made sure that only C methods are different, all other code is the same in C#. But even with the P/Invoke overhead the difference is visible. My naive approach is to use MDB_SET_RANGE as the first step and, if the key from this query is not equal to the requested key, to call MOVE_PREV. Other than an additional call to MOVE_PREV, it requires allocation of a copy of the original key, because MDB_SET_RANGE overwrites it and I haven't found a better way to compare the requested key with the key returned after MDB_SET_RANGE. My experience with C (without # or ++) is 4 days less than 2 month, LMDB was the major reason I started, so my code could be really stupid... If it is not, are there other options? E.g. to recompile LMDB for "less or equal" as default behavior. I have tried to change this code inside `mdb_node_search`: if (rc *>* 0) { /* Found entry is *less than* the key. */ i*++*; /* Skip to get the *smallest entry larger than* key. */ if (!IS_LEAF2(mp)) node = NODEPTR(mp, i); } to this code: if (rc *<* 0) { /* Found entry is greater than the key. */ i*--*; /* Skip to get the *largest entry smaller than* key. */ if (!IS_LEAF2(mp)) node = NODEPTR(mp, i); } but it fails badly. Is "greater or equal" approach deeply rooted in the design of LMDB, or I have missed just a small number of other places and it is feasible to change the behavior globally? If that is possible, I would like to do so and to use my current approach for "greater or equal" instead. I cannot test this quickly on a larger-that-RAM data set (because I struggle with my 128Gb laptop drive). But as far as I understand, in most cases MDB_SET_RANGE will load the page with a previous key in RAM - usually this is the same page or one that has been touched during the search? So in the on-disk scenario the incremental MOVE_PREV will be negligible and I should not worry about that? Is there another, completely different and better, way to perform "less than or equal" query? Thanks! Victor

2 1

SSL CA Certificate issue ../../CA/newcerts: No such file or directory
by jeevan kc 24 Feb '15

24 Feb '15

Hi all I'm having trouble with the generation of CA. Please see the error at the bottom and I'd appreciate any help to fix the issue. [root@lap00551]# mkdir /var/myca/[root@lap00551]cd/var/myca[root@lap00551 myca]# /usr/local/openssl.1.0.0d/misc/CA.sh -newcaCA certificate filename (or enter to create) Making CA certificate ...Generating a 1024 bit RSA private key.............++++++........................++++++writing new private key to './demoCA/private/./cakey.pem'Enter PEM pass phrase:Verifying - Enter PEM pass phrase:-----You are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank.-----Country Name (2 letter code) [GB]:USState or Province Name (full name) [Berkshire]:****Locality Name (eg, city) [Newbury]:****Organization Name (eg, company) [My Company Ltd]:****Organizational Unit Name (eg, section) []:DISCommon Name (eg, your name or your server's hostname) []:lap00551.****Email Address []:**** Please enter the following 'extra' attributesto be sent with your certificate requestA challenge password []:****An optional company name []:****Using configuration from /etc/pki/tls/openssl.cnfEnter pass phrase for ./demoCA/private/./cakey.pem:I am unable to access the ../../CA/newcerts directory../../CA/newcerts: No such file or directory Regards,Jeevan

2 2

SSL CA Certificate issue ../../CA/newcerts: No such file or directory
by jeevan kc 24 Feb '15

24 Feb '15

Hi all I'm having trouble with the generation of CA. Please see the error at the bottom and I'd appreciate any help to fix the issue. [root@lap00551]# mkdir /var/myca/[root@lap00551]cd/var/myca[root@lap00551 myca]# /usr/local/openssl.1.0.0d/misc/CA.sh -newcaCA certificate filename (or enter to create) Making CA certificate ...Generating a 1024 bit RSA private key.............++++++........................++++++writing new private key to './demoCA/private/./cakey.pem'Enter PEM pass phrase:Verifying - Enter PEM pass phrase:-----You are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank.-----Country Name (2 letter code) [GB]:USState or Province Name (full name) [Berkshire]:****Locality Name (eg, city) [Newbury]:****Organization Name (eg, company) [My Company Ltd]:****Organizational Unit Name (eg, section) []:DISCommon Name (eg, your name or your server's hostname) []:lap00551.****Email Address []:**** Please enter the following 'extra' attributesto be sent with your certificate requestA challenge password []:****An optional company name []:****Using configuration from /etc/pki/tls/openssl.cnfEnter pass phrase for ./demoCA/private/./cakey.pem:I am unable to access the ../../CA/newcerts directory../../CA/newcerts: No such file or directory Regards, Jeevan

1 0

create new user with same UID and GID
by Fabián M Sales 24 Feb '15

24 Feb '15

I am creating users in LDAP and I assign different UID and GUI. For example. uid = _16661_ (user1) gid = _16664_ (user1) groups = _16664_ (user1) I need that when the user is created is created with the same UID and GID for user created. as I do this? I would love for it to be so: uid = _16664_ (user1) gid = _16664_ (user1) groups = _16664_ (user1) Thanks in advance -- Firma Institucional *Fabián* *M. Sales *Soporte Técnico & I.T.I Linux *DonWeb * La Actitud Es Todo www.DonWeb.com ------------------------------------------------------------------------ Nota de confidencialidad: Este mensaje y archivos adjuntos al mismo son confidenciales, de uso exclusivo para el destinatario del mismo. La divulgación y/o uso del mismo sin autorización por parte de DonWeb.com queda prohibida. DonWeb.com no se hace responsable del mensaje por la falsificación y/o alteración del mismo. De no ser Ud el destinatario del mismo y lo ha recibido por error, por favor, notifique al remitente y elim?elo de su sistema. Confidentiality Note: This message and any attachments (the message) are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited by DonWeb.com. DonWeb.com shall not be liable for the message if altered or falsified. If you are not the intended addressee of this message, please cancel it immediately and inform the sender Nota de Confidencialidade: Esta mensagem e seus eventuais anexos podem conter dados confidenciais ou privilegiados. Se você os recebeu por engano ou não é um dos destinatários aos quais ela foi endereçada, por favor destrua-a e a todos os seus eventuais anexos ou copias realizadas, imediatamente. É proibida a retenção, distribuição, divulgação ou utilização de quaisquer informações aqui contidas. Por favor, informenos sobre o recebimento indevido desta mensagem, retornando-a para o autor.

7 8

root dn password: which one is the reference?
by Jephte Clain 23 Feb '15

23 Feb '15

hello, I have an ldap server with rootdn cn=admin,dc=domain,dc=tld and password set in cn=config (this is openldap 2.4.40 on debian squeeze) I have also the ldap objet cn=admin,dc=domain,dc=tld in the database, with a *different* password both password seem to authenticate. is this expected? This used NOT to work (I don't remember but I think it was on an old version using slapd.conf). I have always considered the password defined in cn=config to be the last resort password, in case the database is corrupted. but when the database is active, I expect the password in the database to be the reference. Being able to regularly change the root dn password looks like a good thing to me. Obviously I'm wrong :-) Out of curiosity, when did this change, if ever? TIA. with best regards, -- Jephté Clain Direction des Systèmes d'Information et des Usages Numériques - 2IG Tél. 0262 93 86 31 Fax. 0262 93 81 06

2 2

cross DIT/TLD rootdn - or allow a foreign rootdn
by lejeczek 22 Feb '15

22 Feb '15

hi everybody I'm just looking at the surface and still have lots to read/lean, but I thought this one should be easy to achieve/set up. Having multiple top level domains I wanted to allow rootdn from other domain (say B) to have similar access rights to rootdn of home domain (say A) and i put this into config of A domain to * by dn="cn=manger,dc=B,dc=topdom" manage but I get infamous: Insufficient access (50) additional info: no write access to parent Is possible what I try to do, does LDAP allow, i prepared for such a scenario? If yes can I get some light shed on what I got wrong or did not get at all. many thanks.

2 2

porting an old bdb wrapper to lmdb - any tips/docs?
by Paul DeBruicker 22 Feb '15

22 Feb '15

Hi - I'm going to port a Smalltalk BerkeleyDB wrapper that was created in 2002 to LMDB. Are there any docs that might help me get my bearings? I've found the ones in the LMDB source code/doxygen site. Thanks Paul

1 0

replica from a to b
by Desfosses, Francois 20 Feb '15

20 Feb '15

Hello World! First of all, I'm not very familiar with LDAP slapd.d config style, well neither with slapd.conf! (I took those server from the old sysadmin, so I'm still in the learning process.) I've been banging my head on the walls for the past 2 days with this, and I can't make it work. I have a server, up and running, and working. (Inside amazon aws) I cloned that server, and started it, working just fine. Then I went on this; https://documentation.fusiondirectory.org/en/documentation/replication_syncr epl Executed that stuff on the first/primary/provider, as mentioned on that page. I'm not even sure it's working but, LDAP is still working as well as sssd. So nothing seems broken. (using Centos 6.6 x86_64) I went on the cloned/secondary/consumer and executed that part mentioned above. But I can't make the LDIF working, I'm getting errors. As I am looking at my /etc/openldap/slapd.d/cn=config/ folder, I see that I have all the files EXCEPT the olcDatabase={1}bdb.ldif, this leads me to think that there is no DB, and therefore, I cannot create or use the creation portion of the replica. Now I am confused. What should be my next step? Create from scratch a new openldap empty DB? Or just duplicate via RSYNC the primary info including the /var/lib/ldap folder ? Or, maybe that site I was looking up brought me in the wrong direction and there might be a better place that explain how to set up a replica with the slapd.d configuration style ? Best regards Francois D.

4 4

LMDB: comparison contexts, lifetimes, composite keys
by Lauri Alanko 19 Feb '15

19 Feb '15

Hello. I have some non-OpenLDAP-related LMDB questions and suggestions. I hope this is the correct list for them. If not, please point to a better venue. It seems that MDB_cmp_func is a plain binary function without a context parameter. This makes it impossible to tune a comparison operation at runtime (without libffi magic, anyway). In particular, it makes it difficult to create bindings for the set_compare operation in other languages. Funnily enough MDB_rel_func _does_ have a context pointer, even though it is not used yet. So would it be feasible to add a similarly contextful version of the comparison function? (Arguably these two could share the context pointer, it could just be mdb_dbi_set_userctx.) Although the documentation in lmdb.h is generally good, it's a bit wishy-washy when it comes to lifetimes of data. The mdb_get documentation only says: "The memory pointed to by the returned values is owned by the database". My understanding is that the pointers to the key/data pair retrieved from the database are valid for the duration of the current transaction. After the transaction is over, the page in which the key/data pair was located may be reclaimed for other uses. If this is correct, could it be reflected in the documentation a bit more explicitly? The current behavior is a bit inconsistent, though, in that depending on the operation, mdb_cursor_get may or may not update the `key` argument to point to the key in the database. It would be much clearer if after the call it _always_ pointed to the key in the database, even for operations (like MDB_SET_KEY) where the value of the key would be the same as the input argument. Finally, what is the recommended way of dealing with composite keys? Suppose I want to look up a value associated to a pair of keys (say, a directory id and a filename). There are several ways of doing this: * Encode the pair (key1, key2) into a single key, use that normally. * Use MDB_DUPSORT, encode each (key2, value) as data for a duplicate key key1. Make sure the encoding is such that the data are sorted by key2. Then use MDB_GET_BOTH_RANGE to look up the nearest entry for a given (key1, key2) pair and check it actually has the correct key2. * Create a named database for each key1, store its name as the data for key1. Store normal (key2, value) pairs in the named database, Each of these has its problems. The first is somewhat wasteful, especially if, say, key1 is long and often repeated. The second is what I use, but it feels a bit kludgy: I'm supposed to use a key-value store yet I still have to manually decode and encode key-value pairs to and from their constituents. The third has lots of overhead if there are very few entries for a given key1, and it requires us to manually manage the lifetimes of the named databases. My understanding is that MDB_DUPSORT internally does something close to the third option (but with optimizations to avoid wasting pages for just a few entries), but just using empty data items in the key-specific subdatabase. Would it then be feasible to add direct support for composite keys by allowing non-empty data there? Thanks, Lauri Alanko la(a)iki.fi

2 2

2.4.40 RPMs for openSUSE
by Michael Ströder 17 Feb '15

17 Feb '15

HI! After some struggle and help by some opensuse-packaging list members (thanks!) I achieved almost what I wanted. I'd appreciate if someone could work on SLES support. Build status and files: https://build.opensuse.org/package/show/home:stroeder:branches:network:ldap… If you're using the openldap packages shipped with openSUSE make sure to read the .changes files to see whether something could break your current setup. Up to now I've tested openSUSE 13.2 and Factory on x86_64 and Factory_ARM on rasperry pi. Note: openSUSE 12.3 was announced to be EOL so I've disabled the repo in my home project. I can easily re-enable it if needed (or branch my repo in your own home project). The usual disclaimer: Don't play with it in production! The download repos are here: http://download.opensuse.org/repositories/home:/stroeder:/branches:/network… Make yourself familiar with zypper commands. Example: Add the repo in openSUSE 13.1 (command in one line): zypper addrepo --refresh http://download.opensuse.org/repositories/home:/stroeder:/branches:/network… Please test. Your feedback is appreciated. Especially have a look at whether the RPMs behave well regarding config files, package descriptions etc. There's a new package openldap2-contrib with a selection of overlays from, you might have guessed, the contrib/ source directory. slapo-noopsrch is still missing because of http://www.openldap.org/its/index.cgi?findid=7998 Since web2ldap makes heavy use of noop search control I'd be glad if someone could look into ITS#7998. ;-) Ciao, Michael.

1 2

[SOLVED] Re: Inconsistent answer from LDAP Server
by Yoann Gini 16 Feb '15

16 Feb '15

Hello, Just for information, I’ve found the mechanism in OpenLDAP allowing integrators to do stupid things: overlays. Apple has created a customer overlay for their own services and has recently added hardcoded value for specific request with specific attributes. http://www.opensource.apple.com/source/OpenLDAP/OpenLDAP-499.27/OpenLDAP/se… I didn’t know that overlay was able to have deep control like that over LDAP request. I can’t thanks you for this end since no one has ever mentioned that OpenLDAP has official hooking API on LDAP request but here is the solution for my problem and now I know how to fix it by my own, without waiting for a fix from Apple, just patching slapd, changing a condition in odusers_search function. Best regards, Yoann

5 4

Indexing in openldap.
by Mangesh Sawant 16 Feb '15

16 Feb '15

Hi, I want information regarding adding index on an ldap attribute. My directory structure is like: ObjectClass Hierarchy: Company=>Department (In dc=example,dc=com) Inside ObjectClass"Company", One of the attributes "UserID" to be indexed. I have added index on the same as per following in slapd.conf: index UserID eq Kindly let me know whether it is the correct syntax of defining an index. Thanks And Regards , Mangesh Sawant .

1 0

Re: syncrepl multiple providers?
by Michael Ströder 16 Feb '15

16 Feb '15

Mark R Bannister wrote: > Is it possible to configure syncrepl on the consumer side with a failover > policy so that if one provider goes down it can automatically retry against > another? On each consumer you should use separate syncrepl directives for each provider you want to get data from. Two providers -> two syncrepl statements. Note the hint about RID values for each syncrepl statement in the docs. > That would remove the need for separate load balancers. No need for any kind of load balancers serving syncrepl. I'd rather consider load balancers for replication harmful. You may want to have a look in the admin guide: http://www.openldap.org/doc/admin24/replication.html Ciao, Michael.

2 2

How to debug single object syncrepl failure
by Geoff Crompton 16 Feb '15

16 Feb '15

Hi, I have a particular object in my LDAP database that is failing to replicate (using syncrepl between two slapd's running 2.4.31-1+nmu2 on Debian Wheezy), despite other objects succeeding to replicate. I'm not using a 'filter' configuration in my olcSyncrepl configuration that might exclude this particular object, and I've checked that the binddn I'm using has permission to see this object all the attributes of the object that isn't replicating. The (sanitised) configuration on the consumer is: dn: olcDatabase={1}hdb,cn=config olcSyncrepl: {0}rid=104 provider=ldap://producer.example.com bindmethod=simple binddn="uid=replicator,ou=pseudoaccounts,dc=example,dc=com" credentials="..." searchbase="dc=example,dc=com" logbase="cn=accesslog" logfilter="(& (objectClass=auditWriteObject)(reqResult=0))" schemachecking=off type=refreshAndPersist retry="60 +" syncdata=accesslog starttls=critical tls_reqcert=demand On the producer the overlay configuration for the database being replicated is: dn: olcOverlay={1}syncprov,olcDatabase={1}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {1}syncprov olcSpCheckpoint: 100 600 olcSpSessionlog: 100 olcSpNoPresent: TRUE If I follow the sanitising I did in the above, then the failing object would be uid=replicationcheck,ou=pseudoaccounts,dc=example,dc=com, and a successfully replicated object would be uid=geoffc,ou=People,dc=example,dc=com. I've stopped slapd on the consumer and deleted all the /var/lib/ldap/ database files, to force re-replication. I get the same symptoms, this one object doesn't replicate, but lots of other objects do replicate. Any tips on how to further debug this? Many thanks, -- Geoff Crompton, System Administrator T: +61 (0)3 9348 7138 Trinity College | University of Melbourne | Royal Parade, Parkville | Victoria 3052, Australia www.trinity.unimelb.edu.au

4 4

ldap_result() timeout zero returns only one result at a time
by Mark R Bannister 15 Feb '15

15 Feb '15

Hi, I've discovered this with the python-ldap module, but having discussed it with the author and done some further testing I'm pretty sure this is down to the ldap_result() C API. I have written a daemon that has a number of worker threads. A worker thread can launch an async LDAP search operation, and then it goes off to do other work while the search is running. It adds the FD of the socket used for the search operation to its select() call, and if there is data to read on that FD it wakes up and runs ldap_result() to grab those results. If the results are incomplete, it goes back around the loop again (check for more work to do, call select, wake up, ldap_result etc.) When I call ldap_result(), the timeout parameter is 0. It turns out, however, this is not what I want. When I run an LDAP search operation with say 80,000 entries, examining the program with truss (on Solaris) on strace (on RHEL) reveals that I end up going around that loop 80,000 times, I call select() 80,000 times, I call ldap_result() 80,000 times ... one per entry. The behaviour I actually want is for ldap_result() to return all the items currently available in kernel buffers but without waiting for any new network packets to arrive. The best approximation I can get for this is to use a timeout value of 0.0001. Having tried various values, this is best for the hardware I'm testing with when OpenLDAP is listening on the loopback interface. It reduces the number of times I called select() from 80,000 times to about 3,000 times, and shaved 5 seconds off the total execution time. However, I'm acutely aware that results will be hardware dependent, and will differ when I'm using a physical network interface. So what I'm asking is, what is the best way of achieving the following workflow: - start LDAP search - start loop - select() on FD, wake me up when there is data to read - ldap.result() gives me ALL available data, and without waiting for anything new - Attend to other unrelated events - Go round loop again Thanks & regards, Mark Bannister. http://dbis.sf.net DBIS, a replacement for RFC2307

2 2

RE: Is OpenLDAP PAE Aware?
by Jack Kielsmeier 14 Feb '15

14 Feb '15

I suppose I should also mention the older version of OpenLDAP we are running. It's openldap-2.4.17. From: Jack Kielsmeier Sent: Friday, February 13, 2015 9:40 AM To: openldap-technical(a)openldap.org Subject: Is OpenLDAP PAE Aware? Hello, We have an older LDAP server running on a 32-bit Linux OS. We've had slapd crash 2 times now, running out of memory. The box only has 2GB of RAM, but it's using PAE capable hardware and PAE support is enabled in Linux. We are debating if we should simply just add more RAM to the box, or rebuild the server. Obviously, rebuilding the server would be the best solution, but adding more RAM would be the quickest. Is 32-bit OpenLDAP able to address 4GB of memory? Thanks, - [cid:image003.png@01CFB713.F712CDA0]<http://www.lightedge.com/> Jack Kielsmeier Systems Engineer Phone: 515-471-1712 E-mail: jkielsmeier(a)lightedge.com<mailto:jkielsmeier@lightedge.com> Follow Us: [cid:image012.png@01CFB715.39A84900] <http://twitter.com/lightedge> [cid:image013.png@01CFB715.39A84900] <http://www.linkedin.com/groups?gid=1846184&trk=hb_side_g> [cid:image014.png@01CFB715.39A84900] <http://www.facebook.com/pages/Des-Moines-IA/LightEdge-Solutions/105451056954> [cid:image010.png@01CFB713.F712CDA0] <http://blog.lightedge.com/> "This message may contain confidential and/or privileged information. If you are not the addressee or authorized to receive this for the addressee, you must not use, copy, disclose, or take any action based on this message or any information herein. If you have received this message in error, please advise the sender immediately by reply e-mail and delete this message. Thank you for your cooperation."

3 3

Is OpenLDAP PAE Aware?
by Jack Kielsmeier 14 Feb '15

14 Feb '15

Hello, We have an older LDAP server running on a 32-bit Linux OS. We've had slapd crash 2 times now, running out of memory. The box only has 2GB of RAM, but it's using PAE capable hardware and PAE support is enabled in Linux. We are debating if we should simply just add more RAM to the box, or rebuild the server. Obviously, rebuilding the server would be the best solution, but adding more RAM would be the quickest. Is 32-bit OpenLDAP able to address 4GB of memory? Thanks, - [cid:image003.png@01CFB713.F712CDA0]<http://www.lightedge.com/> Jack Kielsmeier Systems Engineer Phone: 515-471-1712 E-mail: jkielsmeier(a)lightedge.com Follow Us: [cid:image012.png@01CFB715.39A84900] <http://twitter.com/lightedge> [cid:image013.png@01CFB715.39A84900] <http://www.linkedin.com/groups?gid=1846184&trk=hb_side_g> [cid:image014.png@01CFB715.39A84900] <http://www.facebook.com/pages/Des-Moines-IA/LightEdge-Solutions/105451056954> [cid:image010.png@01CFB713.F712CDA0] <http://blog.lightedge.com/> "This message may contain confidential and/or privileged information. If you are not the addressee or authorized to receive this for the addressee, you must not use, copy, disclose, or take any action based on this message or any information herein. If you have received this message in error, please advise the sender immediately by reply e-mail and delete this message. Thank you for your cooperation."

2 1

Inconsistent answer from LDAP Server
by Yoann Gini 13 Feb '15

13 Feb '15

Hello, I’m working with OS X Server 10.9 who’s using OpenLDAP to provide directory services. I’ve a problem with a simple LDAP request who is not consistent depending of the attribute filter requested. Here are the two commands I’ve used in my CLI: ldapsearch -x -H ldap://192.168.42.10 -b "cn=passwordserver,cn=config,dc=example,dc=com" "(objectclass=*)" and ldapsearch -x -H ldap://192.168.42.10 -b "cn=passwordserver,cn=config,dc=example,dc=com" "(objectclass=*)" apple-xmlplist For each request, the content of apple-xmlplist is different. The problem is the same with ldap_search_ext_s in C. I’ve looked the request with wireshark and the only difference I see is the presence or not of the attribute request. The rest of the request is exactly the same. I don’t understand how is it possible. Do you know this bug? Do you have a way to edit the stored record used for the request with the filter (it’s the one used by Apple internal tools, so it’s not really possible for me to change it). Here are version info: @(#) $OpenLDAP: slapd 2.4.28 (Nov 12 2013 12:02:47) $ root@hikkaduwa.apple.com:/private/var/tmp/OpenLDAP/OpenLDAP-491.1~1/servers/slapd ldapsearch: @(#) $OpenLDAP: ldapsearch 2.4.28 (Nov 12 2013 12:04:43) $ root@hikkaduwa.apple.com:/private/var/tmp/OpenLDAP/OpenLDAP-491.1~1/clients/tools (LDAP library: OpenLDAP 20428) Best regards, Yoann Gini

5 18

Re: Inconsistent answer from LDAP Server
by Michael Ströder 13 Feb '15

13 Feb '15

Yoann Gini wrote: > >> Le 13 févr. 2015 à 16:05, Michael Ströder <michael(a)stroeder.com> a écrit : >> You should really remind *Apple* about what is Open Source while they are >> selling it to people like you willing to pay for it. > > If you want Apple contribution to OpenSource software, you can get it here > http://www.opensource.apple.com Just publishing a download page is not how contributing to Open Source projects work, especially when adding proprietary patches not yet proven to be generally useful. Open Source is more than wearing a cool github t-shirt spitting yet another random fork of something into the cyberspace. > I’m wondering what would be this conversation if I’ve never said it was on > Apple OS. This is not the point. *Your* personal attitude is the problem. Ciao, Michael.

1 0

Data is not replicating in other LDAP server in open-ldap mode configuration
by Shashi Ranjan 13 Feb '15

13 Feb '15

Hello, I am new to openldap, facing some issue in replication of data in one instance to other instance of openldap 2.4.11. I have two instance of openldap 2.4.11 and it is configured in multi-master mode. I import the data in one ldap instance using slapadd command(in that time both the instances are down as it ?pre-requisite to run the slapadd command. ). After importing the data, when I start the both ldap instance, data is not replicated to second ldap instance. I check the ldap behavior after restarting the ldap instance but in all cases it failed. Please provide your input so that we can identified the problem. Thanks, Shashi Ranjan "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

3 2

syncrepl multiple providers?
by Mark R Bannister 13 Feb '15

13 Feb '15

We have a multi-master pair and multiple replicas hanging off it. Currently we have to use a physical load balancer between the replicas and the masters so that the replicas can survive if one master goes down. Is it possible to configure syncrepl on the consumer side with a failover policy so that if one provider goes down it can automatically retry against another? That would remove the need for separate load balancers. Or should I be looking at deploying something like HAProxy on each LDAP replica? Thanks, Mark.

1 0

Add subtrees to replica via ACL
by Maily Peng 13 Feb '15

13 Feb '15

Hello, I'd like to manage replica ( read only) via ACL. So all replica servers would have the same config : olcSyncrepl :rid=001 provider=ldap://ip:389 binddn="cn=seruser-test,ou=AppUsers,dc=test,dc=net" bindmethod=simple credentials=secret searchbase="dc=phonesystems,dc=net" type=refreshAndPersist interval=00:00:00:10 retry="60 10 300 12 7200 +" where searchbase is the base entry. If we want to add a subtree to a replica, we'd only have to add rights to the ACL on the master. exple : ...to dn.subtree="ou=customer,ou=suite,dc=test,dc=net" by group/groupOfNames/member.exact="cn=ser-test-write,ou=groups,cn=system" write by group/groupOfNames/member.exact="cn=ser-test-read,ou=groups,cn=system" read by * none adding to dn.subtree="ou=provider,ou=suite,dc=test,dc=net" by group/groupOfNames/member.exact="cn=ser-test-write,ou=groups,cn=system" write by group/groupOfNames/member.exact="cn=ser-test-read,ou=groups,cn=system" read by * none would add the subtree "ou=provider,ou=suite,dc=test,dc=net" to the replica. It would be easier to manage replica. Is it possible to implement this solution ? Thank you

1 0

Re: Is the monitor backend writable?
by Ferenc Wagner 13 Feb '15

13 Feb '15

"Ulrich Windl" <Ulrich.Windl(a)rz.uni-regensburg.de> writes: > Could it be access problems? No, I used the rootDN. > dn: cn=Total,cn=Connections,cn=Monitor > [...] > Does this help you, or do you want something completely different? I expected to see the current logging configuration in cn=Log,cn=Monitor. -- Feri.

1 0

Is the monitor backend writable?
by Ferenc Wagner 13 Feb '15

13 Feb '15

Hi, >From http://www.openldap.org/faq/data/cache/358.html: dn: cn=Log,cn=Monitor changetype: modify add: managedInfo managedInfo: stats managedInfo: stats2 I'm running 2.4.40 with cn=config, olcLoglevel: stats (thus I can change the log level anyway), but cn=Log,cn=Monitor does not contain any managedInfo attributes (at least $ ldapsearch -x -H ldapi:/// -D cn=monitor -W -b cn=Log,cn=Monitor managedInfo does not return any; cn=monitor is the rootDN of the monitor database). My questions: 1. Is the above FAQ entry outdated? Or is it relevant only when not using cn=config? 2. Are there (other) writeable items under cn=Monitor? -- Thanks, Feri.

2 2

Speed when writing dublicate keys
by Tom Kirchner 13 Feb '15

13 Feb '15

Hi, I have a database with about 1 million integer keys. Now I want to append a lot of small values (each 3 bytes) to random keys very often (tens of millions of times). How do I insert into the database the fastest? Currently I am trying the following setup, but I wonder if that is optimal, because I see a decrease in indexing speed after about 500000 random writes (here appends): - I have split the whole key range into 16 databases (each within a different lmdb environment), so each range-db holds about 65000 keys - I open each range-db with the flags: MDB_APPENDDUP | MDB_INTEGERKEY | MDB_INTEGERDUP | MDB_DUPSORT - then when I want to append 3 bytes to the value of a key, I use the following call: res = mdb_put( txn[dbnumber], db[dbnumber], &k, &v, MDB_APPENDDUP ); Thank you for your help! -Tom

2 2

Re: Is the monitor backend writable?
by Ferenc Wagner 13 Feb '15

13 Feb '15

"Ulrich Windl" <Ulrich.Windl(a)rz.uni-regensburg.de> writes: > Ferenc Wagner <wferi(a)niif.hu> schrieb am 13.02.2015 um 09:20 in Nachricht <874mqqte84.fsf(a)lant.ki.iif.hu>: > >> From http://www.openldap.org/faq/data/cache/358.html: >> >> dn: cn=Log,cn=Monitor >> changetype: modify >> add: managedInfo >> managedInfo: stats >> managedInfo: stats2 >> >> I'm running 2.4.40 with cn=config, olcLoglevel: stats (thus I can change >> the log level anyway), but cn=Log,cn=Monitor does not contain any >> managedInfo attributes (at least >> >> $ ldapsearch -x -H ldapi:/// -D cn=monitor -W -b cn=Log,cn=Monitor managedInfo > > If the default isn't "-s sub", I'd add it, and did you try "monitoredInfo" instead? Neither makes a difference. Not even -s base. Also consider this: $ ldapsearch -LLL -x -H ldapi:/// -D cn=monitor -W -b cn=Log,cn=Monitor -s sub '*' '+' Enter LDAP Password: dn: cn=Log,cn=Monitor objectClass: monitorContainer structuralObjectClass: monitorContainer cn: Log creatorsName: cn=monitor modifiersName: cn=monitor createTimestamp: 20150128093559Z modifyTimestamp: 20150128093559Z description: This subsystem contains information about logging. description: Set the attribute "managedInfo" to the desired log levels. entryDN: cn=Log,cn=Monitor subschemaSubentry: cn=Subschema hasSubordinates: FALSE -- Feri.

1 0

determining what schema are loaded
by chris c 13 Feb '15

13 Feb '15

I've been tasked with adding a mail attribute for an openldap 2.4.23 installation. I've read enough of the entries on the mailing list that talk about the inability to do so being related to the proper schema not being loaded, and I think that is the issue. What I'm struggling with, is how to determine what schema are loaded and where they are loaded from? In reading the Redhat documentation, they reference Required attributes are specified using the objectClass definition, and can be found in schema files located in the /etc/openldap/slapd.d/cn=config/cn=schema/directory. So does this mean that in the above referenced directory, those schema will be loaded?

2 1

Trying to connection php with ldap
by Abhishek koserwal 12 Feb '15

12 Feb '15

*<?php// LDAP variables//$ldaphost = "host";$ldaphost = "localhost";$ldapport = 389;//$ldap_base_dn = "dc=exemplo,dc=com";$ldap_base_dn = "dc=zyz,dc=com";//$ldaprdn = "cn=Manager,$ldap_base_dn";$ldaprdn = "cn=root,$ldap_base_dn";$ldappassw = "my_password";// Connecting to LDAP$ldapconn = ldap_connect($ldaphost, $ldapport) or die ("Could not connect to $ldaphost");@ldap_set_option($ldapconn, LDAP_OPT_PROTOCOL_VERSION, 3);if ($ldapconn) { // binding to ldap server $ldapbind = ldap_bind($ldapconn,$ldaprdn,$ldappassw); // verify binding if (!$ldapbind) { echo '<script>alert("not connected")</script>'; var_dump($ldapbind); exit(); } }?>* Fail to bind, $ldapbind return bool(false). I have configured phpldapadmin, which is working fine. Regards Abhishek Koserwal Final year, CSE, IET-DAVV The capacity to learn is a gift; The ability to learn is a skill; The willingness to learn is a choice -- Brian Herbert

3 2

Re: LDAP searches for Kerberos entries
by Dameon Wagner 12 Feb '15

12 Feb '15

(Reposted to the list rather than just to Michael, sorry about that.) On Wed, Feb 11 2015 at 16:24:09 +0100, Michael Ströder scribbled in "Re: LDAP searches for Kerberos entries": > Simo Sorce wrote: > > On Wed, 2015-02-04 at 12:24 +0100, Michael Ströder wrote: > >> HI! > >> > >> Maybe some of you are using MIT Kerberos with LDAP backend. > >> > >> For creating a decent web2ldap search form template for the > >> Kerberos schema I'd like to know which kind of searches you > >> usually do when looking into your backend via LDAP. > >> > >> Which attributes are you usually using in the search? Which > >> filters do you hack on command-line? > >> > >> Well, 'krbPrincipalName' will of course be the most used search > >> attribute. The default equality matching rule is > >> caseExactIA5Match, so for convenience I'd add something to use > >> caseIgnoreIA5Match without the user having to select that > >> himself. > > > > You should also search on KrbCanonicalName if you need exact > > matching, krbPrincipalName is multivalued and may contain aliases. > > Thanks, added it. > > What about 'krbPrincipalAliases'? Is that actually used? That depends on whether you're using MIT or Heimdal for your your KDCs. IIRC krbPrincipalAliases refers to a feathure of Heimdal's implementation that MIT doesn't have, namely the ability for a principal to have one or more aliases (so host/foo.example.com could have also have HTTP/foo.example.com and ldap/foo.example.com all refer to the same principal in the KDB) If you're using an MIT realm, you probably don't need it. Cheers. Dameon. -- ><> ><> ><> ><> ><> ><> ooOoo <>< <>< <>< <>< <>< <>< Dameon Wagner, Systems Development and Support Team IT Services, University of Oxford ><> ><> ><> ><> ><> ><> ooOoo <>< <>< <>< <>< <>< <><

1 0

OpenLDAP Inheritance not working
by Matthew W. Marshall 12 Feb '15

12 Feb '15

I’m running into an issue with adding users to LDAP, when I use the following LDIF dn: mail=jsmith,ou=customers,dc=mydeqcust,dc=org cn: John Smith sn: Smith uid: jsmith mail: jsmith(a)dev.local<mailto:jsmith@dev.local> objectClass: inetOrgPerson mail: jsmith it adds fine, however does not show any attributes from OrginizationalPerson or Person. I checked in the slapd.d schema files and all the objectClasses have the correct SUP records. My understanding from the docs at http://www.zytrax.com/books/ldap/apa/ldif-objects.html was that openldap will include the inherited items automatically. I’m running slapd 2.4.39 with the slapd.d config style. Is there an additional option I need to configure? Matthew Marshall Network/Systems Engineer 602-771-4637 Matthew.Marshall(a)azdeq.gov<mailto:Matthew.Marshall@azdeq.gov> ********************************************************************** NOTICE: This e-mail (and any attachments) may contain PRIVILEGED OR CONFIDENTIAL information and is intended only for the use of the specific individual(s) to whom it is addressed. It may contain information that is privileged and confidential under state and federal law. This information may be used or disclosed only in accordance with law, and you may be subject to penalties under law for improper use or further disclosure of the information in this e-mail and its attachments. If you have received this e-mail in error, please immediately notify the person named above by reply e-mail, and then delete the original e-mail. Thank you.

3 4

Re: i am new to ldap plz help i have provided ldif file and simple authentication code
by Andrew Findlay 12 Feb '15

12 Feb '15

On Wed, Feb 11, 2015 at 11:19:40AM +0530, Bharath K wrote: > this is my java code where i can get output for "none" authentication when i > use "simple" authentication its not working... > env.put(Context.SECURITY_AUTHENTICATION, "simple"); > env.put(Context.SECURITY_PRINCIPAL, "cn=Manager, ou=People,dc=example,dc=com"); That DN is not in the LDIF data that you posted. It might be set as the rootDN for the database, but we need to see the OpenLDAP configuration to know whether it is right (either the slapd.conf file or an LDIF dump of everything under cn=config depending on which config system you are using). > env.put(Context.SECURITY_CREDENTIALS, "ldap123"); > // env.put(Context.SECURITY_CREDENTIALS, "{SSHA}rZe5WkunQdmRkyCcEHu9g6VsqRecnzIa"); Note that you must send the plain-text password. The SSHA hash is only used in server config or in LDAP entries. > this is my LDIF file > # nagios, People, example.com > dn: uid=nagios,ou=People,dc=example,dc=com > objectClass: inetOrgPerson > objectClass: posixAccount > objectClass: shadowAccount > uid: nagios > sn: nagios > givenName: nagios > cn: nagios > displayName: nagios > uidNumber: 500 > gidNumber: 500 > userPassword:: secret If you want to set the password to 'secret' then you should only have one colon: userPassword: secret Using :: means that the data is Base-64 encoded. Please post the OpenLDAP configuration so that we can check the DNs and passwords. Please also reload the data with the correct userPassword values and try: env.put(Context.SECURITY_PRINCIPAL, "uid=nagios,ou=People,dc=example,dc=com"); env.put(Context.SECURITY_CREDENTIALS, "secret"); VERY IMPORTANT: please post the actual data and the real passwords that you are using to test with. If they are really secret, then change them to something trivial BEFORE doing the tests. Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

1 0

LMDB b-tree question
by Kristoffer Sjögren 11 Feb '15

11 Feb '15

Hi Does every database consist of a separate b-tree or is "database" just a name spacing convince? I.e. are reads faster for many smaller databases rather than one large database? Cheers, -Kristoffer

2 3

Accessing random rows from LMDB
by Sravan Kumar Reddy Javaji 11 Feb '15

11 Feb '15

Hello Everyone, I am new to LMDB. I have couple of questions, 1) Is there anyway that I can find the total number of records in LMDB. 2) Can I access all the rows from LMDB randomly instead of sequentially. For example, if there are 10 rows in LMDB as shown below, Key, Value K1, V1 K2, V2 K3, V3 K4, V4 K5, V5 I want to access it randomly, something like shown below Key, Value K3, V3 K5, V5 K4, V4 K2, V2 K1, V1 I know that it is better to read sequentially from LMDB and then later randomize the records. But I have around 1 million records in LMDB, I cant upload entire data to memory at once. I am planning to read data batch wise into memory and perform some operation on it. So, I am wondering, is there anyway that I can read the data randomly from LMDB directly. Looking forward to hear from you - Regards, Sravan

2 3

Crash with LMDB on iOS
by QW Support 10 Feb '15

10 Feb '15

I'm having trouble running the latest LMDB version on iOS 8.1.3 It seems to work with previous versions before SysV semaphores were used. Now it crashes with SIGSYS on line: semid = semget(IPC_PRIVATE, 2, mode); (line:4520 file:mdb.c) Has anyone got this to work? Thanks - Greg

2 1

Limitation to MirrorMode
by Tony S. Wu 10 Feb '15

10 Feb '15

Hi, Just curious, does MirrorMode have limitation? Is one master to multiple (4 or 5) slaves with MirrorMode supported? Thanks, Tony Wu Sent from my iPhone

1 0

OpenLDAP at CLT 2015
by Michael Ströder 09 Feb '15

09 Feb '15

HI! Peter Gietz, Dieter Klünter and me will be present OpenLDAP at Chemnitzer Linuxtage 2015 and will answer questions about OpenLDAP server, clients, and integration. Booth: https://chemnitzer.linux-tage.de/2015/en/programm/beitrag/134 My presentation: https://chemnitzer.linux-tage.de/2015/en/programm/beitrag/135 See you there. Ciao, Michael.

1 0

NamingContexts and DN question
by Leonard Smith 07 Feb '15

07 Feb '15

I have two Openldap servers ( openldap-servers-2.4.23-32.el6_4.1.x86_64 ) running on Centos 6.4 and I have a question on NamingContexts. Both servers should have been setup with the same ldif file and comparing the database and configs so far hasn't show any differences. However when I query the namingcontexts on one I get # /usr/bin/ldapsearch -H ldapi:/// -LLL -s base namingContexts dn: namingContexts: dc=foo,dc=com While on the second I get # /usr/bin/ldapsearch -H ldapi:/// -LLL namingContexts dn: dc=foo,dc=com Both have a single database. I verified both have the olcSuffix set to dc=foo,dc=com. The olcAccess rules are the same. Any suggestions on why one is returning a DN and the other a namingContext? Thanks Len

2 1

ITS#8046 - remote unauth DoS on 2.4.40
by Paul B. Henson 06 Feb '15

06 Feb '15

I haven't seen any announcement of this other than on security lists, but there's an unauthenticated remote DoS bug in 2.4.40: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776991 The actual ITS is a bit confusing, the reporter at one point says he had the issue with a beta version of 2.4.40 and it didn't work against release, but debian confirmed it kills their official 2.4.40 package and it caused a segfault against my gentoo 2.4.40 release, so if you're running 2.4.40 (older versions not vulnerable), it's probably worth applying the patch from head: http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=patch;h=2f1a2dd32… I rebuilt my 2.4.40 with this and it no longer dies when the PoC query is issued.

2 2

set-based constraints on multi-valued attrs
by Michael Ströder 06 Feb '15

06 Feb '15

HI! I have a hybrid groupOfEntries/posixGroup object class, let's call it 'aeGroup'. It's supposed to serve the same group membership information to RFC2307 and RFC2307bis NSS clients. I want to keep attributes group membership attriutes consistent by using the following constraint: # restrict memberUID to be consistent with group membership defined in member constraint_attribute memberUID,member set "this/memberUID & this/member/uid" restrict="ldap:///dc=example,dc=com??sub?(objectClass=aeGroup)" This does not work as expected. I suspect that the constraint is not applied to each value separately. Rather the constraint is true when any of the values fulfill the constraint rules. Similar constraints cross-referencing values work pretty well for attributes only containing a single value. Any clue? (Yes, I'm already taking care of this in the admin UI web2ldap, but still I want to prevent inconsistent values for any writing LDAP client.) Ciao, Michael.

1 0

Re: plz provide me any simple authentication code in ldap
by Andrew Findlay 06 Feb '15

06 Feb '15

On Fri, Feb 06, 2015 at 10:42:45AM +0530, Bharath K wrote: > To: Andrew Findlay <andrew.findlay(a)skills-1st.co.uk> Please keep your replies on-list so that others with similar problems can learn from the archive. > Subject: Re: plz provide me any simple authentication code in ldap > > i configured openldap and i added user in ldif file,,without authentication its > working.. when i use simple authenticaion its not working its showing as > invalid credentials so what might be the problem??.. I expect the credentials that you are presenting to the LDAP server are invalid (the DN or the password is wrong or is missing). If you want help you need to supply more information. Your code does not include the DN and password that you are trying to use, and you have not supplied any information about the entry that you are trying to bind as. You need to tell us or we cannot help you. When you run this program, what do you put on the command line? Did you turn up the logging as I suggested? What is in the log? Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

1 0

Compaction after a lot of appending dublicate keys
by Tom Kirchner 06 Feb '15

06 Feb '15

1 0

Chinese display garbled
by Tian Zhiying 06 Feb '15

06 Feb '15

Hello My ldif file type is UTF-8 as below. # file test.ldif test.ldif: UTF-8 Unicode text The test.ldif content includes Chinese, as below: # cat test.ldif dn: cn=行政部,ou=domain,dc=domain,dc=com cn: 行政部 gidnumber: 500 objectclass: posixGroup I can add it to the LDAP server. Then excuting this command “# ldapsearch -x -H ldap://localhost -b dc=domain,dc=com” , it display as below: # \E7\94\B0\E5\BF\97\E8\8B\B1, domain, domain.com dn:: Y24955Sw5b+X6IuxLG91PXRodW5kZXJzb2Z0LGRjPXRodW5kZXJzb2Z0LGRjPWNvbQ== cn:: 55Sw5b+X6Iux gidNumber: 500 objectClass: posixGroup objectClass: top How can I deal with it? Can you help me? Thanks!!!

5 5

FW: API to check if LDAP connection is valid?
by Bin Lu 06 Feb '15

06 Feb '15

Hi, Is there a public API that does the same work as LDAP_VALID()? I maintain a group of long live ldap connections but sometimes I get assertions from the library. Wondering if there is a way to check if the connection is still valid before I use it. Thanks, -binlu

1 0

regarding openldap
by Bharath K 06 Feb '15

06 Feb '15

i configured openldap and i added user in ldif file,,without authentication its working.. when i use simple authenticaion its not working its showing as invalid credentials so what might be the problem??..or else for whom shall i concern plz give any suggestions

1 0

Openldap migration from 2.4.11 to 2.4.40 for 4-way multimaster servers
by Gary Ho 05 Feb '15

05 Feb '15

Dear all, I have a 4-way multi-master openldap servers running in version 2.4.11. Let's say the servers name are A, B, C, D. I have another 4-way multi-master openldap servers running in version 2.4.40. Let's say the servers name are W,X,Y,Z. What's the proper procedure of migrating the data from servers A,B,C,D to W,X,Y,Z ? My procedure is as follows :- Export data from server A using slapcat command.- Delete the first 6 lines of the ldif files (the lines contains the contextCSN).- Shutdown the process slapd in servers W,X,Y,Z and remove all the openldap data files under /usr/local/var/openldap-data.- Import the ldif files to server W, then start the slapd process in server W.- Export the ldif files from server W.- Import the ldif files to server X,Y,Z respectively.- Start the slapd process in X,Y,Z. What I observe is that all four servers then has 100% CPU and never drop back to idle ? So, is there anything I do wrong ? Thanks

2 1

plz provide me any simple authentication code in ldap
by Bharath K 05 Feb '15

05 Feb '15

below is my code....by executing this i am getting as error as invalid credentials ############################################################################ import java.util.Hashtable; import javax.naming.Context; import javax.naming.InitialContext; import javax.naming. NamingEnumeration; import javax.naming.NamingException; public class SimpleBindDemo { public static void main(String[] args) throws NamingException { if (args.length < 2) { System.err.println("Usage: java SimpleBindDemo <userDN> <password>"); System.exit(1); } Hashtable env = new Hashtable(); env.put(Context.INITIAL_CONTEXT_FACTORY,"com.sun.jndi.ldap.LdapCtxFactory"); env.put(Context.PROVIDER_URL, "ldap://localhost:389/"); env.put(Context.SECURITY_AUTHENTICATION, "simple"); //env.put(Context.SECURITY_PRINCIPAL,"cn=Manager,ou=People,dc=example,dc=com"); //env.put(Context.SECURITY_CREDENTIALS,"ldap123"); env.put(Context.SECURITY_PRINCIPAL,args[0]); env.put(Context.SECURITY_CREDENTIALS,args[1]); try { Context ctx = new InitialContext(env); NamingEnumeration enm = ctx.list(""); while (enm.hasMore()) { System.out.println(enm.next()); } enm.close(); ctx.close(); } catch (NamingException e) { System.out.println(e.getMessage()); } } }

2 1

ppolicy: pwdMinAge being enforced for managers
by Phil 05 Feb '15

05 Feb '15

Hi all, We're implementing a basic user directory with OpenLDAP and the ppolicy attributes pwdMaxAge and pwdMinAge give use some desired functionality, but we need the ability for managers to reset a user's password. If we use the “rootdn” then this works, but we need to have other user accounts designated as managers. Even if we define ACLs to give our management group “manage” access we can still get the following from ldappasswd: Result: Constraint violation (19) Additional info: Password is too young to change Is there any way to designate a group of users as "managers" such that pwdMinAge is not applied? These are the ACLs we've tried without success to give the “UserAdmin” group the rights: cat <<__EOF | ldapmodify -Y EXTERNAL -H ldapi:/// dn: olcDatabase={2}bdb,cn=config changetype: modify add: olcAccess olcAccess: to attrs=userPassword by self =xw by group.exact="cn=UserAdmin,${LDAP_SERVER_BASE}" manage by anonymous auth by * none olcAccess: to dn.base="ou=Users,${LDAP_SERVER_BASE}" by group.exact="cn=UserAdmin,${LDAP_SERVER_BASE}" manage by * read olcAccess: to dn.children="ou=Users,${LDAP_SERVER_BASE}" filter=(objectClass=posixAccount) by group.exact="cn=UserAdmin,${LDAP_SERVER_BASE}" write by * read olcAccess: to dn.base="cn=UserAdmin,${LDAP_SERVER_BASE}" attrs=member by group.exact="cn=UserAdmin,${LDAP_SERVER_BASE}" write by * read olcAccess: to * by * read - __EOF Thanks Phil

1 0

ldapadd(1) second DIT
by Igor Shmukler 04 Feb '15

04 Feb '15

Hello, I am having a problem executing the ldapadd(1) through ldapi for the below LDIF: dn: olcDatabase=hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: hdb olcDbDirectory: /var/lib/ldap/example.com olcSuffix: dc=example,dc=com olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymou s auth by dn="cn=admin,dc=example,dc=com" write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by self write by dn="cn=admin,dc=example,dc=com" write by * read olcLastMod: TRUE olcRootDN: cn=admin,dc=example,dc=com olcRootPW:: e1NTSEF9NlZSbnN2bkJEWVdSbFFoS1ZWOE1TckxTdWhsc0NvSVg= olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq The error is below: ldapadd: invalid format (line 12) entry: "olcDatabase=hdb" The line 12 contains: olcRootDN, it seems. I successfully tried a similar setup earlier. Please advise what should I check for clues. Sincerely, Igor Shmukler

2 2

bind UID in DN instead of CN
by Dennis 04 Feb '15

04 Feb '15

Hi everyone, I'm new to the ldap stuff, therefore sorry if this is a silly question. My openldap (slapd) version is 2.4.28. To manage openldap I'm using phpldapadmin. I'm using a third party software which relies on ldap to manage users. I've added a test user to ldap via phpldapadmin. The 3rd party software tries to modify/add an object via the following bind: slapd[19030]: conn=1435 fd=18 ACCEPT from IP=X.X.X.X:35541 (IP=0.0.0.0:389) slapd[19030]: conn=1435 op=0 BIND dn="cn=admin,dc=dmp,dc=..." method=128 slapd[19030]: conn=1435 op=0 BIND dn="cn=admin,dc=dmp,dc=..." mech=SIMPLE ssf=0 slapd[19030]: conn=1435 op=0 RESULT tag=97 err=0 text= slapd[19030]: conn=1435 op=1 MOD dn="uid=test1003,ou=users,dc=dmp,dc=..." slapd[19030]: conn=1435 op=1 MOD attr=objectclass slapd[19030]: conn=1435 op=1 RESULT tag=103 err=32 text= slapd[19030]: conn=1435 fd=18 closed (connection lost) This fails because it tries to accomplish this by using dn="uid=...", but as shown in phpldapadmin the dn is cn=Test Testuser,ou=users,dc=dmp,dc=... Therefore the distinguished name for dn="uid=...,ou=users,dc=dmp,dc=..." doesn't exist (the user has a uid of course). Therefore my question is, is there a possibility to change / to configure openldap to use / allow the uid instead of the cn? Or did I something wrong? So far I couldn't find any information about this. Any help is welcome and I would really appreciate this :) Best regards and have a nice weekend! Dennis Wehrle

3 2

Invalid credentials after moving to a new server
by ... 04 Feb '15

04 Feb '15

Hi all, I have running OpenLDAP on a virtual Ubuntu 12.04 32bit. Now I am trying to move with my data to a newer Debian 7 64bit. So I installed OpenLDAP and rsynced /var/lib/ldap and /etc/ldap tot he new machine. When I try to login with the root-bind-dn credentials working on the Ubuntu machine I get the error that I have invalid credentials. Slapcat on the Debian is working and giving out the total database, what can I do to get the login into OpenLDAP working again? Best regards! Andy

2 1

LMDB : mdb_drop is slow
by Venkat Murty 04 Feb '15

04 Feb '15

I have a lmdb environment in linux with 4K (MDB_dbi) databases. The size of the whole lmdb file is around 500G. foreach (MDB_dbi db in databases) { mdb_drop (txn, db, 0); } This process takes more that 10 hours. Is it reasonable ? Thanks, Venkat Murty _______________________ Cogito ergo sum

2 1

Errors building Current Git Version with windows
by Frank Offermanns 02 Feb '15

02 Feb '15

Hello, when building the current GIT Version 2.4.40 with Windows and MinGW/MSYS I get 3 errors: C:/msys/1.0/openldap-2.4.40git/servers/slapd/slapadd.c:116: undefined reference to `ftello' slapadd.o: In function `slapadd': C:/msys/1.0/openldap-2.4.40git/servers/slapd/slapadd.c:486: undefined reference to `ftello' libbackends.a(mdbmdb.o): In function `mdb_cursor_push': C:/msys/1.0/openldap-2.4.40git/servers/slapd/back-mdb/./../../../libraries/liblm db/mdb.c:4990: undefined reference to `GetFileSizeEx' collect2: ld returned 1 exit status make[2]: *** [slapd.exp] Error 1 Configure was: configure --prefix=/mingw --enable-accesslog --with-tls --enable-syncprov Regards, Frank

2 3

MatchingRuleUseDescription::APPLIES
by michael-catchall＠mail.stroeder.local (POP3) 31 Jan '15

31 Jan '15

HI! In yet another attempt to make more use of server's subschema in web2ldap I'm looking more closely at matchingRuleUse in OpenLDAP's subschema subentry. What's the base for the matchingRuleUse values generated by slapd? RFC 4512 is pretty terse on this: APPLIES provides a list of attribute types the matching rule applies to Ah, well... :-/ Basically I wonder why I can't use this filter and why caseIgnoreIA5SubstringsMatch is not listed as being applicable to krbPrincipalName: (krbPrincipalName:caseIgnoreIA5SubstringsMatch:=k/m*) Yes, I know: krbPrincipalName is correctly declared with EQUALITY caseExactIA5Match. But what's the reason you cannot override the equality matching with this extensible filter? Normalization issues when indexing? Ciao, Michael. [1] http://tools.ietf.org/html/rfc4512#section-4.1.4

1 0

Large Number of Transactions x Low performance
by Alessandro Lasmar Mourao 30 Jan '15

30 Jan '15

Hi, I work in a company that has 140,000 registered users in OpenLDAP. This OpenLDAP is used for authentication of our internal systems. In our tree of groups we have the systems and below the each system there are the groups' authorization (systems profiles). The user is bound in each group according to position, function and department in the company. When a user replaces another user hierarchically higher, this user is taken from the respective group (that he belonged) and registered in user_group with the highest hierarchy. This movement in the company is very common, and this is the cause of our problems. We have a group with 50,000 registered users, and when we need to delete a user of that group or add a new one, OpenLADP takes up to 6 minute to effect the transaction. We have a tool (BMC Identity Management (formerly Control-SA)) that automates the transactions, but due to delay in the transactions are with a row of 100,000 operations of insert / delete to perform. I wonder if you have any way to improve the performance of OpenLDAP for these write operations. The OpenLDAP version is 2.4.40. Thanks, Alessandro Lasmar Mourão Below is our slapd.conf: ############################################## serverID 2 idletimeout 0 include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/ldap.schema include /etc/ldap/schema/ppolicy.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel 256 modulepath /usr/lib/ldap/ moduleload back_mdb moduleload back_monitor moduleload memberof moduleload ppolicy moduleload syncprov moduleload refint moduleload accesslog sizelimit 250 tool-threads 16 password-hash {SSHA} monitoring true TLSCACertificateFile /etc/ssl/certs/cacert.pem TLSCertificateFile /etc/ssl/certs/servercrt.pem TLSCertificateKeyFile /etc/ssl/certs/serverkey.pem backend mdb database config rootdn "cn=admin,cn=config" rootpw secret monitoring true database monitor rootdn "cn=admin,cn=monitor" rootpw secret monitoring true database mdb suffix "cn=accesslog" rootdn "cn=admin,cn=accesslog" rootpw secret maxsize 1073741824 monitoring true directory "/var/lib/ldap/intranet/log" index default eq,pres,sub index entryCSN eq,pres index objectClass,reqEnd eq,pres index reqResult,reqStart eq,pres limits dn.exact="uid=replication,ou=Users,o=company" size.soft=unlimited size.hard=unlimited time.soft=unlimited time.hard=unlimited overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE access to * by dn.base="uid=replication,ou=Users,o=company" read by * break database mdb suffix "o=company" rootdn "cn=admin,o=company" rootpw secret maxsize 4294967296 monitoring true overlay ppolicy ppolicy_use_lockout ppolicy_hash_cleartext ppolicy_default "cn=default,ou=policy,o=company" overlay memberof memberof-group-oc groupOfUniqueNames memberof-member-ad uniqueMember memberof-refint true overlay refint refint_attributes uniqueMember overlay accesslog logdb "cn=accesslog" logops writes logsuccess TRUE logpurge 07+00:00 01+00:00 limits dn.exact="uid=replication01,ou=Users,o=company" size.soft=unlimited size.hard=unlimited time.soft=unlimited time.hard=unlimited limits dn.exact="uid=replication02,ou=Users,o=company" size.soft=unlimited size.hard=unlimited time.soft=unlimited time.hard=unlimited limits dn.exact="uid=replication03,ou=Users,o=company" size.soft=unlimited size.hard=unlimited time.soft=unlimited time.hard=unlimited limits dn.exact="uid=replication04,ou=Users,o=company" size.soft=unlimited size.hard=unlimited time.soft=unlimited time.hard=unlimited overlay syncprov syncprov-checkpoint 1000 20 syncprov-sessionlog 10000 syncrepl rid=100 provider=ldap://10.192.184.195:389 searchbase="o=company" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" type=refreshAndPersist retry="60 +" scope=sub schemachecking=on bindmethod=simple binddn="uid=replication01,ou=Users,o=company" credentials=secret mirrormode true directory "/var/lib/ldap/intranet" directory "/var/lib/ldap/intranet" index objectClass eq,pres index uniqueMember,memberof eq,pres index nu-cpf,nu-cnpj eq,pres index dt-nascimento pres index entryUUID,entryCSN eq,pres index uid,ou,cn,sn,mail eq,pres,sub index default,givenname eq,pres,sub lastmod on checkpoint 1024 10 access to attrs=userPassword,shadowLastChange by dn="cn=admin,o=company" write by dn.exact="uid=replica01,ou=Users,o=company" read by dn.exact="uid=replica02,ou=Users,o=company" read by dn.exact="uid=replica03,ou=Users,o=company" read by dn.exact="uid=replica04,ou=Users,o=company" read by anonymous auth by self write by * none access to * by dn="cn=admin,o=company" write by * read

3 4

LMDB memory location on Android
by Kristoffer Sjögren 30 Jan '15

30 Jan '15

Hi LMDB JNI is a Java wrapper ontop of LMDB which runs on Linux, OSX, Windows and Android (arm-linux-androideabi-4.9 x86_64). At the moment the Android implementation rely on buffer copies and we're trying to implement zero copy using memory addresses provided by LMDB. Zero copy is already working on Linux, OSX and Windows but is not as straight forward on Android since the memory addresses are handled differently? We try to use the memory address of a direct ByteBuffer and hand it over to LMDB (exactly how the PC version works) but something is wrong. The full discussion and code on this can be found here. https://github.com/deephacks/lmdbjni/issues/21 I would greatly appreciate any tips on what might be wrong. Cheers, -Kristoffer

1 0

I have added customized schema in ldap, and it is displaying under schema section (phpldapadmin), but how to make accounts on basis of that schema.
by Abhishek koserwal 30 Jan '15

30 Jan '15

I have added customized schema in ldap, and it is displaying under schema section (phpldapadmin), but how to make accounts on basis of that schema. Creating new entries on basis of customized schema added into phpldapadmin. Regards Abhishek Koserwal Final year, CSE, IET-DAVV The capacity to learn is a gift; The ability to learn is a skill; The willingness to learn is a choice -- Brian Herbert

2 1

LMDB usage on windows - to much memory needed
by Frank Offermanns 29 Jan '15

29 Jan '15

Hello, we would like to change our backend from hdb to mdb. I did some initial tests and found out the following: When setting maxsize to 1.4 GB, the size of the database on the file system is about 1.4 GB. I thought I read that the maxsize has nothing to do with the actual physical size needed. (If I have only 10 MB of data my database should be about 10 MB). Even worse is the fact, that slapd.exe then needs about 1.5 GB virtual size memory. And if I use 32 Bit slapd.exe the process will crash when reaching 2 GB virtual size. (as every 32 bit process will do) Now my conclusion is, that the things described in the mdb paper are only valid for unix/linux, because windows uses another memory system. Is this correct? Or is there a way I haven't found to configure OpenLDAP on windows so that it does not need so much RAM. The size on the disk does not matter for us, but since we use only 32 bit slapd.exe the RAM does matter. Best regards, Frank

4 5

LDAPCon 2015 Call for Papers
by Andrew Findlay 29 Jan '15

29 Jan '15

LDAPCon 2015 ============ The fifth International Conference on LDAP and Directory Services will be held in the UK at the University of Edinburgh School of Informatics Forum. Tutorials: 11th November 2015 Conference: 12th and 13th November 2015 Call for papers and tutorials ============================= Topics You are using LDAP in interesting projects? You do LDAP client or server development? You have used LDAP in a new way? You do identity and access management on top of LDAP? Why not share your ideas and experiences with others? We are looking for speakers who are willing to talk about any topic related to LDAP and identity management, including: LDAP technology implementation (Servers, API, User interfaces etc.) LDAP Usage (Schema, Security, Operations, Scaling, big data, etc.) LDAP related technologies (PKI, XACML, SAML, etc.) LDAP and Beyond (IAM, Identity Federation, Authentication on the web, etc.) Best Practices for directory services. Accepted talks will be grouped into tracks such as a standards/development and deployment/administration. Deadlines & Important Dates Submission Deadline: 28th June Author Notification: 10th July Final Papers due: 10th October 2015 Tutorials: 11th November 2015 Conference: 12th-13th November 2015 Talk Submissions Main presentations should last about 45 minutes including discussion; we will also provide smaller slots of 15 minutes and 5 minutes for poster presentations or lightning talks. Please tell us which duration you prefer when proposing your talk. The talk must be in English. The one and only way to submit your abstract (approximately 200-800 words, accompanied by your biography of about 100-300 words) is via email to submissions(a)lists.ldapcon.org. Abstracts must reach the Program Committee by 28th June 2015. Early submission is encouraged. All abstracts will be reviewed by the program committee. For accepted talks we expect you to submit slides and/or a paper of approximately 2-10 pages (A4 or US Letter format, 25mm borders, preferably LaTeX source or OpenOffice). For 5-minute talks, a brief abstract is required. A short paper, slides or a poster should be provided for accepted talks. We will provide display boards for posters throughout the conference. By submitting a paper you grant the conference organizers the non-exclusive right to publish your paper in the conference proceedings and on the website; you maintain the right to publish it elsewhere at your discretion. Tutorial Submissions We are looking for high-quality tutorials on LDAP and related subjects, at any level from introductory to advanced. Tutorial length can range from an hour to a full day. Wireless Internet access will be available if required. The purpose of the tutorials is focussed education, so they should cover established topics and best practice rather than presenting new work. Tutorials will be on Wednesday 11th November 2015. The Programme Committee has an open mind about the format of the tutorial day, but has a limited number of rooms available. Make your proposal early and we will aim to build an attractive programme for the day. Expenses Speakers get free access to the conference, including the social event. If requested in advance we will provide accommodation for speakers. Travel expenses might also be covered in special cases. If you need this, please contact us early so we can try to arrange it. Website http://ldapcon.org/2015/ Contacts General enquiries: enquiries(a)lists.ldapcon.org Paper/Tutorial submissions: submissions(a)lists.ldapcon.org -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

1 0

Search with wildcard
by Alessandro Lasmar Mourao 28 Jan '15

28 Jan '15

I have the following structure in my OpenLDAP: ou = groups |_cn = system1 | | _cn = Group1 | | _cn = Group2 |_cn = system2 | _cn = Group1 | _cn = Group2 I need to perform a search and return only users who are registered on system1, regardless of the registered group. When I use the search with the filter: memberOf=cn=*,cn=system1,ou=groups nothing is returned. How do I perform this search in OpenLDAP? In search Oracle SJDS works!

3 3

Different DIT on separate database
by Maily Peng 28 Jan '15

28 Jan '15

Hello, I'd like to set up a single instance of slapd from two DIT that have been defined in separate mdb databases in order to manage more efficiently indexes. Is-it possible ? thank you ####################################################################### # mdb primary database definitions ####################################################################### backend mdb database mdb suffix "ou=users,dc=domain,dc=net" rootdn "cn=Manager,dc=domain,dc=net" envflags writemap,nometasync lastmod on rootpw directory /usr/local/var/users-data/ ####################################################################### # mdb second database definitions ####################################################################### backend mdb database mdb suffix "ou=profiles,dc=domain,dc=net" rootdn "cn=Manager,dc=domain,dc=net" envflags writemap,nometasync lastmod on rootpw directory /usr/local/var/profile-data/ -- Maï-Ly PENG Database Administrator Keyyo Communications 92-98 bd Victor Hugo 92115 Clichy - France Tél. : 01 72 38 77 87 mpeng(a)keyyo.com <mailto:mpeng@keyyo.com> www.keyyo.com <http://www.keyyo.com/>

4 3

simple authentication
by Bharath K 28 Jan '15

28 Jan '15

env.put(Context.SECURITY_PRINCIPAL,args[0]); env.put(Context.SECURITY_CREDENTIALS,args[1]); what values i have to provide for this parameters?? the code which i am trying is not doing simple authentication > dn: uid=nagios,ou=People,dc= example,dc=com > ... > userPassword:: > dn: uid=test1,ou=People,dc=example,dc=com > ... > userPassword:: > > dn: uid=test2,ou=People,dc=example,dc=com > ... > userPassword:: for above thing i have password... my problem is... it is not doing simple authentication i am expecting to be ask password on output ....but for me its not asking any password it is directly showing output it means it is not doing simple authentication

1 0

slapacl Read:Allow - ldapsearch no result
by Uli Tehrani 26 Jan '15

26 Jan '15

Hello all, i want to allow general read access for attribute sshPublicKey. I configured the following rule on top access to attrs=sshPublicKey by * read slapacl -f /etc/openldap/slapd.conf -vvv -b uid=utehrani,ou=ActiveUser,ou=PosixUser,ou=User,dc=example,dc=com sshPublicKey/read read access to sshPublicKey: ALLOWED But when i run ldapsearch. I get no such object ldapsearch -LLL -h ldap1 -x -b uid=utehrani,ou=ActiveUser,ou=PosixUser,ou=User,dc=example,dc=com sshPublicKey No such object (32) Who can helps ? I am running openldap 2.4.39-8 Thanks in advance Regards Uli Uli -- =================================== Ulrich Tehrani Am Ulrichshof 19 79189 Bad Krozingen +497633806246 u_tehrani(a)yahoo.de ===================================

3 2

OpenLDAP Replication Issue
by Tony S. Wu 26 Jan '15

26 Jan '15

We have 5 servers running OpenLDAP, 001 - 005. Server is CentOS 6.4, LDAP version is openldap-servers-2.4.23-32.el6_4.1.x86_64, current replication topology is: 001 <=> 002 001 <=> 003 001 <=> 004 001 <=> 005 001 is where the phpLDAPAdmin GUI is running on. 002 - 005 are behind a load balancer, 001 is never directly accessed from clients. I understand this makes 001 the single point of failure in terms of replication, but we would like to fix the current issues before exploring more changes. The issue we are running is intermittent failure in replication. Replication is configured as multi-way master with mirror mode, it always works from 001 to the rest, but sometimes fails the other direction. This is particularly bad when user changes password and it doesn't get replicated to back to 001, and when that happens it doesn't get replicated to the rest of the other servers. In the log we see the following error messages sometimes, but when replication fails sometimes there is no log: Error Log: Jan 21 10:56:42 001 slapd[27161]: do_syncrepl: rid=004 rc -2 retrying (4 retries left) Another issue is failure on slapd service. On each of the server we have a cronjob running that basically dumps the database using slapcat once an hour. However once every 2 weeks or so we would find slapd dead right around the same time slapcat was run. There is no obvious error in ldap log, system log, or dmesg. According to the documentation it is safe to run slapcat while slapd is running, is this not true? Below is the replication section of the configuration on 001 and 004. If someone could advise on this it would be very much appreciated. moduleload syncprov.la serverid 1 cachesize 50000 idlcachesize 50000 syncrepl rid=002 provider=ldap://002.server.com binddn="uid=replication,ou=Services,dc=server,dc=com" bindmethod=simple credentials=******** searchbase="dc=server,dc=com" type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 5" timeout=1 starttls=yes tls_reqcert=never * repeat for 003, 004, and 005 * mirrormode true overlay syncprov syncprov-checkpoint 1000 60 syncprov-sessionlog 100 index entryCSN,entryUUID eq

7 9

Re: OpenLDAP Replication Issue
by Marc Patermann 26 Jan '15

26 Jan '15

Tony, Tony S. Wu schrieb (23.01.2015 20:19 Uhr): please keep replies on the list. > We kinda did this out of necessity. This is hell of an answer! :) > Out ultimate goal is to remove > 001, move web UI to 002, and move the replication hub role to 002. > > The reason we haven't done so is because of replication issue. We > would like to at least figure out what's wrong before introducing > additional changes. You may consider moving to a 4 node MMR cluster. Or make 001 and 002 a MMR cluster, which work as provider for your 003 to 005 as read-only replicas, which sent referrals to the provider cluster or use chaining. (You may use a service address for the cluster and move phpLDAPAdmin GUI to the cluster as well.) Maybe these are more commonly used setups than your current one. Marc

1 0

LDAP ldapsearch filter: return uidNumber if person has sub ou=mail
by Leander Schäfer 25 Jan '15

25 Jan '15

I'm trying to construct a ldap filter for my Dovecot/Postfix setup which acts as the example pseudo code & result below: |return uidNumber OF objectClass=posixAccount IF they have a ou=mail AND the mailAddress in this ou=mail IS EQUAL to test(a)Mydomain.TLD || # User-1, people, Mydomain.TLD dn: uid=||User-1,ou=people,dc=MyDomain,dc=TLD uidNumber: 2110 | More specific like this while %s holds e.g.: test(a)Mydomain.TLD: |search_base = dc=Mydomain,dc=TLD query_filter = ( &(objectClass=posixAccount)(ou=mail)(mailAddress=%s) ) result_attribute = uidNumber | But obviously uidNumber is being hold by the posixAccount container one level above - and therewith it won't display what I want. Unfortunately I couldn't figure out how to get it work. My LDAP structure looks like this: => dc=MyDomain,dc=TLD ==> ou=People ===> uid=User-1 ====> uidNumber=4035 ====> ou=mail =====> mailAddress=test(a)Mydomain.TLD ===> uid=User-2 Any help would be greatly apprecitated Thanks Best Regards Leander

4 16

I am new to ldap and i dont know much about ldap simple authentication could you plz help me and give some suggestions......and below is the simple code which i tried and ther is also uid test 1&2 which i want to authenticate
by Bharath K 23 Jan '15

23 Jan '15

import java.util.Hashtable; import javax.naming.Context; import javax.naming.InitialContext; import javax.naming. NamingEnumeration; import javax.naming.NamingException; public class SimpleBindDemo { public static void main(String[] args) throws NamingException { if (args.length < 2) { System.err.println("Usage: java SimpleBindDemo <userDN> <password>"); System.exit(1); } Hashtable env = new Hashtable(); env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory"); env.put(Context.PROVIDER_URL, "ldap://localhost:389/"); env.put(Context.SECURITY_AUTHENTICATION, "simple"); //env.put(Context.SECURITY_PRINCIPAL,"cn=Manager, ou=People,dc=example,dc=com"); //env.put(Context.SECURITY_CREDENTIALS,"ldap123"); env.put(Context.SECURITY_PRINCIPAL,args[0]); env.put(Context.SECURITY_CREDENTIALS,args[1]); try { Context ctx = new InitialContext(env); NamingEnumeration enm = ctx.list(""); while (enm.hasMore()) { System.out.println(enm.next()); } enm.close(); ctx.close(); } catch (NamingException e) { System.out.println(e.getMessage()); } } } ------------------------------------------------------------------------------------------------------------------------ -- # extended LDIF # # LDAPv3 # base <dc=example,dc=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # example.com dn: dc=example,dc=com dc: example objectClass: top objectClass: domain # People, example.com dn: ou=People,dc=example,dc=com ou: People objectClass: top objectClass: organizationalUnit # Group, example.com dn: ou=Group,dc=example,dc=com ou: Group objectClass: top objectClass: organizationalUnit # nagios, People, example.com dn: uid=nagios,ou=People,dc=example,dc=com objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount uid: nagios sn: nagios givenName: nagios cn: nagios displayName: nagios uidNumber: 500 gidNumber: 500 userPassword:: gecos: nagios loginShell: /bin/bash homeDirectory: /home/nagios shadowExpire: -1 shadowFlag: 0 shadowWarning: 7 shadowMin: 0 shadowMax: 99999 shadowLastChange: 15496 # test1, People, example.com dn: uid=test1,ou=People,dc=example,dc=com objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount uid: test1 sn: test1 givenName: test1 cn: test1 displayName: test1 uidNumber: 501 gidNumber: 501 userPassword:: gecos: test1 loginShell: /bin/bash homeDirectory: /home/test1 shadowExpire: -1 shadowFlag: 0 shadowWarning: 7 shadowMin: 0 shadowMax: 99999 shadowLastChange: 16447 # test2, People, example.com dn: uid=test2,ou=People,dc=example,dc=com objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount uid: test2 sn: test2 givenName: test2 cn: test2 displayName: test2 uidNumber: 502 gidNumber: 502 userPassword:: gecos: test2 loginShell: /bin/bash homeDirectory: /home/test2 shadowExpire: -1 shadowFlag: 0 shadowWarning: 7 shadowMin: 0 shadowMax: 99999 shadowLastChange: 16447 # nagios, Group, example.com dn: cn=nagios,ou=Group,dc=example,dc=com objectClass: posixGroup cn: nagios gidNumber: 500 # test1, Group, example.com dn: cn=test1,ou=Group,dc=example,dc=com objectClass: posixGroup cn: test1 gidNumber: 501 # test2, Group, example.com dn: cn=test2,ou=Group,dc=example,dc=com objectClass: posixGroup cn: test2 gidNumber: 502 # search result search: 2 result: 0 Success # numResponses: 10 # numEntries: 9

2 1

occasional user entry being deleted
by Al 23 Jan '15

23 Jan '15

Hi All - I'm having an odd issue where on a rare occasion (a couple of times a week), a new LDAP user entry is being deleted shortly after it is created. Sometimes it happens within a few minutes, sometimes it happens within an hour or so. I have a 4 way multi-master setup, with all writes being directed at a single server with a load balancer. I have the auditlog enabled (from failed attempts at delta sync) and I see auditDelete entries in the auditdb, but its being executed from the internal admin user, not a "real" user. I do not see anything suspect in my system logs running at the normal loglevel. I'm running 2.4.39 on Redhat 6, x64 with mdb. Below is a snippet of my configuration from the specific database in question. Does anyone know why this might be occurring? Any idea on how to further troubleshoot this issue? Thanks in advance - Al dn: olcDatabase={1}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb olcDbDirectory: /PATH/TO/OPENLDAP/var/openldap-data olcSuffix: dc=company,dc=com olcAddContentAcl: FALSE olcLastMod: TRUE olcLimits: {0}dn.base="XXXXXXX" size.soft=unlimited size.hard=unlimited time.soft=unlimited time.hard=unlimited olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=Manager,dc=company,dc=com olcRootPW:: XXXXXXXXX olcSyncUseSubentry: FALSE olcMirrorMode: TRUE olcMonitoring: TRUE olcDbCheckpoint: 512 5 olcDbNoSync: TRUE olcDbIndex: objectClass eq olcDbIndex: entryUUID eq olcDbIndex: entryCSN eq olcDbIndex: cn pres,eq,sub olcDbIndex: uid eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: uniqueMember eq olcDbIndex: nisNetgroupTriple eq olcDbIndex: sudoUser eq,sub olcDbIndex: mail eq olcDbIndex: pwmToken eq,sub olcDbIndex: memberOf eq olcDbMaxSize: 25000000000 olcDbMode: 0600 structuralObjectClass: olcMdbConfig entryUUID: xxxx-xxxx-xxxxx-xxxxx creatorsName: cn=config createTimestamp: 20111014131247Z olcSyncrepl: {0}rid=011 provider=ldap://server1:21389/ bind method=simple timeout=0 network-timeout=0 binddn="XXXXXXX" credentials="XXXX" keepalive=0:0:0 startt ls=critical filter="(objectclass=*)" searchbase="dc=company,dc=com" scope=sub schemachecking=off type=refreshOnly retry="30 +" interval=00:00:00:30 olcSyncrepl: {1}rid=012 provider=ldap://server2:21389/ bind method=simple timeout=0 network-timeout=0 binddn="XXXXXXX" credentials="XXXX" keepalive=0:0:0 startt ls=critical filter="(objectclass=*)" searchbase="dc=company,dc=com" scope=sub schemachecking=off type=refreshOnly retry="30 +" interval=00:00:00:30 olcSyncrepl: {2}rid=013 provider=ldap://server3:21389/ bind method=simple timeout=0 network-timeout=0 binddn="XXXXXXX" credentials="XXXX" keepalive=0:0:0 startt ls=critical filter="(objectclass=*)" searchbase="dc=company,dc=com" scope=sub schemachecking=off type=refreshOnly retry="30 +" interval=00:00:00:30 olcSyncrepl: {3}rid=014 provider=ldap://server4:21389/ bind method=simple timeout=0 network-timeout=0 binddn="XXXXXXX" credentials="XXXX" keepalive=0:0:0 startt ls=critical filter="(objectclass=*)" searchbase="dc=company,dc=com" scope=sub schemachecking=off type=refreshOnly retry="30 +" interval=00:00:00:30 entryCSN: 20140924095732.634049Z#000000#001#000000 modifiersName: cn=Manager,cn=config modifyTimestamp: 20140924095732Z

5 6

Creating LDAP schema issue
by Leander Schäfer 23 Jan '15

23 Jan '15

Hi Unfortunately I'm struggeling, since since 2.5 days. I have to create individual a LDAP schema which suits the currently used LDAP structure. The current tructure looks like this: => dc=MyDomain,dc=TLD ==> ou=People ===> uid=User-1 ====> ou=mail ===> uid=User-2 ====> ou=mail ... and so on ... Within ou=mail should be the individual mail account(s) information of a user. So in the end I want to add a(nother) mail account by something like this: cat << EOF > ./newUser.ldif dn: mailAddress=Test(a)Domain.TLD,ou=mail,uid=User-1,ou=people,dc=MyDomain,dc=TLD objectclass: top objectclass: mailAccount mailAddress: Test(a)Domain.TLD MailPassword: {SSHA}SomePassword MailAccountStatus: active [...] EOF Therefore I setup a LDAP schema like the following, but it seems to ignore the attributes "MailPassword" and "noMailAccountStatus". Why? I don't understand what I'm missing here on my objectclass? I'm sure it is an easy little thing to fix - but I just can't figure it out with the tutarials provided I went thorugh ;/ # ====================== LDAP schema ======================= # # # OID Macros (10001 should be IANA-registered) # objectidentifier nameSpace 1.3.6.1.4.1.10001 objectidentifier mail nameSpace:1 objectidentifier objectClassAccount mail:1 objectidentifier objectClassAccountInfo mail:2 # # Attributes: objectClass[NAME]:1.[SERIAL] # attributetype ( objectClassAccount:1.1 NAME 'mailAddress' DESC 'The hosted mail addresses' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} SINGLE-VALUE ) attributetype ( objectClassAccount:1.2 NAME 'MailPassword' DESC 'The hosted mail password' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40{128} ) attributetype ( objectClassAccount:1.3 NAME 'MailAccountStatus' DESC 'The status of a user account: active, noaccess, disabled, deleted' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) [...] # # Objects: objectClass[NAME]:2.[SERIAL] # objectclass ( objectClassAccount:2.1 NAME 'mailAccount' SUP ( top ) STRUCTURAL DESC 'Mail account' MUST ( mailAddress ) MAY ( MailPassword $ MailAccountStatus ) ) # ====================================================== # Thanks Best Regards, Leander

2 1

Replication
by sofien BLOUZA 22 Jan '15

22 Jan '15

Hi all, Is it possible to associate multi-master Replication and delta-syncrepl ? Thunks a lot ? Sofiene BLOUZA -- Sofiene BLOUZA Ingénieur R & D 0645492223

1 0

LDAP Search with non-existent attributes
by Dirk-Willem van Gulik 21 Jan '15

21 Jan '15

W’re comparing various LDAP server setups; and we are wondering what the ‘correct’ search result is for a search which is done such as '(|(|(|(givenname=fred*)(sn=fred*)(mail=fred*)(cn=fred*) in a situation where we have records which do not have a certain attribute (e.g. no givenname or cn) — e.g. a record as light weight as: dn: uid= 1234 objectClass: person uid: 1234 sn: fred fred telephoneNumber: 1234 As we notice that some servers will return this given above query; and some do not. And I cannot find the exact spot in the RFC where the ‘correct’ behaviour is mentioned. Would anyone have a pointer or a suggestion ? And would OpenLDAP 2.4 be intentionally more accommodating than the spec ? Dw.

2 2

Access to dn.subtree with dnatrr=attrname
by Tomasz Lesniewski 20 Jan '15

20 Jan '15

Hi. I have ldap tree which i'm trying to migrate from 389-ds to openldap, with structure like this: o=company ou=admins uid=admin1 ... dc=domain ou=users uid=user1 service=service1 ... uid=user2 service=service2 At uid=user1,ou=users,dc=domain,o=company there is admin entry (and no admin entry in childrens) which points to uid=admin1,ou=admins,o=company. Now i want to grant access to all entries below uid=user1,ou=users,dc=domain,o=company to uid=admin1. In 389-ds it was easy, but in openldap it seems not easy to do. I tried to use: olcAccess: to dn.subtree="uid=*,ou=users,dc=domain,o=company" by dnattr="admin" but it grant access only uid=user1,ou=users,dc=domain,o=company and for no childrens access is granted. Maybe i'm doing something wrong or should i use other functionality to solve this problem? Any help will be appreciate. -- Pozdrawiam/Best regards Tomasz Leśniewski

2 1

LMDB and Android
by Kristoffer Sjögren 18 Jan '15

18 Jan '15

Hi I'm a Android noob and need to build LMDB for Android. Is Android NDK the way to go? https://developer.android.com/tools/sdk/ndk/index.html Any tricks I should be aware of? Cheers, -Kristoffer

2 4

Re: back-sql deployment woes
by Nick Atzert 15 Jan '15

15 Jan '15

I personally wouldn't move to a sql backend.. I've recommended against it. This is what the boss wants though so here we are. :-) Any ideas? Thanks. On Jan 5, 2015 8:03 PM, "Quanah Gibson-Mount" <quanah(a)zimbra.com> wrote: > --On Monday, January 05, 2015 7:27 PM -0500 thelastknowngod < > tlkg.me(a)gmail.com> wrote: > > I've finished moving my existing LDAP user data into MySQL >> > > Why would you move to SQL for an LDAP server? > > for use with >> back-sql on my testing machine and everything is working perfectly. >> > > back-sql is entirely experimental and generally unsupported. > > --Quanah > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

7 10

Update openldap version from 2.3.43 to latest
by Tian Zhiying 15 Jan '15

15 Jan '15

Hi Admin I'm running OpenLDAP 2.3.43 in CentOS 5.8 64bit, now I want to update OpenLDAP from 2.3.43 to latest. How can I do it ? If no way update from 2.3.43 to latest, how can I migration data of 2.3.43 to new OpenLDAP? Thanks. Tian Zhiying ----- 在此邮件中未发现病毒。检查工具：AVG - www.avg.com 版本：2012.0.2249 / 病毒数据库：4257/8428 - 发布日期：01/14/15

2 1

[Openldap] Replicate olcAccess and olcLimits from Provider to consumer
by coma 14 Jan '15

14 Jan '15

Dear List, I am currently trying to find out if it is possible to replicate the olcAccess and olcLimits from a master server to a slave server for a specific database (in my case, replicate olcAccess and olcLimits configured on my "dc=example,dc=com" database only, i don't replicates cn=config and other databases). can you give me advice on this? Thanks in advance for any help, Sincerely

1 0

resynchronizing partial replica after ACL change
by Ferenc Wagner 13 Jan '15

13 Jan '15

Hi, I'm running a couple of partial replicas, where the replicated content is narrowed by provider ACLs. All is fine. Now, I need to extend the replicas with a new attribute, so I extend the ACL to allow reading of this attribute as well. How can I get the replicas synchronize this new attribute without downtime? Is forcing a full reload by slapd -c rid=1 a good solution? Does that incur the slapd restart downtime only, or would the replica database be in a crippled state until the full resync finishes? -- Thanks, Feri.

5 6

[Openldap] Add new node in existant n-way multimaster environment
by coma 13 Jan '15

13 Jan '15

Dear list, I'm currently trying to understand how to adding a new node (new master server) in an existant n-way multimaster environment by adding the new node as a "scratch node" (without any data, and without declare all the other servers in the cn=config), so, to do that, i'm would to know if it's possible to add a new master but force an "initial replication" (force it first to replicate config and data from an other master)? Thank you in advance for any answers,

1 0

slapcat command
by Eileen(=^ω^=) 12 Jan '15

12 Jan '15

Hi team! I face a question. When I use "slapcat -l filename.ldif ", the output file will include the createTimestamp、modifyTimestamp、entrycsn and entryUUID etc. These attributes will cause the output file can not put back to the bdb database. ‍ could you pls kindly tell me how can use this slapcat without these attibutes ? thanks and best wishes Eileen~

4 7

replace: olcAccess
by Igor Shmukler 07 Jan '15

07 Jan '15

Hello, With help from various generous people on this list, I am finishing up with my project. Among other things, I need to perform a non-interactive OpenLDAP configuration. I install the server with apptitude and have LDIFs to change the root password and suffix. However, it seems that I still need to correctly adjust olcAccess so my searches work. The olcAccess is the part that is not working as I expected. My LDIF runs just fine changing the name, and domain suffix. Yet, after the operation is complete, ldapsearch(1) start returning errors. When the suffix was nodomain [default left by the install] searches worked. Please advise. The LDIF is below: dn: olcDatabase={1}hdb,cn=config changetype: modify replace: olcAccess olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=example,dc=com" write by anonymous auth by self write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by self write by dn="cn=admin,dc=example,dc=com" write by * read dn: olcDatabase={1}hdb,cn=config changetype: modify replace: olcSuffix olcSuffix: dc=example,dc=com dn: olcDatabase={1}hdb,cn=config changetype: modify replace: olcRootDN olcRootDN: cn=admin,dc=example,dc=com I don't see any errors. Nothing throws me off when I run slapcat(8). Please advise. Thank you, Igor Shmukler

5 6

back-sql deployment woes
by thelastknowngod 06 Jan '15

06 Jan '15

I've finished moving my existing LDAP user data into MySQL for use with back-sql on my testing machine and everything is working perfectly. Trying to switch production over to it is giving me some headaches though. The two environments are configured the same way as far as I can tell and I can startup the service without issue. However when I try to authenticate on the production environment after swapping the backend out it fails. Here are the logs when I tried to authenticate from IRC: Jan 5 17:37:21 new-ldap slapd[14406]: <==backsql_search() Jan 5 17:37:21 new-ldap slapd[14406]: connection_get(14): got connid=1001 Jan 5 17:37:21 new-ldap slapd[14406]: connection_read(14): checking for input on id=1001 Jan 5 17:37:21 new-ldap slapd[14406]: op tag 0x60, time 1420497441 Jan 5 17:37:21 new-ldap slapd[14406]: conn=1001 op=2 do_bind Jan 5 17:37:21 new-ldap slapd[14406]: >>> dnPrettyNormal: <cn=irc,ou=accounts,cn=USERNAME,ou=people,dc=ls,dc=local> Jan 5 17:37:21 new-ldap slapd[14406]: <<< dnPrettyNormal: <cn=irc,ou=accounts,cn=USERNAME,ou=people,dc=ls,dc=local>, <cn=irc,ou=accounts,cn=USERNAME,ou=people,dc=ls,dc=local> Jan 5 17:37:21 new-ldap slapd[14406]: do_bind: version=3 dn="cn=irc,ou=accounts,cn=USERNAME,ou=people,dc=ls,dc=local" method=128 Jan 5 17:37:21 new-ldap slapd[14406]: ==>backsql_bind() Jan 5 17:37:21 new-ldap slapd[14406]: ==>backsql_get_db_conn() Jan 5 17:37:21 new-ldap slapd[14406]: <==backsql_get_db_conn() Jan 5 17:37:21 new-ldap slapd[14406]: ==>backsql_attrlist_add(): adding "userPassword" to list Jan 5 17:37:21 new-ldap slapd[14406]: ==>backsql_attrlist_add(): attribute "userPassword" is in list Jan 5 17:37:21 new-ldap slapd[14406]: ==>backsql_attrlist_add(): adding "objectClass" to list Jan 5 17:37:21 new-ldap slapd[14406]: ==>backsql_dn2id("cn=irc,ou=accounts,cn=USERNAME,ou=people,dc=ls,dc=local") Jan 5 17:37:21 new-ldap slapd[14406]: backsql_dn2id("cn=irc,ou=accounts,cn=USERNAME,ou=people,dc=ls,dc=local"): id_query "SELECT id,keyval,oc_map_id,dn FROM ldap_entries WHERE dn=?" Jan 5 17:37:21 new-ldap slapd[14406]: backsql_dn2id("cn=irc,ou=accounts,cn=USERNAME,ou=people,dc=ls,dc=local"): id=13 keyval=1 oc_id=8 dn=cn=irc,ou=accounts,cn=USERNAME,ou=people,dc=ls,dc=local Jan 5 17:37:21 new-ldap slapd[14406]: >>> dnPrettyNormal: <cn=irc,ou=accounts,cn=USERNAME,ou=people,dc=ls,dc=local> Jan 5 17:37:21 new-ldap slapd[14406]: <<< dnPrettyNormal: <cn=irc,ou=accounts,cn=USERNAME,ou=people,dc=ls,dc=local>, <cn=irc,ou=accounts,cn=USERNAME,ou=people,dc=ls,dc=local> Jan 5 17:37:21 new-ldap slapd[14406]: <==backsql_dn2id("cn=irc,ou=accounts,cn=USERNAME,ou=people,dc=ls,dc=local"): err=0 Jan 5 17:37:21 new-ldap slapd[14406]: ==>backsql_attrlist_add(): attribute "userPassword" is in list Jan 5 17:37:21 new-ldap slapd[14406]: ==>backsql_attrlist_add(): attribute "objectClass" is in list Jan 5 17:37:21 new-ldap slapd[14406]: ==>backsql_attrlist_add(): adding "ref" to list Jan 5 17:37:21 new-ldap slapd[14406]: ==>backsql_id2entry() Jan 5 17:37:21 new-ldap slapd[14406]: backsql_id2entry(): custom attribute list Jan 5 17:37:21 new-ldap slapd[14406]: ==>backsql_get_attr_vals(): oc="ircAccount" attr="userPassword" keyval=1 Jan 5 17:37:21 new-ldap slapd[14406]: backsql_get_attr_vals(): number of values in query: 1 Jan 5 17:37:21 new-ldap slapd[14406]: <==backsql_get_attr_vals() Jan 5 17:37:21 new-ldap slapd[14406]: ==>backsql_get_attr_vals(): oc="ircAccount" attr="objectClass" keyval=1 Jan 5 17:37:21 new-ldap slapd[14406]: backsql_get_attr_vals(): number of values in query: 0 Jan 5 17:37:21 new-ldap slapd[14406]: backsql_id2entry(): attribute "ref" is not defined for objectlass "ircAccount" Jan 5 17:37:21 new-ldap slapd[14406]: <==backsql_id2entry() The attribute the IRC server is looking for is "ircuid" but I'm not seeing that in the log. Could it be that, because this is a custom attribute, it isn't being passed along and/or searched for? It works with that attribute in the old configuration.

2 1

cannot start instance
by Brendan Kearney 05 Jan '15

05 Jan '15

i have been doing a bunch of testing and now have an instance that wont start up. if i run: /usr/sbin/slapd -u ldap -h "ldapi:/// ldap:///" -4 -d9 it runs through and fails with: 54a45a96 read_config: no serverID / URL match found. Check slapd -h arguments. not sure where to look for issues. the ldapi and ldap listeners start up during daemon_init: 54a45551 daemon_init: listen on ldapi:/// 54a45551 daemon_init: listen on ldap:/// 54a45551 daemon_init: 2 listeners to open... ldap_url_parse_ext(ldapi:///) 54a45551 daemon: listener initialized ldapi:/// ldap_url_parse_ext(ldap:///) 54a45551 daemon: listener initialized ldap:/// 54a45551 daemon_init: 2 listeners opened the olcServerID lines are in cn=config.ldif: olcServerID: 1 ldap://ldap1.bpk2.com olcServerID: 2 ldap://ldap2.bpk2.com not sure what is wrong. can someone point me in the right direction?

3 8

ldapmodify crashes with long-ish input for an entry
by Dameon Wagner 05 Jan '15

05 Jan '15

Dear openldap-bugs, I've had a reasonable trawl through the archives, and not found anything that matches the issue I'm seeing, but please point me in the right direction if I've missed anything. (Apologies to anyone receiving this more than once, I tried sending this report to to openldap-bugs and openldap-its over the last few days seen no sign of it in the archives, and not received any message about pending moderation, so thought I would try openldap-technical which might be more appropriate anyway.) We use OpenLDAP for a few directories, one of which is in the process of being migrated to newer hardware, with OS upgrade thrown in, and I've noticed an issue with ldapmodify that I thought was worth reporting. The directory in question has some scripted tooling around it to manage updates from a number of sources, which are staged in a Postgresql database before having some LDIF generated to update the directory itself. During the course of my testing (we've not seen this in production, thankfully) I've noticed that, with reasonably lengthy updates for an entry, ldapmodify dies with an error like the following: #---8<--- Command Output ---------------------------------------------- modifying entry "<DN-FOR-FAILED-ENTRY>" ldap_result: Can't contact LDAP server (-1) #---8<----------------------------------------------------------------- There are matching log-entries in the system's syslog (timestamp, hostname and PID trimmed off to save some linewrapping) and slapd logs (we run slapd under daemontools supervision, and capture it's stdout/stderr): #---8<---- SysLog Output ---------------------------------------------- local4.debug slapd: conn=1002 op=3158 MOD dn="<DN-OF-LAST-GOOD-ENTRY>" local4.debug slapd: conn=1002 op=3158 MOD attr=member local4.debug slapd: conn=1002 op=3158 RESULT tag=103 err=0 text= local4.debug slapd: conn=1002 fd=13 closed (connection lost) #---8<----------------------------------------------------------------- #---8<---- Slapd Output ----------------------------------------------- 54a2e47f conn=1002 op=3158 MOD dn="<DN-OF-LAST-GOOD-ENTRY>" 54a2e47f conn=1002 op=3158 MOD attr=member 54a2e47f conn=1002 op=3158 RESULT tag=103 err=0 text= sb_sasl_cyrus_decode: failed to decode packet: generic failure sb_sasl_generic_read: failed to decode packet 54a2e47f conn=1002 fd=13 closed (connection lost) #---8<----------------------------------------------------------------- The LDIF for the failed entry consists of: #---8<----------------------------------------------------------------- dn: <DN-FOR-FAILED-ENTRY> changetype: modify replace: member member: <DN-FOR-MEMBER> ... member: <DN-FOR-ANOTHER-MEMBER> #---8<----------------------------------------------------------------- where the list of members was, in this case, 9799 long. The LDIF itself is 30097 lines long, and was happy for the first ~15000 lines. If I prune out the modifications for the troublesome DN, the remainder of the file also goes through happily. As a work-around I can manually split up the list into several blocks (tested with roughly 1000 member updates per block) with "replace: member" for the first, to match the current behaviour, and "add: member" for the rest. In this format, ldapmodify is happy to process the LDIF (all in one connection, but as discreet operations). (Note: the authenticated user has "unlimited" limits in the config) Given that, it sounds like it could be a bug in ldapmodify (I don't think it's on the slapd end). I've tested on both the debian stable package (version 2.4.31-1+nmu2), and with a locally compiled build direct from the project's download pages (also 2.4.31 to start with, to see if it was an introduced bug). Has anyone else on the list seen anything like this before? Thanks for your time and any hints and tips. Cheers. Dameon. -- ><> ><> ><> ><> ><> ><> ooOoo <>< <>< <>< <>< <>< <>< Dr. Dameon Wagner, Systems Development and Support IT Services, University of Oxford ><> ><> ><> ><> ><> ><> ooOoo <>< <>< <>< <>< <>< <><

3 6

Non OpenLDAP use of LMDB
by Harry B 04 Jan '15

04 Jan '15

Hello, I am planning to use LMDB to create a resonably large database, few TBs, > 500mil keys, on a Fusion IO flash storage. Memory to storage ratio of the available hardware is about 1:10 Assuming the caching of "5 to 10%" of most-frequently-accessed data is good enough for my use-case, is this a valid/legitimate use of LMDB ? Or am I using the wrong tool for the job? My other choices are RocksDB (haven't looked at it) or Postgres (using a limited subset of features), the latter mainly because we already use it across the company. Any advice is appreciated. Thanks -- Harry

2 2

GSSAPI vs GSS-SPNEGO
by Brendan Kearney 31 Dec '14

31 Dec '14

i am in the process of updating all of my systems to fedora 20 from fedora 16, and am using all the latest available builds for openldap, cyrus-sasl and mit kerberos. i have put everything together as i had on fedora 16, and i am finding that the sasl instance is using sasl/gss-spnego, and not sasl/gssapi like it did on the older version. i am not sure if i should be concerned about this, but it feels like i should be. i am not able to find anything that allow me to configure things one way or another, so i can force the use of gssapi from configs, it seems. can anyone point me in a direction about this, tell me if i should be concerned, or if you might have come across this before what i should be doing that i am not? thank you, brendan

4 11

DB_Config
by Craig White 22 Dec '14

22 Dec '14

I inherited an OpenLDAP server that is in production use and it suffers from a lack of knowledge and I am slowly trying to remedy that. One of the things I noticed was that it complained at startup about the lack of a DB_Config and a caution about it being slow - which it definitely seems to be. As this server is in production use, I am not allowed to do anything to impact it without thorough testing - which I think I have done. Does anyone see any problems if I just drop the following DB_Config file in a data directory so the next time the server is restarted, it takes effect? (Yes, it's a DBD configuration) # cat DB_CONFIG set_cachesize 0 10485760 1 set_lg_regionmax 1048576 set_lg_max 10485760 set_lg_bsize 2097152 set_lg_dir /var/tmp/bdb-log set_flags DB_LOG_AUTOREMOVE Seems safe and I do back it up regularly but if I drop the file in the data directory, I may not be watching when the server is patched/restarted. Comments? Thanks Craig

3 2

Upgrade Ubuntu server will purge OpenLDAP data
by Onno van der Straaten 22 Dec '14

22 Dec '14

Because this is so unexpected and it impacts OpenLDAP installations, I though I share this information here. Ubuntu server upgrade from 12.04 to 14.04 LTS will purge the OpenLDAP directory data. I don't understand why the or a upgrade would want to purge data but that is what happens. I can't find anything on the internet explaining why this is unavoidable and necessary. >From what I have learned so far the best way to recover from this is to completly remove OpenLDAP and start a fresh installation and import data from backup. I'm sure you will have it, for exactly this types of situations that are I'm afraid typical for OpenLDAP. The reason is that it is unclear what state the upgrade leaves OpenLDAP in. I think it will take more time to figure out what was purged, what not, what was changed than it takes to do a complete reinstall.

7 9

OpenLDAP and FIM 2010 R2
by Darouichi, Aziz 19 Dec '14

19 Dec '14

Hello everyone, The management asked me to looking into Forefront Identity Management (FIM) to synch Passwords between our Microsoft AD and OpenLDAP. Openldap is used for SSO hosted by the vendor. Is this something worth exploring for 2 way password synch? Will this need custom APIs to make it work? Or would it work out of the box? Thank you for your input and happy new year all...!! Aziz Darouichi

2 1

help with back-sql setup
by thelastknowngod 17 Dec '14

17 Dec '14

Hey guys, I'm getting an "operation not permitted within namingContext" error when trying to add an entry into a test environment using back-sql. I created the database using the backsql_create.sql,testdb_create.sql,testdb_data.sql, and testdb_metadata.sql files in the OpenLDAP source. I've also tried just using one of the entries in the testdb as a template. Still didn't work. Not sure where the issue is. If you guys can help point me in the right direction that would be awesome. Thanks! I'm building using version 2.4.40 on Linux Mint 17. More relevant info: /etc/odbc.ini: [openldap] Description = Example for OpenLDAP's back-sql Driver = MySQL Trace = No Database = openldap Servername = localhost UserName = openldap Password = thisisatest ReadOnly = No RowVersioning = No ShowSystemTables = No ShowOidColumn = No FakeOidIndex = No ConnSettings = SOCKET = /var/run/mysqld/mysqld.sock /etc/odbcinst.ini: [MySQL] Description = ODBC for MySQL Driver = /usr/lib/odbc/libmyodbc.so FileUsage = 1 /usr/local/openldap/slapd.conf: include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args database sql suffix "dc=example,dc=com" rootdn "cn=root,dc=example,dc=com" rootpw thisisatest dbname openldap dbuser openldap dbpasswd thisisatest subtree_cond "ldap_entries.dn LIKE CONCAT('%',?)" insentry_stmt "INSERT INTO ldap_entries (dn,oc_map_id,parent,keyval) VALUES (?,?,?,?)" has_ldapinfo_dn_ru no File permissions: srwxrwxrwx 1 mysql mysql 0 Dec 8 12:22 /var/run/mysqld/mysqld.sock lrwxrwxrwx 1 root root 43 Dec 8 16:25 /usr/lib/odbc/libmyodbc.so -> /usr/lib/x86_64-linux-gnu/odbc/libmyodbc.so -r--r--r-- 1 root root 20499 Dec 15 11:52 /usr/local/etc/openldap/schema/core.schema -r--r--r-- 1 root root 73994 Dec 15 11:52 /usr/local/etc/openldap/schema/cosine.schema -r--r--r-- 1 root root 6267 Dec 15 11:52 /usr/local/etc/openldap/schema/inetorgperson.schema -rw-r--r-- 1 openldap openldap 29 Dec 15 12:00 /usr/local/var/run/slapd.args -rw-r--r-- 1 openldap openldap 6 Dec 15 12:00 /usr/local/var/run/slapd.pid

2 3

openldap group issue on centos 5.5 - all users automatically get put into newly created group
by Janet Houser 14 Dec '14

14 Dec '14

Hi, I created a dit on a Centos 6.5 box that looks something like this: ........dc=name,dc=com................................ | | | | | | ou=users ou=systems........... ou=policies | | | | | | | | user1 cn=group1 cn=group2 cn=ppolicy user2 | | user3 | | | | user1 user2 user2 user3 I created my users, and I added sever "linux groups" using the ldif file: dn: cn=dev,ou=systems,dc=ehs,dc=edu cn: dev gidNumber: 4005 objectClass: posixGroup My goal was to simulate an entry that you'd find in the /etc/group file on a linux system. So if I added people to this group using the ldif file: dn: cn=dev,ou=systems,dc=ehs,dc=edu changetype: modify add: memberuid memberuid: user1 memberuid: user2 So while user1 and user2 are in the default group "users", I wanted them to be able to change the group on their files to "dev" in order to protect their development files. Now, this seemed to work, and when I went on my client and did a command "groups user1", I saw "users" and "dev" However yesterday I added another group called "team0" with gid 22222 using the following ldif file: dn: cn=team0,ou=systems,dc=ehs,dc=edu cn: team0 gidNumber: 22222 objectClass: posixGroup When I was logged into my client machine (Centos 5.5 box) and did a groups on an old user, it showed "users", "dev" and now "team0" although I never added that user to the new group. I cleaned the client cache using the nscd -i invalidate=group command, and then I removed all the cached directories in /var/db/nscd, and rebooted, but that new group seems to have been applied to everyone. I might have screwed up the creation of my DIT, but I was thinking that things were working ok since I could added "unix groups" that are visible with the "getent group" command on a client, I could add users into these groups and changed the group of files to lock out some users, but I don't understand this behavior now. I have about 6 groups defined and the last one I created yesterday is the only one that seems to get applied to all users. I'd appreciate any help you could give.... I'm scratching my head on this one. Thanks.

2 3

DOS/Windows command to query OpenLDAP
by Scott Gates 13 Dec '14

13 Dec '14

Hello, I have a question. I support a Windows Server based application that connects to several forms of LDAP, including OpenLDAP. Occasionally, for debugging purposes, I need to see if we're on speaking terms with the OpenLDAP server and are getting proper information from it. In a DOS window using Active Directory, I'd type >net user john.doe /domain and get back. C:\Users\john.doe.VB>net user john.doe /domain The request will be processed at a domain controller for domain company.loc. User name john.doe Full Name John Doe Comment Product Support Engineer User's comment Country code (null) Account active Yes Account expires Never Password last set 11/30/2014 7:46.29 AM Password expires 12/30/2014 7:46.29 AM Password changeable 11/30/2014 7:46.29 AM Password required Yes User may change password Yes Workstations allowed All Logon script User profile Home directory Last logon 12/12/2014 8:06:11 AM Logon hours allowed All Local Group Memberships Global Group memberships *FSUSERS *Network Support Engin *SupportSecGroup *Domain Users *Network Engineers The command completed successfully. Is there a command I can run from a Windows DOS prompt that would show me essentially the same info for OpenLDAP. When my customers are using OpenLDAP and having issues, I'm usually flying blind. Scott Gates Production Support Engineer VBrick Systems, Inc.

2 1

modify jpegPhoto => segfault
by Raffael Sahli 11 Dec '14

11 Dec '14

Hi Is there a known problem with the attribute jpegPhoto (InetOrgPerson) on 2.4.40 ? If I update or add the attribute with data bigger than ~27KB the slapd crash (`/usr/local/libexec/slapd': free(): invalid next size (normal):) (Tried with builds on ubuntu lts 12.04, 14.04 and with bdb or mdb, results all in the problem above) Going back to 2.4.39 solves the problem. -- Raffael Sahli

2 2

Re: 2.4.40 RPMs for openSUSE
by Michael Ströder 11 Dec '14

11 Dec '14

Ulrich Windl wrote: >>>> Michael Ströder <michael(a)stroeder.com> schrieb am 11.12.2014 um 09:25 in > Nachricht <54895505.5050005(a)stroeder.com>: >> Ulrich Windl wrote: >>>>>> Michael Ströder <michael(a)stroeder.com> schrieb am 10.12.2014 um 23:34 > in >>> Nachricht <5488CA70.3080805(a)stroeder.com>: >>>> HI! >>>> >>>> After some struggle and help by some opensuse-packaging list members >>>> (thanks!) >>>> I achieved almost what I wanted. >>>> >>>> I'd appreciate if someone could work on SLES support. >>> >>> AFAIK SLES 12 (current) will ship 2.4.39; it shouldn't be hard to use the >> SRPM >>> to upgrade to 2.4.40. >> >> Actually the package was not made from scratch. >> It's branched from the original openSUSE package. >> >>> I never did it, but I guess you can use the SUSE build >>> server to do the job. >> >> Before telling everybody what's already known: >> >> Did you actually read my e-mail? >> If yes, then you should have seen that the links in my e-mail are pointing >> to >> the SUSE build service. > > The links are pointing to some location within opensuse.org, No. https://build.opensuse.org is *the* link to the SUSE build service. Even a SuSE beginner, like myself, should know that. > and it's not > ovbious from the URI how the packages were built, and no: I' don't klick on > every link in every message, especially if I don't want to download the > software at the URI. Feel free to ignore information provided. But don't whine when you're ignored then. >> Please stop writing here when you're not willing to spend at least two >> minutes for reading and thinking before posting. > > Unfriendly tone seems to be common on this list. > > Maybe add to your signature: "I'm a guru, don't try to tell me anything, even > if it seems I'm asking for advice" If you dig into mailing list archives you can see that I give unpaid volunteer support since 15+ years now. I do this because other skilled people helped me when I was a beginner. And I can claim that I'm most times quite patient explaining things. I'm also not perfect either and consider myself to be still learning. The point is: Your postings are often plain wrong. It costs of lot of time to correct your false statements so that mailing list archive is not filled with rubbish leading beginners into the wrong direction. The deal with functional community support is: Don't generate extra work for the experts. Be committed to take over work items you can do yourself. So ask yourself before blaming others for their tone: What's your community contribution up to now? Ciao, Michael.

1 0

Re: Antw: 2.4.40 RPMs for openSUSE
by Michael Ströder 11 Dec '14

11 Dec '14

Ulrich Windl wrote: >>>> Michael Ströder <michael(a)stroeder.com> schrieb am 10.12.2014 um 23:34 in > Nachricht <5488CA70.3080805(a)stroeder.com>: >> HI! >> >> After some struggle and help by some opensuse-packaging list members >> (thanks!) >> I achieved almost what I wanted. >> >> I'd appreciate if someone could work on SLES support. > > AFAIK SLES 12 (current) will ship 2.4.39; it shouldn't be hard to use the SRPM > to upgrade to 2.4.40. Actually the package was not made from scratch. It's branched from the original openSUSE package. > I never did it, but I guess you can use the SUSE build > server to do the job. Before telling everybody what's already known: Did you actually read my e-mail? If yes, then you should have seen that the links in my e-mail are pointing to the SUSE build service. Did you bother clicking on one of the links? If yes, you should have seen from which package my package is branched. You can even see the linkdiff with *one* click. Please stop writing here when you're not willing to spend at least two minutes for reading and thinking before posting. Ciao, Michael.

1 0

Performance impact of linking libwrap
by Michael Ströder 10 Dec '14

10 Dec '14

HI! I'm currently trying to upgrade an OpenLDAP package for a openSUSE distribution. The original package links slapd with libwrap which made sense in former times on systems without local host firewall mechanisms. If libwrap does not have a major performance impact I'd keep it that way just for sake of backward compability. But AFAICT if slapd is linked with libwrap the TCP wrapper is always asked whether a connection is allowed or not. One cannot disable it by slapd configuration. So the question is: How big is the performance impact? Ciao, Michael.

6 11

./configure option for /usr/sbin/slapd
by Michael Ströder 10 Dec '14

10 Dec '14

HI! Is there a possibility to tell ./configure to install the slapd executable also in /usr/sbin/ instead of libexecdir? I set --libexecdir to arch-specific directory /usr/lib or /usr/lib64 for the loadable modules but would like to have slapd in the arch-independent directory /usr/sbin/. Ciao, Michael.

2 1

Problems starting an instance of openLDAP
by Ike Ikonne 10 Dec '14

10 Dec '14

Hi all, I am getting the following error message and would like to know if anyone has any idea as to why I am getting it: 547e04ae line 55 (index telephonenumber) 547e04ae index telephoneNumber 0x0714 547e04ae line 56 (index cn) 547e04ae index cn 0x0714 547e04af config_back_db_open: No explicit ACL for back-config configured. Using hardcoded default 547e04af config_build_attrs: error 21 on olcConfigFile value #0 547e04af config_build_entry: build "cn=config" failed: "" 547e04af backend_startup_one (type=config, suffix="cn=config"): bi_db_open failed! (-1) 547e04af slapd stopped. Thanks, Ike

3 8

-DLDAP_CONNECTIONLESS
by Michael Ströder 10 Dec '14

10 Dec '14

HI! Another packaging decision: Is building with -DLDAP_CONNECTIONLESS of any real use? Is there any harm using it? Personally I see no use but one never knows... Ciao, Michael.

4 9

ldap sync
by Kolijn, P. 10 Dec '14

10 Dec '14

List, I have been trying to configure a producer -> consumer setup with 2.4.39 and a mdb backend. It seems to work, for awhile, but the sync stops when data.mdb is approx 15M, about 1630 entries instead of the 50000 and about 400M... If I do a slapadd of the data into my consumer it will grow beyond the 15M size... --snip-- # ldap data database mdb maxsize 1073741824 directory /var/lib/ldap suffix "dc=example,dc=com" rootdn "cn=ldap_admin,dc=example,dc=com" rootpw "{SSHA}0rvO4rPODnqNPqkbDv/vuKm8hXGS7mtG" # Sync Consumer # The indent is necessary syncrepl rid=002 provider=ldap://ldapmaster.test.example.com type=refreshAndPersist retry="5 5 300 5" searchbase="dc=example,dc=com" filter="(objectclass=*)" attrs="*" scope=sub schemachecking=off bindmethod=simple binddn="cn=replicator,dc=example,dc=com" credentials="secret" -- end snip -- I have set the global options: -- snip -- sizelimit unlimited timelimit unlimited -- end snip -- ...but that didn't help... I have no clue why or where this is coming from or how to figure out where it goes bottom up.. any pointers ? thnx ! -- Pascal Kolijn Vrije Universiteit Amsterdam

5 6

Re: Antw: adding a custom attribute
by Michael Ströder 10 Dec '14

10 Dec '14

Ulrich Windl wrote: >>>> http://tools.ietf.org/html/rfc4512#section-2.5 >>> >>> I couldn't quite read it from there: The closest match I found was: "oid = >>> descr / numericoid", but I was talking about the "on wire" protocol of LDAP. >>> Are there really named objects and attributes? >> >> You really ask to be spoon-fed. >> [..] >> Is it really so hard for you to find the line >> "Examples of valid attribute descriptions:" >> in this particular section? > > No, but what exactly does the example tell about the on-wire protocol? http://tools.ietf.org/html/rfc4511#section-4.1.4 Ciao, Michael.

1 0

Re: Antw: adding a custom attribute
by Michael Ströder 10 Dec '14

10 Dec '14

Ulrich Windl wrote: >>>> Michael Ströder <michael(a)stroeder.com> schrieb am 10.12.2014: >>> I thought the LDAP _protocol_ uses OIDs everywhere, and names are just for >>> human users...? >> >> Nope. One could regard this as design deficiency (in comparison to X.500). >> >> http://tools.ietf.org/html/rfc4512#section-2.5 > > I couldn't quite read it from there: The closest match I found was: "oid = > descr / numericoid", but I was talking about the "on wire" protocol of LDAP. > Are there really named objects and attributes? You really ask to be spoon-fed. Aren't you the one who claimed to write schema-aware LDAP client. If yes, then you should really know RFC 4512 by heart. Is it really so hard for you to find the line "Examples of valid attribute descriptions:" in this particular section? Ciao, Michael. P.S.: You're one nonsense posting away from my killfile.

1 0

Re: Antw: RE: N-Way multimaster Replication with TLS and multiple server certificates
by Michael Ströder 10 Dec '14

10 Dec '14

Ulrich Windl wrote: >>>> Michael Ströder <michael(a)stroeder.com> schrieb am 10.12.2014 um 09:44 in > Nachricht <548807E4.5000108(a)stroeder.com>: >> Ulrich Windl wrote: >>>> I use a cert with the VIP used by clients, and the hostnames used between >>>> the servers all setup in the subjectaltname of the certificate. >>> >>> But this "solution" does not scale well when adding or removing servers... >> >> Why does it not scale? >> >> If you have an individual cert for each server with the VIP DNS name in >> subjectAltName you can just add servers as needed. > > The point is: If you change one server, you'll have to update certificates for > all active servers; Nonsense. This will only be the case if you change the VIP's DNS name. Or could you please tell us what's so hard to understand with "individual cert for each server"? > not to talk about that fact that all certificates will > expire exactly at the same time. Uuuh... yes, there's work out there to be done. So what's the real problem? Ciao, Michael.

1 0

Re: Antw: Performance impact of linking libwrap
by Michael Ströder 10 Dec '14

10 Dec '14

Ulrich Windl wrote: >>>> Michael Ströder <michael(a)stroeder.com> schrieb am 10.12.2014 um 09:46 in > Nachricht <54880865.3060404(a)stroeder.com>: >> Ulrich Windl wrote: >>> As you are building anyway, why not do a simple performance test as part > of >>> your package testing? >> >> Why don't *you* conduct a performance test and report here? > > Have one query. Run it (e.g. ldapsearch) 1000 times (or more if it's too fast) > against the server; with and without libwrap (maybe also with and without > access denied). I'm sure you don't need my help for this ;-) Surely it's not a matter of lacking skills. It's easier to request something from others who are already spending their spare time doing voluntary unpaid work than to actually do the work yourself. So ask yourself: Where are *your* contributions. Ciao, Michael.

1 0

N-Way multimaster Replication with TLS and multiple server certificates
by coma 10 Dec '14

10 Dec '14

Dear List, i'm using N-Way multimaster replication with 2 servers (i will use it on 30 servers soon). Each server is using it's own certificate, so the content of TLSCertificateFile and TLSCertificateKeyFile is different in the cn=config of each of them. My problem is that cn=config is replicated on all servers, including TLSCertificateFile and TLSCertificateKeyFile... therefore the replication obviously not working (the certificate and key path of the first server are replicated on the second server). I know there is some solutions to workaround this "issue", like: - Don't replicate cn=config - Use the same certificate and key for all servers - Use the same certificate and key path in cn=config (ex: /etc/openldap/cert/common_cert_name.pem and /etc/openldap/cert/common_cert_name.key) and then make symlinks to the correct files on the local server but I would avoid this type of solutions if possible, so i would like to know if there is a solution to avoid to replicate TLSCertificateFile and TLSCertificateKeyFile, or other trick? Thank you in advance for any response, Best regards,

5 6

Q: roles for authentication
by Ulrich Windl 10 Dec '14

10 Dec '14

Hi! I have a question: You can define roles for authentication this way: Multiple DNs can be members of a group/rolem, and you can use group names when assigning ACLs. To authenticate, a user will use his DN and own password. Now when a DN is member of multiple roles/groups, authenticating as member assignes all the rights each group/role has. The idea of a role however is that a user "changes hats", depending on the task he is doing. I wonder: Is it possibe to authenticate with a group/role's DN and the user's (a memeber) password? Or is there some other mechanism to accieve what I want? Regards, Ulrich

2 3

Re: Antw: Re: Q: LDIF: use replace instead of add/delete?
by Howard Chu 10 Dec '14

10 Dec '14

Ulrich Windl wrote: >>>> Howard Chu <hyc(a)symas.com> schrieb am 09.12.2014 um 16:24 in Nachricht > <5487144B.8010703(a)symas.com>: >> Ulrich Windl wrote: >>> Hello! >>> >>> I have a question: >>> Is it always OK to use LDIF "replace", even if the attribute doesn't >> exist yet? If so, is it also OK to use "replace" with out specifying an >> attribute value instead of using "delete"? >>> I actually managed to do the first one, and the operation is logged >>> as >> "replace" not as "add" in accesslog. I wrote a program that uses >> accesslog to create an "undo-LDIF" to undo recent changes on demand. Now >> with that "replace" having succeeded, the undo operation created for it >> would be the second case ("replace" with no new value). >> >> Read RFC4511 section 4.6. >> >> General questions about how LDAP works don't belong here. Use the >> ldap(a)umich.edu mailing list. > > Of course I meant "does it work with openLDAP" when asking "does it > work in LDAP". If you meant "in OpenLDAP" than that's what you should have written. Since you asked about "LDAP" you got the correct answer to your question. Meanwhile, your question still is about the basic semantics of a Modify/Replace operation. The semantics of this operation are defined in the LDAP RFC I pointed you to. Every server that claims to support LDAPv3 is required to implement these semantics. Naturally, since OpenLDAP has been the reference implementation of LDAP for nearly 2 decades, of course it implements this aspect of the spec. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: Antw: adding a custom attribute
by Michael Ströder 10 Dec '14

10 Dec '14

Ulrich Windl wrote: >>>> Michael Ströder <michael(a)stroeder.com> schrieb am 09.12.2014 um 16:31 in > Nachricht <548715BF.7050800(a)stroeder.com>: >> Ulrich Windl wrote: >>> I thought a schema having a OID is the same everywhere; would a modified >> schema need a new OID then? >> >> Best practice is to assign a new OID if anything changes for a schema >> element. >> >> 99.9999% of LDAP client applications don't care about OIDs though. > > I thought the LDAP _protocol_ uses OIDs everywhere, and names are just for > human users...? Nope. One could regard this as design deficiency (in comparison to X.500). http://tools.ietf.org/html/rfc4512#section-2.5 Ciao, Michael.

1 0

is syncrepl + lmdb possible ?
by Andrew G 10 Dec '14

10 Dec '14

I'm wanting to implement an N-way multimaster with lmdb, but it seems that syncrepl is whinging about the db not being supported ? Perhaps I need a different/later version of syncprov ? I cant seem to find a definitive answer to this. redhat -> openldap-servers-2.4.23-32.el6_4.1.x86_64 -- Andrew Gray Professional Unix Administration. Vizzini <http://www.imdb.com/name/nm0001728/?ref_=tt_trv_qu>: Wait till I get going! Now, where was I? Man in Black <http://www.imdb.com/name/nm0000144/?ref_=tt_trv_qu>: Australia.

3 3

Re: N-Way multimaster Replication with TLS and multiple server certificates
by coma 09 Dec '14

09 Dec '14

Hello, Thanks for your prompt reply. Yes i'm using also the CA path attribute to specify my CA trust chain. So has you said, i will use the same path on each nodes. Thanks again! 2014-12-09 20:30 GMT+01:00 Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Tuesday, December 09, 2014 7:14 PM +0100 coma <coma.inf(a)gmail.com> > wrote: > > >> Dear List, >> >> i'm using N-Way multimaster replication with 2 servers (i will use it on >> 30 servers soon). Each server is using it's own certificate, so the >> content of TLSCertificateFile and TLSCertificateKeyFile is different in >> the cn=config of each of them. >> >> My problem is that cn=config is replicated on all servers, including >> TLSCertificateFile and TLSCertificateKeyFile... therefore the replication >> obviously not working (the certificate and key path of the first server >> are replicated on the second server). >> >> I know there is some solutions to workaround this "issue", like: >> - Don't replicate cn=config >> - Use the same certificate and key for all servers >> - Use the same certificate and key path in cn=config (ex: >> /etc/openldap/cert/common_cert_name.pem and >> /etc/openldap/cert/common_cert_name.key) and then make symlinks to the >> correct files on the local server >> >> but I would avoid this type of solutions if possible, so i would like to >> know if there is a solution to avoid to replicate TLSCertificateFile and >> TLSCertificateKeyFile, or other trick? >> > > Every server must be able to validate the cert of the other MMR nodes. > For that, it would be easiest to use the CA path attribute (vs file > attribute). For the cert setup for the servers themselves, generally yes, > you can work around that by having the same path to the cert on each node. > > --Quanah > > -- > > Quanah Gibson-Mount > Platform Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

Re: Removing unused schemas - recommended?
by Quanah Gibson-Mount 09 Dec '14

09 Dec '14

--On Wednesday, December 10, 2014 8:49 AM +1300 Chris Neilson <crusty.chris(a)gmail.com> wrote: Please keep replies on the list. > OK thanks. so no performance gains be excluding schemas. sweet. > When working with syncrepl, does it matter if the consumer has schemas > imported in a different order? or if the consumer has more schemas than > the provider (obviously assuming youre not replicating cn=config)? It shouldn't matter, order wise, but I personally prefer to have all systems load in the same order. If you have "extra" schema on a consumer that's never being used, then it shouldn't affect replication. --Quanah -- Quanah Gibson-Mount Platform Architect Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Removing unused schemas - recommended?
by Chris Neilson 09 Dec '14

09 Dec '14

Im having a few issues wrapping my head around how schemas should be implemented. If I do a default install of openldap (2.4.23) on CentOS 6 the following schemas are automatically included: cn={0}corba.ldif cn={1}core.ldif cn={2}cosine.ldif cn={3}duaconf.ldif cn={4}dyngroup.ldif cn={5}inetorgperson.ldif cn={6}java.ldif cn={7}misc.ldif cn={8}nis.ldif cn={9}openldap.ldif cn={10}ppolicy.ldif cn={11}collective.ldif I assume this is done because it allows for a fairly flexible directory that Just Works for nearly everyone. However, many of these schemas contain attributes that I do not use, in fact I can cut down the list of schemas that contain attributes I knowingly use to the following list: cn={0}core.ldif cn={1}cosine.ldif cn={2}inetorgperson.ldif cn={3}nis.ldif cn={4}customschema.ldif My issue is that I am not sure if there is any benefit for removing the unused schemas (i.e. I could have just added my customschema as cn={12}customschema.ldif to the default install but I was worried there would be a performance penalty or security issue with including the unused schemas). Is it advisable to remove unused schemas? Does including unused schemas result in any sort of performance penalty (e.g. while booting or when doing searches)? If I want to use syncrepl to replicate my data do I have to have the exact same list of schemas in the same order on the consumer (i.e. does the number in the curly braces matter)? If I add a schema to a consumer does it have to be added to the provider as well even if the attributes it contains are unused?

3 2

adding a custom attribute
by Igor Shmukler 09 Dec '14

09 Dec '14

Hello, I want to have an ability add "custom attribute[s]" to my LDAP records. For example, such an attribute could be sipTelephone, mobile and/or something else. I did a little digging. Please advise whether I am on the right track. My understanding, at present, is that I would have to modify core.schema [located on my Ubuntu under /etc/ldap/schema ] and perhaps some other schema files from the same directory. I found various syntax OIDs. For telephones, for example - 1.3.6.1.4.1.1466.115.121.1.50 should be the right one. There is another OID for strings - 1.3.6.1.4.1.1466.115.121.1.15 for UTF-8 coded strings. Is editing core.schema the correct way to go? I am eagerly looking for advice. Thank you for reading my question this far. I have been saved twice by people on this list. Appreciate your help very much. Sincerely, Igor Shmukler

5 7

A TLS fatal alert has been received
by Scutulat Um 09 Dec '14

09 Dec '14

Hello guys, I'm having trouble figuring out a TLS fatal error. It seems that the certs are being read but a broken pipe appears suddenly (don't know exaclty what does it means). Here's the command I'm running: $ ldapsearch -LLLxWD cn=manager,dc=example,dc=com -b dc=apsidis,dc=com -ZZ -d 3 ldap_start_tls: Connect error (-11) additional info: A TLS fatal alert has been received. Here's part of the debug output: <Some certs info...> ... tls_write: want=523, written=523 0000: 16 03 03 02 06 10 00 02 02 02 00 9e 22 0e d5 86 ............"... 0010: 69 a5 a2 29 f6 76 11 19 f6 2d db a9 e8 f5 27 26 i..).v...-....'& 0020: da 74 85 e4 22 92 50 37 ef e8 8b 31 6e 32 c6 84 .t..".P7...1n2.. 0030: 2c 61 79 65 b0 56 9e bf 3e 97 3d 9a 6d 61 80 70 ,aye.V..>.=.ma.p 0040: f7 d9 dc 5f e6 40 f7 af 12 92 61 4f 56 fe 52 55 ..._.@....aOV.RU 0050: e0 3a 57 21 c4 d4 27 58 20 ba fb e2 74 9e f8 08 .:W!..'X ...t... 0060: ec 4b 2a b1 93 f1 06 e3 0b a8 d1 d1 b3 f8 e4 c4 .K*............. 0070: d4 b7 0a 22 7f a6 01 17 00 92 bb 12 99 68 2a 6f ...".........h*o 0080: 43 96 7d b1 da 80 fb 53 7e a4 71 40 51 50 46 5e C.}....S~.q@QPF^ 0090: a8 09 fc ab e9 10 90 27 2f a5 46 16 41 45 1d 95 .......'/.F.AE.. 00a0: 0d f2 d4 a1 d7 62 40 dd ba 5e d2 7a 47 10 14 83 .....b@..^.zG... 00b0: 60 2f be 66 a8 a8 6e 82 1a bc 61 45 d7 6c c2 e5 `/.f..n...aE.l.. 00c0: b3 07 b8 e1 6e a7 ca e1 22 50 79 5a 01 60 5f 0d ....n..."PyZ.`_. 00d0: ec f3 f5 a3 c2 f9 9d b1 52 cc 88 f9 65 de 74 58 ........R...e.tX 00e0: c1 b7 a8 e7 b7 c7 81 a0 8b ee 40 8c f3 a5 d2 b5 ..........@..... 00f0: 22 58 bd 87 d5 55 6e 32 a0 b5 2e 7a b7 a5 6b aa "X...Un2...z..k. 0100: 6f ab 32 37 bb bb f7 e5 ed 5c 79 16 93 94 ac 35 o.27.....\y....5 0110: 80 2b 9e d3 e6 c9 7e ef 3f 46 26 64 e4 40 ec f8 .+....~.?F&d.@.. 0120: 69 30 3e c5 61 0e 06 3a 2b 88 72 ef df aa d0 50 i0>.a..:+.r....P 0130: b9 b0 8e 7b 0a e1 2a 61 6d d6 75 1a 2d 04 bf 8e ...{..*am.u.-... 0140: 5e 09 ee c0 c2 1e b1 e1 f8 29 78 0f 91 e7 49 1d ^........)x...I. 0150: 9e bf a9 98 31 bc af d6 02 19 f9 3b 5e d2 0f 5e ....1......;^..^ 0160: 29 c2 ba 00 7c 52 d5 d6 33 59 4c 16 91 a8 9c 6d )...|R..3YL....m 0170: b6 9c 47 51 97 5a d9 ab 14 9b ba 0a a7 08 36 90 ..GQ.Z........6. 0180: 2f a8 33 0e 27 79 93 02 8f 91 46 92 da 5b e6 7e /.3.'y....F..[.~ 0190: db 7a 3a b0 3c c5 c9 98 f4 0a 86 44 94 03 66 d8 .z:.<......D..f. 01a0: b0 36 6e 59 ef 4d c5 03 e3 34 50 be c5 8d 43 e0 .6nY.M...4P...C. 01b0: ba 25 9d b4 74 52 15 5e bc 7c b1 3c 59 3d b7 a2 .%..tR.^.|.<Y=.. 01c0: 9a a0 82 d6 8a 83 8f cd b9 39 89 15 e9 f8 35 80 .........9....5. 01d0: 12 65 d3 1e 78 bb 10 d9 a7 0d 43 92 f5 de 01 52 .e..x.....C....R 01e0: be 55 c8 5c 30 93 21 d2 5e d8 87 a0 f0 5e 57 1a .U.\0.!.^....^W. 01f0: 11 c1 04 c7 70 33 01 8f cc 81 58 b4 4d 4c d2 b2 ....p3....X.ML.. 0200: ff 6a ba 80 e5 c3 18 29 5d c8 5e .j.....)].^ tls_write: want=269 error=Broken pipe Enter LDAP Password: ldap_sasl_bind ldap_send_initial_request ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({i) ber: ber_flush2: 47 bytes to sd 3 tls_write: want=269 error=Broken pipe ldap_write: want=47 error=Broken pipe ldap_free_request (origid 2, msgid 2) ldap_free_connection 0 0 ldap_free_connection: refcnt 1 ldap_err2string ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) ldap_free_connection 1 1 ldap_send_unbind ber_flush2: 7 bytes to sd 3 ldap_write: want=7 error=Broken pipe ldap_free_connection: actually freed $ Can anyone can point me into the right direction on how to solve this? Thanks!

2 1

Q: LDIF: use replace instead of add/delete?
by Ulrich Windl 09 Dec '14

09 Dec '14

Hello! I have a question: Is it always OK to use LDIF "replace", even if the attribute doesn't exist yet? If so, is it also OK to use "replace" with out specifying an attribute value instead of using "delete"? I actually managed to do the first one, and the operation is logged as "replace" not as "add" in accesslog. I wrote a program that uses accesslog to create an "undo-LDIF" to undo recent changes on demand. Now with that "replace" having succeeded, the undo operation created for it would be the second case ("replace" with no new value). Regards, Ulrich

2 1

ACL on new value for two attributes
by Emmanuel Dreyfus 09 Dec '14

09 Dec '14

Hello In ACL, the attrs=foo val.regex="^(.*)$" construct allows filtering on the new value for an attribute. Using sets in the who clauses this new value can be matched as ${v0} against current attributes values. But what about if we want to match against another new attribute value? I currently run 2.4.33, and there is no way to have multiple attrs=foo val.regex="^(.*)$" statements in the what clause. Has this changed in later releases? Or is there another way of doing it? -- Emmanuel Dreyfus manu(a)netbsd.org

4 8

Access bdb and ldap database at the same time
by Zhang,Jun 09 Dec '14

09 Dec '14

I've configured an ldap database in slapd.conf which serves as an Active Directory proxy, the slapd is running on RHEL 6. My Linux openldap clients can now browse the content of the AD. The purpose of doing this is for user login, which is authenticated against the AD, with the home directory information provided by the bdb database of the openldap server. autofs is functional through the rfc2307bis formatted automount maps. The problem is that "getent passwd username" not always work, so the AD users are not known even though ldapsearch can always find the user information with a proper search base set. At the slapd server (rhel 6), nslcd (try to avoid ssl at this stage) is being used, while at the Linux openldap clients, I compiled pam_ldap and nss_ldap. I noticed that the openldap clients use /etc/openldap/ldap.conf as the configuration file, and nss/pam use /etc/ldap.conf. Tried to use different BASE in the two conf files but it didn't work for me. I know there must be other people who's already done this, some way, and I'll very much appreciate it if somebody can point me to some known to work ways. Jun

2 1

Which schema to use?
by Nick Bright 09 Dec '14

09 Dec '14

Are there any pre-defined schema (or combination of schema) available that I could use with openldap that would provide some or all these attributes: accountid (integer) customerid (integer) nodeid (integer) accounttype (string) accesspoint (string) ipaddress (ip address) latitude (float) longitude (float) macaddress (string) A link to a novice/beginner guide for how to create schema would be helpful too. Thanks, -- ----------------------------------------------- - Nick Bright - - Vice President of Technology - - Valnet -=- We Connect You -=- - - Tel 888-332-1616 x 315 / Fax 620-331-0789 - - Web http://www.valnet.net/ - ----------------------------------------------- - Are your files safe? - - Valnet Vault - Secure Cloud Backup - - More information & 30 day free trial at - - http://www.valnet.net/services/valnet-vault - ----------------------------------------------- This email message and any attachments are intended solely for the use of the addressees hereof. This message and any attachments may contain information that is confidential, privileged and exempt from disclosure under applicable law. If you are not the intended recipient of this message, you are prohibited from reading, disclosing, reproducing, distributing, disseminating or otherwise using this transmission. If you have received this message in error, please promptly notify the sender by reply E-mail and immediately delete this message from your system.

2 1

what to do with ssl certs and keys of master and slave during replication
by wailok tam 09 Dec '14

09 Dec '14

Hi, all, Can a kind person tell me what special things need to be done with ca certs, server certs, and server keys? I read some blog which reports concatenating the master ca cert to the slave ca cert. But the slaver server cert and key was created ＆ signed with the slave ca cert b4 concatenation. Is that correct? No need to share the master server cert or key with the slave Thanks for viewing and thanks in advance for any advice.

1 0

storing ldap passwords on HSM
by lux-integ 08 Dec '14

08 Dec '14

Greetings, I have been searching webpages for guidance on using a smartcard ( also know as an HSM ) for storing passwords for an ldap database on a linux system. This would include for instance how would the userPassword (attrribute) be specified - i.e. how to specify the userPassword to read the PIN/SO- PIN/PUK{whatever} of the HSM/smart-card etc etc ?? Any guidance would be much appreciated. Yours sincerely luxInteg

4 16

SASL hashing schemes
by Dieter Klünter 08 Dec '14

08 Dec '14

Hi, RFC 5802 describe a Salted Challenge Response Authentication Mechanism and RFC 5803 describes a schema for storing salted challenge response mechanism secrets, which recommend a authPassword attribute type and a salted hash and a hashing scheme as attribute value. It seems, that OpenLDAP doesn't know authPassword ldapmodify -Y EXTERNAL -H ldapi:/// SASL/EXTERNAL authentication started SASL username: gidNumber=100+uidNumber=1000,cn=peercred,cn=external,cn=auth SASL SSF: 0 dn: cn=dieter kluenter,ou=partner,o=avci,c=de changetype: modify add: authPassword authPassword: xxxxxxx modifying entry "cn=dieter kluenter,ou=partner,o=avci,c=de" ldap_modify: Undefined attribute type (17) additional info: authPassword: attribute type undefined Although the SASL Mechanism is provided and known, but the attribute userPassword maintains a plaintext value. ldapwhoami -Y SCRAM-SHA-1 -U dieter -w xxxx-H ldapi:/// SASL/SCRAM-SHA-1 authentication started SASL username: dieter SASL SSF: 0 dn:cn=dieter kluenter,ou=partner,o=avci,c=de It seems that SASl authentication only supports scram Mechanisms as plaintext value. Is there any intention to fully implement RFC 5802 and RFC 5803? -Dieter -- Dieter Klünter | Systemberatung http://sys4.de GPG Key ID: E9ED159B 53°37'09,95"N 10°08'02,42"E

4 4

manually editing LDIF files with schema
by Igor Shmukler 08 Dec '14

08 Dec '14

Hello, I wrote a test schema file adding one attribute - ipPhone. I found some "tutorials" explaining how to write a schema file then convert it into LDIF using slaptest(8). The authors of these tutorials [found by me] all manually edit slaptest(8)-generated LDIF files, removing structuralObjectClass, entryUUID, creatorsName, createTimestamp, entryCSN, modifiersName and modifyTimestamp. Is this the recommended way of adding a schema? Sincerely, Igor Shmukler

2 1

Returned mail: Data format error
by michael＠stroeder.com 08 Dec '14

08 Dec '14

U��0o�R�]�N��H̉�x�/�L�>�dd�� A�q^��t ��'��A�`$��$�F�2k�?aT�:��A��r#jXE�At��u9NoW�UBB��_�)�l TO�Je1�n�y`W<Y��>��[��FqG_��}��]�O�ٞ�9��a�m%`��d��ź��[k��0��`#��5O�#�z�B��13�u"�S.�4K�Å!'�v��J7A~6;��~�3��q��ưM�F|W�SJ��}Į��k�-�7r�|�/Ϛ!��٨r��k�%T$�V��9&�`�/��tKλD_��)^f��!�J��_O�t�1��fx?��_wp��$��sU��f}w�ӆ/� 3fB^O��Q$��,��^o.M�]2��{��{�ո��`J�G��`Oܷ� 8�Ղ�T��Z�UԬ��l˼C�c�:J��Ȫ`��ёh�qb�.�H��qt�7rR�}�(�s�3�G�ٷv&�Z��z��wH�� \P�T�24zR��:��ڕi�#&o35��ےT�q��k��4M��ߊ` �b͞ۂ\� }��)r<�j��#W0`�B;<�jw�J��,i�v�Ov��V��:�:�'�� C�fu�Ȥ|��?<�gg��r |�sYY��2iK0a�!f~�� Vu�N�KL��Y�q��b޻zc�潞�� ~v�vͨ i$�1.�-�\�n��A��)�I�e��$� ��tt�:/��8�bK��2p��'1G$�x��q��ZФ��)�3[_��8I�V�jq��9u�^��vE6_�z�[�4��IRL��V��2�>�fз��vI��,�t�7��{��Z 6�j�]�k��2�9��U9�>�]�m��%��pr�1Mq�O��U�7o�5YҔ2�ɶ},�0��G��"k�'�P�DQ-�/�e�:�{�!��b�x�.Q��q�G��߹ZP! ��p�>�،~��<%� ��Y���0��a�f��Ŭ��؏(�(�-�z��\o1 �{�Gg�\�BsG$,#ɲd�߸ẁq�3e�*}�kw9�(��'4��4jcF��-t3`��f7ElU�G�>�ֈeS��/8�D��L�V2�N�kޱ�8��B��D��9�<(�쨻D*�k#�/4� p�c,8b��ȇ~�OB��h .�[�Ǣ��mg��F�l`w J{~�xY��w�ٶgs��1M�%q�ϻGC��A�T�BxO�� 7��%�k1��f3B�WBOa��z�q{� 9&up�ݺ�;�)0��S�-�f$��7��F�l� � ʚ�ꯥ��b� T��U�n�,�lu� ��d�H%HxYk [�s�u�?p�ǆ�,��3�yv'i�D:��*��Ώ��5a��C�F��3��(hB��j�ZFp' Y�'��ô(?0��rL4� �k�6�\Ď,0�a�B�<�ߥƱ��q��ިE$�m��$��3��vV��`�� ,_�M��^��{��u��Pq��p ]X�&��-�ì&ADk�/F;�ʣ�2.�Ԉ\�>/�z��>C�I��Q�s��

1 0

cn=config and mdb questions
by Da Rock 08 Dec '14

08 Dec '14

Aside from other issues (which haven't really been solved... just possibly worked around :/), I've been doing some tinkering and have raised some questions which I'm hoping will have answers to. 1. cn=config and friends: Looking at the schema and methods used to implement this config type, I got to considering that I could (in theory) name my databases such as olcDatabase=MyLDAPDatabase (or the like), rather than bdb/hdb/mdb. I then found that I couldn't and then looked it up to see why - I found that it had a naming restriction, but not why. Aside from possible limits within the programming as it stands now, is there some semantical issue why this is the case? Wouldn't possibly be easier to determine which database is which if the administrator was able to name them as they wish? 2. mdb: I know this is the way we're expected to go with ldap now, but what is the point of a db that can't grow as needed? It seems rather limiting (and old school - remember early unix programming on the old IBM mainframes and DOS for the PC's later with the 640k limit), so why the push in this direction? Or is it expected that this will be resolved in the future? Cheers

4 5

Re: Outlook LDAP Addressbook Browsing - Add ORDERING caseIgnoreOrderingMatch on CN or NAME core attributes without source code modification and re-compilition
by Richard LEGER 05 Dec '14

05 Dec '14

On Thu, Jul 10, 2014 at 10:00 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, July 10, 2014 2:58 PM +0100 Richard LEGER < > richard.leger(a)gmail.com> wrote: > > Is there other way(s) via a local schema or else to modify/extend >> definition of OpenLDAP core attributes without modifying source code and >> recompiling? >> > > No. You shouldn't be using the garbage OpenLDAP build shipped with Ubuntu > anyway. > > --Quanah For information to those that may interested (and for the record)... Here is a simple description of the openldap <-> Outlook ldap addressbook issue: Source: http://victor-sudakov.livejournal.com/124269.html Translation: http://translate.google.co.uk/translate?hl=en&sl=ru&u=http://victor-sudakov… In addition, for the address list organization to be displayed in Outlook, it seems necessary to patch the file /etc/openldap/schema/core.schema in order to add 'company' attribute as alias to 'o', something like: attributetype ( 2.5.4.10 NAME ( 'company' 'o' 'organizationName' ) DESC 'RFC2256: organization this object belongs to' SUP name ) Source: http://habrahabr.ru/post/183996/ Translation: http://translate.google.co.uk/translate?hl=en&sl=ru&u=http://habrahabr.ru/p… Not sure to which version of Outlook this would apply... Also it seems possible to modify the LDAP core schema attributes without recompiling... Please note that the following: - has not been tested and may not be fully accurate - is not recommended as you loose RFC compliance - does not apply directly to CN attribute as required for Outlook addressbook ( http://www.openldap.org/cgi-bin/wilma_hiliter/openldap-technical/201001/msg…) but process would be very similar... - may require an openldap version that allow core schema modification (2.4 or upper) === *Method1* (update core schema attribute via ldapmodify) Something like... Source: https://lists.forgerock.org/pipermail/opendj/2013-May/002995.html "... ldapmodify -D cn=root -w password -p 1389 dn: cn=schema changetype: modify delete: attributetypes attributetypes: ( 2.5.4.42 NAME 'givenName' SUP name X-ORIGIN 'RFC 4519' ) - add: attributetypes attributetypes: ( 2.5.4.42 NAME 'givenName' SUP name ORDERING caseIgnoreOrderingMatch X-ORIGIN 'RFC 4519' ) ..." Of course that would need to be adapted to the openldap process and schema definition, as per version in use... === *Method2 *(edit core schema file core.ldif) - Obviously it is not recommended to directly edit core schema ldif files. Source: https://freeswitch.org/confluence/display/FREESWITCH/Polycom+Corporate+Dire… "... Add caseIgnoreOrderingMatch to core.schema We now have to add "ORDERING caseIgnoreOrderingMatch" to the surname- and givenName-Attributes, because Polycom uses simple search expressions like '>=' and '<=' when querying the LDAP-addressbook. root# /etc/init.d/slapd stop root# vim /etc/ldap/sapd.d/cn\=config/cn\=schema/cn\=\{0\}core.ldif In this file, substitute surname original olcAttributeTypes: {1}( 2.5.4.4 NAME ( 'sn' 'surname' ) DESC 'RFC2256: last (family) name(s) for which the entity is known by' SUP name ) with surname ORDERING olcAttributeTypes: {1}( 2.5.4.4 NAME ( 'sn' 'surname' ) DESC 'RFC2256: last (family) name(s) by which the entity is known' SUP name ORDERING caseIgnoreOrderingMatch) Replace givenName original olcAttributeTypes: {35}( 2.5.4.42 NAME ( 'givenName' 'gn' ) DESC 'RFC2256: first name(s) for which the entity is known by' SUP name ) with givenName ORDERING olcAttributeTypes: {35}( 2.5.4.42 NAME ( 'givenName' 'gn' ) DESC 'RFC2256: first name(s) by which the entity is known' SUP name ORDERING caseIgnoreOrderingMatch) start slapd root# /etc/init.d/slapd start ..." Just thought that may be helpful to know and record on the forum...

2 2

Re: Antw: need serious help ton repliIcation over ssl - getting do_syncrep1: rid 001 ldap_sasl_bind_s failed (-1)do
by wailok tam 05 Dec '14

05 Dec '14

A deep bow. You have helped me to conclude that I am having a ssl certs problem, rather than a ldap conf problem.keys I do openssl s_ client fr the master to the slave and vice versa. neither works. Do you mind telling me roughly or pointing me resources that explain what to do after i get an ok with openssl verify on the master? What to do to get the master to let the slave to connect and perform the syncrepl task. I have read some guides which tell me to concatenate the ca cert of the master to that of the slave. some others tell me to use the the ca cert of the master for the slave. so what to do? do the certs and keys have to be shared in some way like setting up ssh? Thanks again in advance. ------------------------------order On Wed, Dec 3, 2014 8:00 AM GMT Ulrich Windl wrote: >>> wailok tam <wailoktam(a)yahoo.com> schrieb am 03.12.2014 um 07:13 in >Nachricht ><174796963.2591360.1417587204114.JavaMail.yahoo(a)jws100175.mail.ne1.yahoo.com>: > >ªpHi, thanks for your reply. >I move the ca cert on the slave, generate a hash of it >openssl x509 -noout -hash -in ca-certificate-file > >and create a symbolic link from the hash >ln -s my_ca.crt RESULT_OF_OPENSSL_X509-NOOUT-HASH > >Then I do an openssl verify -CApath and -CAfile on the slave. I get an okay. >So I have done the rehash step you mentioned? I dont have a rehash program on >my system. You don't have the c_rehash? > >For me it's part of openssl: >% rpm -qf /usr/bin/c_rehash >openssl-0.9.8j-0.66.1 > >Another thing I do is to remove all the SSL relevant lines from the conf of >both the master and the slave and it works. >So can I be certain that the problem is with the certs of the master which >generates the following errors? >openssl verify -CApath /usr/share/ssl/certs/nii-odca2.crt >/usr/share/ssl/certs/mail.ier.hit-u.ac.jp.crt/usr/share/ssl/certs/mail.ier.hit-u.ac.jp.crt: >/C=JP/L=Academe2/O=Hitotsubashi University/OU=Institute of Economic >Research/CN=mail.ier.hit-u.ac.jperror 20 at 0 depth lookup:unable to get local >issuer certificate > >"unable to get local issuer certificate" says it all: the certificate that >signed your certificate cannot be found, and thus the certificate is considered >invalid. If the issuer cert is there, make sure it's hashed (as above); >otherwise openssl cannot use it. > > >verify -CAfile /usr/share/ssl/certs/nii-odca2.crt >/usr/share/ssl/certs/mail.ier.hit-u.ac.jp.crt/usr/share/ssl/certs/mail.ier.hit-u.ac.jp.crt: >/C=JP/L=Academe2/O=National Institute of Informatics/OU=UPKI/OU=NII Open Domain >CA - G2error 2 at 1 depth lookup:unable to get issuer certificate >What do these error mean? > >See above. > >I also find some strange behaviour on the master. When I ping the slave using >its host name, it shows a different ip and it fails. When I ping the slave >using its ip, it succeeds. Can this be relevant? > >Try "nslookup slave" to find out > >Many thanks in advance. > >(Sorry, my mailer refused to quote your message correctly) > > > > > From: Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de> > To: openldap-technical(a)openldap.org; wailoktam(a)yahoo.com > Sent: Monday, December 1, 2014 9:13 PM > Subject: Re: Antw: need serious help on replication over ssl - getting >do_syncrep1: rid 001 ldap_sasl_bind_s failed (-1) > >>> wailok tam <wailoktam(a)yahoo.com> schrieb am 01.12.2014 um 12:48 in >Nachricht ><1417434525.8955.BPMail_high_carrier(a)web122503.mail.ne1.yahoo.com>: > >> Hi, thanks again for offering further help. >> >> Is what you suggesting, c_rehash, equivalent to updating the certificate >> database, just like what the >> update-ca-certificate script would do in debian- based distro? I did not do > >> this rehash thing. > >c_rehash creates a symbolic link for each CA, like this: >lrwxrwxrwx 1 root root 26 Jul 7 08:43 /etc/ssl/certs/a7605362.0 -> >Sonera_Class_2_Root_CA.pem > >If no such link for your CA exists, openssl fails to find it (AFAIK). > >> In the master, I am using an old set of certs which I suppose to be working. > > >Define "an old set of certs", please. > >> In the slave, I put all the certs in the directory they were first >> gen.erated, as given in the conf file. Will rehash work properly with the >> certs in those paths (i.e. /etc/pki/CA/)?I > >It seems you can give the directory as parameter: >windl@rksapv04:~/src/C> c_rehash /tmp >Doing /tmp > > > >> >> So what to do with the output of openssl x509 -noout -text -in >> <your_certificate>? >> >> I cannot try it now. I have tried sth similar a couple of hours ago that >> output the content of a cert in text. For the master, the issuer is an >> external orgaization which we bought the cert from. For the slave, the >issuer >> is my orgaization since I generate it myself. I follow the guide in the link > >> to paste the master ca cert after the orig slave ca cert. Does that strange > >> instruction screw things up?I > >Repeat the openssl verify commands until they work! > > > >> >> Thanks again in advance. >> >> >> ------------------------------ >> On Mon, Dec 1, 2014 11:05 AM GMT Ulrich Windl wrote: >> >>> wailok tam <wailoktam(a)yahoo.com> schrieb am 01.12.2014 um 11:40 in >Nachricht >><1171333883.1885274.1417430400586.JavaMail.yahoo(a)jws100208.mail.ne1.yahoo.com>: >>> Hi, thanks for your help. I am getting this on the master, no matter I put > >>> /usr/share/ssl/certs or /usr/share/ssl/certs/nii-odca2.crt for the first >>> argument after -CApath >>> /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.crt: >>> /C=JP/L=Academe2/O=Hitotsubashi University/OU=Institute of Economic >>> Research/CN=mail.ier.hit-u.ac.jperror 20 at 0 depth lookup:unable to get >>> local issuer certificateunable to load certificate12574:error:0906D06C:PEM > >>> routines:PEM_read_bio:no start line:pem_lib.c:647:Expecting: TRUSTED >>> CERTIFICATE >> >>So you have a problem with your issuer certificate: Did you use c_rehash >> after adding a CA certificate to /etc/ssl/certs? If so, dump your >> certificates (CA and server) like this >>openssl x509 -noout -text -in <your_certificate> >>and examine "Issuer" and "Subject" at least. >> >>Regards, >>Ulrich >> >>> for slave, I am also getting: >>> /etc/pki/tls/misc/newcert.pem: /C=JP/ST=Tokyo/L=Kunitachi/O=Hitotsubashi >>> Univ./OU=IER/CN=blade-s00.ier.hit-u.ac.jperror 20 at 0 depth lookup:unable >to >>> get local issuer certificateunable to load >>> certificate25730:error:0906D06C:PEM routines:PEM_read_bio:no start >>> line:pem_lib.c:647:Expecting: TRUSTED CERTIFICATE >>> no matter I put the /etc/pki/CA/ or /etc/pki/CA/cacert.pem for the first >>> argument after -CApath >>> Any clue? Thanks again in advance. I did not do update-ca-certificates, as > >>> mentioned in some books, on both the master and the slave. First, on the > >>> master, I need to use existing cert . So I suppose I dont need to update >it. >> >>> Second, I dont know where this command is located on RH...Is that >relevant? >>> >>> From: Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de> >>> To: openldap-technical(a)openldap.org; wailoktam(a)yahoo.com >>> Sent: Monday, December 1, 2014 7:08 PM >>> Subject: Antw: need serious help on replication over ssl - getting >>> do_syncrep1: rid 001 ldap_sasl_bind_s failed (-1) >>> >>> wailok tam <wailoktam(a)yahoo.com> schrieb am 01.12.2014 um 10:04 in >Nachricht >>> >>> >>> ><674598213.1863113.1417424697693.JavaMail.yahoo(a)jws10083.mail.ne1.yahoo.com>: >>> Hi, I would really be grateful if a nice guy would appear and save me with > >>> this one. Simple bind replication over ldaps port does not work. I don't >>> have >>> a clue. There are very few guides on setting up replication over ldaps on > >>> the web or on prints. I am following this one as I am using RH: >>> >>> Verifying your SSL certificates: >>> Try this (preferrably as the same user that slapd uses): >>> # openssl verify -CApath /etc/ssl/certs /etc/ssl/servercerts/slapd.pem >>> /etc/ssl/servercerts/slapd.pem: OK >>> >>> If (you are using openssl and) it works, your certificate should be OK; if > >>> not fix it and repeat the test. >>> >>> [...] >>> >>> I'd leave out the "tls_cert=" to switch to automatic cert selection; if >that >> >>> soesn't work, something is wrong with your setup; if it works, you can try > >> to >>> use a fixed certificate. >>> >>> Then you could try a manual remote TLS (not SSL) connect (e.g. ldapsearch) > >>> to your master; if it doesn't work, fix the config and repeat the test. >Try >> >>> to retrieve the whole database; if it works, you are quite close, I >guess. >>> >>> Turn on logging for "config" and "sync" at least. Try some modification on > >>> the master and watch what happens... >>> >>> Regards, >>> Ulrich >>> >>> >>> >>> >> >> >> >> > > > > > >

1 0

Re: Antw: Cannot add to mdb
by Da Rock 05 Dec '14

05 Dec '14

On 26/11/2014 18:23, Ulrich Windl wrote: > What you could try is (assuming you have debug symbols in your binary) attaching gdb to the running slapd to see where it is spending CPU time. I can't remember the commands precisely, but "bt (backtrace)" and "info threads" should point you in the right direction. > Note that slapd will likely stop responding while gdb is attached, so you could also try to force a core dump for offline examination. I'm not sure I follow here. How would this work? I attach gdb to the running slapd I get, but if it stops how does that help me? I've only had a little bit of experience with gdb... How would I get a core dump, as well? That sounds like it might be more useful. > > Maybe the gurus get a clue what may be wrong then... > > Regards, > Ulrich > >>>> Da Rock <openldap-technical(a)herveybayaustralia.com.au> schrieb am 26.11.2014 um > 01:31 in Nachricht <54751F73.3080902(a)herveybayaustralia.com.au>: >> I'm trying to get openldap to play nice with mdb given that it is the >> "recommended" database backend for it now- although the conf wasn't an >> issue excepting I'm playing with the new cn=config setup we're expected >> to use now as well (even though it is mainly broken). >> >> My issue is that it seems to not respond like the older bdb/hdb >> databases. And when I say respond, I mean it hangs the ldapadd and makes >> slapd go into conniptions. I see slapd go to 100% WCPU and not come down >> as well as going into a uwait state. I've left it going for 10 minutes >> or more with no change, and I'm only adding 1 small entry of less the 10 >> lines. Strangely, I can still view other entries in the specific db as >> well access the rest of the server, which I won't complain about (aren't >> threads a wonderful invention? ). >> >> So coming to the experts - got a fix at all? Or should I just go back to >> ye olde db backends? At this point I have a db I can't add anything to. >> >> And before anyone asks, there is practically nothing in the logs that I >> can see; and I set the logging to everything (-1). I see recognition of >> the user in the acl and then nothing. The only possible curious entry is >> some blank lines and a number (that changes each time), so nothing >> informative. >> >> I set it up using the cn=config (and I'm still not entirely convinced >> that I will keep cn=config, but apparently it could be gone next version >> according to the grapevine, so the consensus is to suck it up and get >> used to it or your panties will get in a bunch and around your ankles >> when the upgrade comes along), and I've got only olcDBMaxSize. >> olcSizeLimit (not sure exactly which of these 2 can go just yet), >> olcDBMode, olcDBDirectory, and olcDatabase and the obviously root attrs. >> My max size I've set larger than 50M (so 7 digits) which is larger than >> what I have in another db so far, and I figure I can add more if needed >> - currently it is sitting at 64k. >> >> I'm using FreeBSD 9.1, ports Openldap version is 2.4.40_1 with bdb/hdb >> and mdb set in config. But I notice lmdb is not installed as a >> dependency - is this right? >> >> I've been on this for near a week now with no further advancement so any >> help would be very welcome at this point. No googling seems to find >> anything remotely similar either. >> >> TIA > > >

5 7

Problem with Chain Overlay
by Stefano 03 Dec '14

03 Dec '14

Hi, I state that I am a beginner to Ldap !!! I have a problem with the configuration of the Chain Overlay. Provider and Consumer are identical CentOS release 6.5 openldap-servers-2.4.40-1.el6.x86_64 On the Consumer: I configured olcPPolicyForwardUpdates=TRUE in the Ppolicy Overlay and olcUpdateRef: ldap://stfalf02devpom.sociale.it in the ldif file of Ldap DB imported the ldif file: dn: olcOverlay=chain,olcDatabase={1}sociale,cn=config objectClass: olcOverlayConfig objectClass: olcChainConfig olcOverlay: chain olcChainCacheURI: FALSE olcChainMaxReferralDepth: 1 olcChainReturnError: FALSE created the directory /usr/local/openldap/etc/openldap/slapd.d/cn=config/olcDatabase= {1}sociale/olcOverlay={4}chain and imported the ldif file: dn: olcDatabase=ldap,olcOverlay={4}chain,olcDatabase={1}sociale,cn=config objectClass: olcChainDatabase objectClass: olcConfig objectClass: olcDatabaseConfig objectClass: olcLDAPConfig olcDatabase: ldap olcDbIDAssertBind: bindmethod=simple binddn="uid=selmopi,ou=admin_esercizio,ou=Utenze,ou=Amministratori,dc=socia le,dc=it" credentials=strofinella mode=self olcDbURI: ldap://stfalf02devpom.sociale.it All operations were successful but the overlay does not work and does not know why, there are no errors in the logs !!! Help, I do not know where to turn !!! Thanks Best Regards Stefano

4 6

Re: Antw: need serious help on replication over ssl - getting do_syncrep1: rid 001 ldap_sasl_bind_s failed (-1)
by wailok tam 03 Dec '14

03 Dec '14

Hi, thanks again for offering further help. Is what you suggesting, c_rehash, equivalent to updating the certificate database, just like what the update-ca-certificate script would do in debian- based distro? I did not do this rehash thing. In the master, I am using an old set of certs which I suppose to be working. In the slave, I put all the certs in the directory they were first gen.erated, as given in the conf file. Will rehash work properly with the certs in those paths (i.e. /etc/pki/CA/)?I So what to do with the output of openssl x509 -noout -text -in <your_certificate>? I cannot try it now. I have tried sth similar a couple of hours ago that output the content of a cert in text. For the master, the issuer is an external orgaization which we bought the cert from. For the slave, the issuer is my orgaization since I generate it myself. I follow the guide in the link to paste the master ca cert after the orig slave ca cert. Does that strange instruction screw things up?I Thanks again in advance. ------------------------------ On Mon, Dec 1, 2014 11:05 AM GMT Ulrich Windl wrote: >>> wailok tam <wailoktam(a)yahoo.com> schrieb am 01.12.2014 um 11:40 in Nachricht ><1171333883.1885274.1417430400586.JavaMail.yahoo(a)jws100208.mail.ne1.yahoo.com>: >> Hi, thanks for your help. I am getting this on the master, no matter I put >> /usr/share/ssl/certs or /usr/share/ssl/certs/nii-odca2.crt for the first >> argument after -CApath >> /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.crt: >> /C=JP/L=Academe2/O=Hitotsubashi University/OU=Institute of Economic >> Research/CN=mail.ier.hit-u.ac.jperror 20 at 0 depth lookup:unable to get >> local issuer certificateunable to load certificate12574:error:0906D06C:PEM >> routines:PEM_read_bio:no start line:pem_lib.c:647:Expecting: TRUSTED >> CERTIFICATE > >So you have a problem with your issuer certificate: Did you use c_rehash after adding a CA certificate to /etc/ssl/certs? If so, dump your certificates (CA and server) like this >openssl x509 -noout -text -in <your_certificate> >and examine "Issuer" and "Subject" at least. > >Regards, >Ulrich > >> for slave, I am also getting: >> /etc/pki/tls/misc/newcert.pem: /C=JP/ST=Tokyo/L=Kunitachi/O=Hitotsubashi >> Univ./OU=IER/CN=blade-s00.ier.hit-u.ac.jperror 20 at 0 depth lookup:unable to >> get local issuer certificateunable to load >> certificate25730:error:0906D06C:PEM routines:PEM_read_bio:no start >> line:pem_lib.c:647:Expecting: TRUSTED CERTIFICATE >> no matter I put the /etc/pki/CA/ or /etc/pki/CA/cacert.pem for the first >> argument after -CApath >> Any clue? Thanks again in advance. I did not do update-ca-certificates, as >> mentioned in some books, on both the master and the slave. First, on the >> master, I need to use existing cert . So I suppose I dont need to update it. >> Second, I dont know where this command is located on RH...Is that relevant? >> >> From: Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de> >> To: openldap-technical(a)openldap.org; wailoktam(a)yahoo.com >> Sent: Monday, December 1, 2014 7:08 PM >> Subject: Antw: need serious help on replication over ssl - getting >> do_syncrep1: rid 001 ldap_sasl_bind_s failed (-1) >> >>> wailok tam <wailoktam(a)yahoo.com> schrieb am 01.12.2014 um 10:04 in Nachricht >> >> >> <674598213.1863113.1417424697693.JavaMail.yahoo(a)jws10083.mail.ne1.yahoo.com>: >> Hi, I would really be grateful if a nice guy would appear and save me with >> this one. Simple bind replication over ldaps port does not work. I don't >> have >> a clue. There are very few guides on setting up replication over ldaps on >> the web or on prints. I am following this one as I am using RH: >> >> Verifying your SSL certificates: >> Try this (preferrably as the same user that slapd uses): >> # openssl verify -CApath /etc/ssl/certs /etc/ssl/servercerts/slapd.pem >> /etc/ssl/servercerts/slapd.pem: OK >> >> If (you are using openssl and) it works, your certificate should be OK; if >> not fix it and repeat the test. >> >> [...] >> >> I'd leave out the "tls_cert=" to switch to automatic cert selection; if that >> soesn't work, something is wrong with your setup; if it works, you can try to >> use a fixed certificate. >> >> Then you could try a manual remote TLS (not SSL) connect (e.g. ldapsearch) >> to your master; if it doesn't work, fix the config and repeat the test. Try >> to retrieve the whole database; if it works, you are quite close, I guess. >> >> Turn on logging for "config" and "sync" at least. Try some modification on >> the master and watch what happens... >> >> Regards, >> Ulrich >> >> >> >> > > > >

2 3

Re: adding a custom attribute
by Igor Shmukler 03 Dec '14

03 Dec '14

Hello Quanah, Thank you for your reply. Do I create a new schema file for my new attribute as in ${new_attribute}.schema and another for the new object using this new attribute? Sincerely, Igor Shmukler On Tue, Dec 2, 2014 at 11:05 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, December 02, 2014 10:55 PM +0200 Igor Shmukler > <igor.shmukler(a)gmail.com> wrote: > >> Hello, >> >> I want to have an ability add "custom attribute[s]" to my LDAP records. >> For example, such an attribute could be sipTelephone, mobile and/or >> something else. >> >> I did a little digging. Please advise whether I am on the right track. >> >> My understanding, at present, is that I would have to modify >> core.schema [located on my Ubuntu under /etc/ldap/schema ] and perhaps >> some other schema files from the same directory. >> >> I found various syntax OIDs. For telephones, for example - >> 1.3.6.1.4.1.1466.115.121.1.50 should be the right one. There is >> another OID for strings - 1.3.6.1.4.1.1466.115.121.1.15 for UTF-8 >> coded strings. >> >> Is editing core.schema the correct way to go? I am eagerly looking for >> advice. > > > Never, ever, edit core.schema. > > You can apply for your own OID, create your own attributes, and then create > objectClasses that use them. That is the correct way to do things. > > --Quanah > > -- > > Quanah Gibson-Mount > Server Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration

3 2

Obtaining the hashed password using ldapsearch, from aWwindows 2012 server.
by Mark London 02 Dec '14

02 Dec '14

Hi =- We upgraded the OS of our Active Directory server to Windows 2012. On a linux computer running Redhat 5, we use a script to obtain an account's hashed password, using the ldapsearch command. We request the msSFU30Password attribute. The script works fine for any account that was created before the new server was installed. For new accounts, no password is returned. Does anyone know how to make this possible again? One suggestion by someone, was to install the "Services for Unix <https://en.wikipedia.org/wiki/Windows_Services_for_UNIX>" package, which is now deprecated (I can't find what replaces it!). I installed it, but it didn't seem to help. Any other suggestions? Thanks. Mark London MIT PSFC

4 5

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical