- openldap-technical - openldap.org

Have problem searching against ldap server after asyn sasl bind
by Qian Li 02 Dec '14

02 Dec '14

Hi All, Recently, I tried to write a ldap client to do ldap search asynchronously, but failed to perform search operation after a successful async sasl (digest-md5) bind. I’ve tried some code, but only succeeded in searching in synchronized sasl bind. I compared the captured sync and async packets: In sync bind, the search packets were encrypted. In async bind, after sasl (digest-md5) binding to ldap server asynchronously (by calling ldap_sasl_interactive_bind() twice), ldap_search_ext() was called. But the search packet was in plain text. Then the ldap server reset the connection or just didn’t response (in the case of MSAD). Did I use the ldap API incorrectly? Or async sasl bind doesn’t support search operation? Any suggestion will be appreciated and sorry for my poor English.

3 9

Debian style cn=config
by Christian Kratzer 01 Dec '14

01 Dec '14

Hi, while looking what debian generates in their cn=config for Debian Jessie I found following acl on the frontend database: dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by * break olcAccess: {1}to dn.exact="" by * read olcAccess: {2}to dn.base="cn=Subschema" by * read olcSizeLimit: 500 I somehow fail to grasp the relevance of granting manage access to the frontend database. Is it just me or is this is acl just mindless pasting. Apart from that debian jessie is now on openldap 2.4.40 thoug still built agains gnutls. Greetings Christian -- Christian Kratzer CK Software GmbH Email: ck(a)cksoft.de Wildberger Weg 24/2 Phone: +49 7032 893 997 - 0 D-71126 Gaeufelden Fax: +49 7032 893 997 - 9 HRB 245288, Amtsgericht Stuttgart Mobile: +49 171 1947 843 Geschaeftsfuehrer: Christian Kratzer Web: http://www.cksoft.de/

2 1

need serious help on replication over ssl - getting do_syncrep1: rid 001 ldap_sasl_bind_s failed (-1)
by wailok tam 01 Dec '14

01 Dec '14

Hi, I would really be grateful if a nice guy would appear and save me with this one. Simple bind replication over ldaps port does not work. I don't have a clue. There are very few guides on setting up replication over ldaps on the web or on prints. I am following this one as I am using RH: Technical blurb about Oracle Engineered Systems: Configuring OpenLDAP for High Availability. (Master/Slave or Provider/Consumer configuration) [Part 3 of 4] Some of the suspicious bit are: 1. Concatenating the master CA cert and the original slave CA cert to make a new CA cert for use with the slave. But the server cert and key in the slave was signed with the original slave CA without the concatenation.2. the following line:tls_cert= in the slave replication directive seems to be suggesting the location of the master server certificate in the guide but there is no clear mention. I put the location of the master server certificate in this line. A billion thanks in advance. First the master slapd.conf: include /etc/openldap/schema/core.schemainclude /etc/openldap/schema/cosine.schemainclude /etc/openldap/schema/inetorgperson.schemainclude /etc/openldap/schema/nis.schemainclude /etc/openldap/schema/samba.schema # Allow LDAPv2 client connections. This is NOT the default.allow bind_v2 pidfile /var/run/openldap/slapd.pidargsfile /var/run/openldap/slapd.args ######################################################################## ldbm and/or bdb database definitions####################################################################### database bdbsuffix "dc=ier,dc=hit-u,dc=ac,dc=jp"rootdn "cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp"rootpw sameforalldirectory /var/lib/ldap TLSCACertificateFile /usr/share/ssl/certs/nii-odca2.crtTLSCertificateFile /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.crtTLSCertificateKeyFile /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.key overlay syncprovsyncprov-checkpoint 50 10syncprov-sessionlog 100 # Indices to maintain for this databaseindex objectClass eq,presindex ou,cn,mail,surname,givenname eq,pres,subindex uidNumber,gidNumber,loginShell eq,presindex uid,memberUid eq,pres,subindex nisMapName,nisMapEntry eq,pres,subindex entryCSN,entryUUID eq idlcachesize 1000 access to attrs=userPassword by self write by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write by dn="cn=dovecot,dc=ier,dc=hit-u,dc=ac,dc=jp" read by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read by anonymous auth by * none access to attrs=SambaLMPassword,SambaNTPassword by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write by dn="cn=dovecot,dc=ier,dc=hit-u,dc=ac,dc=jp" read by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read by self read by anonymous auth by * none access to * by self write by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read by * read loglevel stats args trace sync ************************************************************************************************************************Next, the slapd.conf of the slave: ### configuration for IER### writeen by T.Tanaka include /etc/openldap/schema/core.schemainclude /etc/openldap/schema/cosine.schemainclude /etc/openldap/schema/inetorgperson.schemainclude /etc/openldap/schema/nis.schemainclude /etc/openldap/schema/samba.schema # Allow LDAPv2 client connections. This is NOT the default.allow bind_v2 # Do not enable referrals until AFTER you have a working directory# service AND an understanding of referrals.#referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pidargsfile /var/run/openldap/slapd.args ######################################################################## ldbm and/or bdb database definitions####################################################################### database bdbsuffix "dc=ier,dc=hit-u,dc=ac,dc=jp"rootdn "cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp"rootpw sameforalldirectory /var/lib/ldap TLSCACertificateFile /etc/pki/CA/cacert.pemTLSCertificateFile /etc/pki/tls/misc/newcert.pemTLSCertificateKeyFile /etc/pki/tls/misc/clearkey.pem # Replicas of this database # Indices to maintain for this databaseindex objectClass eq,presindex ou,cn,mail,surname,givenname eq,pres,subindex uidNumber,gidNumber,loginShell eq,presindex uid,memberUid eq,pres,subindex nisMapName,nisMapEntry eq,pres,subindex entryCSN,entryUUID eq idlcachesize 1000 access to attrs=userPassword by dn="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" write by self write by anonymous auth by * none access to * by dn="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" write by self write by * read loglevel stats args trace sync syncrepl rid=001 provider=ldaps://mail.ier.hit-u.ac.jp:636 type=refreshOnly interval=00:00:05:00 bindmethod=simple searchbase="dc=ier,dc=hit-u,dc=ac,dc=jp" binddn="uid=root,dc=ier,dc=hit-u,dc=ac,dc=jp" credentials=sameforall tls_cert=/usr/share/ssl/certs/mail.ier.hit-u.ac.jp.crt mirrormode onupdateref ldaps://mail.ier.hit-u.ac.jp **************************************************************************************************************************

2 3

Re: OpenLDAP incroyable!
by Quanah Gibson-Mount 01 Dec '14

01 Dec '14

--On Wednesday, November 26, 2014 12:13 PM +0100 Onno van der Straaten <onno.van.der.straaten(a)gmail.com> wrote: > > And....another one. Amazing. So hard to understand the OpenLDAP > interface. Might just as well have been in Chinese. > > > > $ ldapmodify -h zimbra.server.com -p 389 -D "cn=config" -f > olc_password_hash.ldif -W > ldap_initialize( ldap://zimbra.onknows.com:389 ) > Enter LDAP Password: > replace olcPasswordHash: > {SSHA} > modifying entry "olcDatabase={-1}frontend,cn=config" > modify complete > > > So the "modify complete" sort of suggestive of some kind of success > completion or change applied. One would think. No. > > > The olcPasswordHash was "modified complete" to have exact same value as > before. Sort of expected OpenLDAP to be "unwilling to perform", which > often it is. Not now. It just is "willing to ignore". Almost human. Your list of complaints so far: a) You told OpenLDAP to load a file that didn't exist b) You modified a file, by hand, where the first comment in the file is: # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. c) In doing (b), you failed to preserve proper file permissions d) You failed to use the correct tools for doing what you wanted to do, after you broke the configuration (slapcat/slapadd) I'm not really sure what to make of your above complaint. It seems you are saying you think it is an error for ldap to replace a value with itself? All LDAP servers will do that with a replace operation. I.e., there is significant user error present here, and you got yourself into a bad spot, and made it worse via your own actions. A lack of understanding how to use a piece of software does not indicate the software itself is flawed. I will agree that it takes some time to learn how to work with LDAP in general, regardless of it is OpenLDAP, 389, Apache DS, etc. It may indeed be best in your case, to have a graphical UI hiding the grisly details from you, since those details are apparently causing significant challenge in your case. However, in the long run, it pays off significantly to understand the technology you're attempting to use. --Quanah -- Quanah Gibson-Mount Server Architect Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

8 9

ldap update multiple entry by a single command
by Shashi Ranjan 28 Nov '14

28 Nov '14

Hello, I need to update multiple entries in single LDAP modify request for a particular object class. Otherwise I need to first search all the contact and then update one by one. In my case I want to update " l " parameter. l: mysite --> l: newsite Is there any way to update it in single LDAP modify request. dn: cn=test1,ou=comp,ou=people,dc=example,dc= com contactCompany: comp objectClass: cmmContact l: mysite dn: cn=test2,ou=comp,ou=people,dc= example,dc= com contactCompany: comp objectClass: cmmContact l: mysite dn: cn=test3,ou=comp,ou=people,dc= example,dc=com contactCompany: comp objectClass: cmmContact l: mysite P.S.: I am new to OpenLDAP. Thanks & Regards, Shashi Ranjan "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

2 1

Syncrepl N-Way multimaster replication - Configuration issue on Rhel6
by coma 28 Nov '14

28 Nov '14

Hello everybody, i'm currently tring to configure N-Way multimaster replication, and i'm facing two issues with olcServerId and slapd -h options. For information: I'm running on Rhel6.6 with openldap 2.4.39-8. I'm running slapd on non-standard ports (11389 for ldap and ldap with TLS, and 11390 for ldaps) I've tried on standard ports but same issues. I've configured the replication following these two procedures: https://access.redhat.com/solutions/273533 http://www.openldap.org/doc/admin24/replication.html#N-Way%20Multi-Master - First Issue details: When i'm adding olcServerID's on both servers, using following ldif: cat <<EOF | ldapmodify -Y EXTERNAL -H ldapi:/// dn: cn=config changetype: modify replace: olcServerID olcServerID: 1 ldap://server1-test1.test.com olcServerID: 2 ldap://server2-test1.test.com EOF i'm no longer able to restart slapd. Error is: read_config: no serverID / URL match found. Check slapd -h arguments. To resolve it, i've tried to add the URL of my servers in correspondant /etc/sysconfig/ldapExample: SLAPD_LDAP=no SLAPD_LDAPI=yes SLAPD_LDAPS=no SLAPD_URLS="ldap://server1-test1.test.com:11389 ldaps://server1-test1.test.com:11390" But issue "Error is: read_config: no serverID / URL match found." is always present event after a server reboot and a full openldap reinstallationn. - Second issue détails (replication disabled, serverID's removed): With /etc/sysconfig/ldap configured as: SLAPD_LDAP=no SLAPD_LDAPI=yes SLAPD_LDAPS=no SLAPD_URLS="ldap://:11389 ldaps://:11390" i'm able to connect on port 11389/11390 with clear, starttls and SSL using a ldap browser or ldapsearch, But with /etc/sysconfig/ldap configured as: SLAPD_LDAP=no SLAPD_LDAPI=yes SLAPD_LDAPS=no SLAPD_URLS="ldap://server1-test1.test.com:11389 ldaps://server1-test1.test.com:11390" i'm not able to connect anymore. Can you please help me on this? Thanks in advance,

2 2

syncrepl and change in ordering
by Amol Kulkarni 28 Nov '14

28 Nov '14

Hello, I've a openldap 2.4.30 syncrepl setup which is used by our applications. There are over 50 servers in the setup. I want to upgrade our application to the next version. In a single downtime, all servers cannot be upgraded. So the application will be upgraded in phase wise manner. Application upgrade requires some changes in ldap schemas. I want to update the schemas in same phases as the application so as to avoid separate downtime for schema update. I'm planning to update schema on the consumers first and provider last so that during the phases, some servers with old schemas and others with new schemas both replicate properly. schemachecking is set to off on all servers. I understand that new attributes added in schema will not be present on provider at the beginning, so there is no question of their replication. I've compared the schemas and found that none of the attributes is deleted. Only change is that for some attributes we have added 'ordering' and for some we have changed the 'equality'. I'm not using cn=config - if that is a consideration. So will it all work ? Is there a better way? Thanks in advance, Amol Kulkarni.

3 3

Re: ldaps replication question
by wailok tam 27 Nov '14

27 Nov '14

Hi, thanks a lot for your reply. I want to leave the password in text first and go step by step. Do you mind highlighting those lines needed for a SSL thru ldaps configured slave? I find information about modifying another slapd file under etc/defaults on debian base system but I dont know what to do with those on Redhat 5. What is the corresponding file on Rh and what to do in them on the master and slave? ------------------------------ On Wed, Nov 26, 2014 12:57 PM GMT Dieter Klünter wrote: >Am Wed, 26 Nov 2014 06:39:25 +0000 (UTC) >schrieb wailok tam <wailoktam(a)yahoo.com>: > >> Hi, all, >> I cannot get replication to work even I get no error message. I >> change a record on the Master but when I check it on the slave, it >> remains unchanged. (Is it immediate?) The following command on slave: >> ldapsearch -x -h [MASTER HOST NAME] -W -D >> 'cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp' '(uid=tam)' >> returns no error message and gives the expected record. I am >> suspecting I may have screwed up the ssl/tls setting for the slave as >> I dont know what to put there. >[...] > >This is a simplified slapd.conf that may help. > >http://pastebin.com/JcDz6Tkh > >-Dieter > >-- >Dieter Klünter | Systemberatung >http://sys4.de >GPG Key ID: E9ED159B >53°37'09,95"N >10°08'02,42"E

1 0

using ldap database (multiple upstream servers), how to force reconnect after failover?
by David Young 27 Nov '14

27 Nov '14

Hi technical, We have an openldap server (v2.4.39) which acts as a reverse proxy for 2 backend servers (replicated). The intention is that we use this "proxy" server for authentication requests for applications which can't handle SSL, or multiple backend servers, properly. The implementation works as designed - a query is received from a client, passed on to the first server defined in olcDbURL (server1). If the first server is unavailable, after a brief timeout (1 sec), the query is passed to the second server in the oldDbURL (server2). Here's the problem - server1 is never polled again. Queries continue to be passed to server2, but when server2 is unavailable, all queries fail, even if server1 is now available again. Is there a config directive I can use to force ldap to reattempt connection to server1 after the initial failure? My config is below. Thanks :) David --- dn: olcDatabase={1}ldap objectClass: olcDatabaseConfig objectClass: olcLDAPConfig olcDatabase: {1}ldap olcSuffix: dc=mydomain,dc=net,dc=nz olcAddContentAcl: FALSE olcLastMod: FALSE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcSyncUseSubentry: FALSE olcMonitoring: FALSE olcDbURI: "ldaps://server1 ldaps://server2" olcDbStartTLS: none starttls=no olcDbRebindAsUser: FALSE olcDbChaseReferrals: TRUE olcDbTFSupport: no olcDbProxyWhoAmI: FALSE olcDbNetworkTimeout: 1 olcDbProtocolVersion: 3 olcDbSingleConn: FALSE olcDbCancel: abandon olcDbUseTemporaryConn: FALSE olcDbConnectionPoolMax: 16 olcDbNoRefs: FALSE olcDbNoUndefFilter: FALSE structuralObjectClass: olcLDAPConfig entryUUID: 01eb5074-6f65-1033-8a02-cd0b00053594 creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20140514033850Z olcDbIdleTimeout: 1m olcDbConnTtl: 5m entryCSN: 20140514033850.182221Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20140514033850Z

1 0

Invalid DN errors
by Nick Bright 26 Nov '14

26 Nov '14

Greetings, I hope this is an appropriate mailing list to ask for some assistance. I will state up front that my LDAP experience is extremely limited - essentially noob level. I've been attempting to set up openldap 2.4.39 on CentOS 6 via the official distribution packages. The server is up and running, and my application is connecting successfully, and attempting to add entries to the directory; so I believe I have the most fundamentals in place like the directory manager password, and basic base DN. When connecting with an LDAP browser, I see "dc=valnet,dc=net" which was the configured base DN. When my application attempts to add to the directory it searches for the entry, then adds if the entry isn't found. I'm receiving this error: 54760bfd conn=1003 op=971 do_search: invalid dn: "x500UniqueIdentifier=45270,dc=valnet,dc=net" 54760bfd conn=1003 op=971 SEARCH RESULT tag=101 err=34 nentries=0 text=invalid DN 54760bfd conn=1003 op=972 do_add: invalid dn (x500UniqueIdentifier=45270,dc=valnet,dc=net) 54760bfd conn=1003 op=972 RESULT tag=105 err=34 text=invalid DN I suspect that I am missing some sort of extremely basic configuration item, but I've been having a very very difficult time locating relevant documentation - everything I find in my searches references the old style configuration, not the new style LDIF configuration with cn=config directories, nor have I found any information about how to troubleshoot an "invalid DN" error. It appears that I may be missing a schema file such as inetOrgPerson or nis. The application is attempting to create entries with these attributes: Primary Key: x500UniqueIdentifier Attributes: cn, uid, sn, givenname, userPassword, dn, x500UniqueIdentifier I would appreciate some basic guidance as to what to do, or some direction to the proper documentation or guide for solving "invalid DN" while attempting to add entries to the directory. -- ----------------------------------------------- - Nick Bright - - Vice President of Technology - - Valnet -=- We Connect You -=- - - Tel 888-332-1616 x 315 / Fax 620-331-0789 - - Web http://www.valnet.net/ - ----------------------------------------------- - Are your files safe? - - Valnet Vault - Secure Cloud Backup - - More information& 30 day free trial at - - http://www.valnet.net/services/valnet-vault - -----------------------------------------------

3 5

Setting SSL/TLS options in client code?
by Scott Neugroschl 26 Nov '14

26 Nov '14

Right now, I'm passing an ldaps:// URI to ldap_initialize. I'd like to be able to change the SSL/TLS options before initiating the connection. Is such a thing possible? --- Scott Neugroschl | XYPRO Technology Corporation 4100 Guardian Street | Suite 100 |Simi Valley, CA 93063 | Phone 805 583-2874|Fax 805 583-0124 |

3 2

TLS Configuration
by Hydro Tium 26 Nov '14

26 Nov '14

Hi guys, I'm struggling to configure my OpenLDAP with TLS (openssl) without success. I'm receiving the following error: $ sudo slapd -d 3 ... TLS: gcry_control GCRYCTL_SET_RNDEGD_SOCKET failed 5475ca9c main: TLS init failed: -1 My configuration is the following: dn: cn=config objectClass: olcGlobal cn: config olcPidFile: /var/run/slapd/slapd.pid olcArgsFile: /var/run/slapd/slapd.args olcIdleTimeout: 7 olcLogLevel: conns filter stats none olcReferral: ldap://root.openldap.org olcTLSCACertificateFile: /etc/ssl/certs/My_Root_CA.pem olcTLSCertificateFile: /etc/ssl/certs/My_Root_CA.pem olcTLSCertificateKeyFile: /etc/ldap/server.key.pem olcTLSVerifyClient: demand olcTLSRandFile: /dev/urandom Any clues on how to solve this one?

4 4

Cannot add to mdb
by Da Rock 26 Nov '14

26 Nov '14

I'm trying to get openldap to play nice with mdb given that it is the "recommended" database backend for it now- although the conf wasn't an issue excepting I'm playing with the new cn=config setup we're expected to use now as well (even though it is mainly broken). My issue is that it seems to not respond like the older bdb/hdb databases. And when I say respond, I mean it hangs the ldapadd and makes slapd go into conniptions. I see slapd go to 100% WCPU and not come down as well as going into a uwait state. I've left it going for 10 minutes or more with no change, and I'm only adding 1 small entry of less the 10 lines. Strangely, I can still view other entries in the specific db as well access the rest of the server, which I won't complain about (aren't threads a wonderful invention? ). So coming to the experts - got a fix at all? Or should I just go back to ye olde db backends? At this point I have a db I can't add anything to. And before anyone asks, there is practically nothing in the logs that I can see; and I set the logging to everything (-1). I see recognition of the user in the acl and then nothing. The only possible curious entry is some blank lines and a number (that changes each time), so nothing informative. I set it up using the cn=config (and I'm still not entirely convinced that I will keep cn=config, but apparently it could be gone next version according to the grapevine, so the consensus is to suck it up and get used to it or your panties will get in a bunch and around your ankles when the upgrade comes along), and I've got only olcDBMaxSize. olcSizeLimit (not sure exactly which of these 2 can go just yet), olcDBMode, olcDBDirectory, and olcDatabase and the obviously root attrs. My max size I've set larger than 50M (so 7 digits) which is larger than what I have in another db so far, and I figure I can add more if needed - currently it is sitting at 64k. I'm using FreeBSD 9.1, ports Openldap version is 2.4.40_1 with bdb/hdb and mdb set in config. But I notice lmdb is not installed as a dependency - is this right? I've been on this for near a week now with no further advancement so any help would be very welcome at this point. No googling seems to find anything remotely similar either. TIA

2 4

Unexpected growth in mdb database file
by Rene B. Elgaard 26 Nov '14

26 Nov '14

I have gone through an upgrade proces from OpenLDAP 2.4.21 to 2.4.40 and took the opportunity to switch from the bdb backend to mdb. I am expiriencing an (in my eyes) unexpected growth of the mdb database file. Two types of setup: Setup 1: One master, one slave Setup 2: Two masters MMR (read,write,syncrepl goes to one master, three slaves) I see the growth in both setups on the master, who services read,write and syncrepl. In setup 2 the master, who is "idle" and only syncrepl's with the other master, does not grow more than expected. Example from setup 2: Servicing master: -rw------- 1 openldap openldap 4294963200 Nov 26 10:18 data.mdb Non-servicing master: -rw------- 1 openldap openldap 271347712 Nov 26 10:18 data.mdb Quite a difference ! A slapcat on the servicing master shows that I have no where near 4 Gb of data, here from my nightly backup: -rw------- 1 openldap openldap 73389431 Nov 25 23:46 20141125234504_slapd-dump.ldif I have the same backend configuration on all masters: database mdb maxsize 8589934592 suffix "c=<country>" rootdn "cn=Manager,o=<some-org>,c=<country>" rootpw <some-pw> directory <some-path> index objectClass,entryCSN,entryUUID eq No overlays involved. Operating system is Solaris 10. OpenLDAP compiled with Oracles compiler, compiler flags are: export CC="cc" export CFLAGS="-m64 -fast -D_AVL_H" Unsure how to proceed. Should I file an ITS (looks somewhat like 7974 though) ? I may also have missed something entirely... Happy to provide further info. /Rene

1 0

OpenLDAP incroyable!
by Onno van der Straaten 26 Nov '14

26 Nov '14

What was created with OpenLDAP is incredible. Truly. Experienced with open source but never seen before a system that is so archaic. Amazing. The way that configuration works is something that has to be seen and experienced to be believed. There must be strong commercial interest served here to create a system that works in this manner. It allows for configuration changes that corrupt the installation but will now allow manual correction of the configuration. Chicken and egg. To correct the configuration you have start OpenLDAP and ldapmodify the config files. But.... OpenLDAP will not start because the configuration is not correct. Really funny. And if you try to manually undo your changes, OpenLDAP will completely refuse to put itself into something that resembles a working configuration. It is fairly easy to make configuration changes that corrupt the database. Documentation is often incorrect or non-existing. For example try to add sha2 support. Accidentally add non existing hash method will create a corrupt configuration. If you slapd restart it will fail to start. To correct the configuration you need to start slapd. To start slapd you need correct configuration. It is the end of your efforts. I'm not doing this on a production system of course, I am trying to create a production system where OpenLDAP is on of the many components. So far most of the effort is OpenLDAP effort. It is consuming most of the project budget. A project of a couple of days turns into a project for a couple of weeks. We just need a LDAP user directory. OpenLDAP is not it.

8 14

ldaps replication question
by wailok tam 26 Nov '14

26 Nov '14

Hi, all, I cannot get replication to work even I get no error message. I change a record on the Master but when I check it on the slave, it remains unchanged. (Is it immediate?) The following command on slave: ldapsearch -x -h [MASTER HOST NAME] -W -D 'cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp' '(uid=tam)' returns no error message and gives the expected record. I am suspecting I may have screwed up the ssl/tls setting for the slave as I dont know what to put there. The master is set to use ssl/tls and it communicates fine with the client thru the ldaps protocol. Your help is much needed. First come the slapd.conf of the slave (I dont have the lines for ssl certs. I just use the ldaps address in the replication directive. Is that enough?): ### configuration for IER### writeen by T.Tanaka include /etc/openldap/schema/core.schemainclude /etc/openldap/schema/cosine.schemainclude /etc/openldap/schema/inetorgperson.schemainclude /etc/openldap/schema/nis.schemainclude /etc/openldap/schema/samba.schema # Allow LDAPv2 client connections. This is NOT the default.allow bind_v2 # Do not enable referrals until AFTER you have a working directory# service AND an understanding of referrals.#referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pidargsfile /var/run/openldap/slapd.args ######################################################################## ldbm and/or bdb database definitions####################################################################### database bdbsuffix "dc=ier,dc=hit-u,dc=ac,dc=jp"rootdn "cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp"rootpw SLAVEPWdirectory /var/lib/ldap # Replicas of this database # Indices to maintain for this databaseindex objectClass eq,presindex ou,cn,mail,surname,givenname eq,pres,subindex uidNumber,gidNumber,loginShell eq,presindex uid,memberUid eq,pres,subindex nisMapName,nisMapEntry eq,pres,subindex entryCSN,entryUUID eq idlcachesize 1000 access to attrs=userPassword by dn="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" write by self write by anonymous auth by * none access to * by dn="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" write by self write by * read #loglevel stats sync syncrepl rid=001 provider=ldaps://mail.ier.hit-u.ac.jp type=refreshAndPersist interval=00:00:05:00 searchbase="dc=ier,dc=hit-u,dc=ac,dc=jp" binddn="uid=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" credentials=SLAVEPW Next come the slapd.conf of the master: ### configuration for IER### writeen by T.Tanaka### edited by WL.Tam include /etc/openldap/schema/core.schemainclude /etc/openldap/schema/cosine.schemainclude /etc/openldap/schema/inetorgperson.schemainclude /etc/openldap/schema/nis.schemainclude /etc/openldap/schema/samba.schema # Allow LDAPv2 client connections. This is NOT the default.allow bind_v2 pidfile /var/run/openldap/slapd.pidargsfile /var/run/openldap/slapd.args ######################################################################## ldbm and/or bdb database definitions####################################################################### database bdbsuffix "dc=ier,dc=hit-u,dc=ac,dc=jp"rootdn "cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp"rootpw MASTERPWdirectory /var/lib/ldap TLSCACertificateFile /usr/share/ssl/certs/nii-odca2.crtTLSCertificateFile /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.crtTLSCertificateKeyFile /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.key overlay syncprovsyncprov-checkpoint 50 10syncprov-sessionlog 100 # Indices to maintain for this databaseindex objectClass eq,presindex ou,cn,mail,surname,givenname eq,pres,subindex uidNumber,gidNumber,loginShell eq,presindex uid,memberUid eq,pres,subindex nisMapName,nisMapEntry eq,pres,subindex entryCSN,entryUUID eq idlcachesize 1000 access to attrs=userPassword by self write by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write by dn="cn=dovecot,dc=ier,dc=hit-u,dc=ac,dc=jp" read by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read by anonymous auth by * none access to attrs=SambaLMPassword,SambaNTPassword by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write by dn="cn=dovecot,dc=ier,dc=hit-u,dc=ac,dc=jp" read by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read by self read by anonymous auth by * none access to * by self write by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read by * read

3 2

Re: Antw: getting warning:var/lib/ldap/__db.004 is not owned by "ldap" and ldap wont start
by wailok tam 26 Nov '14

26 Nov '14

Hi, thanks. it is fixed now. I get another trouble with doing replication over SSL on redhat. I dont know how to config the slave.If you can help with my other post, that would be greatly appreciated. From: Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de> To: openldap-technical(a)openldap.org; wailoktam(a)yahoo.com Sent: Wednesday, November 26, 2014 5:26 PM Subject: Antw: getting warning:var/lib/ldap/__db.004 is not owned by "ldap" and ldap wont start >>> wailok tam <wailoktam(a)yahoo.com> schrieb am 26.11.2014 um 04:36 in Nachricht <1434320209.699036.1416973016975.JavaMail.yahoo(a)jws100111.mail.ne1.yahoo.com>: > Hi, all, I get the warning given in the title and ldap stops even after > reporting to start successfully. > The error is fixed by doing a chown for the affected files. It was > mysteriously changed to root. I change it back to ldap and it works again. > However, I want to know what has caused this to happen. Anyone can help? Most likely: You started slapadd as root? > I am in the course of changing a slurpd-based replication to a > syncrepl-based replication. I suspect that is relevant. > In the old and working master config: > rootdn: root binddn for replication(slurpd) directive: replicator > In the old and working slave config: rootdn: replicator > > In the new master config: rootdn: root > > In the new slave config: rootdn: replicator > binddn for replication(syncrepl) directive: replicator > What has caused the db.00X file to be owned by root? > The new configs once start without error. But I find the replication is not > doing its job when I check on the slave the data of a user account I changed > on the master side. So I go back to the old config. And then the > var/lib/ldap/__db.004 is not owned by "ldap" comes up and ldap wont start on > the slave. > Maybe the syncrepl has been working partially, just in a different name and > causes the problem?Maybe it is not working at all as I dont know what to put > about ssl/tls in the slave config file. In the master, I have commented out > the tls cert/key lines and access to the server by the client are done with > the ldaps:// port. But I dont know what to do with the slapd.conf of the > slave file. Does it have to get the ssl lines commented out in order to get > allowed to access the master. > Any help would be greatly appreciated.

1 0

getting warning:var/lib/ldap/__db.004 is not owned by "ldap" and ldap wont start
by wailok tam 26 Nov '14

26 Nov '14

Hi, all, I get the warning given in the title and ldap stops even after reporting to start successfully. The error is fixed by doing a chown for the affected files. It was mysteriously changed to root. I change it back to ldap and it works again. However, I want to know what has caused this to happen. Anyone can help? I am in the course of changing a slurpd-based replication to a syncrepl-based replication. I suspect that is relevant. In the old and working master config: rootdn: root binddn for replication(slurpd) directive: replicator In the old and working slave config: rootdn: replicator In the new master config: rootdn: root In the new slave config: rootdn: replicator binddn for replication(syncrepl) directive: replicator What has caused the db.00X file to be owned by root? The new configs once start without error. But I find the replication is not doing its job when I check on the slave the data of a user account I changed on the master side. So I go back to the old config. And then the var/lib/ldap/__db.004 is not owned by "ldap" comes up and ldap wont start on the slave. Maybe the syncrepl has been working partially, just in a different name and causes the problem?Maybe it is not working at all as I dont know what to put about ssl/tls in the slave config file. In the master, I have commented out the tls cert/key lines and access to the server by the client are done with the ldaps:// port. But I dont know what to do with the slapd.conf of the slave file. Does it have to get the ssl lines commented out in order to get allowed to access the master. Any help would be greatly appreciated.

2 2

Re: Antw: Re: multi master replication
by Guruprasad Kulkarni 26 Nov '14

26 Nov '14

I think I can have two "rid=000" because I do not see any complaints on the logs (both masters) and the replication works. I'll have to read more about this. Thanks, Guruprasad On Nov 25, 2014 2:46 AM, "Ulrich Windl" <Ulrich.Windl(a)rz.uni-regensburg.de> wrote: > Hi! > > First I think you cannot have two "rid=000", second (unless you use > certificates or more sophisticated mechs) your password will be visible in > the > config. That's why the config should be protected (and better not be sent > to > this list unmodified). > > Regards, > Ulrich > > >>> Guruprasad Kulkarni <gkulkarni(a)gridcosystems.com> schrieb am > 24.11.2014 > um > 20:01 in Nachricht > <CAB6=W2stWBseeehyE7vPn-v1BG6Wro+WPZtqdMb8ZY0yFqrXSQ(a)mail.gmail.com>: > > So I found an example for setting up multi master replication using > > slapd.conf > > > > *slapd.conf for MASTER 1* > > > > *# slapd master ldap1.example.com <http://ldap1.example.com>* > > *# global section* > > *serverID 001* > > > > *database bdb* > > *...* > > > > *access to ** > > * by dn.base="cn=admin,ou=people,dc=example,dc=com" read* > > * by * read* > > > > *syncrepl rid=000 * > > * provider=ldap://ldap2.example.com <http://ldap2.example.com>* > > * type=refreshAndPersist* > > * retry="5 5 300 +" * > > * searchbase="dc=example,dc=com"* > > * attrs="*,+"* > > * bindmethod=simple* > > * binddn="cn=admin,ou=people,dc=example,dc=com"* > > * credentials=secret* > > > > *index objectClass eq* > > > > *mirrormode TRUE* > > > > *overlay syncprov* > > *syncprov-checkpoint 100 10* > > > > > > > > *slapd.conf for MASTER 2* > > > > *# slapd master ldap2.example.com <http://ldap2.example.com>* > > *# global section* > > *serverID 002* > > > > *database bdb* > > *...* > > > > *access to ** > > * by dn.base="cn=admin,ou=people,dc=example,dc=com" read* > > * by * read * > > > > *syncrepl rid=000 * > > * provider=ldap://ldap1.example.com <http://ldap1.example.com>* > > * type=refreshAndPersist* > > * retry="5 5 300 +" * > > * searchbase="dc=example,dc=com"* > > * attrs="*,+"* > > * bindmethod=simple* > > * binddn="cn=admin,ou=people,dc=example,dc=com"* > > * credentials=secret* > > > > *index objectClass eq* > > > > *mirrormode TRUE* > > > > *overlay syncprov* > > *syncprov-checkpoint 100 10* > > > > > > > > My question is - Do the credentials have to be clear text passwords? If > > not, how do I mention encrypted passwords? (I tried within quotes ' ' > and " > > ", but each time got invalid credentials error) > > > > > > > > On Mon, Nov 24, 2014 at 1:28 PM, Howard Chu <hyc(a)symas.com> wrote: > > > >> Guruprasad Kulkarni wrote: > >> > >>> Hi, > >>> > >>> I did have a look at the options and only "--enable-modules" option > >>> talks about dynamic module support > >>> > >>> I tried "--enable-dynamic" option as well (the description for it is > >>> enable linking built binaries with dynamic libs) > >>> > >>> What I do observe is that even though I have "moduleload syncprov.la > >>> <http://syncprov.la>" directive in slapd.conf, slapd does not complain > >>> about it. So I guess I do not have to specify the module path > >>> (syncreplication tests were successful as well) > >>> > >> > >> Correct, moduleload silently succeeds if you specify a module that was > >> built statically. > >> > >>> > >>> I also realized I was looking at the OLC configuration examples for > >>> multi master. What I need to do is find slapd.conf example for multi > >>> master. > >>> > >>> > >>> On Mon, Nov 24, 2014 at 11:29 AM, Dieter Klünter <dieter(a)dkluenter.de > >>> <mailto:dieter@dkluenter.de>> wrote: > >>> > >>> Am Mon, 24 Nov 2014 09:52:34 -0500 > >>> schrieb Guruprasad Kulkarni <gkulkarni(a)gridcosystems.com > >>> <mailto:gkulkarni@gridcosystems.com>>: > >>> > >>> > I have 2 questions regarding multi master replication: > >>> > > >>> > 1. I built openldap 2.4.40 from source and according to the > >>> makefile, > >>> > the module directory should be at /usr/local/libexec/openldap. > >>> > > >>> > However I do not see such a folder. Am I missing something? > The > >>> > options I used with configure were "--enable-debug > --enable-modules > >>> > --enable-hdb --enable-monitor --enable-ppolicy --enable-syncprov > >>> > --with-tls --with-cyrus-sasl" > >>> > > >>> > I am asking because the multi master replication example ( > >>> >http://www.openldap.org/doc/admin24/replication.html > >>> > <http://www.openldap.org/doc/admin24/replication.html#N-Way>) > >>> needs > >>> > me to load thesyncprov.la <http://syncprov.la> module, but I am > >>> not sure if the > >>> > modulepath given there is correct or not. > >>> > >>> You have probably not build dynamic loadable modules, but built-in > >>> modules. > >>> you should run ./configure --help | less, which will show proper > build > >>> choices. > >>> > >> > >> -- > >> -- Howard Chu > >> CTO, Symas Corp. http://www.symas.com > >> Director, Highland Sun http://highlandsun.com/hyc/ > >> Chief Architect, OpenLDAP http://www.openldap.org/project/ > >> > > > > > > > > -- > > -Guruprasad > > > >

2 1

Re: Antw: Passwords, Hashing, and Binds
by Quanah Gibson-Mount 26 Nov '14

26 Nov '14

--On Monday, November 24, 2014 12:22 PM +0100 Onno van der Straaten <onno.van.der.straaten(a)gmail.com> wrote: > sudo make install I'd generally advise you really read over the options to configure, and build a better set of binaries. For example, leave out back-bdb/hdb, and enable building things modularly. My options are: --with-cyrus-sasl \ --with-tls=openssl \ --enable-dynamic \ --enable-slapd \ --enable-modules \ --enable-backends=mod \ --disable-shell \ --disable-sql \ --disable-bdb \ --disable-hdb \ --disable-ndb \ --enable-overlays=mod \ --enable-debug \ --enable-spasswd \ --enable-crypt; \ > Make the sha2 module > cd ~/openldap/contrib/slapd-modules/passwd/sha2 > sed -i.bak s/-Wall -g/-Wall -g fPIC/g Makefile > make I do: (cd openldap-$(LDAP_VERSION)/contrib/slapd-modules/passwd/sha2; \ $(MAKE) prefix=/usr/local LIBS="-L$(LDAP_LIB_DIR) -lldap_r -llber" install STRIP=""; \ ) And then it installs it for me in the same location. Just make sure you use the same prefix here. > This results in a number of files pw-sha2.la sha2.lo sha2.o slapd-sha2.lo slapd-sha2.o > > The question now is how to install this on my target OpenLDAP server. I > put the files in /usr/lib64/openldap en dan tried to add the following > dn: cn=module{0},cn=config > changetype: modify > replace: olcModuleLoad > olcModuleLoad: slapd-sha2.la I'm not sure that replacing olcModuleLoad is correct. If you already have values in there, you probably want to keep them. I generally *add* an additional values. In any case, your value for the attribute is incorrect. The .la file is named, as in your email, pw-sha2.la, not slapd-sha2.la . If you want to add it as an additional module to load, then you would do changetype: modify add: olcModuleLoad olcModuleLoad: pw-sha2.la My loaded modules are: dn: cn=module{0} objectClass: olcModuleList cn: module{0} olcModulePath: /opt/zimbra/openldap/sbin/openldap olcModuleLoad: {0}back_mdb.la olcModuleLoad: {1}back_monitor.la olcModuleLoad: {2}syncprov.la olcModuleLoad: {3}accesslog.la olcModuleLoad: {4}dynlist.la olcModuleLoad: {5}unique.la olcModuleLoad: {6}noopsrch.la olcModuleLoad: {7}pw-sha2.la for example. now, if you want to make something like say, SHA512 the default, then you need to modify the frontend config db: dn: olcDatabase={-1},cn=config changetype: modify replace: olcPasswordHash olcPasswordHash: {SSHA512} --Quanah -- Quanah Gibson-Mount Server Architect Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Returned mail: Data format error
by cloos＠jhcloos.com 25 Nov '14

25 Nov '14

1 0

multi master replication
by Guruprasad Kulkarni 25 Nov '14

25 Nov '14

I have 2 questions regarding multi master replication: 1. I built openldap 2.4.40 from source and according to the makefile, the module directory should be at /usr/local/libexec/openldap. However I do not see such a folder. Am I missing something? The options I used with configure were "--enable-debug --enable-modules --enable-hdb --enable-monitor --enable-ppolicy --enable-syncprov --with-tls --with-cyrus-sasl" I am asking because the multi master replication example ( http://www.openldap.org/doc/admin24/replication.html <http://www.openldap.org/doc/admin24/replication.html#N-Way>) needs me to load the syncprov.la module, but I am not sure if the modulepath given there is correct or not. 2. Are the ldifs mentioned in the example enough with the following slapd.conf file I have? include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/misc.schema include /usr/local/etc/openldap/schema/nis.schema include /usr/local/etc/openldap/schema/ppolicy.schema #custom password quality checker module location modulepath /usr/local/lib moduleload back_hdb.la moduleload ppolicy.la moduleload syncprov.la database hdb suffix "dc=example,dc=com" rootdn "cn=manager,dc=example,dc=com" rootpw *rootpw* access to * by dn="cn=manager,dc=example,dc=com" write by self write by * read directory /usr/local/var/openldap-data # Indices to maintain index objectClass eq overlay ppolicy ppolicy_default "cn=default,ou=Policies,dc=example,dc=com" overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 loglevel 256 TLSCACertificateFile path_to_ca_certificate TLSCertificateFile path_to_certificate_file TLSCertificateKeyFile path_to_certificate_key_file I am new to openLDAP and not sure how to set up muti master replication properly. -- -Guruprasad

4 6

can our redhat os be migrate into 64bit?
by Wang, Hui 24 Nov '14

24 Nov '14

Hi, Our openLDAP is in version 2.3.4, it currently installed on a redhat 32bit. Can this server be migrate into 64bits? I can't find the os requirement for different version of openldap at this moment thanks Hui Wang (Holly) CSUN IT Department Identity and Directory Service 818-677-2031 holly.wang(a)csun.edu

3 2

Add attribute to already defined objectclass organizationalUnit in core.schema
by Shashi Ranjan 24 Nov '14

24 Nov '14

Hello, I need to add two elements to organizationalUnit Object Class. How can I do it without modifying the core.schema file? Is there a way to define two new attributes in my private schema file (local.schema) and then extend the object class organizationalUnit defined in core.schema? I do not want to modify the file core.schema. I wish to deliver only my local schema file (local.schema) with other changes also. P.S.: I m new OpenLDAP. Thanks & Regards, Shashi Ranjan "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

4 3

Re: Antw: Passwords, Hashing, and Binds
by Onno van der Straaten 24 Nov '14

24 Nov '14

Hi, I need some help getting this SSHA512 support. I found the module in the contrib directory passwd/sha2 but the README is still the old readme. It is doesn't explain how to install the module after compliation. This is what I was able to do so far On a clean CentOS VM make OpenLDAP 2-4-40 sudo yum -y install git mkdir openldap && cd openldap git clone git://git.openldap.org/openldap.git . git tag -l git checkout tags/OPENLDAP_REL_ENG_2_4_40 sudo yum -y install gcc export CXXFLAGS="$CXXFLAGS -fPIC" sudo yum -y install db4 db4-devel ./configure make depend sudo make sudo make install Make the sha2 module cd ~/openldap/contrib/slapd-modules/passwd/sha2 sed -i.bak s/-Wall -g/-Wall -g fPIC/g Makefile make This results in a number of files pw-sha2.la sha2.lo sha2.o slapd-sha2.lo slapd-sha2.o The question now is how to install this on my target OpenLDAP server. I put the files in /usr/lib64/openldap en dan tried to add the following dn: cn=module{0},cn=config changetype: modify replace: olcModuleLoad olcModuleLoad: slapd-sha2.la This give me an error message + sudo ldapadd -Y EXTERNAL -H ldapi:/// -f sha2.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 ldap_add: Other (e.g., implementation specific) error (80) additional info: <olcModuleLoad> handler exited with 1 adding new entry "cn=module{0},cn=config" The readme only describes how this used to work. I followed the readme for older version of OpenLDAP 2.4.23. This produces one file slapd-sha2.o exactly as described in the readme. I was able to install this module using this readme. Problem is that I need SSHA-512 which the older module does not support. Any tips or suggestions will be much appriacted Thanks and Regards, Onno On Fri, Aug 29, 2014 at 9:15 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Friday, August 29, 2014 9:55 AM +0200 Ulrich Windl < > Ulrich.Windl(a)rz.uni-regensburg.de> wrote: > > Bram Cymet <bcymet(a)cbnco.com> schrieb am 28.08.2014 um 22:26 in >>>>> Nachricht >>>>> >>>> <53FF9080.1050209(a)cbnco.com>: >> >>> Hi, >>> >>> I am storing users passwords in a userPassword attribute. When the >>> passwords are hashed with MD5 I can bind as the user just fine. If I >>> hash the password with sha-256 I get invalid credentials. >>> >> >> I wonder: My slappasswd only knows about {SHA} and {SSHA}, {MD5} and >> {SMD5}, {CRYPT}, and {CLEARTEXT}. Section 14.4 of the manual indicates >> that hashed passwords are non-standard anyway. So implement the >> non-standard on your clients. >> > > It takes 5 seconds to look in the contrib directory shipped with the > source and find: > > SHA-2 OpenLDAP support > ---------------------- > > slapd-sha2.c provides support for SSHA-512, SSHA-384, SSHA-256, > SHA-512, SHA-384 and SHA-256 hashed passwords in OpenLDAP. For > instance, one could have the LDAP attribute: > > userPassword: {SHA512}vSsar3708Jvp9Szi2NWZZ02Bqp1qRC > FpbcTZPdBhnWgs5WtNZKnvCXdhztmeD2cmW192CF5bDufKRpayrW/isg== > > or: > > userPassword: {SHA384}WKd1ukESvjAFrkQHznV9iP2nHUBJe7 > gCbsrFTU4//HIyzo3jq1rLMK45dg/ufFPt > > or: > > userPassword: {SHA256}K7gNU3sdo+OL0wNhqoVWhr3g6s1xYv72ol/pe/Unols= > > all of which encode the password 'secret'. > > (etc). As I already stated, there's a module for this. I use it on my > systems to add SSHA512 suport. > > --Quanah > > > > -- > > Quanah Gibson-Mount > Server Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > >

1 0

LDAP wire protocol analysis with Wireshark
by Igor Shmukler 24 Nov '14

24 Nov '14

Hello, As per a suggestion by Andrew Findlay, I have been using Wireshark to debug my LDAP client. Specifically, at this time, I am working on simple paging results. One "issue" which I have noticed, is that searchResultsControl returned by both OpenLDAP and/or MS AD servers always has a size of 0. The cookie is returned according to the RFC 2696 specification, but size is not. Please advise what I am missing. Thank you, Igor Shmukler

1 0

main: TLS init def ctx failed: -1
by Hydro Tium 24 Nov '14

24 Nov '14

Hello, I'm trying to configure TLS but slapd won't even start: Here's my config: ################################################################################ # dynamic config file - global configuration entry ################################################################################ dn: cn=config objectClass: olcGlobal cn: config olcPidFile: /var/run/slapd/slapd.pid olcArgsFile: /var/run/slapd/slapd.args olcIdleTimeout: 7 olcLogLevel: conns filter stats none olcReferral: ldap://root.openldap.org olcTLSCACertificateFile: /etc/ldap/tls/cacert.pem olcTLSCertificateFile: /etc/ldap/tls/servercrt.pem olcTLSCertificateKeyFile: /etc/ldap/tls/serverkey.pem olcTLSVerifyClient: demand olcTLSRandFile: /dev/urandom ################################################################################ # modules loading ################################################################################ #dn: cn=module{0},cn=config #objectClass: olcModuleList #cn: module{0} #olcModulePath: /usr/lib/ldap #olcModuleLoad: back_hdb.la ################################################################################ # schema definitions ################################################################################ dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema ################################################################################ # include the schemas ################################################################################ include: file:///etc/ldap/schema/core.ldif include: file:///etc/ldap/schema/cosine.ldif include: file:///etc/ldap/schema/inetorgperson.ldif ################################################################################ # backend directives ################################################################################ dn: olcBackend=hdb,cn=config objectClass: olcBackendConfig olcBackend: hdb ################################################################################ # frontend database parameters ################################################################################ dn: olcDatabase=frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: frontend olcAccess: to * by * read olcReadOnly: FALSE ################################################################################ # config database parameters ################################################################################ dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootPW: {SSHA}nHfi6O5OcjA0LG6gj2Gb7EDzBoGFPQtB olcAccess: to * by * none When I check the /var/log/debug messages the error in this email subject appears. I'm trying to start the service via the invoke-rc.d slapd start command, but all it returns is a failed status. Any clues with this? Thanks!

4 3

slapcat ldif backup
by Jerry 23 Nov '14

23 Nov '14

FreeBSD 10.1-RELEASE I reported this problem before. I am experiencing periodic backup failure with slapcat. I run it from CRON if that makes any difference. This is the exact failure message: 5471c421 mdb_db_open: database "dc=seibercom,dc=net" cannot be opened: No such file or directory (2). Restore from backup! 5471c421 backend_startup_one (type=mdb, suffix="dc=seibercom,dc=net"): bi_db_open failed! (2) slap_startup failed LDIF Backup Failed Exit Code: 0 I ran the slapcat command under "truss" and this is the output: mmap(0x0,32768,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 34367242240 (0x800728000) issetugid(0x800928a20,0x7fffffffefc8,0x40,0x0,0xffff800800929a58,0x0) = 0 (0x0) lstat("/etc",{ mode=drwxr-xr-x ,inode=29614464,size=2560,blksize=32768 }) = 0 (0x0) lstat("/etc/libmap.conf",{ mode=-rw-r--r-- ,inode=29614965,size=109,blksize=32768 }) = 0 (0x0) open("/etc/libmap.conf",O_CLOEXEC,01760) = 3 (0x3) fstat(3,{ mode=-rw-r--r-- ,inode=29614965,size=109,blksize=32768 }) = 0 (0x0) mmap(0x0,109,PROT_READ,MAP_PRIVATE,3,0x0) = 34367275008 (0x800730000) close(3) = 0 (0x0) lstat("/usr",{ mode=drwxr-xr-x ,inode=37238784,size=512,blksize=32768 }) = 0 (0x0) lstat("/usr/local",{ mode=drwxr-xr-x ,inode=37238785,size=512,blksize=32768 }) = 0 (0x0) lstat("/usr/local/etc",{ mode=drwxr-xr-x ,inode=37569402,size=2560,blksize=32768 }) = 0 (0x0) lstat("/usr/local/etc/libmap.d",{ mode=drwxr-xr-x ,inode=803208,size=512,blksize=32768 }) = 0 (0x0) open("/usr/local/etc/libmap.d",O_NONBLOCK|O_DIRECTORY|O_CLOEXEC,0165) = 3 (0x3) __sysctl(0x7fffffffc948,0x2,0x80092964c,0x7fffffffc940,0x0,0x0) = 0 (0x0) fstatfs(0x3,0x7fffffffc968,0x80092964c,0x7fffffffc940,0x0,0x0) = 0 (0x0) getdirentries(0x3,0x80072e000,0x1000,0x80072d028,0x0,0x0) = 24 (0x18) getdirentries(0x3,0x80072e000,0x1000,0x80072d028,0x18,0x0) = 0 (0x0) close(3) = 0 (0x0) munmap(0x800730000,109) = 0 (0x0) mmap(0x0,36864,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 34367275008 (0x800730000) access("/usr/local/lib/libldap_r-2.4.so.2",0) = 0 (0x0) open("/usr/local/lib/libldap_r-2.4.so.2",O_CLOEXEC,034607770) = 3 (0x3) fstat(3,{ mode=-rw-r--r-- ,inode=37570468,size=311864,blksize=32768 }) = 0 (0x0) mmap(0x0,4096,PROT_READ,MAP_PRIVATE|MAP_PREFAULT_READ,3,0x0) = 34367311872 (0x800739000) mmap(0x0,2416640,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34369347584 (0x80092a000) mmap(0x80092a000,303104,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE|MAP_PREFAULT_READ,3,0x0) = 34369347584 (0x80092a000) mmap(0x800b73000,12288,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_PREFAULT_READ,3,0x49000) = 34371743744 (0x800b73000) mmap(0x800b76000,8192,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_ANON,-1,0x0) = 34371756032 (0x800b76000) munmap(0x800739000,4096) = 0 (0x0) close(3) = 0 (0x0) access("/usr/local/lib/liblber-2.4.so.2",0) = 0 (0x0) open("/usr/local/lib/liblber-2.4.so.2",O_CLOEXEC,034607770) = 3 (0x3) fstat(3,{ mode=-rw-r--r-- ,inode=37567810,size=58320,blksize=32768 }) = 0 (0x0) mmap(0x0,4096,PROT_READ,MAP_PRIVATE|MAP_PREFAULT_READ,3,0x0) = 34367311872 (0x800739000) mmap(0x0,2154496,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34371764224 (0x800b78000) mmap(0x800b78000,57344,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE|MAP_PREFAULT_READ,3,0x0) = 34371764224 (0x800b78000) mmap(0x800d85000,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_PREFAULT_READ,3,0xd000) = 34373914624 (0x800d85000) munmap(0x800739000,4096) = 0 (0x0) close(3) = 0 (0x0) access("/usr/local/lib/libltdl.so.7",0) = 0 (0x0) open("/usr/local/lib/libltdl.so.7",O_CLOEXEC,034607770) = 3 (0x3) fstat(3,{ mode=-rwxr-xr-x ,inode=37570220,size=37304,blksize=32768 }) = 0 (0x0) mmap(0x0,4096,PROT_READ,MAP_PRIVATE|MAP_PREFAULT_READ,3,0x0) = 34367311872 (0x800739000) mmap(0x0,2134016,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34373918720 (0x800d86000) mmap(0x800d86000,36864,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE|MAP_PREFAULT_READ,3,0x0) = 34373918720 (0x800d86000) mmap(0x800f8e000,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_PREFAULT_READ,3,0x8000) = 34376048640 (0x800f8e000) munmap(0x800739000,4096) = 0 (0x0) close(3) = 0 (0x0) access("/usr/local/lib/libcrypt.so.5",0) ERR#2 'No such file or directory' open("/var/run/ld-elf.so.hints",O_CLOEXEC,034607770) = 3 (0x3) read(3,"Ehnt\^A\0\0\0\M^@\0\0\0M\^A\0\0"...,128) = 128 (0x80) lseek(3,0x80,SEEK_SET) = 128 (0x80) read(3,"/lib:/usr/lib:/usr/lib/compat:/u"...,333) = 333 (0x14d) close(3) = 0 (0x0) access("/lib/libcrypt.so.5",0) = 0 (0x0) open("/lib/libcrypt.so.5",O_CLOEXEC,034607770) = 3 (0x3) fstat(3,{ mode=-r--r--r-- ,inode=9871558,size=62040,blksize=32768 }) = 0 (0x0) mmap(0x0,4096,PROT_READ,MAP_PRIVATE|MAP_PREFAULT_READ,3,0x0) = 34367311872 (0x800739000) mmap(0x0,2228224,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34376052736 (0x800f8f000) mmap(0x800f8f000,57344,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE|MAP_PREFAULT_READ,3,0x0) = 34376052736 (0x800f8f000) mmap(0x80119d000,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_PREFAULT_READ,3,0xe000) = 34378207232 (0x80119d000) mmap(0x80119e000,69632,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_ANON,-1,0x0) = 34378211328 (0x80119e000) munmap(0x800739000,4096) = 0 (0x0) close(3) = 0 (0x0) access("/usr/local/lib/libssl.so.8",0) = 0 (0x0) open("/usr/local/lib/libssl.so.8",O_CLOEXEC,034607770) = 3 (0x3) fstat(3,{ mode=-rw-r--r-- ,inode=37562291,size=479367,blksize=32768 }) = 0 (0x0) mmap(0x0,4096,PROT_READ,MAP_PRIVATE|MAP_PREFAULT_READ,3,0x0) = 34367311872 (0x800739000) mmap(0x0,2527232,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34378280960 (0x8011af000) mmap(0x8011af000,393216,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE|MAP_PREFAULT_READ,3,0x0) = 34378280960 (0x8011af000) mmap(0x80140e000,40960,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_PREFAULT_READ,3,0x5f000) = 34380767232 (0x80140e000) munmap(0x800739000,4096) = 0 (0x0) close(3) = 0 (0x0) access("/usr/local/lib/libcrypto.so.8",0) = 0 (0x0) open("/usr/local/lib/libcrypto.so.8",O_CLOEXEC,034607770) = 3 (0x3) fstat(3,{ mode=-rw-r--r-- ,inode=37560373,size=2390484,blksize=32768 }) = 0 (0x0) mmap(0x0,4096,PROT_READ,MAP_PRIVATE|MAP_PREFAULT_READ,3,0x0) = 34367311872 (0x800739000) mmap(0x0,4222976,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34380808192 (0x801418000) mmap(0x801418000,1966080,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE|MAP_PREFAULT_READ,3,0x0) = 34380808192 (0x801418000) mmap(0x8017f8000,147456,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_PREFAULT_READ,3,0x1e0000) = 34384871424 (0x8017f8000) mmap(0x80181c000,12288,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_ANON,-1,0x0) = 34385018880 (0x80181c000) munmap(0x800739000,4096) = 0 (0x0) close(3) = 0 (0x0) access("/usr/local/lib/libthr.so.3",0) ERR#2 'No such file or directory' access("/lib/libthr.so.3",0) = 0 (0x0) open("/lib/libthr.so.3",O_CLOEXEC,034607770) = 3 (0x3) fstat(3,{ mode=-r--r--r-- ,inode=9871581,size=105248,blksize=32768 }) = 0 (0x0) mmap(0x0,4096,PROT_READ,MAP_PRIVATE|MAP_PREFAULT_READ,3,0x0) = 34367311872 (0x800739000) mmap(0x0,2248704,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34385031168 (0x80181f000) mmap(0x80181f000,102400,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE|MAP_PREFAULT_READ,3,0x0) = 34385031168 (0x80181f000) mmap(0x801a37000,8192,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_PREFAULT_READ,3,0x18000) = 34387226624 (0x801a37000) mmap(0x801a39000,45056,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_ANON,-1,0x0) = 34387234816 (0x801a39000) munmap(0x800739000,4096) = 0 (0x0) close(3) = 0 (0x0) access("/usr/local/lib/libc.so.7",0) ERR#2 'No such file or directory' access("/lib/libc.so.7",0) = 0 (0x0) open("/lib/libc.so.7",O_CLOEXEC,034607770) = 3 (0x3) fstat(3,{ mode=-r--r--r-- ,inode=9871556,size=1631216,blksize=32768 }) = 0 (0x0) mmap(0x0,4096,PROT_READ,MAP_PRIVATE|MAP_PREFAULT_READ,3,0x0) = 34367311872 (0x800739000) mmap(0x0,3837952,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34387279872 (0x801a44000) mmap(0x801a44000,1523712,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE|MAP_PREFAULT_READ,3,0x0) = 34387279872 (0x801a44000) mmap(0x801db7000,53248,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_PREFAULT_READ,3,0x173000) = 34390896640 (0x801db7000) mmap(0x801dc4000,167936,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_ANON,-1,0x0) = 34390949888 (0x801dc4000) munmap(0x800739000,4096) = 0 (0x0) close(3) = 0 (0x0) munmap(0x800736000,12288) = 0 (0x0) mmap(0x0,53248,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 34367299584 (0x800736000) munmap(0x80073f000,16384) = 0 (0x0) mmap(0x0,102400,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 34367336448 (0x80073f000) sysarch(0x81,0x7fffffffd8c8,0x4,0x0,0xfffffffffe97b5c0,0x8080808080808080) = 0 (0x0) __sysctl(0x7fffffffd8a8,0x2,0x7fffffffd890,0x7fffffffd888,0x0,0x0) = 0 (0x0) getrlimit(RLIMIT_STACK,{ cur=536870912,max=536870912 }) = 0 (0x0) mprotect(0x7fffdffff000,536870912,PROT_READ|PROT_WRITE|PROT_EXEC) = 0 (0x0) sigprocmask(SIG_BLOCK,SIGHUP|SIGINT|SIGQUIT|SIGKILL|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2,0x0) = 0 (0x0) sigprocmask(SIG_SETMASK,0x0,0x0) = 0 (0x0) readlink("/etc/malloc.conf",0x7fffffffcff0,1024) ERR#2 'No such file or directory' issetugid(0x801b8f53e,0x7fffffffcff0,0xffffffffffffffff,0x2,0x40,0x0) = 0 (0x0) mmap(0x0,4194304,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 34391117824 (0x801ded000) munmap(0x801ded000,4194304) = 0 (0x0) mmap(0x0,8384512,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 34391117824 (0x801ded000) munmap(0x801ded000,2174976) = 0 (0x0) munmap(0x802400000,2015232) = 0 (0x0) sigprocmask(SIG_BLOCK,SIGHUP|SIGINT|SIGQUIT|SIGKILL|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2,0x0) = 0 (0x0) sigprocmask(SIG_SETMASK,0x0,0x0) = 0 (0x0) getpid() = 28705 (0x7021) __sysctl(0x7fffffffd400,0x2,0x801a438a0,0x7fffffffd408,0x0,0x0) = 0 (0x0) __sysctl(0x7fffffffd320,0x2,0x7fffffffd360,0x7fffffffd358,0x801833f6d,0xd) = 0 (0x0) __sysctl(0x7fffffffd360,0x3,0x801a4232c,0x7fffffffd408,0x0,0x0) = 0 (0x0) mmap(0x0,4194304,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 34397487104 (0x802400000) thr_self(0x802406400,0x1,0x0,0x800733530,0x40,0x802416010) = 0 (0x0) mmap(0x7fffffbfe000,4096,PROT_NONE,MAP_ANON,-1,0x0) = 140737484152832 (0x7fffffbfe000) rtprio_thread(0x0,0x18b01,0x7fffffffd3d8,0x400000,0xffffffff,0x0) = 0 (0x0) sysarch(0x81,0x7fffffffd3e8,0x801a41f00,0x0,0xffffffff,0x0) = 0 (0x0) sigaction(32,{ 0x80182cae0 SA_SIGINFO ss_t },0x0) = 0 (0x0) sigprocmask(SIG_UNBLOCK,0x0,0x0) = 0 (0x0) _umtx_op(0x7fffffffd398,0x3,0x1,0x0,0x0,0x0) = 0 (0x0) mprotect(0x0,0,PROT_NONE) = 0 (0x0) getpid() = 28705 (0x7021) sigprocmask(SIG_BLOCK,SIGHUP|SIGINT|SIGQUIT|SIGILL|SIGTRAP|SIGABRT|SIGEMT|SIGFPE|SIGKILL|SIGBUS|SIGSEGV|SIGSYS|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2,0x0) = 0 (0x0) sigprocmask(SIG_SETMASK,0x0,0x0) = 0 (0x0) open("/usr/home/gerard/LDAP_Backup/seibercom.net.ldif",O_WRONLY|O_CREAT|O_TRUNC,0666) = 3 (0x3) madvise(0x802446000,0x4000,0x5,0xaaaaaaaaaaaaaaab,0x7fffffffc6d0,0x801debbe0) = 0 (0x0) madvise(0x80244d000,0x2000,0x5,0xaaaaaaaaaaaaaaab,0x7fffffffc6d0,0x801debbe0) = 0 (0x0) madvise(0x802453000,0x2000,0x5,0xaaaaaaaaaaaaaaab,0x7fffffffc6d0,0x801debbe0) = 0 (0x0) madvise(0x80245a000,0x2000,0x5,0xaaaaaaaaaaaaaaab,0x7fffffffc6d0,0x801debbe0) = 0 (0x0) madvise(0x80246a000,0x1000,0x5,0xaaaaaaaaaaaaaaab,0x7fffffffc6d0,0x801debbe0) = 0 (0x0) stat("/usr/local/etc/openldap/slapd.conf",{ mode=-rw------- ,inode=37883465,size=2382,blksize=32768 }) = 0 (0x0) open("/usr/local/etc/openldap/slapd.conf",O_RDONLY,0666) = 4 (0x4) fstat(4,{ mode=-rw------- ,inode=37883465,size=2382,blksize=32768 }) = 0 (0x0) read(4,"#\n# See slapd.conf(5) for detai"...,32768) = 2382 (0x94e) stat("/usr/local/etc/openldap/schema/core.schema",{ mode=-rw-r--r-- ,inode=34109613,size=20499,blksize=32768 }) = 0 (0x0) open("/usr/local/etc/openldap/schema/core.schema",O_RDONLY,0666) = 5 (0x5) fstat(5,{ mode=-rw-r--r-- ,inode=34109613,size=20499,blksize=32768 }) = 0 (0x0) read(5,"# OpenLDAP Core schema\n# $OpenL"...,32768) = 20499 (0x5013) read(5,0x802497000,32768) = 0 (0x0) close(5) = 0 (0x0) stat("/usr/local/etc/openldap/schema/cosine.schema",{ mode=-rw-r--r-- ,inode=34109614,size=73994,blksize=32768 }) = 0 (0x0) open("/usr/local/etc/openldap/schema/cosine.schema",O_RDONLY,0666) = 5 (0x5) fstat(5,{ mode=-rw-r--r-- ,inode=34109614,size=73994,blksize=32768 }) = 0 (0x0) read(5,"# RFC1274: Cosine and Internet X"...,32768) = 32768 (0x8000) read(5,"#\n# This section attempts to f"...,32768) = 32768 (0x8000) read(5,"uteType 7}\n#\n#\n# userClass"...,32768) = 8458 (0x210a) read(5,0x802495000,32768) = 0 (0x0) close(5) = 0 (0x0) stat("/usr/local/etc/openldap/schema/inetorgperson.schema",{ mode=-rw-r--r-- ,inode=34109617,size=6267,blksize=32768 }) = 0 (0x0) open("/usr/local/etc/openldap/schema/inetorgperson.schema",O_RDONLY,0666) = 5 (0x5) fstat(5,{ mode=-rw-r--r-- ,inode=34109617,size=6267,blksize=32768 }) = 0 (0x0) read(5,"# inetorgperson.schema -- InetOr"...,32768) = 6267 (0x187b) read(5,0x802495000,32768) = 0 (0x0) close(5) = 0 (0x0) stat("/usr/local/etc/openldap/schema/nis.schema",{ mode=-rw-r--r-- ,inode=34109620,size=7640,blksize=32768 }) = 0 (0x0) open("/usr/local/etc/openldap/schema/nis.schema",O_RDONLY,0666) = 5 (0x5) fstat(5,{ mode=-rw-r--r-- ,inode=34109620,size=7640,blksize=32768 }) = 0 (0x0) read(5,"# $OpenLDAP$\n## This work is pa"...,32768) = 7640 (0x1dd8) read(5,0x802495000,32768) = 0 (0x0) close(5) = 0 (0x0) open("/usr/local/libexec/openldap/back_mdb.la",O_RDONLY,0666) = 5 (0x5) fstat(5,{ mode=-rwxr-xr-x ,inode=34109609,size=827,blksize=32768 }) = 0 (0x0) read(5,"# back_mdb.la - a libtool librar"...,32768) = 827 (0x33b) read(5,0x802495000,32768) = 0 (0x0) close(5) = 0 (0x0) open("/usr/local/libexec/openldap/back_mdb-2.4.so.2",O_CLOEXEC,056) = 5 (0x5) fstat(5,{ mode=-rwxr-xr-x ,inode=34109608,size=232288,blksize=32768 }) = 0 (0x0) mmap(0x0,4096,PROT_READ,MAP_PRIVATE|MAP_PREFAULT_READ,5,0x0) = 34367438848 (0x800758000) mmap(0x0,2428928,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34401681408 (0x802800000) mmap(0x802800000,225280,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE|MAP_PREFAULT_READ,5,0x0) = 34401681408 (0x802800000) mmap(0x802a37000,8192,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_PREFAULT_READ,5,0x37000) = 34404003840 (0x802a37000) mmap(0x802a39000,98304,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_ANON,-1,0x0) = 34404012032 (0x802a39000) munmap(0x800758000,4096) = 0 (0x0) close(5) = 0 (0x0) open("/var/db/openldap-data/DUMMY",O_WRONLY|O_CREAT|O_TRUNC,0666) = 5 (0x5) close(5) = 0 (0x0) unlink("/var/db/openldap-data/DUMMY") = 0 (0x0) read(4,0x80248d000,32768) = 0 (0x0) close(4) = 0 (0x0) stat("/var/db/openldap-data",{ mode=drwx------ ,inode=22311219,size=512,blksize=32768 }) = 0 (0x0) getpid() = 28705 (0x7021) __sysctl(0x7fffffffdc38,0x2,0x7fffffffdc34,0x7fffffffdc40,0x0,0x0) = 0 (0x0) open("/var/db/openldap-data/data.mdb",O_RDONLY,00) = 4 (0x4) open("/var/db/openldap-data/lock.mdb",O_RDWR|O_CREAT|O_CLOEXEC,0600) = 5 (0x5) fcntl(5,F_SETLK,0x7fffffffd9d0) ERR#35 'Resource temporarily unavailable' fcntl(5,F_SETLKW,0x7fffffffd9d0) = 0 (0x0) lseek(5,0x0,SEEK_END) = 8192 (0x2000) mmap(0x0,8192,PROT_READ|PROT_WRITE,MAP_SHARED,5,0x0) = 34367438848 (0x800758000) open("/tmp/SEMDMDBr?Nu;oi>KeQ",O_RDWR|O_EXLOCK|O_CLOEXEC,027) ERR#2 'No such file or directory' close(4) = 0 (0x0) munmap(0x800758000,8192) = 0 (0x0) close(5) = 0 (0x0) stat("/usr/share/nls/C/libc.cat",0x7fffffffd758) ERR#2 'No such file or directory' stat("/usr/share/nls/libc/C",0x7fffffffd758) ERR#2 'No such file or directory' stat("/usr/local/share/nls/C/libc.cat",0x7fffffffd758) ERR#2 'No such file or directory' stat("/usr/local/share/nls/libc/C",0x7fffffffd758) ERR#2 'No such file or directory' clock_gettime(13,{1416741752.000000000 }) = 0 (0x0) write(2,"5471c378 mdb_db_open: database ""...,123) = 123 (0x7b) clock_gettime(13,{1416741752.000000000 }) = 0 (0x0) write(2,"5471c378 backend_startup_one (ty"...,94) = 94 (0x5e) write(2,"slap_startup failed\n",20) = 20 (0x14) process exit, rval = 1 Now, if I restart slapd, and I did check and it was running, everything will work fine, at least for awhile. I can supply the "truss" output of a successful run if desired. -- Jerry

2 1

Can't contact LDAP server (-1) additional info: error:14077410:SSL routines :SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
by wailok tam 22 Nov '14

22 Nov '14

Hi, can anyone help me with the error given in the title when entering the following command: ldapmodify -x -W -D 'cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp' Enter LDAP Password: ldap_bind: Can't contact LDAP server (-1) additional info: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure Access by the dovecot user is also blocked and all mails stop...Thanks in advace. Below is the slapd conf file: ### configuration for IER ### writeen by T.Tanaka ### edited by WL.Tam include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/samba.schema # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args ####################################################################### # ldbm and/or bdb database definitions ####################################################################### database bdb suffix "dc=ier,dc=hit-u,dc=ac,dc=jp" rootdn "cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" rootpw ier2009 directory /var/lib/ldap overlay syncprov syncprov-checkpoint 50 10 syncprov-sessionlog 100 # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index entryCSN,entryUUID eq idlcachesize 1000 access to attrs=userPassword by self write by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write by dn="cn=dovecot,dc=ier,dc=hit-u,dc=ac,dc=jp" read by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read by anonymous auth by * none access to attrs=SambaLMPassword,SambaNTPassword by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write by dn="cn=dovecot,dc=ier,dc=hit-u,dc=ac,dc=jp" read by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read by self read by anonymous auth by * none access to * by self write by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read by * read

3 2

slapd read_config / interface bind errors
by Jason Swank 20 Nov '14

20 Nov '14

Hi, We updated from 2.4.23 to 2.4.39 and ran into the following issues around specifying listen interfaces for slapd. We run an n-way multi-master configuration. It appears as if a specific interface needs to be specified in order to start slapd, and using a specific interface is prevented by a binding to all interfaces. Is this expected behavior, or a bug? Running slapd as below results in an error: $ /usr/sbin/slapd -d 1 -h "ldap:// ldapi://" -u ldap ... 546cfa04 read_config: no serverID / URL match found. Check slapd -h arguments. 546cfa04 slapd destroy: freeing system resources. 546cfa04 syncinfo_free: rid=001 546cfa04 syncinfo_free: rid=001 546cfa04 slapd stopped. 546cfa04 connections_destroy: nothing to destroy. Specifying the hostname of this ldap server (ldap02) addresses the error, but introduces another- the listener can't be started since it conflicts with the INADDR_ANY interface definition "ldap://": $ /usr/sbin/slapd -d 1 -h "ldap:// ldapi:// ldap://ldap02" -u ldap ... 546cfb52 slapd starting 546cfb53 daemon: listen(ldap://ldap02, 5) failed errno=98 (Address already in use) 546cfb53 slapd shutdown: initiated 546cfb53 ====> bdb_cache_release_all 546cfb53 slapd destroy: freeing system resources. 546cfb53 syncinfo_free: rid=001 546cfb53 syncinfo_free: rid=001 546cfb53 slapd stopped. Removing the binding to INADDR_ANY (ldap://) allows slapd to be started: $ /usr/sbin/slapd -d 1 -h "ldapi:// ldap://ldap02" -u ldap Thanks, Jason

4 5

any help on "ldap_sasl_bind_s failed (53)"
by wailok tam 20 Nov '14

20 Nov '14

Hi, I am new to ldap. I am following the book "Mastering Openldap" to set up replication but I am getting the error given in the title when I start the slave with "splad -d sync" . Replication does not work. ****************************************************************************************************** slapd.conf of the Master: include /etc/openldap/schema/core.schemainclude /etc/openldap/schema/cosine.schemainclude /etc/openldap/schema/inetorgperson.schemainclude /etc/openldap/schema/nis.schemainclude /etc/openldap/schema/samba.schema #modulepath /usr/lib/openldap#moduleload syncprov.la # Allow LDAPv2 client connections. This is NOT the default.allow bind_v2 # Do not enable referrals until AFTER you have a working directory# service AND an understanding of referrals.#referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pidargsfile /var/run/openldap/slapd.args #sasl-realm ier.hit-u.ac.jp#sasl-host localhost#authz-regexp uid=([^,]*),cn=ier.hit-u.ac.jp,cn=DIGEST-MD5,cn=auth cn=$1,dc=ier,dc=hit-u,dc=ac,dc=jp ######################################################################## ldbm and/or bdb database definitions####################################################################### database bdbsuffix "dc=ier,dc=hit-u,dc=ac,dc=jp"rootdn "cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp"#rootpw {MD5}x1Ktlhm0p7RPnl/G01rhTQ==rootpw secret#password-hash {MD5}directory /var/lib/ldap TLSCACertificateFile /usr/share/ssl/certs/nii-odca2.crtTLSCertificateFile /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.crtTLSCertificateKeyFile /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.key overlay syncprovsyncprov-checkpoint 50 10syncprov-sessionlog 100 # Indices to maintain for this databaseindex objectClass eq,presindex ou,cn,mail,surname,givenname eq,pres,subindex uidNumber,gidNumber,loginShell eq,presindex uid,memberUid eq,pres,subindex nisMapName,nisMapEntry eq,pres,subindex entryCSN,entryUUID eq idlcachesize 1000 access to attrs=userPassword by self write by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write by dn="cn=dovecot,dc=ier,dc=hit-u,dc=ac,dc=jp" read by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read by anonymous auth by * none access to attrs=SambaLMPassword,SambaNTPassword by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write by dn="cn=dovecot,dc=ier,dc=hit-u,dc=ac,dc=jp" read by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read by self read by anonymous auth by * none access to * by self write by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read by * read ***************************************************************************************************** sladp.conf of the slave: include /etc/openldap/schema/core.schemainclude /etc/openldap/schema/cosine.schemainclude /etc/openldap/schema/inetorgperson.schemainclude /etc/openldap/schema/nis.schemainclude /etc/openldap/schema/samba.schema # Allow LDAPv2 client connections. This is NOT the default.allow bind_v2 # Do not enable referrals until AFTER you have a working directory# service AND an understanding of referrals.#referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pidargsfile /var/run/openldap/slapd.args ######################################################################## ldbm and/or bdb database definitions####################################################################### database bdbsuffix "dc=ier,dc=hit-u,dc=ac,dc=jp"#rootdn "cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp"rootdn "cn=replicator,dc=ier,dc=hit-u,dc=ac,dc=jp"#rootpw {MD5}x1Ktlhm0p7RPnl/G01rhTQ==rootpw secretofreplicator #password-hash {MD5}directory /var/lib/ldap#TLSCACertificateFile /usr/share/ssl/certs/nii-odca2.crt#TLSCertificateFile /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.crt#TLSCertificateKeyFile /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.key # Replicas of this database#updatedn cn=replicator,dc=ier,dc=hit-u,dc=ac,dc=jp#updateref uri=ldap://192.168.84.22 # Indices to maintain for this databaseindex objectClass eq,presindex ou,cn,mail,surname,givenname eq,pres,subindex uidNumber,gidNumber,loginShell eq,presindex uid,memberUid eq,pres,subindex nisMapName,nisMapEntry eq,pres,subindex entryCSN,entryUUID eq idlcachesize 1000 #access to attrs=userPassword# by dn="cn=replicator,dc=ier,dc=hit-u,dc=ac,dc=jp" write# by self write# by anonymous auth# by * none #access to * # by dn="cn=replicator,dc=ier,dc=hit-u,dc=ac,dc=jp" write# by self write# by * read #loglevel stats sync syncrepl rid=001 provider=ldap://mail.ier.hit-u.ac.jp type=refreshAndPersist interval=00:00:05:00 searchbase="dc=ier,dc=hit-u,dc=ac,dc=jp" binddn="uid=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" bindmethod=simple# bindmethod=sasl saslmech=DIGEST-MD5# authcid=replicator credentials=secretofreplicator updateref ldap://mail.ier.hit-u.ac.jp/ *****************************************************************************************what puzzles me is that: I try on the slave to access the master withldapsearch -x -H ldap://mail.ier.hit-u.ac.jp -W -D 'cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp' '(uid=someone)' and it works. What is wrong? I really need your help.

5 7

debugging OpenLDAP client
by Igor Shmukler 19 Nov '14

19 Nov '14

Hello, I wrote a client to make RFC 2696 (paged results) requests. My client gets results fine, yet size and cookie values are always 0, "" - this should not be the case. I tried with ldapsearch(1) and it does paging fine. Hence, it makes sense to assume that the server is OK and opaque/cookie must not be empty. At the same time, format of my ASN object is fine. I need to understand where exactly, I messed up. In order to debug this, I added a logging LDIF and set debug to -1 any. It shows quite a lot of information, but I did not notice size and cookie values being dumped into syslog(3). Is there a way to have separate values that go into the packets printed out? I see that there is an option for BER 0x10 and parse 0x800 as well as others. Thank you, Igor Shmukler

4 8

make test failure due to libsasl2.so.3 not found
by Guruprasad Kulkarni 19 Nov '14

19 Nov '14

I am using ubuntu 12.04.5 LTS I installed cyrus-sasl-2.1.26 (created symlink from /usr/lib/sasl2 to /usr/local/lib/sasl2) I used the following options for configuration: --enable-debug --enable-hdb --enable-ppolicy --enable-syncprov --with-cyrus-sasl Configuration, make depend and make were successful. I then proceeded to "make test" and I got the error: ../clients/tools/ldapsearch: error while loading shared libraries: libsasl2.so.3: cannot open shared object file: No such file or directory The file libsasl2.so.3 is present in /usr/local/lib I set LDFLAGS="-L/usr/local/lib -L/usr/local/lib/sasl2" Do I need to set some other flags to make the tests work? -Guruprasad

3 3

Re: any help on "ldap_sasl_bind_s failed (53)"
by wailok tam 19 Nov '14

19 Nov '14

thx for your reply. do i put in the slave conf file the same thing as the following command? > ldapsearch -x -H ldap://mail.ier.hit-u.ac.jp -W -D > 'cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp' '(uid=someone)' ------------------------------ On Wed, Nov 19, 2014 9:25 AM GMT Jephte Clain wrote: >hello, > >I would say, try to understand the meaning of what you do. The >openldap admin guide is a good place to start. > >- for instance, on the slave, you bind to the master with dn >uid=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp and password >secretofreplicator >does this objet exist *on the master*? with the right password? does >this account have the right acl to read everything on the master >(i.e., on the master, the acl is defined for cn=replicator,... which >is not the same as uid=replicator,...) >- also, why would you use the replicator dn as the rootdn for the slave? > >one last thing: I advise you change the password of both the master >and slave. posting the file with the hash password of the root dn on >the internet is not a good idea :-) > >good luck > > >2014-11-19 11:38 GMT+04:00 wailok tam <wailoktam(a)yahoo.com>: >> Hi, I am new to ldap. I am following the book "Mastering Openldap" to set up >> replication >> but I am getting the error given in the title when I start the slave with >> "splad -d sync" . Replication does >> not work. >> >> ****************************************************************************************************** >> >> slapd.conf of the Master: >> >> include /etc/openldap/schema/core.schema >> include /etc/openldap/schema/cosine.schema >> include /etc/openldap/schema/inetorgperson.schema >> include /etc/openldap/schema/nis.schema >> include /etc/openldap/schema/samba.schema >> >> >> #modulepath /usr/lib/openldap >> #moduleload syncprov.la >> >> # Allow LDAPv2 client connections. This is NOT the default. >> allow bind_v2 >> >> # Do not enable referrals until AFTER you have a working directory >> # service AND an understanding of referrals. >> #referral ldap://root.openldap.org >> >> pidfile /var/run/openldap/slapd.pid >> argsfile /var/run/openldap/slapd.args >> >> #sasl-realm ier.hit-u.ac.jp >> #sasl-host localhost >> #authz-regexp uid=([^,]*),cn=ier.hit-u.ac.jp,cn=DIGEST-MD5,cn=auth >> cn=$1,dc=ier,dc=hit-u,dc=ac,dc=jp >> >> ####################################################################### >> # ldbm and/or bdb database definitions >> ####################################################################### >> >> database bdb >> suffix "dc=ier,dc=hit-u,dc=ac,dc=jp" >> rootdn "cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" >> #rootpw {MD5}x1Ktlhm0p7RPnl/G01rhTQ== >> rootpw secret >> #password-hash {MD5} >> directory /var/lib/ldap >> >> TLSCACertificateFile /usr/share/ssl/certs/nii-odca2.crt >> TLSCertificateFile /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.crt >> TLSCertificateKeyFile /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.key >> >> overlay syncprov >> syncprov-checkpoint 50 10 >> syncprov-sessionlog 100 >> >> # Indices to maintain for this database >> index objectClass eq,pres >> index ou,cn,mail,surname,givenname eq,pres,sub >> index uidNumber,gidNumber,loginShell eq,pres >> index uid,memberUid eq,pres,sub >> index nisMapName,nisMapEntry eq,pres,sub >> index entryCSN,entryUUID eq >> idlcachesize 1000 >> >> >> access to attrs=userPassword >> by self write >> by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write >> by dn="cn=dovecot,dc=ier,dc=hit-u,dc=ac,dc=jp" read >> by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read >> by anonymous auth >> by * none >> >> >> >> access to attrs=SambaLMPassword,SambaNTPassword >> by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write >> by dn="cn=dovecot,dc=ier,dc=hit-u,dc=ac,dc=jp" read >> by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read >> by self read >> by anonymous auth >> by * none >> >> access to * >> by self write >> by dn="cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" write >> by dn.exact="cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" read >> by * read >> >> ***************************************************************************************************** >> >> sladp.conf of the slave: >> >> include /etc/openldap/schema/core.schema >> include /etc/openldap/schema/cosine.schema >> include /etc/openldap/schema/inetorgperson.schema >> include /etc/openldap/schema/nis.schema >> include /etc/openldap/schema/samba.schema >> >> # Allow LDAPv2 client connections. This is NOT the default. >> allow bind_v2 >> >> # Do not enable referrals until AFTER you have a working directory >> # service AND an understanding of referrals. >> #referral ldap://root.openldap.org >> >> pidfile /var/run/openldap/slapd.pid >> argsfile /var/run/openldap/slapd.args >> >> ####################################################################### >> # ldbm and/or bdb database definitions >> ####################################################################### >> >> database bdb >> suffix "dc=ier,dc=hit-u,dc=ac,dc=jp" >> #rootdn "cn=root,dc=ier,dc=hit-u,dc=ac,dc=jp" >> rootdn "cn=replicator,dc=ier,dc=hit-u,dc=ac,dc=jp" >> #rootpw {MD5}x1Ktlhm0p7RPnl/G01rhTQ== >> rootpw secretofreplicator >> #password-hash {MD5} >> directory /var/lib/ldap >> #TLSCACertificateFile /usr/share/ssl/certs/nii-odca2.crt >> #TLSCertificateFile /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.crt >> #TLSCertificateKeyFile /usr/share/ssl/certs/mail.ier.hit-u.ac.jp.key >> >> >> # Replicas of this database >> #updatedn cn=replicator,dc=ier,dc=hit-u,dc=ac,dc=jp >> #updateref uri=ldap://192.168.84.22 >> >> # Indices to maintain for this database >> index objectClass eq,pres >> index ou,cn,mail,surname,givenname eq,pres,sub >> index uidNumber,gidNumber,loginShell eq,pres >> index uid,memberUid eq,pres,sub >> index nisMapName,nisMapEntry eq,pres,sub >> index entryCSN,entryUUID eq >> idlcachesize 1000 >> >> >> #access to attrs=userPassword >> # by dn="cn=replicator,dc=ier,dc=hit-u,dc=ac,dc=jp" write >> # by self write >> # by anonymous auth >> # by * none >> >> >> #access to * >> # by dn="cn=replicator,dc=ier,dc=hit-u,dc=ac,dc=jp" write >> # by self write >> # by * read >> >> >> >> >> #loglevel stats sync >> >> syncrepl rid=001 >> provider=ldap://mail.ier.hit-u.ac.jp >> type=refreshAndPersist >> interval=00:00:05:00 >> searchbase="dc=ier,dc=hit-u,dc=ac,dc=jp" >> binddn="uid=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp" >> bindmethod=simple >> # bindmethod=sasl saslmech=DIGEST-MD5 >> # authcid=replicator >> credentials=secretofreplicator >> >> updateref ldap://mail.ier.hit-u.ac.jp/ >> >> >> ***************************************************************************************** >> what puzzles me is that: >> >> I try on the slave to access the master with >> ldapsearch -x -H ldap://mail.ier.hit-u.ac.jp -W -D >> 'cn=replicator,ou=Users,dc=ier,dc=hit-u,dc=ac,dc=jp' '(uid=someone)' >> >> and it works. >> >> What is wrong? I really need your help. >> >> > > > >-- >cordialement, >Jephté Clain >Direction des Systèmes d'Information >et des Usages Numériques - 2IG >Tél. 0262 93 86 31 >Fax. 0262 93 81 06 >

2 1

openldap 2.4.40 with cyrus sasl 2.1.26 on ubuntu 12.04lts
by Guruprasad Kulkarni 15 Nov '14

15 Nov '14

Hi, I am using ubuntu 12.04lts I installed cyrus sasl version 2.1.26 using the following steps: ./configure --disable-digest --without-saslauthd make make install I had to use the option without-saslauthd, otherwise it would fail. Now I tried to install openldap 2.4.40 with the following options ./configure --enable-hdb --enable-ppolicy --enable-syncprov --with-cyrus-sasl During make test, I get the error: ../clients/tools/ldapsearch: error while loading shared libraries: libsasl2.so.3: cannot open shared object file: No such file or directory Do I need to use the option --with-saslauthd while installing cyrus sasl to be able to use --with-cyrus-sasl option while installing openldap? -Guruprasad

4 5

ldapsearch and ldappasswd, one can't find user account.
by Grant Schoep 14 Nov '14

14 Nov '14

So I am trying to setup a command line script to simply changing users passwords. I know there are Perl modules and the like, but right now I just want to try to use ldapsearch and ldappasswd. >From my workstation(just a client of the LDAP server). ldapsearch is working fine. When I run ldapsearch -x -H ldaps://blah.blah:#### -W -D uid=mradmin,ou=service-accounts,ou=taco,dc=bell,dc=com -b ou=taco,dc=bell,dc=com "(&(cn=*)(uid=testuser))" This returns info. Looking at those results, it returned what I think I was looking for ... dc: uid=testuser,ou=people,ou=taco,dc=bell,dc=com ... So I then ran. ldappasswd -x -H ldaps://blah.blah:#### -D "uid=mradmin,ou=service-accounts,ou=taco,dc=bell,dc=com" -W "uid=testuser,ou=people,ou=taco,dc=bell,dc=com" And I get the following error Result: No such object (32) Additional info: Error in search for entry "oid=1.3.6.1.4.1.4203.1.11.1,cn=features,cn=config". I very new to dealing with LDAP, so I could be missing something simple from the command line. Thanks for any pointers.

2 1

pwdCheckModule not allowed on openldap 2.4.40 (ubuntu server 12.04)
by Guruprasad Kulkarni 14 Nov '14

14 Nov '14

Hi, I installed openldap 2.4.40 on ubuntu 12.04LTS I enabled ppolicy while configuring the installation. ./configure --enable-hdb --enable-ppolicy --enable-syncprov --with-tls I want to specify a password check module (to check for minimum upper cases, lower cases, digits, etc). I got the module from http://ltb-project.org/wiki/documentation/openldap-ppolicy-check-password I created a password policy very similar to the one given in the documentation: dn: cn=default,ou=policies,dc=example,dc=com cn: default objectClass: pwdPolicy objectClass: person objectClass: top pwdAllowUserChange: TRUE pwdAttribute: userPassword pwdCheckQuality: 1 pwdCheckModule: check_password.so pwdExpireWarning: 600 pwdFailureCountInterval: 30 pwdGraceAuthNLimit: 0 pwdInHistory: 5 3 pwdLockout: TRUE pwdLockoutDuration: 60 0 pwdMaxAge: 1200 pwdMaxFailure: 3 pwdMinAge: 0 pwdMinLength: 8 pwdMustChange: FALSE pwdSafeModify: FALSE sn: dummy value slapd.conf: modulepath /usr/local/lib moduleload check_password.so While adding this password policy to ldap, I get the error: ldap_add: Object class violation (65) attribute info: attribute 'pwdCheckModule' not allowed The log level is 256 and doesn't say much besides giving the same error. Let me know where I have gone wrong. -Guruprasad

2 1

Re: adding VLV support to OpenLDAP 2.4.31
by Igor Shmukler 13 Nov '14

13 Nov '14

Hello, I want to thank everyone who reads this mailing list and especially those who provided advice, which helped me to finally configure my server. You are amazing. Thank you

1 0

Re: adding VLV support to OpenLDAP 2.4.31
by Igor Shmukler 13 Nov '14

13 Nov '14

Hi Chris, vq@vq-HVM-domU:~$ ldapsearch -x -w Vq0106%% -D "cn=admin,dc=nodomain" -b cn=config # extended LDIF # # LDAPv3 # base <cn=config> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 32 No such object # numResponses: 1 vq@vq-HVM-domU:~$ cat /usr/share/slapd/sssvlv.ldif dn: olcOverlay=sssvlv,olcDatabase={1}bdb,cn=config objectClass: olcSssVlvConfig olcOverlay: sssvlv olcSssVlvMax: 10 olcSssVlvMaxKeys: 5 In order to actually get the search working, I use base dc=nodomain It is not my choice. I inherited the server and the configuration. Nor do I know much about OpenLDAP configuration. I am a programmer and my job is [among other things] hacking the client piece. Unfortunately, there is nobody else [better] qualified to configure the server. Hence, I am filling in for an administrator. The "ldapsearch -x -w SECRET -D "cn=admin,dc=nodomain" -b dc=nodomain" version works fine and I do in fact get results. Sincerely, Igor Shmukler On Wed, Nov 12, 2014 at 11:47 AM, Chris Card <ctcard(a)hotmail.com> wrote: > > > >> Hi Chris, >> >> Sorry to bother you again. >> >>>>>>> ldapadd -x -w <password> -D cn=config -f <ldif file> >> >> -D cn=config was giving me an authentication error. I used >> credentials, which work for ldapsearch and got a syntax error. >> >> vq@vq-HVM-domU:~$ ldapadd -x -w SECRET -D "cn=admin, dc=nodomain" -f >> /usr/share/slapd/sssvlv.ldif >> ldap_add: Invalid syntax (21) >> additional info: objectClass: value #0 invalid per syntax >> > Is cn=admin,dc=nodomain the rootdn for the cn=config directory? > > Does > > ldapsearch -x -w SECRET -D "cn=admin,dc=nodomain" -b cn=config > > work? > > What are the contents of sssvlv.ldif? (it's possible I made a typo, it was untested) > > Chris > >

7 17

OpenLDAP Proxy for Active Directory Authentication (slapd.d)
by Šmucr Jan 13 Nov '14

13 Nov '14

Hello. I need to integrate local OpenLDAP and remote Active directory DS wereas the result is expected to work like this: User wants to authenticate --> Client (Gerrit 2.9.1) connects to the local OpenLDAP server --> The OpenLDAP server searches its local database for a relevant entry * Entry found --> Inform the client * Entry not found --> Delegate the request to the remote Active directory server o Entry found --> Inform the OpenLDAP server --> Inform the client o Entry not found --> Inform the OpenLDAP server --> Inform the client I came across this article [1], but my server uses the slapd.d configuration schema and I can't make it work as there's too little helpful documentation to it. I'll be thankful for every help. Jan [1] http://ltb-project.org/wiki/documentation/general/sasl_delegation

3 3

questions on overlay sssvlv
by Nicolas RENAULT 13 Nov '14

13 Nov '14

Hello, I already post some question about this but without succes, perhaps because i made a mistake and replys in another question thread. So I restart here. testing env so i can make all that i want. openldap 2.4.40 build on opensuse 13.1. try to make a proxy ldap, with use of meta to relay informations from one AD , one EDir and one openLDAP. (just use openLDAP for now) I create a database to get locally the root "dc=example,dc=fr" and firstlevel OU : "ou=TOUT,dc=example,dc=fr" , "ou=TEST,dc=example,dc=fr" I bind the openLDAP on "ou=LDAP,ou=TOUT,dc=example,dc=fr" I add users on the local ou "TEST" simple requests are working without problem. (on "TEST" and on "TOUT" ) activate sssvlv on slapd.conf (because of meta) globally (ie before the statement for the meta database) overlay sssvlv just this line. when a try this search ldapsearch -E 'sss=displayName' -H ldap://localhost -x -D "cn=Manager,dc=example,dc=fr" -b "ou=TEST,dc=example,dc=fr" -w xxxx -s sub "(&(objectClass=user)(displayName=ag*))" displayName I got the user list sort by display name ( they are local user) when i try this : ldapsearch -E 'sss=displayName' -H ldap://localhost -x -D "cn=Manager,dc=example,dc=fr" -b "ou=LDAP,ou=TOUT,dc=example,dc=fr" -w xxxx -s sub "(&(objectClass=user)(displayName=ag*))" displayName I got this : # extended LDIF # # LDAPv3 # base <ou=LDAP,ou=TOUT,dc=example,dc=fr> with scope subtree # filter: (&(objectClass=user)(displayName=ag*)) # requesting: displayName # with server side sorting control # # search result search: 2 result: 0 Success control: 1.2.840.113556.1.4.474 false MAMKAQA= sortResult: (0) Success # numResponses: 1 I understand that the request as been successfull but whitout any results ? any idea ? I'm thinking of a problem with : * bad place for "overlay ssvlv" in slapd.conf (actually it take place juste after moduleload section and just before the ACL statements * problem with remap attribute when asking the distant LDAP * overlay sssvlv not working with meta ? but need some clues to find where is the problem. Regards -- Nicolas

2 2

allow to pass on "undefined" filters in meta
by Markus.Storm＠t-systems.com 13 Nov '14

13 Nov '14

Hi I've run into a problem trying to deploy back-meta in front of an Active Directory target. I believe that to resolve it, I need to get a new option implemented. I need to issue a request through a back-meta proxy . That query happens to contain a matching rule which is not implemented in OpenLDAP so slapd does not know to evaluate the query. The target that the query will ultimately be passed on to (an Active Directory) does know to process the query, though. OpenLDAP, however, considers the filter to be "undefined" and thus on relaying the request to the AD target, back-meta replaces a portion of the original query with a "(?=undefined)" filter as documented in e.g. slapd-meta manpage "noundeffilter" option. But I need the original query to be passed on. It's in fact a _valid_ LDAP request, just OpenLDAP happens to be unable to parse it. But at least in my setup, slapd does not have to do _anything_ about the query other than to pass it on, so I find it inacceptable that it replaces the query just because it doesn't understand it. Please, can you add an option switch to the code to allow for passing on original queries *without* replacing undefined portions ? I have not found any other solution to my problem. I tried to make OpenLDAP aware of the undefined portion by adding the matching rule to the schema but I failed. Seems that would need to be planted into the code, and not being a programmer, that's not as easy as it is with expanding the schema by some new attributes. Also, while of course any parser/feature enhancement will always be appreciated, I would think that to implement the matching rule is not the best way of fixing things: I believe there will always be situations where OpenLDAP cannot parse the input while another LDAP server can. For a proof of concept, I hacked servers/slapd/back-meta/map.c (around line 581 as of 2.4.39) and but - again, I'm not a programmer - I feel incapable of turning this into a full-blown patch free of side effects, also I want the modification to become available to anyone. So I'm hoping for you to implement the switch mentioned above, maybe as a third possible setting for the "noundeffilter" option. Thanks a lot in advance, best regards Markus Storm

3 4

[PATCH] Fix OpenLDAP build when using LibreSSL
by Xin Li 12 Nov '14

12 Nov '14

Hi, A FreeBSD user have proposed the patch below to solve OpenLDAP compile issue when using LibreSSL, which I think would be good to share with upstream. The patch can be found at: https://svnweb.freebsd.org/ports/head/net/openldap24-server/files/patch-des… The patch was created by "Spil Oss <spil.oss(a)gmail.com>" so credit should go to the submitter: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=194841 Cheers, --- libraries/liblutil/passwd.c.orig 2014-09-19 03:48:49.000000000 +0200 +++ libraries/liblutil/passwd.c 2014-11-05 19:57:10.807555025 +0100 @@ -38,11 +38,11 @@ # include <openssl/des.h> -typedef des_cblock des_key; -typedef des_cblock des_data_block; -typedef des_key_schedule des_context; -#define des_failed(encrypted) 0 -#define des_finish(key, schedule) +typedef DES_cblock DES_key; +typedef DES_cblock DES_data_block; +typedef DES_key_schedule DES_context; +#define DES_failed(encrypted) 0 +#define DES_finish(key, schedule) #elif defined(HAVE_MOZNSS) /* @@ -53,9 +53,9 @@ */ #define PROTYPES_H 1 # include <nss/pk11pub.h> -typedef PK11SymKey *des_key; -typedef unsigned char des_data_block[8]; -typedef PK11Context *des_context[1]; +typedef PK11SymKey *DES_key; +typedef unsigned char DES_data_block[8]; +typedef PK11Context *DES_context[1]; #define DES_ENCRYPT CKA_ENCRYPT #endif @@ -664,10 +664,10 @@ * abstract away setting the parity. */ static void -des_set_key_and_parity( des_key *key, unsigned char *keyData) +DES_set_key_and_parity( DES_key *key, unsigned char *keyData) { memcpy(key, keyData, 8); - des_set_odd_parity( key ); + DES_set_odd_parity( key ); } @@ -677,7 +677,7 @@ * implement MozNSS wrappers for the openSSL calls */ static void -des_set_key_and_parity( des_key *key, unsigned char *keyData) +DES_set_key_and_parity( DES_key *key, unsigned char *keyData) { SECItem keyDataItem; PK11SlotInfo *slot; @@ -699,7 +699,7 @@ } static void -des_set_key_unchecked( des_key *key, des_context ctxt ) +DES_set_key_unchecked( DES_key *key, DES_context ctxt ) { ctxt[0] = NULL; @@ -712,37 +712,37 @@ } static void -des_ecb_encrypt( des_data_block *plain, des_data_block *encrypted, - des_context ctxt, int op) +DES_ecb_encrypt( DES_data_block *plain, DES_data_block *encrypted, + DES_context ctxt, int op) { SECStatus rv; int size; if (ctxt[0] == NULL) { /* need to fail here... */ - memset(encrypted, 0, sizeof(des_data_block)); + memset(encrypted, 0, sizeof(DES_data_block)); return; } rv = PK11_CipherOp(ctxt[0], (unsigned char *)&encrypted[0], - &size, sizeof(des_data_block), - (unsigned char *)&plain[0], sizeof(des_data_block)); + &size, sizeof(DES_data_block), + (unsigned char *)&plain[0], sizeof(DES_data_block)); if (rv != SECSuccess) { /* signal failure */ - memset(encrypted, 0, sizeof(des_data_block)); + memset(encrypted, 0, sizeof(DES_data_block)); return; } return; } static int -des_failed(des_data_block *encrypted) +DES_failed(DES_data_block *encrypted) { - static const des_data_block zero = { 0 }; + static const DES_data_block zero = { 0 }; return memcmp(encrypted, zero, sizeof(zero)) == 0; } static void -des_finish(des_key *key, des_context ctxt) +DES_finish(DES_key *key, DES_context ctxt) { if (*key) { PK11_FreeSymKey(*key); @@ -817,7 +817,7 @@ static void lmPasswd_to_key( const char *lmPasswd, - des_key *key) + DES_key *key) { const unsigned char *lpw = (const unsigned char *) lmPasswd; unsigned char k[8]; @@ -832,7 +832,7 @@ k[6] = ((lpw[5] & 0x3F) << 2) | (lpw[6] >> 6); k[7] = ((lpw[6] & 0x7F) << 1); - des_set_key_and_parity( key, k ); + DES_set_key_and_parity( key, k ); } static int chk_lanman( @@ -843,10 +843,10 @@ { ber_len_t i; char UcasePassword[15]; - des_key key; - des_context schedule; - des_data_block StdText = "KGS!@#$%"; - des_data_block PasswordHash1, PasswordHash2; + DES_key key; + DES_context schedule; + DES_data_block StdText = "KGS!@#$%"; + DES_data_block PasswordHash1, PasswordHash2; char PasswordHash[33], storedPasswordHash[33]; for( i=0; i<cred->bv_len; i++) { @@ -864,21 +864,21 @@ ldap_pvt_str2upper( UcasePassword ); lmPasswd_to_key( UcasePassword, &key ); - des_set_key_unchecked( &key, schedule ); - des_ecb_encrypt( &StdText, &PasswordHash1, schedule , DES_ENCRYPT ); + DES_set_key_unchecked( &key, &schedule ); + DES_ecb_encrypt( &StdText, &PasswordHash1, &schedule , DES_ENCRYPT ); - if (des_failed(&PasswordHash1)) { + if (DES_failed(&PasswordHash1)) { return LUTIL_PASSWD_ERR; } lmPasswd_to_key( &UcasePassword[7], &key ); - des_set_key_unchecked( &key, schedule ); - des_ecb_encrypt( &StdText, &PasswordHash2, schedule , DES_ENCRYPT ); - if (des_failed(&PasswordHash2)) { + DES_set_key_unchecked( &key, &schedule ); + DES_ecb_encrypt( &StdText, &PasswordHash2, &schedule , DES_ENCRYPT ); + if (DES_failed(&PasswordHash2)) { return LUTIL_PASSWD_ERR; } - des_finish( &key, schedule ); + DES_finish( &key, schedule ); sprintf( PasswordHash, "%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x", PasswordHash1[0],PasswordHash1[1],PasswordHash1[2],PasswordHash1[3], @@ -1139,10 +1139,10 @@ ber_len_t i; char UcasePassword[15]; - des_key key; - des_context schedule; - des_data_block StdText = "KGS!@#$%"; - des_data_block PasswordHash1, PasswordHash2; + DES_key key; + DES_context schedule; + DES_data_block StdText = "KGS!@#$%"; + DES_data_block PasswordHash1, PasswordHash2; char PasswordHash[33]; for( i=0; i<passwd->bv_len; i++) { @@ -1160,12 +1160,12 @@ ldap_pvt_str2upper( UcasePassword ); lmPasswd_to_key( UcasePassword, &key ); - des_set_key_unchecked( &key, schedule ); - des_ecb_encrypt( &StdText, &PasswordHash1, schedule , DES_ENCRYPT ); + DES_set_key_unchecked( &key, &schedule ); + DES_ecb_encrypt( &StdText, &PasswordHash1, &schedule , DES_ENCRYPT ); lmPasswd_to_key( &UcasePassword[7], &key ); - des_set_key_unchecked( &key, schedule ); - des_ecb_encrypt( &StdText, &PasswordHash2, schedule , DES_ENCRYPT ); + DES_set_key_unchecked( &key, &schedule ); + DES_ecb_encrypt( &StdText, &PasswordHash2, &schedule , DES_ENCRYPT ); sprintf( PasswordHash, "%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x", PasswordHash1[0],PasswordHash1[1],PasswordHash1[2],PasswordHash1[3], -- Xin LI <delphij(a)delphij.net> https://www.delphij.net/ FreeBSD - The Power to Serve! Live free or die

2 1

LDAP auth is failing when I disconnect and re-connect AD server
by Adarsha S 12 Nov '14

12 Nov '14

Hi All, I've a setup where I've installed openldap-2.4.25 on debian machine to access windows 2003 AD server. my radius server use the libraire of openldap-2.4.25. Along with this i'm using samba to join the AD domain and bring up winbindd. The senario is this way. After I've started my radius server, winbindd process autherthication works fine. Now I disconnect my AD server for a while.Try to authenticate. It fails. This is a valid senario. But after I re-connect my AD server still the authentication says invalid users. I would like to know how to debug this issue as i'm not able to get logs also. Thanks in Advance, Adarsha

1 0

adding VLV support to OpenLDAP 2.4.31
by Igor Shmukler 12 Nov '14

12 Nov '14

Hello, I apologize if I am posting to the wrong mailing list. I have a simple problem, which I am sure any OpenLDAP administrator can easily solve... I am not an administrator, however. Hence being unable to answer this trivial question presents a real problem. I am stuck. Any assistance would be greatly appreciated. I am trying to add Virtual List View support to an OpenLDAP server on hosted Ubuntu. The distro version is Ubuntu 14.04.1 LTS. The OpenLDAP server is already running. I receive responses to basic commands, but VLV is not working. When I run the version command, I get: vq@vq-HVM-domU:~$ slapd -VV @(#) $OpenLDAP: slapd (Ubuntu) (Mar 17 2014 21:20:08) $ buildd@aatxe:/build/buildd/openldap-2.4.31/debian/build/servers/slapd I added the following lines to the slapd.conf file (located for some reason in a funky place /usr/share/slapd/slapd.conf ) moduleload sssvlv.so overlay sssvlv My path seems to be OK: modulepath /usr/lib/ldap The dynamic library appears to be in the right place as well: vq@vq-HVM-domU:~$ ls -l /usr/lib/ldap/sssvlv.so lrwxrwxrwx 1 root root 19 Mar 17 2014 /usr/lib/ldap/sssvlv.so -> sssvlv-2.4.so.2.8.3 vq@vq-HVM-domU:~$ ls -l /usr/lib/ldap/sssvlv-2.4.so.2.8.3 -rw-r--r-- 1 root root 26872 Mar 17 2014 /usr/lib/ldap/sssvlv-2.4.so.2.8.3 I cut out a piece of dmesg, just in case: [ 0.000000] Linux version 3.13.0-32-generic (buildd@kissel) (gcc version 4.8. 2 (Ubuntu 4.8.2-19ubuntu1) ) #57-Ubuntu SMP Tue Jul 15 03:51:08 UTC 2014 (Ubuntu 3.13.0-32.57-generic 3.13.11.4) I tried to figure out how to see what OpenLDAP modules are loaded, but did not find the appropriate documentation, at least quickly. Sorry again. I am sure the list subscribers where where to look. I unfortunately do not. There is no slapd-config executable on this system. Hence, I am assuming that slapd.conf is being used. Please advise what I am missing and/or doing wrong. Any suggestions are welcome If this is a totally wrong place to ask, please direct me to an appropriate resource. The server fault forums did not produce immediate results. Thank you, Igor Shmukler

5 16

Fwd: interaction of LastBind and Accesslog modules
by David Tello 11 Nov '14

11 Nov '14

i have a problem with the modules lastbind and access log. Without lastbind modulo i can to audit the login of users finding the bind entries in the accesslog database. My problem is that when i active the lastbind module, this bind entries not appear in access log database. Instead appear modify entries that modify the AUTHTIMESTAMP attribute in the users that did the login, and the reqAuthnz of the modify is the rootDN of the directory. I can change the mode to audit the login finding this new entries, but i want to know if this is the normal funcionality or this a problem in the interaction of both. Thanks to all.

3 4

export directory in LDIF format
by Jerry 11 Nov '14

11 Nov '14

I have a strange problem exporting my directory into LDIF format. I am using the "mdb" format with openldap. /usr/local/sbin/slapcat -l MyDomain.net.ldif -b "dc=MyDomain,dc=net" If I run this command after starting "slapd", it works fine. However, I have this configured to run from a CRON job at midnight. It fails with this message: 5460a615 mdb_db_open: database "dc=MyDomain,dc=net" cannot be opened: No such file or directory (2). Restore from backup! 5460a615 backend_startup_one (type=mdb, suffix="dc=MyDomain,dc=net"): bi_db_open failed! (2) slap_startup failed This also occurs from the command line if the database has not been accessed for several hours, usually on a weekend. Restarting "slapd" immediately corrects the problem. I have checked and "slapd" is running when the failure occurs. I tried accessing the database and then using the backup command; however, the failure still continues. That is assuming that it failed to begin with obviously. Is there some sort of a "sleep" mode or something like that, that I am not aware of, or some really hard to debug "bug" somewhere? -- Jerry

4 4

How do I say to LDAP to use my configuration instead of the default one?
by Abel Guzmán Sánchez 11 Nov '14

11 Nov '14

Hi, I am writing because some time ago I have done some things with LDAP. But I am unable to make the new versions work (2.4.x). Basically I create the config file but I am unable to say to LDAP to use it instead of the default one. Is that clear somewhere in the documentation? can anyone help me? I have followed the official documentation and I managed to compile and create the config files (Config manual <http://www.openldap.org/doc/admin24/slapdconf2.html>), after this I have an ldif file like this: root@helpDesk10000:~# cat base.ldif # example config file - global configuration entry dn: cn=config objectClass: olcGlobal cn: config # olcReferral: ldap://root.openldap.org # internal schema dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema # include the core schema include: file:///usr/local/etc/openldap/schema/core.ldif <http:///usr/local/etc/openldap/schema/core.ldif%3C/p%3E%3Cp%3E#> <http:///usr/local/etc/openldap/schema/core.ldif%3C/p%3E%3Cp%3E#> # <http:///usr/local/etc/openldap/schema/core.ldif%3C/p%3E%3Cp%3E#> global database parameters dn: olcDatabase=frontend,cn=config objectClass: olcDatabaseConfig olcDatabase: frontend olcAccess: to * by * read # set a rootpw for the config database so we can bind. # deny access to everyone else. dn: olcDatabase=config,cn=config objectClass: olcDatabaseConfig olcDatabase: config olcRootPW: {SSHA}EQpw7T2x2Num+krwRjq/ZYczmRgaX1Km olcAccess: to * by * none # HDB definition for example.com dn: olcDatabase=bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: hdb olcSuffix: dc=helpdesk,dc=co,dc=bw olcDbDirectory: /var/lib/ldap-database olcRootDN: cn=Manager,dc=helpdesk,dc=co,dc=bw olcRootPW: {SSHA}teY3/6WO7uoGrCmaDu9NKmvgn87WlCCw olcDbIndex: uid pres,eq olcDbIndex: cn,sn pres,eq,approx,sub olcDbIndex: objectClass eq olcAccess: to attrs=userPassword by self write by anonymous auth by dn.base="cn=Admin,dc=helpdesk,dc=co,dc=bw" write by * none olcAccess: to * by self write by dn.base="cn=Admin,dc=helpdesk,dc=co,dc=bw" write by * read root@helpDesk10000:~# Then the LDAP add apparently works: root@helpDesk10000:~# ldapadd -Y EXTERNAL -H ldapi:/// -vn -f base.ldif add objectClass: olcGlobal add cn: config !adding new entry "cn=config" add objectClass: olcSchemaConfig add cn: schema !adding new entry "cn=schema,cn=config" add objectClass: olcSchemaConfig add cn: core add olcAttributeTypes: ( 2.5.4.2 NAME 'knowledgeInformation' DESC 'RFC2256: knowledge information' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{32768} ) ( 2.5.4.4 NAME (...) add olcDbDirectory: /var/lib/ldap-database add olcRootDN: cn=Manager,dc=helpdesk,dc=co,dc=bw add olcRootPW: {SSHA}teY3/6WO7uoGrCmaDu9NKmvgn87WlCCw add olcDbIndex: uid pres,eq cn,sn pres,eq,approx,sub objectClass eq add olcAccess: to attrs=userPassword by self write by anonymous auth by dn.base="cn=Admin,dc=helpdesk,dc=co,dc=bw" write by * none to * by self write by dn.base="cn=Admin,dc=helpdesk,dc=co,dc=bw" write by * read !adding new entry "olcDatabase=bdb,cn=config" root@helpDesk10000:~# after that I start slapcat and it says this: root@helpDesk10000:~# slapcat 545b828d bdb_db_open: warning - no DB_CONFIG file found in directory /usr/local/var/openldap-data: (2). Expect poor performance for suffix "dc=my-domain,dc=com". 545b828d bdb_monitor_db_open: monitoring disabled; configure monitor database to enable root@helpDesk10000:~# *How do I say to LDAP to use my configuration instead of the default one?* Thank you!

2 1

PFS: ITS#7506 in master but not in release
by Christopher Odenbach 10 Nov '14

10 Nov '14

Hi, while I was trying to find out why slapd does not use Perfect Forward Secrecy I found bug #7506 from september 2013. The patch has already been applied to the master branch but still cannot be found in any released version since. Why is this so? I would like to see good encryption in OpenLDAP for Debian. Regards, Christopher -- ====================================================== Dipl.-Ing. Christopher Odenbach Zentrum fuer Informations- und Medientechnologien Universitaet Paderborn Raum N5.311 odenbach(a)uni-paderborn.de Tel.: +49 5251 60 5315 ======================================================

4 6

Ppolicy not working on openldap on ubuntu 12.04 server
by Guruprasad Kulkarni 10 Nov '14

10 Nov '14

Hi, I am using Ubuntu 12.04 LTS server and have installed openldap on it. The commands used were: apt-get install slapd ldap-utils dpkg-reconfigure slapd I selected the default options for the questions asked. I am having a hard time trying to make ppolicy work on it. I loaded the ppolicy.schema by making the following change to /etc/ldap.conf: include /etc/ldap/schema/ppolicy.schema I even tried the command "moduleload ppolicy.la" None have worked. If anyone knows of a way to make it work, please let me know. -Guruprasad

2 1

Backing up openldap
by Jerry 10 Nov '14

10 Nov '14

Before changing over to "mdb" from "bdb", I ran a script that used slapcat to generate an LDIF file every night. Since updating to "mdb", that script fails if "slapd" is running. That is expected behavior from what I have been reading. <http://www.openldap.org/faq/data/cache/288.html> My question is how do I export the directory into an LDIF file if "slapd" is running, or is that not supported? I could easily modify the script to shut down the program, backup the directory in an LDIF format and restart the program; however, that seems overly ambitious. I understand that "replication" is an option, but I don't know if I really want to go that route at this time. -- Jerry

3 2

Re: Replication restores deleted user
by kevin sullivan 10 Nov '14

10 Nov '14

Thank you very much for the advice and the example config! I generally convert my slapd.conf to cn=config, I just find it easier to use the slapd.conf when debugging. But this gives me hope that my problem could be an issue with the conversion of slapd.conf to cn=config or something that I can find in your configuration. Thank you again, and I will let you know what I find! On Fri, Oct 31, 2014 at 3:40 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Friday, October 31, 2014 4:13 PM -0400 kevin sullivan < > kevin4sullivan(a)gmail.com> wrote: > > >> >> >> >> >> Quanah, >> >> Thank you for the suggestion to move to delta-syncrepl MMR. >> Unfortunately, I am having problems setting this up properly. After >> reading through some documentation, I thought it would be simple but when >> I bring up slapd on my two servers, they both start using around 100% CPU >> and in the debug output the two servers are constantly looping through >> all of the objects in my DIT and saying that the objects have not changed: >> >> 5453d6b5 @(#) $OpenLDAP: slapd 2.4.39 (Jun 18 2014 05:19:18) $ >> >> mockbuild@x86-028.build.eng.bos.redhat.com:/builddir/build/BUILD/openldap >> -2.4.39/openldap-2.4.39/build-servers/servers/slapd >> 5453d6b5 hdb_monitor_db_open: monitoring disabled; configure monitor >> database to enable >> 5453d6b5 slapd starting >> ... >> 5453d6b5 syncrepl_message_to_entry: rid=001 DN: dc=example,dc=com, UUID: >> 1cfcd560-f564-1033-9f47-b521eabdb6ad >> 5453d6b5 syncrepl_entry: rid=001 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) >> 5453d6b5 syncrepl_entry: rid=001 inserted UUID >> 1cfcd560-f564-1033-9f47-b521eabdb6ad >> 5453d6b5 dn_callback : entries have identical CSN dc=example,dc=com >> 20141031161001.910968Z#000000#000#000000 >> 5453d6b5 syncrepl_entry: rid=001 be_search (0) >> 5453d6b5 syncrepl_entry: rid=001 dc=example,dc=com >> 5453d6b5 syncrepl_entry: rid=001 entry unchanged, ignored >> (dc=example,dc=com) >> 5453d6b5 syncrepl_message_to_entry: rid=001 DN: >> ou=users,dc=example,dc=com, UUID: 1cfe8cf2-f564-1033-9f48-b521eabdb6ad >> 5453d6b5 syncrepl_entry: rid=001 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) >> 5453d6b5 syncrepl_entry: rid=001 inserted UUID >> 1cfe8cf2-f564-1033-9f48-b521eabdb6ad >> 5453d6b5 dn_callback : entries have identical CSN >> ou=users,dc=example,dc=com 20141031161001.922234Z#000000#000#000000 >> 5453d6b5 syncrepl_entry: rid=001 be_search (0) >> 5453d6b5 syncrepl_entry: rid=001 ou=users,dc=example,dc=com >> 5453d6b5 syncrepl_entry: rid=001 entry unchanged, ignored >> (ou=users,dc=example,dc=com) >> ..... >> 5453d6b5 do_syncrep2: rid=001 LDAP_RES_SEARCH_RESULT >> 5453d6b5 do_syncrep2: rid=001 cookie= >> ... Repeated forever ... >> >> Am I configuring something incorrectly? >> >> To refresh your memory, I am running 2.4.39-8. I have two servers >> (server1 and server2) that I want to setup in delta-syncrepl MMR >> MirrorMode. >> > > Hi Kevin, > > I stopped using the deprecated slapd.conf format years ago, as it's prone > to misuse and incorrect setup. Your supplied config is an example of why > it's a bad idea to use slapd.conf (For example, you have serverID under the > database section, when it's a global option, etc). I'd strongly advise you > to switch to using cn=config so that you can have an actual validated > configuration. It also makes troubleshooting a lot easier to do. > > Aside from that, your log simply shows the server comparing each entry > between the two servers... Sounds like they didn't start out believing they > were in sync and are trying to get there. > > Here's an example of my config, using cn=config (slapcat export) minus the > schema: > > <http://pastebin.com/nv1WNX2y> > > > --Quanah > > > > -- > > Quanah Gibson-Mount > Server Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

3 10

LDAP Admin updating OpenLDAP and something very odd ...
by Kevin Teague 08 Nov '14

08 Nov '14

I am using the "LDAP Admin” tool to update an OpenLDAP server on Windows. This works just fine. However, when I update members of a group in LDAP with LDAP Admin, those changes are not be seen by another application which queries LDAP (Atlassian's Crowd). Clearly this application is caching results from LDAP and there is a bug in that application's caching where updates don't get detected (I can always see changes made with LDAP Admin with other LDAP). If I update LDAP with other clients (python-ldap, phpldapadmin), then that application has no problem seeing the updates. It’s only when modifications are made with LDAP Admin that updates aren’t seen. Yeah, it's a super weird bug … Is there something on an OpenLDAP server which tells clients if an entry has been modified? And it’s possible to somehow bypass that thing which gets updated? I can modify a group with LDAP Admin and run an LDIF and see that the modifyTimestamp field is being properly updated. I'm totally stumped as to how an OpenLDAP entry can be updated in a way that another client (with possibly aggressive or buggy query result caching) is able to somehow ignore that update.

2 1

Replication : consumer to master server
by Yannick Barbeaux 07 Nov '14

07 Nov '14

Hello all, I asked this question a few days ago but I guess I entered into too many details so did not get any answer. So I will try to be as conscise as possible this time: After configuring and running a replication based on the consumer-producer method (syncrepl), can a consumer become the master ldap server (after shutting down the original master/producer) ? I tried by removing the syncprov module on the consumer but without success. Thanks. Yannick

2 1

Openldap Master Slave configuration
by Elmopi, Stefano 07 Nov '14

07 Nov '14

Hi, I have a configuration with a Master and 4 Slave. Provider and Consumer are identical CentOS release 6.5 rpm -qa | grep ldap openldap-clients-2.4.23-34.el6_5.1.x86_64 openldap-2.4.23-34.el6_5.1.x86_64 apr-util-ldap-1.3.9-3.el6_0.1.x86_64 nss-pam-ldapd-0.7.5-18.2.el6_4.x86_64 mod_authz_ldap-0.26-16.el6.x86_64 pam_ldap-185-11.el6.x86_64 openldap-servers-2.4.23-34.el6_5.1.x86_64 and all are configured with olc. All applications that use OpenLDAP for their login are configured to do queries on slave and this creates problems with some options of Ppolicy, Let me explain. I have configured the option that after a user wrong your password 5 times, it is locked. and here lies the problem, because the slave database is read-only and then the block is not reported to the Master and the user does not lock !!! I read that you could do something using the Chain Overlay but I found little documentation and everything I tried did not work. Anyone have any ideas to suggest ?? Thanks Best Regards Ing. Stefano Elmopi Cooperativa Capodarco - Resp. Area ICT Gestione Esercizio Via Ostiense 131/L Corpo B, 00154 Roma cell. 3466147165 tel. 0657060500 email:stefano.elmopi@sociale.it -- "Ai sensi e per gli effetti della legge sulla tutela dei dati personali (D.lgs 196/2003), le informazioni contenute nella presente @mail sono di natura riservata e destinate ad un uso aziendale-lavorativo con esclusione di utilizzi ad uso personale; come tali, pertanto, sono riservate esclusivamente ai destinatari sopra indicati. E' proibito leggere, copiare, usare o diffondere il contenuto della presente @mail senza autorizzazione. Se avete ricevuto questa @mail per errore, siete pregati di rispedire la stessa al mittente. Grazie"

2 1

LMDB performance tip
by Howard Chu 07 Nov '14

07 Nov '14

Just recently measured: when doing a bulk-load of a DB that's larger than RAM, it's faster to turn off WRITEMAP and just use regular writes. When the DB is much larger than RAM, and LMDB is reusing old pages, most likely the next page to be written will not currently be in memory. If you just access the mapped page (writing to it) the OS will have to page it in first. This is an unnecessary I/O operation since you're simply going to overwrite its contents anyway. If you do a regular write() from a buffer instead, the OS just writes it to the target page, no page-in required. Strangely enough, this performance advantage disappears when under an active random read/write workload. I haven't yet worked out why that is. Perhaps the cost of multiple memcpy's comes into play. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 4

Connecting to LDAPS
by Marian Baskharoun 07 Nov '14

07 Nov '14

Hi, I created an iOS app using xcode version 6.0.1. This app should accept the windows login information from the user. I'm using OpenLDap to do the authentication. This is the code I'm using, works fine with Ldap and port 389 How do I make it work with Ldaps and port 636? # define LDAP_SERVER = "ldap://host:389" - (BOOL)checkValidUser:(NSString *)username password:(NSString *)password { LDAP *ld; int rc; int desired_version = LDAP_VERSION3; struct berval cred; size_t len = strlen([username UTF8String]) + 1; char usr [len]; memcpy(usr, [usernameUTF8String], len); size_t len2 = strlen([password UTF8String]) + 1; char passwd [len2]; memcpy(passwd, [password UTF8String], len2); cred.bv_val = (char *) passwd; cred.bv_len = strlen( passwd ); if( ldap_initialize( &ld, LDAP_SERVER ) ) { return NO; } rc = ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &desired_version); if ( rc != LDAP_SUCCESS ) { perror( "ldap_set_option failed" ); exit(EXIT_FAILURE); } else { printf("Set LDAPv3 client version.\n"); } // Simple Authentication rc = ldap_sasl_bind_s( ld, usr, LDAP_SASL_SIMPLE, &cred, NULL, NULL, NULL ); if( rc != LDAP_SUCCESS ) { fprintf(stderr, "ldap_sasl_bind_s: %s\n", ldap_err2string(rc) ); return NO; } else { return YES; } } Thanks, Marian

3 2

Meaning of "ppolicy_bind: Setting warning for password expiry for ... = 0 seconds"?
by Ulrich Windl 06 Nov '14

06 Nov '14

Hi! Can someone explain what this message is actually saying: slapd[3990]: ppolicy_bind: Setting warning for password expiry for uid=testuser,ou=domain,dc=org = 0 seconds Does this mean a user who mistyped his password before logged in successfully now? I saw no change to the LDAP database after this message, so what is changed, and where is it cahnged? Also those "0 seconds" don't match my password policy, which looks like this (still testing): -- objectClass: namedObject objectClass: pwdPolicy cn: PP-Default pwdAttribute: userPassword pwdMinAge: 30 pwdMaxAge: 86400000 pwdInHistory: 3 pwdCheckQuality: 1 pwdMinLength: 8 pwdExpireWarning: 604800 pwdGraceAuthNLimit: 5 pwdLockout: TRUE pwdLockoutDuration: 1800 pwdMaxFailure: 10 pwdFailureCountInterval: 1209600 pwdMustChange: TRUE pwdAllowUserChange: TRUE pwdSafeModify: FALSE -- I'm running SLES11 SP3... Regards, Ulrich

2 3

is there hardware inventory schema?
by Zeus Panchenko 05 Nov '14

05 Nov '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 greetings, please advise, is there schema or what will it be correct to use, for hardware inventory data to be stored in LDAP (except custom schema)? perhaps I'm not the first who asks that ... - -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET) -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlRXWVUACgkQr3jpPg/3oyo4uwCgxUA5AwR6x2r2idQsAYXZSYgM UHYAoK6uQ87UL2K/k6NlW/1Ns6h1a+Hh =GvDb -----END PGP SIGNATURE-----

3 4

Migrating from BDB to LMDB
by Michael 05 Nov '14

05 Nov '14

Good evening - I would like to upgrade my OpenLDAP servers and migrate from BDB to LMDB. What is the recommended path for doing this? Can I simply take a dump with slapcat while using BDB and then run a slapadd on the resulting LDIF after changing the configuration to MDB? -Mike

2 2

Trying to switch from bdb to mdb
by Jerry 04 Nov '14

04 Nov '14

I am running OpenLDAP on a FreeBSD-10 amd 64 machine. It is installed via the FreeBSD ports system and I compile it on my machine. I recently wanted to switch from BDB since versions greater than 6 are not acceptable to OpenLDAP. I wanted to use "mdb", but I just cannot seem to get it configured correctly. I changed the "database bdb" to "database mdb" but when I try to start openLDAP, I get this error: Starting slapd Unrecognized database type (mdb) Warning: failed to start slapd I removed the existing database, so it should be starting up with a clean environment, but the problem continues. This is probably a problem specific to FreeBSD. If any user of FreeBSD has this working, I would love to see how they configured it. Feel free to contact me off list if it is more convenient. Thanks! -- Jerry

7 21

Kernel segfault slapd
by Scot Hollingsworth 04 Nov '14

04 Nov '14

Issue: slapd keeps crashing about twice a day on multiple servers. I updated the kernel and openldap but still see the problem. Anyone point me in the right direction? Log: kernel: slapd[4435]: segfault at 4 ip 00d1984f sp acc3d270 error 4 in slapd[bcc000+215000] System: openldap-2.4.39-8.el6.i686 openldap-clients-2.4.39-8.el6.i686 openldap-servers-2.4.39-8.el6.i686 Kernel: 2.6.32-504.el6.i686 -- Thanks. Scot H -- The mission of the Rankin County School District is to prepare every student with the cognitive and social skills necessary to be productive members of an ever-changing global society. -- This email and any attachments to it may be confidential and are intended solely for the use of the individual to whom it is addressed. If you are not the intended recipient of this email, you must neither take any action based upon its contents, nor copy or show it to anyone. Please contact the sender if you believe you have received this email in error.

4 4

journal of changes
by Zeus Panchenko 04 Nov '14

04 Nov '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 hi, is there way to have something like, I'd call, "journal of changes" where it could be saved all changes (modifications and deletions in particular) for each object what I'm talking about is *whole* history of the actions the object has undergone after creation - -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET) -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlRHeGUACgkQr3jpPg/3oyrwuQCgygBCJzX239kZSvAWUj+eDarN adwAni+d1KSGElOeeHBw10zXb400pSzG =QEn7 -----END PGP SIGNATURE-----

2 2

Windows Server 2012 R2 - TLS 1.2 connection errors
by Jeff Lebo 02 Nov '14

02 Nov '14

Have had a public facing OpenLDAP server setup pointing to Windows Server 2008 on the back end for auth. AD servers are being migrated to Server 2012 R2, and I see this error on the Windows side when OpenLDAP tries to authenticate to them: "An TLS 1.2 connection request was received from a remote client application, but none of the cipher suites supported by the client application are supported by the server. The SSL connection request has failed." "A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 40. The Windows SChannel error state is 1205." I've spent the last few days trying different configs, and reading Microsoft forums, and haven't been able to figure it out. Apparently MS changed the TLS configs with 2012R2 and it doesn't support a key length I am using. I've tried to disable TLS 1.2 on the OpenLDAP side using TLSCiperSuite in slapd.conf, but OpenLDAP fails to start with "main: TLS init def ctx failed: -1".

2 3

Re: Need information on alock file in data directory of OpenLDAP 2.4.39
by pramod kulkarni 01 Nov '14

01 Nov '14

I am runing slapcat command like this, slapcat -f slapd.conf -l backup.ldif is it wrong ? On Thu, Oct 30, 2014 at 10:20 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, October 30, 2014 11:16 PM +0100 pramod kulkarni < > pammu.kulkarni(a)gmail.com> wrote: > > > 5452a973 The first database does not allow slapcat; using the first >> available on e (2) >> > > You're running slapcat incorrectly if you get this message. > > In any case, as already noted, the correct solution is to move to using > back-mdb, and stop using the deprecated BDB based backend. > > > --Quanah > > > > -- > > Quanah Gibson-Mount > Server Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

6 8

Re: Kernel segfault slapd
by Dominik George 31 Oct '14

31 Oct '14

Hi Scott, > Thanks for responding Nik. I have rsyslog 5.8.10-9 running but I do see > the following.... > > rsyslogd-2177: imuxsock lost 426 messages from pid 17944 due to > rate-limiting > > > This is repeated multiple times. I guess that 17944 is the PID of your running slapd. In this case, you are having the same issue as I once had - slapd will segfault sometimes when syslog drops its messages. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=689025 Updatign to Debian wheeze fixes the issue. -nik

3 3

Re: Replication restores deleted user
by Quanah Gibson-Mount 31 Oct '14

31 Oct '14

--On Friday, October 31, 2014 4:13 PM -0400 kevin sullivan <kevin4sullivan(a)gmail.com> wrote: > > > > > > Quanah, > > Thank you for the suggestion to move to delta-syncrepl MMR. > Unfortunately, I am having problems setting this up properly. After > reading through some documentation, I thought it would be simple but when > I bring up slapd on my two servers, they both start using around 100% CPU > and in the debug output the two servers are constantly looping through > all of the objects in my DIT and saying that the objects have not changed: > > 5453d6b5 @(#) $OpenLDAP: slapd 2.4.39 (Jun 18 2014 05:19:18) $ > > mockbuild@x86-028.build.eng.bos.redhat.com:/builddir/build/BUILD/openldap > -2.4.39/openldap-2.4.39/build-servers/servers/slapd > 5453d6b5 hdb_monitor_db_open: monitoring disabled; configure monitor > database to enable > 5453d6b5 slapd starting > ... > 5453d6b5 syncrepl_message_to_entry: rid=001 DN: dc=example,dc=com, UUID: > 1cfcd560-f564-1033-9f47-b521eabdb6ad > 5453d6b5 syncrepl_entry: rid=001 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) > 5453d6b5 syncrepl_entry: rid=001 inserted UUID > 1cfcd560-f564-1033-9f47-b521eabdb6ad > 5453d6b5 dn_callback : entries have identical CSN dc=example,dc=com > 20141031161001.910968Z#000000#000#000000 > 5453d6b5 syncrepl_entry: rid=001 be_search (0) > 5453d6b5 syncrepl_entry: rid=001 dc=example,dc=com > 5453d6b5 syncrepl_entry: rid=001 entry unchanged, ignored > (dc=example,dc=com) > 5453d6b5 syncrepl_message_to_entry: rid=001 DN: > ou=users,dc=example,dc=com, UUID: 1cfe8cf2-f564-1033-9f48-b521eabdb6ad > 5453d6b5 syncrepl_entry: rid=001 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) > 5453d6b5 syncrepl_entry: rid=001 inserted UUID > 1cfe8cf2-f564-1033-9f48-b521eabdb6ad > 5453d6b5 dn_callback : entries have identical CSN > ou=users,dc=example,dc=com 20141031161001.922234Z#000000#000#000000 > 5453d6b5 syncrepl_entry: rid=001 be_search (0) > 5453d6b5 syncrepl_entry: rid=001 ou=users,dc=example,dc=com > 5453d6b5 syncrepl_entry: rid=001 entry unchanged, ignored > (ou=users,dc=example,dc=com) > ..... > 5453d6b5 do_syncrep2: rid=001 LDAP_RES_SEARCH_RESULT > 5453d6b5 do_syncrep2: rid=001 cookie= > ... Repeated forever ... > > Am I configuring something incorrectly? > > To refresh your memory, I am running 2.4.39-8. I have two servers > (server1 and server2) that I want to setup in delta-syncrepl MMR > MirrorMode. Hi Kevin, I stopped using the deprecated slapd.conf format years ago, as it's prone to misuse and incorrect setup. Your supplied config is an example of why it's a bad idea to use slapd.conf (For example, you have serverID under the database section, when it's a global option, etc). I'd strongly advise you to switch to using cn=config so that you can have an actual validated configuration. It also makes troubleshooting a lot easier to do. Aside from that, your log simply shows the server comparing each entry between the two servers... Sounds like they didn't start out believing they were in sync and are trying to get there. Here's an example of my config, using cn=config (slapcat export) minus the schema: <http://pastebin.com/nv1WNX2y> --Quanah -- Quanah Gibson-Mount Server Architect Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: Replication restores deleted user
by kevin sullivan 31 Oct '14

31 Oct '14

Quanah, Thank you for the suggestion to move to delta-syncrepl MMR. Unfortunately, I am having problems setting this up properly. After reading through some documentation, I thought it would be simple but when I bring up slapd on my two servers, they both start using around 100% CPU and in the debug output the two servers are constantly looping through all of the objects in my DIT and saying that the objects have not changed: 5453d6b5 @(#) $OpenLDAP: slapd 2.4.39 (Jun 18 2014 05:19:18) $ mockbuild(a)x86-028.build.eng.bos.redhat.com: /builddir/build/BUILD/openldap-2.4.39/openldap-2.4.39/build-servers/servers/slapd 5453d6b5 hdb_monitor_db_open: monitoring disabled; configure monitor database to enable 5453d6b5 slapd starting ... 5453d6b5 syncrepl_message_to_entry: rid=001 DN: dc=example,dc=com, UUID: 1cfcd560-f564-1033-9f47-b521eabdb6ad 5453d6b5 syncrepl_entry: rid=001 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) 5453d6b5 syncrepl_entry: rid=001 inserted UUID 1cfcd560-f564-1033-9f47-b521eabdb6ad 5453d6b5 dn_callback : entries have identical CSN dc=example,dc=com 20141031161001.910968Z#000000#000#000000 5453d6b5 syncrepl_entry: rid=001 be_search (0) 5453d6b5 syncrepl_entry: rid=001 dc=example,dc=com 5453d6b5 syncrepl_entry: rid=001 entry unchanged, ignored (dc=example,dc=com) 5453d6b5 syncrepl_message_to_entry: rid=001 DN: ou=users,dc=example,dc=com, UUID: 1cfe8cf2-f564-1033-9f48-b521eabdb6ad 5453d6b5 syncrepl_entry: rid=001 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) 5453d6b5 syncrepl_entry: rid=001 inserted UUID 1cfe8cf2-f564-1033-9f48-b521eabdb6ad 5453d6b5 dn_callback : entries have identical CSN ou=users,dc=example,dc=com 20141031161001.922234Z#000000#000#000000 5453d6b5 syncrepl_entry: rid=001 be_search (0) 5453d6b5 syncrepl_entry: rid=001 ou=users,dc=example,dc=com 5453d6b5 syncrepl_entry: rid=001 entry unchanged, ignored (ou=users,dc=example,dc=com) ..... 5453d6b5 do_syncrep2: rid=001 LDAP_RES_SEARCH_RESULT 5453d6b5 do_syncrep2: rid=001 cookie= ... Repeated forever ... Am I configuring something incorrectly? To refresh your memory, I am running 2.4.39-8. I have two servers (server1 and server2) that I want to setup in delta-syncrepl MMR MirrorMode. slapd.conf for server1: ---------------------------------------------- modulepath /usr/lib64/openldap moduleload accesslog.la moduleload memberof.la moduleload ppolicy.la moduleload refint.la moduleload syncprov.la access to * by dn.exact="cn=syncuser,dc=example,dc=com" read by * break access to dn.base="" by * read access to dn.base="cn=subschema" by * read access to attrs=userPassword,pwdHistory by self write by anonymous auth by * none access to dn.subtree="dc=example,dc=com" by self write by users read by anonymous read database config access to * by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * none access to * by * none database hdb suffix "cn=accesslog" directory /var/lib/ldap/accesslog rootdn "cn=accesslog" index default eq index entryCSN,objectClass,reqEnd,reqResult,reqStart overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE limits dn.exact="cn=syncuser,dc=example,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited database hdb suffix "dc=example,dc=com" directory /var/lib/ldap rootdn "cn=admin,dc=example,dc=com" index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index entryCSN eq index entryUUID eq limits dn.exact="cn=syncuser,dc=example,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited overlay syncprov syncprov-checkpoint 1000 60 serverID 1 syncrepl rid=001 provider=ldap://server2/ type=refreshAndPersist retry="10 +" searchbase="dc=example,dc=com" bindmethod=simple binddn="cn=syncuser,dc=example,dc=com" credentials=secret syncdata=accesslog mirrormode on overlay accesslog logdb cn=accesslog logops writes logsuccess TRUE logpurge 07+00:00 01+00:00 --------------------------------------- slapd.conf for server2: ------------------------------------------- modulepath /usr/lib64/openldap moduleload accesslog.la moduleload memberof.la moduleload ppolicy.la moduleload refint.la moduleload syncprov.la access to * by dn.exact="cn=syncuser,dc=example,dc=com" read by * break access to dn.base="" by * read access to dn.base="cn=subschema" by * read access to attrs=userPassword,pwdHistory by self write by anonymous auth by * none access to dn.subtree="dc=example,dc=com" by self write by users read by anonymous read database config access to * by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * none access to * by * none database hdb suffix "cn=accesslog" directory /var/lib/ldap/accesslog rootdn "cn=accesslog" index default eq index entryCSN,objectClass,reqEnd,reqResult,reqStart overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE limits dn.exact="cn=syncuser,dc=example,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited database hdb suffix "dc=example,dc=com" directory /var/lib/ldap rootdn "cn=admin,dc=example,dc=com" index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index entryCSN eq index entryUUID eq limits dn.exact="cn=syncuser,dc=example,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited overlay syncprov syncprov-checkpoint 1000 60 serverID 2 syncrepl rid=001 provider=ldap://server1/ type=refreshAndPersist retry="10 +" searchbase="dc=example,dc=com" bindmethod=simple binddn="cn=syncuser,dc=example,dc=com" credentials=secret syncdata=accesslog mirrormode on overlay accesslog logdb cn=accesslog logops writes logsuccess TRUE logpurge 07+00:00 01+00:00 ------------------------------------------- Are there any obvious errors that I am making? Thanks, Kevin On Thu, Oct 30, 2014 at 4:24 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, October 30, 2014 4:55 PM -0400 kevin sullivan < > kevin4sullivan(a)gmail.com> wrote: > > I am also looking for any resources that explain exactly how replication >> works and how conflicts are resolved in a multi-master configuration. For >> example, I know there are two phases of replication: the present phase >> and the delete phase. Could server1 be replicating the data for >> 'deletedUser' to server2 in the present phase before server2 has >> communicated to server1 that 'deletedUser' no longer exists in the delete >> phase? I don't believe this problem happens when I just delete >> 'deletedUser' (instead of deleting AND modifying). I know I am butchering >> the technical details a little bit, which is why I am curious how this >> situation is expected to be resolved. >> > > Personaly I use delta-syncrepl MMR to avoid the general issues with > syncrepl. I've found it to be much more reliable. > > > --Quanah > > > > -- > > Quanah Gibson-Mount > Server Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

LDAP Crafted Search Request Access Allowed
by Net Warrior 31 Oct '14

31 Oct '14

Hi there guys. Recently we had an internal audit and it seems that our opelndap server is not configured properly, it seems that null bind are allowed and Crafted request as well are permited and it would be nice if anyone of you could lend me a hand to fix this: There are the access list: olcAccess: {0}to attrs=userPassword by dn="cn=Manager,dc=domain,dc=com" wr ite by anonymous auth by self write by * none olcAccess: {1}to attrs=cn,sn,memberUid,uidNumber,pwdHistory,pwdPolicySubentry, gidNumber,homeDirectory,givenName,description,loginShell by self write by ano nymous read by * none olcAccess: {2}to dn.base="" by * read olcAccess: {3}to * by dn="cn=Manager,dc=domain,dc=com" write by * read And from a client I got the following: ldapsearch -x -s base -b '' -H ldap://ldapserver "(objectClass=*)" "*" + # extended LDIF # # LDAPv3 # base <> with scope baseObject # filter: (objectClass=*) # requesting: * + # dn: objectClass: top objectClass: OpenLDAProotDSE structuralObjectClass: OpenLDAProotDSE configContext: cn=config monitorContext: cn=Monitor namingContexts: dc=domain,dc=com supportedControl: 2.16.840.1.113730.3.4.18 supportedControl: 2.16.840.1.113730.3.4.2 supportedControl: 1.3.6.1.4.1.4203.1.10.1 supportedControl: 1.2.840.113556.1.4.319 supportedControl: 1.2.826.0.1.3344810.2.3 supportedControl: 1.3.6.1.1.13.2 supportedControl: 1.3.6.1.1.13.1 supportedControl: 1.3.6.1.1.12 supportedExtension: 1.3.6.1.4.1.1466.20037 supportedExtension: 1.3.6.1.4.1.4203.1.11.1 supportedExtension: 1.3.6.1.4.1.4203.1.11.3 supportedExtension: 1.3.6.1.1.8 supportedFeatures: 1.3.6.1.1.14 supportedFeatures: 1.3.6.1.4.1.4203.1.5.1 supportedFeatures: 1.3.6.1.4.1.4203.1.5.2 supportedFeatures: 1.3.6.1.4.1.4203.1.5.3 supportedFeatures: 1.3.6.1.4.1.4203.1.5.4 supportedFeatures: 1.3.6.1.4.1.4203.1.5.5 supportedLDAPVersion: 3 entryDN: subschemaSubentry: cn=Subschema It seems it's no good at all, any help appreciated Best regards

4 18

#Overview in openldap2/guide/admin/guide.html
by Ulrich Windl 31 Oct '14

31 Oct '14

Hi! Can someone check whether there are still multiple "#Overview" HREFs in guide.html? In 2.4.26 the hyperlink (just one example) for "11.9.1. Overview" (Relay) jumps to "11.1.1. Overview" (BDB)... # grep '#Overview' /usr/share/doc/packages/openldap2/guide/admin/guide.html <A HREF="#Overview">11.1.1. Overview</A> <A HREF="#Overview">11.2.1. Overview</A> <A HREF="#Overview">11.3.1. Overview</A> <A HREF="#Overview">11.4.1. Overview</A> <A HREF="#Overview">11.5.1. Overview</A> <A HREF="#Overview">11.6.1. Overview</A> <A HREF="#Overview">11.7.1. Overview</A> <A HREF="#Overview">11.8.1. Overview</A> <A HREF="#Overview">11.9.1. Overview</A> <A HREF="#Overview">11.10.1. Overview</A> <A HREF="#Overview">12.1.1. Overview</A> <A HREF="#Overview">12.2.1. Overview</A> <A HREF="#Overview">12.3.1. Overview</A> <A HREF="#Overview">12.4.1. Overview</A> <A HREF="#Overview">12.5.1. Overview</A> <A HREF="#Overview">12.6.1. Overview</A> <A HREF="#Overview">12.7.1. Overview</A> <A HREF="#Overview">12.8.1. Overview</A> <A HREF="#Overview">12.9.1. Overview</A> <A HREF="#Overview">12.10.1. Overview</A> <A HREF="#Overview">12.11.1. Overview</A> <A HREF="#Overview">12.12.1. Overview</A> <A HREF="#Overview">12.13.1. Overview</A> <A HREF="#Overview">12.14.1. Overview</A> <A HREF="#Overview">12.15.1. Overview</A> <A HREF="#Overview">12.16.1. Overview</A> <A HREF="#Overview">12.17.1. Overview</A> <A HREF="#Overview">12.18.1. Overview</A> Regards, Ulrich

2 1

Re: Need information on alock file in data directory of OpenLDAP 2.4.39
by pramod kulkarni 30 Oct '14

30 Oct '14

Thanks for the information. I tried few more tests,slapcat doesn't always hang and it hangs every second restart of slapd. I don't know really whether it is sharing of locks issue or something else. Currently lock detect is set to DB_LOCK_DEFAULT even if I increase the lock detect to Maximum locks no change in the state of slapcat. If I upgrade BDB will this solve the issue of slapcat hanging ? , Have your faced such situation of hanging in slapcat I get this below message when I run the slapcat and it never goes forward 5452a973 The first database does not allow slapcat; using the first available on e (2) Regards, Pramod On Thu, Oct 30, 2014 at 7:41 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, October 30, 2014 6:04 PM +0100 pramod kulkarni < > pammu.kulkarni(a)gmail.com> wrote: > > >> >> Thanks for the response. >> What if I disable the alock file generation in the back-bdb >> initialization? will it affect other functionalities like replication etc. >> > > You should understand what the alock file is for before you think about > deleting it. It tracks the state of your database. If your slapcat is > hanging, it sounds like you have DB corruption at the BDB level. > > --Quanah > > > -- > > Quanah Gibson-Mount > Server Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

Re: Replication restores deleted user
by kevin sullivan 30 Oct '14

30 Oct '14

Sorry about the confusion, I specified MirrorMode since that is a specific type of Multi-Master Replication and I wanted to be exact. To answer Michael's questions: 1. Check whether cn=syncuser,dc=example,dc=com can really read *everything* and no ACLs are preventing access to relevant CSN attributes etc. My replication user can read everything. In fact, these deletes work when both instances of slapd are online when the delete happens. My problem only occurs when one of the instances of slapd is offline when the delete occurs. 2. Try to reproduce your issue with 2.4.40. I will try this out and let you know what happens. I am also looking for any resources that explain exactly how replication works and how conflicts are resolved in a multi-master configuration. For example, I know there are two phases of replication: the present phase and the delete phase. Could server1 be replicating the data for 'deletedUser' to server2 in the present phase before server2 has communicated to server1 that 'deletedUser' no longer exists in the delete phase? I don't believe this problem happens when I just delete 'deletedUser' (instead of deleting AND modifying). I know I am butchering the technical details a little bit, which is why I am curious how this situation is expected to be resolved. Thanks, Kevin On Thu, Oct 30, 2014 at 2:42 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, October 30, 2014 7:33 PM +0100 Michael Ströder < > michael(a)stroeder.com> wrote: > > kevin sullivan wrote: >> >>> I have two servers (server1 and server2) running openldap 2.4.39-8 and >>> they are configured to replicate via MirrorMode replication. >>> >> >> Really mirror mode? Not MMR? You're config looks like MMR. >> > > Mirror mode is a way of configuring MMR. It is *not* something "separate" > from MMR. Mirror mode will *always* be MMR. > > --Quanah > > -- > > Quanah Gibson-Mount > Server Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

Replication restores deleted user
by kevin sullivan 30 Oct '14

30 Oct '14

I have two servers (server1 and server2) running openldap 2.4.39-8 and they are configured to replicate via MirrorMode replication. Here is what I am seeing in order: 1) On server1, I create a two users: deleteUser and modifyUser. 2) I can see that these users are then properly synced to server2. 3) On server1, slapd is stopped. 4) On server2, I now delete 'deleteUser' and I modify 'modifyUser'. 5) On server1, slapd is started. 6) The two slapd instances replicate. Outcome: Both servers now have the deleted user 'deleteUser' in their databases like the user was never deleted. However, the user 'modifyUser' was properly updated in both places. Expected outcome: I would expect that 'deleteUser' wouldn't exist in either database. I would expect that 'modifyUser' would be properly modified on both servers. Why would this happen? Do I need to configure something specifically so deletes are handled properly? Is this just a quirk with how replication works? Below are the relevant parts of each server's slapd.conf. server1's configuration: serverID 1 ... overlay syncprov syncrepl rid=001 provider=ldap://server2/ type=refreshAndPersist retry="10 +" searchbase="dc=example,dc=com" bindmethod=simple binddn="cn=syncuser,dc=example,dc=com credentials=secret mirrormode on ... server2's configuration: serverID 2 ... overlay syncprov syncrepl rid=001 provider=ldap://server1/ type=refreshAndPersist retry="10 +" searchbase="dc=example,dc=com" bindmethod=simple binddn="cn=syncuser,dc=example,dc=com credentials=secret mirrormode on ... Thanks, Kevin

3 2

Need information on alock file in data directory of OpenLDAP 2.4.39
by pramod kulkarni 30 Oct '14

30 Oct '14

Hi, I have taken the OpenLDAP 2.4.39 and able to work properly but when I do slapcat then it hangs and always complains on alock. But if I delete alock it works fine. I have 4.6.21 version of bdb I don't know much about alock file in bdb . Can you please suggest is it ok to delete alock file for running slapd and slapcat ? Thanks, Pramod

3 3

2.4.41?
by Michael Ströder 30 Oct '14

30 Oct '14

HI! It seems to me some import fixes were committed to git-master after cutting 2.4.40. Will there be a 2.4.41 release? Ciao, Michael.

2 1

Overlays in Consumer and provider configuration
by Uli Tehrani 30 Oct '14

30 Oct '14

Hello all, I have some questions regarding overlay configuration for consumer and provider server. It is necessary to load the same overlay modules in a consumer configuration? Is it also necessary to configure the overlay like in the provider configuration ? There are overlays that are needed only for the provider, e.g. syncprov. Others are only needed for the consumer like the chaining overlay. But for other overlays it is not that clear: Dynlist needs to be configured for both servers. But what's about dds, ppolicy and refinit? Here maybe a provider configuration is enough. Is there a simple best practise ? Thanks in advance. Regards Uli -- =================================== Ulrich Tehrani Am Ulrichshof 19 79189 Bad Krozingen +497633806246 u_tehrani(a)yahoo.de ===================================

2 2

syncrepl: turn consumer into a stand-alone ldap server
by Yannick Barbeaux 29 Oct '14

29 Oct '14

Hi everyone, I have configured an ldap replication based on the producer-consumer mechanism using the syncrepl module. It worked fine but at first, the ldap tree was only partially imported on the consumer because the autofs.schema was missing. It took me a few hours (days?) to find out that I had to import the autofs.ldif manually on the consumer to make it work properly: ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/autofs.ldif (that might not be the recommended way to achieve the sync but that worked). Now that I have my producer and consumer perfectly in sync, I would like to get rid of the producer server and turn my consumer into the master ldap server (that might be used later as a producer). I wonder if it is possible... I almost achieved "un-configuring" the consumer mechanism but the "ex-consumer" has now an odd behaviour : it allows me to modify the ldap tree with ldapmodify (normally impossible on consumer) but the tree is effectively modified on the ex-producer and not on the consumer itself. Yet when I perform an ldapsearch, it searches in the consumer tree, not on the producer side. To initially configure the consumer, I had injected the following ldif file: ### consumer.ldif ### #Load the syncprov module. dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: syncprov #syncrepl specific indices dn: olcDatabase={1}bdb,cn=config changetype: modify add: olcDbIndex olcDbIndex: entryUUID eq - add: olcSyncRepl olcSyncRepl: rid=001 provider=ldap://10.50.1.11 bindmethod=simple binddn="cn=synchronisator,dc=office,dc=myorg,dc=be" credentials=mysecret searchbase="dc=office,dc=myorg,dc=be" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" schemachecking=on type=refreshAndPersist retry="60 +" syncdata=accesslog - add: olcUpdateRef olcUpdateRef: ldap://10.50.1.11 So I thought that after sync, disabling the consumer property would be as simple as unloading the syncprov module and removing the olcSyncRepl directive... this way: ### removeSyncprovModule.ldif ### dn: cn=module{0},cn=config changetype: modify delete: olcModuleLoad olcModuleLoad: {1}syncprov ### disableConsumer.ldif ### dn: olcDatabase={1}bdb,cn=config changetype: modify delete: olcSyncrepl - delete: olcUpdateRef But the ldapmodify returned an error when trying to inject that ldif file. Such operations are not allowed on the consumer. So I had no other choice than to edit the ldif manually (though it is not recommended!) to delete the corresponding directives and restart the ldap server ( /etc/ldap/slapd.d/cn=config/cn=module{0}.ldif ) Of course the server complained about wrong checksums. So I applied the method suggested on this page to fix it: http://serverfault.com/questions/499856/is-there-any-bad-thing-happens-if-i… (basically removing and re-adding the schemas+data using *slapcat* and *slapadd)* Since that, the consumer is not sync-ed with the producer anymore (good) but as I mentionned above, any attempt to modify the tree on the ex-consumer sides results in a modification on the ex-producer side and not on the consumer. Is there any easier and working way to turn a consumer into a stand-alone master ldap server? Thank you. Yannick

1 0

Access right for slapd plugins
by Ulrich Windl 29 Oct '14

29 Oct '14

Hi! I have a question: I slapd bound to access rights itself, i.e. do you have to assign some rights for e.g. the password policies for slapd to read those? What are the minimum (i.e. recommended) acess right for the password policy and the pwdPolicySubentry? Regards, Ulrich

1 0

Send Email to users on account creation
by santosh pai 27 Oct '14

27 Oct '14

Hello team, I have setup Openldap and managing the same through Ldap Account manager( https://www.ldap-account-manager.org/lamcms/) . I 'm able to create the accounts through ldif file and as well as through the ldap account manager .Is it possible to send email to user once the account is created on ldap .I have googled but I'm able to get results which tells on integrating openldap with smtp server . -- Cheers, Santhosh Pai Mob# : +91 9886545674 Email to:Santoshsco@gmail.com

3 2

Duda
by Jorge Alberto Aquino Andrade 27 Oct '14

27 Oct '14

Quiero configurar lo siguiente ou=administracion ou=cobros ou=facturacion y quiero tener varios usuarios usuario1=juan.perez usuario2=perico.delospalotes usuario3=juan.lopez usuario4=juan.flores quisera asignar los usuarios a las ou ou=administracion usuario1 usuario2 ou=cobros usuario3 usuario4 ou=facturacion usuario1 usuario2 Quisiera restringir que el usuario1 solo pueda ingresar a la ou=administracion y a ou=facturacion y que NOPUEDA ingresar a la ou=cobros Como puedo hacer esto?

1 1

Advice sought regarding logging changes made to OpenLDAP server
by Philip Colmer 27 Oct '14

27 Oct '14

I've been asked to log & track changes made to our LDAP system. My initial thought was to use the auditlog overlay as it outputs to a text file, thus making it relatively straightforward to parse, but a 2009 discussion (http://www.openldap.org/lists/openldap-technical/200911/msg00092.html) suggested a potential problem, namely no logging of time and name for deletes. Replies to that discussion suggested the use of accesslog instead. However, that logs to a database which isn't really what I'm after. A 2011 discussion (http://www.openldap.org/lists/openldap-technical/201104/msg00084.html) sought answers similar to the one I'm looking for now, namely is there a way of getting changes logged into a text file? One of the replies (from Quanah) suggested ldap-stats.pl but I'm not looking for stats - I'm looking for the actual changes being made. Since both of those discussions are quite old, I was wondering if there was any up-to-date advice regarding best practice for the sort of information I'm trying to capture? Thanks. Philip

2 1

issues with schema mapping on 2.4.39 with back-sql AND oracle
by Roberto Benedetti 27 Oct '14

27 Oct '14

hello to everyone. [I already tried to send this message to the list. as a list-subscriber I couldn't see it in my inbox neither I saw it on the web list archives. I hope you did not get this message twice] * I was able to run tests against a 2.4.39 OpenLDAP server configured to make use of a MySQL server database. * I have a properly installed Oracle client and also properly configured unixODBC to query Oracle via the "isql" command. * I can see queries run against the oracle instance (although bind-values masquerade run-time queries) after issuing all the DDL and DML statements that come with the distributed software and after modifying the slapd.conf as suggested, I run into problems when starting the server (enclosed please find the complete output with debug set to "-1"): I get the following error[1] even if the query with "2" as the bind value properly works. *questions* Q1) what am I missing? have you got any hint? (if needed, I can provide further information) Q2) are the provided sample files supposed to work as-is? Q3) if the answer to Q2 is "no" but you have been able to run back-sql and Oracle, could you please share DDL and metadata? thanks for your support, roberto benedetti [1] 5447ade2 backsql_oc_get_attr_mapping(): error executing at_query "SELECT name,sel_expr,from_tbls,join_where,add_proc,delete_proc,param_order,expect_return,sel_expr_u FROM ldap_attr_mappings WHERE oc_map_id=?" for objectClass "document" with param oc_id=2 5447ade2 Return code: -1 5447ade2 <==backsql_load_schema_map() 5447ade2 backsql_db_open(): schema mapping failed, exiting 5447ade2 backend_startup_one (type=sql, suffix="dc=example,dc=com"): bi_db_open failed! (1)

1 0

sha256WithRSAEncryption certificates - should this work
by lejeczek 26 Oct '14

26 Oct '14

hi everybody our suite: openldap-2.4.39-3.el7.x86_64 openldap-clients-2.4.39-3.el7.x86_64 openldap-servers-2.4.39-3.el7.x86_64 tools/clients break against sha256 certs, TLS: loaded CA certificate file /etc/openldap/cacerts/5d05809b.0 from CA certificate directory /etc/openldap/cacerts. TLS: error: connect - force handshake failure: errno 0 - moznss error -5938 TLS: can't connect: TLS error -5938:Encountered end of file. is this expected? regards

1 1

translucent overlay add an attribute to all users in a OU and subtree
by Nicolas RENAULT 26 Oct '14

26 Oct '14

Hi, (sorry for poor english) I already ask here for meta and it's working (only have the date format conversion problem but we are about to find alternative) So the ldap proxy can search for a user and provide attributes from an AD, Edir and openldap. but now I want to add attributes to the edir and openldap users search result to have as much as from a AD user (example homeDrive) I plan to use translucent to add these attributes, find that translucent cannot be used with meta so create new slapd instance. I have add base and OU into this instance I read carefully http://www.openldap.org/doc/admin24/overlays.html , and man slapo-translucent I understand that they explain how to add attributes to only one group here my questions how can I add attributes to the translucent instance to all users in an OU (and sub) ? is there another way to do what I want to do ? thanks all for responses -- Nicolas

4 15

filesystem considerations
by Julien Huon 24 Oct '14

24 Oct '14

Hello, I read a long time ago theses very interesting benchmarks : http://symas.com/mdb/microbench/july/. It seams that ext2 is the fastest filesystem for asynchronous writes. Do you think an ext4 filesystem without journalisation but with extents could be faster ? A LMBD database is a big flat file isn't it ? Extents are very interesting with that kind of files, aren't they ? Did someone try it ? Regards

3 4

Redhat LDAP Client Issues when disabling SSLv3
by Peter Boguszewski 23 Oct '14

23 Oct '14

I am running into issues on RHEL 6.x servers (mix of 6.5 and now 6.6) when attempting to disable SSLv3. I have compiled the servers with the --with-tls=openssl option and communication appears to be working well between servers to matter what I have for SSL Protocol. My problems are with the clients. For client configuration I install the openldap-clients package via yum install. Everything works as expected with this setting on the server side: olcTLSCipherSuite: HIGH:+TLSv1.2:-TLSv1.1:-TLSv1.0:+SSLv3:-SSLv2 as soon as I modify the +SSLv3 to -SSLv3 to this: olcTLSCipherSuite: HIGH:+TLSv1.2:-TLSv1.1:-TLSv1.0:-SSLv3:-SSLv2 the client no longer works. I have tried just about everything I can think of. I /can /get ldapsearch to work properly when I compile the openldap source on the client but sssd / authentication on the Red Hat side still fails. Here is the error message I am getting: 54481b75 slap_listener_activate(8): 54481b75 >>> slap_listener(ldaps://blah) 54481b75 connection_get(38): got connid=1009 54481b75 connection_read(38): checking for input on id=1009 TLS trace: SSL_accept:before/accept initialization TLS trace: SSL3 alert write:fatal:handshake failure TLS trace: SSL_accept:error in SSLv3 read client hello C TLS trace: SSL_accept:error in SSLv3 read client hello C TLS: can't accept: error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher. 54481b75 connection_read(38): TLS accept failure error=-1 id=1009, closing 54481b75 connection_close: conn=1009 sd=38 I am assuming this has something to do with RHEL clients linking to MozNSS libraries instead of openssl but can not be sure of that. Again, to be clear - I do not change anything but the olcTLSCipherSuite entry so I do not believe it is a certificate issue. Is there a solution to LDAP auth for RHEL clients with only allowind TLSv1.2? I will gladly compile from source or use the LTB Project rpms. Thanks in advance, -- Peter Boguszewski Manager of Library Systems UW Madison - Library Technology Group pboguszewski(a)library.wisc.edu 608.262.4768

6 8

Synchronizing two mirror mode clusters
by Clément OUDOT 23 Oct '14

23 Oct '14

Hi, I need to set up a backup OpenLDAP cluster and I am looking for advices on the best solutions to achieve it. The situation is: * A mirror mode cluster on one geographical site * A mirror mode cluster on another geographical site (backup site) * I would prefer not to impact configuration of main cluster * I think that full multi-master on different geographical site is not the best solution (but maybe I am totally wrong on this point) The backup site must be in sync with the main site. Here are my two ideas: * Configure a syncrepl client to main cluster on each node of the backup cluster. Question is: will not be conflicts as each node of the backup cluster is already synced with the other backup node? * Configure a LDAP proxy (back-ldap) to backup cluster, with syncrepl client to main cluster. But would back-ldap be able to write operational attributes to backup cluster? I imagine that some of you already have such needs, could you share your experience? Thanks, Clément.

5 6

Multimaster OpenLDAP - LDAP failed to start
by Arantza Serrano 23 Oct '14

23 Oct '14

Hello, I've a multimaster openldap servers. One of them is not running and when I try to start I show this error: Starting ldap...Done. Failed. /opt/zimbra/bin/ldap: line 50: kill: (4375) - No such process /opt/zimbra/bin/ldap: line 50: kill: (6219) - No such process /opt/zimbra/bin/ldap: line 50: kill: (6231) - No such process /opt/zimbra/bin/ldap: line 50: kill: (6242) - No such process /opt/zimbra/bin/ldap: line 50: kill: (6253) - No such process /opt/zimbra/bin/ldap: line 50: kill: (6264) - No such process /opt/zimbra/bin/ldap: line 50: kill: (6275) - No such process Failed to start slapd. Attempting debug start to determine error. 5446fc53 <= mdb_index_read: failed (-30798) 5446fc53 <= mdb_index_read: failed (-30798) res_errno: 0, res_error: <>, res_matched: <> res_errno: 0, res_error: <>, res_matched: <> 5446fc53 <= mdb_index_read: failed (-30798) 5446fc53 <= mdb_dn2id: get failed: MDB_NOTFOUND: No matching key/data pair found (-30798) 5446fc53 <= mdb_dn2id: get failed: MDB_NOTFOUND: No matching key/data pair found (-30798) slapd: ./../../../libraries/liblmdb/mdb.c:2282: mdb_txn_commit: Assertion `oldpg_txnid <= env->me_pgstate.mf_pglast' failed. What can I do to solve the problem? Thanks

2 2

Re: Seems that syncprov holds up LMDB's reclaiming while handle a syncrepl requests.
by Леонид Юрьев 23 Oct '14

23 Oct '14

I will submit the ITS with a patch. Now it is being tested. Leonid. 2014-10-20 21:30 GMT+04:00 Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Wednesday, October 15, 2014 10:47 PM +0400 Леонид Юрьев <leo(a)yuriev.ru> > wrote: > >> Under heavy load conditions with syncrepl a lot of FreeDB records is >> generated, without any other reading activity. Is really a lot, up to >> 90% of DB space, a sample is below. >> >> I assume that the bugfix of ITS#7904 does not affected for syncprov >> overlay and syncrepl. >> http://www.openldap.org/its/index.cgi/Software%20Bugs?id=7904 > > > Provide a test case that triggers the behavior. > > --Quanah > > -- > > Quanah Gibson-Mount > Server Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration

1 1

LDAP searches hang after returning results...
by Jeff Lebo 22 Oct '14

22 Oct '14

OpenLDAP server setup as pass-through to AD on the backend. When doing a traffic dump on the connection between OpenLDAP and the AD server, I see OpenLDAP make the search request, the AD server responds with the results, then it just hangs there for about 90 seconds before the OpenLDAP server sends an unbind request to AD. This is causing the external application to timeout. Any idea what is causing this?

3 7

Modifying schemas
by Côme BERNIGAUD 22 Oct '14

22 Oct '14

Hello, If I do sudo ldapsearch -Y EXTERNAL -H ldapi:/// -b "cn=schema,cn=config" "cn=*" cn I can see in the resulsting list: # {18}applications-fd, schema, config dn: cn={18}applications-fd,cn=schema,cn=config cn: {18}applications-fd But if I use an ldif trying to modify this I get: modifying entry "cn={18}applications-fd,cn=schema,cn=config" ldap_modify: No such object (32) I can see in /etc/ldap/slapd.d/cn=config/cn=schema that the file is named cn={19}applications-fd.ldif so I tried with 19 instead of 18 in the ldif and I get: modifying entry "cn={19}applications-fd,cn=schema,cn=config" ldap_modify: No such object (32) matched DN: cn=schema,cn=config Which seems worse. I'm wondering if there is not a numbering problem with schemas due to a previous dirty delete of a schema (stopping slapd, deleting the file and starting slapd), but it still is weird that slapd would list the schema but not find it for modification. Côme

2 3

username syntax for bind/auth
by Jeff Lebo 21 Oct '14

21 Oct '14

So I've got everything working with my OpenLDAP passthrough to AD... one last thing (I think). Is there a way to make OpenLDAP accept username(a)domain.com instead of the full DN?

2 2

LDAP Replica TLS problem
by Elmopi, Stefano 21 Oct '14

21 Oct '14

Hi, I'm having trouble to run the replica LDAP with TLS, without TLS, all works !! Provider and Consumer are identical CentOS release 6.5 rpm -qa | grep ldap openldap-clients-2.4.23-34.el6_5.1.x86_64 openldap-2.4.23-34.el6_5.1.x86_64 apr-util-ldap-1.3.9-3.el6_0.1.x86_64 nss-pam-ldapd-0.7.5-18.2.el6_4.x86_64 mod_authz_ldap-0.26-16.el6.x86_64 pam_ldap-185-11.el6.x86_64 openldap-servers-2.4.23-34.el6_5.1.x86_64 Provider config, file cn\=config.ldif olcTLSCACertificateFile: /etc/openldap/certs/ldapscert.pem olcTLSCertificateFile: /etc/openldap/certs/ldapscert.pem olcTLSCertificateKeyFile: /etc/openldap/certs/keys/ldapskey.pem olcTLSCipherSuite: TLSv1+RSA:!EXPORT:!NULL olcTLSVerifyClient: never Consumer config: olcSyncrepl: {0}rid=000 provider=ldap://ldpsoc01devpom.sociale.it starttls=yes type=refreshonly retry="5 5 300 +" searchbase="dc=example,dc=it" attrs="*,+" bindmethod=simple binddn="uid=xxxxxxxx,ou=admin_bind,ou=Utenze_Amministratori,dc=example,dc=it" credentials=xxxxxxx interval=60 and, in /etc/openldap/ldap.conf TLS_CACERT /etc/openldap/certs/ldapscert.pem TLS_REQCERT never the certificate is self-signed On the slave, if I try the following command: ldapsearch -ZZ -x -H ldap://ldpsoc01devpom -D 'uid=xxxxxxx,ou=admin_bind,ou=Utenze_Amministratori,dc=example,dc=it' -W 'objectclass=*' -v everything is ok but when I try to use TLS in replication, the process goes wrong. In the Provider log: connection_get(16) connection_get(16): got connid=1030 connection_read(16): checking for input on id=1030 connection_read(16): TLS accept failure error=-1 id=1030, closing connection_closing: readying conn=1030 sd=16 for close connection_close: conn=1030 sd=16 daemon: activity on 1 descriptor daemon: activity on: In the Consumer log: slapd[6508]: =>do_syncrepl rid=000 slap_client_connect: URI=ldap://ldpsoc01devpom.sociale.it Warning, ldap_start_tls failed (-11) slap_client_connect: URI=ldap://ldpsoc01devpom.sociale.it DN="uid=bind_replica,ou=admin_bind,ou=utenze_amministratori,dc=sociale,dc=it" ldap_sasl_bind_s failed (-1) do_syncrepl: rid=000 rc -1 retrying (3 retries left) daemon: activity on 1 descriptor daemon: activity on: Help, I do not know where to turn !!!! Thanks Ing. Stefano Elmopi Cooperativa Capodarco - Resp. Area ICT Gestione Esercizio Via Ostiense 131/L Corpo B, 00154 Roma cell. 3466147165 tel. 0657060500 email:stefano.elmopi@sociale.it -- "Ai sensi e per gli effetti della legge sulla tutela dei dati personali (D.lgs 196/2003), le informazioni contenute nella presente @mail sono di natura riservata e destinate ad un uso aziendale-lavorativo con esclusione di utilizzi ad uso personale; come tali, pertanto, sono riservate esclusivamente ai destinatari sopra indicati. E' proibito leggere, copiare, usare o diffondere il contenuto della presente @mail senza autorizzazione. Se avete ricevuto questa @mail per errore, siete pregati di rispedire la stessa al mittente. Grazie"

4 4

POODLE SSLv3 downgrade attack
by Howard Chu 21 Oct '14

21 Oct '14

You've probably all heard about this "new" attack several times by now. Just to confirm what's already been stated - this attack only affects HTTP browsers that deliberately break the TLS handshake protocol to allow using older SSL versions. It does not affect LDAP software at all. Also, since version 2.4.14 (released February 2009), OpenLDAP has supported TLSProtocolMin slapd config and LDAP_TLS_PROTOCOL_MIN client config directives for selecting the minimum version of SSL/TLS to allow. As this feature has been available for over 5 years there is no reason for any OpenLDAP deployments to be using SSLv3 today. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

6 8

bdb_equality_candidates: (cn) not indexed
by Gremaud Cyrill 21 Oct '14

21 Oct '14

HI list ! I just have a 3-way multi-master replication with openldap for cn=config and HDB. Sometime in the log, I have this error/warning : <= bdb_equality_candidates: (cn) not indexed How can I fix it ? just add olcDbIndex cn eq ??? and my second question is why this warning occurs ? thanks a lot for your response. cyrill gremaud

2 2

Problem with chain overlay
by Elmopi, Stefano 20 Oct '14

20 Oct '14

Hi, I have a problem with the configuration of the Chain Overlay. Provider and Consumer are identical CentOS release 6.5 rpm -qa | grep ldap openldap-clients-2.4.23-34.el6_5.1.x86_64 openldap-2.4.23-34.el6_5.1.x86_64 apr-util-ldap-1.3.9-3.el6_0.1.x86_64 nss-pam-ldapd-0.7.5-18.2.el6_4.x86_64 mod_authz_ldap-0.26-16.el6.x86_64 pam_ldap-185-11.el6.x86_64 openldap-servers-2.4.23-34.el6_5.1.x86_64 On the Consumer I imported the ldif file: dn: olcOverlay=chain,olcDatabase={-1}frontend,cn=config objectClass: olcOverlayConfig objectClass: olcChainConfig olcOverlay: chain olcChainCacheURI: FALSE olcChainMaxReferralDepth: 1 olcChainReturnError: FALSE and I created the file. /etc/openldap/slapd.d/cn=config/olcDatabase={-1}frontend/olcOverlay={1}chain.ldif and after that I can not understand what I do. I've read a few things on the internet but have not been able to arrive at a solution, I tried to import the ldif file: dn: olcDatabase=ldap,olcOverlay={1}chain,olcDatabase={-1}frontend,cn=config objectClass: olcLDAPConfig objectClass: olcChainDatabase olcDatabase: ldap olcDbURI: "ldap://ldpsoc01devpom.sociale.it" olcDbIDAssertBind: mode=self flags=prescriptive,proxy-authz-non-critical bindmethod=simple timeout=0 network-timeout=0 binddn="uid=pippo,ou=admin_esercizio,ou=Utenze_Amministratori,dc=sociale,dc=it" credentials="*******" keepalive=0:0:0 olcDbIDAssertAuthzFrom: * olcDbRebindAsUser: FALSE olcDbChaseReferrals: TRUE olcDbTFSupport: no olcDbProxyWhoAmI: FALSE olcDbProtocolVersion: 3 olcDbSingleConn: FALSE olcDbCancel: abandon olcDbUseTemporaryConn: FALSE olcDbConnectionPoolMax: 16 olcDbNoRefs: FALSE olcDbNoUndefFilter: FALSE but what I try to import it, I get the following error ldapadd -d 5 -H ldap://localhost:389 -x -W -D "cn=admin,cn=config" -f chaing_entry.ldif res_errno: 32, res_error: <>, res_matched: <olcDatabase={-1}frontend,cn=config> ldap_free_request (origid 2, msgid 2) ldap_parse_result ber_scanf fmt ({iAA) ber: ber_scanf fmt (}) ber: ldap_msgfree ldap_err2string ldap_add: No such object (32) matched DN: olcDatabase={-1}frontend,cn=config ldap_free_connection 1 1 ldap_send_unbind ber_flush2: 7 bytes to sd 4 ldap_free_connection: actually freed I do not know what to do !!!! My problem is that I use the Consumer ldap for authentication of some applications and if a user fails for more than 5 times the password, it should be blocked but being Consumer ldap read-only, the locking is not done !!! HELP !!! Ing. Stefano Elmopi Cooperativa Capodarco - Resp. Area ICT Gestione Esercizio Via Ostiense 131/L Corpo B, 00154 Roma cell. 3466147165 tel. 0657060500 email:stefano.elmopi@sociale.it -- "Ai sensi e per gli effetti della legge sulla tutela dei dati personali (D.lgs 196/2003), le informazioni contenute nella presente @mail sono di natura riservata e destinate ad un uso aziendale-lavorativo con esclusione di utilizzi ad uso personale; come tali, pertanto, sono riservate esclusivamente ai destinatari sopra indicati. E' proibito leggere, copiare, usare o diffondere il contenuto della presente @mail senza autorizzazione. Se avete ricevuto questa @mail per errore, siete pregati di rispedire la stessa al mittente. Grazie"

4 3

Seems that syncprov holds up LMDB's reclaiming while handle a syncrepl requests.
by Леонид Юрьев 20 Oct '14

20 Oct '14

Under heavy load conditions with syncrepl a lot of FreeDB records is generated, without any other reading activity. Is really a lot, up to 90% of DB space, a sample is below. I assume that the bugfix of ITS#7904 does not affected for syncprov overlay and syncrepl. http://www.openldap.org/its/index.cgi/Software%20Bugs?id=7904 Which is the best way to verify this and fix? Could anybody pointed me to a code? Leonid. --- Environment Info Map address: (nil) Map size: 2000000000 Page size: 4096 Max pages: 488281 Number of pages used: 480301 Last transaction ID: 1485433 Tail transaction ID: 1485433 Max readers: 126 Number of readers used: 0 Freelist Status Tree depth: 3 Branch pages: 8 Leaf pages: 1121 Overflow pages: 1 Entries: 28991 Page Allocation Info Max pages: 488281 100% Number of pages used: 480301 98.4% Remained: 7980 1.6% Used now: 33397 6.8% Free pages: 446904 91.5% Reading: 9 0.0% Reclaimable: 446895 91.5% Available: 454875 93.2% Status of Main DB Tree depth: 1 Branch pages: 0 Leaf pages: 1 Overflow pages: 0 Entries: 6

2 1

Segmentation fault in s23_clnt.c when used in a library
by Tobias Ljunggren 20 Oct '14

20 Oct '14

Hello, I've been trying to track a segmentation fault for a couple of days but I'm running out of ideas and need some help or suggestion on how to proceed. Perhaps this is the wrong forum and if so I apologize. It's also worth mentioning that I don't have any knowledge about the openSSL library source code but I've been working with ldap libraries for quite some time (about 10 years). What I have is shared object (.so) that is loaded from another program (nothing I have control of) using a public API. My library loads openLDAP (libldap_r and liblber) using dlopen/dlsym. After some initialization code I try to bind to a ldap source (ldaps://ldaphost:636) but I get a segmentation fault in s23_clnt.c at line 159: else if (s->ctx->info_callback != NULL) For some reason s->ctx is a null pointer. My first thoughts was that I do something I shouldn't prior to ldap_sasl_bind_s which corrupts the LDAP handle but after days with gdb and valgrind I still can't find anything. openLDAP version used is 2.4.40 built with openSSL 1.0.1i. If I copy the ldap code to a test executable it works fine. Is there anything special to consider when loading the libraries from a shared object? I understand that it is almost impossible to give me any good answers but since I'm a bit frustrated I hope someone can give me some hints. Best regards, Tobias

2 4

Proper way to de initialize library
by Tobias Ljunggren 19 Oct '14

19 Oct '14

Hello, What is the proper way to de-initialize openLDAP library? Let's assume I have ldap_initialize (ldaps://....) a couple of general ldap_set_option some ldap_set_option for TLS ldap_sasl_bind_s Is ldap_unbind_s all that's required? My problem is that if I do it this way when using openLDAP from a shared object and the process unloads the shared object and then loads it again (restarts my library) TLS won't work anymore. Probably there is one or more global variables in openLDAP that needs to be reset before unload to make sure the initialization works. I looked at the ldapsearch example provided, in common.c, and noticed a call to ldap_pvt_tls_destroy. I tried that but it doesn't make any difference. I've compiled openLDAP to use Mozilla NSS. Best regards, Tobias

2 2

[LMDB] some few questions
by Klaus Malorny 17 Oct '14

17 Oct '14

Hi, LMDB seems to be quite the right database I am looking for in order to speed up my application. However, I still need to figure some things out. While I could get many answers to my questions by skimming through the archive, the following things are still unclear to me, and it would be quite nice if someone could clarify them: - in the documentation, I saw two limits: the key is limited to 511 bytes (by default) and the data is limited to 16777215 bytes. Is this correct? For larger data sizes, is the data still maintained in one contiguous block, so that the application can still access it directly without any need of copying within LMDB? Or it is better to split larger data into multiple key/value pairs? - I discovered the return code "MDB_TXN_FULL". By what means are transactions limited? I might consider to use few, but quite large transactions dealing with hundreds of thousands key/value pairs to be created, updated or deleted in some circumstances. - I saw the discussion about the predefined database size, and that it is recommended to use a never-to-be-reached size and to rely on the sparse file capabilities of the underlying OS. If I would not want to go this way: Is it correct that if I encounter an "MDB_MAP_FULL" return code, it would be sufficient to abort the current transaction, resize the database using mdp_env_set_mapsize and repeat the transaction? Thanks in advance and regards, Klaus

2 3

AW: Q: accesslog and sessions
by Uwe Werler 17 Oct '14

17 Oct '14

-----Ursprüngliche Nachricht----- Von: Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de> Gesendet: Do 16.10.2014 13:46 Betreff: Q: accesslog and sessions An: openldap-technical(a)openldap.org; > Hi! > > I have configured accesslog for modification (attempts) in a multi-master > configuration. Comparing accesslogs after some changes, I find some issues > (openLDAP 2.4.26 of SLES11 SP3): > > On the originating server the "reqSession" varies with the connection made, > while on a replication consumer the "reqSession" seems fixed (always 2 in one > case). 'cause of replication. > Also on the originating server I see the authenticated DN in > "reqAuthzID", while on the replication consumer it seems to be always > "cn=Admin,dc=example,dc=org". "reqStart" and "reqEnd" are also local for the > LDAP server. 'cause the repl consumer writes to the database as admin user. > > Now at least I have a problem with "reqSession": If you examine accesslog at > some later time, those volatile session IDs don't tell you anything anymore > (e.g. the host that opened the connection). Could acesslog be modified to add > some details from the session (like monitorConnectionPeerAddress, > monitorConnectionStartTime)? > > Regards, > Ulrich Windl > This woule be a very nice feature, indeed. > >

4 3

WG: (ITS#7964) overlay rwm escape issue with more the 9 rules / rewrite statements
by Uwe Werler 16 Oct '14

16 Oct '14

FYI - last week I filed an ITS regarding overlay rwm: -----Ursprüngliche Nachricht----- Von: Uwe Werler <uwe.werler(a)retiolum.eu> Gesendet: Mo 13.10.2014 08:46 Betreff: (ITS#7964) overlay rwm escape issue with more the 9 rules / rewrite statements An: openldap-its(a)OpenLDAP.org; Full_Name: Uwe Werler Version: 2.4.40 OS: Linux / SLES 11 SP3 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (155.56.68.214) If I have rewrite rules like this: 23 olcOverlay={1}rwm,olcDatabase={3}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcRwmConfig olcOverlay: {1}rwm olcRwmRewrite: {0}rwm-rewriteEngine on olcRwmRewrite: {1}rwm-rewriteContext searchFilter olcRwmRewrite: {2}rwm-rewriteRule "(.*\$)uid=sapr3(\$.*)" "$1uid=dlmsapr3$2" olcRwmRewrite: {3}rwm-rewriteRule "(.*\$)uid=sdb(\$.*)" "$1uid=sdb$2" olcRwmRewrite: {4}rwm-rewriteRule "(.*\$)uid=sapadm(\$.*) "$1uid=dlmsapadm$2" olcRwmRewrite: {5}rwm-rewriteRule "(.*\$)uid=sapmnt(\$.*)" "$1uid=sapmnt$2" olcRwmRewrite: {6}rwm-rewriteRule "(.*\$)uid=[a-z0-9]{3}adm(\$.*)" "$1uid=dlmsidadm$2" olcRwmRewrite: {7}rwm-rewriteRule "(.*\$)uid=sqd[a-z0-9]%3%3}(\$.*)" "$1uid=dlmsqdsid$2" olcRwmRewrite: {8}rwm-rewriteRule "(.*\$)uid=ora[a-z0-9]{3}(\$.*)" "$1uid=dlmorasid$2" olcRwmRewrite: {9}rwm-rewriteRule "(.*\$)uid=sap[a-z0-9]{3}(\$.*)" "$1uid=dlmsapr3$2" olcRwmRewrite: {10}rwm-rewriteRule "(.*\$)uid=sap[a-z0-9]{3}db(\$.*)" "$1uid=dlmsapr3db$2" olcRwmRewrite: {11}rwm-rewriteRule "(.*\$)uid=db2[a-z0-9]{3}(\$.*)" "$1uid=dlmdb2sid$2" olcRwmRewrite: {12}rwm-rewriteRule "(.*\$)uid=db2[a-z0-9]{3}ap(\$.*)" "$1uid=dlmdb2sid$2" then the 7. rule / 9. statement failes to escape. In this example ora*** get's not correctly rewritten to dlmora***: See loglevel trace: 543b711d ==> rewrite_rule_apply rule='(.*$)uid=sapr3($.*)' string='(&(objectClass=dynamicObject)(entryExpireTimestamp<=20141013062840Z))' [1 pass(es)] 543b711d ==> rewrite_rule_apply rule='(.*$)uid=sdb($.*)' string='(&(objectClass=dynamicObject)(entryExpireTimestamp<=20141013062840Z))' [1 pass(es)] 543b711d ==> rewrite_rule_apply rule='(.*$)uid=sapadm($.*)' string='(&(objectClass=dynamicObject)(entryExpireTimestamp<=20141013062840Z))' [1 pass(es)] 543b711d ==> rewrite_rule_apply rule='(.*$)uid=sapmnt($.*)' string='(&(objectClass=dynamicObject)(entryExpireTimestamp<=20141013062840Z))' [1 pass(es)] 543b711d ==> rewrite_rule_apply rule='(.*$)uid=[a-z0-9]{3}adm($.*)' string='(&(objectClass=dynamicObject)(entryExpireTimestamp<=20141013062840Z))' [1 pass(es)] 543b711d ==> rewrite_rule_apply rule='(.*$)uid=sqd[a-z0-9]{3}($.*)' string='(&(objectClass=dynamicObject)(entryExpireTimestamp<=20141013062840Z))' [1 pass(es)] 543b711d ==> rewrite_rule_apply rule='(.*\$)uid=ora[a-z0-9]{3}(\$.*)' string='(&(objectClass=dynamicObject)(entryExpireTimestamp<=20141013062840Z))' [1 pass(es)] 543b711d ==> rewrite_rule_apply rule='(.*$)uid=sap[a-z0-9]{3}($.*)' string='(&(objectClass=dynamicObject)(entryExpireTimestamp<=20141013062840Z))' [1 pass(es)] 543b711d ==> rewrite_rule_apply rule='(.*$)uid=sap[a-z0-9]{3}db($.*)' string='(&(objectClass=dynamicObject)(entryExpireTimestamp<=20141013062840Z))' [1 pass(es)] 543b711d ==> rewrite_rule_apply rule='(.*$)uid=db2[a-z0-9]{3}($.*)' string='(&(objectClass=dynamicObject)(entryExpireTimestamp<=20141013062840Z))' [1 pass(es)] 543b711d ==> rewrite_rule_apply rule='(.*$)uid=db2[a-z0-9]{3}ap($.*)' string='(&(objectClass=dynamicObject)(entryExpireTimestamp<=20141013062840Z))' [1 pass(es)] If I insert a dummy statement like this: olcRwmRewrite: {0}rwm-rewriteEngine on olcRwmRewrite: {1}rwm-rewriteContext searchFilter olcRwmRewrite: {2}rwm-rewriteRule "(.*\$)uid=sapr3(\$.*)" "$1uid=dlmsapr3$2" olcRwmRewrite: {3}rwm-rewriteRule "(.*\$)uid=sdb(\$.*)" "$1uid=sdb$2" olcRwmRewrite: {4}rwm-rewriteRule "(.*\$)uid=sapadm(\$.*)" "$1uid=dlmsapadm$2" olcRwmRewrite: {5}rwm-rewriteRule "(.*\$)uid=sapmnt(\$.*)" "$1uid=sapmnt$2" olcRwmRewrite: {6}rwm-rewriteRule "(.*\$)uid=[a-z0-9]{3}adm(\$.*)" "$1uid=dlmsidadm$2" olcRwmRewrite: {7}rwm-rewriteRule "(.*\$)uid=sqd[a-z0-9]{3}(\$.*)" "$1uid=dlmsqdsid$2" olcRwmRewrite: {8}rwm-rewriteRule "(.*\$)uid=ora[a-z0-9]{3}(\$.*)" "$1uid=dlmorasid$2" olcRwmRewrite: {9}rwm-rewriteContext placeHolder alias searchFilter olcRwmRewrite: {10}rwm-rewriteRule "(.*\$)uid=sap[a-z0-9]{3}(\$.*)" "$1uid=dlmsapr3$2" olcRwmRewrite: {11}rwm-rewriteRule "(.*\$)uid=sap[a-z0-9]{3}db(\$.*)" "$1uid=dlmsapr3db$2" olcRwmRewrite: {12}rwm-rewriteRule "(.*\$)uid=db2[a-z0-9]{3}(\$.*)" "$1uid=dlmdb2sid$2" olcRwmRewrite: {13}rwm-rewriteRule "(.*\$)uid=db2[a-z0-9]{3}ap(\$.*)" "$1uid=dlmdb2sid$2" then the escapes are working properly. Sometimes this occurs with the last rule too. I first tried with 2.4.26 (standard version in SLES11 SP3) and now with 2.4.40. Regards Uwe

1 0

AW: Q: accesslog and sessions
by Uwe Werler 16 Oct '14

16 Oct '14

> >> Now at least I have a problem with "reqSession": If you examine accesslog at > >> some later time, those volatile session IDs don't tell you anything anymore > >> (e.g. the host that opened the connection). Could acesslog be modified to add > >> some details from the session (like monitorConnectionPeerAddress, > >> monitorConnectionStartTime)? > > RTFM and turn on session logging. > > > This woule be a very nice feature, indeed. You mean that I'm then able to get the session ID and search them in log if I turn on loglevel conns?

1 0

Q: accesslog and sessions
by Ulrich Windl 16 Oct '14

16 Oct '14

Hi! I have configured accesslog for modification (attempts) in a multi-master configuration. Comparing accesslogs after some changes, I find some issues (openLDAP 2.4.26 of SLES11 SP3): On the originating server the "reqSession" varies with the connection made, while on a replication consumer the "reqSession" seems fixed (always 2 in one case). Also on the originating server I see the authenticated DN in "reqAuthzID", while on the replication consumer it seems to be always "cn=Admin,dc=example,dc=org". "reqStart" and "reqEnd" are also local for the LDAP server. Now at least I have a problem with "reqSession": If you examine accesslog at some later time, those volatile session IDs don't tell you anything anymore (e.g. the host that opened the connection). Could acesslog be modified to add some details from the session (like monitorConnectionPeerAddress, monitorConnectionStartTime)? Regards, Ulrich Windl

1 0

referrals
by Balazs Kovacs 15 Oct '14

15 Oct '14

Hi, I'm reading about referrals in RFC4511, which says: "Referrals can be returned in response to any operation request (except Unbind and Abandon, which do not have responses)." Can OpenLDAP slapd return referrals for bind operations? I got them for searches but not for binds. I'm using "Subordinate Knowledge Information" as described here" http://www.openldap.org/doc/admin24/referrals.html If no, can you please tell me the reasoning behind it? Best Regards, Balazs

1 0

<attrlist> syntax in ACLs
by Nikos Voutsinas 15 Oct '14

15 Oct '14

Hi all, Although I suspect what the answer would be, I thought It might be a good idea to confirm with the list. Is the following <attrlist> clause in OpenLdap's ACLs syntax valid; <attr1> [val[.<basic-style>]=<regex>],<attr2> e.g. to dn.subtree="ou=People,dc=foo,dc=com" attrs=entry,objectClass val.regex="objvalue1|objvalue2",attr1,attr2 by <who> <what> Thanks

4 9

OpenLDAP as proxy to Active Directory backend
by Jeff Lebo 15 Oct '14

15 Oct '14

Goal: LDAP server in Internet facing DMZ to provide authentication for externally hosted applications using internal AD credentials. I've done a LOT of reading and testing, and there is one thing I am still not 100% clear on: Is it possible to do this WITHOUT having a local user database on the OpenLDAP proxy? We will have thousands of users that will need to authenticate, and I can't maintain another user database (adds, removes, etc..). Is there a way to make OpenLDAP just act more like a reverse proxy and forward anything that matches a specific domain on to the internal LDAP/AD server for password verification?

4 8

LDAP, autofs and nested directories
by Lasse Knudsen 13 Oct '14

13 Oct '14

Greetings, I have run into a little snag, i know this is possible but, there is something that escapes me, my issue is as follows. I would like to have nested directories available, something to this effect, i need all directories to be created by the automounter, the problem is that i can't make configuration changes that always work, there is something that seems not to work as i would. what i would like to achieve is that the automounter creates my entire structure. for instance /fpc/apps (for some reason this works) and the two chess directories mount /fcp/co/home (co is created but home is not) i would like the ldap structure to be clean and neat, but it looks messy and its not clear to me when i make changes that it will work. So my question how do i go about creating this structure in a reliable way, most guides i have found only deal with creating a directory in / but does not go any further? And it bothers me that i have to use the slashes, like this “cn=/fpc/apps” Any suggestions how i can create this in a way that works? I have included my automount structure and my autofs confs thank you in advance lk

1 0

Q. null-modification with ppolicy?
by Ulrich Windl 13 Oct '14

13 Oct '14

Hi! Is it possible that ppolicy overlay does null-modifications on login for user entries that don't have a password policy? I see changes like this (diff of LDIF dump): -entryCSN: 20130910073734.028691Z#000000#001#000000 +entryCSN: 20141013114030.580239Z#000000#001#000000 modifiersName: cn=Admin,dc=domain,dc=org -modifyTimestamp: 20130910073734Z +modifyTimestamp: 20141013114030Z That is only the modification times seem changed. Regards, Ulrich

1 0

Antw: Questions on ppolicy (SLES11)
by Ulrich Windl 13 Oct '14

13 Oct '14

>>> I wrote: > Hello! > > I started to configure ppolicy in SLES11 SP3, and I think I succeeded with > the LDAP part. However I did not understand how to integrate ppolicy to the > OS, specifically: > > I created one test user with a ppolicy, and expectation is that on first > login the passowrd should be canged (minus grace logins). According to the > syslog ppolicy triggers an expired password: > > slapd[3990]: ppolicy_bind: Setting warning for password expiry for > uid=windl2,ou=domain,dc=org = 0 seconds > > However the user when logging in gets no type of message at all. It also > seems that nothing is changed in the LDAP database when this message occurs. The answer to this part is: If nscd is stil using the same connection, it won't detect ppolicy. After restarting nscd, things work as expected on that client. > So what is actually "set" there? > > When the user actually changes the password, I see the following attributes > changed in LDAP: > userPassword, pwdHistory, shadowLastChange > > What's not quite clear is when using SSHA-hashed passwords, what changes can > be done regarding pwdCheckQuality. I can imagine that some checks will work > if the client uses the extended operation to change the password, but not if > the password is changed by an ordinary LDAP modify request. Is that correct? It seems password history and minimum length can still be checked. Unsure about the rest. I also discovered that the attempt to change the password (after being logged in) may consume another grace login. This may be of interest if the actual password change failed or was aborted. > > Finally, maybe a stupid question: How does authentication against LDAP work? > In the classical UNIX mechanism, the authenticating process would query the > user name, then fetch the hashed password for that user, get the password > from the user, hash it using the same salt, and then compare the results for > a match. To my understanding you cannot get the hashed password from LDAP > until authenticated, so that looks like a egg-hen paradoxon to me. > > If anybody could enlighten me, I'd be glad. > > Regards, > Ulrich > >

1 0

Questions on ppolicy (SLES11)
by Ulrich Windl 13 Oct '14

13 Oct '14

Hello! I started to configure ppolicy in SLES11 SP3, and I think I succeeded with the LDAP part. However I did not understand how to integrate ppolicy to the OS, specifically: I created one test user with a ppolicy, and expectation is that on first login the passowrd should be canged (minus grace logins). According to the syslog ppolicy triggers an expired password: slapd[3990]: ppolicy_bind: Setting warning for password expiry for uid=windl2,ou=domain,dc=org = 0 seconds However the user when logging in gets no type of message at all. It also seems that nothing is changed in the LDAP database when this message occurs. So what is actually "set" there? When the user actually changes the password, I see the following attributes changed in LDAP: userPassword, pwdHistory, shadowLastChange What's not quite clear is when using SSHA-hashed passwords, what changes can be done regarding pwdCheckQuality. I can imagine that some checks will work if the client uses the extended operation to change the password, but not if the password is changed by an ordinary LDAP modify request. Is that correct? Finally, maybe a stupid question: How does authentication against LDAP work? In the classical UNIX mechanism, the authenticating process would query the user name, then fetch the hashed password for that user, get the password from the user, hash it using the same salt, and then compare the results for a match. To my understanding you cannot get the hashed password from LDAP until authenticated, so that looks like a egg-hen paradoxon to me. If anybody could enlighten me, I'd be glad. Regards, Ulrich

2 1

Complementing "set" ACLs documentation
by Ignacio Gallegos 13 Oct '14

13 Oct '14

Hi, I will try to explain "set" ACLs complementing the information originally written by Mark Valence in the openldap-devel archive (http://www.openldap.org/lists/openldap-devel/200006/msg00046.html). Set ACLs are a bit tricky and difficult to understand without the appropiate documentation. I hope this information helps to understand this kind of ACLs. 1. SYNTAX --------- First of all, the sintax in Backus-Naur form: <set> := <base> | "(" <set> ")" | <set> <conj> <set> | <set> "/" <attribute> "*" | <set> "/" <attribute> | <set> "/-" <level> | <set> "/-*" <base> := "this" | "user" | "[" <any text> "]" <conj> := "&" | "|" | "+" <attribute> := an attributeType as defined in the schema Of course, anywhere in the string, submatch replacements can appear in the form $<digit> or ${<digits>} if "set.regex=" is used instead "set=". 1.1. this, user and [] ---------------------- Keyword "this" means the object being accessed. So, if you are trying to read "cn=ignacio,ou=users,dc=foo,dc=com", "this" refers to "cn=ignacio,ou=users,dc=foo,dc=com" object. Keywork "user" means the object used to authenticate. If you are trying to read "cn=ignacio,ou=users,dc=foo,dc=com" authenticated as "cn=admin,dc=foo,dc=com", "user" refers to "cn=admin,dc=foo,dc=com" object. Keyword "[<text>]" means any text you need to use. For example "[cn=admin,dc=foo,dc=com]", "[FOO]". In other words, like strings in any programming language. 1.2. Object attributes ---------------------- Using the keywords of the previous section, you can access to the value of an attribute of a given object using the "/" operator. So, with an object like the next: dn: cn=ignacio,ou=users,dc=foo,dc=com uid: ignacio cn: ignacio description: Ignacio Gallegos Sanchez homeDirectory: /home/ignacio objectClass: posixAccount objectClass: top objectClass: account uidNumber: 800 structuralObjectClass: account gidNumber: 800 userPassword: MyPassword The expression "[cn=ignacio,ou=users,dc=foo,dc=com]/cn" will return "ignacio". The expression "this/uidNumber" will return "800" only if the target object is "cn=ignacio,ou=users,dc=foo,dc=com". 1.3. Operators &, | and + ------------------------- With a brief explanation: * & is a logic AND operator * | is a logic OR operator * + concatenates strings With examples: * "[A] & [A]" will return "A" * "[A] & [B]" will return an empty set * "[A] | [B]" will return "{ A, B }" * "[A] + [B]" will return "AB" * "[ignacio] & user/cn" will return "ignacio" ONLY if the client is authenticated with a user with a "CN" with value "ignacio" * "this & user" will return the object DN if the object used to authenticate is the target object, and will return nothing if not. 1.4. Group recursion -------------------- Using the "*" character we can obtain the group members in a recursive manner. The sintax is: <object>/<attribute>* For example, if we have the next objects: dn: cn=mail,ou=groups,dc=foo,dc=com objectClass: groupOfNames objectClass: top cn: mail member: cn=ignacio,ou=users,dc=foo,dc=com member: cn=claudia,ou=users,dc=foo,dc=com member: cn=clara,ou=users,dc=foo,dc=com dn: cn=web,ou=groups,dc=foo,dc=com objectClass: groupOfNames objectClass: top cn: web member: cn=oliver,ou=users,dc=foo,dc=com member: cn=sandra,ou=users,dc=foo,dc=com dn: cn=all_services,ou=groups,dc=foo,dc=com objectClass: groupOfNames objectClass: top cn: all_services member: cn=web,ou=groups,dc=foo,dc=com member: cn=mail,ou=groups,dc=foo,dc=com member: cn=julian,ou=users,dc=foo,dc=com The expression "[cn=all_services,ou=groups,dc=foo,dc=com]/member*" will return: { "member: cn=ignacio,ou=users,dc=foo,dc=com", "member: cn=claudia,ou=users,dc=foo,dc=com", "member: cn=clara,ou=users,dc=foo,dc=com", "member: cn=oliver,ou=users,dc=foo,dc=com", "member: cn=sandra,ou=users,dc=foo,dc=com", "member: cn=julian,ou=users,dc=foo,dc=com" } 1.5. Distingued Name Levels --------------------------- We can have the different levels of the DN of a given object using the /-<number> operator, or all levels with "/-*". So if the user is "cn=ignacio,ou=admins,ou=users,dc=foo,dc=com": * "user" resolves to "cn=ignacio,ou=admins,ou=users,dc=foo,dc=com" * "user/-1" resolves to "ou=admins,ou=users,dc=foo,dc=com" * "user/-2" resolves to "ou=users,dc=foo,dc=com" * "user/-3" resolves to "dc=foo,dc=com" * "user/-*" resolves to { "cn=ignacio,ou=admins,ou=users,dc=foo,dc=com", "ou=admins,ou=users,dc=foo,dc=com", "ou=users,dc=foo,dc=com", "dc=foo,dc=com", "dc=com", "" } 2. ACCESS CONTROL EVALUATION ---------------------------- After the previous examples, it's time to put it all together. -- The way "set" ACLs works is to grant the access if the expression returns something, don't grant access if the expression returns an empty set --, independtly the authenticated user is. This seems very simple (it's indeed) but can be very dangerous: we can grant access to an object by an unwanted user if we dont write the expression carefully. As usual, it's better to understand it with examples: * access to dn="ou=users,dc=foo,dc=com" by set="[A]" write Will grant write access to any user, because the set expression always return "A" * access to dn="ou=users,dc=foo,dc=com" by set="[A] & [B]" write Will NOT grant write access to any user, because the set expressions always returns an empty set. * access to dn="ou=users,dc=foo,dc=com" by set="user" write Will grant write access to any user, because the set expression always return the user DN. * access to dn="ou=users,dc=foo,dc=com" by set="user/description" write Will grant write access only if the object used to authenticate has the attribute "description" * access to dn="ou=users,dc=foo,dc=com" by set="user & [cn=ignacio,ou=users,dc=foo,dc=com]" write Will grant write access if the user DN is "cn=ignacio,ou=users,dc=foo,dc=com", because this is the only case the expression "user & [cn=ignacio,ou=users,dc=foo,dc=com]" will return something. * access to dn="ou=users,dc=foo,dc=com" by set="user/-2 & [dc=foo,dc=com]" write Will grant write access to any user two levels over "dc=foo,dc=com" domain, independly the "ou" is. In other words, "cn=ignacio,ou=users,dc=foo,dc=com" and "cn=clara,ou=admins,dc=foo,dc=com" will have write access, but "cn=claudia,ou=mail,ou=admins,dc=foo,dc=com" will not. * access to dn="ou=users,dc=foo,dc=com" by set="user/description & this/description" write Will grant write access to any user which description match the accessed object description. * access to dn="ou=users,dc=foo,dc=com" by set="(user/domain & this/domain)/-2 & [dc=foo,dc=com]" write Will grant write access to any user wich domain attribute match accessed object attribute and also domain is equal to "dc=foo,dc=com". * access to dn.regex="cn=(.+?),ou=users,(.+?)$" by set.regex="($1 & [ignacio]) & ($2 & [dc=foo,dc=com])" write Will grant write access if the user cn is "ignacio" and domain is "dc=foo, dc=com". Best Regards, Ignacio Gallegos Sánchez

2 1

schema for host info?
by Doug OLeary 09 Oct '14

09 Oct '14

Hi; I'm looking to store some host information in an ldap directory. Example attributes are: * Hostname * IP * Netmask * Default gateway * Remote console info * H/W * Serial number * Distribution List addresses to contact if the system has issues. Some of those are obvious: host, iphostnumber, ipnetmasknumber and serialnumber; the others somewhat less so. Any suggestions on how I could approach getting this information in my directory? Best case would be a pre-defined schema that I'm unable to find. Runner up would be a pointer from someone who's already faced and solved this issue. Thanks for any help/hints/tips. Doug O'Leary ------------ Senior UNIX/Security Admin CISSP, CISA, RHCE, CEH O'Leary Computers Inc dkoleary(a)olearycomputers.com (w) 630-904-6098 (c) 630-248-2749 linkedin: http://www.linkedin.com/in/dkoleary resume: http://www.olearycomputers.com/resume.html

3 2

Phpldapadmin can't connect openldap
by Onni Hakala 09 Oct '14

09 Oct '14

Hey! I need help with configuring openldap so that it allows logging in to phpldapadmin. Can you please give me hints how to debug my ldap authentication? I have a freshly installed server with ubuntu 14.04. I installed openldap and phpldapadmin following digitalocean tutorial [1]. My goal is to have all my user accounts in openldap. Services which will be using openldap are owncloud and dovecot. I don't have strong experience with openldap so I wanted to have phpldapadmin for easy administration of ldap database. Openldap is now installed and I can verify that it's working by running command below and entering ldap-root password: $ ldapsearch -x -W -D 'cn=admin,dc=XYZXYZ,dc=fi' -b "" -s base -H ldap://localhost Enter LDAP Password: # extended LDIF # # LDAPv3 # base <> with scope baseObject # filter: (objectclass=*) # requesting: ALL # # dn: objectClass: top objectClass: OpenLDAProotDSE # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Phpldapadmin is also installed and I have verified that it's connecting to ldap. When I try to login to phpldapadmin with same credentials as ldapsearch above. It fails with message: Error: Invalid credentials (49) for user Why are these credentials wrong? I'm sure that password is correct and dn ('cn=admin,dc=XYZXYZ,dc=fi') is correct. Is there something I need to enable in openldap authentication to allow requests from phpldapadmin? I have verified that phpldapadmin is connecting to correct ldap. Firstly I had this error message from phpldapadmin: Error: Can't contact LDAP server (-1) for user But changed /etc/phpldapadmin/config.php to have: $servers->setValue('server','host','ldap://localhost'); I have tried to reinstall both of them several times and still getting this same error. I checked Php error logs (/var/log/apache2/error.log) and they are empty. OPENLDAP VERSION: $ slapd -V @(#) $OpenLDAP: slapd (Ubuntu) (Mar 17 2014 21:20:08) $ buildd@aatxe:/build/buildd/openldap-2.4.31/debian/build/servers/slapd PHPMYADMIN VERSION: 1.2.2 Thanks in advance :)! [1] https://www.digitalocean.com/community/tutorials/how-to-install-and-configu… - Onni Hakala

2 2

more too old cmp -1 output in the log
by Daniel Jung 09 Oct '14

09 Oct '14

Running on 2.4.39 centos 6.4 in MMR setup ( 4 servers ). 001 is the provider that was being written to at the time. The log is from 001. Could you advise whether my understanding of the log is correct? synrepl consumer on serverID=001 is polling syncrepl provider on serverID=001 and 003 and gets the CSN that is older that its own. We were doing a lot of writes during this time and there were cmp -1 104480 or simiar entries in the log. I had similar issue in the past while running 2.4.37 and it crashed slapd at that time but it didnt this time. The CSN were all synced at the end without any issue. Could you advise what could be causing this? Oct 8 20:36:50 servername slapd[58097]: srs csn 20141008181030.452659Z#000000#001#000000 Oct 8 20:36:50 servername slapd[58097]: log csn 20140723214017.586869Z#000000#001#000000 Oct 8 20:36:50 servername slapd[58097]: cmp -1, too old Oct 8 20:36:50 servername slapd[58097]: log csn 20140723214017.847644Z#000000#001#000000 Oct 8 20:36:50 servername slapd[58097]: cmp -1, too old Oct 8 20:36:50 servername slapd[58097]: log csn 20140723214122.276227Z#000000#001#000000 Oct 8 20:36:50 servername slapd[58097]: cmp -1, too old Oct 8 20:36:50 servername slapd[58097]: log csn 20140723214515.997173Z#000000#001#000000 Oct 8 20:36:50 servername slapd[58097]: cmp -1, too old Oct 8 20:36:50 servername slapd[58097]: log csn 20140723214734.650752Z#000000#001#000000 Oct 8 20:36:50 servername slapd[58097]: log csn 20140723220152.569135Z#000000#003#000000 Oct 8 20:36:50 servername slapd[58097]: cmp -1, too old Oct 8 20:36:50 servername slapd[58097]: log csn 20140723220328.184724Z#000000#001#000000 Oct 8 20:36:50 servername slapd[58097]: cmp -1, too old Oct 8 20:36:50 servername slapd[58097]: log csn 20140723222016.864642Z#000000#001#000000 Oct 8 20:36:50 servername slapd[58097]: cmp -1, too old Oct 8 20:36:50 servername slapd[58097]: log csn 20140723232832.307038Z#000000#003#000000 Oct 8 20:36:50 servername slapd[58097]: cmp -1, too old Oct 8 20:36:50 servername slapd[58097]: log csn 20140723232958.001298Z#000000#003#000000

2 3

syncrepl and LDAP_BUSY on LDBM by ITS#7904
by Леонид Юрьев 08 Oct '14

08 Oct '14

Hi all, We got a trouble with 2.4.40 syncrepl in the the multi-master mode. I think is too complex for analyse, and so not yet testcase is ready. But I noticed a change in ITS#7904 and the impact of LDAP_BUSY upon syncrepl. http://www.openldap.org/devel/gitweb.cgi?p=openldap.git&a=search&h=refs%2Ft… For instance, I assume that in case the LDAP_BUSY returned from ldap_sync_search(), then a syncrepl-connection would be closed and reestablished. Let see around the line 1554 of server/slapd/syncrepl.c and below. https://github.com/leo-yuriev/openldap-lmdb-challenge/blob/master/servers/s… Also, nowadays it is no repeatable read txn-isolation during the search and transfer data over a network. Does it influence upon syncrepl or not? Could anybody dispel my doubts? Leonid.

2 2

Map NFShomedirectory to new value
by Frans Lanting - IT Admin 08 Oct '14

08 Oct '14

Hi Folks, We are using an external OpenLDAP to authenticate users on a FreeBSD server and would like to re-map the NFSHomeDirectory to a different location. Currently that value looks like: /afs/home.example.com/users/t/jsmith We'd like to map it to something along the lines of: /users/jsmith If anyone could please point me in the right direction of how to do this, I'd be much appreciated. Cheers, Dan

4 3

Re: OpenLDAP, SASL and TLS
by Kristof Takacs 08 Oct '14

08 Oct '14

I use the following version: - OpenLDAP (2.4.35), but I have tried 2.4.39 as well - Cyrus SASL (2.1.26) - OpenSSL (1.0.1h) - Heimdal ( I beleive 1.5.2) Thanks, Kris On Mon, Oct 6, 2014 at 1:30 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Monday, October 06, 2014 2:27 PM -0400 Kristof Takacs < > kristof.takacs(a)gmail.com> wrote: > > > I use the following open source libraries: >> - OpenLDAP >> - Cyrus SASL >> - OpenSSL >> - Heimdal >> > > It is always critical to list the versions of software you are using. > Please do so. > > --Quanah > > > -- > > Quanah Gibson-Mount > Server Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

3 8

Re: Problem adding olcModuleLoad
by Daniel Jung 07 Oct '14

07 Oct '14

sorry isnt module name memberof? On Mon, Oct 6, 2014 at 7:45 PM, Daniel Jung <mimianddaniel(a)gmail.com> wrote: > sorry isnt module name memberof? > > On Mon, Oct 6, 2014 at 6:39 PM, Howard Chu <hyc(a)symas.com> wrote: > >> Daniel Jung wrote: >> >>> running 2.4.39 >>> >>> # module{0}, config >>> dn: cn=module{0},cn=config >>> objectClass: olcModuleList >>> cn: module{0} >>> olcModuleLoad: {0}syncprov.la <http://syncprov.la> >>> olcModuleLoad: {1}auditlog.la <http://auditlog.la> >>> >>> ldif: >>> dn: cn=module{0},cn=config >>> changetype: modify >>> add: olcModuleLoad >>> olcModuleLoad: memberof >>> >>> using ldapmodify >>> modifying entry "cn=module{0},cn=config" >>> ldap_modify: Other (e.g., implementation specific) error (80) >>> additional info: <olcModuleLoad> handler exited with 1 >>> >>> What am i missing here? >>> >> >> You're missing a valid module name. >> >> -- >> -- Howard Chu >> CTO, Symas Corp. http://www.symas.com >> Director, Highland Sun http://highlandsun.com/hyc/ >> Chief Architect, OpenLDAP http://www.openldap.org/project/ >> > >

3 4

Problem with Index creation
by Joaquin Estrada 07 Oct '14

07 Oct '14

Hi folks. I am having a problem with index creation and am wondering if anyone here has seen this or knows what may be happening. We recently deployed a new proxy server product in our environment and have been working with the vendor to resolve some problems. This device connects to our existing LDAP server environment though a new database we added, per the vendor¹s requirements. One of the problems I am seeing is that, since the addition of this device, we are getting a lot of of the ³<= bdb_equality_cadidates: (uniqueMember) not indexed² messages showing up in the slapd log files. In order to resolve this, I¹ve attempted to create a new equality index on this attribute however no matter what I do, slapindex will not create an index! The following steps were done: 1. Shut down Slapd 2. Modify the slapd.conf file and add the ³index uniqueMember eq² entry to the current list of indexes. 3. Save the slapd.conf file. 4. Navigate to the current path for the database files and delete all existing index ³bdb² files. 5. Run a slapindex f (location of slapd) -b (suffix of database to reindex) I¹ve done this several times, once without deleting the current index files and then a few others after I¹ve deleted the current index files. The slapindex tool will recreate all of the indexes except the ³uniqueMember² index. I do not see an index file for this, and of course starting slapd back up results in the same messages in the log. So, what could be causing this? Is it possible that the vendor is using a filter improperly? If there is no data in the uniqueMember attribute for any of the records would it prevent slapindex from creating an index file? Any help would be appreciated!

1 0

Problem adding olcModuleLoad
by Daniel Jung 07 Oct '14

07 Oct '14

running 2.4.39 # module{0}, config dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModuleLoad: {0}syncprov.la olcModuleLoad: {1}auditlog.la ldif: dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: memberof using ldapmodify modifying entry "cn=module{0},cn=config" ldap_modify: Other (e.g., implementation specific) error (80) additional info: <olcModuleLoad> handler exited with 1 What am i missing here? Thanks

2 1

Re: Issues with Master / Slave and ppolicy
by Raul Hernandez 06 Oct '14

06 Oct '14

Hello Quanah, You are right. Here is my slave configuration: dn: cn=module,cn=config changetype: add objectClass: olcModuleList cn: module olcModulePath: /usr/lib/ldap olcModuleLoad: syncprov olcModuleLoad: back_ldap dn: olcOverlay=syncprov,olcDatabase={1}hdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov dn: olcDatabase={1}hdb,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=ldap://example.com binddn="cn=syncReplUser,dc=example,dc=com" bindmethod=simple credentials=PASSWD searchbase="dc=example,dc=com" type=refreshAndPersist scope=sub retry="5 10 10 +" timeout=1 sizelimit=unlimited schemachecking=on - add: olcUpdateRef olcUpdateRef: ldap://example.com dn: olcOverlay=chain,olcDatabase={-1}frontend,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcChainConfig olcOverlay: chain olcChainReturnError: TRUE dn: olcDatabase=ldap,olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config changetype: add objectClass: olcLDAPConfig objectClass: olcChainDatabase olcDatabase: ldap olcDbURI: ldap://example.com olcDbRebindAsUser: TRUE olcDbIDAssertBind: bindmethod=simple binddn="cn=syncReplUser,dc=example,dc=com" credentials=123456. mode=self flags=prescriptive,proxy-authz-non-critical dn: cn=module,cn=config changetype: add objectClass: olcModuleList cn: module olcModulePath: /usr/lib/ldap olcModuleLoad: ppolicy dn: olcOverlay=ppolicy,olcDatabase={1}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcOverlay: ppolicy olcPPolicyDefault: cn=default,ou=Policies,dc=example,dc=com olcPPolicyHashCleartext: FALSE olcPPolicyUseLockout: FALSE olcPPolicyForwardUpdates: TRUE On Mon, Oct 6, 2014 at 1:20 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Monday, October 06, 2014 2:12 PM -0430 Raul Hernandez < > hernandezr(a)gmail.com> wrote: > > > I've been searching on the Internet how to solve this issue without any >> luck. Can someone point me to the right direction? >> > > You've left out the sync replication configuration for the slave. > > --Quanah > > -- > > Quanah Gibson-Mount > Server Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

LMDB Crash-consistency
by Howard Chu 06 Oct '14

06 Oct '14

Just an fyi... As you would know from reading the LMDB design papers ( http://symas.com/mdb/#pubs ) LMDB is crash-proof by design. A Symas client already confirmed this in their own crash testing last year https://symas.com/carrier-grade-stability-and-performance/ and it has again been verified by a research group at the University of Wisconsin. Their findings are being presented at the Usenix OSDI conference this week, and you can read the paper here https://www.usenix.org/conference/osdi14/technical-sessions/presentation/pi… They report on a single "vulnerability" in LMDB, in which LMDB depends on the atomicity of a single sector 106-byte write for its transaction commit semantics. Their claim is that not all storage devices may guarantee the atomicity of such a write. While I myself filed an ITS on this very topic a year ago, http://www.openldap.org/its/index.cgi/Incoming?id=7668 the reality is that all storage devices made in the past 20+ years actually do guarantee atomicity of single-sector writes. You would have to rewind back to 30 years at least, to find a HDD where this is not true. The UWisc researchers' point is that we cannot say what behaviors will be exported by up--and-coming nonvolatile RAM mechanisms (e.g. MRAM or PCRAM); if they offer byte-addressability instead of sector-addressability then there's a potential for these writes to become non-atomic in the future. At any rate, this issue has zero relevance today, and we are monitoring all of the upcoming NVRAM technologies closely for future developments. The other takeaway from these reports is how critically unreliable many other popular systems are. If you use any of the other projects that were included in this research, you owe it to yourself to rethink that usage, or raise discussions with their developers on how they plan to address their many weaknesses. As an interesting footnote, BerkeleyDB was included in the original testing, and while it was in their preliminary results http://wisdom.cs.wisc.edu/workshops/spring-14/talks/Thanu.pdf it is now conspicuously absent from the final paper. Regardless, the OpenLDAP Project is deprecating use of BerkeleyDB for multiple reasons. Again, if you're still using BDB you need to take a moment to re-evaluate your project. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Issues with Master / Slave and ppolicy
by Raul Hernandez 06 Oct '14

06 Oct '14

Hello! I've implemented in our testing lab, 2 openldap master servers (both configured as mirror mode); 1 HA server with HAproxy (to grant load balancing and tcp proxying to both masters), and 1 openldap slave which synchronizes its data from the masters through the HA server. All writes sent to the slave (add/edit ous and users), are forwarded to the masters. It work as is supposed to. I've also implemented the ppolicy overlay on this architecture, with "olcPPolicyForwardUpdates" set to TRUE on the slave. All authentication failures made on the slave, are sent to the masters so they can manage the policy. Here is the issue: On the slave, after a few write operations, its database misses its base (objectClass: dcObject). On the master, after an ldapsearch to its base I get the following: # example.com dn: dc=example,dc=com objectClass: top objectClass: dcObject objectClass: organization o: Example dc: example # admin, example.com dn: cn=admin,dc=example,dc=com objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator userPassword:: e1NTSEF9V1poc1UwK3VIV0FtMXRMMm1XdE9xU0Y4M3NHY05Qd28= # Test, example.com dn: ou=Test,dc=example,dc=com objectClass: organizationalUnit objectClass: top ou: Test On the slave, after an ldapsearch to its base, I get the following: # Test, example.com dn: ou=Test,dc=example,dc=com objectClass: organizationalUnit objectClass: top ou: Test I can still fetch objects, and make modifications to them from the slave; but tools like PHPLDAPADMIN, which constructs the tree from "dcObject", shows the following message: "This base cannot be created with PLA." All this servers are Debian SID, with slapd 2.4.39. I've been searching on the Internet how to solve this issue without any luck. Can someone point me to the right direction?

2 1

OpenLDAP, SASL and TLS
by Kristof Takacs 06 Oct '14

06 Oct '14

Hello, I have been working on extending an application that searches LDAP server with Kerberos support. I can now bind and then search using the following mechanism: - Simple Bind - Simple Bind with TLS - Kerberos Bind I am having issues when I have Kerberos bind and TLS turned on. I can see the the Kerberos ticket established, the SASL bind to the LDAP server complete, but the LDAP search failing as the message cannot be parsed by the server. I use the following open source libraries: - OpenLDAP - Cyrus SASL - OpenSSL - Heimdal In my debugging, I noticed that there are different writers that are installed in the chain. I turned on debugging, and hence I see these writers called in the order listed: - simple with TLS: sb_debug_write() -> tlso_sb_write() -> sb_debug_write() -> sb_stream_write() - Kerberos Bind: sb_debug_write() -> sb_sasl_generic_write() -> sb_debug_write() -> sb_stream_write() - Kerberos + TLS: sb_debug_write() -> sb_sasl_generic_write() -> sb_debug_write() -> tlso_sb_write() -> sb_debug_write() -> sb_stream_write() Is this a use case that is supposed to work? What could I be missing? Thanks! Kris

2 1

Syncrepl question
by Бажал Дмитрий 06 Oct '14

06 Oct '14

Hey guys. We have syncrepl working and recently got next problem: when trying to rename object, operation succeeds, but syncrepl gets no events for renaming children objects of renamed first one. How do you fix this? Is it ldap server configuration, or am I doing smth wrong with syncrepl client? Fast look into google gave no information. Thanks for your attention (talk is about OpenLDAP 2.4.31)

3 2

MMR with MirrorMode problem..
by Bill Brigden 06 Oct '14

06 Oct '14

Hi all, I'm running 2.4.39 with Mirrormode replication. I've noticed that occasionally when making schema changes, a change will hang indefinitely without reason. Though (possibly as a cause), also I've found that if I try and restart one of the three servers in this replica set, it will occasionally get the following with causes it to hang indefinitely: Oct 1 08:55:37 ldap-03 slapd[19608]: daemon: shutdown requested and initiated. Oct 1 08:55:37 ldap-03 slapd[19608]: slapd shutdown: waiting for 2 operations/tasks to finish The other hosts show the disconnection and try and reconnect - the only way to fix it seems to be either force killing this server or restarting all the other hosts. Any ideas? It's a fairly standard setup with mirrormode as per the doc's. I've seen there is 2.4.40 released however haven't scheduled in an upgrade yet as there wasn't anything on the changelog that appeared to be linked. Cheers

3 3

Re: LMDB internals questions
by Howard Chu 04 Oct '14

04 Oct '14

Valerii Hiora wrote: > Hi Howard, > > I have a couple of questions regarding LMDB. In the future, please send questions to the openldap-technical mailing list. > 1. MDB_INTEGERKEY > >> Setting this option requires all keys to be the same size, typically >> sizeof(int) or sizeof(size_t) > > It is unclear from this description if size of the key depends on arch > or the only requirement is to have all keys to have same size. Is it > possible use i64 keys independent of arch? The documentation is precise - if the actual word size mattered, we would say so. You can use 64 bit integers on any arch. You could use 16 bit or 128 bit as well, it makes no difference. > 2. MDB_DUPSORT - how is it organized internally, i.e. which are > penalties of having big number of items for one key. And how > cheap/expensive is cursor count operation for a key? This is already documented - the values of a dupsort key are their own sub-database. Cursor count just returns md_entries of the subDB. > 3. Multiple databases > >> Currently a moderate number of slots are cheap but a huge number >> gets expensive: 7-120 words per transaction, and every mdb_dbi_open() >> does a linear search of the opened slots. > > So if the space isn't a problem and mdb_dbi_open() is called only once > and returned handle is kept - are there any other penalties for multiple > dbs? Can you also specify "moderate number of slots" to have a better > understanding? You should understand "moderate" as it applies to your own situation. We state quite clearly it does a linear search - you can see how the cost adds up. There are no costs other than those we have documented. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

N-Way Multi-Master authentication problem
by Pocci Francesco 03 Oct '14

03 Oct '14

Hello everyone. I have a big problem releated to 2 OpenLdap configured in N-Way Multi-Master Configuration. My problem isn't on replication, that works, but on authenticating users on DIT !!! Infact when an user tries to simply authenticate himself on DIT with ldapsearch -x -D 'uid=example(a)gmail.com,ou=people,dc=example,dc=com' -w 'password' he receives an ldap_bind: Invalid credentials (49) error. Disabling configurations for multi master replication the same user is able to search on DIT. Following there is one slapd.conf of server 1... allow bind_anon_dn # Schema and objectClass definitions include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/inetorgperson.schema # Additional schemas pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Read slapd.conf(5) for possible values loglevel 0 modulepath /usr/lib64/openldap moduleload syncprov.la serverID 001 backend bdb # FIXME: puppet database bdb suffix "dc=example,dc=com" directory /var/lib/ldap rootdn "cn=admin,dc=example,dc=com" rootpw password checkpoint 512 30 dbconfig set_cachesize 0 2097152 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 #allows read access from all consumers access to * by dn.base="cn=admin,dc=example,dc=com" read by * break syncrepl rid=000 provider=ldap://ldap-be2 type=refreshAndPersist retry="5 5 300 +" searchbase="dc=example,dc=com" attrs="*,+" bindmethod=simple binddn="cn=admin,dc=example,dc=com" credentials=password ########################################################### index objectclass eq index entryCSN eq index entryUUID eq index uidNumber eq index gidNumber eq index cn pres,sub,eq index sn pres,sub,eq index uid pres,sub,eq index displayName pres,sub,eq # mirror mode essential to allow writes #and must appear after all syncrepl directives mirrormode TRUE # define the provider to use the syncprov overlay # (last directives in database section) overlay syncprov # # contextCSN saved to database every 100 updates or ten minutes syncprov-checkpoint 100 10 Slap.conf of 2th server is a copy of this with different serverID and provider. Every hint will be a bless. Best regards. F. Francesco Pocci Open Reply Viale Regina Margherita, 8 00198 - Roma - ITALY phone: +39 06 844341 f.pocci(a)reply.it<mailto:f.pocci@reply.it> www.reply.it [Open Reply] ________________________________ -- The information transmitted is intended for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any computer.

1 0

Ldap performance : help needed
by Jonas Kellens 03 Oct '14

03 Oct '14

Hello list, I have the following rules in /etc/openldap/slapd.conf for about 250 users (cust1 -> cust250). This is an extract for user 'cust22' and user 'cust23' : access to dn.regex="ou=tbook[12345],ou=contacten,ou=cust22,dc=mydomain" attrs=children by group.exact="cn=admins,ou=cust22,dc=mydomain" write by * none break access to dn.one="ou=tbook1,ou=contacten,ou=cust22,dc=mydomain" by group.exact="cn=admins,ou=cust22,dc=mydomain" write by group.exact="cn=tbook1,ou=gebruikers,ou=cust22,dc=mydomain" read access to dn.one="ou=tbook2,ou=contacten,ou=cust22,dc=mydomain" by group.exact="cn=admins,ou=cust22,dc=mydomain" write by group.exact="cn=tbook2,ou=gebruikers,ou=cust22,dc=mydomain" read access to dn.one="ou=tbook3,ou=contacten,ou=cust22,dc=mydomain" by group.exact="cn=admins,ou=cust22,dc=mydomain" write by group.exact="cn=tbook3,ou=gebruikers,ou=cust22,dc=mydomain" read access to dn.one="ou=tbook4,ou=contacten,ou=cust22,dc=mydomain" by group.exact="cn=admins,ou=cust22,dc=mydomain" write by group.exact="cn=tbook4,ou=gebruikers,ou=cust22,dc=mydomain" read access to dn.one="ou=tbook5,ou=contacten,ou=cust22,dc=mydomain" by group.exact="cn=admins,ou=cust22,dc=mydomain" write by group.exact="cn=tbook5,ou=gebruikers,ou=cust22,dc=mydomain" read access to dn.regex="ou=tbook[12345],ou=contacten,ou=cust23,dc=mydomain" attrs=children by group.exact="cn=admins,ou=cust23,dc=mydomain" write by * none break access to dn.one="ou=tbook1,ou=contacten,ou=cust23,dc=mydomain" by group.exact="cn=admins,ou=cust23,dc=mydomain" write by group.exact="cn=tbook1,ou=gebruikers,ou=cust23,dc=mydomain" read access to dn.one="ou=tbook2,ou=contacten,ou=cust23,dc=mydomain" by group.exact="cn=admins,ou=cust23,dc=mydomain" write by group.exact="cn=tbook2,ou=gebruikers,ou=cust23,dc=mydomain" read access to dn.one="ou=tbook3,ou=contacten,ou=cust23,dc=mydomain" by group.exact="cn=admins,ou=cust23,dc=mydomain" write by group.exact="cn=tbook3,ou=gebruikers,ou=cust23,dc=mydomain" read access to dn.one="ou=tbook4,ou=contacten,ou=cust23,dc=mydomain" by group.exact="cn=admins,ou=cust23,dc=mydomain" write by group.exact="cn=tbook4,ou=gebruikers,ou=cust23,dc=mydomain" read access to dn.one="ou=tbook5,ou=contacten,ou=cust23,dc=mydomain" by group.exact="cn=admins,ou=cust23,dc=mydomain" write by group.exact="cn=tbook5,ou=gebruikers,ou=cust23,dc=mydomain" read I notice that there is a huge lack of performance (slow response times) when over about 100 users. There are quite some access rules in slapd.conf at that time. There is about 8 seconds between query and response : Sep 3 14:57:05 slap01 slapd[12908]: conn=1001 fd=13 ACCEPT from IP=xx.xx.xx.xx:1046 (IP=0.0.0.0:389) Sep 3 14:57:05 slap01 slapd[12908]: conn=1001 op=0 BIND dn="cn=Ucust23,ou=cust23,dc=mydomain" method=128 Sep 3 14:57:05 slap01 slapd[12908]: conn=1001 op=0 BIND dn="cn=Ucust23,ou=cust23,dc=mydomain" mech=SIMPLE ssf=0 Sep 3 14:57:05 slap01 slapd[12908]: conn=1001 op=0 RESULT tag=97 err=0 text= Sep 3 14:57:05 slap01 slapd[12908]: conn=1001 op=1 SRCH base="dc=mydomain" scope=2 deref=0 filter="(&(telephoneNumber=*)(sn=t*))" Sep 3 14:57:05 slap01 slapd[12908]: conn=1001 op=1 SRCH attr=cn sn telephoneNumber Sep 3 14:57:13 slap01 slapd[12908]: conn=1001 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Sep 3 14:57:13 slap01 slapd[12908]: conn=1001 op=2 ABANDON msg=2 Sep 3 14:57:13 slap01 slapd[12908]: conn=1001 op=3 UNBIND Sep 3 14:57:13 slap01 slapd[12908]: conn=1001 fd=13 closed Question : how can I get a better performance ? How can I adapt my access rules for better performance ? Thanks ! Kind Regards, Jonas.

4 10

Re: (ITS#7274) delta-syncrepl MMR infinite loop - like issue?
by Quanah Gibson-Mount 03 Oct '14

03 Oct '14

--On Thursday, September 25, 2014 2:46 PM +0200 Francesco Malvezzi <francesco.malvezzi(a)unimore.it> wrote: > During the setup of a mirror mode cluster, I enabled the syncprov after > building the mirror. > > So maybe I run into ITS#7274: > http://www.openldap.org/its/index.cgi/Documentation?id=7274;selectid=7274 > ;statetype=-1 > > delta-syncrepl fails with: > 1) ABANDON log messages on provider; > 2) matching "delta-sync lost" log messages on consumer. > > Do I understand correctly: provider needs contextCSN value for SID=0 in > order to have delta-syncrepl working? No, that is not correct. ITS#7274 was invalid, and had to do very specifically with the way in which I wrote a script to promote a stand-alone master to MMR mode. It does not apply to your situation. More likely, you would be hitting <http://www.openldap.org/its/index.cgi/?findid=7849>. --Quanah -- Quanah Gibson-Mount Server Architect Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

Returned mail: see transcript for details
by richm＠stanfordalumni.org 01 Oct '14

01 Oct '14

Your message was not delivered due to the following reason: Your message could not be delivered because the destination computer was not reachable within the allowed queue period. The amount of time a message is queued before it is returned depends on local configura- tion parameters. Most likely there is a network problem that prevented delivery, but it is also possible that the computer is turned off, or does not have a mail system running right now. Your message was not delivered within 2 days: Host 41.121.38.8 is not responding. The following recipients did not receive this message: <openldap-technical(a)openldap.org> Please reply to postmaster(a)openldap.org if you feel this message to be in error.

1 0

RE: MMR with MirrorMode problem..
by Bill Brigden 01 Oct '14

01 Oct '14

Just as a followup from having the issue now - I force killed and restarted the process as it wouldn't shutdown normally - it came up with: slapd[12047]: @(#) $OpenLDAP: slapd (Feb 27 2014 09:38:39) $#012#011root@debian: slapd[12048]: hdb_db_open: database "dc=test,dc=com": unclean shutdown detected; attempting recovery. slapd[12048]: slapd starting slapd[12048]: => bdb_idl_delete_key: c_get failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30994) slapd[12048]: conn=-1 op=0: attribute "entryCSN" index delete failure Cheers > -----Original Message----- > From: Bill Brigden [mailto:bill@dotbill.co.uk] > Sent: 01 October 2014 09:09 > To: 'openldap-technical(a)openldap.org' > Subject: MMR with MirrorMode problem.. > > Hi all, > > I'm running 2.4.39 with Mirrormode replication. I've noticed that > occasionally when making schema changes, a change will hang indefinitely > without reason. Though (possibly as a cause), also I've found that if I > try and restart one of the three servers in this replica set, it will > occasionally get the following with causes it to hang indefinitely: > > Oct 1 08:55:37 ldap-03 slapd[19608]: daemon: shutdown requested and > initiated. > Oct 1 08:55:37 ldap-03 slapd[19608]: slapd shutdown: waiting for 2 > operations/tasks to finish > > The other hosts show the disconnection and try and reconnect - the only > way to fix it seems to be either force killing this server or restarting > all the other hosts. > > Any ideas? It's a fairly standard setup with mirrormode as per the > doc's. > > I've seen there is 2.4.40 released however haven't scheduled in an > upgrade yet as there wasn't anything on the changelog that appeared to > be linked. > > Cheers

1 0

undefined reference to gnutls_certificate_get_x509_cas -HELP
by lux-integ 01 Oct '14

01 Oct '14

Greetings I am trying to compile openldap-2.4.39 on machine with linux (amd64 cpu) and gnutls-3.3.8. I passed --with-tls=gnutls to the configure options. The 'make' ends in failue with the errors:- " undefined reference to gnutls_certificate_get_x509_cas" " undefined reference to gcry_control" It compiles if I remove the --with-tls=gnutls option but I want to use gnutls. I would be grateful for some help. Yours sincerely luxInteg

2 2

Syncrepl authentication via GSSAPI/SASL/Kerberos
by Steven Presser 30 Sep '14

30 Sep '14

Hi, I'm running a pair of OpenLDAP servers on a network which primarily uses kerberos for authentication. The two servers replicate data (via a simple syncrepl master-slave setup). Right now, they're using simple authentication. I'd like to move them to using kerberos authentication. I've successfully gotten them to the point where the kerberos authentication (appears) to succeed. However, replication doesn't happen with the mysterious error "findbase failed! 32". I have found no mention of this error, other than a couple of permissions-related errors. I double-checked my permissions, so it's not that. I've copied relevant portions of my slapd.conf below and would be happy to provide more if required. I also have a syslog excerpt below. Does anyone know what I should be looking at next or have an example of a functional setup similar to what I've described? Thanks, Steve Functioning syncrepl config: syncrepl rid=1 provider=ldap://ldap1.pressers.name/ type=refreshAndPersist retry="60 30 300 +" searchbase="dc=pressers,dc=name"i bindmethod=simple binddn="cn=repl,dc=pressers,dc=name" credentials="SOMEPASSWORD" Config which fails mysteriously: syncrepl rid=1 provider=ldap://ldap1.pressers.name/ type=refreshAndPersist retry="60 30 300 +" searchbase="dc=pressers,dc=name"i bindmethod=sasl saslmech=gssap Finally, an excerpt for syslog on the master when the client attempts to connect: Sep 30 13:11:09 hawking slapd[1620]: conn=1005 fd=18 ACCEPT from IP=10.0.0.3:57149 (IP=0.0.0.0:389) Sep 30 13:11:09 hawking slapd[1620]: conn=1005 op=0 BIND dn="" method=163 Sep 30 13:11:09 hawking slapd[1620]: GSSAPI server step 1 Sep 30 13:11:09 hawking slapd[1620]: conn=1005 op=0 RESULT tag=97 err=14 text=SASL(0): successful result: Sep 30 13:11:09 hawking slapd[1620]: conn=1005 op=1 BIND dn="" method=163 Sep 30 13:11:09 hawking slapd[1620]: GSSAPI server step 2 Sep 30 13:11:09 hawking slapd[1620]: conn=1005 op=1 RESULT tag=97 err=14 text=SASL(0): successful result: Sep 30 13:11:09 hawking slapd[1620]: conn=1005 op=2 BIND dn="" method=163 Sep 30 13:11:09 hawking slapd[1620]: GSSAPI server step 3 Sep 30 13:11:09 hawking slapd[1620]: conn=1005 op=2 BIND authcid="ldap/mordor.pressers.name" authzid="ldap/mordor.pressers.name" Sep 30 13:11:09 hawking slapd[1620]: conn=1005 op=2 BIND dn="uid=ldap/mordor.pressers.name,cn=gssapi,cn=auth" mech=GSSAPI sasl_ssf=56 ssf=56 Sep 30 13:11:09 hawking slapd[1620]: conn=1005 op=2 RESULT tag=97 err=0 text= Sep 30 13:11:09 hawking slapd[1620]: conn=1005 op=3 SRCH base="dc=pressers,dc=name" scope=2 deref=0 filter="(objectClass=*)" Sep 30 13:11:09 hawking slapd[1620]: conn=1005 op=3 SRCH attr=* + Sep 30 13:11:09 hawking slapd[1620]: findbase failed! 32 Sep 30 13:11:09 hawking slapd[1620]: conn=1005 op=3 SEARCH RESULT tag=101 err=32 nentries=0 text= Sep 30 13:11:09 hawking slapd[1620]: conn=1005 op=4 UNBIND Sep 30 13:11:09 hawking slapd[1620]: conn=1005 fd=18 closed

3 6

MMR - Add and delete entry on on server, CSN too old on the other and the entry is not deleted
by Meunier, Antonin 30 Sep '14

30 Sep '14

Hello, I'm with openldap-2.4.39. I've 2 openldap server on MMR, the config is down to the mail. On the 1st server, il made - ADD an entry - Little after (1h) DELETE the same entry On the second server, I have : - The entry is created by replication - BUT the entry is not delete by the replication with a CSN too old error. How can i resolv this ? Thanks by advance Extract of the logs is : On 1st server (where entry is add and delete) : 2014-09-16T01:59:09.161478+02:00 ldapp01 slapd[19641]: conn=6131651 op=5367 ADD dn="cn=1952991,ou=groupe..." 2014-09-16T02:57:46.499274+02:00 ldapp01 slapd[19641]: conn=6153444 op=24 DEL dn="cn=1952991,ou=groupe_..." ... 2014-09-16T04:44:01.713257+02:00 ldapp01 slapd[19641]: syncprov_search_response: cookie=rid=000,sid=001,csn=20140916024243.636498Z#000000#001#000000;20140830211826.755872Z#000000#002#000000;20131010140905.564563Z#000000#065#000000;20130913220003.060576Z#000000#12b#000000;20131206221310.808393Z#000000#12d#000000 2014-09-16T04:44:01.713299+02:00 ldapp01 slapd[19641]: syncprov_sendresp: cookie=rid=000,sid=001,csn=20140916024342.267736Z#000000#001#000000 2014-09-16T04:44:01.906746+02:00 ldapp01 slapd[19641]: conn=6183327 op=1 UNBIND On the Second server (where entry persist without delete) : 2014-09-16T04:29:28.462968+02:00 ldapp02 slapd[12536]: syncrepl_message_to_op: rid=102 be_add cn=1952991,ou=groupe... (0) 2014-09-16T04:29:28.462968+02:00 ldapp02 slapd[12536]: syncrepl_message_to_op: rid=102 be_add cn=1952991,ou=groupe... (0) 2014-09-16T04:29:28.462978+02:00 ldapp02 slapd[12536]: slap_queue_csn: queing 0x7f0f505698d0 20140915235909.161585Z#000000#001#000000 2014-09-16T04:29:28.463051+02:00 ldapp02 slapd[12536]: slap_graduate_commit_csn: removing 0x7f0f50568740 20140915235909.161585Z#000000#001#000000 2014-09-16T04:29:28.463076+02:00 ldapp02 slapd[12536]: do_syncrep2: rid=102 cookie=rid=000,sid=001,csn=20140915235909.166279Z#000000#001#000000 2014-09-16T04:29:28.463113+02:00 ldapp02 slapd[12536]: slap_queue_csn: queing 0x7f0f5056e6ee 20140915235909.166279Z#000000#001#000000 2014-09-16T04:29:28.464678+02:00 ldapp02 slapd[12536]: slap_queue_csn: queing 0x7f0f5055f710 20140915235909.166279Z#000000#001#000000 2014-09-16T04:29:28.464860+02:00 ldapp02 slapd[12536]: syncprov_matchops: skipping original sid 001 2014-09-16T04:29:28.464870+02:00 ldapp02 slapd[12536]: slap_graduate_commit_csn: removing 0x7f0f50556380 20140915235909.166279Z#000000#001#000000 2014-09-16T04:29:28.464880+02:00 ldapp02 slapd[12536]: slap_graduate_commit_csn: removing 0x7f0f50563df0 20140915235909.166279Z#000000#001#000000 ... 2014-09-16T04:44:01.653713+02:00 ldapp02 slapd[12536]: do_syncrep2: rid=102 cookie=rid=000,sid=001,csn=20140915235909.166279Z#000000#001#000000 2014-09-16T04:44:01.653740+02:00 ldapp02 slapd[12536]: do_syncrep2: rid=102 CSN too old, ignoring 20140915235909.166279Z#000000#001#000000 (reqStart=20140915235909.000007Z,cn=de lta-sync) .. 2014-09-16T04:44:01.653619+02:00 ldapp02 slapd[12536]: do_syncrep2: rid=102 cookie=rid=000,sid=001,csn=20140915235909.161585Z#000000#001#000000 2014-09-16T04:44:01.653646+02:00 ldapp02 slapd[12536]: do_syncrep2: rid=102 CSN too old, ignoring 20140915235909.161585Z#000000#001#000000 (reqStart=20140915235909.000005Z,cn=de lta-sync) Configuration is : On the 1st server : . ServerID 001 . maxderefdepth 15 readonly FALSE sync_use_subentry FALSE . dbnosync TRUE # ecriture tous les 15 minutes checkpoint 0 15 . syncrepl rid=201 provider=ldap://ldapp02:389 type=refreshAndPersist retry="5 5 300 +" searchbase="dc=ent,dc=fr" attrs="*,+" bindmethod=simple binddn="cn=admin,ou=system,dc=ent,dc=fr" credentials=XXXXXXX logbase="cn=delta-sync" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" syncdata=accesslog mirrormode on # Overlay configuration should be added after the database configuration # Définition de l'overlay lié à la réplication maitre overlay syncprov syncprov-checkpoint 100 10 On the second server : ServerID 002 . maxderefdepth 15 readonly FALSE sync_use_subentry FALSE . dbnosync TRUE # ecriture tous les 15 minutes checkpoint 0 15 . syncrepl rid=102 provider=ldap://ldapp01:389 type=refreshAndPersist retry="5 5 300 +" searchbase="dc=ent,dc=fr" attrs="*,+" bindmethod=simple binddn="cn=admin,ou=system,dc=ent,dc=fr" credentials=XXXXXXX logbase="cn=delta-sync" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" syncdata=accesslog mirrormode on # Overlay configuration should be added after the database configuration # Définition de l'overlay lié à la réplication maitre overlay syncprov syncprov-checkpoint 100 10 Antonin Meunier

2 3

OpenLDAP manual sync (on-demand replication)
by Peter Boguszewski 30 Sep '14

30 Sep '14

I would like to setup a Master / Consumer relationship that only does one way replication on demand. We have complex scripts that update one server (the master) and needs to be verified / approved before replicating to the consumer. I understand how to setup replication in general and have a multi-master setup for other services so I am not asking how to do initial setup. My first thought is to set the replication interval to 30 days and forcing a manual sync - but this is the part I am not sure how to do. Is there a command to force a manual sync before the normal replication interval? Thanks in advance and sorry if there is a simple answer I am missing. Thanks for any help! -- Peter Boguszewski Manager of Library Systems UW Madison - Library Technology Group pboguszewski(a)library.wisc.edu 608.262.4768

3 3

access control with pbind overlay
by Ferenc Wagner 29 Sep '14

29 Sep '14

Hi, I've got a partial syncrepl replica, which (among others) misses the userPassword attributes of the provider database. I added a pbind overlay to the replica, which forwards binds to the provider, thus it became possible to do simple binds against the replica. But access control on the replica does not honor these binds properly: "by users" works, but "by self" does not. Before I waste too much time debugging: is it supposed to work at all? I tested this under 2.4.31 with: dn: olcDatabase={1}mdb,cn=config olcAccess: to * by dn.exact=gidNumber=119+uidNumber=116,cn=peercred,cn=external,cn=auth read by self read by * none olcSyncrepl: rid=1 [...] The external auth part works, and if I replace self with users, that works as well (but is not what I want). Do I expect too much? -- Thanks, Feri.

2 5

can a automountMap be associated with a nisNetgroup
by Dal tee 26 Sep '14

26 Sep '14

Hi, I'm trying to see if I can control which mounts get mounted based on a servers netgroup membership. I suppose the first question is... Can it be done. I'm using an openldap client on RHEL 6.2 accessing AD. Has anyone got a working example they can walk through ?

1 0

Help: Query unmodified non SSHA userPasswords
by Ulrich Windl 26 Sep '14

26 Sep '14

Hi! I'd like to query userPassword attributes that don't start with "{SSHA", but it seems substring match doesn't work there. An addition I'd like to find those users that didn't change their password since the user was created, i.e. modifyTimestamp=createTimestamp, but I think that's not possible in a search filter as the right of '=' is interpreted literally, right? Any ideas? Regards, Ulrich

4 5

Sync Repl - mirror mode - rid=001 LDAP_RES_INTERMEDIATE - REFRESH_DELETE
by Sterling Sahaydak 25 Sep '14

25 Sep '14

I've upgraded my 2 ldap servers to 2.4.39 and have been trying to get mirror mode to work with no luck. I've removed out for now TLS and using ldap:/// The issue I've had since 2.4.23 version and now is "LDAP_RES_INTERMEDIATE - REFRESH_DELETE" Everything else works but have run into this issue that can't resolve. I've looked up in the forum for other references to this, but not seeing a clear resolution. Others, keep getting additional messages beyond this, but mine stops at this. I've tried running also with slapd -h "ldapi:/// ldap:///" -d 7 but getting stuck as well Your help is greatly appreciated! [root@ldap-east ~]# slapd -d sync 54243242 @(#) $OpenLDAP: slapd 2.4.39 (Sep 17 2014 15:14:19) $ root@admin.xxxxx.net:/root/rpmbuild/BUILD/openldap-2.4.39/openldap-2.4.39/servers/slapd 54243242 /etc/openldap/slapd.conf: line 226: rootdn is always granted unlimited privileges. 54243242 slapd starting 54243242 do_syncrep2: rid=001 LDAP_RES_INTERMEDIATE - REFRESH_DELETE Provider/Master side - slapd.conf (ldap-east) ------------------------------------------- include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/sudo.schema allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args modulepath /usr/lib/openldap modulepath /usr/lib64/openldap moduleload accesslog.la moduleload rwm.la moduleload syncprov.la disallow bind_anon moduleload back_bdb moduleload back_ldap backend bdb database monitor access to * by dn.exact="cn=Manager,dc=xxxxx,dc=net" read by * none database bdb suffix "dc=xxxxx,dc=net" checkpoint 1024 15 rootdn "cn=Manager,dc=xxxxx,dc=net" rootpw xxxxx directory /var/lib/ldap access to * by dn.base="cn=TestSync,ou=Roles,dc=xxxxx,dc=net" write by * break access to attrs=userPassword,shadowLastChange by dn="cn=Manager,dc=xxxxx,dc=net" write by anonymous auth by self write by * none index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index entryCSN,entryUUID eq serverID 1 overlay syncprov syncprov-checkpoint 100 1 syncprov-sessionlog 100 #LDAP Sync - Slave syncrepl rid=001 provider=ldap://ldap-west.xxxxx.net bindmethod=simple binddn="cn=TestSync,ou=Roles,dc=xxxxx,dc=net" credentials="xxxxxx" searchbase="dc=xxxxx,dc=net" schemachecking=off type=refreshAndPersist retry="60 +" filter="(objectclass=*)" attrs="*,+" mirrormode on loglevel -1 Consumer/Slave side - slapd.conf (ldap-west) - only difference is the replication section ------------------------------------------- .... serverID 2 overlay syncprov syncprov-checkpoint 100 1 syncprov-sessionlog 100 #LDAP Sync - Master syncrepl rid=001 provider=ldap://ldap-east.xxxxx.net bindmethod=simple binddn="cn=TestSync,ou=Roles,dc=xxxxx,dc=net" credentials="xxxxxx" searchbase="dc=xxxxx,dc=net" schemachecking=off type=refreshAndPersist retry="60 +" filter="(objectclass=*)" attrs="*,+" mirrormode on

1 0

(ITS#7274) delta-syncrepl MMR infinite loop - like issue?
by Francesco Malvezzi 25 Sep '14

25 Sep '14

During the setup of a mirror mode cluster, I enabled the syncprov after building the mirror. So maybe I run into ITS#7274: http://www.openldap.org/its/index.cgi/Documentation?id=7274;selectid=7274;s… delta-syncrepl fails with: 1) ABANDON log messages on provider; 2) matching "delta-sync lost" log messages on consumer. Do I understand correctly: provider needs contextCSN value for SID=0 in order to have delta-syncrepl working? Does the following query confirm the lack of the contextCSN value for SID=0? ldapsearch -ZZ -h ldap.example.org -LLL -x -s base -b dc=example,dc=org contextCSN dn: dc=example,dc=org contextCSN: 20140925113354.230424Z#000000#001#000000 contextCSN: 20140925113307.523494Z#000000#002#000000 If the mirror mode cluster is in production, do I have any hope to setup delta-syncrepl? Thank you, Francesco

1 0

slapo-refint not working on consumer.
by Mike Hulsman 25 Sep '14

25 Sep '14

Hi, When testing slapo-refint functionality in a configuration with mirror node masters, and a Delta-syncrepl consumer. I see that refint is working between the 2 providers, but not on the consumer. Using Openldap 2.4.39 on all instances. Database is hdb After renaming a uid the ContextCSN on all instances are the same, so changes are propagated successful. Every change if replicated properly, except for refint on a consumer. The refint configuration: overlay refint refint_attributes uniqueMember refint_nothing cn=Manager,o=test The logfile on the consumer: Sep 23 17:05:12 sldapa01 slapd[1727]: do_syncrep2: rid=101 cookie=rid=101,sid=001,csn=20140923150512.298991Z#000000#001#000000 Sep 23 17:05:12 sldapa01 slapd[1727]: syncrepl_message_to_entry: rid=101 DN: uid=108284.22593,ou=users,o=test, UUID: 7d4fb488-a789-1033-9f1d-cd9d692f2885 Sep 23 17:05:12 sldapa01 slapd[1727]: syncrepl_entry: rid=101 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_MODIFY) Sep 23 17:05:12 sldapa01 slapd[1727]: => bdb_filter_candidates Sep 23 17:05:12 sldapa01 slapd[1727]: #011AND Sep 23 17:05:12 sldapa01 slapd[1727]: => bdb_list_candidates 0xa0 Sep 23 17:05:12 sldapa01 slapd[1727]: => bdb_filter_candidates Sep 23 17:05:12 sldapa01 slapd[1727]: #011EQUALITY Sep 23 17:05:12 sldapa01 slapd[1727]: <= bdb_filter_candidates: id=1 first=102822 last=102822 Sep 23 17:05:12 sldapa01 slapd[1727]: <= bdb_list_candidates: id=1 first=102822 last=102822 Sep 23 17:05:12 sldapa01 slapd[1727]: <= bdb_filter_candidates: id=1 first=102822 last=102822 Sep 23 17:05:12 sldapa01 slapd[1727]: => test_filter Sep 23 17:05:12 sldapa01 slapd[1727]: EQUALITY Sep 23 17:05:12 sldapa01 slapd[1727]: <= test_filter 6 Sep 23 17:05:12 sldapa01 slapd[1727]: syncrepl_entry: rid=101 be_search (0) Sep 23 17:05:12 sldapa01 slapd[1727]: syncrepl_entry: rid=101 uid=108284.22593,ou=users,o=test Sep 23 17:05:12 sldapa01 slapd[1727]: slap_queue_csn: queing 0x7ff278108d90 20140923150512.298991Z#000000#001#000000 Sep 23 17:05:12 sldapa01 slapd[1727]: slap_graduate_commit_csn: removing 0x7ff27b1f5150 20140923150512.298991Z#000000#001#000000 Sep 23 17:05:12 sldapa01 slapd[1727]: syncrepl_entry: rid=101 be_modrdn uid=118284.22593,ou=users,o=test Sep 23 17:05:12 sldapa01 slapd[1727]: slap_queue_csn: queing 0x7ff278108d90 20140923150512.298991Z#000000#001#000000 Sep 23 17:05:12 sldapa01 slapd[1727]: slap_graduate_commit_csn: removing 0x7ff27b1f3260 20140923150512.298991Z#000000#001#000000 Logfile on mirror mode master: Sep 23 17:05:11 mldapa01 slapd[2237]: do_syncrep2: rid=100 cookie=rid=100,sid=001,csn=20140923150512.298991Z#000000#001#000000 Sep 23 17:05:11 mldapa01 slapd[2237]: syncrepl_message_to_entry: rid=100 DN: uid=108284.22593,ou=users,o=test, UUID: 7d4fb488-a789-1033-9f1d-cd9d692f2885 Sep 23 17:05:11 mldapa01 slapd[2237]: syncrepl_entry: rid=100 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_MODIFY) Sep 23 17:05:11 mldapa01 slapd[2237]: => bdb_filter_candidates Sep 23 17:05:11 mldapa01 slapd[2237]: #011AND Sep 23 17:05:11 mldapa01 slapd[2237]: => bdb_list_candidates 0xa0 Sep 23 17:05:11 mldapa01 slapd[2237]: => bdb_filter_candidates Sep 23 17:05:11 mldapa01 slapd[2237]: #011EQUALITY Sep 23 17:05:11 mldapa01 slapd[2237]: <= bdb_filter_candidates: id=1 first=102822 last=102822 Sep 23 17:05:11 mldapa01 slapd[2237]: <= bdb_list_candidates: id=1 first=102822 last=102822 Sep 23 17:05:11 mldapa01 slapd[2237]: <= bdb_filter_candidates: id=1 first=102822 last=102822 Sep 23 17:05:11 mldapa01 slapd[2237]: => test_filter Sep 23 17:05:11 mldapa01 slapd[2237]: EQUALITY Sep 23 17:05:11 mldapa01 slapd[2237]: <= test_filter 6 Sep 23 17:05:11 mldapa01 slapd[2237]: syncrepl_entry: rid=100 be_search (0) Sep 23 17:05:11 mldapa01 slapd[2237]: syncrepl_entry: rid=100 uid=108284.22593,ou=users,o=test Sep 23 17:05:11 mldapa01 slapd[2237]: slap_queue_csn: queing 0x7f270b394ad0 20140923150512.298991Z#000000#001#000000 Sep 23 17:05:11 mldapa01 slapd[2237]: syncprov_matchops: skipping original sid 001 Sep 23 17:05:11 mldapa01 slapd[2237]: slap_graduate_commit_csn: removing 0x7f27120a2200 20140923150512.298991Z#000000#001#000000 Sep 23 17:05:11 mldapa01 slapd[2237]: syncprov_matchops: skipping original sid 001 Sep 23 17:05:11 mldapa01 slapd[2237]: => bdb_filter_candidates Sep 23 17:05:11 mldapa01 slapd[2237]: #011AND Sep 23 17:05:11 mldapa01 slapd[2237]: => bdb_list_candidates 0xa0 Sep 23 17:05:11 mldapa01 slapd[2237]: => bdb_filter_candidates Sep 23 17:05:11 mldapa01 slapd[2237]: #011OR Sep 23 17:05:11 mldapa01 slapd[2237]: => bdb_list_candidates 0xa1 Sep 23 17:05:11 mldapa01 slapd[2237]: => bdb_filter_candidates Sep 23 17:05:11 mldapa01 slapd[2237]: #011EQUALITY Sep 23 17:05:11 mldapa01 slapd[2237]: syncrepl_entry: rid=100 be_modrdn uid=118284.22593,ou=users,o=test Sep 23 17:05:11 mldapa01 slapd[2237]: <= bdb_filter_candidates: id=0 first=0 last=0 Sep 23 17:05:11 mldapa01 slapd[2237]: => bdb_filter_candidates Sep 23 17:05:11 mldapa01 slapd[2237]: #011OR Sep 23 17:05:11 mldapa01 slapd[2237]: => bdb_list_candidates 0xa1 Sep 23 17:05:11 mldapa01 slapd[2237]: => bdb_filter_candidates Sep 23 17:05:11 mldapa01 slapd[2237]: #011EXT Sep 23 17:05:11 mldapa01 slapd[2237]: <= bdb_filter_candidates: id=-1 first=1 last=102893 Sep 23 17:05:11 mldapa01 slapd[2237]: <= bdb_list_candidates: id=-1 first=1 last=102893 Sep 23 17:05:11 mldapa01 slapd[2237]: <= bdb_filter_candidates: id=-1 first=1 last=102893 Sep 23 17:05:11 mldapa01 slapd[2237]: <= bdb_list_candidates: id=-1 first=1 last=102893 Sep 23 17:05:11 mldapa01 slapd[2237]: <= bdb_filter_candidates: id=-1 first=1 last=102893 Sep 23 17:05:11 mldapa01 slapd[2237]: <= bdb_list_candidates: id=-1 first=1 last=102893 Sep 23 17:05:11 mldapa01 slapd[2237]: <= bdb_filter_candidates: id=-1 first=1 last=102893 Sep 23 17:05:11 mldapa01 slapd[2237]: => test_filter Sep 23 17:05:11 mldapa01 slapd[2237]: OR Sep 23 17:05:11 mldapa01 slapd[2237]: => test_filter_or Sep 23 17:05:11 mldapa01 slapd[2237]: => test_filter Sep 23 17:05:11 mldapa01 slapd[2237]: EXT Sep 23 17:05:11 mldapa01 slapd[2237]: <= test_filter 5 Sep 23 17:05:11 mldapa01 slapd[2237]: <= test_filter_or 5 Sep 23 17:05:11 mldapa01 slapd[2237]: <= test_filter 5 Sep 23 17:05:11 mldapa01 slapd[2237]: => test_filter

2 3

way to validate server certificate
by Bin Lu 25 Sep '14

25 Sep '14

Hi, Does openldap provide APIs to do server certificate validation? Can I retrieve the server cert from LDAP connection and do the validation myself or by passing the trusted CA list openldap will do it (in this case, how the hostname matching with the subject DN is performed)? Thanks a lot in advance, -blu

6 11

Delta-syncrepl Consumer refresh entry
by unimore 25 Sep '14

25 Sep '14

Hi all, once in a while, a modification entry in cn=accesslog on provider is lost by consumer (both openldap-2.4.39). Later modifies on the same entry are cought up, but entry is now inconsistent. If I am right, eventually a "janitor process" recognizes messed up entries and fixes them, but in my limited scenario it could take hours. Is there a way to force consumer to refresh a given entry? Thank you for your patience, Francesco

2 1

unique overlay on a per branch basis
by Craig White 24 Sep '14

24 Sep '14

Assuming branches like: ou=people,ou=company1,dc=example,dc=com ou=people,ou=company2,dc=example,dc=com Is it possible to use a regular expression in the configuration to ensure a unique uid attribute in each branch but allow an identical uid attribute in different companies like: uid=Bob,ou=people,ou=company1,dc=example,dc=com uid=Bob,ou=people,ou=company2,dc=example,dc=com I ask because the man page for slapo-unique seems to suggest only absolute dn's Craig White System Administrator O 623-201-8179 M 602-377-9752 [cid:image001.png@01CF86FE.42D51630] SkyTouch Technology 4225 E. Windrose Dr. Phoenix, AZ 85032

2 1

troubles while setting-up ldap server + pam
by Ivaylo Ganchev 24 Sep '14

24 Sep '14

Hello, I am installing openldap in my cathedra and am running into a strange problem. Currently I configured the server and imported some entries (from the existing nis base). Then I set-up a client station. Unfortunately I am currently unable to log-in with a user account on the client station. The strange problem consists in the following : - When I use libnss_ldap and libpam_ldap the client sends multiple requests, receives multiple answers (with correct values for the given user), but then at one moment the server sends a FIN,ACK packet and in the auth.log of the client machine I see a message saying "failed to bind to ldap server" or something like this. I get this information from a network analyzer. From the server side everything seems OK. - When I use libnss_ldapd and libpam_ldapd, the communication is OK, but it seems that the client is not asking for the userPassword agrument and so, there is no way to login (it only asks for "loginShell cn gidNumber uidNumber objectClass homeDirectory gecos uid" and then in another request "shadowExpire shadowInactive shadowFlag shadowWarning shadowLastChange uid shadowMin shadowMax" I am able to make a ldapsearch from the client side with the binddn specified in the pam_ldap.conf and libnss_ldap.conf and all the information is successfully retrieved. Any advices are welcomed. Thanks, -- Ivaylo

3 3

Hi Need some help regarding OpenLDAP customize schema configuration.
by Abhishek koserwal 24 Sep '14

24 Sep '14

To generate slapd.conf to xyzschema.ldif Using this *slapcat -f slapd.conf.schemaname -F /tmp/schema -n0 -s cn=schema,cn=config* Schema file has been created. But when I am trying to add this schema using *ldapadd -D cn=admin, cn=config -W -f cn\=\{0\}schemaname.ldif* Getting *Error ldap_bind: Invalid credentials (49)* I figure out that my credentials are not configured properly. So, I create a: manage.ldif file dn: olcDatabase={1}bdb,cn=config changetype: modify replace: olcRootPW olcRootPW: {SHA}GvyYSUqNK/Uo/Cva399YZUPUFNM= Used *ldapmodify -Y EXTERNAL -H ldapi:/// -f manager.ldif* *SASL/EXTERNAL authentication started* *SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth* *SASL SSF: 0* *modifying entry "olcDatabase={1}bdb,cn=config"* But still, when I am trying to add my customize schema, getting same error *Error ldap_bind: Invalid credentials (49)* Please fine the Attachment, * /etc/ldap/slapd.d/cn=config/olcDatabase={1}bdb.ldif* System configuration: Ubuntu 14.04 Installed slapd: apt-get install slapd ldap-utils Than, Configured by:- dpkg reconfigure slapd dc=my-xyxdomain, dc=com used: bdb Later configured phpldapadmin. Working fine. Regards Abhishek Koserwal Final year, CSE, IET-DAVV The capacity to learn is a gift; The ability to learn is a skill; The > willingness to learn is a choice -- Brian Herbert >

2 1

Problem: LDAP installation without internet
by Patrick Pat 23 Sep '14

23 Sep '14

Hi, I would like all LDAP installation procedure without internet in linux (ubuntu (9.10 or other), Debian, ...), but by its compressed file namely: openldap-2.4.8.tgz or openldap-2.4.7.tgz or openldap-2.4.9.tgz or openldap-2.0-beta.tgz ... And any configuration environment variables. best regards !

2 1

for aia and cdp; crl and ca publishing in ldap
by lux-integ 23 Sep '14

23 Sep '14

Greetings, I am learning to use openldap. I want to publish CA certificates and crls ( in der format ) in an ldap database. I came accross this link http://www.tldp.org/HOWTO/archived/LDAP-Implementation-HOWTO/certificates.h… ) it relates to publishing 1 certificate. However, I would like to be able to use one entry in the database to later access 2 objects by URL entry (i) so called AuthorityInformationAccess (CA certificate location ) and (ii) CDP (crl distribution point. So I have 2 questions: QUESTION1 ========= I would like to know if I can publish 2 certififates and in the ldif have someting such as :- #----------- dn: cn=certs,dc=example,dc=com ObjectClass: Top ObjectClass: ApplicationProcess ObjectClass: SimpleSecurityObject CertificateRevocationList::-------someBinaryFile CACertificate::-------------------someBinaryFile cn: certs UserPassword: cert-password QUESTION2 ========= if I have the files binary File_crl and CAcertificate can I replace lines 5 and 6 above like this?: CertificateRevocationList;binary: < /path/to/someBinaryFile_File_crl CACertificate;binary: < /path/to/someBinaryFile_CACertificate and if so which is the recommended file insertion or use of pointer? Advice on the above or better methods to proceed will be gratefully received. thanks in advance luxInteg

1 0

Hi, I need help regarding customize schema regarding OpenLDAD 2.4.39 configuration.
by Abhishek koserwal 22 Sep '14

22 Sep '14

Hi, I need some reference material regarding "How to configure customize schema" in OpenLdap2.4.x. I have some schema files of version 2.3<, when slapd.conf were used. I am want to import those schema into new Openldap.2.4.39 . I have gone through Admin guide tried some methods but, I didn't get much help from it. Kindly help me or whom should I contact or any specific materials. Thank You, Abhishek koserwal,

4 4

Updates to OIDs
by Brendan Kearney 19 Sep '14

19 Sep '14

list, i am wondering what the right way is to introduce new OIDs, or request that new OIDs be introduced, to existing schemas. the ipNetwork class could benefit with a couple new optional attributes. the ipNetworkVLAN (only a suggested name) can be used to indicate the VLAN associated with an ipNetworkNumber. due to the increasing use of VLANs, the datapoint being represented in LDAP makes sense to me. another seemingly logical OID would be ipNetCIDR (suggestion only) which would be similar to the ipNetmaskNumber, but would be the short form notation. thank you, brendan kearney

3 4

Trying to perform mirror sync , but getting - TLS: error: the certificate '/etc/openldap/certs/xxx.crt' could not be found in the database - error -12285:Unable to find the certificate or key necessary for authentication.
by Sterling Sahaydak 18 Sep '14

18 Sep '14

I've recently updated both my openldap servers to 2.4.39 version and everything seems to be working EXCEPT the mirror synchronization which was the issue I had previously with 2.4.23 Running on CentOS 6.5 Setup - Server1(provider): ldap-east.xxxxx.net Server2(consumer): ldap-west.xxxxx.net Not using self signed certs. Instead have a SAN(Subject Alternative Name)cert from DigiCert with 4 hostnames: ldap.xxxxx.net ldap-1.xxxxx.net ldap-2.xxxxx.net ldap-alt.xxxxx.net I'm using slapd.conf vs cn=config. The details: [root@ldap-east certs]# slapd -d sync 541b16ed @(#) $OpenLDAP: slapd 2.4.39 (Sep 16 2014 19:42:16) $ root@admin.pcoral.net:/root/rpmbuild/BUILD/openldap-2.4.39/openldap-2.4.39/servers/slapd 541b16ed /etc/openldap/slapd.conf: line 165: warning, destination attributeType 'sAMAccountName' is not defined in schema 541b16ed PROXIED attributeDescription "SAMACCOUNTNAME" inserted. 541b16ed /etc/openldap/slapd.conf: line 215: rootdn is always granted unlimited privileges. 541b16ed bdb_monitor_db_open: monitoring disabled; configure monitor database to enable 541b16ed slapd starting TLS: error: the certificate '/etc/openldap/certs/ldap_xxxxx_net.crt' could not be found in the database - error -12285:Unable to find the certificate or key necessary for authentication.. TLS: certificate '/etc/openldap/certs/ldap_xxxxx_net.crt' successfully loaded from PEM file. TLS: no unlocked certificate for certificate 'CN=ldap.xxxxx.net,O="xxxxxx, INC.",L=Alviso,ST=California,C=US'. 541b16ed do_syncrep2: rid=001 LDAP_RES_INTERMEDIATE - REFRESH_DELETE *** I wonder if there is something about SAN certs where ldap is having issues ? *** Since it is a signed CA cert in a mirror sync setup do I need to set it up in the local CA(using certutil) and add it? (didn't have to for non-sync use) *** Unclear of 'not found in database' - which one? I've tried adding it using certutil in various permutations of setting adding the cert to the local CA database with all the various SAN names as different nick names *** I've also setup symlinks in /etc/openldap/certs pointing from the hashes -> certs - but all of these with the exact same output as above. >From the debug log: Sep 18 13:39:30 ldap-east slapd[18966]: @(#) $OpenLDAP: slapd 2.4.39 (Sep 16 2014 19:42:16) $#012#011root@admin.xxxxx.net:/root/rpmbuild/BUILD/openldap-2.4.39/openldap-2.4.39/servers/slapd Sep 18 13:39:30 ldap-east slapd[18966]: /etc/openldap/slapd.conf: line 165: warning, destination attributeType 'sAMAccountName' is not defined in schema Sep 18 13:39:30 ldap-east slapd[18966]: PROXIED attributeDescription "SAMACCOUNTNAME" inserted. Sep 18 13:39:30 ldap-east slapd[18966]: /etc/openldap/slapd.conf: line 215: rootdn is always granted unlimited privileges. Sep 18 13:39:30 ldap-east slapd[18966]: >>> dnNormalize: <cn=Subschema> Sep 18 13:39:30 ldap-east slapd[18966]: <<< dnNormalize: <cn=subschema> Sep 18 13:39:30 ldap-east slapd[18966]: matching_rule_use_init Sep 18 13:39:30 ldap-east slapd[18966]: 1.2.840.113556.1.4.804 (integerBitOrMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 1.2.840.113556.1.4.804 NAME 'integerBitOrMatch' APPLIES ( supportedLDAPVersion $ entryTtl $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcIndexIntLen $ olcListenerThreads $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcWriteTimeout $ olcDbCacheFree $ olcDbCacheSize $ olcDbDNcacheSize $ olcDbIDLcacheSize $ olcDbSearchStack $ olcDbShmKey $ olcDbMaxReaders $ olcDbMaxSize $ olcSpSessionlog $ olcDbProtocolVersion $ olcDbConnectionPoolMax $ olcChainMaxReferralDepth $ mailPreferenceOption $ shadowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpire $ shadowFlag $ ipServicePort $ ipProtocolNumber $ oncRpcNumber $ sudoOrder ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 1.2.840.113556.1.4.803 (integerBitAndMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 1.2.840.113556.1.4.803 NAME 'integerBitAndMatch' APPLIES ( supportedLDAPVersion $ entryTtl $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcIndexIntLen $ olcListenerThreads $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcWriteTimeout $ olcDbCacheFree $ olcDbCacheSize $ olcDbDNcacheSize $ olcDbIDLcacheSize $ olcDbSearchStack $ olcDbShmKey $ olcDbMaxReaders $ olcDbMaxSize $ olcSpSessionlog $ olcDbProtocolVersion $ olcDbConnectionPoolMax $ olcChainMaxReferralDepth $ mailPreferenceOption $ shadowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpire $ shadowFlag $ ipServicePort $ ipProtocolNumber $ oncRpcNumber $ sudoOrder ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 1.3.6.1.4.1.1466.109.114.2 (caseIgnoreIA5Match): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 1.3.6.1.4.1.1466.109.114.2 NAME 'caseIgnoreIA5Match' APPLIES ( altServer $ olcDbConfig $ c $ mail $ dc $ associatedDomain $ email $ aRecord $ mDRecord $ mXRecord $ nSRecord $ sOARecord $ cNAMERecord $ janetMailbox $ gecos $ homeDirectory $ loginShell $ memberUid $ memberNisNetgroup $ ipHostNumber $ ipNetworkNumber $ ipNetmaskNumber $ macAddress $ bootFile $ nisMapEntry $ sudoUser $ sudoHost $ sudoCommand $ sudoRunAs $ sudoOption $ sudoRunAsUser $ sudoRunAsGroup ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 1.3.6.1.4.1.1466.109.114.1 (caseExactIA5Match): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 1.3.6.1.4.1.1466.109.114.1 NAME 'caseExactIA5Match' APPLIES ( altServer $ olcDbConfig $ c $ mail $ dc $ associatedDomain $ email $ aRecord $ mDRecord $ mXRecord $ nSRecord $ sOARecord $ cNAMERecord $ janetMailbox $ gecos $ homeDirectory $ loginShell $ memberUid $ memberNisNetgroup $ ipHostNumber $ ipNetworkNumber $ ipNetmaskNumber $ macAddress $ bootFile $ nisMapEntry $ sudoUser $ sudoHost $ sudoCommand $ sudoRunAs $ sudoOption $ sudoRunAsUser $ sudoRunAsGroup ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.39 (certificateListMatch): Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.38 (certificateListExactMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.38 NAME 'certificateListExactMatch' APPLIES ( authorityRevocationList $ certificateRevocationList $ deltaRevocationList ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.35 (certificateMatch): Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.34 (certificateExactMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.34 NAME 'certificateExactMatch' APPLIES ( userCertificate $ cACertificate ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.30 (objectIdentifierFirstComponentMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.30 NAME 'objectIdentifierFirstComponentMatch' APPLIES ( supportedControl $ supportedExtension $ supportedFeatures $ ldapSyntaxes $ supportedApplicationContext ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.29 (integerFirstComponentMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.29 NAME 'integerFirstComponentMatch' APPLIES ( supportedLDAPVersion $ entryTtl $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcIndexIntLen $ olcListenerThreads $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcWriteTimeout $ olcDbCacheFree $ olcDbCacheSize $ olcDbDNcacheSize $ olcDbIDLcacheSize $ olcDbSearchStack $ olcDbShmKey $ olcDbMaxReaders $ olcDbMaxSize $ olcSpSessionlog $ olcDbProtocolVersion $ olcDbConnectionPoolMax $ olcChainMaxReferralDepth $ mailPreferenceOption $ shadowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpire $ shadowFlag $ ipServicePort $ ipProtocolNumber $ oncRpcNumber $ sudoOrder ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.28 (generalizedTimeOrderingMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.28 NAME 'generalizedTimeOrderingMatch' APPLIES ( createTimestamp $ modifyTimestamp $ sudoNotBefore $ sudoNotAfter ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.27 (generalizedTimeMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.27 NAME 'generalizedTimeMatch' APPLIES ( createTimestamp $ modifyTimestamp $ sudoNotBefore $ sudoNotAfter ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.24 (protocolInformationMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.24 NAME 'protocolInformationMatch' APPLIES protocolInformation ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.23 (uniqueMemberMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.23 NAME 'uniqueMemberMatch' APPLIES uniqueMember ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.22 (presentationAddressMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.22 NAME 'presentationAddressMatch' APPLIES presentationAddress ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.20 (telephoneNumberMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.20 NAME 'telephoneNumberMatch' APPLIES ( telephoneNumber $ homePhone $ mobile $ pager ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.18 (octetStringOrderingMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.18 NAME 'octetStringOrderingMatch' APPLIES ( userPassword $ olcDbCryptKey ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.17 (octetStringMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.17 NAME 'octetStringMatch' APPLIES ( userPassword $ olcDbCryptKey ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.16 (bitStringMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.16 NAME 'bitStringMatch' APPLIES x500UniqueIdentifier ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.15 (integerOrderingMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.15 NAME 'integerOrderingMatch' APPLIES ( supportedLDAPVersion $ entryTtl $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcIndexIntLen $ olcListenerThreads $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcWriteTimeout $ olcDbCacheFree $ olcDbCacheSize $ olcDbDNcacheSize $ olcDbIDLcacheSize $ olcDbSearchStack $ olcDbShmKey $ olcDbMaxReaders $ olcDbMaxSize $ olcSpSessionlog $ olcDbProtocolVersion $ olcDbConnectionPoolMax $ olcChainMaxReferralDepth $ mailPreferenceOption $ shadowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpire $ shadowFlag $ ipServicePort $ ipProtocolNumber $ oncRpcNumber $ sudoOrder ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.14 (integerMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.14 NAME 'integerMatch' APPLIES ( supportedLDAPVersion $ entryTtl $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcIndexIntLen $ olcListenerThreads $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcWriteTimeout $ olcDbCacheFree $ olcDbCacheSize $ olcDbDNcacheSize $ olcDbIDLcacheSize $ olcDbSearchStack $ olcDbShmKey $ olcDbMaxReaders $ olcDbMaxSize $ olcSpSessionlog $ olcDbProtocolVersion $ olcDbConnectionPoolMax $ olcChainMaxReferralDepth $ mailPreferenceOption $ shadowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpire $ shadowFlag $ ipServicePort $ ipProtocolNumber $ oncRpcNumber $ sudoOrder ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.13 (booleanMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.13 NAME 'booleanMatch' APPLIES ( hasSubordinates $ olcAddContentAcl $ olcGentleHUP $ olcHidden $ olcLastMod $ olcMirrorMode $ olcMonitoring $ olcReadOnly $ olcReverseLookup $ olcSyncUseSubentry $ olcDbChecksum $ olcDbNoSync $ olcDbDirtyRead $ olcDbLinearIndex $ olcAccessLogSuccess $ olcRwmNormalizeMapped $ olcRwmDropUnrequested $ olcSpNoPresent $ olcSpReloadHint $ olcDbRebindAsUser $ olcDbChaseReferrals $ olcDbProxyWhoAmI $ olcDbSingleConn $ olcDbUseTemporaryConn $ olcDbSessionTrackingRequest $ olcDbNoRefs $ olcDbNoUndefFilter $ olcChainCacheURI $ olcChainReturnError ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.11 (caseIgnoreListMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.11 NAME 'caseIgnoreListMatch' APPLIES ( postalAddress $ registeredAddress $ homePostalAddress ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.9 (numericStringOrderingMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.9 NAME 'numericStringOrderingMatch' APPLIES ( x121Address $ internationaliSDNNumber ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.8 (numericStringMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.8 NAME 'numericStringMatch' APPLIES ( x121Address $ internationaliSDNNumber ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.7 (caseExactSubstringsMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.7 NAME 'caseExactSubstringsMatch' APPLIES ( serialNumber $ c $ telephoneNumber $ destinationIndicator $ dnQualifier $ homePhone $ mobile $ pager ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.6 (caseExactOrderingMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.6 NAME 'caseExactOrderingMatch' APPLIES ( supportedSASLMechanisms $ vendorName $ vendorVersion $ ref $ name $ cn $ uid $ labeledURI $ description $ olcConfigFile $ olcConfigDir $ olcAccess $ olcAllows $ olcArgsFile $ olcAttributeOptions $ olcAttributeTypes $ olcAuthIDRewrite $ olcAuthzPolicy $ olcAuthzRegexp $ olcBackend $ olcDatabase $ olcDisallows $ olcDitContentRules $ olcExtraAttrs $ olcInclude $ olcLdapSyntaxes $ olcLimits $ olcLogFile $ olcLogLevel $ olcModuleLoad $ olcModulePath $ olcObjectClasses $ olcObjectIdentifier $ olcOverlay $ olcPasswordCryptSaltFormat $ olcPasswordHash $ olcPidFile $ olcPlugin $ olcPluginLogFile $ olcReferral $ olcReplica $ olcReplicaArgsFile $ olcReplicaPidFile $ olcReplogFile $ olcRequires $ olcRestrict $ olcRootDSE $ olcRootPW $ olcSaslAuxprops $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ olcSecurity $ olcServerID $ olcSizeLimit $ olcSortVals $ olcSubordinate $ olcSyncrepl $ olcTCPBuffer $ olcTimeLimit $ olcTLSCACertificateFile $ olcTLSCACertificatePath $ olcTLSCertificateFile $ olcTLSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ olcTLSCRLFile $ olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ olcTLSProtocolMin $ olcUpdateRef $ olcDbDirectory $ olcDbCheckpoint $ olcDbCryptFile $ olcDbPageSize $ olcDbIndex $ olcDbLockDetect $ olcDbMode $ olcDbEnvFlags $ olcAccessLogOps $ olcAccessLogPurge $ olcAccessLogOld $ olcAccessLogOldAttr $ olcAccessLogBase $ olcRwmRewrite $ olcRwmTFSupport $ olcRwmMap $ olcSpCheckpoint $ olcDbURI $ olcDbStartTLS $ olcDbACLPasswd $ olcDbACLBind $ olcDbIDAssertPasswd $ olcDbIDAssertBind $ olcDbIDAssertMode $ olcDbIDAssertAuthzFrom $ olcDbTFSupport $ olcDbTimeout $ olcDbIdleTimeout $ olcDbConnTtl $ olcDbNetworkTimeout $ olcDbCancel $ olcDbQuarantine $ olcDbOnErr $ olcDbIDAssertPassThru $ olcDbKeepalive $ olcChainingBehavior $ knowledgeInformation $ sn $ serialNumber $ c $ l $ st $ street $ o $ ou $ title $ businessCategory $ postalCode $ postOfficeBox $ physicalDeliveryOffi Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.5 (caseExactMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.5 NAME 'caseExactMatch' APPLIES ( supportedSASLMechanisms $ vendorName $ vendorVersion $ ref $ name $ cn $ uid $ labeledURI $ description $ olcConfigFile $ olcConfigDir $ olcAccess $ olcAllows $ olcArgsFile $ olcAttributeOptions $ olcAttributeTypes $ olcAuthIDRewrite $ olcAuthzPolicy $ olcAuthzRegexp $ olcBackend $ olcDatabase $ olcDisallows $ olcDitContentRules $ olcExtraAttrs $ olcInclude $ olcLdapSyntaxes $ olcLimits $ olcLogFile $ olcLogLevel $ olcModuleLoad $ olcModulePath $ olcObjectClasses $ olcObjectIdentifier $ olcOverlay $ olcPasswordCryptSaltFormat $ olcPasswordHash $ olcPidFile $ olcPlugin $ olcPluginLogFile $ olcReferral $ olcReplica $ olcReplicaArgsFile $ olcReplicaPidFile $ olcReplogFile $ olcRequires $ olcRestrict $ olcRootDSE $ olcRootPW $ olcSaslAuxprops $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ olcSecurity $ olcServerID $ olcSizeLimit $ olcSortVals $ olcSubordinate $ olcSyncrepl $ olcTCPBuffer $ olcTimeLimit $ olcTLSCACertificateFile $ olcTLSCACertificatePath $ olcTLSCertificateFile $ olcTLSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ olcTLSCRLFile $ olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ olcTLSProtocolMin $ olcUpdateRef $ olcDbDirectory $ olcDbCheckpoint $ olcDbCryptFile $ olcDbPageSize $ olcDbIndex $ olcDbLockDetect $ olcDbMode $ olcDbEnvFlags $ olcAccessLogOps $ olcAccessLogPurge $ olcAccessLogOld $ olcAccessLogOldAttr $ olcAccessLogBase $ olcRwmRewrite $ olcRwmTFSupport $ olcRwmMap $ olcSpCheckpoint $ olcDbURI $ olcDbStartTLS $ olcDbACLPasswd $ olcDbACLBind $ olcDbIDAssertPasswd $ olcDbIDAssertBind $ olcDbIDAssertMode $ olcDbIDAssertAuthzFrom $ olcDbTFSupport $ olcDbTimeout $ olcDbIdleTimeout $ olcDbConnTtl $ olcDbNetworkTimeout $ olcDbCancel $ olcDbQuarantine $ olcDbOnErr $ olcDbIDAssertPassThru $ olcDbKeepalive $ olcChainingBehavior $ knowledgeInformation $ sn $ serialNumber $ c $ l $ st $ street $ o $ ou $ title $ businessCategory $ postalCode $ postOfficeBox $ physicalDeliveryOfficeName $ Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.4 (caseIgnoreSubstringsMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.4 NAME 'caseIgnoreSubstringsMatch' APPLIES ( serialNumber $ c $ telephoneNumber $ destinationIndicator $ dnQualifier $ homePhone $ mobile $ pager ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.3 (caseIgnoreOrderingMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.3 NAME 'caseIgnoreOrderingMatch' APPLIES ( supportedSASLMechanisms $ vendorName $ vendorVersion $ ref $ name $ cn $ uid $ labeledURI $ description $ olcConfigFile $ olcConfigDir $ olcAccess $ olcAllows $ olcArgsFile $ olcAttributeOptions $ olcAttributeTypes $ olcAuthIDRewrite $ olcAuthzPolicy $ olcAuthzRegexp $ olcBackend $ olcDatabase $ olcDisallows $ olcDitContentRules $ olcExtraAttrs $ olcInclude $ olcLdapSyntaxes $ olcLimits $ olcLogFile $ olcLogLevel $ olcModuleLoad $ olcModulePath $ olcObjectClasses $ olcObjectIdentifier $ olcOverlay $ olcPasswordCryptSaltFormat $ olcPasswordHash $ olcPidFile $ olcPlugin $ olcPluginLogFile $ olcReferral $ olcReplica $ olcReplicaArgsFile $ olcReplicaPidFile $ olcReplogFile $ olcRequires $ olcRestrict $ olcRootDSE $ olcRootPW $ olcSaslAuxprops $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ olcSecurity $ olcServerID $ olcSizeLimit $ olcSortVals $ olcSubordinate $ olcSyncrepl $ olcTCPBuffer $ olcTimeLimit $ olcTLSCACertificateFile $ olcTLSCACertificatePath $ olcTLSCertificateFile $ olcTLSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ olcTLSCRLFile $ olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ olcTLSProtocolMin $ olcUpdateRef $ olcDbDirectory $ olcDbCheckpoint $ olcDbCryptFile $ olcDbPageSize $ olcDbIndex $ olcDbLockDetect $ olcDbMode $ olcDbEnvFlags $ olcAccessLogOps $ olcAccessLogPurge $ olcAccessLogOld $ olcAccessLogOldAttr $ olcAccessLogBase $ olcRwmRewrite $ olcRwmTFSupport $ olcRwmMap $ olcSpCheckpoint $ olcDbURI $ olcDbStartTLS $ olcDbACLPasswd $ olcDbACLBind $ olcDbIDAssertPasswd $ olcDbIDAssertBind $ olcDbIDAssertMode $ olcDbIDAssertAuthzFrom $ olcDbTFSupport $ olcDbTimeout $ olcDbIdleTimeout $ olcDbConnTtl $ olcDbNetworkTimeout $ olcDbCancel $ olcDbQuarantine $ olcDbOnErr $ olcDbIDAssertPassThru $ olcDbKeepalive $ olcChainingBehavior $ knowledgeInformation $ sn $ serialNumber $ c $ l $ st $ street $ o $ ou $ title $ businessCategory $ postalCode $ postOfficeBox $ physicalDeliveryOff Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.2 (caseIgnoreMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.2 NAME 'caseIgnoreMatch' APPLIES ( supportedSASLMechanisms $ vendorName $ vendorVersion $ ref $ name $ cn $ uid $ labeledURI $ description $ olcConfigFile $ olcConfigDir $ olcAccess $ olcAllows $ olcArgsFile $ olcAttributeOptions $ olcAttributeTypes $ olcAuthIDRewrite $ olcAuthzPolicy $ olcAuthzRegexp $ olcBackend $ olcDatabase $ olcDisallows $ olcDitContentRules $ olcExtraAttrs $ olcInclude $ olcLdapSyntaxes $ olcLimits $ olcLogFile $ olcLogLevel $ olcModuleLoad $ olcModulePath $ olcObjectClasses $ olcObjectIdentifier $ olcOverlay $ olcPasswordCryptSaltFormat $ olcPasswordHash $ olcPidFile $ olcPlugin $ olcPluginLogFile $ olcReferral $ olcReplica $ olcReplicaArgsFile $ olcReplicaPidFile $ olcReplogFile $ olcRequires $ olcRestrict $ olcRootDSE $ olcRootPW $ olcSaslAuxprops $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ olcSecurity $ olcServerID $ olcSizeLimit $ olcSortVals $ olcSubordinate $ olcSyncrepl $ olcTCPBuffer $ olcTimeLimit $ olcTLSCACertificateFile $ olcTLSCACertificatePath $ olcTLSCertificateFile $ olcTLSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ olcTLSCRLFile $ olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ olcTLSProtocolMin $ olcUpdateRef $ olcDbDirectory $ olcDbCheckpoint $ olcDbCryptFile $ olcDbPageSize $ olcDbIndex $ olcDbLockDetect $ olcDbMode $ olcDbEnvFlags $ olcAccessLogOps $ olcAccessLogPurge $ olcAccessLogOld $ olcAccessLogOldAttr $ olcAccessLogBase $ olcRwmRewrite $ olcRwmTFSupport $ olcRwmMap $ olcSpCheckpoint $ olcDbURI $ olcDbStartTLS $ olcDbACLPasswd $ olcDbACLBind $ olcDbIDAssertPasswd $ olcDbIDAssertBind $ olcDbIDAssertMode $ olcDbIDAssertAuthzFrom $ olcDbTFSupport $ olcDbTimeout $ olcDbIdleTimeout $ olcDbConnTtl $ olcDbNetworkTimeout $ olcDbCancel $ olcDbQuarantine $ olcDbOnErr $ olcDbIDAssertPassThru $ olcDbKeepalive $ olcChainingBehavior $ knowledgeInformation $ sn $ serialNumber $ c $ l $ st $ street $ o $ ou $ title $ businessCategory $ postalCode $ postOfficeBox $ physicalDeliveryOfficeName Sep 18 13:39:30 ldap-east slapd[18966]: 1.2.36.79672281.1.13.3 (rdnMatch): Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.1 (distinguishedNameMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.1 NAME 'distinguishedNameMatch' APPLIES ( creatorsName $ modifiersName $ subschemaSubentry $ entryDN $ namingContexts $ aliasedObjectName $ dynamicSubtrees $ distinguishedName $ seeAlso $ olcDefaultSearchBase $ olcRootDN $ olcSchemaDN $ olcSuffix $ olcUpdateDN $ olcAccessLogDB $ olcDbACLAuthcDn $ olcDbIDAssertAuthcDn $ member $ owner $ roleOccupant $ manager $ documentAuthor $ secretary $ associatedName $ dITRedirect ) ) Sep 18 13:39:30 ldap-east slapd[18966]: 2.5.13.0 (objectIdentifierMatch): Sep 18 13:39:30 ldap-east slapd[18966]: matchingRuleUse: ( 2.5.13.0 NAME 'objectIdentifierMatch' APPLIES ( supportedControl $ supportedExtension $ supportedFeatures $ supportedApplicationContext ) ) Sep 18 13:39:30 ldap-east slapd[18966]: slapd startup: initiated. Sep 18 13:39:30 ldap-east slapd[18966]: backend_startup_one: starting "cn=config" Sep 18 13:39:30 ldap-east slapd[18966]: config_back_db_open Sep 18 13:39:30 ldap-east slapd[18966]: config_back_db_open: line 0: warning: cannot assess the validity of the ACL scope within backend naming context Sep 18 13:39:30 ldap-east slapd[18966]: config_back_db_open: No explicit ACL for back-config configured. Using hardcoded default Sep 18 13:39:30 ldap-east slapd[18966]: config_build_entry: "cn=config" Sep 18 13:39:30 ldap-east slapd[18966]: config_build_entry: "cn=module{0}" Sep 18 13:39:30 ldap-east slapd[18966]: config_build_entry: "cn=schema" Sep 18 13:39:30 ldap-east slapd[18966]: >>> dnNormalize: <cn={0}core> Sep 18 13:39:30 ldap-east slapd[18966]: <<< dnNormalize: <cn={0}core> Sep 18 13:39:30 ldap-east slapd[18966]: config_build_entry: "cn={0}core" Sep 18 13:39:30 ldap-east slapd[18966]: >>> dnNormalize: <cn={1}cosine> Sep 18 13:39:30 ldap-east slapd[18966]: <<< dnNormalize: <cn={1}cosine> Sep 18 13:39:30 ldap-east slapd[18966]: config_build_entry: "cn={1}cosine" Sep 18 13:39:30 ldap-east slapd[18966]: >>> dnNormalize: <cn={2}inetorgperson> Sep 18 13:39:30 ldap-east slapd[18966]: <<< dnNormalize: <cn={2}inetorgperson> Sep 18 13:39:30 ldap-east slapd[18966]: config_build_entry: "cn={2}inetorgperson" Sep 18 13:39:30 ldap-east slapd[18966]: >>> dnNormalize: <cn={3}nis> Sep 18 13:39:30 ldap-east slapd[18966]: <<< dnNormalize: <cn={3}nis> Sep 18 13:39:30 ldap-east slapd[18966]: config_build_entry: "cn={3}nis" Sep 18 13:39:30 ldap-east slapd[18966]: >>> dnNormalize: <cn={4}sudo> Sep 18 13:39:30 ldap-east slapd[18966]: <<< dnNormalize: <cn={4}sudo> Sep 18 13:39:30 ldap-east slapd[18966]: config_build_entry: "cn={4}sudo" Sep 18 13:39:30 ldap-east slapd[18966]: config_build_entry: "olcDatabase={-1}frontend" Sep 18 13:39:30 ldap-east slapd[18966]: config_build_entry: "olcDatabase={0}config" Sep 18 13:39:30 ldap-east slapd[18966]: config_build_entry: "olcDatabase={1}ldap" Sep 18 13:39:30 ldap-east slapd[18966]: config_build_entry: "olcOverlay={0}rwm" Sep 18 13:39:30 ldap-east slapd[18966]: config_build_entry: "olcDatabase={2}bdb" Sep 18 13:39:30 ldap-east slapd[18966]: config_build_entry: "olcOverlay={0}syncprov" Sep 18 13:39:30 ldap-east slapd[18966]: config_build_entry: "olcOverlay={1}glue" Sep 18 13:39:30 ldap-east slapd[18966]: backend_startup_one: starting "ou=Users,ou=xxxxx,dc=ad,dc=xxxxx,dc=net" Sep 18 13:39:30 ldap-east slapd[18966]: ldap_back_db_open: URI=ldap://ad1.xxxxx.net Sep 18 13:39:30 ldap-east slapd[18966]: backend_startup_one: starting "dc=xxxxx,dc=net" Sep 18 13:39:30 ldap-east slapd[18966]: bdb_db_open: "dc=xxxxx,dc=net" Sep 18 13:39:30 ldap-east slapd[18966]: bdb_db_open: database "dc=xxxxx,dc=net": dbenv_open(/var/lib/ldap). Sep 18 13:39:30 ldap-east slapd[18966]: bdb_monitor_db_open: monitoring disabled; configure monitor database to enable Sep 18 13:39:30 ldap-east slapd[18966]: => bdb_entry_get: ndn: "dc=xxxxx,dc=net" Sep 18 13:39:30 ldap-east slapd[18966]: => bdb_entry_get: oc: "(null)", at: "contextCSN" Sep 18 13:39:30 ldap-east slapd[18966]: bdb_dn2entry("dc=xxxxx,dc=net") Sep 18 13:39:30 ldap-east slapd[18966]: => bdb_dn2id("dc=xxxxx,dc=net") Sep 18 13:39:30 ldap-east slapd[18966]: <= bdb_dn2id: got id=0x7 Sep 18 13:39:30 ldap-east slapd[18966]: entry_decode: "dc=xxxxx,dc=net" Sep 18 13:39:30 ldap-east slapd[18966]: <= entry_decode(dc=xxxxx,dc=net) Sep 18 13:39:30 ldap-east slapd[18966]: => bdb_entry_get: found entry: "dc=xxxxx,dc=net" Sep 18 13:39:30 ldap-east slapd[18966]: bdb_entry_get: rc=0 Sep 18 13:39:30 ldap-east slapd[18966]: slapd starting Sep 18 13:39:30 ldap-east slapd[18966]: daemon: added 4r listener=(nil) Sep 18 13:39:30 ldap-east slapd[18966]: daemon: added 7r listener=0x7f37cb13f7c0 Sep 18 13:39:30 ldap-east slapd[18966]: daemon: added 8r listener=0x7f37cb13f8a0 Sep 18 13:39:30 ldap-east slapd[18966]: daemon: epoll: listen=7 active_threads=0 tvp=zero Sep 18 13:39:30 ldap-east slapd[18966]: daemon: epoll: listen=8 active_threads=0 tvp=zero Sep 18 13:39:30 ldap-east slapd[18966]: daemon: activity on 1 descriptor Sep 18 13:39:30 ldap-east slapd[18966]: daemon: activity on: Sep 18 13:39:30 ldap-east slapd[18966]: Sep 18 13:39:30 ldap-east slapd[18966]: daemon: epoll: listen=7 active_threads=0 tvp=zero Sep 18 13:39:30 ldap-east slapd[18966]: daemon: epoll: listen=8 active_threads=0 tvp=zero Sep 18 13:39:30 ldap-east slapd[18966]: =>do_syncrepl rid=001 Sep 18 13:39:30 ldap-east slapd[18966]: => bdb_entry_get: ndn: "dc=xxxxx,dc=net" Sep 18 13:39:30 ldap-east slapd[18966]: => bdb_entry_get: oc: "(null)", at: "contextCSN" Sep 18 13:39:30 ldap-east slapd[18966]: bdb_dn2entry("dc=xxxxx,dc=net") Sep 18 13:39:30 ldap-east slapd[18966]: => bdb_entry_get: found entry: "dc=xxxxx,dc=net" Sep 18 13:39:30 ldap-east slapd[18966]: bdb_entry_get: rc=0 Sep 18 13:39:30 ldap-east slapd[18966]: => access_allowed: result not in cache (contextCSN) Sep 18 13:39:30 ldap-east slapd[18966]: => access_allowed: read access to "dc=xxxxx,dc=net" "contextCSN" requested Sep 18 13:39:30 ldap-east slapd[18966]: <= root access granted Sep 18 13:39:30 ldap-east slapd[18966]: => access_allowed: read access granted by manage(=mwrscxd) Sep 18 13:39:30 ldap-east slapd[18966]: => access_allowed: result was in cache (contextCSN) Sep 18 13:39:30 ldap-east slapd[18966]: => access_allowed: result was in cache (contextCSN) Sep 18 13:39:30 ldap-east slapd[18966]: =>do_syncrep2 rid=001 Sep 18 13:39:30 ldap-east slapd[18966]: do_syncrep2: rid=001 LDAP_RES_INTERMEDIATE - REFRESH_DELETE Sep 18 13:39:30 ldap-east slapd[18966]: daemon: added 13r listener=(nil) Sep 18 13:39:30 ldap-east slapd[18966]: daemon: activity on 1 descriptor Sep 18 13:39:30 ldap-east slapd[18966]: daemon: activity on: Sep 18 13:39:30 ldap-east slapd[18966]: Sep 18 13:39:30 ldap-east slapd[18966]: daemon: epoll: listen=7 active_threads=0 tvp=zero Sep 18 13:39:30 ldap-east slapd[18966]: daemon: epoll: listen=8 active_threads=0 tvp=zero slapd.conf [root@ldap-east openldap]# cat slapd.conf include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/sudo.schema allow bind_v2 TLSCertificateFile /etc/openldap/certs/ldap_xxxxx_net.crt TLSCertificateKeyFile /etc/openldap/certs/ldap_xxxxx_net.key TLSCACertificateFile /etc/openldap/certs/CAcompany.crt pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args modulepath /usr/lib/openldap modulepath /usr/lib64/openldap moduleload accesslog.la moduleload rwm.la moduleload syncprov.la disallow bind_anon moduleload back_bdb moduleload back_ldap backend bdb moduleload syncprov database ldap suffix "ou=Users,ou=xxxxx,dc=ad,dc=xxxxx,dc=net" uri ldap://ad1.xxxxx.net/ rebind-as-user idassert-bind bindmethod=simple binddn="cn=username,ou=users,ou=xxxxxx,dc=ad,dc=xxxxx,dc=net" credentials="xxxxxxxxx" mode=none idassert-authzFrom "*" chase-referrals yes subordinate overlay rwm rwm-map attribute uid sAMAccountName database bdb suffix "dc=xxxxx,dc=net" checkpoint 1024 15 rootdn "cn=Manager,dc=xxxxx,dc=net" rootpw {SSHA}xxxxxxxxxxx directory /var/lib/ldap access to * by dn.base="cn=TestSync,ou=Roles,dc=xxxxx,dc=net" write by * break # Generic ACL section access to attrs=userPassword,shadowLastChange by dn="cn=Manager,dc=xxxxx,dc=net" write by anonymous auth by self write by * none # Specific ACL section to restrict userPassword to be used for authentication only - 8-15-14 #access to to dn.children="ou=People,dc=xxxxx,dc=net" write # attrs=userPasswrod # by self write # by * auth # by dn.children="ou=Customers,ou=People,dc=xxxxx,dc=net" write # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index entryCSN,entryUUID eq #LDAP Sync - Master serverID 1 overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 #LDAP Sync - Slave syncrepl rid=001 provider=ldaps://ldap-west.xxxxx.net bindmethod=simple binddn="cn=TestSync,ou=Roles,dc=xxxxx,dc=net" credentials=xxxxxxx searchbase="dc=xxxxx,dc=net" schemachecking=on type=refreshAndPersist retry="60 +" mirrormode on loglevel -1

2 1

Re: Issues with Ppolicy Overlay and chaining (master/slave)
by Raul Hernandez 18 Sep '14

18 Sep '14

Hi Quanah, I really appreciate your help. I just started some debugging on the master side, and I found out that the root of my issue was permission. I got the following messages on the masters side: 5418a353 conn=1064 op=6 MOD dn="cn=Lisa Hayes,ou=Quality,dc=example,dc=com" 5418a353 conn=1064 op=6 MOD attr=pwdFailureTime 5418a353 conn=1064 op=6 RESULT tag=103 err=50 text= tag=103 err=50 ----> This usually means insufficient access. I look over the my HDB access configuration, and realize that my chaining (cn=syncrepluser,ou=security,dc=example,dc=com) user had "write" permissions on userPassword, pwdFailuretime, pwdChangedTime, pwdHistory, pwdAccountLockedTime attributes and that wasn't enough. I changed the "write" permission to "manage" and everything started working. #----- # Master #----- dn: olcDatabase={1}hdb,cn=config changetype: modify replace: olcAccess olcAccess: {0}to attrs=userPassword,pwdFailuretime,pwdChangedTime,pwdHistory,pwdAccountLockedTime by self write by dn="cn=admin,dc=example,dc=com" write by dn="cn=syncReplUser,ou=Security,dc=example,dc=com" manage by * none Hope this can help others. Thanks a lot for your help!

4 3

Re: Issues with Ppolicy Overlay and chaining (master/slave)
by Raul Hernandez 16 Sep '14

16 Sep '14

OpenLDAP 2.4.39 running on Debian SID I also forgot to post my ppolicy conf for both master and slave: #----- # Master #----- dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulePath: /usr/lib/ldap olcModuleLoad: ppolicy dn: olcOverlay=ppolicy,olcDatabase={1}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcOverlay: ppolicy olcPPolicyHashCleartext: FALSE olcPPolicyUseLockout: FALSE olcPPolicyDefault: cn=default,ou=policies,dc=bandes,dc=gob,dc=ve #----- # Slave #----- dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulePath: /usr/lib/ldap olcModuleLoad: ppolicy dn: olcOverlay=ppolicy, olcDatabase={1}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcOverlay: ppolicy olcPPolicyDefault: cn=default,ou=policies,dc=bandes,dc=gob,dc=ve olcPPolicyHashCleartext: FALSE olcPPolicyUseLockout: FALSE olcPPolicyForwardUpdates: TRUE On Tue, Sep 16, 2014 at 2:30 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, September 16, 2014 3:27 PM -0430 Raul Hernandez < > hernandezr(a)gmail.com> wrote: > > >> >> >> >> Hello! >> >> >> I've been experiencing some issues with ppolicy overlay and chaining. >> I've implemented a simple openldap master and consumer architecture.This >> implementation works fine. I have data from the master, replicated into >> the slave, and all writes sent to the slave (add/edit ous and users), are >> forwarded to the master. >> > > OpenLDAP version? > > --Quanah > > -- > > Quanah Gibson-Mount > Server Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

Issues with Ppolicy Overlay and chaining (master/slave)
by Raul Hernandez 16 Sep '14

16 Sep '14

Hello! I've been experiencing some issues with ppolicy overlay and chaining. I've implemented a simple openldap master and consumer architecture.This implementation works fine. I have data from the master, replicated into the slave, and all writes sent to the slave (add/edit ous and users), are forwarded to the master. I've now added to this architecture ppolicy overlay (with olcPPolicyForwardUpdates set to TRUE). When the slave receives a logon failure, it should forward this to the master, so ppolicy overlay can set pwdFailuretime and pwdAccountLockedTime. This is not happening. Neither master nor slave, are setting pwdFailuretime or pwdAccountLockedTime. When debugging the slave, I get the following messages: 541875a7 conn=1010 op=0 BIND dn="cn=Lisa Hayes,ou=Quality,dc=example,dc=com" method=128 541875a7 conn=1010 op=0 ldap_back_retry: retrying URI="ldap://ldapmaster.com" DN="cn=syncrepluser,ou=security,dc=example,dc=com" 541875a7 conn=1010 op=0 RESULT tag=97 err=49 text= 541875a7 conn=1010 op=1 UNBIND 541875a7 conn=1010 fd=21 closed I've been searching the Internet how to solve this issue without any luck. can someone point me to the right direction? Here is my conf for replication and chain in both master and slave: #----- # Master #----- dn: cn=module,cn=config changetype: add objectClass: olcModuleList cn: module olcModulePath: /usr/lib/ldap olcModuleLoad: syncprov dn: olcOverlay=syncprov,olcDatabase={1}hdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov #----- # Slave #----- dn: cn=module,cn=config changetype: add objectClass: olcModuleList cn: module olcModulePath: /usr/lib/ldap olcModuleLoad: syncprov olcModuleLoad: back_ldap dn: olcOverlay=syncprov,olcDatabase={1}hdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov dn: olcDatabase={1}hdb,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=ldap://ldapmaster.com binddn="cn=syncReplUser,ou=Security,dc=example,dc=com" bindmethod=simple credentials=secret searchbase="dc=example,dc=com" type=refreshAndPersist scope=sub retry="5 10 10 +" timeout=1 sizelimit=unlimited schemachecking=on - add: olcUpdateRef olcUpdateRef: ldap://ldapmaster.com dn: olcOverlay=chain,olcDatabase={-1}frontend,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcChainConfig olcOverlay: chain olcChainReturnError: TRUE dn: olcDatabase=ldap,olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config changetype: add objectClass: olcLDAPConfig objectClass: olcChainDatabase olcDatabase: ldap olcDbURI: ldap://ldapmaster.com olcDbRebindAsUser: TRUE olcDbIDAssertBind: bindmethod=simple binddn="cn=syncReplUser,ou=Security,dc=example,dc=com" credentials=secret mode=self flags=prescriptive,proxy-authz-non-critical Thanks in advanced

2 1

Re: Consumer replication 0 entries fetched - CSN problem?
by Josh Nielsen 16 Sep '14

16 Sep '14

Okay. Thank you for the information Quanah. Regards, Josh On Tue, Sep 16, 2014 at 11:27 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, September 16, 2014 11:38 AM -0500 Josh Nielsen > <jnielsen(a)hudsonalpha.org> wrote: > >> Yes, I used distro packages for Centos 6; and yes, I understand your >> point. I may have the luxury of building openldap from scratch for >> LDAP02, though I don't have the redundancy (the point of this whole >> exercise) that I need to reinstall LDAP01 by building it from scratch. >> That was an unfortunate mistake in hindsight that I stuck with the >> distro package there. I suppose to start over I would have to make a >> new server and slapcat the LDAP01 config? How would I carry over the >> existing DB entries without using replication? I'm still a novice when >> it comes to OLC. >> >> As for the ACL, that was a result of my sloppy email editing. I >> changed the name of the DNs. They actually match in my config. Once I >> proof-of-concept the replication I will create replication-only user >> DNs. >> >> But nothing looks overtly amiss with my CSNs or UUIDs? > > > Hi Josh, > > 2.4.23 is known to have numerous bugs in sync replication. So even once you > have your system configured correctly, there is no guarantee that your data > will be correctly pushed out. I strongly advise you to read over the > CHANGES file for everything fixed since 2.4.23 to the 2.4.40 release: > > <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=blob_plain;f=CHAN…> > > In addition, there's no requirement that you build OpenLDAP yourself. You > can obtain current OpenLDAP builds from Symas (<https://symas.com/>) or the > LTB project (<http://ltb-project.org/wiki/download#openldap>) for > deployment. > > Regards, > Quanah > > > > -- > > Quanah Gibson-Mount > Server Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration

1 0

Consumer replication 0 entries fetched - CSN problem?
by Josh Nielsen 16 Sep '14

16 Sep '14

Hello all, Last year I switched from the slapd.conf to the OLC style config for OpenLDAP and transitionally tested it by making the OLC server a replication slave to the older LDAP server configured with slapd.conf. Now I've disabled replication from that old server and am making the OLC server (LDAP01 - version 2.4.23) the new master and threw up a new VM called LDAP02 (2.4.23) to become the new sync replication slave/consumer. Though I'm using multiple guides of varying detail the simplest setup steps basically followed this article: http://gagravarr.livejournal.com/145679.html. I followed the same steps I thought I did for LDAP01, but despite the fact that I see LDAP02 bind and try to fetch entries for replication nothing is being fetched. The problem description is almost identical to this person's issue: http://www.openldap.org/lists/openldap-software/200911/msg00017.html (with "nentries=0" in the replication log messages, but plenty of entries found with an ldapsearch manually). Though I think my setup situation is different than that person's, and they were exporting using slapcat/slapadd (which I did for converting my existing slapd.conf config to LDAP01 last year, but this time I merely setup LDAP02 from scratch as a cn=config OLC server to begin with), one of the follow-up responses to that email thread said this: "The only correct usage of -w is when you have an LDIF produced by slapcat on a database that was not being used with replication before, and so is missing the contextCSN. But all the other operational attributes (entryUUID and entryCSN in particular) are present and valid." This made me wonder if the problem I'm seeing is because LDAP02 (or LDAP01?) is somehow missing a contextCSN. I am seeing no "cookie" messages associated with replication in my log. Some of my config is below as well as the log messages I am seeing on LDAP01 (edited domain & password). I did notice off-the-bat though that I am missing an "olcDbIndex: entryUUID pres,eq" entry on LDAP02 where I have it on LDAP01. Is that a crucial setting for replication? Lastly, I deleted the database files in /var/lib/ldap/ on LDAP02 and restarted slapd once I had configured "olcSyncRepl" on LDAP02 to ensure that I was starting from scratch. ------- LDAP01's log entry for LDAP02's attempted connection looks like this: Sep 15 16:29:07 ldap01 slapd[18869]: conn=1472 fd=359 ACCEPT from IP=192.168.21.60:46198 (IP=0.0.0.0:389) Sep 15 16:29:07 ldap01 slapd[18869]: conn=1472 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Sep 15 16:29:07 ldap01 slapd[18869]: conn=1472 op=0 STARTTLS Sep 15 16:29:07 ldap01 slapd[18869]: conn=1472 op=0 RESULT oid= err=0 text= Sep 15 16:29:07 ldap01 slapd[18869]: conn=1472 fd=359 TLS established tls_ssf=256 ssf=256 Sep 15 16:29:07 ldap01 slapd[18869]: conn=1472 op=1 BIND dn="cn=root,dc=myerslab,dc=haib,dc=org" method=128 Sep 15 16:29:07 ldap01 slapd[18869]: conn=1472 op=1 BIND dn="cn=root,dc=myerslab,dc=haib,dc=org" mech=SIMPLE ssf=0 Sep 15 16:29:07 ldap01 slapd[18869]: conn=1472 op=1 RESULT tag=97 err=0 text= Sep 15 16:29:07 ldap01 slapd[18869]: conn=1472 op=2 SRCH base="dc=myerslab,dc=haib,dc=org" scope=2 deref=0 filter="(objectClass=*)" Sep 15 16:29:07 ldap01 slapd[18869]: conn=1472 op=2 SRCH attr=* + Sep 15 16:29:07 ldap01 slapd[18869]: conn=1472 op=2 SEARCH RESULT tag=101 err=0 nentries=0 text= Sep 15 16:29:07 ldap01 slapd[18869]: conn=1472 op=3 UNBIND Sep 15 16:29:07 ldap01 slapd[18869]: conn=1472 fd=359 closed ------- LDAP02's /etc/openldap/slapd.d/cn=config/olcDatabase={1}bdb.ldif: dn: olcDatabase={1}bdb objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {1}bdb olcSuffix: dc=mydomain,dc=org olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=admin,dc=mydomain,dc=org olcRootPW:: olcSyncUseSubentry: FALSE olcMonitoring: TRUE olcDbDirectory: /var/lib/ldap olcDbCacheSize: 50000 olcDbCheckpoint: 10240 720 olcSyncrepl: {0}rid=001 provider=ldap://ldap01.mydomain.org bindmethod=si mple timeout=1 network-timeout=0 binddn="cn=root,dc=mydomain,dc=org" credentials="ld4p3650" keepalive=0:0:0 starttls=yes filter="(objectclass=*)" s earchbase="dc=mydomain,dc=org" scope=sub schemachecking=off type=refr eshOnly interval=00:00:00:10 retry="5 5 300 5" tls_cacert=/etc/openldap/certs/rootCA.cert olcUpdateRef: ldap://ldap01.mydomain.org olcMirrorMode: TRUE olcDbNoSync: FALSE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 0 olcDbIndex: objectClass pres,eq olcDbIndex: cn pres,eq,sub olcDbIndex: uid pres,eq,sub olcDbIndex: uidNumber pres,eq olcDbIndex: gidNumber pres,eq olcDbIndex: mail pres,eq,sub olcDbIndex: ou pres,eq,sub olcDbIndex: loginShell pres,eq olcDbIndex: sn pres,eq,sub olcDbIndex: givenName pres,eq,sub olcDbIndex: memberUid pres,eq,sub olcDbIndex: nisMapName pres,eq,sub olcDbIndex: nisMapEntry pres,eq,sub olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 structuralObjectClass: olcBdbConfig entryUUID: 31e2c8b0-c0ec-1033-8c20-43a6f59853d5 creatorsName: cn=config createTimestamp: 20140825214036Z entryCSN: 20140912164223.814325Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20140912164223Z ------- LDAP01's /etc/openldap/slapd.d/cn=config/olcDatabase={1}bdb.ldif: dn: olcDatabase={1}bdb objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {1}bdb olcSuffix: dc=mydomain,dc=org olcAccess: {0}to attrs=userPassword by self write by anonymous auth by * no ne olcAccess: {1}to * by anonymous read olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=admin,dc=mydomain,dc=org olcRootPW:: olcSyncUseSubentry: FALSE olcMirrorMode: TRUE olcMonitoring: TRUE olcDbDirectory: /var/lib/ldap olcDbCacheSize: 50000 olcDbCheckpoint: 10240 720 olcDbConfig: {0}# $OpenLDAP: pkg/ldap/servers/slapd/DB_CONFIG,v 1.3.2.4 2007/1 2/18 11:53:27 ghenry Exp $ olcDbConfig: {1}# Example DB_CONFIG file for use with slapd(8) BDB/HDB databas es. olcDbConfig: {2}# olcDbConfig: {3}# See the Oracle Berkeley DB documentation olcDbConfig: {4}# <http://www.oracle.com/technology/documentation/berkeley-d b/db/ref/env/db_config.html> olcDbConfig: {5}# for detail description of DB_CONFIG syntax and semantics. olcDbConfig: {6}# olcDbConfig: {7}# Hints can also be found in the OpenLDAP Software FAQ olcDbConfig:: ezh9Iwk8aHR0cDovL3d3dy5vcGVubGRhcC5vcmcvZmFxL2luZGV4LmNnaT9maWxl PTI+ olcDbConfig: {9}# in particular: olcDbConfig: {10}# <http://www.openldap.org/faq/index.cgi?file=1075> olcDbConfig: {11} olcDbConfig: {12}# Note: most DB_CONFIG settings will take effect only upon re building olcDbConfig: {13}# the DB environment. olcDbConfig: {14} olcDbConfig: {15}# one 0.25 GB cache olcDbConfig: {16}set_cachesize 0 268435456 1 olcDbConfig: {17} olcDbConfig: {18}# Data Directory olcDbConfig: {19}#set_data_dir db olcDbConfig: {20} olcDbConfig: {21}# Transaction Log settings olcDbConfig: {22}set_lg_regionmax 262144 olcDbConfig: {23}set_lg_bsize 2097152 olcDbConfig: {24}#set_lg_dir logs olcDbConfig: {25} olcDbConfig: {26}# Note: special DB_CONFIG flags are no longer needed for "qui ck" olcDbConfig:: ezI3fSMgc2xhcGFkZCg4KSBvciBzbGFwaW5kZXgoOCkgYWNjZXNzIChzZWUgdGhl aXIgLXEgb3B0aW9uKS4g olcDbNoSync: FALSE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 0 olcDbIndex: objectClass pres,eq olcDbIndex: entryUUID pres,eq olcDbIndex: entryCSN pres,eq olcDbIndex: cn pres,eq,sub olcDbIndex: uid pres,eq,sub olcDbIndex: uidNumber pres,eq olcDbIndex: gidNumber pres,eq olcDbIndex: ou pres,eq,sub olcDbIndex: mail pres,eq,sub olcDbIndex: memberUid pres,eq,sub olcDbIndex: sn pres,eq,sub olcDbIndex: loginShell pres,eq olcDbIndex: givenName pres,eq,sub olcDbIndex: nisMapName pres,eq,sub olcDbIndex: nisMapEntry pres,eq,sub olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 structuralObjectClass: olcBdbConfig entryUUID: 727d260c-cc5c-1032-89cf-2fc7acd5ca31 creatorsName: cn=config createTimestamp: 20131018161654Z entryCSN: 20140915195740.431843Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20140915195740Z ------ Thanks, Josh Nielsen

3 3

ldappasswd usage problems
by Bruce Carleton 15 Sep '14

15 Sep '14

I'm having problems setting passwords with ldappasswd. It keeps failing with a usage message. I've tried a bunch of different arrangements of the command line arguments, but it keeps giving me a usage message. Here's an example: ldappasswd -s some_password \ -x -H ldapi:/// \ -D cn=admin,dc=example,dc=com -y secret.txt \ uid=some.user,ou=people,dc=example,dc=com During one of my attempts I followed the order specified in the man page. That didn't work either. I'm using the packaged (ldap-utils / 2.4.28-1.1ubuntu4.4) ldappasswd on Ubuntu 12.04.4 LTS. The specific ldappasswd version follows: $ ldappasswd -VV ldappasswd: @(#) $OpenLDAP: ldappasswd (Sep 19 2013 22:39:03) $ buildd@panlong:/build/buildd/openldap-2.4.28/debian/build/clients/tools (LDAP library: OpenLDAP 20428) I'm feeling kind of stuck on this. I'm probably missing something silly. Any suggestions? Thanks, --Bruce

4 6

Returned mail: Data format error
by richm＠stanfordalumni.org 14 Sep '14

14 Sep '14

This message was undeliverable due to the following reason(s): Your message was not delivered because the destination server was unreachable within the allowed queue period. The amount of time a message is queued before it is returned depends on local configura- tion parameters. Most likely there is a network problem that prevented delivery, but it is also possible that the computer is turned off, or does not have a mail system running right now. Your message was not delivered within 5 days: Mail server 46.146.14.227 is not responding. The following recipients did not receive this message: <openldap-technical(a)openldap.org> Please reply to postmaster(a)openldap.org if you feel this message to be in error.

1 0

OpenLDAP crash when defining multiple olcDbURI for chaining
by Khosrow Ebrahimpour 13 Sep '14

13 Sep '14

Hello list, I am trying to setup referral chaining in a multi-master setup. I can setup chaining to one of the masters without any problems. And I can perform a MOD operation that is then referral chased and performed on the master. However, when I define both masters the replica crashes when I do a MOD operation. Snippet of cn=config from the working example: dn: olcDatabase={1}ldap,olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config objectClass: olcLDAPConfig objectClass: olcChainDatabase olcDatabase: {1}ldap olcDbStartTLS: start starttls=yes olcDbIDAssertAuthzFrom: {0}* olcDbRebindAsUser: FALSE olcDbChaseReferrals: TRUE olcDbTFSupport: no olcDbProxyWhoAmI: FALSE olcDbProtocolVersion: 3 olcDbSingleConn: FALSE olcDbCancel: abandon olcDbUseTemporaryConn: FALSE olcDbConnectionPoolMax: 16 olcDbNoRefs: FALSE olcDbNoUndefFilter: FALSE olcDbURI: ldap://ldap-m1.example.com olcDbIDAssertBind: mode=self flags=prescriptive,proxy-authz-non-critical bindmethod=simple timeout=0 network-timeout=0 binddn="cn=admin,dc=example,dc=com" credentials="secret" keepalive=0:0:0 starttls=yes tls_reqcert=allow If I change olcDbURI to either of the entries below, the replica server crashes * olcDbURI: "ldap://ldap-m1.example.com,ldap://ldap-m2.example.com" * olcDbURI: "ldap://ldap-m1.example.com ldap://ldap-m2.example.com" According to slapd-ldap(5), the URI list can be comma or space separated. I've turned on "args" and "trace" debugging to troubleshoot, but never get any errors in the logs. I only see an attempt to chase the referral followed by an immediate crash (see log snippet at the end of email). Finally, I'm running OpenLDAP 2.4.31 on Ubuntu Trusty, but was also able to replicate this same error on OpenLDAP 2.4.28 on Ubuntu Precise. Any help is much appreciated. -- Khosrow Ebrahimpour Crash Log: Sep 8 21:07:23 ldap-rep1 slapd[20947]: conn=1000 op=1 modifications: Sep 8 21:07:23 ldap-rep1 slapd[20947]: replace: givenName Sep 8 21:07:23 ldap-rep1 slapd[20947]: one value, length 1 Sep 8 21:07:23 ldap-rep1 slapd[20947]: conn=1000 op=1 MOD dn="uid=user1,ou=people,dc=example,dc=com" Sep 8 21:07:23 ldap-rep1 slapd[20947]: conn=1000 op=1 MOD attr=givenName Sep 8 21:07:23 ldap-rep1 slapd[20947]: bdb_dn2entry("uid=user1,ou=people,dc=example,dc=com") Sep 8 21:07:23 ldap-rep1 slapd[20947]: => hdb_dn2id("ou=people,dc=example,dc=com") Sep 8 21:07:23 ldap-rep1 slapd[20947]: <= hdb_dn2id: got id=0x6 Sep 8 21:07:23 ldap-rep1 slapd[20947]: => hdb_dn2id("uid=user1,ou=people,dc=example,dc=com") Sep 8 21:07:23 ldap-rep1 slapd[20947]: <= hdb_dn2id: got id=0xe Sep 8 21:07:23 ldap-rep1 slapd[20947]: entry_decode: "" Sep 8 21:07:23 ldap-rep1 slapd[20947]: <= entry_decode() Sep 8 21:07:23 ldap-rep1 slapd[20947]: send_ldap_result: conn=1000 op=1 p=3 Sep 8 21:07:23 ldap-rep1 slapd[20947]: send_ldap_result: err=10 matched="" text="" Sep 8 21:07:23 ldap-rep1 slapd[20947]: send_ldap_result: referral="ldap://ldap-m1.example.com/uid=user1,ou=people,dc=example,dc=com" Sep 8 21:07:23 ldap-rep1 slapd[20947]: >>> dnPrettyNormal: <uid=user1,ou=people,dc=example,dc=com> Sep 8 21:07:23 ldap-rep1 slapd[20947]: <<< dnPrettyNormal: <uid=user1,ou=people,dc=example,dc=com>, <uid=user1,ou=people,dc=example,dc=com> Sep 8 21:07:23 ldap-rep1 slapd[20947]: conn=1000 op=1 ldap_chain_op: ref="ldap://ldap-m1.example.com/uid=user1,ou=people,dc=example,dc=com" -> "ldap://ldap-m1.example.com" Sep 8 21:09:02 ldap-rep1 slapd[21057]: @(#) $OpenLDAP: slapd (Ubuntu) (Mar 17 2014 21:20:08) $ buildd@aatxe:/build/buildd/openldap-2.4.31/debian/build/servers/slapd

2 3

LDAP_OPT_DESC historic
by Michael Ströder 12 Sep '14

12 Sep '14

HI! What does it mean that there's the comment "historic" at constant LDAP_OPT_DESC in ldap.h? Is there another option value one should use to get the file descriptor of a connection? Ciao, Michael.

1 0

difference between configuration file
by Gremaud Cyrill 12 Sep '14

12 Sep '14

Hello List, I don’t understand the difference between /etc/ldap/ldap.conf and /etc/default/slapd For exemple, what is the difference between URI and SLAPD_SERVICES ? I want to authorise LDAP protocol only from localhost and only LDAPS for the external… How can I do this ? thanks

2 1

Multiple threads and mdb_dbi_open
by Harry B 12 Sep '14

12 Sep '14

Hello, As per the documentation here http://symas.com/mdb/doc/group__mdb.html#gac08cad5b096925642ca359a6d6f0562a I see the following, "This function must not be called from multiple concurrent transactions. A transaction that uses this function must finish (either commit or abort) before any other transaction may use this function." This seems to imply that after one txn has begun on an environment, I cannot create another txn or dbi until the first one has finished - that doesn't seem to be right. If I have multi-threaded app, what is the expected sequence for creation of Environment, Transaction, and DBI handles? Any help is appreciated. -- Harry

2 4

Re: Replication breaks and needs restart - version 2.4.30
by Raja T Nair 11 Sep '14

11 Sep '14

Hello Quanah, Thanks for your suggestion. I will seriously consider upgrading my installations. For now, the issue seems resolved by setting TCP keepalive values in my servers. Regards, Raja. On 9 September 2014 22:44, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, September 09, 2014 1:42 PM +0530 Raja T Nair < > rtnair(a)gmail.com> wrote: > > >> >> >> >> Hello All, >> >> >> I am running openldap-2.4.30 in multiple locations, and all are >> replicating from a single Provider. >> > > Upgrade to a current release, to start with. 2.4.30 is ancient, and > numerous replication related bugs have been fixed since that release. > Second, you may want to configure TCP keepalive settings in the syncrepl > setup, as it seems like you have a device between the replicas and master > that is timing out the connections. Hard to really know for sure, however. > > --Quanah > > > -- > > Quanah Gibson-Mount > Server Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- :^)

1 0

RE24 testing call (2.4.40)
by Quanah Gibson-Mount 10 Sep '14

10 Sep '14

If you know how to build OpenLDAP manually, and would like to participate in testing the next set of code for the 2.4.39 release, please do so. Generally, get the code for RE24: <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> Configure & build. Execute the test suite (via make test) after it is built. Thanks! --Quanah -- Quanah Gibson-Mount Server Architect Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

7 8

question on ldap_unbind_ext_s
by Aditham, Radhakrishna 09 Sep '14

09 Sep '14

Hi, We have a long running server that tries to get a new LDAP handle if the current handle becomes invalid (LDAP_SERVER_DOWN error, etc). However if I call ldap_unbind_ext_s() on the old handle to release it, it hangs with the following stack: (gdb) bt #0 0x000000080166935c in read () at read.S:2 #1 0x00000008014748f0 in __read (fd=68, buf=0x803293003, nbytes=5) at /.automount/nfs.panwest.panasas.com/root/sb10/hlewis/hlewis-sb10-pioneer-ldap/src/freebsd-c/lib/libthr/thread/thr_syscalls.c:384 #2 0x0000000802c715d2 in sb_stream_read (sbiod=0x8088070d0, buf=0x803293003, len=5) at /.automount/nfs.panwest.panasas.com/root/sb10/hlewis/hlewis-sb10-pioneer-ldap/src/likewise/openldap/libraries/liblber/sockbuf.c:493 #3 0x0000000802c7207e in sb_debug_read (sbiod=0x803291220, buf=0x803293003, len=5) at /.automount/nfs.panwest.panasas.com/root/sb10/hlewis/hlewis-sb10-pioneer-ldap/src/likewise/openldap/libraries/liblber/sockbuf.c:827 #4 0x0000000802356971 in tlso_bio_read (b=0x803205400, buf=0x803293003 "\027\003\001", len=5) at tls_o.c:687 #5 0x000000080252c2df in BIO_read () from /usr/lib/libcrypto.so.1.0.0 #6 0x0000000802eb9f01 in ssl3_read_n () from /usr/lib/libssl.so.1.0.0 #7 0x0000000802eba3ce in ssl3_read_bytes () from /usr/lib/libssl.so.1.0.0 #8 0x0000000802eb67ac in ssl3_shutdown () from /usr/lib/libssl.so.1.0.0 #9 0x0000000802356cf6 in tlso_sb_close (sbiod=0x803291250) at tls_o.c:808 #10 0x0000000802c71253 in ber_int_sb_close (sb=0x803291160) at /.automount/nfs.panwest.panasas.com/root/sb10/hlewis/hlewis-sb10-pioneer-ldap/src/likewise/openldap/libraries/liblber/sockbuf.c:383 #11 0x000000080233d625 in ldap_free_connection (ld=0x804c48c00, lc=0x8088080f0, force=1, unbind=1) at request.c:769 #12 0x000000080232ffa2 in ldap_ld_free (ld=0x804c48c00, close=1, sctrls=0x0, cctrls=0x0) at unbind.c:93 #13 0x000000080232fe8b in ldap_unbind_ext (ld=0x804c48c00, sctrls=0x0, cctrls=0x0) at unbind.c:52 #14 0x000000080232fec5 in ldap_unbind_ext_s (ld=0x804c48c00, sctrls=0x0, cctrls=0x0) at unbind.c:61 ...... I want to make sure that there are memory leaks etc, hence the attempt to release the invalid handle. Question: What is the best or correct way to release an invalid LDAP handle? Appreciate any help. Thanks R.K. Aditham

2 2

Replication breaks and needs restart - version 2.4.30
by Raja T Nair 09 Sep '14

09 Sep '14

Hello All, I am running openldap-2.4.30 in multiple locations, and all are replicating from a single Provider. Though it seems working fine initially, the replication stops as time progresses. The only way to bring it back is to restart clients. Here are the relevant configuration lines from my provider and consumers: Provider: ----------- overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 Consumer: ----------------- syncrepl rid=203 provider=ldap://192.168.1.101:389 type=refreshAndPersist searchbase="dc=com" retry="120 3" attrs="*,+" scope=sub bindmethod=simple binddn="cn=user1,ou=people,dc=mydomain,dc=com" credentials="user1pass" It would be great if someone can help me with this situation. Currently I keep restarting every client, and it breaks the respective operation being served by the client every now and then. Thanks in Advance, Raja. -- :^)

2 1

Counting the total number of users in an AD forest
by Sankar P 09 Sep '14

09 Sep '14

Hi, Is there a way to count the total number of user objects in an AD forest. I do not want the names/details of any of these user objects. But I just want a programmatic way of finding the total number of AD users. Is it possible to achieve ? Could not get anything related from Googling. Thanks. -- Sankar P http://psankar.blogspot.com

3 2

Error when trying to setup olcMirrorMode
by Gremaud Cyrill 09 Sep '14

09 Sep '14

Hello, I'm trying to setup N-way multimaster replication for cn=config only (for the moment). I have problem when I try to add olcMirrorMode: TRUE. Here is my ldif file to do this: dn: olcDatabase={0}config,cn=config changetype: modify add: olcMirrorMode olcMirrorMode: TRUE and the error is the following : root@ldap1:~/downloads/ldif/config# ldapmodify -Y EXTERNAL -H ldapi:// -f 7_addMirrorMode.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "olcDatabase={0}config,cn=config" ldap_modify: Server is unwilling to perform (53) additional info: shadow context; no update referral I have tried a lot of things but nothing working. Please I really need your help. Thanks a lot. Cyrill Gremaud

3 6

what mean null_callback : error code 0x35
by Gremaud Cyrill 09 Sep '14

09 Sep '14

Hi all, I have freshly installed 3 openLDAP 2.4 with cn=config and setting up N-Way multi master replication. When I check the logs, I have a lot of this error: slapd[2534] : null_callback : error code 0x35 What this error means ? thanks in advance for your help. cyrill gremaud

1 0

Q: frontend and cn=Subschema
by Ulrich Windl 08 Sep '14

08 Sep '14

Hi! forgive a beginner's question, but: If I examine cn=Subschema, I see the following object classes: objectClass[0] top objectClass[1] subentry objectClass[2] subschema objectClass[3] extensibleObject And among the attributes is ldapSyntaxes. ldapSyntaxes however is not part of subentry or subschema; according to the schemata presented, ldapSyntaxes is only part of olcGlobal and olcSchemaConfig. So should cn=Subentry have olcSchemaConfig as auxiliary object class? And in which object class should structuralObjectClass (and things like createTimestamp) belong? Regards, Ulrich

2 1

OpenLDAP self-signed certificates issue
by Vijay Ganesan 08 Sep '14

08 Sep '14

For SSL, I'm trying to install a self-signed certificate to OpenLDAP (version 2.4.28 on Ubuntu 12.04). Followed the following steps: *1. Created server certificate using:* openssl req -newkey rsa:1024 -x509 -nodes -out server.pem -keyout server.pem -days 365 *2. Added following entries to /usr/share/slapd/slapd.conf:* TLSCACertificateFile server.pem TLSCertificateFile server.pem TLSCertificateKeyFile server.pem *3. Restarted openldap:* sudo /etc/init.d/slapd restart *4. Tried to read the certs:* openssl s_client -connect localhost:636 -showcerts This causes the following error: *CONNECTED(00000003)* *140409289410208:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:177:* *---* *no peer certificate available* *---* *No client certificate CA names sent* *---* *SSL handshake has read 0 bytes and written 213 bytes* *---* *New, (NONE), Cipher is (NONE)* *Secure Renegotiation IS NOT supported* *Compression: NONE* *Expansion: NONE* *---* Can someone help with what might be wrong in the setup? Thanks -- - Vijay

5 9

LDAP gateway to RADIUS serverf
by David R 08 Sep '14

08 Sep '14

Dear All, I have setup 2 factor authentication on a RADIUS server (OTP).The user has to authenticate using:login: adusernamepassword: ADpasswordGENERATEDPIN My issue is that some applications like VMWare supports only LDAP authentication. So i was wondering how i could use RADIUS server for authentication inside LDAP. I have found some elements like pw-radius.so, but this is clearly not fully documented. So I was wondering if one of you has ever implemented this kind of solution and how... Kind reagrds, David

3 2

accesslog search filter using reqAttr
by John Alex. 08 Sep '14

08 Sep '14

Hi all, Is anyone using "reqAttr" of accesslog overlay to find ldap requests for specific attributes? Our accesslog db contains some entries like for example: dn: reqStart=20140902092840.000001Z,cn=accesslog objectClass: auditSearch reqStart: 20140902092840.000001Z reqEnd: 20140902092840.000002Z reqType: search reqSession: 1018 reqAuthzID: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth reqDN: dc=example,dc=com reqResult: 0 reqScope: sub reqDerefAliases: never reqAttrsOnly: FALSE reqFilter: (objectClass=*) reqAttr: userPassword reqEntries: 7 reqTimeLimit: 3600 reqSizeLimit: 500 I am trying to search using the filter "(reqAttr=userPassword)" but no results are returned, while "(reqAttr=*)" returns all entries. What am I missing? Using version 2.4.39 John

1 1

slap_client_connect error
by Gremaud Cyrill 08 Sep '14

08 Sep '14

Hello ! I’m trying to setup N-way multi master replication with openLDAP 2.4 but I have an error when I reload my servers. slapd_client_connect : URI=ldap://lda2.gremaud.local DN=“cn=config” ldap_sasl_bind_s failed (-1) How this error is possible ? I can make a ldapsearch with dn=config and correct password on all my servers… thanks for your help.

1 0

LMDB : MDB_BAD_RSLOT on mdb_txn_begin
by Venkat Murty 06 Sep '14

06 Sep '14

Hello, What is the reason I get MDB_BAD_RSLOT on mdb_txn_begin? This is a read transaction. -venkat

1 0

Mail System Error - Returned Mail
by dieter＠dkluenter.de 06 Sep '14

06 Sep '14

Your message could not be delivered

1 0

sha2 module and 2.4.39, iterations question
by bitsofinfo 05 Sep '14

05 Sep '14

Hi - openldap version = 2.4.39 With: moduleload pw-sha2.la I have an application that generates SHA256 b64 encoded hashes w/ a 4byte (16bit) salt and stores them in userPassword and binds work fine When I add this to slapd.conf: password-crypt-salt-format $5$rounds=1000$%.16s And change my application to add 1000 iterations when it writes to userPassword, then binds fail pw in userPassword is generated in this format: {SSHA256}b64Encoded(sha256Digest1000Iterations(pw+salt)+salt) Is "password-crypt-salt-format" the correct place to specify we want to use iterations on our hashes? Is this configurable?

2 2

Re[4]: Trying to Mirror 2 OpenLDAP servers
by Sterling Sahaydak 05 Sep '14

05 Sep '14

Thanks Quanah, Appreciate the prompt reply and as you advised, I'll try the other build you mentioned. Best Regards, Sterling ------ Original Message ------ From: "Quanah Gibson-Mount" <quanah(a)zimbra.com> To: "Sterling Sahaydak" <sterling.sahaydak(a)pi-coral.com>; openldap-technical(a)openldap.org Sent: 9/4/2014 7:12:22 PM Subject: Re: Re[2]: Trying to Mirror 2 OpenLDAP servers >--On Thursday, September 04, 2014 11:52 PM +0000 Sterling Sahaydak ><sterling.sahaydak(a)pi-coral.com> wrote: > >>I think your response, you may be getting confused with someone else? >> >>I haven't been on IRC - don't have an account there or even installed >>to >>check, so not sure of the dialog or reference you are referring to. >> >>As to the build, I'm on CentOS and not RHEL, so as to the build it's >>relatively up to date on that platform and definitely not 4 years old. >>Maybe a couple months old only. >> >>My understanding is this is not restricted to RHEL only, so still >>inquiring to the community assistance here. If there is another >>please, >>then please let me know. > >Ah, interesting timing... Someone was on IRC with a nick similar to >your name asking almost identical questions. ;) > >In any case, everything I noted still stands. Avoid the RHEL build >(that's what is in CentOS). Use a sane build. Otherwise you're just >wasting everyone's time. > >--Quanah > > >-- > >Quanah Gibson-Mount >Server Architect >Zimbra, Inc. >-------------------- >Zimbra :: the leader in open source messaging and collaboration

1 0

Re[2]: Trying to Mirror 2 OpenLDAP servers
by Sterling Sahaydak 05 Sep '14

05 Sep '14

I think your response, you may be getting confused with someone else? I haven't been on IRC - don't have an account there or even installed to check, so not sure of the dialog or reference you are referring to. As to the build, I'm on CentOS and not RHEL, so as to the build it's relatively up to date on that platform and definitely not 4 years old. Maybe a couple months old only. My understanding is this is not restricted to RHEL only, so still inquiring to the community assistance here. If there is another please, then please let me know. Running into the following: slapd -d sync @(#) $OpenLDAP: slapd 2.4.23 (Feb 3 2014 19:11:35) $ mockbuild@c6b10.bsys.dev.centos.org:/builddir/build/BUILD/openldap-2.4.23/openldap-2.4.23/build-servers/servers/slapd /etc/openldap/slapd.conf: line 163: warning, destination attributeType 'sAMAccountName' is not defined in schema PROXIED attributeDescription "SAMACCOUNTNAME" inserted. /etc/openldap/slapd.conf: line 213: rootdn is always granted unlimited privileges. bdb_monitor_db_open: monitoring disabled; configure monitor database to enable slapd starting TLS: error: the certificate '/etc/openldap/certs/ldap_example_net.crt' could not be found in the database - error -12285:Unable to find the certificate or key necessary for authentication.. TLS: certificate '/etc/openldap/certs/ldap_example_net.crt' successfully loaded from PEM file. TLS: no unlocked certificate for certificate 'CN=ldap.example.net,O="xx-xxxxxxx, INC.",L=xxxx,ST=xxxxxx,C=US'. do_syncrep2: rid=001 LDAP_RES_INTERMEDIATE - REFRESH_DELETE In my slapd.conf I have setup (Provider setup): TLSCertificateFile /etc/openldap/certs/ldap_example_net.crt TLSCertificateKeyFile /etc/openldap/certs/ldap_example_net.key TLSCACertificateFile /etc/openldap/certs/CAcompany.crt serverID 1 overlay syncprov #syncprov-checkpoint 100 10 syncprov-checkpoint 100 2 syncprov-sessionlog 100 #LDAP Sync - Slave - Consumer syncrepl rid=001 provider=ldaps://ldap-west.examplel.net bindmethod=simple binddn="cn=xxxxx,ou=Roles,dc=pcoral,dc=net" credentials=xxxxxxxxxxxx searchbase="dc=example,dc=net" filter="(objectclass=*)" attrs="*" schemachecking=on type=refreshAndPersist interval=00.00.00:30 retry="60 +" mirrormode on So, not sure why the synchronization isn't working? Thanks. ------ Original Message ------ From: "Quanah Gibson-Mount" <quanah(a)zimbra.com> To: "Sterling Sahaydak" <sterling.sahaydak(a)pi-coral.com>; openldap-technical(a)openldap.org Sent: 9/4/2014 5:47:38 PM Subject: Re: Trying to Mirror 2 OpenLDAP servers >--On Thursday, September 04, 2014 3:30 PM -0700 Quanah Gibson-Mount ><quanah(a)zimbra.com> wrote: > >>--On Thursday, September 04, 2014 10:14 PM +0000 Sterling Sahaydak >><sterling.sahaydak(a)pi-coral.com> wrote: >> >>> >>>Just updated slapd.conf with CA Certs and trying to get mirroring >>>synchronization to work. >>> >>>Running into the following: >>> >>>slapd -d sync >>>@(#) $OpenLDAP: slapd 2.4.23 (Feb 3 2014 19:11:35) $ >> >>Don't waste your time using this build, as you were already informed >>on >>IRC. > >Since you quit IRC in a huff, I'll give you some follow on thoughts: > >a) It is not the community's job to support the broken builds that RHEL >created. They are known to have numerous problems, some of which were >inflicted by RH itself by doing custom patches against OpenLDAP. > >b) 2.4.23 is over 4 years old at this point. There have been numerous >bugs fixed since that release, particularly around MMR. > >c) RHEL links to the non-standard NSS encryption libraries, which are >utterly broken in concept, which may be the cause of your cert issues > >d) There are freely available current alternatives to using the crap >shipped by RHEL if you are not comfortable with building OpenLDAP >yourself. You should investigate using them rather than complaining >that the community is refusing to support RHEL's garbage. > >Alternatives: ><http://www.symas.com/> - They offer free OpenLDAP builds sanely linked >to OpenSSL. They also provide support contracts, with extremely >knowledgable staff (The primary openldap developer works for them, for >example). > ><http://ltb-project.org/wiki/> - They offer free OpenLDAP builds sanely >linked to OpenSSL. They also have a support forum for their builds. > >--Quanah > >-- > >Quanah Gibson-Mount >Server Architect >Zimbra, Inc. >-------------------- >Zimbra :: the leader in open source messaging and collaboration

2 1

Trying to Mirror 2 OpenLDAP servers
by Sterling Sahaydak 04 Sep '14

04 Sep '14

Just updated slapd.conf with CA Certs and trying to get mirroring synchronization to work. Running into the following: slapd -d sync @(#) $OpenLDAP: slapd 2.4.23 (Feb 3 2014 19:11:35) $ mockbuild@c6b10.bsys.dev.centos.org:/builddir/build/BUILD/openldap-2.4.23/openldap-2.4.23/build-servers/servers/slapd /etc/openldap/slapd.conf: line 163: warning, destination attributeType 'sAMAccountName' is not defined in schema PROXIED attributeDescription "SAMACCOUNTNAME" inserted. /etc/openldap/slapd.conf: line 213: rootdn is always granted unlimited privileges. bdb_monitor_db_open: monitoring disabled; configure monitor database to enable slapd starting TLS: error: the certificate '/etc/openldap/certs/ldap_example_net.crt' could not be found in the database - error -12285:Unable to find the certificate or key necessary for authentication.. TLS: certificate '/etc/openldap/certs/ldap_example_net.crt' successfully loaded from PEM file. TLS: no unlocked certificate for certificate 'CN=ldap.example.net,O="xx-xxxxxxx, INC.",L=xxxx,ST=xxxxxx,C=US'. do_syncrep2: rid=001 LDAP_RES_INTERMEDIATE - REFRESH_DELETE In my slapd.conf I have setup (Provider setup): TLSCertificateFile /etc/openldap/certs/ldap_example_net.crt TLSCertificateKeyFile /etc/openldap/certs/ldap_example_net.key TLSCACertificateFile /etc/openldap/certs/CAcompany.crt serverID 1 overlay syncprov #syncprov-checkpoint 100 10 syncprov-checkpoint 100 2 syncprov-sessionlog 100 #LDAP Sync - Slave - Consumer syncrepl rid=001 provider=ldaps://ldap-west.examplel.net bindmethod=simple binddn="cn=xxxxx,ou=Roles,dc=pcoral,dc=net" credentials=xxxxxxxxxxxx searchbase="dc=example,dc=net" filter="(objectclass=*)" attrs="*" schemachecking=on type=refreshAndPersist interval=00.00.00:30 retry="60 +" mirrormode on So, not sure why the synchronization isn't working? Thanks!!!

2 2

Re: slap_queue_csn and slap_graduate_commit_csn in log
by Stefano Zanmarchi 04 Sep '14

04 Sep '14

Thank you Quanah, it works, but now my doubt is: do the log lines containing slap_queue_csn and slap_graduate_commit_csn mean that replication is on and that a slave is syncing? On Wed, Sep 3, 2014 at 7:09 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Wednesday, September 03, 2014 10:55 AM +0200 Stefano Zanmarchi < > zanmarchi(a)gmail.com> wrote: > > >> Thank you very much for the hint Ulrich, >> does anyone else know if it is normal to have thousands of lines like >> these in the log: >> > > You will have one per commit as long as you have "sync" logging enabled in > your loglevel. If you don't want to see them, remove "sync" from your > loglevel. > > --Quanah > > -- > > Quanah Gibson-Mount > Server Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

FW: Openldap search results varies with search base
by Jeganathan S 04 Sep '14

04 Sep '14

Hi All, We are searching with same filter but with two different search bases and we are seeing results to be different. Case1: (working case) Search filter: (cn=monitorsoapnode*) Search base: o=itsmydomain.com Search result: cn=monitorsoapnode@np-m910-45-4,cn=soap nodes,o=system,cn=cordys,cn=ucloud,o=itsmydomain.com<mailto:cn=monitorsoapnode@np-m910-45-4,cn=soap%20nodes,o=system,cn=cordys,cn=ucloud,o=itsmydomain.com> cn=monitorsoapnode@ np-m910-87-8,cn=soap nodes,o=system,cn=cordys,cn=ucloud,o=itsmydomain.com Case2: (not working case) Search filter: (cn=monitorsoapnode*) Search base: cn=ucloud,o=itsmydomain.com Search result: cn=monitorsoapnode@np-m910-45-4,cn=soap nodes,o=system,cn=cordys,cn=ucloud,o=itsmydomain.com<mailto:cn=monitorsoapnode@np-m910-45-4,cn=soap%20nodes,o=system,cn=cordys,cn=ucloud,o=itsmydomain.com> It is observed that with search base "o=system,cn=cordys,cn=ucloud,o=itsmydomain.com" we are getting the expected results. We are seeing this behaviour with hdb database, but not with bdb. But we want to stick to hdb only. Is there any workaround to fix the issue(something like changing the configuration settings)? It is also observed that in both cases bdb_substring_candidates value is 2 but bdb_search_candidates value is different. I am not sure if this observation is relevant or not. You can check the logs for working and not working cases below. Please help. ########Not working case log ################## <= send_search_entry: conn 1000 exit. send_ldap_result: conn=1000 op=8 p=3 send_ldap_response: msgid=9 tag=101 err=0 ber_flush2: 14 bytes to sd 12 connection_get(12): got connid=1000 connection_read(12): checking for input on id=1000 ber_get_next connection_get(12): got connid=1000 connection_read(12): checking for input on id=1000 ber_get_next ber_get_next: tag 0x30 len 118 contents: op tag 0x63, time 1409136356 ber_get_next conn=1000 op=9 do_search ber_scanf fmt ({miiiib) ber: >>> dnPrettyNormal: <cn=ucloud,o=itsmydomain.com> <<< dnPrettyNormal: <cn=ucloud,o=itsmydomain.com>, <cn=ucloud,o=itsmydomain.com> ber_scanf fmt ({m) ber: ber_scanf fmt (m) ber: ber_scanf fmt ({M}}) ber: => get_ctrls ber_scanf fmt ({m) ber: => get_ctrls: oid="2.16.840.1.113730.3.4.2" (noncritical) <= get_ctrls: n=1 rc=0 err="" => hdb_search bdb_dn2entry("cn=ucloud,o=itsmydomain.com") search_candidates: base="cn=ucloud,o=itsmydomain.com" (0x00000002) scope=2 => hdb_dn2idl("cn=ucloud,o=itsmydomain.com") => bdb_substring_candidates (cn) => key_read <= bdb_index_read 6 candidates => key_read <= bdb_index_read 33 candidates => key_read <= bdb_index_read 3 candidates => key_read <= bdb_index_read 17 candidates => key_read <= bdb_index_read 6 candidates => key_read <= bdb_index_read 18 candidates <= bdb_substring_candidates: 2, first=267, last=198029 bdb_search_candidates: id=1 first=267 last=267 => send_search_entry: conn 1000 dn="cn=monitorsoapnode@np-m910-45-4,cn=soap nodes,o=system,cn=cordys,cn=ucloud,o=itsmydomain.com<mailto:cn=monitorsoapnode@np-m910-45-4,cn=soap%20nodes,o=system,cn=cordys,cn=ucloud,o=itsmydomain.com>" ber_flush2: 140 bytes to sd 12 <= send_search_entry: conn 1000 exit. send_ldap_result: conn=1000 op=9 p=3 send_ldap_response: msgid=10 tag=101 err=0 ber_flush2: 14 bytes to sd 12 ########Working case log ################## <= send_search_entry: conn 1000 exit. send_ldap_result: conn=1000 op=9 p=3 send_ldap_response: msgid=10 tag=101 err=0 ber_flush2: 14 bytes to sd 12 connection_get(12): got connid=1000 connection_read(12): checking for input on id=1000 ber_get_next connection_get(12): got connid=1000 connection_read(12): checking for input on id=1000 ber_get_next ber_get_next: tag 0x30 len 108 contents: op tag 0x63, time 1409136444 ber_get_next conn=1000 op=10 do_search ber_scanf fmt ({miiiib) ber: >>> dnPrettyNormal: <o=itsmydomain.com> <<< dnPrettyNormal: <o=itsmydomain.com>, <o=itsmydomain.com> ber_scanf fmt ({m) ber: ber_scanf fmt (m) ber: ber_scanf fmt ({M}}) ber: => get_ctrls ber_scanf fmt ({m) ber: => get_ctrls: oid="2.16.840.1.113730.3.4.2" (noncritical) <= get_ctrls: n=1 rc=0 err="" => hdb_search bdb_dn2entry("o=itsmydomain.com") search_candidates: base="o=itsmydomain.com" (0x00000001) scope=2 => hdb_dn2idl("o=itsmydomain.com") => bdb_substring_candidates (cn) => key_read <= bdb_index_read 6 candidates => key_read <= bdb_index_read 33 candidates => key_read <= bdb_index_read 3 candidates => key_read <= bdb_index_read 17 candidates => key_read <= bdb_index_read 6 candidates => key_read <= bdb_index_read 18 candidates <= bdb_substring_candidates: 2, first=267, last=198029 bdb_search_candidates: id=2 first=267 last=198029 => send_search_entry: conn 1000 dn="cn=monitorsoapnode@np-m910-45-4,cn=soap nodes,o=system,cn=cordys,cn=ucloud,o=itsmydomain.com<mailto:cn=monitorsoapnode@np-m910-45-4,cn=soap%20nodes,o=system,cn=cordys,cn=ucloud,o=itsmydomain.com>" ber_flush2: 140 bytes to sd 12 <= send_search_entry: conn 1000 exit. => send_search_entry: conn 1000 dn="cn=monitorsoapnode@np-m910-87-8,cn=soap nodes,o=system,cn=cordys,cn=ucloud,o=itsmydomain.com<mailto:cn=monitorsoapnode@np-m910-87-8,cn=soap%20nodes,o=system,cn=cordys,cn=ucloud,o=itsmydomain.com>" ber_flush2: 140 bytes to sd 12 <= send_search_entry: conn 1000 exit. send_ldap_result: conn=1000 op=10 p=3 send_ldap_response: msgid=11 tag=101 err=0 ber_flush2: 14 bytes to sd 12 Slapd config details you may be interested in are as follows ####### Config details start ###### database hdb suffix "o= itsmydomain.com" rootdn "cn=Directory Manager,o= itsmydomain.com" rootpw {SSHA}4tqAhskuvQm3wFz9EI3lqLI8pRRs6IfI sizelimit 2000 index default pres,eq index cn pres,eq,sub index objectClass eq index entryCSN,entryUUID eq index authenticationuser pres,eq,sub index osidentity pres,eq,sub cachesize 5000 checkpoint 1024 10 ####### Config details end ###### Regards, Jegan.

2 4

slap_queue_csn and slap_graduate_commit_csn in log
by Stefano Zanmarchi 03 Sep '14

03 Sep '14

Hi all, I can see thousands of lines like the following in my log: Sep 2 18:16:54 db51 slapd[16511]: slap_queue_csn: queing 0x432f20d0 20140902161654.626905Z#000000#000#000000 Sep 2 18:16:54 db51 slapd[16511]: slap_graduate_commit_csn: removing 0x2aaab801d1c0 20140902161654.626905Z#000000#000#000000 What are they related to? Could it be replication? Hope not because we used to have a syncrepl slave, but it has been turned off time ago and "moduleload syncprov.la" is commented out in slapd.conf. Thank you very much for your help!

3 3

slapd doesn't start with openldap-2.4.39 and cyrus-sasl-2.1.26
by Jeganathan S 03 Sep '14

03 Sep '14

Hi All, I am trying to build openldap 2.4.39 with following dependencies in RHEL 5.5. BerkleyDB-5.1.29, cyrus-sasl-2.1.26 and openssl-1.0.1i. "make test" is failing due to failure in starting the ldap server. The content of the log file is given below. When I disable cyrus-sasl while building openssl, I don't get the issue. Is there any known issue with these combination? The configuration options are: export CPPFLAGS="-I/opt/cars-openldap-building/build_outputs/openldap_binaries/berkeleydb/include -I/opt/cars-openldap-building/build_outputs/openldap_binaries/openssl/include/openssl -I/opt/cars-openldap-building/build_outputs/openldap_binaries/cyrussasl/include/sasl" export LDFLAGS="-L/opt/cars-openldap-building/build_outputs/openldap_binaries/berkeleydb/lib -L/opt/cars-openldap-building/build_outputs/openldap_binaries/openssl/lib -L/opt/cars-openldap-building/build_outputs/openldap_binaries/cyrussasl/lib -L/opt/cars-openldap-building/build_outputs/openldap_binaries/cyrussasl/lib/sasl2" export LD_LIBRARY_PATH=/opt/cars-openldap-building/build_outputs/openldap_binaries/berkeleydb/lib:/opt/cars-openldap-building/build_outputs/openldap_binaries/openssl/lib:/opt/cars-openldap-building/build_outputs/openldap_binaries/cyrussasl/lib:/opt/cars-openldap-building/build_outputs/openldap_binaries/cyrussasl/lib/sasl2 ./configure --prefix=/opt/cars-openldap-building/build_outputs/openldap_binaries/openldap --exec-prefix=/opt/cars-openldap-building/build_outputs/openldap_binaries/openldap --with-tls=openssl --enable-bdb=mod --enable-hdb=mod --enable-mdb=mod Regards, Jeganathan ***************start of log file ********************* ldap_url_parse_ext(ldap://lap_sasl_init: auxprop add plugin failedocalhost/) 5406f5e9 @(#) $OpenLDAP: slapd 2.4.39 (Sep 3 2014 16:35:00) $ root@srv-ind-mdm6l.vanenburg.com:/opt/cars-openldap-building/openldap-2.4.39/servers/slapd ldap_pvt_gethostbyname_a: host=srv-ind-mdm6l.vanenburg.com, r=0 5406f5e9 daemon_init: ldap://localhost:9011/ 5406f5e9 daemon_init: listen on ldap://localhost:9011/ 5406f5e9 daemon_init: 1 listeners to open... ldap_url_parse_ext(ldap://localhost:9011/) 5406f5e9 daemon: listener initialized ldap://localhost:9011/ 5406f5e9 daemon_init: 1 listeners opened ldap_create 5406f5e9 slapd init: initiated server. 5406f5e9 slap_sasl_init: auxprop add plugin failed 5406f5e9 slapd destroy: freeing system resources. 5406f5e9 slapd stopped. 5406f5e9 connections_destroy: nothing to destroy. *********************end of logfile***************

1 0

ppolicy and repeated password
by Stefano Zanmarchi 03 Sep '14

03 Sep '14

Hi all, we'd like to use the ppolicy overlay to implement password locking after a certain number of bind failures. Sadly ppolicy does not distinguish between failures with different passwords (probably a dictionary attack) and failures with the same password (a client using an old, expired, password). This would easily lead to locking out users shortly after password change. I read that Zytrax has developed for Mozilla a modified version of ppolicy: http://www.zytrax.com/books/ldap/ch6/ppolicy.html which can distinguish between unique and repeated passwords. The page states the modified mozilla-ppolicy is available for openldap 2.4.11 and 2.4.16. Has anyone tried it with a newer version of openldap? Is it working? Thank you in advance, Stefano

1 0

accesslog-based consumer stuck on objectClass modify on provider
by Francesco Malvezzi 03 Sep '14

03 Sep '14

Hi all, yesterday I changed a structural objectClass for a entry with the relax control (control: 1.3.6.1.4.1.4203.666.5.12): dn: uid=cognos,ou=agents,dc=example,dc=org control: 1.3.6.1.4.1.4203.666.5.12 changetype: modify replace: objectClass objectClass: inetOrgPerson - add: sn sn: cognos On provider all ok. Provider is mirrormode and other mirror side is ok. The accesslog-based syncrepl on a consumer was stuck. Neither the modify nor the other next modifies were propagated. Is relax control unsupported in this scenario? Did I forget something really important? thank you, Francesco PS: I deleted on provider from accesslog db the entry corresponding to the said modify, restarted both consumer and provider and replica started again.

3 3

ACLQuestion
by Karl Heinz Wichmann 01 Sep '14

01 Sep '14

Hallo I have a problem with acl. We have following sturctur. dc=a,dc=b,dc=c | |-ou=ww-a | |-ou=ww-b | |-ou=ww-c | |-ou=ww-x | |-ou=system In each ww-a,b,c...x have we users and groups. In system we have system account (in groups and users) When we search with an ldap client like thunderbird addressbook, the users in system should not be visible. I use follow rule didn't run: olcAccess: {1}to filter="(objectclass=inetOrgperson)" attrs=entry,uid,sn,cn,mail,givenName by dn="cn=ad,ou=sys_ad,ou=people,dc=a,dc=b,dc=c" read by * none the following rule, i found all users (incl. ad, admin and so on) olcAccess: {1}to filter="(objectclass=*)" attrs=entry,uid,sn,cn,mail,givenName by dn="cn=ad,ou=system,dc=a,dc=b,dc=c" read by * none I want to avoid regex when posible. Karl Heinz

1 0

LMDB write/read simultaneously over different threads
by Vasilis Lasdas 29 Aug '14

29 Aug '14

Hi all, I am a new user to LMDB. Please forgive me for my ignorance or mistakes you might encounter. However, I have spent quite some time trying to resolve my issues but without a success. That's why I am writing to you asking for your help to shade some light. To the point: 1) I am having a database where there is only one writer and a few readers(e.g. 4 readers). 2) The database-writer lives on different thread than the database-reader(s). 3) The writer-thread keeps on running/writing all the time to the database. 4) At random intervals readers from different threads will request to extract data from the database. The problem that occurs is the following: If the writer is active( during writing), If I try to fetch any data from the db using the reader, it fails, with error MDB_NOTFOUND. As a remark here, I make sure that the reader-thread is launched AFTER the writer thread to ensure that the data exist in the db. In order to simulate this kind of behaviour(write-read) over different threads, I have written a small test application, that tries to depict my case/usecase. In main() I simply launch two threads/functions, the writer-thread and after some time, the reader thread. The common enviroment is constructed() in main and passed as parameter to the auxilliary functions. If the reader starts reading while writing is not finished, then the application crashes or returns MDB_NOTFOUND. This contradicts with the capabilities of the library, that is, parallel write/read from different threads. If the writer has finished, then the reader works properly. Some general questions. i) How many times do i need to open the database? Currently I open the (unique) database twice: one in the writer and one in the reader. The doc mentions that it has to be opened only one time. Even in that case, my app does not work. ii) What is the practical usage of mdb_txn_reset() and mdb_txn_renew()? Does it need to be used in my case? iii) Since I am only ADDING data in the db and only READING them, what kind of optimizations can be applied? iv) Regarding for-loops, what is a proper way of using the trasnactions and commit/abort/reset/etc of transactions? Please any helpfull information is highly apprecited or if someone can add some examples with different threads that would be awesome. #include <iostream> #include <thread> #include <assert.h> #include <string> #include "lmdb.h" #include <unistd.h> using namespace std; void writeLMDB( MDB_env * env, size_t nrElems ) { cout << "BEGIN WRITING." << endl; MDB_txn *txn; MDB_dbi dbi; MDB_stat status; // create transaction assert( MDB_SUCCESS == mdb_txn_begin( env, NULL, 0, &txn ) ); // open db assert( MDB_SUCCESS == mdb_open( txn, NULL, MDB_DUPSORT , &dbi ) ); // this commit-transaction is needed since we are creating the db for the first time assert( MDB_SUCCESS == mdb_txn_commit( txn ) ); MDB_val key, data; // begin (again a new transaction) assert( MDB_SUCCESS == mdb_txn_begin( env, NULL, 0, &txn ) ); // keep on writing elements in the db for( size_t i = 0; i < nrElems ; ++i ) { key.mv_size = sizeof( size_t ); key.mv_data = &i; string value = "test"; data.mv_size = value.size(); data.mv_data = (void*)value.data(); cout << "WRITER-KEY:" << *(size_t*)key.mv_data << " VALUE:" ; cout.write( (char*)data.mv_data, data.mv_size ); cout << endl; assert( MDB_SUCCESS == mdb_put( txn, dbi, &key, &data, 0 ) ); } assert( MDB_SUCCESS == mdb_txn_commit( txn ) ); assert( MDB_SUCCESS == mdb_env_stat( env, &status ) ); mdb_close( env, dbi ); cout << "FINISHED WRITING." << endl; } void readLMDB( MDB_env * _env, size_t start, size_t end ) { cout << "BEGIN READING.." << endl; MDB_dbi dbi; MDB_txn *txn = NULL; // lmdb operations assert( MDB_SUCCESS == mdb_txn_begin( _env, NULL, MDB_RDONLY, &txn ) ); assert( MDB_SUCCESS == mdb_open( txn, NULL, 0, &dbi ) ); // key+data MDB_val key, data; for ( size_t i = start; i <= end ; i++ ) { key.mv_size = sizeof( size_t ); key.mv_data = &i; int res = mdb_get( txn, dbi , &key, &data ); //cout << "READER-KEY:" << *(size_t*)key.mv_data << " VALUE:" ; cout.write( (char*)data.mv_data, data.mv_size ); cout << endl; if( res != 0 ) cout << "error fetching data" << endl; } // close db mdb_close( _env, dbi ); cout << "FINISHED READING.." << endl; } int main(int argc, char *argv[] ) { // db location(folder must exist) string dbLocation = "/work/vasilis/databases/lmdbtest/"; size_t maxdbSize = 10485760; system( "rm -rf /work/vasilis/databases/lmdbtest/*" ); //create enviroment:ONE enviroment only for one process MDB_env * _env; assert( MDB_SUCCESS == ( mdb_env_create( &_env ) ) ); //set the size of the database assert( MDB_SUCCESS == mdb_env_set_mapsize( _env, maxdbSize ) ); // open the enviroment: ready to be used by everyone else assert( MDB_SUCCESS == mdb_env_open( _env, dbLocation.c_str(), 0 , 0664 ) ); // writer-thread: write 1000 elements in the database thread writethread( writeLMDB, _env, 1000 ); usleep( 1000 * 100 ); // read from - to thread readthread( readLMDB, _env, 0, 20 ); // wait for threads to finish writethread.join(); readthread.join(); cout << "THREADS COMPLETED " << endl; // close the enviroment mdb_env_close( _env ); return 0; } regards, Vasilis

1 0

Passwords, Hashing, and Binds
by Bram Cymet 29 Aug '14

29 Aug '14

Hi, I am storing users passwords in a userPassword attribute. When the passwords are hashed with MD5 I can bind as the user just fine. If I hash the password with sha-256 I get invalid credentials. Is there something I have to change in my client? Is there something I have to change on the server? Is binding a user with a password stored with sha-256 (or at least something better then md5) even possible? Thanks, -- Bram Cymet Software Developer Canadian Bank Note Co. Ltd. 613-608-9752

4 4

keepalive parameter setting in openldap for consumer doesnot work
by pramod kulkarni 29 Aug '14

29 Aug '14

Hi, I unplugged network cable of provider,added new users but it never synchronizes. with the consumer.Consumer never sends the keepalive signals I am using 2.4.39 version of Openldap on windows machine this is my consumer setting olcSyncrepl: {0}rid=002 provider=ldap://ipaddress:389 bindmethod=sasl timeou t=0 network-timeout=0 saslmech=external keepalive=1:1:10 starttls=critical tl s_cert="CN=Consumer3, O=CRAP" tls_cacert="CN=TestCA, O=CRAP" tls_reqcert=demand tls_cipher_suite=HIGH:MEDIUM:-SSLv2 filter="(objectclass=*)" searchbase="dc= crap,dc=com" scope=sub attrs="*,+" schemachecking=off type=refreshAndPersis t retry="60 +" if I make fresh setup of consumer & provider,it works & everything gets replicated properly. In the earlier version of openldap it was based on system setting like I used to get keepalive every 2 hours. What is the minimum value to be set for keepalive parameter in syncrepl? Can you please tell me do I need to make any changes on consumer side or provider ?

3 2

3rd try : Bug ? ldap_start_tls_s successful even after removing ca certificate from ca cert dir
by SOMA SEKHAR 28 Aug '14

28 Aug '14

On Sat, Aug 23, 2014 at 1:08 PM, SOMA SEKHAR <somasekhar44(a)gmail.com> wrote: > link to question on stackoverflow > <http://stackoverflow.com/questions/25457034/starttls-succesful-even-after-d…> > > > I'm having trouble verifying the correct behavior of my software. Here are > the steps I am performing to verify correct operation: > > 1. I have sample code that uses openldap library and doing a start tls > to a ldap server. > 2. I have set the global option for ca cert directory and tlx context > for the first time. > 3. After that I did ldap init and ldap start tls to a server. This is > succesful as expected. > 4. I did an ldap_unbind_s > 5. I deleted the CA cert that signed the ldap server's certificate > from the ca cert directory of the client. > 6. Again did ldap_init and ldap_start_tls_s . > 7. I expected this call to fail , as I have removed the ca cert. But > what I observe is that , server sends the certificate but start_tls is > returning success. > > I am using openldap 2.4 with libssl.0.9.8 > > LDAP *ld;int desired_version=3; > if ((ld = ldap_init(<hostname>, <server_port>)) == NULL ) { > printf("ldap_init failed\n"); > exit(0);} > > ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &desired_version); > ldap_set_option(NULL, LDAP_OPT_X_TLS_CTX, NULL); > ldap_set_option(NULL, LDAP_OPT_X_TLS_CACERTDIR,"<ca dir>"); > if(ldap_start_tls_s(ld, NULL, NULL) != LDAP_SUCCESS){ > printf("start tls failed.\n"); > exit(0);} > ...... <do bind and search>... > > ldap_unbind_s(ld); ... > // DELETE the CA certificate from the ca dir. // Try to do start tls again > if ((ld = ldap_init(hostname, server_port)) == NULL ) { > printf("ldap_init failed , after deleting CA\n"); > exit(0);} > // This goes fine even after deleting the CAif (ldap_start_tls_s(ld, NULL, NULL) != LDAP_SUCCESS){ > printf("start tls failed after deleting CA.\n"); > exit(0);} > > > -- > Thanks&Regards, > SomaSekhar. > > -- Thanks&Regards, SomaSekhar.

3 5

best practices WRT resizing a MDB backend?
by Brian Reichert 28 Aug '14

28 Aug '14

Other than this thread: http://t23307.network-openldap-technical.opennetworks.info/lmdb-growing-the… I don't see a discussion of changing the 'maxsize' setting after a LMDB database has been generated. This thread includes this response about growing the database: http://www.openldap.org/lists/openldap-technical/201402/msg00302.html On Windows, Linux, and FreeBSD, there's no problem increasing the mapsize and preserving the existing data. (I'm making a wild assumption that 'mapsize' is a typo, and 'maxsize' was intended.) Can 'maxsize' ever be reduced after the fact? If so, is their guidance as to how much it can change (perhaps based on mdb_stat)? The problem I'm trying to solve: For my $job, we provide OpenLDAP-backed clustered appliances to customers. The hardware doesn't vary, but the size of individual customers' databases. - Our strategy for adding members to the cluster involves managing backups (compressed tarballs). Our prior use of the now-ancient bdb backend let these backups be lightweight things to manage for smaller customers, and larger customers would take the hit for having big databases. - Also, upgrading appliances means importing data from the customers' bdb-based server. My naive use of the LDMB backend has me assume the worst case, and now everyone is equally punished for having a 'big' (albeit sparse) database. My hope was to, given awareness of either the data in an LDIF extract, or data about the legacy bdb database itself, we could make a more conservative guess as to a reasonable size for the mdb backend. Has anyone written up some strategies on these topics, or in the position to provide any recommendation? -- Brian Reichert <reichert(a)numachi.com> BSD admin/developer at large

5 11

LMDB: Compare function implementation
by Venkat Murty 28 Aug '14

28 Aug '14

Hi all, I am inserting a non-zero length key into a database where I provide a compare function. But I am seeing that MDB_val->mv_size = 0 in the compare function. Is that possible? More details (LMDB 0.9.11 Release): I have a database where I want to delete all elements that have the same prefix. void eraseElements (KeyPrefix prefix, MDB_txn *txn, MDB_dbi database) { MDB_val k; k.mv_data = &prefix; k.mv_size = sizeof (KeyPrefix); MDB_val v; MDB_cursor *cur; mdb_cursor_open (txn, database, &cur); while (! mdb_cursor_get (cur, &k, &v, MDB_SET_RANGE)) { if (memcmp (&prefix, k.mv_data, sizeof (KeyPrefix)) != 0) break; mdb_cursor_del (cur, 0); k.mv_data = &prefix; k.mv_size = sizeof (KeyPrefix); } mdb_cursor_close (cur); } Relevant stack trace DB::compare (a, b) and b->mv_size == 0 mdb_cursor_set(mc, key, data, op=MDB_SET_RANGE, exactp=0x0) at mdb.c:5348 mdb_cursor_get(mc,key,data,op=MDB_SET_RANGE) at mdb.c:5655 eraseElements(..)

3 2

OpenLdap Access Control
by Mehmet Sağdıç 28 Aug '14

28 Aug '14

Hello, I installed OpenLDAP server on Ubuntu 12.04. Phpldapadmin using the interface groups and users have added. Connection with the ftp server on the LDAP user did running. I want to limitation of the user on openldap. I selected one group of users are able to access privileges such as read or write. OlcAccess tried to do in the checklist user restrictions, but did not. Please help

1 0

From: Suneet Shah
by Suneet Shah 27 Aug '14

27 Aug '14

Hi openldap http://anon.gooffcampus.com/love.php?ugwun3106ehvfty suneetshah2000(a)gmail.com

1 0

Bug ? ldap_start_tls_s successful even after removing ca certificate from ca cert dir
by SOMA SEKHAR 27 Aug '14

27 Aug '14

link to question on stackoverflow <http://stackoverflow.com/questions/25457034/starttls-succesful-even-after-d…> I'm having trouble verifying the correct behavior of my software. Here are the steps I am performing to verify correct operation: 1. I have sample code that uses openldap library and doing a start tls to a ldap server. 2. I have set the global option for ca cert directory and tlx context for the first time. 3. After that I did ldap init and ldap start tls to a server. This is succesful as expected. 4. I did an ldap_unbind_s 5. I deleted the CA cert that signed the ldap server's certificate from the ca cert directory of the client. 6. Again did ldap_init and ldap_start_tls_s . 7. I expected this call to fail , as I have removed the ca cert. But what I observe is that , server sends the certificate but start_tls is returning success. I am using openldap 2.4 with libssl.0.9.8 LDAP *ld;int desired_version=3; if ((ld = ldap_init(<hostname>, <server_port>)) == NULL ) { printf("ldap_init failed\n"); exit(0);} ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &desired_version); ldap_set_option(NULL, LDAP_OPT_X_TLS_CTX, NULL); ldap_set_option(NULL, LDAP_OPT_X_TLS_CACERTDIR,"<ca dir>"); if(ldap_start_tls_s(ld, NULL, NULL) != LDAP_SUCCESS){ printf("start tls failed.\n"); exit(0);} ...... <do bind and search>... ldap_unbind_s(ld); ... // DELETE the CA certificate from the ca dir. // Try to do start tls again if ((ld = ldap_init(hostname, server_port)) == NULL ) { printf("ldap_init failed , after deleting CA\n"); exit(0);} // This goes fine even after deleting the CAif (ldap_start_tls_s(ld, NULL, NULL) != LDAP_SUCCESS){ printf("start tls failed after deleting CA.\n"); exit(0);} -- Thanks&Regards, SomaSekhar.

1 1

ldapi:/// without TLS; ldap:// with TLS?
by Tom 26 Aug '14

26 Aug '14

I'm running OpenLDAP 2.4 on CentOS. I'm trying to set it up so clients can use the ldapi:/// socket without TLS, but any clients using ldap:// must use TLS. I believe that the relevant olc variables are olcLocalSSF and olcSecurity. I can't get it to work - either TLS is required no matter which URI I use, or clients can connect without TLS at all. According to the docs, if I set olcLocalSSF to 128, and olcSecurity to ssf=128, it should work, but it's not. I can only connect without TLS if I delete the olcSecurity attribute, which allows anyone to connect without TLS. What am I dong wrong?

2 3

a lot of dnMatch msgs after do_syncrep2
by Daniel Jung 26 Aug '14

26 Aug '14

openldap-2.4.39 with lmdb backend running on centos 6.4. This occurred on one of the consumers and other consumers didnt have any issue. I was running args,stats and sync loglevel, and I see the following in the log. Each do_syncrep2 shows dnMatch. The contextcsn got out of sync and I used slapd -c to resync it and it looks ok now. Aug 25 03:45:02 servernameslapd[16312]: mdb_idl_delete_keys: 226c [7a441664] Aug 25 03:45:02 servernameslapd[16312]: mdb_idl_delete_keys: 226c Aug 25 03:45:02 servernameslapd[16312]: mdb_idl_delete_keys: 226c Aug 25 03:45:02 servernameslapd[16312]: mdb_idl_insert_keys: 226c [eebf38e5] Aug 25 03:45:02 servernameslapd[16312]: mdb_idl_insert_keys: 226c Aug 25 03:45:02 servernameslapd[16312]: mdb_idl_insert_keys: 226c Aug 25 03:45:02 servernameslapd[16312]: send_ldap_result: err=0 matched="" text="" Aug 25 03:45:02 servernameslapd[16312]: mdb_modify: dc=server,dc=com Aug 25 03:45:02 servernameslapd[16312]: mdb_modify_internal: replace contextCSN Aug 25 03:45:02 servernameslapd[16312]: send_ldap_result: err=0 matched="" text="" Aug 25 03:45:02 servernameslapd[16312]: slap_graduate_commit_csn: removing 0x7fc0185aa630 20140825014502.251709Z#000000#001#000000 Aug 25 03:45:02 servernameslapd[16312]: syncrepl_entry: rid=703 be_modify cn=cname,ou=Group,dc=server,dc=com (0) Aug 25 03:45:02 servernameslapd[16312]: slap_queue_csn: queing 0x7fc01859e320 20140825014502.251709Z#000000#001#000000 Aug 25 03:45:02 servernameslapd[16312]: mdb_modify: dc=server,dc=com Aug 25 03:45:02 servernameslapd[16312]: mdb_modify_internal: replace contextCSN Aug 25 03:45:02 servernameslapd[16312]: send_ldap_result: err=0 matched="" text="" Aug 25 03:45:02 servernameslapd[16312]: slap_graduate_commit_csn: removing 0x7fc01850f060 20140825014502.251709Z#000000#001#000000 Aug 25 03:45:02 servernameslapd[16312]: connection_get(12) Aug 25 03:45:02 servernameslapd[16312]: do_syncrep2: rid=703 cookie=rid=703,sid=001,csn=20140825014502.428281Z#000000#001#000000 Aug 25 03:45:02 servernameslapd[16312]: syncrepl_message_to_entry: rid=703 DN: cn=development,ou=somegroup,dc=server,dc=com, UUID: a06de85e-b545-102d-9482-cde2fff247a7 Aug 25 03:45:02 servernameslapd[16312]: dnMatch -3 Aug 25 03:45:02 servernameslapd[16312]: dnMatch 1 Aug 25 03:45:02 servernameslapd[16312]: dnMatch -3 Aug 25 03:45:02 servernameslapd[16312]: dnMatch -2 <snip>

1 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical