- openldap-technical - openldap.org

How can I add ldap user from linux shell command line?
by Tian Zhiying 26 Aug '14

26 Aug '14

Hi All How can I add ldap user from linux shell command line? And how can I batch add ldap user from linux shell command line? Tian Zhiying

3 2

Getting the memberof overlay to work
by Karel Vervaeke 26 Aug '14

26 Aug '14

Hi. I've followed a number of memberof tutorials/howto guides, but I can't get it to work. I've tried to document my best attempt yet in this github repository: https://github.com/karel1980/openldap-memberof There is an installation script which: - installs slapd - sets up a new database - configures memberof and refint overlays - restarts slapd - adds groups and users There's also a sample query which should return memberOf attributes, but it does not. If you can spot the error of my ways, please enlighten me. Regards, Karel

1 1

Converting BDB database from 4.8 to 4.5.
by Markus Moeller 26 Aug '14

26 Aug '14

I have an openldap server using libdb-4.5, but somehow my OS had db-utils for 4.8 and I guess I run the wrong commands as I now get the following error when starting the server. Is there a way to "downgrade" to 4.5 ? Unacceptable log file /var/lib/ldap/log.0000000001: unsupported log version 16 Thank you Markus

4 4

(no subject)
by Meunier, Antonin 25 Aug '14

25 Aug '14

Hello, In my openldap with mdb I imported a ldif that made add and modify (1000 objects). 95% of the file is processed in 2 minutes without problems. 5% of the rest of file is porcessed in more than 1 hour. The problem is on the groupOfName with lots of member (more than 1000 members). Each modify can take between 3 and 10 minutes. My Openldap is MMR with 2 servers. The problem appears only on one of the two ldap server. On the second one, each modification take 2 seconds. I've tried a reindex of the member attribute but nothing change. I've tried a delete and reimport (ldif file from the second server) the ldap and the problem persist. The configurations are the same on the 2 servers. What can explain this huge time to modify a group ? Exemple of a modification in my ldif file : dn: cn=522495,ou=groupes,ou=XXXXXX,dc=xxxxx,dc=fr changetype: modify add: member member: uid=2142279020,ou=personnes,ou= XXXXXX,dc= xxxxx,dc=fr dn: cn=522813, ou=groupes,ou=XXXXXX,dc=xxxxx,dc=fr changetype: modify add: member member: uid=1021253020,ou=personnes,ou= XXXXXX,dc= xxxxx,dc=fr Thanks a lot by advance Antonin Meunier

3 3

idassert-authzFrom ignored
by Charles Bueche 22 Aug '14

22 Aug '14

Hi, I have an OpenLDAP proxy using back_meta to talk to two back-ends Microsoft AD servers. My goal is to provide a single view of both AD trees. Basically, it works, as long as I use a bind account which exists in one of the back-end AD's. However, to first search where an AD account is, I would like to use a local account on the LDAP proxy. To my understanding, I need to use database meta suffix dc=proxy,dc=stuff,dc=ch rootdn "cn=root,dc=proxy,dc=stuff,dc=ch" rootpw "secret" subordinate ... idassert-bind bindmethod=simple binddn="CN=srvLDAP,..." credentials="..." mode=none flags=non-prescriptive idassert-authzFrom "dn.exact:cn=root,dc=proxy,dc=stuff,dc=ch" The DN "cn=root,dc=proxy,dc=stuff,dc=ch" does exist in the proxy and can do local searches. However, the account defined in the idassert is never used, and the connections to the back-ends AD's fail. Respectively, I think they are contacted using anonymous instead of the account I specify (not sure about the anonymous part, the debug log isn't very clear about it). Hints welcome. Below is a part of the relevant log if it helps. Charles .......... tls_read: want=64, got=64 0000: 65 87 ac 08 7e 49 8d 7f 95 3c d0 1f 09 57 b7 ce e...~I...<...W.. 0010: d4 13 2e ac 57 c9 27 6b 58 f7 76 70 a1 95 10 3e ....W.'kX.vp...> 0020: e2 96 0d cf a1 d3 13 ff e7 0b b1 2f c0 6f dc 19 .........../.o.. 0030: 93 38 07 b9 f7 e4 81 a8 e0 45 0e 97 ec 7f 21 a6 .8.......E....!. TLS trace: SSL_connect:SSLv3 read finished A ldap_int_poll: fd: -1 tm: 0 53679e3b conn=1000 op=1 <<< meta_search_dobind_init[0]=4 53679e3b conn=1000 op=1 <<< meta_back_search_start[0]=4 53679e3b conn=1000 op=1 meta_back_search: ncandidates=1 cnd="*" 53679e3b conn=1000 op=1 >>> meta_search_dobind_init[0] ldap_sasl_bind ldap_send_initial_request ldap_int_poll: fd: 12 tm: 0 ldap_is_sock_ready: 12 ldap_ndelay_off: 12 TLS trace: SSL_connect:before/connect initialization tls_write: want=225, written=225 0000: 16 03 01 00 dc 01 00 00 d8 03 02 53 67 9e 3b 55 ...........Sg.;U 0010: 4b 2f ee 53 01 81 ee ca 6a 3f a0 ea 85 3a c9 7e K/.S....j?...:.~ 0020: e3 01 d7 e6 d1 09 65 14 21 05 ef 00 00 66 c0 14 ......e.!....f.. 0030: c0 0a c0 22 c0 21 00 39 00 38 00 88 00 87 c0 0f ...".!.9.8...... 0040: c0 05 00 35 00 84 c0 12 c0 08 c0 1c c0 1b 00 16 ...5............ 0050: 00 13 c0 0d c0 03 00 0a c0 13 c0 09 c0 1f c0 1e ................ 0060: 00 33 00 32 00 9a 00 99 00 45 00 44 c0 0e c0 04 .3.2.....E.D.... 0070: 00 2f 00 96 00 41 c0 11 c0 07 c0 0c c0 02 00 05 ./...A.......... 0080: 00 04 00 15 00 12 00 09 00 14 00 11 00 08 00 06 ................ 0090: 00 03 00 ff 01 00 00 49 00 0b 00 04 03 00 01 02 .......I........ 00a0: 00 0a 00 34 00 32 00 0e 00 0d 00 19 00 0b 00 0c ...4.2.......... 00b0: 00 18 00 09 00 0a 00 16 00 17 00 08 00 06 00 07 ................ 00c0: 00 14 00 15 00 04 00 05 00 12 00 13 00 01 00 02 ................ 00d0: 00 03 00 0f 00 10 00 11 00 23 00 00 00 0f 00 01 .........#...... 00e0: 01 . TLS trace: SSL_connect:SSLv3 write client hello A tls_read: want=5 error=Connection reset by peer TLS trace: SSL_connect:error in SSLv3 read server hello A TLS: can't connect: . ldap_free_connection 1 1 ldap_send_unbind ber_flush2: 7 bytes to sd 12 0000: 30 05 02 01 03 42 00 0....B. ldap_write: want=7 error=Broken pipe ldap_free_connection: actually freed 53679e3b conn=1000 op=1 <<< meta_search_dobind_init[0]=0 53679e3b send_ldap_result: conn=1000 op=1 p=3 53679e3b send_ldap_result: err=0 matched="" text="" 53679e3b send_ldap_result: conn=1000 op=1 p=3 53679e3b send_ldap_result: err=0 matched="" text="" 53679e3b send_ldap_response: msgid=2 tag=101 err=0 ber_flush2: 14 bytes to sd 11 0000: 30 0c 02 01 02 65 07 0a 01 00 04 00 04 00 0....e........ tls_write: want=69, written=69

1 1

Re : RE24 testing call (2.4.40)
by "POISSON Frédéric" 22 Aug '14

22 Aug '14

Hello, I have tested with success the rev 55eddb0 on an RHEL 5.3 x86_64. I also copy a small test file (starting from a copy of the 051) in order to check if the new code correct the ITS#7822 "Segmentation fault while modifying olcDbMaxSize". The test file (see attachment) succeed like this : # ./run -b mdb test065-config-update Cleaning up test run directory leftover from previous run. Running ./scripts/test065-config-update for mdb... running defines.sh Running slapadd to build slapd database... Starting slapd on TCP/IP port 9011... Check the olcDbMaxSize dn: olcDatabase={1}mdb,cn=config olcDbMaxSize: 10485760 Dynamically updating the olcDbMaxSize Re-check the olcDbMaxSize dn: olcDatabase={1}mdb,cn=config olcDbMaxSize: 123456789 >>>>> Test succeeded While if i run the same test on release 2.4.39 and older it fail with a seg fault. I'm not sure that this is a good test for future release of openldap but if you agree, the ITS#7822 could be closed if release 2.4.40 of openldap has the same behavior :-). Thanks a lot, Regards, Le 11/08/14 20:58, Quanah Gibson-Mount <quanah(a)zimbra.com> a écrit : > > If you know how to build OpenLDAP manually, and would like to participate in testing the next set of code for the 2.4.39 release, please do so. > > Generally, get the code for RE24: > > <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> > > Configure & build. > > Execute the test suite (via make test) after it is built. > > Thanks! > > --Quanah > > > -- > Quanah Gibson-Mount > Server Architect > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration > > > -- Frederic Poisson

1 0

Accesslog: Excluding attributes from logging
by Oriol Rosa Ramoneda 22 Aug '14

22 Aug '14

4 5

memberof overlay surpresses accesslog olcAccessLogOps = all
by Jan Prinsloo 21 Aug '14

21 Aug '14

Hi All, I would appreciate it if someone could give me some insight into the following issue: I have a standalone openldap 2.4.26 setup. We would like to use the accesslog overlay for auditing. I have enabled the accesslog overlay with olcAccessLogOps = all. This writes all groups of operations (writes, reads, session) to cn=accesslog without issues. We would also like to make use of the memberof overlay. The issue we're seeing is that once you enable the memberof overlay, only search, unbind, add operations are logged to accesslog. We do not see delete, modify, modrdn values logged. If I then change the logops to "olcAccessLogOps = add delete modify modrdn" we see those operations logged, but no bind, search, unbind operations (ie. no reads or session). Is this a limitation of using these two overlay's together, or am I completely missing something? Here is the configuration output: dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig olcDatabase: {-1}frontend olcAccess: {0}to dn.base="" by * read olcAccess: {1}to dn.base="cn=Subschema" by * read structuralObjectClass: olcDatabaseConfig entryUUID: 174cbd2c-bbe1-1033-97e1-99c5bb2fcfe1 creatorsName: cn=config createTimestamp: 20140819113832Z entryCSN: 20140819113832.018426Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20140819113832Z dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootDN: cn=config structuralObjectClass: olcDatabaseConfig entryUUID: 174cc498-bbe1-1033-97e2-99c5bb2fcfe1 creatorsName: cn=config createTimestamp: 20140819113832Z olcAccess: {0}to * by * manage entryCSN: 20140819153732.253785Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20140819153732Z dn: olcDatabase={1}bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {1}bdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=novell,dc=com olcAccess: {0}to attrs=userPassword by self write by * auth olcAccess: {1}to attrs=shadowLastChange by self write by * read olcAccess: {2}to attrs=userPKCS12 by self read by * none olcAccess: {3}to * by * read olcRootDN: cn=admin,dc=novell,dc=com olcRootPW:: e1NTSEF9eTUrcGVLRmtBSlY4aytQUVJZOVVDTzByN1FwV1RrbENSZz09 olcDbCacheSize: 10000 olcDbCheckpoint: 1024 5 olcDbConfig: {0}set_cachesize 0 15000000 1 olcDbConfig: {1}set_lg_regionmax 262144 olcDbConfig: {2}set_lg_bsize 2097152 olcDbConfig: {3}set_flags DB_LOG_AUTOREMOVE olcDbConfig: {4}set_lk_max_locks 30000 olcDbConfig: {5}set_lk_max_objects 30000 olcDbIDLcacheSize: 30000 olcDbIndex: objectclass eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: member eq olcDbIndex: memberUid eq olcDbIndex: mail eq olcDbIndex: cn eq,sub olcDbIndex: displayName eq,sub olcDbIndex: uid eq,sub olcDbIndex: sn eq,sub olcDbIndex: givenName eq,sub olcDbIndex: entryCSN eq olcDbIndex: entryUUID eq structuralObjectClass: olcBdbConfig entryUUID: 174ccbbe-bbe1-1033-97e3-99c5bb2fcfe1 creatorsName: cn=config createTimestamp: 20140819113832Z entryCSN: 20140819114039.896372Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20140819114039Z dn: olcOverlay={0}accesslog,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcAccessLogConfig olcAccessLogDB: cn=accesslog olcAccessLogPurge: 07+00:00 01+00:00 olcAccessLogSuccess: TRUE structuralObjectClass: olcAccessLogConfig entryUUID: 827deb2a-bbe1-1033-8b97-93a12773fffb creatorsName: cn=config createTimestamp: 20140819114131Z olcOverlay: {0}accesslog olcAccessLogOps: writes entryCSN: 20140819154607.969610Z#000000#000#000000 modifiersName: cn=admin,dc=novell,dc=com modifyTimestamp: 20140819154607Z dn: olcOverlay={1}refint,olcDatabase={1}bdb,cn=config objectClass: olcConfig objectClass: olcOverlayConfig objectClass: olcRefintConfig objectClass: top olcOverlay: {1}refint olcRefintAttribute: memberof member manager owner structuralObjectClass: olcRefintConfig entryUUID: e5b204be-bbfb-1033-9b62-8fa7905953f2 creatorsName: cn=config createTimestamp: 20140819145025Z entryCSN: 20140819145025.207784Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20140819145025Z dn: olcDatabase={2}bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {2}bdb olcDbDirectory: /var/lib/ldap/accesslog olcSuffix: cn=accesslog olcRootDN: cn=admin,dc=novell,dc=com olcDbIndex: default eq olcDbIndex: entryCSN,objectClass,reqEnd,reqResult,reqStart structuralObjectClass: olcBdbConfig entryUUID: 827bc75a-bbe1-1033-8b95-93a12773fffb creatorsName: cn=config createTimestamp: 20140819114131Z entryCSN: 20140819114131.842907Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20140819114131Z Regards, Jan Prinsloo

2 1

setting up mirroring with ldaps
by Sterling Sahaydak 20 Aug '14

20 Aug '14

Setting up mirroring between 2 servers - (ldap1 and ldap2) Have a self signed cert installed on ldap1(provider) and connecting to ldap2(consumer) which is using the same cert as ldap1. What I'm not sure about is can I put the same self signed cert on both ldap1 and ldap2? Or on ldap2 create a self signed cert and copy it to ldap1 and register it using (certutil) to fix the issue below? Thanks! [root@ldap1 log]# slapd -d Sync @(#) $OpenLDAP: slapd 2.4.23 (Feb 3 2014 19:11:35) $ mockbuild@c6b10.bsys.dev.centos.org:/builddir/build/BUILD/openldap-2.4.23/openldap-2.4.23/build-servers/servers/slapd /etc/openldap/slapd.conf: line 149: warning, destination attributeType 'sAMAccountName' is not defined in schema PROXIED attributeDescription "SAMACCOUNTNAME" inserted. /etc/openldap/slapd.conf: line 199: rootdn is always granted unlimited privileges. bdb_monitor_db_open: monitoring disabled; configure monitor database to enable slapd starting TLS: error: the certificate '/etc/openldap/certs/testldap1cert.pem' could not be found in the database - error -8174:security library: bad database.. TLS: certificate '/etc/openldap/certs/testldap1cert.pem' successfully loaded from PEM file. TLS: no unlocked certificate for certificate 'E=sterling.sahaydak(a)example.com,CN=ldap1.example.net,OU=IT,O=example,L=xxxx,ST=xx,C=xx'. TLS: hostname (ldap2.example.net) does not match common name in certificate (ldap1.example.net). TLS: can't connect: TLS error -8157:Certificate extension not found.. slap_client_connect: URI=ldaps://ldap2.example.net DN="cn=testsync,ou=roles,dc=example,dc=net" ldap_sasl_bind_s failed (-1) do_syncrepl: rid=001 rc -1 retrying

1 0

question about ldap log file
by Wang, Holly 20 Aug '14

20 Aug '14

Hello, I am working on configure the OpenLDAP log file. Openldap has a document on the log level. However, I can't find where to configure the log file location and how to configure the log file in our current sladp.conf file. Where do we usually define the log file location? How to configure the log files? Holly Wang CSUN IT Department Identity and Directory Service 818-677-2031 holly.wang(a)csun.edu

2 1

TLS negotiation failed on ldaps:// - sslv3 alert bad record mac
by Oriol Rosa Ramoneda 19 Aug '14

19 Aug '14

2 1

Antw: Q: querying accesslog with reqStart>=partial time spec
by Ulrich Windl 18 Aug '14

18 Aug '14

>>> Ulrich Windl schrieb am 18.08.2014 um 11:53 in Nachricht <53F1CD10.741 : 161 : 60728>: > Hi! > > Can anybody explain when openLDAP with bdb succeeds on a filter like >(reqStart>=X) on accesslog? > When I use "(reqStart>=2014080100)" I get "no match", but when I use >"(reqStart>=20140801000)" I get the expected matches. > (And I don't get any match when just using "reqStart>=20140801)") > I see no log messages on the server's syslog... Sorry, I was telling nonsense (my program just dropped the longer stings) due to a bad regex match. It seems I must specify the full legth date specification (20140811073600.000000Z) > > Regards, > Ulrich > >

2 1

using {CRYPT} for rootpw, using SHA512?
by Brian Reichert 18 Aug '14

18 Aug '14

I've been messing with trying to get SHA512 password hash formats in openldap 2.4.39 under a 64-bit CentOS 6 distribution, using the LTB RPMs. I have read the FAQ at http://www.openldap.org/faq/data/cache/1467.html - The first entry describes a third-party module; I have been using that for years on a 32-bit CentOS 5 platform, using the vendor-provided openldap-2.3.43 RPMs. My efforts to build that module for 2.4.39 seemed to build clean, but effort to bind as a user with a {SHA512} hashed password cause slapd to segfault. I didn't try very hard to track that down, as there seem to be better supported techniques. - The third entry describes a slapo-pw-sha2 overlay, but no LTB RPM provides the overlay. I tried exactly once to build this overlay, but that failed due to a configure failure. I blame me; I'll revisit this when I have the time. However, I had some luck with the second entry, using {CRYPT}. Following these instructions, I was able to create users, successfully bind, and even use ldappasswd to change the passwords: http://www.openldap.org/lists/openldap-technical/201305/msg00002.html But, when I generated a hashed password using suggestions like this: http://serverfault.com/questions/330069/how-to-create-an-sha-512-hashed-pas… # python -c 'import crypt; print crypt.crypt("test", "$6$random_salt")' $6$random_salt$BnOQxEG8Gk2rzFYwoWXjr59zLVYzwshvca5oV0PtU8fAfT4a571evgca.E0hLnYNCdfq//zw9YyQN33QtztI10 and tried to embed this rootpw in my config file; rootpw {CRYPT}$6$random_salt$BnOQxEG8Gk2rzFYwoWXjr59zLVYzwshvca5oV0PtU8fAfT4a571evgca.E0hLnYNCdfq//zw9YyQN33QtztI10 I would get bind errors. Have I misunderstood how to use {CRYPT} for storing root's password? -- Brian Reichert <reichert(a)numachi.com> BSD admin/developer at large

8 13

what happened to the openldap toolbox project?
by Miroslaw Baran 18 Aug '14

18 Aug '14

Dear all, I don't want to sound too alarmistic, but it seems that the LTB project has disappeared from the 'net sometime this week. Would you happen to know what happened, what's going on (and perhaps if some help with the infrastructure is needed)? I've been relying on project-ltb packages for a while and would be quite unhappy to see it go; and I find the lack of information and the abrupt disappearance a bit troubling. While I know it's not strictly on-topic here, I know also that OpenLdap Toolbox folks are subscribed to this list, and ltb-project.org packages are quite widely used here – so I hope someone would be able to provide a bit of information… Kind regards – Miroslaw Baran -- » miroslaw baran » chaos monkey • pope • general nuisance » 0101010 Down with categorical imperative!

4 3

Q: querying accesslog with reqStart>=partial time spec
by Ulrich Windl 18 Aug '14

18 Aug '14

Hi! Can anybody explain when openLDAP with bdb succeeds on a filter like (reqStart>=X) on accesslog? When I use "(reqStart>=2014080100)" I get "no match", but when I use "(reqStart>=20140801000)" I get the expected matches. (And I don't get any match when just using "reqStart>=20140801)") I see no log messages on the server's syslog... Regards, Ulrich

1 0

Password Policy Questions
by Bram Cymet 18 Aug '14

18 Aug '14

Hi, It looks like the password policy overlay will do exactly what I need it to I just can't get it to work. I have applied the overlay my directory. I have a default policy set that has: pwdAttribute set to userPassword and pwdMustChange set to TRUE. However when I change a user's password either with an ldapmodify or the ldappassword command that user is still able to bind to the directory just fine. I was assuming that a bind attempt would return an error saying that the user had to change their password or is this not the expected behavior? Also I have tried adding pwdReset = TRUE to my user's object but it complains the pwdReset is not allowed in the schema. Is there a specific objectclass that I have to add to my user entries? I have also tried creating a schema with pwdReset and pwdPolicySubentry but when I add that schema it complains that these are operational attributes. I have upped the logging and when I user tries to bind I see: Aug 3 08:57:08 devauth slapd[30441]: conn=1017 fd=17 ACCEPT from IP=10.20.48.66:55519 (IP=0.0.0.0:389) Aug 3 08:57:08 devauth slapd[30441]: conn=1017 op=0 BIND dn="uid=email(a)test.com,ou=test_websales_users,dc=ls,dc=cbn" method=128 Aug 3 08:57:08 devauth slapd[30441]: => bdb_entry_get: found entry: "uid=email(a)test.com,ou=test_websales_users,dc=ls,dc=cbn" Aug 3 08:57:08 devauth slapd[30441]: => bdb_entry_get: found entry: "cn=websales_password_policy,ou=test_websales_users,dc=ls,dc=cbn" Aug 3 08:57:08 devauth slapd[30441]: => access_allowed: result not in cache (userPassword) Aug 3 08:57:08 devauth slapd[30441]: => access_allowed: auth access to "uid=email(a)test.com,ou=test_websales_users,dc=ls,dc=cbn" "userPassword" requested Aug 3 08:57:08 devauth slapd[30441]: => acl_get: [2] attr userPassword Aug 3 08:57:08 devauth slapd[30441]: => acl_mask: access to entry "uid=email(a)test.com,ou=test_websales_users,dc=ls,dc=cbn", attr "userPassword" requested Aug 3 08:57:08 devauth slapd[30441]: => acl_mask: to value by "", (=0) Aug 3 08:57:08 devauth slapd[30441]: <= check a_dn_pat: self Aug 3 08:57:08 devauth slapd[30441]: <= check a_dn_pat: * Aug 3 08:57:08 devauth slapd[30441]: <= acl_mask: [2] applying auth(=xd) (stop) Aug 3 08:57:08 devauth slapd[30441]: <= acl_mask: [2] mask: auth(=xd) Aug 3 08:57:08 devauth slapd[30441]: => slap_access_allowed: auth access granted by auth(=xd) Aug 3 08:57:08 devauth slapd[30441]: => access_allowed: auth access granted by auth(=xd) Aug 3 08:57:08 devauth slapd[30441]: conn=1017 op=0 BIND dn="uid=email(a)test.com,ou=test_websales_users,dc=ls,dc=cbn" mech=SIMPLE ssf=0 So it looks to me like the default policy has been applied but nothing happens when a password is reset by an administrator. So I think I am missing something fundamental here. I have a few questions that I think will help me to narrow down my problem though. 1) What is the best way to debug an overlay? 2) Is there a proper way for an administrator to change a password so that the pwdReset flag is set on the user (or whatever is supposed to happen so that the user needs to reset their password on their next bind) 3) Is it enough to have a password policy with just pwdAttribute and pwdMustChange set or are there other values that need to be set to make this work. 4) Are there any extra object classes that have to added to my user entries for the password policies to work? 5) I would like users to have to reset their password on first bind do I need to set something on object creation? 6) Anything else I might be missing? Any help would be awesome. Thanks, -- Bram Cymet Software Developer Canadian Bank Note Co. Ltd. 613-608-9752

2 2

pwdChangedTime/authTimestamp, MMR etc.
by Michael Ströder 15 Aug '14

15 Aug '14

HI! I have a replication topology with providers running with MMR and a layer of r/o consumers.. - spread across three data centers - in two different countries (DE and foreign country) Network traffic between the countries has higher latency so consumers are only accessing providers within the same country. Write operations go nearly 100% to a single provider in Germany. All systems are using these overlays: - slapo-ppolicy (mostly for password expiry) - slapo-lastbind overlays - slapo-accesslog (yes, also on consumers) Now occasionally contextCSN values differ most times for a couple of minutes on the consumers in the foreign country from their local providers. I cannot tell exactly which conditions are causing this. But I observed that most times there was a login failure on the provider in Germany which results in 'pwdChangedTime' being set and replicated to the consumers. Most times followed by 'authTimestamp' being correctly set. So I wonder whether the differences of the contextCSN values could be caused by 'pwdChangedTime' and 'authTimestamp' being replicated to providers but not to consumers. Any clue? Thanks in advance. Ciao, Michael.

2 3

sanity check on updating from HDB backend to MDB
by Brian Reichert 14 Aug '14

14 Aug '14

I have an experiment, that may have too many moving parts to tease apart. We're exploring migrating our LDAP server from a 32-bit OS to a 64-bit OS, and I've also explored the port to the mdb back end. My first shot at this does not show the performance the write-ups on MDB would have me expect. If it matters, my old environment is a Dell R610 server, with 6G of RAM. # uname -r 2.6.18-308.13.1.el5PAE # cat /etc/redhat-release CentOS release 5.8 (Final) # rpm -qf `which slapd` openldap-servers-2.3.43-25.el5_8.1 My ldapsearch invocations on this host take ~120 seconds. I set up two Dell R610s, each with 12G or memory. One environment uses the RPM produced by the LTB project, here named 'ltb': root@ltb# uname -r 2.6.32-431.17.1.el6.x86_64 root@ltb# cat /etc/redhat-release CentOS release 6.5 (Final) root@ltb# rpm -qf /usr/local/openldap/libexec/slapd openldap-ltb-2.4.39-2.el6.x86_64 And the other uses the same OS, but uses CentOS's stock OpenLDAP RPM; here named 'stock': root@stock# rpm -qf `which slapd` openldap-servers-2.4.23-34.el6_5.1.x86_64 I migrated a database of ~360k DNs, and underwent the cache tuning, following the suggestions here: http://www.openldap.org/doc/admin24/tuning.html#Caching http://blog.monitor.us/2012/02/berkeley-db-performance-tuning/ And with those tunings, my ldapsearch command does outperform our old 32-but environment: stock# time ldapsearch -x -w XXXXX -D "cn=manager,orgid=MyOrgID" -b orgid=MyOrgID dn | grep ^dn: | wc -l 3600071 real 0m27.147s user 0m19.216s sys 0m10.585s However, my efforts to use the MDB backend yield slower responses, on the order of 175 seconds. How I set up the MDB backend: I copied my old slapd.conf over, and replaced my bdb backend with mdb settings. - I set 'tool-threads' to 2 - I set 'maxsize' to 21474836480 [ 20G = 20 * ( 1024 * 1024 * 1024 ) ] ltb# /usr/local/openldap/sbin/slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d config file testing succeeded ltb# chown -R ldap:ldap /etc/openldap/slapd.d I was apparently able to import all 360k DNs without an error: ltb# time setuidgid ldap /usr/local/openldap/sbin/slapadd \ -q -v -F /etc/openldap/slapd.d -b orgId=MyOrgID \ -l export_from_OLD.ldif >& log; echo $? real 16m46.924s user 8m52.165s sys 3m44.859s 0 ltb# ls -ld data.mdb -rw------- 1 ldap ldap 21474836480 Jul 30 20:16 data.mdb ltb# du -c -h data.mdb 6.3G data.mdb 6.3G total But, the same search looks worse here. ltb# time ldapsearch -x -w XXXXX -D "cn=manager,orgid=MyOrgID" -b orgid=MyOrgID dn | grep ^dn: | wc -l 3600071 real 2m55.482s user 0m25.459s sys 0m23.948s Both 64-bit hosts show no swapping, and minimal CPU load. Can anyone point out what I've missed? -- Brian Reichert <reichert(a)numachi.com> BSD admin/developer at large

6 13

CA and Intermediate Certificates
by Andrew Devenish-Meares 14 Aug '14

14 Aug '14

Hi All, We are currently assessing changing our TLS Certificate setup. We have been using a self-signed CA to issue certificates for our OpenLDAP setup, which has required us to supply the CA to anyone outside our organisation that wishes to use our OpenLDAP over TLS or SSL. We're currently starting to migrate our certificates to AusCERT, as we get a good deal as a University. As AusCERT is an intermediate CA, so we need to use a chain to get this to work. The server side works, as per the documentation, by adding the intermediate CA with the root CA in the olcTLSCertificateCAFile. This means that we need to install the intermediate certificate on clients that connect to our LDAP using SSL or TLS. Admittedly this isn't vastly different to what we need to do now in supplying our own CA. Looking at our Linux clients in particular, we need to add an appropriate TLS_CACERT directive to our openldap/ldap.conf. Is the intention, then, to point the client at the appropriate CA files? Is there a reason that OpenLDAP doesn't use the regular system CA store? Is there any reason for us not to point to the CA store that's already maintained? Cheers -- Andrew Devenish-Meares Solutions Analyst Information Technology University of New England Armidale NSW 2351 e: adevenis(a)une.edu.au p: 02 6773 4098 w: http://une.edu.au/itd

6 9

Specifying multiple password hashes
by Michael 14 Aug '14

14 Aug '14

Since both the password-hash and password-crypt-salt-format are Global options, is it possible to specify the password-hash on a per BDB backend basis? For example, I have 4 BDB backends and I'd like them all to have the CRYPT and salt listed below sans one BDB backend where it needs to be CLEARTEXT. However, when I specify this configuration in sladp.conf and bounce slapd I get the following error when trying to change a users password with the ldappasswd command. It's worth nothing that an ldapmodify to the userPassword attribute works just fine. I use security ssf=256, which is a Global option as well on a per BDB backend basis and this works just fine so I assumed this config for hashes would work as well. Error message: "Result: Constraint violation (19) Additional info: Password policy only allows one password value" Relevant config below: ## GLOBAL SETTING password-hash {CRYPT} password-crypt-salt-format $6$%.12s ### BDB DATABASE SETTING database bdb suffix "dc=testldap,dc=com" rootdn "cn=LDAPAdmin,dc=testldap,dc=com" directory /var/lib/ldap/testldap password-hash {CLEARTEXT}

2 2

How to do a case insensitive substring search on a case-sensitive field ?
by Guillermo-Nicolas Guénon Díaz 14 Aug '14

14 Aug '14

Hello, [First of all, sorry if this question has already been answered before: the search on this mailing list does not work currently so I haven't been able to check.] I need to write a filter so that when the user of my software introduces any substring of the content of a field in any case (upper, lower or mixed case), it finds the entry. It must work even if the user does not input a complete word, but just a part of a word. The field is called "supName" and it follows the DirectoryString syntax. This means that the default matching rule is exact and case sensitive ("caseExactMatch"). But according to: http://www.zytrax.com/books/ldap/apa/types.html , this syntax should allow also "caseIgnoreMatch" and "caseIgnoreSubstringsMatch" matching rules. I though I just needed to force to use the last one ("caseIgnoreSubstringsMatch"), so I tried this filter: (supName:caseIgnoreSubstringsMatch:=*somesubstring*) But this does not work. I make my tests using Apache Directory Studio, and that tool refuses to accept the above filter. It complains on the asterisks, and I don't understand why, since I am using a Substring match (and thus asterisks should be allowed). If I run the filter from command line (using ldapsearch), I get this error message: ldap_search_ext: Bad search filter (-7) Therefore this is not an issue with Apache Directory Studio. So my question is: What is the correct way of defining a case-insensitive substring filter on a field that is case-sensitive by default? Yesterday I filled a question in StackOverflow regarding this same issue. There are more details and examples in that question: http://stackoverflow.com/questions/25290494/case-insensitive-substring-ldap… Any help would be greatly appreciated ! Thank you very much. Nicolas

2 1

slapd.conf loglevel for slapo-rwm operations?
by Anthony Clark 13 Aug '14

13 Aug '14

Hello, What loglevel should I set to see the "[rw]" operations performed by slapo-rwm? Thanks! -Anthony Clark, DevOps and Skulduggery.

1 0

Create Distribution List
by Jerry 12 Aug '14

12 Aug '14

I don't know if this is the best place to ask this question, but it is probably as good as any to start. I am a new user of OpenLDAP. I formerly, and still do use the MS Outlook address book to store my contacts. I can duplicate most of the features of the MS Address book, except the ability to create distribution lists. I just cannot figure out how to accomplish this feat. Using MS Outlook, or Claws-Mail on my FreeBSD machine, I can type in a distribution name and all of the email addresses are filled in. EXAMPLE: distribution list name=my-list john(a)somewhere.com jill(a)anotherISP.net jim(a)hisISP.com Some of these distribution lists are quite large. I cannot fine out a way to create a similar list in OpenLDAP, which is a serious buzz, not to mention deal killer in this instance. Thanks! -- Jerry

5 5

LMDB storing generated values
by Simon Majou 11 Aug '14

11 Aug '14

Hello, Is there a way to write a value one part at a time ? For instance a value which is being generated, or received. >From the doc I found 2 put methods, but they expect a pointer to the full value. -- Best regards, Simon

2 2

Migration process in detail
by Rodrigo Coutinho 11 Aug '14

11 Aug '14

Hi, in a near future I will need to migrate from Oracle OID to Openldap. Could you please share more details of your migration process, the approach taken, the problems you faced and how did you resolved them. Right now I can't see how can I migrate the encripted user passwords. Is it possible ? I would appreciate any information you could provide. Thank you in advance A transmiss�o de mensagens por e-mail n�o � absolutamente segura ou livre de erros. A mensagem pode ser intercetada, alterada, perdida, destru�da, chegar ao destinat�rio com atraso, ou mesmo com v�rus, n�o obstante o IFAP utilizar software anti-v�rus. Esta mensagem, incluindo eventuais ficheiros anexos, pode conter informa��o confidencial ou privilegiada e destina-se a uso exclusivo dos seus destinat�rios. Se n�o for o destinat�rio pretendido, informamos que a recebeu por engano, pelo que, qualquer utiliza��o, distribui��o, reencaminhamento ou outra forma de revela��o a terceiros, impress�o ou c�pia s�o expressamente proibidos. Se recebeu esta mensagem por engano, por favor contacte imediatamente o remetente por e-mail, e apague de imediato a mensagem do seu sistema inform�tico. O IFAP declina qualquer responsabilidade por erros ou omiss�es na presente mensagem e eventuais consequ�ncias, que resultem das situa��es referidas.

1 0

Auto Response
by Paul 10 Aug '14

10 Aug '14

1 0

Why cannot run slapadd -l backup.ldif which requires deprecated lsapd.conf?
by jupiter 09 Aug '14

09 Aug '14

Hi, I am running openldap version 2.4.23 on CentOS 6.5, there is no slapd.conf, according to the document it is deprecated. But when I run slapadd, it got an error. # slapadd -v -l /root/backup.ldif could not stat config file "/etc/openldap/slapd.conf": No such file or directory (2) slapadd: bad configuration file! Now I am confused, if the slapd.conf is deprecated why the slapadd sdepends on it? How can I generate the slapd.conf, or copy a template of slpad.conf? Thank you and appreciate your advice - j

3 6

LMDB and writes
by Bill Hastings 09 Aug '14

09 Aug '14

Hi All Just getting my feet wet with LMDB. Is it possible for multiple threads write into LMDB concurrently? Or should writes be serialized to LMDB? Thanks Bill

2 1

Help for encrypted password with Blowfish
by Franck Goirand 08 Aug '14

08 Aug '14

Hello, I have a text file containing users and their password encrypted blowfish. This password is in the form $ 2a $ 08 $ hNbsbhDlbaogpYL/2yeCkuxKPPGKcluKb5rk16R0Nwi/34eGVi8r2 I need to create a script for insert the users in a directory via ldap ldif file. For the password, I use the userPassword instruction. If I put the password as contained in the file, it does not work. My issue are: - Is it possible to type in a password (encrypted in blowfish) as such ldap directory? - What syntax i need to use to tag the userPassword ({crypt} password ...)? - Should i perform a specific configuration for the slapd.conf file for the pam authentication engine (pam-ldap is it sufficient)? I worked on the crypt library, pam_ldap, slapcat ... without success Any ideas would be welcome, Best regards Franck ps: before passwords were MD5 and I never encountered any problems.

1 0

Updating schema with ldapmodify
by Katherine Faella 07 Aug '14

07 Aug '14

I am running openldap on Redhat 6 at 2.4.23. I am using cn=config. I have a schema called uri was added during the initial setup of this server a few years ago. In this schema I have an dn: cn={12}uri,cn=schema,cn=config objectClass: olcSchemaConfig cn: {12}uri olcAttributeTypes: {0}( 1.3.6.1.4.1.14092.2.1.1 NAME 'uriid' EQUALITY caseIgno reMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {1}( 1.3.6.1.4.1.14092.2.1.2 NAME 'dept' EQUALITY caseIgnor eMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{ 256} ) .... *olcObjectClasses: {7}( 1.3.6.1.4.1.14092.2.2.8 NAME 'URIEducmanager' DESC 'URI** ** Educmanager' STRUCTURAL MAY ( uid $ userPassword $ employeeNumber $ cn $ sn $** ** givenname $ telephoneNumber $ dc ) )* olcObjectClasses: {8}( 1.3.6.1.4.1.14092.2.2.9 NAME 'URIEdusakaiperson' DESC ' URIEdusakaiperson' STRUCTURAL MUST ( URIEduemplid $ URIEduecampusid $ URIEdus n $ URIEdustatus $ userPassword ) MAY ( mail $ URIEdugn ) ) I need to update the URIEducmanager objectclass to include the mail object so it will be: olcObjectClasses: {7}( 1.3.6.1.4.1.14092.2.2.8 NAME 'URIEducmanager' DESC 'URI Educmanager' STRUCTURAL MAY ( uid $ userPassword $ employeeNumber $ cn $ sn $ givenname $ mail $ telephoneNumber $ dc ) ) I have tried many combinations the last of which is ldapmodify -D "cn=admin,cn=config" -x -W -f /root/ldapscripts/updatecmanager.ldif -v -H ldap://locumtenens.uri.edu where updatecmanager.ldif contains: dn: cn={12}uri,cn=schema,cn=config changetype: modify delete: objectclass objectclass: ( 1.3.6.1.4.1.14092.2.2.8 NAME 'URIEducmanager' DESC 'URIEducmanager' STRUCTURAL MAY ( uid $ userPassword $ employeeNumber $ cn $ sn $givenname $ telephoneNumber $ dc ) ) - add: objectclass objectclass: ( 1.3.6.1.4.1.14092.2.2.8 NAME 'URIEducmanager' DESC 'URIEducmanager' SUP top AUXILIARY STRUCTURAL MAY ( uid $ userPassword $ employeeNumber $ cn $ sn $givenname $ mail $ telephoneNumber $ dc ) ) My run looks like ldapmodify -D "cn=admin,cn=config" -x -W -f /root/ldapscripts/updatecmanager.ldif -v -H ldap://locumtenens.uri.edu ldap_initialize( ldap://locumtenens.uri.edu:389/??base ) Enter LDAP Password: delete objectclass: ( 1.3.6.1.4.1.14092.2.2.8 NAME 'URIEducmanager'DESC 'URIEducmanager'STRUCTURAL MAY ( uid $ userPassword $ employeeNumber $cn $ sn $givenname $ telephoneNumber $ dc ) ) add objectclass: ( 1.3.6.1.4.1.14092.2.2.8 NAME 'URIEducmanager'DESC 'URIEducmanager' SUP top AUXILIARYSTRUCTURAL MAY ( uid $ userPassword $ employeeNumber $cn $ sn $givenname $ mail $ telephoneNumber $ dc ) ) modifying entry "cn={12}uri,cn=schema,cn=config" ldap_modify: Invalid syntax (21) additional info: objectclass: value #0 invalid per syntax I have checked for extra blanks on the line, I have tried it with replace instead of delete and add. I must be missing some important facts about how it should be done. Any help greatly appreciated! Kathy -- Katherine Faella tel: (401) 874-4469 Sr. Technical Programmer kmf(a)uri.edu University of Rhode Island University Computing Systems(UCS) 210 Flagg Road Kingston, Rhode Island 02881

5 5

Re: RE24 Testing call #3
by Patrick Laimbock 07 Aug '14

07 Aug '14

Hi Quanah, From the OPENLDAP_REL_ENG_2_4 branch I got the snapshot with git rev 140c8b8. On an up-to-date CentOS 6.5 x86_64 VM all tests succeeded. HTH, Patrick

1 0

ACL for object creation in subtree with specific attributes and object classes
by Simeon Ott 06 Aug '14

06 Aug '14

Hello, I'd like to refine my permission set of my openldap installation. The tree structure is: dc=mydomain - cn=admin (ldap admin) - ou=domains (customer domains) - ou=example1.com - cn=user1 - cn=user2 - cn=postmaster - ou=example2.com - cn=user1 - cn=user2 - cn=postmaster The user postmaster is able to change specific attributes of objects in its own "domain" (one level up). The current ACLs are defined as: access to dn.regex="^(.+,)?ou=(.+),ou=domains,dc=mydomain$" attrs=userPassword by dn.base="cn=admin,dc=mydomain" write by self write by dn.base,expand="cn=postmaster,ou=$2,ou=domains,dc=mydomain" write by anonymous auth by * none access to attrs=userPassword by dn.base="cn=admin,dc=mydomain" write by self write by anonymous auth by * none access to dn.regex="^(.+,)?ou=(.+),ou=domains,dc=mydomain$" attrs=sn,description,vacationActive,vacationInfo,vacationForward,displayName,givenName,homePhone,homePostalAddress,initials,mobile,postalAddress,postalCode,l,telephoneNumber,title by self write by dn.base,expand="cn=postmaster,ou=$2,ou=domains,dc=mydomain" write by * read access to dn.regex="^(.+,)?ou=(.+),ou=domains,dc=mydomain$" by dn.base,expand="cn=postmaster,ou=$2,ou=domains,dc=mydomain" write by * read access to * by dn.base="cn=admin,dc=mydomain" write by * read ACL rule 4 allows the postmaster to add objects to it's "domain" without any restrictions. How can i restrict the object creation to specific object classes and attributes? Let's say postmaster should only be able to add objects like the following: dn: cn=user3,ou=example2.com,ou=domains,dc=mydomain objectClass: CourierMailAccount objectClass: inetOrgPerson objectClass: top objectClass: Vacation cn: user3 homeDirectory: user3/example2.com/ mail: user.3(a)exampl2.com sn: User3 vacationActive: TRUE gidNumber: 5000 smtpRelayFlag: 1 uidNumber: 5000 userPassword:: <crypted password> vacationInfo:: <binary data> I didn't find such an approach in Faq-O-Matic nor the manuals Thanks in advance for any advice

2 8

slapd core dumps on ldap add
by Celalettin KILINÇ 06 Aug '14

06 Aug '14

Hi, I have openldap 2.4.36 installed using mdb backend on Solaris 10. I am using this database for a while and suddenly I started getting core dumps while trying to add any data to database. Disk, memory usages seem fine. Database size is not exceeded, it is almost 1/10 full. What may be the reason for this? Please find the other information about the issue as below: slapd version: # ./slapd -VVV @(#) $OpenLDAP: slapd 2.4.36 (Oct 6 2013 13:56:57) $ myuser@myhost:/some/dir/openldap-2.4.36/servers/slapd Included static overlays: syncprov Included static backends: config ldif mdb slapd.conf for mdb backend: database mdb directory /some/dir/openldap/var/openldap-data suffix "dc=mycomp,dc=com" rootdn "cn=Manager,dc=mycomp,dc=com" rootpw password index objectClass eq maxsize 45899345920 dbnosync checkpoint 0 10 threads 32 listener-threads 16 concurrency 1024 envflags writemap,nometasync slapd debug log: 53e15b8d conn=1001 op=17 do_add ber_scanf fmt ({m) ber: 53e15b8d conn=1001 op=17 do_add: dn (BatchGroupName=test,uid=myuser,OperationType=create,o=cust,dc=mycomp,dc=com) ber_scanf fmt ({m{W}}) ber: ber_scanf fmt ({m{W}}) ber: ber_scanf fmt (}) ber: 53e15b8d >>> dnPrettyNormal: <BatchGroupName=test,uid=myuser,OperationType=create,o=cust,dc=mycomp,dc=com> => ldap_bv2dn(BatchGroupName=test,uid=myuser,OperationType=create,o=cust,dc=mycomp,dc=com,0) <= ldap_bv2dn(BatchGroupName=test,uid=myuser,OperationType=create,o=cust,dc=mycomp,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(BatchGroupName=test,uid=myuser,OperationType=create,o=cust,dc=mycomp,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(BatchGroupName=test,uid=myuser,OperationType=create,o=cust,dc=mycomp,dc=com)=0 53e15b8d <<< dnPrettyNormal: <BatchGroupName=test,uid=myuser,OperationType=create,o=cust,dc=mycomp,dc=com>, <BatchGroupName=test,uid=myuser,OperationType=create,o=cust,dc=mycomp,dc=com> 53e15b8d ==> mdb_add: BatchGroupName=test,uid=myuser,OperationType=create,o=cust,dc=mycomp,dc=com 53e15b8d oc_check_required entry (BatchGroupName=test,uid=myuser,OperationType=create,o=cust,dc=mycomp,dc=com), objectClass "RTEBatchGroup" 53e15b8d oc_check_allowed type "BatchGroupName" 53e15b8d oc_check_allowed type "objectClass" 53e15b8d oc_check_allowed type "structuralObjectClass" 53e15b8d mdb_dn2entry("BatchGroupName=test,uid=myuser,OperationType=create,o=cust,dc=mycomp,dc=com") 53e15b8d => mdb_dn2id("BatchGroupName=test,uid=myuser,OperationType=create,o=cust,dc=mycomp,dc=com") 53e15b8d <= mdb_dn2id: get failed: MDB_NOTFOUND: No matching key/data pair found (-30798) 53e15b8d => mdb_entry_decode: 53e15b8d <= mdb_entry_decode 53e15b8d => mdb_dn2id_add 0x1a28eb: "BatchGroupName=test,uid=myuser,OperationType=create,o=cust,dc=mycomp,dc=com" zsh: bus error (core dumped) ./slapd -d5 gdb backtrace of the generated core file: # gdb slapd core GNU gdb 6.8 Copyright (C) 2008 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "sparc-sun-solaris2.10"... (no debugging symbols found) Reading symbols from /some/dir/lib/libldap_r-2.4.so.2...(no debugging symbols found)...done. Loaded symbols for /some/dir/lib/libldap_r-2.4.so.2 Reading symbols from /some/dir/lib/liblber-2.4.so.2...(no debugging symbols found)...done. Loaded symbols for /some/dir/lib/liblber-2.4.so.2 Reading symbols from /usr/lib/sparcv9/libicuuc.so.3...(no debugging symbols found)...done. Loaded symbols for /usr/lib/64/libicuuc.so.3 Reading symbols from /usr/lib/sparcv9/libicudata.so.3...(no debugging symbols found)...done. Loaded symbols for /usr/lib/64/libicudata.so.3 Reading symbols from /some/dir/lib/libsasl2.so.2... (no debugging symbols found)...done. Loaded symbols for /some/dir/lib/libsasl2.so.2 Reading symbols from /lib/sparcv9/libdl.so.1... warning: Lowest section in /lib/sparcv9/libdl.so.1 is .hash at 0000000000000120 (no debugging symbols found)...done. Loaded symbols for /lib/64/libdl.so.1 Reading symbols from /opt/csw/lib/sparcv9/libssl.so.0.9.8...(no debugging symbols found)...done. Loaded symbols for /opt/csw/lib/sparcv9/libssl.so.0.9.8 Reading symbols from /opt/csw/lib/sparcv9/libcrypto.so.0.9.8...(no debugging symbols found)...done. Loaded symbols for /opt/csw/lib/sparcv9/libcrypto.so.0.9.8 Reading symbols from /lib/sparcv9/libresolv.so.2... (no debugging symbols found)...done. Loaded symbols for /lib/64/libresolv.so.2 Reading symbols from /lib/sparcv9/libgen.so.1...(no debugging symbols found)...done. Loaded symbols for /lib/64/libgen.so.1 Reading symbols from /lib/sparcv9/libnsl.so.1...(no debugging symbols found)...done. Loaded symbols for /lib/64/libnsl.so.1 Reading symbols from /lib/sparcv9/libsocket.so.1...(no debugging symbols found)...done. Loaded symbols for /lib/64/libsocket.so.1 Reading symbols from /lib/sparcv9/librt.so.1... (no debugging symbols found)...done. Loaded symbols for /lib/64/librt.so.1 Reading symbols from /lib/sparcv9/libc.so.1...(no debugging symbols found)...done. Loaded symbols for /lib/64/libc.so.1 Reading symbols from /opt/csw/gcc4/lib/sparcv9/libgcc_s.so.1...(no debugging symbols found)...done. Loaded symbols for /opt/csw/gcc4/lib/sparcv9/libgcc_s.so.1 Reading symbols from /lib/sparcv9/libpthread.so.1... warning: Lowest section in /lib/sparcv9/libpthread.so.1 is .dynamic at 00000000000000b0 (no debugging symbols found)...done. Loaded symbols for /lib/64/libpthread.so.1 Reading symbols from /lib/sparcv9/libm.so.2... (no debugging symbols found)...done. Loaded symbols for /lib/64/libm.so.2 Reading symbols from /usr/lib/sparcv9/libCrun.so.1...(no debugging symbols found)...done. Loaded symbols for /usr/lib/64/libCrun.so.1 Reading symbols from /lib/sparcv9/libaio.so.1...(no debugging symbols found)...done. Loaded symbols for /lib/64/libaio.so.1 Reading symbols from /lib/sparcv9/libmd.so.1...(no debugging symbols found)...done. Loaded symbols for /lib/64/libmd.so.1 Reading symbols from /platform/sun4v/lib/sparcv9/libc_psr.so.1... (no debugging symbols found)...done. Loaded symbols for /platform/SUNW,Netra-T2000/lib/sparcv9/libc_psr.so.1 Reading symbols from /lib/sparcv9/ld.so.1...(no debugging symbols found)...done. Loaded symbols for /lib/sparcv9/ld.so.1 Core was generated by `./slapd -d5'. Program terminated with signal 10, Bus error. [New process 1335262 ] [New process 90078 ] [New process 155614 ] [New process 221150 ] [New process 286686 ] [New process 352222 ] [New process 417758 ] [New process 483294 ] [New process 548830 ] [New process 614366 ] [New process 679902 ] [New process 745438 ] [New process 810974 ] [New process 876510 ] [New process 942046 ] [New process 1007582 ] [New process 1073118 ] [New process 1138654 ] [New process 1204190 ] [New process 1269726 ] #0 0x0000000100159c3c in mdb_page_search_root () (gdb) bt #0 0x0000000100159c3c in mdb_page_search_root () #1 0x000000010015a2d0 in mdb_page_search () #2 0x000000010015c984 in mdb_cursor_first () #3 0x000000010015d93c in mdb_cursor_get () #4 0x000000010015204c in mdb_page_alloc () #5 0x0000000100152b6c in mdb_page_touch () #6 0x000000010015a264 in mdb_page_search () #7 0x000000010015dba0 in mdb_cursor_touch () #8 0x000000010015e314 in mdb_cursor_put () #9 0x000000010018f25c in mdb_dn2id_add () #10 0x0000000100184e94 in mdb_add () #11 0x0000000100060970 in fe_op_add () #12 0x00000001000601fc in do_add () #13 0x000000010005128c in connection_operation () #14 0x0000000100051a4c in connection_read_thread () #15 0xffffffff7f4164bc in ldap_int_thread_pool_wrapper () from /some/dir/lib/libldap_r-2.4.so.2 #16 0xffffffff7ced7374 in _lwp_start () from /lib/64/libc.so.1 #17 0xffffffff7ced7374 in _lwp_start () from /lib/64/libc.so.1 Backtrace stopped: previous frame identical to this frame (corrupt stack?) Thanks

2 1

RE: ACL doesn't work on my Centos 6
by Dong Xi 05 Aug '14

05 Aug '14

Hi Quanah, I am using RHEL build, so in this case, slaps.conf. Can you please tell me how to apply the ACL in my case (disable anonymous access to any except rootdn, and allow self and bind user write to userPassword)? I am new to openldap, any help is really appreciated. dxi -----Original Message----- From: "Quanah Gibson-Mount" <quanah(a)zimbra.com> Sent: ‎2014-‎08-‎04 12:31 To: "Dong Xi" <dxi188(a)gmail.com>; "openldap-technical(a)openldap.org" <openldap-technical(a)openldap.org> Subject: Re: ACL doesn't work on my Centos 6 --On Saturday, August 02, 2014 10:39 PM -0400 Dong Xi <dxi188(a)gmail.com> wrote: > > > > Hi, > > Just set up openldap on my CentOS 6.5. Are you using the RHEL build of OpenLDAP or your own? If you are using the RHEL build, be aware that it uses cn=config, not slapd.conf, so making changes to slapd.conf will not have any effect. --Quanah -- Quanah Gibson-Mount Server Architect Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 1

Need help in undertsanding server certification verification by the client
by SOMA SEKHAR 05 Aug '14

05 Aug '14

Hi , I have my ca cert in a dir and I am setting the CACERTDIR option in openldap global options. *ldap_set_option(NULL, LDAP_OPT_X_TLS_CACERTDIR, <my dir path>)*. After that , I started the tls connection using '*ldap_start_tls_s*' , followed by '*ldap_bind_s*'. This worked fine. What I did not understand is that , even after removing the ca cert from that directory , ldap bind succeeds. Does it mean that certificate verification is not done for the second time by SSL_connect? I have just started on openldap and gone through the code in version 2.4 and openssl-fips-1.2 , searched in google,stackoverflow etc . Can anyone please help me with some information or pointers on this. -- Thanks&Regards, SomaSekhar.

1 0

Re: Will lmdb suit my needs ?
by Florian Weimer 04 Aug '14

04 Aug '14

* Sankar P.: > SELECT DISTINCT column2 FROM autocomplete WHERE column1 LIKE > '<prefix>%' ORDER BY column3 DESC LIMIT 5 > > where column1 and column2 are strings and column3 is int. > > So, what my query essentially does is get a prefix string from user > and get the top (sorted by column3) 5 records where column1 start with > the input prefix and return the column2 of those records. > > In my sqlite, the first time query for each key (a or b or c ...) is > taking about 350 seconds (with an index on all columns) and about 500 > seconds (with an index on only column1). Do you use PRAGMA case_sensitive_like? How many candidate does the "column1 LIKE '<prefix>%'" expression select?

1 0

ACL doesn't work on my Centos 6
by Dong Xi 04 Aug '14

04 Aug '14

Hi, Just set up openldap on my CentOS 6.5. Looks like very easy to set up. And it is working. However, I found ACL doesn't work as expected. I am trying to disable read access to anonymous, and give userPassword write access to self and binduser. But it doesn't work: anonymous can still read whole ldap entries, and no one except cn=Manager,dc=domain,dc=com can change userPassword. I even change following section to access to * by * none to lock down ldap, but still anonymous can read all. === access to dn.base="" by * read access to dn.base="cn=Subschema" by * read access to attrs=userPassword by self write by dn.exact="cn=binduser,dc=domain,dc=com" write by users read by anonymous auth access to * by users read by anonymous auth === to === access to * by * none === Here is the complete slapd.conf. Look like only default ACL works, whatever ACL policy I am trying to apply. Please help. slapd.conf ==== # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/corba.schema include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/duaconf.schema include /etc/openldap/schema/dyngroup.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/java.schema include /etc/openldap/schema/misc.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/ppolicy.schema include /etc/openldap/schema/collective.schema # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Load dynamic backend modules # - modulepath is architecture dependent value (32/64-bit system) # - back_sql.la overlay requires openldap-server-sql package # - dyngroup.la and dynlist.la cannot be used at the same time # modulepath /usr/lib/openldap # modulepath /usr/lib64/openldap # moduleload accesslog.la # moduleload auditlog.la # moduleload back_sql.la # moduleload chain.la # moduleload collect.la # moduleload constraint.la # moduleload dds.la # moduleload deref.la # moduleload dyngroup.la # moduleload dynlist.la # moduleload memberof.la # moduleload pbind.la # moduleload pcache.la # moduleload ppolicy.la # moduleload refint.la # moduleload retcode.la # moduleload rwm.la # moduleload seqmod.la # moduleload smbk5pwd.la # moduleload sssvlv.la # moduleload syncprov.la # moduleload translucent.la # moduleload unique.la # moduleload valsort.la # The next three lines allow use of TLS for encrypting connections using a # dummy test certificate which you can generate by running # /usr/libexec/openldap/generate-server-cert.sh. Your client software may balk # at self-signed certificates, however. #TLSCACertificatePath /etc/openldap/certs #TLSCertificateFile "\"OpenLDAP Server\"" #TLSCertificateKeyFile /etc/openldap/certs/password # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: #access to dn.base="" by * read #access to dn.base="cn=Subschema" by * read #access to * # by self write # by users read # by anonymous auth access to dn.base="" by * read access to dn.base="cn=Subschema" by * read access to attrs=userPassword by self write by dn.exact="cn=binduser,dc=domain,dc=com" write by users read by anonymous auth access to * by users read by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! # enable on-the-fly configuration (cn=config) database config access to * by * none # enable server status monitoring (cn=monitor) database monitor access to * by * none ####################################################################### # database definitions ####################################################################### database bdb suffix "dc=domain,dc=com" checkpoint 1024 15 rootdn "cn=Manager,dc=domain,dc=com" rootpw {SSHA}f3F8TAj9BihNSUtVdMyqrvlcIoawHDgb loglevel 256 sizelimit unlimited # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret #rootpw {SSHA}f3F8TAj9BihNSUtVdMyqrvlcIoawHDgb # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub # Replicas of this database #replogfile /var/lib/ldap/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com(a)EXAMPLE.COM

2 1

Groups in ACLs on MDB
by Johannes Löthberg 04 Aug '14

04 Aug '14

Hello, I've been trying to get using groups working in ACLs, but no matter what I do the group ACL isn't applied. It seems it might be a LMDB bug, and I'm planning on switching to hdb to see if it works there when I get the time. I've attached the olcAccess.ldif that doesn't work and the output of slapacl -D uid=kyrias,ou=users,dc=kyriasis,dc=com \ -b ou=users,dc=kyriasis,dc=com -dacl which shows that the group ACL isn't applied to the user uid=kyrias,ou=users,dc=kyriasis,dc=com even tho it is a member of the cn=admins,ou=security,dc=kyriasis,dc=com group and that the 'to *' ACL is above the other ones. -- Sincerely, Johannes Löthberg PGP Key ID: 3A9D0BB5

1 0

Password Failure for one user
by brown wrap 01 Aug '14

01 Aug '14

I am trying to track down why one user all of a sudden can't log into a machine. He can use his LDAP passwd through our network, but gets an immediate login failure on a particular machine. I can 'su' to his account, from my account using his password, but when I try to log into this machine remotely, I get the failure and it terminates the sessions. There have been no changes to the system at all. I am looking for step to troubleshoot this issue. Thanks.

2 2

Q: cn=Connection 0,cn=Connections,cn=Monitor
by Ulrich Windl 01 Aug '14

01 Aug '14

Hi! I'm browsing the monitor database for routine, and I founf this "Connectio 0": # Connection 0, Connections, Monitor dn: cn=Connection 0,cn=Connections,cn=Monitor monitorConnectionNumber: 0 monitorConnectionProtocol: 0 monitorConnectionOpsReceived: 4 monitorConnectionOpsExecuting: 0 monitorConnectionOpsPending: 0 monitorConnectionOpsCompleted: 4 monitorConnectionGet: 6 monitorConnectionRead: 6 monitorConnectionWrite: 0 monitorConnectionMask: L monitorConnectionListener: monitorConnectionPeerDomain: unknown monitorConnectionPeerAddress: unknown monitorConnectionLocalAddress: monitorConnectionStartTime: 19700101000000Z monitorConnectionActivityTime: 19700101000000Z Is it a bug that Start and Activity time are both unset? If the reads and writes of the connection can be counted, the timestamps could be updated as well, I guess. It's 2.4.26 here, so maybe it has been fixed meanwhile... I just saw that I have a second "connection 0": # Connection 0, Connections, Monitor dn: cn=Connection 0,cn=Connections,cn=Monitor monitorConnectionNumber: 0 monitorConnectionProtocol: 0 monitorConnectionOpsReceived: 4 monitorConnectionOpsExecuting: 0 monitorConnectionOpsPending: 0 monitorConnectionOpsCompleted: 4 monitorConnectionGet: 6 monitorConnectionRead: 6 monitorConnectionWrite: 0 monitorConnectionMask: L monitorConnectionListener: monitorConnectionPeerDomain: unknown monitorConnectionPeerAddress: unknown monitorConnectionLocalAddress: monitorConnectionStartTime: 19700101000000Z monitorConnectionActivityTime: 19700101000000Z Doing a simple quick-and-dirty test, I found out that I have multiple "Connection 0"s: sh monitor2.sh |grep '^# Connection' |sort -n SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 # Connection 0, Connections, Monitor # Connection 0, Connections, Monitor # Connection 0, Connections, Monitor # Connection 0, Connections, Monitor # Connection 0, Connections, Monitor # Connection 0, Connections, Monitor # Connection 0, Connections, Monitor # Connection 0, Connections, Monitor # Connection 0, Connections, Monitor # Connection 1000, Connections, Monitor # Connection 1001, Connections, Monitor # Connection 1008, Connections, Monitor # Connection 1013, Connections, Monitor # Connection 1016, Connections, Monitor # Connection 1017, Connections, Monitor # Connection 1018, Connections, Monitor # Connection 1020, Connections, Monitor # Connection 1021, Connections, Monitor # Connection 1024, Connections, Monitor # Connection 1036, Connections, Monitor # Connection 1040, Connections, Monitor # Connection 1042, Connections, Monitor # Connection 1043, Connections, Monitor # Connection 1118, Connections, Monitor # Connection 1201, Connections, Monitor # Connection 1247, Connections, Monitor # Connection 1380, Connections, Monitor # Connection 14755, Connections, Monitor # Connection 14758, Connections, Monitor # Connection 15369, Connections, Monitor # Connection 15800, Connections, Monitor # Connection 15886, Connections, Monitor # Connection 16674, Connections, Monitor # Connection 20526, Connections, Monitor # Connection 20626, Connections, Monitor # Connection 21044, Connections, Monitor # Connection 21460, Connections, Monitor # Connection 21474, Connections, Monitor # Connection 21688, Connections, Monitor # Connection 25846, Connections, Monitor # Connection 30396, Connections, Monitor # Connection 30665, Connections, Monitor # Connection 31948, Connections, Monitor # Connection 35407, Connections, Monitor # Connection 35953, Connections, Monitor # Connection 36575, Connections, Monitor # Connection 36576, Connections, Monitor # Connection 36577, Connections, Monitor # Connection 36648, Connections, Monitor # Connection 50382, Connections, Monitor # Connection 50599, Connections, Monitor # Connection 50706, Connections, Monitor # Connection 51477, Connections, Monitor # Connection 55650, Connections, Monitor # Connection 55651, Connections, Monitor # Connection 56206, Connections, Monitor # Connection 61141, Connections, Monitor # Connection 61144, Connections, Monitor # Connection 61152, Connections, Monitor # Connection 61153, Connections, Monitor # Connection 61162, Connections, Monitor # Connection 61163, Connections, Monitor # Connection 61164, Connections, Monitor # Connection 61165, Connections, Monitor # Connection 61166, Connections, Monitor # Connection 61167, Connections, Monitor # Connection 61168, Connections, Monitor # Connection 62161, Connections, Monitor # Connection 65286, Connections, Monitor # Connection 67224, Connections, Monitor # Connection 70109, Connections, Monitor # Connection 70162, Connections, Monitor # Connection 70516, Connections, Monitor # Connection 70528, Connections, Monitor # Connection 70529, Connections, Monitor # Connections, Monitor Regards, Ulrich

2 1

Antw: Setting up Monitor Backend
by Ulrich Windl 01 Aug '14

01 Aug '14

>>> Leonard Smith <lrsmith(a)umich.edu> schrieb am 31.07.2014 um 21:52 in Nachricht <CAP9L-w5pR5z80_aTgt_ux2xUpH4gu-kA_Y5zd2VZuNfE9kgfQg(a)mail.gmail.com>: > To all, > > I'm trying to setup the monitoring backend so I can get metrics in OpenLDAP > 2.4.23 on Centos 6. I have it setup and I can query but I don't seem to be > getting any metrics/values. I check the olcAccess rules and it should be > allowing access so I"m not sure why I cannot see any values for any of the > monitoring points. > > > sh-4.1# ldapsearch -Y EXTERNAL -H ldapi:/// -b > 'cn=Total,cn=Connections,cn=Monitor' Hi! Try " ldapsearch -Y EXTERNAL -H ldapi:/// -b 'cn=Total,cn=Connections,cn=monitor' -s sub '(objectClass=*)' monitorCounter". I got: # Total, Connections, Monitor dn: cn=Total,cn=Connections,cn=Monitor monitorCounter: 70315 Regards, Ulrich > SASL/EXTERNAL authentication started > SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth > SASL SSF: 0 > # extended LDIF > # > # LDAPv3 > # base <cn=Total,cn=Connections,cn=Monitor> with scope subtree > # filter: (objectclass=*) > # requesting: ALL > # > > # Total, Connections, Monitor > dn: cn=Total,cn=Connections,cn=Monitor > objectClass: monitorCounterObject > cn: Total > > # search result > search: 2 > result: 0 Success > > # numResponses: 2 > # numEntries: 1 > > dn: olcDatabase={1}monitor > objectClass: olcDatabaseConfig > olcDatabase: {1}monitor > olcAddContentAcl: FALSE > olcLastMod: TRUE > olcMaxDerefDepth: 15 > olcReadOnly: FALSE > olcSyncUseSubentry: FALSE > olcMonitoring: FALSE > structuralObjectClass: olcDatabaseConfig > entryUUID: 4313fd2c-b0ec-1032-8c14-c907d74f027d > creatorsName: cn=config > createTimestamp: 20130913181549Z > olcAccess: {0}to * by > dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by > dn.base="cn=manager > ,dc=foo,dc=com" read by dn.base="cn=monitor,dc=foo,dc=com" read by * none

1 0

syncrepl_del_nonpresent leading to directory implosion
by Aaron Bennett 10 Jul '14

10 Jul '14

Hi, I've got a two-node MMR setup using syncrepl running 2.4.36 with back-bdb. Last night, between 1/3 and 1/2 of the entries in our directory disappeared. Fortunately I have olcLogLeve=sync set, so I think I have a line on what happened... I see this at 4AM long of the morning before the fun started: Jul 7 04:19:30 zoot slapd[15011]: bdb(dc=clarku,dc=edu): Lock table is out of available lock entries Jul 7 04:19:30 zoot slapd[15011]: => bdb_idl_insert_key: c_get failed: Cannot allocate memory (12) Then many hours later: Jul 7 15:04:30 zoot slapd[15011]: bdb(dc=clarku,dc=edu): Lock table is out of available lock entries Jul 7 15:04:30 zoot slapd[15011]: => bdb_idl_delete_key: c_get failed: Cannot allocate memory (12) Jul 7 15:04:30 zoot slapd[15011]: null_callback : error code 0x50 Jul 7 15:04:30 zoot slapd[15011]: slap_graduate_commit_csn: removing 0x7fa33c248a80 20140707190424.188580Z#000000#001#000000 Jul 7 15:04:30 zoot slapd[15011]: syncrepl_del_nonpresent: rid=001 be_delete cn=parents_ug_students,ou=Other,ou=Groups,dc=clarku,dc=edu (80) This repeats itself several times: Jul 7 16:41:09 zoot slapd[15011]: syncprov_matchops: skipping original sid 001 Jul 7 16:41:09 zoot slapd[15011]: bdb(dc=clarku,dc=edu): Lock table is out of available lock entries Jul 7 16:41:09 zoot slapd[15011]: => bdb_idl_delete_key: c_get failed: Cannot allocate memory (12) Jul 7 16:41:09 zoot slapd[15011]: null_callback : error code 0x50 Jul 7 16:41:09 zoot slapd[15011]: slap_graduate_commit_csn: removing 0x7fa37e4b4260 20140707204059.442906Z#000000#001#000000 Jul 7 16:41:09 zoot slapd[15011]: syncrepl_del_nonpresent: rid=001 be_delete cn=parents_ug_students,ou=Other,ou=Groups,dc=clarku,dc=edu (80) Jul 7 16:52:44 zoot slapd[2179]: bdb(dc=clarku,dc=edu): Lock table is out of available lock entries Jul 7 16:52:44 zoot slapd[2179]: => bdb_idl_delete_key: c_get failed: Cannot allocate memory (12) Jul 7 16:52:44 zoot slapd[2179]: null_callback : error code 0x50 Jul 7 16:52:44 zoot slapd[2179]: slap_graduate_commit_csn: removing 0x7f74581dae70 20140707205225.029175Z#000000#001#000000 Jul 7 16:52:44 zoot slapd[2179]: syncrepl_del_nonpresent: rid=001 be_delete cn=parents_ug_students,ou=Other,ou=Groups,dc=clarku,dc=edu (80) Jul 7 16:52:44 zoot slapd[2179]: slap_queue_csn: queing 0x7f7458be8470 20140707205225.029175Z#000000#001#000000 Jul 7 16:52:44 zoot slapd[2179]: slap_graduate_commit_csn: removing 0x7f74581ad2e0 20140707205225.029175Z#000000#001#000000 Then we get (possibly unrelated) a lengthy list of nonpresent_callbacks (tons more then I list here): Jul 7 17:06:24 zoot slapd[2179]: nonpresent_callback: rid=001 present UUID 5111f346-871c-1033-8d4b-f5dbd10b8ca0, dn uid=rvenkatachalam,ou=Users,dc=clarku,dc=edu Jul 7 17:06:24 zoot slapd[2179]: nonpresent_callback: rid=001 present UUID 1e3d94e4-8ce8-1033-8d6a-f5dbd10b8ca0, dn cn=BIOL399-09-SU14,ou=Courses,ou=Groups,dc=clarku,dc=edu Jul 7 17:06:24 zoot slapd[2179]: nonpresent_callback: rid=001 present UUID 45843aa6-91b8-1033-81a9-ff6ec337b146, dn cn=MSPC3090-01-F14,ou=Courses,ou=Groups,dc=clarku,dc=edu Jul 7 17:06:24 zoot slapd[2179]: nonpresent_callback: rid=001 present UUID 4dd09f16-921b-1033-8d8e-f5dbd10b8ca0, dn cn=msit3710-01-f14,ou=DL,ou=Groups,dc=clarku,dc=edu Jul 7 17:06:24 zoot slapd[2179]: nonpresent_callback: rid=001 present UUID 0b3e8d76-9607-1033-81cf-ff6ec337b146, dn cn=acct5411-01-f14,ou=DL,ou=Groups,dc=clarku,dc=edu Jul 7 17:06:24 zoot slapd[2179]: nonpresent_callback: rid=001 present UUID a698a278-9677-1033-81ee-ff6ec337b146, dn cn=ESL0051-E1-F14,ou=Courses,ou=Groups,dc=clarku,dc=edu Jul 7 17:06:24 zoot slapd[2179]: nonpresent_callback: rid=001 present UUID ccf94c1c-979c-1033-8dc9-f5dbd10b8ca0, dn uid=dgunarajasingam,ou=Users,dc=clarku,dc=edu Followed by another lock table / del_nonpresent: Jul 7 17:06:24 zoot slapd[2179]: bdb(dc=clarku,dc=edu): Lock table is out of available lock entries Jul 7 17:06:24 zoot slapd[2179]: => bdb_idl_delete_key: c_del id failed: Cannot allocate memory (12) Jul 7 17:06:24 zoot slapd[2179]: null_callback : error code 0x50 Jul 7 17:06:24 zoot slapd[2179]: slap_graduate_commit_csn: removing 0x7f73e016cb40 20140707210614.062782Z#000000#001#000000 Jul 7 17:06:24 zoot slapd[2179]: syncrepl_del_nonpresent: rid=001 be_delete cn=parents_ug_students,ou=Other,ou=Groups,dc=clarku,dc=edu (80) Jul 7 17:06:24 zoot slapd[2179]: slap_queue_csn: queing 0x7f73e0f0eaa0 20140707210614.062782Z#000000#001#000000 Jul 7 17:06:24 zoot slapd[2179]: slap_graduate_commit_csn: removing 0x7f73e0f180c0 20140707210614.062782Z#000000#001#000000 That repeats itself @ 18:07, 18:47, 18:55. Then the train departs for crazy town... notice this is the other node: ul 7 18:55:59 animal slapd[10389]: nonpresent_callback: rid=002 nonpresent UUID 0e6fea9e-9279-1033-8d97-f5dbd10b8ca0, dn cn=MSPC3070-01-F14,ou=Courses,ou=Groups,dc=clarku,dc=edu Jul 7 18:55:59 animal slapd[10389]: nonpresent_callback: rid=002 nonpresent UUID f710e364-958c-1033-8da2-f5dbd10b8ca0, dn cn=MKT5900-01-F14,ou=Courses,ou=Groups,dc=clarku,dc=edu Jul 7 18:55:59 animal slapd[10389]: nonpresent_callback: rid=002 nonpresent UUID 815ece60-965e-1033-8dab-f5dbd10b8ca0, dn cn=ESL0067-M1-F14,ou=Courses,ou=Groups,dc=clarku,dc=edu Jul 7 18:55:59 animal slapd[10389]: nonpresent_callback: rid=002 nonpresent UUID f9d8a408-96cf-1033-8db0-f5dbd10b8ca0, dn cn=eng2950-01-su14,ou=DL,ou=Groups,dc=clarku,dc=edu Jul 7 18:55:59 animal slapd[10389]: nonpresent_callback: rid=002 nonpresent UUID 480d8cbc-96d3-1033-8dbf-f5dbd10b8ca0, dn cn=esl0011-e1-f14,ou=DL,ou=Groups,dc=clarku,dc=edu Jul 7 18:55:59 animal slapd[10389]: nonpresent_callback: rid=002 nonpresent UUID ccf94c1c-979c-1033-8dc9-f5dbd10b8ca0, dn uid=dgunarajasingam,ou=Users,dc=clarku,dc=edu Jul 7 18:55:59 animal slapd[10389]: slap_graduate_commit_csn: removing 0x7f59c8eddc00 20140707225554.051198Z#000000#002#000000 Jul 7 18:55:59 animal slapd[10389]: syncrepl_del_nonpresent: rid=002 be_delete cn=MPA3950-03-SU14,ou=Courses,ou=Groups,dc=clarku,dc=edu (0) Jul 7 18:55:59 animal slapd[10389]: syncprov_matchops: skipping original sid 002 Jul 7 18:55:59 animal slapd[10389]: syncrepl_del_nonpresent: rid=002 be_delete cn=MSIT3950-0R-SU14,ou=Courses,ou=Groups,dc=clarku,dc=edu (0) Jul 7 18:55:59 animal slapd[10389]: syncprov_matchops: skipping original sid 002 Jul 7 18:55:59 animal slapd[10389]: syncrepl_del_nonpresent: rid=002 be_delete uid=zbamberger,ou=Users,dc=clarku,dc=edu (0) Jul 7 18:55:59 animal slapd[10389]: syncprov_matchops: skipping original sid 002 Jul 7 18:55:59 animal slapd[10389]: syncrepl_del_nonpresent: rid=002 be_delete uid=dgunarajasingam,ou=Users,dc=clarku,dc=edu (0) Jul 7 18:55:59 animal slapd[10389]: syncprov_matchops: skipping original sid 002 Jul 7 18:55:59 animal slapd[10389]: syncrepl_del_nonpresent: rid=002 be_delete uid=hmunawar,ou=Users,dc=clarku,dc=edu (0) Jul 7 18:55:59 animal slapd[10389]: syncprov_matchops: skipping original sid 002 Jul 7 18:55:59 animal slapd[10389]: syncrepl_del_nonpresent: rid=002 be_delete cn=scrn2940-01-su14,ou=DL,ou=Groups,dc=clarku,dc=edu (0) Jul 7 18:55:59 animal slapd[10389]: syncprov_matchops: skipping original sid 002 Jul 7 18:55:59 animal slapd[10389]: syncrepl_del_nonpresent: rid=002 be_delete cn=eng2940-02-su14,ou=DL,ou=Groups,dc=clarku,dc=edu (0) Jul 7 18:55:59 animal slapd[10389]: syncprov_matchops: skipping original sid 002 Jul 7 18:55:59 animal slapd[10389]: syncrepl_del_nonpresent: rid=002 be_delete cn=id2940-02-su14,ou=DL,ou=Groups,dc=clarku,dc=edu (0) Jul 7 18:55:59 animal slapd[10389]: syncprov_matchops: skipping original sid 002 Jul 7 18:55:59 animal slapd[10389]: syncrepl_del_nonpresent: rid=002 be_delete cn=msit3950-0p-su14,ou=DL,ou=Groups,dc=clarku,dc=edu (0) Jul 7 18:55:59 animal slapd[10389]: syncprov_matchops: skipping original sid 002 Jul 7 18:55:59 animal slapd[10389]: syncrepl_del_nonpresent: rid=002 be_delete cn=mspc3060-0p-su14,ou=DL,ou=Groups,dc=clarku,dc=edu (0) That goes on, deleting things, until my pager exploded when some critical role accounts got nuked and our radius servers died. I pulled an LDIF when I realized what was happening and between 18:55 and 19:35, our LDIF went from 75MB to 45MB - so about 30MB of stuff disappeared. What happened? Did I get hit by an oddball BDB/Syncrepl behavior? Do I have a bad misconfiguration in my replication setup? Thanks for your time, Aaron ---- Manager of Systems Administration Clark University ITS

3 3

Outlook LDAP Addressbook Browsing - Add ORDERING caseIgnoreOrderingMatch on CN or NAME core attributes without source code modification and re-compilition
by Richard LEGER 10 Jul '14

10 Jul '14

Hi, We currently used openldap as provided out of the box (binary) by Ubuntu 12.04 LTS. We need to enable Outlook LDAP Addressook browsing when used with our OpenLDAP current setup. According to past posts on the OpenLDAP technical mailing list, there seems to be two requirements: - Add ORDERING caseIgnoreOrderingMatch in the definition of core schema attribute CN (or Name) - Enable LDAP Virtual List View (VLV - OID: 2.16.840.1.113730.3.4.9) control and Server Side Control (SSS - OID: 1.2.840.113556.1.4.473) control on the OpenLDAP server ### Modify (or extend, or replace) definition of core schema attribute As per those posts below, it is possible to mofidy core schema attribute(s) by updating source code and recompiling openldap. http://www.openldap.org/cgi-bin/wilma_hiliter/openldap-technical/201001/msg… http://www.openldap.org/cgi-bin/wilma_hiliter/openldap-technical/201212/msg… Unfortunately this is not an option for us. Is there other way(s) via a local schema or else to modify/extend definition of OpenLDAP core attributes without modifying source code and recompiling? Via ldpamodify or via the creation of a module/overlay maybe that could be loaded via openldap configuration file slapd.conf at startup? The slapd.conf method would be our preference at the moment. As last resort, if not technically possible via slapd.conf, would using the OpenLDAP On-Line Configuration (OLC - cn=config - slapd.config) method instead allow such extend/modification of core schema attributes? If yes how? We are aware that may render our ldapserver no longer fully RFC compliant, but we need to be pragmatic here to provide an effective solution to end-users. We already use our own local LDAP schema definition anyway :-) Thank in advance for your any help/enlightenment you could provide. ### VLV and SSS Control(s) have been enabled as follow # Added the following in /etc/ldap/sldap.conf (...) moduleload sssvlv overlay sssvlv sssvlv-max 8 sssvlv-maxkeys 5 #sssvlv-maxperconn 5 <-- this option is not currently availabe in current database backend version (...) # Restart ldap server /etc/init.d/slapd restart # Check ldapsearch -x -b '' -s base '(ObjectClass=*)' + -D "uid=richard,ou=people,dc=example,dc=com" -W (...) supportedControl: 2.16.840.1.113730.3.4.9 <-- LDAP Virtual List View (VLV) supportedControl: 1.2.840.113556.1.4.473 <-- Server Side Control (SSS) (...) Regards, Richard Leger

1 0

Adding and attribute and editing a matchingRuleUse in the subschema
by espeake＠oreillyauto.com 10 Jul '14

10 Jul '14

On our current server running 2.4.31 we have an operational attribute in the schema labeled pwdFailureTime. I have done: slapcat -n 0 -l /tmp/<my_config>.ldif on our production server. I have also used an LDAP browser to export the schema. When I do a a slapadd -F /etc/your/config/goes/here/ -n 0 -l /tmp/<my_config>.ldif I do get the config loaded. I have confirmed that I am loading all of the same modules on both servers and that the config files match. What I don't have is the pwdFailureTime attribute which I need since it is in the data file as well, making it so I cannot import my data either. This is what the attribute looks like in the subschema: attributeTypes: ( 1.3.6.1.4.1.42.2.27.8.1.19 NAME 'pwdFailureTime' DESC 'The timestamps of the last consecutive authentication failures' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 NO-USER-MODIFICATION USAGE directoryOperation ) Here is the matchingRuleUse: matchingRuleUse: ( 2.5.13.27 NAME 'generalizedTimeMatch' APPLIES ( createTimesta mp $ modifyTimestamp $ pwdChangedTime $ pwdAccountLockedTime $ pwdFailureTime $ pwdGraceUseTime $ birthDate $ hireDate $ statusDate $ openDate ) ) >From other posts that I have read I cannot edit the subschema directly and that makes sense since that would be the fastest way to kill a server. I have tried doing an ldap modify to dn: cn={4}ppolicy,cn=schema,cn=config and I get a syntax error in trying to number the attribute. The new version is 2.4.39 running on ubuntu 12.04 with 3.13 kernel. Thanks Eric Speake Web Systems Administrator O'Reilly Auto Parts (417) 862-2674 Ext. 1975 This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

1 1

SASL not honoring slapo-ppolicy
by Achilleas Mantzios 10 Jul '14

10 Jul '14

Hello list, I have managed successfully to setup a fully functional openldap server on FreeBSD. So far, I had success with : ppolicy, ACLs, legacy SQL exposed as LDAP, SASL authentication. My only problem thus far is combining SASL with ppolicy. When binding with classic simple authentication using -D dn, then ppolicy overlay has the expected effect. However when using SASL (SASL/SCRAM-SHA-1) with -U, while it works correctly converting uid to DN with authz-regexp, it does not seem to look for ppolicy (default or derived from pwdPolicySubentry). Moreover, enforced violations of ppolicy (e.g. failed attempted authentications >= pwdMaxFailure) when done via SASL seem to have no effect on ppolicy attributes, e.g. pwdAccountLockedTime, while they work fine when binding with simple authentication. Is there any way to overcome this? Or is ppolicy honored only via simple DN binds? -- Achilleas Mantzios Head of IT DEV IT DEPT Dynacom Tankers Mgmt

2 3

Re: creating a cn=config modules
by Greg Treantos 10 Jul '14

10 Jul '14

I have read the documentation and cannot figure out how to create a new dit so I can add the module I need. If you can be more specific on what I should be looking for that would be great. But no where have I found that points how to create the cn=module{0} dit so it can be populated. I don't know maybe I'm asking the wrong questions. from the docs 5.2.2. cn=module If support for dynamically loaded modules was enabled when configuring slapd, cn=module entries may be used to specify sets of modules to load. Module entries must have the olcModuleList objectClass. I don't have a cn=module dit, how do I create it? On Wed, Jul 9, 2014 at 6:26 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Wednesday, July 09, 2014 6:59 PM -0400 Greg Treantos < > gtreanto(a)gmail.com> wrote: > > >> From the man pages ldapadd is just a hardlink to ldapmodify, but I tried >> and got the same error >> >> >> >> ldapadd -Y EXTERNAL -H ldapi:/// -v -f ldapMdynalist.ldif >> ldap_initialize( ldapi:///??base ) >> SASL/EXTERNAL authentication started >> SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth >> SASL SSF: 0 >> add olcModuleLoad: >> {0}/usr/lib64/openldap/memberof.la >> > > The above is invalid. I strongly advise you to read the documentation. > > Also, you should not be touching or creating any files inside the > cn=config database. > > > --Quanah > > -- > > Quanah Gibson-Mount > Server Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Greg http://www.linkedin.com/in/gregtreantos

4 5

Re: creating a cn=config modules
by Greg Treantos 10 Jul '14

10 Jul '14

>From the man pages ldapadd is just a hardlink to ldapmodify, but I tried and got the same error ldapadd -Y EXTERNAL -H ldapi:/// -v -f ldapMdynalist.ldif ldap_initialize( ldapi:///??base ) SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 add olcModuleLoad: {0}/usr/lib64/openldap/memberof.la modifying entry "cn=module{0},cn=config" ldap_modify: No such object (32) matched DN: cn=config I also tried this before and after touching cn=module{0} with ldap:ldap as the owner/group On Wed, Jul 9, 2014 at 5:50 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Wednesday, July 09, 2014 6:23 PM -0400 Greg Treantos < > gtreanto(a)gmail.com> wrote: > > >> >> Here is what the cn=config directory looks like. As you can see there is >> no olcDatabase={x}module.ldif file so my question is how do you create >> one. >> > > Modify is for objects that exist. Try using ldapadd. > > > --Quanah > > -- > > Quanah Gibson-Mount > Server Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Greg http://www.linkedin.com/in/gregtreantos

2 1

Re: creating a cn=config modules
by Greg Treantos 09 Jul '14

09 Jul '14

Here is what the cn=config directory looks like. As you can see there is no olcDatabase={x}module.ldif file so my question is how do you create one. olcDatabase={2}hdb.ldif olcDatabase={1}monitor.ldif olcDatabase={0}config.ldif cn=schema olcDatabase={-1}frontend.ldif cn=schema.ldif I created this compliant ldif dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: {0}/usr/lib64/openldap/memberof.la but when I try an use ldapmodify -Y EXTERNAL -H ldapi:/// -v -f ldapMdynalist.ldif I get ldap_initialize( ldapi:///??base ) SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 add olcModuleLoad: {0}/usr/lib64/openldap/memberof.la modifying entry "cn=module{0},cn=config" ldap_modify: No such object (32) matched DN: cn=config So how do you create a ldif in cn=config. I've read the docs but it is not clear to me how to do this. Once the file is created I'm sure ldapmodify will work. Do I just touch the file? On Wed, Jul 9, 2014 at 4:54 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Wednesday, July 09, 2014 2:10 PM -0400 Greg Treantos < > gtreanto(a)gmail.com> wrote: > > 1 dn: cn=module{0},cn=config >> 2 changetype: modify >> 3 add:olcModuleList >> 4 objectClass: olcModuleList >> 5 olcModulePath: /usr/lib64/openldap/ >> 6 cn: module{0} >> 7 changetype: modify >> 8 add: olcModuleLoad >> 9 olcModuleLoad: {0}accesslog.la >> 10 olcModuleLoad: {1}auditlog.la >> 11 olcModuleLoad: {2}constraint.la >> 12 olcModuleLoad: {3}dynlist.la >> 13 olcModuleLoad: {4}memberof.la >> 14 olcModuleLoad: {5}ppolicy.la >> 15 olcModuleLoad: {6}refint.la >> 16 olcModuleLoad: {7}seqmod.la >> 17 olcModuleLoad: {8}syncprov.la >> 18 olcModuleLoad: {9}sssvlv.la >> 19 olcModuleLoad: {10}translucent.la >> 20 olcModuleLoad: {11}unique.la >> 21 olcModuleLoad: {12}back_monitor.la >> > > The above LDIf is clearly invalid. I'm not surprised at all that it gets > rejected. I'd suggest re-reading the documentation on how to use > ldapmodify and the LDIF format. > > --Quanah > > -- > > Quanah Gibson-Mount > Server Architect > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Greg http://www.linkedin.com/in/gregtreantos

2 1

creating a cn=config modules
by Greg Treantos 09 Jul '14

09 Jul '14

I have openldap server version I am trying to create a cn=module{0} I created an ldif but can't seem to get the proper syntax. I've spent a lot of time searching but haven't found a solution. Any suggestions are appreciated. the ldif I am using, The line numbers are for reference only 1 dn: cn=module{0},cn=config 2 changetype: modify 3 add:olcModuleList 4 objectClass: olcModuleList 5 olcModulePath: /usr/lib64/openldap/ 6 cn: module{0} 7 changetype: modify 8 add: olcModuleLoad 9 olcModuleLoad: {0}accesslog.la 10 olcModuleLoad: {1}auditlog.la 11 olcModuleLoad: {2}constraint.la 12 olcModuleLoad: {3}dynlist.la 13 olcModuleLoad: {4}memberof.la 14 olcModuleLoad: {5}ppolicy.la 15 olcModuleLoad: {6}refint.la 16 olcModuleLoad: {7}seqmod.la 17 olcModuleLoad: {8}syncprov.la 18 olcModuleLoad: {9}sssvlv.la 19 olcModuleLoad: {10}translucent.la 20 olcModuleLoad: {11}unique.la 21 olcModuleLoad: {12}back_monitor.la here is the error ldapmodify -Y EXTERNAL -H ldapi:/// -vn -f ldapMdynalist.ldif ldapmodify: wrong attributeType at line 4, entry "cn=module{0},cn=config" -- Greg http://www.linkedin.com/in/gregtreantos

2 1

Addressbook in LDAP ... should be simple right?
by Adam Goryachev 09 Jul '14

09 Jul '14

I've been messing with LDAP for the past couple of days, and following various online tutorials on how to create an addressbook for Thunderbird in openldap. Sure, this isn't too difficult, and I have it working as a proof of concept. I can use phpldapadmin to create new entries in my addressbook, and these will show up in Thunderbird's addressbook. I've also spent the day reading most of the openldap admin guide (250 pages), which eventually I noticed is missing section E, where I'm sure something simple like this would appear. However, now I want to organise the addresses into groups. eg, say we have the following staff: John Smith works in the head office and is the CEO Ann Johnson works in the head office and is a general admin person Mary Brown works in the branch office and is the state manager Jane Martin works in the branch office and is a general admin person I want everybody to be listed in a People group... I want all four people listed in a Staff group... I want John Smith and Mary Brown in a Managers group I want John Smith and Ann Johnson in a Head Office group I want Mary Brown and Jane Martin in a Branch Office group So, I could do this like this: dn: dc=example,dc=com objectClass: top objectClass: dcObject objectClass: organization o: My Organization dc: example dn: ou=People,dc=example,dc=com objectClass: top objectClass: organizationalUnit ou: People description: All the people dn: ou=Staff,dc=example,dc=com objectClass: organizationalUnit objectClass: top ou: Staff dn: cn=John Smith+mail=jsmith(a)example.com,ou=People,dc=example,dc=com objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: mozillaAbPersonAlpha givenName: John sn: Smith cn: John Smitih mail: jsmith(a)example.com etc for other people Then I can configure the groups like this: dn: cn=Managers,dc=example,dc=com cn: Managers of example.com objectclass: groupofNames member: cn=John Smith+mail=jsmith(a)example.com,ou=People,dc=example,dc=com member: cn=Mary Brown+mail=mbrown(a)example.com,ou=People,dc=example,dc=com However, thunderbird doesn't seem to have any smart way to show this group... So, I thought, maybe I could duplicate the "People" and put complete addressbook records into the Managers ou, but then it complains that the same CN already exists, besides the fact that this just seems like a kludge, and not a very "nice" way to achieve this. PS, the context is to try and replace MS Outlook with Mozilla Thunderbird. With email in IMAP4, that works well. I can share the calendar from thunderbird to iphones/android phones with http://calendarserver.org/. Now I'm just trying to resolve the "shared contacts" issue, which is currently solved by copying (at login) a pst file from a share to the local users profile, and having that configured to open in outlook (add pst data file). I'd prefer to replace all that with ldap, since thunderbird supports ldap for an addressbook, and it would then update immediately (instead of after next login). Also, long term it would be useful to use ldap for other web based login authentication, squid proxy auth, and/or even windows authentication, but, one step/problem at a time. Thank you for any advise or suggestions, or pointers to documentation. Regards, Adam -- Adam Goryachev Website Managers www.websitemanagers.com.au

6 8

sizelimit issue in openldap + lmdb environment
by Ajit K Jena 08 Jul '14

08 Jul '14

Hi, We have been openldap user for long time with BDB backend. Now I am trying to migrate to LMDB backend. In our environment we are trying to enforce a limit specified below: sizelimit size.soft=54 size.hard=100 size.unchecked=150 This works properly in the BDB environment. In the LMDB environment we cant get even one query answered. We get error 11 (administrative limit exceeded). The query is for (objectclass=*) for a single user (uid=xxx). Has anyone see this before ? The property "sizelimit" is concerned with ldap. How is it getting affected with change of storage backend ? Pl guide me as to how to fix this problem. --ajit --------------------------------------------------------------------- Ajit K. Jena Phone :+91-22-25768750 Computer Centre +91-22-25767751 Indian Institute of Technology POWAI, Mumbai-400 076 Fax : +91-22-25721210 PIN 400076, India Email : ajit(a)iitb.ac.in ---------------------------------------------------------------------

3 2

Trying to get ACLs to work ...
by Philip Colmer 08 Jul '14

08 Jul '14

We have a setup whereby a group of users are able to create accounts in specific OUs. This is handled by ACLs like this one: add: olcAccess olcAccess: to dn.exact="ou=team1,ou=accounts,dc=example,dc=org" attrs=children by group/groupOfUniqueNames/uniqueMember="cn=account-mgrs-non-staff,ou=mailing,ou=groups,dc=example,dc=org" write by users read by * none - add: olcAccess olcAccess: to dn.sub="ou=team1,ou=accounts,dc=example,dc=org" attrs=entry by group/groupOfUniqueNames/uniqueMember="cn=account-mgrs-non-staff,ou=mailing,ou=groups,dc=example,dc=org" write by users read by * none - I've been asked if the people who create those accounts can edit the passwords after the accounts have been created. I tried to do that by changing the second access line to read: add: olcAccess olcAccess: to dn.sub="ou=team1,ou=accounts,dc=example,dc=org" attrs=entry,userPassword,shadowLastChange by group/groupOfUniqueNames/uniqueMember="cn=account-mgrs-non-staff,ou=mailing,ou=groups,dc=example,dc=org" write by users read by * none - Now, my problem is that this is clashing with the rule that we have for authentication: # Allow LDAP admin and the account concerned to modify their password, anonymous to authenticate. add: olcAccess olcAccess: to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=example,dc=org" write by anonymous auth by self write by * none Initially, that rule as the first of the olcAccess rules. I thought in advance that that was going to block the writes to userPassword & shadowLastChange in subsequent rules, so I moved it to after the rules that covered creating those accounts. Authentication then broke :-( I can't just add by group/groupOfUniqueNames/uniqueMember="cn=account-mgrs-non-staff,ou=mailing,ou=groups,dc=example,dc=org" write to the primary olcAccess rule because that will allow members of "account-mgrs-non-staff" to change the password on ANY account, which I cannot allow. It must only be to specific OUs. How do I fix this clash between the rules, please? Thanks. Philip

1 0

Distributing a list of users across multiple servers
by Carlo Santos 08 Jul '14

08 Jul '14

Hi all, I'm trying to create an OpenLDAP service where the amount of users are distributed across multiple servers. For example, I have the users under "ou=users,dc=cloudtop,dc=ph" and I have all my users under it without any hierarchy (let's say a million). How do I distribute them to different OpenLDAP servers without hierarchy? Do I use referrals or do I use subordinating?

2 1

capture password
by Rogério Augusto Rondini 05 Jul '14

05 Jul '14

Hi folks, I need to implement password sync between AD and OpenLDAP using an IDM tool. I want to know how to capture clear text password in OpenLDAP before encryption so that I can sync with AD and potentially with others user repositories. Kind Regards, Rogério Rondini

5 6

meta backend NOT working in parallel???
by Vishchers, Michael, SEVEN PRINCIPLES 04 Jul '14

04 Jul '14

Hi there, my goal was to use one openldap server as a proxy to a couple of ldap backends (targets) running on different hosts for user authentication. This works fine if all servers can be reached, there is either no answer or (usually) one from one of the backends. If one of these servers is not reachable due to e.g. a firewall, the meta_search_dobind_init hangs waiting to connect to this candidate, and after a timeout, retries one time. In the meantime, no other candidates are tried. >From the documentation and several discussions, I understood that meta would connect in parallel to all the candidates and return whatever answer it got. Am I mistaken, or are there any configuration parameters that I am unaware of to achieve the desired behaviour? Kind regards Michael

1 0

Openlda2.4.39 compling error
by Darouichi, Aziz 03 Jul '14

03 Jul '14

Hi, I am trying to compile Openldap-2.4.39 in RHEL 6.5 with DB -6-0.30, I run the configure with: env CPPFLAGS="-I/opt/local/db-6.0.30/include" LDFLAGS="-L/opt/local/db-6.0.30/lib" ./configure --enable-hdb --enable-bdb --enable-overlays=mod --enable-ppolicy=yes --enable-passwd --enable-syslog --enable-debug --with-tls --prefix=/opt/local - but when I get to run make test I get : make[1]: Entering directory `/root/Downloads/openldap-2.4.39/tests' make[2]: Entering directory `/root/Downloads/openldap-2.4.39/tests' Initiating LDAP tests for BDB... Running ./scripts/all for bdb... >>>>> Executing all LDAP tests for bdb >>>>> Starting test000-rootdse for bdb... running defines.sh Starting slapd on TCP/IP port 9011... Using ldapsearch to retrieve the root DSE... Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... ./scripts/test000-rootdse: line 66: kill: (10020) - No such process ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) >>>>> Test failed >>>>> test000-rootdse failed for bdb (exit 255) make[2]: *** [bdb-yes] Error 255 make[2]: Leaving directory `/root/Downloads/openldap-2.4.39/tests' make[1]: *** [test] Error 2 make[1]: Leaving directory `/root/Downloads/openldap-2.4.39/tests' make: *** [test] Error 2 make install fails with: /usr/bin/ld: /opt/local/lib/libssl.a(s23_meth.o): relocation R_X86_64_32 against `.rodata' can not be used when making a shared object; recompile with -fPIC /opt/local/lib/libssl.a: could not read symbols: Bad value collect2: ld returned 1 exit status libtool: install: error: relink `libldap.la' with the above command before installing it make[2]: *** [install-local] Error 1 make[2]: Leaving directory `/root/Downloads/openldap-2.4.39/libraries/libldap' make[1]: *** [install-common] Error 1 make[1]: Leaving directory `/root/Downloads/openldap-2.4.39/libraries' make: *** [install-common] Error 1 Please let me know if you need more info. Thanks

3 3

backend meta rwm rewrite attribute value that is not DNs
by Nicolas RENAULT 03 Jul '14

03 Jul '14

Hello, Questions from this first post http://www.openldap.org/lists/openldap-technical/201407/msg00002.html I want to know if there is an overlay like rwm that can rewrite attribut values that are not DNs ? Exactly I want to rewrite createTimestamp (and all attribute that contains this datetime output form) value from yyyyMMddhhmmss.0Z to yyyyMMddHHmmssZ Regards -- Nicolas

1 0

Promoting slave to master LDAP server
by Bruno Furtado 03 Jul '14

03 Jul '14

Hi all, can I promote a LDAP slave server to master? Best regards, -- Bruno Furtado

2 1

Setting a flat to indicate disabled / enabled user
by Udai Singh Mehra (Vizury) 02 Jul '14

02 Jul '14

Hello, I am trying to develop a mechanism using which the users who left the organization can be easily identified and hence set their account as disabled. Is there any schema already available for this? I would appreicate if I can get to know anyone who has already encountered this situation and fixed the problem. Thanks. -- Udai Singh Mehra Infrastructure Engineering and Operations

2 3

rewrite of date-hour format from AD to openldap format
by Nicolas RENAULT 02 Jul '14

02 Jul '14

Hello, I have a openldap with meta backend connected to 3 ldap (one openldap, one edir and one AD). I test authentication again the proxy , it's working. my problem : dev team is working to use this proxy from alfresco, but there is error cause by date format on some attributes from Active Directory yyyyMMddHHmmss'.0Z' from OpenLDAP yyyyMMddHHmmss'Z' alfresco can understand only one type of date format on his configuration. (say dev team) they says to me : go to openldap format. so I want to rewrite all the attributes with date at yyyyMMddHHmmss'.0Z' to yyyyMMddHHmmss'Z' exemple : whenCreate (AD) to createTimestamp (openldap) I succesfully use rwm to rewrite DN but rwm-rewriteRule seem not to work for attributes that are not distinguishedname type. before asking I have googlize a lot without succes. any idea, clue or help ? Regards (sorry if bad english, I'm not fluent) -- Nicolas

2 2

Master Master or Master Slave Openldap replication.
by Kaushal Shriyan 01 Jul '14

01 Jul '14

Hi, Are there any document or writeup regarding setup of Master Master Openldap application? Do i need to go with setup of Master Master or Master Slave openldap replication, Please advice which approach should i follow and help me understand with some use cases. Regards, Kaushal

2 1

how to use ppolicy schema
by Udai Singh Mehra (Vizury) 30 Jun '14

30 Jun '14

Hi, I want to set password policies for my users in LDAP. Therefore i used the ppolicy.schema and added it to cn=config. I also used the ppolicy to be used as a olcOverLay Module. But I am unable to see a way to use it. I fail to create a default password policy for all the users. Can anyone send me some guidling steps as to how can I use the ppolicy.schema and set password policies for my users. i am using openldap in Ubuntu 14.04 which has everything set in slapd database. thanks, -- Udai Singh Mehra Infrastructure Engineering and Operations

1 0

LDAP limit of groups per user
by Julien Courtès 30 Jun '14

30 Jun '14

Hi, I am experiencing an issue with posix groups. I have a user which belongs to 28 posix groups but when I use the command "id" on the user, I can't see all the groups whereas as root, I can clearly see that this member belongs to much groups. Is there a limit of posix groups per user? If yes, how to increase it? Thanks Julien Courtès

2 2

zero copy jni lib for lmdb
by Kristoffer Sjögren 29 Jun '14

29 Jun '14

Hi I'm experimenting a bit with developing a JNI library for LMDB that utilize zero copy buffers. As you may know there is a project called lmdbjni [1] already but it does buffer copy only. I must admit that my C and JNI skills is not really that great, so please forgive any stupidity on my part. Anyway, i'm taking the sun.misc.Unsafe (no bounds checking) approach for memory allocation and pass memory addresses through JNI to LMDB for both writes and reads and at the moment I have implemented put, get, begin, commit [2]. I suspect that something is wrong because the performance between the buffer copy and zero copy isn't really that big. lmdbjni is even faster sometimes, write commits specifically is almost twice as fast. The test write 1M entries with a 4 bytes key (1-1M) and 128 bytes value (random) committed in one go. LMDB is configured identically both implementations with 4GB MDB_WRITEMAP. I run Linux 3.2.0 with Intel(R) Core(TM)2 Quad CPU Q6600 @ 2.40GHz. JProfiler show no signs of bottlenecks in Java in my implementation, most time is spent on the native methods put and commit. The opposite is true for lmdbjni where most time is spent creating and writing Java byte buffers, while native put and commit is just a fraction of that time. Not sure exactly the significance of the gcc compiler but here is how I do it. gcc -g -Wall -O2 -Wbad-function-cast -Wno-write-strings -fPIC -shared -I$JAVA_HOME/include -I$JAVA_HOME/include/linux -Isrc/main/native src/main/native/jlmdb.c src/main/native/liblmdb.a -o target/linux64/libjlmdb.so - What could be the reason for "slow(er)" commits? - How much faster can I expect properly implemented zero copying to be? - Maybe lmdbjni have defacto standard optimizations that me as a C noobie might have overlooked? - Are there any performance counters, tracepoints or similar that might be of interest to find where latency is spent? Greatful for any tips or pointers on how to track the problem down. Cheers, -Kristoffer [1] https://github.com/chirino/lmdbjni [2] JNI MDB_env *mdb_env; MDB_dbi dbi; JNIEXPORT jlong JNICALL Java_NativeLmdb_put (JNIEnv * env, jobject obj, jlong tx, jlong keyAddress, jlong keySize, jlong valAddress, jlong valSize) { MDB_val mdb_key, mdb_val; mdb_key.mv_data = (void *)(intptr_t) keyAddress; mdb_key.mv_size = (size_t) keySize; mdb_val.mv_data = (void *)(intptr_t) valAddress; mdb_val.mv_size = (size_t) valSize; int rc = mdb_put((MDB_txn *) (intptr_t) tx, dbi, &mdb_key, &mdb_val, 0); return rc; } JNIEXPORT jlong JNICALL Java_NativeLmdb_get (JNIEnv *env, jobject o, jlong tx, jlong a, jlong s) { MDB_val mdb_key, mdb_val; mdb_key.mv_data = (void *)(intptr_t) a; mdb_key.mv_size = (size_t) s; int rc = mdb_get((MDB_txn *) (intptr_t) tx, dbi, &mdb_key, &mdb_val); if (rc == 0) { return (intptr_t) mdb_val.mv_data; } return -1; } JNIEXPORT void JNICALL Java_org_deephacks_lmdb_NativeLmdb_mdb_1txn_1begin(JNIEnv *env, jobject obj, jlongArray array) { jlong *nArray = (*env)->GetLongArrayElements(env, array, NULL); MDB_txn *txn; mdb_txn_begin(mdb_env, NULL, 0, &txn); nArray[0] = (jlong) txn; (*env)->ReleaseLongArrayElements(env, array, nArray, 0); } JNIEXPORT void JNICALL Java_NativeLmdb_mdb_1txn_1begin(JNIEnv *env, jobject obj, jlongArray tx) { jlong *nArray = (*env)->GetLongArrayElements(env, array, NULL); MDB_txn *txn; mdb_txn_begin(mdb_env, NULL, 0, &txn); tx[0] = (jlong) txn; (*env)->ReleaseLongArrayElements(env, tx, nArray, 0); } JNIEXPORT jint JNICALL Java_NativeLmdb_mdb_1txn_1commit(JNIEnv *env, jobject obj, jlong tx) { return (jint)mdb_txn_commit((MDB_txn *)(intptr_t)tx); } JNIEXPORT void JNICALL Java_NativeLmdb_open (JNIEnv * env, jobject obj) { mdb_env_create(&mdb_env); mdb_env_set_mapsize(mdb_env, 4294967296); mdb_env_open(mdb_env, "/tmp/testdb", MDB_WRITEMAP, 0664); MDB_txn *txn; mdb_txn_begin(mdb_env, NULL, 0, &txn); mdb_open(txn, NULL, 0, &dbi); mdb_txn_commit(txn); }

2 3

Syncrepl and problem with ldap_sasl_bind_s failed?
by Eivind Olsen 27 Jun '14

27 Jun '14

Hello. I'm struggling a bit with setting up syncrepl replication between two OpenLDAP servers (using version 2.4.39 compiled by the LTB project, on top of RHEL6, if that matters in this case). Does anyone here have some suggestions on what I should look deeper into here? Is it a known newbie-error I'm making? I can post configuration files, describe how I attempt to set up the replication etc. The two servers have a replicated cn=config, in addition to two suffixes with their own HDB backend. The first of those suffixes are meant for administrative data, replication user account, etc., and the second suffix is for some end-user accounts/settings. I seem to have managed to get the first HDB backend to replicate, but I can't get the 2nd to work for some reason (most likely because I'm doing something wrong). When I start OpenLDAP with some debug logging, I see several log line, but the first ones that catches my interest looks like: 53ac30ff slapd starting 53ac30ff slap_client_connect: URI=ldap://ldap01-testing.aminor.no DN="cn=replicator,ou=admins,ou=internal,o=aminor" ldap_sasl_bind_s failed (49) 53ac30ff do_syncrepl: rid=005 rc 49 retrying (4 retries left) (this was seen on the node ldap02-testing.aminor.no. The hostnames exist in DNS internally, the two nodes can see each other on the IP level etc.) Both the working and non-working suffix are configured to use the same replication user (which lives in the 1st suffix). In my case, I have 2 hdb backends, one seems to replicate just fine, the other doesn't. I can use ldapsearch on the suffix for that non-replicating hdb from both nodes to both nodes, and get replies back (running ldapsearch -x, with -D and -w giving the cn=replicator,ou=admins...etc. and password). I went to the #openldap IRC channel and asked about this issue earlier today, and I saw another person ask about the same "ldap_sasl_bind_s failed (49)" error message as well. He was using a somewhat older OpenLDAP though (2.4.23) on Debian though. Regards Eivind Olsen

3 6

mdb maxsize too big - no specific error message?
by Marc Patermann 25 Jun '14

25 Jun '14

Hi, is there no specific error message if the mdb maxsize is too big (for the containing filesystem)? I used my ansible (great tool!) playbook to create an ldap server in a test VM. This was only 8 GB small. My initial slapadd failed and I did not why. (On my "real hardware" test machine this was all fine.) "mdb_db_open: cannot be opened, err 112, Restore from Backup!" If this is what "err 112" means, it should better say "maxsize too big" or something. It took me some time to figure out, my disk was to small for my config. Marc

2 1

slapd dead. pls advise how I can restart it
by Eileen(=^ω^=) 25 Jun '14

25 Jun '14

Hi team, My LDAP service had an unexpected blackout, it can’t be started. could you pls advise how I can restart it? When I check the slapd status: [root@nplserver1 ~]# service slapd status slapd dead but pid file exists àbut I can’t find any pid file When I start slapd, below will be come. [root@nplserver1 openldap]# slapd start -d 256 @(#) $OpenLDAP: slapd 2.4.23 (Feb 22 2013 01:50:21) $ mockbuild@c6b7.bsys.dev.centos.org:/builddir/build/BUILD/openldap-2.4.23/openldap-2.4.23/build-servers/servers/slapd bdb(dc=npl,dc=tmsr): unable to join the environment bdb_db_open: database "dc=npl,dc=tmsr" cannot be opened, err 11. Restore from backup! bdb(dc=npl,dc=tmsr): txn_checkpoint interface requires an environment configured for the transaction subsystem bdb_db_close: database "dc=npl,dc=tmsr": txn_checkpoint failed: Invalid argument (22). backend_startup_one (type=bdb, suffix="dc=npl,dc=tmsr"): bi_db_open failed! (11) bdb_db_close: database "dc=npl,dc=tmsr": alock_close failed slapd stopped. And I can’t find any process in 389 port.‍ best wishes Eileen

7 8

Re: slapd dead. pls advise how I can restart it
by Mauricio Tavares 24 Jun '14

24 Jun '14

On Tue, Jun 24, 2014 at 11:31 AM, Alessandro Avagliano <alessandro(a)avagliano.berlin> wrote: > > On 24/06/14 16:10, Mauricio Tavares wrote: >> >> I does sound like the database is corrupted somehow. slapcat >> needs slapd to be running, right? >> > > Hello Mauricio, > Hello and thanks for the reply. I will save it in my notes. That said, the original poster was Eileen, not me. I do hope she'll try your suggestions and get the data back. > (If you don't have a backup... ) > ...depending on your operating system and OpenLDAP version installed, > you should have on your system a tool called db<version>_recover > > e.g.: db5.1_recover, db4.8_recover and so on. > > (from the man page:) > "db5.1_recover - Restore the database to a consistent state > > The db5.1_recover utility must be run after an unexpected application, > Berkeley DB, or system failure to > restore the database to a consistent state. All committed transactions > are guaranteed to appear after > db5.1_recover has run, and all uncommitted transactions will be > completely undone." > > > Be sure to make a backup copy of your db before running it, and that the > version of the db utilities that you are running matches your BDB > version (I haven't tried to recover it using different utilities/db > version). > > If you manage to restore your db, make sure you perform regular backups > and that you have at least 1 slapd replica running.... they can both > help you to restore the system in such situations > > I hope this helps, > > > Kind Regards, > Alessandro > >

1 0

ldap_set_option() performs blocking name resolution during initalization
by Jan Synacek 24 Jun '14

24 Jun '14

Is it intentional? If yes, could you please explain why, or point me to a documentation where I can find the answer? A backtrace and a snippet of code follow: #0 0x00007fda39c80a70 in __poll_nocancel () at ../sysdeps/unix/syscall-template.S:81 #1 0x00007fda38d17e0d in send_dg (resplen2=0x0, anssizp2=0x0, ansp2=0x0, anscp=0x7fff2548cb30, gotsomewhere=<synthetic pointer>, v_circuit=<synthetic pointer>, ns=0, terrno=0x7fff2548bab0, anssizp=0x7fff2548bbf0, ansp=0x7fff2548baa8, buflen2=0, buf2=0x0, buflen=36, buf=0x7fff2548bc20 "\tg\001", statp=0x7fda39f533e0 <_res(a)GLIBC_2.2.5>) at res_send.c:1059 #2 __libc_res_nsend (statp=statp@entry=0x7fda39f533e0 <_res(a)GLIBC_2.2.5>, buf=buf@entry=0x7fff2548bc20 "\tg\001", buflen=<optimized out>, buf2=buf2@entry=0x0, buflen2=buflen2@entry=0, ans=ans@entry=0x7fff2548c700 "", anssiz=anssiz@entry=1024, ansp=ansp@entry=0x7fff2548cb30, ansp2=ansp2@entry=0x0, nansp2=nansp2@entry=0x0, resplen2=resplen2@entry=0x0) at res_send.c:556 #3 0x00007fda38d15d47 in __GI___libc_res_nquery ( statp=statp@entry=0x7fda39f533e0 <_res(a)GLIBC_2.2.5>, name=0x7fff2548d140 "client.example.com", class=class@entry=1, type=type@entry=1, answer=answer@entry=0x7fff2548c700 "", anslen=anslen@entry=1024, answerp=answerp@entry=0x7fff2548cb30, answerp2=answerp2@entry=0x0, nanswerp2=nanswerp2@entry=0x0, resplen2=resplen2@entry=0x0) at res_query.c:226 #4 0x00007fda38d16963 in __libc_res_nquerydomain (domain=0x0, resplen2=0x0, nanswerp2=0x0, answerp2=0x0, answerp=0x7fff2548cb30, anslen=1024, answer=0x7fff2548c700 "", type=1, class=1, name=0x7fff2548d140 "client.example.com", statp=0x7fda39f533e0 <_res(a)GLIBC_2.2.5>) at res_query.c:582 #5 __GI___libc_res_nsearch (statp=0x7fda39f533e0 <_res(a)GLIBC_2.2.5>, name=name@entry=0x7fff2548d140 "client.example.com", class=class@entry=1, type=type@entry=1, answer=answer@entry=0x7fff2548c700 "", anslen=anslen@entry=1024, answerp=0x7fff2548cb30, answerp2=answerp2@entry=0x0, nanswerp2=nanswerp2@entry=0x0, resplen2=resplen2@entry=0x0) at res_query.c:378 #6 0x00007fda2f2777e4 in __GI__nss_dns_gethostbyname3_r ( name=name@entry=0x7fff2548d140 "client.example.com", af=af@entry=2, result=result@entry=0x7fff2548d120, buffer=buffer@entry=0x1f33590 "\177", buflen=buflen@entry=992, errnop=errnop@entry=0x7fda3d8966a0, h_errnop=h_errnop@entry=0x7fff2548d10c, ttlp=ttlp@entry=0x0, canonp=canonp@entry=0x0) at nss_dns/dns-host.c:192 #7 0x00007fda2f277af0 in _nss_dns_gethostbyname_r ( name=0x7fff2548d140 "client.example.com", result=0x7fff2548d120, buffer=0x1f33590 "\177", buflen=992, errnop=0x7fda3d8966a0, h_errnop=0x7fff2548d10c) at nss_dns/dns-host.c:273 #8 0x00007fda39c9e163 in __gethostbyname_r ( name=name@entry=0x7fff2548d140 "client.example.com", resbuf=resbuf@entry=0x7fff2548d120, buffer=0x1f33590 "\177", buflen=buflen@entry=992, result=result@entry=0x7fff2548d118, h_errnop=h_errnop@entry=0x7fff2548d10c) at ../nss/getXXbyYY_r.c:266 #9 0x00007fda3bb1b3de in ldap_pvt_gethostbyname_a ( name=name@entry=0x7fff2548d140 "client.example.com", resbuf=resbuf@entry=0x7fff2548d120, buf=buf@entry=0x7fff2548d110, result=result@entry=0x7fff2548d118, herrno_ptr=herrno_ptr@entry=0x7fff2548d10c) at util-int.c:350 #10 0x00007fda3bb1b5d0 in ldap_pvt_get_fqdn (name=0x7fff2548d140 "client.example.com", name@entry=0x0) at util-int.c:748 #11 0x00007fda3bb19b47 in ldap_int_initialize ( gopts=gopts@entry=0x7fda3bd40000 <ldap_int_global_options>, dbglvl=dbglvl@entry=0x0) at init.c:645 #12 0x00007fda3bb1a627 in ldap_set_option (ld=0x0, option=24582, invalue=0x7fff2548d2b0) at options.c:446 #13 0x00007fda30951cf6 in setup_tls_config (basic_opts=0x1f30450) at src/providers/ldap/sdap.c:533 #14 0x00007fda308214b3 in ldap_id_init_internal (bectx=0x1f12b40, ops=0x1f12cb0, pvt_data=0x7fff2548d5e8) at src/providers/ldap/ldap_init.c:146 #15 0x00007fda30821ba0 in sssm_ldap_id_init (bectx=0x1f12b40, ops=0x1f12cb0, pvt_data=0x1f12cb8) at src/providers/ldap/ldap_init.c:199 #16 0x000000000041b227 in load_backend_module (ctx=0x1f12b40, bet_type=BET_ID, bet_info=0x1f12ca8, default_mod_name=0x0) at src/providers/data_provider_be.c:2346 #17 0x000000000041ce4c in be_process_init (mem_ctx=0x1f0ba80, be_domain=0x1f093f0 "localipaldap", ev=0x1f0a630, cdb=0x1f0bb90) at src/providers/data_provider_be.c:2520 #18 0x000000000041fde6 in main (argc=3, argv=0x7fff2548e008) at src/providers/data_provider_be.c:2743 735 /* LDAP_OPT_X_TLS_REQUIRE_CERT has to be set as a global option, 736 * because the SSL/TLS context is initialized from this value. */ 737 ret = ldap_set_option(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, 738 &ldap_opt_x_tls_require_cert); 739 if (ret != LDAP_OPT_SUCCESS) { 740 DEBUG(SSSDBG_CRIT_FAILURE, 741 "ldap_set_option failed: %s\n",sss_ldap_err2string(ret)); 742 return EIO; 743 } Thanks, -- Jan Synacek Software Engineer, Red Hat

5 7

[LMDB] Single writer question
by Alain 18 Jun '14

18 Jun '14

If my memory serves me well, at some point Howard mentioned that LMDB was looking at moving from a single environment writer to a single writer per database. Am I just dreaming or did I see that? And if I'm not dreaming then what is the status of this, as my experiment seem to show that there is no performance gain to be have by splitting your data in more than one db. Thanks Alain

2 2

back-sql on Debian testing
by Chad E. Berg 17 Jun '14

17 Jun '14

I am trying to get OpenLDAP 2.4.39 working with MySQL using back-sql to query the database for a specific application. I have spent weeks on this and I feel like I am very close. The database is for vpopmail, I realize that there is an ldap auth module for vpopmail, however it is not very well supported so I hesitate to jump to that in a production system. I have it 90% working I would say, just missing a few minor things I believe. I was able to get the OpenLDAP example includes in the docs working so I know it's something with my configuration specifically that is not correct. I would greatly appreciate if anyone could see something wrong with my setup. I have included all relevant configuration files as well as the MySQL vpopmail database information. This is the slapd.conf file: include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/inetorgperson.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args idletimeout 30 threads 32 loglevel 0xFFFF modulepath /usr/lib/ldap moduleload back_sql.la database sql suffix "dc=example,dc=com" rootdn "cn=root,dc=example,dc=com" rootpw {CRYPT}rootpassword dbname vpopmail dbuser vpopmail dbpasswd somepassword subtree_cond "ldap_entries.dn LIKE CONCAT('%',?)" has_ldapinfo_dn_ru no There is an /etc/odbc.ini file and /etc/odbcinst.ini file, but the issue is not the connection, so that should be irrelevant. When running in debug mode here is the relevant part of the console log when executing: ldapsearch -x -s sub -b "UID=ADWORDS(a)EXAMPLE.COM,DC=EXAMPLE,DC=COM" "(objectClass=*)" 5383972d slapd startup: initiated. 5383972d backend_startup_one: starting "cn=config" 5383972d config_back_db_open 5383972d config_build_entry: "cn=config" 5383972d config_build_entry: "cn=module{0}" 5383972d config_build_entry: "cn=schema" 5383972d >>> dnNormalize: <cn={0}core> 5383972d <<< dnNormalize: <cn={0}core> 5383972d config_build_entry: "cn={0}core" 5383972d >>> dnNormalize: <cn={1}cosine> 5383972d <<< dnNormalize: <cn={1}cosine> 5383972d config_build_entry: "cn={1}cosine" 5383972d >>> dnNormalize: <cn={2}inetorgperson> 5383972d <<< dnNormalize: <cn={2}inetorgperson> 5383972d config_build_entry: "cn={2}inetorgperson" 5383972d config_build_entry: "olcDatabase={-1}frontend" 5383972d config_build_entry: "olcDatabase={0}config" 5383972d config_build_entry: "olcDatabase={1}sql" 5383972d backend_startup_one: starting "dc=example,dc=com" 5383972d ==>backsql_db_open(): testing RDBMS connection 5383972d backsql_db_open(): concat func not specified (use "concat_pattern" directive in slapd.conf) 5383972d backsql_db_open(): children search SQL condition not specified (use "children_cond" directive in slapd.conf); preparing default 5383972d backsql_db_open(): setting "ldap_entries.dn LIKE CONCAT('%,',?)" as default "children_cond" 5383972d backsql_db_open(): DN match search SQL condition not specified (use "dn_match_cond" directive in slapd.conf); preparing default 5383972d backsql_db_open(): setting "ldap_entries.dn=?" as default "dn_match_cond" 5383972d backsql_db_open(): objectclass mapping SQL statement not specified (use "oc_query" directive in slapd.conf) 5383972d backsql_db_open(): setting "SELECT id,name,keytbl,keycol,create_proc,delete_proc,expect_return FROM ldap_oc_mappings" by default 5383972d backsql_db_open(): attribute mapping SQL statement not specified (use "at_query" directive in slapd.conf) 5383972d backsql_db_open(): setting "SELECT name,sel_expr,from_tbls,join_where,add_proc,delete_proc,param_order,expect_r eturn,sel_expr_u FROM ldap_attr_mappings WHERE oc_map_id=?" by default 5383972d backsql_db_open(): entry insertion SQL statement not specified (use "insentry_stmt" directive in slapd.conf) 5383972d backsql_db_open(): setting "INSERT INTO ldap_entries (dn,oc_map_id,parent,keyval) VALUES (?,?,?,?)" by default 5383972d backsql_db_open(): entry deletion SQL statement not specified (use "delentry_stmt" directive in slapd.conf) 5383972d backsql_db_open(): setting "DELETE FROM ldap_entries WHERE id=?" by default 5383972d backsql_db_open(): entry deletion SQL statement not specified (use "renentry_stmt" directive in slapd.conf) 5383972d backsql_db_open(): setting "UPDATE ldap_entries SET dn=?,parent=?,keyval=? WHERE id=?" by default 5383972d backsql_db_open(): objclasses deletion SQL statement not specified (use "delobjclasses_stmt" directive in slapd.conf) 5383972d backsql_db_open(): setting "DELETE FROM ldap_entry_objclasses WHERE entry_id=?" by default 5383972d ==>backsql_get_db_conn() 5383972d ==>backsql_open_db_handle() 5383972d <==backsql_open_db_handle() 5383972d <==backsql_get_db_conn() 5383972d ==>backsql_load_schema_map() 5383972d backsql_load_schema_map(): oc_query "SELECT id,name,keytbl,keycol,create_proc,delete_proc,expect_return FROM ldap_oc_mappings" 5383972d objectClass: id="1" name="inetOrgPerson" keytbl="vpopmail" keycol="id" create_proc="" create_keyval="" delete_proc="" expect_return="0"create_hint="" 5383972d backsql_load_schema_map(): objectClass "inetOrgPerson": keytbl="vpopmail" keycol="id" 5383972d expect_return: add=0, del=0; attributes: 5383972d objectClass: id="2" name="groupOfUniqueNames" keytbl="vpopmail" keycol="id" create_proc="" create_keyval="" delete_proc="" expect_return="0"create_hint="" 5383972d backsql_load_schema_map(): objectClass "groupOfUniqueNames": keytbl="vpopmail" keycol="id" 5383972d expect_return: add=0, del=0; attributes: 5383972d backsql_load_schema_map(): at_query "SELECT name,sel_expr,from_tbls,join_where,add_proc,delete_proc,param_order,expect_r eturn,sel_expr_u FROM ldap_attr_mappings WHERE oc_map_id=?" 5383972d backsql_oc_get_attr_mapping(): executing at_query "SELECT name,sel_expr,from_tbls,join_where,add_proc,delete_proc,param_order,expect_r eturn,sel_expr_u FROM ldap_attr_mappings WHERE oc_map_id=?" for objectClass "inetOrgPerson" with param oc_id=1 5383972d attributeType: name="cn" sel_expr="pw_gecos" from="vpopmail" join_where="" add_proc="" delete_proc="" sel_expr_u="" 5383972d backsql_oc_get_attr_mapping(): preconstructed query "SELECT pw_gecos AS cn FROM vpopmail WHERE vpopmail.id=? ORDER BY cn" 5383972d attributeType: name="givenName" sel_expr="SUBSTRING_INDEX(`pw_gecos`, ' ', 1)" from="vpopmail" join_where="" add_proc="" delete_proc="" sel_expr_u="" 5383972d backsql_oc_get_attr_mapping(): preconstructed query "SELECT SUBSTRING_INDEX(`pw_gecos`, ' ', 1) AS givenName FROM vpopmail WHERE vpopmail.id=? ORDER BY givenName" 5383972d attributeType: name="sn" sel_expr="SUBSTRING_INDEX(`pw_gecos`, ' ', -1)" from="vpopmail" join_where="" add_proc="" delete_proc="" sel_expr_u="" 5383972d backsql_oc_get_attr_mapping(): preconstructed query "SELECT SUBSTRING_INDEX(`pw_gecos`, ' ', -1) AS sn FROM vpopmail WHERE vpopmail.id=? ORDER BY sn" 5383972d attributeType: name="userPassword" sel_expr="pw_passwd" from="vpopmail" join_where="" add_proc="" delete_proc="" sel_expr_u="" 5383972d backsql_oc_get_attr_mapping(): preconstructed query "SELECT pw_passwd AS userPassword FROM vpopmail WHERE vpopmail.id=? ORDER BY userPassword" 5383972d attributeType: name="uid" sel_expr="CONCAT(pw_name,'@',pw_domain)" from="vpopmail" join_where="" add_proc="" delete_proc="" sel_expr_u="" 5383972d backsql_oc_get_attr_mapping(): preconstructed query "SELECT CONCAT(pw_name,'@',pw_domain) AS uid FROM vpopmail WHERE vpopmail.id=? ORDER BY uid" 5383972d backsql_load_schema_map("inetOrgPerson"): autoadding 'objectClass' and 'ref' mappings 5383972d backsql_oc_get_attr_mapping(): executing at_query "SELECT name,sel_expr,from_tbls,join_where,add_proc,delete_proc,param_order,expect_r eturn,sel_expr_u FROM ldap_attr_mappings WHERE oc_map_id=?" for objectClass "groupOfUniqueNames" with param oc_id=2 5383972d attributeType: name="cn" sel_expr="UNIQUE(pw_domain)" from="vpopmail" join_where="" add_proc="" delete_proc="" sel_expr_u="" 5383972d backsql_oc_get_attr_mapping(): preconstructed query "SELECT UNIQUE(pw_domain) AS cn FROM vpopmail WHERE vpopmail.id=? ORDER BY cn" 5383972d backsql_load_schema_map("groupOfUniqueNames"): autoadding 'objectClass' and 'ref' mappings 5383972d <==backsql_load_schema_map() 5383972d ==>backsql_free_db_conn() 5383972d ==>backsql_close_db_handle(0x7f9f7427da70) 5383972d <==backsql_close_db_handle(0x7f9f7427da70) 5383972d <==backsql_free_db_conn() 5383972d <==backsql_db_open(): test succeeded, schema map loaded 5383972d slapd starting 53839731 slap_listener_activate(8): 53839731 >>> slap_listener(ldap:///) 53839731 connection_get(10) 53839731 connection_get(10): got connid=1000 53839731 connection_read(10): checking for input on id=1000 ber_get_next ber_get_next: tag 0x30 len 12 contents: 53839731 op tag 0x60, time 1401132849 ber_get_next 53839731 conn=1000 op=0 do_bind ber_scanf fmt ({imt) ber: ber_scanf fmt (m}) ber: 53839731 >>> dnPrettyNormal: <> 53839731 <<< dnPrettyNormal: <>, <> 53839731 do_bind: version=3 dn="" method=128 53839731 send_ldap_result: conn=1000 op=0 p=3 53839731 send_ldap_result: err=0 matched="" text="" 53839731 send_ldap_response: msgid=1 tag=97 err=0 ber_flush2: 14 bytes to sd 10 53839731 do_bind: v3 anonymous bind 53839731 connection_get(10) 53839731 connection_get(10): got connid=1000 53839731 connection_read(10): checking for input on id=1000 ber_get_next ber_get_next: tag 0x30 len 76 contents: 53839731 op tag 0x63, time 1401132849 ber_get_next 53839731 conn=1000 op=1 do_search ber_scanf fmt ({miiiib) ber: 53839731 >>> dnPrettyNormal: <UID=ADWORDS(a)EXAMPLE.COM,DC=EXAMPLE,DC=COM> => ldap_bv2dn(UID=ADWORDS(a)EXAMPLE.COM,DC=EXAMPLE,DC=COM,0) <= ldap_bv2dn(UID=ADWORDS(a)EXAMPLE.COM,DC=EXAMPLE,DC=COM)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=ADWORDS(a)EXAMPLE.COM,dc=EXAMPLE,dc=COM)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=adwords(a)example.com,dc=example,dc=com)=0 53839731 <<< dnPrettyNormal: <uid=ADWORDS(a)EXAMPLE.COM,dc=EXAMPLE,dc=COM>, <uid=adwords(a)example.com,dc=example,dc=com> 53839731 SRCH "UID=ADWORDS(a)EXAMPLE.COM,DC=EXAMPLE,DC=COM" 2 053839731 0 0 0 ber_scanf fmt (m) ber: 53839731 filter: (objectClass=*) ber_scanf fmt ({M}}) ber: 53839731 attrs:53839731 53839731 ==> limits_get: conn=1000 op=1 self="[anonymous]" this="uid=adwords(a)example.com,dc=example,dc=com" 53839731 ==>backsql_search(): base="uid=adwords(a)example.com,dc=example,dc=com", filter="(objectClass=*)", scope=2,53839731 deref=0, attrsonly=0, attributes to load: all 53839731 ==>backsql_get_db_conn() 53839731 ==>backsql_open_db_handle() 53839731 <==backsql_open_db_handle() 53839731 <==backsql_get_db_conn() 53839731 ==>backsql_dn2id("uid=adwords(a)example.com,dc=example,dc=com") matched expected 53839731 backsql_dn2id("uid=adwords(a)example.com,dc=example,dc=com"): id_query "SELECT id,keyval,oc_map_id,dn FROM ldap_entries WHERE dn=?" 53839731 backsql_dn2id("uid=adwords(a)example.com,dc=example,dc=com"): id=adwords(a)example.com keyval=adwords(a)example.com oc_id=1 dn=UID=ADWORDS(a)EXAMPLE.COM,DC=EXAMPLE,DC=COM 53839731 <==backsql_dn2id("uid=adwords(a)example.com,dc=example,dc=com"): err=80 53839731 send_ldap_result: conn=1000 op=1 p=3 53839731 send_ldap_result: err=80 matched="" text="" 53839731 send_ldap_response: msgid=2 tag=101 err=80 ber_flush2: 14 bytes to sd 10 53839731 <==backsql_search() 53839731 connection_get(10) 53839731 connection_get(10): got connid=1000 53839731 connection_read(10): checking for input on id=1000 ber_get_next ber_get_next: tag 0x30 len 5 contents: 53839731 op tag 0x42, time 1401132849 ber_get_next 53839731 ber_get_next on fd 10 failed errno=0 (Success) 53839731 conn=1000 op=2 do_unbind 53839731 connection_close: conn=1000 sd=10\ Here is the vpopmail database structure without any LDAP tables added: -- -- Table structure for table `dir_control` -- CREATE TABLE IF NOT EXISTS `dir_control` ( `domain` char(64) NOT NULL DEFAULT '', `cur_users` int(11) DEFAULT NULL, `level_cur` int(11) DEFAULT NULL, `level_max` int(11) DEFAULT NULL, `level_start0` int(11) DEFAULT NULL, `level_start1` int(11) DEFAULT NULL, `level_start2` int(11) DEFAULT NULL, `level_end0` int(11) DEFAULT NULL, `level_end1` int(11) DEFAULT NULL, `level_end2` int(11) DEFAULT NULL, `level_mod0` int(11) DEFAULT NULL, `level_mod1` int(11) DEFAULT NULL, `level_mod2` int(11) DEFAULT NULL, `level_index0` int(11) DEFAULT NULL, `level_index1` int(11) DEFAULT NULL, `level_index2` int(11) DEFAULT NULL, `the_dir` char(160) DEFAULT NULL, PRIMARY KEY (`domain`) ) ENGINE=MyISAM DEFAULT CHARSET=latin1; -- -------------------------------------------------------- -- -- Table structure for table `lastauth` -- CREATE TABLE IF NOT EXISTS `lastauth` ( `user` char(32) NOT NULL DEFAULT '', `domain` char(64) NOT NULL DEFAULT '', `remote_ip` char(18) NOT NULL DEFAULT '', `timestamp` bigint(20) NOT NULL DEFAULT '0', PRIMARY KEY (`user`,`domain`) ) ENGINE=MyISAM DEFAULT CHARSET=latin1; -- -------------------------------------------------------- -- -- Table structure for table `relay` -- CREATE TABLE IF NOT EXISTS `relay` ( `ip_addr` char(18) NOT NULL DEFAULT '', `timestamp` char(12) DEFAULT NULL, PRIMARY KEY (`ip_addr`) ) ENGINE=MyISAM DEFAULT CHARSET=latin1; -- -------------------------------------------------------- -- -- Table structure for table `valias` -- CREATE TABLE IF NOT EXISTS `valias` ( `alias` varchar(32) NOT NULL DEFAULT '', `domain` varchar(64) NOT NULL DEFAULT '', `valias_line` text NOT NULL, KEY `alias` (`alias`,`domain`) ) ENGINE=MyISAM DEFAULT CHARSET=latin1; -- -------------------------------------------------------- -- -- Table structure for table `vlog` -- CREATE TABLE IF NOT EXISTS `vlog` ( `id` bigint(20) NOT NULL AUTO_INCREMENT, `user` varchar(32) DEFAULT NULL, `passwd` varchar(32) DEFAULT NULL, `domain` varchar(64) DEFAULT NULL, `logon` varchar(200) DEFAULT NULL, `remoteip` varchar(18) DEFAULT NULL, `message` varchar(255) DEFAULT NULL, `timestamp` bigint(20) NOT NULL DEFAULT '0', `error` int(11) DEFAULT NULL, PRIMARY KEY (`id`), KEY `user_idx` (`user`), KEY `domain_idx` (`domain`), KEY `remoteip_idx` (`remoteip`), KEY `error_idx` (`error`), KEY `message_idx` (`message`) ) ENGINE=MyISAM DEFAULT CHARSET=latin1 AUTO_INCREMENT=21403 ; -- -------------------------------------------------------- -- -- Table structure for table `vpopmail` -- CREATE TABLE IF NOT EXISTS `vpopmail` ( `pw_name` char(32) NOT NULL, `pw_domain` char(96) NOT NULL, `pw_passwd` char(40) DEFAULT NULL, `pw_uid` int(11) DEFAULT NULL, `pw_gid` int(11) DEFAULT NULL, `pw_gecos` char(48) DEFAULT NULL, `pw_dir` char(160) DEFAULT NULL, `pw_shell` char(20) DEFAULT NULL, `pw_clear_passwd` char(16) DEFAULT NULL, PRIMARY KEY (`pw_name`,`pw_domain`) ) ENGINE=InnoDB DEFAULT CHARSET=latin1; Here are the tables added to the vpopmail database with their info: -- -- Table structure for table `ldap_attr_mappings` -- CREATE TABLE IF NOT EXISTS `ldap_attr_mappings` ( `id` int(10) unsigned NOT NULL AUTO_INCREMENT, `oc_map_id` int(10) unsigned NOT NULL, `name` varchar(255) NOT NULL, `sel_expr` varchar(255) NOT NULL, `sel_expr_u` varchar(255) DEFAULT NULL, `from_tbls` varchar(255) NOT NULL, `join_where` varchar(255) DEFAULT NULL, `add_proc` varchar(255) DEFAULT NULL, `delete_proc` varchar(255) DEFAULT NULL, `param_order` tinyint(4) NOT NULL, `expect_return` tinyint(4) NOT NULL, PRIMARY KEY (`id`) ) ENGINE=InnoDB DEFAULT CHARSET=latin1 AUTO_INCREMENT=8 ; -- -------------------------------------------------------- -- -- Table structure for table `ldap_attr_mappings` -- CREATE TABLE IF NOT EXISTS `ldap_attr_mappings` ( `id` int(10) unsigned NOT NULL AUTO_INCREMENT, `oc_map_id` int(10) unsigned NOT NULL, `name` varchar(255) NOT NULL, `sel_expr` varchar(255) NOT NULL, `sel_expr_u` varchar(255) DEFAULT NULL, `from_tbls` varchar(255) NOT NULL, `join_where` varchar(255) DEFAULT NULL, `add_proc` varchar(255) DEFAULT NULL, `delete_proc` varchar(255) DEFAULT NULL, `param_order` tinyint(4) NOT NULL, `expect_return` tinyint(4) NOT NULL, PRIMARY KEY (`id`) ) ENGINE=InnoDB DEFAULT CHARSET=latin1 AUTO_INCREMENT=8 ; -- -- Dumping data for table `ldap_attr_mappings` -- INSERT INTO `ldap_attr_mappings` (`id`, `oc_map_id`, `name`, `sel_expr`, `sel_expr_u`, `from_tbls`, `join_where`, `add_proc`, `delete_proc`, `param_order`, `expect_return`) VALUES (1, 1, 'cn', 'pw_gecos', NULL, 'vpopmail', NULL, NULL, NULL, 3, 0), (2, 1, 'givenName', 'SUBSTRING_INDEX(`pw_gecos`, '' '', 1)', NULL, 'vpopmail', NULL, NULL, NULL, 3, 0), (3, 1, 'sn', 'SUBSTRING_INDEX(`pw_gecos`, '' '', -1)', NULL, 'vpopmail', NULL, NULL, NULL, 3, 0), (4, 1, 'userPassword', 'pw_passwd', NULL, 'vpopmail', NULL, NULL, NULL, 3, 0), (5, 1, 'uid', 'CONCAT(pw_name,''@'',pw_domain)', NULL, 'vpopmail', NULL, NULL, NULL, 3, 0), (7, 2, 'cn', 'UNIQUE(pw_domain)', NULL, 'vpopmail', NULL, NULL, NULL, 3, 0); -- -------------------------------------------------------- -- -- Table structure for table `ldap_entry_objclasses` -- CREATE TABLE IF NOT EXISTS `ldap_entry_objclasses` ( `entry_id` int(11) NOT NULL, `oc_name` varchar(64) DEFAULT NULL, PRIMARY KEY (`entry_id`) ) ENGINE=InnoDB DEFAULT CHARSET=latin1; -- -- Dumping data for table `ldap_entry_objclasses` -- INSERT INTO `ldap_entry_objclasses` (`entry_id`, `oc_name`) VALUES (1, 'inetOrgPerson'), (2, 'groupOfUniqueNames'); -- -------------------------------------------------------- -- -- Table structure for table `ldap_oc_mappings` -- CREATE TABLE IF NOT EXISTS `ldap_oc_mappings` ( `id` int(10) unsigned NOT NULL AUTO_INCREMENT, `name` varchar(64) NOT NULL, `keytbl` varchar(64) NOT NULL, `keycol` varchar(64) NOT NULL, `create_proc` varchar(255) DEFAULT NULL, `delete_proc` varchar(255) DEFAULT NULL, `expect_return` tinyint(4) NOT NULL, PRIMARY KEY (`id`) ) ENGINE=InnoDB DEFAULT CHARSET=latin1 AUTO_INCREMENT=5 ; -- -- Dumping data for table `ldap_oc_mappings` -- INSERT INTO `ldap_oc_mappings` (`id`, `name`, `keytbl`, `keycol`, `create_proc`, `delete_proc`, `expect_return`) VALUES (1, 'inetOrgPerson', 'vpopmail', 'id', NULL, NULL, 0), (2, 'groupOfUniqueNames', 'vpopmail', 'id', NULL, NULL, 0); This is the code used to create the ldap_entries view: CREATE VIEW ldap_entries AS SELECT CONCAT(vpopmail.pw_name,'@',vpopmail.pw_domain) AS id, UCASE(CONCAT('uid=', vpopmail.pw_name,'@',vpopmail.pw_domain, ',DC=example,DC=com')) AS dn, 1 AS oc_map_id, 0 AS parent, CONCAT(vpopmail.pw_name,'@',vpopmail.pw_domain) AS keyval FROM vpopmail UNION SELECT vpopmail.pw_domain AS id, UCASE(CONCAT( 'cn=', vpopmail.pw_domain, ',DC=example,DC=com')) AS dn, 2 AS oc_map_id, 3 AS parent, vpopmail.pw_domain AS id FROM vpopmail

2 1

bug with smbldap ldap
by rodrigo tavares 17 Jun '14

17 Jun '14

Hello people, I'm try install samba e ldap. #the site that I below is a tutorial http://www.unixmen.com/setup-samba-domain-controller-with-openldap-backend-…. My OS is ubuntu, I have some troubles smbldap CRASH. How mean this log ? Sorry, command-not-found has crashed! Please file a bug report at: https://bugs.launchpad.net/command-not-found/+filebug Please include the following information with the report: command-not-found version: 0.3 Python version: 3.3.1 final 0 Distributor ID: Ubuntu Description: Ubuntu 13.04 Release: 13.04 Codename: raring Exception information: unsupported locale setting Traceback (most recent call last): File "/usr/lib/python3/dist-packages/CommandNotFound/util.py", line 24, in crash_guard callback() File "/usr/lib/command-not-found", line 69, in main enable_i18n() File "/usr/lib/command-not-found", line 40, in enable_i18n locale.setlocale(locale.LC_ALL, '') File "/usr/lib/python3.3/locale.py", line 541, in setlocale return _setlocale(category, locale) locale.Error: unsupported locale setting

3 2

ITS #7161, ppolicy pwdFailureTime resolution should be better than 1 second
by Paul B. Henson 16 Jun '14

16 Jun '14

I realize that development discussion is supposed to go to openldap-devel, but despite having subscribed to that a month ago, none of my postings have gone through. I hear they are having some technical difficulties with that list, so for the sake of this submission not being indefinitely delayed, here it is. Attached is a proposed patch to fix ITS #7161. It uses the same method as the accesslog module to generate a subsecond generalized time, appending the o_tincr value from the operation structure as fractional seconds. The only other code that looks at the value of that attribute calls parse_time to pull seconds out of it (ignoring the fractional second part), so other than modifying the format the attribute is stored in I don't believe there are any other changes required with this.

4 24

issue with bad data ? In MMR setup
by Daniel Jung 14 Jun '14

14 Jun '14

Hi, Ldap daemon was being restarted every so many minutes. All the consumers were out of sync and had to be re-synced. This specific master in question in MMR setup was restored from other master and the issue went away. running 2.4.37 on centos6 with hdb backend on the masters and lmdb on the consumers. Searching thru the list shows a lot of hits with "too old", AFAIK ntp is kept quite closely. serverid "000" no longer exists as it was decomissioned since last year, hence contextcsn is really old. Not sure if that played a role in this havoc or not. Could you tell me what "srs" and "log" means in the context below? Following is what I found in the log, and there were a lot of these which probably contributed to restart of the daemon: Jun 14 00:05:21 name of the server slapd[16745]: srs csn 20131226183611.000000Z#000000#000#000000 Jun 14 00:05:21 name of the server slapd[16745]: log csn 20131206192447.000000Z#000000#000#000000 Jun 14 00:05:21 name of the server slapd[16745]: cmp -2, too old Jun 14 00:05:21 name of the server slapd[16745]: log csn 20131206193513.000000Z#000000#000#000000 Jun 14 00:05:21 name of the server slapd[16745]: cmp -2, too old </snip> Jun 14 00:05:59 name of the server slapd[16745]: do_syncrep2: rid=0 01 (-1) Can't contact LDAP server </snip> Jun 14 00:06:15 name of the server slapd[16745]: log csn 20131229125124.532456Z#000000#001#000000 Jun 14 00:06:15 name of the server slapd[16745]: cmp -256, too old Jun 14 00:06:15 name of the server slapd[16745]: log csn 20131229125143.680121Z#000000#001#000000 Jun 14 00:06:15 name of the server slapd[16745]: cmp -256, too old Jun 14 00:06:15 name of the server slapd[16745]: log csn 2013122913 </snip> Jun 14 00:06:59 name of the server slapd[31392]: do_syncrep2: rid=000 LDAP_RES_INTERMEDIATE - SYNC_ID_SET Jun 14 00:06:59 name of the server slapd[31392]: do_syncrep2: rid=000 cookie=rid=000,sid=002,csn=20140613220035.981531Z#000000#001#000000 Jun 14 00:06:59 name of the server slapd[31392]: do_syncrep2: rid=000 LDAP_RES_INTERMEDIATE - REFRESH_DELETE </snip> thank you

1 0

test050-syncrepl-multimaster fails on 2.4.39/mdb
by Jean Gillaux 13 Jun '14

13 Jun '14

Hello, When running test suite for openldap 2.4.39, I see test050-syncrepl-multimaster failing with mdb. Software is build with ./configure --enable-overlays Env is: lxc container 0.9.0.alpha3 running debian wheezy, gcc version 4.7.2 (Debian 4.7.2-5) Same test with hdb is ok. Here is test output: Cleaning up test run directory leftover from previous run. Running ./scripts/test050-syncrepl-multimaster for mdb... running defines.sh Initializing server configurations... Starting server 1 on TCP/IP port 9011... Using ldapsearch to check that server 1 is running... Inserting syncprov overlay on server 1... Starting server 2 on TCP/IP port 9012... Using ldapsearch to check that server 2 is running... Configuring syncrepl on server 2... Starting server 3 on TCP/IP port 9013... Using ldapsearch to check that server 3 is running... Configuring syncrepl on server 3... Starting server 4 on TCP/IP port 9014... Using ldapsearch to check that server 4 is running... Configuring syncrepl on server 4... Adding schema and databases on server 1... Using ldapadd to populate server 1... Waiting 15 seconds for syncrepl to receive changes... Using ldapsearch to read config from server 1... Using ldapsearch to read config from server 2... Using ldapsearch to read config from server 3... Using ldapsearch to read config from server 4... Comparing retrieved configs from server 1 and server 2... Comparing retrieved configs from server 1 and server 3... Comparing retrieved configs from server 1 and server 4... Using ldapsearch to read all the entries from server 1... Using ldapsearch to read all the entries from server 2... Using ldapsearch to read all the entries from server 3... Using ldapsearch to read all the entries from server 4... Comparing retrieved entries from server 1 and server 2... test failed - server 1 and server 2 databases differ The diff between 1 and 2 is: 363,388d362 < dn: cn=Manager,dc=example,dc=com < objectClass: person < cn: Manager < cn: Directory Manager < cn: Dir Man < sn: Manager < description: Manager of the directory < userPassword:: c2VjcmV0 < < dn: cn=Mark Elliot,ou=Alumni Association,ou=People,dc=example,dc=com < objectClass: OpenLDAPperson < cn: Mark Elliot < cn: Mark A Elliot < sn: Elliot < uid: melliot < postalAddress: Alumni Association $ 111 Maple St $ Anytown, MI 48109 < seeAlso: cn=All Staff,ou=Groups,dc=example,dc=com < homePostalAddress: 199 Outer Drive $ Ypsilanti, MI 48198 < homePhone: +1 313 555 0388 < drink: Gasoline < title: Director, UM Alumni Association < mail: melliot(a)mail.alumni.example.com < pager: +1 313 555 7671 < facsimileTelephoneNumber: +1 313 555 7762 < telephoneNumber: +1 313 555 4177 < 395,409d368 < < dn: cn=Ursula Hampster,ou=Alumni Association,ou=People,dc=example,dc=com < objectClass: OpenLDAPperson < cn: Ursula Hampster < sn: Hampster < uid: uham < title: Secretary, UM Alumni Association < postalAddress: Alumni Association $ 111 Maple St $ Anytown, MI 48109 < seeAlso: cn=All Staff,ou=Groups,dc=example,dc=com < homePostalAddress: 123 Anystreet $ Anytown, MI 48104 < mail: uham(a)mail.alumni.example.com < homePhone: +1 313 555 8421 < pager: +1 313 555 2844 < facsimileTelephoneNumber: +1 313 555 9700 < telephoneNumber: +1 313 555 5331 Do you have any suggestion regarding this? Thanks -- Jean

2 5

Re: AD pass through to Openladp?
by Justin Stanczak 13 Jun '14

13 Jun '14

This is probably better posted on the Kerberos list, but can Kerberos server work with AD? Meaning set up a Kerberos server (not MS) to authenticate users, and AD accepts tickets from that? On Tue, Jun 10, 2014 at 9:36 AM, Stewart Walters <stewart.walters(a)gmail.com> wrote: > Hi Justin, > > My emails don't seem to arrive to the openldap-technical list. > > But, (and please note, I've never actually done this before) you could use > a virtual LDAP directory front-end to combine portions of both AD and > OpenLDAP to provide clients with a single unified view. In theory the > client can't tell the difference between data from one or the other (though > I imagine that the theory and the practice of this is completely different, > which is why I've never attempted this). > > Such products that provide this are MyVD (http://myvd.sourceforge.net/) > and some commercial ones like RadiantOne VDS, Virtual Identity Server, > Virtual LDAP Server EE > > However all of that complicates what should be a relatively simple thing - > storing and retrieving an identity held within a directory. I wouldn't > recommend looking at virtual directories as a way forward, you're likely to > run in to bigger problems by over engineering the solution. > > I find its best to keep things simple. Either keep the OpenLDAP and AD > identities separate between the two directories, or if you have to, look > towards suggestions made by others (such as using Kerberos V5 Trusted > Realm+OpenLDAP; or Samba+OpenLDAP). > > Best of luck, > > Stewart > > >

2 1

chaining a subordinate database only?
by Marc Patermann 12 Jun '14

12 Jun '14

Hello, http://www.openldap.org/doc/admin24/overlays.html#Chaining says: "On each replica, add this near the top of the slapd.conf(5) file (global), before any database definitions" - so chaining works as a global directive for all databases in the example. I get it to work this way. But I want chaining only for a single subordinate db, not for all. I do not get this working. It behaves like there is not chaining. Is this even possible? The basic layout is like this: database mdb suffix ou=system,ou=foo subordinate database mdb suffix ou=linux,ou=foo subordinate overlay chaining overlay ppolicy database mdb suffix ou=foo ppolicy must only work for ou=linux. That is why, it is a database of its own. (Is there another way?). The ppolicy attributes should be replicated to all the slaves. As far as I understood it, I have to chain the database to the master to replicate the attributes. (Right?) Marc

1 0

Password History check in openldap
by scor z 10 Jun '14

10 Jun '14

Password History check in openldap not working when I am using SHA-256 password hashing in openldap. So I am sending clear text password from my java application to openLDAP and it is storing as SHA-256 hashed form on its own. whenever I am changing password, openLDAP is storing the previous password in pwdHistory. There is no problem in that but when I am changing password with the same password previously used it is taking up without throwing any error. I am struggling to make it work for few weeks. Please somebody help me. My environment details: OpenLDAP 2.4.38 RHEL 6 Following details also mentioned in slapd.conf include ../etc/openldap/schema/ppolicy.schema password-hash {SHA256} overlay ppolicy ppolicy_default "cn=default,ou=pwdpolicies,dc=my-domain,dc=com" ppolicy_hash_cleartext my password policy: dn: cn=Default,ou=pwdpolicies,dc=my-domain,dc=com objectClass: pwdPolicy objectClass: person objectClass: top cn: Default sn: Default pwdAttribute: userPassword pwdMinAge: 0 pwdInHistory: 5 pwdFailureCountInterval: 0 pwdLockout: TRUE pwdLockoutDuration: 0 pwdAllowUserChange: TRUE pwdExpireWarning: 0 pwdGraceAuthNLimit: 0 pwdMustChange: FALSE pwdSafeModify: FALSE Kindly let me know if I have to give me more information to nail down the issue. Please Please Please someone help me on this. I am badly need a solution on this.

3 2

Re: AD pass through to Openladp?
by Justin Stanczak 10 Jun '14

10 Jun '14

I want to keep the password part in the current LDAP so we don't have to do a mass reset for all parties. And I didn't want to move the LDAP to an MS product. Thanks for the information. On Fri, Jun 6, 2014 at 8:08 PM, Stewart Walters <stewart.walters(a)gmail.com> wrote: > Just spit balling here, because I'm not exactly sure I completely > understand your usage scenario. > > You say you want AD to use OpenLDAP as the authentication source, I > presume so that Windows workstation logins can authenticate against an > identity in OpenLDAP? > > If Group Policy/File and Printer management and other aspects of AD aren't > hugely important to the control and management of your workstation fleet, > you could deploy pGina (pgina.org) to every workstation. pGina will > replace the windows Ctrl + Alt + Del style login screen with one that will > allow users to authenticate directly to an identity in OpenLDAP. > > If that's not your scenario (or if you need the Group Policy/File and > Print stuff), as Peter correctly asserts - Samba 3/4 can be used as a drop > in replacement for AD. It can also be configured to use Kerberos and > OpenLDAP on the backend to control identity and authentication. Without > having to learn Samba (which by extension, often requires you to know low > level concepts of AD itself), you could also consider a FreeIPA deployment > which may or may not assist with simplifying the configuration of Samba4. > > Another way would be to use an IDAM product such as Microsoft Forefront > Identity Manager (or the Quest or NetIQ equivalents) to replicate > user identities and passwords in AD over to OpenLDAP (and vice versa). I > suspect however that an IDAM project is probably too over-engineered/too > expensive for your needs. > > Hope that helps, > > Stewart > > >

1 0

LMDB and multiple processes
by Brian G. Merrell 08 Jun '14

08 Jun '14

Hi all, First, I'm having trouble finding resources to answer a question like this myself, so please forgive me if I've missed something. I'm considering using LMDB (versus LevelDB) for a project I'm working on where I'll be receiving a high volume (hundreds per second) of high priority requests (over HTTP) and issuing multiple (<10) database queries per request. I'll also have a separate process receiving updates for the data and writing to the database. This will happen often (several times a minute, perhaps), but the priority is much lower than the read requests. LMDB appealed to me because of the read performance and that I could have one processing reading data from LMDB and another process writing data updates to LMDB. For proof of concept, I hacked up the following (I'll use pseudocode since I used the Go bindings for my actual programs, and hopefully my question is sufficiently abstract not to matter): Process 1, the writer, simply writes a random integer (from 0 to 1000) to a defined set of keys: env = NewEnv() env.Open("/tmp/foo", 0, 0664) txn = env.BeginTxn(nil, 0) dbi = txn.DBIOpen(nil, 0) txn.Commit() txn = env.BeginTxn(nil, 0) n_entries = 5 for i = 0; i < n_entries; i++ { key = sprintf("Key-%d", i) val = sprintf("Val-%d", rand.Int(1000)) txn.Put(dbi, key, val, 0) } txn.Commit() env.DBIClose(dbi) env.Close() Process 2, the reader, simply loops forever and does random access reads on the data from process 1 (I won't benefit from a cursor for my actual problem), and prints out that data occasionally: env = NewEnv() env.Open("/tmp/foo", 0, 0664) while { txn = BeginTxn(nil, 0) dbi = txn.DBIOpen(nil, 0) txn.Commit() for i = 0; i < n_entries; i++ { key = sprintf("Key-%d", i) val = txn.Get(dbi, key) print("%s: %s", key, value) } env.DBIClose(dbi) sleep(5) } So my high level question is: What am I doing wrong? This seems to work OK, but a lot of it was guesswork, so I'm sure I'm doing some silly things. For example, first I put the BeginTxn() and DBIOpen() calls in process 2 outside of the while loop, but when I did that, I never saw the updates values upon running process 1 simultaneously. In my real-world application, it seems like adding these calls to every request (to be sure the data being read is up-to-date) could be an unnecessary performance penalty. I was suspect there are flags that I can/should be using, but I'm not sure. Thanks for any input. Brian

2 6

Problems using StartTls with openldap-2.4.31
by Andrei Cipu 07 Jun '14

07 Jun '14

Hi all, I'm using openldap-2.4.31 compiled with gnutls25 on Rapsbmc (pre-compiled by the distribution) and I'm trying to make ldap+StartTls work with ldapsearch (simple ldap:// works like a charm). After hitting the issue described at [1] , I've decided to use a self-signed CA cert generated with certtool, as described in [2]. This allowed me to establish the TLS connection. However, the client still sends the bind in clear text, then the server closes the connection. The slapd.conf file is below (comments stripped; the client has the same CACert and cipher suites): > include /etc/ldap/schema/core.schema > include /etc/ldap/schema/cosine.schema > include /etc/ldap/schema/nis.schema > include /etc/ldap/schema/inetorgperson.schema > include /etc/ldap/schema/samba.schema > > pidfile /var/run/slapd/slapd.pid > > argsfile /var/run/slapd/slapd.args > > loglevel -1 > > modulepath /usr/lib/ldap > moduleload back_hdb > > sizelimit 500 > > tool-threads 1 > > TLSCACertificateFile /etc/ldap/certs/selfsign/ca-cert.pem > TLSCertificateKeyFile /etc/ldap/certs/selfsign/key.pem > TLSCertificateFile /etc/ldap/certs/selfsign/cert.pem > TLSCipherSuite NONE:+VERS-TLS1.2:+VERS-TLS1.1:+VERS-TLS1.0:+COMP-ALL:+AES-256-CBC:+CAMELLIA-256-CBC:+RSA:+SHA1:+SHA256 > TLSVerifyClient never The client output: > root@argyle:/home/pi# ldapsearch -x -H ldap://127.0.0.1 -Z -b 'dc=strainu,dc=ro' -Dcn=admin,dc=strainu,dc=ro -w bla > ldap_start_tls: Connect error (-11) > additional info: (unknown error code) > ldap_result: Can't contact LDAP server (-1) And finally the server output: > root@argyle:/etc/ldap# /usr/sbin/slapd -g openldap -u openldap -f /etc/ldap/slapd.conf -d -1 > 53923fb1 @(#) $OpenLDAP: slapd (Apr 24 2013 17:35:25) $ buildd@build07.raspbian.lan:/build/openldap-nxJLrU/openldap-2.4.31/debian/build/servers/slapd > ldap_pvt_gethostbyname_a: host=argyle, r=0 > 53923fb1 daemon_init: <null> > 53923fb1 daemon_init: listen on ldap:/// > 53923fb1 daemon_init: 1 listeners to open... > ldap_url_parse_ext(ldap:///) > 53923fb1 daemon: listener initialized ldap:/// > 53923fb1 daemon_init: 2 listeners opened > ldap_create > 53923fb1 slapd init: initiated server. > > [...] > > 53923ffe connection_read(12): unable to get TLS client DN, error=49 id=1000 > 53923ffe conn=1000 fd=12 TLS established tls_ssf=256 ssf=256 > 53923ffe daemon: activity on 1 descriptor > 53923ffe daemon: activity on:53923ffe > 53923ffe daemon: epoll: listen=6 active_threads=0 tvp=zero > 53923ffe daemon: epoll: listen=7 active_threads=0 tvp=zero > 53923ffe daemon: activity on 1 descriptor > 53923ffe daemon: activity on:53923ffe 12r53923ffe > 53923ffe daemon: read active on 12 > 53923ffe connection_get(12) > 53923ffe connection_get(12): got connid=1000 > 53923ffe connection_read(12): checking for input on id=1000 > ber_get_next > tls_read: want=5, got=5 > 0000: 30 33 02 01 02 03... > ldap_read: want=8 error=Success > 53923ffe ber_get_next on fd 12 failed errno=0 (Success) > 53923ffe connection_read(12): input error=-2 id=1000, closing. > 53923ffe connection_closing: readying conn=1000 sd=12 for close > 53923ffe connection_close: conn=1000 sd=12 > 53923ffe daemon: removing 12 > tls_write: want=53, written=53 > 0000: 15 03 03 00 30 c2 bb c0 ae 12 fa 04 27 45 11 6e ....0.......'E.n > 0010: d7 08 20 97 49 59 0b 35 c5 77 2d b5 65 a0 97 a4 .. .IY.5.w-.e... > 0020: b0 3a eb aa b1 e7 71 8b 3e 0c 73 60 e3 9b 66 8c .:....q.>.s`..f. > 0030: f8 94 e0 c6 50 ....P > 53923ffe daemon: epoll: listen=6 active_threads=0 tvp=zero > 53923ffe daemon: epoll: listen=7 active_threads=0 tvp=zero > 53923ffe daemon: activity on 1 descriptor > 53923ffe daemon: activity on:53923ffe > 53923ffe daemon: epoll: listen=6 active_threads=0 tvp=zero > 53923ffe daemon: epoll: listen=7 active_threads=0 tvp=zero > 53923ffe conn=1000 fd=12 closed (connection lost) As you can see, the server declares the TLS established, then tries to read something, receives 5 bytes which indicates the ldap protocol (I believe), then comes the part I can't decode: > ldap_read: want=8 error=Success > 53923ffe ber_get_next on fd 12 failed errno=0 (Success) > 53923ffe connection_read(12): input error=-2 id=1000, closing. What's with the "failed errno=0" and why does the server close the connection? What should I change in the config to make it work? If you need any more information I'll provide it - I selected the part that seemed relevant to me. Thank a lot for any ideas, Andrei [1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737921#25 [2] http://www.gnutls.org/manual/html_node/certtool-Invocation.html

2 1

AD pass through to Openladp?
by Justin Stanczak 07 Jun '14

07 Jun '14

Is there a method of connecting Active Directory to use OpenLDAP as the authentication source. So pass through to OpenLDAP. Making OpenLDAP the primary system with all the passwords and usernames. I realize this might be more of a AD question, but the places I've looked seem to always make AD the primary. Then everyone else must proxy to AD. Thanks.

4 6

back_meta does not like my LDAP_MATCHING_RULE_IN_CHAIN filter
by Charles Bueche 06 Jun '14

06 Jun '14

Hi, I'm running the latest openldap stable 2.4.39 on Ubuntu. My openldap server is configured as a LDAP proxy to MS-AD using back-meta. It works nicely, as long as I don't use OID in filters. Specifically, I need LDAP_MATCHING_RULE_IN_CHAIN (http://msdn.microsoft.com/en-us/library/aa746475(v=vs.85).aspx) to search recursive groups in MS-AD. If I use that special filter directly against AD, I get my group list. filter='(memberOf:1.2.840.113556.1.4.1941:=cn=ls-msp-app1,OU=App,DC=ad,DC=stuff,DC=ch)' Or if I use a "normal" filter across my proxy, I get my group list as well. filter='(memberOf=cn=gs-msp-report,OU=Customers,DC=ad,DC=stuff,DC=ch)' BROKEN: If I use the special filter across my LDAP proxy's back-meta, I get no results and filter="(?=undefined)" in my debug log. filter='(memberOf:1.2.840.113556.1.4.1941:=cn=ls-msp-app1,OU=App,DC=ad,DC=stuff,DC=ch)' So my guess is that my filter syntax with OID is not accepted by back-meta. When using -d -1, I see this: ... 538dd110 begin get_filter 538dd110 EXTENSIBLE ... 538dd110 end get_filter 0 538dd110 filter: (?=undefined) ... I have looked at the code of openldap-2.4.39/servers/slapd/filter.c but I don't really see what's wrong. Help very welcome ! Charles

4 11

LDAP Proxy Timeout Values
by Jack Kielsmeier 05 Jun '14

05 Jun '14

Hello, We are running OpenLDAP 2.4.23. Part of our implementation proxies to an Active Directory server. Whenever connectivity to the AD server is interrupted, queries to the non-proxied portion of our implementation take a very long time and cause many issues with querying services. I have been looking at timeout options for both slapd.conf and ldap.conf and I have found the following: ldap.conf: NETWORK_TIMEOUT <integer> Specifies the timeout (in seconds) after which the poll(2)/select(2) following a connect(2) returns in case of no activity. TIMEOUT <integer> Specifies a timeout (in seconds) after which calls to synchronous LDAP APIs will abort if no response is received. Also used for any ldap_result(3) calls where a NULL timeout parameter is supplied. slapd.conf: idletimeout <integer> Specify the number of seconds to wait before forcibly closing an idle client connection. A idletimeout of 0 disables this feature. The default is 0. You may also want to set the writetimeout option. writetimeout <integer> Specify the number of seconds to wait before forcibly closing a connection with an outstanding write. This allows recovery from various network hang conditions. A writetimeout of 0 disables this feature. The default is 0. I am wondering which timeout values would be best to set in order to speed up queries when proxy connectivity is interrupted. Perhaps there is something else wrong with our config that is causing this issue. Our ldap.conf file is basically empty (so, using all default) Our slapd.conf looks something like this (heavily edited to remove specific info): ##########BEGIN SLAPD.CONF########## include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/samba3.schema include /etc/openldap/schema/lockfile.schema include /etc/openldap/schema/yast.schema include /etc/openldap/schema/ldap2dns.schema include /etc/openldap/schema/radius.schema include /etc/openldap/schema/mail.schema loglevel 256 allow bind_v2 sasl-host [REMOVED] sasl-realm [REMOVED] pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args modulepath /usr/lib64/openldap moduleload rwm tool-threads 2 #TLSCipherSuite HIGH:MEDIUM:+SSLv2 #TLSCACertificatePath /etc/ssl/certs/ #TLSCertificateFile [REMOVED] #TLSCertificateKeyFile [REMOVED] #TLSVerifyClient demand access to attrs=[REMOVED] by anonymous [REMOVED] by * [REMOVED] access to attrs=[REMOVED] by * [REMOVED] access to [REMOVED] by * [REMOVED] access to [REMOVED] by * [REMOVED] database [REMOVED] suffix "[REMOVED]" checkpoint 20480 5 cachesize 100000 directory [REMOVED] dbconfig set_cachesize 0 268435456 1 dbconfig set_lg_max 268435456 dbconfig set_lg_bsize 16777216 dbconfig set_lk_max_objects 5000 dbconfig set_lk_max_locks 5000 dbconfig set_lk_max_lockers 50000 dbconfig set_flags DB_LOG_AUTOREMOVE index [REMOVED] index [REMOVED] index [REMOVED] rootdn [REMOVED] rootpw [REMOVED] syncrepl rid=[REMOVED] provider=[REMOVED] type=refreshAndPersist retry="300 +" searchbase="[REMOVED]" filter="(objectClass=*)" sizelimit="unlimited" timelimit="unlimited" scope=sub schemachecking=off bindmethod=simple binddn="[REMOVED]" credentials=[REMOVED] database [REMOVED] suffix "[REMOVED]" checkpoint 20480 5 cachesize 100000 directory [REMOVED] dbconfig set_cachesize 0 268435456 1 dbconfig set_lg_max 268435456 dbconfig set_lg_bsize 16777216 dbconfig set_lk_max_objects 5000 dbconfig set_lk_max_locks 5000 dbconfig set_lk_max_lockers 50000 dbconfig set_flags DB_LOG_AUTOREMOVE index [REMOVED] index [REMOVED] index [REMOVED] rootdn "[REMOVED]" rootpw [REMOVED] syncrepl [REMOVED] provider=[REMOVED] type=refreshAndPersist retry="300 +" searchbase="[REMOVED]" filter="(objectClass=*)" sizelimit="unlimited" timelimit="unlimited" scope=sub schemachecking=off bindmethod=simple binddn="[REMOVED]" credentials=[REMOVED] database ldap suffix "[REMOVED]" uri "ldap:// [REMOVED]" uri "ldap:// [REMOVED]" rebind-as-user lastmod off chase-referrals yes acl-bind bindmethod=simple binddn="[REMOVED]" credentials="[REMOVED]" idassert-bind bindmethod=simple binddn="[REMOVED]" credentials="[REMOVED]" mode=none flags=prescriptive idassert-authzFrom "dn.regex:.*" overlay rwm rwm-map attribute [REMOVED] rwm-map attribute [REMOVED] rwm-map attribute [REMOVED] rwm-map attribute [REMOVED] rwm-map attribute [REMOVED] rwm-map attribute [REMOVED] rwm-map objectclass [REMOVED] rwm-map objectclass [REMOVED] database [REMOVED] ##########END SLAPD.CONF########## Thank You

3 10

Getting the list of members in an AD group
by Sankar P 04 Jun '14

04 Jun '14

Hi, I have the SID of an AD group. I want to get the list of members who belong to that group. All the documentation page that I search for points me to the reverse only (i.e., getting all the groups membership information of a user). Can someone show me to the relevant way to get the users who belong to a group whose SID I have ? Thanks. -- Sankar P http://psankar.blogspot.com

6 15

ACL inconsistency
by John Alex. 04 Jun '14

04 Jun '14

Hi all, I use the following rules in my configuration: olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=extern al,cn=auth" manage by * break olcAccess: {1}to dn.one="ou=people,dc=xmpl,dc=co" filter="(pwdReset=TRUE)" a ttrs=userPassword by * none olcAccess: {2}to dn.subtree="ou=people,dc=xmpl,dc=co" by dn.base="cn=radius, ou=admins,dc=xmpl,dc=co" read by * break olcAccess: {3}to attrs=userPassword by anonymous auth olcAccess: {4}to dn.base="dc=xmpl,dc=co" by * read olcAccess: {5}to dn.subtree="ou=people,dc=xmpl,dc=co" by * read I have issues with rule {1} which I have set in order to disallow ldap bind and radius authentication from users whose password has been reset. I found out that this rule works when I request all attributes of a matching entry (uid=jdoe,ou=people,dc=xmpl,dc=co), but if I request specifically the attribute userPassword, its value is returned as if this rule did not exist: % ldapsearch -H ldapi:/// -D "cn=radius,ou=admins,dc=xmpl,dc=co" -W -x -b "ou=people,dc=xmpl,dc=co" "uid=jdoe" # extended LDIF # # LDAPv3 # base <ou=people,dc=xmpl,dc=co> with scope subtree # filter: uid=jdoe # requesting: ALL # # jdoe, people, xmpl.co dn: uid=jdoe,ou=people,dc=xmpl,dc=co objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person objectClass: top cn: John Doe sn: Doe uid: jdoe # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 % ldapsearch -H ldapi:/// -D "cn=radius,ou=admins,dc=xmpl,dc=co" -W -x -b "ou=people,dc=xmpl,dc=co" "uid=jdoe" "userPassword" # extended LDIF # # LDAPv3 # base <ou=people,dc=xmpl,dc=co> with scope subtree # filter: uid=jdoe # requesting: userPassword # # jdoe, people, xmpl.co dn: uid=jdoe,ou=people,dc=xmpl,dc=co userPassword:: dGVzdDEyMw== # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 ------------------------------------------ slapacl shows it should be ok in any case: % slapacl -F /usr/local/etc/openldap/slapd.d/ -v -D "cn=radius,ou=admins,dc=xmpl,dc=co" -b "uid=jdoe,ou=people,dc=xmpl,dc=co" authcDN: "cn=radius,ou=admins,dc=xmpl,dc=co" entry: read(=rscxd) children: read(=rscxd) objectClass=inetOrgPerson: read(=rscxd) objectClass=organizationalPerson: read(=rscxd) objectClass=person: read(=rscxd) objectClass=top: read(=rscxd) structuralObjectClass=inetOrgPerson: read(=rscxd) entryUUID=e959dfb8-76b6-1033-8972-4b1922a532ac: read(=rscxd) creatorsName=cn=admin,dc=xmpl,dc=co: read(=rscxd) createTimestamp=20140523111245Z: read(=rscxd) cn=John Doe: read(=rscxd) sn=Doe: read(=rscxd) uid=jdoe: read(=rscxd) userPassword=****: none(=0) pwdChangedTime=20140602101409Z: read(=rscxd) pwdReset=TRUE: read(=rscxd) entryCSN=20140602101723.590271Z#000000#000#000000: read(=rscxd) modifiersName=cn=admin,dc=xmpl,dc=co: read(=rscxd) modifyTimestamp=20140602101723Z: read(=rscxd) % slapacl -F /usr/local/etc/openldap/slapd.d/ -v -D "cn=radius,ou=admins,dc=xmpl,dc=co" -b "uid=jdoe,ou=people,dc=xmpl,dc=co" userPassword/read authcDN: "cn=radius,ou=admins,dc=xmpl,dc=co" read access to userPassword: DENIED ------------------------------------------ If I change the rule and keep just the filter or the attribute, like: olcAccess: {1}to dn.one="ou=people,dc=xmpl,dc=co" filter="(pwdReset=TRUE)" b y * none OR olcAccess: {1}to dn.one="ou=people,dc=xmpl,dc=co" attrs=userPassword by * no ne then it seems to work ok in all cases. # /usr/local/libexec/slapd -V @(#) $OpenLDAP: slapd 2.4.39 (May 9 2014 09:26:03) $ root@xmpl.co:/usr/ports/net/openldap24-server/work/openldap-2.4.39/servers/slapd Am I doing something wrong or is this a bug? Thanks in advance, John

2 2

ldapsearch utf-8 results
by Nicolas Cauchie 01 Jun '14

01 Jun '14

Hello there I use a Debian 7.4 server with ldapsearch to search data about users on an Active Directory database. When a result of a search contains specials characters (such as é, è, à), no result is given, but if I delete special characters to the user profile, it works. How could I make it work with special caracters (guess it's a UTF-8 problem ?) ? Thanks in advance Nicolas -- signature -----

5 6

Incremental ACLs somehow do not work
by Dominik George 31 May '14

31 May '14

Hi, I have these ACLs in place: olcAccess: {0}to dn.base="dc=teckids,dc=org" by group.exact="cn=ldapadmin,ou=Groups,dc=teckids,dc=org" manage by dn="cn=admin,dc=teckids,dc=org" manage by self read continue by * auth break olcAccess: {1}to dn.base="ou=Mailinglists,dc=teckids,dc=org" by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read continue by * break olcAccess: {2}to attrs=userPassword,shadowLastChange,loginShell by self write continue by anonymous auth continue by * break olcAccess: {3}to dn.subtree="ou=People,dc=teckids,dc=org" attrs=cn,uid,loginShell,homeDirectory,uidNumber,gidNumber,gecos by dn="cn=nslcd,dc=teckids,dc=org" read continue by * break olcAccess: {4}to dn.subtree="ou=People,dc=teckids,dc=org" attrs=uid,mailLocalAddress,mailRoutingAddress by dn="cn=postfix,dc=teckids,dc=org" read continue by * break olcAccess: {5}to dn.subtree="ou=Members,ou=People,dc=teckids,dc=org" attrs=employeeNumber by dn.subtree="ou=Board,ou=Members,ou=People,dc=teckids,dc=org" read continue by * none stop olcAccess: {6}to dn.subtree="ou=Members,ou=People,dc=teckids,dc=org" by dn.subtree="ou=Members,ou=People,dc=teckids,dc=org" read continue by * break olcAccess: {7}to dn.subtree="ou=Groups,dc=teckids,dc=org" by dn="cn=nslcd,dc=teckids,dc=org" read continue by * break olcAccess: {8}to dn.subtree="ou=Domains,dc=teckids,dc=org" by dn="cn=postfix,dc=teckids,dc=org" read continue by * break olcAccess: {9}to attrs=cn,uid,userPassword by * auth break But still, even a simple bind fails because it somehow does not get the auth privileges defined in the first stanza. The ACL log says: http://paste.ubuntu.com/7544324/ What did I miss? Cheers, Nik

2 2

Req for How to configure LMDB Database as backend
by Varadharajan S 30 May '14

30 May '14

I'm attempting to setup OpenLDAP 2.4.39 on Ubuntu 14.04 LTS and am getting lost on how to switch from the default hdb/bdb backend to mdb. On http://www.openldap.org/doc/admin24/backends.html#Overview in the 11.4. LMDB section it states: 11.4.2. back-mdb Configuration Unlike the HDB/BDB backends, the mdb backend can be instantiated with very few configuration lines: include ./schema/core.schema database mdb directory ./mdb suffix "dc=example,dc=com" rootdn "cn=mdb,dc=example,dc=com" rootpw mdb maxsize 1073741824 However it doesn't state where to make these entries. After installing OpenLDAP through dpkg or apt-get, I have an /etc/ldap/slapd.d/cn=config directory, which contains a file named olcDatabase={1}hdb.ldif. A grep of the directory returns other files containing various entries referencing hdb. Can anyone advise or provide a link on how to remove the hdb/bdb database configurations and how to use mdb? I've been googling the better part of this morning and while I have found a few howto's and guide's, they all just have bits of "do this" with no specification of where to do it or in what file. Or am I just missing something in general? Also, even if i try to reconfigure through #dpkg-reconfigure slapd doesn't ask while in the database selection ? It's having option to select bdb or hdb only.In our organization we are using 389 DS already and once we saw this LMDB feature in openldap, we are planning to migrate slapd.But while starting itself, we are struck.Please help us on the same.If possible include the clear configurarion steps in the official doc. Regards, Varad

4 6

Quick question re: memberOf and refInt overlays
by Mark Cairney 30 May '14

30 May '14

Hi, I suspect the answer is going to turn out to be blindingly obvious but I noticed this when reviewing my config of the 2 overlays mentioned and I thought this looked a little bit odd: dn: olcOverlay={1}memberof,olcDatabase={1}hdb,cn=config objectClass: olcMemberOf objectClass: olcOverlayConfig olcOverlay: {1}memberof olcMemberOfDangling: ignore olcMemberOfGroupOC: groupOfNames olcMemberOfMemberAD: member olcMemberOfMemberOfAD: memberOf olcMemberOfRefInt: TRUE dn: olcOverlay={3}refint,olcDatabase={1}hdb,cn=config objectClass: olcConfig objectClass: olcOverlayConfig objectClass: olcRefintConfig objectClass: top olcOverlay: {3}refint olcRefintAttribute: member olcRefintAttribute: memberOf So I have olcMemberOfRefint set to TRUE in the memberOf overlay and olcRefintAttribute: memberOf set in the refint overlay. Is this correct or should it only be defined in one of these overlays? If it is defined in both overlays as it currently is, can this cause issues such as contention/deadlocking as there are 2 overlays essentially trying to do the same thing. Or does it not actually matter? I'm using an HDB backend just in case that makes any difference. Kind regards, Mark -- /**************************** Mark Cairney ITI UNIX Section Information Services University of Edinburgh Tel: 0131 650 6565 Email: Mark.Cairney(a)ed.ac.uk *******************************/ The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336.

1 0

On-disk-format of back-mdb depends on LDAP syntax?
by Michael Ströder 29 May '14

29 May '14

HI! Does the on-disk-format of back-mdb depends on which LDAP syntax is used for an attribute? So if the LDAP syntax for an an existing attribute would change I have to reimport the MDB? Background: I've changed (as a work-around for a broken client software) the LDAP syntax of a custom attribute from Boolean to IA5String. After that I could still read the attribute. But when deleting the attribute slapd returned noSuchAttribute(16). I had to remove the whole entry. BTW: No index configured this attribute. Ciao, Michael.

2 3

Making sure this is a real issue before I submit it
by Mark Henning 29 May '14

29 May '14

Good Afternoon, I am in the process of building an LDAP schema which has a number of attributes which will be constrained to specific values. I have run into an issue where slaptest will build the ldif file without syntax errors, but when slapd starts up it can't find the X-ENUM syntax defined in the same file. # service slapd start Checking configuration files for slapd: [FAILED] olcAttributeTypes: value #0 olcAttributeTypes: Syntax not found: "1.3.6.1.4.1.39235.2.3.500" config error processing cn={5}test,cn=schema,cn=config: olcAttributeTypes: Syntax not found: "1.3.6.1.4.1.39235.2.3.500" slaptest: bad configuration file! [root@DNEAA18S2 openldap]# slapd -V @(#) $OpenLDAP: slapd 2.4.23 (Jan 28 2014 09:30:02) $ mockbuild(a)x86-022.build.eng.bos.redhat.com: /builddir/build/BUILD/openldap-2.4.23/openldap-2.4.23/build-servers/servers/slapd I have simplified the problem to a single syntax, attribute and object class. The .schema file and resulting ldif are attached. Is this a legitimate issue to report, or have I made some subtle syntax / contextual error that is preventing the attribute from finding the syntax? Cordially, -Mark Henning

2 1

Use active directory to check password but keep all user data in LDAP
by Mattias Segerdahl 28 May '14

28 May '14

Hello, I was wondering if it is possible to configure OpenLDAP 2.4 to only check the password validation with Active Directory and have the rest of the user attributes, such as mail, loginShell, homeDirectory, etc. come from OpenLDAP? Any pointers, guides, howto’s or even “let me google that for you” are highly appreciated. Cheers Mattias

5 4

RDN
by Artur Nike 28 May '14

28 May '14

Hi all, Is the suffix dc=example,dc=com in tree is a valid rdn ? and whether the drawing http://www.zytrax.com/books/ldap/ch2/dit-dn-rdn.pngis correct? Regards Mariusz

5 6

Fwd: Re: ldapsearch utf-8 results
by Nicolas Cauchie 27 May '14

27 May '14

Le 26/05/2014 10:02, Matthias Apitz a écrit : > El día Monday, May 26, 2014 a las 09:18:38AM +0200, Nicolas Cauchie escribió: > >> Hello there >> I use a Debian 7.4 server with ldapsearch to search data about users >> on an Active Directory database. >> When a result of a search contains specials characters (such as é, >> è, à), no result is given, but if I delete special characters to the >> user profile, it works. >> How could I make it work with special caracters (guess it's a UTF-8 >> problem ?) ? >> Thanks in advance >> Nicolas > Hi Nicolas, > > Are you sure that no results are returned? Can you show the output of a > ldapsearch cmd-line tool? I saw that in the result values are encoded if > they contain non ASCII chars. > > matthias Yes, I wrote it in a previous answer. The result is base64 encoded if "-t" switch is not used, or sent to a temp file if this switch is used. But in both cases, I can't use the result "as is" without another manipulation, but i'm stuck.. Thanks signature -----

4 5

New LDAP installation ?
by Michael Maymann 27 May '14

27 May '14

Hi List, I'm new to setting up LDAP so please be nice... :) I would like to achieve: - SingleSignOn using AD username/password on my Linux servers (currently we are running NIS) - use strong encryption (very least no username/passwords in clear text) - be able to keep current NIS uid/gid(s) - use autofs on my linux servers - For my purpose - would I need to populate/maintain a LDAP tree or would other tools e.g. winbind be sufficient ? - Does anyone have experience with puppet module torian-ldap that could give an example of their manifest ? Thanks in advance :) ! Br. ~maymann

1 0

Locale dependent collation for server side sorting
by Jonas Israelsson 26 May '14

26 May '14

Greetings. We have some challenges regarding Server Side Sorting, where is does not really sort the way we want it to. In UTF-8 the character Ä/ä (c3 85/c3 a4) comes before Å/å (c3 84/c3 a5) whereas in our (swedish) alphabetic order it should be the other way around. Server Side Sorting seem to blindly fall back on the sorting order of UTF-8 isrjo@svarde:~> ldapsearch -E 'sss=sn:caseIgnoreOrderingMatch' -x -H ldaps://myserver:636 -D uid=myuser,ou=applications,o=myorg -w mypass -b ou=people,o=myorg -s sub gn=sortme sn gn description # extended LDIF # # LDAPv3 # base <ou=people,o=myorg> with scope subtree # filter: gn=sortme # requesting: sn gn description # with server side sorting control # # angla, people, Myorg dn:uid=angla,ou=people,o=Myorg givenName: sortme sn:: w4RuZ2x1bmQ= description: SN BEGINNING WITH LATIN CAPITAL LETTER A WITH DIAERESIS # 19f98ab4-7beb-4703-82ec-df970944ef30, people, Myorg dn: cn=19f98ab4-7beb-4703-82ec-df970944ef30,ou=people,o=Myorg sn:: w4VrZXNzb24= givenName: sortme description: SN BIGGING WITH LATIN CAPITAL LETTER A WITH RING ABOVE # search result search: 2 result: 0 Success control: 1.2.840.113556.1.4.474 false MAMKAQA= sortResult: (0) Success # numResponses: 3 # numEntries: 2 I fail in openldap to find any matching rule or any other way such as setting the locale before starting the slapd daemon that changes the sorting order. Does anyone know if it is possible to specify a locale dependent collation for server side sorting? Rgds Jonas

3 4

Fwd: Re: ldapsearch utf-8 results
by Nicolas Cauchie 26 May '14

26 May '14

Le 26/05/2014 09:51, Howard Chu a écrit : > Nicolas wrote: >>> Hello there >>> >>> I use a Debian 7.4 server with ldapsearch to search data about users >>> on an >>> Active Directory database. >>> >>> When a result of a search contains specials characters (such as é, >>> è, à), no >>> result is given, but if I delete special characters to the user >>> profile, it >>> works. >>> >>> How could I make it work with special caracters (guess it's a UTF-8 >>> problem ?) ? >>> >>> Thanks in advance >>> >>> Nicolas >>> -- >>> signature ----- >>> >>> >>> >> No one could help me ? > > Sounds like a question for Microsoft. The OpenLDAP ldapsearch command > prints out whatever data it receives from the remote server. If the > remote server isn't sending you what you expect, then get help from > that server's support team. > Hello, (including others users reply) I just found one thing (obviously, you know it, not me...): - When a result containing specials caracters and when I use "-t" switch, my result is sent to a file under /tmp folder : the result is well-readable, with every accent everywhere they should be : it fits me. - When a result containing specials caracters and when I don't use "-t" switch, the result is base64 encoded. So, I have 2 solutions : - Read the /tmp/*.file and export the content to my scripts variable, but I can't guess the name of this file : for example, there's the name of a company's user search : "ldapsearch-company-_8K2vOo_" - Decode the result wich was base64 encoded, but I can't guess if the result will contain special caracter or not. And if i decode a string wich doesn't contain special caracters, it crashes, telling me it's not base64 content... What must I do ? Thanks a lot guys Nicolas

1 0

posixgroups vs groupofnames
by Doug OLeary 26 May '14

26 May '14

Hey; Here's the end goal: Have the ability to have posixgroup style support for gid <-> group_name translation and the ability to use memberof style searches without data duplication. In short: # ldapsearch -xLLL -s sub '(uid=doleary)' memberof dn: uid=doleary,ou=users,dc=oci,dc=com memberOf: cn=infra,ou=groups,dc=oci,dc=com memberOf: cn=ldap-Administrators,ou=groups,dc=oci,dc=com memberOf: cn=infosec,ou=groups,dc=oci,dc=com memberOf: cn=dba,ou=groups,dc=oci,dc=com and # groups doleary doleary : ldap-users ldap-Administrators infosec infra Using a standard rfc2307 install, the only way I was able to get there was by having duplicate groups, one posix and one groupofnames. I've been playing around with rfc2307bis the last few days. While I'm able to have one group, in order to support the desired functionality, I still have to have two member types in that group - member and memberuid: # ldap -search cn=infra ----------------------------------------------------------------------- dn:cn=infra,ou=groups,dc=oci,dc=com cn: infra objectClass: top groupOfNames posixGroup member: cn=admin,dc=oci,dc=com uid=doleary,ou=users,dc=oci,dc=com description: System Admins gidNumber: 610 memberUid: doleary Short version: is there a way to achieve this ability without duplicating data? Any info greatly appreciated. Thanks for your time. Doug O'Leary ------------ Senior UNIX/Security Admin CISSP, CISA, RHCE, CEH O'Leary Computers Inc dkoleary(a)olearycomputers.com (w) 630-904-6098 (c) 630-248-2749 linkedin: http://www.linkedin.com/in/dkoleary resume: http://www.olearycomputers.com/resume.html

2 3

Recovering a multi-master node after a server failure
by Richard Marshall 23 May '14

23 May '14

Hi, We have a multi master (2-node) cluster running 2.4.23 on CentOS 6. We're effectively using them as a failover active-standby pair. The 'Master' node failed last night and we failed over to the standby (they're behind a load balancer). I am now trying to bring the old 'Master' back online but it has become apparent there was a misconfiguration in the server id config. We did have 'Master' = serverid 1 and 'slave' = serverid 2 - i.e. it was missing the servers URI. I have now fixed this, but we have around 500 objects on the old master reporting " changed by peer, ignored in the sync log. The old master will get up to the latest CSN number after I restart it, but then get stuck with these " changed by peer, ignored" errors. My question is, how do I get past this? Is it possible to remove the objects and if so how (I don't want to delete them totally, just remove the conflict). Or, do I need to rebuild the 'old' master server database? If so, is the process to stop slapd, remove the content of the database and accesslog directories. Create an ldif export on the live server, slapadd that file back on to the 'old' master, start it and then allow it to replicate any new changes from it's partner? If this is the only way to do it, is there anything I need to look out for? If not this, then what do I do? I've looked but can't find any guidelines in how to recover a failed node. Any help appreciated! Thanks, Rich

2 1

Advice for repairing lost db log file
by jupiter 22 May '14

22 May '14

Hi, We are running ldap server on CentOS 6.4. We've just found that slapd stopped as the DB log file (log.0000000001) is being removed and lost (someone may delete it inadvertently), now the slapd cannot be started. Although we have a backup days ago, I am not sure if it will work to copy the outdated backup DB log file to the ldap server. Appreciate any advice of repairing it. Thank you. Kind regards, jupiter

1 0

ldapsearch hidden option "-T"
by Auteria W. Winzer Jr. 21 May '14

21 May '14

Is the "-T" option for ldapsearch available in 2.4.39, or has it been permanently removed? Regards, Auteria Winzer Jr.

7 13

RE: pplolicy lockout grace time? - alternatives
by Chris Jacobs 21 May '14

21 May '14

> First of all, password lockout itself is a dumb idea, and we only implement it > because it's part of the original ppolicy spec. The ppolicy spec is pathetically > bad though. What methods aren't dumb ideas that accomplish account unavailability on N password failures? > -- > -- Howard Chu > CTO, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc/ > Chief Architect, OpenLDAP http://www.openldap.org/project/ This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

2 3

Datatype mapping for openldap
by Sankar P 21 May '14

21 May '14

Hi, I saw some example code on MSDN which I tried to compile against openldap on Linux and got some errors. The C code that I tried to compile was: http://msdn.microsoft.com/en-us/library/aa367017(v=vs.85).aspx The errors were related to the undefined nature of types such as: DWORD, PCHAR, BOOL, TRUE, FALSE and functions such as _snprintf_s etc. While I could define these types myself, I wanted to check if there are any standard header files that do these type mappings already. Doing a `rpm -ql openldap2-devel | grep h$ | xargs grep DWORD` did not return anything and so I am feeling that no such standard type-mapping already exists. But I wanted to confirm and to know what is the best practice to follow here. Thanks. -- Sankar P http://psankar.blogspot.com

2 1

pplolicy lockout grace time?
by Emmanuel Dreyfus 21 May '14

21 May '14

Hello We ran into the following problem: someone changes its password, but has a few devices with the old password recorderd. Before the user has time to update stored passwords, an buggy-client hammers servers with requests using the old password, and get the account locked by slapo-ppolicy. Perhaps there could be a setting in pwdPolicy or in slapd.conf so that there is a grace time after a password reset? For instance, the admin could configure that slapo-ppolicy should not lock a user if password has been changed less than X seconds ago. Opinions? -- Emmanuel Dreyfus manu(a)netbsd.org

2 1

DIT for an academic institution
by Shali 9846303531 20 May '14

20 May '14

Dear All, I am new to these LDAP concepts , i have prepared a DIT for our organization with two academic institutions with each institution having different branches of study and also there is staff and students . i have attached the DIT , if am going through a wrong way kindly guide me. -- Thanks & Regards Shali.K.R Server Administrator

4 3

OpenLDAP-2.4.23 on SUSE 11
by Mulligan, Scott 20 May '14

20 May '14

I am running openldap-2.4.23 on SUSE 10 with no problems. After upgrading to SUSE 11, I cannot start slapd. I get an error that it can't find libltdl.so.3. I noticed that libltdl.so.7 is in /usr/lib64. My question is: Will openldap-2.4.23 work with libltdl.so.7 or do I need to upgrade openldap to run on SUSE 11? Can I install a version of libltdl.so.3 on SUSE 11 and get it to work? Are there any other options? Thanks for any suggestions. I haven't been able to find anything about this for days.

2 1

Host Based OpenLDAP Authentication On Mac OS X Mountain Lion
by Amit More 20 May '14

20 May '14

Hello All, I'm sorry if this is the wrong group to post such a question. I have openldap (slapd version 2.4.31-1+nmu2ubuntu8) running on Ubuntu Server 14.04. The 'hostObject' objectClass is added in the OpenLDAP directory. The 'host' attribute is added under all ldap users, which allows users to access just those particular hosts. Apple schema has been added as well. I have a ubuntu client that authenticates users against the ldap server. The ubuntu client is configured to perform host-based authentication via pam modules. Only users that have access to the Ubuntu client can login, and others are denied access. I also have a Mac OS X Mountain Lion (10.8.5) client that authenticates users against the same openldap server. All network users can login through the login window. I would like to restrict access to the Mountain Lion client based on hosts, as I've it on the Ubuntu client. I tried to search for documentation on this, but didn't find any good one. Most of the documentation suggest that network user access be controlled on the Mountain Lion client. I'd really like to have that control on ldap server and not on client. Also, restricting network user access using 'Users & Groups' settings in System Preferences fails. All ldap users are blocked from login. I have successfully tested host-based authentication on a Ubuntu Server 10.04 client that is connected to the same ldap server. So, I know host based authentication works. I would really appreciate if anyone could shed some light on this, or point me to a document that talks about host-based authentication on Mac OS X Mountain Lion client. Thanks, Amit

1 0

virtual lists
by Laurent Schweizer 19 May '14

19 May '14

Hello, I have a ldap client requesting virtual lists and I get an error with openldap (critical extension is not recognized) , ldap exchange are bellow. Any idea how to enable virtual list ? BR Laurent REQUEST Lightweight Directory Access Protocol LDAPMessage searchRequest(2) "dc=peoplefone, dc=com" wholeSubtree messageID: 2 protocolOp: searchRequest (3) searchRequest [Response In: 1785] controls: 2 items Control controlType: 1.2.840.113556.1.4.473 (sortKeyList) criticality: True SortKeyList: 1 item SortKeyList item attributeType: cn Control controlType: 2.16.840.1.113730.3.4.9 (LDAP_CONTROL_VLVREQUEST VLV) criticality: True controlValue: 300e020100020100a006020101020100 REPONSE Lightweight Directory Access Protocol LDAPMessage searchResDone(2) unavailableCriticalExtension (critical extension is not recognized) [0 results] messageID: 2 protocolOp: searchResDone (5) searchResDone

2 2

Close sometime takes a long time
by Venkat Murty 19 May '14

19 May '14

Why does close sometime take a long time? mdb_env_close (in sync7320902242508427276.so) + 69 [0x112e37d35] mdb_env_close0 (in sync7320902242508427276.so) + 248 [0x112e37948] close (in libsystem_kernel.dylib) + 10 [0x7fff8bf900c2] Usually, happens when I have killed the process the last time. System: Mac OS X Thanks, Venkat Murty

3 8

slapcat -c problem
by David Spurek 19 May '14

19 May '14

Hi, slapcat -c doesn't work as I expect in one case. It should ignore errors. I have following slapd.conf with 2 suffixies, only the second one (dc=my-domain,dc=com) is filled with data: cat slapd.conf include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args database bdb suffix dc=example,dc=com rootdn "cn=Manager,dc=example,dc=com" rootpw x directory /var/lib/ldap/ database bdb suffix dc=my-domain,dc=com rootdn "cn=Manager,dc=my-domain,dc=com" rootpw x directory /tmp/tmp.lfFaOlWyes/ldap-test-ldap2 [test]slapcat 537223f1 bdb_db_open: warning - no DB_CONFIG file found in directory /var/lib/ldap/: (2). Expect poor performance for suffix "dc=example,dc=com". 537223f1 bdb_db_open: database "dc=example,dc=com": db_open(/var/lib/ldap//id2entry.bdb) failed: No such file or directory (2). 537223f1 backend_startup_one (type=bdb, suffix="dc=example,dc=com"): bi_db_open failed! (2) slap_startup failed 'slapcat -c' gives me the same output. I expect that it will ignore errors with the first database and dumps the database for second suffix. Should slapcat -c skip error in this case? Tested with openldap-2.4.39 -- David Spurek

2 1

Multiple ou entries are added
by David Spurek 19 May '14

19 May '14

Hi, If I add following ldif with slapadd(attribute 'ou' and 'ou' in dn: are different): dn: ou=testou.auto,dc=my-domain,dc=com ou: testou.misc objectClass: top objectClass: organizationalUnit Slapadd doesn't evalute it as an error in ldif but it adds 'ou' from dn as another attribute. Added entry then looks like: # testou.auto, my-domain.com dn: ou=testou.auto,dc=my-domain,dc=com ou: testou.misc ou: testou.auto objectClass: top objectClass: organizationalUnit Is this expected behavior or a bug? Tested with openldap-2.4.39 -- David Spurek

2 1

slapadd -s doesn't add structuralObjectClass attribute
by David Spurek 19 May '14

19 May '14

Hi, If I add ldap entry with 'slapadd -s' then added entry doesn't contain structuralObjectClass attribute. Is this expected behavior? Tested with openldap-2.4.39 -- David Spurek

1 0

Encryption storage mechanism SHA256 in OpenLDAP
by bris chik 19 May '14

19 May '14

Hi All We are using OpenLDAP 2.4.38 windows version as user store for our application. I need to configure encryption storage mechanish as SHA256 in openLDAP. I tried with changing #password-hash {CLEARTEXT} password-hash {SHA256} But it is not working. I mean after making this change password got saved in OpenLDAP as SHA256 but after that when I am authenticating using pwd through JNDI it cannot match with the stored one and it says incorrect credentials. FYI - I am just taking the plain text pwd as user is providing in login page and passing to openLDAP. My understanding is OpenLDAP will take the plaintext pwd and encrypt it to SHA256 and compare with its store. Please let me know if my understanding is wrong or anything extra I have to do here. I got one link for doing this in linux version but didn't get anything for windows version. http://www.openldap.org/devel//cvsweb.cgi/~checkout~/contrib/slapd-modules/…<http://www.openldap.org/devel/cvsweb.cgi/~checkout~/contrib/slapd-modules/p…> Can anyone please help me on this?

1 0

Weird DNS round-robin issue
by Dennis Leeuw 18 May '14

18 May '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi all, I hope I am on the right list for the problem I am experiencing. We have two subnets 192.168.196. 192.168.222. Our main LDAP servers run in 192.168.196. and are load-balanced by round-robin DNS. The 192.168.196. network is exhausted, so we added a new LDAP slave to 192.168.222. and added the IP address to the round-robin pool. But it seems that it is only used by other servers in the 192.168.222 network and not by servers in the 192.168.196. network This setup has now been running for 6 days, with nscd.conf: enable-cache hosts yes positive-time-to-live hosts 3600 negative-time-to-live hosts 20 suggested-size hosts 211 check-files hosts yes persistent hosts yes shared hosts yes max-db-size hosts 33554432 and nslcd.conf: uid nslcd gid ldap uri ldap://ldap.div.ourdomain.nl/ base dc=div,dc=ourdomain,dc=nl ssl no tls_cacertdir /etc/openldap/cacerts The LDAP server in the 192.168.222 range serves only 33 connections all from the 192.168.222 range, and the 2 hosts in the 192.168.196 range serve 599 and 706 connections. The last 2 servers do serve the 143.121.222. network also. So might there be some caching issue? $ getent ahost ldap.div.ourdomain.nl 192.168.196.190 STREAM ldap.div.ourdomain.nl 192.168.196.190 DGRAM 192.168.196.190 RAW 192.168.196.151 STREAM 192.168.196.151 DGRAM 192.168.196.151 RAW 192.168.222.179 STREAM 192.168.222.179 DGRAM 192.168.222.179 RAW Is this the right list for this question? And if so can someone help me understand what is going on? With kind regards, Dennis Leeuw - -- ICT Medewerker Divisie Biomedische Genetica UMC Utrecht Heidelberglaan 100 STR2.126 3584 CX Utrecht The Netherlands 06 27744048 intern: 64048 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBAgAGBQJTAyjwAAoJEMVYYpdbQscouGsH/3yXjh6zmLMDRaks18qe+yH7 oUrdatkENF7+WyxLz7ZzNL69gXyEwTANGGf9y7CYuqNu47PDs3SvNOM1/kgjy7pr CSN1t9acVb9i67JgOV2ed5fMHlOzOR+sevNKjsdEdKVXrYvcXnevLOD0KHhGlXeq Ips0Uqk8cusDXQZSUPab0aQNhWawyT1Tf4SQVAJbJ3OYEiFpHyPJXos2F4DIpYPJ 9FLn/dqV8sUNc9kaOHRjwcVYYAVyey9vX33xbYKr4pXKLd/ujaArBtwE1tyKvR2G JPz6Gw5sYK5JLjkmr1uzPAze46heiVFY6U1Vv7aMJ4ujuabBiU11Us2k4XuotPI= =UxBr -----END PGP SIGNATURE----- ------------------------------------------------------------------------------ De informatie opgenomen in dit bericht kan vertrouwelijk zijn en is uitsluitend bestemd voor de geadresseerde. Indien u dit bericht onterecht ontvangt, wordt u verzocht de inhoud niet te gebruiken en de afzender direct te informeren door het bericht te retourneren. Het Universitair Medisch Centrum Utrecht is een publiekrechtelijke rechtspersoon in de zin van de W.H.W. (Wet Hoger Onderwijs en Wetenschappelijk Onderzoek) en staat geregistreerd bij de Kamer van Koophandel voor Midden-Nederland onder nr. 30244197. Denk s.v.p aan het milieu voor u deze e-mail afdrukt. ------------------------------------------------------------------------------ This message may contain confidential information and is intended exclusively for the addressee. If you receive this message unintentionally, please do not use the contents but notify the sender immediately by return e-mail. University Medical Center Utrecht is a legal person by public law and is registered at the Chamber of Commerce for Midden-Nederland under no. 30244197. Please consider the environment before printing this e-mail.

4 9

Re: Need Schema for aci attribute
by neel 17 May '14

17 May '14

> neel wrote: > > I am using HPCC and I am integrating it with openldap. In that when I > start > > one component I.e. mydali server. It throws this error. > > I don't know HPCC. Is it this one? > > https://track.hpccsystems.com/browse/HPCC-7999 > > Ciao, Michael. > > Yep, you are correct. Regards Neelesh

1 0

Re: Have you seen this FUD - IT pros suffer OpenLDAP configuration headaches ?
by Turbo Fredriksson 16 May '14

16 May '14

[Sorry Howard for sending it to you personally. It was meant for the list. I sent a copy to the list as well. I hope you don't mind if I send this reply to the list. I've included every word, so not to take something out of context.] On Jan 30, 2014, at 6:17 PM, Howard Chu wrote: >> Personally, I think it's spot on. It IS hard to configure an LDAP server, and >> even harder to understand how it works (the object based part). Took me three >> months first time, and I'm not an idiot. > > The object based part is *LDAP*, so that complaint is not specific to OpenLDAP. Indeed. But setting up something like Active Directory is something my aunt can/could do. It probably won't scale to thousands (or maybe not even hundreds :) of users, but it can be done with reasonable ease. > The part about RedHat seems fairly accurate to me, it *is* true that they have their own commercial LDAP server to sell, and they have no great interest in OpenLDAP working well on their platforms. > >> Even today, I need to consult either my own book or the howto (or seriously >> skim through the man pages) to setup a new server. > > And I still need to read the docs when configuring an Apache HTTP server. That's why we have manpages, there's nothing wrong about that. Same here. Not my point (see the part at the bottom)... >> And even worse if when you want to optimize the backend... There's a lot of >> magic there.... > > The LMDB backend has no tuning/optimization. That's one of the reasons it exists today. Yeah, but isn't it quite slow with lmdb? I haven't tested that in years, so I don't know. One wouldn't run it in production though? >> And with the new config backend!? I haven't even had the time or energy to go >> that far yet! >> > I think you (and everyone else) are blowing this way out of proportion. Compare the example from here I know how it works and I don't really have that much problem with it, it's just so much more difficult to setup (initially) and then maintain than a simple text file. It's way better, but it IS also more complicated (than just fire up an editor, modify the part you want and then issue a service restart - can't be much simpler than that)... > http://www.openldap.org/doc/admin24/slapdconf2.html#Configuration%20Example > > to the slapd.conf example > > http://www.openldap.org/doc/admin24/slapdconfig.html#Configuration%20File%2… > > They aren't that different, and anyone familiar with slapd.conf and LDIF files should have no trouble mapping concepts from one to the other. > > And if you aren't familiar with slapd.conf *and* LDIF then you don't know enough to be an LDAP administrator in the first place, you need to do more homework. That's just life. I couldn't agree more! I've taken over more than my fair share of badly setup and maintained OpenLDAP servers to get really pissed at all the ones not having a clue what they're doing. It's not just making a config file/backend to allow the server to start, it's more planning on how the database should look like (where to put what and what object classes to use and allow), setting up access control etc, etc. The actually planing of the database (the content) is the most important part, and it require quite a lot of reading and testing before it's understood properly to be able to be used to any extent. But then there's the integration to the rest of the system (pam login and what not), Kerberos, SASL, etc, etc... My point wasn't to argue about the validity of how the OpenLDAP server and it's config file/backend work etc. I fully agree and have no problems with it. My point was that the website isn't WRONG - it IS hard! Maybe it SHOULD be hard? The whole concept of an LDAP server is a difficult subject, and shouldn't be taken lightly. Unfortunately, it seems that way to many beginners that have been installing a distribution at home is starting to work as a Linux tech/admin thinking that just because the've run it at their workstation at home for a couple of months makes them good enough to work in a professional environment. I see that in a lot of OpenSource project I'm part of. Complete noobs want to use something complicated that require quite a lot of homework. And then comes complaining when things go south! Or even worse, they bad mouth the project or the technology! (Open)LDAP is one of those many things that require a lot more from the admin than say ... installing a mail server locally... On Debian GNU/Linux that's practically automatic. Just answer a couple of questions, and it works... It's sad that the website in question (and from what one could take from this - that people 'out there') actually thinks that this should be easy. But it's not (technically) wrong... -- There are no dumb questions, unless a customer is asking them. - Unknown

17 92

regarding logging when running in the foreground
by Mike Jackson 16 May '14

16 May '14

Hi, Is there a way to prevent slapd from using syslog when running in the foreground? I run slapd permanently under the runit process supervision package with -d 256, and it already captures stderr to it's own logging system. However, I also get the same log messages cluttering up my syslog with local4.debug lines. Running in the foreground is pretty much a requirement for using process supervision and almost every service related software supports it for this reason. The background logging, despite running in the foreground, is undesired behavior. -mike

4 6

Search issue (objectclass=person) (Possible dupe email)
by Tuc 16 May '14

16 May '14

Hi, We're having an issue with a slightly older version of openldap. (2.4.23-26 on CentOS). Using Apache Directory Studio I do a search: "(objectclass=person)" on a search base of "ou=People,dc=example,dc=com" This should be the easiest and simplest search in the world. However, I get entries like : dn: uid=PLACEHOLDER_example_agent,ou=People,dc=example,dc=com objectClass: top objectClass: posixAccount objectClass: inetOrgPerson cn: PLACEHOLDER_example agent gidNumber: 100 homeDirectory: /home/example_agent sn: agent uid: PLACEHOLDER_example_agent uidNumber: 621 givenName: example loginShell: /bin/bash userPassword:: DELETED and dn: uid=BDTestUser,ou=People,dc=example,dc=com objectClass: top objectClass: organizationalPerson objectClass: inetOrgPerson cn: BD sn: User displayName: BD User givenName: BD mail: seo(a)example.com mobile: +1 1111111111 ou: Sales telephoneNumber: +1 222222222 title: BD Sample User uid: BDTestUser userPassword:: DELETED Where am I going wrong? Tuc

5 17

ldapadd errors
by Brendan Kearney 16 May '14

16 May '14

[root@test mdb]# slapd -V @(#) $OpenLDAP: slapd 2.4.39 (Feb 4 2014 09:07:17) $ mockbuild@buildvm-25.phx2.fedoraproject.org:/builddir/build/BUILD/openldap-2.4.39/openldap-2.4.39/servers/slapd i am trying to add ipNetwork entries to my tree, and at first i was getting "index generation failed" errors after several thousand entries were added. i removed the indexing of the cn attribute and restarted slapd and reran the loading of the entries. the existing objects were moved past, and some new objects were added. then some new errors came out. adding new entry "cn=64.89.32.0,c=US,ou=GeoLocation,dc=bpk2,dc=com" ldap_add: Other (e.g., implementation specific) error (80) additional info: entry store failed i am using lmdb. i have checked filesystem space, and that is not an issue. the data.mdb is about 10 MB in size. the job i am running is an ldapadd, using the rootdn ID. this is only because it is going against a test instance. the job is started with: ldapadd -h test.bpk2.com -D cn=Manager,dc=my-domain,dc=com -W -f geolocation.ldif -S geo_errors.out -c the data is a parsed version of the IpToCountry.csv geolocation info. there are 137951 unique dn's to be added (with cn, ipnetworknumber, ipnetmasknumber, l, and 2 objectclasses per dn), and i am part way through the list. the ldif file is about 25 MB in size. all of the parent objects exist, as that was a previous job to add them. this is just to create the networks below each of the parent objects. where can i look for places to identify the issue? has anyone run into something like this before? a quick google only shows threads for BDB/HDB backends, but i am using LMDB. thanks in advance, brendan kearney

4 3

replica of schema info
by Francesco Malvezzi 16 May '14

16 May '14

good morning, I would like to be able to replicate the schema info only from cn=config. I tried to add the olcSyncrepl to cn=schema dn: cn=schema,cn=config changetype: modify add: olcSyncrepl olcSyncrepl: .... but doesn't work: <olcSyncrepl> only allowed within database declaration I tried to push a whole new olcDatabase={0}config (next step would be to add glue overlay to olcDatabase={1}config,cn=config) dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth manage by * break olcAccess: {1}to dn.base="cn=config" by * none olcSuffix: cn=schema,cn=config olcRootDN: cn=admin,cn=schema,cn=config olcRootPW:: e1NTSEF9bnNNYkxIMFhFTm0zaXA5N0JXaHRVb3RwTlRsRXRxNTA= olcMonitoring: FALSE olcSyncrepl: .... but it doesn't work: olcSuffix: value #0: suffix <cn=schema,cn=config> not allowed in config database. It does work to add olcSyncrepl to olcDatabase={0}config,cn=config with a filter like: olcSyncrepl: {0}rid=001 provider=... binddn=... bindmethod=simple search base="cn=schema,cn=config" filter="(!(cn=core))" but then the whole olcDatabase={0}config,cn=config becomes a shadow context and I'm unable to ldapmodify anything (olcLoglevel for example). What am I missing? thank you for reading me, Francesco

2 5

Need Schema for aci attribute
by neel 16 May '14

16 May '14

Hi, I have compiled and configured OpenLDAP 2.4.39 with ACI. I am trying to integrate one application with LDAP. I have entered all settings. Authentication is working fine. Only thing when it tries to add some entries to ldap, it says that "err=17 text=aci: attribute type undefined" Can you please provide schema for aci attribute? Regards Neelesh

7 20

[LMDB] Choosing right environment flags
by Alain 14 May '14

14 May '14

I need to better understand the best way to configure the various environment flags related to sync and map. When we converted from BDB to LMDB, we instinctively kept #MDB_NOSYNC true. This proved to make the database subject to corruption if it was killed or stopped too harshly. It also had the effect on Windows at least to make Windows gradually use up all available RAM for the memory mapped file and to bring the server to its knees. After carefully reading the documentation about leaving "the system with no hint for when to write transactions to disk" when MDB_NOSYNC was turned on, we completely went without setting any options. The results were that we can't corrupt the database, but the speed degradation makes this approach unusable, as we are very heavily write focused (at least in this part of our process, where we perform analysis and load the database with 100's millions of records). In looking at the documentation I'm tempted to try MDB_WRITEMAP with MDB_MAPASYNC but do I then need to also issue some manual mdb_env_sync and if so at what frequency and what should trigger this? What are best practices combinations of those flags here. We absolutely can't afford database corruption, but we can deal with one (or maybe more with some re-design) transactions that are lost. Please guide us. Thanks Alain

2 1

password policy module memory leaks / excessive replication?
by Paul B. Henson 14 May '14

14 May '14

I've been testing the password policy module lately. I updated our development LDAP infrastructure Monday, basically loading and enabling the module, adding a default policy: dn: cn=default,ou=ppolicy,dc=csupomona,dc=edu cn: default objectClass: organizationalRole objectClass: pwdPolicy pwdAttribute: userPassword pwdLockout: TRUE pwdLockoutDuration: 1800 pwdMaxFailure: 100 pwdFailureCountInterval: 300 And a policy specific for service accounts: dn: cn=serviceaccount,ou=ppolicy,dc=csupomona,dc=edu cn: serviceaccount objectClass: organizationalRole objectClass: pwdPolicy pwdAttribute: userPassword After some initial testing and determining that the current implementation is not suitable for account lockouts, I haven't touched it since Monday. Yesterday, I started getting alerts that the systems were low on memory, and upon looking, found extremely bloated slapd processes. Next, I started getting alerts that the accesslog mdb was running out of space. Upon investigation, I found that the service account that is used to gather statistics was generating a considerable amount of churn every time it authenticated (every 30 seconds). This account was explicitly configured to use the service account password policy: dn: cn=slapd-monitor,ou=user,ou=service,dc=csupomona,dc=edu objectClass: person cn: slapd-monitor sn: LDAP monitoring account pwdPolicySubentry: cn=serviceaccount,ou=ppolicy,dc=csupomona,dc=edu Which should be pretty much "do nothing". (I realize now that this policy will actually result in pwdFailureTime entries being created for failed authentications, and accumulating forever until a successful authentication, but there are no failed authentications for this service account, only successful ones, in this case). There were 1662836 entries in the access log for this dn since Monday that as far as I can tell solely change the CSN: dn: reqStart=20140502031556.000000Z,cn=accesslog objectClass: auditModify structuralObjectClass: auditModify reqStart: 20140502031556.000000Z reqEnd: 20140502031558.000000Z reqType: modify reqSession: 2 reqAuthzID: cn=ldaproot,dc=csupomona,dc=edu reqDN: cn=slapd-monitor,ou=user,ou=service,dc=csupomona,dc=edu reqResult: 0 reqMod: entryCSN:= 20140501211559.348458Z#000000#003#000000 reqMod: modifiersName:= cn=ldaproot,dc=csupomona,dc=edu reqMod: modifyTimestamp:= 20140501211559Z reqEntryUUID: c16729b0-ce1e-4f9d-9123-e0b8f115133c entryUUID: 240ec245-0bac-4e20-b387-19243f720674 creatorsName: cn=accesslog createTimestamp: 20140501211559Z entryCSN: 20140501211559.348458Z#000000#003#000000 modifiersName: cn=accesslog modifyTimestamp: 20140501211559Z This explains why the accesslog was running out of space, it was full of these. It doesn't explain why the slapd process exploded in memory use, unless I suppose the steady-state memory usage of a slapd this busy processing replication is higher than one that's not quite so busy. But I'm confused as to why loading the password policy module, for an account with a policy configured to pretty much not do anything, results in a modification of the CSN for every authentication? I'm going to go peruse the source code to see if I can determine what's going on, but any expert opinions would be most welcome. Thanks much.

3 21

autoreconf failing with automake errors
by rajesh＠linux.vnet.ibm.com 13 May '14

13 May '14

Hi, I am trying to build the openldap package from the source following the release tarball from ftp://ftp.openldap.org/pub/OpenLDAP/openldap-release/openldap-2.4.39.tgz. I am building this package in a new architecture ppc64le ( IBM PowerPC Little endian ). As the config.guess and libtool did not have the required patches to identify this new architecture, I did autoreconf -f -i in my build system whose latest automake and libtool has the patches of ppc64le. but the autoreconf failed with the following error automake: error: no 'Makefile.am' found for any configure output autoreconf: automake failed with exit status: 1 As the config.guess and configure scripts were updated with the ppc64le patches, i went ahead building the package. IT subsequently failed during 'make' with the following errors make[2]: Entering directory `/home/rajesh/openldap/openldap/libraries/liblber' rm -f version.c ../../build/mkversion -v "2.X" liblber.la > version.c /bin/sh ../../libtool --mode=compile cc -g -O2 -I../../include -I../../include -DLBER_LIBRARY -c assert.c ../../libtool: 1: eval: base_compile+= cc: not found ../../libtool: 1: eval: base_compile+= -g: not found ../../libtool: 1: eval: base_compile+= -O2: not found ../../libtool: 1: eval: base_compile+= -I../../include: not found ../../libtool: 1: eval: base_compile+= -I../../include: not found ../../libtool: 1: eval: base_compile+= -DLBER_LIBRARY: not found ../../libtool: 1: eval: base_compile+= -c: not found libtool: compile: you must specify a compilation command libtool: compile: Try `libtool --help --mode=compile' for more information. make[2]: *** [assert.lo] Error 1 FYI, I also tried verified building the package in x86 ( Intel Box ) to get some clues if it is specific to ppc64le architecture. Without doing a autoreconf (which I dont require in my x86 laptop), the package building was sucessful. When I did autoreconf in my x86 laptop, I was struck with the similar errors as I had mentioned above. So, can anyone provide any clues how to progress or redirect this mail to the right person if this is not the right place to discuss this issue? Thanks and Regards Rajeshkumar S Linux Technology Center, IBM

2 1

LDAP_OPT_X_TLS_CACERTDIR not working.
by Seshadri, Anitha 13 May '14

13 May '14

Hi, I would like to open a discussion with OpenLDAP team. I hope this is the right email address. If not please let me know the correct to which this mail should be directed to. Issue: We are currently using OpenLdap 2.4.16 version on Win 64 .We are using RSA and MES Shareadapter internally to build the openldap libs. I am getting the below error when I use Sha-256 (2048 key length) certificates: ldap_sasl_bind_s: Can't contact LDAP server (-1) error:14090086:SSL routines: SSL3_GET_SERVER_CERTIFICATE:certificate verify failed I am using the option LDAP_OPT_X_TLS_CACERTDIR and pass the cert directory which has the certificates. This fails. But the same passes when I use LDAP_OPT_X_TLS_CACERTFILE and point to the certicate which is of .pem format. Can you please let me know I am missing something here or is this a bug? Any help on this is appreciated. Thanks Anitha

3 2

Moving From Debian 2.4.31/hdb to LTB 2.4.39/mdb
by Andy Dorman 13 May '14

13 May '14

Hi. We have been using OpenLDAP for about 11 years now and have an MMR set up with 2 masters and 18 delta-syncrepl clients/slaves, all but 3 slaves are currently using back_hdb. Our beta test server and two load balancers are using back_mdb. The db is not too big with about 50,000 entries, 9 indexes (7 eq & 2 sub) and the slapdump ldif is about 41 MB. All our servers are Debian "testing" with a few packages from unstable and even experimental so we have the latest security and feature fixes for the work we do (email security filtering). Unfortunately, even the "bleeding edge" debian releases are waaaay behind in OpenLDAP. Last year we lost our system admin that set all this up, and I have been on a very steep learning curve since then. At this time I believe we need to move to a current version of OpenLDAP via ltb-project and switch to mdb, but I have run into a couple of questions we need to resolve first. FWIW, I would dearly like to help out the Debian community and compile & maintain an up-to-date version of OpenLDAP for them, but I need at least a couple more years of experience before it is even marginally safe to have other companies depending on my expertise with debian packaging. Anyway, after reading the OpenLDAP & ltb-project docs I have a couple of questions for anyone already using the ltb-project debian release, slapd.d & mdb. I hope the answers will help make our and others' transition go more smoothly. So here we go.... Question #1. I see that slapd.conf is deprecated and we should move to a slapd.d config db. However, the slapd.conf file (with git & cfengine) meets 3 key requirements for our service's configuration management: (1) audit trail, (2) peer review & staff notification, (3) automatic, staggered release to all servers so our users experience 0 downtime. I do not yet see an "easy" way to meet the first two requirements using slapd.d. To satisfy #3 I hope we can just update our master server slapd.d and config changes will be replicated to the slaves. Someone please correct me if I am wrong about that. To meet the requirement for an audit trail & staff review & notification, in the absence of someone's experience and/or knowledge from this group, we currently plan to use our ticket-tracking system (Request Tracker). Within an RT queue dedicated to our db systems we will document, review & manage slapd.d changes prior to actually making a change in the master which will then (I hope) propagate through delta-syncrepl. How does anyone else that is using slapd.d with an MMR setup with multiple client/slaves take care of their needs for an audit trail, peer review/staff notification, and release to all those servers? Question #2. This may be a simple one....When reading the latest OpenLDAP docs at http://www.openldap.org/doc/admin24/slapdconf2.html I noticed that there are no references to back_mdb in the configuration documentation...Specifically, "Table 5.2: Database Backends" and "Table 6.2: Database Backends" do not show an "mdb" option. Is this an oversight or is mdb going away already or am I completely confused? I suspect the answer is #3 ;-) Basically I need to know what to use in the "backend" & "database" directives (slapd.conf) or "olcBackend" attribute (slapd.d) if we want the mdb backend? Thank you for your insights and any information you can share. -- Andy Dorman Ironic Design, Inc. AnteSpam.com, ComeHome.net CONFIDENTIALITY NOTICE: This message is for the named person's use only. It may contain confidential, proprietary or legally privileged information. No confidentiality or privilege is waived or lost by any erroneous transmission. If you receive this message in error, please immediately destroy it and notify the sender. You must not, directly or indirectly, use, disclose, distribute, or copy any part of this message if you are not the intended recipient.

2 1

problems in memberof overlay
by goal jeff 13 May '14

13 May '14

hi. I configured the function of 'memberof overlay' these days. At first I used the methods on the webpage of http://www.openldap.org/doc/admin24/overlays.html, I add the codes of "overlay memeberof" in the file of slapd.conf,then I started the slapd service, the system give me an error "overlay "memberof" not found" . second,I googled the internet and found an article on this webpage:http://www.redmine.org/projects/redmine/wiki/RedmineLDAP,so I create two LDIF files as follow: the first file : dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulePath: /usr/lib/ldap olcModuleLoad: memberof the second file: dn: olcOverlay=memberof,olcDatabase={1}hdb,cn=config objectClass: olcMemberOf objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top olcOverlay: memberof olcMemberOfDangling: ignore olcMemberOfRefInt: TRUE olcMemberOfGroupOC: groupOfNames olcMemberOfMemberAD: member olcMemberOfMemberOfAD: memberOf after I entered the command "ldapadd -x -D 'cn=Manager,dc=example,dc=com' -W -f 1.ldif",the system give an error:"ldap_add: Insufficient access (50)" please help me ,thanks.

3 2

Help with SASL generic GSSAPI error
by Joshua Schaeffer 13 May '14

13 May '14

I'm looking for a little help concerning the below error I get when I do an ldapsearch: root@mytest:~# ldapsearch -Y GSSAPI SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Other (e.g., implementation specific) error (80) additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information () That error is pretty generic to me and the searching I've done to find a solution has not yielded anything successful. I have MIT Kerberos and SASL setup and I'm able to successfully get a TGT from any machine that can see my KDC. I also can successfully search my ldap directory using simple authentication. I've run the sasl-sample-client and server between several machines including: ldap server to krb server, test server to krb server, test server to ldap server, etc. I can complete the sasl test on every one. Running slapd in debug mode doesn't provide me with any additional information: root@baneling:~# slapd -h "ldap:/// ldapi:///" -d 256 5371865b @(#) $OpenLDAP: slapd (Apr 23 2013 12:16:04) $ root@lupin:/tmp/buildd/openldap-2.4.31/debian/build/servers/slapd 5371865c slapd starting 53718672 conn=1000 fd=13 ACCEPT from IP=10.1.10.10:53839 (IP=0.0.0.0:389) 53718672 conn=1000 op=0 BIND dn="" method=163 53718672 SASL [conn=1000] Failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information () 53718672 conn=1000 op=0 RESULT tag=97 err=80 text=SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information () 53718672 conn=1000 op=1 UNBIND 53718672 conn=1000 fd=13 closed 53718672 connection_read(13): no connection! I do have the keytab in a non-standard location on the ldap server (/etc/ldap/ldap.keytab), so I modified /etc/default/slapd and restarted slapd. I'm not really sure what I can provide from my cn=config that would help diagnose this issue let me know and I can respond with the details. Here is my ldap.conf from the server I'm running the ldapsearch from (my test server): root@mytest:~# cat /etc/ldap/ldap.conf # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. BASE dc=harmonywave,dc=com URI ldap://baneling.harmonywave.com #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never # TLS certificates (needed for GnuTLS) TLS_CACERT /etc/ssl/certs/ca.harmonywave.com.pem TLS_REQCERT demand TLS_CHECKPEER yes TLS_CIPHER_SUITE SECURE256 # LDAP sudo settings sudoers_base ou=SUDOers,dc=harmonywave,dc=com # SASL Kerberos settings SASL_MECH GSSAPI SASL_REALM HARMONYWAVE.COM Thanks, Josh

4 6

Phantom certificates?
by Andrew D. Arenson 12 May '14

12 May '14

I am trying to understand how a ldap server's certificate is being verified in the absence of the appropriate CA certificates. I have openldap 2.4.23-34 installed. If I set TLS_CACERTDIR to a dummy directory (like /home/aarenson), ldapsearch tells me, as expected, that the server's certificate is not verified. If I set TLS_CACERTDIR to a directory where I have placed the file with my CA certificates, ldapsearch tells me, again as expected, that the server's certificate _IS_ verified. The situation that is surprising me, though, is that if I set TLS_CACERTDIR to /etc/openldap/certs, which has the cert8.db file, but as far as I can tell has no actuall certificates in that database, ldap search tells me, surprisingly, that the server's certificate _IS_ verified. How is openldap verifying my server's certificate? When I look in /etc/openldap/certs for certificates, I find none: =========================================================================== = [root@in-rtls-dev02 certs]# pwd /etc/openldap/certs [root@in-rtls-dev02 certs]# ls cert8.db key3.db less password secmod.db [root@in-rtls-dev02 certs]# certutil -d . -L Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI = =========================================================================== I have put a file with the appropriate chain of signing certificates in /etc/pki/tls/certs as incommon_chain_2013.pem: =========================================================================== = [root@in-rtls-dev02 certs]# pwd /etc/pki/tls/certs [root@in-rtls-dev02 certs]# ls 3641f99d.0 Makefile incommon-ie.pem make-dummy-cert 9de8458f.0 ca-bundle.crt incommon_chain_2013.pem renew-dummy-cert 9ef5f911.0 ca-bundle.trust.crt iu-bl-inter-ie.pem = =========================================================================== Here's the system ldap configuration I'm using: =========================================================================== = [root@in-rtls-dev02 openldap]# pwd /etc/openldap [root@in-rtls-dev02 openldap]# cat ldap.conf # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. #BASE dc=example,dc=com #URI ldap://ldap.example.com ldap://ldap-master.example.com:666 #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never #TLS_REQCERT allow TLS_REQCERT demand #TLS_CACERTDIR /etc/openldap/certs #TLS_CACERTDIR /etc/pki/tls/certs TLS_CACERTDIR /home/aarenson = =========================================================================== Here is the user ldap configuration I'm using. It is all commented out: =========================================================================== = [in-rtls-dev02.uits.iupui.edu:/home/aarenson] bash> cat .ldaprc # Instruct client to try requesting a server's cert. #TLS_REQCERT allow #TLS_REQCERT demand # Define location of CA Cert #TLS_CACERTDIR /etc/openldap/certs #TLS_CACERTDIR /etc/pki/tls/certs #TLS_CACERTDIR /home/aarenson = =========================================================================== Here are the three invocations of ldapsearch: =========================================================================== = [in-rtls-dev02.uits.iupui.edu:/home/aarenson] bash> ldapsearch -d 9 -D "aarenson(a)ads.iu.edu" -w "<PASSWORD>" -H ldaps://ads.iu.edu:636 -b "ou=Accounts,dc=ads,dc=iu,dc=edu" -s sub "(sAMAccountName=aarenson)" ... TLS: certificate [CN=InCommon Server CA,OU=InCommon,O=Internet2,C=US] is not valid - error -8179:Peer's Certificate issuer is not recognized.. ... [in-rtls-dev02.uits.iupui.edu:/home/aarenson] bash> LDAPTLS_CACERTDIR=/etc/pki/tls/certs LDAPTLS_REQCERT=demand ldapsearch -d 9 -D "aarenson(a)ads.iu.edu" -w "<PASSWORD" -H ldaps://ads.iu.edu:636 -b "ou=Accounts,dc=ads,dc=iu,dc=edu" -s sub "(sAMAccountName=aarenson)" ... distinguishedName: CN=aarenson,OU=Accounts,DC=ads,DC=iu,DC=edu ... [in-rtls-dev02.uits.iupui.edu:/home/aarenson] bash> LDAPTLS_CACERTDIR=/etc/openldap/certs LDAPTLS_REQCERT=demand ldapsearch -d 9 -D "aarenson(a)ads.iu.edu" -w "<PASSWORD>" -H ldaps://ads.iu.edu:636 -b "ou=Accounts,dc=ads,dc=iu,dc=edu" -s sub "(sAMAccountName=aarenson)" ... distinguishedName: CN=aarenson,OU=Accounts,DC=ads,DC=iu,DC=edu ... = =========================================================================== Andy -- Andrew D. Arenson | aarenson (@) iu.edu Advanced Biomedical IT Core, Research Technologies, UITS | W (317) 278-1208 RT is a PTI Cyberinfrastructure & Service Center | C (317) 679-4669 Indiana University Purdue University Indianapolis | F (317) 278-1852

2 5

common name
by Jignesh 12 May '14

12 May '14

I have confusion on on common name. In Open ldap it is a combination of first name and last name and other side it is unique. So it is forces us to use something else then combination of first name and last name. Now tools like php openldap, apache directory shows the LDPA user in left navigation by common name. So if we map common name to something else then we will have problem to view the list in these tools. Is it possible to change the setting for above tools so that they can reflect based on first name and last name instead of common name? -Jignesh

2 1

LMDB concurrent operation and MDB_NOSYNC
by Kristian Amlie 12 May '14

12 May '14

Hi, Does using MDB_NOSYNC when opening the MDB environment in any way affect LMDB's ability to do concurrent database access? Regards Kristian Amlie CFEngine

2 4

Multiple userPasswords entries & resetting one value
by Michael 11 May '14

11 May '14

I have a user with a SSHA userPassword value as well as a SASL userPassword entry. The SASL entry will never change but I'd like to be able to reset and age the SSHA entry only. Is this aging of only one value possible with ppolicy and is it possible to handle manual resets with ldappasswd and/or utilizing an LDIF file? -Mike

2 2

evaluation of set-clauses in <WHO>
by Michael Ströder 10 May '14

10 May '14

HI! Still trying to optimize a bunch of set-based ACLs I wonder whether the (possibly heavy-weight) set-clauses in the <WHO> part are evaluated only in case of an actually matching <WHAT> part. Any hint is appreciated. Ciao, Michael.

2 2

LDAP account status
by Julien Courtès 09 May '14

09 May '14

Hi, I want to disable an account without deleting informations about it. This account is linked with some services such as Owncloud, ftp authentification, samba, linux auth and ssh auth. Does it exists a way to disable the account for all the services? I know that I can disable the account for samba with sambaAcctFlags but I don't know an easy way for other services. I thinked to create a new field called "AccountStatus" and filter on each service accounts which have AccountStatus=active like that /(&(objectClass=inetOrgPerson)(AccountStatus=active)) /Is it a good way to do it or no? Thanks Julien Courtès

4 5

memberOf overlay issues
by Brendan Kearney 08 May '14

08 May '14

Fedora 20, slapd 2.4.39 i am trying to add the memberOf overlay onto a database. the module is loading fine, but the instantiation of the overlay causes some errors. it seems that an OID syntax is throwing things for a loop. below is the output from "slaptest -d any". What could i be doing wrong? 53682a3b ldif_read_file: read entry file without checksum: "/etc/openldap/slapd.d/cn=config/olcDatabase={2}mdb/olcOverlay={2}memberof.ldif" 53682a3b => str2entry: "dn: olcOverlay={2}memberof objectClass: olcOverlayConfig objectClass: olcMemberOfConfig objectClass: top olcOverlay: {2}memberof structuralObjectClass: olcMemberOfConfig entryUUID: 881fa376-67df-1033-8b16-e73c76eb0f15 creatorsName: cn=Manager,dc=my-domain,dc=com createTimestamp: 20140504135544Z entryCSN: 20140504135544.638618Z#000000#000#000000 modifiersName: cn=Manager,dc=my-domain,dc=com modifyTimestamp: 20140504135544Z " 53682a3b >>> dnPrettyNormal: <olcOverlay={2}memberof> 53682a3b <<< dnPrettyNormal: <olcOverlay={2}memberof>, <olcOverlay={2}memberof> 53682a3b str2entry: invalid value for attributeType objectClass #1 (syntax 1.3.6.1.4.1.1466.115.121.1.38) 53682a3b send_ldap_result: conn=-1 op=0 p=0 53682a3b send_ldap_result: err=80 matched="" text="internal error (cannot parse some entry file)" slaptest: bad configuration file!

1 1

Re: Phantom certificates?
by Andrew D. Arenson 07 May '14

07 May '14

On Wed, May 07, 2014 at 09:42:33AM +0200, Hallvard Breien Furuseth wrote: > On 05/06/2014 05:26 PM, Andrew D. Arenson wrote: > >(...) if I set > >TLS_CACERTDIR to /etc/openldap/certs, which has the cert8.db file, but > >as far as I can tell has no actuall certificates in that database, ldap > >search tells me, surprisingly, that the server's certificate _IS_ verified. > > > > How is openldap verifying my server's certificate? > > Maybe this is a variant of ITS#5582: Setting TLS_CACERT to any > certificate.pem file also tells OpenSSL to check the system's > standard installed certs. OpenLDAP should have a separate > option for that, or the opposite - an option not to do that. Thanks. I didn't find an option for turning on/off the use of a system's standard installed certs. Are you saying that you think something like that _does_ exist, or that you simply think it should? I tried moving my certs directory out of the default location of /etc/pki/tls, but was still unable able to generate a failure to verify the certificate when TLS_CACERTDIR was set to /etc/openldap/certs. Andy -- Andrew D. Arenson | aarenson (@) iu.edu Advanced Biomedical IT Core, Research Technologies, UITS | W (317) 278-1208 RT is a PTI Cyberinfrastructure & Service Center | C (317) 679-4669 Indiana University Purdue University Indianapolis | F (317) 278-1852

2 1

Re: LMDB integrity with MDB_NOSYNC on various filesystems
by Howard Chu 06 May '14

06 May '14

Dimitrios Apostolou wrote: > Hello, > > I'm reading in LMDB docs that MDB_NOSYNC will not allow database > corruption under certain conditions: > >> However, if the filesystem preserves write order and the MDB_WRITEMAP >> flag is not used, transactions exhibit ACI (atomicity, consistency, >> isolation) properties and only lose D (durability). I.e. database >> integrity is maintained, but a system crash may undo the final >> transactions > > > Do we know if these conditions are valid for modern filesystems like ext3, > ext4, XFS and how this is affected by various mount options (e.g. ordered, > writeback etc)? Read up on the specific filesystems you're interested in. These things change too frequently for us to track, and it's your responsibility to know what you're deploying. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

deploying password policy module
by Paul B. Henson 06 May '14

06 May '14

We are planning to deploy the password policy module to satisfy our security groups requirement for account lockouts (a.k.a., intentionally provided DoS attack vectors <sigh>). I had a couple of questions regarding the deployment I was hoping someone might be kind enough to answer. Does the password policy module need to be loaded on all of the servers simultaneously, even if there are no password policies defined? We typically stage configuration changes, pulling servers out of the load balancer, updating them, testing them, and then putting them back, such that at no time is service unavailable. The password policy module extends the schema though, and I don't want a server with it loaded potentially trying to replicate unknown attributes to one without it loaded. It's not clear whether simply loading the module would potentially cause this, or if password policy attributes would only be replicated if the module was actually configured with a default policy or if a user had a specifically defined policy. So, would it be safe to stage the initial configuration change loading the module as long as no policies are in place or used (until all of the servers have been updated), or is it required to shut down all of the servers simultaneously to make the change? We are only planning to avail of account lockouts, not any of the other functionality of the module. As such, unless I misunderstand, the following policy should enable lockouts but not apply any of the other restrictions: dn: cn=default,ou=policies,dc=example,dc=com cn: default objectClass: pwdPolicy pwdAttribute: userPassword pwdLockout: TRUE pwdLockoutDuration: 1800 pwdMaxFailure: 100 pwdFailureCountInterval: 300 This would be the default policy. We also have some number of service accounts which we would not want subject to lockouts, if I understand correctly, configuring those accounts with an explicit password policy pwdPolicySubentry like this: dn: cn=serviceaccount,ou=policies,dc=example,dc=com cn: default objectClass: pwdPolicy pwdAttribute: userPassword Should leave them with no restrictions? Finally, there is a requirement for the helpdesk to be able to manually unlock a locked out account. For an account that is currently locked out, would deleting the pwdAccountLockedTime and pwdFailureTime attributes reset it to a normal state? Thanks much.

3 15

Replication for small-bandwidth, mobile systems
by jan＠pki-labor.de 06 May '14

06 May '14

Hello all, we're challenged with a PKI scenario with multiple CAs (Certification Authorities) publishing into multiple directories. Each CA has its own distinct namespace (=DIT) and the directories shall be Muli-Master replicated. So far, I think this can be handled via syncrepl. Now I'm looking for a possibility to replicate (push) certain directory contents (e.g. revocation list updates from the CAs) to mobile systems which are connected via low bandwidth media (some kBPS like slow Modems, which also is already in use for other applications) and the connections are not always available (e.g. client out of radio reachability). As far as I understood several documents on syncrepl, it is not really useful on low bandwidth connections. This push service should therefore compress data or at least only transfer the differences. Is there a standardized protocol or other mechanism to accomplish that? If not, is there a way to trigger something when updates are coming in via replication? We would then think of using/building a special transfer mechanism that does the job. Thanks in advance for any hint! Best regards, Jan

1 0

not able to use idassert-bind successfuly
by Charles Bueche 05 May '14

05 May '14

Dear members, We are trying to create a LDAP proxy to hide two distinct AD servers behind a "single LDAP view". The goal is to authentify and authorize extranet and internal users using a single LDAP server, as LDAP clients (eg Apache) should only talk to a single LDAP server, and not be aware about the multiple AD servers behind the proxy. Our understanding is that we can create a meta database with two back-ends, using distinct uri/suffix/etc. What works: - using an AD user to talk to the proxy, which then is re-used by the proxy to talk to the back-end What does not work: - one "front-end", simple-bind LDAP-user used to access the LDAP-proxy, and only known to the proxy - one back-end user per back-end (known in AD). So we want to first search where a user is by using a front-end account, and then retry a bind with the user's effective username and password using its correct DN. Our config: -------------------------------------------------------------------- database meta suffix dc=meta,dc=x1,dc=ch uri "ldaps://ad1.ad.x1.ch/OU=O3,dc=meta,dc=x1,dc=ch" suffixmassage "OU=O3,dc=meta,dc=x1,dc=ch" "OU=O3,dc=ad,dc=x1,dc=ch" idassert-authzFrom "dn:*" idassert-bind bindmethod=simple tls_reqcert=allow binddn="CN=ldapsrvusr,OU=Service Accounts,OU=O3,dc=ad,dc=x1,dc=ch" credentials="abcdef12345" -------------------------------------------------------------------- When we try to use idassert-bind above, we always get the following error in the log: ... 535a1f25 conn=1000 op=1 <<< meta_search_dobind_init[0]=4 535a1f25 conn=1000 op=1 <<< meta_back_search_start[0]=4 535a1f25 conn=1000 op=1 meta_back_search: ncandidates=1 cnd="*" 535a1f25 conn=1000 op=1 >>> meta_search_dobind_init[0] 535a1f25 conn=1000 op=1 meta_search_dobind_init[0] mc=0x7f17fc008ef0: non-empty dn with empty cred; binding anonymously ... so it looks our identity is never used beyond the proxy to talk to the AD. help welcome. TIA, Charles

1 1

slapd-ldap with translucent and rwm
by Balazs Kovacs 05 May '14

05 May '14

Hi, I'd like to set up an LDAP backend toward a remote LDAP server. The base DN of the searches for the remote server is runtime information and can be any valid DN. I used slapd-ldap and found slapo-rwm which seems like doing exactly what I need so I configured a suffixmassage, where I replace the local DN to the remote base DN. So far so good, I got everything working. I even applied some more manipulations on searches and results by rwm. I was almost done except for one (not so) tiny thing: I wanted to have local overrides on certain attributes. I was glad to encounter slapo-translucent as it documents: "Entries retrieved from a remote LDAP server may have some or all attributes overridden, or new attributes added, by entries in the local database before being presented to the client". I started to set it up, but for me it looks like impossible to combine it with rwm. I used the following example to set up translucent: http://www.openldap.org/lists/openldap-technical/201205/msg00125.html I tried to apply rwm together with translucent like 1) first. I thought this is the ideal setup since I want the suffixmassage only when I turn to the remote LDAP and I want the suffixmassage to be reverted when back from remote. --- 1) dn: olcOverlay=rwm,olcDatabase={0}ldap,olcOverlay={0}translucent,olcDatabase={1}hdb,cn=config And the result was: adding new entry "olcOverlay=rwm,olcDatabase={0}ldap,olcOverlay={0}translucent,olcDatabase={1}hdb,cn=config" ldap_add: Object class violation (65) I was a bit disappointed but tried other combinations as well. 2) dn: olcOverlay={0}translucent,olcDatabase={2}hdb,cn=config dn: olcDatabase={0}ldap,olcOverlay={0}translucent,olcDatabase={2}hdb,cn=config dn: olcOverlay={1}rwm,olcDatabase={2}hdb,cn=config This one resulted in suffixmassage for remote ldap, but also for the translucent local hdb search, which is obviously not a valid dn for the local DB. As an extra I also faced ITS#5941 ( http://www.openldap.org/its/index.cgi/Software%20Bugs?selectid=5941) 3) dn: olcOverlay={0}rwm,olcDatabase={2}hdb,cn=config dn: olcOverlay={1}translucent,olcDatabase={2}hdb,cn=config dn: olcDatabase={0}ldap,olcOverlay={1}translucent,olcDatabase={2}hdb,cn=config This one resulted in intact suffix for ldap and a suffixmassage for local, which is again useless for my case. --- I also tried to look at if I can use the obsolete suffixmassage option of the slapd-ldap, but that does not seem to have an olc schema by looking at the source. After these trials my conclusion was that I have to find a completely different way of doing this. Is it not possible to do a suffixmassage on an ldap backend over translucent? For me this is so much a basic use case that I am surprised. Can someone explain if this is a known missing feature or an intentional limitation? If the latter, why? Any proposal how to solve local overrides inside slapd? (I wouldn't like to run two slapd to separate rwm from translucent) Thanks and Regards, Balazs Kovacs ps: using OpenLDAP 2.4.28 on an Ubuntu 12.04 LTS

1 0

N-Way Multimaster replication
by Flatfender 05 May '14

05 May '14

All, I'm trying to get N-Way Multi-master replication working, and can see each server polling each other but replication doesn't see to update. I have two servers auth03 and auth04. Both servers are Centos 6.5 with OpenLDAP 2.4.23-34.el6_5.1 from the Base/Updates CentOS repository. What I see is that each server seems to contact the other and both get log entries like this. I can post more logs if need be. I haven't been able to find much on "got empty syncUUID" Apr 14 15:44:32 auth03 slapd[1467]: daemon: epoll: listen=11 active_threads=0 tvp=zero Apr 14 15:44:32 auth03 slapd[1467]: connection_get(22) Apr 14 15:44:32 auth03 slapd[1467]: connection_get(22): got connid=0 Apr 14 15:44:32 auth03 slapd[1467]: =>do_syncrepl rid=004 Apr 14 15:44:32 auth03 slapd[1467]: =>do_syncrep2 rid=004 Apr 14 15:44:32 auth03 slapd[1467]: do_syncrep2: rid=004 got empty syncUUID with LDAP_SYNC_ADD Apr 14 15:44:32 auth03 slapd[1467]: connection_get(22) Apr 14 15:44:32 auth03 slapd[1467]: connection_get(22): got connid=0 Apr 14 15:44:32 auth03 slapd[1467]: daemon: removing 22 Apr 14 15:44:32 auth03 slapd[1467]: do_syncrepl: rid=004 rc -1 retrying (29 retries left) Here is the configs for each server: Each server has a unique server ID as well. I haven't tried to get my main user database replicating, as it appears the config database isn't replicating yet. Auth03 Config: slapcat -s olcDatabase={0}config,cn=config dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth" manage by dn.base="cn=Admin,cn=config" manage by dn.exact="uid=sync repl,ou=System,dc=livegamer,dc=com" read by * none olcRootPW:: <redacted> olcAddContentAcl: TRUE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=config olcSyncUseSubentry: FALSE olcMonitoring: TRUE structuralObjectClass: olcDatabaseConfig olcSyncrepl: {0}rid=004 provider="ldaps://auth04.pax.livegamer.com" type=refre shAndPersist retry="60 30 300 +" searchbase="cn=config" bindmethod=simple bin ddn="uid=syncrepl,ou=System,dc=livegamer,dc=com" tls_reqcert=allow credential s=<redacted> olcSyncrepl: {1}rid=003 provider=ldaps://auth03.pax.livegamer.comtype=refresh AndPersist retry="60 30 300 +" searchbase="cn=config" bindmethod=simple bindd n="uid=syncrepl,ou=System,dc=livegamer,dc=com" tls_reqcert=allow credentials= <redacted> olcMirrorMode: TRUE entryCSN: 20140414153033.402795Z#000000#003#000000 modifiersName: cn=config modifyTimestamp: 20140414153033Z dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov structuralObjectClass: olcSyncProvConfig entryUUID: 9cec0db6-5377-1033-940a-233ba8867211 creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20140408144128Z olcSpCheckpoint: 100 10 entryCSN: 20140409154557.570189Z#000000#003#000000 modifiersName: cn=config modifyTimestamp: 20140409154557Z dn: olcOverlay={1}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {1}syncprov structuralObjectClass: olcSyncProvConfig entryUUID: 4c7ef0fe-538c-1033-941d-1b46f26937f8 creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20140408170933Z olcSpCheckpoint: 100 10 entryCSN: 20140409154608.786640Z#000000#003#000000 modifiersName: cn=config modifyTimestamp: 20140409154608Z Auth04 Config: slapcat -s olcDatabase={0}config,cn=config dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootPW:: <redacted> olcAddContentAcl: TRUE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=config olcSyncUseSubentry: FALSE olcMonitoring: TRUE structuralObjectClass: olcDatabaseConfig olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth" manage by dn.base="cn=Admin,cn=config" manage by dn.exact="uid=sync repl,ou=System,dc=livegamer,dc=com" read by * none olcSyncrepl: {0}rid=003 provider=ldaps://auth03.pax.livegamer.comtype=refresh AndPersist retry="60 30 300 +" searchbase="cn=config" bindmethod=simple bindd n="uid=syncrepl,ou=System,dc=livegamer,dc=com" tls_reqcert=allow credentials= <redacted> olcSyncrepl: {1}rid=004 provider=ldaps://auth04.pax.livegamer.comtype=refresh AndPersist retry="60 30 300 +" searchbase="cn=config" bindmethod=simple bindd n="uid=syncrepl,ou=System,dc=livegamer,dc=com" tls_reqcert=allow credentials= <redacted> olcMirrorMode: TRUE entryCSN: 20140414152957.400652Z#000000#004#000000 modifiersName: cn=config modifyTimestamp: 20140414152957Z dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov structuralObjectClass: olcSyncProvConfig entryUUID: aabb3a20-5377-1033-8399-57009c40c824 creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20140408144151Z olcSpCheckpoint: 100 10 entryCSN: 20140409154507.269469Z#000000#004#000000 modifiersName: cn=config modifyTimestamp: 20140409154507Z dn: olcOverlay={1}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {1}syncprov structuralObjectClass: olcSyncProvConfig entryUUID: 5151199a-538c-1033-83f9-bd35daeffcf0 creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20140408170941Z olcSpCheckpoint: 100 10 entryCSN: 20140409154526.632472Z#000000#004#000000 modifiersName: cn=config modifyTimestamp: 20140409154526Z Please let me know what additional info I may need to provide. Thank you Matt P.

3 3

development mailing list?
by Paul B. Henson 03 May '14

03 May '14

I subscribed to the development mailing list Tuesday, to migrate a thread discussing the password policy implementation that I was told belonged there. However, neither of my two postings to that list seem to have been delivered. I am definitely subscribed, having received a message from the list, and my messages to openldap-technical are coming through fine, so I don't think my mail isn't reaching the list. The list description says the list is semi-moderated, so I'm assuming that as a new subscriber my postings are awaiting approval. Reviewing the archives, it doesn't seem like it's that busy of a list. I was just wondering if anyone knew how long it usually took for a new subscriber to be approved for posting? Thanks.

1 0

Q: syncprov_sendresp IDs
by Ulrich Windl 02 May '14

02 May '14

Hi! Can anybody explain what the "rid", "sid", and "to" IDs refer to in the syncprov_sendresp message? Example: slapd[28206]: syncprov_sendresp: to=002, cookie=rid=006,sid=003,csn=20140430111351.287889Z#000000#001#000000 I guess the original is from SID==1, the local SID==003. Does it send to SID==2? If so, what is rid==6 referring to? Regards, Ulrich

2 3

Duplicate dynamically an OU with another RDN ?
by Sylvain 02 May '14

02 May '14

Hi ! I have a branch "ou=people" where RDN are in the form "X1234" and NEVER change for one people. Ex. : uid=X1234,ou=people,dc=example,dc=org In this node, I have the login under "eduPersonPrincipalName" attribute which MAY change. Some applications doesn't allow us to define which login to use and so take "uid" attribute by default, not so cool. Is there any possibility in OpenLDAP to duplicate dynamically an OU with another RDN to have for example : uid=sylvain,ou=peoplebis,dc=example,dc=org ? Best regards, Sylvain

5 5

Can't override TLS_REQCERT
by Andrew D. Arenson 01 May '14

01 May '14

I found the previous post of someone else who faced the same problem I'm encountering, but I did not see a posted solution: http://www.openldap.org/lists/openldap-technical/201310/msg00084.html In /etc/openldap/ldap.conf, TLS_REQCERT is set to 'allow'. I would like to leave this setting, but override it for a specific invocation of ldapsearch. I have attempted to do so by setting TLS_REQCERT in ~/.ldaprc and be setting the LDAPTLS_REQCERT environment variable. Neither has worked. Interestingly, I _HAVE_ found that I can override TLS_CACERTDIR in either of those locations. Is this a bug? Andy -- Andrew D. Arenson | aarenson (@) iu.edu Advanced Biomedical IT Core, Research Technologies, UITS | W (317) 278-1208 RT is a PTI Cyberinfrastructure & Service Center | C (317) 679-4669 Indiana University Purdue University Indianapolis | F (317) 278-1852

2 4

What is the option '-e ppolicy' ?
by Thierry Thelliez 01 May '14

01 May '14

Hello, Looking at the test source code of 2.4.39 for the ppolicy script, I can see the ldapsearch is using a '-e ppolicy' option. The man page for ldapsearch lists 'general extensions' under -e and -E options. But I cannot figure out what these extensions are. What is '-e ppolicy' ? and when do you need it? Thanks, Thierry

4 4

slapd forgets entries
by Emmanuel Dreyfus 30 Apr '14

30 Apr '14

Hello We had a nasty incident with OpenLDAP 2.4.33 (and DB 4.8.30). slapd started to forget about somes entries. There is no error in the logs, but we can see that SRCH operation on some objects that existed randomly returned nentries=0 instead of nentriees=1 We fixed it by destroying the DB and resync'ing from master. Is it a known problem? I upgraded to 2.4.39 after the problem, but I would like to be sure I will not encounter that again. -- Emmanuel Dreyfus manu(a)netbsd.org

1 0

slap_timestamp with microsecond granularity?
by Paul B. Henson 29 Apr '14

29 Apr '14

Reviewing current time handling code, while lutil_parsetime understands and can parse a generalized time that includes fractions of a second, there doesn't seem to be any code that can generate a generalized time string including fractions of a second, in particular to microsecond resolution (to match a struct timeval time)? I'd like to enhance the current password policy module to use microsecond resolution for the pwdFailureTime attribute, as the current 1 second resolution makes it less than ideal for account lockouts. Currently, it is using slap_timestamp to generate the generalized time to store, which only provides a generalized time with 1 second granularity. On initial review, it looks like simply storing a generalized time with microsecond resolution in the pwdFailureTime attribute is all that is required to enhance the ppolicy module for better account lockout support, because as previously mentioned lutil_parsetime already understands and can parse fractional seconds. I don't see any other code that would need to be modified so far. The question is how to generate the needed format? One option would be to enhance one way or another the existing generic support, perhaps adding a slap_timestamp_usec function? Another would be to just add a call to gettimeofday() next to the current call to time() in the ppolicy code, generate the generalized time string with slap_timestamp, and then mash the fractional seconds into it. Ideally I'd like to get this enhancement to ppolicy accepted into the code base, so I'd appreciate some feedback as to what implementation would be preferred for this. Thanks...

4 5

LMDB data corruption/alignment issues on ARM
by Martin Lucina 29 Apr '14

29 Apr '14

Hi, I've just spent about two days chasing down a bug in my application using LMDB, where if I ran the code on an ARM (and ARM only) platform, data returned from mdb_get() would appear to be corrupted. The symtomps were quite bizarre, I'm including them here in case someone else sees something similar; you can skip to the conclusion if you're in a hurry: a) data written by an application process using mdb_put() appeared correct and consistent b) the same data read by a different application process using mdb_cursor_get() would appear consistent when examined with a live GDB on the target c) however, when actually running the application code, even under GDB, some data would mysteriously be corrupted d) single-stepping through one case of corruption lead me to a single LDR instruction which appeared to load bogus data from memory. GDB showed the same data (at the exact same memory address) as correct, i.e. not corrupted. e) the problem only occured on ARM and was always reproducible. Much experimenting and googling later I found [1], the upshot of which is that on some ARM platforms unaligned word accesses to data using LDR produce *bogus* data. No exception, nothing, just silent data corruption. My question is: Given that I'm storing C structs directly in LMDB, I need to get at least word-aligned pointers back from LMDB in order to be able to access the data safely. I've not found anything in the documentation or the source about being able to tweak alignment of key and data values; I *think* that all I need is an option where LMDB would guarantee a minimum word (4 byte in this case) alignment of data. How hard would this be to implement? Would you consider such a feature? The only workaround I can think of is explicitly copying all data I get back from LMDB into aligned struct pointers; for obvious performance reasons I don't want to do that. Martin [1] http://stackoverflow.com/questions/21488501/strange-pointer-arithmetic See the second answer, and the link to the ARM documentation for the LDR instruction.

2 4

ppolicy module limited to catching 1 login failure per second?
by Paul B. Henson 29 Apr '14

29 Apr '14

We're testing the ppolicy module for the purposes of enabling account lockout on our ldap infrastructure. During initial testing, I noticed that it didn't seem to be catching all of the failed logins, and then realized that the pwdFailureTime attribute in which they are stored seems to have a granularity of only 1 second? So, if there are 100 failed logins in 1 second, for the purposes of account lockout, the password policy module only records them all as 1 failed login? Such that if you had a pwdMaxFailure set to 100, an intruder would actually be able to get in 10000 password guess attempts before the account was actually locked out? Am I misunderstanding something here? Is there anyway to get pwdFailureTime to use microsecond granularity like entryCSN? Thanks...

2 2

import new schema via ldapmodify
by Nikos Voutsinas 26 Apr '14

26 Apr '14

Hello all, While practising with the cn=config, I tried to import a new schema to an Openldap 2.4.39 server by using the ldapmodify cmd. Can someone please enlighten me on why the 1st ldif works but not the 2nd one? The "{4}", which is the only difference between the 1st and the 2nd ldif, is the index of the next available object under cn=schema,cn=config 1st (works) ============= dn: cn={4}eduPerson,cn=schema,cn=config changetype: add objectClass: olcSchemaConfig cn: eduPerson dn: cn={4}eduPerson,cn=schema,cn=config changetype: modify add: olcAttributeTypes olcAttributeTypes: ( 1.3.6.1.4.1.5923.1.1.1.1 NAME 'eduPersonAffiliation' DESC 'eduPerson per Internet2 and EDUCAUSE' EQUALITY caseIgnoreMatch SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' ) - add: olcObjectClasses olcObjectClasses: ( 1.3.6.1.4.1.5923.1.1.2 NAME 'eduPerson' AUXILIARY MAY ( eduPersonAffiliation ) ) - ============= 2nd (doesn't work) ============= dn: cn=eduPerson,cn=schema,cn=config changetype: add objectClass: olcSchemaConfig cn: eduPerson dn: cn=eduPerson,cn=schema,cn=config changetype: modify add: olcAttributeTypes olcAttributeTypes: ( 1.3.6.1.4.1.5923.1.1.1.1 NAME 'eduPersonAffiliation' DESC 'eduPerson per Internet2 and EDUCAUSE' EQUALITY caseIgnoreMatch SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' ) - add: olcObjectClasses olcObjectClasses: ( 1.3.6.1.4.1.5923.1.1.2 NAME 'eduPerson' AUXILIARY MAY ( eduPersonAffiliation ) ) - ============= The command used, looks like this: ldapmodify -h localhost -p 389 -D cn=admin,cn=config -x -W -f <filename> Thanks, Nikos

1 0

How can i setup acl on openldap(ubuntu 12.04)
by Tian Zhiying 25 Apr '14

25 Apr '14

Hi My server is ubuntu 12.04 64bit, install openldap via apt-get, now i want to setup acl,how can i quickly to setup it. Before i use centos 5, slapd.conf on /etc/openldap dir, but slapd.conf is not on /etc/ldap dir at ubuntu 12.04. Tian Zhiying

2 1

Re: LMDB: fast writes: removing the write mutex ?
by Simon Majou 25 Apr '14

25 Apr '14

MDB_NOLOCK doesn't fit, from the doc : #MDB_NOLOCK Don't do any locking. If concurrent access is anticipated, the caller must manage all concurrency itself. I still want the concurrency managed on reads. On Fri, Apr 25, 2014 at 3:06 PM, Hallvard Breien Furuseth <hbf(a)mail.uio.no>wrote: > I wrote: > >> On 13. april 2014 18:04, Simon Majou wrote: >> (...) >> >> In that case, how can I disable the write lock ? >>> Would commenting LOCK_MUTEX_W() & UNLOCK_MUTEX_W() make the trick ? >>> >> >> You could use MDB_NOTLS in LMDB 0.9.7 or later, but then you must >> synchronize threads yourself which does not sound like what you >> want. Also, then you must not write when there are too old readers. >> > > Oops, I meant MDB_NOLOCK. MDB_NOTLS is about readers. > > > > -- Best regards, Simon

1 0

failed bind after password update
by Emmanuel Dreyfus 25 Apr '14

25 Apr '14

Hi After heartbeat we force password resets and we observe an odd behavior: after a password is changed, a replica will fail bind just as if the password was wrong (LDAP_INVALID_CREDENTIALS), while another replica will accept it. slapcat show idential userPassword hashes everywhere: master, bad replica and good replica. Destroying the replica data and resyncrhonizing it fixes the problem. Is there some kind of bind cache somewhere? This is OpenLDAP 2.4.33 -- Emmanuel Dreyfus manu(a)netbsd.org

1 0

slapcat -F failing to backup
by Mike_Mcarthur＠kaltire.com 24 Apr '14

24 Apr '14

Hello; I am running an older version of openldap and having issues in our production environment. We would backup our openldap db by running slapcat -F /etc/openldap/slapd.d/ Recently htat backup fails and causes issues with our ldap db. [root@l900pldp01v ~]# slapcat -F /etc/openldap/slapd.d/ ch_calloc of 1 elems of 800000008 bytes failed slapcat: ../../../servers/slapd/ch_malloc.c:107: ch_calloc: Assertion `0' failed. Aborted When I run this same command in our test system the backups succeed. Any ideas on what the error is talking about? Thank you Mike M

2 2

[LMDB] Access violation
by Alain 23 Apr '14

23 Apr '14

Hi, We've now started to receive regular access violation after running our application for about 30-45 minutes of heavy processing. We are at commit 5bda356 and running under Windows 2k8 R2 Datacenter, service pack 1 Here's what I found from the log file produced by the Java JVM about crashing. The issue happens after our application call db_put. It occurs in mdb_xcursor_init0 (inlined within mdb_cursor_init) at: if (txn->mt_dbs[dbi].md_flags & MDB_DUPSORT) { mdb_tassert(txn, mx != NULL); mc->mc_xcursor = mx; mdb_xcursor_init0(mc); mdb_xcursor_init0(MDB_cursor *mc) { MDB_xcursor *mx = mc->mc_xcursor; mx->mx_cursor.mc_xcursor = NULL; <------here or: 0000000180008A9C: 4D 89 4B 10 mov qword ptr [r11+10h],r9 //mc->mc_xcursor = mx; (6736) 0000000180008AA0: 49 89 59 10 mov qword ptr [r9+10h],rbx //mx->mx_cursor.mc_xcursor = NULL; (6651) Looking at the register it is clear that cursor_init is called with a dbi of zero and a null mx pointer. >From the stack I was able to trace the call to mdb_cursor_init to come from mdb_page_alloc at: if (op == MDB_FIRST) { /* 1st iteration */ /* Prepare to fetch more and coalesce */ oldest = mdb_find_oldest(txn); last = env->me_pglast; mdb_cursor_init(&m2, txn, FREE_DBI, NULL); <-----here the question then is why and how we can have had dupsort turned on for FREE_DBI so that init cursor could have triggered this code. I am working on publishing a change to the above line to disregard FREE_DBI, but that looks like a patch that doesn't address the cause of this issue: if (dbi && txn->mt_dbs[dbi].md_flags & MDB_DUPSORT) { I'm at a real lost how DUPSORT can ever be turned on for FREE_DBI and if that's now a symptom a another problem. Thanks for you help and insight Alain

1 0

SAML Identity Provider for OpenLDAP
by Marc Patermann 23 Apr '14

23 Apr '14

Hi, I searching for proven "extention" to use my OpenLDAP directory data with an SAML identity provider. I found LemonLDAP:NG and OpenAM as possible candidates. Howtos and success stories are welcome! Marc

4 3

Re: (ITS#7840) bug with initial/seed syncrepl
by Jephte Clain 22 Apr '14

22 Apr '14

hello, thanks for your answer. see my response below 2014-04-20 7:13 GMT+04:00 Howard Chu <hyc(a)symas.com>: > Jephte.Clain(a)univ-reunion.fr wrote: >> >> Full_Name: Jephte CLAIN >> Version: 2.4.39 >> OS: Debian 6 64bits >> URL: http://jclain.fr/openldap-its/ >> Submission from: (NULL) (93.176.62.129) >> >> >> I have scripts to test several replication scenarii, that setup the LDAP >> environment then allow me to play with parameters as I see fit. >> >> I believe that there is a bug with the "seed replication" that allow one >> to >> build an exact clone of a master with minimal configuration on the slave >> side. > > > There is no bug. The syncrepl consumer is working as designed. If you want > the consumer's entries to be automatically overwritten, create the consumer > first so that its seed entries have older timestamps than the provider. ok, it works as designed. I just didn't know what the design was :-) quoting man slapd: Use only the rid part to force a full reload. I guess I didn't notice that the word "full" have a different meaning here than usual about creating the consumer first. you are kidding, right? in production, the provider exists long before the consumer is set up. the tests I do are based on the production state. anyway, my automated scripts "touch" the provider after setting up the slave, so this is not a problem. It's just that I would prefer not to have wasted time wondering why the slave was not being updated even though I asked for a "full" reload Thanks for your answer. It's now clearer in my mind. I Cc the openldap-technical list, this can help others. > >> note: the tests below require 2 VMs, or running the two slapd instances in >> chroots, because a clone replica requires the data files to be in the same >> path... > > > That's far overkill. All you need to do is configure your test scripts to > use relative pathnames. test049 (and others) in the test suite already > operates this way. ok thanks for pointing this out It has been a while since I read the tests scripts. I should have paid more attention... > > Closing this ITS. > >> I attach two scripts to replicate the problem. they require root (they >> uses >> chroots) >> this is with openldap 2.4.39 on debian squeeze. some paths may have to be >> fixed >> in the scripts below >> >> use jclain-20140419-0start.sh to: >> - create a ldap server to be served on ldap://localhost:3890 >> - start the master in chroot >> (the logs are in /jclain-slapd-test/master.data/slapd.log) >> - create a seed ldap replica to be served on ldap://localhost:3891 with >> ldap://localhost:3890 as the provider >> - start it in chroot with option -c rid=0 >> (the logs are in /jclain-slapd-test/slave.data/slapd.log) >> >> use jclain-20140419-1stop.sh to: >> - stop the servers >> - umount the chroots >> >> If I understand the manual correctly, after 0start.sh, the replica should >> be >> identical to the master thanks to -c rid=0 >> BUT, the log on the replica says: >> >> 534d5481 dn_callback : new entry is older than ours cn=config ours >> 20140415154713.807278Z#000000#000#000000, new >> 20140415154704.888204Z#000000#000#000000 >> >> and indeed, the seed entries are NOT overwritten >> I have to "touch" them on the master to force the replication. >> >> I have uploaded the scripts to http://jclain.fr/openldap-its/ >> >> thanks in advance >> >> > > > -- > -- Howard Chu > CTO, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc/ > Chief Architect, OpenLDAP http://www.openldap.org/project/ -- cordialement, Jephté Clain Direction des Systèmes d'Information et des Usages Numériques - 2IG Tél. 0262 93 86 31 Fax. 0262 93 81 06

1 1

TLS init def ctx failed: -73
by ChiiSama 20 Apr '14

20 Apr '14

Hi, does anybody knows what main: TLS init def ctx failed: -73 means ? I replaced my CA, key and cert files. I generated the new certs like the previous before with Debian Stable / CA.pl Script (-newca/newcert). Standard 4096 Bit, rsa/sha certs. Greeting -- Mit freundlichen Grüßen ChiiSama mailto:ChiiSama@gmx.net

2 1

bug(?) with initial/seed syncrepl
by Jephte Clain 19 Apr '14

19 Apr '14

hello, (note: english is not my primary language. I'll do my best to be clear...) I have scripts to test several replication scenarii, that setup the LDAP environment then allow me to play with parameters as I see fit. I believe that there is a bug with the "seed replication" that allow one to build an exact clone of a master with minimal configuration on the slave side. Before I fill an ITS, I'd like to confirm with you that I do the right thing (tm) note: the tests below require 2 VMs, or running the two slapd instances in chroots, because a clone replica requires the data files to be in the same path... this is openldap 2.4.39 on debian squeeze I attach a script to replicate the problem. it requires root (it uses chroots) use 0start.sh to: - create a ldap server to be served on ldap://localhost:3890 - start the master in chroot (the logs are in /jclain-slapd-test/master.data/slapd.log) - create a seed ldap replica to be served on ldap://localhost:3891 with ldap://localhost:3890 as the provider - start it in chroot with option -c rid=0 (the logs are in /jclain-slapd-test/slave.data/slapd.log) use 1stop.sh to: - stop the servers - umount the chroots If I understand the manual correctly, after 0start.sh, the replica should be identical to the master thanks to -c rid=0 BUT, the log on the replica says: 534d5481 dn_callback : new entry is older than ours cn=config ours 20140415154713.807278Z#000000#000#000000, new 20140415154704.888204Z#000000#000#000000 and indeed, the seed entries are NOT overwritten I have to "touch" them on the master to force the replication. so my question is: do I use the -c option correctly, or is there a bug? thanks for your help. regards, -- Jephté Clain Direction des Systèmes d'Information et des Usages Numériques - 2IG Tél. 0262 93 86 31 Fax. 0262 93 81 06

1 1

Date format
by Frans Lanting - IT Admin 19 Apr '14

19 Apr '14

Hi Folks, This refers to the OpenLDAP found in OS X Server, which Apple calls Open Directory. I'm trying to determine the time when an OpenLDAP replica got its last update from the OpenLDAP master, so on a replica I do the following: % sudo slapconfig -getreplicaconfig Replica LDAP server Updated: 2014-04-18 22:29:01 +0000 List Of Replicas od-example.com - OK My question is the date/time format as seen above, since it does not appear to be GMT/UTC or the server time, so any clarification on this would be most appreciated! I don't see any reference to this slapconfig man page or in Apple server documentation. Thanks in advance, Dan

2 1

attribute for storing SSH RSA host keys
by ML mail 17 Apr '14

17 Apr '14

Hello, On my already existing OpenLDAP server I would like to add an attribute in order to store SSH RSA host keys. Currently there are no such attributes (for example: sshRSAHostKey) in any standard schemas. What would be the best strategy to add this attribute to my OpenLDAP server? Create a new objectClass? or simply add it to another already standard objectClass such as the NIS schema? Regards ML

4 6

Re: OpenLDAP Metadirectory
by Thomas Stegbauer 16 Apr '14

16 Apr '14

Hi, i have in my company two ActiveDirectories. as i have an application which has only the possiblity to query one LDAP-server for authentication i thought about a metadirectory as described here: http://ltb-project.org/wiki/documentation/general/sasl_delegation and here https://www.memolinux.info/doku.php?id=unix:ldap:openldapads&s=meta#backend… so i started with openldap 2.4.31 from debian 7.4. my starting configuration looks like below: what i was missing from the docu, i need a schema, where sAMAccountName, proxyAddresses and so on is defined. so i created the msad.schema as described here: http://serverfault.com/questions/151688/configuring-openldap-as-a-active-di… now i don't get an error when i startup slapd. but when i do an search to the metadirectory for example: "ldapsearch -x -D cn=manager,dc=meta -b dc=meta uid=testuser", i see in the wireshark -the bindreques -the searchrequest within DC=D6200,DC=comp,DC=com -but the search criteria looks like this: (!(objectclass=*)) not (objectclass=*) which finds nothing. and gives me 0 results. also i found: http://www.openldap.org/lists/openldap-technical/201206/msg00168.html But what here unclear, what schema definitions do i need with this? could someone point me to my error, as i am nearly blind for comparing. Thomas slapd.conf ========== # Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/misc.schema include /etc/ldap/schema/msad.schema pidfile /var/run/slapd/slapd.pid loglevel 99 # Where the dynamically loaded modules are stored modulepath /usr/lib/ldap moduleload back_hdb moduleload back_ldap moduleload back_meta moduleload rwm access to * by * read # Database database meta suffix "dc=meta" rootdn "cn=Manager,dc=meta" rootpw secret # LDAP 1 uri "ldap://192.168.0.2:3268/ou=vzp,dc=meta" lastmod off suffixmassage "ou=vzp,dc=meta" "DC=D6200,DC=comp,DC=com" idassert-bind bindmethod=simple binddn="CN=Meta,CN=Users,DC=D6200,DC=comp,DC=com" credentials="secret" mode=none flags=non-prescriptive idassert-authzFrom "dn.exact:cn=Manager,dc=meta" overlay rwm rwm-map objectclass account user rwm-map attribute mail proxyAddresses rwm-map attribute uid sAMAccountName rwm-map attribute cn name rwm-map attribute * # LDAP 2 uri ldap:// 192.168.13.2 :3268/ou=azp,dc=meta lastmod off suffixmassage "ou=azp,dc=meta" "DC=d5820,DC=muc,DC=com" idassert-bind bindmethod=simple binddn="CN=Meta,CN=Users,DC=d5820,DC=muc,DC=com" credentials="secret" mode=none flags=non-prescriptive idassert-authzFrom "dn.exact:cn=Manager,dc=meta" overlay rwm rwm-map objectclass account user rwm-map attribute mail proxyAddresses rwm-map attribute uid sAMAccountName rwm-map attribute cn name rwm-map attribute *

1 0

response controls
by Huub Sepers 15 Apr '14

15 Apr '14

Hi, We use openLdap as our user identity store for our SSO solution which is openAM. We want to implement a password expiration strategy. Therefore we have to configure openLdap to return a signal for events like: - password about to expire - password expired - .... The openAM code (java) anticipates "controls" for this purpose. Questions: - How to configure openLdap to return a control when a password is about to expire. - Which java Ldap api should be used to process such a control. Greetings, Huub

3 2

Checking client certificates against CRLs
by David Arroyo 15 Apr '14

15 Apr '14

This question may be better asked in the NSS mailing list. Feel free to let me know if that is the case. I'm building a service based around OpenLDAP and SASL EXTERNAL authentication using client certificates. One of requirements is that we have the ability to revoke client certificates. I've found that the only way to revoke a client certificate using an NSS-linked OpenLDAP (RHEL's default 2.4.23) is to: - Revoke the certificate - Import the CRL into the db referenced by olcTLSCACertificatePath - restart slapd Is there a way to update the CRL without restarting slapd? And is there any way to make slapd request the URL referenced in the client cert's nsCaRevocationUrl attribute? If the answer to this is "use OpenSSL", that's a fine answer. Regards, David

4 6

CRL with OpenSSL
by manu＠netbsd.org 15 Apr '14

15 Apr '14

Hi A cautious handling of heatbleed included renewing private keys and certificates. But that is of no interest if the possibly compromised certificate is not revoked, or if revokation is not enforced. I therefore tried CRL in OpenLDAP (linked with OpenSSL). I first started with client settings, in ~/.ldaprc: BASE dc=example,dc=net URI ldaps://ldap.example.net TLS_CACERT /etc/openssl/certs/ca.crt TLS_REQCERT demand TLS_CACERTDIR /home/manu/openssl/ca TLS_CRLCHECK all As suggested in the man page, I added a copy of /etc/openssl/certs/ca.crt in /home/manu/openssl/ca and tried a ldapsearch on the server. It fails, and with debug output I have: TLS certificate verification: Error, unable to get certificate CRL TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (unable to get certificate CRL). ldap_err2string ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) kernel trace show that before the error message, it attemps to open /home/manu/openssl/ca/0726b466.r0 If I rename the CA to that name, it will read it, then fail on: TLS certificate verification: Error, unable to get certificate CRL TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect: error:0906D06C:PEM routines:PEM_read_bio:no start line. That suggests the man page is wrong and it is not expecting a CA there. If I remove the CA from /home/manu/openssl/ca/ and copy the CRL in /home/manu/openssl/ca/0726b466.r0, it reads it without a complain, then tries to read /home/manu/openssl/ca/0726b466.r1 and fail there. If I copy /home/manu/openssl/ca/0726b466.r0 to /home/manu/openssl/ca/0726b466.r1, the message suggests that it is indeed trying to load the CRL from that file: TLS: can't connect: error:0B07D065:x509 certificate routines:X509_STORE_add_crl:cert already in hash table. I have a few questions before I start to read the code, just in case it is a known issue: Why the cryptic file names? And why do I need a second 0726b466.r1 file? Using TLS_CRLCHECK peer instead of TLS_CRLCHECK all does not change the behavior. And is OpenSSL CRL supposed to work? This is OpenLDAP 2.4.33 -- Emmanuel Dreyfus http://hcpnet.free.fr/pubz manu(a)netbsd.org

5 11

Problem after migration openldap 2.3.43 to 2.4.23 --> 32 No Such Object
by Jonas Kellens 14 Apr '14

14 Apr '14

Hello, I have a working openLDAP server version 2.3.43. My configuration there works : the correct users have the correct access. I have set up a new openLDAP-server with newer version 2.3.43. I have no working openLDAP on version 2.3.43. I have tried with the new syntax and with the command /usr/sbin/slaptest -f /etc/openldap/slapd.conf -v to use the build in converion tool, but I always got : ldap_bind: Invalid credentials (49) So I forgot this conversion and continued with the "old" slapd.conf file. But in this configuration (which is just a copy/paste of my openLDAP 2.3.43) no user can query the LDAP entries. So this is the setup : I have a user : cn=U101001,ou=101001,dc=mydomain This user is member of the group : cn=tbook1,ou=gebruikers,ou=101001,dc=mydomain These members can read entries in the tree : ou=tbook1,ou=contacten,ou=101001,dc=mydomain I have in slapd.conf : access to dn.one="ou=tbook1,ou=contacten,ou=101001,dc=mydomain" by group.exact="cn=admins,ou=101001,dc=mydomain" write by group.exact="cn=tbook1,ou=gebruikers,ou=101001,dc=mydomain" read This user cn=U101001,ou=101001,dc=mydomain really exists (if you should doubt) : # extended LDIF # # LDAPv3 # base <cn=U101001,ou=101001,dc=mydomain> with scope subtree # filter: (objectclass=*) # requesting: ALL # # U101001, 101001, mydomain dn: cn=U101001,ou=101001,dc=mydomain cn: U101001 sn: U101001 objectClass: inetOrgPerson objectClass: top userPassword:: e1NTSEF9OVBTNmltR3ZpUEhzK1JRQVpickNVdVR5cS9Iejg5TzY= # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 The group cn=tbook1,ou=gebruikers,ou=101001,dc=mydomain also really exists (if you should doubt) : # tbook1, gebruikers, 101001, mydomain dn: cn=tbook1,ou=gebruikers,ou=101001,dc=mydomain cn: tbook1 member: cn=U101001,ou=101001,dc=mydomain objectClass: groupOfNames objectClass: top # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 When I query the LDAP-tree ou=tbook1,ou=contacten,ou=101001,dc=mydomain with my root-account (cn=Manager,dc=mydomain), the I get results : [root@ldap1 ]# ldapsearch -x -D 'cn=Manager,dc=mydomain' -b "ou=tbook1,ou=contacten,ou=101001,dc=mydomain" -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <ou=tbook1,ou=contacten,ou=101001,dc=mydomain> with scope subtree # filter: (objectclass=*) # requesting: ALL # # tbook1, contacten, 101001, mydomain dn: ou=tbook1,ou=contacten,ou=101001,dc=mydomain ou: tbook1 objectClass: organizationalUnit objectClass: top ...<cut>... # search result search: 2 result: 0 Success # numResponses: 5 # numEntries: 4 But when I query this same LDAP-tree with my user cn=U101001,ou=101001,dc=mydomain, I get : [root@ldap1 openldap]# ldapsearch -x -D 'cn=U101001,ou=101001,dc=mydomain' -b "dc=mydomain" -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=mydomain> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 32 No such object # numResponses: 1 I also have phpLDAPadmin installed and there I see that there are definitely enries in the LDAP-directory ou=tbook1,ou=contacten,ou=101001,dc=mydomain. So why does my user cn=U101001,ou=101001,dc=mydomain fails to get results ?? Kind regards, Jonas.

6 21

LMDB: fast writes: removing the write mutex ?
by Simon Majou 13 Apr '14

13 Apr '14

Hello, I wanted to know, how we could disable the write lock, in case the application shards the writes per thread ? I guess that would imply to have one btree per thread, isn't it ? We could as well use as many DB as threads (at the cost of also sharding the reads) ? In that case, how can I disable the write lock ? Would commenting LOCK_MUTEX_W() & UNLOCK_MUTEX_W() make the trick ? -- Best regards, Simon

1 0

Problems with slapo-rwm
by Fred Snilees 12 Apr '14

12 Apr '14

Hi I am trying to get slapo-rwm module working in a cn=config setup I have openldap with a local DB and ldap database backing onto a MS AD DB I am trying to rewrite objectclass group to groupOfUniqueNames and attribute member to uniqueMember this is what i use to set it up dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: {4}rwm dn: olcOverlay=rwm,olcDatabase={1}ldap,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcRwmConfig olcOverlay: rwm olcRwmRewrite: rwm-rewriteEngine "on" olcRwmMap: {1}objectclass group groupOfUniqueNames olcRwmMap: {2}attribute member uniqueMember olcRwmNormalizeMapped: FALSE but when i try a ldapsearch it doesn't work , the object class and attribute are not re written

2 3

Strange password policy behaviour
by Philip Colmer 10 Apr '14

10 Apr '14

I'm using OpenLDAP 2.4.38. At some distant point when I was testing the configuration of our OpenLDAP server, I must have set pwdInHistory to 5 as I have 5 previous passwords stored in my account object. Before going live, though, I changed my mind and set pwdInHistory to 0. However, my account still retains those five previous passwords. I've tried applying a specific pwdPolicy to my object and setting pwdInHistory to 1 then changing my password but the object still retains 5 previous passwords :-(. Given that pwdHistory is read-only and therefore I cannot delete those entries, does anyone have any suggestions on how I can persuade OpenLDAP to forget those old passwords? I don't think changing the password multiple times is going to fix the problem either. Despite setting pwdInHistory to 1, changing the password multiple times doesn't seem to be working in the way I would expect. The five pwdHistory entries that are being shown by Apache Directory Studio all show a date from the beginning of 2013. I would expect ONE of those entries to be replaced with an entry with today's date and, even better, I would expect OpenLDAP to be removing entries if there are more than pwdInHistory's value. Regards Philip

2 2

2.4.39 error when starting openldap with mdb backend
by ping-shin ching 10 Apr '14

10 Apr '14

Using openldap 2.4.39 on solaris 10 sparc box. Bdb runs without any issue. Mdb fails on startup ( described below) Snip from the slapd.conf------------------------------------- database mdbsuffix "o=vtec,c=au"rootdn "cn=manager,o=vtec,c=au"# Cleartext passwords, especially for the rootdn, should# be avoid. See slappasswd(8) and slapd.conf(5) for details.# Use of strong authentication encouraged.rootpw secret# The database directory MUST exist prior to running slapd AND# should only be accessible by the slapd and slap tools.# Mode 700 recommended.directory /data/irene/var/openldap-data-mdbmaxsize 1073741824 Get this error on startup-------------------------------------- 34628c3 1.2.36.79672281.1.13.3 (rdnMatch): 534628c3 2.5.13.1 (distinguishedNameMatch): 534628c3 matchingRuleUse: ( 2.5.13.1 NAME 'distinguishedNameMatch' APPLIES ( creatorsName $ modifiersName $ subschemaSubentry $ entryDN $ namingContexts $ aliasedObjectName $ dynamicSubtrees $ distinguishedName $ seeAlso $ olcDefaultSearchBase $ olcRootDN $ olcSchemaDN $ olcSuffix $ olcUpdateDN $ olcRelay $ member $ owner $ roleOccupant ) )534628c3 2.5.13.0 (objectIdentifierMatch): 534628c3 matchingRuleUse: ( 2.5.13.0 NAME 'objectIdentifierMatch' APPLIES ( supportedControl $ supportedExtension $ supportedFeatures $ supportedApplicationContext ) )534628c3 slapd startup: initiated.534628c3 backend_startup_one: starting "cn=config"534628c3 config_back_db_openBackend ACL: access to * by * none 534628c3 config_back_db_open: line 0: warning: cannot assess the validity of the ACL scope within backend naming context534628c3 config_back_db_open: No explicit ACL for back-config configured. Using hardcoded default534628c3 config_build_entry: "cn=config"534628c3 config_build_entry: "cn=schema"534628c3 >>> dnNormalize: <cn={0}core>534628c3 <<< dnNormalize: <cn={0}core>534628c3 config_build_entry: "cn={0}core"534628c3 config_build_entry: "olcDatabase={-1}frontend"534628c3 config_build_entry: "olcDatabase={0}config"534628c3 config_build_entry: "olcDatabase={1}mdb"534628c3 backend_startup_one: starting "o=vtec,c=au"534628c3 mdb_db_open: "o=vtec,c=au"534628c3 mdb_db_open: database "o=vtec,c=au": dbenv_open(/data/irene/var/openldap-data-mdb).534628c3 mdb_db_open: database "o=vtec,c=au": mdb_dbi_open(/data/irene/var/openldap-data-mdb/id2e) failed: MDB_BAD_TXN: Transaction cannot recover - it must be aborted (-30782).534628c3 backend_startup_one (type=mdb, suffix="o=vtec,c=au"): bi_db_open failed! (-30782)534628c3 slapd shutdown: initiated534628c3 slapd destroy: freeing system resources.534628c3 slapd stopped.

1 0

syncrepl question
by John Timon 09 Apr '14

09 Apr '14

Hey, I hope that this is a good forum for this question, if not please feel free to tell me where to go ;) I have recently inherited an existing openldap infrastructure. The LDAP tree also stores Kerberos tickets and principals. the environment is configured with a 'master' ldap server and a bunch of 'consumer' nodes all pointing to it for syncrepl. The syncrepl looks like that olcSyncrepl: {0}rid=312 provider="ldaps://<ldap master>:636/" type=refreshAndPersist interval="00:00:01:00" retry="60 30 300 +" searchbase="<base dn>" bi ndmethod=sasl saslmech=gssapi keepalive=3540:10:3 This master server needs to be decommissioned. So I have chosen one of the consumers in the environment to be the new master. And pointed all of the other consumers to use its IP in the provider field. Syncreplication appears to be working as expected. However the new master still has the original in its provider field. Is the process of promoting this new node to 'master' as simple as stopping slapd, removing the olcSyncRepl line from the hdb.ldif file and restarting slapd? Or is this more to it, I am assuming more to it, but I can't seem to verify that suspicion. Thanks -- JT Experience is what you get when you didn't get what you wanted.

1 0

回复： mirror mode question
by Eileen(=^ω^=) 09 Apr '14

09 Apr '14

Hi Michael and Dieter, Thanks for your kindly replies. In my case, I didn't use any SASL or TLS but "simple" method with operation mode of user/password authenticated. However, I need the rootpw hashed (not cleartext) and the 2 servers (master & slave) synchronized. Could you pls advise how i should modify the syncrepl part? or could you pls provide a sample of the slapd.conf file configuration? Best regards, Eileen ------------------ 原始邮件 ------------------ 发件人: "Michael Ströder";<michael(a)stroeder.com>; 发送时间: 2014年3月5日(星期三) 下午4:09 收件人: "Dieter Klünter"<dieter(a)dkluenter.de>; "openldap-technical"<openldap-technical(a)openldap.org>; 主题: Re: mirror mode & sasl question Dieter Klünter wrote: > Am Wed, 5 Mar 2014 14:38:04 +0800 > schrieb "Eileen(=^ω^=)" <123784635(a)qq.com>: >> This is Eileen from China SINAP. I am a beginner for openldap soft. I >> encountered a problem in my study on two LDAP services replication. >> I have 2 LDAP services, one name LDPA1, the other is LDAP2 . I want >> to make them synchronously in mirror mode. But when I set LDAP >> services rootpw both in hash, the 2 LDAP serivces can’t be >> synchronous. My question is >> 1. if I set my rootpw in hash, my bindmethod must be SASL? If I >> must use sasl method, can I put the sasl service in the same ldap >> service? If bindmethod=sasl then what is the saslmech should be? >> 2. If I change to sasl method, do I need change my database >> record? > > In order to use sasl, passwords must be cleartext and you should > configure an apropriate authz-regexp, see man slapd.conf(5) > You may use any sasl mechanism that you sasl framework provides. > [...] To be more precise: In order to use password-based SASL mechs the passwords have to be stored in clear-text. Well, if working with SASL and TLS (LDAPS, StartTLS) one should consider using client certs and SASL/EXTERNAL for replication. Ciao, Michael.

4 7

help with cn=config and rwm
by Alex Samad - Yieldbroker 09 Apr '14

09 Apr '14

Hi Wondering what an example rwm overlay module would look like in cn=config Trying to apply to a msad ldap backend I would like to change group to groupOfUniqueNames and attributr member to uniqueMember Thanks

1 0

dnNormalize with subsequent dnMatch on do_syncrep
by Daniel Jung 08 Apr '14

08 Apr '14

Hi, Running 2.4.37 with mdb backend. Recently I ran one of our test LDAP instance a olcLogLevel with strace and noticed the following in the log: pr 7 00:10:16 servername.com slapd[15271]: connection_get(12) Apr 7 00:10:16 servername.com slapd[15271]: connection_get(12): got connid=0 Apr 7 00:10:16 servername.com slapd[15271]: =>do_syncrepl rid=405 Apr 7 00:10:16 servername.com slapd[15271]: =>do_syncrep2 rid=405 all the entries are being normalized, 75911 Apr 7 00:05:16 servername.com slapd[15271]: >>> dnNormalize: <uid=someone,ou=People,dc=example,dc=com> 75912 Apr 7 00:05:16 servername.com slapd[15271]: <<< dnNormalize: <uid=someone2,ou=people,dc=example,dc=com> 75913 Apr 7 00:05:16 servername.com slapd[15271]: dnMatch 6 75914 Apr 7 00:05:16 servername.com slapd[15271]: dnMatch -6 75915 Apr 7 00:05:16 servername.com slapd[15271]: dnMatch -1 for each of db_syncrep2 action, could this be related to the ITS#7741? Thanks

1 0

unicodePwd
by Jean-Marc Choulet 03 Apr '14

03 Apr '14

Hello, I want to convert my client (ADSI and C++) for use OpenLDAP. I know I must encode the unicodePwd. With ADSI, Miscrosoft give me some functions to do that. How can I do same things from OpenLDAP ? Thanks, Jean-Michel

3 3

Converting from slapd.d back to slapd.conf
by Sven Jourgensen 03 Apr '14

03 Apr '14

Is there a tool to perform the reverse operation, and convert the newer cn=config configuration back into a slapd.conf? Thanks. s.

9 17

LDAPS: ldapsearch working, back-ldap failing?
by Mitchell Im 03 Apr '14

03 Apr '14

Hi there, After several hours of beating on this (including multiple searches over the general internet and the mailing list), I've hit a dead end. So, I've decided to ask the experts, since it may require poking idassert-bind, which is pretty opaque to me (I can only partially understand the man page). Here's the problem: I'm setting up OpenLDAP as a proxy to another LDAP server (Active Directory, if it matters). I'm able to perform an ldapsearch against the backend LDAP server via ldaps://. The OpenLDAP proxy works if it connects to the backend LDAP server via ldap://. The OpenLDAP proxy does *not* work if it connects to the backend LDAP server via ldaps://, though. What am I missing? This is on CentOS 6.5, packages openldap-servers-2.4.23-34.el6_5.1.x86_64, nss-3.15.3-6.el6_5.x86_64 (Red Hat's decision). ======================================== * Backend LDAP server, ldaps:// $ ldapsearch -x -W -D 'cn=bindbot,cn=users,dc=domain,dc=local' -H ldaps://ad.domain.local -b 'dc=domain,dc=local' 'uid=bindbot' Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=domain,dc=local> with scope subtree # filter: uid=bindbot # requesting: ALL # # BindBot, Users, domain.local dn: CN=BindBot,CN=Users,DC=domain,DC=local ... .. . ======================================== * OpenLDAP server, connecting to the backend via ldap:// $ ldapsearch -x -W -D 'cn= bindbot,cn=users,dc=domain,dc=local' -H ldaps://openldap.domain.local -b 'dc=domain,dc=local' 'uid=bindbot' Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=domain,dc=local> with scope subtree # filter: uid=bindbot # requesting: ALL # # BindBot, Users, domain.local dn: cn=BindBot,cn=Users,dc=domain,dc=local ... .. . ======================================== * OpenLDAP server, connecting to the backend via ldaps:// (adding only the s to olcDbURI's ldap:// connection) $ ldapsearch -x -W -D 'cn= bindbot,cn=users,dc=domain,dc=local' -H ldaps://openldap.domain.local -b 'dc=domain,dc=local' 'uid=bindbot' Enter LDAP Password: ldap_bind: Server is unavailable (52) additional info: Proxy operation retry failed ======================================== * LDIF specifying the backend: dn: olcDatabase={2}ldap objectClass: olcDatabaseConfig objectClass: olcLDAPConfig olcDatabase: {2}ldap olcSuffix: cn=users,dc=domain,dc=local olcSubordinate: TRUE olcAccess: {0}to dn.subtree="dc=domain,dc=local" by * read olcDbURI: "ldap://ad.domain.local" olcDbIDAssertBind: bindmethod=simple binddn="cn=bindbot,cn=users,dc=domain,dc= local" credentials="********" tls_cacert=/etc/openldap/certs/ad.crt olcDbIDAssertAuthzFrom: * olcDbRebindAsUser: TRUE ======================================== * Snippet of /var/log/ldaplog (olcLogLevel 65535): Mar 30 21:21:37 openldap slapd[14645]: daemon: activity on 1 descriptor Mar 30 21:21:37 openldap slapd[14645]: daemon: activity on: Mar 30 21:21:37 openldap slapd[14645]: Mar 30 21:21:37 openldap slapd[14645]: slap_listener_activate(9): Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=7 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=8 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=9 busy Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=10 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=11 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: >>> slap_listener(ldaps:///) Mar 30 21:21:37 openldap slapd[14645]: daemon: listen=9, new connection on 15 Mar 30 21:21:37 openldap slapd[14645]: daemon: activity on 1 descriptor Mar 30 21:21:37 openldap slapd[14645]: daemon: activity on: Mar 30 21:21:37 openldap slapd[14645]: Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=7 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=8 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=9 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=10 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=11 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: added 15r (active) listener=(nil) Mar 30 21:21:37 openldap slapd[14645]: daemon: activity on 1 descriptor Mar 30 21:21:37 openldap slapd[14645]: daemon: activity on: Mar 30 21:21:37 openldap slapd[14645]: conn=1000 fd=15 ACCEPT from IP=10.0.0.202:40342 (IP=0.0.0.0:636) Mar 30 21:21:37 openldap slapd[14645]: Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=7 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=8 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=9 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=10 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=11 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: activity on 1 descriptor Mar 30 21:21:37 openldap slapd[14645]: daemon: activity on: Mar 30 21:21:37 openldap slapd[14645]: 15r Mar 30 21:21:37 openldap slapd[14645]: Mar 30 21:21:37 openldap slapd[14645]: daemon: read active on 15 Mar 30 21:21:37 openldap slapd[14645]: connection_get(15) Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=7 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=8 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: connection_get(15): got connid=1000 Mar 30 21:21:37 openldap slapd[14645]: connection_read(15): checking for input on id=1000 Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=9 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=10 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=11 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: activity on 1 descriptor Mar 30 21:21:37 openldap slapd[14645]: daemon: activity on: Mar 30 21:21:37 openldap slapd[14645]: Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=7 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=8 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=9 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=10 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=11 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: activity on 1 descriptor Mar 30 21:21:37 openldap slapd[14645]: daemon: activity on: Mar 30 21:21:37 openldap slapd[14645]: 15r Mar 30 21:21:37 openldap slapd[14645]: Mar 30 21:21:37 openldap slapd[14645]: daemon: read active on 15 Mar 30 21:21:37 openldap slapd[14645]: connection_get(15) Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=7 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=8 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=9 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=10 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=11 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: connection_get(15): got connid=1000 Mar 30 21:21:37 openldap slapd[14645]: connection_read(15): checking for input on id=1000 Mar 30 21:21:37 openldap slapd[14645]: connection_read(15): unable to get TLS client DN, error=49 id=1000 Mar 30 21:21:37 openldap slapd[14645]: conn=1000 fd=15 TLS established tls_ssf=256 ssf=256 Mar 30 21:21:37 openldap slapd[14645]: daemon: activity on 1 descriptor Mar 30 21:21:37 openldap slapd[14645]: daemon: activity on: Mar 30 21:21:37 openldap slapd[14645]: Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=7 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=8 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=9 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=10 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=11 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: activity on 1 descriptor Mar 30 21:21:37 openldap slapd[14645]: daemon: activity on: Mar 30 21:21:37 openldap slapd[14645]: 15r Mar 30 21:21:37 openldap slapd[14645]: Mar 30 21:21:37 openldap slapd[14645]: daemon: read active on 15 Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=7 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=8 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=9 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=10 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=11 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: connection_get(15) Mar 30 21:21:37 openldap slapd[14645]: connection_get(15): got connid=1000 Mar 30 21:21:37 openldap slapd[14645]: connection_read(15): checking for input on id=1000 Mar 30 21:21:37 openldap slapd[14645]: op tag 0x60, time 1396239697 Mar 30 21:21:37 openldap slapd[14645]: daemon: activity on 1 descriptor Mar 30 21:21:37 openldap slapd[14645]: daemon: activity on: Mar 30 21:21:37 openldap slapd[14645]: Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=7 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=8 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=9 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=10 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=11 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: conn=1000 op=0 do_bind Mar 30 21:21:37 openldap slapd[14645]: >>> dnPrettyNormal: <cn=bindbot,cn=users,dc=domain,dc=local> Mar 30 21:21:37 openldap slapd[14645]: <<< dnPrettyNormal: <cn=bindbot,cn=users,dc=domain,dc=local>, <cn=bindbot,cn=users,dc=domain,dc=local> Mar 30 21:21:37 openldap slapd[14645]: conn=1000 op=0 BIND dn="cn=bindbot,cn=users,dc=domain,dc=local" method=128 Mar 30 21:21:37 openldap slapd[14645]: do_bind: version=3 dn="cn=bindbot,cn=users,dc=domain,dc=local" method=128 Mar 30 21:21:37 openldap slapd[14645]: [rw] bindDN: "cn=bindbot,cn=users,dc=domain,dc=local" -> "cn=bindbot,cn=users,dc=domain,dc=local" Mar 30 21:21:37 openldap slapd[14645]: send_ldap_result: conn=1000 op=0 p=3 Mar 30 21:21:37 openldap slapd[14645]: send_ldap_result: err=52 matched="" text="Proxy operation retry failed" Mar 30 21:21:37 openldap slapd[14645]: send_ldap_response: msgid=1 tag=97 err=52 Mar 30 21:21:37 openldap slapd[14645]: conn=1000 op=0 RESULT tag=97 err=52 text=Proxy operation retry failed Mar 30 21:21:37 openldap slapd[14645]: daemon: activity on 1 descriptor Mar 30 21:21:37 openldap slapd[14645]: daemon: activity on: Mar 30 21:21:37 openldap slapd[14645]: 15r Mar 30 21:21:37 openldap slapd[14645]: Mar 30 21:21:37 openldap slapd[14645]: daemon: read active on 15 Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=7 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=8 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=9 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=10 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=11 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: connection_get(15) Mar 30 21:21:37 openldap slapd[14645]: connection_get(15): got connid=1000 Mar 30 21:21:37 openldap slapd[14645]: connection_read(15): checking for input on id=1000 Mar 30 21:21:37 openldap slapd[14645]: ber_get_next on fd 15 failed errno=0 (Success) Mar 30 21:21:37 openldap slapd[14645]: connection_read(15): input error=-2 id=1000, closing. Mar 30 21:21:37 openldap slapd[14645]: connection_closing: readying conn=1000 sd=15 for close Mar 30 21:21:37 openldap slapd[14645]: daemon: activity on 1 descriptor Mar 30 21:21:37 openldap slapd[14645]: daemon: activity on: Mar 30 21:21:37 openldap slapd[14645]: Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=7 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=8 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=9 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=10 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: daemon: epoll: listen=11 active_threads=0 tvp=zero Mar 30 21:21:37 openldap slapd[14645]: connection_close: conn=1000 sd=15 Mar 30 21:21:37 openldap slapd[14645]: =>ldap_back_conn_destroy: fetching conn 1000 Mar 30 21:21:37 openldap slapd[14645]: daemon: removing 15 Mar 30 21:21:37 openldap slapd[14645]: conn=1000 fd=15 closed (connection lost) ======================================== * Other miscellaneous information: - /etc/openldap/ldap.conf also sets TLS_CACERT, /etc/openldap/certs/ad.crt, the CA public PEM. - The "unable to get TLS client DN, error=49 id=1000" error happens whether OpenLDAP attempts to connect to the backend LDAP server via ldap:// or ldaps://. - Adding tls_reqcert=allow to olcDbIDAssertBind doesn't help. - Explicitly specifying :636 doesn't help.

2 2

Hashed Entries
by Monica Warnock 03 Apr '14

03 Apr '14

Hi Can I please ask the relevance of the results of my ldapsearch command: ldapsearch -x -LLL -b dc=/name///=/name / dn: dc=/name/__,dc=/name/// objectClass: dcObject objectClass: organization dc:: ZGxpYi1tb25pZHAg o:: ZGxpYi1tb25pZHAg dn: ou=Users,dc=/name///,dc=/name/ objectClass: organizationalUnit ou: Users dn: cn=Bob Jones,ou=Users,dc=/name///,dc=/name/ cn: Bob Jones sn: Jones objectClass: inetOrgPerson objectClass: eduPerson eduPersonAffiliation: staff userPassword:: cGFzc3dvcmQg uid: bjones When I log in as bjones using the correct password the 'username or password is not valid'. What is the relevance of the entries such as the userPassword:: which now appear with two colons? I have added more test users and on their entry the uid entry also has the double colons with a hashed entry following. Thanks in advance. Monica -- *Monica Warnock* UK Access Management Federation for Education and Research EDINA Causewayside House, 160 Causewayside, Edinburgh EH9 1PR *t:* 0131 651 7721 *f:* 0131 650 3308 *e:* monica.warnock(a)ed.ac.uk The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336.

5 6

dhcp.schema attribute dhcpStatements value in filter
by Zeus Panchenko 03 Apr '14

03 Apr '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 hi, I configured my isc-dhcpd servers to work with openldap, all works now when I want to find dn for some definite MAC or IP, I am unable to do that please, help to understand how can I ldapsearch by attribute dhcpStatements values? in dhcp.schema it is written: - ---[ quotation start ]------------------------------------------- ... attributetype ( 2.16.840.1.113719.1.203.4.3 NAME 'dhcpStatements' EQUALITY caseIgnoreIA5Match DESC 'Flexible storage for specific data depending on what object this exists in. Like conditional statements, server parameters, etc. This allows the standard to evolve without needing to adjust the schema.' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) ... - ---[ quotation end ]------------------------------------------- so, when I use filter "(&(objectClass=dhcpHost)(dhcpStatements=*))" I successfully receive all objects but lets say I need to find this object: - ---[ quotation start ]------------------------------------------- dn: cn=ap01,cn=10.0.0.0,cn=officeXXX DHCP Config,ou=officeXXX,ou=DHCP, dc=allstuff cn: ap01 objectClass: top objectClass: dhcpHost dhcpHWAddress: ethernet 20:cf:30:88:5d:18 dhcpStatements: fixed-address 10.0.0.222 - ---[ quotation end ]------------------------------------------- I use filter: "(&(objectClass=dhcpHost)(dhcpStatements=fixed-address 10.0.0.222))" and receive empty result ... it is the same picture for anything except dhcpStatements=* ... so, how is it correct to write the filter to get all objects with IP like 10.0.0.2* ? - -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET) -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAlM6y1sACgkQr3jpPg/3oyqPvQCgq6w8K53fw+6zrsSLbI72sbMR 5k8AoOh0wWlYmeQyyNKfngyMQrP3TXrt =KYZt -----END PGP SIGNATURE-----

3 9

Re: dhcp.schema attribute dhcpStatements value in filter
by Harry Jede 02 Apr '14

02 Apr '14

Zeus Panchenko wrote: > hi, > > I configured my isc-dhcpd servers to work with openldap, all works > > now when I want to find dn for some definite MAC or IP, I am unable > to do that ... > I use filter: > "(&(objectClass=dhcpHost)(dhcpStatements=fixed-address 10.0.0.222))" > > and receive empty result ... Then you make a mistake :-( $ ldapsearch -xLLL -H ldap://10.100.0.1 '(&(objectclass=dhcphost) (dhcpStatements=fixed-address 10.100.0.102))' dn dhcpStatements dn: cn=DEBIAN,ou=hosts,cn=DHCP Config,dc=europa,dc=xx dhcpStatements: fixed-address 10.100.0.102 > it is the same picture for anything except dhcpStatements=* ... > > so, how is it correct to write the filter to get all objects with IP > like 10.0.0.2* ? By default, that's not possible. You need to modify the schema to make this work. step 1: find the dhcp schema # ldapsearch -LLLY external -H ldapi:/// -b cn=schema,cn=config dn|grep dhcp dn: cn={7}dhcp,cn=schema,cn=config step2: prepare a ldapmodify input file # echo 'dn: cn={7}dhcp,cn=schema,cn=config' > /tmp/dhcp_s.ldif # echo 'changetype: modify' >> /tmp/dhcp_s.ldif # echo 'replace: olcAttributeTypes' >> /tmp/dhcp_s.ldif step 3: retrieve the attributes from cn=config # ldapsearch -LLLY external -H ldapi:/// -b cn=schema,cn=config 'cn={7}dhcp' olcAttributeTypes >> /tmp/dhcp_s.ldif step 4.1: add Substring match to dhcpStatements with an editor this I have added "SUBSTR caseIgnoreIA5SubstringsMatch" to dhcpStatements. The result is: olcAttributeTypes: {2}( 2.16.840.1.113719.1.203.4.3 NAME 'dhcpStatements' DESC 'Flexible storage for specific data depending on what object this exists in. Like conditional statements, server parameters, etc. This allows the standard to evolve without needing to adjust the schema.' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) step 4.2 remove line number 4 in my config 'dn: cn={7}dhcp,cn=schema,cn=config' step 5: update the server # ldapmodify -Y external -H ldapi:/// -f /tmp/dhcp_s.ldif step 6: be happy ;-) $ ldapsearch -xLLL -H ldap://10.100.0.1 '(&(objectclass=dhcphost) (dhcpStatements=fixed-address 10.100.0.*))' dn dhcpStatementsdn: cn=ainf-01,ou=hosts,cn=DHCP Config,dc=europa,dc=xx dhcpStatements: fixed-address 10.100.0.101 dn: cn=ainf-02,ou=hosts,cn=DHCP Config,dc=europa,dc=xx dhcpStatements: fixed-address 10.100.0.103 dhcpStatements: filename "pxelinux.0" dhcpStatements: next-server 10.100.0.1 dhcpStatements: broadcast-address 10.100.255.255 dn: cn=ainf-22,ou=hosts,cn=DHCP Config,dc=europa,dc=xx dhcpStatements: fixed-address 10.100.0.104 dn: cn=DEBIAN,ou=hosts,cn=DHCP Config,dc=europa,dc=xx dhcpStatements: fixed-address 10.100.0.102 hints: 1. modify an objectclass this way, will not work 2. an index on dhcpStatements is not required to make this work perhaps good for performance reasons 3. try it first on a test server :-) -- Harry Jede

2 2

Volunteers for Linuxtag 2014
by Dieter Klünter 02 Apr '14

02 Apr '14

Hi, The OpenLDAP Project will be present at Linuxtag 2014 in Berlin http://linuxtag.org/2014/ I am looking for volunteers to support the OpenLDAP booth. Prospective volunteers may contact me. -Dieter -- Dieter Klünter | Systemberatung http://sys4.de GPG Key ID: E9ED159B 53°37'09,95"N 10°08'02,42"E

1 0

Re: Changing cert paths may cause openldap to stop
by Quanah Gibson-Mount 01 Apr '14

01 Apr '14

--On Thursday, March 27, 2014 1:52 PM +0200 Nick Milas <nick(a)eurobjects.com> wrote: > Hi, > > On 2.4.39 (CentOS 5.10 x86_64), I found that if I attempt to change > certificate values but there is an error in a path, openldap stops. > > I would expect this should be avoided. Openldap should reject the > modification and not stop. > > Running the modification below, it hungs; we press Ctrl-C (and we print a > full backtrace), then we find slapd is stopped. File an ITS. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: Problem after migration openldap 2.3.43 to 2.4.23 --> 32 No Such Object
by Jonas Kellens 01 Apr '14

01 Apr '14

On 01-04-14 10:53, Terje Trane wrote: > On 01.04.2014 09:58, Jonas Kellens wrote: >> >> even if I add at the beginning of slapd.conf the following : >> >> access to * by * >> >> I still get no results with the user 'cn=U101001,ou=101001,dc=mydomain' >> >> I only get result with 'cn=Manager,dc=mydomain' >> > > Remember that ACLs are "first match used". > > If a database does not have an ACL the global ACL applies. > > But if it has a database specific ACL, that one is read first when > accessing that particular database, and the global then *only* used if > there is no match (or a control keyword like break or continue is > specified) I posted it before, but will post it again. This is the database specific ACL : database bdb suffix "dc=mydomain" rootdn "cn=Manager,dc=mydomain" rootpw {SSHA}blCAG/CNdFPY597Cf4Ssuj access to attrs=userPassword by * auth access to dn.regex="ou=tbook[12345],ou=contacten,ou=101001,dc=mydomain" attrs=children by group.exact="cn=admins,ou=101001,dc=mydomain" write by * none break access to dn.one="ou=tbook1,ou=contacten,ou=101001,dc=mydomain" by group.exact="cn=admins,ou=101001,dc=mydomain" write by group.exact="cn=tbook1,ou=gebruikers,ou=101001,dc=mydomain" read access to dn.one="ou=tbook2,ou=contacten,ou=101001,dc=mydomain" by group.exact="cn=admins,ou=101001,dc=mydomain" write by group.exact="cn=tbook2,ou=gebruikers,ou=101001,dc=mydomain" read access to dn.one="ou=tbook3,ou=contacten,ou=101001,dc=mydomain" by group.exact="cn=admins,ou=101001,dc=mydomain" write by group.exact="cn=tbook3,ou=gebruikers,ou=101001,dc=mydomain" read access to dn.one="ou=tbook4,ou=contacten,ou=101001,dc=mydomain" by group.exact="cn=admins,ou=101001,dc=mydomain" write by group.exact="cn=tbook4,ou=gebruikers,ou=101001,dc=mydomain" read access to dn.one="ou=tbook5,ou=contacten,ou=101001,dc=mydomain" by group.exact="cn=admins,ou=101001,dc=mydomain" write by group.exact="cn=tbook5,ou=gebruikers,ou=101001,dc=mydomain" read If user 'cn=U101001,ou=101001,dc=mydomain' is member of group "cn=tbook1,ou=gebruikers,ou=101001,dc=mydomain", wouldn't you agree that it should be able to read the entries in dn "ou=tbook1,ou=contacten,ou=101001,dc=mydomain" ?? Kind regards, Jonas.

4 6

RE: Slave not able to update master pwdFailureTime via chain.
by serpent6877 01 Apr '14

01 Apr '14

Anyone else have an answer for this? Thanks, Brad -------- Original message -------- From: Brad dameron <serpent6877(a)hotmail.com> Date:03/24/2014 8:36 AM (GMT-08:00) To: Esteban Pereira <esteban.pereira(a)gepsit.fr>,openldap-technical(a)openldap.org Subject: RE: Slave not able to update master pwdFailureTime via chain. >From what I read I need to setup authzTo. But having problems understanding what I need to set in the slaps.conf and on the allowed user. -------- Original message -------- From: Esteban Pereira <esteban.pereira(a)gepsit.fr> Date:03/20/2014 10:55 AM (GMT-08:00) To: Brad dameron <serpent6877(a)hotmail.com>,openldap-technical(a)openldap.org Subject: Re: Slave not able to update master pwdFailureTime via chain. I've never configured this kind of architecture, but as far as I know the ppolicy, I think my first thought configuring this would have been to not rebind as user because the attribute modified is an operational one which need the manage right (not sure about that) So I should have configured this with the replication user with manage right and without rebinding as a user when chaining to the master. Hope this help On Thu, Mar 20, 2014 at 6:14 PM, Brad dameron <serpent6877(a)hotmail.com>wrote: > I understand what you are saying. But this is what the > ppolicy_forward_updates says: > > ppolicy_forward_updates > Specify that policy state changes that result from Bind operations (such as recording > failures, lockout, etc.) on a consumer should be forwarded to a master instead of > being written directly into the consumer’s local database. This setting is only use‐ > ful on a replication consumer, and also requires the updateref setting and chain > overlay to be appropriately configured. > > So when a password failure occurs "pwdFailureTime" it relays it to the master as the user doing a MOD > from what I have seen in my logs. And thus the user doesn't have access to modify this attribute. > > Brad > > > > ------------------------------ > Date: Thu, 20 Mar 2014 12:13:02 +0100 > Subject: Re: Slave not able to update master pwdFailureTime via chain. > From: esteban.pereira(a)gepsit.fr > To: serpent6877(a)hotmail.com > CC: openldap-technical(a)openldap.org > > > Hi Brad, > > pwdFailureTime is an operational attribute, I don't think any user can > modify it on any instance. May be you should try to modify it on the master > to see if it comes from this assumption. > > Esteban > > > On Thu, Mar 20, 2014 at 11:33 AM, Brad dameron <serpent6877(a)hotmail.com>wrote: > > OpenLDAP 2.4.23-26 on CentOS 5. I am trying to get the pwdFailureTime > updated on the master when the slave recieves a password failure. Here is > my config. It's pretty simple and basic. No TLS. > > Master: > > access to attrs=userPassword > by group.exact="cn=ldapadmins,ou=Groups,dc=test,dc=net" write > by dn.exact="cn=replication,dc=test,dc=net" read > by self write > by anonymous auth > by * none > access to * > by group.exact="cn=ldapadmins,ou=Groups,dc=test,dc=net" write > by dn.exact="cn=replication,dc=test,dc=net" write > by self write > by users read > by anonymous read > by * none > > > > Slave: > > overlay chain > chain-uri ldap://172.16.0.84:389 > chain-rebind-as-user TRUE > chain-idassert-bind bindmethod=simple > binddn="cn=replication,dc=test,dc=net" > credentials="MyPasswd" > mode="self" > chain-return-error TRUE > > # Password Policy > overlay ppolicy > ppolicy_default "cn=default,ou=Policies,dc=test,dc=net > ppolicy_use_lockout > ppolicy_forward_updates > > > # Slave Replication > syncrepl rid=101 > provider=ldap://172.16.0.84:389 > type=refreshAndPersist > interval=00:00:01:00 > retry="60 10 300 +" > searchbase="dc=test,dc=net" > schemachecking=off > bindmethod=simple > binddn="cn=replication,dc=test,dc=net" > credentials="MyPasswd" > updateref "ldap://172.16.0.84:389" > > > > I see the connection on the master but it gives a permission error: > > > Mar 20 09:47:46 LDAP-RADIUS-1 slapd[14288]: conn=1124 op=3 MOD > dn="cn=testuser,ou=People,dc=test,dc=net" > Mar 20 09:47:46 LDAP-RADIUS-1 slapd[14288]: conn=1124 op=3 MOD > attr=pwdFailureTime > Mar 20 09:47:46 LDAP-RADIUS-1 slapd[14288]: conn=1124 op=3 RESULT tag=103 > err=50 text= > > > I read that you maybe need authzTo added to the binddn for the chain? Or > is this only for TLS? > > I tried adding this ldif: > > dn: cn=replication,dc=test,dc=net > changetype: modify > add: authzTo > authzTo: * > > And even set the: > > chain-idassert-authzFrom "*" > > in the chain. But it always gives me the error code 50 not enough > permissions. I believe it is supposed to give access to the user to MOD the > pwdFailureTime tribute knowing it is coming from a relay. But I can't find > very specific docs on this or see what is wrong. Any help apreciated. > > Thanks, > Brad > > >

2 1

openldap for fedora
by Brendan Kearney 30 Mar '14

30 Mar '14

i hope to be getting some new machines and updating/upgrading my ldap instances in the process. i am looking to use the ltb-project.org rpms for the install, but have a couple of questions. first, i do not see any fedora versions in the repo. only redhat 5 and 6. are these packages binary compatible with fedora? second, it seems that the packages use the Sys V Init style, as i am sure the RH servers still use. although that is supported for legacy compatibility in fedora, does the new systemd init style work with these packages? third, is a package for fedora versions available through the ltb-project site? thank you, brendan

2 1

What is the replacement for /etc/ldap.conf?
by Peng Yu 30 Mar '14

30 Mar '14

Hi, http://ubuntuforums.org/showthread.php?t=1421998 The above link mentioned the following code. But /etc/ldap.conf is not available on ubuntu 13.10. Does anybody know what I should do instead? Thanks. sudo echo "index sudoUser eq" >> /etc/ldap.conf -- Regards, Peng

4 3

Why "ldapadd -x -D cn=admin, cn=config -W -f ~/sudoWork/cn\=sudo.ldif" does not work?
by Peng Yu 29 Mar '14

29 Mar '14

Hi, I followed the following instructions. http://ubuntuforums.org/showthread.php?t=1421998 I get the following error. pengy@openldapserver:~$ ldapadd -x -D cn=admin,cn=config -W -f ~/sudoWork/cn\=sudo.ldif Enter LDAP Password: ldap_bind: Invalid credentials (49) Here is the log. Does anybody know what the log means and how to fix the problem? Thanks. pengy@openldapserver:~$ tail -n 5 /var/log/syslog Mar 28 22:20:07 openldapserver slapd[972]: conn=1460 fd=21 ACCEPT from IP=127.0.0.1:47481 (IP=0.0.0.0:389) Mar 28 22:20:07 openldapserver slapd[972]: conn=1460 op=0 BIND dn="cn=admin,cn=config" method=128 Mar 28 22:20:07 openldapserver slapd[972]: conn=1460 op=0 RESULT tag=97 err=49 text= Mar 28 22:20:07 openldapserver slapd[972]: conn=1460 op=1 UNBIND Mar 28 22:20:07 openldapserver slapd[972]: conn=1460 fd=21 closed -- Regards, Peng

4 6

Re: What is the default of `-b`?
by Peng Yu 29 Mar '14

29 Mar '14

How to search for everything in the ldap database (such config)? On Fri, Mar 28, 2014 at 8:31 AM, Brad Hartlove <bradley.hartlove(a)g2-inc.com> wrote: > Peng > > The default of "-b" should be whatever you have specified in your > ldap.conf configuration file. In a fresh install, without any > configuration, I do not believe it will look for any base. The "-b" flag > is used to specify the base of the tree from where you wish to begin your > search. If you also pass the "-v" flag, it will spit out the base you are > using ex:" # base <dc=somedomain,dc=com> with scope subtree". In the > ldap.conf (typically located in your /etc/opendlap directory in linux), > the directive you want to set is "BASE". It natively comes with something > that is commented out ex: #BASE dc=example,dc=com. You need to > uncomment and add the appropriate base location from where you wish to > operate. Bear in mind that this affects the behavior of all your OpenLDAP > client calls if the "-b" is not specified in the command string. > > Regards, > Brad Hartlove > > -----Original Message----- > From: openldap-technical-bounces(a)OpenLDAP.org > [mailto:openldap-technical-bounces@OpenLDAP.org] On Behalf Of Peng Yu > Sent: Thursday, March 27, 2014 4:17 PM > To: openldap-technical(a)openldap.org > Subject: What is the default of `-b`? > > Hi, > > The man page says the following. > > `-b` *searchbase* > : Use *searchbase* as the starting point for the search instead of > the default. > > I'm wondering what is the default. If I don't specify -b, I will get an > error. Does anyone know how show all the contents from the database? > Thanks. > > $ sudo ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b cn=config dn > dn: cn=config > > dn: cn=module{0},cn=config > > dn: cn=schema,cn=config > > dn: cn={0}core,cn=schema,cn=config > > dn: cn={1}cosine,cn=schema,cn=config > > dn: cn={2}nis,cn=schema,cn=config > > dn: cn={3}inetorgperson,cn=schema,cn=config > > dn: olcBackend={0}hdb,cn=config > > dn: olcDatabase={-1}frontend,cn=config > > dn: olcDatabase={0}config,cn=config > > dn: olcDatabase={1}hdb,cn=config > > $ sudo ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// dn No such object (32) > > -- > Regards, > Peng -- Regards, Peng

1 0

Re: memberof in openldap
by Howard Chu 28 Mar '14

28 Mar '14

Brad Hartlove wrote: > I get everything you said. I also understand that this may be a valid > permissions issue. If the answer is "it isn't supposed to be done and the > server will prevent that", that is what I will go with. This is not my > first dance, but if I already knew every detail of LDAP's code, I wouldn't > be on this mailing list. There is no such thing as "LDAP's code" - LDAP is a protocol definition built on a data model. There is "OpenLDAP code" and "SunDS code" etc., various other implementations of the protocol and data model. It is well documented that Sun/Netscape/RedHat/Microsoft implemented the specs incorrectly. As I have said, I am seeing this defined in > another LDAP's objectClass, so someone figured it out right, wrong, or > indifferent. I am not here to argue, so if that is what I go with, so be > it. > Brad Hartlove > > -----Original Message----- > From: Howard Chu [mailto:hyc@symas.com] > Sent: Friday, March 28, 2014 11:08 AM > To: Michael Ströder; brad.hartlove(a)g2-inc.com; > openldap-technical(a)openldap.org > Subject: Re: memberof in openldap > > Michael Ströder wrote: >> Brad Hartlove wrote: >>> The core problem is why can I not add the operational attribute to my >>> custom objectclass. >> >> Operational attributes are simply not normal user attributes. >> >> If your LDAP client is supposed to alter an attribute via LDAP it has >> to be a user attribute. Period. > > That's only a partial answer. > > Brad, the answer is "go read the LDAP spec" - operational attributes are > never part of any objectclass definition, and the server is free to use > them in any entry regardless of objectclass. > > The OpenLDAP manpages are not here to teach you the basics of LDAP. You're > expected to read the specs and know the basics of LDAP. > > -- > -- Howard Chu > CTO, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc/ > Chief Architect, OpenLDAP http://www.openldap.org/project/ > -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Syncrepl Multi-Master with multiple BDB backends
by Michael 28 Mar '14

28 Mar '14

I have two servers i'd like to setup to do MMR. I have several BDB backends that I would like to replicate. My question is do I need to create a "replicate" user for each BDB backend as well as a syncrepl statement under each BDB definition and an acl to allow the sync user to read the each BDB? Consider the slapd configuration below. Or is is possible to just setup one user with read access to all of my BDB backends and then setup just one syncrepl statement? serverID 1 ldap://txeduds1 serverID 2 ldap://txeduds2 database bdb suffix "dc=il,dc=edu,dc=com" rootdn "cn=LDAPAdmin,dc=il,dc=edu,dc=com" rootpw xxxx directory /var/lib/ldap/ldap.edu.il monitoring off syncrepl rid=001 provider=ldap://txeduds1:389 type=refreshAndPersist retry="60 10 300 +" searchbase="dc=il,dc=edu,dc=com" attrs="*,+" schemachecking=off bindmethod=simple starttls=no tls_reqcert=never binddn="cn=ilreplicator,ou=ilservice,dc=il,dc=edu,dc=com" credentials=xxxx ##Syncrepl overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 mirrormode on limits dn.exact="cn=ilreplicator,ou=ilservice,dc=il,dc=edu,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited #################################################################################### #################################################################################### access to attrs=userpassword by dn.base="cn=njreplicator,ou=njservice,dc=nj,dc=edu,dc=com read by self write by anonymous auth by * none database bdb suffix "dc=nj,dc=edu,dc=com" rootdn "cn=LDAPAdmin,dc=nj,dc=edu,dc=com" rootpw xxxx directory /var/lib/ldap/ldap.edu.nj monitoring off syncrepl rid=001 provider=ldap://txeduds1:389 type=refreshAndPersist retry="60 10 300 +" searchbase="dc=nj,dc=edu,dc=com" attrs="*,+" schemachecking=off bindmethod=simple starttls=no tls_reqcert=never binddn="cn=njreplicator,ou=njservice,dc=nj,dc=edu,dc=com" credentials=xxx ##Syncrepl overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 mirrormode on limits dn.exact="cn=njreplicator,ou=njservice,dc=nj,dc=edu,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited #################################################################################### #################################################################################### access to attrs=userpassword by dn.base="cn=gareplicator,ou=gaservice,dc=ga,dc=edu,dc=com" read by self write by anonymous auth by * none database bdb suffix "dc=ga,dc=edu,dc=com" rootdn "cn=LDAPAdmin,dc=ga,dc=edu,dc=com" rootpw xxx directory /var/lib/ldap/ldap.edu.ga syncrepl rid=001 provider=ldap://txeduds1:389 type=refreshAndPersist retry="60 10 300 +" searchbase="dc=ga,dc=edu,dc=com" attrs="*,+" schemachecking=off bindmethod=simple starttls=no tls_reqcert=never binddn="cn=gareplicator,ou=gaservice,dc=ga,dc=edu,dc=com" credentials=xxx ##Syncrepl overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 mirrormode on

2 2

cn=config replication mistake
by Ferenc Wagner 28 Mar '14

28 Mar '14

Hi, First, please let me tell you the story of my adventure yesterday. I'll summarize my questions at the end. I've set up a simple master-slave replicated system some time ago (stock Debian wheezy OpenLDAP, version 2.4.31-1+nmu2): dn: olcDatabase={0}config,cn=config olcSyncrepl: {0}rid=1 provider=ldap://elm.niif.hu [...] dn: olcDatabase={1}mdb,cn=config olcSyncrepl: {0}rid=2 provider=ldap://elm.niif.hu [...] The slave opened two connections to the master, and everything worked fine. Then I enabled TLS and put in a CNAME record, so that the master became accessible as ldaps://ldap-master.niif.hu. I decided to also switch over the replication traffic to the SSL channel, so ldapmodified the above attributes to contain provider=ldaps://ldap-master.niif.hu. This pretty much broke the system, because the master server suddenly started to replicate from itself, thus became read-only. Finding no other option, I stopped the "master" slapd and edited back the providers to their previous values (above) in the olcDatabase={0}config.ldif and olcDatabase={1}mdb.ldif files under the cn=config directory of my server configuration. I know these files should not be edited, but I found no other way. This move made the master recognized itself again in the provider URI, so it did not start replicating and became writeable. My edits, however, did not propagate to the slave, probably because I did not change the internal attributes (entryCSN?) so this was expected. Also, slapcat started to report CRC warnings in some LDIF files while dumping the databases, which was also understandable for the edited ones, but not so much for cn=config.ldif (if I remember correctly). I tried to fix these by doing some dummy changes by ldapmodify to the database entries. For both, I added an extra olcAccess attribute, then deleted it. These operations made the slave switch back its syncrepl connections to the ldap port from ldaps, but also instantly broke the slave server, which stopped returning results and instead logged lots of slapd[27944]: => mdb_idl_fetch_key: cursor failed: Invalid argument (22) lines. Having no better idea, I restarted the slave server, which fortunately returned it to normal working condition. So, my questions: 1. How does the "self-recognition" (by which the master does not start replicating from itself) work, why did it fail when I changed the provider URI to ldaps? Did using a CNAME (instead of some FQDN of the server) confuse it? Could this be fixed by adding an appropriate subjectAltName to the server TLS certificate? Or by adding some olcServerID attributes? 2. How could I have handled the read-only situation, instead of editing forbidden LDIF files? Would setting olcMirrorMode have been possible (without olcServerIDs around)? 3. Is my setup in a reliable and consistent state now, or should I expect sudden future failures? I mean, were the "cursor failed" errors fixed for good by the slave server restart? Please also feel free to educate me on any other points, as needed. :) -- Thanks, Feri.

2 2

memberof in openldap
by Brad Hartlove 28 Mar '14

28 Mar '14

I have been trying to include the memberOf attribute in a new objectClass. If I just set it to "MAY" (for example), it complains about using an operational attribute in my definition. I have seen quite a few Q&As about this, but I am really trying to understand where this issue is originating. Maybe I haven't looked at the right one yet. OpenDJ has the ability to utilize it in custom classes, so I was hoping to be able to also do the same in OpenLDAP. Thoughts?

4 5

OpenLDAP Installation and Extending Schema Walkthru
by Tim Watkins 27 Mar '14

27 Mar '14

I am somewhat knew to LDAP and have been trying to find a fully functioning WalkThru to install OpenLDAP 2.4.39 on an Ubuntu 12.04 or 13.10. After installing I would like to have the same for extending the Schema. I have tried multiple times with ones that I have found online or YouTube, but so far, everything is missing something or another. If someone has document to point me that is complete, it would be greatly appreciated! Tim

1 1

What is the default of `-b`?
by Peng Yu 27 Mar '14

27 Mar '14

Hi, The man page says the following. `-b` *searchbase* : Use *searchbase* as the starting point for the search instead of the default. I'm wondering what is the default. If I don't specify -b, I will get an error. Does anyone know how show all the contents from the database? Thanks. $ sudo ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b cn=config dn dn: cn=config dn: cn=module{0},cn=config dn: cn=schema,cn=config dn: cn={0}core,cn=schema,cn=config dn: cn={1}cosine,cn=schema,cn=config dn: cn={2}nis,cn=schema,cn=config dn: cn={3}inetorgperson,cn=schema,cn=config dn: olcBackend={0}hdb,cn=config dn: olcDatabase={-1}frontend,cn=config dn: olcDatabase={0}config,cn=config dn: olcDatabase={1}hdb,cn=config $ sudo ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// dn No such object (32) -- Regards, Peng

2 1

Re: Kerberos issue running OpenLDAP on Mac OS X Mavericks
by Dan White 27 Mar '14

27 Mar '14

Putting the email list back into the CC. On 03/20/14 10:16 -0500, Denis Ahearn wrote: >Thanks for responding Dan. We have spent the past several days taking the >information you provided and trying to get smarter about how OpenLDAP and >Kerberos work on Mac OS X Mavericks. Unfortunately we haven't made much >progress. I think it may be because the way we are trying to use OpenLDAP >is not the standard way that Apple intends it to be used from a server or >client standpoint, so there doesn't seem to be any documentation available >that speaks directly to our use case. Responses to your questions are >listed below. > >>> If you are authenticating against Active Directory, how does slapd fit >>> into the picture? > >Our Rails app authenticates using Active Directory only in staging and >production. We're using OpenLDAP (slapd) in our local development >environments to simulate this (i.e. to provide a local LDAP server that >serves the purpose that Active Directory does in production). To test >locally, we define an organization, groups and users in ldif files that get >loaded into OpenLDAP using ldapadd. > >>> Do you have an authz-regex rule mapping the authentication identity to >>> this? Can you reproduce this problem with ldapsearch/ldapwhoami, using >>> the same parameters as your ruby code? > >Are you referring to setting an authz-regex rule in slapd.conf? If so, we >do not have any authz-regex rules in our slapd.conf. I attached the >slapd.conf and ldap.conf files that are being used with OpenLDAP if that >helps. > >>> It appears your client has a kerberos ticket, and is attempting GSSAPI >>> authentication. You can verify that with klist or your OS's kerberos >>> utilities. > >I ran the klist command on the Mac that is having this issue. Output is >below: > >$ klist > >Credentials cache: API:77A8E90B-01BF-4F18-A94E-035C3AB25A59 > > Principal: dahearn(a)BWD.INT > > Issued Expires Principal > > >>> The client side Ruby code may allow you to configure a sasl mechanism. >>> If not, see ldap.conf(5) and set an appropriate LDAPSASL_MECH >>> environment variable or set SASL_MECH within your home .ldaprc file >>> (to, for instance, DIGEST-MD5). > >We tried the suggestions you listed above, none of which seemed to have any >effect on OpenLDAP's behavior (output in slapd.log is exactly the same). I'm still not clear if ruby is attempting SASL GSSAPI authentication or not. Your syslog (auth facility) may tell you that. Since you have a ticket, it's certainly possible. You can disable GSSAPI in a couple of additional ways: 1) Remove the SASL GSSAPI shared library, assuming your cyrus sasl install was compiled using shared libraries. pluginviewer (or saslpluginview) should list the mechanisms which are installed. 2) Configure a slapd.conf SASL configuration, on the server, which explicitly lists which mechanisms you wish to offer. The FAQ at: http://www.cyrussasl.org/mediawiki/index.php/FAQ details how to *enable* GSSAPI for slapd. Find out where cyrus sasl is looking for config files (e.g. /usr/lib/sasl2 or /etc/sasl2) and create a slapd.conf file with this line: mech_list: PLAIN LOGIN DIGEST-MD5 Are you performing pass-through authentication? In that case, try running saslauthd in debug mode for testing. >We are only using OpenLDAP in our development environment as a way to store >groups and users for testing purposes, and to provide an LDAP server that >our application can talk to in the same way it talks to Active Directory in >our production environment. We rely upon logic in the application (the >Ruby Devise and CanCan gems) to provide the necessary authentication and >authorization services. What I think we need to do is make OpenLDAP not >use Kerberos or other authentication mechanisms, but I haven't been able to >figure out if this is possible and if so, how to do that. Does this sound >like the way to go? If so, can you provide any assistance in setting this >up? Is there anything else I can send you to help you understand our setup? Replace the ruby authentication step with a ldapsearch/ldapwhoami call (with a -d -1 option for debugging on the client side). Or see if you can specify a debug option within Ruby (assuming it is using libldap). If you can figure out how your ruby code is connecting to the server in this way, your problem will likely stand out pretty quickly. A wireshark trace of the ruby ldap connection may help with that as well. -- Dan White

2 3

Changing cert paths may cause openldap to stop
by Nick Milas 27 Mar '14

27 Mar '14

Hi, On 2.4.39 (CentOS 5.10 x86_64), I found that if I attempt to change certificate values but there is an error in a path, openldap stops. I would expect this should be avoided. Openldap should reject the modification and not stop. Running the modification below, it hungs; we press Ctrl-C (and we print a full backtrace), then we find slapd is stopped. Please check the output below. Best regards, Nick Example: ------------------------------------------------------------------------------- Modification file: /root/work/certmod2: ------------------------------------------------------------------------------- dn: cn=config changetype: modify replace: olcTLSCACertificateFile olcTLSCACertificateFile: /usr/local/openldap/etc/openldap/certs/chain-2241.pem - replace: olcTLSCertificateFile olcTLSCertificateFile: /usr/local/openldap/etc/openldap/certs/cert-2241.pem - replace: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /usr/local/openldap/etc/openldap/certs/priv-2241.pem ------------------------------------------------------------------------------- In this case priv-2241.pem does not exist (the correct value would be: key-2241.pem). ------------------------------------------------------------------------------- Modification attempt: ------------------------------------------------------------------------------- # /usr/local/openldap/bin/ldapmodify -h localhost -x -v -W -D "cn=admin,cn=config" -f /root/work/certmod2 ldap_initialize( ldap://localhost ) Enter LDAP Password: replace olcTLSCACertificateFile: /usr/local/openldap/etc/openldap/certs/chain-2241.pem replace olcTLSCertificateFile: /usr/local/openldap/etc/openldap/certs/cert-2241.pem replace olcTLSCertificateKeyFile: /usr/local/openldap/etc/openldap/certs/priv-2241.pem modifying entry "cn=config" <it hungs and we press Ctrl-C> ldap_result: Can't contact LDAP server (-1) ------------------------------------------------------------------------------- ------------------------------------------------------------------------------- (gdb) backtrace full #0 0x00000033bf830265 in raise () from /lib64/libc.so.6 No symbol table info available. #1 0x00000033bf831d10 in abort () from /lib64/libc.so.6 No symbol table info available. #2 0x00000033bf829706 in __assert_fail () from /lib64/libc.so.6 No symbol table info available. #3 0x000000000044f66d in slap_send_ldap_result (op=0xcd75580, rs=0x2ba278651c20) at result.c:813 tmp = <value optimized out> otext = 0x2ba278650664 "" oref = 0x0 __PRETTY_FUNCTION__ = "slap_send_ldap_result" #4 0x000000000042ca7f in config_back_modify (op=0xcd75580, rs=0x2ba278651c20) at bconfig.c:5926 cfb = 0x8787a0 ce = 0xffffffff last = 0x600000000 ml = 0x6 ca = {argc = 2, argv = 0xce77200, argv_size = 513, line = 0xce75c00 "/usr/local/openldap/etc/openldap/certs/priv-2241.pem", tline = 0xc81a880 "\220d\224\f", fname = 0x5c7c99 "slapd", lineno = 0, log = "olcTLSCertificateKeyFile: value #0", '\000' <repeats 4089 times>, reply = {err = 0, msg = '\000' <repeats 255 times>}, depth = 0, valx = -1, values = {v_int = 209823808, v_uint = 209823808, v_long = 209823808, v_ulong = 209823808, v_ber_t = 209823808, v_string = 0xc81a840 "/usr/local/openldap/etc/openldap/certs/priv-2241.pem", v_bv = {bv_len = 209823808, bv_val = 0x0}, v_dn = {vdn_dn = {bv_len = 209823808, bv_val = 0x0}, vdn_ndn = {bv_len = 0, bv_val = 0x0}}, v_ad = 0xc81a840}, rvalue_vals = 0x0, rvalue_nvals = 0x0, op = 0, type = 8, ca_op = 0xcd75580, be = 0x87a520, bi = 0x0, ca_entry = 0xc81ab48, ca_private = 0xc81a280, cleanup = 0x427850 <config_tls_cleanup>, table = Cft_Global} rdn = {bv_len = 2, bv_val = 0xc81a7e0 "cn=config"} rad = 0xc7c4e90 do_pause = 1 #5 0x0000000000455ff7 in fe_op_modify (op=0xcd75580, rs=0x2ba278651c20) at modify.c:303 repl_user = <value optimized out> bd = 0x87a520 textbuf = "\005\000\000\000\000\000\000\000xZ\327\f\000\000\000\000h[\327\f\000\000\000\000\003\000\000\000\000\000\000\000\b\000\000\000\000\000\000\000\270Z\327\f\000\000\000\000P\271}\f\000\000\000\000\000\\\347\f\000\000\000\000\320[\347\f\000\000\000\000:\213E", '\000' <repeats 21 times>, "4\000\000\000\000\000\000\000\000\\\347\f\000\000\000\000\270U\327\f", '\000' <repeats 12 times>, "@\\\347\f", '\000' <repeats 12 times>"\340, \272}\f\000\000\000\000\020", '\000' <repeats 15 times>"\304, XE\000\000\000\000\000\340:\306\f\000\000\000\000\000\001\000\000\000\000\000\000\320\032ex\242+\000\000@\034ex\242+\000\000\200U\327\f\000\000\000\000\001\000\000\000\000\000\000\000\270U\327\f\000\000\000\000\250U\327\f\000\000\000\000\340:\306\f\000\000\000\000\251\063"... #6 0x0000000000456762 in do_modify (op=0xcd75580, rs=0x2ba278651c20) at modify.c:177 dn = {bv_len = 9, bv_val = 0xcd75459 "cn=config"} textbuf = "\000\b\000\000\000\000\000\000\000\001\000\000\000\000\000\000 \000\000\000\000\000\000\000\004", '\000' <repeats 15 times>"\377, \017\000\000\000\000\000\000\260\005\002", '\000' <repeats 14 times>"\360, \377\377\377\377\377\377\000\000\000\000~", '\000' <repeats 27 times>"\271, \312\065\062\"", '\000' <repeats 11 times>"\340, I\265\277\063\000\000\000\000\000\020\000\000\000\000\000\000\000\020\000\000\000\000\000\001\000\000\000\000\000\000\000\340:\306\f\000\000\000\000\000\000\020\000\000\000\000\000\236@\207\277\063", '\000' <repeats 13 times>, "\020\000\000\000\000\000p\035ex\242+\000\000Mc[\000\000\000\000\000\000\000\020\000\000\000\000\000\373\210E\000\000\000\000\000\001\000\000\000\000\000\000\000\330\002I\000\000\000\000\000\200U\327\f\000\000\000\000]\226F\---Type <return> to continue, or q <return> to quit--- 000\000\000\000" tmp = 0x0 #7 0x000000000043f0d5 in connection_operation (ctx=0x2ba278651d70, arg_v=<value optimized out>) at connection.c:1155 rc = <value optimized out> cancel = <value optimized out> op = 0xcd75580 rs = {sr_type = REP_RESULT, sr_tag = 0, sr_msgid = 0, sr_err = -1, sr_matched = 0x0, sr_text = 0x2ba278650664 "", sr_ref = 0x0, sr_ctrls = 0x0, sr_un = {sru_search = {r_entry = 0x0, r_attr_flags = 0, r_operational_attrs = 0x0, r_attrs = 0x0, r_nentries = 0, r_v2ref = 0x0}, sru_sasl = { r_sasldata = 0x0}, sru_extended = {r_rspoid = 0x0, r_rspdata = 0x0}}, sr_flags = 0} tag = 102 opidx = SLAP_OP_MODIFY conn = 0xc9c2d20 memctx = 0xcc63ae0 memctx_null = 0x0 __PRETTY_FUNCTION__ = "connection_operation" #8 0x000000000043f6af in connection_read_thread (ctx=0x2ba278651d70, argv=<value optimized out>) at connection.c:1291 s = 12 #9 0x000000000058d92c in ldap_int_thread_pool_wrapper (xpool=0xc7c8430) at tpool.c:688 task = 0xcd752f0 work_list = <value optimized out> ctx = {ltu_id = 47976804591936, ltu_key = {{ltk_key = 0x43e040, ltk_data = 0xcd75950, ltk_free = 0x43e110 <conn_counter_destroy>}, { ltk_key = 0x48ff50, ltk_data = 0xcc63ae0, ltk_free = 0x48ff70 <slap_sl_mem_destroy>}, {ltk_key = 0x0, ltk_data = 0x0, ltk_free = 0} <repeats 30 times>}} kctx = <value optimized out> keyslot = 435 hash = <value optimized out> __PRETTY_FUNCTION__ = "ldap_int_thread_pool_wrapper" #10 0x00002ba23235583d in start_thread () from /lib64/libpthread.so.0 No symbol table info available. #11 0x00000033bf8d526d in clone () from /lib64/libc.so.6 No symbol table info available. -------------------------------------------------------------------------------

1 0

Failure in 2.4.32: similar experiences?
by Nick Urbanik 27 Mar '14

27 Mar '14

Dear Folks, We have some moderately busy OpenLDAP servers, OpenLDAP 2.4.32 running on CentOS 5.8 on HP BL495cG6 blades, with 24GB RAM, in a cluster of four, using LVS to balance the load. They peak at just over 3000 LDAP connections per second. They stopped serving requests, or at least, began serving them so slowly that they caused an outage. After my colleague restarted slapd, they resumed serving the requests. slapd didn't die, or dump core. Sadly, since the most minimal logging produces 25GB per day, so we have that turned off, and after the event, I now am graphing some of the statistics from the monitor database, though that provides less detail than I would wish. My questions: ============= Has anyone had a similar experience of failure with this version of OpenLDAP specifically, or with any other version? Has anyone any suggestions on what might have happened? I am upgrading LDAP to 2.4.39, but would like to know if there is a known problem that I will resolve by this upgrade. Here is a "sanitised" view of our configuration: # slapd.conf generated by /usr/bin/conform include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/local.schema include /etc/openldap/schema/prefs.schema loglevel stats allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args tool-threads 8 password-hash {CRYPT} password-crypt-salt-format "$1$%.8s" TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt TLSCertificateFile /etc/openldap/ldap.syd.crt TLSCertificateKeyFile /etc/openldap/ldap.syd.key ############################################################ # GLOBAL database definition ############################################################ access to dn.base="" by peername.ip=133.3.193.2 read by peername.ip=19.21.201.10 read by * read access to dn.base="cn=Subschema" by * read ############################################################ # ou=tree1,ou=name database definition ############################################################ database bdb suffix "ou=tree1,ou=name" rootdn cn=manager,ou=tree1,ou=name rootpw root-password directory /var/lib/ldap/ou=tree1,ou=name index domain eq,pres index entryCSN eq index entryUUID eq index mail eq,pres index objectClass eq index uid eq,pres shm_key 331 cachesize 100000 idlcachesize 100000 checkpoint 32768 30 idletimeout 3600 writetimeout 90000 access to dn.base="ou=tree1,ou=name" by peername.ip=96.76.69.162 read by * none break access to dn.subtree="ou=tree1,ou=name" by dn.base="cn=Reader,ou=tree1,ou=name" read by peername.ip=205.191.75.42 read by peername.ip=198.132.212.127 read by peername.ip=101.169.45.146 read by peername.ip=212.38.134.82 read by peername.ip=127.0.0.1 read by peername.ip=49.15.162.36 read by peername.ip=142.226.69.215 read by peername.ip=236.107.103.158 read by peername.ip=57.167.92.229 read by peername.ip=138.57.161.36 read by peername.ip=99.33.110.154 read by peername.ip=196.119.159.149 read by peername.ip=44.116.9.128 read by peername.ip=122.234.222.27 read by self peername.ip=154.238.170.210 read by self peername.ip=31.62.15.241 read by self peername.ip=163.226.124.118 read by self peername.ip=92.190.127.61 read by self peername.ip=125.225.28.232 read by self peername.ip=122.148.131.239 read by self peername.ip=118.160.216.124 read by self peername.ip=74.226.71.41 read by self peername.ip=179.149.175.90 read by self peername.ip=235.160.10.186 read by self peername.ip=125.80.123.119 read by self peername.ip=185.5.66.203 read by self peername.ip=158.224.9.61 read by self peername.ip=46.146.95.97 read by self peername.ip=6.182.235.60 read by self peername.ip=7.137.32.196 read by self peername.ip=204.184.227.24 read by self peername.ip=56.10.14.169 read by self peername.ip=165.49.58.78 read by self peername.ip=165.211.155.235 read by self peername.ip=119.216.126.40 read by self peername.ip=94.212.46.227 read by self peername.ip=210.225.203.227 read by self peername.ip=171.235.159.67 read by self peername.ip=28.94.19.93 read by self peername.ip=206.12.128.149 read by self peername.ip=18.223.36.165 read by self peername.ip=35.164.112.79 read by self peername.ip=145.100.109.232 read by self peername.ip=10.230.19.137 read by self peername.ip=86.124.99.133 read by self peername.ip=56.223.60.177 read by self peername.ip=140.114.55.210 read by self peername.ip=216.13.135.39 read by self peername.ip=5.93.220.80 read by self peername.ip=87.215.35.140 read by self peername.ip=162.101.170.221 read by self peername.ip=100.59.12.102 read by self peername.ip=58.223.90.131 read by self peername.ip=124.165.37.123 read by self peername.ip=11.178.120.42 read by self peername.ip=99.205.107.56 read by self peername.ip=31.26.172.88 read by self peername.ip=211.133.184.38 read by self peername.ip=84.215.59.209 read by self peername.ip=13.70.104.6 read by self peername.ip=111.100.110.74 read by self peername.ip=190.199.36.1 read by self peername.ip=236.212.185.240 read by self peername.ip=180.4.69.152 read by self peername.ip=38.63.162.124 read by self peername.ip=68.34.84.216 read by self peername.ip=43.41.142.100 read by self peername.ip=118.225.164.10 read by self peername.ip=40.26.24.236 read by self peername.ip=197.161.148.167 read by self peername.ip=148.163.210.9 read by self peername.ip=161.141.31.120 read by self peername.ip=85.59.211.7 read by self peername.ip=237.59.225.239 read by self peername.ip=29.114.216.84 read by anonymous auth by * none break syncrepl rid=001 provider=ldap://master:389 type=refreshAndPersist bindmethod=simple binddn=cn=syncrepl,ou=tree1,ou=name credentials=syncrepl-password searchbase="ou=tree1,ou=name" retry="5 10 60 +" ############################################################ # ou=tree2,ou=name database definition ############################################################ database bdb suffix "ou=tree2,ou=name" rootdn cn=manager,ou=tree2,ou=name rootpw root-password directory /var/lib/ldap/ou=tree2,ou=name index avcid eq index entryCSN eq index entryUUID eq index gsid eq index objectClass eq shm_key 320 cachesize 100000 idlcachesize 100000 checkpoint 32768 30 idletimeout 3600 writetimeout 90000 access to dn.base="ou=tree2,ou=name" by peername.ip=1.224.5.235 read by * none break access to dn.subtree="ou=tree2,ou=name" by dn.base="cn=Reader,ou=tree2,ou=name" read by peername.ip=124.182.243.237 read by peername.ip=73.200.132.164 read by peername.ip=5.106.199.123 read by peername.ip=243.60.43.234 read by peername.ip=127.0.0.1 read by anonymous auth by * none break syncrepl rid=010 provider=ldap://master:389 type=refreshAndPersist bindmethod=simple binddn=cn=syncrepl,ou=tree2,ou=name credentials=syncrepl-password searchbase="ou=tree2,ou=name" retry="5 10 60 +" ############################################################ # ou=tree3,ou=name database definition ############################################################ database bdb suffix "ou=tree3,ou=name" rootdn cn=manager,ou=tree3,ou=name rootpw root-password directory /var/lib/ldap/ou=tree3,ou=name index entryCSN eq index entryUUID eq index fnn eq index lineid eq index objectClass eq index serviceid eq index ullsid eq shm_key 74 cachesize 100000 idlcachesize 100000 checkpoint 32768 30 idletimeout 3600 writetimeout 90000 access to dn.base="ou=tree3,ou=name" by peername.ip=100.131.166.211 read by * none break access to dn.subtree="ou=tree3,ou=name" by dn.base="cn=Reader,ou=tree3,ou=name" read by peername.ip=39.236.93.167 read by peername.ip=48.145.97.90 read by peername.ip=143.186.10.231 read by peername.ip=35.68.19.116 read by peername.ip=127.0.0.1 read by anonymous auth by * none break syncrepl rid=008 provider=ldap://master:389 type=refreshAndPersist bindmethod=simple binddn=cn=syncrepl,ou=tree3,ou=name credentials=syncrepl-password searchbase="ou=tree3,ou=name" retry="5 10 60 +" ############################################################ # ou=tree4,ou=name database definition ############################################################ database bdb suffix "ou=tree4,ou=name" rootdn cn=manager,ou=tree4,ou=name rootpw root-password directory /var/lib/ldap/ou=tree4,ou=name index cn eq index entryCSN eq index entryUUID eq index objectClass eq shm_key 195 cachesize 100000 idlcachesize 100000 checkpoint 32768 30 idletimeout 3600 writetimeout 90000 access to dn.base="ou=tree4,ou=name" by peername.ip=26.233.142.132 read by * none break access to dn.subtree="ou=tree4,ou=name" by dn.base="cn=Reader,ou=tree4,ou=name" read by peername.ip=127.0.0.1 read by anonymous auth by * none break access to dn.subtree="" by peername.ip=101.156.205.102 read by peername.ip=136.25.130.235 read by peername.ip=136.206.49.17 read by peername.ip=37.21.18.99 read by * none break syncrepl rid=002 provider=ldap://master:389 type=refreshAndPersist bindmethod=simple binddn=cn=syncrepl,ou=tree4,ou=name credentials=syncrepl-password searchbase="ou=tree4,ou=name" retry="5 10 60 +" ############################################################ # ou=tree5,ou=name database definition ############################################################ database bdb suffix "ou=tree5,ou=name" rootdn cn=manager,ou=tree5,ou=name rootpw root-password directory /var/lib/ldap/ou=tree5,ou=name index entryCSN eq index entryUUID eq index gsid eq index objectClass eq index uid eq shm_key 626 cachesize 100000 idlcachesize 100000 checkpoint 32768 30 idletimeout 3600 writetimeout 90000 access to dn.base="ou=tree5,ou=name" by peername.ip=225.143.210.78 read by * none break access to dn.subtree="ou=tree5,ou=name" by dn.base="cn=Reader,ou=tree5,ou=name" read by peername.ip=106.154.145.84 read by peername.ip=197.28.75.183 read by peername.ip=179.151.185.161 read by peername.ip=4.60.182.12 read by peername.ip=127.0.0.1 read by anonymous auth by * none break syncrepl rid=011 provider=ldap://master:389 type=refreshAndPersist bindmethod=simple binddn=cn=syncrepl,ou=tree5,ou=name credentials=syncrepl-password searchbase="ou=tree5,ou=name" retry="5 10 60 +" ############################################################ # ou=tree6,ou=name database definition ############################################################ database bdb suffix "ou=tree6,ou=name" rootdn cn=manager,ou=tree6,ou=name rootpw root-password directory /var/lib/ldap/ou=tree6,ou=name index entryCSN eq index entryUUID eq index objectClass eq index uid eq index username eq shm_key 290 cachesize 100000 idlcachesize 100000 checkpoint 32768 30 idletimeout 3600 writetimeout 90000 access to dn.base="ou=tree6,ou=name" by peername.ip=195.44.90.201 read by * none break access to dn.subtree="ou=tree6,ou=name" by dn.base="cn=Reader,ou=tree6,ou=name" read by peername.ip=131.55.25.176 read by peername.ip=52.151.227.147 read by peername.ip=144.91.87.53 read by peername.ip=51.236.131.115 read by peername.ip=127.0.0.1 read by anonymous auth by * none break syncrepl rid=009 provider=ldap://master:389 type=refreshAndPersist bindmethod=simple binddn=cn=syncrepl,ou=tree6,ou=name credentials=syncrepl-password searchbase="ou=tree6,ou=name" retry="5 10 60 +" ############################################################ # ou=tree7,ou=name database definition ############################################################ database bdb suffix "ou=tree7,ou=name" rootdn cn=manager,ou=tree7,ou=name rootpw root-password directory /var/lib/ldap/ou=tree7,ou=name index entryCSN eq index entryUUID eq index objectClass eq index uid eq index username eq shm_key 105 cachesize 100000 idlcachesize 100000 checkpoint 32768 30 idletimeout 3600 writetimeout 90000 access to dn.base="ou=tree7,ou=name" by peername.ip=82.36.151.29 read by peername.ip=69.183.15.150 read by * none break access to dn.subtree="ou=tree7,ou=name" by peername.ip=81.44.61.5 read by peername.ip=75.34.88.223 read by peername.ip=40.106.122.233 read by dn.base="cn=Reader,ou=tree7,ou=name" read by peername.ip=127.0.0.1 read by anonymous auth by * none break syncrepl rid=003 provider=ldap://master:389 type=refreshAndPersist bindmethod=simple binddn=cn=syncrepl,ou=tree7,ou=name credentials=syncrepl-password searchbase="ou=tree7,ou=name" retry="5 10 60 +" ############################################################ # ou=tree8,ou=name database definition ############################################################ database bdb suffix "ou=tree8,ou=name" rootdn cn=manager,ou=tree8,ou=name rootpw root-password directory /var/lib/ldap/ou=tree8,ou=name index entryCSN eq index entryUUID eq index objectClass eq index uid eq index username eq shm_key 280 cachesize 100000 idlcachesize 100000 checkpoint 32768 30 idletimeout 3600 writetimeout 90000 access to dn.base="ou=tree8,ou=name" by peername.ip=221.195.40.138 read by * none break access to dn.subtree="ou=tree8,ou=name" by dn.base="cn=Reader,ou=tree8,ou=name" read by peername.ip=211.28.110.6 read by peername.ip=4.134.128.66 read by peername.ip=194.183.122.54 read by peername.ip=89.223.206.194 read by peername.ip=28.88.175.182 read by peername.ip=209.169.46.101 read by peername.ip=230.21.178.118 read by peername.ip=41.55.202.55 read by peername.ip=127.0.0.1 read by anonymous auth by * none break syncrepl rid=004 provider=ldap://master:389 type=refreshAndPersist bindmethod=simple binddn=cn=syncrepl,ou=tree8,ou=name credentials=syncrepl-password searchbase="ou=tree8,ou=name" retry="5 10 60 +" ############################################################ # ou=tree9,ou=name database definition ############################################################ database bdb suffix "ou=tree9,ou=name" rootdn cn=manager,ou=tree9,ou=name rootpw root-password directory /var/lib/ldap/ou=tree9,ou=name index entryCSN eq index entryUUID eq index objectClass eq index uid eq index username eq shm_key 122 cachesize 100000 idlcachesize 100000 checkpoint 32768 30 idletimeout 3600 writetimeout 90000 access to dn.base="ou=tree9,ou=name" by peername.ip=153.54.1.23 read by * none break access to dn.subtree="ou=tree9,ou=name" by dn.base="cn=Reader,ou=tree9,ou=name" read by peername.ip=164.215.79.230 read by peername.ip=52.205.194.57 read by peername.ip=69.215.8.144 read by peername.ip=240.46.54.48 read by peername.ip=127.0.0.1 read by anonymous auth by * none break syncrepl rid=006 provider=ldap://master:389 type=refreshAndPersist bindmethod=simple binddn=cn=syncrepl,ou=tree9,ou=name credentials=syncrepl-password searchbase="ou=tree9,ou=name" retry="5 10 60 +" ############################################################ # ou=tree10,ou=name database definition ############################################################ database bdb suffix "ou=tree10,ou=name" rootdn cn=manager,ou=tree10,ou=name rootpw root-password directory /var/lib/ldap/ou=tree10,ou=name index entryCSN eq index entryUUID eq index mtaMacAddress eq index mtaSubcriberKey eq index objectClass eq shm_key 548 cachesize 100000 idlcachesize 100000 checkpoint 32768 30 idletimeout 3600 writetimeout 90000 access to dn.base="ou=tree10,ou=name" by peername.ip=111.64.19.131 read by * none break access to dn.subtree="ou=tree10,ou=name" by dn.base="cn=Reader,ou=tree10,ou=name" read by peername.ip=49.225.102.91 read by peername.ip=169.2.225.154 read by peername.ip=177.202.224.166 read by peername.ip=56.152.182.238 read by peername.ip=157.83.196.154 read by peername.ip=66.220.12.152 read by peername.ip=132.204.57.43 read by peername.ip=222.142.242.198 read by peername.ip=153.130.78.144 read by peername.ip=166.31.243.77 read by peername.ip=226.40.169.1 read by peername.ip=224.110.119.208 read by peername.ip=15.227.192.210 read by peername.ip=45.56.216.152 read by peername.ip=127.0.0.1 read by anonymous auth by * none break syncrepl rid=000 provider=ldap://master:389 type=refreshAndPersist bindmethod=simple binddn=cn=syncrepl,ou=tree10,ou=name credentials=syncrepl-password searchbase="ou=tree10,ou=name" retry="5 10 60 +" ############################################################ # ou=tree11,ou=name database definition ############################################################ database bdb suffix "ou=tree11,ou=name" rootdn cn=manager,ou=tree11,ou=name rootpw root-password directory /var/lib/ldap/ou=tree11,ou=name index entryCSN eq index entryUUID eq index objectClass eq index uid eq index username eq shm_key 215 cachesize 100000 idlcachesize 100000 checkpoint 32768 30 idletimeout 3600 writetimeout 90000 access to dn.base="ou=tree11,ou=name" by peername.ip=51.114.241.35 read by * none break access to dn.subtree="ou=tree11,ou=name" by dn.base="cn=Reader,ou=tree11,ou=name" read by peername.ip=17.32.79.33 read by peername.ip=140.205.127.168 read by peername.ip=190.147.122.157 read by peername.ip=170.66.104.2 read by peername.ip=45.154.226.85 read by peername.ip=116.172.183.88 read by peername.ip=96.51.58.70 read by peername.ip=85.240.27.171 read by peername.ip=127.0.0.1 read by anonymous auth by * none break syncrepl rid=005 provider=ldap://master:389 type=refreshAndPersist bindmethod=simple binddn=cn=syncrepl,ou=tree11,ou=name credentials=syncrepl-password searchbase="ou=tree11,ou=name" retry="5 10 60 +" ############################################################ # ou=tree12,ou=name database definition ############################################################ database monitor rootdn cn=manager,ou=tree12,ou=name rootpw root-password access to dn.subtree="ou=tree12,ou=name" by peername.ip=127.0.0.1 read by * none -- Nick Urbanik http://nicku.org 808-71011 nick.urbanik(a)optusnet.com.au GPG: 7FFA CDC7 5A77 0558 DC7A 790A 16DF EC5B BB9D 2C24 ID: BB9D2C24 I disclaim, therefore I am.

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical