- openldap-technical - openldap.org

Re: MDB_PAGE_FULL
by Pieter Martin 19 Jan '14

19 Jan '14

Hi, I am using lmdb to implement a graph db via java JNI. Initial results are amazing. Anyhow I am having trouble with deletions. I am getting MDB_PAGE_FULL when trying to delete. A simplified version of the code is as follows. //set the key ... while ((rc = mdb_cursor_get(vertexCursor, &key, &data, MDB_SET_RANGE)) == 0) { rc = mdb_cursor_del(vertexCursor, 0); if (rc != 0) { printf("removeVertex 4 %i\n", rc); goto fail; } //set the key ... } The mdb_cursor_del returns a error code -30786 (MDB_PAGE_FULL) on about the 38th loop. if there are very few entries then the exception does not happen. Is there something obvious that I am doing wrong to cause a MDB_PAGE_FULL exception? Thanks Pieter

3 3

ldif-diff / ldif->ldap sync utilities
by Hallvard Breien Furuseth 17 Jan '14

17 Jan '14

[There doesn't seem to be an active general LDAP list anymore, so I hope it's OK to post here instead.] I need an ldif-diff utility (take two LDIF dumps and produce an .LDIF to change one to the other) and maybe an LDIF->LDAP sync program like this: - Give me some control of the order in which entries are output. I need to ensure that when a "mail:" value moves from one entry to another, it should temporarily occur in both entries rather than in neither. Usually that means output the 2nd entry first. - Fairly fast, but a slower and smarter mode would be nice. Fast mode can be crude, e.g. it need not know that "foo:: eHk=" means "foo: xy" and DN cn=x+uid=y,... matches uid=y+cn=x,... - Not resource-hungry. (Don't slurp the entire LDIFs into memory. Scan them to build a mapping {dn: filepos} or something.) - Don't generate a huge "replace: member" change when it instead can generate a small "delete:" + "add:" for the attribute change. (So it must be configured to know which attrs have an EQUALITY matching rule, at least when there is no server to ask.) - Preferably LDAP-novice-friendly error messages. It does *not* need to: - Detect renamed entries. - Certainly not convert anything to/from Unicode. Sometimes I've had to battle tools to stop them from deciding I want Latin1->UTF-8. - Preserve entry/attribute order. (But preserved attr.value order is nice for some attributes, even if LDAP does not guarantee it.) -- Hallvard

1 0

lmdb memory usage when writing lots of data with memorymap option
by Luc Vlaming 16 Jan '14

16 Jan '14

Hi, Currently I am creating support for using LMDB as a new storage backend for one of our products. At the moment I am testing import bulk data into lmdb using transactions that span a single record of 10MB. The total db size afterwards is 5GB. I also tested with records of 1MB. I noticed a very odd thing: when using the MDB_WRITEMAP option, memory usage grows very quickly and linear with the amount of data stored into the database. (memory usage ends up a bit higher than 5GB). when not using MDB_WRITEMAP, however, memory usage stays very low. Does anyone have a suggestion what might be wrong and what causes such different behaviour with and without using the memorymap option? FYI: - there are no long lived reads so that should not be the problem. - I am using the newest git version: ec97f49a6552a8ed599472d665ec7c16463b808c Regards, Luc Vlaming

3 8

Failed bind registry
by David Tello 15 Jan '14

15 Jan '14

I need to have in a exploitable format the failed binds. Something similar to the correct binds in the accesslog. I have seen that some people talks about the use of loglevel 256, but i thing that is too hard. Any help would be welcome. Thanks!

4 11

SETTING UP MONITOR
by Borresen, John - 0442 - MITLL 15 Jan '14

15 Jan '14

First, my apologies for the adding you, Quanah, to the cc list. Over the last few weeks, my emails have not been getting through to the openldap-technical group (haven't seen anything getting posted). Anyway, Trying to set up Monitor. I've created a Monitor directory in my ldap directory: /var/lib/openldap /var/lib/openldap/Monitor /var/lib/openldap/openldap-data All owned by ldap. My ldif looks like this: dn: olcDatabase=Monitor,cn=config objectClass:olcDatabaseConfig olcDatabase:Monitor olcAccess:dn.exact="cn=ldapadmin,dc=<my_group>,dc=ldap" write olcAccess:by users read olcAccess:by * none Getting two different errors: 1) Ldap_add: Other (e.g., implementation specific) error (80); additional info: <olcAccess> handlier exited with 1 2) Then after restarting slapd, and seeing no changes in the /var/lib/openldap/Monitor directory and ldapsearch returns # extended LDIF # # LDAPv3 # base <cn=Monitor> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 10 Referral ref: ldap://<ldap_server>.<my_group>.ldap/cn=Monitor??sub # numResponses: 1 John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420 Email: john.borresen(a)ll.mit.edu<mailto:john.borresen@ll.mit.edu>

4 3

SSHA hashed passwords && retrieving the salt
by Matthias Apitz 15 Jan '14

15 Jan '14

Hello, I want to understand how to retrieve the 'salt' which was used by the LDAP server to hash a user's password with seeded sha1, i.e. SSHA; when I do a ldapsearch from the UNIX cmd line I get the attribute as: $ ldapsearch -h 10.45.xx.xx -p 389 -x -D ... 'cn=jrXXXXX' ... dn: cn=jrXXXXX,ou=user,ou=.... userPassword:: e1NTSEF9TWd3ZmtxQ25HdTJYVXZtVzNzTm5yWjlwVjBUSmwvQ0Q= ... the above string I can decode with: $ echo -n 'e1NTSEF9TWd3ZmtxQ25HdTJYVXZtVzNzTm5yWjlwVjBUSmwvQ0Q=' | mmencode -u {SSHA}MgwfkqCnGu2XUvmW3sNnrZ9pV0TJl/CD but now I'm lost how to retrieve the 'salt' from it :-( I have google'd around and see examples for this like in http://www.pressinganswer.com/444023/how-can-i-retrieve-a-salt-from-ldap <CITED ON> With SSHA, normally the salt is appended to the SHA1 hash and then the whole thing is Base64 encoded (I've never seen an LDAP that didn't do SSHA this way). You should be able to tell this by looking at the userPassword attribute. If it's 28 character long with a = at the end, it's only the hash. If the Base64 value is 32 character long or greater, it contains both the hash and the salt. Base64 decode the value and strip off the first 20 bytes, this is the SHA1 hash. The remaining bytes are the salt. Example: Base64 encoded hash with salt userPassword: {SSHA}MTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0 Base64 decoded value SHA1 Hash Salt --------------------++++ 123456789012345678901234 <CITED OFF> I can repeat the given example with: $ echo -n 'MTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0' | mmencode -u 123456789012345678901234 but when I run the original string through decode, I get only binary nonsense from: echo -n 'MgwfkqCnGu2XUvmW3sNnrZ9pV0TJl/CD' | mmencode -u 2 §íRùÞÃgð What I do wrong or what I'm missing here? The used 'mmencode' is on FreeBSD 10-CURRENT from a pkg: $ pkg_info -W /usr/local/bin/mmencode /usr/local/bin/mmencode was installed by package metamail-2.7_9 if this does any matter. Thanks matthias -- Matthias Apitz | /"\ ASCII Ribbon Campaign: www.asciiribbon.org E-mail: guru(a)unixarea.de | \ / - No HTML/RTF in E-mail WWW: http://www.unixarea.de/ | X - No proprietary attachments phone: +49-170-4527211 | / \ - Respect for open standards

2 3

strange error with openldap 2.4 and sql backend
by Adrian 15 Jan '14

15 Jan '14

Hi, I have a very strange issue with OpenLDAP 2.4 and the SQL backend. at_query fails although the exactly same query works fine with 2.3. I posted some details on this question on SF: http://serverfault.com/questions/566902/openldap-sql-backend-failing There's also this Gist containing my config, the full error message, etc.: https://gist.github.com/ThiefMaster/b47613f79d6a3ed879df Regards, Adrian

1 0

N-Way-Multimaster Configuration
by Borresen, John - 0442 - MITLL 15 Jan '14

15 Jan '14

Thanks for your help with my last post. Now, the next task, will be setting up an N-way multimaster: Server1 Server2 Server3 Server4 Using TLS. To create the certificates, finding a lot of varying ideas via google, what is the "best practice" to create certificates to where I don't have to touch each client if a server goes down. Create a wildcard cert or use the subjectAltName in the openssl.cnf file? John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420 Email: john.borresen(a)ll.mit.edu<mailto:john.borresen@ll.mit.edu>

4 5

BDB fine grained lock manager
by Chris Card 15 Jan '14

15 Jan '14

Hi All, We are running openldap 2.4.36 and Berkeley DB 4.6.21 (+ 4 patches) on centos 6.3 64 bit. Does anyone know if building Berkeley DB with --enable-fine_grained_lock_manager is likely to make any difference to slapd performance? Chris

2 1

Re: N-Way-Multimaster Configuration
by Quanah Gibson-Mount 14 Jan '14

14 Jan '14

--On Tuesday, January 14, 2014 2:22 PM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > > > Thanks for your help with my last post. > > > > Now, the next task, will be setting up an N-way multimaster: > > Server1 > > Server2 > > Server3 > > Server4 > > > > Using TLS. To create the certificates, finding a lot of varying ideas > via google, what is the "best practice" to create certificates to > where I don't have to touch each client if a server goes down. Create > a wildcard cert or use the subjectAltName in the openssl.cnf file? I prefer to use a wildcard cert. I would note that a technically correct wildcard cert has *.domain in subjectAltname. On the flip side, virtually no CA creates certs that are compliant with the RFC for wildcards. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

RE: SETTING UP MONITOR
by Quanah Gibson-Mount 14 Jan '14

14 Jan '14

--On Tuesday, January 14, 2014 11:51 AM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > Did I miss something? That link just showed me an ldif that isn't > telling me anything...that I haven't already seen in numerous google > searches. It is an example of a correctly configured monitor backend. Given that your attempt to add the monitor backend to your database is failing, I thought it might help you actually get it configured. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

Re: SETTING UP MONITOR
by Quanah Gibson-Mount 14 Jan '14

14 Jan '14

--On Tuesday, January 14, 2014 11:06 AM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > Trying to set up Monitor. I've created a Monitor directory in my ldap > directory: Why? The monitor backend has no database. > My ldif looks like this: I suggest you look at: <https://github.com/Zimbra-Community/zimbra-sources/blob/master/main/ZimbraS…> --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

mdb expected growth
by Paul B. Henson 13 Jan '14

13 Jan '14

So after updating our dev ldap environment to use mdb, and slapadd'ing a fresh copy from our production environment into it, the database was using 828M: Environment Info Map address: (nil) Map size: 2147483648 Page size: 4096 Max pages: 524288 Number of pages used: 211612 Last transaction ID: 1333 Max readers: 126 Number of readers used: 6 Status of Main DB Tree depth: 1 Branch pages: 0 Leaf pages: 1 Overflow pages: 0 Entries: 29 I then proceeded to run a test load on it (basically, I had a script I put together when I added the memberof overlay that ripped through all of our groups, removing and then re-adding all members). After this test run, the use jumped to 1.9G: Environment Info Map address: (nil) Map size: 2147483648 Page size: 4096 Max pages: 524288 Number of pages used: 479536 Last transaction ID: 1075380 Max readers: 126 Number of readers used: 11 Status of Main DB Tree depth: 1 Branch pages: 0 Leaf pages: 1 Overflow pages: 0 Entries: 29 There is no new data in the database, all that happened was existing data was removed and then re-added. Is this drastic increase in space utilization expected in such a scenario? I bumped the max size from 2G to 4G and am rerunning the same script to see what happens. Is there any heuristic for how mdb will grow over time, based on the initial size from a fresh slapadd? I plan to set a fairly large maxsize, and also monitor it with munin to keep track of any unexpected growth, but I am curious if it is going to reach a steady-state size or continue growing over time. I would expect growth as additional entries were added, and possibly some growth from overhead when things were changed, but not necessarily such a big jump in size. Thanks.

5 8

Question regarding slapo-pcache
by Philippe 13 Jan '14

13 Jan '14

Hi everyone, I'm setting up an openldap server that proxies _and_ caches everything from other servers (OpenLDAP and AD, that's what the meta database is for). As for now proxying and caching data works fine but I'm unable to get credentials cached. How is pcacheBind supposed to work? This is my setup so far: --%snip%-- # slapd.conf include /some/schemas/.. sizelimit unlimited moduleload back_bdb moduleload back_ldap moduleload back_meta moduleload pcache database ldap suffix "dc=xyz,dc=de" rootdn "cn=sys,dc=xyz,dc=de" uri "ldap://10.0.0.1" # the ldap server I'm talking to chase-referrals yes rebind-as-user yes overlay pcache pcache bdb 999999 2 999 300 directory /var/lib/ldap-cache cachesize 1024 index objectClass eq,pres index uidNumber,gidNumber eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uid,memberUid eq,pres,sub index uniqueMember eq,pres pcacheMaxQueries 999999 pcacheOffline false pcachePersist true pcacheAttrset 0 cn uid objectclass userpassword sn mail memberof displayname pcacheTemplate (cn=) 0 3600 pcacheAttrset 1 cn uid pcacheTemplate (cn=) 1 3600 pcacheBind (cn=) 1 3600 sub dc=xyz,dc=de database meta suffix "dc=de" uri "ldap://localhost/dc=xyz,dc=de" idassert-bind bindmethod=simple binddn="cn=sys,dc=xyz,dc=de" credentials="somecredentials" chase-referrals yes rebind-as-user yes --%snip%-- Now I'm running some queries using ldapsearch and watching the traffic via tcpdump. As far as I can tell the requested attributes are cached, the remote ldap server is only asked once about the requested data. But even when the data is already cached the openldap server still tries to bind to the remote server. Which is unfortunate since I'm trying to catch network outages with the caching proxy. Example: >> $ ldapsearch -x -H ldap://localhost -D cn=me,ou=users,dc=xyz,dc=de -W -b dc=xyz,dc=de 'cn=foo' mail - first attempt tcpdump shows: bind, search of cn uid objectclass userpassword sn mail memberof, and the result - second attempt, same command tcpdump shows: bind and that's all. The result are delivered from cache. I tried other filter masks, too, which lead to different results: --%snip%-- pcacheAttrset 0 * pcacheTemplate (cn=) 0 3600 pcacheBind (cn=) 0 3600 sub dc=xyz,dc=de --%snip%-- In this case the remote server isn't queried anymore after the second attempt of the command above (which is good), but when trying to search for data that hasn't been cached yet, openldap tries to bind anonymously to the remote server (which is bad, because it won't work). Syslog tells me: >> ldap_back_dobind_int: DN="cn=me,ou=users,dc=xyz,dc=de" without creds, binding anonymously Any clues? Kind regards, Philippe

1 0

Re: MDB_BAD_RSLOT while executing slapacl
by Francesco Malvezzi 13 Jan '14

13 Jan '14

This is a follow-up of: https://www.openldap.org/lists/openldap-technical/201312/msg00119.html I have observed in the wild the "MDB_BAD_RSLOT while executing slapacl" error on two different servers: [...] 52d3c079 <= check a_group_pat: cn=agentsgroup,ou=groups,dc=example,dc=org 52d3c079 mdb_opinfo_get: err MDB_BAD_RSLOT: Invalid reuse of reader locktable slot(-30783) 52d3c079 <= check a_group_pat: cn=admins,ou=groups,dc=example,dc=org 52d3c079 mdb_opinfo_get: err MDB_BAD_RSLOT: Invalid reuse of reader locktable slot(-30783) [...] On the other hand, I am not able to reproduce the error with the example data given by Igor. The slapacl returns 'ALLOW'. Might be of interest my config yielding the error? thank you, Francesco /usr/local/openldap-2.4/libexec/slapd -V @(#) $OpenLDAP: slapd 2.4.38 (Dec 4 2013 11:26:00) $ francesco@c1:/usr/local/src/openldap-2.4.38/servers/slapd

2 1

syncrepl will update, and delete, but won't create entries
by Andrew LaPierre 10 Jan '14

10 Jan '14

Before I give too many details that you don't need, is there something that would cause this behavior? Both servers have: Ubuntu 10.04 OpenLDAP 2.4.21 I'm using RefreshAndPersist. I can make changes and delete entries, and the changes and deletions happen on the consumer, but if I create somebody on the provider, they never show up on the consumer. Please let me know what additional information I can give you guys to help. Thanks for the help! -- Andrew LaPierre

3 2

configuring mdb maxsize
by Paul B. Henson 09 Jan '14

09 Jan '14

I'd like to clarify the requirements for the mdb maxsize parameter. According to the current admin guide: "This should be the largest that the database is ever anticipated to grow" Which would seem to imply it cannot later be changed without completely rebuilding the database. According to the slapd-mdb manpage: "Note: It is important to set this to as large a value as possible, (relative to anticipated growth of the actual data over time) since growing the size later may not be practical when the system is under heavy load." It can possibly be changed later, but maybe not ;). Based on unauthoritative postings I've read, it seems that if you shut down openldap, you can change it to whatever you want, and when you restart openldap, the additional size will immediately be available with no problems. It also seems that if you're using cn=config, you can change it live and it will immediately take effect. I haven't seen any postings indicating a problem that occurred while changing it live. Are there any restrictions for changing it while the server is down? What restrictions, or problems, if any, are involved when changing it while the server is up? Thanks much.

3 4

optimal mdb flags
by Paul B. Henson 09 Jan '14

09 Jan '14

So if it's not obvious, we're working on migrating our openldap deployment to mdb from hdb :), I apologize for the flurry of questions, this will be the last, at least for today ;). I'm trying to evaluate the optimal configuration for mdb; it seems like for the most part you can just set maxsize and move on if you don't have performance issues, but one flag I've seen frequently mentioned for improving performance is writemap. This seems like a win all around, unless there is some bug that results in erroneous writes into the mapped region, in which case it could potentially cause major database corruption. For those that have been running mdb in the field for a while, are you using writemap? Have you ever run into any corruption because of it? The other flag that seems to be popular is nometasync. As opposed to nosync, which might cause loss of some number of transactions in case of a crash, nometasync only risks one? And the benefit is that it is "slightly faster"? Again, any recommendations from field experience on this? Also, if you do enable it, do you need a checkpoint directive, or is that only necessary for nosync? Thanks.

3 5

Port 636 and SLAPD(8)
by jumpgroup＠aol.com 09 Jan '14

09 Jan '14

Hello Experts, In need of a little guidance please. I'm installed OpenLdap 2.4.23 on RHEL in a sandbox and would like to enable SSL on port 636. All documentation references SLAPD(5), but since I'm using SLAPD(8), I do not know have the slapd.conf file. Looking for the current SLAPD(8) method of configuring this along with starting the service to support port 636. Thanks in advance! Jeff P.

5 5

mdb searchstack parameter
by Paul B. Henson 09 Jan '14

09 Jan '14

>From reading the documentation, it sounds like when configuring this parameter you need to strike a balance between potential performance impact if it is too low, and wasted memory if it is too high. While running, is there any way to tell whether or not a search exceeded your configured value and required additional allocation? Whether via the monitor backend, or a log entry, or? Ideally, it would be nice to be able to tell if your configured value was too low and adjust as necessary. Thanks.

2 2

mdb_stat
by Paul B. Henson 09 Jan '14

09 Jan '14

Where does one typically acquire the mdb_stat binary for use with openldap? It appears to be part of liblmdb. openldap includes a bundled copy of liblmdb, but does not actually build mdb_stat. Is the intention for distributions to have a separate package for liblmdb, which would include mdb_stat, which one would then install to acquire it (even though the library isn't needed for openldap itself)? I can obviously just compile it myself :), but plan to open a bug with my distribution (Gentoo) to see about making it available, and I'm not sure whether it would be better to compile the one within openldap and install that as part of the openldap package, or create a new package for liblmdb. Given it is still under relatively early development, would it be better to install the bundled one as ol_mdb_stat or something like that, to make sure it corresponds to the version actually used by the installed openldap? What are other distributions doing? Thanks.

2 2

replicating central NSS data (was: DBIS - new IETF drafts)
by Michael Ströder 08 Jan '14

08 Jan '14

(I take this point to openldap-technical(a)openldap.org since it discusses OpenLDAP-specific things.) Howard Chu wrote: > The discussion of caching here > http://www.ietf.org/id/draft-bannister-dbis-mapping-02.txt is one such example > - this is purely a client-side implementation issue. Also you give nscd as an > example, and nscd has been thoroughly discredited and is well known to be > unsuitable for real use. Critical deployments can use a local LDAP server with > a replica of the central data, to avoid error-prone caching implementations. > This is a commonly recommended approach when using OpenLDAP nssov, for example. I really wonder how this replication approach works in practice without disclosing too much data on a system more exposed to attacks from the outside. In theory one could implement partial replication based on systems's bind identity. But in practice I have some doubts because in a really paranoid setup you don't even want to disclose replication meta data and intermediate entries of the tree structure. Ciao, Michael.

2 1

Problem with back-mdb
by Grégory T 08 Jan '14

08 Jan '14

Hello, before starting, we wish a happy new year to the community ! Now, we start with presentation. We have compiled the Openldap build version 2.4.38 on a ubuntu 12.04. This openldap server is a dual processor Intel Xeon with 4 Gb Memory. This machine is virtualized (vmware). Openldap is configured with back-mdb, overlays memberof and syncprov, and envflags writemap and nosync. We encounter a problem with a callback procedure in a perl script. This script have to remove a couple of attributes for each entry (~120 000). In order to save memory consumption, we use a callback function to treat each entry one after one. Everything works with back-bdb but ... there are mistakes with back-mdb. In ldap.log, this kind of message appears many times : ldapserver slapd[7264]: connection_input: conn=1014 deferring operation: awaiting write ldapserver last message repeated 55 times And suddenly, ldapserver slapd[7264]: conn=1014 fd=14 closed (connection lost) Our script result in "connection reset by peer" message. The script stop around the 1040 entry. Although the connection was closed by server, it still continue to run. However, no explicit message in ldap.log. If we run the script once again, the next ~1040 entries will be treated and the script stop. We have try with envflags writemap and nosync deactivated ... but unsuccessful. This is the ldapsearch request : my $result=$ldapMaster->search(base=>$baseDN,scope=>'sub',filter=>$filter,typesonly=>'1',callback=>\&callback); And this is the callback function : sub callback{ my ($search,$ent)=@_; return unless defined $ent; my $entry = $search->shift_entry(); my @tabAttribToDel=(); if (defined $entry){ my $dn=$entry->dn(); $countDN++; foreach my $attrib($entry->attributes){ if ($attrib ~~ @tabOldAttrib){ $countAttrib++; push (@tabAttribToDel,$attrib); } } if (($SUPPR==1) && (@tabAttribToDel)) { $countTrace++; my $result = $ldapMaster->modify($dn,delete => \@tabAttribToDel); warn "(nbEntry:$countTrace, nbAttr:$countAttrib) Error with $dn: ".$result->error."\n" if $result->code; } } } Why is this script working well with back-bdb but not with back-mdb ? Thanks, -- Grégory Trucy Ingénieur système et réseau Aix-Marseille Université

3 2

replication of databases with different backends???
by lux-integ 08 Jan '14

08 Jan '14

Greetings, I have two computers with these:- host 1: --cpu amd64 3 cores --os blfs linux-3.10.24, openldap-2.4.33 with bdb backend host 2: --cpu amd64 3 cores --os blfs linux-3.10.24, openldap-2.4.33 with sql backend QUESTION: can I replicate these databases over each host (in other words can I for example do N-ray multimaster syncrepl ( http://www.openldap.org/doc/admin24/replication.html ) or another type of replication in view of the different backends ? thanks in advance sincerely luxnteg

4 3

Search filter for ou=Groups
by jupiter 08 Jan '14

08 Jan '14

Hi, How can I search for displaying all members in ou=Groups only? I added a filter (&(objectClass=posixGroup)(ou=Groups)), but nothing displayed (I can get every entries if the filter is not used) ldapsearch -x -W -D cn=insecure,dc=ldap,dc=hce,dc=org "(&(objectClass=posixGroup)(ou=Groups)" # extended LDIF # # LDAPv3 # base <dc=ldap,dc=hce,dc=org> (default) with scope subtree # filter: (&(objectClass=posixGroup)(ou=Groups)) # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 Thanks. jupiter

2 1

openldap problem with synchronization
by Robert Mach 07 Jan '14

07 Jan '14

Hello, I have troubles using openldap replication in Centos 6.4. and Centos 5.3 I have two server with following version of openldap from centos repository configures as multimaster replication (internal servers): openldap-servers-2.4.23-32.el6_4.1.x86_64 openldap-clients-2.4.23-32.el6_4.1.x86_64 openldap-2.4.23-32.el6_4.1.x86_64 Then I have one external server with following products: openldap-servers-2.3.43-12.el5_5.3 openldap-clients-2.3.43-12.el5_5.3 openldap-2.3.43-12.el5_5.3 Then two internal servers are configured as multi-master replication and everything is working fine. The external server is configures as slave replication from one of those internal servers using the following configuration: CODE: SELECT ALL database bdb suffix "o=test,c=cz" rootdn "cn=Manager,o=test,c=cz" directory /var/local/ldap/test.cz index entryCSN,entryUUID eq index objectClass eq,pres index ou,cn,mail eq,pres,sub syncrepl rid=132 provider=ldaps://xxxxx.xxx.xxx type=refreshOnly interval=00:00:01:00 searchbase="o=test,c=cz" filter="(!(objectclass=simpleSecurityObject))" scope=sub updatedn="cn=SyncMaster,o=test,c=cz" bindmethod=sasl saslmech=external attrs="objectClass,cn,sn,ou,o,mail,serialNumber,userCertificate,cACertificate,certificateRevocationList,authorityRevocationList,entrustPolicyCertificate,crossCertificatePair" schemachecking=on There is a problem with replication from internal server to external. If I delete the database of external server and start the consumer, everything is correctly replicated from the provider (internal server) to the consumer. Therefore I assume, that the replication is configured correctly. But if the servers are running for a while and changes are made on the Provider (internal server) some data are not replicated to the consumer. More precisely the contextCSN of the root of the tree of consumer (external server) is updated and is the same as on the Provider(internal server), but some entries lower in the three are not replicated correctly, both the entry entryCSN and the entry data itself are not updated on the Consumer. Do you have any idea where could be the problem? Thank you, Rob

6 8

OpenLDAP can manage IP/MAC/Assets and other information?
by Tian Zhiying 07 Jan '14

07 Jan '14

Hi OpenLDAP can manage IP/MAC/Assets and other information? If it can, what schema I need to add ? Thanks. Tian Zhiying

2 1

"ber write failed", followed by slapd not responding
by Chris Down 07 Jan '14

07 Jan '14

Hello, I am having a small problem with an OpenLDAP master at work. Twice today, at seemingly random intervals, it has stopped responding to all queries, and all clients lose connection to the master, immediately after printing the following message in the debug log: Jan 7 10:04:58 ldap slapd[20310]: send_search_entry: conn 1851 ber write failed. There are no more messages printed before or after this for hours. I looked at the source, but it didn't seem particularly illuminating (it looks like this happens when send_ldap_ber() doesn't write anything and returns 0 bytes, but I don't know how to debug that, since there are a lot of conditions there that return 0). I saw this[0] thread, but we are already using 2.4.23 on Debian Squeeze, so it appears to not be the same problem: @(#) $OpenLDAP: slapd 2.4.23 (Dec 16 2012 11:48:44) $ root@carillon:/tmp/buildd/openldap-2.4.23/debian/build/servers/slapd I am not aware of performing any changes to our LDAP configuration recently. How should I go about debugging this? Is this a known issue? I searched openldap-bugs, but I didn't find anything recent that seemed related. Thanks. 0: http://www.openldap.org/lists/openldap-technical/200907/msg00199.html

1 0

Re: Search in Active Directory Proxy with multiple level of OU
by Michael Lois 07 Jan '14

07 Jan '14

Thank you for the reply, Dieter. I tried the following config: rwm-suffixmassage "ou=user,dc=company,dc=com" "OU=All Users,dc=internal,dc=company,dc=com" rwm-map attribute uid sAMAccountName Simple searches work ( ldapsearch -W -x -b "ou=user,dc=company,dc=com" uid=michael), but some of our application needs to specify the binding of which OU the user belongs to. From the above example, if we do a search on proxy with "ldapsearch -xW -b "cn=Michael Lois,ou=user,dc=company,dc=com", the proxy would need to translate it into "cn=Michael Lois,ou=Accounting,OU=All Users,dc=internal,dc=company,dc=com" on AD, without the need for user to provide that Michael Lois on the Accounting OU. Is this possible? I think my problem is similar to this one in the older thread in 2009, but seems like this quesiton was still open: http://www.openldap.org/lists/openldap-technical/200902/msg00090.html

2 1

DBIS - new IETF drafts to replace NIS and RFC2307
by Mark R Bannister 06 Jan '14

06 Jan '14

In August this year, I submitted some new IETF drafts with the intent that they would replace NIS and RFC2307. It introduces Directory Based Information Services (DBIS). Michael Ströder suggested I post a link to this mailing list. The following article (and further articles on my blog) discuss some of the aspects of DBIS, and link to all of the relevant internet drafts: http://technicalprose.blogspot.co.uk/2013/08/introducing-dbis.html I am currently working on a reference implementation here: http://sourceforge.net/projects/dbis/ This may be coming out of the blue for many of you, and I appreciate you may need some time to read and digest my drafts, and then ask me lots of questions. But my first question to you is, where is the best place for discussion related to these drafts? Is this the mailing list to use? Best regards, Mark Bannister. e: dbis(a)proseconsulting.co.uk

3 2

mod_athnz_ldap module for Fedora 19
by Tharmakulasingam Jeyjenthan 06 Jan '14

06 Jan '14

Hi, I am trying to get mod_athnz_ldap module to connect apache server with openldap server in Fedora 19. But there are RPM modules for fedora except for Fedora 19. How can i achieve this? Any Suggestion. Thanks in advance. Regards, T.Jeyjenthan

1 0

Ldap password policy not throwing different errors
by Idan Fridman 05 Jan '14

05 Jan '14

Hi, I use ppolicy overlay and enabled ppolicy_use_lockout to separate between invalid password and locked accounts. database bdb suffix "dc=openiam,dc=com" rootdn "cn=Manager,dc=openiam,dc=com" rootpw "{SSHA}2ttRoo/t5HuMT2nPxtI6goVUML5R2H9h" # PPolicy Configuration overlay ppolicy ppolicy_default "cn=default,ou=policies,dc=openiam,dc=com" ppolicy_use_lockout ppolicy_hash_cleartext I tried to lock user account by entering wrong password couple of times (pwdMaxFailure) The user is being locked but when I try to login again I still get the same error: Invalid credentials (49) Any idea why i am not getting diffrent error to disticnt between the cases? thanks, ray. This e-mail and the information it contains may be privileged and/or confidential. It is intended solely for the use of the named recipient(s). If you are not the intended recipient you may not disclose, copy, distribute or retain any part of this message or attachments. If you have received this e-mail in error please notify the sender immediately [by clicking 'Reply'] and delete this e-mail.

4 4

using the deref control
by Arthur de Jong 05 Jan '14

05 Jan '14

Hi list, First off, best wishes for 2014. I've been looking into the deref control that was pointed out here (in the Oracle OpenLDAP PPolicy ppolicy and the hierarchy thread). With some trail and error I got things working so I thought to document what I did in the hopes that it may be useful for other people wanting to use this control. First of all, get a slapd instance running with the deref overlay. With older versions (at least 2.4.31) it was sufficient to load the module to have the relevant control being shown in the root DSE. However, due to ITS#7436 this didn't actually do anything. With later slapd versions (at least 2.4.38) loading the overlay apparently isn't sufficient but you have to also configure it for each database: dn: olcOverlay={1}deref,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig olcOverlay: {1}deref In terms of using the API you have to first create a control with ldap_create_deref_control() and pass it along with ldap_search_ext(). After the call to search, free the control again with ldap_control_free(). The control is built up of an array of LDAPDerefSpec structs that contains the attribute name that contains the link and a list of attributes to retrieve from the linked entry (just like you would pass to ldap_search()). A bump in the road here was that ldap_create_deref_control() was broken (reported earlier and already fixed in Git) but ldap_create_deref_control_value() seems to work. Any response entries will have a control available that can be extracted with ldap_get_entry_controls() and parsed with ldap_parse_derefresponse_control() (and freed with ldap_derefresponse_free()). The returned control data is a linked list of LDAPDerefRes structs, one per link attribute value. Each struct contains the attribute name, the original value and a linked list of LDAPDerefVal structs. The DerefVal structs contain per requested attribute from the linked entry (if the entry has the attribute) the attribute name and a list of values. This has been implemented in the development branch of nss-pam-ldapd and will probably land in the next 0.9 release. - adding the request control: http://arthurdejong.org/git/nss-pam-ldapd/commit/?id=547e4792c580b67ec14595… - parsing the response control information: http://arthurdejong.org/git/nss-pam-ldapd/commit/?id=c973834328baa69dbd3352… - complete functionality (merge commit): http://arthurdejong.org/git/nss-pam-ldapd/commit/?id=c6c317ec9efb8190bdc183… Hope this is helpful for someone. -- -- arthur - arthur(a)arthurdejong.org - http://arthurdejong.org/ --

1 0

OpenLDAP Multiple User Import
by David Barr 03 Jan '14

03 Jan '14

I have one file that I need to use to import about 50 people, it doesn't like the fact that I have more than one user in the file for some reason. I might have another 200 in the future and need to figure out why it isn't working... Help please. Is my syntax wrong? Did I place something in the wrong order or something more than once that isn't needed. I have included two users, all are the same except the actual username. Help please. # USER ENTRY dn: cn=New.user01,ou=People,dc=test,dc=com uid: NEW.user01 givenName: NEW.user01 objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson userPassword: NEW.user01 sn: NEW.user01 ou: People cn: NEW.user01 objectClass: uidObject objectClass: pwdPolicy pwdAttribute: userPassword objectClass: pwdPolicyChecker pwdMinAge: 86400 pwdMaxAge: 7776002 pwdInHistory: 10 pwdCheckQuality: 2 pwdMinLength: 14 pwdExpireWarning: 432000 pwdGraceAuthNLimit: 0 pwdFailureCountInterval: 120 pwdAllowUserChange: TRUE pwdCheckModule: Standard Policy pwdLockout: FALSE dn: cn=NEW.user02,ou=People,dc=test,dc=com uid: NEW.user02 givenName: NEW.user02 objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson userPassword: NEW.user02 sn: NEW.user02 ou: People cn: NEW.user02 objectClass: uidObject objectClass: pwdPolicy pwdAttribute: userPassword objectClass: pwdPolicyChecker pwdMinAge: 86400 pwdMaxAge: 7776002 pwdInHistory: 10 pwdCheckQuality: 2 pwdMinLength: 14 pwdExpireWarning: 432000 pwdGraceAuthNLimit: 0 pwdFailureCountInterval: 120 pwdAllowUserChange: TRUE pwdCheckModule: Standard Policy pwdLockout: FALSE ldapadd -v -d 1 -D "cn=Admin,dc=test,dc=com" -w test -f /tmp/T/.ldif adding new entry cn=New.user01,ou=People,dc=test,dc=com ldap_add: Type or value exists ldap_add: additional info: objectClass: value #1021 provided more than once ________________________________ CONFIDENTIALITY NOTICE: The information contained in this electronic mail (email) transmission (including attachments), is intended by MCLANE ADVANCED TECHNOLOGIES for the use of the named individual or entity to which it is addressed and may contain information that is privileged, confidential and/or protected as a trade secret. It is not intended for transmission to, or receipt by, any individual or entity other than the named addressee(s). If you have received this email in error, please delete it (including attachments) and any copies thereof without printing, copying or forwarding it, and notify the sender of the error by email reply immediately.

6 8

Search in Active Directory Proxy with multiple level of OU
by Michael Lois 03 Jan '14

03 Jan '14

Hi, We need to setup a openldap proxy to Active Directory. Here is our slapd.conf: database ldap suffix "ou=user,dc=company,dc=com" uri ldap://10.10.10.10/ rebind-as-user idassert-bind bindmethod=simple binddn="cn=openldapuser,ou=Service Accounts,dc=internal,dc=company,dc=com" credentials=******** mode=none idassert-authzFrom "dn.regex:.*" overlay rwm rwm-suffixmassage "OU=All Users,dc=internal,dc=company,dc=com" rwm-map attribute uid sAMAccountName We were trying to query multiple of OU in Active Directory, with the same search string. For example, on AD, user Michael Lois is in "cn=Michael Lois,ou=Accounting,OU=All Users,dc=internal,dc=company,dc=com". With the openldap proxy, we were trying to search Michael with "cn=Michael Lois,ou=user,dc=company,dc=com". From the above slapd config, the following 2 ldapsearch on the openladp proxy server would work: ldapsearch -W -x -b "ou=user,dc=company,dc=com" cn="Michael Lois" ldapsearch -xW -b "cn=Michael Lois,ou=Accounting,ou=user,dc=company,dc=com" But our goal is to make this ldapsearch to give us the same result: ldapsearch -xW -b "cn=Michael Lois,ou=user,dc=company,dc=com" Does anyone know how to search through a proxy with mulitple level of OU in AD? Thank you, Michael

2 1

Is SQLigthning suport full text index?
by Aris Setyawan 03 Jan '14

03 Jan '14

Hi, SQLigthning is enable MDB's MVCC to SQLite. Is SQLigthning suport full text index? regards, Aris

1 0

slapd "olcreadonly" and syncrepl
by Olivier 31 Dec '13

31 Dec '13

Hi everyone, I just configured a directory tuning readonly in the backend database : olcDatabase={1}bdb,cn=config ... olcreadonly: TRUE Good : now if I try to change anything I get an "Server is unwilling to perform (53)" from the server, for axample : # ldappasswd -h localhost -D "uid=olivier,ou=people" -W -S "uid=guillard,ou=people" New password: Re-enter new password: Enter LDAP Password: Result: Server is unwilling to perform (53) Additional info: operation restricted On the other hand, I also have configured this directory to get synchronized on another ldap server through a syncrepl directive, and I see that the ldap synchronization works properly: if I change my password an the master ldap, it's propagated on my "readonly" slave one. This is good since this is exactly what I want. However I have not found the confirmation of this behaviour in the documentation (may be I missed something), that's why I ask here : Is it correct to configure a olcreadonly directory to be slave through syncrepl to another one ? Thanks, --- Olivier

1 0

acl problem
by Mundry, Marvin 30 Dec '13

30 Dec '13

I have encountered an effect that I believe is a bug, but I might be wrong. It would be nice if someone could confirm that my acls should be working, or in case they should not, give me a hint what I am doing wrong. Here is what I am trying to archive: * there is one ldap provider (master) server that contains all attributes that are relevant for my organisation * on the master there is a user allowing a highly secured consumer(slave) ldap server the replication of all attributes from the master * on the master there is a user allowing a low-security consumer(slave) ldap server the replication of all attributes from the master except some critical ones * on the master there is a user (cn=provisioninguser) that can read the accesslog. it is used by scripts to e.g. notify non-ldap systems of password changes. I would like to put the acls for the replication users (high and low security ldap slaves) on the databases and not the frontend to avoid accidental modifications. All other acls should be on the frontend. If I configure all my acls on the frontend only everything works as I think it should. If some acls are on the database the results are rather weird ( the cn=provisioninguser can see only one value of the multi-valued reqMod attribte) The following acl snippet only deals with accesslog access which is where I encounter the problem: dn: olcDatabase={2}hdb,cn=config olcAccess: {0}to dn.subtree="cn=accesslog" attrs=reqMod val.regex="^topSecretAttribute:.*" by dn.base="cn=replicationuser,dc=organisation,dc=com" read by dn.base="cn=replication_low_security,dc=organisation,dc=com" none by * break dn: olcDatabase={2}hdb,cn=config olcAccess: {1}to dn.subtree="cn=accesslog" by dn.base="cn=replicationuser,dc=organisation,dc=com" read by dn.base="cn=replication_low_security,dc=organisation,dc=com" read by * break dn: olcDatabase={-1}frontend,cn=config olcAccess: {0}to dn.subtree="cn=accesslog" by dn.base="cn=provisioninguser,dc=organisation,dc=com" read by * none *if the acls 1,2 and 3 are on "olcDatabase={-1}frontend,cn=config" (which they are not in the example above) cn=provisioninguser,dc=organisation,dc=com can read all values from the multi-valued attribute reqMod (which is what I want). >ldapsearch -D cn=provisioninguser,dc=organisation,dc=com -w 123 -b cn=accesslog reqDN=cn=user1,dc=organisation,dc=com reqMod dn: reqStart=20131227145130.000001Z,cn=accesslog reqMod: userPassword:= {SSHA}bmyaw8Xy1UftlTorPDQE9yLzruoxDnGq reqMod: topSecretAttribute:= topsecret reqMod: pwdChangedTime:= 20131227145130Z reqMod: entryCSN:= 20131227145130.917649Z#000000#000#000000 reqMod: modifiersName:= cn=admin reqMod: modifyTimestamp:= 20131227145130Z *if the acls 1 and 2 are on "olcDatabase={2}hdb,cn=config" and the 3rd one is on "olcDatabase={-1}frontend,cn=config" cn=provisioninguser,dc=organisation,dc=com can read only one value from the multi-valued attribute reqMod (why?). >ldapsearch -D cn=provisioninguser,dc=organisation,dc=com -w 123 -b cn=accesslog reqDN=cn=user1,dc=organisation,dc=com reqMod dn: reqStart=20131227145130.000001Z,cn=accesslog reqMod: userPassword:= {SSHA}bmyaw8Xy1UftlTorPDQE9yLzruoxDnGq Best regards, Marvin Mundry University of Hamburg Regional Computer Center (RRZ) Division Zentrale Dienste Schlueterstrasse 70 20146 Hamburg +49 (0)40 42838-9109

3 3

"LDAP Injection" attacks
by Howard Chu 29 Dec '13

29 Dec '13

A paper and presentation making the rounds, claiming to show how webapps using LDAP are vulnerable to search filter spoofing attacks. http://www.youtube.com/watch?v=wtahzm_R8e4 http://www.blackhat.com/presentations/bh-europe-08/Alonso-Parada/Whitepaper… Can't imagine that work like this gets peer-reviewed, because it's mostly garbage. They concoct a scenario in section 4.1.1 of their paper, supposedly showing how filter manipulation can allow a webapp user to bypass LDAP-based authentication. It's ridiculous drivel though, since LDAP-based authentication uses Bind requests and not search filters. Most LDAP deployments don't even give search/compare access to userPassword attributes in the first place. Just in case anybody out there might be bitten by this info - client-enforced security is no security at all. This is why slapd has such an extensive ACL engine - you enforce access controls on the server, and then it doesn't matter what kind of garbage requests your clients send to you, they can only ever access information that they were allowed to access. This is also why the old pam_ldap authorization scheme was such a bad idea, it relied on the LDAP client (pam_ldap) to correctly implement authorization, instead of the server. (Multiply that by hundreds or thousands of clients and you have an unmanageable, insecurable mess.) This is why we have nssov today. Of course, this is no excuse to be sloppy when writing your web apps. But if you've configured ACLs to adequately protect your data, then it doesn't matter how sloppy your clients are. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

4 9

write access issue
by Umar Draz 28 Dec '13

28 Dec '13

Hi I am trying to rename the (dn) entry through a normal user which is first authenticate it self, but I there is an error while renaming the dn entry text=no write access to old parent's children here is my slapd.conf access settings. # Sample access control policy: access to attrs=userPassword,shadowLastChange by self write by dn="cn=admin,dc=mydomain,dc=com" write by * auth access to * by self write by dn="cn=admin,dc=mydom,dc=com" write by * read Would you please help, what I need to set? Br. Umar

3 4

Oracle OpenLDAP PPolicy ppolicy and the hierarchy
by David Barr 28 Dec '13

28 Dec '13

In Use: Oracle OpenLDAP 2.4.30, I cannot change to the OpenLDAP version that one can compile. Problem: I have the module and overlay in the conf files and slaptest says it's fine. Both files are from Openldap.org version 2.4.37But how do I test it? I have created unix shell scripts to do actions like add, delete, modify, view, etc. I can share these if requested. But I am unsure on the lock, unlock, policy stuff. Also, How should the OpenLDAP hierarchy look? Here's mine: dn: dc=bozo_company,dc=com ou: com objectClass: dcObject objectClass: organizationalUnit objectClass: top dc: bozo_company userPassword: {SSHA}XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX dn: cn=Directory Administrators,dc=bozo_company,dc=com objectClass: top objectClass: groupOfUniqueNames cn: Directory Administrators uniqueMember: cn=clownadmin,ou=Special Users,dc=bozo_company,dc=com uniqueMember: cn=david.barr,ou=People,dc=bozo_company,dc=com dn: ou=Groups,dc=bozo_company,dc=com objectClass: top objectClass: organizationalUnit ou: Groups dn: ou=People,dc=bozo_company,dc=com objectClass: top objectClass: organizationalUnit ou: People dn: ou=Special Users,dc=bozo_company,dc=com objectClass: top objectClass: organizationalUnit ou: Special Users description: Special Administrative Accounts dn: cn=Accounting Managers,ou=groups,dc=bozo_company,dc=com objectClass: top objectClass: groupOfUniqueNames cn: Accounting Managers ou: groups description: People who can manage accounting entries uniqueMember: cn=clownadmin,ou=Special Users,dc=bozo_company,dc=com uniqueMember: uid=Replica,ou=People,dc=bozo_company,dc=com uniqueMember: cn=david.barr,ou=People,dc=bozo_company,dc=com dn: cn=HR Managers,ou=groups,dc=bozo_company,dc=com objectClass: top objectClass: groupOfUniqueNames cn: HR Managers ou: groups description: People who can manage HR entries uniqueMember: cn=clownadmin,ou=Special Users,dc=bozo_company,dc=com uniqueMember: cn=david.barr,ou=People,dc=bozo_company,dc=com dn: cn=QA Managers,ou=groups,dc=bozo_company,dc=com objectClass: top objectClass: groupOfUniqueNames cn: QA Managers ou: groups description: People who can manage QA entries uniqueMember: cn=clownadmin,ou=Special Users,dc=bozo_company,dc=com uniqueMember: cn=david.barr,ou=People,dc=bozo_company,dc=com dn: cn=PD Managers,ou=groups,dc=bozo_company,dc=com objectClass: top objectClass: groupOfUniqueNames cn: PD Managers ou: groups description: People who can manage engineer entries uniqueMember: cn=clownadmin,ou=Special Users,dc=bozo_company,dc=com uniqueMember: cn=david.barr,ou=People,dc=bozo_company,dc=com dn: ou=Services,dc=bozo_company,dc=com ou: Services objectClass: top objectClass: organizationalUnit dn: ou=DML,ou=Services,dc=bozo_company,dc=com ou: DML objectClass: top objectClass: organizationalUnit dn: ou=1.0,ou=DML,ou=Services,dc=bozo_company,dc=com ou: 1.0 objectClass: top objectClass: organizationalUnit dn: ou=UserForm,ou=1.0,ou=DML,ou=Services,dc=bozo_company,dc=com ou: UserForm objectClass: top objectClass: organizationalUnit dn: ou=Configuration,ou=1.0,ou=DML,ou=Services,dc=bozo_company,dc=com ou: Configuration objectClass: top objectClass: organizationalUnit dn: cn=Configuration:#ID#Configuration:SystemConfiguration,ou=Configuration,ou=1 .0,ou=DML,ou=Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: Configuration:#ID#Configuration:SystemConfiguration dn: cn=Configuration:#ID#Configuration:CustomRoles,ou=Configuration,ou=1.0,ou=DM L,ou=Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: Configuration:#ID#Configuration:CustomRoles dn: cn=Configuration:#ID#Configuration:DmlManagedDirectory,ou=Configuration,ou=1 .0,ou=DML,ou=Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: Configuration:#ID#Configuration:DmlManagedDirectory dn: cn=UserForm:#ID#UserForm:DefaultUserForm,ou=UserForm,ou=1.0,ou=DML,ou=Servic es,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultUserForm dn: cn=UserForm:#ID#UserForm:DefaultNtUserForm,ou=UserForm,ou=1.0,ou=DML,ou=Serv ices,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultNtUserForm dn: cn=UserForm:#ID#UserForm:DefaultHomeForm,ou=UserForm,ou=1.0,ou=DML,ou=Servic es,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultHomeForm dn: cn=UserForm:#ID#UserForm:DefaultDMLObjectForm,ou=UserForm,ou=1.0,ou=DML,ou=S ervices,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultDMLObjectForm dn: cn=UserForm:#ID#UserForm:DefaultCreateForm,ou=UserForm,ou=1.0,ou=DML,ou=Serv ices,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultCreateForm dn: cn=UserForm:#ID#UserForm:DefaultObjectClassSelectionForm,ou=UserForm,ou=1.0, ou=DML,ou=Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultObjectClassSelectionForm dn: cn=UserForm:#ID#UserForm:DefaultDisplayComponentFields,ou=UserForm,ou=1.0,ou =DML,ou=Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultDisplayComponentFields dn: cn=UserForm:#ID#UserForm:DefaultEditFieldForm,ou=UserForm,ou=1.0,ou=DML,ou=S ervices,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultEditFieldForm dn: cn=UserForm:#ID#UserForm:DefaultListFormsForm,ou=UserForm,ou=1.0,ou=DML,ou=S ervices,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultListFormsForm dn: cn=UserForm:#ID#UserForm:DefaultEditFormForm,ou=UserForm,ou=1.0,ou=DML,ou=Se rvices,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultEditFormForm dn: cn=UserForm:#ID#UserForm:DefaultGroupForm,ou=UserForm,ou=1.0,ou=DML,ou=Servi ces,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultGroupForm dn: cn=UserForm:#ID#UserForm:DefaultFindLibrary,ou=UserForm,ou=1.0,ou=DML,ou=Ser vices,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultFindLibrary dn: cn=UserForm:#ID#UserForm:DefaultGroupFilterForm,ou=UserForm,ou=1.0,ou=DML,ou =Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultGroupFilterForm dn: cn=UserForm:#ID#UserForm:DefaultOuForm,ou=UserForm,ou=1.0,ou=DML,ou=Services ,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultOuForm dn: cn=UserForm:#ID#UserForm:DefaultDomainForm,ou=UserForm,ou=1.0,ou=DML,ou=Serv ices,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultDomainForm dn: cn=UserForm:#ID#UserForm:DefaultLocalityForm,ou=UserForm,ou=1.0,ou=DML,ou=Se rvices,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultLocalityForm dn: cn=UserForm:#ID#UserForm:DefaultFindForm,ou=UserForm,ou=1.0,ou=DML,ou=Servic es,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultFindForm dn: cn=UserForm:#ID#UserForm:DefaultSearchConfigForm,ou=UserForm,ou=1.0,ou=DML,o u=Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultSearchConfigForm dn: cn=Configuration:#ID#Configuration:DefaultSearchOptions,ou=Configuration,ou= 1.0,ou=DML,ou=Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: Configuration:#ID#Configuration:DefaultSearchOptions dn: cn=UserForm:#ID#UserForm:DefaultCOSTemplateForm,ou=UserForm,ou=1.0,ou=DML,ou =Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultCOSTemplateForm dn: cn=UserForm:#ID#UserForm:DefaultExtensionsEditForm,ou=UserForm,ou=1.0,ou=DML ,ou=Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultExtensionsEditForm dn: cn=UserForm:#ID#UserForm:DefaultManagedDirectoryForm,ou=UserForm,ou=1.0,ou=D ML,ou=Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultManagedDirectoryForm dn: cn=UserForm:#ID#UserForm:DefaultOrganizationPickerForm,ou=UserForm,ou=1.0,ou =DML,ou=Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultOrganizationPickerForm dn: cn=UserForm:#ID#UserForm:DefaultListNamingAttributesForm,ou=UserForm,ou=1.0, ou=DML,ou=Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultListNamingAttributesForm dn: cn=UserForm:#ID#UserForm:DefaultNamingAttributeForm,ou=UserForm,ou=1.0,ou=DM L,ou=Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultNamingAttributeForm dn: cn=UserForm:#ID#UserForm:DefaultRolesForm,ou=UserForm,ou=1.0,ou=DML,ou=Servi ces,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultRolesForm dn: cn=UserForm:#ID#UserForm:DefaultRoleForm,ou=UserForm,ou=1.0,ou=DML,ou=Servic es,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultRoleForm dn: cn=UserForm:#ID#UserForm:DefaultDeleteForm,ou=UserForm,ou=1.0,ou=DML,ou=Serv ices,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultDeleteForm dn: cn=UserForm:#ID#UserForm:DefaultDeleteGeneralPurposeForm,ou=UserForm,ou=1.0, ou=DML,ou=Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultDeleteGeneralPurposeForm dn: cn=UserForm:#ID#UserForm:DefaultEnableForm,ou=UserForm,ou=1.0,ou=DML,ou=Serv ices,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultEnableForm dn: cn=UserForm:#ID#UserForm:DefaultDisableForm,ou=UserForm,ou=1.0,ou=DML,ou=Ser vices,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultDisableForm dn: cn=UserForm:#ID#UserForm:DefaultRenameForm,ou=UserForm,ou=1.0,ou=DML,ou=Serv ices,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultRenameForm dn: cn=UserForm:#ID#UserForm:DefaultConfigBackupRestoreForm,ou=UserForm,ou=1.0,o u=DML,ou=Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultConfigBackupRestoreForm dn: cn=UserForm:#ID#UserForm:DefaultBrowseForm,ou=UserForm,ou=1.0,ou=DML,ou=Serv ices,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultBrowseForm dn: cn=Configuration:#ID#Configuration:ComponentProperties,ou=Configuration,ou=1 .0,ou=DML,ou=Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: Configuration:#ID#Configuration:ComponentProperties dn: cn=Configuration:#ID#Configuration:DefaultFormConfiguration,ou=Configuration ,ou=1.0,ou=DML,ou=Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: Configuration:#ID#Configuration:DefaultFormConfiguration dn: cn=Configuration:#ID#Configuration:DefaultRoles,ou=Configuration,ou=1.0,ou=D ML,ou=Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: Configuration:#ID#Configuration:DefaultRoles dn: cn=Configuration:#ID#Configuration:DefaultCapabilities,ou=Configuration,ou=1 .0,ou=DML,ou=Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: Configuration:#ID#Configuration:DefaultCapabilities dn: cn=Configuration:#ID#Configuration:DefaultNamingAttributesConfiguration,ou=C onfiguration,ou=1.0,ou=DML,ou=Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: Configuration:#ID#Configuration:DefaultNamingAttributesConfiguration dn: cn=UserForm:#ID#UserForm:DefaultEditPasswordForm,ou=UserForm,ou=1.0,ou=DML,o u=Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:DefaultEditPasswordForm dn: cn=Configuration:#ID#Configuration:WPSearchOptions,ou=Configuration,ou=1.0,o u=DML,ou=Services,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: Configuration:#ID#Configuration:WPSearchOptions dn: cn=UserForm:#ID#UserForm:WPSearchLibrary,ou=UserForm,ou=1.0,ou=DML,ou=Servic es,dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:WPSearchLibrary dn: cn=UserForm:#ID#UserForm:WPSearchForm,ou=UserForm,ou=1.0,ou=DML,ou=Services, dc=bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:WPSearchForm dn: cn=UserForm:#ID#UserForm:WPViewForm,ou=UserForm,ou=1.0,ou=DML,ou=Services,dc =bozo_company,dc=com objectClass: top objectClass: applicationProcess description:: cn: UserForm:#ID#UserForm:WPViewForm dn: cn=clownadmin,ou=Special Users,dc=bozo_company,dc=com sn: clownadmin ou: People ou: Special Users cn: clownadmin objectClass: top objectClass: person objectClass: organizationalPerson userPassword: {SHA}ZC/bQou6tU8wl3TJ6dCoSasxgVA= dn: uid=Replica,ou=People,dc=bozo_company,dc=com uid: Replica cn: Replica objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword: {SSHA}xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx shadowLastChange: 13761 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 22222 gidNumber: 100 homeDirectory: /tmp gecos: Replica userid for slave LDAP servers dn: cn=david.m.barr,ou=People,dc=bozo_company,dc=com uid: david.m.barr sn: david.m.barr ou: People cn: david.m.barr objectClass: top objectClass: person objectClass: organizationalPerson objectClass: uidObject objectClass: pwdPolicyChecker objectClass: pwdPolicy pwdCheckModule:: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX pwdAttribute: userPassword userPassword: {SSHA}XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX dn: cn=Test.user02,ou=People,dc=bozo_company,dc=com uid: Test.user02 sn: Test.user02 ou: People cn: Test.user02 objectClass: top objectClass: person objectClass: organizationalPerson objectClass: uidObject objectClass: pwdPolicyChecker objectClass: pwdPolicy pwdCheckModule:: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX pwdAttribute: userPassword pwdLockout: TRUE userPassword: {SSHA}XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX dn: cn=Test.user04,ou=People,dc=bozo_company,dc=com uid: Test.user04 sn: Test.user04 ou: People cn: Test.user04 objectClass: top objectClass: person objectClass: organizationalPerson objectClass: uidObject userPassword: {SSHA}XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX dn: ou=Policies,dc=bozo_company,dc=com objectClass: top objectClass: organizationalUnit ou: Policies dn: cn=Password Policy,ou=Policies,dc=bozo_company,dc=com objectClass: top objectClass: pwdPolicy objectClass: person description: The default password policy pwdAllowUserChange: TRUE pwdAttribute: userPassword pwdCheckQuality: 2 pwdExpireWarning: 3600 pwdFailureCountInterval: 30 pwdGraceAuthNLimit: 5 pwdInHistory: 5 pwdLockout: TRUE pwdLockoutDuration: 0 pwdMaxAge: 5184000 pwdMaxFailure: 5 pwdMinAge: 3600 pwdMinLength: 5 pwdMustChange: TRUE pwdSafeModify: FALSE sn: Password Policy cn: Password Policy dn: ou=Standard Policy,ou=Policies,dc=bozo_company,dc=com objectClass: top objectClass: organizationalUnit objectClass: pwdPolicy objectClass: pwdPolicyChecker ou: Standard Policy pwdAttribute: userPassword pwdCheckQuality: 2 pwdMaxFailure: 3 pwdMustChange: TRUE pwdSafeModify: TRUE pwdLockoutDuration: 0 pwdCheckModule: ou=Standard Policy,ou=Policies,dc=bozo_company,dc=com pwdAllowUserChange: TRUE description: Standard Password Policy pwdMaxAge: 7776002 pwdExpireWarning: 432000 pwdFailureCountInterval: 120 pwdMinLength: 14 pwdInHistory: 10 pwdGraceAuthNLimit: 0 pwdMinAge: 86400 dn: cn=accesslogname,dc=bozo_company,dc=com objectClass: top objectClass: person objectClass: organizationalPerson ou: accesslogname description: accesslog sn: accesslogname cn: accesslogname dn: cn=john.d.doe,ou=People,dc=bozo_company,dc=com uid: john.d.doe sn: john.d.doe ou: People cn: john.d.doe objectClass: top objectClass: person objectClass: organizationalPerson objectClass: uidObject userPassword: {SSHA}XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Anyone out there who can help? -David dbc(a)usa.net ________________________________ CONFIDENTIALITY NOTICE: The information contained in this electronic mail (email) transmission (including attachments), is intended by MCLANE ADVANCED TECHNOLOGIES for the use of the named individual or entity to which it is addressed and may contain information that is privileged, confidential and/or protected as a trade secret. It is not intended for transmission to, or receipt by, any individual or entity other than the named addressee(s). If you have received this email in error, please delete it (including attachments) and any copies thereof without printing, copying or forwarding it, and notify the sender of the error by email reply immediately.

8 17

recursion in olcLimits
by Mundry, Marvin 27 Dec '13

27 Dec '13

Hi, is there a way in openldap to define limits (search result size limits) for the members of a group and the members of sub groups of that group recursively (i.e. something like the setspec syntax for acls)? for acls the recursion could be done via: access to dn.subtree="ou=branch1,dc=organization,dc=com" by set="[cn=chiefcommanders,ou=groups,dc=organization,dc=com]/member* & user" manage the "group[/oc[/at]]=<pattern>" form what I understand does not allow to recursively resolve members of sub groups. Thanks, Marvin

1 0

MMR config question - serverID without URL and CSN too old, ignoring in the log
by Daniel Jung 27 Dec '13

27 Dec '13

Set up 4 way MMR setup with 2.4.37, centos 6. Reading the doc[0] indicates that adding the URL is an optional and is used to avoid future serverID collision and using the number alone does work without any issue. Based on that information, i created 3 MMR setup with each provider with unique serverids and unique rid within each sever pointing to other providers. I have seen examples where each provider has multiple serverIDs (all providers), as the doc indicates, this is possible only if URL option is specified. Since i didnt use the URL, i only configured single serverID per the provider in the global cn=config. I had tested cn=config with 2 MMR and i didnt see the CSN too old, ignoring message in the log. But, when i set it up to be 3 way MMR, i am seeing this msg with new sync where other provider sends do_synrepl2 to the original provider and hence CSN too old, ignoring is logged. I searched the mailing list and some of the reputable members here have mentioned it is due to wrong MMR serverID setup. Could you point out if serverid without URL may be the culprit to this problem? I see no other issues other than this, replication to other consumers work fine and data are in synced. my setup serverID and rid setup. serverID 1 rid 000 for replicating from serverID 2 rid 001 for replication from serverID 3 serverID 2 rid 000 for serverID 1 rid 001 for serverID 3 serverID 3 rid 000 for serverID 1 rid 001 for serverID 2 Thank you [0] http://www.zytrax.com/books/ldap/ch6/#serverid

1 1

How to sync UID/GID?
by Peng Yu 26 Dec '13

26 Dec '13

Hi, I'm able to create an OpenLDAP server. I can use ldapsearch to query the server. https://help.ubuntu.com/12.10/serverguide/openldap-server.html http://serverfault.com/questions/19323/is-it-feasible-to-have-home-folder-h… I see on the above URL that OpenLDAP can be used to sync UID/GID. But it is not clear to how to do it. Could anybody point me some directions? Thanks. "... as you have to keep the UID and GIDs in sync - use something like OpenLDAP ..." -- Regards, Peng

2 1

missing libldif.so library ?
by Daniel Jung 26 Dec '13

26 Dec '13

Hi, I can't seem to find this lib anymore after upgrading to 2.4.37. Is this lib not being built anymore? Thanks

3 3

LDAP Proxy
by Keith Hamburg 24 Dec '13

24 Dec '13

I'm trying to configure a third party product to obtain the list of valid users based on a group membership in a corporate active directory server. The third party product is not capable of querying for users based on group membership. It can only use an OU or objectClass. The corporate AD server has a very broad "All Users" OU and we can't add an OU or objectClass to AD . I would like to configure an OpenLDAP proxy using that can dynamically create an OU by querying the members of a group. Is this possible using overlays? Another possibility is that try to synchronize OpenLDAP with AD based on a filter that includes membership in only one group. Would either of these methods work or is there another solution I haven't mentioned? Thanks, Keith

1 0

MDB_BAD_RSLOT while executing slapacl
by Igor Zinovik 24 Dec '13

24 Dec '13

Hello. Today I run slapacl to test access rights and saw this: ldap3# sudo slapacl -F /etc/openldap/slapd.d/ ... ... 52a8ae51 mdb_opinfo_get: err MDB_BAD_RSLOT: Invalid reuse of reader locktable slot(-30783) read access to o: ALLOWED At http://symas.com/mdb/doc/group__errors.html#ga1b6cbb28da30e28c48c9df66dd398… I read explanation that this error means: Txn has too many dirty pages. slapd 2.4.36 with Linux kernel 3.7.10 x86_64. In my slapd I have single database with mdb backend: dn: olcDatabase={1}mdb,config ... olcDbNoSync: FALSE olcDbMaxSize: 1073741824 olcDbMode: 0600 olcDbSearchStack: 16 Two questions: 0. What might cause this error? 1. Should I worry about this?

2 8

How to configure LDAP for sync passwd and group between ubuntu machines?
by Peng Yu 24 Dec '13

24 Dec '13

Hi, I'm trying to find a succinct description on how to use LDAP for sync passwd and group between ubuntu machines. I only find some general information on LDAP but not specific for sync passwd and group. Could anybody point me some simple instructions on how to do so? Thanks. -- Regards, Peng

1 0

Question about search performance
by Ferne Quinlan 24 Dec '13

24 Dec '13

Hi, Is there someone use openldap on windows? I found the query performance on windows is too bad, Any solution or relevant official documents?

3 4

Fw: Fw: host Attribute --- Low Sensitivity/Aerospace Internal Use Only
by Warron S French 23 Dec '13

23 Dec '13

Low Sensitivity/Aerospace Internal Use Only NetWarrior, are you attempting to apply a TCP_Wrappers like behavior but implement it through LDAP? Warron French, MBA, SCSA ----- Forwarded by Warron S French/Emp/Aerospace/US on 12/23/2013 07:42 AM ----- From: Net Warrior <netwarrior863(a)gmail.com> To: openldap-technical <openldap-technical(a)openldap.org>, Date: 12/23/2013 07:36 AM Subject: host Attribute Sent by: openldap-technical-bounces(a)OpenLDAP.org Hi guys. I'm trying to restric some user to login to some server, googling around I found that some things can be donde with the host attribute, this is what I got. A user with host attribute and and a FQDN server on it server.comap.com , the pam_check_host_attr set to yes in the client configuration ( pam_ldap.conf / ldap.conf ), If I understand well the user can now login to that server, in my tests I can confirm that, what I notice is that the user can loging to all the other servers in the farm whaterver I set to the host attribute I read this article as a reference: thornelabs dot net /documentation/2013/02/01/linux-restrict-server-login-via-ldap-hostobject-objectclass-and-host-attribute.html Please, can someone shed some light on this or clarify what I'm trying to to is correct or wrong? Thanks for your time and support Regards Low Sensitivity/Aerospace Internal Use Only

3 3

host Attribute
by Net Warrior 23 Dec '13

23 Dec '13

Hi guys. I'm trying to restric some user to login to some server, googling around I found that some things can be donde with the host attribute, this is what I got. A user with host attribute and and a FQDN server on it server.comap.com , the pam_check_host_attr set to yes in the client configuration ( pam_ldap.conf / ldap.conf ), If I understand well the user can now login to that server, in my tests I can confirm that, what I notice is that the user can loging to all the other servers in the farm whaterver I set to the host attribute I read this article as a reference: thornelabs dot net /documentation/2013/02/01/linux-restrict-server-login-via-ldap-hostobject-objectclass-and-host-attribute.html Please, can someone shed some light on this or clarify what I'm trying to to is correct or wrong? Thanks for your time and support Regards

1 0

Fw: Fw: ADDING OBJECT CLASS --- Low Sensitivity/Aerospace Internal Use Only
by Warron S French 23 Dec '13

23 Dec '13

Low Sensitivity/Aerospace Internal Use Only John, I agree with Dieter, in fact I haven't finished reading this full thread yet, but my instinct was to suggest inetOrgPerson as the appropriate schema as well. Also, Terje, that is a great website I agree, but here's another one I discovered that was also very useful: http://ldap.akbkhome.com/index.php Warron French, MBA, SCSA The Aerospace Corporation Sr. UNIX SA & Storage Admin Mailstop: CH1-230 Desk: 571-307-5311 Cell: 703-967-8936 ----- Forwarded by Warron S French/Emp/Aerospace/US on 12/23/2013 07:06 AM ----- From: Terje Trane <terjet(a)funcom.com> To: openldap-technical(a)openldap.org, Date: 12/20/2013 04:10 AM Subject: Re: ADDING OBJECT CLASS Sent by: openldap-technical-bounces(a)OpenLDAP.org On 19.12.2013 22:39, Borresen, John - 0442 - MITLL wrote: > > I would like to add and objectClass(es) so that I can add, > emailAddress, employee number. Can someone refresh my memory on what > I need (objectClasses)? > > The objectClass inetOrgPerson that you can find in the file inetorgperson.schema has employeeNumber and mail and several other useful attributes. That is what we use. PS: I have found this useful: http://www.zytrax.com/books/ldap/ape/ --- This email is free from viruses and malware because avast! Antivirus protection is active. http://www.avast.com Low Sensitivity/Aerospace Internal Use Only

1 0

ADDING OBJECT CLASS
by Borresen, John - 0442 - MITLL 23 Dec '13

23 Dec '13

For my Users, currently utilizing the following: ObjectClass: account (structural) objectClass: posixAccount (auxiliary) objectClass: pwdPolicy (auxiliary) objectClass: shadowAccount (auxiliary) objectClass: top (abstract) cn: gidNumber: homeDirectory: pwdAttribute: uid: uidNumber: gecos: loginShell: pwdAllowUserChange: pwdMinLength: pwdMustChange: shadowLastChange: userPassword: I would like to add and objectClass(es) so that I can add, emailAddress, employee number. Can someone refresh my memory on what I need (objectClasses)? Thanks, John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420

6 7

Replicate cn=config between masters and slaves?
by Karsten Heymann 23 Dec '13

23 Dec '13

Hi, when setting up a cluster with 1+x masters and 1+x slaves, is it possible to use a single cn=config replicated between all of these? Or do masters and slaves need to have different settings anyhow. I'd like not to have to manage schema information and acls in two places. Best, Karsten

4 7

BIND ERROR
by Borresen, John - 0442 - MITLL 21 Dec '13

21 Dec '13

Built a test 2.4.38 server, port 389 (for now), trying to set up a NetApp filer. When attempting to run: Wcc -u jdoe No passwd entry for jdoe I can see on the server the following: 52b4adfe => bdb_search 52b4adfe bdb_dn2entry("ou=users,dc=example,dc=ldap") 52b4adfe search_candidates: base="ou=users,dc=example,dc=ldap" (0x000002d6) scope=2 52b4adfe => bdb_dn2idl("ou=users,dc=example,dc=ldap") 52b4adfe <= bdb_dn2idl: id=2 first=726 last=727 52b4adfe => bdb_equality_candidates (objectClass) 52b4adfe => key_read 52b4adfe <= bdb_index_read: failed (-30989) 52b4adfe <= bdb_equality_candidates: id=0, first=0, last=0 52b4adfe bdb_search_candidates: id=0 first=726 last=0 52b4adfe bdb_search: no candidates 52b4adfe send_ldap_result: conn=1007 op=5 p=3 52b4adfe send_ldap_response: msgid=12 tag=101 err=0 ber_flush2: 14 bytes to sd 20 Thanks in advance John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420 Email: john.borresen(a)ll.mit.edu<mailto:john.borresen@ll.mit.edu>

2 1

Authentication problem
by Jean-Charles 20 Dec '13

20 Dec '13

Hello I have a problem authenticating from a client RedHat 6.3 to a server RedHat 6.3 Connection is ok I can change user when I am root with *su paula* with no problem When I change from non root to paula *su paula* : I am requested a password, but I get an incorrect password message despite the password bieng correct Here are the details : _*SERVER Configuration (obtained with slapcat) *_ The first database does not allow slapcat; using the first available one (2) bdb_db_open: warning - no DB_CONFIG file found in directory /var/lib/ldap: (2). Expect poor performance for suffix "dc=jcs-PC,dc=home". dn: dc=jcs-PC,dc=home dc: jcs-PC objectClass: dcObject objectClass: organization o: NETEXPANSION structuralObjectClass: organization entryUUID: b9dcdb1e-f628-1032-8eef-4f234421cd34 creatorsName: cn=ldapadmin,dc=jcs-PC,dc=home createTimestamp: 20131210205228Z entryCSN: 20131210205228.791640Z#000000#000#000000 modifiersName: cn=ldapadmin,dc=jcs-PC,dc=home modifyTimestamp: 20131210205228Z dn: ou=employes,dc=jcs-PC,dc=home objectClass: organizationalUnit ou: employes structuralObjectClass: organizationalUnit entryUUID: 2008d924-f629-1032-8ef0-4f234421cd34 creatorsName: cn=ldapadmin,dc=jcs-PC,dc=home createTimestamp: 20131210205520Z entryCSN: 20131210205520.207551Z#000000#000#000000 modifiersName: cn=ldapadmin,dc=jcs-PC,dc=home modifyTimestamp: 20131210205520Z dn: cn=Paula Bionda,ou=employes,dc=jcs-PC,dc=home cn: Paula Bionda sn: Bionda uid: paula uidNumber: 503 gidNumber: 1100 gecos: Paula Bionda homeDirectory: /home/paula shadowLastChange: 10877 shadowMin: 0 shadowMax: 999999 shadowWarning: 7 shadowInactive: -1 shadowExpire: -1 shadowFlag: 0 structuralObjectClass: person entryUUID: e4f37848-f930-1032-985a-91cf669ea788 creatorsName: cn=ldapadmin,dc=jcs-PC,dc=home createTimestamp: 20131214172830Z loginShell: /bin/bash objectClass: top objectClass: person objectClass: posixAccount objectClass: shadowAccount userPassword:: e1NTSEF9aEFzWFZFejlIa2xQSUpFSFF2SnpoZmo1cTYzdzRLUlg= entryCSN: 20131219155524.533147Z#000000#000#000000 modifiersName: cn=Paula Bionda,ou=employes,dc=jcs-PC,dc=home modifyTimestamp: 20131219155524Z dn: ou=groups,dc=jcs-PC,dc=home objectClass: organizationalUnit ou: groups structuralObjectClass: organizationalUnit entryUUID: e1a8545a-fa85-1032-84b7-a9514c4c1551 creatorsName: cn=ldapadmin,dc=jcs-PC,dc=home createTimestamp: 20131216100923Z entryCSN: 20131216100923.403228Z#000000#000#000000 modifiersName: cn=ldapadmin,dc=jcs-PC,dc=home modifyTimestamp: 20131216100923Z dn: cn=mygroup,ou=groups,dc=jcs-PC,dc=home objectClass: top objectClass: posixGroup cn: mygroup gidNumber: 1100 memberUid: paula memberUid: giuseppe structuralObjectClass: posixGroup entryUUID: c26713a0-fa9f-1032-8b7d-155dd966052d creatorsName: cn=ldapadmin,dc=jcs-PC,dc=home createTimestamp: 20131216131437Z entryCSN: 20131216131437.881194Z#000000#000#000000 modifiersName: cn=ldapadmin,dc=jcs-PC,dc=home modifyTimestamp: 20131216131437Z _*CLIENT C*__*onfiguration *_ authconfig-tui gives [] Cache Infomation [*] Use LDAP [] Use NIS [] Use IPAV2 [] Use WinBind [*] Use MD5 Passwords [*] Use Shadow Passwords [*] Use LDAP Authentication [] Use Kerboros [*] Use Fingerprint Reader [] Use Windbind Authentication [*] Local Authorization is sufficient [] Use TLS ldap://192.168.1.12/ Base DN: dc=jcs-PC,dc=home _*Result su paula *_ a) when I am logged in as root, *su paula* logs me into paula : no problem b) when I am not logged in as root and I do *su paula* I am requested a password (as expected), but then I get incorrect password despite the password being correct Here is the log Dec 19 18:49:50 jcs-PC slapd[6441]: => slap_access_allowed: backend default read access granted to "(anonymous)" Dec 19 18:49:50 jcs-PC slapd[6441]: => access_allowed: read access granted by read(=rscxd) Dec 19 18:49:50 jcs-PC slapd[6441]: conn=1005 op=3 SEARCH RESULT tag=101 err=0 nentries=1 text= Dec 19 18:49:50 jcs-PC slapd[6441]: conn=1006 fd=21 ACCEPT from IP=192.168.1.17:56000 (IP=0.0.0.0:389) Dec 19 18:49:50 jcs-PC slapd[6441]: conn=1006 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Dec 19 18:49:50 jcs-PC slapd[6441]: conn=1006 op=0 STARTTLS Dec 19 18:49:50 jcs-PC slapd[6441]: conn=1006 op=0 RESULT oid= err=0 text= Dec 19 18:49:50 jcs-PC slapd[6441]: conn=1006 fd=21 closed (TLS negotiation failure) Dec 19 19:04:43 jcs-PC slapd[6441]: conn=1005 op=4 UNBIND Dec 19 19:04:43 jcs-PC slapd[6441]: conn=1005 fd=14 closed And these are the last 2 lines of wireshark _Source_ _Destination_ _Protocol_ _Info_ 192.168.1.17(Client) 192.168.1.12 (Server) LDAP ExtendedReq LDAP_START_TLS_OID 192.168.1.12 192.168.1.17 LDAP ExtendedResp LDAP_START_TLS_OID responseName missing I am surprised about STARTLS because there seems to be nothing in my configuration files about TLS Thank you Axel --

1 0

search on multimaster gives 2 different results
by Gare Calhoun 19 Dec '13

19 Dec '13

Hello, We are running 2 servers in multimaster mode ; openldap-2.4.35 on CentOS 6.6 using the autogroup overlay. I have a search filter (APersonCategory=*ADJ*) that returns different numbers of records when queried against each server. The actual records exist on both servers. 1 server is not returning all expected records. The other server returns records as expected. There is no index defined for this attribute in slapd.conf on either server. schema definition of attribute is same on each server: attributetype ( 1.3.6.1.4.1.5923.1.1.1.23 NAME 'APersonCategory' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) Would someone suggest what to look at to troubleshoot this? Thank you very much for your assistance. -Gare Calhoun -- . . . . . . . . . . . . . . . . . . . . . . . . . . . . Gare Calhoun Antioch University IT Services, Software Developer

1 0

Fw: TLS Configurations with OpenLDAP-2.4.23 on CentOS-6.2 --- Low Sensitivity/Aerospace Internal Use Only
by Warron S French 19 Dec '13

19 Dec '13

Low Sensitivity/Aerospace Internal Use Only Quanah, I downloaded the RPMs for OpenLDAP-LTB, but I didn't see anything that looked like my prior OpenLDAP (original) files. With my prior set, I was doing configuration changes in the /etc/openldap/slapd.d/cn=config directory's files. I didn't feel comfortable with moving forward because I found no README file or Getting Started or whatever. I was also looking for such documentation on the www.ltb-project.org website so that I could get a preliminary idea of what I was going to do, before I executed the installation and configuration steps. One of my major concerns is the ability to update the binaries on a regular basis for security purposes. I need to do it very easily and without re-engineering a yum repository every time there is an update. I am going to be building this LDAP system on a totally isolated environment, NO internet access at all. Can you (or anyone else) tell me, do I need to register with the LTB-Project.org website in order to find good, solid, installation and configuration instructions for what I need to accomplish? I am a newbie at OpenLDAP, I am senior in UNIX skills. I just have never had a single successful implementation of OpenLDAP. Warron French, MBA, SCSA ----- Forwarded by Warron S French/Emp/Aerospace/US on 12/19/2013 01:04 PM ----- From: Quanah Gibson-Mount <quanah(a)zimbra.com> To: Warron S French <Warron.S.French(a)aero.org>, openldap-technical(a)openldap.org, Date: 12/18/2013 01:06 PM Subject: Re: TLS Configurations with OpenLDAP-2.4.23 on CentOS-6.2 --- Low Sensitivity/Aerospace Internal Use Only Sent by: openldap-technical-bounces(a)OpenLDAP.org --On Wednesday, December 18, 2013 12:38 PM -0500 Warron S French <Warron.S.French(a)aero.org> wrote: > Low Sensitivity/Aerospace Internal Use Only > > Sorry, I thought I had replied back to the list. Apparently I have to > forward my responses to the list. > > I am checking into the options you suggested. I will probably pursue the > LTB Project, would you agree that's the better course of action? It's magnitudes better than what ships with RHEL/CentOS. Plenty of people use it with success. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration Low Sensitivity/Aerospace Internal Use Only

2 1

Monitoring back-mdb's olcDbMaxSize
by Michael Ströder 19 Dec '13

19 Dec '13

HI! Using back-mdb there's one thing which could cause trouble: One has to configure olcDbMaxSize which cannot be changed later. So when monitoring OpenLDAP with back-mdb it would be interesting to see how much space of configured olcDbMaxSize is already occupied. Does it make sense to compare the real file size shown by du -h /path/to/data.mdb to configured olcDbMaxSize? Ciao, Michael.

4 5

Fw: Fw: LDAP ERROR 19 CONTRAINT VIOLATION --- Low Sensitivity/Aerospace Internal Use Only
by Warron S French 19 Dec '13

19 Dec '13

Low Sensitivity/Aerospace Internal Use Only John, what was your solution? Was it a syntax error? Warron French, MBA, SCSA ----- Forwarded by Warron S French/Emp/Aerospace/US on 12/19/2013 09:41 AM ----- From: "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> To: "openldap-technical(a)openldap.org" <openldap-technical(a)openldap.org>, Date: 12/19/2013 09:06 AM Subject: RE: LDAP ERROR 19 CONTRAINT VIOLATION Sent by: openldap-technical-bounces(a)OpenLDAP.org Nevermind, resolved it. From: openldap-technical-bounces(a)OpenLDAP.org [ mailto:openldap-technical-bounces@OpenLDAP.org] On Behalf Of Borresen, John - 0442 - MITLL Sent: Thursday, December 19, 2013 8:36 AM To: openldap-technical(a)openldap.org Subject: LDAP ERROR 19 CONTRAINT VIOLATION Adding sudo.schema (sudo.ldif) to cn=schema,cn=config: # ldapadd -H ldap:/// -x -D cn=admin,cn=config -W -f /usr/local/openldap/etc/openldap/schema/sudo.ldif Enter LDAP Password: adding new entry "cn=sudo,cn=schema,cn=config" ldap_add: Constraint violation (19) additional info: structuralObjectClass: no user modification allowed Currently, my schema?s are: cn={0}core cn={1}cosine cn={2}inetorgperson cn={3}java cn={4}misc cn={5}nis cn={6}openldap cn={7}policy cn={8}2307bis cn={9}printers John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420 Ph: (781) 981-1609 Email: john.borresen(a)ll.mit.edu Low Sensitivity/Aerospace Internal Use Only

1 0

LDAP ERROR 19 CONTRAINT VIOLATION
by Borresen, John - 0442 - MITLL 19 Dec '13

19 Dec '13

Adding sudo.schema (sudo.ldif) to cn=schema,cn=config: # ldapadd -H ldap:/// -x -D cn=admin,cn=config -W -f /usr/local/openldap/etc/openldap/schema/sudo.ldif Enter LDAP Password: adding new entry "cn=sudo,cn=schema,cn=config" ldap_add: Constraint violation (19) additional info: structuralObjectClass: no user modification allowed Currently, my schema's are: cn={0}core cn={1}cosine cn={2}inetorgperson cn={3}java cn={4}misc cn={5}nis cn={6}openldap cn={7}policy cn={8}2307bis cn={9}printers John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420 Ph: (781) 981-1609 Email: john.borresen(a)ll.mit.edu<mailto:john.borresen@ll.mit.edu>

1 1

TLS: peer cert untrusted or revoked (0x42)
by Kumar, Amit 19 Dec '13

19 Dec '13

Dear All, We have installed a newer version of Ubuntu 13.10 and trying to setup LDAP client. Context: Self signed server CA certificate in pem format installed on the client with a hashed symbolic link pointing to it. We have other clients that are able to validate and are working great, hence I do not think this is a certificate issue, and also it is not expired. And I get this legendary error "TLS: peer cert untrusted or revoked (0x42)" for which number of recommendation have been made online, to set TLS_REQCERT & TLS_CACERT in the /etc/ldap.conf Although this did not work for me. While openssl and gnutls command can successfully connect and validate the certificate, ldapsearch and getent miserably fails. Any insight into this error and an approach to fix this will be greatly appreciated. Best Regards, Amit

1 1

Syncrepl on glued databases only replicates the superior and the first subordinate
by Robert Minsk 19 Dec '13

19 Dec '13

Openldap version 2.4.35 Our global ldap server has the following naming contexts: namingContexts: o=global,ou=studios,dc=methodstudios,dc=net namingContexts: o=chi01,ou=studios,dc=methodstudios,dc=net namingContexts: o=det01,ou=studios,dc=methodstudios,dc=net namingContexts: o=la01,ou=studios,dc=methodstudios,dc=net namingContexts: o=ny01,ou=studios,dc=methodstudios,dc=net namingContexts: o=lon01,ou=studios,dc=methodstudios,dc=net namingContexts: o=van01,ou=studios,dc=methodstudios,dc=net namingContexts: ou=studios,dc=methodstudios,dc=net namingContexts: ou=login,dc=methodstudios,dc=net ou=studio,dc=methodstudios,dc=net is the superior database and global, chi01, det01, la01, ny01, lon01, van01 are all have "subordinate advertise" and are all sync providers. The sync provider: database mdb suffix "ou=studios,dc=methodstudios,dc=net" rootdn ... rootpw ... directory /var/lib/ldap/studios.methodstudios.net maxsize 17179869184 serverID 201 overlay glue overlay syncprov syncprov-reloadhint TRUE syncprov-checkpoint 100 5 sync_use_subentry true ... The sync consumer only has a database for ou=studios,dc=methodstudios,dc=net. database mdb suffix "ou=studios,dc=methodstudios,dc=net" rootdn ... rootpw ... directory /var/lib/ldap/studios.methodstudios.net maxsize 17179869184 serverID 202 syncrepl rid=201 provider=ldap://<providor host name> type=refreshAndPersist retry="60 10 300 +" searchbase="ou=studios,dc=methodstudios,dc=net" bindmethod=simple starttls=yes binddn="..." credentials=... schemachecking=off sizelimit=unlimited timelimit=unlimited updateref ldap://<providor host name> It seems to be only syncing ou=studios,dc=methodstudios,dc=net and o=global,ou=studios,dc=methodstudios,dc=net. If I change the order of the provider server so that chi01 comes before global then only syncing ou=studios,dc=methodstudios,dc=net and o=chi01,ou=studios,dc=methodstudios,dc=net get sync. Am I doing anything obviously wrong? -- Robert Minsk Systems and Software Engineer WWW.METHODSTUDIOS.COM <http://www.methodstudios.com> 730 Arizona Ave, Santa Monica, CA 90401 O:+1 310 434 6500 <tel:+13104346500> // F:+1 310 434 6501 <tel:+13104346501> Los Angeles <http://www.methodstudios.com/signature/url/los-angeles><http://www.methodstudios.com/signature/url/los-angeles> This e-mail and any attachments are intended only for use by the addressee(s) named herein and may contain confidential information. If you are not the intended recipient of this e-mail, you are hereby notified any dissemination, distribution or copying of this email and any attachments is strictly prohibited. If you receive this email in error, please immediately notify the sender by return email and permanently delete the original, any copy and any printout thereof. The integrity and security of e-mail cannot be guaranteed.

1 1

Oracle OpenLDAP 2.4.30 add on PPOLICY
by David Barr 18 Dec '13

18 Dec '13

Thank you, Perfec, Dieter. I cannot compile the OpenLDAP.org version. I have tried several suggested methods from internet to test the policy, none work as I get syntax error. Suggestions? Example: openldapwhoami -e ppolicy -X -D "cn=Manager,dc=$DC1,dc=$DC2" "uid=$U" ldapsearch -e ppolicy -D "uid=user02,ou=People,dc=training,dc=com" -W Is there a command to see what policies are loaded via slapd.conf ? - David. --------------------------------------------------------- Am Tue, 17 Dec 2013 18:35:10 +0000 schrieb David Barr <David.Barr2(a)mclaneat.com>: > I am trying to get policy to work in an Oracle Solaris 11 environment. > Trouble is it is pre-compiled, anyone know how I can use a policy > that didn't come with the OpenLDAP 2.4.30-0.175.1.0.0.24.0 ? Run slapd -VVV in order to check the build in modules of slapd. -Dieter -- Dieter KlÃnter | Systemberatung http://dkluenter.de GPG Key ID:DA147B05 53Â37'09,95"N 10Â08'02,42"E ________________________________ CONFIDENTIALITY NOTICE: The information contained in this electronic mail (email) transmission (including attachments), is intended by MCLANE ADVANCED TECHNOLOGIES for the use of the named individual or entity to which it is addressed and may contain information that is privileged, confidential and/or protected as a trade secret. It is not intended for transmission to, or receipt by, any individual or entity other than the named addressee(s). If you have received this email in error, please delete it (including attachments) and any copies thereof without printing, copying or forwarding it, and notify the sender of the error by email reply immediately.

3 2

Re: TLS Configurations with OpenLDAP-2.4.23 on CentOS-6.2 --- Low Sensitivity/Aerospace Internal Use Only
by Quanah Gibson-Mount 18 Dec '13

18 Dec '13

--On Wednesday, December 18, 2013 11:21 AM -0500 Warron S French <Warron.S.French(a)aero.org> wrote: > Low Sensitivity/Aerospace Internal Use Only > > Quanah, thank you for responding. Please keep replies on the list. > I have since my email updated all of my servers using yum > kernel-<whatever> update, and gotten my three virtual systems updated all > to CentOS-6.4, and on the same kernel. So, can we agree I have addressed > situation-A? Or do I need to update further? Yes, 6.4 is fine. > As for situation-B, thank you for filling me in. I was getting really > frustrated and was starting to think I was doing something wrong. But, > can you tell me, does symas or LTB come in a CentOS package format? > Something I can maintain easily instead of building from source code? Yes, I suggest you follow the links I provided. --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 2

RE: OPENLDAP UPGRADE
by Quanah Gibson-Mount 18 Dec '13

18 Dec '13

--On Wednesday, December 18, 2013 11:33 AM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > Yea, that's is what I was thinking, too. Ran netstat: > ># netstat -tulpn | grep ':389' | grep 'LISTEN' > tcp 0 0 :::389 :::* > LISTEN 25516/java > > Why java is LISTENING on port 389...I have no idea! I am thinking since > someone (not me) tried to build OpenDJ, it still has some fingers out > there holding onto resources. Time to use "kill -9". --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

OPENLDAP UPGRADE
by Borresen, John - 0442 - MITLL 18 Dec '13

18 Dec '13

In the process of upgrading to 2.4.38 (was able to work with the LTB group to resolve the repo issue there), created a slapd.conf, and converted to the slapd.d format successfully. - this is initially on a test server. Most of the slapd.conf was migrated over from the 2.4.23 configuration that is currently in production. When starting slapd, receiving the following (and slapd does not start): # /usr/local/openldap/libexec/slapd -u ldap -d 1 -F /usr/local/openldap/etc/openldap/slapd.d 52b1c516 @(#) $OpenLDAP: slapd 2.4.38 (Nov 27 2013 13:40:34) $ clement@localhost.localdomain:/home/clement/build/BUILD/openldap-2.4.38/servers/slapd ldap_pvt_gethostbyname_a: host=<server_name>, r=0 52b1c516 daemon_init: listen on ldap:/// 52b1c516 daemon_init: 1 listeners to open... ldap_url_parse_ext(ldap:///) 52b1c516 daemon: bind(7) failed errno=98 (Address already in use) 52b1c516 daemon: bind(7) failed errno=98 (Address already in use) 52b1c516 slap_open_listener: failed on ldap:/// 52b1c516 slapd stopped. 52b1c516 connections_destroy: nothing to destroy. Here is my slapd.conf: # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/openldap/etc/openldap/schema/core.schema # ## Added to support the inetOrgPerson objectClass include /usr/local/openldap/etc/openldap/schema/cosine.schema include /usr/local/openldap/etc/openldap/schema/inetorgperson.schema include /usr/local/openldap/etc/openldap/schema/java.schema include /usr/local/openldap/etc/openldap/schema/misc.schema include /usr/local/openldap/etc/openldap/schema/nis.schema include /usr/local/openldap/etc/openldap/schema/openldap.schema # include /usr/local/openldap/etc/openldap/pmi.schema include /usr/local/openldap/etc/openldap/schema/ppolicy.schema include /usr/local/openldap/etc/openldap/schema/2307bis.schema include /usr/local/openldap/etc/openldap/schema/printers.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org referral ldap://<server_name>.test.ldap pidfile /var/lib/openldap/run/slapd.pid argsfile /var/lib/openldap/run/slapd.args # Load dynamic backend modules: # modulepath /usr/local/openldap/libexec/openldap # moduleload back_bdb.la # moduleload back_hdb.la # moduleload back_ldap.la # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read access to * by self write by users read by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # BDB database definitions ####################################################################### database config rootdn "cn=admin,cn=config" rootpw {SSHA}_________________________ database bdb suffix "dc=test,dc=ldap" rootdn "cn=ldapadmin,dc=test,dc=ldap" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw {SSHA}_________________________ # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/openldap/openldap-data # Indices to maintain index objectClass eq index cn,sn,mail eq,sub index departmentNumber eq index automountKey eq index entryCSN eq index entryUUID eq index gidNumber,memberUID eq index uid eq index uidNumber,printerURI eq John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420 Ph: (781) 981-1609 Email: john.borresen(a)ll.mit.edu<mailto:john.borresen@ll.mit.edu>

3 3

TLS Configurations with OpenLDAP-2.4.23 on CentOS-6.2 --- Low Sensitivity/Aerospace Internal Use Only
by Warron S French 18 Dec '13

18 Dec '13

Low Sensitivity/Aerospace Internal Use Only Hello, I need help figuring out why I can't get CentOS-6.2 machines to authenticate against my OpenLDAP implementation where user and group entries are stored. I can use ldapsearch and get back the results I am expecting, but I don't know where in my long list of configurations I might have gone wrong, or left something else out. All of my instructions have been based on reading several (easily 20) other people's pages for configuring an LDAP DIT for the explicit purpose of centralizing USER AUTHENTICATION. I can submit my MS Word document that I used to keep track of the steps that I used thus far. I am writing up the instructions so that I can repeat them in the hopes of building a small development environment for my coworkers. In my environment I have all CentOS-6.4 OS virtual machines that I am running inside of my PC running Oracle VirtualBox. I am attempting to keep them entirely isolated from the network so, I have... a dedicated DNS server, dedicated CA server and dedicated LDAP server. Their names respectively, can be wsf-LabDNS, wsf-LabCA and wsf-LabLDAP. I wrote a script that automates the creation of an LDIF file so that the same script can turn around and add records (DNs) using ldapadd. I have CA certificates for my DNS, CA and LDAP servers, and my CA is a self-signed CA. My DNS and LDAP servers' certificates are signed by my CA. I am attempting to use my DNS and CA servers as LDAP-USER-AUTH clients against my LDAP server. CentOS requires the use of TLS certificates. I cannot get user authentication to work no matter what I have done over the past 4 months. I have a user account I created, called wsf29221, that I am using to test against LDAP. I used yum to install all of my packages, meaning I did not compile anything from scratch. I am using all of the OpenLDAP-2.4.23-32.el6_4.1. The commands I am attempting are: su - wsf29221 id wsf29221 ssh wsf29221@wsf-LabDNS (from wsf--LabCA) I am pretty sure my problem is in the TLS configuration, but I don't really know what to look at or even where to start. Warron French, MBA, SCSA |||||Submission End||||| Low Sensitivity/Aerospace Internal Use Only

2 1

Oracle OpenLDAP 2.4.30 add on PPOLICY
by David Barr 17 Dec '13

17 Dec '13

I am trying to get policy to work in an Oracle Solaris 11 environment. Trouble is it is pre-compiled, anyone know how I can use a policy that didn't come with the OpenLDAP 2.4.30-0.175.1.0.0.24.0 ? Excerpt from my slapd.conf ########### # SCHEMAS # ########### # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/corba.schema include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/ppolicy.schema ########### # MODULES # ########### # Load dynamic backend modules: modulepath /etc/openldap/modules moduleload ppolicy.la ################### # PASSWORD POLICY # ################### overlay ppolicy ppolicy_default "cn=Standard Policy,ou=Policies,dc=XXXXX,dc=XXXXX" ppolicy_use_lockout Any Ideas? ________________________________ CONFIDENTIALITY NOTICE: The information contained in this electronic mail (email) transmission (including attachments), is intended by MCLANE ADVANCED TECHNOLOGIES for the use of the named individual or entity to which it is addressed and may contain information that is privileged, confidential and/or protected as a trade secret. It is not intended for transmission to, or receipt by, any individual or entity other than the named addressee(s). If you have received this email in error, please delete it (including attachments) and any copies thereof without printing, copying or forwarding it, and notify the sender of the error by email reply immediately.

3 2

deploy monitor backend while existing DB in the root namespace
by GALAMBOS Daniel 17 Dec '13

17 Dec '13

Hi, My task was to configure our existing openldap (debian wheezy 2.4.31-1+nmu2) to use use monitor backend. The main problem is that our (BDB backed) database has empty suffix (for historical reason). If the monitor defined later under the /etc/ldap/slapd.d then the BDB, slapd fails to start, because BDB database would hide the monitor. database init failed (monitor) 52b038c0 olcDatabase: value #0: "monitor" database serving namingContext "cn=Monitor" is hidden by "bdb" database serving namingContext "". (monitor) 52b038c0 config error processing olcDatabase={2}monitor,cn=config: "monitor" database serving namingContext "cn=Monitor" is hidden by "bdb" database serving namingContext "". If it's defined before the bdb, then the slapd starts, but ldapsearch give 'no such object' for cn=Monitor. (should not be permission issue) It was doesn't matter if i included 'olcSubordinate: true' in the monitor. When I added a non-empty suffix to the bdb in the devel environment, the monitor worked, but this can't be the solution for our prod servers. monitor backend is defined by: dn: olcDatabase=monitor objectClass: olcDatabaseConfig olcDatabase: monitor olcAccess: {0}to * by read olcSubordinate: TRUE A colleague is concerned about the performance loss because of the monitor backend. Does monitor use significant resources in a heavily used slapd? Thanks, Dancsa

2 1

replication refint
by Artur Nike 17 Dec '13

17 Dec '13

Hi All, debian wheezy, OpenLDAP 2.4.31, muti-master replication Small question whether referential integrity (multiple-captains) are replicated? It seems to me that, yes, but the change (removal), entry on one of the servers does not call the bonds on the other. can by example: in annex replikat_refint.html ...sorry for the little technical diagram but I just had libre-office. Can anyone have any suggestions or experience with this problem. For all, thank you in advance. Muniek

2 3

default setup examples/documentation
by Alex Mestiashvili 17 Dec '13

17 Dec '13

Hi All, I am trying to find some kind of official documentation or examples for default structures for ldap. It is clear that the structure can vary a lot for different cases. But most of the users I think want to have a couple of ldif files simulating unix's passwd/group files something like that: ou=People,dc=example,dc=com uid=toor,ou=People,dc=example,dc=com ou=Group,dc=example,dc=com with proper objectClasses and shadow attributes. That should be enough to start using ldap. For sure there are tons of examples in the net, but this time I tried to do it just by reading openldap.org site and couldn't find enough to start with it. Could you please point me on more or less official documentation for the case above ? Thank you, Alex

1 0

Question about openLDAP proxy to MSAD
by Alex Samad - Yieldbroker 17 Dec '13

17 Dec '13

Hi I am using openldap to sit in front of MS AD. So that servers in the DMZ can access information in MS AD and in openldap. My problem is that MS AD sends back referrals and using referrals = ignore fails. Is there anything in the olcLDAPConfig that I set to stop referrals and/or set it to point back to itself A

1 0

Storing graph data structure with MDB_FIXEDMAP
by Aris Setyawan 16 Dec '13

16 Dec '13

Hi, I'm new in this list. I plan to store graph data structure (vertex and edge) in LMDB. The "edge" data value of a record will contain a pointer which is pointing to the address of "vertex" data value. So, I must make it sure that data value address is not changing during operation. According to the doc, I can use MDB_FIXEDMAP. And from the doc: "... the memory map will always reside at the same virtual address and pointers used to reference data items in the database will be constant across multiple invocations. ..." Spesifically: "... pointers used to reference data items in the database will be constant ..." Is this mean that I must allocate memory to write data using mdb_put with MDB_RESERVE flag?

2 3

Fwd: Linux kernel performance regressions
by Howard Chu 16 Dec '13

16 Dec '13

-------- Original Message -------- Subject: Linux kernel performance regressions Date: Wed, 11 Dec 2013 04:33:06 -0800 From: Howard Chu <hyc(a)symas.com> To: OpenLDAP-devel(a)openldap.org <OpenLDAP-devel(a)openldap.org> We upgraded from kernel 3.5 to 3.12.3 to update some of our benchmark numbers and hit some major performance regressions, mainly because the kernel is throttling processes that use too much CPU. This is definitely a kernel bug, as the throttle mechanism belongs to the realtime scheduler and none of the processes being affected had realtime priority when the throttle kicked in. I've posted a query to the linux kernel mailing list but haven't gotten any satisfactory answers yet. The same throttling behavior also occurs with 3.11.10, but there are no corresponding messages in the kernel log. The email thread is here http://lkml.indiana.edu/hypermail/linux/kernel/1312.1/02313.html A patch that may be related is described here http://lkml.org/lkml/2013/5/29/640 which explains part of the observed behavior, but not all of it (and indeed may be a red herring, unless it has some interaction with the realtime scheduler). There appear to be other serious networking related regressions in 3.12 as well. http://lkml.indiana.edu/hypermail/linux/kernel/1312.1/02588.html I recommend staying on 3.10 for production servers until this is sorted out. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 3

Design for large openldap deployments
by Christian Kratzer 16 Dec '13

16 Dec '13

Hi, I have been thinking about a scalable multi site deployment architecture for openldap where I would like to: - Have a small number of master servers centrally in the enterprise with MMR. - All account provisioning would be at the central sites. - Have multiple edge sites replicate of those masters in a star toplogy with MMR. - Allow writes to those edge sites for the purpososes of slapo_ppolicy, slapo_lastbind and password changes. I would like to avoid fully meshing all servers for MMR and would prefer a star topology where each edge site only replicates with the central site. I would also like to avoid chaining. See my previous posts why. Before I set this up in my lab I would like a second opinion. The customer is asking for best practice in large deployments. Any comments ? Greetings Christian -- Christian Kratzer CK Software GmbH Email: ck(a)cksoft.de Wildberger Weg 24/2 Phone: +49 7032 893 997 - 0 D-71126 Gaeufelden Fax: +49 7032 893 997 - 9 HRB 245288, Amtsgericht Stuttgart Web: http://www.cksoft.de/ Geschaeftsfuehrer: Christian Kratzer

4 8

Multi-master replication (ldap_sasl_bind_s failed)
by Artur Nike 16 Dec '13

16 Dec '13

Hi all, My adventure with LDAP lasts a few months, and I came to the topic of replication, namely multiple-master replication. cn = config is replicated perfectly, but the schema, say, dc = example, dc = com does not want to: (. I have two servers slap1 and slap2 I have a standard installation ##Server slap1 whezzy debian 64bit apt-get install-y slapd ldap-utils added my scheme ldapadd-Y EXTERNAL-H ldapi :///-f $ CURRENT / memberof.ldif ldapadd-Y EXTERNAL-H ldapi :///-f $ CURRENT / refint.ldif # Add "ldap :/ / ldap1 / in /etc/default/slapd sed-i "/^ SLAPD_SERVICES/s/=[^]*/=\"ldap:\/\/slap1\//'/etc/default/slapd ldapmodify-Y EXTERNAL-H ldapi :/ / /-f replica1.ldif where replica1.ldif (replication configuration):: dn: cn=config changetype: modify add: olcServerID olcServerID: 1 dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: {1}syncprov.la dn: olcDatabase={0}config,cn=config changetype: modify add: olcRootPW #only for tests olcRootPW: 123 dn: cn=config changetype: modify replace: olcServerID olcServerID: 1 ldap://slap1/ olcServerID: 2 ldap://slap2/ dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=ldap://slap1/ binddn="cn=admin,cn=config" bindmethod=simple credentials=123 searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncRepl: rid=002 provider=ldap://slap2/ binddn="cn=admin,cn=config" bindmethod=simple credentials=123 searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 - add: olcMirrorMode olcMirrorMode: TRUE This same scenario takes on a server slap2 (the name change slap1 -> slap2) where replica2.ldif (replication configuration only servers slap2) : dn: cn=config changetype: modify add: olcServerID olcServerID: 2 dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: {1}syncprov.la dn: olcDatabase={0}config,cn=config changetype: modify #only for tests add: olcRootPW olcRootPW: 123 dn: cn=config changetype: modify replace: olcServerID olcServerID: 1 ldap://slap1/ olcServerID: 2 ldap://slap2/ dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=ldap://slap1/ binddn="cn=admin,cn=config" bindmethod=simple credentials=123 searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncRepl: rid=002 provider=ldap://slap2/ binddn="cn=admin,cn=config" bindmethod=simple credentials=123 searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 - add: olcMirrorMode olcMirrorMode: TRUE and it works , the whole configuration is replicated . Now I want ( I'm trying to add a replication scheme . ) Adds only one server , eg slap2 : ldapmodify - Y EXTERNAL -H ldapi :/ / / -f rep_schema.ldif where rep_schema.ldif : # add replica schema dn: olcDatabase={1}hdb,cn=config changetype: modify replace: olcRootPW olcRootPW: 123 - replace: olcRootDN olcRootDN: cn=admin,dc=example,dc=com dn: olcDatabase={1}hdb,cn=config changetype: modify add: olcLimits olcLimits: dn.exact="cn=admin,dc=example,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited - add: olcSyncRepl olcSyncRepl: rid=004 provider=ldap://ldap1/ binddn="cn=admin,dc=example,dc=com" bindmethod=simple credentials="123" searchbase="dc=example,dc=com" starttls=no filter="(objectclass=*)" attrs="*,+" scope=sub schemachecking=of type=refreshAndPersist interval=00:00:00:10 retry="5 5 10 5" timeout=1 olcSyncRepl: rid=005 provider=ldap://ldap2/ binddn="cn=admin,dc=example,dc=com" bindmethod=simple credentials="123" searchbase="dc=example,dc=com" starttls=no filter="(objectclass=*)" attrs="*,+" scope=sub schemachecking=off type=refreshAndPersist interval=00:00:00:10 retry="5 5 10 5" timeout=1 - add: olcDbIndex olcDbIndex: entryUUID eq - add: olcDbIndex olcDbIndex: entryCSN eq - add: olcMirrorMode olcMirrorMode: TRUE dn: olcOverlay=syncprov,olcDatabase={1}hdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov Configuration replicates and the end, schema does not replicate. If you try to replicate one of the servers are in the logs I see: Dec 15 23:44:48 slap1 slapd[4496]: do_syncrepl: rid=004 rc -1 quitting Dec 15 23:44:48 slap1 slapd[4496]: slap_client_connect: URI=ldap://ldap2/ DN="cn=admin,dc=example,dc=com" ldap_sasl_bind_s failed (-1) Dec 15 23:44:48 slap1 slapd[4496]: do_syncrepl: rid=005 rc -1 retrying Dec 15 23:44:58 slap1 slapd[4496]: =>do_syncrepl rid=005 Dec 15 23:44:58 slap1 slapd[4496]: slap_client_connect: URI=ldap://ldap2/ DN="cn=admin,dc=example,dc=com" ldap_sasl_bind_s failed (-1) Dec 15 23:44:50 slap2 slapd[4456]: do_syncrepl: rid=004 rc -1 retrying Dec 15 23:44:54 slap2 slapd[4456]: =>do_syncrepl rid=005 Dec 15 23:44:54 slap2 slapd[4456]: slap_client_connect: URI=ldap://ldap2/ DN="cn=admin,dc=example,dc=com" ldap_sasl_bind_s failed (-1) Dec 15 23:44:54 slap2 slapd[4456]: do_syncrepl: rid=005 rc -1 quitting Dec 15 23:45:00 slap2 slapd[4456]: =>do_syncrepl rid=004 Dec 15 23:45:00 slap2 slapd[4456]: slap_client_connect: URI=ldap://ldap1/ DN="cn=admin,dc=example,dc=com" ldap_sasl_bind_s failed (-1) from server slap2 to search slap1: ldapsearch -x -D cn=admin,dc=example,dc=com-H ldap://slap1/ -b dc=example,dc=com -w 123 (working) from server slap1 to search slap2: ldapsearch -x -D cn=admin,dc=example,dc=com-H ldap://slap2/ -b dc=example,dc=com -w 123 (working) I'm out of ideas... user : DN="cn=admin,dc=example,dc=com" is created automatically when I install slapd Can anyone have any suggestions or experience with this problem. For all, thank you in advance. Muniek

1 1

RE24 testing call (OpenLDAP 2.4.37)
by Quanah Gibson-Mount 15 Dec '13

15 Dec '13

If you know how to build OpenLDAP manually, and would like to participate in testing the next set of code for the 2.4.37 release, please do so. Generally, get the code for RE24: <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> Configure & build. Execute the test suite (via make test) after it is built. Thanks! --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

12 32

2.4.36 : too many open files
by Aaron Bennett 14 Dec '13

14 Dec '13

Just to clarify - subject on original post was wrong - version is 2.4.36. From: Aaron Bennett Sent: Tuesday, December 3, 2013 9:58 AM To: 'openldap-technical(a)openldap.org' Subject: 2.4.26 : too many open files Hi, I just ran into this yesterday on CentOS 6 / OpenLdap 2.4.36, my own build against bdb 5.1.29 and OpenSSL. Dec 2 16:55:40 animal slapd[13735]: bdb(dc=clarku,dc=edu): /var/lib/ldap/log.0000032796: log file unreadable: Too many open files Dec 2 16:55:40 animal slapd[13735]: bdb(dc=clarku,dc=edu): PANIC: Too many open files Dec 2 16:55:40 animal slapd[13735]: bdb(dc=clarku,dc=edu): PANIC: fatal region error detected; run recovery Dec 2 16:55:40 animal slapd[13735]: bdb(dc=clarku,dc=edu): PANIC: fatal region error detected; run recovery Dec 2 16:55:40 animal slapd[13735]: null_callback : error code 0x50 I never did anything to change the default process limit, looks like it's set to 1024 in /proc/$(pidof slapd)/limits. Is there anything I can do short of an automatic restart to prevent that from cropping up again? I have an MMR via Syncrepl setup with nothing too complicated; can't think of any reason offhand that slapd would need to have more than 1024 files open. Best, Aaron --- Aaron Bennett Manager of Systems Administration Clark University ITS W:508.793.7315

4 3

Max length allowed for a password
by Rob Tanner 13 Dec '13

13 Dec '13

Hi, We are looking at extending the allowed length of passwords we allow people to use (the theory being that a short phrase is easier to remember than a shorter, but arbitrary string of characters). But since we use our ldap server for authentication to a whole host of online tools, including several portals, I need to know the max length of the source password when doing a bind. Thanks, Rob Rob Tanner UNIX Services Manager Linfield College, McMinnville Oregon ITS will never ask you for your password. Please don’t share yours with anyone!

4 7

Re: Upgrading from Ubuntu-packaged 2.4.28 to self-built 2.4.38
by Philip Colmer 12 Dec '13

12 Dec '13

> You only responded about one My second paragraph addressed the second suggestion. I did *try* to edit the LDIF file and then use slapadd but it wasn't working. In retrospect, the reason it wasn't working was because I didn't have the correct slapadd command-line options. Therefore, I think that I didn't need to sym-link and that slapcat/slapadd was the appropriate way to go. On 12 December 2013 16:54, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, December 12, 2013 4:20 PM +0000 Philip Colmer > <philip.colmer(a)linaro.org> wrote: > >>> Huh? Why didn't you just use ldapmodify to modify it? Or, slapcat your >>> cn=config db, fix it in the LDIF, and reload it? >> >> >> Couldn't use ldapmodify to modify it because slapd wasn't running. >> Couldn't use ldapmodify to modify it whilst Ubuntu version was >> installed because that would break *that* version. Couldn't use >> ldapmodify to modify it whilst new version was installed because new >> version wouldn't start. > > > I listed two options. The other works when slapd is offline. You only > responded about one. > > > --Quanah > > > -- > > Quanah Gibson-Mount > Architect - Server > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration

1 0

Re: Upgrading from Ubuntu-packaged 2.4.28 to self-built 2.4.38
by Philip Colmer 12 Dec '13

12 Dec '13

> Huh? Why didn't you just use ldapmodify to modify it? Or, slapcat your cn=config db, fix it in the LDIF, and reload it? Couldn't use ldapmodify to modify it because slapd wasn't running. Couldn't use ldapmodify to modify it whilst Ubuntu version was installed because that would break *that* version. Couldn't use ldapmodify to modify it whilst new version was installed because new version wouldn't start. I think, in retrospect, that I was hitting two problems - the wrong path in cn=config and the wrong command to try and build a new cn=config from LDIF. It is possible that the correct command (which I eventually found in another mail thread) avoids this whole issue. On 12 December 2013 16:14, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, December 12, 2013 1:40 PM +0000 Philip Colmer > <philip.colmer(a)linaro.org> wrote: > >> dn: cn=module{0} >> objectClass: olcModuleList >> cn: module{0} >> olcModulePath: /usr/lib/ldap >> olcModuleLoad: {0}back_hdb >> >> olcModulePath, if defined, is referenced INSTEAD OF any environment >> variables like PATH or LD_LIBRARY_PATH. >> >> /usr/lib/ldap is the Ubuntu path. The new location is >> /usr/local/libexec/ldap. Since I can't edit the ldif file, I put in a >> symbolic link. > > > Huh? Why didn't you just use ldapmodify to modify it? Or, slapcat your > cn=config db, fix it in the LDIF, and reload it? > > --Quanah > > -- > > Quanah Gibson-Mount > Architect - Server > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration

2 1

Upgrading from Ubuntu-packaged 2.4.28 to self-built 2.4.38
by Philip Colmer 12 Dec '13

12 Dec '13

Our current implementation of OpenLDAP is Ubuntu 12.04 running version 2.4.28 which has been installed as a package. To upgrade to 2.4.38, it looks like I need to remove that package and then install my own built binaries. Has anyone gone through this process before and got any tips/notes to share? I'm particularly thinking that there will be some path changes to contend with. For example, my main HDB database seems to be in /var/lib/ldap but the migration steps suggest that everything is in /usr/local/var/openldap-data/. Clearly I can work through this but if someone has already done it and can share lessons learnt, that would be much appreciated. Philip

4 5

Running slapcat and slapd at the same time
by Chris Card 12 Dec '13

12 Dec '13

Hi all, I am running openldap 2.4.36 with Berkeley DB 4.6.21 under centos 6.3 64 bit on a Dell 710 with 96 Gb RAM. My slapd configuration sets the BDB cachesize to use a shared memory segment of 47 Gb (id2entry.bdb is about 40 Gb currently). I use slapcat to take regular backups using the same configuration as slapd, running in parallel with slapd, and the backup works successfully, but uses a lot of memory when it is running. I would like to be able to run slapcat with a smaller memory requirement, and to this end I have experimented with running slapcat with a different configuration as follows: 1. create a work directory 2. create links in the work directory to the .bdb files 3. slapcat cn=config to an ldif file 4. edit the ldif file to change the db data directory to the work directory and change the olcDbConfig settings to use less memory 5. slapadd the ldif file to create a new slapd.d config directory in the work directory 6. run slapcat with the new slapd.d config The reason for this approach is to allow slapcat to run with a different DB_CONFIG file to slapd. This appeared to work in testing, but in the production environment produced backups with data missing, while outputting no error messages. Is there a way to run slapcat with a different memory configuration to slapd? Chris

2 1

please fix ITS#6825
by Michael Ströder 12 Dec '13

12 Dec '13

HI! I have a setup where I cannot work around ITS#6825 by putting posixGroup entries in a single container. So I hit this bug again where slapo-unique does not behave as documented: http://www.openldap.org/its/index.cgi?findid=6825 Is there a chance to get this fixed soon? Ciao, Michael.

1 0

OPENLDAP BUILD/CONFIGURE
by Borresen, John - 0442 - MITLL 11 Dec '13

11 Dec '13

Attempting to upgrade to OpenLDAP 2.4.38 Receiving the following output : Configuring OpenLDAP 2.4.38-Release ... checking build system type... x86_64-unknown-linux-gnu checking host system type... x86_64-unknown-linux-gnu checking target system type... x86_64-unknown-linux-gnu checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking for gawk... gawk checking whether make sets $(MAKE)... yes checking configure arguments... done checking for ar... ar checking for style of include used by make... GNU checking for gcc... gcc checking whether the C compiler works... no configure: error: in `/opt/rpmbuild/BUILD/openldap-2.4.38': configure: error: C compiler cannot create executables See `config.log' for more details. Using the following options with ./configure: $ ./configure --disable-dependency-tracking --enable-ldap --enable-debug --prefix=/usr/local/openldap --libdir=/usr/local/openldap/lib64 --with-tls --with-cyrus-sasl --enable-spasswd --enable-overlays --enable-modules --enable-dynamic=no --enable-slapi --enable-meta --enable-crypt In the config.log seeing the following: configure:5744: $? = 127 configure:5764: checking whether the C compiler works configure:5786: gcc -DOPENLDAP_FD_SETSIZE=4096 -O2 -g -I/usr/local/berkeleydb/include -I/usr/kerberos/include -L/usr/local/berkeleydb/lib64 conftest.c -ldb -ldb-4.6 -ldb46 -ldb-4 -ldb-4-6 -lgcc_s >&5 ./configure: line 5788: gcc: command not found configure:5790: $? = 127 configure:5828: result: no configure: failed program was: | /* confdefs.h */ | #define PACKAGE_NAME "" | #define PACKAGE_TARNAME "" | #define PACKAGE_VERSION "" | #define PACKAGE_STRING "" | #define PACKAGE_BUGREPORT "" | #define PACKAGE_URL "" | #define OPENLDAP_PACKAGE "OpenLDAP" | #define OPENLDAP_VERSION "2.4.38" | #define LDAP_VENDOR_VERSION 20438 | #define LDAP_VENDOR_VERSION_MAJOR 2 | #define LDAP_VENDOR_VERSION_MINOR 4 | #define LDAP_VENDOR_VERSION_PATCH 38 | #define HAVE_MKVERSION 1 | /* end confdefs.h. */ ... configure:5833: error: in `/opt/rpmbuild/BUILD/openldap-2.4.38': configure:5837: error: C compiler cannot create executables See `config.log' for more details. Note: gcc is installed (/usr/bin/gcc) and is version 4.4.7 John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420 Ph: (781) 981-1609 Email: john.borresen(a)ll.mit.edu<mailto:john.borresen@ll.mit.edu>

4 6

2 way SSL configuration in OpenLDAP 2.4
by vidya bharadwaj 11 Dec '13

11 Dec '13

Hi, We have to implement a 2 way SSL mechanism on a LDAP connector in our product. In order to test the implementation, we have chosen openLDAP2.4 as the data source. Currently we have done the following steps: On the OpenLDAP end: 1. Installed OpenLDAP with TLS feature 2.Created a CA using OpenSSL /etc/pki/tls/misc/CA –newca 3.Created a certificate using OpenSSL openssl req -newkey rsa:1024 -nodes -keyout newreq.pem -out newreq.pem 4.Signed the certificate using the CA created /etc/pki/tls/misc/CA –sign 5. Finally stored the cacert.pem, newreq.pem and newcert.pem under /opt/openldap/certificate folder 6. Following changes were made in sldap.conf TLSCipherSuite MEDIUM:+SSLv2:+SSLv3:RSA TLSCACertificatePath /opt/openldap/certificate/ TLSCACertificateFile /opt/openldap/certificate/cacert.pem TLSCertificateFile /opt/openldap/certificate/servercrt.pem TLSCertificateKeyFile /opt/openldap/certificate/serverkey.pem # Use the following if client authentication is required TLSVerifyClient demand 7.Similarly a new certificate for client was created using client’s details such as host name etc 8.Signed by the previously created CA On the client side: 1. Following changes were made in ldap.conf HOST spsdel192 PORT 636 TLS_CACERTDIR/etc/openldap/certs TLS_REQCERT demand TLS_CACERT /etc/openldap/certs/cacert.pem Finally when executing [root@spsdel193 ~]# ldapsearch -v -Z -D cn=root,o=ShawEnterprise -w secret -b o=accounts,o=shawEnterprise ldap_initialize( <DEFAULT> ) ldap_start_tls: Connect error (-11) additional info: TLS error -12227:SSL peer was unable to negotiate an acceptable set of security parameters. ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) [root@spsdel193 ~]# Any solution to resolve this issue would be of great help. Thanks in advance. Regards Vidya

2 1

Re: Recovering from a Single-Node downtime in a Multi-Master Setup
by Marco Nett 11 Dec '13

11 Dec '13

2013/12/10 Quanah Gibson-Mount <quanah(a)zimbra.com> > --On Tuesday, December 10, 2013 11:08 AM -0600 espeake(a)oreillyauto.comwrote: > > Do the slapcat on ldap2 and then delete the db files on ldap1 and then run >> the slapadd. you will not get duplicates because all of the CSN's will be >> the same. This is what I have done my migrations to the most recent >> versions and doing my own builds. Works great that way. >> > So by "delete the db files" you mean deleting the contents of the slapd home-dir (usually /var/lib/ldap)? Here's what I read out of your answer: (ldap2) slapcat -bcn=config -l config.ldiff (ldap2) slapcat -l actual-data.ldiff (ldap1) rm -rf /var/lib/ldap/* (ldap1) /etc/init.d/slapd start (ldap1) slapadd -bcn=config -l config.ldiff (ldap1) slapcat -l actual-data.ldiff Like this? Any traps or common problems I should be aware of? > > Huh? > > The CSNs contain the server IDs. Servers ignore their own changes. > You're saying I shouldn't delete the files before doing the cat/add business, right? If I'd do it like this, wouldn't stuff that got deleted on ldap2 (while ldap1 was down) still end up being on ldap1?

3 2

Custom attribute values created prior to an index are not getting indexed by slapindex
by Jon C Kidder 11 Dec '13

11 Dec '13

I am running 2.4.36 with mdb and have discovered an interesting behavior that may be a bug but wanted some input before I opened an ITS. I can upgrade to .38 and verify the behavior if needed. I have a third party application that defines the following custom attribute: olcAttributeTypes: ( 1.3.6.1.4.1.8241.1.15 NAME 'ctscPropertyKeywords' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) I have recently added the following index to the database for this application: olcDbIndex: ctscPropertyKeywords pres,eq When I run a search using objectclass as a filter I see 17 records that contain the value "Exportable" for ctscPropertyKeywords. When I repeat the search using (ctscPropertyKeywords=Exportable) as the filter I only get back 9 records even though the value is present in 17 records. I have included examples of my searches and the results below. I have run slapindex on this database several times since the new index was added using: /appl/openldap/sbin/slapindex -v -F /appl/openldap/etc/openldap/slapd.d -b "dc=global,dc=aep,dc=com" I have also restarted slapd several times just for grins. The behavior has not changed. I have discovered that the 9 records I see have been modified since the index was created and the missing 8 records existed before the index was created. Modifying a record causes the index to get updated and adds the record to the results of my second search but re-indexing the database using slapindex does not. Any thoughts? Here are my sample searches and their output. /appl/openldap/bin/ldapsearch -H "ldap://localhost:389" -x -D {removed} -y {removed} -s sub -b 'dc=Global,dc=aep,dc=com' '(objectClass=ctscPropertyDefinition)' objectClass ctscPropertyKeywords # extended LDIF # # LDAPv3 # base <dc=Global,dc=aep,dc=com> with scope subtree # filter: (objectClass=ctscPropertyDefinition) # requesting: objectClass ctscPropertyKeywords # # 1102, ctscApplicationDataRepository, ctsc, ApplicationData, Global.aep.com dn: cn=1102,ou=ctscApplicationDataRepository,ou=ctsc,ou=ApplicationData,dc=Glo bal,dc=aep,dc=com objectClass: top objectClass: dlm1ManagedElement objectClass: ctscPropertyDefinition objectClass: ctscManagedObjectAuxClass ctscPropertyKeywords: Exportable # 1103, ctscApplicationDataRepository, ctsc, ApplicationData, Global.aep.com dn: cn=1103,ou=ctscApplicationDataRepository,ou=ctsc,ou=ApplicationData,dc=Glo bal,dc=aep,dc=com objectClass: top objectClass: dlm1ManagedElement objectClass: ctscPropertyDefinition objectClass: ctscManagedObjectAuxClass ctscPropertyKeywords: Exportable # 1104, ctscApplicationDataRepository, ctsc, ApplicationData, Global.aep.com dn: cn=1104,ou=ctscApplicationDataRepository,ou=ctsc,ou=ApplicationData,dc=Glo bal,dc=aep,dc=com objectClass: top objectClass: dlm1ManagedElement objectClass: ctscPropertyDefinition objectClass: ctscManagedObjectAuxClass ctscPropertyKeywords: Exportable # 4305, ctscApplicationDataRepository, ctsc, ApplicationData, Global.aep.com dn: cn=4305,ou=ctscApplicationDataRepository,ou=ctsc,ou=ApplicationData,dc=Glo bal,dc=aep,dc=com objectClass: top objectClass: dlm1ManagedElement objectClass: ctscPropertyDefinition objectClass: ctscManagedObjectAuxClass ctscPropertyKeywords: Exportable ctscPropertyKeywords: HelpDeskAccessible # 16802, ctscApplicationDataRepository, ctsc, ApplicationData, Global.aep.com dn: cn=16802,ou=ctscApplicationDataRepository,ou=ctsc,ou=ApplicationData,dc=Gl obal,dc=aep,dc=com objectClass: top objectClass: dlm1ManagedElement objectClass: ctscPropertyDefinition objectClass: ctscManagedObjectAuxClass ctscPropertyKeywords: Exportable ctscPropertyKeywords: HelpDeskAccessible # 16803, ctscApplicationDataRepository, ctsc, ApplicationData, Global.aep.com dn: cn=16803,ou=ctscApplicationDataRepository,ou=ctsc,ou=ApplicationData,dc=Gl obal,dc=aep,dc=com objectClass: top objectClass: dlm1ManagedElement objectClass: ctscPropertyDefinition objectClass: ctscManagedObjectAuxClass ctscPropertyKeywords: Exportable ctscPropertyKeywords: HelpDeskAccessible # 16804, ctscApplicationDataRepository, ctsc, ApplicationData, Global.aep.com dn: cn=16804,ou=ctscApplicationDataRepository,ou=ctsc,ou=ApplicationData,dc=Gl obal,dc=aep,dc=com objectClass: top objectClass: dlm1ManagedElement objectClass: ctscPropertyDefinition objectClass: ctscManagedObjectAuxClass ctscPropertyKeywords: Exportable ctscPropertyKeywords: HelpDeskAccessible # 16805, ctscApplicationDataRepository, ctsc, ApplicationData, Global.aep.com dn: cn=16805,ou=ctscApplicationDataRepository,ou=ctsc,ou=ApplicationData,dc=Gl obal,dc=aep,dc=com objectClass: top objectClass: dlm1ManagedElement objectClass: ctscPropertyDefinition objectClass: ctscManagedObjectAuxClass ctscPropertyKeywords: Exportable ctscPropertyKeywords: HelpDeskAccessible # 16806, ctscApplicationDataRepository, ctsc, ApplicationData, Global.aep.com dn: cn=16806,ou=ctscApplicationDataRepository,ou=ctsc,ou=ApplicationData,dc=Gl obal,dc=aep,dc=com objectClass: top objectClass: dlm1ManagedElement objectClass: ctscPropertyDefinition objectClass: ctscManagedObjectAuxClass ctscPropertyKeywords: Exportable ctscPropertyKeywords: HelpDeskAccessible # 16808, ctscApplicationDataRepository, ctsc, ApplicationData, Global.aep.com dn: cn=16808,ou=ctscApplicationDataRepository,ou=ctsc,ou=ApplicationData,dc=Gl obal,dc=aep,dc=com objectClass: top objectClass: dlm1ManagedElement objectClass: ctscPropertyDefinition objectClass: ctscManagedObjectAuxClass ctscPropertyKeywords: Exportable ctscPropertyKeywords: HelpDeskAccessible # 16810, ctscApplicationDataRepository, ctsc, ApplicationData, Global.aep.com dn: cn=16810,ou=ctscApplicationDataRepository,ou=ctsc,ou=ApplicationData,dc=Gl obal,dc=aep,dc=com objectClass: top objectClass: dlm1ManagedElement objectClass: ctscPropertyDefinition objectClass: ctscManagedObjectAuxClass ctscPropertyKeywords: Exportable ctscPropertyKeywords: HelpDeskAccessible # 16813, ctscApplicationDataRepository, ctsc, ApplicationData, Global.aep.com dn: cn=16813,ou=ctscApplicationDataRepository,ou=ctsc,ou=ApplicationData,dc=Gl obal,dc=aep,dc=com objectClass: top objectClass: dlm1ManagedElement objectClass: ctscPropertyDefinition objectClass: ctscManagedObjectAuxClass ctscPropertyKeywords: Exportable ctscPropertyKeywords: HelpDeskAccessible # 16814, ctscApplicationDataRepository, ctsc, ApplicationData, Global.aep.com dn: cn=16814,ou=ctscApplicationDataRepository,ou=ctsc,ou=ApplicationData,dc=Gl obal,dc=aep,dc=com objectClass: top objectClass: dlm1ManagedElement objectClass: ctscPropertyDefinition objectClass: ctscManagedObjectAuxClass ctscPropertyKeywords: Exportable ctscPropertyKeywords: HelpDeskAccessible # 17702, ctscApplicationDataRepository, ctsc, ApplicationData, Global.aep.com dn: cn=17702,ou=ctscApplicationDataRepository,ou=ctsc,ou=ApplicationData,dc=Gl obal,dc=aep,dc=com objectClass: top objectClass: dlm1ManagedElement objectClass: ctscPropertyDefinition objectClass: ctscManagedObjectAuxClass ctscPropertyKeywords: Exportable # 17703, ctscApplicationDataRepository, ctsc, ApplicationData, Global.aep.com dn: cn=17703,ou=ctscApplicationDataRepository,ou=ctsc,ou=ApplicationData,dc=Gl obal,dc=aep,dc=com objectClass: top objectClass: dlm1ManagedElement objectClass: ctscPropertyDefinition objectClass: ctscManagedObjectAuxClass ctscPropertyKeywords: Exportable # 17803, ctscApplicationDataRepository, ctsc, ApplicationData, Global.aep.com dn: cn=17803,ou=ctscApplicationDataRepository,ou=ctsc,ou=ApplicationData,dc=Gl obal,dc=aep,dc=com objectClass: top objectClass: dlm1ManagedElement objectClass: ctscPropertyDefinition objectClass: ctscManagedObjectAuxClass ctscPropertyKeywords: Exportable # 18902, ctscApplicationDataRepository, ctsc, ApplicationData, Global.aep.com dn: cn=18902,ou=ctscApplicationDataRepository,ou=ctsc,ou=ApplicationData,dc=Gl obal,dc=aep,dc=com objectClass: top objectClass: dlm1ManagedElement objectClass: ctscPropertyDefinition objectClass: ctscManagedObjectAuxClass ctscPropertyKeywords: Exportable ctscPropertyKeywords: HelpDeskAccessible ctscPropertyKeywords: MultiValued # search result search: 2 result: 0 Success # numResponses: 18 # numEntries: 17 /appl/openldap/bin/ldapsearch -H "ldap://localhost:389" -x -D {removed} -y {removed} -s sub -b 'dc=Global,dc=aep,dc=com' '(ctscPropertyKeywords=Exportable)' objectClass ctscPropertyKeywords # extended LDIF # # LDAPv3 # base <dc=Global,dc=aep,dc=com> with scope subtree # filter: (ctscPropertyKeywords=Exportable) # requesting: objectClass ctscPropertyKeywords # # 1103, ctscApplicationDataRepository, ctsc, ApplicationData, Global.aep.com dn: cn=1103,ou=ctscApplicationDataRepository,ou=ctsc,ou=ApplicationData,dc=Glo bal,dc=aep,dc=com objectClass: top objectClass: dlm1ManagedElement objectClass: ctscPropertyDefinition objectClass: ctscManagedObjectAuxClass ctscPropertyKeywords: Exportable # 1104, ctscApplicationDataRepository, ctsc, ApplicationData, Global.aep.com dn: cn=1104,ou=ctscApplicationDataRepository,ou=ctsc,ou=ApplicationData,dc=Glo bal,dc=aep,dc=com objectClass: top objectClass: dlm1ManagedElement objectClass: ctscPropertyDefinition objectClass: ctscManagedObjectAuxClass ctscPropertyKeywords: Exportable # 4305, ctscApplicationDataRepository, ctsc, ApplicationData, Global.aep.com dn: cn=4305,ou=ctscApplicationDataRepository,ou=ctsc,ou=ApplicationData,dc=Glo bal,dc=aep,dc=com objectClass: top objectClass: dlm1ManagedElement objectClass: ctscPropertyDefinition objectClass: ctscManagedObjectAuxClass ctscPropertyKeywords: Exportable ctscPropertyKeywords: HelpDeskAccessible # 16808, ctscApplicationDataRepository, ctsc, ApplicationData, Global.aep.com dn: cn=16808,ou=ctscApplicationDataRepository,ou=ctsc,ou=ApplicationData,dc=Gl obal,dc=aep,dc=com objectClass: top objectClass: dlm1ManagedElement objectClass: ctscPropertyDefinition objectClass: ctscManagedObjectAuxClass ctscPropertyKeywords: Exportable ctscPropertyKeywords: HelpDeskAccessible # 16810, ctscApplicationDataRepository, ctsc, ApplicationData, Global.aep.com dn: cn=16810,ou=ctscApplicationDataRepository,ou=ctsc,ou=ApplicationData,dc=Gl obal,dc=aep,dc=com objectClass: top objectClass: dlm1ManagedElement objectClass: ctscPropertyDefinition objectClass: ctscManagedObjectAuxClass ctscPropertyKeywords: Exportable ctscPropertyKeywords: HelpDeskAccessible # 17702, ctscApplicationDataRepository, ctsc, ApplicationData, Global.aep.com dn: cn=17702,ou=ctscApplicationDataRepository,ou=ctsc,ou=ApplicationData,dc=Gl obal,dc=aep,dc=com objectClass: top objectClass: dlm1ManagedElement objectClass: ctscPropertyDefinition objectClass: ctscManagedObjectAuxClass ctscPropertyKeywords: Exportable # 17703, ctscApplicationDataRepository, ctsc, ApplicationData, Global.aep.com dn: cn=17703,ou=ctscApplicationDataRepository,ou=ctsc,ou=ApplicationData,dc=Gl obal,dc=aep,dc=com objectClass: top objectClass: dlm1ManagedElement objectClass: ctscPropertyDefinition objectClass: ctscManagedObjectAuxClass ctscPropertyKeywords: Exportable # 17803, ctscApplicationDataRepository, ctsc, ApplicationData, Global.aep.com dn: cn=17803,ou=ctscApplicationDataRepository,ou=ctsc,ou=ApplicationData,dc=Gl obal,dc=aep,dc=com objectClass: top objectClass: dlm1ManagedElement objectClass: ctscPropertyDefinition objectClass: ctscManagedObjectAuxClass ctscPropertyKeywords: Exportable # 18902, ctscApplicationDataRepository, ctsc, ApplicationData, Global.aep.com dn: cn=18902,ou=ctscApplicationDataRepository,ou=ctsc,ou=ApplicationData,dc=Gl obal,dc=aep,dc=com objectClass: top objectClass: dlm1ManagedElement objectClass: ctscPropertyDefinition objectClass: ctscManagedObjectAuxClass ctscPropertyKeywords: Exportable ctscPropertyKeywords: HelpDeskAccessible ctscPropertyKeywords: MultiValued # search result search: 2 result: 0 Success # numResponses: 10 # numEntries: 9 -Jon C. Kidder American Electric Power Middleware Services Email: jckidder(a)aep.com<mailto:jckidder@aep.com> Phone: 614-716-4970

1 0

Replicating cn=config in configuration tool
by Daniel J 11 Dec '13

11 Dec '13

Hi Openldap gents/ladies, For those who migrated over to cn=config and are replicating cn=config as well as other DIT using configuration tools like cfengine, puppet, chef etc... I have currently have set up to not replicate cn=config for the following reasons: - flexibility to run different cn=config if needed for testing/for a specific purpose - able to reduce the scope of changes that may be disastrous Curious to know how others have implemented and theirs reasoning behind his/hers implementation. Your comments and advise are very welcome. Thanks

1 0

LTB DOWNLOAD
by Borresen, John - 0442 - MITLL 10 Dec '13

10 Dec '13

Sorry, if this is not the forum to post this issue...but...received the following error when downloading the LTB Packages: Is this ok [y/N]: y Downloading Packages: openldap-ltb-2.4.38-1.el5.x86_64.rpm | 3.9 MB 00:01 Running rpm_check_debug Running Transaction Test Finished Transaction Test Transaction Test Succeeded Running Transaction Error in PREIN scriptlet in rpm package openldap-ltb-2.4.38-1.el5.x86_64 error: %pre(openldap-ltb-2.4.38-1.el5.x86_64) scriptlet failed, exit status 1 error: install: %pre scriptlet failed (2), skipping openldap-ltb-2.4.38-1.el5 Failed: openldap-ltb.x86_64 0:2.4.38-1.el5 Complete! John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory

2 1

Recovering from a Single-Node downtime in a Multi-Master Setup
by Marco Nett 10 Dec '13

10 Dec '13

Quick question: State 1: - I have two OpenLDAP slapd servers (ldap1 and ldap2) configured as Multi-master. - The both have the exact same data between the mirrored directories. - If I create a new directory entry on one server, it immediately gets mirrored to the second server. - I'm happy. State 2: - One LDAP-Master (ldap1) is down because of whatever. - Changes to the directory are made on the LDAP-Master which is still up (ldap2). - Changes are not mirrored to ldap1 because it's down. - I'm a little worried but still happy. State 3: - ldap1 is back up and running, but it's directory is not up to date. - The changes made to ldap2 in state 2 are not on ldap1 and aren't getting replicated automatically. - Mirroring again works fine, but ldap1 still doens't know about changes made in state 2. - I'm confused because I can't seem to find any information on how to recover from this. I couldn't just delete the directory on ldap1 and import the one from ldap2 because the importing would also be mirrored to ldap2. right? how would i go about recoverying from a downtime in a multi-master setup?

4 6

Q: empty groups (groupOfNames, member)
by Ulrich Windl 09 Dec '13

09 Dec '13

Hi! I had a problem with "empty groups": object class groupOfNames has a MUST member attribute, so you cannot create an empty group. I consider this to be a bug in the object class definition, specifically as groupOfNames is structural, and not auxillary. So in SLES empty (POSIX) groups are created with a namedObject structural class. Unfortunately because of "structural object class modification from 'namedObject' to 'groupOfNames' not allowed", the entry has to be recreated whenever the first member is added or the last member is removed to/from a group. While examining the problem,. I found out that the namedObject (rfc2307bis.schema) has ist "cn" attribute optional: ## namedObject is needed for groups without members objectclass ( 1.3.6.1.4.1.5322.13.1.1 NAME 'namedObject' SUP top STRUCTURAL MAY cn ) I'd consider this workaround as a bug also. Two questions remaining: 1) is there a technical reason against empty groups? I'd consider them as valid as empty arrays. 2) Is it an LDAP requirement to forbid structural changes in object classes, or is it an implementation restriction? In my experience the ID of an entry is (if not the entry's UUID) more the value of DN rather than the structural objectClass... Insights? Regards, Ulrich

4 6

OPENLDAP HANGS DAILY
by Borresen, John - 0442 - MITLL 06 Dec '13

06 Dec '13

All, I just restarted with the group, and the OpenLDAP software has not been upgraded - currently 2.4.23 (that will be coming...hopefully). Anyway, an issue that was brought to my attention upon starting was that slapd needs to be restarted daily. It is still running, it just stops responding (no one can log in). Nothing has, previously, been found in the logs. The other day, during my initial search through the slapd logs I found: conn=1144 op=1 SRCH attr=automountKey automountInformation <= bdb_equality_candidates: (automountKey) not indexed <= bdb_equality_candidates: (automountKey) not indexed <= bdb_equality_candidates: (automountKey) not indexed Which I added "olcDbIndex: automountKey eq" to the cn=config/olcDatabase={1}bdb.ldif. Took care of that one. But, under further investigation I am finding this, repeatedly (for slapcat, slapd, and others): Dec 5 00:00:02 server_name slapcat: unable to dlopen /usr/lib/sasl2/libanonymous.so.2: /usr/lib/sasl2/libanonymous.so.2: wrong ELF class: ELFCLASS32 Dec 5 00:00:02 server_name slapcat: unable to dlopen /usr/lib/sasl2/libplain.so.2: /usr/lib/sasl2/libplain.so.2: wrong ELF class: ELFCLASS32 Dec 5 00:00:02 server_name slapcat: unable to dlopen /usr/lib/sasl2/libsasldb.so.2: /usr/lib/sasl2/libsasldb.so.2: wrong ELF class: ELFCLASS32 Dec 5 00:00:02 server_name slapcat: unable to dlopen /usr/lib/sasl2/liblogin.so.2: /usr/lib/sasl2/liblogin.so.2: wrong ELF class: ELFCLASS32 Dec 5 02:00:02 server_name setroubleshoot: SELinux is preventing sendmail (system_mail_t) "read" to libsasl2.so.2 (usr_t). For complete SELinux messages. run sealert -l c4516acc-2dde-4dca-973e-86cd6686ee9f Dec 5 02:30:02 server_name setroubleshoot: SELinux is preventing sendmail (system_mail_t) "read" to libsasl2.so.2 (usr_t). For complete SELinux messages. run sealert -l c4516acc-2dde-4dca-973e-86cd6686ee9f Dec 5 02:31:08 server_name tar: nss-ldap: do_open: do_start_tls failed:stat=-1 Not sure why it should even been trying to use the these lib files, as one, we are not using SASL. Looking at "ldd slapd" it is seeing only 64-bit libraries. Anyone have any suggestions? John D. Borresen (Dave) Linux/Unix Systems Administrator MIT Lincoln Laboratory Surveillance Systems Group 244 Wood St Lexington, MA 02420 Ph: (781) 981-1609 Email: john.borresen(a)ll.mit.edu<mailto:john.borresen@ll.mit.edu>

5 7

Mysql to Ldap
by Burk Al 06 Dec '13

06 Dec '13

Hi, I am using mysql to store my users and mailbox information on my email server (postfix & dovecot). And I am using Postfix Admin as my front end to manage domains, users and such. I want to replace mysql with ldap server. Somehow, I need to find a way to create the same or similar structure of mysql schema on ldap server. I am not expecting a tool, magic wand to make that conversion but what is the easiest and right approach to do this? Any sample, documentation etc etc would help greatly. Thanks...

1 0

[LMDB] Problem with extending size on Windows
by Alain 05 Dec '13

05 Dec '13

I encountered a problem trying to change the mapsize of an existing store. It turned out to be that the newsize argument to mdb_env_map wasn't set correctly when coming from mdb_env_open2. So I had to change the call to be: rc = mdb_env_map(env, meta.mm_address, newenv || env->me_mapsize != meta.mm_mapsize); (adding the || != test) Also I had some issues with large files (4GB) and I made some small changes which better match documentation and reported issues, but not sure if the original code was flawed or not. It is in mdb_env_map when we set the file pointer and EOF: if (newsize) { if ((SetFilePointer(env->me_fd, sizelo, &sizehi, 0) == INVALID_SET_FILE_POINTER && GetLastError() != ERROR_SUCCESS) || !SetEndOfFile(env->me_fd) || (SetFilePointer(env->me_fd, 0, NULL, 0) == INVALID_SET_FILE_POINTER && GetLastError() != ERROR_SUCCESS)) return ErrCode(); } Again, I made those changes according to what I noticed and this might not be the perfect final solution. Cheers, Alain

2 2

RE: OPENLDAP HANGS DAILY
by Quanah Gibson-Mount 05 Dec '13

05 Dec '13

<http://ltb-project.org/wiki/download> --On December 5, 2013 at 2:36:07 PM -0500 "Borresen, John - 0442 - MITLL" <John.Borresen(a)ll.mit.edu> wrote: > This was built from source, the OS flavor is 5.9 (originally built on > 5.7). The rpm versions were/are too old. > > Is the link to the LTB packages? > http://ltb-project.org/wiki/documentation/openldap-rpm > > Thanks > Dave > > -----Original Message----- > From: Quanah Gibson-Mount [mailto:quanah@zimbra.com] > Sent: Thursday, December 05, 2013 2:19 PM > To: Borresen, John - 0442 - MITLL; Michael Ströder; > openldap-technical(a)openldap.org Subject: RE: OPENLDAP HANGS DAILY > > You can quickly upgrade if you use the LTB packages... Which are more > sanely built than the RH ones anyway, which I'm going to guess you are > using based on the version. > > --Quanah > > --On December 5, 2013 at 1:53:15 PM -0500 "Borresen, John - 0442 - MITLL" > <John.Borresen(a)ll.mit.edu> wrote: > >> Yea, I was afraid you were going to say that. >> >> -----Original Message----- >> From: Michael Ströder [mailto:michael@stroeder.com] >> Sent: Thursday, December 05, 2013 1:30 PM >> To: Borresen, John - 0442 - MITLL; openldap-technical(a)openldap.org >> Subject: Re: OPENLDAP HANGS DAILY >> >> Borresen, John - 0442 - MITLL wrote: >>> I just restarted with the group, and the OpenLDAP software has not >>> been upgraded - currently 2.4.23 (that will be coming...hopefully). >>> Anyway, an issue that was brought to my attention upon starting was >>> that slapd needs to be restarted daily. It is still running, it just >>> stops responding (no one can log in). Nothing has, previously, been >>> found in the logs. The other day, during my initial search through >>> the slapd logs I found: >> >> Please upgrade first. Everything else is waste of yours and others time. >> >> Ciao, Michael. >> >> >> > > > > -- > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: Sync working in lab but not in production
by Philip Colmer 05 Dec '13

05 Dec '13

> Big mistake, as mentioned numerous times on the list. Use a current build. OK - I'll test the upgrade process. Thanks for the pointer on that. Philip On 5 December 2013 16:45, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, December 05, 2013 1:38 PM +0000 Philip Colmer > <philip.colmer(a)linaro.org> wrote: > >> I suspect I've broken a fundamental rule of how sync works on OpenLDAP >> but here goes ... >> >> We've been running a single OpenLDAP server for a while now so I >> wanted to get some resiliency into place. We are using version 2.4.28 >> on Ubuntu 12.04. > > > Big mistake, as mentioned numerous times on the list. Use a current build. > > Your log indicates that there is no accesslog DB, so I'd start with > investigating there after you fix the first problem. > > --Quanah > > -- > > Quanah Gibson-Mount > Architect - Server > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

Sync working in lab but not in production
by Philip Colmer 05 Dec '13

05 Dec '13

I suspect I've broken a fundamental rule of how sync works on OpenLDAP but here goes ... We've been running a single OpenLDAP server for a while now so I wanted to get some resiliency into place. We are using version 2.4.28 on Ubuntu 12.04. The original machine is a VM so I cloned it and built two further servers from that clone. I then followed the instructions in https://help.ubuntu.com/12.04/serverguide/openldap-server.html to add the provider bits to server A and the consumer bits to server B. That works fine. So, since I had a working consumer, I added the provider bits to the original LDAP server and changed the configuration on server B so that it queries that server and not server A. Syncing now fails and I'm getting the following in the log: slapd[8201]: conn=1059 fd=18 ACCEPT from IP=127.0.0.1:52374 (IP=0.0.0.0:389) slapd[8201]: conn=1059 op=0 BIND dn="cn=XXX,dc=YYY,dc=ZZZ" method=128 slapd[8201]: conn=1059 op=0 BIND dn="cn=XXX,dc=YYY,dc=ZZZ" mech=SIMPLE ssf=0 slapd[8201]: conn=1059 op=0 RESULT tag=97 err=0 text= slapd[8201]: conn=1059 op=1 SRCH base="cn=accesslog" scope=2 deref=0 filter="(&(?objectClass=auditWriteObject)(?reqResult=0))" slapd[8201]: conn=1059 op=1 SRCH attr=reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN slapd[8201]: conn=1059 op=1 SEARCH RESULT tag=101 err=32 nentries=0 text= slapd[8201]: do_syncrep2: rid=000 LDAP_RES_SEARCH_RESULT (32) No such object slapd[8201]: do_syncrep2: rid=000 (32) No such object slapd[8201]: conn=1059 op=2 UNBIND I've double-checked the configuration on the provider and if I revert the configuration on server B so that it consumes from server A, it all works again. Have I broken a fundamental rule? If I have, how can I fix it? If I haven't, what have I done wrong? Thanks. Philip

3 3

Found bug in GET_BOTH_RANGE
by Alain 04 Dec '13

04 Dec '13

I found a bug where the data was not updated in a call to cursor get with GET_BOTH_RANGE Here is what I did to fix it, but not 100% sure it covers everything correctly: rc = mc->mc_dbx->md_dcmp(data, &d2); if (rc) { if (op == MDB_GET_BOTH || rc > 0) return MDB_NOTFOUND; data->mv_data = d2.mv_data; //added data->mv_size = d2.mv_size; //added rc = 0; } Please confirm. Thanks Alain

1 0

2.4.26 : too many open files
by Aaron Bennett 04 Dec '13

04 Dec '13

Hi, I just ran into this yesterday on CentOS 6 / OpenLdap 2.4.36, my own build against bdb 5.1.29 and OpenSSL. Dec 2 16:55:40 animal slapd[13735]: bdb(dc=clarku,dc=edu): /var/lib/ldap/log.0000032796: log file unreadable: Too many open files Dec 2 16:55:40 animal slapd[13735]: bdb(dc=clarku,dc=edu): PANIC: Too many open files Dec 2 16:55:40 animal slapd[13735]: bdb(dc=clarku,dc=edu): PANIC: fatal region error detected; run recovery Dec 2 16:55:40 animal slapd[13735]: bdb(dc=clarku,dc=edu): PANIC: fatal region error detected; run recovery Dec 2 16:55:40 animal slapd[13735]: null_callback : error code 0x50 I never did anything to change the default process limit, looks like it's set to 1024 in /proc/$(pidof slapd)/limits. Is there anything I can do short of an automatic restart to prevent that from cropping up again? I have an MMR via Syncrepl setup with nothing too complicated; can't think of any reason offhand that slapd would need to have more than 1024 files open. Best, Aaron --- Aaron Bennett Manager of Systems Administration Clark University ITS W:508.793.7315

5 5

LDAP issue with SASL 2.1.26
by Sergey Emantayev 04 Dec '13

04 Dec '13

Hello, We successfully use OpenLDAP C SDK 2.4.36 integrated with Cyrus-SASL 2.1.23. Recently we have upgraded Cyrus-SASL to 2.1.26 and encountering the next issue. LDAP search consistently fails. We analyzed this issue and found the following behavior. When we use OpenLDAP with Cyrus-SASL 2.1.23 the LDAP Message Search Request payload is wrapped in GSS-API payload. When we use OpenLDAP with Cyrus-SASL 2.1.26 the LDAP Message Search Request payload is not wrapped in GSS-API payload at all. LDAP Search Request looks like clear text LDAP Search Request and not like LDAP SASL Search Request. In both cases - with Cyrus-SASL 2.1.23 and with Cyrus-SASL 2.1.26 – LDAP SASL Bind succeeds and LDAP SASL bindResponse looks identical with Cyrus-SASL 2.1.23 and with Cyrus-SASL 2.1.26. On the SASL support mail list I was suggested to setup minssf parameter. We have double checked that it's set correctly (=1). Please advise how to troubleshoot the issue. Thanks & Regards, Sergey

1 0

Memory leak question
by Markus Moeller 03 Dec '13

03 Dec '13

Hi I am using openldap 2.2.4.33 with cyrus-sasl 2.1.25 to do a sasl bind and get the following valgrind leak message. Looking through the source it seems to be a variable only used inside the openldap library and not related to what I provide to ldap_sasl_interactive_bind_s. ==14039== 34 (32 direct, 2 indirect) bytes in 2 blocks are definitely lost in loss record 561 of 666 ==14039== at 0x4C2C27B: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==14039== by 0x558E764: ber_memalloc_x (memory.c:228) ==14039== by 0x558A8B7: ber_get_stringal (decode.c:582) ==14039== by 0x558AFF5: ber_scanf (decode.c:806) ==14039== by 0x535535D: ldap_parse_sasl_bind_result (sasl.c:327) ==14039== by 0x5351FE1: ldap_int_sasl_bind (cyrus.c:551) ==14039== by 0x5355810: ldap_sasl_interactive_bind (sasl.c:474) ==14039== by 0x5355A0C: ldap_sasl_interactive_bind_s (sasl.c:511) ==14039== by 0x44DDC9: tool_sasl_bind (ldap.c:2338) Is that a real memory leak or is it something I did wrong ? Thank you Markus

3 4

Ldap simple bind problems on slaves during network outage
by Christian Kratzer 03 Dec '13

03 Dec '13

Hi, we are currently chasing a strange issue at a customers site where the ldap slaves become unresponsive when network connectivity to master ldaps and dns servers is lost. They have a setup of two masters and two slaves at separate sites. There is a load balancer sitting in front of the slaves that performs regular health checks consisting of binds followed by a search of their binddn. During regular operations the load balancers health checks look as follows [1] Dec 2 14:38:05 ldap slapd[57585]: conn=3924716 fd=36 ACCEPT from IP=192.0.2.189:33852 (IP=192.0.2.129:389) Dec 2 14:38:05 ldap slapd[57585]: conn=3924716 op=0 BIND dn="cn=keepalive-check-lb,ou=system,dc=example,dc=org" method=128 Dec 2 14:38:05 ldap slapd[57585]: conn=3924716 op=0 BIND dn="cn=keepalive-check-lb,ou=system,dc=example,dc=org" mech=SIMPLE ssf=0 Dec 2 14:38:05 ldap slapd[57585]: conn=3924716 op=0 RESULT tag=97 err=0 text= Dec 2 14:38:05 ldap slapd[57585]: conn=3924716 op=1 SRCH base="ou=system,dc=example,dc=org" scope=1 deref=0 filter="(cn=keepalive-check-lb)" Dec 2 14:38:05 ldap slapd[57585]: conn=3924716 op=1 ENTRY dn="cn=keepalive-check-lb,ou=system,dc=example,dc=org" Dec 2 14:38:05 ldap slapd[57585]: conn=3924716 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Dec 2 14:38:05 ldap slapd[57585]: conn=3924716 op=2 UNBIND Dec 2 14:38:05 ldap slapd[57585]: connection_closing: readying conn=3924716 sd=36 for close Dec 2 14:38:05 ldap slapd[57585]: connection_resched: attempting closing conn=3924716 sd=36 Dec 2 14:38:05 ldap slapd[57585]: conn=3924716 fd=36 closed When they experience a network outage separating the slaves from the masters and the dns servers the load balancers are not able to bind the slaves: Dec 2 14:38:50 ldap slapd[57585]: conn=3924725 fd=44 ACCEPT from IP=192.0.2.188:35761 (IP=192.0.2.129:389) Dec 2 14:38:50 ldap slapd[57585]: connection_closing: readying conn=3924725 sd=44 for close Dec 2 14:38:50 ldap slapd[57585]: connection_close: deferring conn=3924725 sd=44 Dec 2 14:38:50 ldap slapd[57585]: conn=3924725 op=0 BIND dn="cn=keepalive-check-lb,ou=system,dc=example,dc=org" method=128 Dec 2 14:38:50 ldap slapd[57585]: conn=3924725 op=0 BIND dn="cn=keepalive-check-lb,ou=system,dc=example,dc=org" mech=SIMPLE ssf=0 Dec 2 14:38:50 ldap slapd[57585]: connection_resched: attempting closing conn=3924725 sd=44 Dec 2 14:38:50 ldap slapd[57585]: conn=3924725 fd=44 closed (connection lost) We have not been able to reproduce this problem in a lab setup which is supposed to be identical to the production setup. It does not seem to be related to the servers not being able to perform reverse mapping on the client ips. We run a mixture of 2.4.35 and 2.4.38 on CentOS 6.4. In the lab the slaves are able to perform queries just fine without connectivity to the masters or to their dns servers. The servers are currently running with following loglevel: dn: cn=config olcLogLevel: Conns olcLogLevel: Stats olcLogLevel: Stats2 olcLogLevel: Sync It seems we only get to the point where the bind credentials are parsed after which the connection is closed. This could of course be a problem with the load balancer prematurely closing the connection. I am trying to eliminate any causes in the ldap servers. Any ideas on how to debug this or where we could look. Greetings Christian [1] dns and ips obfuscated to protect the customer -- Christian Kratzer CK Software GmbH Email: ck(a)cksoft.de Wildberger Weg 24/2 Phone: +49 7032 893 997 - 0 D-71126 Gaeufelden Fax: +49 7032 893 997 - 9 HRB 245288, Amtsgericht Stuttgart Web: http://www.cksoft.de/ Geschaeftsfuehrer: Christian Kratzer

2 2

Getting internal error, index points to a 00 page!?
by Alain 02 Dec '13

02 Dec '13

Hi, I converted an application from BDB to LMDB (using Java/JNI) and now I'm getting this error when doing an mdb_cursor_get with SET. In debugging, at that point mp is empty: mp = 0x0000000015ddb000 {mp_p={p_pgno=0 p_next=0x0000000000000000 } mp_pad=0 mp_flags=0 ...} The code where this happens is called many times before without issue, so I'm at a lost to explain what is going on. I'm including the debug output from the session. If anybody can point me in the right direction, I will do whatever tests or debugging is needed. BTW, lines numbers might be a bit off as I needed to make minor changes to run under MS VS at line 329, added code for lack of support for __func__: #ifdef _MSC_VER //MS C++ doesn't support __func__ # define DPRINTF0(fmt, ...) \ fprintf(stderr, "%s:%d " fmt "\n", __FUNCTION__, __LINE__, __VA_ARGS__) #else # define DPRINTF0(fmt, ...) \ fprintf(stderr, "%s:%d " fmt "\n", __func__, __LINE__, __VA_ARGS__) #endif Thanks Alain

2 2

Unable to add umlaut character dn to the openLDAP 2.4.32
by pramod kulkarni 29 Nov '13

29 Nov '13

Hi , I am having trouble in adding user with dn having umlaut characters using ldapmodify tool,It is giving invalid syntax what I need to do ? please help dn:uid=Röichard,ou=newUsers,dc=cricbox,dc=in ldap_add: Invalid DN syntax (34) additional info: invalid DN Regards, pk

3 3

OLC configuration
by Jacques Foucry 28 Nov '13

28 Nov '13

Hello folks, I think I can use and manage a small LDAP. I can configure it but... with the old slapd.conf method. I need to configue a new one and it's time for me to understand the OLC configuration way. Did you have a good tuto (in french?) to help to help me? The official docs are to hard for me. Thanks in advance, Jacques Foucry -- Jacques Foucry *NOVΛSPARKS * IT Manager Tel : +33 (0)1 42 68 12 61 jacques.foucry(a)novasparks.com

2 1

p12 files for user-auth in slapd.conf question
by lux-integ 28 Nov '13

28 Nov '13

Greetings, I am a complete beginner leaning to use openldap. I read through a few of the manuals online. I am finding the access-control manual ( http://www.openldap.org/doc/admin24/access-control.html ) the hardest to understand. I would like to know if it is possible to authenticate users using p12 (pkcs12 certificates/key pair ) and IF SO what would be a) the standard shemas to be included in slapd.conf to make this possible ? , b) the entry for olcAccess ( in slapd.conf) for users to be authenticared via their p12 files ? , b) the location and storage method in the database for these .p12 files ? or IF NOT SO what is the recommended equivalent to p12 files and how would they be deployed.? thanks in advance sincerely luxInteg

2 1

OpenLDAP with ppolicy and SSSD configuration question.
by Viviano, Brad 28 Nov '13

28 Nov '13

Hello, I've searched the archives of this list, the web as best I can, and have this same question asked to the sssd-devel mailing list and can not seem to find an answer this my question. I have a RHEL 6.4 server with OpenLDAP 2.4.23-32.el6_4.1 and sssd 1.9.2-129.el6, both installed as standard RPM's from Redhat. I have ppolicy configured in slapd and on another RHEL6.4 system have sssd setup as a client. Everything works fine with password expires, grace periods, etc and sssd, if the user has to enter their password. But, if the user is using an SSH public key, setting the account as locked or the password is expired still allows them to log in. I can't seem to find a good solution that forces the user to change their password before they can login. The specifics are. sshd_config is configured to use PAM. My pam.d auth config is standard for RHEL6 which is: auth required pam_env.so auth sufficient pam_fprintd.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth sufficient pam_sss.so use_first_pass auth required pam_deny.so I've confirmed that when a user logs in from ssh with both password and ssh keys, they are going through the PAM sss.so just fine, by turning up the debugging levels and watching the logs. I've read everything I can find on sssd and it appears that for all cases of LDAP, sssd wants a single true/false value along the lines of nsAccountLocked. I can't find anything in ppolicy that sets true/false for account locked like other LDAP implementations do, all ppolicy seems to provide is pwdAccountLockedTime. While the issue seems more like a limitation on sssd's side, I thought I'd ask on this list to see if anyone has been able to come up with a solution or if there is something in ppolicy I am missing for a true/false on, is DN=X locked or not. Thanks, -Brad Viviano =================================================== Brad Viviano High Performance Computing & Scientific Visualization Lockheed Martin, Supporting the EPA Research Triangle Park, NC 919-541-2696 HSCSS Task Order Lead - Ravi Nair 919-541-5467 - Nair.Ravi(a)epa.gov High Performance Computing Subtask Lead - Durward Jones 919-541-5043 - Jones.Durward(a)epa.gov Environmental Modeling and Visualization Lead - Heidi Paulsen 919-541-1834 - Paulsen.Heidi(a)epa.gov

7 24

Q: monitoring attributes
by Ulrich Windl 28 Nov '13

28 Nov '13

Hi! I found out why I never was successful with cn=monitor: By default '*' attributes show almost nothing; you'll have to use '+' attributes (in my version at least). I'm not very happy with the decision, because you'll get the truely operational attributes also. If the whole subtree cn=Monitor is invisible in naming contexts, I see little reason to hide the "normal" attributes as operational in the whole subtree. Seeing those operational atributes, I noticed that "creatorsName" and "modifiersName" are both present but have an empty value. That doesn't look very nice, especially as createTimestamp and modifyTimestamp do have proper values. Using monitoredObject for all monitored values gives a unique interface, but having all possible results in monitoredInfo is not very usable, especially if there's no description. For example (some attributes removed for brevity): --- dn: cn=Uptime,cn=Time,cn=Monitor structuralObjectClass: monitoredObject monitoredInfo: 153543 hasSubordinates: FALSE --- It's not clear (denying the obvious) what the units of uptime are: seconds, minutes, etc. It seems to me that "monitoredType" or "monitoredInfoType" and "monitoredUnit" (for measurable infos) are missing. Shouldn't "monitorCounter" be named "monitoredCounter" to use the same pattern as "monitoredInfo"? I could not find the schema for the monitoring objects in any file. Can I retrieve a readable schema from openLDAP? The other thing is that I'm not too happy with are spaces in RDNs, like " cn=Connection 2111,cn=Connections,cn=Monitor", or "cn=Database 2,cn=Databases,cn=Monitor". I'd prefer are more common pattern for IDs like "Connection-2111" or "Connection_2111". Also: is "cn=Connection 0,cn=Connections,cn=Monitor" a bug? I see it twice: --- dn: cn=Connection 0,cn=Connections,cn=Monitor structuralObjectClass: monitorConnection (...) monitorConnectionNumber: 0 monitorConnectionProtocol: 0 monitorConnectionOpsReceived: 0 monitorConnectionOpsExecuting: 0 monitorConnectionOpsPending: 0 monitorConnectionOpsCompleted: 0 monitorConnectionGet: 0 monitorConnectionRead: 0 monitorConnectionWrite: 0 monitorConnectionMask: L monitorConnectionListener: monitorConnectionPeerDomain: unknown monitorConnectionPeerAddress: unknown monitorConnectionLocalAddress: monitorConnectionStartTime: 19700101000000Z monitorConnectionActivityTime: 19700101000000Z (...) --- Regards, Ulrich

4 10

Problem with self in acl in combination with rwm
by Arthur de Jong 27 Nov '13

27 Nov '13

I have a configuration somewhat similar to the one below and the ACLs seem to be applied using the non-rewritten DN which causes the self specifier to never match. We are in the process of configuring a more secure LDAP server with stricter ACLs and extra security checks without affecting existing applications. For this purpose we are putting a rewriting proxy in front of several legacy LDAP servers. Ideally, the ACLs would be put in place on the original servers but this is not easily possible in this environment. Is this a bug or am I doing something wrong? Configuration snippet (simplified and anonymised): access to attrs=userPassword by self =xw by anonymous auth by * none access to * by self read by * search database ldap suffix "ou=department1,dc=example,dc=com" rootdn "cn=admin,dc=example,dc=com" subordinate uri "ldap://192.168.1.1" overlay rwm rwm-suffixmassage "ou=department1,dc=example,dc=com" "dc=department1,dc=local" database ldap suffix "ou=department2,dc=example,dc=com" rootdn "cn=admin,dc=example,dc=com" subordinate uri "ldap://192.168.1.2" overlay rwm rwm-suffixmassage "ou=department2,dc=example,dc=com" "dc=department2,dc=local" database bdb suffix "dc=example,dc=com" rootdn "cn=admin,dc=example,dc=com" rootpw {SSHA}5OWnUtaKRBk7x0UBQKO/HOgMZQoCczY5 directory /var/openldap-data cachesize 1000 index objectClass eq index cn,mail pres,eq,sub index uid,uidNumber pres,eq Part of the slapd output with -d 896 (again, anonymised): 5295fbb1 conn=1000 fd=27 ACCEPT from IP=127.0.0.1:48903 (IP=0.0.0.0:3389) 5295fbb1 conn=1000 op=0 BIND dn="uid=ldaptest,ou=People,ou=department2,dc=example,dc=com" method=128 5295fbb1 conn=1000 op=0 BIND dn="uid=ldaptest,ou=People,dc=department2,dc=local" mech=SIMPLE ssf=0 5295fbb1 conn=1000 op=0 RESULT tag=97 err=0 text= 5295fbb1 conn=1000 op=1 SRCH base="dc=example,dc=com" scope=2 deref=0 filter="(objectClass=*)" 5295fbb1 => access_allowed: search access to "dc=example,dc=com" "entry" requested 5295fbb1 => dn: [1] 5295fbb1 => acl_get: [3] attr entry 5295fbb1 => acl_mask: access to entry "dc=example,dc=com", attr "entry" requested 5295fbb1 => acl_mask: to all values by "uid=ldaptest,ou=people,dc=department2,dc=local", (=0) 5295fbb1 <= check a_dn_pat: self 5295fbb1 <= check a_dn_pat: * 5295fbb1 <= acl_mask: [2] applying search(=scxd) (stop) 5295fbb1 <= acl_mask: [2] mask: search(=scxd) 5295fbb1 => slap_access_allowed: search access granted by search(=scxd) 5295fbb1 => access_allowed: search access granted by search(=scxd) [...] 5295fbb2 => access_allowed: read access to "uid=ldaptest,ou=People,ou=department2,dc=example,dc=com" "entry" requested 5295fbb2 => dn: [1] 5295fbb2 => acl_get: [3] attr entry 5295fbb2 => acl_mask: access to entry "uid=ldaptest,ou=People,ou=department2,dc=example,dc=com", attr "entry" requested 5295fbb2 => acl_mask: to all values by "uid=ldaptest,ou=people,dc=department2,dc=local", (=0) 5295fbb2 <= check a_dn_pat: self 5295fbb2 <= check a_dn_pat: * 5295fbb2 <= acl_mask: [2] applying search(=scxd) (stop) 5295fbb2 <= acl_mask: [2] mask: search(=scxd) 5295fbb2 => slap_access_allowed: read access denied by search(=scxd) 5295fbb2 => access_allowed: no more rules 5295fbb2 send_search_entry: conn 1000 access to entry (uid=ldaptest,ou=People,ou=department2,dc=example,dc=com) not allowed The DN that is used seems to be uid=ldaptest,ou=people, dc=department2,dc=local which is how we were bound to the second LDAP server. Thanks ps, I would also be very interested in a solution for http://www.openldap.org/lists/openldap-technical/201302/msg00152.html -- -- arthur - arthur(a)arthurdejong.org - http://arthurdejong.org/ --

1 0

syncrepl
by Tony Chilton 27 Nov '13

27 Nov '13

I have set up a slave ldap server for syncrepl and seem to be unable to get it to repicate. There is nothing logged on the slave at all. ACL logging on the master shows the slave connecting and seeming to get access - see below. On the MAIN SERVER I HAVE access to attrs=userPassword,shadowLastChange by self =xw by anonymous auth by dn="cn=sync,dc=my company,dc=com" read by * none access to * by self write by dn="cn=sync,dc=my company,dc=com" read by users read by * read # Replication stuff overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 200 ON THE SLAVE I HAVE access to * by self write by dn="cn=sync,dc=my company,dc=com" write by users read by anonymous auth loglevel sync config acl logfile /tmp/ldaptmp syncrepl rid=123 provider=ldaps://envy.my company.com type=refreshOnly interval=01:00:00:00 searchbase="dc=my company,dc=com" filter="(objectClass=*)" scope=sub attrs="*,+" schemachecking=off retry="60 10 300 3" logbase="cn=accesslog" syncdata=accesslog bindmethod=simple binddn="cn=sync,dc=my company,dc=com" credentials="password" AUTH OUTPUT FROM THE MASTER Nov 26 10:48:04 envy slapd[19774]: => acl_mask: to value by "", (=0) Nov 26 10:48:04 envy slapd[19774]: <= check a_dn_pat: self Nov 26 10:48:04 envy slapd[19774]: <= check a_dn_pat: cn=sync,dc=imagreendriver,dc=com Nov 26 10:48:04 envy slapd[19774]: <= check a_dn_pat: users Nov 26 10:48:04 envy slapd[19774]: <= check a_dn_pat: * Nov 26 10:48:04 envy slapd[19774]: <= acl_mask: [4] applying read(=rscxd) (stop) Nov 26 10:48:04 envy slapd[19774]: <= acl_mask: [4] mask: read(=rscxd) Nov 26 10:48:04 envy slapd[19774]: => slap_access_allowed: read access granted by read(=rscxd) AN LDAP SEARCH QUERY produces zip on slave ldapsearch -H ldaps:/// -x -b 'dc=my company,dc=com' '(objectclass=*)' -s sub # extended LDIF # # LDAPv3 # base <dc=my company,dc=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 32 No such object # numResponses: 1

4 3

Re: OpenLDAP 2.4.38 available
by Clément OUDOT 27 Nov '13

27 Nov '13

2013/11/18 OpenLDAP Project <project(a)openldap.org>: > OpenLDAP 2.4.38 is now available for download as detailed on our download page: > > http://www.openldap.org/software/download/ > Hi, I am happy to inform you that LDAP Tool Box packages are now available for OpenLDAP 2.4.38 (see announce: http://tools.ltb-project.org/news/44) The great news is that we now provide Debian packages! We also now have a YUM repository and a APT repository. Special mention to David Coutadeur who works hard on the Debian packages. Clément.

1 0

Re : Antw: dynlist performance
by "POISSON Frédéric" 27 Nov '13

27 Nov '13

Hello, Le 27/11/13, Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de> a écrit : > >>> "POISSON Frédéric"<frederic.poisson(a)admin.gmessaging.net> schrieb am > 27.11.2013 > um 10:46 in Nachricht <3fd84a3867972521.5295cd90(a)admin.gmessaging.net>: > > Hello, > > > > I'm testing the dynlist overlay on OpenLDAP 2.4.38 because i have a static > > group of around 10K uniqueMember. I want to have now a equivalent group with > > > dynlist. > > > > I have configured my overlay dynlist like this : > > dn: olcOverlay={2}dynlist,olcDatabase={1}bdb,cn=config > > objectClass: olcOverlayConfig > > objectClass: olcDynamicList > > olcOverlay: {2}dynlist > > olcDlAttrSet: {0}groupOfURLs memberURL uniqueMember > > > > And my group is quite like OpenLDAP example in documentation : > > > > dn: cn=GeneralisationDyn,ou=Groups,dc=example,dc=com > > objectClass: top > > objectClass: groupOfURLs > > cn: GeneralisationDyn > > memberURL: ldap:///ou=People,dc=example,dc=com??one?(objectClass=person) > > uniqueMember: uid=user1,ou=People,dc=example,dc=com > > uniqueMember: uid=user2,ou=People,dc=example,dc=com > > [...] > > > > My backend is Berkeley DB and i have tune it in order to have quite fast > > responses on searches, and locally on my server (virtualized with a single > > proc), it take that time to return the entries found by memberURL : > > > > real 0m0.272s > > user 0m0.040s > > sys 0m0.023s > > Actually, if you sum sys and user, you get 0.07s. Times 10000 gives 700s. So > the bulk transfer is quite efficient compared to the single transfer. > Also not that the direction of search is different: Once you start from > uniqueMember, and the other time you start from DN (I guess). > > Sorry i don't understand the way you explain that, it is not clear in my mind. Do the dyngroup plugin run the same ldapsearch as presented inside the memberURL ? If yes : why showing the uniqueMember from dyngroup overlay takes more time than running the equivalent ldapsearch ? If not : How the dyngroup overlay works ? Sorry if my questions are boring... > > > > > > If i run an ldapsearch to see all uniqueMember of my dynamic group it take > > around 8 to 10 seconds to have the output ! > > > > Why a so big difference of response time in a search of entries and a search > > > of uniqueMember inside a dynamic group ? > > Is there some tuning for dynlist plugin ? > > > > Notice also that when i search uniqueMember inside my static group with > > quite same number of uniqueMember) i have less than 0.1 seconds of real > time. > > > > > > Thanks, > > Regards, > > -- > > > > Frederic Poisson > > > Regards, -- Frederic Poisson

1 0

Re : Re: dynlist performance
by "POISSON Frédéric" 27 Nov '13

27 Nov '13

Hello, Thanks Clement for your response and blog for valsort usage (http://coudot.blogs.linagora.com/index.php/post/2013/01/07/Astuce-OpenLDAP-…!). Dieter i didn't mention my search filter because i take the same base/scope/filter that i configure inside memberURL, and also my idea wasn't to compare my server configuration with others and yours, but just to understand why it take more time to search uniqueMember whitout valsort overlay than searching the entries locally. Now, yes using valsort overlay decrease the time of ldapsearch display for my 10K entries : real 0m0.436s user 0m0.010s sys 0m0.009s Where is it mention inside OpenLDAP documentation/faq that performance are better with valsort and what is the threshold for using it (eg how many uniqueMember? ) ? Thanks, Le 27/11/13, Dieter Klünter <dieter(a)dkluenter.de> a écrit : > Am Wed, 27 Nov 2013 10:46:40 +0100 > schrieb "POISSON Frédéric" <frederic.poisson(a)admin.gmessaging.net>: > > > Hello, > > > > I'm testing the dynlist overlay on OpenLDAP 2.4.38 because i have a > > static group of around 10K uniqueMember. I want to have now a > > equivalent group with dynlist. > > > > I have configured my overlay dynlist like this : > > dn: olcOverlay={2}dynlist,olcDatabase={1}bdb,cn=config > > objectClass: olcOverlayConfig > > objectClass: olcDynamicList > > olcOverlay: {2}dynlist > > olcDlAttrSet: {0}groupOfURLs memberURL uniqueMember > > > > And my group is quite like OpenLDAP example in documentation : > > > > dn: cn=GeneralisationDyn,ou=Groups,dc=example,dc=com > > objectClass: top > > objectClass: groupOfURLs > > cn: GeneralisationDyn > > memberURL: > > ldap:///ou=People,dc=example,dc=com??one?(objectClass=person) > > uniqueMember: uid=user1,ou=People,dc=example,dc=com uniqueMember: > > uid=user2,ou=People,dc=example,dc=com [...] > > > > My backend is Berkeley DB and i have tune it in order to have quite > > fast responses on searches, and locally on my server (virtualized > > with a single proc), it take that time to return the entries found by > > memberURL : > > > > real 0m0.272s > > user 0m0.040s > > sys 0m0.023s > > > > If i run an ldapsearch to see all uniqueMember of my dynamic group it > > take around 8 to 10 seconds to have the output ! > > > > Why a so big difference of response time in a search of entries and a > > search of uniqueMember inside a dynamic group ? Is there some tuning > > for dynlist plugin ? > > > > Notice also that when i search uniqueMember inside my static group > > with quite same number of uniqueMember) i have less than 0.1 seconds > > of real time. > > You didn't mention the search string and filter, but here my results of > 5,000 entries > > time ldapsearch -Y DIGEST-MD5 -U replicator -wxxxx -l0 -z0 -H > ldap://localhost -b cn=dynamicGroup,o=avci,c=de -s base "*" > [5000 lines] > > # search result > search: 3 > result: 0 Success > > # numResponses: 2 > # numEntries: 1 > > real 0m0.606s > user 0m0.014s > sys 0m0.027s > > -Dieter > > -- > Dieter Klünter | Systemberatung > http://dkluenter.de > GPG Key ID:DA147B05 > 53°37'09,95"N > 10°08'02,42"E > > > -- Frederic Poisson

2 1

dynlist performance
by "POISSON Frédéric" 27 Nov '13

27 Nov '13

Hello, I'm testing the dynlist overlay on OpenLDAP 2.4.38 because i have a static group of around 10K uniqueMember. I want to have now a equivalent group with dynlist. I have configured my overlay dynlist like this : dn: olcOverlay={2}dynlist,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcDynamicList olcOverlay: {2}dynlist olcDlAttrSet: {0}groupOfURLs memberURL uniqueMember And my group is quite like OpenLDAP example in documentation : dn: cn=GeneralisationDyn,ou=Groups,dc=example,dc=com objectClass: top objectClass: groupOfURLs cn: GeneralisationDyn memberURL: ldap:///ou=People,dc=example,dc=com??one?(objectClass=person) uniqueMember: uid=user1,ou=People,dc=example,dc=com uniqueMember: uid=user2,ou=People,dc=example,dc=com [...] My backend is Berkeley DB and i have tune it in order to have quite fast responses on searches, and locally on my server (virtualized with a single proc), it take that time to return the entries found by memberURL : real 0m0.272s user 0m0.040s sys 0m0.023s If i run an ldapsearch to see all uniqueMember of my dynamic group it take around 8 to 10 seconds to have the output ! Why a so big difference of response time in a search of entries and a search of uniqueMember inside a dynamic group ? Is there some tuning for dynlist plugin ? Notice also that when i search uniqueMember inside my static group with quite same number of uniqueMember) i have less than 0.1 seconds of real time. Thanks, Regards, -- Frederic Poisson

4 3

ldap_search_ext_s timeout
by Mahadev, Vasavi (CW) 27 Nov '13

27 Nov '13

Hi All, The LDAP directory services in our product uses ldap_search_ext_s for synchronous search. Now,my intension is to specify a timeout in this API,so that in case if the server does not respond within the timelimit,the operation should be terminated. I tried specifying time out for the asyncronous search usign the API ldap_search_ext and it did not work.Adding timeout to ldap_result did timed out the operation! So, I was wondering how I can make the synchronous search to timeout . Requesting your help on this. Regards, Vasavi

1 0

Different approaches to setup ldap client
by slacker lnx 26 Nov '13

26 Nov '13

Hello, I have a few ldap clients which were set up by my previous sys-admin. 1. In some of the servers I see that the configuration is done in /etc/pam_ldap.conf, /etc/nslcd.conf and there is a nslcd process running on the clients. 2. On other servers I find that there is only an /etc/ldap.conf and there are no nslcd process running. The configuration values in both the approaches are the same. Are there two different ways to setup an ldap client. I would like to understand both these approaches. In the second approach is there some other process which does the ldap lookup? Can someone share links to docs related to both the installation steps. Thanks

3 2

Recommended ACL for nagios monitoring
by ML mail 26 Nov '13

26 Nov '13

Hello, I would like to monitor connectivity to my OpenLDAP using nagios with its check_ldap script and was wondering which minimal ACL would you recommend for that purpose? For that purpose I will be using a dedicated user such as cn=nagios,ou=users,dc=domain,dc=tld and would like it just to be able to bind to dc=domain,dc=tld and nothing else. Any recommendations? Thanks ML

6 7

Openldap for proxy AD
by wrm＠cdtn.br 26 Nov '13

26 Nov '13

Hi, I´m with some troubles to do authentication in AD trough of Openldap. Somebody managed to authenticate with AD password in Openldap Server? I´m trying everything but don´t auth. I see all users but the password don´t pass. My slapd.conf like this : # include /etc/openldap/schema/corba.schema include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/duaconf.schema include /etc/openldap/schema/dyngroup.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/misc.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/ppolicy.schema include /etc/openldap/schema/collective.schema #allow bind_v2 loglevel 256 #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Load dynamic backend modules: modulepath /usr/lib/openldap #moduleload back_bdb moduleload accesslog.la moduleload auditlog.la moduleload ppolicy.la moduleload rwm.la moduleload back_ldap TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt TLSCertificateFile /etc/pki/tls/certs/slapd.pem TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem ####################################################################### database ldap suffix "dc=foobar" rootdn "cn=admin,dc=foobar" ################################### rootpw {SSHA}wXmTs2ANS4XwqqnzEVIqmc+i6VCUiD7I database ldap suffix dc=foobar,dc=com #subordinate rebind-as-user uri ldaps://srv-2003.foobar.com idassert-bind bindmethod=simple binddn="cn=vmail,cn=users,dc=foobar,dc=com" credentials=abc@123 mode=none flags=non-prescriptive idassert-authzFrom "dn.regex:.*" #idassert-authzFrom "dn.exact:cn=admin,dc=foobar" # chase-referrals yes require authc ############################# ###########password-hash {CLEARTEXT} TLSCipherSuite HiGH:MEDIUM:+TLSv1:+SSLv2:+SSLv3 TLSVerifyClient allow sasl-host localhost sasl-secprops none ######################################################################### database config # all others attributes are readable to everybody access to * by * read lastmod off overlay rwm rwm-suffixmassage dc=foobar,dc=com #rwm-normalize-mapped-attrs rwm-map attribute uid sAMAccountName rwm-map attribute cn name #rwm-map attribute mail userPrincipalName rwm-map objectclass account What is wrong? Please help me. Thanks.

7 14

ACL and Password Policy
by Aleksander Dzierżanowski 26 Nov '13

26 Nov '13

Hi. I have OpenLDAP 2.4.36 server grabbed from LTB project. I’ve noticed two issues, can anyone confirm the same behavior? First - ACLs: to dn.base="" by users read to dn.subtree="ou=disabledaccounts,o=examples" by dn.base="cn=replicationmanager,o=example" read by * none to attrs=userPassword,shadowLastChange by dn.base="cn=replicationmanager,o=example" read by dn.base=„cn=radiussuperuser,o=example" read by anonymous auth by self write by * none [skipping few next less important rules] Above ACL should NOT show user’s own password, right? But it shows in my environment.. Second: PwdMinLength in password policy does not work. I can easily set shorter password. Password policy in general works, for example it does not allow me to change password earlier than ‚pwdMinAge’. Best regards, — Olo

5 7

Wtrlt: Re: Antw: Re: Q: "opjectClass: top" or not?
by Ulrich Windl 26 Nov '13

26 Nov '13

(forgot the copy to the list) I wrote: >>>>> Michael Ströder<michael(a)stroeder.com> schrieb am 22.11.2013 um 20:24 in >> Nachricht <528FAF5A.3050603(a)stroeder.com>: >>> Christian Kratzer wrote: >>>> very interesting point. >>>> >>>> I have a customer with an enterprise application that insists on having an >>>> explicit objectClass: top on all entries. >>>> >>>> Their developers argue that the rfcs mandate an explicit objectClass: top >> on >>>> all entries. I argue that the wording in the respective rfcs is not exact >>>> enough. Having an objectClass that inherits from top should be enough from >> >>> my >>>> point of view. >>>> >>>> I am currently travelling and cannot lookup the rfc. >>> >>> I vaguely remember having researched this as well many years ago. Don't >>> remember the details but I came up with the following recommendations: >>> >>> For client developers: Don't require object class 'top'. >>> >>> For LDAP admins: Add object class 'top' to all entries. >>> >>> Ciao, Michael. >> >> I wonder: If you query an object, you get a set of attributes. Whether you >> added "top" or not, the attributes are the same (except the "objectClass: >> top"). And ussually the attributes are not associated with a specific >> objectlass in the search result. >> >> If you try to "structure" the search results, then with "top", you'll find > the >> objectClass attribute at the "top" abstract class, while without "top" > you'll >> find it in the structural object class. >> >> I haven't found a document that describes "multiple inheritance" as it > happens >> with "top" (every objectclass inherits from top, but still the attributes > occur >> only once in the type hierarchy). >> >> Regards, >> Ulrich

1 0

Password Issues between provider and consumer
by Choure, Sidd 25 Nov '13

25 Nov '13

Everything is setup on RHEL 6.4 with Openldap 2.4. I have one provider and one consumer. StartTLS has been enabled and everything is working as intended. My only problem arises here - When a user is setup with a password and he tries to change his password on a consumer pointing client, I get a passwd: Authentication token manipulation error. This message is misleading since the password is in fact changed on the provider ( I have the olcUpdateRef directive setup). This creates a situation where the user can login to consumer pointed boxes with his old password and provider pointed boxes with his new password. If the user tries to change his password for the second time on consumer pointed boxes, I get Password change failed. Server message: unwilling to verify old password passwd: Authentication token manipulation error which understandably is because the password in the actual LDAP db is different from what is being supplied and being accepted by the client. What is going on here? Why isn’t the password not getting updated properly in the consumer? Here are some of the relevant snippets of configs - For Syncrepl in olcDatabase={2}bdb.ldif on consumer ###For Replication olcSyncrepl: rid=100 provider="ldap://server.com type=refreshAndPersist retry="60 30 300 +" searchbase=“dc=ex,dc=example,dc=com" bindmethod=simple binddn="cn=Manager,dc=ex,dc=example,dc=com" credentials=secret starttls=yes tls_cacert=/etc/pki/CA/cacert.pem tls_cert=/etc/pki/tls/certs/cert.pem tls_key=/etc/pki/tls/certs/key.pem olcUpdateRef: ldap://server.com ACL on provider - lcAccess: to attrs=userPassword by self write by dn.base="cn=Manager,dc=ex,dc=example,dc=com" write by anonymous auth by * none olcAccess: to * by self write by dn.base="cn=Manager,dc=ex,dc=example,dc=com" write by users read olcAccess: to attrs=entry by dn.base="cn=Manager,dc=ex,dc=example,dc=com" write by * read Let me know if any more configs are needed and I will post them. Any help is appreciated. Siddharth Choure Senior Systems Engineer

3 7

DNS SRV with openldap
by Jignesh Patel 25 Nov '13

25 Nov '13

To setup DNS SRV record in LDAP, do we need to use some kind of DNS server i.e. bind or powerdns? Or by default LDAP supports it? Jignesh Patel Chief Architect iCare.com LLC 14001 NW 4th Street Sunrise, FL 33325 O: 954-616-5604 F: 954-616-5609 jignesh(a)icare.com CONFIDENTIALITY NOTE: The information contained in this transmission is privileged and confidential information intended only for the use of the individual or entity named above. If you are not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, please immediately reply to the sender that you have received this communication in error and then delete it. Thank you.

4 4

Re: password hashes and simple binds
by Dieter Klünter 24 Nov '13

24 Nov '13

Am Sat, 23 Nov 2013 20:22:56 +0100 schrieb Aleksander Dzierżanowski <olo(a)e-lista.pl>: > Wiadomość napisana przez Dieter Klünter <dieter(a)dkluenter.de> w dniu > 23 lis 2013, o godz. 19:57: > > > Am Sat, 23 Nov 2013 13:24:56 +0100 > > schrieb Michael Ströder <michael(a)stroeder.com>: > > > >> Dieter Klünter wrote: > >>> Hi, > >>> I have a ldap server (2.4.36) with various password hashes > >>> {CLEARTEXT} {KERBEROS} {SSHA} for different users, there is no > >>> pasword-hash declaration in slapd.conf. Now i face a strange > >>> behaviour with {CLEARTEXT} hash. that is: > >>> userPassword: {CLEARTEXT} secret > >> ^^^ > >> I'd try to remove this extra space. Not sure though. > > > > Just to demonstrate the various hash scheme {CLEARTEXT} results: > > http://pastebin.de/37485 > > > > Well, AFAIK if there is no {METHOD} in userPassword attribute than > method is cleartext, so everything works as expected I suppose... — > Olo It is not that simple. RFC-2307 describes hashing schemes, but not {CLEARTEXT), man slapd.conf(5) mentions {CLEARTEXT} as password-hash. http://tools.ietf.org/id/draft-stroeder-hashed-userpassword-values-01.html only refers to hashed userpassword values. DIGEST-MD5 is a SASL mechanism which requires a cleartext password, thus a hashing scheme of {CLEARTEXT} is valid for a SASL mechanism. A simple bind requires a userpassword attribute value in cleartext, but doesn't require a hashing scheme. It would be quite helpful if OpenLDAP would accept a hash scheme for a simple bind. -Dieter -- Dieter Klünter | Systemberatung http://dkluenter.de GPG Key ID:DA147B05 53°37'09,95"N 10°08'02,42"E

2 1

password hashes and simple binds
by Dieter Klünter 23 Nov '13

23 Nov '13

Hi, I have a ldap server (2.4.36) with various password hashes {CLEARTEXT} {KERBEROS} {SSHA} for different users, there is no pasword-hash declaration in slapd.conf. Now i face a strange behaviour with {CLEARTEXT} hash. that is: userPassword: {CLEARTEXT} secret A sasl bind with DIGEST-MD5 is succesful, but a simple bind returns error 49. If I remove the {CLEARTEXT} hint and only the secret remains, userPassword: secret all binds (sasl and simple) are successful. Any hints why this is happen? -Dieter -- Dieter Klünter | Systemberatung http://dkluenter.de GPG Key ID:DA147B05 53°37'09,95"N 10°08'02,42"E

3 4

proxy user
by Jignesh Patel 23 Nov '13

23 Nov '13

How to create a proxy user in LDAP and assign it to main user? Jignesh Patel Chief Architect iCare.com LLC 14001 NW 4th Street Sunrise, FL 33325 O: 954-616-5604 F: 954-616-5609 jignesh(a)icare.com CONFIDENTIALITY NOTE: The information contained in this transmission is privileged and confidential information intended only for the use of the individual or entity named above. If you are not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, please immediately reply to the sender that you have received this communication in error and then delete it. Thank you.

2 1

creating proxy LDAP
by Jignesh Patel 23 Nov '13

23 Nov '13

We have a requirement to expose our LDAP to public domain. In that case I need to setup internal LDAP and a proxy LDAP, that is the way I see it. Any inputs on the design highly appreciated. We are using openldap with MDB. Jignesh Patel Chief Architect iCare.com LLC 14001 NW 4th Street Sunrise, FL 33325 O: 954-616-5604 F: 954-616-5609 jignesh(a)icare.com CONFIDENTIALITY NOTE: The information contained in this transmission is privileged and confidential information intended only for the use of the individual or entity named above. If you are not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, please immediately reply to the sender that you have received this communication in error and then delete it. Thank you.

2 1

hide namingcontexts
by openldap＠downhomelinux.com 22 Nov '13

22 Nov '13

I am trying to lock down an openldap server (2.4.23). Using the FAQ I have limited the user entries with: {1)to attrs=userPassword by self =xw by anonymous auth {2)to * by users read However, I cannot figure out how to match the namingContexts attribute with olcaccess to also prevent unauthenticated users from listing the directories served. I have tried many variations of the following based on search results: to attrs=namingContexts by * none to dn.exact="" attrs=namingContexts by * none to dn.base="" attrs=namingContexts val/distinguishedNameMatch="dc=mydomain,dc=com" by * none Can anyone help? Thanks

3 3

Q: "opjectClass: top" or not?
by Ulrich Windl 22 Nov '13

22 Nov '13

Hi! Sorry, this is a somewhat generic question: I wonder what difference it makes whether I specify "objectClass: top" for an object, or not: Conceptually, "top" is included automatically (so the objectClass attribute goes to any structural class), but when I fetch an object, I never see the "top" objectClass. Explicitly specifying "objectClass: top" makes every object a few bytes larger. So is there any reason to explicitly specify "objectClass: top"? Regards, Ulrich

3 2

fwd field
by arun.sasi1＠wipro.com 22 Nov '13

22 Nov '13

Hello Team, I have a mail server which is authenticating with OPenLDAP; when I set mail forwarding option I get the below error code LDAP Error Code - 17 - Undefined attribute type so I would like to know how to enable fwd filed and related field like out of office in OpenLDAP. which schema I should use in my openldap to enable it. I have below schema already enabled. include /ldap/etc/openldap/schema/corba.schema include /ldap/etc/openldap/schema/core.schema include /ldap/etc/openldap/schema/cosine.schema include /ldap/etc/openldap/schema/duaconf.schema include /ldap/etc/openldap/schema/dyngroup.schema include /ldap/etc/openldap/schema/inetorgperson.schema include /ldap/etc/openldap/schema/java.schema include /ldap/etc/openldap/schema/misc.schema include /ldap/etc/openldap/schema/nis.schema include /ldap/etc/openldap/schema/openldap.schema include /ldap/etc/openldap/schema/ppolicy.schema include /ldap/etc/openldap/schema/collective.schema include /ldap/etc/openldap/schema/samba.schema Thanks -Arun Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

3 5

Modify indexes on a delta-syncrepl consumer
by ML mail 21 Nov '13

21 Nov '13

Hello, I am using two OpenLDAP 2.4.31 servers with delta-syncrepl as replication method. So far everything works perfectly but I was wondering how I can modify cn=config settings on the consumer. For instance I would like to add new indexes (olcDbIndex) on the consumer to my replicated HDB database but this fails as you can see here: ldap_modify: Server is unwilling to perform (53) additional info: shadow context; no update referral I understand that it does not want me to modify any settings on my consumer but I was thinking this should be possible no? If not this means if I want to change a setting on the consumer I need to delete my whole database on the consumer configure it and add replication again. Any one has an idea what am I doing wrong here? Cheers, M.L.

3 6

openldap database replication and multiple hosts TLScertificates question
by lux-integ 21 Nov '13

21 Nov '13

Greetings, I am learning to configure/use openldap. I have a question regarding database replication I have a primary openldap server. I prepared/installed openssl certificates for the server -and he slapd.conf has these lines #--- Define SSL and TLS properties TLSCertificateFile /etc/certs/ldap1stServerCert.pem TLSCertificateKeyFile /etc/certs/ldap1stServerKey.pem TLSCACertificateFile /etc/certs/cacert.pem #---if client authentication is/isNOT required TLSVerifyClient demand I want to replicate the database over two other hosts. Call these 2ndServer and 3rdserver. Both of these computers ALSO have ssl certificates in /etc/certs like so:- #### in 2nd ldap host /etc/certs/ldap2ndServerCert.pem /etc/certs/ldap2ndServerKey.pem /etc/certs/cacert.pem #### in 3rd ldap host /etc/certs/ldap3rdServerCert.pem /etc/certs/ldap3rdServerKey.pem /etc/certs/cacert.pem As regards these certificates (the fact that they are not the same ) I would like to know what happens when I try to do replication.. I am following the guides 18.3.1.1. Syncrepl configuration ( http://www.openldap.org/doc/admin24/replication.html ) and 18.3.2. Delta-syncrepl ( also from http://www.openldap.org/doc/admin24/replication.html ) ( In otherwords is is best to remove the certificates and install after replication or whatever. ) Thanks in advance sincerely LuxInteg

2 1

SSL authentication to Active Directory via OpenLDAP client
by Ashwin Kumar 21 Nov '13

21 Nov '13

I have set up Active Directory to serve requests over SSL (ldaps://). Also, I have generated the certificate files on Windows 2008 server. (I have copied the self-signed certificate to test.cer) I have downloaded test.cer file to my linux machine to use it with Openldap client. The .cer file is present in /etc/openldap/certs directory and the content of ldap.conf file is TLS_CACERTDIR /etc/openldap/certs However, when I issue an ldapsearch on the Active Directory I end up with the following error: ldapsearch -x -H ldaps://192.168.1.84:636 -D CN=Administrator,CN=Users,DC=test,DC=ldap,DC=com -b CN=Administrator,CN=Users,DC=test,DC=ldap,DC=com -w Admin123 ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) My question: 1) Is this how I use my *.cer file? 2) How do I convert it to a proper file recognized by openldap clients? 3) What am I missing? (Very new to ldap and Active Directory) 4) Any useful resource or documentation to get ldaps working? Thanks. -- Ashwin kumar (http://ashwinkumar.me)

1 0

Error while updating olcDbConfig
by Daniel Jung 20 Nov '13

20 Nov '13

Hi wonderful ppl at openldap- Running 2.4.37 - on centos 6.4 using following ldif to update olcDbConfig dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcDbConfig olcDbConfig: set_lg_max 10485760 olcDbConfig: set_lg_regionmax 262144 olcDbConfig: set_lg_bsize 2097152 olcDbConfig: set_lg_dir /var/lib/ldap/ olcDbConfig: set_lk_max_locks 8192 olcDbConfig: set_lk_max_objects 8192 olcDbConfig: set_flags DB_LOG_AUTOREMOVE olcDbConfig: set_tas_spins 1 - ldapmodifyx -d 1 -h localhost -D 'cn=Manager,cn=config' -W -f /var/tmp/ldif Getting the following error res_errno: 80, res_error: <failed to reopen database, rc=22>, res_matched: <> ldap_free_request (origid 2, msgid 2) ldap_parse_result ber_scanf fmt ({iAA) ber: ber_scanf fmt (}) ber: ldap_msgfree ldap_err2string ldap_modify: Other (e.g., implementation specific) error (80) additional info: failed to reopen database, rc=22 Going through the list lead me to believe that changes will be applied after the restart? but didnt say it causes an error. Also does olcDbNoSync play a role here ? Can someone shed some light on this?

3 5

Re: Openldap for proxy AD
by Clément OUDOT 20 Nov '13

20 Nov '13

2013/11/20 Willy Ramos <wrm(a)cdtn.br>: > Em 20/11/2013 10:26, Clément OUDOT escreveu: > >> 2013/11/20 <wrm(a)cdtn.br>: >>> >>> Thank you. >>> >>> Yes, the credentials are stored in AD. >>> >>> I saw this documentation, >>> http://ltb-project.org/wiki/documentation/general/sasl_delegation >>> >>> Helped me very much, but I think there are some wrong in my >>> saslauth.conf, >>> because when I put the AD server and ldap_filter = (sAMAccountName=%u is >>> Ok Success SASL, " but when I put my localhost like this: >>> >>> ldap_servers: ldaps://127.0.0.1 #or ldap://localhost >>> #ldap_servers: ldaps://1.1.2.1 >>> ldap_version: 3 >>> ldap_auth_method: bind >>> ldap_search_base: cn=users,dc=foobar,dc=br >>> #ldap_filter: (sAMAccountname=%u) >>> #ldap_filter: (userPrincipalName=%u) >>> ldap_filter: uid=%u >>> ldap_bind_dn: cn=vmail,cn=users,dc=foobar,dc=br #or >>> cn=admin,dc=foobar >>> ldap_password: abc@123 >>> ldap_deref: never >>> ldap_restart: yes >>> ldap_scope: sub >>> ldap_use_sasl: no >>> ldap_start_tls: no >>> ldap_timeout: 10 >>> >>> >>> testsaslauthd -u usertst -p password >>> >>> NO "authentication failed" >>> >>> See the log: >>> >>> Nov 20 09:13:23 mail slapd[12776]: conn=1139 fd=18 ACCEPT from >>> IP=127.0.0.1:50194 (IP=0.0.0.0:636) >>> Nov 20 09:13:23 mail slapd[12776]: conn=1139 fd=18 TLS established >>> tls_ssf=256 ssf=256 >>> Nov 20 09:13:23 mail slapd[12776]: conn=1139 op=0 BIND >>> dn="cn=vmail,cn=users,dc=foobar,dc=br" method=128 >>> Nov 20 09:13:23 mail slapd[12776]: conn=1139 op=0 BIND >>> dn="cn=vmail,cn=users,dc=foobar,dc=br" mech=SIMPLE ssf=0 >>> Nov 20 09:13:23 mail slapd[12776]: conn=1139 op=0 RESULT tag=97 err=0 >>> text= >>> Nov 20 09:13:23 mail slapd[12776]: conn=1139 op=1 SRCH >>> base="cn=users,dc=foobar,dc=br" scope=2 deref=0 filter="(uid=usertst)" >>> Nov 20 09:13:23 mail slapd[12776]: conn=1139 op=1 SRCH attr=dn >>> Nov 20 09:13:23 mail slapd[12776]: conn=1139 op=1 SEARCH RESULT tag=101 >>> err=0 nentries=0 text= >>> >>> What can I do to fix this? >>> >> The log says that the entry is not found (nentries=0) either because >> it does not exist, either because you can't read it (ACL). >> >> But what are you using localhost behind your SASL pass trough? Seems >> like you are doing a loop on your LDAP server. >> >> >> Clément. >> > > That is a problem, because don´t found the base but when I´m using > ldapsearch my search is acepted, very strange. > > how this example: > ldapsearch -x -H ldaps://localhost -b dc=foobar,dc=com -D > cn=usertst,cn=users,dc=foobar,dc=com -w password > > I see all objects in database, when I do this command. > > If you had another idea please tell me, I just was seeing that link in the > ltb-project.org. where tell me to use in localhost SASL. > Seems you don't really understand how it works. OpenLDAP talks to saslauthd on localhost, then saslauthd talks to AD. So don't configure localhost in saslauthd, just set your AD settings in saslauthd.conf. Clément.

3 2

Slapd sometimes stucks: slapd shutdown: waiting for N operations/tasks to finish
by Покотиленко Костик 20 Nov '13

20 Nov '13

Hi, In our 1 Master - several slaves environment master slapd sometimes stucks in such condition that it takes minutes to get replay to simple queries with no visible resource consumption on both: the slapd process itself and the linux it is running on. Restarting slapd helps for several days. Today I have not been able to restart it without kill -9 because of: slapd shutdown: waiting for 12 operations/tasks to finish Waited 5 minutes with no luck, kill -9, start. slapd: 2.4.28 OS: Ubuntu 12.04.2 LTS I'm Ok with "try latest version", but it would be nice to have some pointers (maybe bug in this version or error in configuration). The server is running for 6+ month with no problems. The stucks first appeared 2 weeks ago after changing ACLs to use group.exact instead of set which came deadly slow.

2 2

openldap syncrepl issue
by Chris Card 19 Nov '13

19 Nov '13

Hi All, I am running openldap 2.4.36 with BDB for my main backend db, and multi-master replication setup using delta-syncrepl with MDB for the cn=accesslog db. I monitor the contextCSN to check that replication is in sync, but I've noticed what looks like a bug: If I try to delete a non-existent DN from the main db on machine A, I see the delete attempt in the cn=accesslog db on machine A with status 32, but the contextCSN of the main db is not changed, as expected. On machine B the contextCSN of the main db is updated, as if the delete had succeeded, and then machine A appears to be behind machine B according to the contextCSN values. Is this a known bug? Chris

3 7

RE24 testing call (OpenLDAP 2.4.37)
by Sergio NNX 16 Nov '13

16 Nov '13

Ciao all. I'd like to contribute to this testing call. I'm afraid I haven't been as lucky as the rest of you, guys! I'm building OpenLDAP 2.4.37 from source under MinGW. When I type in: make check, all tests pass except the ones (quite a few, by the way) containing the following line: $SLAPADD -f $ADDCONF -l $LDIFORDERED (for instance here: test001-slapadd) ... 52812558 bdb_db_open: database "dc=example,dc=com": dbenv_open(testrun/db.1.a). Program received signal SIGSEGV, Segmentation fault. 0x008061de in pthread_mutex_unlock () (gdb) bt #0 0x008061de in pthread_mutex_unlock () #1 0x0055d2d1 in ldap_pvt_gettime () #2 0x0055d464 in ldap_pvt_csnstr () #3 0x004753b3 in slap_get_csn () #4 0x0041f2e5 in slap_add_opattrs () #5 0x00480fff in bdb_db_open () #6 0x00423647 in backend_startup_one () #7 0x00423785 in backend_startup () #8 0x0043f028 in slap_startup () #9 0x00477ed5 in slap_tool_init () #10 0x00476a3a in slapadd () #11 0x0080dcf3 in main () However, if I use: ldapadd ...... using exactly the same LDIF, it works fine. I've done some Google search but found nothing. Since I have no knowledge about how to fix this, I'd like to know whether there's a patch available somewhere or how I can overcome this issue. Thanks in advance. Sergio.

3 4

Replication fails after network outage
by Darouichi, Aziz 15 Nov '13

15 Nov '13

Hi, We are running 2 replicas one local and the other is remote. When there is a network interruption replication fails and I have to delete the entire database in the remote replica, and let it re-synch again. Is there a way to make the remote continue its replication after the network connection is established without having to delete the database or restart the services? Thank you,

6 10

Can a DN entry have multiple structural object class
by Harishkumar Pathangay 14 Nov '13

14 Nov '13

Hi, Can a DN entry have multiple structural object class? For example, an entry with inetOrgPerson Object class with custom object class, both being STRUCTURAL. Thanks,Harish Pathangay

2 1

trouble when switching from bdb to mdb database
by Aleksander Dzierżanowski 14 Nov '13

14 Nov '13

Hi. I have properly runnig setup of three multimaster OpenLDAP servers (version 2.4.36 from ltb project) with bdb database backend. Everything was working flawless so I decided to try out ‚new shiny' mdb database with the same configuration - the only thing I changed was removing ‚cache’ settings and adding ‚maxsize’. What I’m doing and observing: - clear all config and database on all masters. Generate new configuration from slapd.conf using ‚slaptest’ tool. - on master1 I add three base organizations let’s say o=test1 + o=test2 + o=test3 using slapadd [without -w switch] - on master1 I add some entries using ldapadd command so all organizations have now contextCSN attribute. - starting master1 - everything OK - starting master2 - everything OK, including succesfull replication from master1 - starting master3 - everything OK and including replication, but… some or all other master are dying unexpectedly. strace of dying process show: --- write(2, "slapd: id2entry.c:509: mdb_opinfo_get: Assertion `!rc' failed.\n", 63) = 63 — debug log last lines: — => mdb_entry_get: ndn: „o=test1” => mdb_entry_get: oc: "(null)", at: „contextCSN" — But when I do ‚slapcat’ I can clearly see contextCSN for all o=test[123] databases... Is it bug or some possible replication configuration issue? — Olo

4 5

olcAccess: Regex questions for "departments" and there admins
by Denny Fuchs 14 Nov '13

14 Nov '13

hi, I plan the new ACL layout for our Wheezy LDAP server. Our layout: Main suffix: dc=example,dc=com than the first department: ou=department1,dc=example,dc=com ou=people,ou=department1,dc=example,dc=com uid=foobar,ou=people,ou=department1,dc=example,dc=com [...] ou=groups,ou=department1,dc=example,dc=com gid=students,ou=groups,ou=department1,dc=example,dc=com [...] ou=roles,ou=department1,dc=example,dc=com cn=mail,ou=roles,ou=department1,dc=example,dc=com cn=admins,ou=roles,ou=department1,dc=example,dc=com ou=services,ou=department1,dc=example,dc=com ou=mail,ou=services,ou=department1,dc=example,dc=com cn=aliases,ou=mail,ou=services,ou=department1,dc=example,dc=com [...] next department2, the same: ou=department2,dc=example,dc=com ou=people,ou=department2,dc=example,dc=com uid=foobar,ou=people,ou=department2,dc=example,dc=com [...] [...] .... complete the same one, as department1 Now I stuck on the ACLs. I want to make use of RegEx, so that every department has its own roles, groups and admins and access only to there (for example) services. What I already have: {0}to attrs=userPassword,shadowLastChange,sambaLMPassword,sambaNTpassword by self =xw by anonymous auth by * none {1}to dn.regex="uid=(.+),ou=people,ou=(.+),dc=example,dc=com$" attrs="myFB,myStudiengang,gender,myMatrikel,myTudUserUniqueID" by self read by * none {2}to dn.regex="uid=(.+),ou=people,ou=(.+),dc=example,dc=com$" attrs="mail,myMailalias,myMailDomain,myNoMail" by self read by dn.regex="cn=mail,ou=roles,ou=$2,dc=example,dc=com$" read by * none {3}to dn.regex="^(.+,)?ou=mail,ou=services,ou=(.+)?,dc=example,dc=com$" by dn.regex="cn=mail,ou=roles,ou=$2,dc=example,dc=com$" read {4}to dn.regex="^(.+,)?ou=services,ou=(.+,)?dc=example,dc=com$" by * none {5}to * by dn.base="cn=Admin,dc=example,dc=com" write by * read {6}to dn.base="dc=example,dc=com" by self write by dn.base="cn=Admin,dc=example,dc=com" write by * read I'm able to read the subtree: "ou=mail,ou=services,ou=department1,dc=example,dc=com" only with the authenticated user "cn=mail,ou=roles,ou=department1,dc=example,dc=com" and "ou=mail,ou=services,ou=department2,dc=example,dc=com" with authenticated user "cn=mail,ou=roles,ou=department2,dc=example,dc=com" and I can't search with user from ou=department2 the service tree from ou=department1 :-) But, why I can't see the "ou=services,ou=department2,dc=example,dc=com" ? Just for me to know, where I have a problem ... for the services (Postfix in most cases) it isn't important, that they can't see the "ou=services" Also I want to make sure, that every department "admin group" (cn=admins,ou=roles,ou=<department>,dc=example,dc=com -> groupOfUniqueNames) can do everything under there (and only) three ou=<department>,ou=example,ou=com so, any tipps are welcome :-) cu denny pages I have already open: http://www.openldap.org/doc/admin24/access-control.html http://wiki.mandriva.com/fr/uploads/3/3a/Mandriva-dit-access-template.conf http://www.openldap.org/devel/admin/slapdconf2.html

2 3

Re: [Engine-devel] OpenLdap and Kerberos for oVirt on f19
by Piotr Kliczewski 14 Nov '13

14 Nov '13

On Thu, Nov 14, 2013 at 11:05 AM, Juan Hernandez <jhernand(a)redhat.com> wrote: > On 11/14/2013 11:01 AM, Piotr Kliczewski wrote: >> Hello everyone, >> >> I working on configuring OpenLdap 2.4.36 with kerberos for oVirt running on f19. >> >> I follow following instruction: >> https://bugzilla.redhat.com/show_bug.cgi?id=967327#c5 >> >> Please note that the instruction was written for f18. In order to have >> step 18 working from >> command line I had to set SASL_NOCANON to off. The reason was that I got: >> >> ldap_sasl_interactive_bind_s: Invalid credentials (49) >> additional info: SASL(-13): authentication failure: GSSAPI Failure: >> gss_accept_sec_context >> >> When SASL_NOCANON is off I can search the ldap but have the same issue >> from java code: >> >> I got javax.naming.AuthenticationException: [LDAP: error code 49 - >> SASL(-13): authentication failure: GSSAPI Failure: >> gss_accept_sec_context]. >> Have this when connecting using engine-manage-domains >> (http://gerrit.ovirt.org/gitweb?p=ovirt-engine.git;a=blob;f=backend/manager/… >> line 84). >> >> Can you please point me where is my config issue? >> >> I copied engine-devel for reference. >> > > Do you have the cyrus-sasl-gssapi package installed? That should have > been part of step 1. Try this: > > # yum -y install cyrus-sasl-gssapi > > I think that once that is installed you shouldn't need to set > SASL_NOCANON off. > You are right the package was not installed I restarted slapd, krb5kdc and kadmin after installing. I kinit one more time and tried to ldapsearch as in step 18 but with the same result. > -- > Dirección Comercial: C/Jose Bardasano Baos, 9, Edif. Gorbea 3, planta > 3ºD, 28016 Madrid, Spain > Inscrita en el Reg. Mercantil de Madrid – C.I.F. B82657941 - Red Hat S.L.

1 1

OpenLdap and Kerberos for oVirt on f19
by Piotr Kliczewski 14 Nov '13

14 Nov '13

Hello everyone, I working on configuring OpenLdap 2.4.36 with kerberos for oVirt running on f19. I follow following instruction: https://bugzilla.redhat.com/show_bug.cgi?id=967327#c5 Please note that the instruction was written for f18. In order to have step 18 working from command line I had to set SASL_NOCANON to off. The reason was that I got: ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: SASL(-13): authentication failure: GSSAPI Failure: gss_accept_sec_context When SASL_NOCANON is off I can search the ldap but have the same issue from java code: I got javax.naming.AuthenticationException: [LDAP: error code 49 - SASL(-13): authentication failure: GSSAPI Failure: gss_accept_sec_context]. Have this when connecting using engine-manage-domains (http://gerrit.ovirt.org/gitweb?p=ovirt-engine.git;a=blob;f=backend/manager/… line 84). Can you please point me where is my config issue? I copied engine-devel for reference. Thanks, Piotr

1 0

"dn: cn=admin,cn=config" adding problem
by Oleg 13 Nov '13

13 Nov '13

Hello. Our slapd listens on outer interfaces and i want to create an access rule for rootdn to allow admin access only from 127.0.0.1 ip. So, i try to add "dn: cn=admin,cn=config" record to config database: ~# cat admin.ldif dn: cn=admin,cn=config objectClass: person cn: admin sn: admin userPassword: 1 ~# ldapadd -xWD 'cn=admin,cn=config' -f admin.ldif Enter LDAP Password: adding new entry "cn=admin,cn=config" ldap_add: Object class violation (65) I got no extra info, just this. According to core.schema mandatory fields are only cn and sn. So, i don't understand why i see this error. Can anybody help me? Thanks.

7 18

TLS_REQCERT and no server certificate
by Jan Synacek 13 Nov '13

13 Nov '13

Hello, quoting ldap.conf(5): TLS_REQCERT <level> ... try The server certificate is requested. If no certificate is provided, the session proceeds normally. If a bad certificate is provided, the session is immediately terminated. ... I'd like to try the "If no certificate is provided" part, but can't manage to do so. I tried configuring the server to 1) not use any CA certificate or server certificate, 2) only use the CA certificate without any server certificate, 3) specify CA certificate dir with no certs in it, 4) specify CA certificate dir with a valid CA cert and no server certs. In any case, the client (ldapsearch) doesn't even connect to the server, stating either "SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure" or simply failing to connect with "Can't contact LDAP server (-1)". The server is listening on ldap and ldaps. I tested this using both ldaps and StartTLS. That leads me to a conclusion that what I'm trying to achieve is not achievable and that the manpage should be changed. Is the manpage wrong or is there any other way I can test the client with no server certificate provided? Cheers, -- Jan Synacek Software Engineer, Red Hat

4 9

RE24 testing call (OpenLDAP 2.4.38)
by Quanah Gibson-Mount 12 Nov '13

12 Nov '13

If you know how to build OpenLDAP manually, and would like to participate in testing the next set of code for the 2.4.38 release, please do so. Generally, get the code for RE24: <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> Configure & build. Execute the test suite (via make test) after it is built. Thanks! --Quanah -- Quanah Gibson-Mount Architect - Server Zimbra, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

4 3

Last days to get a place at LDAPCon 2013!
by Clément OUDOT 12 Nov '13

12 Nov '13

Hi, the final program of LDAPCon has been published: http://ldapcon.org/#program The conference is now in one week, and you can still book your place: http://ldapcon2013.eventbrite.fr Hope to see you next week in Paris! Clément.

1 0

Q: syntax 1.3.6.1.4.1.1466.115.121.1.51
by Ulrich Windl 12 Nov '13

12 Nov '13

Hi! I see that core.schema defines: --- attributetype ( 2.5.4.22 NAME 'teletexTerminalIdentifier' DESC 'RFC2256: Teletex Terminal Identifier' SYNTAX 1.3.6.1.4.1.1466.115.121.1.51 ) --- However I cannot locate the syntax for the OID. It's mentioned in secion 6.5 of RFC 2256, however. How is an LDAP client expected to resolve this? I see the following syntaxes defines in the LDAP schema: DB<17> print sort map { $_->{name} . "\n" } $s->all_syntaxes 1.2.36.79672281.1.5.0 1.3.6.1.1.1.0.0 1.3.6.1.1.1.0.1 1.3.6.1.1.16.1 1.3.6.1.4.1.1466.115.121.1.10 1.3.6.1.4.1.1466.115.121.1.11 1.3.6.1.4.1.1466.115.121.1.12 1.3.6.1.4.1.1466.115.121.1.14 1.3.6.1.4.1.1466.115.121.1.15 1.3.6.1.4.1.1466.115.121.1.22 1.3.6.1.4.1.1466.115.121.1.24 1.3.6.1.4.1.1466.115.121.1.26 1.3.6.1.4.1.1466.115.121.1.27 1.3.6.1.4.1.1466.115.121.1.28 1.3.6.1.4.1.1466.115.121.1.34 1.3.6.1.4.1.1466.115.121.1.36 1.3.6.1.4.1.1466.115.121.1.38 1.3.6.1.4.1.1466.115.121.1.39 1.3.6.1.4.1.1466.115.121.1.4 1.3.6.1.4.1.1466.115.121.1.40 1.3.6.1.4.1.1466.115.121.1.41 1.3.6.1.4.1.1466.115.121.1.44 1.3.6.1.4.1.1466.115.121.1.45 1.3.6.1.4.1.1466.115.121.1.49 1.3.6.1.4.1.1466.115.121.1.5 1.3.6.1.4.1.1466.115.121.1.50 1.3.6.1.4.1.1466.115.121.1.52 1.3.6.1.4.1.1466.115.121.1.6 1.3.6.1.4.1.1466.115.121.1.7 1.3.6.1.4.1.1466.115.121.1.8 1.3.6.1.4.1.1466.115.121.1.9 1.3.6.1.4.1.4203.666.11.10.2.1 Regards, Ulrich

2 3

OpenLDAP on CF disk
by richard lucassen 11 Nov '13

11 Nov '13

Hello list, I want to migrate some OpenLDAP servers from 3.5" disks to CF-disks. The data in the OpenLDAP is only updated once a month or so. It is just an "99%-read-only" LDAP implementation. However, with a standard Debian install, some files in the /var/lib/ldap directory are updated upon each query: # ls -altr -rw-r--r-- 1 openldap openldap 96 2008-11-19 11:45 DB_CONFIG drwxr-xr-x 28 root root 4096 2008-12-03 15:03 .. -rw------- 1 openldap openldap 8192 2013-04-08 10:50 cn.bdb -rw------- 1 openldap openldap 24576 2013-09-29 13:49 objectClass.bdb -rw------- 1 openldap openldap 180224 2013-09-29 13:49 id2entry.bdb -rw------- 1 openldap openldap 8192 2013-09-29 13:49 entryUUID.bdb -rw------- 1 openldap openldap 8192 2013-09-29 13:49 entryCSN.bdb -rw------- 1 openldap openldap 36864 2013-09-29 13:49 dn2id.bdb -rw------- 1 openldap openldap 1168654 2013-10-17 09:40 log.0000000001 -rw------- 1 openldap openldap 24576 2013-11-07 05:45 __db.005 -rw------- 1 openldap openldap 98304 2013-11-07 05:45 __db.003 -rw-r--r-- 1 openldap openldap 4096 2013-11-07 05:45 alock drwx------ 2 openldap openldap 4096 2013-11-07 05:45 accesslog drwx------ 3 openldap openldap 4096 2013-11-07 05:45 . -rw------- 1 openldap openldap 565248 2013-11-07 11:30 __db.004 -rw------- 1 openldap openldap 2629632 2013-11-07 11:30 __db.002 -rw------- 1 openldap openldap 8192 2013-11-07 11:30 __db.001 Apparently the cluster is doing some synchronizing at 05:45 in the morning, but that's once a day. My concern is the files called __db.001 __db.002 __db.004 Is there a simple way to prevent OpenLDAP from updating these files at each query? R. -- ___________________________________________________________________ It is better to remain silent and be thought a fool, than to speak aloud and remove all doubt. +------------------------------------------------------------------+ | Richard Lucassen, Utrecht | +------------------------------------------------------------------+

6 13

New objectClass
by Merve Temizer 11 Nov '13

11 Nov '13

How can i add mailacceptinggeneralid and maildrop attirbutes to use postfix with openldap ? I tried to adding a schema like (into /etc/ldap/schema) # # postfix.schema - basic attributes based on default queries # postfix will make for alias and virtual account lookups # I don't think there is an official postfix schema out there, # but if there is, this most certainly is not it. # # leah(a)frauerpower.com # # mailacceptinguser and mailAccount added by Barrie Bremner < bjb(a)netcraft.com> # attributetype ( 1.3.6.1.4.1.25260.1.000 NAME 'mailacceptinggeneralid' DESC 'Defines an address that we accept mail for' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) attributetype ( 1.3.6.1.4.1.25260.1.001 NAME 'maildrop' DESC 'Defines the address mail goes to' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) attributetype ( 1.3.6.1.4.1.25260.1.002 NAME 'mailacceptinguser' DESC 'Defines if this user accepts mail' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) objectClass ( 1.3.6.1.4.1.25260.1.1.100 NAME 'virtualaccount' DESC 'Holds mail info for a virtual account' STRUCTURAL MUST ( owner $ mailacceptinggeneralid $ maildrop $ cn ) ) objectClass ( 1.3.6.1.4.1.25260.1.1.101 NAME 'maillist' DESC 'Virtual account for holding mailing list info' STRUCTURAL MUST ( mailacceptinggeneralid $ maildrop $ cn ) ) objectClass ( 1.3.6.1.4.1.25260.1.1.102 NAME 'mailAccount' DESC 'Email account details' AUXILIARY MUST ( mailacceptinguser $ maildrop $ cn ) MAY ( mailacceptinggeneralid ) ) and add a line into /usr/share/slapd/slapd.conf " include /etc/ldap/schema/inetorgperson.schema" But i am geting ldap_add: Invalid syntax (21) additional info: objectClass: value #3 invalid per syntax when i try to add an object objectClass:mailAccount Where am i wrong? Thanks

2 1

ldapmodify replace olcAccess
by Daniel Jung 11 Nov '13

11 Nov '13

Hi all, Is it possible to use the replace the instead of delete then add again for olcAccess? dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcDbCacheSize olcDbCacheSize: 10240 - replace: olcAccess olcAccess: {0}to dn.base="" attrs=namingContexts by * none olcAccess: {1}to * by * read - Thanks

3 2

Re: ldap syncrepl issue.
by Ashok Kumar Shah 11 Nov '13

11 Nov '13

I don't see any fix done for syncrepl on 2.4.36. Speaking about the actual problem i have noticed that the do_syncrep* is not getting triggered as defined in the config: interval=00:00:05:00 retry="60 +" and get triggered after long delay about ~23hrs or so. Not sure if this a bug. Thanks, Ashok On Sun, Nov 10, 2013 at 6:14 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > I suggest you read the openldap changelog and upgrade to 2.4.36. > > --Quanah > > On Nov 9, 2013, at 12:34 AM, Ashok Kumar Shah <ashok.shah(a)flipkart.com> > wrote: > > I have upgraded to OpenLDAP 2.4.31. I was hoping that the syncrepl issue > will subside with the upgrade, but problem continue to persist even now. > Just to point out that the master still runs the older version i.e 2.4.31, > but i guess that should be ok since the issue is with the replication or > perhaps with contextCSN not getting updated on the client(slaves). > > Thanks, > Ashok > > > On Mon, Jul 15, 2013 at 3:47 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > >> --On Sunday, July 14, 2013 10:35 PM +0530 Ashok Kumar Shah < >> ashok.shah(a)flipkart.com> wrote: >> >> >>> I am running OpenLDAP 2.4.23. >>> >> >> I would advise you to run a modern release. I would strongly advise you >> to read the changes log since 2.4.23. >> >> >> --Quanah >> >> >> -- >> >> Quanah Gibson-Mount >> Sr. Member of Technical Staff >> Zimbra, Inc >> A Division of VMware, Inc. >> -------------------- >> Zimbra :: the leader in open source messaging and collaboration >> > >

3 2

How to say not to use a particular objectClass for a dn
by Harishkumar Pathangay 10 Nov '13

10 Nov '13

Hi,How to say not to use a particular objectClass for a dn. For example,harish@openSUSE:~> ldapsearch -x -b 'dc=my-domain,dc=com' '(objectclass=*)' # extended LDIF## LDAPv3# base <dc=my-domain,dc=com> with scope subtree# filter: (objectclass=*)# requesting: ALL# # my-domain.comdn: dc=my-domain,dc=comobjectClass: dcObjectobjectClass: organizationdc: my-domaino: Example Corporation # Manager, my-domain.comdn: cn=Manager,dc=my-domain,dc=comobjectClass: organizationalRolecn: Managerdescription: Directory Manager # search resultsearch: 2result: 0 Success Here, we see that dn: dc=my-domain,dc=com uses objectClass: organizationI want to say not to use objectClass: organization. How to do this? Thanks,Harish Pathangay

3 4

Restricting Login based on AD GID
by Manish Nene 10 Nov '13

10 Nov '13

Hello, I've LDAP authentication functioning well against Novell e-directory. Is there a way I can restrict the login access to appliance based on the GID of an user? Thanks, - Manish. ------------------------ Powered by BigRock.com

2 2

Re: ldap syncrepl issue.
by Ashok Kumar Shah 09 Nov '13

09 Nov '13

I have upgraded to OpenLDAP 2.4.31. I was hoping that the syncrepl issue will subside with the upgrade, but problem continue to persist even now. Just to point out that the master still runs the older version i.e 2.4.31, but i guess that should be ok since the issue is with the replication or perhaps with contextCSN not getting updated on the client(slaves). Thanks, Ashok On Mon, Jul 15, 2013 at 3:47 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Sunday, July 14, 2013 10:35 PM +0530 Ashok Kumar Shah < > ashok.shah(a)flipkart.com> wrote: > > >> I am running OpenLDAP 2.4.23. >> > > I would advise you to run a modern release. I would strongly advise you > to read the changes log since 2.4.23. > > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

Re: Reseting content/database/schema
by Ryan Tandy 08 Nov '13

08 Nov '13

Hi, Please, let's keep the discussion on the list. On 13-11-08 12:26 AM, Merve Temizer wrote: > Tandy thanks for your answer. > > Might the problem be about default conf despite that i was able to add > my ldif at first installation? Sure, it's definitely possible that I was wrong. It doesn't really matter, though: stop the daemon and remove everything from /etc/ldap/slapd.d and from /var/lib/ldap, and you're immediately in a clean and unconfigured state. Purging and reinstalling the package doesn't do much else. If you want more detailed help, please provide more details about the problem: a full transcript of the commands you're running (including any input files) and their output, plus the exact version of OpenLDAP you're running, would be a good start. -- Ryan Tandy - Programmer/Analyst rtandy(a)sd63.bc.ca School District 63 (Saanich) +1 250 652 7385

1 0

PBKDF2 for OpenLDAP
by Tsukasa HAMANO 08 Nov '13

08 Nov '13

Hi, I was concerned that OpenLDAP have no modern key derivation function. (It seems eglibc's crypt(3) has bcrypt, but it's depends environment) So I just implemented PBKDF2 module for OpenLDAP. https://github.com/hamano/openldap-pbkdf2 # Installation $ cd <OPENLDAP_BUILD_DIR>/contrib/slapd-modules/passwd/ $ git clone https://github.com/hamano/openldap-pbkdf2.git $ cd openldap-pbkdf2/ $ make # make install in slapd.conf: moduleload pw-pbkdf2.so password-hash {PBKDF2} # Usage $ slappasswd -o module-load=pw-pbkdf2.la -h {PBKDF2} -s secret {PBKDF2}60000$Y6ZHtTTbeUgpIbIW0QDmDA$j/aU7jFKUSbH4UobNQDm9OEIwuw This format is compatible with Python's passlib.hash.ldap_pbkdf2_sha1 http://pythonhosted.org/passlib/lib/passlib.hash.ldap_pbkdf2_digest.html And also, I have roadmap to implement {PBKDF2-SHA256} and {PBKDF2-SHA512} schemes in the future. Could you merge the module into contrib/ directory? Thank you. -- Open Source Solution Technology Corporation HAMANO Tsukasa <hamano(a)osstech.co.jp> fingerprint = 2285 2111 6D34 3816 3C2E A5B9 16BE D101 6069 BE55

2 2

different hdbs for ou
by Denny Fuchs 08 Nov '13

08 Nov '13

hi, I have one main HDB Database for: dc=example,dc=net -> /var/lib/ldap/ with one subtree: ou=department,dc=example,dc=net Now I want to let other departments use our N-Way LDAP server too. My idea was to put the new departments into different hdb databases: ou=department-1,dc=example,dc=net -> /var/lib/ldap/department-1/ ou=department-2,dc=example,dc=net -> /var/lib/ldap/department-2/ ou=department-n,dc=example,dc=net -> /var/lib/ldap/department-n/ all with own admin access to there root dn. How should I do that? cu denny

2 6

Reseting content/database/schema
by Merve Temizer 07 Nov '13

07 Nov '13

I need to remove every configuration/schema/database. Is it possible and if so how? So far Code: sudo apt-get purge slapd ldap-utils remove Code: /etc/ldap /etc/openldap /var/lib/ldap and Code: sudo apt-get install slapd ldap-utils tried to Code: sudo ldapadd -Y EXTERNAL -H ldapi:/// -f backend2.example.com.ldif still getting 80 error, which means, according to my restricted knowledge, ldap already has modules and cn s in ldif file.

2 1

OpenLDAP DB question
by Dheeraj Khanna 07 Nov '13

07 Nov '13

Hi I wanted to find if I can add a host based authentication, here is my setup. Regular LDAP DB , I use group and users and associate permissions to users based on groups. What I want to achieve is this: *If a User A is a member of "Group A" and has access to "hostsA" allow else deny, this will allow me to limit access to certain server types based on user groups. I think we can define this in /etc/ldap.conf but I could not find find the right syntax to add hosts in this config file.* *Question: *I do not know how to add this ou called "hostaccess", I used a GUI portal called Apache Directory Studio to add/delete users and groups. If some one knows how to add hosts in LDAP and be able t map groups and users to it that would greatly help me. Thanks Dheera

3 3

slapd-mdb network performance
by Jancewicz, Russell 07 Nov '13

07 Nov '13

Hello, I am experiencing a bit of an issue with mdb network traffic. When I request large queries (entire subtrees) from remote hosts my searches take hundreds of times longer to complete than they do if I search on the local machine (in all expect for one case). I have attempted to tune the kernel network settings, adjusted tx buffer sizes all to no avail. Just before turning to this list i gave one last shot in the dark attempt running my query using the rootDN. This produced the expected results. When queried with a typical account DN my system was transmitting around 2.0Mbps to the remote client. When queried with the rootDN my system was transmitting around 100Mbps to the client. The system has an olcLimits rule allowing unlimited time and size to the account "typical account" I was testing with. ' olcLimits: dn.children="ou=accounts,dc=example,dc=com" time=unlimited size=unlimited ' Clearly the server is capable of serving data to the remote machine at 100Mbps (given that the rootDN has done so) I cannot for the life of me find a configuration option or setting would should be impacting the transmission bandwidth of searches. Any help or advice of where I should be looking would be greatly appreciated. I have included the relevant cn=config information below. Thank you, -Russell J. Jancewicz University of Connecticut OpenLDAP: slapd 2.4.36 (Sep 19 2013 11:16:48) $ dn: olcDatabase={1}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: mdb olcDbDirectory: /srv/ldap/example.com olcSuffix: dc=example,dc=com # ... olcAccess olcLimits: {0}dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" time=unlimited size=unlimited olcLimits: {1}dn.children="ou=accounts,dc=example,dc=com" time=unlimited size=unlimited olcRootDN: cn=root,dc=example,dc=com olcDbCheckpoint: 512 30 olcDbNoSync: FALSE olcDbMaxSize: 8589934592

3 4

unsubscribe
by Richards, Toby 06 Nov '13

06 Nov '13

Respectfully Submitted, R. Toby Richards Network Administrator Superior Court of California In and for the County of San Luis Obispo (805) 781-4150

1 0

slapd appears to incorrectly report an object class violation when renaming an entry
by Jon C Kidder 06 Nov '13

06 Nov '13

I am running 2.4.36 in my sandbox environment and have recently found myself needing to rename some entries in my directory. Slapd is reporting an object class violation when attempting to rename the entries even though all required attributes are present on the entry. I have a sample ldif that reproduces this problem. dn: cn=testuser,ou=users,dc=example,dc=com changetype: add objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson cn: testuser uid: testuser sn: surname dn: cn=testuser,ou=users,dc=example,dc=com changetype: modrdn newrdn: uid=testuser deleteoldrdn: 1 newsuperior: ou=users,dc=example,dc=com When I run this ldif using ldapmodify this is the result I get back. adding new entry "cn=testuser,ou=users,dc=example,dc=com" modifying rdn of entry "cn=testuser,ou=users,dc=example,dc=com" ldap_rename: Object class violation (65) additional info: object class 'inetOrgPerson' requires attribute 'cn' As you can see from the ldif the cn attribute is clearly present. I am assuming this is a bug and needs reported but wanted to review it with the list members before I submitted the ITS entry. -Jon C. Kidder American Electric Power Middleware Services Email: jckidder(a)aep.com<mailto:jckidder@aep.com> Phone: 614-716-4970

4 3

Openldap Synch problem
by Darouichi, Aziz 06 Nov '13

06 Nov '13

Hi, I have 2 Openldaps that are configured for replication one is on site, the other is a remote. They are connected via a VPN tunnel and every time there is a connection problem between the two the replication fails, but I have to stop the services on the remote, delete the database and start a fresh replication. Is there a way that I can configure the remote to force it to re-synch without having to delete the database and start all over again? This is what I see in the log after connection gets re-established: Nov 6 11:37:39 LDAP-TLS-2 slapd[4903]: slap_graduate_commit_csn: removing 0x1cffefb0 20131106163739.780633Z#000000#000#000000 Nov 6 11:37:50 LDAP-TLS-2 slapd[4903]: do_syncrep2: rid=006 LDAP_RES_SEARCH_RESULT Nov 6 11:37:50 LDAP-TLS-2 slapd[4903]: do_syncrepl: rid=006 rc -2 retrying Nov 6 11:38:28 LDAP-TLS-2 slapd[4903]: slap_queue_csn: queing 0x41d1be70 20131106163828.873440Z#000000#000#000000 Nov 6 11:38:28 LDAP-TLS-2 slapd[4903]: slap_graduate_commit_csn: removing 0x1d10d1f0 20131106163828.873440Z#000000#000#000000 Nov 6 11:38:39 LDAP-TLS-2 slapd[4903]: slap_queue_csn: queing 0x41d1c0e0 20131106163839.682221Z#000000#000#000000 Nov 6 11:38:39 LDAP-TLS-2 slapd[4903]: slap_graduate_commit_csn: removing 0x1d3f3fc0 20131106163839.682221Z#000000#000#000000 Nov 6 11:38:49 LDAP-TLS-2 slapd[4903]: slap_queue_csn: queing 0x4251ce70 20131106163849.281885Z#000000#000#000000 Nov 6 11:38:49 LDAP-TLS-2 slapd[4903]: slap_graduate_commit_csn: removing 0x1d369af0 20131106163849.281885Z#000000#000#000000 Nov 6 11:38:50 LDAP-TLS-2 slapd[4903]: do_syncrep2: rid=006 LDAP_RES_SEARCH_RESULT Nov 6 11:38:50 LDAP-TLS-2 slapd[4903]: do_syncrepl: rid=006 rc -2 retrying. This is the config of the remote for synrepl syncrepl rid=006 provider=ldap://192.168.19.43 tls_cert=/etc/pki/tls/certs/ldap-tls.curry.edu.cert.pem tls_key=/etc/pki/tls/private/ldap-tls.curry.edu.key.pem tls_cacert=/etc/pki/tls/certs/cacert.pem tls_reqcert=demand searchbase="dc=curry,dc=edu" schemachecking=on timelimit=unlimited sizelimit=unlimited type=refreshAndPersist retry="60 +" keepalive=240:10:30 Thank You

1 0

Q: syntax attribute in schema
by Ulrich Windl 06 Nov '13

06 Nov '13

Hi! This is probably a stupid question, but I wonder: In the schema definitions, neither "gn" nor "sn" have a "syntax" attribute. So I wonder: If an attribute has a "sup", is the syntax inherited from the "sup" ("name" in this special case)? In Perilish: DB<27> x $s->attribute('sn') 0 HASH(0xd89e88) 'aliases' => ARRAY(0xd87a40) 0 'surname' 'desc' => 'RFC2256: last (family) name(s) for which the entity is known by' 'name' => 'sn' 'oid' => '2.5.4.4' 'sup' => ARRAY(0xd89fc0) 0 'name' 'type' => 'at' DB<28> x $s->attribute('surname') 0 HASH(0xd89e88) 'aliases' => ARRAY(0xd87a40) 0 'surname' 'desc' => 'RFC2256: last (family) name(s) for which the entity is known by' 'name' => 'sn' 'oid' => '2.5.4.4' 'sup' => ARRAY(0xd89fc0) 0 'name' 'type' => 'at' DB<29> x $s->attribute('gn') 0 HASH(0x14e25d0) 'aliases' => ARRAY(0xd8b508) 0 'gn' 'desc' => 'RFC2256: first name(s) for which the entity is known by' 'name' => 'givenName' 'oid' => '2.5.4.42' 'sup' => ARRAY(0x14e2738) 0 'name' 'type' => 'at' DB<30> x $s->attribute('givenname') 0 HASH(0x14e25d0) 'aliases' => ARRAY(0xd8b508) 0 'gn' 'desc' => 'RFC2256: first name(s) for which the entity is known by' 'name' => 'givenName' 'oid' => '2.5.4.42' 'sup' => ARRAY(0x14e2738) 0 'name' 'type' => 'at' DB<31> x $s->attribute('name') 0 HASH(0x1476008) 'aliases' => ARRAY(0x1475ff0) empty array 'desc' => 'RFC4519: common supertype of name attributes' 'equality' => 'caseIgnoreMatch' 'max_length' => 32768 'name' => 'name' 'oid' => '2.5.4.41' 'substr' => 'caseIgnoreSubstringsMatch' 'syntax' => '1.3.6.1.4.1.1466.115.121.1.15' 'type' => 'at' Regards, Ulrich

2 1

Unique overlay not working, where is the misconfiguration ? [Debian 7 - 2.4.31]
by Philippe MARASSE 05 Nov '13

05 Nov '13

Hello, I'm trying to enable unique overlay to enforce uniqueness of uid and mail attributes with no luck. My server is debian 7 based with packaged slapd (2.4.31]. Here's the config for the unique overlay : DN: cn=module{1},cn=config objectClass: olcModuleList objectClass: olcConfig objectClass: top cn: module{1} olcModuleLoad: {0}memberof olcModuleLoad: {1}refint olcModuleLoad: {2}unique olcModulePath: /usr/lib/ldap DN: olcOverlay={4}unique,olcDatabase={1}hdb,cn=config objectClass: olcUniqueConfig objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top olcOverlay: {4}unique olcUniqueURI: ldap:///?mail?sub olcUniqueURI: ldap:///?uid?sub assuming the configuration is good, I've tried to create 2 entries : uid=test,ou=people,dc=mydomain,dc=com and uid=test2,ou=people,dc=mydomain,dc=com with the same mail : test(a)mydomain.com => created without error. change mail to test2(a)mydomain.com on entry uid=test2,ou=people,dc=mydomain,dc=com works going back to test(a)mydomain.com => no error The first time, I've used the main administrative account. So I created a sub administrator account, changed the ACLs, fine. Deleted the two entries, recreated the two entries with the same mail without error. I've tried to put slapd in debug mode, the only ting I've noticed is : 51f7df1e >>> dnPrettyNormal: <uid=test2,ou=people,dc=mydomain,dc=com> 51f7df1e <<< dnPrettyNormal: <uid=test2,ou=people,dc=mydomain,dc=com>, <uid=test2,ou=people,dc=mydomain,dc=com> 51f7df1e ==> unique_modify <uid=test2,ou=people,dc=mydomain,dc=com> 51f7df1e *unique_modify: administrative bypass, skipping* 51f7df1e bdb_dn2entry("uid=test2,ou=people,dc=mydomain,dc=com") 51f7df1e bdb_entry_get: rc=0 If someone has a clue... Rgds -- Philippe MARASSE Service Informatique - Centre Hospitalier Henri Laborit CS 10587 - 370 avenue Jacques Coeur 86021 Poitiers Cedex Tel : 05.49.44.57.19

4 13

OpenLDAP with ssl client certs
by Brent Bice 05 Nov '13

05 Nov '13

I was recently asked if we could use ssl client certs as a 2nd form of authentication with OpenLDAP and didn't know for sure. Is it possible to have OpenLDAP require both a DN/password pair *and* a client ssl cert? Just to see if I could make any form of client cert authentication work, I took a test-bed instance of OpenLDAP and added this line to slapd.conf: TLSVerifyClient allow Then I created a self-signed ssl cert, converted it to a .der binary file, then added it to an LDAP record's userCertificate attribute with this: dn: <my-dn> changetype: modify add: userCertificate;binary userCertificate;binary:< file:///tmp/ldapclient.bin Then I found my ldap client of choice doesn't seem to have an option to authenticate via client certs, and didn't see any command line options for ldapsearch for specifying a client ssl cert/key pair. So I edited ~/.ldaprc and added: BINDDN <my-dn> TLS_REQCERT demand TLS_CERT /tmp/ldapclient.crt TLS_KEY /tmp/ldapclient.key But when I run ldapsearch -x with no -D and -W options, it's clearly still just binding anonymously. When I run ldapsearch -x with a -D and no -W option it says I can't bind without a password. :-) So... I'm clearly missing something here. How do I get ldapsearch to try to authenticate with the SSL cert? Or is it possibly trying but failing because slapd can't validate the self-signed client cert I made? It's definitely finding and using my .ldaprc file because I can change BASE, PORT, and HOST settings in there and don't have to specify 'em on the command line afterwards, but as near as I can tell it's not using the client cert. Brent

5 12

ldap users shows up in user list, but unable to login
by slacker lnx 05 Nov '13

05 Nov '13

Hi I am using LDAP for authenticating users. I have some Fedora 8 servers which are setup as ldap clients. When I create users in LDAP it shows up on all clients. I can do an 'ldapsearch' or 'getent passwd' and all the clients shows up the ldap users. But on one of the client, I am unable to login (through ssh) using the ldap userids. When I login as root and try to switch user I get a message 'user does not exist' (getent passwd and ldapsearch shows the user). On all other clients it works fine. I compared the config files in /etc/pam.d/ and /etc/nsswitch.conf but I don't see any difference. What else can I check, which other config files do I need to look at? I had followed the same steps while configuring all ldap clients. Please help Thanks

3 4

Mixing multi-master and master-slave replication
by Robert Minsk 04 Nov '13

04 Nov '13

As a factility we have locations world wide. Within each facility we would like to use multi-master replication. We would also like to sync each facility to a glued set of databases on the global servers with simple master slave replication. See ASCII art diagram below. If every OpenLDAP server across all our locations has a unique "serverID" will the global master-slave replication play nice with the facility multi-master replication? -------- -------- -------- -------- | la01 |<-- multi-master --> | la02 | | ny01 |<-- multi-master -->| ny02 | -------- -------- -------- -------- | | -- master-slave -- -- master-slave -- | | v v ------------ | global01 | ------------ -- Robert Minsk Systems and Software Engineer WWW.METHODSTUDIOS.COM <http://www.methodstudios.com> 730 Arizona Ave, Santa Monica, CA 90401 O:+1 310 434 6500 <tel:+13104346500> // F:+1 310 434 6501 <tel:+13104346501> Los Angeles <http://www.methodstudios.com/signature/url/los-angeles><http://www.methodstudios.com/signature/url/los-angeles> This e-mail and any attachments are intended only for use by the addressee(s) named herein and may contain confidential information. If you are not the intended recipient of this e-mail, you are hereby notified any dissemination, distribution or copying of this email and any attachments is strictly prohibited. If you receive this email in error, please immediately notify the sender by return email and permanently delete the original, any copy and any printout thereof. The integrity and security of e-mail cannot be guaranteed.

2 2

Invalid credentials
by yan＠seiner.com 31 Oct '13

31 Oct '13

I am setting up a simple LDAP server. I have a few entries that I am playing with for user authentication. I have phpldapadmin set up and I can verify that the passwords are correct. However, when I test authentication usign ldapwhoami or ldapsearch (anonymous) it always fails with invalid credentials or no records found. Can anyone provide any clues on what might be going on? yan@NewMoon:/etc$ ldapwhoami -x -W -D uid=yan,ou=People,dc=seiner,dc=lan -H ldap://eluonhea1.seiner.lan/ -d 255 ldap_url_parse_ext(ldap://eluonhea1.seiner.lan/) ldap_create ldap_url_parse_ext(ldap://eluonhea1.seiner.lan:389/??base) Enter LDAP Password: ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP eluonhea1.seiner.lan:389 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 192.168.128.21:389 ldap_pvt_connect: fd: 3 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_dump: buf=0x7f567246c800 ptr=0x7f567246c800 end=0x7f567246c83c len=60 0000: 30 3a 02 01 01 60 35 02 01 03 04 22 75 69 64 3d 0:...`5...."uid= 0010: 79 61 6e 2c 6f 75 3d 50 65 6f 70 6c 65 2c 64 63 yan,ou=People,dc 0020: 3d 73 65 69 6e 65 72 2c 64 63 3d 6c 61 6e 80 0c =seiner,dc=lan.. 0030: xx (password deleted) ber_scanf fmt ({i) ber: ber_dump: buf=0x7f567246c800 ptr=0x7f567246c805 end=0x7f567246c83c len=55 0000: 60 35 02 01 03 04 22 75 69 64 3d 79 61 6e 2c 6f `5...."uid=yan,o 0010: 75 3d 50 65 6f 70 6c 65 2c 64 63 3d 73 65 69 6e u=People,dc=sein xx (password deleted) ber_flush2: 60 bytes to sd 3 0000: 30 3a 02 01 01 60 35 02 01 03 04 22 75 69 64 3d 0:...`5...."uid= 0010: 79 61 6e 2c 6f 75 3d 50 65 6f 70 6c 65 2c 64 63 yan,ou=People,dc 0020: 3d 73 65 69 6e 65 72 2c 64 63 3d 6c 61 6e 80 0c =seiner,dc=lan.. xx (password deleted) ldap_write: want=60, written=60 0000: 30 3a 02 01 01 60 35 02 01 03 04 22 75 69 64 3d 0:...`5...."uid= 0010: 79 61 6e 2c 6f 75 3d 50 65 6f 70 6c 65 2c 64 63 yan,ou=People,dc 0020: 3d 73 65 69 6e 65 72 2c 64 63 3d 6c 61 6e 80 0c =seiner,dc=lan.. xx (password deleted) ldap_result ld 0x7f5672464250 msgid 1 wait4msg ld 0x7f5672464250 msgid 1 (infinite timeout) wait4msg continue ld 0x7f5672464250 msgid 1 all 1 ** ld 0x7f5672464250 Connections: * host: eluonhea1.seiner.lan port: 389 (default) refcnt: 2 status: Connected last used: Thu Oct 31 09:42:03 2013 ** ld 0x7f5672464250 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x7f5672464250 request count 1 (abandoned 0) ** ld 0x7f5672464250 Response Queue: Empty ld 0x7f5672464250 response count 0 ldap_chkResponseList ld 0x7f5672464250 msgid 1 all 1 ldap_chkResponseList returns ld 0x7f5672464250 NULL ldap_int_select read1msg: ld 0x7f5672464250 msgid 1 all 1 ber_get_next ldap_read: want=8, got=8 0000: 30 0c 02 01 01 61 07 0a 0....a.. ldap_read: want=6, got=6 0000: 01 31 04 00 04 00 .1.... ber_get_next: tag 0x30 len 12 contents: ber_dump: buf=0x7f567246daa0 ptr=0x7f567246daa0 end=0x7f567246daac len=12 0000: 02 01 01 61 07 0a 01 31 04 00 04 00 ...a...1.... read1msg: ld 0x7f5672464250 msgid 1 message type bind ber_scanf fmt ({eAA) ber: ber_dump: buf=0x7f567246daa0 ptr=0x7f567246daa3 end=0x7f567246daac len=9 0000: 61 07 0a 01 31 04 00 04 00 a...1.... read1msg: ld 0x7f5672464250 0 new referrals read1msg: mark request completed, ld 0x7f5672464250 msgid 1 request done: ld 0x7f5672464250 msgid 1 res_errno: 49, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_parse_result ber_scanf fmt ({iAA) ber: ber_dump: buf=0x7f567246daa0 ptr=0x7f567246daa3 end=0x7f567246daac len=9 0000: 61 07 0a 01 31 04 00 04 00 a...1.... ber_scanf fmt (}) ber: ber_dump: buf=0x7f567246daa0 ptr=0x7f567246daac end=0x7f567246daac len=0 ldap_msgfree ldap_err2string ldap_bind: Invalid credentials (49) ldap_free_connection 1 1 ldap_send_unbind ber_flush2: 7 bytes to sd 3 0000: 30 05 02 01 02 42 00 0....B. ldap_write: want=7, written=7 0000: 30 05 02 01 02 42 00 0....B. ldap_free_connection: actually freed ========================= slapd.conf root@EluOnHea1:/etc/openldap# cat slapd.conf | grep -v ^# | grep -v ^$ include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/inetorgperson.schema pidfile /var/run/slapd.pid argsfile /var/run/slapd.args moduleload back_bdb.la access to * by self write by users read by anonymous auth database ldif suffix "dc=seiner,dc=lan" rootdn "cn=admin,dc=seiner,dc=lan" rootpw xxx directory /usr/lib/openldap-data

1 0

ldap_set_option() of LDAP_OPT_X_TLS_REQUIRE_CERT
by Todd Lyons 31 Oct '13

31 Oct '13

Hello, I'm a developer on the Exim MTA and I have some questions about differing behavior I am seeing across different systems. I would like some suggestions about the best way to handle each issue. First, I have not gotten "a ton of complaints." One person contacted me with the issues I am describing below. I do not know his server or client versions, other than his workstation is Debian Squeeze. I'll just refer to him as "the guy". Second, my test server is running openldap 2.3.34, my workstation on which I am running my test builds of Exim is using openldap 2.4.28 client libs. Issues: 1. When multiple servers are specified, our ldap code just did an unbind to all servers defined when it was finished. The guy contacted me with the problem that the unbind call hangs when one of the ldap servers was unavailable for whatever reason. On *my* system, the blind unbind worked properly no matter if the bind succeeded. I modified the ldap code so that it only unbinds if the original bind succeeded. That seems the proper/correct way to handle it in all cases, so this issue really is already solved. I'm just wondering if there are any gotchas I might be missing by doing it this way. 2. A few months ago I helped (a different) someone troubleshoot a really strange problem where setting the LDAP_OPT_X_TLS_REQUIRE_CERT option in our code did not have any impact on his machine. Our code set that option per connection. It turns out that, for him, setting that option per connection did not affect the TLS require cert option that the bind used. He found some comment somewhere advising that NULL for the ldap handle sets the option globally in the ldap client. We tried it and it solved the problem for him. I saw identical behavior on my system (NULL worked, ldap handle did not) so we assumed that the code had never really worked properly. I then changed our ldap code to use NULL instead of the ldap handle when setting the TLS require cert option. The guy (with the current problem) runs a system that worked just fine previously, but using the new code (NULL instead of ldap handle when setting TLS require cert option) does not affect the TLS require certificate setting when his bind is attempted. After much testing and debugging, I had him merely change that one line back to using the ldap handle in ldap_set_option() and it then worked properly for him. So I have two systems (mine and his) which behave differently after the ldap_set_option() on LDAP_OPT_X_TLS_REQUIRE_CERT. In a fit of psychotic testing, I decided on my system to just blindly set it both globally and per connection. It worked, and produced no errors. That surprised me, I expected one or the other to complain. My potential code looks like the following (apologize if Gmail wraps), can you explain any pitfalls of doing it this way? Should the two be #ifdef guarded by client lib version checks or something? /* Use NULL ldap handle b/c is global in some client libs */ rc = ldap_set_option(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, &cert_option); if (rc) { DEBUG(D_lookup) debug_printf("Unable to set TLS require cert_option(%d) globally: %s\n", cert_option, ldap_err2string(rc)); } /* Use current ldap handle b/c is per-connection in others */ rc = ldap_set_option(ld, LDAP_OPT_X_TLS_REQUIRE_CERT, &cert_option); if (rc) { DEBUG(D_lookup) debug_printf("Unable to set TLS require cert_option(%d) on LDAP server " "%s%s: %s\n", cert_option, host, porttext, ldap_err2string(rc)); } Any comments or suggestions are appreciated. ...Todd -- The total budget at all receivers for solving senders' problems is $0. If you want them to accept your mail and manage it the way you want, send it the way the spec says to. --John Levine

1 1

substring matching rule not working in extensible search filter
by David Coutadeur 31 Oct '13

31 Oct '13

Hi everybody, I tryied this filter in a ldapsearch operation: (&(objectClass=inetOrgPerson)(description:2.5.13.7:=*abcd)) but this results in a "Bad search filter (-7)". However if I write this without the joker it works: (&(objectClass=inetOrgPerson)(description:2.5.13.7:=abcd)) I don't see any restriction on matching rule extensible notation in RFC 4515 (http://tools.ietf.org/html/rfc4515). Is this syntax not implemented in OpenLDAP, or did I make a mistake in my filter ? Thank you in advance, DC

1 0

invalid value for attributeType objectClass
by limpteam＠gmail.com 31 Oct '13

31 Oct '13

Hello community! Have a Centos 6.4 server with new openldap 2.4.23-32.el6_4.1 installled. I'm new to ldap and just install it and configure for easy use. I edit only than 2 files olcDatabase={0}config.ldif and olcDatabase={2}bdb.ldif It's starts, I worked with it, add some OU and CN via phpLdapAdmin and tested it on Thunderbird. But after I decide to restart slapd i got error: PROXIED attributeDescription "DC" inserted. str2entry: invalid value for attributeType objectClass #0 (syntax 1.3.6.1.4.1.1466.115.121.1.38) slaptest: bad configuration file! and didn't start. it's problem with ppolicy and pwdAttribute? How can i solve this? Thanks for answer! P.S. Google can't help me or I just don't understand the whole theory.

2 1

About LDAP PAM authentication
by Ernesto Manuel Suarez Ojeda 30 Oct '13

30 Oct '13

Hi, I have 4 goals in configurating ldap pam authentication in my workstations Ubuntu 12.04 and 10.04: 1. Authenticate both ldap users and unix users. 2. Login using cached credentials when ldap server is down. 3. Warnings and dialog for password change when password expired or is about to expire. 4. Password length and complexity check. We have an openldap server with an operational ppolicy.schema and we need a comprehensive explanation about configuring Ubuntu clients for achieve this goals. I have read some documents but I'm not satisfied. Thanks, Ernesto Suárez Ojeda

1 0

OpenLDAP 2.4.26 SRPM for RHEL
by Aaron Bennett 30 Oct '13

30 Oct '13

Hi, Just in case anyone's using them, I've updated the SRPMS for our local build of OpenLDAP for RHEL/CentOS to 2.4.36. https://wordpress.clarku.edu/abennett/2012/03/16/openldap-src-rpms-for-rhel… It's basically as stock-as-possible, build against BDB 5.1.29 and OpenSSL. - Aaron --- Aaron Bennett Manager of Systems Administration Clark University ITS W:508.793.7315

2 1

limit on number of members in groupOfNames
by Dorit Eitan 30 Oct '13

30 Oct '13

2 2

Trouble with delta-syncrepl MMR: delta-sync lost sync on X, switching to REFRESH
by Patrick Lists 29 Oct '13

29 Oct '13

Hi, I'm trying to create a 2-node delta-syncrepl Multi-Master setup with the help of the Admin Guide, man pages and tests/scripts/test063-delta-multimaster. I see the following problem repeat on the "slave" master aka ldap02 which initially syncs with ldap01 aka the "primary" master: Oct 28 04:12:14 ldap02 slapd[9998]: do_syncrep2: rid=001 delta-sync lost sync on (reqStart=20131028012214.000002Z,cn=accesslog), switching to REFRESH I found ITS#7274 which mentions that some order should be changed (syncprov before olcServerID) but I have no idea how that applies to my setup. Being new to all this magic I came up empty. So here's my config. Hopefully it isn't too messed up :) I would appreciate it if someone could share a clue or 2 how to make this work. Comments on the config not related to the problem are also most welcome. OS: CentOS 6.4 x86_64 - clean install, all OpenLDAP dirs are empty OpenLDAP version: RE24 git rev f9e417a from around 10/23/2013. On the initial/"primary" master (note that the config is the same for the "slave" up to the comment): $ sudo /usr/local/sbin/slapadd -v -F $LDAP_ETC/slapd.d \ -l ./delta-syncrepl-MMR.ldif -n 0 $ cat ./delta-syncrepl-MMR.ldif # global configuration settings dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/openldap-2.4/slapd-2.4.args olcPidFile: /var/run/openldap-2.4/slapd-2.4.pid olcLogFile: /var/log/openldap-2.4/slapd-2.4.log olcLogLevel: conns stats stats2 sync olcTLSCACertificateFile: /etc/pki/tls/certs/DS-CA.crt olcTLSCertificateFile: /etc/pki/tls/certs/slapd.crt olcTLSCertificateKeyFile: /etc/pki/tls/private/slapd.key.crt olcTLSCipherSuite: TLSv1+HIGH:!SSLv2:!aNULL:!eNULL:!3DES:!RC4:@STRENGTH olcTLSVerifyClient: demand olcLocalSSF: 256 olcSecurity: ssf=256 olcPasswordCryptSaltFormat: $6$%s olcPasswordHash: {CRYPT} olcServerID: 1 ldap://ldap01 olcServerID: 2 ldap://ldap02 # load modules dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulePath: /usr/local/lib64/openldap-2.4 olcModuleload: {0}syncprov.la olcModuleload: {1}accesslog.la olcModuleLoad: {2}back_mdb.la olcModuleLoad: {3}back_monitor.la olcModuleLoad: {4}memberof.la olcModuleLoad: {5}refint.la olcModuleLoad: {6}ppolicy.la # schema definitions dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema # include the schemas include: file:///etc/openldap-2.4/schema/core.ldif include: file:///etc/openldap-2.4/schema/corba.ldif include: file:///etc/openldap-2.4/schema/cosine.ldif include: file:///etc/openldap-2.4/schema/duaconf.ldif include: file:///etc/openldap-2.4/schema/dyngroup.ldif include: file:///etc/openldap-2.4/schema/inetorgperson.ldif include: file:///etc/openldap-2.4/schema/java.ldif include: file:///etc/openldap-2.4/schema/misc.ldif include: file:///etc/openldap-2.4/schema/nis.ldif include: file:///etc/openldap-2.4/schema/openldap.ldif include: file:///etc/openldap-2.4/schema/ppolicy.ldif include: file:///etc/openldap-2.4/schema/collective.ldif # global database parameters dn: olcDatabase=frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: frontend # setup cn=config (password = 1234) dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootPW: {CRYPT}$6$... olcSyncrepl: {0}rid=001 provider=ldap://ldap01 binddn="cn=Manager,dc=test" bindmethod=sasl saslmech=external searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 schemachecking=off interval=00:00:00:5 retry="5 +" starttls=critical tls_cert=/etc/pki/tls/certs/Manager.crt tls_key=/etc/pki/tls/private/Manager.key.crt tls_cacert=/etc/pki/tls/certs/DS-CA.crt tls_reqcert=demand logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" syncdata=accesslog olcSyncrepl: {1}rid=002 provider=ldap://ldap02 binddn="cn=Manager,dc=test" bindmethod=sasl saslmech=external searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 schemachecking=off interval=00:00:00:5 retry="5 +" starttls=critical tls_cert=/etc/pki/tls/certs/Manager.crt tls_key=/etc/pki/tls/private/Manager.key.crt tls_cacert=/etc/pki/tls/certs/DS-CA.crt tls_reqcert=demand logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" syncdata=accesslog olcMirrorMode: TRUE olcAccess: to * by dn.exact="cn=Manager,dc=test" write by * none olcLimits: dn.exact="cn=Manager,dc=test" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited # add the syncprov overlay to the cn=config database dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov olcSpNoPresent: TRUE olcSpReloadHint: TRUE # setup monitoring dn: olcDatabase=monitor,cn=config objectClass: olcDatabaseConfig objectClass: olcMonitorConfig olcDatabase: monitor olcAccess: to dn.subtree=cn=Monitor by dn.exact="cn=config" write by dn.exact="cn=Manager,dc=test" write by * none # setup Accesslog database definitions dn: olcDatabase={2}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {2}mdb olcDbDirectory: /var/lib/ldap-2.4/accesslog olcSuffix: cn=accesslog olcAccess: {0}to dn.subtree="cn=accesslog" by dn.exact="cn=Manager,dc=test" read olcRootDN: cn=Manager,dc=test olcDbIndex: objectClass,entryCSN,reqStart,reqEnd,reqResult,reqDN eq olcDbMode: 0600 # max size in bytes - 1GB = 1073741824 bytes olcDbMaxsize: 1073741824 # add the syncprov overlay to the cn=accesslog database dn: olcOverlay=syncprov,olcDatabase={2}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov olcSpNoPresent: TRUE olcSpReloadHint: TRUE # up to here ^^^ is also the config for the "slave" # main mdb database definition dn: olcDatabase={3}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {3}mdb olcSuffix: dc=test olcDbDirectory: /var/lib/ldap-2.4/test olcRootDN: cn=Manager,dc=test olcRootPW: {CRYPT}$6$... olcSyncrepl: {0}rid=003 provider=ldap://ldap01 binddn="cn=Manager,dc=test" bindmethod=sasl saslmech=external searchbase="dc=test" type=refreshAndPersist retry="5 5 300 5" timeout=1 schemachecking=off interval=00:00:00:5 retry="5 +" starttls=critical tls_cert=/etc/pki/tls/certs/Manager.crt tls_key=/etc/pki/tls/private/Manager_nopass.key.crt tls_cacert=/etc/pki/tls/certs/DS-CA.crt tls_reqcert=demand logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" syncdata=accesslog olcSyncrepl: {1}rid=004 provider=ldap://ldap02 binddn="cn=Manager,test" bindmethod=sasl saslmech=external searchbase="dc=test" type=refreshAndPersist retry="5 5 300 5" timeout=1 schemachecking=off interval=00:00:00:5 retry="5 +" starttls=critical tls_cert=/etc/pki/tls/certs/Manager.crt tls_key=/etc/pki/tls/private/Manager.key.crt tls_cacert=/etc/pki/tls/certs/DS-CA.crt tls_reqcert=demand logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" syncdata=accesslog olcMirrorMode: TRUE olcDbIndex: cn pres,eq,sub olcDbIndex: gidNumber pres,eq olcDbIndex: mail pres,eq,sub olcDbIndex: memberUid pres,eq olcDbIndex: objectClass pres,eq olcDbIndex: ou pres,eq,sub olcDbIndex: sn pres,eq,sub olcDbIndex: uid pres,eq olcDbIndex: uidNumber pres,eq olcDbIndex: entryCSN,entryUUID eq olcDbMode: 0600 # max size in bytes - 1GB = 1073741824 bytes olcDbMaxSize: 5368709120 olcAccess: to attrs=userPassword by dn.exact="cn=Manager,dc=test" write by self write by anonymous auth by * none olcAccess: to * by dn.exact="cn=Manager,dc=test" write by self read by * read olcLimits: dn.exact="cn=Manager,dc=test" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited # add the syncprov overlay to the main mdb database dn: olcOverlay={0}syncprov,olcDatabase={3}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov olcSpCheckPoint: 20 10 # add the accesslog overlay to the main mdb database dn: olcOverlay={1}accesslog,olcDatabase={3}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcAccessLogConfig olcOverlay: accesslog olcAccessLogDB: cn=accesslog olcAccessLogOps: writes olcAccessLogSuccess: TRUE olcAccessLogPurge: 01+00:00 04+00:00 # add memberof overlay to mdb database dn: olcOverlay={2}memberof,olcDatabase={3}mdb,cn=config objectClass: olcConfig objectClass: olcMemberOf objectClass: olcOverlayConfig objectClass: top olcOverlay: memberof olcMemberOfDangling: ignore olcMemberOfRefInt: TRUE olcMemberOfGroupOC: groupOfNames olcMemberOfMemberAD: member olcMemberOfMemberOfAD: memberOf # add refint overlay to mdb database dn: olcOverlay={3}refint,olcDatabase={3}mdb,cn=config objectClass: olcConfig objectClass: olcOverlayConfig objectClass: olcRefintConfig objectClass: top olcOverlay: refint olcRefintAttribute: member memberOf olcRefintNothing: cn=Manager,dc=test # add the ppolicy overlay to the main mdb database dn: olcOverlay={4}ppolicy,olcDatabase={3}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcOverlay: ppolicy olcPPolicyDefault: cn=default,ou=policies,dc=test olcPPolicyHashCleartext: TRUE $ sudo /usr/local/bin/ldapadd -v -f ./test-data.ldif x -D "cn=Manager,dc=test" -w $(cat ./ldap.secret) -d0 -ZZ # Organization dn: dc=test objectClass: dcObject objectClass: organization dc: test o: Test description: Test LDAP Root # add ppolicy ou dn: ou=policies,dc=test ou: policies objectClass: top objectClass: organizationalUnit # add password policy dn: cn=default,ou=policies,dc=test cn: default objectClass: pwdPolicy objectClass: pwdPolicyChecker objectClass: person objectClass: top pwdAllowUserChange: TRUE pwdAttribute: userPassword pwdCheckQuality: 2 pwdExpireWarning: 600 pwdFailureCountInterval: 30 pwdGraceAuthNLimit: 5 pwdInHistory: 5 pwdLockout: TRUE pwdLockoutDuration: 0 pwdMaxAge: 0 pwdMaxFailure: 5 pwdMinAge: 0 pwdMinLength: 5 pwdMustChange: FALSE pwdSafeModify: FALSE pwdCheckModule: check_password.so sn: dummy value ... Thanks! Regards, Patrick

4 6

Used port
by Muhammad Bashir Al-Noimi 29 Oct '13

29 Oct '13

Hello, As I know OpenLDAP uses by default 389. How can I be sure what if my server use it or not? -- Best Regards Muhammad Bashir Al-Noimi

2 2

libpam-ldapd issue
by Muhammad Bashir Al-Noimi 29 Oct '13

29 Oct '13

Hello, I installed OpenLDAP under Ubuntu 13.04 x64 by using the mentioned steps in this article ( http://edin.no-ip.com/blog/hswong3i/ldap-single-sign-webmin-ubuntu-12-04-ho… ) the problem I've faced that my system cannot lookup Unix users in the LDAP database because I couldn't configure libpam-ldapd to enable Unix authentication, LDAP Authentication. How can I fix this issue? P.S. I'm still a newbie with LDAP so forgive me for silly question. I tried to use dpkg-reconfigure libpam-ldapd but it didn't ask me anything! -- Best Regards Muhammad Bashir Al-Noimi

2 3

slapd deferring operation?
by Aleksander Dzierżanowski 29 Oct '13

29 Oct '13

Hi. I’m trying to migrate small other vendor LDAP server to OpenLDAP. I've created test environment with 3 multimaster OpenLDAP instances - version 2.4.36. Below is some strange behavior of slapd while I was adding few hunderd of accounts from ldif file using ‚ldapadd’ command from remote host. […] conn=1015 op=440 ADD dn=„uid=XXX,ou=People,ou=developers,o=test" conn=1015 op=440 RESULT tag=105 err=0 text= connection_input: conn=1015 deferring operation: too many executing conn=1015 op=441 ADD dn=„uid=YYY,ou=People,ou=developers,o=test" conn=1015 op=441 RESULT tag=105 err=0 text= […] My question is what does mean 'deferring operation’ - as you can see result is OK (err=0) so nothing was really deferred. Database is really small - few hundred entries, and server is not used at all by any other machine. I was using rootdn user which I suppose does not have any limits for search/add/mod operations? Is it some configuration issue? I also observe the same ‚deferring’ info in log file when there is only a single host client connected to this LDAP server - RedHat/CentOS with configured sssd. They are not so often but appear regularly. — Olo

3 2

use openssl or moznss for more than TLS?
by Steve Eckmann 29 Oct '13

29 Oct '13

We need a FIPS-validated SHA512 for password storage. The pw-sha2 module provides SHA512 but isn't FIPS-validated. I see that I can use openssl or moznss in FIPS mode to get TLS, but I don't see how to get to either of those library's crypto functions from openldap. Is it possible? Thanks. Steve

6 8

Migrating to N-Way Master
by Peter Sprokkelenburg 28 Oct '13

28 Oct '13

Currently have a provider / consumer setup in one datacenter. Looking to expand to other datacentre and would like better redundancy. Running version 2.4.28. What's the best way to change from provider / consumer to n-way master? Down time is an option. Can the current replication be stopped, reconfigured and then started again? ---- Peter

3 16

Can multiple threads use the same MDB transaction?
by Petri Huovinen＠ 25 Oct '13

25 Oct '13

Hi, Can multiple threads access to the same MDB transaction and issue read-only calls between opening and closing the MDB_cursors? More detail, we would like to use MDB_NOTLS flag when opening the MDB environments, start read-only transaction in a single thread. Then we would like to use this transaction in the multiple threads simultaneously (opening cursors, reading, closing cursors). Only after these operations are finalized we would then commit the transaction in a single thread. The same question applies to the read-write transaction. The only differences would be that MDB_NOTLS flag is not relevant and that we would anyway serialize the update operations and would not allow parallel read operations and update operations. Does MDB support the above scenario? If not, what is the reason? Thanks, Petri Huovinen

1 0

slapd-ldap and Multiple URIs: Dealing with hosts that are down
by Jesus Jr M Salvo 25 Oct '13

25 Oct '13

Using the meta backend, I have specified a list of LDAP URIs. I am testing what happens if the first URI becomes unresponsive ( e.g. The host was shutdown, etc. ). So I deliberately put in a bogus URI as the first URI that I know will not respond ( TCP SYN would be sent out by OpenLDAP, but no TCP ACK coming back ): ##################### backend meta database meta access to * by * read suffix "dc=ldapproxy,dc=local" uri ldap://10.10.10.10/dc=aas,dc=priv,dc=ldapproxy,dc=local ldap://aassydc02.aas.priv/ suffixmassage "dc=aas,dc=priv,dc=ldapproxy,dc=local" "dc=aas,dc=priv" chase-referrals no lastmod off protocol-version 3 timeout 10 ##################### With the above timeout setting, I was hoping that after 10 seconds, OpenLDAP will try the next URI it the first URI did not respond ... but it did not as per tshark capture below. What setting do I need to accomplish what I need ? 0.000000 127.0.0.1 -> 127.0.0.1 TCP 76 50649 > ldap [SYN] Seq=0 Win=32792 Len=0 MSS=16396 SACK_PERM=1 TSval=133287492 TSecr=0 WS=128 0.000021 127.0.0.1 -> 127.0.0.1 TCP 76 ldap > 50649 [SYN, ACK] Seq=0 Ack=1 Win=32768 Len=0 MSS=16396 SACK_PERM=1 TSval=133287492 TSecr=133287492 WS=128 0.000035 127.0.0.1 -> 127.0.0.1 TCP 68 50649 > ldap [ACK] Seq=1 Ack=1 Win=32896 Len=0 TSval=133287492 TSecr=133287492 0.000090 127.0.0.1 -> 127.0.0.1 LDAP 118 bindRequest(1) "cn=admin,dc=ldapproxy,dc=local" simple 0.000102 127.0.0.1 -> 127.0.0.1 TCP 68 ldap > 50649 [ACK] Seq=1 Ack=51 Win=32768 Len=0 TSval=133287492 TSecr=133287492 0.000829 127.0.0.1 -> 127.0.0.1 LDAP 82 bindResponse(1) success 0.000856 127.0.0.1 -> 127.0.0.1 TCP 68 50649 > ldap [ACK] Seq=51 Ack=15 Win=32896 Len=0 TSval=133287493 TSecr=133287493 0.000909 127.0.0.1 -> 127.0.0.1 LDAP 158 searchRequest(2) "DC=ldapproxy,DC=local" wholeSubtree 0.001196 172.21.17.193 -> 10.10.10.10 TCP 76 58293 > ldap [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 TSval=133287493 TSecr=0 WS=128 0.040403 127.0.0.1 -> 127.0.0.1 TCP 68 ldap > 50649 [ACK] Seq=15 Ack=141 Win=32768 Len=0 TSval=133287503 TSecr=133287493 1.001055 172.21.17.193 -> 10.10.10.10 TCP 76 58293 > ldap [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 TSval=133287743 TSecr=0 WS=128 3.006852 172.21.17.193 -> 10.10.10.10 TCP 76 58293 > ldap [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 TSval=133288244 TSecr=0 WS=128 7.013361 172.21.17.193 -> 10.10.10.10 TCP 76 58293 > ldap [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 TSval=133289246 TSecr=0 WS=128 15.020550 172.21.17.193 -> 10.10.10.10 TCP 76 58293 > ldap [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 TSval=133291248 TSecr=0 WS=128 31.052492 172.21.17.193 -> 10.10.10.10 TCP 76 58293 > ldap [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 TSval=133295256 TSecr=0 WS=128 60.063874 172.21.17.193 -> 10.10.10.10 TCP 76 58295 > ldap [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 TSval=133302508 TSecr=0 WS=128 61.060500 172.21.17.193 -> 10.10.10.10 TCP 76 58295 > ldap [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 TSval=133302758 TSecr=0 WS=128 63.065447 172.21.17.193 -> 10.10.10.10 TCP 76 58295 > ldap [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 TSval=133303259 TSecr=0 WS=128

3 4

Syncrepl with subordinate databases
by Robert Minsk 25 Oct '13

25 Oct '13

I have multiple sites that I am trying to sync up to a global server. Each site is configured (striped down) as: ############################################################################ # mdb database for o=chi01,ou=studios,dc=methodstudios,dc=net ############################################################################ database mdb suffix "o=chi01,ou=studios,dc=methodstudios,dc=net" # Save the time that the entry gets modified lastmod on # Subordinate of the ou=studios,dc=methodstudios,dc=net database below subordinate advertise overlay syncprov syncprov-reloadhint TRUE syncprov-checkpoint 100 5 ############################################################################ # mdb database for ou=studios,dc=methodstudios,dc=net ############################################################################ database mdb suffix "ou=studios,dc=methodstudios,dc=net" The above is my configuration for Chicago. I have similar ones for New York (ny01) and Los Angeles (la01) On my global server I am trying to use sync replication to clone each site. The global server is configured (striped down) as: ############################################################################ # mdb database for o=global,ou=studios,dc=methodstudios,dc=net ############################################################################ database mdb suffix "o=global,ou=studios,dc=methodstudios,dc=net" # Save the time that the entry gets modified lastmod on # Subordinate of the ou=studios,dc=methodstudios,dc=net database below subordinate advertise overlay syncprov syncprov-reloadhint TRUE syncprov-checkpoint 100 5 ############################################################################ # mdb database for o=chi01,ou=studios,dc=methodstudios,dc=net ############################################################################ database mdb suffix "o=chi01,ou=studios,dc=methodstudios,dc=net" # Subordinate of the ou=studios,dc=methodstudios,dc=net database below subordinate advertise syncrepl rid=1 provider=ldap://chi01.methodstudios.com type=refreshOnly retry="60 10 300 +" interval=00:00:10:00 searchbase="o=chi01,ou=studios,dc=methodstudios,dc=net" bindmethod=simple starttls=yes binddn="****" credentials=**** schemachecking=off ############################################################################ # mdb database for o=ny01,ou=studios,dc=methodstudios,dc=net ############################################################################ database mdb suffix "o=ny01,ou=studios,dc=methodstudios,dc=net" # Subordinate of the ou=studios,dc=methodstudios,dc=net database below subordinate advertise syncrepl rid=2 provider=ldap://ny01.methodstudios.com type=refreshOnly retry="60 10 300 +" interval=00:00:10:00 searchbase="o=ny01,ou=studios,dc=methodstudios,dc=net" bindmethod=simple starttls=yes binddn="****" credentials=**** schemachecking=off ############################################################################ # mdb database for ou=studios,dc=methodstudios,dc=net ############################################################################ database mdb suffix "ou=studios,dc=methodstudios,dc=net" overlay glue overlay syncprov syncprov-reloadhint TRUE syncprov-checkpoint 100 5 Now that I have the configuration out of the way. Syncrepl on the global server is failing on chi01. The chi01 server syslog has Oct 23 18:41:35 boote01-chi01 slapd[19324]: conn=1000 op=2 SRCH base="o=chi01,ou=studios,dc=methodstudios,dc=net" scope=2 deref=0 filter="(objectClass=*)" Oct 23 18:41:35 boote01-chi01 slapd[19324]: conn=1000 op=2 SRCH attr=* + Oct 23 18:41:35 boote01-chi01 slapd[19324]: conn=1000 op=2 SEARCH RESULT tag=101 err=53 nentries=0 text=consumer state is newer than provider! Oct 23 18:41:35 boote01-chi01 slapd[19324]: conn=1000 op=3 UNBIND Looking at the ny01 server (ldapsearch -x -h ny01 -b o=ny01,ou=studios,dc=methodstudios,dc=net -s base +) where syncrepl is working # ny01, studios, methodstudios.net dn: o=ny01,ou=studios,dc=methodstudios,dc=net structuralObjectClass: organization entryUUID: 257c5408-717c-1032-9b24-31eddc101779 creatorsName: cn=admin,ou=studios,dc=methodstudios,dc=net createTimestamp: 20130625004432Z entryCSN: 20130625004432.932104Z#000000#000#000000 modifiersName: cn=admin,ou=studios,dc=methodstudios,dc=net modifyTimestamp: 20130625004432Z contextCSN: 20131023210335.999443Z#000000#000#000000 entryDN: o=ny01,ou=studios,dc=methodstudios,dc=net subschemaSubentry: cn=Subschema hasSubordinates: TRUE Looking at the global server (ldapsearch -x -h global -b o=ny01,ou=studios,dc=methodstudios,dc=net -s base +): # ny01, studios, methodstudios.net dn: o=ny01,ou=studios,dc=methodstudios,dc=net structuralObjectClass: organization entryUUID: ccbe6442-d084-1032-8149-e14ce02952dd creatorsName: cn=admin,ou=studios,dc=methodstudios,dc=net createTimestamp: 20131023231549Z entryCSN: 20131023231549.982220Z#000000#000#000000 modifiersName: cn=admin,ou=studios,dc=methodstudios,dc=net modifyTimestamp: 20131023231549Z entryDN: o=ny01,ou=studios,dc=methodstudios,dc=net subschemaSubentry: cn=Subschema hasSubordinates: FALSE Notice no contextCSN. Looking at the chi01 server (ldapsearch -x -h chi01 -b o=chi01,ou=studios,dc=methodstudios,dc=net -s base +): # chi01, studios, methodstudios.net dn: o=chi01,ou=studios,dc=methodstudios,dc=net structuralObjectClass: organization entryUUID: 4b4f63f6-81bb-1032-97d3-7d320a684bf1 creatorsName: cn=admin,ou=studios,dc=methodstudios,dc=net createTimestamp: 20130715165653Z entryCSN: 20130715165653.289427Z#000000#000#000000 modifiersName: cn=admin,ou=studios,dc=methodstudios,dc=net modifyTimestamp: 20130715165653Z contextCSN: 20131018000127.430328Z#000000#000#000000 entryDN: o=chi01,ou=studios,dc=methodstudios,dc=net subschemaSubentry: cn=Subschema hasSubordinates: TRUE Looking at the global server (ldapsearch -x -h global -b o=chi01,ou=studios,dc=methodstudios,dc=net -s base +): # chi01, studios, methodstudios.net dn: o=chi01,ou=studios,dc=methodstudios,dc=net structuralObjectClass: organization entryUUID: cc675698-d084-1032-8eb1-f1b765ca1756 creatorsName: cn=admin,ou=studios,dc=methodstudios,dc=net createTimestamp: 20131023231549Z entryCSN: 20131023231549.411641Z#000000#000#000000 modifiersName: cn=admin,ou=studios,dc=methodstudios,dc=net modifyTimestamp: 20131023231549Z entryDN: o=chi01,ou=studios,dc=methodstudios,dc=net subschemaSubentry: cn=Subschema hasSubordinates: FALSE Notice no contextCSN. Looking at the global server root of the glued database (ldapsearch -x -h global -b ou=studios,dc=methodstudios,dc=net -s base +): # studios, methodstudios.net dn: ou=studios,dc=methodstudios,dc=net structuralObjectClass: organizationalUnit entryUUID: cc769b12-d084-1032-86fe-a1b1821abdab creatorsName: cn=admin,ou=studios,dc=methodstudios,dc=net createTimestamp: 20131023231549Z entryCSN: 20131023231549.511823Z#000000#000#000000 modifiersName: cn=admin,ou=studios,dc=methodstudios,dc=net modifyTimestamp: 20131023231549Z contextCSN: 20131024000524.348070Z#000000#000#000000 entryDN: ou=studios,dc=methodstudios,dc=net subschemaSubentry: cn=Subschema hasSubordinates: FALSE So after all that. Is the syncrepl from chi01 using the contextCSN from the root of the glued database? It seems all the syncrepl from all the sites fail unless they have the latest change. How do you handle syncrepl on glued databases? -- Robert Minsk Systems and Software Engineer WWW.METHODSTUDIOS.COM <http://www.methodstudios.com> 730 Arizona Ave, Santa Monica, CA 90401 O:+1 310 434 6500 <tel:+13104346500> // F:+1 310 434 6501 <tel:+13104346501> Los Angeles <http://www.methodstudios.com/signature/url/los-angeles><http://www.methodstudios.com/signature/url/los-angeles> This e-mail and any attachments are intended only for use by the addressee(s) named herein and may contain confidential information. If you are not the intended recipient of this e-mail, you are hereby notified any dissemination, distribution or copying of this email and any attachments is strictly prohibited. If you receive this email in error, please immediately notify the sender by return email and permanently delete the original, any copy and any printout thereof. The integrity and security of e-mail cannot be guaranteed.

3 6

Re: RE24 testing call (OpenLDAP 2.4.37)
by Marco Pizzoli 24 Oct '13

24 Oct '13

All tests fine even here. Compiled HDB and MDB on RHEL6.4 64bit with gperftool. Regards Marco On Tue, Oct 22, 2013 at 10:27 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > If you know how to build OpenLDAP manually, and would like to participate > in testing the next set of code for the 2.4.37 release, please do so. > > Generally, get the code for RE24: > > <http://www.openldap.org/**devel/gitweb.cgi?p=openldap.** > git;a=snapshot;h=refs/heads/**OPENLDAP_REL_ENG_2_4;sf=tgz<http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> > > > > Configure & build. > > Execute the test suite (via make test) after it is built. > > Thanks! > > --Quanah > > -- > > Quanah Gibson-Mount > Architect - Server > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > >

1 0

Re: LDAP: error code 69 - structural object class modification
by Artur Nike 24 Oct '13

24 Oct '13

Thank you for your help. Yes I did, the extension of such objects STRUCTURAL, Auxiliary facilities (including the new attributes.) It works :). Regards Mariusz 2013/10/23 Quanah Gibson-Mount <quanah(a)zimbra.com> > --On Wednesday, October 23, 2013 12:44 PM +0200 Artur Nike < > opalsie(a)gmail.com> wrote: > > > The only thing that works is: >> -export facility to ldif >> -swapping of a new class (which inherits old) >> -Remove the item from the tree, >> -add the ldif (with swapped class) >> >> >> Maybe I do not understand something, ask for help, how to expand objects >> > > An object can only be of one structural type. I.e., you cannot simply > make an apple become an orange. You may wish to look at using an AUXILIARY > objectClass to "add-on" attributes to an existing object. > > --Quanah > > -- > > Quanah Gibson-Mount > Architect - Server > Zimbra, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

Re: Re: OpenLDAP 2.3.4 TLS negotiation failure
by Tian Zhiying 24 Oct '13

24 Oct '13

Hi Dieter： Thanks for your quick reply. I have changed 'TLS_REQCERT try' and check the commonName of the host certificate, the common name is LDAP Server hostname "auth.server.com", the following is the query results: [root@auth cacerts]# openssl s_client -connect localhost:636 -showcerts -state -CAfile /etc/openldap/cacerts/cacert.pem CONNECTED(00000003) SSL_connect:before/connect initialization SSL_connect:SSLv2/v3 write client hello A SSL_connect:SSLv3 read server hello A depth=0 /C=CN/ST=BJ/L=BJ/O=TS/OU=IT/CN=auth.server.com/emailAddress=tianzy(a)server.com verify error:num=18:self signed certificate verify return:1 depth=0 /C=CN/ST=BJ/L=BJ/O=TS/OU=IT/CN=auth.server.com/emailAddress=tianzy(a)server.com verify return:1 SSL_connect:SSLv3 read server certificate A SSL_connect:SSLv3 read server certificate request A SSL_connect:SSLv3 read server done A SSL_connect:SSLv3 write client certificate A SSL_connect:SSLv3 write client key exchange A SSL_connect:SSLv3 write change cipher spec A SSL_connect:SSLv3 write finished A SSL_connect:SSLv3 flush data SSL_connect:SSLv3 read finished A Now, the /etc/openldap/ldap.conf file: URI ldap://ldap.server.com/ BASE dc=server,dc=com TLS_CACERT /etc/openldap/cacerts/cacert.pem #SSL ON TLS_REQCERT try But, run "#ldapsearch -x -H ldap://ldap.server.com -ZZ" , I also get the following error: [root@client cacerts]# ldapsearch -x -H ldap://ldap.server.com -ZZ ldap_start_tls: Connect error (-11) Tian Zhiying From: DieterKlünter Date: 2013-10-23 17:35 To: openldap-technical CC: tianzy1225 Subject: Re: OpenLDAP 2.3.4 TLS negotiation failure Am Wed, 23 Oct 2013 16:47:25 +0800 schrieb "Tian Zhiying" <tianzy1225(a)thundersoft.com>: > Hi > > On the LDAP Server , I run following command is ok: > #ldapsearch -x -H ldap://ldap.server.com -ZZ > #ldapsearch -x -H ldap://ldap.server.com > > But on my client , I run "#ldapsearch -x -H ldap://ldap.server.com", > is ok; Run "#ldapsearch -x -H ldap://ldap.server.com -ZZ" , I get the > following error: [root@client cacerts]# ldapsearch -x -H > ldap://ldap.server.com -ZZ ldap_start_tls: Connect error (-11) > > On LDAP Server log file, I get the following error messages: > Oct 23 16:41:25 auth slapd[4213]: conn=206 fd=24 ACCEPT from > IP=192.168.9.9:45648 (IP=0.0.0.0:389) Oct 23 16:41:25 auth > slapd[4213]: conn=206 op=0 STARTTLS Oct 23 16:41:25 auth slapd[4213]: > conn=206 op=0 RESULT oid= err=0 text= Oct 23 16:41:25 auth > slapd[4213]: conn=206 fd=24 closed (TLS negotiation failure) > > My client ldap configuration: > /etc/openldap/ldap.conf file: > URI ldap://ldap.server.com/ > BASE dc=server,dc=com > TLS_CACERT /etc/openldap/cacerts/ca.crt > SSL ON > TLS_REQCERT demand Set 'TLS_REQCERT try' and check the commonName of the host certificate. SSL ON is not an openldap configuration parameter. The /etc/ldap.conf file is not a openldap client configuration file, but of nss_ldap. > /etc/ldap.conf file: > BASE dc=server,dc=com > URI ldap://ldap.server.com > SSL ON > TLS_CACERT /etc/openldap/cacert/ca.crt > TLS_REQCERT demand > > Any suggestion what cause TLS negotiation failure? -Dieter -- Dieter Klünter | Systemberatung http://dkluenter.de GPG Key ID:DA147B05 53°37'09,95"N 10°08'02,42"E

2 2

slapo-nssov and authz2dn
by btb＠bitrate.net 24 Oct '13

24 Oct '13

i'm experimenting with the authz2dn setting for olcnsspam: dn: olcOverlay={7}nssov,olcDatabase={2}mdb,cn=config objectClass: olcConfig objectClass: olcNssOvConfig objectClass: olcOverlayConfig olcOverlay: {7}nssov olcNssMap: group uniquemember member olcNssPam: authz2dn hostservice olcNssPamSession: login olcNssPamSession: sshd it seems to work, but only if i have no olcauthzregexp attributes, and i see no references to cn=<service>+uid=<user>,cn=<hostname>,cn=pam,cn=auth in the slapd log [using -d -1]. if i add an olcauthzregexp [for example: uid=([^,]*),cn=plain,cn=auth uid=$1,ou=people,ou=accounts,dc=example,dc=com, this seems to break nssov, and i'm unable to login [ssh], with pam denying me: Oct 19 19:55:23 dsa1 sshd[30458]: pam_ldap(sshd:account): nslcd authorisation; user=jdoe Oct 19 19:55:23 dsa1 sshd[30458]: pam_ldap(sshd:account): Access denied for this service; user=jdoe Oct 19 19:55:23 dsa1 sshd[30458]: fatal: Access denied for user jdoe by PAM account configuration [preauth] i don't understand why a seemingly unrelated olcauthzregexp is breaking this, but i'm also not confident i'm using authz2dn properly. man 5 slapo-nssov says "If no mapping is found for this authentication DN, then this mapping will be ignored.", but i don't think i understand that clearly. is that saying that failure to find a match via an olcauthzregexp mapping is not considered a failure to find a dn? if i remove authz2dn [and thus use uid2dn] then presence of the above olcauthzregexp value doesn't break nssov. when using -d -1, should i see references to cn=<service>+uid=<user>,cn=<hostname>,cn=pam,cn=auth? what am i doing wrong? thanks -ben

1 1

LDAP: error code 69 - structural object class modification
by Artur Nike 23 Oct '13

23 Oct '13

Good day, Can anyone know how to update the ldap objects in ver 2.4.31. I have an object: * dn: cn=crit3,ou=criteria,o=n1,dc=nodomain* * objectClass: top* * objectClass: n1criterion* * cn: crit3* * n1asn: 1004* * n1cc: US* * n1fqdn: nask.pl* * n1iprange: 4000,4004* * * *with def: * * attributetype ( 1.5.2.6.6.6.1 * * NAME 'n1asn' * * DESC 'number Autonomous System' * * SUP cn * * )* * * * attributetype ( 1.5.2.6.6.6.2 * * NAME 'n1cc' * * DESC 'country code' * * SUP cn * * )* * * * attributetype ( 1.5.2.6.6.6.3 * * NAME 'n1fqdn' * * DESC 'domain' * * SUP cn * * )* * * * attributetype ( 1.5.2.6.6.6.4 * * NAME 'n1iprange' * * DESC 'ip range' * * SUP cn * * )* * * * objectclass ( 1.5.2.6.6.7.1 * * NAME 'n1criterion' * * DESC 'criterion' * * SUP top * * STRUCTURAL * * MUST cn * * MAY ( n1asn $ n1cc $ n1fqdn $ n1iprange ) * * )* and I want to add another attribute, say n1yyy * attributetype ( 1.3.6.1.4.1.111111.99.7 * * NAME 'n1yyy' * * DESC 'vvvv' * * SUP n1cc * * )* * * * objectclass ( 1.3.6.1.4.1.111111.99.8 * * NAME 'n1CNEWcollect' * * DESC 'cvcxvcxvxc' * * SUP n1criterion * * STRUCTURAL * * MAY n1yyy * * )* So creating new atrubut, and class it uses, adding to the schema I want to add to the object dn, a new class, or replace existing it gets the error: * #!RESULT ERROR* * #!CONNECTION ldap://deb:389* * #!DATE 2013-10-23T10:14:34.751* * #!ERROR [LDAP: error code 69 - structural object class modification from 'n1criterion' to 'n1CNEWcollect' not allowed]* * dn: cn=crit3,ou=criteria,o=n1,dc=nodomain* * changetype: modify* * add: objectClass* * objectClass: n1CNEWcollect* * -* * * * #!RESULT ERROR* * #!CONNECTION ldap://deb:389* * #!DATE 2013-10-23T10:17:33.763* * #!ERROR [LDAP: error code 69 - structural object class modification from 'n1criterion' to 'n1CNEWcollect' not allowed]* * dn: cn=crit3,ou=criteria,o=n1,dc=nodomain* * changetype: modify* * add: n1yyy* * n1yyy: SS* * -* * add: objectClass* * objectClass: n1CNEWcollect* * -* * * * #!RESULT ERROR* * #!CONNECTION ldap://deb:389* * #!DATE 2013-10-23T10:18:15.412* * #!ERROR [LDAP: error code 69 - structural object class modification from 'n1criterion' to 'n1CNEWcollect' not allowed]* * dn: cn=crit3,ou=criteria,o=n1,dc=nodomain* * changetype: modify* * add: cn* * cn: dddd* * -* * add: objectClass* * objectClass: n1CNEWcollect* The only thing that works is: -export facility to ldif -swapping of a new class (which inherits old) -Remove the item from the tree, -add the ldif (with swapped class) Maybe I do not understand something, ask for help, how to expand objects Mariusz

2 1

OpenLDAP 2.3.4 TLS negotiation failure
by Tian Zhiying 23 Oct '13

23 Oct '13

Hi On the LDAP Server , I run following command is ok: #ldapsearch -x -H ldap://ldap.server.com -ZZ #ldapsearch -x -H ldap://ldap.server.com But on my client , I run "#ldapsearch -x -H ldap://ldap.server.com", is ok; Run "#ldapsearch -x -H ldap://ldap.server.com -ZZ" , I get the following error: [root@client cacerts]# ldapsearch -x -H ldap://ldap.server.com -ZZ ldap_start_tls: Connect error (-11) On LDAP Server log file, I get the following error messages: Oct 23 16:41:25 auth slapd[4213]: conn=206 fd=24 ACCEPT from IP=192.168.9.9:45648 (IP=0.0.0.0:389) Oct 23 16:41:25 auth slapd[4213]: conn=206 op=0 STARTTLS Oct 23 16:41:25 auth slapd[4213]: conn=206 op=0 RESULT oid= err=0 text= Oct 23 16:41:25 auth slapd[4213]: conn=206 fd=24 closed (TLS negotiation failure) My client ldap configuration: /etc/openldap/ldap.conf file: URI ldap://ldap.server.com/ BASE dc=server,dc=com TLS_CACERT /etc/openldap/cacerts/ca.crt SSL ON TLS_REQCERT demand /etc/ldap.conf file: BASE dc=server,dc=com URI ldap://ldap.server.com SSL ON TLS_CACERT /etc/openldap/cacert/ca.crt TLS_REQCERT demand Any suggestion what cause TLS negotiation failure? Thanks! Tian Zhiying

1 0

Pass-through authentication to Active Directory when using saslbind
by Jesus Jr M Salvo 22 Oct '13

22 Oct '13

Hi All, First off, I am a beginner with OpenLDAP, so please bear with me as I try to explain what I am trying to achieve. 1) There are 2 Active Directory servers that I need to connect to. Both of these are NOT under my control. We shall call them AD1 and AD2 here. 2) I can connect to AD1 via testsaslauthd using both simple bind and saslbind using DIGEST-MD5. 2a) For simple bind, I know of an adminstrative read-only account that I use to perform the initial LDAP bind request in order to allow an LDAP searchRequest to authenticate any user with AD1. Below is a sample /etc/saslauthd.conf ( ldap_bind_dn and ldap_bind_pw altered slightly to protect the identity ) ################################################################### #/etc/saslauthd.conf ldap_servers: ldap://172.21.128.49:3268 ldap_default_domain: ad1.priv ldap_search_base: DC=ad1,DC=priv ldap_bind_dn: CN=administrativero,OU=Service_Accounts,DC=ad1,DC=priv ldap_bind_pw: readonly ldap_deref: never ldap_restart: yes ldap_scope: sub ldap_use_sasl: no ldap_start_tls: no ldap_version: 3 ldap_auth_method: bind ldap_filter: sAMAccountName=%u ldap_password_attr: userPassword ldap_timeout: 10 ldap_cache_ttl: 30 ldap_cache_mem: 32768 ######################################################################### $ testsaslauthd -u salvojo -p mypassword 0: OK "Success." ... and what was captured by tshark ( I included port 53 for DNS queries as it was essential for finding out why digest-uri was only IP addresses instead of the hostname later on ): $ sudo tshark -i any port 3268 or port 53 or port 389 <...time elapsed .. snipped..> 81336.300597 172.21.17.193 -> 172.21.128.49 TCP 76 44477 > msft-gc [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 TSval=50014473 TSecr=0 WS=128 81336.301498 172.21.128.49 -> 172.21.17.193 TCP 80 msft-gc > 44477 [SYN, ACK] Seq=0 Ack=1 Win=64512 Len=0 MSS=1460 WS=1 TSval=0 TSecr=0 SACK_PERM=1 81336.301626 172.21.17.193 -> 172.21.128.49 TCP 68 44477 > msft-gc [ACK] Seq=1 Ack=1 Win=14720 Len=0 TSval=50014474 TSecr=0 81336.301840 172.21.17.193 -> 172.21.128.49 LDAP 141 bindRequest(1) "CN=administrativero,OU=Service_Accounts,DC=ad1,DC=priv" simple 81336.304464 172.21.128.49 -> 172.21.17.193 LDAP 90 bindResponse(1) success 81336.304559 172.21.17.193 -> 172.21.128.49 TCP 68 44477 > msft-gc [ACK] Seq=74 Ack=23 Win=14720 Len=0 TSval=50014474 TSecr=5446546 81336.304930 172.21.17.193 -> 172.21.128.49 LDAP 139 searchRequest(2) "DC=ad1,DC=priv" wholeSubtree 81336.305702 172.21.128.49 -> 172.21.17.193 LDAP 175 searchResEntry(2) "CN=John Salvo,OU=Users,OU=_Windows7 Pilot Group,DC=ad1,DC=priv" | searchResDone(2) success 81336.305972 172.21.17.193 -> 172.21.128.49 LDAP 154 bindRequest(3) "CN=John Salvo,OU=Users,OU=_Windows7 Pilot Group,DC=ad1,DC=priv" simple 81336.308982 172.21.128.49 -> 172.21.17.193 LDAP 90 bindResponse(3) success 81336.349661 172.21.17.193 -> 172.21.128.49 TCP 68 44477 > msft-gc [ACK] Seq=231 Ack=152 Win=14720 Len=0 TSval=50014486 TSecr=5446547 2b) For saslbind using DIGEST-MD5, I have no need for the administrative read-only account, as shown below by my /etc/saslauthd.conf: ( saslauthd was restarted in each case when saslauthd.conf was changed ) ################################################################### #/etc/saslauthd.conf ldap_servers: ldap://172.21.128.49:3268 ldap_deref: never ldap_restart: yes ldap_scope: sub ldap_use_sasl: yes ldap_mech: DIGEST-MD5 ldap_start_tls: no ldap_version: 3 ldap_timeout: 10 ldap_cache_ttl: 30 ldap_cache_mem: 32768 ######################################################################### $ testsaslauthd -u salvojo -p mypassword 0: OK "Success." $ sudo tshark -i any port 3268 or port 53 or port 389 <...time elapsed .. snipped..> 7.488292 172.21.17.193 -> 172.21.128.49 TCP 76 44478 > msft-gc [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 TSval=50082984 TSecr=0 WS=128 7.489163 172.21.128.49 -> 172.21.17.193 TCP 80 msft-gc > 44478 [SYN, ACK] Seq=0 Ack=1 Win=64512 Len=0 MSS=1460 WS=1 TSval=0 TSecr=0 SACK_PERM=1 7.489258 172.21.17.193 -> 172.21.128.49 TCP 68 44478 > msft-gc [ACK] Seq=1 Ack=1 Win=14720 Len=0 TSval=50082985 TSecr=0 7.489757 172.21.17.193 -> 172.21.10.24 DNS 88 Standard query PTR 49.128.21.172.in-addr.arpa 7.490577 172.21.10.24 -> 172.21.17.193 DNS 120 Standard query response PTR aassydc01.ad1.priv 7.492610 172.21.17.193 -> 172.21.128.49 LDAP 94 bindRequest(1) "<ROOT>" sasl 7.493828 172.21.128.49 -> 172.21.17.193 LDAP 326 bindResponse(1) saslBindInProgress 7.493928 172.21.17.193 -> 172.21.128.49 TCP 68 44478 > msft-gc [ACK] Seq=27 Ack=259 Win=15744 Len=0 TSval=50082986 TSecr=5449287 7.494828 172.21.17.193 -> 172.21.128.49 LDAP 442 bindRequest(2) "<ROOT>" sasl 7.498503 172.21.128.49 -> 172.21.17.193 LDAP 132 bindResponse(2) success 7.536572 172.21.17.193 -> 172.21.128.49 TCP 68 44478 > msft-gc [ACK] Seq=401 Ack=323 Win=15744 Len=0 TSval=50082997 TSecr=5449287 All good so far with simple bind and saslauthd to AD1. 3) I can only connect to AD2, the second active directory server, via testsaslauthd using only sasl bind. That is because I do not know of an adminstrative read-only account in AD2 that I can use to perform the initial LDAP bindRequest in order to allow an LDAP searchRequest. Here is the /etc/saslauthd.conf for saslbind to AD2: ################################################################### #/etc/saslauthd.conf # Your AD server adress # NOTE: This will only work IFF there is also a reverse DNS entry for this A record # Otherwise, the digest-uri in the LDAP SASL bind request will only contain the IP address instead of the hostname # which will result in "The digest-uri does not match any LDAP SPN's registered for this server" ldap_servers: ldap://ad2idcdc11.au.ad2.corp:3268 ldap_deref: never ldap_restart: yes ldap_scope: sub ldap_start_tls: no ldap_version: 3 ldap_use_sasl: yes ldap_mech: DIGEST-MD5 ldap_timeout: 10 ldap_cache_ttl: 30 ldap_cache_mem: 32768 #EOF ######################################################################### $ testsaslauthd -u anotheruser -p otherpassword 0: OK "Success." $ sudo tshark -i any port 3268 or port 53 or port 389 <...time elapsed .. snipped..> 321.883648 172.21.17.193 -> 10.3.90.55 TCP 76 49226 > msft-gc [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 TSval=50161583 TSecr=0 WS=128 321.884343 10.3.90.55 -> 172.21.17.193 TCP 80 msft-gc > 49226 [SYN, ACK] Seq=0 Ack=1 Win=16384 Len=0 MSS=1460 WS=1 TSval=0 TSecr=0 SACK_PERM=1 321.884541 172.21.17.193 -> 10.3.90.55 TCP 68 49226 > msft-gc [ACK] Seq=1 Ack=1 Win=14720 Len=0 TSval=50161583 TSecr=0 321.886323 172.21.17.193 -> 10.3.90.55 LDAP 94 bindRequest(1) "<ROOT>" sasl 321.887247 10.3.90.55 -> 172.21.17.193 LDAP 329 bindResponse(1) saslBindInProgress 321.887336 172.21.17.193 -> 10.3.90.55 TCP 68 49226 > msft-gc [ACK] Seq=27 Ack=262 Win=15744 Len=0 TSval=50161584 TSecr=65953794 321.888296 172.21.17.193 -> 10.3.90.55 LDAP 447 bindRequest(2) "<ROOT>" sasl 321.892567 10.3.90.55 -> 172.21.17.193 LDAP 132 bindResponse(2) success 321.933533 172.21.17.193 -> 10.3.90.55 TCP 68 49226 > msft-gc [ACK] Seq=406 Ack=326 Win=15744 Len=0 TSval=50161596 TSecr=65953794 4) I am using SASL because I currently have Subversion 1.8 configured to use SASL to authenticate users to AD1, but currently using simple bind. I will be changing this later on so that saslauthd will use sasl bind to AD1. $ cat /etc/sasl2/svn.conf pwcheck_method: saslauthd mech_list: PLAIN ----------------------------------------------------- Now here is what I am trying to achieve with OpenLDAP: I am using slapd.conf. I am also using the meta backend, as my instance of OpenLDAP will not really have its own LDAP database as I intended to use OpenLDAP for pass-through authentication. 5) I am able to use OpenLDAP as a proxy to AD1 for pass-through authentication via the meta backend, but only if OpenLDAP is configured to use simplebind to AD1. That is: testsaslauthd ( simple bind ) -> OpenLDAP ( simple bind ) -> AD1. Here is my /etc/ldap/slapd.conf: ######################################################################### include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel stats modulepath /usr/lib/ldap moduleload back_meta.so moduleload back_ldap.so sizelimit 500 tool-threads 1 backend meta database meta access to * by * read suffix "dc=ad1,dc=priv" uri ldap://172.21.128.49:3268/dc=ad1,dc=priv chase-referrals no lastmod off protocol-version 3 ######################################################################### .. and here is my /etc/saslauthd.conf for this specific test: ( The only difference between this and [2a] is the ldap_servers entry, which now points to OpenLDAP, and the ldap_filter, which now has an OR condition ) ################################################################### #/etc/saslauthd.conf # # Your AD server adress ldap_servers: ldap://127.0.0.1:389 ldap_default_domain: ad1.priv ldap_search_base: DC=ad1,DC=priv ldap_bind_dn: CN=administrativero,OU=Service_Accounts,DC=ad1,DC=priv ldap_bind_pw: readonly ldap_deref: never ldap_restart: yes ldap_scope: sub ldap_use_sasl: no ldap_start_tls: no ldap_version: 3 ldap_auth_method: bind ldap_filter: (|(uid=%U)(sAMAccountName=%U)) ldap_password_attr: userPassword ldap_timeout: 10 ldap_cache_ttl: 30 ldap_cache_mem: 32768 #EOF ######################################################################### $ testsaslauthd -u salvojo -p mypassword 0: OK "Success." $ sudo tshark -i any port 3268 or port 53 or port 389 <...time elapsed .. snipped..> 1310.330189 127.0.0.1 -> 127.0.0.1 TCP 76 50279 > ldap [SYN] Seq=0 Win=32792 Len=0 MSS=16396 SACK_PERM=1 TSval=50408695 TSecr=0 WS=128 1310.330234 127.0.0.1 -> 127.0.0.1 TCP 76 ldap > 50279 [SYN, ACK] Seq=0 Ack=1 Win=32768 Len=0 MSS=16396 SACK_PERM=1 TSval=50408695 TSecr=50408695 WS=128 1310.330262 127.0.0.1 -> 127.0.0.1 TCP 68 50279 > ldap [ACK] Seq=1 Ack=1 Win=32896 Len=0 TSval=50408695 TSecr=50408695 1310.330612 127.0.0.1 -> 127.0.0.1 LDAP 141 bindRequest(1) "CN=administrativero,OU=Service_Accounts,DC=ad1,DC=priv" simple 1310.330640 127.0.0.1 -> 127.0.0.1 TCP 68 ldap > 50279 [ACK] Seq=1 Ack=74 Win=32768 Len=0 TSval=50408695 TSecr=50408695 1310.331106 172.21.17.193 -> 172.21.128.49 TCP 76 44485 > msft-gc [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 TSval=50408695 TSecr=0 WS=128 1310.332041 172.21.128.49 -> 172.21.17.193 TCP 80 msft-gc > 44485 [SYN, ACK] Seq=0 Ack=1 Win=64512 Len=0 MSS=1460 WS=1 TSval=0 TSecr=0 SACK_PERM=1 1310.332129 172.21.17.193 -> 172.21.128.49 TCP 68 44485 > msft-gc [ACK] Seq=1 Ack=1 Win=14720 Len=0 TSval=50408695 TSecr=0 1310.332239 172.21.17.193 -> 172.21.128.49 LDAP 141 bindRequest(1) "cn=administrativero,ou=Service_Accounts,dc=ad1,dc=priv" simple 1310.335445 172.21.128.49 -> 172.21.17.193 LDAP 90 bindResponse(1) success 1310.335575 172.21.17.193 -> 172.21.128.49 TCP 68 44485 > msft-gc [ACK] Seq=74 Ack=23 Win=14720 Len=0 TSval=50408696 TSecr=5462316 1310.336554 127.0.0.1 -> 127.0.0.1 LDAP 82 bindResponse(1) success 1310.336634 127.0.0.1 -> 127.0.0.1 TCP 68 50279 > ldap [ACK] Seq=74 Ack=15 Win=32896 Len=0 TSval=50408697 TSecr=50408697 1310.336863 127.0.0.1 -> 127.0.0.1 LDAP 157 searchRequest(2) "DC=ad1,DC=priv" wholeSubtree 1310.337809 172.21.17.193 -> 172.21.128.49 LDAP 157 searchRequest(2) "dc=ad1,dc=priv" wholeSubtree 1310.339277 172.21.128.49 -> 172.21.17.193 LDAP 175 searchResEntry(2) "CN=John Salvo,OU=Users,OU=_Windows7 Pilot Group,DC=ad1,DC=priv" | searchResDone(2) success 1310.339581 127.0.0.1 -> 127.0.0.1 LDAP 141 searchResEntry(2) "cn=John Salvo,ou=Users,ou=_Windows7 Pilot Group,dc=ad1,dc=priv" 1310.339871 127.0.0.1 -> 127.0.0.1 LDAP 82 searchResDone(2) success 1310.339966 127.0.0.1 -> 127.0.0.1 TCP 68 50279 > ldap [ACK] Seq=163 Ack=102 Win=32896 Len=0 TSval=50408697 TSecr=50408697 1310.340053 127.0.0.1 -> 127.0.0.1 LDAP 154 bindRequest(3) "cn=John Salvo,ou=Users,ou=_Windows7 Pilot Group,dc=ad1,dc=priv" simple 1310.340698 172.21.17.193 -> 172.21.128.49 TCP 76 44486 > msft-gc [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 TSval=50408698 TSecr=0 WS=128 1310.341883 172.21.128.49 -> 172.21.17.193 TCP 80 msft-gc > 44486 [SYN, ACK] Seq=0 Ack=1 Win=64512 Len=0 MSS=1460 WS=1 TSval=0 TSecr=0 SACK_PERM=1 1310.341977 172.21.17.193 -> 172.21.128.49 TCP 68 44486 > msft-gc [ACK] Seq=1 Ack=1 Win=14720 Len=0 TSval=50408698 TSecr=0 1310.342157 172.21.17.193 -> 172.21.128.49 LDAP 154 bindRequest(1) "cn=John Salvo,ou=Users,ou=_Windows7 Pilot Group,dc=ad1,dc=priv" simple 1310.345643 172.21.128.49 -> 172.21.17.193 LDAP 90 bindResponse(1) success 1310.345733 172.21.17.193 -> 172.21.128.49 TCP 68 44486 > msft-gc [ACK] Seq=87 Ack=23 Win=14720 Len=0 TSval=50408699 TSecr=5462316 1310.346198 127.0.0.1 -> 127.0.0.1 LDAP 82 bindResponse(3) success 1310.377558 172.21.17.193 -> 172.21.128.49 TCP 68 44485 > msft-gc [ACK] Seq=163 Ack=130 Win=14720 Len=0 TSval=50408707 TSecr=5462316 1310.384549 127.0.0.1 -> 127.0.0.1 TCP 68 50279 > ldap [ACK] Seq=249 Ack=116 Win=32896 Len=0 TSval=50408709 TSecr=50408699 You can see from the above that: * The initial administrative simple bind to OpenLDAP was delegated by OpenLDAP to AD1. * The searchRequest to OpenLDAp was delegated by OpenLDAP to AD1. * The second bindRequest ( that is authenticating the user that I specified with testsaslauthd ) to OpenLDAP was delegated by OpenLDAP to AD1. That is, on all 3 cases above, OpenLDAP only returned success back to testsaslauthd only if AD1 only returned success. So far so good. 6) I am unable to use ... or rather confused on how to use .. OpenLDAP as a proxy to AD1 so that OpenLDAP will use sasl bind to AD1. This is where I am stuck. Here is my /etc/saslauthd.conf for this test: The only difference between this and saslauthd.conf in [2b] is the ldap_servers entry, which is now pointing to OpenLDAP. ################################################################### #/etc/saslauthd.conf # # Your AD server adress ldap_servers: ldap://127.0.0.1:389 ldap_deref: never ldap_restart: yes ldap_scope: sub ldap_use_sasl: yes ldap_mech: DIGEST-MD5 ldap_start_tls: no ldap_version: 3 ldap_timeout: 10 ldap_cache_ttl: 30 ldap_cache_mem: 32768 #EOF ######################################################################### Here is my /etc/ldap/slapd.conf for this test: ( The only difference between this file and the slapd.conf file in [5] is the addition of the idassert-bind line ) ######################################################################### include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel stats modulepath /usr/lib/ldap moduleload back_meta.so moduleload back_ldap.so sizelimit 500 tool-threads 1 backend meta database meta access to * by * read suffix "dc=ad1,dc=priv" uri ldap://172.21.128.49:3268/dc=ad1,dc=priv chase-referrals no lastmod off protocol-version 3 idassert-bind bindmethod=sasl saslmech=DIGEST-MD5 mode=none ######################################################################### $ testsaslauthd -u salvojo -p mypassword 0: NO "authentication failed" $ sudo tshark -i any port 3268 or port 53 or port 389 <...time elapsed .. snipped..> 401.111261 127.0.0.1 -> 127.0.0.1 TCP 76 50299 > ldap [SYN] Seq=0 Win=32792 Len=0 MSS=16396 SACK_PERM=1 TSval=51388330 TSecr=0 WS=128 401.111304 127.0.0.1 -> 127.0.0.1 TCP 76 ldap > 50299 [SYN, ACK] Seq=0 Ack=1 Win=32768 Len=0 MSS=16396 SACK_PERM=1 TSval=51388330 TSecr=51388330 WS=128 401.111332 127.0.0.1 -> 127.0.0.1 TCP 68 50299 > ldap [ACK] Seq=1 Ack=1 Win=32896 Len=0 TSval=51388330 TSecr=51388330 401.113332 127.0.0.1 -> 127.0.0.1 LDAP 94 bindRequest(1) "<ROOT>" sasl 401.113419 127.0.0.1 -> 127.0.0.1 TCP 68 ldap > 50299 [ACK] Seq=1 Ack=27 Win=32768 Len=0 TSval=51388330 TSecr=51388330 401.113806 127.0.0.1 -> 127.0.0.1 LDAP 304 bindResponse(1) saslBindInProgress (SASL(0): successful result: ) 401.114023 127.0.0.1 -> 127.0.0.1 TCP 68 50299 > ldap [ACK] Seq=27 Ack=237 Win=32768 Len=0 TSval=51388331 TSecr=51388330 401.114362 127.0.0.1 -> 127.0.0.1 LDAP 393 bindRequest(2) "<ROOT>" sasl 401.114671 127.0.0.1 -> 127.0.0.1 LDAP 130 bindResponse(2) invalidCredentials (SASL(-13): user not found: no secret in database) 401.153939 127.0.0.1 -> 127.0.0.1 TCP 68 50299 > ldap [ACK] Seq=352 Ack=299 Win=32768 Len=0 TSval=51388341 TSecr=51388331 As you can see from the above tshark, OpenLDAP did not even try to communicate at all to AD1 ! What should I have in slapd.conf ? Maybe the problem is that, I am using testsaslauthd, which uses saslauthd to connect to OpenLDAP, but also need OpenLDAP to use saslauthd to AD1 ( e.g. It is using the same saslauthd daemon ) ? I also read about at ( Section 14.5 ): http://www.openldap.org/doc/admin24/security.html ... about setting the userPassword attribute to something of the form: userPassword: {SASL}user@realm ... but: *) I am using a meta backend, and thus I have no internal users, so I cannot set the userPassword attribute .... or is this saying that I need a "copy" of the DN name of the users from AD1 to my local OpenLDAP ? It also says: "Since OpenLDAP 2.0 slapd has had the ability to delegate password verification to a separate **PROCESS** ( emphasis mine ). This uses the sasl_checkpass(3) function so it can use any back-end server that Cyrus SASL supports for checking passwords." .. but: *) How was OpenLDAP able to delegate password verification in the simple-bind proxy as I have demonstrated above WITHOUT going through a separate proccess but going straight through a TCP/IP connection ? *) Is the statement saying that OpenLDAP will use saslauthd to connect to a remote LDAP/AD ? If so, since I am using testsaslauthd and I am already using saslauthd to connect to OpenLDAP, and saslauthd.conf is configured to point to the local OpenLDAP, does this mean I need another instance of saslauthd with its own unix socket and its own saslauthd.conf ? If so, what's the point of having the uri in slapd.conf when the separate instance of saslauthd.conf will have its own entry of the remote ldap / AD1 anyway ? Anyway, as you can see .. I am confused on how to do item [6] above. All I really need to happen is ( from a tcp capture / wireshark perspective ), something like ( similar to the simple bind PTA ): 127.0.0.1 -> 127.0.0.1 TCP 76 44478 > msft-gc [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 TSval=50082984 TSecr=0 WS=128 127.0.0.1 -> 127.0.0.1 TCP 80 msft-gc > 44478 [SYN, ACK] Seq=0 Ack=1 Win=64512 Len=0 MSS=1460 WS=1 TSval=0 TSecr=0 SACK_PERM=1 127.0.0.1 -> 127.0.0.1 TCP 68 44478 > msft-gc [ACK] Seq=1 Ack=1 Win=14720 Len=0 TSval=50082985 TSecr=0 127.0.0.1 -> 127.0.0.1 LDAP 94 bindRequest(1) "<ROOT>" sasl 172.21.17.193 -> 172.21.128.49 TCP 76 44478 > msft-gc [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 TSval=50082984 TSecr=0 WS=128 172.21.128.49 -> 172.21.17.193 TCP 80 msft-gc > 44478 [SYN, ACK] Seq=0 Ack=1 Win=64512 Len=0 MSS=1460 WS=1 TSval=0 TSecr=0 SACK_PERM=1 172.21.17.193 -> 172.21.128.49 TCP 68 44478 > msft-gc [ACK] Seq=1 Ack=1 Win=14720 Len=0 TSval=50082985 TSecr=0 172.21.17.193 -> 172.21.128.49 LDAP 94 bindRequest(1) "<ROOT>" sasl 172.21.128.49 -> 172.21.17.193 LDAP 326 bindResponse(1) saslBindInProgress 172.21.17.193 -> 172.21.128.49 TCP 68 44478 > msft-gc [ACK] Seq=27 Ack=259 Win=15744 Len=0 TSval=50082986 TSecr=5449287 127.0.0.1 -> 127.0.0.1 LDAP 326 bindResponse(1) saslBindInProgress 127.0.0.1 -> 127.0.0.1 TCP 68 44478 > msft-gc [ACK] Seq=27 Ack=259 Win=15744 Len=0 TSval=50082986 TSecr=5449287 127.0.0.1 -> 127.0.0.1 LDAP 442 bindRequest(2) "<ROOT>" sasl 172.21.17.193 -> 172.21.128.49 LDAP 442 bindRequest(2) "<ROOT>" sasl 172.21.128.49 -> 172.21.17.193 LDAP 132 bindResponse(2) success 172.21.17.193 -> 172.21.128.49 TCP 68 44478 > msft-gc [ACK] Seq=401 Ack=323 Win=15744 Len=0 TSval=50082997 TSecr=5449287 127.0.0.1 -> 127.0.0.1 LDAP 132 bindResponse(2) success 127.0.0.1 -> 127.0.0.1 TCP 68 44478 > msft-gc [ACK] Seq=401 Ack=323 Win=15744 Len=0 TSval=50082997 TSecr=5449287 7) If I can find out how to do item [6] above with help from this list, then I will try to do the same for AD2. 8) The end goal therefore is to use OpenLDAP as a dumb proxy that will authenticate users to either AD1 or AD2. Any help / hints appreciated, Jesus Salvo

3 5

Subject Alternative Name in TLS - does this work?
by lejeczek 21 Oct '13

21 Oct '13

dear all I'm trying to set a seeminglysimple setup having a box with openldap I want it to use TLS on both internal and external hostnames/IPs openldap was set up earlier and was/is working I generate TLS certificate with SAN everything seems working fine but when I ldapsearch on external fqdn/IP (which in the certificate is the subjectAltName) search fails whereas it succeeds on internal fqdn(which is the hostname/ CN in the certificate) error is: additional info: TLS error -8157:Certificate extension not found. is such a scenario even possible? having very same DN being served on more than one name via TLS? best wishes

9 20

prevent mail loops using constraint overlay
by Ole 21 Oct '13

21 Oct '13

Hi, some user always try to build mail loops, creating a mailForwadingAddress attribute with the value of one of their mail attribute. according to the manpage SLAPO-CONSTRAINT(5): [...] constraint_attribute cn,sn,givenName set "(this/givenName + [ ] + this/sn) & this/cn" [...] it requires the values of the attribute cn to be constructed by pairing values of the attributes sn and givenName, separated by a space, [...] I understand the syntax of the constraint overlay in that way, that the expression after the "set" command has to be true. But if I try to use constraint_attribute mail,mailForwardingAddress set "this/mail | this/mailForwardingAddress" it takes no effect. It should require that there can be a attribute mail with value X OR a value mailForwardingAddress with value X. Is it not valid to use the | operator? Regards Ole

1 0

Updated scheme
by Artur Nike 21 Oct '13

21 Oct '13

Hi all , I have a question. How as the most updated schema file (dynamic) and all objects in the ldif file in. in OpenLDAP 2.4.31. Let's say I have a scheme with its own defined attributes and classes and after a while you need to add an attribute and for example, change the class. How to upload an updated scheme under the same name and do not change the names of the updated attributes and classes. Now Loading a revised scheme under a new name and change the object definitions in the ldif. Can anyone have any suggestions or experience with this problem. For all thank you in advance. Mariusz

1 0

ACL with val.regex expression
by Mark Dieterich 18 Oct '13

18 Oct '13

Hi all, I'm banging my head against a wall trying to get one particular ACL setup. We want our users, with the exception of those that have a restricted shell, to be able to change their own shell values. A typical user looks like: dn: uid=user,ou=people,dc=cs,dc=brown,dc=edu objectClass: top objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount objectClass: krb5Principal objectClass: sambaSamAccount objectClass: ownCloudUser objectClass: mailUser ... loginShell: /bin/bash We'd ideally like to have an ACL in place that looks like: access to dn.subtree="ou=people,dc=cs,dc=brown,dc=edu" attrs=loginShell val.regex="/bin/[^f][^s][^h]" by ssf=128 self write by * read The idea being that a user with a loginShell value of /bin/fsh would NOT be allowed to change their shell value. However, with this rule in place, no user is able to change their shell value. Even if I change the rule to be: access to dn.subtree="ou=people,dc=cs,dc=brown,dc=edu" attrs=loginShell val.exact="/bin/bash" by ssf=128 self write by * read users with loginShell of /bin/bash still can't change their own values. If I drop the val.<type>="<whatever>" restriction, users can change their shell values just fine. This the first time I've ever used and ACL with a val.<type>= restriction, but I've scoured the internet and I can't for the life of me figure out what I'm doing wrong. I'm happy to have someone here give me a dope slap... I'm just tired of the headaches ;) Thanks! Mark

5 14

Need to Create Default Printer Entries
by Michael C. Ibarra 18 Oct '13

18 Oct '13

Greetings; I’ve recently built a new LDAP infrastructure, migrated from NIS. Under NIS, I had a map, “printers”, which I used to query with “ypcat printers.byname|grep username”. I need to setup default printers for several applications, and making them centrally available, and configurable, is a must for me. The issue I am facing is that my users, now listed under people, have no place to add a default printer; although there is an “allowed attribute” for “host”, which right now for me goes unused. What I would like to do is to create a new database in my DIT, call it say defaultPrinters, which contains left side username, right side printer; i.e.: smitha hp001 joner hp002 carsont hp001 Additionally, I would like to be able to add an allowable attribute under People, named defaultPrinters, which points to the database that I am trying to create. Thanks in advance. -mi

3 3

Does MDB backend shrinks on disk files after delete operation?
by Igor Zinovik 17 Oct '13

17 Oct '13

Hello. I would like to understand one thing about mdb backend: Current size of /var/lib/ldap is 15 megabytes (~ 10000 entries). After i added to my database 1839 entries on disk directory size becomes 93 megabytes. But when i delete all 1839 entires mdb does not free disk space, my /var/lib/ldap is still 93 megabytes in size. It does not remove data and just marks it as 'free' meaning that it is reusable for new write operations? I use mdb from openldap 2.4.33

2 3

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical