- openldap-technical - openldap.org

Berkeley DB backend - exact version check
by Jan Synacek 17 Oct '13

17 Oct '13

Hello, slapd checks the exact version of BDB at runtime and fails if it doesn't equal to the version that it's been linked against. Is there a reason for such precise check? Shouldn't the major and minor version numbers be enough? The code seems to have been there for a while, so I'm sorry if such question has been asked before. I couldn't find any answers. Thank you, -- Jan Synacek Software Engineer, Red Hat

2 2

bind-dyndb-ldap
by Brendan Kearney 17 Oct '13

17 Oct '13

i am trying to setup BIND to use LDAP as the zone data repository, using bind-dyndb-ldap and continue to run into issues. i am not sure what this error message means, but it seems to be part of the problem. i see that the bind attempt succeeds and that a search is attempted. but, when the search is attempted, a critical piece of the puzzle is missing and an extension is not recognized. indexing will be done once i get the rest of this working... 2013-10-15T19:10:16.980653-04:00 test slapd[12675]: conn=1057 fd=11 ACCEPT from IP=127.0.0.1:57849 (IP=0.0.0.0:389) 2013-10-15T19:10:16.980675-04:00 test slapd[12675]: conn=1057 op=0 BIND dn="cn=Manager,dc=my-domain,dc=com" method=128 2013-10-15T19:10:16.980680-04:00 test slapd[12675]: conn=1057 op=0 BIND dn="cn=Manager,dc=my-domain,dc=com" mech=SIMPLE ssf=0 2013-10-15T19:10:16.980683-04:00 test slapd[12675]: conn=1057 op=0 RESULT tag=97 err=0 text= 2013-10-15T19:10:16.982325-04:00 test slapd[12675]: conn=1058 fd=17 ACCEPT from IP=127.0.0.1:57850 (IP=0.0.0.0:389) 2013-10-15T19:10:16.983442-04:00 test slapd[12675]: conn=1058 op=0 BIND dn="cn=Manager,dc=my-domain,dc=com" method=128 2013-10-15T19:10:16.983456-04:00 test slapd[12675]: conn=1058 op=0 BIND dn="cn=Manager,dc=my-domain,dc=com" mech=SIMPLE ssf=0 2013-10-15T19:10:16.983459-04:00 test slapd[12675]: conn=1058 op=0 RESULT tag=97 err=0 text= 2013-10-15T19:10:16.990216-04:00 test slapd[12675]: conn=1057 op=1 SEARCH RESULT tag=101 err=12 nentries=0 text=critical extension is not recognized 2013-10-15T19:10:16.990883-04:00 test slapd[12675]: conn=1057 op=1 do_search: get_ctrls failed 2013-10-15T19:10:16.991177-04:00 test slapd[12675]: conn=1058 op=1 SRCH base="cn=dns,dc=my-domain,dc=com" scope=2 deref=0 filter="(&(idnsZoneActive=TRUE)(|(objectClass=idnsZone)(objectClass=idnsForwardZone)))" 2013-10-15T19:10:16.991468-04:00 test slapd[12675]: conn=1058 op=1 SRCH attr=idnsName idnsUpdatePolicy idnsAllowQuery idnsAllowTransfer idnsForwardPolicy idnsForwarders idnsAllowDynUpdate idnsAllowSyncPTR objectClass 2013-10-15T19:10:16.991740-04:00 test slapd[12675]: <= bdb_equality_candidates: (idnsZoneActive) not indexed 2013-10-15T19:10:16.992025-04:00 test slapd[12675]: conn=1058 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= i know that the schema for dyn-dns is loaded and all the objectClasses and attributeTypes are available. the problem i run into is an A Record that should be in the zone data cannot be queried out of the BIND instance that is talking to LDAP. [root@test conf.d]# nslookup foo.my-domain.com. localhost ;; Got SERVFAIL reply from 127.0.0.1, trying next server ;; Got SERVFAIL reply from 127.0.0.1, trying next server Server: localhost Address: 127.0.0.1#53 ** server can't find foo.my-domain.com: SERVFAIL i am using: bind - 9.9.3 bind-dyndb-ldap - 3.5 openldap 2.4.36 on Fedora 19 (yes, it is the distro packaged version). Can anyone give me some pointers on how to get this working?

1 1

temporarily removing a group object in SLES11
by Ulrich Windl 16 Oct '13

16 Oct '13

Hi! I realized that in SLES11 SP2 the YaST user management module does recreate a group (instead of modifying it) when you add a user to the particular group. I wonder what the consequences could be (despite of the unnecessary deltas being created). Did anybody else notice this, or even had some negative experience caused by that, escpecially for groups with many members? Regards, Ulrich

2 3

Q: access rights for shadowAccount attributes
by Ulrich Windl 16 Oct '13

16 Oct '13

Hi! I wonder what the minimum required access rights for the attributes of shadowAccount are: Should they be protected the same way the password is? At the moment an anonymous bind can read them (i.e. no special access rules present). Regards, Ulrich

2 1

Need help with replica
by Jacques Foucry 15 Oct '13

15 Oct '13

Hello list, I created a VM to test ppolicy migration and replication. On my master server some user (like mine) are "bind" to ppolicy: I have a OU policies dn: cn=default,ou=policies,dc=example,dc=com cn: default objectclass: top objectclass: device objectclass: pwdPolicy objectclass: pwdPolicyChecker pwdallowuserchange: TRUE pwdattribute: userPassword pwdcheckmodule: mmc-check-password.so pwdcheckquality: 0 pwdexpirewarning: 600 pwdfailurecountinterval: 0 pwdgraceauthnlimit: 5 pwdinhistory: 5 pwdlockout: TRUE pwdlockoutduration: 0 pwdmaxage: 7776000 pwdmaxfailure: 5 pwdminlength: 8 pwdmustchange: TRUE pwdsafemodify: FALSE And my user: dn: cn=Jacques Foucry,ou=People,dc=example,dc=com c: France cn: Jacques Foucry gidnumber: 1000 givenname: Jacques homedirectory: /home/jfoucry loginshell: /bin/zsh mail: jacques.foucry(a)example.com objectclass: inetOrgPerson objectclass: mozillaAbPersonAlpha objectclass: sambaSamAccount objectclass: posixAccount objectclass: top objectclass: shadowAccount objectclass: pwdPolicy ou: RT_Users postalcode: 75009 pwdattribute: userPassword sambaacctflags: [U] shadowlastchange: 15987 shadowmax: 120 shadowmin: 7 shadowwarning: 7 sn: Foucry uid: jfoucry uidnumber: 1010 userpassword: --password-- On the replica mv. I created a slapd.conf file (I cannot understand the "new" syntax). include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/mozillaAbPersonAlpha.schema include /etc/ldap/schema/samba.schema include /etc/ldap/schema/pureftpd.schema include /etc/ldap/schema/ppolicy.schema pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args loglevel config sync modulepath /usr/lib/ldap moduleload back_hdb database hdb suffix "dc=example,dc=com" rootdn "cn=admin,dc=example,dc=com" rootpw {SSHA}--password-- directory /var/lib/ldap referral ldaps://192.168.72.13 syncrepl rid=020 provider=ldaps://192.168.72.13 type=refreshOnly interval=00:08:00:00 retry="60 10 300 +" filter="(objectClass=*)" scope=sub attrs="*" bindmethod=simple schemachecking=off searchbase="dc=exmaple,dc=com" binddn="cn=syncuser,dc=exmaple,dc=com" credentials=--password-- tls_reqcert=never When I start slapd on the slave vm, It sound correct but only few off my user records are sync. For example mine is not. One the master: # ldapsearch -x -b"ou=people,dc=example,dc=com" uid=jfoucry # extended LDIF # # LDAPv3 # base <ou=people,dc=example,dc=com> with scope subtree # filter: uid=jfoucry # requesting: ALL # # Jacques Foucry, People, example.com dn: cn=Jacques Foucry,ou=People,dc=example,dc=com c: France cn: Jacques Foucry mail: jacques.foucry(a)example.com gidNumber: 1000 givenName: Jacques homeDirectory: /home/jfoucry loginShell: /bin/zsh ou: RT_Users postalCode: 75009 shadowMax: 120 shadowMin: 7 shadowWarning: 7 sn: Foucry uidNumber: 1010 uid: jfoucry objectClass: inetOrgPerson objectClass: mozillaAbPersonAlpha objectClass: sambaSamAccount objectClass: posixAccount objectClass: top objectClass: shadowAccount objectClass: pwdPolicy pwdAttribute: userPassword shadowLastChange: 15987 # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 On the slave: ldapsearch -x -b"ou=people,dc=exmaple,dc=com" uid=jfoucry # extended LDIF # # LDAPv3 # base <ou=people,dc=example,dc=com> with scope subtree # filter: uid=jfoucry # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 I can't figure what's wrong. Why some records are sync and other are not? Is it because of ppolicy? Thanks in advance for your help, Jacques Foucry -- Jacques Foucry *NOVΛSPARKS * IT Manager Tel : +33 (0)1 42 68 12 61 jacques.foucry(a)novasparks.com

2 1

remove unused schema from cn=config in n-way multi-master setup
by Igor Zinovik 15 Oct '13

15 Oct '13

Hello, opeldap-technical@ readers. I have a 3 nodes n-way multi-master setup configured accroding to OpenLDAP Admin Guide. Currently my catalog configuration stores custom schema which I made some time ago, but it no longer needed, so I would like to delete my custom schema from configuration. Replication is bothering me the most. I understand that consequences would be unexpectable when one of my server will see that other node is telling him to delete cn={14}example,cn=schema,cn=config. So my main question is how to correctly disable replication in n-way multi-master setup? Objects that are stored in catalog do not use attributes or object classes that are defined in custom schema. In my setup write operations are directed only to single node of a cluster. I would like to ask for advice about my deletion plan. 0. Make backup of current cn=config and data 1. Disable replication via deletion olcServerID in cn=config and setting olcMirrorMode to FALSE 2. Direct write operations to third node 3. Stop slapd instance on first node 4. Edit configuration (remove custom schema from file, renumber siblings in cn=schema,cn=config) 5. Load new configuration into /etc/openldap/slapd.d 6. Start slapd instance on first node 7. Check that schema is absent in cn=config on first node 8. Repeat steps from 3-7 on second node 9. Direct write operations to first node 10. Repeat steps from 3-7 on third node 11. Turn on replication in cluster If it matters i use OpenLDAP 2.4.33 (x86_64).

3 3

Multiple CSN use
by Emmanuel BILLOT 13 Oct '13

13 Oct '13

Hi, I read a thread about multiple CSN. If a server have to replicate multiple parts from several servers, it must have multiplace CSN. Now we use multiple database for having multiple CSN (one subordinate per remote server), but this thread seems to talk about multiple CSN using with one database. What should be a simple conf example to use multiple CSN values ? I didn't find any doc about using multiple CSN with "correctly used SIDs". http://www.openldap.org/lists/openldap-technical/201011/msg00153.html "But the SIDs will only be used correctly if the URLs in the ServerID directive match the actual URLs given to the slapd -h option." Regards,

2 1

contextCSN format
by Emmanuel BILLOT 13 Oct '13

13 Oct '13

Hi, When using refreshonly replication, i cannot see any rid or sid info on the consumer contextCSN Oct 13 21:39:24 seshat-test slapd[5053]: do_syncrep2: cookie=rid=003,sid=003,csn=20131013024923.410481Z#000000#000#000000 Oct 13 21:39:24 seshat-test slapd[5053]: slap_queue_csn: queing 0x8765080 20131013024923.410481Z#000000#000#000000 Oct 13 21:39:24 seshat-test slapd[5053]: slap_graduate_commit_csn: removing 0x8761170 20131013024923.410481Z#000000#000#000000 Whereas ServerID is set on provider. What could explain this ?

1 0

memberof overlay results in unexpected slapd death?
by Paul B. Henson 12 Oct '13

12 Oct '13

Our LDAP infrastructure is currently running 2.4.35, and consists of two read/write masters configured in mirror mode behind the load balancer, with three additional read-only slaves using syncrepl. We recently decided to add the memberof overlay to our configuration, due to an application that did not support querying the groups for members. I updated our configuration to load the module, and add the overlay, and proceeded to rip through all of our groups removing and then re-adding the members in order to populate the memberOf attribute on the user objects. While doing so, there were errors logged on all of the servers: Oct 10 04:26:09 fosse slapd[9944]: conn=75373 op=184748: memberof_value_modify DN="uid=tdnguyen1,ou=user,dc=cs upomona,dc=edu" delete memberOf="uid=classes,ou=group,dc=csupomona,dc=edu" failed err=16 This was expected, as the memberOf attribute did not exist in our current directory. However, what was unexpected was that the slapd processes started to mysteriously die while I was trying to repopulate the groups. No log messages, or any other indication of the failure, just attribute delete errors: Oct 10 04:29:39 filmore slapd[25526]: conn=-1 op=0: memberof_value_modify DN="uid=rfu,ou=user,dc=csupomona,dc=edu" delete memberOf="uid=mhr31806,ou=group,dc=csupomona,dc=edu" failed err=16 Oct 10 04:29:39 filmore slapd[25526]: conn=-1 op=0: memberof_value_modify DN="uid=rfu,ou=user,dc=csupomona,dc=edu" delete memberOf="uid=mhr_classes,ou=group,dc=csupomona,dc=edu" failed err=16 Then the process was gone. It was definitely related to mass group updates, they would run for hours with no problems under general use, but as soon as I started churning group members, bam, one or two of them would go away. I ended up backing out the modification, dumping the database, removing all of the memberOf attributes, and reloading it. I will try to duplicate this in a test environment with debugging enabled and see if I can get a better idea what's going on, but I was just curious if anyone had seen anything like this or knew of any underlying issues with the memberof overlay. Thanks much.

3 6

mysterious glue record with empty dn
by Paul B. Henson 12 Oct '13

12 Oct '13

While I was trying to recover my directory from an aborted attempt to implement the memberof overlay, I ended up dumping the database with slapcat and then reloading it with slapadd after removing the now invalid MEMBEROF attributes that lingered after the overlay was disabled. Strangely, on some of my servers, a glue object with an empty DN showed up in the slapcat output: dn: objectClass: glue structuralObjectClass: glue entryUUID: 411f0301-e857-4228-a22d-c5d1451d4496 creatorsName: cn=ldaproot,dc=csupomona,dc=edu createTimestamp: 20131007210011Z entryCSN: 20131007210011.273579Z#000000#000#000000 modifyTimestamp: 20131007210011Z modifiersName: cn=idmgmt,ou=user,ou=service,dc=csupomona,dc=edu slapadd refused to load the input file with this record at the top, I ended up deleting it and then it seemed to load fine. I'm not sure where this record came from? From what I could research, it seems glue records are created when you delete part of the hierarchy that is in between the top and some lower record? I don't think I did that, plus I don't see why it would have an empty DN? This must have something to do with my attempt to implement the memberof overlay, as I have never seen it before. Any thoughts? Thanks.

2 2

memberof overlay replicating memberOf attribute?
by Paul B. Henson 12 Oct '13

12 Oct '13

Based on the documentation, my understanding was that the memberof overlay maintained the memberOf attribute locally, and this attribute was not replicated? While I was recently working on implementing the memberof overlay, I noticed that after I had enabled it on one server, before enabling it on another, the memberOf attribute seemed to be replicated from the server on which the overlay was enabled to the one on which it was not: Oct 7 18:30:18 filmore slapd[28994]: UNKNOWN attributeDescription "MEMBEROF" inserted. Oct 7 18:30:18 fosse slapd[3047]: UNKNOWN attributeDescription "MEMBEROF" inserted. Oct 10 16:23:08 pip-dev slapd[7030]: slapd starting Oct 10 16:23:08 pip-dev slapd[7030]: UNKNOWN attributeDescription "MEMBEROF" inserted. This seems contrary to the documentation and I found it confusing. Am I missing something? Thanks.

2 2

unixUserPassword and userPassword
by jupiter 12 Oct '13

12 Oct '13

Hi, I am migrating user account entries from an old openldap AD to openldap BDB. Both LDAP client authentications are implemented in Linux, the former in CentOS 5, and the latter in CentOS 6. But the major problem is that the old openldap AD uses encrypted password in "unixUserPassword:" while the openldap BDB uses base64 "userPassword::". The option for solution I could think of are: (a) Convert the encrypted password from unixUserPassword format to userPasswor, then I can use ldapmodify to change userPassword. Is it possible? If it is, appreciate more details. (b) Change LDAP client authentication to use unixUserPassword. I haven't found any document to configure Linux client authentication to use unixUserPassword. In fact, I could not find any document regarding details of uing unixUserPassword. Any suggestions, tips and advice are very much appreciated. Thank you. Kind regards, jupiter Sorry for asking a non-dev question, but I could not find any solution from openldap document, nor from Internet searching. Thank you and appreciate any advice. Kind regards, jupiter

2 4

sasl/plain with hashed password not working
by btb 11 Oct '13

11 Oct '13

i've enabled the plain sasl mech, and testing with ldapwhoami works, but only if the userpassword is left as plaintext. if hashing [ssha] is used, it fails. a simple bind succeeds. what am i doing wrong? >ldapwhoami -H 'ldap://dsa4.example.com/' -Y 'plain' -U 'flash' -w 'xxxxxxxx' SASL/PLAIN authentication started ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: SASL(-13): user not found: Password verification failed 524b7989 daemon: activity on 1 descriptor 524b7989 daemon: activity on:524b7989 524b7989 slap_listener_activate(7): 524b7989 daemon: epoll: listen=7 busy 524b7989 daemon: epoll: listen=8 active_threads=0 tvp=NULL 524b7989 >>> slap_listener(ldap:///) 524b7989 daemon: activity on 1 descriptor 524b7989 daemon: activity on:524b7989 524b7989 daemon: epoll: listen=7 active_threads=0 tvp=NULL 524b7989 daemon: epoll: listen=8 active_threads=0 tvp=NULL 524b7989 daemon: listen=7, new connection on 16 524b7989 daemon: added 16r (active) listener=(nil) 524b7989 daemon: activity on 1 descriptor 524b7989 daemon: activity on:524b7989 524b7989 daemon: epoll: listen=7 active_threads=0 tvp=NULL 524b7989 daemon: epoll: listen=8 active_threads=0 tvp=NULL 524b7989 conn=1014 fd=16 ACCEPT from IP=192.168.1.81:35171 (IP=0.0.0.0:389) 524b7989 daemon: activity on 1 descriptor 524b7989 daemon: activity on:524b7989 16r524b7989 524b7989 daemon: read active on 16 524b7989 daemon: epoll: listen=7 active_threads=0 tvp=NULL 524b7989 daemon: epoll: listen=8 active_threads=0 tvp=NULL 524b7989 connection_get(16) 524b7989 connection_get(16): got connid=1014 524b7989 connection_read(16): checking for input on id=1014 ber_get_next ldap_read: want=8, got=8 0000: 30 22 02 01 01 60 1d 02 0"...`.. ldap_read: want=28, got=28 0000: 01 03 04 00 a3 16 04 05 50 4c 41 49 4e 04 0d 00 ........PLAIN... 0010: 66 6c 61 73 68 00 74 69 67 67 65 72 flash.xxxxxxx ber_get_next: tag 0x30 len 34 contents: ber_dump: buf=0x7f1580103750 ptr=0x7f1580103750 end=0x7f1580103772 len=34 0000: 02 01 01 60 1d 02 01 03 04 00 a3 16 04 05 50 4c ...`..........PL 0010: 41 49 4e 04 0d 00 66 6c 61 73 68 00 74 69 67 67 AIN...flash.xxxx 0020: 65 72 xxxxxx 524b7989 op tag 0x60, time 1380678025 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable 524b7989 conn=1014 op=0 do_bind 524b7989 daemon: activity on 1 descriptor ber_scanf fmt ({imt) ber: ber_dump: buf=0x7f1580103750 ptr=0x7f1580103753 end=0x7f1580103772 len=31 0000: 60 1d 02 01 03 04 00 a3 16 04 05 50 4c 41 49 4e `..........PLAIN 0010: 04 0d 00 66 6c 61 73 68 00 74 69 67 67 65 72 ...flash.xxxxxxxx ber_scanf fmt ({m) ber: ber_dump: buf=0x7f1580103750 ptr=0x7f158010375a end=0x7f1580103772 len=24 0000: 00 16 04 05 50 4c 41 49 4e 04 0d 00 66 6c 61 73 ....PLAIN...flas 0010: 68 00 74 69 67 67 65 72 h.xxxxxxxxx ber_scanf fmt (m) ber: ber_dump: buf=0x7f1580103750 ptr=0x7f1580103763 end=0x7f1580103772 len=15 0000: 00 0d 00 66 6c 61 73 68 00 74 69 67 67 65 72 ...flash.xxxxxxx ber_scanf fmt (}}) ber: ber_dump: buf=0x7f1580103750 ptr=0x7f1580103772 end=0x7f1580103772 len=0 524b7989 >>> dnPrettyNormal: <> 524b7989 <<< dnPrettyNormal: <>, <> 524b7989 conn=1014 op=0 BIND dn="" method=163 524b7989 do_bind: dn () SASL mech PLAIN 524b7989 ==> sasl_bind: dn="" mech=PLAIN datalen=13 524b7989 SASL Canonicalize [conn=1014]: authcid="flash" 524b7989 slap_sasl_getdn: conn 1014 id=flash [len=5] => ldap_dn2bv(16) <= ldap_dn2bv(uid=flash,cn=PLAIN,cn=auth)=0 524b7989 slap_sasl_getdn: u:id converted to uid=flash,cn=PLAIN,cn=auth 524b7989 >>> dnNormalize: <uid=flash,cn=PLAIN,cn=auth> => ldap_bv2dn(uid=flash,cn=PLAIN,cn=auth,0) <= ldap_bv2dn(uid=flash,cn=PLAIN,cn=auth)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=flash,cn=plain,cn=auth)=0 524b7989 <<< dnNormalize: <uid=flash,cn=plain,cn=auth> 524b7989 ==>slap_sasl2dn: converting SASL name uid=flash,cn=plain,cn=auth to a DN 524b7989 ==> rewrite_context_apply [depth=1] string='uid=flash,cn=plain,cn=auth' 524b7989 ==> rewrite_rule_apply rule='uid=([^,]*),cn=digest-md5,cn=auth' string='uid=flash,cn=plain,cn=auth' [1 pass(es)] 524b7989 ==> rewrite_rule_apply rule='uid=([^,]*),cn=plain,cn=auth' string='uid=flash,cn=plain,cn=auth' [1 pass(es)] 524b7989 ==> rewrite_context_apply [depth=1] res={0,'uid=flash,ou=people,ou=accounts,dc=example,dc=com'} 524b7989 [rw] authid: "uid=flash,cn=plain,cn=auth" -> "uid=flash,ou=people,ou=accounts,dc=example,dc=com" 524b7989 slap_parseURI: parsing uid=flash,ou=people,ou=accounts,dc=example,dc=com ldap_url_parse_ext(uid=flash,ou=people,ou=accounts,dc=example,dc=com) 524b7989 >>> dnNormalize: <uid=flash,ou=people,ou=accounts,dc=example,dc=com> => ldap_bv2dn(uid=flash,ou=people,ou=accounts,dc=example,dc=com,0) <= ldap_bv2dn(uid=flash,ou=people,ou=accounts,dc=example,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=flash,ou=people,ou=accounts,dc=example,dc=com)=0 524b7989 <<< dnNormalize: <uid=flash,ou=people,ou=accounts,dc=example,dc=com> 524b7989 <==slap_sasl2dn: Converted SASL name to uid=flash,ou=people,ou=accounts,dc=example,dc=com 524b7989 slap_sasl_getdn: dn:id converted to uid=flash,ou=people,ou=accounts,dc=example,dc=com 524b7989 SASL Canonicalize [conn=1014]: slapAuthcDN="uid=flash,ou=people,ou=accounts,dc=example,dc=com" 524b7989 SASL Canonicalize [conn=1014]: authcid="flash" 524b7989 slap_sasl_getdn: conn 1014 id=flash [len=5] => ldap_dn2bv(16) <= ldap_dn2bv(uid=flash,cn=PLAIN,cn=auth)=0 524b7989 slap_sasl_getdn: u:id converted to uid=flash,cn=PLAIN,cn=auth 524b7989 >>> dnNormalize: <uid=flash,cn=PLAIN,cn=auth> => ldap_bv2dn(uid=flash,cn=PLAIN,cn=auth,0) <= ldap_bv2dn(uid=flash,cn=PLAIN,cn=auth)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=flash,cn=plain,cn=auth)=0 524b7989 <<< dnNormalize: <uid=flash,cn=plain,cn=auth> 524b7989 ==>slap_sasl2dn: converting SASL name uid=flash,cn=plain,cn=auth to a DN 524b7989 ==> rewrite_context_apply [depth=1] string='uid=flash,cn=plain,cn=auth' 524b7989 ==> rewrite_rule_apply rule='uid=([^,]*),cn=digest-md5,cn=auth' string='uid=flash,cn=plain,cn=auth' [1 pass(es)] 524b7989 ==> rewrite_rule_apply rule='uid=([^,]*),cn=plain,cn=auth' string='uid=flash,cn=plain,cn=auth' [1 pass(es)] 524b7989 ==> rewrite_context_apply [depth=1] res={0,'uid=flash,ou=people,ou=accounts,dc=example,dc=com'} 524b7989 [rw] authid: "uid=flash,cn=plain,cn=auth" -> "uid=flash,ou=people,ou=accounts,dc=example,dc=com" 524b7989 slap_parseURI: parsing uid=flash,ou=people,ou=accounts,dc=example,dc=com ldap_url_parse_ext(uid=flash,ou=people,ou=accounts,dc=example,dc=com) 524b7989 >>> dnNormalize: <uid=flash,ou=people,ou=accounts,dc=example,dc=com> => ldap_bv2dn(uid=flash,ou=people,ou=accounts,dc=example,dc=com,0) <= ldap_bv2dn(uid=flash,ou=people,ou=accounts,dc=example,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=flash,ou=people,ou=accounts,dc=example,dc=com)=0 524b7989 <<< dnNormalize: <uid=flash,ou=people,ou=accounts,dc=example,dc=com> 524b7989 <==slap_sasl2dn: Converted SASL name to uid=flash,ou=people,ou=accounts,dc=example,dc=com 524b7989 slap_sasl_getdn: dn:id converted to uid=flash,ou=people,ou=accounts,dc=example,dc=com 524b7989 SASL Canonicalize [conn=1014]: slapAuthcDN="uid=flash,ou=people,ou=accounts,dc=example,dc=com" 524b7989 => mdb_search 524b7989 mdb_dn2entry("uid=flash,ou=people,ou=accounts,dc=example,dc=com") 524b7989 => mdb_dn2id("uid=flash,ou=people,ou=accounts,dc=example,dc=com") 524b7989 <= mdb_dn2id: got id=0x2c 524b7989 => mdb_entry_decode: 524b7989 <= mdb_entry_decode 524b7989 => access_allowed: auth access to "uid=flash,ou=people,ou=accounts,dc=example,dc=com" "entry" requested 524b7989 => dn: [2] uid=flash,ou=people,ou=accounts,dc=example,dc=com 524b7989 => acl_get: [2] matched 524b7989 => acl_get: [2] attr entry 524b7989 => acl_mask: access to entry "uid=flash,ou=people,ou=accounts,dc=example,dc=com", attr "entry" requested 524b7989 => acl_mask: to all values by "", (=0) 524b7989 <= check a_dn_pat: self 524b7989 <= check a_dn_pat: users 524b7989 <= check a_dn_pat: anonymous 524b7989 <= acl_mask: [3] applying auth(=xd) (stop) 524b7989 <= acl_mask: [3] mask: auth(=xd) 524b7989 => slap_access_allowed: auth access granted by auth(=xd) 524b7989 => access_allowed: auth access granted by auth(=xd) 524b7989 base_candidates: base: "uid=flash,ou=people,ou=accounts,dc=example,dc=com" (0x0000002c) 524b7989 => test_filter 524b7989 daemon: activity on:524b7989 PRESENT 524b7989 => access_allowed: auth access to "uid=flash,ou=people,ou=accounts,dc=example,dc=com" "objectClass" requested 524b7989 => dn: [2] uid=flash,ou=people,ou=accounts,dc=example,dc=com 524b7989 => acl_get: [2] matched 524b7989 => acl_get: [2] attr objectClass 524b7989 => acl_mask: access to entry "uid=flash,ou=people,ou=accounts,dc=example,dc=com", attr "objectClass" requested 524b7989 => acl_mask: to all values by "", (=0) 524b7989 <= check a_dn_pat: self 524b7989 <= check a_dn_pat: users 524b7989 <= check a_dn_pat: anonymous 524b7989 <= acl_mask: [3] applying auth(=xd) (stop) 524b7989 <= acl_mask: [3] mask: auth(=xd) 524b7989 => slap_access_allowed: auth access granted by auth(=xd) 524b7989 => access_allowed: auth access granted by auth(=xd) 524b7989 <= test_filter 6 524b7989 => access_allowed: auth access to "uid=flash,ou=people,ou=accounts,dc=example,dc=com" "userPassword" requested 524b7989 => acl_get: [1] attr userPassword 524b7989 => acl_mask: access to entry "uid=flash,ou=people,ou=accounts,dc=example,dc=com", attr "userPassword" requested 524b7989 => acl_mask: to all values by "", (=0) 524b7989 <= check a_dn_pat: anonymous 524b7989 <= acl_mask: [1] applying auth(=xd) (stop) 524b7989 <= acl_mask: [1] mask: auth(=xd) 524b7989 => slap_access_allowed: auth access granted by auth(=xd) 524b7989 => access_allowed: auth access granted by auth(=xd) 524b7989 slap_ap_lookup: str2ad(cmusaslsecretPLAIN): attribute type undefined 524b7989 send_ldap_result: conn=1014 op=0 p=3 524b7989 send_ldap_result: err=0 matched="" text="" 524b7989 SASL [conn=1014] Failure: Password verification failed 524b7989 send_ldap_result: conn=1014 op=0 p=3 524b7989 send_ldap_result: err=49 matched="" text="SASL(-13): user not found: Password verification failed" 524b7989 send_ldap_response: msgid=1 tag=97 err=49 ber_flush2: 69 bytes to sd 16 0000: 30 43 02 01 01 61 3e 0a 01 31 04 00 04 37 53 41 0C...a>..1...7SA 0010: 53 4c 28 2d 31 33 29 3a 20 75 73 65 72 20 6e 6f SL(-13): user no 0020: 74 20 66 6f 75 6e 64 3a 20 50 61 73 73 77 6f 72 t found: Passwor 0030: 64 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 66 d verification f 0040: 61 69 6c 65 64 ailed ldap_write: want=69, written=69 0000: 30 43 02 01 01 61 3e 0a 01 31 04 00 04 37 53 41 0C...a>..1...7SA 0010: 53 4c 28 2d 31 33 29 3a 20 75 73 65 72 20 6e 6f SL(-13): user no 0020: 74 20 66 6f 75 6e 64 3a 20 50 61 73 73 77 6f 72 t found: Passwor 0030: 64 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 66 d verification f 0040: 61 69 6c 65 64 ailed 524b7989 conn=1014 op=0 RESULT tag=97 err=49 text=SASL(-13): user not found: Password verification failed 524b7989 <== slap_sasl_bind: rc=49 524b7989 524b7989 daemon: epoll: listen=7 active_threads=0 tvp=NULL 524b7989 daemon: epoll: listen=8 active_threads=0 tvp=NULL 524b7989 daemon: activity on 1 descriptor 524b7989 daemon: activity on:524b7989 16r524b7989 524b7989 daemon: read active on 16 524b7989 daemon: epoll: listen=7 active_threads=0 tvp=NULL 524b7989 daemon: epoll: listen=8 active_threads=0 tvp=NULL 524b7989 connection_get(16) 524b7989 connection_get(16): got connid=1014 524b7989 connection_read(16): checking for input on id=1014 ber_get_next ldap_read: want=8, got=7 0000: 30 05 02 01 02 42 00 0....B. ber_get_next: tag 0x30 len 5 contents: ber_dump: buf=0x7f1584117620 ptr=0x7f1584117620 end=0x7f1584117625 len=5 0000: 02 01 02 42 00 ...B. 524b7989 op tag 0x42, time 1380678025 ber_get_next ldap_read: want=8, got=0 524b7989 ber_get_next on fd 16 failed errno=0 (Success) 524b7989 connection_read(16): input error=-2 id=1014, closing. 524b7989 connection_closing: readying conn=1014 sd=16 for close 524b7989 daemon: activity on 1 descriptor 524b7989 daemon: activity on:524b7989 524b7989 daemon: epoll: listen=7 active_threads=0 tvp=NULL 524b7989 connection_close: deferring conn=1014 sd=16 524b7989 daemon: epoll: listen=8 active_threads=0 tvp=NULL 524b7989 conn=1014 op=1 do_unbind 524b7989 conn=1014 op=1 UNBIND 524b7989 connection_resched: attempting closing conn=1014 sd=16 524b7989 connection_close: conn=1014 sd=16 524b7989 daemon: removing 16 524b7989 conn=1014 fd=16 closed

4 7

slapcat backup with empty DNs
by Samir Cury 10 Oct '13

10 Oct '13

Dear all, The problem I'm having is simple, although I didn't find much eplanations for it, once I try to backup the database with : slapcat -v -l ldap-backup5.ldif It works nicely, except that _all_ entries have : dn: structuralObjectClass: organizationalUnit dn: objectClass: organizationalRole cn: Manager dn: structuralObjectClass: inetOrgPerson entryUUID: e8ef2300-f04c-10fb-9b02-a54a91b9c30b (empty DNs) Although the information is still there, if I ldapsearch one of the entities it comes easily : ldapsearch -x -LLL '(uid=samir)' dn: cn=Samir Cury,ou=abc,ou=def,dc=org,dc=edu cn: Samir Cury Siqueira objectClass: inetOrgPerson is this problem obvious to any of you? The only similar case I found in the history was :http://www.openldap.org/lists/openldap-technical/201201/msg00160.html Which doesn't have a clear outcome. Any hint on where to look at? Thanks, Samir ==== Aditional information - just in case ==== My setup is a 1 Master 1 Slave of slapd 2.3.43. Relevant information is that after the master's hardware died, few days later the slave started to misbehave and probably got the DB corrupted. slapd_db_recover seems to have fixed it as now it is working just fine, log messages from before the error / recovery : #slapcat -v -l ldap-backup.ldif bdb_db_open: unclean shutdown detected; attempting recovery. bdb_db_open: Recovery skipped in read-only mode. Run manual recovery if errors are encountered. #slapd_db_recover -v -h /var/lib/ldap Finding last valid log LSN: file: 2 offset 6078834 Recovery starting from [2][6065934] Recovery complete at Wed Oct 9 16:42:55 2013 Maximum transaction ID 8000c207 Recovery checkpoint [2][6091589] -- slapcat now has no warnings/errors -- I suspect slightly of this as I've read that corrupted databases can cause such effects, but the ldapsearch with full DNs makes me think that it didn't happen. ==== / Aditional information ====

2 1

another CSN too old N-WAY master
by Lanfeust troy 10 Oct '13

10 Oct '13

hi all, sometimes my server a not in sync. because server ignoring entry: do_syncrep2: rid=102 CSN too old, ignoring 20130923090023.266239Z#000000#002#000000 @(#) $OpenLDAP: slapd 2.4.33 (....) 4 server host1 and host 2: only one database c=fr ( contain an ou=apps-ext ) host3 and host 4: tow database: first ou=apps-ext (glued with c=fr ). writable by host1,2,3,4 second c=fr writable only by host1,2 ldap-int1 and ldap-int2 cn=config also into syncrepl mirrorMode ldap-ext1 and ldap-ext2 cn=config also into syncrepl mirrorMode Configuration: grep serverID /etc/openldap/slapd.d/* /etc/openldap/slapd.d/cn=config.ldif:olcServerID: 1 ldaps://ldap-int1.dom.fr /etc/openldap/slapd.d/cn=config.ldif:olcServerID: 2 ldaps://ldap-int2.dom.fr /etc/openldap/slapd.d/cn=config.ldif:olcServerID: 3 ldaps:// ldap-ext1.vlandata.dom.fr /etc/openldap/slapd.d/cn=config.ldif:olcServerID: 4 ldaps:// ldap-ext2.vlandata.dom.fr syncrepl: ldap-int1 and ldap-int2 cn=config also into syncrepl olcSyncrepl: {0}rid=101 provider=ldaps://ldap-int1.dom.frbinddn="uid=syncrepl ,ou=system,ou=dom,o=domgroup,c=fr" bindmethod=simple credentials=XXXXXX sea rchbase="c=fr" tls_reqcert=never type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 +" timeout=1 olcSyncrepl: {1}rid=102 provider=ldaps://ldap-int2.cdoms.frbinddn="uid=syncrepl ,ou=system,ou=dom,o=domgroup,c=fr" bindmethod=simple credentials=XXXXXX sea rchbase="c=fr" tls_reqcert=never type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 +" timeout=1 olcSyncrepl: {2}rid=103 provider=ldaps://ldap-ext2.vlandata.dom.frbinddn="uid =syncrepl,ou=system,ou=dom,o=domgroup,c=fr" bindmethod=simple credentials=XX XXXX tls_reqcert=never searchbase="o=apps-ext,c=fr" type=refreshAndPersist r etry="5 5 300 +" timeout=1 olcSyncrepl: {3}rid=104 provider=ldaps://ldap-ext1.vlandata.dom.frbinddn="uid =syncrepl,ou=system,ou=dom,o=domgroup,c=fr" bindmethod=simple credentials=XXX XXXX searchbase="o=apps-ext,c=fr" tls_reqcert=never type=refreshAndPersist r etry="5 5 300 +" timeout=1 syncrepl host3 and host4: database apps-ext: olcSyncrepl: {0}rid=303 provider=ldaps://ldap-ext1.vlandata.dom.frbinddn="uid =syncrepl,ou=system,ou=dom,o=domgroup,c=fr" bindmethod=simple credentials=XXX XXXX searchbase="o=apps-ext,c=fr" tls_reqcert=never type=refreshAndPersist r etry="5 5 300 +" timeout=1 olcSyncrepl: {1}rid=304 provider=ldaps://ldap-ext2.vlandata.dom.frbinddn="uid =syncrepl,ou=system,ou=dom,o=domgroup,c=fr" bindmethod=simple credentials=XXX XXX searchbase="o=apps-ext,c=fr" tls_reqcert=never type=refreshAndPersist r etry="5 5 300 +" timeout=1 database c=fr: olcSyncrepl: {0}rid=201 provider=ldaps://ldap-int1.dom.frbinddn="uid=syncrepl ,ou=system,ou=dom,o=domgroup,c=fr" bindmethod=simple credentials=XXXXXX sea rchbase="c=fr" tls_reqcert=never type=refreshOnly interval=00:00:00:10 retry= "5 5 300 +" timeout=1 olcSyncrepl: {1}rid=202 provider=ldaps://ldap-int2.dom.frbinddn="uid=syncrepl ,ou=system,ou=dom,o=domgroup,c=fr" bindmethod=simple credentials=XXXXX tls _reqcert=never searchbase="c=fr" type=refreshOnly interval=00:00:00:10 retry= "5 5 300 +" timeout=1 log message into ldap-int1: ep 23 09:00:26 ldap-int1 slapd[30481]: do_syncrep2: rid=104 LDAP_RES_INTERMEDIATE - NEW_COOKIE Sep 23 09:00:26 ldap-int1 slapd[30481]: do_syncrep2: rid=104 NEW_COOKIE: rid=104,sid=003,csn=20130304121522.188962Z#000000#000#000000;20130920094938.821063Z#000000#001#000000;20130923081114.470856Z#000000#002#000000;20130920094950.036431Z#000000#003#000000;20130912174047.679980Z#000000#004#000000;20130304131428.455916Z#000000#00b#000000;20130304125618.164164Z#000000#00c#000000 Sep 23 09:00:26 ldap-int1 slapd[30481]: do_syncrep2: rid=104 LDAP_RES_INTERMEDIATE - NEW_COOKIE Sep 23 09:00:26 ldap-int1 slapd[30481]: do_syncrep2: rid=104 NEW_COOKIE: rid=104,sid=003,csn=20130304121522.188962Z#000000#000#000000;20130920094938.821063Z#000000#001#000000;20130923090023.733719Z#000000#002#000000;20130920094950.036431Z#000000#003#000000;20130912174047.679980Z#000000#004#000000;20130304131428.455916Z#000000#00b#000000;20130304125618.164164Z#000000#00c#000000 Sep 23 09:00:26 ldap-int1 slapd[30481]: slap_queue_csn: queing 0x7f3787471a90 20130923090023.733719Z#000000#002#000000 Sep 23 09:00:26 ldap-int1 slapd[30481]: slap_graduate_commit_csn: removing 0x7f37873baa10 20130923090023.733719Z#000000#002#000000 Sep 23 09:00:27 ldap-int1 slapd[30481]: syncprov_matchops: skipping original sid 002 Sep 23 09:00:27 ldap-int1 slapd[30481]: slap_graduate_commit_csn: removing 0x7f37803e9320 20130923090023.225026Z#000000#002#000000 Sep 23 09:00:27 ldap-int1 slapd[30481]: syncrepl_entry: rid=102 be_add cn=502257-dt-global-gridded-adt-ref,ou=affectations,ou=console,o=apps,c=fr (0) Sep 23 09:00:27 ldap-int1 slapd[30481]: do_syncrep2: rid=102 cookie=rid=102,sid=002,csn=20130923090023.266239Z#000000#002#000000 Sep 23 09:00:27 ldap-int1 slapd[30481]: do_syncrep2: rid=102 CSN too old, ignoring 20130923090023.266239Z#000000#002#000000 (cn=502257-dt-med-gridded-sla-ref,ou=affectations,ou=console,o=apps,c=fr) Sep 23 09:00:27 ldap-int1 slapd[30481]: do_syncrep2: rid=102 cookie=rid=102,sid=002,csn=20130923090023.278474Z#000000#002#000000 Sep 23 09:00:27 ldap-int1 slapd[30481]: do_syncrep2: rid=102 CSN too old, ignoring 20130923090023.278474Z#000000#002#000000 (cn=502257-dt-blacksea-alongtrack-sla-ref,ou=affectations,ou=console,o=apps,c=fr) time sync host1 ntpq> lpeers remote refid st t when poll reach delay offset jitter ============================================================================== *date.dom.fr 145.238.203.10 3 u 676 1024 377 1.592 0.284 0.018 +date2.dom.fr 145.238.203.10 3 u 295 1024 377 2.681 -0.410 0.326 host2 ntpq> lpeers remote refid st t when poll reach delay offset jitter ============================================================================== *date.dom.fr 145.238.203.10 3 u 954 1024 377 1.028 1.012 0.343 +date2.dom.fr 145.238.203.10 3 u 413 1024 377 2.171 0.098 0.606 does somebody see what is wrong . thanks

6 14

Solaris 10 tls:simple binding to OpenLDAP
by Ben Babich 10 Oct '13

10 Oct '13

Folks, I have been fighting along getting some Solaris 10 nodes (both SPARC and x86) to talk via TLS/SSL to our OpenLDAP infrastructure. Without SSL (tls:simple) it binds and functions fine which in my mind rules out most of the usual culprits. As for the certificates, I have verified connectivity with the certificate via openssl s_client -connect <fqdn> -CAfile <cacert> -showcerts but I cannot get the correct version/combination of certutil to setup the appropriate keystore (cert[78].db, key3.db and secmod.db) and make the native SUN ldapsearch or native ldapclient work correctly. Oct 10 10:48:29 solaris1 /usr/lib/nfs/nfsmapid[3668]: [ID 293258 daemon.warning] libsldap: Status: 91 Mesg: createTLSSession: failed to initialize TLS security (security library: bad database.) Oct 10 10:48:29 solaris1 /usr/lib/nfs/nfsmapid[3668]: [ID 292100 daemon.warning] libsldap: could not remove <ldapserver> from servers list Oct 10 10:48:29 solaris1 /usr/lib/nfs/nfsmapid[3668]: [ID 293258 daemon.warning] libsldap: Status: 7 Mesg: Session error no available conn. # certutil -d /var/ldap -L Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI CA certificate CT,, # ldapclient list NS_LDAP_FILE_VERSION= 2.0 NS_LDAP_BINDDN= <masked> NS_LDAP_BINDPASSWD= <masked> NS_LDAP_SERVERS= <masked> NS_LDAP_SEARCH_BASEDN= <masked> NS_LDAP_AUTH= tls:simple NS_LDAP_CACHETTL= 0 NS_LDAP_CREDENTIAL_LEVEL= proxy NS_LDAP_HOST_CERTPATH= /var/ldap # I've tried a few of the older certutil's getting around, including the one from here: along with libraries from openCSW to get it all working http://www.gurulabs.com/downloads/certutil-1.0-sol9-sun4u-local.gz I'm pretty sure its the cert database or something to do with certutill being painful. Any suggestions? Thanks Ben

2 1

Allow invalid certificates for a single host
by Jared 10 Oct '13

10 Oct '13

Hi, all. I'm having trouble figuring out how to allow SSL connections (using ldapsearch) to a single host with an invalid certificate. I know this can be done using TLS_REQCERT=allow (or never), but the same account also connects to multiple other hosts using certificate-based authentication, and the problem is that I can get those two configurations to work together. To illustrate, here's the current ~/.ldaprc file for this user: TLS_CERT /home/ldap/certs/admin.crt TLS_KEY /home/ldap/certs/admin.key TLS_REQCERT demand SASL_MECH external That works fine for everything but this one new host. I'm not able to fix the the SSL issue on this host, so for now I need to work around it. If I replace the above ~/.ldaprc with this: HOST server.domain.com PORT 636 TLS_REQCERT allow Then ldapsearch works fine for this new server, but, of course, SASL/cert auth fails for everything else. So, how do I get these to work together, with that first configuration example set as the default for all hosts *except* server.domain.com? Here's what I've tried so far: * Appending the configuration for server.domain.com to the existing ~/.ldaprc file - it doesn't have an effect, like the global stuff is overriding the host-specific options * Adding the server.domain.com config to /etc/openldap/ldap.conf, but ~/.ldaprc takes precedence over this, so again it has no effect. * Creating a separate ~/.ldaprc-server file and exporting LDAPRC=.ldaprc-server - in this case, both ~/.ldaprc AND ~/.ldaprc-server are sourced (found using strace), so again my host-specific settings are ignored. * exporting both LDAPNOINIT=true and LDAPRC=.ldaprc-server, but that prevents either rc file from being sourced * exporting LDAPNOINIT=true and calling ldapsearch with: LDAPTLS_REQCERT=allow ldapsearch -H ldaps://server.domain.com ... - this also seems to have no effect, though I'm sure I must be missing something simple, but I'm out of ideas at this point. Would appreciate any tips or pointers. Thanks! -- Jared

4 13

Modification hooks for the OpenLDAP system
by Mailing Lists 09 Oct '13

09 Oct '13

Hi, I was looking into OpenLDAP and couldn't find the following information in the documentation: Is there any possibility to have hooks in the openLDAP system which allow a customizable action to be performed when records are added/deleted/updated? An example for this would be to send a message to an external system in case a modification of the directory service has occured, so that this system can act on this (the 'external' system could, of course, belong to the same organization as well). E.g. for improving synchronization with GAE (but I could name some other uses for it too). I have found a prior post on hooks for authentication (http://www.openldap.org/lists/openldap-software/200510/msg00549.html) but this is not what I am looking for. If it is not supported in openLDAP, are there any plug-ins which do support it? Thanks in advance!

3 2

New release request
by Marco Pizzoli 09 Oct '13

09 Oct '13

Hi all, considered the importance of the patches which have landed in the last few days, could I ask to start with a testing call for a new release? I'm confident they could solve the crashes I have been facing since I started working heavily with back-mdb and I'm only allowed to work with "official" releases. Thanks in advance as usual Marco

2 1

Some things strange
by Jacques Foucry 09 Oct '13

09 Oct '13

Hello list, On a test VM I create a replica of my LDAP server, install pureFtp-ldap and configure it. It work perfectly. I can login on my vm, use ftp user too. But when I try to start ldap with the init script, it failed. I found that on the log file: > Oct 8 16:02:38 ldap-test slapd[3507]: @(#) $OpenLDAP: slapd (Apr 23 2013 12:16:04) $#012#011root@lupin:/tmp/buildd/openldap-2.4.31/debian/build/servers/slapd > Oct 8 16:02:38 ldap-test slapd[3507]: daemon: bind(10) failed errno=2 (No such file or directory) > Oct 8 16:02:38 ldap-test slapd[3507]: slapd stopped. > Oct 8 16:02:38 ldap-test slapd[3507]: connections_destroy: nothing to destroy. If I launch it on the cli: # slapd Everything work perfectly. I can figure what's wrong with the startup script. Is somebody could see what's wrong ? Thanks in advance, Jacques Foucry -- Jacques Foucry *NOVΛSPARKS * IT Manager Tel : +33 (0)1 42 68 12 61 jacques.foucry(a)novasparks.com

2 2

slapo-lastbind and chaining
by Christian Kratzer 08 Oct '13

08 Oct '13

Hi, it seems this has been asked before but I am not sure of the conclusion: http://www.openldap.org/lists/openldap-technical/201211/msg00078.html I have setup setup with slapo-lastbind configured on some slaves that have a working chaining configuration to the masters. It seems that the authTimestmap attribute from slapo-lastbind is not getting replicated. >From looking at the source code for lastbind it seems we would need to implement something similar to olcPPolicyForwardUpdates from ppolicy.c If none of the gurus here don't object the code looks clean enough that I would attempt to port forwarding of updates from slapo-ppolicy to slapo-lastbind. ( olcLastbindForwardUpdates ) Greetings Christian -- Christian Kratzer CK Software GmbH Email: ck(a)cksoft.de Wildberger Weg 24/2 Phone: +49 7032 893 997 - 0 D-71126 Gaeufelden Fax: +49 7032 893 997 - 9 HRB 245288, Amtsgericht Stuttgart Web: http://www.cksoft.de/ Geschaeftsfuehrer: Christian Kratzer

4 6

Problem TLS
by felas 08 Oct '13

08 Oct '13

Hi i have installed OpenLdap in local, and i try to enabled the TLS Auth. I follow this guide https://help.ubuntu.com/12.04/serverguide/openldap-server.html#openldap-ser… but when i try to auth with my program(in Eclipse) i have this error: Unable to connect to server 192.168.1.156:636 (91) Connect Error java.net.ConnectException: Connection Refused

2 1

Migrating to new production servers via syncrepl
by samuli.seppanen＠gmail.com 07 Oct '13

07 Oct '13

Hi, I'm phasing out two OpenLDAP production servers[1] in a master-master configuration. The production servers can't afford more than a few mins of downtime, so migrating using slapcat/slapadd is out of the question. So, what I'm ending up doing is migrating using syncrepl. Here's the plan, with arrows pointing from the provider to the consumer: old1 <-> old2 -> new1 -> new2 Once the replicas on "new1" and "new2" are complete, I plan to 1) Direct all LDAP reads to "new1" 2) Direct all LDAP writes to "new1" (=make it briefly the only active LDAP server) 3) Change the replication config on "new1" so that it fetches changes from "new2" instead of "old2" 4) Restart slapd on new1 (it uses slapd.conf) to activate the change 4) Start offloading LDAP reads/writes to "new2" (e.g. using a loadbalancer) A couple of questions: . Does this plan makes sense in general? - Which caveats I should be aware of? - How can I ensure the replicas are complete and in the same state[1]? - Does switching the replication provider for "new1" from "old2" to "new2" cause any side-effects? Also, when is full reload of the replica[2] required/suggested? I've managed to end up with incomplete replicas on "old2" a couple of times even if I've wiped /var/lib/ldap and started replication from scratch. Any suggestions or pointers are most welcome! Also let me know if you need more info (configs, etc) and I'll provide it. Best regards, Samuli Seppänen --- [1] I've used these command so far: $ cd /var/lib/ldap $ db_stat -d <database-file> If the numbers (data items etc) match, can I be sure the replicas are identical? I've also checked the contextCSN on the using something like this: $ ldapsearch -H ldap://old2:389 -D "cn=admin,dc=domain,dc=com" -x -W -v -s base -b "dc=domain,dc=com" $ ldapsearch -H ldap://new1:389 -D "cn=admin,dc=domain,dc=com" -x -W -v -s base -b "dc=domain,dc=com" $ ldapsearch -H ldap://new2:389 -D "cn=admin,dc=domain,dc=com" -x -W -v -s base -b "dc=domain,dc=com" The output seems to be identical for "old2" and "new1", but "new2" differs, even though the database seems identical if checked with db_stat. I assume this is normal given the replication chaining (see above). [2] Starting slapd with the "-c rid=<rid>" switch should do this, correct?

4 5

Q: restrict access using "peername"
by Ulrich Windl 04 Oct '13

04 Oct '13

Hi! Can anybody present an example that uses "peername" with a hostname (not an IP address) to restrict access? I once tried and locked out clients I did not want to lock out. It seemed that the name match failed... slapd.access(5) seems to lack an example. Regards, Ulrich

2 1

Openldap server with TLS not working
by Axel Grosse 04 Oct '13

04 Oct '13

Hi I am new to OpenLDAP and have to configure and LDAP Proxy in one project. Thanks to the mailing lists I managed to setup and configure the Ldap Proxy an get it working one 389 . One of the next requirenents is to secure the outside connection with SSL. So I have to configure LDAP over SSL .. I am using openldap 2.3.43-12.el5 on Redhat EL 5.5 (Tikanga) I created the certificates with openssl 0.9.8e-12.el5_4.6 and configured the slapd.conf part of slapd.conf # The next three lines allow use of TLS for encrypting connections using a # dummy test certificate which you can generate by changing to # /etc/pki/tls/certs, running "make slapd.pem", and fixing permissions on # slapd.pem so that the ldap user or group can read it. Your client software # may balk at self-signed certificates, however. TLSCACertificateFile /etc/openldap/ssl/VordelCA.crt TLSCertificateFile /etc/openldap/ssl/VordelDevInt.crt TLSCertificateKeyFile /etc/openldap/ssl/VordelDev.key TLSCipherSuite HIGH:MEDUIM:!SSLv2 TLSVerifyClient never ... ###### server got up on 636 but when I try to connect I get SSL handshake error ... when I test on the server itself .. openssl s_client -connect 192.168.30.169:389 -showcerts -CAfile ./ssl/VordelCA.crt CONNECTED(00000003) 710:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:188: I got this one ... any idea whats my problem ? regards Axel

7 16

Log level will not change.
by espeake＠oreillyauto.com 04 Oct '13

04 Oct '13

Here is the contents of configlog.ldif dn: cn=config changetype: modify delete: olcLogLEvel - add: olcLogLevel olcLogLevel: 0 I run the following commend: ldapmodify -Wx -D "uid=admin,dc=oreillyauto,dc=com" -H ldap://tntest-ldap-1.oreillyauto.com -c -f /tmp/configlog.ldif the output shows: Enter LDAP Password: modifying entry "cn=config" Except the loglevel cn=config does not change. The modifyTimeStamp and entryCSN change to match the server. I have a 3 node MMR cluster on 2.4.31. I am working on a build to go to 2.4.36, but in the mean time I need to get this working. Thanks, Eric Speake Web Systems Administrator O'Reilly Auto Parts This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

5 7

Unknown db in slapd.conf
by espeake＠oreillyauto.com 03 Oct '13

03 Oct '13

I have a brand new Ubuntu-12.04 server with a brand new build of openldap 2.4.36 on it and I am try to set it up for MMR with mdb. I get the following error when I try slapadd my config. 524c62f1 line 61 (databse mdb) 524c62f1 /usr/local/etc/openldap/slapd.conf: line 61: <database> failed init (mdb)! Now when I look at man slapd.conf and these are the database types that are shown for use. There is nothing there showing mdb, but I know that it is a viable selection. database <databasetype> Mark the beginning of a new database instance definition. <databasetype> should be one of bdb, config, dnssrv, hdb, ldap, ldif, meta, monitor, null, passwd, perl, relay, shell, or sql, depending on which backend will serve the database. in my slapd.conf file I have the following setup (just partially listing here): # Load dynamic backend modules: modulepath /usr/local/libexec/openldap moduleload back_mdb.la moduleload back_ldap.la ############################################################################ database mdb I have checked and double cheked to be sure that /usr/local/libexec/openldap/back_mdb.la exists. What simple thing am I missing? Thanks, Eric Speake Web Systems Administrator O'Reilly Auto Parts This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

4 7

openldap-2.3.43 ignore limits in slapd.conf
by Axel Grosse 03 Oct '13

03 Oct '13

Hi I try to change the default search limits in an openldap-2.3.43 server. I am using this entries in the slapd.conf gerneral section #change to unlimited results sizelimit size.soft=10000 size.hard=10000 timelimit unlimited Database section limits * size.soft=10000 size.hard=10000 size.pr=10000 size.prtotal=10000 but on a search I am always limited to 500 ldapsearch -H ldap://192.168.30.169 -x -D "cn=admin,o=TI" -W -b "ou=CustomerGroups,ou=GROUPS,o=TI" -s sub -a always -z 10000 "(objectClass=*)" "hasSubordinates" "objectClass" ldapentrycount # search result search: 2 result: 4 Size limit exceeded # numResponses: 501 # numEntries: 500 is that a know bug ? ... AXEL GROSSE Principal Solution Architect, Sales Solution Center, Axway P: +61-405-995-768 828 Pacific Highway Gordon, 2072 NSW agrosse(a)axway.com<mailto:agrosse@axway.com> http://www.axway.com<http://www.axway.com/>

1 1

Re: Attributes rewriting
by Dimitri Osler 03 Oct '13

03 Oct '13

I also have the same problem, can anybody help? > Hello, List > > I've been trying to find a working example to understand how slapo-rwm, slapd-meta and slapd-relay work for the last 3 days with no success. > > I just need to substitute one attribute by another for a single LDAP user. > Lets say I have a posixAccount Object with cn = user1 as shown below. > dn: uid=user1,ou=People,dc=localnet > uid: user1 > cn: user1 > objectClass: account > objectClass: posixAccount > objectClass: shadowAccount > ..... > > Also I have two LDAP users (organizationalRole): admin. simpleuser. > I want to configure openldap in a way which allows "simpleuser" to make queries using "(description=user1)" instead of ("cn=user1") to find previously mentioned user object. > The only thing I was able to configure is the suffixmassage, but can't find a way how to add rwm-map to my configuration. > > Could somebody point me to the working example.

1 0

OpenLDAP duplication
by 25Dollar Tech 30 Sep '13

30 Sep '13

Hello Team, I just want to know the below According to my understanding, LDAP authenticates (binds) with DN (distinguish name) and password. E.g. CN=bob, OU=Users,DC=test,DC=com. So OpenLDAP allows the same CN in a different OU. Is there any option to prevent it. ? -- *Thanks & Regards, 25dollarTech Team https://sites.google.com/site/25dollartech/* *Email: 25dollartechhelp(a)gmail.com*

4 3

ldapsearch: wildcard search do not list all entries
by Birgit Ohlenbusch 30 Sep '13

30 Sep '13

Hello, I had a curious problem with ldapsearch: A wildcard search like ldapsearch -LLL -Wx -h myldap -D cn=xx -b dc=xx -b "ou=Accounts,xx" uid='xyzzs*' uid lists only three entries: dn: uid=xyzzs146,ou=Accounts,xx uid: xyzzs146 dn: uid=xyzzs147,ou=Accounts,xx uid: xyzzs147 dn: uid=xyzzs148,ou=Accounts,xx uid: xyzzs148 though there exists more, which can be displayed with ldapsearch not specifying a filter or by specifying the object exactly like ldapsearch -LLL -Wx -h myldap -D cn=xx -b dc=xx -b "ou=Accounts,xx" uid='xyzzs020' uid Reindexing with slapindex solved the problem, ldapsearch with uid='xyzzs*' shows all those entries, not only three. But I'm afraid that this happens again. Can you tell me how somethink like this can happen and how I can prevent such a situation? The slapd is running on a RHLE 6.4 server, using a hdb database. We indexed olcDbIndex: objectClass pres,eq olcDbIndex: entryUUID eq olcDbIndex: entryCSN eq olcDbIndex: cn pres,eq olcDbIndex: uidNumber pres,eq olcDbIndex: gidNumber pres,eq olcDbIndex: CAUmailHost pres,eq olcDbIndex: memberUid pres,eq olcDbIndex: ou eq olcDbIndex: uniqueMember pres,eq olcDbIndex: uid pres,eq,sub Thanks in advance for your help Birgit

3 5

Kudos to all who contributed to MDB
by Brent Bice 30 Sep '13

30 Sep '13

I've started testing an LDAP server here using MDB and ran across a few caveats that might be of use to others looking into using it. But first off, let me say a hearty THANKS to anyone who's contributed to it. In this first OpenLDAP server I've converted over to MDB it's *dramatically* faster and it's definitely nice to not worry about having to setup script/s to occasionally (carefully) commit/flush DB logs, etc. One caveat that might be worth mentioning in release notes somewhere... Not all implementations of memory mapped I/O are created equal. I ran into this a long time back when I wrote a multi-threaded quicksort program for a friend to had to sort text files bigger than 10 gigs and didn't want to wait for the unix sort command. :-) The program I banged together for him used memory mapped I/O and one of the things I found was that while Solaris would let me memory map a file bigger than I had physical or virtual memory for, linux wouldn't. It appeared that some versions of the 2.x kernels wouldn't let me memory-map a file bigger than the total *virtual* memory size, and I think MDB is running into the same limitation. On a SLES11 system, for instance with the 2.6.32.12 kernel, I can't specify a maxsize bigger than the total of my physical memory and swap space. So just something to keep in mind if you're using MDB on the 2.x kernels - you may need a big swap area even though the memory mapped I/O routines in the kernel seem to be smart enough to avoid swapping like mad. On a newish ubuntu system with a 3.5 kernel this doesn't seem to be an issue - tell OpenLDAP to use whatever maxsize you want and it just works. :-) I'd also only use MDB on a 64 bit linux system. One of the other headaches I remember running into with memory mapped I/O was adding in support for 64 bit I/O on 32 bit systems. Best to avoid that whole mess and just use a 64 bit OS in the first place. Lastly... At the risk of making Howard and Quanah cringe... :-) The OpenLDAP DB I've been testing this with is the back-end to an email tracking tool I setup several years ago. More as an excuse to edjimicate myself on the java API for LDAP than anything else, I wrote a quick bit of java that watches postfix and sendmail logs and writes pertinent bits of info into an LDAP database, and a few PHP scripts to then query that database for things like to/from addresses, queue IDs, and message IDs. 'Makes it easy for junior admins to quickly search through gigabytes of logs to see what path an email took to get from point A to point B, who all received it (after it went through one or more list servers and a few aliases got de-ref'd, etc). Yeah, it's an utter abuse of LDAP which is supposed to be write-rarely and read-mostly, especially as our postfix relays handle anywhere from 1 to 10 messages per second on average. :-) But what the heck, it works fine and was a fun weekend project. It's also served as a way to stress-test new versions of OpenLDAP before I deploy them elsewhere. :-) Anyway, thanks again to everyone who contributed to MDB. It's lots faster than BerkeleyDB in all of my testing so far. 'Looking forward to gradually shifting more of my LDAP servers over to it. Brent

4 6

building SLES packages on openSuSE Build Service
by Marc Patermann 30 Sep '13

30 Sep '13

Hi, I used to build newer versions of openldap on openSuSE Build Service derived from the ones at network:ldap (from Ralf Haferkamp; which is stuck at .33). I did this for 2.4.33, .34 and .35. When I tried to build 2.4.36 something changed (at the build service?) and now my builds - even the older ones, which built fine before - fail with the following errors: [ 399s] E: openldap2 64bit-portability-issue dn2id.c:738 [ 399s] E: openldap2 64bit-portability-issue id2entry.c:123 What may have caused this? Marc

2 1

Re: separate login/password for several services?
by Andrew Findlay 30 Sep '13

30 Sep '13

On Fri, Aug 09, 2013 at 05:53:57PM +0300, Zeus Panchenko wrote: > To: Andrew Findlay <andrew.findlay(a)skills-1st.co.uk> Please keep replies on the list so that they become searchable and everyone can benefit. > here is the diagram depicting what I am thinking about while talking :) > > https://www.dropbox.com/s/212kdpbiug9obkc/org-ldap-diagram-plane.png > I dedicate these DN-s for services, so each such DN *can and supposed to* > use any (in theory) uid in the entry, the user can ask for Do you reall want every user account on every service to have a different username? (i.e. the user cannot request to be known as 'fred' on both the SMTP service and the IMAP service? > in particular, I do not see another way to authenticate users of > different domains(for email)/realms(for xmpp) against the same LDAP DB That depends on how you provide the services. If the network address of the services used by domain-A users is different from that used by domain-B users then the server processes will know which domain they are serving. If the same network address is used to serve all domains then you do indeed require the uids to be unique across domains (but you probably do want to let fred(a)x.y.com use that ID for all services). > > It may be enough for you to simply prevent the non-uniqueness. You can > > do that using the 'unique' overlay: > > mmm ... will not it prevent non-uniqueness only for parent DN-s? while > what I'm trying to ask (I'm sorry for muddled up explanation what I mean) > about is - uniqueness for the uid *in* the entry ... so, the uniqueness > of the attribute `uid' among all DN-s containing authorizedService=target-service You could do that if you are prepared to have one config line for each service. Something like: overlay unique unique_uri ldap:///ou=People,dc=org?uid?sub?(authorizedService=SMTP) unique_uri ldap:///ou=People,dc=org?uid?sub?(authorizedService=IMAP) unique_uri ldap:///ou=People,dc=org?uid?sub?(authorizedService=POP3) unique_uri ldap:///ou=People,dc=org?uid?sub?(authorizedService=XMPP) unique_uri ldap:///ou=People,dc=org?uid?sub?(authorizedService=SSH) Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

3 7

Building LMDB for Windows 64bits
by Alain 29 Sep '13

29 Sep '13

I am not an expert at this, so I might be doing things incorrectly. I used Mingw x86_64 to build LMDB (just changed the CC in the Makefile). I had an issue with srandom and random in the test programs and switch to rand instead. Now I can build successfully and make test runs mtest successfully. Now if I try one of the other mtest[2-5] or mtest itself, I get sporadic segmentation fault. If I wait long enough it will always work, but running the programs in a kind of loop guarantees a seg fault error. I wanted to try running with gdb but it seems that it doesn't ship with cygwin for Mingw. Using standard gdb gives me a 193 error. Again this is getting past my expertise here. Has anyone successfully build LMDB for Windows and can help here. Cheers, Alain

3 4

Re: Re: Slapd permission issues
by Gary Slopsema 28 Sep '13

28 Sep '13

> I guess AppArmor is blocking you. If I'm right, dmesg(1) will show some > audit messages that confirm it. Look at /etc/apparmor.d/usr.sbin.slapd > for the rules it follows. You are correct. > You could work around AppArmor, either by copying or hard-linking > /usr/sbin/slapd somewhere else and running it from there, This works perfectly. Thanks very much!

1 0

Changing domain name
by Jukka Tuominen 28 Sep '13

28 Sep '13

Hi all, I'm in the process of changing the domain name of a kerberos/openafs/openldap server on ubuntu 10.04 LTS. ldap provides the user metadata such as homedir location, user and group id, etc. The server itself remains the same as well as the IP number. Actually I cloned it, so I can still access the old, working instance (only one server running at any time, since the IP is the same). I followed instructions telling to 1) export the old data... slapcat -v -l ldap.diff 2) replace the old domain instances with the new ones using gedit 3) remove the old data rm -rf /var/lib/ldap/* 4) import the updated data back slapadd -l new-ldap.diff 5) and restore dir permissions chown -R openldap:openldap /var/lib/ldap/* However, whereas the export went seemingly fine, importing and manipulating the new data required to point the specific slapd.conf file. E.g. slapadd or slapindex without -f /etc/ldap/slapd.conf would raise an error: Available database(s) do not allow [action]. Basic commands like id, ldapsearch -x or slapcat return empty content without errors. All the /etc/ .confs have been updated, and should point to the new domain name. Any idea what could cause this and how to fix it? br, jukka

2 3

Re: Synchronous or asynchronous replication
by Stephan Fabel 28 Sep '13

28 Sep '13

On Friday, September 27, 2013 11:07:48 PM Quanah Gibson-Mount wrote: > Again, you need to run a current release if you want to do MMR. Period. No > amount of tuning the DB is going to fix this particular problem. If building debs is the issue, Symas offers supported ones. Just sayin'... -Stephan

1 0

Synchronous or asynchronous replication
by espeake＠oreillyauto.com 28 Sep '13

28 Sep '13

We have a 3 node N-Way Multi master set running 2.4.31. I have been looking and trying to find a way to have asynchronous replication because synchronous replication is not required and we believe is actually slowing us down. I read in one article that by default n-way multi-master was doing asynchronous replication. But then another article kind of mucked that up. I ran through all of my db files with db_stat to get the internal pages and page size to be sure that my DB_Config was set with a large enough paging space and from my calculations it has more than enough. Not enough to cache the entire db, but enough. So how can I be sure that we are using asynchronous replication with the n-way mulri master configuration. Thank you, Eric Speake Web Systems Administrator O'Reilly Auto Parts This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

2 5

Password Policy Overlay Logging
by Fuhs, David 28 Sep '13

28 Sep '13

We implemented the password policy overlay for the purpose of enabling automatic account lockouts after a certain number of failed binds during a certain time span. Testing shows it works as expected, however it does no logging no matter what loglevel I set. Management would like to know how often automated lockouts are occurring, on which accounts, and where the connections are coming from (i.e., normal connection logging records the IP address). Is there any way to make this happen without having to directly query the underlying database (do you have an example query for that?) or run a cron job every minute to search on an attribute (pwdAccountLockedTime) that rarely shows up in a user record (such a search maxes out CPU)? If this is not possible currently, is there some way to make this an enhancement request for a future release? Any suggestions appreciated. Thanks. David

1 0

Slapd permission issues
by Gary Slopsema 27 Sep '13

27 Sep '13

Hello, I'm trying to run slapd as a non-root user and am having difficulties. As part of a test suite for a library I'm working on, I'd like to automate starting and stopping slapd with various configs, with relatively-pathed config files, etc. I'm having an issue running slapd with a custom config "slapd.conf" that's not located at /etc/ldap/slapd.conf. Example: ==================== vagrant@lucid64:~/slapd$ pwd /home/vagrant/slapd vagrant@lucid64:~/slapd$ ls -l total 8 drwxr-xr-x 2 vagrant vagrant 4096 2013-09-27 21:14 schema -rw-r--r-- 1 vagrant vagrant 440 2013-09-27 21:15 slapd.conf vagrant@lucid64:~/slapd$ sudo slapd -h ldap://localhost:10000 -d 2048 -f slapd.conf @(#) $OpenLDAP: slapd 2.4.21 (Dec 19 2011 15:40:04) $ buildd@allspice:/build/buildd/openldap-2.4.21/debian/build/servers/slapd could not open config file "slapd.conf": Permission denied (13) slapd stopped. connections_destroy: nothing to destroy. ==================== The problem is with the "Permission denied": why can't slapd read slapd.conf? But if I copy the same slapd.conf to /etc/ldap, I get ==================== vagrant@lucid64:~/slapd$ ls -l /etc/ldap/ total 20 -rw-r--r-- 1 root root 245 2011-12-19 17:19 ldap.conf drwxr-xr-x 2 root root 4096 2011-12-19 17:19 sasl2 drwxr-xr-x 2 root root 4096 2013-09-27 20:26 schema -rw-r--r-- 1 root root 440 2013-09-27 21:21 slapd.conf drwxr-x--- 3 openldap openldap 4096 2013-09-27 20:26 slapd.d vagrant@lucid64:~/slapd$ sudo slapd -h ldap://localhost:10000 -d 2048 -f /etc/ldap/slapd.conf @(#) $OpenLDAP: slapd 2.4.21 (Dec 19 2011 15:40:04) $ buildd@allspice:/build/buildd/openldap-2.4.21/debian/build/servers/slapd could not stat config file "./core.schema": No such file or directory (2) slapd stopped. connections_destroy: nothing to destroy. ==================== which doesn't run (I have relative schema directives in the config file) but at least slapd can read the file. Note that using an absolute path in the first example has the same result; feeding in a non-existent file gives a different error ("could not stat"). Also, I'm using sudo above just to ease things along; eventually it'll run as a normal user. I'm running Ubuntu Lucid 64-bit. Am I missing something obvious? Thanks, Gary

2 1

cn=config chaining
by Jancewicz, Russell 26 Sep '13

26 Sep '13

Hello, I have been trying to configure my slave ldap servers to send changes to the master servers. >From what I have been able to understand from previous mailing lists and various google searches I need to configure and olcUpdateref on the salve and then add the chaining overlay (I think it should be on the olcDatabase{-1}frontend database from everything I have read however slaptest using openldap-2.4.36 slapd-chain2.conf as the seed generates the overlay atop of the declared database…) Everything I have been trying results in a failure: ldap_modify: Server is unwilling to perform (53) additional info: operation restricted I cannot for the life of me figure out what needs to be done to enable this. Any help would be appreciated, my ldifs are included below. -Russell J. Jancewicz University of Connecticut dn: olcDatabase={1}mdb,cn=config … olcUpdateref: ldap://master.example.com … dn: olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config objectClass: olcOverlayConfig objectClass: olcChainConfig olcOverlay: {0}chain olcChainCacheURI: FALSE olcChainMaxReferralDepth: 1 olcChainReturnError: FALSE dn: olcDatabase=ldap,olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config objectClass: olcLDAPConfig objectClass: olcChainDatabase olcDatabase: ldap olcDbURI: "ldap://master.example.com" olcDbStartTLS: start starttls=no olcDbIDAssertBind: mode=self flags=prescriptive,proxy-authz-non-critical bindmethod=simple timeout=0 network-timeout=0 binddn="cn=admin,dc=example,dc=com" credentials="<SECRET>" keepalive=0:0:0 olcDbIDAssertAuthzFrom: * olcDbRebindAsUser: FALSE olcDbChaseReferrals: TRUE olcDbTFSupport: no olcDbProxyWhoAmI: FALSE olcDbProtocolVersion: 3 olcDbSingleConn: FALSE olcDbCancel: abandon olcDbUseTemporaryConn: FALSE olcDbConnectionPoolMax: 16 olcDbSessionTrackingRequest: FALSE olcDbNoRefs: FALSE olcDbNoUndefFilter: FALSE olcDbOnErr: continue olcDbKeepalive: 0:0:0

3 6

Other system use port 636 connect LDAP Server Error
by Tian Zhiying 26 Sep '13

26 Sep '13

Hi In ldap server(localhost) , I execute the below command , it ok. # ldapsearch -x -b 'ou=people,dc=mydomain,dc=com' -D "cn=interface,dc=mydomain,dc=com" -H ldaps://192.168.1.10 -W But in other linux system is not ok, below is the error info: # ldapsearch -x -b 'ou=people,dc=mydomain,dc=com' -D "cn=interface,dc=mydomain,dc=com" -H ldaps://192.168.1.10 -W ldap_bind: Can't contact LDAP server (-1) additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed LDAP Server is Centos 5.8 64 OS, iptables serverice is closed state. What is the cause? You have any Suggestions? Thanks. Tian Zhiying

5 7

contextCSN values and MMR
by Michael Ströder 26 Sep '13

26 Sep '13

HI! Are contextCSN values on all replicas really in sync if changes were correctly replicated? I've implemented a monitoring check used with normal MMR setup (OpenLDAP 2.4.35, own build on Debian Squeeze) which also checks the contextCSN values on all replicas compared by server-id. Sometimes we observe, even in isolated tests, that contextCSN values for a certain server-id differ for quite a while (up to hours) even though the changes coming from that server were definitely replicated to all other replicas. After a while the contextCSN values get suddenly updated. Unfortunately this does not always happen. Any hint is highly appreciated. Ciao, Michael.

4 19

RE: openldap-technical Digest, Vol 70, Issue 20
by Sotomayor, Vicente (ITD) 26 Sep '13

26 Sep '13

>Message: 12 >Date: Thu, 26 Sep 2013 16:35:38 +0800 >From: "Tian Zhiying" <tianzy1225(a)thundersoft.com> >To: openldap-technical <openldap-technical(a)openldap.org> >Cc: tianzy1225 <tianzy1225(a)thundersoft.com> >Subject: Other system use port 636 connect LDAP Server Error >Message-ID: <2013092616353831259123(a)thundersoft.com> >Content-Type: text/plain; charset="us-ascii" >Hi >In ldap server(localhost) , I execute the below command , it ok. ># ldapsearch -x -b 'ou=people,dc=mydomain,dc=com' -D "cn=interface,dc=mydomain,dc=com" -H ldaps://192.168.1.10 -W >But in other linux system is not ok, below is the error info: ># ldapsearch -x -b 'ou=people,dc=mydomain,dc=com' -D "cn=interface,dc=mydomain,dc=com" -H ldaps://192.168.1.10 -W >ldap_bind: Can't contact LDAP server (-1) > additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed >LDAP Server is Centos 5.8 64 OS, iptables serverice is closed state. What is the cause? >You have any Suggestions? Thanks. Because the telnet test worked then I would look at your client config files on that hosts in addition to seeing if the file size/permission of the cert matches the size on the other client that is working. Also try ldapsearch -x -d 1 and see what the output shows.

1 0

Re: SSL replication deadlocks slapd
by Chad Scott 26 Sep '13

26 Sep '13

Message definitely received. =) I've actually discovered http://ltb-project.org/... Any thoughts on how reputable their build is? On Wed, Sep 25, 2013 at 3:24 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Wednesday, September 25, 2013 2:32 PM -0700 Chad Scott < > cscott(a)appdynamics.com> wrote: > > >> Definitely not an entropy problem. I see "ACCEPT" in the logs, but >> nothing else. >> >> >> I hadn't realized RedHat was so damn behind. I'm going to generate a >> custom package with the latest version and see if the problem goes away. >> > > Note that RedHat links to its own broken SSL implementation MozNSS. I > don't know if Scientific linux went the same route or not, which is why I > (again) recommend linking (sanely) to a current version of OpenSSL. > > > --Quanah > > -- > > Quanah Gibson-Mount > Lead Engineer > Zimbra Software, LLC > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

SSL replication deadlocks slapd
by Chad Scott 26 Sep '13

26 Sep '13

I'm having a lot of trouble with replication when using SSL. If I configure everything exactly the same without SSL, it works flawlessly. The instant I try to encrypt traffic, one or both servers will deadlock, even after restart. I'm configuring according to the instructions at http://www.openldap.org/doc/admin24/replication.html#N-Way Multi-Master, except using ldaps:// instead of ldap://. In cn=config, I've setup: olcTLSCACertificateFile: /etc/openldap/certs/Operations_CA_Certificate.pem olcTLSCertificateFile: /etc/openldap/certs/ldap.pem olcTLSCertificateKeyFile: /etc/openldap/certs/ldap.key I've also tried using STARTTLS over ldap:// and it seems to make no difference. Permissions are right and I can connect via SSL from clients without issue. I'm completely stumped as to what might be going on. Has anyone seen this before? This is running on Scientific Linux 6 with the following packages: openldap-2.4.23-32.el6_4.x86_64 openldap-clients-2.4.23-32.el6_4.x86_64 openldap-servers-2.4.23-32.el6_4.x86_64

3 4

Schema With Multi Part Attribute
by Bram Cymet 26 Sep '13

26 Sep '13

Hi, I am wondering if it is possible to create a schema with a multi part attribute. In other words I want the value of the attribute to be a dictionary. For example I would have an attribute called "Application" which would have a value of: {"name" : "Application Name", "active" : <True or False>} The other way I was thinking about doing this was to just have a multi value string attribute that would be the names of the "applications" and if there was an entry then that "application" is active but the dictionary way just seems cleaner to me. If this is possible an example of how to define the schema entry or a link to an RFC would be helpful. Thanks, -- Bram Cymet Software Developer Canadian Bank Note Co. Ltd. 613-608-9752

2 3

Access being denied.
by espeake＠oreillyauto.com 24 Sep '13

24 Sep '13

I know this has to be super simple in what I am missing. My ldapadmin account cannot write to the database due to insufficient privileges.. This is the ACL part of the ldif file. Version 2.4.31 and this is from olcDatabase={1}hdb.ldif olcAccess: {0}to attrs=userPassword by dn="uid=admin,dc=oreillyauto,dc=com" wr ite by anonymous auth by self write by * none olcAccess: {1}to dn.subtree="" by * read olcAccess: {2}to * by dn="uid=admin,dc=oreillyauto,dc=com" write by dn="uid=ld apadmin,ou=System,dc=oreillyauto,dc=com" write by * read olcAccess: {2} for ldap admin actually be 'dn.base="uid=ldapadmin,ou-System, dc=<domain>,dc=com" write'? Thanks Eric Speake Web Systems Administrator O'Reilly Auto Parts This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

2 4

Fw: Access being denied.
by espeake＠oreillyauto.com 24 Sep '13

24 Sep '13

Eric Speake Web Systems Administrator O'Reilly Auto Parts ----- Forwarded by Eric Speake/OReilly on 09/24/2013 06:31 AM ----- From: Eric Speake/OReilly To: Jason Brandt <jbrandt(a)fsmail.bradley.edu> Cc: openlda-technical(a)openldap.org Date: 09/24/2013 06:16 AM Subject: Re: Access being denied. From: Jason Brandt <jbrandt(a)fsmail.bradley.edu> To: espeake(a)oreillyauto.com Cc: "openldap-technical(a)OpenLDAP.org" <openldap-technical(a)openldap.org> Date: 09/23/2013 03:26 PM Subject: Re: Access being denied. I hope this doesn't confuse you too much... First off... Your admin account will be dn="cn=admin,dc=oreillyauto,dc=com", if you are talking about the default admin account. You also want manage instead of write. I would also recommend securing your admin account with access lists, only allowing access from specific manager IP addresses. In order to restrict the cn=admin account as I do below, you have to set the userPassword attribute for the admin account, and blank the olcRootPW. set admin password: dn: cn=admin,dc=bradley,dc=edu changeType: modify add: userPassword userPassword: {SSHA}<passwordhash> blank old olcRootPW dn: olcDatabase={1}hdb,cn=config changetype: modify delete: olcRootPW This allows use of the normal authentication process and will look at your access lists. Otherwise, it will always bypass access lists and use the olcRootPW to authenticate. Here's how I handle access restrictions, which I would suggest you evaluate. This is a positive security model as well (meaning the default action is deny), which I highly recommend (ie no one can access any field, unless it's specifically defined). The downside to the positive security model is that it's less flexible, you have to whitelist any new attributes you wish users to access, but it provides you with the best security. Another note in this, is that my user accounts are all shadowAccounts, and setting shadowInactive to 1 disables the account. (handled by the 3rd section with password fields). Here is my access list in a template form: dn: olcDatabase={1}hdb,cn=config changetype: modify replace: olcAccess # limit access to directory manager to local host only and specific manager ip's olcAccess: to dn.base="cn=admin,dc=,dc=" by peername.ip=127.0.0.1 auth by sockurl=ldapi:/// auth by peername.ip=<manager IP> auth by users none by anonymous none #Allow admin users full access to all attrs #Allow OpenLDAP2 Sync User read access to all #Everyone else, continue olcAccess: to * by peername.ip=172.16.0.0%255.255.0.0 dn="uid=adminuser,dc=,dc=" manage by peername.ip=<secondary ldap server ip> dn="uid=syncuser,ou=Service_Logins,dc=,dc=" read by peername.ip=<third ldap server ip> dn="uid=syncuser,ou=Service_Logins,dc=,dc=" read by * break #Handle password fields, for all possible entities. No further processing for these attributes olcAccess: to attrs=userPassword,shadowLastChange filter= (&(objectClass=shadowAccount)(!(shadowInactive=1))) by self =w by sockurl=ldapi:/// auth by peername.ip=172.16.0.0%255.255.0.0 auth by peername.ip=127.0.0.1 group.exact="cn=localadmingroup,dc=,dc=" manage by group.exact="cn=admingroup,dc=,dc=" write by * none #Specific processing for an Account #Everyone else, continue olcAccess: to attrs=attr1,attr2 by dn="uid=account1,ou=Service_Logins,dc=,dc=" read by * break #Specific processing for a Group #Everyone else, continue olcAccess: to attrs=attr3,attr4 by group.exact="cn=group1,out=Group,dc=,dc=" manage by * break #Handle SELF writable fields #Everyone else, continue olcAccess: to attrs=loginShell,mailRoutingAddress,additionalattrs by self write by * break #Handle more restrictive fields #Stop processing on match olcAccess: to attrs=audio,attr5,attr6,attr7 filter=(&(matchTrue=1)(objectClass=Person)) by * none #Handle Anonymous Allowed fields #Stop Processing on Match olcAccess: to attrs=attr8,attr9,attr10 by * read #Handle User Allowed Fields #Stop Processing on Match olcAccess: to dn.subtree="dc=,dc=" attrs=audio by users read #Hide additional superuser accounts in directory olcAccess: to attrs=entry filter=(|(ou=Service_Logins)(uid=logins)) by * none #Allow access to specific objectclasses olcAccess: to filter=(| (objectClass=nisDomainObject)(objectClass=nisNetGroup)(objectClass=posixGroup)(objectClass=groupOfUniqueNames)(objectClass=organizationalUnit)) by * read #Allow access to directory entries. Required to query directory when using default deny policy olcAccess: to dn.subtree="dc=,dc=" attrs=entry,objectClass by * read #Default Deny olcAccess: to * by * none Jason, Thanks for the layout and I will take this to my bosses. I might have to group the servers because we have several servers that access the out LDAP servers and by IP address would be a little cumbersome to manage. We use somewhere in the range of 140 different applications on our internal network and accessed by our stores across the country. so we use different accounts to do different types of access depending on the application so we don't use just one admin account and this works on the old LDAP server running 2.4.21 But when I try to replicate the ACL's it has, nothing works. so for the time being I have simplified as recommended by this community and then I will work on tightening down the reigns. Right now I need to figure out why my ldapadmin account doesn't have write permissions in accordance with my ACL on the servers. Is it as simple as a syntax issue. The other issue I mentioned is starting to get a little annoying in the fact that I cannot seem to modify my config. The changes don't happen but the modify timestamp changes. I can deal with that issue later. Right now I need to get this user working. Thanks, Eric Speake Web Systems Administrator O'Reilly Auto Parts. On Mon, Sep 23, 2013 at 12:08 PM, <espeake(a)oreillyauto.com> wrote: I know this has to be super simple in what I am missing. My ldapadmin account cannot write to the database due to insufficient privileges.. This is the ACL part of the ldif file. Version 2.4.31 and this is from olcDatabase={1}hdb.ldif olcAccess: {0}to attrs=userPassword by dn="uid=admin,dc=oreillyauto,dc=com" wr ite by anonymous auth by self write by * none olcAccess: {1}to dn.subtree="" by * read olcAccess: {2}to * by dn="uid=admin,dc=oreillyauto,dc=com" write by dn="uid=ld apadmin,ou=System,dc=oreillyauto,dc=com" write by * read olcAccess: {2} for ldap admin actually be 'dn.base="uid=ldapadmin,ou-System, dc=<domain>,dc=com" write'? Thanks Eric Speake Web Systems Administrator O'Reilly Auto Parts This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS § 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you. -- Jason K. Brandt Systems Administrator Bradley University (309) 677-2958 -- This message has been scanned for viruses and dangerous content, and is believed to be clean. Message id: A1B06600D64.A7776 This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS § 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

1 0

ldap dump filter
by val john 24 Sep '13

24 Sep '13

Hi guys i have openldap server with base url dc=ldap,dc=company,dc=com and our all the users are under ou=users,dc=ldap,dc=company,dc=com within that user base we have users with mail different mail address domains (gmail, yahoo.com , company.com ) by using command "slapcat -l user.ldiff" we can get entire dump of the openldap Is there any way to filter the slapcat dump so the i can get the dump file , only with users with "company.com" mail domain Please advice Thanks John

2 1

OpenLdap 2.4.28 accesslogs
by Steve Herrera 23 Sep '13

23 Sep '13

Hello, I have 2 openldap servers running on Ubuntu 12.04. One is the primary and the other is a slave. My problem is that ldap keeps dumping files into that directory log.00000000001 then log.000000002 and so on thus filling up the drive. Is it safe to remove these logs? How do i know which one it is still using. Ideally it would be great for the server to automatically remove the log once it was done using it. I could set up a cronjob to prune it but I don't know how far back it needs to the logs to be. Any ideas? Thanks

4 4

Wrong certificate being presented
by espeake＠oreillyauto.com 23 Sep '13

23 Sep '13

The authentication works on the single server we have which is running an older version of openLDAP (2.4.21). In my packet captures it appears that the older version of openLDAP is presenting the certificate we want it to present. The new version (2.4.31), although it has the same cert installed in the same place it is presenting an older self signed cert that has been removed. The new servers have been rebooted since this change so where could this possibly be cached at? This is from my slapcat of the new servers. dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/slapd/slapd.args olcAuthzPolicy: any olcPidFile: /var/run/slapd/slapd.pid olcServerID: 1 ldap://tntest-ldap-3.example.com olcServerID: 2 ldap://tntest-ldap-1.example.com olcServerID: 3 ldap://tntest-ldap-2.example.com olcThreads: 8 olcTLSCACertificateFile: /etc/ldap/gd_bundle.crt olcTLSCertificateFile: /etc/ldap/wildcard.example.com.crt olcTLSCertificateKeyFile: /etc/ldap/wildcard.example.com.key olcToolThreads: 1 structuralObjectClass: olcGlobal creatorsName: cn=config entryUUID: 91cc0ae0-9e13-1032-84b5-0151b658a842 createTimestamp: 20130820183919Z olcLogLevel: config acl stats conns olcTLSCipherSuite: NORMAL olcTLSCRLCheck: none olcTLSVerifyClient: never entryCSN: 20130923150907.574575Z#000000#001#000000 modifiersName: uid=admin,dc=oreillyauto,dc=com modifyTimestamp: 20130923150907Z contextCSN: 20130923150907.574575Z#000000#001#000000 contextCSN: 20130923150843.855673Z#000000#002#000000 contextCSN: 20130919185322.242639Z#000000#003#000000 I tried doing an ldapmodify and delete the olcTLSCipherSuite and olcTLSCRLCheck that I added and they will not disappear. Thanks Eric Speake Web Systems Administrator O'Reilly Auto Parts This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

1 1

Re: Invalid DN
by Justin Brown 19 Sep '13

19 Sep '13

Quanah, Thanks for the reply. That ended up being the problem. I figured the olcAccess line would allow anonymous searches, but I changed it to "to * by users read by users write" and actually created the cn=admin,dc=appName,dc=app simpleSecurityObject. Cheers, J On Thu, Sep 19, 2013 at 3:07 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, September 19, 2013 2:35 PM -0500 Justin Brown > <justin.brown(a)fandingo.org> wrote: > >> The problem is that I can't locate these objects using the ldap tools >> (ldapsearch and python-ldap). > > > You are doing anonymous searches. Likely you haven't granted anonymous > access to read these entries. > > Try ldapsearch -x -b "..." -D "..." -W > > with the values that are correct for your installation. > > --Quanah > > > -- > > Quanah Gibson-Mount > Lead Engineer > Zimbra Software, LLC > -------------------- > Zimbra :: the leader in open source messaging and collaboration

1 0

Invalid DN
by Justin Brown 19 Sep '13

19 Sep '13

Hello, I'm struggling to setup my Hdb database in OpenLDAP. I'm trying to create the entire directory from ldif files with cn=config. I have two initialization ldifs. The first one creates all the cn=config stuff, and also creates my Hdb database. The first file is too long to completely list here (I included core, cosine, nis, and inetorgperson schema ldifs.), but I'll put some excerpts here. dn: cn=config objectClass: olcGlobal cn: config ... dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema ... dn: cn={0}core,cn=schema,cn=config objectClass: olcSchemaConfig cn: {0}core ... (There are lots more for the other included schemas. I also have three custom objectClasses in cn=schema,cn=config, and one custom attributeType there, too.) The file finishes with the database configurations. dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend ... dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by * none olcRootDN: cn=config olcRootPW: secret ... dn: olcDatabase={1}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcSuffix: dc=appName,dc=app olcDbDirectory: /var/lib/ldap olcRootDN: cn=admin,dc=appName,dc=app olcRootPW: secret olcAccess: to * by * write by * read ... This file runs successfully with slapadd: sudo -u ldap slapadd -l init.ldif -F /etc/openldap/slapd.d -n0 The second file is very simple and just sets up the root objects in my database. dn: dc=appName,dc=app objectClass: top objectClass: dcObject objectclass: domain dc: addressbook dn: dc=directory,dc=appName,dc=app objectClass: top objectClass: domain dc: directory This also runs successfully with sudo -u ldap slapadd -l init2.ldif -F /etc/openldap/slapd.d -n1 Now if I use slapcat to view the directory, I see those objects: sudo slapcat 523b5022 hdb_monitor_db_open: monitoring disabled; configure monitor database to enable dn: dc=appName,dc=app objectClass: top objectClass: dcObject objectClass: domain dc: addressbook structuralObjectClass: domain entryUUID: 37f1bd06-b5ad-1032-824f-6ffc71c73dcf creatorsName: cn=admin,dc=appName,dc=app createTimestamp: 20130919192708Z entryCSN: 20130919192708.309183Z#000000#000#000000 modifiersName: cn=admin,dc=appName,dc=app modifyTimestamp: 20130919192708Z dn: dc=directory,dc=appName,dc=app objectClass: top objectClass: domain dc: directory structuralObjectClass: domain entryUUID: 37f4023c-b5ad-1032-8250-6ffc71c73dcf creatorsName: cn=admin,dc=appName,dc=app createTimestamp: 20130919192708Z entryCSN: 20130919192708.324059Z#000000#000#000000 modifiersName: cn=admin,dc=appName,dc=app modifyTimestamp: 20130919192708Z The problem is that I can't locate these objects using the ldap tools (ldapsearch and python-ldap). ldapsearch -xb 'dc=addressbook,dc=app' gives result: 34 Invalid DN syntax text: invalid DN If I don't specify a base DN, then I get 32: No such object: ldapsearch -x '(objectClass=*)' # extended LDIF # # LDAPv3 # base <> (default) with scope subtree # filter: (objectClass=*) # requesting: ALL # # search result search: 2 result: 32 No such object Does anyone know why I cannot see my objects through the LDAP "interface?" My configuration seems entirely consistent with http://www.openldap.org/doc/admin24/slapdconf2.html. Thanks, J

2 1

PFS Ciphers
by manu＠netbsd.org 19 Sep '13

19 Sep '13

Hi I tried to use ciphers that bring PFS for OpenLDAP, but it did not work. I used this cipher specification: TLSCipherSuite ECDH:DH:!SHA:!MD5:!aNULL:!eNULL I test it this way: for i in `openssl ciphers ALL|tr ':' '\n'` ; do echo ''|openssl s_client -cipher $i -connect server:636 \ 2>/dev/null |awk '/ Cipher/{print }' ; done I get nothing. I understand ECDH needs some support code, but why aren't DH ciphers available? -- Emmanuel Dreyfus http://hcpnet.free.fr/pubz manu(a)netbsd.org

4 4

TLS negation failure
by espeake＠oreillyauto.com 19 Sep '13

19 Sep '13

We have a client server that is failing on the ssl handshake using TLS. The following is from the server log when the client is trying to connect. Sep 19 09:12:49 tntest-ldap-3 slapd[18796]: conn=3534 fd=28 ACCEPT from IP=172.17.1.10:55469 (IP=0.0.0.0:389) Sep 19 09:12:49 tntest-ldap-3 slapd[18796]: conn=3534 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Sep 19 09:12:49 tntest-ldap-3 slapd[18796]: conn=3534 op=0 STARTTLS Sep 19 09:12:49 tntest-ldap-3 slapd[18796]: conn=3534 op=0 RESULT oid= err=0 text= Sep 19 09:12:50 tntest-ldap-3 slapd[18796]: conn=3534 fd=28 closed (TLS negotiation failure) On the client when I run the following: openssl s_client -showcerts -connect tntest-ldap.oreillyauto.com:389 I get this on the client CONNECTED(00000003) 139669033973408:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:177: --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 0 bytes and written 226 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE If I do the same command on port 636 I can see the certificate. All of our applications that use ldap are all set for TLS. Even if I force them to port 636 they fail. Any ideas to look at are appreciated. Eric Speake Web Systems Administrator O'Reilly Auto Parts This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

2 2

auditing failed login attempts
by Paul B. Henson 18 Sep '13

18 Sep '13

Our security group is hassling us because we don't currently provide them an audit log of failed login attempts on our LDAP servers. For most of our other systems, we simply provide them a syslog feed with this information. However, openldap doesn't appear to have a logging level that provides detail about login attempts on a single line, but rather across many lines that would need to be correlated. It seems more like connection debugging logging as opposed to authentication logging. It looks like we might need to set up an accesslog overlay to log all of the attempted binds and then have a separate process that runs through that and generates the syslog feed to our ISO group's central logging server? That's a bit more overhead than I would like. Are there any other simpler ways of generating failed login logs? Thanks much.

5 8

Re: Multi-master setup in debian
by Listas de Correo 18 Sep '13

18 Sep '13

On Tue, Sep 17, 2013 at 9:49 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Tuesday, September 17, 2013 9:06 PM -0300 Listas de Correo < > toshiro.listas(a)gmail.com> wrote: > > Would you mind to provide me more details about the bugs and potential >> problems of using Debian packages? I'm not putting your statements in >> doubt, I just need to have solid and documented arguments to convince my >> boss that this extra work is really needed. >> > > Read the release notes for OpenLDAP: > > <http://www.openldap.org/**software/release/changes.html<http://www.openldap.org/software/release/changes.html> > > > > The FAQ from the Debian OpenLDAP package maintainers: > > <http://www.openldap.org/faq/**data/cache/1456.html<http://www.openldap.org/faq/data/cache/1456.html> > > > > The use of GnuTLS (What Debian links to instead of OpenSSL) is harmful: > > <http://www.openldap.org/lists/openldap-devel/200802/msg00072.html> > Ok, thanks for the info, I will look into it right away. I have an additional question about compiling from source: how do you handle upgrades? In Debian, I've just use apt-get upgrade, in the case of compiliing yourself, you just compile and then 'make install'? Is that enough or do you need to do any previous housekeeping? (I'm asking because I haven't found any mention of upgrade in the Administrator's Guide)

2 1

Re: Multi-master setup in debian
by Listas de Correo 18 Sep '13

18 Sep '13

Hi Quanah, On Tue, Sep 17, 2013 at 12:21 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > It is always interesting to me when someone emails the technical list, > asking for guidance from people who know the most about the software, and > then ignore it. I know what you mean, I've suffered that myself :) but there's a valid reason for trying to ignore your suggestion (that I explained in a previous message). > The Debian build of OpenLDAP is old, links to a potentially insecure SSL > implementation, and has a variety of known bugs present in it that are > known to affect replication, particularly multi-master. Understand that by > continuing to use the Debian package, you are essentially setting yourself > up for failure when looking at using Multi-Master Replication. > Would you mind to provide me more details about the bugs and potential problems of using Debian packages? I'm not putting your statements in doubt, I just need to have solid and documented arguments to convince my boss that this extra work is really needed. Thanks in advance for your help!

3 2

seeding memberOf attribute
by Paul B. Henson 18 Sep '13

18 Sep '13

We are looking at adding the memberOf overlay to an existing deployment. >From what I can tell, after the configuration on all of the servers has been updated, all of the members need to be removed and then re-added for all existing groups in order to get this new attribute populated? We have a lot of groups, with a lot of members; that's going to be quite a bit of churn. I just want to double check there wasn't a simpler/more efficient mechanism before I started down that path. Thanks much.

1 0

invalid syntax (21) error while importing password password policy
by Philip Bubel 17 Sep '13

17 Sep '13

Running OpenLdap 2.4.23 on Centos 6.4 and we are having truoble enabling password polices. I've read a number of FAQ's online, plus spent hours searching for a solution to this problem, although a lot of folks seem to have the same issue I haven't been able to find a solution that works for us. I run into trouble running ldapadd to import the new policy. I end up with the invalid syntax error I've included below, along with a copy of the .ldif file and my slapd.conf file. I was able to create the policies OU without issue, I also tried using the OID for pwdAttribute instead of userPassword. [root@asu10d schema]# ldapadd -D "cn=Manager,dc=XXXX,dc=test" -W -x -f /tmp/ppolicy.ldif Enter LDAP Password: adding new entry "cn=policy,ou=policies,dc=XXXX,dc=test" ldap_add: Invalid syntax (21) additional info: pwdAttribute: value #0 invalid per syntax Contents of policy.ldif n: cn=policy,ou=policies,dc=XXXX,dc=test cn: default objectClass: pwdPolicy objectClass: person objectClass: top pwdAllowUserChange: TRUE pwdAttribute: userPassword pwdCheckQuality: 2 pwdExpireWarning: 600 pwdFailureCountInterval: 30 pwdGraceAuthNLimit: 5 pwdInHistory: 5 pwdLockout: TRUE pwdLockoutDuration: 0 pwdMaxAge: 0 pwdMaxFailure: 5 pwdMinAge: 0 pwdMinLength: 5 pwdMustChange: FALSE pwdSafeModify: FALSE sn: dummy value Contents of my slapd.conf include /etc/openldap/schema/corba.schema include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/duaconf.schema include /etc/openldap/schema/dyngroup.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/java.schema include /etc/openldap/schema/misc.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/ppolicy.schema include /etc/openldap/schema/collective.schema include /etc/openldap/schema/samba.schema include /etc/openldap/schema/pmi.schema allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args modulepath /usr/lib64/openldap moduleload ppolicy.la TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt TLSCertificateFile /etc/pki/tls/certs/slapd.pem TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem database config access to * by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.exact="cn=Manager,dc=XXXX,dc=test" read by * none database bdb suffix "dc=XXXXX,dc=test" checkpoint 1024 15 rootdn "cn=Manager,dc=XXXX,dc=test" # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw hello (Temp password used for testing) overlay ppolicy policy_default "cn=default,ou=policies,dc=XXXX,dc=test" policy_use_lockout directory /var/lib/ldap # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub

6 21

RE: invalid syntax (21) error while importing password password policy
by Quanah Gibson-Mount 17 Sep '13

17 Sep '13

--On Tuesday, September 17, 2013 8:28 PM +0000 Sebastian Bianchi <Sebastian.Bianchi(a)zaisgroup.com> wrote: > Can anyone tell me how to get off this list? I can tell you a second time to stop hijacking threads. Read the email I sent you earlier about how to get removed. --Quanah -- Quanah Gibson-Mount Lead Engineer Zimbra Software, LLC -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Multi-master setup in debian
by Listas de Correo 17 Sep '13

17 Sep '13

Hi, I've "inherited" from a former sysadmin (among many other things) an LDAP server to administer :) ... it's installed on Debian 6.0; it's currently working ok but the company has another remote site now and wants to have a secondary LDAP server on the new location (in order to support the new remote users). Looking into the documentation I think the best configuration option is a N-way multi-master replication setup; unfortunately, I don't have experience with LDAP so I found difficult to implement this; I've found some good tutorials on the web but they're written for other versions of LDAP (for example, they use slapd.conf but on Debian, the configuration is in several directories under /etc/ldap/slapd.d). My big question is: ¿do you know of any resource (url link, book, whatever) that I can use as a reference to make this configuration? (in particular, I'd be more than happy if provides some examples in Debian). Of course, I'm willing to do my own work (study, research, etc) but I need some guidance regarding where to start (assume I have little LDAP knowledge). Thanks in advance for any help, tip, etc you may have!

7 9

Fwd: [GENERAL] Using LDAP for PostgreSQL permissions/authentication
by Stephan Fabel 17 Sep '13

17 Sep '13

Found on the Postgres mailing list... seems like some folks like to do user provisioning with config management tools rather than LDAP. I don't agree with the guy, but he does point out one issue that I find interesting, which is the absense of a "history" of sorts. Are you guys thinking of some sort of "snapshotting" / COW feature? Would something like that even make sense? -Stephan ---------- Forwarded message ---------- From: Stephen Frost Date: Fri, Sep 13, 2013 at 10:29 AM Subject: Re: [GENERAL] Using LDAP for PostgreSQL permissions/authentication Cc: pgsql-general(a)postgresql.org * Bill Moran wrote: > As documented, LDAP solves a few of the problems we have -- since everyone > will be in LDAP, we can use LDAP's password complexity rules and password > expiration to handle those security requirements, and (of course) when > someone changes their password, they don't have to remember to change it > on every server ... these are big wins. Better is to use Kerberos, imv. It's what AD does. > But it doesn't help with the headache of creating the accounts on all the > servers, or dropping them as part of employee termination procedures, or > doing security audits, or changing permissions on multiple servers when > an employee gets a promotion, etc. Nope; I'd use puppet or chef or something along those lines to deal with this aspect, much as I'd do with Unix accounts. Using nsswitch and tying every user name look up to LDAP has certain.. drawbacks. > Thus, when I go to log in as wmoran, LDAP checks my password, then informs > PostgreSQL to allow me in with specified roles, and I can do operations > granted to those roles. That's a little over-simplistic, isn't it? What about objects which are created by the 'wmoran' account? > Obviously, that's not how it works now ... my question is why not? Is it just > a matter of nobody's gotten to it yet, or are there issues that make such > an implementation difficult/troublesome/impossible? If it's possible, does > anyone have any concept of how hard it would be to implement? My gut feeling on this is 'pretty darn hard' and 'not sure there are many who really want it'. That last particularly because tools like puppet and chef exist and solve this problem in a better way, imv anyway, than LDAP. Back in the day, I was a big proponent of LDAPv3 and all of the nice things it did, but the complexities involved in "what happens when the network goes away" grew tiring and managing accounts through a config management system which also tracks history of changes, both to the master repo and to the individual systems, wins hands down. Thanks, Stephen ----------------------------------------

3 2

RE: unsubscribe
by Quanah Gibson-Mount 17 Sep '13

17 Sep '13

--On Tuesday, September 17, 2013 4:04 PM +0000 Sebastian Bianchi <Sebastian.Bianchi(a)zaisgroup.com> wrote: > How can I unsubscribe from this list? It is going to > Ryan.Palamara(a)zaisgroup.com and he is no longer with the company. This first thing you should never do is hijack a thread. You can read over <http://www.openldap.org/lists/> for information about the lists. Which, for example, can take you to <http://www.openldap.org/lists/mm/listinfo/openldap-technical> and then you can get the information on how to contact the moderator if you can't force unsubscribe your old employee. --Quanah -- Quanah Gibson-Mount Lead Engineer Zimbra Software, LLC -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

openldap mods check attributetype undefined
by Chandrashekar Kola 17 Sep '13

17 Sep '13

Hello All, We have a openldap 2 nodes running on mirrormode set up. We recently added a new attributetype, after that we are seeing this message on slave node. And i can see the Attributype from ApacheDirectory studio on Masternode but not on slave node. syncrepl_message_to_entry: rid=001 mods check (userid: attribute type undefined) Both the nodes have the same schema file and both are running on openldap 2.4 version. Does anybody get into this issue. *Thanks, * *Chandu *

2 1

Re: ldap replication getting lost
by Ashok Kumar Shah 16 Sep '13

16 Sep '13

Thanks. yup i will upgrade to the latest stable. ~Ashok On Mon, Sep 16, 2013 at 9:48 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Saturday, September 14, 2013 2:00 PM +0530 Ashok Kumar Shah < > ashok.shah(a)flipkart.com> wrote: > > Openldap Version: 2.4.23 >> > > Your issue was known fixed in a later release. I would suggest, as I > repeatedly do, that you use a current build. > > > --Quanah > > > -- > > Quanah Gibson-Mount > Lead Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

ldap replication getting lost
by val john 16 Sep '13

16 Sep '13

Hi guys im running simple ldap replication setup , ldap slave node sites behind the firewall and port 389 is open to all and my ldap replication works fine for most of the time , (slave node getting updated real time ) But some times slave just stop getting the update from the master server , But when is restart slave ldap server replication start again , .... as fallows Aug 21 11:59:24 ldapmirror slapd[18107]: do_syncrep2: rid=004 cookie=rid=004,sid=002,csn=20130821160107.813479Z#000000#002#000000 Aug 21 11:59:24 ldapmirror slapd[18107]: syncrepl_entry: rid=004 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_MODIFY) Aug 21 11:59:24 ldapmirror slapd[18107]: <= bdb_equality_candidates: (entryUUID) not indexed Aug 21 11:59:25 ldapmirror slapd[18107]: syncrepl_entry: rid=004 be_search (0) Aug 21 11:59:25 ldapmirror slapd[18107]: syncrepl_entry: rid=004 uid=user1,ou=staff,dc=example,dc=com Aug 21 11:59:25 ldapmirror slapd[18107]: slap_queue_csn: queing 0xcc1060 20130821160107.813479Z#000000#002#000000 Aug 21 11:59:25 ldapmirror slapd[18107]: slap_graduate_commit_csn: removing 0xcc0a40 20130821160107.813479Z#000000#002#000000 Aug 21 11:59:25 ldapmirror slapd[18107]: syncrepl_entry: rid=004 be_modify uid=user1,ou=staff,dc=example,dc=com (0) Aug 21 11:59:25 ldapmirror slapd[18107]: slap_queue_csn: queing 0xcc1060 20130821160107.813479Z#000000#002#000000 Aug 21 11:59:25 ldapmirror slapd[18107]: slap_graduate_commit_csn: removing 0x1a55a70 20130821160107.813479Z#000000#002#000000 Ldap slave configuration .. syncrepl rid=004 provider=ldap://ldap.example.com bindmethod=simple binddn="cn=admin,ou=staff,dc=example,dc=com" credentials="passwd" searchbase="dc=example,dc=com" schemachecking=off type=refreshAndPersist retry="60 +" mirrormode on Is there any reason for such behavior , Please advice Thank You John

5 5

Attributes rewriting
by Vitaliy Aleksandrov 16 Sep '13

16 Sep '13

Hello, List I've been trying to find a working example to understand how slapo-rwm, slapd-meta and slapd-relay work for the last 3 days with no success. I just need to substitute one attribute by another for a single LDAP user. Lets say I have a posixAccount Object with cn = user1 as shown below. dn: uid=user1,ou=People,dc=localnet uid: user1 cn: user1 objectClass: account objectClass: posixAccount objectClass: shadowAccount ..... Also I have two LDAP users (organizationalRole): admin. simpleuser. I want to configure openldap in a way which allows "simpleuser" to make queries using "(description=user1)" instead of ("cn=user1") to find previously mentioned user object. The only thing I was able to configure is the suffixmassage, but can't find a way how to add rwm-map to my configuration. Could somebody point me to the working example.

1 1

slapd.conf deprecate as of 2.5?
by Daniel Jung 16 Sep '13

16 Sep '13

Hi, Quick search through the list shows that slapd.conf will not be supported as of 2.5? Is this still the case? When can we expect 2.5 minor release? Thanks for your answer in advance.

1 0

All Data Deleted on Slapd Restart
by Justin Brown 13 Sep '13

13 Sep '13

Hello, I'm new to using OpenLDAP, and I'm having some trouble finding my way on 2.4 with cn=config. After a lot of trial and error, I finally got the initial ldif files setup to initialize the directory. I'll post the configurations below. One of the peculiarities of my Fedora system is that it does not read my slapd.conf, which contains the initial admin password (for cn=admin,cn=config). Therefore, I manually launch slapd -f /etc/openldap/slapd.conf... and run my ldifs. That works great, and I setup regular user accounts. So far so good. Now that I'm done with initialization, I want to stop slapd and start it up with my service manager (systemd). I issue a `killall slapd` (no SIGKILL) or ^C if running with "-d 0" to stop the console session. There are no error messages. Upon restart (either systemd or on the same console), the whole directory is wiped out and reverted back to default. Again, no errors in the system logs, and the only messages are slapd starting and any Apache Directory Studio or ldapsearch queries that I perform. I have tripled checked all of the file permissions (and SELinux contexts) in /etc/openldap and /var/lib/ldap and cannot find any errors. Could someone help me figure out why my data is purged on restart? Here are the ldif files and commands that I run. Slapd from console slapd -f /etc/openldap/slapd.conf -u ldap -d 0 1) Load the schemas for i in $(ls /etc/openldap/schema/*.ldif); do ldapadd -x -f $i -D "cn=admin,cn=config" -w secret; done 2) Load the "backend" config ldapadd -f /tmp/backend.ldif -D "cn=admin,cn=config" -x -w secret dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulepath: /usr/lib/ldap olcModuleload: back_hdb dn: olcDatabase=hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcSuffix: dc=my-application,dc=app olcDbDirectory: /var/lib/ldap olcRootDN: cn=admin,dc=my-application,dc=app olcRootPW: secret olcDbConfig: set_cachesize 0 2097152 0 olcDbConfig: set_lk_max_objects 1500 olcDbConfig: set_lk_max_locks 1500 olcDbConfig: set_lk_max_lockers 1500 olcDbIndex: objectClass eq olcLastMod: TRUE olcDbCheckpoint: 512 30 olcAccess: to attrs=userPassword by dn="cn=admin,dc=my-application,dc=app" write by anonymous auth by self write by * none olcAccess: to attrs=shadowLastChange by self write by users read olcAccess: to dn.base="" by users read olcAccess: to * by users write by users read I know that those olcAccess rules aren't great, and I plan to fix them once I get past this problem. 3) "Frontend" Config ldapadd -f /tmp/frontend.ldif -D "cn=admin,dc=addressbook,dc=app" -x -w secret dn: dc=my-application,dc=app objectClass: top objectClass: dcObject objectclass: domain dc: addressbook dn: cn=admin,dc=my-application,dc=app objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator userPassword: secret dn: dc=directory,dc=my-application,dc=app objectClass: top objectClass: domain dc: directory Thanks, Justin

1 0

Re: OLC (online config error)
by pramod kulkarni 12 Sep '13

12 Sep '13

Thanks for the reply I added the core.schema include ./schema/core.schema include ./schema/cosine.schema include ./schema/nis.schema include ./schema/inetorgperson.schema include ./schema/openldap.schema include ./schema/dyngroup.schema database config rootdn cn=admin,cn=config rootPw secret but I am still getting the same error of invalid argument as shown below 52313ad6 ldif_write_entry: could not put entry file for "cn=config" in place: Invalid argument 52313ad6 config_build_entry: build "cn=config" failed: "(null)" 52313ad6 backend_startup_one (type=config, suffix="cn=config"): bi_db_open failed! (-1) slap_startup failed (test would succeed using the -u switch) is their anything I am missing here in slaptest function slapd -T test -f slapd.conf -F slapd.d waiting for your inputs On Wed, Sep 11, 2013 at 9:35 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Wednesday, September 11, 2013 2:48 PM +0530 pramod kulkarni < > pammu.kulkarni(a)gmail.com> wrote: > > >> I am trying to establish online config for openLDAP on windows but I am >> getting this below error how to make online config >> >> >> >> 5230324d ldif_write_entry: could not put entry file for "cn=config" in >> place: Invalid argument >> 5230324d config_build_entry: build "cn=config" failed: "(null)" >> 5230324d backend_startup_one (type=config, suffix="cn=config"): >> bi_db_open failed! (-1) >> >> >> my slapd.conf file >> >> >> >> database config >> rootdn "cn=admin,cn=config" >> rootPw config >> > > IIRC, you must at least include the core schema file > > --Quanah > > -- > > Quanah Gibson-Mount > Lead Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 2

LMDB compiling procedure
by Mónico Briseño 11 Sep '13

11 Sep '13

Hi, there. I just downloaded LMDB tarfile. I verified its folder content but I couldn't find any information of how can I use this files with Ldap. Any idea how to do it. TIA -- M.S. José M. Briseño Cortés Universidad de Guadalajara Instructional Technologist Univ. Houston Moodle Teacher Certificate NTCM, IACEP, iNACOL, ACM member

3 2

configure: error: BDB/HDB: BerkeleyDB not available
by Mónico Briseño 11 Sep '13

11 Sep '13

Hi, all. I decided to install openldap release 2.4.36 from tarball file with BerkeleyDB support. According openldap documentation I downloaded and installed Berkeley DB release 6.0 I configured the configure script as follows: CPPFLAGS="-I/usr/local/BerkeleyDB.6.0/include" LDFLAGS="-L/usr/local/BerkeleyDB.6.0/lib" export CPPFLAGS LDFLAGS ./configure --enable-sql Sadly, I have the following error: configure: error: BDB/HDB: BerkeleyDB not available Any idea? How I did wrong? TIA -- M.S. José M. Briseño Cortés Universidad de Guadalajara Instructional Technologist Univ. Houston Moodle Teacher Certificate NTCM, IACEP, iNACOL, ACM member

3 2

OLC (online config error)
by pramod kulkarni 11 Sep '13

11 Sep '13

I am trying to establish online config for openLDAP on windows but I am getting this below error how to make online config 5230324d ldif_write_entry: could not put entry file for "cn=config" in place: Invalid argument 5230324d config_build_entry: build "cn=config" failed: "(null)" 5230324d backend_startup_one (type=config, suffix="cn=config"): bi_db_open failed! (-1) my slapd.conf file database config rootdn "cn=admin,cn=config" rootPw config I did slapd test slapd -T test -f slapd.conf -F slapd.d waiting for your response Regards, Pramod

2 1

ppolicy I need help
by Jacques Foucry 10 Sep '13

10 Sep '13

Hello experts, I tried to enable ppolicy on a test openldap server. As I read I first create an OU policies with the default cn # LDIF Export for cn=default,ou=policies,dc=example,dc=com # Server: My Slave LDAP Server (ldap://localhost) # Search Scope: base # Search Filter: (objectClass=*) # Total Entries: 1 # # Generated by phpLDAPadmin (http://phpldapadmin.sourceforge.net) on September 10, 2013 2:10 pm # Version: 1.2.0.5 version: 1 # Entry 1: cn=default,ou=policies,dc=example,dc=com dn: cn=default,ou=policies,dc=example,dc=com cn: default objectclass: top objectclass: device objectclass: pwdPolicy objectclass: pwdPolicyChecker pwdallowuserchange: TRUE pwdattribute: userPassword pwdcheckmodule: mmc-check-password.so pwdcheckquality: 0 pwdexpirewarning: 600 pwdfailurecountinterval: 0 pwdgraceauthnlimit: 5 pwdinhistory: 5 pwdlockout: TRUE pwdlockoutduration: 0 pwdmaxage: 90 pwdmaxfailure: 5 pwdminlength: 8 pwdmustchange: TRUE pwdsafemodify: FALSE and add it to my base. I also added the ppolicy schema, the module load and the overlay include /etc/ldap/schema/ppolicy.schema moduleload ppolicy.la overlay ppolicy ppolicy_default "cn=default,ou=policies,dc=example,dc=com" ppolicy_hash_cleartext ppolicy_use_lockout In /etc/ldap/ldap.conf I change pam_lookup_policy yes I restarted slapd and change my own client to use my test open ldap server. And it seems working. But suddenly I was not able to do a sudo, change my passwd or login in another session. I checked the log of my server and found Sep 10 16:17:22 ldap-slave slapd[1672]: conn=1075 op=1 ENTRY dn="cn=jacques foucry,ou=people,dc=example,dc=com" Sep 10 16:17:22 ldap-slave slapd[1672]: conn=1075 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Sep 10 16:17:22 ldap-slave slapd[1672]: conn=1075 op=2 BIND dn="cn=Jacques Foucry,ou=People,dc=example,dc=com" method=128 Sep 10 16:17:22 ldap-slave slapd[1672]: conn=1075 op=2 BIND dn="cn=Jacques Foucry,ou=People,dc=example,dc=com" mech=SIMPLE ssf=0 Sep 10 16:17:22 ldap-slave slapd[1672]: ppolicy_bind: Entry cn=Jacques Foucry,ou=People,dc=example,dc=com has an expired password: 0 grace logins Sep 10 16:17:22 ldap-slave slapd[1672]: conn=1075 op=2 RESULT tag=97 err=49 text= Sep 10 16:17:22 ldap-slave slapd[1672]: conn=1075 op=3 BIND anonymous mech=implicit ssf=0 Sep 10 16:17:22 ldap-slave slapd[1672]: conn=1075 op=3 BIND dn="" method=128 Sep 10 16:17:22 ldap-slave slapd[1672]: conn=1075 op=3 RESULT tag=97 err=0 text= So I added to my user some attributes. First the OU pwdPolicy (with userPassord as attribute) then pwdAllowUserChange, pwdGraceAuthNLimit (and put 7 on it) PwdLockout (false) pwdLockoutDuration (0) pwdMustChange (true) pwdSafeModify(true). I still have the same error. So there is something I misunderstood. Can some on explain what's wrognand how can I correct it? Thanks in advance for your help, Best regards, Jacques Foucry -- Jacques Foucry *NOVΛSPARKS * IT Manager Tel : +33 (0)1 42 68 12 61 jacques.foucry(a)novasparks.com

3 4

Perfect Forward Secrecy
by Dieter Klünter 09 Sep '13

09 Sep '13

Hi, I wonder whether openldap, if compiled with openssl-1.x, will support PFS. http://en.wikipedia.org/wiki/Perfect_forward_secrecy This issue has been discussed on several mailinglists recently. -Dieter -- Dieter Klünter | Systemberatung http://dkluenter.de GPG Key ID:DA147B05 53°37'09,95"N 10°08'02,42"E

6 13

Re: SyncRepl Chaining
by espeake＠oreillyauto.com 09 Sep '13

09 Sep '13

From: Quanah Gibson-Mount <quanah(a)zimbra.com> To: espeake(a)oreillyauto.com Date: 09/06/2013 10:42 AM Subject: Re: SyncRepl Chaining --On Friday, September 06, 2013 10:39 AM -0500 espeake(a)oreillyauto.com wrote: > root@tntest-ldap-3:~# ldapwhoami -d -1 -Wx -D > "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" Debug output from ldapwhoami is useless > ldap_bind: Invalid credentials (49) This error can indicate any of a number of things: a) Wrong password b) Acls block the ability to auth to the password c) The DN specified doesn't exist What you would need to provide is the debug output from *slapd* to see which of a, b, or c was the problem. --Quanah -- Here is the olcAcces from the slapcat on the database. Rule {0} should what it is using but becaus eof it not authenticating rule {2} is being applied instead. Here is the slapd debug. Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: conn=1015 op=0 BIND dn="uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" method=128 Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => bdb_entry_get: found entry: "uid=readonlyuser,ou=system,dc=oreillyauto,dc=com" Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => bdb_entry_get: found entry: "cn=passwordadminpolicy,ou=policies,dc=oreillyauto,dc=com" Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: result not in cache (userPassword) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: auth access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "userPassword" requested Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => acl_get: [1] attr userPassword Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => acl_mask: access to entry "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com", attr "userPassword" requested Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => acl_mask: to value by "", (=0) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= check a_dn_pat: uid=syncrepl,ou=system,dc=oreillyauto,dc=com Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= check a_dn_pat: uid=readonlyuser,ou=system,dc=oreillyauto,dc=com Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= check a_dn_pat: uid=ldapadmin,ou=system,dc=oreillyauto,dc=com Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= check a_dn_pat: uid=newuseradmin,ou=system,dc=oreillyauto,dc=com Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= check a_dn_pat: uid=passwordadmin,ou=system,dc=oreillyauto,dc=com Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= acl_mask: no more <who> clauses, returning =0 (stop) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => slap_access_allowed: auth access denied by =0 Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: no more rules Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => bdb_entry_get: found entry: "uid=readonlyuser,ou=system,dc=oreillyauto,dc=com" Sep 6 11:01:25 slapd[20347]: last message repeated 3 times Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => test_filter Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: PRESENT Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: search access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "objectClass" requested Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= root access granted Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: search access granted by manage(=mwrscxd) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= test_filter 6 Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => test_filter Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: PRESENT Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: search access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "objectClass" requested Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= root access granted Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: search access granted by manage(=mwrscxd) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= test_filter 6 Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => bdb_entry_get: found entry: "uid=readonlyuser,ou=system,dc=oreillyauto,dc=com" Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => bdb_entry_get: found entry: "cn=passwordadminpolicy,ou=policies,dc=oreillyauto,dc=com" Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: search access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "entry" requested Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= root access granted Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: search access granted by manage(=mwrscxd) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => test_filter Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: EQUALITY Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: search access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "objectClass" requested Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= root access granted Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: search access granted by manage(=mwrscxd) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= test_filter 5 Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: search access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "entry" requested Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= root access granted Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: search access granted by manage(=mwrscxd) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => test_filter Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: EQUALITY Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: search access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "objectClass" requested Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= root access granted Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: search access granted by manage(=mwrscxd) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= test_filter 5 Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= acl_access_allowed: granted to database root Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => bdb_entry_get: found entry: "uid=readonlyuser,ou=system,dc=oreillyauto,dc=com" Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => test_filter Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: PRESENT Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: search access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "objectClass" requested Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= root access granted Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: search access granted by manage(=mwrscxd) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= test_filter 6 Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => bdb_entry_get: found entry: "uid=readonlyuser,ou=system,dc=oreillyauto,dc=com" Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "entry" requested Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= root access granted Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: read access granted by manage(=mwrscxd) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: result not in cache (objectClass) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "objectClass" requested Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= root access granted Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: read access granted by manage(=mwrscxd) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: result was in cache (objectClass) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: result not in cache (uid) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "uid" requested Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= root access granted Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: read access granted by manage(=mwrscxd) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: result not in cache (description) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "description" requested Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= root access granted Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: read access granted by manage(=mwrscxd) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: result not in cache (pwdPolicySubentry) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "pwdPolicySubentry" requested Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= root access granted Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: read access granted by manage(=mwrscxd) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: result not in cache (structuralObjectClass) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => test_filter Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: PRESENT Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: search access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "objectClass" requested Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= root access granted Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: search access granted by manage(=mwrscxd) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= test_filter 6 Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => bdb_entry_get: found entry: "uid=readonlyuser,ou=system,dc=oreillyauto,dc=com" Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "entry" requested Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: add access to "cn=accesslog" "children" requested Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "structuralObjectClass" requested Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= root access granted Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= root access granted Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: add access granted by manage(=mwrscxd) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: read access granted by manage(=mwrscxd) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: add access to "reqStart=20130906160125.000000Z,cn=accesslog" "entry" requested Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: result not in cache (entryUUID) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "entryUUID" requested Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= root access granted Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: read access granted by manage(=mwrscxd) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: result not in cache (creatorsName) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "creatorsName" requested Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= root access granted Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: read access granted by manage(=mwrscxd) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: result not in cache (createTimestamp) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "createTimestamp" requested Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= root access granted Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: read access granted by manage(=mwrscxd) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: result not in cache (pwdHistory) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "pwdHistory" requested Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= root access granted Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: read access granted by manage(=mwrscxd) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: result was in cache (pwdHistory) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: result not in cache (userPassword) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "userPassword" requested Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= root access granted Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: read access granted by manage(=mwrscxd) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: result not in cache (pwdChangedTime) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "pwdChangedTime" requested Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= root access granted Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: read access granted by manage(=mwrscxd) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: result not in cache (pwdFailureTime) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "pwdFailureTime" requested Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= root access granted Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: read access granted by manage(=mwrscxd) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: result was in cache (pwdFailureTime) Sep 6 11:01:25 slapd[20347]: last message repeated 33 times Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: result not in cache (entryCSN) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "entryCSN" requested Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= root access granted Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: read access granted by manage(=mwrscxd) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: result not in cache (modifiersName) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "modifiersName" requested Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= root access granted Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: read access granted by manage(=mwrscxd) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: result not in cache (modifyTimestamp) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "modifyTimestamp" requested Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= root access granted Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: read access granted by manage(=mwrscxd) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: result not in cache (entryDN) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "entryDN" requested Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= root access granted Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: read access granted by manage(=mwrscxd) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: result was in cache (entryDN) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: result not in cache (subschemaSubentry) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "subschemaSubentry" requested Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= root access granted Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: read access granted by manage(=mwrscxd) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: result was in cache (subschemaSubentry) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: result not in cache (hasSubordinates) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "hasSubordinates" requested Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= root access granted Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: read access granted by manage(=mwrscxd) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: result was in cache (hasSubordinates) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= root access granted Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: <= root access granted Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: read access granted by manage(=mwrscxd) Sep 6 11:01:25 tntest-ldap-1 slapd[20347]: => access_allowed: result not in cache (objectClass) Sep 6 11:01:25 tntest-ldap-1 rsyslogd-2177: imuxsock begins to drop messages from pid 20347 due to rate-limiting Sep 6 11:01:27 tntest-ldap-1 rsyslogd-2177: imuxsock lost 116 messages from pid 20347 due to rate-limiting Thanks, Eric This message has been scanned for viruses and dangerous content, and is believed to be clean. Message id: CA5BC600DE5.AFB93 This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

3 10

Log service time?
by Покотиленко Костик 09 Sep '13

09 Sep '13

Hi, Is there a way to log the time each operation took? I have strange CPU load (~200%) with just ~15 operations per second. SRCH is >90% of all operations. All attributed involved in search a indexed (many single attribute indexes, ~30). The point is to find which search operations a taking long time to develop a solution.

7 22

Slapd High CPU usage on Solaris 9
by Luca Polidoro 09 Sep '13

09 Sep '13

Hello, I am writing to to submit a case that has been happening in the last 2 weeks in our infrastructure. This is structured as follows: 1 provider: Solaris 9 SPARC - Sun Fire V490 - last OS patch level CPU: 4-1500 Mhz RAM: 32 GB OpenLDAP version used: Berkeley DB 2.4.23 and 4.8.30 (with database bdb) all 64-bit 18 consumer: Solaris 9 SPARC - last OS patch level with different types of features (CPU, RAM) On the following consumer products: Consumer 1: Solaris 9 SPARC - Sun Fire 480R - last OS patch level CPU: 4-900 Mhz RAM: 8 GB Consumer 2: Solaris 9 SPARC - Sun Fire 480R - last OS patch level CPU: 4-1050 Mhz RAM: 8 GB Consumer 3: Solaris 9 SPARC - Sun Fire 480R - last OS patch level CPU: 4-1050 Mhz RAM: 8 GB Consumer 4: Solaris 9 SPARC - Sun Fire V210 - last OS patch level CPU: 2-1336 Mhz RAM: 8 GB we are noticing an increase in the cpu used by the slapd process. In fact, the process is constantly between 85% and 95%, and became completely unusable and then we are forced to restart. LDAP with 1.000.000 objects. This is the consumer's slapd.conf (I have omitted parts of the ACL, includes, etc..): # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # # # VERSION v2 - Digital Tru64 # allow bind_v2 Some include ... # # tuning parameters - START # ------------------------------ # conn_max_pending 1000 conn_max_pending_auth 1000 idletimeout 500 sizelimit unlimited threads 8 timelimit 500 disallow bind_anon # # tuning parameters - END # ---------------------------- # ... ####################################################################### # bdb database definitions ####################################################################### database bdb suffix "xxxxxxxxxxxx" rootdn "cn=root,ou=ldapusers,xxxxx" directory /var/openldap-2.4.23_64/var/openldap-data #####disallow limit for syncuser limits dn.children="ou=syncusers,xxxx" size=unlimited index objectClass,entryCSN,entryUUID eq index ou eq,sub,subinitial,subany,subfinal index uidOwner eq index uid eq index memberUid eq #shm_key 1100 cachesize 1000000 cachefree 10000 dncachesize 1000000 idlcachesize 1000000 searchstack 16 checkpoint 1024 10 overlay ppolicy ppolicy_default "cn=Standard,ou=Policies,xxxx" ppolicy_use_lockout ############################SYNCREPL CONF syncrepl rid=011 provider=ldap://xxxxxx type=refreshAndPersist interval=00:00:15:00 retry="15 10 120 +" searchbase="xxxxx" filter="(objectClass=*)" attrs="*,+" scope=sub schemachecking=on bindmethod=simple binddn="xxxxxx" credentials=xxxx ############################SYNCREPL CONF These are the bdb files: 420M dn2id.bdb 30M entryCSN.bdb 32M entryUUID.bdb 1,4G id2entry.bdb 18M memberUid.bdb 4,9M objectClass.bdb 5,3M ou.bdb 17M uid.bdb 17M uidOwner.bdb this is DB CONFIG: ----------------------------------------------------------- ########################################## ########################################### #set_cachesize 0 300000000 10 #set_lg_regionmax 262144 #set_lg_bsize 2097152 ########################################### ########################################### # replaces lockdetect directive #set_lk_detect DB_LOCK_EXPIRE set_lk_detect DB_LOCK_DEFAULT # uncomment if dbnosync required #AGGIUNTO TUTTO #set_flags DB_TXN_WRITE_NOSYNC ####AGGIUNTO set_flags DB_LOG_AUTOREMOVE # multiple set_flags directives allowed # sets max log size = 5M (BDB default=10M) set_lg_max 25242880 set_lg_dir /var/openldap-2.4.23_64/logs set_cachesize 2 274726912 1 # sets a database cache of 5M and # allows fragmentation # does NOT replace slapd.conf cachesize # this is a database parameter #txn_checkpoint 128 15 0 # replaces checkpoint in slap.conf # writes checkpoint if 128K written or every 15 mins # 0 = no writes - no update set_lk_max_locks 2500 set_lk_max_lockers 2500 set_lk_max_objects 2500 --------------------------------------------------- We have tried to change the number of threads bringing them to 16, we lowered the parameters idletimeout and timelimit, but without result. Appreciate your feedback. Thanks, Luca

3 4

Re: Problem pwdChangedTime
by felas 07 Sep '13

07 Sep '13

The problem is i have this LDIF file with this attribute pwdChangedTime, and because that i have a error to import this file LDIF. 2013/9/6 Quanah Gibson-Mount <quanah(a)zimbra.com> > --On Friday, September 06, 2013 9:50 PM +0200 felas <felas85(a)gmail.com> > wrote: > > > I try to add ppolicy.ldif to my schema, but no success. >> >> >> how i can do to resolve this problem? >> > > add ppolicy.ldif with success > > You need to be more detailed about how you tried to add the schema, to > start with. > > --Quanah > > > -- > > Quanah Gibson-Mount > Lead Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

RE: Antw: Re: Log service time?
by Chris Jacobs 07 Sep '13

07 Sep '13

You left off the part where I remind that he was looking for information - specifically how to get said information: "If the information Casper requested isn't available, say so. If it is, how would he get it?" As it stands now, his initial question remains unanswered, with the only guidance being "upgrade"; which lacking anything else he is running with in the blind hope it makes things faster (his actual issue, not his questions). That's really the meat of my response/addition to this conversation, and it's been simply side stepped again. -----Original Message----- From: Michael Ströder [mailto:michael@stroeder.com] Sent: Friday, September 06, 2013 2:16 PM To: Chris Jacobs Cc: openldap-technical(a)openldap.org Subject: Re: Log service time? Chris Jacobs wrote: > Michael: I cannot tell if you're being sarcastic or not, so, I'm running > with your words: I'm completely serious. > Software isn't developed in a vacuum - when truly useful, it's intended use > it to be used and it cannot be used sans distros (in any realistic > production operation; sure you can compile everything from source and > create StroderOS). Are you sarcastic here? Serious: Using packages from a Linux distribution is the normal case and works fine mostly for cases where you don't use very advanced features of a given software. If you experience certain bugs in a software packaged by your distro then build a newer distro package of that software. Yes, that's work but it's worth the effort if the component is really important for your infrastructure. This is about getting real control over important components. > While you may be blessed with using whatever software, > from whatever source you desire, with any (or no) support available, many > system administrators are under edicts and must work within the policies > and instructions of their company. Policies and instructions are always subject to controlled change process. If you don't have a change process then your policies are missing a very essential part. > SOX is a big deal at any organization that is publicly traded or works with > government entities. Be assured that I'm quite aware of what it means to run systems governed by lots of policies. > The support model of essentially "it's not the latest; go away until you update (compile it)" isn't helpful. Do you have a support contract with the OpenLDAP community? Everything here is community effort. If you insist on getting commercial-grade support model then pay people providing support (e.g. buy Symas' build for your favourite OS platform). > Quanah: "I would highly advise upgrading to a current release (2.4.36) and > switching to back-mdb." While I personally agree that Quanah should not just write "yuck" because of someone is using back-hdb (given that back-mdb is really usable just since 2.4.36) he's right in pointing out that someone should try to reproduce issues with the latest release first before asking. Ciao, Michael. This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

4 4

Problem pwdChangedTime
by felas 06 Sep '13

06 Sep '13

Hi, i have this ldif file to import, but i have this error: pwdChangedTime: attribute type undefined I try to add ppolicy.ldif to my schema, but no success. how i can do to resolve this problem?

2 1

Re: Problem pwdChangedTime
by felas 06 Sep '13

06 Sep '13

I don't know!... Il giorno 06/set/2013 22:49, "Turbo Fredriksson" <turbo(a)bayour.com> ha scritto: > On Sep 6, 2013, at 9:50 PM, felas wrote: > > > I try to add ppolicy.ldif to my schema, but no success. > > Why not? > -- > Build a man a fire, and he will be warm for the night. > Set a man on fire and he will be warm for the rest of his life. > >

1 0

2.4.36: test050-syncrepl-multimaster failed for mdm
by Покотиленко Костик 06 Sep '13

06 Sep '13

Following Quanah's advise tried to build 2.4.36 from sources: # ./configure # make depend # make ... test failed - server 1 and server 2 databases differ >>>>> test050-syncrepl-multimaster failed for mdm (exit 1) How bad is this?

2 3

SyncRepl Chaining
by espeake＠oreillyauto.com 06 Sep '13

06 Sep '13

I believe we are very close to our goal of a master/slave syncrepl configuration. I have a master that through refreshAndPersist instantly updates the slave servers. The issue I am having is is passing on updates to the master server for writing the updated information. This is the error message I get. ldap_modify: Strong(er) authentication required (8) I have set up chainingin bother the {-1}frontend database and the {1}hdb database. My understanding of what I read in man slapd-conf is that any attributes used in the {-1}frontend makes these global and I should not need that setup anywhere else unless I need to override the settings fro an individual DB. TLS with openSSL is setup through the compiling of the openldap. I am attaching the slapcat from my master. Any and all help is appreciated. (See attached file: config-20130819-master.ldif) Thank you, Eric Speake Web Systems Administrator O'Reilly Auto PartsThis communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

2 1

overlay accesslog entrydn conflict problem (err=68)
by gottabogh 06 Sep '13

06 Sep '13

Hi all, I have a problem with overlay accesslog. Here is my overlay configuration: overlay accesslog logdb dc=log,dc=ciccio.it logops all logold (objectclass=inetOrgPerson) logpurge 10+00:00 08:00 logsuccess FALSE If I try: ldapwhoami -H ldap://myserver -D "uid=myuser,ou=People,dc= ciccio.it" -W I obtain this in the log: Aug 26 12:01:04 myserver slapd-dblog[12708]: conn=1003 op=19 ADD dn="reqStart=20130826100104.000000Z,dc=log,dc=ciccio.it" Aug 26 12:01:04 myserver slapd-dblog[12708]: conn=1003 op=19 RESULT tag=105 err=0 text= Aug 26 12:01:04 myserver slapd-dblog[12708]: conn=1005 op=12 ADD dn="reqStart=20130826100104.000000Z,dc=log,dc=ciccio.it" Aug 26 12:01:04 myserver slapd-dblog[12708]: conn=1005 op=12 RESULT tag=105 err=68 text= Aug 26 12:01:04 myserver slapd-dblog[12708]: conn=1003 op=20 ADD dn="reqStart=20130826100104.000004Z,dc=log,dc=ciccio.it" Aug 26 12:01:04 myserver slapd-dblog[12708]: conn=1003 op=20 RESULT tag=105 err=0 text= And those are the entries in the dblog: # 20130826100104.000000Z, log.ciccio.it dn: reqStart=20130826100104.000000Z,dc=log,dc=ciccio.it objectClass: auditSearch reqStart: 20130826100104.000000Z reqEnd: 20130826100104.000001Z reqType: search reqSession: 1011 reqAuthzID: cn=Manager,dc=ciccio.it reqDN: uid=myuser,ou=People,dc=ciccio.it reqResult: 0 reqScope: base reqDerefAliases: never reqAttrsOnly: FALSE reqFilter: (objectClass=groupOfNames) reqAttr: member reqEntries: 0 reqTimeLimit: -1 reqSizeLimit: 1 # 20130826100104.000004Z, log.ciccio.it dn: reqStart=20130826100104.000004Z,dc=log,dc=ciccio.it objectClass: auditObject reqStart: 20130826100104.000004Z reqEnd: 20130826100104.000005Z reqType: unbind reqSession: 1011 reqAuthzID: uid=myuser,ou=People,dc=ciccio.it Like you can see there are a search and a unbind, but not the bind operation. I think that err=68 is because ldapwhoami is composed of search, bind, unbind. Since the first two operation are executed at the same time and the dn of a new entry is generated using reqStart, the bind operation takes error 68 (LDAP_ALREADY_EXISTS). How can I get around this problem? Can I modify generation of entrydn in the dblog? For example compose it in this way: "reqStart=xxxx,reqType=yyyy,dc=log,dc=ciccio.it" Thanks a lot, Fabio.

2 1

Fw: SyncRepl Chaining
by espeake＠oreillyauto.com 06 Sep '13

06 Sep '13

Bumping. Eric Speake Web Systems Administrator O'Reilly Auto Parts ----- Forwarded by Eric Speake/OReilly on 08/20/2013 07:39 AM ----- From: Eric Speake/OReilly To: openldap-technical(a)openldap.org Date: 08/19/2013 09:46 AM Subject: SyncRepl Chaining I believe we are very close to our goal of a master/slave syncrepl configuration. I have a master that through refreshAndPersist instantly updates the slave servers. The issue I am having is is passing on updates to the master server for writing the updated information. This is the error message I get. ldap_modify: Strong(er) authentication required (8) I have set up chainingin bother the {-1}frontend database and the {1}hdb database. My understanding of what I read in man slapd-conf is that any attributes used in the {-1}frontend makes these global and I should not need that setup anywhere else unless I need to override the settings fro an individual DB. TLS with openSSL is setup through the compiling of the openldap. I am attaching the slapcat from my master. Any and all help is appreciated. (See attached file: config-20130819-master.ldif) Thank you, Eric Speake Web Systems Administrator O'Reilly Auto PartsThis communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

1 1

OpenLDAP 2.4.36 slapd stop with assertion fail message
by "POISSON Frédéric" 06 Sep '13

06 Sep '13

Hello, I'm testing the latest release of OpenLDAP 2.4.36 and my slapd stop while i'm doing a change on cn=config. My tests are with my own compilation of OpenLDAP on a RHEL6 server but i see the same problem with "LTB project RPMs" http://ltb-project.org/wiki/download#openldap with RHEL6 package. My aim is to modify cn=config like this in order to implement TLS, here is my ldif : dn: cn=config changetype: modify add: olcTLSRandFile olcTLSRandFile: /dev/random The server shutdown when i add this entry and with slapd option "-d 255" i have : slapd: result.c:813: slap_send_ldap_result: Assertion `!((rs->sr_err)<0)' failed. /etc/init.d/slapd: line 285: 5461 Aborted $SLAPD_BIN -h "$SLAPD_SERVICES" $SLAPD_PARAMS Notice that i test this ldif modification on release 2.4.35 without problem. Is there any changes inside cn=config behavior with release 2.4.36 that i don't see ? Thanks in advance, Regards, PS: In attachment my cn=config with slapcat, and the lines when starting slapd with debug -d 255. -- Frederic Poisson

2 1

Group values not returned with "id" command
by Justin Edmands 05 Sep '13

05 Sep '13

Hey, Certainly new to migrations of LDAP. I migrated our old setup from OpenLDAP to 389 Directory Server. When using the "id" command on an LDAP client, it only returns uid,gid, and one group. It for some reason does not show all of the actual groups that the user is associated with. What is set to return these values and what setting ensures they are properly mapped from OpenLDAP to 389DS? ### OpenLDAP example: ### [root openldapclient ~]# id jedmands uid=9999(jedmands) gid=100(users) groups=100(users),5000(manager),5001(linuxadmin),5002(storageadmin),5003(dbadmin),5004(webadmin),5006(it) ### 389 DS Example: ### [root 389dsclient ~]# id jedmands uid=9999(jedmands) gid=100(users) groups=100(users) Notes: Posted this to the 389-users list, nothing received. We are using the memberOf plugin for 389DS. I don't know too much about the openldap environment. I moved to CentOS 6 and figured DS was the way to go with SSL/TLS

3 4

ldappasswd: account has expired (account expired)
by john espiro 04 Sep '13

04 Sep '13

We have opnldap (Version: 2.4.31-1ubuntu2.1) setup on our ubuntu server. Just migrated over from an older server and are getting this message for a user: Our users can login to webmail to send and receive mail, and other stuff like that, they can download pop3 mail via desktop client, but when they go to send out, or su to that user we get messages like this: auth: pam_unix(dovecot:account): account has expired (account expired) Sep 3 19:05:03 auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=XXXX rhost=::1 user=XXXX I changed the password with ldappasswd successfully, but still the error persists. Doing some research it seems that shadowLastChange is not getting updated. How can we resolve this? /usr/share/slapd/slapd.conf access to attrs=userPassword,shadowLastChange by dn="@ADMIN@" write by anonymous auth by self write by * none access to dn.base="" by * read # The admin dn has full write access, everyone else # can read everything. access to * by dn="@ADMIN@" write by * read Package: slapd Status: install ok installed Priority: optional Section: net Installed-Size: 4101 Maintainer: Ubuntu Developers <ubuntu-devel-discuss(a)lists.ubuntu.com> Architecture: amd64 Source: openldap Version: 2.4.31-1ubuntu2.1 Replaces: ldap-utils (<< 2.2.23-3), libldap2 Provides: ldap-server, libslapi-2.4-2 Depends: libc6 (>= 2.15), libdb5.1, libldap-2.4-2 (= 2.4.31-1ubuntu2.1), libltdl7 (>= 2.4.2), libodbc1 (>= 2.2.11) | unixodbc (>= 2.2.11), libperl5.14 (>= 5.14.2), libsasl2-2 (>= 2.1.24), libslp1, libwrap0 (>= 7.6-4~), coreutils (>= 4.5.1-1), psmisc, perl (>> 5.8.0) | libmime-base64-perl, adduser, lsb-base (>= 3.2-13) Pre-Depends: debconf (>= 0.5) | debconf-2.0, multiarch-support Recommends: libsasl2-modules Suggests: ldap-utils, ufw Conflicts: ldap-server, libltdl3 (= 1.5.4-1), umich-ldapd Conffiles:

3 2

Shadow context when modifying syncrepl sections
by Yann Bordenave 04 Sep '13

04 Sep '13

Hi, I run a 3-way multi master system and I'm replicating both configuration and payload database. When I modify something related to the syncrepl sections, I am unable to make changes on my data. I have an error message like the following: err=53, Server is unwilling to perform : shadow context; no update referral Do you have any clue about how to prevent it without having to reboot the slapd daemons ? Thank you for your answers. -- Yann Bordenave - Intern, R&E Infrastructure Smartjog S.A.S. - http://www.smartjog.com - Groupe TDF 27 Bd Hippolyte Marques, 94200 Ivry sur Seine, France Cell : +33.6.68.86.81.61

2 5

Re: Antw: Re: Object not found
by espeake＠oreillyauto.com 03 Sep '13

03 Sep '13

Eric Speake Web Systems Administrator O'Reilly Auto Parts From: "Ulrich Windl" <Ulrich.Windl(a)rz.uni-regensburg.de> To: <espeake(a)oreillyauto.com> Date: 08/29/2013 01:46 AM Subject: Antw: Re: Object not found Eric, following you progress on LDAP, why don't you use a working simple starting configuration and then try simple steps towards getting where you want to be at the end? Only proceed if the current configuration works as intended; if not either undo or fix it. Something like: olcAccess: {0}to * by dn.base="uid=syncrepl,ou=system,dc=whatever" read by group/organizationalRole/roleOccupant.exact="cn=LDAP-Manager,dc=whatever" write by * break olcAccess: {1}to attrs=userPassword by self write by * auth olcAccess: {2}to attrs=shadowLastChange by self write by * read olcAccess: {3}to attrs=userPKCS12 by self read by * none olcAccess: {4}to * by * read You can leave out rule {0}, because that's some local extension used here (use a group for Managers). Also I can recommend turning on auth logging for your tests. In LDIF-format: dn: cn=config changetype: modify add: olcLogLevel olcLogLevel: ACL - I also recommend doing frequent database dumps per slapcat, so you can revert to a working configuration once you messed up things. However when using replication, be aware that restoring one node to an older configuration, the older node may be overwritten if the other nodes still have a newer configuration. To all: Is there an option to slapadd to make any entries actually added being "new" (i.e. ignoring CSNs and modification timestamps in the LDIF)? Regards, Ulrich >>> <espeake(a)oreillyauto.com> schrieb am 29.08.2013 um 05:25 in Nachricht <OF5EFEDB5F.26657526-ON86257BD6.001209FD-86257BD6.0012CADD@LocalDomain>: > Okay so I have the access list figured out and everything looks good except > now the credentials for my user aren't working. I get an error 49 (invalid > credentials) I have reentered the password for the user. There is one > other user that will not autenticate. Both of thes users are in the ou > System. The base admin account can login and get the informatio. Here is > the new access list. > > olcAccess: {0}to * by > dn.base="uid=syncrepl,ou=System,dc=oreillyauto,dc=com" read by > dn.base="uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" read by > dn.base="uid=ldapAdmin,ou=System,dc=oreillyauto,dc=com" write by > dn.base="uid=newUserAdmin,ou=System,dc=oreillyauto,dc=com" write by > dn.base="uid=passwordAdmin,ou=System,dc=oreillyauto,dc=com" write by * > break > olcAccess: {1}to dn.subtree="dc=oreillyauto,dc=com" by > group/groupOfUniqueNames/uniqueMember="cn=System > Administrators,ou=Groups,dc=oreillyauto,dc=com" write > by group/groupOfUniqueNames/uniqueMember="cn=LDAP > Admin,ou=Groups,dc=oreillyauto,dc=com" write by * none break > olcAccess: {2}to attrs=userPassword by > group/groupOfUniqueNames/uniqueMember="cn=Authenticate,ou=Groups,dc=oreillya > uto,dc=com" > write by anonymous auth by self write > olcAccess: {3}to attrs=uid by anonymous read by users read > olcAccess: {4}to attrs=ou,employeeNumber by users read > olcAccess: {5}to dn.subtree="ou=System,dc=oreillyauto,dc=com" by > dn.subtree="ou=Users,dc=oreillyauto,dc=com" none by users read > olcAccess: {6}to dn.children="ou=Groups,dc=oreillyauto,dc=com" by > dnattr=owner write by dnattr=uniqueMember read by * none > olcAccess: {7}to dn.children="ou=Users,dc=oreillyauto,dc=com by self read > by > group/groupOfUniqueNames/uniqueMember="cn=Authenticate,ou=Groups,dc=oreillya > uto,dc=com" > read by * none > olcAccess: {8}to * by self read by users read > > The two users that I need to work are: > readOnlyUser > dn="uid=readOnlyUser,ou=System,dc=oreilly,dc=com > and > ldapadmin dn="uid=ldapadmin, ou=System,dc=oreulllyauto,dc=com > > Here is the search and result: > > root@tntest-ldap-3:/var/lib/ldap# ldapsearch -Wx -D > "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" -b > "dc=oreillyauto,dc=com" -H ldap://<ldap-server>.oreillyauto.com uid=espeake > uid dsplayName employeeNumber > Enter LDAP Password: > ldap_bind: Invalid credentials (49) > > any and all ideas are welcomed. > Eric Speake > Web Systems Administrator > O'Reilly Auto Parts > > > > From: Quanah Gibson-Mount <quanah(a)zimbra.com> > To: espeake(a)oreillyauto.com, openldap-technical(a)openldap.org > Date: 08/28/2013 11:35 AM > Subject: Re: Object not found > Sent by: openldap-technical-bounces(a)OpenLDAP.org > > > > --On Wednesday, August 28, 2013 8:12 AM -0500 espeake(a)oreillyauto.com > wrote: > >> >> I have a user name readonly that we use in our applications to get uid's. >> THis has worked in the past with our old LDAP solution. We have moved to >> 2.4.31 on Ubuntu 12.04 with a n-way Multi master setup. >> >> The slap cat for this database looks like this. >> >> dn: olcDatabase={1}hdb,cn=config >> objectClass: olcDatabaseConfig >> objectClass: olcHdbConfig >> olcDatabase: {1}hdb >> olcDbDirectory: /var/lib/ldap >> olcSuffix: dc=oreillyauto,dc=com >> olcAccess: {0}to attrs=userPassword by anonymous auth by * none >> olcAccess: {1}to dn.subtree="dc=oreillyauto,dc=com" by >> group/groupOfUniqueName >> s/uniqueMember="cn=System > Administrators,ou=Groups,dc=oreillyauto,dc=com" >> wri >> te by group/groupOfUniqueNames/uniqueMember="cn=LDAP >> Admin,ou=Groups,dc=oreil >> lyauto,dc=com" write by * none break >> olcAccess: {2}to attrs=userPassword by >> group/groupOfUniqueNames/uniqueMember=" >> cn=Authenticate,ou=Groups,dc=oreillyauto,dc=com" write by anonymous auth >> by s >> elf write > > Hi, > > You need to spend some time reading the manual pages and admin guide on > access rules for slapd. > > It is immediately obvious that rule {2) will never evaluate because of rule > > {0}. Those shouldn't even be separate rule lines, they should be a single > rule. I haven't looked further because that was so blatant, I'm guessing > you have any number of other issues in your access lines. > > --Quanah > > -- > > Quanah Gibson-Mount > Lead Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration > > > -- > This message has been scanned for viruses and dangerous content, > and is believed to be clean. > Message id: 898DB600A44.A073B > > > > > This communication and any attachments are confidential, protected by > Communications Privacy Act 18 USCS § 2510, solely for the use of the intended > recipient, and may contain legally privileged material. If you are not the > intended recipient, please return or destroy it immediately. Thank you. Here what shows up in the log. I am high lighting what I thought would have been the issue but it appears to be a double-negative so it is not where it is getting denied. Just must be missing it because it looks like it really working. Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: conn=1027 op=0 BIND dn="uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" method=128 Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => bdb_entry_get: found entry: "uid=readonlyuser,ou=system,dc=oreillyauto,dc=com" Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => bdb_entry_get: found entry: "cn=passwordadminpolicy,ou=policies,dc=oreillyauto,dc=com" Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not in cache (userPassword) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: auth access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "userPassword" requested Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => acl_get: [1] attr userPassword Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => acl_mask: access to entry "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com", attr "userPassword" requested Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => acl_mask: to value by "", (=0) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= check a_dn_pat: uid=syncrepl,ou=system,dc=oreillyauto,dc=com Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= check a_dn_pat: uid=readonlyuser,ou=system,dc=oreillyauto,dc=com Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= check a_dn_pat: uid=ldapadmin,ou=system,dc=oreillyauto,dc=com Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= check a_dn_pat: uid=newuseradmin,ou=system,dc=oreillyauto,dc=com Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= check a_dn_pat: uid=passwordadmin,ou=system,dc=oreillyauto,dc=com Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= acl_mask: no more <who> clauses, returning =0 (stop) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => slap_access_allowed: auth access denied by =0 Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: no more rules Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => bdb_entry_get: found entry: "uid=readonlyuser,ou=system,dc=oreillyauto,dc=com" Aug 29 08:53:32 slapd[18777]: last message repeated 3 times Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "objectClass" requested Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search access granted by manage(=mwrscxd) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "objectClass" requested Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search access granted by manage(=mwrscxd) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => bdb_entry_get: found entry: "uid=readonlyuser,ou=system,dc=oreillyauto,dc=com" Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => bdb_entry_get: found entry: "cn=passwordadminpolicy,ou=policies,dc=oreillyauto,dc=com" Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "entry" requested Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search access granted by manage(=mwrscxd) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "objectClass" requested Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search access granted by manage(=mwrscxd) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "entry" requested Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search access granted by manage(=mwrscxd) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "objectClass" requested Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search access granted by manage(=mwrscxd) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= acl_access_allowed: granted to database root Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => bdb_entry_get: found entry: "uid=readonlyuser,ou=system,dc=oreillyauto,dc=com" Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "objectClass" requested Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search access granted by manage(=mwrscxd) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "objectClass" requested Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: search access granted by manage(=mwrscxd) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => bdb_entry_get: found entry: "uid=readonlyuser,ou=system,dc=oreillyauto,dc=com" Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "entry" requested Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access granted by manage(=mwrscxd) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not in cache (objectClass) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "objectClass" requested Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access granted by manage(=mwrscxd) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result was in cache (objectClass) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not in cache (uid) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "uid" requested Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access granted by manage(=mwrscxd) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not in cache (description) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "description" requested Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => bdb_entry_get: found entry: "uid=readonlyuser,ou=system,dc=oreillyauto,dc=com" Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "entry" requested Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access granted by manage(=mwrscxd) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not in cache (objectClass) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "objectClass" requested Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access granted by manage(=mwrscxd) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result was in cache (objectClass) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not in cache (uid) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "uid" requested Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access granted by manage(=mwrscxd) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not in cache (description) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "description" requested Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access granted by manage(=mwrscxd) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not in cache (pwdPolicySubentry) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "pwdPolicySubentry" requested Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access granted by manage(=mwrscxd) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not in cache (structuralObjectClass) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "structuralObjectClass" requested Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access granted by manage(=mwrscxd) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not in cache (entryUUID) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "entryUUID" requested Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access granted by manage(=mwrscxd) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not in cache (creatorsName) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "creatorsName" requested Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access granted by manage(=mwrscxd) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not in cache (createTimestamp) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "createTimestamp" requested Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access granted by manage(=mwrscxd) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not in cache (pwdHistory) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "pwdHistory" requested Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access granted by manage(=mwrscxd) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access granted by manage(=mwrscxd) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not in cache (pwdPolicySubentry) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "pwdPolicySubentry" requested Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access granted by manage(=mwrscxd) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not in cache (structuralObjectClass) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "structuralObjectClass" requested Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access granted by manage(=mwrscxd) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not in cache (entryUUID) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "entryUUID" requested Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access granted by manage(=mwrscxd) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not in cache (creatorsName) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "creatorsName" requested Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access granted by manage(=mwrscxd) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not in cache (createTimestamp) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "createTimestamp" requested Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access granted by manage(=mwrscxd) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not in cache (pwdHistory) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "pwdHistory" requested Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access granted by manage(=mwrscxd) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result was in cache (pwdHistory) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not in cache (userPassword) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "userPassword" requested Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access granted by manage(=mwrscxd) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result was in cache (pwdHistory) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not in cache (pwdChangedTime) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "pwdChangedTime" requested Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access granted by manage(=mwrscxd) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not in cache (userPassword) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not in cache (pwdFailureTime) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "userPassword" requested Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "pwdFailureTime" requested Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access granted by manage(=mwrscxd) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not in cache (pwdChangedTime) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "pwdChangedTime" requested Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access granted by manage(=mwrscxd) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not in cache (pwdFailureTime) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "pwdFailureTime" requested Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access granted by manage(=mwrscxd) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result was in cache (pwdFailureTime) Aug 29 08:53:32 slapd[18777]: last message repeated 5 times Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not in cache (entryCSN) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "entryCSN" requested Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access granted by manage(=mwrscxd) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not in cache (modifiersName) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "modifiersName" requested Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access granted by manage(=mwrscxd) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not in cache (modifyTimestamp) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "modifyTimestamp" requested Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access granted by manage(=mwrscxd) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not in cache (entryDN) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "entryDN" requested Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access granted by manage(=mwrscxd) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result was in cache (entryDN) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not in cache (subschemaSubentry) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "subschemaSubentry" requested Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access granted by manage(=mwrscxd) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result was in cache (subschemaSubentry) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result not in cache (hasSubordinates) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access to "uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" "hasSubordinates" requested Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access granted by manage(=mwrscxd) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: result was in cache (hasSubordinates) Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: <= root access granted Aug 29 08:53:32 tntest-ldap-1 slapd[18777]: => access_allowed: read access granted by manage(=mwrscxd) -- This message has been scanned for viruses and dangerous content, and is believed to be clean. Message id: 28CE360097D.AE572 This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS § 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

2 10

a few MDB questions
by Brent Bice 03 Sep '13

03 Sep '13

I'm trying out the mdb backend before converting several of our LDAP servers to it and have a few questions I haven't found answers to yet. Firstly, I found when I spun up an instance using MDB that I couldn't have more than 1000 leaf nodes. It appears when I tried to create the 1001st leaf node, one of the earlier nodes disappeared. Is this a known limitation or just a config option I don't see in the slapd-mdb man page? Right now my config just contains: database mdb masxize 2147483648 suffix "dc=mysuffix,dc=com" rootdn "cn=Manager,dc=sgi,dc=com" rootpw myrootpw directory /data/ldap/instance-v1.4/var/openldap-data [... a bunch of indexes ...] checkpoint 1024000 60 The total size of the DB was only 412 megs so far and each of three branches in the DB appeared to be limited at 1000 leaf nodes so I don't think I was just hitting a maxsize limit. Which leads me to the 2nd question... The maxsize option (according to what I've read) is the maximum size of the database in bytes. But it looks to me like the biggest value I can specify is 4G - the biggest value for an unsigned long. Would this be cuz the system I'm testing on is a 32bit version of linux? (unsigned long is only 4 bytes whereas on a 64 bit OS unsigned longs are 8 bytes) I can just switch to a 64 bit system, easy-peasy. But I'm not sure why I seem to be limited to 1000 leaf nodes. Brent

2 4

schema extension trouble
by Horatiu Nimigean 03 Sep '13

03 Sep '13

Greetings, I have an $OpenLDAP: slapd 2.4.23 on centos 6.4 installed and i need to extend the schema to fit my setup. all i need is to add to my users in ou People a simple boolean attribute named vpnStatus that i want to be the basis upon which users are given vpn access or not. i created /etc/openldap/schema/local.schema containing > attributetype ( 1.2.3.4.5.6.7.000.1 > NAME 'accountStatus' > DESC 'boolean - defines if user has access to vpn' > EQUALITY booleanMatch > SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 > SINGLE-VALUE ) the OID is random picked. i restarted slapd without error but i can't find this attribute anywhere. i have apache directory studio used for editing and lam as a web gui and i can't find it there either. i'm a bit confused. then i tried to export this attribute as ldif (using apache ds) and import it using cli tools: > > ldapadd -x -W -h 127.0.0.1 -D "cn=Manager,dc=example,dc=com" -f > /tmp/vpnSchema.ldif > > Enter LDAP Password: > adding new entry "cn=vpnSchema, ou=schema" > ldap_add: Invalid syntax (21) > additional info: objectclass: value #0 invalid per syntax what do i need to do ?

2 1

Error message with memberof overlay
by Sylvain 03 Sep '13

03 Sep '13

Hi ! In my logs, I saw lot of lines like this (we have a poor script which refresh the base with delete/add primitives) : memberof_value_modify DN="uid=v6971,ou=people,dc=xxx,dc=com" delete memberOf="cn=VAC,ou=groups,dc=xxx,dc=com" failed err=16 I can reproduce the problem with a small LDIF : # 1st part dn: uid=V6971,ou=people,dc=xxx,dc=com changetype: delete dn: uid=V6971,ou=people,dc=xxx,dc=com changetype: add objectClass... # 2nd part dn: cn=VAC,ou=groups,dc=xxx,dc=com changetype: delete dn: cn=VAC,ou=groups,dc=xxx,dc=com changetype: add objectClass... In the logs (shown below), we saw that problem occurs only on the delete of cn=VAC but if I reduce the LDIF to that (2nd part), I have no more the problem !? I don't understand... Here the logs with all the LDIF : Aug 30 12:01:42 ldap1 slapd[1229]: conn=363692 fd=32 ACCEPT from IP= 192.168.0.1:48049 (IP=0.0.0.0:389) Aug 30 12:01:42 ldap1 slapd[1229]: conn=363692 op=0 BIND dn="cn=portail,ou=ldapusers,dc=xxx,dc=com" method=128 Aug 30 12:01:42 ldap1 slapd[1229]: conn=363692 op=0 BIND dn="cn=portail,ou=ldapusers,dc=xxx,dc=com" mech=SIMPLE ssf=0 Aug 30 12:01:42 ldap1 slapd[1229]: conn=363692 op=0 RESULT tag=97 err=0 text= --> Aug 30 12:01:42 ldap1 slapd[1229]: conn=363692 op=1 DEL dn="cn=VAC,ou=groups,dc=xxx,dc=com" --> Aug 30 12:01:43 ldap1 slapd[1229]: conn=363692 op=1: memberof_value_modify DN="uid=v6971,ou=people,dc=xxx,dc=com" delete memberOf="cn=VAC,ou=groups,dc=xxx,dc=com" failed err=16 Aug 30 12:01:43 ldap1 slapd[1229]: conn=363692 op=1 RESULT tag=107 err=0 text= Aug 30 12:01:43 ldap1 slapd[1229]: conn=363692 op=2 ADD dn="cn=VAC,ou=groups,dc=xxx,dc=com" Aug 30 12:01:43 ldap1 slapd[1229]: conn=363692 op=2 RESULT tag=105 err=0 text= Aug 30 12:01:43 ldap1 slapd[1229]: conn=363692 op=3 DEL dn="uid=V6971,ou=people,dc=xxx,dc=com" Aug 30 12:01:43 ldap1 slapd[1229]: conn=363692 op=3 RESULT tag=107 err=0 text= Aug 30 12:01:43 ldap1 slapd[1229]: conn=363692 op=4 ADD dn="uid=V6971,ou=people,dc=xxx,dc=com" Aug 30 12:01:43 ldap1 slapd[1229]: conn=363692 op=4 RESULT tag=105 err=0 text= Aug 30 12:01:43 ldap1 slapd[1229]: conn=363692 op=5 UNBIND Aug 30 12:01:43 ldap1 slapd[1229]: conn=363692 fd=32 closed And here the logs with only the 2nd part of LDIF : Aug 30 12:06:22 ldap1 slapd[1229]: conn=364437 fd=107 ACCEPT from IP= 192.168.0.1:43599 (IP=0.0.0.0:389) Aug 30 12:06:22 ldap1 slapd[1229]: conn=364437 op=0 BIND dn="cn=portail,ou=ldapusers,dc=xxx,dc=com" method=128 Aug 30 12:06:22 ldap1 slapd[1229]: conn=364437 op=0 BIND dn="cn=portail,ou=ldapusers,dc=xxx,dc=com" mech=SIMPLE ssf=0 Aug 30 12:06:22 ldap1 slapd[1229]: conn=364437 op=0 RESULT tag=97 err=0 text= --> Aug 30 12:06:22 ldap1 slapd[1229]: conn=364437 op=1 DEL dn="cn=VAC,ou=groups,dc=xxx,dc=com" Aug 30 12:06:22 ldap1 slapd[1229]: conn=364437 op=1 RESULT tag=107 err=0 text= Aug 30 12:06:22 ldap1 slapd[1229]: conn=364437 op=2 ADD dn="cn=VAC,ou=groups,dc=xxx,dc=com" Aug 30 12:06:22 ldap1 slapd[1229]: conn=364437 op=2 RESULT tag=105 err=0 text= Aug 30 12:06:22 ldap1 slapd[1229]: conn=364437 op=3 UNBIND Aug 30 12:06:22 ldap1 slapd[1229]: conn=364437 fd=107 closed For information, here the configuration of memberOf overlay : dn: olcOverlay={0}memberof, olcDatabase={1}hdb, cn=config olcMemberOfMemberAD: member olcMemberOfRefInt: FALSE olcOverlay: memberof olcMemberOfDangling: ignore objectClass: olcMemberOf objectClass: olcOverlayConfig olcMemberOfMemberOfAD: memberOf olcMemberOfGroupOC: groupOfNames We run OpenLDAP 2.4.31 replicated onto another host on Debian Wheezy. Do you have an idea on the problem ? Thanks, Sylvain

2 3

Re : Re: (ITS#7676) OpenLDAP 2.4.36 slapd crash with "assertion failed" message
by "POISSON Frédéric" 03 Sep '13

03 Sep '13

Hello all, Thanks first for the patch, i have applied it on my own build of 2.4.36 but i have now a strange behavior, the slapd do not crash but it refused operations. First here is the diff after applying the patch : $ diff ../BUILD/openldap-2.4.36/servers/slapd/bconfig.c ../BUILD/openldap-2.4.36/servers/slapd/bconfig.c.orig 3795d3794 < slap_tls_ctx = NULL; 3804,3808d3802 < } else { < if ( rc == LDAP_NOT_SUPPORTED ) < rc = LDAP_UNWILLING_TO_PERFORM; < else < rc = LDAP_OTHER; Now when i only add or replace only attribute olcTLSRandFile on cn=config i have : ldap_modify: Server is unwilling to perform (53) When i replace following values in this order with 4 actions/operations or with a single action/operation it works : dn: cn=config changetype: modify replace: olcTLSCACertificateFile olcTLSCACertificateFile: /usr/products/openldap/etc/openldap-single/tls/cacert.pem - replace: olcTLSCertificateFile olcTLSCertificateFile: /usr/products/openldap/etc/openldap-single/tls/cert.pem - replace: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /usr/products/openldap/etc/openldap-single/tls/key.pem - replace: olcTLSRandFile olcTLSRandFile: /dev/random But it don't works with only olcTLSRandfile if i do an add or replace first, why ? What do you need for investigation ? Regards, PS: Sorry this is my second post for a better reading... -- Frederic Poisson

2 1

Cannot bind with 2.4.35
by Olivier Nicole 03 Sep '13

03 Sep '13

Hi, I have a small program that I wrote some time back. It authenticates against an LDAP server. Linked with the library provided with OpenLDAP 2.3.40 it works fine, but when I tried to upgrade to 2.4.35, it would not bind anymore. The LDAP server (on a different machine) has not changed, the version of my program with the old library is still working fine. I am getting the error: Can't contact LDAP server I am useing self signed CA. The program is below. Thank you in advance, Olivier i=ldap_initialize(&ldap, "ldaps://ldap.x.y.z/"); if (i != LDAP_SUCCESS) { ERROR; } i=ldap_set_option(ldap, LDAP_OPT_REFERRALS, LDAP_OPT_OFF); if (i!=LDAP_OPT_SUCCESS) { ERROR; } i=ldap_set_option(ldap, LDAP_OPT_RESTART, LDAP_OPT_ON); if (i!=LDAP_OPT_SUCCESS) { ERROR; } res=LDAP_VERSION3; i=ldap_set_option(ldap, LDAP_OPT_PROTOCOL_VERSION, &res); if (i!=LDAP_OPT_SUCCESS) { ERROR; } /* DN containts the dn and passwd contains the password, they are correct */ i=ldap_bind_s(ldap, DN, passwd, LDAP_AUTH_SIMPLE); if (i != LDAP_SUCCESS) { if (i==49) { /* bad user or password */ } else if (i==53) { /* empty password */ } else { /* print ldap_err2string(i) */ /* this is where I get the error */ } } --

2 1

Extending schema problem.
by Mónico Briseño 02 Sep '13

02 Sep '13

Hi all. I'm new using openldap. I googled all info related with it. I decided to extend a ldap schema. but it didn't work. The error message is the following: adding new entry "cn=Gerald W. Cummings,ou=people,dc=example,dc=com" ldap_add: Undefined attribute type (17) additional info: businessName: attribute type undefined I had that error with the following files: #new object schema objectClass ( 1.3.6.1.4.1.4203.666.1.100 NAME 'YoLinuxPerson' DESC 'X-Person' SUP inetOrgPerson STRUCTURAL MAY ( personStatus $ preferredEmail $ mail2 $ businessName $ xmozillanickname $ birthdate $ c ) ) #new attributes # New attribute definitions: attributetype ( 1.3.6.1.4.1.4203.666.1.90 NAME 'personStatus' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1024} ) attributetype ( 1.3.6.1.4.1.4203.666.1.91 NAME 'preferredEmail' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1024} ) attributetype ( 1.3.6.1.4.1.4203.666.1.93 NAME 'businessName' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1024} ) attributetype ( 1.3.6.1.4.1.4203.666.1.94 NAME 'xmozillanickname' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1024} ) #attributetype ( 1.3.6.1.4.1.4203.666.1.95 NAME 'birthdate' SUP name ) Both files are inside of the schema folder with the same right that other files to run ldpap deamon without problem. ldap.conf file #Global section ##Include the minimum schema required. include /usr/local/etc/openldap/schema/core.schema ##Added to support the inetOrgPerson object. include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inteorgperson.schema #testing schemas include /usr/local/etc/openldap/schema/new-object.schema include /usr/local/etc/openldap/schema/new-attributes.schema What did I wrong? TIA -- M.S. José M. Briseño Cortés Universidad de Guadalajara Instructional Technologist Univ. Houston Moodle Teacher Certificate NTCM, IACEP, iNACOL, ACM member

3 3

Replicate part of cn=config in Multi-Master mode
by Yann Bordenave 02 Sep '13

02 Sep '13

Hello, I am running a Multi-master system with 3 nodes, replicating both main database and configuration database. I want to be able to have local configuration on every single node of my system. Is there a way to replicate just a part of cn=config database and still be able to modify the other part. As far I as understand, the filter option in syncrepl allows us to replicate a subtree but will I be able to replicate multiple subtrees with one filter ? Thanks for your answers. -- Yann Bordenave - Intern, R&E Infrastructure Smartjog S.A.S. - http://www.smartjog.com - Groupe TDF 27 Bd Hippolyte Marques, 94200 Ivry sur Seine, France Cell : +33.6.68.86.81.61

1 0

Limit value count of multivalued attribute?
by Ole 02 Sep '13

02 Sep '13

Hi, i'm searching a solution to limit the number of values for multivalued attributes. For example, my users can wirte multivalued "mail". But they should set only 20 mailaddress in max, not 20.000. Is there a way to do this with overlays? Regards Ole

3 2

RE: ldapadd "ldap_bind: Invalid credentials (49)"
by Clint Petty 31 Aug '13

31 Aug '13

-----Original Message----- From: Quanah Gibson-Mount [mailto:quanah@zimbra.com] Sent: Thursday, August 29, 2013 3:10 PM To: Clint Petty Subject: RE: ldapadd "ldap_bind: Invalid credentials (49)" --On Thursday, August 29, 2013 10:06 PM +0000 Clint Petty <cpetty(a)luthresearch.com> wrote: >> # /etc/init.d/slapd debug -1 -u ldap -F /usr/local/etc/openldap/slapd.d >> # -H ldapi:/// >> slapd: [INFO] Using /etc/default/slapd for configuration >> slapd: [INFO] Halting OpenLDAP... >> slapd: [INFO] Can't read PID file, to stop OpenLDAP try: >> /etc/init.d/slapd forcestop slapd: [INFO] No db_recover done >> slapd: [INFO] Launching OpenLDAP... >> slapd: [OK] File descriptor limit set to 1024 >> 521fc4a1 @(#) $OpenLDAP: slapd 2.4.36 (Aug 21 2013 09:39:54) $ >> clement@localhost.localdomain:/home/clement/build/BUILD/openldap-2.4.36/ >> servers/slapd 521fc4a1 /usr/local/openldap/etc/openldap/slapd.conf: line >> 5: unknown directive <dn:> >outside backend info and database >> definitions. 521fc4a1 slapd stopped. >> 521fc4a1 connections_destroy: nothing to destroy. > Hi Clint, > The point is to use a ">" with the text *I* wrote, not the text you write. > That's standard quoting of replies (as you will see my email client does > automatically). > In the above, you used /etc/init.d/slapd, rather than the slapd *binary*. > The above indicates you are using an invalid slapd.conf file localted in > /usr/local/openldap/etc/openldap. I thought you used cn=config? > You may need to examine /etc/default/slapd to see how to fix it to use > cn=config? etc. At this point, you may want to ask the LTB project for > guidance on configuring their servers correctly. > --Quanah _________________________________________________________________ # /usr/local/openldap/libexec/slapd -d -1 -u ldap -F /usr/local/etc/openldap/slapd.d -h ldapi:/// ldap_url_parse_ext(ldap://localhost/) ldap_init: trying /usr/local/openldap/etc/openldap/ldap.conf ldap_init: using /usr/local/openldap/etc/openldap/ldap.conf ldap_init: HOME env is /root ldap_init: trying /root/ldaprc ldap_init: trying /root/.ldaprc ldap_init: trying ldaprc ldap_init: LDAPCONF env is NULL ldap_init: LDAPRC env is NULL 521fc7d9 @(#) $OpenLDAP: slapd 2.4.36 (Aug 21 2013 09:39:54) $ clement@localhost.localdomain:/home/clement/build/BUILD/openldap-2.4.36/servers/slapd ldap_pvt_gethostbyname_a: host=ip-10-15-2-169, r=0 521fc7d9 daemon_init: ldapi:/// 521fc7d9 daemon_init: listen on ldapi:/// 521fc7d9 daemon_init: 1 listeners to open... ldap_url_parse_ext(ldapi:///) 521fc7d9 daemon: listener initialized ldapi:/// 521fc7d9 daemon_init: 1 listeners opened ldap_create 521fc7d9 slapd init: initiated server. 521fc7d9 slap_sasl_init: initialized! 521fc7d9 bdb_back_initialize: initialize BDB backend 521fc7d9 bdb_back_initialize: Berkeley DB 4.6.21: (September 27, 2007) 521fc7d9 hdb_back_initialize: initialize HDB backend 521fc7d9 hdb_back_initialize: Berkeley DB 4.6.21: (September 27, 2007) 521fc7d9 mdb_back_initialize: initialize MDB backend 521fc7d9 mdb_back_initialize: MDB 0.9.7: (January 10, 2013) 521fc7d9 ==> translucent_initialize 521fc7d9 backend_startup_one: starting "cn=config" 521fc7d9 ldif_read_file: Permission denied for "/usr/local/etc/openldap/slapd.d/cn=config.ldif" 521fc7d9 send_ldap_result: conn=-1 op=0 p=0 521fc7d9 send_ldap_result: err=80 matched="" text="internal error (cannot read some entry file)" 521fc7d9 slapd destroy: freeing system resources. 521fc7d9 slapd stopped. 521fc7d9 connections_destroy: nothing to destroy. # My /etc/default/slapd file looks like this: #==================================================================== # Configuration example of OpenLDAP's init script #==================================================================== # IP and port to listen IP="*" SSLIP="*" PORT="389" SSLPORT="636" # OpenLDAP directory and files SLAPD_PATH="/usr/local/openldap" SLAPD_PID_FILE="$SLAPD_PATH/var/run/slapd.pid" SLAPD_CONF="$SLAPD_PATH/etc/openldap/slapd.conf" SLAPD_CONF_DIR="" SLAPD_SERVICES="ldap://$IP:$PORT ldaps://$SSLIP:$SSLPORT" SLAPD_PARAMS="" SLAPD_BIN="$SLAPD_PATH/libexec/slapd" SLAPD_USER="ldap" SLAPD_GROUP="ldap" SLAPD_SYSLOG_LOCAL_USER="local4" DATA_PATH="auto" SLAPADD_BIN="$SLAPD_PATH/sbin/slapadd" SLAPADD_PARAMS="-q" SLAPCAT_BIN="$SLAPD_PATH/sbin/slapcat" SLAPINDEX_BIN="$SLAPD_PATH/sbin/slapindex" SLAPTEST_BIN="$SLAPD_PATH/sbin/slaptest" SLURPD_PID_FILE="$SLAPD_PATH/var/run/slurpd.pid" SLURPD_PARAMS="" SLURPD_BIN="$SLAPD_PATH/libexec/slurpd" # BerkeleyDB directory and files BDB_PATH="/usr/local/berkeleydb" DB_ARCHIVE_BIN="$BDB_PATH/bin/db_archive" DB_RECOVER_BIN="$BDB_PATH/bin/db_recover" RECOVER_AT_STARTUP="0" # Backup BACKUP_AT_SHUTDOWN="0" BACKUP_PATH="/var/backups/openldap" BACKUP_SUFFIX="`date +%Y%m%d%H%M%S`.ldif" BACKUP_COMPRESS_EXT="" # gz, bz2, ... BACKUP_COMPRESS_BIN="" # /bin/gzip, /bin/bzip2, ... BACKUP_UNCOMPRESS_BIN="" # /bin/gunzip, /bin/bunzip2, ... # Other TIMEOUT="30" # Max time to stop process FD_LIMIT="1024" # Max file descriptor DEBUG_LEVEL="256" # Debug loglevel SPECIAL_QUOTE="1" # Quote some command line parameters (eg: LDAP filters) Clint

2 19

Re : Antw: Re: OpenLDAP 2.4.36 slapd crash with "assertion failed" message
by "POISSON Frédéric" 30 Aug '13

30 Aug '13

Hello, I open ITS number 7676 (cf http://www.openldap.org/its/index.cgi/Incoming?id=7676;selectid=7676;statet…). Thanks all, Le 30/08/13, Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de> a écrit : > >>> Quanah Gibson-Mount <quanah(a)zimbra.com> schrieb am 29.08.2013 um 20:46 in > Nachricht <435F5EA8223A74BCD46762EC(a)[192.168.1.22]>: > > --On Thursday, August 29, 2013 4:17 PM +0200 "\"POISSON Frédéric\"" > > <frederic.poisson(a)admin.gmessaging.net> wrote: > > > >> Ok i have downloaded all the debuginfo package on my RHEL6.2 server, and > >> also i have to install with "--nodeps" options the package > >> glibc-debuginfo-2.12-1.47.el6_2.12.x86_64.rpm because it require the > >> glibc-debuginfo-common rpm package which do not found on Redhat website. > > > > Please file an ITS at http://www.openldap.org/its on this issue. > > > > Include your full cn=config (minus passwords), ldapmodify command, and the > > full backtrace from gdb you collected. > > ...and be aware that your gdb backtrace may include credentials (in non-obious > encoding) also... ;-) > > > > > Thanks. > > > > --Quanah > > > > > > -- > > > > Quanah Gibson-Mount > > Lead Engineer > > Zimbra, Inc > > -------------------- > > Zimbra :: the leader in open source messaging and collaboration > > > > -- Frederic Poisson

1 0

OpenLDAP 2.4.36 slapd crash with "assertion failed" message
by "POISSON Frédéric" 30 Aug '13

30 Aug '13

Ok i have downloaded all the debuginfo package on my RHEL6.2 server, and also i have to install with "--nodeps" options the package glibc-debuginfo-2.12-1.47.el6_2.12.x86_64.rpm because it require the glibc-debuginfo-common rpm package which do not found on Redhat website. Here is now the result : # gdb /usr/local/openldap/libexec/slapd 12945 GNU gdb (GDB) Red Hat Enterprise Linux (7.2-50.el6) Copyright (C) 2010 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-redhat-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /usr/local/openldap/libexec/slapd...Reading symbols from /usr/lib/debug/usr/local/openldap/libexec/slapd.debug...done. done. Attaching to program: /usr/local/openldap/libexec/slapd, process 12945 Reading symbols from /usr/local/berkeleydb/lib64/libdb-4.6.so...Reading symbols from /usr/lib/debug/usr/local/berkeleydb/lib64/libdb-4.6.so.debug... warning: "/usr/lib/debug/usr/local/berkeleydb/lib64/libdb-4.6.so.debug": separate debug info file has no debug info (no debugging symbols found)...done. (no debugging symbols found)...done. Loaded symbols for /usr/local/berkeleydb/lib64/libdb-4.6.so Reading symbols from /lib64/libpthread.so.0...Reading symbols from /usr/lib/debug/lib64/libpthread-2.12.so.debug...done. [Thread debugging using libthread_db enabled] [New Thread 0x7f823ed22700 (LWP 12947)] done. Loaded symbols for /lib64/libpthread.so.0 Reading symbols from /usr/lib64/libsasl2.so.2...Reading symbols from /usr/lib/debug/usr/lib64/libsasl2.so.2.0.23.debug...done. done. Loaded symbols for /usr/lib64/libsasl2.so.2 Reading symbols from /usr/lib64/libssl.so.10...Reading symbols from /usr/lib/debug/usr/lib64/libssl.so.1.0.0.debug...done. done. Loaded symbols for /usr/lib64/libssl.so.10 Reading symbols from /usr/lib64/libcrypto.so.10...Reading symbols from /usr/lib/debug/usr/lib64/libcrypto.so.1.0.0.debug...done. done. Loaded symbols for /usr/lib64/libcrypto.so.10 Reading symbols from /lib64/libcrypt.so.1...Reading symbols from /usr/lib/debug/lib64/libcrypt-2.12.so.debug...done. done. Loaded symbols for /lib64/libcrypt.so.1 Reading symbols from /lib64/libresolv.so.2...Reading symbols from /usr/lib/debug/lib64/libresolv-2.12.so.debug...done. done. Loaded symbols for /lib64/libresolv.so.2 Reading symbols from /usr/lib64/libltdl.so.7...Reading symbols from /usr/lib/debug/usr/lib64/libltdl.so.7.2.1.debug...done. done. Loaded symbols for /usr/lib64/libltdl.so.7 Reading symbols from /lib64/libc.so.6...Reading symbols from /usr/lib/debug/lib64/libc-2.12.so.debug...done. done. Loaded symbols for /lib64/libc.so.6 Reading symbols from /lib64/ld-linux-x86-64.so.2...Reading symbols from /usr/lib/debug/lib64/ld-2.12.so.debug...done. done. Loaded symbols for /lib64/ld-linux-x86-64.so.2 Reading symbols from /lib64/libdl.so.2...Reading symbols from /usr/lib/debug/lib64/libdl-2.12.so.debug...done. done. Loaded symbols for /lib64/libdl.so.2 Reading symbols from /lib64/libgssapi_krb5.so.2...Reading symbols from /usr/lib/debug/lib64/libgssapi_krb5.so.2.2.debug...done. done. Loaded symbols for /lib64/libgssapi_krb5.so.2 Reading symbols from /lib64/libkrb5.so.3...Reading symbols from /usr/lib/debug/lib64/libkrb5.so.3.3.debug...done. done. Loaded symbols for /lib64/libkrb5.so.3 Reading symbols from /lib64/libcom_err.so.2...Reading symbols from /usr/lib/debug/lib64/libcom_err.so.2.1.debug...done. done. Loaded symbols for /lib64/libcom_err.so.2 Reading symbols from /lib64/libk5crypto.so.3...Reading symbols from /usr/lib/debug/lib64/libk5crypto.so.3.1.debug...done. done. Loaded symbols for /lib64/libk5crypto.so.3 Reading symbols from /lib64/libz.so.1...Reading symbols from /usr/lib/debug/lib64/libz.so.1.2.3.debug...done. done. Loaded symbols for /lib64/libz.so.1 Reading symbols from /lib64/libfreebl3.so...Reading symbols from /usr/lib/debug/lib64/libfreebl3.so.debug...done. done. Loaded symbols for /lib64/libfreebl3.so Reading symbols from /lib64/libkrb5support.so.0...Reading symbols from /usr/lib/debug/lib64/libkrb5support.so.0.1.debug...done. done. Loaded symbols for /lib64/libkrb5support.so.0 Reading symbols from /lib64/libkeyutils.so.1...Reading symbols from /usr/lib/debug/lib64/libkeyutils.so.1.3.debug...done. done. Loaded symbols for /lib64/libkeyutils.so.1 Reading symbols from /lib64/libselinux.so.1...Reading symbols from /usr/lib/debug/lib64/libselinux.so.1.debug...done. done. Loaded symbols for /lib64/libselinux.so.1 Reading symbols from /lib64/libnss_files.so.2...Reading symbols from /usr/lib/debug/lib64/libnss_files-2.12.so.debug...done. done. Loaded symbols for /lib64/libnss_files.so.2 Reading symbols from /usr/lib64/sasl2/libsasldb.so...Reading symbols from /usr/lib/debug/usr/lib64/sasl2/libsasldb.so.2.0.23.debug...done. done. Loaded symbols for /usr/lib64/sasl2/libsasldb.so Reading symbols from /lib64/libdb-4.7.so...Reading symbols from /usr/lib/debug/lib64/libdb-4.7.so.debug...done. done. Loaded symbols for /lib64/libdb-4.7.so Reading symbols from /usr/lib64/sasl2/libanonymous.so...Reading symbols from /usr/lib/debug/usr/lib64/sasl2/libanonymous.so.2.0.23.debug...done. done. Loaded symbols for /usr/lib64/sasl2/libanonymous.so 0x0000003a00c0804d in pthread_join (threadid=140197376435968, thread_return=0x0) at pthread_join.c:89 89 lll_wait_tid (pd->tid); (gdb) backtrace full #0 0x0000003a00c0804d in pthread_join (threadid=140197376435968, thread_return=0x0) at pthread_join.c:89 __ignore = -512 _tid = 12947 _buffer = {__routine = 0x3a00c07f20 <cleanup>, __arg = 0x7f823ed22d28, __canceltype = 1053960656, __prev = 0x0} oldtype = 0 pd = 0x7f823ed22700 self = 0x7f8281c967c0 result = 0 #1 0x000000000043a0e9 in slapd_daemon () at daemon.c:2929 i = <value optimized out> rc = <value optimized out> #2 0x0000000000426435 in main (argc=11, argv=<value optimized out>) at main.c:1012 i = <value optimized out> no_detach = 0 rc = -12 urls = 0x1aad010 "ldap://*:25389 ldaps://*:25636" username = 0x1aad080 "root" groupname = 0x1aad0a0 "\026\065U" sandbox = 0x0 syslogUser = 160 pid = <value optimized out> waitfds = {9, 10} g_argc = 11 g_argv = <value optimized out> configfile = 0x0 configdir = 0x1aad040 "/usr/local/openldap/etc/openldap/slapd.d" serverName = <value optimized out> scp = <value optimized out> scp_entry = <value optimized out> debug_unknowns = 0x0 syslog_unknowns = 0x0 serverNamePrefix = <value optimized out> slapd_pid_file_unlink = 1 slapd_args_file_unlink = 1 firstopt = <value optimized out> __PRETTY_FUNCTION__ = "main" (gdb) continue Continuing. [New Thread 0x7f823e521700 (LWP 11522)] [New Thread 0x7f823dd20700 (LWP 11523)] Program received signal SIGABRT, Aborted. [Switching to Thread 0x7f823e521700 (LWP 11522)] 0x0000003a00432885 in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64 64 return INLINE_SYSCALL (tgkill, 3, pid, selftid, sig); (gdb) backtrace full #0 0x0000003a00432885 in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64 resultvar = 0 pid = 12945 selftid = 11522 #1 0x0000003a00434065 in abort () at abort.c:92 save_stage = 2 act = {__sigaction_handler = {sa_handler = 0x5dc95e, sa_sigaction = 0x5dc95e}, sa_mask = {__val = {249113688989, 140197368029312, 0, 140197368029552, 249112713062, 206158430232, 140197368029568, 140197368029344, 249112620008, 206158430256, 140197368029600, 140197128851280, 117, 117, 0, 140736009787411}}, sa_flags = 5579917, sa_restorer = 0x5dc857} sigs = {__val = {32, 0 <repeats 15 times>}} #2 0x0000003a0042b9fe in __assert_fail_base (fmt=<value optimized out>, assertion=0x5dc95e "!((rs->sr_err)<0)", file=0x5dc857 "result.c", line=<value optimized out>, function=<value optimized out>) at assert.c:96 str = 0x7f8230104f50 "" total = 4096 #3 0x0000003a0042bac0 in __assert_fail (assertion=0x5dc95e "!((rs->sr_err)<0)", file=0x5dc857 "result.c", line=813, function=0x5dcb40 "slap_send_ldap_result") at assert.c:105 No locals. #4 0x0000000000450bed in slap_send_ldap_result (op=0x7f8230002660, rs=0x7f823e520950) at result.c:813 tmp = 0x0 otext = 0x7f823e51f394 "" oref = 0x0 __PRETTY_FUNCTION__ = "slap_send_ldap_result" #5 0x000000000042d567 in config_back_modify (op=<value optimized out>, rs=<value optimized out>) at bconfig.c:5926 cfb = <value optimized out> ce = <value optimized out> last = 0xd00000000 ml = <value optimized out> ca = {argc = 2, argv = 0x7f8230103ef0, argv_size = 513, line = 0x7f8230102bf0 "/dev/random", tline = 0x7f8230103ed0 "", fname = 0x5d1f79 "slapd", lineno = 0, log = "olcTLSRandFile: value #0", '\000' <repeats 4099 times>, reply = {err = 0, msg = '\000' <repeats 255 times>}, depth = 0, valx = -1, values = {v_int = 806375360, v_uint = 806375360, v_long = 140197128851392, v_ulong = 140197128851392, v_ber_t = 140197128851392, v_string = 0x7f8230104fc0 "/dev/random", v_bv = {bv_len = 140197128851392, bv_val = 0x0}, v_dn = {vdn_dn = { bv_len = 140197128851392, bv_val = 0x0}, vdn_ndn = {bv_len = 0, bv_val = 0x0}}, v_ad = 0x7f8230104fc0}, rvalue_vals = 0x0, rvalue_nvals = 0x0, op = 0, type = 4, ca_op = 0x7f8230002660, be = 0x88e960, bi = 0x0, ca_entry = 0x1b300d8, ca_private = 0x1b2f970, cleanup = 0x427a70 <config_tls_cleanup>, table = Cft_Global} rdn = {bv_len = 2, bv_val = 0x1b2fe30 "cn=config"} ptr = <value optimized out> rad = 0x1ada450 do_pause = <value optimized out> #6 0x000000000045745b in fe_op_modify (op=0x7f8230002660, rs=0x7f823e520950) at modify.c:303 update = <value optimized out> repl_user = <value optimized out> op_be = <value optimized out> bd = 0x88e960 textbuf = "8,\000\060\202\177", '\000' <repeats 18 times>, "\003\000\000\000\000\000\000\000\020/Z\000\000\000\000\000Â7Z\000\000\000\000\000`s¬\001\000\000\000\000ð\035\000\060\202\177\000\000\200ªG\000\000\000\000\000\066¢E\000\000\000\000\000\016\000\000\000\000\000\000\000+&\000\060\202\177", '\000' <repeats 18 times>, "\v\000\000\000\000\000\000\000ð+\020\060\202\177\000\000 +\000\060\202\177\000\000\020,\020\060\202\177\000\000\000\000\000\000\000\000\000\000\200\036¯\001", '\000' <repeats 28 times>, "\237nE\000\000\000\000\000\000\bR>\202\177\000\000p\tR>\202\177\000\000\000\001\000\000\000\000\000\000`&\000\060\202\177\000\000\210&\000\060\202\177\000\000\230&"... #7 0x0000000000457d86 in do_modify (op=0x7f8230002660, rs=0x7f823e520950) at modify.c:177 dn = {bv_len = 9, bv_val = 0x7f8230002617 "cn=config"} textbuf = "\027)\000\060\202\177\000\000Ð+\000\060\202\177\000\000\000\060\020\000\000\000\000\000\000@\000\000\000\000\000\000\000\020\002\000\000\000\000\000\060\000\020\000\000\000\000\000\004\000\000\000\000\000\000\000 \000\000\000\000\000\000\000\000\001\000\000\000\000\000\000\001\000\001\000\060@\000\000[\b\000\000\200\000\000\000\227\000\000\000n\001", '\000' <repeats 20 times>, "\020\000\000\000\000\000 \000\000\060\202\177\000\000\001\000\000\000\000\000\000\000°\nR>\202\177\000\000Ð'\000\060\202\177\000\000Ñ\227G\000:", '\000' <repeats 13 times>, "\020\000\000\000\000\000\001\000\000\000\000\000\000\000\031\001\\\000\000\000\000\000\000\000\020\000\000\000\000\000û\237E\000\000\000\000\000 +\000\060\202"... tmp = <value optimized out> #8 0x000000000043fb79 in connection_operation (ctx=0x7f823e520ab0, arg_v=0x7f8230002660) at connection.c:1155 rc = 80 cancel = <value optimized out> op = 0x7f8230002660 rs = {sr_type = REP_RESULT, sr_tag = 0, sr_msgid = 0, sr_err = -12, sr_matched = 0x0, sr_text = 0x7f823e51f394 "", ---Type <return> to continue, or q <return> to quit--- sr_ref = 0x0, sr_ctrls = 0x0, sr_un = {sru_search = {r_entry = 0x0, r_attr_flags = 0, r_operational_attrs = 0x0, r_attrs = 0x0, r_nentries = 0, r_v2ref = 0x0}, sru_sasl = {r_sasldata = 0x0}, sru_extended = {r_rspoid = 0x0, r_rspdata = 0x0}}, sr_flags = 0} tag = 102 opidx = SLAP_OP_MODIFY conn = 0x1bbad20 memctx = 0x7f8230002ba0 memctx_null = 0x0 memsiz = 1048576 __PRETTY_FUNCTION__ = "connection_operation" #9 0x0000000000440365 in connection_read_thread (ctx=0x7f823e520ab0, argv=<value optimized out>) at connection.c:1291 rc = <value optimized out> cri = {op = 0x7f8230002660, func = 0, arg = 0x0, ctx = 0x7f823e520ab0, nullop = <value optimized out>} s = <value optimized out> #10 0x0000000000595b80 in ldap_int_thread_pool_wrapper (xpool=0x1add680) at tpool.c:688 pool = 0x1add680 task = 0x7f8238000a20 work_list = <value optimized out> ctx = {ltu_id = 140197368043264, ltu_key = {{ltk_key = 0x43e990, ltk_data = 0x7f8230002a90, ltk_free = 0x43ea60 <conn_counter_destroy>}, {ltk_key = 0x492f40, ltk_data = 0x7f8230002ba0, ltk_free = 0x492f60 <slap_sl_mem_destroy>}, {ltk_key = 0x0, ltk_data = 0x0, ltk_free = 0} <repeats 27 times>, { ltk_key = 0x0, ltk_data = 0x3a00c07e8a, ltk_free = 0}, {ltk_key = 0x0, ltk_data = 0x0, ltk_free = 0}, { ltk_key = 0x0, ltk_data = 0x0, ltk_free = 0}}} kctx = <value optimized out> keyslot = 936 hash = <value optimized out> __PRETTY_FUNCTION__ = "ldap_int_thread_pool_wrapper" #11 0x0000003a00c077f1 in start_thread (arg=0x7f823e521700) at pthread_create.c:301 __res = <value optimized out> pd = 0x7f823e521700 now = <value optimized out> unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140197368043264, -7363636271228307732, 140197376425120, 140197368043968, 0, 3, 7407127774185469676, -7369267418370066708}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = { prev = 0x0, cleanup = 0x0, canceltype = 0}}} not_first_call = <value optimized out> pagesize_m1 = <value optimized out> sp = <value optimized out> freesize = <value optimized out> #12 0x0000003a004e5ccd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:115 No locals. (gdb) continue Continuing. [Thread 0x7f823dd20700 (LWP 11523) exited] [Thread 0x7f823e521700 (LWP 11522) exited] [Thread 0x7f823ed22700 (LWP 12947) exited] Program terminated with signal SIGABRT, Aborted. The program no longer exists. (gdb) quit Regards, Le 29/08/13, Aaron Richton <richton(a)nbcs.rutgers.edu> a écrit : > On Thu, 29 Aug 2013, "POISSON Fr?d?ric" wrote: > > >Missing separate debuginfos, use: debuginfo-install cyrus-sasl-lib-2.1.23-13.el6.x86_64 db4-4.7.25-16.el6.x86_64 glibc-2.12-1.47.el6_2.12.x86_64 keyutils-libs-1.4-3.el6.x86_64 krb5-libs-1.9-22.el6_2.1.x86_64 > >libcom_err-1.41.12-11.el6.x86_64 libselinux-2.0.94-5.2.el6.x86_64 libtool-ltdl-2.2.6-15.5.el6.x86_64 nss-softokn-freebl-3.12.9-11.el6.x86_64 openssl-1.0.0-20.el6_2.4.x86_64 zlib-1.2.3-27.el6.x86_64 > > Admittedly the slapd symbols are the most important and may (or may not) be sufficient, but it'd be kinder on our eyes if you followed this advice and got a fresh backtrace? > > > -- Frederic Poisson

3 2

Q: duplicate contextCSN; remove it?
by Ulrich Windl 30 Aug '13

30 Aug '13

Hi! When I examine my slapcat of the config database (multi-master replication), I see a duplicate contextCSN; one of them seems obsolete: contextCSN: 20130722065709.189194Z#000000#000#000000 contextCSN: 20130729112421.079210Z#000000#001#000000 Can I remove one of those, and if so, how? I tried once, but the CSN re-appered, maybe from an other master... Or are those expected to be there? Regards, Ulrich

3 4

RE: ldapadd "ldap_bind: Invalid credentials (49)"
by Clint Petty 30 Aug '13

30 Aug '13

-----Original Message----- From: Quanah Gibson-Mount [mailto:quanah@zimbra.com] Sent: Thursday, August 29, 2013 3:10 PM To: Clint Petty Subject: RE: ldapadd "ldap_bind: Invalid credentials (49)" --On Thursday, August 29, 2013 10:06 PM +0000 Clint Petty <cpetty(a)luthresearch.com> wrote: >> # /etc/init.d/slapd debug -1 -u ldap -F /usr/local/etc/openldap/slapd.d >> # -H ldapi:/// >> slapd: [INFO] Using /etc/default/slapd for configuration >> slapd: [INFO] Halting OpenLDAP... >> slapd: [INFO] Can't read PID file, to stop OpenLDAP try: >> /etc/init.d/slapd forcestop slapd: [INFO] No db_recover done >> slapd: [INFO] Launching OpenLDAP... >> slapd: [OK] File descriptor limit set to 1024 >> 521fc4a1 @(#) $OpenLDAP: slapd 2.4.36 (Aug 21 2013 09:39:54) $ >> clement@localhost.localdomain:/home/clement/build/BUILD/openldap-2.4.36/ >> servers/slapd 521fc4a1 /usr/local/openldap/etc/openldap/slapd.conf: line >> 5: unknown directive <dn:> >outside backend info and database >> definitions. 521fc4a1 slapd stopped. >> 521fc4a1 connections_destroy: nothing to destroy. > Hi Clint, > The point is to use a ">" with the text *I* wrote, not the text you write. > That's standard quoting of replies (as you will see my email client does > automatically). > In the above, you used /etc/init.d/slapd, rather than the slapd *binary*. > The above indicates you are using an invalid slapd.conf file localted in > /usr/local/openldap/etc/openldap. I thought you used cn=config? > You may need to examine /etc/default/slapd to see how to fix it to use > cn=config? etc. At this point, you may want to ask the LTB project for > guidance on configuring their servers correctly. > --Quanah _________________________________________________________________ # /usr/local/openldap/libexec/slapd -d -1 -u ldap -F /usr/local/etc/openldap/slapd.d -h ldapi:/// ldap_url_parse_ext(ldap://localhost/) ldap_init: trying /usr/local/openldap/etc/openldap/ldap.conf ldap_init: using /usr/local/openldap/etc/openldap/ldap.conf ldap_init: HOME env is /root ldap_init: trying /root/ldaprc ldap_init: trying /root/.ldaprc ldap_init: trying ldaprc ldap_init: LDAPCONF env is NULL ldap_init: LDAPRC env is NULL 521fc7d9 @(#) $OpenLDAP: slapd 2.4.36 (Aug 21 2013 09:39:54) $ clement@localhost.localdomain:/home/clement/build/BUILD/openldap-2.4.36/servers/slapd ldap_pvt_gethostbyname_a: host=ip-10-15-2-169, r=0 521fc7d9 daemon_init: ldapi:/// 521fc7d9 daemon_init: listen on ldapi:/// 521fc7d9 daemon_init: 1 listeners to open... ldap_url_parse_ext(ldapi:///) 521fc7d9 daemon: listener initialized ldapi:/// 521fc7d9 daemon_init: 1 listeners opened ldap_create 521fc7d9 slapd init: initiated server. 521fc7d9 slap_sasl_init: initialized! 521fc7d9 bdb_back_initialize: initialize BDB backend 521fc7d9 bdb_back_initialize: Berkeley DB 4.6.21: (September 27, 2007) 521fc7d9 hdb_back_initialize: initialize HDB backend 521fc7d9 hdb_back_initialize: Berkeley DB 4.6.21: (September 27, 2007) 521fc7d9 mdb_back_initialize: initialize MDB backend 521fc7d9 mdb_back_initialize: MDB 0.9.7: (January 10, 2013) 521fc7d9 ==> translucent_initialize 521fc7d9 backend_startup_one: starting "cn=config" 521fc7d9 ldif_read_file: Permission denied for "/usr/local/etc/openldap/slapd.d/cn=config.ldif" 521fc7d9 send_ldap_result: conn=-1 op=0 p=0 521fc7d9 send_ldap_result: err=80 matched="" text="internal error (cannot read some entry file)" 521fc7d9 slapd destroy: freeing system resources. 521fc7d9 slapd stopped. 521fc7d9 connections_destroy: nothing to destroy. # Clint

2 1

Re: Antw: Problems recovering my ldap db[Solved]
by Ger Hooton 29 Aug '13

29 Aug '13

I just started over with a new DB Thanks for your help //Ger ----------------original message----------------- From: "Ulrich Windl" Ulrich.Windl(a)rz.uni-regensburg.de To: ghooton(a)scins.ie Date: Thu, 29 Aug 2013 08:07:51 +0200 ------------------------------------------------- >>>> ghooton(a)scins.ie schrieb am 28.08.2013 um 18:37 in Nachricht > 8004e8d0438c1185f5c2c6b474f7cea0.squirrel(a)www.scins.ie : >> Hi all, I am >> recovering form a disaster. when I do slapcat I can see all the info > > Hi! > > I think it depends on the type of desaster: For human error or filesystem > corruption, you must probably restore your last successful database dump. If > the machine just crashed (and the filesystem configuration was sane), there > shouldn't be a problem with automatic recovery (IMHO). > > Regards, > Ulrich > >> stored in the ldap db However, when I do ldapsearch >> I cannot see anything. When I do slapcat -l backup.ldif I get : >> unclean shutdown >> detected; attempting recovery >> recovery skipped in read-only mode. >> Run manual >> recovery if errors are encountered >> >> I am using Debian 6 2.6.32-5-amd64 and :- >> ldapsearch -VV >> ldapsearch: @(#) $OpenLDAP: ldapsearch 2.4.23 (Dec 16 2012 11:48:21) $ >> >> root@carillon :/tmp/buildd/openldap-2.4.23/debian/build/clients/too >> ls >> (LDAP library: OpenLDAP 20423) >> >> >> //Ger > > > > -- Scoil Chroí Íosa Blarney. Blarney. Co. Cork

1 0

Issue with mdb_cursor_del in MDB_DUPSORT databases
by Mark Zealey 29 Aug '13

29 Aug '13

Hi Howard, I've now switched the database to use MDB_DUPSORT and found what seems to be another issue to do with invalid data being returned after mdb_cursor_del. The following code shows the behaviour against a database that I can provide you with if you need: rc = mdb_cursor_open(txn, dbi, &cursor); char seek[] = "ku.oc.repmulp\t"; key.mv_size = sizeof(seek); key.mv_data = &seek; mdb_cursor_get(cursor, &key, &data, MDB_SET_RANGE); for( i = 0; i < 15; i++ ) { mdb_cursor_del( cursor, MDB_NODUPDATA ); data.mv_size = 0; key.mv_size = 0; mdb_cursor_get( cursor, &key, &data, //MDB_NEXT MDB_GET_CURRENT ); if( key.mv_size == 0 ) printf("WARNING 0 SIZE KEY\n"); else printf("KEY OK: %d: %.*s\n", key.mv_size, key.mv_size, key.mv_data); if( data.mv_size == 0 ) printf("WARNING 0 SIZE DATA\n"); else printf("DATA OK: %d: %.*s\n", data.mv_size, data.mv_size, data.mv_data); } mdb_txn_abort(txn); If you run as-is it seems that if the cursor points at a record with multiple entries, the data is not updated. If however the mdb_cursor_del line is commented and mdb_cursor_get changed to use MDB_NEXT the output is as expected with multiple entries. Here is sample output with get-only: KEY OK: 16: ku.oc.repmulp MX DATA OK: 40: 4160598 300 0 primary.mail.plumper.co.uk KEY OK: 16: ku.oc.repmulp MX DATA OK: 37: 4160598 300 10 cerebellum.david14.com KEY OK: 16: ku.oc.repmulp MX DATA OK: 46: 4160598 300 20 secondary-mail.mailhoster.co.uk KEY OK: 16: ku.oc.repmulp NS DATA OK: 30: 4160598 300 ns1.xcalibre.co.uk KEY OK: 16: ku.oc.repmulp NS DATA OK: 30: 4160598 300 ns2.xcalibre.co.uk KEY OK: 21: ku.oc.repmulp.05pot A DATA OK: 29: 4160598 86400 212.159.180.202 KEY OK: 22: ku.oc.repmulp.05pot MX DATA OK: 40: 4160598 300 0 primary.mail.plumper.co.uk KEY OK: 22: ku.oc.repmulp.05pot MX DATA OK: 37: 4160598 300 10 cerebellum.david14.com KEY OK: 22: ku.oc.repmulp.05pot MX DATA OK: 46: 4160598 300 20 secondary-mail.mailhoster.co.uk And here with mdb_cursor_del: KEY OK: 16: ku.oc.repmulp MX WARNING 0 SIZE DATA KEY OK: 16: ku.oc.repmulp NS WARNING 0 SIZE DATA KEY OK: 21: ku.oc.repmulp.05pot A DATA OK: 29: 4160598 86400 212.159.180.202 KEY OK: 22: ku.oc.repmulp.05pot MX WARNING 0 SIZE DATA KEY OK: 25: ku.oc.repmulp.05pot.www A DATA OK: 29: 4160598 86400 212.159.180.202 KEY OK: 20: ku.oc.repmulp.3pop A DATA OK: 29: 4160598 86400 212.159.180.202 Behaviour seems to be the same regardless of whether I use MDB_NODUPDATA or 0 as the mdb_cursor_del flag (ie 0 length data returned and all duplicate entries deleted) Thanks, Mark

2 2

RE: ldapadd "ldap_bind: Invalid credentials (49)"
by Juergen.Sprenger＠swisscom.com 29 Aug '13

29 Aug '13

--On Thursday, August 29, 2013 12:35 AM +0000 Clint Petty <cpetty(a)luthresearch.com> wrote: > > > After upgrading from OpenLDAP 2.4.23 to 2.4.36, I can no longer add a > user: > > > ># ldapadd -x -D "cn=Manager,dc=luthresearch,dc=net" -w secret -f # >/etc/openldap/adduser.ldif Check Your config for RootPW and whether the hash algorithm used is still supported by Your build of OpenLDAP. Had a similar problem on an old server because --enable-crypt was not set when building OpenLDAP 2.4.36. You can check that by using slappasswd to create a String like the one used in Your config: # /usr/local/sbin/slappasswd -s secret -h '{crypt}' Password generation failed for scheme {crypt}: scheme not recognized --Jürgen Sprenger

3 2

ldapadd "ldap_bind: Invalid credentials (49)"
by Clint Petty 29 Aug '13

29 Aug '13

After upgrading from OpenLDAP 2.4.23 to 2.4.36, I can no longer add a user: # ldapadd -x -D "cn=Manager,dc=luthresearch,dc=net" -w secret -f /etc/openldap/adduser.ldif ldap_bind: Invalid credentials (49)

2 3

Unstable slapd-meta connection with MS AD LDAP
by Nick Anzalone 29 Aug '13

29 Aug '13

Hello, I'm trying to use slapd-meta (openldap version 2.4.28) as a proxy between a web application LDAP authentication request and a MS AD server. The idea being that if we have multiple LDAP authentication clients we can add another target with suffix massage to redirect requests to the appropriate LDAP server. We were forced to use a dedicated proxy because we were told the MS server's firewall requires an actual IP, not a FQDN, and we don't have a stable ip (we're using a load balancer service which only provides a FQDN). In general, it looked like this solution would work well. My problem is that the connection between the slapd-meta proxy and the MS server does not seem very robust. I would be extremely grateful if someone could help me understand where I might start looking to diagnose what is wrong. #################### Problem Summary ##################### The problem I'm seeing was reported as an "Operations Error" from the command line. Initially, I did not have idle-timeout set at all, and this error would occur reliably after 15 minutes of inactivity, and was not recoverable (I needed to restart the slapd server to correct the problem). I suspected that the cause was that the connection was remaining idle too long and getting invalidated by the MS LDAP server (which I don't have access to). To address this problem, I set idle-timeout to 10m (MS AD apparently has a default timeout of 15m). I have set up a cron job to "ping" the MS server every minute in an attempt to keep the connection open (although I'm not sure if it actually uses the same connection, so this may not be doing much). I also set the value of the nretries configuration directive to 20. These adjustments seemed to help significantly. With constant activity (authentication through the web application), everything appears to work great. However I still occasionally get the "operations error," which causes my web application to reject the initial authentication even with correct credentials. At this point it is most reliably reproduced by inducing more than 15 minutes of inactivity on the slapd-meta proxy, and then attempting a login. After an initial failed login attempt, the problem seems to correct for itself (i.e. a second login attempt through the web application with the same credentials will succeed). I am at all times able to connect directly to the LDAP server with no trouble. It is only connections through the slapd-meta proxy I have set up that (sometimes) fail. It may also be worth noting that I don't see any of these problems with an openldap test server that I set up. Thanks so much in advance for any help or suggestions. ################################## Problem Details ##################################### Below is an excerpt from my syslog from a failed authentication request initiated by my web application: -------------------- log output from syslog ------------------------------------------ Aug 28 20:33:26 my-proxy-server slapd[10330]: daemon: epoll: listen=8 active_threads=0 tvp=NULL Aug 28 20:33:26 my-proxy-server slapd[10330]: daemon: epoll: listen=9 active_threads=0 tvp=NULL Aug 28 20:33:26 my-proxy-server slapd[10330]: daemon: epoll: listen=10 active_threads=0 tvp=NULL Aug 28 20:33:26 my-proxy-server slapd[10330]: conn=1094 op=1 do_search Aug 28 20:33:26 my-proxy-server slapd[10330]: >>> dnPrettyNormal: <dc=AAA,dc=YYY,dc=ZZZ> Aug 28 20:33:26 my-proxy-server slapd[10330]: <<< dnPrettyNormal: <dc=AAA,dc=YYY,dc=ZZZ>, <dc=AAA,dc=YYY,dc=ZZZ> Aug 28 20:33:26 my-proxy-server slapd[10330]: SRCH "dc=AAA,dc=YYY,dc=ZZZ" 2 3 Aug 28 20:33:26 my-proxy-server slapd[10330]: 0 0 0 Aug 28 20:33:26 my-proxy-server slapd[10330]: begin get_filter Aug 28 20:33:26 my-proxy-server slapd[10330]: EQUALITY Aug 28 20:33:26 my-proxy-server slapd[10330]: end get_filter 0 Aug 28 20:33:26 my-proxy-server slapd[10330]: filter: (?SAMACCOUNTNAME=xxx) Aug 28 20:33:26 my-proxy-server slapd[10330]: => get_ctrls Aug 28 20:33:26 my-proxy-server slapd[10330]: => get_ctrls: oid="2.16.840.1.113730.3.4.2" (noncritical) Aug 28 20:33:26 my-proxy-server slapd[10330]: <= get_ctrls: n=1 rc=0 err="" Aug 28 20:33:26 my-proxy-server slapd[10330]: attrs: Aug 28 20:33:26 my-proxy-server slapd[10330]: Aug 28 20:33:26 my-proxy-server slapd[10330]: conn=1094 op=1 SRCH base="dc=AAA,dc=YYY,dc=ZZZ" scope=2 deref=3 filter="(?SAMACCOUNTNAME=xxx)" Aug 28 20:33:26 my-proxy-server slapd[10330]: conn=1094 op=1 meta_back_getconn: mc=0x7fafbc004500 conn=ROOTDN expired (tainted). Aug 28 20:33:26 my-proxy-server slapd[10330]: conn=1094 op=1: meta_back_getconn[1] Aug 28 20:33:26 my-proxy-server slapd[10330]: conn=1094 op=1 meta_back_getconn: candidates=1 conn=ROOTDN fetched Aug 28 20:33:26 my-proxy-server slapd[10330]: conn=1094 op=1 >>> meta_back_search_start[1] Aug 28 20:33:26 my-proxy-server slapd[10330]: conn=1094 op=1 >>> meta_search_dobind_init[1] Aug 28 20:33:26 my-proxy-server slapd[10330]: conn=1094 op=1 <<< meta_search_dobind_init[1]=1 Aug 28 20:33:26 my-proxy-server slapd[10330]: ==> rewrite_context_apply [depth=1] string='dc=AAA,dc=YYY,dc=ZZZ' Aug 28 20:33:26 my-proxy-server slapd[10330]: ==> rewrite_rule_apply rule='((.+),)?dc=AAA,[ ]?dc=YYY,[ ]?dc=ZZZ$' string='dc=AAA,dc=YYY,dc=ZZZ' [1 pass(es)] Aug 28 20:33:26 my-proxy-server slapd[10330]: ==> rewrite_context_apply [depth=1] res={0,'ou=Org Unit,dc=AAA,dc=BBB,dc=CCC,dc=DDD'} Aug 28 20:33:26 my-proxy-server slapd[10330]: [rw] searchBase: "dc=AAA,dc=YYY,dc=ZZZ" -> "ou=Org Unit,dc=AAA,dc=BBB,dc=CCC,dc=DDD" Aug 28 20:33:26 my-proxy-server slapd[10330]: ==> rewrite_context_apply [depth=1] string='(SAMACCOUNTNAME=xxx)' Aug 28 20:33:26 my-proxy-server slapd[10330]: ==> rewrite_context_apply [depth=1] res={0,'NULL'} Aug 28 20:33:26 my-proxy-server slapd[10330]: [rw] searchFilter: "(SAMACCOUNTNAME=xxx)" -> "(SAMACCOUNTNAME=xxx)" Aug 28 20:33:26 my-proxy-server slapd[10330]: conn=1094 op=1 meta_back_retry[1]: retrying URI="ldap://ms-ldap-server.AAA.BBB.CCC.DDD" DN="cn=bind-manager,ou=Org Unit,dc=AAA,dc=BBB,dc=CCC,dc=DDD". Aug 28 20:33:26 my-proxy-server slapd[10330]: >>> conn=1094 op=1 meta_back_bind_op_result[1] Aug 28 20:33:26 my-proxy-server slapd[10330]: <<< conn=1094 op=1 meta_back_bind_op_result[1] err=0 Aug 28 20:33:26 my-proxy-server slapd[10330]: conn=1094 op=1 meta_back_retry[1]: meta_back_single_dobind=0 Aug 28 20:33:26 my-proxy-server slapd[10330]: conn=1094 op=1 <<< meta_back_search_start[1]=1 Aug 28 20:33:26 my-proxy-server slapd[10330]: conn=1094 op=1 meta_back_search: ncandidates=1 cnd=" *" Aug 28 20:33:26 my-proxy-server slapd[10330]: conn=1094 op=1 meta_back_search[1] match="" err=1 (Operations error). Aug 28 20:33:26 my-proxy-server slapd[10330]: send_ldap_result: conn=1094 op=1 p=3 Aug 28 20:33:26 my-proxy-server slapd[10330]: send_ldap_result: err=1 matched="" text="" Aug 28 20:33:26 my-proxy-server slapd[10330]: send_ldap_response: msgid=2 tag=101 err=1 Aug 28 20:33:26 my-proxy-server slapd[10330]: conn=1094 op=1 SEARCH RESULT tag=101 err=1 nentries=0 text= ######################### slapd.conf ######################## # This is the main slapd configuration file. See slapd.conf(5) for more # info on the configuration options. ####################################################################### # Global Directives: # Features to permit #allow bind_v2 # Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema # Where the pid file is put. The init.d script # will not stop the server if you change this. pidfile /var/run/slapd/slapd.pid # List of arguments that were passed to the server argsfile /var/run/slapd/slapd.args # Read slapd.conf(5) for possible values # should reduce this once we're live loglevel any # Where the dynamically loaded modules are stored modulepath /usr/lib/ldap moduleload back_meta.la moduleload back_ldap.la # The maximum number of entries that is returned for a search operation sizelimit 500 # The tool-threads parameter sets the actual amount of cpu's that is used # for indexing. tool-threads 1 # experiment trying to figure out error below: # ber_get_next on fd 12 failed errno=34 (Numerical result out of range) #sockbuf_max_incoming_auth 5000000000 # Specific Backend Directives for 'other': # Backend specific directives apply to this backend until another # 'backend' directive occurs backend meta # this is broken - causes slapd to terminate #TLSCipherSuite ALL:!NULL #TLSCipherSuite ECDHE-RSA-AES256-SHA #TLSCipherSuite SECURE256 # TLS Security settings TLSCACertificateFile /etc/ldap/cert/private/ca.my-proxy-server.YYY.ZZZ.pem TLSCertificateFile /etc/ldap/cert/private/ca.my-proxy-server.YYY.ZZZ.pem TLSCertificateKeyFile /etc/ldap/cert/private/private.my-proxy-server.YYY.ZZZ.pem #TLSVerifyClient try # require TLS (secure) connection #security tls=1 ######################################################### # CUSTOM META SLAPD ################################################# database meta suffix "dc=YYY,dc=ZZZ" rootdn "cn=XXX,dc=YYY,dc=ZZZ" rootpw ***** # The following parameters were added to trouble-shoot the unstable connection w/ MS LDAP server idle-timeout 10m nretries 20 ####################################################################### # Test LDAP server on staging # Each LDAP server will get its own entry like this # Please document each server ####################################################### # The LDAP server URL. Note the dc=test in the suffix, which allows us to uniquely identify the request as # one that should be passed to our test server. We might use one like dc=AAA for an entry that would pass # requests to the AAA LDAP server uri "ldap://test.YYY.ZZZ/dc=test,dc=YYY,dc=ZZZ" # Tells the client to use a secure connection with the server. tls start # More connection specifics: specifies the filename/location of the client certificate if the server requires one # we also specify the DN used to bind, and credentials (password) for the binding DN. idassert-bind tls_cacert=/etc/ldap/cert/test.YYY.ZZZ.crt binddn="cn=admin,dc=YYY,dc=ZZZ" credentials="*****" # NB: There is a parameter that needs to "allow" the server to require a client certificate (tls_reqcert=allow), however it doesn't seem to # work. So we were forced to set this in the ldap.conf (client-side) config file. slapd uses this file to set default values for many # parameters, including this one. # This removes the "dc=test" specifier before delegating the LDAP request to the test server. suffixmassage "dc=test,dc=YYY,dc=ZZZ" "dc=YYY,dc=ZZZ" ########################################################################## # AAA LDAP Server Entry # Here is the AAA-provided "user context": # OU=Org Unit, DC=AAA, DC=BBB, DC=CCC, DC=DDD # ########################################################## uri "ldap://ms-ldap-server.AAA.BBB.CCC.DDD/dc=AAA,dc=YYY,dc=ZZZ" tls start idassert-bind tls_cacert=/etc/ldap/cert/AAA.BBB.CCC.DDD.crt binddn="cn=bind-manager,ou=Org Unit,dc=AAA,dc=BBB,dc=CCC,dc=DDD" credentials="******" suffixmassage "dc=AAA,dc=YYY,dc=ZZZ" "ou=Org Unit,dc=AAA,dc=BBB,dc=CCC,dc=DDD" default-target

2 1

Re : Re: OpenLDAP 2.4.36 slapd crash with "assertion failed" message
by "POISSON Frédéric" 29 Aug '13

29 Aug '13

Re Hello, Sorry that was for me the first time i use gdb and i haven't understand that it require to install rpm with debuginfo, now here is a new gdb trace with more informations : # gdb /usr/local/openldap/libexec/slapd 4700 GNU gdb (GDB) Red Hat Enterprise Linux (7.2-50.el6) Copyright (C) 2010 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-redhat-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /usr/local/openldap/libexec/slapd...Reading symbols from /usr/lib/debug/usr/local/openldap/libexec/slapd.debug...done. done. Attaching to program: /usr/local/openldap/libexec/slapd, process 4700 Reading symbols from /usr/local/berkeleydb/lib64/libdb-4.6.so...Reading symbols from /usr/lib/debug/usr/local/berkeleydb/lib64/libdb-4.6.so.debug... warning: "/usr/lib/debug/usr/local/berkeleydb/lib64/libdb-4.6.so.debug": separate debug info file has no debug info (no debugging symbols found)...done. (no debugging symbols found)...done. Loaded symbols for /usr/local/berkeleydb/lib64/libdb-4.6.so Reading symbols from /lib64/libpthread.so.0...(no debugging symbols found)...done. [Thread debugging using libthread_db enabled] [New Thread 0x7f0f51882700 (LWP 4814)] Loaded symbols for /lib64/libpthread.so.0 Reading symbols from /usr/lib64/libsasl2.so.2...(no debugging symbols found)...done. Loaded symbols for /usr/lib64/libsasl2.so.2 Reading symbols from /usr/lib64/libssl.so.10...(no debugging symbols found)...done. Loaded symbols for /usr/lib64/libssl.so.10 Reading symbols from /usr/lib64/libcrypto.so.10...(no debugging symbols found)...done. Loaded symbols for /usr/lib64/libcrypto.so.10 Reading symbols from /lib64/libcrypt.so.1...(no debugging symbols found)...done. Loaded symbols for /lib64/libcrypt.so.1 Reading symbols from /lib64/libresolv.so.2...(no debugging symbols found)...done. Loaded symbols for /lib64/libresolv.so.2 Reading symbols from /usr/lib64/libltdl.so.7...(no debugging symbols found)...done. Loaded symbols for /usr/lib64/libltdl.so.7 Reading symbols from /lib64/libc.so.6...(no debugging symbols found)...done. Loaded symbols for /lib64/libc.so.6 Reading symbols from /lib64/ld-linux-x86-64.so.2...(no debugging symbols found)...done. Loaded symbols for /lib64/ld-linux-x86-64.so.2 Reading symbols from /lib64/libdl.so.2...(no debugging symbols found)...done. Loaded symbols for /lib64/libdl.so.2 Reading symbols from /lib64/libgssapi_krb5.so.2...(no debugging symbols found)...done. Loaded symbols for /lib64/libgssapi_krb5.so.2 Reading symbols from /lib64/libkrb5.so.3...(no debugging symbols found)...done. Loaded symbols for /lib64/libkrb5.so.3 Reading symbols from /lib64/libcom_err.so.2...(no debugging symbols found)...done. Loaded symbols for /lib64/libcom_err.so.2 Reading symbols from /lib64/libk5crypto.so.3...(no debugging symbols found)...done. Loaded symbols for /lib64/libk5crypto.so.3 Reading symbols from /lib64/libz.so.1...(no debugging symbols found)...done. Loaded symbols for /lib64/libz.so.1 Reading symbols from /lib64/libfreebl3.so...(no debugging symbols found)...done. Loaded symbols for /lib64/libfreebl3.so Reading symbols from /lib64/libkrb5support.so.0...(no debugging symbols found)...done. Loaded symbols for /lib64/libkrb5support.so.0 Reading symbols from /lib64/libkeyutils.so.1...(no debugging symbols found)...done. Loaded symbols for /lib64/libkeyutils.so.1 Reading symbols from /lib64/libselinux.so.1...(no debugging symbols found)...done. Loaded symbols for /lib64/libselinux.so.1 Reading symbols from /lib64/libnss_files.so.2...(no debugging symbols found)...done. Loaded symbols for /lib64/libnss_files.so.2 Reading symbols from /usr/lib64/sasl2/libsasldb.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib64/sasl2/libsasldb.so Reading symbols from /lib64/libdb-4.7.so...(no debugging symbols found)...done. Loaded symbols for /lib64/libdb-4.7.so Reading symbols from /usr/lib64/sasl2/libanonymous.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib64/sasl2/libanonymous.so 0x0000003a00c0804d in pthread_join () from /lib64/libpthread.so.0 Missing separate debuginfos, use: debuginfo-install cyrus-sasl-lib-2.1.23-13.el6.x86_64 db4-4.7.25-16.el6.x86_64 glibc-2.12-1.47.el6_2.12.x86_64 keyutils-libs-1.4-3.el6.x86_64 krb5-libs-1.9-22.el6_2.1.x86_64 libcom_err-1.41.12-11.el6.x86_64 libselinux-2.0.94-5.2.el6.x86_64 libtool-ltdl-2.2.6-15.5.el6.x86_64 nss-softokn-freebl-3.12.9-11.el6.x86_64 openssl-1.0.0-20.el6_2.4.x86_64 zlib-1.2.3-27.el6.x86_64 (gdb) backtrace full #0 0x0000003a00c0804d in pthread_join () from /lib64/libpthread.so.0 No symbol table info available. #1 0x000000000043a0e9 in slapd_daemon () at daemon.c:2929 i = <value optimized out> rc = <value optimized out> #2 0x0000000000426435 in main (argc=11, argv=<value optimized out>) at main.c:1012 i = <value optimized out> no_detach = 0 rc = -12 urls = 0x23f5010 "ldap://*:25389 ldaps://*:25636" username = 0x23f5080 "root" groupname = 0x23f50a0 "\026\065U" sandbox = 0x0 syslogUser = 160 pid = <value optimized out> waitfds = {9, 10} g_argc = 11 g_argv = <value optimized out> configfile = 0x0 configdir = 0x23f5040 "/usr/local/openldap/etc/openldap/slapd.d" serverName = <value optimized out> scp = <value optimized out> scp_entry = <value optimized out> debug_unknowns = 0x0 syslog_unknowns = 0x0 serverNamePrefix = <value optimized out> slapd_pid_file_unlink = 1 slapd_args_file_unlink = 1 firstopt = <value optimized out> __PRETTY_FUNCTION__ = "main" (gdb) continue Continuing. [New Thread 0x7f0f51081700 (LWP 5623)] Program received signal SIGABRT, Aborted. [Switching to Thread 0x7f0f51081700 (LWP 5623)] 0x0000003a00432885 in raise () from /lib64/libc.so.6 (gdb) backtrace full #0 0x0000003a00432885 in raise () from /lib64/libc.so.6 No symbol table info available. #1 0x0000003a00434065 in abort () from /lib64/libc.so.6 No symbol table info available. #2 0x0000003a0042b9fe in __assert_fail_base () from /lib64/libc.so.6 No symbol table info available. #3 0x0000003a0042bac0 in __assert_fail () from /lib64/libc.so.6 No symbol table info available. #4 0x0000000000450bed in slap_send_ldap_result (op=0x7f0f44002670, rs=0x7f0f51080950) at result.c:813 tmp = 0x0 otext = 0x7f0f5107f394 "" oref = 0x0 __PRETTY_FUNCTION__ = "slap_send_ldap_result" #5 0x000000000042d567 in config_back_modify (op=<value optimized out>, rs=<value optimized out>) at bconfig.c:5926 cfb = <value optimized out> ce = <value optimized out> last = 0xd00000000 ml = <value optimized out> ca = {argc = 2, argv = 0x7f0f44103f90, argv_size = 513, line = 0x7f0f44102cc0 "/dev/random", tline = 0x7f0f44103f70 "", fname = 0x5d1f79 "slapd", lineno = 0, log = "olcTLSRandFile: value #0", '\000' <repeats 4099 times>, reply = {err = 0, msg = '\000' <repeats 255 times>}, depth = 0, valx = -1, values = {v_int = 1141915104, v_uint = 1141915104, v_long = 139703543152096, v_ulong = 139703543152096, v_ber_t = 139703543152096, v_string = 0x7f0f44103de0 "0?\020D\017\177", v_bv = {bv_len = 139703543152096, bv_val = 0x0}, v_dn = {vdn_dn = { bv_len = 139703543152096, bv_val = 0x0}, vdn_ndn = {bv_len = 0, bv_val = 0x0}}, v_ad = 0x7f0f44103de0}, rvalue_vals = 0x0, rvalue_nvals = 0x0, op = 0, type = 4, ca_op = 0x7f0f44002670, be = 0x88e960, bi = 0x0, ca_entry = 0x24780d8, ca_private = 0x2477970, cleanup = 0x427a70 <config_tls_cleanup>, table = Cft_Global} rdn = {bv_len = 2, bv_val = 0x2477e30 "cn=config"} ptr = <value optimized out> rad = 0x2422450 do_pause = <value optimized out> #6 0x000000000045745b in fe_op_modify (op=0x7f0f44002670, rs=0x7f0f51080950) at modify.c:303 update = <value optimized out> repl_user = <value optimized out> op_be = <value optimized out> bd = 0x88e960 textbuf = "x,\000D\017\177", '\000' <repeats 18 times>, "\003\000\000\000\000\000\000\000\020/Z\000\000\000\000\000Â7Z\000\000\000\000\000`ó@\002\000\000\000\000ð\035\000D\017\177\000\000\200ªG\000\000\000\000\000\066¢E\000\000\000\000\000\016\000\000\000\000\000\000\000K,\020D\017\177", '\000' <repeats 18 times>, "\v\000\000\000\000\000\000\000À,\020D\017\177\000\000à+\000D\017\177\000\000à,\020D\017\177\000\000\000\000\000\000\000\000\000\000\200\236C\002", '\000' <repeats 28 times>, "\237nE\000\000\000\000\000\000\b\bQ\017\177\000\000p\t\bQ\017\177\000\000\000\001\000\000\000\000\000\000p&\000D\017\177\000\000\230&\000D\017\177\000\000¨&"... #7 0x0000000000457d86 in do_modify (op=0x7f0f44002670, rs=0x7f0f51080950) at modify.c:177 dn = {bv_len = 9, bv_val = 0x7f0f44102c37 "cn=config"} textbuf = "')\000D\017\177", '\000' <repeats 42 times>, "Ð\b\bQ\000\000\000\000°\n\bQ\017\177", '\000' <repeats 18 times>, "P\t\bQ\017\177\000\000ùäÀ\000:", '\000' <repeats 11 times>, "\211\022\\\000\000\000\000\000Ð\b\bQ\017\177\000\000p&\000D\017\177\000\000ÿÿÿÿ\017\177\000\000½ÄE\000\000\000\000\000P\t\bQ\017\177\000\000@\224x\000:", '\000' <repeats 11 times>, "\020&\000D\017\177\000\000à+\000D\017\177\000\000\000\000\020\000\000\000\000\000\001\000\000\000\000\000\000\000\001\000\000\000\000\000\000\000°\n\bQ\017\177\000\000ð0I", '\000' <repeats 13 times>, "\005\000\000\000\061\000\000\000p&\000D\017"... tmp = <value optimized out> #8 0x000000000043fb79 in connection_operation (ctx=0x7f0f51080ab0, arg_v=0x7f0f44002670) at connection.c:1155 rc = 80 cancel = <value optimized out> op = 0x7f0f44002670 rs = {sr_type = REP_RESULT, sr_tag = 0, sr_msgid = 0, sr_err = -12, sr_matched = 0x0, sr_text = 0x7f0f5107f394 "", sr_ref = 0x0, sr_ctrls = 0x0, sr_un = {sru_search = {r_entry = 0x0, r_attr_flags = 0, r_operational_attrs = 0x0, r_attrs = 0x0, r_nentries = 0, r_v2ref = 0x0}, sru_sasl = {r_sasldata = 0x0}, sru_extended = {r_rspoid = 0x0, r_rspdata = 0x0}}, sr_flags = 0} tag = 102 opidx = SLAP_OP_MODIFY conn = 0x2502d20 memctx = 0x7f0f44002be0 memctx_null = 0x0 memsiz = 1048576 __PRETTY_FUNCTION__ = "connection_operation" #9 0x0000000000440365 in connection_read_thread (ctx=0x7f0f51080ab0, argv=<value optimized out>) at connection.c:1291 ---Type <return> to continue, or q <return> to quit--- rc = <value optimized out> cri = {op = 0x7f0f44002670, func = 0, arg = 0x0, ctx = 0x7f0f51080ab0, nullop = <value optimized out>} s = <value optimized out> #10 0x0000000000595b80 in ldap_int_thread_pool_wrapper (xpool=0x2425680) at tpool.c:688 pool = 0x2425680 task = 0x7f0f4c0008c0 work_list = <value optimized out> ctx = {ltu_id = 139703760721664, ltu_key = {{ltk_key = 0x43e990, ltk_data = 0x7f0f44002ad0, ltk_free = 0x43ea60 <conn_counter_destroy>}, {ltk_key = 0x492f40, ltk_data = 0x7f0f44002be0, ltk_free = 0x492f60 <slap_sl_mem_destroy>}, {ltk_key = 0x452d70, ltk_data = 0x0, ltk_free = 0x452b40 <slap_op_q_destroy>}, {ltk_key = 0x0, ltk_data = 0x0, ltk_free = 0} <repeats 26 times>, { ltk_key = 0x0, ltk_data = 0x3a00c07e8a, ltk_free = 0}, {ltk_key = 0x0, ltk_data = 0x0, ltk_free = 0}, { ltk_key = 0x0, ltk_data = 0x0, ltk_free = 0}}} kctx = <value optimized out> keyslot = 990 hash = <value optimized out> __PRETTY_FUNCTION__ = "ldap_int_thread_pool_wrapper" #11 0x0000003a00c077f1 in start_thread () from /lib64/libpthread.so.0 No symbol table info available. #12 0x0000003a004e5ccd in clone () from /lib64/libc.so.6 No symbol table info available. (gdb) continue Continuing. [Thread 0x7f0f51081700 (LWP 5623) exited] [Thread 0x7f0f51882700 (LWP 4814) exited] Program terminated with signal SIGABRT, Aborted. The program no longer exists. (gdb) quit Regards Le 29/08/13, "POISSON Frédéric" <frederic.poisson(a)admin.gmessaging.net> a écrit : > Hello, > > Ok thanks for the information, i try the gdb with full backtrace and i have : > > # gdb /usr/local/openldap/libexec/slapd 9522 > GNU gdb (GDB) Red Hat Enterprise Linux (7.2-50.el6) > Copyright (C) 2010 Free Software Foundation, Inc. > License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> > This is free software: you are free to change and redistribute it. > There is NO WARRANTY, to the extent permitted by law. Type "show copying" > and "show warranty" for details. > This GDB was configured as "x86_64-redhat-linux-gnu". > For bug reporting instructions, please see: > <http://www.gnu.org/software/gdb/bugs/>... > Reading symbols from /usr/local/openldap/libexec/slapd...(no debugging symbols found)...done. > Attaching to program: /usr/local/openldap/libexec/slapd, process 9522 > Reading symbols from /usr/local/berkeleydb/lib64/libdb-4.6.so...(no debugging symbols found)...done. > Loaded symbols for /usr/local/berkeleydb/lib64/libdb-4.6.so > Reading symbols from /lib64/libpthread.so.0...(no debugging symbols found)...done. > [Thread debugging using libthread_db enabled] > [New Thread 0x7f036993a700 (LWP 9523)] > Loaded symbols for /lib64/libpthread.so.0 > Reading symbols from /usr/lib64/libsasl2.so.2...(no debugging symbols found)...done. > Loaded symbols for /usr/lib64/libsasl2.so.2 > Reading symbols from /usr/lib64/libssl.so.10...(no debugging symbols found)...done. > Loaded symbols for /usr/lib64/libssl.so.10 > Reading symbols from /usr/lib64/libcrypto.so.10...(no debugging symbols found)...done. > Loaded symbols for /usr/lib64/libcrypto.so.10 > Reading symbols from /lib64/libcrypt.so.1...(no debugging symbols found)...done. > Loaded symbols for /lib64/libcrypt.so.1 > Reading symbols from /lib64/libresolv.so.2...(no debugging symbols found)...done. > Loaded symbols for /lib64/libresolv.so.2 > Reading symbols from /usr/lib64/libltdl.so.7...(no debugging symbols found)...done. > Loaded symbols for /usr/lib64/libltdl.so.7 > Reading symbols from /lib64/libc.so.6...(no debugging symbols found)...done. > Loaded symbols for /lib64/libc.so.6 > Reading symbols from /lib64/ld-linux-x86-64.so.2...(no debugging symbols found)...done. > Loaded symbols for /lib64/ld-linux-x86-64.so.2 > Reading symbols from /lib64/libdl.so.2...(no debugging symbols found)...done. > Loaded symbols for /lib64/libdl.so.2 > Reading symbols from /lib64/libgssapi_krb5.so.2...(no debugging symbols found)...done. > Loaded symbols for /lib64/libgssapi_krb5.so.2 > Reading symbols from /lib64/libkrb5.so.3...(no debugging symbols found)...done. > Loaded symbols for /lib64/libkrb5.so.3 > Reading symbols from /lib64/libcom_err.so.2...(no debugging symbols found)...done. > Loaded symbols for /lib64/libcom_err.so.2 > Reading symbols from /lib64/libk5crypto.so.3...(no debugging symbols found)...done. > Loaded symbols for /lib64/libk5crypto.so.3 > Reading symbols from /lib64/libz.so.1...(no debugging symbols found)...done. > Loaded symbols for /lib64/libz.so.1 > Reading symbols from /lib64/libfreebl3.so...(no debugging symbols found)...done. > Loaded symbols for /lib64/libfreebl3.so > Reading symbols from /lib64/libkrb5support.so.0...(no debugging symbols found)...done. > Loaded symbols for /lib64/libkrb5support.so.0 > Reading symbols from /lib64/libkeyutils.so.1...(no debugging symbols found)...done. > Loaded symbols for /lib64/libkeyutils.so.1 > Reading symbols from /lib64/libselinux.so.1...(no debugging symbols found)...done. > Loaded symbols for /lib64/libselinux.so.1 > Reading symbols from /lib64/libnss_files.so.2...(no debugging symbols found)...done. > Loaded symbols for /lib64/libnss_files.so.2 > Reading symbols from /usr/lib64/sasl2/libsasldb.so...(no debugging symbols found)...done. > Loaded symbols for /usr/lib64/sasl2/libsasldb.so > Reading symbols from /lib64/libdb-4.7.so...(no debugging symbols found)...done. > Loaded symbols for /lib64/libdb-4.7.so > Reading symbols from /usr/lib64/sasl2/libanonymous.so...(no debugging symbols found)...done. > Loaded symbols for /usr/lib64/sasl2/libanonymous.so > 0x0000003a00c0804d in pthread_join () from /lib64/libpthread.so.0 > Missing separate debuginfos, use: debuginfo-install openldap-ltb-2.4.36-1.el6.x86_64 > (gdb) backtrace full > #0 0x0000003a00c0804d in pthread_join () from /lib64/libpthread.so.0 > No symbol table info available. > #1 0x000000000043a0e9 in slapd_daemon () > No symbol table info available. > #2 0x0000000000426435 in main () > No symbol table info available. > (gdb) continue > Continuing. > [New Thread 0x7f0369139700 (LWP 11349)] > > Program received signal SIGABRT, Aborted. > [Switching to Thread 0x7f0369139700 (LWP 11349)] > 0x0000003a00432885 in raise () from /lib64/libc.so.6 > (gdb) backtrace full > #0 0x0000003a00432885 in raise () from /lib64/libc.so.6 > No symbol table info available. > #1 0x0000003a00434065 in abort () from /lib64/libc.so.6 > No symbol table info available. > #2 0x0000003a0042b9fe in __assert_fail_base () from /lib64/libc.so.6 > No symbol table info available. > #3 0x0000003a0042bac0 in __assert_fail () from /lib64/libc.so.6 > No symbol table info available. > #4 0x0000000000450bed in slap_send_ldap_result () > No symbol table info available. > #5 0x000000000042d567 in ?? () > No symbol table info available. > #6 0x000000000045745b in fe_op_modify () > No symbol table info available. > #7 0x0000000000457d86 in do_modify () > No symbol table info available. > #8 0x000000000043fb79 in ?? () > No symbol table info available. > #9 0x0000000000440365 in ?? () > No symbol table info available. > #10 0x0000000000595b80 in ?? () > No symbol table info available. > #11 0x0000003a00c077f1 in start_thread () from /lib64/libpthread.so.0 > No symbol table info available. > #12 0x0000003a004e5ccd in clone () from /lib64/libc.so.6 > No symbol table info available. > (gdb) continue > Continuing. > [Thread 0x7f0369139700 (LWP 11349) exited] > [Thread 0x7f036993a700 (LWP 9523) exited] > > Program terminated with signal SIGABRT, Aborted. > The program no longer exists. > (gdb) quit > > Tell me if it help, or if you need more. > > Regards, > > Le 29/08/13, Nick Milas <nick(a)eurobjects.com> a écrit : > > On 29/8/2013 12:42 μμ, "POISSON Frédéric" wrote: > > > > >The server shutdown when i add this entry and with slapd option "-d 255" i have : > > >slapd: result.c:813: slap_send_ldap_result: Assertion `!((rs->sr_err)<0)' failed. > > >/etc/init.d/slapd: line 285: 5461 Aborted $SLAPD_BIN -h "$SLAPD_SERVICES" $SLAPD_PARAMS > > > > > >Notice that i test this ldif modification on release 2.4.35 without problem. > > > > Can you try taking a full backtrace? > > > > See for example: http://www.openldap.org/lists/openldap-technical/201111/msg00243.html > > > > I am not a developer, but I have been through the same situation, so I know that a full backtrace is needed for troubleshooting. > > > > Best regards, > > Nick > > > > > > > -- > > Frederic Poisson > > > > > > -- Frederic Poisson

2 2

The RootDN
by Joseph D Carroll Jr 29 Aug '13

29 Aug '13

It's been 3 days since I first started reading and playing with openLDAP. Prior to this, I have had no ldap experience of any kind, so please bear with me. (Hopefully this doesn't reach a new low... ) I am working on setting up my first ldap server for a demo environment, and I can't seem to wrap my head around what a rootdn is. I have read several articles, even much of the Zytrax book, and I still cannot figure out what this rootdn is. I get that it is a user, so maybe better stated, I don't understand where the user exists. Is it an OS user with filesystem privileges? Is it a user that exists in every DIT? If so, when/where is it used, can you have multiple, is it only usuable/accesible when you "include" the core.schema, .. ? If I had to guess, I would say: - A rootdn exists in the DIT as a completely arbitrary user (absolutely no relation to the OS) - There can only be one rootdn per DIT - (Consquently) If a parent defines a rootdn, any referral cannot - The rootdn is used for some kind of system action (who knows what) I know this is the "technical" forum, but I am more so interested in the "why to's" and "reasons behind" than the "how to's". Any clarity would be greatly appreciated. Thanks, JD

3 2

Re : Re: OpenLDAP 2.4.36 slapd crash with "assertion failed" message
by "POISSON Frédéric" 29 Aug '13

29 Aug '13

Hello, Ok thanks for the information, i try the gdb with full backtrace and i have : # gdb /usr/local/openldap/libexec/slapd 9522 GNU gdb (GDB) Red Hat Enterprise Linux (7.2-50.el6) Copyright (C) 2010 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-redhat-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /usr/local/openldap/libexec/slapd...(no debugging symbols found)...done. Attaching to program: /usr/local/openldap/libexec/slapd, process 9522 Reading symbols from /usr/local/berkeleydb/lib64/libdb-4.6.so...(no debugging symbols found)...done. Loaded symbols for /usr/local/berkeleydb/lib64/libdb-4.6.so Reading symbols from /lib64/libpthread.so.0...(no debugging symbols found)...done. [Thread debugging using libthread_db enabled] [New Thread 0x7f036993a700 (LWP 9523)] Loaded symbols for /lib64/libpthread.so.0 Reading symbols from /usr/lib64/libsasl2.so.2...(no debugging symbols found)...done. Loaded symbols for /usr/lib64/libsasl2.so.2 Reading symbols from /usr/lib64/libssl.so.10...(no debugging symbols found)...done. Loaded symbols for /usr/lib64/libssl.so.10 Reading symbols from /usr/lib64/libcrypto.so.10...(no debugging symbols found)...done. Loaded symbols for /usr/lib64/libcrypto.so.10 Reading symbols from /lib64/libcrypt.so.1...(no debugging symbols found)...done. Loaded symbols for /lib64/libcrypt.so.1 Reading symbols from /lib64/libresolv.so.2...(no debugging symbols found)...done. Loaded symbols for /lib64/libresolv.so.2 Reading symbols from /usr/lib64/libltdl.so.7...(no debugging symbols found)...done. Loaded symbols for /usr/lib64/libltdl.so.7 Reading symbols from /lib64/libc.so.6...(no debugging symbols found)...done. Loaded symbols for /lib64/libc.so.6 Reading symbols from /lib64/ld-linux-x86-64.so.2...(no debugging symbols found)...done. Loaded symbols for /lib64/ld-linux-x86-64.so.2 Reading symbols from /lib64/libdl.so.2...(no debugging symbols found)...done. Loaded symbols for /lib64/libdl.so.2 Reading symbols from /lib64/libgssapi_krb5.so.2...(no debugging symbols found)...done. Loaded symbols for /lib64/libgssapi_krb5.so.2 Reading symbols from /lib64/libkrb5.so.3...(no debugging symbols found)...done. Loaded symbols for /lib64/libkrb5.so.3 Reading symbols from /lib64/libcom_err.so.2...(no debugging symbols found)...done. Loaded symbols for /lib64/libcom_err.so.2 Reading symbols from /lib64/libk5crypto.so.3...(no debugging symbols found)...done. Loaded symbols for /lib64/libk5crypto.so.3 Reading symbols from /lib64/libz.so.1...(no debugging symbols found)...done. Loaded symbols for /lib64/libz.so.1 Reading symbols from /lib64/libfreebl3.so...(no debugging symbols found)...done. Loaded symbols for /lib64/libfreebl3.so Reading symbols from /lib64/libkrb5support.so.0...(no debugging symbols found)...done. Loaded symbols for /lib64/libkrb5support.so.0 Reading symbols from /lib64/libkeyutils.so.1...(no debugging symbols found)...done. Loaded symbols for /lib64/libkeyutils.so.1 Reading symbols from /lib64/libselinux.so.1...(no debugging symbols found)...done. Loaded symbols for /lib64/libselinux.so.1 Reading symbols from /lib64/libnss_files.so.2...(no debugging symbols found)...done. Loaded symbols for /lib64/libnss_files.so.2 Reading symbols from /usr/lib64/sasl2/libsasldb.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib64/sasl2/libsasldb.so Reading symbols from /lib64/libdb-4.7.so...(no debugging symbols found)...done. Loaded symbols for /lib64/libdb-4.7.so Reading symbols from /usr/lib64/sasl2/libanonymous.so...(no debugging symbols found)...done. Loaded symbols for /usr/lib64/sasl2/libanonymous.so 0x0000003a00c0804d in pthread_join () from /lib64/libpthread.so.0 Missing separate debuginfos, use: debuginfo-install openldap-ltb-2.4.36-1.el6.x86_64 (gdb) backtrace full #0 0x0000003a00c0804d in pthread_join () from /lib64/libpthread.so.0 No symbol table info available. #1 0x000000000043a0e9 in slapd_daemon () No symbol table info available. #2 0x0000000000426435 in main () No symbol table info available. (gdb) continue Continuing. [New Thread 0x7f0369139700 (LWP 11349)] Program received signal SIGABRT, Aborted. [Switching to Thread 0x7f0369139700 (LWP 11349)] 0x0000003a00432885 in raise () from /lib64/libc.so.6 (gdb) backtrace full #0 0x0000003a00432885 in raise () from /lib64/libc.so.6 No symbol table info available. #1 0x0000003a00434065 in abort () from /lib64/libc.so.6 No symbol table info available. #2 0x0000003a0042b9fe in __assert_fail_base () from /lib64/libc.so.6 No symbol table info available. #3 0x0000003a0042bac0 in __assert_fail () from /lib64/libc.so.6 No symbol table info available. #4 0x0000000000450bed in slap_send_ldap_result () No symbol table info available. #5 0x000000000042d567 in ?? () No symbol table info available. #6 0x000000000045745b in fe_op_modify () No symbol table info available. #7 0x0000000000457d86 in do_modify () No symbol table info available. #8 0x000000000043fb79 in ?? () No symbol table info available. #9 0x0000000000440365 in ?? () No symbol table info available. #10 0x0000000000595b80 in ?? () No symbol table info available. #11 0x0000003a00c077f1 in start_thread () from /lib64/libpthread.so.0 No symbol table info available. #12 0x0000003a004e5ccd in clone () from /lib64/libc.so.6 No symbol table info available. (gdb) continue Continuing. [Thread 0x7f0369139700 (LWP 11349) exited] [Thread 0x7f036993a700 (LWP 9523) exited] Program terminated with signal SIGABRT, Aborted. The program no longer exists. (gdb) quit Tell me if it help, or if you need more. Regards, Le 29/08/13, Nick Milas <nick(a)eurobjects.com> a écrit : > On 29/8/2013 12:42 μμ, "POISSON Frédéric" wrote: > > >The server shutdown when i add this entry and with slapd option "-d 255" i have : > >slapd: result.c:813: slap_send_ldap_result: Assertion `!((rs->sr_err)<0)' failed. > >/etc/init.d/slapd: line 285: 5461 Aborted $SLAPD_BIN -h "$SLAPD_SERVICES" $SLAPD_PARAMS > > > >Notice that i test this ldif modification on release 2.4.35 without problem. > > Can you try taking a full backtrace? > > See for example: http://www.openldap.org/lists/openldap-technical/201111/msg00243.html > > I am not a developer, but I have been through the same situation, so I know that a full backtrace is needed for troubleshooting. > > Best regards, > Nick > > > -- Frederic Poisson

2 1

OpenLDAP 2.4.36 slapd crash with "assertion failed" message
by "POISSON Frédéric" 29 Aug '13

29 Aug '13

Hello, I'm testing the latest release of OpenLDAP 2.4.36 and my slapd stop while i'm doing a change on cn=config. My tests are with my own compilation of OpenLDAP on a RHEL6 server but i see the same problem with "LTB project RPMs" http://ltb-project.org/wiki/download#openldap with RHEL6 package. My aim is to modify cn=config like this in order to implement TLS, here is my ldif : dn: cn=config changetype: modify add: olcTLSRandFile olcTLSRandFile: /dev/random The server shutdown when i add this entry and with slapd option "-d 255" i have : slapd: result.c:813: slap_send_ldap_result: Assertion `!((rs->sr_err)<0)' failed. /etc/init.d/slapd: line 285: 5461 Aborted $SLAPD_BIN -h "$SLAPD_SERVICES" $SLAPD_PARAMS Notice that i test this ldif modification on release 2.4.35 without problem. Is there any changes inside cn=config behavior with release 2.4.36 that i don't see ? Thanks in advance, Regards, PS: This is my second submission to mailling list, sorry for the convenience. -- Frederic Poisson

2 1

OpenLDAP Samba4
by Pascal den Bekker 29 Aug '13

29 Aug '13

Hello, I want to use openldap as a backend for Samba4. I set up the openldap with a different port, because samba4 has an own "ldap" server running on port 389. I set up the standard config for samba4 like this: passdb backend = ldapsam:ldap://ldap.example.com:3389 ldap suffix = dc=ldap,dc=example,dc=com ldap user suffix = ou=users ldap group suffix = ou=groups ldap machine suffix = ou=computers ldap idmap suffix = ou=Idmap ldap delete dn = no ldap admin dn = cn=admin,dc=ldap,dc=example,dc=com ldap ssl = no ldap passwd sync = yes idmap_ldb:use rfc2307 = Yes invalid users = root Created also the ou's in openldap, added a couple of users in openldap. Also set the smbpasswd, but everytime when I try to ask the openldap through samba. Im getting: smbldap_search_domain_info: Adding domain info for OPENCHANGE failed with NT_STATUS_UNSUCCESSFUL Do I still need to load the samba.schema in openldap ? And when yes.. How do I do that?? openldap: 2.4.31 samba: 4.0.1 OS: Debian Wheezy Cheers, -- Pascal den Bekker Linux System Administrator Affinitas GmbH | Kohlfurter Straße 41/43 | 10999 Berlin | Germany email: pascal_den.bekker(a)affinitas.de | tel: +49 30 868 000 140 www.edarling.de | www.shopaman.de Geschäftsführer: Lukas Brosseder, David Khalil, Michael Schrezenmaier Eingetragen beim Amtsgericht Berlin-Charlottenburg, HRB 115958

3 3

Object not found
by espeake＠oreillyauto.com 29 Aug '13

29 Aug '13

I have a user name readonly that we use in our applications to get uid's. THis has worked in the past with our old LDAP solution. We have moved to 2.4.31 on Ubuntu 12.04 with a n-way Multi master setup. The slap cat for this database looks like this. dn: olcDatabase={1}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=oreillyauto,dc=com olcAccess: {0}to attrs=userPassword by anonymous auth by * none olcAccess: {1}to dn.subtree="dc=oreillyauto,dc=com" by group/groupOfUniqueName s/uniqueMember="cn=System Administrators,ou=Groups,dc=oreillyauto,dc=com" wri te by group/groupOfUniqueNames/uniqueMember="cn=LDAP Admin,ou=Groups,dc=oreil lyauto,dc=com" write by * none break olcAccess: {2}to attrs=userPassword by group/groupOfUniqueNames/uniqueMember=" cn=Authenticate,ou=Groups,dc=oreillyauto,dc=com" write by anonymous auth by s elf write olcAccess: {3}to attrs=uid by anonymous read by users read olcAccess: {4}to attrs=ou,employeeNumber by users read olcAccess: {5}to dn.subtree="ou=System,dc=oreillyauto,dc=com" by dn.subtree="o u=Users,dc=oreillyauto,dc=com" none by users read olcAccess: {6}to dn.children="ou=Groups,dc=oreillyauto,dc=com" by dnattr=owner write by dnattr=uniqueMember read by * none olcAccess: {7}to dn.children="ou=Users,dc=oreillyauto,dc=com" by self read by group/groupOfUniqueNames/uniqueMember="cn=Authenticate,ou=Groups,dc=oreillya uto,dc=com" read by * none olcAccess: {8}to * by self read by users read olcAddContentAcl: FALSE olcLastMod: TRUE olcLimits: {0}dn.exact="uid=syncrepl,ou=System,dc=oreillyauto,dc=com" time.sof t=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited olcLimits: {1}dn.exact="uid=ldapAdmin,ou=System,dc=oreillyauto,dc=com" time.so ft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited olcLimits: {2}dn.exact="uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" time .soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: uid=admin,dc=oreillyauto,dc=com olcRootPW:: c2VjcmV0 olcSyncUseSubentry: FALSE olcDbCacheSize: 50000 olcDbCheckpoint: 512 30 olcDbNoSync: FALSE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 150000 olcDbIndex: objectClass eq olcDbIndex: cn eq olcDbIndex: uid eq olcDbIndex: oreillyGroup eq olcDbIndex: locationEntry eq olcDbIndex: counterNumber eq olcDbIndex: businessCategory eq olcDbIndex: locationNumber eq olcDbIndex: position eq olcDbIndex: title eq,subany olcDbIndex: givenName eq,subany olcDbIndex: functionListing eq olcDbIndex: manager eq olcDbIndex: sn eq,subany olcDbIndex: nickName eq,subany olcDbIndex: employeeNumber eq olcDbIndex: ou eq olcDbIndex: entryCSN eq olcDbIndex: entryUUID eq olcDbIndex: supervisor eq olcDbIndex: status eq olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 structuralObjectClass: olcHdbConfig entryUUID: 91ce693e-9e13-1032-84c2-0151b658a842 createTimestamp: 20130820183919Z creatorsName: cn=config olcMirrorMode: TRUE olcSyncrepl: {0}rid=004 provider=ldap://tntest-ldap-3.oreillyauto.com b inddn="uid=admin,dc=oreillyauto,dc=com" bindmethod=simple credentials=<password> searchbase="dc=oreillyauto,dc=com" type=refreshAndPersist retry="5 5 5 +" tim eout=1 olcSyncrepl: {1}rid=005 provider=ldap://tntest-ldap-1.oreillyauto.com binddn=" uid=admin,dc=oreillyauto,dc=com" bindmethod=simple credentials=<password> searchb ase="dc=oreillyauto,dc=com" type=refreshAndPersist retry="5 5 5 +" timeout=1 olcSyncrepl: {2}rid=006 provider=ldap://tntest-ldap-2.oreillyauto.com binddn=" uid=admin,dc=oreillyauto,dc=com" bindmethod=simple credentials=<password> searchb ase="dc=oreillyauto,dc=com" type=refreshAndPersist retry="5 5 5 +" timeout=1 entryCSN: 20130821193620.549061Z#000000#002#000000 modifiersName: uid=admin,dc=oreillyauto,dc=com modifyTimestamp: 20130821193620Z And the ldap logs show this: Aug 28 07:56:48 tntest-ldap-1 slapd[3067]: conn=27464 op=0 BIND dn="uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" method=128 Aug 28 07:56:48 tntest-ldap-1 slapd[3067]: conn=27464 op=0 BIND dn="uid=readOnlyUser,ou=System,dc=oreillyauto,dc=com" mech=SIMPLE ssf=0 Aug 28 07:56:48 tntest-ldap-1 slapd[3067]: conn=27464 op=0 RESULT tag=97 err=0 text= Aug 28 07:56:48 tntest-ldap-1 slapd[3067]: conn=27464 op=1 SRCH base="uid=espeake,ou=Users,dc=oreillyauto,dc=com" scope=0 deref=3 filter="(objectClass=*)" Aug 28 07:56:48 tntest-ldap-1 slapd[3067]: conn=27464 op=1 SEARCH RESULT tag=101 err=32 nentries=0 text= Aug 28 07:56:48 tntest-ldap-1 slapd[3067]: conn=27464 op=2 UNBIND Aug 28 07:56:48 tntest-ldap-1 slapd[3067]: conn=27464 fd=40 closed We had one issue with this server not running a rebuild last night due to a certificate error of the cacert not being found and we are addressing the through the following article: http://www.mikepilat.com/blog/2011/05/adding-a-certificate-authority-to-the… Searching as the ldapadmin user I find the user. So I am thinking that I need to adjust the ACL here but I'm not seeing what is wrong. Thanks, Eric Speake Web Systems Administrator O'Reilly Auto Parts This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

2 2

Openldap proxy to Active Directory howto?
by Mike W 28 Aug '13

28 Aug '13

I am attempting to configure an openldap to proxy with AD that needs to "rebind"? as a user I believe. I've been scanning yahoo/google trying to find some documentation of someone detailing that sort of procedure using the olc configs but no luck. Anyone know of such a thing that gives a bit more specific detail to this topic? -- Mike Wilson

1 0

Configure Mirror Mode Replication
by Clint Petty 28 Aug '13

28 Aug '13

Ok, now that I have updated to openLDAP 2.4.36, back to my original question below. Thanks, Clint ------------------------------------------------------------ I am wanting to implement Mirror Mode Replication. I am using OpenLDAP 2.4.23 on CentOS 6.4, which uses cn=config format, that does not have a slapd.conf file. The instructions say to add the following to the slapd.conf file: database bdb suffix dc=Example,dc=com rootdn dc=Example,dc=com directory /var/ldap/db index objectclass,entryCSN,entryUUID eq overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 MirrorMode node 1: # Global section serverID 1 # database section # syncrepl directive syncrepl rid=001 provider=ldap://ldap-sid2.example.com bindmethod=simple binddn="cn=mirrormode,dc=example,dc=com" credentials=mirrormode searchbase="dc=example,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" mirrormode on MirrorMode node 2: # Global section serverID 2 # database section # syncrepl directive syncrepl rid=001 provider=ldap://ldap-sid1.example.com bindmethod=simple binddn="cn=mirrormode,dc=example,dc=com" credentials=mirrormode searchbase="dc=example,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" mirrormode on Since there is no slapd.conf file, how do I configure replication in a cn=config format? Do I need to run a slapadd or ldapadd command? Syntax? What files do I need to create, and where? Thanks in advance.

2 1

Problems recovering my ldap db
by ghooton＠scins.ie 28 Aug '13

28 Aug '13

Hi all, I am recovering form a disaster. when I do slapcat I can see all the info stored in the ldap db However, when I do ldapsearch I cannot see anything. When I do slapcat -l backup.ldif I get : unclean shutdown detected; attempting recovery recovery skipped in read-only mode. Run manual recovery if errors are encountered I am using Debian 6 2.6.32-5-amd64 and :- ldapsearch -VV ldapsearch: @(#) $OpenLDAP: ldapsearch 2.4.23 (Dec 16 2012 11:48:21) $ root@carillon:/tmp/buildd/openldap-2.4.23/debian/build/clients/tools (LDAP library: OpenLDAP 20423) //Ger

2 1

Configure Mirror Mode Replication
by Clint Petty 28 Aug '13

28 Aug '13

I am wanting to implement Mirror Mode Replication. I am using OpenLDAP 2.4.23 on CentOS 6.4, which uses cn=config format, that does not have a slapd.conf file. The instructions say to add the following to the slapd.conf file: database bdb suffix dc=Example,dc=com rootdn dc=Example,dc=com directory /var/ldap/db index objectclass,entryCSN,entryUUID eq overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 MirrorMode node 1: # Global section serverID 1 # database section # syncrepl directive syncrepl rid=001 provider=ldap://ldap-sid2.example.com bindmethod=simple binddn="cn=mirrormode,dc=example,dc=com" credentials=mirrormode searchbase="dc=example,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" mirrormode on MirrorMode node 2: # Global section serverID 2 # database section # syncrepl directive syncrepl rid=001 provider=ldap://ldap-sid1.example.com bindmethod=simple binddn="cn=mirrormode,dc=example,dc=com" credentials=mirrormode searchbase="dc=example,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" mirrormode on Since there is no slapd.conf file, how do I configure replication in a cn=config format? Do I need to run a slapadd or ldapadd command? Syntax? What files do I need to create, and where? Thanks in advance.

2 1

Slapd - Back-ldap Chain overlay: Proxied Authorization Denied
by Raul Hernandez 27 Aug '13

27 Aug '13

Hello! I've implemented a simple openldap master and consumer architecture. To achieved this, I had to implement back-ldap chain overlay (in order to have a read only "slave"), and syncprov overlay, to synchronize data from master to the slave. This implementation works fine. I have data from the master, replicated into the slave. When I try to modify an object from the consumer using the administrative account "cn=admin,dc=company,dc=com", references the modify command to the master. The master performs the operation and returns the consumer the operation result. When I try to perform any modify operation with another authorized account, I get the following error *LDAP said*:Proxied Authorization Denied*Error number*:0x7b ()*Description*: The account has permission to write the whole tree in both, the master and the slave. Here is my config on both servers: #------- # Master #------- dn: cn=module,cn=config changetype: add objectClass: olcModuleList cn: module olcModulePath: /usr/lib/ldap olcModuleLoad: syncprov dn: olcOverlay=syncprov,olcDatabase={1}hdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov dn: olcDatabase={1}hdb,cn=config changetype: modify replace: olcAccess olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymous auth by dn="cn=admin,dc=company,dc=com" write by dn="cn=idm,ou=Seguridad,dc=company,dc=comdc=company,dc=com" write by anonymous read by * none olcAccess: {1}to attrs=shadowWarning,shadowMax,shadowMin by self write by dn="cn=admin,dc=company,dc=com" write by dn="cn=idm,ou=Seguridad,dc=company,dc=com" write by anonymous read by * none olcAccess: {2}to dn.base="" by * read olcAccess: {3}to * by self write by dn="cn=admin,dc=company,dc=com" write by dn="cn=idm,ou=Seguridad,dc=company,dc=com" write by * read #------- # Consumer #------- dn: cn=module,cn=config changetype: add objectClass: olcModuleList cn: module olcModulePath: /usr/lib/ldap olcModuleLoad: syncprov olcModuleLoad: back_ldap dn: olcOverlay=syncprov,olcDatabase={1}hdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov dn: olcDatabase={1}hdb,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=ldap://192.168.123.139binddn="cn=syncReplUser,ou=Seguridad,dc=bandes,dc=gob,dc=ve" bindmethod=simple credentials=0p3n1d4pPr0d% searchbase="dc=bandes,dc=gob,dc=ve" type=refreshAndPersist scope=sub retry="5 10 10 +" timeout=1 sizelimit=unlimited schemachecking=on - add: olcUpdateRef olcUpdateRef: ldap://192.168.123.139 dn: olcOverlay=chain,olcDatabase={-1}frontend,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcChainConfig olcOverlay: chain olcChainReturnError: TRUE olcChainMaxReferralDepth: 1 dn: olcDatabase=ldap,olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config changetype: add objectClass: olcLDAPConfig objectClass: olcChainDatabase olcDatabase: ldap olcDbURI: ldap://192.168.123.139 olcDbRebindAsUser: TRUE olcDbChaseReferrals: TRUE olcDbProxyWhoAmI: TRUE olcDbNoRefs: FALSE olcDBIDAssertAuthzFrom: * olcDBACLBind: bindmethod="simple" binddn="cn=syncReplUser,ou=Seguridad,dc=bandes,dc=gob,dc=ve" credentials=0p3n1d4pPr0d% olcDbIDAssertBind: bindmethod="simple" binddn="cn=syncReplUser,ou=Seguridad,dc=bandes,dc=gob,dc=ve" credentials=0p3n1d4pPr0d% mode="self" flags="prescriptive,proxy-authz-non-critical" Hope someone can help me out! Thanks in advanced

1 0

Replication setup
by Vishesh kumar 27 Aug '13

27 Aug '13

Hi Members, I am good in openldap basics but new in Replication. I am trying to setup replication on CentOS 6 systems. OpenLDAP version is 2.4.23-32.el6_4.1.x86_64. I loaded syncprov module using following ldif file on both the provider and consumer +++++++++ dn: cn=module,cn=config ObjectClass: olcModuleList cn: Module olcModulepath: /usr/lib64/openldap/ olcModuleLoad: syncprov.la +++++++++ I also configured replica database on consumer as following +++++++++ olcsyncrepl: rid=101 provider=ldap://192.168.10.1:389 type=refreshOnly interval= 00:05:00:00 searchbase="dc=l,dc=local" scope=sub bindmethod=simple binddn="cn=Man ager,dc=l,dc=local" credentials=xxxx +++++++++++++++++++++++++++++ Above configuration is not replicating database. Am I missing something? -- Vishesh Kumar

2 1

sambaSamAccount Problem
by felas 27 Aug '13

27 Aug '13

Hi, i have a ldif file with a objectClass: sambaSamAccount objectClass: posixAccount so i add follow this guide: https://help.ubuntu.com/12.04/serverguide/samba-ldap.html the samba.schema and samba.ldif. I restart slapd, but still not found, because if i try to change this: objectClass: inetOrgPerson objectClass: posixAccount it's work.. but with sambaSamAccount not..

1 0

Openldap configuration import LDIF
by felas 27 Aug '13

27 Aug '13

hi, i have install OpenLdap in a UbuntuServer, in virtual with VirtualBox. Now i want to import in Eclipse via Ldap Browser one file LDIF. I have a FQDN like this, ldap.***.***.com, and i add this in /etc/hosts this FQDN with a ip address 192.168.1.156, the ip is my Server. Now the problem, when i try to import Ldif, i have the problem with auth, i know i must change something in a slapd config but what?

5 21

Re: How to check whether OpenLDAP server is provider or consumer ?
by pramod kulkarni 27 Aug '13

27 Aug '13

Hi, Thanks for the reply. I have a rootdn,How to query the updateref setting ? waiting for your inputs Regards, Pramod On Sat, Aug 24, 2013 at 12:51 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Friday, August 23, 2013 3:53 PM +0530 pramod kulkarni < > pammu.kulkarni(a)gmail.com> wrote: > > >> I am trying to notify a system to check if the openLDAP server is >> provider or consumer.I can do this by getting a referral error on the >> consumer side whenever I try to write something on the server , but is >> their any other way to check if OpenLDAP is provider or consumer without >> writing to it ? . >> > > You could query for the updateref setting if you are using cn=config out > of the config DB, but that'd require the rootdn? Or, you could just set up > slapo-chain on your replica, and then it doesn't matter. > > --Quanah > > -- > > Quanah Gibson-Mount > Lead Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

3 5

[LMDB] Support for secondary index
by Alain 27 Aug '13

27 Aug '13

I am trying to port an application that currently uses BDB and I'm stuck with how to implement secondary indexes with LMDB. Can you point me in the right direction here. Thanks Alain

2 1

Re: OpenLDAP 2.4.36 available
by Clément OUDOT 24 Aug '13

24 Aug '13

Hi, LTB project RPMs for OpenLDAP 2.4.36 are available: http://tools.ltb-project.org/news/40 I also created a yum repository to ease the installation: http://ltb-project.org/wiki/documentation/openldap-rpm#yum_repository Clément.

6 7

Issues arising from creating powerdns backend based on LMDB
by Mark Zealey 23 Aug '13

23 Aug '13

Hi Howard, I've now got lmdb working with powerdns in place of kyoto - nice and easy to do thanks! Maximum DNS query load is a little better - about 10-30% depending on use-case, but for us the main gain is that you can have a writer going on at the same time - I was struggling a bit with how to push updates from a different process using kyoto. There's a few issues and things I'd like to comment on though: 1) Can you update documentation to explain what happens when I do a mdb_cursor_del() ? I am assuming it advances the cursor to the next record (this seems to be the behaviour). However there is some sort of bug with this assumption. Basically I have a loop which jumps (MDB_SET_RANGE) to a key and then wants to do a delete until key is like something else. So I do while(..) { mdb_cursor_del(), mdb_cursor_get(..., MDB_GET_CURRENT)}. This works fine mostly, but roughly 1% of the time I get EINVAL returned when I try to MDB_GET_CURRENT after a delete. This always seems to happen on the same records - not sure about the memory structure but could it be something to do with hitting a page boundary somehow invalidating the cursor? At the moment I just catch that and then do an MDB_NEXT to skip over them but this will be an issue for us on live. This is from perl so it /may/ be that, or the version of lmdb that is shipped with it however the perl layer is a very thin wrapper and looking at the code I can only think it comes from lmdb. 2) Currently, because kyoto cabinet didn't have support for multiple identical keys we don't use the DUP options. This leads to quite long keys (1200-1300 bytes in some cases). In the future, it would be nice to have a run-time keylength specifier or something along those lines. 3) Perhaps a mdb_cursor_get_key() function (like kyoto) which doesn't return the data (just the key). As in (2) we store all the data in the key - not sure how much of a performance difference this would make though 4) Creating database with non-sequential keys is very bad (on 4gb databases, 2* slower than kyoto - about 1h30 and uses more memory). I spent quite a bit of time looking at this in perl and then C. Basically I create a database, open 1 txn and then insert a bunch of unordered keys. Up to about 500mb it's fine and nice and quick - from perl about 75k inserts/sec (slow mostly because it's reading from mysql). However after than first 500mb it starts flushing to disk. In a sequential insert case the flush is very quick - 100-200mb/sec or so. However on non-sequential insert I've seen it drop to like 4 or 5mb/sec as it's writing data all over the disk rather than big sequential writes. iostat shows the same ~200tps of write, 100% usage but only 4-10mb/sec of bytes being written. However, even when it's not flushing (or when storing data on SSD or memdisk), after the first 500mb performance massively drops off to perhaps 10-15k inserts/sec. At the same time, looking at `top`, once the residential memory hits about 500mb, the 'shared memory' starts being used and residential just keeps on increasing. I'm not sure if this is some kind of kernel accounting thing to do with mmap usage but it doesn't happen for sequential key inserts (for those, shared mem stays around 0, residential stays 500mb). I'm using centos 6 with various different kernels from default to 3.7.5 and the behaviour is the same. I don't really know how to go about looking for the root cause of this but I'm pretty sure that whilst the IO is crippling it in places there is something else going on of which the shared memory increase is a sign. I've tried using the WRITEMAP option too which doesn't seem to affect anything significantly in terms of performance or memory usage. 5) pkgconfig/rpms would be really nice to have. Or do you expect it to just be bundled with a project as eg the perl module does? Thanks, Mark

3 18

How to check whether OpenLDAP server is provider or consumer ?
by pramod kulkarni 23 Aug '13

23 Aug '13

I am trying to notify a system to check if the openLDAP server is provider or consumer.I can do this by getting a referral error on the consumer side whenever I try to write something on the server , but is their any other way to check if OpenLDAP is provider or consumer without writing to it ? .

2 1

How to two-way synchronization on openldap 2.4.33 version
by Tian Zhiying 23 Aug '13

23 Aug '13

Hi I use OpenLDAP 2.4.33 version, I want to achieve two-way synchronization, but master --> slave ok slave --> master not ok Can it support slave to master data synchronization on 2.4.33 version? Thanks Tian Zhiying

2 1

Mirrormode replication
by Darouichi, Aziz 22 Aug '13

22 Aug '13

Hi, I have 3 local servers and 1 remote server. All servers are configured for Mirror mode replications. Every night replication stops on the remote server. Once I delete the database on the remote, start services replication works fine, the next morning I have to go through the same process. The remote server is a VM image of one of the local servers. They hosing company changed the host name, IP address and allowed communication via a VPN tunnel between them and us. These is my replication entry in slapd.conf #mirrormode TRUE mirrormode on # define the provider to use the syncprov overlay # (last directives in database section) syncrepl rid=006 provider=ldap://192.168.60.42 tls_cert=/etc/pki/tls/certs/ldap-tls.curry.edu.cert.pem tls_key=/etc/pki/tls/private/ldap-tls.curry.edu.key.pem tls_cacert=/etc/pki/tls/certs/cacert.pem tls_reqcert=demand searchbase="dc=curry,dc=edu" schemachecking=on timelimit=unlimited sizelimit=unlimited type=refreshAndPersist retry="60 +" Thanks

2 6

How to start slapd without slapd.conf?
by Steppacher Ralf 21 Aug '13

21 Aug '13

Hello all, this is probably a really stupid question... But I cannot figure out how to start a freshly built slapd using only slapd-config configuration. I built and installed slapd 2.4.35: ./configure --prefix=$HOME/server/openldap --enable-modules --enable-overlays=mod --with-tls=openssl make depend make make test make install After that I find a slapd.conf and slapd.ldif in $HOME/server/openldap/etc/openldap. As I understood from the administrator's guide the slapd.conf approach is deprecated and should not be used. So I renamed the slapd.conf to slapd.conf.ignore so it is not picked up by default as I think it would be. But sudo $HOME/server/openldap/libexec/slapd -s any -F $HOME/server/openldap/etc/openldap/ logs ldif_read_file: no entry file "/home/dpr/server/openldap/etc/openldap//cn=config.ldif" and slapd is stopped immediatelly sudo $HOME/server/openldap/libexec/slapd -s any -F $HOME/server/openldap/etc/openldap/ -f $HOME/server/openldap/etc/openldap/slapd.ldif yields /home/dpr/server/openldap/etc/openldap/slapd.ldif: line 5: unknown directive <dn:> outside backend info and database definitions. and again the demon stops. The only way I got the demon to start is by using the default slapd.conf or with the -f option pointing to a slapd.conf file. Please advise. Thanks! Ralf

5 9

attribute to store system mailbox value
by Zeus Panchenko 19 Aug '13

19 Aug '13

hi, may somebody to recommend the attribute to store path to system mailbox, among attributes of schema files shipped with openldap, "system mailbox" is the path to mbox format file or maildir directory where MDA (depends on MDA configuration) stores received mail messages so, to not to add new LDAP object and attribute definition, I'd like to know, may be close by function attribute already exists? -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET)

3 3

How to correct delete objects from cn=config?
by Robert Wolf 19 Aug '13

19 Aug '13

Hello people, I would like to ask for correct and/or official way how to remove objects from cn=config. I have found "how to delete backend DB" and "can't delete bdb backend from cn=config" threads. I know I can activate experimental delete support for cn=config, but I don't want to use experimental features. I would like to do it correct way. Can you explain how to delete objects from cn=config? I wanted to test null backend so I have added olcModuleLoad: {1}back_null in cn=module{0} and then I have created olcDatabase={2}null in cn=config. After testing I wanted to delete null backend and unload null module. But it is impossible to delete olcDatabase={2}null from cn=config (error 53 unwilling to perform) and it is impossible delete the back_null module (error 80 cannot delete olcModuleLoad). What is correct way to remove such configured backends and modules? I have read about slapcat and slapadd, which can be used to dump cn=config into LDIF, then edit this LDIF and import with slapadd, but the slapd should not be running. Is this only way how to remove some configuration? Is there any other way to remove configuration online? Thank you for answers. Regards, Robert Wolf.

6 10

ou=people hidden from ldapsearch
by Adam 18 Aug '13

18 Aug '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, I'm sure this is a really stupid question, and I'm sorry for asking it, but I'm testing a migration from Sun DSEE to OpenLDAP 2.4.35 at the moment. I am creating a DIT similar to the following: dn: ou=people,dc=example,dc=com dn: ou=ftp,dc=example,dc=com dn: ou=groups,dc=example,dc=com dn: ou=hosts,dc=example,dc=com dn: ou=us,ou=people,dc=example,dc=com dn: ou=bd,ou=people,dc=example,dc=com dn: ou=id,ou=people,dc=example,dc=com dn: ou=users,ou=ftp,dc=example,dc=com dn: ou=groups,ou=ftp,dc=example,dc=com dn: ou=us,ou=groups,dc=example,dc=com dn: ou=bd,ou=groups,dc=example,dc=com dn: ou=id,ou=groups,dc=example,dc=com dn: ou=us,ou=hosts,dc=example,dc=com dn: ou=bd,ou=hosts,dc=example,dc=com dn: ou=id,ou=hosts,dc=example,dc=com When I perform a ldapsearch against our current Sun DSEE environment (with the same layout) I see the following: ldapsearch -x -h ldap.example.com -b example.com objectclass=organizationalUnit 1 -LLL dn: ou=people,dc=example,dc=com dn: ou=ftp,dc=example,dc=com dn: ou=groups,dc=example,dc=com dn: ou=hosts,dc=example,dc=com dn: ou=us,ou=people,dc=example,dc=com dn: ou=bd,ou=people,dc=example,dc=com dn: ou=id,ou=people,dc=example,dc=com dn: ou=users,ou=ftp,dc=example,dc=com dn: ou=groups,ou=ftp,dc=example,dc=com dn: ou=us,ou=groups,dc=example,dc=com dn: ou=bd,ou=groups,dc=example,dc=com dn: ou=id,ou=groups,dc=example,dc=com dn: ou=us,ou=hosts,dc=example,dc=com dn: ou=bd,ou=hosts,dc=example,dc=com dn: ou=id,ou=hosts,dc=example,dc=com When I perform the same search against OpenLDAP, I get the following: dn: ou=ftp,dc=example,dc=com dn: ou=hosts,dc=example,dc=com dn: ou=us,ou=people,dc=example,dc=com dn: ou=bd,ou=people,dc=example,dc=com dn: ou=id,ou=people,dc=example,dc=com dn: ou=users,ou=ftp,dc=example,dc=com dn: ou=groups,ou=ftp,dc=example,dc=com dn: ou=us,ou=groups,dc=example,dc=com dn: ou=bd,ou=groups,dc=example,dc=com dn: ou=id,ou=groups,dc=example,dc=com dn: ou=us,ou=hosts,dc=example,dc=com dn: ou=bd,ou=hosts,dc=example,dc=com dn: ou=id,ou=hosts,dc=example,dc=com Notice the destinct lack of ou=people,dc=example,dc=com and ou=groups,dc=example,dc=com. I know they're there, because I can create objects etc in them, but I'm at a complete loss as to why they don't show up in the ldapsearch. I know I'm obviously doing something stupid here, and again, I apologize, but any assistance would be appreciated. Thanks. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQEcBAEBAgAGBQJSD4mtAAoJEH1iO/rgZIL9FwwH/3UxTIgxrVbe7IVf99IRB+hf veJMZ6NaqMjlFfFsla+KLbIF/64I5rwqVCLu/y6necJrQS2EY+cmZmNRlQ02/Cso rfd5ZQgp5q7ECZSkZCTLhrB1CIY183PiloDnG41lmpJkkP+thwj4NUdcMYYxP0bo EOMZIefdOewhV7+DOv0Jw807HCOAYrgfsbIk8uDmBUCdBaf4/WVmnLzTGMLq7zrj HLSJC09bPqcmlEieWVXFNVajE5ztZs8XI6WmFYvrDq1/+1bKoaYMRT2sMh8HnuEM hisFEUsLpQWSpwP52tmSGau2sOhthLPQKRBrIQbCyAwfEfwtqc+TUDmMsaxhKy0= =AqJ2 -----END PGP SIGNATURE-----

2 2

Schema Replication and data replication.
by espeake＠oreillyauto.com 12 Aug '13

12 Aug '13

So we are cooking with warm oil and I wan to the cooking with hot oil!!!! I have been able to get upgraded 2.4.28 on open ldap. Having issue with getting a good build of 2.4.35. But that isn't the problem. Below is the log on my log from one of my consumers after starting the slapd service. Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: loaded module back_hdb Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: module back_hdb: null module registered Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: loaded module ppolicy Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: module ppolicy: null module registered Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: loaded module memberof Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: module memberof: null module registered Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: loaded module dynlist Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: module dynlist: null module registered Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: loaded module syncprov Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: module syncprov: null module registered Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: loaded module refint Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: module refint: null module registered Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: loaded module back_ldap Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: module back_ldap: null module registered Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: Config: ** successfully added syncrepl rid=002 "ldap://tntest-ldap-master-1.oreillyauto.com" Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: index objectClass 0x0004 Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: index cn 0x0004 Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: index uid 0x0004 Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: index oreillyGroup 0x0004 Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: index locationEntry 0x0004 Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: index counterNumber 0x0004 Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: index businessCategory 0x0004 Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: index locationNumber 0x0004 Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: index position 0x0004 Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: index title 0x0214 Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: index givenName 0x0214 Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: index functionListing 0x0004 Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: index manager 0x0004 Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: index sn 0x0214 Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: index nickName 0x0214 Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: index employeeNumber 0x0004 Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: index ou 0x0004 Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: index entryUUID 0x0004 Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: index supervisor 0x0004 Aug 7 21:36:16 tntest-ldap-2 slapd[3961]: index entryCSN 0x0004 Aug 7 21:36:17 tntest-ldap-2 slapd[3962]: slapd starting Aug 7 21:36:17 tntest-ldap-2 slapd[3962]: do_syncrep2: rid=002 LDAP_RES_SEARCH_RESULT Here is where is stops. Here in the ldif file from my master: # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 3411e7fc dn: olcDatabase={0}config objectClass: olcDatabaseConfig olcDatabase: {0}config olcUpdateRef: ldap://tntest-ldap-master-1.oreillyauto.com olcsyncrepl: rid=002 provider=ldap://tntest-ldap-master-1.oreillyauto.com type=refreshAndPersist retry="10 +" searchbase="cn=config" bindmethod=simple binddn="uid=admin,dc=oreillyauto,dc=com" credentials=<password> olcAccess: to * by dn="uid=admin,dc=oreillyauto,dc=com" write by dn="uid=ldapadmin,ou=system,dc=oreillyauto,dc=com" write by * none olcRootDN: cn=admin,cn=config olcRootPW:: c2VjcmV0 structuralObjectClass: olcDatabaseConfig entryUUID: 35b75e72-93c2-1032-9ca4-711c013d2dcb creatorsName: cn=config createTimestamp: 20130807153144Z entryCSN: 20130807153144.468097Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20130807153144Z Here is the ldif from my consumer: dn: olcDatabase={0}config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootDN: cn=admin,cn=config olcRootPW: secret structuralObjectClass: olcDatabaseConfig olcsyncrepl: {0}rid=002 provider=ldap://tntest-ldap-master-1.oreillyauto.com type=refreshOnly retry="5 +" searchbase="cn=config" bindmethod=simple binddn="cn=admin,cn=config" credentials=<password> schemachecking=on olcAccess: to * by dn="uid=admin,dc=oreillyauto,dc=com" write by dn="uid=ldapadmin,ou=system,dc=oreillyauto,dc=com" write by * none entryUUID: f074ba7c-09ed-1030-952b-0bb60fbd91a8 creatorsName: cn=config createTimestamp: 20110503162710Z entryCSN: 20110503162710.319234Z#000000#000#000000 modifiersName: cn=config ModifyTimestamp: 20110503162710Z logging is set to config and sync. Is the issue the maybe the entryCSN? I am wondering if I need to blow out the cn=config stuff and recreate it on the consumer It should be that hard, just take a little time. Am I headed in the right direction or am I off base. Thank you, Eric Speake Web Systems Administrator O'Reilly Auto Parts This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

3 16

RE24 testing call (OpenLDAP 2.4.36)
by Quanah Gibson-Mount 12 Aug '13

12 Aug '13

If you know how to build OpenLDAP manually, and would like to participate in testing the next set of code for the 2.4.36 release, please do so. Generally, get the code for RE24: <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> Configure & build. Execute the test suite (via make test) after it is built. Thanks! --Quanah -- Quanah Gibson-Mount Lead Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

8 17

UNSUBSCRIBE
by Kumar, Amit 12 Aug '13

12 Aug '13

1 0

DB config and log files
by jeevan kc 12 Aug '13

12 Aug '13

Hello thereMy DB_CONFIG looks like this set_cachesize 0 716800 0set_lg_bsize 2097512set_lg_dir /usr/local/var/openldap-logsset_flags DB_LOG_AUTOREMOVE Recently , we have few batch processes running in the LDAP server for Datawarehouse groups and other apps and this is causing DB logs to grow . When I do a ls -l the size of the logs are almost 4GB in size. This is causing trouble and we don't want this many logs. How do I limit the log size so that it doesn't exceed lets say 1 GB . These DB logs are of very little importance to us. We periodically do a backup using slapcat and we can use this in case we have a fatal crash .Please throw some light on how to limit these DB logs . Thanks Jeevan

3 4

Re: RE24 testing call (OpenLDAP 2.4.36)
by Marco Pizzoli 12 Aug '13

12 Aug '13

On Mon, Jul 29, 2013 at 9:44 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > If you know how to build OpenLDAP manually, and would like to participate > in testing the next set of code for the 2.4.36 release, please do so. > > Generally, get the code for RE24: > > <http://www.openldap.org/**devel/gitweb.cgi?p=openldap.** > git;a=snapshot;h=refs/heads/**OPENLDAP_REL_ENG_2_4;sf=tgz<http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> > > > > Configure & build. > > Execute the test suite (via make test) after it is built. > > Thanks! > > --Quanah > All MDB tests passed with current RE24 (apart from the very last additions you just made). RHEL6.4 x86_64 > > -- > > Quanah Gibson-Mount > Lead Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration > >

1 0

MAC and Network Asset Inventory on LDAP
by Nick Milas 12 Aug '13

12 Aug '13

Hello, We are planning on using FreeRadius for MAC-auth based on MAC addresses (to be) stored on our OpenLDAP (in parallel to 802.1x using our ldap-stored users). With that opportunity we would be aiming at starting a comprehensive network asset inventory. So, I would like to ask people to share their experience regarding storing MAC addresses and other device info on LDAP. If using LDAP for device inventory, are you simply using device and ieee802Device object classes (in core.schema and nis.schema respectively), or you would suggest a more specialized/extensive schema to be used instead or additionally (auxiliary object class(es))? Which? An example method (found with some googling): http://collaboration.cmc.ec.gc.ca/science/rpn/biblio/ddj/Website/articles/S… Of course, one could try to re-invent the wheel (custom schema, custom apps), but I am sure there should be some well designed schema(s) around for this purpose. I think that it would also make sense, if possible, to be able to use a storage format that can be leveraged by other open-source network assets management software (like ocsinventory-ng or openipam, which however use SQL backends). Any experiences/suggestions would be highly appreciated. Thanks and Regards, Nick

1 0

Linux quota problem for LDAP users
by Osman ÜNALAN (ULAKBİM) 12 Aug '13

12 Aug '13

Hi, I'm trying to set quotas for LDAP users on a Linux server. But all the users' name begins with number and when I try to set quota for a user like "123456" it sets a quota for "#123456" I set quota like this: setquota -u 123456 1500 1500 0 0 -a repquota output is like: user used soft hard grace used soft hard grace 123456 -- 500 0 0 100 0 0 # 123456 -- 0 1500 1500 0 0 0 That's why the quota I set applies to non existing user named #123456. Does anyone know how can I fix that? Thanks, Osman Ünalan

4 3

One questions about nested gourp support of openldap
by ctosgh 12 Aug '13

12 Aug '13

Hi, there To meet the following requirement: "groupA" contains user entries: cn=a,ou=users,dc=test,dc=com cn=b,ou=users,dc=test,dc=com "groupB" contains "groupA" I have following questions: 1 Which object classes should I use to implement above requirement? Could anyone give a simple sample ldif file? 2 Is there a standard or commonly used way to implement nested groups? Appreciate your feedback~~~ Thanks, Jacky

3 3

developing module that instantiates check_password() function
by Scott Koranda 10 Aug '13

10 Aug '13

Hello, I wish to develop a user-defined loadable module that instantiates the check_password() function as described in the slapo-ppolicy man page. The man page specifies the function prototype as int check_password (char *pPasswd, char **ppErrStr, Entry *pEntry); In which header file is the 'Entry' type defined? Thanks, Scott

2 3

separate login/password for several services?
by Zeus Panchenko 09 Aug '13

09 Aug '13

hi all, please, may somebody advice I need to set separate credentials for each service I provide (optionally) to my users I think of something like this: dn: uid=target-user,ou=People,dc=ibs userPassword: ****** ... authorizedService: xmpp authorizedService: smtp authorizedService: pop authorizedService: imap authorizedService: mail ... loginSMTP: mail-send-login passwSMTP: xxx loginPOP3: mail-get-login passwPOP3: yyy ... loginXMPP: login-xmpp passwXMPP: zzz can I achieve it? from which side to approach the issue? -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET)

5 10

Re: Schema Replication and data replication
by Christian Kratzer 09 Aug '13

09 Aug '13

Hi, On Thu, 8 Aug 2013, espeake(a)oreillyauto.com wrote: > Christian, > > The olcServerID goes in the cn=config file correct? I will do a ldapmodify to change this. yes. use the following: dn: olcDatabase={0}config changetype: modify replace: olcServerID olcServerID: 1 ldap://tntest-ldap-master-1.oreillyauto.com olcServerID: 2 ldap://tntest-ldap-master-2.oreillyauto.com > The consumer config is what was on there and that's why I asked the question about wiping it out and then using slapcat to put it back in. slapcat NEVER shows the checksums and protecting comments that you only see when you go looking at the files under slapd.d # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 3411e7fc Once you have the correct configuration on one server dump it with slapcat -n0 and import it to the second server using slapadd -n0. Be sure to wipe ALL of the contents in the slapd.d directory before importing with slapadd. ps: please keep the mailinglist on the Cc: so what we learn from this is for the greater good. Greetings Christian > > Thanks, > Eric > > > > -----openldap-technical-bounces(a)OpenLDAP.org wrote: -----To: espeake(a)oreillyauto.com > From: Christian Kratzer > Sent by: openldap-technical-bounces(a)OpenLDAP.org > Date: 08/08/2013 06:58AM > Cc: openldap-technical(a)openldap.org > Subject: Re: Schema Replication and data replication > > Hi, > > On Wed, 7 Aug 2013, espeake(a)oreillyauto.com wrote: > > > > > So we are cooking with warm oil and I wan to the cooking with hot oil!!!! > > > > I have been able to get upgraded 2.4.28 on open ldap. Having issue with > > getting a good build of 2.4.35. But that isn't the problem. Below is the > > log on my log from one of my consumers after starting the slapd service. > > > <snipp> > > > > Here is where is stops. > > > > Here in the ldif file from my master: > > > > # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. > > # CRC32 3411e7fc > > use slapcat -n0 instead of copying manually the files from the slapd.d directory. > > > dn: olcDatabase={0}config > > objectClass: olcDatabaseConfig > > olcDatabase: {0}config > > olcUpdateRef: ldap://tntest-ldap-master-1.oreillyauto.com > > olcsyncrepl: rid=002 provider=ldap://tntest-ldap-master-1.oreillyauto.com > > type=refreshAndPersist retry="10 +" searchbase="cn=config" > > bindmethod=simple binddn="uid=admin,dc=oreillyauto,dc=com" > > credentials=<password> > > olcAccess: to * by dn="uid=admin,dc=oreillyauto,dc=com" write by > > dn="uid=ldapadmin,ou=system,dc=oreillyauto,dc=com" write by * none > > olcRootDN: cn=admin,cn=config > > olcRootPW:: c2VjcmV0 > > structuralObjectClass: olcDatabaseConfig > > entryUUID: 35b75e72-93c2-1032-9ca4-711c013d2dcb > > creatorsName: cn=config > > createTimestamp: 20130807153144Z > > entryCSN: 20130807153144.468097Z#000000#000#000000 > > modifiersName: cn=config > > modifyTimestamp: 20130807153144Z > > > > Here is the ldif from my consumer: > > > > dn: olcDatabase={0}config > > objectClass: olcDatabaseConfig > > olcDatabase: {0}config > > olcRootDN: cn=admin,cn=config > > olcRootPW: secret > > structuralObjectClass: olcDatabaseConfig > > olcsyncrepl: {0}rid=002 > > provider=ldap://tntest-ldap-master-1.oreillyauto.com type=refreshOnly > > retry="5 +" searchbase="cn=config" bindmethod=simple > > binddn="cn=admin,cn=config" credentials=<password> schemachecking=on > > olcAccess: to * by dn="uid=admin,dc=oreillyauto,dc=com" write by > > dn="uid=ldapadmin,ou=system,dc=oreillyauto,dc=com" write by * none > > entryUUID: f074ba7c-09ed-1030-952b-0bb60fbd91a8 > > creatorsName: cn=config > > createTimestamp: 20110503162710Z > > entryCSN: 20110503162710.319234Z#000000#000#000000 > > modifiersName: cn=config > > ModifyTimestamp: 20110503162710Z > > > > both your entryCSN have #000# for the serverID. Even though it seems you > have somehow modified the configuration. > > Your replication cannot work when you have not configured a serverID. > > You need at least the following in your configs. > > olcServerID: 1 ldap://tntest-ldap-master-1.oreillyauto.com > olcServerID: 2 ldap://tntest-ldap-master-2.oreillyauto.com > > Also why does the ModifyTimestamp: attribute from your second server start with a capital 'M'. > > Are you still somehow manually poking at the files in slapd.d ? > > Please use slapcat / slapadd with the -n0 option to export and import your configuration. > > > Greetings > Christian > > -- > Christian Kratzer CK Software GmbH > Email: ck(a)cksoft.de Wildberger Weg 24/2 > Phone: +49 7032 893 997 - 0 D-71126 Gaeufelden > Fax: +49 7032 893 997 - 9 HRB 245288, Amtsgericht Stuttgart > Web: http://www.cksoft.de/ Geschaeftsfuehrer: Christian Kratzer > > > -- > This message has been scanned for viruses and dangerous content, > and is believed to be clean. > Message id: 7014E600847.AEC40 > > > This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS § 2510, solely for the use of the intended > recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you. > > -- Christian Kratzer CK Software GmbH Email: ck(a)cksoft.de Wildberger Weg 24/2 Phone: +49 7032 893 997 - 0 D-71126 Gaeufelden Fax: +49 7032 893 997 - 9 HRB 245288, Amtsgericht Stuttgart Web: http://www.cksoft.de/ Geschaeftsfuehrer: Christian Kratzer

4 5

DB_Config and log files
by jeevan kc 08 Aug '13

08 Aug '13

Hello thereMy DB_CONFIG looks like this set_cachesize 0 716800 0set_lg_bsize 2097512set_lg_dir /usr/local/var/openldap-logsset_flags DB_LOG_AUTOREMOVE Recently , we have few batch processes running in the LDAP server for Datawarehouse groups and other apps and this is causing DB logs to grow . When I do a ls -l the size of the logs are almost 4GB in size. This is causing trouble and we don't want this many logs. How do I limit the log size so that it doesn't exceed lets say 1 GB . These DB logs are of very little importance to us. We periodically do a backup using slapcat and we can use this in case we have a fatal crash .Please throw some light on how to limit these DB logs . Thanks

1 0

group name of a user
by zeya badar 08 Aug '13

08 Aug '13

Hi I am very new to openldap so i need some help on that suppose i created one group and added users as a member but when i am searching a user i am unable to find user's group name? in which attribute we can find user's group name can anyone help me to get group name of a user? Thanks & Regards Zeya Alam Badar

2 1

[OT] is there any theory behind (|) being false?
by Zhang Weiwu 08 Aug '13

08 Aug '13

Quote from RFC 4526: > An 'and' filter with zero elements always evaluates to True. An 'or' > filter with zero elements always evaluates to False. My question is, is there any theory this decision is based on, or is it randomly chosen? Why not (&) being false, and (|) being true? Or more specifically, we know 'FALSE && NULL' is FALSE, we know 'TRUE || NULL' is TRUE, but is there reason 'NULL && NULL' being true and 'NULL || NULL' being false? Thanks:)

2 1

Replicating Schema, olcAccess and olcLimits
by Andrew Devenish-Meares 08 Aug '13

08 Aug '13

Hi List, I'm attempting to set up replication of schema, olcAccess and olcLimits. It appears replicating the schema works, but the olcAccess and olcLimits do not appear to replicate under olcDatabase={2}bdb,cn=config. (Additionally the DIT under dc=une,dc=edu,dc=au is also replicated without issue). The syncprov overlay is in place root@ldap-master-dev [DEV] ~/ldap-config/# ldapsearch -Y EXTERNAL -H ldapi:// -LL -b olcOverlay={0}syncprov,olcDatabase={0}config,cn=config SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 version: 1 dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov The SyncUser has access to read the cn=schema,cn=config and olcDatabase={2}bdb,cn=config branches: root@ldap-master-dev [DEV] ~/ldap-config/# ldapsearch -Y EXTERNAL -H ldapi:// -LL -b olcDatabase={0}config,cn=config olcAccess SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 version: 1 dn: olcDatabase={0}config,cn=config olcAccess: {0}to dn.subtree="cn=schema,cn=config" by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by dn="cn=SyncUser,dc=une,dc=edu,dc=au" read by * none olcAccess: {1}to dn.subtree="olcDatabase={2}bdb,cn=config" by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by dn="cn=SyncUser,dc=une,dc=edu,dc=au" read by * none olcAccess: {2}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * none dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config On the consumer side, I've added the following two olcSyncRepl enteries to the olcDatabase={2}bdb,cn=config: root@ldap-slave-dev-00 [DEV] ~/ldap-slave-config/# ldapsearch -Y EXTERNAL -H ldapi:/// -LL -b olcDatabase={0}config,cn=config olcSyncRepl SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 version: 1 dn: olcDatabase={0}config,cn=config olcSyncrepl: {0}rid=001 provider=ldap://ldap-master-dev.server.une.edu.au bindmethod=simple binddn="cn=SyncUser,dc=une,dc=edu,dc=au" credentials="PASSWORD" searchbase="cn=schema,cn=config" type=refreshAndPersistinterval=00:00:00:10 retry="5 5 300 5" timeout=1 olcSyncrepl: {1}rid=003 provider=ldap://ldap-master-dev.server.une.edu.au bindmethod=simple binddn="cn=SyncUser,dc=une,dc=edu,dc=au" credentials="PASSWORD" searchbase="olcDatabase={2}bdb,cn=config" attrs="olcDbIndex,olcDbConfig,olcAccess,olcLimits" type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 5" timeout=1 I don't follow why this doesn't work. Any suggestions? Thanks -- Andrew Devenish-Meares Solutions Analyst Information Technology University of New England Armidale NSW 2351 e: adevenis(a)une.edu.au p: 02 6773 4098 w: http://une.edu.au/itd

2 3

Replicate translucent ldap
by Zoli Szemelyesen 07 Aug '13

07 Aug '13

Greetings, I have an unusual setup and would like to hear opinions about it. We have an AD in a central office. I have to replicate an ou portion of it once a day to a remote location. (Using the remote AD is technically not an option here and a daily update is sufficient.) I add new attributes locally in a translucent setup. These attributes are used only locally and meddling with the AD is not an option either. Access to this is ok, but I need to have copies of the overlayed ldap. (Reasons: Local redundancy is important to keep SLA with automated systems using ldap and also have another local office nearby with slow/bad connection so a local copy is needed there as well). Reading docs and googling around I couldn't find a good and working solution for the local copies. - Doing dumps and copy them over could work but it's a crappy solution imho. - Replicating the 'AD portion' and the local db separately and doing 'local overlay' on the backup nodes might work but I'd prefer to use an already set up db instead of dynamically rebuild it in multiple locations). - Doing 'classic' replication is not possible afaik. Ideas or experience with similar scenario? Thanks in advance McLoud

1 0

Editing Schema
by Bram Cymet 07 Aug '13

07 Aug '13

Hi, I am wondering the best way to edit a schema after it is loaded. I would like to change the syntax OID for an object type. I have tried using Apache Directory Studio to do this and it just causes OpenLDAP to segfault. Is this possible? How would I do it? Do I need to remove all entries currently referencing the schema? Thanks, -- Bram Cymet Software Developer Canadian Bank Note Co. Ltd. 613-608-9752

2 1

Whenchanged or modifyTimestamp filter
by Sébastien MALHEIRO 06 Aug '13

06 Aug '13

Hi, I want to configure openldap to work as a proxy for Active Directory. I have : A ldap database section to connect to active directory a dbd database to store local ldap A relay database to map Active Directory OU on a local OU This work fine but I have a problem with this type of filter : - ldapsearch -x -D "cn=manager,dc=openldap,dc=priv" -W "(&(objectClass=*)(whenChanged>=20080812000000.0Z))" - ldapsearch -x -D "cn=manager,dc=openldap,dc=priv" -W "(&(objectClass=*)(modifyTimestamp>=20080812000000.0Z))" => I have no result But with this type of filter : ldapsearch -x -D "cn=manager,dc=opencg21,dc=priv" -W "(&(objectClass=*)(uid=MyUsername))" => I can see the whenChanged and modifyTimestamp attributes. Can someone help me? I don't know how to have an error code to see where is the pb Thanks a lot. ---------------------------------------------- here is my slapd.conf -------------------------------------------- # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/corba.schema include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/duaconf.schema include /etc/openldap/schema/dyngroup.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/java.schema include /etc/openldap/schema/misc.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/ppolicy.schema include /etc/openldap/schema/collective.schema include /etc/openldap/schema/microsoft-minimal.schema # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Load dynamic backend modules # - modulepath is architecture dependent value (32/64-bit system) # - back_sql.la overlay requires openldap-server-sql package # - dyngroup.la and dynlist.la cannot be used at the same time # modulepath /usr/lib/openldap # modulepath /usr/lib64/openldap # moduleload accesslog.la # moduleload auditlog.la # moduleload back_sql.la # moduleload chain.la # moduleload collect.la # moduleload constraint.la # moduleload dds.la # moduleload deref.la # moduleload dyngroup.la # moduleload dynlist.la # moduleload memberof.la # moduleload pbind.la # moduleload pcache.la # moduleload ppolicy.la # moduleload refint.la # moduleload retcode.la moduleload rwm.la # moduleload seqmod.la # moduleload smbk5pwd.la # moduleload sssvlv.la # moduleload syncprov.la # moduleload translucent.la # moduleload unique.la # moduleload valsort.la moduleload back_ldap moduleload rwm # The next three lines allow use of TLS for encrypting connections using a # dummy test certificate which you can generate by running # /usr/libexec/openldap/generate-server-cert.sh. Your client software may balk # at self-signed certificates, however. TLSCACertificatePath /etc/openldap/certs TLSCertificateFile "\"OpenLDAP Server\"" TLSCertificateKeyFile /etc/openldap/certs/password # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! # enable on-the-fly configuration (cn=config) database config access to * by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * none # enable server status monitoring (cn=monitor) database monitor access to * by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.exact="cn=Manager,dc=opencg21,dc=priv" read by * none ############################################################ #LDAP ############################################################ database ldap suffix "OU=MYOU,DC=MYDC,DC=PRIV" uri ldap://mydc.cg21.priv rebind-as-user acl-bind bindmethod=simple binddn="CN=****,DC=PRIV" credentials="***" idassert-bind bindmethod=simple binddn="CN=****,DC=PRIV" credentials="***" mode=none lastmod on idassert-authzFrom * access to * by * read ############################################################ #RELAY ############################################################ database relay suffix "ou=myOU,dc=openldap,dc=priv" relay "ou=myOU,dc=mydc,dc=priv" subordinate overlay rwm rwm-rewriteEngine on rwm-rewriteContext default rwm-rewriteRule "(.+,)?ou=myOU,dc=openldap,dc=priv$" "$1ou=myOU,dc=mydc,dc=priv" ":" rwm-rewriteContext searchEntryDN rwm-rewriteContext searchAttrDN rwm-rewriteRule "(.+,)?dc=openldap,dc=priv$" "$1dc=openldap,dc=priv" ":" rwm-rewriteContext searchFilter rwm-rewriteContext referralAttrDN rwm-rewriteContext referralDN rwm-map attribute uid sAMAccountName rwm-map attribute modifyTimestamp modifyTimestamp #rwm-map objectclass inetOrgPerson * rwm-map objectclass groupOfNames group rwm-normalize-mapped-attrs yes ############################################################# #DATABASE PRINCIPALE ############################################################ database bdb suffix "dc=openldap,dc=priv" checkpoint 1024 15 rootdn "cn=Manager,dc=openldap,dc=priv" # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw {SSHA}qGb9L/sewV24o10bQNynt3Kb2Uyv0Ac8 # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap lastmod on # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub #index samaccountname # Replicas of this database #replogfile /var/lib/ldap/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com(a)EXAMPLE.COM Ce message (pièces jointes comprises) est protégé par des règles relatives au secret des correspondances ; il peut en outre contenir des informations à caractère confidentiel ; il est établi à destination exclusive de son destinataire. Toute divulgation, utilisation, diffusion ou reproduction (totale ou partielle) de ce message, ou des informations qu'il contient, doit être préalablement autorisée. Tout message électronique est susceptible d'altération et son intégrité ne peut être assurée. Le Conseil Général de la Côte d'Or décline toute responsabilité au titre de ce message, s'il a été modifié ou falsifié. Si vous n'êtes pas destinataire de ce message, merci de le détruire immédiatement et d'avertir l'expéditeur de l'erreur de distribution et de la destruction du message. Toute opinion contenue dans ce message appartient à son auteur : pour qu'il engage la responsabilité de l'institution, il doit être confirmé par un écrit et son auteur doit être dûment habilité.

1 0

Re: add rich data into attribute type definition possible?
by Ulrich Windl 06 Aug '13

06 Aug '13

Sorry, the list doesn't set the proper reply-to, so I forgot to send to the list... See attached message

3 2

Difference between ldap searches
by radiatejava 06 Aug '13

06 Aug '13

I am trying to understand the difference between these 2 ldap searches, can anyone explain ? ldapsearch --hostname localhost --baseDN "ou=Groups,dc=example,dc=com" "(objectclass=*)" @groupOfUniqueNames ldapsearch --hostname localhost --baseDN "ou=Groups,dc=example,dc=com" "(objectclass=groupOfUniqueNames)" What do we primarily mean by using @<objectclass> format ? Thanks

4 3

Re: N-Way Master replication no contextcsn
by espeake＠oreillyauto.com 05 Aug '13

05 Aug '13

Okay so I down loaded tar and followed these instructions. http://www.openldap.org/software/release/install.html It says that everything was okay and I received no errors. I restarted the slapd service and it still shows that it is the old version. I guess I'm still missing something. Eric Speake Web Systems Administrator O'Reilly Auto Parts From: Christian Kratzer <ck(a)cksoft.de> To: espeake(a)oreillyauto.com Cc: openldap-technical(a)openldap.org, openldap-technical-bounces(a)OpenLDAP.org Date: 08/02/2013 10:09 AM Subject: Re: N-Way Master replication no contextcsn Hi, On Fri, 2 Aug 2013, espeake(a)oreillyauto.com wrote: > As a noob upgrading appears to easier said than done. I am running on > Ubuntu 10.04 on my master and I have tried to create packages from the code > I downloaded from the web site and the install just doesn't work. So I > found an RPM and and converted it via alien to a deb file and used dpkg to > try and install and even with --force it erred out trying to overwrite the > slapd.d folder. Is there and easy way to build the package as a deb file > so I can install it and also add it to my repo for the other servers. you could try just fetching the official tarball and building and installing from that. also take a backup of you config and your data with: slapcat -n0 -l > config.ldif slapcat -l data.ldif Greetings Christian > > Thanks, > Eric Speake > Web Systems Administrator > O'Reilly Auto Parts > > > > From: Christian Kratzer <ck-lists(a)cksoft.de> > To: espeake(a)oreillyauto.com > Cc: openldap-technical(a)openldap.org > Date: 07/29/2013 10:44 AM > Subject: Re: N-Way Master replication no contextcsn > Sent by: openldap-technical-bounces(a)OpenLDAP.org > > > > Hi, > > On Fri, 26 Jul 2013, espeake(a)oreillyauto.com wrote: > >> >> Trying a different method of replication to suit or need and I set up two >> test servers for n-way master mirroring servers. Both servers have the >> same configuration being fed to them through puppet. In the logs I can > see >> them bind and check cookies but I get CSN too old, ignoring >> 20110608165005.984980Z#000000#000#000000 (olcOverlay= >> {4}syncprov,olcDatabase={1}hdb,cn=config) THen the last slapd entry in > the >> log is rid=002 >> cookie=rid=002,sid=002,csn=20110915141524.047299Z#000000#000#000000 and >> then nothing else happens. If I make a change to user it never syncs to >> the other server. >> >> At this point I don't know what to look at or what you might want to look >> at to help diagnose the problem. I followed the documentation in the > admin >> guide to set this up. >> >> Any and all help is appreciated. > > 1. You are using an ancient openldap version 2.4.28 compiled by your > distribution. Please start by updating to a current 2.4.35 build from > sources. > > 2. You say both servers have the same configuration through puppet ? I see > you are using cn=config. How are you distributing this configuration. You > should not write any files to slapd.d via puppet or other means. Use > slapcat/slapadd -n0 to export and import configurations. > > Greetings > Christian > > -- > Christian Kratzer CK Software GmbH > Email: ck(a)cksoft.de Wildberger Weg 24/2 > Phone: +49 7032 893 997 - 0 D-71126 Gaeufelden > Fax: +49 7032 893 997 - 9 HRB 245288, Amtsgericht Stuttgart > Web: http://www.cksoft.de/ Geschaeftsfuehrer: Christian Kratzer > > > -- > This message has been scanned for viruses and dangerous content, > and is believed to be clean. > Message id: 07A406006FB.AF9AA > > > > > This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS ? 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you. > -- Christian Kratzer CK Software GmbH Email: ck(a)cksoft.de Wildberger Weg 24/2 Phone: +49 7032 893 997 - 0 D-71126 Gaeufelden Fax: +49 7032 893 997 - 9 HRB 245288, Amtsgericht Stuttgart Web: http://www.cksoft.de/ Geschaeftsfuehrer: Christian Kratzer -- This message has been scanned for viruses and dangerous content, and is believed to be clean. Message id: C01E4600DDE.A423A This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

2 2

should sssvlv and translucent overlays work together?
by Steve Eckmann 05 Aug '13

05 Aug '13

I am applying the sssvlv overlay globally and applying the translucent overlay to an ldap backend. If I execute a search like: ldapsearch -x -H ldaps://localhost -LLL -b dc=example,dc=com \ -D "cn=admin,dc=example,dc=com" -w admin \ -E 'sss=cn:2.5.13.3' \ '(filter)' cn mail localAttr1 localAttr2 the result is sorted by cn, as desired, but the 'cn' and 'mail' attributes are not included in the ldapsearch output for proxied entries. It doesn't matter whether the filter refers to proxied or local attributes, or some combination. I'm not seeing any clues in the slapd debug output (-d -1). In the ldapsearch debug output it looks like the proxied attributes are not being returned from slapd. So should the sssvlv and translucent overlays work together, and if so, where should I be looking for a misconfiguration? Thanks. Steve

1 0

add rich data into attribute type definition possible?
by Zhang Weiwu 05 Aug '13

05 Aug '13

GUI explains to the end user what each field is about, by reciting DESC of olcAttributeTypes - this design seems passable, after all, DESC is intended to describe the attribute type. This method worked for years. Now user base grows, there are speakers of different languages. It is required the field being described in multiple languages. Had DESC been like the 'description' attribute type, an attribute type defined in RFC2256, then I would be able to use language modifier: description: Weight, in kg. It is used to screen health problems. description;lang-zh: 体重，用于检查健康问题。 But it is not. I can see only two ways to workaround the problem: 1. Extend DESC. This look ugly but simple: ... NAME 'ibmWeight' DESC 'Your weight, in kg. It is used to screen health problems.|lang-zh: 您的体重，用于检查健康问题。' ... The application would read DESC, split it by vertical-bars, find the langauge that matches the users's and only display that part. 2. Build a shadow entry for every attributeType: dn: olcAttributeTypes=ibmWeight,cn=shadowAttributeTypes,dc=ibm,dc=com objectClass: ibmShadowAttributeType olcAttributeTypes: ibmWeight description: Weight, in kg. It is used to screen health problems. description;lang-zh: 体重，用于检查健康问题。 and laboriously manually update shadow attribute entry when user add or modify existing olcAttributeTypes. What do you think? How can such a need can be solved? Thanks in advance! P.S. === about openldap's choice of design === When a few years ago I learned that a attribute type is defined by adding an olcAttributeTypes attribute my first reaction was, why not design it in such a way, that a attribute type is defined by adding an olcAttributeType *entry*? Like this: --> objectClasss: olcAttributeType --> olcAttributeName: ibmWeight --> description: Weight, in kg. It is used to screen health problems. --> description;lang-zh: 体重，用于检查健康问题。 The advantage, is to allow extension and inheritance. e.g. the following example has olcConstrainedAttributeType which inherits olcAttributeType --> objectClasss: olcAttributeType ++> objectClasss: olcConstrainedAttributeType --> olcAttributeName: ibmWeight --> description: Weight, in kg. It is used to screen health problems. --> description;lang-zh: 体重，用于检查健康问题。 ++> olcConstraintRegex: [0-9.][0-9.]kg For usability reasons, some developer may as well add jpegPhoto into attribute type definition.

1 0

naming convention for INTEGER attribute types with measurement unit
by Zhang Weiwu 05 Aug '13

05 Aug '13

Is there a naming convention for attribute types whose SYNTAX is INTEGER? If I wish to represent 300g as a weight, should I use ibmWeightInGrams: 300 or ibmWeightInGRam: 300 or ibmGrams: 300 or ibmGram: 300 What is the convention way? There seems to be no INTEGER attribute types shipped with openldap, thus I have no references. In my use case, ordered comparison of integer value is required, thus I cannot use: ibmWeight: 300g

1 0

documents or examples on defining / adding a new syntax?
by Zhang Weiwu 05 Aug '13

05 Aug '13

Here is what I can find about defining / adding a new syntax. Peter Marschall wrote on Sat, 5 Jul 2003 > Defining a new syntax means defining a new form of data structure that the > server must know about. This is not possible using only configration > options. You need to code it into the server. Of course the same holds > for matching rules. Howard Chu wrote on 2002-10-25 > if you had originally configured with --enable-modules, You need to create > a dynamic module that calls register_syntax() with your new syntax > definition, and then use moduleload in slapd.conf to load your module. My question is: 1. is there a module that introduces a new syntax, from which I could observe how that is done? 2. Is there any document on what-to-be-aware-of if you design a new syntax? 3. Do I need to design a new syntax at all? My requirement is the following: I need a new syntax for ranged-values. Examples are: - netWeight: 12~13kg - ISOSensitivity: 800~1600 - heightAdjustableRange: 1.2m~1.5m The spec of ranged-value is a numeric, optionally followed by a measurement unit, followed by a tild as seperator†, followed by another measurement. The syntax needs its own comparison rules, so that you can filter a range, and get entries who offer values ranging in that range. † quote from http://en.wikipedia.org/wiki/~ In some languages (though not English), a tilde-like wavy dash may be used as punctuation (instead of an unspaced hyphen or en-dash) between two numbers, to indicate a range rather than subtraction or a hyphenated number (such as a part number or model number).

3 6

OpenLDAP server should use windows certificate store for certificates
by pramod kulkarni 05 Aug '13

05 Aug '13

Hi, I need information on how to configure OpenLDAP server in the slapd.conf to look for certificates from windows certificate store? Currently i am using certificates from file in a path. Waiting for your inputs. Regards, Pramod

4 4

is there an overlay for 'inheriting' attribute-values from DN?
by Zhang Weiwu 04 Aug '13

04 Aug '13

I think there is an overlay that enables inheriting attribute-values, I am sure I read it somewhere, a few years ago, but I cannot find it, not with Googling. The intended behaviour is the following: For this record: dn: cn=David,ou=Sales Department,o=Example Co. objectClass: organizationalPerson cn: David sn: Jones Normally, if you do (ou=Sales Department), you don't find David's record. But with a certain overlay enabled, you can. It is as if the attribute in the DN is inexplicitly there assigned to the record. Forgive me if I was wrong. Best.

2 1

how to configure deref overlay
by Zhang Weiwu 04 Aug '13

04 Aug '13

It seems few use deref overlay. This feature is mentioned on feature list†, but there is no manual for the overlay; only one line is about it in ldapsearch(1) manual. In the last years, only one person mentioned it in 2009 on this mailing list, and his question was unanswered. I observed this is the way it is supposed to work: $ ldapsearch -E deref=secretary:sn Would put the surname of the secretary as the value of 'secretary' attribute. In reality this search extension complains the "control is unavailable in context". I am afraid loading the model is not enough, it has to be configured first, somewhere in cn=config, but couldn't find any document. $ ldapsearch -x -E '!deref=secretary:sn' cn=Betsy secretary # extended LDIF # # LDAPv3 # base <dc=example,dc=com> (default) with scope subtree # filter: cn=Betsy # requesting: secretary with dereference critical control # # search result search: 2 result: 12 Critical extension is unavailable text: critical control unavailable in context # numResponses: 1 This is how I loaded the module (slapd didn't produce error in log, thus I consider it is loaded): $ slapcat -s cn=config | grep -C 8 deref entryCSN: 20130803010832.965676Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20130803010832Z dn: cn=module{1},cn=config objectClass: olcModuleList cn: module{1} olcModulePath: /usr/lib/ldap olcModuleLoad: {0}deref structuralObjectClass: olcModuleList entryUUID: cdb88ba8-9131-1032-8334-7700fe3e5919 creatorsName: cn=admin,cn=config createTimestamp: 20130804091300Z entryCSN: 20130804091300.138105Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20130804091300Z Here is the data I am experimenting with, very minimalism: $ ldapsearch -x objectClass=pilotPerson # extended LDIF # # LDAPv3 # base <dc=example,dc=com> (default) with scope subtree # filter: objectClass=pilotPerson # requesting: ALL # # David, editors dn: cn=David,ou=editors,dc=example,dc=com cn: David objectClass: pilotPerson objectClass: person objectClass: top sn: Jones # Betsy, editors dn: cn=Betsy,ou=editors,dc=example,dc=com cn: Betsy objectClass: pilotPerson objectClass: person objectClass: top sn: Shwan secretary: cn=David,ou=editors,dc=example,dc=com # search result search: 2 result: 0 Success # numResponses: 3 # numEntries: 2 Any hint on how to make it work? Or more importantly, was there anyone using the overlay at all?? Thanks. P.S. the email subject intends to guide googlers to land in this discussion. † http://www.openldap.org/faq/data/cache/645.html

1 0

error "!deref=secretary: event not found"
by Zhang Weiwu 04 Aug '13

04 Aug '13

It seems few use deref overlay. This feature is mentioned on feature list†, but there is no manual for the overlay; only one line is about it in ldapsearch(1) manual. In the last years, only one person mentioned it in 2009 on this mailing list, and his question was unanswered. I observed this is the way it is supposed to work: $ ldapsearch -E deref=secretary:sn Would put the surname of the secretary as the value of 'secretary' attribute. In reality this search extension errs with a confusing "event not found": $ ldapsearch -x -E !deref=secretary:sn cn=Betsy secretary bash: !deref=secretary: event not found A TCP dump shows the surname of the secretary was not mentioned. Here is the data I am experimenting with, very minimalism: $ ldapsearch -x objectClass=pilotPerson # extended LDIF # # LDAPv3 # base <dc=example,dc=com> (default) with scope subtree # filter: objectClass=pilotPerson # requesting: ALL # # David, editors dn: cn=David,ou=editors,dc=example,dc=com cn: David objectClass: pilotPerson objectClass: person objectClass: top sn: Jones # Betsy, editors dn: cn=Betsy,ou=editors,dc=example,dc=com cn: Betsy objectClass: pilotPerson objectClass: person objectClass: top sn: Shwan secretary: cn=David,ou=editors,dc=example,dc=com # search result search: 2 result: 0 Success # numResponses: 3 # numEntries: 2 Any hint on how to make it work? Or more importantly, was there anyone using the overlay at all?? Thanks. P.S. the email subject intends to guide googlers to land in this discussion. † http://www.openldap.org/faq/data/cache/645.html

2 2

adding mail objectClass to schema
by Darouichi, Aziz 03 Aug '13

03 Aug '13

Hi all, I am trying to create groups within in Openldap-2.4.34 to use for Gmail Active Directory Synch "GADs" I formed the ldif file with following attributes: dn: cn=Google,ou=Group,dc=curry,dc=edu objectclass: groupOfUniqueNames cn: mail: description: uniqueMember: uniqueMember: when I try to add the file I get the following error: adding new entry "cn=Google,ou=Group,dc=curry,dc=edu" ldap_add: Object class violation (65) additional info: attribute 'mail' not allowed Thanks.

4 3

Re: RE24 testing call (OpenLDAP 2.4.36)
by Khosrow Ebrahimpour 02 Aug '13

02 Aug '13

On Monday, July 29, 2013 12:44:39 PM Quanah Gibson-Mount wrote: > If you know how to build OpenLDAP manually, and would like to participate > in testing the next set of code for the 2.4.36 release, please do so. > > Generally, get the code for RE24: > > <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> > > Configure & build. > > Execute the test suite (via make test) after it is built. All tests completed fine on a stock Ubuntu 12.04. # uname -a Linux localhost 3.2.0-23-generic #36-Ubuntu SMP Tue Apr 10 20:39:51 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux

1 0

olcAccess best practices
by Jancewicz, Russell 02 Aug '13

02 Aug '13

Hello, I was wondering if there exists a best practices guide to crafting olcAccess rules? For example: Should I create a single entry per account I want to give access, granting all attributes they would need read/write access to with a particular filter? Or would I be better off grouping access granting to members of the groups and adding individual rules for special edge cases? Or are both these ideas off base and something else would be preferred? Currently I am granting access by groups with access to collections of attributes, however as I am discovering that some accounts need access to those attributes with different filters my rules are continually shifting and growing. Thank You, -Russell Janceiwcz University of Connecticut

2 1

mdb fixes for 2.4.35?
by Patrick Lists 02 Aug '13

02 Aug '13

Hi, Quanah mentioned in another posting to the list that there are some mdb fixes for 2.4.35. Is there a patch available somewhere or a location where I can download the source containing those fixes? Regards, Patrick

4 9

N-Way Master replication no contextcsn
by espeake＠oreillyauto.com 02 Aug '13

02 Aug '13

Trying a different method of replication to suit or need and I set up two test servers for n-way master mirroring servers. Both servers have the same configuration being fed to them through puppet. In the logs I can see them bind and check cookies but I get CSN too old, ignoring 20110608165005.984980Z#000000#000#000000 (olcOverlay= {4}syncprov,olcDatabase={1}hdb,cn=config) THen the last slapd entry in the log is rid=002 cookie=rid=002,sid=002,csn=20110915141524.047299Z#000000#000#000000 and then nothing else happens. If I make a change to user it never syncs to the other server. At this point I don't know what to look at or what you might want to look at to help diagnose the problem. I followed the documentation in the admin guide to set this up. Any and all help is appreciated. Thank you, Eric Speake Web Systems Administrator O'Reilly Auto Parts This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

5 9

Fw: OpenLDAP (using BDB) stalls adding 65,536th entry
by Mark Cooper 02 Aug '13

02 Aug '13

Does anyone have opinions about questions 2 and 3? Thanks ----- Forwarded by Mark Cooper/Poughkeepsie/IBM on 08/01/2013 10:27 PM ----- From: Mark Cooper/Poughkeepsie/IBM To: Howard Chu <hyc(a)symas.com>, Cc: openldap-technical(a)openldap.org, openldap-technical-bounces(a)openldap.org Date: 07/30/2013 09:58 PM Subject: Re: OpenLDAP (using BDB) stalls adding 65,536th entry Not sure exactly how I am supposed to respond (reply all, or just to openldap-technical(a)openldap.org). So, excuse me if I did it wrong doing a reply all. I appreciate all the quick responses. I've been working on this issue for a couple of weeks, so it's great to be able to post a question and get back the answer so rapidly. I do have some follow-up questions based on the responses: 1) Quanah wrote: "This is indeed a BDB bit." Not sure I understand what that means. Is part of the delay due to BDB? It does seem like a whole bunch (maybe 30) log files getting written to file before processing resumes. 2) Index lists get collapsed into ranges - I assume this done to make processing more efficient. Is this a one time event? As I mentioned, I did not see it happen again. 3)If I know I'm going to have greater than 64K elements, is there any way to force it to use ranges at server startup and avoid the delay? I didn't see any such option. Quanah - Yes, I understood that 65,536 is a power of 2 and it's importance in computer processing :) Thanks again for the answers From: Howard Chu <hyc(a)symas.com> To: Mark Cooper/Poughkeepsie/IBM@IBMUS, openldap-technical(a)openldap.org, Date: 07/30/2013 05:11 PM Subject: Re: OpenLDAP (using BDB) stalls adding 65,536th entry Sent by: openldap-technical-bounces(a)openldap.org Mark Cooper wrote: > I've been doing some testing using OpenLDAP with BDB on a couple of different > platforms. I noticed a similar situation. When I sit in a loop doing adds, > at the 65,536th added entry the process stalls for a short period of time. > After a minute or two, the add succeeds. My first thought is that this is a > BDB issue, so I posted this question to Oracle's BDB forum. But I have yet to > receive any answer. This is all known/expected behavior. One (or more) of your index slots hit its maxsize of 65535 elements and was collapsed into a range. This typically happens with the objectClass index first, if you're adding a bunch of objects all of the same classes. Taking a minute or two is abnormal, but I suppose is possible if multiple indices hit the condition at the same time. > This situation seems to happen when I have around 43 10MB log files. During > the stall, I notice many log files are being written (another 25 or so), which > is a much quicker rate than was being written prior to the stall. > > The stall only happens once. I added another 350,000 entries and no more > stalls. I ran a few other tests. Added 65,535 entries. All is fine. As > soon as the next entry is add, even if I recycle the server, I hit the > condition. I even tried deleting 1,000 entries. I would then need to add > 1,0001 to get to 65,536 entries in the database and then hit the delay. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

DR scenerio
by espeake＠oreillyauto.com 01 Aug '13

01 Aug '13

Okay here is what we are wanting to do and I need to know if it is possible with openLDAP. We have a main production ldap server v. 2.4.28 running on Ubuntu 10.04 We are adding two servers that will handle authenication and refer writes to the main provider server. What I would like to to setup another provider in our DR site and have it pull replication from the main LDAP server once a day, maybe twice. Then in turn that server would be the provider for two consumers at the DR site that would handle auth requests and refer write to the provider at the DR site. But the no changes at the DR site would be written back to the main production provider. I don't want someone testing something in the DR to be written back to production. In a nut shell I want to have two systems that look the same and the information for the second system would come from a sync with the first system, but the second system would not be able to write back to the main system. Thanks, Eric Speake Web Systems Administrator O'Reilly Auto Parts This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

2 1

Error 32 object not found.
by espeake＠oreillyauto.com 01 Aug '13

01 Aug '13

Here is the error message I get when I and trying to replicate my databases. Aug 1 11:05:41 tntest-ldap-2 slapd[4871]: do_syncrep2: rid=002 LDAP_RES_SEARCH_RESULT Aug 1 11:05:41 tntest-ldap-2 slapd[4871]: do_syncrepl: rid=002 rc -2 retrying Here is the ldif from the master. dn: olcDatabase={0}config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootDN: cn=admin,cn=config olcRootPW: secret olcSyncrepl: rid=002 provider=ldap://tntest-ldap-master-1.oreillyauto.com type=refreshAndPersist retry="5 +" searchbase="cn=config" bindmethod=simple binddn="uid=admin,dc=oreillyauto,dc=com" credentials=secret olcUpdateRef: ldap://tntest-ldap-master-1.oreillyauto.com olcAccess: to * by dn="uid=admin,dc=oreillyauto,dc=com" read by dn="uid=ldapAdmin,ou=system,dc=oreillyauto,dc=com" read by * none structuralObjectClass: olcDatabaseConfig entryUUID: f074ba7c-09ed-1030-952b-0bb60fbd91a8 creatorsName: cn=config createTimestamp: 20110503162710Z entryCSN: 20110503162710.319234Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20110503162710Z Here is the ldif from the consumer. dn: olcDatabase={0}config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootDN: cn=config olcRootPW: secret structuralObjectClass: olcDatabaseConfig olcUpdateRef: ldap://tntest-ldap-master-1.oreillyauto.co olcsyncrepl: rid=002 provider=ldap://tntest-ldap-master-1.oreillyauto.com type=refreshAndPersist retry="10 +" searchbase="cn=config" bindmethod=simple binddn="uid=admin,dc=oreillyauto,dc=com" credentials=secret olcAccess: to * by dn="uid=admin,dc=oreillyauto,dc=com" write by dn="uid=ldapadmin,ou=system,dc=oreillyauto,dc=com" write by * none entryUUID: f074ba7c-09ed-1030-952b-0bb60fbd91a8 creatorsName: cn=config createTimestamp: 20110503162710Z entryCSN: 20110503162710.319234Z#000000#000#000000 modifiersName: cn=config ModifyTimestamp: 20110503162710Z Getting cloaser I think. Thanks, Eric Speake Web Systems Administrator O'Reilly Auto Parts This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

1 0

how to configure subsuffix?
by Zeus Panchenko 01 Aug '13

01 Aug '13

hi all, I'm absolutely new to LDAP and need advice, please how is it better/correct to configure database to implement "corporative users tree" covered? what I mean is structure for head office (ho), branch 1 of head office (bo1), ... branch N of head office (boN): - ho -+- bo1 -+- People | +- Groups | +- Hosts ... | +- boN -+- People +- Groups +- Hosts I see it as core LDAP server which replicates db partially, to the consequent branches while trying to google the solution I found this (just what I described as I believe): http://www.centos.org/docs/5/html/CDS/ag/8.0/Configuring_Directory_Database… but it've occured not enough for me :( so, may somebody advice, how to implement the structure in .ldif? -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET)

2 2

Removing Overlays Using cn=config
by Tim Gustafson 01 Aug '13

01 Aug '13

Hi, I would like to remove the "auditlog" overlay from one of my databases on my OpenLDAP server that is running 2.4.35 and is configured via cn=config. But, when I try to remove the overlay object, I get: 0x35 (LDAP_UNWILLING_TO_PERFORM) I Googled around about this, and found some older list messages about not being able to delete overlays, but most of those messages are years old and I was wondering if this has changed at all? If not, what is the "proper" way to remove an overlay? -- Tim Gustafson tjg(a)ucsc.edu 831-459-5354 Baskin Engineering, Room 313A

4 3

Re: Antw: N-Way Multi-Master TLS problem
by Patrick Lists 31 Jul '13

31 Jul '13

On 07/31/2013 11:50 AM, Ulrich Windl wrote: > Hi! > > I had the same problem, and I found a solution: > > In config, don't use the host name as filename for the certificate/key, but use the service name (like "slapd"). Then (the confusing part), store the server's certificate in that "slapd" file. So even if the file name is the same on every server, the file's contents are different. > > I use (SLES11, your paths may vary): > > olcTLSCertificateFile: /etc/ssl/servercerts/slapd.pem > olcTLSCertificateKeyFile: /etc/ssl/private/slapd.key > olcTLSCACertificatePath: /etc/ssl/certs > > Here that works fine, but I feel documentation should talk about that also. Wow that certainly is a solution I did not see coming. Thanks! I think I got it working now :-) IMHO it sounds like a bug to me. Never seen such a requirement for a TLS config. Thanks again, much appreciated! Regards, Patrick

1 0

Re: RE24 testing call (OpenLDAP 2.4.36)
by Andrew Cobaugh 31 Jul '13

31 Jul '13

On Mon, Jul 29, 2013 at 3:44 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > If you know how to build OpenLDAP manually, and would like to participate > in testing the next set of code for the 2.4.36 release, please do so. > I can report that all tests run by 'make test' complete successfuly on a stock 64-bit RHEL6 host. --andy

1 0

OpenLDAP syncrepl over SSL
by Tony Davis 31 Jul '13

31 Jul '13

Hi, I wonder if anyone can help me with a question I have regarding an openldap setup on Redhat / Centos 5.8 using openldap-2.3.43. I am trying to setup replication, I have set this up using the simple bind method, which stores a password for the replication in the config. (This works) but I wondered if there was a way to have this replication take place using ssl certificates without the need to store the unhashed password in the slapd.conf? Is this possible? or do I still have to specify a replication user and pass, but all the auth takes place over ssl? This is my current config for replication: syncrepl rid=001 provider=ldap://master01.tld type=refreshAndPersist interval=00:00:05:00 retry="5 5 300 +" searchbase="dc=tld" attrs="*,+" bindmethod=sasl saslmech=EXTERNAL tls_cert=/etc/master02.tld.pem tls_key=/etc/master02.tld.key tls_cacert=/etc/openldap/cacerts/ca.pem tls_reqcert=demand starttls=yes mirrormode on updateref ldap://master01.tld but in the replication log i get the following: Jul 31 11:06:18 master02 slapd[6958]: do_syncrep1: rid 001 ldap_sasl_interactive_bind_s failed (7) Jul 31 11:06:18 master02 slapd[6958]: do_syncrepl: rid 001 retrying (3 retries left) Jul 31 11:06:18 master02 slapd[6958]: daemon: activity on 1 descriptor Jul 31 11:06:18 master02 slapd[6958]: daemon: activity on:

3 2

ldap_sasl_bind doesn't fail with wrong credentials
by Andrius Kulbis 31 Jul '13

31 Jul '13

Hello, Shouldn't ldap_sals_bind fail if wrong credentials are given? Or am I checking the bind result in wrong way? I pass wrong password or username and still can't get BIND ERROR. #include <stdio.h> #include <ldap.h> #include <stdlib.h> #define HOST "x.x.x.x" int main (int argc, char **argv) { char *UID = argv[1]; char *PASSWD = argv[2]; char BASEDN[80]; strcpy(BASEDN, "eduPersonPrincipalName="); strcat(BASEDN, UID); strcat(BASEDN, "@ex.com,ou=People,ou=Users,dc=ex,dc=com"); LDAP *ld; char *ldapuri = NULL; LDAPURLDesc url; memset( &url, 0, sizeof(url)); url.lud_scheme = "ldap"; url.lud_host = HOST; url.lud_port = LDAP_PORT; url.lud_scope = LDAP_SCOPE_DEFAULT; ldapuri = ldap_url_desc2str( &url ); int rc, msgid, version = LDAP_VERSION3; struct berval passwd = {0, NULL}; passwd.bv_val = PASSWD; passwd.bv_len = strlen(PASSWD); LDAPControl c; LDAPControl **sctrlsp = NULL; LDAPControl *sctrls[3]; LDAPControl sctrl[3]; int nsctrls = 0; c.ldctl_oid = LDAP_CONTROL_PASSWORDPOLICYREQUEST; c.ldctl_value.bv_val = NULL; c.ldctl_value.bv_len = 0; c.ldctl_iscritical = 1; sctrl[nsctrls] = c; sctrls[nsctrls] = &sctrl[nsctrls]; sctrls[++nsctrls] = NULL; sctrlsp = sctrls; if((rc = ldap_initialize(&ld, ldapuri)) != LDAP_SUCCESS) { printf("LDAP_INIT Error\n"); return 1; } ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &version); ldap_set_option(ld, LDAP_OPT_REFERRALS, 0); ldap_set_option(ld, LDAP_OPT_SERVER_CONTROLS, sctrlsp); if((rc = ldap_sasl_bind(ld, BASEDN, LDAP_SASL_SIMPLE, &passwd, NULL, NULL, &msgid)) != LDAP_SUCCESS) { printf("BIND ERROR\n"); return 1; } return 0; } Regards, Andrius

1 0

N-Way Multi-Master TLS problem
by Patrick Lists 31 Jul '13

31 Jul '13

Hi, As an exercise I tried setting up a 2 node N-Way Multi-Master with TLS and TLS replication based on section 18.3.3 of the Admin Gguide. I bumped into a problem that I haven't been able to fix. The error is: TLS: hostname (ldap02.local) does not match common name in certificate (ldap01.local). 51f87d48 slap_client_connect: URI=ldap://ldap02.local Error, ldap_start_tls failed (-11 I have tested the certificates manually and I can't see anything wrong with them. I use FQDNs everywhere. Also it seems odd that, based on strace slapd output, ldap01 needs acess to the public and private certificate of ldap02 and vice versa. OpenLDAP version 2.4.35 + fixes recommended by Quanah on the list. Ntp is running, iptables & SELinux are off The config below is added with: slapadd -v -F /etc/openldap-2.4/slapd.d -l ./test.ldif -n 0 Anyone have a hint what I am doing wrong? ------------------------------------------------------------------- Config ldap01: ------------------------------------------------------------------- # global configuration settings dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/openldap-2.4/slapd-2.4.args olcPidFile: /var/run/openldap-2.4/slapd-2.4.pid olcLogFile: /var/log/openldap-2.4/slapd-2.4.log olcLogLevel: 127 16384 olcTLSCACertificateFile: /etc/pki/tls/certs/Test-CA.crt olcTLSCertificateFile: /etc/pki/tls/certs/ldap01.local.crt olcTLSCertificateKeyFile: /etc/pki/tls/private/ldap01.local.key.crt olcTLSVerifyClient: demand olcLocalSSF: 256 olcSecurity: ssf=256 olcPasswordCryptSaltFormat: $6$%s olcPasswordHash: {CRYPT} olcServerID: 1 ldap://ldap01.local olcServerID: 2 ldap://ldap02.local # load modules dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulePath: /usr/local/lib64/openldap-2.4 olcModuleLoad: back_mdb.la olcModuleLoad: back_monitor.la olcModuleload: syncprov.la # schema definitions dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema # include the schemas include: file:///etc/openldap-2.4/schema/core.ldif include: file:///etc/openldap-2.4/schema/corba.ldif include: file:///etc/openldap-2.4/schema/cosine.ldif include: file:///etc/openldap-2.4/schema/duaconf.ldif include: file:///etc/openldap-2.4/schema/dyngroup.ldif include: file:///etc/openldap-2.4/schema/inetorgperson.ldif include: file:///etc/openldap-2.4/schema/java.ldif include: file:///etc/openldap-2.4/schema/misc.ldif include: file:///etc/openldap-2.4/schema/nis.ldif include: file:///etc/openldap-2.4/schema/openldap.ldif include: file:///etc/openldap-2.4/schema/ppolicy.ldif include: file:///etc/openldap-2.4/schema/collective.ldif # global database parameters dn: olcDatabase=frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: frontend # setup cn=config dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: config olcRootPW: {CRYPT}$6$<somepass> olcSyncrepl: rid=1 provider=ldap://ldap01.local searchbase="cn=config" type=refreshAndPersist timeout=1 schemachecking=off interval=00:00:00:5 retry="5 +" bindmethod=simple binddn="cn=config" credentials=password starttls=critical tls_cert=/etc/pki/tls/certs/config.crt tls_key=/etc/pki/tls/private/config.key.crt tls_cacert=/etc/pki/tls/certs/Test-CA.crt tls_reqcert=demand olcSyncrepl: rid=2 provider=ldap://ldap02.local searchbase="cn=config" type=refreshAndPersist timeout=1 schemachecking=off interval=00:00:00:5 retry="5 +" bindmethod=simple binddn="cn=config" credentials=1234 starttls=critical tls_cert=/etc/pki/tls/certs/config.crt tls_key=/etc/pki/tls/private/config.key.crt tls_cacert=/etc/pki/tls/certs/Test-CA.crt tls_reqcert=demand olcMirrorMode: TRUE olcAccess: to * by dn.exact="cn=Manager,dc=local" write by * none # setup monitoring dn: olcDatabase={1}monitor,cn=config objectClass: olcDatabaseConfig objectClass: olcMonitorConfig olcDatabase: monitor olcAccess: to dn.subtree=cn=Monitor by dn.exact="cn=Manager,dc=local" write by * none dn: olcDatabase={2}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: mdb olcSuffix: dc=local olcRootDN: cn=Manager,dc=local olcRootPW: {CRYPT}$6$<somepass> olcDbDirectory: /var/lib/ldap-2.4/local olcDbIndex: cn pres,eq,sub olcDbIndex: gidNumber pres,eq olcDbIndex: mail pres,eq,sub olcDbIndex: memberUid pres,eq olcDbIndex: objectClass pres,eq olcDbIndex: ou pres,eq,sub olcDbIndex: sn pres,eq,sub olcDbIndex: uid pres,eq olcDbIndex: uidNumber pres,eq olcDbIndex: entryCSN eq olcDbIndex: entryUUID eq olcDbMaxReaders: 0 olcDbMode: 0600 olcDbSearchStack: 16 # size in bytes - 1GB = 1073741824 bytes olcDbMaxSize: 5368709120 olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcSyncUseSubentry: FALSE olcMonitoring: TRUE olcDbNoSync: FALSE olcSizeLimit: unlimited olcTimeLimit: unlimited olcDbEnvFlags: writemap olcDbEnvFlags: nometasync olcAccess: to attrs=userPassword by dn.exact="cn=Manager,dc=local" write by self write by anonymous auth by * none olcAccess: to * by dn.exact="cn=Manager,dc=local" write by self write by * read olcLimits: dn.exact="cn=Manager,dc=local" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited olcSyncrepl: rid=3 provider=ldap://ldap01.local searchbase="dc=local" type=refreshAndPersist timeout=1 schemachecking=off interval=00:00:00:5 retry="5 +" bindmethod=simple binddn="cn=Manager,dc=local" credentials=password starttls=critical tls_cert=/etc/pki/tls/certs/Manager.crt tls_key=/etc/pki/tls/private/Manager.key.crt tls_cacert=/etc/pki/tls/certs/Test-CA.crt tls_reqcert=demand olcSyncrepl: rid=4 provider=ldap://ldap02.local searchbase="dc=local" type=refreshAndPersist timeout=1 schemachecking=off interval=00:00:00:5 retry="5 +" bindmethod=simple binddn="cn=Manager,dc=local" credentials=password starttls=critical tls_cert=/etc/pki/tls/certs/Manager.crt tls_key=/etc/pki/tls/private/Manager.key.crt tls_cacert=/etc/pki/tls/certs/Test-CA.crt tls_reqcert=demand olcMirrorMode: TRUE # add the syncprov overlay to the cn=config database dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov # add the syncprov overlay to the main mdb database dn: olcOverlay=syncprov,olcDatabase={2}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov ------------------------------------------------------------------- Config ldap02: ------------------------------------------------------------------- # global configuration settings dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/openldap-2.4/slapd-2.4.args olcPidFile: /var/run/openldap-2.4/slapd-2.4.pid olcLogFile: /var/log/openldap-2.4/slapd-2.4.log olcLogLevel: 127 16384 olcTLSCACertificateFile: /etc/pki/tls/certs/Test-CA.crt olcTLSCertificateFile: /etc/pki/tls/certs/ldap01.local.crt olcTLSCertificateKeyFile: /etc/pki/tls/private/ldap01.local.key.crt olcTLSCipherSuite: TLSv1+HIGH:!SSLv2:!aNULL:!eNULL:!3DES:!RC4:@STRENGTH olcTLSVerifyClient: demand olcLocalSSF: 256 olcSecurity: ssf=256 olcPasswordCryptSaltFormat: $6$%s olcPasswordHash: {CRYPT} olcServerID: 1 ldap://ldap01.local olcServerID: 2 ldap://ldap02.local # load modules dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulePath: /usr/local/lib64/openldap-2.4 olcModuleLoad: back_mdb.la olcModuleLoad: back_monitor.la olcModuleLoad: memberof.la olcModuleLoad: refint.la olcModuleLoad: auditlog.la olcModuleLoad: ppolicy.la olcModuleload: syncprov.la # schema definitions dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema # include the schemas include: file:///etc/openldap-2.4/schema/core.ldif include: file:///etc/openldap-2.4/schema/corba.ldif include: file:///etc/openldap-2.4/schema/cosine.ldif include: file:///etc/openldap-2.4/schema/duaconf.ldif include: file:///etc/openldap-2.4/schema/dyngroup.ldif include: file:///etc/openldap-2.4/schema/inetorgperson.ldif include: file:///etc/openldap-2.4/schema/java.ldif include: file:///etc/openldap-2.4/schema/misc.ldif include: file:///etc/openldap-2.4/schema/nis.ldif include: file:///etc/openldap-2.4/schema/openldap.ldif include: file:///etc/openldap-2.4/schema/ppolicy.ldif include: file:///etc/openldap-2.4/schema/collective.ldif # global database parameters dn: olcDatabase=frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: frontend # setup cn=config dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: config olcRootPW: {CRYPT}$6$<somepass> olcSyncrepl: rid=1 provider=ldap://ldap01.local searchbase="cn=config" type=refreshAndPersist timeout=1 schemachecking=off interval=00:00:00:5 retry="5 +" bindmethod=simple binddn="cn=config" credentials=password starttls=critical tls_cert=/etc/pki/tls/certs/config.crt tls_key=/etc/pki/tls/private/config.key.crt tls_cacert=/etc/pki/tls/certs/Test-CA.crt tls_reqcert=demand olcSyncrepl: rid=2 provider=ldap://ldap02.local searchbase="cn=config" type=refreshAndPersist timeout=1 schemachecking=off interval=00:00:00:5 retry="5 +" bindmethod=simple binddn="cn=config" credentials=1234 starttls=critical tls_cert=/etc/pki/tls/certs/config.crt tls_key=/etc/pki/tls/private/config.key.crt tls_cacert=/etc/pki/tls/certs/Test-CA.crt tls_reqcert=demand olcMirrorMode: TRUE olcAccess: to * by dn.exact="cn=Manager,dc=local" write by * none # setup monitoring dn: olcDatabase={1}monitor,cn=config objectClass: olcDatabaseConfig objectClass: olcMonitorConfig olcDatabase: monitor olcAccess: to dn.subtree=cn=Monitor by dn.exact="cn=Manager,dc=local" write by * none # add the syncprov overlay to the cn=config database dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov Thank you for any pointers. Regards, Patrick

1 0

OpenLDAP (using BDB) stalls adding 65,536th entry
by Mark Cooper 31 Jul '13

31 Jul '13

I've been doing some testing using OpenLDAP with BDB on a couple of different platforms. I noticed a similar situation. When I sit in a loop doing adds, at the 65,536th added entry the process stalls for a short period of time. After a minute or two, the add succeeds. My first thought is that this is a BDB issue, so I posted this question to Oracle's BDB forum. But I have yet to receive any answer. This situation seems to happen when I have around 43 10MB log files. During the stall, I notice many log files are being written (another 25 or so), which is a much quicker rate than was being written prior to the stall. The stall only happens once. I added another 350,000 entries and no more stalls. I ran a few other tests. Added 65,535 entries. All is fine. As soon as the next entry is add, even if I recycle the server, I hit the condition. I even tried deleting 1,000 entries. I would then need to add 1,0001 to get to 65,536 entries in the database and then hit the delay. I did try playing around with the number of indexes and it did seem to affect the size of the delay, but not the fact that the delay occurs. I'm trying to understand what OpenLDAP or BDB is doing during the stall. Is their a reorganizing of tables/indexes based on a threshold of 65,536 entries? Is this a one time only event as my testing seems to show? Again, my suspicion is that it's more of a BDB issue, but thought others here may have seen this situation. Some values from my DB_CONFIG file: set_cachesize 0 20971520 1 set_lg_regionmax 1048576 set_lg_max 10485760 set_lg_bsize 2097152 set_lk_max_locks 2000 set_lk_max_objects 2000 set_open_flags db_private Some values from my slapd.conf: database bdb suffix "dc=myco,dc=com" rootdn "cn=Manager,dc=myco,dc=com" rootpw secret directory /usr/local/var/openldap-data index objectClass eq index cn eq,sub index departmentNumber eq index employeeNumber eq,sub index uid eq,sub index entryCSN eq index entryUUID eq cachesize 5000 idlcachesize 5000 dncachesize 30000 cachefree 100 searchstack 8 threads 4 Thanks for any help, Mark

4 6

back_sql synrepl producer
by Raymond Page 30 Jul '13

30 Jul '13

Pierangelo, Has the status of back_sql as a valid syncrepl provider changed since this conversation: http://www.openldap.org/lists/openldap-technical/200904/msg00145.html I have a back_sql producer that I want to query and populate/synchronize to a back_hdb consumer. From the 2009 email exchange, it sounds as though it is impossible or unsupported, though some emails from 2004 made it sound as though its feasible. http://www.openldap.org/lists/openldap-devel/200410/msg00020.html -------------------------------------------------------------- # My SQL Producer database null suffix "cn=admin" rootdn "cn=admin" rootpw password #Clone of SQL entries for verifying syncrepl configuration #database hdb #suffix "ou=virtual" #rootdn "cn=admin" #directory /var/lib/ldap/virtual database sql lastmod on readonly on suffix "ou=virtual" dbname dbname dbuser dbuser upper_func UPPER use_subtree_shortcut yes children_cond "ldap_entries.dn=UPPER(?)" subtree_cond "UPPER(ldap_entries.dn) LIKE UPPER(CONCAT('%',?))" has_ldapinfo_dn_ru no overlay syncprov -------------------------------------------------------------- # My HDB Consumer database null suffix "cn=admin" rootdn "cn=admin" rootpw password database hdb rootdn "cn=admin" directory /var/lib/ldap syncrepl rid=123 provider=ldaps://localhost:636 type=refreshOnly interval=00:00:05:00 searchbase="ou=virtual" schemachecking=off bindmethod=simple binddn="cn=admin" credentials=password tls_cacertdir=/etc/pki/cacerts ---------------------------------------------------------- # Producer logging from -d 16384 syncprov_search_response: cookie=rid=123,csn=20130724213107.411609Z#000000#000#000000 slap_queue_csn: queing 0x7fe7fbffcb70 20130724213725.653540Z#000000#000#000000 slap_graduate_commit_csn: removing 0x7fe7f4168ef0 20130724213725.653540Z#000000#000#000000 ----------------------------------------------------------- # Consumer logging from -d 16384 do_syncrep2: rid=123 LDAP_RES_SEARCH_RESULT do_syncrep2: rid=123 cookie=rid=123,csn=20130724213107.411609Z#000000#000#000000 slap_queue_csn: queing 0x7fba781ae900 20130724213107.411609Z#000000#000#000000 slap_graduate_commit_csn: removing 0x7fba781ae880 20130724213107.411609Z#000000#000#000000 syncrepl_updateCookie: rid=123 be_modify failed (32) -- Raymond Page

2 1

ldap_bind() extended response for password policy
by Andrius Kulbis 29 Jul '13

29 Jul '13

Hello, I'm trying to pull the password policy response message from ldap_bind() method. While checking the packet content from OpenLDAP after ldap_bind() request, with Wireshark, there is a control hooked to the ldap_bind() response, were the message code and message text about password expiration is, but I can't manage to parse that message from response. AFAIK, the OpenLDAP C API ldap_get_option() method doesn't have LDAP_OPT_SERVER_CONTRLOLS case implementation, and I can't get the PASSWORDPOLICYRESPONSE, although I have set the PASSWORDPOLICYREQUEST before the bind. Is there a workaround of this problem? ------ Regards, Andrius Kulbis

3 4

Q: "olcMirrorMode: no equality matching rule"
by Ulrich Windl 29 Jul '13

29 Jul '13

Hi! When trying to add "olcMirrorMode: TRUE" to a database where the value already exists, I get: --- # ldapmodify -ZZ -x -W -D cn=config -f mirrormode.ldif -v -c ldap_initialize( <DEFAULT> ) Enter LDAP Password: add olcMirrorMode: TRUE modifying entry "olcDatabase={0}config,cn=config" ldap_modify: Inappropriate matching (18) additional info: modify/add: olcMirrorMode: no equality matching rule add olcMirrorMode: TRUE modifying entry "olcDatabase={1}hdb,cn=config" modify complete --- It looks to me as if a compare operator for "TRUE" (Boolean?) is not defined. Am I right? olcObjectIdentifier: OMsBoolean OMsyn:7 Regards, Ulrich

2 1

How to Pointing Openldap Slave from Openldap Master on Openldap Replication
by Iftakhul Anwar 27 Jul '13

27 Jul '13

Hi All, I just successfully replicated Openldap using ubuntu 10.04 as master server (provider), 12.04 as slave server (consumer). I'm using syncrepl method for this replication. Below configuration for provider.ldif and customer.ldif *### provider ### # Add indexes to the frontend db. dn: olcDatabase={1}hdb,cn=config changetype: modify add: olcDbIndex olcDbIndex: entryCSN eq - add: olcDbIndex olcDbIndex: entryUUID eq #Load the syncprov and accesslog modules. dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: syncprov - add: olcModuleLoad olcModuleLoad: accesslog # Accesslog database definitions dn: olcDatabase={2}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {2}hdb olcDbDirectory: /var/lib/ldap/accesslog olcSuffix: cn=accesslog olcRootDN: cn=admin,dc=teleneos,dc=org olcDbIndex: default eq olcDbIndex: entryCSN,objectClass,reqEnd,reqResult,reqStart # Accesslog db syncprov. dn: olcOverlay=syncprov,olcDatabase={2}hdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov olcSpNoPresent: TRUE olcSpReloadHint: TRUE # syncrepl Provider for primary db dn: olcOverlay=syncprov,olcDatabase={1}hdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov olcSpNoPresent: TRUE # accesslog overlay definitions for primary db dn: olcOverlay=accesslog,olcDatabase={1}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcAccessLogConfig olcOverlay: accesslog olcAccessLogDB: cn=accesslog olcAccessLogOps: writes olcAccessLogSuccess: TRUE # scan the accesslog DB every day, and purge entries older than 7 days olcAccessLogPurge: 07+00:00 01+00:00* Then below consumer.ldif * ### consumer ### #Load the syncprov module. dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: syncprov # syncrepl specific indices dn: olcDatabase={1}hdb,cn=config changetype: modify add: olcDbIndex olcDbIndex: entryUUID eq - add: olcSyncRepl olcSyncRepl: rid=0 provider=ldap://139.193.195.170 bindmethod=simple binddn="cn=admin,dc=teleneos,dc=org" credentials=teleneos searchbase="dc=teleneos,dc=org" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" schemachecking=on type=refreshAndPersist retry="60 +" syncdata=accesslog - add: olcUpdateRef olcUpdateRef: ldap://139.193.195.170* Now when i add any value on ldap provider, They will replicated on consumer (ldap slave server). But on my mechanism, i will have many ldap master machine on internet which will have to replicated to one ldap slave server.I will created centralized system. Moreover every ldap server is using dynamic Ip address which should change automatically. So not possible for me if i must add line* olcUpdateRef: ldap://ip_provider*for every ldap provider on ldap configuration. Is there configuration on ldap provider to pointing where ldap slave is ? So that, to replicate to slave server on my provider server (ldap master) , i just need pointing ip of slave ldap server is. So configuration pointing on every ldap provider. Help me to solve this issue. Thanks

1 0

undefined symbol: ldap_x_utf8s_to_wcs
by Michael 27 Jul '13

27 Jul '13

Hi, I originally sent this to the wrong mail list. I hope this is the correct one. I've compiled v2.4.35 on CentOS v6.4 with the smbk5pwd overlay. When I change my password the openldap terminates with the message: /usr/sbin/slapd: symbol lookup error: /usr/lib64/openldap/smbk5pwd-2.4.so.2: undefined symbol: ldap_x_utf8s_to_wcs Thanks for any help. Google wasn't so helpful this time. Mike

1 0

Example for SASL bind to Microsoft AD
by radiatejava 26 Jul '13

26 Jul '13

I am trying to do OpenLDAP integration with Microsoft AD/LDAP. For some initial troublehooting purpose, I am looking for using ldapsearch command with SASL bind (DIGEST-MD5). Can anyone give me the exact syntax for how to use ldapsearch command with SASL bind for active directory ? Appreciate your help. I have been trying out whats there over the web but no luck yet. Thanks.

3 5

Fwd: Fwd: Example for SASL bind to Microsoft AD
by radiatejava 26 Jul '13

26 Jul '13

These are my tries, do you see anything wrong here: ldapsearch -h 10.77.125.83 -p 389 -Y DIGEST-MD5 -R agentdev-dc.agentdev.com -X "dn:CN=sburnwal,CN=Users,DC=agentdev,DC=com" -b "dc=agentdev,dc=com" "(cn=iqsyed)" SASL/DIGEST-MD5 authentication started Please enter your password: ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: 80090303: LdapErr: DSID-0C0904BE, comment: The digest-uri does not match any LDAP SPN's registered for this server., data 0, v1db1 ldapsearch -h 10.77.125.83 -p 389 -Y DIGEST-MD5 -R agentdev-dc.agentdev.com -U sburnwal(a)agentdev.com -X "dn:CN=sburnwal,CN=Users,DC=agentdev,DC=com" -b "dc=agentdev,dc=com" "(cn=iqsyed)" SASL/DIGEST-MD5 authentication started Please enter your password: ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: 8009030C: LdapErr: DSID-0C0904DC, comment: AcceptSecurityContext error, data 52e, v1db1 Thanks.

1 0

Replicating schema
by espeake＠oreillyauto.com 26 Jul '13

26 Jul '13

Okay so I am very new to openLDAP and we are running v 2.4.28 on ubuntu 12.04. In trying to set up a mirror with two servers that will grow to 3 soon. THis is what I get in the log about syncing the schema: Jul 25 13:26:42 tntest-ldap-1 slapd[27954]: conn=1004 fd=16 ACCEPT from IP= 172.17.3.148:39672 (IP=0.0.0.0:389) Jul 25 13:26:42 tntest-ldap-1 slapd[27954]: conn=1004 op=0 BIND dn="uid=admin,dc=example,dc=com" method=128 Jul 25 13:26:42 tntest-ldap-1 slapd[27954]: conn=1004 op=0 BIND dn="uid=admin,dc=example,dc=com" mech=SIMPLE ssf=0 Jul 25 13:26:42 tntest-ldap-1 slapd[27954]: conn=1004 op=0 RESULT tag=97 err=0 text= Jul 25 13:26:42 tntest-ldap-1 slapd[27954]: conn=1004 op=1 SRCH base="cn=config" scope=2 deref=0 filter="(objectClass=*)" Jul 25 13:26:42 tntest-ldap-1 slapd[27954]: conn=1004 op=1 SRCH attr=* + Jul 25 13:26:42 tntest-ldap-1 slapd[27954]: findbase failed! 32 Jul 25 13:26:42 tntest-ldap-1 slapd[27954]: conn=1004 op=1 SEARCH RESULT tag=101 err=32 nentries=0 text= Jul 25 13:26:42 tntest-ldap-1 slapd[27954]: conn=1004 op=2 UNBIND Jul 25 13:26:42 tntest-ldap-1 slapd[27954]: conn=1004 fd=16 closed >From what I can tell it is binding with the simple methad establishes the search base looking at all of the object classes. but then it says it can't find the data base. Here is the ldif file from olcDatabase{0}config.ldif dn: olcDatabase={0}config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootDN: cn=admin,cn=config olcRootPW: secret structuralObjectClass: olcDatabaseConfig olcsyncrepl: rid=001 provider=ldap://tntest-ldap-1.example.com type=refreshAndPersist retry="5 +" searchbase="cn=config" bindmethod=simple binddn="uid=admin,dc=example,dc=com" credentials=secret olcsyncrepl: rid=002 provider=ldap://tntest-ldap-2.example.com type=refreshAndPersist retry="5 +" searchbase="cn=config" bindmethod=simple binddn="uid=admin,example,dc=com" credentials=secret olcMirrorMode: TRUE olcAccess: to * by by dn="uid=admin,dc=example,dc=com" write by dn="uid=ldapadmin,ou=system,dc=oreillyauto,dc=com" read by * none Any ideas on where I should be looking to make a correction or any other information you need to help me figure this out? Thank you, Eric Speake Web Systems Administrator O'Reilly Auto Parts This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

2 1

Replicating the Access Log
by Tim Gustafson 26 Jul '13

26 Jul '13

Hi, I'm using the accesslog overlay on all three of my LDAP servers to record BIND and WRITE operations. Is there any reason I can't replicate the data from cn=log on all three of my servers in MirrorMode so that all three of my servers contain a complete audit log of all bind and write operations? I tried to Google this, but all I'm findind is how-tos and questions about using accesslog and delta replication, which is not what I want. I want to actually replicate the contents of the accesslog itself between all of my servers. -- Tim Gustafson tjg(a)ucsc.edu 831-459-5354 Baskin Engineering, Room 313A

1 0

delta sync error message in log
by Ludovic Brochard 25 Jul '13

25 Jul '13

Hello, I use the 2.4.35 version of openldap. I have three master ldap mulit-delta-sync: ldap01, ldap02 and ldap03. We import data ldap03 on two others by a copy of the FileSystem. Upon restart, the three seem OK but we have in the logs files 3GB of message like this: Jul 22 20:10:46 ldap02 slapd[31439]: do_syncrep2: rid=992 (4096) Content Sync Refresh Required Jul 22 20:10:46 ldap02 slapd[31439]: do_syncrep2: rid=992 (4096) Content Sync Refresh Required Jul 22 20:10:46 ldap02 slapd[31439]: do_syncrep2: rid=992 (4096) Content Sync Refresh Required Jul 22 20:10:46 ldap02 slapd[31439]: do_syncrep2: rid=992 (4096) Content Sync Refresh Required Jul 22 20:10:46 ldap02 slapd[31439]: do_syncrep2: rid=992 (4096) Content Sync Refresh Required Jul 22 20:10:46 ldap02 slapd[31439]: do_syncrep2: rid=992 (4096) Content Sync Refresh Required Jul 22 20:10:46 ldap02 slapd[31439]: do_syncrep2: rid=992 (4096) Content Sync Refresh Required Jul 22 20:10:46 ldap02 slapd[31439]: do_syncrep2: rid=992 (4096) Content Sync Refresh Required Jul 22 20:10:46 ldap02 slapd[31439]: do_syncrep2: rid=992 (4096) Content Sync Refresh Required Jul 22 20:10:46 ldap02 slapd[31439]: do_syncrep2: rid=992 (4096) Content Sync Refresh Required Jul 22 20:10:46 ldap02 slapd[31439]: do_syncrep2: rid=992 (4096) Content Sync Refresh Required Jul 22 20:10:46 ldap02 slapd[31439]: do_syncrep2: rid=992 (4096) Content Sync Refresh Required Jul 22 20:10:46 ldap02 slapd[31439]: do_syncrep2: rid=992 (4096) Content Sync Refresh Required Jul 22 20:10:46 ldap02 slapd[31439]: do_syncrep2: rid=992 (4096) Content Sync Refresh Required Jul 22 20:10:46 ldap02 slapd[31439]: do_syncrep2: rid=992 (4096) Content Sync Refresh Required Jul 22 20:10:46 ldap02 slapd[31439]: do_syncrep2: rid=992 (4096) Content Sync Refresh Required Someone had an idea of the problem? Or significatuion of this message ? Thank you. -- If the automobile had followed the same development cycle as the computer, a Rolls-Royce would today cost $100, get a million miles per gallon, and explode once a year, killing everyone inside. Robert X. Cringely, InfoWorld magazine

6 5

cn=monitor issues.
by Mónico Briseño 25 Jul '13

25 Jul '13

Hi, there. I have installed ldap in Ubuntu 12.04. I decided to use cn=monitor. I added that line in the slap.conf script. I stopped and started the slpad deamon. After that I typed the following command: ldapsearch -x -D 'cn=admin,dc=example,dc=com' -W \ -b 'cn=monitor' -s base '(objectClass=*)' '*' '+' The results of this command is: extended LDIF # # LDAPv3 # base <> (default) with scope baseObject # filter: (objectclass=*) # requesting: -b cn=monitor (objectClass=*) * + # # dn: objectClass: top objectClass: OpenLDAProotDSE structuralObjectClass: OpenLDAProotDSE configContext: cn=config namingContexts: dc=example,dc=com supportedControl: 2.16.840.1.113730.3.4.18 supportedControl: 2.16.840.1.113730.3.4.2 supportedControl: 1.3.6.1.4.1.4203.1.10.1 supportedControl: 1.2.840.113556.1.4.319 supportedControl: 1.2.826.0.1.3344810.2.3 supportedControl: 1.3.6.1.1.13.2 supportedControl: 1.3.6.1.1.13.1 supportedControl: 1.3.6.1.1.12 supportedExtension: 1.3.6.1.4.1.4203.1.11.1 supportedExtension: 1.3.6.1.4.1.4203.1.11.3 supportedExtension: 1.3.6.1.1.8 supportedFeatures: 1.3.6.1.1.14 supportedFeatures: 1.3.6.1.4.1.4203.1.5.1 supportedFeatures: 1.3.6.1.4.1.4203.1.5.2 supportedFeatures: 1.3.6.1.4.1.4203.1.5.3 supportedFeatures: 1.3.6.1.4.1.4203.1.5.4 supportedFeatures: 1.3.6.1.4.1.4203.1.5.5 supportedLDAPVersion: 3 supportedSASLMechanisms: DIGEST-MD5 supportedSASLMechanisms: CRAM-MD5 supportedSASLMechanisms: NTLM entryDN: subschemaSubentry: cn=Subschema # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 However, I don't see nothing related with cn=monitor. What did I do wrong? Thanks in Advance -- M.S. José M. Briseño Cortés Universidad de Guadalajara Instructional Technologist Univ. Houston Moodle Teacher Certificate NTCM, IACEP, iNACOL, ACM member

4 3

Ldap features installed.
by Mónico Briseño 25 Jul '13

25 Jul '13

Hi, there. I installed Ldap in Ubuntu 12.04 Question: How can I know the ldap features are installed? -- M.S. José M. Briseño Cortés Universidad de Guadalajara Instructional Technologist Univ. Houston Moodle Teacher Certificate NTCM, IACEP, iNACOL, ACM member

2 1

str2entry: invalid value for attributeType objectClass #2 URGENT
by 25Dollar Tech 25 Jul '13

25 Jul '13

Hello Team, I have a problem with OpenLDAP exporting and importing in to a different machine. When I use slapadd -l /backupfilname.ldif I used to get below error message _ 0.16% eta 05m31s elapsed none spd 6.7 k/s 51f0c75b str2entry: invalid value for attributeType objectClass #2 (syntax 1.3.6.1.4.1.1466.115.121.1.38) slapadd: could not parse entry (line=168) . 0.28% eta 04m29s elapsed none spd 12.1 k/s Closing DB... Below is the line 168 168 dn: ou=Idmap,dc=example,dc=test,dc=com 169 objectClass: top 170 objectClass: organizationalUnit 171 objectClass: sambaUnixIdPool 172 ou: Idmap 173 structuralObjectClass: organizationalUnit 174 entryUUID: 22da7a76-16e0-102f-87b0-799f55e47d38 175 creatorsName: cn=admin,dc=example,dc=test,dc=com 176 createTimestamp: 20100628090609Z 177 uidNumber: 1000 178 gidNumber: 20001 179 entryCSN: 20100814084304.552975Z#000000#002#000000 180 modifiersName: cn=admin,dc=example,dc=test,dc=com 181 modifyTimestamp: 20100814084304Z I already installed samba.schema. what could be the reason then. -- *Thanks & Regards, 25dollarTech Team https://sites.google.com/site/25dollartech/* *Email: 25dollartechhelp(a)gmail.com*

2 1

lmdb - atomic actions
by Tomer Doron 24 Jul '13

24 Jul '13

wondering what the best strategy to achieve atomic updates with LMDB. what i am trying to achieve is a read then update atomic action given a highly concurrent use case, for example, if a key/value pair represents a counter, how does one increment or decrement the counter atomically. i am pretty sure mdb_get -> mdv_set sequence is not atomic, wondering if mdb_cursor_get -> mdv_cursor_put sequence is? perhaps a certain flag is required on the get action to achieve a lock? in my bdb implementation i used lockers to achieve this. thanks, tomer

2 3

TLS, integrity and root DSE
by Ulrich Windl 24 Jul '13

24 Jul '13

Hi! When trying to require integrity for LDAP connections by specifying "ssf=1" in Security, I have a problem with Perl where the cat bites its tail: It's recommended to query the root DSE for TLS extension before trying to use TLS like this: my $dse = $ldap->root_dse(); if ($dse->supported_extension(LDAP_EXTENSION_START_TLS)) { my $msg = $ldap->start_tls('verify' => 'require', 'capath' => '/etc/ssl/certs'); ... Unfortunately the root_dse() fails with the security restriction: "confidentiality required" Note: The manual says: "0 (zero) implies no protection, 1 implies integrity protection only" So is "confidentiality" actually "integrity" here, and are here any solutions to this problem? Regards, Ulrich Windl

3 2

root cannot change user password with command "passwd", sssd, pam, openldap
by Augustin Wolf 23 Jul '13

23 Jul '13

Hi list, I'm using CentOs 6.4, and moved user management to OpenLDAP. As far as it works fine for user - user can login, do `passwd` to change his password, etc. - it fails for root to change users passwords. Root have to use ldapmodify. Is it normal behavior, or do I have some configuration errors? For now, LDAP ACL was "turned off" - every user has manage permission. I know it's a security issue, but I wanted to remove potential interference. I will change this as soon as root can change users password. SELlinux was also turned off to eliminate it's potential interference. Iptables was "turned off", as well, though I thing it doesn't matter as long as port 389 is open. My configs, logs, etc are in here: http://fpaste.org/26708/ Thanks in advance, Augustyn

3 4

undocumented TLSProtocolMin
by Manuel Gaupp 23 Jul '13

23 Jul '13

Hi, OpenLDAP seems to support an undocumented configuration parameter "TLSProtocolMin" when linked against OpenSSL. It allows to set the minimum SSL/TLS protocol version: * TLSProtocolMin 768 # (3 << 8) disables SSLv2 * TLSProtocolMin 769 # ((3 << 8)+1) disables SSLv2 and SSLv3 As there's no documentation for TLSProtocolMin: Is this feature ready for production or is it experimental? Best regards, Manuel

3 2

need help interpreting "Error: ldap_back_is_proxy_authz returned 0, misconfigured URI?"
by Steve Eckmann 23 Jul '13

23 Jul '13

The answer would be obvious if we had a misconfigured URI, but I don't think we do. In fact, we are getting this error from the ldap/translucent proxy on a first attempt to retrieve a DN from a remote Active Directory, then a second identical ldapsearch always succeeds. That makes us think there might be a timing issue getting from our openldap server, through a forwarding proxy out of a DMZ, and finally to the target AD server. But since all the openldap log messages appear with the same timestamp, there would have to be a sub-second timeout somewhere in the path. Does openldap have any default sub-second timeouts? I haven't configured any of the slapd or slapd-ldap timeout options. Here is a typical log from a failed search: Jul 15 09:46:09 eck1 slapd[9198]: conn=1001 fd=10 ACCEPT from IP=172.20.11.85:54864 (IP=0.0.0.0:636) Jul 15 09:46:09 eck1 slapd[9198]: conn=1001 fd=10 TLS established tls_ssf=256 ssf=256 Jul 15 09:46:09 eck1 slapd[9198]: conn=1001 op=0 BIND dn="cn=localuser,ou=users,ou=Native,dc=example,dc=com" method=128 Jul 15 09:46:09 eck1 slapd[9198]: conn=1001 op=0 BIND dn="cn=localuser,ou=users,ou=Native,dc=example,dc=com" mech=SIMPLE ssf=0 Jul 15 09:46:09 eck1 slapd[9198]: conn=1001 op=0 RESULT tag=97 err=0 text= Jul 15 09:46:09 eck1 slapd[9198]: conn=1001 op=1 SRCH base="dc=example,dc=com" scope=2 deref=0 filter="(sAMAccountName=steve.eckmann)" Jul 15 09:46:09 eck1 slapd[9198]: conn=1001 op=1 SRCH attr=cn Jul 15 09:46:09 eck1 slapd[9198]: conn=1001 op=1 ldap_back_retry: retrying URI="ldap://172.30.11.20" DN="cn=remoteuser,ou=users,ou=system accounts,dc=example,dc=com" Jul 15 09:46:09 eck1 slapd[9198]: Error: ldap_back_is_proxy_authz returned 0, misconfigured URI? Jul 15 09:46:09 eck1 slapd[9198]: <= mdb_equality_candidates: (sAMAccountName) not indexed Jul 15 09:46:09 eck1 slapd[9198]: conn=1001 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= Jul 15 09:46:09 eck1 slapd[9198]: conn=1001 op=2 UNBIND Jul 15 09:46:09 eck1 slapd[9198]: conn=1001 fd=10 closed Thanks. Steve

3 4

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical