- openldap-technical - openldap.org

cn=config chaining or authzTo Strong(er) authentication required (8)
by espeake＠oreillyauto.com 23 Jul '13

23 Jul '13

I am working on setting up a provider/consumer setup for openLDAP version 2.4.28. Everything seems to be working other than referrals. I can query the consumers, I can write directly to the provider. But I get the following when I try to sent a ldapmadify to a consumer and it refers it to the provider. ldapmodify -W -D "uid=ldapadmin,ou=system,dc=example,dc=com" -H ldap://tntest-ldap.example.com -c -f /tmp/epseake.ldif Enter LDAP Password: modifying entry "uid=ESPEAKE,ou=Users,dc=example,dc=com" ldap_modify: Strong(er) authentication required (8) If I run the modify against the provider with the same credentials it will modify the record. I have added authzTo dn.regex:^uid= [^,]*,ou=system,dc=example,dc=com$. I also added authzTo ldap:///dc=example,dc=com???(objectClass=top) This got rid of my error 10 on the referral but now it is asking for strong(er) authentication. I do have certificates on my servers in the correct locations and olcTLSCertificate statements with the directories for the certs and keys. THis is the final step I hope in getting the test environment completed and ready for testing. All help is appreciated. Thank you, Eric Speake Web Systems Administrator O'Reilly Auto Parts This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

2 1

OpenLdap from OpenCSW installation
by michał kępkowski 23 Jul '13

23 Jul '13

Hey, Has anyone of you install OpenLdap from OpenCSW repositories on Solaris? I've try to install using pkgutils: pkgutil -yi CSWopenldap than I read something more an add pkgutil -iy berkeleydb48 pkgutil -i CSWopenldap-back-bdb however my slaptest shows Unrecognized database type (bdb) 51ed5c62 /etc/opt/csw/openldap/slapd.conf: line 53: <database> failed init (bdb) Line 53 is the beginning of database configuration: database bdb Do you have any ideas? Am I configured something bad?

2 1

Slapd starts with "-h" not working as described
by Nathanel Sulimanov 22 Jul '13

22 Jul '13

Hi, I am trying to configure /etc/sysconfig/ldap with following: SLAPD_LDAP=no SLAPD_URLS="ldap://${HOSTNAME} ldaps://${HOSTNAME} ldap://127.0.0.1" ---> This works and Slapd start ok. But While using: SLAPD_URLS="ldap://${HOSTNAME} ldaps://${HOSTNAME} ldap://localhost" ---> Does NOT work. My /etc/hosts looks like this: 127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 following RPM installed: openldap-2.4.34-1.el6.x86_64 openldap-clients-2.4.34-1.el6.x86_64 openldap-servers-2.4.34-1.el6.x86_64 And one more issue: How I could verify that ldap server start with proper olcServerID ? Is there any logging should be enabled and what values to look for ? How I could present olcServerID along with ldap://${HOSTNAME} ldaps://${HOSTNAME} ldap://127.0.0.1 command ? Regards,

1 0

Re: ldap syncrepl issue.
by Ashok Kumar Shah 22 Jul '13

22 Jul '13

I am running OpenLDAP 2.4.23. Looks like syncrepl has stuck i am seeing this message from last 2 days every minute i see this message popping up on the logs perhaps this the reason of huge slave lag is 2 days and some hours. Is there a fix for this? *syncrepl_message_to_op: rid=011 be_modrdn uid=user.name,ou=xxxxx,dc=xxxx,dc=com (68)* * do_syncrepl: rid=011 rc 68 retrying* * * Thanks, Ashok On Fri, Jul 12, 2013 at 9:26 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Friday, July 12, 2013 5:40 PM +0530 Ashok <ashok.shah(a)flipkart.com> > wrote: > > >> >> >> >> >> Hi, >> >> I am running ldap master and multiple slave with RefreshandPersist config. >> ldap search for an user shows different set of records. ContextCSN on >> master and slave are exactly same. >> What can i do to fix this. I tried restarting slave ldap but didn't help. >> Also i keep getting do_syncrepl: rid=112 rc 68 retrying every minute. I >> doubt if there is replication issue. >> > > It sounds like it is resyncing the DB, and skipping entries that already > exist: LDAP_ALREADY_EXISTS is error code 68. > > > --Quanah > > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

3 3

Antw: Q: Multi-Master setup
by Ulrich Windl 22 Jul '13

22 Jul '13

>>> I wrote on 16.07.2013 at 09:02: [...] > 2) What is the correct syntax for the second argument (URI): Do you need a > final slash, do you need the port? Currently I'm using a syntax like > "olcServerID: 1 ldap://ldap.domain.org" [...] As nobody did answer, I guess nobody knows how the server matches the ServerID. So let me ask a diffenent question: (How) can I query the ServerID a server uses? Regards, Ulrich

2 2

Openldap-2.4.33 bind problem
by Darouichi, Aziz 19 Jul '13

19 Jul '13

Hi all, I am trying to bind openldap-2.4.33 to vendor SSO using simple bind and I am getting invalid credentials. I have reset the rootdn password more than once to make sure there were no typos, and I am still getting same Invalid Credentials error. This is a copy of my slapd.conf # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /opt/local/etc/openldap/schema/core.schema include /opt/local/etc/openldap/schema/ppolicy.schema # Define global ACLs to disable default read access. include /opt/local/etc/openldap/schema/cosine.schema include /opt/local/etc/openldap/schema/nis.schema include /opt/local/etc/openldap/schema/inetorgperson.schema # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /opt/local/var/run/slapd.pid argsfile /opt/local/var/run/slapd.args sizelimit unlimited #serverID 1 allow bind_v2 loglevel sync "/opt/local/etc/openldap/slapd.conf" 180L, 5417C # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /opt/local/etc/openldap/schema/core.schema include /opt/local/etc/openldap/schema/ppolicy.schema # Define global ACLs to disable default read access. include /opt/local/etc/openldap/schema/cosine.schema include /opt/local/etc/openldap/schema/nis.schema include /opt/local/etc/openldap/schema/inetorgperson.schema # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org # Load dynamic backend modules: # modulepath /opt/local/libexec/openldap # moduleload back_bdb.la # moduleload back_hdb.la # moduleload back_ldap.la #modulepath /usr/lib/openldap #moduleload accesslog.la moduleload auditlog.la #moduleload denyop.la #moduleload dyngroup.la moduleload dynlist.la #moduleload lastmod.la #moduleload pcache.la moduleload ppolicy.la #moduleload refint.la #moduleload retcode.la #moduleload rwm.la #moduleload smbk5pwd.la moduleload syncprov.la moduleload syncprov #moduleload translucent.la moduleload unique.la moduleload valsort.la # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! # CA singed Certificate and server cert entries: TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCACertificateFile /opt/local/etc/openldap/cacert.pem TLSCertificateFile /opt/local/etc/openldap/ldap-tls.curry.edu.cert.pem TLSCertificateKeyFile /opt/local/etc/openldap/ldap-tls.curry.edu.key.pem # Clinet verification not required #TLSVerifyClient never ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=curry,dc=edu" rootdn "cn=ldap,dc=curry,dc=edu" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw {SSHA}gMePUFraA8Fjn63t8FzpYHbp+6g8N6Mz #access to * # by dn.base="cn=ldap,dc=curry,dc=edu" read # by * break # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /opt/local/var/openldap-data syncrepl rid=006 provider=ldap://192.168.60.42 tls_cert=/etc/pki/tls/certs/ldap-tls.curry.edu.cert.pem tls_key=/etc/pki/tls/private/ldap-tls.curry.edu.key.pem tls_cacert=/etc/pki/tls/certs/cacert.pem tls_reqcert=demand searchbase="dc=curry,dc=edu" schemachecking=on timelimit=unlimited sizelimit=unlimited type=refreshAndPersist retry="60 +" # Index to maintain index entryUUID eq index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres index nisMapName,nisMapEntry eq,pres,sub #mirrormode TRUE mirrormode on # define the provider to use the syncprov overlay # (last directives in database section) overlay syncprov # contextCSN saved to database every 100 updates or ten minutes syncprov-checkpoint 100 1 syncprov-sessionlog 100 ################################################################################# # Password Policy # ################################################################################ ################################################################################# # This implies the password policy should be for the entire base DN #ppolicy_default overlay ppolicy ppolicy_default "cn=default,ou=policies,dc=curry,dc=edu" # This implies the passwords should not be in clear text and this directive takes no parameters ppolicy_hash_cleartex

2 1

Q: referral issue
by espeake＠oreillyauto.com 18 Jul '13

18 Jul '13

Okay my referral chaining was working and then stopped working. I get an error 10 when I submit a change to my clustered consumers that are setup to refer writes to my master LDAP server. In looking at the configuration help in the online documentation it shows how to setup the slapd.conf file on the master. The issue here is that everything is setup through cn=config. my consumers do have a slapd.conf file along with cn=config files. I have inherited these servers so I'm sure what the person here before me was trying to do. I have an idea but I didn't like that idea. Here is the chaining command from my slapd.conf file. overlay chain chain-uri "ldap://tntest-ldap-master-1.example.com" chain-rebind-as-user TRUE chain-idassert-bind bindmethod="simple" binddn="uid=admin,dc=oreillyauto,dc=com" credentials="password" mode="self" chain-tls start chain-return-error TRUE The the syncrepl area syncrepl rid 002 provider=ldap://tntest-ldap-master-1.example.com type=refreshOnly interval=00:00:05:00 searchbase-"dc=oreillyauto,dc=com" binddn="uuid=syncrepl,ou=system,dc=oreillyauto,dc=com" credentials=password updatedn "uid=ldapadmin,ou=system,dc=example,dc=com" updateref ldap://tntest-ldap-master-1.example.com I need to be pointed in the right direction please. Thanks, Eric Speake Web Systems Administrator O'Reilly Auto Parts This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

2 1

unable to query rootdn on slave via external auth
by Adrian Bridgett 18 Jul '13

18 Jul '13

This has been driving me up the wall and I wondered if someone could point out the bit I'm missing - the desk is getting badly damaged by my head bashing it :-) On our master server I can query the rootdb no problem, but I can't do this on the slaves - this applies whether I use external or ldaps authentication. I've turned on access and search filter debugging and I can't see any rejections. I'm trying to query contextCSN to ensure that the slave is in sync. "slapcat" works, but seems an ugly hack. I can query all the children - just not the root. The config is the same (ish) on both - here's the slave: dn: olcDatabase={1}hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=example,dc=com olcLastMod: TRUE olcRootDN: cn=admin,dc=example,dc=com olcRootPW:: ....... olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 structuralObjectClass: olcHdbConfig entryUUID: 07f3fede-c201-1031-8b17-f3837148ab05 creatorsName: cn=config createTimestamp: 20121113171221Z olcSyncrepl: {0}rid=000 provider=ldap://ldap.example.com type=refreshandPers ist interval=00:00:00:60 retry="60 10 300 +" timelimit=10 searchbase="dc=example ,dc=com" binddn="cn=admin,dc=example,dc=com" bindmethod=simple credent ials=..... starttls=critical tls_reqcert=demand attrs="*,+" olcUpdateRef: ldap://ldap.example.com olcDbIndex: entryCSN eq olcDbIndex: entryUUID eq olcDbIndex: objectClass eq olcDbIndex: cn,sn pres,eq,sub olcDbIndex: uid,uidNumber,gidNumber,memberOf,sudoUser,memberUid pres,eq olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymou s auth by dn="cn=admin,dc=example,dc=com" manage by group.exact="cn=admins, ou=Group,dc=example,dc=com" manage by dn.exact=gidNumber=0+uidNumber=0,cn=p eercred,cn=external,cn=auth manage by * none olcAccess: {1}to attrs=SambaLMPassword,SambaNTPassword by self write by dn="cn =freenas-auth,ou=services,dc=example,dc=com" read by dn="cn=admin,dc=example ,dc=com" manage by group.exact="cn=admins,ou=Group,dc=example,dc=com" ma nage by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth mana ge by * none olcAccess: {2}to dn.base="" by * read olcAccess: {3}to * by self write by dn="cn=admin,dc=example,dc=com" manage b y group.exact="cn=admins,ou=Group,dc=example,dc=com" manage by dn.exact=gid Number=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by * read olcAccess: {4}to dn.base="dc=example,dc=com" by * read On the slave: ldapsearch -Y EXTERNAL -H ldapi:/// -b dc=example,dc=com -s base -Q# extended LDIF # search result search: 2 result: 0 Success # numResponses: 1 On the master: ldapsearch -Y EXTERNAL -H ldapi:/// -b dc=example,dc=com -s base dn: dc=example,dc=com objectClass: top objectClass: dcObject objectClass: organization o: example.com dc: example # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1

2 6

olcPasswordHash
by Nerijus Kislauskas 18 Jul '13

18 Jul '13

Hi community, We want implement password politics in our DIT, and are testing ppolicy and found issues using olcPasswordHash, Password Modify Extension and so. Here are my testings: 1) My cn=config with olcPasswordHash and olcSuffix values $ ldapsearch -D "cn=admin,dc=ktu,dc=lt" -W -x -b "cn=config" olcPasswordHash olcSuffix dn: cn=config olcPasswordHash: {SSHA} ... # {-1}frontend, config dn: olcDatabase={-1}frontend,cn=config olcPasswordHash: {SSHA} olcPasswordHash: {SHA} olcPasswordHash: {SMD5} olcPasswordHash: {MD5} olcPasswordHash: {CRYPT} ... # {2}hdb, config dn: olcDatabase={2}hdb,cn=config olcSuffix: dc=ktu,dc=lt $ 2) My testing user exists without userPassword attribute $ ldapsearch -D "cn=admin,dc=ktu,dc=lt" -W -x -b "eduPersonPrincipalName=testuser9(a)ktu.lt,ou=People,ou=Users,dc=ktu,dc=lt" userPassword Enter LDAP Password: dn: eduPersonPrincipalName=testuser9(a)ktu.lt,ou=People,ou=Users,dc=ktu,dc=lt $ 3) Making a password for a test user. As documentation says "ldappasswd uses the LDAPv3 Password Modify (RFC 3062) extended operation." $ ldappasswd -h localhost -D "cn=admin,dc=ktu,dc=lt" -x -W -S "eduPersonPrincipalName=testuser9(a)ktu.lt,ou=People,ou=Users,dc=ktu,dc=lt" New password: Re-enter new password: Enter LDAP Password: $ 4) userPassword is somehow gets multivalued $ ldapsearch -D "cn=admin,dc=ktu,dc=lt" -W -x -b "eduPersonPrincipalName=testuser9(a)ktu.lt,ou=People,ou=Users,dc=ktu,dc=lt" userPassword Enter LDAP Password: # testuser9(a)ktu.lt, People, Users, ktu.lt dn: eduPersonPrincipalName=testuser9(a)ktu.lt,ou=People,ou=Users,dc=ktu,dc=lt userPassword:: e1NTSEF9RlE3VjRYa003RVJ6eGFTNjR4ZkFRSzRGZEk4cFk0UDQ= --> {SSHA}FQ7V4XkM7ERzxaS64xfAQK4FdI8pY4P4 userPassword:: e1NTSEF9K1JtbWl3M0RxTTV3aEl0U3g5TjVrZWRETlpES3NROUg= --> {SSHA}+Rmmiw3DqM5whItSx9N5kedDNZDKsQ9H userPassword:: e1NIQX1maVFONTAreDdRajZDTk9BWS9hbXFSUmlxQlU9 --> {SHA}fiQN50+x7Qj6CNOAY/amqRRiqBU= userPassword:: e1NNRDV9VUdaa3ZDSWI5Qld4a1VNcUhyZEl3ZElTbnJ3PQ== --> {SMD5}UGZkvCIb9BWxkUMqHrdIwdISnrw= userPassword:: e01ENX1SN3pseDA5WW4waG4yOVYrbktuNENBPT0= --> {MD5}R7zlx09Yn0hn29V+nKn4CA== userPassword:: e0NSWVBUfTFNZVAud1ZxenEvdWM= --> {CRYPT}1MeP.wVqzq/uc $ I guess "frontend" database has so called global olcPasswordHash directive in effect over all databases. I also guess, that 1 SSHA form comes from cn=config, and other 5 forms comes from "frontend". Does anyone know if this is true? 5) if above is true, overwriting globals in local database config seems like a solution to me, but ... $ ldapmodify -D "cn=admin,dc=ktu,dc=lt" -W -x <<EOF > dn: olcDatabase={2}hdb,cn=config > changetype: modify > add: olcPasswordHash > olcPasswordHash: {SSHA} > EOF Enter LDAP Password: modifying entry "olcDatabase={2}hdb,cn=config" ldap_modify: Object class violation (65) additional info: attribute 'olcPasswordHash' not allowed $ Is it possible to get rid of not secure forms of password schemes? I always believed, that password-hash (olcPasswordHash) should help to do that. Maybe I don't know something? I also think, that it could be related to ITS#7625 <http://www.openldap.org/its/index.cgi/Incoming?id=7625;expression=ppolicy;p…>, why ppolicy shows "Additional info: Password policy only allows one password value" error message. Please, help to clear things out. System: Debian 7.0 (wheezy) OpenLDAP: 2.4.31 (from package) Thank you. -- Pagarbiai, Nerijus Kislauskas KTU ITD, Litnet valdymo centras Studentu g. 48a - 101, Kaunas tel.: (8~37) 30 06 45 mob. tel.: 8-614-93889 e-mail.: nerijus.kislauskas(a)ktu.lt

1 1

Re: Upgrade to 2.4.35 Causes Instability, Errors
by Tim Gustafson 18 Jul '13

18 Jul '13

> So you didn't answer anything about the old version of OpenLDAP versus the > current one. I would note that according to the db_stat output, you've > experienced zero deadlocks. That seems somewhat in conflict with your > earlier report. Did you run db_recover (resetting the stats)? Sorry; I missed that one. We were running 2.4.33 before the upgrade. I have not run db_recover in between the original report and now. It is worth noting that the deadlock errors have ceased in the log file, but I can't speak to whether or not we're more stable than we were before; as I mentioned earlier, it seemed kinda random when it would crash. I was thinking that doing a slapcat and then cleaning out the database files and then slapadd'ing everything back might be helpful. Do you agree? -- Tim Gustafson tjg(a)ucsc.edu 831-459-5354 Baskin Engineering, Room 313A

2 1

Re: Upgrade to 2.4.35 Causes Instability, Errors
by Tim Gustafson 18 Jul '13

18 Jul '13

> When you say you upgraded, what all did you do? Did you only upgrade the > openldap binaries? From what openldap release to what release? Did your > upgrade also change the version of BDB? What version of BDB were you on? > What one are you on now? What does your DB_CONFIG file look like? What > does your db_stat -c usage show for locks/lockers/lock objects etc? We're running FreeBSD. I did a minor OS update from 8.2 to 8.4, and then rebuilt all my ports using "portmaster". We're using db46-4.6.21.4 both before and after the upgrade. DB_CONFIG is as follows: set_cachesize 0 67108864 1 set_flags DB_LOG_AUTOREMOVE The output of "db_stat-4.6 -c" is: 116 Last allocated locker ID 0x7fffffff Current maximum unused locker ID 9 Number of lock modes 1000 Maximum number of locks possible 1000 Maximum number of lockers possible 1000 Maximum number of lock objects possible 16 Number of current locks 24 Maximum number of locks at any one time 105 Number of current lockers 111 Maximum number of lockers at any one time 16 Number of current lock objects 22 Maximum number of lock objects at any one time 4144507 Total number of locks requested 4144491 Total number of locks released 0 Total number of locks upgraded 36 Total number of locks downgraded 38 Lock requests not available due to conflicts, for which we waited 0 Lock requests not available due to conflicts, for which we did not wait 0 Number of deadlocks 0 Lock timeout value 0 Number of locks that have timed out 0 Transaction timeout value 0 Number of transactions that have timed out 712KB The size of the lock region 13666 The number of region locks that required waiting (0%) -- Tim Gustafson tjg(a)ucsc.edu 831-459-5354 Baskin Engineering, Room 313A

2 1

Upgrade to 2.4.35 Causes Instability, Errors
by Tim Gustafson 17 Jul '13

17 Jul '13

I recently upgraded OpenLDAP to 2.4.35 and I'm now experiencing some instability issues, and also seeing a bazillion of the following error in my log file: bdb_dn2id_delete 0x108c68: delete failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock -30995 I'm using the BDB backend at the moment. One Google search hit I found suggested I switch to MDB instead. Would this help? -- Tim Gustafson tjg(a)ucsc.edu 831-459-5354 Baskin Engineering, Room 313A

3 3

delete members in big groups with back_mdb
by Marco Schirrmeister 17 Jul '13

17 Jul '13

Hi, I have a problem with mdb and modify operations on very large groups. Specifically deleting members from those groups. Removing 10 members from a group with 25000 members takes 23 seconds. Which also means, all other clients that want to do something hang. Deleting a user from multiple big groups takes minutes before it finishes. Adding members to a large group is quick though. When this delete is running, the cpu goes also up to 100%. It looks like it has to do with the index that I have on uniqueMember. If I remove the index on uniqueMember, the delete of members in big groups is fast. System details are CentOS 6 64bit OpenLDAP 2.4.35 slapd.conf below Is this something normal/exptected or is it maybe a bug? Steps to reproduce - Install OpenLDAP 2.4.35 - Import a base ldif - Add a group with 25000 users - Remove 10 members from the group via ldapmodify Example group dn: cn=x3zolgnanlmpzj1nfk21,ou=groups,dc=example,dc=com objectClass: top objectClass: groupOfUniqueNames ou: groups cn: x3zolgnanlmpzj1nfk21 description: aw88bob79vvqffv1fhii uniqueMember: uid=faefxus4e83ywhh7bbgw(a)ough6unnwjdx0zzqiy0i.e3j,ou=people,dc=example,dc=com ... Below is the slapd.conf from a test system where I reproduced it. I used a very minimal config on the test system. ---- slapd.conf ---- include /usr/share/openldap2.4/schema/core.schema include /usr/share/openldap2.4/schema/cosine.schema include /usr/share/openldap2.4/schema/corba.schema include /usr/share/openldap2.4/schema/inetorgperson.schema include /usr/share/openldap2.4/schema/openldap.schema pidfile /var/run/ldap2.4/slapd.pid argsfile /var/run/ldap2.4/slapd.args modulepath /usr/lib64/oldap24/openldap2.4 moduleload back_monitor.la loglevel stats sync serverID 21 ldap://ldap.example.com database mdb suffix "dc=example,dc=com" rootdn "cn=manager,dc=example,dc=com" rootpw secret directory /var/lib/ldap2.4/example.com dbnosync maxsize 107374182400 conn_max_pending_auth 2000 index objectClass eq index uniqueMember eq index entryCSN,entryUUID eq monitoring on database config rootdn "cn=admin,cn=config" rootpw secret database monitor rootdn cn=monitor rootpw secret ---- slapd.conf ---- Thanks Marco

4 6

Q: TLS support
by Ulrich Windl 17 Jul '13

17 Jul '13

Hi! I have some questions on TLS support in OpenLDAP: 1) How can I find out which cipher suite had been configured (when using the distribution-supplied version)? From ldd I guess my slapd is using libopenssl0_9_8. 2) Is the restriction ("This directive is not supported when using GnuTLS.") on TLSCACertificatePath and GunTLS still effective? I'd like to use it, but I'm unsure what the cipher suite is. 3) Do the CA certificates for TLSCACertificateFile have to have a specific ordering? Regards, Ulrich

3 3

OpenLDAP syncrepl using SASL - GSSAPI
by Quentin PETEL 17 Jul '13

17 Jul '13

Hi! I'm trying to implement a Kerberos server using an OpenLdap backend on a server called *ldap1.vm* and replicate those on an other called *ldap2.vm*. My first server is working fine. Each kerberos principal is stored in his own ldap entry (with the krbPrincipalName attribut). For exemple : user1(a)EXEMPLE.COM --> uid=user1,ou=people,dc=exemple,dc=com ldap/ldap2.vm.exemple.com(a)EXEMPLE.COM --> cn=ldap2.vm,ou=ldap,dc=exemple,dc=com I wish to replicate either the cn=config DIT and the dc=exemple,dc=com DIT to my second server. So in my *cn=config* DIT on *ldap1.vm* I have the following configuration : ========================================================== dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/slapd/slapd.args olcAuthzRegexp: {0}uid=admin,cn=exemple.com,cn=gssapi,cn=auth cn=admin,dc=exemple,dc=com olcAuthzRegexp: {1}uid=ldap\/(.*).exemple.com,cn=exemple.com,cn=gssapi,cn=auth cn=$1,ou=ldap,dc=exemple,dc=com olcAuthzRegexp: {2}uid=host\/(.*).exemple.com,cn=exemple.com,cn=gssapi,cn=auth cn=$1,ou=hosts,dc=exemple,dc=com olcAuthzRegexp: {3}uid=(.*),cn=exemple.com,cn=gssapi,cn=auth uid=$1,ou=people,dc=exemple,dc=com olcSaslRealm: EXEMPLE.COM olcServerID: 1 ldap://ldap1.vm.exemple.com/ olcServerID: 2 ldap://ldap2.vm.exemple.com/ olcLogLevel: stats olcPidFile: /var/run/slapd/slapd.pid olcToolThreads: 1 dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib/ldap olcModuleLoad: {0}back_hdb olcModuleLoad: {1}syncprov dn: olcBackend={0}hdb,cn=config objectClass: olcBackendConfig olcBackend: {0}hdb dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth manage by * break olcAccess: {1}to dn.exact="" by * read olcAccess: {2}to dn.base="cn=Subschema" by * read olcSizeLimit: 500 dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth manage by * break olcRootDN: *cn=admin,cn=config* dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpCheckpoint: 100 10 olcSpSessionlog: 100 dn: olcDatabase={1}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=exemple,dc=com olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=exemple,dc=com" write by dn.one="ou=ldap,dc=exemple,dc=com" read by anonymous auth by * none olcAccess: {1}to dn.subtree="dc=exemple,dc=com" by dn="cn=adm-srv,ou=krb5,dc=exemple,dc=com" write by dn="cn=kdc-srv,ou=krb5,dc=exemple,dc=com" read by dn="cn=admin,dc=exemple,dc=com" write by dn.one="ou=ldap,dc=exemple,dc=com" read olcAccess: {2}to attrs=loginShell by self write by users read by * none olcAccess: {3}to dn.base="" by * read olcAccess: {4}to * by users read by * none olcAccess: {5}to dn="cn=config" by dn.one="ou=ldap,dc=exemple,dc=com" write olcLastMod: TRUE olcRootDN: cn=admin,dc=exemple,dc=com olcRootPW: {SSHA}7JR5Gh0ZUbw9U4cVytBrChBjXuPAdLKh olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq olcDbIndex: uid eq olcDbIndex: cn eq olcDbIndex: ou eq olcDbIndex: dc eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: memberUid eq olcDbIndex: uniqueMember eq olcDbIndex: krbPrincipalName eq,pres,sub olcDbIndex: krbPwdPolicyReference eq dn: olcOverlay={0}syncprov,olcDatabase={1}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpCheckpoint: 100 10 olcSpSessionlog: 100 ========================================================== And on the ldap2.vm i wanna replicate the cn=config DIT first: ========================================================== dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by * break olcRootDN: cn=admin,cn=config olcSyncrepl: {0}rid=001 provider="ldap://ldap1.vm.exemple.com/" type=refreshAndPersist retry="10 30 30 +" searchbase="cn=config" bindmethod=sasl saslmech=gssapi ========================================================== There is no olcMirrorMode attributes because I wanna add other provider directives later. Every 10 secondes, i see those logs: ========================================================== conn=1001 fd=13 ACCEPT from IP=192.168.x.x:57695 (IP=0.0.0.0:389) conn=1001 op=0 BIND dn="" method=163 conn=1001 op=0 RESULT tag=97 err=14 text=SASL(0): successful result: conn=1001 op=1 BIND dn="" method=163 conn=1001 op=1 RESULT tag=97 err=14 text=SASL(0): successful result: conn=1001 op=2 BIND dn="" method=163 conn=1001 op=2 BIND authcid="ldap/ldap2.vm.exemple.com(a)EXEMPLE.COM" authzid="ldap/ldap2.vm.exemple.com(a)EXEMPLE.COM" conn=1001 op=2 BIND dn="cn=ldap2.vm,ou=ldap,dc=exemple,dc=com" mech=GSSAPI sasl_ssf=56 ssf=56 conn=1001 op=2 RESULT tag=97 err=0 text= conn=1001 op=3 SRCH base="cn=config" scope=2 deref=0 filter="(objectClass=*)" conn=1001 op=3 SRCH attr=* + findbase failed! 32 conn=1001 op=3 SEARCH RESULT tag=101 err=32 nentries=0 text= conn=1001 op=4 UNBIND conn=1001 fd=13 closed ========================================================== We see that the olcAuthzRegexp do is job, indeed, the authcid="ldap/ldap2.vm.exemple.com(a)EXEMPLE.COM" from the ticket (I use Kstart to obtain it) become dn="cn=ldap2.vm,ou=ldap,dc=exemple,dc=com". But it fail to find the cn=config DIT. Here is the entry on my ldap database: ========================================================== dn: cn=ldap2.vm,ou=ldap,dc=exemple,dc=com objectClass: ipHost objectClass: device objectClass: top objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux cn: ldap2.vm ipHostNumber: 192.168.x.x structuralObjectClass: device entryUUID: afe9a32a-81a3-1032-85b7-7976b72b0c24 creatorsName: cn=admin,dc=exemple,dc=com createTimestamp: 20130715140754Z krbPrincipalName: ldap/ldap2.vm.exemple.com(a)EXEMPLE.COM krbLoginFailedCount: 0 krbPrincipalKey:: [...] krbPasswordExpiration: 19700101000000Z krbLastPwdChange: 20130715140838Z krbExtraData:: AAJmAuRRYWRtaW5ASU5URVJORS5PQlNFUlZBVE9JUkVERVNNQVJRVUVTLkZSAA= = krbExtraData:: AAgBAA== authzTo: {0}dn.regex:*cn=admin,cn=config* entryCSN: 20130716154135.008692Z#000000#001#000000 modifiersName: cn=admin,dc=exemple,dc=com modifyTimestamp: 20130716154135Z ========================================================== The authzTo directive allow, i think, this entry to act as cn=admin,cn=config and to see the cn=config DIT, am I wrong? How can I do what I want? This configuration works well when I try to synchronise the dc=exemple,dc=com DIT. Regards, Quentin

1 1

Problems with ACLs
by Leonardo Bacha Abrantes 16 Jul '13

16 Jul '13

Hi guys, I configured ACL (below) and am trying to log on the console with a ldap's user I receive the error "ldap_search_s No such object' on /var/log/secure. If I comment acls the user is able to logon. Here my configuration: ==>> olcDatabase={2}bdb.ldif olcRootDN: cn=Manager,dc=foo,dc=local olcRootPW: {MD5}xxxxxxxxxxxxxxxxx olcAccess: to attrs=userPassword by self write olcAccess: to attrs=cn,sn,displayName,mail,description by users read olcaccess: to * by self read I used slapacl to check the permissions and appeared ok. What I'm doing worng ? Can you help me please ?

2 2

Q: Multi-Master setup
by Ulrich Windl 16 Jul '13

16 Jul '13

Hi! I have a few questions for multi-master mode: 1) olcServerID (two arguments): if a node's salpd binds to some interface alias address, do I need an olcServerID for that interface alias, do I need an olcServerID for the physical host, or do I need both? 2) What is the correct syntax for the second argument (URI): Do you need a final slash, do you need the port? Currently I'm using a syntax like "olcServerID: 1 ldap://ldap.domain.org" 3) For the syncrepl privider, how is the syntax of the provider URI: With trailing slash, or with port, or with none of those? Currently I'm using a syntax like "olcServerID: 1 ldap://ldap.domain.org/" 4) Do I need olcUpdateRef? If so, for every server in the multi-master group? My guess is that without olcUpdateRef each server will accept local changes and sync those out. 5) How does "mirrormode=on" affect a multi-master setup? I'm dealing with a configuration tool (SLES11 SP2 YaST) tha tseems to have trouble with some configuration settings, so I wonder how the correct configuration will look like. 6) On "split brain": If one server is separated from the rest, and that server receives updates, and the rest receives updates also: The latest update of an entry will overwrite older entries once the servers join again, right? Once delta-syncrepl will work for multi-master, will the latest attribute change (as opposed to the latest entry change) be propagated to the rest? I read the documentation, but could not find answers to all of the questions above. Maybe someone can help. Regards, Ulrich

1 0

Regarding Queries for Ldap authentication
by Ashutosh Tiwari 16 Jul '13

16 Jul '13

Hello, I am calling ldap_init and ldap_bind_s from our code in which while calling the ldap_init, we are passing the multiple host in it, so I want to know what is the retry count for connection to a down server and time to wait for a connection etc. Is these parameters are configured ? where I can look into details for it. Thanks & Regards, Ashutosh Tiwari

1 0

Q: "stable" slapcat / slapadd?
by Ulrich Windl 12 Jul '13

12 Jul '13

Hi! I used to dump the OpenLDAP databases using slapcat (as suggested for backup). As an optimization I avoid storing identical databases. However I had seen changes that actually were not made, so my question: Is slapcat expected to be stable, i.e. report entries and attributes in a specific ordering? Is slapadd expected to be stable, i.e. add entries and attributes the same way when they come from the same LDIF file? I had just removed the entryCSN on cn=config, and I see differences after removing and rebuilding the config database that were not made in the LDIF file: --- /tmp/1 2013-07-12 14:49:35.000000000 +0200 +++ /tmp/2 2013-07-12 14:49:35.000000000 +0200 @@ -4,6 +4,10 @@ olcArgsFile: /var/run/slapd/slapd.args olcAuthzRegexp: {0}gidNumber=0\+uidNumber=0,cn=peercred,cn=external,cn=auth dn :cn=config +olcLogLevel: config +olcLogLevel: stats +olcLogLevel: sync +olcLogLevel: none olcPidFile: /var/run/slapd/slapd.pid olcServerID: 1 ldap://rksapds1.site olcServerID: 2 ldap://rksapds2.site @@ -19,10 +23,6 @@ entryUUID: db3f4d44-7c0e-1032-81c4-d54356bd918f creatorsName: cn=config createTimestamp: 20130708113956Z -olcLogLevel: config -olcLogLevel: stats -olcLogLevel: sync -olcLogLevel: none entryCSN: 20130712095650.995134Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20130712095650Z @@ -2152,12 +2152,12 @@ dn: olcDatabase={2}monitor,cn=config objectClass: olcDatabaseConfig olcDatabase: {2}monitor +olcAccess: {0}to dn.subtree="cn=monitor" by dn.base="cn=Admin,dc=censored + ,dc=uni-regensburg,dc=de" write by users read by * none structuralObjectClass: olcDatabaseConfig entryUUID: 20f4a254-7f1a-1032-9c35-67ae7acd0417 creatorsName: cn=config createTimestamp: 20130712083810Z -olcAccess: {0}to dn.subtree="cn=monitor" by dn.base="cn=Admin,dc=censored - ,dc=uni-regensburg,dc=de" write by users read by * none entryCSN: 20130712085712.643156Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20130712085712Z Regards, Ulrich

3 2

How to make a temporary password expire?
by jeevan kc 12 Jul '13

12 Jul '13

With the Openldap password policy I was able to lock the account after a certain number of failed login attempts. When I reset the password, the user can login whenever. What I want to ask is, is there a way to make the password expire if the user doesn't login within lets say 24 hours after the password has been reset? Thank you! Jeevan

3 3

Re: ldap syncrepl issue.
by Ashok Kumar Shah 12 Jul '13

12 Jul '13

Is there a way reliable determine whether ldap slave is sync with master? Currently i am using ContextCSN diff between master and slave to determine the lag. Thanks in advance. Ashok On Fri, Jul 12, 2013 at 9:26 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Friday, July 12, 2013 5:40 PM +0530 Ashok <ashok.shah(a)flipkart.com> > wrote: > > >> >> >> >> >> Hi, >> >> I am running ldap master and multiple slave with RefreshandPersist config. >> ldap search for an user shows different set of records. ContextCSN on >> master and slave are exactly same. >> What can i do to fix this. I tried restarting slave ldap but didn't help. >> Also i keep getting do_syncrepl: rid=112 rc 68 retrying every minute. I >> doubt if there is replication issue. >> > > It sounds like it is resyncing the DB, and skipping entries that already > exist: LDAP_ALREADY_EXISTS is error code 68. > > > --Quanah > > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 2

OTP
by Vishesh kumar 12 Jul '13

12 Jul '13

Do anyone point me right direction for setting up OTP authentication in openldap. Reference to URL or guide will be sufficient. -- Thanks & Regards Vishesh Kumar http://linuxmantra.com

3 3

Re: Antw: Re: olcSizeLimit become ignored somehow
by Quanah Gibson-Mount 12 Jul '13

12 Jul '13

--On Friday, July 12, 2013 8:06 AM +0200 Ulrich Windl <Ulrich.Windl(a)rz.uni-regensburg.de> wrote: >>>> Quanah Gibson-Mount <quanah(a)zimbra.com> schrieb am 11.07.2013 um 20:56 >>>> in > Nachricht <3CC7F3DA0AFBA8ED75D07A48(a)[192.168.1.28]>: >> --On Thursday, July 11, 2013 9:36 PM +0300 Покотиленко >> Костик <casper(a)meteor.dp.ua> wrote: >> >>> Hi, >>> >>> We have 1 master + 2 slaves setup (2.4.28, Ubuntu). >> >> Why are you running such an ancient version of OpenLDAP? Get a current >> release and then see if you have issues. > > For your records: SLES11 SP2 currently has 2.4.26, and SLES10 SP4 has > 2.3.32. Both are still "supported" by the vendor. > Basically those versions seem to work also ;-) What does this have to do with anything? Using distribution provided OpenLDAP builds is generally an extremely bad idea. Please keep replies to the list as well. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

ldap syncrepl issue.
by Ashok 12 Jul '13

12 Jul '13

Hi, I am running ldap master and multiple slave with RefreshandPersist config. ldap search for an user shows different set of records. ContextCSN on master and slave are exactly same. What can i do to fix this. I tried restarting slave ldap but didn't help. Also i keep getting do_syncrepl: rid=112 rc 68 retrying every minute. I doubt if there is replication issue. Thanks, Ashok

2 1

olcSizeLimit become ignored somehow
by Покотиленко Костик 12 Jul '13

12 Jul '13

Hi, We have 1 master + 2 slaves setup (2.4.28, Ubuntu). We had an issue with only 500 search entries returned due to the default limit. I've added olcSizeLimit 100000 parameter to cn=config on all 3 servers and checked that all 3 servers return 500+ entries Ok. In a week or so the problem returned. I've checked - the setting existed on all 3 servers, but only one of them returned 500+, the rest 2 returned only 500 with 4 size limit exceeded. Solution was to change olcSizeLimit to some different value and then back. So, the question is how could slapd "forget" about the olcSizeLimit until it's changed? Known bug? Also, docs state that olcSizeLimit=0 is no limit, in fact it's literal 0. I've seen posts about that in the past, but it seems to still exist.

2 3

Q: Managing entryCSN with slapadd
by Ulrich Windl 12 Jul '13

12 Jul '13

Hi! I have a question: Is there a way to fix entryCSNs for slapadd? Reasoning: With dynamic configuration, sometimes (if you messed up) you'll have to edit your slapcat dump to reinitialize the config database. Unfortunately with replication the entry CSNs seem to casue trouble: If you don't change the CSN, the canges are not replicated, it seems; if you change the CSN, OpenLDAP doesn't seem to like it. I see repeating message slike these: slapd[3017]: Entry olcDatabase={0}config,cn=config CSN 20130709140112.108165Z#000000#000#000000 older or equal to ctx 20130709140112.108165Z#000000#000#000000 slapd[3017]: do_syncrep2: rid=001 CSN too old, ignoring 20130712085712.643156Z#000000#000#000000 (olcDatabase={2}monitor,cn=config) Ist there a way to fix this? Regards, Ulrich Windl

2 1

mdb grows to olcDbMaxsize if searched before syncrepl completes.
by Jancewicz, Russell 11 Jul '13

11 Jul '13

I am experiencing strange behavior when running an mdb database, as compared to the same system configured with hdb. If I conduct any queries while the server is receiving its initial data the server via syncrepl it stops receiving new entries and the data.mdb file balloons to the olcDbMaxsize value. I have tried adjusting configuration settings but regardless this continues to occur is this to be expected with mdb? It should be noted that if I wait for the entire database to replicate I can query the database fine and the size of data.mdb does not change. Furthermore if new changes are propagated down to the replica the issue does not arise. Any help would be appreciated. Please find below configuration ldifs and version information. -Russell J. Jancewicz University of Connecticut Version: @(#) $OpenLDAP: slapd 2.4.35 (Jun 17 2013 12:21:32) $ My olcDatabaseConfig: # {1}mdb, config dn: olcDatabase={1}mdb,cn=config changetype: add objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: mdb olcDbDirectory: /srv/ldap/example.com olcSuffix: dc=example,dc=com olcRootDN: dc=example,dc=com olcRootPW: secret olcDbMaxsize: 4294967296 olcDbNoSync: FALSE olcReadOnly: TRUE olcDbCheckpoint: 512 30 olcDbIndex: default pres,eq olcAccess: to * by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * break olcAccess: to * by * none olcSyncrepl: rid=101 provider=ldap://replica0.ldap.example.com starttls=critical bindmethod=simple binddn="dc=example,dc=com" credentials=secret searchbase="dc=example,dc=com" type=refreshAndPersist retry="5 5 300 +" olcSyncrepl: rid=102 provider=ldap://replica1.ldap.example.com starttls=critical bindmethod=simple binddn="dc=example,dc=com" credentials=secret searchbase="dc=example,dc=com" type=refreshAndPersist retry="5 5 300 +" # {1}memberof, {1}hdb, config dn: olcOverlay={0}memberof,olcDatabase={1}mdb,cn=config objectClass: top objectClass: olcOverlayConfig objectClass: olcMemberOf olcOverlay: {0}memberof

1 0

caseIgnoreMatch for Country String
by Maucci, Cyrille 11 Jul '13

11 Jul '13

Hello gurus, When I have this piece of schema included in my slapd.conf file... attributetype ( 1.3.6.1.4.1.11.11.1.1.1.1.402 NAME ( 'TestCountryString' 'TestCountryStringSyn' ) DESC 'Test Country String' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.11 SINGLE-VALUE ) ... my 2.4.32 slapd -Tt complains with this error: line 8 attributetype: AttributeType inappropriate matching rule: "caseIgnoreMatch". My understanding of http://tools.ietf.org/html/rfc4517 is that caseIgnoreMatch is valid for country string: "The caseIgnoreMatch rule compares an assertion value of the Directory String syntax to an attribute value of a syntax (e.g., the Directory String, Printable String, Country String, or Telephone Number syntax) whose corresponding ASN.1 type is DirectoryString or one of its alternative string types. " Could you confirm whether this is a bug in openldap or simply a misunderstanding from me ? Thanks in advance ++Cyrille

2 1

RE: configuring monitor database in SLES11 SP2
by Dieter Klünter 11 Jul '13

11 Jul '13

Hi, Am Wed, 10 Jul 2013 16:09:17 +0200 schrieb "Ulrich Windl" <Ulrich.Windl(a)rz.uni-regensburg.de>: > Hi! > > I wonder how to configure the monitor database with dynamic > configuration in general ,and then specifically for SLES11 SP2 > (possibly slapd isn't configured for that, but I'm not sure). The > docs still describe the slapd.conf-way... first check if back-monitor is statically build in /usr/lib/openldap/slapd -VVV if so, slapadd dn -- Dieter Klünter | Systemberatung http://dkluenter.de GPG Key ID:DA147B05 53°37'09,95"N 10°08'02,42"E -- Dieter Klünter | Systemberatung http://dkluenter.de GPG Key ID:DA147B05 53°37'09,95"N 10°08'02,42"E

2 1

High load times with mdb
by Bill MacAllister 11 Jul '13

11 Jul '13

With the release of Debian 7 (wheezy) I was rebuilding a couple test systems and was surprised to find that the load times I am seeing for populating the mdb database with slapd have gone up dramatically. The load for a master server that was taking about 10 minutes just took 35 minutes. The slave is worse. A normal load time is 20 minutes and it is at 31 minutes now with an eta of about 2.5 hours. These systems are using OpenLDAP 2.4.35. Here are some relevent bits from the configuration. dn: cn=config olcToolThreads: 2 dn: olcDatabase={2}mdb,cn=config olcDbCheckpoint: 1024 5 olcDbEnvFlags: writemap olcDbEnvFlags: nometasync olcDbNoSync: FALSE olcDbMaxSize: 85899345920 The systems are Dell r610s with 16 gbyte of memory. Our database is currently 3.2G on the master server. I have been loading wheezy/2.4.35 databases for weeks now in preparation upgrading the OS and installing the new version of OpenLDAP on our production servers. This is the first time I have seen this. I fiddled with the hardware enough to the point I don't think it is a hardware problem. There is not really much tuning to do with mdb and I would appreciate some suggestions for what to look at next. Bill -- Bill MacAllister Infrastructure Delivery Group, Stanford University

3 5

"No such object" error with translucent overlay and base scope search
by Steve Eckmann 10 Jul '13

10 Jul '13

We found that we get a "No such object" error from the translucent overlay when we do a search like this: ldapsearch -x -H ldaps://localhost -LLL \ -b "cn=John Doe,ou=Users,dc=example,dc=com" -s base \ -D "cn=admin,dc=example,dc=com" -w admin \ '(&)' if there is no entry for "cn=John Doe,ou=Users,dc=example,dc=com" in the local database, whether or not the remote entry exists. It seems like a mistake for the translucent overlay to report an error if the remote entry exists, since it only means that we haven't added any local attributes yet. Is there a way to suppress the error result when the proxied server returns an entry, so we don't have to hack around this weirdness in our client? Thanks. Steve

2 2

RE: unable top add ppolicy_overlay.ldif
by Sotomayor, Vicente (ITD) 10 Jul '13

10 Jul '13

I had a similar error using RH 6 and so I used pwdAttribute: 2.5.4.35 instead of pwdAttribute: userPassword

3 2

configuring monitor database in SLES11 SP2
by Ulrich Windl 10 Jul '13

10 Jul '13

Hi! I wonder how to configure the monitor database with dynamic configuration in general ,and then specifically for SLES11 SP2 (possibly slapd isn't configured for that, but I'm not sure). The docs still describe the slapd.conf-way... Regards, Ulrich

1 0

Need Help on ACL
by pradyumna dash 10 Jul '13

10 Jul '13

Hi, Need a help related to ACL. I need to setup some basic ACL for LDAP, I need Manager only should have access to the entire tree both read and write and only users under ou=operation can have a read only access to the tree. Currently i dont have any ACL in the slapd.conf file. Would be great if you can share the ACL. Please help. Regards, /Pradyumna

2 1

unable top add ppolicy_overlay.ldif
by Michael Roth 09 Jul '13

09 Jul '13

I'm using Ubuntu 12.04 server running OpenLDAP-2.4.28. I'm following this tutorial HERE<http://raerek.blogspot.com/2012/09/openldap-password-policy-on-ubuntu-1204.…> When I get to the step to add the ppolicy_overlay.ldif I get this error: ldapadd -x -D "cn=admin,cn=config" -w secret -f ppolicy_overlay.ldif adding new entry "olcOverlay={1}ppolicy,olcDatabase={1}hdb,cn=config" ldap_add: Other (e.g., implementation specific) error (80) additional info: User Schema load failed for attribute "pwdAttribute". Error code 17: attribute type undefined What could the issue be? future thanks!

1 0

Mirror mode replication breaks at times.
by Pradyumna 09 Jul '13

09 Jul '13

Hi, I have configured mirror mode replication. It's 2 node. Everything works fine but if I don't work on the server or say 30/40 mins or so and then when I try to add or delete any users or groups it don't get replicated to the other node. Am not getting any error in the logs and if I restart the slapd service it's syncs again and giving expected results. The same setup I have in the test environment and its works like a charm the only difference in this setup is that the 2 servers are hosted on 2 different DC geographically separated where as in test they are in same DC. Am using the openldap version which comes by default with RHEL 6.3. If it would have been a version issue then I should have expected the same result in test as well? Please help. Regards, /Pradyumna Sent from my iPhone

4 3

"Fan-Out" replication
by espeake＠oreillyauto.com 08 Jul '13

08 Jul '13

Oracle talks about doing a "fan-out" replication that fits what we are looking at doing. What we want to do is once a day or once a week is to replicate our production LDAP from our master to a master LDAP server at our DR site. That server would then push changes to the consumer LDAP servers at our DR site. We are trying to keep the sites basically mirrored but I do not want changes made at the DR site to replicate back to the production master. Master LDAP /\ / \ / \ / \ / \ DR Master LDAP \ / \ / \ / \ / Production Consumers / / DR Consumers I hope that helps to visualize what we are trying to do. Thank you, Eric Speake Web Systems Administrator O'Reilly Auto Parts This communication and any attachments are confidential, protected by Communications Privacy Act 18 USCS � 2510, solely for the use of the intended recipient, and may contain legally privileged material. If you are not the intended recipient, please return or destroy it immediately. Thank you.

1 0

What should I use as hostname for php to connect to openLDAP?
by Jason Huang 08 Jul '13

08 Jul '13

Hello - I am a newbie to openLDAP and wants to get some help here. I've deployed apache on a EC2 server, obtain an elastic IP from amazon and point xyz.com to this IP. I've installed a service provider(simplesamlphp) with hostname sp.xyz.com, pointing to this same IP. I've also installed an identity provider (simplesamlphp) with hostname idp.xyz.com, pointing to this same IP. Now I am installing openLDAP on this same server. What hostname should I use for php to connect to this ldap server? Should I use "xyz.com" or " sp.xyz.com" or "idp.xyz.com", or something else like "ldap.xyz.com"? If I am using "ldap.xyz.com", where should I specify this hostname? thanks!

2 1

slapd[16890]: main: TLS init def ctx failed: -1
by Ulrich Windl 08 Jul '13

08 Jul '13

Hi! I found out that "slapd[16890]: main: TLS init def ctx failed: -1" is due to [pid 16890] open("/etc/ssl/private/slapd.key", O_RDONLY) = -1 EACCES (Permission denied) and I wonder whether it isn't possible pro privide a better error message like "slapd[16890]: main: TLS init failed to read /etc/ssl/private/slapd.key: Permission denied" Regards, Ulrich

1 0

Re: High load times with mdb
by Bill MacAllister 08 Jul '13

08 Jul '13

--On Tuesday, June 25, 2013 12:58:54 PM -0700 Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, June 25, 2013 12:38 PM -0700 Bill MacAllister <whm(a)stanford.edu> wrote: > >> The load starts out at a rate of about 2 M/s. In the past I remember >> that dropping to something like 900 k/s and staying there. Now the >> load starts in the same place, but after 30 seconds it alternates >> between stalling out right, and a rate under 100 k/s. Dips as low as >> under 10 k/s and sometimes as high at 700 k/s. (My undergraduate >> degree was in watching water boil.) > > What is the partition type? ext4? > > What options are set for the partition in fstab? This is what I am currently using. The UUID are obviously shortened for readability. UUID=blah1 / ext4 defaults,acl,noatime,errors=remount-ro 0 1 UUID=blah2 /var/cache/openafs ext4 defaults,noatime 0 2 UUID=blah3 /var/lib/ldap ext4 defaults,noatime 0 2 UUID=blah4 none swap sw 0 0 I also tried ext3 with the same results. This is on a raid-1. I have also tried splitting the two disks and putting the OS on one and the LDAP database on the other. None of this moved the problem. It really has the feel of a resource exhaustion. The load is now stalled in that the progress display is not updating. top does not show slapd as doing anything. Bill -- Bill MacAllister Infrastructure Delivery Group, Stanford University

2 6

proxying read/write request to secounday ldap server
by val john 08 Jul '13

08 Jul '13

Hi.. guys We have primary ldap called ,ldap.example.com , In that server we have following structure ou=users,ou=ldap,ou=example,ou=com ou=applications,ou=ldap,ou=example,ou=com basically we need redirect any read/write request that coming to the server ldap.example.com 's *"ou=applications,ou=ldap,ou=example,ou=com*" to our second ldap server called ldap2.example.com , and also all the Read/Write request that comes to * ou=users,ou=ldap,ou=example,ou=com* OU should be served from our primary ldap server , is there any way to achieve that , Please advice Thank You John

1 0

slapd on an interface alias
by Ulrich Windl 06 Jul '13

06 Jul '13

Hi! I had sent a request for documentation to the ITS, because I feel that something is wrong with OpenLDAP 2.4.26 (as shipped with SLES11 SP2), but I was redirected: I wrote: > Full_Name: Ulrich Windl > Version: 2.4.26 > OS: Linux (SLES11 SP2) [...] > > > I was able to set up a master LDAP server and a replication consumer using the > physical host names and TLS. However when I tried to bind slapd on a virtual IP > address ("interface alias"), I never got slapd working (even though I fixed the > certificates for TLS, of course). Dynamic configuration ("cn=config") seems to > make things very difficult, because slapd ends in a state where _nobody_ can > make configuration changes. Use the openldap-technical mailing list to ask for configuration help. You talk about IP addresses and yet in your quoted text below you are using hostnames. Be consistent when you post your question to the mailing list otherwise no one will understand what you're asking for. --> Obviously slapd listens to ports, not to names, and names were invented so that people don't have to remember IP addresses, but you know. --> Only with X.509 certificates the relation between names and adresses are of some inportance, but you can believe me that I understand that. Closing this ITS. > It seems slapd tried to use the wrong URI (using the physical host where nobody > is listening): > slapd[10036]: slap_client_connect: URI=ldap://phost.domain.org/ Error, > ldap_start_tls failed (-1) > slapd[10036]: do_syncrepl: rid=002 rc -1 retrying > > slapd is listening on ldap://vhost.domain.org/ however. --> You should believe me if I say so. > > I read lots of procedures using Google, but could not find the solution for this > problem. Thus I suggest to add documentation how to configure such a scenario: > > 1) Set up an LDAP Master server that provides service on a specific IP address > using TLS > 2) Set up a replication consumer that provides service on a specific IP address > using TLS also > 3) The replication consumer should use the address where the master server > listens for replication > > It sounds like an every-day setup, but I failed multiple times, thus the request > for documentation. > Still waiting for a procedure. Something seems to be non-obvious or broken. Some details (randomly picked, with some names obfuscated): (master server) olcSyncrepl: {0}rid=2 provider="ldap://v07.domain.org/" searchbase="dc=domain,dc=org" type="refreshAndPersist" retry="120 +" starttls=critical tls_reqcert=demand bindmethod="simple" binddn="uid=syncrepl,ou=system,dc=domain,dc=org" credent ials="wNkWudLd3ko8" The process is started as "/usr/lib/openldap/slapd -h ldap://ds1.domain.org:389 ldaps://ds1.domain.org:636 ldapi:/// -F /etc/openldap/slapd.d -u ldap -g ldap -o slp=off" And syslog message sI'm seeing over and over are like this: Jul 5 08:23:16 v07 slapd[25914]: slap_client_connect: URI=ldap://v07.domain.org/ Error, ldap_start_tls failed (-1) Jul 5 08:23:16 v07 slapd[25914]: do_syncrepl: rid=002 rc -1 retrying Obviously a connection to the "v07" address is not possible, because the server listens to the "ds1" address. The interface settings look like this: eth0 Link encap:Ethernet HWaddr 00:16:3E:5C:DD:76 inet addr:172.20.16.38 Bcast:172.20.17.255 Mask:255.255.254.0 inet6 addr: fe80::216:3eff:fe5c:4d76/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:6334378 errors:0 dropped:6 overruns:0 frame:0 TX packets:237667 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:421369553 (401.8 Mb) TX bytes:49452419 (47.1 Mb) eth0:ds1 Link encap:Ethernet HWaddr 00:16:3E:5C:DD:76 inet addr:172.20.17.200 Bcast:172.20.17.255 Mask:255.255.254.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 Basically I think I have to fix the "olcSyncrepl provider" and possibly the "olcServerID", but with dynamic configuration I cannot do it: Using ldapmodify I get: v07:~ # ldapmodify -v -ZZ -x -W -D cn=config -H ldap://ds1.domain.org -f /tmp/fix1.ldif ldap_initialize( ldap://ds1.domain.org:389/??base ) Enter LDAP Password: replace olcServerID: 1 ldap://ds1.domain.org modifying entry "cn=config" ldap_modify: Server is unwilling to perform (53) additional info: shadow context; no update referral When editing the files in the slap.d directory, I get: Jul 5 09:11:25 v07 slapd[15014]: @(#) $OpenLDAP: slapd 2.4.26 (Sep 26 2012 13:21:45) $ abuild@e71:/usr/src/packages/BUILD/openldap-2.4.26/servers/slapd Jul 5 09:11:25 v07 slapd[15014]: ldif_read_file: checksum error on "/etc/openldap/slapd.d/cn=config/olcDatabase={0}config.ldif" Jul 5 09:11:25 v07 slapd[15014]: ldif_read_file: checksum error on "/etc/openldap/slapd.d/cn=config/olcDatabase={1}hdb.ldif" Jul 5 09:11:25 v07 slapd[15015]: hdb_monitor_db_open: monitoring disabled; configure monitor database to enable Jul 5 09:11:25 v07 slapd[15015]: slapd starting Jul 5 09:11:25 v07 slapd[15015]: slap_client_connect: URI=ldap://ds1.domain.org/ DN="uid=syncrepl,ou=system,dc=domain,dc=org" ldap_sasl_bind_s failed (49) Jul 5 09:11:25 v07 slapd[15015]: do_syncrepl: rid=002 rc 49 retrying Jul 5 09:11:25 v07 slapd[15015]: slap_client_connect: URI=ldap://ds1.domain.org/ DN="uid=syncrepl,ou=system,dc=domain,dc=org" ldap_sasl_bind_s failed (49) Jul 5 09:11:25 v07 slapd[15015]: do_syncrepl: rid=001 rc 49 retrying Jul 5 09:12:37 v07 nscd: nss-ldap: do_open: do_start_tls failed:stat=-1 (So obviously the syncrepl provider has changed, but it still won't work) Regards, Ulrich

3 2

4th LDAP International Conference announced
by Clément OUDOT 03 Jul '13

03 Jul '13

Hi, The 4th LDAP international conference LDAPCON 2013 will be held in Paris, France on November 18th & 19th. You can find all the details on http://ldapcon.org/ The call for paper is now open and you have until September 8th to submit your proposals. Please check http://ldapcon.org/#cfp for details. LDAPCON is also looking for sponsors. If you or your company is interested, please check http://ldapcon.org/ldapcon_2013_sponsoring.pdf. Hope I can meet some of you at this event! Best regards, Clément.

1 0

err=32 (No such object) with translucent overlay and base scope search
by Steve Eckmann 03 Jul '13

03 Jul '13

Is it expected that the translucent overlay returns a proxied entry but also a "No such object" error when a remote entry exists but the matching local entry does not exist? For example, if there is no local entry for user "John Doe", then the search: ldapsearch -x -H ldaps://localhost -LLL \ -b "cn=John Doe,ou=Users,dc=example,DC=com" -s base \ -D "cn=admin,dc=example,dc=com" -w admin \ '(&)' cn mail manager returns: dn: cn=John Doe,ou=Users,dc=example,DC=com cn: John Doe mail: john.doe(a)example.com manager: cn=Jane Smith,ou=Users,dc=example,DC=com No such object (32) In the slapd log I see: conn=1000 op=9 SEARCH RESULT tag=101 err=32 nentries=1 text= For comparison, the search: ldapsearch -x -H ldaps://localhost -LLL -b dc=example,DC=com \ -s sub \ -D "cn=admin,dc=example,dc=com" -w admin \ '(cn=John Doe)' cn mail manager returns the same entry and attributes but no error. Should the client use the one entry and ignore the error, or is there some way to ask the translucent overlay to not return that error, or how should we handle this? Thanks. Steve

1 0

Increasing olcSockbufMaxIncomingAuth
by Chris Card 03 Jul '13

03 Jul '13

Hi, I'm running openldap 2.4.31 on centos 6.3. I am seeing an issue where a very large group (> 270000 members) is being added to my directory and it is failing with the connection to slapd being closed. I have tracked this down to this error: ber_get_next: sockbuf_max_incoming exceeded (19634099> 16777215) and I can see that the olcSockbufMaxIncomingAuth value is set by default to 2^24 - 1 = 16777215. I've tried increasing this value to 2^25 - 1 = 33554431 in cn=config and the request works fine. Are there any problems associated with increasing olcSockbufMaxIncomingAuth? Chris

1 0

restrict anonymous read access to posixAccount
by Ingo 03 Jul '13

03 Jul '13

Hello list, I'm just learning about access control. I want to setup my clients to manage its posixAccounts and posixGroups over the ldap Directory. With the default access rights it's working. Clients are looking anonymous at the directory for the group, e.g. at boot time or on user login. Syslog shows me: ~$ sudo egrep "slapd\[.*\]: conn=1186" /var/log/syslog slapd[2340]: conn=1186 fd=13 ACCEPT from IP=192.168.1.64:35566 (IP=0.0.0.0:389) slapd[2340]: conn=1186 op=0 BIND dn="" method=128 slapd[2340]: conn=1186 op=0 RESULT tag=97 err=0 text= slapd[2340]: conn=1186 op=1 SRCH base="dc=hoeft-online,dc=de" scope=2 deref=0 filter="(&(objectClass=posixGroup)(gidNumber=1002))" slapd[2340]: conn=1186 op=1 SRCH attr=cn userPassword memberUid uniqueMember gidNumber slapd[2340]: conn=1186 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= slapd[2340]: conn=1186 fd=13 closed (connection lost) ~$ slapd ACCEPT a connection from the client, BIND to anonymous with simple method (BIND dn="" method=128) and searches with filter="(&(objectClass=posixGroup)(gidNumber=1002))" with SEARCH RESULT success (err=0 nentries=1). testing it with: ~$ ldapsearch -xLLL "(&(objectClass=posixGroup)(gidNumber=1002))" dn: cn=gemeinsam,ou=groups,ou=home,dc=hoeft-online,dc=de cn: gemeinsam gidNumber: 1002 objectClass: top objectClass: posixGroup memberUid: ingo memberUid: uschi ~$ Now I try to restrict anonymous read only to posixGroup and posixAccount because I don't want anonymous reading other Entries. I modified the default access control to this: olcAccess: to filter= "(| (objectClass=posixAccount) (objectClass=posixGroup))" by anonymous read olcAccess: to * by self write by dn=<admin> write by * none now I get: ~$ ldapsearch -xLLL "(&(objectClass=posixGroup)(gidNumber=1002))" No such object (32) ~$ It works with: olcAccess: to filter="(objectClass=*)" by anonymous read or olcAccess: to filter="(objectClass=top)" by anonymous read What I'm misunderstanding here? And yes, I have read slapd.access three times but do not really understand everything til now. kind regards Ingo

1 1

Re: Mirror mode replication
by Philip Colmer 03 Jul '13

03 Jul '13

> Just curious, why would you do "mirror mode" MMR vs just plain MMR? Do you feel you have a specific > requirement that only one master ever receive the write traffic? No specific requirement but the documentation made various points that suggested "mirror mode" MMR would be easier to support ... For example, for plain MMR, the arguments against included: If connectivity with a provider is lost because of a network partition, then "automatic failover" can just compound the problem Typically, a particular machine cannot distinguish between losing contact with a peer because that peer crashed, or because the network link has failed If a network is partitioned and multiple clients start writing to each of the "masters" then reconciliation will be a pain; it may be best to simply deny writes to the clients that are partitioned from the single provider but the arguments against mirror mode were more semantics (e.g. "MirrorMode is not what is termed as a Multi-Master solution" and "MirrorMode can be termed as Active-Active Hot-Standby") rather than any real negatives. I'm essentially looking to have two LDAP servers and keep them in sync. LDAP consumers will be configured to query both and the web interfaces would be configured to talk to their "local" instance with DNS pointing at a preferred instance. For me, the biggest concern I have about implementing MMR - plain or mirror mode - is the challenge of recovering from a problem. Mirror mode seems to be simpler in that respect because only one node has the writes and therefore reconciliation should be straightforward. Philip On 2 July 2013 16:27, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, July 02, 2013 10:25 AM +0100 Philip Colmer < > philip.colmer(a)linaro.org> wrote: > > >> At the moment, we have a single LDAP server which we are using with LDAP >> Account Manager for web-based object management and Atlassian Crowd for >> authentication. The LDAP server is queried directly by other servers for >> UNIX-level authentication, i.e. SSH and group membership. >> >> >> I'm looking at introducing a second LDAP server and I'm leaning towards >> choosing mirror mode as the replication methodology. Since the only >> writes to LDAP come via LAM or Crowd, and these are both web-based, I >> think I could set up an almost identical server to the one I have at the >> moment and use a system like Amazon's Route 53 DNS service with health >> checks to allow me to redirect users off to the second server if the >> first server fails. >> > > Just curious, why would you do "mirror mode" MMR vs just plain MMR? Do > you feel you have a specific requirement that only one master ever receive > the write traffic? > > --Quanah > > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

Corrupted cn=config on multimaster configuration
by paolo penzo 02 Jul '13

02 Jul '13

Hi all, recently I've upgraded some OpenLDAP installations running MM replica from version 2.4.23 to version 2.4.34 (both compiled and packaged locally on RHEL6). At the beginning everything worked fine but then on a cluster I got a corrupted cn=config database after that some modifications were made. When this arose on all the nodes but one the cn=config database was missing of all the other database definitions. I've made a little investigation on this with no luck but I was able to reproduce this behaviour with a simple script which is attached whenever the replication is configured. In my tests both the nodes are configured with the monitor database but after the replica is activated, on the second one, this database is removed and the logs reports "be_delete olcDatabase={1}monitor,cn=config" Did I miss something? Regards, Paolo. ________________________________ Non stampare questa e-mail. Questo documento e' formato esclusivamente per il destinatario. Tutte le informazioni ivi contenute, compresi eventuali allegati, sono soggette a riservatezza a termini del vigente D.Lgs. 196/2003 in materia di privacy e quindi ne e' proibita l'utilizzazione. Se avete ricevuto per errore questo messaggio, Vi preghiamo cortesemente di contattare immediatamente il mittente e cancellare la e-mail. Grazie. Please don't print this e-mail. Confidentiality Notice - This e-mail message including any attachments is for the sole use of the intended recipient and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

1 0

Mirror mode replication
by Philip Colmer 02 Jul '13

02 Jul '13

At the moment, we have a single LDAP server which we are using with LDAP Account Manager for web-based object management and Atlassian Crowd for authentication. The LDAP server is queried directly by other servers for UNIX-level authentication, i.e. SSH and group membership. I'm looking at introducing a second LDAP server and I'm leaning towards choosing mirror mode as the replication methodology. Since the only writes to LDAP come via LAM or Crowd, and these are both web-based, I think I could set up an almost identical server to the one I have at the moment and use a system like Amazon's Route 53 DNS service with health checks to allow me to redirect users off to the second server if the first server fails. It occurs to me, though, that either LAM or Crowd could have failed, leaving the LDAP service itself quite healthy. In that situation, all of the writes would still be directed to one of the LDAP servers so is that a problem? The documentation says that "the two providers are set up to replicate from each other but an external frontend is employed to direct all writes to only one of the two servers. The second provider will only be used for writes if the first provider crashes, at which point the frontend will switch to directing all writes to the second provider. When a crashed provider is repaired and restarted it will automatically catch up to any changes on the running provider and resync." So the only requirement of mirror mode *seems* to be that all writes just go to one provider at a time, i.e. the replication model must be as close to single-master as possible, presumably because of consistency requirements? Or do I need to introduce yet another layer of "something" to direct the writes? The documentation suggests slapd in proxy model or a hardware load balancer, but would my scenario as described above meet the needs? Thanks. Philip

2 1

OpenLDAP multimaster
by 25Dollar Tech 02 Jul '13

02 Jul '13

Hello Team, I have a few concern about OpenLDAP multimaster restoration and migration. Scenario I have OpenLDAP multimaster configured on ubuntu 9.04 and OPenLDAP version is 2.4.15. i.e. NODE1 and NODE2 Unfortunatly NODE2 has crashed due to server hardware failure. and running my OpenLDAP infra for a while without multi-master server but I have multimaster confoguraiton on NODE1 which is working without any issues. Question 1) Is it possible to bind new OpenLDAP version and OS ubuntu 12.04 with existing OpenLDAP multimaster server; existing NODE1 server has config DB and HDB already configured and it contains more than 10000 entry. and NODE2 is already crashed. 2) If yes then what will be procedure to replicate config DB or how to equalize the database. -- *Thanks & Regards, 25dollarTech Team https://sites.google.com/site/25dollartech/* *Email: 25dollartechhelp(a)gmail.com*

2 1

pure_ftpd & LDAP
by maral 02 Jul '13

02 Jul '13

hey! I installed Pure-ftpd + Ldap and add a user in Ldap but Pure-ftpd don't recognize that user how can i fix this issue?

2 2

OpenLDAP Proxy using PKCS#11/SmartCard client authentication
by Stefan Scheidewig 01 Jul '13

01 Jul '13

Hello, we have two LDAP instances. LDAP A acts as proxy for LDAP B using the ldap-backend. Now we configured LDAP B to use client authentication. We successfully established a connection to LDAP B using OpenSSL s_client and the PKCS#11 engine (OpenSSL engine library). Now we want the LDAP proxy to establish the connection using this pkcs11 engine (we compiled the ldap proxy to use OpenSSL as TLS implementation). Is there a posibility to tell the LDAP proxy to use the certificate and key from the smartcard (e.g. something like pkcs11:slot_1-id_42) ? Thank you in advance, Stefan Scheidewig -- Mit freundlichen Grüßen, Stefan Scheidewig T-Systems Multimedia Solutions GmbH BU Content & Collaboration Solution PF 54 Integrated Content Portals Dipl.-Inf. Stefan Scheidewig Softwareentwickler Hausanschrift: Riesaer Str. 5, 01129 Dresden, Germany Postanschrift: Postfach 10 02 24, 01072 Dresden, Germany +49 351 2820 2924 (Tel) +49 351 2820 5118 (Fax) Stefan.Scheidewig(a)t-systems.com (E-Mail) Internet: http://www.t-systems-mms.com T-Systems Multimedia Solutions GmbH Aufsichtsrat: Klaus Werner (Vorsitzender) Geschäftsführung: Peter Klingenburg, Susanne Heger Handelsregister: Amtsgericht Dresden HRB 11433 Sitz der Gesellschaft Dresden Ust-IdNr.: DE 811 807 949

4 9

ACL - grant access to subtree by regex
by Ole 29 Jun '13

29 Jun '13

Hi, I'm really new to OpenLDAP and try to grant domain-admins access to their domain-subtree in our historicaly grown LDAP Structure. The Structure is like this: ou=somedomain.tld,ou=mail,dc=example,dc=tld ou=admins,ou=somedomain.tld,ou=mail,dc=example,dc=tld cn=admin(a)somedomain.tld,ou=admins,ou=somedomain.tld,ou=mail,dc=example,dc=tld The ACL I try to use (according to [1]) is: access to dn.regex=".+,ou=([^,]+),ou=mail,dc=example,dc=tld$" by dn.onelevel,expand="ou=admins,ou=$1,ou=mail,dc=example,dc=tld" write by * break but it doesn't take effect. After hours of thinking about the problem and searching in the internet I still can't get the poit. Thank you for reading, Ole [1] http://www.openldap.org/faq/data/cache/973.html

2 4

Types of Groups, Structural objects and Inheritance
by Brendan Kearney 29 Jun '13

29 Jun '13

list members, As a caveat to my ACLs, most of my groups are the posixGroup class. from what i understand, that means i need to use set ACLs, instead of group ACLs. this does not seem to be a big deal, and is covered in the admin guide. that being said, i am looking to find out what the functional differences between a posixGroup and groupOfNames are? are there significant reasons to use one over the other? in my environment, i have the ability to recreate all the posixGroup objects as groupOfNames objects, if it would help with the creation of ACLs and other work to be done. is that a worthwhile effort? In my searching, i have found an explicit reason to keep using the posixGroup type, as NFSv4 ACLs can only use posixGroup types of groups. the dependency is because of the use of memberUid attributes. would there be any other explicit reasons to use one group type over another? my users have inetOrgPerson as their structural class, and as such i cannot add the NFSv4RemotePerson class to their list of objectClass attributes. the NFSv4RemotePerson class is structural as well. i have heard about the ability to create a hierarchy of objectClass objects so that an object can inherit the properties of all the SUP classes. is there a way i can create this hierarchy to allow multiple structural class attributes to be inherited by user objects? i have not found much info around doing this. are there any pointers? thanks in advance, brendan

3 3

Openldap-2.4.35 TLS/SSl
by Darouichi, Aziz 29 Jun '13

29 Jun '13

Hi, I am trying to configure TLS/SSL and I have a Cert from Geotrust . I configure slapd.conf with the followings: # TLS/SSL information # TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCACertificateFile /opt/local/etc/openldap/GeoTrust_Global_CA.cer TLSCertificateFile /opt/local/etc/openldap/rhea.curry.edu.pem.cer TLSCertificateKeyFile /opt/local/etc/openldap/rhea.key.pem But when I check the cert using "openssl s_client -connect 192.168.60.43:636 -CApath /opt/local/etc/openldap/" I get CONNECTED(00000003) 140230373582504:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:177: --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 0 bytes and written 321 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE I checked the log I see TLS connection

3 2

LB health check during syncrepl refresh
by Michael Ströder 28 Jun '13

28 Jun '13

HI! Inspired by ITS#7616 and looking at our monitoring: If I bring up a syncrepl consumer with empty DB it seems contextCSN attribute is missing in DB base entry during refresh phase. This is nice because we could use that in the load-balancer health check to prevent clients to connect to this replica until all data is loaded into the consumer and contextCSN is present. So is it guaranteed that contextCSN is missing during lengthy refresh phase? Ciao, Michael.

2 1

Unable to edit cn=config
by Michael Roth 28 Jun '13

28 Jun '13

Hello openldap masters, I have a big issue and I'm praying someone can help me Am I able to change the ACL so I can edit cn=config to load a module in? If so how do I do that? How I setup my working LDAP with the script here: http://www.ghacks.net/2010/08/31/set-up-your-ldap-server-on-ubuntu-10-04/ I'm now using Ubuntu 12.04 Server x64 Working on this module here: http://raerek.blogspot.com/2012/06/sync-ldap-and-samba-passwords-using.html When I load changes into LDAP I'm denied. $ sudo ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f smbkrb5pwd_load.ldif modifying entry "cn=module{0},cn=config" ldap_modify: Insufficient access (50) $ sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f smbkrb5pwd_load.ldif ldap_sasl_interactive_bind_s: Unknown authentication method (-6) additional info: SASL(-4): no mechanism available: $ ldapsearch -xLLL -b cn=config -D cn=admin,cn=config -W olcDatabase=hdb olcAccess Enter LDAP Password: dn: olcDatabase={1}hdb,cn=config olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=domain,dc=net" write by anonymous auth by self write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by dn="cn=admin,dc=domain,dc=net" write by * read Regards, ~Mike

2 6

MDB resizing
by Liam Gretton 28 Jun '13

28 Jun '13

I'm evaluating upgrading our LDAP services and moving from hdb to mdb. I don't seem to be able to get my MDB database to resize by changing the value of maxsize, whether increasing it or decreasing it. I'm using slapd.conf, so changes to the config require a restart. Looking at debug output when slapd starts I can see that the new value of maxsize is being read. If I delete the database and rebuild with slapadd then it's created with the new size. I see there was an ITS#7471 reporting a similar issue, but this was apparently fixed in 2.4.34 (if that's what RE24 is) - I'm using 2.4.35. In my config maxsize is the only MDB setting I've used, everything else will be using default values. Should it be possible to resize MDB this way? I haven't been able to track down much information about resizing beyond the issue report mentioned above. In practice I expect it's something that I'll rarely (if ever) have to do, but I'd like to at least understand what I should be able to do. -- Liam Gretton liam.gretton(a)le.ac.uk Systems Specialist http://www.le.ac.uk/its IT Services Tel: +44 (0)116 2522254 University of Leicester, University Road Leicestershire LE1 7RH, United Kingdom

1 0

Controlling access to users
by Mathew Wilson 28 Jun '13

28 Jun '13

2 1

Groups, Nesting and Access
by Brendan Kearney 28 Jun '13

28 Jun '13

list members, i am looking to have a group "LDAP Engineers" and "LDAP Admins" configured, with the engineers group a member of the admin group. i have a feeling ACLs will need to be adjusted for this. the engineer role will have full read/write access to cn=config. the access granted to cn=config should not include access to the DIT by default. the membership in the admin group should be used to grant this access. think more than one database, and not every engineer will be an admin for every database. essentially, engineers can modify base level configs in slapd, add/load schemas, add/load modules, create new databases, add/modify/delete ACLs, etc. these will be the ldap gurus. the admin roll will have full read/write access to the database the dc=bpk2,dc=com tree is in, only. essentially, admins can add/modify/delete the objects in the DIT. these will be the ldap support staff. because the engineers can be members of this group, they will inherit the access to the DIT. acls will need to be constructed for this separation of duty. the default access granted to the root id by the below might need to be modified or additions made to the ACL list: olcAccess: {0}to * by dn.base="gidNumber=0 +uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * none since this applies to the base, the engineer role should get this access, too. does the above ACL grant access to more than just the cn=config? how can the engineer role be limited to only the cn=config, and not the database(s) that would have DITs in them? the database for the DIT, where dc=bpk2,dc=com resides has the below ACLs. what ACLs are needed to give the admin role full read/write access to the database only? i would imagine those ACLs need to be above the ones listed, so that the admins can modify the same settings the users are allowed to modify. olcAccess: {0}to attrs=userPassword,shadowLastChange by anonymous auth by * none olcAccess: {1}to attrs=loginShell by self write by * none olcAccess: {2}to dn.base="" by * read olcAccess: {3}to dn.subtree="dc=bpk2,dc=com" by dn="cn=adm-srv,dc=bpk2,dc=com" write by dn="cn=kdc-srv,dc=bpk2,dc=com" read by * none also, i have read that users should not be able to modify their own uid and gid attributes. how does one construct ACLs that grant users the ability to modify specific attributes, but not others? what are the attributes that users should not be able to modify? i would think those are fewer in total #s than the ones that the users should be able to modify. with that theory, how is an ACL constructed so that all attributes, except for those few, can be modified by the user? is there some "negated" logic that can be used in ACLs? i have read the "man slapd.access" page, and ACLs are still a bit of voodoo for me. i have to get more comfortable with them, but would like some pointers to get me going. thanks in advance, brendan

1 0

IDs, RootDN and replication
by Brendan Kearney 28 Jun '13

28 Jun '13

list members, i have separate olcRootDN's for cn=config and for dc=bpk2,dc=com (cn=config and cn=Manager,dc=bpk2,dc=com respectively) configured in slapd. i would like to change this so that the olcRootDN's are part of a DIT, and have their authentication managed via SASL or Kerberos. i am using the cn=config olcRootDN as the id for the n-way multimaster replication of both cn=config and olcDatabase for the hdb that has the dc=bpk2,dc=com tree in it. i believe the below will get the olcRootDN's confiured for an id contained in the DIT: ldapmodify -QY EXTERNAL -H ldapi:/// dn: cn=config changetype: modify delete: olcRootDN olcRootDN: cn=config - add: olcRootDN olcRootDN: uid=root,cn=bpk2.com,cn=gssapi,cn=auth - delete: olcRootPW - dn: olcDatabase={2}hdb,cn=config changetype: modify delete: olcRootDN olcRootDN: cn=Manager,dc=bpk2,dc=com - add: olcRootDN olcRootDN: uid=root,cn=bpk2.com,cn=gssapi,cn=auth - delete: olcRootPW - when performing the delete action, do i need to do both "delete: olcRootDN", and then specify "olcRootDN: cn=config"? since there is only one value, i would think it is unnecessary, but just want to check. what are best practices around using a RootDN ID contained in a DIT? i would imagine using "root" is something to avoid. what suggestions are there around the RootDN id? what about using the RootDN id as the id for replication, when the bind method is sasl and the saslmech is gssapi? should a different id be used for replication? i am using n-way multi master replication with credentials= specified in my configs. with the below, i plan to modify the id used to do the replication, as well as the authentication: ldapmodify -QY EXTERNAL -H ldapi:/// dn: cn=config changetype: modify delete: olcSyncrepl olcSyncrepl: {1} - delete: olcSyncrepl olcSyncrepl: {0} - add: olcSyncrepl olcSyncrepl: olcSyncrepl: {0}rid=001 provider=ldap://ldap1.bpk2.com binddn="replication_user" bind method=sasl saslmech=gssapi searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 - olcSyncrepl: olcSyncrepl: {1}rid=002 provider=ldap://ldap2.bpk2.com binddn="replication_user" bind method=sasl saslmech=gssapi searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 - dn: dc=bpk2,dc=com delete: olcSyncrepl olcSyncrepl: {1} - delete: olcSyncrepl olcSyncrepl: {0} - add: olcSyncrepl olcSyncrepl: olcSyncrepl: {0}rid=001 provider=ldap://ldap1.bpk2.com binddn="replication_user" bind method=sasl saslmech=gssapi searchbase="dc=bpk2,dc=com" scope=sub schemachecking=off type=refreshAndPersist retry="5 5 300 5" timeout=1 - olcSyncrepl: olcSyncrepl: {0}rid=002 provider=ldap://ldap2.bpk2.com binddn="replication_user" bind method=sasl saslmech=gssapi searchbase="dc=bpk2,dc=com" scope=sub schemachecking=off type=refreshAndPersist retry="5 5 300 5" timeout=1 - does the "replication_user" ID need to be user(a)domain.tld or in some other "qualified" format, or will just the id/name be ok? with the above config to use sasl auth for replication, do i need to run k5start for the tickets to be maintained for the replication_user? i dont want to use authcid or authzid because of the requirement of the credentials being in the config. i want no password to be in the configs. from what i find, k5start is needed. thanks in advance, brendan

1 0

Simple bind error
by Darouichi, Aziz 28 Jun '13

28 Jun '13

Hi, I am trying to use softerra to connect to a local openldap-2.4.34 using Simple Bind, after I enter the password and BasDn info. I get Invalid credentials. Any help or debug this issue will be great. Thank you, Aziz

2 2

Question regarding authentication
by Jason Voorhees 27 Jun '13

27 Jun '13

Hi: I have a doubt about how OS level authentication against an LDAP server could work, so I hope someone can point me to a solution. If I have a lot of users in a Linux box with a common prefix in its usernames like these: - prejvoorhees - premjackson - presjobs - prebgates - pretcruise ... ... As you can see, all these have the prefix "pre" before it's real username (jvoorhees, mjackson, sjobs, bgates, tcruis, etc...). I also have an OpenLDAP server with a users directory tree whose usernames are the same but without "pre", I mean they are jvoorhees, mjackson, sjobs, bgates, tcruis, etc.... So what I'd like to do if configure my Linux box (ldap client) so it can authenticate against the OpenLDAP server in this way: - username prebgates authenticates with bgates in LDAP server. - username pretcruise authenticates with tcruise in LDAP server. - username prejvoorhees authenticates with jvoorhees in LDAP server. ... ... Is this possible to do? Can I make a rule to supress the "pre" prefix before authentication against LDAP? If yes, where should I make this "rule": in the Linux box (ldap client) or in the LDAP Server? I hope someone has any idea about this topic. THanks in advance. Bye

2 2

Issue with LDAPVerifyServerCert flag.
by Mangesh Sawant 27 Jun '13

27 Jun '13

If in LDAP client, LDAPVerifyServerCert is enabled in SSL , authentication fails with Message simple bind failed. If LDAPVerifyServerCert is disabled in SSL there is no issue. LDAP server is OpenLdap. What configuration w.r.t LDAP/SSL I need to check so that authentication succeeds with LDAPVerifyServerCertflag ON. -- Thanks And Regards , Mangesh Sawant .

1 0

(no subject)
by Ben Johnson 27 Jun '13

27 Jun '13

I posted this to openldap-bugs but I didn't see it actually posted to the archive so I'll try in openldap-technical. I have LMDB integrated and it's working smoothly except for this issue. ---- Original Message ---- I'm an author of an open source database called Sky (http://skydb.io/) and I'm interested in porting the backend off LevelDB and move it over to LMDB. I pulled down the LMDB code using the instructions on Ferenc Szalai's gomdb (https://github.com/szferi/gomdb) README: git clone -b mdb.master --single-branch git://git.openldap.org/openldap.git When I ran "make test" against the code it seems to run through most of the tests but I get a "Resource Busy" error at one point. Here's the full output: https://gist.github.com/benbjohnson/5628725 I'm running Mac OS X 10.8.3 and here's the output of my gcc -v: $ gcc -v Using built-in specs. Target: i686-apple-darwin11 Configured with: /private/var/tmp/llvmgcc42/llvmgcc42-2336.11~182/src/configure --disable-checking --enable-werror --prefix=/Applications/Xcode.app/Contents/Developer/usr/llvm-gcc-4.2 --mandir=/share/man --enable-languages=c,objc,c++,obj-c++ --program-prefix=llvm- --program-transform-name=/^[cg][^.-]*$/s/$/-4.2/ --with-slibdir=/usr/lib --build=i686-apple-darwin11 --enable-llvm=/private/var/tmp/llvmgcc42/llvmgcc42-2336.11~182/dst-llvmCore/Developer/usr/local --program-prefix=i686-apple-darwin11- --host=x86_64-apple-darwin11 --target=i686-apple-darwin11 --with-gxx-include-dir=/usr/include/c++/4.2.1 Thread model: posix gcc version 4.2.1 (Based on Apple Inc. build 5658) (LLVM build 2336.11.00) Let me know if you need any other info from me. Ben Johnson ben(a)skylandlabs.com Ben Johnson ben(a)skylandlabs.com

5 11

rootdn password change
by Darouichi, Aziz 26 Jun '13

26 Jun '13

Hi all, I compiled Openldap-2.4.35 with TLS/SSL support and have not configured certs yet. But I am trying to change/encrypt rootdn password using the following /opt/local/bin/ldappasswd -h {SSHA} and I am getting ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1). I checked host file and server DNS name has been added....!!!! Thank you for the help Aziz

2 1

Question on assigning a new user with admin role
by Kumar, Amit 26 Jun '13

26 Jun '13

Hi, I have little experience with managing LDAP servers. Previously with just one file slapd.conf it was lot easier to assign a user a role of an admin, just by giving access to attrs=...by With newer version of openldap-servers-2.4.23-26 on RHEL 6.x this is not the same, and hope you can help me understand this to assign access to user to be able to manage the directory. So I began giving access to attrs=userPassword by self write by dn="NEW USER DN ...." write by * auth ...similarly I did this for all attributes I wanted this user to manage. I made the above changes in my slapd.conf, but this does not allow the new user to manage the directory, he is just like any other user who can browse but not write to it. What more do I need to do? Best, Amit

2 3

unsupported extended operation
by Rodney Simioni 26 Jun '13

26 Jun '13

Hi, I just compiled openldap with: ./configure --prefix=/usr/local/openldap --enable-ldap --with-tls=openssl --with-cyrus-sasl --enable-crypt I did a 'make depend', 'make', and a 'make install'; I didn't see any errors. I fired up ldap with: './slapd -d127 -h "ldap:///"' Then I went to test my install with:' ldapsearch -x -ZZ -d1 -H ldap://blah.com/' And I'm still getting: ldap_msgfree ldap_err2string ldap_start_tls: Protocol error (2) additional info: unsupported extended operation ldap_free_connection 1 1 ldap_send_unbind ber_flush2: 7 bytes to sd 3 ldap_free_connection: actually freed Does anybody have a clue? This email message is intended for the use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, distribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. Verio Inc. makes no warranty that this email is error or virus free. Thank you.

5 6

openldap and MozNSS
by Rodney Simioni 25 Jun '13

25 Jun '13

Greetings, I have heard through the grapevine that it is best not to use openldap with MozNSS support for SSL/TLS and to use openssl. I'm using a Red Hat pkg of openldap with version 2.4.23. How do I know if this version has openssl compiled? If it is compiled for openssl, how do I tell openldap not to use MOzNSS? Thanks! This email message is intended for the use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, distribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. Verio Inc. makes no warranty that this email is error or virus free. Thank you.

2 6

RHEL 6.3 /Openldap-2.4.35
by Darouichi, Aziz 25 Jun '13

25 Jun '13

Hi All, I am trying to compile Openldap-2.4.35 on RHEL 6.3 to enable SSL/TLS and I get the following error: -configure: WARNING: Could not locate TLS/SSL package -configure: WARNING: TLS data protection not supported! - I installed openssl-1.0.1e - gnutls-2.8.6 - libgcrypt-1.5.2 - libgpg-error-1.8 - DB-6.0.19I run config with the following options: CPPFLAGS="-I/opt/local/DB-6/include/" LDFLAGS="-L/opt/local/DB-6/lib/" ./configure --enable-hdb --enable-bdb --enable-overlays=mod --enable-ppolicy=yes --prefix=/opt/local Any help will be great :) Thank You, Aziz

2 2

SASL Proxy Authorization
by Vishesh kumar 25 Jun '13

25 Jun '13

Hi Members, I am trying to get SASL Proxy Authorization in work. GSSAPI authentication is already in place ++++++++++++ SASL/GSSAPI authentication started SASL username: admin(a)LINUXMANTRA.LOCAL SASL SSF: 56 SASL data security layer installed. dn:uid=admin,cn=gssapi,cn=auth ++++++++++++++++++++++++++ But following command giving error ldapsearch -d 1 -Y GSSAPI -X "uid=vishesh,dc=linuxmantra,dc=local" -b"dc=linuxmantra,dc=local" -s base I already mentioned "authzTo: dn:uid=vishesh,dc=linuxmantra,dc=local" for admin DN. Thanks in advance for your help. -- http://linuxmantra.com

2 2

Defining search depth for mod_ldap.
by Mangesh Sawant 25 Jun '13

25 Jun '13

Hi, when searching a user mod_ldap returns only parent node attributes. Is there any setting so that search will return parent node attributes as well. LDAP URS is as follows: LdapUrl=ldap:// 172.16.100.237/ou=radiusUserProfile,dc=mtnl,dc=com?uid,userPassword,cn,sn? Here I could get back only uid,userPassword. cn and sn were blank, which are attributes of child nodes. -- Thanks And Regards , Mangesh Sawant .

2 1

understanding ldap
by Rodney Simioni 25 Jun '13

25 Jun '13

Please correct me if I am wrong. These questions are stemming from a Red Hat Linux Server. /etc/openldap/ldap.conf # this config file is openldap server's ldap config file? /etc/ldap.conf # This config file is for ldap's clients? If I want to test test if LDAP is configured with TLS/SSL with this command ldapsearch -d -1 -x -LLL -ZZ, do I need a ldap client config file? This email message is intended for the use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, distribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. Verio Inc. makes no warranty that this email is error or virus free. Thank you.

4 4

etiquette when asking questions
by Brendan Kearney 25 Jun '13

25 Jun '13

i have several questions that i am looking for information on, but they are not all related to each other. is it proper etiquette to send a separate thread for each topic, or can one post a series of questions in one thread? my questions run the gambit from access, groups and ACLs to SASL+Kerberos, inheritance of structural object classes, and group types (groupOfNames vs posixAccount). thank you, brendan

2 1

OpenLDAP export in Oracle DB (10g) - not as backend
by Lukas Lehner 24 Jun '13

24 Jun '13

Hi I want an interface to OpenLDAP (with sudoers) to Oracle DB. I have no access to OpenLDAP server, but an LDAP admin user. The OpenLDAP data in Oracle DB should be relational, the same logic like in OpenLDAP. How is the easiest? Is there already finished scripts?

2 2

no-op search control, large result sets and abandon
by Michael Ströder 22 Jun '13

22 Jun '13

HI! In web2ldap I've implemented a feature some time ago which uses the no-op search control to determine the overall number of results when only displaying a partial result set. Obviously this does not scale well when interactively browsing into a container with many entries. So I'm considering whether to make this configurable (default off) or to make something automagically. My current working code sends a search no-op request with small timeout (5 sec), catches the error if the no-op search would take longer (Python exception ldap.TIMEOUT) and sends abandon request in this case. The idea is trying to determine the overall number of results only if it does not put too much burden on the server. But I wonder whether sending the abandon request really helps to reduce the server load: Does slapd immediately stop processing the no-op search request? Or does it generate the result set but not return it to the client? Ciao, Michael.

2 1

adding schemas
by Bruno Furtado 22 Jun '13

22 Jun '13

Hi Dan, I'm trying to add new schema with the command: * * *ldapadd -Y EXTERNAL -H ldapi:/// -f qmail.ldif* and I'm getting the following error message: * * *ldap_add: Server is unwilling to perform (53) * *additional info: no global superior knowledge* how can I solve it? best regards, -- Bruno Furtado LinkedIn: http://linkd.in/brunofurtado

2 1

RE: Understanding PKI
by Dave Thompson 22 Jun '13

22 Jun '13

>From: owner-openssl-users(a)openssl.org On Behalf Of Rodney Simioni >Sent: Friday, 21 June, 2013 10:36 >I want to really understand certificates, pki, etc; so forgive me >if these questions are elementary. >Before creating a certificate, I need to generate the CSR on the >actual server where I am going to install the certificate? >(reason why I'm asking is because a wildcard csr was sent to me >and I don't know if I should use the wildcard csr or the one >generated on the server). It can vary depending on who does what, and whether you are doing only server-authentication or client-authentication as well, which is not common for SSL/TLS in general but I don't know for LDAP. Client-authentication is often called "client certificate", although this is loose wording because you actually need the cert *and key*. Similarly server-authentication is often called "server cerificate" but often it is left implicit since it is practically always there. (Formally there are non-authenticating "anonymous" suites in TLS, but they are rarely used and very rarely a good idea.) FWWIW http://www.openldap.org/doc/admin24/tls.html says "All servers are required to have valid certificates, whereas client certificates are optional. Clients must have a valid certificate in order to authenticate via SASL EXTERNAL." Optional could mean 95% but not 100%, or it could mean 2%. The canonical process is: - the "user" system that will be authenticated -- usually server, sometimes client -- generates a keypair and generates a CSR using that keypair (which includes the publickey part) - a CA uses the CSR to create a user cert (which copies the user publickey from the CSR and thus originally from the keypair); the cert is signed using the *CA* key-and-cert. This may be a "public" CA like Verisign or (in your case) GeoTrust, or it can be private, but see below - the user system uses its privatekey and its cert in SSL/TLS - each *peer* system -- all clients for a server usually -- must have the root cert of the CA in its truststore (which as described earlier can be a single file or a directory). For public CAs the roots are available both on the CA site and other places that can be used to confirm their correctness and legitimacy, like every copy of Windows (including IE) or Firefox or Java; private CA roots are generally only available from the CA, whom you must trust - if the CA uses an intermediate cert (or several) which in your case GeoTrust did, then the server *should* send the intermediate cert(s), and optionally the root, in the SSL/TLS handshake. How to do this varies, but in your case it appears openldap doesn't use openssl's option for a chainfile, so you must put the cert(s) in the truststore the server uses. For the rarer case of client authentication, s/server/client/. If someone else generates your key, they can give you the key and let you generate the CSR and request the cert; they can generate the keypair and CSR and let you request the cert; or they can generate the key and CSR and get the cert. In your case your "admin" gave you all three, implying the third choice. The third choice also includes the case where it's really their key; they created a key and CSR and got a cert and (then) decided to let you share their identity. Since this apparently is as you said a "company" cert (and key) it makes sense for you to share. >Once the CSR is created, a CA will use the CSR to create the certificate? Exactly. (The user cert, not the CA cert(s) which are different.) >A CA was sent to me, it's the company's CA (wildcard); if the above answer >is yes, do I use the CA, the private key, and CSR to create the certificate? You didn't get any CA, you got a user cert *issued by* (or from) GeoTrust. GeoTrust is the CA. If I remember (without searching) it is a cert *for* *.securesites.com which is a wildcard, so this cert can be used by any system whose DNSname matches that pattern. >A CSR will only work with the private key it was generated with? A CSR is generated from, and is for, a given keypair (private+public). A cert based on that CSR is for that publickey, and thus only works with that privatekey. Once you have the cert, you don't use the CSR for anything except possibly getting a new cert -- if you want a new cert for the same keypair and Subject name, and any extensions that are specified in the CSR and honored.

1 0

RE: Is my process correct.: openldap using GeoTrust
by Dave Thompson 22 Jun '13

22 Jun '13

> From: owner-openssl-users(a)openssl.org On Behalf Of Rodney Simioni > Sent: Friday, 21 June, 2013 11:38 > Comments below. > > From: owner-openssl-users(a)openssl.org On Behalf Of Dave Thompson > Sent: Thursday, June 20, 2013 6:24 PM <snip> > The wildcard.securesites.com.cert you posted 6/19 has > Issuer: C=US, O=GeoTrust, Inc., CN=GeoTrust SSL CA and AKI > 42:79:54:1B:61:CD:55:2B:3E:63:D5:3C:48:57:F5:9F:FB:45:CE:4A > > GeoTrust doesn't publish that anywhere I can find but > http://www.tbs-certificats.com/FAQ/en/603.html has <snip> > which is an intermediate (not root) cert (verifiably) under > Issuer: C=US, O=GeoTrust Inc., CN=GeoTrust Global CA AKI > C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E > [[Rod's comment]] I need clarification please. The 'Root 2' > is the root CA that I can download from geotrust and the one > provided to me by my sysadmin is an intermeadiate? > > and THAT is "Root 2" (one of several) on > http://www.geotrust.com/resources/root-certificates/index.html > (also in the standard Windows, Firefox, and Java truststores) > The cert from your admin is a *user* cert -- for *.securesites.com. The one I found on tbs-certificats is the relevant intermediate. "Root 2" from GeoTrust, or elsewhere, is the relevant root. > >What command do I use to make sure the key/pair that was > sent to me is > >compatible with GeoTrust's CA? > > Either concatenate the intermediate above and the correct > root (also in PEM) into one file say geotrustCAs.pem and do: > openssl verify -CAfile geotrustCAs.pem yourcertfile > [[Rod's comment]] Are you saying to concatenate the > intermediate root and 'Root 2' which should be downloaded > from geotrust? > The intermediate cert and the root cert. The intermediate is a CA cert, but is not a root cert (or root CA cert). > Or put them as separate files in some directory say mycadir, > create hashnames using c_rehash or by hand, and do: > openssl verify -CApath mycadir yourcertfile > > (The first is usually easier.) > > Assuming (as asked before) your opendlap is using openssl not > MozillaNSS, to use a key&cert with an intermediate cert > openssl requires either configuring a certchain file or > putting the chain cert(s) in the truststore (even if the > cert(s) or truststore aren't needed for verification). > [[Rod's comment]] As you said before, I'm probably using > MozNSS because of the errors I was getting several emails > ago. What should I do? Should I remove MozNSS pkg? I've already > Installed openssl-devel pkg. > Someone else suggested that and I was referring to them. Part of the errorlog you posted before looks consistent with MozNSS, but part looks consistent with openssl to me, so I can't tell. I expect openldap has a way to tell you which it uses, but I don't know how. 'devel' packages probably matter only if you are re-building openldap; are you? If you are in fact using MozNSS, the same principles still apply as to which key and certficates you need where (server vs client), but the specifics of what file(s) you put them are entirely different, so ignore those parts of my instructions. <snip>

1 0

RE: Is my process correct.: openldap using GeoTrust
by Dave Thompson 21 Jun '13

21 Jun '13

>From: owner-openssl-users(a)openssl.org On Behalf Of Rodney Simioni >Sent: Thursday, 20 June, 2013 12:04 >A key/pair was sent to me from my admin and it looked like it came >from GeoTrust. It's a wildcard cert. A privatekey (which in most formats including openssl's is really a keypair) and a matching certificate. You need both. >I downloaded the Root CA from GeoTrust 's web site because LDAP >requires the CA file. The wildcard.securesites.com.cert you posted 6/19 has Issuer: C=US, O=GeoTrust, Inc., CN=GeoTrust SSL CA and AKI 42:79:54:1B:61:CD:55:2B:3E:63:D5:3C:48:57:F5:9F:FB:45:CE:4A GeoTrust doesn't publish that anywhere I can find but http://www.tbs-certificats.com/FAQ/en/603.html has it as -----BEGIN CERTIFICATE----- MIID2TCCAsGgAwIBAgIDAjbQMA0GCSqGSIb3DQEBBQUAMEIxCzAJBgNVBAYTAlVT MRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9i YWwgQ0EwHhcNMTAwMjE5MjIzOTI2WhcNMjAwMjE4MjIzOTI2WjBAMQswCQYDVQQG EwJVUzEXMBUGA1UEChMOR2VvVHJ1c3QsIEluYy4xGDAWBgNVBAMTD0dlb1RydXN0 IFNTTCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJCzgMHk5Uat cGA9uuUU3Z6KXot1WubKbUGlI+g5hSZ6p1V3mkihkn46HhrxJ6ujTDnMyz1Hr4Gu FmpcN+9FQf37mpc8oEOdxt8XIdGKolbCA0mEEoE+yQpUYGa5jFTk+eb5lPHgX3UR 8im55IaisYmtph6DKWOy8FQchQt65+EuDa+kvc3nsVrXjAVaDktzKIt1XTTYdwvh dGLicTBi2LyKBeUxY0pUiWozeKdOVSQdl+8a5BLGDzAYtDRN4dgjOyFbLTAZJQ50 96QhS6CkIMlszZhWwPKoXz4mdaAN+DaIiixafWcwqQ/RmXAueOFRJq9VeiS+jDkN d53eAsMMvR8CAwEAAaOB2TCB1jAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFEJ5 VBthzVUrPmPVPEhX9Z/7Rc5KMB8GA1UdIwQYMBaAFMB6mGiNifurBWQMEX2qfWW4 ysxOMBIGA1UdEwEB/wQIMAYBAf8CAQAwOgYDVR0fBDMwMTAvoC2gK4YpaHR0cDov L2NybC5nZW90cnVzdC5jb20vY3Jscy9ndGdsb2JhbC5jcmwwNAYIKwYBBQUHAQEE KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5nZW90cnVzdC5jb20wDQYJKoZI hvcNAQEFBQADggEBANTvU4ToGr2hiwTAqfVfoRB4RV2yV2pOJMtlTjGXkZrUJPji J2ZwMZzBYlQG55cdOprApClICq8kx6jEmlTBfEx4TCtoLF0XplR4TEbigMMfOHES 0tdT41SFULgCy+5jOvhWiU1Vuy7AyBh3hjELC3DwfjWDpCoTZFZnNF0WX3OsewYk 2k9QbSqr0E1TQcKOu3EDSSmGGM8hQkx0YlEVxW+o78Qn5Rsz3VqI138S0adhJR/V 4NwdzxoQ2KDLX4z6DOW/cf/lXUQdpj6HR/oaToODEj+IZpWYeZqF6wJHzSXj8gYE TpnKXKBuervdo5AaRTPvvz7SBMS24CqFZUE+ENQ= -----END CERTIFICATE----- which is an intermediate (not root) cert (verifiably) under Issuer: C=US, O=GeoTrust Inc., CN=GeoTrust Global CA AKI C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E and THAT is "Root 2" (one of several) on http://www.geotrust.com/resources/root-certificates/index.html (also in the standard Windows, Firefox, and Java truststores) >What command do I use to make sure the key/pair that was sent to me >is compatible with GeoTrust's CA? Either concatenate the intermediate above and the correct root (also in PEM) into one file say geotrustCAs.pem and do: openssl verify -CAfile geotrustCAs.pem yourcertfile Or put them as separate files in some directory say mycadir, create hashnames using c_rehash or by hand, and do: openssl verify -CApath mycadir yourcertfile (The first is usually easier.) Assuming (as asked before) your opendlap is using openssl not MozillaNSS, to use a key&cert with an intermediate cert openssl requires either configuring a certchain file or putting the chain cert(s) in the truststore (even if the cert(s) or truststore aren't needed for verification). The manpage on http://linux.die.net/man/5/slapd-config does not indicate any option to configure a chain file; if that is true for the version you are using, use one of the above approaches with olcTLSCACertificateFile or Path .

1 0

Fw: LDAP/SASL problems
by Krishnamoorthi Gopal 20 Jun '13

20 Jun '13

Hi, Thanks Is Possible to create active directory schema manually in openLDAP...? Regards Support Team. ----- Forwarded by Krishnamoorthi Gopal/Chennai/Vernalis/IN on 06/20/2013 09:20 PM ----- From: Vishesh kumar <linuxtovishesh(a)gmail.com> To: Krishnamoorthi Gopal <krishnamoorthi(a)vernal.is> Cc: Ricardo Sant Ana <ricksant2003(a)gmail.com>, openldap-technical-bounces(a)openldap.org, "openldap-technical(a)openldap.org" <openldap-technical(a)openldap.org> Date: 06/20/2013 09:18 PM Subject: Re: LDAP/SASL problems As per understanding, AD use different schema so OpenLDAP replication will not work. Thanks Vishesh Kumar http://www.linuxmantra.com/ On Tue, Jun 11, 2013 at 7:40 PM, Krishnamoorthi Gopal < krishnamoorthi(a)vernal.is> wrote: Hi Ricardo, Is possible to replicate Active directory users into OpenLDAP server. Can you confirm. Regards Support Team. From: Ricardo Sant Ana <ricksant2003(a)gmail.com> To: openldap-technical(a)openldap.org Date: 06/11/2013 07:36 PM Subject: LDAP/SASL problems Hello All I am instaling an OpenLDAP server (Ubuntu Precise) on a local network (Ip 10.67.123.146). I installed using : apt-get install slapd ldap-utils later, I used slapcat to insert data from a teste.ldif file. So, the problem: from local machine I used ldapsearch -D "cn=admin,dc=eb,dc=mil,dc=br" -w password -p 389 -h 10.67.123.146 -b "dc=eb,dc=mil,dc=br" -s sub "(objectclass=*)" and it works properly. But from a remote host: ldapsearch -D "cn=admin,dc=eb,dc=mil,dc=br" -w password -p 389 -h 10.67.123.146 -b "dc=eb,dc=mil,dc=br" -s sub "(objectclass=*)" returns: SASL/DIGEST-MD5 authentication started ldap_sasl_interactive_bind_s: Invalid credentials (49) So, from a remote host, I had to add -x option: ldapsearch -x -D "cn=admin,dc=eb,dc=mil,dc=br" -w sped -p 389 -h 10.67.123.146 -b "dc=eb,dc=mil,dc=br" -s sub "(objectclass=*)" and it works again. So, after some google, it seems I need to configure/install SASL support; How do I do that ? thanks in advance Ricardo Sant'Ana VERNALIS SYSTEMS EMAIL NOTICE ----------------------------- The information contained in this email and any attachments is confidential and may be subject to copyright or other intellectual property protection. If you are not the intended recipient, you are not authorized to use or disclose this information, and we request that you notify us by reply mail or telephone and delete the original message from your mail system. -- http://linuxmantra.com VERNALIS SYSTEMS EMAIL NOTICE ----------------------------- The information contained in this email and any attachments is confidential and may be subject to copyright or other intellectual property protection. If you are not the intended recipient, you are not authorized to use or disclose this information, and we request that you notify us by reply mail or telephone and delete the original message from your mail system.

2 1

Multi master replication
by 25Dollar Tech 20 Jun '13

20 Jun '13

Hello Team, I am facing an issue with multi-master replication. After Multi-Master configuration when I add entry it is susccessfully replicating only one time second time it is not repplicating. what could be the reson. below is the logs (stat and -1) stat logs from one server when I add entry in server 2 Jun 20 11:37:06 vm2 slapd[1559]: conn=-1 fd=21 ACCEPT from IP= 192.168.122.87:46965 (IP=0.0.0.0:389) Jun 20 11:37:06 vm2 slapd[1559]: do_syncrep2: rid=005 LDAP_RES_INTERMEDIATE - SYNC_ID_SET Jun 20 11:37:06 vm2 slapd[1559]: do_syncrep2: rid=005 LDAP_RES_SEARCH_RESULT Jun 20 11:37:06 vm2 slapd[1559]: do_syncrep2: rid=005 cookie=rid=005,csn=20130620073703.737390Z#000000#000#000000 Jun 20 11:37:06 vm2 slapd[1559]: nonpresent_callback: rid=005 present UUID 0cbd9aa0-6dba-1032-8208-dff4fce29a41, dn dc=emb,dc=slb,dc=com Jun 20 11:37:06 vm2 slapd[1559]: nonpresent_callback: rid=005 present UUID 0cbe2902-6dba-1032-8209-dff4fce29a41, dn cn=admin,dc=emb,dc=slb,dc=com Jun 20 11:37:06 vm2 slapd[1559]: nonpresent_callback: rid=005 present UUID 5c8269b0-6dc1-1032-80e1-8fddbab869b5, dn ou=Groups,dc=emb,dc=slb,dc=com Jun 20 11:37:06 vm2 slapd[1559]: slap_queue_csn: queing 0x7f5f10109b40 20130620073703.737390Z#000000#000#000000 Jun 20 11:37:06 vm2 slapd[1559]: slap_graduate_commit_csn: removing 0x7f5f1010b540 20130620073703.737390Z#000000#000#000000 Jun 20 11:37:14 vm2 slapd[1559]: conn=1013 fd=19 ACCEPT from IP= 192.168.122.199:35866 (IP=0.0.0.0:389) Jun 20 11:37:14 vm2 slapd[1559]: conn=1013 op=0 BIND dn="cn=admin,dc=emb,dc=slb,dc=com" method=128 Jun 20 11:37:14 vm2 slapd[1559]: conn=1013 op=0 BIND dn="cn=admin,dc=emb,dc=slb,dc=com" mech=SIMPLE ssf=0 Jun 20 11:37:14 vm2 slapd[1559]: conn=1013 op=0 RESULT tag=97 err=0 text= Jun 20 11:37:14 vm2 slapd[1559]: conn=1013 op=1 SRCH base="dc=emb,dc=slb,dc=com" scope=2 deref=0 filter="(objectClass=*)" Jun 20 11:37:14 vm2 slapd[1559]: conn=1013 op=1 SRCH attr=* + Jun 20 11:37:14 vm2 slapd[1559]: conn=1013 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= Jun 20 11:37:14 vm2 slapd[1559]: conn=1013 op=2 UNBIND Jun 20 11:37:14 vm2 slapd[1559]: conn=1013 fd=19 closed loglevel -1 enabled and below are the logs from the server1 when I add entry in server2 Jun 20 16:30:13 vm2 slapd[13074]: => access_allowed: search access to "dc=emb,dc=slb,dc=com" "entryCSN" requested Jun 20 16:30:13 vm2 slapd[13074]: <= root access granted Jun 20 16:30:13 vm2 slapd[13074]: => access_allowed: search access granted by manage(=mwrscxd) Jun 20 16:30:13 vm2 slapd[13074]: <= test_filter 6 Jun 20 16:30:13 vm2 slapd[13074]: <= test_filter_and 6 Jun 20 16:30:13 vm2 slapd[13074]: <= test_filter 6 Jun 20 16:30:13 vm2 slapd[13074]: nonpresent_callback: rid=005 present UUID b49be142-6dd7-1032-821e-bd2e8e19723c, dn dc=emb,dc=slb,dc=com Jun 20 16:30:13 vm2 slapd[13074]: => test_filter Jun 20 16:30:13 vm2 slapd[13074]: AND Jun 20 16:30:13 vm2 slapd[13074]: => test_filter_and Jun 20 16:30:13 vm2 slapd[13074]: => test_filter Jun 20 16:30:13 vm2 slapd[13074]: LE Jun 20 16:30:13 vm2 slapd[13074]: => access_allowed: search access to "cn=admin,dc=emb,dc=slb,dc=com" "entryCSN" requested Jun 20 16:30:13 vm2 slapd[13074]: <= root access granted Jun 20 16:30:13 vm2 slapd[13074]: => access_allowed: search access granted by manage(=mwrscxd) Jun 20 16:30:13 vm2 slapd[13074]: <= test_filter 6 Jun 20 16:30:13 vm2 slapd[13074]: <= test_filter_and 6 Jun 20 16:30:13 vm2 slapd[13074]: <= test_filter 6 Jun 20 16:30:13 vm2 slapd[13074]: nonpresent_callback: rid=005 present UUID b49c7e5e-6dd7-1032-821f-bd2e8e19723c, dn cn=admin,dc=emb,dc=slb,dc=com Jun 20 16:30:13 vm2 slapd[13074]: => test_filter Jun 20 16:30:13 vm2 slapd[13074]: AND Jun 20 16:30:13 vm2 slapd[13074]: => test_filter_and Jun 20 16:30:13 vm2 slapd[13074]: => test_filter Jun 20 16:30:13 vm2 slapd[13074]: LE Jun 20 16:30:13 vm2 slapd[13074]: => access_allowed: search access to "ou=Groups4,dc=emb,dc=slb,dc=com" "entryCSN" requested Jun 20 16:30:13 vm2 slapd[13074]: <= root access granted Jun 20 16:30:13 vm2 slapd[13074]: => access_allowed: search access granted by manage(=mwrscxd) Jun 20 16:30:13 vm2 slapd[13074]: <= test_filter 6 Jun 20 16:30:13 vm2 slapd[13074]: <= test_filter_and 6 Jun 20 16:30:13 vm2 slapd[13074]: <= test_filter 6 Jun 20 16:30:13 vm2 slapd[13074]: nonpresent_callback: rid=005 present UUID 3e8b5198-6dd9-1032-8006-655e62f4c8e4, dn ou=Groups4,dc=emb,dc=slb,dc=com Jun 20 16:30:13 vm2 slapd[13074]: => test_filter Jun 20 16:30:13 vm2 slapd[13074]: AND Jun 20 16:30:13 vm2 slapd[13074]: => test_filter_and Jun 20 16:30:13 vm2 slapd[13074]: => test_filter ANybody please help me to solve this issue. Operating system Ubuntu 12.04 OpenLDAP version: openldap-2.4.28 (Debian build) Note:- When I try to delete /var/lib/ldap/* and start one server it is able to replicate but after that again stoped for any new entry or any changes in another server. -- *Thanks & Regards, 25dollarTech Team https://sites.google.com/site/25dollartech/* *Email: 25dollartechhelp(a)gmail.com*

2 1

ppolicy not respecting overrides
by Michael Proto 20 Jun '13

20 Jun '13

Hello all, I'm currently seeing an issue with slapo-ppolicy and individual account overrides not being respected. CentOS 6.4 with system-provided openldap-2.4.23-32.el6_4.1.x86_64 slapd.conf: include /etc/openldap/schema/ppolicy.schema ... moduleload ppolicy.la ... database bdb suffix "dc=domain" ... overlay ppolicy ppolicy_default "cn=PasswordPolicy,ou=Policies,dc=domain" ppolicy_hash_cleartext ppolicy_use_lockout # PasswordPolicy, Policies, domain dn: cn=PasswordPolicy,ou=Policies,dc=domain sn: PasswordPolicy cn: PasswordPolicy objectClass: person objectClass: top objectClass: pwdPolicy pwdAttribute: userPassword pwdLockout: TRUE pwdAllowUserChange: TRUE pwdInHistory: 4 pwdMinLength: 8 pwdFailureCountInterval: 600 pwdMaxFailure: 6 pwdLockoutDuration: 600 pwdCheckQuality: 1 pwdGraceAuthNLimit: 0 pwdMaxAge: 7776000 pwdMustChange: TRUE pwdExpireWarning: 1209600 This works for all user accounts (passwords expire, history is stored, lockouts work). Now I use a bind account for all LDAP-authenticated systems named cn=system,dc=domain that I don't want aligned with the above policy (namely I don't want its password to expire, no password history, no lockout, etc... as it is managed by my admins), so I set the following on that account: # system, domain dn: cn=system,dc=domain sn: system cn: system objectClass: inetOrgPerson objectClass: top objectClass: pwdPolicy pwdAttribute: userPassword pwdLockout: FALSE pwdMaxAge: 0 pwdInHistory: 0 pwdCheckQuality: 0 pwdExpireWarning: 0 pwdLockoutDuration: 0 pwdMaxFailure: 0 pwdMustChange: FALSE pwdFailureCountInterval: 0 pwdGraceAuthNLimit: 0 userPassword:: xxxxxx Earlier today it appears the password for this account expired, which is precisely what I don't want. What I saw in my slapd.log when all systems started failing authentication across the board: Jun 19 18:03:26 master slapd[22980]: conn=1001 op=1 BIND dn="cn=system,dc=domain" method=128 Jun 19 18:03:26 master slapd[22980]: conn=1001 op=1 BIND dn="cn=system,dc=domain" mech=SIMPLE ssf=0 Jun 19 18:03:26 master slapd[22980]: ppolicy_bind: Entry cn=system,dc=domain has an expired password: 0 grace logins Jun 19 18:03:26 master slapd[22980]: conn=1001 op=1 RESULT tag=97 err=49 text= Jun 19 18:03:26 master slapd[22980]: conn=1001 op=1 BIND dn="cn=system,dc=domain" method=128 Jun 19 18:03:26 master slapd[22980]: conn=1001 op=1 BIND dn="cn=system,dc=domain" mech=SIMPLE ssf=0 Jun 19 18:03:26 master slapd[22980]: ppolicy_bind: Entry cn=system,dc=domain has an expired password: 0 grace logins My immediate fix was to use ldappasswd as cn=Manager and change the password 4 times and then change it back to its original, which then allowed systems to authenticate to the directory once again. Obviously this has me concerned as I have a replication user and a chain user to chain modifications from my slaves back to my master, and if their passwords expire I expect to be in for a fair amount of work to fix. What I've done in the interim is create a new ppolicy container with no expiration and assigned my system account's pwdPolicySubentry attribute to that: # NoPasswordPolicy, Policies, domain dn: cn=NoPasswordPolicy,ou=Policies,dc=domain sn: NoPasswordPolicy cn: NoPasswordPolicy objectClass: person objectClass: top objectClass: pwdPolicy pwdAttribute: userPassword pwdCheckQuality: 0 pwdExpireWarning: 0 pwdFailureCountInterval: 0 pwdGraceAuthNLimit: 0 pwdInHistory: 0 pwdLockout: FALSE pwdLockoutDuration: 0 pwdMaxAge: 0 pwdMaxFailure: 0 pwdMinLength: 0 pwdMustChange: FALSE pwdAllowUserChange: FALSE # system, domain dn: cn=system,dc=domain pwdPolicySubentry: cn=NoPasswordPolicy,ou=Policies,dc=domain (I'm hoping this works like I want/expect it to, if not all ideas are welcome...) >From the slapo-ppolicy man page: pwdMaxAge This attribute contains the number of seconds after which a modified password will expire. If this attribute is not present, or if its value is zero (0), then passwords will not expire. With cn=system,dc=domain having a MaxAge attribute set to 0, why would that account's password expire? I'm somewhat stumped here. Thanks, Michael Proto

2 2

Re: Is my process correct.
by Oliver Loch 20 Jun '13

20 Jun '13

"openssl verify" does the trick. http://www.openssl.org/docs/apps/verify.html# And to test if the key and the cert belong together: openssl x509 -in $cert -noout -modulus | openssl md5 openssl rsa -in $key -noout -modulus | openssl md5 If the md5 sums don't match, the key or the cert is invalid. Cu Am 20.06.2013 um 18:04 schrieb "Rodney Simioni" <rodney.simioni(a)verio.net>: > Hi, > > A key/pair was sent to me from my admin and it looked like it came from GeoTrust. It’s a wildcard cert. > > I downloaded the Root CA from GeoTrust ‘s web site because LDAP requires the CA file. > > What command do I use to make sure the key/pair that was sent to me is compatible with GeoTrust’s CA? > > Rod > > > This email message is intended for the use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, distribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. Verio Inc. makes no warranty that this email is error or virus free. Thank you. >

1 0

LDAP/SASL problems
by Ricardo Sant Ana 20 Jun '13

20 Jun '13

Hello All I am instaling an OpenLDAP server (Ubuntu Precise) on a local network (Ip 10.67.123.146). I installed using : apt-get install slapd ldap-utils later, I used slapcat to insert data from a teste.ldif file. So, the problem: from local machine I used ldapsearch -D "cn=admin,dc=eb,dc=mil,dc=br" -w password -p 389 -h 10.67.123.146 -b "dc=eb,dc=mil,dc=br" -s sub "(objectclass=*)" and it works properly. But from a remote host: ldapsearch -D "cn=admin,dc=eb,dc=mil,dc=br" -w password -p 389 -h 10.67.123.146 -b "dc=eb,dc=mil,dc=br" -s sub "(objectclass=*)" returns: SASL/DIGEST-MD5 authentication started ldap_sasl_interactive_bind_s: Invalid credentials (49) So, from a remote host, I had to add -x option: ldapsearch -x -D "cn=admin,dc=eb,dc=mil,dc=br" -w sped -p 389 -h 10.67.123.146 -b "dc=eb,dc=mil,dc=br" -s sub "(objectclass=*)" and it works again. So, after some google, it seems I need to configure/install SASL support; How do I do that ? thanks in advance Ricardo Sant'Ana

3 2

ldap slave version greater than master version
by Bruno Furtado 19 Jun '13

19 Jun '13

Can I have a master server with 2.2 version and the slave with 2.4 version? regards -- Bruno Furtado

2 1

OpenLDAP multimaster
by 25Dollar Tech 19 Jun '13

19 Jun '13

Hello Team, I am facing an issue with setting up OpenLDAP multimaster replicaiton. It is happening only one time and it is giving an error in the server log file that *"hdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found". * Below are my configuration details. Operating system: Ubuntu 12.04.2 cat /etc/ldap/slapd.d/cn\=config.ldif # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 96647d53 dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/slapd/slapd.args olcLogLevel: none olcLogLevel: -1 olcPidFile: /var/run/slapd/slapd.pid olcToolThreads: 1 structuralObjectClass: olcGlobal creatorsName: cn=config olcAllows: bind_v2 olcServerID: 3 ldap://vm3.test.example.com olcServerID: 4 ldap://vm4.test.example.com entryUUID: 7bfbb79a-6d19-1032-9008-c1a20821a82c createTimestamp: 20130619104813Z entryCSN: 20130619104813.603914Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20130619104813Z contextCSN: 20130619104818.925492Z#000000#000#000000 --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- cat /etc/ldap/slapd.d/cn\=config/olcDatabase\=\{1\}hdb.ldif # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 2b434e34 dn: olcDatabase={1}hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=test,dc=example,dc=com olcLastMod: TRUE olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq structuralObjectClass: olcHdbConfig entryUUID: 7bfd08b6-6d19-1032-9012-c1a20821a82c createTimestamp: 20130619104813Z creatorsName: cn=config olcRootDN: cn=admin,dc=test,dc=example,dc=com olcRootPW:: YWRtaW5AMTIz olcSyncrepl: {0}rid=500 provider=ldap://vm3.test.example.combinddn="cn=admin,dc=te st,dc=example,dc=com" bindmethod=simple credentials=admin@123searchbase="dc=emb,d c=slb,dc=com" type=refreshOnly interval=00:00:00:10 retry="5 5 300 +" timeout =1 olcSyncrepl: {1}rid=600 provider=ldap://vm4.test.example.combinddn="cn=admin,dc=te st,dc=example,dc=com" bindmethod=simple credentials=admin@123searchbase="dc=emb,d c=slb,dc=com" type=refreshOnly interval=00:00:00:10 retry="5 5 300 +" timeout =1 olcMirrorMode: TRUE entryCSN: 20130619105336.281097Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20130619105336Z -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- cat /etc/ldap/slapd.d/cn\=config/olcDatabase\=\{0\}config.ldif # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 882cef38 dn: olcDatabase={0}config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth manage by * break structuralObjectClass: olcDatabaseConfig entryUUID: e237277c-6d1b-1032-87ac-4153a9d6c230 creatorsName: cn=config createTimestamp: 20130619110523Z olcRootDN: cn=admin,cn=config olcRootPW:: YWRtaW5AMTIz olcSyncrepl: {0}rid=100 provider=ldap://vm3.test.example.combinddn="cn=admin,cn=co nfig" bindmethod=simple credentials=admin@123 searchbase="cn=config" type=ref reshAndPersist retry="5 5 300 5" timeout=1 olcSyncrepl: {1}rid=200 provider=ldap://vm4.test.example.combinddn="cn=admin,cn=co nfig" bindmethod=simple credentials=admin@123 searchbase="cn=config" type=ref reshAndPersist retry="5 5 300 5" timeout=1 olcMirrorMode: TRUE entryCSN: 20130619110524.008790Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20130619110524Z ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- :/var/lib/ldap# ls -ltrh total 1.4M -rw-r--r-- 1 openldap openldap 96 Jun 19 15:05 DB_CONFIG -rw------- 1 openldap openldap 8.0K Jun 19 15:05 objectClass.bdb -rw------- 1 openldap openldap 32K Jun 19 15:05 id2entry.bdb -rw------- 1 openldap openldap 8.0K Jun 19 15:05 dn2id.bdb -rw------- 1 openldap openldap 10M Jun 19 15:05 log.0000000001 -rw------- 1 openldap openldap 32K Jun 19 15:05 __db.006 -rw------- 1 openldap openldap 160K Jun 19 15:05 __db.004 -rw------- 1 openldap openldap 360K Jun 19 15:05 __db.002 -rw------- 1 openldap openldap 24K Jun 19 15:05 __db.001 -rw-r--r-- 1 openldap openldap 2.0K Jun 19 15:05 alock -rw------- 1 openldap openldap 2.6M Jun 19 15:05 __db.003 -rw------- 1 openldap openldap 1.3M Jun 19 15:05 __db.005 -- *Thanks & Regards, 25dollarTech Team https://sites.google.com/site/25dollartech/* *Email: 25dollartechhelp(a)gmail.com*

1 0

converting schemas
by Bruno Furtado 18 Jun '13

18 Jun '13

Hi folks! I need to upgrade my LDAP server 2.2 to 2.4 and I'm trying to convert the schemas file with slaptest . But when I run the command bellow I get the follow message. And some schema files aren't converted. # slaptest -f schema.conf -F /tmp/ldap/slapd/ 51c0725d config_build_attrs: error 21 on olcAttributeTypes value #10 51c0725d config_build_entry: build "cn={7}phpgwaccount" failed: "" 51c0725d backend_startup_one (type=config, suffix="cn=config"): bi_db_open failed! (-1) slap_startup failed (test would succeed using the -u switch) [s] -- Bruno Furtado

1 0

slapd+syncrepl+mirrormode_connection_hang
by michal 18 Jun '13

18 Jun '13

Hi, I have two ldap servers on two different machines (one is working under debian another is a qnap). I would like to create a mirrormode servers. So I configure slapd.conf like it is described here (http://www.openldap.org/doc/admin24/replication.html) I've changed my personal data. First server: serverID 001 syncrepl rid=001 provider=ldap://another-server bindmethod=simple binddn="cn=root,o=zpcir" credentials="pass" searchbase="database-path" schemachecking=on type=refreshAndPersist retry="60 +" mirrormode on overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 Second server has changes only in serverID = 002, provider=ldap://another-server2, rid=002 I run slapd daemon in debug "slapd -d256 -u root -h "ldap:///" -f /etc/ldap/slapd.conf" And my syncrepl is working because on the other server (where I run slapd in the same mode) I have response: conn=1000 fd=11 ACCEPT from IP=First-serwer:34579 (IP=0.0.0.0:389) conn=1000 op=0 BIND dn="bind-info" method=128 conn=1000 op=0 BIND dn="bind-info" mech=SIMPLE ssf=0 conn=1000 op=0 RESULT tag=97 err=0 text= conn=1000 op=1 SRCH base="cn=database-path" scope=2 deref=0 filter="(objectClass=*)" conn=1000 op=1 SRCH attr=* + And slapd is in this state for a long time and nothing is happening. It is answering for another calls, however conn=1000 is still running (I suppose). There is no result databases aren't updated. Do you have any ideas what is wrong with my replication?

2 2

LDAP and TLS
by Rodney Simioni 17 Jun '13

17 Jun '13

Hi, In order to for LDAP to work with TLS, does the certificate names need to match the server name? My admin gave me a certificate but it's called wildcard.com.cert, the name of my server is not 'wildcard'. usaims This email message is intended for the use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, distribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. Verio Inc. makes no warranty that this email is error or virus free. Thank you.

5 8

translucent overlay and "orphaned" local entry when remote entry moves
by Steve Eckmann 14 Jun '13

14 Jun '13

Is there a standard way to recover a local entry when its proxied entry is moved, that is, when a remote DN changes? It looks like the local entry and its attribute values become inaccessible via ldapsearch. I found the orphaned entry in the output of slapcat, but the man page warning about stopping slapd before running slapcat makes that seem like an impractical way to find and recover the orphans. Thank you.

2 2

What version of OpenSSL is required for OpenLDAP 2.4.35
by Ashwin Kumar 14 Jun '13

14 Jun '13

I am compiling OpenLDAP 2.4.35 with OpenSSL 1.0.0a. The compilation and building the library works fine. However, when I am using the OpenLDAP client "ldapsearch" the tool fails with these errors: [root@xMachine openldap-2.4.35]# ./ldaplib/bin/ldapsearch -H ldaps:// 192.168.1.51:10636 -d 5 ldap_url_parse_ext(ldaps://192.168.1.51:10636) ldap_create ldap_url_parse_ext(ldaps://192.168.1.51:10636/??base) ldap_pvt_sasl_getmech ldap_search put_filter: "(objectclass=*)" put_filter: simple put_simple_filter: "objectclass=*" ldap_build_search_req ATTRS: supportedSASLMechanisms ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP 192.168.1.51:10636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 192.168.1.51:10636 ldap_pvt_connect: fd: 3 tm: -1 async: 0 attempting to connect: connect success TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:error in SSLv3 read server hello B TLS trace: SSL_connect:error in SSLv3 read server hello B TLS: can't connect: error:1411809D:SSL routines:SSL_CHECK_SERVERHELLO_TLSEXT:tls invalid ecpointformat list. ldap_msgfree ldap_err2string ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) additional info: error:1411809D:SSL routines:SSL_CHECK_SERVERHELLO_TLSEXT:tls invalid ecpointformat list 1. Why does this happen? 2. Is it the issue with the OpenSSL 1.0.0a? 3. What is the minimum version of OpenSSL required to build the LDAP clients? -- Ashwin kumar (http://ashwinkumar.me)

2 1

password policy error: Password policy only allows one password value
by Joke de Buhr 14 Jun '13

14 Jun '13

Hi, I activated the password policy overlay but every time I try to update the password using ldappassw I get this error message: SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 Result: Constraint violation (19) Additional info: Password policy only allows one password value The user account has it attribute pwdPolicySubentry set to the policy listed below. The original account had multiple userPassword values with different hashes but I deleting every attribute userPassword but the last one didn't help. Deleting all userPassword attributes didn't work either. ldappasswd always returns the error. Any idea what causes the problem or what setting to check? Regards Joke ----------------------------------------------------------------------------- dn: cn=person,ou=policies,dc=seiken,dc=de objectClass: top objectClass: person objectClass: pwdPolicy cn: person pwdAttribute: userPassword sn: -none- description: password policy designed for real people logins pwdAllowUserChange: TRUE pwdCheckQuality: 1 pwdExpireWarning: 2592000 pwdFailureCountInterval: 5 pwdGraceAuthNLimit: 3 pwdInHistory: 5 pwdLockout: TRUE pwdLockoutDuration: 3600 pwdMaxAge: 7776000 pwdMaxFailure: 60 pwdMinAge: 0 pwdMinLength: 5 pwdMustChange: TRUE pwdSafeModify: FALSE -----------------------------------------------------------------------------

1 1

Re: openldap-technical Digest, Vol 67, Issue 12
by Mark Molenda 13 Jun '13

13 Jun '13

It's been awhile since I've messed with this but this sounds like a classic directory chaining or LDAP referral, where the LDAP client does not find the user and automatically refers the client to the directory having the entry. ============================ Message: 1 Date: Wed, 12 Jun 2013 09:20:56 -0500 From: Jason Brandt <jbrandt(a)fsmail.bradley.edu> To: openldap-technical(a)openldap.org Subject: OpenLDAP Proxy for Active Directory Authentication Message-ID: <CAJ-t26o1=bEWUuv4xeveTNG37jqD-hWCoGbSpofU4fCiywAiiw(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" We run in a mixed environment, with both Active Directory and LDAP directory servers. Some users exist in both LDAP and AD, while some are just in AD. As such, we always have obstacles with password sync between directories. Is it possible, to set up an OpenLDAP proxy (if that's the correct term), which would authenticate via Active Directory if the user exists there (or if a flag is present in the LDAP entry, etc), otherwise via LDAP if the user is not an AD user, thereby eliminating the need to store the password in both directories? Directory information would otherwise

1 0

How can OpenLDAP client process on FreeBSD authenticate a web user with active directory
by Ganesh Borse 13 Jun '13

13 Jun '13

Dear Friends I am new to OpenLDAP. We are migrating our application (integrated with webserver) from Windows to FreeBSD. However, this is adding a bit of a problem. Previously, I used Microsoft SSPI authentication loop mechanism to authenticate the users connecting from GUI client (launched from computers in MS active directory) to our application. AD authentication helped avoid maintaining separate passwords. Now, since we are moving to FreeBSD and web based interface, it is difficult to use the same SSPI mechanism and so, the users connecting to this application from web browser can be authenticated using the AD credentials. The function ldap_bind_s requires explicit password when connecting to directory server using a username other than logged in user. Also, pass-through authentication mechanism (14.5) outlined in OpenLDAP-Admin-Guide cannot be used as it is for slapd. Thus, can you please help me know, how can I authenticate a user configured in AD and connecting from web browser running on a computer in AD using openLDAP client on FreeBSD? I want to avoid maintaining or passing passwords on FreeBSD. Many thanks in advance for your time and help. Thanks and Regards, - ganesh

3 4

LMDB: MDB_MAP_FULL doesn't allow deletions
by Jeremy Bernstein 12 Jun '13

12 Jun '13

Hi OpenLDAP-Technical, First post, thanks in advance for any assistance. I am trying to manage database size for an application in which a fixed DB size is necessary (user-specified and these users are ornery). My preferred strategy is: - write to the DB until it's (nearly?) full - at that point, prune entries matching a certain criteria (either deleting them or backing them up to an auxiliary DB of some sort). I have all of this working, in fact, except that once I hit MDB_MAP_FULL on mdb_put(), I can no longer do anything with the DB, including deleting records. mdb_cursor_del() also returns MDB_MAP_FULL at that point. If I had some idea of when the DB was nearly full, I could do my pruning prophylactically, I guess. Resizing the database upward isn't really a solution, given the constraints of this particular application. Some other observations: - on OSX (BSD?), if I do not set MDB_WRITEMAP in mdb_env_open(), MDB_MAP_FULL is _never_ returned, even when the DB is full. Setting MDB_WRITEMAP disables DB sparseness, though (so my 64MB-mapsize db with one record is 64MB on disk). Bug or feature? - on Windows, the database size is always the same as the mapsize. Possibly there's simply no support for sparse MM files on Windows, but I thought it's worth checking. OK, that's enough for the first post, thanks once again for any insight. Jeremy Bernstein

2 10

Getting Openldap to Trigger Events On Add
by Bram Cymet 12 Jun '13

12 Jun '13

Hi, I am wondering if it is possible to have OpenLDAP trigger a script anytime something is added to the ldap tree. For example after a user entry is added to the tree I would like to run some commands to create a kerberos principle for that user. A user will always be "Kerberized" so it would be continent to just have this happen automatically. -- Bram Cymet Software Developer Canadian Bank Note Co. Ltd. 613-608-9752

2 1

OpenLDAP Proxy for Active Directory Authentication
by Jason Brandt 12 Jun '13

12 Jun '13

We run in a mixed environment, with both Active Directory and LDAP directory servers. Some users exist in both LDAP and AD, while some are just in AD. As such, we always have obstacles with password sync between directories. Is it possible, to set up an OpenLDAP proxy (if that's the correct term), which would authenticate via Active Directory if the user exists there (or if a flag is present in the LDAP entry, etc), otherwise via LDAP if the user is not an AD user, thereby eliminating the need to store the password in both directories? Directory information would otherwise be pulled from the LDAP server, not from Active Directory.

2 3

Design of assertion control filter
by Dieter Klünter 10 Jun '13

10 Jun '13

Hi, following search shows correct results: ldapsearch -Y EXTERNAL -H ldapi:/// \ -b "cn=billy kid,ou=tombstone,o=avci,c=de" -s base \ "(l:caseExactmatch:=Tombstone)" sn l # LDAPv3 # base <cn=billy kid,ou=tombstone,o=avci,c=de> with scope baseObject # filter: (l:caseExactmatch:=Tombstone) # requesting: sn l # # Billy Kid, tombstone, avci, de dn: cn=Billy Kid,ou=tombstone,o=avci,c=de sn: Kid l: Tombstone # search result # numResponses: 2 # numEntries: 1 changing the filter to (l:caseExactmatch:=tombstone) shows the expected results # search result search: 2 result: 0 Success Now a search with assertion control allways shows error 122 ldapsearch -YEXTERNAL -e assert='l=Tombstone'-H ldapi:/// -b "cn=Billy Kid,ou=tombstone,o=avci,c=de" -s base sn l LDAPv3 # base <cn=Billy Kid,ou=tombstone,o=avci,c=de> with scope baseObject # filter: (objectclass=*) # requesting: ldapi:/// sn l # # search result search: 2 result: 122 Assertion Failed The same applies to an extended assertion filter ldapsearch -YEXTERNAL -e assert='l:caseExactmatch:=Tombstone' -H ldapi:/// -b "cn=Billy Kid,ou=tombstone,o=avci,c=de" -s base sn l # search result search: 2 result: 122 Assertion Failed What is wrong with this assertion filter? -Dieter -- Dieter Klünter | Systemberatung http://dkluenter.de GPG Key ID:DA147B05 53°37'09,95"N 10°08'02,42"E

3 3

migrating from SUN one C SDK to openldap C sdk (Linux).
by Far a 10 Jun '13

10 Jun '13

As part of Solaris to Linux migration, I am planning to migrate my application that uses SUN one C SDK to openldap C sdk (Linux). I have various questions that I need to address at the beginning. I am hoping I can get some help over here. The questions are as follows * Can client use openldap C sdk (Linux) while the server is still on Sun one LDAP server. * Is there a list of dos and don'ts and list of possible issues for migrating from SUN one LDAP TO openldap on Linux . Regards farhad

5 14

Unable to bind LDAP server via SSL
by Ashwin Kumar 10 Jun '13

10 Jun '13

Hello all, I have written a sample code to connect to LDAP server via SSL running on port 10389(ldap) & 10636(ldaps). But the sample application fails to set the options for the SSL connection. I do not want to verify the certificate correctness at this moment. Can someone help fix this sample code?? #include <stdio.h> #define LDAP_DEPRECATED 1 #include <ldap.h> #define BIND_DN "dc=example,dc=com" #define BIND_PW "secret" int main() { LDAP *ld; int rc; int reqcert = LDAP_OPT_X_TLS_NEVER; int version = LDAP_VERSION3; int ret(0); if (ldap_initialize (&ld, "ldap://192.168.1.51:10389")) { perror("ldap_init"); /* no error here */ return(1); } rc = ldap_set_option (ld, LDAP_OPT_PROTOCOL_VERSION, &version); if(rc != LDAP_OPT_SUCCESS){ printf("Setting LDAP_OPT_PROTOCOL_VERSION failed: %s\n",ldap_err2string(rc)); } rc = ldap_set_option (ld, LDAP_OPT_X_TLS_REQUIRE_CERT, &reqcert); if(rc != LDAP_OPT_SUCCESS){ printf("Setting LDAP_OPT_X_TLS_REQUIRE_CERT failed: %s\n",ldap_err2string(rc)); } rc = ldap_start_tls_s(ld, NULL, NULL); if (rc != LDAP_SUCCESS) { printf("ldap_start_tls failed: %s\n",ldap_err2string(rc)); } rc = ldap_bind_s(ld, BIND_DN, BIND_PW, LDAP_AUTH_SIMPLE); if( rc != LDAP_SUCCESS ) { fprintf(stderr, "ldap_simple_bind_s: %s\n", ldap_err2string(rc) ); return( 1 ); } ldap_unbind(ld); } The program always fails with: *Setting LDAP_OPT_X_TLS_REQUIRE_CERT failed: Can't contact LDAP server* *ldap_start_tls failed: Not Supported* The server does support ldaps and ldap+tls. Can some one please help?? -- Ashwin kumar (http://ashwinkumar.me)

3 6

Fwd: [lmdb] .NET-wrapper for LightningDB
by Howard Chu 10 Jun '13

10 Jun '13

For any C-Sharp fans out there. ---------- Forwarded message ---------- From: *Илья Лукьянов* <ilya.lukyanov(a)gmail.com <mailto:ilya.lukyanov@gmail.com>> Date: 2013/5/26 Subject: .NET-wrapper for LightningDB To: openldap-technical(a)openldap.org <mailto:openldap-technical@openldap.org> Hello, I'm glad to anounce a first version of .NET-wrapper for LightningDB. I've published it here - https://github.com/ilyalukyanov/Lightning.NET I've developed it to use in couple of projects. Hope it will be useful for someone else. Best regards, Ilya Lukyanov.

1 0

Samba + LDAP: Issue adding machine to domain.
by Luis H. Forchesatto 10 Jun '13

10 Jun '13

Greetings. I've run into a trouble when trying to add a new Win7 machine on a domain. The domain is controlled by a server running Samba + LDAP (samba compiled with ldap support), on a Debian 5 OS at the local network. I've added the machine name to the LDAP three through phpldapadmin using the option "Samba3 Machine" on the related submenu and via terminal on samba. Then I renamed the new machine to match the computer name and tried to add it to the domain. When prompted for credentials to add the new machine I've informed the admin login and password and hit <enter>. The windows then returned the following error (something like): "The junction operation was not well succeded. Maybe another existent machine account <machine_account_name> was created previously using anothet set of credentials. User another computer name or contact the admin to remove any obsolete conflicting account. Error: Access denied." Any ideas for the troubleshoot will be welcome. -- Att.* *** Luis H. Forchesatto

1 0

run test suite separately from the source code compilation?
by Meike Stone 10 Jun '13

10 Jun '13

Hello, is it possible and how, to run the complete test suite included in the source tarball later, after installing the openldap rpm/deb package independently and separated from the compilation? Thanks Meike

5 10

Open LDAP ACL and Group
by Dysan 67 10 Jun '13

10 Jun '13

Hello, I have a problem with acl and group. I configured a proxy slapd and add acl (see slapd.conf below) When I run a ldapsearch command with user 'Test User' the attributes are displayed. It's Ok But when I run the same ldapsearch command with user 'Synchro1 User' the message 'Insufficient access (50)' are displayed. It's not ok The user 'Synchro1 User' is member of CN=Grp_Users_UG,OU=Gina,OU=Applications,DC=activedir,DC=example,DC=ch Are you an idea ? Thank you for you help Dysan My environment --------------------- ldapproxy server is CentOS release 5.9 (Final) openldap version 2.3.43 dc1-test Windows Server 2008 R2 (Domain Controler) Ldapsearch command ------------------- $ ldapsearch -x -LLL -H ldaps://ldapproxy.example.ch:636 -D "CN=Test User,OU=TST,OU=USERS,DC=activedir,DC=example,DC=ch" -W -b "dc=activedir,dc=example,dc=ch" -s sub cn=* Enter LDAP Password: dn: ........ ... $ ldapsearch -x -LLL -H ldaps://ldapproxy.example.ch:636 -D "CN=Synchro1 User,OU=TST,OU=USERS,DC=activedir,DC=example,DC=ch" -W -b "dc=activedir,dc=example,dc=ch" -s sub cn=* Enter LDAP Password: Insufficient access (50) slapd.conf ---------- include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args TLSCipherSuite HIGH:-SSLv2 TLSCACertificateFile /etc/openldap/cacerts/cacerts.crt TLSCertificateFile /etc/openldap/cacerts/ldapproxy.example.ch.crt TLSCertificateKeyFile /etc/openldap/cacerts/ldapproxy.example.ch.key loglevel -1 disallow bind_anon # AD database ldap suffix "dc=activedir,dc=example,dc=ch" uri "ldaps://dc1-test.example.ch/" readonly on rebind-as-user lastmod off access to attrs=displayname,sn,givenname,mail,telephoneNumber by dn.exact="CN=Test User,OU=TST,OU=USERS,DC=activedir,DC=example,DC=ch" read by group.exact="CN=Grp_Users_UG,OU=Gina,OU=Applications,DC=activedir,DC=example,DC=ch" read by * none # The users must see the entry itself access to attrs=entry by dn.exact="CN=Test User,OU=TST,OU=USERS,DC=activedir,DC=example,DC=ch" read by group.exact="CN=Grp_Users_UG,OU=Gina,OU=Applications,DC=activedir,DC=example,DC=ch" read by * none # Other attributes, others users have no access access to * by * none #--------------------------------------------------------------------------------------------------------------- slapd.conf end

2 2

Question Sun Directory Server upgrades from version 6.3.1.1.1 to version 11.1.1.5.0
by Far a 09 Jun '13

09 Jun '13

I am new with LDAP. I am not sure if this is proper place to post this. I could use all the help I can get. Our LDAP server side team are upgrading soon. Sun Directory Server upgrades from version 6.3.1.1.1 to version 11.1.1.5.0 My application is just a client using Sun LDAP C SDK. I would like to know if there is any potential issue for me to watch out for. Regards Farhad

2 1

ldap_get_values(..) returns decoding error only during stress test.
by Mangesh Sawant 09 Jun '13

09 Jun '13

Stress test parameters are as follows. TPS : 1000 Users in LDAP DB : 50K LDAP operation performed during stress : ldapsearch. Problem is, user is fetched from LDAP server(verified this with tcpdump), but ldap_get_values returns 'DECODING ERROR'. This happens randomly during stress for 8 or 9 users out of 50K, during stress. If ldap search is performed for a single user, there is no issue. Is this a known issue in OpenLDAP client library ? Is any fix available for this issue. -- Thanks And Regards , Mangesh Sawant .

2 3

olcAuthzRegexp and SASL
by Brendan Kearney 08 Jun '13

08 Jun '13

all, i am working on getting SASL, Kerberos 5, and LDAP working together. i buggered an olcAuthzRegexp and need to correct it. i need to remove the one in place, and replace it with the corrected version. below is what i am trying: ldapmodify -QY EXTERNAL -H ldapi:/// dn: cn=config changetype: delete olcAuthzRegexp: uid=([^,]+),cn=bpk2.com,cn=gssapi,cn=auth uid= $1,ou=Users,dc=bpk2,dc=com - changetype: modify add: olcAuthzRegexp olcAuthzRegexp: {0}uid=([^,]*),cn=bpk2.com,cn=gssapi,cn=auth olcAuthzRegexp: {1}uid=$1,ou=Users,dc=bpk2,dc=com (note, the first olcAuthzRegexp that is to be deleted should be all on one line, and that is why it is wrong. formatting in this message may change the way it looks.) the error i get is:

2 4

[lmdb] mdb_stat with named databases
by JK 08 Jun '13

08 Jun '13

Hi, should using 'mdb_stat' in c work with named databases? In my test, when using 'mdb_dbi_open' with a string name and inserting some data, 'mdb_stat' sets all 'MDB_stat' values to zero. Using an unnamed database or the 'mdb_stat' command-line utility returns expected values. I'm using the gitorius mdb version, commit e7f6767, on linux 3.9.4. Thanks for any insights. relevant code (generated) ---- #include <stdio.h> #include <lmdb.h> #define s(arg) status=arg;if(!(MDB_SUCCESS==status)){puts(mdb_strerror(status));return(status);} int status; MDB_env* env; int main() { MDB_stat stat; int data; MDB_val val; MDB_txn* txn; MDB_dbi dbi; s(mdb_env_create(&env)); s(mdb_env_set_maxdbs(env,10u)); s(mdb_env_set_maxreaders(env,3u)); s(mdb_env_open(env,"/tmp/mdb",0u,384u)); s(mdb_txn_begin(env,0u,0u,&txn)); s(mdb_dbi_open(txn,"testdb",MDB_CREATE,&dbi)); val.mv_size=sizeof(int); val.mv_data=&data; data=123u; s(mdb_put(txn,dbi,&val,&val,0u)); data=124u; s(mdb_put(txn,dbi,&val,&val,0u)); data=125u; s(mdb_put(txn,dbi,&val,&val,0u)); s(mdb_txn_commit(txn)); s(mdb_txn_begin(env,0u,MDB_RDONLY,&txn)); s(mdb_stat(txn,dbi,&stat)); mdb_txn_abort(txn); printf("ms-entries: %lu\nms-depth: %lu\n",stat.ms_entries,stat.ms_depth); mdb_env_close(env); return(0); } ----

1 0

How to build OpenLDAP in Windows?
by Ashwin Kumar 08 Jun '13

08 Jun '13

Can someone point out how to build OpenLDAP windows library using Visual Studio compiler? Compiling in Cygwin or MinGW is not the option now. -- Ashwin kumar (http://ashwinkumar.me)

1 0

Openldap
by Caldwell, Carmela 07 Jun '13

07 Jun '13

We are trying to install Open LDAP, but we are not sure if it will work with z/OS 1.13 mainframe. Does anyone have experience with z/OS mainframe? Thank you, Carmela C. Caldwell Data Security Analyst Bexar ccaldwell(a)bexar.org<mailto:ccaldwell@bexar.org>

2 1

Building 32-bit libraries on 64-bit machine
by Ashwin Kumar 07 Jun '13

07 Jun '13

I am using a 64 bit machine to build OpenLDAP libraries. Building 64-bit libraries works fine. Is there any switch for the configure script to build the 32-bit libraries. Is this documented anywhere? -- Ashwin kumar (http://ashwinkumar.me)

3 5

Per User Search Limits
by Jason Brandt 07 Jun '13

07 Jun '13

I have done some searching, and have been unable to come up with a solution/answer... I'm looking for a way to change the server side search limits on a per user basis. Currently, if we want to maintain global search result limit, it appears that we are required to use the administrator account to bypass the search result limit. Is there any way to enable a user to bypass the search limit? We have a few service accounts that we have created, which we would like to be able to bypass this limit, while still enforcing it for standard users and anonymous. Any suggestions would be greatly appreciated. We're using the olc configuration file format as well, if that matters. -- Jason K. Brandt Systems Administrator Bradley University

3 3

Unable to bind sample program to LDAP server via SSL (ldaps://)
by Ashwin Kumar 06 Jun '13

06 Jun '13

I have a sample program here that is trying to connect to LDAP server on the secured port (ldaps://) However, the sample program is not able to bind to the server. #define LDAP_DEPRECATED 1 #include <stdio.h> #include <ldap.h> #define HOSTNAME "192.168.1.51" #define PORTNUMBER 10389 #define BIND_DN "dc=example,dc=com" #define BIND_PW "secret" int main() { LDAP *ld; int rc; int reqcert = LDAP_OPT_X_TLS_NEVER; int version = LDAP_VERSION3; int ret(0); if (ldap_initialize (&ld, "ldaps://192.168.1.51:10636")) { perror("ldap_init"); /* no error here */ return(1); } ldap_set_option (ld, LDAP_OPT_PROTOCOL_VERSION, &version); ldap_set_option (ld, LDAP_OPT_X_TLS_REQUIRE_CERT, &reqcert); rc = ldap_bind_s(ld, BIND_DN, BIND_PW, LDAP_AUTH_SIMPLE); if( rc != LDAP_SUCCESS ) { fprintf(stderr, "ldap_simple_bind_s: %s\n", ldap_err2string(rc) ); return( 1 ); } printf("Initial Authentication successful\n"); ldap_unbind(ld); } However, with START_TLS the sample program successfully binds to LDAP server running on port 10389. ldapsearch client is able to connect to the server ans search the user base tree. But the sample program above does not. To get it working with START_TLS: Here is what I have added: ldap_set_option (ld, LDAP_OPT_X_TLS_REQUIRE_CERT, &reqcert); rc = ldap_start_tls_s(ld, NULL, NULL); if (rc != LDAP_SUCCESS) { printf("ldap_start_tls() %s",ldap_err2string(ret)); } *Can someone point out what I am missing here for binding to LDAP server via ldaps://??* -- Ashwin kumar (http://ashwinkumar.me)

1 0

Possible ppolicy override for other than rootDN
by Christian Kratzer 05 Jun '13

05 Jun '13

Hi, We have a customer setup where the corporate identity management applications provisions users to the directory, resets their passwords etc... The tool binds as a specific user and we permit write access to appropriate subtress via an acl. The customer also uses password policy to enforce policy in ldap. The problem we have is that the idm tool is obivously also subject to the pwdMinAge and pwdSafeModify policies. The tool never stores a users password so when pwdSafeModify is in effect it cannot provide the old password to satisfy the policy. It obviously also cannot reset the password until pwdMinAge has elapsed. Giving the rootDN credentials to the tool is also not an option as we would like to keep audit logs clean and have the acl in place to stop the tool from writing all over the place. So we would like to override password policy for the idm tools bind user similarly as the rootDN is already able to bypass policy. I found following section in ppolicy.c 1197 static int 1198 ppolicy_bind( Operation *op, SlapReply *rs ) 1199 { 1200 slap_overinst *on = (slap_overinst *)op->o_bd->bd_info; 1201 1202 /* Reset lockout status on all Bind requests */ 1203 if ( !BER_BVISEMPTY( &pwcons[op->o_conn->c_conn_idx].dn )) { 1204 ch_free( pwcons[op->o_conn->c_conn_idx].dn.bv_val); 1205 BER_BVZERO( &pwcons[op->o_conn->c_conn_idx].dn ); 1206 } 1207 1208 /* Root bypasses policy */ 1209 if ( !be_isroot_dn( op->o_bd, &op->o_req_ndn )) { 1210 Entry *e; 1211 int rc; I would think hacking line 1205 one could hardcode additional dn but I am searching for a cleaner more general solution. I was thinking on the lines of having a configurable olcPPolicyOverride with a list of dn that override password policy like the rootDN already does. If I attempted such a patch would it have changes of being accepted from the architectural point of view ? Any other ideas on how to solve above problem ? Greetings Christian -- Christian Kratzer CK Software GmbH Email: ck(a)cksoft.de Wildberger Weg 24/2 Phone: +49 7032 893 997 - 0 D-71126 Gaeufelden Fax: +49 7032 893 997 - 9 HRB 245288, Amtsgericht Stuttgart Web: http://www.cksoft.de/ Geschaeftsfuehrer: Christian Kratzer

3 5

SSHA as default password-hash in next password change
by cbulist＠gmail.com 05 Jun '13

05 Jun '13

Hi, All our users in LDAP database are under MD5 encryption. We want to change this to SSHA in the next user password change. We tried using: password-hash {SSHA} option in slapd.conf and restart the ldap service but it didn't work. The user password are still under MD5 encryption. We are using openldap 2.4.23-26 version. Any clue about this problem?. Thanks in advance! CBU

3 6

Re: extend groupOfURLs
by Michael Ströder 05 Jun '13

05 Jun '13

Carlos. please always follow-up on the mailing list so others can learn and answer as well. Carlos Santos wrote: > ################################################################################ > - # > - objectClass ( 1.3.6.1.4.1.5923.1.1.101 > - NAME 'dygroup' > - DESC 'dynamic group' > - SUP groupOfURLs > - STRUCTURAL > - MUST ( visibility $ groupname $ owner ) ) > - > - > - > ################################################################################ When using this and starting slapd with -d config,stats then it outputs: 51a8b922 line 53 (objectClass ( 1.3.6.1.4.1.5923.1.1.101 NAME 'dygroup' DESC 'dynamic group' SUP groupOfURLs STRUCTURAL MUST ( visibility $ groupname $ owner ) )) 51a8b922 /home/michael/ftp/Linux/Networking/LDAP/OpenLDAP/schema/experimental.schema: line 53 objectClass: AttributeType not found: "visibility" So where's the attribute type description for 'visibility'? => always use debug options when starting slapd after working on custom schema definitions. Ciao, Michael.

2 5

Substring Indexes on userPassword Attribute
by Tim Gustafson 04 Jun '13

04 Jun '13

Hi, I have a need to find out how many of my users are using different password hashing methods, so I went and tried to do this search: ldapsearch -D uid=tjg,ou=People,dc=com -W -b ou=People,dc=com 'userPassword={SHA}*' But that didn't return anything. So I figured maybe I needed to create a substr index on that attribute. When I did that, slapindex returned: slapd.conf: line 82: substr index of attribute "userPassword" disallowed Why is that? How can I do a search that would tell me which of my users is using an SHA-hashed password? -- Tim Gustafson tjg(a)ucsc.edu 831-459-5354 Baskin Engineering, Room 313A

4 8

Usage of the LDAP_OPT_X_SASL_GSS_CREDS
by Bernardo Pastorelli 31 May '13

31 May '13

Not sure if this is the right mailing list. I'm developing an LDAP client that uses GSSAPI as the transport mechanism. I would like to set the credentials to use for binding my user, and it seems that it is possible to set them using the LDAP_OPT_X_SASL_GSS_CREDS option. So I create the ldap context using ldap_initialize and then try to set the credentials using the option above, before calling the ldap_sasl_interactive_bind_s function for binding my user. But the options setting operation fails. Looking at the code, I see that, to set the option, it is necessary that the pointers in the chain below are not null: ld->ld_defconn->lconn_sasl_authctx But they are null after initializing the ldap context. So, which function calls do I have to execute for being able to set credentials before calling the bind function? Any alternative way? Regards, Bernardo Pastorelli

1 0

How to make OpenLDAP use random (v4) UUIDs in entryUUID attribute
by dorian taylor 31 May '13

31 May '13

Hello, It is my understanding that OpenLDAP keys its entries on UUIDs under the hood. I have a system that makes extensive use of UUIDs as canonical (and sometimes public-facing) identifiers, and would like to tap into the UUIDs generated for the objects in the LDAP directory for certain operations over those objects. The problem is I'm using type 4 (random) UUIDs [1] everywhere, and OpenLDAP uses type 1 (time-based). It is important to the system to some extent that these identifiers be resistant to sequencing. As such, they really ought to be random. Since it hasn't been deployed in production yet, the sanest course of action seems to be to bend OpenLDAP to comply. (The alternative would be to maintain a dictionary of some kind, which I'm not keen about.) A survey of the code is as such: OpenLDAP doesn't appear to care which version of UUID it uses save for the generator function itself. The util library is hardcoded [2] to use type 1, and the entryUUID attribute itself is constrained in the schema [3] to not permit modification (where "modification" ostensibly also extends to adding new records). I'm not too familiar with the source but at a glance it appears to accommodate an entryUUID attribute as input [4]. I guess my question is: what's the best strategy? * Relax NO-USER-MODIFY on the entryUUID schema entry and set it at the application layer (easiest but most prone to problems) * Hack uuid.c to use uuid_generate_random instead of uuid_generate (easy, but introduces a maintenance problem) * Create an overlay (no idea where to start but can figure it out) * Figure out some way to make the UUID version configurable and send a patch upstream (most work and would it even be desirable?) Links: 1) http://tools.ietf.org/html/rfc4122#section-4.4 2) http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=blob;f=libraries/… 3) http://tools.ietf.org/html/rfc4530#section-2.4 4) http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=blob;f=servers/sl… -- Dorian Taylor http://doriantaylor.com/

2 4

Re: use ldif backup with operational attributes in conjunction with slapadd?
by Meike Stone 31 May '13

31 May '13

2013/5/30 Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Thursday, May 30, 2013 11:39 AM +0200 Meike Stone > <meike.stone(a)googlemail.com> wrote: > >> Hello, >> >> >> is it possible to use a ldif-backup with operation attributes >> (ldapsearch ... '+' '*') with slapadd, to save the operation >> attributes, if no slapcat backup is available? Are there any concerns? > > > If you can't get a slapcat backup, how would you get a ldapsearch backup? > A seconds reason, why I try to prevent using slapcat on a productive system is: ======================================================= slapd[4812]: bdb(ou=root): PANIC: Permission denied slapd[4812]: bdb(ou=root): DB_ENV->log_newfh: 15752: DB_RUNRECOVERY: Fatal error, run database recovery slapd[4812]: bdb(ou=root): txn_checkpoint: failed to flush the buffer cache: DB_RUNRECOVERY: Fatal error, run database recover slapd[4812]: bdb(ou=root): PANIC: fatal region error detected; run recovery slapd[4812]: null_callback : error code 0x50 slapd[4812]: syncrepl_updateCookie: rid=001 be_modify failed (80) slapd[4812]: do_syncrepl: rid=001 rc 80 retrying (4 retries left) ======================================================= This message I got today on a productive system while getting a ldif via slapcat for setting up an syncrepl slave. This shouldn happen, slapcat (8) manpage tells: "For some backend types, your slapd(8) should not be running (at least, not in read-write mode) when you do this to ensure consistency of the database. *It is always safe to run slapcat with the slapd-bdb(5)*, slapd-hdb(5), and slapd-null(5) backends." So using ldapsearch is more reliable for me ... Kindly regards Meike

2 2

Any issue on random OIDs?
by Geo P.C. 31 May '13

31 May '13

For our openldap server we created custom attributes by giving random OIDs like 2.25.10.1, 2.25.10.100.10 etc . We are able to add custom attributes and the LDAP server is working fine. Please let us know is there any issue in giving random OIDs for attributes and object classes. Also is there any issue in future while using this. Can anyone please advise us on this. Also I came to know that we can create OIDs without registering. From this site http://www.itu.int/ITU-T/asn1/cgi-bin/uuid_generate I can create UUID but from where I can convert this UUID to OID? Suppose when we convert this UUID to decimal shall we can use it permanently without any issue? Please help us on it Thanks Geo* <http://pcgeo.blogspot.in/>*

2 4

About ldapwhoami
by Jacques Foucry 31 May '13

31 May '13

Hello folks, I think I misunderstood something, but I can't make ldapwhoami working. Mu openldap server work perfectly I and all my users can connect using it. But whe I try to use ldapwhoami I get an error: ldapwhoami -x -D uid=jfoucry,ou=people,dc=example,dc=com -W Enter LDAP Password: ldap_bind: Invalid credentials (49) I am sure to use my LDAP password. I try with -d1 to have debug, and I reach to right server. What's going wrong? Thanks in advance for your help, regards, Jacques -- Jacques Foucry *NOVΛSPARKS * IT Manager Tel : +33 (0)1 42 68 12 61 jacques.foucry(a)novasparks.com

3 5

Re: use ldif backup with operational attributes in conjunction with slapadd?
by Meike Stone 31 May '13

31 May '13

2013/5/30 Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Thursday, May 30, 2013 8:04 PM +0200 Meike Stone > <meike.stone(a)googlemail.com> wrote: > >> I want to preserve the operational attributes from the ldapsearch ldif >> (created with '+' '*'). >> But I saw, that a ldapsearch ldif with operational attributes has a >> more operational attributes than from the slapcat ldif. > > > An ldapsearch generated and slapcat generated LDIF of the same db will be > identical for *,+ for ldapsearch. So your statement doesn't really make > much sense. I compared it and found this three additional attributes are in the ldapsearch, but not in slapcat: - entryDN - subschemaSubentry - hasSubordinates It seems, that slapcat ignores this values or at least, it does not complain... Kindly regards Meike

1 0

Re: use ldif backup with operational attributes in conjunction with slapadd?
by Meike Stone 31 May '13

31 May '13

2013/5/30 Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Thursday, May 30, 2013 7:51 PM +0200 Meike Stone > <meike.stone(a)googlemail.com> wrote: > >> 2013/5/30 Quanah Gibson-Mount <quanah(a)zimbra.com>: >>> >>> --On Thursday, May 30, 2013 11:39 AM +0200 Meike Stone >>> <meike.stone(a)googlemail.com> wrote: >>> >>>> Hello, >>>> >>>> >>>> is it possible to use a ldif-backup with operation attributes >>>> (ldapsearch ... '+' '*') with slapadd, to save the operation >>>> attributes, if no slapcat backup is available? Are there any concerns? >>> >>> >>> >>> If you can't get a slapcat backup, how would you get a ldapsearch backup? >>> >> >> That's a a ldif created from a colleague, before the database on the >> test system was deleted.. >> I want to simulate some documented test from this colleague, but ony >> the ldif exist and no slapcat. > > > So slapadd it. slapadd will automatically generate the operational attrs. > > I want to preserve the operational attributes from the ldapsearch ldif (created with '+' '*'). But I saw, that a ldapsearch ldif with operational attributes has a more operational attributes than from the slapcat ldif. Is it possible with this ldif, to create the database like my colleague it used? Thanks Meike

4 4

Post-clone Cleanup of Hostname on Version Query
by Kim, Robert 31 May '13

31 May '13

I've been cloning servers with LDAP server set up on them and the process has been working fine but when I recently queried the version with slapd -V, the hostname of the original server shows up. I tried re-running make and make install with no luck. How can I change the hostname that shows up on the version query without redoing the whole installation? OpenLDAP 2.4.30 Red Hat 5.7 Robert Kim Staff Systems Engineer Lockheed Martin IS&GS National/Defense 3100 Zanker Rd San Jose, CA 95134 408-473-4260 Office 408-505-8717 Cell

3 2

Re: how to take hot backup of MDB ...
by anil beniwal 30 May '13

30 May '13

Hi Sanjay e.g /opt/symas/bin/mdb_copy /openldap-data /backup/ syntax:- mdb_copy /<db-dir> /<backup destination> You only need data.mdb file. We are having very big db size(about 500Gb) and we never face any problem with backup. lock.mdb is not required. You can simply copy back data.mdb to your db directory for restoration and it will work like magic. On Thu, May 30, 2013 at 3:21 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Wednesday, May 29, 2013 2:26 PM -0700 Sanjay Jain <sjain74(a)gmail.com> > wrote: > > How do I take backup of data.mdb and lock.mdb files while server >> is up and provisioning is going on? Is mdb_copy not the right tool for >> this purpose? What am I missing? >> > > a) What version of OpenLDAP are you using? I can mdb_copy a live DB just > fine. > > b) You only need a backup of data.mdb. That's why lock.mdb isn't copied. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > > -- Thanks&Regards Anil Beniwal +919891695048

1 0

Re: use ldif backup with operational attributes in conjunction with slapadd?
by Meike Stone 30 May '13

30 May '13

2013/5/30 Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Thursday, May 30, 2013 11:39 AM +0200 Meike Stone > <meike.stone(a)googlemail.com> wrote: > >> Hello, >> >> >> is it possible to use a ldif-backup with operation attributes >> (ldapsearch ... '+' '*') with slapadd, to save the operation >> attributes, if no slapcat backup is available? Are there any concerns? > > > If you can't get a slapcat backup, how would you get a ldapsearch backup? > That's a a ldif created from a colleague, before the database on the test system was deleted.. I want to simulate some documented test from this colleague, but ony the ldif exist and no slapcat. Kind regards Meike

2 1

use ldif backup with operational attributes in conjunction with slapadd?
by Meike Stone 30 May '13

30 May '13

Hello, is it possible to use a ldif-backup with operation attributes (ldapsearch ... '+' '*') with slapadd, to save the operation attributes, if no slapcat backup is available? Are there any concerns? Thanks Meike

2 1

how to take hot backup of MDB ...
by Sanjay Jain 29 May '13

29 May '13

Hi, I have a server that runs on top of MDB. While provisioning is going on, I would like to take the backup of MDB (data.mdb and lock.mdb files). While trying to use mdb_copy command line tool, I noticed: - mdb_copy utility hangs while server is up, I guess waiting for a lock (on DB?) to be released by the server. - if I shutdown the server, mdb_copy works but copies only data.mdb and NOT lock.mdb How do I take backup of data.mdb and lock.mdb files while server is up and provisioning is going on? Is mdb_copy not the right tool for this purpose? What am I missing? Thanks, Sanjay

2 1

extend groupOfURLs
by Carlos Santos 29 May '13

29 May '13

Greetings, I have a dynamic group whose objectclass is groupOfURLs. I want to add a few parameters to the group, such as groupname and others. However, when I go to the schema file and create my own dygroup objectclass, ldap doesn't accept groupOfURLs as dygroup's SUP objectclass. What am I doing wrong and if possible how to fix it? -- Thanks in advance, Carlos Santos

2 1

bind-dyndb-ldap and AttributeType not found
by Brendan Kearney 29 May '13

29 May '13

all, i am trying to load the bind-dyndb-ldap schema into my ldap instance and keep getting an error 'AttributeType not found: "ARecord"'. from what i can tell, the ARecord AttributeType is defined by the cosine schema, which is loaded and present in the ldap instance. I have the dnszone schema loaded too and i am serving static dns entries out of ldap right now. it would seem that the prerequisites for bind-dyndb-ldap are fulfilled, but i cant load the schema. some details: [root@server cn=schema]# slapd -V @(#) $OpenLDAP: slapd 2.4.26 (Jun 27 2012 15:27:46) $ mockbuild@x86-16.phx2.fedoraproject.org:/builddir/build/BUILD/openldap-2.4.26/openldap-2.4.26/build-servers/servers/slapd [root@server schema]# slaptest -v -d9 -f ./dns-dyndb.schema -F ../slapd.d/cn\=config/cn\=schema/ slaptest init: initiated tool. slap_sasl_init: initialized! bdb_back_initialize: initialize BDB backend bdb_back_initialize: Berkeley DB 5.2.36: (September 14, 2011) hdb_back_initialize: initialize HDB backend hdb_back_initialize: Berkeley DB 5.2.36: (September 14, 2011) null_back_initialize: initialize null backend backend_startup_one: starting "cn=config" ./dns-dyndb.schema: line 296 objectclass: AttributeType not found: "ARecord" slaptest: bad configuration directory! Since the cosine schema is loaded, the ARecord AttributeType is available for reference by this schema, but it does not seem to load. am i missing something obvious? can anyone shed light on this? to make sure i was going about this right, i also tried it this way: [root@server openldap]# cat this.out include /etc/openldap/schema/dns-dyndb.schema [root@server openldap]# slaptest -v -d9 -f /etc/openldap/this.out -F /etc/openldap/slapd.d/ slaptest init: initiated tool. slap_sasl_init: initialized! bdb_back_initialize: initialize BDB backend bdb_back_initialize: Berkeley DB 5.2.36: (September 14, 2011) hdb_back_initialize: initialize HDB backend hdb_back_initialize: Berkeley DB 5.2.36: (September 14, 2011) null_back_initialize: initialize null backend backend_startup_one: starting "cn=config" /etc/openldap/schema/dns-dyndb.schema: line 296 objectclass: AttributeType not found: "ARecord" slaptest: bad configuration directory! still got the error...

1 1

Re: ldap query performance issue
by Meike Stone 28 May '13

28 May '13

Hello, because of this, does it make sense in a directory with > 1,000,000 people to index the sex? thanks Meike 2013/5/23 Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Thursday, May 23, 2013 4:40 PM +0000 Chris Card <ctcard(a)hotmail.com> > wrote: > >> Hi all, >> >> I have an openldap directory with about 7 million DNs, running openldap >> 2.4.31 with a BDB backend (4.6.21), running on CentOS 6.3. >> >> The structure of the directory is like this, with suffix dc=x,dc=y >> >> dc=x,dc=y >> account=a,dc=x,dc=y >> mail=m,account=a,dc=x,dc=y // Users >> .... >> licenceId=l,account=a,dc=x,dc=y // Licences, >> objectclass=licence .... >> group=g,account=a,dc=x,dc=y // Groups >> .... >> // etc. >> >> account=b,dc=x,dc=y >> .... >> >> Most of the DNs in the directory are users or groups, and the number of >> licences is small (<10) for each account. >> >> If I do a query with basedn account=a,dc=x,dc=y and filter >> (objectclass=licence) I see wildly different performance, depending on >> how many users are under account a. For an account with ~30000 users the >> query takes 2 seconds at most, but for an account with ~60000 users the >> query takes 1 minute. >> >> It only appears to be when I filter on objectclass=licence that I see >> that behaviour. If I filter on a different objectclass which matches a >> similar number of objects to the objectclass=licence filter, the >> performance doesn't seem to depend on the number of users. >> >> There is an index on objectclass (of course), but the behaviour I'm >> seeing seems to indicate that for this query, at some point slapd stops >> using the index and just scans all the objects under the account. >> >> Any ideas? > > > Increase the IDL range. This is how I do it: > > --- openldap-2.4.35/servers/slapd/back-bdb/idl.h.orig 2011-02-17 > 16:32:02.598593211 -0800 > +++ openldap-2.4.35/servers/slapd/back-bdb/idl.h 2011-02-17 > 16:32:08.937757993 -0800 > @@ -20,7 +20,7 @@ > /* IDL sizes - likely should be even bigger > * limiting factors: sizeof(ID), thread stack size > */ > -#define BDB_IDL_LOGN 16 /* DB_SIZE is 2^16, UM_SIZE is 2^17 > */ > +#define BDB_IDL_LOGN 17 /* DB_SIZE is 2^16, UM_SIZE is 2^17 > */ > #define BDB_IDL_DB_SIZE (1<<BDB_IDL_LOGN) > #define BDB_IDL_UM_SIZE (1<<(BDB_IDL_LOGN+1)) > #define BDB_IDL_UM_SIZEOF (BDB_IDL_UM_SIZE * sizeof(ID)) > > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 4

RE: ldap query performance issue
by Chris Card 28 May '13

28 May '13

---------------------------------------- > From: ctcard(a)hotmail.com > To: quanah(a)zimbra.com > Subject: RE: ldap query performance issue > Date: Thu, 23 May 2013 17:37:18 +0000 > > ---------------------------------------- >> Date: Thu, 23 May 2013 10:06:51 -0700 >> From: quanah(a)zimbra.com >> To: ctcard(a)hotmail.com; openldap-technical(a)openldap.org >> Subject: Re: ldap query performance issue >> >> --On Thursday, May 23, 2013 4:40 PM +0000 Chris Card <ctcard(a)hotmail.com> >> wrote: >> >>> Hi all, >>> >>> I have an openldap directory with about 7 million DNs, running openldap >>> 2.4.31 with a BDB backend (4.6.21), running on CentOS 6.3. >>> >>> The structure of the directory is like this, with suffix dc=x,dc=y >>> >>> dc=x,dc=y >>> account=a,dc=x,dc=y >>> mail=m,account=a,dc=x,dc=y // Users >>> .... >>> licenceId=l,account=a,dc=x,dc=y // Licences, >>> objectclass=licence .... >>> group=g,account=a,dc=x,dc=y // Groups >>> .... >>> // etc. >>> >>> account=b,dc=x,dc=y >>> .... >>> >>> Most of the DNs in the directory are users or groups, and the number of >>> licences is small (<10) for each account. >>> >>> If I do a query with basedn account=a,dc=x,dc=y and filter >>> (objectclass=licence) I see wildly different performance, depending on >>> how many users are under account a. For an account with ~30000 users the >>> query takes 2 seconds at most, but for an account with ~60000 users the >>> query takes 1 minute. >>> >>> It only appears to be when I filter on objectclass=licence that I see >>> that behaviour. If I filter on a different objectclass which matches a >>> similar number of objects to the objectclass=licence filter, the >>> performance doesn't seem to depend on the number of users. >>> >>> There is an index on objectclass (of course), but the behaviour I'm >>> seeing seems to indicate that for this query, at some point slapd stops >>> using the index and just scans all the objects under the account. >>> >>> Any ideas? >> >> Increase the IDL range. This is how I do it: >> >> --- openldap-2.4.35/servers/slapd/back-bdb/idl.h.orig 2011-02-17 >> 16:32:02.598593211 -0800 >> +++ openldap-2.4.35/servers/slapd/back-bdb/idl.h 2011-02-17 >> 16:32:08.937757993 -0800 >> @@ -20,7 +20,7 @@ >> /* IDL sizes - likely should be even bigger >> * limiting factors: sizeof(ID), thread stack size >> */ >> -#define BDB_IDL_LOGN 16 /* DB_SIZE is 2^16, UM_SIZE is 2^17 >> */ >> +#define BDB_IDL_LOGN 17 /* DB_SIZE is 2^16, UM_SIZE is 2^17 >> */ >> #define BDB_IDL_DB_SIZE (1<<BDB_IDL_LOGN) >> #define BDB_IDL_UM_SIZE (1<<(BDB_IDL_LOGN+1)) >> #define BDB_IDL_UM_SIZEOF (BDB_IDL_UM_SIZE * sizeof(ID)) > Thanks, that looks like it might be the issue. Unfortunately I only see the issue in production, so patching it might be a pain. I've tried this change, but it made no difference to the performance of the query. Chris

4 6

[lmdb] MDB_BAD_RSLOT for mdb_txn_get()
by Ben Johnson 24 May '13

24 May '13

I'm using the gomdb interface so I'll do my best to translate this to the C calls. I'm performing an mdb_txn_put(), committing the transaction and then later I'm opening a new read-only transaction where I do an mdb_txn_get() and I receive a "MDB_BAD_RSLOT: Invalid reuse of reader locktable slot" error. When I switch the second transaction to not be read-only then the error goes away and it works fine. I checked the LMDB code and on line 1798, it's checking: if (r->mr_pid != env->me_pid || r->mr_txnid != (txnid_t)-1) return MDB_BAD_RSLOT; The r->mr_pid == env->me_pid (I'm only running one process) and the r->mr_txnid is 0 and the txnid_t is 0 (so the txnid_t - 1 is -1). I started going down the rabbit hole to figure this out further but I don't understand the locktable setup entirely. Am I doing something wrong with how I'm creating read-only transactions? Ben Johnson ben(a)skylandlabs.com

2 1

Can I distribute salted-hashed passwords on different machines?
by Marco Pizzoli 23 May '13

23 May '13

Hi all, I think I already know the answer, but I would like to be absolutely sure about it. Could I generate a {SSHA1} hash of a password (to be used for the rootdn account) with the help of slappasswd utility on a system and reuse that salted hash for the very same purpose but on a different operating system? Thanks in advance again Marco

3 2

ldap query performance issue
by Chris Card 23 May '13

23 May '13

Hi all, I have an openldap directory with about 7 million DNs, running openldap 2.4.31 with a BDB backend (4.6.21), running on CentOS 6.3. The structure of the directory is like this, with suffix dc=x,dc=y dc=x,dc=y account=a,dc=x,dc=y mail=m,account=a,dc=x,dc=y // Users .... licenceId=l,account=a,dc=x,dc=y // Licences, objectclass=licence .... group=g,account=a,dc=x,dc=y // Groups .... // etc. account=b,dc=x,dc=y .... Most of the DNs in the directory are users or groups, and the number of licences is small (<10) for each account. If I do a query with basedn account=a,dc=x,dc=y and filter (objectclass=licence) I see wildly different performance, depending on how many users are under account a. For an account with ~30000 users the query takes 2 seconds at most, but for an account with ~60000 users the query takes 1 minute. It only appears to be when I filter on objectclass=licence that I see that behaviour. If I filter on a different objectclass which matches a similar number of objects to the objectclass=licence filter, the performance doesn't seem to depend on the number of users. There is an index on objectclass (of course), but the behaviour I'm seeing seems to indicate that for this query, at some point slapd stops using the index and just scans all the objects under the account. Any ideas? Chris

2 1

Invalid manager attribute when in form 1.3.6.1.4.1.1466.0=#04024869,O=Test,C=GB
by Soulier, Marcel 23 May '13

23 May '13

Hi, I am trying to import the following ldif file into openldap and get the error message "manager: value #0 invalid per syntax". test.ldif: dn: cn=test,o=users,dc=example,dc=com objectClass: top objectClass: person cn: test manager: 1.3.6.1.4.1.1466.0=#04024869,O=Test,C=GB Console output: adding new entry "cn=test,o=users,dc=example,dc=com" ldap_add: Invalid syntax (21) additional info: manager: value #0 invalid per syntax According to the cosine.schema the value of the manager attribute should have the EQUALITY distinguishedNameMatch, SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 The value "1.3.6.1.4.1.1466.0=#04024869,O=Test,C=GB" is taken from the examples provided for DN in rfc2252 and works fine in open-ds. So I would expect it to work in openldap as well. What am I missing? Marcel Marcel.Soulier(a)opitz-consulting.com<mailto:Marcel.Soulier@opitz-consulting.com>

3 4

Deadlock problem on objectClass.bdb
by Maxim Shaposhnik 23 May '13

23 May '13

Hi, I'm faced with the OpenLDAP freeze problem on concurrent item modification. OS type\version is FC17, OpenLDAP 2.4.35. Tried both BerkrleyDB versions 5.2.36 and latest 5.3.21. DB size is about 50K. >From my experiments, LDAP stops responding when the count of locks on objectClass.bdb reaches 3 (when less than 3, seems it resolves OK): 80000573 READ 3 HELD objectClass.bdb page 3 80000573 WRITE 7 HELD objectClass.bdb page 3 800001b6 READ 1 WAIT objectClass.bdb page 3 I also tried different locks detector schemes (different values for set_lk_detect ) without success. What may be a root cause of such situation? This is my full db_stat output: db_stat -CA Default locking region information: 19 Last allocated locker ID 0x7fffffff Current maximum unused locker ID 9 Number of lock modes 200 Initial number of locks allocated 0 Initial number of lockers allocated 200 Initial number of lock objects allocated 3000 Maximum number of locks possible 1500 Maximum number of lockers possible 1500 Maximum number of lock objects possible 200 Current number of locks allocated 15 Current number of lockers allocated 200 Current number of lock objects allocated 40 Number of lock object partitions 2053 Size of object hash table 46 Number of current locks 115 Maximum number of locks at any one time 6 Maximum number of locks in any one bucket 11 Maximum number of locks stolen by for an empty partition 4 Maximum number of locks stolen for any one partition 13 Number of current lockers 15 Maximum number of lockers at any one time 26 Number of current lock objects 74 Maximum number of lock objects at any one time 2 Maximum number of lock objects in any one bucket 0 Maximum number of objects stolen by for an empty partition 0 Maximum number of objects stolen for any one partition 88126 Total number of locks requested 87895 Total number of locks released 0 Total number of locks upgraded 16 Total number of locks downgraded 174 Lock requests not available due to conflicts, for which we waited 153 Lock requests not available due to conflicts, for which we did not wait 11 Number of deadlocks 0 Lock timeout value 0 Number of locks that have timed out 0 Transaction timeout value 0 Number of transactions that have timed out 2MB 504KB Region size 16 The number of partition locks that required waiting (0%) 8 The maximum number of times any partition lock was waited for (0%) 0 The number of object queue operations that required waiting (0%) 1 The number of locker allocations that required waiting (0%) 2 The number of region locks that required waiting (0%) 2 Maximum hash bucket length =-=-=-=-=-=-=-=-=-=-=-=-=-=-=- =-=-=-=-=-=-=-=-=-= Lock REGINFO information: Environment Region type 1 Region ID __db.001 Region name 0x7fc6ffe7f000 Region address 0x7fc6ffe7f0a0 Region allocation head 0x7fc70007f5b0 Region primary address 0 Region maximum allocation 0 Region allocated Region allocations: 2874 allocations, 0 failures, 2750 frees, 7 longest Allocations by power-of-two sizes: 1KB 2869 2KB 0 4KB 1 8KB 0 16KB 0 32KB 0 64KB 2 128KB 0 256KB 1 512KB 0 1024KB 1 REGION_SHARED Region flags =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Lock region parameters: 2 Lock region region mutex [2/59655 0% 25161/140492677707584] <wakeups 0/1> 2053 locker table size 2053 object table size 2099280 obj_off 2316456 locker_off 1 need_dd =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Lock conflict matrix: =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Locks grouped by lockers: Locker Mode Count Status ----------------- Object --------------- e dd=11 locks held 1 write locks 0 pid/thread 23242/140324977571648 flags 10 priority 100 e READ 1 HELD id2entry.bdb handle 0 f dd=10 locks held 1 write locks 0 pid/thread 23242/140324977571648 flags 10 priority 100 f READ 1 HELD dn2id.bdb handle 0 10 dd= 9 locks held 0 write locks 0 pid/thread 23242/140324977571648 flags 0 priority 100 11 dd= 6 locks held 1 write locks 0 pid/thread 23242/140324451448576 flags 10 priority 100 11 READ 1 HELD objectClass.bdb handle 0 12 dd= 5 locks held 1 write locks 0 pid/thread 23242/140324451448576 flags 10 priority 100 12 READ 1 HELD cloudIdeAliases.bdb handle 0 13 dd= 4 locks held 1 write locks 0 pid/thread 23242/140324451448576 flags 10 priority 100 13 READ 1 HELD ou.bdb handle 0 8000019c dd= 8 locks held 0 write locks 0 pid/thread 23242/140324977571648 flags 0 priority 100 8000019d dd= 7 locks held 0 write locks 0 pid/thread 23242/140324451448576 flags 0 priority 100 800001a1 dd= 3 locks held 0 write locks 0 pid/thread 23242/140324443055872 flags 0 priority 100 800001b6 dd= 2 locks held 0 write locks 0 pid/thread 23242/140324332623616 flags 0 priority 100 800001b6 READ 1 WAIT objectClass.bdb page 3 8000045f dd= 1 locks held 1 write locks 1 pid/thread 23242/140324164859648 flags 0 priority 100 8000045f WRITE 1 HELD cloudIdeAliases.bdb page 5337 80000572 dd= 0 locks held 2 write locks 0 pid/thread 23242/140324451448576 flags 0 priority 100 80000572 READ 1 HELD 0x23f140 len: 9 data: 020000000000000000 80000572 READ 1 HELD dn2id.bdb page 10752 80000573 dd= 0 locks held 36 write locks 19 pid/thread 23242/140324451448576 flags 0 priority 100 80000573 READ 1 WAIT cloudIdeAliases.bdb page 5337 80000573 WRITE 1 HELD cloudIdeAliases.bdb page 4604 80000573 READ 1 HELD cloudIdeAliases.bdb page 4604 80000573 WRITE 1 HELD cloudIdeAliases.bdb page 6375 80000573 READ 1 HELD cloudIdeAliases.bdb page 6375 80000573 WRITE 1 HELD cloudIdeAliases.bdb page 200 80000573 READ 1 HELD cloudIdeAliases.bdb page 200 80000573 WRITE 1 HELD cloudIdeAliases.bdb page 1438 80000573 READ 1 HELD cloudIdeAliases.bdb page 1438 80000573 WRITE 1 HELD cloudIdeAliases.bdb page 16 80000573 READ 1 HELD cloudIdeAliases.bdb page 16 80000573 WRITE 1 HELD cloudIdeAliases.bdb page 286 80000573 READ 1 HELD cloudIdeAliases.bdb page 286 80000573 WRITE 1 HELD cloudIdeAliases.bdb page 2308 80000573 READ 1 HELD cloudIdeAliases.bdb page 2308 80000573 WRITE 1 HELD cloudIdeAliases.bdb page 4708 80000573 READ 1 HELD cloudIdeAliases.bdb page 4708 80000573 WRITE 1 HELD cloudIdeAliases.bdb page 123 80000573 READ 1 HELD cloudIdeAliases.bdb page 123 80000573 WRITE 1 HELD cloudIdeAliases.bdb page 540 80000573 READ 1 HELD cloudIdeAliases.bdb page 540 80000573 WRITE 1 HELD cloudIdeAliases.bdb page 4737 80000573 READ 1 HELD cloudIdeAliases.bdb page 4737 80000573 WRITE 1 HELD cloudIdeAliases.bdb page 2806 80000573 READ 1 HELD cloudIdeAliases.bdb page 2806 80000573 WRITE 1 HELD ou.bdb page 271 80000573 READ 1 HELD ou.bdb page 271 80000573 WRITE 7 HELD objectClass.bdb page 3 80000573 READ 3 HELD objectClass.bdb page 3 80000573 WRITE 3 HELD objectClass.bdb page 2 80000573 READ 1 HELD objectClass.bdb page 2 80000573 WRITE 1 HELD dn2id.bdb page 10234 80000573 READ 1 HELD dn2id.bdb page 10234 80000573 WRITE 1 HELD dn2id.bdb page 2 80000573 READ 1 HELD dn2id.bdb page 2 80000573 WRITE 1 HELD dn2id.bdb page 10225 80000573 WRITE 1 HELD dn2id.bdb page 10752 =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Locks grouped by object: Locker Mode Count Status ----------------- Object --------------- 80000573 READ 1 HELD cloudIdeAliases.bdb page 4604 80000573 WRITE 1 HELD cloudIdeAliases.bdb page 4604 80000573 READ 1 HELD cloudIdeAliases.bdb page 4708 80000573 WRITE 1 HELD cloudIdeAliases.bdb page 4708 80000573 READ 1 HELD cloudIdeAliases.bdb page 540 80000573 WRITE 1 HELD cloudIdeAliases.bdb page 540 13 READ 1 HELD ou.bdb handle 0 80000573 READ 1 HELD cloudIdeAliases.bdb page 2806 80000573 WRITE 1 HELD cloudIdeAliases.bdb page 2806 80000573 READ 1 HELD cloudIdeAliases.bdb page 4737 80000573 WRITE 1 HELD cloudIdeAliases.bdb page 4737 80000573 READ 1 HELD ou.bdb page 271 80000573 WRITE 1 HELD ou.bdb page 271 80000572 READ 1 HELD dn2id.bdb page 10752 80000573 WRITE 1 HELD dn2id.bdb page 10752 e READ 1 HELD id2entry.bdb handle 0 8000045f WRITE 1 HELD cloudIdeAliases.bdb page 5337 80000573 READ 1 WAIT cloudIdeAliases.bdb page 5337 80000573 READ 1 HELD cloudIdeAliases.bdb page 1438 80000573 WRITE 1 HELD cloudIdeAliases.bdb page 1438 f READ 1 HELD dn2id.bdb handle 0 80000573 READ 1 HELD dn2id.bdb page 2 80000573 WRITE 1 HELD dn2id.bdb page 2 80000572 READ 1 HELD 0x23f140 len: 9 data: 020000000000000000 80000573 READ 1 HELD dn2id.bdb page 10234 80000573 WRITE 1 HELD dn2id.bdb page 10234 80000573 WRITE 1 HELD dn2id.bdb page 10225 80000573 READ 1 HELD cloudIdeAliases.bdb page 123 80000573 WRITE 1 HELD cloudIdeAliases.bdb page 123 12 READ 1 HELD cloudIdeAliases.bdb handle 0 80000573 READ 1 HELD cloudIdeAliases.bdb page 16 80000573 WRITE 1 HELD cloudIdeAliases.bdb page 16 80000573 READ 1 HELD cloudIdeAliases.bdb page 200 80000573 WRITE 1 HELD cloudIdeAliases.bdb page 200 80000573 READ 1 HELD cloudIdeAliases.bdb page 6375 80000573 WRITE 1 HELD cloudIdeAliases.bdb page 6375 80000573 READ 3 HELD objectClass.bdb page 3 80000573 WRITE 7 HELD objectClass.bdb page 3 800001b6 READ 1 WAIT objectClass.bdb page 3 80000573 READ 1 HELD objectClass.bdb page 2 80000573 WRITE 3 HELD objectClass.bdb page 2 11 READ 1 HELD objectClass.bdb handle 0 80000573 READ 1 HELD cloudIdeAliases.bdb page 2308 80000573 WRITE 1 HELD cloudIdeAliases.bdb page 2308 80000573 READ 1 HELD cloudIdeAliases.bdb page 286 80000573 WRITE 1 HELD cloudIdeAliases.bdb page 286

2 3

Syncrepl and selected subtrees
by Marco Pizzoli 23 May '13

23 May '13

Hi all, I would like a hint on how to syncreplicate only a group of subtrees from a master DIT. In example, if I have a BaseDN called "ou=root,dc=my_domain" with 4 subtrees at the first nesting level (ou=subtree1, ou=subtree2, and so on..), how can I configure a slave to syncrepl only subtree1 and subtree3? Graphically: ou=root,dc=my_domain |- ou=subtree1 |- ou=subtree2 |- ou=subtree3 |- ou=subtree4 Of course, I could use a dedicated user with ACL-masqueraded data to her, but what if I couldn't? Is there a way to express this purpose on the "replica" configuration? Thanks in advance Marco

1 0

MaxDBs
by Ben Johnson 23 May '13

23 May '13

Is there an upper limit to mdb_env_set_maxdbs()? And what's the overhead for adding additional DBs? Can I change this number once it's set if I close and reopen the env? Ben Johnson ben(a)skylandlabs.com

3 3

Different admin passwords on replica servers
by Thomas Macaigne 22 May '13

22 May '13

Hello, I have two servers in a N-Way MultiMaster / MirrorMode setup. Everything works fine, backend and cn=config is replicated. But I would like to have a different password for the cn=admin,dc=xxx=dc,dc=fr account. How would one do this ? Regards,

2 1

Syncrepl unregularly stops on slaves, leaving DB in inconsistent state
by Karsten.Kroesch＠swisscom.com 22 May '13

22 May '13

Hello OpenLDAP users, I have a Syncrepl setup with one master server and seven slaves. The slaves are mail servers running Postfix, SpamAssassin and Amavis as LDAP clients and have a relatively heavy load. Every two weeks or so (not regularly) the Syncrepl stops on some of the slaves are stopping; there are no Syncrepl requests from the slaves any more. Restarting the Slapd on the slaves fixes the problem in most cases, but sometimes some entries are not replicated until I modify them manually on the master. After that, it works fine again. My OpenLDAP version is 2.4.23 running on SunOS 5.10 Generic_139555-08 sun4v sparc SUNW,Sun-Fire-T1000 Solaris. The servers that are affected more often are running in non-global zone. Any ideas would be helpful. Thanks in advance, Karsten Kroesch ____________________________ Internet Application Engineer Applications Operations karsten.kroesch(a)swisscom.com ____________________________ Swisscom (Schweiz) AG Corporate Business Unit Müllerstrasse 16 8004 Zürich ____________________________ -------8<--------------------------------------- Affected entries, log files and configuration see below: # # On the master: # ldapsearch mail=mthudianplackal(a)[domain-deleted].ch # extended LDIF # # LDAPv3 # base <dc=ip-plus, dc=net> (default) with scope subtree # filter: mail=mthudianplackal(a)[domain-deleted].ch # requesting: ALL # # mthudianplackal(a)[domain-deleted].ch, [domain-deleted].ch, vsf, ip-plus.net dn: mail=mthudianplackal(a)[domain-deleted].ch,dc=[domain-deleted].ch,ou=vsf,dc=ip-plus, dc=net objectClass: top objectClass: mailObject objectClass: amavisAccount mail: mthudianplackal(a)[domain-deleted].ch # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 # On some of the slaves: $ ldapsearch mail=mthudianplackal(a)[domain-deleted].ch # extended LDIF # # LDAPv3 # base <dc=ip-plus, dc=net> (default) with scope subtree # filter: mail=mthudianplackal(a)[domain-deleted].ch # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 Log files at the time, the entries were made: May 16 11:56:20 v-vsf4 slapd[14302]: [ID 538834 local4.debug] daemon: select: listen=7 active_threads=0 tvp=zero May 16 11:56:20 v-vsf4 slapd[14302]: [ID 538834 local4.debug] daemon: select: listen=8 active_threads=0 tvp=zero May 16 11:56:31 v-vsf4 slapd[14302]: [ID 538834 local4.debug] daemon: select: listen=7 active_threads=0 tvp=zero May 16 11:56:31 v-vsf4 slapd[14302]: [ID 538834 local4.debug] daemon: select: listen=8 active_threads=0 tvp=zero May 16 11:56:31 v-vsf4 slapd[14302]: [ID 365351 local4.debug] do_syncrep2: rid=000 LDAP_RES_SEARCH_RESULT # 15 Seconds no action -- unusual on a server with heavy load. May 16 11:56:46 v-vsf4 slapd[14302]: [ID 538834 local4.debug] daemon: select: listen=7 active_threads=0 tvp=zero May 16 11:56:46 v-vsf4 slapd[14302]: [ID 538834 local4.debug] daemon: select: listen=8 active_threads=0 tvp=zero May 16 11:56:46 v-vsf4 slapd[14302]: [ID 977386 local4.debug] syncrepl_entry: rid=000 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) May 16 11:56:46 v-vsf4 slapd[14302]: [ID 580501 local4.debug] syncrepl_entry: rid=000 inserted UUID a36b3802-525a-1032-9442-17888436c71f May 16 11:56:46 v-vsf4 slapd[14302]: [ID 565591 local4.debug] syncrepl_entry: rid=000 be_search (0) May 16 11:56:46 v-vsf4 slapd[14302]: [ID 709484 local4.debug] syncrepl_entry: rid=000 mail=mthudianplackal(a)[domain-deleted].ch,dc=[domain-deleted].ch,ou=vsf,dc=ip-plus,dc=net May 16 11:56:48 v-vsf4 slapd[14302]: [ID 601841 local4.debug] daemon: activity on 1 descriptor May 16 11:56:48 v-vsf4 slapd[14302]: [ID 538834 local4.debug] daemon: select: listen=7 active_threads=0 tvp=zero May 16 11:56:48 v-vsf4 slapd[14302]: [ID 300852 local4.debug] daemon: listen=8, new connection on 91 May 16 11:56:48 v-vsf4 slapd[14302]: [ID 538834 local4.debug] daemon: select: listen=8 active_threads=0 tvp=zero May 16 11:56:48 v-vsf4 slapd[14302]: [ID 368480 local4.debug] daemon: added 91r (active) listener=0 May 16 11:56:48 v-vsf4 slapd[14302]: [ID 848112 local4.debug] conn=35253 fd=91 ACCEPT from IP=192.168.1.4:45922 (IP=0.0.0.0:389) May 16 11:56:48 v-vsf4 slapd[14302]: [ID 601841 local4.debug] daemon: activity on 1 descriptor May 16 11:56:48 v-vsf4 slapd[14302]: [ID 609413 local4.debug] daemon: waked May 16 11:56:48 v-vsf4 slapd[14302]: [ID 538834 local4.debug] daemon: select: listen=7 active_threads=0 tvp=zero May 16 11:56:48 v-vsf4 slapd[14302]: [ID 538834 local4.debug] daemon: select: listen=8 active_threads=0 tvp=zero May 16 11:56:48 v-vsf4 slapd[14302]: [ID 601841 local4.debug] daemon: activity on 1 descriptor May 16 11:56:48 v-vsf4 slapd[14302]: [ID 802679 local4.debug] daemon: activity on: May 16 11:56:48 v-vsf4 slapd[14302]: [ID 522297 local4.debug] 91r May 16 11:56:48 v-vsf4 slapd[14302]: [ID 100000 local4.debug] May 16 11:56:48 v-vsf4 slapd[14302]: [ID 694296 local4.debug] daemon: read activity on 91 May 16 11:56:48 v-vsf4 slapd[14302]: [ID 538834 local4.debug] daemon: select: listen=7 active_threads=0 tvp=zero May 16 11:56:48 v-vsf4 slapd[14302]: [ID 215403 local4.debug] conn=35253 op=0 BIND dn="" method=128 May 16 11:56:48 v-vsf4 slapd[14302]: [ID 538834 local4.debug] daemon: select: listen=8 active_threads=0 tvp=zero May 17 08:43:18 v-vsf4 slapd[14302]: [ID 515743 local4.debug] syncrepl_entry: rid=000 be_add mail=mthudianplackal(a)[domain-deleted].ch,dc=[domain-deleted].ch,ou=vsf,dc=ip-plus,dc=net (0) May 17 08:43:34 v-vsf4 slapd[3312]: [ID 709484 local4.debug] syncrepl_entry: rid=000 mail=mthudianplackal(a)[domain-deleted].ch,dc=[domain-deleted].ch,ou=vsf,dc=ip-plus,dc=net May 17 08:43:34 v-vsf4 slapd[3312]: [ID 515743 local4.debug] syncrepl_entry: rid=000 be_add mail=mthudianplackal(a)[domain-deleted].ch,dc=[domain-deleted].ch,ou=vsf,dc=ip-plus,dc=net (68) May 17 08:43:34 v-vsf4 slapd[3312]: [ID 933660 local4.debug] syncrepl_entry: rid=000 be_modify mail=mthudianplackal(a)[domain-deleted].ch,dc=[domain-deleted].ch,ou=vsf,dc=ip-plus,dc=net (0) May 17 08:43:47 v-vsf4 slapd[3312]: [ID 338579 local4.debug] nonpresent_callback: rid=000 nonpresent UUID a36b3802-525a-1032-9442-17888436c71f, dn mail=mthudianplackal(a)[domain-deleted].ch,dc=[domain-deleted].ch,ou=vsf,dc=ip-plus,dc=net May 17 08:43:48 v-vsf4 slapd[3312]: [ID 905397 local4.debug] syncrepl_del_nonpresent: rid=000 be_delete mail=mthudianplackal(a)[domain-deleted].ch,dc=[domain-deleted].ch,ou=vsf,dc=ip-plus,dc=net (0) May 17 10:11:05 v-vsf4 slapd[3312]: [ID 469902 local4.debug] conn=1480 op=1 SRCH base="dc=ip-plus,dc=net" scope=2 deref=0 filter="(mail=mthudianplackal(a)[domain-deleted].ch)" May 17 10:39:39 v-vsf4 slapd[3312]: [ID 469902 local4.debug] conn=1595 op=1 SRCH base="dc=ip-plus,dc=net" scope=2 deref=0 filter="(mail=mthudianplackal(a)[domain-deleted].ch)" May 17 10:41:15 v-vsf4 slapd[3312]: [ID 469902 local4.debug] conn=1599 op=1 SRCH base="dc=ip-plus,dc=net" scope=2 deref=0 filter="(mail=mthudianplackal(a)[domain-deleted].ch)" May 17 10:41:22 v-vsf4 slapd[3312]: [ID 709484 local4.debug] syncrepl_entry: rid=000 mail=mthudianplackal(a)[domain-deleted].ch,dc=[domain-deleted].ch,ou=vsf,dc=ip-plus,dc=net May 17 10:41:22 v-vsf4 slapd[3312]: [ID 515743 local4.debug] syncrepl_entry: rid=000 be_add mail=mthudianplackal(a)[domain-deleted].ch,dc=[domain-deleted].ch,ou=vsf,dc=ip-plus,dc=net (0) May 17 10:41:37 v-vsf4 slapd[3312]: [ID 469902 local4.debug] conn=1601 op=1 SRCH base="dc=ip-plus,dc=net" scope=2 deref=0 filter="(mail=mthudianplackal(a)[domain-deleted].ch)" May 17 10:41:37 v-vsf4 slapd[3312]: [ID 580335 local4.debug] conn=1601 op=1 ENTRY dn="mail=mthudianplackal(a)[domain-deleted].ch,dc=[domain-deleted].ch,ou=vsf,dc=ip-plus,dc=net" Master configuration: # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/amavisd-new.schema include /etc/openldap/schema/ipplus.schema pidfile /var/run/slapd.pid argsfile /var/run/slapd.args # allow ldap protocol v2 allow bind_v2 # debug level loglevel 256 ####################################################################### # ldbm database definitions ####################################################################### database bdb suffix "dc=ip-plus,dc=net" rootdn "cn=root,dc=ip-plus,dc=net" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw swisscom # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd/tools. Mode 700 recommended. directory /var/openldap-data # Indices to maintain index objectclass,entryCSN,entryUUID eq index dc,cn,mail eq ####################################################################### # replication ####################################################################### overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 On the slaves, the config looks like: [ ... same as above, execpt replication: ] ####################################################################### # replication ####################################################################### syncrepl rid=0 provider=ldap://v-ldapmaster-lan:389 type=refreshOnly interval=00:00:00:15 searchbase="dc=ip-plus,dc=net" filter="(objectClass=*)" scope=sub attrs="*" bindmethod=simple binddn="cn=root,dc=ip-plus,dc=net" credentials=swisscom schemachecking=off retry="5 +"

2 1

Rationale for compulsory objectClass top in RFC2256 5.1
by Christian Kratzer 21 May '13

21 May '13

Hi, I have always wondered about directories that have included objectClass top in every entry even though practically any usefull objectClass inherits from top eventually. Apparantly RFC2256 5.1 requests this: 5.1. objectClass The values of the objectClass attribute describe the kind of object which an entry represents. The objectClass attribute is present in every entry, with at least two values. One of the values is either "top" or "alias". ( 2.5.4.0 NAME 'objectClass' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 ) It seems RFC4512 addresses the matter in: A.3. Changes to RFC 2256 This document incorporates Sections 5.1, 5.2, 7.1, and 7.2 of RFC 2256. Section 5.1 of RFC 2256 provided the definition of the 'objectClass' attribute type. This was integrated into Section 2.4.1 of this document. The statement "One of the values is either 'top' or 'alias'" was replaced with statement that one of the values is 'top' as entries belonging to 'alias' also belong to 'top'. So this means objectClass top is still compulsory in every entry as in: dn: cn=bar,dc=example,dc=com objectClass: top objectClass: alias objectClass: extensibleObject which means somehting like the following would be illegal: dn: cn=Hugo,dc=example,dc=com objectClass: person Can anybody comment on the rationale why this is needed ? I somehow completely fail to see the purpose. Greetings Christian -- Christian Kratzer CK Software GmbH Email: ck(a)cksoft.de Wildberger Weg 24/2 Phone: +49 7032 893 997 - 0 D-71126 Gaeufelden Fax: +49 7032 893 997 - 9 HRB 245288, Amtsgericht Stuttgart Web: http://www.cksoft.de/ Geschaeftsfuehrer: Christian Kratzer

1 0

standalone and master slave ldap behave differently
by Desiree Klecker 20 May '13

20 May '13

Hello, to update entry persistend in a master slave openldap environment the following steps are performed using Java : 1. The entry is removed. 2. The entry is created again. This does not result in faulty behavior using a single/simple OpenLdap directory. Using a master slave configuration this results in unpredictable errors claiming that the item still exists (the remove statement has ran immediately before) if it is recreated. I cannot see why the master slave environment should not behave in a tranparent way. It seems the remove statement was not executed in complete allthough the call is synchronous. Which additional information are required to analyse the problem? Do similar problems exist/ is this a known problem? Regards, Desiree

2 1

olcAccess replication - error 80 attributes not within database namespace
by Igor Zinovik 20 May '13

20 May '13

Hello. I'm trying to replicate access rules and limits for one of my databases, but with no success: suse:~ # cat olcAccess-syncrepl.ldif dn: olcDatabase={1}mdb,cn=config changetype: modify add: olcSyncrepl olcSyncrepl: {1}rid=002 provider=ldap://ldap1.local bindmethod=simple binddn="cn=admin,cn=config" credentials="TopSecret" searchbase="olcDatabase={1}mdb,cn=config" attrs="olcAccess,olcLimits" timeout=3 network-timeout=0 starttls=yes tls_cert="/etc/openldap/ldap.pem" tls_key="/etc/openldap/ldap.key" tls_cacert="/etc/ssl/local-ca.pem" tls_reqcert=demand tls_crlcheck=none suse:~ # ldapmodify -H ldap://ldap2.local -ZZxWD cn=admin,cn=config -f olcAccess-syncrepl.ldif Enter LDAP Password: modifying entry "olcDatabase={1}mdb,cn=config" ldap_modify: Other (e.g., implementation specific) error (80) additional info: Base DN "olcAccess,olcLimits" is not within the database naming context slapd-2.4.33 if it matters.

3 5

translucent overlay - bogus local entries
by Steve Eckmann 20 May '13

20 May '13

We noticed that adding a local entry for which there is no corresponding remote entry doesn't cause an error to be reported, but the bogus local entry cannot then be found or deleted, as far as I can tell. I realize it was a mistake to add such an entry, but is it possible to configure the translucent overlay to prevent the client from making this mistake, or is it up to the client to ensure a remote entry exists before adding a local entry? And is there some way to find and delete such bobus local entries, either via LDAP commands or by directly querying and managing the local mdb instance? Thanks. Steve

2 2

Re: ldap_add: Invalid syntax (21) additional info: objectclass: value #0 invalid per syntax
by Quanah Gibson-Mount 17 May '13

17 May '13

--On Friday, May 17, 2013 12:38 AM +0100 Youssef Said Khloufi <mragrid(a)yahoo.fr> wrote: > > - stoping and restarting slapd does not resolve the problem. > - i checked all schemes loaded in the configuration DIT using the command > : > sudo ldapsearch -Y EXTERNAL -H ldapi:/// -b "cn=schema,cn=config" > and my scheme is not there (it seems to be the problem). > - i am using openldap-2.4.28 on Ubuntu 12.04.2 LTS. Please do not top post. Please always copy the list in replies if you want further help. I don't see any obvious changes between OpenLDAP 2.4.28 and current release (2.4.35) addressing why your schema wasn't added, but my first step would be to confirm whether or not you see this behavior if you use a release of OpenLDAP that isn't a year and a half old. It certainly works (in general) for me with OpenLDAP 2.4.35: zimbra@zre-ldap002:~$ ldapadd -x -H ldapi:/// -D cn=config -w zimbra dn: cn=stSchema,cn=schema,cn=config objectClass: olcSchemaConfig olcObjectClasses: ( 1.3.6.1.4.1.4203.666.1.1 NAME 'stPerson' SUP inetOrgPerson STRUCTURAL MUST correo) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.2 NAME 'correo' SUP mail) adding new entry "cn=stSchema,cn=schema,cn=config" zimbra@zre-ldap002:~$ ldapsearch -LLL -x -H ldapi:/// -D cn=config -w zimbra -b "cn=schema,cn=config" 1.1 dn: cn=schema,cn=config dn: cn={0}core,cn=schema,cn=config dn: cn={1}cosine,cn=schema,cn=config dn: cn={2}inetorgperson,cn=schema,cn=config dn: cn={3}dyngroup,cn=schema,cn=config dn: cn={4}zimbra,cn=schema,cn=config dn: cn={5}amavisd,cn=schema,cn=config dn: cn={6}opendkim,cn=schema,cn=config dn: cn={7}stSchema,cn=schema,cn=config --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

ldap_add: Invalid syntax (21) additional info: objectclass: value #0 invalid per syntax
by Youssef Said Khloufi 17 May '13

17 May '13

I have the problem that the title mention. I am trying to create this entry : dn: cn=usuario2,ou=st,o=um,c=es changetype: add objectclass: stPerson sn: usuario2 mobile: 657132819 correo: usuario2(a)st.um using the command : ldapmodify -D "cn=admin,o=um,c=es" -W -H ldap://ldap -f st.ldif if i only change the objectclass to "inetOrgPerson" and the attribute "correo" to "mail", everything works well so my DIT is just fine and it's my objectclass "stPerson" that is giving me the problem. This is my definition of the "stPerson" objectclass : #Definición de ObjectClass "stPerson" y atributo "correo" dn: cn=stSchema,cn=schema,cn=config objectClass: olcSchemaConfig olcObjectClasses: ( 1.3.6.1.4.1.4203.666.1.1 NAME 'stPerson' SUP inetOrgPerson STRUCTURAL MUST correo) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.2 NAME 'correo' SUP mail) I already added this scheme to the configuration DIT using the command : ldapadd -Y EXTERNAL -H ldapi:/// -f stSchema.ldif and it says : SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 adding new entry "cn=stSchema,cn=schema,cn=config" I do not see where is the problem.

2 1

Re: getting bindDN in perl script
by Benin Technologies 16 May '13

16 May '13

yes I'm using Net::LDAP in my back-perl to access a back-hdb server and it works, but I always use the same hardcorded $bindDN and $password (for example : $binddn = cn=admin,dc=my-domain and $password = secret) But I'd like to use the same bindDN and the same password as the one that has been used to bind to the back-perl backend Le 15/05/2013 17:14, Brian Reichert a écrit : > On Wed, May 15, 2013 at 03:42:44PM +0100, Benin Technologies wrote: >> thanks, but I'm surprised, I don't see the bindDN and password in the >> parameter list of the perl subs > This has nothing to to with OpenLDAP. > > > From perl, you fird get an LDAP object: > > my $ldap = Net::LDAP->new($uri->as_string); > > then bind: > > my $mesg = $ldap->bind($bindDN, password=> $passwd); > > then search: > > $mesg = $ldap->search( @search_args ); > > once the bind has completed, nothing retains that information; it > was only needed to bind. > > I have no idea what the architecture of your project is, but you'd > be better off asking on one of the perl lists to work this stuff out. >

6 15

openldap client wasn't able to authenticate SSH
by ded1＠MyBSD.org.my 16 May '13

16 May '13

Hi, I have issue with my openldap client to authenticate on SSH using openldap server. It's failed to authenticate using account that i create on openldap server OR default user !. I have to reboot to single mode and change everything back to default. The SSH account that i use is "labu" Output from /etc/passwd on openldap server (10.1.1.1): # more /etc/passwd | grep labu labu:x:1003:1003::/home/labu:/bin/sh Here's what i'm using on the setup: Server (10.1.1.1): i. openldap 2.4.28-1.1 on Linux Ubuntu 12.04 Client (10.1.1.2): i. libpam-ldapd 0.8.4 on Linux Ubuntu 12.04 Here's the output when i do on openldap server itself: # ldapsearch -h localhost -D "cn=admin,dc=ROSAK,dc=COM" -w openiam -b "dc=ROSAK,dc=COM" -s sub "objectclass=*" ldap_bind: Invalid credentials (49) _BUT_ i'm am able to login using admin account on phpldapadmin. Here's my /etc/ldap/slapd.conf ############################################################## # S L A P D . C O N F # ############################################################## include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema password-hash {CLEARTEXT} allow bind_v2 pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args modulepath /usr/lib/ldap moduleload back_bdb.la #moduleload back_@BACKEND@ access to dn.exact="cn=admin,ou=Roles,dc=ROSAK,dc=COM" by * manage access to dn.exact="cn=admin,ou=Roles,dc=ROSAK,dc=COM" by * read access to attrs=userPassword by self write by anonymous auth by * none access to * by self write by users read by anonymous auth database bdb suffix "dc=ROSAK,dc=COM" rootdn "cn=admin,dc=ROSAK,dc=COM" rootpw {CLEARTEXT}123456 directory "/var/lib/ldap" index objectClass eq loglevel 2048 Here's /etc/nsswitch.conf from my openldap client: # /etc/nsswitch.conf passwd: files ldap group: files ldap shadow: files ldap sudoers: files ldap services: files ldap automount: files ldap Here's /etc/pam.d/sshd from my openldap client: # auth include system-auth account required pam_nologin.so account include system-auth password include system-auth session optional pam_keyinit.so force revoke session include system-auth session required pam_loginuid.so Appreciate anyone help / advice. Thanks. --- ded1 "The end is the beginning, the beginning is the end"

2 1

Re: getting bindDN in perl script
by Pierangelo Masarati 16 May '13

16 May '13

Please reply on the mailing list. On 05/16/2013 01:00 AM, Benin Technologies wrote: > yes but...where is this perl function called for binds ??? it isn't in > SampleLDAP.pm... > servers/slapd/back-perl/bind.c calls a method "bind" as much as servers/slapd/back-perl/search.c calls a method "search". Apparently, who wrote "SampleLDAP.pm" did not provide a "bind" example. Note that I've been working for 15 years with OpenLDAP and I never used back-perl; I discovered all of this last night by opening 2 files and reading about 10 lines of code. You should probably try to do something like this yourself. p. > Le 15/05/2013 22:20, Pierangelo Masarati a écrit : >> binddn and bindpw are the first two parameters of the perl function >> called for binds. >> > > -- Pierangelo Masarati Associate Professor Dipartimento di Ingegneria Aerospaziale Politecnico di Milano

3 4

back-mdb vs back-hdb read performance
by Quanah Gibson-Mount 16 May '13

16 May '13

<http://mishikal.wordpress.com/2013/05/16/openldap-a-comparison-of-back-mdb-…> --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

getting bindDN in perl script
by Benin Technologies 15 May '13

15 May '13

Hi, I needed to access from an LDAP client (Outlook or Thunderbird) some data stored in several locations (an OpenLDAP server with back-hdb, and a PostgreSQL database). I wrote a perl script used with back-perl, and everything works fine. The client queries that back-ldap server, wich in turn retrieves data both from the back-hdb server and the PostgreSQL server, does some formatting on it, and returns it to the client It works fine, except that I have to use a standard bindDN/password from the perl script to access the back-hdb server, because I don't know how to retrieve in that perl script the initial bindDN/password (the credentials provided initially by the client). I guess there is a way to do it, because I found some links like http://osdir.com/ml/network.openldap.general/2002-09/msg00021.html where people seem to have been able to get the bindDN and password provided by the client, but they didn't say how and I couldn't figure it out. Does anybody know if it's possible to get, within the perl script, the bindDN/password provided by the client ? Thanks Ben

4 7

Access Control List Configuration.
by Geo P.C. 15 May '13

15 May '13

I am trying to configure acl in such a way users with attribute allowedService with application name can only login to that particular application. We have users as follows: dn: ou=People,dc=prime,dc=ds,dc=geo,dc=com dn: uid=user1,ou=People,dc=prime,dc=ds,dc=geo,dc=com uid: user1 allowedService: gitlab dn: uid=user2,ou=People,dc=prime,dc=ds,dc=geo,dc=com uid: user2 allowedService: zabbix dn: uid=user3,ou=People,dc=prime,dc=ds,dc=geo,dc=com objectClass: top uid: user3 allowedService: zabbix We created an user as follows: dn: cn=gitlab,ou=Applications,ou=Groups,dc=prime,dc=ds,dc=geo,dc=com cn: gitlab uid: gitlab Now in application we given the details as follows: gitlab configuration base: ou=People,dc=prime,dc=ds,dc=geo,dc=com uid: uid bind_dn: cn=gitlab,ou=Applications,ou=Groups,dc=prime,dc=ds,dc=geo,dc=com password: password Now in acl we tried various options as follows: root@geopc:/# ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b cn=config '(olcDatabase={1}hdb)' olcAccess dn: olcDatabase={1}hdb,cn=config olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymous auth by dn="cn=admin,dc=ds,dc=geo,dc=com" write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to dn.subtree="ou=Applications,ou=Groups,dc=prime,dc=ds,dc=geo,dc=com" by self write by * write olcAccess: {3}to dn.subtree="ou=People,dc=prime,dc=ds,dc=geo,dc=com" by self write by * auth olcAccess: {4}to dn.subtree="ou=People,dc=prime,dc=ds,dc=geo,dc=com" filter="(allowedService=gitlab)" by dn.exact="cn=gitlab,ou=Applications,ou=Groups,dc=prime,dc=ds,dc=geo,dc=com" write by self write But with this no user can able to login. But we change olcAccess: {3}to dn.subtree="ou=People,dc=prime,dc=ds,dc=geo,dc=com" by self write by * write, all users can login. But actually we need is only the user1 need only to login to gitlab application. And the users user2 and user3 need only to login to zabbix application Can anyone please help me to configure acl for this. Thanks in advance. Thanks Geo

2 2

Problems with SSH to Openldap server
by Stuart Watson 14 May '13

14 May '13

Hi I have created an ec2 instance and have installed openldap and setup openldap to use OpenSSH. However I cannot ssh from a remote pc, to the openldap server, I just get invalid user, although the username is the same that I have specified in openldap. What am I doing wrong? Thanks

2 7

Re: Using LDAP how to restrict users to certain applications only
by Geo P.C. 14 May '13

14 May '13

Dear Peter Thanks for your update. As you specified I am trying to set up this option. Thanks again Geo. *Thanks & Regards Geo P.C. www.geopc.co.cc* On Tue, May 7, 2013 at 8:34 PM, Peter Gietz <peter.gietz(a)daasi.de> wrote: > Hi Geo, > > I don't think that alias object will be of use for you. Frankly I don't > quite understand how you would like to use that. > > What you should do as I proposed (solution 2b.): > > define an attribute like allowedService and manage that instead of using > groups. > > create accounts for each application (all applications have binddn and > bind password to connect to an ldap server) > > And the restrict access rights of these DNs via ACLs such as : > > access to filter=(allowedService=Wordpress) > by cn=wordpress,ou=serviceaccounts,dc=examle,dc=com > read > ... > > access to * by * none > > Cheers, > > Peter > > > > Am 07.05.2013 14:59, schrieb Geo P.C.: > > Dear Peter, > > Thanks for your reply. In order to login to an application from a > selected group only we checked alias option. But it was not working. Please > see the details: > > In application we have given base dn as ou=People,dc=geo,dc=com and the user dn: uid=geo_pc,ou=People,dc=geo,dc=com can able to login to the application successfully. > > Now we created an alias as follows: > > dn: uid=geo_pc,ou=Applications,ou=Groups,dc=geo,dc=com > > aliasedobjectname: uid=geo_pc,ou=People,dc=geo,dc=com > > objectclass: alias > > objectclass: extensibleObject > > objectclass: top > > uid: geo_pc > > Now in application we have given base dn as ou=Applications,ou=Groups,dc=geo,dc=com but with this user ou=Applications,ou=Groups,dc=geo,dc=com we are unable to login to the application. > > Please let us know is there any additional configuration we need to done. Can you please help me on it. > > > > > Thanks > Geo > > > > > > > *Thanks & Regards > Geo P.C. > www.geopc.co.cc* > > > On Tue, May 7, 2013 at 5:51 PM, Peter Gietz <peter.gietz(a)daasi.de> wrote: > >> >> 1.) If you had a config parameter like search filter in your application >> you could use that to make unwanted users invisible for the application. >> But this means you can't use group entries , but dynamic groups, i.e. a >> group is an ldapfilter, e.g. "(allowedServices=Wordpress)" and you manage >> group privileges in an own attribute allowedServices. >> >> 2.) You could also do this via ACLs in the server, each application using >> its own bind dn, which can then have read access to a subset of the data. >> Here you can use a.) group entries or b.) dynamic groups >> >> 3.) Of course you could also have a separate replica for each application >> with filtered entries, but only with dynamic groups (see 1.), but that is a >> lot of overhead. Beware: combining this with 2. i.e. group ACLs on replica >> bindDN is a rathole, don't do that! >> >> 4.) IMHO best would be to file a feature request to the application >> developers for supporting LDAP-groups >> >> >> if not 4.) my recommendation would be 2a.) being the minimal invasive >> alternative. >> >> Hope this helps, >> >> Peter >> >> >> Am 06.05.2013 12:21, schrieb Geo P.C.: >> >> Hi >> >> We are using many applications like zabbix, phabricator, AC etc. We need >> to integrate LDAP in all these applications. These application support LDAP >> but not group based authentication. >> >> Please let us know is there any option to restrict selected users to >> login. We created all users under ou ‘users’ . >> >> [image: Inline image 1] >> >> On these application we need to login certain users only. How we can >> restrict it as we can’t able to restrict on application side >> >> In these application they provide only “Base DN” and “Search Attribute” >> so we can’t able to give dn: ou=users,ou=system as it gives access to all >> users. >> >> So is it possible to give Base DN as “cn=Zabbix,ou=groups,ou=system” and >> this group contains only user1 and user2. SO it will restrict users. >> >> Please let us know how we can implement this scenario. Thanks in advance >> please help us to solve this issue. >> >> Thanks >> Geo >> >> >> >> >> -- >> >> Peter Gietz, CEO >> >> DAASI International GmbH >> Europaplatz 3 >> D-72072 Tübingen >> Germany >> >> phone: +49 7071 407109-0 >> fax: +49 7071 407109-9 >> email: peter.gietz(a)daasi.de >> web: www.daasi.de >> >> Sitz der Gesellschaft: Tübingen >> Registergericht: Amtsgericht Stuttgart, HRB 382175 >> Geschäftsleitung: Peter Gietz >> >> >> >> > > > -- > > Peter Gietz, CEO > > DAASI International GmbH > Europaplatz 3 > D-72072 Tübingen > Germany > > phone: +49 7071 407109-0 > fax: +49 7071 407109-9 > email: peter.gietz(a)daasi.de > web: www.daasi.de > > Sitz der Gesellschaft: Tübingen > Registergericht: Amtsgericht Stuttgart, HRB 382175 > Geschäftsleitung: Peter Gietz > > > >

2 7

Access Rules and Replication
by Andrew Devenish-Meares 14 May '13

14 May '13

Hi List, I've just joined the list as I'm starting work on a new project to move our OpenLDAP servers over to cn=config from the old slapd.conf configuration. I've been working with our LDAP servers for about twelve months since I started this job, and have used OpenLDAP and other LDAP servers for five years before that. For the moment we're not looking to change the way clients use LDAP, but are looking to bring the config up to the new format, and take advantage of "no downtime" configuration changes. At present our production environment uses a single LDAP Master, which is used by the IAM system and system and network admins to maintain the various entries, while clients are set to read from ldap.une.edu.au, a RR DNS entry to the LDAP consumers. Beyond discussions of moving to an F5 Load Banacer, rather than RR DNS, we're not aiming to change that setup. I've read examples of replicating not only the directory, but also the cn=schema,cn=config DIT, which seems useful. Can anyone advise if there are any pitfalls in this approach, or any reason not to investigate it? I can see that the Access Controls are moved into olcAccess entries either in the cn=config or database parts of the tree. If we can replicate the schema to the consumers, can we replicate our ACLs as well? Has anyone done this, are their examples? I've been searching around for a while and haven't found any. I'm also interested in hearing about any other issues people have encountered moving to the cn=config setup, gotcha's or anything else people might consider useful for me to know. Thanks all Andrew -- Andrew Devenish-Meares Solutions Analyst Information Technology University of New England Armidale NSW 2351 e: adevenis(a)une.edu.au p: 02 6773 4098 w: http://une.edu.au/itd

1 0

back-perl and bind DN
by Benin Technologies 11 May '13

11 May '13

Hi, I'm using a perl backend. Is it possible, inside the perl script, to get the bind DN ? Ben

1 1

Re: connection_read
by Quanah Gibson-Mount 10 May '13

10 May '13

--On Friday, May 10, 2013 9:05 AM -0300 paulo bruck <paulobruck1(a)gmail.com> wrote: > I insert concurrency to 20000 and threads to 64 , but some branches > continues not syncing . Please keep your replies on the list. I have no clue why you think this would do anything to help with your sync issues. At best, it is killing your servers, and you are playing with parameters you don't understand. I would also note the OpenLDAP versions provided by RedHat, if that is what you are using on your RedHat replicas, are also known to be terrible. You should be using the same (current) version of OpenLDAP on all servers (provider and replicas). --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Open ldap GPG Keyserver
by Michée Lengronne 10 May '13

10 May '13

Hello, I would like to know if it is possible to do a GPG Keyserver with Openldap. I found tutorials but very outdated. I use Debian Squeeze and I saw that ldaputils is an optionnal dependency for the gnupg package, so I think it is possible. Do you have tutorials somewhere, some examples to do that ? Is there some restrictions ? Thanks. -- Michée Lengronne's email footer Michée Lengronne Tel: +33(0)672504808 -- E-mail: michee(a)lengronne.ch My online CV <http://www.doyoubuzz.com/michee-lengronne>

1 0

index on attribute in acl filter
by Al 10 May '13

10 May '13

Hi, I am looking for a way to allow certain support individuals to unlock ldap accounts that have been locked by too many failed auth attempts (ppolicy), however I do not want them to be able to unlock accounts that have been locked for administrative reasons. I was assuming I could use an ACL like the one below, since we lock an account for administrative reasons with the same pwdAccountLockedTime value - {6}to dn.subtree="cn=users,dc=company,dc=com" filter=(!(pwdAccountLockedTime=000001010000Z)) by group/groupOfUniqueNames/uniqueMember.exact="cn=user_admins,cn=groups,dc=company,dc=com" write by users read {7}to dn.subtree="cn=users,dc=company,dc=com" filter=(pwdAccountLockedTime=000001010000Z) by group/groupOfUniqueNames/uniqueMember.exact="cn=super_user_admins,cn=groups,dc=company,dc=com" by users read I know for a search with that filter, an index on pwdAccountLockedTime would be beneficial, but would it help for an acl filter? Does this seem like a reasonable approach? Thanks in advance, Al

2 1

cleaning HDB after an unclean shutdown
by Benin Technologies 10 May '13

10 May '13

Hi, I'm doing some tests on a perl backend, which causes sometimes my OpenLDAP to hang. I then kill the process, but when I try to restart openldap it won't, because of my HDB backend. I get the following message : db_db_open: database "dc=mycompany": database already in use. After rebooting the server, everything works fine. Any way to "clean" the HDB backend manually, without having to reboot the server ? Ben

4 6

connection_read
by paulo bruck 09 May '13

09 May '13

Hello guys using openldap as master : debian squeeze ldap version 2.4.23-7.3 around 85 openldap as slaves based on red hat. since last week we have been seeing a lot of connection_read in ldap master reading docs about it: http://www.openldap.org/lists/openldap-software/200208/msg00118.html inserting at master slapd.conf: connections 20000 threads 64 and after some time some of our branches stay w/ base different from master. Is there any other parameter than we could change to mantain all branches w/ the same base as Master??? best regards May 9 15:34:02 ldap slapd[27856]: conn=5570 fd=272 closed (connection lost) May 9 15:34:02 ldap slapd[27856]: conn=5569 fd=279 closed (connection lost) May 9 15:34:02 ldap slapd[27856]: conn=5574 fd=279 closed (connection lost) May 9 15:34:02 ldap slapd[27856]: conn=5573 fd=277 closed (connection lost) May 9 15:34:03 ldap slapd[27856]: connection_read(274): no connection! May 9 15:34:03 ldap slapd[27856]: connection_read(274): no connection! May 9 15:34:03 ldap slapd[27856]: connection_read(274): no connection! May 9 15:34:03 ldap slapd[27856]: connection_read(274): no connection! May 9 15:34:04 ldap slapd[27856]: connection_read(274): no connection! May 9 15:34:04 ldap slapd[27856]: connection_read(274): no connection! May 9 15:34:04 ldap slapd[27856]: conn=5549 fd=263 closed (connection lost) May 9 15:34:04 ldap slapd[27856]: conn=5558 fd=278 closed (connection lost) May 9 15:34:04 ldap slapd[27856]: conn=5551 fd=270 closed (connection lost) May 9 15:34:04 ldap slapd[27856]: connection_read(274): no connection! May 9 15:34:04 ldap slapd[27856]: connection_read(274): no connection! May 9 15:34:04 ldap slapd[27856]: conn=5550 fd=268 closed (connection lost) May 9 15:34:04 ldap slapd[27856]: conn=5547 fd=221 closed (connection lost) May 9 15:34:05 ldap slapd[27856]: connection_read(263): no connection! May 9 15:34:05 ldap slapd[27856]: connection_read(263): no connection! May 9 15:34:08 ldap slapd[27856]: conn=5577 fd=277 closed (connection lost) May 9 15:34:09 ldap slapd[27856]: conn=5588 fd=263 closed (connection lost) May 9 15:34:10 ldap slapd[27856]: conn=5575 fd=273 closed (connection lost) May 9 15:34:10 ldap slapd[27856]: conn=5572 fd=276 closed (connection lost) May 9 15:34:14 ldap slapd[27856]: conn=3461 fd=248 closed (connection lost)

2 1

SSH Gateway
by Stuart Watson 09 May '13

09 May '13

Hi I am looking at creating a SSH gateway using OpenLDAP. The idea is to store our devs public keys in OpenLdap, which would give us the ability to control who has SSH access to our servers. Currently everyone shares the same key which means it is impossible to control access. Do I just need to... Install OpenLDAP Import the public keys into OpenLDAP Install OpenSSH Server on the OpenLDAP server and configure it to use LDAP. Configutre the remote servers to use the OpenLDAP servers to authenticate The the devs can ssh from their computers through the OpenLDAP server to the remote servers. Can anyone help? Thanks

5 8

compile OpenLDAP with SSL support
by Ashwin Kumar 09 May '13

09 May '13

How to compile OpenLDAP libraries with SSL (OpenSSL) support? Please provide me with instructions to build on Linux and Windows. Thanks and regards. -- Ashwin kumar (http://ashwinkumar.me)

1 0

Re: dynamic group perfs
by Jephte Clain 08 May '13

08 May '13

2013/5/7 Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Tuesday, May 07, 2013 9:36 AM +0400 Jephte Clain > <jephte.clain(a)univ-reunion.fr> wrote: > >> It needs more than 30 seconds to build the dynamic group! and this is the >> case every time I do the search >> >> For the sake of it, I made a static group with 45000 member, and it takes >> 0.037 seconds for the search >> >> So my question is: is it normal for the dynamic group to be so slow to be >> built? is there something I can do? > > hello. thanks for your answer > What about the second time you run a query on a subtree? it's the same every time, so it's not a cache problem > For back-hdb, the > first time it has load a bunch of data into the idl cache IIRC. Also, you > do not show in your config if you have actually indexed the attributes to be > used by the dynamic group. This of course would be a requirement. For > example: > > <ldap:///ou=users,ou=cas,dc=univ-reunion,dc=fr??one?(uid=*)> > > pres index on uid > > <ldap:///ou=webaccounts,dc=univ-reunion,dc=fr??one?(&(uid=*)(runUnivCategorie=inconnu)(!(runUnivAuthorization=webaccounts:disabled)))> > > runUnivCategorie -> eq index > runUnivAuthorizaion -> eq index well, all these attributes have an eq index, and I assumed an eq index would imply the pres index. maybe that's the problem. I will try it on friday, it's not possible right now. you may have noticed in the examples I gave in the first mail: the individual searches by themselves are quite fast. $ time ldapsearch (...) -b ou=users,ou=cas,dc=univ-reunion,dc=fr "(uid=*)" dn >/dev/null real 0m1.025s $ time ldapsearch (...) -b ou=webaccounts,dc=univ-reunion,dc=fr "(&(uid=*)(runUnivCategorie=inconnu)(!(runUnivAuthorization=webaccounts:disabled)))" dn >/dev/null real 0m0.043s $ time ldapsearch (...) -b ou=groups,ou=eduspot,dc=univ-reunion,dc=fr "(cn=users)" member >/dev/null real 0m34.334s what I don't understand is how 1.025 + 0.043 = 34.33 or perhaps 1.025 is very slow by openldap standards, and the reason is that there is only an eq index on uid? but I didn't set a pres index on uid because in the branches above, nearly 100% of the objets beneath have the uid attribute, and the openldap admin guide says: ----------------------------- 8< ----------------------------- 21.2.3. Presence indexing If your client application uses presence filters and if the target attribute exists on the majority of entries in your target scope, then all of those entries are going to be read anyway, because they are valid members of the result set. In a subtree where 100% of the entries are going to contain the same attributes, the presence index does absolutely NOTHING to benefit the search, because 100% of the entries match that presence filter. So the resource cost of generating the index is a complete waste of CPU time, disk, and memory. Don't do it unless you know that it will be used, and that the attribute in question occurs very infrequently in the target data. Almost no applications use presence filters in their search queries. Presence indexing is pointless when the target attribute exists on the majority of entries in the database. In most LDAP deployments, presence indexing should not be done, it's just wasted overhead. ----------------------------- 8< ----------------------------- Is dynamic group a special case where a presence index is required? thanks in advance for any insights > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration -- cordialement, Jephté Clain Direction des Systèmes d'Information et des Usages Numériques - 2IG Tél. 0262 93 86 31 Fax. 0262 93 81 06

2 1

dynamic group perfs
by Jephte Clain 08 May '13

08 May '13

hello all, I have a weird perf problem with a dynamic group. I wonder if it is normal, and if I can improve the situation. jump to the line marked "-------------> for the impatients, JUMP HERE :-)" if you want to skip the details This is openldap 2.4.35 on debian 6 (built from source with debian defaults and patches) here the relevant configuration: ------------ 8< ------------ dn: cn=module{0},cn=config ... olcModuleLoad: {4}dynlist.la dn: olcDatabase={2}hdb,cn=config ... olcDbCacheSize: 4096 olcDbCheckpoint: 1024 10 olcDbConfig: {0}set_cachesize 2 0 0 olcDbConfig: {1}set_lk_max_objects 32768 olcDbConfig: {2}set_lk_max_locks 32768 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbConfig: {4}set_lg_dir /var/lib/ldap/logs/dc=univ-reunion,dc=fr olcDbConfig: {5}set_lg_regionmax 262144 olcDbConfig: {6}set_lg_bsize 524288 olcDbIDLcacheSize: 12288 dn: olcOverlay={2}dynlist,olcDatabase={2}hdb,cn=config ... olcDlAttrSet: {0}groupOfURLs memberURL member ------------ 8< ------------ and the definition of the dynamic group: ------------ 8< ------------ dn: cn=users,ou=groups,ou=eduspot,dc=univ-reunion,dc=fr objectClass: groupOfURLs memberURL: ldap:///ou=users,ou=cas,dc=univ-reunion,dc=fr??one?(uid=*) memberURL: ldap:///ou=webaccounts,dc=univ-reunion,dc=fr??one?(&(uid=*)(runUnivCategorie=inconnu)(!(runUnivAuthorization=webaccounts:disabled))) ------------ 8< ------------ this result in a dynamic group with 45000 members I dont know how the final application will use the dynamic group, but I did some tests on my own. now for the perf tests: $ time ldapsearch -LLL -H "ldap://localhost" -x -D cn=admin,dc=univ-reunion,dc=fr -wadmin -b ou=users,ou=cas,dc=univ-reunion,dc=fr "(uid=*)" dn >/dev/null real 0m1.025s user 0m0.096s sys 0m0.196s $ time ldapsearch -LLL -H "ldap://localhost" -x -D cn=admin,dc=univ-reunion,dc=fr -wadmin -b ou=webaccounts,dc=univ-reunion,dc=fr "(&(uid=*)(runUnivCategorie=inconnu)(!(runUnivAuthorization=webaccounts:disabled)))" dn >/dev/null real 0m0.043s user 0m0.004s sys 0m0.004s $ time ldapsearch -LLL -H "ldap://localhost" -x -D cn=admin,dc=univ-reunion,dc=fr -wadmin -b ou=groups,ou=eduspot,dc=univ-reunion,dc=fr "(cn=users)" member >/dev/null real 0m34.334s user 0m0.024s sys 0m0.000s -------------> for the impatients, JUMP HERE :-) It needs more than 30 seconds to build the dynamic group! and this is the case every time I do the search For the sake of it, I made a static group with 45000 member, and it takes 0.037 seconds for the search So my question is: is it normal for the dynamic group to be so slow to be built? is there something I can do? thanks in advance for your answers! best regards, -- cordialement, Jephté Clain Direction des Systèmes d'Information et des Usages Numériques - 2IG Tél. 0262 93 86 31 Fax. 0262 93 81 06

3 3

Looking for schema work around
by jckidder＠aep.com 08 May '13

08 May '13

I have an application vendor that attempts schema validation incorrectly and fails. This failure prevents us from being able to configure the application to connect to our OpenLDAP implementation. I have identified the issue and have a case open with the software vendor to get it fixed. The failing application is part of a suite that must deploy to production very soon in order to meet regulatory requirements and avoid very costly fines. The application vendor is not obligated in any way to meet our deadlines and has indicated that they will not be able to provide a code fix in time. We have a work around that allows us to manage user accounts locally within the application suite itself. If we are forced to take this approach when this application is implemented we will not be able to cost effectively switch back to LDAP once the vendor fixes the code. I'm in a very tough spot where I'm trying to avoid this. To get past the broken schema validation I need cn=Subschema to appear as cn=schema. I've tried everything I can think of (short of tweaking the source) and every approach I've tried has one little technical detail that prevents it from working. Anyone have any ideas I could use? At this point I'm even considering a replica that uses modified source but I have no experience with the OpenLDAP source and would need hints as to how much effort this is and where to make the code changes. Any ideas or assistance would be greatly appreciated. -Jon C. Kidder American Electric Power Middleware Services 614-716-4970

2 2

Using LDAP how to restrict users to certain applications only
by Geo P.C. 07 May '13

07 May '13

Hi We are using many applications like zabbix, phabricator, AC etc. We need to integrate LDAP in all these applications. These application support LDAP but not group based authentication. Please let us know is there any option to restrict selected users to login. We created all users under ou ‘users’ . [image: Inline image 1] On these application we need to login certain users only. How we can restrict it as we can’t able to restrict on application side In these application they provide only “Base DN” and “Search Attribute” so we can’t able to give dn: ou=users,ou=system as it gives access to all users. So is it possible to give Base DN as “cn=Zabbix,ou=groups,ou=system” and this group contains only user1 and user2. SO it will restrict users. Please let us know how we can implement this scenario. Thanks in advance please help us to solve this issue. Thanks Geo

3 4

Unable to login applications using LDAP alias
by Geo P.C. 07 May '13

07 May '13

We have several applications and we are able to integrate LDAP successfully. In application we have given base dn as ou=People,dc=geo,dc=com and the user dn: uid=geo_pc,ou=People,dc=geo,dc=com can able to login to the application successfully. Now we created an alias as follows: dn: uid=geo_pc,ou=Applications,ou=Groups,dc=geo,dc=com aliasedobjectname: uid=geo_pc,ou=People,dc=geo,dc=com objectclass: alias objectclass: extensibleObject objectclass: top uid: geo_pc Now in application we have given base dn as ou=Applications,ou=Groups,dc=geo,dc=com but with this user ou=Applications,ou=Groups,dc=geo,dc=com we are unable to login to the application. Please let us know is there any additional configuration we need to done. Can anyone please help us on it. Thanks Geo

2 1

password policy and pwdMustChange behavior
by Felix Schmitt 07 May '13

07 May '13

Hi, I'm installing an OpenLDAP directory server at a customer and we're also implementing password policies. We do have set the pwdMustChange attribute to true in our policy. During the tests I was a bit surprised that a user for which I've set the password did not require to change his password but was allowed access with the new password. Reading the documentation and the (expired) draft standard clearly suggests a different behavior. pwdMustChange (true or false) This attribute specifies with a value of "TRUE" that users must change their passwords when they first bind to the directory after a password is set or reset by a password administrator. If this attribute is not present, or if the value is "FALSE", users are not required to change their password upon binding after the password administrator sets or resets the password. This attribute is not set due to any actions specified by this document, it is typically set by a password administrator after resetting a user's password. Then I did some research on the web and found this thread http://www.openldap.org/lists/openldap-technical/201106/msg00178.html It seems an administrator needs to additionally set the pwdReset attribute to force the user to change the password. The question is: Why does an administrator need to set this attribute? Why isn't this done by the directory server on its own? The directory server does change a few other password policy related attributes as can be seen from the audit log (see below). Thus it should be possible to do the same for the pwdReset attribute. This behavior of OpenLDAP is different from what I'm used from the Sun (now Oracle) Directory Server where the pwdReset attribute is changed automatically. Best regards Felix # modify 1367849424 dc=telefonica,dc=com cn=Manager,dc=example,dc=com IP=192.168.186.141:52267 conn=1561 dn: uid=fbtwo,ou=people,dc=de,dc=telefonica,dc=com changetype: modify replace: userPassword userPassword:: e1NTSEF9VzNpZmtPRkROQTk0MCtmR3pIanZOcTdxbk9QUDArNTM= - replace: pwdChangedTime pwdChangedTime: 20130506141024Z - delete: pwdGraceUseTime - add: pwdHistory pwdHistory: 20130506141024Z#1.3.6.1.4.1.1466.115.121.1.40#38#{SSHA}AU4VVldD3ct JnHil4AZPHnIC4G1aobhg - replace: entryCSN entryCSN: 20130506141024.395155Z#000000#001#000000 - replace: modifiersName modifiersName: cn=Manager,dc=example,dc=com - replace: modifyTimestamp modifyTimestamp: 20130506141024Z - # end modify 1367849424 ---- Felix Schmitt Blumenweg 24 phone: +49 8092 20796 D-85567 Grafing mobile: +49 172 842 99 12 Germany mailto:Felix-Schmitt@t-online.de

1 0

Unable to use TLS in a 2-WayMaster/MirrorMode Setup
by Thomas Macaigne 06 May '13

06 May '13

Hi, It's been a few days I'm trying to replicate my actual LDAP server on a new one. @(#) $OpenLDAP: slapd 2.4.21 (Dec 19 2011 15:18:58) $ buildd@roseapple:/build/buildd/openldap-2.4.21/debian/build/servers/slapd and @(#) $OpenLDAP: slapd (Oct 17 2012 19:48:41) $ buildd@komainu:/build/buildd/openldap-2.4.28/debian/build/servers/slapd for the replica. The replication part works great, but whenever I try to use TLS it fails. Here is how I proceed: - Genereate the certs (tried with CA.sh, CA.pl, certtools) -> I use the servers fqdn as CN (hostname --fqdn gives the right output) - Copy files to /etc/ldap/ssl - chmod 660 them and chown openldap:openldap An ouput of slapcat can be found here: http://paste.ubuntu.com/5638646/ When I try to check if TLS is working by using -ZZ of ldapsearch: ie: ldapsearch -xLLL -b dc=beware,dc=fr -D cn=admin,dc=beware,dc=fr -w motdepasse -H ldap://master.beware.fr/ -ZZ I get no error. The errors I get are: May 6 16:14:20 master slapd[1057]: slapd starting May 6 16:14:23 master slapd[1057]: slap_client_connect: URI=ldap://slave.beware.fr/ DN="cn=admin,cn=config" ldap_sasl_bind_s failed (-1) May 6 16:14:23 master slapd[1057]: do_syncrepl: rid=002 rc -1 retrying (4 retries left) May 6 16:14:23 master slapd[1057]: slap_client_connect: URI=ldap://slave.beware.fr Warning, ldap_start_tls failed (-1) May 6 16:14:26 master slapd[1057]: slap_client_connect: URI=ldap://slave.beware.fr DN="cn=admin,dc=beware,dc=fr" ldap_sasl_bind_s failed (-1) May 6 16:14:26 master slapd[1057]: do (on the slave) e.fr Error, ldap_start_tls failed (-1) May 6 16:14:55 slave slapd[1278]: do_syncrepl: rid=003 rc -1 retrying (4 retries left) May 6 16:15:00 slave slapd[1278]: slap_client_connect: URI=ldap://master.beware.fr/ DN="cn=admin,cn=config" ldap_sasl_bind_s failed (-1) May 6 16:15:00 slave slapd[1278]: do_syncrepl: rid=001 rc -1 retrying (3 retries left) May 6 16:15:00 slave slapd[1278]: slap_client_connect: URI=ldap://master.beware.fr Error, ldap_start_tls failed (-1) May 6 16:15:00 slave slapd[1278]: do_syncrepl: rid=003 rc -1 retrying (3 retries left) output of slapd -d 16383 5187bb09 slap_client_connect: URI=ldap://master.beware.fr Error, ldap_start_tls failed (-1) 5187bb09 daemon: activity on 1 descriptor 5187bb09 daemon: activity on:5187bb09 5187bb09 daemon: epoll: listen=7 active_threads=0 tvp=zero 5187bb09 daemon: epoll: listen=8 active_threads=0 tvp=zero 5187bb09 do_syncrepl: rid=003 rc -1 retrying (3 retries left) Regards,

2 1

invalid value for attributeType olcSuffix while restoring cn=config (slapd-2.4.33)
by Igor Zinovik 06 May '13

06 May '13

Hello, openldap-technical@ readers. I backed up cn=config from openldap-2.4.33 and now i try to restore it, but with no success. I made backup copy this way: ldap1# sudo slapcat -b cn=config -F /etc/openldap/slapd.d -l config.ldif After this i created new clean VM with opensuse 12.3 and slapd 2.4.33 opensuse# slapadd -u -F /etc/openldap/slapd.d -b cn=config -l config.ldif 5187acde str2entry: invalid value for attributeType olcSuffix #0 (syntax 1.3.6.1.4.1.1466.115.121.1.12) slapadd: could not parse entry (line=3206) _################### 98.19% eta none elapsed none spd 19.9 M/s opensuse# fgrep -n olcSuffix config.ldif 522:olcAttributeTypes: ( OLcfgDbAt:0.10 NAME 'olcSuffix' EQUALITY distinguishedNam 1049: n $ olcSuffix $ olcSubordinate $ olcAccess $ olcAddContentAcl $ olcLastMod $ 3205:olcSuffix: dc=example,dc=ru 3411:olcSuffix: cn=example-log LDIF content around line 3206 is following: 3201: dn: olcDatabase={1}mdb,cn=config 3202: objectClass: olcDatabaseConfig 3203: objectClass: olcMdbConfig 3204: olcDatabase: {1}mdb 3205: olcSuffix: dc=example,dc=ru 3206: olcAddContentAcl: FALSE Here is trace: 5187b22a <<< dnPrettyNormal: <olcDatabase={1}mdb,cn=config>, <olcDatabase={1}mdb,cn=config> 5187b22a >>> dnPretty: <dc=example,dc=ru> 5187b22a str2entry: invalid value for attributeType olcSuffix #0 (syntax 1.3.6.1.4.1.1466.115.121.1. 12) slapadd: could not parse entry (line=3201)

1 0

Use LDAP netgroup to control NFS exports?
by jupiter 06 May '13

06 May '13

Hi, I am running LDAP server and NFS server on CentOS 6, is it true that LDAP can be used to control NFS exports authentication, uid and gid setting without needing to specifie client IP addresses , anonuid and anongid on NFS exports file? I saw some sample such as to define "/tmp/nfs2 @mynetgrp(rw,no_root_squash)" to exports file, it seems to me, you can add new user with IP address to LDAP entry anytine without updating exports file in NFS server? If it is correct, has the netgroup schema already been defined in /etc/openldap/schema? Could anyone kindly point me a link for document or howto for the setting in both LDAP and NFS exports? Thank you. Kind regards. Jupiter

2 1

About ppolicy
by Jacques Foucry 06 May '13

06 May '13

Hello Folks, On my openldap server I was using shadowAccount to enforce password change for my users. It works, but it's not really secure. Users can reuse old passwors, etc. So I had a look to ppolicy and appli this tutorial: http://theslashroot.blogspot.fr/2011/12/openldap-with-ppolicy.html Some things are not clear for me. Did I have to disable shadowAccount on my schema? If not is shadowLastChange will be updated? I hope I need to include ppolicy schema on all my replica. Thanks in advance for your help, Jacques Foucry -- Jacques Foucry *NOVΛSPARKS * IT Manager Tel : +33 (0)1 42 68 12 61 jacques.foucry(a)novasparks.com

2 2

Modern Password Hashes in Openldap?
by Chris Hiestand 04 May '13

04 May '13

Since SSHA-1 is weak these days I'd like to switch to PBKDF2, Bcrypt or the like with key stretching. Since Openldap does not support relatively strong hashes, do you guys use SASL to store stronger hashes? If so, what kind of backend are you using to store hashes? Background: OclHashcat can generate tens of billions of SHA-1 hashes per second with off-the-shelf hardware. But it can only generate thousands of bcrypt hashes per second on similar hadware: https://hashcat.net/forum/thread-1541.html .

4 4

Questions about multiple identical values in a field
by Nicolas Mora 04 May '13

04 May '13

Hello, I'm currently programming a connector between a CardDAV server and a LDAP server in php. I'm using the schema inetOrgPerson which is good for most of the data but I have a problem with multiple equal data. The VCard data is set like this : ADR;TYPE=HOME:;;123 1st av;Montreal;QC;GGG RT3;CA which is translated into : street:: 123 1st av l: Montreal st:QC postalcode: GGG RT3 By default in the inetOrgPerson schema, the country code is not added, so I add a personalized schema with 2 fields : - countryCode ('c') - VCardUnassigned ('vcardunassigned') The second one is when a vcard field has no correspondance in the ldap schema Problem is, when you have multiple fields with the same value, you get an error 0x14 - LDAP_TYPE_OR_VALUE_EXISTS. Which is logical but kinda annoying if you want for example to add a second address in the same state or country, like : ADR;TYPE=HOME:;;321 42nd st;Montreal;QC;GGG RT1;CA Is there a way to save multiple equal values for an entry for some fields ?

4 3

Re: Questions about multiple identical values in a field
by Erwann Abalea 04 May '13

04 May '13

2013/5/3 Quanah Gibson-Mount <quanah(a)zimbra.com> > --On Friday, May 03, 2013 6:24 PM +0200 Erwann Abalea <eabalea(a)gmail.com> > wrote: > > Can't you use the postalAddress attribute? >> With your examples, it should be something like: >> postalAddress: 123 1st av$Montreal$QC$GGG RT3$CA >> >> postalAddress: 321 42nd st$Montreal$QC$GGG RT1$CA >> > > This is almost the correct way to format it... it should be: > > postalAddress: 123 1st av $ Montreal $ QC $ GGG RT3 $ CA > If I correctly read RFC2252, the space character around the "$" isn't required: postal-address = dstring *( "$" dstring ) dstring = 1*utf8 And the provided examples don't include such spaces. I would also note that there is no guaranteed return order for values > unless you use weighted attributes. Is the weighted attribute standardized LDAP, or specific to OpenLDAP? I can't find supportive definition in RFC45* documents. > Generally the best thing to do if you are going to have multiple > addresses (say home, work, business, mailing, etc) is to have custom > attributes specifically for those addresses > Or maybe a subordinate leaf for each address (with address elements splitted in several attributes), to be able to use search filters. -- Erwann.

4 5

Re: Questions about multiple identical values in a field
by Erwann Abalea 03 May '13

03 May '13

2013/5/3 Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Friday, May 03, 2013 7:01 PM +0200 Erwann Abalea <eabalea(a)gmail.com> > wrote: > >> 2013/5/3 Quanah Gibson-Mount <quanah(a)zimbra.com> >>> --On Friday, May 03, 2013 6:24 PM +0200 Erwann Abalea <eabalea(a)gmail.com> >>> wrote: >>>> Can't you use the postalAddress attribute? >>>> With your examples, it should be something like: >>>> postalAddress: 123 1st av$Montreal$QC$GGG RT3$CA >>>> >>>> postalAddress: 321 42nd st$Montreal$QC$GGG RT1$CA >>> >>> This is almost the correct way to format it... it should be: >>> >>> postalAddress: 123 1st av $ Montreal $ QC $ GGG RT3 $ CA >> >> If I correctly read RFC2252, the space character around the "$" isn't >> required: >> >> postal-address = dstring *( "$" dstring ) >> dstring = 1*utf8 >> >> And the provided examples don't include such spaces. > > Please fix your email client to quote replies properly. ;) That's GMail, multipart/alternative stuff, with inline replying :( The text/plain part was mostly OK, but it's difficult to manually read+parse the quoted-printable text/html part... I have similar problems when using Google Groups. Switched to pure text, manually added missing quote levels, it should be better. >>> I would also note that there is no guaranteed return order for values >>> unless you use weighted attributes. >> >> Is the weighted attribute standardized LDAP, or specific to OpenLDAP? I >> can't find supportive definition in RFC45* documents. > > This is an OpenLDAP specific overlay (valsort). Nice to know it's non portable. >>> Generally the best thing to do if you are going to have multiple >>> addresses (say home, work, business, mailing, etc) is to have custom >>> attributes specifically for those addresses >> >> Or maybe a subordinate leaf for each address (with address elements >> splitted in several attributes), to be able to use search filters. > > Personally, I would avoid subtrees for this. I prefer to see all my data > for a given user stored with the user entry. But that's me. ;) I've used > custom AUX objectClasses for this in the past to attach to the person entry > if they had a specific type of addr. Then a simple copy of "TYPE=HOME:;;123 1st av;Montreal;QC;GGG RT3;CA" into a custom attribute (with a properly defined auxiliary class) should get the job done. -- Erwann.

1 0

RE: Chaining stops working after slapd restart
by Quanah Gibson-Mount 03 May '13

03 May '13

--On Monday, April 29, 2013 6:56 PM +0000 jeevan kc <jeev_biz(a)hotmail.com> wrote: > > No, I'm fully using cn=config on Openldap 2.4.30 . I'm working on the > chain overlay for the past couple of weeks and when now I finally was > able to get it working, I found I could modify the slaves until I restart > the server. After I restart the server the chaining doesn't work it says > "strong authentication required". So the chaining basically worked only > just before I restarted the server. > Thanks Please do not top post. Please keep replies to the list. Please verify whether or not you can reproduce this with OpenLDAP 2.4.35. Thanks, Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

4 5

Help with first immersion into LDAP
by Šerých Jakub 03 May '13

03 May '13

Dear group, I would like to ask you for the little help with the newbie first immersion into LDAP. The problem is, that I need to build LDAP proxy, that will connect information from two MS ADs into one meta LDAP. But all the beginers tutorials start from the building of the new fresh LDAP database on the server, so it's very hard for me to catch the first clues... My situation: Debian with openLDAP and two Microsoft Win2008 servers with AD. The commands from Linux server: ldapsearch -x -H ldap://192.168.0.10 -D "ldap-user" -w password -b "ou=studenti,dc=student,dc=intra" and ldapsearch -x -H ldap://192.168.100.5 -D "ldap-user" -w password -b "dc=panska,dc=intra" are fully functional and returning the results I need. But when I try to config openLDAP server just to play role of proxy between the client and AD server it is not working and I cannot find why. One of my attempts to set ldap.conf: loglevel 255 database ldap suffix "ou=studenti,dc=student,dc=intra" uri "ldap://192.168.0.10/" binddn "name=ldap-user" bindpw password I'm trying the functionality by the command: ldapsearch -x -H ldap://localhost -D "ldap-user" -w password -b "ou=studenti,dc=student,dc=intra" or ldapsearch -x -H ldap://localhost "ou=studenti,dc=student,dc=intra" Could somebody give me a tip, how to set the ldap.conf to do just this simple proxying for the begining? How can I track what is going on, if the openLDAP at least tries to send something to MS AD server and if yes, what is the structure of his query (the loglevel 255 doesn't seem to be very helpfull)? Sorry for that newbie type of question and thanks in advance for any info Jakub

2 1

Checking that a change has reached all servers
by Hallvard Breien Furuseth 03 May '13

03 May '13

We have clients which must check that an update has reached all LDAP servers before they start some task. So we need to publish a list of all servers. Where would you put that list, when clients should normally not contact these servers directly (ldap-prod*.uio.no) but instead contact the load balancer sitting in front of them (ldap.uio.no)? 'altServer' in the root DSE anyway, or has someone defined another attribute? With transactional backend databases, an existing slow LDAP operation predating the change might return the old value while this quick poll sees the change. I'm content to just tell clients to wait a second after seeing the change though, unless someone has brighter ideas. Finally, has anyone written a nice little server (LDAP or otherwise) which does this - client sends a request, server checks all LDAP servers and either returns true/false or waits & retries while false? -- Hallvard

2 2

Re: ACL on create questions
by Andrew Findlay 03 May '13

03 May '13

[ Keep copying to the openldap-technical(a)openldap.org list ] On Thu, May 02, 2013 at 02:15:02PM +0000, Emmanuel Dreyfus wrote: > It almost works. My only concern is that it is possible to create an > object where LHS of DN is not in object's attributes. Like this: > > dn: foo=x,o=org > objectClass: fooClass > foo: y There was some argument about that a few years ago. I am sure that the intention of X.500 was for values in the RDN to be *chosen from* values in the entry. X.501(1988) section 8.1(g) defines an RDN: A set of attribute value assertions, each of which is true, concerning the distinguished values of a particular entry. Unfortunately, somewhere along the line one or more LDAP implementations permitted values in the RDN to be *in addition to* the values in the entry. This was a pain as it was not clear how search filters etc should behave, but some people with loud voices apparently became dependent on it. I remember someone (probably Kurt) saying at one point that the behaviour was wrong but someone had written it into the standards so it had to be supported. However, LDAP is now defined by RFC4512 which says this: 2.3.1. Relative Distinguished Names Each entry is named relative to its immediate superior. This relative name, known as its Relative Distinguished Name (RDN) [X.501], is composed of an unordered set of one or more attribute value assertions (AVA) consisting of an attribute description with zero options and an attribute value. These AVAs are chosen to match attribute values (each a distinguished value) of the entry. I read that as equivalent to the original X.501 definition, so maybe we should now treat the behaviour you see as a bug. Which version of slapd are you using? When I try this on 2.4.35 the extra value from the RDN gets copied into the entry so although the LDIF being loaded is not strictly correct it does result in a conformant entry. What does your entry look like when you read it back? Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

2 1

Debian Squeeze: Slapd subtree disappears, but ldapsearch finds it | unable to allocate memory for mutex; resize mutex region
by Denny Schierz 02 May '13

02 May '13

hi, on the last hour I had a very strange problem: I have a Debian Squeeze with Slapd installed and it was working a long time, but today one subtree disappears completely from the ldap browser (Apache Directory Studio). I wasn't accessible anymore, but with ldapsearch I was able to see the tree. Also I tried to add the LDIF again to the LDAP, but slapd says: "... exists ...." The only way to get it back working again, was to restore the plain BDB files from the backupjob yesterday. I absolutely don't know, what happens. The only thing I changed, I reinstalled the second LDAP (n-way master) on a new host, with a config only and let the second ldap synchronize with the main LDAP. After ~20-40 minutes the job was done and the second was up to date. That was yesterday. - The subtree was also missing on the second LDAP ... so, the synchronizing did the same ... So, I deleted all *dbd* *log* on ldap2 (after the restore from the main LDAP) and wanted to synchronizing again the full tree ... but I get many warnings: dc=...... unable to allocate memory for mutex; resize mutex region any suggestions? cu denny

7 19

ACL on create questions
by Emmanuel Dreyfus 02 May '13

02 May '13

HI Two ACL questions: 1) Is it possible to allow entry creation on a branch while preventing renaming? I understand I need to give write access to - attrs=chidren on parent - attrs=entry on created entry - attrs=<the mandatory attributes for object> Last item include the attributes used for RHS part of the DN. That suggests renaming will always be possible 2) Is it possible to make some entry values mandatory for an entry creation? e.g.: I want to enforce specific values of objectClass -- Emmanuel Dreyfus manu(a)netbsd.org

2 1

How to configure ubuntu server with LDAP group based authentication
by Geo P.C. 02 May '13

02 May '13

By installing libnss-ldap we are able to integrate an Ubuntu server with ldap (openldap). But we are unable to configure ldap group based authentication. We need to configure in such a way that user from a particular group need only to login. Please let me know is it possible configure it and please update us the steps or any url. Thanks Geo

3 3

Need help to configure OpenLDAP!!
by pradyumna dash 02 May '13

02 May '13

Hi, Am facing an issue while configuring OpenLDAP. My suffix looks like below in the *slapd.conf* file and apart from the default schema i have used ppolicy. database bdb suffix "dc=example,dc=com,dc=in" rootdn "cn=Manager,dc=example,dc=com,dc=in" # SAG: 20100203 overlay ppolicy ppolicy_default "cn=default,ou=policies,o=test,dc=example,dc=com,dc=in" ppolicy_use_lockout I have prepared the below LDIF to add *test.ldif* ====== dn: dc=com,dc=in dc: com objectClass: top objectClass: domain dn: dc=example,dc=com,dc=in dc: example objectClass: top objectClass: domain dn: ou=People,dc=example,dc=com,dc=in ou: People objectClass: top objectClass: organizationalUnit dn: ou=Group,dc=example,dc=com,dc=in ou: Group objectClass: top objectClass: organizationalUnit Am using the below command to add this LDIF file: *ldapadd -x -W -D "cn=Manager,dc=example,dc=com,dc=in" -f /opt/test.ldif* But am getting the below error. * "adding new entry "dc=com,dc=in" ldap_add: Server is unwilling to perform (53) additional info: no global superior knowledge**"* Please help. Regards, /Neo

5 4

The problem of BINDDN/BINDPW in ldap.conf (2nd time)
by Madas Pál 01 May '13

01 May '13

Earlier thread: > Tianyin Xu asked, Howard Chu answered: > > > ... > > This works quite fine. Then, I write the parameters into ldap.conf as follows: > > -----------------ldap.conf----------------------- > BASE dc=ucsd,dc=edu > BINDDN cn=admin,dc=ucsd,dc=edu > BINDPW 12345 > ----------------------------------------------------- > > Then only BASE has effect. According to the ldap.conf manual, BINDDN is a > > ... > > Those were not OpenLDAP's ldap.conf. BINDPW isn't mentioned in > OpenLDAP documentation because it does not exist in OpenLDAP. Reading > non-OpenLDAP documentation and attempting to apply it to OpenLDAP > software is a pretty reliable means of confusing yourself. My question: It has been clearly stated, that BINDPW cannot be used in ldaprc (at least in the case of openldap). But it is definitely stated in the manpage of ldap.conf, that BINDDN is a legal user-only option of openldap. My ldaprc says: BASE ou=madas,dc=something BINDDN cn=admin,dc=something TLS_REQCERT allow URI ldaps://ip1.ip2.ip3.ip4 BASE and URI has its effect, BINDDN has not. Did I make a mistake? Thank you in advance. man ldap.conf: ... AUTHOR Kurt Zeilenga, The OpenLDAP Project ACKNOWLEDGEMENTS OpenLDAP Software is developed and maintained by The OpenLDAP Project <http://www.openldap.org/>. OpenLDAP Software is derived from University of Michigan LDAP 3.3 Release. OpenLDAP 2011/11/24 LDAP.CONF(5) ...

2 1

slapd 2.4.33 changes 'dc' to 'ou' after cn=schema,cn=config modification
by Igor Zinovik 30 Apr '13

30 Apr '13

Hello. I'm running openldap 2.4.33 with on-line configuration (slapd-config). Before running slapd with on-line configuration i developed my own schema and after that i converted old fashioned slapd.conf to slapd.d. Today i modified one attribute in my schema from this: olcAttributeTypes: {9}( 2.16.840.1.113730.3.1.217 NAME 'spamassassin' DESC 'Sp amAssassin user preferences settings' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) to this olcAttributeTypes: {9}( 2.16.840.1.113730.3.1.217 NAME 'spamassassin' DESC 'Sp amAssassin user preferences settings' SUP name ) I was binded to cn=config with DN that is not part of that tree, my dn was uid=zinovik,ou=people,dc=...,dc=ru So after that change i noticed that i see following messages while running slaptest: ldap1:~ $ sudo slaptest -vF /etc/openldap/slapd.d 51800ba4 PROXIED attributeDescription "OU" inserted. 51800ba4 PROXIED attributeDescription "DC" inserted. config file testing succeeded I pointed out that this happened because i modified entries in cn=config with modifierName not being part of cn=config namespace. But that is not a problem. Problem happens when i do following ldap1:~ $ cat example.com.ldif dn: dc=example.com,ou=Mail,dc=...,dc=ru objectClass: top objectClass: domain objectClass: amavisAccount dc: example.com amavisLocal: TRUE ldap1:~ $ ldapadd -v -ZZxWD uid=zinovik,ou=people,dc=...,dc=ru -f example.com.ldif add objectClass: top domain amavisAccount add dc: example.com add amavisLocal: TRUE adding new entry "dc=example.com,ou=Mail,dc=...,dc=ru" modify complete ldap1:~ $ ldapsearch -LLLZZxWD uid=zinovik,ou=people,dc=...,dc=ru -b ou=Mail,dc=...,dc=ru -s one '(&)' Enter LDAP Password: dn: dc=example.com,ou=Mail,dc=...,dc=ru objectClass: top objectClass: domain objectClass: amavisAccount ou: example.com amavisLocal: TRUE Why i do not see 'dc' attribute in this entry and why 'ou' appeared? Trace of this operation: 51800cc6 >>> dnPrettyNormal: <dc=example.com,ou=Mail,dc=...,dc=ru> 51800cc6 <<< dnPrettyNormal: <dc=example.com,ou=Mail,dc=...,dc=ru>, <dc=example.com,ou=mail,dc=...,dc=ru> 51800cc6 ==> unique_add <dc=example.com,ou=Mail,dc=...,dc=ru> 51800cc6 oc_check_required entry (dc=example.com,ou=Mail,dc=...,dc=ru), objectClass "domain" 51800cc6 oc_check_required entry (dc=example.com,ou=Mail,dc=...,dc=ru), objectClass "amavisAccount" 51800cc6 oc_check_allowed type "objectClass" 51800cc6 oc_check_allowed type "dc" 51800cc6 oc_check_allowed type "amavisLocal" 51800cc6 oc_check_allowed type "structuralObjectClass" 51800cc6 mdb_dn2entry("dc=example.com,ou=mail,dc=...,dc=ru") 51800cc6 => mdb_dn2id("dc=example.com,ou=mail,dc=...,dc=ru") 51800cc6 <= mdb_dn2id: get failed: MDB_NOTFOUND: No matching key/data pair found (-30798) 51800cc6 => mdb_entry_decode: 51800cc6 <= mdb_entry_decode 51800cc6 mdb_dn2entry("cn=ldap admins,ou=groups,dc=...,dc=ru") 51800cc6 => mdb_dn2id("cn=ldap admins,ou=groups,dc=...,dc=ru") 51800cc6 <= mdb_dn2id: got id=0xfab 51800cc6 => mdb_entry_decode: 51800cc6 <= mdb_entry_decode 51800cc6 mdb_entry_get: rc=0 51800cc6 => mdb_dn2id_add 0x1f19: "dc=example.com,ou=mail,dc=...,dc=ru" 51800cc6 <= mdb_dn2id_add 0x1f19: 0 51800cc6 => index_entry_add( 7961, "dc=example.com,ou=Mail,dc=...,dc=ru" ) 51800cc6 <= index_entry_add( 7961, "dc=example.com,ou=Mail,dc=...,dc=ru" ) success 51800cc6 => mdb_entry_encode(0x00001f19): dc=example.com,ou=Mail,dc=...,dc=ru 51800cc6 <= mdb_entry_encode(0x00001f19): dc=example.com,ou=Mail,dc=...,dc=ru 51800cc6 mdb_add: added id=00001f19 dn="dc=example.com,ou=Mail,dc=...,dc=ru" 51800cc6 send_ldap_result: conn=1000 op=2 p=3 When i try to modify attribute: dn: dc=example.com,ou=Mail,dc=...,dc=ru changetype: modify add: dc dc: example.com I get: modifying entry "dc=example.com,ou=Mail,dc=...,dc=ru" ldap_modify: Object class violation (65) additional info: attribute 'ou' not allowed Even my root object lost its 'dc' attribute somehow: ldap1: ~$ ldapsearch -LLLZZxWD uid=zinovik,ou=people,dc=...,dc=ru -b dc=...,dc=ru -s base '(&)' dn: dc=...,dc=ru ou: ... objectClass: organization objectClass: dcObject o: my organization If it matters i use slapd-mdb as storage backend. I did not changed 'dc' and 'ou': ldap1:~ $ ldapsearch -LLLZZxWD uid=zinovik,ou=people,dc=...,dc=ru -b 'cn={0}core,cn=schema,cn=config' '(&)' olcAttributeTypes|egrep -e "'(ou|dc)'" Enter LDAP Password: olcAttributeTypes: {8}( 2.5.4.11 NAME ( 'ou' 'organizationalUnitName' ) DESC ' olcAttributeTypes: {49}( 0.9.2342.19200300.100.1.25 NAME ( 'dc' 'domainCompone I do not use slapo-rwm. Here are my overlays for dc=...,dc=ru: dn: olcOverlay={0}memberof,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcMemberOf olcOverlay: {0}memberof olcMemberOfDangling: ignore olcMemberOfRefInt: TRUE olcMemberOfGroupOC: groupOfNames olcMemberOfMemberAD: member dn: olcOverlay={1}refint,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcRefintConfig olcOverlay: {1}refint olcRefintAttribute: seeAlso olcRefintAttribute: uniqueMember olcRefintAttribute: member olcRefintNothing: cn=EMPTY dn: olcOverlay={2}unique,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcUniqueConfig olcOverlay: {2}unique olcUniqueURI: ldap:///ou=Hosts,dc=...,dc=ru?ipHostNumber?sub olcUniqueURI: ldap:///ou=People,dc=...,dc=ru?uid,uidNumber?sub olcUniqueURI: ldap:///ou=Groups,dc=...,dc=ru?cn,gidNumber?sub olcUniqueURI: ldap:///ou=Mail,dc=...,dc=ru?mail,mailLocalAddress?sub dn: olcOverlay={3}syncprov,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig olcOverlay: {3}syncprov olcSpCheckpoint: 200 20 olcSpSessionlog: 100

1 0

slapschema and slapd-mdb
by Igor Zinovik 30 Apr '13

30 Apr '13

Hello. Is it safe to run slapschema with slapd-mdb(5) (while slapd is running in r/w mode)?

1 0

replicating a special objectclass with a seperate syncrepl statement
by Al 30 Apr '13

30 Apr '13

Hi, I am wondering if it is possible to have two syncrepl statements on a consumer that pull from the same source, but do so with a different set of parameters and filters that ensure their is no overlap. Below is an example of what I am interested in trying: olcSyncRepl: rid=001 provider=ldap://server1.example.com binddn="MANAGERDN" bindmethod=simple credentials=$PASSWD searchbase="$BASEDN" type=refreshAndPersist retry="5 5 300 5" timeout=1 filter="(!(objectclass=mygroup))" olcSyncRepl: rid=002 provider=ldap://server1.example.com binddn="MANAGERDN" bindmethod=simple credentials=$PASSWD searchbase="$BASEDN" type=refreshOnly interval=00:00:10:00 retry="5 5 300 5" timeout=1 filter="(objectclass=mygroup)" Basically, I am interested in syncing certain groups occasionally (they have a custom objectclass), but everything else as quickly as possible. Thanks! Al

1 0

Chaining stops working after slapd restart
by jeevan kc 29 Apr '13

29 Apr '13

Hi, I am trying to setup a chain overlay to allow writes to a read-only slave to be chained up to the master. dn: olcOverlay={0}chain,olcDatabase={-1}frontend,cn=configchangetype: add objectClass: olcOverlayConfig objectClass: olcChainConfig olcOverlay: {0}chain dn: olcDatabase=ldap,olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config changetype: add objectClass: olcLDAPConfig objectClass: olcChainDatabase olcDBURI: ldap://10.1.0.3/ olcDbIDAssertBind: bindmethod=simple binddn="cn=admin,dc=example,dc=com" credentials=********** mode=self This works until I have to restart the slave ldap server. Can anyone help me fix this problem?

2 1

slow replication
by Meike Stone 29 Apr '13

29 Apr '13

Hello, I've a problem with the speed of replication. I've set up openldap 2.4.33 with a Master and one consumer. At the moment the full replaction takes abaout 32hours. No LDAP operations are made on master or consumer during this time. (I know, i depends on Hardware too, but the two servers are fast ) How long should it need, to replicate a DB from about 6GByte (id2entry.bdb + dn2id.bdb) with 1.6M DN's and about 66M Attributes. Replication is configured with RefreshAndPersist, no DeltaSync. Both servers are on the same IP segment, connected via gigabit ethernet switch. I played in test environment with different parameters: - shm_key - dbnosync - switched off all indexes on consumer except entryUUID and entryCSN - different bdb cachesize - noatime, relatime - ext3/xfs I locked on disk via iostat (nothing seen), no io waits with top, looked on network, but max 5Mbit/s is used, I listen with strace on slapd and I see, that slapd is reading from Network and wrinting it to id2entiry.bdb. Before each Test, I deleted complete ldap db (except DB_CONFIG) and shared memory ipcrm -m Are there similar limitations, that will trigger slow replication like BDB_IDL_LOGN? How can I accelerate this Replication. I'm of the opinion that it was significantly faster with a smaller database. Thanks and kindly regards Meike Configuration: -------------------- Configuration is only a test configuration, some values differs, some are commented out because of playing with them. # Master (Provider) ========================================================== include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/yast.schema include /etc/openldap/schema/rfc2307bis.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args modulepath /usr/lib/ldap moduleload back_bdb moduleload syncprov sizelimit -1 timelimit 300 tool-threads 8 threads 8 serverID 001 ######################################## database bdb suffix "ou=root" rootdn "cn=admin,ou=root" #loglevel stats sync loglevel 0 rootpw <password> directory /DATA/ldap #cachesize 500000 #dncachesize 500000 #idlcachesize 150000 cachefree 500 dirtyread dbnosync shm_key 7 checkpoint 4096 15 index objectClass,entryUUID,entryCSN eq index cn eq,sub index ownattributes .... overlay syncprov syncprov-checkpoint 100 5 # Consumer ========================================================== include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/yast.schema include /etc/openldap/schema/rfc2307bis.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args modulepath /usr/lib/ldap moduleload back_bdb moduleload syncprov sizelimit -1 timelimit 300 serverID 002 #loglevel stats sync loglevel 0 ######################################## database bdb suffix "ou=root" rootdn "cn=admin,ou=root" checkpoint 4096 15 rootpw <password> directory /DATA/ldap dbnosync shm_key 7 checkpoint 4096 15 #cachesize 100000 #dncachesize 100000 #idlcachesize 150000 #cachefree 500 #dirtyread syncrepl rid=020 provider=ldap://192.168.1.10 type=refreshAndPersist retry="5 5 300 +" searchbase="ou=root" attrs="*,+" bindmethod=simple binddn="cn=admin,ou=root" credentials=<password> index entryUUID,entryCSN eq #index cn eq,sub mirrormode FALSE

3 5

translucent overlay and memberof overlay together?
by Steve Eckmann 29 Apr '13

29 Apr '13

Are the translucent and memberof overlays supposed to work together? I have one mdb backend with "native" accounts, and another mdb backend for "remote" accounts using the translucent overlay to proxy a remote AD. I want to be able to add remote account entries to groups in the native branch and have a memberof attribute automatically instantiated in the already added local entry associated with the remote entry. That isn't happening, and what I see in the log is something like: memberof_value_modify DN="cn=xxx,ou=users,ou=remote,dc=example,dc=com" add myMemberOf="cn=myGroup,ou=Groups,ou=Native,dc=example,dc=com" failed err=32 The local objectClass for user entries has myMemberOf as a DN-valued attribute (I tried using the builtin "memberOf", but when that didn't work I thought there might be a conflict between the remote attribute name and the local attribute name). I have the memberof overlay applied to both mdb backends. I guess what I'm trying to do is going across backends. Is that an incorrect/unsupported use of the memberof overlay? Thanks. Steve

1 0

back-sql: restart slapd while new entry ldap_entries view
by hornuda 27 Apr '13

27 Apr '13

Hello, I set up a openldap-server with postgresql backend. Everything works fine but: On http://www.wingfoss.com/content/sample-mysql-for-openldap-back-sql you can read you have to restart the slapd server everytime you change one of the ldap_* tables. But my ldap_entries table is a view but I also have to restart slapd, is this a normal behavior? Thank you! hornuda

1 0

Issue with delta-sync multimaster
by Al 26 Apr '13

26 Apr '13

Hi All, I just recently migrated to a new OpenLDAP environment, and am experiencing an occasional issue. I am using 2.4.35 and Redhat 6 - x64 with OpenLDAP compiled and packaged locally. I have setup multimaster using delta-sync with MDB being utilized for both the user data as well as the access log. This environment is fronted by a load balancer, so traffic is directed to a single server. A couple of times an hour, I get the following error in the log on the second server: -------------------- Apr 25 13:52:19 server2 slapd[15648]: null_callback : error code 0x10 Apr 25 13:52:19 server2 slapd[15648]: syncrepl_message_to_op: rid=011 be_modify cn=USER123,cn=users,cn=domain,cn=com (16) -------------------- After this error, the second server goes into refresh mode and gets a fresh copy. It would appear that this error relates to the ppolicy overlay as the entries in the access log at the time of error shows the pwdFailureTime being removed during a password reset. I do see the pwdFailureTime being set in the access log earlier too, so the data should be there (even though the error code indicates no such attribute). I was luckily able to catch a bunch of debug logging while the issue occured. I have attempted to strip out some useful information, but I have a very large file with more data in it if neccessary. -------------------- 517967bc mdb_modify_internal: 0x000197ed: cn=USER123,cn=users,cn=domain,cn=com 517967bc <= acl_access_allowed: granted to database root 517967bc mdb_modify_internal: replace userPassword 517967bc mdb_modify_internal: replace pwdChangedTime 517967bc mdb_modify_internal: softdel pwdFailureTime 517967bc mdb_modify_internal: replace entryCSN 517967bc mdb_modify_internal: replace modifiersName 517967bc mdb_modify_internal: replace modifyTimestamp 517967bc mdb_modify_internal: delete pwdFailureTime 517967bc mdb_modify_internal: 16 modify/delete: pwdFailureTime: no such attribute 517967bc mdb_modify: modify failed (16) 517967bc send_ldap_result: conn=-1 op=0 p=3 517967bc send_ldap_result: err=16 matched="" text="modify/delete: pwdFailureTime: no such attribute" 517967bc null_callback : error code 0x10 517967bc slap_graduate_commit_csn: removing 0x7fc7ec1bc300 20130425172817.060117Z#000000#001#000000 517967bc syncrepl_message_to_op: rid=011 be_modify cn=USER123,cn=users,cn=domain,cn=com (16) ... 517967bc do_syncrep2: rid=011 delta-sync lost sync on (reqStart=20130425172817.000023Z,cn=accesslog), switching to REFRESH -------------------- Here is the important parts of my config - the configs are mirrored - so its the same on all: -------------------- dn: olcDatabase={1}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb olcDbDirectory: /u01/openldap/live2/var/openldap-data olcSuffix: cn=domain,cn=com olcAddContentAcl: FALSE olcLastMod: TRUE olcLimits: {0}dn.base="cn=ldapreplicator,cn=systems,cn=domain,cn=com " size.soft=unlimited size.hard=unlimited time.soft=unlimited time.hard=un limited olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=Manager,cn=domain,cn=com olcRootPW:: NONONO olcSyncUseSubentry: FALSE olcMirrorMode: TRUE olcMonitoring: TRUE olcDbCheckpoint: 512 5 olcDbNoSync: TRUE olcDbIndex: objectClass eq olcDbIndex: entryUUID eq olcDbIndex: entryCSN eq olcDbIndex: cn pres,eq,sub olcDbIndex: uid eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: uniqueMember eq olcDbIndex: nisNetgroupTriple eq olcDbIndex: sudoUser eq,sub olcDbMaxSize: 25000000000 olcDbMode: 0600 structuralObjectClass: olcMdbConfig entryUUID: a12ed549-25c6-4424-8c4f-fe63eed54ba2 creatorsName: cn=config createTimestamp: 20111014131247Z olcSyncrepl: {0}rid=011 provider=ldap://server1.company.com:21389/ bind method=simple timeout=1 network-timeout=1 binddn="cn=ldapreplicator,cn=system s,cn=domain,cn=com" credentials="NONONONO" keepalive=0:0:0 startt ls=critical filter="(objectclass=*)" searchbase="cn=domain,cn=com" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" logbase="cn=access log" scope=sub schemachecking=off type=refreshAndPersist interval=00:00:00:05 retry="30 +" syncdata=accesslog olcSyncrepl: {1}rid=012 provider=ldap://server2.company.com:21389/ bind method=simple timeout=1 network-timeout=1 binddn="cn=ldapreplicator,cn=system s,cn=domain,cn=com" credentials="NONONO" keepalive=0:0:0 startt ls=critical filter="(objectclass=*)" searchbase="cn=domain,cn=com" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" logbase="cn=access log" scope=sub schemachecking=off type=refreshAndPersist interval=00:00:00:05 retry="30 +" syncdata=accesslog entryCSN: 20130425161500.179131Z#000000#001#000000 modifiersName: cn=Manager,cn=config modifyTimestamp: 20130425161500Z dn: olcOverlay={0}syncprov,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov structuralObjectClass: olcSyncProvConfig entryUUID: 9a4fbba8-fbe8-4f89-a64f-f20d66023a8a creatorsName: cn=config createTimestamp: 20111014131247Z entryCSN: 20130425004117.389246Z#000000#001#000000 modifiersName: cn=Manager,cn=config modifyTimestamp: 20130425004117Z dn: olcOverlay={1}accesslog,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcAccessLogConfig olcOverlay: {1}accesslog olcAccessLogDB: cn=accesslog olcAccessLogOps: writes olcAccessLogPurge: 7+00:00 1+00:00 olcAccessLogSuccess: TRUE structuralObjectClass: olcAccessLogConfig entryUUID: 7e12de76-e7fd-4fb2-83f5-46bb58363dd9 creatorsName: cn=config createTimestamp: 20111014131247Z entryCSN: 20111019170537.715510Z#000000#000#000000 modifiersName: cn=Manager,cn=config modifyTimestamp: 20111019170537Z dn: olcOverlay={2}ppolicy,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcOverlay: {2}ppolicy olcPPolicyHashCleartext: TRUE olcPPolicyUseLockout: FALSE olcPPolicyForwardUpdates: FALSE structuralObjectClass: olcPPolicyConfig entryUUID: c9b15bd3-ae80-42f7-b355-31acebcc941f creatorsName: cn=config createTimestamp: 20111014131247Z entryCSN: 20111014131247.731074Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20111014131247Z dn: olcOverlay={3}memberof,olcDatabase={1}mdb,cn=config objectClass: olcMemberOf objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top olcOverlay: {3}memberof olcMemberOfRefInt: FALSE olcMemberOfGroupOC: groupOfUniqueNames olcMemberOfMemberAD: uniquemember structuralObjectClass: olcMemberOf entryUUID: 370bc13f-ae2a-4082-945d-7e6778967400 creatorsName: cn=Manager,cn=config createTimestamp: 20121001170641Z entryCSN: 20121001170641.572227Z#000000#000#000000 modifiersName: cn=Manager,cn=config modifyTimestamp: 20121001170641Z dn: olcDatabase={2}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {2}mdb olcDbDirectory: /u01/openldap/live2/var/accesslog-data olcSuffix: cn=accesslog olcAccess: {0}to dn.subtree="cn=accesslog" by dn.base="cn=manager,cn=company, cn=com" read by dn.base="cn=ldapreplicator,cn=systems,cn=company,cn=com" read by group/groupOfUniqueNames/uniqueMember.exact="cn=ldap_ admins,cn=ldap,cn=groups,cn=domain,cn=com" read by * none olcAddContentAcl: FALSE olcLastMod: TRUE olcLimits: {0}dn.base="cn=ldapreplicator,cn=systems,cn=domain,cn=com " size.soft=unlimited size.hard=unlimited time.soft=unlimited time.hard=un limited olcMaxDerefDepth: 15 olcReadOnly: FALSE olcSyncUseSubentry: FALSE olcMonitoring: TRUE olcDbNoSync: TRUE olcDbIndex: default eq olcDbIndex: objectClass eq olcDbIndex: entryCSN eq olcDbIndex: reqStart eq olcDbIndex: reqEnd eq olcDbIndex: reqResult eq olcDbIndex: reqDN eq olcDbMaxSize: 25000000000 olcDbMode: 0600 structuralObjectClass: olcMdbConfig entryUUID: 76907acf-5c8e-4650-9b36-023da1655a81 creatorsName: cn=config createTimestamp: 20111014131247Z entryCSN: 20130424144439.664389Z#000000#001#000000 modifiersName: cn=Manager,cn=config modifyTimestamp: 20130424144439Z dn: olcOverlay={0}syncprov,olcDatabase={2}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpNoPresent: TRUE olcSpReloadHint: TRUE structuralObjectClass: olcSyncProvConfig entryUUID: d6cadc16-c4f7-4daf-9a6b-9a37db55ca91 creatorsName: cn=config createTimestamp: 20111014131247Z entryCSN: 20111014131247.731074Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20111014131247Z -------------------- Thank you in advance for any help you might be able to offer. AL

2 3

Reduce the influence of ldap server trouble
by Yuki Takase 26 Apr '13

26 Apr '13

Hi all I'm a beginner of openldap. When I can't use a ldap server because of hardware or network trouble, I want to reduce the influence of ldap client. I changed the following configration of ldap.conf. bind_policy soft bind_timelimit 10 nss_initgroups_ignoreusers [local users...] Are there other solutions to reduce the influence? I use WebSphereMQ on Linux server. I added MQ's startup user 'mqm' to nss_initgroups_ignoreusers. But WebSphereMQ's startup command 'strmqm' always tries to connect to a ldap server. (I think that's a specification.) I use a ldap server to authentification of server maintenance members. But in some case such as above is it better not to use ldap?

2 1

hdb and mdb dereferencing aliases differently
by Juergen.Sprenger＠swisscom.com 26 Apr '13

26 Apr '13

Hi Michael, NSS results must not be dependent on the backend database a directory service uses. I activated connection logging and here's the proof that NSS is not the culprit. Searches initiated by NSS are identical and exactly this behavior can also be seen when using ldapsearch from command line with parameters from the log: # running 'getent passwd' with hdb backend: Apr 24 09:53:54 openldap-dev slapd[19240]: conn=1000 op=0 BIND dn="cn=itsAgent,ou=customerAgent,dc=scom" method=128 Apr 24 09:53:54 openldap-dev slapd[19240]: conn=1000 op=0 BIND dn="cn=itsAgent,ou=customerAgent,dc=scom" mech=SIMPLE ssf=0 Apr 24 09:53:54 openldap-dev slapd[19240]: conn=1000 op=0 RESULT tag=97 err=0 text= Apr 24 09:53:54 openldap-dev slapd[19240]: conn=1000 op=1 SRCH base="ou=account,dc=its,dc=scom" scope=1 deref=3 filter="(objectClass=posixAccount)" Apr 24 09:53:54 openldap-dev slapd[19240]: conn=1000 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory x-LinuxLoginShell gecos description objectClass Apr 24 09:53:54 openldap-dev slapd[19240]: conn=1000 op=1 SEARCH RESULT tag=101 err=0 nentries=656 text= Apr 24 09:53:54 openldap-dev slapd[19240]: conn=1000 fd=13 closed (connection lost) # running 'getent passwd' with mdb backend: Apr 24 10:00:17 openldap-dev slapd[19300]: conn=1002 op=0 BIND dn="cn=itsAgent,ou=customerAgent,dc=scom" method=128 Apr 24 10:00:17 openldap-dev slapd[19300]: conn=1002 op=0 BIND dn="cn=itsAgent,ou=customerAgent,dc=scom" mech=SIMPLE ssf=0 Apr 24 10:00:17 openldap-dev slapd[19300]: conn=1002 op=0 RESULT tag=97 err=0 text= Apr 24 10:00:17 openldap-dev slapd[19300]: conn=1002 op=1 SRCH base="ou=account,dc=its,dc=scom" scope=1 deref=3 filter="(objectClass=posixAccount)" Apr 24 10:00:17 openldap-dev slapd[19300]: conn=1002 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory x-LinuxLoginShell gecos description objectClass Apr 24 10:00:17 openldap-dev slapd[19300]: conn=1002 op=1 SEARCH RESULT tag=101 err=0 text= Apr 24 10:00:17 openldap-dev slapd[19300]: conn=1002 fd=13 closed (connection lost) I suspect that aliases are not handled the same way in hdb and mdb as I am using aliases here and deref=3 in both searches, example: dn: uid=joe,ou=Account,dc=its,dc=scom objectClass: alias objectClass: extensibleObject uid: joe aliasedObjectName: uid=joe,ou=Person,dc=its,dc=scom structuralObjectClass: alias When using hdb, the alias is dereferenced correctly (nentries=656), when using mdb it seems not to be dereferenced at all (nentries=0). Maybe there's a parameter around for mdb which I couldn't find in the docs to prevent this, but if not I consider this as a bug. Regards Juergen michael(a)stroeder.com wrote: >It would certainly help if you could examine the issue with pure LDAP search >operations preferably with OpenLDAP's ldapsearch command-line tool. > >When looking at NSS results too many things can go wrong with other >components' configuration. > >Ciao, Michael. > >Juergen.Sprenger(a)swisscom.com wrote: >> Hi, >> >> I have running OpenDLAP 2.4.35 on Gentoo Linux and wanted to make some tests with mdb. >> >> Slapd was running fine with hdb, no problems so far. >> Then I exported contents via slapcat and switched config to mdb. >> When slapd started using mdb no users from directory were shown by 'getent passwd': >> >> ### hdb part #### >> # using hdb parameters >> database hdb >> dirtyread >> cachesize 150000 >> cachefree 100 >> idlcachesize 450000 >> dncachesize 100000 >> >> # slapadd from backup and run slapd with hdb backend >> /etc/init.d/unscd stop >> /etc/init.d/slapd stop >> rm /var/lib/openldap-data/* >> rm -rf /etc/openldap/slapd.d/* >> cp -p /etc/openldap/DB_CONFIG /var/lib/openldap-data/ >> cp -p /etc/openldap/slapd.conf.hdb /etc/openldap/slapd.conf >> su ldap -c '/usr/sbin/slapadd -f /etc/openldap/slapd.conf -l odsldap-dev.ldif' >> /etc/init.d/slapd start >> /etc/init.d/unscd start >> slapcat -f /etc/openldap/slapd.conf -b dc=scom | md5sum >> # 73850f9a3f7ff9d3d1ddb7663cd046a6 - >> >> getent passwd >> # all users shown, everything ok >> >> ### mdb part #### >> # using mdb paramters >> database mdb >> dbnosync >> maxsize 2094967296 >> searchstack 64 >> >> # slapadd from backup and run slapd with mdb backend >> /etc/init.d/unscd stop >> /etc/init.d/slapd stop >> rm /var/lib/openldap-data/* >> rm -rf /etc/openldap/slapd.d/* >> cp -p /etc/openldap/slapd.conf.mdb /etc/openldap/slapd.conf >> su ldap -c '/usr/sbin/slapadd -f /etc/openldap/slapd.conf -l odsldap-dev.ldif' >> /etc/init.d/slapd start >> /etc/init.d/unscd start >> slapcat -f /etc/openldap/slapd.conf -b dc=scom | md5sum >> # 73850f9a3f7ff9d3d1ddb7663cd046a6 - <> >> getent passwd >> # no users from ldap shown >> >> Am I missing something when setting up and using mdb? >> Both backends have exactly the same content, and so the results for searches should also be identical. >> >> Regards >> >> Jürgen Sprenger

3 3

odd multi-master inconsistency
by Brian Gold 25 Apr '13

25 Apr '13

Hi all. Kind of an odd issue that I was hoping to get your advice with. I'm currently running a pair of rhel6 servers (hostnames: ldap1 & ldap2) w/ openldap-2.4.23 in multi-master. I also have a pair of rhel6 servers running keepalived & haproxy to act as loadbalancers (floating ip resolves to hostname: ldap) to direct ldap queries from some of our less documented/older services from the days before we had 2 ldap servers or from services that can't natively handle failover ldap providers. This setup has been working without issue (from what I could tell) for over 2 years. I noticed today that we have an issue with 2x of our users ldap entries. They went from being students to being staff, which necessitated a uid change (username09 for student to username for staff). We have a script that was written years ago for handling these uid changes. Apparently, when this script was run on these two users, the uid change happened only on one of the ldap servers. The other still contains the old uid information. Here is a sanitized version of the script: http://pastebin.com/UiDJgWKA Would love some advice on why this might not have replicated and what I might be able to do to prevent this in the future.

3 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical