- openldap-technical - openldap.org

retrieve local operational attributes with translucent overlay?
by Steve Eckmann 25 Apr '13

25 Apr '13

Is it possible to retrieve operational attributes associated with local entries in the context of translucent overlay queries? For example, to retrieve the local entryUUID, I try something like this: ldapsearch -x -H ldaps://localhost -LLL -b ou=people,dc=issinc,dc=com \ -D "cn=admin,ou=people,dc=issinc,dc=com" -W \ '(mail=steve.eckmann(a)issinc.com)' dn entryUUID where the 'mail' attribute is remote. I get back the DN but not an entryUUID. If I specify + instead of entryUUID I get back three operational attributes: entryDN, subschemaSubentry, and hasSubordinates. If I query a purely local backend with + I get several operational attributes, including the three I want: entryUUID, createTimestamp, and modifyTimestamp. Is there something I can put in my slapd.conf or in the search to get specific local operational attributes? Thanks. Steve

1 0

slapd terminates with error "read_config: no serverID / URL match found. Check slapd -h arguments"
by Joe Phan 24 Apr '13

24 Apr '13

Hi, When I configure N-Way Multi-Master configuration with cn=config, slapd terminates with the error: "module syncprov.la: null module registered" and "read_config: no serverID / URL match found. Check slapd -h arguments". olcServerID IDs are already added and configured properly, but when slapd starts with -h option, it always fails. Please help if someone has gone through a similar issue. Thanks, Joe Reference, Step 3-4: http://niranjanmr.wordpress.com/2012/03/29/n-waymmr/ Is there an equivalent /etc/sysconfig/ldap file in Solaris 10? Platform: Sun Solaris10 OpenLDAP: openldap-2.4.32 Configuring for N-Way Multi-Master: adding olcServerID, olcOverlay: syncprov, and olcSyncRepl: apggd04dev# more config_repl.ldif #Specify ServerID for both the masters dn: cn=config changetype: modify add: olcServerID olcServerID: 101 ldap://apggd06dev.pg.dtveng.net olcServerID: 201 ldap://apggd04dev.pg.dtveng.net #Enable Syncprov Overlay for config database dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config changetype: add objectclass: olcOverlayConfig objectclass: olcSyncProvConfig olcOverlay: syncprov #Configure SyncRepl for config database dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=ldap://apggd06dev.pg.dtveng.net binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncRepl: rid=002 provider=ldap://apggd04dev.pg.dtveng.net binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 - add: olcMirrorMode olcMirrorMode: TRUE apggd04dev# ldapmodify -x -D "cn=config" -w secret -f config_repl.ldif -h apggd04dev.pg.dtveng.net <== olcServerID IDs are already added successfully to dn: cn=config. modifying entry "cn=config" adding new entry "olcOverlay=syncprov,olcDatabase={0}config,cn=config" modifying entry "olcDatabase={0}config,cn=config" Restart slapd with -h option: ==================== apggd04dev# /usr/local/libexec/slapd -d -1 -h ldap://apggd04dev.pg.dtveng.net:389 entryUUID: 05897b3c-3bd8-1032-8598-57af23b0cca0 creatorsName: cn=config createTimestamp: 20130417182610Z olcServerID: 101 ldap://apggd06dev.pg.dtveng.net <=== olcServerID IDs are successfully loaded olcServerID: 201 ldap://apggd04dev.pg.dtveng.net <=== olcServerID IDs are successfully loaded entryCSN: 20130418183118.510871Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20130418183118Z contextCSN: 20130418183118.573577Z#000000#000#000000 ... olcModuleLoad: {0}syncprov.la 51705faf loaded module syncprov.la 51705faf module syncprov.la: null module registered <=== ERROR for syncprov.la module ... olcSyncrepl: {0}rid=001 provider=ldap://apggd06dev.pg.dtveng.net binddn="cn=co <=== olcSyncrepl is successfully loaded nfig" bindmethod=simple credentials=secret searchbase="cn=config" type=refres hAndPersist retry="5 5 300 5" timeout=1 olcSyncrepl: {1}rid=002 provider=ldap://apggd04dev.pg.dtveng.net binddn="cn=co nfig" bindmethod=simple credentials=secret searchbase="cn=config" type=refres hAndPersist retry="5 5 300 5" timeout=1 olcMirrorMode: TRUE ... 5170847e index objectClass 0x0004 5170847e index entryUUID 0x0006 5170847e index entryCSN 0x0006 5170847e send_ldap_result: conn=-1 op=0 p=0 5170847e send_ldap_result: err=0 matched="" text="" 5170655f read_config: no serverID / URL match found. Check slapd -h arguments. <=== ERROR for serverID 5170655f slapd destroy: freeing system resources. 5170655f syncinfo_free: rid=001 5170655f slapd stopped. <=== slapd terminates 5170655f connections_destroy: nothing to destroy.

3 4

Documentation for memberof overlay
by Philip Colmer 24 Apr '13

24 Apr '13

I'm trying to find documentation for the various values that can be specified for the MemberOf overlay, particularly olcMemberOfMemberAD and olcMemberOfMemberOfAD. There are other values where I'm curious as to why they have their particular value (e.g. olcMemberOfDangling: ignore). Where is this stuff documented, please? I've tried searching openldap.orgweb site but cannot find anything definitive. Thanks. Philip

2 1

pbkdf2_sha256
by Alessandro Dentella 24 Apr '13

24 Apr '13

Hi, is it possible to use password stored as pbkdf2_sha256 in slapd? A first trial on ubuntu 12.04 seems to fail... My trial was: userPassword: {PBKDF2-SHA256}12000$1Pqf0/pfyxmDsPaeEwIghA$ory6WKYGfDASDNwhsWoOiVHwqmBnHginfu.FD2YuXIs Thnaks in advance sandro *:-) -- Sandro Dentella *:-) http://www.reteisi.org Soluzioni libere per le scuole http://sqlkit.argolinux.org SQLkit home page - PyGTK/python/sqlalchemy

2 2

RE: slapd-meta as a proxy for a monolithic namespace
by Hummel, Wolfgang 24 Apr '13

24 Apr '13

Hello, thanks a lot for your support on this topic. Both inputs from Howard and Pierangelo were really helpful. With the additional config tweak it works properly. So far I tested search and delete operations successfully. Other tests to follow ... Regards Wolfgang Hummel -----Original Message----- From: Hummel, Wolfgang Sent: Dienstag, 23. April 2013 18:10 To: 'openldap-technical(a)openldap.org' Subject: slapd-meta as a proxy for a monolithic namespace Hello OpenLDAP community, we are currently planning for a largescale directory with > 1 Bio. entries in a single namespace. The idea is to divide the DB in 10 equal sized DBs and let them access by slapd-meta proxies. Example: dn: ou=rsp1,c=de,o=mno entries with uid=79101234567890, 79101234567891 etc. 791 is always fix In our scenario each server would have 100 Mio. entries using the last digit of uid as a naturally even balanced distribution mechanism. Here are the questions: - is slapd-meta a feasible approach for this scenario ? - how could the slapd.conf for the proxy look like ? Here is a (non working) example with 2 backend servers. What is wrong about it ? ... moduleload back_meta moduleload back_ldap ... ####################################################################### # Meta database ####################################################################### database meta suffix " ou=rsp1,c=de,o=mno" dncache-ttl forever lastmod off rootdn "cn=admin,ou=rsp1,c=de,o=mno" rootpw secret network-timeout 1 uri "ldap://10.11.12.170/ ou=rsp1,c=de,o=mno" rewriteEngine on #rewriteContext searchFilterAttrDN rewriteContext searchFilter rewriteRule '^uid=[0-9]{11}1,.*' 'ldap://10.11.12.170/%0' ':@' uri "ldap://10.11.12.180/ ou=rsp1,c=de,o=mno" rewriteEngine on #rewriteContext searchFilterAttrDN rewriteContext searchFilter rewriteRule '^uid=[0-9]{11}2,.*' 'ldap://10.11.12.180/%0' ':@' ...

1 0

slapd-meta as a proxy for a monolithic namespace
by Hummel, Wolfgang 24 Apr '13

24 Apr '13

Hello OpenLDAP community, we are currently planning for a largescale directory with > 1 Bio. entries in a single namespace. The idea is to divide the DB in 10 equal sized DBs and let them access by slapd-meta proxies. Example: dn: ou=rsp1,c=de,o=mno entries with uid=79101234567890, 79101234567891 etc. 791 is always fix In our scenario each server would have 100 Mio. entries using the last digit of uid as a naturally even balanced distribution mechanism. Here are the questions: - is slapd-meta a feasible approach for this scenario ? - how could the slapd.conf for the proxy look like ? Here is a (non working) example with 2 backend servers. What is wrong about it ? ... moduleload back_meta moduleload back_ldap ... ####################################################################### # Meta database ####################################################################### database meta suffix " ou=rsp1,c=de,o=mno" dncache-ttl forever lastmod off rootdn "cn=admin,ou=rsp1,c=de,o=mno" rootpw secret network-timeout 1 uri "ldap://10.11.12.170/ ou=rsp1,c=de,o=mno" rewriteEngine on #rewriteContext searchFilterAttrDN rewriteContext searchFilter rewriteRule '^uid=[0-9]{11}1,.*' 'ldap://10.11.12.170/%0' ':@' uri "ldap://10.11.12.180/ ou=rsp1,c=de,o=mno" rewriteEngine on #rewriteContext searchFilterAttrDN rewriteContext searchFilter rewriteRule '^uid=[0-9]{11}2,.*' 'ldap://10.11.12.180/%0' ':@' ... logfile snippet for # ldapsearch -LLL -xD uid=admin,ou=rsp1,c=de,o=mno -w secret -b ou=rsp1,c=de,o=mno uid=791720001981 ldap_bind: Invalid credentials (49) Apr 23 08:44:13 slapd[26200]: >>> dnPrettyNormal: <uid=admin,ou=rsp1,c=de,o=mno> Apr 23 08:44:13 slapd[26200]: <<< dnPrettyNormal: <uid=admin,ou=rsp1,c=de,o=mno>, <uid=admin,ou=rsp1,c=de,o=mno> Apr 23 08:44:13 slapd[26200]: conn=1015 op=0 BIND dn="uid=admin,ou=rsp1,c=de,o=mno" method=128 Apr 23 08:44:13 slapd[26200]: do_bind: version=3 dn="uid=admin,ou=rsp1,c=de,o=mno" method=128 Apr 23 08:44:13 slapd[26200]: conn=1015 op=0 meta_back_bind: dn="uid=admin,ou=rsp1,c=de,o=mno". Apr 23 08:44:13 slapd[26200]: conn=1015 op=0: meta_back_getconn[0] Apr 23 08:44:13 slapd[26200]: conn=1015 op=0: meta_back_getconn[1] Apr 23 08:44:13 slapd[26200]: conn=1015 op=0 meta_back_getconn: candidates=2 conn=ANON fetched Apr 23 08:44:13 slapd[26200]: conn=1015 op=0 >>> meta_back_search_start[0] Apr 23 08:44:13 slapd[26200]: conn=1015 op=0 >>> meta_search_dobind_init[0] Apr 23 08:44:13 slapd[26200]: conn=1015 op=0 <<< meta_search_dobind_init[0]=1 Apr 23 08:44:13 slapd[26200]: ==> rewrite_context_apply [depth=1] string='uid=admin,ou=rsp1,c=de,o=mno' Apr 23 08:44:13 slapd[26200]: ==> rewrite_context_apply [depth=1] res={0,'NULL'} Apr 23 08:44:13 slapd[26200]: [rw] searchBase: "uid=admin,ou=rsp1,c=de,o=mno" -> "uid=admin,ou=rsp1,c=de,o=mno" Apr 23 08:44:13 slapd[26200]: ==> rewrite_context_apply [depth=1] string='(objectClass=*)' Apr 23 08:44:13 slapd[26200]: ==> rewrite_rule_apply rule=''^uid=[0-9]{11}1,.*'' string='(objectClass=*)' [1 pass(es)] Apr 23 08:44:13 slapd[26200]: ==> rewrite_context_apply [depth=1] res={0,'(objectClass=*)'} Apr 23 08:44:13 slapd[26200]: [rw] searchFilter: "(objectClass=*)" -> "(objectClass=*)" Apr 23 08:44:13 slapd[26200]: conn=1015 op=0 <<< meta_back_search_start[0]=1 Apr 23 08:44:13 slapd[26200]: conn=1015 op=0 >>> meta_back_search_start[1] Apr 23 08:44:13 slapd[26200]: conn=1015 op=0 >>> meta_search_dobind_init[1] Apr 23 08:44:13 slapd[26200]: conn=1015 op=0 <<< meta_search_dobind_init[1]=1 Apr 23 08:44:13 slapd[26200]: ==> rewrite_context_apply [depth=1] string='uid=admin,ou=rsp1,c=de,o=mno' Apr 23 08:44:13 slapd[26200]: ==> rewrite_context_apply [depth=1] res={0,'NULL'} Apr 23 08:44:13 slapd[26200]: [rw] searchBase: "uid=admin,ou=rsp1,c=de,o=mno" -> "uid=admin,ou=rsp1,c=de,o=mno" Apr 23 08:44:13 slapd[26200]: ==> rewrite_context_apply [depth=1] string='(objectClass=*)' Apr 23 08:44:13 slapd[26200]: ==> rewrite_rule_apply rule=''^uid=[0-9]{11}2,.*'' string='(objectClass=*)' [1 pass(es)] Apr 23 08:44:13 slapd[26200]: ==> rewrite_context_apply [depth=1] res={0,'(objectClass=*)'} Apr 23 08:44:13 slapd[26200]: [rw] searchFilter: "(objectClass=*)" -> "(objectClass=*)" Apr 23 08:44:13 slapd[26200]: conn=1015 op=0 <<< meta_back_search_start[1]=1 Apr 23 08:44:13 slapd[26200]: conn=1015 op=0 meta_back_search: ncandidates=2 cnd="**" Apr 23 08:44:13 slapd[26200]: daemon: activity on 1 descriptor Apr 23 08:44:13 slapd[26200]: daemon: activity on: Apr 23 08:44:13 slapd[26200]: Apr 23 08:44:13 slapd[26200]: daemon: epoll: listen=8 active_threads=0 tvp=zero Apr 23 08:44:13 slapd[26200]: daemon: epoll: listen=9 active_threads=0 tvp=zero Apr 23 08:44:13 slapd[26200]: conn=1015 op=0 meta_back_search[0] match="" err=32 (No such object). Apr 23 08:44:13 slapd[26200]: conn=1015 op=0 meta_back_search[1] match="" err=32 (No such object). Apr 23 08:44:13 slapd[26200]: send_ldap_result: conn=1015 op=0 p=3 Apr 23 08:44:13 slapd[26200]: send_ldap_result: err=32 matched="ou=rsp1,c=de,o=mno" text="" Apr 23 08:44:13 slapd[26200]: conn=1015 op=0 meta_back_bind: no target for dn "uid=admin,ou=rsp1,c=de,o=mno" (32).

3 2

ldap with TLS
by Rodney Simioni 24 Apr '13

24 Apr '13

Hi, I'm getting a weird behavior in LDAP with TLS. Using: openldap Linux Red Hat Sssd Nslcd When I issue a ' ldapsearch -x ZZ', it works flawlessly but when issue a `getent passwd`, I get back the system users in /etc/passwd file but I don't see the ldap users. The openldap.log indicates the following when I issue the 'getent passwd' command connection_read(14): TLS accept failure error=-1 id=1037 But it does not give any errors when doing the ldapsearch -x ZZ. So, if I have TLS not correctly configured, shouldn't it not work completely? Here's my sssd.conf: [domain/local] debug_level = 9 ldap_id_use_start_tls = True cache_credentials = True ldap_search_base = dc=wh,dc=local id_provider = ldap auth_provider = ldap chpass_provider = ldap ldap_uri = ldap://127.0.0.1/ ldap_tls_cacert = /certs/cacert.pem [sssd] services = nss, pam config_file_version = 2 domains = local [nss] [pam] [sudo] [autofs] [ssh] Here's my nslcd.conf: uri ldap://127.0.0.1/ base dc=wh,dc=local ssl start_tls tls_cacertfile /certs/cacert.pem tls_reqcert hard Here's my /etc/openldap/ldap.conf: TLS_CACERT /certs/cacert.pem TLS_REQCERT hard URI ldap://127.0.0.1/ BASE dc=wh,dc=local This email message is intended for the use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, distribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. Verio Inc. makes no warranty that this email is error or virus free. Thank you.

3 2

hdb and mdb have different search results/behaviour
by Juergen.Sprenger＠swisscom.com 23 Apr '13

23 Apr '13

Hi, I have running OpenDLAP 2.4.35 on Gentoo Linux and wanted to make some tests with mdb. Slapd was running fine with hdb, no problems so far. Then I exported contents via slapcat and switched config to mdb. When slapd started using mdb no users from directory were shown by 'getent passwd': ### hdb part #### # using hdb parameters database hdb dirtyread cachesize 150000 cachefree 100 idlcachesize 450000 dncachesize 100000 # slapadd from backup and run slapd with hdb backend /etc/init.d/unscd stop /etc/init.d/slapd stop rm /var/lib/openldap-data/* rm -rf /etc/openldap/slapd.d/* cp -p /etc/openldap/DB_CONFIG /var/lib/openldap-data/ cp -p /etc/openldap/slapd.conf.hdb /etc/openldap/slapd.conf su ldap -c '/usr/sbin/slapadd -f /etc/openldap/slapd.conf -l odsldap-dev.ldif' /etc/init.d/slapd start /etc/init.d/unscd start slapcat -f /etc/openldap/slapd.conf -b dc=scom | md5sum # 73850f9a3f7ff9d3d1ddb7663cd046a6 - getent passwd # all users shown, everything ok ### mdb part #### # using mdb paramters database mdb dbnosync maxsize 2094967296 searchstack 64 # slapadd from backup and run slapd with mdb backend /etc/init.d/unscd stop /etc/init.d/slapd stop rm /var/lib/openldap-data/* rm -rf /etc/openldap/slapd.d/* cp -p /etc/openldap/slapd.conf.mdb /etc/openldap/slapd.conf su ldap -c '/usr/sbin/slapadd -f /etc/openldap/slapd.conf -l odsldap-dev.ldif' /etc/init.d/slapd start /etc/init.d/unscd start slapcat -f /etc/openldap/slapd.conf -b dc=scom | md5sum # 73850f9a3f7ff9d3d1ddb7663cd046a6 - getent passwd # no users from ldap shown Am I missing something when setting up and using mdb? Both backends have exactly the same content, and so the results for searches should also be identical. Regards Jürgen Sprenger

2 1

Re: OpenLDAP 2.4.35 available
by Clément OUDOT 23 Apr '13

23 Apr '13

2013/4/1 OpenLDAP Project <project(a)openldap.org> > OpenLDAP 2.4.35 is now available for download as detailed on our download > page: > > http://www.openldap.org/software/download/ > > and should soon be available on all official mirrors: > > ftp://ftp.openldap.org/pub/OpenLDAP/MIRRORS > > This is a maintenance release and is made available for general use. > Users of OpenLDAP Software are encouraged to upgrade. > > Hi, as usual, you can find some RPMs here: http://ltb-project.org/wiki/download#openldap Clément.

3 2

clarification on ldap with ssl/tls
by Rodney Simioni 23 Apr '13

23 Apr '13

Hi, I've been tasked to enable ssl/tls on ldap. The server already has a certificate and key file. After looking at documentation, these are the three files that are needed In the ldap.conf file: TLSCertificateFile /etc/openldap/servercrt.pem TLSCertificateKeyFile /etc/openldap/serverkey.pem TLSCACertificateFile /etc/openldap/cacert.pem I already have the TLSCertificateFile and TLSCertificateKeyFile but I don't have the TLSCACertificateFile. Is that something I have to generate? Rod This email message is intended for the use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, distribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. Verio Inc. makes no warranty that this email is error or virus free. Thank you.

4 3

hashed credentials for idassert-bind?
by Steve Eckmann 23 Apr '13

23 Apr '13

I thought I could use something like "credentials={SSHA}/iiPJIZ2Srf+O0HqLIypyKYKccx9V6ag" with idassert-bind or acl-bind in configuring an ldap backend in slapd.conf, instead of including the cleartext password. But when I try that I get an "invalid credentials" error from the proxied Active Directory. I've carefully regenerated the hashed value with slappasswd and repasted the new value into my slapd.conf file, so I'm pretty sure that the hash is correct. Is there a right way to obfuscate passwords that will be sent to a proxied AD server? Thanks. Steve

3 4

Re: How to improve performance with MDB backend?
by Saša-Stjepan Bakša 21 Apr '13

21 Apr '13

How do you measure or compare speed? I have a Python program which add a predefined number of users (1mil and each user consists of 8 DNs and 3 alias DNs) and for Modify test I have also Python program which modify 1 attribute with random value under one DN changed sequentially from 1 to 1mil) Now I can add those 1 million of users in 5508 sec what amounts to 181,55 users per second. Modify program can do 2141,33 modifications per sec. Do you find those numbers reasonable or are they nonsense? Is there a way to get 10000 modifications per second or I am asking a stupid question? Sasa On Mon, Apr 8, 2013 at 4:40 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Monday, April 08, 2013 4:49 AM -0700 Howard Chu <hyc(a)symas.com> > wrote: > > Saša-Stjepan Bakša wrote: >> >>> Hi, >>> >>> Maybe this is not the best way to ask but I would like to get some >>> performance expectations or maybe suggestions how to improve >>> performance. I do have relatively long experience with OpenLDAP as a >>> precompiled package and with much less users so performance was not an >>> issue for those installations. >>> >>> Now I need to put few million users (now one million for test), custom >>> tailored schema and search performance is crucial but also modify >>> performance is big issue. Before MDB I have used HDB as backend. >>> >>> What to do to improve write part of performance or performance in general >>> (when adding data – from time to time – OpenLDAP stalls in a way)? >>> Just around 5 add/mod operations during that time then it continue with >>> much higher speed. >>> >>> I have used many different sources to find out other peoples experience >>> and I didn't choose to write to list lightly but I really need some >>> help/hints. >>> >> >> There's nothing particular to LMDB to tune. But if you're seeing pauses >> due to disk I/O, as your iotop output seems to indicate, you might want >> to look into using a different I/O scheduler. >> > > Not quite true. On Linux, I suggest setting the olcDbFlags as follows: > > olcDbEnvFlags: writemap > olcDbEnvFlags: nometasync > > With those flags set, writes are 65x faster for me with back-mdb than they > are with back-hdb/back-bdb. > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

7 27

backsql -> slapd restart necessary?
by hornuda 21 Apr '13

21 Apr '13

Hello, I use backsql as ldap backend. Is it necessary to restart the slapd server when a new entry was written into a table (postgresql) to make this entry available in ldap? Cheers, hornuda

2 1

disabling user account
by Jignesh Patel 20 Apr '13

20 Apr '13

Does openldap has a provision like active directory to disable a user? useraccountcontrol 544 -Jignesh

6 8

LDAP proxy
by Šerých Jakub 19 Apr '13

19 Apr '13

Dear group, I manage the school network in which we have two separate MS-AD servers (one for teachers and the other for students). We also have mySQL database of our alumni. I would like to connect this three information bases to one "virtual" LDAP server (for authentication purposes on various LAMP web servers etc.). Is it possible to configure such virtual or proxy server using OpenLDAP? And if yes, could anybody be so kind and redirect me to some how-to resources? I was trying to search this using Google, but as I'm OpenLDAP newbie, I don't know the terminology exactly and my search results are not good. Thanks in advance for any help Jakub

2 1

Re: Alias dereferencing
by Saša-Stjepan Bakša 19 Apr '13

19 Apr '13

Compiled from source, version current OpenLDAP RE24 (from GIT) ./configure --prefix=/opt/openldap Data was added with same ldapadd progy, schema is the same version. Here it is - config, slapcat from slapd.d (lengthy schema omitted): dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /opt/openldap/var/run/slapd.args olcLogLevel: none olcPidFile: /opt/openldap/var/run/slapd.pid structuralObjectClass: olcGlobal creatorsName: cn=config entryUUID: a8df00ce-80fb-1031-8652-fff9cf1d6a3e createTimestamp: 20120822232009Z olcServerID: 1 ldap://spr1.lab.os olcServerID: 2 ldap://spr2.lab.os olcThreads: 2 olcToolThreads: 32 olcIdleTimeout: 10 entryCSN: 20130402101823.578807Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20130402101823Z contextCSN: 20130402101823.578807Z#000000#001#000000 contextCSN: 20130329141804.133907Z#000000#002#000000 dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema structuralObjectClass: olcSchemaConfig entryUUID: 9c79c918-80fb-1031-92fa-11190a1d893e creatorsName: cn=config createTimestamp: 20120822231948Z entryCSN: 20120822231948.419573Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20120822231948Z snip-----------------------------------------------------------------------------------------snip dn: olcBackend={0}mdb,cn=config objectClass: olcBackendConfig olcBackend: {0}mdb structuralObjectClass: olcBackendConfig entryUUID: 8c59fb88-2cc3-1032-9b7c-c7b2eb845e03 creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20130329135149Z entryCSN: 20130329135149.548491Z#000000#001#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20130329135149Z dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth manage by * break olcAccess: {1}to dn.exact="" by * read olcAccess: {2}to dn.base="cn=Subschema" by * read structuralObjectClass: olcDatabaseConfig creatorsName: cn=config entryUUID: a8df0ace-80fb-1031-8653-fff9cf1d6a3e createTimestamp: 20120822232009Z olcSizeLimit: 5000000 entryCSN: 20130326133336.496532Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20130326133336Z dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth manage by * break structuralObjectClass: olcDatabaseConfig entryUUID: a8df1960-80fb-1031-8654-fff9cf1d6a3e creatorsName: cn=config olcRootDN: cn=admin,cn=config createTimestamp: 20120822232009Z olcRootPW:: e1NTSEF9eDRVRTBiV2Z4YnFSNnZDVDdKRWEwSWRhWFRhMDN2M3I= olcSyncrepl: {0}rid=001 provider=ldap://spr1.lab.os binddn="cn=admin,cn=config " bindmethod=simple credentials=siemens searchbase="cn=config" type=refreshAn dPersistretry="5 5 300 5" timeout=1 olcSyncrepl: {1}rid=002 provider=ldap://spr2.lab.os binddn="cn=admin,cn=config " bindmethod=simple credentials=siemens searchbase="cn=config" type=refreshAn dPersistretry="5 5 300 5" timeout=1 olcMirrorMode: TRUE entryCSN: 20130329141804.133907Z#000000#002#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20130329141804Z dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov structuralObjectClass: olcSyncProvConfig creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth entryUUID: 36e07d68-2cc7-1032-8bf6-1905ee7d8e9d createTimestamp: 20130329141804Z entryCSN: 20130329141804.132859Z#000000#002#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20130329141804Z dn: olcDatabase={1}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb olcDbDirectory: /opt/openldap/var/openldap-data olcSuffix: dc=spr olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymou s auth by dn="cn=admin,dc=spr" write by * none olcAccess: {1}to attrs=shadowLastChange by self write by * read olcAccess: {2}to dn.base="" by * read olcAccess: {3}to * by self write by dn="cn=admin,dc=spr" write by * read olcLastMod: TRUE olcRootDN: cn=admin,dc=spr olcRootPW:: e1NTSEF9eDRVRTBiV2Z4YnFSNnZDVDdKRWEwSWRhWFRhMDN2M3I= olcDbCheckpoint: 4096 10 olcDbNoSync: TRUE olcDbMaxSize: 107374182400 structuralObjectClass: olcMdbConfig entryUUID: 804a8ede-2cc3-1032-9b7a-c7b2eb845e03 creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20130329135129Z olcDbIndex: objectClass eq olcDbIndex: uid eq olcDbIndex: MSISDN eq olcDbIndex: IMSI eq olcDbIndex: pfUsername eq olcDbIndex: entryCSN eq olcDbIndex: entryUUID eq olcDbIndex: contextCSN eq olcMirrorMode: TRUE olcSyncrepl: {0}rid=003 provider=ldap://spr1.lab.os binddn="cn=admin,dc=spr" b indmethod=simple credentials=siemens searchbase="dc=spr" type=refreshOnly int erval=00:00:00:10 retry="5 5 300 5" timeout=1 olcSyncrepl: {1}rid=004 provider=ldap://spr2.lab.os binddn="cn=admin,dc=spr" b indmethod=simple credentials=siemens searchbase="dc=spr" type=refreshOnly int erval=00:00:00:10 retry="5 5 300 5" timeout=1 entryCSN: 20130329141637.442296Z#000000#002#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20130329141637Z dn: olcOverlay={0}syncprov,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov structuralObjectClass: olcSyncProvConfig creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth entryUUID: e2aa5b24-2cc6-1032-8bf5-1905ee7d8e9d createTimestamp: 20130329141542Z entryCSN: 20130329141542.849443Z#000000#002#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20130329141542Z Output from ldapsearch done on server with mdb: root@test7kde:~# ldapsearch -x -h 172.17.103.200 -D cn=admin,dc=spr -s sub -a always -W -b pfUsername=user1,dc=USERNAME,dc=spr Enter LDAP Password: # extended LDIF # # LDAPv3 # base <pfUsername=user1,dc=USERNAME,dc=spr> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 Output from ldapsearch done on server with hdb: root@test7kde:~# ldapsearch -x -h 172.17.103.215 -D cn=admin,dc=spr -s sub -a always -W -b pfUsername=user1,dc=USERNAME,dc=spr Enter LDAP Password: # extended LDIF # # LDAPv3 # base <pfUsername=user1,dc=USERNAME,dc=spr> with scope subtree # filter: (objectclass=*) # requesting: ALL # # 1, USERS, STANDARD, SPR dn: uid=1,ds=USERS,o=STANDARD,dc=SPR objectClass: sprUser uid: 1 # userData, 1, USERS, STANDARD, SPR dn: subdata=userData,uid=1,ds=USERS,o=STANDARD,dc=SPR roamingAllowed: TRUE objectClass: sprUserData subdata: userData prepaidFlag: TRUE sn: TestProv pfUsername: user1 givenName: pcrfUser loginPassword: 123 pfPassword: 123 # applicationData, 1, USERS, STANDARD, SPR dn: subdata=applicationData,uid=1,ds=USERS,o=STANDARD,dc=SPR objectClass: sprUserData subdata: applicationData # aaa, applicationData, 1, USERS, STANDARD, SPR dn: ds=aaa,subdata=applicationData,uid=1,ds=USERS,o=STANDARD,dc=SPR objectClass: sprDs ds: aaa # 2g3g, aaa, applicationData, 1, USERS, STANDARD, SPR dn: ds=2g3g,ds=aaa,subdata=applicationData,uid=1,ds=USERS,o=STANDARD,dc=SPR objectClass: sprDs ds: 2g3g # pcrf, aaa, applicationData, 1, USERS, STANDARD, SPR dn: ds=pcrf,ds=aaa,subdata=applicationData,uid=1,ds=USERS,o=STANDARD,dc=SPR objectClass: sprDs ds: pcrf # 2g3gProf, 2g3g, aaa, applicationData, 1, USERS, STANDARD, SPR dn: subdata=2g3gProf,ds=2g3g,ds=aaa,subdata=applicationData,uid=1,ds=USERS,o=S TANDARD,dc=SPR service2g3g: defaultService profile2g3g: profile1 productCode2g3g: prodCode barringStatus2g3g: barringStatus objectClass: spr2g3gUser uniqueId2g3g: user1 apnGroup2g3g: apnGG provider2g3g: me-myself-and-i framedIPAddress2g3g: 1.1.1.1 accountGroup2g3g: acctGroup subdata: 2g3gProf msisdn: 1234560001 flagStatus2g3g: flagStatus class2g3g: classs type2g3g: type creationDate2g3g: 01.10.2010. classification2g3g: 111 poolGroup2g3g: poolGroup status2g3g: ACTIVE # pcrfProf, pcrf, aaa, applicationData, 1, USERS, STANDARD, SPR dn: subdata=pcrfProf,ds=pcrf,ds=aaa,subdata=applicationData,uid=1,ds=USERS,o=S TANDARD,dc=SPR profile: 3100 totalUsedVolume: 3 msisdn: 1234560001 objectClass: sprPcrfProf totalMaximumVolume: 5 imsi: 1991234560001 subdata: pcrfProf subscriberServiceProfile: TM00003100 featureList: Faeture1 paymentTypexy: NeverPaid pfUsername: user1 tariffId: 1 pcrfServiceId: 3100 # search result search: 2 result: 0 Success # numResponses: 9 # numEntries: 8 On Thu, Apr 18, 2013 at 4:11 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Thursday, April 18, 2013 1:55 PM +0200 Saša-Stjepan Bakša < > ssbaksa(a)gmail.com> wrote: > > >> >> >> I am using alias dereferencing with hdb backed because that was >> application requirement. Now I am switching to mdb but I can't get the >> same answer with ldapsearch. >> >> Does dereferencing work for mdb? >> > > OpenLDAP version? Example configuration? > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

I can't delete a shell DB
by Diego Woitasen 18 Apr '13

18 Apr '13

Hi, I was using shell backend and now switched to sock backend (shell looks unstable). My problem not is that I can't delete the shell DB. This is the entry in cn=config: dn: olcDatabase={3}shell,cn=config objectClass: olcShellConfig objectClass: olcDatabaseConfig olcDatabase: {3}shell When I try to remove it I get Error 53 - Unwilling to perform. Looks like there is a dependency with this entry, but I don't see where. Is the last one, i removed the suffix.... hints? And don't see anything usefull in the logs. Regards, Diego -- Diego Woitasen

4 11

Stable schema definition for dynlist overlay?
by Paolo Miotto 18 Apr '13

18 Apr '13

Hello, I'm trying dynamic groups on ldap via dynlist overlay. In the documentation (slapo-dynlist man page, openldap administrator guide) the examples are using the dyngroup.schema, which is marked as experimental. There are more reliable schemas? The experimental label is only due to the lack of an rfc, or other issues can be found using this schema? Or it is better to define new attributes and objectclass in our internal schema? The authorization attributes and objectclass are required or it is safe to ignore them if not used? I have tried a schema without them and I have only a warning in the log, but it is a test environment and maybe it is not exaustive. Best regards Paolo Miotto ---------------------------------------------------------------------- SEMEL (SErvizio di Messaging ELettronico) - AINF, Universita' di Udine

2 1

Alias dereferencing
by Saša-Stjepan Bakša 18 Apr '13

18 Apr '13

I am using alias dereferencing with hdb backed because that was application requirement. Now I am switching to mdb but I can't get the same answer with ldapsearch. Does dereferencing work for mdb? Lp Sasa

2 1

Backend meta and write access?
by Yoann Gini 18 Apr '13

18 Apr '13

Hello, I’m working on a setup with backend meta, the aim of the setup is to have a LDAP database for our Samba 3. We already have a LDAP but we don’t wan’t to change the schema, so I’ve build a LDAP server on Centos with a local database for samba (cn=samba) and I plan to use meta to do the merge (and the translucent to save locally new fields for existing users). I’ve successfully deploy the meta backend but it work in readonly mode, I can’t write on it… Here is my config, if someone can give me a clue, that would be great :-) ####################################################################### # Samba Database ####################################################################### database bdb directory "/var/db/openldap/samba-directory" suffix "cn=samba" rootdn "uid=samba_root,cn=users,cn=samba" rootpw {SSHA}--- access to * by dn.exact="uid=samba_root,cn=users,dc=example,dc=com,dc=meta" write by * read ####################################################################### # Meta Database ####################################################################### database meta suffix "dc=example,dc=com,dc=meta" ## Main database dc=example,dc=com mapped to dc=example,dc=com,dc=meta uri "ldap://192.168.2.200/dc=example,dc=com,dc=meta" suffixmassage "dc=example,dc=com,dc=meta" "dc=example,dc=com" ## Mapping for specific Samba node uri "ldap://127.0.0.1:1389/sambaDomainName=EXAMPLE,dc=example,dc=com,dc=meta" suffixmassage "sambaDomainName=EXAMPLE,dc=example,dc=com,dc=meta" "sambaDomainName=EXAMPLE,cn=samba" uri "ldap://127.0.0.1:1389/cn=idmap,dc=example,dc=com,dc=meta" suffixmassage "cn=idmap,dc=example,dc=com,dc=meta" "cn=idmap,cn=samba" uri "ldap://127.0.0.1:1389/cn=nt-computers,dc=example,dc=com,dc=meta" suffixmassage "cn=nt-computers,dc=example,dc=com,dc=meta" "cn=nt-computers,cn=samba" access to * by dn.exact="uid=samba_root,cn=users,dc=example,dc=com,dc=meta" write

1 0

database meta and overlay memberof
by David Bonnafous 17 Apr '13

17 Apr '13

hi, I have a meta directory with two uri (one is openldap directory, used by Linux, and the other is "Mac OS X directory"). This meta-directory is used for authentication and it works. I try to use the "memberof" overlay in the meta directory to build some groupOfNames... but it doesn't work: the memberOf attribute is not updated. More precisely the groupOfNames is created in the Linux directory (through the meta directory) and then I add members. If the members are dn in this directory: it works (memberOf attribute is updated). But if the members are in the Mac OS X it doesn't work (memberOf attribute is not updated). questions: Is it possible to get the groupOfNames/memberof to work ? If yes, how ? an extract of my slapd.conf: -------------------- database meta overlay memberof suffix "dc=laplace,dc=meta" # # Mac OS X # uri "ldap://192.168.0.1/dc=macosx,dc=labo,dc=meta" suffixmassage "dc=macosx,dc=labo,dc=meta" "dc=here,dc=gg" # # Linux # uri "ldap://192.168.0.2/dc=linux,dc=labo,dc=meta" suffixmassage "dc=linux,dc=labo,dc=meta" "dc=xxx,dc=yy,dc=gg" -------------------- Under Linux, I use openldap 2.4.23 (debian squeeze) and 2.4.11 (debian lenny). thank you. -- David Bonnafous, ingénieur CNRS Service Informatique LAboratoire PLAsma et Conversion d'Energie Université de Toulouse France

1 0

A bit confused about rootpw
by D C 16 Apr '13

16 Apr '13

I'm trying to replicate a production problem, so I setup a test server. I rsynced everything from /etc/openldap and /var/lib/ldap, and confirmed that both systems have the same exact openldap packages installed. For some reason on the test box, I cannot bind as the rootdn, it keeps saying invalid credentials. reluctantly, i've updated slapd.conf with a new rootpw, but that doesn't seem to be working either. I've ran grep -RHi olcRootPW on the slapd.d directory, but it came back with nothing. Any thoughts? rsync options used "-avz --delete" Thanks, Dan

2 2

RE: help -- Regarding the jks certificate error
by Chris Jacobs 15 Apr '13

15 Apr '13

> Hi, > > // Either explicitly tell your tools to trust the CA for the cert via config or the > command line – How do I tell my tools (which tools?) to trust the CA for the > cert in config or the cmd line? > > I have put all the certs in my openldaps client ldap.conf file. All the jks certs > are created by kaytool command. > None of the below work : > > #TLS_CACERT /etc/openldap/cacerts/123keystore.jks // server is started > using jks certificates for secure connections.. this is not working TLS_CACERT > /etc/openldap/cacerts/789server.cer // This didn’t work # TLS_CACERT > /etc/openldap/cacerts/789server.pem // I converted the cer to pem file.. > But even this didn’t work TLS_CACERTDIR /etc/openldap/cacerts > > // Perhaps even (I'm mostly guessing) adding the CA to your systems trusted > CA certs Start by getting your CA's cert. – how to add CA to my clients trusted > CA certs? CJ: That's on a per OS basis. It's rarely made easy. But after more reading, unlikely to help you. > In openldap cmd ldapsearch, there is no option to specify the cert path. It > picks the cert files/dir from the /etc/openldap/ldap.conf CJ: I was mistaken. I thought there was. > Jks(java key store) certs(created by the server) work with openldap clients > by just copying the certs to client machine and adding the path in ldap.conf > file ? Or do we need pem certs only? CJ: We use base64 encoded certs. I tried looking into what type of cert was acceptable to openldap, but failed to find it. The cert should look similar to: -----BEGIN CERTIFICATE----- MIIF3jCCBMagAwIBAgIKf/7gwAAAAAAJ5zANBgkqhkiG9w0BAQUFADBVMRMwEQYK [plenty of lines similar] Vtm/MSZk5cBjnM84+MK3sVdE -----END CERTIFICATE----- > I am a newbie..Pls guide me..Thanks. CJ: I'm not that much better I'm afraid. Some things to consider: Make sure you're putting the CA's cert for openldap to ref, and not the actual cert being used. If you find yourself still stuck, try reading: http://www.openldap.org/faq/data/cache/185.html and make sure you understand CAs, certs signed by that CA, etc. We've some JKS certs we have to monitor in our environment, and we use the following to export java/JKS certs to x509 Base64 encoded PEM format: keytool -exportcert -keystore [store-with-CA-cert] -alias [alias-name-of-CA-cert] -storepass [password] -rfc Use that cert with your ldap toolset. > Regards, > Sridhar Sontha > > > > From: Chris Jacobs [mailto:Chris.Jacobs@apollogrp.edu] > Sent: Friday, April 12, 2013 9:39 PM > To: Sontha, Sridhar; 'openldap-technical(a)openldap.org'; 'openldap- > technical-request(a)openldap.org' > Subject: Re: help -- Regarding the jks certificate error > > Your cert is self signed and not trusted by your client. > > Either explicitly tell your tools to trust the CA for the cert via config or the > command line. Perhaps even (I'm mostly guessing) adding the CA to your > systems trusted CA certs. > > Start by getting your CA's cert, and reading the ldapsearch man page. > > - chris > > ________________________________________ > From: openldap-technical-bounces(a)OpenLDAP.org <openldap-technical- > bounces(a)OpenLDAP.org> > To: openldap-technical(a)openldap.org <openldap- > technical(a)openldap.org>; openldap-technical-request(a)openldap.org > <openldap-technical-request(a)openldap.org> > Sent: Fri Apr 12 20:24:03 2013 > Subject: help -- Regarding the jks certificate error Hi There, > I am using an ldap server created using unbounded ldap API (Java). And > the server is started to support both ldap and ldaps. Sever uses java > keystore (.jks) certificates namely 123keystore.jks and 456truststore.jks and > some 789server.cer (all these files are protected by some passoword). The > server is listening at port # 1636 for all ldaps connections. > I am able to connect to the server using (ldaps) some java ldap clients and > able to bind and search successfully. But when I try to connect to the server > using openldap client, it is NOT working, getting SSL > routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed error. > > I get the below error when I try to do the search using ldaps://<ip>:1636 > > ldapsearch -w 'xxxxxx1234' -H ldaps://xx.xx.xx.xxx:1636 -b > "o=person,o=hp" -D "id=xxxx89,o=person,o=hp" > > [bea@devcg4sdmbl01 ldapsearch -w 'xxxxxx1234' -H > ldaps://xx.xx.xx.xxx:1636 -b "o=person,o=hp" -D > "id=xxxx89,o=person,o=hp" > ldap_create > ldap_url_parse_ext(ldaps://x.x.x.x:1636) > ldap_pvt_sasl_getmech > ldap_search > put_filter: "(objectclass=*)" > put_filter: simple > put_simple_filter: "objectclass=*" > ldap_send_initial_request > ldap_new_connection 1 1 0 > ldap_int_open_connection > ldap_connect_to_host: TCP xx.x.xx.xx:1636 > ldap_new_socket: 3 > ldap_prepare_socket: 3 > ldap_connect_to_host: Trying 10.0.59.164:1636 > ldap_connect_timeout: fd: 3 tm: -1 async: 0 TLS trace: > SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 > write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS > certificate verification: depth: 0, err: 18, subject: > /C=xxx/ST=x/L=xxx/O=xxxx/OU=xxx/CN=xxx, > issuer: /C=xxx/ST=xxx/L=xxxx/O=xxxxx/OU=xxx/CN=xxxxx > TLS certificate verification: Error, self signed certificate TLS trace: SSL3 alert > write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server > certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B > TLS: can't connect. > ldap_perror > ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) > additional info: error:14090086:SSL > routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed > > Here is my ldap.conf : located at /etc/openldap/ldap.conf > > URI ldaps://x.x.x.x:1636/ > BASE o=person,o=hp > HOST <IP> > PORT 1636 > #TLS_CACERT /etc/openldap/cacerts/123keystore.jks // server is started > using jks certificates for secure connections.. this is not working TLS_CACERT > /etc/openldap/cacerts/789server.cer // This didn’t work # TLS_CACERT > /etc/openldap/cacerts/789server.pem // I converted the cer to pem file.. > But even this didn’t work TLS_CACERTDIR /etc/openldap/cacerts > TLS_REQCERT require > > What is the correct configuration to make this work? Can I use the jks > certificates in openldap client to connect to server which is using jks for > ldaps connections? What is missing here? Pls help fix this issue. > Same openldap client works fine for non-secure and simple authentication > ldap connections. The problem is only when I try to use ldaps from the > client. > > Thanks in advance. Let me know if you need more info. > > > Regards, > Sridhar Sontha > > > > > ________________________________________ > This message is private and confidential. If you have received it in error, > please notify the sender and remove it from your system. > This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

2 2

Merge two LDAP store in one proxy with attribute mapping?
by Yoann Gini 14 Apr '13

14 Apr '13

Hello, Actually working on a Samba 3.x integration on an Apple OpenDirectory, I’m wondering one thing. Is that possible to make a LDAP proxy composing record as a proxy from two existing LDAP database? For example, I’ve one LDAP db with my user and an other with my password hash, I would like to try to create a third LDAP access point to get a unified access to both informations. Best regards, Yoann

2 2

Augmented data in a proxy?
by Yoann Gini 14 Apr '13

14 Apr '13

Hello, Actually working on a Samba 3.x integration on an Apple OpenDirectory, I’m wondering one thing. Is it possible to use proxy feature of LDAP to augment existing data ? For example, I would like to extend the Apple LDAP schema by adding the Samba support but I don’t want to store this additional data in the main store. If it’s possible, I would like to use a dedicated LDAP server configured to use my original LDAP server as backend and who can be allowed to store locally extra data from specific schema. Do you know a way to do that? Best regards, Yoann

2 2

help -- Regarding the jks certificate error
by Sontha, Sridhar 14 Apr '13

14 Apr '13

Hi There, I am using an ldap server created using unbounded ldap API (Java). And the server is started to support both ldap and ldaps. Sever uses java keystore (.jks) certificates namely 123keystore.jks and 456truststore.jks and some 789server.cer (all these files are protected by some passoword). The server is listening at port # 1636 for all ldaps connections. I am able to connect to the server using (ldaps) some java ldap clients and able to bind and search successfully. But when I try to connect to the server using openldap client, it is NOT working, getting SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed error. I get the below error when I try to do the search using ldaps://<ip>:1636 ldapsearch -w 'xxxxxx1234' -H ldaps://xx.xx.xx.xxx:1636 -b "o=person,o=hp" -D "id=xxxx89,o=person,o=hp" [bea@devcg4sdmbl01 ldapsearch -w 'xxxxxx1234' -H ldaps://xx.xx.xx.xxx:1636 -b "o=person,o=hp" -D "id=xxxx89,o=person,o=hp" ldap_create ldap_url_parse_ext(ldaps://x.x.x.x:1636) ldap_pvt_sasl_getmech ldap_search put_filter: "(objectclass=*)" put_filter: simple put_simple_filter: "objectclass=*" ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP xx.x.xx.xx:1636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 10.0.59.164:1636 ldap_connect_timeout: fd: 3 tm: -1 async: 0 TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 0, err: 18, subject: /C=xxx/ST=x/L=xxx/O=xxxx/OU=xxx/CN=xxx, issuer: /C=xxx/ST=xxx/L=xxxx/O=xxxxx/OU=xxx/CN=xxxxx TLS certificate verification: Error, self signed certificate TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect. ldap_perror ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed Here is my ldap.conf : located at /etc/openldap/ldap.conf URI ldaps://x.x.x.x:1636/ BASE o=person,o=hp HOST <IP> PORT 1636 #TLS_CACERT /etc/openldap/cacerts/123keystore.jks // server is started using jks certificates for secure connections.. this is not working TLS_CACERT /etc/openldap/cacerts/789server.cer // This didn't work # TLS_CACERT /etc/openldap/cacerts/789server.pem // I converted the cer to pem file.. But even this didn't work TLS_CACERTDIR /etc/openldap/cacerts TLS_REQCERT require What is the correct configuration to make this work? Can I use the jks certificates in openldap client to connect to server which is using jks for ldaps connections? What is missing here? Pls help fix this issue. Same openldap client works fine for non-secure and simple authentication ldap connections. The problem is only when I try to use ldaps from the client. Thanks in advance. Let me know if you need more info. Regards, Sridhar Sontha

2 2

pwdReset - ldapmodify : Undefined attribute type (17)
by cbulist＠gmail.com 12 Apr '13

12 Apr '13

Hi, I'm trying to add pwdReset attribute to a user in order to reset the user password but It fails. I added the pwdReset attribute to the schema using Apache Directory Studio but I'm getting the same error. Any recommendation?...Thanks!! This is the command that I run: ldapmodify -c -H ldap://localhost -x -D "cn=Manager,dc=sample,dc=com" -w "password" <<EOF dn: uid=aaa,ou=People,dc=sample,dc=com changetype: modify replace: userPassword userPassword:test changetype: modify add: pwdReset pwdReset: TRUE EOF This is the output: ldapmodify: Undefined attribute type (17) additional info: changetype: attribute type undefined

2 1

ldapadd failing with mdb backend
by Chris Card 12 Apr '13

12 Apr '13

Hi, I'm doing some testing with an mdb backend with the openldap 2.4.35, and I'm seeing an issue where ldapadd is failing for an object which worked fine with a bdb backend. The error from ldapadd is "ldap_add: Other (e.g., implementation specific) error (80)" and when I run slapd with "-d -1" I see the error "mdb_add: dn2id_add failed: Invalid argument (22)" in the debug logging. Running an unoptimized slapd under gdb I have traced the error to lines 4887-8 in mdb.c, in mdb_cursor_put: if (F_ISSET(mc->mc_db->md_flags, MDB_DUPSORT) && data->mv_size > MDB_MAXKEYSIZE) return EINVAL; and from gdb I can see that data->mv_size = 512: (gdb) p *data $1 = {mv_size = 512, mv_data = 0x2f2e858} The error appears to be related to the length of the DN of the object being added, but there are longer DNs in the directory which were loaded successfully with slapadd. Any ideas? Chris

2 1

Users quotas with LDAP.
by Luis H. Forchesatto 12 Apr '13

12 Apr '13

Greetings. What is the best wat to store user disk quotas on LDAP. I got two (and there will be more) servers running and both will authenticate on LDAP. What are the best ways to manage user quotas with LDAP? -- Att.* *** Luis H. Forchesatto

2 1

LDAP search from Active Directory 2008r2
by John 12 Apr '13

12 Apr '13

Hi all, We are doing LDAP search from our Active Directory, the AD enabled "Require signing" option, please see the attachement. We can't let it work right now. I did online google search, LDAP SASL should be the way. But are there any reference or guide to install and configure LDAP SASL? Thanks John

1 0

back-perl not working with cn=config
by Benin Technologies 11 Apr '13

11 Apr '13

Hi, I'm unable to set up a back-perl backend directly in cn=config mode. However, if I set it up in slapd.conf mode, and then convert it to cn=config mode, it works fine. It's not convenient, because I have to set all my perl backends up before converting to cn=config. Here's the ldif file I'm using to set up a back-perl backend in cn=config mode (it's inspired from the files I get by converting slapd.conf into cn=config with slaptest) # Load dynamic backend modules dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulepath: /usr/local/libexec/openldap olcModuleload: back_perl.la # Database settings dn: olcDatabase=perl,cn=config objectClass: olcDatabaseConfig objectClass: olcDbPerlConfig olcDatabase: perl olcSuffix: dc=mydomain,dc=org olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=Manager,dc=mydomain,dc=org olcRootPW:: c2VjcmV0 olcSyncUseSubentry: FALSE olcMonitoring: FALSE olcPerlModulePath: /usr/local/etc/openldap/perl olcPerlModule: SampleLDAP olcPerlFilterSearchResults: FALSE And here's what I get when I try to load the file: ldapadd -Y EXTERNAL -H ldapi:/// -f perl-backend.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 adding new entry "cn=module,cn=config" adding new entry "olcDatabase=perl,cn=config" ldap_result: Can't contact LDAP server (-1) After that, if I start OpenLDAP I get a segmentation fault: root@ldap:/tmp# /usr/local/libexec/slapd -u openldap -g openldap -h "ldap:/// ldapi:///" -d 16383 .... 51585496 perl backend db init Segmentation fault Like I said, if I set back-perl up in slapd.conf mode and then convert it to cn=config, everything works fine. Something must be wrong with my LDIF file, but what ??? It seems to be the same as the one generated by slaptest when converting from slapd.conf mode. Ben

2 5

Re: How to improve performance with MDB backend?
by Saša-Stjepan Bakša 11 Apr '13

11 Apr '13

Is there any HOWTO document which explains how to get exact version out from repository? I have cloned openldap git repo but I am not sure that I have checked out RE24 or yust "plain" 2.4.35. May be that this is simple thing to do but I am new to git and I newer used source for openldap before, just binary packages. On Tue, Apr 9, 2013 at 4:15 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Tuesday, April 09, 2013 2:07 PM +0200 Saša-Stjepan Bakša < > ssbaksa(a)gmail.com> wrote: > > >> >> Tnx. I will add what you suggest and try to run modify test with that. I >> didn't done that already because my mdb database is overflowed. I have >> set it to 100GB but it wasn't enough. I am not sure why. Are there logs >> inside? I have 1 mil users but they didn't use all data storage. Hmmm, >> maybe indexes, I have 8 of them. I know how to look for hdb/bdb problems >> but mdb is a puzzle for me (for now). >> > > Please keep replies to the list. I would suggest you try current OpenLDAP > RE24, there was a growth issue fixed since the 2.4.35 release (ITS#7565). > > > --Quanah > > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

Hi!!!
by Jim Vanes 11 Apr '13

11 Apr '13

http://www.poidslourdsoccasions.com/bnct/jlox61zde11fi.acjgf18jtuid7e?6qlkx…

1 0

translucent search and modify not working as expected
by Steve Eckmann 10 Apr '13

10 Apr '13

I am trying to "extend" a corporate Active Directory with application-specific user attributes by running a local OpenLDAP (2.4.34) with back-ldap and the translucent overlay. I can add local attributes associated with remote entries, and I can see these local attributes when searching on a remote attribute. But I cannot modify local attributes, and searching on a local attribute returns no results. For example, after ldapadd -x -H ldaps://localhost -D "cn=admin,dc=example,dc=com" -W -f addLocalUser.ldif where "cn=admin,dc=example,dc=com" is the local rootdn and addLocalUser.ldif contains dn: cn=John Doe,ou=myOrg,dc=example,dc=com objectclass: organizationalPerson objectclass: myPerson myAttribute: somevalue the search ldapsearch -x -H ldaps://localhost -LLL -b dc=example,dc=com \ -D "cn=remoteuser,cn=Users,dc=example,dc=com" -W \ '(mail=john.doe(a)example.com)' cn manager myattribute (where remoteuser has read access on the remote directory and read/write access on the local directory) returns one entry with the expected cn, manager, and myattribute values. But the search ldapsearch -x -H ldaps://localhost -LLL -b dc=example,dc=com \ -D "cn=admin,cn=Users,dc=example,dc=com" -W \ '(myattribute=somevalue)' cn manager myattribute returns nothing. And the modify commands ldapmodify -x -H ldaps://localhost \ -D "cn=admin,dc=example,dc=com" -W -f modUser.ldif ldapmodify -x -H ldaps://localhost \ -D "cn=remoteuser,cn=Users,dc=example,dc=com" -W -f modUser.ldif where modUser.ldif contains dn: cn=John Doe,ou=myOrg,dc=example,dc=com changetype: modify replace: myAttribute myAttribute: anothervalue both result in ldapmodify: No such object (32) additional info: attempt to modify nonexistent local record I've read the relevant parts of the Admin Guide and the relevant man pages numerous times, along with everything I found via google. I've also studied the translucent overlay test cases. It looks like what I'm trying to do is a mainstream use case, so obviously I'm missing some crucial aspects of configuration. Here are the slapd.conf backend configs that I'm using (with name changes to match the examples above): database mdb suffix "dc=example,dc=com" rootdn "cn=admin,dc=example,dc=com" rootpw {SSHA}blahblah directory /opt/openldap-2.4/var/local-data index objectClass eq,pres index myAttribute eq,pres,sub overlay translucent uri "ldaps://ldap.example.com/" acl-bind bindmethod=simple binddn=cn=remoteuser,cn=Users,dc=example,dc=com credentials={SSHA}blahblah tls_reqcert=demand idassert-bind bindmethod=simple binddn=cn=remoteuser,cn=Users,dc=example,dc=com credentials={SSHA}blahblah mode=none tls_reqcert=demand idassert-authzFrom dn.regex:.* rebind-as-user chase-referrals yes translucent_local cn,myAttribute translucent_remote cn,mail Are there glaring mistakes here? Thanks for reading this far :-) Steve

1 0

Re: What can I use for pwdCheckModule?
by D C 10 Apr '13

10 Apr '13

Here are my results.. Any thoughts as to why this is not working? As for my ldap version, I'm using the version provided in CentOS 6. I would prefer to use these prepacked builds whenever possible. If there is an issue where this will not work on that version, then I'll go ahead and upgrade. TESTS: RESULT: pwdSafeModify: FALSE PASS: Message: LDAP password information update failed: Insufficient access. Must supply old password to be changed as well as new one pwdAllowUserChange: FALSE PASS: Message: LDAP password information update failed: Insufficient access. User alteration of password is not allowed pwdMaxAge: 300 FAIL: Login still allowed after 300 seconds. pwdExpireWarning: 10 FAIL: No warning message pwdInHistory: 3 FAIL: I can still flip between 2 passwords pwdMinLength: 12 FAIL: I can still set a 6 char password pwdMustChange: FAIL: I am not forced to change passwd. pwdMaxFailure: 2 FAIL: Still allowed in after 6 failures Other Info: pwdLockout: TRUE pwdLockoutDuration: 600 Thanks, Dan On Wed, Apr 10, 2013 at 10:41 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Wednesday, April 10, 2013 9:30 AM -0400 D C <dc12078(a)gmail.com> > wrote: > > >> Server is openldap 2.4.23 >> > > > Seriously? You're using a version of OpenLDAP that is nearly 3 years old? > Why would you do that to yourself? > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

3 5

What can I use for pwdCheckModule?
by D C 10 Apr '13

10 Apr '13

After nearly two weeks of going nuts trying to setup a password policy, I finally found part of the documentation that I was missing. Apparently "ppolicy" does not actualy enforce the policy you create. If I'm understanding the documentation correctly, it really only provides more of a transport to something else which can do it. In particular the attribute pwdCheckModule, needs to point to a module which can enforce the policy. However no module seems to be provided. What modules are other people using? I stumbled around and found password_check.so, which I am trying to setup now with partial success. http://ltb-project.org/wiki/documentation/openldap-ppolicy-check-password Anyone else have something better? One thing I need to do which I don't think this will help with, is storing the last x passwords. Thanks, Dan

3 5

issue with the ftp server
by Claude Brisson 10 Apr '13

10 Apr '13

Hi, while trying to submit a (small) patch on ftp.openldap.org, I got "No space left on device". I guess there is some cleanup to do somewhere... Claude

1 0

rfc2307bis.schema woes (OpenIndiana 151a7 client)
by Tobias Verbeke 10 Apr '13

10 Apr '13

Dear list, I am trying to add an OpenIndiana 151a7 machine as an LDAP client of an Ubuntu 12.04.1 server with slapd version as shipped with it: # slapd -V @(#) $OpenLDAP: slapd (Oct 17 2012 19:48:41) $ buildd@komainu:/build/buildd/openldap-2.4.28/debian/build/servers/slapd On the OI client I get # ldapclient init machine.openanalytics.eu Can not find the nisDomainObject for domain Google found out for me that the OpenIndiana LDAP client assumes the rfc2307bis.schema to be used instead of the nis.schema that is used by default and grep confirms the nisDomainObject can be found there: # grep -nr nisDomain* /etc/ldap/schema. ./rfc2307bis.schema:158:attributetype ( 1.3.6.1.1.1.1.30 NAME 'nisDomain' ./rfc2307bis.schema:269:objectclass ( 1.3.6.1.1.1.2.15 NAME 'nisDomainObject' SUP top AUXILIARY ./rfc2307bis.schema:271: MUST nisDomain ) To make it a little bit simpler for the newbie I am, I made sure static configuration is used (by removing /etc/ldap/slapd.d) The relevant part of the slapd.conf now reads # Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/rfc2307bis.schema include /etc/ldap/schema/ldapns.schema include /etc/ldap/schema/inetorgperson.schema When running slaptest, I get # slaptest 51655577 /etc/ldap/schema/rfc2307bis.schema: line 5 attributetype: Duplicate attributeType: "1.3.6.1.1.1.1.0" slaptest: bad configuration file! However, when grepping on "1.3.6.1.1.1.1.0", I only get the rfc2307bis.schema file: # grep -rn 1.3.6.1.1.1.1.0 /etc/ldap/schema /etc/ldap/schema/rfc2307bis.schema:1:attributetype ( 1.3.6.1.1.1.1.0 NAME 'uidNumber' Where else can this attributeType live? Can I provide more information? I am a bit puzzled, so many thanks in advance for any pointer! Best, Tobias

1 0

Re: How to improve performance with MDB backend?
by Saša-Stjepan Bakša 09 Apr '13

09 Apr '13

I am sorry replaying directly. I didn't check who was in TO field. OK I will try Re24. Tnx again. Sasa On Tue, Apr 9, 2013 at 4:15 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Tuesday, April 09, 2013 2:07 PM +0200 Saša-Stjepan Bakša < > ssbaksa(a)gmail.com> wrote: > > >> >> Tnx. I will add what you suggest and try to run modify test with that. I >> didn't done that already because my mdb database is overflowed. I have >> set it to 100GB but it wasn't enough. I am not sure why. Are there logs >> inside? I have 1 mil users but they didn't use all data storage. Hmmm, >> maybe indexes, I have 8 of them. I know how to look for hdb/bdb problems >> but mdb is a puzzle for me (for now). >> > > Please keep replies to the list. I would suggest you try current OpenLDAP > RE24, there was a growth issue fixed since the 2.4.35 release (ITS#7565). > > > --Quanah > > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

openLDAP storing passwords in plain text
by Derryl Varghese 09 Apr '13

09 Apr '13

I am setting up openLDAP for one of my Java applications. Usernames and passwords are stored in openLDAP and users are able to update their passwords via the application (using the javax.naming.directory API'). I imported our users from our existing Sun Directory Server into openLDAP. Import was successfull and passwords were encrypted in SSHA format. I noticed that when i update a password from the application, it stores it in 'Plain Text' format. I can unhide the password when i view it via Apache Directory Studio. A lot of googling later, i tried setting the "password-hash {SSHA}" in the slapd.conf file and that didn't help me either. I am on a windows environment. I am passing the password to openLDAP in plain text format. There is no encryption going on in the code. I know i can encrypt it in the application but i would prefer openLDAP to do it for me. Please let me know if i can do anything on the openLDAP side. This is the JAVA code i use today to modify passwords. This has been working fine in our existing environment for the past 7 years. ModificationItem[] newAttribs = new ModificationItem[1]; Attribute passwordAttrib = new BasicAttribute(DirectoryConstants.USER_PASSWORD, password); ModificationItem passwordItem = new ModificationItem(DirContext.REPLACE_ATTRIBUTE, passwordAttrib); newAttribs[0] = passwordItem; ..... DirContext ctx = this.getContext(); ctx.modifyAttributes( DirectoryConstants.USER_UID + "=" + userId + "," + ou, newAttribs);

4 4

Trouble getting ppolicy overlay to work
by D C 09 Apr '13

09 Apr '13

I'm really banging my head trying to get the ppolicy overlay to work properly. My only indication that I am partially on the right track is that if I set pwdSafeModify=TRUE in my default policy, then I get the following error from pam_ldap when changing my password. If I set it back to false, then I can change my password. LDAP password information update failed: Insufficient access Must supply old password to be changed as well as new one passwd: Authentication token manipulation error However, everything else in the policy is being ignored. any help would be greatly appreciated. Thanks! * I am assuming that the password policy is going to be enforced by ldap, so testing with pam_ldap is not necessary at this point. I should be able to use any client such as apache directory studio to test password policy. Version Info: CentOS 6.4 CentOS packaged openldap-servers-2.4.23 slapd.conf: # ( I am aware that I have * write. this is just for desperate testing on a test box ) include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/sudo.schema include /etc/openldap/schema/pwm.schema include /etc/openldap/schema/ppolicy.schema moduleload ppolicy.la moduleload syncprov.la # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args ####################################################################### # ACL ####################################################################### access to attrs=userPassword,pwmResponseSet,pwmToken by dn="uid=root,ou=People,dc=example,dc=net" write by dn="cn=svc_pam,ou=SVC_Accounts,dc=example,dc=net" write by dn="cn=svc_pwm,ou=SVC_Accounts,dc=example,dc=net" write by dn="cn=replica,dc=example,dc=net" read by anonymous auth by self write by * none access to * by self write by * write ####################################################################### # ldbm and/or bdb database definitions ####################################################################### database bdb suffix "dc=example,dc=net" rootdn "cn=admin,dc=example,dc=net" rootpw {SMD5}********* overlay ppolicy ppolicy_default "cn=default,ou=policies,dc=example,dc=net" ppolicy_use_lockout overlay syncprov syncprov-checkpoint 100 10 directory /var/lib/ldap loglevel 65535 # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index contextCSN eq index sudoUser eq index entryCSN eq index entryUUID eq # default, policies, example.net dn: cn=default,ou=policies,dc=example,dc=net objectClass: top objectClass: person objectClass: pwdPolicy cn: default sn: default policy pwdAttribute: userPassword pwdMaxAge: 7776002 pwdExpireWarning: 432000 pwdInHistory: 3 pwdLockout: TRUE pwdGraceAuthNLimit: 0 pwdMustChange: TRUE pwdAllowUserChange: TRUE pwdLockoutDuration: 45 pwdMaxFailure: 2 pwdFailureCountInterval: 1 pwdMinLength: 12 pwdCheckQuality: 1 pwdSafeModify: TRUE

1 0

Re: How to improve performance with MDB backend?
by Quanah Gibson-Mount 09 Apr '13

09 Apr '13

--On Tuesday, April 09, 2013 2:07 PM +0200 Saša-Stjepan Bakša <ssbaksa(a)gmail.com> wrote: > > > Tnx. I will add what you suggest and try to run modify test with that. I > didn't done that already because my mdb database is overflowed. I have > set it to 100GB but it wasn't enough. I am not sure why. Are there logs > inside? I have 1 mil users but they didn't use all data storage. Hmmm, > maybe indexes, I have 8 of them. I know how to look for hdb/bdb problems > but mdb is a puzzle for me (for now). Please keep replies to the list. I would suggest you try current OpenLDAP RE24, there was a growth issue fixed since the 2.4.35 release (ITS#7565). --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Remote access to the directory schema
by Rick van Rein (OpenFortress) 08 Apr '13

08 Apr '13

Hello, Do I understand correctly, is the schema of a directory always accessible to its remote users? Because when I request | ldapsearch -x -h ldap.example.com -b dc=example,dc=com subschemaSubentry I get entries like | dn: dc=example,dc=com | subschemaSubentry: cn=Subschema | | dn: cn=someone,dc=example,dc=com | subschemaSubentry: cn=Subschema but when I then try things like | ldapsearch -x -h ldap.example.com -b dc=example,dc=com -E subentries=true cn=Subschema I get no results. How should this work? Do schema entries have to be explicitly enabled in the ACL as though they were normal entries, or is the schema always visible? Thanks, -Rick

3 4

~Bob Fitch~
by Bob Fitch 08 Apr '13

08 Apr '13

http://www.rouviere-bat.com/htteopa/5875137920578718644.8901773532214087666… Bob Fitch

1 0

How to improve performance with MDB backend?
by Saša-Stjepan Bakša 08 Apr '13

08 Apr '13

Hi, Maybe this is not the best way to ask but I would like to get some performance expectations or maybe suggestions how to improve performance. I do have relatively long experience with OpenLDAP as a precompiled package and with much less users so performance was not an issue for those installations. Now I need to put few million users (now one million for test), custom tailored schema and search performance is crucial but also modify performance is big issue. Before MDB I have used HDB as backend. What to do to improve write part of performance or performance in general (when adding data – from time to time – OpenLDAP stalls in a way)? Just around 5 add/mod operations during that time then it continue with much higher speed. I have used many different sources to find out other peoples experience and I didn’t choose to write to list lightly but I really need some help/hints. As a hardware I am using two ProLiant DL360p Gen8 servers with: 48GB RAM, HP Smart Array P420i Controller, 2 x EG0600FBDSR 558 GB hard disk in RAID 1. 2 Ethernet ports are bonded to achieve redundancy and performance and connected to Cisco 3750 switch OS is Ubuntu 12.04.2 LTS server with no unnecessary daemons installed. Disk is partitioned this way. Filesystem Size Used Avail Use% Mounted on /dev/sda1 46G 1.4G 43G 4% / udev 24G 4.0K 24G 1% /dev tmpfs 9.5G 240K 9.5G 1% /run none 5.0M 0 5.0M 0% /run/lock none 24G 0 24G 0% /run/shm /dev/sda3 232G 32G 189G 15% /var /dev/sda4 230G 2.4G 216G 2% /opt OpenLDAP is latest one – 2.4.35 compiled on Ubuntu server with addition of Berkley db 5.3.21 (I am not using it but …) and no special switches are used during configuration except the on which puts installation to /opt/openldap directory. I am using also libhoard.so as a memory manager (latest one downloaded from HOARD web site). OpenLDAP is configured as MultiMaster N Way and I am using MDB as backend database. Config is in conf.d stile. root@spr1:~# more /opt/openldap/etc/openldap/slapd.d/cn\=config.ldif # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 47664f80 dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/slapd/slapd.args olcLogLevel: none olcPidFile: /var/run/slapd/slapd.pid structuralObjectClass: olcGlobal creatorsName: cn=config entryUUID: a8df00ce-80fb-1031-8652-fff9cf1d6a3e createTimestamp: 20120822232009Z olcServerID: 1 ldap://spr1.lab.os olcServerID: 2 ldap://spr2.lab.os olcIdleTimeout: 5 olcThreads: 6 entryCSN: 20130404141239.680528Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20130404141239Z contextCSN: 20130404141404.368953Z#000000#001#000000 contextCSN: 20130329141804.133907Z#000000#002#000000 And database: root@spr1:~# more /opt/openldap/etc/openldap/slapd.d/cn\=config/olcDatabase={1}mdb.ldif # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 405c8aaf dn: olcDatabase={1}mdb objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=spr olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymou s auth by dn="cn=admin,dc=spr" write by * none olcAccess: {1}to attrs=shadowLastChange by self write by * read olcAccess: {2}to dn.base="" by * read olcAccess: {3}to * by self write by dn="cn=admin,dc=spr" write by * read olcLastMod: TRUE olcRootDN: cn=admin,dc=spr olcRootPW:: e1NTSEF9eDRVRTBiV2Z4YnFSNnZDVDdKRWEwSWRhWFRhMDN2M3I= olcDbNoSync: TRUE olcDbMaxSize: 107374182400 structuralObjectClass: olcMdbConfig entryUUID: 804a8ede-2cc3-1032-9b7a-c7b2eb845e03 creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20130329135129Z olcDbIndex: objectClass eq olcDbIndex: uid eq olcDbIndex: MSISDN eq olcDbIndex: IMSI eq olcDbIndex: pfUsername eq olcDbIndex: entryCSN eq olcDbIndex: entryUUID eq olcDbIndex: contextCSN eq olcMirrorMode: TRUE olcSyncrepl: {0}rid=003 provider=ldap://spr1.lab.os binddn="cn=admin,dc=spr" b indmethod=simple credentials=siemens searchbase="dc=spr" type=refreshOnly int erval=00:00:00:10 retry="5 5 300 5" timeout=1 olcSyncrepl: {1}rid=004 provider=ldap://spr2.lab.os binddn="cn=admin,dc=spr" b indmethod=simple credentials=siemens searchbase="dc=spr" type=refreshOnly int erval=00:00:00:10 retry="5 5 300 5" timeout=1 olcDbCheckpoint: 8192 15 entryCSN: 20130404141404.368953Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20130404141404Z This is output from iotop during ldapmodify test (1 mil user, two clients modifying each user in sequence , 1 DN / 1 attribute per user): Total DISK READ: 0.00 B/s | Total DISK WRITE: 15.30 M/s TID PRIO USER DISK READ DISK WRITE SWAPIN IO> COMMAND 4403 be/4 root 0.00 B/s 0.00 B/s 0.00 % 98.88 % [flush-8:0] 4838 be/4 openldap 0.00 B/s 3.41 M/s 0.00 % 21.68 % slapd -h ldap:/// -F /opt/openldap/etc/~ldap/slapd.d -g openldap -u openldap -4 4837 be/4 openldap 0.00 B/s 3.19 M/s 0.00 % 19.13 % slapd -h ldap:/// -F /opt/openldap/etc/~ldap/slapd.d -g openldap -u openldap -4 4836 be/4 openldap 0.00 B/s 2.83 M/s 0.00 % 17.48 % slapd -h ldap:/// -F /opt/openldap/etc/~ldap/slapd.d -g openldap -u openldap -4 10889 be/4 openldap 0.00 B/s 2.94 M/s 0.00 % 16.30 % slapd -h ldap:/// -F /opt/openldap/etc/~ldap/slapd.d -g openldap -u openldap -4 10962 be/4 openldap 0.00 B/s 2.92 M/s 0.00 % 15.25 % slapd -h ldap:/// -F /opt/openldap/etc/~ldap/slapd.d -g openldap -u openldap -4 1816 be/3 root 0.00 B/s 0.00 B/s 0.00 % 3.23 % [jbd2/sda3-8] And top: top - 11:56:27 up 4 days, 1:43, 1 user, load average: 2.71, 2.88, 3.19 Tasks: 224 total, 1 running, 223 sleeping, 0 stopped, 0 zombie Cpu(s): 2.6%us, 0.1%sy, 0.0%ni, 91.3%id, 6.0%wa, 0.0%hi, 0.0%si, 0.0%st Mem: 49424228k total, 35362892k used, 14061336k free, 127844k buffers Swap: 46874876k total, 0k used, 46874876k free, 32631568k cached PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 4833 openldap 20 0 101g 30g 29g S 91 64.1 196:30.20 slapd 4403 root 20 0 0 0 0 D 2 0.0 2:41.89 flush-8:0 1 root 20 0 24472 2444 1360 S 0 0.0 0:04.36 init 2 root 20 0 0 0 0 S 0 0.0 0:00.03 kthreadd 3 root 20 0 0 0 0 S 0 0.0 0:00.37 ksoftirqd/0

3 2

Loosing existing entries when implementing syncrepl N-Way Multi-Master Replication (openldap-2.4.32)
by Joe Phan 07 Apr '13

07 Apr '13

Hi, I have some general questions related to syncrepl N-Way Multi-Master Replication (openldap-2.4.32 on Solaris 10). I already configured a LDAP server and added user entries to DIT. From a client machine, I am able to retrieve user entries via ldapsearch, and login using LDAP user entries is also successful. When I try to configure the LDAP server to be syncrepl N-Way Multi-Master Replication - Server1, existing entries in DIT are gone. From the client machine, ldapsearch command returns empty. - For existing entries in DIT, can we keep them when implementing syncrepl N-Way Multi-Master Replication or we must create them again from the beginning? Regards, Joe

2 1

Re: Anonymous Bind ACL Problems
by Shawn Morford 07 Apr '13

07 Apr '13

On Fri, Apr 5, 2013 at 1:11 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Friday, April 05, 2013 12:46 PM -0700 Dark Morford < > darkmorford+ldap(a)gmail.com> wrote: > > I'm setting up my first LDAP server; just using it as an auth provider >> for Apache until I'm more comfortable with things. I was able to get it >> up and running with a few user entries, but I can't get anonymous >> searching to work the way I want. >> >> It's configured (cn=config) style, and the ACLs are: >> {0}to attrs=uid by anonymous read by users read >> {1}to attrs=userPassword by anonymous auth by self write >> {2}to * by users read >> > > access to entry by * read needs to be in there too before {2}. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > Adding the access entry exactly like you have it gave me an error; I managed to figure out that it needed to be 'to attrs=entry by * read'. And now it seems to be working, so thanks for that. I'm not sure I understand why it's necessary, though. The client service (Apache) just needs to find out if a particular uid exists. Why does it need access to the whole entry?

1 0

None
by Bob Fitch 06 Apr '13

06 Apr '13

http://www.octevillenatation.com/nnqv/xdxapmiuaxur.lsu 4/6/2013 8:23:01 PM 4/6/2013 8:23:01 PM fitchbob

1 0

Anonymous Bind ACL Problems
by Dark Morford 05 Apr '13

05 Apr '13

I'm setting up my first LDAP server; just using it as an auth provider for Apache until I'm more comfortable with things. I was able to get it up and running with a few user entries, but I can't get anonymous searching to work the way I want. It's configured (cn=config) style, and the ACLs are: {0}to attrs=uid by anonymous read by users read {1}to attrs=userPassword by anonymous auth by self write {2}to * by users read Searching for a user as the rootDN works fine: shawn@aquamarine:~$ ldapsearch -x -D 'cn=Manager,dc=darkmorford,dc=net' -W -b 'dc=darkmorford,dc=net' '(uid=smorford)' uid Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=darkmorford,dc=net> with scope subtree # filter: (uid=smorford) # requesting: uid # # smorford, Users, darkmorford.net dn: uid=smorford,ou=Users,dc=darkmorford,dc=net uid: smorford # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 But doing the same search anonymously can't find the user: shawn@aquamarine:~$ ldapsearch -x -b 'dc=darkmorford,dc=net' '(uid=smorford)' uid # extended LDIF # # LDAPv3 # base <dc=darkmorford,dc=net> with scope subtree # filter: (uid=smorford) # requesting: uid # # search result search: 2 result: 32 No such object # numResponses: 1 I have to assume that something in the ACL is blocking the anonymous search. How do I fix this?

2 1

Replication using cn=config
by Andre Rodier 05 Apr '13

05 Apr '13

Hello Everyone, I am trying to implement mirorring replication on OpenLDAP on debian wheezy, and I am struggling since a few days. All the documentation I have found so far on the web site is related to OpenLDAP with a configuration file (slapd.conf) Can anyone gives me a clue on how I can adapt the examples given on the web site to the database configuration backend (cn=config). Thanks for your help. André Rodier.

3 3

How to use LDAP to get user information from MySql database?
by jupiter 05 Apr '13

05 Apr '13

Hi, I have a user management which using MySql database. How can I add and configure LDAP to get user information (username, password, email, public key ....) which installed in MySql database? I know there is a shell in LDAP configuration which can be used to get information from external database such as MySql, but I am not sure if it is the good way or only way to run LDAP and MySql together. Appreciate any advice. Thank you. Kind regards. j

3 3

Re: openldap-technical Digest, Vol 64, Issue 28
by Francois Gnu 03 Apr '13

03 Apr '13

Hello Bill, I'm very interesting to know your method to create a debian package. Thanks a lot! Librement, ------ Francois Trachez (kiko) Team Fedora|Lyon (France) http://stg.fedoraproject.org/fr/ http://stg.fedoraproject.org/es/ 2013/3/28 <openldap-technical-request(a)openldap.org>: > > --On Tuesday, March 26, 2013 06:14:33 PM -0700 Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > >> If you know how to build OpenLDAP manually, and would like to participate in testing the next set of code for the 2.4.35 release, please do so. >> >> Generally, get the code for RE24: >> >> <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> >> >> Configure & build. >> >> Execute the test suite (via make test) after it is built. > > Created a debian package for wheezy and installed it on our development > servers. In addition to passing all of the build tests, my initial > tests have all been successful. > > To build the package I did have to update ol_patch in version.var. > > Bill > > -- > > Bill MacAllister > Infrastructure Delivery Group, Stanford University > > > > ------------------------------ > > _______________________________________________ > openldap-technical mailing list > openldap-technical(a)openldap.org > http://www.openldap.org/lists/mm/listinfo/openldap-technical > > > End of openldap-technical Digest, Vol 64, Issue 28 > **************************************************

1 0

::Bob Fitch::
by Bob Fitch 03 Apr '13

03 Apr '13

http://www.drkaria.com/xecoyox/tose.keyh?pni 4/3/2013 2:28:49 PM 4/3/2013 2:28:49 PM fitchbob

1 0

Chaining without TLS
by jeevan kc 02 Apr '13

02 Apr '13

I've configured a chaining overlay on two slaves with a master to enable update privileges on the slave servers. But every-time I try to modify entries on the Slave I get error code 8.(strong authentication required) Can chaining work without TLS ? If so how? Also I created the overlay only on the slaves ( I looked at the references and it's obvious it shouldn't be on the master). Please help.

1 0

any body have done openldap and active directory synchronization? i need help
by Suman Karki 02 Apr '13

02 Apr '13

hello there! anybody have done openldap and active directory synchronization? i want to sync them. give me idea how you have done? i am struggling to solve that. if you charge some amount then i am ready to pay. just i need to solve that problem.

3 3

Returning objects on exact DN match
by Rick van Rein (OpenFortress) 02 Apr '13

02 Apr '13

Hello, I am trying to publish information only when the exact DN is used, as a measure against iteration of accounts. I configured: olcAccess: to dn.regex="^uid=[^,]+,(ou=[^,]+,)*dc=openfortress,dc=nl$" by (admin) write by * =rcdx Note how this is like read privilege =rscdx minus the =s search filter privilege. I am told that I lack the permission, and suspect the deafult search filter (objectClass=*) requires the =s privilege. Is what I am trying to do posisble with OpenLDAP? Thanks, -RIck

1 2

userPassword issues
by Bbaale Fred 01 Apr '13

01 Apr '13

My users can not login after a successful database migration from ldbm to bdb. I did slapcat and slapadd my ldiff file sucessfully, but the userPassword attribute seems to have been modified. Now for a user to login, i have to first change their password, or at least appear to do that. After doing a ldappasswd, even with the old password, the user can login. Your help is needed , as I do not want to change passwords for 2000 users. Thanks, Fred Bbaale +256772499474

3 9

Re: Jim Vanes
by Jim Vanes 01 Apr '13

01 Apr '13

http://www.pescadosolmeda.com/xrqupfi/cgufm.vrdor?ondes Jim Vanes fbhvveh

1 0

LMDB vs FastDB
by Tobias Oberstein 30 Mar '13

30 Mar '13

Hello, I have read the - very interesting - performance comparison http://symas.com/mdb/microbench/ I'd like to ask if someone did benchmark LMDB (and/or the others) against http://www.garret.ru/fastdb.html FastDB is an in-memory ACID database that works via shadow paging, and without a transaction log. Thanks, Tobias

3 7

Re: RE24 testing call (OpenLDAP 2.4.35)
by Marco Pizzoli 29 Mar '13

29 Mar '13

On Wed, Mar 27, 2013 at 2:14 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > If you know how to build OpenLDAP manually, and would like to participate > in testing the next set of code for the 2.4.35 release, please do so. > > Generally, get the code for RE24: > > <http://www.openldap.org/**devel/gitweb.cgi?p=openldap.** > git;a=snapshot;h=refs/heads/**OPENLDAP_REL_ENG_2_4;sf=tgz<http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> > > > > Configure & build. > > Execute the test suite (via make test) after it is built. > > Thanks! > > --Quanah > > All tests ok for me, too. RHEL6.3 x86_64 Tested for HDB and MDB Marco

1 0

rid tracking
by Sven Jourgensen 28 Mar '13

28 Mar '13

Is there any way to get a master to divulge the rid of each slave that is using it to keep in sync?

3 4

RE24 testing call (OpenLDAP 2.4.35)
by Quanah Gibson-Mount 28 Mar '13

28 Mar '13

If you know how to build OpenLDAP manually, and would like to participate in testing the next set of code for the 2.4.35 release, please do so. Generally, get the code for RE24: <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> Configure & build. Execute the test suite (via make test) after it is built. Thanks! --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

3 2

Chaining
by jeevan kc 27 Mar '13

27 Mar '13

HelloI've set up a chaining overlay on the slave server. I think I followed the proper procedures but every time I try to update entries (delete,add,change)the slave server I get LDAP error code 8 - Strong Authentication Required. How can I modify entries on the slave without getting the error? I've openldap 2.4.30 installed on Red Hat and my configuration is as follows. Any help would be appreciated. dn: olcDatabase={0}ldapobjectClass: olcLDAPConfigobjectClass: olcChainDatabaseolcDatabase: {0}ldapolcDbURI: "ldap://lap00621.cov.vinex.com"olcDbStartTLS: none starttls=noolcDbIDAssertBind: mode=self flags=prescriptive,proxy-authz-non-critical bindm ethod=simple timeout=0 network-timeout=0 binddn="cn=manager,o=vinex,c=us" credentials="l4s3rj3t" keepalive=0:0:0olcDbRebindAsUser: FALSEolcDbChaseReferrals: TRUEolcDbTFSupport: noolcDbProxyWhoAmI: FALSEolcDbProtocolVersion: 3olcDbSingleConn: FALSEolcDbCancel: abandonolcDbUseTemporaryConn: FALSEolcDbConnectionPoolMax: 16olcDbSessionTrackingRequest: FALSEolcDbNoRefs: FALSEolcDbNoUndefFilter: FALSEstructuralObjectClass: olcLDAPConfigentryUUID: df6c7dc4-26a0-1032-829d-b5d50f9d249ecreatorsName: cn=manager,o=vinex,c=uscreateTimestamp: 20130321182829ZentryCSN: 20130321182829.558457Z#000000#000#000000modifiersName: cn=manager,o=vinex,c=usmodifyTimestamp: 20130321182829Z dn: olcOverlay={0}chainobjectClass: olcOverlayConfigobjectClass: olcChainConfigolcOverlay: {0}chainolcChainCacheURI: FALSEolcChainMaxReferralDepth: 1olcChainReturnError: TRUEstructuralObjectClass: olcChainConfigentryUUID: 8a6734ba-2685-1032-8293-b5d50f9d249ecreatorsName: cn=manager,o=vinex,c=uscreateTimestamp: 20130321151250ZentryCSN: 20130321151250.505781Z#000000#000#000000modifiersName: cn=manager,o=vinex,c=usmodifyTimestamp: 20130321151250Z

3 2

Translucent + ProxyCache
by Kevin Vargo 27 Mar '13

27 Mar '13

Hi, Has anyone been able to get Translucent Proxy (slapo-translucent) working with Proxy Cache (slapo-pcache)? I'm using v2.4.31, and the translucent is working great to mix in some attributes specific to that server. Problem is we're converting the "upstream" LDAP to Back-SQL which ends up mighty slow in some use-cases. It would be great to be able to cache the results from the translucent's back-LDAP call. I've tried placing the pcache overlay in various places, but either it the server doesn't start and yields a: no structural objectClass add function error, which may/not be related; or the service starts fine, but doesn't appear to hit the cache at all. Looks like someone tried a while ago, but I can't find any answer: http://www.openldap.org/lists/openldap-software/200803/msg00004.html Perhaps the back-ldap implementation under slapo-translucent isn't fully-functional for some reason? Thanks, Kevin

1 0

Replicating more than 1 subtree from a single master
by Carlo Santos 27 Mar '13

27 Mar '13

Hi, I have a single master and single slave replication setup. Is it possible to replicate different subtrees. I have thought of the following ways to do this: Given we have root node dc=my,dc=ldap with 2 subtrees cn=subtree1,dc=my,dc=ldap and cn=subtree2,dc=my,dc=ldap - use the dn's of the subtrees as searchbases - Assuming that the cn attribute is propagated under the subtrees, use the filter attribute. - A mix of both. Are all of these possible? Or is it even possible to replicate multiple subtrees from a single master?

1 0

Quick setup replica with openldap-2.4.33
by Takashi Komatsubara 27 Mar '13

27 Mar '13

Hi team, This is my first time to post a question. Please forgive me if I am making miss-posting. I have a big ldap master which is based on openldap-2.4.33. The mdb file size is 50 GB. In order to setup an replica server quickly, can we copy the mdb and config to the replica server? files: data/ldap/mdb/db/data.mdb data/ldap/config/cn=config data/ldap/config/cn=config/.... Thank you very much, Takashi.

3 5

Kinda stuck
by Spyros Mailinglists 26 Mar '13

26 Mar '13

Hello all, New to the list, so be tolerant ? :-) I am trying to build an ubuntu server 12.04 with openldap and samba. I want openldap to handle aspects of the server like having a centrilized user management and samba , naturally, for the shares. In an ideal scenario, I would like this box to be able to authenticate LAN users and create shares depending on each users' priviledges. Anywhoo, I've been trying to built this for about three months now. I cannot get it to work. At the moment I am stuck on smbldap-tools and the (infamous ?) configure.pl script. I've tried tons of howto's and manuals on the topic from the net. But once I am stuck, I cannot continue past the aformentioned point. Would anyone know of any resources out there ? If you have any pointers, please share . . . . Thank you very much, spyros

2 1

Re: openldap-2.4.32 su-ok, rlogin-fails
by Joe Phan 26 Mar '13

26 Mar '13

Hi Doug, Thank you so much for your help. With your questions, I double checked credential levels and authentication methods, and luckily, I found the solution for my problem. Error recap: On the Client Machine, when su from one user to another, /var/log/authlog shows the following error: Mar 22 09:03:53 apggd08dev login: [ID 316739 auth.error] pam_ldap: no legal authentication method configured Solution: Reconfigure Client again using credentialLevel and serviceAuthenticationMethod attributes. apggd08dev# ldapclient -v manual -a defaultsearchbase=dc=pg,dc=dtveng,dc=net \ > -a domainname=pg.dtveng.net \ > -a credentialLevel=anonymous \ > -a serviceAuthenticationMethod=pam_ldap:simple xxx.xxx.xxx.xxx where xxx.xxx.xxx.xxx is LDAP server IP. Now, I am able to rlogin/telnet/ssh to the client machine (Native Solaris LDAP Client) using a user account defined from LDAP Server. "su" from from one user to another also works well. Thanks, Joe ________________________________ From: Doug Leavitt <doug.leavitt(a)oracle.com> To: Joe Phan <joeanhphan(a)yahoo.com> Sent: Wednesday, March 20, 2013 12:20 PM Subject: Re: openldap-2.4.32 su-ok, rlogin-fails No. SSL is not required for authentication. But if you are using pam_ldap without SSL, your passwords are sent over TCP/IP in the clear. Alternatively you can use pam_unix authentication and have the password hashes sent over the wire (like in NIS) and have the unix client do the authentication. This usually requires that you store the passwords in the LDAP server in {crypt} format. On 03/20/13 14:07, Joe Phan wrote: Hi Doug, > >Do you know if it is required to have SSL for authentication? In other word, do I need to configure SSL Tunnel? >Do I need to change pam.conf on LDAP Server? > >Link: http://www.softpanorama.info/Net/Directories/ldap.shtml >"Because our LDAP service requires SSL connections before allowing authentication, it is necessary to connect to the LDAP server using SSL" > > >Thanks, >Joe > > > > >________________________________ > From: Doug Leavitt <doug.leavitt(a)oracle.com> >To: Joe Phan <joeanhphan(a)yahoo.com> >Sent: Tuesday, March 19, 2013 3:08 PM >Subject: Re: openldap-2.4.32 su-ok, rlogin-fails > > >You probably need to correct your pam settings in pam.conf. >See the pam_ldap man page for more details. I suspect you >need to change the setting to look more like this: > # Authentication management for login service is stacked. > # If pam_unix_auth succeeds, pam_ldap is not invoked. > # The control flag "binding" provides a local overriding > # remote (LDAP) control. The "server_policy" option is used > # to tell pam_unix_auth.so.1 to ignore the LDAP users. > > login auth requisite pam_authtok_get.so.1 > login auth required pam_dhkeys.so.1 > login auth required pam_unix_cred.so.1 > login auth binding pam_unix_auth.so.1 server_policy > login auth required pam_ldap.so.1 > >If your system is set up for anonymous connections may or may not >be an issue depending on your servers acl setups. > >I am referring to the configuration supplied into ldapclient (aka what is in >/var/ldap/ldap_client_file, and presumably ldap_cred_file is you have bind >credentials into the ldap server). > >When we setup DSEE servers we usually recommend at least proxy >credentials and at least simple bind, or more depending on your security >needs. Your needs may vary. > >Doug. > >On 03/19/13 15:32, Joe Phan wrote: >Hi Doug, >> >> >>Thank you for looking at this. >> >>apggd08dev# ldaplist -l passwd jphan >>dn: uid=jphan,ou=people,dc=pg,dc=dtveng,dc=net >> objectClass: top >> objectClass: posixAccount >> objectClass: shadowAccount >> objectClass: posixGroup >> cn: jphan >> uid: jphan >> uidNumber: 2003 >> gidNumber: 203 >> homeDirectory: /export/home/jphan >> loginShell: /usr/bin/csh >> gecos: Joe Phan 310-964-4125 >> shadowLastChange: 0 >> shadowMax: 0 >> shadowWarning: 0 >> userPassword: {SSHA}/... >> >>Also how is your system configured w.r.t anonymous connections? <== Yes, I believed that I configured the system for anonymous connections. Do you know how to verify it? >>What are you credential levels and authentication methods being used in your configuration? <== Not sure about credential levels; I am using PAM for authentication. At the beginning, I don't have SASL/TLS. >> >> >> >>Sorry for unclear answers if existed, b/c I am new to LDAP and PAM. >>Please show me where or which area I should verify the system. >>Thank you so much, >> >> >>Joe Phan >> >> >> >>________________________________ >> From: Doug Leavitt <doug.leavitt(a)oracle.com> >>To: Joe Phan <joeanhphan(a)yahoo.com> >>Sent: Tuesday, March 19, 2013 12:27 PM >>Subject: Re: openldap-2.4.32 su-ok, rlogin-fails >> >> >>What happens if you try: >> >>ldaplist -l passwd jphan >> >>Also how is your system configured w.r.t anonymous connections? >>What are you credential levels and authentication methods being used >>in your configuration? >> >> >>Doug. >> >>On 03/18/13 19:01, Joe Phan wrote: >>Hi, >>> >>> >>> >>>I configured a machine to be LDAP Server (openldap-2.4.32) on Solaris 10. Adding users/groups to LDAP Server seems to be ok. >>> >>> >>> >>>From a second machine, I configured it to be LDAP Client using command "ldapclient manual -v -a defaultsearchbase=dc=pg,dc=dtveng,dc=net -a domainname=pg.dtveng.net 10.26.82.16". It was successful. /var/ldap/ldap_client_file contains appropriate LDAP Server information. >>>Openldap-2.4.32 is not installed on the Client Machine. >>> >>> >>>I updated PAM configuration on Client Machine for su and rlogin, results are listed below: >>>- rlogin into Client Machine using root - OK >>>- rlogin into Client Machine using "jphan" user - Fails >>> >>>- After login to Client Machine as root, su from root to "jphan" user - OK (Note: jphan user does not exist in Client Machine /etc/passwd, jphan user exists in LDAP Server) >>> >>>- From "jphan" user, su to another user - Fails >>> >>> >>>Could someone please take a look at the configuration for rlogin PAM below to see if the configuration is correct. >>>Please let me know if there is anything missing from my setup. >>>Do I need to configure pam.conf on LDAP Server machine as well? >>> >>> >>> >>>Any help is greatly appreciated. >>>Best regards, >>>Joe Phan >>> >>> >>> >>> >>> >>>Downloaded and installed following packages from SunFreeWare.com to LDAP Server: >>>openldap-2.4.32-sol10-sparc-local.gz >>>db-4.7.25.NC-sol10-sparc-local.gz >>>gcc-3.3.2-sol10-sparc-local.gz >>>libgcc-3.3-sol10-sparc-local.gz >>>libtool-2.4.2-sol10-sparc-local.gz >>>openssl-1.0.1c-sol10-sparc-local.gz >>>sasl-2.1.25-sol10-sparc-local.gz >>> >>> >>>Client Machine configuration: >>>- /etc/nsswitch.conf: >>>passwd: files ldap >>>group: files ldap >>>shadow: files ldap >>> >>> >>>- /etc/pam.conf: >>>apggd08dev# more pam.conf >>># >>>login auth requisite pam_authtok_get.so.1 >>>login auth required pam_dhkeys.so.1 >>>login auth required pam_unix_cred.so.1 >>>#login auth required pam_unix_auth.so.1 >>>login auth sufficient pam_unix_auth.so.1 >>>login auth required pam_dial_auth.so.1 >>>login auth required pam_ldap.so.1 debug >>># >>># rlogin service (explicit because of pam_rhost_auth) >>># >>>rlogin auth sufficient pam_rhosts_auth.so.1 >>>rlogin auth requisite pam_authtok_get.so.1 >>>rlogin auth required pam_dhkeys.so.1 >>>rlogin auth required pam_unix_cred.so.1 >>>#rlogin auth required pam_unix_auth.so.1 >>>rlogin auth sufficient pam_unix_auth.so.1 >>>rlogin auth required pam_ldap.so.1 debug >>># >>># Kerberized rlogin service >>># >>>krlogin auth required pam_unix_cred.so.1 >>>krlogin auth binding pam_krb5.so.1 >>>krlogin auth required pam_unix_auth.so.1 >>># >>># rsh service (explicit because of pam_rhost_auth, >>># and pam_unix_auth for meaningful pam_setcred) >>># >>>rsh auth sufficient pam_rhosts_auth.so.1 >>>rsh auth required pam_unix_cred.so.1 >>># >>># Kerberized rsh service >>># >>>krsh auth required pam_unix_cred.so.1 >>>krsh auth binding pam_krb5.so.1 >>>krsh auth required pam_unix_auth.so.1 >>># >>># Kerberized telnet service >>># >>>ktelnet auth required pam_unix_cred.so.1 >>>ktelnet auth binding pam_krb5.so.1 >>>ktelnet auth required pam_unix_auth.so.1 >>># >>># PPP service (explicit because of pam_dial_auth) >>># >>>ppp auth requisite pam_authtok_get.so.1 >>>ppp auth required pam_dhkeys.so.1 >>>ppp auth required pam_unix_cred.so.1 >>>#ppp auth required pam_unix_auth.so.1 >>>ppp auth sufficient pam_unix_auth.so.1 >>>ppp auth required pam_dial_auth.so.1 >>>ppp auth required pam_ldap.so.1 debug >>># >>># Default definitions for Authentication management >>># Used when service name is not explicitly mentioned for authentication >>># >>>other auth requisite pam_authtok_get.so.1 >>>other auth required pam_dhkeys.so.1 >>>other auth required pam_unix_cred.so.1 >>>#other auth required pam_unix_auth.so.1 >>>other auth sufficient pam_unix_auth.so.1 >>>other auth required pam_ldap.so.1 debug >>># >>># passwd command (explicit because of a different authentication module) >>># >>>#passwd auth required pam_passwd_auth.so.1 >>>passwd auth sufficient pam_passwd_auth.so.1 >>>passwd auth required pam_ldap.so.1 debug >>># >>># cron service (explicit because of non-usage of pam_roles.so.1) >>># >>>cron account required pam_unix_account.so.1 >>># >>># Default definition for Account management >>># Used when service name is not explicitly mentioned for account management >>># >>>other account sufficient pam_ldap.so.1 debug >>>other account requisite pam_roles.so.1 >>>other account required pam_unix_account.so.1 >>># >>># Default definition for Session management >>># Used when service name is not explicitly mentioned for session management >>># >>>other session required pam_unix_session.so.1 >>># >>># Default definition for Password management >>># Used when service name is not explicitly mentioned for password management >>># >>>other password required pam_dhkeys.so.1 >>>other password requisite pam_authtok_get.so.1 >>>other password requisite pam_authtok_check.so.1 >>>other password required pam_authtok_store.so.1 >>> >>> >>> >>> >>>jphan user info: >>>apggd04dev# ldapsearch -x -b 'dc=pg,dc=dtveng,dc=net' 'uid=jphan' >>># extended LDIF >>># >>># LDAPv3 >>># base <dc=pg,dc=dtveng,dc=net> with scope subtree >>># filter: uid=jphan >>># requesting: ALL >>># >>> >>># jphan, people, pg.dtveng.net >>>dn: uid=jphan,ou=people,dc=pg,dc=dtveng,dc=net >>>objectClass: top >>>objectClass: posixAccount >>>objectClass: shadowAccount >>>objectClass: posixGroup >>>cn: jphan >>>uid: jphan >>>uidNumber: 2003 >>>gidNumber: 203 >>>homeDirectory: /export/home/jphan >>>loginShell: /usr/bin/csh >>>gecos:: Sm9lIFBoYW4gMzEwLTk2NC00MTI1IA== >>>shadowLastChange: 0 >>>shadowMax: 0 >>>shadowWarning: 0 >>>userPassword:: ....= >>> >>># search result >>>search: 2 >>>result: 0 Success >>> >>># numResponses: 2 >>># numEntries: 1 >>> >>> >> >> > >

1 0

[LMDB] Append To Value
by Yucheng Low 26 Mar '13

26 Mar '13

Hi, I am considering using LMDB to store a dynamic graph structure, and it will be very helpful to support "append to value" having the same semantics as "append" in Kyoto Cabinet. http://fallabs.com/kyotocabinet/api/classkyotocabinet_1_1BasicDB.html#a23e7… For instance, if I were to store an adjacency list representation of a graph in LMDB, I would use vertex ID as the key, and the value is a vector of 64-bit IDs. To insert an edge into the graph will simply require appending 8 bytes to the end of the vector. Re-reading and re-writing the entire value will be somewhat excessive (and will actually change the asymptotic runtime of the insertion). This is also one of those situations where a batch append might be useful. For instance, if I have an edge list on file which is too large to retain in memory. To convert it to an adjacency list in LMDB will require batch-append. Batch-writes are insufficient since that will require me to cache at least, large parts of the adjacency list in memory, and the original edge list could be ordered arbitrarily. The actual graph representation I am thinking of is somewhat more intelligent than a straight adjacency list, but similar concepts hold. I have tried looking through the lmdb source to try to implement append myself, but the put logic is somewhat complicated... Yucheng

2 3

about openldap over udp
by Guo Star 26 Mar '13

26 Mar '13

Hi, i am a freshman on openldap. Now, i can login my openldap client machine, through openldap server machine authentication. And I see openldap use tcp/389 to communicate. Can I set openldap over udp/389 ? Thank a lot. Best Regard, Star Guo >From Guangzhou, China.

2 1

Problem in connecting OpenLDAP server with PostgreSQL DB
by SHEKHAR PODICHETI 26 Mar '13

26 Mar '13

Hello, I compiled and installed openldap-2.4.34 by enabling the back-sql. I installed PostgreSQL database , created the users in DB as per the OpenLDAP Admin guide. However, OpenLDAP server is unable to start and connect to the PostgreSQL database. I got a following problem while I was running a sample SQL read operation from the PostgreSQL DB. root@DevelopmentServer:~/Shekhar/OpenLDAP/openldap-2.4.34/tests#<https://mail.ril.com/owa/UrlBlockedError.aspx>SLAPD_USE_SQL=pgsql ./run sql-test000 Cleaning up test run directory leftover from previous run. Running ./scripts/sql-test000-read for bdb... running defines.sh Starting slapd on TCP/IP port 9011... Testing SQL backend read operations... Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... ldapsearch failed (255)! kill: 57: No such process root@DevelopmentServer:~/Shekhar/OpenLDAP/openldap-2.4.34/tests#<https://mail.ril.com/owa/UrlBlockedError.aspx> Regards, Shekhar Podicheti

1 0

Openldap Chaining help
by jeevan kc 26 Mar '13

26 Mar '13

HelloI've set up a chaining overlay on the slave server. I think I followed the proper procedures but every time I try to update entries (delete,add,change)the slave server I get LDAP error code 8 - Strong Authentication Required. How can I modify entries on the slave without getting the error? I've openldap 2.4.30 installed on Red Hat and my configuration is as follows. Any help would be appreciated.dn: olcDatabase={0}ldapobjectClass: olcLDAPConfigobjectClass: olcChainDatabaseolcDatabase: {0}ldapolcDbURI: "ldap://lap00621.cov.vinex.com"olcDbStartTLS: none starttls=noolcDbIDAssertBind: mode=self flags=prescriptive,proxy-authz-non-critical bindm ethod=simple timeout=0 network-timeout=0 binddn="cn=manager,o=vinex,c=us" credentials="l4s3rj3t" keepalive=0:0:0olcDbRebindAsUser: FALSEolcDbChaseReferrals: TRUEolcDbTFSupport: noolcDbProxyWhoAmI: FALSEolcDbProtocolVersion: 3olcDbSingleConn: FALSEolcDbCancel: abandonolcDbUseTemporaryConn: FALSEolcDbConnectionPoolMax: 16olcDbSessionTrackingRequest: FALSEolcDbNoRefs: FALSEolcDbNoUndefFilter: FALSEstructuralObjectClass: olcLDAPConfigentryUUID: df6c7dc4-26a0-1032-829d-b5d50f9d249ecreatorsName: cn=manager,o=vinex,c=uscreateTimestamp: 20130321182829ZentryCSN: 20130321182829.558457Z#000000#000#000000modifiersName: cn=manager,o=vinex,c=usmodifyTimestamp: 20130321182829Z dn: olcOverlay={0}chainobjectClass: olcOverlayConfigobjectClass: olcChainConfigolcOverlay: {0}chainolcChainCacheURI: FALSEolcChainMaxReferralDepth: 1olcChainReturnError: TRUEstructuralObjectClass: olcChainConfigentryUUID: 8a6734ba-2685-1032-8293-b5d50f9d249ecreatorsName: cn=manager,o=vinex,c=uscreateTimestamp: 20130321151250ZentryCSN: 20130321151250.505781Z#000000#000#000000modifiersName: cn=manager,o=vinex,c=usmodifyTimestamp: 20130321151250Z

1 0

OpenLDAP + Active Directory User and Password Sync
by Suman Karki 26 Mar '13

26 Mar '13

This is what I am looking for: 1. Any User Added to Active Directory shall be added to OpenLDAP as well and any password modified from Active Directory should be modified in OpenLDAP as well - where OpenLDAP would be used for System Auth in a Linux environment. 2. Any User Added to OpenLDAP should be added to Active Directory along with the same credentials and any password modified in OpenLDAP should be modified in Active Directory as well.

1 0

unique olcOverlay: pb in configuration
by Alessandro Dentella 25 Mar '13

25 Mar '13

Hi, I have been struggling to understand how to configure unique overlay and I can't understand the error message I receive. Adding the overlay ================== And I'm trying to add Unique Overlay as:: dn: olcOverlay={0}unique,olcDatabase={1}hdb changetype: add objectClass: olcOverlayConfig objectClass: olcUniqueConfig olcOverlay: {0}unique olcUniqueURI: ldap:///?mail?sub that fails with error:: test-acomea:~# ldapmodify -D cn=admin,cn=config -w isi -f ,ldapvi-test-acomea-3996.ldif adding new entry "olcOverlay={0}unique,olcDatabase={1}hdb" ldap_add: Invalid syntax (21) additional info: objectClass: value #1 invalid per syntax I can't really understand which is the syntax error, my setup is below. Dscription of setup =================== I have a database to which I need to add unique constraint to the 'mail' field. I loaded uniqu module in cn-config:: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib/ldap olcModuleLoad: {0}back_hdb olcModuleLoad: {1}unique and I have a db defined as:: test-acomea:~# ldapsearch -xLLL -D cn=admin,cn=config -b cn=config -W olcSuffix=dc=acomea,dc=it dn: olcDatabase={1}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=acomea,dc=it ... Thanks in advance sandro *:-) PS: Any pointer to examples is very appreciated

2 2

Help me "Ldap Replication"
by hash 25 Mar '13

25 Mar '13

Hi, sorry to ask simple question, since i am newbie in ldap. I am trying to setup ldap replication provider and consumer, i am using RHEL 6 with openldap-2.4.23-26.el6.x86_64. The problem is the data is not being synchronozing. i am using cn=config. here is the config of provider. [root@hmslogbnc3 slapd.d]# more cn\=config.ldif dn: cn=config objectClass: olcGlobal cn: config olcConfigFile: /etc/openldap/schema/schema_convert.conf olcConfigDir: /etc/openldap/slapd.d olcArgsFile: /var/run/openldap/slapd.args olcAttributeOptions: lang- olcAuthzPolicy: none olcConcurrency: 0 olcConnMaxPending: 100 olcConnMaxPendingAuth: 1000 olcGentleHUP: FALSE olcIdleTimeout: 0 olcIndexSubstrIfMaxLen: 4 olcIndexSubstrIfMinLen: 2 olcIndexSubstrAnyLen: 4 olcIndexSubstrAnyStep: 2 olcIndexIntLen: 4 olcLocalSSF: 71 olcPidFile: /var/run/openldap/slapd.pid olcReadOnly: FALSE olcReverseLookup: FALSE olcSaslSecProps: noplain,noanonymous olcSizeLimit: unlimited olcSockbufMaxIncoming: 262143 olcSockbufMaxIncomingAuth: 16777215 olcThreads: 16 olcTLSVerifyClient: never olcToolThreads: 1 olcWriteTimeout: 0 structuralObjectClass: olcGlobal entryUUID: e683e806-2680-1032-8d81-bf9693325536 creatorsName: cn=config createTimestamp: 20130321143937Z entryCSN: 20130321143937.560581Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20130321143937Z [root@hmslogbnc3 cn=config]# more olcDatabase\=\{1\}bdb.ldif dn: olcDatabase={1}bdb objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {1}bdb olcSuffix: dc=secure-mail,dc=belgacom olcAccess: {0}to attrs=userPassword by dn.base="cn=admin,dc=secure-mail,dc=be lgacom" write by dn.children="ou=administrators,dc=secure-mail,dc=belgacom" write by anonymous auth olcAccess: {1}to * by dn.base="cn=admin,dc=secure-mail,dc=belgacom" write by dn.base="cn=replica,dc=secure-mail,dc=belgacom" write by dn.children="ou=ad ministrators,dc=secure-mail,dc=belgacom" write by users read by anonymous r ead olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=admin,dc=secure-mail,dc=belgacom olcRootPW:: ***** olcSyncUseSubentry: FALSE olcMonitoring: TRUE olcDbDirectory: /openldap olcDbCacheSize: 20000 olcDbNoSync: FALSE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 20000 olcDbIndex: objectClass eq olcDbIndex: entryUUID eq olcDbIndex: entryCSN eq olcDbIndex: srcIP eq,approx,sub olcDbIndex: finalDestination eq,sub olcDbIndex: policy eq olcDbIndex: customerId eq olcDbIndex: dc eq,approx,sub olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 structuralObjectClass: olcBdbConfig entryUUID: e68469de-2680-1032-8d8d-bf9693325536 creatorsName: cn=config createTimestamp: 20130321143937Z entryCSN: 20130321143937.560581Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20130321143937Z [root@hmslogbnc3 cn=config]# [root@hmslogbnc3 cn=config]# more cn\=module\{0\}.ldif dn: cn=module{0} objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib64/openldap olcModuleLoad: {0}syncprov.la structuralObjectClass: olcModuleList entryUUID: e683edd8-2680-1032-8d82-bf9693325536 creatorsName: cn=config createTimestamp: 20130321143937Z entryCSN: 20130321143937.560581Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20130321143937Z When i tried to start the consumer server i am getting the log daemon: activity on 1 descriptor daemon: listen=7, new connection on 12 daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: added 12r (active) listener=(nil) daemon: activity on 2 descriptors daemon: activity on: 12r daemon: read active on 12 conn=1000 fd=12 ACCEPT from IP=10.48.12.42:33557 (IP=0.0.0.0:389) daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL connection_get(12) connection_get(12): got connid=1000 connection_read(12): checking for input on id=1000 ber_get_next ldap_read: want=8, got=8 0000: 30 38 02 01 01 60 33 02 08...`3. ldap_read: want=50, got=50 0000: 01 03 04 25 63 6e 3d 72 65 70 6c 69 63 61 2c 64 ...%cn=replica,d 0010: 63 3d 73 65 63 75 72 65 2d 6d 61 69 6c 2c 64 63 c=secure-mail,dc 0020: 3d 62 65 6c 67 61 63 6f 6d 80 07 72 33 70 6c 69 =belgacom..r3pli 0030: 63 61 ca ber_get_next: tag 0x30 len 56 contents: ber_dump: buf=0x7fc7f4002660 ptr=0x7fc7f4002660 end=0x7fc7f4002698 len=56 0000: 02 01 01 60 33 02 01 03 04 25 63 6e 3d 72 65 70 ...`3....%cn=rep 0010: 6c 69 63 61 2c 64 63 3d 73 65 63 75 72 65 2d 6d lica,dc=secure-m 0020: 61 69 6c 2c 64 63 3d 62 65 6c 67 61 63 6f 6d 80 ail,dc=belgacom. 0030: 07 72 33 70 6c 69 63 61 .r3plica op tag 0x60, time 1364215962 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable daemon: activity on 1 descriptor daemon: activity on: conn=1000 op=0 do_bind daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL ber_scanf fmt ({imt) ber: ber_dump: buf=0x7fc7f4002660 ptr=0x7fc7f4002663 end=0x7fc7f4002698 len=53 0000: 60 33 02 01 03 04 25 63 6e 3d 72 65 70 6c 69 63 `3....%cn=replic 0010: 61 2c 64 63 3d 73 65 63 75 72 65 2d 6d 61 69 6c a,dc=secure-mail 0020: 2c 64 63 3d 62 65 6c 67 61 63 6f 6d 80 07 72 33 ,dc=belgacom..r3 0030: 70 6c 69 63 61 plica ber_scanf fmt (m}) ber: ber_dump: buf=0x7fc7f4002660 ptr=0x7fc7f400268f end=0x7fc7f4002698 len=9 0000: 00 07 72 33 70 6c 69 63 61 ..r3plica >>> dnPrettyNormal: <cn=replica,dc=secure-mail,dc=belgacom> => ldap_bv2dn(cn=replica,dc=secure-mail,dc=belgacom,0) <= ldap_bv2dn(cn=replica,dc=secure-mail,dc=belgacom)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=replica,dc=secure-mail,dc=belgacom)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=replica,dc=secure-mail,dc=belgacom)=0 <<< dnPrettyNormal: <cn=replica,dc=secure-mail,dc=belgacom>, <cn=replica,dc=secure-mail,dc=belgacom> conn=1000 op=0 BIND dn="cn=replica,dc=secure-mail,dc=belgacom" method=128 do_bind: version=3 dn="cn=replica,dc=secure-mail,dc=belgacom" method=128 ==> bdb_bind: dn: cn=replica,dc=secure-mail,dc=belgacom bdb_dn2entry("cn=replica,dc=secure-mail,dc=belgacom") => bdb_dn2id("cn=replica,dc=secure-mail,dc=belgacom") <= bdb_dn2id: got id=0x4b7 entry_decode: "cn=replica,dc=secure-mail,dc=belgacom" <= entry_decode(cn=replica,dc=secure-mail,dc=belgacom) => access_allowed: result not in cache (userPassword) => access_allowed: auth access to "cn=replica,dc=secure-mail,dc=belgacom" "userPassword" requested => acl_get: [1] attr userPassword => acl_mask: access to entry "cn=replica,dc=secure-mail,dc=belgacom", attr "userPassword" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: cn=admin,dc=secure-mail,dc=belgacom <= check a_dn_pat: ou=administrators,dc=secure-mail,dc=belgacom <= check a_dn_pat: anonymous <= acl_mask: [3] applying auth(=xd) (stop) <= acl_mask: [3] mask: auth(=xd) => slap_access_allowed: auth access granted by auth(=xd) => access_allowed: auth access granted by auth(=xd) conn=1000 op=0 BIND dn="cn=replica,dc=secure-mail,dc=belgacom" mech=SIMPLE ssf=0 do_bind: v3 bind: "cn=replica,dc=secure-mail,dc=belgacom" to "cn=replica,dc=secure-mail,dc=belgacom" send_ldap_result: conn=1000 op=0 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_response: msgid=1 tag=97 err=0 ber_flush2: 14 bytes to sd 12 0000: 30 0c 02 01 01 61 07 0a 01 00 04 00 04 00 0....a........ ldap_write: want=14, written=14 0000: 30 0c 02 01 01 61 07 0a 01 00 04 00 04 00 0....a........ conn=1000 op=0 RESULT tag=97 err=0 text= daemon: activity on 1 descriptor daemon: activity on: 12r daemon: read active on 12 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL connection_get(12) connection_get(12): got connid=1000 connection_read(12): checking for input on id=1000 ber_get_next ldap_read: want=8, got=8 0000: 30 81 c1 02 01 02 63 40 0.....c@ ldap_read: want=188, got=188 0000: 04 1a 64 63 3d 73 65 63 75 72 65 2d 6d 61 69 6c ..dc=secure-mail 0010: 2c 64 63 3d 62 65 6c 67 61 63 6f 6d 0a 01 00 0a ,dc=belgacom.... 0020: 01 00 02 01 00 02 01 00 01 01 00 87 0b 6f 62 6a .............obj 0030: 65 63 74 63 6c 61 73 73 30 06 04 01 2a 04 01 2b ectclass0...*..+ 0040: a0 7a 30 5a 04 18 31 2e 33 2e 36 2e 31 2e 34 2e .z0Z..1.3.6.1.4. 0050: 31 2e 34 32 30 33 2e 31 2e 39 2e 31 2e 31 04 3e 1.4203.1.9.1.1.> 0060: 30 3c 0a 01 03 04 34 72 69 64 3d 31 30 30 2c 63 0<....4rid=100,c 0070: 73 6e 3d 32 30 31 33 30 33 32 32 31 34 35 39 30 sn=2013032214590 0080: 33 2e 38 31 36 30 39 36 5a 23 30 30 30 30 30 30 3.816096Z#000000 0090: 23 30 30 30 23 30 30 30 30 30 30 01 01 ff 30 1c #000#000000...0. 00a0: 04 17 32 2e 31 36 2e 38 34 30 2e 31 2e 31 31 33 ..2.16.840.1.113 00b0: 37 33 30 2e 33 2e 34 2e 32 01 01 ff 730.3.4.2... ber_get_next: tag 0x30 len 193 contents: ber_dump: buf=0x7fc7f80008c0 ptr=0x7fc7f80008c0 end=0x7fc7f8000981 len=193 0000: 02 01 02 63 40 04 1a 64 63 3d 73 65 63 75 72 65 ...c@..dc=secure 0010: 2d 6d 61 69 6c 2c 64 63 3d 62 65 6c 67 61 63 6f -mail,dc=belgaco 0020: 6d 0a 01 00 0a 01 00 02 01 00 02 01 00 01 01 00 m............... 0030: 87 0b 6f 62 6a 65 63 74 63 6c 61 73 73 30 06 04 ..objectclass0.. 0040: 01 2a 04 01 2b a0 7a 30 5a 04 18 31 2e 33 2e 36 .*..+.z0Z..1.3.6 0050: 2e 31 2e 34 2e 31 2e 34 32 30 33 2e 31 2e 39 2e .1.4.1.4203.1.9. 0060: 31 2e 31 04 3e 30 3c 0a 01 03 04 34 72 69 64 3d 1.1.>0<....4rid= 0070: 31 30 30 2c 63 73 6e 3d 32 30 31 33 30 33 32 32 100,csn=20130322 0080: 31 34 35 39 30 33 2e 38 31 36 30 39 36 5a 23 30 145903.816096Z#0 0090: 30 30 30 30 30 23 30 30 30 23 30 30 30 30 30 30 00000#000#000000 00a0: 01 01 ff 30 1c 04 17 32 2e 31 36 2e 38 34 30 2e ...0...2.16.840. 00b0: 31 2e 31 31 33 37 33 30 2e 33 2e 34 2e 32 01 01 1.113730.3.4.2.. 00c0: ff . op tag 0x63, time 1364215962 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable daemon: activity on 1 descriptor conn=1000 op=1 do_search ber_scanf fmt ({miiiib) ber: ber_dump: buf=0x7fc7f80008c0 ptr=0x7fc7f80008c3 end=0x7fc7f8000981 len=190 0000: 63 40 04 1a 64 63 3d 73 65 63 75 72 65 2d 6d 61 c@..dc=secure-ma 0010: 69 6c 2c 64 63 3d 62 65 6c 67 61 63 6f 6d 0a 01 il,dc=belgacom.. 0020: 00 0a 01 00 02 01 00 02 01 00 01 01 00 87 0b 6f ...............o 0030: 62 6a 65 63 74 63 6c 61 73 73 30 06 04 01 2a 04 bjectclass0...*. 0040: 01 2b a0 7a 30 5a 04 18 31 2e 33 2e 36 2e 31 2e .+.z0Z..1.3.6.1. 0050: 34 2e 31 2e 34 32 30 33 2e 31 2e 39 2e 31 2e 31 4.1.4203.1.9.1.1 0060: 04 3e 30 3c 0a 01 03 04 34 72 69 64 3d 31 30 30 .>0<....4rid=100 0070: 2c 63 73 6e 3d 32 30 31 33 30 33 32 32 31 34 35 ,csn=20130322145 0080: 39 30 33 2e 38 31 36 30 39 36 5a 23 30 30 30 30 903.816096Z#0000 0090: 30 30 23 30 30 30 23 30 30 30 30 30 30 01 01 ff 00#000#000000... 00a0: 30 1c 04 17 32 2e 31 36 2e 38 34 30 2e 31 2e 31 0...2.16.840.1.1 00b0: 31 33 37 33 30 2e 33 2e 34 2e 32 01 01 ff 13730.3.4.2... >>> dnPrettyNormal: <dc=secure-mail,dc=belgacom> => ldap_bv2dn(dc=secure-mail,dc=belgacom,0) <= ldap_bv2dn(dc=secure-mail,dc=belgacom)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=secure-mail,dc=belgacom)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=secure-mail,dc=belgacom)=0 <<< dnPrettyNormal: <dc=secure-mail,dc=belgacom>, <dc=secure-mail,dc=belgacom> SRCH "dc=secure-mail,dc=belgacom" 0 0 0 0 0 begin get_filter PRESENT ber_scanf fmt (m) ber: ber_dump: buf=0x7fc7f80008c0 ptr=0x7fc7f80008f0 end=0x7fc7f8000981 len=145 0000: 87 0b 6f 62 6a 65 63 74 63 6c 61 73 73 30 06 04 ..objectclass0.. 0010: 01 2a 04 01 2b a0 7a 30 5a 04 18 31 2e 33 2e 36 .*..+.z0Z..1.3.6 0020: 2e 31 2e 34 2e 31 2e 34 32 30 33 2e 31 2e 39 2e .1.4.1.4203.1.9. 0030: 31 2e 31 04 3e 30 3c 0a 01 03 04 34 72 69 64 3d 1.1.>0<....4rid= 0040: 31 30 30 2c 63 73 6e 3d 32 30 31 33 30 33 32 32 100,csn=20130322 0050: 31 34 35 39 30 33 2e 38 31 36 30 39 36 5a 23 30 145903.816096Z#0 0060: 30 30 30 30 30 23 30 30 30 23 30 30 30 30 30 30 00000#000#000000 0070: 01 01 ff 30 1c 04 17 32 2e 31 36 2e 38 34 30 2e ...0...2.16.840. 0080: 31 2e 31 31 33 37 33 30 2e 33 2e 34 2e 32 01 01 1.113730.3.4.2.. 0090: ff . end get_filter 0 filter: (objectClass=*) ber_scanf fmt ({M}}) ber: ber_dump: buf=0x7fc7f80008c0 ptr=0x7fc7f80008fd end=0x7fc7f8000981 len=132 0000: 00 06 04 01 2a 04 01 2b a0 7a 30 5a 04 18 31 2e ....*..+.z0Z..1. 0010: 33 2e 36 2e 31 2e 34 2e 31 2e 34 32 30 33 2e 31 3.6.1.4.1.4203.1 0020: 2e 39 2e 31 2e 31 04 3e 30 3c 0a 01 03 04 34 72 .9.1.1.>0<....4r 0030: 69 64 3d 31 30 30 2c 63 73 6e 3d 32 30 31 33 30 id=100,csn=20130 0040: 33 32 32 31 34 35 39 30 33 2e 38 31 36 30 39 36 322145903.816096 0050: 5a 23 30 30 30 30 30 30 23 30 30 30 23 30 30 30 Z#000000#000#000 0060: 30 30 30 01 01 ff 30 1c 04 17 32 2e 31 36 2e 38 000...0...2.16.8 0070: 34 30 2e 31 2e 31 31 33 37 33 30 2e 33 2e 34 2e 40.1.113730.3.4. 0080: 32 01 01 ff 2... => get_ctrls ber_scanf fmt ({m) ber: ber_dump: buf=0x7fc7f80008c0 ptr=0x7fc7f8000907 end=0x7fc7f8000981 len=122 0000: 30 5a 04 18 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e 0Z..1.3.6.1.4.1. 0010: 34 32 30 33 2e 31 2e 39 2e 31 2e 31 04 3e 30 3c 4203.1.9.1.1.>0< 0020: 0a 01 03 04 34 72 69 64 3d 31 30 30 2c 63 73 6e ....4rid=100,csn 0030: 3d 32 30 31 33 30 33 32 32 31 34 35 39 30 33 2e =20130322145903. 0040: 38 31 36 30 39 36 5a 23 30 30 30 30 30 30 23 30 816096Z#000000#0 0050: 30 30 23 30 30 30 30 30 30 01 01 ff 30 1c 04 17 00#000000...0... 0060: 32 2e 31 36 2e 38 34 30 2e 31 2e 31 31 33 37 33 2.16.840.1.11373 0070: 30 2e 33 2e 34 2e 32 01 01 ff 0.3.4.2... ber_scanf fmt (m) ber: ber_dump: buf=0x7fc7f80008c0 ptr=0x7fc7f8000923 end=0x7fc7f8000981 len=94 0000: 00 3e 30 3c 0a 01 03 04 34 72 69 64 3d 31 30 30 .>0<....4rid=100 0010: 2c 63 73 6e 3d 32 30 31 33 30 33 32 32 31 34 35 ,csn=20130322145 0020: 39 30 33 2e 38 31 36 30 39 36 5a 23 30 30 30 30 903.816096Z#0000 0030: 30 30 23 30 30 30 23 30 30 30 30 30 30 01 01 ff 00#000#000000... 0040: 30 1c 04 17 32 2e 31 36 2e 38 34 30 2e 31 2e 31 0...2.16.840.1.1 0050: 31 33 37 33 30 2e 33 2e 34 2e 32 01 01 ff 13730.3.4.2... => get_ctrls: oid="1.3.6.1.4.1.4203.1.9.1.1" (noncritical) ber_scanf fmt ({i) ber: ber_dump: buf=0x7fc7f8000925 ptr=0x7fc7f8000925 end=0x7fc7f8000963 len=62 0000: 30 3c 0a 01 03 04 34 72 69 64 3d 31 30 30 2c 63 0<....4rid=100,c 0010: 73 6e 3d 32 30 31 33 30 33 32 32 31 34 35 39 30 sn=2013032214590 0020: 33 2e 38 31 36 30 39 36 5a 23 30 30 30 30 30 30 3.816096Z#000000 0030: 23 30 30 30 23 30 30 30 30 30 30 01 01 ff #000#000000... ber_scanf fmt (m) ber: ber_dump: buf=0x7fc7f8000925 ptr=0x7fc7f800092a end=0x7fc7f8000963 len=57 0000: 04 34 72 69 64 3d 31 30 30 2c 63 73 6e 3d 32 30 .4rid=100,csn=20 0010: 31 33 30 33 32 32 31 34 35 39 30 33 2e 38 31 36 130322145903.816 0020: 30 39 36 5a 23 30 30 30 30 30 30 23 30 30 30 23 096Z#000000#000# 0030: 30 30 30 30 30 30 01 01 ff 000000... ber_scanf fmt (b) ber: ber_dump: buf=0x7fc7f8000925 ptr=0x7fc7f8000960 end=0x7fc7f8000963 len=3 0000: 00 01 ff ... ber_scanf fmt (}) ber: ber_dump: buf=0x7fc7f8000925 ptr=0x7fc7f8000963 end=0x7fc7f8000963 len=0 daemon: activity on:ber_scanf fmt ({m) ber: ber_dump: buf=0x7fc7f80008c0 ptr=0x7fc7f8000963 end=0x7fc7f8000981 len=30 0000: 00 1c 04 17 32 2e 31 36 2e 38 34 30 2e 31 2e 31 ....2.16.840.1.1 0010: 31 33 37 33 30 2e 33 2e 34 2e 32 01 01 ff 13730.3.4.2... ber_scanf fmt (b) ber: ber_dump: buf=0x7fc7f80008c0 ptr=0x7fc7f800097e end=0x7fc7f8000981 len=3 0000: 00 01 ff ... => get_ctrls: oid="2.16.840.1.113730.3.4.2" (critical) <= get_ctrls: n=2 rc=0 err="" attrs: * + conn=1000 op=1 SRCH base="dc=secure-mail,dc=belgacom" scope=0 deref=0 filter="(objectClass=*)" conn=1000 op=1 SRCH attr=* + daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL ==> limits_get: conn=1000 op=1 self="cn=replica,dc=secure-mail,dc=belgacom" this="dc=secure-mail,dc=belgacom" => bdb_search bdb_dn2entry("dc=secure-mail,dc=belgacom") => access_allowed: search access to "dc=secure-mail,dc=belgacom" "entry" requested => acl_get: [2] attr entry => acl_mask: access to entry "dc=secure-mail,dc=belgacom", attr "entry" requested => acl_mask: to all values by "cn=replica,dc=secure-mail,dc=belgacom", (=0) <= check a_dn_pat: cn=admin,dc=secure-mail,dc=belgacom <= check a_dn_pat: cn=replica,dc=secure-mail,dc=belgacom <= acl_mask: [2] applying write(=wrscxd) (stop) <= acl_mask: [2] mask: write(=wrscxd) => slap_access_allowed: search access granted by write(=wrscxd) => access_allowed: search access granted by write(=wrscxd) base_candidates: base: "dc=secure-mail,dc=belgacom" (0x00000001) => test_filter PRESENT => access_allowed: search access to "dc=secure-mail,dc=belgacom" "objectClass" requested => acl_get: [2] attr objectClass => acl_mask: access to entry "dc=secure-mail,dc=belgacom", attr "objectClass" requested => acl_mask: to all values by "cn=replica,dc=secure-mail,dc=belgacom", (=0) <= check a_dn_pat: cn=admin,dc=secure-mail,dc=belgacom <= check a_dn_pat: cn=replica,dc=secure-mail,dc=belgacom <= acl_mask: [2] applying write(=wrscxd) (stop) <= acl_mask: [2] mask: write(=wrscxd) => slap_access_allowed: search access granted by write(=wrscxd) => access_allowed: search access granted by write(=wrscxd) <= test_filter 6 send_ldap_result: conn=1000 op=1 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_result: conn=1000 op=1 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_intermediate: err=0 oid=1.3.6.1.4.1.4203.1.9.1.4 len=2 send_ldap_response: msgid=2 tag=121 err=0 ber_flush2: 37 bytes to sd 12 0000: 30 23 02 01 02 79 1e 80 18 31 2e 33 2e 36 2e 31 0#...y...1.3.6.1 0010: 2e 34 2e 31 2e 34 32 30 33 2e 31 2e 39 2e 31 2e .4.1.4203.1.9.1. 0020: 34 81 02 a1 00 4.... ldap_write: want=37, written=37 0000: 30 23 02 01 02 79 1e 80 18 31 2e 33 2e 36 2e 31 0#...y...1.3.6.1 0010: 2e 34 2e 31 2e 34 32 30 33 2e 31 2e 39 2e 31 2e .4.1.4203.1.9.1. 0020: 34 81 02 a1 00 4.... conn=1000 op=1 INTERM oid=1.3.6.1.4.1.4203.1.9.1.4 Here is the consumer config. [id828684@hmslogbnc4 slapd.d]$ more cn\=config.ldif dn: cn=config objectClass: olcGlobal cn: config olcConfigFile: /etc/schema/schema_convert.conf olcConfigDir: /etc/openldap/slap.d olcArgsFile: /var/run/openldap/slapd.args olcAttributeOptions: lang- olcAuthzPolicy: none olcConcurrency: 0 olcConnMaxPending: 100 olcConnMaxPendingAuth: 1000 olcGentleHUP: FALSE olcIdleTimeout: 0 olcIndexSubstrIfMaxLen: 4 olcIndexSubstrIfMinLen: 2 olcIndexSubstrAnyLen: 4 olcIndexSubstrAnyStep: 2 olcIndexIntLen: 4 olcLocalSSF: 71 olcPidFile: /var/run/openldap/slapd.pid olcReadOnly: FALSE olcReverseLookup: FALSE olcSaslSecProps: noplain,noanonymous olcSizeLimit: unlimited olcSockbufMaxIncoming: 262143 olcSockbufMaxIncomingAuth: 16777215 olcThreads: 16 olcTLSVerifyClient: never olcToolThreads: 1 olcWriteTimeout: 0 [id828684@hmslogbnc4 cn=config]$ more olcDatabase\=\{2\}bdb.ldif dn: olcDatabase={2}bdb objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {2}bdb olcSuffix: dc=secure-mail,dc=belgacom olcAccess: {0}to * by dn.base="cn=admin,dc=secure-mail,dc=belgacom" write by dn.base="cn=replica,dc=secure-mail,dc=belgacom" read by users read by anonymous read olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=admin,dc=secure-mail,dc=belgacom olcRootPW:: dGVzdA== olcSyncUseSubentry: FALSE olcSyncrepl: rid=100 provider=ldap://hmslogbnc3.bc:389 bindmethod=simple timeout=0 network-timeout=0 binddn="cn=replica,dc=secure-mail,dc=belgacom" credentials="r3plica" keepalive=0:0:0 searchbase= "dc=secure-mail,dc=belgacom" scope=base attrs="*,+" schemachecking=on type=refreshAndPersist interval=00:00:01:00 retry="5 5 300 +" syncdata=default olcMirrorMode: FALSE olcMonitoring: TRUE olcDbDirectory: /home/hmslog/data/ldap olcDbCacheSize: 20000 olcDbNoSync: FALSE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 20000 olcDbIndex: objectClass eq olcDbIndex: finalDestination eq,sub olcDbIndex: dc eq,approx,sub olcDbIndex: srcIP eq,approx,sub olcDbIndex: customerId eq olcDbIndex: policy eq olcDbIndex: entryCSN,entryUUID eq olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 Any help will be appreciated. Thanks Regards KM HASHIM,

2 1

Help me for " LDAP Sync Replication with Active Directory from Openldap side"
by Suman Karki 25 Mar '13

25 Mar '13

I am running open ldap server in redhat server, and active directory in win server 2008. I have admin access to both servers. The thing is that i have to sync both server, like from openldap i could access active directory data. Can it be possible? If possible then then please give me some information that i could proceed this task. I have tried some thing like using openldap admin guide syncrepl rid=001 provider=ldap://IP of AD server/ binddn="cn=replicator,dc=suretecsystems,dc=com" bindmethod=simple credentials=Password of AD server searchbase="dc=suretecsystems,dc=com" type=refreshAndPersist retry="5 5 300 5" I don't how much i am right. Or is there any different way? Please help me to solve this.

6 10

Re: Help me for " LDAP Sync with Active Directory from Openldap side"
by Mark Pröhl 25 Mar '13

25 Mar '13

please discuss this on the list. I do not fully understand why you need synchronization. If it is because your LDAP client (i.e. liferay) only supports one LDAP-URI but you have two different user directories (AD and OpenLDAP), than there would be no need for synchronization: OpenLDAP could be used to integrate both directories under one URL (e.g. by meta backend) On 25.03.2013 10:02, Suman Karki wrote: > thank you for your reply. And i need some help that can perform my task. > > I am using liferey for web hosting. Which is http://www.liferay.com/ > > I am managing liferay's user accounts with open ldap server. > > And i need to sync AD to Open Ldap . > > So through one Open Ldap server configuration i can access both > servers user account. > > I have admin access to both server. > > Just, I need to sync AD to Open Ldap server for user account accessing. > > > > > > On 3/25/13, Mark Pröhl <mark(a)mproehl.net> wrote: >> on 25.03.2013 06:57, Suman Karki wrote: >>> I am running open ldap server in redhat server, and active directory >>> in win server 2008. >>> I have admin access to both servers. >>> >>> The thing is that i have to sync both server, like from openldap i >>> could access active directory data. >>> >>> >>> So anybody tell me how can we synchronize both server, any solutions ? >>> or it will be better if anyone provide me some tutorials or better >>> give me some documentation? >>> >>> please i need to solve this problem as soon as possible. >>> >> can you describe your requirements a little bit more? I.e. >> >> - which attributes do you need to be synchronized? >> - do you need to synchronize from AD to OpenLDAP >> or from OpenLDAP to AD or in both directions? >> - do you need passwords to be synchronized? >> >> BTW: OpenLDAP can be configured as a (caching) LDAP >> proxy to Active Directory. Configuring that is much >> more simple than synchronization with AD. >> >> For synchronization you will need some kind of >> 3rd-party product, like the SPML based solution >> mentioned here: >> http://www.openldap.org/lists/openldap-technical/201303/msg00167.html >> >> -- >> Mark Pröhl >> mark(a)mproehl.net >> www.kerberos-buch.de >> >>

1 0

Help me for " LDAP Sync with Active Directory from Openldap side"
by Suman Karki 25 Mar '13

25 Mar '13

I am running open ldap server in redhat server, and active directory in win server 2008. I have admin access to both servers. The thing is that i have to sync both server, like from openldap i could access active directory data. So anybody tell me how can we synchronize both server, any solutions ? or it will be better if anyone provide me some tutorials or better give me some documentation? please i need to solve this problem as soon as possible.

2 1

Re: openldap-technical Digest, Vol 64, Issue 24
by Suman Karki 24 Mar '13

24 Mar '13

Help me for " LDAP Sync Replication with Active Directory from Openldap side" If any person is willing to help me and require more detail about this problem i will reply that.

1 0

trouble with slapo-pcache
by btb＠bitrate.net 24 Mar '13

24 Mar '13

hi- i'm having a few different issues with slapo-pcache. i did a bit of searching in the its and did not find any items which seemed to match my symptoms. i'm using 2.4.31, on ubuntu 12.10. the first is that i so to not be able to add, via ldapadd, additional olcPcacheTemplate attributes to the config entry. i was able to add the first one using ldapadd, but subsequent modify operations to add another complain "no equality matching rule": >ldapsearch -LLLZZxWH 'ldap://localhost/' -D 'cn=config' -b 'olcOverlay={0}pcache,olcDatabase={2}ldap,cn=config' -s base Enter LDAP Password: dn: olcOverlay={0}pcache,olcDatabase={2}ldap,cn=config objectClass: olcPcacheConfig objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top olcOverlay: {0}pcache olcPcache: mdb 1000 100 1000 60 olcPcacheAttrset: 0 "*" "+" olcPcacheTemplate: "(uid=)" 0 3600 >cat template.ldif dn: olcOverlay={0}pcache,olcDatabase={2}ldap,cn=config changetype: modify add: olcPcacheTemplate olcPcacheTemplate: "(cn=)" 0 3600 >ldapadd -ZZxWH 'ldap://localhost/' -D 'cn=config' -f template.ldif Enter LDAP Password: modifying entry "olcOverlay={0}pcache,olcDatabase={2}ldap,cn=config" ldap_modify: Inappropriate matching (18) additional info: modify/add: olcPcacheTemplate: no equality matching rule Oct 29 20:01:30 dsa1 slapd[8250]: conn=1003 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Oct 29 20:01:30 dsa1 slapd[8250]: conn=1003 op=0 STARTTLS Oct 29 20:01:30 dsa1 slapd[8250]: conn=1003 op=0 RESULT oid= err=0 text= Oct 29 20:01:30 dsa1 slapd[8250]: conn=1003 fd=12 ACCEPT from IP=127.0.0.1:32916 (IP=0.0.0.0:389) Oct 29 20:01:30 dsa1 slapd[8250]: conn=1003 fd=12 TLS established tls_ssf=128 ssf=128 Oct 29 20:01:32 dsa1 slapd[8250]: conn=1003 op=1 BIND dn="cn=config" method=128 Oct 29 20:01:32 dsa1 slapd[8250]: conn=1003 op=1 BIND dn="cn=config" mech=SIMPLE ssf=0 Oct 29 20:01:32 dsa1 slapd[8250]: conn=1003 op=1 RESULT tag=97 err=0 text= Oct 29 20:01:32 dsa1 slapd[8250]: connection_input: conn=1003 deferring operation: binding Oct 29 20:01:32 dsa1 slapd[8250]: conn=1003 op=2 MOD dn="olcOverlay={0}pcache,olcDatabase={2}ldap,cn=config" Oct 29 20:01:32 dsa1 slapd[8250]: conn=1003 op=2 MOD attr=olcPcacheTemplate Oct 29 20:01:32 dsa1 slapd[8250]: conn=1003 op=2 RESULT tag=103 err=18 text=modify/add: olcPcacheTemplate: no equality matching rule Oct 29 20:01:32 dsa1 slapd[8250]: conn=1003 op=3 UNBIND Oct 29 20:01:32 dsa1 slapd[8250]: conn=1003 fd=12 closed adding the attribute "manually" [e.g. slapcat, modify ldif, slapadd] seems to be fine: >ldapsearch -LLLZZxWH 'ldap://localhost/' -D 'cn=config' -b 'olcOverlay={0}pcache,olcDatabase={2}ldap,cn=config' -s base Enter LDAP Password: dn: olcOverlay={0}pcache,olcDatabase={2}ldap,cn=config objectClass: olcPcacheConfig objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top olcOverlay: {0}pcache olcPcache: mdb 1000 100 1000 60 olcPcacheAttrset: 0 "*" "+" olcPcacheTemplate: "(objectclass=)" 0 3600 olcPcacheTemplate: "(uid=)" 0 3600 my second problem is with caching when slapo-nssov is involved. it appears to not cache [QUERY NOT ANSWERABLE/QUERY NOT CACHEABLE] when a query occurs via nss: >getent passwd flash flash:x:2013:2013:flash gordon:/home/flash:/bin/bash Oct 31 08:42:15 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:42:15 deepfield slapd[12862]: daemon: activity on: Oct 31 08:42:15 deepfield slapd[12862]: 11r Oct 31 08:42:15 deepfield slapd[12862]: Oct 31 08:42:15 deepfield slapd[12862]: daemon: read active on 11 Oct 31 08:42:15 deepfield slapd[12862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 31 08:42:15 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:42:15 deepfield slapd[12862]: connection_get(11) Oct 31 08:42:15 deepfield slapd[12862]: connection_get(11): got connid=0 Oct 31 08:42:15 deepfield slapd[12862]: nssov: connection from uid=0 gid=0 Oct 31 08:42:15 deepfield slapd[12862]: nssov_passwd_byname(flash) Oct 31 08:42:15 deepfield slapd[12862]: str2filter "(&(objectClass=posixAccount)(uid=flash))" Oct 31 08:42:15 deepfield slapd[12862]: begin get_filter Oct 31 08:42:15 deepfield slapd[12862]: AND Oct 31 08:42:15 deepfield slapd[12862]: begin get_filter_list Oct 31 08:42:15 deepfield slapd[12862]: begin get_filter Oct 31 08:42:15 deepfield slapd[12862]: EQUALITY Oct 31 08:42:15 deepfield slapd[12862]: end get_filter 0 Oct 31 08:42:15 deepfield slapd[12862]: begin get_filter Oct 31 08:42:15 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:42:15 deepfield slapd[12862]: EQUALITY Oct 31 08:42:15 deepfield slapd[12862]: daemon: activity on: Oct 31 08:42:15 deepfield slapd[12862]: end get_filter 0 Oct 31 08:42:15 deepfield slapd[12862]: Oct 31 08:42:15 deepfield slapd[12862]: end get_filter_list Oct 31 08:42:15 deepfield slapd[12862]: end get_filter 0 Oct 31 08:42:15 deepfield slapd[12862]: query template of incoming query = (&(objectClass=)(uid=)) Oct 31 08:42:15 deepfield slapd[12862]: QUERY NOT ANSWERABLE Oct 31 08:42:15 deepfield slapd[12862]: QUERY NOT CACHEABLE Oct 31 08:42:15 deepfield slapd[12862]: =>ldap_back_getconn: conn 0xb51f8ee8 fetched refcnt=1. Oct 31 08:42:15 deepfield slapd[12862]: => ldap_back_munge_filter "(&(objectClass=posixAccount)(uid=flash))" Oct 31 08:42:15 deepfield slapd[12862]: <= ldap_back_munge_filter "(&(objectClass=posixAccount)(uid=flash))" (0) Oct 31 08:42:15 deepfield slapd[12862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 31 08:42:15 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:42:15 deepfield slapd[12862]: >>> dnPrettyNormal: <uid=flash,ou=people,ou=accounts,dc=example,dc=net> Oct 31 08:42:15 deepfield slapd[12862]: <<< dnPrettyNormal: <uid=flash,ou=people,ou=accounts,dc=example,dc=net>, <uid=flash,ou=people,ou=accounts,dc=example,dc=net> Oct 31 08:42:15 deepfield slapd[12862]: send_ldap_result: conn=-1 op=0 p=0 Oct 31 08:42:15 deepfield slapd[12862]: send_ldap_result: err=0 matched="" text="" although i believe i have a matching query template defined in the config: dn: olcDatabase={2}ldap,cn=config objectClass: olcLDAPConfig objectClass: olcDatabaseConfig objectClass: olcConfig objectClass: top olcDatabase: {2}ldap olcSuffix: dc=example,dc=net olcLastMod: TRUE olcReadOnly: TRUE olcRootDN: uid=dit_admin,ou=role_accounts,ou=accounts,dc=example,dc=net olcMonitoring: TRUE olcDbURI: ldap://dsa1.example.net/ olcDbStartTLS: start tls_cacert="/etc/pki/trusted_roots/example_networks_roo t_ca-cert.pem" tls_reqcert="demand" olcDbACLBind: bindmethod=simple binddn="cn=slapd,ou=deepfield,ou=services,ou=a ccounts,dc=example,dc=net" credentials="xxxxxxxxxxxxxxx" s tarttls="critical" tls_cacert="/etc/pki/trusted_roots/example_networks_root _ca-cert.pem" tls_reqcert="demand" olcDbIDAssertBind: bindmethod=simple binddn="cn=slapd,ou=deepfield,ou=services ,ou=accounts,dc=example,dc=net" credentials="xxxxxxxxxxxxxxx" structuralObjectClass: olcLDAPConfig entryUUID: f24e435a-b35a-1031-8f37-336141b7bc90 creatorsName: cn=config createTimestamp: 20121026014812Z entryCSN: 20121031023501.089672Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20121031023501Z dn: olcOverlay={0}pcache,olcDatabase={2}ldap,cn=config objectClass: olcPcacheConfig objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top olcOverlay: {0}pcache olcPcache: mdb 1000 100 1000 60 olcPcacheAttrset: 0 "*" "+" olcPcacheTemplate: "(objectClass=)" 0 3600 olcPcacheTemplate: "(uid=)" 0 3600 olcPcacheTemplate: "(&(objectClass=)(uid=))" 0 3600 olcPcacheBind: "(uid=)" 0 60 "sub" "dc=example,dc=net" structuralObjectClass: olcPcacheConfig entryUUID: ddb05d7e-b4fa-1031-811e-353e11fff366 creatorsName: cn=config createTimestamp: 20121028032528Z entryCSN: 20121030002115.179177Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20121030002115Z dn: olcDatabase={0}mdb,olcOverlay={0}pcache,olcDatabase={2}ldap,cn=config objectClass: olcPcacheDatabase objectClass: olcMdbConfig objectClass: olcDatabaseConfig objectClass: olcConfig objectClass: top olcDatabase: {0}mdb olcDbDirectory: /var/lib/ldap/example.net/ olcLastMod: TRUE olcMaxDerefDepth: 15 olcDbNoSync: FALSE olcDbIndex: certfingerprint eq olcDbIndex: cn eq olcDbIndex: default eq olcDbIndex: description eq olcDbIndex: entrycsn eq olcDbIndex: entryuuid eq olcDbIndex: gidnumber pres,eq olcDbIndex: host eq olcDbIndex: iphostnumber eq olcDbIndex: ipserviceport eq olcDbIndex: ipserviceprotocol eq olcDbIndex: mail eq olcDbIndex: maillocaladdress eq olcDbIndex: member eq olcDbIndex: memberof eq olcDbIndex: memberuid eq olcDbIndex: objectclass eq olcDbIndex: rfc822mailmember eq olcDbIndex: sudoUser eq olcDbIndex: uid pres,eq,sub olcDbIndex: uidnumber pres,eq olcDbMode: 0600 olcDbSearchStack: 16 structuralObjectClass: olcMdbConfig entryUUID: 88b37716-b590-1031-8c75-439de7087923 creatorsName: cn=config createTimestamp: 20121028211650Z entryCSN: 20121029021315.039143Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20121029021315Z dn: olcOverlay={1}nssov,olcDatabase={2}ldap,cn=config objectClass: olcNssOvConfig objectClass: olcOverlayConfig objectClass: olcConfig olcOverlay: {1}nssov olcNssMap: group uniquemember member olcNssPam: authz2dn hostservice olcNssPamSession: sshd olcNssPamSession: login structuralObjectClass: olcNssOvConfig entryUUID: 47ecaef0-b73e-1031-8761-9f0bff5d3212 creatorsName: cn=config createTimestamp: 20121031003305Z entryCSN: 20121031003305.637051Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20121031003305Z and if i perform the same query using ldapsearch: >ldapsearch -LLLZZxH 'ldap://localhost/' -D 'uid=flash,ou=people,ou=accounts,dc=example,dc=net' -w 'test' '(&(objectClass=posixAccount)(uid=flash))' dn: uid=flash,ou=people,ou=accounts,dc=example,dc=net initials: fg givenName: flash loginShell: /bin/bash uidNumber: 2013 gidNumber: 2013 uid: flash objectClass: posixAccount objectClass: top objectClass: shadowAccount objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person objectClass: extensibleObject c: us homeDirectory: /home/flash sn: gordon cn: flash gordon displayName: flash_gordon mail: user(a)example.com it does seem to cache it: Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on: Oct 31 08:55:37 deepfield slapd[12862]: Oct 31 08:55:37 deepfield slapd[12862]: slap_listener_activate(8): Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=8 busy Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: >>> slap_listener(ldap:///) Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on: Oct 31 08:55:37 deepfield slapd[12862]: Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: listen=8, new connection on 18 Oct 31 08:55:37 deepfield slapd[12862]: daemon: added 18r (active) listener=(nil) Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:55:37 deepfield slapd[12862]: conn=1003 fd=18 ACCEPT from IP=127.0.0.1:37220 (IP=0.0.0.0:389) Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on: Oct 31 08:55:37 deepfield slapd[12862]: 18r Oct 31 08:55:37 deepfield slapd[12862]: Oct 31 08:55:37 deepfield slapd[12862]: daemon: read active on 18 Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: connection_get(18) Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:55:37 deepfield slapd[12862]: connection_get(18): got connid=1003 Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on: Oct 31 08:55:37 deepfield slapd[12862]: connection_read(18): checking for input on id=1003 Oct 31 08:55:37 deepfield slapd[12862]: Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: op tag 0x77, time 1351688137 Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on: Oct 31 08:55:37 deepfield slapd[12862]: Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: conn=1003 op=0 do_extended Oct 31 08:55:37 deepfield slapd[12862]: conn=1003 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Oct 31 08:55:37 deepfield slapd[12862]: do_extended: oid=1.3.6.1.4.1.1466.20037 Oct 31 08:55:37 deepfield slapd[12862]: conn=1003 op=0 STARTTLS Oct 31 08:55:37 deepfield slapd[12862]: send_ldap_extended: err=0 oid= len=0 Oct 31 08:55:37 deepfield slapd[12862]: send_ldap_response: msgid=1 tag=120 err=0 Oct 31 08:55:37 deepfield slapd[12862]: conn=1003 op=0 RESULT oid= err=0 text= Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on: Oct 31 08:55:37 deepfield slapd[12862]: 18r Oct 31 08:55:37 deepfield slapd[12862]: Oct 31 08:55:37 deepfield slapd[12862]: daemon: read active on 18 Oct 31 08:55:37 deepfield slapd[12862]: connection_get(18) Oct 31 08:55:37 deepfield slapd[12862]: connection_get(18): got connid=1003 Oct 31 08:55:37 deepfield slapd[12862]: connection_read(18): checking for input on id=1003 Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on: Oct 31 08:55:37 deepfield slapd[12862]: Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on: Oct 31 08:55:37 deepfield slapd[12862]: 18r Oct 31 08:55:37 deepfield slapd[12862]: Oct 31 08:55:37 deepfield slapd[12862]: daemon: read active on 18 Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: connection_get(18) Oct 31 08:55:37 deepfield slapd[12862]: connection_get(18): got connid=1003 Oct 31 08:55:37 deepfield slapd[12862]: connection_read(18): checking for input on id=1003 Oct 31 08:55:37 deepfield slapd[12862]: connection_read(18): unable to get TLS client DN, error=49 id=1003 Oct 31 08:55:37 deepfield slapd[12862]: conn=1003 fd=18 TLS established tls_ssf=128 ssf=128 Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on: Oct 31 08:55:37 deepfield slapd[12862]: Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on: Oct 31 08:55:37 deepfield slapd[12862]: 18r Oct 31 08:55:37 deepfield slapd[12862]: Oct 31 08:55:37 deepfield slapd[12862]: daemon: read active on 18 Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: connection_get(18) Oct 31 08:55:37 deepfield slapd[12862]: connection_get(18): got connid=1003 Oct 31 08:55:37 deepfield slapd[12862]: connection_read(18): checking for input on id=1003 Oct 31 08:55:37 deepfield slapd[12862]: op tag 0x60, time 1351688137 Oct 31 08:55:37 deepfield slapd[12862]: conn=1003 op=1 do_bind Oct 31 08:55:37 deepfield slapd[12862]: >>> dnPrettyNormal: <uid=flash,ou=people,ou=accounts,dc=example,dc=net> Oct 31 08:55:37 deepfield slapd[12862]: <<< dnPrettyNormal: <uid=flash,ou=people,ou=accounts,dc=example,dc=net>, <uid=flash,ou=people,ou=accounts,dc=example,dc=net> Oct 31 08:55:37 deepfield slapd[12862]: conn=1003 op=1 BIND dn="uid=flash,ou=people,ou=accounts,dc=example,dc=net" method=128 Oct 31 08:55:37 deepfield slapd[12862]: do_bind: version=3 dn="uid=flash,ou=people,ou=accounts,dc=example,dc=net" method=128 Oct 31 08:55:37 deepfield slapd[12862]: => mdb_entry_get: ndn: "uid=flash,ou=people,ou=accounts,dc=example,dc=net" Oct 31 08:55:37 deepfield slapd[12862]: => mdb_entry_get: oc: "(null)", at: "(null)" Oct 31 08:55:37 deepfield slapd[12862]: mdb_dn2entry("uid=flash,ou=people,ou=accounts,dc=example,dc=net") Oct 31 08:55:37 deepfield slapd[12862]: => mdb_dn2id("uid=flash,ou=people,ou=accounts,dc=example,dc=net") Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on: Oct 31 08:55:37 deepfield slapd[12862]: Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: <= mdb_dn2id: got id=0x4 Oct 31 08:55:37 deepfield slapd[12862]: => mdb_entry_decode: Oct 31 08:55:37 deepfield slapd[12862]: <= mdb_entry_decode Oct 31 08:55:37 deepfield slapd[12862]: => mdb_entry_get: found entry: "uid=flash,ou=people,ou=accounts,dc=example,dc=net" Oct 31 08:55:37 deepfield slapd[12862]: mdb_entry_get: rc=0 Oct 31 08:55:37 deepfield slapd[12862]: str2filter "(uid=flash)" Oct 31 08:55:37 deepfield slapd[12862]: begin get_filter Oct 31 08:55:37 deepfield slapd[12862]: EQUALITY Oct 31 08:55:37 deepfield slapd[12862]: end get_filter 0 Oct 31 08:55:37 deepfield slapd[12862]: Lock QC index = 0xb867e250 Oct 31 08:55:37 deepfield slapd[12862]: Base of added query = dc=example,dc=net Oct 31 08:55:37 deepfield slapd[12862]: QUERY ANSWERABLE (answered 5 times) Oct 31 08:55:37 deepfield slapd[12862]: => mdb_search Oct 31 08:55:37 deepfield slapd[12862]: mdb_dn2entry("uid=flash,ou=people,ou=accounts,dc=example,dc=net") Oct 31 08:55:37 deepfield slapd[12862]: => mdb_dn2id("uid=flash,ou=people,ou=accounts,dc=example,dc=net") Oct 31 08:55:37 deepfield slapd[12862]: <= mdb_dn2id: got id=0x4 Oct 31 08:55:37 deepfield slapd[12862]: => mdb_entry_decode: Oct 31 08:55:37 deepfield slapd[12862]: <= mdb_entry_decode Oct 31 08:55:37 deepfield slapd[12862]: => access_allowed: search access to "uid=flash,ou=people,ou=accounts,dc=example,dc=net" "entry" requested Oct 31 08:55:37 deepfield slapd[12862]: <= root access granted Oct 31 08:55:37 deepfield slapd[12862]: => access_allowed: search access granted by manage(=mwrscxd) Oct 31 08:55:37 deepfield slapd[12862]: base_candidates: base: "uid=flash,ou=people,ou=accounts,dc=example,dc=net" (0x00000004) Oct 31 08:55:37 deepfield slapd[12862]: => test_filter Oct 31 08:55:37 deepfield slapd[12862]: EQUALITY Oct 31 08:55:37 deepfield slapd[12862]: => access_allowed: search access to "uid=flash,ou=people,ou=accounts,dc=example,dc=net" "uid" requested Oct 31 08:55:37 deepfield slapd[12862]: <= root access granted Oct 31 08:55:37 deepfield slapd[12862]: => access_allowed: search access granted by manage(=mwrscxd) Oct 31 08:55:37 deepfield slapd[12862]: <= test_filter 6 Oct 31 08:55:37 deepfield slapd[12862]: pc_bind_search: cache is stale, reftime: 1351688135, current time: 1351688137 Oct 31 08:55:37 deepfield slapd[12862]: send_ldap_result: conn=1003 op=1 p=3 Oct 31 08:55:37 deepfield slapd[12862]: send_ldap_result: err=0 matched="" text="" Oct 31 08:55:37 deepfield slapd[12862]: =>ldap_back_getconn: conn=1003 op=1: lc=0xb38f9788 inserted refcnt=1 rc=0 Oct 31 08:55:37 deepfield slapd[12862]: conn=1003 op=1 BIND dn="uid=flash,ou=people,ou=accounts,dc=example,dc=net" mech=SIMPLE ssf=0 Oct 31 08:55:37 deepfield slapd[12862]: do_bind: v3 bind: "uid=flash,ou=people,ou=accounts,dc=example,dc=net" to "uid=flash,ou=people,ou=accounts,dc=example,dc=net" Oct 31 08:55:37 deepfield slapd[12862]: send_ldap_result: conn=1003 op=1 p=3 Oct 31 08:55:37 deepfield slapd[12862]: send_ldap_result: err=0 matched="" text="" Oct 31 08:55:37 deepfield slapd[12862]: pc_setpw: CACHING BIND for uid=flash,ou=people,ou=accounts,dc=example,dc=net Oct 31 08:55:37 deepfield slapd[12862]: mdb_modify: uid=flash,ou=people,ou=accounts,dc=example,dc=net Oct 31 08:55:37 deepfield slapd[12862]: mdb_dn2entry("uid=flash,ou=people,ou=accounts,dc=example,dc=net") Oct 31 08:55:37 deepfield slapd[12862]: => mdb_dn2id("uid=flash,ou=people,ou=accounts,dc=example,dc=net") Oct 31 08:55:37 deepfield slapd[12862]: <= mdb_dn2id: got id=0x4 Oct 31 08:55:37 deepfield slapd[12862]: => mdb_entry_decode: Oct 31 08:55:37 deepfield slapd[12862]: <= mdb_entry_decode Oct 31 08:55:37 deepfield slapd[12862]: mdb_modify_internal: 0x00000004: uid=flash,ou=people,ou=accounts,dc=example,dc=net Oct 31 08:55:37 deepfield slapd[12862]: <= acl_access_allowed: granted to database root Oct 31 08:55:37 deepfield slapd[12862]: mdb_modify_internal: replace userPassword Oct 31 08:55:37 deepfield slapd[12862]: => mdb_entry_encode(0x00000004): uid=flash,ou=people,ou=accounts,dc=example,dc=net Oct 31 08:55:37 deepfield slapd[12862]: <= mdb_entry_encode(0x00000004): uid=flash,ou=people,ou=accounts,dc=example,dc=net Oct 31 08:55:37 deepfield slapd[12862]: mdb_modify: updated id=00000004 dn="uid=flash,ou=people,ou=accounts,dc=example,dc=net" Oct 31 08:55:37 deepfield slapd[12862]: send_ldap_result: conn=1003 op=1 p=3 Oct 31 08:55:37 deepfield slapd[12862]: send_ldap_result: err=0 matched="" text="" Oct 31 08:55:37 deepfield slapd[12862]: send_ldap_response: msgid=2 tag=97 err=0 Oct 31 08:55:37 deepfield slapd[12862]: conn=1003 op=1 RESULT tag=97 err=0 text= Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on: Oct 31 08:55:37 deepfield slapd[12862]: 18r Oct 31 08:55:37 deepfield slapd[12862]: Oct 31 08:55:37 deepfield slapd[12862]: daemon: read active on 18 Oct 31 08:55:37 deepfield slapd[12862]: connection_get(18) Oct 31 08:55:37 deepfield slapd[12862]: connection_get(18): got connid=1003 Oct 31 08:55:37 deepfield slapd[12862]: connection_read(18): checking for input on id=1003 Oct 31 08:55:37 deepfield slapd[12862]: op tag 0x63, time 1351688137 Oct 31 08:55:37 deepfield slapd[12862]: conn=1003 op=2 do_search Oct 31 08:55:37 deepfield slapd[12862]: >>> dnPrettyNormal: <dc=example,dc=net> Oct 31 08:55:37 deepfield slapd[12862]: <<< dnPrettyNormal: <dc=example,dc=net>, <dc=example,dc=net> Oct 31 08:55:37 deepfield slapd[12862]: SRCH "dc=example,dc=net" 2 0 Oct 31 08:55:37 deepfield slapd[12862]: 0 60 0 Oct 31 08:55:37 deepfield slapd[12862]: begin get_filter Oct 31 08:55:37 deepfield slapd[12862]: AND Oct 31 08:55:37 deepfield slapd[12862]: begin get_filter_list Oct 31 08:55:37 deepfield slapd[12862]: begin get_filter Oct 31 08:55:37 deepfield slapd[12862]: EQUALITY Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on 1 descriptor Oct 31 08:55:37 deepfield slapd[12862]: daemon: activity on: Oct 31 08:55:37 deepfield slapd[12862]: Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Oct 31 08:55:37 deepfield slapd[12862]: end get_filter 0 Oct 31 08:55:37 deepfield slapd[12862]: begin get_filter Oct 31 08:55:37 deepfield slapd[12862]: EQUALITY Oct 31 08:55:37 deepfield slapd[12862]: end get_filter 0 Oct 31 08:55:37 deepfield slapd[12862]: end get_filter_list Oct 31 08:55:37 deepfield slapd[12862]: end get_filter 0 Oct 31 08:55:37 deepfield slapd[12862]: filter: (&(objectClass=posixAccount)(uid=flash)) Oct 31 08:55:37 deepfield slapd[12862]: attrs: Oct 31 08:55:37 deepfield slapd[12862]: Oct 31 08:55:37 deepfield slapd[12862]: conn=1003 op=2 SRCH base="dc=example,dc=net" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=flash))" Oct 31 08:55:37 deepfield slapd[12862]: ==> limits_get: conn=1003 op=2 self="uid=flash,ou=people,ou=accounts,dc=example,dc=net" this="dc=example,dc=net" Oct 31 08:55:37 deepfield slapd[12862]: query template of incoming query = (&(objectClass=)(uid=)) Oct 31 08:55:37 deepfield slapd[12862]: Entering QC, querystr = (&(objectClass=posixAccount)(uid=flash)) Oct 31 08:55:37 deepfield slapd[12862]: Lock QC index = 0xb867e350 Oct 31 08:55:37 deepfield slapd[12862]: Base of added query = dc=example,dc=net Oct 31 08:55:37 deepfield slapd[12862]: QUERY ANSWERABLE (answered 1 times) Oct 31 08:55:37 deepfield slapd[12862]: => mdb_search Oct 31 08:55:37 deepfield slapd[12862]: mdb_dn2entry("dc=example,dc=net") Oct 31 08:55:37 deepfield slapd[12862]: => mdb_dn2id("dc=example,dc=net") Oct 31 08:55:37 deepfield slapd[12862]: <= mdb_dn2id: got id=0x1 Oct 31 08:55:37 deepfield slapd[12862]: => mdb_entry_decode: what am i doing wrong? -ben

2 2

unable to load back-perl module
by Benin Technologies 24 Mar '13

24 Mar '13

Hi, I'm unable to load the back-perl backend module, I get "lt_dlopenext failed: (back_perl.la) file not found" But back_perl.la is there though, and I can load other modules without problem (back_hdb.la, back_sql.la, ...) Any idea what's going on ? My slapd.conf : # Load dynamic backend modules: modulepath /usr/local/libexec/openldap moduleload back_hdb.la moduleload back_sql.la moduleload back_perl.la If I comment the last line, slapd starts without problem. The error message : root@ldap:~# /usr/local/libexec/slapd -u openldap -g openldap -d 256 514dbea0 @(#) $OpenLDAP: slapd 2.X (Feb 3 2013 19:41:33) $ root@ldap:/tmp/openldap-a98eb28/servers/slapd 514dbea0 lt_dlopenext failed: (back_perl.la) file not found 514dbea0 slapd stopped. 514dbea0 connections_destroy: nothing to destroy. It doesn't find back_perl.la, but the file exists though, with the same right as the other backend modules: root@ldap:/usr/local/libexec/openldap# ls -la -rwxr-xr-x 1 root staff 987 Feb 3 19:43 back_hdb.la -rwxr-xr-x 1 root staff 1026 Feb 3 19:43 back_perl.la -rwxr-xr-x 1 root staff 991 Feb 3 19:43 back_sql.la I'm using OpenLDAP 2.4.33 on Debian 6.0.4 Ben.

2 2

pwdMaxAge And pwdExpireWarning not working
by Swapnil Dubey 24 Mar '13

24 Mar '13

Hi All, I am using OpenLdap 2.4.32 on solaris 10. It seems that pwdMaxAge And pwdExpireWarning are not working. Other policies like pwdInHistory, pwdLockout seems to work fine. I cannot see either expiry message or authentication failure in logs after I wait for configured time/seconds. Can somebody help me out with this? -bash-3.00# ./ldapwhoami -x -D uid=admin,ou=People,dc=example,dc=com -W -e ppolicy Enter LDAP Password: ldap_bind: Success (0) (Password expires in 0 seconds) dn:uid=admin,ou=people,dc=example,dc=com Here is my configuration. -bash-3.00# ./ldapsearch -x -b "dc=example,dc=com" "(objectclass=*)" # extended LDIF # # LDAPv3 # base <dc=example,dc=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # example.com dn: dc=example,dc=com objectClass: dcObject objectClass: domain dc: example # roles, example.com dn: ou=roles,dc=example,dc=com objectClass: organizationalUnit ou: roles # people, example.com dn: ou=people,dc=example,dc=com objectClass: organizationalUnit ou: people # admin, people, example.com dn: uid=admin,ou=people,dc=example,dc=com objectClass: person objectClass: inetOrgPerson cn: admin displayName: Admin givenName: admin mail: admin(a)example.com sn: Admin uid: admin userPassword:: e1NTSEF9NU1WNHpuTHB2N3ZmSkcvaU44VC85QkNJMWVueU5hcDc= # utsacct_provisioner, roles, example.com dn: cn=utsacct_provisioner,ou=roles,dc=example,dc=com objectClass: groupOfUniqueNames cn: utsacct_provisioner uniqueMember: uid=admin,ou=people,dc=example,dc=com # provisioner, roles, example.com dn: cn=provisioner,ou=roles,dc=example,dc=com objectClass: groupOfUniqueNames cn: provisioner uniqueMember: uid=admin,ou=people,dc=example,dc=com # policies, example.com dn: ou=policies,dc=example,dc=com ou: policies objectClass: organizationalUnit objectClass: top # default, policies, example.com dn: cn=default,ou=policies,dc=example,dc=com cn: default objectClass: pwdPolicy objectClass: person objectClass: top pwdAllowUserChange: TRUE pwdAttribute: userPassword pwdCheckQuality: 2 pwdExpireWarning: 600 pwdFailureCountInterval: 30 pwdGraceAuthNLimit: 5 pwdInHistory: 5 pwdLockout: TRUE pwdLockoutDuration: 0 pwdMaxAge: 2000 pwdMaxFailure: 5 pwdMinAge: 0 pwdMinLength: 5 pwdMustChange: FALSE pwdSafeModify: FALSE sn: dummy value # search result search: 2 result: 0 Success # numResponses: 9 # numEntries: 8 Slapd.conf --------------------------------- ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=example,dc=com" rootdn "cn=Manager,dc=example,dc=com" overlay ppolicy ppolicy_default "cn=default,ou=policies,dc=example,dc=com" ppolicy_use_lockout ppolicy_hash_cleartext Regards, Swapnil

1 1

openldap and AD sync
by 杨峰 23 Mar '13

23 Mar '13

I had set up LDAP on linux side, I want to build a AD with Windows2008R2, and AD should sync the user information from LDAP, is there any suggestion on this?

7 8

shadowLastChange can't be read
by Maria McKinley 23 Mar '13

23 Mar '13

Hi there, I can change the shadowLastChange attribute: maria@mimi:~/sysadmin/ldap$ ldapmodify -x -v -r -W -D "cn=admin,dc=example,dc=com" -f pass.expldap_initialize( <DEFAULT> ) Enter LDAP Password: replace shadowLastChange: 15786 modifying entry "uid=chris,ou=people,dc=example,dc=com" modify complete But, I can't see it: annette:~# ldapsearch -x "uid=chris" shadowLastChange # extended LDIF # # LDAPv3 # base <dc=example,dc=com> (default) with scope subtree # filter: uid=chris # requesting: shadowLastChange # # chris, people, example.com dn: uid=chris,ou=people,dc=example,dc=com # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Even though this is my permission: olcAccess: {0}to attrs=shadowLastChange by self write by anonymous auth by dn= "cn=admin,dc=example,dc=com" write by * read olcAccess: {1}to attrs=userPassword by self write by anonymous auth by dn="cn= admin,dc=example,dc=com" write by * none olcAccess: {2}to dn.base="" by * read olcAccess: {3}to * by self write by dn="cn=admin,dc=example,dc=com" write by * read Have I done something wrong with my permissions? Is there something else that could be going on here? thanks, Maria

2 1

Question about OpenLDAP integration with JMS
by Nick 22 Mar '13

22 Mar '13

Dear All, Please tell me, is there any way to integrate OpenLDAP with some JMS service (in particular - Apache ActiveMQ) to make OpenLDAP server post all changes (object creates/upadtes/deletes) to the message bus, and also to receive updates from the message bus? Best regards Nikolay

4 8

pcache overlay help
by brendan kearney 21 Mar '13

21 Mar '13

i am trying to setup the pcache overlay to cache routinely used entries in the DIT. using the below, i am able to load the pcache module: ldapmodify -QY EXTERNAL -H ldapi:/// dn: cn=module,cn=config changetype:add objectClass: olcModuleList cn: module olcModulePath: /usr/lib64/openldap olcModuleLoad: pcache.la then i try to add some caching directives, using the below: ldapmodify -QY EXTERNAL -H ldapi:/// dn: olcOverlay={0}pcache,olcDatabase={2}hdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcPcacheConfig objectClass: olcPcacheDatabase olcOverlay: {0}pcache olcPcache: hdb 100000 50 1000 100 olcPcacheAttrset: 0 nSRecord sOARecord pTRRecord aRecord cNAMERecord sRVRecord tXTRecord olcPcacheTemplate: "(zoneName=)" 0 3600 olcPcacheTemplate: "(&(zoneName=)(relativeDomainName=))" 0 3600 olcPcacheAttrset: 1 krbprincipalname krbcanonicalname objectclass krbprincipalkey krbmaxrenewableage krbmaxticketlife krbticketflags krbprincipalexpiration krbticketpolicyreference krbUpEnabled krbpwdpolicyreference krbpasswordexpiration krbLastFailedAuth krbLoginFailedCount krbLastSuccessfulAuth nsaccountlock krbLastPwdChange krbLastAdminUnlock krbExtraData krbObjectReferences krbAllowedToDelegateTo olcPcacheTemplate: "(&(|(objectClass=)(objectClass=))(krbPrincipalName=))" 1 3600 olcPcacheAttrset: 2 userPassword cn gidNumber uidNumber loginShell objectClass gecos uid homeDirectory olcPcacheTemplate: "(&(objectClass=)(uid=))" 2 3600 olcPcacheAttrset: 3 cn userPassword memberUid gidNumber uniqueMember olcPcacheTemplate: "(&(objectClass=)(cn=))" 3 3600 olcPcacheTemplate: "(&(objectClass=)(memberUid=))" 3 3600 olcPcacheTemplate: "(&(objectClass=)(gidNumber=))" 3 3600 olcPcacheTemplate: "(&(objectClass=)(|(memberUid=)(uniqueMember=)))" 3 3600 i no longer have logs around the failure, but the error message indicated that the olcDbDirectory could not be found. the DN dn: olcDatabase={2}hdb,cn=config has that specified (olcDbDirectory: /var/lib/ldap), but i am missing something about pcache and the backend sharing this directive. can anyone point me in the right direction about how to get the pcache overlay setup correctly?

2 3

Crash with syncrepl refreshAndPersist and database ldap
by Raffael Sahli 20 Mar '13

20 Mar '13

Hi I run a master slapd with 2.4.33 which has a bdb and an ldap database. A slave server 2.4.33 syncs the bdb database with delta syncrepl (type=refreshAndPersist), and has the same ldap database. So my problem is, that the slave crashes very often (That could be multiple times per hour). I have to kill (9) the daemon and restart it. What I found out is, I can solve the problem with either set the type from refreshAndPersist to refreshOnly or remove the ldap database. I have the problem on other servers, which run with 2.4.31, there I disabled the ldap database on the slave. I'm not sure if it was the same, but I had same problems with 2.4.28 and earlier. So what could that be? Maybe a config problem or a bug? Thanks -- Raffael Sahli public(a)raffaelsahli.com

2 1

ldapsearch returning failure to import cert
by John Rouillard 20 Mar '13

20 Mar '13

Hi all: I am running Scientific Linux 6 (a Red Hat enterprise repackage). Until recently these machines were interacting fine with our ldap setup. We use a self signed cert for the ldap servers and deploy the CA cert in /etc/openldap/cacert.pem. However after the last series of updates ldapsearch has been failing in an interesting way and our sssd caching daemons are failing to connect to our ldaps servers. I am hoping that they are both having the same issue. The relevant installed packages are: openldap-2.4.23-26.el6_3.2.x86_64 openssl-1.0.0-27.el6_4.2.x86_64 nss-util-3.14.0.0-2.el6.x86_64 nss-3.14.0.0-12.el6.x86_64 I am using the command (lightly obscured): ldapsearch -d -1 -v -x -b uid=user,ou=people,dc=staff,dc=example,dc=com -D uid=user,ou=people,dc=staff,dc=example,dc=com -W -H ldaps://auth.staff.example.com/ This fails with the error: TLS: error: connect - force handshake failure: errno 21 - moznss error -8054 TLS: can't connect: TLS error -8054:You are attempting to import a cert with the same issuer/serial as an existing cert, but that is not the same cert.. ldap_err2string ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) Where is ldapsearch "importing" a cert? Where is it getting its other certs from? I ran strace on ldapsearch and the only cert file I can see it accessing is /etc/openldap/cacert.pem as specified in /etc/openldap/ldap.conf (not counting the /usr/lib64/libnssckbi.so file). The cert in cacert.pem is identical to the one retrieved by running: openssl s_client -connect auth.staff.example.com:636 </dev/null \ 2>/dev/null | sed -ne '/BEGIN CERTIFICATE/,/END CERTIFICATE/p' Here is where it gets a little more interesting: I have a previous CA cert (that used an md5 message digest). If I install that as the CA, ldapsearch works for 2 of my 3 ldap servers. I have used openssl x509 -in ... -text to compare the certificates for my 3 ldap server and they look identical except where they shouldn't be (subject name, subject name digests...). The issuer, issuer digest ... fields are the same. If I use openssl verify -CAfile /etc/openldap/cacert.pem -purpose sslserver -issuer_checks ldap where ldap is the cert retrieved using s_client it validates for all three servers regardless of whether the CAfile is the older md5 or newer cert. Just to add more into the mix, our CentOS 5 boxes have no issues with any of the servers (IIUC they have an entirely different tls/cert level since they do not use Mozilla nss). Thanks for any insight or questions as the answer didn't come to me while I was writing this email 8-). -- -- rouilj John Rouillard System Administrator Renesys Corporation 603-244-9084 (cell) 603-643-9300 x 111

2 1

Re: Problems with authentication against OpenlDAP
by francesco.policastro＠selex-es.com 19 Mar '13

19 Mar '13

Hi, I made some progress, but I am still unable to do what I need. I said that ldapsearch correctly returns the record related to myself from both servers, but one of them, namely that configured with ACL's, also returns some other lines like this: # refldap://ext.domain.net/CN=Configuration,DC=ext,DC=domain,DC=net I use simple bind and these lines are returned because my servers answer on port 389. Querying the Global Catalog on port 3268 removes those lines (and authentication works fine), but GC does not return an attribute I need, i.e. the employeeID. So when the records synchronize I will get problems. I did not find a way to avoid referrals to appear in the answer. Did anyone face and solve this problem? Thanks, Francesco

1 0

None
by Nick 19 Mar '13

19 Mar '13

Dear All, Please tell me, is there support for DIT structure rules or GoverningStructureRule in current version of OpenLDAP? Best regards Nikolay

2 1

openldap-2.4.32 su-ok, rlogin-fails
by Joe Phan 19 Mar '13

19 Mar '13

Hi, I configured a machine to be LDAP Server (openldap-2.4.32) on Solaris 10. Adding users/groups to LDAP Server seems to be ok. From a second machine, I configured it to be LDAP Client using command "ldapclient manual -v -a defaultsearchbase=dc=pg,dc=dtveng,dc=net -a domainname=pg.dtveng.net 10.26.82.16". It was successful. /var/ldap/ldap_client_file contains appropriate LDAP Server information. Openldap-2.4.32 is not installed on the Client Machine. I updated PAM configuration on Client Machine for su and rlogin, results are listed below: - rlogin into Client Machine using root - OK - rlogin into Client Machine using "jphan" user - Fails - After login to Client Machine as root, su from root to "jphan" user - OK (Note: jphan user does not exist in Client Machine /etc/passwd, jphan user exists in LDAP Server) - From "jphan" user, su to another user - Fails Could someone please take a look at the configuration for rlogin PAM below to see if the configuration is correct. Please let me know if there is anything missing from my setup. Do I need to configure pam.conf on LDAP Server machine as well? Any help is greatly appreciated. Best regards, Joe Phan Downloaded and installed following packages from SunFreeWare.com to LDAP Server: openldap-2.4.32-sol10-sparc-local.gz db-4.7.25.NC-sol10-sparc-local.gz gcc-3.3.2-sol10-sparc-local.gz libgcc-3.3-sol10-sparc-local.gz libtool-2.4.2-sol10-sparc-local.gz openssl-1.0.1c-sol10-sparc-local.gz sasl-2.1.25-sol10-sparc-local.gz Client Machine configuration: - /etc/nsswitch.conf: passwd: files ldap group: files ldap shadow: files ldap - /etc/pam.conf: apggd08dev# more pam.conf # login auth requisite pam_authtok_get.so.1 login auth required pam_dhkeys.so.1 login auth required pam_unix_cred.so.1 #login auth required pam_unix_auth.so.1 login auth sufficient pam_unix_auth.so.1 login auth required pam_dial_auth.so.1 login auth required pam_ldap.so.1 debug # # rlogin service (explicit because of pam_rhost_auth) # rlogin auth sufficient pam_rhosts_auth.so.1 rlogin auth requisite pam_authtok_get.so.1 rlogin auth required pam_dhkeys.so.1 rlogin auth required pam_unix_cred.so.1 #rlogin auth required pam_unix_auth.so.1 rlogin auth sufficient pam_unix_auth.so.1 rlogin auth required pam_ldap.so.1 debug # # Kerberized rlogin service # krlogin auth required pam_unix_cred.so.1 krlogin auth binding pam_krb5.so.1 krlogin auth required pam_unix_auth.so.1 # # rsh service (explicit because of pam_rhost_auth, # and pam_unix_auth for meaningful pam_setcred) # rsh auth sufficient pam_rhosts_auth.so.1 rsh auth required pam_unix_cred.so.1 # # Kerberized rsh service # krsh auth required pam_unix_cred.so.1 krsh auth binding pam_krb5.so.1 krsh auth required pam_unix_auth.so.1 # # Kerberized telnet service # ktelnet auth required pam_unix_cred.so.1 ktelnet auth binding pam_krb5.so.1 ktelnet auth required pam_unix_auth.so.1 # # PPP service (explicit because of pam_dial_auth) # ppp auth requisite pam_authtok_get.so.1 ppp auth required pam_dhkeys.so.1 ppp auth required pam_unix_cred.so.1 #ppp auth required pam_unix_auth.so.1 ppp auth sufficient pam_unix_auth.so.1 ppp auth required pam_dial_auth.so.1 ppp auth required pam_ldap.so.1 debug # # Default definitions for Authentication management # Used when service name is not explicitly mentioned for authentication # other auth requisite pam_authtok_get.so.1 other auth required pam_dhkeys.so.1 other auth required pam_unix_cred.so.1 #other auth required pam_unix_auth.so.1 other auth sufficient pam_unix_auth.so.1 other auth required pam_ldap.so.1 debug # # passwd command (explicit because of a different authentication module) # #passwd auth required pam_passwd_auth.so.1 passwd auth sufficient pam_passwd_auth.so.1 passwd auth required pam_ldap.so.1 debug # # cron service (explicit because of non-usage of pam_roles.so.1) # cron account required pam_unix_account.so.1 # # Default definition for Account management # Used when service name is not explicitly mentioned for account management # other account sufficient pam_ldap.so.1 debug other account requisite pam_roles.so.1 other account required pam_unix_account.so.1 # # Default definition for Session management # Used when service name is not explicitly mentioned for session management # other session required pam_unix_session.so.1 # # Default definition for Password management # Used when service name is not explicitly mentioned for password management # other password required pam_dhkeys.so.1 other password requisite pam_authtok_get.so.1 other password requisite pam_authtok_check.so.1 other password required pam_authtok_store.so.1 jphan user info: apggd04dev# ldapsearch -x -b 'dc=pg,dc=dtveng,dc=net' 'uid=jphan' # extended LDIF # # LDAPv3 # base <dc=pg,dc=dtveng,dc=net> with scope subtree # filter: uid=jphan # requesting: ALL # # jphan, people, pg.dtveng.net dn: uid=jphan,ou=people,dc=pg,dc=dtveng,dc=net objectClass: top objectClass: posixAccount objectClass: shadowAccount objectClass: posixGroup cn: jphan uid: jphan uidNumber: 2003 gidNumber: 203 homeDirectory: /export/home/jphan loginShell: /usr/bin/csh gecos:: Sm9lIFBoYW4gMzEwLTk2NC00MTI1IA== shadowLastChange: 0 shadowMax: 0 shadowWarning: 0 userPassword:: ....= # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1

2 1

ldap, kerberos and authorization by group membership
by brendan kearney 19 Mar '13

19 Mar '13

all, please excuse my ignorance, as i am still learning. i have started working with mit kerberos 5 and openldap. i have the krb5 database in ldap, have several principals created, can can authenticate using kerberos. what i would like to accomplish is authorization based on group membership. i am unclear on how to do this, and if this requires the use of SASL (via the cyrus-sasl packages). am i able to create a groupofnames object, populated with kerberos principals and accomplish authorization by checking for membership of that groupofnames? the scenario is mod_auth_kerb implemented in httpd, or access control via acl in squid. based on group membership, certain functionality or access would be given to authenticated users. i have read and re-read the guide included with openldap, but am still unclear about what is needed. Below is some info about versions, etc... thank you in advance for any guidance. OS: Fedora: 16 x86_64 OpenLDAP: 2.4.26-8 MIT Kerberos: 1.9.4-3 Cyrus SASL: 2.1.23-27 thank you, brendan

2 2

Re: provider/consumer: entries have identical CSN
by Walter Werner 18 Mar '13

18 Mar '13

hi everyone ok, i think i found it :-). It is the sizelimit parameter on the provider. 'The olcSizeLimit/sizelimit attribute/directive specifies the number of entries to return to a search request' Due to the website http://www.zytrax.com/books/ldap/ch6/ It says that 'If no sizelimit directive is defined the default is 500.' No wonder that i had always 500 results with ldapsearch -x, despite the fact, that i deleted some entries. Walter 2013/3/18 Walter Werner <wernwa(a)gmail.com>: > hello everyone > > I still did not solve my problem, but i think the solution could be > really some size limitation (already suggested by Marc) > > LDAP_RES_SEARCH_RESULT (4) Size limit exceeded > > The replication was until Object stud31. So i deleted on provider (on > the test environment i can do that) Objects stud01 until stud06. And > the replication went until stud34. 6 deleted and 3 could replicate. I > guess the other 3 objects where replicated in some other sub trees, i > did not noticed, if the size-limit is a constant. The question is, is > there an easy way to see the difference between the provider and > consumer? > > And the main question is, where can the size limitation (if i am > thinking right) comes from? > > Every help is highly appreciated. > > Walter > > 2013/3/15 Walter Werner <wernwa(a)gmail.com>: >> hi Marc >> >> Thanks a lot for you quick answer. >> >> 2013/3/15 Marc Patermann <hans.moser(a)ofd-z.niedersachsen.de>: >>> Walter, >>> >>> Walter Werner schrieb (15.03.2013 10:58 Uhr): >>> >>> >>>> I get a strange replication problem. After i didn't find a solution >>>> somewhere on internet i decided to post to this mailing-list. Probably >>>> i should describe my system settings. Both consumer and provider are >>>> running on suse 12.1. And i got the errors with openldap version >>>> 2.4.26-3.1.3. Since it is a good >>>> behavior i red somewhere on this email-list, i compiled the latest >>>> openldap v2.4.34 and could unfortunately reproduce the same error. >>> >>> The is a repo, did you know? >>> http://download.opensuse.org/repositories/network:/ldap:/OpenLDAP:/ >>> (it is still 2.4.33, but anyway) >> >> No, i didn't. That can save me a lot of time in the future. >> >>> >>>> Mar 15 09:17:43 ismvm22 slapd[17313]: dn_callback : entries have >>>> identical CSN uid=stud31,ou=Student,ou=People,ou=myou,dc=mybase >>>> 20130315072217.081269Z#000000#000#000000 >>> >>> do the objects differ from provider to consumer? >> >> Especially that stud31 object is exactly the same. I am not sure all >> copied objects are the same, if that was the question. Apparently ldap >> has added the stud objects in alphabetical order. There are all studXX >> until stud31. So after stud31 there should be stud32 stud33 and so on, >> but they are missing on the consumer. It is maybe no accident that in >> the log it ends with stud31 object. >> >> dn_callback : entries have identical CSN uid=stud31... >> >>> >>>> Mar 15 09:17:43 ismvm22 slapd[17313]: do_syncrep2: rid=010 >>>> LDAP_RES_SEARCH_RESULT (4) Size limit exceeded >>>> Mar 15 09:17:43 ismvm22 slapd[17313]: do_syncrep2: rid=010 (4) Size >>>> limit exceeded >>>> Mar 15 09:17:43 ismvm22 slapd[17313]: do_syncrepl: rid=010 rc -2 >>>> retrying (58 retries left) >>> >>> Change that! >> >> Do you mean Size limit exceeded? I already thought about that. Please >> look at the partial configs in the first mail.On the provider time and >> size are set to unlimited for the replicator reader. On the consumer >> it is also set to unlimited. Maybe i forgot some other option. >> >>>> overlay syncprov >>> >>> man slapo-syncprov tells more about options to the syncprov overlay. >> >> There are indeed a lot more. I tried with additional parameter for checkpoint >> >> syncprov-checkpoint 100 10 >> >> No effect. Other options seems to me for speeding up ldap. I do not >> want to complicate things. I don't now if it is useful, before trying >> out something, i also always deleted the database files on the >> consumer to avoid memory effects of some sort. >> >> Still not replicating properly. >> >> Walter

2 1

impact on performance by adding jpeg file
by Jignesh Patel 18 Mar '13

18 Mar '13

We have around 10 million users and trying to add images(only faces), is it wise to do that way? Or should I bring images from database? -jignesh

2 2

Problems with authentication against OpenlDAP
by francesco.policastro＠selex-es.com 18 Mar '13

18 Mar '13

Hi all, I have two OpenLDAP servers (2.4.34) used by some applications to authenticate. Both servers use the meta backend, that is the frontend to two AD domains in separate forests. Ldapsearch correctly finds the users in both servers, while authentication works for one only. I must say that I had to exclude some portions of the trees in order to avoid duplicate names. My "correct" users are in 15 subtrees. In the working server I configured 15 URI's, one for each subtree, specifying for each of them the credentials, the attribute mappings and the suffixmassage. The bad news is that slapd.conf is 580 lines and its maintenance is error prone. That's why I configured the second server with two URI's only and with ACL's to limit the access to the 15 subtrees only. The resulting slapd.conf is much more readable and easy to maintain, but it does not work. The ACL's are all of this type: access to dn.subtree="ou=Users,ou=MySite,dc=FirstSubdomain,dc=Company,dc=com" read by dn.exact="cn=LdapSnooper,ou=people,dc=ExtraDomain,dc=com" read There are no other ACL's, but I already tried adding something like "access to * by * read" with no success. As said before ldapsearch works fine, while authentication does not. Please look at the excerpt from the log files, for both servers, when I try to authenticate. Both servers start the same sequence, but one stops just after reading the same search result. conn=1033 fd=10 ACCEPT from IP=10.31.222.106:38492 (IP=0.0.0.0:389) conn=1033 op=0 BIND dn="cn=LdapSnooper,ou=people,dc=ExtraDomain,dc=com" method=128 conn=1033 op=0 BIND dn="cn=LdapSnooper,ou=people,dc=ExtraDomain,dc=com" mech=SIMPLE ssf=0 conn=1033 op=0 RESULT tag=97 err=0 text= conn=1033 op=1 SRCH base="dc=Company,dc=com" scope=2 deref=0 filter="(sAMAccountName=policastro)" conn=1033 op=1 SRCH attr=sAMAccountName conn=1033 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=1033 op=2 UNBIND conn=1033 fd=10 closed =========================== conn=4960 fd=373 ACCEPT from IP=10.31.221.162:40893 (IP=0.0.0.0:389) conn=4960 op=0 BIND dn="cn=LdapSnooper,ou=people,dc=ExtraDomain,dc=com" method=128 conn=4960 op=0 BIND dn="cn=LdapSnooper,ou=people,dc=ExtraDomain,dc=com" mech=SIMPLE ssf=0 conn=4960 op=0 RESULT tag=97 err=0 text= conn=4960 op=1 SRCH base="dc=Company,dc=com" scope=2 deref=0 filter="(sAMAccountName=policastro)" conn=4960 op=1 SRCH attr=sAMAccountName conn=4960 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=4960 op=2 BIND anonymous mech=implicit ssf=0 conn=4960 op=2 BIND dn="cn=Policastro Francesco,ou=Users,ou=MySite,dc=FirstSubdomain,dc=Company,dc=com" method=128 conn=4960 op=2 BIND dn="cn=Policastro Francesco,ou=Users,ou=MySite,dc=FirstSubdomain,dc=Company,dc=com" mech=SIMPLE ssf=0 conn=4960 op=2 RESULT tag=97 err=0 text= conn=4960 op=3 UNBIND conn=4960 fd=373 closed conn=4961 fd=373 ACCEPT from IP=10.31.221.162:40894 (IP=0.0.0.0:389) conn=4961 op=0 BIND dn="cn=LdapSnooper,ou=people,dc=ExtraDomain,dc=com" method=128 conn=4961 op=0 BIND dn="cn=LdapSnooper,ou=people,dc=ExtraDomain,dc=com" mech=SIMPLE ssf=0 conn=4961 op=0 RESULT tag=97 err=0 text= conn=4961 op=1 SRCH base="dc=Company,dc=com" scope=2 deref=0 filter="(&(!(?employeeID=-*))(employeeID=*)(mail=*)(givenName=*)(sn=*)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(sAMAccountName=policastro))" conn=4961 op=1 SRCH attr=sAMAccountName conn=4961 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=4961 op=2 SRCH base="cn=Policastro Francesco,ou=Users,ou=MySite,dc=FirstSubdomain,dc=Company,dc=com" scope=0 deref=0 filter="(&(!(?employeeID=-*))(employeeID=*)(mail=*)(givenName=*)(sn=*)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))" conn=4961 op=2 SRCH attr=givenName sn mail employeeID sAMAccountName conn=4961 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=4961 op=3 UNBIND conn=4961 fd=373 closed conn=4962 fd=373 ACCEPT from IP=10.31.221.162:40895 (IP=0.0.0.0:389) conn=4962 op=0 BIND dn="cn=LdapSnooper,ou=people,dc=ExtraDomain,dc=com" method=128 conn=4962 op=0 BIND dn="cn=LdapSnooper,ou=people,dc=ExtraDomain,dc=com" mech=SIMPLE ssf=0 conn=4962 op=0 RESULT tag=97 err=0 text= conn=4962 op=1 SRCH base="dc=Company,dc=com" scope=2 deref=0 filter="(sAMAccountName=policastro)" conn=4962 op=1 SRCH attr=sAMAccountName conn=4962 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=4962 op=2 SRCH base="cn=Policastro Francesco,ou=Users,ou=MySite,dc=FirstSubdomain,dc=Company,dc=com" scope=0 deref=0 filter="(objectClass=*)" conn=4962 op=2 SRCH attr=shadowExpire conn=4962 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=4962 op=3 UNBIND Can anyone explain me what happens and how to let the ACL version work? Thanks, Francesco

1 0

LMDB - growing the database
by Shmulik Regev 16 Mar '13

16 Mar '13

Hi, I understand that the DB size has an upper limit set by the call to mdb_env_set_mapsize . I wonder what is the best strategy for growing the size. From what I read, the put operations of either txn or cursor may fail with the MDB_MAP_FULL error but then it is too late to change the DB size. On the other hand I didn't find in mdb_env_stat (or perhaps I didn't understand) any information suggesting how full is the DB so I can't really implement any strategy for preemptively growing the DB based on the used space. Did I miss anything? Cheers, Shmul

3 2

Lua wrapper for LMDB
by Shmulik Regev 16 Mar '13

16 Mar '13

Hi, I've been working on a Lua wrapper for LMDB - https://github.com/shmul/lightningdbm . It is a thin wrapper around the database leveraging upon Lua's elegant integration with C libraries. Feedback is welcomed warmly. Cheers, Shmul

4 4

Multiple uid's?
by R V 15 Mar '13

15 Mar '13

Is there a alias entry that can be used for authentication? Basically I am looking for away to allow a user record to have multiple uid's. Example: uid johnsmith uid jsmith Trying to bring multiple services under one authentication method. The challenging part, some services have varying usernames as list above. Which unfortunately can not be changed. Thanks RV

2 1

Encryption or hash for password?
by Gerhardus Geldenhuis 15 Mar '13

15 Mar '13

Hi I am using the default Ubuntu 12.10 openldap installation and have inherited an existing ldap setup. When I do a slapcat -n 1 It shows userPassword entries as follows: userPassword:: e2NyeFB0fSQxJEkwKGc3bGJjJFpwL3JndlpCZDBlSPZuZGdoMFczTC8= ( password string has been edited... ) I am not sure how this is encoded... is there a way to find out? I have tried md5 which is currently the default encoding for our servers. I have also tried slappasswd with various -h option to see if I can recreate the same hash if it is a hash. I want to add new users using ldif and would like to encrypt/hash their passwords in a similar fashion if possible. Any help would be appreciated. Regards -- Gerhardus Geldenhuis

5 5

provider/consumer: entries have identical CSN
by Walter Werner 15 Mar '13

15 Mar '13

hi to everyone I get a strange replication problem. After i didn't find a solution somewhere on internet i decided to post to this mailing-list. Probably i should describe my system settings. Both consumer and provider are running on suse 12.1. And i got the errors with openldap version 2.4.26-3.1.3. Since it is a good behavior i red somewhere on this email-list, i compiled the latest openldap v2.4.34 and could unfortunately reproduce the same error. The Problem is that the consumer does not replicate all objects. The loglevel on the consumer is loglevel stats sync This is the partial output of the /var/log/messages ... Mar 15 09:17:43 ismvm22 slapd[17313]: dn_callback : entries have identical CSN cn=stud31,nisMapName=ws,ou=autofs,ou=etc,ou=Data,ou=myou,dc=mybase 20130315072217.079828Z#000000#000#000000 Mar 15 09:17:43 ismvm22 slapd[17313]: syncrepl_entry: rid=010 be_search (0) Mar 15 09:17:43 ismvm22 slapd[17313]: syncrepl_entry: rid=010 cn=stud31,nisMapName=ws,ou=autofs,ou=etc,ou=Data,ou=myou,dc=mybase Mar 15 09:17:43 ismvm22 slapd[17313]: syncrepl_entry: rid=010 entry unchanged, ignored (cn=stud31,nisMapName=ws,ou=autofs,ou=etc,ou=Data,ou=myou,dc=mybase) Mar 15 09:17:43 ismvm22 slapd[17313]: syncrepl_message_to_entry: rid=010 DN: uid=stud31,ou=Student,ou=People,ou=myou,dc=mybase, UUID: 5949c18a-cd49-4dec-85dc-68ae129c13d7 Mar 15 09:17:43 ismvm22 slapd[17313]: syncrepl_entry: rid=010 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Mar 15 09:17:43 ismvm22 slapd[17313]: syncrepl_entry: rid=010 inserted UUID 5949c18a-cd49-4dec-85dc-68ae129c13d7 Mar 15 09:17:43 ismvm22 slapd[17313]: dn_callback : entries have identical CSN uid=stud31,ou=Student,ou=People,ou=myou,dc=mybase 20130315072217.081269Z#000000#000#000000 Mar 15 09:17:43 ismvm22 slapd[17313]: syncrepl_entry: rid=010 be_search (0) Mar 15 09:17:43 ismvm22 slapd[17313]: syncrepl_entry: rid=010 uid=stud31,ou=Student,ou=People,ou=myou,dc=mybase Mar 15 09:17:43 ismvm22 slapd[17313]: syncrepl_entry: rid=010 entry unchanged, ignored (uid=stud31,ou=Student,ou=People,ou=myou,dc=mybase) Mar 15 09:17:43 ismvm22 slapd[17313]: do_syncrep2: rid=010 LDAP_RES_SEARCH_RESULT Mar 15 09:17:43 ismvm22 slapd[17313]: do_syncrep2: rid=010 LDAP_RES_SEARCH_RESULT (4) Size limit exceeded Mar 15 09:17:43 ismvm22 slapd[17313]: do_syncrep2: rid=010 (4) Size limit exceeded Mar 15 09:17:43 ismvm22 slapd[17313]: do_syncrepl: rid=010 rc -2 retrying (58 retries left) The config files privider: --------------------------------------------- access to dn.base="" by * read access to dn.base="cn=Subschema" by * read # lege ein replicator reader an der auch passwörter lesen kann limits dn.exact="cn=replicator,dc=mybase" size=unlimited time=unlimited access to * by dn.exact="cn=replicator,dc=mybase" read by * break access to attrs=userPassword,userPKCS12 by self write by * auth access to attrs=shadowLastChange by self write by * read access to * by * read database bdb suffix "dc=mybase" checkpoint 1024 5 cachesize 10000 rootdn "cn=ldapadmin,dc=mybase" directory /opt/var/openldap-data/ # Indices to maintain index objectClass eq index entryUUID eq overlay syncprov ------------------------------------------------------------------ On the consumer side is all same except the syncrepl directive consumer: ------------------------------------------------------- syncrepl rid=10 provider=ldap://172.22.199.121 searchbase="dc=mybase" type=refreshAndPersist retry="30 60 120 +" filter="objectClass=*" scope=sub attrs="*,+" sizelimit=unlimited timelimit=unlimited binddn="cn=replicator,dc=mybase" bindmethod=simple credentials="secred" ------------------------ Any Ideas? I am glad for every help.

2 1

Local group and ldap user combination
by Gerhardus Geldenhuis 14 Mar '13

14 Mar '13

Hi Admittedly this is slightly OT but I were hoping someone could point me in the right direction. I want to be able to grant LDAP users group membership to local groups on a Ubuntu box. For example the adm group. How would I go about doing this? As a very quick test I created a adm group in ldap but it is not having the desired effect. Output from getent group | grep arm adm:x:4: adm:*:4:uid=ggeldenhuis,ou=People,dc=example,dc=com The first adm group is the local file group and the second my ldap group. Am I going about this in the wrong way... ? Regards -- Gerhardus Geldenhuis

3 6

Adding samba schema to OpenLDAP2.4
by Wes Modes 14 Mar '13

14 Mar '13

Previously, I was running 2.3 and then 2.4 using all the 2.3 config files. I am building a new 2.4 server the right way using OpenLDAP native database and config schema. As I migrate the functionality of the old server to the new one, I will have various questions. Today's question: How do I import the samba (3.6.9) schema (previously in an include schema file) to the new 2.4 server? W. -- Wes Modes Systems Designer, Developer, and Administrator University Library ITS University of California, Santa Cruz

3 4

Issues with deletes and syncrepl
by Adam 14 Mar '13

14 Mar '13

Hi, I am currently working on setting up a new openldap environment, based on the current stable version of 2.4.34 I have two servers, ldap1 and ldap2, which are performing mirror-mode multi-master replication. When ldap1 and ldap2 are both up, adds/deletes/modifications are replicated correctly. When ldap1 is up and ldap2 is down, adds/modifications can be performed successfully against ldap1, and when ldap2 comes back up, changes are replicated successfully. Problem is, if ldap2 is down, and a deletion occurs against ldap1, when ldap2 comes back up, the deletion is not replicated. Here are my slapd.confs for each server ldap1: ----------------------------- include /opt/openldap/etc/openldap/schema/core.schema pidfile /opt/openldap/var/run/slapd.pid argsfile /opt/openldap/var/run/slapd.args moduleload syncprov.la moduleload accesslog.la moduleload back_bdb.la serverID 1 ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=example,dc=com" rootdn "cn=manager,dc=example,dc=com" rootpw {SSHA}zViBuH78jtg/BKtT1sZHNp7gwWnlCWDk directory /opt/openldap/var/openldap-data checkpoint 10240 720 cachesize 50000 dbconfig set_cachesize 0 524288000 1 dbconfig set_lk_max_locks 3000 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_lockers 1500 dbconfig set_lg_regionmax 262144 dbconfig set_lg_bsize 2097152 syncrepl rid=001 provider=ldap://ldap2.example.com:389 binddn="cn=manager,dc=example,dc=com" bindmethod=simple credentials=password searchbase="dc=example,dc=com" type=refreshAndPersist interval=00:00:00:01 retry="60 +" schemachecking=on index objectClass eq index entryUUID eq index entryCSN eq mirrormode on overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE syncprov-checkpoint 100 1 ldap2: ----------------------------- include /opt/openldap/etc/openldap/schema/core.schema pidfile /opt/openldap/var/run/slapd.pid argsfile /opt/openldap/var/run/slapd.args moduleload syncprov.la moduleload accesslog.la moduleload back_bdb.la serverID 2 ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=example,dc=com" rootdn "cn=manager,dc=example,dc=com" rootpw {SSHA}zViBuH78jtg/BKtT1sZHNp7gwWnlCWDk directory /opt/openldap/var/openldap-data checkpoint 10240 720 cachesize 50000 dbconfig set_cachesize 0 524288000 1 dbconfig set_lk_max_locks 3000 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_lockers 1500 dbconfig set_lg_regionmax 262144 dbconfig set_lg_bsize 2097152 syncrepl rid=001 provider=ldap://ldap1.example.com:389 binddn="cn=manager,dc=example,dc=com" bindmethod=simple credentials=password searchbase="dc=example,dc=com" type=refreshAndPersist interval=00:00:00:01 retry="60 +" schemachecking=on index objectClass eq index entryUUID eq index entryCSN eq mirrormode on overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE syncprov-checkpoint 100 1 Here is the logging output at level 16384 ldap1: ----------------------------- 51401797 bdb_monitor_db_open: monitoring disabled; configure monitor database to enable 51401797 slapd starting 51401797 do_syncrep2: rid=001 LDAP_RES_INTERMEDIATE - REFRESH_DELETE 514017ae do_syncrep2: rid=001 (-1) Can't contact LDAP server 514017ae do_syncrepl: rid=001 rc -1 retrying 514017c9 slap_queue_csn: queing 0x7fa53f0c5020 20130313060809.655329Z#000000#001#000000 514017c9 slap_graduate_commit_csn: removing 0x7fa530100910 20130313060809.655329Z#000000#001#000000 514017cc syncprov_search_response: cookie=rid=001,sid=001,csn=20130313060809.655329Z#000000#001#000000;20130313054634.762054Z#000000#002#000000 514017e8 slap_queue_csn: queing 0x7fa53e8c4470 20130313060840.173887Z#000000#001#000000 514017e8 slap_graduate_commit_csn: removing 0x7fa534101170 20130313060840.173887Z#000000#001#000000 514017ea slap_client_connect: URI=ldap://ldap2.example.com:389 DN="cn=manager,dc=example,dc=com" ldap_sasl_bind_s failed (-1) 514017ea do_syncrepl: rid=001 rc -1 retrying 514017ed syncprov_search_response: cookie=rid=001,sid=001,csn=20130313060840.173887Z#000000#001#000000;20130313054634.762054Z#000000#002#000000 51401826 do_syncrep2: rid=001 LDAP_RES_INTERMEDIATE - REFRESH_DELETE ldap2: ----------------------------- 514017ed bdb_monitor_db_open: monitoring disabled; configure monitor database to enable 514017ed slapd starting 514017ed do_syncrep2: rid=001 LDAP_RES_INTERMEDIATE - REFRESH_DELETE 514017ed do_syncrep2: rid=001 cookie=rid=001,sid=001,csn=20130313060840.173887Z#000000#001#000000;20130313054634.762054Z#000000#002#000000 514017ed slap_queue_csn: queing 0x7f5070109540 20130313060840.173887Z#000000#001#000000 514017ed slap_graduate_commit_csn: removing 0x7f50701096b0 20130313060840.173887Z#000000#001#000000 Heres the command I'm using on the client to perform the delete: While ldap2 is offline, ldapdelete -h ldap1 -x -r -D "cn=manager,dc=example,dc=com" -w password "ou=groups,dc=example,dc=com" Let me know if you want any further information I'm sure its something stupid I'm missing, but would appreciate any assistance with this. Cheers, Adam

3 3

ldapmodify: multiple additions
by infirit 13 Mar '13

13 Mar '13

Hi, I am working through a book (Mastering OpenLDAP, Packtpub) which is based on openldap 2.3. The book talks in chapter 3 how to modify/add/delete attributes for a dn. It instructs to put the bellow in an ldif file and read it with ldapmodify. The writerś point here is that I am supposed to add both a "description" and "title" without separating out the additions with a dash (-). It never works for me and always comes with a syntax error. non working ldif file: dn: uid=nicholas,ou=Users,dc=home changetype: modify add: description title # <- 2 attributes description: This is a test title: Cartesian philosopher Error: ldapmodify: wrong attributeType at line 4, entry "uid=nicholas,ou=Users,dc=home" The ldif file that does work is below. Working ldif file: dn: uid=nicholas,ou=Users,dc=home changetype: modify add: description description: This is a test - add: title title: Cartesian philosopher Now am I doing something wrong, is the book using functionality that is not available in openldap version 2.4 or something else? Any pointers and help much appreciated. Thx infirit

3 2

slapd version 2.4.32 crashes on Solaris 10
by Juergen.Sprenger＠swisscom.com 13 Mar '13

13 Mar '13

Hello, Since update from OpenLDAP 2.4.23 to OpenLDAP 2.4.32 about one to three times a week a slapd process crashes with a coredump. Seems it's caused by ldap requests as only some of our servers are affected which are all in the same network zone. The facts I found out so far: Syslog: Mar 8 20:13:01 vg0092 slapd[220]: [ID 870088 local4.debug] get_filter: unknown filter type=48 Mar 8 20:13:01 vg0092 last message repeated 14 times Mar 8 20:13:01 vg0092 slapd[220]: [ID 870088 local4.debug] get_filter: unknown filter type=48 Mar 8 20:13:01 vg0092 last message repeated 17 times Mar 8 20:13:01 vg0092 slapd[220]: [ID 870088 local4.debug] get_filter: unknown filter type=48 Mar 8 20:13:01 vg0092 last message repeated 15 times Mar 8 20:13:01 vg0092 slapd[220]: [ID 870088 local4.debug] get_filter: unknown filter type=48 Mar 8 20:13:02 vg0092 last message repeated 18 times Mar 8 20:13:02 vg0092 slapd[220]: [ID 870088 local4.debug] get_filter: unknown filter type=48 Mar 8 20:13:11 vg0092 last message repeated 1091 times Mar 8 20:13:11 vg0092 slapd[220]: [ID 870088 local4.debug] get_filter: unknown filter type=48 Mar 8 20:13:20 vg0092 last message repeated 1057 times Mar 8 20:14:14 vg0092 genunix: [ID 603404 kern.notice] NOTICE: core_log: slapd[220] core dumped: /dpool/vg0092-data/ldap/core/core.slapd.220 Mar 8 20:14:14 vg0092 slapd[7288]: [ID 702911 local4.debug] @(#) $OpenLDAP: slapd 2.4.32 (Aug 5 2012 00:09:28) $ Mar 8 20:14:14 vg0092 steve@sunblade2500:/bigdisk/SOURCES/S10/openldap-2.4.32/servers/slapd Mar 8 20:14:14 vg0092 slapd[7299]: [ID 643551 local4.debug] hdb_db_open: database "dc=scom": unclean shutdown detected; attempting recovery. Mar 8 20:14:31 vg0092 last message repeated 2 times Mar 8 20:14:42 vg0092 last message repeated 5 times Mar 8 20:15:03 vg0092 slapd[8246]: [ID 702911 local4.debug] @(#) $OpenLDAP: slapd 2.4.32 (Aug 5 2012 00:09:28) $ Mar 8 20:15:03 vg0092 steve@sunblade2500:/bigdisk/SOURCES/S10/openldap-2.4.32/servers/slapd Mar 8 20:15:03 vg0092 ldap: [ID 702911 user.warning] vg0092 slapd maintenance, rebuilding, WARNING The 'unknown filter' messages are caused by HPUX clients. By the crash the Berkeley-DB became corrupt and has to be rebuilt. Coredump: # adb /usr/local/libexec/slapd core.slapd.220 core file = core.slapd.220 -- program ``/usr/local/libexec/slapd'' on platform SUNW,SPARC-Enterprise-T5120 SIGABRT: Abort $c libc.so.1`_lwp_kill+8(6, 0, fed87080, fecede54, ffffffff, 6) libc.so.1`abort+0x110(b07ff4e8, 1, fed833f0, ffba0, fed85518, 0) libc.so.1`_assert+0x64(12d0d0, 12c9d0, 3a8, 0, ff8bc, 19418c) connection_next+0x138(0, b07ff7c4, b07ff7c0, 199d1c, fd17ba00, 1a2000) 0x112574(8000, b07ffcb8, 5e9bb4, 199d1c, b07ff8a8, 1c77a8) monitor_entry_create+0x94(714ba50, b07ffcb8, 0, 545d64, b07ff8a8, 546084) 0xe1eec(714ba50, b07ffcb8, 545d3c, 0, 1, 1a2400) monitor_back_search+0x248(714ba50, b07ffcb8, 0, 142a7da8, e1fb8, 1971d8) fe_op_search+0x420(714ba50, b07ffcb8, 12d838, 0, 1a2928, 1a2a20) do_search+0x618(714ba50, b07ffcb8, fed87940, 0, 3f0f4, b07ffa38) 0x3da44(b07ffe08, 714ba50, fed87940, 0, fd17ba00, 0) 0x3e3d0(0, 2f, fed87940, 0, fd17ba00, 2330ec) libldap_r-2.4.so.2`ldap_int_thread_pool_wrapper+0x190(2330a8, b0800000, 0, 0, ff30ed80, 1) libc.so.1`_lwp_start(0, 0, 0, 0, 0, 0) pflags shows, that lwp 25 might be the culprit: # pflags core.slapd.220 core 'core.slapd.220' of 220: /usr/local/libexec/slapd -4 -u ldap -g ldap -f /dpool/vg0092-data/ldap data model = _ILP32 flags = MSACCT|MSFORK /1: flags = STOPPED lwp_wait(0x4,0xffbffb34) why = PR_SUSPENDED /2: flags = STOPPED pollsys(0x4,0x9f,0x0,0x0) why = PR_SUSPENDED /3: flags = DETACH|STOPPED lwp_park(0x4,0x0,0x0) why = PR_SUSPENDED /4: flags = DETACH|STOPPED lwp_park(0x4,0x0,0x0) why = PR_SUSPENDED /5: flags = DETACH|STOPPED lwp_park(0x4,0x0,0x0) why = PR_SUSPENDED /6: flags = DETACH|STOPPED lwp_park(0x4,0x0,0x0) why = PR_SUSPENDED /7: flags = DETACH|STOPPED lwp_park(0x4,0x0,0x0) why = PR_SUSPENDED /8: flags = DETACH|STOPPED lwp_park(0x4,0x0,0x0) why = PR_SUSPENDED /9: flags = DETACH|STOPPED lwp_park(0x4,0x0,0x0) why = PR_SUSPENDED /10: flags = DETACH|STOPPED lwp_park(0x4,0x0,0x0) why = PR_SUSPENDED /11: flags = DETACH|STOPPED lwp_park(0x4,0x0,0x0) why = PR_SUSPENDED /12: flags = DETACH|STOPPED lwp_park(0x4,0x0,0x0) why = PR_SUSPENDED /13: flags = DETACH|STOPPED why = PR_SUSPENDED /14: flags = DETACH|STOPPED lwp_park(0x4,0x0,0x0) why = PR_SUSPENDED /15: flags = DETACH|STOPPED lwp_park(0x4,0x0,0x0) why = PR_SUSPENDED /16: flags = DETACH|STOPPED lwp_park(0x4,0x0,0x0) why = PR_SUSPENDED /17: flags = DETACH|STOPPED lwp_park(0x4,0x0,0x0) why = PR_SUSPENDED /18: flags = DETACH|STOPPED lwp_park(0x4,0x0,0x0) why = PR_SUSPENDED /19: flags = DETACH|STOPPED lwp_park(0x4,0x0,0x0) why = PR_SUSPENDED /20: flags = DETACH|STOPPED lwp_park(0x4,0x0,0x0) why = PR_SUSPENDED /21: flags = DETACH|STOPPED lwp_park(0x4,0x0,0x0) why = PR_SUSPENDED /22: flags = DETACH|STOPPED lwp_park(0x4,0x0,0x0) why = PR_SUSPENDED /23: flags = DETACH|STOPPED lwp_park(0x4,0x0,0x0) why = PR_SUSPENDED /24: flags = DETACH|STOPPED lwp_park(0x4,0x0,0x0) why = PR_SUSPENDED /25: flags = DETACH sigmask = 0xffffbefc,0x0000ffff cursig = SIGABRT /26: flags = DETACH|STOPPED lwp_park(0x4,0x0,0x0) why = PR_SUSPENDED /27: flags = DETACH|STOPPED lwp_park(0x4,0x0,0x0) why = PR_SUSPENDED /28: flags = DETACH|STOPPED lwp_park(0x4,0x0,0x0) why = PR_SUSPENDED /29: flags = DETACH|STOPPED lwp_park(0x4,0x0,0x0) why = PR_SUSPENDED /30: flags = DETACH|STOPPED lwp_park(0x4,0x0,0x0) why = PR_SUSPENDED /31: flags = DETACH|STOPPED why = PR_SUSPENDED /32: flags = DETACH|STOPPED lwp_park(0x4,0x0,0x0) why = PR_SUSPENDED /33: flags = DETACH|STOPPED lwp_park(0x4,0x0,0x0) why = PR_SUSPENDED /34: flags = DETACH|STOPPED lwp_park(0x4,0x0,0x0) why = PR_SUSPENDED pstack: ----------------- lwp# 25 / thread# 25 -------------------- fed0e8cc _lwp_kill (6, 0, fed87080, fecede54, ffffffff, 6) + 8 fec82950 abort (b07ff4e8, 1, fed833f0, ffba0, fed85518, 0) + 110 fec82b8c _assert (12d0d0, 12c9d0, 3a8, 0, ff8bc, 19418c) + 64 0003cc64 connection_next (0, b07ff7c4, b07ff7c0, 199d1c, fd17ba00, 1a2000) + 138 00112574 ???????? (8000, b07ffcb8, 5e9bb4, 199d1c, b07ff8a8, 1c77a8) 00114670 monitor_entry_create (714ba50, b07ffcb8, 0, 545d64, b07ff8a8, 546084) + 94 000e1eec ???????? (714ba50, b07ffcb8, 545d3c, 0, 1, 1a2400) 000e2200 monitor_back_search (714ba50, b07ffcb8, 0, 142a7da8, e1fb8, 1971d8) + 248 0004005c fe_op_search (714ba50, b07ffcb8, 12d838, 0, 1a2928, 1a2a20) + 420 0003f70c do_search (714ba50, b07ffcb8, fed87940, 0, 3f0f4, b07ffa38) + 618 0003da44 ???????? (b07ffe08, 714ba50, fed87940, 0, fd17ba00, 0) 0003e3d0 ???????? (0, 2f, fed87940, 0, fd17ba00, 2330ec) ff30ef10 ldap_int_thread_pool_wrapper (2330a8, b0800000, 0, 0, ff30ed80, 1) + 190 fed0abd8 _lwp_start (0, 0, 0, 0, 0, 0) Questions: - Is this a known problem? - If yes: is it already fixed in OpenLDAP 2.4.34 or can it be circumvented? - If no: Is there any additional info I can provide which might be helpful? Sending the coredump is no option yet as it contains all password hashes etc. Regards Jürgen Sprenger E-Mail: mailto:juergen.sprenger@swisscom.com Internet: http://www.swisscom.com/it-services

2 1

Re: OpenLDAP 2.4.34 available
by Clément OUDOT 12 Mar '13

12 Mar '13

2013/3/5 OpenLDAP Project <project(a)openldap.org>: > OpenLDAP 2.4.34 is now available for download as detailed on our download > page: > > http://www.openldap.org/software/download/ > Hi, for people interested in RPM, I publish some on LDAP Tool Box project: http://ltb-project.org/wiki/download#openldap Clément.

1 0

ldap_add: Invalid syntax (21)
by Graeme Gemmill 12 Mar '13

12 Mar '13

Sorry, but after a couple of hours head-scratching, I need some help from the experts. Environment: Mandriva Linux 2011_x64, OpenLDAP openldap-2.4.33 (also jxplorer). I'm trying to process a large LDIF file produced by Thunderbird. My slapd.conf file contains include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/openldap.schema include /usr/local/etc/openldap/schema/mozilla.schema include /usr/local/etc/openldap/schema/misc.schema I've progresses to the point where two organizational units have been created, Personal and NCI. I get the error when processing the first person in the LDIF file: dn: cn=Chris Smith,mail=chris.smith(a)ccb-insight.emv1.net,ou=Personal,dc=gemmills,dc=name objectclass: top objectclass: person objectclass: organizationalPerson objectclass: inetOrgPerson objectclass: mozillaAbPersonAlpha cn: Chris Smith mail: chris.smith(a)ccb-insight.emv1.net #modifytimestamp: 1314088910 The full error message is ldap_add: Invalid syntax (21) additional info: objectclass: value #4 invalid per syntax, which points to a problem with the mozillaABPersonAlpha object. here is the log output: add objectclass: top person organizationalPerson inetOrgPerson mozillaAbPersonAlpha add cn: Chris Smith add mail: chris.smith(a)ccb-insight.emv1.net adding new entry "cn=Chris Smith,mail=chris.smith(a)ccb-insight.emv1.net,ou=Personal,dc=gemmills,dc=name" I can't see why either of these attributes should give a problem. As a side issue: is it significant that KWrite doesn't colour the "objectclass: mozillaAbPersonAlpha" line in the LDIF file the same as the other objectclass lines? Your comments/help will be gratefully received. Graeme

3 5

RE: getent passwd inconsistent loginShell with ldapsearch [ISSUE RESOLVED]
by Rodney Simioni 12 Mar '13

12 Mar '13

ISSUE RESOLVED I didn't have nslcd started. Thanks everybody for your help. -----Original Message----- From: Dan White [mailto:dwhite@olp.net] Sent: Tuesday, March 12, 2013 11:07 AM To: Rodney Simioni Cc: openldap-technical(a)openldap.org Subject: Re: getent passwd inconsistent loginShell with ldapsearch On 03/12/13 10:19 -0400, Rodney Simioni wrote: >I removed ldap from nsswitch.conf. I restarted slapd and sssd. > >There is still inconsistencies between getent and ldapsearch: > >[root@rodster sssd]# getent passwd meathead08 >meathead08:*:343108:343108:Johnny >Appleseed:/home/meathead08:/bin/noshell > >ldapsearch -w xxxx -D "cn=manager,dc=wh,dc=local" >homeDirectory: /home/meathead08 >loginShell: /bin/bash >>/etc/nsswitch.conf has: >> >>passwd: files sss ldap >>shadow: files sss ldap Your problem does not appear to be openldap related. Try alternatively removing 'files' and 'sss' from your nsswitch.conf file, and then running getent again. If the problem persists in both scenarios, then you've got a caching issue. If the problem exists in only one of the cases, then you know who to blame. -- Dan White This email message is intended for the use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, distribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. Verio Inc. makes no warranty that this email is error or virus free. Thank you.

1 0

RE: getent passwd inconsistent loginShell with ldapsearch
by Rodney Simioni 12 Mar '13

12 Mar '13

I think this may have fixed it. In my ldap.conf I had: URI ldap://127.0.0.1/ I changed it to the host name: URI ldap://narf.com/ I restarted slapd and now they are consistent. From: Rodney Simioni Sent: Friday, March 08, 2013 4:14 PM To: openldap-technical(a)openldap.org Subject: getent passwd inconsistent loginShell with ldapsearch Hi, When I do a 'getent check72 passwd' I get: check72:*:6072:6072:Johnny Appleseed:/home/check72:/bin/bash But when I do a ldapsearch command I get: # check72, people, wh.local dn: uid=check72,ou=people,dc=wh,dc=local uid: check72 cn: Johnny Appleseed objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword:: e1NTSEF9OWVHdTdPVHIwVE15ajNQNEphdG9GR1cwZnQxa2Ftb3k= shadowLastChange: 15140 shadowMax: 99999 shadowWarning: 7 uidNumber: 6072 gidNumber: 6072 homeDirectory: /home/check72 loginShell: /bin/noshell # check72, group, wh.local dn: cn=check72,ou=group,dc=wh,dc=local objectClass: posixGroup objectClass: top cn: check72 gidNumber: 6072 userPassword:: e0NSWVBUfXg= # search result search: 2 result: 0 Success I have rstarted slapd and nscd, any clue? Thanks in advance. This email message is intended for the use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, distribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. Verio Inc. makes no warranty that this email is error or virus free. Thank you.

4 10

ACL by objectClass
by Evgeny Basov 12 Mar '13

12 Mar '13

Hello, everybody. I have this structure: dn: o=z objectclass: organization objectclass: top o: z dn: domainName=example.org,o=z objectclass: mailDomain objectclass: top domainname: example.org dn: uid=user,domainName=example.org,o=z objectclass: account objectclass: mailUser objectclass: top mail: user(a)example.org uid: user and want to grant access only for members of subtree of every domainName: dn: ou=Admins,domainName=example.org,o=z objectclass: organizationalUnit objectclass: top ou: Admins dn: uid=postmaster,ou=Admins,domainName=example.org,o=z objectclass: account objectclass: mailAdmin objectclass: top mail: postmaster(a)example.org uid: postmaster write ACL : {0}to attrs=userPassword by self write by anonymous auth by * none {1}to dn.regex="^(.+,)?(domainName=[^,]+,o=z)$" by dn.onelevel,expand="ou=Admins,$2" write {2}to * by self write and all working fine, but I want to add something this: dn: uid=admin,domainName=example.org,o=z objectclass: account objectclass: mailAdmin objectclass: top mail: admin(a)example.org uid: admin and rewrite ACL to dn.regex="^(.+,)?(domainName=[^,]+,o=z)$" by dn.onelevel,expand="ou=Admins,$2" write for grant write access for all subentries of domainName which has objectClass=mailAdmin . Is it possible? How can I do it?

1 0

Data validation
by bob＠swin.edu.au 12 Mar '13

12 Mar '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, Can anyone point me to a means of performing some sort of data validation on input data at the server end? Specifically, I want to store email addresses to be looked up by sendmail when doing alias processing. I want to have these aliases managed by users who may not be totally trustworthy, so I'd like to knock out any attempts to add aliases that have redirection or pipe operators in them. The printable string schema syntax (OID=1.3.6.1.4.1.1466.115.121.1.44) is pretty close to what I need, but it doesn't include the '@' character. Any ideas? Thanks in advance, Bob..... -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.0 (MingW32) Comment: No comment iD8DBQFRPneLpjfLzfdVw6YRAjueAKCV7fVyve4m0wTNy0S4/FNMrdT2XACcCryX Sn7CpG8ZHVVlUn+mu9kLE00= =nql5 -----END PGP SIGNATURE-----

2 1

S/Mime configuration
by Jignesh Patel 12 Mar '13

12 Mar '13

How to configure s/mime with openldap 2.4.23? -Jignesh

3 7

shadowLastChange missing after update
by Maria McKinley 11 Mar '13

11 Mar '13

Hi there, I recently changed from the slapd.conf configuration to the slapd.d configuration. Everything seemed to go reasonably well, but for some reason the shadowLastChange attribute was missing from all of the people. When I try to add it back in, I get: ldap_add: Object class violation (65) additional info: no objectClass attribute but, I seem to have the schema and objectClasses for ShadowLastChange: annette:~# ldapsearch -LLLQY EXTERNAL -H ldapi:/// -b cn=schema,cn=config "(objectClass=olcSchemaConfig)" dn dn: cn=schema,cn=config dn: cn={0}core,cn=schema,cn=config dn: cn={1}cosine,cn=schema,cn=config dn: cn={2}nis,cn=schema,cn=config dn: cn={3}inetorgperson,cn=schema,cn=config dn: cn={4}misc,cn=schema,cn=config maria@mimi:~/sysadmin$ ldapsearch -xLLL "uid=jd" dn: uid=jd,ou=people,dc=example,dc=com objectClass: top objectClass: posixAccount objectClass: shadowAccount objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: inetLocalMailRecipient cn: Jochen Ditterich shadowMax: 365 gidNumber: 100 uid: jd homeDirectory: /home/jd mailRoutingAddress: jd(a)example.com uidNumber: 1025 sn: Ditterich shadowWarning: 7 mailLocalAddress: jd mail: jd(a)example.com loginShell: /bin/bash Anyone have any idea what might be going on? What am I missing? thanks, maria

3 5

Import base64 info
by arantza serrano 11 Mar '13

11 Mar '13

Hello, I’m trying to import my LDIF where some attributes are in base64: /opt/openldap/bin/ldapadd -x -D "root_dn" -w pass_dn << _EOF dn: uid=usu3,ou=users,o=my_organization uid: usu2 objectClass: top objectClass: person objectClass: organizationalperson objectClass: inetorgperson cn:: Q0FNSdFBCg== sn: my_sn mail: my_mail(a)mydomain.com userPassword: usuario > _EOF Then I get this error: adding new entry " uid=usu3,ou=users,o=my_organization " ldap_add: Invalid syntax (21) additional info: cn: value #0 invalid per syntax If I decode the value, I get the same error: /opt/openldap/bin/ldapadd -x -D "root_dn" -w pass_dn << _EOF dn: uid=usu3,ou=users,o=my_organization uid: usu2 objectClass: top objectClass: person objectClass: organizationalperson objectClass: inetorgperson cn: CAMIÑA sn: my_sn mail: my_mail(a)mydomain.com userPassword: usuario _EOF adding new entry " uid=usu3,ou=users,o=my_organization " ldap_add: Invalid syntax (21) additional info: cn: value #0 invalid per syntax How can I import my LDIF? Thanks!

5 5

Re: Import base64 info
by Jorge.armijo 11 Mar '13

11 Mar '13

elimina el caracter especial y prueb asi ese problema tenia yo usa la herramienta grafica ldapexplorer Enviado desde Samsung Mobile arantza serrano <zazu2276(a)hotmail.com> escribió: Hello, I’m trying to import my LDIF where some attributes are in base64: /opt/openldap/bin/ldapadd -x -D "root_dn" -w pass_dn << _EOF dn: uid=usu3,ou=users,o=my_organization uid: usu2 objectClass: top objectClass: person objectClass: organizationalperson objectClass: inetorgperson cn:: Q0FNSdFBCg== sn: my_sn mail: my_mail(a)mydomain.com userPassword: usuario > _EOF Then I get this error: adding new entry " uid=usu3,ou=users,o=my_organization " ldap_add: Invalid syntax (21) additional info: cn: value #0 invalid per syntax If I decode the value, I get the same error: /opt/openldap/bin/ldapadd -x -D "root_dn" -w pass_dn << _EOF dn: uid=usu3,ou=users,o=my_organization uid: usu2 objectClass: top objectClass: person objectClass: organizationalperson objectClass: inetorgperson cn: CAMIÑA sn: my_sn mail: my_mail(a)mydomain.com userPassword: usuario _EOF adding new entry " uid=usu3,ou=users,o=my_organization " ldap_add: Invalid syntax (21) additional info: cn: value #0 invalid per syntax How can I import my LDIF? Thanks!

1 0

ldap start and stop scripts
by francesco.policastro＠selex-es.com 11 Mar '13

11 Mar '13

Hi, Can anyone address me to a script to start and stop openldap? I mean a script to use with chkconfig. What I found online is somehow obsolete, i.e. it refers to slurpd and slapd.conf, with no reference to slapd.d I installed rev. 2.4.33 from sources. Thanks in advance, Francesco

3 4

getent passwd inconsistent loginShell with ldapsearch
by Rodney Simioni 08 Mar '13

08 Mar '13

Hi, When I do a 'getent check72 passwd' I get: check72:*:6072:6072:Johnny Appleseed:/home/check72:/bin/bash But when I do a ldapsearch command I get: # check72, people, wh.local dn: uid=check72,ou=people,dc=wh,dc=local uid: check72 cn: Johnny Appleseed objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword:: e1NTSEF9OWVHdTdPVHIwVE15ajNQNEphdG9GR1cwZnQxa2Ftb3k= shadowLastChange: 15140 shadowMax: 99999 shadowWarning: 7 uidNumber: 6072 gidNumber: 6072 homeDirectory: /home/check72 loginShell: /bin/noshell # check72, group, wh.local dn: cn=check72,ou=group,dc=wh,dc=local objectClass: posixGroup objectClass: top cn: check72 gidNumber: 6072 userPassword:: e0NSWVBUfXg= # search result search: 2 result: 0 Success I have rstarted slapd and nscd, any clue? Thanks in advance. This email message is intended for the use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, distribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. Verio Inc. makes no warranty that this email is error or virus free. Thank you.

2 3

SASL/PLAIN Passthrough auth
by Robin Helgelin 08 Mar '13

08 Mar '13

Hi, I have a SASL pass-through authentication working when using a simple bind only on users that has a userPassword starting with {SASL}. When the users password contains {SASL}extraAuthInformation, the extraAuthInformation is passed on as username to the saslauthd and everything works as it should. However, when using SASL/PLAIN all requests goes to the saslauthd, without passing the extra information found in userPassword. Another issue is that the username sent to saslauthd is the username entered by the user, not the dn found when rewriting the username with authz-regexp. Is this by design or did I miss anything? Documentation states that pass-through should be working with SASL/PLAIN, but perhaps I misunderstood what it really meant? -- regards, Robin

3 2

Server is unwilling to perform
by anil beniwal 08 Mar '13

08 Mar '13

Hi We are getting "Server is unwilling to perform" error in our ldap log files. Can somebody guide me, why we are getting this. We are having everything running fine on all the ldap servers. We have enabled ssl/tls. And its working fine when we connect on port 636 from application. We are not using ssl/tls for replication. Mar 8 13:52:51 prodldap01 slapd[10659]: conn=160323 fd=13 ACCEPT from IP= 10.243.129.9:27525 (IP=0.0.0.0:636) Mar 8 13:52:51 prodldap01 slapd[10659]: conn=160323 fd=13 closed (TLS negotiation failure) Mar 8 13:52:56 prodldap01 slapd[10659]: conn=160324 fd=13 ACCEPT from IP= 10.243.129.9:44600 (IP=0.0.0.0:636) Mar 8 13:52:56 prodldap01 slapd[10659]: conn=160324 fd=13 closed (TLS negotiation failure) Mar 8 13:52:56 prodldap01 slapd[10659]: conn=160324 fd=13 closed (TLS negotiation failure) Mar 8 13:52:57 prodldap01 slapd[10659]: do_syncrep2: rid=001 LDAP_RES_SEARCH_RESULT Mar 8 13:52:57 prodldap01 slapd[10659]: do_syncrep2: rid=001 LDAP_RES_SEARCH_RESULT (53) Server is unwilling to perform Mar 8 13:52:57 prodldap01 slapd[10659]: do_syncrep2: rid=001 (53) Server is unwilling to perform Mar 8 13:52:57 prodldap01 slapd[10659]: do_syncrepl: rid=001 rc -2 retrying Please let me know , if more details are required. -- Thanks&Regards AB

1 0

why are ppolicy operational attributes not viewable by default?
by John Baker 08 Mar '13

08 Mar '13

We were testing out password policy and noticed that attributes like pwdFailureTime that are modified during operation are commented out in the schema so they can't be viewed by the admin. Does anybody know the reasoning for this? We are thinking that we will want to be able to see them for debugging problems when we implement a password policy. But I wondered if that can cause problems if we put them in the schema or if their are other ways to get to current values on accounts. -- John Baker Network Administrator Marlboro College Phone: 451-7551 Cell: 490-0066

2 1

How to build OpenLDAP against specific OpenSSL install?
by Patrick Lists 08 Mar '13

08 Mar '13

Hi, I'm already using OpenSSL 1.0.1e for nginx 1.3.14 with SPDY support on a CentOS 6.3 x86_64 box. Now I'm trying to build OpenLDAP 2.4.34 against OpenSSL 1.0.1e instead of the distro provided OpenSSL. The new OpenSSL 1.0.1e header files are located under /usr/local/include/openssl and the libs are in /usr/local/lib64. Here is the way I'm trying to build OpenLDAP 2.4.34: export CFLAGS="%{optflags} -fPIC -Wl,--as-needed -DLDAP_CONNECTIONLESS" export LDFLAGS="-L/usr/local/lib64" export CPPFLAGS="-I/usr/local/include/openssl" %configure --enable-debug --enable-dynamic --enable-syslog \ --enable-proctitle --enable-ipv6 --enable-local \ --enable-slapd --enable-dynacl --enable-aci \ --enable-cleartext --enable-crypt --enable-lmpasswd \ --enable-spasswd --enable-modules --enable-rewrite \ --enable-rlookups --enable-slapi --disable-slp \ --enable-wrappers --enable-backends=mod --disable-ndb \ --disable-perl --enable-overlays=mod \ --disable-static --enable-shared --with-cyrus-sasl \ --without-fetch --with-threads --with-pic \ --with-tls=openssl --with-gnu-ld # remove rpath as demanded by Packaging Guidelines sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool #sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool make make install After the building/installing is done I check the output of ldd slapd I can see that it still shows the distro provided OpenSSL: libcrypto.so.10 => /usr/lib64/libcrypto.so.10 libssl.so.10 => /usr/lib64/libssl.so.10 Anyone have a hint how can I force the usage of the OpenSSL header files in /usr/local/include/openssl and libs in /usr/local/lib64? Regards, Patrick

2 2

RE: ssh with ldap authentication
by Rodney Simioni 06 Mar '13

06 Mar '13

Something new has just transpired. Before leaving work last night, I created 10 accounts and then tried to ssh in. All the logins failed prompting for the password. I came to work this morning, and now all the accounts are able to login successfully. Why is it taking so long for the accounts to work? From: Rodney Simioni Sent: Tuesday, March 05, 2013 2:17 PM To: 'openldap-technical(a)openldap.org' Subject: ssh with ldap authentication Hi, I'm new to LDAP. I just created a new user in LDAP and it cannot login through ssh. It keeps prompting for the password. Any help will be greatly appreciated. # dude12, people, wh.local dn: uid=dude12,ou=people,dc=wh,dc=local uid: dude12 cn: Johnny Appleseed objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword:: e1NTSEF9K2E0YXVTWlYwckMwRUhsVWlNVzBrS2U3MzA1a1JrOVI= shadowLastChange: 15140 shadowMax: 99999 shadowWarning: 7 uidNumber: 1212 gidNumber: 1212 homeDirectory: /home/dude12 loginShell: /bin/bash # dude12, group, wh.local dn: cn=dude12,ou=group,dc=wh,dc=local objectClass: posixGroup objectClass: top cn: dude12 gidNumber: 1212 userPassword:: e0NSWVBUfXg= # search result search: 2 result: 0 Success # numResponses: 220 # numEntries: 219 ############################### When I created the user, the logs indicated. ############################### Mar 5 13:53:18 rodster slapd[2678]: => bdb_dn2id("uid=dude12,ou=people,dc=wh,dc=local") Mar 5 13:53:18 rodster slapd[2678]: <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30988) Mar 5 13:53:18 rodster slapd[2678]: => bdb_dn2id_add 0x628: "uid=dude12,ou=people,dc=wh,dc=local" Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 %ou=people,dc=wh,dc=local Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 @ou=people,dc=wh,dc=local Mar 5 13:53:18 rodster slapd[2678]: <= bdb_dn2id_add 0x628: 0 Mar 5 13:53:18 rodster slapd[2678]: => index_entry_add( 1576, "uid=dude12,ou=people,dc=wh,dc=local" ) Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [7c477315] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [1fd53424] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [02537054] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [53430dd1] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [5aef1f7f] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [acefc46f] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [caca4579] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [c37ad51a] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [9b3bdeb2] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [39ebd2f9] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [d7851707] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:54:51 rodster slapd[2678]: connection_get(24) Mar 5 13:54:51 rodster slapd[2678]: connection_get(24): got connid=1903 Mar 5 13:54:51 rodster slapd[2678]: connection_read(24): checking for input on id=1903 Mar 5 13:54:51 rodster slapd[2678]: ber_get_next on fd 24 failed errno=0 (Success) Mar 5 13:54:51 rodster slapd[2678]: connection_close: conn=1903 sd=24 ####################################### When I try to ssh as the user the logs indicates. ####################################### Mar 5 14:14:30 rodster slapd[2678]: slap_listener_activate(7): Mar 5 14:14:30 rodster slapd[2678]: >>> slap_listener(ldap:///) Mar 5 14:14:30 rodster slapd[2678]: connection_get(17) Mar 5 14:14:30 rodster slapd[2678]: connection_get(17): got connid=1910 Mar 5 14:14:30 rodster slapd[2678]: connection_read(17): checking for input on id=1910 Mar 5 14:14:30 rodster slapd[2678]: op tag 0x60, time 1362510870 Mar 5 14:14:30 rodster slapd[2678]: conn=1910 op=0 do_bind Mar 5 14:14:30 rodster slapd[2678]: >>> dnPrettyNormal: <> Mar 5 14:14:30 rodster slapd[2678]: <<< dnPrettyNormal: <>, <> Mar 5 14:14:30 rodster slapd[2678]: do_bind: version=3 dn="" method=128 Mar 5 14:14:30 rodster slapd[2678]: send_ldap_result: conn=1910 op=0 p=3 Mar 5 14:14:30 rodster slapd[2678]: send_ldap_result: err=0 matched="" text="" Mar 5 14:14:30 rodster slapd[2678]: send_ldap_response: msgid=1 tag=97 err=0 Mar 5 14:14:30 rodster slapd[2678]: do_bind: v3 anonymous bind Mar 5 14:14:30 rodster slapd[2678]: connection_get(17) Mar 5 14:14:30 rodster slapd[2678]: connection_get(17): got connid=1910 Mar 5 14:14:30 rodster slapd[2678]: connection_read(17): checking for input on id=1910 Mar 5 14:14:30 rodster slapd[2678]: op tag 0x63, time 1362510870 Mar 5 14:14:30 rodster slapd[2678]: conn=1910 op=1 do_search Mar 5 14:14:30 rodster slapd[2678]: >>> dnPrettyNormal: <dc=wh,dc=local> Mar 5 14:14:30 rodster slapd[2678]: <<< dnPrettyNormal: <dc=wh,dc=local>, <dc=wh,dc=local> Mar 5 14:14:30 rodster slapd[2678]: SRCH "dc=wh,dc=local" 2 0 Mar 5 14:14:30 rodster slapd[2678]: 1 0 0 Mar 5 14:14:30 rodster slapd[2678]: filter: (uid=dude12) Mar 5 14:14:30 rodster slapd[2678]: attrs: Mar 5 14:14:30 rodster slapd[2678]: host Mar 5 14:14:30 rodster slapd[2678]: authorizedService Mar 5 14:14:30 rodster slapd[2678]: shadowExpire Mar 5 14:14:30 rodster slapd[2678]: shadowFlag Mar 5 14:14:30 rodster slapd[2678]: shadowInactive Mar 5 14:14:30 rodster slapd[2678]: shadowLastChange Mar 5 14:14:30 rodster slapd[2678]: shadowMax Mar 5 14:14:30 rodster slapd[2678]: shadowMin Mar 5 14:14:30 rodster slapd[2678]: shadowWarning Mar 5 14:14:30 rodster slapd[2678]: uidNumber Mar 5 14:14:30 rodster slapd[2678]: Mar 5 14:14:30 rodster slapd[2678]: ==> limits_get: conn=1910 op=1 self="[anonymous]" this="dc=wh,dc=local" Mar 5 14:14:30 rodster slapd[2678]: => bdb_search Mar 5 14:14:30 rodster slapd[2678]: bdb_dn2entry("dc=wh,dc=local") Mar 5 14:14:30 rodster slapd[2678]: search_candidates: base="dc=wh,dc=local" (0x00000001) scope=2 Mar 5 14:14:30 rodster slapd[2678]: => bdb_dn2idl("dc=wh,dc=local") Mar 5 14:14:30 rodster slapd[2678]: => bdb_equality_candidates (objectClass) Mar 5 14:14:30 rodster slapd[2678]: => key_read Mar 5 14:14:30 rodster slapd[2678]: bdb_idl_fetch_key: [b49d1940] Mar 5 14:14:30 rodster slapd[2678]: <= bdb_index_read: failed (-30988) Mar 5 14:14:30 rodster slapd[2678]: <= bdb_equality_candidates: id=0, first=0, last=0 Mar 5 14:14:30 rodster slapd[2678]: => bdb_equality_candidates (uid) Mar 5 14:14:30 rodster slapd[2678]: => key_read Mar 5 14:14:30 rodster slapd[2678]: bdb_idl_fetch_key: [7c477315] Mar 5 14:14:30 rodster slapd[2678]: <= bdb_index_read 1 candidates Mar 5 14:14:30 rodster slapd[2678]: <= bdb_equality_candidates: id=1, first=1578, last=1578 Mar 5 14:14:30 rodster slapd[2678]: bdb_search_candidates: id=1 first=1578 last=1578 Mar 5 14:14:30 rodster slapd[2678]: => send_search_entry: conn 1910 dn="uid=dude12,ou=people,dc=wh,dc=local" Mar 5 14:14:30 rodster slapd[2678]: <= send_search_entry: conn 1910 exit. Mar 5 14:14:30 rodster slapd[2678]: send_ldap_result: conn=1910 op=1 p=3 Mar 5 14:14:30 rodster slapd[2678]: send_ldap_result: err=0 matched="" text="" Mar 5 14:14:30 rodster slapd[2678]: send_ldap_response: msgid=2 tag=101 err=0 Mar 5 14:14:30 rodster slapd[2678]: connection_get(17) Mar 5 14:14:30 rodster slapd[2678]: connection_get(17): got connid=1910 Mar 5 14:14:30 rodster slapd[2678]: connection_read(17): checking for input on id=1910 Mar 5 14:14:30 rodster slapd[2678]: op tag 0x60, time 1362510870 Mar 5 14:14:30 rodster slapd[2678]: conn=1910 op=2 do_bind Mar 5 14:14:30 rodster slapd[2678]: >>> dnPrettyNormal: <uid=dude12,ou=people,dc=wh,dc=local> Mar 5 14:14:30 rodster slapd[2678]: <<< dnPrettyNormal: <uid=dude12,ou=people,dc=wh,dc=local>, <uid=dude12,ou=people,dc=wh,dc=local> Mar 5 14:14:30 rodster slapd[2678]: do_bind: version=3 dn="uid=dude12,ou=people,dc=wh,dc=local" method=128 Mar 5 14:14:30 rodster slapd[2678]: ==> bdb_bind: dn: uid=dude12,ou=people,dc=wh,dc=local Mar 5 14:14:30 rodster slapd[2678]: bdb_dn2entry("uid=dude12,ou=people,dc=wh,dc=local") Mar 5 14:14:30 rodster slapd[2678]: send_ldap_result: conn=1910 op=2 p=3 Mar 5 14:14:30 rodster slapd[2678]: send_ldap_result: err=49 matched="" text="" Mar 5 14:14:30 rodster slapd[2678]: send_ldap_response: msgid=3 tag=97 err=49 Mar 5 14:14:30 rodster slapd[2678]: connection_get(17) Mar 5 14:14:30 rodster slapd[2678]: connection_get(17): got connid=1910 Mar 5 14:14:30 rodster slapd[2678]: connection_read(17): checking for input on id=1910 Mar 5 14:14:30 rodster slapd[2678]: op tag 0x60, time 1362510870 Mar 5 14:14:30 rodster slapd[2678]: conn=1910 op=3 do_bind Mar 5 14:14:30 rodster slapd[2678]: >>> dnPrettyNormal: <> Mar 5 14:14:30 rodster slapd[2678]: <<< dnPrettyNormal: <>, <> Mar 5 14:14:30 rodster slapd[2678]: do_bind: version=3 dn="" method=128 Mar 5 14:14:30 rodster slapd[2678]: send_ldap_result: conn=1910 op=3 p=3 Mar 5 14:14:30 rodster slapd[2678]: send_ldap_result: err=0 matched="" text="" Mar 5 14:14:30 rodster slapd[2678]: send_ldap_response: msgid=4 tag=97 err=0 Mar 5 14:14:30 rodster slapd[2678]: do_bind: v3 anonymous bind This email message is intended for the use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, distribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. Verio Inc. makes no warranty that this email is error or virus free. Thank you.

4 13

configuring digital certificate on openldap
by Jignesh Patel 06 Mar '13

06 Mar '13

I am working on setting ldap certification discovery on openldap 2.4. version. Is it possible to configure it such that an CERT entry like "test.direct.icare.com" gets translated to the "certificate" attribute of a mapped inetOrgPerson

1 0

FW: Userpasswords stored in plain text
by arantza serrano 06 Mar '13

06 Mar '13

It works perfect with ppolicy_hash_cleartext!! Thanks!! > Date: Wed, 6 Mar 2013 10:13:09 +0000 > From: tw(a)dionic.net > To: openldap-technical(a)openldap.org > Subject: Re: Userpasswords stored in plain text > > On 06/03/13 09:58, arantza serrano wrote: > > Hello, > > > > I need that the userpasswords are stored hashed. I have configured the > > slapd.conf file with this option: > > > > password-hash {SSHA} > > Hi, > > That only takes effect if the password is set via an Extended Operation > password Modify command. > > using slapo-ppolicy and setting: > ppolicy_hash_cleartext > > Will catch your cases and hash them. > > Another solution is to pre-hash them before sending to ldapadd. You can > use slappasswd for this - or do it directly in perl for example. > > Cheers > > Tim > > -- > Tim Watts > Personal Blog: http://squiddy.blog.dionic.net/ > > http://www.sensorly.com/ Crowd mapping of 2G/3G/4G mobile signal coverage >

1 0

Userpasswords stored in plain text
by arantza serrano 06 Mar '13

06 Mar '13

Hello, I need that the userpasswords are stored hashed. I have configured the slapd.conf file with this option: password-hash {SSHA} But when I add users with ldapadd command, I pass the values of userpassword in plain text. Like this: /opt/openldap/bin/ldapadd -x -D "root_dn" -w pass_dn << _EOF dn: uid=usu3,ou=users,o=my_organization uid: usu2 objectClass: top objectClass: person objectClass: organizationalperson objectClass: inetorgperson cn: my_cn sn: my_sn mail: my_mail(a)mydomain.com userPassword: usuario _EOF I think that these values must be stored hashed, but they are only store in plain text in base64. /opt/openldap/bin/ldapsearch -D cn="root_dn" -w pass_dn -x -b o= my_organization uid=usu3 -LLL dn: uid=usu3,ou=users,o=my_organization uid: usu2 uid: usu3 objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson cn: my_cn sn: my_sn mail: my_mail(a)mydomain.com userPassword:: dXN1YXJpbw== echo dXN1YXJpbw==|base64 -d usuario What I am doing wrong? Thanks!

3 2

ssh with ldap authentication
by Rodney Simioni 06 Mar '13

06 Mar '13

Hi, I'm new to LDAP. I just created a new user in LDAP and it cannot login through ssh. It keeps prompting for the password. Any help will be greatly appreciated. # dude12, people, wh.local dn: uid=dude12,ou=people,dc=wh,dc=local uid: dude12 cn: Johnny Appleseed objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword:: e1NTSEF9K2E0YXVTWlYwckMwRUhsVWlNVzBrS2U3MzA1a1JrOVI= shadowLastChange: 15140 shadowMax: 99999 shadowWarning: 7 uidNumber: 1212 gidNumber: 1212 homeDirectory: /home/dude12 loginShell: /bin/bash # dude12, group, wh.local dn: cn=dude12,ou=group,dc=wh,dc=local objectClass: posixGroup objectClass: top cn: dude12 gidNumber: 1212 userPassword:: e0NSWVBUfXg= # search result search: 2 result: 0 Success # numResponses: 220 # numEntries: 219 ############################### When I created the user, the logs indicated. ############################### Mar 5 13:53:18 rodster slapd[2678]: => bdb_dn2id("uid=dude12,ou=people,dc=wh,dc=local") Mar 5 13:53:18 rodster slapd[2678]: <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30988) Mar 5 13:53:18 rodster slapd[2678]: => bdb_dn2id_add 0x628: "uid=dude12,ou=people,dc=wh,dc=local" Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 %ou=people,dc=wh,dc=local Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 @ou=people,dc=wh,dc=local Mar 5 13:53:18 rodster slapd[2678]: <= bdb_dn2id_add 0x628: 0 Mar 5 13:53:18 rodster slapd[2678]: => index_entry_add( 1576, "uid=dude12,ou=people,dc=wh,dc=local" ) Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [7c477315] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [1fd53424] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [02537054] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [53430dd1] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [5aef1f7f] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [acefc46f] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [caca4579] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [c37ad51a] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [9b3bdeb2] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [39ebd2f9] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:53:18 rodster slapd[2678]: bdb_idl_insert_key: 628 [d7851707] Mar 5 13:53:18 rodster slapd[2678]: <= key_change 0 Mar 5 13:53:18 rodster slapd[2678]: => key_change(ADD,628) Mar 5 13:54:51 rodster slapd[2678]: connection_get(24) Mar 5 13:54:51 rodster slapd[2678]: connection_get(24): got connid=1903 Mar 5 13:54:51 rodster slapd[2678]: connection_read(24): checking for input on id=1903 Mar 5 13:54:51 rodster slapd[2678]: ber_get_next on fd 24 failed errno=0 (Success) Mar 5 13:54:51 rodster slapd[2678]: connection_close: conn=1903 sd=24 ####################################### When I try to ssh as the user the logs indicates. ####################################### Mar 5 14:14:30 rodster slapd[2678]: slap_listener_activate(7): Mar 5 14:14:30 rodster slapd[2678]: >>> slap_listener(ldap:///) Mar 5 14:14:30 rodster slapd[2678]: connection_get(17) Mar 5 14:14:30 rodster slapd[2678]: connection_get(17): got connid=1910 Mar 5 14:14:30 rodster slapd[2678]: connection_read(17): checking for input on id=1910 Mar 5 14:14:30 rodster slapd[2678]: op tag 0x60, time 1362510870 Mar 5 14:14:30 rodster slapd[2678]: conn=1910 op=0 do_bind Mar 5 14:14:30 rodster slapd[2678]: >>> dnPrettyNormal: <> Mar 5 14:14:30 rodster slapd[2678]: <<< dnPrettyNormal: <>, <> Mar 5 14:14:30 rodster slapd[2678]: do_bind: version=3 dn="" method=128 Mar 5 14:14:30 rodster slapd[2678]: send_ldap_result: conn=1910 op=0 p=3 Mar 5 14:14:30 rodster slapd[2678]: send_ldap_result: err=0 matched="" text="" Mar 5 14:14:30 rodster slapd[2678]: send_ldap_response: msgid=1 tag=97 err=0 Mar 5 14:14:30 rodster slapd[2678]: do_bind: v3 anonymous bind Mar 5 14:14:30 rodster slapd[2678]: connection_get(17) Mar 5 14:14:30 rodster slapd[2678]: connection_get(17): got connid=1910 Mar 5 14:14:30 rodster slapd[2678]: connection_read(17): checking for input on id=1910 Mar 5 14:14:30 rodster slapd[2678]: op tag 0x63, time 1362510870 Mar 5 14:14:30 rodster slapd[2678]: conn=1910 op=1 do_search Mar 5 14:14:30 rodster slapd[2678]: >>> dnPrettyNormal: <dc=wh,dc=local> Mar 5 14:14:30 rodster slapd[2678]: <<< dnPrettyNormal: <dc=wh,dc=local>, <dc=wh,dc=local> Mar 5 14:14:30 rodster slapd[2678]: SRCH "dc=wh,dc=local" 2 0 Mar 5 14:14:30 rodster slapd[2678]: 1 0 0 Mar 5 14:14:30 rodster slapd[2678]: filter: (uid=dude12) Mar 5 14:14:30 rodster slapd[2678]: attrs: Mar 5 14:14:30 rodster slapd[2678]: host Mar 5 14:14:30 rodster slapd[2678]: authorizedService Mar 5 14:14:30 rodster slapd[2678]: shadowExpire Mar 5 14:14:30 rodster slapd[2678]: shadowFlag Mar 5 14:14:30 rodster slapd[2678]: shadowInactive Mar 5 14:14:30 rodster slapd[2678]: shadowLastChange Mar 5 14:14:30 rodster slapd[2678]: shadowMax Mar 5 14:14:30 rodster slapd[2678]: shadowMin Mar 5 14:14:30 rodster slapd[2678]: shadowWarning Mar 5 14:14:30 rodster slapd[2678]: uidNumber Mar 5 14:14:30 rodster slapd[2678]: Mar 5 14:14:30 rodster slapd[2678]: ==> limits_get: conn=1910 op=1 self="[anonymous]" this="dc=wh,dc=local" Mar 5 14:14:30 rodster slapd[2678]: => bdb_search Mar 5 14:14:30 rodster slapd[2678]: bdb_dn2entry("dc=wh,dc=local") Mar 5 14:14:30 rodster slapd[2678]: search_candidates: base="dc=wh,dc=local" (0x00000001) scope=2 Mar 5 14:14:30 rodster slapd[2678]: => bdb_dn2idl("dc=wh,dc=local") Mar 5 14:14:30 rodster slapd[2678]: => bdb_equality_candidates (objectClass) Mar 5 14:14:30 rodster slapd[2678]: => key_read Mar 5 14:14:30 rodster slapd[2678]: bdb_idl_fetch_key: [b49d1940] Mar 5 14:14:30 rodster slapd[2678]: <= bdb_index_read: failed (-30988) Mar 5 14:14:30 rodster slapd[2678]: <= bdb_equality_candidates: id=0, first=0, last=0 Mar 5 14:14:30 rodster slapd[2678]: => bdb_equality_candidates (uid) Mar 5 14:14:30 rodster slapd[2678]: => key_read Mar 5 14:14:30 rodster slapd[2678]: bdb_idl_fetch_key: [7c477315] Mar 5 14:14:30 rodster slapd[2678]: <= bdb_index_read 1 candidates Mar 5 14:14:30 rodster slapd[2678]: <= bdb_equality_candidates: id=1, first=1578, last=1578 Mar 5 14:14:30 rodster slapd[2678]: bdb_search_candidates: id=1 first=1578 last=1578 Mar 5 14:14:30 rodster slapd[2678]: => send_search_entry: conn 1910 dn="uid=dude12,ou=people,dc=wh,dc=local" Mar 5 14:14:30 rodster slapd[2678]: <= send_search_entry: conn 1910 exit. Mar 5 14:14:30 rodster slapd[2678]: send_ldap_result: conn=1910 op=1 p=3 Mar 5 14:14:30 rodster slapd[2678]: send_ldap_result: err=0 matched="" text="" Mar 5 14:14:30 rodster slapd[2678]: send_ldap_response: msgid=2 tag=101 err=0 Mar 5 14:14:30 rodster slapd[2678]: connection_get(17) Mar 5 14:14:30 rodster slapd[2678]: connection_get(17): got connid=1910 Mar 5 14:14:30 rodster slapd[2678]: connection_read(17): checking for input on id=1910 Mar 5 14:14:30 rodster slapd[2678]: op tag 0x60, time 1362510870 Mar 5 14:14:30 rodster slapd[2678]: conn=1910 op=2 do_bind Mar 5 14:14:30 rodster slapd[2678]: >>> dnPrettyNormal: <uid=dude12,ou=people,dc=wh,dc=local> Mar 5 14:14:30 rodster slapd[2678]: <<< dnPrettyNormal: <uid=dude12,ou=people,dc=wh,dc=local>, <uid=dude12,ou=people,dc=wh,dc=local> Mar 5 14:14:30 rodster slapd[2678]: do_bind: version=3 dn="uid=dude12,ou=people,dc=wh,dc=local" method=128 Mar 5 14:14:30 rodster slapd[2678]: ==> bdb_bind: dn: uid=dude12,ou=people,dc=wh,dc=local Mar 5 14:14:30 rodster slapd[2678]: bdb_dn2entry("uid=dude12,ou=people,dc=wh,dc=local") Mar 5 14:14:30 rodster slapd[2678]: send_ldap_result: conn=1910 op=2 p=3 Mar 5 14:14:30 rodster slapd[2678]: send_ldap_result: err=49 matched="" text="" Mar 5 14:14:30 rodster slapd[2678]: send_ldap_response: msgid=3 tag=97 err=49 Mar 5 14:14:30 rodster slapd[2678]: connection_get(17) Mar 5 14:14:30 rodster slapd[2678]: connection_get(17): got connid=1910 Mar 5 14:14:30 rodster slapd[2678]: connection_read(17): checking for input on id=1910 Mar 5 14:14:30 rodster slapd[2678]: op tag 0x60, time 1362510870 Mar 5 14:14:30 rodster slapd[2678]: conn=1910 op=3 do_bind Mar 5 14:14:30 rodster slapd[2678]: >>> dnPrettyNormal: <> Mar 5 14:14:30 rodster slapd[2678]: <<< dnPrettyNormal: <>, <> Mar 5 14:14:30 rodster slapd[2678]: do_bind: version=3 dn="" method=128 Mar 5 14:14:30 rodster slapd[2678]: send_ldap_result: conn=1910 op=3 p=3 Mar 5 14:14:30 rodster slapd[2678]: send_ldap_result: err=0 matched="" text="" Mar 5 14:14:30 rodster slapd[2678]: send_ldap_response: msgid=4 tag=97 err=0 Mar 5 14:14:30 rodster slapd[2678]: do_bind: v3 anonymous bind This email message is intended for the use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, distribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. Verio Inc. makes no warranty that this email is error or virus free. Thank you.

3 3

Double escaping \ in regex in slapo-constraint directives in slapd.conf
by Tim Watts 05 Mar '13

05 Mar '13

Could someone make sure I'm not going mad before I call this a bug? In slapd.conf: constraint_attribute mail regex ^[^@]+@[a-z0-9\-]+(\.[a-z0-9\-]+)*$ stick this into ldapmodify and it is allowed: replace: mail mail: mrwibble-bble@example#com This looks like the last \. is being parsed to . before the regex engine sees it. With this regex: constraint_attribute mail regex ^[^@]+@[a-z0-9\-]+(\\.[a-z0-9\-]+)*$ the constraint acts on mrwibble-bble@example#com but allows mrwibble-bble(a)example.com which is correct. Is this a bug in the code, a bug in man -S5 slapo-constraint (which does not mention double escaping is necessary) or am I insane? Makes me wonder what is happening with the \- Hmm Both: constraint_attribute mail regex ^[^@]+@[a-z0-9\-]+(\\.[a-z0-9\-]+)*$ and constraint_attribute mail regex ^[^@]+@[a-z0-9\-]+(\\.[a-z0-9\\-]+)*$ accept mrwibble-bble(a)example.c-o-m I'll investigate further is someone would kindly rule out anything I may have overlooked. Cheers, Tim -- Tim Watts Personal Blog: http://squiddy.blog.dionic.net/ http://www.sensorly.com/ Crowd mapping of 2G/3G/4G mobile signal coverage

2 2

Re: Mirror mode and cn=config replication
by John Baker 04 Mar '13

04 Mar '13

Thanks for the reply, gnutls is a pain but we've been able to make it work and the boss hates it when we use source so I'm kind of stuck with it as it is unless I can make a better case than ssl. So mirror mode is really defined by the load balancer in front? I guess this is a bit confusing in the documentation because multi-master has a more complex configuration. As of right now then we are really using multi-master with two servers and the very simple example configuration that's laid out under mirror mode at http://www.openldap.org/doc/admin24/replication.html. But the plan is to upgrade and put load balancing in front. And then we want to use a couple of slaves with limited directories in front of those for constant lookups from services like mail. We are trying to get he benefits of load balancing for heavy writing without having one point of failure for critical services that need a lot of lookups but no writes. I'm testing a setup with the load balancer right now. Can schema changes in cn=config be sent to the the load balancer and slaves as well? On Mon, Mar 4, 2013 at 4:00 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Monday, March 04, 2013 3:39 PM -0500 John Baker <johnnyb(a)marlboro.edu> > wrote: > > Hi, >> >> >> We have been using mirror mode for some time as a simple way for us to >> have an up to date copy in case of a crash and load balancing. We have >> been using the older slapd.conf configuration in Ubntu Hardy and are now >> moving up to 2.4.28 in Ubuntu Precise. >> > > a) Don't use builds provided by Debian/Ubuntu. Build something sane > linked to OpenSSL. > b) Use a current release (2.4.34) > c) There is no difference in configuration between "Mirror Mode" and MMR. > They are the exact same thing configuration wise. The *only* difference is > that with "mirror mode" you use some sort of balancer so that only a single > server is available for writes at a given time. > > --Quanah > > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- John Baker Network Administrator Marlboro College Phone: 451-7551 Cell: 490-0066

2 2

Mirror mode and cn=config replication
by John Baker 04 Mar '13

04 Mar '13

Hi, We have been using mirror mode for some time as a simple way for us to have an up to date copy in case of a crash and load balancing. We have been using the older slapd.conf configuration in Ubntu Hardy and are now moving up to 2.4.28 in Ubuntu Precise. The documentation for N-way multi master mentions that cn=config can be replicated. Can this be done in mirror mode as well? The part I'm particularly trying to figure out is how schema and password policy changes can be sent to both mirrors as well as the proxy and slaves so that we don't have to add ldifs manually an each server. -- John Baker Network Administrator Marlboro College Phone: 451-7551 Cell: 490-0066

2 1

Combining AD and Local DB into single 'virtual' tree
by Mailing Lists 04 Mar '13

04 Mar '13

Hello, I posted a question along these lines a few months ago and received replies, but never understood enough to implement them. I've done more research in the meantime and hopefully have learned enough to ask this question intelligently. I'm working on a project proposal for integrating Linux machines into a Windows environment. The client is very concerned about their AD environment and wants to do as little modification to it as possible (preferably none). What I'd like to propose is that we set up an OpenLDAP server that chains to AD. If possible, I would like to use the OpenLDAP client's credentials to bind to AD instead of having a dedicated user for the OpenLDAP <--> AD connection. I believe this can be accomplished with the 'rebind-as-user' option of the ldap backend (slapd-ldap). Is this correct? Now here's where I think it gets tricky. We also need to be able to store information for the Linux boxes in LDAP (samba winbind mappings for example), but keep it separate from AD. I know that part of this would require a dedicated LDAP database backend (slapd-bdb) to be configured, but what confuses me is how to combine these two separate entities (the AD proxy and this bdb database) into one 'virtual' backend that clients can query against. Is this where slapd-translucent would come into play? Finally, if I want to create OUs in the Linux LDAP database that contain user DNs from AD, is that possible? Any guidance, example solutions, or suggested reading is greatly appreciated. -Dave

3 2

Openldap doesn't force password change and other related problems
by Francesco Belli 04 Mar '13

04 Mar '13

Hello All, I probably have something misconfigured on my openldap server, but it seems that this is not so easy to debug (for me). I use openldap 2.4.23 with ppolicy and accesslog overlays. I have the following behaviours: - when pwdMustChange and pwdReset are set to true, after login, user is not prompted to change the password, however if I run: [def_auditor@localhost fbelli]$ ldapwhoami -x -e ppolicy -D uid=def_auditor,ou=people,dc=pippo,dc=com -w ****** -ZZ -H ldap://mkernel ldap_bind: Success (0); Password must be changed (Password expires in 0 seconds) dn:uid=def_auditor,ou=people,dc=pippo,dc=com - When there are less of pwdExpireWarning seconds and user authenticates (bash shell or ldapsearch), it doesn't get any warning. - When password is expired and user uses one of his pwdGraceAuthNLimit, he doesn't get any warning (but it will get lockedout after). It looks like that for some reason the openldap server doesn't send warnings back to the user. However if user tryes to change the password to one that doesn't match the policy, it gets the correct warnings. Following there is my standard password policy: dn: ou=Policies,dc=aivp,dc=vtp ou: Policies description: Directory policies. objectClass: organizationalUnit dn: cn=Standard,ou=Policies,dc=aivp,dc=vtp cn: Standard description: Standard password policy. pwdAttribute: 2.5.4.35 pwdMinAge: 172800 pwdMaxAge: 5184000 pwdCheckQuality: 1 pwdCheckModule: check_password.so pwdMinLength: 8 pwdExpireWarning: 604800 pwdGraceAuthNLimit: 1 pwdInHistory: 20 pwdLockout: TRUE pwdLockoutDuration: 900 pwdMaxFailure: 3 pwdFailureCountInterval: 1200 pwdMustChange: TRUE objectClass: device objectClass: pwdPolicy objectClass: pwdPolicyChecker Overlay configuration: dn: olcOverlay={2}ppolicy objectClass: olcPPolicyConfig objectClass: olcOverlayConfig olcOverlay: ppolicy olcPPolicyDefault: cn=Standard,ou=Policies,dc=aivp,dc=vtp olcPPolicyUseLockout: TRUE olcPPolicyHashCleartext: TRUE And an example of an user when first inserted: dn: uid=def_auditor,ou=people,dc=aivp,dc=vtp cn: def_auditor gidnumber: 601 homedirectory: /home/def_auditor loginshell: /bin/bash objectclass: account objectclass: posixAccount objectclass: top uid: def_auditor uidnumber: 634 userPassword:: ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ= pwdReset: TRUE Thanks in advance for any advice Best Regards, Francesco Belli

1 0

N-WAY replication cn=config and virtual IP
by Lanfeust troy 04 Mar '13

04 Mar '13

Hi all, today i have a little problem with openldap configuration. I have 2 server configured as N-WAY replication on database and cn=config. into cn=config we have olcServerId: 1 ldap://ldap-int1.domaine.fr olcServerId: 2 ldap://ldap-int2.domaine.fr replication is working. However to provide service to client we want to use a Virtual IP adresse. ( ldap-int-vip.domaine.fr ) On two server i have installed keepalived demon to manage Virtual IP. On nominal time the VIP is owned by ldap-int1 but she can going on ldap-int2 My problem is the slapd binary which don't want to start on secondary server I want to start slapd demon on all interface but if we use ldap://* in command line to start slapd he say: read_config: no serverID / URL match found. Check slapd -h arguments. How to make this configuration ? thanks

1 0

Setting Authentication & Access for ldap backend
by Chris Chipman 03 Mar '13

03 Mar '13

I have three servers running openldap 2.4. On superior server I have all account information. ldap://a.example.com On subordinate server I have an address book. ldap://b.example.com On third server I use an ldap backend to tie the two together. ldap://c.example.com Using 3rd server (ldap://c.example.com) to search and modify, I can authenticate on 1st server (a.example.com). But because no user account information is stored on 2nd server (b.example.com) I can't authenticate, or modify any entries there. My question is, how do I set up the ability to change entries in the subordinate database, if no entries can be bound to? Server One: olcSuffix: dc=example,dc=com olcDatabase: {1}hdb olcDBDirectory: /var/lib/ldap With an entry like so: dn: ou=address,dc=example,dc=com objectClass: extensibleobject objectClass: referral ou: address ref: ldap://b.example.com Server 2: olcReferral: ldap://a.example.com olcSuffix: ou=address,dc=example,dc=com olcDatabase: {1}hdb olcDBDirectory: /var/lib/ldap With an entry: dn: cn=Bob,ou=address,dc=example,dc=com objectClass: inetorgperson cn: Bob gn: Bob sn: Smith Server 3: olcSuffix: dc=example,dc=com olcDatabase: {1}ldap olcDBUri: ldap://a.example.com olcDBRebindAsUser: TRUE olcDBChaseReferrals: TRUE

1 0

Please help: Any way to query host membership in nested ldap groups?
by Gelen James 03 Mar '13

03 Mar '13

Hi all, I have a openldap server setup with netsted netgruops,. Say the netgroups are: ngA: (host1, -, - ), (host2, -, - ) ngB: ngA, (host3, - - ) ngc: ngB, (host4, -, -) Is there a way to find host1's membership? so that it can return: ngA, ngB, ngC? Thanks a lot. --Gelen

1 0

Unable to authenticate via pam_ldap
by Meghanand Acharekar 01 Mar '13

01 Mar '13

I've LDAP production server running over last 1 years without any issues, I'm suddently getting password fail error while authenticating via pam_ldap.so its show following error message, I'm able to authenticate using ldap client utilities like ldapsearch, also via some java application, On client side I got following error message in /var/log/secure Failed password for [username] from xx.xx.xx.xx port 38473 ssh2 fatal: Access denied for user [username] by PAM account configuration On LDAP server logs. => access_allowed: read access denied by auth(=xd) send_search_entry: conn 1711 access to attribute userPassword, value #0 not allowed ACL configuration on LDAP server access to attrs=userPassword by self write by anonymous auth by dn.base="cn=Manager,dc=example,dc=com" write by * none access to attrs=shadowLastChange by self write by * read access to * by self write by dn.base="cn=Manager,dc=example,dc=com" write by * read pam_ldap (/etc/pam.d/system-auth) configuration - client side #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth sufficient pam_ldap.so try_first_pass auth sufficient pam_unix.so nullok use_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth required pam_deny.so account required pam_unix.so broken_shadow account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_ldap.so account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 debug minclass=4 dcredit=-1 ucredit=-1 ocredit=-1 lcredit=0 minlen=8 password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok password sufficient pam_ldap.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session optional pam_mkhomedir.so skel=/etc/skel/ umask=0077 session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_ldap.so The strange thing is I haven't made any changes on server or client side since a long time. Regards, Meghanand N. Acharekar " A proud Linux User " Reg Linux User #397975 ------------------------------------------ The gates in my computer are AND, OR and NOT; they are not Bill..

2 1

OpenLDAP slave-master synchronization problem
by Tian Zhiying 01 Mar '13

01 Mar '13

Hello， I have two openldap servers, and have configured the master-slave synchronization, but have a problem: When an entry in master server is changed it is automatically changed in the slave server. But, when an entry in slave server is changed it is not automatically changed in the master server. In the slave server slapd.conf config file, I've set up “updateref ldap://192.168.100.11:389“ , the 192.168.100.11 is my master server. The following is my configuration. Master Configuration: allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args access to * by * write database bdb suffix "dc=domain,dc=com" rootdn "cn=root,dc=domain,dc=com" overlay ppolicy rootpw {SSHA}DyNIn6rweGRnQP0ntGaZxynMllSA3/w4 directory /var/lib/ldap index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub replogfile /var/lib/ldap/openldap-master-replog loglevel 4095 replica host=192.168.70.15:389 binddn="cn=sa,dc=domain,dc=com" bindmethod=simple credentials=miao3p Slave Configuration: allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args access to * by * write database bdb suffix "dc=domain,dc=com" rootdn "cn=root,dc=domain,dc=com" overlay ppolicy rootpw {SSHA}sgBwprgmRciOEGTLjE5K9J22msm+U9NW directory /var/lib/ldap index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub updatedn "cn=sa,dc=domain,dc=com" updateref ldap://192.168.100.11:389 Any ideas? Thank you very much. Tian Zhiying

3 4

Is there any way to change structuralObjectClass of an LDAP entry?
by Marco Pizzoli 28 Feb '13

28 Feb '13

Hi all, yes, I already know this is not possible. But I have a particular scenario and maybe someone could give advice. In an LDAP tree I inherited some times ago, I have entries created many years ago by using a schema definition which implied an entry to acquire as structuralObjectClass a custom objectClass. This custom objectClass (let's say it's called custObjectClass) inherits from inetOrgPerson and mandates some specific attributes. Now, all entries are created expliciting the following objectClasses: - top - person - organizationalPerson - inetOrgPerson - custObjectClass The outcome is these entries have custObjectClass as structuralObjectClass. Now, I would like to make some cleaning on this tree, and I would like to change some schema definition on objects. First of all, I would like to NOT have custObjectClass as structuralObjectClass. Obviously I could slapcat my slapd engine, change the ldif and then re-import as new. But I would prefer to not switch off my slapd engine in the meantime. I can't afford that, to be honest... One idea I had was to create a replica consumer, change on it the schema definition (custObjectClass inheriting from TOP and being auxiliary instead of structural), and let the replication create the entries with the correct "structurality". I self-discovered this way is not viable, considering OL refuses to insert an entry with source structuralObjectClass not being defined structural on the slave as well. Now I'm asking for help to the community. Any hint welcome. How would you do? Thanks in advance Marco

2 1

additional info: objectClasses: value #0 invalid per syntax
by Jimmy Royer 28 Feb '13

28 Feb '13

Hello, I am starting out with openldap and I don't know it that much. I got the error mentioned in the title when trying to add an object class, which is apparently a very common one per my google searches. I've read that common causes are: * extraneous white space (especially trailing white space) * improperly encoded characters (LDAPv3 uses UTF-8 encoded Unicode) * empty values (few syntaxes allow empty values) This is the object class file I am trying to add, I picked it as an example on some website, to have something minimal and make it easier to test: # cat exObjectClasses.ldif dn: cn=schema changetype: modify add: objectClasses objectClasses: ( 2.16.840.1.113730.3.2.2.9 NAME 'blogger' DESC 'Someone who has a blog' SUP inetOrgPerson STRUCTURAL MAY blog ) I've checked if there was any trailing spaces at the end with the following: # cat -vte exObjectClasses.ldif dn: cn=schema$ changetype: modify$ add: objectClasses$ objectClasses: ( 2.16.840.1.113730.3.2.2.9$ NAME 'blogger'$ DESC 'Someone who has a blog'$ SUP inetOrgPerson STRUCTURAL$ MAY blog )$ I've made sure the file is UTF-8: # iconv -f ASCII -t UTF-8 exObjectClasses.ldif > exObjectClasses.ldif.utf8 And I don't think there are any empty values defined in the LDIF file. So when I type this command, I still have the "invalid per syntax error: # ldapmodify -x -W -H "ldaps://127.0.0.1" -D cn=Manager,dc=modelsolv,dc=com -f exObjectClasses.ldif Enter LDAP Password: modifying entry "cn=schema" ldap_modify: Invalid syntax (21) additional info: objectClasses: value #0 invalid per syntax This is the content of the /etc/openldap/slapd.conf file: # cat slapd.conf # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/corba.schema include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/duaconf.schema include /etc/openldap/schema/dyngroup.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/java.schema include /etc/openldap/schema/misc.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/ppolicy.schema include /etc/openldap/schema/collective.schema # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Load dynamic backend modules # - modulepath is architecture dependent value (32/64-bit system) # - back_sql.la overlay requires openldap-server-sql package # - dyngroup.la and dynlist.la cannot be used at the same time # modulepath /usr/lib/openldap # modulepath /usr/lib64/openldap # moduleload accesslog.la # moduleload auditlog.la # moduleload back_sql.la # moduleload chain.la # moduleload collect.la # moduleload constraint.la # moduleload dds.la # moduleload deref.la # moduleload dyngroup.la # moduleload dynlist.la # moduleload memberof.la # moduleload pbind.la # moduleload pcache.la # moduleload ppolicy.la # moduleload refint.la # moduleload retcode.la # moduleload rwm.la # moduleload seqmod.la # moduleload smbk5pwd.la # moduleload sssvlv.la # moduleload syncprov.la # moduleload translucent.la # moduleload unique.la # moduleload valsort.la # The next three lines allow use of TLS for encrypting connections using a # dummy test certificate which you can generate by running # /usr/libexec/openldap/generate-server-cert.sh. Your client software may balk # at self-signed certificates, however. TLSCACertificatePath /etc/openldap/certs TLSCertificateFile "\"OpenLDAP Server\"" TLSCertificateKeyFile /etc/openldap/certs/password # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! # enable on-the-fly configuration (cn=config) database config access to * by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * none # enable server status monitoring (cn=monitor) database monitor access to * by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.exact="cn=Manager,dc=my-domain,dc=com" read by * none ####################################################################### # database definitions ####################################################################### database bdb suffix "dc=modelsolv,dc=com" checkpoint 1024 15 rootdn "cn=Manager,dc=modelsolv,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw SECRET # rootpw {crypt}ijFYNcSNctBYg # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub # Replicas of this database #replogfile /var/lib/ldap/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com(a)EXAMPLE.COM I was able to add a few entries in LDAP so far. So I know I am able to reach the server, the connection is fine, and LDAP is somewhat functional. But I can't modify the schema with objectclasses. Is there anything obvious that I am doing wrong? Do you have any recommendation for debugging further? Regards, Jimmy Royer

4 4

Limit on number of attrs in replica conf?
by Marco Pizzoli 28 Feb '13

28 Feb '13

Hi all, Is it possible I discovered a limit on the number of attributes I can specify on the "attrs" parameter of the replica directive in slapd.conf? In my config file, for the replica directive, I explicited a long list of attributes. On the provider side I can see, on the provider slapd logs, that only 8 of the attrs I specified on the replica directive are actually asked. Plus objectClass, structuralObjectClass and entryCSN. Is that the expected behaviour? I already checked on the man page and I don't see this limitation explicited Thanks in advance Marco

1 1

internal_modify in overlays
by Tim Watts 28 Feb '13

28 Feb '13

Hi, Does anyone know of a bit of code I can look at that does an *internal* (completed inline) LDAP_MOD_REPLACE operation on one attribute without chaining (ie it does a return 0)? I've found Sun docs for doing this in a slapi plugin but not an openldap slapd plugin. Reason: Basically, I've been hacking on smbkrb5pwd.c and discovered if I do a "return 0;" at the end, I can prevent chaining (not documented but found some openldap hacking - denyop.c - that demonstrated this). At this point, smbkrb5pwd.c has changed our MIT Kerberos principal's password, and "return 0" prevenrs_modsts slapd from chaining onto the code that tries to set a local hash into userPassword. And it does it without causing a nasty client error. I thought: would it not be nice to set userPassword: to {SASL}UID(a)KERB.REALM now... Each user's auth method gets switched upon the first successful password change that propagates to kerberos. However, all the existing overlays seem to set extra attributes by setting up a request in ->rs_mods off the original request. I assume these get actioned after a "return SLAP_CB_CONTINUE". So - how do set an attribute if we are halting the chain at our overlay? Cheers :) Tim -- Tim Watts Personal Blog: http://squiddy.blog.dionic.net/ http://www.sensorly.com/ Crowd mapping of 2G/3G/4G mobile signal coverage

2 2

Re: meta backend subtree directive ignored by conversion to cn=config
by francesco.policastro＠selex-es.com 28 Feb '13

28 Feb '13

I see. So I need to look at ACL, because my real meta configuration contains two trees coming from different forests, sharing nothing. It's the result of a merge of two companies, each with its AD, and I use OpenLDAP to authenticate users against a single meta domain, after a long job to rename many users who just shared the only object I did not want, i.e. the sAMAccountNname. Thanks, Francesco

1 0

Re: meta backend subtree directive ignored by conversion to cn=config
by Pierangelo Masarati 27 Feb '13

27 Feb '13

> Sorry! > I mistyped the uri where the user is found (this happens because I saw > this behaviour on the real configuration and I had to massage it). > The search command, issued from the openldap server itself, is: > > ldapsearch -xLLL -H ldap:/// -D ""cn=LdapBindUser,dc=newco,dc=com" -w > secret1 -E pr=647/noprompt -b 'DC=newco,DC=com' 'sn=policastro' dn > > I find two records, one correct and one unexpected: > > dn: cn=Policastro > Francesco,ou=Users,ou=2nd-location,dc=first,dc=newco,dc=com" (matches the > line marked with *) > > dn: cn=Policastro Francesco,ou=UsersDisable,dc=second,dc=newco,dc=com OK, I got the point. You're probably misusing this feature. If you want to prevent a portion of the subtree from being returned, you need to use ACL. The subtree-{in|ex}clude is only used during candidate selection. This means that it is used while deciding whether or not an operation must be propagated to a specific target. For example, let's say that target #1 is rooted at "ou=Sub 1,dc=org", and target #2 is rooted at "dc=org", and it is known that target #2 does not contain a subtree named "ou=Sub 1,dc=org", adding subtree-exclude "ou=Sub 1,dc=org" to target #2 prevents searches whose searchBase is (a subordinate of) "ou=Sub 1,dc=org" to span target #2 in addition to target #1. p. -- Pierangelo Masarati Associate Professor Dipartimento di Scienze e Tecnologie Aerospaziali Politecnico di Milano

1 0

Re: meta backend subtree directive ignored by conversion to cn=config
by francesco.policastro＠selex-es.com 27 Feb '13

27 Feb '13

Sorry! I mistyped the uri where the user is found (this happens because I saw this behaviour on the real configuration and I had to massage it). The search command, issued from the openldap server itself, is: ldapsearch -xLLL -H ldap:/// -D ""cn=LdapBindUser,dc=newco,dc=com" -w secret1 -E pr=647/noprompt -b 'DC=newco,DC=com' 'sn=policastro' dn I find two records, one correct and one unexpected: dn: cn=Policastro Francesco,ou=Users,ou=2nd-location,dc=first,dc=newco,dc=com" (matches the line marked with *) dn: cn=Policastro Francesco,ou=UsersDisable,dc=second,dc=newco,dc=com Francesco Policastro From: Pierangelo Masarati <masarati(a)aero.polimi.it> To: <openldap-technical(a)openldap.org> Date: 27/02/2013 10:36 Subject: Re: meta backend subtree directive ignored by conversion to cn=config Sent by: <openldap-technical-bounces(a)OpenLDAP.org> On 02/26/2013 02:19 PM, francesco.policastro(a)selex-es.com wrote: > Even worse: if I start the server using slapd.conf, not cn=config, the > subtree-include directives seem to be ignored. > With reference to the previously attached file if I search users from the > root ( "dc=newco,dc=com") I find them also outside the included subtrees; > e.g I find users under "ou=UsersDisable, > ou=Users,ou=2nd-location,dc=first,dc=newco,dc=com". > Is it there anything wrong in my config file? Did I misunderstand the > directive? According to your configuration file, whose relevant directives I summarized below, the entry "ou=UsersDisable,ou=Users,ou=2nd-location,dc=first,dc=newco,dc=com" matches the 3rd subtree-include of the 1st target (marked with [*]). So it seems to behave as intended. p. ----- database meta suffix "dc=newco,dc=com" ... uri "ldap://server1.it.domain1.com/dc=first,dc=newco,dc=com" ... subtree-include "ou=Applications,ou=Groups Shared,dc=first,dc=newco,dc=com" subtree-include "ou=Users,ou=1st-location,dc=first,dc=newco,dc=com" subtree-include "ou=Users,ou=2nd-location,dc=first,dc=newco,dc=com" [*] subtree-include "ou=Users,ou=3rd-location,dc=first,dc=newco,dc=com" ... uri "ldap://server2.domain2.net/ou=organizationalUnit,dc=second,dc=newco,dc=com" ... subtree-include "ou=Users,ou=1st-location,ou=organizationalUnit,dc=second,dc=newco,dc=com" subtree-include "ou=My-ou,ou=1st-location,ou=organizationalUnit,dc=second,dc=newco,dc=com" subtree-include "ou=Remote Sites,ou=organizationalUnit,dc=second,dc=newco,dc=com" -- Pierangelo Masarati Associate Professor Dipartimento di Scienze e Tecnologie Aerospaziali Politecnico di Milano

1 0

N-Way Multimaster with syncrepl and delta-repl -- slapd stops responding
by Robert W. Smith 27 Feb '13

27 Feb '13

Hi, I am running a 4-way multi-master configuration with a number of slaves in remote locations. I am currently running openldap 2.4.33 on top of CentOS 6.3 (I built 2.4.33 from a modified base centos 6 spec file). I was originally running the centos base openldap 2.4.23 using N-way multimaster using the syncrepl configuration but I was having problems with the masters and slaves staying in perfect sync--other than this 2.4.23 was running stably since last spring. I'll try to be brief in what has happened since Feb 1. * I upgraded the 4 masters to 2.4.33 and kept the syncrepl configuration. The syncrepl masters were using RefreshAndPersist while the slave consumers were using RefreshOnly. * After the upgrade the 2.4.33 masters began locking up, not refusing connections, but not returning queries--this would happen 3-4 per day. When one master locked all the masters would lock. Slaves appear to not be affected by this. * I downgraded back 2.4.23 in all of the masters only to have the lock-ups continue. * I slapcat'ed the database on one master and blew away the databases on all the other masters and slaves and rebuilt everything. I rebuilt one master and one slave and rsync'ed the slapd.d directory where needed. Then I started each master one-by-one to validate that they mirrored the databases correctly. Then I repeated this on the slaves. Unfortunately the masters would continue to lock up as above. * So, seeing that the lock-ups were occurring regardless of the openldap version I decided to go back to 2.4.33 and make the move to delta-replication. * This past weekend I finally got delta-replication working. I did the slapcat-rebuild slapd.d-slapadd on one master and rsync'ed slapd.d to each master one at a time. All was well and all databases were in perfect sync. * Unfortunately the masters would continue to lock, accepting connections but never servicing the request so all queries would hang. Looking at this again today I noticed that my masters were all running at near 100% CPU but continuing to service queries. Depending on the # of CPUs only one or two threads would be running this high. Using strace -tt -p <pid-ofthread>, this is what would be spewing out: 18:52:05.713266 sched_yield() = 0 18:52:05.713323 sched_yield() = 0 18:52:05.713380 sched_yield() = 0 18:52:05.713438 sched_yield() = 0 18:52:05.713495 sched_yield() = 0 18:52:05.713553 sched_yield() = 0 18:52:05.713611 sched_yield() = 0 18:52:05.713668 sched_yield() = 0 18:52:05.713726 sched_yield() = 0 18:52:05.713783 sched_yield() = 0 18:52:05.713840 sched_yield() = 0 18:52:05.713898 sched_yield() = 0 I haven't correlated this to the slapd daemons hanging, yet. There is nothing interesting in the logs when the slapd daemons would hang. Again when one master hangs they all would hang. I would restart each master one by one and on occasions when one master restarted the others would start servicing again. Other times it would take two or three restarts to get all of the masters servicing again. The only gain with delta-replication is that they only hang once a day now and usually after I had gone home. For now I have implemented a small script that is run from cron every two minutes to test the slapd daemons if they are hung doing a simple ldapsearch and if so then restart the slapd daemon. This is done on all four masters. My database is not large at all with only ~100 users but it is critical as it is the backend authentication for everything including the remote access. Here is the slapcat of my cn=config database (minus the schemas and operational attributes). It is a fairly typical delta-replication configuration. The accesslogs use hdb as that is what most (all) of the accesslogs examples show. The main database is bdb. Any suggestions would be greatly appreciated. Regards, Bob --bs dn: cn=config objectClass: olcGlobal cn: config olcConfigFile: slapd.conf olcConfigDir: slapd.d olcArgsFile: /var/run/openldap/slapd.args olcAttributeOptions: lang- olcAuthzPolicy: none olcConcurrency: 0 olcConnMaxPendingAuth: 1000 olcGentleHUP: FALSE olcIdleTimeout: 0 olcIndexSubstrIfMaxLen: 4 olcIndexSubstrIfMinLen: 2 olcIndexSubstrAnyLen: 4 olcIndexSubstrAnyStep: 2 olcIndexIntLen: 4 olcLocalSSF: 71 olcPidFile: /var/run/openldap/slapd.pid olcReadOnly: FALSE olcSaslSecProps: noplain,noanonymous olcSecurity: tls=1 olcServerID: 1 ldap://auth1noc.man.o3b.local olcServerID: 2 ldap://auth2noc.man.o3b.local olcServerID: 3 ldap://auth1noc.btz.o3b.local olcServerID: 4 ldap://auth2noc.btz.o3b.local olcServerID: 5 ldap://auth1gw.nma.o3b.local olcServerID: 6 ldap://auth2gw.nma.o3b.local olcServerID: 7 ldap://auth1gw.sun.o3b.local olcServerID: 8 ldap://auth2gw.sun.o3b.local olcServerID: 9 ldap://auth1gw.per.o3b.local olcServerID: 10 ldap://auth2gw.per.o3b.local olcSockbufMaxIncoming: 262143 olcSockbufMaxIncomingAuth: 16777215 olcThreads: 16 olcTLSCipherSuite: HIGH:MEDIUM:SSLv2 olcTLSCertificateFile: /etc/openldap/cacerts/auth-o3b.crt olcTLSCertificateKeyFile: /etc/openldap/cacerts/auth-o3b.key olcTLSCRLCheck: none olcToolThreads: 1 olcWriteTimeout: 0 olcTLSCACertificateFile: /etc/pki/tls/certs/o3b-master-ca.crt olcTLSVerifyClient: never olcLogLevel: sync olcConnMaxPending: 101 dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib64/openldap olcModuleLoad: {0}syncprov.la olcModuleLoad: {1}memberof.la olcModuleLoad: {2}ppolicy.la olcModuleLoad: {3}accesslog.la dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAccess: {0}to dn.base="" by * read olcAccess: {1}to dn.subtree="cn=monitor" by dn.base="cn=rootdn,dc=o3bnetworks .net" read olcAccess: {2}to dn.base="cn=subschema" by * read olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 0 olcReadOnly: FALSE olcSchemaDN: cn=Subschema olcSecurity: tls=1 olcMonitoring: FALSE olcPasswordHash: {SSHA} dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.base="cn=rootdn,dc=o3bnetworks.net" write by dn.bas e="cn=syncdn,dc=o3bnetworks.net" read by * none olcAddContentAcl: TRUE olcLastMod: TRUE olcLimits: {0}dn.base="cn=rootdn,dc=o3bnetworks.net" size=unlimited time=unli mited olcLimits: {1}dn.base="cn=syncdn,dc=o3bnetworks.net" size=unlimited time=unli mited olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=config olcMirrorMode: TRUE olcMonitoring: FALSE olcRootPW:: *** olcSyncrepl: {0}rid=001 provider=ldap://auth1noc.man.o3b.local bindmethod=simp le binddn="cn=syncdn,dc=o3bnetworks.net" credentials="33jJ9nSkSD" keepalive=0 :5:0 starttls=yes tls_reqcert=allow tls_cipher_suite=HIGH:MEDIUM:SSLv2 search base="cn=config" scope=sub schemachecking=off type=refreshAndPersist retry="5 5 300 +" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)( reqResult=0))" syncdata=accesslog olcSyncrepl: {1}rid=002 provider=ldap://auth2noc.man.o3b.local bindmethod=simp le binddn="cn=syncdn,dc=o3bnetworks.net" credentials="33jJ9nSkSD" keepalive=0 :5:0 starttls=yes tls_reqcert=allow tls_cipher_suite=HIGH:MEDIUM:SSLv2 search base="cn=config" scope=sub schemachecking=off type=refreshAndPersist retry="5 5 300 +" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)( reqResult=0))" syncdata=accesslog olcSyncrepl: {2}rid=003 provider=ldap://auth1noc.btz.o3b.local bindmethod=simp le binddn="cn=syncdn,dc=o3bnetworks.net" credentials="33jJ9nSkSD" keepalive=0 :5:0 starttls=yes tls_reqcert=allow tls_cipher_suite=HIGH:MEDIUM:SSLv2 search base="cn=config" scope=sub schemachecking=off type=refreshAndPersist retry="5 5 300 +" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)( reqResult=0))" syncdata=accesslog olcSyncrepl: {3}rid=004 provider=ldap://auth2noc.btz.o3b.local bindmethod=simp le binddn="cn=syncdn,dc=o3bnetworks.net" credentials="33jJ9nSkSD" keepalive=0 :5:0 starttls=yes tls_reqcert=allow tls_cipher_suite=HIGH:MEDIUM:SSLv2 search base="cn=config" scope=sub schemachecking=off type=refreshAndPersist retry="5 5 300 +" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)( reqResult=0))" syncdata=accesslog dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {1}syncprov olcSpCheckpoint: 1000 60 dn: olcOverlay={1}accesslog,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcAccessLogConfig olcOverlay: {1}accesslog olcAccessLogDB: cn=accesslog olcAccessLogOps: writes olcAccessLogSuccess: TRUE olcAccessLogPurge: 2+00:00 1+00:00 dn: olcDatabase={1}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcConfig objectClass: top objectClass: olcHdbConfig olcDbDirectory: /var/lib/ldap/accesslog olcSuffix: cn=accesslog olcDbConfig: [Deleted] aXIgLXEgb3B0aW9uKS4g olcAddContentAcl: FALSE olcDbCacheFree: 1 olcDbCacheSize: 1000 olcAccess: {0}to * by self write by dn.base="cn=rootdn,dc=o3bnetworks.net" r ead by dn.base="cn=authdn,dc=o3bnetworks.net" read by dn.base="cn=syncdn,dc= o3bnetworks.net" read olcDbDirtyRead: FALSE olcDbIDLcacheSize: 0 olcDbDNcacheSize: 0 olcDbIndex: default eq olcMaxDerefDepth: 15 olcLimits: {0}dn.base="cn=syncdn,dc=o3bnetworks.net" size=unlimited time=unli mited olcDbSearchStack: 16 olcLastMod: TRUE olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbNoSync: FALSE olcDbShmKey: 0 olcReadOnly: FALSE olcSecurity: tls=1 olcRootDN: cn=accesslogdn olcDatabase: {1}hdb dn: olcOverlay={0}syncprov,olcDatabase={1}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpNoPresent: TRUE olcSpReloadHint: TRUE dn: olcDatabase={3}monitor,cn=config objectClass: olcDatabaseConfig olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=monitor,cn=Monitor olcRootPW:: bW9uaXRvcg== olcSecurity: tls=1 olcMonitoring: FALSE olcDatabase: {3}monitor dn: olcDatabase={3}bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcSuffix: dc=o3bnetworks.net olcAddContentAcl: FALSE olcLastMod: TRUE olcLimits: {0}dn.base="cn=syncdn,dc=o3bnetworks.net" size=unlimited time=unli mited olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=rootdn,dc=o3bnetworks.net olcRootPW:: *** olcSecurity: tls=1 olcMirrorMode: TRUE olcMonitoring: TRUE olcDbDirectory: /var/lib/ldap olcDbConfig: [Deleted] olcDbNoSync: FALSE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 0 olcDbIndex: objectClass pres,eq olcDbIndex: cn pres,eq,sub olcDbIndex: uid pres,eq,sub olcDbIndex: uidNumber pres,eq olcDbIndex: gidNumber pres,eq olcDbIndex: memberUid pres,eq,sub olcDbIndex: displayName pres,eq,sub olcDbIndex: sambaSID pres,eq,sub olcDbIndex: sambaDomainName pres,eq olcDbIndex: sambaGroupType pres,eq olcDbIndex: ou pres,eq,sub olcDbIndex: sambaSIDList pres,eq olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 olcAccess: {0}to * by self write by group/groupOfNames/member.exact="cn=ldap admins,dc=o3bnetworks.net" write by dn.base="cn=authdn,dc=o3bnetworks.net" r ead by dn.base="cn=syncdn,dc=o3bnetworks.net" read by users read by anonym ous read olcDbCacheSize: 1000 olcDatabase: {3}bdb olcSyncrepl: {0}rid=011 provider=ldap://auth1noc.man.o3b.local bindmethod=simp le binddn="cn=syncdn,dc=o3bnetworks.net" credentials="33jJ9nSkSD" keepalive=0 :5:0 starttls=yes tls_reqcert=allow tls_cipher_suite=HIGH:MEDIUM:SSLv2 search base="dc=o3bnetworks.net" scope=sub schemachecking=off type=refreshAndPersist retry="5 5 300 +" logbase="cn=accesslog" logfilter="(&(objectClass=auditWrit eObject)(reqResult=0))" syncdata=accesslog olcSyncrepl: {1}rid=012 provider=ldap://auth2noc.man.o3b.local bindmethod=simp le binddn="cn=syncdn,dc=o3bnetworks.net" credentials="33jJ9nSkSD" keepalive=0 :5:0 starttls=yes tls_reqcert=allow tls_cipher_suite=HIGH:MEDIUM:SSLv2 search base="dc=o3bnetworks.net" scope=sub schemachecking=off type=refreshAndPersist retry="5 5 300 +" logbase="cn=accesslog" logfilter="(&(objectClass=auditWrit eObject)(reqResult=0))" syncdata=accesslog olcSyncrepl: {2}rid=013 provider=ldap://auth1noc.btz.o3b.local bindmethod=simp le binddn="cn=syncdn,dc=o3bnetworks.net" credentials="33jJ9nSkSD" keepalive=0 :5:0 starttls=yes tls_reqcert=allow tls_cipher_suite=HIGH:MEDIUM:SSLv2 filter ="(objectclass=*)" searchbase="dc=o3bnetworks.net" scope=sub schemachecking=o ff type=refreshAndPersist retry="5 5 300 +" logbase="cn=accesslog" logfilter= "(&(objectClass=auditWriteObject)(reqResult=0))" syncdata=accesslog olcSyncrepl: {3}rid=014 provider=ldap://auth2noc.btz.o3b.local bindmethod=simp le binddn="cn=syncdn,dc=o3bnetworks.net" credentials="33jJ9nSkSD" keepalive=0 :5:0 starttls=yes tls_reqcert=allow tls_cipher_suite=HIGH:MEDIUM:SSLv2 filter ="(objectclass=*)" searchbase="dc=o3bnetworks.net" scope=sub schemachecking=o ff type=refreshAndPersist retry="5 5 300 +" logbase="cn=accesslog" logfilter= "(&(objectClass=auditWriteObject)(reqResult=0))" syncdata=accesslog dn: olcOverlay={0}memberof,olcDatabase={3}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcMemberOf olcOverlay: {0}memberof olcMemberOfDangling: ignore olcMemberOfRefInt: FALSE dn: olcOverlay={1}syncprov,olcDatabase={3}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {1}syncprov olcSpCheckpoint: 1000 60 dn: olcOverlay={2}ppolicy,olcDatabase={3}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top objectClass: olcPPolicyConfig olcOverlay: {2}ppolicy olcPPolicyDefault: cn=O3b,ou=Password,ou=Policy,dc=o3bnetworks.net dn: olcOverlay={3}accesslog,olcDatabase={3}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcAccessLogConfig olcOverlay: {3}accesslog olcAccessLogOps: writes olcAccessLogSuccess: TRUE olcAccessLogDB: cn=accesslog olcAccessLogPurge: 2+00:00 1+00:00

3 5

slapo-rwm intercept and maasage an attribute?
by Tim Watts 27 Feb '13

27 Feb '13

Hi, Following on from SASL/EXOP password related issues, I'd like to try something. When an EXOP PASS MOD happens, I'd like to catch it before it updates userPassword: in the hdb backend and chance the data to {SASL}<uid>@FIXED.REALM.NAME I've been through the slapo-rwm man page several times and all over google and I'm more confused that I was to start with. Could anyone give me a hint please? 2 problems: What context does this update happen in? Is it a exopPasswdDN context or a modifyAttrDN context? Bearing in mind I want to catch where the Password Modify EXOP goes to write the userPassword entry. How do I pull the uid of the current bind doing the password change? I'm guessing it is a $ parameter defref, but I do not see any examples? Many thanks, Tim BTW, if there's a better mailing list for "user" questions I'll happily bugger off there :) -- Tim Watts Personal Blog: http://www.dionic.net/tim/ "It would be better to live under robber barons than under omnipotent moral busybodies."

3 4

Re: meta backend subtree directive ignored by conversion to cn=config
by Pierangelo Masarati 27 Feb '13

27 Feb '13

On 02/26/2013 02:19 PM, francesco.policastro(a)selex-es.com wrote: > Even worse: if I start the server using slapd.conf, not cn=config, the > subtree-include directives seem to be ignored. > With reference to the previously attached file if I search users from the > root ( "dc=newco,dc=com") I find them also outside the included subtrees; > e.g I find users under "ou=UsersDisable, > ou=Users,ou=2nd-location,dc=first,dc=newco,dc=com". > Is it there anything wrong in my config file? Did I misunderstand the > directive? According to your configuration file, whose relevant directives I summarized below, the entry "ou=UsersDisable,ou=Users,ou=2nd-location,dc=first,dc=newco,dc=com" matches the 3rd subtree-include of the 1st target (marked with [*]). So it seems to behave as intended. p. ----- database meta suffix "dc=newco,dc=com" ... uri "ldap://server1.it.domain1.com/dc=first,dc=newco,dc=com" ... subtree-include "ou=Applications,ou=Groups Shared,dc=first,dc=newco,dc=com" subtree-include "ou=Users,ou=1st-location,dc=first,dc=newco,dc=com" subtree-include "ou=Users,ou=2nd-location,dc=first,dc=newco,dc=com" [*] subtree-include "ou=Users,ou=3rd-location,dc=first,dc=newco,dc=com" ... uri "ldap://server2.domain2.net/ou=organizationalUnit,dc=second,dc=newco,dc=com" ... subtree-include "ou=Users,ou=1st-location,ou=organizationalUnit,dc=second,dc=newco,dc=com" subtree-include "ou=My-ou,ou=1st-location,ou=organizationalUnit,dc=second,dc=newco,dc=com" subtree-include "ou=Remote Sites,ou=organizationalUnit,dc=second,dc=newco,dc=com" -- Pierangelo Masarati Associate Professor Dipartimento di Scienze e Tecnologie Aerospaziali Politecnico di Milano

1 0

Jim Vanes
by Jim Vanes 26 Feb '13

26 Feb '13

   http://www.locksmithsbethnalgreen.com/va/bm9wtj55qrblk7e27s4pn.gs39g?assmdd…   Jim Vanes2/26/2013 6:23:42 PM

1 0

Re: meta backend subtree directive ignored by conversion to cn=config
by francesco.policastro＠selex-es.com 26 Feb '13

26 Feb '13

Even worse: if I start the server using slapd.conf, not cn=config, the subtree-include directives seem to be ignored. With reference to the previously attached file if I search users from the root ( "dc=newco,dc=com") I find them also outside the included subtrees; e.g I find users under "ou=UsersDisable, ou=Users,ou=2nd-location,dc=first,dc=newco,dc=com". Is it there anything wrong in my config file? Did I misunderstand the directive? Thanks, Francesco Policastro

1 0

slapd, SASL passthrough and changing passwords smashing userPassword
by Tim Watts 25 Feb '13

25 Feb '13

Hi folks, I hope this is a quick and easy one :) I have slapd 2.4.23 working with passthrough to MIT kerberos via saslauthd. I use smbkrb5pwd (a hack on smbk5pwd) to pass password changes through to kerberos (creating or modifying the target principle as required) To enable a particular user to bind to slapd with their kerberos password, I'm setting: userPassword: {SASL}myuid(a)MY.KERBEROS.REALM.EXAMPLE.COM This works *very nicely*. Except one thing... Using passwd via pam_ldap or ldappasswd directly smashes userPassword: and replaces the value with the password hash. Both machanisms are doing EXOP password changes. Is there any way to stop this happening when the mechanism in userPassword is {SASL} ? Or maybe there is another way to enable global SASL password passthroughs? ====== I'm in a transition phase. I need to import the slapcat output from the old LDAP server to my new one. At this point, all authentication should be done with the existing userPassword hash. Password changes should update this hash and create/modify principles on the kerberos server. 3 months later, I want to switch the auth mechanism on all accounts to passthrough to kerberos, at which point, ldappasswd should still work but via smbkrb5pwd updating kerberos. Maybe my strategy is wrong, but that's the basic problem I need to solve. Am I trying this the wrong way? Cheers and thanks in advance for any ideas. Tim -- Tim Watts Personal Blog: http://www.dionic.net/tim/ "She got her looks from her father. He's a plastic surgeon."

3 4

Access permissions to add new entries
by Philip Colmer 25 Feb '13

25 Feb '13

Hi I wanted to run a scenario past everyone to see if there is a better approach to the one I am thinking of implementing. The OU structure we have is: +- dc=example,dc=com +-- ou=accounts +--- ou=subsidiary1 +--- ou=subsidiary2 +--- ou=special +--- ou=staff +--- ou=the-rest I have two groups defined - one group needs to be able to create new entries under the staff OU, and the other group needs to be able to create new entries under the OUs subsidiary1, subsidiary2 and the-rest. Nobody (except for LDAP admin) should be able to create entries under OU special. More specifically, I want group members to be able to *add* new entries but modification and deletion of entries should only be done by the LDAP admin. I *may* want to allow group members to modify entries in the future but certainly just add for now. A couple of notes about subsidiary1/subsidiary2: * they aren't really called that :-) * more will get added over time, with corresponding changes in permissions required. In other words, I can't use a regex to match against "subsidiary", but I want an ACL implementation that, if possible, can cope with future OUs being created without modifying the ACLs. So, my thinking is: 1. Have an ACL that blocks write access to "special". 2. Have an ACL that grants write access to "staff" for members of the staff account managers group. 3. Have one ACL that grants write access to all other OUs for members of the non-staff account managers group. If that makes sense ... access to dn.exact="ou=special,ou=accounts,dc=example,dc=com" attrs=children by * none access to dn.exact="ou=staff,ou=accounts,dc=example,dc=com" attrs=children by group="cn=account-mgrs-staff,ou=mailing,ou=groups,dc=example,dc=com" add by * none access to dn.sub="ou=staff,ou=accounts,dc=example,dc=com" attrs=entry by group="cn=account-mgrs-staff,ou=mailing,ou=groups,dc=example,dc=com" add by * none How do I do the rules for the other OUs? Can I have just two rules? One to allow access to the children attribute and one to allow access to the entry attribute? If so, it would need to be on the OUs *beneath* ou=accounts so that members of the group cannot create entries within ou=accounts. So would this work? access to dn.one="ou=accounts,dc=example,dc=com" attrs=children by group="cn=account-mgrs-non-staff,ou=mailing,ou=groups,dc=example,dc=com" add by * none access to dn.sub="ou=accounts,dc=example,dc=com" attrs=entry by group="cn=account-mgrs-non-staff,ou=mailing,ou=groups,dc=example,dc=com" add by * none I'm not sure if members of account-mgrs-non-staff would be blocked from adding to ou=staff ... Suggestions or help appreciated. Regards Philip

1 0

ppolicy overlay with sasl bind
by General Stone 24 Feb '13

24 Feb '13

Hello, can I use the ppolicy overlay wtih sasl binds? It seems, that it dosn't work?! Greetings Markus -- Key fingerprint = A0D9 F306 0FC0 30E7 62DB E785 A192 2A30 5CF1 224D ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Die Theorie ist immer nur so gut wie ihre Praxis. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 1

RE24 testing call (OpenLDAP 2.4.34)
by Quanah Gibson-Mount 23 Feb '13

23 Feb '13

If you know how to build OpenLDAP manually, and would like to participate in testing the next set of code for the 2.4.34 release, please do so. Generally, get the code for RE24: <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> Configure & build. Execute the test suite (via make test) after it is built. Thanks! --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

4 14

new module overlay modtrigger
by Maarten Vanraes 22 Feb '13

22 Feb '13

Hey, a few years back i wrote an overlay module "modtrigger", that executes a script on modifications. Some of the comments i got was that it should really require to work with the new config structure. Finally i've done that, but i'm sure it could be improved. So, i'm kind of asking if someone can review it and give some pointers to improve. and next if it's possible to include in the openldap distribution, in the overlay section or contrib section.

2 4

slapd ACL to allow Password Modify exop by ldappasswd - but deny direct modification via ldapmodify
by Tim Watts 22 Feb '13

22 Feb '13

Hi, I've been through google and the man pages - no avail. If anyone can help, I'd be very grateful :) slapd.conf acl: access to attrs=userPassword by peername.path="/var/run/slapd/ldapi" manage by dn="cn=admin,dc=dighum,dc=kcl,dc=ac,dc=uk" manage by self write by * auth This allows ldappasswd to work, but of course, it also allows anybody to issue an ldapmodify against their own record and store a weak hash (eg {crypt} ) or worse, bypass my check_password plugin policy enforcer. Removing the "self write" line kills ldapmodify, but also seems to break the password modify exop issues by ldappasswd. So - how do I allow ldappasswd to work (which respects the policies and allows the server to hash the password using its default hash - SSHA1 in my case) whilst disallowing *direct* modify access to the userPassword: entry? Answers on a postcard, or a wet herring as appropriate :-| Many thanks! Tim -- Tim Watts Personal Blog: http://squiddy.blog.dionic.net/ http://www.sensorly.com/ Crowd mapping of 2G/3G/4G mobile signal coverage

1 1

ppolicy pwdCheckModule failure and still calling other overlays
by Tim Watts 21 Feb '13

21 Feb '13

I realise this is a long shot, but if pwdCheckModule is enabled in ppolicy AND the module it calls FAILS a prospective password (for being too weak) - should slapd actually be calling the next overlay in the stack?? Common sense says ppolicy should bomb out? Here are the overlay configs in slapd.conf: <backend hdb database stuff> overlay smbkrb5pwd smbkrb5pwd-enable krb5 smbkrb5pwd-krb5realm DIGHUM.KCL.AC.UK smbkrb5pwd-requiredclass posixAccount # # Password Policy - this runs check_password.so compiled from # /vol/source/ldap_check_password/1.0/check_password.c # # overlay ppolicy ppolicy_default "cn=default,ou=pwpolicies,dc=dighum,dc=kcl,dc=ac,dc=uk" ppolicy_use_lockout ppolicy_hash_cleartext The idea is: ppolicy is configured to call my own password_check.so and that works nicely - that exits with EXIT_FAILURE if it fails. smbkrb5pwd is OpinSys.fi's modification to smbk5pwd to work with MIT kerberos. That works too (after I fixed something). It will set the principle's password and create the principle is it doesn't exist. The failure scenario is: 1) No principle for the UID in question; 2) The UID in question has a DN in slapd; 3) Set password for UID - choose one that will fail the ppolicy checks; 4) do an ldappasswd change for UID Result: ldappasswd says it fails and the user password hash in slapd is not changed. However, smbkrb5pwd was still called and managed to create a principle for UID with the weak password - bypassing the policy. The best answer to my mind is: Fix smbkrb5pwd to be able to add a default kerberos policy to any created principles. Such a policy can replace ppolicy for password strength checking. I think I can do this. However, it bothers me - is there no way to make the failure of one overlay bomb the stack out (rather like PAM)? Or perhaps ppolicy is not actually "failing" as such?? Any ideas? Cheers! Tim -- Tim Watts Personal Blog: http://squiddy.blog.dionic.net/ http://www.sensorly.com/ Crowd mapping of 2G/3G/4G mobile signal coverage

1 0

Indices is missing?
by Vit Dua 21 Feb '13

21 Feb '13

Hi, I have indexed my mdb by: slapcat -f slapd.conf -q After that, I can find entries quickly with the filter: mail=viet...(a)example.com But I cannot find the entry: mail=viet2000000(a)example.com,dc=example,dc=com with that filter. However, I can search that entry with other filter: mail=viet200000*(a)example.com My slapd.conf: index mail eq Thanks, Viet

3 4

openLDAP is not working with MySQL cluster
by SHEKHAR PODICHETI 21 Feb '13

21 Feb '13

Hi, I tried connecting openLDAP server with MySQL cluster through NDB APIs. I made configuration changes in slapd.conf so that it connect to NDB. However it is throwing Unrecongnized NDB. I request tou to help me. It will be great if u share me sample slapd.conf file that has the NDB configuration. Thanks. -- Regards, Shekhar Podicheti

3 3

ppolicy on consumers
by Andrei BĂNARU 21 Feb '13

21 Feb '13

Hi, Did anyone manage to get the *ppolicy overlay* to work on the *consumers *? The user gets the *pwdAccountLockedTime *attribute on the provider and the consumers. To validate this I use: /[root@opennms ~]# //*ldapwhoami -x -e ppolicy -D "uid=user1,ou=People,ou=Country1,dc=example,dc=com" -w'password' -h ldap-master.example.com*//* *//*ldap_bind: Invalid credentials (49); Account locked*/ where *ldap-master.example.com* is the *provider*. /[root@opennms ~]# //*ldapwhoami -x -e ppolicy -D "uid=user1,ou=People,ou=Country1,dc=example,dc=com" -w'password' -h ldap.example.ro*//* *//*dn:uid=user1,ou=People,ou=Country1,dc=example,dc=com*/ where *ldap.example.ro* is one of the *consumers*. The same issue occurs also on expired passwords. On the consumer I've used *ppolicy_forward_updates* and that works like a charm. Did I miss something vital in the configuration ? Thx! -- Andrei BĂNARU Internal Support CCNA Security, CCIP StreamWIDE Romania

1 0

enabling logs in openLDAP
by Jignesh Patel 21 Feb '13

21 Feb '13

How to enable logs to capture authentication information in openLDAP 2.4.33

2 1

Append `git log -p COMMIT~..COMMIT` to an OpenLDAP commit message
by SATOH Fumiyasu 21 Feb '13

21 Feb '13

FYI. https://github.com/fumiyas/mail-filters/blob/master/openldap-commitmail-adj… -- -- Name: SATOH Fumiyasu @ OSS Technology Corp. (fumiyas @ osstech co jp) -- Business Home: http://www.OSSTech.co.jp/ -- GitHub Home: https://GitHub.com/fumiyas/ -- PGP Fingerprint: BBE1 A1C9 525A 292E 6729 CDEC ADC2 9DCA 5E1C CBCA

1 0

meta backend subtree directive ignored by conversion to cn=config
by francesco.policastro＠selex-es.com 21 Feb '13

21 Feb '13

Hi all, I realized that the subtree-include directives I use in my meta backend are not converted at all to cn=config. I cannot find them in cn=config tree. The slapd version is 2.4.33 as patched after ITS#7525 (openldap-648d28f.tar.gz) Here is my slapd.conf: ==================================================== # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/dyngroup.schema attributetype ( 1.2.840.113556.1.4.221 NAME 'sAMAccountName' EQUALITY caseExactMatch SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' SINGLE-VALUE ) attributetype ( 1.2.840.113556.1.4.35 NAME 'employeeID' EQUALITY caseExactMatch SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' SINGLE-VALUE ) attributetype ( 1.2.840.113556.1.4.8 NAME 'userAccountControl' EQUALITY integerMatch SYNTAX '1.3.6.1.4.1.1466.115.121.1.27' SINGLE-VALUE ) attributetype ( 1.2.840.113556.1.4.656 NAME 'userPrincipalName' EQUALITY caseExactMatch SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' SINGLE-VALUE ) # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 pidfile /var/run/slapd.pid # ---------------------- backend meta backend hdb # ---------------------- # ---------------------- database meta # ---------------------- suffix "dc=newco,dc=com" readonly on rootdn "cn=LdapBindUser,dc=newco,dc=com" rootpw secret1 # no anonymous bind require authc conn-ttl 25m dncache-ttl disabled access to * by * none # first domain uri "ldap://server1.it.domain1.com/dc=first,dc=newco,dc=com" idassert-bind bindmethod=simple binddn="cn=LDAP User,ou=ITStaff,dc=it,dc=domain1,dc=com" credentials=secret2 chase-referrals no rebind-as-user true map objectclass groupOfNames * map objectclass person * suffixmassage "dc=first,dc=newco,dc=com" "dc=it,dc=domain1,dc=com" subtree-include "ou=Applications,ou=Groups Shared,dc=first,dc=newco,dc=com" subtree-include "ou=Users,ou=1st-location,dc=first,dc=newco,dc=com" subtree-include "ou=Users,ou=2nd-location,dc=first,dc=newco,dc=com" subtree-include "ou=Users,ou=3rd-location,dc=first,dc=newco,dc=com" # map visible attributes to matching attributes on backend map attribute distinguishedName * map attribute givenName * map attribute description * map attribute sn * map attribute cn * map attribute mail * map attribute samAccountName * map attribute userAccountControl * map attribute employeeID * map attribute userPrincipalName * # map everything else to null map attribute * # second domain uri "ldap://server2.domain2.net/ou=organizationalUnit,dc=second,dc=newco,dc=com" idassert-bind bindmethod=simple binddn="cn=ldap-2,cn=Users,dc=domain2,dc=net" credentials=secret3 chase-referrals no rebind-as-user true map objectclass groupOfNames * map objectclass person * suffixmassage "dc=second,dc=newco,dc=com" "dc=domain2,dc=net" subtree-include "ou=Users,ou=1st-location,ou=organizationalUnit,dc=second,dc=newco,dc=com" subtree-include "ou=My-ou,ou=1st-location,ou=organizationalUnit,dc=second,dc=newco,dc=com" subtree-include "ou=Remote Sites,ou=organizationalUnit,dc=second,dc=newco,dc=com" # map visible attributes to matching attributes on backend map attribute distinguishedName * map attribute givenName * map attribute description * map attribute sn * map attribute cn * map attribute mail * map attribute samAccountName * map attribute userAccountControl * map attribute employeeID pager map attribute userPrincipalName * # map everything else to null map attribute * # ---------------------- database hdb # ---------------------- suffix dc=domain-groups,dc=com" rootdn "cn=groupsRoot,dc=domain-groups,dc=com" rootpw secret4 overlay dynlist dynlist-attrset groupOfURLs memberURL member directory /usr/local/var/openldap-data ============================================= Did anyone successfully use subtrees with cn=config? Thanks, Francesco Policastro

1 0

Openldap Chaining
by jeevan kc 21 Feb '13

21 Feb '13

Hello guys here is my proceudre that I wrote for OpenLDAP chaining. My question is since I have a master and two slaves on the replication, where do these overlay go? On the slaves only or both master and slaves. Please respond. Thanks · Create /usr/local/etc/openldap/slapd.d/cn=config/olcDatabase={-1}frontend · Create /usr/local/etc/openldap/slapd.d/cn=config/olcDatabase={-1}frontend/olcOverlay={0}chain · Add olcOverlay={0}chain.ldif to /usr/local/etc/openldap/slapd.d/cn=config/olcDatabase={-1}frontend dn: olcOverlay={0}chain objectClass: olcOverlayConfig objectClass: olcChainConfig olcOverlay: {0}chain olcChainCacheURI: FALSE olcChainMaxReferralDepth: 1 olcChainReturnError: TRUE structuralObjectClass: olcChainConfig · Add olcDatabase={0}ldap.ldif to /usr/local/etc/openldap/slapd.d/cn=config/olcDatabase={-1}frontend/olcOverlay={0}chain dn: olcDatabase={0}ldap objectClass: olcLDAPConfig objectClass: olcChainDatabase olcDatabase: {0}ldap olcDbStartTLS: none starttls=no olcDbRebindAsUser: FALSE olcDbChaseReferrals: TRUE olcDbTFSupport: no olcDbProxyWhoAmI: FALSE olcDbProtocolVersion: 3 olcDbSingleConn: FALSE olcDbCancel: abandon olcDbUseTemporaryConn: FALSE olcDbConnectionPoolMax: 16 olcDbSessionTrackingRequest: FALSE olcDbNoRefs: FALSE olcDbNoUndefFilter: FALSE structuralObjectClass: olcLDAPConfig · Add olcDatabase={1}ldap.ldif to /usr/local/etc/openldap/slapd.d/cn=config/olcDatabase={-1}frontend/olcOverlay={0}chain dn: olcDatabase={1}ldap objectClass: olcLDAPConfig objectClass: olcChainDatabase olcDatabase: {1}ldap olcDbURI: "ldap://master.dc.us" olcDbStartTLS: none starttls=no olcDbIDAssertBind: mode=self flags=prescriptive,proxy-authz-non-critical bindm ethod=simple timeout=0 network-timeout=0 binddn="cn=manager,o=dc,c=us” credentials="l4s3rj3t" keepalive=0:0:0 olcDbRebindAsUser: FALSE olcDbChaseReferrals: TRUE olcDbTFSupport: no olcDbProxyWhoAmI: FALSE olcDbProtocolVersion: 3 olcDbSingleConn: FALSE olcDbCancel: abandon olcDbUseTemporaryConn: FALSE olcDbConnectionPoolMax: 16 olcDbSessionTrackingRequest: FALSE olcDbNoRefs: FALSE olcDbNoUndefFilter: FALSE structuralObjectClass: olcLDAPConfig · Restart slapd

2 3

Listing linux users
by Thiago Parolin 20 Feb '13

20 Feb '13

Hi all. My scenario is: openldap/samba pdc server for authenticating Windows and Linux. I need to know when a user, from Linux clients, logs in and out from the system. If some problem occurs, i need to know who was logged, in particular computer, in that time. With windows computers, the "last" bash command (in server) gave me the information needed, but with linux clients i don't know what i have to do. They are not listed with "last" command. I don't want to redirect all auth logs from clients to my server. It probably will overload my server. There are some way to do this?

2 1

How to search for all the dynamic groups a member belongs to?
by Carlos Santos 20 Feb '13

20 Feb '13

Hello to all of you, So, the situation is the following: I have a dynamic group (objectClass: groupOfURLs) and on my ldap filter I fetch the users UID. When I access the content of the group, there are a set of members there, one of them is testUser1, but when I search for (&(objectClass=groupOfURLs)(uid=testUser1)) the search result is empty. However when I search for an attribute which is native to the class, such as owner, the search returns the group. Is it possible for an ldap search to return the dynamic groups a user belongs to? -- cumprimentos, Carlos Santos

2 1

paged search fails through proxy
by Eimar Koort 20 Feb '13

20 Feb '13

Hi, I'm a bit in dead end. Scenario: Active Direcotory & openldap (2.4.33) proxy. Paged search through proxy is not working. I'm not sure about this OID "1.2.840.113556.1.4.1339". OpenLdap ldap.h tells that this oid is LDAP_CONTROL_X_DOMAIN_SCOPE. According to O'Reilly AD cookbook: "No referrals generated" with longer description "Informs the server not to generate any referrals in a search response". May this be the reason for paged search to fail? Same query runs without any problems directly within Active Directory domain controller's. As i read from google, it should be possible to make paged search work, but i can't figure it out how. eimar@box: /tmp > ldapsearch -LLL -H ldaps://olp-test.example.ee -P 3 -E pr=500/noprompt -D "CN=ldap-auth,CN=Users,DC=example,DC=ee" -W -b "ou=workers,dc=example,dc=ee" "(objectClass=person)" samaccountname -s sub > results.txt Enter LDAP Password: Size limit exceeded (4) eimar@box: /tmp > grep dn\: results.txt | wc -l 1000 which is the default search limit in AD. Openldap proxy log: Feb 20 12:45:27 olp-test slapd[1788]: connection_get(10) Feb 20 12:45:27 olp-test slapd[1788]: send_ldap_result: err=0 matched="" text="" Feb 20 12:45:27 olp-test slapd[1788]: connection_get(10) Feb 20 12:45:27 olp-test slapd[1788]: SRCH "ou=workers,dc=example,dc=ee" 2 0 Feb 20 12:45:27 olp-test slapd[1788]: 0 0 0 Feb 20 12:45:27 olp-test slapd[1788]: filter: (objectClass=person) Feb 20 12:45:27 olp-test slapd[1788]: attrs: Feb 20 12:45:27 olp-test slapd[1788]: samaccountname Feb 20 12:45:27 olp-test slapd[1788]: 1.1 Feb 20 12:45:27 olp-test slapd[1788]: sub Feb 20 12:45:27 olp-test slapd[1788]: Feb 20 12:45:27 olp-test slapd[1788]: conn=1007 op=1: non-critical control "1.2.840.113556.1.4.1339" not supported; stripped. Feb 20 12:45:27 olp-test slapd[1788]: => ldap_back_munge_filter "(objectClass=person)" Feb 20 12:45:27 olp-test slapd[1788]: <= ldap_back_munge_filter "(objectClass=person)" (0) Feb 20 12:45:27 olp-test slapd[1788]: send_ldap_result: err=4 matched="" text="" Feb 20 12:45:27 olp-test slapd[1788]: connection_get(10) And here is my slapd.conf: olp-test /usr/local/etc/openldap # cat slapd.conf include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/nis.schema pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args sizelimit unlimited #limits * size.pr=unlimited size.prtotal=unlimited modulepath /usr/local/libexec/openldap moduleload back_bdb moduleload back_ldap loglevel 4 TLSCipherSuite ALL:!ADH:@STRENGTH TLSCACertificateFile /usr/local/etc/openldap/certs/cert.crt TLSCertificateFile /usr/local/etc/openldap/certs/cert.crt TLSCertificateKeyFile /usr/local/etc/openldap/certs/cert.pem TLSVerifyClient try database ldap suffix "dc=example,dc=ee" rootdn "dc=example,dc=ee" uri "ldaps://dc1.example.ee:636/" idassert-bind bindmethod=simple binddn="CN=LDAP-Auth,CN=Users,DC=example,DC=ee" credentials="somepw" mode=anonymous flags=override idassert-authzFrom "dn.regex:.*" overlay pcache readonly on proxycache bdb 3500 1 50 1200 directory /var/db/openldap-data index cn,sn,uid eq,sub index objectclass eq proxycachequeries 400 proxyattrset 0 uid mail cn sn givenName proxytemplate (uid=) 0 600 proxytemplate (mail=) 0 600 proxytemplate (&(uid=)(mail=)) 0 600 Regards -- Eimar Koort ( eimar.koort(a)gmail.com )

1 0

modifying cn=config - Invalid credentials (49)
by Asmaa Ahmed 20 Feb '13

20 Feb '13

Hi, I am trying to modify cn=config, but I don't understand why It doesn't work any more. root@auth-dev:/etc/ldap# ldapsearch -v -x -D 'cn=admin,cn=config' -W ldap_initialize( <DEFAULT> )Enter LDAP Password: ldap_bind: Invalid credentials (49)root@auth-dev:/etc/ldap# ldapsearch -v -x -D 'cn=admin,^C-W root@auth-dev:/etc/ldap# cat /etc/ldap/slapd.d/cn=config/olcDatabase\=\{0\}config.ldifdn: olcDatabase={0}configobjectClass: olcDatabaseConfigolcDatabase: {0}configolcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth manage by * breakolcRootDN: cn=admin,cn=configstructuralObjectClass: olcDatabaseConfigentryUUID: 7904eb62-0b79-1032-92e0-3d0a3fa53956creatorsName: cn=configcreateTimestamp: 20130215050825ZentryCSN: 20130215050825.984665Z#000000#000#000000modifiersName: cn=configmodifyTimestamp: 20130215050825Z Thanks.

4 10

Compile openldap library with GSSAPI enabled
by Michele 19 Feb '13

19 Feb '13

Hi all, I'm trying to build OpenLDAP enabling the GSSAPI module, but I can't find any reference on that in the configure file. I'm doing that because I'm writing a client program that want to login to a Windows AD via kerberos. Any help is appreciated.

3 6

ldapi without TLS and ldap with TLS?
by Patrick Lists 19 Feb '13

19 Feb '13

Hi, I'm tying achieve the following with OpenLDAP RE24 from last week: Connections on ldapi:/// are plain text and ldap connections require TLS with client cert auth. I thought I could do that with: # global configuration settings dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/openldap34/slapd34.args olcPidFile: /var/run/openldap34/slapd34.pid olcLogFile: /var/log/openldap34/slapd34.log olcLogLevel: -1 olcTLSCACertificateFile: /etc/pki/tls/certs/ca.crt olcTLSCertificateFile: /etc/pki/tls/certs/server.crt olcTLSCertificateKeyFile: /etc/pki/tls/private/server.key olcTLSCipherSuite: TLSv1+HIGH:!SSLv2:!aNULL:!eNULL:!3DES:@STRENGTH olcTLSVerifyClient: demand <--- olcLocalSSF: 0 <--- olcSecurity: tls=256 <--- Since I'm seeing the error below clearly I thought wrong: 5121a107 >>> slap_listener(ldapi:///) 5121a107 daemon: listen=11, new connection on 15 5121a107 daemon: added 15r (active) listener=(nil) 5121a107 conn=1009 fd=15 ACCEPT from PATH=/var/run/ldapi (PATH=/var/run/ldapi) [snip] 5121a107 conn=1009 op=0 BIND dn="cn=ReadOnly,dc=example,dc=com" method=128 5121a107 do_bind: version=3 dn="cn=ReadOnly,dc=example,dc=com" method=128 5121a107 send_ldap_result: conn=1009 op=0 p=3 5121a107 send_ldap_result: err=13 matched="" text="TLS confidentiality required" [snip] 5121a107 conn=1009 op=0 RESULT tag=97 err=13 text=TLS confidentiality required Anyone have an idea how I can achieve my goal? Thanks! Patrick

2 4

Problem in user authentication with LDAP + SSSD
by Cristiane França 18 Feb '13

18 Feb '13

Hi, I'm an authentication problem with my server CentOS 6.3, there are installer LDAP (openldap-2.4.23-26) and SSSD (sssd-1.8.0-32). The LDAP server is working fine but the integration between LDAP + SSSD has a problem because it can not authenticate the user on the server Can anyone help me identify the problem? I've revised all the configuration and found nothing wrong. ::::: slapd.conf ::::: include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/misc.schema allow bind_v2 pidfile /var/run/openldap/slapd.pid TLSCACertificateFile /etc/openldap/cacert.pem TLSCertificateFile /etc/openldap/servercrt.pem TLSCertificateKeyFile /etc/openldap/serverkey.pem access to * by self write by users auth by anonymous read database bdb suffix "dc=domain,dc=com,dc=br" checkpoint 1024 15 rootdn "cn=Manager,dc=domain,dc=com,dc=br" rootpw xxxxxxxxxx directory /database/ldap index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub database monitor loglevel 768 ::::: sssd.conf ::::: [sssd] config_file_version = 2 reconnection_retries = 3 sbus_timeout = 30 services = nss, pam domains = default [nss] filter_groups = root filter_users = root reconnection_retries = 3 [pam] reconnection_retries = 3 debug_level = 8 [domain/default] ldap_tls_reqcert = never auth_provider = ldap ldap_id_use_start_tls = False chpass_provider = ldap krb5_realm = EXAMPLE.COM cache_credentials = True debug_timestamps = True ldap_default_authtok_type = password ldap_search_base = dc=domain,dc=com,dc=br debug_level = 9 id_provider = ldap ldap_default_bind_dn = cn=Manager,dc=domain,dc=com,dc=br min_id = 100 ldap_uri = ldap://localhost/ krb5_kdcip = kerberos.example.com ldap_default_authtok = xxxxxxxxxx ldap_tls_cacertdir = /etc/openldap/cacerts :::: nsswitch.conf ::::: passwd: files sss shadow: files sss group: files sss hosts: files dns bootparams: nisplus [NOTFOUND=return] files ethers: files netmasks: files networks: files protocols: files rpc: files services: files netgroup: files sss publickey: nisplus automount: files ldap aliases: files nisplus LOG: Feb 18 14:50:01 primario slapd[16064]: conn=1119 op=185 SRCH base="dc=domain,dc=com,dc=br" scope=2 deref=0 filter="(&(uid=cristiane)(objectClass=posixAccount))" Feb 18 14:50:01 primario slapd[16064]: conn=1119 op=185 SRCH attr=objectClass uid userPassword uidNumber gidNumber gecos homeDirectory loginShell krbPrincipalName cn modifyTimestamp modifyTimestamp shadowLastChange shadowMin shadowMax shadowWarning shadowInactive shadowExpire shadowFlag krbLastPwdChange krbPasswordExpiration pwdAttribute authorizedService accountExpires userAccountControl nsAccountLock host loginDisabled loginExpirationTime loginAllowedTimeMap Feb 18 14:50:01 primario slapd[16064]: conn=1119 op=185 SEARCH RESULT tag=101 err=32 nentries=0 text= Thanks Cristiane

2 1

Where is the TLSCertificateFile in cn=config?
by Sascha Ziemann 18 Feb '13

18 Feb '13

I am looking for the right DN in the cn=config tree for the following options of the legacy slapd.conf file: TLSCertificateFile /path/to/server-certificate.pem TLSCertificateKeyFile /path/to/private-key.pem TLSCACertificateFile /path/to/CA-certificates Where do I have to put the path names? Maybe someone can update the FAQ: http://www.openldap.org/faq/data/cache/185.html

2 1

How to create cn=config DIT
by arantza serrano 18 Feb '13

18 Feb '13

Hello, I've installed my first openldap using the source downloaded in openldap web pages. when the make install finishs i don't find the cn=config DIT, it hasn't been created during intallation process. How can i created the cn=config directory after the installation? Sorry if i'm asking a foolishness Thanks

3 3

does openldap/hdb support transactions ?
by Benin Technologies 17 Feb '13

17 Feb '13

Hi, They say that Berkeley HDB is an ACID database, but does OpenLDAP support transactions ? And if yes, how do you start and commit/rollback a transaction ? Thanks Ben

3 2

User Private Groups
by Omar Hijab 17 Feb '13

17 Feb '13

Hello, Does openLDAP support User Private Groups by having memberOf return a fake self-group through some rewriting rule? Our campus has a SUN LDAP for user data that is not under our control. Our Mac and Linux clients use it for authentication. This server does not provide group management as a service. Because of this, we set up a separate openLDAP server to create/store groups. With clients bound to both servers, this works seamlessly. Because of this, we want our server to respond to memberOf queries with a fake private self-group in addition to legitimate groups the user is in, this without creating and storing private groups on our server. Is this do-able? Omar ----------------------------------------------------------------------- Omar Hijab Associate Dean for Faculty Affairs and Operations College of Science and Technology Temple University Email: hijab(a)temple.edu Web: http://www.cst.temple.edu/~hijab/ ------------------------------------------------------------------------

1 0

ACL and New users binding as anonym haveous
by cbulist 15 Feb '13

15 Feb '13

Hi, We have openldap 2.4.33 running without problem. In our first configuration we created a simple ACL in order to get access to every user. access to * by * read Then we changed it to: access to * by self write by anonymous auth by * none This ACL rules works perfectly with users that were logged by ssh before to change but users created and that never were logged after this ACL can not login. I review the openldap log file and I can see the user is trying to bind using anonymous instead of its uid. Are there any way to send the full user DN (uid=user,ou=People,dc=company,dc=com) to Ldap? Thanks in advance!

2 1

Advice request : LDAP server discovering
by Olivier 15 Feb '13

15 Feb '13

Hello, in the case I was not knocking at the right door, please accept my apologies, but as I suspect that some of you could provide some advices I post this here. In summary the issue I try to solve is "which mecanism should I deloy to route ldap requests to the right ldap server". Here is the situation : My hosts and services are distributed in 3 distinct operationnal sites (site A, site B, site C). I have three ldap servers (one on each site) that are configured to be exact replication of the others (I use openldap syncrepl in multimaster mode). On the client side (linux boxes), authentication on my hosts are based on ldap (posixaccounts/nsswitch/pam/ldap.conf and sssd). I also have deployed things such as centralized sudoer rules in ldap. At this stage, I have configured hosts so that ldap queries are sent to "the closer" ldap server first, then to another one if the first timeout : nsswitch.conf tells to query ldap (sss), and here is an extract of my ldap.conf for a host located in site A: > URI ldap://ldapA.mydom.fr ldap://ldapB.mydom.fr ldap://ldapC.mydom.fr For a host located in site C, I have declared this in ldap.conf: > URI ldap://ldapC.mydom.fr ldap://ldapB.mydom.fr ldap://ldapA.mydom.fr I would like to change that. Rather than declaring three ldap server references in configurations on the client side, I would like to implement some sort of mecanism thanks to which I would only need to declare one reference on the client side (routing ldap queries to ldap service, not to ldap servers). I see different possibilities to do that, such as setting up some sort of "heartbeat" or using some DNS trick such as multiple IN A for the same DNS RR, using sortlist option, or DNS SRV records ( _ldap._tcp. ) See: http://www-01.ibm.com/software/network/directory/library/publications/jndid… http://www.rjsystems.nl/en/2100-dns-discovery-openldap.php http://www.ietf.org/proceedings/50/I-D/ldapext-locate-05.txt http://ipamworldwide.com/bind-options/sortlist-option.html Intuitively, my preference would go to use an "_ldap._tcp" srv record, but I'm not sure if nsswitch (or clients such as sssd) would interpret this kind of DNS responses correctly (what I mean by "correctly" is "client would query an up and running ldap server found in the NS response list." Even better: "would query the faster one to respond" ). Any advice ? Experience ? Article to read ? Thanks, --- Olivier

2 2

Why is DN invalid?
by David Cunningham 13 Feb '13

13 Feb '13

Hello all, I've installed openldap 2.4.33 on OpenSUSE 11 and am trying out the perl backend. I got my certificate issues sorted out and everything seems good - until I search our university server which returns dn's such as: unbCaId=9e3454b178993cc73619606d22c7882755c9cb0d,ou=people,dc=unb,dc=ca When I return entry from search routine in perl module I get error "str2entry: entry -1 has invalid DN". I can't see anything wrong with the dn (other than it is ugly). Are there length restrictions for individual components of a dn? All similar problems I've discovered on the net are issues with commas, plus signs, quotes or unicode characters. No doubt there is something I've overlooked so please point me in the right direction. cheers, Dave C.

3 2

how to compile an openldap dll to use with LabVIEW?
by Amrbar, Mehran (356E) 12 Feb '13

12 Feb '13

Hi, I want to know how can I compile the openldap C library into a dll so I can use it with LabVIEW? Or if a dll with header is already available? Thanks, Mehran

1 0

inconsistent sshPublicKey entries
by Michael W. Lucas 12 Feb '13

12 Feb '13

Hi, I'm running OpenLDAP 2.4.21 on FreeBSD. We do a lot of administration via phpLDAPAdmin, but I do some command-line stuff. And I've seen an inconsistency between the two in the ldapPublicKey object class. When I look in phpLDAPAdmin, my SSH keys start like this: ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAw9zmtbk8b... ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDfZ/p... If I do a ldapsearch, however, I get: sshPublicKey:: c3NoLXJzYSBBQUFBQjNOemFD.... sshPublicKey: ssh-rsa AAAAB3NzaC1 The ssh-rsa or ssh-dss string is missing from all public keys except the last one displayed. The entries without a key type have a double colon. slapcat behaves like ldapsearch. But I have to believe that the key type information is in the database, somewhere, because phpLDAPAdmin reports it's there. I didn't notice this while we used the LPK patch for our SSH servers, but we're now migrating to the official OpenSSH AuthorizedKeysCommand feature. I have a script to retrieve the keys, but my SSH servers only recognize the last key. It rejects the others because they don't have a key type attached. Any suggestions? Thanks, ==ml -- Michael W. Lucas http://www.MichaelWLucas.com/, http://blather.MichaelWLucas.com/ Latest book: SSH Mastery http://www.michaelwlucas.com/nonfiction/ssh-mastery mwlucas(a)michaelwlucas.com, Twitter @mwlauthor

3 3

bdb_equality_candidates: cn=config
by Denny Schierz 12 Feb '13

12 Feb '13

hi, I get lot of messages like: <= bdb_equality_candidates: (ipHostNumber) not indexed <= bdb_equality_candidates: (ipHostNumber) not indexed <= bdb_equality_candidates: (memberUid) not indexed <= bdb_equality_candidates: (title) not indexed [...] and some more. I don't know why it happens, because I have all attributes in my index: olcDbIndex: ipHostNumber eq olcDbIndex: memberUID eq olcDbIndex: title eq [...] and also the files are there and automatically created: /var/lib/ldap/ou-company/{ ipHostNumber.bdb, memberUid.bdb, title.bdb } All index attributes are added via cn=config with my LDAP Browser. Also restarts doesn't help. I use Debian Squeeze packages in a n-way master configuration (two nodes) Any suggestions? cu denny

3 3

ldapsearch and LDAP_CONTROL_VALSORT
by Benin Technologies 12 Feb '13

12 Feb '13

Hi, I'm trying to use ldapsearch with LDAP_CONTROL_VALSORT (1.3.6.1.4.1.4203.666.5.14 ), does anybody know how to do that ? Here's what I did and the error I get: ldapsearch -x -W -D "cn=admin,dc=company,dc=com" -b "ou=people,dc=company,dc=com" -s subtree -e 1.3.6.1.4.1.4203.666.5.14 I get : # search result search: 2 result: 2 Protocol error text: valSort control value is absent Thanks Ben

1 0

weighted valsort for telephone Numbers
by Benin Technologies 12 Feb '13

12 Feb '13

Hi Quanah, I just found an old post of yours, and I'd be interested to know if and how you solved that problem, because I ran into the same need. Thanks Ben * *To*: *openldap-devel(a)OpenLDAP.org <mailto:openldap-devel%40OpenLDAP.org>* * *Subject*: *valsort & telephoneNumber* * *From*: *Quanah Gibson-Mount <quanah(a)stanford.edu <mailto:quanah%40stanford.edu>>* * Date: Mon, 28 Aug 2006 21:11:07 -0700 * Content-disposition: inline ------------------------------------------------------------------------ We would like to be able to use valsort to weight telephoneNumber values in OpenLDAP. However, modifications of that type get rejected by the SYNTAX validation for telephoneNumber because it contains {}'s. Is it reasonable to expect to be able to override the SYNTAX in this case? Should valsort be modified to do so? Basically, the desired behavior would be for the non-weighted part (i.e., the actual data) of the value to be validated via the SYNTAX rules, but the weight part at the beginning ignored. --Quanah -- Quanah Gibson-Mount Principal Software Developer ITS/Shared Application Services Stanford University GnuPG Public Key:http://www.stanford.edu/~quanah/pgp.html <http://www.stanford.edu/%7Equanah/pgp.html>

5 10

Mirror mode difference from N-Way Multi-Master
by Покотиленко Костик 11 Feb '13

11 Feb '13

Hi, I've red replication documentation many times, and also many related mailing list threads. Some aspects are still not clear. So: 1. Can Mirror Mode be setup across more than 2 servers, say 3 mirrors? I found one thread saying that mirror can only be setup for 2 master servers: http://www.openldap.org/lists/openldap-software/200801/msg00046.html 2. How Mirror Mode of 2 servers differs in configuration comparing to N-Way Multi-Master of 2 servers? I don't see difference in setting up Mirror vs N-Way, both should have syncprov and syncrepl, both should have ServerID and MirrorMode TRUE, what am I missing? As far as I can see there is no difference in configuration. The only distinction I can see is the "use case", as N-Way supposed to accept writes on all Masters, but Mirror only on one at a time. This is not clearly stated anywhere, so do they really differ only in proxy/balancer in front of Mirrors? If so, why can't I do 3 Mirrors with proxy/balancer in front? 3. It is clearly stated in the docs that in Mirror Mode one can't use Delta-syncrepl. Can it be used in N-Way Multi-Master? There are posts saying Delta-syncrepl is not supported in Multi-Master: http://www.openldap.org/lists/openldap-devel/200708/msg00139.html http://www.openldap.org/lists/openldap-technical/201104/msg00241.html 4. In Mirror mode, can I use UpdateRef on one mirror to direct writes to another so proxy/balancer will become not required?

4 9

What is difference between basic search and search fired by ACL check.
by Tio Teath 11 Feb '13

11 Feb '13

I'm trying to setup Set ACL via ldap proxy with proxy cache. Problem is that proxy cache are not used during ACL checking. For example, I have next ACL to the local database: olcAccess: {0}to * by self write by set="[cn=test2,ou=group,dc=remote]/member & user" write by anonymous auth by * none And at the remote LDAP server I have next entry: dn: cn=test2,ou=group,dc=remote objectClass: groupOfNames member: uid=user,ou=user,dc=local member: uid=j_doe,ou=people,dc=remote Proxy cache works perfectly when fired by basic search request, I can see it in the debug log. But when search are fired by ACL check (i.e. search to local entry, which handled by Set ACL), proxy cache are completely ignored. And I am sure about that, because I have added 'Debug( pcache_debug ...' entry in every function from servers/slapd/overlays/pcache.c and could not see any of them in the trace output, during ACL check and could see them perfectly during basic search. Here are log entries from the remote server for cache search(1) and ACL search(2): 1) 5118f601 conn=1003 op=1 SRCH base="cn=test2,ou=group,dc=remote" scope=2 deref=0 filter="(objectClass=*)" 5118f601 conn=1003 op=1 SRCH attr=member objectClass 2) 5118f706 conn=1000 op=1 SRCH base="cn=test2,ou=group,dc=remote" scope=0 deref=0 filter="(objectClass=*)" 5118f706 conn=1000 op=1 SRCH attr=member For (1), seems search are fired by pcache itself, hence attr=member objectClass. Proper search request, which are fired by myself does not contain objectClass in the requested attribute list. I have not managed to find the place in the code, where the search are fired by ACL, seems it is servers/slapd/overlays/sets.c, but there is no direct search invocation there. Could you please give me a clue how to fix this issue? P.S. I have googled this post http://www.openldap.org/lists/openldap-devel/200908/msg00018.html. Seems, it is somehow related to the issue, only in my case entry is not in hand.

1 0

integrating open ldap with kerberos and ssl
by Asmaa Ahmed 11 Feb '13

11 Feb '13

Hello, Is it possible to get an open ldap support the both way of authentication?I have a open ldap integrated already with MIT kerberos, and I wonder if I can adapt it to support SSL/TLS as well.The problem is that some applications allow only for simple binding which is not possible with Kerberos.If yes, does any one have a good tutorial for such kind of integration or some guide lines? Thanks.

1 0

valsort and telephone numbers
by Benin Technologies 10 Feb '13

10 Feb '13

Hi, Does anybody use the valsort overlay and its "weighted" method with telephone numbers ? Telephone numbers don't accept braces {} in their syntax, but the braces are used by valsort to define the attribute's weight. What's the best way around this ? An easy way would be to create a custom myMobile attribute, with syntax IA5 string (1.3.6.1.4.1.1466.115.121.1.26) instead of the telephone number syntax (1.3.6.1.4.1.1466.115.121.1.50). IA5 strings accept braces {}. But the tradeoff is that any string can be put in the myMobile attribute. The best way would be to enforce myMobile to accept only telephone numbers (syntax 1.3.6.1.4.1.1466.115.121.1.50), PLUS braces {} Can this be done ? any other idea ?

1 0

Problem with too many concurrent LDAP requests (Postfix+LDAP)
by Denis BUCHER (lists) 09 Feb '13

09 Feb '13

Dear all, I am using LDAP as backend for Postfix for all email accounts. Any email coming to the server is checked against LDAP to check if email is valid, and deliver it accordingly. It works almost perfectly but I have a big problem that arise when receiving (or sending) too many emails at the same time. It looks like slapd server is overwhelmed with too many requests at the same time, which makes postfix getting timeouts. On the postfix side hopefully it's only a "temporary lookup failure" but I want to correct that problem. In the logs I get two kind of LDAP errors : a) * postfix/trivial-rewrite: warning: dict_ldap_lookup: Search error -5: Timed out * postfix/trivial-rewrite: fatal: ldap:/etc/postfix/ldap-domains.cf(0,lock|fold_fix): table lookup problem b) * postfix/smtpd: warning: dict_ldap_connect: Unable to bind to server ldap://localhost:389 as cn=mailadmin, ou=mailservices, dc=domain, dc=ch: -5 (Timed out) If someone had a suggestion on how to optimize the LDAP server to be able to cope with the demand coming from postfix it would be great ! Denis

2 3

Using multi-value attributes for ACLs
by Andrew Heagle 08 Feb '13

08 Feb '13

Hi, At my work, we use LDAP as the backend for Puppet node definitions. Each host would have an LDAP entry specifying things like which puppet classes to apply, host specific variables, environment (which git branch to use for puppet manifests and a few other things. There are different teams that would like to be able to manage these attributes when deploying software. For example, DBA should be able to manage DB servers while QA need to be able to configure their hosts to test different software. Any hosts that DBA can manage has a role=DBA applied and likewise an QA hosts has role=QA set. Since role is multi-valued, a QA DB can have role=DBA and role=QA set on it, since both QA and DBAs might need to be able to make changes to the host. Our slapd.conf has these ACLS access to dn.subtree="ou=hosts,dc=example,dc=info" filter=(role=DBA) attrs=puppetclass,puppetvar,environment by group/groupOfUniqueNames/uniqueMember="cn=dba,ou=groups,dc=example,dc=info" write by group="cn=sysadmin,ou=ldapgroup,dc=example,dc=info" write by * read access to dn.subtree="ou=hosts,dc=example,dc=info" filter=(role=QA) attrs=puppetclass,puppetvar,environment by group/groupOfUniqueNames/uniqueMember="cn=qa,ou=groups,dc=example,dc=info" write by group="cn=sysadmin,ou=ldapgroup,dc=example,dc=info" write by * read let say a LDAP host entry looks like this: dn: cn=qadb1.int.example.info ,ou=QAServers,dc=tor,ou=hosts,dc=example,dc=info objectClass: puppetClient objectClass: device objectClass: exampleHost objectClass: dNSDomain2 cn=qadb1.int.example.info role: DBA role: QA environment: qa datacenter: tor aRecord: 10.10.12.53 dc: qadb1.int.example.info if a DBA wants to edit this entry, it hits the first ACL, sees the DBA user in the dba group and allows the change. If a QA person wants to edit the entry, it hits the first ACL, sees role=DBA, and checks the DBA group, but the QA user is not in the DBA group and rejects the change, even though the next ACL would have allowed the change, it just doesn't hit it. Is it possible to somehow use the ACLs above without have to make lots of ACL rules that combine all the possible combos, such as role=DBA, role=QA, role=DBAQA, role=DBADEV, role=DBABI, etc...? Such as adding a third entry (eg, this would work, but would like to find a more elegant solution): access to dn.subtree="ou=hosts,dc=example,dc=info" filter=(role=DBAQA) attrs=puppetclass,puppetvar,environment by group/groupOfUniqueNames/uniqueMember="cn=dba,ou=groups,dc=example,dc=info" write by group/groupOfUniqueNames/uniqueMember="cn=qa,ou=groups,dc=example,dc=info" write by group="cn=sysadmin,ou=ldapgroup,dc=example,dc=info" write by * read Thanks, Andrew

2 2

Re: Delta replication don't starts if consumer supports SSL?
by paler cryptkeeper 08 Feb '13

08 Feb '13

Mmmm.. the fact is that is *in the consumer* that I had to disable ldaps, not on the provider, the provider is now supporting ldap and ldaps; if I enable ldaps in the consumer, replication does not start, even when specifying provider=ldap://provider-host:389.. One more thing that results strange to me is that if I put a wrong configuration under syncrepl on the consumer, the server does not start and logs some messages, but If the configuration is fine, the server starts but the replication does not, and nothing gets logged, in the consumer nor in the provider.. thanks! 2013/2/6 Quanah Gibson-Mount <quanah(a)zimbra.com> > --On Wednesday, February 06, 2013 6:33 PM -0200 paler cryptkeeper < > paler.cryptkeeper(a)gmail.com> wrote: > > >> Hi. >> >> Today I had to set up two OpenLDAP instances (2.4.33), with delta >> replication under SSL/TLS, something pretty common, I think. >> The installation (from source), initializing and TLS support setup went >> fine, and both, provider and consumer, started up without problems, and >> searches did well on both, with ldapd and ldaps. However, the replication >> never started. After a while (almost 2.5 hours!! and so many slapd.conf >> files..) I tried to start the consumer without ldaps support, only ldap, >> and the replication started perfectly! Is this normal? Could be something >> with the config? The only thing that changed between a not working state >> and a working one was that if 'slapd -d 256 -h "ldap:/// ldaps:///"' was >> used, replication didn't start, and with only 'slapd -d 256' the >> replication started normally.. I repeat that with the first option, >> beside replication, everything else worked fine, even searches using >> ldaps.. >> It's something I could not explain to or customer.. can someone explain >> it to me? :) >> Thanks! >> > > Likely it couldn't negotiate the SSL connection. I would guess you failed > to set the cert options in the syncrepl line. Since you provide no detail > into your configuration, all I can do is guess. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Cuando crees que ya has llegado al piso y que no puedes caer mas bajo, descubres que hay un subsuelo...

1 0

Enforce TLS?
by Patrick Lists 07 Feb '13

07 Feb '13

Hi, I've gone through slapd.access a couple of times but I can't wrap my head around the mountain of information. IMHO that man page could do with a few more examples for us mere mortals :-) FYI: I was not able to find what ssf=<n>, transport_ssf=<n>, tls_ssf=<n>, sasl_ssf=<n> mean and which possible values (+ meaning of those values) I can set them too. Missing info? Goal: allow 127.0.0.1 and ::1 non-TLS access and all other connections must use TLS. Anyone perhaps have an example that can get me started? Thanks! Patrick

2 2

import Certificate to userCertificate
by Алексей 07 Feb '13

07 Feb '13

*Hello. I have a problem with importing certificate to OPENLDAP. I had exported a Certificate from Active Directory and then tried to import it into userCertificate attribute. The system show me error because i didn't use binary in file ldif. After I had done correction of file "ldif", I received message value #0 normalization failed. When I change a SYNTAX of userCertificate from 1.3.6.1.4.1.1466.115.121.1.8 to 1.3.6.1.4.1.1466.115.121.1.40 the file was importing well, and LDAP Browser show me data in attribute userCertificate as Certificate. I could also export data from OPENLDAP. And now question: what difference between 1.3.6.1.4.1.1466.115.121.1.8 and 1.3.6.1.4.1.1466.115.121.1.40, and which of syntax is more correct to use in my case? In case if 1.3.6.1.4.1.1466.115.121.1.8 is more correct how can i understand where i make mistake? I was trying to import Certificate as base64. As example userCertificate;binary:: MIIHcjCCBxygAwIBAgIQQAAAANG9zQ1Jv2ZMAM6FJDANBgkrBgEEAZxWAQIFADCBgjETMBEGCgmSJo... * * With regards, * * Aleksey *

3 7

meta backend and bad configuration file
by francesco.policastro＠selex-es.com 07 Feb '13

07 Feb '13

Hi, I am running slapd 2.4.33 on RHEL, compiled from the sources. I successfully configured meta backend using old style slapd.conf. My aim is to browse two Active Directories in two separate forests (success) and to collect in a new group all users members of two local groups, one for each domain (not done yet). For the latter I read that the dynlist overlay is what I need and I created a hdb database. The configuration examples I found for dynlist are in the cn=config style, so I felt pushed to convert my configuration (slapd -f slapd.conf -F slapd.d). I did it, but the results are not as expected, because slapd starts, but slaptest for the new config issues an error. # slaptest -f slapd.conf 51137c4c hdb_monitor_db_open: monitoring disabled; configure monitor database to enable config file testing succeeded # slaptest 51137c5a olcDbURI: value #0: unable to parse URI #0 in "olcDbURI <protocol>://<server>[:port]/<naming context>". 51137c5a config error processing olcMetaSub={0}uri,olcDatabase={1}meta,cn=config: unable to parse URI #0 in "olcDbURI <protocol>://<server>[:port]/<naming context>" slaptest: bad configuration file! I assume, please tell me if I am wrong, that if you have the new cn=config files, then slapd.conf is not used. But I remove or rename it slapd does not start and the error message is the same as for slaptest. olcDbURI: value #0: unable to parse URI #0 in "olcDbURI <protocol>://<server>[:port]/<naming context>". config error processing olcMetaSub={0}uri,olcDatabase={1}meta,cn=config: unable to parse URI #0 in "olcDbURI <protocol>://<server>[:port]/<naming context>" slapd stopped. So I am wondering if the new config files are even read when slapd starts correctly (i.e. when called with both "-f" and "-F" flags). I know that one of the new features of version 2.4.33 is just the cn=config support for meta. Any ideas? Thanks in advance, Francesco

2 1

Delta replication don't starts if consumer supports SSL?
by paler cryptkeeper 06 Feb '13

06 Feb '13

Hi. Today I had to set up two OpenLDAP instances (2.4.33), with delta replication under SSL/TLS, something pretty common, I think. The installation (from source), initializing and TLS support setup went fine, and both, provider and consumer, started up without problems, and searches did well on both, with ldapd and ldaps. However, the replication never started. After a while (almost 2.5 hours!! and so many slapd.conf files..) I tried to start the consumer without ldaps support, only ldap, and the replication started perfectly! Is this normal? Could be something with the config? The only thing that changed between a not working state and a working one was that if 'slapd -d 256 -h "ldap:/// ldaps:///"' was used, replication didn't start, and with only 'slapd -d 256' the replication started normally.. I repeat that with the first option, beside replication, everything else worked fine, even searches using ldaps.. It's something I could not explain to or customer.. can someone explain it to me? :) Thanks! -- Cuando crees que ya has llegado al piso y que no puedes caer mas bajo, descubres que hay un subsuelo...

2 1

Re: TLS problem
by Quanah Gibson-Mount 05 Feb '13

05 Feb '13

--On Monday, February 04, 2013 9:16 AM +0200 Chris <chris(a)flamengro.co.za> wrote: > Thank you for the link. I have downloaded the newest version. Please keep replies on the list. > I get the following error message in my messages file when I start slapd > > Feb 4 09:15:53 ibm-01 slapd[25637]: [INFO] Using /etc/default/slapd for > configuration > Feb 4 09:15:53 ibm-01 slapd[25642]: [INFO] Launching OpenLDAP > configuration test... > Feb 4 09:15:53 ibm-01 nslcd[18834]: [a6c6dc] failed to bind to LDAP > server ldaps://ibm-01: Can't contact LDAP server > ldpasearch gives the following results > > ldapsearch -x -Z -b'dc=flamengro,dc=co,dc=za' uid=izak > ldap_start_tls: Protocol error (2) > additional info: unsupported extended operation Are you using startTLS (extended operation) or ldaps? These are two different things, and yet it seems you are trying to use both. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

Error from MOD referral containing spaces
by Chris Palmer 05 Feb '13

05 Feb '13

I am having trouble processing referred MOD requests where the DN contains spaces. It always fails with error 32 (not found). Instance A is the master. Instance B is a replica, type refreshAndPersist, and contains "updateref ldap://instanceA:389" following the syncrepl. Both A and B are openldap 2.4.33 with identical configuration apart from the sync and referral settings. Updates to A replicate immediately and correctly to B (including those with spaces in the DN). Updates to B, without spaces in the DN, are referred to A, processed correctly on A, and replicated correctly to B. But: updates to B, *with* spaces in the DN, are referred to A where they fail with error 32. The client (using Novell jldap 2009.10.07) does not report an error, and of course the change is not replicated. The MOD to B appears in ldap.log as dn="cn=first second,ou=.......". Note the space between the two words of the CN. (This is also how MODs sent directly to A appear, which do get correctly processed). A network trace shows B generating a referral to A of the form: ldap://instanceA:389/cn=first%20second,ou=..... The MOD referral to A appears in A's ldap.log as dn="cn=first%20second,ou=....." with err=32. I'm at a loss to know where to go from here, or even which component is at fault. Can anyone help? Many thanks Chris

3 4

Can't contact server for syncrepl but can ldapsearch
by Carlo Santos 05 Feb '13

05 Feb '13

Hi guys, I have the following problem: I have two servers, ldap1 and ldap2 that I am trying to sync both ways using syncrepl. However, when I was entering an 8mb data into ldap1 using ldapadd, the changes were not propagated or was not retrieved by ldap2. What's worse is ldap2 syncrepl gets a "Can't contact server error." However, when doing an ldapsearch from the ldap2 terminal to ldap1, the results are displayed. Additionally, I was doing an ldapsearch in ldap2 while the syncing was going on. Does this have any effect? Below is the olcDatabase={2}bdb.ldif files from both ldap1 and ldap2. dn: olcDatabase={2}bdb objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {2}bdb olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcSyncUseSubentry: FALSE olcMonitoring: TRUE olcDbDirectory: /var/lib/ldap olcDbCacheSize: 1000 olcDbCheckpoint: 1024 15 olcDbNoSync: FALSE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 0 olcDbIndex: objectClass pres,eq olcDbIndex: cn pres,eq,sub olcDbIndex: uid pres,eq,sub olcDbIndex: uidNumber pres,eq olcDbIndex: gidNumber pres,eq olcDbIndex: mail pres,eq,sub olcDbIndex: ou pres,eq,sub olcDbIndex: loginShell pres,eq olcDbIndex: sn pres,eq,sub olcDbIndex: givenName pres,eq,sub olcDbIndex: memberUid pres,eq,sub olcDbIndex: nisMapName pres,eq,sub olcDbIndex: nisMapEntry pres,eq,sub olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 structuralObjectClass: olcBdbConfig entryUUID: 3c9dde1a-f65f-1031-92f3-ef68fd07464c creatorsName: cn=config createTimestamp: 20130119083743Z olcSuffix: dc=myorganization,dc=org olcRootDN: cn=admin,dc=myorganization,dc=org olcRootPW: password olcAccess: {0}to attrs=employeeType by dn="cn=sssd,dc=myorganization,dc=org" read by self read by * none olcAccess: {1}to attrs=userPassword,shadowLastChange by self write by anonymous auth by * none olcAccess: {2}to dn.base="" by * none olcAccess: {3}to * by dn="cn=config" write by dn="cn=sssd,dc=myorganization,dc=org" read by self write by * none olcSyncrepl: {0}rid=001 provider=ldaps://ldap1.myorganization.orgbinddn="cn=admin,dc=myorganization,dc=org" bindmethod=simple credentials=password searchbase="dc=myorganization,dc=org" type=refreshOnly interval=00:00:05:00 retry="5 5 300 5" timeout=1 olcSyncRepl: {2}rid=002 provider=ldaps://ldap2.myorganization.orgbinddn="cn=admin,dc=myorganization,dc=org" bindmethod=simple credentials=password searchbase="dc=myorganization,dc=org" type=refreshOnly interval=00:00:05:00 retry="5 5 300 5" timeout=1 olcMirrorMode: TRUE The ldap1 logs show nothing and the ldap2 logs display the following lines: do_syncrep2: rid=001 (-1) Can't contact LDAP server do_syncrepl: rid=001 rc -1 retrying (4 retries left) I have tried rebooting both the servers but the problem persists. I am using OpenLDAP v2.4.23 on a CentOS 6.3 VM. -- Carlo Santos

2 3

can rwm map operational attributes ?
by Benin Technologies 04 Feb '13

04 Feb '13

Hi I have a back-relay server with rwm, and I was wondering if it was possible to map operational attributes. Let's say I have (in my hdb backend): DN: cn=John Doe,ou=Accountancy,dc=company,dc=com cn:John Doe gn:John sn:Doe I'd like clients accessing my back-relay to get the OU, like this : DN :cn=John Doe,ou=Accountancy,dc=company,dc=com cn:John Doe gn:John sn:Doe *ou:Accountancy* Do I have to add an "ou" attribute to each entry in my hdb backend, or can rwm do the job of extracting the ou from the entryDN ? I tried this: dn: olcOverlay={0}rwm,olcDatabase={2}relay,cn=config changetype:modify add:olcRwmMap olcRwmMap: {2} attribute ou entryDN If it had worked I would have had something like : "ou:cn=John Doe,ou=Accountancy,dc=company,dc=com" Second step would then have been to transform that into a plain "ou:Accountancy" But even the first step didn't work, it seem rwm cannot map operational attributes like entryDN. Or am I missing something ? Thanks Ben

1 0

Re: TLS problem
by devzero2000 04 Feb '13

04 Feb '13

On Tue, Jan 29, 2013 at 7:31 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Tuesday, January 29, 2013 10:22 AM +0200 Chris <chris(a)flamengro.co.za> > wrote: > > Hi >> >> I am running Openldap 2.4.23 on RHEL6. I can telnet to the server on both >> 389 636 ports. >> I can do a ldapsearch and ldapadd without any errors. I get this error >> when I start the slapd daemon. >> > > In addition to the issue noted by Rich, I would note that you are using an > ancient release with numerous known issues that is not suitable for a > production LDAP server. I would strongly advise you to use a current > OpenLDAP release. If you do not feel comfortable building OpenLDAP > yourself, there are packages available at <http://ltb-project.org/wiki/** > download#openldap <http://ltb-project.org/wiki/download#openldap>> that > should meet your needs. > Yes, probably it is the best thing to do. BUT have you recently looked to the bugfix openldap backport from RED HAT ? Or from other commercial distro ? New feature is a point, but old bugfix are another. JMHO. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > >

1 0

client server connection to LDAP/Kerberos
by Asmaa Ahmed 04 Feb '13

04 Feb '13

Hello, I recently added Kerberos authentication to my LDAP server, and I am trying to connect the other servers to it.I have a server running Davical shared calendar, and I hope to get it working with my LDAP server again after Kerberos integration. Here is my configuration which was working before the integration and my source is "http://wiki.davical.org/w/Configuration/LDAP#Kerberos_Authentication" $c->authenticate_hook['config'] = array( 'host' => 'ldap.domain.com', //host name of your LDAP Server 'port' => '389', //port// 'bindDN' => 'cn=admin,dc=domain,dc=com', //DN to bind request to this server (if required)// 'passDN' => 'password', //Password of request bind 'baseDNUsers' => 'ou=People,dc=domain,dc=com', //where to look for valid user 'filterUsers' => 'objectClass=*', //filter which must validate a user according to RFC4515, i.e. surrounded by brackets 'protocolVersion' => 3, // important for simple auth (no sasl)// 'startTLS' => true, // securing your LDAP connection 'i_use_mode_kerberos' => "i_know_what_i_am_doing", My slapd error logs:Jan 31 23:40:00 ldap slapd[1059]: conn=1273 fd=43 ACCEPT from IP=203.28.247.193:56887 (IP=0.0.0.0:389)Jan 31 23:40:00 ldap slapd[1059]: conn=1273 op=0 BIND dn="" method=128Jan 31 23:40:00 ldap slapd[1059]: conn=1273 op=0 RESULT tag=97 err=0 text=Jan 31 23:40:00 ldap slapd[1059]: conn=1273 op=1 SRCH base="ou=People,dc=domain,dc=com" scope=2 deref=0 filter="(objectClass=*)"Jan 31 23:40:00 ldap slapd[1059]: conn=1273 op=1 SRCH attr=uid modifyTimestamp cn mailJan 31 23:40:00 ldap slapd[1059]: conn=1273 op=1 SEARCH RESULT tag=101 err=32 nentries=0 text=Jan 31 23:40:00 ldap slapd[1059]: conn=1273 op=2 UNBIND My OLC configuration:root@ldap:/var/log# ldapsearch -LLLQY EXTERNAL -H ldapi:/// -b cn=config "(|(cn=config)(olcDatabase={1}hdb))"dn: cn=configobjectClass: olcGlobalcn: configolcArgsFile: /var/run/slapd/slapd.argsolcAuthzRegexp: {0}uid=([^,]+),cn=domain.com,cn=gssapi,cn=auth uid=$1 ,ou=people,dc=domain,dc=comolcLogLevel: statsolcPidFile: /var/run/slapd/slapd.pidolcSaslRealm: DOMAIN.COMolcToolThreads: 1 dn: olcDatabase={1}hdb,cn=configobjectClass: olcDatabaseConfigobjectClass: olcHdbConfigolcDatabase: {1}hdbolcDbDirectory: /var/lib/ldapolcSuffix: dc=domain,dc=comolcAccess: {0}to attrs=userPassword,shadowLastChange by anonymous auth by * no neolcAccess: {1}to dn.subtree="ou=krb5,dc=domain,dc=com" by dn="c n=adm-srv,ou=krb5,domain,dc=com" write by dn="cn=kdc-srv,ou =krb5,domain,dc=com" read by * noneolcAccess: {2}to attrs=loginShell,gecos by self write by users read by * noneolcAccess: {3}to dn.base="" by * readolcAccess: {4}to * by users read by * noneolcLastMod: TRUEolcRootDN: uid=admin,ou=people,domain,dc=com Any suggestion to fix the binding and get my search working again with kerberos authentication ? Thanks.

2 4

Access control
by Philip Colmer 04 Feb '13

04 Feb '13

I'm trying to get access control for writing to groups as automated as possible, in as much as I would like LDAP to be able to determine who is able to write based on other attributes. I've been able to successfully do this if I only need to grant access to one or a few individuals, by specifying their DN as a value to an attribute, and then using this ACL: add: olcAccess olcAccess: {2}to dn.sub="ou=groups,dc=example,dc=com" by dnattr="owner" write by users read by * none That works really well - I just add the owner attribute to an object, specify the owner's DN and they can then write to the object. However, for larger scale permissions, I need to be able to use the membership of a group. Now I've read http://www.openldap.org/faq/data/cache/52.html and seen that you can specify: access to <what> by group/<objectclass>/<attributename>=<DN> <access> However, that would require me to explicitly set the DN of the group in the access control itself. What I want/need to be able to do is for LDAP to read the DN of the group that has permission, in the same what that it does with dnattr. I thought that I had read something about this being possible with sets, but slapd.access says that "The statement set=<pattern> is undocumented yet." so I'm not clear if that is the most appropriate way to proceed. Can someone please advise on how this might be accomplished? Thanks. Philip

2 5

configure ldap + cyrus sasl on debian 6
by Benin Technologies 03 Feb '13

03 Feb '13

Hi, I tried to install OpenLDAP with Cyrus SASL support on Debian. I'm running Debian 6.0.4, and until now I was using an 2.4.23 installation, from debian packages. First attempt : installation of OpenLDAP 2.4.33 with default configure options. After installation, I converted slapd.conf to cn=config Then I dropped the database, and tried to rebuild a new one by loading a ldif file (like I'm used to do with my previous installation, from Debian packages) ldapadd -Y EXTERNAL -H ldapi:/// -f myfile.ldif ldapadd: not compiled with SASL support Second attempt I installed Cyrus-SASL-2.1.26 (with default configure options) Then I installed OpenLDAP, "--with-cyrus-sasl" This time, I got the following message: ldapadd -Y EXTERNAL -H ldapi:/// -f myfile.ldif ldap_sasl_interactive_bind: Can't contact LDAP server (-1) What step did I miss ? B.

2 4

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical