- openldap-technical - openldap.org

problem with ldap group check in squid
by Fuhrmann, Marcel 03 Feb '13

03 Feb '13

Hello, i'm trying to to configure squid to use a ldap (ADS 2008) group check to give access to the internet. The squid mailing list couldn't help me. Maybe you can. /usr/lib64/squid/squid_ldap_group -d -v3 -b 'ou=OU3,ou=OU2,ou=OU1,dc=DOMAIN,dc=LOCAL' -f \ '(&(sAMAccountName=%v)(memberOf=cn=%a,ou=USERGRUPPEN,dc=DOMAIN,dc=LOCAL))' -D cn=LDAP,cn=USERS,dc=DOMAIN,dc=LOCAL \ -w PASSWORT -h DOMAINCONTROLLER testuser internet Connected OK group filter '(&(sAMAccountName=testuser) (memberOf=cn=internet,ou=USERGROUPS,dc=DOMAIN,dc=LOCAL))', searchbase 'ou=OU3,ou=OU2,ou=OU1,dc=DOMAIN,dc=LOCAL' ERR The user TESTUSER is in OU3. The group INTERNET is in a OU called USERGROUPS. TESTUSER is member of INTERNET. But it doesn't work. Can somebody give me advice? Thanks a lot -- Marcel

1 1

Hello!!
by Bob Fitch 03 Feb '13

03 Feb '13

http://www.bellacroquercreations.com/components/com_content/yaid352.php Bob Fitch 2/3/2013 5:35:12 AM _____

1 0

slapd-meta and tls_reqcert=allow
by Jim Vanes 01 Feb '13

01 Feb '13

I'm using OpenLDAP 2.4.23-26 from Centos 6. I seem to be hitting a configuration issue regarding slapd-meta and SSL/TLS. Here is my meta config: database meta suffix "dc=virtual,dc=local" rootdn "cn=root,dc=virtual,dc=local" rootpw password # Local uri ldap://localhost/dc=ds1,dc=virtual,dc=local suffixmassage "dc=ds1,dc=virtual,dc=local" "dc=lab,dc=local" idassert-bind bindmethod=simple binddn="cn=root,dc=lab,dc=local" credentials=password #Remote AD server uri ldap://10.33.63.125:389/dc=ad1,dc=virtual,dc=local tls start suffixmassage "dc=ad1,dc=virtual,dc=local" "dc=mslab,dc=local" idassert-bind bindmethod=simple binddn="CN=Sync,CN=Users,DC=lab,DC=local" credentials="Password1" starttls="yes" tls_reqcert="allow" It seems as though tls_reqcert="allow" is ignored for the remote AD server. If set that variable in the ldap.conf everything works fine. But shouldn't the above function as an override to the default of 'demand'? The behaviour is the same when I change the above to use SSL instead. Another thing I noticed was that adding tls_crlcheck="none" to my idassert-bind line causes slaptest to fail..not sure if this is related or not. /etc/openldap/slapd.conf: line 68: "idassert-bind <args>": unable to parse field "tls_crlcheck=none". slaptest: bad configuration file! I must be misunderstanding the docs. Any help would be appreciated.

3 4

missing entry in slapcat backup
by Meike Stone 01 Feb '13

01 Feb '13

Hello dear List, I tried to import a slapcat backup from our production machine in a test environment and got following message: debld02:~ # time slapadd -w -q -f /etc/openldap/slapd.conf -l /backup.ldif 50f98421 mdb_monitor_db_open: monitoring disabled; configure monitor database to enable -#################### 100.00% eta none elapsed 09m18s spd 4.6 M/s Closing DB...Error, entries missing! entry 1156449: ou=a,ou=b,ou=c,ou=root First I did not noticed this message, but now I see the database is broken, because the node "ou=a" is missing. So my questions: - What ist the origin for such orphaned nodes (In MMR, it happens and I see a few glue records, but in my backup this one node is complete missing...)? - How can I prevent from such entires and how can I recognize them without importing? - How can I remove this entry (esp. in production DB without downtime), because a delete show following messages: ~ # ldapdelete -x -h localhost -w password -D cn=admin,ou=root 'cn=cname,ou=a,ou=b,ou=c,ou=root' ldap_delete: Other (e.g., implementation specific) error (80) additional info: could not locate parent of entry and if I try to add this missing node, then I get: ldapadd -x -h localhost -w password -D"cn=admin,ou=root" -f test.ldif adding new entry ou=a,ou=b,ou=c,ou=root ldap_add: Already exists (68) Thanks for help Meike

4 11

Duplicate attributeType: "2.5.4.35"
by rodrigo tavares 01 Feb '13

01 Feb '13

Hello, In my samba.schema, added the atribute userPassword. attributetype ( 1.3.6.1.4.1.7165.2.1.24 NAME 'sambaLMPassword' DESC 'LanManager Password' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} SINGLE-VALUE ) attributetype ( 1.3.6.1.4.1.7165.2.1.25 NAME 'sambaNTPassword' DESC 'MD4 hash of the unicode password' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} SINGLE-VALUE ) attributetype ( 2.5.4.35 NAME 'userPassword' DESC 'RFC2256/2307: password of user' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40{128}) Then, i excute command slapindex -v. root@fileserver02:/etc/ldap/schema# slapindex -v WARNING! Runnig as root! There's a fair chance slapd will fail to start. Check file permissions! /etc/ldap/schema/samba.schema: line 195 attributetype: Duplicate attributeType: "2.5.4.35" slapindex: bad configuration file! What´s wrong ? Rodrigo

3 4

server-side sub-search
by Benin Technologies 31 Jan '13

31 Jan '13

Hi, Is it possible to do a server-side sub-search before returning the data to the client ? Let's say I have this tree : ---> dc=com | |-->dc=mycompany | | --> cn=Jane Doe | |-- objectClass=inetOrgPerso |-- cn=Jane Doe |-- mobile : 11223344 | --> cn=secretary | |-- objectClass=organizationalRole |--cn=secretary |--telephoneNumber=12345678 |--roleOccupant=cn=Jane Doe,dc=mycompany,dc=com I'd like to return, in a single search, something like : cn : Jane Doe - mobile : 11223344 - telephoneNumber : 12345678 Can this be done ? Ben

2 2

Search speed regarding BDB_IDL_LOGN and order in search filter
by Meike Stone 31 Jan '13

31 Jan '13

Hello, I'm sorry, but I want to ask again for clarifying. First question: - An index slot is loosing precision if the search result for an (indexed) attribute is larger than 2^16. Then the search time is going to increase a lot. - I can change this via BDB_IDL_LOGN. - But if I have a directory, that holds 200.000 employees with '(ObjectClass=Employees)', the result is larger than 2^16 and it is slow. - lets say, the employees are distributed over 4 continents and the DIT is structured geographical eg.: o=myOrg, c=us (100,000 employees) o=myOrg, c=gb ( 30,000 employees) o=myOrg, c=de ( 25,000 employees) o=myOrg, c=br ( 45,000 employees) Can i prevent it this problem with index slot size, if I change the search base to "o=myOrg, c=gb", because there are only 30,000 employees. This takes me to the second question: "How is a search filter evaluated?" Lets say, I combine three filter via "and" like '(&(objectlass=Employees)(age=30)(sex=m))' and the all attributes are indexed. Each filter results: (objectlass=Employees) => 200,000 entries (age=30) => 10,000 entries (sex=m) => 3,000 entries Does the order matter regarding speed, is it better to form the filter like this? '(&(sex=m)(age=30)(objectlass=Employees))' Thanks Meike

2 2

CLOSE_WAIT TCP connection
by Vanpeer 31 Jan '13

31 Jan '13

Hello, Could you please help me to understand the problem that i didn't really resolv.. I have my openldap platform which has been working well OpenldapServer : 2.3.39 Openldapclient : RedHat 5.x with nss_ldap and pam_ldap.so release 253-51 All my servers were configured with : /etc/nsswitch.conf /etc/ldap.conf and /etc/pam.d/sshd The user authentification with ssh connection is perfect. The filter of authorisation host connection is ok too. Everything is ok. But i've recently realized that i have a lot of TCP CLOSE_WAIT connexion from differents servers to my OpenLdapServer. These connexions are somethings like : tcp 1 0 IP_CLIENT:44633 OPENLDAP_SERVER:389 CLOSE_WAIT 3321/crond off (0.00/0/0) tcp 1 0 IP_CLIENT:44674 OPENLDAP_SERVER:389 CLOSE_WAIT 2426/nagios off (0.00/0/0) tcp 1 0 IP_CLIENT:44956 OPENLDAP_SERVER:389 CLOSE_WAIT 4652/ntpd off (0.00/0/0) ..... And so on .. I have ~20 TCP CLOSE_WAIT connection to OPENLDAP_SERVER I don't understand when these applications tried to connect to OPENLDAP server and why i have TCP persistent connexion. Meanwhile, I only have SSHD configured to use pam_ldap.so ... Someone can help me please ?!? Thanks by advance for your answer and i m sorry about my English

1 0

indexing with mdb
by anil beniwal 30 Jan '13

30 Jan '13

Hi i am using openldap 2.4.33 on rhel 6.3 with large mdb database size. We are using it for last few weeks, now we want to add index few attributes. What approach we should take, so that there is no downtime. How we can check the status if indexing is complete or not ? with both dynamic and static config We are using flat file configuration. Anil

1 0

Kerberos/LDAP integration
by Asmaa Ahmed 30 Jan '13

30 Jan '13

Hello, I am trying to integrate Kerberos to my Openldap server, and I am following pretty much the instructions from there 'http://www.rjsystems.nl/en/2100-d6-kerberos-openldap-client.php'But still can't get it work to connect the client server to the LDAP one after the integration!I can see this error in my logs:Jan 30 17:27:17 mail nscd: nss_ldap: failed to bind to LDAP server ldapi://ldap.domain.com/: Can't contact LDAP serverJan 30 17:27:17 mail nscd: nss_ldap: reconnecting to LDAP server (sleeping 1 seconds)...Jan 30 17:27:18 mail nscd: nss_ldap: failed to bind to LDAP server ldapi://ldap.domain.com/: Can't contact LDAP serverJan 30 17:27:18 mail nscd: nss_ldap: could not search LDAP server - Server is unavailable Thanks.

2 2

ldapsearch question
by Benin Technologies 30 Jan '13

30 Jan '13

Hi, I was wondering if the following search can be done. Let's say I have this tree : ---> dc=com | |-->dc=mycompany | | -->cn=Jane Doe | |-- objectClass=inetOrgPerson |-- cn=Jane Doe |-- mobile : 11223344 |--> cn=secretary | |--objectClass=organizationalRole |--cn=secretary |--telephoneNumber = 12345678 I'd like to return, in a SINGLE search, something like : cn : Jane Doe - mobile : 11223344 - telephoneNumber : 12345678 In other words, I'd like the search to return the attribute telephoneNumber AS an attribute of Jane Doe, and not as an attribute of Jane Doe --> cn=secretary Ben

2 1

ldapsearch trying to use SASL
by Scott Classen 29 Jan '13

29 Jan '13

Hello, I have a script which checks for the existence of an email address in my LDAP directory. the relevant line is: ldapsearch -D "uid=nss,dc=bah,dc=com" -w mypassword -b "ou=People,dc=blah,dc=com" uid=bobthebuilder mail If I run this script as the root or tomcat user it works as expected and returns the mail attribute. If this script is called from Apache Tomcat webapp (running as the tomcat user). I receive the following errors in my slapd.log file: Jan 29 13:59:29 bl1 slapd[3783]: conn=247839 fd=26 ACCEPT from IP=131.1.2.3:50230 (IP=0.0.0.0:389) Jan 29 13:59:29 bl1 slapd[3783]: conn=247839 op=0 SRCH base="" scope=0 deref=0 filter="(objectClass=*)" Jan 29 13:59:29 bl1 slapd[3783]: conn=247839 op=0 SRCH attr=supportedSASLMechanisms Jan 29 13:59:29 bl1 slapd[3783]: conn=247839 op=0 SEARCH RESULT tag=101 err=0 nentries=1 text= Jan 29 13:59:29 bl1 slapd[3783]: conn=247839 op=1 BIND dn="uid=nss,dc=bah,dc=com" method=163 Jan 29 13:59:29 bl1 slapd[3783]: conn=247839 op=1 RESULT tag=97 err=14 text=SASL(0): successful result: security flags do not match required Jan 29 13:59:29 bl1 slapd[3783]: conn=247839 op=2 BIND dn="uid=nss,dc=bah,dc=com" method=163 Jan 29 13:59:29 bl1 slapd[3783]: SASL [conn=247839] Failure: no secret in database Jan 29 13:59:29 bl1 slapd[3783]: conn=247839 op=2 RESULT tag=97 err=49 text=SASL(-13): user not found: no secret in database Jan 29 13:59:29 bl1 slapd[3783]: conn=247839 fd=26 closed (connection lost) I don't understand why the ldapsearch is searching for attr=supportedSASLMechanisms when invoked from within a Tomcat Webapp, but works fine when invoked from a c shell. Any ideas? Your help is greatly appreciated. Scott

2 2

TLS problem
by Chris 29 Jan '13

29 Jan '13

Hi I am running Openldap 2.4.23 on RHEL6. I can telnet to the server on both 389 636 ports. I can do a ldapsearch and ldapadd without any errors. I get this error when I start the slapd daemon. /ldap_start_tls_s() failed: Can't contact LDAP server: Transport endpoint is not connected (uri="ldap://ldapserver")// //failed to bind to LDAP server ldap://ldapserver: Can't contact LDAP server: Transport endpoint is not connected/ When I do a ldapsearch -x -d1 -Z -b 'dc=flamengro,dc=co,dc=za' I get the following error /TLS: certificate [//CA certificate details omitted here...] is not valid - error -8172:Peer's certificate issuer has been marked as not trusted by the user..// //TLS: error: connect - force handshake failure: errno 0 - moznss error -8172// //TLS: can't connect: TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user..// //ldap_err2string// //ldap_start_tls: Connect error (-11)// // additional info: TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user/ Any help will be appreciated. This is my slapd.conf file include /etc/openldap/schema/corba.schema include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/duaconf.schema include /etc/openldap/schema/dyngroup.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/java.schema include /etc/openldap/schema/misc.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/ppolicy.schema include /etc/openldap/schema/collective.schema allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args TLSCipherSuite HIGH TLSCertificateFile /etc/pki/tls/certs/slapdcert.pem TLSCertificateKeyFile /etc/pki/tls/certs/slapdkey.pem TLSVerifyClient never database bdb suffix "dc=flamengro,dc=co,dc=za" checkpoint 1024 15 rootdn "cn=Manager,dc=flamengro,dc=co,dc=za" rootpw secret directory /var/lib/ldap/flamengro index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub database monitor # allow only rootdn to read the monitor access to * by dn.exact="cn=Manager,dc=flamengro,dc=co,dc=za" read by * none access to attrs=userPassword,shadowLastChange by anonymous auth by self write by * none I

4 3

Atribute Samba
by rodrigo tavares 29 Jan '13

29 Jan '13

Hi, I have a master ldap master, then make replication. The replication is ok, but when i see the samba atributes are empty. sambaAcctFlags: [U] sambaLogonScript: netlogon.vbs sambaPasswordHistory: 00000000000000000000000000000000000000000000000000000000 00000000 sambaPwdCanChange: 1359464617 sambaPwdLastSet: 1359464617 sambaPwdMustChange: 2147483647 sambaLMPassword: sambaNTPassword: sambaSID: S-1-5-21-4183517729-3427035622-36389750-6040 sambaPrimaryGroupSID: S-1-5-21-4183517729-3427035622-36389750-3003 Any suggestion ? Rodrigo Faria Tavares

1 0

Replication LDAP Users Samba
by rodrigo tavares 29 Jan '13

29 Jan '13

Hello, Today, I have one host vmware, it a master, it replicate all datas about LDAP from filesever01 (Samba). Using LDAP, I using the inteface, and when i create a ldap user, it create a samba account. So, i not need create user samba. ldap admin dn = cn=admin,dc=def,dc=mg,dc=gov,dc=us ldap group suffix = ou=Groups ldap machine suffix = ou=Computers ldap passwd sync = yes pam password change = yes encrypt passwords = True ldap suffix = ou=def,dc=def,dc=mg,dc=gov,dc=us ldap ssl = no ldap user suffix = ou=Users Well, When I remove slapd config replicate, i got change users samba passwords. But is replication LDAP is active, my ldap users can to email, but sambausers is not login in domain. root@fileserver02:~# smbclient -L localhost -U house.green Enter house.green's password: session setup failed: NT_STATUS_LOGON_FAILURE Any suggestion ? Rodrigo Faria Tavares

1 0

389 port is closed from the client point of view
by Asmaa Ahmed 29 Jan '13

29 Jan '13

Hello, I am trying to get my ldap binding running, but some how it doen't work!When I checked the port using nmap, I can see clearly that it is closed while the server listens to it! client# nmap -p 389 ldap.domain.com Starting Nmap 5.00 ( http://nmap.org ) at 2013-01-29 23:09 ESTInteresting ports on ldap.domain.com (203.28.247.83):PORT STATE SERVICE389/tcp closed ldap Nmap done: 1 IP address (1 host up) scanned in 0.06 seconds root@server:/etc/ldap# nmap -p 389 localhost Starting Nmap 5.00 ( http://nmap.org ) at 2013-01-29 23:09 ESTInteresting ports on localhost (127.0.0.1):PORT STATE SERVICE389/tcp open ldap Nmap done: 1 IP address (1 host up) scanned in 0.04 secondsroot@server:/etc/ldap#root@server:/etc/ldap# nmap localhost Starting Nmap 5.00 ( http://nmap.org ) at 2013-01-29 23:10 ESTInteresting ports on localhost (127.0.0.1):Not shown: 994 closed portsPORT STATE SERVICE22/tcp open ssh80/tcp open http389/tcp open ldap464/tcp open kpasswd5636/tcp open ldapssl749/tcp open kerberos-adm Nmap done: 1 IP address (1 host up) scanned in 0.05 secondsroot@server:/etc/ldap# cat /etc/hosts127.0.0.1 localhost#127.0.1.1 ldap.domain.com ldap203.28.247.83 ldap.domain.com ldap How can I fix this? Thanks.

2 3

Re: replication between a back-sql master and back-hdb slave
by Benin Technologies 29 Jan '13

29 Jan '13

ok thanks I found that in the mailing list archive, dating back from 2007 (http://www.openldap.org/lists/openldap-software/200708/msg00015.html) Indeed back-sql was intended to loosely support acting as a syncrepl provider (limited to refreshOnly), but it's currently broken, and it's never been fixed (mostly due to lack of interest). Patches (or sponsorships) are welcome. Ing. Pierangelo Masarati OpenLDAP Core Team So I was wondering if it has been fix since... > your question is, can I use back-sql as syncperov. A sql backend is not > a fully featered database to use with slapd. > > -Dieter >

3 4

Usage of groups in an access control
by Marco de Booij 28 Jan '13

28 Jan '13

I use openLDAP already for years to store my users so I have to define them only once. The users can logon to both Linux and Windows (samba). Now I want to add address-books and manage the access rights. I have a problem with the usage of groups in an access control. I want to gave addressbooks in my LDAP but they should not be accessible by everybody. I used http://www.openldap.org/faq/data/cache/52.html to configure openLDAP but it does not seem to work. I have created a group like this: dn: cn=abk-admin,ou=Roles,dc=example,dc=com objectClass: groupOfNames member: cn=My ENTRY,ou=People,dc=example,dc=com cn: abk-admin and an address-book like this: dn: ou=abk1,ou=Addressbooks,dc=example,dc=com ou: abk1 objectClass: organizationalUnit objectClass: top (Both entries are output of slapcat. I did not put in the attributes like creatorsName and entryUUID) In the slapd:conf I have the following access rules: access to attrs=userPassword,sambaNTPassword,sambaLMPassword,sambaPwdMustChange,sambaPwdLastSet by dn="cn=admin,dc=example,dc=com" write by dn="cn=proxyuser,dc=example,dc=com" read by anonymous auth by self write by * none access to attrs=shadowLastChange,shadowMax by self write by * read access to dn.base="" by * read access to * by dn="cn=admin,dc=example,dc=com" write by * read access to dn.children="ou=abk1,ou=Addressbooks,dc=example,dc=com" by dn="cn=admin,dc=example,dc=com" write by groupOfNames="cn=abk-admin,ou=Roles,dc=example,dc=com" write by groupOfNames="cn=abk-user,ou=Roles,dc=example,dc=com" read by * none I searched around and changed dn.children by dn.subtree and dn.one but the result is the same. I can read the entries but I cannot insert or delete an entry. I can only do this with admin but only if the line for admin is defined. What did I do wrong or understood wrong? I tried to find the answer on the internet but was not able :( OpenLDAP: slapd 2.4.23 (Jun 16 2011 02:53:39) Debian 6.0.6 Regards, Marco

4 6

Re: Permissions, users, startup when install from source
by Ori Bani 28 Jan '13

28 Jan '13

Thanks for your reply, >> If compiling and installing from source, I don't see any information >> in the manual about how to auto-start the software and about >> process/file/directory permissions and ownership. I'm still searching >> the Faq-O-Matic (which is a little frustrating). >> >> Taking a step back, I'd love to install from yum on RHEL/CentOS and >> let it be taken care of in a trusted manner. But we require better >> password hashing than SHA1, so we are required to compile by hand >> using the passwd/sha2 contributed module (little surprised this isn't >> accepted into the core project, but I'm sure there are reasons). >> Maybe I can find this in a third-party repo somewhere? > > Not sure what you mean. the SHA2 contrib module is shipped with every > OpenLDAP release. Thus, as best I can tell, it is indeed included. My "surprised" comment is in reference to the fact that the default build of OpenLDAP only supports SHA1, which is widely regarded as deprecated. Why hasn't the sha2 module been migrated out of the contrib directory is what I am getting at (which commonly requires situations like this -- forcing people who wouldn't otherwise do so to install from source just to obtain this feature). One could argue that situations like this contribute to the lack of adoption of stronger password schemes in general. Something of an off-topic tangent. > If you are using RHEL or CentOS, you may be interested in > <http://ltb-project.org/wiki/download#openldap> Great. I will investigate. Does anyone else know of any yum-compatible repos that have a sha2-enabled OpenLDAP build in them? Anyone know anything about the OpenLDAP packages in RepoForge? I actually only assumed without testing that the OpenLDAP package in the CentOS base repo doesn't have the sha2 module compiled in. I should go back and check that assumption. Also, reflecting on the installation of the sha2 module, it occurs to me that short of the CentOS repo package already having sha2 compiled in, the best course of action is probably to compile only the sha2 module and use it with the CentOS package --- including the module in the slapd configuration seems to be the extent of integration, so that should work, no? If so, I think this would be the best option. >> After installation, what is commonly done in this regard? Create >> user/group "ldap" with no login shell and chown ldap:ldap on >> /usr/local/var/openldap-data? Is that all? > > It depends on your needs. I have done anything from running slapd as root, > to running it as a specific user. I'd welcome pointers to somewhere this is discussed (don't see it in the docs, maybe in the FAQ?). I don't have needs that are much different than anyone else. I naively assume slapd should generally not be run as root. In that case, is creating a ldap user/group and chowning the openldap-data directory the only things to do? >> Then what do people use for auto-starting the software (presumably >> with -u ldap -g ldap) in a RedHat environment? > > I wrote my own startup script that works with chkconfig. > <http://linuxcommand.org/man_pages/chkconfig8.html> I'm looking for anyone who wants to share such scripts. Thanks kindly for your time, much appreciated.

5 9

Re: syncrepl issue
by Meike Stone 28 Jan '13

28 Jan '13

> > a) Use a current release. That would be 2.4.33. > b) Delta-syncrepl supports MMR in current releases > c) The reason I suggest delta-syncrepl is because syncrepl is known to be > problematic, particularly with MMR. If you want reliable replication, use > delta-syncrepl. Is it recommended in MMR setups to use delta-syncrepl before syncrepl in general? Are there any disadvantages, like using more RAM, or other things to care..? Thanks, Meike

2 1

replication between a back-sql master and back-hdb slave
by Benin Technologies 28 Jan '13

28 Jan '13

Hi, I set up a back-sql server to access some existing data in a postgresql database. I was wondering if it's possible to replicate that server to some (read-only) back-hdb servers. Thanks BT

2 2

Is any way to make proxy cache working for acl requests?
by Tio Teath 28 Jan '13

28 Jan '13

I'm thick and tired of configuring this dame thing! I mean slapo-pcache. It just won't work. Is any way to force this to cache JUST EVERYTHING, including ACL requests to remote server? I don't care of disk or memory usage, I just want dame thing working!

1 0

back-sql : defining groups
by DavidHornung 27 Jan '13

27 Jan '13

Hello, until now I don't understand how to add users to a group in Openldap with back-sql I use a VIEW for ldap_entries like described in the manual pages of slapd-sql. CREATE VIEW ldap_entries (id, dn, oc_map_id, parent, keyval) AS SELECT 0, UPPER(’o=MyCompany,c=NL’), 3, 0, ’baseObject’ FROM unixusers WHERE userid=’root’ UNION SELECT (1000000000+userid), UPPER(CONCAT(CONCAT(’cn=’,gecos),’,o=MyCompany,c=NL’)), 1, 0, userid FROM unixusers UNION SELECT (2000000000+groupnummer), UPPER(CONCAT(CONCAT(’cn=’,groupnaam),’,o=MyCompany,c=NL’)), 2, 0, groupnummer FROM groups; How can I add users to a group? 1.) build additional entries like uid=testuser,cn=group1,o=MyCompany,c=NL OR 2.) use the memberOf Attribute (but how?) Thank you for your answers Cheers, David

1 0

Re: slapcat output is truncated every now and then
by Bálint Réczey 26 Jan '13

26 Jan '13

Hi Quanah, 2013/1/25 Quanah Gibson-Mount <quanah(a)zimbra.com> > --On Friday, January 25, 2013 12:07 AM +0100 Bálint Réczey < > balint(a)balintreczey.hu> wrote: > > >> I have a attached two patches hoping that they may be useful. >> > > I suggest you file an ITS if you want them considered for inclusion: > I have file them under http://www.openldap.org/its/index.cgi?findid=7503 and http://www.openldap.org/its/index.cgi?findid=7504 hopefully complying to the instructions. Please CC me in further related discussions about the problem because I will unsubscribe from the list for now. Cheers, Balint

2 2

using back-sql with cn=config
by Benin Technologies 25 Jan '13

25 Jan '13

Hi, Has anyone out there managed to successfully convert slapd.conf into cn=config with back-sql enabled ? I'm on Debian 6 / OpenLDAP 2.4.33 with back-sql support (./configure --enable-sql) According tohttp://www.openldap.org/software/release/changes.html, back-sql supports dynamic config as of version 2.4.27. So I converted slapd.conf to slapd.d, conversion went well. However, when I start slapd, I get the following message : # /usr/local/libexec/slapd -u openldap -g openldap -d -1 ....... 50ff3f0a<<< dnPrettyNormal:<cn=root,dc=example,dc=com>,<cn=root,dc=example,dc=com> 50ff3f0a olcSqlInsEntryStmt: value #0:<olcSqlInsEntryStmt> extra cruft after<SQL expression>. 50ff3f0a config error processing olcDatabase={1}sql,cn=config: <olcSqlInsEntryStmt> extra cruft after<SQL expression> 50ff3f0a send_ldap_result: conn=-1 op=0 p=0 50ff3f0a send_ldap_result: err=19 matched="" text="" 50ff3f0a slapd destroy: freeing system resources. 50ff3f0a slapd stopped. 50ff3f0a connections_destroy: nothing to destroy. The error message seems to be "extra cruft after<SQL expression>" If I edit slapd.d/cn=config/olcDatabase={1}sql.ldif and I comment the line starting with olcSqlInsEntryStmt, then slapd starts fine. So what's the right syntax for olcSqlInsEntryStmt ??? Thanks Ben

2 2

slapd not starting at boot when compiled with --enable-sql
by Benin Technologies 25 Jan '13

25 Jan '13

Hi, I'm not sure wether this is an OpenLDAP issue or a Debian issue... When installing OpenLDAP 2.4.33 from source on Debian 6.0.4 with back-sql support, I'm unable to make it start at boot. I tested it a few times to isolate the problem, and the simple fact of installing OpenLDAP with "--enable-sql" seems to be the cause. My "/etc/init.d/slapd" file works fine, but the service won't start at boot. Does anybody have an idea ? Below the details of my tests, I tried two configurations, without and with back-sql enabled : Config 1°/ I installed OpenLDAP 2.4.33 WITHOUT back-sql support. (plain "./configure") I installed an adequate "/etc/init.d/slapd" file (inspired from the file shipped with the Debian package installation), and then I installed the slapd service (update-rc.d slapd defaults). When I reboot the debian server, everything works fine, slapd starts. Config 2°/ Same installation, but this time WITH back-sql support (./configure --enable-sql) Like before, I deployed my "/etc/init.d/slapd" file. The file works fine ("/etc/init.d/slapd start" starts the OpenLDAP server) Then I install the slapd service, it seems to install well (update-rc.d slapd defaults). But when I reboot, slapd fails to start. I tried the following commands : # service slapd start Starting OpenLDAP: slapd failed! # /etc/init.d/slapd start Starting OpenLDAP: slapd. # service slapd stop Stopping OpenLDAP: slapd So it seems the "slapd" service can not be started by the "service" command (and thus cannot be launched a boot). NOTE that the ONLY difference between Config 1 and Config 2 is that I compiled OpenLDAP with "--enable-sql". At this point, I don't even use a back-sql backend (I'm still with the default configuration, using the bdb backend). Does anybody have an idea what's happening ? One last thing : I tried also to compile OpenLDAP with back-sql as a dynamic loaded module (./configure --enable-modules --enable-sql=mod). Same result, if my "slapd.conf" contains the instructions to dynamically load "back_sql.la", then : - OpenLDAP doesn't start at boot - "#service slapd start" doesn't work - "#/etc/init.d slapd start" still works Ben Note : I tried to use insserv instead of update-rc.d, same result

1 0

Re: syncrepl issue
by Frank Luo 25 Jan '13

25 Jan '13

thanks. I am using 2.4.23 sudo /opt/openldap/libexec/slapd -V @(#) $OpenLDAP: slapd 2.4.23 (Mar 9 2011 11:39:07) $ I understand that delta-syncrepl will significantly reduce traffic but that should not be the problem here. Also we have mirror mode turned on and I read "Note: Delta-syncrepl is not yet supported with MirrorMode." Frank On Fri, Jan 25, 2013 at 2:14 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Friday, January 25, 2013 11:59 AM -0500 Frank Luo > <frank.luoy(a)gmail.com> wrote: > >> We have 4 openldap servers, 1 and 2 are masters with mirror mode., 3 >> and 4 are slaves. 3 and 4 sometimes get out of sync with masters. But >> a few minutes or a few hours later, it can get synced again with some >> "random" events. The reason I call it "random" because I could not >> find any patter yet. This happens almost every day. > > > a) Always note the version of OpenLDAP you are using > b) Use delta-syncrepl > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration

2 1

syncrepl issue
by Frank Luo 25 Jan '13

25 Jan '13

We have 4 openldap servers, 1 and 2 are masters with mirror mode., 3 and 4 are slaves. 3 and 4 sometimes get out of sync with masters. But a few minutes or a few hours later, it can get synced again with some "random" events. The reason I call it "random" because I could not find any patter yet. This happens almost every day. What I found is 3 and 4 (consumer) sometime get newer entryCSN than 1 and 2 (provider) for example on 1 and 2 entryCSN: 20130115190406.091431Z#000000#001#000000 on 3 and 4 entryCSN: 20130116183923.969790Z#000000#000#000000 I have confirmed that with the following syncrepl config, we can not update entry on 3 or 4 directly. (ldap_modify: Server is unwilling to perform (53) additional info: shadow context; no update referral). So that exclude the possibility 3 and 4 get updated directly from ldap client. Any direction? Thanks Frank Attachment: sync config portion #server 1 serverID 1 syncrepl rid=001 provider=ldap://s2.domain.com bindmethod=simple binddn="cn=Manager,dc=domain,dc=com" credentials=xxxxxxx searchbase="dc=domain,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" mirrormode on #server 2 serverID 2 syncrepl rid=002 provider=ldap://s1.domain.com bindmethod=simple binddn="cn=Manager,dc=domain,dc=com" credentials=xxxxxxx searchbase="dc=domain,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" mirrormode on #server 3 syncrepl rid=003 provider=ldap://ldaptm.domain.com bindmethod=simple binddn="cn=Manager,dc=domain,dc=com" credentials=xxxxxxx searchbase="dc=domain,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" #server 4 syncrepl rid=004 provider=ldap://ldaptm.domain.com bindmethod=simple binddn="cn=Manager,dc=domain,dc=com" credentials=xxxxxxx searchbase="dc=domain,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" As you noticed, ldaptm.domain.com is a virtual service on load balancer with server 1 and 2 behind

2 1

slapd-ldap: second search operation always generates error LdapErr: DSID-0C0906E8
by Bryce Powell 25 Jan '13

25 Jan '13

Hi, I have setup an LDAP proxy using OpenLDAP 2.4.23 running on CentOS release 6.2 Linux 2.6.32-220.4.2.el6.x86_64. Every second search operation on a connection returns an error: SEARCH RESULT tag=101 err=1 nentries=0 text=000004DC: LdapErr: DSID-0C0906E8, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1db1 database ldap readonly on suffix "dc=example,dc=com" # Recreate cached connection before it can be dropped by the Active Directory. Default Active Directory timeout MaxConnIdleTime=900 idle-timeout 899 rebind-as-user yes uri "ldap://169.254.253.228/ ldap://169.254.239.115/ ldap://169.254.245.81/ ldap://169.254.239.91/" Here is an extract of the LDAP log, filtered on one connection: Jan 22 16:41:17 vmldapproxy1 slapd[1851]: conn=1035 fd=29 ACCEPT from IP=172.16.10.126:3579 (IP=0.0.0.0:389) Jan 22 16:41:17 vmldapproxy1 slapd[1851]: conn=1035 op=0 BIND dn="cn=sa_srv,ou=service accounts,dc=example,dc=com" method=128 Jan 22 16:41:17 vmldapproxy1 slapd[1851]: conn=1035 op=0 BIND dn="cn=sa_srv,ou=service accounts,dc=example,dc=com" mech=SIMPLE ssf=0 Jan 22 16:41:17 vmldapproxy1 slapd[1851]: conn=1035 op=0 RESULT tag=97 err=0 text= Jan 22 17:21:46 vmldapproxy1 slapd[1851]: conn=1035 op=1 SRCH base="dc=example,dc=com" scope=2 deref=3 filter="(|(cn=foobar)(uid=foobar)(sn=foobar)(givenName=foobar)(mail=foobar))" Jan 22 17:21:46 vmldapproxy1 slapd[1851]: conn=1035 op=1 SRCH attr=FullName userPassword MailServer mail CalendarDomain MailFile uid ServerName EncryptIncomingMail ListName MailSystem objectClass member NetUserName SametimeServer uniqueMember DB2UserName MailDomain NotesDN AltFullName HTTPPasswordChangeDate modifyTimestamp Location CertificateThumbprint MailAddress HTTPPasswordForceChange Policy MessageStorage NewMailFile LTPA-UsrNm NewMailServer AltFullNameLanguage CN Jan 22 17:21:46 vmldapproxy1 slapd[1851]: conn=1035 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= Jan 22 17:23:31 vmldapproxy1 slapd[1851]: conn=1035 op=2 SRCH base="dc=example,dc=com" scope=2 deref=3 filter="(|(cn=foo.bar@example.com)(uid=foo.bar@example.com)(sn=foo.bar@example.com)(givenName=foo.bar@example.com)(mail=foo.bar@example.com))" Jan 22 17:23:31 vmldapproxy1 slapd[1851]: conn=1035 op=2 SRCH attr=FullName userPassword MailServer mail CalendarDomain MailFile uid ServerName EncryptIncomingMail ListName MailSystem objectClass member NetUserName SametimeServer uniqueMember DB2UserName MailDomain NotesDN AltFullName HTTPPasswordChangeDate modifyTimestamp Location CertificateThumbprint MailAddress HTTPPasswordForceChange Policy MessageStorage NewMailFile LTPA-UsrNm NewMailServer AltFullNameLanguage CN Jan 22 17:23:31 vmldapproxy1 slapd[1851]: conn=1035 op=2 SEARCH RESULT tag=101 err=1 nentries=0 text=000004DC: LdapErr: DSID-0C0906E8, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1db1 Every subsequent search operation going forward generates the same error. The time difference between the bind (op=0) and the first successful search (op=1) is 40 minutes 29 seconds. The time between op=1 and the first failed search op=2 is 1 minute 45 seconds. This behaviour is consistent for all connections, and appears independent of time. Therefore I'm not seeing how timeouts factor into this issue. Appears a few folks have posted about this, here and elsewhere, but I could not find any suitable explanation that resolved the issue. Hoping someone can help me out. Thanks, and regards, Bryce Powell

3 4

exclude subtree from ppolicy
by Marc Patermann 25 Jan '13

25 Jan '13

Hi, is it possible to exclude a subtree (or some objects by filter) from the password policy overlay? Marc

2 1

Re: slapcat output is truncated every now and then
by Bálint Réczey 25 Jan '13

25 Jan '13

Hi Quanah, Thank you for the answer. 2013/1/22 Quanah Gibson-Mount <quanah(a)zimbra.com> > --On Sunday, January 20, 2013 11:58 AM +0100 Balint Reczey < > balint(a)balintreczey.hu> wrote: > > Dear Members of OpenLDAP Technical List, >> >> Could you please help in finding and explanation and potentially a fix >> for the bug reported at [1]? >> > > Per Howard Chu: > > I think it's because slapcat's attempt to get a read lock failed, probably > because slapd already had a conflicting write lock on it and the deadlock > detector chose slapcat to lose and slapcat doesn't retry on lock errors, > unlike slapd. > > The solution, of course, is to use back-mdb. > Forgive me for asking this with so little experience with OpenLDAP, but would fixing slapcat to retry on lock errors be an other option? It seems it could help people managing LDAP servers with high write-rate and others who are not be able to migrate to mdb in short term. Cheers, Balint

2 2

no data are fetched when using cn=config + back-sql
by Benin Technologies 24 Jan '13

24 Jan '13

Hi, I'm using back-sql. After converting to cn=config, ldapsearch fetches no data (with the old slapd.conf everything worked fine). Any idea why ? ------> $ ldapsearch -x -h localhost -b "dc=example,dc=com" "(objectClass=*)" # extended LDIF # # LDAPv3 # base <dc=example,dc=com> with scope subtree # filter: (objectClass=*) # requesting: ALL # # search result search: 2 result: 80 Other (e.g., implementation specific) error # numResponses: 1 ------> Versions : OpenLDAP 2.4.33 with latest patchs applied (until ITS#7499) Debian 6.0.4

1 0

Preoperation Plugin Questions
by Julius Plenz 23 Jan '13

23 Jan '13

Hi, I'm writing an preoperation authentication plugin for OpenLDAP, but I have trouble finding any documentation whatsoever on this. So most of what I know comes from tutorials like this one from Oracle: http://docs.oracle.com/cd/E19099-01/nscp.dirsvr416/816-6683-10/custauth.htm But since this is not official documentation and I find the execution paths hard to trace, I have two questions stemming from above guide: 1) The guide says that for an authentication preop plugin, Your pre-operation plug-in function is responsible for sending the result code to the client and for setting the DN and authentication method for the connection. Okay, so I do that. Like in the code example, I set the connection's DN to the value I got from the 'pb' in the first place: slapi_pblock_set(pb, SLAPI_CONN_DN, slapi_ch_strdup(dn)); But setting the authentication type fails: slapi_pblock_set(pb, SLAPI_CONN_AUTHTYPE, SLAPD_AUTH_SIMPLE); This is no real error though, it's simply not implemented: See http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=blob;f=servers/sl… case SLAPI_CONN_AUTHMETHOD: ... /* These parameters cannot be set */ rc = PBLOCK_ERROR; break; (This was noted in 2006 already, with no reply on this list: http://www.openldap.org/lists/openldap-software/200601/msg00044.html ) So basically it boils down to: Do I have to do *any* other stuff except for sending back the result code? Like this: slapi_send_ldap_result(pb, rc, NULL, NULL, 0, NULL); 2) What is the preferred return value for a plugin function? Most (other) documentations and the code hints at this: i) return 0 if you handled the authentication ii) return 1 if you want successive plugins/backends/... to handle the authentication Is this correct? Or should I use the more suggestive SLAPI_BIND_SUCCESS and SLAPI_BIND_FAIL? Thanks! Julius P.S.: What I'm actually trying to achieve is to do RADIUS authentification via an external library. But I want to send the client's IP in a Calling-Station-Id attribute, so I cannot simply write a password check function, right? If you got any ideas that are better than a preop module, please tell me...

3 4

RE: slapd-ldap: second search operation always generates error LdapErr: DSID-0C0906E8
by Quanah Gibson-Mount 23 Jan '13

23 Jan '13

--On Wednesday, January 23, 2013 11:22 AM -0700 Bryce Powell <Bryce.Powell(a)TELUS.COM> wrote: > Hi Quanah, > > Thank you. Is this a known issue that's been addressed in the 2.4.33 > release? Please keep replies to the list, and please don't top post. There have been a multitude of bug fixes to slapd-ldap since the 2.4.23 release (I counted over 10 in the CHANGES file). There are also numerous other reasons not to use the generally broken packages provided by RH/CentOS. The first step to getting help with an issue like this is always going to be to first verify whether or not it occurs on a current release. Regards, Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

openldap overlays
by Carlos Santos 23 Jan '13

23 Jan '13

Greetings, I'm relatively new to OpenLDAP and I think I am an average user and a newbie when it comes to development. I am currently on a project on which we use openldap2.4 and the dyngroup overlay. My goal is to build another group overlay which will fetch data from outside the ldap machine (webservices) and then works just like the regular dyngroup overlay, returning the members of that group based on the results of the call to the webservices. The problem is, like I said, that I'm a newbie. I looked at dyngroup.c and I find it quite hard to understand what is going on. It has very few comments and of little help. Can someone give me an overview of the code, and maybe introduce me to the steps of creating an overlay? thanks, Carlos Santos

1 0

RE: (ITS#7498) Openldap syncrepl issue
by Chris Card 23 Jan '13

23 Jan '13

Hi,> > Hi, > > I've been having issues with syncrepl in openldap. This is plain > syncrepl. I'm not using delta-syncrepl as I run with mirror mode on. > > I've noticed that when there are a large number of writes on the > writemaster (Typically around 10 per second) the data on the readslave > goes out of sync with the master, typically having entries which have > been deleted on the master. The contextCSNs on both the readslaves and > writemaster match eventually, but the data doesn't. I'm running the > readslave in refreshOnly mode with an interval of 1 minute. I'm using a > reasonably large DB of size ~ 2 GB. I turned on the sync logs and found > lots of entries with "nonpresent_callback" and "syncrepl_del_nonpresent". > > Tested this and found it occurring in both 2.4.29 and 2.4.33 (Latest as > of this time), and with BDB 4.2.36 as the backend. > > I was wondering if anyone has faced similar issues before, and if there > exists a solution to this problem. I will send any relevant > configuration and log snippets as needed. > > Thanks >I am certainly seeing similar problems with plain syncrepl in an MMR setup (all writes to one server currently, openldap 2.4.31):for example, at the moment in my production system, there are 18 DNs (out of 5.7 million) which are in the writemaster but which are missing from the 3 readslaves, although the contextCSNs all match. Deleting and re-adding such DNs to the writemastercan usually fix this up, but sometimes the contextCSNs get out of sync, andthen the only practical way to recover is to rebuild the readslaves from a backup taken from the writemaster. Because of this issue I am planning to change to using delta-syncrepl, which does appear to work and not get out of sync in the testingI have done. I believe this is the only solution at the moment. Chris

1 0

Grant access to a group
by Onno van der Straaten 23 Jan '13

23 Jan '13

Hi, I would like to grant access to a group in my directory. Granting access to user is straightforward and works, for example access to attrs=myAttribute by dn="cn=User,dc=mydomain,dc=com" write by anonymous auth by users read by * none Now I'm trying to do the same using a group for example access to attrs=myAttribute by group/groupOfUniqueNames/uniqueMember="cn=ldap-admins,dc=groups,dc=mydomain,dc=com" write by anonymous auth by users read by * none I can't get this to work. I tried by group and by group.exact, these also don't work. From the documentation I understand that by group assumes objectClass 'groupOfNames' and attribute 'member' I used groupOfUniqueNames and uniqueMember so the configuration ended up as above. Is is possible to grant access to the directory in such a way? To a group? How? Best Regards, Onno

1 0

bug on dynamic configuration with back-sql
by Benin Technologies 23 Jan '13

23 Jan '13

Hi, I'm on Debian 6 / OpenLDAP 2.4.33 with back-sql. According to http://www.openldap.org/software/release/changes.html, back-sql supports dynamic config as of version 2.4.27. So I converted slapd.conf to slapd.d, conversion went well. However, when I start slapd, I get the following message : # /usr/local/libexec/slapd -u openldap -g openldap -d -1 ....... 50ff3f0a <<< dnPrettyNormal: <cn=root,dc=example,dc=com>, <cn=root,dc=example,dc=com> 50ff3f0a olcSqlInsEntryStmt: value #0: <olcSqlInsEntryStmt> extra cruft after <SQL expression>. 50ff3f0a config error processing olcDatabase={1}sql,cn=config: <olcSqlInsEntryStmt> *extra cruft after <SQL expression>* 50ff3f0a send_ldap_result: conn=-1 op=0 p=0 50ff3f0a send_ldap_result: err=19 matched="" text="" 50ff3f0a slapd destroy: freeing system resources. 50ff3f0a slapd stopped. 50ff3f0a connections_destroy: nothing to destroy. I took a look into olcDatabase={1}sql.ldif, and I saw that olcSqlInsEntryStmt was splitted on two lines : olcSqlInsEntryStmt: insert into ldap_entries (id,dn,oc_map_id,parent,keyval) v alues ((select max(id)+1 from ldap_entries),?,?,?,?) I tries to put everything on the same line, like : olcSqlInsEntryStmt: insert into ldap_entries (id,dn,oc_map_id,parent,keyval) values ((select max(id)+1 from ldap_entries),?,?,?,?) But the error persists. If I comment that line, the server starts fine # olcSqlInsEntryStmt: insert into ldap_entries (id,dn,oc_map_id,parent,keyval) values ((select max(id)+1 from ldap_entries),?,?,?,?)

1 0

slapcat output is truncated every now and then
by Balint Reczey 22 Jan '13

22 Jan '13

Dear Members of OpenLDAP Technical List, Could you please help in finding and explanation and potentially a fix for the bug reported at [1]? It seems it has been found often enough by Elmar as well to write a workaround [2]. Thanks, Balint [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=673038 [2] https://github.com/elmar/ldap-git-backup/blob/master/README.mdown#safe-ldif On 06/19/2012 06:27 PM, Quanah Gibson-Mount wrote: > --On Tuesday, June 19, 2012 2:25 PM +0200 Axel Beckert > <abe(a)debian.org> wrote: > >> Hi Steve, >> >> Steve Langasek wrote: >>> > According to the slapcat man page it should be "always safe to run >>> > slapcat with the slapd-bdb(5) ... backends" even if slapd runs. We do >>> > use a BDB backend. >>> >>> Note that the HDB backend is the one recommended upstream and the >>> Debian >>> default. >> >> Well, yeah, that system has been dist-upgraded from at least Etch. >> IIRC it started at some time when BDB was still the default. >> >> I wrote that -- according to our backups -- this happened already with >> Lenny's slapd. But with Lenny it seemed to have happened less often >> (which is why we noticed it only recently). > > Personally, I would advise you to ask a question about this on > openldap-technical(a)openldap.org. I asked Howard about it, and he had > a ready answer as to why you were seeing this, but I forget what it > is. In any case, this is not a debian specific openldap bug. > > --Quanah > ...

2 1

Re: Replication not working
by anil beniwal 22 Jan '13

22 Jan '13

> > I will be highly thankful to you, if you can help me out in below issue. > > We have three servers on rhel 6.3, 16 vcpu and 32G RAM , openldap 2.4.33 > with mdb db of 200G > > We are facing replication issue on our servers, otherwise servers are good > with login and user registration from website.(doing on one server only as > of now) > > We imported data on one server mmam01 and copied it to other 2 servers. > After some time we got big diff b/w db size of mmam01 and other two servers. > Then exported data and restored it on other two servers. > > i tried adding a user and i got replicated to other two servers, but after > some time, new users stop getting replicated to other servers. > > initial replication status after some 30 min > > Even when i tried with blank db it initally started and then stopped. i got errors like dn_callback : entries have identical CSN syncrepl_entry: rid=111 entry unchanged, ignored > Sat Jan 12 12:40:41 EST 2013 > > DR-SJ > contextCSN: 20130101132757.303803Z#000000#000#000000 > contextCSN: 20130111144013.926562Z#000000#001#000000 > contextCSN: 20130112174023.266193Z#000000#002#000000 > DC-mmam01 > contextCSN: 20130101132757.303803Z#000000#000#000000 > contextCSN: 20130112174006.314483Z#000000#001#000000 > contextCSN: 20130112174023.266193Z#000000#002#000000 > DC-mmam04 > contextCSN: 20130101132757.303803Z#000000#000#000000 > contextCSN: 20130111144013.926562Z#000000#001#000000 > contextCSN: 20130112174023.266193Z#000000#002#000000 > > After 2 hours > > DR-SJ > contextCSN: 20130101132757.303803Z#000000#000#000000 > contextCSN: 20130111144013.926562Z#000000#001#000000 > contextCSN: 20130112174023.266193Z#000000#002#000000 > contextCSN: 20130112175710.938307Z#000000#003#000000 > DC-mmam01 > contextCSN: 20130101132757.303803Z#000000#000#000000 > contextCSN: 20130112193219.242546Z#000000#001#000000 > contextCSN: 20130112174023.266193Z#000000#002#000000 > contextCSN: 20130112175710.938307Z#000000#003#000000 > DC-mmam04 > contextCSN: 20130101132757.303803Z#000000#000#000000 > contextCSN: 20130111144013.926562Z#000000#001#000000 > contextCSN: 20130112174023.266193Z#000000#002#000000 > contextCSN: 20130112175710.938307Z#000000#003#000000 > > My ldap.conf file is(same on all server) , we have host-ip mapping in > /etc/hosts file > > BASE dc=example, dc=com > URI ldap://mmam01.com ldaps://mmam01.com ldap://mmam04.com ldaps:// > mmam04.com ldap://sjam01.com ldaps://sjam01.com > TLS_REQCERT demand > TLS_CACERT /etc/openldap/cacerts/cacert.pem > > slapd.conf file(from mmam01) > > include /etc/openldap/schema/core.schema > include /etc/openldap/schema/cosine.schema > include /etc/openldap/schema/nis.schema > include /etc/openldap/schema/inetorgperson.schema > include /etc/openldap/schema/openldap.schema > include /etc/openldap/schema/dyngroup.schema > include /etc/openldap/schema/ppolicy.schema > include /etc/openldap/schema2/channelIdentifier.schema > include /etc/openldap/schema2/platform.schema > include /etc/openldap/schema2/extendedProfileKey.schema > include /etc/openldap/schema2/extendedProfileValue.schema > include /etc/openldap/schema2/behaviorKey.schema > include /etc/openldap/schema2/behaviorValue.schema > include /etc/openldap/schema2/questionAnswer.schema > include /etc/openldap/schema2/extendedTop.schema > include /etc/openldap/schema2/counter.schema > serverid 1 > TLSCipherSuite HIGH:MEDIUM:+SSLv3 > TLSCACertificateFile /etc/openldap/cacerts/cacert.pem > TLSCertificateFile /etc/openldap/cacerts/mmam01.crt > TLSCertificateKeyFile /etc/openldap/cacerts/mmam01.key > TLSVerifyClient never > pidfile /var/symas/run/slapd.pid > argsfile /var/symas/run/slapd.args > loglevel sync stats > idletimeout 30 > writetimeout 30 > modulepath /etc/openldap/lib64/openldap > moduleload back_mdb.la > moduleload ppolicy.la > moduleload unique.la > moduleload syncprov.la > database mdb > suffix "dc=example,dc=com" > directory /openldap/var/data > access to attrs=userPassword > by self write > by anonymous auth > by * break > > access to * > by > group/groupOfUniqueNames/uniqueMember.exact="cn=PWrite,ou=bGroup,dc=example,dc=com" > manage > by > group/groupOfUniqueNames/uniqueMember.exact="cn=PRead,ou=bGroup,dc=example,dc=com" > read > by * break > access to * > by self write > by anonymous auth > by * read > rootdn "cn=Manager,dc=example,dc=com" > rootpw {SSHA}dXDESQeFjSoa/A1HfJ2TAzYf4DrSYWY > index > mail,uid,postalCode,smail,channelType,channelValue,answer,behavName,objectclass,type > eq > index givenName,sn,city,cn,extName sub > index displayName approx > index entryCSN,entryUUID eq > checkpoint 128 15 > maxsize 274877906944 > syncrepl rid=111 > provider=ldap://sjam01.com > binddn="cn=Manager,dc=example,dc=com" > bindmethod=simple > credentials=0m2013 > tls_cacert=/etc/openldap/cacerts/cacert.pem > searchbase="dc=example,dc=com" > type=refreshAndPersist > retry="5 5 60 +" > network-timeout=10 > timeout=10 > syncrepl rid=222 > provider=ldap://mmam04.com > binddn="cn=Manager,dc=example,dc=com" > bindmethod=simple > credentials=0m2013 > tls_cacert=/etc/openldap/cacerts/cacert.pem > searchbase="dc=example,dc=com" > type=refreshAndPersist > retry="5 5 60 +" > network-timeout=10 > timeout=10 > overlay syncprov > syncprov-checkpoint 100 10 > syncprov-sessionlog 100 > mirrormode true > overlay unique > unique_attributes mail > overlay ppolicy > ppolicy_default "cn=default,ou=pwdPolicy,dc=example,dc=com" > ppolicy_use_lockout > > logs > > DR-sj > > Jan 12 14:51:28 sjprodam01 slapd[25165]: do_syncrep2: rid=111 > LDAP_RES_INTERMEDIATE - SYNC_ID_SET > Jan 12 14:51:28 sjprodam01 slapd[25165]: do_syncrep2: rid=111 > LDAP_RES_INTERMEDIATE - SYNC_ID_SET > Jan 12 14:51:28 sjprodam01 slapd[25165]: do_syncrep2: rid=111 > LDAP_RES_INTERMEDIATE - SYNC_ID_SET > Jan 12 14:51:28 sjprodam01 slapd[25165]: do_syncrep2: rid=111 > LDAP_RES_INTERMEDIATE - SYNC_ID_SET > Jan 12 14:51:28 sjprodam01 slapd[25165]: do_syncrep2: rid=111 > LDAP_RES_INTERMEDIATE - SYNC_ID_SET > > mmam04 > > Jan 12 14:53:24 mmprodam04 slapd[14108]: do_syncrep2: rid=222 > LDAP_RES_INTERMEDIATE - SYNC_ID_SET > Jan 12 14:53:24 mmprodam04 slapd[14108]: do_syncrep2: rid=222 > LDAP_RES_INTERMEDIATE - SYNC_ID_SET > Jan 12 14:53:25 mmprodam04 slapd[14108]: do_syncrep2: rid=222 > LDAP_RES_INTERMEDIATE - SYNC_ID_SET > Jan 12 14:53:25 mmprodam04 slapd[14108]: do_syncrep2: rid=222 > LDAP_RES_INTERMEDIATE - SYNC_ID_SET > > mmam01 > Users are add on this server > > > Jan 12 14:53:26 mmprodam01 slapd[24380]: slap_queue_csn: queing > 0x7f55dd4fa120 20130112195326.941804Z#000000#001#000000 > Jan 12 14:53:27 mmprodam01 slapd[24380]: conn=8516 op=291 RESULT tag=105 > err=0 text= > Jan 12 14:53:27 mmprodam01 slapd[24380]: slap_graduate_commit_csn: > removing 0x7f55d010ee30 20130112195326.941804Z#000000#001#000000 > Jan 12 14:53:27 mmprodam01 slapd[24380]: conn=8516 op=292 MOD > dn="extName=PIT,cn=entitlements,cn=extendedProfile,uid=6a9ddf85-1072-48b4-9f09-10f032c8f05e,ou=endUsers,dc=example,dc=com" > Jan 12 14:53:27 mmprodam01 slapd[24380]: conn=8516 op=292 MOD attr=extValue > Jan 12 14:53:27 mmprodam01 slapd[24380]: slap_queue_csn: queing > 0x7f55deffc210 20130112195327.100182Z#000000#001#000000 > Jan 12 14:53:27 mmprodam01 slapd[24380]: conn=8516 op=292 RESULT tag=103 > err=0 text= > Jan 12 14:53:27 mmprodam01 slapd[24380]: slap_graduate_commit_csn: > removing 0x7f55d8392770 20130112195327.100182Z#000000#001#000000 > Jan 12 14:53:27 mmprodam01 slapd[24380]: conn=8516 op=293 MOD > dn="extName=RVW,cn=entitlements,cn=extendedProfile,uid=6a9ddf85-1072-48b4-9f09-10f032c8f05e,ou=endUsers,dc=example,dc=com" > Jan 12 14:53:27 mmprodam01 slapd[24380]: conn=8516 op=293 MOD attr=extValue > Jan 12 14:53:27 mmprodam01 slapd[24380]: slap_queue_csn: queing > 0x7f560a22e210 20130112195327.103686Z#000000#001#000000 > Jan 12 14:53:27 mmprodam01 slapd[24380]: conn=8516 op=293 RESULT tag=103 > err=0 text= > Jan 12 14:53:27 mmprodam01 slapd[24380]: slap_graduate_commit_csn: > removing 0x7f55fc6f35e0 20130112195327.103686Z#000000#001#000000 > Jan 12 14:53:27 mmprodam01 slapd[24380]: conn=8516 op=294 MOD > dn="extName=ICA,cn=entitlements,cn=extendedProfile,uid=6a9ddf85-1072-48b4-9f09-10f032c8f05e,ou=endUsers,dc=example,dc=com" > Jan 12 14:53:27 mmprodam01 slapd[24380]: conn=8516 op=294 MOD attr=extValue > Jan 12 14:53:27 mmprodam01 slapd[24380]: slap_queue_csn: queing > 0x7f55f3ffd210 20130112195327.107815Z#000000#001#000000 > Jan 12 14:53:27 mmprodam01 slapd[24380]: conn=8516 op=294 MOD attr=extValue > Jan 12 14:53:27 mmprodam01 slapd[24380]: slap_queue_csn: queing > 0x7f55f3ffd210 20130112195327.107815Z#000000#001#000000 > Jan 12 14:53:27 mmprodam01 slapd[24380]: conn=8516 op=294 RESULT tag=103 > err=0 text= > Jan 12 14:53:27 mmprodam01 slapd[24380]: slap_graduate_commit_csn: > removing 0x7f55e87ae550 20130112195327.107815Z#000000#001#000000 > Jan 12 14:53:27 mmprodam01 slapd[24380]: conn=8516 op=295 MOD > dn="extName=RVP,cn=entitlements,cn=extendedProfile,uid=6a9ddf85-1072-48b4-9f09-10f032c8f05e,ou=endUsers,dc=example,dc=com" > Jan 12 14:53:27 mmprodam01 slapd[24380]: conn=8516 op=295 MOD attr=extValue > Jan 12 14:53:27 mmprodam01 slapd[24380]: slap_queue_csn: queing > 0x7f55f0cf8210 20130112195327.112994Z#000000#001#000000 > Jan 12 14:53:27 mmprodam01 slapd[24380]: conn=8516 op=295 RESULT tag=103 > err=0 text= > Jan 12 14:53:27 mmprodam01 slapd[24380]: slap_graduate_commit_csn: > removing 0x7f55e4618780 20130112195327.112994Z#000000#001#000000 > Jan 12 14:53:27 mmprodam01 slapd[24380]: conn=8516 op=296 MOD > dn="extName=RAD,cn=entitlements,cn=extendedProfile,uid=6a9ddf85-1072-48b4-9f09-10f032c8f05e,ou=endUsers,dc=example,dc=com" > Jan 12 14:53:27 mmprodam01 slapd[24380]: conn=8516 op=296 MOD attr=extValue > Jan 12 14:53:27 mmprodam01 slapd[24380]: slap_queue_csn: queing > 0x7f55dd4f9210 20130112195327.117321Z#000000#001#000000 > Jan 12 14:53:27 mmprodam01 slapd[24380]: conn=8516 op=296 RESULT tag=103 > err=0 text= > Jan 12 14:53:27 mmprodam01 slapd[24380]: slap_graduate_commit_csn: > removing 0x7f55d0001490 20130112195327.117321Z#000000#001#000000 > > > I have tried adding users and changing passwords one by one, it doesn't > work. > I can search old entries from one server to other server. > > -- Thanks&Regards Anil Beniwal +919891695048

3 6

about Too many executing
by rodrigo tavares 22 Jan '13

22 Jan '13

Hello ! I'm see my logs, many messagens come: deferring operation: too many executing. Search in Google, I found informations, about message. First: "too many executing" is undesirable. Second: It means there are too many operations active on the given connection, so mais operations on that connection will be queued until some of the active operations complete. It is cause some problem for the sytem, memory or slapd ? Thanks: Rodrigo

2 1

How to get all attributes of a entry
by ctosgh 22 Jan '13

22 Jan '13

Hi, All I enabled memberOf overlay feature. Now I can get memberOf back with ldapsarch. ldapsearch -x -D "cn=admin,dc=xxx,dc=xxx" -b "dc=xxx,dc=xxx" -w xxx -H "ldap://10.139.36.7:389" "cn=user2" "memberOf" However, with above command other attributes, such as cn and sn, can't be retrieved back... As manual said, memberOf is a opertional attribute so that you should require it explicitly.. Is there a way that I can retrieve all other attributes in addition to memberOf? Thanks, Jacky

2 2

Microsoft Outlook (2011) jpegPhoto and thumbnailPhoto Suffixed With ';binary'
by Eren Türkay 22 Jan '13

22 Jan '13

Hello, I am testing my tree with outlook 2011 (for mac) to see if everything works expected. When I search a contact in address book, photo of the user is not shown. I searched the problem and learned that outlook uses thumbnailPhoto attribute for photos. Then, I created an outlook compatibility schema that includes thumbnailPhoto attribute. However, photos still not shown, at which time I started investigating the problem. I debugged the problem using the network analyzer and realized that Outlook 2011 requests awkward attribute names suffixed with the word ';binary'. When searching, it requests these attributes below along with standard ones: - userSMIMECertificate;binary - userCertificate;binary - thumbnailPhoto;binary - jpegPhoto;binary Since these attributes are not present in my tree (though I have 'normal' ones without a suffix), they are not sent to outlook client so photos are not shown. I, then, tried to change my compatibility schema to use 'thumbnailPhoto;binary', but I got an error stating that the attribute name is not valid. OpenLDAP does not seem to accept ';' character in attribute names. Probably, AD accepts ';' character in attribute names and outlook 2011 works with AD. Apart from not seeing photos, you cannot send encrypted e-mail using outlook because you cannot send a user certificate with openldap (';binary' suffix). So, if you try to use current openldap with outlook, you will miss 2 features, encryption on photos. I'm not sure if ';binary' suffix is done on purpose to make other LDAP servers work with outlook harder. Is there any workaround for it? Being able to include ';' in attribute name will probably fix the problem but I don't know if ';' is acceptable in LDAP standard. Regards, Eren -- . 73! DE TA1AET http://linkedin.com/in/erenturkay

2 1

Re: slapd segfaults with mdb
by Meike Stone 22 Jan '13

22 Jan '13

> File an ITS (http://www.openldap.org/its/) with a full backtrace of all > threads from gdb. => #7496 Thanks

1 0

Continuous mode (ldapmodify -c) not working
by Ori Bani 21 Jan '13

21 Jan '13

Am I doing something wrong? Here is an example: $ ldapmodify -c -x -D 'cn=config' -W Enter LDAP Password: <password> dn: olcDatabase={0}config,cn=config changetype: modify delete: olcSizeLimit - modifying entry "olcDatabase={0}config,cn=config" ldap_modify: No such attribute (16) additional info: modify/delete: olcSizeLimit: no such attribute

2 12

slapd segfaults with mdb
by Meike Stone 21 Jan '13

21 Jan '13

Hello, I play a little with the mdb on a test machine, and imported our db from production system. (about 1,500,000 entires, 2,5GByte ldif from slapcat) I took the slapd source from git today, and because of segmentation fault, I compiled slapd with debugging symbols. My configuration is simple: -------------------------------------------- include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/yast.schema include /etc/openldap/schema/rfc2307bis.schema include /etc/openldap/schema/my_ldap_attributes.schema include /etc/openldap/schema/my_ldap_ObjectClasses.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args sizelimit -1 timelimit 300 disallow bind_anon require authc gentlehup on tool-threads 4 serverID 001 ############################ # mdb database definitions ############################ database mdb suffix "ou=root" rootdn "cn=admin,ou=root" rootpw password directory /var/lib/ldap/ldap.mdb loglevel 256 maxsize 10737418240 envflags writemap,nometasync index objectClass,entryUUID,entryCSN eq index cn eq,sub . . . some other own indexes here -------------------------------------------- I started my search via: /tmp/ol/usr/local/bin/ldapsearch -x -h localhost -w password -D cn=admin,ou=root -b'ou=root' '(objectClass=*)' >/dev/null and got in the syslog folloing meassge: Jan 21 17:50:31 debld02 kernel: [348860.053152] slapd[19394]: segfault at 7f760f974ce8 ip 000000000053bea1 sp 00007f738b10a650 error 4 in slapd [400000+227000] Because of this, I configured the kernel to core dump: sysctl -w kernel.core_pattern=/tmp/core sysctl -w kernel.core_uses_pid=1 sysctl -w kernel.suid_dumpable=2 ulimit -c unlimited ulimit -v unlimited and got the result via: ~# gdb /tmp/ol/usr/local/libexec/slapd /tmp/core.19386 Core was generated by `/tmp/buildforopenldaptechnical/usr/local/libexec/slapd -h ldap:/// -f /etc/op'. Program terminated with signal 11, Segmentation fault. #0 0x000000000053bea1 in mdb_entry_decode (op=0xc3a020, data=0x7f738b10a770, e=0x7f738b11a828) at id2entry.c:666 666 a->a_desc = mdb->mi_ads[*lp++]; (gdb) How can I solve this? Btw.: This error is repeatable and I saw the same error with the release OL2.4.33. Thanks Meike

2 1

openldap 2.4.33 from source, can't find slapd.d directory
by Benin Technologies 21 Jan '13

21 Jan '13

3 5

ACL: Permissions with Groups and 'memberOf' Using Regex
by Eren Türkay 21 Jan '13

21 Jan '13

Hello, I'm designing a directory structure for our radio amateur union, and I have a problem with somewhat complex ACL (for me). Before I ask my question, I want to mention that this structure is not in production so it can always change. I may have designed the structure wrong, and there would be a better way to represent it. However, I believe that this is the correct way of representing our amateur radio union's organization. As a radio amateur union, we have different branches across different cities. These branches have their own members, and own managers, Additionally, there is a unit which is the manager of the whole union. Their members are listed in "cn=general-managers,<base dn>". All of the user information is stored under "ou=people,<base dn>" and 'memberOf' overlay is enabled. The structure is below: ==== BEGIN: directory structure ==== - <base dn> - cn=general-managers (groupOfNames) - ou=branch - ou=foo-city - cn=managers (groupOfNames) - cn=members (groupOfNames) - ou= bar-city - cn=managers (groupOfNames) - cn=members (groupOfNames) ... ... - ou=people cn=ta1aet (inetOrgPerson) memberOf: cn=managers,ou=foo-city,ou-branch,<base-dn> memberOf: cn=members,ou=foo-city,ou-branch,<base-dn> cn=CALLSIGN1 memberOf: cn=members,ou=foo-city,ou-branch,<base-dn> cn=CALLSIGN2 memberOf: cn=members,ou=bar-city,ou-branch,<base-dn> cn= CALLSIGNn ... ... ==== END: directory structure ==== So far, I have achieved to write an ACL for "ou=people". The users have write permission to some of the attributes such as "givenName, sn, mail, address" but they don't have permission to edit "title" (which should be edited by his manager in his branch) What I am aiming is listed below. 1- People in cn=managers,ou=XXXX,ou=branch should be able to add new user/member under "ou=people,<base dn>". (Of course, setting member attribute their branch "cn=members,ou=XXXX,ou=branch") 2- These managers (cn=managers,ou=XXX,ou=branch) should only be able to edit attributes of members registered to them. So, only people that are member of "cn=members,ou=XXX,ou=branch" should be edited by "cn=managers,ou=XXX,ou=branch". 3- Any user should be able to edit some (e.g not 'title') of his attributes (I've done it but I'm not sure if it can be done in a more elegant way. Config is attached at the end). 4- General managers should be able to edit the tree and children of "ou=branch,<base dn>" as well as "ou=people,<base dn>". This looks a bit easier compared to 1 and 2. I have searched through all regular expressions tutorials but none of them includes such a membership example. "access to" syntax has "filter" option. Since 'access to' requires <what> clause first, I thought of using regular expression to filter the people accordingly to their 'memberOf' attributes, somehow (-don't know how :) -) match their branches that they belong to, and give access to corresponding manager group. However, 'filter' does not seem to accept regular expressions and it requires a direct attribute. I cannot further proceed right now, and I will really appreciate a hand on this issue. My best regards and 73s! Eren ==== BEGIN: current olcAccess ==== olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonym ous auth by dn="cn=admin,dc=trac,dc=org,dc=tr" write by * none olcAccess: {1}to dn.base="dc=trac,dc=org,dc=tr" by dn="cn=admin,dc=trac,dc=o rg,dc=tr" write by * read by anonymous none olcAccess: {2}to dn.base="ou=people,dc=trac,dc=org,dc=tr" attrs="entry,objec tClass" by dn.one="ou=people,dc=trac,dc=org,dc=tr" read by anonymous none olcAccess: {3}to dn.one="ou=people,dc=trac,dc=org,dc=tr" attrs="givenName,sn ,mail" by self write by dn.one="ou=people,dc=trac,dc=org,dc=tr" read olcAccess: {4}to dn.one="ou=people,dc=trac,dc=org,dc=tr" attrs="entry,object Class,cn,givenName,sn,title,mail" by dn.one="ou=people,dc=trac,dc=org,dc=tr " read by anonymous none ==== END: current olcAccess ==== -- . 73! DE TA1AET http://linkedin.com/in/erenturkay

1 1

Rewriting query and results
by Kurt Roeckx 21 Jan '13

21 Jan '13

Hi, I have PBX that queries the ldap server, but I'm not very happy with how it behaves, and of course have no control over what it does. It sends a query for "sn=foo*". But I want it to run a query that checks against fields like cn, givenName and sn. I also want to query to be "*foo*" instead of "foo*". It only requests the fields sn, givenName and the various phone numbers and then shows sn and givenName. I want it to display cn instead. So I guess I want to return the value of cn in sn and don't return a givenName. I've been looking at slapo-rwm manpage, but it's not really making much sense to me. Can someone guide me on how to do it? Kurt

1 0

Understanding dynamic configuration
by Ori Bani 20 Jan '13

20 Jan '13

Hello, I'm struggling a little with understanding the dynamic configuration system (sorry, but wanted to say my vote is for file-based config; the way some of this config has been put into LDAP feels forced and unnecessarily convoluted). Specifically, I'm having a hard time getting my mind around how to manage and secure the configuration database. What's tripping me up is how to reconcile the separate ldif files that contain global server-level configuation settings and config database level settings with what I understand to be the recommended way to manage those things -- using OpenLDAP client tools. When starting a fresh server (CentOS6.3, installed from yum if that matters here), it's not clear to me how I can bind using ldapadd in order to modify global server settings. Right now, I suspect the trouble is that the default databases have been created without a olcRootPw. Do I have to violate best practices just long enough to add that setting to the cn=config/olcDatabase={0}config.ldif file? After that, do I bind to "cn=config" in order to change global configuration settings using the base DN "cn=config"? (The olcRootDN is in the config database ldif file is "cn=config") To modify settings for the configuration database itself, do I also use the same bind ("cn=config") but use a base DN of "olcDatabase={0}config.ldif,cn=config"? I'm also curious, many of the examples I see for things like cn=Modules don't use the full DN, which I think is cn=Modules,cn=config. Why is this? I've read the website docs, the man pages, but I don't see any information that addresses how to initially bind to and start configuring the server in the Right Way. The quick start guide would be a good place for that, but it still talks about slapd.conf. Thanks for the help and for the good software

2 1

unable to sasl bind to openldap .
by mallapadi niranjan 20 Jan '13

20 Jan '13

Hi all, I need some help in finding more about the below error: Jan 20 05:34:58 ldap2 slapd[2561]: conn=1025 op=1 RESULT tag=97 err=14 text=SASL(0): successful result: Jan 20 05:34:58 ldap2 slapd[2561]: conn=1025 op=2 BIND dn="" method=163 Jan 20 05:34:58 ldap2 slapd[2561]: SASL [conn=1025] Failure: Inappropriate authentication Jan 20 05:34:58 ldap2 slapd[2561]: conn=1025 op=2 RESULT tag=97 err=50 text=SASL(-14): authorization failure: Inappropriate authentication Jan 20 05:34:58 ldap2 slapd[2561]: conn=1025 op=3 UNBIND Jan 20 05:34:58 ldap2 slapd[2561]: conn=1025 fd=31 closed More information: Openldap version:openldap-servers-2.4.23-26.el6_3.2.x86_64 What i am trying to do is i have configure bind (named) to store it's records in LDAP server using plugin provided by bind-dyndb-ldap-1.1.0-0.9.b1.el6.x86_64, And i have configure named.conf to access ldap server only through GSSAPI. options { listen-on port 53 { 127.0.0.1; }; listen-on-v6 port 53 { ::1; }; directory "/var/named"; dump-file "/var/named/data/cache_dump.db"; statistics-file "/var/named/data/named_stats.txt"; memstatistics-file "/var/named/data/named_mem_stats.txt"; forward first; forwarders { }; #dnssec-enable yes; #dnssec-validation yes; #dnssec-lookaside auto; allow-recursion { any; }; /* Path to ISC DLV key */ #bindkeys-file "/etc/named.iscdlv.key"; #managed-keys-directory "/var/named/dynamic"; tkey-gssapi-credential "dnsadmin(a)EXAMPLE.ORG"; tkey-domain "EXAMPLE.ORG"; }; logging { channel default_debug { file "data/named.run"; severity dynamic; }; }; zone "." IN { type hint; file "named.ca"; }; include "/etc/named.rfc1912.zones"; include "/etc/named.root.key"; dynamic-db "openldap" { library "ldap.so"; #arg "uri ldapi://%2fvar%2frun%2fldapi"; arg "uri ldap://localhost"; arg "base cn=dns,dc=example,dc=org"; arg "fake_mname ldap2.example.org."; arg "auth_method sasl"; arg "sasl_mech GSSAPI"; arg "sasl_user dnsadmin(a)EXAMPLE.ORG"; arg "zone_refresh 30"; }; As you can see named checks for dnsadmin(a)EXAMPLE.ORG as it sasl authentication user, dnsadmin(a)EXAMPLE.ORG is an user who exists in ldap records dn: cn=dnsadmin,ou=People,dc=example,dc=org cn: dnsadmin sn: user objectClass: person objectClass: krbPrincipalAux objectClass: krbTicketPolicyAux userPassword:: U2VjcmV0MTIz krbPrincipalName: dnsadmin(a)EXAMPLE.ORG krbLoginFailedCount: 0 krbPrincipalKey:: MIIByKADAgEBoQMCAQGiAwIBAqMDAgEBpIIBsDCCAawwVKAHMAWgAwIBAKFJ MEegAwIBEqFABD4gACUNiDAaRqfI6BDKN9YZ/DhvIf6TfUZY8pdWQ5HvM1ZI/DOxdPnIoXfnbjRT+ i7D7lMpkixzcxcFki3fFDBEoAcwBaADAgEAoTkwN6ADAgERoTAELhAAqBkEvL+gzUndM8TNS7ik+I 1weyacnVPB3PaFjtteeQBLcmrqikUN9eCWTDgwTKAHMAWgAwIBAKFBMD+gAwIBEKE4BDYYAM0347z v8kK3gj0A9SYOzUDa7Hc89pG1dg4LOdJfam6QkNGamezP45ZnFLzGSQ/oTR76I3YwRKAHMAWgAwIB AKE5MDegAwIBF6EwBC4QAC3muW46EjvmxYXnvzA11/kiUrGwknrOL/dtcVVhx2ul81zChqkfuHYjU BbTMDygBzAFoAMCAQChMTAvoAMCAQihKAQmCADtDnWrNBUuisnbEstExWOiwQphTqqXyrzPi1XQ3U jvE0TpMZUwPKAHMAWgAwIBAKExMC+gAwIBA6EoBCYIAFNul3CO38n/hMzLT9lT31ma7ObzhJ9B1qn BIGSvn7wDSiH2dw== krbPasswordExpiration: 19700101000000Z krbLastPwdChange: 20130119232256Z krbExtraData:: AALQKvtQcm9vdC9hZG1pbkBFWEFNUExFLk9SRwA= krbExtraData:: AAgBAA== named reads /etc/named.keytab file to get dnsadmin(a)EXAMPLE.ORG [root@ldap2 master]# klist -k /etc/named.keytab Keytab name: WRFILE:/etc/named.keytab KVNO Principal ---- -------------------------------------------------------------------------- 2 dnsadmin(a)EXAMPLE.ORG 2 dnsadmin(a)EXAMPLE.ORG 2 dnsadmin(a)EXAMPLE.ORG 2 dnsadmin(a)EXAMPLE.ORG 2 dnsadmin(a)EXAMPLE.ORG 2 dnsadmin(a)EXAMPLE.ORG what i am looking for is when bind tries to connect using " dnsadmin(a)EXAMPLE.ORG" to ldap server i am seeing below error Jan 20 05:47:43 ldap2 slapd[2561]: conn=1031 op=0 RESULT tag=97 err=14 text=SASL(0): successful result: Jan 20 05:47:43 ldap2 slapd[2561]: connection_input: conn=1031 deferring operation: binding Jan 20 05:47:43 ldap2 slapd[2561]: conn=1031 op=1 BIND dn="" method=163 Jan 20 05:47:43 ldap2 slapd[2561]: connection_input: conn=1031 deferring operation: binding Jan 20 05:47:43 ldap2 slapd[2561]: conn=1031 op=1 RESULT tag=97 err=14 text=SASL(0): successful result: Jan 20 05:47:43 ldap2 slapd[2561]: conn=1031 op=2 BIND dn="" method=163 Jan 20 05:47:43 ldap2 slapd[2561]: SASL [conn=1031] Failure: Inappropriate authentication Jan 20 05:47:43 ldap2 slapd[2561]: conn=1031 op=3 UNBIND Jan 20 05:47:43 ldap2 slapd[2561]: conn=1031 op=2 RESULT tag=97 err=50 text=SASL(-14): authorization failure: Inappropriate authentication Jan 20 05:47:43 ldap2 slapd[2561]: conn=1031 fd=34 closed Can any one help me on how to enable more debugging to get more info about the error=50 (Insufficient access error) , Below is my olcAuthRegexp configuration: # config dn: cn=config objectClass: olcGlobal cn: config olcConfigFile: /opt/setup-openldap/sample-slapd.conf olcConfigDir: /etc/openldap/slapd.d/ olcAllows: bind_v2 ... .. ... ... .... olcTLSCACertificateFile: /etc/pki/tls/certs/cacert.pem olcTLSCertificateFile: /etc/pki/tls/certs/server.pem olcTLSCertificateKeyFile: /etc/pki/tls/certs/serverkey.pem olcTLSVerifyClient: allow olcToolThreads: 1 olcWriteTimeout: 0 olcAuthzRegexp: {0}uid=(.*),cn=EXAMPLE.ORG,cn=gssapi,cn=auth uid=$1,ou=People ,dc=example,dc=org olcLogLevel: stats And the output of ldapwhoami [root@ldap2 master]# ldapwhoami -Y GSSAPI -H ldapi:/// SASL/GSSAPI authentication started SASL username: dnsadmin(a)EXAMPLE.ORG SASL SSF: 56 SASL data security layer installed. dn:uid=dnsadmin,cn=example.org,cn=gssapi,cn=auth I just want to find out why named when trying to sasl bind with openldap it fails, Thanks Niranjan

2 2

ldap users with users samba
by rodrigo tavares 18 Jan '13

18 Jan '13

Hello ! I trying sync ldap users with users samba. I´m using a interface, by create ldap users. So, when ldap user be created, i want account e password samba be created. No my smb.conf I put the follow lines: ldap admin dn = cn=admin,dc=def,dc=mg,dc=gov,dc=br ldap group suffix = ou = groups ldap machine suffix = ou = computers ldap passwd sync = yes encrypt passwords = Yes ldap suffix = dc=def,dc=mg,dc=gov,dc=br ldap ssl = no ldap user suffix = ou = defensory smb ports = 445 139 add user script = /usr/sbin/smbldap-useradd -a -m "%u" add group script = /usr/sbin/smbldap-groupadd -p "%g" add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g" delete user from group script = /usr/sbin/smbldap-groupmod -x "%u" "%g" set primary group script = /usr/sbin/smbldap-usermod -g "%g" "%u" add machine script = /usr/sbin/smbldap-useradd -w "%u" passwd program = /usr/sbin/smbldap-passwd -s "%u" passdb backend = ldapsam:ldap://10.65.8.95 passdb backend = tdbsam hosts allow = 127.0.0.1, 10.65.8.0/255.255.252.0 pam password change = yes passwd program = /usr/bin/passwd %u I configure in sladp.conf: include /etc/ldap/schema/ppolicy.schema moduleload ppolicy.so overlay ppolicy access to attrs=userPassword,shadowLastChange,sambaPwdMustChange,sambaLMPassword,sambaPwdLastSet,sambaNTPassword by dn="cn=admin,dc=def,dc=mg,dc=gov,dc=br" write by anonymous auth by self write by * none The user ldap is done, but samba user is not created. See some logs: Jan 18 16:09:01 defensoria slapd[6210]: conn=2455 fd=50 ACCEPT from IP=10.65.8.95:54507 (IP=0.0.0.0:389) So its bad. root@replica:/etc/ldap# smbclient -L 10.65.8.95 -U xbox Enter xbox's password: session setup failed: NT_STATUS_LOGON_FAILURE Thanks ! Rodrigo Faria Tavares

1 0

Re: don't get running the slapd while using mdb backend
by Meike Stone 18 Jan '13

18 Jan '13

> >>>>> So my first question: >>>>> Does mdb have limitations like bdb it have aka BDB_IDL_LOGN? >>>> >>>> >>>> >>>> Yes. back-mdb is ~60% the same code as back-bdb/hdb, its indexing >>>> functions are basically identical. >>> >>> >>> >>> However, I never got mdb to work successfully by modifying these values. >> >> >> Does this mean, it's not possible at moment to get running the mdb >> with BDB_IDL_LOGN = 2^17? > > > I can guarantee that would never work, as the variable with MDB is > MDB_IDL_LOGN. I don't recall exactly the issues I hit when changing it to > 17 from 16. Also, MDB has changed substantially since I did that testing. > ;) I was ok with not modifying it given the read speed improvements in mdb > vs bdb. > Thank for sharing, so I'll do test regarding this with the unmodified slapd and mdb, if it is fast enough in our environment! Have a nice weekend! Meike

2 1

Re: don't get running the slapd while using mdb backend
by Meike Stone 18 Jan '13

18 Jan '13

>>> So my first question: >>> Does mdb have limitations like bdb it have aka BDB_IDL_LOGN? >> >> >> Yes. back-mdb is ~60% the same code as back-bdb/hdb, its indexing >> functions are basically identical. > > > However, I never got mdb to work successfully by modifying these values. Does this mean, it's not possible at moment to get running the mdb with BDB_IDL_LOGN = 2^17? @Howard: I'm sorry, it was really not my intention to annoy, because of my statement about this problem in the bdb/mdb. Yes and I've read/followed each document under http://symas.com/mdb/, but not every one is a developer and not all of them is easy to understand. I try to get deeper inside to openldap and understand how it works, but it is really hard ;-) But anyway, I have to say thanks to all the great work you and the developer have done on openldap and especially mdb too! Thanks Meike

2 1

don't get running the slapd while using mdb backend
by Meike Stone 18 Jan '13

18 Jan '13

Hello, because of problems with bdb (virtual memory using and glibc) and limitiations (IDL), I want migrate to mdb. So my first question: Does mdb have limitations like bdb it have aka BDB_IDL_LOGN? Second, I set up an small lab for tests with mdb and don't get the slapd started with larger mdb size (10GB). Here the lab and test: Start slapd with an empty /var/lib/ldap/ldap.mdb directory I want reserve 10GByte disk space for mdb (maxsize 10737418240) error message in syslog ============================================================== @(#) $OpenLDAP: slapd 2.4.33 $ opensuse-buildservice(a)opensuse.org daemon: IPv6 socket() failed errno=97 (Address family not supported by protocol) mdb_db_open: database "ou=demo" cannot be opened, err 12. Restore from backup! backend_startup_one (type=mdb, suffix="ou=demo"): bi_db_open failed! (12) slapd stopped. created files from slapd while using ============================================================== ~# du -b /var/lib/ldap/ldap.mdb/* 12288 /var/lib/ldap/ldap.mdb/data.mdb 8192 /var/lib/ldap/ldap.mdb/lock.mdb I "straced" the start of slapd, here I think is the importand part: ============================================================== . . . stat("/var/lib/ldap/ldap.mdb", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 mmap(NULL, 2101248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fe38f915000 brk(0x7fe3948ae000) = 0x7fe3948ae000 open("/var/lib/ldap/ldap.mdb/lock.mdb", O_RDWR|O_CREAT, 0600) = 9 fcntl(9, F_GETFD) = 0 fcntl(9, F_SETFD, FD_CLOEXEC) = 0 fcntl(9, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=1}) = 0 lseek(9, 0, SEEK_END) = 0 ftruncate(9, 8192) = 0 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_SHARED, 9, 0) = 0x7fe3941e4000 open("/var/lib/ldap/ldap.mdb/data.mdb", O_RDWR|O_CREAT, 0600) = 11 read(11, "", 4096) = 0 mmap(NULL, 10737418240, PROT_READ, MAP_SHARED, 11, 0) = -1 ENOMEM (Cannot allocate memory) close(11) = 0 munmap(0x7fe3941e4000, 8192) = 0 close(9) = 0 . . . So I tried to start slapd with the default of maxsize -- every thing is ok -- ============================================================== If i comment out maxsize 10737418240 (use the default of 10M), start slapd every thing is fine, slapd starts and create files: ~# du -b /var/lib/ldap/ldap.mdb/* 12288 /var/lib/ldap/ldap.mdb/data.mdb 8192 /var/lib/ldap/ldap.mdb/lock.mdb As I understand, at first slapd start, the database file will be created with the full size, but as sparse file? So why I don't see this, if I use the default (maxsize 10485760) Here my slapd.configuration file ============================================================== include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/yast.schema include /etc/openldap/schema/rfc2307bis.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args modulepath /usr/lib/ldap moduleload back_mdb moduleload back_monitor sizelimit -1 timelimit 300 disallow bind_anon require authc gentlehup on tool-threads 4 serverID 001 database mdb suffix "ou=demo" rootdn "cn=admin" rootpw password directory /var/lib/ldap/ldap.mdb loglevel 256 maxsize 10737418240 index objectClass,entryUUID,entryCSN eq mounted filesystem for database ============================================================== debld02:/etc/openldap # mount | grep ldap /dev/sdb5 on /var/lib/ldap type ext3 (rw,relatime) free space on filsystem ============================================================== debld02:/etc/openldap # df -h | grep ldap /dev/sdb5 30G 5.6G 23G 20% /var/lib/ldap So I tried to create the sparse file manual ============================================================== ~# su -- ldap ~> id uid=76(ldap) gid=70(ldap) groups=70(ldap) ~> dd if=/dev/zero of=/var/lib/ldap/ldap.mdb/test.sparse bs=1 count=0 seek=10G 0+0 records in 0+0 records out 0 bytes (0 B) copied, 1.3413e-05 s, 0.0 kB/s ~> du -b /var/lib/ldap/ldap.mdb/test.sparse 10737418240 /var/lib/ldap/ldap.mdb/test.sparse What is going wrong with my test lab? Thanks Meike

3 4

Re: ldap update ( 2.2 to 2.4)
by Dan White 17 Jan '13

17 Jan '13

>On Thu, Jan 17, 2013 at 5:20 PM, Dan White <dwhite(a)olp.net> wrote: >> What is the output of: >> >> slapcat -n0 -s olcDatabase={1}bdb,cn=config >> >> (remove any passwords or sensitive information) >> >> Increase your debug level to see if you get any more specific information. On 01/17/13 18:37 -0200, Bruno Furtado wrote: >this is the output of slapcat: > > str2entry: invalid value for attributeType objectClass #1 (syntax >1.3.6.1.4.1.1466.115.121.1.38) That looks like the output of slapadd, not slapcat. Either that, or something strange has happened. >and this is the debug output: > config_add_internal: DN="olcDatabase={1}bdb,cn=config" no >structural objectClass in configuration table My output of the above slapcat command includes the following objectClasses (for olcDatabase={1}bdb,cn=config): objectClass: olcDatabaseConfig objectClass: olcBdbConfig If I understand your above error correctly, your configuration is bad. -- Dan White

1 0

Re: ldap update ( 2.2 to 2.4)
by Dan White 17 Jan '13

17 Jan '13

On 01/17/13 17:10 -0200, Bruno Furtado wrote: >On Fri, Jan 11, 2013 at 6:09 PM, Dan White <dwhite(a)olp.net> wrote: >> On 01/11/13 17:29 -0200, Bruno Furtado wrote: >>> On Thu, Jan 10, 2013 at 12:34 PM, Dan White <dwhite(a)olp.net> wrote: >>>> On 01/10/13 12:04 -0200, Bruno Furtado wrote: >>>>> Hi Folks! >>>>> >>>>> I'm newbie to LDAP and I received a mission to update the version. >>>>> >>>>> Today is running Openldap 2.2.23 and I need to update to OpenLDAP >>>>> 2.4.28. all update attempts failed. I observed that the new version >>>>> have a different method of configuration. >>>>> >>>>> What the best way to do this? >>>>> >>>>> >>>> What error messages did you receive? >>>> >>>> You can use slaptest (with both -f and -F options) to convert your >>>> configuration to the newer configuration database format (see man >>>> slapd-config), although you can still use a slapd.conf based >>>> configuration. >>> >>> I tried both settings. >>> >>> This is the error message: >>> >>> 50f066f8 str2entry: invalid value for attributeType objectClass #1 >>> (syntax 1.3.6.1.4.1.1466.115.121.1.38) >>> >> >> This error means that you have a value within your input, for an >> objectClass, which is invalid per rfc2252 and is not accepted by the >> newer version of slapd that you are using. >> >> Try to found out which entry in your input is causing the error. > >Now when I try to start LDAP I get this error: > >config error processing olcDatabase={1}bdb,cn=config > >olcDatabase={1}bdb.ldif aparently is ok! What is the output of: slapcat -n0 -s olcDatabase={1}bdb,cn=config (remove any passwords or sensitive information) Increase your debug level to see if you get any more specific information. -- Dan White

1 0

back-sql documentation (was: SELinux woes)
by Ori Bani 17 Jan '13

17 Jan '13

>> Trying to switch to slapd.conf instead of dynamic configuration in >> order to test the back-sql backend > > As of version 2.4.27, I believe back-sql supports dynamic configuration, so > there's no need to switch to slapd.conf > > see http://www.openldap.org/software/release/changes.html : > > OpenLDAP 2.4.27 Release (2011/11/24) > > Added slapd-sql dynamic config support Oh! Thanks for the pointer. Anyone know if there's any chance the documentation is going to be updated? It's over a year later and the docs (and everything I saw in the list archives) say I must use slapd.conf

3 2

Re: slapd crashes with ch_realloc of X bytes failed
by Meike Stone 17 Jan '13

17 Jan '13

Hello, I could update both systems during my vacation to 2.4.33. Both servers had 16GByte RAM. The system crashed again randomly (as expected). So we increased the memory on one server to 24 GByte RAM. No effect, this server crashes too, sometime till 5 times a day. I installed a test machine (VM), but only with 7GByte RAM and could reproduce the crashes with one/two parallel searches. So I tried tcmalloc, but with the same result. I digged a little deeper and the results are, that not the physical memory from the system is insufficient. First - slapd tries to allocate memory more then available, but not use it. It is enough physical memory available during slapd crashes. I ran the commands continuously with while and sleep 1: free -m, and pmap $PID_OF_LDAP and vmstat 1 The last memory information before the crash was: pmap: -------------------------- 21954: slapd START SIZE RSS PSS DIRTY SWAP PERM MAPPING 00007f63f4904000 4K 0K 0K 0K 0K rw-p [anon] 00007f63f4905000 4K 0K 0K 0K 0K ---p [anon] 00007f63f4906000 16384K 2080K 2080K 2080K 0K rw-p [anon] 00007f63f5906000 4K 0K 0K 0K 0K ---p [anon] 00007f63f5907000 16384K 4120K 4120K 4120K 0K rw-p [anon] 00007f63f6907000 4K 0K 0K 0K 0K ---p [anon] 00007f63f6908000 16384K 4120K 4120K 4120K 0K rw-p [anon] 00007f63f7908000 4K 0K 0K 0K 0K ---p [anon] 00007f63f7909000 16384K 4104K 4104K 4104K 16K rw-p [anon] 00007f63f8909000 4K 0K 0K 0K 0K ---p [anon] 00007f63f890a000 16384K 8K 8K 8K 4K rw-p [anon] 00007f63f990a000 24K 8K 8K 8K 0K rw-s /SYSV0000000c 00007f63f9910000 544K 44K 44K 44K 0K rw-s /SYSV0000000b 00007f63f9998000 2304K 12K 12K 12K 0K rw-s /SYSV0000000a 00007f63f9bd8000 2097152K 2097052K 2097052K 2097052K 0K rw-s /SYSV00000009 00007f6479bd8000 78008K 60508K 60508K 60508K 0K rw-s /SYSV00000008 00007f647e806000 16K 0K 0K 0K 0K r-xp /usr/lib64/sasl2/libplain.so.2.0.22 00007f647e80a000 2044K 0K 0K 0K 0K ---p /usr/lib64/sasl2/libplain.so.2.0.22 00007f647ea09000 4K 0K 0K 0K 4K r--p /usr/lib64/sasl2/libplain.so.2.0.22 00007f647ea0a000 4K 0K 0K 0K 4K rw-p /usr/lib64/sasl2/libplain.so.2.0.22 00007f647ea0b000 16K 0K 0K 0K 0K r-xp /usr/lib64/sasl2/libanonymous.so.2.0.22 00007f647ea0f000 2044K 0K 0K 0K 0K ---p /usr/lib64/sasl2/libanonymous.so.2.0.22 00007f647ec0e000 4K 0K 0K 0K 4K r--p /usr/lib64/sasl2/libanonymous.so.2.0.22 00007f647ec0f000 4K 0K 0K 0K 4K rw-p /usr/lib64/sasl2/libanonymous.so.2.0.22 00007f647ec10000 20K 0K 0K 0K 0K r-xp /usr/lib64/sasl2/libsasldb.so.2.0.22 00007f647ec15000 2044K 0K 0K 0K 0K ---p /usr/lib64/sasl2/libsasldb.so.2.0.22 00007f647ee14000 4K 0K 0K 0K 4K r--p /usr/lib64/sasl2/libsasldb.so.2.0.22 00007f647ee15000 4K 0K 0K 0K 4K rw-p /usr/lib64/sasl2/libsasldb.so.2.0.22 00007f647ee16000 16K 0K 0K 0K 0K r-xp /usr/lib64/sasl2/liblogin.so.2.0.22 00007f647ee1a000 2044K 0K 0K 0K 0K ---p /usr/lib64/sasl2/liblogin.so.2.0.22 00007f647f019000 4K 0K 0K 0K 4K r--p /usr/lib64/sasl2/liblogin.so.2.0.22 00007f647f01a000 4K 0K 0K 0K 4K rw-p /usr/lib64/sasl2/liblogin.so.2.0.22 00007f647f01b000 8K 0K 0K 0K 0K r-xp /lib64/libkeyutils-1.2.so 00007f647f01d000 2044K 0K 0K 0K 0K ---p /lib64/libkeyutils-1.2.so 00007f647f21c000 4K 0K 0K 0K 4K r--p /lib64/libkeyutils-1.2.so 00007f647f21d000 4K 0K 0K 0K 4K rw-p /lib64/libkeyutils-1.2.so 00007f647f21e000 28K 0K 0K 0K 0K r-xp /usr/lib64/libkrb5support.so.0.1 00007f647f225000 2048K 0K 0K 0K 0K ---p /usr/lib64/libkrb5support.so.0.1 00007f647f425000 4K 0K 0K 0K 4K r--p /usr/lib64/libkrb5support.so.0.1 00007f647f426000 4K 0K 0K 0K 4K rw-p /usr/lib64/libkrb5support.so.0.1 00007f647f427000 12K 0K 0K 0K 0K r-xp /lib64/libcom_err.so.2.1 00007f647f42a000 2044K 0K 0K 0K 0K ---p /lib64/libcom_err.so.2.1 00007f647f629000 4K 0K 0K 0K 4K r--p /lib64/libcom_err.so.2.1 00007f647f62a000 4K 0K 0K 0K 4K rw-p /lib64/libcom_err.so.2.1 00007f647f62b000 144K 0K 0K 0K 0K r-xp /usr/lib64/libk5crypto.so.3.1 00007f647f64f000 2044K 0K 0K 0K 0K ---p /usr/lib64/libk5crypto.so.3.1 00007f647f84e000 8K 0K 0K 0K 8K r--p /usr/lib64/libk5crypto.so.3.1 00007f647f850000 4K 0K 0K 0K 4K rw-p /usr/lib64/libk5crypto.so.3.1 00007f647f851000 632K 0K 0K 0K 0K r-xp /usr/lib64/libkrb5.so.3.3 00007f647f8ef000 2044K 0K 0K 0K 0K ---p /usr/lib64/libkrb5.so.3.3 00007f647faee000 12K 0K 0K 0K 12K r--p /usr/lib64/libkrb5.so.3.3 00007f647faf1000 8K 0K 0K 0K 8K rw-p /usr/lib64/libkrb5.so.3.3 00007f647faf3000 172K 0K 0K 0K 0K r-xp /usr/lib64/libgssapi_krb5.so.2.2 00007f647fb1e000 2048K 0K 0K 0K 0K ---p /usr/lib64/libgssapi_krb5.so.2.2 00007f647fd1e000 4K 0K 0K 0K 4K r--p /usr/lib64/libgssapi_krb5.so.2.2 00007f647fd1f000 4K 0K 0K 0K 4K rw-p /usr/lib64/libgssapi_krb5.so.2.2 00007f647fd20000 28K 0K 0K 0K 0K r-xp /usr/lib64/sasl2/libgssapiv2.so.2.0.22 00007f647fd27000 2044K 0K 0K 0K 0K ---p /usr/lib64/sasl2/libgssapiv2.so.2.0.22 00007f647ff26000 4K 0K 0K 0K 4K r--p /usr/lib64/sasl2/libgssapiv2.so.2.0.22 00007f647ff27000 4K 0K 0K 0K 4K rw-p /usr/lib64/sasl2/libgssapiv2.so.2.0.22 00007f647ff28000 48K 0K 0K 0K 0K r-xp /usr/lib64/sasl2/libdigestmd5.so.2.0.22 00007f647ff34000 2044K 0K 0K 0K 0K ---p /usr/lib64/sasl2/libdigestmd5.so.2.0.22 00007f6480133000 4K 0K 0K 0K 4K r--p /usr/lib64/sasl2/libdigestmd5.so.2.0.22 00007f6480134000 4K 0K 0K 0K 4K rw-p /usr/lib64/sasl2/libdigestmd5.so.2.0.22 00007f6480135000 84K 0K 0K 0K 0K r-xp /lib64/libz.so.1.2.3 00007f648014a000 2044K 0K 0K 0K 0K ---p /lib64/libz.so.1.2.3 00007f6480349000 4K 0K 0K 0K 4K r--p /lib64/libz.so.1.2.3 00007f648034a000 4K 0K 0K 0K 4K rw-p /lib64/libz.so.1.2.3 00007f648034b000 84K 0K 0K 0K 0K r-xp /lib64/libgcc_s.so.1 00007f6480360000 2044K 0K 0K 0K 0K ---p /lib64/libgcc_s.so.1 00007f648055f000 4K 0K 0K 0K 4K r--p /lib64/libgcc_s.so.1 00007f6480560000 4K 0K 0K 0K 4K rw-p /lib64/libgcc_s.so.1 00007f6480561000 940K 0K 0K 0K 0K r-xp /usr/lib64/libstdc++.so.6.0.16 00007f648064c000 2048K 0K 0K 0K 0K ---p /usr/lib64/libstdc++.so.6.0.16 00007f648084c000 32K 0K 0K 0K 32K r--p /usr/lib64/libstdc++.so.6.0.16 00007f6480854000 8K 0K 0K 0K 8K rw-p /usr/lib64/libstdc++.so.6.0.16 00007f6480856000 84K 0K 0K 0K 4K rw-p [anon] 00007f648086b000 36K 28K 28K 0K 0K r-xp /lib64/libunwind.so.7.0.0 00007f6480874000 2044K 0K 0K 0K 0K ---p /lib64/libunwind.so.7.0.0 00007f6480a73000 4K 4K 4K 4K 0K r--p /lib64/libunwind.so.7.0.0 00007f6480a74000 4K 4K 4K 4K 0K rw-p /lib64/libunwind.so.7.0.0 00007f6480a75000 16K 4K 4K 4K 0K rw-p [anon] 00007f6480a79000 1460K 444K 38K 0K 0K r-xp /lib64/libc-2.11.3.so 00007f6480be6000 2048K 0K 0K 0K 0K ---p /lib64/libc-2.11.3.so 00007f6480de6000 16K 16K 16K 8K 0K r--p /lib64/libc-2.11.3.so 00007f6480dea000 4K 4K 4K 4K 0K rw-p /lib64/libc-2.11.3.so 00007f6480deb000 20K 16K 16K 16K 4K rw-p [anon] 00007f6480df0000 36K 28K 10K 0K 0K r-xp /lib64/libwrap.so.0.7.6 00007f6480df9000 2044K 0K 0K 0K 0K ---p /lib64/libwrap.so.0.7.6 00007f6480ff8000 4K 4K 4K 0K 0K r--p /lib64/libwrap.so.0.7.6 00007f6480ff9000 4K 4K 4K 4K 0K rw-p /lib64/libwrap.so.0.7.6 00007f6480ffa000 4K 4K 4K 4K 0K rw-p [anon] 00007f6480ffb000 76K 4K 0K 0K 0K r-xp /lib64/libresolv-2.11.3.so 00007f648100e000 2048K 0K 0K 0K 0K ---p /lib64/libresolv-2.11.3.so 00007f648120e000 4K 0K 0K 0K 4K r--p /lib64/libresolv-2.11.3.so 00007f648120f000 4K 0K 0K 0K 4K rw-p /lib64/libresolv-2.11.3.so 00007f6481210000 8K 0K 0K 0K 0K rw-p [anon] 00007f6481212000 48K 4K 0K 0K 0K r-xp /lib64/libcrypt-2.11.3.so 00007f648121e000 2044K 0K 0K 0K 0K ---p /lib64/libcrypt-2.11.3.so 00007f648141d000 4K 0K 0K 0K 4K r--p /lib64/libcrypt-2.11.3.so 00007f648141e000 4K 0K 0K 0K 4K rw-p /lib64/libcrypt-2.11.3.so 00007f648141f000 184K 0K 0K 0K 0K rw-p [anon] 00007f648144d000 1484K 4K 4K 0K 0K r-xp /usr/lib64/libcrypto.so.0.9.8 00007f64815c0000 2044K 0K 0K 0K 0K ---p /usr/lib64/libcrypto.so.0.9.8 00007f64817bf000 64K 0K 0K 0K 64K r--p /usr/lib64/libcrypto.so.0.9.8 00007f64817cf000 100K 0K 0K 0K 100K rw-p /usr/lib64/libcrypto.so.0.9.8 00007f64817e8000 16K 0K 0K 0K 12K rw-p [anon] 00007f64817ec000 308K 4K 4K 0K 0K r-xp /usr/lib64/libssl.so.0.9.8 00007f6481839000 2044K 0K 0K 0K 0K ---p /usr/lib64/libssl.so.0.9.8 00007f6481a38000 8K 0K 0K 0K 8K r--p /usr/lib64/libssl.so.0.9.8 00007f6481a3a000 24K 0K 0K 0K 24K rw-p /usr/lib64/libssl.so.0.9.8 00007f6481a40000 8K 4K 0K 0K 0K r-xp /lib64/libdl-2.11.3.so 00007f6481a42000 2048K 0K 0K 0K 0K ---p /lib64/libdl-2.11.3.so 00007f6481c42000 4K 0K 0K 0K 4K r--p /lib64/libdl-2.11.3.so 00007f6481c43000 4K 0K 0K 0K 4K rw-p /lib64/libdl-2.11.3.so 00007f6481c44000 100K 44K 36K 0K 0K r-xp /usr/lib64/libsasl2.so.2.0.22 00007f6481c5d000 2048K 0K 0K 0K 0K ---p /usr/lib64/libsasl2.so.2.0.22 00007f6481e5d000 4K 4K 4K 4K 0K r--p /usr/lib64/libsasl2.so.2.0.22 00007f6481e5e000 4K 4K 4K 4K 0K rw-p /usr/lib64/libsasl2.so.2.0.22 00007f6481e5f000 84K 4K 0K 0K 0K r-xp /lib64/libnsl-2.11.3.so 00007f6481e74000 2044K 0K 0K 0K 0K ---p /lib64/libnsl-2.11.3.so 00007f6482073000 4K 0K 0K 0K 4K r--p /lib64/libnsl-2.11.3.so 00007f6482074000 4K 0K 0K 0K 4K rw-p /lib64/libnsl-2.11.3.so 00007f6482075000 8K 0K 0K 0K 0K rw-p [anon] 00007f6482077000 364K 4K 0K 0K 0K r-xp /lib64/libm-2.11.3.so 00007f64820d2000 2044K 0K 0K 0K 0K ---p /lib64/libm-2.11.3.so 00007f64822d1000 4K 0K 0K 0K 4K r--p /lib64/libm-2.11.3.so 00007f64822d2000 120K 0K 0K 0K 8K rw-p /lib64/libm-2.11.3.so 00007f64822f0000 96K 4K 4K 0K 0K r-xp /usr/lib64/libslp.so.1.0.0 00007f6482308000 2044K 0K 0K 0K 0K ---p /usr/lib64/libslp.so.1.0.0 00007f6482507000 4K 0K 0K 0K 4K r--p /usr/lib64/libslp.so.1.0.0 00007f6482508000 4K 0K 0K 0K 4K rw-p /usr/lib64/libslp.so.1.0.0 00007f6482509000 92K 76K 26K 0K 0K r-xp /lib64/libpthread-2.11.3.so 00007f6482520000 2048K 0K 0K 0K 0K ---p /lib64/libpthread-2.11.3.so 00007f6482720000 4K 4K 4K 4K 0K r--p /lib64/libpthread-2.11.3.so 00007f6482721000 4K 4K 4K 4K 0K rw-p /lib64/libpthread-2.11.3.so 00007f6482722000 16K 4K 4K 4K 0K rw-p [anon] 00007f6482726000 400K 4K 4K 0K 0K r-xp /usr/lib64/libodbc.so.1.0.0 00007f648278a000 2044K 0K 0K 0K 0K ---p /usr/lib64/libodbc.so.1.0.0 00007f6482989000 4K 0K 0K 0K 4K r--p /usr/lib64/libodbc.so.1.0.0 00007f648298a000 28K 0K 0K 0K 28K rw-p /usr/lib64/libodbc.so.1.0.0 00007f6482991000 4K 0K 0K 0K 0K rw-p [anon] 00007f6482992000 1224K 196K 187K 0K 0K r-xp /usr/lib64/libdb-4.5.so 00007f6482ac4000 2048K 0K 0K 0K 0K ---p /usr/lib64/libdb-4.5.so 00007f6482cc4000 12K 4K 4K 4K 8K r--p /usr/lib64/libdb-4.5.so 00007f6482cc7000 12K 12K 12K 12K 0K rw-p /usr/lib64/libdb-4.5.so 00007f6482cca000 36K 4K 0K 0K 0K r-xp /usr/lib64/libltdl.so.7.2.0 00007f6482cd3000 2044K 0K 0K 0K 0K ---p /usr/lib64/libltdl.so.7.2.0 00007f6482ed2000 4K 0K 0K 0K 4K r--p /usr/lib64/libltdl.so.7.2.0 00007f6482ed3000 4K 0K 0K 0K 4K rw-p /usr/lib64/libltdl.so.7.2.0 00007f6482ed4000 56K 44K 14K 0K 0K r-xp /usr/lib64/liblber-2.4.so.2.8.5 00007f6482ee2000 2044K 0K 0K 0K 0K ---p /usr/lib64/liblber-2.4.so.2.8.5 00007f64830e1000 4K 4K 4K 4K 0K r--p /usr/lib64/liblber-2.4.so.2.8.5 00007f64830e2000 4K 4K 4K 4K 0K rw-p /usr/lib64/liblber-2.4.so.2.8.5 00007f64830e3000 308K 64K 64K 0K 0K r-xp /usr/lib64/libldap_r-2.4.so.2.8.5 00007f6483130000 2048K 0K 0K 0K 0K ---p /usr/lib64/libldap_r-2.4.so.2.8.5 00007f6483330000 4K 4K 4K 4K 0K r--p /usr/lib64/libldap_r-2.4.so.2.8.5 00007f6483331000 8K 8K 8K 8K 0K rw-p /usr/lib64/libldap_r-2.4.so.2.8.5 00007f6483333000 12K 8K 8K 8K 4K rw-p [anon] 00007f6483336000 288K 96K 96K 0K 0K r-xp /usr/local/lib/libtcmalloc.so.4.1.0 00007f648337e000 2044K 0K 0K 0K 0K ---p /usr/local/lib/libtcmalloc.so.4.1.0 00007f648357d000 4K 4K 4K 4K 0K r--p /usr/local/lib/libtcmalloc.so.4.1.0 00007f648357e000 4K 4K 4K 4K 0K rw-p /usr/local/lib/libtcmalloc.so.4.1.0 00007f648357f000 156K 92K 92K 88K 36K rw-p [anon] 00007f64835a6000 124K 40K 0K 0K 0K r-xp /lib64/ld-2.11.3.so 00007f6483708000 212K 0K 0K 0K 0K r--s /var/run/nscd/group 00007f648373d000 212K 0K 0K 0K 0K r--s /var/run/nscd/passwd 00007f6483772000 212K 0K 0K 0K 0K r--s /var/run/nscd/dbvbS4oY 00007f64837a7000 48K 28K 28K 24K 20K rw-p [anon] 00007f64837bc000 24K 8K 8K 8K 0K rw-s /SYSV00000007 00007f64837c2000 8K 4K 4K 4K 4K rw-p [anon] 00007f64837c4000 4K 4K 4K 4K 0K r--p /lib64/ld-2.11.3.so 00007f64837c5000 4K 4K 4K 4K 0K rw-p /lib64/ld-2.11.3.so 00007f64837c6000 4K 4K 4K 4K 0K rw-p [anon] 00007f64837c7000 1944K 456K 456K 0K 0K r-xp /usr/lib/openldap/slapd 00007f6483bac000 20K 8K 8K 8K 12K r--p /usr/lib/openldap/slapd 00007f6483bb1000 48K 24K 24K 24K 24K rw-p /usr/lib/openldap/slapd 00007f6483bbd000 3812K 1052K 1052K 984K 1788K rw-p [heap] 00007f6483f76000 5004408K 4574484K 4574484K 4574392K 257508K rw-p [heap] 00007fff9f532000 132K 4K 4K 4K 32K rw-p [stack] 00007fff9f5b6000 4K 4K 0K 0K 0K r-xp [vdso] ffffffffff600000 4K 0K 0K 0K 0K r-xp [vsyscall] Total: 7350688K 6749464K 6748875K 6747724K 259932K 5091328K writable-private, 80668K readonly-private, 2178692K shared, and 4900700K referenced ================================================================================ last free -m before crash: ------------------------------- total used free shared buffers cached Mem: 6928 6813 115 0 0 2180 -/+ buffers/cache: 4632 2296 Swap: 2047 288 1759 last free after crash: ------------------------------- total used free shared buffers cached Mem: 6928 4978 1950 0 0 2166 -/+ buffers/cache: 2810 4117 Swap: 2047 42 2005 ================================================================================ and vmstat: ------------------------------- procs -----------memory---------- ---swap-- -----io---- -system-- -----cpu------ r b swpd free buff cache si so bi bo in cs us sy id wa st 1 4 295284 110148 540 2255804 108 0 13428 0 796 1373 3 5 27 65 0 0 3 295260 118140 608 2242804 36 0 9308 0 2227 1309 2 5 23 70 0 0 3 295224 116668 680 2237396 48 0 4008 0 1253 2002 3 6 52 39 0 1 0 295164 116296 736 2232588 128 0 6028 0 1083 954 3 14 45 39 0 0 0 42332 4742716 768 2219044 784 0 1104 0 1428 1178 3 23 63 11 0 0 0 42332 4743020 768 2219168 0 0 0 0 253 97 0 0 100 0 0 0 0 42332 4743408 768 2219160 0 0 0 0 201 98 0 0 100 0 0 0 1 42300 4743408 768 2219140 216 0 216 0 295 150 0 0 99 1 0 What I see, that slapd had reserved "Total: 7350688K" (overcommitted?), but only referenced 4900700K. Why does slapd reserve so much memory and use it not? Because of this, I changed the default values for memory overcomittment from: vm.overcommit_memory = 0 (guess, default) vm.overcommit_ratio = 50 to: vm.overcommit_memory=2 (strict overcommit) vm.overcommit_ratio=100 but it crashed again (ch_malloc of 34545 bytes failed): . . 00007f2bf8e1a000 5019920K 4597460K 4597460K 4597116K 333472K rw-p [heap] 00007fffe86c5000 132K 0K 0K 0K 36K rw-p [stack] 00007fffe87af000 4K 4K 0K 0K 0K r-xp [vdso] ffffffffff600000 4K 0K 0K 0K 0K r-xp [vsyscall] Total: 7333420K 6766996K 6766484K 6765536K 336192K 5074068K writable-private, 80660K readonly-private, 2178692K shared, and 4681876K referenced So in spite of increase the memory from 16GByte to 24 GByte (one of the production server - configuration described in the first mail) same results. Is there anywhere a memory leak - how can I find out this? Thanks Meike P.S., mdb is not the option now, we need time to evaluate this ...

2 3

[OT] SELinux woes
by Ori Bani 17 Jan '13

17 Jan '13

All, Trying to switch to slapd.conf instead of dynamic configuration in order to test the back-sql backend I ran into a problem with SELinux that I do not understand. The startup fails with the error: /etc/openldap/slapd.conf: line 27: invalid path: Permission denied Disabling SELinux fixes the problem, however I'm not sure what is going on. The line in question is naturally the "directory" that points in this case to /var/lib/ldap. That directory is a hand-made clone of the original one that was there which was moved (renamed) out of the way. Here is what I did: mv /etc/openldap/slapd.d /etc/openldap/slapd.d.BAK mv /var/lib/ldap /var/lib/ldap.BAK mkdir /var/lib/ldap chown ldap:ldap /var/lib/ldap chmod 700 /var/lib/ldap create a simple /etc/openldap/slapd.conf The ownership and permissions on ldap and ldap.BAK directories are identical. OpenLDAP works fine if I disable SELinux. What is SELinux doing here?

3 3

Issue with LDAP TLS for Unix Login
by Arvind Navale 17 Jan '13

17 Jan '13

Hi Folks, I have a openldap server version slapd 2.4.16 running on a Solaris-10 OS. I have generated the self signed CA certificate on the ldap server to use TLS and configured the slapd.conf with certificate information. I am looking to get LDAP authentication using TLS on the ldap client side. I was able to setup centos-6.3 linux as ldap client using openldap client to LDAP authentication using TLS but I am having issues to setup a Solaris-10 OS using native LDAP client software. Solaris-10 LDAP client is setup using 'ldapclient manaul' and certificate was added using certutil command. Here is error messages seeing when trying to authenticate when using LDAP-TLS in sladp.log file on the openldap server side, Jan 14 14:51:53 ldapsrv slapd[543]: [ID 848112 local4.debug] conn=1270 fd=25 ACCEPT from IP=10.90.180.236:41051 (IP=0.0.0.0:636) Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=10 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 601841 local4.debug] daemon: activity on 1 descriptor Jan 14 14:51:53 ldapsrv slapd[543]: [ID 609413 local4.debug] daemon: waked Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=7 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=8 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=9 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=10 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 601841 local4.debug] daemon: activity on 1 descriptor Jan 14 14:51:53 ldapsrv slapd[543]: [ID 802679 local4.debug] daemon: activity on: Jan 14 14:51:53 ldapsrv slapd[543]: [ID 522297 local4.debug] 25r Jan 14 14:51:53 ldapsrv slapd[543]: [ID 100000 local4.debug] Jan 14 14:51:53 ldapsrv slapd[543]: [ID 694296 local4.debug] daemon: read activity on 25 Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=7 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 525477 local4.debug] connection_get(25) Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=8 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 611214 local4.debug] connection_get(25): got connid=1270 Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=9 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=10 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 138202 local4.debug] connection_read(25): checking for input on id=1270 Jan 14 14:51:53 ldapsrv slapd[543]: [ID 601841 local4.debug] daemon: activity on 1 descriptor Jan 14 14:51:53 ldapsrv slapd[543]: [ID 609413 local4.debug] daemon: waked Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=7 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=8 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=9 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=10 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 601841 local4.debug] daemon: activity on 1 descriptor Jan 14 14:51:53 ldapsrv slapd[543]: [ID 802679 local4.debug] daemon: activity on: Jan 14 14:51:53 ldapsrv slapd[543]: [ID 522297 local4.debug] 25r Jan 14 14:51:53 ldapsrv slapd[543]: [ID 100000 local4.debug] Jan 14 14:51:53 ldapsrv slapd[543]: [ID 694296 local4.debug] daemon: read activity on 25 Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=7 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 525477 local4.debug] connection_get(25) Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=8 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=9 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 611214 local4.debug] connection_get(25): got connid=1270 Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=10 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 138202 local4.debug] connection_read(25): checking for input on id=1270 Jan 14 14:51:53 ldapsrv slapd[543]: [ID 688457 local4.debug] connection_read(25): TLS accept failure error=-1 id=1270, closing Jan 14 14:51:53 ldapsrv slapd[543]: [ID 734893 local4.debug] connection_closing: readying conn=1270 sd=25 for close Jan 14 14:51:53 ldapsrv slapd[543]: [ID 330685 local4.debug] connection_close: conn=1270 sd=25 Jan 14 14:51:53 ldapsrv slapd[543]: [ID 601841 local4.debug] daemon: activity on 1 descriptor Jan 14 14:51:53 ldapsrv slapd[543]: [ID 609413 local4.debug] daemon: waked Jan 14 14:51:53 ldapsrv slapd[543]: [ID 423323 local4.debug] daemon: removing 25 Jan 14 14:51:53 ldapsrv slapd[543]: [ID 485650 local4.debug] conn=1270 fd=25 closed (TLS negotiation failure) Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=7 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=8 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=9 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 538834 local4.debug] daemon: select: listen=10 active_threads=1 tvp=zero Jan 14 14:51:53 ldapsrv slapd[543]: [ID 601841 local4.debug] daemon: activity on 1 descriptor Jan 14 14:51:53 ldapsrv slapd[543]: [ID 802679 local4.debug] daemon: activity on: Jan 14 14:51:53 ldapsrv slapd[543]: [ID 522297 local4.debug] 23r Jan 14 14:51:53 ldapsrv slapd[543]: [ID 100000 local4.debug] On the ldap client side I have enabled pam debugging and I see the following error messages associated with it, Jan 14 14:52:34 drac9ec2 sshd[6459]: [ID 492885 auth.debug] PAM[6459]: pam_setcred(80c9bd8, 2) Jan 14 14:52:34 drac9ec2 sshd[6459]: [ID 931871 auth.debug] PAM[6459]: load_modules(80c9bd8, pam_sm_setcred)=/usr/lib/security/pam_authtok_get.s o.1 Jan 14 14:52:34 drac9ec2 sshd[6459]: [ID 962116 auth.debug] PAM[6459]: pam_setcred(80c9bd8, 2): error Permission denied Jan 14 14:52:34 drac9ec2 sshd[6459]: [ID 509612 auth.debug] PAM[6459]: pam_set_item(80c9bd8:authtok) Jan 14 14:52:34 drac9ec2 sshd[6459]: [ID 725776 auth.debug] PAM[6459]: pam_end(80c9bd8): status = Permission denied Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 826707 auth.debug] PAM[6820]: pam_set_item(80c9bd8:authtok) Jan 14 14:52:45 drac9ec2 last message repeated 1 time Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 887652 auth.debug] PAM[6820]: pam_authenticate(80c9bd8, 1): error Authentication failed Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 285619 auth.debug] ldap pam_sm_authenticate(sshd-kbdint ldapusr2), flags = 1 Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 293258 auth.warning] libsldap: Status: 81 Mesg: openConnection: simple bind failed - Can't contact LDA P server Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 887652 auth.debug] PAM[6820]: pam_authenticate(80c9bd8, 1): error Permission denied Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 826707 auth.debug] PAM[6820]: pam_set_item(80c9bd8:authtok) Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 800047 auth.info] Keyboard-interactive (PAM) userauth failed[9] while authenticating: Authentication fa iled Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 800047 auth.notice] Failed keyboard-interactive for ldapusr2 from 10.90.176.38 port 44078 ssh2 Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 826707 auth.debug] PAM[6820]: pam_set_item(80c9bd8:conv) Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 814791 auth.debug] PAM[6820]: pam_end(80c9bd8): status = Authentication failed Jan 14 14:52:45 drac9ec2 sshd[6820]: [ID 324150 auth.debug] PAM[6820]: pam_start(sshd-kbdint,ldapusr2,80a98a8:80c9bd8) - debug = 1 Here is the ldapclient I have ran to setup the ldapclient, ldapclient -v manual -a defaultServerList=10.90.177.2 -a credentialLevel=anonymous -a domainName=dvsg-ldap.com -a defaultSearchBase=dc=dvsg-ldap,dc=com -a authenticationMethod=tls:simple -a serviceAuthenticationMethod=pam_ldap:tls:simple -a proxyDN=cn=readonly,dc=dvsg-ldap,dc=com -a proxyPassword=secret -a certificatePath=/var/ldap Any guidance or help to resolve this issue would be most appreciated. thank you, Arvind.

1 0

Strange ACL evaluation depending on AttributeSelection?
by Michael Ströder 17 Jan '13

17 Jan '13

HI! Today I made a strange observation tested with release 2.4.32 and git-build RE24 6f33e2c both with same results. The following commands (lines wrapped herein) were all typed as user root which gets mapped by authz-regexp to the rootdn of the database o=example (LDAPI with SASL/EXTERNAL). Let's check that: # ldapwhoami SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 dn:uid=admin,o=example I wanted to check ACLs applied to attribute 'sambaNTPassword' and to test Samba logon of course. Samba logon did work when putting the Samba demon user in a special group which has read access everywhere but it didn't when the special Samba ACLs were to be applied. So I tried to examine a possible bug in my ACLs but noticed unexpected results during that. Everything looks fine with a normal search as rootdn and we see that the entry indeed contains 'sambaNTPassword': # ldapsearch -LLL "(&(objectclass=sambaSamAccount)(uid=wtester))" sambaNTPassword SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 dn: employeeNumber=42424242,ou=users,o=example sambaNTPassword: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx But when requesting to use the authz-DN with which the Samba demon binds the attribute is not shown which one might consider an ACL issue. Note that sambaNTPassword is explicitly requested just like Samba correctly does it: # ldapsearch -LLL -X "dn:uid=samba_dc_1,ou=samba,o=example" "(&(objectclass=sambaSamAccount)(uid=wtester))" sambaNTPassword SASL/EXTERNAL authentication started SASL username: dn:uid=samba_dc_1,ou=samba,o=example SASL SSF: 0 dn: employeeNumber=42424242,ou=users,o=example But then I would expect this search also *not* to return attribute 'sambaNTPassword' but it does! # ldapsearch -LLL -X "dn:uid=samba_dc_1,ou=samba,o=example" "(&(objectclass=sambaSamAccount)(uid=wtester))" "*" |grep -i sambaNTPassword SASL/EXTERNAL authentication started SASL username: dn:uid=samba_dc_1,ou=samba,o=example SASL SSF: 0 sambaNTPassword: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Maybe I'm doing something wrong on the command-line but I simply don't get it... :-/ Or is there some difference in ACL handling based on SearchRequest.attributes (AttributeSelection)? I have an ACL which blocks access to password attributes of disabled users by using a filter-based ACL. Hmm, I did not try what happens when explicitly requesting the attribute used in the filter. I have to do that tomorrow... Ciao, Michael.

2 3

Re: Replication not working
by anil beniwal 17 Jan '13

17 Jan '13

Ok Thanks a lot , looks like i will be able to swim through Final question, before going for this config. What would be impact of lastmode on/off with and without replication with big db size. On Thu, Jan 17, 2013 at 4:45 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Thursday, January 17, 2013 4:37 AM +0530 anil beniwal < > beni.anil(a)gmail.com> wrote: > > >> I am using rpm from symas, latest update on 29th dec,2013. i think that >> will work. >> >> Is my acceslog db configuration in slapd.conf right ? >> > > If that is your actual config file, no. You stuck the definition of the > accesslog DB in the middle of your existing DB configuration, which is > going to cause you all sorts of problems. I prefer to list the accesslog > db prior to the main db. > > > --Quanah > > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Thanks&Regards Anil Beniwal +919891695048

1 0

Re: Replication not working
by anil beniwal 17 Jan '13

17 Jan '13

I am using rpm from symas, latest update on 29th dec,2013. i think that will work. Is my acceslog db configuration in slapd.conf right ? On Thu, Jan 17, 2013 at 4:27 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Thursday, January 17, 2013 2:49 AM +0530 anil beniwal < > beni.anil(a)gmail.com> wrote: > > >> My Bad >> >> Going forward, what would be my strategy, to enable delta sync repl with >> one master is already running with 200G mdb db. >> >> What i understand is >> 1.enable accesslog overlay on master server configure accesslog start >> the master >> 2. Take backup with mdb_copyand restore it on other master servers. >> 3. Enable accesslog configure to new consumers(work as providers as >> well) >> > > That sounds about right. I assume you are using current RE24 OpenLDAP, > and not 2.4.33. > > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Thanks&Regards Anil Beniwal +919891695048

2 1

Re: Replication not working
by anil beniwal 16 Jan '13

16 Jan '13

My Bad Going forward, what would be my strategy, to enable delta sync repl with one master is already running with 200G mdb db. What i understand is 1.enable accesslog overlay on master server configure accesslog start the master 2. Take backup with mdb_copyand restore it on other master servers. 3. Enable accesslog configure to new consumers(work as providers as well) Can you have a look, if i am wrong some where or any suggestion. include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/dyngroup.schema include /etc/openldap/schema/ppolicy.schema include /etc/openldap/schema2/channelIdentifier.schema include /etc/openldap/schema2/platform.schema include /etc/openldap/schema2/extendedProfileKey.schema include /etc/openldap/schema2/extendedProfileValue.schema include /etc/openldap/schema2/behaviorKey.schema include /etc/openldap/schema2/behaviorValue.schema include /etc/openldap/schema2/questionAnswer.schema include /etc/openldap/schema2/extendedTop.schema include /etc/openldap/schema2/counter.schema serverid 1 TLSCipherSuite HIGH:MEDIUM:+SSLv3 TLSCACertificateFile /etc/openldap/cacerts/cacert.pem TLSCertificateFile /etc/openldap/cacerts/mmam01.crt TLSCertificateKeyFile /etc/openldap/cacerts/mmam01.key TLSVerifyClient never pidfile /var/run/slapd.pid argsfile /var/run/slapd.args loglevel sync stats idletimeout 30 writetimeout 30 modulepath /etc/openldap/lib64/openldap moduleload back_mdb.la moduleload ppolicy.la moduleload unique.la moduleload syncprov.la database mdb suffix "dc=example,dc=com" directory /openldap/var/data access to attrs=userPassword by self write by anonymous auth by * break access to * by group/groupOfUniqueNames/uniqueMember.exact="cn=PWrite,ou=bGroup,dc=example,dc=com" manage by group/groupOfUniqueNames/uniqueMember.exact="cn=PRead,ou=bGroup,dc=example,dc=com" read by * break access to * by self write by anonymous auth by * read rootdn "cn=Manager,dc=example,dc=com" rootpw {SSHA}dXDESQeFjSoa/A1HfJ2TAzYf4DrSYWY index mail,uid,postalCode,smail,channelType,channelValue,answer,behavName,objectclass,type eq index givenName,sn,city,cn,extName sub index displayName approx index entryCSN,entryUUID eq checkpoint 128 15 maxsize 274877906944 overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 #accesslog db configuration database mdb suffix cn=log rootdn "cn=Manager,cn=log" rootpw xxxxxx directory /apps/accesslog index reqStart,objectclass,entryCSN,reqResult eq overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE overlay accesslog logdb cn=log logops writes logpurge 7+00:00 2+00:00 logsuccess TRUE syncrepl rid=111 provider=ldap://sjam01.com binddn="cn=Manager,dc=example,dc=com" bindmethod=simple credentials=0m2013 tls_cacert=/etc/openldap/cacerts/cacert.pem searchbase="dc=example,dc=com" type=refreshAndPersist retry="5 5 60 +" network-timeout=10 timeout=10 syncdata=accesslog logbase="cn=log" logfilter="(&(objectclass=auditWriteObject)(reqResult=0))" syncrepl rid=222 provider=ldap://mmam04.com binddn="cn=Manager,dc=example,dc=com" bindmethod=simple credentials=0m2013 tls_cacert=/etc/openldap/cacerts/cacert.pem searchbase="dc=example,dc=com" type=refreshAndPersist retry="5 5 60 +" network-timeout=10 timeout=10 syncdata=accesslog logbase="cn=log" logfilter="(&(objectclass=auditWriteObject)(reqResult=0))" mirrormode true overlay unique unique_attributes mail overlay ppolicy ppolicy_default "cn=default,ou=pwdPolicy,dc=example,dc=com" ppolicy_use_lockout On Thu, Jan 17, 2013 at 1:51 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Thursday, January 17, 2013 1:48 AM +0530 anil beniwal < > beni.anil(a)gmail.com> wrote: > > >> If i can't use multi master with refreshandpersist then why its given at >> all. >> i was able to get replication working with same configuration in other >> testing environment, but with very less users 1m only. >> > > I don't understand your statement/question. Delta-Syncrepl MMR uses > refresh and persist, and it is the best option to use for replication in > OpenLDAP. Particularly with multi-master replication. > > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Thanks&Regards Anil Beniwal +919891695048

2 1

Access questions
by Ori Bani 16 Jan '13

16 Jan '13

Hello, I think I understand that default access for everything that does not have any access rule is to allow read permission to everyone. All other entries (that have some form of access rules) will have a default of "access to * by * none" applied. I'd like instead to have all defaults be no access. I have a directory that will be used for internal email processes and also have a certain amount of public/anonymous access (but only to chosen attributes). Due to the public/anonymous component, I'd like to have default access rules be as restrictive as possible. Does it make sense to (do people commonly) set a global access of "access to * by * none" and then open access up for individual databases as desired? I'm thinking a global rule: access to * by dn.base="cn=Manager,dc=example,dc=com" write by * none Then each database will have to explicitly open access only as much as needed. The following would be in the database that uses the suffix for dc=example,dc=com Passwords for auth only, only admin can change passwords: access to attrs=userPassword by dn.base="cn=Manager,dc=example,dc=com" write by anonymous auth by * none Attributes needed by email delivery software only visible to the entry itself: access to attrs=mailMessageStore,homeDirectory,uidNumber,gidNumber by dn.base="cn=Manager,dc=example,dc=com" write by self read by * none Publicly available attributes defined explicitly: access to attrs=mail,jpegPhoto by dn.base="cn=Manager,dc=example,dc=com" write by * read Nothing else can be seen by anyone except the admin: access to * by dn.base="cn=Manager,dc=example,dc=com" write by * none In this scenario, cn is used to identify entries when searching but as you see, that attribute is forbidden to anonymous. Is that a problem or is it OK to allow query against cn while still disallowing cn in the results? I guess I'd also add this within this database's context, but I have to do it above the other rules I just listed? access to dn.base="cn=Manager,dc=example,dc=com" by peername.ip=127.0.0.1 auth by peername.ip=192.168.0.0%255.255.255.0 auth by * none Any tips much appreciated.

2 6

Re: Replication not working
by anil beniwal 16 Jan '13

16 Jan '13

If i can't use multi master with refreshandpersist then why its given at all. i was able to get replication working with same configuration in other testing environment, but with very less users 1m only. I am having all this running in production, but replication is not working. What should be my strategy to add new consumer, where my provider is running with mdb db size of 200G in production. i don't want to mess with configuration changes on master or with minimum changes. Any other suggestions are all welcome. On Wed, Jan 16, 2013 at 12:46 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Tuesday, January 15, 2013 6:53 PM +0000 Chris Card < > ctcard(a)hotmail.com> wrote: > > This second problem doesn't happen consistently, but because I don't >> understand why it happens or how to fix it consistently, I can't go ahead >> with the production upgrade to delta-syncrepl, which is very frustrating. >> We are currently running openldap 2.4.31, but I do plan to see if 2.4.33 >> or RE24 behaves better. However, looking at the openldap sources I >> haven't spotted any fixes which look likely to help. >> Any ideas? >> > > I take it you are replicating cn=config then? I never do that, so hard > for me to comment on issues that may arise by doing that. > > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Thanks&Regards Anil Beniwal +919891695048

2 1

Using policy overlay
by rodrigo tavares 16 Jan '13

16 Jan '13

Hello ! I´m with troubles, in trying to load policy overlay,it is /usr/lib/ldap/ppolicy.so. Then I put overlay ppolicy in slapd.conf. So, restart openldap. But is com error: Jan 16 16:08:12 defensoria slapd[14010]: @(#) $OpenLDAP: slapd 2.4.23 (Jun 16 2011 02:53:39) $#012#011buildd@murphy:/build/buildd-openldap_2.4.23-7.2-i386-Y1mwvF/openldap-2.4.23/debian/build/servers/slapd Jan 16 16:08:12 defensoria slapd[14010]: overlay "ppolicy" not found Jan 16 16:08:12 defensoria slapd[14010]: slapd stopped. Jan 16 16:08:12 defensoria slapd[14010]: connections_destroy: nothing to destroy. Anybody Can to help me ? Thanks ! Rodrigo Faria

2 3

Re: uninstall?
by Ori Bani 16 Jan '13

16 Jan '13

>> Is there a make rule for uninstallation? "make uninstall" doesn't do >> the trick... >> >> If there's not, is there any recommended way to handle removing >> OpenLDAP that was installed from source? > > > Use --prefix so you install everything into the path you want? Otherwise, > no, no particularly easy way to uninstall. Hmmm, OK thank you.

1 0

uninstall?
by Ori Bani 16 Jan '13

16 Jan '13

Hi, Is there a make rule for uninstallation? "make uninstall" doesn't do the trick... If there's not, is there any recommended way to handle removing OpenLDAP that was installed from source? Thank you!

2 1

Permissions, users, startup when install from source
by Ori Bani 15 Jan '13

15 Jan '13

Hi, If compiling and installing from source, I don't see any information in the manual about how to auto-start the software and about process/file/directory permissions and ownership. I'm still searching the Faq-O-Matic (which is a little frustrating). Taking a step back, I'd love to install from yum on RHEL/CentOS and let it be taken care of in a trusted manner. But we require better password hashing than SHA1, so we are required to compile by hand using the passwd/sha2 contributed module (little surprised this isn't accepted into the core project, but I'm sure there are reasons). Maybe I can find this in a third-party repo somewhere? After installation, what is commonly done in this regard? Create user/group "ldap" with no login shell and chown ldap:ldap on /usr/local/var/openldap-data? Is that all? Then what do people use for auto-starting the software (presumably with -u ldap -g ldap) in a RedHat environment? Thanks for the work that you do, thanks for the great software.

2 1

Re: slapd crashes with ch_realloc of X bytes failed
by Meike Stone 15 Jan '13

15 Jan '13

> > Yes, that would significantly increase memory usage. I have only ever done > the *second* modification (BDB_IDL_LOGN) to fix the IDL issues. I've run > that way for years. How much have you increased the BDB_IDL_LOGN -> 2^17 or more, would be interesting for me, because we are nearly reach this size too. > Try dropping the modification to LDAP_PVT_THREAD_STACK_SIZE. It has never > been necessary for any of my customers, many of whom have DBs with 6 to 10 > million entries. Ok, thanks, I'll do this and check. Thanks Mike

2 1

Fwd: adding support to mdb
by Friedrich Locke 15 Jan '13

15 Jan '13

Dear gentleman/madam, as you may be aware i am having hard times trying to get qmail+ldap working on my OpenBSD 5.2 amd64. While after installation OLDAP works 100% (I am using BDB as backend). When i start qmail, every query sent by qmail to the OLDAP server increases memory up to a point OLDAP needs to be restarted. I emailed misc(a)openbsd.org. I got responses. Here i pass them to the OLDAP developer: After some advice from Mr. Quanah, i gave up BDB and would like to give MDB a try. Here is what i got from the misc(a)openbsd.org I believe the OLDAP developer should know: ---------- Forwarded message ---------- From: Stuart Henderson <stu(a)spacehopper.org> Date: Mon, Jan 14, 2013 at 8:47 PM Subject: Re: adding support to mdb To: Friedrich Locke <friedrich.locke(a)gmail.com> Cc: ports(a)openbsd.org On 2013/01/14 19:18, Friedrich Locke wrote: > Hi folks, > > this is my first message to this list. I am writing because i am in need to > use openldap from ports. > Initially i tried openldap with support to BDB, but it is buggy. > I was suggest to try mdb, but openldap's Makefile have the --disable-mdb > instruction. > > Since i do need to get a directory service and have no knownledge on > openldap internals, i come to you > in order to suggest how could i help in order to get mdb supported by > OpenBSD Ports OpenLDAP. > > Thank you a lot for your time and cooperation. > > Best regards, > > Fried. So this is a memory-mapped database; there have been problems with these in the past (e.g. in Cyrus imapd and Dovecot) but I am not sure of all the details. The port diff is easy enough but I would really like some advice from someone who is knowledgeable about the mmap issues as to whether or not it's safe to use this on OpenBSD. A bit more info from slides at http://www.openldap.org/pub/hyc/mdm-slides.pdf :- -- -- -- -- -- * Uses a read-only memory map * Protects the database structure from corruption due to stray writes in memory * Any attempts to write to the map will cause a SEGV, allowing immediate identification of software bugs * There's no point in making the pages writable anyway, since only existing pages may be written. Growing the database requires file ops (write, ftruncate) so for uniformity, file ops are also used for updates. -- -- -- -- -- I *think* the problems were only with mmap writes, if this is correct then they seem to be sidestepping the problems by doing this. BTW I'm using OpenLDAP 2.4 with BDB here and haven't noticed issues however it is not under extreme load..

2 1

Fwd: adding support to mdb
by Friedrich Locke 15 Jan '13

15 Jan '13

This one too. []s ---------- Forwarded message ---------- From: Stuart Henderson <stu(a)spacehopper.org> Date: Tue, Jan 15, 2013 at 6:41 AM Subject: Re: adding support to mdb To: Friedrich Locke <friedrich.locke(a)gmail.com> On 2013/01/14 21:31, Friedrich Locke wrote: > Hi! > > people from openldap group have already migrated to mdb. > Why OpenBSD has such problems. On other OSes, things work nicely. > BTW, no offense, i do like obsd, but things like make me upset. I suspect that the MDB code probably requires something from the OS that OpenBSD doesn't have (coherent buffer and page caches - http://utcc.utoronto.ca/~cks/space/blog/unix/UnifiedCacheMmap) If I'm correct then it will appear to work, but with a risk of database corruption. For this reason I won't enable this in the OpenLDAP port unless someone who knows the area well is satisfied that it's safe. Some other database code which likes to use mmap (e.g. cyrus skiplist) takes into account the various types of cache behaviour and has options to avoid using mmap. It doesn't appear that MDB has this yet.

1 0

Re: slapd crashes with ch_realloc of X bytes failed
by Meike Stone 15 Jan '13

15 Jan '13

>> >>> From slapd.conf/cn=config: >>> a) cachesize setting >>> b) idlcachesize setting >>> c) dncachesize setting >> >> >> cachesize 750000 >> dncachesize 750000 >> idlcachesize 2250000 >> >> Thanks and best regards > > > Your settings here don't make a lot of sense. > > I would try > cachesize 1500000 > dncachesize 0 (or leave it unset) > idlcachesize 3000000 > Yes, I know this values are very low in my configuration, but if I have problems with the memory, should I increase the caches that use this memory? In the last thread , you confirmed, that if I increasing the DB cachesize, the system is faster running out of memory. http://www.openldap.org/lists/openldap-technical/201211/msg00171.html ("ch_realloc means the system ran out of memory. Increasing the DB_CONFIG cachesize will run you out of memory more quickly.") To get the slapd a little bit more stable, I reduced this values (caches) to the posted in last message. Before i had: cachesize 1000000 dncachesize 1000000 idlcachesize 3000000 > Your current idlcachesize in particular may be part of the issue in addition > to your glibc setting. But the problem exist on the test system with tcmalloc too. So are 24GByte RAM for 1.500.000 DNs and 6GByte DB are not enough? During all time (especially the crash), there was enough physical (unallocated) memory free. But "slapd/malloc" tried to allocate more and more (as you can see in the post from 2013/01/12), but did not use it, no matter if glibc or tcmalloc I hope I interpreted it right?! Thanks Meike Btw.: I use a "special version" of openldap. Because of limited index slot of 65535, I changed in openldap-2.4.33.orig/include/ldap_pvt_thread.h from # define LDAP_PVT_THREAD_STACK_SIZE ( 1 * 1024 * 1024 * sizeof(void *) ) to # define LDAP_PVT_THREAD_STACK_SIZE ( 2 * 1024 * 1024 * sizeof(void *) ) and in openldap-2.4.33/servers/slapd/back-bdb/idl.h from #define BDB_IDL_LOGN 16 /* DB_SIZE is 2^16, UM_SIZE is 2^17 */ to #define BDB_IDL_LOGN 17 /* DB_SIZE is 2^17, UM_SIZE is 2^18 */ as Howard it recommended http://www.openldap.org/lists/openldap-technical/201101/msg00095.html Maybe this could be the problem?? My changes are available under: https://build.opensuse.org/package/show?expand=0&package=openldap2&project=…

2 1

Using smbtools an create account
by rodrigo tavares 15 Jan '13

15 Jan '13

Hello People. I have a samba server and LDAP, it´s running, but i put the slap replicate, come this error: root@replica:/etc/smbldap-tools# smbldap-useradd -a ola Error: shadow context; no update referral at /usr/share/perl5/smbldap_tools.pm line 1187. If I remove config slap replicate is run. syncrepl rid=123 provider=ldap://10.65.11.250:389 type=refreshOnly interval=00:00:05:00 retry="60 30 300 +" searchbase="dc=net,dc=mg,dc=gov,dc=br" filter="(objectClass=*)" scope=sub attrs="*,+" schemachecking=off bindmethod=simple binddn="cn=admin,dc=net,dc=mg,dc=gov,dc=br" credentials=secret Any idea ? Rodrigo Faria

2 4

Re: kernel: slapd[7962]: segfault
by Quanah Gibson-Mount 15 Jan '13

15 Jan '13

--On Tuesday, January 15, 2013 11:43 AM +0530 Pawan Kamboj <pawank.kamboj(a)gmail.com> wrote: > > Is there any fixes for time being? > Keep replies to the list. You need to understand you're running a piece of software that is several years old, for which support ended a few years ago. Even then 2.3.43 was the last release of the 2.3 series. So you are running an ancient version of OpenLDAP with numerous known problems. Any help is going to require you to upgrade to a supported release. If you want to pay for help, you could try Symas perhaps: <http://www.symas.com> --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

kernel: slapd[7962]: segfault
by Pawan Kamboj 15 Jan '13

15 Jan '13

Hi Team, SLAPD is crashing with the throwing following error. ldap1p kernel: slapd[7962]: segfault at 0000000000000008 rip 000000000044cef0 rsp 000000004169c528 error 4 We are using the following version of openldap and bdb. Openldap 2.3.32 DB.4.5 Any help? Regards Pawan Kamboj

2 1

Re: pthread lock failed: Resource deadlock avoided
by Chandrashekar Kola 15 Jan '13

15 Jan '13

Linux version: Linux version 2.6.18-194.el5 *Regards,* *Chandrashekar kola,* *408-666-2814* On Mon, Jan 14, 2013 at 7:37 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Monday, January 14, 2013 7:13 PM -0800 Chandrashekar Kola < > chandrashekar.kola(a)gmail.com> wrote: > > >> What version of BDB is OpenLDAP compiled against? >>> >> BDB version is 4.3.29 >> > > BDB 4.3 has been known to be buggy for years. You should use something > recent. > > > What version of OpenLDAP 2.4? >>> >> OpenLDAP 2.4.22 >> > > Use a real version of OpenLDAP > > What OS? >> > > You still didn't answer this. > > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

Re: pthread lock failed: Resource deadlock avoided
by Chandrashekar Kola 15 Jan '13

15 Jan '13

Hi Quanah, Thank you for quick reply. Here are the details. > Have you checked your lock/lockers/lock object settings? 112 Last allocated locker ID 0x7fffffff Current maximum unused locker ID 9 Number of lock modes 1500 Maximum number of locks possible 1500 Maximum number of lockers possible 1500 Maximum number of lock objects possible 40 Number of lock object partitions 8 Number of current locks 445 Maximum number of locks at any one time 12 Maximum number of locks in any one bucket 0 Maximum number of locks stolen by for an empty partition 0 Maximum number of locks stolen for any one partition 90 Number of current lockers 115 Maximum number of lockers at any one time 8 Number of current lock objects 226 Maximum number of lock objects at any one time 3 Maximum number of lock objects in any one bucket 0 Maximum number of objects stolen by for an empty partition 0 Maximum number of objects stolen for any one partition 10M Total number of locks requested (10526725) 10M Total number of locks released (10518219) 0 Total number of locks upgraded 18 Total number of locks downgraded 8766 Lock requests not available due to conflicts, for which we waited 7739 Lock requests not available due to conflicts, for which we did not wait 759 Number of deadlocks 0 Lock timeout value 0 Number of locks that have timed out 0 Transaction timeout value 0 Number of transactions that have timed out 1MB 224KB The size of the lock region 3663 The number of partition locks that required waiting (0%) 243 The maximum number of times any partition lock was waited for (0%) 0 The number of object queue operations that required waiting (0%) 675 The number of locker allocations that required waiting (0%) 0 The number of region locks that required waiting (0%) 3 Maximum hash bucket length > What version of BDB is OpenLDAP compiled against? BDB version is 4.3.29 > What version of OpenLDAP 2.4? OpenLDAP 2.4.22 What OS? *Regards,* *Chandrashekar kola,* *408-666-2814* On Mon, Jan 14, 2013 at 5:50 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Monday, January 14, 2013 5:08 PM -0800 Chandrashekar Kola < > chandrashekar.kola(a)gmail.com> wrote: > > Hello, >> >> We have a openldap running on version 2.4, recently we started seeing >> these kind of error messages in ldap.log. >> > > Have you checked your lock/lockers/lock object settings? > > What version of BDB is OpenLDAP compiled against? > > What version of OpenLDAP 2.4? > > What OS? > > --Quanah > > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

pthread lock failed: Resource deadlock avoided
by Chandrashekar Kola 15 Jan '13

15 Jan '13

Hello, We have a openldap running on version 2.4, recently we started seeing these kind of error messages in ldap.log. Jan 14 04:03:03 ldap-cl-node02-vm slapd2.4[32455]: bdb(o=foo): pthread lock failed: Resource deadlock avoided Jan 14 04:03:03 ldap-cl-node02-vm slapd2.4[32455]: bdb(o=foo): PANIC: Resource deadlock avoided Jan 14 04:03:03 ldap-cl-node02-vm slapd2.4[32455]: => bdb_idl_insert_key: c_put id failed: DB_RUNRECOVERY: Fatal error, run database recovery (-30974) Jan 14 04:03:03 ldap-cl-node02-vm slapd2.4[32455]: bdb(o=foo): PANIC: fatal region error detected; run recovery Jan 14 04:03:03 ldap-cl-node02-vm slapd2.4[32455]: conn=23402078 op=6: attribute "entryCSN" index add failure This happened today morning and after restarting, it's started working fine for few hours. And then we saw these error messages in the logs, and crashed again. Jan 14 13:35:15 ldap-cl-node02-vm slapd2.4[1397]: bdb(o=foo): PANIC: Invalid argument Jan 14 13:35:15 ldap-cl-node02-vm slapd2.4[1397]: => bdb_idl_insert_key: c_put id failed: DB_RUNRECOVERY: Fatal error, run database recovery (-30974) Jan 14 13:35:15 ldap-cl-node02-vm slapd2.4[1397]: bdb(o=foo): PANIC: fatal region error detected; run recovery Did anybody face this issue, and what will be the resolution. Please help me. *Regards,* chandu

2 1

pthread lock failed: Resource deadlock avoided
by Chandrashekar Kola 15 Jan '13

15 Jan '13

Hello, We have a openldap running on version 2.4, recently we started seeing these kind of error messages in ldap.log. Jan 14 04:03:03 ldap-cl-node02-vm slapd2.4[32455]: bdb(o=foo): pthread lock failed: Resource deadlock avoided Jan 14 04:03:03 ldap-cl-node02-vm slapd2.4[32455]: bdb(o=foo): PANIC: Resource deadlock avoided Jan 14 04:03:03 ldap-cl-node02-vm slapd2.4[32455]: => bdb_idl_insert_key: c_put id failed: DB_RUNRECOVERY: Fatal error, run database recovery (-30974) Jan 14 04:03:03 ldap-cl-node02-vm slapd2.4[32455]: bdb(o=foo): PANIC: fatal region error detected; run recovery Jan 14 04:03:03 ldap-cl-node02-vm slapd2.4[32455]: conn=23402078 op=6: attribute "entryCSN" index add failure This happened today morning and after restarting, it's started working fine for few hours. And then we saw these error messages in the logs, and crashed again. Jan 14 13:35:15 ldap-cl-node02-vm slapd2.4[1397]: bdb(o=foo): PANIC: Invalid argument Jan 14 13:35:15 ldap-cl-node02-vm slapd2.4[1397]: => bdb_idl_insert_key: c_put id failed: DB_RUNRECOVERY: Fatal error, run database recovery (-30974) Jan 14 13:35:15 ldap-cl-node02-vm slapd2.4[1397]: bdb(o=foo): PANIC: fatal region error detected; run recovery Did anybody face this issue, and what will be the resolution. Please help me. *Regards,* *Chandrashekar kola,* *408-666-2814*

1 0

Re: slapd crashes with ch_realloc of X bytes failed
by Meike Stone 14 Jan '13

14 Jan '13

2013/1/14 Quanah Gibson-Mount <quanah(a)zimbra.com>: > > > Sorry, I don't have your configuration memorized. Generally, you should > list: Oops sorry, I used my gmail account and did not see, that the thread in the mailing list is "broken".. Here are all posted informations from my production system http://www.openldap.org/lists/openldap-technical/201211/msg00164.html > > memory allocator (should be tcmalloc, if you've set that up correctly) In the test system yes (us see it in the pmaps), but on production, I use glibc. > > DB Information: > a) Total number of DNs in your database about 1.500.000 > b) DB_CONFIG settings set_cachesize 2 0 1 set_lg_regionmax 262144 set_lg_bsize 2097152 set_flags DB_LOG_AUTOREMOVE > c) Size of database on disk: du -c -h *.bdb 27M MyActivateTime.bdb 8.0K MyClassName.bdb 30M MyDeletedTime.bdb 14M MyInsertDate.bdb 92K MyJpeg.bdb 1.9M MyKey.bdb 2.2M MyLanguage.bdb 184K MyPhoneNumber.bdb 38M MyPk.bdb 14M MyPId.bdb 5.4M MyPIfId.bdb 9.4M MyProductTyp.bdb 140K MyProperty.bdb 2.5M MySystemFlag.bdb 22M MyUserName.bdb 184K MyVId.bdb 428M cn.bdb 728M dn2id.bdb 37M entryCSN.bdb 39M entryUUID.bdb 4.0G id2entry.bdb 6.2M objectClass.bdb 5.4G total > From slapd.conf/cn=config: > a) cachesize setting > b) idlcachesize setting > c) dncachesize setting cachesize 750000 dncachesize 750000 idlcachesize 2250000 Thanks and best regards Meike

2 1

Re: Replication not working
by Quanah Gibson-Mount 14 Jan '13

14 Jan '13

--On Sunday, January 13, 2013 1:37 AM +0530 anil beniwal <beni.anil(a)gmail.com> wrote: > > Hi Quanah > > I will be highly thankful to you, if you can help me out in below issue. > > We have three servers on rhel 6.3, 16 vcpu and 32G RAM , openldap 2.4.33 > with mdb db of 200G a) Keep messages to the list b) Use delta-syncrepl for MMR c) Grab the latest RE24 code --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: Memory usage with bdb
by Friedrich Locke 14 Jan '13

14 Jan '13

Quanah, i would like to have ti fully functional on OpenBSD 5.2. I have no coding skill nor understand technically how ldap works. How may we get in touch with OpenLDAP developer to let them know about this problem ? Since you are baffled. Probably, the OpenLDAP should be aware about this problem. []s On Mon, Jan 14, 2013 at 4:33 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Monday, January 14, 2013 3:45 PM -0200 Friedrich Locke < > friedrich.locke(a)gmail.com> wrote: > > Sorry. >> >> Here you have it: >> > > If further information is necessary, let me know! >> > > Thanks. I have to say I'm pretty baffled. I've never used OpenLDAP under > BSD, but I wonder if there are issues with how BDB itself is built. For > Linux, there are particular flags you want to set to get it to work well. > > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

Re: Memory usage with bdb
by Friedrich Locke 14 Jan '13

14 Jan '13

Sorry. Here you have it: On Mon, Jan 14, 2013 at 3:30 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Monday, January 14, 2013 2:00 PM -0200 Friedrich Locke < > friedrich.locke(a)gmail.com> wrote: > > Some time ago, i send a message about slapd "eating" all my memory >> resource. >> >> Mr. Quanah asked me to provide more details. Here you have it: >> sioux@gustav$ uname -a >> OpenBSD gustav.cpd.ufv.br 5.2 GENERIC.MP#368 amd64 >> sioux@gustav$ >> >> sioux@gustav$ pkg_info | grep openldap >> openldap-client-2.4.31 Open source LDAP software (client) >> openldap-server-2.4.31p0 Open source LDAP software (server) >> sioux@gustav$ pkg_info | grep db >> cyrus-sasl-2.1.25p3-db4 RFC 2222 SASL (Simple Authentication and Security >> Layer) >> db-4.6.21v0 Berkeley DB package, revision 4 >> dbus-1.6.2p0v0 message bus system >> gdbm-1.8.3p0 GNU dbm >> iodbc-3.52.7 ODBC 3.x driver manager >> sioux@gustav$ >> > > You are still extremely vague in your details. > > How large is your DB on disk? (du -c -h *.bdb) > gustav# pwd /var/openldap-data gustav# du -c -h *.bdb 32.0K cn.bdb 32.0K dn2id.bdb 64.0K id2entry.bdb 32.0K mail.bdb 32.0K mailAlternateAddress.bdb 32.0K mailHost.bdb 32.0K objectClass.bdb 32.0K uid.bdb 288K total > What are your BDB settings in your DB_CONFIG file? > gustav# cat /var/openldap-data/DB_CONFIG # $OpenLDAP$ # Example DB_CONFIG file for use with slapd(8) BDB/HDB databases. # # See the Oracle Berkeley DB documentation # < http://www.oracle.com/technology/documentation/berkeley-db/db/ref/env/db_co… > # for detail description of DB_CONFIG syntax and semantics. # # Hints can also be found in the OpenLDAP Software FAQ # <http://www.openldap.org/faq/index.cgi?file=2> # in particular: # <http://www.openldap.org/faq/index.cgi?file=1075> # Note: most DB_CONFIG settings will take effect only upon rebuilding # the DB environment. # one 0.25 GB cache #set_cachesize 0 268435456 1 set_cachesize 0 16777216 1 # Data Directory #set_data_dir db # Transaction Log settings set_lg_regionmax 262144 set_lg_bsize 2097152 #set_lg_dir logs # Note: special DB_CONFIG flags are no longer needed for "quick" # slapadd(8) or slapindex(8) access (see their -q option). > What how many DNs are there in your database? > gustav# ldapsearch -D cn=oldap,dc=ufv,dc=br -W | grep dn: Enter LDAP Password: dn: dc=ufv,dc=br dn: ou=group,dc=ufv,dc=br dn: cn=its,ou=group,dc=ufv,dc=br dn: cn=asd,ou=group,dc=ufv,dc=br dn: cn=dba,ou=group,dc=ufv,dc=br dn: cn=wbx,ou=group,dc=ufv,dc=br dn: cn=alg,ou=group,dc=ufv,dc=br dn: cn=djb,ou=group,dc=ufv,dc=br dn: cn=nofiles,ou=group,dc=ufv,dc=br dn: cn=qmail,ou=group,dc=ufv,dc=br dn: cn=ftp,ou=group,dc=ufv,dc=br dn: cn=src,ou=group,dc=ufv,dc=br dn: cn=vmail,ou=group,dc=ufv,dc=br dn: cn=ord,ou=group,dc=ufv,dc=br dn: cn=adc,ou=group,dc=ufv,dc=br dn: cn=bod,ou=group,dc=ufv,dc=br dn: cn=frn,ou=group,dc=ufv,dc=br dn: ou=people,dc=ufv,dc=br dn: uid=sioux,ou=people,dc=ufv,dc=br dn: uid=mysql,ou=people,dc=ufv,dc=br dn: uid=oldap,ou=people,dc=ufv,dc=br dn: uid=dnscache,ou=people,dc=ufv,dc=br dn: uid=dnslog,ou=people,dc=ufv,dc=br dn: uid=tinydns,ou=people,dc=ufv,dc=br dn: uid=ftp,ou=people,dc=ufv,dc=br dn: uid=alias,ou=people,dc=ufv,dc=br dn: uid=qmaild,ou=people,dc=ufv,dc=br dn: uid=qmaill,ou=people,dc=ufv,dc=br dn: uid=qmailp,ou=people,dc=ufv,dc=br dn: uid=qmailq,ou=people,dc=ufv,dc=br dn: uid=qmailr,ou=people,dc=ufv,dc=br dn: uid=qmails,ou=people,dc=ufv,dc=br dn: uid=cvs,ou=people,dc=ufv,dc=br dn: uid=tftp,ou=people,dc=ufv,dc=br dn: uid=vmail,ou=people,dc=ufv,dc=br dn: uid=grios,ou=people,dc=ufv,dc=br dn: uid=vlobo,ou=people,dc=ufv,dc=br dn: ou=appsrv,dc=ufv,dc=br dn: cn=ypldap,ou=appsrv,dc=ufv,dc=br dn: cn=webprv,ou=appsrv,dc=ufv,dc=br dn: cn=mail,ou=appsrv,dc=ufv,dc=br gustav# Total: 41 > What is your total amount of RAM? > > Memory: 2GB > May be a few useful bits of information to have. > > If further information is necessary, let me know! > > --Quanah > > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

memory leak
by Friedrich Locke 14 Jan '13

14 Jan '13

Hi! Is anybody aware of memory leaks in OpenLDAP 2.4.31 ? My server is consuming memory. I have only around 16 users on my oldap implementation. Every search performed increase memory consumption. Any ideia ?

2 1

OpenLDAP SSL
by Andy Carlson 14 Jan '13

14 Jan '13

I am running an OpenLDAP server and I am attempting to get it set up with SSL. The service config appears to already be configured with port 636. I have added the Cert, CACert, and Key into the cn=config context using the three corresponding attributes. When I attempt to restart the slapd service it will not start up. I have done this on three other servers whose configuration is exactly the same and it worked perfectly. Any thoughts? Thanks much!!!, Andy Carlson Moody Bible Institute Identity Administrator | Information Systems 312-329-4385 www.moody.edu<http://www.moody.edu>

3 2

Re: Memory usage with bdb
by Friedrich Locke 14 Jan '13

14 Jan '13

Some time ago, i send a message about slapd "eating" all my memory resource. Mr. Quanah asked me to provide more details. Here you have it: sioux@gustav$ uname -a OpenBSD gustav.cpd.ufv.br 5.2 GENERIC.MP#368 amd64 sioux@gustav$ sioux@gustav$ pkg_info | grep openldap openldap-client-2.4.31 Open source LDAP software (client) openldap-server-2.4.31p0 Open source LDAP software (server) sioux@gustav$ pkg_info | grep db cyrus-sasl-2.1.25p3-db4 RFC 2222 SASL (Simple Authentication and Security Layer) db-4.6.21v0 Berkeley DB package, revision 4 dbus-1.6.2p0v0 message bus system gdbm-1.8.3p0 GNU dbm iodbc-3.52.7 ODBC 3.x driver manager sioux@gustav$ So: Why is this happening ? On Thu, Nov 1, 2012 at 3:02 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Thursday, November 01, 2012 2:24 PM -0200 Friedrich Locke < > friedrich.locke(a)gmail.com> wrote: > > Is anyone aware of any buggy in openldap+bdb related to memory usage? >> Have anyone here using this type of backend ? Any problem to report? >> > > No. Yes. No. > > I would suggest you provide some more detailed information as to what, if > any, problem you feel you are experiencing. This email is quite vague. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

openbsd+ldap+qmail: a nightmare
by Friedrich Locke 14 Jan '13

14 Jan '13

Hi folks, i have been walking around and now i need to get qmail+ldap+openbsd working. I could configure everything, as usual openbsd runs rock solid. But i believe openldap does not like openbsd somehow. That's what i want to figure it out. The point is: i have just setted up obsd+oldap+qmail. I am trying to send a message for the only user i have in the tree: somehow, i don't know why is "eating" all my system memory. I am really curious why it happens on OBSD. I am running amd64 5.2, but i remenber to have given up some time ago when the obsd version was not 5.2. When i issue ldapsearch not memory increase is realized. The problem remains even with the 5.2 version. Some information is provided below : sioux@gustav$ uname -a OpenBSD gustav.cpd.ufv.br 5.2 GENERIC.MP#368 amd64 sioux@gustav$ pkg_info | grep openldap openldap-client-2.4.31 Open source LDAP software (client) openldap-server-2.4.31p0 Open source LDAP software (server) sioux@gustav$ For the /etc/openldap/slapd.conf, here you have it: # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/qmail.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Load dynamic backend modules: # modulepath /usr/local/libexec/openldap # moduleload back_bdb.la # moduleload back_hdb.la # moduleload back_ldap.la # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # BDB database definitions ####################################################################### database bdb #suffix "dc=my-domain,dc=com" suffix "dc=ufv,dc=br" #rootdn "cn=Manager,dc=my-domain,dc=com" rootdn "cn=oldap,dc=ufv,dc=br" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. #rootpw secret rootpw {SSHA}HBjSmSCbiE8J26EuDg3ULnSj2SmN1x5g # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/openldap-data # Indices to maintain index cn eq index objectClass eq index mail,mailalternateaddress,uid eq,sub index accountstatus,mailhost,deliverymode eq index default eq cachesize 4096 checkpoint 128 15 dbnosync dirtyread sasl-host gustav.cpd.ufv.br sasl-realm UFV.BR sasl-regexp uid=([^,]+),cn=UFV.BR,cn=gssapi,cn=auth uid=$1,ou=people,dc=ufv,dc=br limits dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" time=2048 size=16384 limits dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" time=2048 size=16384 limits dn.onelevel="ou=people,dc=ufv,dc=br" time=4 size=16384 ################################################################################ # access definition on ou=appsrv,dc=ufv,dc=br ################################################################################ access to dn.one="ou=appsrv,dc=ufv,dc=br" attrs=userPassword by self read by anonymous auth # by * none access to dn.one="ou=appsrv,dc=ufv,dc=br" by dn.one="ou=appsrv,dc=ufv,dc=br" read access to dn.base="ou=appsrv,dc=ufv,dc=br" attrs=entry by dn.one="ou=appsrv,dc=ufv,dc=br" read ################################################################################ # access definition on ou=group,dc=ufv,dc=br ################################################################################ access to dn.one="ou=group,dc=ufv,dc=br" by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read by dn.one="ou=people,dc=ufv,dc=br" read access to dn.base="ou=group,dc=ufv,dc=br" attrs=entry by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read by dn.one="ou=people,dc=ufv,dc=br" read ################################################################################ # access definition on ou=people,dc=ufv,dc=br ################################################################################ access to dn.one="ou=people,dc=ufv,dc=br" attrs=userPassword by self read by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read by anonymous auth by * none access to dn.one="ou=people,dc=ufv,dc=br" attrs=uid,homeDirectory by self read by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read access to dn.one="ou=people,dc=ufv,dc=br" attrs=cn,uidNumber,gidNumber,loginShell,gecos,description by self read by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read access to dn.one="ou=people,dc=ufv,dc=br" attrs=mail,mailMessageStore,mailAlternateAddress,qmailUID,qmailGID,mailHost,mailForwardingAddress,deliveryProgramPath,qmailDotMode,deliveryMode,mailReplyText,accountStatus,qmailAccountPurge,mailQuotaSize,mailQuotaCount,mailSizeMax by self read by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read access to dn.one="ou=people,dc=ufv,dc=br" by self read by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read access to dn.base="ou=people,dc=ufv,dc=br" attrs=entry by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read ################################################################################ # access definition for the root (ufv.br) ################################################################################ access to dn.base="dc=ufv,dc=br" attrs=entry by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read ####################################################################### # Monitor database definitions ####################################################################### database monitor access to dn.subtree="cn=monitor" by dn.base="cn=oldap,dc=ufv,dc=br" read # by * none

1 0

authentication problems
by Friedrich Locke 12 Jan '13

12 Jan '13

Dear list member, i am trying to retrieve data from a openldap server. When i issue ldapsearch from local machine itself, every thing works ok, but when i try from a remote host, i got problems related to GSSAPI authentication. Here you have: sioux@gustav$ ldapsearch -D cn=ypldap,ou=appsrv,dc=ufv,dc=br -b uid=vlobo,ou=people,dc=ufv,dc=br -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <uid=vlobo,ou=people,dc=ufv,dc=br> with scope subtree # filter: (objectclass=*) # requesting: ALL # # vlobo, people, ufv.br dn: uid=vlobo,ou=people,dc=ufv,dc=br uid: vlobo objectClass: organizationalRole objectClass: posixAccount objectClass: qmailUser cn: Valter Lobo uidNumber: 2001 gidNumber: 2000 homeDirectory: /home/vlobo loginShell: /bin/sh gecos: Valter Lobo,,, # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 sioux@gustav$ ############################################################################ But when i try from a remote host (the same command line with -h option, of course): sioux@lion$ ldapsearch -D cn=ypldap,ou=appsrv,dc=ufv,dc=br -b ou=people,dc=ufv,dc=br -h gustav.cpd.ufv.br -W Enter LDAP Password: SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Local error (-2) additional info: SASL(-1): generic failure: GSSAPI Error: Miscellaneous failure (see text) (open(/tmp/krb5cc_1000): No such file or directory) sioux@lion$ What is it my mistaken ? Thanks in advance.

2 1

cluster
by Friedrich Locke 12 Jan '13

12 Jan '13

Hi! I am aware that openldap supports custering, but i have some doubts. Is this cluster based on a single write server/multiple read server ? Or i may have multiple read/write server ? Does an openldap cluster scales unlimited ? I mean: if I need more space or processing power, it is just to add a new server . I would like to use a configuration like: The space requirement would be spread over the number of servers; A client can connect to any node of the cluster for read/write operation; To increase space/processing power, just add a new node. Is that possible with openldap ? PS: keep in mind that there is a huge difference in allowing multiple write/read over a set of nodes that keep is own copy of the data and a set of nodes whose data is spread accross them all.

2 1

Re: ldap update ( 2.2 to 2.4)
by Dan White 11 Jan '13

11 Jan '13

>On Thu, Jan 10, 2013 at 12:34 PM, Dan White <dwhite(a)olp.net> wrote: > >> On 01/10/13 12:04 -0200, Bruno Furtado wrote: >> >>> Hi Folks! >>> >>> I'm newbie to LDAP and I received a mission to update the version. >>> >>> Today is running Openldap 2.2.23 and I need to update to OpenLDAP 2.4.28. >>> all update attempts failed. I observed that the new version have a >>> different method of configuration. >>> >>> What the best way to do this? >>> >> >> What error messages did you receive? >> >> You can use slaptest (with both -f and -F options) to convert your >> configuration to the newer configuration database format (see man >> slapd-config), although you can still use a slapd.conf based configuration. >> >> See chapters 10, 19, and appendix B of the OpenLDAP Administrator's Guide, >> and the man pages for slapcat/slapdd. You should dump the contents of your >> databases on the old system with slapcat, and slapadd them on the new >> installation. On 01/11/13 17:29 -0200, Bruno Furtado wrote: >Hi Dan, > >I tried both settings. > >This is the error message: > > 50f066f8 str2entry: invalid value for attributeType objectClass #1 >(syntax 1.3.6.1.4.1.1466.115.121.1.38) This error means that you have a value within your input, for an objectClass, which is invalid per rfc2252 and is not accepted by the newer version of slapd that you are using. Try to found out which entry in your input is causing the error. -- Dan White

1 0

Openldap Server Issue - ver-2.4.23 (Jun 22 2012 14:02:53)
by Arvind Navale 11 Jan '13

11 Jan '13

Hi There, Need help with resolving an configuration issue I am having with openldap server (OpenLDAP: slapd 2.4.23 (Jun 22 2012 14:02:53) ) running a CentOS-6.3 1. Have a openldap server setup with TLS running on CentOS-6.3 rpm -qa | grep ldap openldap-devel-2.4.23-26.el6.x86_64 python-ldap-2.3.10-1.el6.x86_64 apr-util-ldap-1.3.9-3.el6_0.1.x86_64 openldap-servers-2.4.23-26.el6.x86_64 openldap-2.4.23-26.el6.x86_64 openldap-clients-2.4.23-26.el6.x86_64 pam_ldap-185-11.el6.x86_64 ldapjdk-4.18-6.el6.x86_64 3. Have generated self signed server certificates using openssl command. openssl req -x509 -nodes -days 3650 -newkey rsa:1048 -keyout /etc/openldap/certs/server-key.pem -out /etc/openldap/certs/server-cert.pem 3. Have a CentOS-6.3 setup a openldap client and enable TLS. rpm -qa | grep ldap openldap-2.4.23-26.el6.x86_64 python-ldap-2.3.10-1.el6.x86_64 openldap-clients-2.4.23-26.el6.x86_64 apr-util-ldap-1.3.9-3.el6_0.1.x86_64 pam_ldap-185-11.el6.x86_64 4. When I try to login on a LDAP client, I am seeing following debugging messages in LDAP server side, >>> slap_listener(ldaps://:389/) daemon: listen=7, new connection on 14 daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL daemon: added 14r (active) listener=(nil) conn=1000 fd=14 ACCEPT from IP=xxx.xxx.xxx.xxxx:55585 (IP=0.0.0.0:389) daemon: activity on 2 descriptors daemon: activity on: 14r daemon: read active on 14 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(14) connection_get(14): got connid=1000 connection_read(14): checking for input on id=1000 TLS: file server-cert.pem does not end in [.0] - does not appear to be a CA certificate directory file with a properly hashed file name - skipping. TLS: file server-key.pem does not end in [.0] - does not appear to be a CA certificate directory file with a properly hashed file name - skipping. TLS: error: no server certificate: must specify a certificate for the server to use TLS: error: could not initialize moznss security context - error -5939:No more entries in the directory TLS: can't create ssl handle. connection_read(14): TLS accept failure error=-1 id=1000, closing connection_closing: readying conn=1000 sd=14 for close connection_close: conn=1000 sd=14 5. I generate the hash in the directory were the certs are and then try connecting again, see different slapd debugging messages conn=1001 fd=14 ACCEPT from IP=10.90.180.220:55586 (IP=0.0.0.0:389) daemon: activity on 1 descriptor daemon: activity on: 14r daemon: read active on 14 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: epoll: listen=9 active_threads=0 tvp=NULL daemon: epoll: listen=10 active_threads=0 tvp=NULL connection_get(14) connection_get(14): got connid=1001 connection_read(14): checking for input on id=1001 TLS: error: could not initialize moznss security context - error -5925:The one-time function was previously called and failed. Its error code is no longer available TLS: can't create ssl handle. connection_read(14): TLS accept failure error=-1 id=1001, closing connection_closing: readying conn=1001 sd=14 for close connection_close: conn=1001 sd=14 daemon: removing 14 daemon: activity on 1 descriptor daemon: activity on: conn=1001 fd=14 closed (TLS negotiation failure) Is there any bug with the version of openldap I am using? Appreciate any and every help from any of the group member to resolve the issue. Thank you, anlinux.

2 1

setting rootpw for cn=monitor
by Chris Card 11 Jan '13

11 Jan '13

Hi all, I'm seeing an issue with setting the rootpw for the cn=monitor database and syncrepl replication (multi-master syncrepl). I am seeing this problem with openldap 2.4.31 at the moment, but I intend to upgrade to 2.4.34 when that becomes available. When I just have one LDAP server (ldap1 say), I can set the olcrootdn to cn=monitor and set the olcrootpw without any error, so I have something like: dn: olcDatabase={2}monitor,cn=config objectClass: olcDatabaseConfig olcDatabase: {2}monitor olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcSyncUseSubentry: FALSE olcMonitoring: FALSE olcRootPW: {SSHA}************** olcRootDN: cn=monitor When I create another LDAP server (ldap2 say) and set up multi-master syncrepl replication for cn=config between ldap1 and ldap2 I see an error in the slapd log on ldap2 like: olcRootPW: value #0: <olcRootPW> can only be set when rootdn is under suffix No olcSuffix is set for the cn=monitor database in the cn=config, but all the cn=monitor DNs are of the form cn=X,cn=Y,...,cn=monitor, so it seems that the suffix of the cn=monitor database is effectively cn=monitor. Any ideas? Chris

4 6

installing a new cacert - the transition
by Adam Wolfe 10 Jan '13

10 Jan '13

Greetings all. I am looking at having to install a new ca cert on our ldap server(s) and thus swapping out the client certs as well. This totals roughly 250 different machines. I am wondering as to the easiest way to go about this. Is there some grace period that can be set to allow me to relax and get to all the clients over a week's time? Or possibly the ability to use two certs? Then just slowly remove the old ones from the clients?

2 1

ldap update ( 2.2 to 2.4)
by Bruno Furtado 10 Jan '13

10 Jan '13

Hi Folks! I'm newbie to LDAP and I received a mission to update the version. Today is running Openldap 2.2.23 and I need to update to OpenLDAP 2.4.28. all update attempts failed. I observed that the new version have a different method of configuration. What the best way to do this? Best regards, -- Bruno Furtado

2 1

How to change a schema attribute definition or how to change the slapd configuration?
by Philip Colmer 10 Jan '13

10 Jan '13

I'm using OpenLDAP on Ubuntu 12.04. The installation of OpenLDAP automatically installs the schemas for core, cosine, nis and inetorgperson. In the nis schema, posixGroup is defined as structural but I need it to be auxiliary. Is it possible to change that definition? My database is completely empty - I've literally uninstalled OpenLDAP and then reinstalled it in an attempt to try and find a clean way of solving my problem. Alternatively - and perhaps better since I'm a bit worried about changing *just* that one thing - is it possible for me to export the slapd configuration in a way that I can then edit the configuration to replace nis with rfc2037bis and create everything afresh? Unfortunately, because the installation on Ubuntu does all of the slapd configuration automatically, I don't know what parameters are being specified. Many thanks for any help or suggestions provided. Philip

3 5

Re: LDAP - not starting
by Oshadha Gunawardena 10 Jan '13

10 Jan '13

Well I don't think so When I issue * netstat -lt | grep ldap* it shows nothing On Thu, Jan 10, 2013 at 7:01 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Thursday, January 10, 2013 6:29 AM +0530 Oshadha Gunawardena < > oshadha.rocky(a)gmail.com> wrote: > > >> >> >> >> >> >> >> Hi all, >> >> I myself is struggling to configure and starting up the openldap server >> (v 2.4.33). Every time I started the server >> >> service slapd start >> >> I'm getting this error - and it never starts >> > > Your output shows it started just fine. It looks like the status command > is broken. > > --Quanah > > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

LDAP - not starting
by Oshadha Gunawardena 10 Jan '13

10 Jan '13

Hi all, I myself is struggling to configure and starting up the openldap server (v 2.4.33). Every time I started the server *service slapd start* I'm getting this error - and it never starts check-config.sh[3003]: Configuration directory '/etc/openldap/slapd.d' does not exist. check-config.sh[3003]: Warning: Usage of a configuration file is obsolete! runuser[3006]: pam_unix(runuser:session): session opened for user ldap by (uid=0) runuser[3006]: pam_unix(runuser:session): session closed for user ldap slapd[3019]: @(#) $OpenLDAP: slapd 2.4.33 (Oct 31 2012 12:02:13) $ slapd[3021]: bdb_monitor_db_open: monitoring disabled; configure monitor database to enable slapd[3021]: slapd starting slapd[3021]: daemon: shutdown requested and initiated. slapd[3021]: slapd shutdown: waiting for 0 operations/tasks to finish slapd[3021]: slapd stopped. When I issue the *service slapd status* slapd.service - OpenLDAP Server Daemon Loaded: loaded (/usr/lib/systemd/system/slapd.service; disabled) Active: failed (Result: timeout) since Thu, 10 Jan 2013 06:21:30 +0530; 21s ago Process: 3019 ExecStart=/usr/sbin/slapd -u ldap -h ${SLAPD_URLS} $SLAPD_OPTIONS (code=exited, status=0/SUCCESS) Process: 3003 ExecStartPre=/usr/libexec/openldap/check-config.sh (code=exited, status=0/SUCCESS) CGroup: name=systemd:/system/slapd.service My slapd.conf file * **include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema database bdb suffix "dc=test,dc=lan" rootdn "cn=Manager,dc=test,dc=lan" rootpw {SSHA}6U9AkmiHv9XpWBDyD9fsjhtF/NC0wpiq directory /mydata/Downloads/ldap/ # Global Read ACL access to * by self write by * read # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret* My ldap.conf file * # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. #BASE dc=example,dc=com #URI ldap://ldap.example.com ldap://ldap-master.example.com:666 #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never TLS_CACERTDIR /etc/openldap/certs* I'm kind of new to LDAP and Openldap so appreciate some assistance Thanks, Oshadha.

2 1

syncrepl mirrormode with SSL/TLS issues
by Houston Ray 10 Jan '13

10 Jan '13

I am attempting to move my sycrepl with mirrormode configuration over to TLS using LDAPS (not starttls) and running into problems. Multimaster setup (2 servers) behind a VIP both RHEL 6.3 Openldap 2.4.23-26 still running the old slapd.conf method (apologies) There are 3 separate certificates ldap.mycompany.net, server01.mycompany.net, and server02.mycompany.net The primary certificate is used for running slapd, and the individual server certs are intended to allow syncrepl over ssl. My configurations for syncrepl/mirrormode are down below. I had success with non-ssl syncrepl/mirrormode. It worked great actually. Now I am attempting to get syncrepl/mirrormode working with SSL. What I observe is whichever slapd instance is the last to startup is the one that becomes a "Master" as if I was in a producer/consumer setup. Errors I am seeing are slapd[11995]: conn=1003 fd=13 ACCEPT from IP=<server1_IP>:56368 (IP= 0.0.0.0:636) slapd[11995]: connection_read(13): TLS accept failure error=-1 id=1003, closing slapd[11485]: slap_client_connect: URI=ldaps://server01.mycompany.netDN="cn=Admin,dc=mycompany,dc=net" ldap_sasl_bind_s failed (-1) slapd[11485]: do_syncrepl: rid=001 rc -1 retrying Server 1 configuration ************************* # Server1 synchronization settings serverID 1 syncrepl rid=002 provider=ldaps://server02.mycompany.net binddn="cn=Admin,dc=mycompany,dc=net" bindmethod=simple credentials=secret tls_cert=/etc/openldap/certs/server02.mycompany.net.pem tls_cacert=/etc/openldap/certs/Verisignbundle.crt tls_key=/etc/openldap/certs/server02.mycompany.net.key tls_reqcert=allow searchbase="dc=mycompany,dc=net" type=refreshAndPersist retry="5 5 300 +" timelimit=5 attrs="*,+" interval=00:00:05:00 schemachecking=off mirrormode on # Server1 synchronization overlay overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 # Server1 end ************************************************************************************************** Server 2 configuration ********************************* # Server2 syncronization settings serverID 2 syncrepl rid=001 provider=ldaps://server01.mycompany.net binddn="cn=Admin,dc=mycompany,dc=net" bindmethod=simple credentials=secret tls_cert=/etc/openldap/certs/server01.mycompany.net.pem tls_cacert=/etc/openldap/certs/Verisignbundle.crt tls_key=/etc/openldap/certs/server01.mycompany.net.key tls_reqcert=allow searchbase="dc=mycompany,dc=net" type=refreshAndPersist retry="5 5 300 +" timelimit=5 attrs="*,+" interval=00:00:05:00 schemachecking=off mirrormode on # Server02 synchronization overlay overlay syncprov syncprov-checkpoint 100 10 # Server2 end ************************************************************************************************** any help is greatly appreciated

2 1

Get machines in Base LDAP
by rodrigo tavares 09 Jan '13

09 Jan '13

Hello, I have in my smb.conf, the follow line is: add machine script = /usr/sbin/useradd -s /bin/false -d /var/lib/nobody %u So, with the line machines get logon in domain, but machines come to /etc/passwd. I would like add all machines in LDAP, how I can to do it ? ldap admin dn = cn=admin,dc=brazil,dc=mg,dc=gov,dc=br ldap group suffix = ou=groups ldap machine suffix = ou=computers ldap passwd sync = yes ldap suffix = dc=brazil,dc=mg,dc=gov,dc=br ldap ssl = no ldap user suffix = ou=defensoria passdb backend = ldapsam:ldap://10.65.8.250 passdb backend = tdbsam hosts allow = 127.0.0.1, 10.65.8.0/255.255.252.0

2 1

slapd-ldap and backend errors
by John Madden 09 Jan '13

09 Jan '13

While setting up and testing new 2.4 infra (2.4.33), I've come across the situation where the proxy (slapd-ldap) doesn't pass LDAP_UNAVAILABLE back to the client when the backend slapd goes away. Is this behavior configurable on the proxy, something along the lines of chain-return-error? Example: connect to the backend slapd and ldapsearch a long-running query, then shut down slapd and the client provides the proper "error can't contact." Duplicate that behavior while searching against the proxy and you simply get a truncated list of entries with no errors. Thanks, John -- John Madden / Systems Engineer III Office of Technology / Ivy Tech Community College of Indiana Free Software is a matter of liberty, not price. To understand the concept, you should think of Free as in 'free speech,' not as in 'free beer.' -- Richard Stallman

2 2

access directive
by Friedrich Locke 09 Jan '13

09 Jan '13

Hi folks, i have just installed openldap and i am having trouble to understand access directive: I have 6 access rules : ################################################################################ # access definition on ou=people,dc=ufv,dc=br ################################################################################ access to dn.one="ou=people,dc=ufv,dc=br" attrs=userPassword by self read by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read by anonymous auth by * none access to dn.one="ou=people,dc=ufv,dc=br" attrs=uid,homeDirectory by self read by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read access to dn.one="ou=people,dc=ufv,dc=br" attrs=cn,uidNumber,gidNumber,loginShell,gecos,description by self read by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read access to dn.one="ou=people,dc=ufv,dc=br" attrs=mail,mailMessageStore,mailAlternateAddress,qmailUID,qmailGID,mailHost,mailForwardingAddress,deliveryProgramPath,qmailDotMode,deliveryMode,mailReplyText,accountStatus,qmailAccountPurge,mailQuotaSize,mailQuotaCount,mailSizeMax by self read by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read access to dn.one="ou=people,dc=ufv,dc=br" by self read by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read access to dn.base="ou=people,dc=ufv,dc=br" by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read I have some rules, as you can see, giving acess to certain attributes of anything below (one level) ou=people,dc=ufv,dc=br. I have another rule given access to everything on the same level, this is the rule 5th. Everything works ok, for instance: sioux@gustav$ ldapsearch -b uid=sioux,ou=people,dc=ufv,dc=br homedirectory SASL/GSSAPI authentication started SASL username: sioux(a)UFV.BR SASL SSF: 56 SASL data security layer installed. # extended LDIF # # LDAPv3 # base <uid=sioux,ou=people,dc=ufv,dc=br> with scope subtree # filter: (objectclass=*) # requesting: homedirectory # # sioux, people, ufv.br dn: uid=sioux,ou=people,dc=ufv,dc=br homeDirectory: /home/sioux # search result search: 5 result: 0 Success # numResponses: 2 # numEntries: 1 sioux@gustav$ But if i comment the 5th rule (I keep the others, giving access to the homedirectory attribute), it does not work: sioux@gustav$ ldapsearch -b uid=sioux,ou=people,dc=ufv,dc=br homedirectory SASL/GSSAPI authentication started SASL username: sioux(a)UFV.BR SASL SSF: 56 SASL data security layer installed. # extended LDIF # # LDAPv3 # base <uid=sioux,ou=people,dc=ufv,dc=br> with scope subtree # filter: (objectclass=*) # requesting: homedirectory # # search result search: 5 result: 32 No such object # numResponses: 1 sioux@gustav$ Does anybody here know why ? Thanks in advance.

2 1

Re: MDB Newbie
by Kyle Smith 08 Jan '13

08 Jan '13

On Wed, Jan 2, 2013 at 5:00 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Wednesday, January 02, 2013 4:35 PM -0500 Kyle Smith < > alacer.cogitatus(a)gmail.com> wrote: > > >> Greetings and Salutations. >> >> >> December 20, I converted from bdb to mdb. Now my memory usage looks like >> this: http://faculty.ycp.edu/~**ksmith8/openldap_stats.png<http://faculty.ycp.edu/~ksmith8/openldap_stats.png> >> >> >> I am concerned with the graph for "superman". How can I start tracking >> down the usage and why almost 50% of my memory is being consumed. These 4 >> are in MMR and are 2.4.33 and are nearly exact in server specification. >> Thanks in advance! >> > > Memory is vague. Do you mean shared, resident, or virtual? Your graphs > don't illustrate which either. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > Memory in this case is Physical memory as reported by ubuntu top. %MEM is the column. I did a "du -c -h data.mdb" on each of the four. Superman is listed at 1.4GB, while the other 3 are at 185MB. Not quite sure why that one is so much bigger. Thanks in advance.

1 0

Re: Replication status
by anil beniwal 07 Jan '13

07 Jan '13

Dear It means my DR server is not in sync with other two servers dc1 and dc2. but i am able to do successful search of last added user on all the servers.(which i added only on dc1 server) On Mon, Jan 7, 2013 at 7:44 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Monday, January 07, 2013 5:24 AM +0530 anil beniwal < > beni.anil(a)gmail.com> wrote: > > >> Hi >> >> We are having 3 openldap 2.4.33 servers on rhel 6.3 in MMR, below is my >> replication status for all of them. >> We have imported all the data on one server and copied same data to other >> 2 servers. >> > > DR >> contextCSN: 20130101132757.303803Z#000000#**000#000000 >> contextCSN: 20130102093855.341468Z#000000#**001#000000 >> contextCSN: 20130102050153.147891Z#000000#**002#000000 >> contextCSN: 20130102135821.337371Z#000000#**003#00000 >> > > #000# is the CSN created before MMR was set up, so there were no servers > with any server ID, i.e., one server with a server ID of zero. This > context CSN will never update. > > #001# is the CSN of the server with ServerID 1. > #002# is the CSN of the server with ServerID 2. > #003# is the CSN of the server with ServerID 3. > > The 001 through 003 CSNs will reflect the last time any of those servers > had a direct *not replicated* update. For testing if a server is up to > date, you want to compare all the CSNs to one another between the two > servers. > > I.e., you want CSN 001 to match CSN 001 on both servers. CSN 002 to match > CSN 002 on both servers. CSN 003 to CSN 003 on both servers. I wrote a > rather fun perl script for Zimbra to do this across a MMR setup. > > I will note that delta-syncrepl MMR remains the best option for > configuring MMR, as it is the least likely to end up with conflicts, unless > you run purely in MirrorMode. It also retains the bandwidth and write > throughput advantages it has with provider/replica replication as well. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

MirrorMode, delta syncrepl and memberof issues
by Al 07 Jan '13

07 Jan '13

Hi All - I'm having an issue with mirrormode replication (via delta syncrepl) and the memberof overlay. When a group membership is changed on the first node, slapd on the second node is crashing with the following error (as seen from running slapd with -d-1): slapd: memberof.c:1465: memberof_res_modify: Assertion `0' failed. If I disable either memberof or mirrormode, the change replicates correctly. This behavior happens on both bdb and mdb backends. Any thoughts on what that might mean? I am still in development, so I can try pretty much anything at this point - I appreciate any guidance that you can offer. Here are the important details: OpenLDAP 2.4.33 Redhat Linux 6.3 - x64 Server1 and Server2 are using the same configuration, minus the serverid and the syncrepl provider. here is server1's pertinent config: olcServerID: 1 ... olcSyncrepl: rid=000 provider=ldap://server1.xxx.xxx.com:389/ bindme thod=simple timeout=0 network-timeout=0 binddn="cn=ldapreplicator,xxx, xxx,xxx.com" credentials="secret" keepalive=0:0:0 starttls=critical filter="(objectclass=*)" searchbase="xxx.com" logfilter= "(&(objectClass=auditWriteObject)(reqResult=0))" logbase="cn=accesslog" scope =sub schemachecking=on type=refreshAndPersist retry="60 +" syncdata=accesslog olcMirrorMode: TRUE ... olcMemberOfRefInt: FALSE olcMemberOfGroupOC: groupOfUniqueNames olcMemberOfMemberAD: uniquemember Regards, Al

2 1

Replication status
by anil beniwal 07 Jan '13

07 Jan '13

Hi We are having 3 openldap 2.4.33 servers on rhel 6.3 in MMR, below is my replication status for all of them. We have imported all the data on one server and copied same data to other 2 servers. 1. I am not able to figure out why i am having 4th line in my DR server, while searching contextCSN, while we are having only 3 ldap servers 2. Why CSN values are different , while i am getting latest added record in search on all the servers. Before Adding user dc1 contextCSN: 20130101132757.303803Z#000000#000#000000 contextCSN: 20130106222129.577348Z#000000#001#000000 contextCSN: 20130102050153.147891Z#000000#002#000000 dc2 contextCSN: 20130101132757.303803Z#000000#000#000000 contextCSN: 20130106222129.577348Z#000000#001#000000 contextCSN: 20130102050153.147891Z#000000#002#000000 DR contextCSN: 20130101132757.303803Z#000000#000#000000 contextCSN: 20130106222129.577348Z#000000#001#000000 contextCSN: 20130102050153.147891Z#000000#002#000000 contextCSN: 20130102135821.337371Z#000000#003#000000 After adding User ( its reflecting on all the servers in search) DC 1 contextCSN: 20130101132757.303803Z#000000#000#000000 contextCSN: 20130102093855.341468Z#000000#001#000000 contextCSN: 20130102050153.147891Z#000000#002#000000 DC 2 contextCSN: 20130101132757.303803Z#000000#000#000000 contextCSN: 20130102093855.341468Z#000000#001#000000 contextCSN: 20130102050153.147891Z#000000#002#000000 DR contextCSN: 20130101132757.303803Z#000000#000#000000 contextCSN: 20130102093855.341468Z#000000#001#000000 contextCSN: 20130102050153.147891Z#000000#002#000000 contextCSN: 20130102135821.337371Z#000000#003#00000 -- Thanks&Regards Anil Beniwal

2 1

How to change the base dn after installation
by Onno van der Straaten 07 Jan '13

07 Jan '13

Hi, I have a simple directory setup with base dn dc=my-domain, dc=com. How can I change the base dn? I'm running the latest OpenLDAP version on Fedora 17. Thanks, Onno

2 1

How to create a directory admin group
by Onno van der Straaten 07 Jan '13

07 Jan '13

Hi, How can I define a admin group for my directory? Currently I have one admin account, the one that was created during installation, cn=Manager, dc=my-domain, dc=com. I would like to create a group for example cn=ldap-admins,dc=my-domain,dc=com and then make users member of this group to grant them privilege to do admin work on the directory similar to cn=Manager. I suppose I have to add access rules. But where and how I don't know. Thanks, Onno

2 1

Bind failing with "critical extension is unavailable" error when used with pagedresultscontrol
by Cannady, Mike 05 Jan '13

05 Jan '13

I have a program that works with Microsoft LDAP that I'm trying to get to work with openldap. The program is from a third-party and I have NO access to the code. I was able to duplicate the behavior with Perl code (testPaged.pl) later in this email. The bind is to a domain that uses the BDB backend. If my test code ignores the error from bind, it does the paged results just fine. The problem is the third-party program stops if it sees the error in bind. I've captured network traffic to the Microsoft LDAP server and see that it generates NO error. The version I'm running is: [root@radius1 openldap]# slapd -V @(#) $OpenLDAP: slapd 2.4.23 (Jul 31 2012 10:47:00) $ mockbuild@x86-001.build.bos.redhat.com:/builddir/build/BUILD/openldap-2.4.23/openldap-2.4.23/build-servers/servers/slapd Is this a bug? I have the perl code, the debug run of the perl code, the slapd.d structure, dumps of the olcDatabase entries, and the results of "slapd -d -1" output. ##==============================================================testPaged.pl [mcannady@vmHTCradius1 ldap]$ cat testPaged.pl use Net::LDAP; use Net::LDAP::Control::Paged; use Net::LDAP::Constant qw( LDAP_CONTROL_PAGED ); ################################## sub ProcessSearch { my ( $msg, $result ) = @_; ## Nothing to do return if ( ! defined($result) ); if ( $result->isa("Net::LDAP::Reference") ) { ## a reference... just mention it. } else { $result->dump( ); print "\n"; } } ##################################### $ldap = Net::LDAP->new( "radius1.pbx.htc.internal" ); $page = Net::LDAP::Control::Paged->new( size => 10 , critical => true ); $mesg = $ldap->bind( "uid=NuPoint,dc=htc,dc=com", password => "XXXXXXX[redacted]XXXXXXXXXXX" , control => [ $page ] ); if ( $mesg->code ) { ## print error print "error on bind: ", $mesg->error(), "\n"; return; } @args = ( base => "cn=Users,dc=htc,dc=com", scope => "subtree", filter => "(objectClass=user)", callback => \&ProcessSearch, # Call this sub for each entry control => [ $page ], ); my $cookie; while(1) { # Perform search my $mesg = $ldap->search( @args ); # Only continue on LDAP_SUCCESS $mesg->code and last; # Get cookie from paged control my($resp) = $mesg->control( LDAP_CONTROL_PAGED ) or last; $cookie = $resp->cookie or last; # Set cookie in paged control $page->cookie($cookie); } if ($cookie) { # We had an abnormal exit, so let the server know we do not want any more $page->cookie($cookie); $page->size(0); $ldap->search( @args ); } [mcannady@vmHTCradius1 ldap]$ ##================================================================ perl debug-mode test [mcannady@vmHTCradius1 ldap]$ perl -d testPaged.pl Loading DB routines from perl5db.pl version 1.32 Editor support available. Enter h or `h h' for help, or `man perldebug' for more help. main::(testPaged.pl:20): $ldap = Net::LDAP->new( "radius1.pbx.htc.internal" ); DB<1> n main::(testPaged.pl:22): $page = Net::LDAP::Control::Paged->new( size => 10 , critical => true ); DB<1> n main::(testPaged.pl:24): $mesg = $ldap->bind( "uid=NuPoint,dc=htc,dc=com", main::(testPaged.pl:25): password => "XXXXXXXXX[redacted]XXXXXX" , main::(testPaged.pl:26): control => [ $page ] main::(testPaged.pl:27): ); DB<1> n main::(testPaged.pl:28): if ( $mesg->code ) { DB<1> n main::(testPaged.pl:30): print "error on bind: ", $mesg->error(), "\n"; DB<1> n error on bind: critical extension is unavailable main::(testPaged.pl:31): return; ##====================================================================================== [root@radius1 slapd.d]# find . -print . ./cn=config.ldif ./cn=config ./cn=config/cn=include{1}.ldif ./cn=config/cn=schema ./cn=config/cn=schema/cn={1}cosine.ldif ./cn=config/cn=schema/cn={4}ad.ldif ./cn=config/cn=schema/cn={2}inetorgperson.ldif ./cn=config/cn=schema/cn={3}nis.ldif ./cn=config/cn=schema/cn={0}core.ldif ./cn=config/cn=include{3}.ldif ./cn=config/olcDatabase={1}bdb.ldif ./cn=config/olcDatabase={2}bdb.ldif ./cn=config/olcDatabase={0}config.ldif ./cn=config/cn=schema.ldif ./cn=config/cn=include{2}.ldif ./cn=config/cn=include{0}.ldif ./cn=config/olcDatabase={3}monitor.ldif ./cn=config/olcDatabase={-1}frontend.ldif ##======================================================================================= ======================================================== cat olcDatabase={0}config.ldif dn: olcDatabase={0}config objectClass: olcDatabaseConfig olcDatabase: {0}config olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=admin,cn=config olcRootPW:: XXXredactedXXX structuralObjectClass: olcDatabaseConfig entryUUID: ac0d8a60-c861-1031-9bd4-5591ba7dfe32 creatorsName: cn=config createTimestamp: 20121121195915Z entryCSN: 20121121195915Z#000000#00#000000 modifiersName: cn=config modifyTimestamp: 20121121195915Z ======================================================== cat olcDatabase={1}bdb.ldif dn: olcDatabase={1}bdb objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {1}bdb olcSuffix: dc=htc,dc=com olcAccess: {0}to * by dn.base="uid=push-master,cn=nupointproxy,dc=internal" w rite by * +0 break olcAccess: {1}to dn.base="" by * read olcAccess: {2}to dn.base="cn=subschema" by * read olcAccess: {3}to dn.subtree="cn=monitor" by users read by * none olcAccess: {4}to * by self write by * read olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootPW:: XXXXXXXXXXXXXXXXXXXXredactedXXXXXXXXXXXX olcDbDirectory: /var/lib/ldap/htc.com olcDbCacheSize: 150000 olcDbCheckpoint: 102400 1 olcDbConfig: {0}set_cachesize 0 268435465 1 olcDbConfig: {1}set_lg_bsize 2097152 olcDbConfig: {2}set_lg_regionmax 262144 olcDbConfig: {3}set_flags DB_LOG_AUTOREMOVE olcDbNoSync: TRUE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 150000 olcDbIndex: objectClass pres,eq olcDbIndex: cn pres,eq,sub olcDbIndex: ou pres,eq,sub olcDbIndex: mail pres,eq,sub olcDbIndex: sn pres,eq,sub olcDbIndex: givenName pres,eq,sub olcDbLinearIndex: FALSE olcDbMode: 384 olcDbSearchStack: 16 olcDbShmKey: 12321 olcDbCacheFree: 1 structuralObjectClass: olcBdbConfig entryUUID: ac0da28e-c861-1031-9bd5-5591ba7dfe32 creatorsName: cn=config createTimestamp: 20121121195915Z olcRootDN: uid=Manager,dc=htc,dc=com olcUpdateDN: uid=Push-Master,cn=NupointProxy,dc=internal entryCSN: 20121212180425.846656Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20121212180425Z ======================================================== cat olcDatabase={-1}frontend.ldif dn: olcDatabase={-1}frontend objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcLastMod: TRUE olcMaxDerefDepth: 0 olcReadOnly: FALSE olcSchemaDN: cn=Subschema structuralObjectClass: olcDatabaseConfig entryUUID: ac0d771e-c861-1031-9bd3-5591ba7dfe32 creatorsName: cn=config createTimestamp: 20121121195915Z olcTimeLimit: unlimited olcSizeLimit: unlimited entryCSN: 20121214201101.233668Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20121214201101Z ======================================================== cat olcDatabase={2}bdb.ldif dn: olcDatabase={2}bdb objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {2}bdb olcSuffix: dc=internal olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=admin,cn=config olcSyncUseSubentry: FALSE olcMonitoring: TRUE olcDbDirectory: /var/lib/ldap/htc.internal olcDbCacheSize: 1000 olcDbCheckpoint: 100 63 olcDbNoSync: FALSE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 0 olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 structuralObjectClass: olcBdbConfig entryUUID: 92ff370e-dcc9-1031-8a59-533cee5baf07 creatorsName: cn=config createTimestamp: 20121217191324Z entryCSN: 20121217191324.652465Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20121217191324Z ======================================================== cat olcDatabase={3}monitor.ldif dn: olcDatabase={3}monitor objectClass: olcDatabaseConfig olcDatabase: {3}monitor olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig entryUUID: 54da1e50-d8df-1031-85bf-235d062b63b6 creatorsName: cn=config createTimestamp: 20121212193904Z entryCSN: 20121212193904.665758Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20121212193904Z ======================================================== Script started on Tue 18 Dec 2012 01:56:28 PM EST [root@radius1 openldap]# slapd -u ldap -d -1 @(#) $OpenLDAP: slapd 2.4.23 (Jul 31 2012 10:47:00) $ mockbuild@x86-001.build.bos.redhat.com:/builddir/build/BUILD/openldap-2.4.23/openldap-2.4.23/build-servers/servers/slapd ldap_pvt_gethostbyname_a: host=radius1.pbx.htc.internal, r=0 daemon_init: <null> daemon_init: listen on ldap:/// daemon_init: 1 listeners to open... ldap_url_parse_ext(ldap:///) daemon: listener initialized ldap:/// daemon_init: 2 listeners opened ldap_create slapd init: initiated server. slap_sasl_init: initialized! bdb_back_initialize: initialize BDB backend bdb_back_initialize: Berkeley DB 4.7.25: (March 5, 2012) hdb_back_initialize: initialize HDB backend hdb_back_initialize: Berkeley DB 4.7.25: (March 5, 2012) null_back_initialize: initialize null backend backend_startup_one: starting "cn=config" ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config.ldif" => str2entry: "dn: cn=config objectClass: olcGlobal cn: config olcConfigFile: /etc/openldap/slapd.conf olcConfigDir: /etc/openldap/slapd.d olcAllows: bind_v2 olcArgsFile: /var/run/openldap/slapd.args olcAttributeOptions: lang- olcAuthzPolicy: none olcConcurrency: 0 olcConnMaxPending: 100 olcConnMaxPendingAuth: 1000 olcGentleHUP: FALSE olcIdleTimeout: 0 olcTLSCACertificateFile: /etc/pki/tls/certs/ca-bundle.crt olcTLSCertificateFile: /etc/pki/tls/certs/slapd.pem olcTLSCertificateKeyFile: /etc/pki/tls/certs/slapd.pem olcIndexSubstrIfMaxLen: 4 olcIndexSubstrIfMinLen: 2 olcIndexSubstrAnyLen: 4 olcIndexSubstrAnyStep: 2 olcLocalSSF: 71 olcLogLevel: Stats olcPidFile: /var/run/openldap/slapd.pid olcReadOnly: FALSE olcReplicationInterval: 0 olcReverseLookup: FALSE olcSaslHost: htcRadius1.htc.internal olcSaslSecProps: noplain,noanonymous olcSockbufMaxIncoming: 262143 olcSockbufMaxIncomingAuth: 16777215 olcThreads: 16 olcTLSCRLCheck: none olcTLSVerifyClient: never olcToolThreads: 1 structuralObjectClass: olcGlobal entryUUID: ac065c7c-c861-1031-9bc9-5591ba7dfe32 creatorsName: cn=config createTimestamp: 20121121195915Z entryCSN: 20121121195915Z#000000#00#000000 modifiersName: cn=config modifyTimestamp: 20121121195915Z " >>> dnPrettyNormal: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnPrettyNormal: <cn=config>, <cn=config> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> <= str2entry(cn=config) -> 0x7fcb0f61d108 => test_filter PRESENT => access_allowed: search access to "cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) <= test_filter 6 olcTLSCRLCheck: value #0: keyword <TLSCRLCheck> ignored olcTLSCRLCheck: value #0: keyword <TLSCRLCheck> ignored olcReplicationInterval: value #0: <olcReplicationInterval> keyword is obsolete (ignored) ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/cn=include{0}.ldif" => str2entry: "dn: cn=include{0} objectClass: olcIncludeFile cn: include{0} olcInclude: /etc/openldap/schema/core.schema structuralObjectClass: olcIncludeFile entryUUID: ac0c28d2-c861-1031-9bca-5591ba7dfe32 creatorsName: cn=config createTimestamp: 20121121195915Z entryCSN: 20121121195915Z#000000#00#000000 modifiersName: cn=config modifyTimestamp: 20121121195915Z " >>> dnPrettyNormal: <cn=include{0}> => ldap_bv2dn(cn=include{0},0) <= ldap_bv2dn(cn=include{0})=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=include{0})=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=include{0})=0 <<< dnPrettyNormal: <cn=include{0}>, <cn=include{0}> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> <= str2entry(cn=include{0}) -> 0x7fcb0f61d108 => test_filter PRESENT => access_allowed: search access to "cn=include{0},cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) <= test_filter 6 ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/cn=include{1}.ldif" => str2entry: "dn: cn=include{1} objectClass: olcIncludeFile cn: include{1} olcInclude: /etc/openldap/schema/cosine.schema structuralObjectClass: olcIncludeFile entryUUID: ac0c434e-c861-1031-9bcb-5591ba7dfe32 creatorsName: cn=config createTimestamp: 20121121195915Z entryCSN: 20121121195915Z#000000#00#000000 modifiersName: cn=config modifyTimestamp: 20121121195915Z " >>> dnPrettyNormal: <cn=include{1}> => ldap_bv2dn(cn=include{1},0) <= ldap_bv2dn(cn=include{1})=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=include{1})=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=include{1})=0 <<< dnPrettyNormal: <cn=include{1}>, <cn=include{1}> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> <= str2entry(cn=include{1}) -> 0x7fcb0f61d108 => test_filter PRESENT => access_allowed: search access to "cn=include{1},cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) <= test_filter 6 ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/cn=include{2}.ldif" => str2entry: "dn: cn=include{2} objectClass: olcIncludeFile cn: include{2} olcInclude: /etc/openldap/schema/inetorgperson.schema structuralObjectClass: olcIncludeFile entryUUID: ac0c54f6-c861-1031-9bcc-5591ba7dfe32 creatorsName: cn=config createTimestamp: 20121121195915Z entryCSN: 20121121195915Z#000000#00#000000 modifiersName: cn=config modifyTimestamp: 20121121195915Z " >>> dnPrettyNormal: <cn=include{2}> => ldap_bv2dn(cn=include{2},0) <= ldap_bv2dn(cn=include{2})=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=include{2})=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=include{2})=0 <<< dnPrettyNormal: <cn=include{2}>, <cn=include{2}> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> <= str2entry(cn=include{2}) -> 0x7fcb0f61d108 => test_filter PRESENT => access_allowed: search access to "cn=include{2},cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) <= test_filter 6 ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/cn=include{3}.ldif" => str2entry: "dn: cn=include{3} objectClass: olcIncludeFile cn: include{3} olcInclude: /etc/openldap/schema/nis.schema structuralObjectClass: olcIncludeFile entryUUID: ac0c6496-c861-1031-9bcd-5591ba7dfe32 creatorsName: cn=config createTimestamp: 20121121195915Z entryCSN: 20121121195915Z#000000#00#000000 modifiersName: cn=config modifyTimestamp: 20121121195915Z " >>> dnPrettyNormal: <cn=include{3}> => ldap_bv2dn(cn=include{3},0) <= ldap_bv2dn(cn=include{3})=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=include{3})=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=include{3})=0 <<< dnPrettyNormal: <cn=include{3}>, <cn=include{3}> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> <= str2entry(cn=include{3}) -> 0x7fcb0f61d108 => test_filter PRESENT => access_allowed: search access to "cn=include{3},cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) <= test_filter 6 ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/cn=schema.ldif" => str2entry: "dn: cn=schema objectClass: olcSchemaConfig cn: schema olcObjectIdentifier: OLcfg 1.3.6.1.4.1.4203.666.11.1 olcObjectIdentifier: OLcfgAt OLcfg:3 olcObjectIdentifier: OLcfgGlAt OLcfgAt:0 olcObjectIdentifier: OLcfgBkAt OLcfgAt:1 olcObjectIdentifier: OLcfgDbAt OLcfgAt:2 olcObjectIdentifier: OLcfgOvAt OLcfgAt:3 olcObjectIdentifier: OLcfgOc OLcfg:4 olcObjectIdentifier: OLcfgGlOc OLcfgOc:0 olcObjectIdentifier: OLcfgBkOc OLcfgOc:1 olcObjectIdentifier: OLcfgDbOc OLcfgOc:2 olcObjectIdentifier: OLcfgOvOc OLcfgOc:3 olcObjectIdentifier: OMsyn 1.3.6.1.4.1.1466.115.121.1 olcObjectIdentifier: OMsInteger OMsyn:27 olcObjectIdentifier: OMsBoolean OMsyn:7 olcObjectIdentifier: OMsDN OMsyn:12 olcObjectIdentifier: OMsDirectoryString OMsyn:15 olcObjectIdentifier: OMsOctetString OMsyn:40 olcAttributeTypes: ( 2.5.4.0 NAME 'objectClass' DESC 'RFC2256: object classes of the entity' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121 .1.38 ) olcAttributeTypes: ( 2.5.21.9 NAME 'structuralObjectClass' DESC 'X.500(93): st ructural object class of entry' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1 .4.1.1466.115.121.1.38 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOpera tion ) olcAttributeTypes: ( 2.5.18.1 NAME 'createTimestamp' DESC 'RFC2252: time which object was created' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOr deringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE NO-USER-MODIFIC ATION USAGE directoryOperation ) olcAttributeTypes: ( 2.5.18.2 NAME 'modifyTimestamp' DESC 'RFC2252: time which object was last modified' EQUALITY generalizedTimeMatch ORDERING generalized TimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE NO-USER-M ODIFICATION USAGE directoryOperation ) olcAttributeTypes: ( 2.5.18.3 NAME 'creatorsName' DESC 'RFC2252: name of creat or' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SING LE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) olcAttributeTypes: ( 2.5.18.4 NAME 'modifiersName' DESC 'RFC2252: name of last modifier' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1. 12 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) olcAttributeTypes: ( 2.5.18.9 NAME 'hasSubordinates' DESC 'X.501: entry has ch ildren' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALU E NO-USER-MODIFICATION USAGE directoryOperation ) olcAttributeTypes: ( 2.5.18.10 NAME 'subschemaSubentry' DESC 'RFC2252: name of controlling subschema entry' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1. 4.1.1466.115.121.1.12 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperat ion ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.33 NAME 'entryDN' DESC 'DN of the entry' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 S INGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) olcAttributeTypes: ( 1.3.6.1.1.16.4 NAME 'entryUUID' DESC 'UUID of the entry' EQUALITY UUIDMatch ORDERING UUIDOrderingMatch SYNTAX 1.3.6.1.1.16.1 SINGLE-VA LUE NO-USER-MODIFICATION USAGE directoryOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.7 NAME 'entryCSN' DESC 'change seq uence number of the entry content' EQUALITY CSNMatch ORDERING CSNOrderingMatc h SYNTAX 1.3.6.1.4.1.4203.666.11.2.1{64} SINGLE-VALUE NO-USER-MODIFICATION US AGE directoryOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.13 NAME 'namingCSN' DESC 'change s equence number of the entry naming (RDN)' EQUALITY CSNMatch ORDERING CSNOrder ingMatch SYNTAX 1.3.6.1.4.1.4203.666.11.2.1{64} SINGLE-VALUE NO-USER-MODIFICA TION USAGE directoryOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.23 NAME 'syncreplCookie' DESC 'syn crepl Cookie for shadow copy' EQUALITY octetStringMatch ORDERING octetStringO rderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE NO-USER-MODIFI CATION USAGE dSAOperation ) olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.1.25 NAME 'contextCSN' DESC 'the lar gest committed CSN of a context' EQUALITY CSNMatch ORDERING CSNOrderingMatch SYNTAX 1.3.6.1.4.1.4203.666.11.2.1{64} SINGLE-VALUE NO-USER-MODIFI>>> dnPrettyNormal: <cn=schema> => ldap_bv2dn(cn=schema,0) <= ldap_bv2dn(cn=schema)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=schema)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=schema)=0 <<< dnPrettyNormal: <cn=schema>, <cn=schema> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> <= str2entry(cn=schema) -> 0x7fcb0f61d108 => test_filter PRESENT => access_allowed: search access to "cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) <= test_filter 6 ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/cn=schema/cn={0}core.ldif" => str2entry: "dn: cn={0}core objectClass: olcSchemaConfig cn: {0}core olcAttributeTypes: {0}( 2.5.4.2 NAME 'knowledgeInformation' DESC 'RFC2256: kno wledge information' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121. 1.15{32768} ) olcAttributeTypes: {1}( 2.5.4.4 NAME ( 'sn' 'surname' ) DESC 'RFC2256: last (f amily) name(s) for which the entity is known by' SUP name ) olcAttributeTypes: {2}( 2.5.4.5 NAME 'serialNumber' DESC 'RFC2256: serial numb er of the entity' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch S YNTAX 1.3.6.1.4.1.1466.115.121.1.44{64} ) olcAttributeTypes: {3}( 2.5.4.6 NAME ( 'c' 'countryName' ) DESC 'RFC2256: ISO- 3166 country 2-letter code' SUP name SINGLE-VALUE ) olcAttributeTypes: {4}( 2.5.4.7 NAME ( 'l' 'localityName' ) DESC 'RFC2256: loc ality which this object resides in' SUP name ) olcAttributeTypes: {5}( 2.5.4.8 NAME ( 'st' 'stateOrProvinceName' ) DESC 'RFC2 256: state or province which this object resides in' SUP name ) olcAttributeTypes: {6}( 2.5.4.9 NAME ( 'street' 'streetAddress' ) DESC 'RFC225 6: street address of this object' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreS ubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} ) olcAttributeTypes: {7}( 2.5.4.10 NAME ( 'o' 'organizationName' ) DESC 'RFC2256 : organization this object belongs to' SUP name ) olcAttributeTypes: {8}( 2.5.4.11 NAME ( 'ou' 'organizationalUnitName' ) DESC ' RFC2256: organizational unit this object belongs to' SUP name ) olcAttributeTypes: {9}( 2.5.4.12 NAME 'title' DESC 'RFC2256: title associated with the entity' SUP name ) olcAttributeTypes: {10}( 2.5.4.14 NAME 'searchGuide' DESC 'RFC2256: search gui de, deprecated by enhancedSearchGuide' SYNTAX 1.3.6.1.4.1.1466.115.121.1.25 ) olcAttributeTypes: {11}( 2.5.4.15 NAME 'businessCategory' DESC 'RFC2256: busin ess category' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTA X 1.3.6.1.4.1.1466.115.121.1.15{128} ) olcAttributeTypes: {12}( 2.5.4.16 NAME 'postalAddress' DESC 'RFC2256: postal a ddress' EQUALITY caseIgnoreListMatch SUBSTR caseIgnoreListSubstringsMatch SYN TAX 1.3.6.1.4.1.1466.115.121.1.41 ) olcAttributeTypes: {13}( 2.5.4.17 NAME 'postalCode' DESC 'RFC2256: postal code ' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4. 1.1466.115.121.1.15{40} ) olcAttributeTypes: {14}( 2.5.4.18 NAME 'postOfficeBox' DESC 'RFC2256: Post Off ice Box' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3 .6.1.4.1.1466.115.121.1.15{40} ) olcAttributeTypes: {15}( 2.5.4.19 NAME 'physicalDeliveryOfficeName' DESC 'RFC2 256: Physical Delivery Office Name' EQUALITY caseIgnoreMatch SUBSTR caseIgnor eSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} ) olcAttributeTypes: {16}( 2.5.4.20 NAME 'telephoneNumber' DESC 'RFC2256: Teleph one Number' EQUALITY telephoneNumberMatch SUBSTR telephoneNumberSubstringsMat ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.50{32} ) olcAttributeTypes: {17}( 2.5.4.21 NAME 'telexNumber' DESC 'RFC2256: Telex Numb er' SYNTAX 1.3.6.1.4.1.1466.115.121.1.52 ) olcAttributeTypes: {18}( 2.5.4.22 NAME 'teletexTerminalIdentifier' DESC 'RFC22 56: Teletex Terminal Identifier' SYNTAX 1.3.6.1.4.1.1466.115.121.1.51 ) olcAttributeTypes: {19}( 2.5.4.23 NAME ( 'facsimileTelephoneNumber' 'fax' ) DE SC 'RFC2256: Facsimile (Fax) Telephone Number' SYNTAX 1.3.6.1.4.1.1466.115.12 1.1.22 ) olcAttributeTypes: {20}( 2.5.4.24 NAME 'x121Address' DESC 'RFC2256: X.121 Addr ess' EQUALITY numericStringMatch SUBSTR numericStringSubstringsMatch SYNTAX 1 .3.6.1.4.1.1466.115.121.1.36{15} ) olcAttributeTypes: {21}( 2.5.4.25 NAME 'internationaliSDNNumber' DESC 'RFC2256 : international ISDN number' EQUALITY numericStringMatch SUBSTR numericString SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.36{16} ) olcAttributeTypes: {22}( 2.5.4.26 NAME 'registeredAddress' DESC 'RFC2256: regi stered postal address' SUP postalAddress SYNTAX 1.3.6.1.4.1.1466.115.121.1.41 ) olcAttributeTypes: {23}( 2.5.4.27 NAME 'destinationIndicator' DESC 'RFC2256: d estination indicator' EQUALITY caseIgnoreMatch SUBSTR cas>>> dnPrettyNormal: <cn={0}core> => ldap_bv2dn(cn={0}core,0) <= ldap_bv2dn(cn={0}core)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn={0}core)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn={0}core)=0 <<< dnPrettyNormal: <cn={0}core>, <cn={0}core> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> <= str2entry(cn={0}core) -> 0x7fcb0f61d108 => test_filter PRESENT => access_allowed: search access to "cn={0}core,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) <= test_filter 6 ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/cn=schema/cn={1}cosine.ldif" => str2entry: "dn: cn={1}cosine objectClass: olcSchemaConfig cn: {1}cosine olcAttributeTypes: {0}( 0.9.2342.19200300.100.1.2 NAME 'textEncodedORAddress' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1. 1466.115.121.1.15{256} ) olcAttributeTypes: {1}( 0.9.2342.19200300.100.1.4 NAME 'info' DESC 'RFC1274: g eneral information' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{2048} ) olcAttributeTypes: {2}( 0.9.2342.19200300.100.1.5 NAME ( 'drink' 'favouriteDri nk' ) DESC 'RFC1274: favorite drink' EQUALITY caseIgnoreMatch SUBSTR caseIgno reSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {3}( 0.9.2342.19200300.100.1.6 NAME 'roomNumber' DESC 'RFC1 274: room number' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch S YNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {4}( 0.9.2342.19200300.100.1.7 NAME 'photo' DESC 'RFC1274: photo (G3 fax)' SYNTAX 1.3.6.1.4.1.1466.115.121.1.23{25000} ) olcAttributeTypes: {5}( 0.9.2342.19200300.100.1.8 NAME 'userClass' DESC 'RFC12 74: category of user' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMat ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {6}( 0.9.2342.19200300.100.1.9 NAME 'host' DESC 'RFC1274: h ost computer' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTA X 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {7}( 0.9.2342.19200300.100.1.10 NAME 'manager' DESC 'RFC127 4: DN of manager' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115 .121.1.12 ) olcAttributeTypes: {8}( 0.9.2342.19200300.100.1.11 NAME 'documentIdentifier' D ESC 'RFC1274: unique identifier of document' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {9}( 0.9.2342.19200300.100.1.12 NAME 'documentTitle' DESC ' RFC1274: title of document' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstri ngsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {10}( 0.9.2342.19200300.100.1.13 NAME 'documentVersion' DES C 'RFC1274: version of document' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSu bstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {11}( 0.9.2342.19200300.100.1.14 NAME 'documentAuthor' DESC 'RFC1274: DN of author of document' EQUALITY distinguishedNameMatch SYNTAX 1 .3.6.1.4.1.1466.115.121.1.12 ) olcAttributeTypes: {12}( 0.9.2342.19200300.100.1.15 NAME 'documentLocation' DE SC 'RFC1274: location of document original' EQUALITY caseIgnoreMatch SUBSTR c aseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) olcAttributeTypes: {13}( 0.9.2342.19200300.100.1.20 NAME ( 'homePhone' 'homeTe lephoneNumber' ) DESC 'RFC1274: home telephone number' EQUALITY telephoneNumb erMatch SUBSTR telephoneNumberSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121 .1.50 ) olcAttributeTypes: {14}( 0.9.2342.19200300.100.1.21 NAME 'secretary' DESC 'RFC 1274: DN of secretary' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.146 6.115.121.1.12 ) olcAttributeTypes: {15}( 0.9.2342.19200300.100.1.22 NAME 'otherMailbox' SYNTAX 1.3.6.1.4.1.1466.115.121.1.39 ) olcAttributeTypes: {16}( 0.9.2342.19200300.100.1.26 NAME 'aRecord' EQUALITY ca seIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {17}( 0.9.2342.19200300.100.1.27 NAME 'mDRecord' EQUALITY c aseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {18}( 0.9.2342.19200300.100.1.28 NAME 'mXRecord' EQUALITY c aseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {19}( 0.9.2342.19200300.100.1.29 NAME 'nSRecord' EQUALITY c aseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {20}( 0.9.2342.19200300.100.1.30 NAME 'sOARecord' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {21}( 0.9.2342.19200300.100.1.31 NAME 'cNAMERecord' EQUALIT Y caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {22}( 0.9.2342.19200300.100.1.38 NAM>>> dnPrettyNormal: <cn={1}cosine> => ldap_bv2dn(cn={1}cosine,0) <= ldap_bv2dn(cn={1}cosine)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn={1}cosine)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn={1}cosine)=0 <<< dnPrettyNormal: <cn={1}cosine>, <cn={1}cosine> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> <= str2entry(cn={1}cosine) -> 0x7fcb0f61d108 => test_filter PRESENT => access_allowed: search access to "cn={1}cosine,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) <= test_filter 6 ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/cn=schema/cn={2}inetorgperson.ldif" => str2entry: "dn: cn={2}inetorgperson objectClass: olcSchemaConfig cn: {2}inetorgperson olcAttributeTypes: {0}( 2.16.840.1.113730.3.1.1 NAME 'carLicense' DESC 'RFC279 8: vehicle license or registration plate' EQUALITY caseIgnoreMatch SUBSTR cas eIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {1}( 2.16.840.1.113730.3.1.2 NAME 'departmentNumber' DESC ' RFC2798: identifies a department within an organization' EQUALITY caseIgnoreM atch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {2}( 2.16.840.1.113730.3.1.241 NAME 'displayName' DESC 'RFC 2798: preferred name to be used when displaying entries' EQUALITY caseIgnoreM atch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SI NGLE-VALUE ) olcAttributeTypes: {3}( 2.16.840.1.113730.3.1.3 NAME 'employeeNumber' DESC 'RF C2798: numerically identifies an employee within an organization' EQUALITY ca seIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.12 1.1.15 SINGLE-VALUE ) olcAttributeTypes: {4}( 2.16.840.1.113730.3.1.4 NAME 'employeeType' DESC 'RFC2 798: type of employment for a person' EQUALITY caseIgnoreMatch SUBSTR caseIgn oreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {5}( 0.9.2342.19200300.100.1.60 NAME 'jpegPhoto' DESC 'RFC2 798: a JPEG image' SYNTAX 1.3.6.1.4.1.1466.115.121.1.28 ) olcAttributeTypes: {6}( 2.16.840.1.113730.3.1.39 NAME 'preferredLanguage' DESC 'RFC2798: preferred written or spoken language for a person' EQUALITY caseIg noreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1. 15 SINGLE-VALUE ) olcAttributeTypes: {7}( 2.16.840.1.113730.3.1.40 NAME 'userSMIMECertificate' D ESC 'RFC2798: PKCS#7 SignedData used to support S/MIME' SYNTAX 1.3.6.1.4.1.14 66.115.121.1.5 ) olcAttributeTypes: {8}( 2.16.840.1.113730.3.1.216 NAME 'userPKCS12' DESC 'RFC2 798: personal identity information, a PKCS #12 PFX' SYNTAX 1.3.6.1.4.1.1466.1 15.121.1.5 ) olcObjectClasses: {0}( 2.16.840.1.113730.3.2.2 NAME 'inetOrgPerson' DESC 'RFC2 798: Internet Organizational Person' SUP organizationalPerson STRUCTURAL MAY ( audio $ businessCategory $ carLicense $ departmentNumber $ displayName $ em ployeeNumber $ employeeType $ givenName $ homePhone $ homePostalAddress $ ini tials $ jpegPhoto $ labeledURI $ mail $ manager $ mobile $ o $ pager $ photo $ roomNumber $ secretary $ uid $ userCertificate $ x500uniqueIdentifier $ pre ferredLanguage $ userSMIMECertificate $ userPKCS12 ) ) structuralObjectClass: olcSchemaConfig entryUUID: ac0d4294-c861-1031-9bd1-5591ba7dfe32 creatorsName: cn=config createTimestamp: 20121121195915Z entryCSN: 20121121195915Z#000000#00#000000 modifiersName: cn=config modifyTimestamp: 20121121195915Z " >>> dnPrettyNormal: <cn={2}inetorgperson> => ldap_bv2dn(cn={2}inetorgperson,0) <= ldap_bv2dn(cn={2}inetorgperson)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn={2}inetorgperson)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn={2}inetorgperson)=0 <<< dnPrettyNormal: <cn={2}inetorgperson>, <cn={2}inetorgperson> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> <= str2entry(cn={2}inetorgperson) -> 0x7fcb0f61d108 => test_filter PRESENT => access_allowed: search access to "cn={2}inetorgperson,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) <= test_filter 6 ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/cn=schema/cn={3}nis.ldif" => str2entry: "dn: cn={3}nis objectClass: olcSchemaConfig cn: {3}nis olcAttributeTypes: {0}( 1.3.6.1.1.1.1.2 NAME 'gecos' DESC 'The GECOS field; th e common name' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatc h SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {1}( 1.3.6.1.1.1.1.3 NAME 'homeDirectory' DESC 'The absolut e path to the home directory' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1 466.115.121.1.26 SINGLE-VALUE ) olcAttributeTypes: {2}( 1.3.6.1.1.1.1.4 NAME 'loginShell' DESC 'The path to th e login shell' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.2 6 SINGLE-VALUE ) olcAttributeTypes: {3}( 1.3.6.1.1.1.1.5 NAME 'shadowLastChange' EQUALITY integ erMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {4}( 1.3.6.1.1.1.1.6 NAME 'shadowMin' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {5}( 1.3.6.1.1.1.1.7 NAME 'shadowMax' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {6}( 1.3.6.1.1.1.1.8 NAME 'shadowWarning' EQUALITY integerM atch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {7}( 1.3.6.1.1.1.1.9 NAME 'shadowInactive' EQUALITY integer Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {8}( 1.3.6.1.1.1.1.10 NAME 'shadowExpire' EQUALITY integerM atch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {9}( 1.3.6.1.1.1.1.11 NAME 'shadowFlag' EQUALITY integerMat ch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {10}( 1.3.6.1.1.1.1.12 NAME 'memberUid' EQUALITY caseExactI A5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1. 26 ) olcAttributeTypes: {11}( 1.3.6.1.1.1.1.13 NAME 'memberNisNetgroup' EQUALITY ca seExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.11 5.121.1.26 ) olcAttributeTypes: {12}( 1.3.6.1.1.1.1.14 NAME 'nisNetgroupTriple' DESC 'Netgr oup triple' SYNTAX 1.3.6.1.1.1.0.0 ) olcAttributeTypes: {13}( 1.3.6.1.1.1.1.15 NAME 'ipServicePort' EQUALITY intege rMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {14}( 1.3.6.1.1.1.1.16 NAME 'ipServiceProtocol' SUP name ) olcAttributeTypes: {15}( 1.3.6.1.1.1.1.17 NAME 'ipProtocolNumber' EQUALITY int egerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {16}( 1.3.6.1.1.1.1.18 NAME 'oncRpcNumber' EQUALITY integer Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) olcAttributeTypes: {17}( 1.3.6.1.1.1.1.19 NAME 'ipHostNumber' DESC 'IP address ' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128} ) olcAttributeTypes: {18}( 1.3.6.1.1.1.1.20 NAME 'ipNetworkNumber' DESC 'IP netw ork' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128} SI NGLE-VALUE ) olcAttributeTypes: {19}( 1.3.6.1.1.1.1.21 NAME 'ipNetmaskNumber' DESC 'IP netm ask' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128} SI NGLE-VALUE ) olcAttributeTypes: {20}( 1.3.6.1.1.1.1.22 NAME 'macAddress' DESC 'MAC address' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128} ) olcAttributeTypes: {21}( 1.3.6.1.1.1.1.23 NAME 'bootParameter' DESC 'rpc.bootp aramd parameter' SYNTAX 1.3.6.1.1.1.0.1 ) olcAttributeTypes: {22}( 1.3.6.1.1.1.1.24 NAME 'bootFile' DESC 'Boot image nam e' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) olcAttributeTypes: {23}( 1.3.6.1.1.1.1.26 NAME 'nisMapName' SUP name ) olcAttributeTypes: {24}( 1.3.6.1.1.1.1.27 NAME 'nisMapEntry' EQUALITY caseExac tIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121. 1.26{1024} SINGLE-VALUE ) olcObjectClasses: {0}( 1.3.6.1.1.1.2.0 NAME 'posixAccount' DESC 'Abstraction o f an account with POSIX attributes' SUP top AUXILIARY MUST ( cn $ uid $ uidNu mber $ gidNumber $ homeDirectory ) MAY ( userPassword $ loginShell $ gecos $ description ) ) olcObjectClasses: {1}( 1.3.6.1.1.1.2.1 NAME 'shadowAccount' DESC 'Additional a ttributes for shadow passwords'>>> dnPrettyNormal: <cn={3}nis> => ldap_bv2dn(cn={3}nis,0) <= ldap_bv2dn(cn={3}nis)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn={3}nis)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn={3}nis)=0 <<< dnPrettyNormal: <cn={3}nis>, <cn={3}nis> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> <= str2entry(cn={3}nis) -> 0x7fcb0f61d108 => test_filter PRESENT => access_allowed: search access to "cn={3}nis,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) <= test_filter 6 ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/cn=schema/cn={4}ad.ldif" => str2entry: "dn: cn={4}AD objectClass: olcSchemaConfig cn: {4}AD olcAttributeTypes: {0}( 1.2.840.113556.1.2.447 NAME 'mailNickname' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) olcAttributeTypes: {1}( 1.2.840.113556.1.4.782 NAME 'objectCategory' SYNTA X 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE ) olcAttributeTypes: {2}( 1.2.840.113556.1.4.221 NAME 'sAMAccountName' SYNTA X 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) olcObjectClasses: {0}( 1.2.840.113556.1.5.9 NAME 'user' SUP organizational Person STRUCTURAL MAY ( objectCategory $ mailNickname $ sAMAccountName $ di splayName $ mail ) ) olcObjectClasses: {1}( 1.2.840.113556.1.3.23 NAME 'container' SUP top STRU CTURAL MUST cn ) structuralObjectClass: olcSchemaConfig entryUUID: 6feaa26c-cf6d-1031-986d-79eaa697be5e creatorsName: cn=config createTimestamp: 20121130191106Z entryCSN: 20121130191106Z#000000#00#000000 modifiersName: cn=config modifyTimestamp: 20121130191106Z " >>> dnPrettyNormal: <cn={4}AD> => ldap_bv2dn(cn={4}AD,0) <= ldap_bv2dn(cn={4}AD)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn={4}AD)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn={4}ad)=0 <<< dnPrettyNormal: <cn={4}AD>, <cn={4}ad> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> <= str2entry(cn={4}AD) -> 0x7fcb0f61d108 => test_filter PRESENT => access_allowed: search access to "cn={4}AD,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) <= test_filter 6 ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/olcDatabase={-1}frontend.ldif" => str2entry: "dn: olcDatabase={-1}frontend objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcLastMod: TRUE olcMaxDerefDepth: 0 olcReadOnly: FALSE olcSchemaDN: cn=Subschema structuralObjectClass: olcDatabaseConfig entryUUID: ac0d771e-c861-1031-9bd3-5591ba7dfe32 creatorsName: cn=config createTimestamp: 20121121195915Z olcTimeLimit: unlimited olcSizeLimit: unlimited entryCSN: 20121214201101.233668Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20121214201101Z " >>> dnPrettyNormal: <olcDatabase={-1}frontend> => ldap_bv2dn(olcDatabase={-1}frontend,0) <= ldap_bv2dn(olcDatabase={-1}frontend)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcDatabase={-1}frontend)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcDatabase={-1}frontend)=0 <<< dnPrettyNormal: <olcDatabase={-1}frontend>, <olcDatabase={-1}frontend> >>> dnNormalize: <cn=Subschema> => ldap_bv2dn(cn=Subschema,0) <= ldap_bv2dn(cn=Subschema)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=subschema)=0 <<< dnNormalize: <cn=subschema> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> >>> dnNormalize: <cn=admin,cn=config> => ldap_bv2dn(cn=admin,cn=config,0) <= ldap_bv2dn(cn=admin,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=admin,cn=config)=0 <<< dnNormalize: <cn=admin,cn=config> <= str2entry(olcDatabase={-1}frontend) -> 0x7fcb0f61d108 => test_filter PRESENT => access_allowed: search access to "olcDatabase={-1}frontend,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) <= test_filter 6 >>> dnPrettyNormal: <cn=Subschema> => ldap_bv2dn(cn=Subschema,0) <= ldap_bv2dn(cn=Subschema)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=Subschema)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=subschema)=0 <<< dnPrettyNormal: <cn=Subschema>, <cn=subschema> >>> dnPrettyNormal: <cn=Subschema> => ldap_bv2dn(cn=Subschema,0) <= ldap_bv2dn(cn=Subschema)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=Subschema)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=subschema)=0 <<< dnPrettyNormal: <cn=Subschema>, <cn=subschema> ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/olcDatabase={0}config.ldif" => str2entry: "dn: olcDatabase={0}config objectClass: olcDatabaseConfig olcDatabase: {0}config olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=admin,cn=config olcRootPW:: Y29uZmln structuralObjectClass: olcDatabaseConfig entryUUID: ac0d8a60-c861-1031-9bd4-5591ba7dfe32 creatorsName: cn=config createTimestamp: 20121121195915Z entryCSN: 20121121195915Z#000000#00#000000 modifiersName: cn=config modifyTimestamp: 20121121195915Z " >>> dnPrettyNormal: <olcDatabase={0}config> => ldap_bv2dn(olcDatabase={0}config,0) <= ldap_bv2dn(olcDatabase={0}config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcDatabase={0}config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcDatabase={0}config)=0 <<< dnPrettyNormal: <olcDatabase={0}config>, <olcDatabase={0}config> >>> dnNormalize: <cn=admin,cn=config> => ldap_bv2dn(cn=admin,cn=config,0) <= ldap_bv2dn(cn=admin,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=admin,cn=config)=0 <<< dnNormalize: <cn=admin,cn=config> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> <= str2entry(olcDatabase={0}config) -> 0x7fcb0f61d108 => test_filter PRESENT => access_allowed: search access to "olcDatabase={0}config,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) <= test_filter 6 >>> dnPrettyNormal: <cn=admin,cn=config> => ldap_bv2dn(cn=admin,cn=config,0) <= ldap_bv2dn(cn=admin,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=admin,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=admin,cn=config)=0 <<< dnPrettyNormal: <cn=admin,cn=config>, <cn=admin,cn=config> >>> dnPrettyNormal: <cn=admin,cn=config> => ldap_bv2dn(cn=admin,cn=config,0) <= ldap_bv2dn(cn=admin,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=admin,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=admin,cn=config)=0 <<< dnPrettyNormal: <cn=admin,cn=config>, <cn=admin,cn=config> ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/olcDatabase={1}bdb.ldif" => str2entry: "dn: olcDatabase={1}bdb objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {1}bdb olcSuffix: dc=htc,dc=com olcAccess: {0}to * by dn.base="uid=push-master,cn=nupointproxy,dc=internal" w rite by * +0 break olcAccess: {1}to dn.base="" by * read olcAccess: {2}to dn.base="cn=subschema" by * read olcAccess: {3}to dn.subtree="cn=monitor" by users read by * none olcAccess: {4}to * by self write by * read olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootPW:: e1NIQX01ZW42RzZNZXpScm9UM1hLcWtkUE9tWS9CZlE9 olcDbDirectory: /var/lib/ldap/htc.com olcDbCacheSize: 150000 olcDbCheckpoint: 102400 1 olcDbConfig: {0}set_cachesize 0 268435465 1 olcDbConfig: {1}set_lg_bsize 2097152 olcDbConfig: {2}set_lg_regionmax 262144 olcDbConfig: {3}set_flags DB_LOG_AUTOREMOVE olcDbNoSync: TRUE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 150000 olcDbIndex: objectClass pres,eq olcDbIndex: cn pres,eq,sub olcDbIndex: ou pres,eq,sub olcDbIndex: mail pres,eq,sub olcDbIndex: sn pres,eq,sub olcDbIndex: givenName pres,eq,sub olcDbLinearIndex: FALSE olcDbMode: 384 olcDbSearchStack: 16 olcDbShmKey: 12321 olcDbCacheFree: 1 structuralObjectClass: olcBdbConfig entryUUID: ac0da28e-c861-1031-9bd5-5591ba7dfe32 creatorsName: cn=config createTimestamp: 20121121195915Z olcRootDN: uid=Manager,dc=htc,dc=com olcUpdateDN: uid=Push-Master,cn=NupointProxy,dc=internal entryCSN: 20121212180425.846656Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20121212180425Z " >>> dnPrettyNormal: <olcDatabase={1}bdb> => ldap_bv2dn(olcDatabase={1}bdb,0) <= ldap_bv2dn(olcDatabase={1}bdb)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcDatabase={1}bdb)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcDatabase={1}bdb)=0 <<< dnPrettyNormal: <olcDatabase={1}bdb>, <olcDatabase={1}bdb> >>> dnNormalize: <dc=htc,dc=com> => ldap_bv2dn(dc=htc,dc=com,0) <= ldap_bv2dn(dc=htc,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=htc,dc=com)=0 <<< dnNormalize: <dc=htc,dc=com> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> >>> dnNormalize: <uid=Manager,dc=htc,dc=com> => ldap_bv2dn(uid=Manager,dc=htc,dc=com,0) <= ldap_bv2dn(uid=Manager,dc=htc,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=manager,dc=htc,dc=com)=0 <<< dnNormalize: <uid=manager,dc=htc,dc=com> >>> dnNormalize: <cn=admin,cn=config> => ldap_bv2dn(cn=admin,cn=config,0) <= ldap_bv2dn(cn=admin,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=admin,cn=config)=0 <<< dnNormalize: <cn=admin,cn=config> <= str2entry(olcDatabase={1}bdb) -> 0x7fcb0f61d108 => test_filter PRESENT => access_allowed: search access to "olcDatabase={1}bdb,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) <= test_filter 6 >>> dnPrettyNormal: <dc=htc,dc=com> => ldap_bv2dn(dc=htc,dc=com,0) <= ldap_bv2dn(dc=htc,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=htc,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=htc,dc=com)=0 <<< dnPrettyNormal: <dc=htc,dc=com>, <dc=htc,dc=com> >>> dnPrettyNormal: <uid=Manager,dc=htc,dc=com> => ldap_bv2dn(uid=Manager,dc=htc,dc=com,0) <= ldap_bv2dn(uid=Manager,dc=htc,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=Manager,dc=htc,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=manager,dc=htc,dc=com)=0 <<< dnPrettyNormal: <uid=Manager,dc=htc,dc=com>, <uid=manager,dc=htc,dc=com> >>> dnPrettyNormal: <uid=Push-Master,cn=NupointProxy,dc=internal> => ldap_bv2dn(uid=Push-Master,cn=NupointProxy,dc=internal,0) <= ldap_bv2dn(uid=Push-Master,cn=NupointProxy,dc=internal)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=Push-Master,cn=NupointProxy,dc=internal)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=push-master,cn=nupointproxy,dc=internal)=0 <<< dnPrettyNormal: <uid=Push-Master,cn=NupointProxy,dc=internal>, <uid=push-master,cn=nupointproxy,dc=internal> bdb_db_init: Initializing BDB database >>> dnPrettyNormal: <dc=htc,dc=com> => ldap_bv2dn(dc=htc,dc=com,0) <= ldap_bv2dn(dc=htc,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=htc,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=htc,dc=com)=0 <<< dnPrettyNormal: <dc=htc,dc=com>, <dc=htc,dc=com> >>> dnNormalize: <uid=push-master,cn=nupointproxy,dc=internal> => ldap_bv2dn(uid=push-master,cn=nupointproxy,dc=internal,0) <= ldap_bv2dn(uid=push-master,cn=nupointproxy,dc=internal)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=push-master,cn=nupointproxy,dc=internal)=0 <<< dnNormalize: <uid=push-master,cn=nupointproxy,dc=internal> Backend ACL: access to * by dn.base="uid=push-master,cn=nupointproxy,dc=internal" write by * +0 break /etc/openldap/slapd.d: line 1: warning: cannot assess the validity of the ACL scope within backend naming context >>> dnNormalize: <> <<< dnNormalize: <> Backend ACL: access to dn.base="" by * read /etc/openldap/slapd.d: line 1: warning: ACL appears to be out of scope within backend naming context >>> dnNormalize: <cn=subschema> => ldap_bv2dn(cn=subschema,0) <= ldap_bv2dn(cn=subschema)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=subschema)=0 <<< dnNormalize: <cn=subschema> Backend ACL: access to dn.base="cn=subschema" by * read /etc/openldap/slapd.d: line 1: warning: ACL appears to be out of scope within backend naming context >>> dnNormalize: <cn=monitor> => ldap_bv2dn(cn=monitor,0) <= ldap_bv2dn(cn=monitor)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=monitor)=0 <<< dnNormalize: <cn=monitor> Backend ACL: access to dn.subtree="cn=monitor" by users read by * none /etc/openldap/slapd.d: line 1: warning: ACL appears to be out of scope within backend naming context Backend ACL: access to * by self write by * read /etc/openldap/slapd.d: line 1: warning: cannot assess the validity of the ACL scope within backend naming context >>> dnPrettyNormal: <uid=Manager,dc=htc,dc=com> => ldap_bv2dn(uid=Manager,dc=htc,dc=com,0) <= ldap_bv2dn(uid=Manager,dc=htc,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=Manager,dc=htc,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=manager,dc=htc,dc=com)=0 <<< dnPrettyNormal: <uid=Manager,dc=htc,dc=com>, <uid=manager,dc=htc,dc=com> >>> dnPrettyNormal: <uid=Push-Master,cn=NupointProxy,dc=internal> => ldap_bv2dn(uid=Push-Master,cn=NupointProxy,dc=internal,0) <= ldap_bv2dn(uid=Push-Master,cn=NupointProxy,dc=internal)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=Push-Master,cn=NupointProxy,dc=internal)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=push-master,cn=nupointproxy,dc=internal)=0 <<< dnPrettyNormal: <uid=Push-Master,cn=NupointProxy,dc=internal>, <uid=push-master,cn=nupointproxy,dc=internal> index objectClass 0x0006 index cn 0x0716 index ou 0x0716 index mail 0x0716 index sn 0x0716 index givenName 0x0716 ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/olcDatabase={2}bdb.ldif" => str2entry: "dn: olcDatabase={2}bdb objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {2}bdb olcSuffix: dc=internal olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=admin,cn=config olcSyncUseSubentry: FALSE olcMonitoring: TRUE olcDbDirectory: /var/lib/ldap/htc.internal olcDbCacheSize: 1000 olcDbCheckpoint: 100 63 olcDbNoSync: FALSE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 0 olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 structuralObjectClass: olcBdbConfig entryUUID: 92ff370e-dcc9-1031-8a59-533cee5baf07 creatorsName: cn=config createTimestamp: 20121217191324Z entryCSN: 20121217191324.652465Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20121217191324Z " >>> dnPrettyNormal: <olcDatabase={2}bdb> => ldap_bv2dn(olcDatabase={2}bdb,0) <= ldap_bv2dn(olcDatabase={2}bdb)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcDatabase={2}bdb)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcDatabase={2}bdb)=0 <<< dnPrettyNormal: <olcDatabase={2}bdb>, <olcDatabase={2}bdb> >>> dnNormalize: <dc=internal> => ldap_bv2dn(dc=internal,0) <= ldap_bv2dn(dc=internal)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=internal)=0 <<< dnNormalize: <dc=internal> >>> dnNormalize: <cn=admin,cn=config> => ldap_bv2dn(cn=admin,cn=config,0) <= ldap_bv2dn(cn=admin,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=admin,cn=config)=0 <<< dnNormalize: <cn=admin,cn=config> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> <= str2entry(olcDatabase={2}bdb) -> 0x7fcb0f61d108 => test_filter PRESENT => access_allowed: search access to "olcDatabase={2}bdb,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) <= test_filter 6 >>> dnPrettyNormal: <dc=internal> => ldap_bv2dn(dc=internal,0) <= ldap_bv2dn(dc=internal)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=internal)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=internal)=0 <<< dnPrettyNormal: <dc=internal>, <dc=internal> >>> dnPrettyNormal: <cn=admin,cn=config> => ldap_bv2dn(cn=admin,cn=config,0) <= ldap_bv2dn(cn=admin,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=admin,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=admin,cn=config)=0 <<< dnPrettyNormal: <cn=admin,cn=config>, <cn=admin,cn=config> bdb_db_init: Initializing BDB database >>> dnPrettyNormal: <dc=internal> => ldap_bv2dn(dc=internal,0) <= ldap_bv2dn(dc=internal)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=internal)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=internal)=0 <<< dnPrettyNormal: <dc=internal>, <dc=internal> >>> dnPrettyNormal: <cn=admin,cn=config> => ldap_bv2dn(cn=admin,cn=config,0) <= ldap_bv2dn(cn=admin,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=admin,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=admin,cn=config)=0 <<< dnPrettyNormal: <cn=admin,cn=config>, <cn=admin,cn=config> ldif_read_file: read entry file: "/etc/openldap/slapd.d/cn=config/olcDatabase={3}monitor.ldif" => str2entry: "dn: olcDatabase={3}monitor objectClass: olcDatabaseConfig olcDatabase: {3}monitor olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig entryUUID: 54da1e50-d8df-1031-85bf-235d062b63b6 creatorsName: cn=config createTimestamp: 20121212193904Z entryCSN: 20121212193904.665758Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20121212193904Z " >>> dnPrettyNormal: <olcDatabase={3}monitor> => ldap_bv2dn(olcDatabase={3}monitor,0) <= ldap_bv2dn(olcDatabase={3}monitor)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcDatabase={3}monitor)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcDatabase={3}monitor)=0 <<< dnPrettyNormal: <olcDatabase={3}monitor>, <olcDatabase={3}monitor> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> >>> dnNormalize: <cn=config> => ldap_bv2dn(cn=config,0) <= ldap_bv2dn(cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=config)=0 <<< dnNormalize: <cn=config> <= str2entry(olcDatabase={3}monitor) -> 0x7fcb0f61d108 => test_filter PRESENT => access_allowed: search access to "olcDatabase={3}monitor,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) <= test_filter 6 >>> dnPrettyNormal: <cn=Monitor> => ldap_bv2dn(cn=Monitor,0) <= ldap_bv2dn(cn=Monitor)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=Monitor)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=monitor)=0 <<< dnPrettyNormal: <cn=Monitor>, <cn=monitor> send_ldap_result: conn=-1 op=0 p=0 send_ldap_result: err=0 matched="" text="" matching_rule_use_init 1.2.840.113556.1.4.804 (integerBitOrMatch): matchingRuleUse: ( 1.2.840.113556.1.4.804 NAME 'integerBitOrMatch' APPLIES ( supportedLDAPVersion $ entryTtl $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcIndexIntLen $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcWriteTimeout $ olcDbCacheFree $ olcDbCacheSize $ olcDbDNcacheSize $ olcDbIDLcacheSize $ olcDbSearchStack $ olcDbShmKey $ olcChainMaxReferralDepth $ olcDbProtocolVersion $ olcDbConnectionPoolMax $ mailPreferenceOption $ shadowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpire $ shadowFlag $ ipServicePort $ ipProtocolNumber $ oncRpcNumber ) ) 1.2.840.113556.1.4.803 (integerBitAndMatch): matchingRuleUse: ( 1.2.840.113556.1.4.803 NAME 'integerBitAndMatch' APPLIES ( supportedLDAPVersion $ entryTtl $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcIndexIntLen $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcWriteTimeout $ olcDbCacheFree $ olcDbCacheSize $ olcDbDNcacheSize $ olcDbIDLcacheSize $ olcDbSearchStack $ olcDbShmKey $ olcChainMaxReferralDepth $ olcDbProtocolVersion $ olcDbConnectionPoolMax $ mailPreferenceOption $ shadowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpire $ shadowFlag $ ipServicePort $ ipProtocolNumber $ oncRpcNumber ) ) 1.3.6.1.4.1.1466.109.114.2 (caseIgnoreIA5Match): matchingRuleUse: ( 1.3.6.1.4.1.1466.109.114.2 NAME 'caseIgnoreIA5Match' APPLIES ( altServer $ olcDbConfig $ mail $ dc $ associatedDomain $ email $ aRecord $ mDRecord $ mXRecord $ nSRecord $ sOARecord $ cNAMERecord $ janetMailbox $ gecos $ homeDirectory $ loginShell $ memberUid $ memberNisNetgroup $ ipHostNumber $ ipNetworkNumber $ ipNetmaskNumber $ macAddress $ bootFile $ nisMapEntry ) ) 1.3.6.1.4.1.1466.109.114.1 (caseExactIA5Match): matchingRuleUse: ( 1.3.6.1.4.1.1466.109.114.1 NAME 'caseExactIA5Match' APPLIES ( altServer $ olcDbConfig $ mail $ dc $ associatedDomain $ email $ aRecord $ mDRecord $ mXRecord $ nSRecord $ sOARecord $ cNAMERecord $ janetMailbox $ gecos $ homeDirectory $ loginShell $ memberUid $ memberNisNetgroup $ ipHostNumber $ ipNetworkNumber $ ipNetmaskNumber $ macAddress $ bootFile $ nisMapEntry ) ) 2.5.13.39 (certificateListMatch): 2.5.13.38 (certificateListExactMatch): matchingRuleUse: ( 2.5.13.38 NAME 'certificateListExactMatch' APPLIES ( authorityRevocationList $ certificateRevocationList $ deltaRevocationList ) ) 2.5.13.35 (certificateMatch): 2.5.13.34 (certificateExactMatch): matchingRuleUse: ( 2.5.13.34 NAME 'certificateExactMatch' APPLIES ( userCertificate $ cACertificate ) ) 2.5.13.30 (objectIdentifierFirstComponentMatch): matchingRuleUse: ( 2.5.13.30 NAME 'objectIdentifierFirstComponentMatch' APPLIES ( supportedControl $ supportedExtension $ supportedFeatures $ ldapSyntaxes $ supportedApplicationContext ) ) 2.5.13.29 (integerFirstComponentMatch): matchingRuleUse: ( 2.5.13.29 NAME 'integerFirstComponentMatch' APPLIES ( supportedLDAPVersion $ entryTtl $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcIndexIntLen $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcWriteTimeout $ olcDbCacheFree $ olcDbCacheSize $ olcDbDNcacheSize $ olcDbIDLcacheSize $ olcDbSearchStack $ olcDbShmKey $ olcChainMaxReferralDepth $ olcDbProtocolVersion $ olcDbConnectionPoolMax $ mailPreferenceOption $ shadowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpire $ shadowFlag $ ipServicePort $ ipProtocolNumber $ oncRpcNumber ) ) 2.5.13.27 (generalizedTimeMatch): matchingRuleUse: ( 2.5.13.27 NAME 'generalizedTimeMatch' APPLIES ( createTimestamp $ modifyTimestamp ) ) 2.5.13.24 (protocolInformationMatch): matchingRuleUse: ( 2.5.13.24 NAME 'protocolInformationMatch' APPLIES protocolInformation ) 2.5.13.23 (uniqueMemberMatch): matchingRuleUse: ( 2.5.13.23 NAME 'uniqueMemberMatch' APPLIES uniqueMember ) 2.5.13.22 (presentationAddressMatch): matchingRuleUse: ( 2.5.13.22 NAME 'presentationAddressMatch' APPLIES presentationAddress ) 2.5.13.20 (telephoneNumberMatch): matchingRuleUse: ( 2.5.13.20 NAME 'telephoneNumberMatch' APPLIES ( telephoneNumber $ homePhone $ mobile $ pager ) ) 2.5.13.17 (octetStringMatch): matchingRuleUse: ( 2.5.13.17 NAME 'octetStringMatch' APPLIES ( userPassword $ olcDbCryptKey ) ) 2.5.13.16 (bitStringMatch): matchingRuleUse: ( 2.5.13.16 NAME 'bitStringMatch' APPLIES x500UniqueIdentifier ) 2.5.13.14 (integerMatch): matchingRuleUse: ( 2.5.13.14 NAME 'integerMatch' APPLIES ( supportedLDAPVersion $ entryTtl $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcIndexIntLen $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcWriteTimeout $ olcDbCacheFree $ olcDbCacheSize $ olcDbDNcacheSize $ olcDbIDLcacheSize $ olcDbSearchStack $ olcDbShmKey $ olcChainMaxReferralDepth $ olcDbProtocolVersion $ olcDbConnectionPoolMax $ mailPreferenceOption $ shadowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpire $ shadowFlag $ ipServicePort $ ipProtocolNumber $ oncRpcNumber ) ) 2.5.13.13 (booleanMatch): matchingRuleUse: ( 2.5.13.13 NAME 'booleanMatch' APPLIES ( hasSubordinates $ olcAddContentAcl $ olcGentleHUP $ olcHidden $ olcLastMod $ olcMirrorMode $ olcMonitoring $ olcReadOnly $ olcReverseLookup $ olcSyncUseSubentry $ olcDbChecksum $ olcDbNoSync $ olcDbDirtyRead $ olcDbLinearIndex $ olcChainCacheURI $ olcChainReturnError $ olcDbRebindAsUser $ olcDbChaseReferrals $ olcDbProxyWhoAmI $ olcDbSingleConn $ olcDbUseTemporaryConn $ olcDbNoRefs $ olcDbNoUndefFilter ) ) 2.5.13.11 (caseIgnoreListMatch): matchingRuleUse: ( 2.5.13.11 NAME 'caseIgnoreListMatch' APPLIES ( postalAddress $ registeredAddress $ homePostalAddress ) ) 2.5.13.8 (numericStringMatch): matchingRuleUse: ( 2.5.13.8 NAME 'numericStringMatch' APPLIES ( x121Address $ internationaliSDNNumber ) ) 2.5.13.7 (caseExactSubstringsMatch): matchingRuleUse: ( 2.5.13.7 NAME 'caseExactSubstringsMatch' APPLIES ( serialNumber $ destinationIndicator $ dnQualifier ) ) 2.5.13.6 (caseExactOrderingMatch): matchingRuleUse: ( 2.5.13.6 NAME 'caseExactOrderingMatch' APPLIES ( serialNumber $ destinationIndicator $ dnQualifier ) ) 2.5.13.5 (caseExactMatch): matchingRuleUse: ( 2.5.13.5 NAME 'caseExactMatch' APPLIES ( supportedSASLMechanisms $ vendorName $ vendorVersion $ ref $ name $ cn $ uid $ labeledURI $ description $ olcConfigFile $ olcConfigDir $ olcAccess $ olcAllows $ olcArgsFile $ olcAttributeOptions $ olcAttributeTypes $ olcAuthIDRewrite $ olcAuthzPolicy $ olcAuthzRegexp $ olcBackend $ olcDatabase $ olcDisallows $ olcDitContentRules $ olcInclude $ olcLdapSyntaxes $ olcLimits $ olcLogFile $ olcLogLevel $ olcModuleLoad $ olcModulePath $ olcObjectClasses $ olcObjectIdentifier $ olcOverlay $ olcPasswordCryptSaltFormat $ olcPasswordHash $ olcPidFile $ olcPlugin $ olcPluginLogFile $ olcReferral $ olcReplica $ olcReplicaArgsFile $ olcReplicaPidFile $ olcReplogFile $ olcRequires $ olcRestrict $ olcRootDSE $ olcRootPW $ olcSaslAuxprops $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ olcSecurity $ olcServerID $ olcSizeLimit $ olcSortVals $ olcSubordinate $ olcSyncrepl $ olcTCPBuffer $ olcTimeLimit $ olcTLSCACertificateFile $ olcTLSCACertificatePath $ olcTLSCertificateFile $ olcTLSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ olcTLSCRLFile $ olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ olcTLSProtocolMin $ olcUpdateRef $ olcDbDirectory $ olcDbCheckpoint $ olcDbCryptFile $ olcDbPageSize $ olcDbIndex $ olcDbLockDetect $ olcDbMode $ olcChainingBehavior $ olcDbURI $ olcDbStartTLS $ olcDbNetworkTimeout $ olcDbQuarantine $ olcDbACLPasswd $ olcDbACLBind $ olcDbIDAssertPasswd $ olcDbIDAssertBind $ olcDbIDAssertMode $ olcDbIDAssertAuthzFrom $ olcDbTFSupport $ olcDbTimeout $ olcDbIdleTimeout $ olcDbConnTtl $ olcDbCancel $ olcDbIDAssertPassThru $ olcDbSocketPath $ olcDbSocketExtensions $ knowledgeInformation $ sn $ serialNumber $ c $ l $ st $ street $ o $ ou $ title $ businessCategory $ postalCode $ postOfficeBox $ physicalDeliveryOfficeName $ destinationIndicator $ givenName $ initials $ generationQualifier $ dnQualifier $ houseIdentifier $ dmdName $ pseudonym $ textEncodedORAddress $ info $ drink $ roomNumber $ userClass $ host $ documentIdentifier $ documentTitle $ documentVersion $ documentLocation $ personalTitle $ co $ uniqueIdentifier $ organizationalStatus $ buildingName $ documentPublisher $ carLicense $ departmentNumber $ displayName $ employeeNumber $ employeeType $ preferredLanguage $ ipServiceProtocol $ nisMapName $ mailNickname $ sAMAccountName ) ) 2.5.13.4 (caseIgnoreSubstringsMatch): matchingRuleUse: ( 2.5.13.4 NAME 'caseIgnoreSubstringsMatch' APPLIES ( serialNumber $ destinationIndicator $ dnQualifier ) ) 2.5.13.3 (caseIgnoreOrderingMatch): matchingRuleUse: ( 2.5.13.3 NAME 'caseIgnoreOrderingMatch' APPLIES ( serialNumber $ destinationIndicator $ dnQualifier ) ) 2.5.13.2 (caseIgnoreMatch): matchingRuleUse: ( 2.5.13.2 NAME 'caseIgnoreMatch' APPLIES ( supportedSASLMechanisms $ vendorName $ vendorVersion $ ref $ name $ cn $ uid $ labeledURI $ description $ olcConfigFile $ olcConfigDir $ olcAccess $ olcAllows $ olcArgsFile $ olcAttributeOptions $ olcAttributeTypes $ olcAuthIDRewrite $ olcAuthzPolicy $ olcAuthzRegexp $ olcBackend $ olcDatabase $ olcDisallows $ olcDitContentRules $ olcInclude $ olcLdapSyntaxes $ olcLimits $ olcLogFile $ olcLogLevel $ olcModuleLoad $ olcModulePath $ olcObjectClasses $ olcObjectIdentifier $ olcOverlay $ olcPasswordCryptSaltFormat $ olcPasswordHash $ olcPidFile $ olcPlugin $ olcPluginLogFile $ olcReferral $ olcReplica $ olcReplicaArgsFile $ olcReplicaPidFile $ olcReplogFile $ olcRequires $ olcRestrict $ olcRootDSE $ olcRootPW $ olcSaslAuxprops $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ olcSecurity $ olcServerID $ olcSizeLimit $ olcSortVals $ olcSubordinate $ olcSyncrepl $ olcTCPBuffer $ olcTimeLimit $ olcTLSCACertificateFile $ olcTLSCACertificatePath $ olcTLSCertificateFile $ olcTLSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ olcTLSCRLFile $ olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ olcTLSProtocolMin $ olcUpdateRef $ olcDbDirectory $ olcDbCheckpoint $ olcDbCryptFile $ olcDbPageSize $ olcDbIndex $ olcDbLockDetect $ olcDbMode $ olcChainingBehavior $ olcDbURI $ olcDbStartTLS $ olcDbNetworkTimeout $ olcDbQuarantine $ olcDbACLPasswd $ olcDbACLBind $ olcDbIDAssertPasswd $ olcDbIDAssertBind $ olcDbIDAssertMode $ olcDbIDAssertAuthzFrom $ olcDbTFSupport $ olcDbTimeout $ olcDbIdleTimeout $ olcDbConnTtl $ olcDbCancel $ olcDbIDAssertPassThru $ olcDbSocketPath $ olcDbSocketExtensions $ knowledgeInformation $ sn $ serialNumber $ c $ l $ st $ street $ o $ ou $ title $ businessCategory $ postalCode $ postOfficeBox $ physicalDeliveryOfficeName $ destinationIndicator $ givenName $ initials $ generationQualifier $ dnQualifier $ houseIdentifier $ dmdName $ pseudonym $ textEncodedORAddress $ info $ drink $ roomNumber $ userClass $ host $ documentIdentifier $ documentTitle $ documentVersion $ documentLocation $ personalTitle $ co $ uniqueIdentifier $ organizationalStatus $ buildingName $ documentPublisher $ carLicense $ departmentNumber $ displayName $ employeeNumber $ employeeType $ preferredLanguage $ ipServiceProtocol $ nisMapName $ mailNickname $ sAMAccountName ) ) 1.2.36.79672281.1.13.3 (rdnMatch): 2.5.13.1 (distinguishedNameMatch): matchingRuleUse: ( 2.5.13.1 NAME 'distinguishedNameMatch' APPLIES ( creatorsName $ modifiersName $ subschemaSubentry $ entryDN $ namingContexts $ aliasedObjectName $ dynamicSubtrees $ distinguishedName $ seeAlso $ olcDefaultSearchBase $ olcRootDN $ olcSchemaDN $ olcSuffix $ olcUpdateDN $ olcDbACLAuthcDn $ olcDbIDAssertAuthcDn $ olcRelay $ member $ owner $ roleOccupant $ manager $ documentAuthor $ secretary $ associatedName $ dITRedirect $ objectCategory ) ) 2.5.13.0 (objectIdentifierMatch): matchingRuleUse: ( 2.5.13.0 NAME 'objectIdentifierMatch' APPLIES ( supportedControl $ supportedExtension $ supportedFeatures $ supportedApplicationContext ) ) slapd startup: initiated. backend_startup_one: starting "cn=config" config_back_db_open Backend ACL: access to * by * none config_back_db_open: line 0: warning: cannot assess the validity of the ACL scope within backend naming context backend_startup_one: starting "dc=htc,dc=com" bdb_db_open: "dc=htc,dc=com" bdb_db_open: database "dc=htc,dc=com": dbenv_open(/var/lib/ldap/htc.com). backend_startup_one: starting "dc=internal" bdb_db_open: "dc=internal" bdb_db_open: warning - no DB_CONFIG file found in directory /var/lib/ldap/htc.internal: (2). Expect poor performance for suffix "dc=internal". bdb_db_open: database "dc=internal": dbenv_open(/var/lib/ldap/htc.internal). backend_startup_one: starting "cn=Monitor" >>> dnNormalize: <cn=Monitor> <<< dnNormalize: <cn=monitor> >>> dnPretty: <cn=Backends> => ldap_bv2dn(cn=Backends,0) <= ldap_bv2dn(cn=Backends)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=Backends)=0 <<< dnPretty: <cn=Backends> >>> dnNormalize: <cn=Backends> <<< dnNormalize: <cn=backends> >>> dnPretty: <cn=Connections> => ldap_bv2dn(cn=Connections,0) <= ldap_bv2dn(cn=Connections)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=Connections)=0 <<< dnPretty: <cn=Connections> >>> dnNormalize: <cn=Connections> <<< dnNormalize: <cn=connections> >>> dnPretty: <cn=Databases> => ldap_bv2dn(cn=Databases,0) <= ldap_bv2dn(cn=Databases)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=Databases)=0 <<< dnPretty: <cn=Databases> >>> dnNormalize: <cn=Databases> <<< dnNormalize: <cn=databases> >>> dnPretty: <cn=Listeners> => ldap_bv2dn(cn=Listeners,0) <= ldap_bv2dn(cn=Listeners)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=Listeners)=0 <<< dnPretty: <cn=Listeners> >>> dnNormalize: <cn=Listeners> <<< dnNormalize: <cn=listeners> >>> dnPretty: <cn=Log> => ldap_bv2dn(cn=Log,0) <= ldap_bv2dn(cn=Log)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=Log)=0 <<< dnPretty: <cn=Log> >>> dnNormalize: <cn=Log> <<< dnNormalize: <cn=log> >>> dnPretty: <cn=Operations> => ldap_bv2dn(cn=Operations,0) <= ldap_bv2dn(cn=Operations)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=Operations)=0 <<< dnPretty: <cn=Operations> >>> dnNormalize: <cn=Operations> <<< dnNormalize: <cn=operations> >>> dnPretty: <cn=Overlays> => ldap_bv2dn(cn=Overlays,0) <= ldap_bv2dn(cn=Overlays)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=Overlays)=0 <<< dnPretty: <cn=Overlays> >>> dnNormalize: <cn=Overlays> <<< dnNormalize: <cn=overlays> >>> dnPretty: <cn=SASL> => ldap_bv2dn(cn=SASL,0) <= ldap_bv2dn(cn=SASL)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=SASL)=0 <<< dnPretty: <cn=SASL> >>> dnNormalize: <cn=SASL> <<< dnNormalize: <cn=sasl> >>> dnPretty: <cn=Statistics> => ldap_bv2dn(cn=Statistics,0) <= ldap_bv2dn(cn=Statistics)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=Statistics)=0 <<< dnPretty: <cn=Statistics> >>> dnNormalize: <cn=Statistics> <<< dnNormalize: <cn=statistics> >>> dnPretty: <cn=Threads> => ldap_bv2dn(cn=Threads,0) <= ldap_bv2dn(cn=Threads)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=Threads)=0 <<< dnPretty: <cn=Threads> >>> dnNormalize: <cn=Threads> <<< dnNormalize: <cn=threads> >>> dnPretty: <cn=Time> => ldap_bv2dn(cn=Time,0) <= ldap_bv2dn(cn=Time)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=Time)=0 <<< dnPretty: <cn=Time> >>> dnNormalize: <cn=Time> <<< dnNormalize: <cn=time> >>> dnPretty: <cn=TLS> => ldap_bv2dn(cn=TLS,0) <= ldap_bv2dn(cn=TLS)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=TLS)=0 <<< dnPretty: <cn=TLS> >>> dnNormalize: <cn=TLS> <<< dnNormalize: <cn=tls> >>> dnPretty: <cn=Waiters> => ldap_bv2dn(cn=Waiters,0) <= ldap_bv2dn(cn=Waiters)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=Waiters)=0 <<< dnPretty: <cn=Waiters> >>> dnNormalize: <cn=Waiters> <<< dnNormalize: <cn=waiters> >>> dnNormalize: <cn=Backend 0> <<< dnNormalize: <cn=backend 0> >>> dnNormalize: <cn=Database 0,cn=Databases,cn=Monitor> => ldap_bv2dn(cn=Database 0,cn=Databases,cn=Monitor,0) <= ldap_bv2dn(cn=Database 0,cn=Databases,cn=Monitor)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=database 0,cn=databases,cn=monitor)=0 <<< dnNormalize: <cn=database 0,cn=databases,cn=monitor> >>> dnNormalize: <cn=Backend 1> <<< dnNormalize: <cn=backend 1> >>> dnNormalize: <cn=Backend 2> <<< dnNormalize: <cn=backend 2> >>> dnNormalize: <cn=Database 3,cn=Databases,cn=Monitor> => ldap_bv2dn(cn=Database 3,cn=Databases,cn=Monitor,0) <= ldap_bv2dn(cn=Database 3,cn=Databases,cn=Monitor)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=database 3,cn=databases,cn=monitor)=0 <<< dnNormalize: <cn=database 3,cn=databases,cn=monitor> >>> dnNormalize: <cn=Backend 3> <<< dnNormalize: <cn=backend 3> >>> dnNormalize: <cn=Database 1,cn=Databases,cn=Monitor> => ldap_bv2dn(cn=Database 1,cn=Databases,cn=Monitor,0) <= ldap_bv2dn(cn=Database 1,cn=Databases,cn=Monitor)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=database 1,cn=databases,cn=monitor)=0 <<< dnNormalize: <cn=database 1,cn=databases,cn=monitor> >>> dnNormalize: <cn=Database 2,cn=Databases,cn=Monitor> => ldap_bv2dn(cn=Database 2,cn=Databases,cn=Monitor,0) <= ldap_bv2dn(cn=Database 2,cn=Databases,cn=Monitor)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=database 2,cn=databases,cn=monitor)=0 <<< dnNormalize: <cn=database 2,cn=databases,cn=monitor> >>> dnNormalize: <cn=Backend 4> <<< dnNormalize: <cn=backend 4> >>> dnNormalize: <cn=Backend 5> <<< dnNormalize: <cn=backend 5> >>> dnNormalize: <cn=Backend 6> <<< dnNormalize: <cn=backend 6> >>> dnNormalize: <cn=Backend 7> <<< dnNormalize: <cn=backend 7> >>> dnNormalize: <cn=Backend 8> <<< dnNormalize: <cn=backend 8> >>> dnNormalize: <cn=Backend 9> <<< dnNormalize: <cn=backend 9> >>> dnNormalize: <cn=Backend 10> <<< dnNormalize: <cn=backend 10> >>> dnNormalize: <cn=Backend 11> <<< dnNormalize: <cn=backend 11> >>> dnNormalize: <cn=Max File Descriptors> <<< dnNormalize: <cn=max file descriptors> >>> dnNormalize: <cn=Total> <<< dnNormalize: <cn=total> >>> dnNormalize: <cn=Current> <<< dnNormalize: <cn=current> >>> dnNormalize: <cn=Frontend> <<< dnNormalize: <cn=frontend> >>> dnNormalize: <cn=Database 0> <<< dnNormalize: <cn=database 0> >>> dnNormalize: <cn=Backend 0,cn=Backends,cn=Monitor> => ldap_bv2dn(cn=Backend 0,cn=Backends,cn=Monitor,0) <= ldap_bv2dn(cn=Backend 0,cn=Backends,cn=Monitor)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=backend 0,cn=backends,cn=monitor)=0 <<< dnNormalize: <cn=backend 0,cn=backends,cn=monitor> >>> dnNormalize: <cn=Database 1> <<< dnNormalize: <cn=database 1> >>> dnNormalize: <cn=Backend 3,cn=Backends,cn=Monitor> => ldap_bv2dn(cn=Backend 3,cn=Backends,cn=Monitor,0) <= ldap_bv2dn(cn=Backend 3,cn=Backends,cn=Monitor)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=backend 3,cn=backends,cn=monitor)=0 <<< dnNormalize: <cn=backend 3,cn=backends,cn=monitor> >>> dnNormalize: <cn=Database 2> <<< dnNormalize: <cn=database 2> >>> dnNormalize: <cn=Backend 3,cn=Backends,cn=Monitor> => ldap_bv2dn(cn=Backend 3,cn=Backends,cn=Monitor,0) <= ldap_bv2dn(cn=Backend 3,cn=Backends,cn=Monitor)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=backend 3,cn=backends,cn=monitor)=0 <<< dnNormalize: <cn=backend 3,cn=backends,cn=monitor> >>> dnNormalize: <cn=Database 3> <<< dnNormalize: <cn=database 3> >>> dnNormalize: <cn=Backend 2,cn=Backends,cn=Monitor> => ldap_bv2dn(cn=Backend 2,cn=Backends,cn=Monitor,0) <= ldap_bv2dn(cn=Backend 2,cn=Backends,cn=Monitor)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=backend 2,cn=backends,cn=monitor)=0 <<< dnNormalize: <cn=backend 2,cn=backends,cn=monitor> >>> dnNormalize: <cn=Listener 0> <<< dnNormalize: <cn=listener 0> >>> dnNormalize: <cn=Listener 1> <<< dnNormalize: <cn=listener 1> >>> dnNormalize: <cn=Bind> <<< dnNormalize: <cn=bind> >>> dnNormalize: <cn=Unbind> <<< dnNormalize: <cn=unbind> >>> dnNormalize: <cn=Search> <<< dnNormalize: <cn=search> >>> dnNormalize: <cn=Compare> <<< dnNormalize: <cn=compare> >>> dnNormalize: <cn=Modify> <<< dnNormalize: <cn=modify> >>> dnNormalize: <cn=Modrdn> <<< dnNormalize: <cn=modrdn> >>> dnNormalize: <cn=Add> <<< dnNormalize: <cn=add> >>> dnNormalize: <cn=Delete> <<< dnNormalize: <cn=delete> >>> dnNormalize: <cn=Abandon> <<< dnNormalize: <cn=abandon> >>> dnNormalize: <cn=Extended> <<< dnNormalize: <cn=extended> >>> dnNormalize: <cn=Overlay 0> <<< dnNormalize: <cn=overlay 0> >>> dnNormalize: <cn=Overlay 1> <<< dnNormalize: <cn=overlay 1> >>> dnNormalize: <cn=Overlay 2> <<< dnNormalize: <cn=overlay 2> >>> dnNormalize: <cn=Overlay 3> <<< dnNormalize: <cn=overlay 3> >>> dnNormalize: <cn=Bytes> <<< dnNormalize: <cn=bytes> >>> dnNormalize: <cn=PDU> <<< dnNormalize: <cn=pdu> >>> dnNormalize: <cn=Entries> <<< dnNormalize: <cn=entries> >>> dnNormalize: <cn=Referrals> <<< dnNormalize: <cn=referrals> >>> dnNormalize: <cn=Max> <<< dnNormalize: <cn=max> >>> dnNormalize: <cn=Max Pending> <<< dnNormalize: <cn=max pending> >>> dnNormalize: <cn=Open> <<< dnNormalize: <cn=open> >>> dnNormalize: <cn=Starting> <<< dnNormalize: <cn=starting> >>> dnNormalize: <cn=Active> <<< dnNormalize: <cn=active> >>> dnNormalize: <cn=Pending> <<< dnNormalize: <cn=pending> >>> dnNormalize: <cn=Backload> <<< dnNormalize: <cn=backload> >>> dnNormalize: <cn=State> <<< dnNormalize: <cn=state> >>> dnNormalize: <cn=Runqueue> <<< dnNormalize: <cn=runqueue> >>> dnNormalize: <cn=Tasklist> <<< dnNormalize: <cn=tasklist> >>> dnNormalize: <cn=Start> <<< dnNormalize: <cn=start> >>> dnNormalize: <cn=Current> <<< dnNormalize: <cn=current> >>> dnNormalize: <cn=Uptime> <<< dnNormalize: <cn=uptime> >>> dnNormalize: <cn=Read> <<< dnNormalize: <cn=read> >>> dnNormalize: <cn=Write> <<< dnNormalize: <cn=write> slapd starting daemon: added 4r listener=(nil) daemon: added 7r listener=0x7fcb0f5bc2d0 daemon: added 8r listener=0x7fcb0f5bc390 daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: activity on 1 descriptor daemon: activity on: slap_listener_activate(7): daemon: epoll: listen=7 busy daemon: epoll: listen=8 active_threads=0 tvp=zero >>> slap_listener(ldap:///) daemon: activity on 1 descriptor daemon: activity on:daemon: listen=7, new connection on 16 daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: added 16r (active) listener=(nil) conn=1000 fd=16 ACCEPT from IP=172.24.10.201:23867 (IP=0.0.0.0:389) daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: activity on 1 descriptor daemon: activity on: 16r daemon: read active on 16 daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero connection_get(16) connection_get(16): got connid=1000 connection_read(16): checking for input on id=1000 ber_get_next ldap_read: want=8, got=8 0000: 30 60 02 01 01 60 33 02 0`...`3. ldap_read: want=90, got=90 0000: 01 03 04 19 75 69 64 3d 4e 75 50 6f 69 6e 74 2c ....uid=NuPoint, 0010: 64 63 3d 68 74 63 2c 64 63 3d 63 6f 6d 80 13 64 dc=htc,dc=com..d 0020: 65 63 20 31 33 20 32 30 31 32 20 63 72 65 61 74 ec 13 2012 creat 0030: 65 64 a0 26 30 24 04 16 31 2e 32 2e 38 34 30 2e ed.&0$..1.2.840. 0040: 31 31 33 35 35 36 2e 31 2e 34 2e 33 31 39 01 01 113556.1.4.319.. 0050: ff 04 07 30 05 02 01 0a 04 00 ...0...... ber_get_next: tag 0x30 len 96 contents: ber_dump: buf=0x7fcad8000920 ptr=0x7fcad8000920 end=0x7fcad8000980 len=96 0000: 02 01 01 60 33 02 01 03 04 19 75 69 64 3d 4e 75 ...`3.....uid=Nu 0010: 50 6f 69 6e 74 2c 64 63 3d 68 74 63 2c 64 63 3d Point,dc=htc,dc= 0020: 63 6f 6d 80 13 64 65 63 20 31 33 20 32 30 31 32 com..dec 13 2012 0030: 20 63 72 65 61 74 65 64 a0 26 30 24 04 16 31 2e created.&0$..1. 0040: 32 2e 38 34 30 2e 31 31 33 35 35 36 2e 31 2e 34 2.840.113556.1.4 0050: 2e 33 31 39 01 01 ff 04 07 30 05 02 01 0a 04 00 .319.....0...... op tag 0x60, time 1355857467 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable daemon: activity on 1 descriptor daemon: activity on: conn=1000 op=0 do_bind daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero ber_scanf fmt ({imt) ber: ber_dump: buf=0x7fcad8000920 ptr=0x7fcad8000923 end=0x7fcad8000980 len=93 0000: 60 33 02 01 03 04 19 75 69 64 3d 4e 75 50 6f 69 `3.....uid=NuPoi 0010: 6e 74 2c 64 63 3d 68 74 63 2c 64 63 3d 63 6f 6d nt,dc=htc,dc=com 0020: 80 13 64 65 63 20 31 33 20 32 30 31 32 20 63 72 ..dec 13 2012 cr 0030: 65 61 74 65 64 a0 26 30 24 04 16 31 2e 32 2e 38 eated.&0$..1.2.8 0040: 34 30 2e 31 31 33 35 35 36 2e 31 2e 34 2e 33 31 40.113556.1.4.31 0050: 39 01 01 ff 04 07 30 05 02 01 0a 04 00 9.....0...... ber_scanf fmt (m}) ber: ber_dump: buf=0x7fcad8000920 ptr=0x7fcad8000943 end=0x7fcad8000980 len=61 0000: 00 13 64 65 63 20 31 33 20 32 30 31 32 20 63 72 ..dec 13 2012 cr 0010: 65 61 74 65 64 a0 26 30 24 04 16 31 2e 32 2e 38 eated.&0$..1.2.8 0020: 34 30 2e 31 31 33 35 35 36 2e 31 2e 34 2e 33 31 40.113556.1.4.31 0030: 39 01 01 ff 04 07 30 05 02 01 0a 04 00 9.....0...... => get_ctrls ber_scanf fmt ({m) ber: ber_dump: buf=0x7fcad8000920 ptr=0x7fcad800095a end=0x7fcad8000980 len=38 0000: 30 24 04 16 31 2e 32 2e 38 34 30 2e 31 31 33 35 0$..1.2.840.1135 0010: 35 36 2e 31 2e 34 2e 33 31 39 01 01 ff 04 07 30 56.1.4.319.....0 0020: 05 02 01 0a 04 00 ...... ber_scanf fmt (b) ber: ber_dump: buf=0x7fcad8000920 ptr=0x7fcad8000974 end=0x7fcad8000980 len=12 0000: 00 01 ff 04 07 30 05 02 01 0a 04 00 .....0...... ber_scanf fmt (m) ber: ber_dump: buf=0x7fcad8000920 ptr=0x7fcad8000977 end=0x7fcad8000980 len=9 0000: 04 07 30 05 02 01 0a 04 00 ..0...... => get_ctrls: oid="1.2.840.113556.1.4.319" (critical) <= get_ctrls: n=1 rc=12 err="critical extension is unavailable" send_ldap_result: conn=1000 op=0 p=3 send_ldap_result: err=12 matched="" text="critical extension is unavailable" send_ldap_response: msgid=1 tag=97 err=12 ber_flush2: 47 bytes to sd 16 0000: 30 2d 02 01 01 61 28 0a 01 0c 04 00 04 21 63 72 0-...a(......!cr 0010: 69 74 69 63 61 6c 20 65 78 74 65 6e 73 69 6f 6e itical extension 0020: 20 69 73 20 75 6e 61 76 61 69 6c 61 62 6c 65 is unavailable ldap_write: want=47, written=47 0000: 30 2d 02 01 01 61 28 0a 01 0c 04 00 04 21 63 72 0-...a(......!cr 0010: 69 74 69 63 61 6c 20 65 78 74 65 6e 73 69 6f 6e itical extension 0020: 20 69 73 20 75 6e 61 76 61 69 6c 61 62 6c 65 is unavailable conn=1000 op=0 RESULT tag=97 err=12 text=critical extension is unavailable conn=1000 op=0 do_bind: get_ctrls failed daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: activity on 1 descriptor daemon: activity on: 16r daemon: read active on 16 daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero connection_get(16) connection_get(16): got connid=1000 connection_read(16): checking for input on id=1000 ber_get_next ldap_read: want=8, got=0 ber_get_next on fd 16 failed errno=0 (Success) connection_read(16): input error=-2 id=1000, closing. connection_closing: readying conn=1000 sd=16 for close connection_close: conn=1000 sd=16 daemon: activity on 1 descriptor daemon: activity on: daemon: removing 16 conn=1000 fd=16 closed (connection lost) daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: epoll: listen=8 active_threads=0 tvp=zero ^Cdaemon: shutdown requested and initiated. daemon: closing 7 daemon: closing 8 slapd shutdown: waiting for 0 operations/tasks to finish slapd shutdown: initiated ====> bdb_cache_release_all ====> bdb_cache_release_all slapd destroy: freeing system resources. slapd stopped. [root@radius1 openldap]# exit exit Script done on Tue 18 Dec 2012 03:06:10 PM EST ********************************************************************** HTC Disclaimer: The information contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the message and deleting it from your computer. Thank you. **********************************************************************

3 2

Re: Fwd: Multi-Master OpenLDAP Replication for 3 nodes -- slapadd command failing
by fal patel 05 Jan '13

05 Jan '13

Oho, so you agree that the OpenLDAP Guide Section 18.3.3 "N-Way Multi-Master" fails to work as is with the Section 10.2 "Creating a database off-line", specifically with Section 10.2.1 "The slapadd program"? And you're failing or refusing to provide a LDIF file for the above that that actually works? That means you don't have "enough understanding and general competence" to make your own product, OpenLDAP, work according to the description in your own manual, the "OpenLDAP 2.4 Administrator's Guide". Your product is a joke and you're another. I hereby unsubscribe from this mailing list. Fal On Thu, Jan 3, 2013 at 9:51 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Thursday, January 03, 2013 9:28 PM -0800 fal patel < > fal0patel(a)gmail.com> wrote: > > It should be acceptable as an LDIF as input to slapadd. >> If it is not, it is buggy by definition. >> Remember, we should be able to perform database configuration OFF-LINE. >> ie. without slapd running. >> And obviously when off-line, slapadd works whereas ldapmodify, ldapadd >> etc. cannot. >> > > If you would spend the time to start with a basic cn=config setup, and > then perform the ldap modifications as noted in the admin guide, your end > result would be a cn=config DB you could *slapcat* into LDIF, which you > could then use as a template for loading other servers. In fact, you'd be > long done with this if you'd simply done that very simple thing. > > Just because slapadd doesn't parse LDIF meant for ldap modify does *not* > mean it is buggy. It means you are following the admin guide. > > The admin guide is not a document that explains how to do anything and > everything under the sun. It is a general guide that gives working > examples of how to do various things. The end user is supposed to have > enough understanding and general competence to be able to extrapolate how > to go from there. > > In addition, you've also been pointed to test suites that set up > multi-master replication of cn=config. You could have trivially exported > those cn=config DB's via slapcat as well. > > You seem awfully determined to have other people take the time to do your > work for you, rather than doing what you could have already done weeks ago > in a few minutes. > > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

Re: About TLS - ldaps search
by Bheeshma SM 05 Jan '13

05 Jan '13

Is there a specific way, i have to configure the slapd to listem to 636 port..? And does the 389 search is a secure search...? Is there a particular way of Starting the TLS operation..? Thanks in advance On Fri, Jan 4, 2013 at 4:31 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Friday, January 04, 2013 4:09 PM -0800 Bheeshma SM < > bheeshma.manjunath(a)gmail.com> wrote: > > >> Hi guys. >> >> I have a problem in Openldap 2.4.33 on RHEL 5.8 >> >> I am able to do a " ldapsearch -x -p 389 -h -D<> -w<> -b<> " >> >> but i am not able to do >> >> " ldapsearch -x -p 636 -h -D<> -w<> -b<> >> > > Sounds like slapd is not configured to listen to port 636. No amount of > mucking with ldapsearch is going to change that. > > I would note that you can do secure searches over port 389 just fine. > Simply use the startTLS operation. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

About TLS - ldaps search
by Bheeshma SM 05 Jan '13

05 Jan '13

Hi guys. I have a problem in Openldap 2.4.33 on RHEL 5.8 I am able to do a *" ldapsearch -x -p 389 -h -D<> -w<> -b<> "* but i am not able to do *" ldapsearch -x -p 636 -h -D<> -w<> -b<>* I have done all the changes in ldap.conf and certificates are working fine. The weird thing is *"ldapsearch -x -H **ldaps://hostname* <ldaps://hostname>* -D <> -w <> -b<> " is working fine.* What i am trying to do is-- I want to disable the 389 port so that is no searches running in the non-secure port. So can any1 tell me why the *" ldapsearch -x -p 636 -h -D<> -w<> -b<>" [secure search is not working]* Please help me out in this. Thanks in advance. -bhee

2 1

Forcing TLS, but keep working SASL authentication
by Wiebe Cazemier 04 Jan '13

04 Jan '13

Hi, I want to force SSL on my OpenLDAP server (2.4.21-0ubuntu5.7, Ubuntu 10.04 LTS), but then the SASL authentication breaks. I did this to enable tls-only: # feed to ldapmodify dn: cn=config changetype: modify add: olcSecurity olcSecurity: tls=1 But, then I can't use "-Y EXTERNAL" anymore, because it then demands a TLS connection. When I enable TLS (-ZZ) on tools like ldapmodify and use ldap://hostname/ and bind with my rootDN (admin user), it doesn't work (insufficient access (50)). I guess it needs the socket to know I'm root. Inspecting all DB's with "ldapsearch -LLL -Y EXTERNAL -H ldapi:/// -b cn=config", it appears the config DB's have an olcAccess rule like: olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by * break gid and uid = 0, so I guess it's the system's root account. I tried adding an olcRootDN and olcRootPW to olcDatabase={0}config,cn=config so that I could modify the cn=config, but adding them gave an error: "<olcRootPW> can only be set when rootdn is under suffix". When I tried adding olcSuffix to "dc=domain,dc=tld", it said: "<olcSuffix> handler exited with 1". I also tried specifying a olcRootDN only (no olcRootPW) (like cn=admin,dc=domain,dc=tld) and then add that user to "dc=domain,dc=tld", but it didn't work. Unfortunately, I don't remember what went wrong. So, is there a way to enforce TLS but still use the SASL authentication? Any help is appreciated. Thanks in advance, Wiebe Cazemier

2 3

Fwd: Multi-Master OpenLDAP Replication for 3 nodes -- slapadd command failing
by fal patel 04 Jan '13

04 Jan '13

---------- Forwarded message ---------- From: fal patel <fal0patel(a)gmail.com> Date: Thu, Jan 3, 2013 at 3:28 PM Subject: Re: Multi-Master OpenLDAP Replication for 3 nodes -- slapadd command failing To: openldap-technica(a)openldapl.org, Howard Chu <hyc(a)symas.com>, Philip Guenther <guenther+ldaptech(a)sendmail.com> Cc: fal patel <fal0patel(a)gmail.com> Hi Howard and Philip, Thank you very much for your emails. Well, it doesn't work for me, and hasn't for the two weeks I've been wrestling with it. Could you please post a *working* LDIF file of Section 18.3.3 "N-Way Multi-Master"? (I can substitute my real values if you keep the "$xxx" labels in there, of course.) I want to be able to feed the above LDIF file in to slapadd and obtain both config db replication and also data replication. The only change I should have to make for my 3 OpenLDAP servers is that the Server#1 should have "olcServerID: 1", Server#2 should have "olcServerID: 2", etc. Thanks very much. Best regards Fal On Thu, Jan 3, 2013 at 6:40 AM, Howard Chu <hyc(a)symas.com> wrote: > fal patel wrote: > >> Hi Philip, >> >> hank you very much for your email. >> >> In that case, my original surmise is correct: The OpenLDAP >> Administrator's >> Guide's Section 18.3.3 "N-Way Multi-Master" definitely is buggy. >> Because my LDIF file is a direct copy thereof (except for my environment >> values substituted in instead of the labels such as $URI1, of course.) >> > > The example in 18.3.3 works perfectly when you substitute the correct > values in for the variables and follow the steps listed. > > > How can this be reported as a bug, please? (In OpenLDAP documentation >> or/and >> code). >> And can a *working* sample LDIF file be provided, please, for this >> important >> replication design, n-way multi-master? >> > > -- > -- Howard Chu > CTO, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc/ > Chief Architect, OpenLDAP http://www.openldap.org/**project/<http://www.openldap.org/project/> >

3 3

authentication for users in referral branch
by Wu, James C. 04 Jan '13

04 Jan '13

Hi, I have sent out a relevant email about this issue before but the context was a little bit complicated. So I simplified the settings and post this issue again, hoping to get more attentions from this mailing list. I am trying to set up a testing environment in which there are two openldap servers and have one server (externalldap) refer to the second server (internalldap) for some users in a subtree (sub.example.com). Both servers contains some POSIX users. However, I could not get the authentication for the users in the referral branch to work. For example, this command fails. ldapwhoami -d -1 -x -H ldap://externalldap -D "uid=mark,ou=People,dc=sub,dc=example,dc=com" -w password The log of the externalldap shows as follows: 50e6279d bdb_dn2entry("uid=mark,ou=people,dc=sub,dc=example,dc=com") 50e6279d => bdb_dn2id("dc=example,dc=com") 50e6279d <= bdb_dn2id: got id=0x1 50e6279d => bdb_dn2id("dc=sub,dc=example,dc=com") 50e6279d <= bdb_dn2id: got id=0x6 50e6279d => bdb_dn2id("ou=people,dc=sub,dc=example,dc=com") 50e6279d <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30988) I am wondering why the externalldap did not just send the client the uri of the referral ldap box and have the client connect directly to the internalldap instead. Similarly error also happened when I use ldapsearch command ldapsearch -d -1 -x -H ldap:// externalldap -D "uid=mark,ou=People,dc=sub,dc=example,dc=com" -w password -CC The referral record is defined as follows and added into the external ldap using ldapadd command. dn: dc=sub,dc=example,dc=com objectClass: referral objectClass: extensibleObject dc: sub ref: ldap://10.42.13.212/dc=sub,dc=example,dc=com The slapd.conf of both the external and the internal ldap are defined as follows: #referral ldap://root.openldap.org pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=example;dc=com" rootdn "cn=Manager,dc=example,dc=com" rootpw password directory /usr/local/var/openldap-data # Indices to maintain index objectClass eq TLSCACertificateFile /etc/pki/tls/certs/example_cert.pem TLSCertificateFile /etc/pki/tls/certs/example_cert.pem TLSCertificateKeyFile /etc/pki/tls/certs/example_key.pem # configure the SASL parameters sasl-host localhost sasl-secprops none For the client, I am just using the default settings. I believe referral chasing is enabled by default in the ldap client library. I have spent more than two weeks on this problem and the project is delayed quite a lot. Referral in LDAP has been in RFC for more than five years. I can not believe that OpenLDAP's implementation of referral can't handle authentication. Can anyone kindly let me know what is missing from my setup? Regards, James

1 0

referral authentication
by Wu, James C. 03 Jan '13

03 Jan '13

Hi Kurt, I saw you once replied a question by Ming Hou about referral authentication. Could you let me know how to do it? I read through the man pages slap and slapd-ldap and still could not have it work. http://linux.die.net/man/5/slapd-ldap http://linux.die.net/man/8/slapd the rebind-as-user option does not seem to be supported by openldap. Regards, James

1 0

Re: Multi-Master OpenLDAP Replication for 3 nodes -- slapadd command failing
by fal patel 03 Jan '13

03 Jan '13

Hey Quanah, Oh no, my question was whether an arbitrary external variable (eg. URI1) could be set (eg. to ldap://host1.hq.mycompany.com:389/) inside an LDIF file and used in subsequent places in the file. (to avoid having to type in the value in multiple places). I suppose not? Assuming not, I typed in each value into all its relevant places in my LDIF file and re-ran slapadd. Now it gives me the following error (on latest redhat 64bit): loaded module syncprov.la *module syncprov.la: null module registered* Surely the above message signifies an error? Anyway, processing continues until it gives the following final error: >>> dnPrettyNormal: <cn=config> <<< dnPrettyNormal: <cn=config>, <cn=config> *<= str2entry: str2ad(changetype): attribute type undefined* slapadd: could not parse entry (line=48) Could you please advise? I have no clue as to what is going wrong. I have attached the LDIF file "nwaymmr2s.ldif" and the debug output from running the command slapadd -d -1 -v -F /etc/openldap/slapd.d -n 0 -l /etc/openldap/nwaymmr2s.ldif >& output.txt. Also, do I need to run slappasswd and copy the hash value from it into my LDIF' file's olcRootPW field value? Or can I just keep the original value, "secret"? And a final question, please: Why does the data replication (unlike the config replication, which does operate in refreshAndPersist mode) have to operate in refreshOnly mode? Why can't it operate in refreshAndPersist mode? Thank you very much. Fal On Mon, Dec 31, 2012 at 12:49 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Monday, December 31, 2012 9:49 AM -0800 fal patel < > fal0patel(a)gmail.com> wrote: > > Hey Quanah, >> >> Thank you very much for the debugging tip! -- Using it I got further in. >> Now I get an error "<= str2entry: str2ad(UR1): attribute type undefined". >> I must be setting my external variables (such as UR1) incorrectly in my >> LDIF file. >> What is the correct syntax for setting them, please? >> I tried each of the following sentences, none of which worked: >> URI1: ldap://host1.hq.mycompany.com:**389/<http://host1.hq.mycompany.com:389/> >> URI1: ldap://host1.hq.mycompany.com:**389<http://host1.hq.mycompany.com:389> >> URI1: "ldap://host1.hq.mycompany.**com:389/<http://host1.hq.mycompany.com:389/> >> " >> URI1="ldap://host1.hq.**mycompany.com:389/<http://host1.hq.mycompany.com:389/> >> " >> URI1="ldap://host1.hq.**mycompany.com:389<http://host1.hq.mycompany.com:389> >> " >> URI1 ldap://host1.hq.mycompany.com:**389/<http://host1.hq.mycompany.com:389/> >> > > There is no URI bit in the admin guide. I highly advise you go re-read > it. What you posted is clearly invalid. > > From the admin guide: >> > > ------------------------------**----------------------- > > Now we setup the first Master Node (replace $URI1, $URI2 and $URI3 etc. > with your actual ldap urls): > > > dn: cn=config > changetype: modify > replace: olcServerID > olcServerID: 1 $URI1 > olcServerID: 2 $URI2 > olcServerID: 3 $URI3 > > ------------------------------**----------------------- > > I.e. the attribute name is "olcServerID". > > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

5 7

sasl Kerberos authentication with subordinate
by Wu, James C. 03 Jan '13

03 Jan '13

Hi, I am trying to set up an OpenLDAP and Kerberos authentication for testing purpose. The setup contains a pair of internal ldap server and Kerberos server and the pair of external ldap server and Kerberos server. I made the tree of the internal ldap server to be a subordinate of the external server and enabled the saslauthd for authentication on both the internal and the external ldap server to the respective Kerberos server. I have tested that the LDAP authentication through saslauthd using Kerberos works well on both the internal ldap and Kerberos pair and the external ldap Kerberos pair. However, when I point the client machine to the external ldap server and the add the subordinate relationship, I could not get the authentication for the uses in the internal ldap directory to work. For example, when I used "su - peter" where peter is a user in the external ldap server and the password is {SASL}peter(a)EXAMPLE.COM<mailto:%7bSASL%7dpeter@EXAMPLE.COM>. The authentication works. However, when I use "su - James" where james is a user defined in the internal ldap server with password {SASL}james(a)SUB.EXAMPLE.COM<mailto:%7bSASL%7djames@SUB.EXAMPLE.COM>, then the authentication failed. I check the log file, the internal server did get the search request forwarded from the external ldap server and returned the correct information back. However, I did not see the saslauthd process on either the external or the internal ldap server get any inquiry for the authentication. I tried to modify the /etc/krb5.conf and added the realms for both EXAMPLE.COM and SUB.EXAMPLE.COM. Still, the authentication does not work for users defined in the internal ldap server. Could anyone give me some hints for this issue? james

2 12

MDB Newbie
by Kyle Smith 02 Jan '13

02 Jan '13

Greetings and Salutations. December 20, I converted from bdb to mdb. Now my memory usage looks like this: http://faculty.ycp.edu/~ksmith8/openldap_stats.png I am concerned with the graph for "superman". How can I start tracking down the usage and why almost 50% of my memory is being consumed. These 4 are in MMR and are 2.4.33 and are nearly exact in server specification. Thanks in advance! Kyle Smith

2 1

Ldap db is corupt
by Jorge Armijo 02 Jan '13

02 Jan '13

Hi my friends i have the next problem when mi server is down for electrical fails my ldap db is corrupt I need some procedure to restore de db because until this moment I restore but from a backup but i thing that is not the better strategy I realy need your help!!!!!!! Atento a sus comentarios Jorge Armijo Ingeniero de Soporte Soporte Libre Cia. Ltda. D: Hernandez de Giron Oe4-175 y Vasco de Contreras T: +593 (2) 331-9027 F: +593 (2) 243-1103 @: jorge.armijo(a)soportelibre.com www.soportelibre.com

2 1

GDM + pwdPolicy problem
by cbulist 02 Jan '13

02 Jan '13

Hi, We have a problem using Red Hat 5.7, gdm 2.16.0-59 y pwdPolicy. When an account gets pwdMaxAge limit and the user try to login using GUI the user doesn't receive any warning about expiration account, it just requests the user and password like a normal login and it fail. The warning works if the user try login by SSH. If we use pwdReset the user get the warning message and it is able to change the password. We comment pwdPolicy rules and using shadow attributes gdm works fine. We tried the same configuration with a Red Hat 6 server and everything works fine but we are not able to change our Red Hat version now. Our requirements are keep the password history and we tried pam_unix remember=3 option in /etc/pam.d/system-auth with /etc/security/opasswd but It did not work. We can go with shadow attributes as long as we keep the password history. Any idea? Thanks in advance!

2 1

olcToolthreads and slapadd -n0
by Василий Молостов 01 Jan '13

01 Jan '13

i have migrated server side config for my db and I have found some strange behavior of slapadd: I've got started migration from converting slapd.conf containing my db config and a 'tool-threads' parameter (with value above 1) into common ldif file, in which an 'olcToolThreads' was defined appropriately (i.e above 1). It was the simplest and clear step. The next step was to 'slapadd -n 0' this ldif file into an empty server config (having slapd stopped), but just at adding 'cn=config' object (which contains olcToolThreads with value > 1) 'slapadd' stuck indefinitely at shed_yelds() call (I have observed this via strace tool from ubuntu). So as a result slapadd had been in processing its operation indefinitely without any output but was capable to stop working by Ctrl-C handler. Setting olcToolThreads to 0 or 1 has solved this problem. I dont know is this a bug or my misconfiguration?

3 2

missing structuralObjectClass
by Dusty Doris 01 Jan '13

01 Jan '13

I recently migrated a client's ldap directories to new servers. I setup replication from the new servers to the old servers to do the initial build of the directory and to keep up to date with changes before the cutover. In the process we also moved from 2.4.12 to 2.4.33. I've run into an issue since then with an object that was missing a structuralObjectClass. When we try to commit modifications to that object, we received an error that says: ldap_modify: Other (e.g., implementation specific) error (80) additional info: no structuralObjectClass operational attribute Doing a search on that object with +, shows that it is in fact missing a structuralObjectClass. Other users that we can modify, show that they do have that attribute. I was able to solve this problem by doing an ldapsearch on the user and saving to an ldif, ldapdelete the user, then ldapadd the user back from the ldif file. When re-adding that user, the structuralObjectClass was created. It looks like about 50% of our objects are missing that attribute. To get those numbers, I am searching with: '(&(objectClass=*)(!(structuralObjectClass=*)))' + VS '(&(objectClass=*)(structuralObjectClass=*))' + What would be the best way for me to fix these issues on every object that is missing the structuralObjectClass? Also, in the future, would you recommend I do a slapcat/slapadd or something like that to populate a new database instead of letting syncrepl load it for me? Would that have fixed this problem from the start? Thanks for any suggestions. - Dusty Doris

2 3

Re: Multi-Master OpenLDAP Replication for 3 nodes -- slapadd command failing
by fal patel 31 Dec '12

31 Dec '12

Hey Quanah, Thank you very much for the debugging tip! -- Using it I got further in. Now I get an error "<= str2entry: str2ad(UR1): attribute type undefined". I must be setting my external variables (such as UR1) incorrectly in my LDIF file. What is the correct syntax for setting them, please? I tried each of the following sentences, none of which worked: URI1: ldap://host1.hq.mycompany.com:389/ URI1: ldap://host1.hq.mycompany.com:389 URI1: "ldap://host1.hq.mycompany.com:389/" URI1="ldap://host1.hq.mycompany.com:389/" URI1="ldap://host1.hq.mycompany.com:389" URI1 ldap://host1.hq.mycompany.com:389/ This is the command I execute (after removing all contents from slapd.d): slapadd -d -1 -v -F /etc/openldap/slapd.d -n 0 -l /etc/openldap/nwaymmr.ldif >& output.txt For completeness I've attached my LDIF file "nwaymmr.ldif" and the output "output.txt" utilizing the first line above. Thank you very much, in advance. Fal On Sat, Dec 29, 2012 at 9:02 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Saturday, December 29, 2012 9:01 AM -0800 fal patel < > fal0patel(a)gmail.com> wrote: > > (3) Where It's Failing: >> ================= >> I first executed the following: >> >> slapadd -v -F /usr/local/etc/openldap/slapd.**d -b bdb -l mmr.ldif >> > > This is nonsensical. You are adding a cn=config DB. Thus you cannot use > a base of "bdb". Remember that -b is the suffix you are adding (in this > case, cn=config). Not the database type. > > > So I suppose I must create the database beforehand? >> > > No. But the directory (/usr/local/etc/openldap/**slapd.d) must exist > before slapadd will work. > > I would suggest you run: > > slapadd -d -1 -v -F /usr/local/etc/openldap/slapd.**d -n 0 -l mmr.ldif > > So you can see exactly why it is failing. My guess is you didn't create > the directory. > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

Rewrite dn ?
by ST Wong 31 Dec '12

31 Dec '12

Hi, I'm newbie to openldap 2.4, and planning to setup an ldap proxy using ldap backend + remap overlay so that user can bind as cn=xxx,dc=my,dc=com, while at the backend ldap, the object looks like following: dn: uid=yyy,dc=my,dc=com objectclass: inetorgperson objectclass: dcobject cn=xxx uid=yyy mail=xxx(a)my.com ... Is it possible? Thanks a lot. Rgds

1 0

Admin user has two passwords
by Wiebe Cazemier 31 Dec '12

31 Dec '12

Hi, I tried changing the password for the admin user in my OpenLDAP tree, but now I can log in with both. When I do this: ldapsearch -vxZZH ldap://ldap.domain.tld/ -D "cn=admin,dc=domain,dc=tld" -W Entering a wrong password makes it fail, but entering the old or new password both work. I thought maybe it used the root account, so in an attempt to fix this, I tried setting the rootpw with this: # cat change-rootpw.ldif dn: olcDatabase={0}config,cn=config replace: olcRootPW olcRootPW: {SSHA}some hash ldapmodify -v -Y EXTERNAL -H ldapi:/// -f change-rootpw.ldif But that didn't fix it. I'm quite confused. Any help is appreciated. Regards, Wiebe

3 6

Re: Multi-Master OpenLDAP Replication for 3 nodes -- slapadd command failing
by fal patel 30 Dec '12

30 Dec '12

Hi Bernd and Dieter, Thank you very much for your advice. Unfortunately, however, I still haven't succeeded in getting N-way MMR to work. So, to get it straight in my mind, I've written it up in 3 parts below -- (1) Problem Statement and Requirements, (2) My Implementation Attempt, and (3) Where It's Failing. (1) Problem Statement and Requirements: ============================== Need N-Way Multi-Master OpenLDAP Replication for 3 nodes. LDAP Writes are infrequent, but can occur to any of the 3 nodes. No need for high performance. No need for ACID transactions. There is no database or anything at all at present, so it's a clean slate for development. slapd.conf(5) will not be used at all. Only slapd-config will be used for configuring. The only back-end that will be used is bdb. The only replication mechanism is syncrepl in Provider Push mode of operation, ie., refreshAndPersist, which is initiated by a Consumer. (Consumer Pull mode of operation, ie. refreshOnly, will not be used at all.). So, once the Provider services the Consumer’s search request, Provider locally persists the synchronization search. There will be no maintaining of any Provider session log store. Thus only the Present phase of the refresh synchronization will be used. (not the Delete phase at all). Database creation will be performed off-line (to ensure database is not accessed while being created!). (not on-line). Thus the database creation tools that will be used are slapadd, slapcat, slaptest etc. (not ldapadd, ldapmodify etc.) In fact, there being no database to begin with, for slapadd I must use the "-b suffix" to specify which database to add entries to. slapadd -b bdb (not the "slapadd -n 0" parameter to specify the zero-th database.). (2) My Implementation Attempt: ========================== I have copy-pasted the exact text from the OpenLDAP 2.4 Administrator's Guide, Section 18.3.3 "N-Way Multi-Master" (with my only changes being to my user variables), as follows: #################################### # mmr.ldif #################################### # This sets up the config database: dn: cn=config objectClass: olcGlobal cn: config olcServerID: 1 dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootPW: secret # second and third servers will have a different olcServerID obviously: dn: cn=config objectClass: olcGlobal cn: config olcServerID: 2 dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootPW: secret dn: cn=config objectClass: olcGlobal cn: config olcServerID: 3 dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootPW: secret # This sets up syncrepl as a provider (since these are all masters): dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulePath: /usr/local/libexec/openldap olcModuleLoad: syncprov.la # Now we setup the first Master Node # (replace $URI1, $URI2 and $URI3 etc. with your actual ldap urls): URI1="ldap://ldap.node1.mycompany.com" URI2="ldap://ldap.node2.mycompany.com" URI3="ldap://ldap.node3.mycompany.com" dn: cn=config changetype: modify replace: olcServerID olcServerID: 1 $URI1 olcServerID: 2 $URI2 olcServerID: 3 $URI3 dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=$URI1 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncRepl: rid=002 provider=$URI2 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncRepl: rid=003 provider=$URI3 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 add: olcMirrorMode olcMirrorMode: TRUE # Now start up the Master and a consumer/s; # also add the above LDIF to the first consumer, second consumer etc. # It will then replicate cn=config. # You now have N-Way Multimaster on the config database. # We still have to replicate the actual data, not just the config; # so add to the master # (all active and configured consumers/masters will pull down this config, # as they are all syncing). # Also, replace all ${} variables with whatever is applicable to your setup: BACKEND=bdb BASEDN="dc=ldapservice,dc=hq,dc=mycompany,dc=com" MANAGERDN="cn=Admins,$BASEDN" PASSWD=secret dn: olcDatabase={1}$BACKEND,cn=config objectClass: olcDatabaseConfig objectClass: olc${BACKEND}Config olcDatabase: {1}$BACKEND olcSuffix: $BASEDN olcDbDirectory: ./db olcRootDN: $MANAGERDN olcRootPW: $PASSWD olcLimits: dn.exact="$MANAGERDN" time.soft=unlimited time.hard=unlimited size.soft=unlimited olcSyncRepl: rid=004 provider=$URI1 binddn="$MANAGERDN" bindmethod=simple credentials=$PASSWD searchbase="$BASEDN" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcSyncRepl: rid=005 provider=$URI2 binddn="$MANAGERDN" bindmethod=simple credentials=$PASSWD searchbase="$BASEDN" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcSyncRepl: rid=006 provider=$URI3 binddn="$MANAGERDN" bindmethod=simple credentials=$PASSWD searchbase="$BASEDN" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcMirrorMode: TRUE dn: olcOverlay=syncprov,olcDatabase={1}${BACKEND},cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov # Note: All of your servers' clocks must be tightly synchronized using e.g. NTP. # Note: URLs specified in olcSyncRepl directives are the servers URLs to replicate from. # These must exactly match the URLs slapd listens on (-h in Command-Line Options). # Otherwise slapd may attempt to replicate from itself, causing a loop. (3) Where It's Failing: ================= I first executed the following: slapadd -v -F /usr/local/etc/openldap/slapd.d -b bdb -l mmr.ldif But that was a fiasco, saying "slapadd: slap_init invalid suffix ("bdb") ". So I suppose I must create the database beforehand? So then I created the database (by running slapd using slapd.conf with "database config" and "rootpw config" directives commented out); then I stopped the slapd service and executed the following: slapadd -v -F /usr/local/etc/openldap/slapd.d -n 0 -l mmr.ldif That failed too, saying "slapadd: could not add entry dn="cn=config" (line=1)". So then I tried: slapadd -v -F /usr/local/etc/openldap/slapd.d -n 1 -l mmr.ldif That failed too, saying "slapadd: database doesn't support necessary operations". So then I tried: slapadd -v -F /usr/local/etc/openldap/slapd.d -n 2 -l mmr.ldif That failed too, saying "slapadd: line 1: database #2 (dc=ldapservice,dc=hq,dc=mycompany,dc=com) not configured to hold "cn=config"; did you mean to use database #0 (cn=config)?". Of course, when I try any other number for n it says "Database number selected via -n is out of range. Must be in the range 0 to 2 (the number of configured databases)." So, my question is: How in the world do I configure my database #0 to also include my database #2 entities? Or, alternatively, how do I configure my database #2 to also hold "cn=config"? There is an old OpenLDAP.org blog which summarises how, but doesn't describe any execution steps at all: http://blog.suretecsystems.com/archives/40-OpenLDAP-Weekly-News-Issue-5.html " *Multi-Master Replication configuration example:* This has been asked for a few times now, so I'm putting an example here for use with OpenLDAP 2.4.6, which will then be part of the main docs<http://www.openldap.org/doc> This is adapted from test050-syncrepl-multimaster<http://www.openldap.org/devel/cvsweb.cgi/tests/scripts/test050-syncrepl-mul…> A proper writeup will be in the admin guide<http://www.openldap.org/doc/admin24/replication.html#N-Way%20Multi-Master>soon, I promise [image: ;-)] Right, the following is all in LDIF<http://en.wikipedia.org/wiki/LDAP_Data_Interchange_Format>format and you *slapadd* them to your *cn=config* on the amount of Master nodes you have/want (using *slappasswd* of course): This sets up the config database: " I really urgently need your help with this, please. I thoroughly appreciate your help so far. Thanks Fal On Fri, Dec 28, 2012 at 9:18 AM, fal patel <fal0patel(a)gmail.com> wrote: > > > ---------- Forwarded message ---------- > From: Bernd May <bernd(a)net.t-labs.tu-berlin.de> > Date: Fri, Dec 28, 2012 at 5:07 AM > Subject: Re: Multi-Master OpenLDAP Replication for 3 nodes -- slapadd > command failing > To: openldap-technical(a)openldap.org > > > From the manpage of slapadd: > > '-n dbnum Add entries to the dbnum-th database listed in the > configuration file. The -n cannot be used in conjunction with the -b > option. To populate the config database slapd-config(5), use -n 0 as it > is always the first database. It must physically exist on the > filesystem prior to this, however.' > > hth > > On 28.12.2012 09:14, fal patel wrote: > > Hi Dieter, > > > > Thank you very much, but even though I spent all day trying to figure out > > the problem I could not make any progress at all. > > > > The mmr_servers.ldif file I provided is an *exact* copy of the OpenLDAP > 2.4 > > Administrator's Guide Section 18.3.3 "N-Way Multi-Master", so if it is > not > > working it has to be a documentation error/bug in that section of the > > Administrator's Guide itself. > > Or is it the case that the variables I'm setting therein are wrong? > > > > Here are the variable values I'm setting: > > ============================ > > # Also, replace all ${} variables with whatever is applicable to your > setup: > > BACKEND=bdb > > BASEDN="dc=ldapservice,dc=hq,dc=mycompany,dc=com" > > MANAGERDN="cn=admin,$BASEDN" > > PASSWD=secret > > > > > > The slapd.conf file also is the *exact* same one that gets created at > > install-time in /usr/local/etc/openldap/ , with the only change being my > > "BDB database definitions" customisations as follows: > > ####################################################################### > > # BDB database definitions > > ####################################################################### > > > > ## added for multimaster replication (prior to running slapadd to create > > db): > > database bdb > > # suffix <DN of root of subtree you are trying to create> > > suffix "dc=ldapservice,dc=hq,dc=mycompany,dc=com" > > rootdn "cn=admin,dc=ldapservice,dc=hq,dc=mycompany,dc=com" > > rootpw secret > > # directory for index files > > directory /usr/local/var/openldap-data > > # specify which indices you want to build > > index objectClass eq > > # loglevel 64 > > > > > > Whatever I try, however, slapadd gives the same error: > > ======================================= > > ubuntu11@ubuntu11:~$ sudo slapadd -l > > /home/ubuntu11/openldap-2.4.33/mmr_servers.ldif -f > > /usr/local/etc/openldap/slapd.conf -F /usr/local/etc/openldap/slapd.d > > 50dd4b2a bdb_monitor_db_open: monitoring disabled; configure monitor > > database to enable > > slapadd: line 1: database #1 > > (dc=ldapservice,dc=hq,dc=practicefusion,dc=com) not configured to hold > > "cn=config"; did you mean to use database #0 (cn=config)? > > _ 3.25% eta none elapsed none spd > 833.5 > > k/s > > Closing DB... > > > > > > I didn't quite understand your instructions either: > > ================================== > > "cn=config has to be database number 0, that > > is, the first database declaration must be cn=config." > > > > In mmr_servers.ldif, the very first line is > > dn: cn=config > > > > How do I cause cn=config to be database number 0 , please? > > > > And why should I have to, unless the text in OpenLDAP 2.4 Administrator's > > Guide, Section 18.3.3 "N-Way Multi-Master" has a bug? > > > > Could you please advise? I am completely stuck. > > > > Thank you very much. > > > > Fal > > > > > > > > On Thu, Dec 27, 2012 at 3:54 AM, Dieter Klünter <dieter(a)dkluenter.de> > wrote: > > > >> Am Thu, 27 Dec 2012 02:22:18 -0800 > >> schrieb fal patel <fal0patel(a)gmail.com>: > >> > >>> Oops -- forgot to enter subject-line! > >>> > >>> > >>> On Thu, Dec 27, 2012 at 2:11 AM, fal patel <fal0patel(a)gmail.com> > >>> wrote: > >>> > >>>> Hello, > >>>> > >>>> I'm trying to accomplish Multi-Master OpenLDAP Replication for 3 > >>>> nodes, but it's not working. > >> [...] > >>>> > >>>> (1) The slapadd command, I execute, and the error message I get: > >>>> ================================================ > >>>> sudo slapadd -l /home/ubuntu11/openldap-2.4.33/mmr_servers.ldif -f > >>>> /usr/local/etc/openldap/slapd.conf > >>>> -F /usr/local/etc/openldap/slapd.d [sudo] password for ubuntu11: > >>>> 50dc0b31 bdb_monitor_db_open: monitoring disabled; configure monitor > >>>> database to enable > >>>> slapadd: line 1: database #1 > >>>> (dc=ldapservice,dc=hq,dc=mycompany,dc=com) not configured to hold > >>>> "cn=config"; did you mean to use database #0 (cn=config)? > >>>> _ 2.58% eta none elapsed none > >> > >> This error is quite clear, cn=config has to be database number 0, that > >> is, the first database declaration must be cn=config. > >> This is probably due to including a slapd.conf file with a database > >> declaration. > >> > >> -Dieter > >> > >> -- > >> Dieter Klünter | Systemberatung > >> http://dkluenter.de > >> GPG Key ID:DA147B05 > >> 53°37'09,95"N > >> 10°08'02,42"E > >> > >> > > > > -- > Technische Universität Berlin - FGINET > > Bernd May > > System Administration > An-Institut Deutsche Telekom Laboratories > Sekr. TEL 16 > Ernst-Reuter-Platz 7 > 10587 BERLIN > GERMANY > > Mobile: 0160/90257737 > E-Mail: bernd(a)net.t-labs.tu-berlin.de (T-Labs work) > WWW: net.t-labs.tu-berlin.de > > > >

2 1

Forcing TLS encryption
by Wiebe Cazemier 28 Dec '12

28 Dec '12

Hi, I'm trying to get slapd to reject non-encrypted connections, but nowhere can I find how you configure it to *only* accept TLS traffic. I just confirmed that our server accepts unencrypted traffic (with ldapsearch and tcpdump). Normally, I would just close the non-SSL port with IP tables, but using the SSL port is deprecated, apparently, so I don't have that option. So, with the cn=config SSL configuration commands, like this: dn: cn=config changetype:modify replace: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/ssl/bla.key - replace: olcTLSCertificateFile olcTLSCertificateFile: /etc/ssl/bla.crt - replace: olcTLSCACertificateFile olcTLSCACertificateFile: /etc/ssl/ca.pem Is there a param for forcing TLS? I tried: dn: cn=config changetype: modify replace: olcTLSCipherSuite olcTLSCipherSuite: TLSv1+RSA:!NULL but it doesn't work; the server doesn't start. Debug output: TLS: could not set cipher list TLSv1+RSA:!NULL. main: TLS init def ctx failed: -1 slapd destroy: freeing system resources. slapd stopped. connections_destroy: nothing to destroy. Nor does "olcTLSCipherSuite: HIGH" work. I looked in the openldap source code, but even there, I can't find how to do it. Slapd: 2.4.21-0ubuntu5.7 Ubuntu: Ubuntu 10.04.4 LTS Thanks, Wiebe Cazemier

5 8

add posixAccount to back-sql definition
by DavidHornung 28 Dec '12

28 Dec '12

Hello, up to now i used inetOrgPerson from the docs to auth my users via LDAP/back-sql. but in inetOrgPerson isnt a uid defined so the Object Class posixAccount would fit better. I created a table which represents the posixAccount - minimal I need uid and password. the entity integer refers to id's of table persons with mobliePhone, mail, etc. CREATE TABLE net_accounts ( id serial NOT NULL, entity integer NOT NULL, password character varying NOT NULL, uid character varying NOT NULL, CONSTRAINT "net_accounts_pkey" PRIMARY KEY (id , uid ) ) I plan to use this posixAccount to auth with Mailserver, Intranet and all other services ... How to modify the example in the docs to do this ? Thank you! David

1 0

Multi-Master OpenLDAP Replication for 3 nodes -- slapadd command failing
by fal patel 28 Dec '12

28 Dec '12

Oops -- forgot to enter subject-line! On Thu, Dec 27, 2012 at 2:11 AM, fal patel <fal0patel(a)gmail.com> wrote: > Hello, > > I'm trying to accomplish Multi-Master OpenLDAP Replication for 3 nodes, > but it's not working. > > Specifically, per The OpenLDAP 2.4 Administrator's Guide, Section 18.3.3 > "N-Way Multi=Master", I have created the following LDIF file and slapd.conf > file, but when I run slapadd to create my config database it fails. > > Could you please advise? > > Thank you very much. > > Fal > > (1) The slapadd command, I execute, and the error message I get: > ================================================ > sudo slapadd -l /home/ubuntu11/openldap-2.4.33/mmr_servers.ldif -f > /usr/local/etc/openldap/slapd.conf -F /usr/local/etc/openldap/slapd.d > [sudo] password for ubuntu11: > 50dc0b31 bdb_monitor_db_open: monitoring disabled; configure monitor > database to enable > slapadd: line 1: database #1 (dc=ldapservice,dc=hq,dc=mycompany,dc=com) > not configured to hold "cn=config"; did you mean to use database #0 > (cn=config)? > _ 2.58% eta none elapsed none spd 1.1 > M/s > Closing DB... > > > > (2) My LDIF File, mmr-servers.ldif > ========================= > # This sets up the config database: > dn: cn=config > objectClass: olcGlobal > cn: config > olcServerID: 1 > > dn: olcDatabase={0}config,cn=config > objectClass: olcDatabaseConfig > olcDatabase: {0}config > olcRootPW: secret > > # second and third servers will have a different olcServerID obviously: > dn: cn=config > objectClass: olcGlobal > cn: config > olcServerID: 2 > > dn: olcDatabase={0}config,cn=config > objectClass: olcDatabaseConfig > olcDatabase: {0}config > olcRootPW: secret > > dn: cn=config > objectClass: olcGlobal > cn: config > olcServerID: 3 > > dn: olcDatabase={0}config,cn=config > objectClass: olcDatabaseConfig > olcDatabase: {0}config > olcRootPW: secret > > # This sets up syncrepl as a provider (since these are all masters): > dn: cn=module,cn=config > objectClass: olcModuleList > cn: module > olcModulePath: /usr/local/libexec/openldap > olcModuleLoad: syncprov.la > > # Now we setup the first Master Node > # (replace $URI1, $URI2 and $URI3 etc. with your actual ldap urls): > dn: cn=config > changetype: modify > replace: olcServerID > ## olcServerID: 1 $URI1 > > olcServerID: 1 ldap://ldap.awshost.ldapservice.hq.mycompany.com > ## olcServerID: 2 $URI2 > olcServerID: 2 ldap://ldap.schost.ldapservice.hq.mycompany.com > ## olcServerID: 3 $URI3 > olcServerID: 3 ldap://ldap.sachost.ldapservice.hq.mycompany.com > > dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config > changetype: add > objectClass: olcOverlayConfig > objectClass: olcSyncProvConfig > olcOverlay: syncprov > > dn: olcDatabase={0}config,cn=config > changetype: modify > add: olcSyncRepl > olcSyncRepl: rid=001 provider=$URI1 binddn="cn=config" bindmethod=simple > credentials=secret searchbase="cn=config" type=refreshAndPersist > retry="5 5 300 5" timeout=1 > olcSyncRepl: rid=002 provider=$URI2 binddn="cn=config" bindmethod=simple > credentials=secret searchbase="cn=config" type=refreshAndPersist > retry="5 5 300 5" timeout=1 > olcSyncRepl: rid=003 provider=$URI3 binddn="cn=config" bindmethod=simple > credentials=secret searchbase="cn=config" type=refreshAndPersist > retry="5 5 300 5" timeout=1 > > add: olcMirrorMode > olcMirrorMode: TRUE > > # Now start up the Master and a consumer/s; > # also add the above LDIF to the first consumer, second consumer etc. > # It will then replicate cn=config. > # You now have N-Way Multimaster on the config database. > > # We still have to replicate the actual data, not just the config; > # so add to the master > # (all active and configured consumers/masters will pull down this config, > # as they are all syncing). > # Also, replace all ${} variables with whatever is applicable to your > setup: > dn: olcDatabase={1}$BACKEND,cn=config > objectClass: olcDatabaseConfig > objectClass: olc${BACKEND}Config > olcDatabase: {1}$BACKEND > olcSuffix: $BASEDN > olcDbDirectory: ./db > olcRootDN: $MANAGERDN > olcRootPW: $PASSWD > olcLimits: dn.exact="$MANAGERDN" time.soft=unlimited time.hard=unlimited > size.soft=unlimited olcSyncRepl: rid=004 provider=$URI1 binddn="$MANAGERDN" > bindmethod=simple > credentials=$PASSWD searchbase="$BASEDN" type=refreshOnly > interval=00:00:00:10 retry="5 5 300 5" timeout=1 > olcSyncRepl: rid=005 provider=$URI2 binddn="$MANAGERDN" bindmethod=simple > credentials=$PASSWD searchbase="$BASEDN" type=refreshOnly > interval=00:00:00:10 retry="5 5 300 5" timeout=1 > olcSyncRepl: rid=006 provider=$URI3 binddn="$MANAGERDN" bindmethod=simple > credentials=$PASSWD searchbase="$BASEDN" type=refreshOnly > interval=00:00:00:10 retry="5 5 300 5" timeout=1 > olcMirrorMode: TRUE > > dn: olcOverlay=syncprov,olcDatabase={1}${BACKEND},cn=config > changetype: add > objectClass: olcOverlayConfig > objectClass: olcSyncProvConfig > olcOverlay: syncprov > > # Note: All of your servers' clocks must be tightly synchronized using > e.g. NTP. > # Note: URLs specified in olcSyncRepl directives are the servers URLs to > replicate from. > # These must exactly match the URLs slapd listens on (-h in Command-Line > Options). > # Otherwise slapd may attempt to replicate from itself, causing a loop. > > > > (3) My slapd.conf file: > ================ > # > # See slapd.conf(5) for details on configuration options. > # This file should NOT be world readable. > # > include /usr/local/etc/openldap/schema/core.schema > > # Define global ACLs to disable default read access. > > # Do not enable referrals until AFTER you have a working directory > # service AND an understanding of referrals. > #referral ldap://root.openldap.org > > pidfile /usr/local/var/run/slapd.pid > argsfile /usr/local/var/run/slapd.args > > # Load dynamic backend modules: > # modulepath /usr/local/libexec/openldap > # moduleload back_bdb.la > # moduleload back_hdb.la > # moduleload back_ldap.la > > # Sample security restrictions > # Require integrity protection (prevent hijacking) > # Require 112-bit (3DES or better) encryption for updates > # Require 63-bit encryption for simple bind > # security ssf=1 update_ssf=112 simple_bind=64 > > # Sample access control policy: > # Root DSE: allow anyone to read it > # Subschema (sub)entry DSE: allow anyone to read it > # Other DSEs: > # Allow self write access > # Allow authenticated users read access > # Allow anonymous users to authenticate > # Directives needed to implement policy: > # access to dn.base="" by * read > # access to dn.base="cn=Subschema" by * read > # access to * > # by self write > # by users read > # by anonymous auth > # > # if no access controls are present, the default policy > # allows anyone and everyone to read anything but restricts > # updates to rootdn. (e.g., "access to * by * read") > # > # rootdn can always read and write EVERYTHING! > > ####################################################################### > # BDB database definitions > ####################################################################### > ## database bdb > ## suffix "dc=my-domain,dc=com" > ## rootdn "cn=Manager,dc=my-domain,dc=com" > # Cleartext passwords, especially for the rootdn, should > # be avoid. See slappasswd(8) and slapd.conf(5) for details. > # Use of strong authentication encouraged. > ## rootpw secret > # The database directory MUST exist prior to running slapd AND > # should only be accessible by the slapd and slap tools. > # Mode 700 recommended. > ## directory /usr/local/var/openldap-data > # Indices to maintain > ## index objectClass eq > > ## added for multimaster replication (prior to running slapadd to create > db): > database bdb > # suffix <DN of root of subtree you are trying to create> > suffix "dc=ldapservice,dc=hq,dc=mycompany,dc=com" > rootdn "cn=admin,dc=ldapservice,dc=hq,dc=mycompany,dc=com" > rootpw secret > # directory for index files > directory /usr/local/var/openldap-data > # specify which indices you want to build > index objectClass eq > # loglevel 64 > > > > I have these additional questions also, please: > * It's "refreshAndPersist" Provider Push replication I want to implement, > not "refreshOnly" Consumer Poll Pull. > So in my mmr-servers.ldif file, can/should I change all the "refreshOnly" > clauses in the Data Replication part to "refreshAndPersist"? > > * In the above LDIF file, in both the Config Replication section and the > Data Replication section, why does it add MirrorMode and set it to True? > It's N-Way Multi-Master replication I want to implement, not Mirror-Mode > replication, so can/should I get rid of all those "Mirror Mode" clause > statements? > > Thank you once again. > >

3 4

db_recover gives program version mismatch
by anil beniwal 28 Dec '12

28 Dec '12

Hi I am getting belwo errors when i run db_recover on rhel 6.3 64 bit. [root@mmprodam01 data-ldap]# /apps/db4/bin/db_recover -h /apps/openldap/var/openldap-data/ db_recover: Program version 4.7 doesn't match environment version 4.8 db_recover: Unacceptable log file /apps/openldap/var/openldap-data/log.0000000001: unsupported log version 16 db_recover: Invalid log file: log.0000000001: Invalid argument db_recover: PANIC: Invalid argument db_recover: process-private: unable to find environment db_recover: DB_ENV->open: DB_RUNRECOVERY: Fatal error, run database recovery I have installed berkely db in /apps/db4 with simple prefix=/apps/db4 i am getting this error everytime i run any db_xxx command. [root@mmprodam01 data-ldap]# rpm -qa | grep db4 db4-4.7.25-17.el6.x86_64 db4-utils-4.7.25-17.el6.x86_64 Its still taking db4.7 . Any help would be great. Let me know in case further details are required. -- Thanks&Regards Anil Beniwal

3 6

Re: How to force password change upon account creation
by Dan White 27 Dec '12

27 Dec '12

On 12/27/12 14:24 -0600, Kyle(a)TheHarrisHome.com wrote: >Hi Dan, > >Thank you for your response. I am using CentOS 6.3, OpenLDAP 2.4 and sssd >1.8 as the pam module. Hope that helps as I still can't quite figure it >out, and thank you again. You should see if sssd contains the logic to make use of the ppolicy related attributes. If not, you should configure the appropriate shadowAccount attributes instead. >-----Original Message----- >From: Dan White [mailto:dwhite@olp.net] >Sent: Sunday, December 23, 2012 6:43 PM >To: Kyle Harris >Cc: openldap-technical(a)openldap.org >Subject: Re: How to force password change upon account creation > >On 12/23/12 17:33 -0600, Kyle Harris wrote: >>Hello All, >> >>I have a perl script that allows for the creation of new accounts in >>OpenLDAP. I am attempting to find a way to force the newly created >>user to change his or her password upon first login. I tried setting >>the attribute pwdMustChange to TRUE but that attribute must not be >>definable upon user creation. So, how can this be accomplished so that >>a new user is forced to change passwords after they first log on? > >By 'log in' I assume you're asking about shell access to your system, which >makes use of an ldap pam module to authenticate users. If so, the function >of prompting users to change their password will be handled by that piece of >software, and you should consult the documentation distributed with it. > >If that's not the case, please clarify your authentication scenario. -- Dan White

1 0

Multi-Master OpenLDAP Replication for 3 nodes -- slapadd command failing
by fal patel 27 Dec '12

27 Dec '12

Oops -- forgot to add subject-line! ---------- Forwarded message ---------- From: fal patel <fal0patel(a)gmail.com> Date: Thu, Dec 27, 2012 at 2:11 AM Subject: To: openldap-technical(a)openldap.org Cc: fal patel <fal0patel(a)gmail.com>

1 0

(no subject)
by fal patel 27 Dec '12

27 Dec '12

Hello, I'm trying to accomplish Multi-Master OpenLDAP Replication for 3 nodes, but it's not working. Specifically, per The OpenLDAP 2.4 Administrator's Guide, Section 18.3.3 "N-Way Multi=Master", I have created the following LDIF file and slapd.conf file, but when I run slapadd to create my config database it fails. Could you please advise? Thank you very much. Fal (1) The slapadd command, I execute, and the error message I get: ================================================ sudo slapadd -l /home/ubuntu11/openldap-2.4.33/mmr_servers.ldif -f /usr/local/etc/openldap/slapd.conf -F /usr/local/etc/openldap/slapd.d [sudo] password for ubuntu11: 50dc0b31 bdb_monitor_db_open: monitoring disabled; configure monitor database to enable slapadd: line 1: database #1 (dc=ldapservice,dc=hq,dc=mycompany,dc=com) not configured to hold "cn=config"; did you mean to use database #0 (cn=config)? _ 2.58% eta none elapsed none spd 1.1 M/s Closing DB... (2) My LDIF File, mmr-servers.ldif ========================= # This sets up the config database: dn: cn=config objectClass: olcGlobal cn: config olcServerID: 1 dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootPW: secret # second and third servers will have a different olcServerID obviously: dn: cn=config objectClass: olcGlobal cn: config olcServerID: 2 dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootPW: secret dn: cn=config objectClass: olcGlobal cn: config olcServerID: 3 dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootPW: secret # This sets up syncrepl as a provider (since these are all masters): dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulePath: /usr/local/libexec/openldap olcModuleLoad: syncprov.la # Now we setup the first Master Node # (replace $URI1, $URI2 and $URI3 etc. with your actual ldap urls): dn: cn=config changetype: modify replace: olcServerID ## olcServerID: 1 $URI1 olcServerID: 1 ldap://ldap.awshost.ldapservice.hq.mycompany.com ## olcServerID: 2 $URI2 olcServerID: 2 ldap://ldap.schost.ldapservice.hq.mycompany.com ## olcServerID: 3 $URI3 olcServerID: 3 ldap://ldap.sachost.ldapservice.hq.mycompany.com dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=$URI1 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncRepl: rid=002 provider=$URI2 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncRepl: rid=003 provider=$URI3 binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 add: olcMirrorMode olcMirrorMode: TRUE # Now start up the Master and a consumer/s; # also add the above LDIF to the first consumer, second consumer etc. # It will then replicate cn=config. # You now have N-Way Multimaster on the config database. # We still have to replicate the actual data, not just the config; # so add to the master # (all active and configured consumers/masters will pull down this config, # as they are all syncing). # Also, replace all ${} variables with whatever is applicable to your setup: dn: olcDatabase={1}$BACKEND,cn=config objectClass: olcDatabaseConfig objectClass: olc${BACKEND}Config olcDatabase: {1}$BACKEND olcSuffix: $BASEDN olcDbDirectory: ./db olcRootDN: $MANAGERDN olcRootPW: $PASSWD olcLimits: dn.exact="$MANAGERDN" time.soft=unlimited time.hard=unlimited size.soft=unlimited olcSyncRepl: rid=004 provider=$URI1 binddn="$MANAGERDN" bindmethod=simple credentials=$PASSWD searchbase="$BASEDN" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcSyncRepl: rid=005 provider=$URI2 binddn="$MANAGERDN" bindmethod=simple credentials=$PASSWD searchbase="$BASEDN" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcSyncRepl: rid=006 provider=$URI3 binddn="$MANAGERDN" bindmethod=simple credentials=$PASSWD searchbase="$BASEDN" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcMirrorMode: TRUE dn: olcOverlay=syncprov,olcDatabase={1}${BACKEND},cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov # Note: All of your servers' clocks must be tightly synchronized using e.g. NTP. # Note: URLs specified in olcSyncRepl directives are the servers URLs to replicate from. # These must exactly match the URLs slapd listens on (-h in Command-Line Options). # Otherwise slapd may attempt to replicate from itself, causing a loop. (3) My slapd.conf file: ================ # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args # Load dynamic backend modules: # modulepath /usr/local/libexec/openldap # moduleload back_bdb.la # moduleload back_hdb.la # moduleload back_ldap.la # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # BDB database definitions ####################################################################### ## database bdb ## suffix "dc=my-domain,dc=com" ## rootdn "cn=Manager,dc=my-domain,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. ## rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. ## directory /usr/local/var/openldap-data # Indices to maintain ## index objectClass eq ## added for multimaster replication (prior to running slapadd to create db): database bdb # suffix <DN of root of subtree you are trying to create> suffix "dc=ldapservice,dc=hq,dc=mycompany,dc=com" rootdn "cn=admin,dc=ldapservice,dc=hq,dc=mycompany,dc=com" rootpw secret # directory for index files directory /usr/local/var/openldap-data # specify which indices you want to build index objectClass eq # loglevel 64 I have these additional questions also, please: * It's "refreshAndPersist" Provider Push replication I want to implement, not "refreshOnly" Consumer Poll Pull. So in my mmr-servers.ldif file, can/should I change all the "refreshOnly" clauses in the Data Replication part to "refreshAndPersist"? * In the above LDIF file, in both the Config Replication section and the Data Replication section, why does it add MirrorMode and set it to True? It's N-Way Multi-Master replication I want to implement, not Mirror-Mode replication, so can/should I get rid of all those "Mirror Mode" clause statements? Thank you once again.

1 0

data import very slow for data migration
by anil beniwal 26 Dec '12

26 Dec '12

Hi We are having 4 million users to migrate, all data exported from oracle to multiple ldif files. Imported 1 million till now, took almost 28 hours. and openldap-data dir of about 28G. openldap version 2.4.33 bdb version 5.1.29 RHEL 6.3 RAM 8G 4 cpu , system is a VM. Currently running slapadd output + /apps/openldap/sbin/slapadd -q -c -w -f /apps/openldap/etc/openldap/slapd.conf -l /root/User9.ldif bdb_monitor_db_open: monitoring disabled; configure monitor database to enable . 2.27% eta 21h31m elapsed 29m57s spd 1.6 k/s str2entry: invalid value for attributeType postalAddress #0 (syntax 1.3.6.1.4.1.1466.115.121.1.41) slapadd: could not parse entry (line=394416) * 2.81% eta 19h59m elapsed 34m40s spd 10.1 k/s Its seems to be taking weeks go import whole data. is there any tool or any other approach which we can use to make it fast,Or we are going with wrong configuration. Or we have to switch to ODS or RHDS Top output top - 10:26:04 up 21 days, 6:51, 3 users, load average: 2.13, 2.06, 1.79 Tasks: 153 total, 2 running, 151 sleeping, 0 stopped, 0 zombie Cpu0 :100.0%us, 0.0%sy, 0.0%ni, 0.0%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st Cpu1 : 0.0%us, 0.0%sy, 0.0%ni,100.0%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st Cpu2 : 0.0%us, 0.0%sy, 0.0%ni,100.0%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st Cpu3 : 3.0%us, 0.3%sy, 0.0%ni, 0.0%id, 96.6%wa, 0.0%hi, 0.0%si, 0.0%st Mem: 9095980k total, 8956852k used, 139128k free, 31452k buffers Swap: 6291448k total, 21300k used, 6270148k free, 7431012k cached PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 27877 ldap 20 0 4855m 539m 284m S 99.8 6.1 1807:28 slapd 21130 root 20 0 5267m 3.8g 3.0g R 4.3 43.6 0:59.27 slapadd DB_CONFIG set_cachesize 0 4294967295 0 set_lg_regionmax 2048576 set_lg_max 20485760 set_lg_bsize 2097152 set_lk_max_locks 10000 set_lk_max_objects 5000 set_lk_max_lockers 5000 slapd.conf include /apps/openldap/etc/openldap/schema/core.schema include /apps/openldap/etc/openldap/schema/cosine.schema include /apps/openldap/etc/openldap/schema/nis.schema include /apps/openldap/etc/openldap/schema/inetorgperson.schema include /apps/openldap/etc/openldap/schema/openldap.schema include /apps/openldap/etc/openldap/schema/dyngroup.schema include /apps/openldap/etc/openldap/schema/ppolicy.schema include /apps/openldap/etc/openldap/schema/channelIdentifier.schema include /apps/openldap/etc/openldap/schema/platform.schema include /apps/openldap/etc/openldap/schema/extendedProfileKey.schema include /apps/openldap/etc/openldap/schema/extendedProfileValue.schema include /apps/openldap/etc/openldap/schema/behaviorKey.schema include /apps/openldap/etc/openldap/schema/behaviorValue.schema include /apps/openldap/etc/openldap/schema/questionAnswer.schema include /apps/openldap/etc/openldap/schema/extendedTop.schema include /apps/openldap/etc/openldap/schema/counter.schema pidfile /apps/openldap/var/run/slapd.pid argsfile /apps/openldap/var/run/slapd.args logfile /apps/logs/ldap loglevel 16640 database bdb suffix "dc=example,dc=com" access to attrs=userPassword by self write by anonymous auth by * break access to * by group/groupOfUniqueNames/uniqueMember.exact="cn=VWrite,ou=businessUsersGroup,dc=example,dc=com" manage by group/groupOfUniqueNames/uniqueMember.exact="cn=VRead,ou=businessUsersGroup,dc=example,dc=com" read by * break access to * by self write by anonymous auth by * read rootdn "cn=Manager,dc=example,dc=com" rootpw {SSHA}dXDFSQeFjSofJ3TAzYf8DrDSYWY ################## SSL ########################################## # TLSCipherSuite HIGH:MEDIUM:+SSLv3 TLSCACertificateFile /apps/openldap/etc/openldap/cacerts/cacert.pem TLSCertificateFile /apps/openldap/etc/openldap/cacerts/dam01.crt TLSCertificateKeyFile /apps/openldap/etc/openldap/cacerts/dam01.key # #################################################################### ####ache Entries ##### cachesize 900000 #idlcachesize 900000 lastmod on checkpoint 128 15 concurrency 100 index entryCSN eq index entryUUID eq index mail,uid,postalCode,smail,channelType,channelValue,answer,behavName,objectclass,tokenID,type eq index givenName,sn,city,question,behavValue,cn,extName sub index displayName approx # Replication Configuration overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 serverid 1 syncrepl rid=111 provider=ldap://s01.com binddn="cn=Manager,dc=example,dc=com" bindmethod=simple starttls=yes tls_reqcert=allow schemachecking=off credentials=G00gle# searchbase="dc=example,dc=com" type=refreshAndPersist retry="5 5 300 +" interval=00:00:00:10 syncrepl rid=222 provider=ldap://m04.com binddn="cn=Manager,dc=example,dc=com" bindmethod=simple starttls=yes tls_reqcert=allow schemachecking=off credentials=G00gle# searchbase="dc=example,dc=com" type=refreshAndPersist retry="5 5 300 +" interval=00:00:00:10 ###### mirrormode TRUE directory /apps/openldap/var/openldap-data overlay unique unique_attributes mail overlay ppolicy ppolicy_default "cn=default,ou=pwdPolicy,dc=example,dc=com" ppolicy_use_lockout -- Please let me know in case you need further details. Thanks&Regards Anil Beniwal +919891695048

2 3

How to force password change upon account creation
by Kyle Harris 24 Dec '12

24 Dec '12

Hello All, I have a perl script that allows for the creation of new accounts in OpenLDAP. I am attempting to find a way to force the newly created user to change his or her password upon first login. I tried setting the attribute pwdMustChange to TRUE but that attribute must not be definable upon user creation. So, how can this be accomplished so that a new user is forced to change passwords after they first log on? Thank you.

6 5

Migration from openldap 2.4.20 to 2.4.33
by anil beniwal 24 Dec '12

24 Dec '12

Hi We are planing migration from openldap 2.4.20 (with bdb 4.8) to openldap 2.4.33 (bdb 5.1.29) No of users are 4 million and about to go live within next 10 days. We are using flat file for configuration in use. Below is my slapd.conf and DB_CONFIG files include /apps/openldap/etc/openldap/schema/core.schema include /apps/openldap/etc/openldap/schema/cosine.schema include /apps/openldap/etc/openldap/schema/nis.schema include /apps/openldap/etc/openldap/schema/inetorgperson.schema include /apps/openldap/etc/openldap/schema/openldap.schema include /apps/openldap/etc/openldap/schema/dyngroup.schema include /apps/openldap/etc/openldap/schema/ppolicy.schema include /apps/openldap/etc/openldap/schema/channelIdentifier.schema include /apps/openldap/etc/openldap/schema/platform.schema include /apps/openldap/etc/openldap/schema/extendedProfileKey.schema include /apps/openldap/etc/openldap/schema/extendedProfileValue.schema include /apps/openldap/etc/openldap/schema/behaviorKey.schema include /apps/openldap/etc/openldap/schema/behaviorValue.schema include /apps/openldap/etc/openldap/schema/questionAnswer.schema include /apps/openldap/etc/openldap/schema/extendedTop.schema include /apps/openldap/etc/openldap/schema/counter.schema pidfile /apps/openldap/var/run/slapd.pid argsfile /apps/openldap/var/run/slapd.args logfile /apps/logs/ldap loglevel 16640 database bdb suffix "dc=ibm,dc=com" access to attrs=userPassword by self write by anonymous auth by * break access to * by group/groupOfUniqueNames/uniqueMember.exact="cn=VWrite,ou=businessUsersGroup,dc=ibm,dc=com" manage by group/groupOfUniqueNames/uniqueMember.exact="cn=VRead,ou=businessUsersGroup,dc=ibm,dc=com" read by * break access to * by self write by anonymous auth by * read rootdn "cn=Manager,dc=ibm,dc=com" rootpw {SSHA}dXDFSQeFjSoa/A1HfJ3TAzYf8 ################## SSL ########################################## # #TLSVerifyClient allow TLSCipherSuite HIGH:MEDIUM:+SSLv3 TLSCACertificateFile /apps/openldap/etc/openldap/cacerts/nascarcacert.pem TLSCertificateFile /apps/openldap/etc/openldap/cacerts/sj.crt TLSCertificateKeyFile /apps/openldap/etc/openldap/cacerts/sj.key # index entryCSN eq index entryUUID eq index mail,uid,postalCode,smail,channelType,channelValue,answer,behavName,objectclass,tokenID,type eq index givenName,sn,city,question,behavValue,cn,extName sub index displayName approx overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 serverid 3 syncrepl rid=111 provider=ldap://mmprod04 binddn="cn=Manager,dc=ibm,dc=com" bindmethod=simple starttls=yes tls_reqcert=allow credentials=G00gle# searchbase="dc=ibm,dc=com" type=refreshAndPersist retry="5 5 300 +" interval=00:00:00:10 syncrepl rid=222 provider=ldap://mmprod05 binddn="cn=Manager,dc=ibm,dc=com" bindmethod=simple starttls=yes tls_reqcert=allow credentials=G00gle# searchbase="dc=idm,dc=com" type=refreshAndPersist retry="5 5 300 +" interval=00:00:00:10 mirrormode TRUE cachesize 100000 idlcachesize 300000 lastmod on checkpoint 128 15 concurrency 100 directory /apps/openldap/var/openldap-data overlay unique unique_attributes mail overlay ppolicy ppolicy_default "cn=default,ou=pwdPolicy,dc=idm,dc=com" ppolicy_use_lockout DB_CONFIG set_cachesize 0 4294967295 0 set_lg_regionmax 2048576 set_lg_max 20485760 set_lg_bsize 2097152 set_lk_max_locks 10000 set_lk_max_objects 5000 set_lk_max_lockers 5000 My querries are:- 1. What should be taken care(Best Practices). 2. Data migration can be db_hotbackup will work? 3. Can same flat file method be used, if not what could be the way should work out. 4. any thing else i should be aware and is critical. -- Thanks&Regards Anil Beniwal

1 0

Config dynamic list using slapd.d
by vitdua 24 Dec '12

24 Dec '12

Hi all, I have managed to make Openldap to use dynamic list. Luckily, I found this http://koivunej.wordpress.com/2012/07/16/learning-openldap-2-4-cnconfig-usa… and config LDAP successfully. But I also need to config *member-attr*: overlay dynlist dynlist-attrset groupOfURLs labeledURImember image as in OpenLDAP document. Could you show me way to do it with OLC (cn=config)? Thanks, Viet

1 0

Why ldapsearch is not working with anonymous bind after upgrading OpenLDAP to v2.4?
by Sachin Divekar 23 Dec '12

23 Dec '12

Dear all, I have a setup of **OpenLDAP v2.3** which I am using for last few years. Following are the lines in `slapd.conf` for access control. access to dn.one="o=abc, c=IN" by * read access to dn.base="o=abc, c=IN" by * none When I do ldapsearch using anonymous bind gives me result. For example following command gives result. ldapsearch -x -h localhost -b "o=abc,c=IN" Now I upgraded the OS, CentOS from 5.5 to 6.3 so the version of OpenLDAP is **OpenLDAP v2.4**. We have not changed the schema. But now the same `ldapsearch` gives me `result: 32 No such object` error. But it works when I added following line in access control configuration. access to dn.one="o=abc, c=IN" by * read access to dn.base="o=abc, c=IN" by anonymous read by * none What can be the reason? Is there any security risk in doing so? Thank you. -- Regards, Sachin Divekar

2 2

Why I can't get back attribute tokenGroups from AD with ldapsearch command?
by ctosgh 22 Dec '12

22 Dec '12

Hi, World I have one question about my recent work on LDAP. Why I can't get tokenGroups back but can get other attributes back with following search against an AD server? [root@fc11-lab ~]# ldapsearch -x -D "cn=admin,cn=Users,dc=jacky,dc=org,dc=cn" -b "cn=Users,dc=jacky,dc=org,dc=cn" -w 11111111 -H "ldap://x.x.x.x:389" "sAMAccountName=user1" cn whenChanged userPrincipalName tokenGroups # extended LDIF # # LDAPv3 # base <cn=Users,dc=jacky,dc=org,dc=cn> with scope subtree # filter: sAMAccountName=user1 # requesting: cn whenChanged userPrincipalName tokenGroups # # search result search: 2 result: 1 Operations error text: 00002120: SvcErr: DSID-03140293, problem 5012 (DIR_ERROR), data 0 # numResponses: 1 However, if I do NOT request tokenGroups attribute I get a successful response. [root@fc11-lab ~]# ldapsearch -x -D "cn=admin,cn=Users,dc=jacky,dc=org,dc=cn" -b "cn=Users,dc=jacky,dc=org,dc=cn" -w 11111111 -H "ldap://x.x.x.x:389" "sAMAccountName=user1" cn whenChanged userPrincipalName # extended LDIF # # LDAPv3 # base <cn=Users,dc=jacky,dc=org,dc=cn> with scope subtree # filter: sAMAccountName=user1 # requesting: cn whenChanged userPrincipalName # # user1, Users, jacky.org.cn dn: CN=user1,CN=Users,DC=jacky,DC=org,DC=cn cn: user1 whenChanged: 20121221012448.0Z userPrincipalName: user1(a)jacky.org.cn # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 I do see entry "CN=user1,CN=Users,DC=jacky,DC=org,DC=cn" has the attribute tokenGroups on AD. Any thoughs? TIA Thanks, Jacky

2 1

nssov works fine, unable to set nssov-pam-session
by Василий Молостов 22 Dec '12

22 Dec '12

Before enabling nssov I have got nslcd working, so the transition from one to another was clear (ubuntu 12.04.1, openldap 2.4.28-1.1ubuntu4.2). according to slapo-nssov man page I have added to my slapd.conf: moduleload nssov overlay nssov nssov-pam userhost nssov-pam-session login nssov-pam-session sshd but olcOverlay=nssov,olcDatabase=hdb,cn=config has no olcNssPamSession and its related values after creation of db. When I add olcNssPamSession into cn=config with above values by hand - loginstatus is working well, but when nssov-pam-session into slapd.conf - none. Does it mean that I am missed something to correctly set nssov-pam-session in slapd.conf?

3 2

RE: META database root DN : no such object
by Bryce Powell 21 Dec '12

21 Dec '12

Aaron, thanks very much for your suggestion. I understand the key concept here is "subordinate", in order to glue the meta database into another superior naming context. I was able to create a LDIF database, containing a baseDN, which was superior to the subordinate META database. The vendor application appears to accept this LDIF database now, as it can verify the existence of the baseDN. My next hurdle will be to get it authorize users based on group membership within the underlying Active Directories. But I think that may be beyond the scope of this forum. Thanks again for your help. Bryce -----Original Message----- From: Aaron Richton [mailto:richton@nbcs.rutgers.edu] Sent: December 20, 2012 03:20 PM To: Bryce Powell Cc: openldap-technical(a)openldap.org Subject: Re: META database root DN : no such object On Thu, 20 Dec 2012, Bryce Powell wrote: > ?When a search with base "dc=foo,dc=com" is attempted, if the scope is > "base" it fails with "no such object"; in fact, the common root > of the two targets (prior to massaging) does not exist.? The vendor > won?t change their code to skip the verification, and recommended I > use Microsoft?s ADAM instead of OpenLDAP. I would prefer to leverage > OpenLDAP, so does anyone have any recommendations as to what I could do? > Thanks, Bryce You're quoting from "scenario 2a" from the man page, which envisions dc=a,dc=foo,dc=com and dc=b,dc=foo,dc=com; your desire is to serve some data at dc=foo,dc=com. So you have to make that exist (obviously). You'll need a data store to place your "dc=foo,dc=com" data, and you'll need to "attach" dc=a,dc=foo,dc=com and dc=b,dc=foo,dc=com. So basically... database meta # maybe ldap or even relay in some installations subordinate suffix "dc=a,dc=foo,dc=com" uri "ldap://a.foo.com/dc=a,dc=foo,dc=com" database meta subordinate suffix "dc=b,dc=foo,dc=com" uri "ldap://b.foo.com/dc=a,dc=foo,dc=com" database mdb # or hdb or bdb or even ldif or..... suffix "dc=foo,dc=com" So then dc=a and dc=b live over the wire, and dc=foo,dc=com can be filled with Whatever You Want. Like, say, your base-scope data at dc=foo,dc=com. You'll almost certainly want to set up some careful ACLs and make sure, in particular, that nobody writes any dc=a/dc=b data to the on-disk database. Without trying it, I don't think it would cause a failure per se, but it would cause a very confused LDAP admin (quite undesirable)! (As for "dc=c" data on-disk, that's up to you and your site.)

1 0

Can we configure the way by which slapd return search response?
by ctosgh 21 Dec '12

21 Dec '12

Hi, All I do the following similiar search against AD and openldap respectively with ldapsearch command. For AD: ldapsearch -x -D "cn=admin,cn=Users,dc=jacky,dc=org,dc=cn" -b "cn=Users,dc=jacky,dc=org,dc=cn" -w 11111111 -H "ldap://x.x.x.x:389" "sAMAccountName=user1" For openldap: ldapsearch -x -D "cn=admin,dc=jacky,dc=com" -b "ou=users,dc=jacky,dc=com" -w 11111111 -H "ldap://x.x.x.x:389" "uid=user" I capture all the packets for above two searchs with tcpdump and I find that AD server will send search response(including search result entry & search result) in ONE packet while openldap will send search result entry and search result independently in two packets. My question: Is how to send search response back(in one or more packets) implementation specific? Thanks, Jacky

1 0

META database root DN : no such object
by Bryce Powell 21 Dec '12

21 Dec '12

Hi, I've configured a META database to proxy two LDAP directories. Each of those LDAP directories is in turn a proxy for an Active Directory. My intention was to use the meta directory as a single point for user authentication, however, the vendor application does not allow one to use the OpenLDAP meta directory. Their LDAP authentication setup wizard performs a verification of the specified baseDN, i.e. the root DN (suffix) of the meta database, and this does not exist. As per the slapd-meta man page: "When a search with base "dc=foo,dc=com" is attempted, if the scope is "base" it fails with "no such object"; in fact, the common root of the two targets (prior to massaging) does not exist." The vendor won't change their code to skip the verification, and recommended I use Microsoft's ADAM instead of OpenLDAP. I would prefer to leverage OpenLDAP, so does anyone have any recommendations as to what I could do? Thanks, Bryce

2 1

Re: Disble the 389 ldapsearch
by Bheeshma SM 20 Dec '12

20 Dec '12

hi I tried ./slapd -h ldap:/// ./slapd -h ldaps:/// Slapd status says its listening to both the ports But when i try ldapsearch -p 389 -h <hostname> it works but with -p 636 its doesnot work. and -H ldap:// works and -H ldaps:// works can you help me out with this. What i want is ldapsearch must not be successful with ldap:// and -p 389 but it must be successfull in ldaps:// and -p 636 Thanks Bhee On Thu, Dec 20, 2012 at 12:49 PM, Allan E. Johannesen <aej(a)wpi.edu> wrote: > See "-h" in slapd to specify the ports on which it will listen, if that's > what > you want to do. >

1 0

Disble the 389 ldapsearch
by Bheeshma SM 20 Dec '12

20 Dec '12

Hi I want to know how to disable the 389 search in Openldap. I am using Openldap 2.4.33 in RHEL 5.8 I have both the search running . ldapsearch -x -H ldap://hostname -D "<>" -w "<>" -b "<>" ldapsearch -x -H ldaps://hostname -D "<>" -w "<>" -b "<>" Both the above searches are running successfully, but i dont want the 389 dat is the ldap://hostname to run, Is there are way i can disable that..? Thanks in advance Bhee

1 0

DB_LOG_AUTOREMOVE not working
by BheeshmaManjunath 19 Dec '12

19 Dec '12

Hi I am using the latest Openldap. Software- Openldap 2.4.33 Server - RHEL 5.8 64 bit When i do an Ldapsearch, Ldapadd, Ldapdelete , the log.00000000x files are getting generated in the directory folder. To auto remove them i did add the " set_flags DB_LOG_AUTOREMOVE " to the DB_CONFIG file which is present in the directory folder itself. And I am using crontab to add the new data on the daily bases, but the log.00000000x files which are generated are not being auto removed..? Can anyone help me regarding this issue..? Is there a need to restart the server before adding the new data on the daily bases..? If so why is it so..? Thanks bhee

3 4

acl issue
by anil beniwal 19 Dec '12

19 Dec '12

Hi We are having below two acl to allow acces for read and write to two different users. First one is working fine, 2nd one is not allowing to write access to Vpwrite user. Can some body help me to rectify it. Scanerio is we want to delegate read access to all the attributes to one user and other user to write access to all the attributes. This is for login. access to attrs=userPassword by self write by dn="cn=Vpwrite,ou=businessUsersGroup,dc=example,dc=com" write by dn="cn=Vpread,ou=businessUsersGroup,dc=example,dc=com" read by anonymous auth by * break Read/Write access access to * by dn="cn=Vwrite,ou=businessUsersGroup,dc=example,dc=com" write by dn="cn=Vread,ou=businessUsersGroup,dc=example,dc=com" read by * none Please let me know , if you need more details. -- Thanks&Regards Anil Beniwal

2 1

best practices for backing up ldap configuration
by Khosrow Ebrahimpour 19 Dec '12

19 Dec '12

Hello everyone, Are there any best practices for backing up ldap configuration? Our current approach is to run a nightly diff on the output of "slapcat -l -b cn=config' and if it has changed, the new ldif is comitted to svn. Ideally, I'd like to just add the slapd.d directory to svn, and everytime it changes I'd checkin the new version. But I have a feeling that the ".svn" directories that will be created are going to cause trouble. Is there better way of doing this? Thanks, -- Khosrow

7 13

Doe's olcAuthzRegexp rules applied on the all incoming authentication requests?
by Tio Teath 18 Dec '12

18 Dec '12

Are olcAuthzRegexp rules applied on the all incoming authentication requests, or on the SASL request only? And what exactly loglevel shows those rules processing? I've tried all of them , and any showed me olcAuthzRegexp processing.

1 0

EXTERNAL mech missing
by Emmanuel Dreyfus 18 Dec '12

18 Dec '12

Hi When is the EXTERNAL mech proposed? I want to use peercred on a slapd instance, but EXTERNAL is not available: $ ldapsearch -xLLLH ldapi:/// -s base -b '' supportedSASLMechanisms dn: supportedSASLMechanisms: DIGEST-MD5 supportedSASLMechanisms: PLAIN supportedSASLMechanisms: LOGIN I have other machines when it shows up without a hassle. Where is the setting that cause it to be proposed? -- Emmanuel Dreyfus manu(a)netbsd.org

3 7

Re: Bulk update
by anil beniwal 18 Dec '12

18 Dec '12

Hi Quanah Thanks a lot. We can't change ldap version now. As we are about to GoLive. On Mon, Dec 17, 2012 at 10:14 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Monday, December 17, 2012 10:59 AM +0530 anil beniwal < > beni.anil(a)gmail.com> wrote: > > >> Hi >> >> We want to update bulk records ( 3 million ) insert in my openldap >> 42.4.20 on rhel 6.3 . Three servers in replication. >> >> Each record is almost 6 KB. >> >> My concern, is there any tool or trick to speed this up. As of now for >> some 9 K records its taking around 3 hours. >> >> What should be my DB_CONFIG file . >> >> >> Please let me know what else should be taken care off. >> > > a) Upgrade to a sane, stable version of OpenLDAP < > http://ltb-project.org/wiki/**download#openldap<http://ltb-project.org/wiki/download#openldap> > > > b) Use -q with slapadd > c) Ensure your tool threads setting is appropriate for the number of > cpu/cores on your server > d) Read over <https://wiki.zimbra.com/wiki/**OpenLDAP_Performance_Tuning#* > *Configuring_the_Berkeley_DB_**subsystem_to_increase_LDAP_** > server_performance<https://wiki.zimbra.com/wiki/OpenLDAP_Performance_Tuning#Configuring_the_Be…>> > and apply it to your setup. In particular, if you have plenty of RAM, use > a shared memory key, and set the DB_CONFIG cachesize to a large value. > --Quanah > > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Thanks&Regards Anil Beniwal

1 0

DB_LOG_AUTOREMOVE not working without restarting the server.
by Bheeshma SM 17 Dec '12

17 Dec '12

Hi I am using the latest Openldap. Software- Openldap 2.4.33 Server - RHEL 5.8 64 bit When i do an Ldapsearch, Ldapadd, Ldapdelete , the log.00000000x files are getting generated in the directory folder. To auto remove them i did add the " set_flags DB_LOG_AUTOREMOVE " to the DB_CONFIG file which is present in the directory folder itself. And I am using crontab to add the new data on the daily bases, but the log.00000000x files which are generated are not being auto removed..? Can anyone help me regarding this issue..? Is there a need to restart the server before adding the new data on the daily bases..? If so why is it so..? Thanks bhee

1 0

Bulk update
by anil beniwal 17 Dec '12

17 Dec '12

Hi We want to update bulk records ( 3 million ) insert in my openldap 42.4.20 on rhel 6.3 . Three servers in replication. Each record is almost 6 KB. My concern, is there any tool or trick to speed this up. As of now for some 9 K records its taking around 3 hours. What should be my DB_CONFIG file . Please let me know what else should be taken care off. -- Thanks&Regards Anil Beniwal

2 1

openldap shared address book + outlook 2010.
by Sandeep 17 Dec '12

17 Dec '12

HI, I am configuring a shared address book using Centos 6.3 openldap-2.4.23-26 Configuration is working with Thunderbird. but when checked with Outlook, I need to select advance find to get the list. Names only option remains unavailable. Any pointer ? Thanks Sandeep

3 2

Re: opeLDAP + backsql + salted_hashed_password, how to adopt the mappings
by Dan White 17 Dec '12

17 Dec '12

>>On 12/16/12 12:04 +0100, DavidHornung wrote: >>>I have to say thank you! I changed in the table >>>ldap_attr_mappings the value of userPassword from >>>persons.password >>> >>>to >>>text('{CRYPT}'||persons.password) >>> >>>Now I am able to auth again the salted MD5 passwords! >>> >>>One further question: >>>I tried to use blowfish >>>UPDATE persons SET password = crypt('secret', gen_salt('bf')); >>>instead of md5 >>>UPDATE persons SET password = crypt('secret', gen_salt('bf')); >>> >>>but i could not authenticate, what could be the problem? >> >>Check your local manpage for crypt(3) to see if blowfish is supported on >>your system, and that the ID matches the postgresql output. >> > >Yes, it gives > > ID | Method >--------------------------------------------------------- > 1 | MD5 > 2a | Blowfish (not in mainline glibc; added in some > | Linux distributions) > 5 | SHA-256 (since glibc 2.7) > 6 | SHA-512 (since glibc 2.7) > > >and the 2a is also given back from postgresql crypt When using the '{CRYPT}' identifier, you're telling slapd to make a 'crypt' system call to verify the hash. If that is failing for blowfish (but working for md5), that indicates that your problem is likely with how glibc was compiled on your system. Check with your distribution's glibc maintainer to verify they have included blowfish support (for the crypt call). -- Dan White

1 0

Ldap server Behind Firewall
by Hugo Deprez 17 Dec '12

17 Dec '12

Hello, I am currently running OpenLdap behind a checkpoint firewall. Some hosts are reaching the LDAP server, but the source IP is NAT Hide. (original IP is 192.168.0.1 - translated 192.168.1.2). I can see on my firewall many drops coming from the LDAP server to the translated IP. This kind of packet shouldn't exist, as I am using corosync for HA => No packet are coming from the VIP. This maybe a problem on the checkpoint firewall (which is not handling correctly the NAT), but I would like to know if someone already had this behaviour already with any firewall ? Maybe I am missing something on OpenLDAP network flow. Best regards, Hugo

1 0

Re: opeLDAP + backsql + salted_hashed_password, how to adopt the mappings
by Dan White 16 Dec '12

16 Dec '12

>On 12/16/12 08:55 +0100, DavidHornung wrote: >>>I already set up a self-compiled openldap-server 2.4.33 on CentOS6 with >>>back-sql, especially posgtresql as backend. I am already able to >>>authenticate from my MoinMoin Wiki via LDAP - but up to now the >>>passwords are saved in clear text in the postgresql table. >>> >>>Now I want to save the passwords as salted hash, rearding to >>>postgresql documentation >>See chapter 14.4 of the OpenLDAP Administrator's Guide. >> >>If the output of your postgresql crypt function produces a compatible >>format, use a concatenation function to prepend '{CRYPT}' (or other >>identifier) to your hash before postgresql hands the data off to >>back-sql. On 12/16/12 12:04 +0100, DavidHornung wrote: >I have to say thank you! I changed in the table ldap_attr_mappings >the value of userPassword from >persons.password > >to >text('{CRYPT}'||persons.password) > >Now I am able to auth again the salted MD5 passwords! > >One further question: >I tried to use blowfish >UPDATE persons SET password = crypt('secret', gen_salt('bf')); >instead of md5 >UPDATE persons SET password = crypt('secret', gen_salt('bf')); > >but i could not authenticate, what could be the problem? Check your local manpage for crypt(3) to see if blowfish is supported on your system, and that the ID matches the postgresql output. -- Dan White

1 0

opeLDAP + backsql + salted_hashed_password, how to adopt the mappings
by DavidHornung 16 Dec '12

16 Dec '12

Hello, I would really appreciate if you could help me with following. I already set up a self-compiled openldap-server 2.4.33 on CentOS6 with back-sql, especially posgtresql as backend. I am already able to authenticate from my MoinMoin Wiki via LDAP - but up to now the passwords are saved in clear text in the postgresql table. Now I want to save the passwords as salted hash, rearding to postgresql documentation creating a hash UPDATE ... SET pswhash = crypt('new password', gen_salt('bf')); ask for password SELECT pswhash = crypt('entered password', pswhash) FROM ... ; Now my question : How adopt the mappings in backsql to work with the hashes? Cheers, David

2 1

Help needed for Openldap > Active directory slave/proxy setup.
by Marco van Putten 14 Dec '12

14 Dec '12

Hi all, We want to setup a Openldap server which is a slave to our Active directory. The ldap server only has to do replication of the necessary records to act as a address book for non Exchange users. Further more the authentication has to be done against the users in the Active directory. I found some guides/examples to set up the authentication part. But none of them seems to do want we want because it requires to have the user in your Openldap server with a special "userPassword {SASL}user(a)domain.com" entry. But we want the openldap database to only contain contact information and not username/password information. Does anybody know how to set up such a thing and can give me some hints/guides/recipes on how to do this? Thanks, Marco. -- M. (Marco) van Putten TU Delft / Shared Service Centre ICT Marco.vanPutten(a)tudelft.nl

3 3

authz-regexp trouble, help!
by Василий Молостов 14 Dec '12

14 Dec '12

Hi, I have th following directive in the slapd.conf: authz-regexp gidNumber=([^0][0-9]+).uidNumber=([^0][0-9]+),cn=peercred,cn=external,cn=auth ldapi:///ou=people,dc=local???(uidNumber=$2) but server is unable to fetch (slap_sasl2dn: Converted SASL name to <nothing>) here is trace output (slapd -d 2177 -h "ldapi:/// ldaps:/// ldap:///"): 50ca62b8 >>> dnPrettyNormal: <> 50ca62b8 <<< dnPrettyNormal: <>, <> 50ca62b8 do_bind: dn () SASL mech EXTERNAL 50ca62b8 ==>slap_sasl2dn: converting SASL name gidNumber=1000+uidNumber=1000,cn=peercred,cn=external,cn=auth to a DN 50ca62b8 ==> rewrite_context_apply [depth=1] string='gidNumber=1000+uidNumber=1000,cn=peercred,cn=external,cn=auth' 50ca62b8 ==> rewrite_rule_apply rule='gidNumber=([^0][0-9]+).uidNumber=([^0][0-9]+),cn=peercred,cn=external,cn=auth' string='gidNumber=1000+uidNumber=1000,cn=peercred,cn=external,cn=auth' [1 pass(es)] 50ca62b8 ==> rewrite_context_apply [depth=1] res={0,'ldapi:///ou=people,dc=local??sub?(uidNumber=1000)'} 50ca62b8 slap_parseURI: parsing ldapi:///ou=people,dc=local??sub?(uidNumber=1000) ldap_url_parse_ext(ldapi:///ou=people,dc=local??sub?(uidNumber=1000)) 50ca62b8 <==slap_sasl2dn: Converted SASL name to <nothing> 50ca62b8 SASL Authorize [conn=1001]: proxy authorization allowed authzDN="" 50ca62b8 send_ldap_sasl: err=0 len=-1 50ca62b8 do_bind: SASL/EXTERNAL bind: dn="gidNumber=1000+uidNumber=1000,cn=peercred,cn=external,cn=auth" sasl_ssf=0 50ca62b8 send_ldap_response: msgid=1 tag=97 err=0 Direct sasl authz mapping works fine, but URI does not, what's wrong with this stuff? How I can check URI correctness for slapd or get tracing info from ldap_url_parse_ext/slap_sasl2dn about why they returned nothing? With wich access rights slapd does its internal query ? How to configure them ?

3 2

rwm/relay and ldapwhoami
by Tim Watts 13 Dec '12

13 Dec '12

OK - must be missing something really basic - and I am new to LDAP... I have a server (ldapmaster) that serves dc=new,dc=example,dc=com and a seperate server, ldaplegacy, that uses slapd-ldap + rwm to proxy-translate requests aimed at: dc=old,dc=example,dc=com So: ldapsearch -x -b dc=old,dc=example,dc=com -H ldap://ldaplegacy/ returns ... # me, people, old.example.com dn: uid=me,ou=people,dc=old,dc=example,dc=com objectClass: top objectClass: inetOrgPerson ... nice - exactly as expected. But ldapwhoami -x -W -D uid=me,ou=people,dc=old,dc=example,dc=com -H ldap://ldaplegacy/ returns (after successful bind) dn:uid=me,ou=people,dc=new,dc=example,dc=com Why doesn't the DN get translated? The config section that's relevant on ldaplegacy is: slapd.conf ############################### ... database relay suffix "dc=old,dc=example,dc=com" relay "dc=new,dc=example,dc=com" overlay rwm rwm-suffixmassage "dc=new,dc=example,dc=com" ... ############################### I thought I needed more magic to translate the replies, but that *looks* like it is happening with ldapsearch??? Cheers! Tim -- Tim Watts Personal Blog: http://www.dionic.net/tim/ "History will be kind to me for I intend to write it."

2 2

ppolicy and rwm/relay segfaulting
by Tim Watts 13 Dec '12

13 Dec '12

Hi, This is weird - quite possible a config problem, I'm hoping someone can spot it :) I have a minimal slapd server which works fine with either an rwm/relay section or a ppolicy section - but not both at once. I'm happy to explain *why* I need to do this if asked, but for now it would just clutter this message. I do have a Really Good(TM) reason. ============ Actual problem =================== We load slapd up with actual entries for the dc=new,dc=example,dc=com domain. slapd is configured to map all records with rwm/relay to dc=old,dc=example,dc=com so clients with the old config still work. ie we load a real record: 1) dn: uid=testuser,ou=people,dc=new,dc=example,dc=com and we want clients asking about 2) dn: uid=testuser,ou=people,dc=old,dc=example,dc=com will be served from (1) ======== OK here's an example ================ === Server ==== Running debian 6 server with debian slapd 2.4.23-7.2 /usr/sbin/slapd -d 4 -h "ldap:/// ldaps:/// ldapi:///" -g openldap -u openldap -f /etc/ldap/slapd.conf === Test client === Running test against the "old" realm: ldapwhoami -x -W -D uid=testuser,ou=people,dc=old,dc=example,dc=com # Enter the wrong password and it fails correctly and server runs OK. # Enter the right password and the client says: ldap_result: Can't contact LDAP server (-1) Server says (last few lines from slapd): [rw] bindDN: "uid=testuser,ou=people,dc=old,dc=example,dc=com" -> "uid=testuser,ou=people,dc=old,dc=example,dc=com" [rw] bindDN: "uid=testuser,ou=people,dc=old,dc=example,dc=com" -> "uid=testuser,ou=people,dc=new,dc=example,dc=com" => ldap_bv2dn(uid=testuser,ou=people,dc=new,dc=example,dc=com,0) <= ldap_bv2dn(uid=testuser,ou=people,dc=new,dc=example,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=testuser,ou=people,dc=new,dc=example,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=testuser,ou=people,dc=new,dc=example,dc=com)=0 => bdb_entry_get: ndn: "uid=testuser,ou=people,dc=new,dc=example,dc=com" => bdb_entry_get: oc: "(null)", at: "(null)" => bdb_entry_get: ndn: "cn=default,ou=pwpolicies,dc=new,dc=example,dc=com" => bdb_entry_get: oc: "(null)", at: "(null)" ==> hdb_bind: dn: uid=testuser,ou=people,dc=new,dc=example,dc=com send_ldap_result: err=0 matched="" text="" => bdb_entry_get: ndn: "uid=testuser,ou=people,dc=new,dc=example,dc=com" => bdb_entry_get: oc: "(null)", at: "(null)" Segmentation fault However, queries against the "new" domain work: ldapwhoami -x -W -D uid=testuser,ou=people,dc=new,dc=example,dc=com Enter LDAP Password: dn:uid=testuser,ou=people,dc=new,dc=example,dc=com If I disable ppolicy in slapd.conf, queries agains the "old" domain work: root@ldaptest1:/etc# ldapwhoami -x -W -D uid=testuser,ou=people,dc=old,dc=example,dc=com Enter LDAP Password: dn:uid=testuser,ou=people,dc=new,dc=example,dc=com (the rewrite is not perfect - but that may not matter for my clients). Almost certainly I have done something stupid - and it seems clear that ppolicy is being upset by the relay mappings. Any ideas how to fix would be *very* welcome - I have been all over Google and the man pages. All the best! Tim OK - boring stuff: slapd.conf ########################################### ####################################################################### # Global Directives: # Features to permit allow bind_anon_cred bind_anon_dn update_anon # Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/ppolicy.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel sync stats sizelimit 5000 tool-threads 1 modulepath /usr/lib/ldap moduleload back_hdb moduleload back_relay moduleload rwm moduleload ppolicy overlay rwm rwm-rewriteEngine on backend hdb ####################################################################### # Global ACLs # # Ensure read access to the base for things like # supportedSASLMechanisms. access to dn.base="" by * read # The userPassword by default can be changed # by the entry owning it if they are authenticated. # This ACL must be first or password leakage will happen!!! access to attrs=userPassword,shadowLastChange by peername.path="/var/run/slapd/ldapi" manage by dn="cn=admin,dc=new,dc=example,dc=com" manage by set="user/uid & [cn=sysadmin,ou=groups,dc=new,dc=example,dc=com]/memberUid" write by self write by * auth # The admin dn has full write access, everyone else # can read everything. Local unix domain socket (root only) # Can do everything access to * by peername.path="/var/run/slapd/ldapi" manage by dn="cn=admin,dc=new,dc=example,dc=com" manage by set="user/uid & [cn=sysadmin,ou=groups,dc=new,dc=example,dc=com]/memberUid" write by * read ####################################################################### # Main new.example.com authoritative database # database hdb suffix dc=new,dc=example,dc=com rootdn "cn=admin,dc=new,dc=example,dc=com" rootpw "{SSHA}NoNoNooo..." directory "/var/lib/ldap" dbconfig set_cachesize 0 134217728 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 index objectClass eq lastmod on checkpoint 512 30 ####################################################################### # # Password Policy # # overlay ppolicy ppolicy_default "cn=default,ou=pwpolicies,dc=new,dc=example,dc=com" ppolicy_use_lockout ppolicy_hash_cleartext ####################################################################### # Virtual maps - compatibility with old.example.com only # # map dc=old to dc=new # database relay suffix "dc=old,dc=example,dc=com" relay "dc=new,dc=example,dc=com" overlay rwm rwm-suffixmassage "dc=new,dc=example,dc=com" ########################################### Initial database loaded with slapadd from this ldif: ########################################### dn: dc=new,dc=example,dc=com objectClass: top objectClass: dcObject objectClass: organization o: new.example.com dc: new dn: cn=admin,dc=new,dc=example,dc=com objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator userPassword:: NoNoNoooo... dn: ou=people,dc=new,dc=example,dc=com objectClass: organizationalUnit ou: people dn: ou=groups,dc=new,dc=example,dc=com objectClass: organizationalUnit ou: groups dn: ou=pwpolicies,dc=new,dc=example,dc=com objectClass: organizationalUnit ou: pwpolicies # # # Standard policy for normal people # dn: cn=default,ou=pwpolicies,dc=new,dc=example,dc=com objectClass: device objectClass: pwdPolicy cn: default pwdAttribute: userPassword pwdMinAge: 0 pwdMaxAge: 15811200 pwdExpireWarning: 1814400 pwdGraceAuthnLimit: 3 pwdInHistory: 6 pwdCheckQuality: 2 pwdMaxFailure: 5 pwdMinLength: 8 pwdLockout: TRUE pwdLockoutDuration: 300 pwdFailureCountInterval: 300 pwdMustChange: TRUE pwdAllowUserChange: TRUE pwdSafeModify: FALSE dn: uid=testuser,ou=people,dc=new,dc=example,dc=com objectClass: top objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount cn: Test User employeeType: Staff gecos: Test User gidNumber: 1000 givenName: Test homeDirectory: /homes/testuser loginShell: /bin/bash mail: testuser(a)new.example.com sn: User uid: testuser uidNumber: 1000 userPassword: {SSHA}NoNoNoooo... dn: cn=ddh-staff,ou=groups,dc=new,dc=example,dc=com objectClass: top objectClass: posixGroup cn: ddh-staff description: Test Group gidNumber: 1000 memberUid: testuser dn: cn=sysadmin,ou=groups,dc=new,dc=example,dc=com objectClass: top objectClass: posixGroup cn: sysadmin description: Staff: System Admin Group gidNumber: 1001 memberUid: testuser ########################################### ########################################### ########################################### ########################################### ########################################### ########################################### -- Tim Watts Personal Blog: http://www.dionic.net/tim/ "A fanatic is one who can't change his mind and won't change the subject."

4 10

Search for the last gidNumber/uidNumber
by cbulist 13 Dec '12

13 Dec '12

Hi, I would like to do a search using ldapsearh in order to get the last gidNumber/uidNumber assigned. Any clue? Thanks in advance!

2 2

How to find a users last password change date/time
by Kyle Harris 12 Dec '12

12 Dec '12

Hello All, I am new to OpenLDAP but have it up and running and have allowed users to change their own password. I was about to start working on a Perl script to grab the last password change date/time and email a user a few days before it expires. I have done that before with Perl using Active Directory as the LDAP server. The problem is that when I use ldapsearch, I can see the user attributes including the hashed password but I don't see where it stores the last time a password was changed? In the event it matters, I am using bdb as the database and everything else including logins is working fine. Am I using the wrong tool? How can I get this information? Thank you in advance.

3 2

OpenLDAP as an address book for MS Outlook
by Victor Sudakov 12 Dec '12

12 Dec '12

Dear Colleagues, I have been trying to investigate what is needed in OpenLDAP to have Microsoft Outlook 2007 display a list of names in the addressbook when first accessed in the same way that it does with ActiveDirectory/Exchange. From what I have found out from Web searching, MS Outlook requires a certain set of overlays, supportedCapabilities and supportedControls from the LDAP server to show the addressbook this way. The CommunigatePro LDAP server can emulate those. Are there any success stories or recommendations or howtos how to setup OpenLDAP to provide such service? I am running openldap-server-2.4.33 on FreeBSD. I have tried various combinations of sssvlv and valsort overlays to no avail. Outlook does show contacts from the OpenLDAP addressbook when I specifically search for them, so my general setup (schema etc) seems to be correct. Thank you very much in advance for any input. -- Victor Sudakov, VAS4-RIPE, VAS47-RIPN sip:sudakov@sibptus.tomsk.ru

10 45

Re: MDB and slapcat of subtrees
by Venkat 11 Dec '12

11 Dec '12

Please test after applying < http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commitdiff;h=a2cf… > > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > Thanks Quanah and Howard for the speedy solution, the patch worked -- no more crashes on subtrees. The help is much appreciated! cheers, Ven

1 0

RE: LDAP database timeout settings
by Bryce Powell 11 Dec '12

11 Dec '12

Having done some more research, it appears that Active Directory also has some settings that could result in disconnected connections. I experimented with idle-timeout set to 30 seconds for the LDAP databases, but this seemed to exacerbate the frequency of the errors. The behaviour exhibits as 'dead' connections, and LDAP does not appear to attempt to re-establish these connections. Using the CentOS distro of OpenLDAP 2.4.23 Here are the slapd.conf settings: database ldap readonly on suffix "dc=xyz,dc=local" #noundeffilter yes #use-temporary-conn yes uri "ldap://IP1/ ldap://IP2/ ldap://3/ ldap://IPn/" database ldap readonly on suffix "dc=abc,dc=adroot,dc=abc,dc=bc,dc=ca" #noundeffilter yes #use-temporary-conn yes uri "ldap://IP11/ ldap://IP12/ ldap://13/ ldap://IP1n/" I have some rewrite rules for bindDN, searchEntryDN, searchAttrDN, matchedDN, but I don't believe these settings are relevant to the issue at hand. Essentially I want the connections to be re-established without generating errors. Thanks _____________________________________________ From: Bryce Powell Sent: December 10, 2012 01:32 PM To: openldap-technical(a)openldap.org Subject: LDAP database timeout settings Hi, I have configured two LDAP backend databases, each pointing to a difference Active Directory domain (multiple domain controllers specified per domain). After a period of time after slapd starts, the ldap log file shows multiple entries like this for the various connections (conns=nnnn): Dec 10 13:18:03 vmxxxldap01 slapd[7826]: conn=1004 op=27 SEARCH RESULT tag=101 err=1 nentries=0 text=000004DC: LdapErr: DSID-0C0906E8, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1db1 Without going into too much detail regarding the configuration, I'm wondering if I need to specify LDAP database configuration settings for: idle-timeout network-timeout man slapd-ldap: idle-timeout <time> This directive causes a cached connection to be dropped an recreated after it has been idle for the specified time. network-timeout <time> Sets the network timeout value after which poll(2)/select(2) following a connect(2) returns in case of no activity. The value is in seconds, and it can be specified as for idle-timeout. I don't understand the explanation for network-timeout though, and am hoping someone can kindly explain it in more detail, and suggest a scenario for its appropriate usage. Also, when is it appropriate to use the ldap.conf NETWORK_TIMEOUT setting? man ldap.conf: NETWORK_TIMEOUT <integer> Specifies the timeout (in seconds) after which the poll(2)/select(2) following a connect(2) returns in case of no activity. Could someone please suggest the best approach for my use case? Of course, I might also be completely off the mark here ... Thanks Bryce Powell

3 3

MDB and slapcat of subtrees
by Venkat 11 Dec '12

11 Dec '12

Hello, Has anyone here encountered an issue with MDB and taking a slapcat of a subtree? slapcat works fine when issued on the root DN; however it fails when exporting a subtree as follows: /usr/local/sbin/slapcat -F /usr/local/etc/openldap/verf/slapd.d -l /dv01/app/OpenLDAP/verf/ldif/out.ldif -s ou=uit,o=myorg.ca The OS is RHEL 5.8; gcc output is: gcc version 4.1.2 20080704 (Red Hat 4.1.2-52) The exact same command works fine on BDB. Thanks for any info. cheers, Ven ----------------------- *** glibc detected *** /usr/local/sbin/slapcat: double free or corruption (!prev): 0x0000000016c1e930 *** ======= Backtrace: ========= /lib64/libc.so.6[0x3cf08711df] /lib64/libc.so.6(cfree+0x4b)[0x3cf087163b] /usr/local/sbin/slapcat(mdb_entry_return+0x61)[0x4c8ee1] /usr/local/sbin/slapcat(mdb_entry_release+0x26)[0x4c93a6] /usr/local/sbin/slapcat(slapcat+0x251)[0x49d2c1] /usr/local/sbin/slapcat(main+0xb2)[0x41b5f2] /lib64/libc.so.6(__libc_start_main+0xf4)[0x3cf081d994] /usr/local/sbin/slapcat[0x41b0a9] ======= Memory map: ======== 00400000-00588000 r-xp 00000000 fd:00 451495 /usr/local/libexec/slapd 00787000-00790000 rw-p 00187000 fd:00 451495 /usr/local/libexec/slapd 00790000-00803000 rw-p 00790000 00:00 0 16a4f000-16c3e000 rw-p 16a4f000 00:00 0 [heap] 3cf0400000-3cf041c000 r-xp 00000000 fd:00 1769634 /lib64/ld-2.5.so 3cf061c000-3cf061d000 r--p 0001c000 fd:00 1769634 /lib64/ld-2.5.so 3cf061d000-3cf061e000 rw-p 0001d000 fd:00 1769634 /lib64/ld-2.5.so 3cf0800000-3cf094e000 r-xp 00000000 fd:00 1769849 /lib64/libc-2.5.so 3cf094e000-3cf0b4d000 ---p 0014e000 fd:00 1769849 /lib64/libc-2.5.so 3cf0b4d000-3cf0b51000 r--p 0014d000 fd:00 1769849 /lib64/libc-2.5.so 3cf0b51000-3cf0b52000 rw-p 00151000 fd:00 1769849 /lib64/libc-2.5.so 3cf0b52000-3cf0b57000 rw-p 3cf0b52000 00:00 0 3cf0c00000-3cf0c02000 r-xp 00000000 fd:00 1769876 /lib64/libdl-2.5.so 3cf0c02000-3cf0e02000 ---p 00002000 fd:00 1769876 /lib64/libdl-2.5.so 3cf0e02000-3cf0e03000 r--p 00002000 fd:00 1769876 /lib64/libdl-2.5.so 3cf0e03000-3cf0e04000 rw-p 00003000 fd:00 1769876 /lib64/libdl-2.5.so 3cf1400000-3cf1416000 r-xp 00000000 fd:00 1769746 /lib64/libpthread-2.5.so 3cf1416000-3cf1615000 ---p 00016000 fd:00 1769746 /lib64/libpthread-2.5.so 3cf1615000-3cf1616000 r--p 00015000 fd:00 1769746 /lib64/libpthread-2.5.so 3cf1616000-3cf1617000 rw-p 00016000 fd:00 1769746 /lib64/libpthread-2.5.so 3cf1617000-3cf161b000 rw-p 3cf1617000 00:00 0 3cf1800000-3cf1814000 r-xp 00000000 fd:00 1769880 /lib64/libz.so.1.2.3 3cf1814000-3cf1a13000 ---p 00014000 fd:00 1769880 /lib64/libz.so.1.2.3 3cf1a13000-3cf1a14000 rw-p 00013000 fd:00 1769880 /lib64/libz.so.1.2.3 3cf2000000-3cf2015000 r-xp 00000000 fd:00 1769882 /lib64/libselinux.so.1 3cf2015000-3cf2215000 ---p 00015000 fd:00 1769882 /lib64/libselinux.so.1 3cf2215000-3cf2217000 rw-p 00015000 fd:00 1769882 /lib64/libselinux.so.1 3cf2217000-3cf2218000 rw-p 3cf2217000 00:00 0 3cf2400000-3cf243b000 r-xp 00000000 fd:00 1769881 /lib64/libsepol.so.1 3cf243b000-3cf263b000 ---p 0003b000 fd:00 1769881 /lib64/libsepol.so.1 3cf263b000-3cf263c000 rw-p 0003b000 fd:00 1769881 /lib64/libsepol.so.1 3cf263c000-3cf2646000 rw-p 3cf263c000 00:00 0 3cf6400000-3cf652d000 r-xp 00000000 fd:00 1769889 /lib64/libcrypto.so.0.9.8e 3cf652d000-3cf672c000 ---p 0012d000 fd:00 1769889 /lib64/libcrypto.so.0.9.8e 3cf672c000-3cf674d000 rw-p 0012c000 fd:00 1769889 /lib64/libcrypto.so.0.9.8e 3cf674d000-3cf6751000 rw-p 3cf674d000 00:00 0 3cf8800000-3cf8811000 r-xp 00000000 fd:00 1769887 /lib64/libresolv-2.5.so 3cf8811000-3cf8a11000 ---p 00011000 fd:00 1769887 /lib64/libresolv-2.5.so 3cf8a11000-3cf8a12000 r--p 00011000 fd:00 1769887 /lib64/libresolv-2.5.so 3cf8a12000-3cf8a13000 rw-p 00012000 fd:00 1769887 /lib64/libresolv-2.5.so 3cf8a13000-3cf8a15000 rw-p 3cf8a13000 00:00 0 3cf9000000-3cf9002000 r-xp 00000000 fd:00 1769852 /lib64/libkeyutils-1.2.so 3cf9002000-3cf9201000 ---p 00002000 fd:00 1769852 /lib64/libkeyutils-1.2.so 3cf9201000-3cf9202000 rw-p 00001000 fd:00 1769852 /lib64/libkeyutils-1.2.so 3cf9800000-3cf9802000 r-xp 00000000 fd:00 1769888 /lib64/libcom_err.so.2.1 3cf9802000-3cf9a01000 ---p 00002000 fd:00 1769888 /lib64/libcom_err.so.2.1 3cf9a01000-3cf9a02000 rw-p 00001000 fd:00 1769888 /lib64/libcom_err.so.2.1 3cfbe00000-3cfbe2c000 r-xp 00000000 fd:00 451161 /usr/lib64/libgssapi_krb5.so.2.2 3cfbe2c000-3cfc02c000 ---p 0002c000 fd:00 451161 /usr/lib64/libgssapi_krb5.so.2.2 3cfc02c000-3cfc02e000 rw-p 0002c000 fd:00 451161 /usr/lib64/libgssapi_krb5.so.2.2 3cfc600000-3cfc624000 r-xp 00000000 fd:00 451159 /usr/lib64/libk5crypto.so.3.1 3cfc624000-3cfc823000 ---p 00024000 fd:00 451159 /usr/lib64/libk5crypto.so.3.1 3cfc823000-3cfc825000 rw-p 00023000 fd:00 451159 /usr/lib64/libk5crypto.so.3.1 3cfca00000-3cfca91000 r-xp 00000000 fd:00 451160 /usr/lib64/libkrb5.so.3.3 3cfca91000-3cfcc91000 ---p 00091000 fd:00 451160 /usr/lib64/libkrb5.so.3.3 3cfcc91000-3cfcc95000 rw-p 00091000 fd:00 451160 /usr/lib64/libkrb5.so.3.3 3cfda00000-3cfda08000 r-xp 00000000 fd:00 436460 /usr/lib64/libkrb5support.so.0.1 3cfda08000-3cfdc07000 ---p 00008000 fd:00 436460 /usr/lib64/libkrb5support.so.0.1 3cfdc07000-3cfdc08000 rw-p 00007000 fd:00 436460 /usr/lib64/libkrb5support.so.0.1 3cfde00000-3cfde46000 r-xp 00000000 fd:00 1769890 /lib64/libssl.so.0.9.8e 3cfde46000-3cfe046000 ---p 00046000 fd:00 1769890 /lib64/libssl.so.0.9.8e 3cfe046000-3cfe04c000 rw-p 00046000 fd:00 1769890 /lib64/libssl.so.0.9.8e 3cff200000-3cff20d000 r-xp 00000000 fd:00 1769878 /lib64/libgcc_s-4.1.2-20080825.so.1 3cff20d000-3cff40d000 ---p 0000d000 fd:00 1769878 /lib64/libgcc_s-4.1.2-20080825.so.1 3cff40d000-3cff40e000 rw-p 0000d000 fd:00 1769878 /lib64/libgcc_s-4.1.2-20080825.so.1 3d04200000-3d04204000 r-xp 00000000 fd:00 1769845 /lib64/libuuid.so.1.2 3d04204000-3d04403000 ---p 00004000 fd:00 1769845 /lib64/libuuid.so.1.2 3d04403000-3d04404000 rw-p 00003000 fd:00 1769845 /lib64/libuuid.so.1.2 3d04a00000-3d04a09000 r-xp 00000000 fd:00 1769708 /lib64/libcrypt-2.5.so 3d04a09000-3d04c08000 ---p 00009000 fd:00 1769708 /lib64/libcrypt-2.5.so 3d04c08000-3d04c09000 r--p 00008000 fd:00 1769708 /lib64/libcrypt-2.5.so 3d04c09000-3d04c0a000 rw-p 00009000 fd:00 1769708 /lib64/libcrypt-2.5.so 3d04c0a000-3d04c38000 rw-p 3d04c0a000 00:00 0 3d06600000-3d06618000 r-xp 00000000 fd:00 451168 /usr/lib64/libsasl2.so.2.0.22 3d06618000-3d06818000 ---p 00018000 fd:00 451168 /usr/lib64/libsasl2.so.2.0.22 3d06818000-3d06819000 rw-p 00018000 fd:00 451168 /usr/lib64/libsasl2.so.2.0.22 2aacb7a6c000-2aacb7a6e000 rw-p 2aacb7a6c000 00:00 0 2aacb7a87000-2aacb7a8d000 r-xp 00000000 fd:00 437440 /usr/lib64/libltdl.so.3.1.4 2aacb7a8d000-2aacb7c8d000 ---p 00006000 fd:00 437440 /usr/lib64/libltdl.so.3.1.4 2aacb7c8d000-2aacb7c8e000 rw-p 00006000 fd:00 437440 /usr/lib64/libltdl.so.3.1.4 2aacb7c8e000-2aacb7c96000 rw-p 2aacb7c8e000 00:00 0 2aacb7c96000-2aacb7d6d000 r-xp 00000000 fd:00 526741 /usr/lib64/sasl2/libsasldb.so.2.0.22 2aacb7d6d000-2aacb7f6c000 ---p 000d7000 fd:00 526741 /usr/lib64/sasl2/libsasldb.so.2.0.22 2aacb7f6c000-2aacb7f70000 rw-p 000d6000 fd:00 526741 /usr/lib64/sasl2/libsasldb.so.2.0.22 2aacb7f70000-2aacb7f74000 r-xp 00000000 fd:00 527379 /usr/lib64/sasl2/libplain.so.2.0.22 2aacb7f74000-2aacb8173000 ---p 00004000 fd:00 527379 /usr/lib64/sasl2/libplain.so.2.0.22 2aacb8173000-2aacb8174000 rw-p 00003000 fd:00 527379 /usr/lib64/sasl2/libplain.so.2.0.22 2aacb8174000-2aacb8178000 r-xp 00000000 fd:00 526744 /usr/lib64/sasl2/liblogin.so.2.0.22 2aacb8178000-2aacb8377000 ---p 00004000 fd:00 526744 /usr/lib64/sasl2/liblogin.so.2.0.22 2aacb8377000-2aacb8378000 rw-p 00003000 fd:00 526744 /usr/lib64/sasl2/liblogin.so.2.0.22 2aacb8378000-2aacb837c000 r-xp 00000000 fd:00 524299 /usr/lib64/sasl2/libanonymous.so.2.0.22 2aacb837c000-2aacb857b000 ---p 00004000 fd:00 524299 /usr/lib64/sasl2/libanonymous.so.2.0.22 2aacb857b000-2aacb857c000 rw-p 00003000 fd:00 524299 /usr/lib64/sasl2/libanonymous.so.2.0.22 2aacb867d000-2aacb893f000 rw-p 2aacb867d000 00:00 0 2aacb893f000-2aacb8941000 rw-s 00000000 fd:02 10010626 /dv01/app/OpenLDAP/verf/mdb/lock.mdb 2aacb8941000-2ac0b8941000 r--s 00000000 fd:02 10010627 /dv01/app/OpenLDAP/verf/mdb/data.mdb 7fff05bae000-7fff05bc3000 rw-p 7ffffffe9000 00:00 0 [stack] 7fff05bfd000-7fff05c00000 r-xp 7fff05bfd000 00:00 0 [vdso] ffffffffff600000-ffffffffffe00000 ---p 00000000 00:00 0 [vsyscall]

2 3

slawpo-rwm attributes concatenation
by Benin Technologies 10 Dec '12

10 Dec '12

Hi, What would be the best way to concatenate several attributes into one (maybe with slapo-rwm and back-relay ?). I know LDAP is a data container, and not a fancy string generator, but I see no other way around this. An example : my directory contain an inetOrgPerson (say John Doe) with 3 telephoneNumber attributes, say 101010, 202020 and 303030. I access this directory with 2 clients : the first client displays the data in the right fashion: cn: John Doe telephoneNumber:101010 telephoneNumber:202020 telephoneNumber:303030 But the second client only displays only one telephoneNumber attribute, so it displays: cn: John Doe telephoneNumber:101010 Given the fact that I have no way to modify the client's source code, how could I do to display all 3 phone numbers ? An idea would be to use rwm with back-relay and do some server side string generation, in order for the second client to retrieve : cn: John Doe telephoneNumber:101010/202020/303030 is there a way to do this ? BT

3 4

LDAP database timeout settings
by Bryce Powell 10 Dec '12

10 Dec '12

Hi, I have configured two LDAP backend databases, each pointing to a difference Active Directory domain (multiple domain controllers specified per domain). After a period of time after slapd starts, the ldap log file shows multiple entries like this for the various connections (conns=nnnn): Dec 10 13:18:03 vmxxxldap01 slapd[7826]: conn=1004 op=27 SEARCH RESULT tag=101 err=1 nentries=0 text=000004DC: LdapErr: DSID-0C0906E8, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1db1 Without going into too much detail regarding the configuration, I'm wondering if I need to specify LDAP database configuration settings for: idle-timeout network-timeout man slapd-ldap: idle-timeout <time> This directive causes a cached connection to be dropped an recreated after it has been idle for the specified time. network-timeout <time> Sets the network timeout value after which poll(2)/select(2) following a connect(2) returns in case of no activity. The value is in seconds, and it can be specified as for idle-timeout. I don't understand the explanation for network-timeout though, and am hoping someone can kindly explain it in more detail, and suggest a scenario for its appropriate usage. Also, when is it appropriate to use the ldap.conf NETWORK_TIMEOUT setting? man ldap.conf: NETWORK_TIMEOUT <integer> Specifies the timeout (in seconds) after which the poll(2)/select(2) following a connect(2) returns in case of no activity. Could someone please suggest the best approach for my use case? Of course, I might also be completely off the mark here ... Thanks Bryce Powell

1 0

LDAP DIT Design
by Valentin Bud 10 Dec '12

10 Dec '12

Hello World, I am using OpenLDAP for quite some time now, a few months. I have set up a simple directory following DNS, RFC2247, directory structure, `dc=company,dc=com`. I use the directory to store POSIX accounts. Now I want to extend the directory to store application configuration, starting with Postfix virtual domains and maps. I would also like to store Kerberos principals in the future. For now I have three companies I want to use OpenLDAP for. Each of this companies have part of the above services in their premises and in some datacenters. I would like to configure replication between the datacenter and the premise. Maybe more companies will be added to the mix in the future. Do you think it would be safe to use an empty suffix "" and go with RFC2247 structure downwards? " " | | + - - - - - - - - + - - - - - - - - + | | dc=net dc=com | | dc=compX + - - - - - - + - - - - - - + | | dc=compA dc=compB I think this way it would be easy to replicate `dc=compA,dc=com` from the datacenter servers to the on-premise ones. Also this would keep things simple (?). Each company would get an `ou` for people and one for groups. I would also want to add the fact that some directories will also be used to store Samba ID maps but I guess this makes no difference on how the directory in structured. What do you people think about this approach? If some of you have some information on the topic of DIT Design please share so I can learn more. Thank you. Cheers and Goodwill, v

2 1

OpenLDAP Sandbox on AWS/Eucalyptus
by Harold Spencer Jr. 09 Dec '12

09 Dec '12

Hey guys, I wanted to share a blog I recently published. It shows how to build an OpenLDAP server (from git) on Ubuntu 12.04 LTS in Amazon Web Services and Eucalyptus using cloud-init. Hope you enjoy. Any feedback would be greatly appreciated. http://blogs.mindspew-age.com/2012/12/08/openldap-sandbox-in-the-clouds/ _________________________ Harold Spencer, Jr. - Technical Support Engineer Eucalyptus Systems www.eucalyptus.com +1 805 845-8400 IRC: #eucalyptus #eucalyptus-devel Follow us on Twitter Like our Facebook Page Keep up-to-date with us _________________________

2 1

Openldap schema for services like Skype, Jabber, AIM, ….
by Bas van der Vlies 08 Dec '12

08 Dec '12

Hello, I needed to store information how to reach people, e.g.: * Skype * Jabber * AIM * Facetime * … I wanted to know if there is a schema for it or people write there own schema? I have read that there is an URI schema for this kind of services: * http://en.wikipedia.org/wiki/URI_scheme regards -- Bas van der Vlies mail: basv(a)sara.nl<mailto:basv@sara.nl> SARA - Academic Computing Services , Amsterdam, The Netherlands

2 1

rwm searchAttrDN rewrite skipping some rewrites
by Scott Koranda 08 Dec '12

08 Dec '12

Hi, I am using OpenLDAP 2.4.33 and the rwm overlay. I am attempting to remove ("hide") certain DN entries from returned queries. The rwm configuration looks like overlay rwm rwm-rewriteEngine on rwm-rewriteContext searchAttrDN rwm-rewriteRule "^employeeNumber=.*$" "$0" ":@" rwm-rewriteRule "cn=.*" "" "#" Without the rwm overlay the query with filter '(&(objectClass=groupOfNames)(cn=LVCGroupMembers))' member returns dn: cn=LVCGroupMembers,ou=LVC,ou=Communities,ou=grouper,o=internal,dc=wiki,dc=myorg,dc=org member: employeeNumber=1377,ou=people,o=internal,dc=wiki,dc=myorg,dc=org member: cn=UWashingtonGroupMembers,ou=UWashington,ou=MOU,ou=LSC,ou=LVC,ou=Communities,ou=grouper,o=internal,dc=wiki,dc=myorg,dc=org member: employeeNumber=19,ou=people,o=internal,dc=wiki,dc=myorg,dc=org member: employeeNumber=1331,ou=people,o=internal,dc=wiki,dc=myorg,dc=org member: employeeNumber=935,ou=people,o=internal,dc=wiki,dc=myorg,dc=org member: employeeNumber=459,ou=people,o=internal,dc=wiki,dc=myorg,dc=org member: employeeNumber=876,ou=people,o=internal,dc=wiki,dc=myorg,dc=org <snip> I want to "hide" the members with DNs of the form "cn=*" (I want to squash the nested groups). With the rwm configuration above the hiding almost works--93 of member DNs are "hidden", but 3 are not: $ ldapsearch -D "<some bind dn>" -w password -x -LLL -b 'dc=wiki,dc=myorg,dc=org' -H ldaps://server.somewhere '(&(objectClass=groupOfNames)(cn=LVCGroupMembers))' member | grep cn dn: cn=LVCGroupMembers,ou=LVC,ou=Communities,ou=grouper,o=internal,dc=wiki,dc= member: cn=AGWGGroupMembers,ou=AGWG,ou=MOU,ou=LSC,ou=LVC,ou=Communities,ou=gro member: cn=GWUGroupMembers,ou=GWU,ou=MOU,ou=LSC,ou=LVC,ou=Communities,ou=group member: cn=ULBGroupMembers,ou=ULB,ou=MOU,ou=LSC,ou=LVC,ou=Communities,ou=group I checked and the 3 DNs that survive are not different in any substantial way then the 97 DNs that are effectively hidden. Any ideas why the 3 DNs survive the rewriting? Thanks, Scott

2 2

slapd-meta configuration details
by Scott Koranda 07 Dec '12

07 Dec '12

Hello, As part of an evaluation and testing phase, on a Debian Squeeze system using version 2.4.23 of OpenLDAP I successfully configured and used the slapd-meta backend. The configuration looked like this: database meta suffix "dc=test,dc=myorg,dc=org" uri "ldapi:///o=external,dc=test,dc=myorg,dc=org" acl-authcDN uid=foswiki,ou=system,o=external,dc=test,dc=myorg,dc=org acl-passwd passwd idassert-bind bindmethod=simple binddn="uid=foswiki,ou=system,o=external,dc=test,dc=myorg,dc=org" credentials="passwd" mode=self uri "ldapi:///o=internal,dc=test,dc=myorg,dc=org" acl-authcDN uid=foswiki,ou=system,o=external,dc=test,dc=myorg,dc=org acl-passwd passwd idassert-bind bindmethod=simple binddn="uid=foswiki,ou=system,o=external,dc=test,dc=myorg,dc=org" credentials="passwd" mode=self To prepare for a production deployment I then compiled OpenLDAP 2.4.33 using this set of configure options: ./configure --prefix=/opt/openldap-2.4.33 --enable-slapd --enable-cleartext --enable-rewrite --enable-bdb --enable-hdb --enable-ldap --enable-meta --enable-rwm I attempted to use the same configuration for the slapd-meta backend. My queries to slapd no longer returned anything and I saw this in the debug ouput: 50c15573 conn=1000 op=1 meta_search_dobind_init[0] mc=0x22c2da0: non-empty dn with empty cred; binding anonymously 50c15573 conn=1000 op=1 meta_search_dobind_init[1] mc=0x22c2da0: non-empty dn with empty cred; binding anonymously I interpret this to mean that the slapd-meta backend is deciding it does not have a credential to use and is binding anonymously to the proxied services. How should I change my configuration above so that the most recent version of OpenLDAP will be able to bind to the proxied services in the way that happened with version 2.4.23? Note that I installed versions between 2.4.23 and 2.4.33 (bisection) and found that the change from 2.4.25 to 2.4.26 causes the configuration above to go from "working" to "not working". Versions 2.4.26 and above that I tested result in the "non-empty dn with empty cred" in the debug output. Thanks, Scott

3 5

DB_LOCK_DEADLOCK
by Pawan Kamboj 07 Dec '12

07 Dec '12

Hi, We are getting "bdb_idl_fetch_key: get failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30995)" error in Openldap debug log. We are using Openldap.2.3.31 and db.4.5 version and have configured master-slave. Any help on this? Is it something need to worry or we can ignore this. This error coming frequently when we do lots of write opration on ldap. Regards Pawan

3 5

how to speed up filtering of dn's
by Hanspeter Kunz 06 Dec '12

06 Dec '12

Hi all, I want to find all entries in my ldap directory that contain certain ou's, e.g. ldapsearch -x "(ou:dn:=Administration)" which returns (in my case) all entries that correspond to administrative staff. The query works but it is slow and puts a high load on the ldap server. I wonder if I can create an index which would speed things up, but I could not figure out what I should index. Note that I cannot do this using a specific basedn, because we have administrative staff in several subtrees of our ldap hierarchy. Best

2 4

dnMatch flooding logs and access blocked
by Al Dispennette 05 Dec '12

05 Dec '12

Hello, I am seeing the following get repeated in my slapd logs for hundreds of line. I know it is due to the logging level. However, when this starts happening no one can access the server because what ever is logging this is blocking. Can anyone tell me what is causing this log entry? slapd[20616]: dnMatch -1#012#011"uid=item1,ou=users,dc=example,dc=com"#012#011"uid=user,ou=users,dc=example,dc=com" slapd[20616]: dnMatch 2#012#011"uid=item2,ou=users,dc=example,dc=com"#012#011"uid=user,ou=users,dc=example,dc=com" slapd[20616]: dnMatch 2#012#011"uid=item3,ou=users,dc=example,dc=com"#012#011"uid=user,ou=users,dc=example,dc=com" slapd[20616]: dnMatch -2#012#011"uid=item4,ou=users,dc=example,dc=com"#012#011"uid=user,ou=users,dc=example,dc=com" slapd[20616]: dnMatch -1#012#011"uid=item5,ou=users,dc=example,dc=com"#012#011"uid=user,ou=users,dc=example,dc=com" slapd[20616]: dnMatch -2#012#011"uid=item6,ou=users,dc=example,dc=com"#012#011"uid=user,ou=users,dc=example,dc=com" Al Dispennette Sr. Software Engineer t: 415 526 7206 m: 309 868 1401 al.dispennette(a)monitise.com<mailto:al.dispennette@monitise.com> [Description: Description: Description: http://mailmedia.monitisegroup.com/MonitiseUpdate/Images/Email_logo.gif] www.monitisegroup.com<http://www.monitisegroup.com/> [Description: Description: Description: http://mailmedia.monitisegroup.com/MonitiseUpdate/Images/linked_in_sig.gif]<http://www.linkedin.com/company/monitise>[Description: Description: Description: http://mailmedia.monitisegroup.com/MonitiseUpdate/Images/twitter_sig.gif]<http://twitter.com/#!/MonitiseGroup>

3 4

meta_back_db_open: no targets defined
by Matthew Bik 05 Dec '12

05 Dec '12

Hello, I hope this is the right forum for technical questions. If not I apologise in advance. I have been surfing for an answer for a while and was hoping that I am just missing something simple and someone can point me in the right direction. The scenario : I have several active directory domains where individual user accounts are managed. I am trying to setup slapd to use the meta backend so that my ldap server can act as a single sign on source for internal tools such as web pages, jabber, and the like. During the start of slapd it looks like I'm either missing something in my config or I have a typo that I haven't been able to find. To me, it looks like slapd won't start because I'm not giving it anything to do (no targets). I've also been using slaptest to convert a slapd.conf file since documentation on the cn=config files is a little hard to find. The Setup: - CentOS release 6.3 - openldap-2.4.23-26.el6_3.2.x86_64 - openldap-servers-2.4.23-26.el6_3.2.x86_64 The Error Log: Dec 5 08:20:56 example-host slapd[3487]: slapd startup: initiated. Dec 5 08:20:56 example-host slapd[3487]: backend_startup_one: starting "cn=config" Dec 5 08:20:56 example-host slapd[3487]: config_back_db_open Dec 5 08:20:56 example-host slapd[3487]: backend_startup_one: starting "dc=example,dc=com" Dec 5 08:20:56 example-host slapd[3487]: meta_back_db_open: no targets defined Dec 5 08:20:56 example-host slapd[3487]: backend_startup_one (type=meta, suffix="dc=example,dc=com"): bi_db_open failed! (1) Dec 5 08:20:56 example-host slapd[3487]: slapd shutdown: initiated Dec 5 08:20:56 example-host slapd[3487]: slapd destroy: freeing system resources. Dec 5 08:20:56 example-host slapd[3487]: slapd stopped. My slapd.conf: include /etc/openldap/schema/core.schema loglevel -1 modulepath /var/lib/openldap moduleload back_meta.la moduleload back_ldap.la lastmod off database config rootdn "cn=root,cn=config" rootpw "secret" database meta suffix "dc=example,dc=com" uri "ldap://dom01.example.com/dc=us,dc=example,dc=com" default-target uri "ldap://dom02.example.com/dc=eu,dc=example,dc=com"

1 0

Re: Password policy
by Mauricio Tavares 04 Dec '12

04 Dec '12

On Mon, Nov 19, 2012 at 10:46 AM, jeevan kc <jeev_biz(a)hotmail.com> wrote: > Thanks . But we have like more than 25k users on the server. Doing that individually would be tedious. Is there any other way ? > How about a script of some sorts? Something on the lines of: ask ldap for the userlist (using ldapsearch) for each user Add objectClass: pwdPolicy (using ldapmodify) done > Sent from my iPhone > > On Nov 19, 2012, at 10:42 AM, "Mauricio Tavares" <raubvogel(a)gmail.com> wrote: > >> On Mon, Nov 19, 2012 at 10:14 AM, jeevan kc <jeev_biz(a)hotmail.com> wrote: >>> Hello >>> >>> I want to enable password policy on Openldap 2.4.30(to all users. I see that >>> the ppolicy.ldif and ppolicy.schema are listed under >>> /usr/local/etc/openldap/schema but are not present on >>> /usr/local/etc/openldap/slapd.d/cn=config folder. So do I need to add the >>> policy.ldif to the cn=config folder ? Is there like specific procedure to do >>> that or can I add manually with ldapadd ? Also how do I enable that schema >>> to all users ? Please help. >>> >>> >>> Jeevan >> >> If you have the policy as a diff, you could add it by saying >> >> ldapadd -Y EXTERNAL -H ldapi:/// -f /path/to/ppolicy.ldif >> >> Then you need to ldapmodify each user, adding something like >> >> objectClass: pwdPolicy >> >> to each of them. >> >> This is off the top of my head, so do verify before doing exciting >> thingies to your server. ;)

4 4

Fwd: Difference between 2.4.30 and 2.3.43 in certificateMatch.
by Erwann Abalea 03 Dec '12

03 Dec '12

---------- Forwarded message ---------- From: Erwann Abalea <eabalea(a)gmail.com> Date: 2012/12/3 Subject: Re: Difference between 2.4.30 and 2.3.43 in certificateMatch. To: Mike Hulsman <mike(a)hulsman.net> 2012/12/3 Mike Hulsman <mike(a)hulsman.net> > > Quoting Erwann Abalea <eabalea(a)gmail.com>: > > 2012/12/3 Mike Hulsman <mike(a)hulsman.net> >> >> >>> Quoting Howard Chu <hyc(a)symas.com>: >>> >>> >>>> [...] >>>> >>> >> No. Read RFC4523. >>> >>>> >>>> >>> After a lot of reading and testing I still cannot get it working. >>> >>> I read RFC4523 and am now doing an ldap search of (usercertificate:** >>> certificateExactMatch:=****certificate_serial_number$** >>> >>> certificate_Issuer_DN) >>> Than I get an (?=undefined) in my logfile, so the query is not correct. >>> In my schema is 2.5.4.36 and 2.5.4.37 defined. >>> >>> When I search on >>> (usercertificate=certificate_****serial_number$certificate_**** >>> Issuer_DN) >>> >>> I see the query in the log so I asume it is ok, but in the debugging i >>> see >>> "illegal value for attributeType usercertificate" >>> >>> >> Here's what I use: >> >> 'userCertificate={ serialNumber <yourserial>, issuer "<yourIssuerDN>" }' >> >> For example: >> 'userCertificate={ serialNumber 5090, issuer "cn=passport country signing >> authority, ou=ptb, ou=dfat, o=gov, c=au" }' >> > Thanks alot for pointing me in the right direction, > > The search is working now. > Now I also noticed that I put in the serialnumber in Hex instead of > decimal. > That is what I was doing wrong :-( > You can express the serial number in hex. My example becomes '... serialNumber 0x13E2, issuer ...' OpenLDAP follows the X.520 name comparison rules for the issuer name; you can switch case, change spaces into multiple spaces, add heading/trailing spaces, etc. I hadn't looked at the code yet to understand why asking for serialNumber 0x013E2 or 05090 doesn't match my certificates. -- Erwann.

1 0

RE: deleting all entries
by jeevan kc 03 Dec '12

03 Dec '12

Thanks for the quick reply. One more question, we have a master and couple slaves on the replication topology. Do I need to remove the files of all 3 servers individually? From: turbo(a)bayour.com Subject: Re: deleting all entries Date: Mon, 3 Dec 2012 17:05:45 +0100 To: jeev_biz(a)hotmail.com On Dec 3, 2012, at 4:33 PM, jeevan kc wrote:My openldap on the server is built from the source and the DB files are located on /usr/local/var/openldap-data. Simply shut the server down and delete all files (possibly except the DB_CONFIGfile) in that directory. It's that simple. --Build a man a fire, and he will be warm for the night.Set a man on fire and he will be warm for the rest of his life.

1 0

Difference between 2.4.30 and 2.3.43 in certificateMatch.
by Mike Hulsman 03 Dec '12

03 Dec '12

Hi, I stumbled upon an difference between openldap 2.4.30 and 2.3.43. This is my configuration. X509 certificates are stored in the directory and a search is done with: (&(mail=aaa@a.b)(userCertificate:certificateMatch:=<binary certificate)) if that is a match the uid must be returned. That is working on 2.3.43 but when I try that on 2.4.30 it does not work and I start debugging I see filter="(&(mail=aaa(a)a.b)(?=undefined))" in the logfiles. The request is the same on both openldap servers, I copied the schema's and the acl's are the same. A slapcat on 2.3.43 is done and imported on 2.4.30 An ldapsearch on both servers for that user is returning the same data. Do I need some more configuration for the 2.4.30 version or am I doing something wrong. The 2.3.43 version is working properly, but I want to update to 2.4.xx for better replication. Kind regards. Mike Hulsman ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.

3 6

deleting all entries
by jeevan kc 03 Dec '12

03 Dec '12

HelloWe are deleting all the entries from the Test ldap server and migrating the production data into the test server. I believe slapcat and slapadd would come handy for the migration part. But what I am concerned now is removing the entries from the Test server. How do I delete them ? I need to empty the server but then I want to keep the current configuration and schemas. My openldap on the server is built from the source and the DB files are located on /usr/local/var/openldap-data.Any ideas would be appreciated . Thank you.

1 0

last login time
by Jignesh Patel 03 Dec '12

03 Dec '12

How to capture last login time in openLDAP? -Jignesh

5 11

Re: Index Add Failures
by Kyle Smith 03 Dec '12

03 Dec '12

Ok, I have been running 2.4.32 for some time with no issues. Yesterday, 2 different servers (both part of a 4-way MMR) produced an "index add failure" and an "index delete failure". I went back over the bdb DB_CONFIG Settings (listed below) and everything looks nominal to me. Would it just make more sense to switch from bdb to mdb instead of troubleshooting these "random" errors too much? I also noticed that the number of "deadlocks" corresponds to the number of errors that were produced. Is there correlation there? Thanks! 578 Last allocated locker ID 0x7fffffff Current maximum unused locker ID 9 Number of lock modes 3000 Maximum number of locks possible 1500 Maximum number of lockers possible 1500 Maximum number of lock objects possible 1 Number of lock object partitions 15 Number of current locks 1029 Maximum number of locks at any one time 17 Maximum number of locks in any one bucket 0 Maximum number of locks stolen by for an empty partition 0 Maximum number of locks stolen for any one partition 123 Number of current lockers 224 Maximum number of lockers at any one time 15 Number of current lock objects 526 Maximum number of lock objects at any one time 5 Maximum number of lock objects in any one bucket 0 Maximum number of objects stolen by for an empty partition 0 Maximum number of objects stolen for any one partition 3581M Total number of locks requested (3581768929) 3581M Total number of locks released (3581768869) 0 Total number of locks upgraded 77 Total number of locks downgraded 7041 Lock requests not available due to conflicts, for which we waited 43 Lock requests not available due to conflicts, for which we did not wait 2 Number of deadlocks 0 Lock timeout value 0 Number of locks that have timed out 0 Transaction timeout value 0 Number of transactions that have timed out 1MB 392KB The size of the lock region 0 The number of partition locks that required waiting (0%) 0 The maximum number of times any partition lock was waited for (0%) 0 The number of object queue operations that required waiting (0%) 577 The number of locker allocations that required waiting (0%) 32148 The number of region locks that required waiting (0%) 5 Maximum hash bucket length On Wed, Aug 29, 2012 at 12:04 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Wednesday, August 29, 2012 11:32 AM -0400 Kyle Smith < > alacer.cogitatus(a)gmail.com> wrote: > > Quanah, Thanks for the info, I have confirmed I'm hitting the lock maxes >> of 1000. And I will be upgrading to 2.4.32. I was wondering, what steps >> should be done to have the changes in DB_CONFIG take effect? >> >> >> stop slapd >> make changes to DB_CONFIG >> db_recover >> start slapd >> >> >> Will this also auto remove the log.* files? ( I plan on setting this: >> "set_flags DB_LOG_AUTOREMOVE" in DB_CONFIG) >> > > If you have checkpointing set in slapd.conf/cn=config, it should, yes. > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

4 15

Optimization help
by Pawan Kamboj 30 Nov '12

30 Nov '12

Hi, What can I do to maximize the performance of my openldap setup which running in master-slave mode using syncrepl? System has 8GM RAM and 4GB swap space Openldap-2.3.32 and DB.4.5 ---------------------------------- Total dn count is 2450000. LDIF size is 670MB using ldapsearch dbd size is : du -c -h *.bdb 69M authenticationId.bdb 227M cn.bdb 602M dn2id.bdb 27M entryCSN.bdb 24M entryUUID.bdb 2.5G id2entry.bdb 6.4M mail.bdb 4.6M objectClass.bdb 16M ou.bdb 263M sn.bdb 740M uid.bdb 4.4G total ----------------------- Portion of slapd.conf: cachesize 50000 checkpoint 4096 10 sizelimit 2500000 ------------------------- DB_CONFIG # Set the database in memory cache size. set_cachesize 2 0 1 # Set database flags. set_flags DB_TXN_NOSYNC set_lk_max_locks 2000 set_lk_max_objects 1000 set_lk_max_lockers 1000 set_txn_timeout 3000000 set_lock_timeout 3000000 set_lg_regionmax 1048576 set_lg_max 10485760 set_lg_bsize 2097152 set_lg_dir /usr/local/var/master/logs db_stat -h /usr/local/master/db -m | head -n 2 2GB Total cache size 1 Number of caches Thanks Pawan Kumar

2 1

slapo-pcache seems broken in openldap-2.4.31
by Tio Teath 30 Nov '12

30 Nov '12

I'm trying to set up slapo-pcache using cn=config, and this is my settings: dn: olcDatabase={1}ldap,cn=config objectClass: olcConfig objectClass: olcDatabaseConfig objectClass: olcLDAPConfig objectClass: top olcDatabase: {1}ldap olcRootDN: cn=admin,cn=config olcAccess: {0}to * by * read olcDbACLBind: bindmethod=simple binddn="ou=group,dc=remote" credentials="password" tls_cacert="/etc/ssl/certs/ca-certificates.crt" starttls=yes olcDbURI: ldap://remote.host olcSuffix: dc=remote dn: olcOverlay={0}pcache,olcDatabase={1}ldap,cn=config objectClass: olcPcacheConfig objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top olcOverlay: {0}pcache olcPcache: hdb 10000 1 50 100 olcPcacheAttrset: 0 member olcPcacheTemplate: "(objectClass=)" 0 3600 dn: olcDatabase={0}hdb,olcOverlay={0}pcache,olcDatabase={1}ldap,cn=config objectClass: olcPcacheDatabase objectClass: olcHdbConfig objectClass: olcDatabaseConfig objectClass: olcConfig objectClass: top olcDatabase: {0}hdb olcDbDirectory: /var/lib/ldap/cache olcDbIndex: objectClass eq olcDbIndex: pcacheQueryid eq But each time I'm trying to run ldapsearch -b"cn=test2,ou=group,dc=remote" '(objectClass=*)' member I'm getting QUERY NOT ANSWERABLE/QUERY NOT CACHEABLE errors in the log. Besides, it is impossible to modify attributes olcPcacheTemplate/olcPcacheAttrset: modify/add: olcPcacheTemplate: no equality matching rule Can anyone confirm that the one have managed to make slapo pcache working on 2.4.31?

2 1

monitoring openldap 2.0.27 connections
by santosh malavade 29 Nov '12

29 Nov '12

Hi, We are using openldap version 2.0.27 on RHEL AS 3 with Postfix 2.2.10 In postfix logs, I have seen the following warning message: warning: dict_ldap_connect: Unable to bind to server ldap://127.0.0.1:389 as <dn>: 85 (Timed out) The default timeout is set as 10 seconds. How do I monitor my ldap server. I would like to know the active connection counts on my ldap server. Rgds, Santosh

5 5

MirrorMode Replication Problem
by rocketdive5＠yahoo.co.jp 29 Nov '12

29 Nov '12

Hello, I set up 10 OpenLDAP Servers in MirrorMode replication. (Using OpenLDAP 2.4.24) syncrepl [Server1] provider: server10, server2 [Server2] provider: server1, server3 [Server3] provider: server2, server4 [Server4] provider: server3, server5 [Server5] provider: server4, server6 [Server6] provider: server5, server7 [Server7] provider: server6, server8 [Server8] provider: server7, server9 [Server9] provider: server8, server10 [Server10] provider: server9, server1 (like the shape of a ring.) When data was updated by Server1, the value was updated only by Server1 and Server3. (Reproducibility is low) Question * How to investigate the cause which was not replicated? * Although all the servers become a setup which serves both as a provider and a consumer, is there any problem? * Is there the method(API) that can detect what was replicated? Thanks. Hiro Configuration Server1 --------------------------------------------------------------- overlay syncprov syncprov-checkpoint 100 5 syncprov-sessionlog 1000 serverID 1 syncrepl rid=2 provider=ldap://server2 bindmethod=simple binddn="cn=Manager,dc=my-domain,dc=com" credentials="secret" searchbase="dc=my-domain,dc=com" schemachecking=off type=refreshAndPersist retry="2 30 30 +" syncrepl rid=10 provider=ldap://server10 bindmethod=simple binddn="cn=Manager,dc=my-domain,dc=com" credentials="secret" searchbase="dc=my-domain,dc=com" schemachecking=off type=refreshAndPersist retry="2 30 30 +" mirrormode on --------------------------------------------------------------- Server2 --------------------------------------------------------------- overlay syncprov syncprov-checkpoint 100 5 syncprov-sessionlog 1000 serverID 2 syncrepl rid=1 provider=ldap://server1 bindmethod=simple binddn="cn=Manager,dc=my-domain,dc=com" credentials="secret" searchbase="dc=my-domain,dc=com" schemachecking=off type=refreshAndPersist retry="2 30 30 +" syncrepl rid=3 provider=ldap://server3 bindmethod=simple binddn="cn=Manager,dc=my-domain,dc=com" credentials="secret" searchbase="dc=my-domain,dc=com" schemachecking=off type=refreshAndPersist retry="2 30 30 +" mirrormode on --------------------------------------------------------------- Server3 --------------------------------------------------------------- overlay syncprov syncprov-checkpoint 100 5 syncprov-sessionlog 1000 serverID 3 syncrepl rid=2 provider=ldap://server2 bindmethod=simple binddn="cn=Manager,dc=my-domain,dc=com" credentials="secret" searchbase="dc=my-domain,dc=com" schemachecking=off type=refreshAndPersist retry="2 30 30 +" syncrepl rid=4 provider=ldap://server4 bindmethod=simple binddn="cn=Manager,dc=my-domain,dc=com" credentials="secret" searchbase="dc=my-domain,dc=com" schemachecking=off type=refreshAndPersist retry="2 30 30 +" mirrormode on --------------------------------------------------------------- .... Server10 --------------------------------------------------------------- overlay syncprov syncprov-checkpoint 100 5 syncprov-sessionlog 1000 serverID 10 syncrepl rid=9 provider=ldap://server9 bindmethod=simple binddn="cn=Manager,dc=my-domain,dc=com" credentials="secret" searchbase="dc=my-domain,dc=com" schemachecking=off type=refreshAndPersist retry="2 30 30 +" syncrepl rid=1 provider=ldap://server1 bindmethod=simple binddn="cn=Manager,dc=my-domain,dc=com" credentials="secret" searchbase="dc=my-domain,dc=com" schemachecking=off type=refreshAndPersist retry="2 30 30 +" mirrormode on ---------------------------------------------------------------

3 3

ldap_bind parse result: Decoding error (-4)
by Kaushal Shriyan 29 Nov '12

29 Nov '12

Hi, Any clue about this error "/usr/bin/ldapadd -x -W -D "cn=root,dc=mydomain,dc=com" -f ./base.ldif I get ldap_bind parse result: Decoding error (-4). " Regards Kaushal

2 2

Re: MSYS build and PCRE - Good news
by Anton Malov 28 Nov '12

28 Nov '12

I have answered you yesterday. PCRE build doesn't produce libraries required by OpenLDAP configure script. OpenLDAP requires libregex.a or libgnuregex.a but PCRE builds to libpcre.a libpcreposix.a and libpcrecpp.a. If you successfully built OpenLDAP than you linked it to another regex library, not PCRE. I have solved the problem by adding LIBS=-lpcre to configure script. On Wed, Nov 28, 2012 at 4:01 PM, Sergio NNX <sfhacker(a)hotmail.com> wrote: >> > I mentioned my steps in a previous email. Did you receive it? >> Yes, I did. I have a question for you. What was the output of your >> PCRE build? Which static libraries did it produce? >> I think there may be difference between the distro libraries I am >> using and custom PCRE build. > > Any news Anton? You can build static or shared or both PCRE libraries. As > long as OpenLDAP can find the header and lib files, it should be ok! I > tested it yesterday and no problem at all.

1 0

Modify cn=config
by Rob "Bubba" Hines 28 Nov '12

28 Nov '12

It's been a while since I touched LDAP, so I'm new to the latest configuration changes. Admittedly, I find it aggravating that I can't simply shutdown the LDAP server and modify the configuration, and start it back up. Regardless, my intern stuck the wrong paths in for the TLSCerts, ldap will not start up now ... I need to modify cn=config with the correct paths, but I can't figure out how to get slap* to do it. It hates my ldif, and I just want a simple way to change those three paths. I assume that somewhere in the arcane knowledge that is LDAP, there is a simple solution. But my Google FU has failed me, tho it has served up numerous threads that talk around the problem without providing a solution (or the solution provided was simply 'use slapadd' with no direction on how to 'use slapadd'). Here is the latest ldif I've attempted to use (to no avail) with slapadd: dn: cn=config objectClass: olcGlobal cn: config olcTLSCACertificateFile: /etc/ldap/tls/cacert.pem olcTLSCertificateFile: /etc/ldap/tls/slapd.d/slapd_cert.pem olcTLSCertificateKeyFile: /etc/ldap/tls/slapd.d/slapd_key.pem I assume I just don't know how to write a correct LDIF. But I would appreciate any help in modifying cn=config with the server down. -- Rob "Bubba" Hines * Bubba <http://blog.hines57.com/> * Bubba on LinkedIn <http://www.linkedin.com/in/robhines> * Bubba on Twitter <http://twitter.com/#%21/robhines> * Bubba on Facebook <http://www.facebook.com/people/Robert-Hines/679491526> * Bubba on Plaxo <http://www.plaxo.com/profile/showPublic/robhines> * Bubba's Klout <http://klout.com/#/robhines> * Bubba on Google <https://plus.google.com/u/0/110941764679832570087/about>

3 2

Problems getting mdb_stat to work
by Mark Cairney 27 Nov '12

27 Nov '12

Hi, I've acquired the libmdb tools from the Gitorious page. I've got it to compile (with some warnings, see below) but it throws an error when I try and run mdb_stat on the mdb directory: Compilation yields the following: [root@birch libmdb]# ./make.sh gcc -pthread -O2 -g -DMDB_DSYNC=O_SYNC -W -Wall -Wno-unused-parameter -Wbad-function-cast -std=c99 -pedantic -fPIC -c mdb.c mdb.c:433: warning: extra semicolon in struct or union specified mdb.c:796: warning: implicit declaration of function ‘fdatasync’ mdb.c:1388: warning: implicit declaration of function ‘pwrite’ mdb.c:1699: warning: implicit declaration of function ‘ftruncate’ mdb.c:1885: warning: implicit declaration of function ‘strdup’ mdb.c:1885: warning: assignment makes pointer from integer without a cast mdb.c:4079: warning: assignment makes pointer from integer without a cast gcc -pthread -O2 -g -DMDB_DSYNC=O_SYNC -W -Wall -Wno-unused-parameter -Wbad-function-cast -std=c99 -pedantic -fPIC -c midl.c ar rs libmdb.a mdb.o midl.o ar: creating libmdb.a gcc -shared -o libmdb.so mdb.o midl.o gcc -pthread -O2 -g -DMDB_DSYNC=O_SYNC -W -Wall -Wno-unused-parameter -Wbad-function-cast -std=c99 -pedantic -c mdb_stat.c gcc -pthread -O2 -g -DMDB_DSYNC=O_SYNC -W -Wall -Wno-unused-parameter -Wbad-function-cast -std=c99 -pedantic mdb_stat.o libmdb.a -o mdb_stat gcc -pthread -O2 -g -DMDB_DSYNC=O_SYNC -W -Wall -Wno-unused-parameter -Wbad-function-cast -std=c99 -pedantic -c mtest.c gcc -pthread -O2 -g -DMDB_DSYNC=O_SYNC -W -Wall -Wno-unused-parameter -Wbad-function-cast -std=c99 -pedantic mtest.o libmdb.a -o mtest gcc -pthread -O2 -g -DMDB_DSYNC=O_SYNC -W -Wall -Wno-unused-parameter -Wbad-function-cast -std=c99 -pedantic -c mtest2.c gcc -pthread -O2 -g -DMDB_DSYNC=O_SYNC -W -Wall -Wno-unused-parameter -Wbad-function-cast -std=c99 -pedantic mtest2.o libmdb.a -o mtest2 gcc -pthread -O2 -g -DMDB_DSYNC=O_SYNC -W -Wall -Wno-unused-parameter -Wbad-function-cast -std=c99 -pedantic -c mtest3.c gcc -pthread -O2 -g -DMDB_DSYNC=O_SYNC -W -Wall -Wno-unused-parameter -Wbad-function-cast -std=c99 -pedantic mtest3.o libmdb.a -o mtest3 Running the command gives the following: [root@birch tmp]# ./mdb_stat /usr/local/authz/var/openldap-data/authorise-test mdb_env_open failed, error 22 Running this through strace looks like: [root@birch tmp]# strace ./mdb_stat /usr/local/authz/var/openldap-data/authorise-test execve("./mdb_stat", ["./mdb_stat", "/usr/local/authz/var/openldap-da"...], [/* 29 vars */]) = 0 brk(0) = 0x200f000 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb138ef5000 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) open("/etc/ld.so.cache", O_RDONLY) = 3 fstat(3, {st_mode=S_IFREG|0644, st_size=66956, ...}) = 0 mmap(NULL, 66956, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7fb138ee4000 close(3) = 0 open("/lib64/libpthread.so.0", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\\\340\2401\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=145720, ...}) = 0 mmap(0x31a0e00000, 2212768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x31a0e00000 mprotect(0x31a0e17000, 2097152, PROT_NONE) = 0 mmap(0x31a1017000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x17000) = 0x31a1017000 mmap(0x31a1019000, 13216, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x31a1019000 close(3) = 0 open("/lib64/libc.so.6", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\355a\2401\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=1922112, ...}) = 0 mmap(0x31a0600000, 3745960, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x31a0600000 mprotect(0x31a0789000, 2097152, PROT_NONE) = 0 mmap(0x31a0989000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x189000) = 0x31a0989000 mmap(0x31a098e000, 18600, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x31a098e000 close(3) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb138ee3000 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb138ee2000 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb138ee1000 arch_prctl(ARCH_SET_FS, 0x7fb138ee2700) = 0 mprotect(0x31a0989000, 16384, PROT_READ) = 0 mprotect(0x31a1017000, 4096, PROT_READ) = 0 mprotect(0x31a041f000, 4096, PROT_READ) = 0 munmap(0x7fb138ee4000, 66956) = 0 set_tid_address(0x7fb138ee29d0) = 13054 set_robust_list(0x7fb138ee29e0, 0x18) = 0 futex(0x7fff78256ffc, FUTEX_WAKE_PRIVATE, 1) = 0 futex(0x7fff78256ffc, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7fb138ee2700) = -1 EAGAIN (Resource temporarily unavailable) rt_sigaction(SIGRTMIN, {0x31a0e05ae0, [], SA_RESTORER|SA_SIGINFO, 0x31a0e0f500}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {0x31a0e05b70, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x31a0e0f500}, NULL, 8) = 0 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 getrlimit(RLIMIT_STACK, {rlim_cur=10240*1024, rlim_max=RLIM_INFINITY}) = 0 mmap(NULL, 2101248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb138ce0000 brk(0) = 0x200f000 brk(0x2030000) = 0x2030000 open("/usr/local/authz/var/openldap-data/authorise-test/lock.mdb", O_RDWR|O_CREAT, 0) = 3 fcntl(3, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=1}) = -1 EAGAIN (Resource temporarily unavailable) fcntl(3, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=1}) = 0 lseek(3, 0, SEEK_END) = 6272 mmap(NULL, 6272, PROT_READ|PROT_WRITE, MAP_SHARED, 3, 0) = 0x7fb138ef3000 open("/usr/local/authz/var/openldap-data/authorise-test/data.mdb", O_RDONLY) = 4 read(4, "\0\0\0\0\0\0\0\0\0\0\10\0\0\0\0\0\336\300\357\276\1\0\0\0\0\0\0\0\0\0\0\0"..., 4096) = 4096 close(4) = 0 close(3) = 0 fstat(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0), ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb138ef2000 write(1, "mdb_env_open failed, error 22\n", 30mdb_env_open failed, error 22 ) = 30 exit_group(1) = ? [root@birch tmp]# [root@birch tmp]# [root@birch tmp]# [root@birch tmp]# ./mdb_stat /usr/local/authz/var/openldap-data/authorise-test mdb_env_open failed, error 22 [root@birch tmp]# strace ./mdb_stat /usr/local/authz/var/openldap-data/authorise-test execve("./mdb_stat", ["./mdb_stat", "/usr/local/authz/var/openldap-da"...], [/* 29 vars */]) = 0 brk(0) = 0x1946000 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3f6a65000 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) open("/etc/ld.so.cache", O_RDONLY) = 3 fstat(3, {st_mode=S_IFREG|0644, st_size=66956, ...}) = 0 mmap(NULL, 66956, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7fb3f6a54000 close(3) = 0 open("/lib64/libpthread.so.0", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\\\340\2401\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=145720, ...}) = 0 mmap(0x31a0e00000, 2212768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x31a0e00000 mprotect(0x31a0e17000, 2097152, PROT_NONE) = 0 mmap(0x31a1017000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x17000) = 0x31a1017000 mmap(0x31a1019000, 13216, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x31a1019000 close(3) = 0 open("/lib64/libc.so.6", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\355a\2401\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=1922112, ...}) = 0 mmap(0x31a0600000, 3745960, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x31a0600000 mprotect(0x31a0789000, 2097152, PROT_NONE) = 0 mmap(0x31a0989000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x189000) = 0x31a0989000 mmap(0x31a098e000, 18600, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x31a098e000 close(3) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3f6a53000 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3f6a52000 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3f6a51000 arch_prctl(ARCH_SET_FS, 0x7fb3f6a52700) = 0 mprotect(0x31a0989000, 16384, PROT_READ) = 0 mprotect(0x31a1017000, 4096, PROT_READ) = 0 mprotect(0x31a041f000, 4096, PROT_READ) = 0 munmap(0x7fb3f6a54000, 66956) = 0 set_tid_address(0x7fb3f6a529d0) = 13069 set_robust_list(0x7fb3f6a529e0, 0x18) = 0 futex(0x7fffb15785cc, FUTEX_WAKE_PRIVATE, 1) = 0 futex(0x7fffb15785cc, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7fb3f6a52700) = -1 EAGAIN (Resource temporarily unavailable) rt_sigaction(SIGRTMIN, {0x31a0e05ae0, [], SA_RESTORER|SA_SIGINFO, 0x31a0e0f500}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {0x31a0e05b70, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x31a0e0f500}, NULL, 8) = 0 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 getrlimit(RLIMIT_STACK, {rlim_cur=10240*1024, rlim_max=RLIM_INFINITY}) = 0 mmap(NULL, 2101248, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3f6850000 brk(0) = 0x1946000 brk(0x1967000) = 0x1967000 open("/usr/local/authz/var/openldap-data/authorise-test/lock.mdb", O_RDWR|O_CREAT, 0) = 3 fcntl(3, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=1}) = -1 EAGAIN (Resource temporarily unavailable) fcntl(3, F_SETLKW, {type=F_RDLCK, whence=SEEK_SET, start=0, len=1}) = 0 lseek(3, 0, SEEK_END) = 6272 mmap(NULL, 6272, PROT_READ|PROT_WRITE, MAP_SHARED, 3, 0) = 0x7fb3f6a63000 open("/usr/local/authz/var/openldap-data/authorise-test/data.mdb", O_RDONLY) = 4 read(4, "\0\0\0\0\0\0\0\0\0\0\10\0\0\0\0\0\336\300\357\276\1\0\0\0\0\0\0\0\0\0\0\0"..., 4096) = 4096 close(4) = 0 close(3) = 0 fstat(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0), ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb3f6a62000 write(1, "mdb_env_open failed, error 22\n", 30mdb_env_open failed, error 22 ) = 30 exit_group(1) = ? [root@birch tmp]# Any ideas and apologies if this isn't the appropriate place to ask about this. /**************************** Mark R Cairney ITI UNIX Section Information Services Tel: 0131 650 6565 Email: Mark.Cairney(a)ed.ac.uk ****************************/ -- The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336.

2 2

Re: installing openldap with mdb
by Jignesh Patel 27 Nov '12

27 Nov '12

Thanks, can you provide more deails about DB Env flags. -Jignesh On Mon, Nov 26, 2012 at 2:39 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Tuesday, November 20, 2012 5:40 PM -0500 Jignesh Patel < > jignesh(a)icare.com> wrote: > > Here is a nice sample setup to install openldap with mdb. >> >> http://blogs.mindspew-age.com/**2012/06/11/overlays-mdb-**openldap-fun/<http://blogs.mindspew-age.com/2012/06/11/overlays-mdb-openldap-fun/> >> > > Decent, but it is a bit out of date. No mention of the DB Env flags. ;) > > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

Re: MSYS build and PCRE - Good news
by Anton Malov 27 Nov '12

27 Nov '12

On Tue, Nov 27, 2012 at 1:52 PM, Sergio NNX <sfhacker(a)hotmail.com> wrote: > I mentioned my steps in a previous email. Did you receive it? Yes, I did. I have a question for you. What was the output of your PCRE build? Which static libraries did it produce? I think there may be difference between the distro libraries I am using and custom PCRE build.

1 0

Re: MSYS build and POSIX regex
by Anton Malov 27 Nov '12

27 Nov '12

First of all, GNU regex library is seriously outdated and unmaintained anymore. Second, there is no such library in most popular MinGW distro - http://nuwen.net/mingw.html I can try to build GNU regex lib by myself, but for now I need to know is there any way to build OpenLDAP client library using PCRE. On Mon, Nov 26, 2012 at 5:32 PM, Sergio NNX <sfhacker(a)hotmail.com> wrote: > Ciao. > > I've built several versions of OpenLDAP and never had any issues with regex. > If PCRE libraries don't work, you could try GNU regex instead. > > Let me know how you get on. > > Sergio.

2 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical