- openldap-technical - openldap.org

Re: MSYS build and PCRE - Good news
by Anton Malov 27 Nov '12

27 Nov '12

I have described what am I doing at least 3 times. I am trying to build OpenLDAP using MinGW and MSYS packages from http://nuwen.net/mingw.html Configuration script tests for -lregex and -lgnuregex libraries, but beforementioned MinGW has PCRE precompiled to libpcre.a and libpcreposix.a May be you have installed PCRE on your system, but OpenLDAP was compiled using GNU regex or other POSIX regex library? On Mon, Nov 26, 2012 at 8:25 PM, Sergio NNX <sfhacker(a)hotmail.com> wrote: >> I am using MinGW distro from http://nuwen.net/mingw.html It states, that >> PCRE 8.31 is included which is the latest stable version for now >> http://pcre.org/ > > I've just built OpenLDAP 2.4.33 against PCRE 8.31 without any issues! > > Let me know how you're doing. > > Cheers.

1 0

Re: last login time
by Clément OUDOT 26 Nov '12

26 Nov '12

2012/11/14 Quanah Gibson-Mount <quanah(a)zimbra.com> > --On Wednesday, November 14, 2012 10:03 PM +0100 Clément OUDOT < > clem.oudot(a)gmail.com> wrote: > > Your OpenLDAP configuration will be compatible between 2.4.23 and 2.4.33. >> But LTB project install OpenLDAP in /usr/local, not in the default >> location, so you need to move your configuration in the new location. >> > > Why would they have to move the location of the configuration? The point > of the -F flag to slapd is that you can use a location of your choosing any > time you want to... > > Right. In LTB package, this can be done in /etc/default/slapd Clément.

4 15

Re: MSYS build and POSIX regex
by Anton Malov 26 Nov '12

26 Nov '12

On 26.11.2012 17:56, Sergio NNX wrote: > I agree with you it's outdated, but everybody is using it. It's also > mentioned on the OpenLDAP website. I can try with the PCRE libs on my > box. Can you send me the link to PCRE libs source code and which version > you have installed? I am using MinGW distro from http://nuwen.net/mingw.html It states, that PCRE 8.31 is included which is the latest stable version for now http://pcre.org/

1 0

Re: MSYS build and POSIX regex
by Anton Malov 26 Nov '12

26 Nov '12

On Fri, Nov 23, 2012 at 5:05 PM, Howard Chu <hyc(a)symas.com> wrote: > Only you can answer that. Read the config.log file and see what error > message was in it for the regfree test. As far as I can investigate the situation configure script tries to build following source to find regex library: | /* Override any GCC internal prototype to avoid an error. | Use char because int might match the return type of a GCC | builtin and then its argument prototype would still apply. */ | #ifdef __cplusplus | extern "C" | #endif | char regfree (); | int | main () | { | return regfree (); | ; | return 0; | } There is 3 attempts to build it with or without various libraries: 1) cc -o conftest.exe -g -O2 conftest.c -lws2_32 >&5 C:\temp\temp\ccKv1vKc.o: In function `main': d:\MyProgram\kokoko\openldap-2.4.33/conftest.c:69: undefined reference to `regfree' 2) cc -o conftest.exe -g -O2 conftest.c -lregex -lws2_32 >&5 D:\Dev\mingw\bin/ld.exe: cannot find -lregex 3) cc -o conftest.exe -g -O2 conftest.c -lgnuregex -lws2_32 >&5 D:\Dev\mingw\bin/ld.exe: cannot find -lgnuregex But PCRE posix wrappers lives in libpcreposix.a. Is there any way to use pcre libraries (libpcreposix.a + libpcre.a) for openldap build? Should such behavior of configuration script be consifdered as bug?

1 0

Announcing MDB C++ wrapper
by ArtemGr 26 Nov '12

26 Nov '12

http://code.google.com/p/libglim/source/browse/trunk/mdb.hpp The wrapper adds Boost Serialization, iterators and triggers to the mix. Any serializable class can be used as a key or a value. Triggers can be used to maintain indexes. Notice that there is an MDB issue triggered when using this wrapper ( http://www.openldap.org/its/index.cgi?findid=7448 ), use at your own risk.

2 1

Re: slapd crashes with ch_realloc of X bytes failed
by Meike Stone 24 Nov '12

24 Nov '12

> >> Yes, not before January 2013 ... >> Hope after reorganization, slapd runs more stable... >> The only thing I can do for now. > > > It is highly unlikely that "reorganization" will change the overall > footprint of the slapd database. Yes, I see this now ... Id does not matter ... > Your best bet is to use tcmalloc with > slapd -- Just LD_PRELOAD it. But where to get, I use SLES11SP1 Thanks Meike

2 1

Re: slapd crashes with ch_realloc of X bytes failed
by Meike Stone 24 Nov '12

24 Nov '12

> >> I'm afraid to increase the cachesize in DB_CONFIG: > > > ch_realloc means the system ran out of memory. Increasing the DB_CONFIG > cachesize will run you out of memory more quickly. I'm sitting JUST NOW in front of the LDAP Server and slapcat/slapadd the database to reorganize .. (database is almost 4 years old) 2 hours ago, booth servers crashed again ... I can't belief, that 16G RAM not enough for 1500000 entires/objects ... I need about 5G for set_cache_size (DB_CONFIG) and the other RAM (11G) is for shared memory and the other caches (cachesize, dncachesize, idlcachesize). How much need the three caches? And if to less cache, the machines should run slower, but not run out of memory? > > The best thing for you to do would be to upgrade to OpenLDAP 2.4.33 and > switch to using back-mdb. Softwareupdate is possible not before january 2013. I was wrong with the version, we use 2.4.31 I'm looking to mdb since a few month, but is it usable for production? > > If you are not capable of doing that, I would suggest you use tcmalloc as an > alternative memory allocator to glibc, and reduce your entry cachesize and > idlcachesize. If you can reclaim enough space, you should increase your > DB_CONFIG cachesize, as that is the most important element of performance > with back-bdb/hdb. Yes, not before january 2013 ... Hope after reorganization, slapd runs more stable... The only thing I can do for now. Thanks Meike

2 1

slapd crashes with ch_realloc of X bytes failed
by Meike Stone 24 Nov '12

24 Nov '12

Hello, since a short time, my slapd crashes often. I have two servers running in MM replication. I use openldap version 2.4.30 (for updates are only dedicated timeslots...) The loglevel is set to 256 I see some strange messages in my log before the slapd crashes: "ch_realloc of 986032 bytes failed" --- "ch_malloc of 294896 bytes failed" --- "bdb(ou=root): txn_checkpoint: failed to flush the buffer cache: Cannot allocate memory" --- "ch_malloc of 34159 bytes failed" What does they mean, how can I solve this problem The System has 16GByte RAM, no other service is running there. The Database size is about 1500000 entires and the size of the ldif is about 2Gbyte Because of the memory messages, I reduced the cachesize 1000000 dncachesize 1000000 idlcachesize 3000000 to cachesize 750000 dncachesize 750000 idlcachesize 2250000 but the problem exist still again. I can't believe, that the memory is insufficient. Sysstat is running, and I see enough cache memory (about 5GByte all time), and the Swap (2GByte) is almost not used (about 2MByte). vm.swappiness is set to default (60), so the Swap should used more before the memory is running out. OOM Kill is enabled via SYSRQ (signalling of processes), so slapd should terminated by the kernel ... My configuration: == DB_CONFIG ================================== set_cachesize 2 0 1 set_lg_regionmax 262144 set_lg_bsize 2097152 set_flags DB_LOG_AUTOREMOVE == slapd.conf ================================== include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/yast.schema include /etc/openldap/schema/rfc2307bis.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args modulepath /usr/lib/ldap moduleload back_bdb moduleload syncprov moduleload back_monitor sizelimit -1 timelimit 300 disallow bind_anon require authc gentlehup on tool-threads 8 serverID <001|002> database bdb suffix "ou=demo" rootdn "cn=admin" directory /var/lib/ldap loglevel 256 cachesize 750000 dncachesize 750000 idlcachesize 2250000 cachefree 500 dirtyread dbnosync shm_key 7 checkpoint 4096 15 index objectClass,entryUUID,entryCSN eq index cn eq,sub index ... own indexes syncrepl rid=<001|002> provider=ldap://master-<01|02> type=refreshAndPersist keepalive=360:10:5 retry="5 5 300 +" searchbase="ou=demo" attrs="*,+" overlay syncprov mirrormode TRUE syncprov-checkpoint 100 5 database monitor ========================================== (I know, dirtyread and dbnosync are not recommended..) Additional I see messages like: "bdb_idl_delete_key: c_del id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30995)" Should I care about it? Thanks Meike

3 4

OpenLDAP 2.4.32 back_sql Oracle 10 - error executing at_query (?)
by Barros, Nuno Alexandre Freire, Vodafone Portugal 23 Nov '12

23 Nov '12

Hi. I'm having trouble against an Oracle 10 database using: - Solaris 10 Sparc - OpenLDAP 2.4.32 - unixODBC 2.2.14 - Oracle Instant Client 10.2.0.5.0 I get this errors: 50ae749e backsql_oc_get_attr_mapping(): error executing at_query "SELECT name,sel_expr,from_tbls,join_where,add_proc,delete_proc,param_order,expect_r eturn,sel_expr_u FROM ldap_attr_mappings WHERE oc_map_id=?" for objectClass "inetOrgPerson" with param oc_id=1 50ae749e Return code: -1 50ae749e <==backsql_load_schema_map() 50ae749e backsql_db_open(): schema mapping failed, exiting 50ae749e backend_startup_one (type=sql, suffix="app=contentfilter,ou=app,ou=vodafone-pt,c=pt,o=vodafone"): bi_db_open failed! (1) when I use this configuration file: bash-3.2# cat ldap.conf # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/conf/inetorgperson.schema pidfile /app/users/ldap/slapd.pid argsfile /app/users/ldap/slapd.args idletimeout 0 threads 32 timelimit 5 modulepath /opt/csw/libexec/openldap moduleload back_sql.la ####################################################################### # sql database definitions ####################################################################### database sql suffix "app=contentfilter,ou=app,ou=vodafone-pt,c=pt,o=vodafone" rootdn "vfsid=root,app=contentfilter,ou=app,ou=vodafone-pt,c=pt,o=vodafone" rootpw cu906B2H04cNE #dbname ORACLE10_FREE dbname ORACLE10 dbuser EREXTENSION dbpasswd ERSINPRD subtree_cond "UPPER(ldap_entries.dn) LIKE CONCAT('%',UPPER(?))" insentry_stmt "INSERT INTO ldap_entries (id,dn,oc_map_id,parent,keyval) VALUES (ldap_entry_ids.nextval,?,?,?,?)" upper_func UPPER has_ldapinfo_dn_ru no readonly on access to * by dn="vfsid=root,app=contentfilter,ou=app,ou=vodafone-pt,c=pt,o=vodafone" read by users read by * auth So I added this line to ldap.conf (oc_map_id=1 instead of oc_map_id=?) and this way I'm able to start LDAP: at_query "SELECT name,sel_expr,from_tbls,join_where,add_proc,delete_proc,param_order,expect_r eturn,sel_expr_u FROM ldap_attr_mappings WHERE oc_map_id=1" But then I get other issues related to the character "?" for example I'm unable to get results from the database if I use that character: 50afc6d1 backsql_get_attr_vals(): error executing attribute count query 'SELECT COUNT(*) FROM accounts,customer_attributes_values_t WHERE accounts.id=? AND customer_attributes_values_t.account_id=accounts.id and customer_attributes_values_t.attribute_id = 83' 50afc6d1 Return code: -1 50afc6d1 backsql_get_attr_vals(): error executing attribute count query 'SELECT COUNT(*) FROM ldap_entry_objclasses,ldap_entries,accounts WHERE accounts.id=? AND ldap_entries.id=ldap_entry_objclasses.entry_id AND ldap_entries.keyval=accounts.id and ldap_entries.oc_map_id=1' 50afc6d1 Return code: -1 Strange thing is that I have other machine which I'm migrating that works fine against same Oracle database but it uses: - Solaris 9 - OpenLDAP 2.3.24 - unixODBC 2.2.12 - Oracle Instant Client 10.2.0.3.0 I may try to downgrade to the "working" versions of unixODBC and Oracle Instant Client but I prefer to keep the ones I installed in the new machine. Same thing regarding OpenLdap version. Anyway I would like to understand the issue I'm facing instead of changing versions of software. Does someone know (and understand) what's going on with this? Thanks, Nuno Barros

1 0

MSYS build and POSIX regex
by Anton Malov 23 Nov '12

23 Nov '12

Trying to build openldap with msys and mingw using distribution from http://nuwen.net/mingw.html The problem is the configure script can not find regex library and provides following output: checking for regex.h... yes checking for library containing regfree... no configure: error: POSIX regex required. But the distribution contains precompiled pcre library and regex.h contains regfree function declaration. What is going wrong?

2 1

ldif, a person with city and country
by Jobst Schmalenbach 23 Nov '12

23 Nov '12

Hi Sorry, new member and just started using ldap (openldap). I am not sure whether I can ask this question here as the name of the list specifies "technical", if not please tell me list(s) where I can do so. For starters I have read the O'reilly book, I tried to figure out my questions using the help in the FAQ's, I searched to net ... but I am a little out of my depth in the moment. I am trying to get LDAP to work to help authentication in wordpress and moodle, with wordpress being the main part and moodle uses LDAP for the authentication (subscription based) and some info for each student from LDAP. So far I can add entries to LDAP from wordpress, I can login to wordpress using LDAP. I have got it to work to allow access to moodle when the correct username (uid) and password is found in LDAP but I want to add some info about each student to LDAP, one the country and the other being the city (and later some more). So far I can add enough information for subscribers (billing address, uid, telephone etc) using the standard schemas and object classes, but I need a little mode info for each. This is what I have: dn: dc=MyDomain,dc=com,dc=au dc: MyDomain objectClass: domain dn: o=Subscriptions,dc=MyDomain,dc=com,dc=au o: Subscriptions objectClass: organization dn: ou=moodle,o=Subscriptions,dc=MyDomain,dc=com,dc=au ou: moodle objectClass: organizationalUnit dn: uid=gemma, ou=moodle, o=Subscriptions, dc=MyDomain, dc=com, dc=au objectclass: top objectclass: person objectclass: organizationalPerson objectclass: inetorgPerson objectclass: emailPerson objectclass: NameViewPerson cn=Gemma Turtle sn=Turtle givenName=Gemma Turtle uid=gemma countryCode=AU I end up with an error "invalid structural object class chain", which I think means the country needs to be higher up the tree, but then I would have to create the tree branches for every country (for each person)? Subscribers will come from different countries and countless cities (which I haven't added yet) as this is part of the target audience. I am not sure how to structure this. Are there any ldif file around I can have a look that deal with subscriptions like this? Jobst

3 4

OpenLDAP Proxy to AD of User Objects with full/correct schema
by Mailing Lists 23 Nov '12

23 Nov '12

I know this list gets a large number of questions about Active Directory integration and this one is no different. I've tried to do as much research as possible on my own but still have a few un-answered questions and issues, so i'm adding yet another AD question to the list. Sorry in advance. My initial foray into OpenLDAP was to use it to store the idmaps created by Samba, so that mapped user and group IDs were identical between file servers. As I thought about it more, I realized we could use LDAP to centralize our Linux users, groups, and access to other LDAP-enabled applications. The point of all this is, that I don't need to proxy Active Directory (and its schema) in its entirety, I really just want to use it as a central repository for user info and authentication. So, I guess, my first question is: Is this a viable use case? All signs seem to point to yes, but I just want to make sure. I currently have a proxy database configured that is successfully proxying/querying our AD infrastructure. From what I've read, OpenLDAP 2.3 and newer have the ability to proxy unknown schemas, but will be not be able to do any advanced filtering because the schema is unknown. My question is, given a full export of the AD schema from CN=Schema,CN=Configuration,DC=corp,DC=whatever,DC=com via LDIFDE, is there a way to leverage this to re-create parts of the AD schema so that OpenLDAP can perform native filtering? I'm primarily only interested in the user objects (ObjectClass=user). I know that all of this might be easier if I was to use ADAM/ADLDS and/or scrape the Samba4 schema, but i'd like to do it myself just for the education it provides and because I'm trying to implement just the bare minimum to our users. I've also seen the AD/Outlook Global Address List entry in the FAQ, but that involves editing the OpenLDAP provided .schema files. If possible, i'd like to keep all of these AD related schemas within their own files and keep the OpenLDAP provided ones untouched. Thanks for the help, -Dave

4 5

Fail to pass the basic functionality testing (test058-syncrepl-asymmetric)
by Jackie Zhang 23 Nov '12

23 Nov '12

Hi, I installed the newest openldap-2.4.33 on my Linux machine. I run the test in the tests directory. And I received the following error (attached below). Mainly: ERROR: Second site1 backend not replicated to central master I can replay it everytime by executing "./run -b hdb test058-syncrepl-asymmetric". Using hdb or mdb leads to the same result. Is anybody know what is this problem? Is there something wrong on my installation? Thank you very much! Best regards, Jackie Zhang ============test058-syncrepl-asymmetric================== Cleaning up test run directory leftover from previous run. Running ./scripts/test058-syncrepl-asymmetric for bdb... running defines.sh Initializing master configurations... Initializing search configurations... Starting central master slapd on TCP/IP port 9011... Using ldapsearch to check that central master slapd is running... Starting site1 master slapd on TCP/IP port 9012... Using ldapsearch to check that site1 master is running... Starting site2 master slapd on TCP/IP port 9013... Using ldapsearch to check that site2 master is running... Starting central search slapd on TCP/IP port 9014... Using ldapsearch to check that central search slapd is running... Starting site1 search slapd on TCP/IP port 9015... Using ldapsearch to check that site1 search slapd is running... Starting site2 search slapd on TCP/IP port 9016... Using ldapsearch to check that site2 search slapd is running... Adding schema on ldap://localhost:9011/... Adding schema on ldap://localhost:9012/... Adding schema on ldap://localhost:9013/... Adding schema on ldap://localhost:9014/... Adding schema on ldap://localhost:9015/... Adding schema on ldap://localhost:9016/... Adding database config on central master... Adding database config on site1 master... Adding database config on site2 master... Adding access rules on central master... Adding access rules on site1 master... Adding access rules on site2 master... Adding database config on central search... Adding database config on site1 search... Adding database config on site2 search... Populating central master... Adding syncrepl on site1 master... Adding syncrepl on site2 master... Using ldapsearch to check that site1 master received changes... Using ldapsearch to check that site2 master received changes... Populating site1 master... Populating site2 master... Stopping site1 master... Adding syncrepl on central master... Using ldapsearch to check that central master received site2 entries... Using ldapmodify to modify central master... Restarting site1 master slapd on TCP/IP port 9012... Using ldapsearch to check that site1 master is running... Using ldapsearch to check that central master received site1 entries... Using ldapsearch to check that site1 master received central master update... Using ldapsearch to check that site2 master received central master update... Adding syncrepl consumer on central search... Adding syncrepl consumer on site1 search... Adding syncrepl consumer on site2 search... Using ldapsearch to check that central search received changes... Using ldapsearch to check that site1 search received changes... Using ldapsearch to check that site2 search received changes... Checking contextCSN after initial replication... Using ldapmodify to modify first backend on central master... Using ldapsearch to check replication to central search... Using ldapsearch to check replication to site1 search... Using ldapsearch to check replication to site2 search... Checking contextCSN after modify of first backend on central master... Using ldapmodify to modify second backend on central master... Using ldapsearch to check replication to site2 search... Using ldapsearch to check no replication to site1 master... Using ldapsearch to check no replication to central search... Checking contextCSN after modify of second backend on central master... Using ldapmodify to modify first backend on site1 master... Using ldapsearch to check replication to site1 search... Using ldapsearch to check replication to site2 master... Using ldapsearch to check no replication to site2 search... Using ldapsearch to check no replication to central search... Checking contextCSN after modify of first backend on site1 master... Using ldapmodify to modify second backend on site1 master... Using ldapsearch to check replication to site1 search... Using ldapsearch to check no replication to central master... Checking contextCSN after modify of second backend on site1 master... Using ldapmodify to modify first backend on site2 master... Using ldapsearch to check replication to central master... Using ldapsearch to check replication to site2 search... Using ldapsearch to check no replication to site1 master... Using ldapsearch to check no replication to central search... Checking contextCSN after modify of first backend on site2 master... Using ldapmodify to modify second backend on site2 master... Using ldapsearch to check replication to site2 search... Using ldapsearch to check no replication to central master... Checking contextCSN after modify of second backend on site2 master... Stopping central master and site2 servers to test start with emtpy db... Starting site2 master slapd on TCP/IP port 9013... Using ldapsearch to check that site2 master slapd is running... Starting site2 search slapd on TCP/IP port 9016... Using ldapsearch to check that site2 search slapd is running... Starting central master slapd on TCP/IP port 9011... Using ldapsearch to check that central master slapd is running... Using ldapsearch to check that site2 master received base... Using ldapsearch to check that site2 search received base... Waiting 1 seconds for syncrepl to receive changes... Checking contextCSN after site2 servers repopulated... Adding syncrepl of second site1 master backend on central master... Using ldapsearch to check that central master received second site1 backend... Waiting 1 seconds for syncrepl to receive changes... Waiting 2 seconds for syncrepl to receive changes... Waiting 3 seconds for syncrepl to receive changes... Waiting 4 seconds for syncrepl to receive changes... Waiting 5 seconds for syncrepl to receive changes... ERROR: Second site1 backend not replicated to central master Restarting central master slapd on TCP/IP port 9011... Using ldapsearch to check that central master slapd is running... Waiting 1 seconds for slapd to start... Using ldapsearch to check that central master received second site1 backend... Using ldapsearch to check that central search received second site1 backend... Waiting 1 seconds for syncrepl to receive changes... Waiting 2 seconds for syncrepl to receive changes... Waiting 3 seconds for syncrepl to receive changes... Waiting 4 seconds for syncrepl to receive changes... Waiting 5 seconds for syncrepl to receive changes... ERROR: Second site1 backend not replicated to central search Restarting central search slapd on TCP/IP port 9014... Using ldapsearch to check that central search slapd is running... Waiting 1 seconds for slapd to start... Using ldapsearch to check that central search received second site1 backend... Running 1 of 10 syncrepl race tests... Stopping central master... Using ldapadd to add entry on site1 master... Starting central master again... Using ldapsearch to check that central master received entry... Using ldapsearch to check that central search received entry... Stopping central master... Using ldapdelete to delete entry on site1 master... Starting central master again... Using ldapsearch to check that entry was deleted on central master... Using ldapsearch to check that entry was deleted on central search... Running 2 of 10 syncrepl race tests... Stopping central master... Using ldapadd to add entry on site1 master... Starting central master again... Using ldapsearch to check that central master received entry... Using ldapsearch to check that central search received entry... Stopping central master... Using ldapdelete to delete entry on site1 master... Starting central master again... Using ldapsearch to check that entry was deleted on central master... Using ldapsearch to check that entry was deleted on central search... Running 3 of 10 syncrepl race tests... Stopping central master... Using ldapadd to add entry on site1 master... Starting central master again... Using ldapsearch to check that central master received entry... Using ldapsearch to check that central search received entry... Stopping central master... Using ldapdelete to delete entry on site1 master... Starting central master again... Using ldapsearch to check that entry was deleted on central master... Using ldapsearch to check that entry was deleted on central search... Running 4 of 10 syncrepl race tests... Stopping central master... Using ldapadd to add entry on site1 master... Starting central master again... Using ldapsearch to check that central master received entry... Using ldapsearch to check that central search received entry... Stopping central master... Using ldapdelete to delete entry on site1 master... Starting central master again... Using ldapsearch to check that entry was deleted on central master... Using ldapsearch to check that entry was deleted on central search... Running 5 of 10 syncrepl race tests... Stopping central master... Using ldapadd to add entry on site1 master... Starting central master again... Using ldapsearch to check that central master received entry... Using ldapsearch to check that central search received entry... Stopping central master... Using ldapdelete to delete entry on site1 master... Starting central master again... Using ldapsearch to check that entry was deleted on central master... Using ldapsearch to check that entry was deleted on central search... Running 6 of 10 syncrepl race tests... Stopping central master... Using ldapadd to add entry on site1 master... Starting central master again... Using ldapsearch to check that central master received entry... Using ldapsearch to check that central search received entry... Stopping central master... Using ldapdelete to delete entry on site1 master... Starting central master again... Using ldapsearch to check that entry was deleted on central master... Using ldapsearch to check that entry was deleted on central search... Running 7 of 10 syncrepl race tests... Stopping central master... Using ldapadd to add entry on site1 master... Starting central master again... Using ldapsearch to check that central master received entry... Using ldapsearch to check that central search received entry... Stopping central master... Using ldapdelete to delete entry on site1 master... Starting central master again... Using ldapsearch to check that entry was deleted on central master... Using ldapsearch to check that entry was deleted on central search... Running 8 of 10 syncrepl race tests... Stopping central master... Using ldapadd to add entry on site1 master... Starting central master again... Using ldapsearch to check that central master received entry... Using ldapsearch to check that central search received entry... Stopping central master... Using ldapdelete to delete entry on site1 master... Starting central master again... Using ldapsearch to check that entry was deleted on central master... Using ldapsearch to check that entry was deleted on central search... Running 9 of 10 syncrepl race tests... Stopping central master... Using ldapadd to add entry on site1 master... Starting central master again... Using ldapsearch to check that central master received entry... Using ldapsearch to check that central search received entry... Stopping central master... Using ldapdelete to delete entry on site1 master... Starting central master again... Using ldapsearch to check that entry was deleted on central master... Using ldapsearch to check that entry was deleted on central search... Running 10 of 10 syncrepl race tests... Stopping central master... Using ldapadd to add entry on site1 master... Starting central master again... Using ldapsearch to check that central master received entry... Using ldapsearch to check that central search received entry... Stopping central master... Using ldapdelete to delete entry on site1 master... Starting central master again... Using ldapsearch to check that entry was deleted on central master... Using ldapsearch to check that entry was deleted on central search... No race errors found after 10 iterations Found 2 errors >>>>>> Exiting with a false success status for now

1 0

slapo-rwm overlay and backend databases
by Bryce Powell 22 Nov '12

22 Nov '12

Hi, The OpenLDAP 2.4 documentation states: "When using slapd.conf(5), overlays that are configured before any other databases are considered global, as mentioned above. In fact they are implicitly stacked on top of the frontend database. They can also be explicitly configured as such: database frontend overlay <overlay name>" I currently use slapo-rwm, defined as a global declaration in slapd.conf, to provide bindDN rewrites to a remote LDAP server via slapo-ldap (LDAP proxy database). Is it possible then, if I'm interpreting the documentation correctly, to additionally stack a rewrite/remap overly in each defined database section? The objective would be to achieve database specific rewrites that are not applicable to all defined databases. e.g. database ldap suffix "dc=abc,dc=local" uri "ldap://172.11.250.200/" overlay rwm rwm-rewriteEngine on rwm-rewriteContext searchEntryDN rwm-rewriteRule "^cn=(.+)?\\\\2C(.+)?,ou=users,dc=abc,dc=local$" "cn=$1_$2,ou=users,dc=abc,dc=local" ":@" [...etc.] database ldap suffix "dc=xyz,dc=local" uri "ldap://172.11.250.201/" overlay rwm rwm-rewriteEngine on rwm-rewriteContext searchEntryDN rwm-rewriteRule <some other rewrite rule here> [...etc.] If this is possible, does the configuration allow one to define the overlay at the "backend" level, so that it applies to all databases of the same type? e.g. backend ldap overlay rwm rwm-rewriteEngine on database ldap suffix "dc=abc,dc=local" uri "ldap://172.11.250.200/" rwm-rewriteContext searchEntryDN rwm-rewriteRule "^cn=(.+)?\\\\2C(.+)?,ou=users,dc=abc,dc=local$" "cn=$1_$2,ou=users,dc=abc,dc=local" ":@" [...etc.] database ldap suffix "dc=xyz,dc=local" uri "ldap://172.11.250.201/" rwm-rewriteContext searchEntryDN rwm-rewriteRule <some other rewrite rule here> [...etc.] Thanks Bryce Powell

2 1

Password policy
by jeevan kc 22 Nov '12

22 Nov '12

Hello I want to enable password policy on Openldap 2.4.30(to all users. I see that the ppolicy.ldif and ppolicy.schema are listed under /usr/local/etc/openldap/schema but are not present on /usr/local/etc/openldap/slapd.d/cn=config folder. So do I need to add the policy.ldif to the cn=config folder ? Is there like specific procedure to do that or can I add manually with ldapadd ? Also how do I enable that schema to all users ? Please help. Jeevan

4 5

Re: OpenLDAP-Client TLS
by Martin.Heinzmann＠belden.com 20 Nov '12

20 Nov '12

Little update...i managed to get it to work :-) It looks like it was the option "LDAP_OPT_X_TLS_ALLOW" i have to set. Unfortunately i did it on the wrong position in my code. Now this option is the first thing i do, even prior the initialization. Nevertheless "LDAP_START_TLS_S" returns 3 errors: 1.unable to get local issuer certificate, 2. certificate not trusted, 3.unable to verify the first certificate. I think the 2nd and 3rd appear because the server uses a self signed certificate? One question i still have on my mind. I am only able to compile my client by including the library "sasl2" although i am not using "ldap_sals_bind" or anything like that. Is it possible expel sasl from my program or do i have to use that library? Regards Martin DISCLAIMER: Privileged and/or Confidential information may be contained in this message. If you are not the addressee of this message, you may not copy, use or deliver this message to anyone. In such event, you should destroy the message and kindly notify the sender by reply e-mail. It is understood that opinions or conclusions that do not relate to the official business of the company are neither given nor endorsed by the company. Thank You.

2 2

olcPcacheAttrset/olcPcacheTemplate values for set acl
by Tio Teath 19 Nov '12

19 Nov '12

I'm trying to write ACL, using set entries, like this: to * by set="[cn=remote group,dc=host]/member & user" write, where cn=remote group,dc=host is a remote group, available via ldap-proxy. The remote group looks like this: dn: cn=remote group,dc=host cn: remote member: cn=user1,ou=users,dc=host member: cn=user2,ou=users,dc=host objectClass: group It works fine, except it raises search query to remote ldap server each time, I'm trying to search against objects, the ACL applies. Is it possible to set up pcache overlay to handle such kind of requests to speed up ACL processing? Which values olcPcacheAttrset and olcPcacheTemplate attributes should have?

1 0

Assertion failed: errno != EDEADLK, file alock.c, line 77
by cjkry156＠yahoo.co.jp 19 Nov '12

19 Nov '12

Hi World, We are using OpenLDAP 2.3.5 on Solaris 9. For security reason, System administrator start to use corporate LDAP, (disable local authorization) and disable inetd services (comment out inetd.conf). After that, when we try to start the OpenLDAP, this is not same as the corporate LDAP, we recived Dead lock error message as, Assertion failed: errno != EDEADLK, file alock.c, line 77 And the OpenLDAP was aborted. Does anybody know this error? Best Regards, Ken

2 2

OpenLDAP-Client TLS
by Martin.Heinzmann＠belden.com 19 Nov '12

19 Nov '12

Hi, i am trying to write my own client which connects to an active directory and searches for an user. So far it works, i call "ldap_initialize", set version 3, "ldap_simple_bind_s" and then search the directory. Now i want the connection to be secure by executing a "Simple TLS handshake ". I changed my hostname variable to "ldaps://ip:636" and tried "ldap_start_tls_s(ld,NULL,NULL)" before the bind but get a "cant contact ldap server" error. I think my active directory is configured the right way because with JXplorer it works over ssl and port 636. Does anyone know which functions i have to call so a successful tls connection will be set up? Regards Martin DISCLAIMER: Privileged and/or Confidential information may be contained in this message. If you are not the addressee of this message, you may not copy, use or deliver this message to anyone. In such event, you should destroy the message and kindly notify the sender by reply e-mail. It is understood that opinions or conclusions that do not relate to the official business of the company are neither given nor endorsed by the company. Thank You.

3 3

Re: n-way multimaster replication with ssl and tls
by anil beniwal 17 Nov '12

17 Nov '12

Yes I am able to access using JXplorer using tls and 636. I am using diff self singed certificate for each server. I have done same configuration on 3 servers. i am having /etc/openldap/ldap.conf and /apps/openldap/etc/openldap/ldap.conf file I have compiled ldap to /apps/openldap directory. I am getting same output running on each server against the other 2 servers. [root@sjprodam01 ~]# openssl s_client -connect mmprodam01.abc.com:636 -showcerts CONNECTED(00000003) depth=0 C = IN, ST = HR, L = GGN, O = SAP, OU = ISST, CN = mmprodam01.abc.com verify error:num=18:self signed certificate verify return:1 depth=0 C = IN, ST = HR, L = GGN, O = SAP, OU = ISST, CN = mmprodam01.abc.com verify return:1 --- Certificate chain 0 s:/C=IN/ST=HR/L=GGN/O=SAP/OU=ISST/CN=mmprodam01.abc.com i:/C=IN/ST=HR/L=GGN/O=SAP/OU=ISST/CN=mmprodam01.abc.com -----BEGIN CERTIFICATE----- MIICoDCCAgmgAwIBAgIJAJ5P5x76CGAUMA0GCSqGSIb3DQEBBQUAMGkxCzAJBgNV BAYTAklOMQswCQYDVQQIDAJIUjEMMAoGA1UEBwwDR0dOMRAwDgYDVQQKDAdTQVBJ RU5UMQ0wCwYDVQQLDARJU1NUMR4wHAYDVQQDDBVtbXByb2RhbTAxLm5hc2Nhci5j b20wHhcNMTIxMTE2MDMyMDAxWhcNMTMxMTE2MDMyMDAxWjBpMQswCQYDVQQGEwJJ TjELMAkGA1UECAwCSFIxDDAKBgNVBAcMA0dHTjEQMA4GA1UECgwHU0FQSUVOVDEN MAsGA1UECwwESVNTVDEeMBwGA1UEAwwVbW1wcm9kYW0wMS5uYXNjYXIuY29tMIGf MA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDETDjOiWY1hkHcZ82BRtDabD7mPN8 A9OwLAule0NC6Y76mI8fHDs+vip9P6ASyVaSkxT8g+dOLGDBBy7winj52wcnP9aW u38kE5Sm+suSFLlJ3A0uIfgmLr6dglyGsFMiYJCkeHKxBpF5zeJHTnKpqWZ+emwj XwO0Dv22AYvATQIDAQABo1AwTjAdBgNVHQ4EFgQUhhRZ1mSzr1zccS4aHSKcoy8o F5owHwYDVR0jBBgwFoAUhhRZ1mSzr1zccS4aHSKcoy8oF5owDAYDVR0TBAUwAwEB /zANBgkqhkiG9w0BAQUFAAOBgQCr2gh0U000EttpCQeSjAoUjjkHB3zWMpGZ64Pr SynPEy7uTFT4N5SRx11dZAHIOslQLhr8MiobqX+9EGvQo9ua3TQKd/jT+tgX32Nc iZZyerd6IcT4SZTvH67UZwTxtlqu397Ti8cI8fcqziHoY76MBHCVcG6pvpW4e5H+ LvitdA== -----END CERTIFICATE----- --- Server certificate subject=/C=IN/ST=HR/L=GGN/O=SAP/OU=ISST/CN=mmprodam01.abc.com issuer=/C=IN/ST=HR/L=GGN/O=SAP/OU=ISST/CN=mmprodam01.abc.com --- No client certificate CA names sent --- SSL handshake has read 1008 bytes and written 311 bytes --- New, TLSv1/SSLv3, Cipher is AES256-SHA Server public key is 1024 bit Secure Renegotiation IS supported Compression: zlib compression Expansion: zlib compression SSL-Session: Protocol : TLSv1 Cipher : AES256-SHA Session-ID: 2D97EE613D427036C9A1B1BB5E2371283763DDA8A761D9BED3385D4793E6E061 Session-ID-ctx: Master-Key: 161A39EC4E5B5C0E0F211A014E6CE4B643F77C8C77B9175BFEF399A08319A56C9C199AF417E09EA9508579368E31F7AA Key-Arg : None Krb5 Principal: None PSK identity: None PSK identity hint: None TLS session ticket: 0000 - 82 43 eb e1 46 c2 bd 6f-7a 8b 44 20 cc 8a d5 c4 .C..F..oz.D .... 0010 - 9f 34 ee 02 36 1b 24 32-05 7e e4 3c a7 de 01 e6 .4..6.$2.~.<.... 0020 - c0 b9 39 8b 50 b6 b8 b2-21 3a 81 02 16 3d a1 b1 ..9.P...!:...=.. 0030 - b6 ac 98 fe 34 f5 ba e2-f1 e2 30 c8 ed ad f8 8b ....4.....0..... 0040 - 00 5f bf f8 ed 75 90 65-7e c1 e6 b5 b1 e7 a3 ba ._...u.e~....... 0050 - 75 67 6e a3 d2 ab f5 2b-20 77 31 90 cd 3f b0 38 ugn....+ w1..?.8 0060 - 1f 60 da e9 8e dc 7c e2-97 56 95 55 61 c9 51 da .`....|..V.Ua.Q. 0070 - c7 4f 65 13 48 64 8f 67-1d d1 75 b2 91 b2 7c b5 .Oe.Hd.g..u...|. 0080 - 7e 5f 6b 7b 61 e3 73 63-2b d7 91 c0 91 61 e7 27 ~_k{a.sc +....a.' 0090 - 16 4b c5 e9 e0 ea 03 7a-6c 77 51 77 5c b6 f0 93 .K.....zlwQw\... 00a0 - ab 82 f9 8c 23 06 61 88-86 43 5a 20 1a 11 c5 e7 ....#.a..CZ .... Compression: 1 (zlib compression) Start Time: 1353129151 Timeout : 300 (sec) Verify return code: 18 (self signed certificate) --- ^C On Sat, Nov 17, 2012 at 11:22 AM, houston <houston.r.hopkins(a)gmail.com>wrote: > just curious, did you get ldap running over ssl on rhel 6.3? if so did > you have to compile your ownnor did you use the red hat version? i cant > seem to get ldapsearch to work over ldaps when using red hats 2.4 version > > thx, > Houston > > anil beniwal <beni.anil(a)gmail.com> wrote: > Hi List > > Can any body guide me through the steps required to setup n-way > multimaster(3 or more servers at diff countries) replication with > openldap 2.4.2 > > 1. ssl based > 2. tls based > > I am having normal replication running b/w 3 servers. Now i want to setup > secure replication. > > i am using self signed certificate on RHEL 6.3. > How can i validate whether replication is working fine for ssl or tls. > How to enable replication logs. > > Anything else i should check out. > > I have already gone through a lot of postings on google. > > > > > > > > -- > > Thanks&Regards > Anil Beniwal > > >

1 0

n-way multimaster replication with ssl and tls
by anil beniwal 17 Nov '12

17 Nov '12

Hi List Can any body guide me through the steps required to setup n-way multimaster(3 or more servers at diff countries) replication with openldap 2.4.2 1. ssl based 2. tls based I am having normal replication running b/w 3 servers. Now i want to setup secure replication. i am using self signed certificate on RHEL 6.3. How can i validate whether replication is working fine for ssl or tls. How to enable replication logs. Anything else i should check out. I have already gone through a lot of postings on google. -- Thanks&Regards Anil Beniwal

1 0

restricting access *to* entries by a group member
by Elan Ruusamäe 16 Nov '12

16 Nov '12

hi the goal is to make some users hidden from part of the ldap tree from Apache, as Apache mod_ldap requires only one entry to be returned for anonymous search it performs. there can be duplicates in the same ldap directory, like, for example there's another uid=glen present the tree looks like this: +- dc=example,dc=net +- cn=Manager +- ou=People +- uid=glen +- ou=Basement +- uid=glen +- ou=Groups +- cn=Hidden Users +- member: uid=glen,ou=People,dc=example,dc=net in what ou=Basement,ou=People,dc=example,dc=net is filled by "database ldap", and it causes duplicate uid entries in the directory (unavoidable) so far i have just static acl that is working: access to dn.regex="uid=(glen|somebody-else),ou=People,dc=delfi,dc=net" attrs=uid by anonymous =rcxd it would be better if that can be done by dynamic group lookup via acl. as i see it, there shoould be acl stating if access to uid=.+,ou=People,dc=example,dc=net is attempted, it is checked first that it is not "member" of cn=Hidden Users,ou=Groups,dc=example,dc=net and if it's member, access to entry is denied. however i'm unable to complete such acl rule i have read manual, and tried to experiment, but i can't make up such dynamic configuration. any help from the list? -- glen

1 0

Question about "sockbuf_max_incoming"
by Tianyin Xu 16 Nov '12

16 Nov '12

Hi, all, Good day! Could anyone explain the two following configuration directive: *sockbuf_max_incoming* <*integer*> Specify the maximum incoming LDAP PDU size for anonymous sessions. The default is 262143. *sockbuf_max_incoming_auth* <*integer*> Specify the maximum incoming LDAP PDU size for authenticated sessions. The default is 4194303. In which scenario, we need to configure these directive? What value should we set? Thanks a lot! Tianyin -- Tianyin XU, http://cseweb.ucsd.edu/~tixu/

1 0

DN matching rules
by Chris Card 16 Nov '12

16 Nov '12

Hi all, I see that openldap supports a number of matching rules for DNs, e.g. dnOneLevelMatch, dnSubtreeMatch, dnSubordinateMatch and dnSuperiorMatch. Please can someone point me to documentation about these matching rules? (Google doesn't seem to bring up much useful). Chris

4 9

Password policy
by jeevan kc 15 Nov '12

15 Nov '12

Hello thereI want to enable password policy on Openldap 2.4.30(to all users) running on Linux machine. I see that the ppolicy.ldif and ppolicy.schema are listed under /usr/local/etc/openldap/schema but are not present on /usr/local/etc/openldap/slapd.d/cn=config folder. So do I need to add the policy.ldif to the cn=config folder ? Is there like specific procedure to do that or can I add manually with ldapadd ? Also how do I enable that schema to all users ? Please help.

1 0

Re: last login time
by Clément OUDOT 15 Nov '12

15 Nov '12

2012/11/15 Quanah Gibson-Mount <quanah(a)zimbra.com> > > > d) I would note that RedHat's 2.4 build is linked to NSS, which is fairly > problematic. See <http://www.openldap.org/**lists/openldap-devel/201204/* > *msg00019.html<http://www.openldap.org/lists/openldap-devel/201204/msg00019.html>> > and <http://www.openldap.org/its/**index.cgi/?findid=7367<http://www.openldap.org/its/index.cgi/?findid=7367>>. > I do not know if the LTB project makes this same mistake or not. > > LTB packages use OpenSSL. Clément.

1 0

Re: "authtimestamp" attribute replication
by Clément OUDOT 13 Nov '12

13 Nov '12

2012/11/13 Quanah Gibson-Mount <quanah(a)zimbra.com> > --On Tuesday, November 13, 2012 7:29 PM +0000 jeevan kc < > jeev_biz(a)hotmail.com> wrote: > > >> Hello >> So I have initiated the lastbind overlay and have retrived the >> 'authtimestamp' attribute on openldap 2.4.30. What I found is that the >> timestamps on the attribute have different values on the master server >> and slave servers. Is there any way to fix this issue? An application >> developer wants to retreive this value to create a report on 90 days of >> inactivity for users and since the attribute has different vlaues on >> different servers the testing on the accuracy of the report is failing. >> Thank you. >> > > Read the slapo-ppolicy(5) man page. > I'm sorry but I think RTFM is not the good answer this time ;) authtimestamp is not managed by ppolicy but by the lastbind overlay. To answer the question, I think the only thing to do is check all directories to create the report. It should be not be difficult for your application developer. Clément. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > >

2 1

"authtimestamp" attribute replication
by jeevan kc 13 Nov '12

13 Nov '12

Hello So I have initiated the lastbind overlay and have retrived the 'authtimestamp' attribute on openldap 2.4.30. What I found is that the timestamps on the attribute have different values on the master server and slave servers. Is there any way to fix this issue? An application developer wants to retreive this value to create a report on 90 days of inactivity for users and since the attribute has different vlaues on different servers the testing on the accuracy of the report is failing. Thank you.

2 1

OpenLDAP on SMP/multicore environment
by Friedrich Locke 13 Nov '12

13 Nov '12

Hi folks, i would like to set up a new openldap server in my workplace. If possible, i would like to install openldap in a multicore server running OpenBSD/amd64 5.1. May OpenLDAP benefit from a SMP system? If yes, any tip on where to go to learn how to set up OpenLDAP to take full advantage of a SMP system ? Thanks in advance.

2 1

Re: Index Add Failures
by Kyle Smith 12 Nov '12

12 Nov '12

a) Slapadd does a slapindex. Why would you slapadd and then slapindex? > Because I forgot that slapadd also does slapindex. > > b) What version of OpenLDAP? slapindex still shouldn't cause a failure. 2.4.33 > > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

Nssov overlay in Ubuntu 12.04
by Simone Scremin 12 Nov '12

12 Nov '12

Hi all, I'm trying to setup the nssov overlay in Ubuntu 12.04. I setup the server as the official doc suggested here: https://help.ubuntu.com/12.04/serverguide/openldap-server.html Now I'm stuck because I didn't find anywhere a working ldif example to enable the addon. I tried with the following ldif: dn: olcOverlay={0}nssov,olcDatabase={1}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcNssOvConfig olcOverlay: {0}nssov olcNssSsd: test ldap:///ou=People,dc=example,dc=com but I get: ldap_add: Invalid syntax (21) additional info: objectClass: value #1 invalid per syntax Can someone please give some advice? Thank you! Simone Scremin

2 3

Lastlogon attribute
by jeevan kc 09 Nov '12

09 Nov '12

Hello there Does any versions of openldap schema support the last logon attribute? I am asked to add that attribute to run a report through a application? I don't know if simply addding that attribute on the local schema configuration(openldap 2.4.30) would do it.Is it possible? Thanks John

2 13

TLS issue with self-signed certificate
by Luc MAIGNAN 09 Nov '12

09 Nov '12

Hi, I want to setup a LDAPS connection with a self signed certificate. Unfortunaly, I have the following error : Peer's certificate issuer has been marked as not trusted by the user I tried to trust is by a : certutil -d ... -A -n 'CA' -t CT,,, -a -i ca.crt But it doen't change anything. Has someone an idea for me ? Best regards

2 5

Replication account kept being deleted
by sgao＠frontier.com 09 Nov '12

09 Nov '12

Hi, I am running into a problem with replication accounts being deleted from directory from time to time. Here is my setup: 1. Master-master replication configuration: On ldap1 Syncrepl rid=002 provider=ldaps://ldap2.example.com interval=00:00:02:00 retry="60 5 300 5" type=refreshAndPersist searchbase="dc=example,dc=com" schemachecking=off bindmethod=simple binddn="cn=repl1,dc=example,dc=com" credentials=password On ldap2 Syncrepl rid=001 provider=ldaps://ldap1.example.com interval=00:00:01:00 retry="60 5 300 5" type=refreshAndPersist searchbase="dc=example,dc=com" schemachecking=off bindmethod=simple binddn="cn=repl2,dc=example,dc=com" credentials=password The DNs "cn=repl1,dc=example,dc=com" and "cn=repl2,dc=example,dc=com" are kept being removed from directory on ldap1 or ldap2. When the DNs exist, replication worked fine. However, once the DNs got removed, replication would stop working upon restarting slapd. The version of OpenLDAP is 2.4.23. Any help would be very much appreciated. Simon

1 0

TLS issue
by Luc MAIGNAN 07 Nov '12

07 Nov '12

Hi, I try to setup a LDAPS server. The chain of my certificate seems to be right (openssl s_client showcerts id ok) but I have the following error : unable to get TLS client DN : error -49 Can anyone help me ? Thanks for any help BR

2 1

SASL issue
by Luc MAIGNAN 06 Nov '12

06 Nov '12

Hi, I want to configure SASL in my OpenLDAP server. I saw in documentation that I have to set 'sasl-host' and 'sasl-realm' in slapd.conf In fact I don't use slapd.conf but the cn=config architecture. So where put the parameters ? Thanks for any help

3 2

local password change in read-only replica?
by Marc Patermann 06 Nov '12

06 Nov '12

Hi, from a central master/provider server we replicate to (a lot of) sync-repl slave/consumers. Which are then - of course - read-only. We have passwordpolicy turned on on all the servers. Now we have three accounts - each an another "home" replica - which have a newer modifyTimestamp value on their replica then on the master and all other slaves. The userPassword attribute is different on the "home" replica. What could have caused this? In the log I cannot find any changing operation on the replica according to the time in modifyTimestamp. Marc

1 0

Ubuntu Server 12.04: StartTLS
by admus 05 Nov '12

05 Nov '12

Hello, I'm following https://help.ubuntu.com/12.04/serverguide/openldap-server.html#openldap-tls… how to: LDAP serwer starts correctly but when I tries to test StartTLS: ldapsearch -x -H ldap:/// -ZZ -d -1 I gets the following error: TLS: peer cert untrusted or revoked (0x42) TLS: can't connect: (unknown error code). ldap_err2string ldap_start_tls: Connect error (-11) additional info: (unknown error code) Any idea?

6 10

Re: Error : when create usermachine in LDAP
by rodrigo tavares 05 Nov '12

05 Nov '12

Hello Mauricio, 1) How comfortable are you with linux/unix in general and debian specifically? Do not take this as an insult; I just want to know what I need to ask. Remember I have no access to your machine. ;) I like much Debian Linux, it's very fast. I began work with Linux, i used Conetiva 6.0 and Red Hat Enteprise/Fedora both using format RPM. Debian have a lot packages. And is free, diffent red hat. 2) Are you using ldap to login to this machine or just to check mail? Well I have a server email with LDAP and Suport Samba. So the base ldap the mailserver is replicated from server samba. Then, all modifications LDAP made go to server samba. It run about 5 minutes. I create users emails e samba users. Making intgretion with users samba. 3) I do speak portuguese (I lived in SJC and then Rio). Would you prefer that a gente fale em portugues? Once again, it is all about your comfort level. Speak an English. For others in discussion ________________________________ De: Mauricio Tavares <raubvogel(a)gmail.com> Para: rodrigo tavares <rodrigofariat(a)yahoo.com.br> Enviadas: Quarta-feira, 31 de Outubro de 2012 14:14 Assunto: Re: Error : when create usermachine in LDAP A few questions (I am replying directly to you instead of to the list): 1) How comfortable are you with linux/unix in general and debian specifically? Do not take this as an insult; I just want to know what I need to ask. Remember I have no access to your machine. ;) 2) Are you using ldap to login to this machine or just to check mail? 3) I do speak portuguese (I lived in SJC and then Rio). Would you prefer that a gente fale em portugues? Once again, it is all about your comfort level. On Wed, Oct 31, 2012 at 11:49 AM, rodrigo tavares <rodrigofariat(a)yahoo.com.br> wrote: > Hello, > > > How exactly are you adding the computer to ldap? I take it is not > using ldapadd. ;) > > > In Brazil in state Parana, exists on sofwtare called Expresso Mail Free. > It have a easy interface, and you can create mail users, users samba and > machine, all integrate in > LDAP. It have cyrus-imap, openldap, posfix and postgresql. > > > http://rodrigofariat.files.wordpress.com/2012/10/ldap-error.png > > Some logs: > > Oct 31 13:59:08 defensoria slapd[1688]: conn=1542 op=1 SRCH > base="dc=defensoria,dc=mg,dc=gov,dc=br" scope=2 deref=0 > filter="(uid=computer2$)" > Oct 31 13:59:08 defensoria slapd[1688]: conn=1542 op=1 SEARCH RESULT tag=101 > err=0 nentries=0 text= > Oct 31 13:59:08 defensoria slapd[1688]: conn=1542 op=2 UNBIND > Oct 31 13:59:08 defensoria slapd[1688]: conn=1542 fd=38 closed > Oct 31 13:59:08 defensoria slapd[1688]: conn=1543 fd=38 ACCEPT from > IP=127.0.0.1:50679 (IP=0.0.0.0:389) > Oct 31 13:59:08 defensoria slapd[1688]: conn=1543 op=0 BIND > dn="cn=admin,dc=defensoria,dc=mg,dc=gov,dc=br" method=128 > Oct 31 13:59:08 defensoria slapd[1688]: conn=1543 op=0 BIND > dn="cn=admin,dc=defensoria,dc=mg,dc=gov,dc=br" mech=SIMPLE ssf=0 > Oct 31 13:59:08 defensoria slapd[1688]: conn=1543 op=0 RESULT tag=97 err=0 > text= > Oct 31 13:59:08 defensoria slapd[1688]: conn=1543 op=1 ADD > dn="uid=computer2$,ou=defensoria,dc=defensoria,dc=mg,dc=gov,dc=br" > Oct 31 13:59:08 defensoria slapd[1688]: conn=1543 op=1 RESULT tag=105 err=21 > text=gidNumber: value #0 invalid per syntax > Oct 31 13:59:08 defensoria slapd[1688]: conn=1543 op=2 UNBIND > Oct 31 13:59:08 defensoria slapd[1688]: conn=1543 fd=38 closed > Oct 31 13:59:08 defensoria slapd[1688]: conn=1544 fd=38 ACCEPT from > IP=127.0.0.1:50680 (IP=0.0.0.0:389) > Oct 31 13:59:08 defensoria slapd[1688]: conn=1544 op=0 BIND > dn="cn=admin,dc=defensoria,dc=mg,dc=gov,dc=br" method=128 > Oct 31 13:59:08 defensoria slapd[1688]: conn=1544 op=0 BIND > dn="cn=admin,dc=defensoria,dc=mg,dc=gov,dc=br" mech=SIMPLE ssf=0 > Oct 31 13:59:08 defensoria slapd[1688]: conn=1544 op=0 RESULT tag=97 err=0 > text= > Oct 31 13:59:08 defensoria slapd[1688]: conn=1545 fd=39 ACCEPT from > IP=127.0.0.1:50681 (IP=0.0.0.0:389) > Oct 31 13:59:08 defensoria slapd[1688]: conn=1545 op=0 BIND > dn="cn=admin,dc=defensoria,dc=mg,dc=gov,dc=br" method=128 > Oct 31 13:59:08 defensoria slapd[1688]: conn=1545 op=0 BIND > dn="cn=admin,dc=defensoria,dc=mg,dc=gov,dc=br" mech=SIMPLE ssf=0 > Oct 31 13:59:08 defensoria slapd[1688]: conn=1545 op=0 RESULT tag=97 err=0 > text= > Oct 31 13:59:08 defensoria slapd[1688]: conn=1545 op=1 SRCH > base="dc=defensoria,dc=mg,dc=gov,dc=br" scope=2 deref=0 > filter="(objectClass=organizationalUnit)" > Oct 31 13:59:08 defensoria slapd[1688]: conn=1545 op=1 SRCH attr=dn > Oct 31 13:59:08 defensoria slapd[1688]: conn=1545 op=1 SEARCH RESULT tag=101 > err=0 nentries=1 text= > Oct 31 13:59:08 defensoria slapd[1688]: conn=1545 op=2 UNBIND > Oct 31 13:59:08 defensoria slapd[1688]: conn=1545 fd=39 closed > Oct 31 13:59:08 defensoria slapd[1688]: conn=1544 op=1 UNBIND > Oct 31 13:59:08 defensoria slapd[1688]: conn=1544 fd=38 closed > Oct 31 13:59:08 defensoria slapd[1688]: conn=1541 op=1 UNBIND > Oct 31 13:59:08 defensoria slapd[1688]: conn=1541 fd=17 closed > Oct 31 13:59:10 defensoria slapd[1688]: conn=1546 fd=17 ACCEPT from > IP=127.0.0.1:50682 (IP=0.0.0.0:389) > Oct 31 13:59:10 defensoria slapd[1688]: conn=1546 op=0 do_search: invalid > dn: "LDAP_DN" > Oct 31 13:59:10 defensoria slapd[1688]: conn=1546 op=0 SEARCH RESULT tag=101 > err=34 nentries=0 text=invalid DN > Oct 31 13:59:10 defensoria slapd[1688]: conn=1546 op=1 UNBIND > Oct 31 13:59:10 defensoria slapd[1688]: conn=1546 fd=17 closed > > Thanks ! > > Rodrigo > > > > ________________________________ > De: Mauricio Tavares <raubvogel(a)gmail.com> > Para: "openldap-technical(a)openldap.org" <openldap-technical(a)openldap.org> > Cc: rodrigo tavares <rodrigofariat(a)yahoo.com.br> > Enviadas: Quarta-feira, 31 de Outubro de 2012 12:47 > > Assunto: Re: Error : when create usermachine in LDAP > > On Wed, Oct 31, 2012 at 9:46 AM, Dan White <dwhite(a)olp.net> wrote: >> On 10/31/12 06:16 -0700, rodrigo tavares wrote: >>> >>> Hello, >>> >>> I try to create a computer in LDAP, come this message: >>> Error in OpenLDAP recording computer.* >>> >>> What is wrong ? >> >> >> Rodrigo, >> >> I am unfamiliar with the error message you are seeing. However, your >> post lacks some important information. See: >> >> http://www.chiark.greenend.org.uk/~sgtatham/bugs.html >> >> Provide a better mental image of what command or action you are performing >> that is causing your error, and what output you are expecting to see; what >> software are using that is causing this error? What version of OpenLDAP >> are >> you using? >> >> -- >> Dan White >> > Rodrigo: > > How exactly are you adding the computer to ldap? I take it is not > using ldapadd. ;) > > Does whatever you are using have a log and a debugging/verbose mode? > > >

2 2

general protection fault when deleting members from a large group (mdb)
by Mundry, Marvin 03 Nov '12

03 Nov '12

Hi, i was trying to remove all members from a group initially having 48428 members one by one. i.e.: dn: cn=students,ou=groups,dc=university,dc=com changetype: modify delete: member member: cn=user1,ou=users,dc=uni-hamburg,dc=de dn: cn=students,ou=groups,dc=university,dc=com changetype: modify delete: member member: cn=user2,ou=users,dc=uni-hamburg,dc=de [...] after some time ldapmodify stops as the slapd stops running. In the syslog i see the following message: Nov 3 15:05:45 oscar slapd[11040]: conn=1000 op=133 MOD dn="cn=students,ou=groups,dc=university,dc=com" Nov 3 15:05:45 oscar slapd[11040]: conn=1000 op=133 MOD attr=member Nov 3 15:05:45 oscar slapd[11040]: conn=1000 op=134 MOD dn="cn=students,ou=groups,dc=university,dc=com" Nov 3 15:05:45 oscar slapd[11040]: conn=1000 op=134 MOD attr=member Nov 3 15:05:45 oscar slapd[11040]: conn=1000 op=133 RESULT tag=103 err=0 text= Nov 3 15:05:45 oscar kernel: [21207.720483] slapd[11045] general protection ip:7fae665cbc1f sp:7faded9c9fc0 error:0 in back_mdb-2.4.so.2.8.5[7fae665a5000+30000] am i doing something wrong or is there a bug in my slapd? i am running openldap-2.4.33 on ubuntu 12.10, compiled with: --enable-dynamic=yes --enable-syslog=yes --enable-slapd=yes --enable-dynacl=yes --enable-crypt=yes --enable-modules=yes --enable-rewrite=yes --enable-bdb=mod --enable-hdb=mod --enable-ldap=mod --enable-mdb=mod --enable-meta=mod --enable-monitor=mod --enable-overlays=mod --with-tls=openssl Best regards, Marvin Mundry

2 1

Modify schema add atributtes
by Jorge Armijo 03 Nov '12

03 Nov '12

Hi my friends im new with ldap and samba i need to add some attributes i need a tool or some thing similar i need replicate this in a 20 more servers Enviado desde mi iPhone

2 1

Re: Problem in sync-repling multiple databases
by Marco Pizzoli 02 Nov '12

02 Nov '12

On Wed, Oct 31, 2012 at 8:32 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Wednesday, October 31, 2012 10:03 AM +0100 Marco Pizzoli < > marco.pizzoli(a)gmail.com> wrote: > > Hi Quanah, >> >> >> On Mon, Oct 29, 2012 at 6:16 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> >> wrote: >> >> >> --On Monday, October 29, 2012 8:52 AM +0100 Marco Pizzoli >> <marco.pizzoli(a)gmail.com> wrote: >> >> >> If I try to configure a second replica configration targeted directly to >> (in example) to ou=ou3, then that ou get replicated. >> >> Any help/advice is welcome. >> >> >> Hi Marco, >> >> You have not provided any useful information with which to help you, so >> there is not really any advice one can offer you. I.e., you have not >> provided the configuration you are using on your master and replicas in >> the scenario where you have multiple DBs. >> >> >> You are absolutely right and I'm aware of it... >> The problem is in this case I can't provide any (even similar >> to)real configuration. Both from technical limitation (remote server >> with no possibility of copy/paste) and corporate policy*. >> >> * Continuing experimenting I found also 2 or 3 cases in which I'm able to >> crash OL 2.4.33 (in one case by simply slapadding using back-mdb) but I >> CAN'T provide any material to file a "valid" ITS. I'm sorry about that. >> > > Hi Marco, > > Your corporate policy sounds so severe, I'm surprised you can even send > email indicating you have faced any issues. Without an ability to provide > useful information, I don't believe there is any way anyone can help you. > > I would suggest you find a way to comply with your corporate policy while > providing useful information. Since I don't know what that policy is, it > is hard to know what you might do, but I'd hope you could supply your > configs minus any passwords and specific schema/attrs or something (i.e., > make generic configs that illustrate the issues you are facing). That's > what I generally do. > > If you require confidentiality, I would suggest a support agreement with > Symas that includes an NDA. > > Quanah, I appreciate you always answering my requests, but in this case my only question was if the problem I was facing is a known issue (at least in OL2.3 we know it was). If not, it could be my fault in the configuration. Maybe someone had a similar problem and could share his experience. By not being able to provide useful configuration snippets, I *have not* asked for a specific help. With your answers, do I have to assume that with OL2.4.x you never faced a problem syncrepl-ing a tree composed by multiple db's, testing both scenarios (more or less) similar to the two I presented from a (very) high-level-view perspective? Thanks again Marco

2 1

Memory usage with bdb
by Friedrich Locke 02 Nov '12

02 Nov '12

Is anyone aware of any buggy in openldap+bdb related to memory usage? Have anyone here using this type of backend ? Any problem to report? Thanks for your time and cooperation. Best regards.

6 7

memberOf data in new replica servers 2.4.31
by Todd Stein 02 Nov '12

02 Nov '12

Hi, I have a provider server and five consumer servers, all of which have the memberOf overlay configured: overlay memberof memberof-group-oc groupOfUniqueNames memberof-member-ad uniqueMember memberof-refint true memberof-dangling ignore syncrepl rid=005 provider=ldap://<server>:389 type=refreshAndPersist interval=00:00:05:00 retry="60 10 600 +" searchbase="dc=<removed>,dc=<removed>" filter="(objectClass=*)" scope=sub attrs="*" schemachecking=off starttls=no bindmethod=simple binddn="cn=replica,dc=<removed>,dc=<removed>" credentials=<removed> When I bring a new replica online, it appears that entries are replicated in the order that they were created on the provider server which produces many "memberof_value_modify failed err=32" messages in the log, and incomplete memberOf data. To get around this, I wrote a script which empties all groups prior to replication, and then recreates the memberships after the initial replication. This seems to work, but is hardly ideal. Is there a "more correct" way of replicating memberOf values without manipulating my provider each time I bring up a new consumer? Thank you very much, Todd

2 1

AW: openldap 2.2.x
by Pörschke, Gunnar 02 Nov '12

02 Nov '12

With my ldap client, JXplore, I import a subtree and get this error message: [LDAP: error code 21 - postalAddress: value #0 invalid per syntax]; remaining name 'uid=reskes(a)circa,ou=Users,ou=DATA,ou=fis-vl.bund.de,o=IRCusers,l=CIRCA' The import job fails (same result with slapadd). This are the data: postalAddress:: TmllZGVyc+RjaHNpc2NoZXMgTGFuZGVzYW10IGb8ciBWZXJicmF1Y2hlcnNj aHV0eiB1bmQgTGViZW5zbWl0dGVsc2ljaGVyaGVpdCwgRGV6ZXJuYXQgMjMsIFBvc3RmYWNoIDM 5NDksIDI2MDI5IE9sZGVuYnVyZw== -----Ursprüngliche Nachricht----- Von: Pörschke, Gunnar Gesendet: Donnerstag, 1. November 2012 13:51 An: 'openldap-technical(a)openldap.org' Betreff: openldap 2.2.x Hi all, we have an very old openldap running and we need to migrate data to latest openldap version. I create an ldif but the data in that file are encoded "base64". Is there a trick to disable that? My plan is to export everything from openldap 2.2 database (lbdb) without base64 encoding so I can easily use slapadd to add this data to a database on my new openldap 2.4.2x system Thank you for any idea. Gunnar

3 2

Re: Index Add Failures
by Kyle Smith 01 Nov '12

01 Nov '12

Thanks for the input, Quanah. I really appreciate it. On Thu, Nov 1, 2012 at 1:10 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > > --On Thursday, November 01, 2012 1:04 PM -0400 Kyle Smith < > alacer.cogitatus(a)gmail.com> wrote: > > Is it possbile to use MMR to my advantage to switch over? For example, >> take down 1 of the servers, switch the db config from bdb to mdb, and >> then restart with a blank database (with appropriate structure) and >> have the MMR take care of backfilling the mdb entries? Then I wouldn't >> have to export to ldif, convert the db, and reimport while possibly >> loosing data from the other systems. >> > > Hi Kyle, > > I'm not sure what you are trying to avoid here... Slapcat/slapadd are > always faster than sync replication. Why would you lose data from the > other server while doing this? contextCSNs should be preserved w/ > slapcat/slapadd, so the server being converted will just catch up using > sync replication as before. You may wish to look at ITS#7427 though. The > fix for that is in current RE24. > > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

Re: Index Add Failures
by Kyle Smith 01 Nov '12

01 Nov '12

Is it possbile to use MMR to my advantage to switch over? For example, take down 1 of the servers, switch the db config from bdb to mdb, and then restart with a blank database (with appropriate structure) and have the MMR take care of backfilling the mdb entries? Then I wouldn't have to export to ldif, convert the db, and reimport while possibly loosing data from the other systems. On Thu, Nov 1, 2012 at 12:57 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > > --On Thursday, November 01, 2012 12:36 PM -0400 Kyle Smith < > alacer.cogitatus(a)gmail.com> wrote: > > Ok, I have been running 2.4.32 for some time with no issues. Yesterday, 2 >> different servers (both part of a 4-way MMR) produced an "index add >> failure" and an "index delete failure". I went back over the bdb >> DB_CONFIG Settings (listed below) and everything looks nominal to me. >> Would it just make more sense to switch from bdb to mdb instead of >> troubleshooting these "random" errors too much? I also noticed that the >> number of "deadlocks" corresponds to the number of errors that were >> produced. Is there correlation there? >> > > I would suggest back-mdb in OpenLDAP 2.4.33 over back-hdb, yes. It will > remove these deadlock issues entirely. When you configure the back-mdb > backend in cn=config, be sure to have: > > olcDbEnvFlags: writemap > olcDbEnvFlags: nometasync > > set as well. This makes back-mdb writes significantly faster than writes > to back-bdb/hdb. (Some 2x faster in my testing so far). > > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

openldap 2.2.x
by Pörschke, Gunnar 01 Nov '12

01 Nov '12

Hi all, we have an very old openldap running and we need to migrate data to latest openldap version. I create an ldif but the data in that file are encoded "base64". Is there a trick to disable that? My plan is to export everything from openldap 2.2 database (lbdb) without base64 encoding so I can easily use slapadd to add this data to a database on my new openldap 2.4.2x system Thank you for any idea. Gunnar

2 1

Re: Problem in sync-repling multiple databases
by Marco Pizzoli 31 Oct '12

31 Oct '12

Hi Quanah, On Mon, Oct 29, 2012 at 6:16 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Monday, October 29, 2012 8:52 AM +0100 Marco Pizzoli < > marco.pizzoli(a)gmail.com> wrote: > > If I try to configure a second replica configration targeted directly to >> (in example) to ou=ou3, then that ou get replicated. >> >> Any help/advice is welcome. >> > > Hi Marco, > > You have not provided any useful information with which to help you, so > there is not really any advice one can offer you. I.e., you have not > provided the configuration you are using on your master and replicas in the > scenario where you have multiple DBs. > You are absolutely right and I'm aware of it... The problem is in this case I can't provide any (even similar to)real configuration. Both from technical limitation (remote server with no possibility of copy/paste) and corporate policy*. I was hoping to find a known logical problem/bug, so to continue myself. I read an answer from Howard to another user some times ago telling him that is a known problem in OL2.3 not handling well subordinate db's and syncrepl, so I asked from help in this topic. The suggestion (from another user) was, for that release, to configure a syncrepl directive for each of the subordinate db's. This is what I did and in the end I succeded in syncrepling also other db's. If you have general guidance, know issues to share in cases similar to these and so on... I would be interested in it. Thanks for your comprehension Marco * Continuing experimenting I found also 2 or 3 cases in which I'm able to crash OL 2.4.33 (in one case by simply slapadding using back-mdb) but I CAN'T provide any material to file a "valid" ITS. I'm sorry about that. > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

Setting a whole subtree temporarily read-only based on an attribute?
by Peter Mogensen 31 Oct '12

31 Oct '12

Hi, I've been reading the slapd.access back and forth a few times in search for a way to make an ACL, which defines read (and only read) access to a whole subtree in the DIT based on the value of an attribute of the subtree root node. I've found out how to do it for a named user by defining a group attribute on the node like this: olcAccess: {2}to dn.regex="^.+,o=([^,]+),dc=example,dc=com" by group/NamedObject/denied.expand="o=$1,dc=example,dc=com" read by * +0 break But this only denies the named DNs write access. What I want to to deny everybody write access to everything below the o=$1 RDN. Conceptually I would also imagine, that this would belong in the <WHAT> clause of the ACL and not in the <WHO> clause, but I can't find any mechanism to do stuff like: access to dn.<which-have-attr-set-to-readonly>.children by * read What is the text-book way to do this? regards, Peter

1 0

Error : when create usermachine in LDAP
by rodrigo tavares 31 Oct '12

31 Oct '12

Hello, I try to create a computer in LDAP, come this message: Error in OpenLDAP recording computer.* What is wrong ? Rodrigo Faria

3 5

read/write password/... attributes from/in SQL DB directly
by Denny Schierz 31 Oct '12

31 Oct '12

hi, our usermanagement is running on a Postgres (later MariaDB) database and have some (cron)scripts, that push/delete the new users into the LDAP tree. If the user changes his password (passwd/linux) it is only written to the LDAP side and one other script, reads the new password out and writes it into the user mgt DB back. I want to ask: is there a way, to let LDAP read/write this or more attributes to the DB directly? We thought also to switch the dbdm to the mySQL backend, but I think, it isn't a good idea for ~4.000 active accounts and several netboot clients. cu denny

1 1

OpenLDAP - how to correct invalid cn values
by Whiteman, Craig 30 Oct '12

30 Oct '12

A bug in a PHP script<http://www.linuxquestions.org/questions/showthread.php?p=4813771> has caused some entries in the LDAP database<http://www.linuxquestions.org/questions/showthread.php?p=4813771> to have invalid values: # James + Bond, people, mi6.gov.uk dn: cn=James+sn=Bond,ou=people,dc=mi6,dc=gov,dc=uk sn: Bond givenName: James cn:: U3RldmUg gecos:: U3RldmUg As you can see, the cn: and gecos: have the invalid values - they should be James Bond. I did attempt to correct the problem with ldapmodify by putting the following into a file called updateCN.ldif: dn: cn=James+sn=Bond,ou=people,dc=mi6,dc=gov,dc=uk changetype:modify replace: cn cn: James Bond and executing the following command: ldapmodify -x -W -D "cn=admin,dc=mi6,dc=gov,dc=uk" -f updateCN.ldif This returned the following error Enter LDAP Password: modifying entry "cn=James+sn=Bond,ou=people,dc=mi6,dc=gov,dc=uk" ldap_modify: Naming violation (64) additional info: value of naming attribute 'cn' is not present in entry I have also tried ldapmodrdn: ldapmodrdn -r -f updateCN.ldif with updateCN.ldif: dn: cn=James Bond+sn=Bond,ou=people,dc=mi6,dc=gov,dc=uk cn=James Bond $ ldapmodrdn -r -f updateCN.ldif SASL/DIGEST-MD5 authentication started Please enter your password: ldap_sasl_interactive_bind_s: Internal (implementation specific) error (80) additional info: SASL(-13): user not found: no secret in database and ldapmodify -f updateCN.ldif with updateCN.ldif: dn: cn=James Bond+sn=Bond,ou=people,dc=mi6,dc=gov,dc=uk changetype: modrdn newrdn: cn=James Bond deleteoldrdn: 1 $ ldapmodify -f updateCN.ldif SASL/DIGEST-MD5 authentication started Please enter your password: ldap_sasl_interactive_bind_s: Internal (implementation specific) error (80) additional info: SASL(-13): user not found: no secret in database How can I correct the invalid values in the LDAP database? THINK BEFORE YOU PRINT====================================================================== The information contained in this email is intended only for the individual to whom it is addressed. It may contain legally privileged or confidential information or otherwise be exempt from disclosure. If you have received this message in error or there are any problems, please notify the sender immediately and delete the message from your computer. YOU MUST NOT use, disclose, copy or alter this message for any unauthorized purpose. Neither Electricity North West Limited nor any of its subsidiaries will be liable for any direct, special, indirect or consequential damages as a result of any virus being passed on, or arising from the alteration of the contents of this message by a third party. Electricity North West Limited 304 Bridgewater Place, Birchwood Park Warrington WA3 6XG, Registered in England and Wales Registration No 02366949 ===========================================================================================

3 4

max. numbers of subordinate databases
by Dieter Klünter 29 Oct '12

29 Oct '12

Hello, I have a strange requirement to setup a Server with as much as possible subordinate databases. In a test environment I could create any number of databases, but a one level search presents the results of 27 databases and after this an internal error is reported. (thread_pool_setkey failed err (12)) I did this tests with back-hdb and back-mdb. Is there any way to increase the number of subordinate databases? -Dieter -- Dieter Klünter | Systemberatung http://dkluenter.de GPG Key ID:DA147B05 53°37'09,95"N 10°08'02,42"E

2 1

[PATCH] ctrl & exop for PHP 5.3
by Emmanuel Dreyfus 29 Oct '12

29 Oct '12

Hello Quite some time ago, Pierangelo Masarati wrote a patch to brind ctrl and exop support to PHP. Unfortunately the patch was never checked in upstream and broke with PHP 5.3 I trieed to upgrade the patch for PHP 5.3 support. Here is my first attempt, which builds on PHP 5.3.17: http://ftp.espci.fr/shadow/manu/ldap-ctrl-exop-20121025.patch I successfully tested ldap_exop_passwd, ldap_exop_whoami, and ldap_refresh. Everything else was not tested and is broken without any doubt (zend_parse_parameters 3rd argument is wrong, it should probably be Z more often). Feel free to help, either by fixing the remaining bits, or by providing a test case for the broken parts (I never used controls and therefore I am not going to do it). -- Emmanuel Dreyfus manu(a)netbsd.org

4 3

Problem in sync-repling multiple databases
by Marco Pizzoli 29 Oct '12

29 Oct '12

Hi all, I'm using OL 2.4.33 and I'm trying to replicate a tree to an instace of OL 2.4.33 composed by multiple databases. My tree is something as this: - basedn - ou=ou1 - ou=ou2 - ou=ou3 If I have all my subtrees, on the master, served by a single db... then I can syncrepl to the consumer without problems. If my master is composed by separate databases (ou1, ou2, etc.. are all distinct databases), then the replica stops after completing the first one of them. So to recap: - single database to multiple database --> ok - multiple database to multiple database --> ko Is it a known problem? I read that it was as of OL 2.3, but also that it was fixed in OL2.4. My logs present no indication of any kind of problem, even at debug level. If I try to configure a second replica configration targeted directly to (in example) to ou=ou3, then that ou get replicated. Any help/advice is welcome. Thanks in advance as usual Marco

2 1

Newbie question about host base authentication
by Simone Scremin 29 Oct '12

29 Oct '12

Hi all, I'm in the process of learning the OpenLDAP authentication mechanics. I'd need to know what is the best way to configure an host based authentication system that allow to configure a per-user rule to include a group of host to which the user is allowed to login. In example: user Bob needs to authenticate on systems: sys01pra sys02pre sys03pra sys03pre some configuration on the LDAP server enable this hostnames for Bob with a regular expression like: sys0*pr* Is it feasable? Thanks Simone

5 7

Re: Newbie question about host base authentication
by Simone Scremin 29 Oct '12

29 Oct '12

Hi Olivier, thanks for the fast answer. I'm looking at pam_ldap component and I already saw the host based authentication that enables to list hostnames on the server per user. Your idea, if I'm not mistaken, would be to specify this host parameter as some kind of LDAP data structure (ie: groupOfNames) and have the authentication mechanism match on that structure. I'm looking at groupOfNames and it's not clear to me if it can really be used for that purpose but the most obscure point is where the logic for the matching should go. I'm really open to any input on this subject whether it is some example of already implemented solutions or just some direction on how to go forward with the development. Thank you Simone On Oct 29, 2012, at 2:40 PM, Olivier <ldap(a)guillard.nom.fr> wrote: > ---Previous mail sent accidently before ending (sorry for doublon)--- > > Feasable it is (there different ways to do that). > > BTW, I'm also interested to gather some input on that topic. > > @simone : I suggest that you look at pam mecanisms : > http://www.padl.com/OSS/pam_ldap.html > And more specifically at the access.conf syntax. > > You may be interested in : > Hosts, posix groups, group of names and netgroups > > > @list : I would appreciate some input from others about the > best way to store hosts in ldap for this kind of usage : > > Which container to use for hosts (structural class account? > device ? ... ) > > How to deal with groups of hosts : groupOfNames ? posixGroup ? > > Any advice ? > > Thanks, > > > 2012/10/29 Simone Scremin <simone.scremin(a)gmail.com>: >> Hi all, >> I'm in the process of learning the OpenLDAP authentication mechanics. >> I'd need to know what is the best way to configure an host based authentication system that allow to configure a per-user rule to include a group of host to which the user is allowed to login. >> >> In example: >> >> user Bob needs to authenticate on systems: >> >> sys01pra >> sys02pre >> sys03pra >> sys03pre >> >> some configuration on the LDAP server enable this hostnames for Bob with a regular expression like: >> >> sys0*pr* >> >> Is it feasable? >> >> Thanks >> >> Simone >>

1 0

compile 2.4.33 on AIX 6.1 with IBM vac - mdb.c - mdb_cursor_pop fails
by Howard Allison 25 Oct '12

25 Oct '12

Hi I've compiled openldap 2.4.33 on AIX 6.1 and had to edit the file libraries/libmdb/mdb.c. In mdb_cursor_pop I had to comment out the #if MDB_DEBUG directive to make *top visible. #if MDB_DEBUG */ MDB_page *top = mc->mc_pg[mc->mc_top]; /* #endif */ Is this something particular to xlc? Thanks Howard Allison -------------------------------------------------------------------------------------------------------- VERTRAULICHKEIT: Diese Nachricht ist ausschließlich für denjenigen bestimmt, an den sie adressiert ist und kann vertrauliche Informationen enthalten. Falls Sie nicht der Empfänger dieser Nachricht sind, weisen wir Sie darauf hin, dass die unberechtigte Weitergabe oder Verwendung sowie das unberechtigte Verteilen oder Kopieren dieser Nachricht strikt untersagt sind. Falls Sie diese Nachricht irrtümlich erhalten haben, vernichten Sie sie bitte sofort. CONFIDENTIALITY: This message is intended only for the use of the individuality or entity to which it is addressed and may contain information that is privileged, confidential and exempt from disclosure. If you are not the intended recipient you are notified that any dissemination, distribution, use or copying of this communication is strictly prohibited. If you received this message in error, please immediately destroy this message. --------------------------------------------------------------------------------------------------------

2 1

Sincrony groups in LDAP
by rodrigo tavares 23 Oct '12

23 Oct '12

Hello, With paramater retry="60 30 300 +", i can to replicate users. But, I see the groups not copyed for LDAP. I can't replicate the groups. syncrepl rid=123 provider=ldap://10.26.7.45:389 type=refreshOnly interval=00:00:05:00 retry="60 30 300 +" searchbase="dc=company,dc=mg,dc=gov,dc=br" filter="(objectClass=organizationalPerson)" scope=sub attrs="*,+" schemachecking=off bindmethod=simple binddn="cn=admin,dc=company,dc=mg,dc=gov,dc=br" credentials=secret Do I have modificate the objectClass ? Best regards, Rodrigo Faria

2 1

Using replication LDAP
by rodrigo tavares 23 Oct '12

23 Oct '12

Hello ! I'm trying make a replication from master for slave. My configure master: moduleload syncprov.la moduleload back_monitor.la moduleload back_bdb overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 Slave: syncrepl rid=123 provider=ldap://10.26.7.45:389 type=refreshOnly interval=00:00:05:00 searchbase="dc=company,dc=mg,dc=gov,dc=br" filter="(objectClass=organizationalPerson)" scope=sub attrs="*,+" schemachecking=off bindmethod=simple binddn="cn=admin,dc=company,dc=mg,dc=gov,dc=br" credentials=secret I syslog i see this message: Oct 23 10:23:32 replica slapd[1827]: syncrepl rid=123 searchbase="dc=company,dc=mg,dc=gov,dc=br": no retry defined, using default. How I can to resolve it ? Best regards, Rodrigo Faria

3 2

Search response attribute/alias names
by Tele Fone 23 Oct '12

23 Oct '12

Hello, I've searched and think I know the answer, but... This post from several years ago is exactly my issue: www.openldap.org/its/?findid=787 See this one too: www.openldap.org/lists/openldap-software/200105/msg00160.html I would like to know if anything has changed in 10+ years. I'm in the middle of coverting from Critical Path LDAP to OpenLDAP 2.4.26. Critical Path returns the alias name (when requested in search) in search responses. Has there been a magic configuration flag added to make the transition to openldap a bit easier? I understand that openLDAP conforms to the LDAPv3 standard, but had to ask. Thanks.

1 0

ContextCSN generation
by Sven Jourgensen 22 Oct '12

22 Oct '12

I have an odd issue, where I have some new slaves that I added to my pool, they ran fine sync'ing with the master, etc. for weeks, until I added them into use (we're using an F5 frontend) whereupon they started getting a contextCSN which was larger than that of the master. How is the contextCSN generated, I thought the slave could never get ahead of the master, but it's happening consistently, it's not a transient thing, the slave gets a larger contextCSN and keeps it, until the master is updated again. master: contextCSN: 20121010154339.775633Z#000000#000#000000 slave1: contextCSN: 20121010154442.858054Z#000000#000#000000 slave2: contextCSN: 20121010154351.807575Z#000000#000#000000 As soon as I remove them from use, and update the master, they come back into sync. Thanks in advance. SJ

3 4

LDAP Architecture for CardDAV/OpenLDAP interface
by Nicolas Mora 21 Oct '12

21 Oct '12

Hello, I'm using both an OpenLDAP server and an owncloud server, both for different but convergent purposes. The OpenLDAP manages an addressbook that is used by all mail client (Thunderbird, Horde, etc.), and the owncloud server also manages an addressbook for phone numbers, addresses and stuff, this one is a CardDAV one with VCard files. My goal is to converge these 2 different back-ends into one, all the data would be stored in the LDAP server. I did some research about how to do it and I have some clue that I would like to submit to you for feedbacks. The first interrogation is about the VCard/LDAP interface. After studying the VCard format and the different LDAP schemas, mostly RFC 6350 and 2256 and the schema files in the OpenLDAP conf folder in a Debian Stable server. I think that a new schema would do the connection. All the VCard properties can be easily linked to an existing person or inetOrgPerson or another *person objectClass. And the properties that doesn't exist yet are to be created in a schema extension. Also, one or two additional properties fields per property are to be created for the VCard parameters. Actually, there are different objectClass that might be extended: person, inetOrgPerson, organizationalPerson and residentialPerson. Considering that inetOrgPerson, organizationalPerson and residentialPerson are designed for specific purposes, I think that extending the person objectClass would be the best guess, what do you think ? The second question is more about the OpenLDAP configuration to handle this need. Right now, the OpenLDAP server is only used by me as an addressbook and an authentication server, the directory looks like this: dc=babelouest,dc=org | |-ou=addressbook | | | |-cn=Address1 | |-cn=Address2 | |-[...] | |-ou=users | | | |-uid=user1 | |-uid=user2 | |[...] I would like to add another branch to allow users to add their own addressbook entries, these entries would be in read/write mode only for the owner, no one else but him should have access. The new directory would look like this: dc=babelouest,dc=org | |-ou=addressbook (global, read-only for all users) | | | |-cn=Address1 | |-cn=Address2 | |-[...] | |-ou=users | | | |-uid=user1 | |-uid=user2 | |[...] | |-ou=personnalAddressbooks (personnal addressbook entries) | | | |-uid=user1 | | | | | |-cn=Address1 | | |-cn=Address2 | | |-cn=Address3 | | | |-uid=user2 | | | | | |-cn=Address1 | | |-cn=Address2 I took a look at the Access control help page but I couldn't find how to properly set the OpenLDAP configuration like this. Can you help me configuring the slapd.conf ? Thanks in advance. /Nicolas

2 1

Dynamic configuration / admin users
by Simon Walter 20 Oct '12

20 Oct '12

Greetings, First off, I'm sorry if this is the wrong place to ask this. Please direct me to the appropriate list. Here goes with the n00b questions: Debian Squeeze is using the dynamic configuration. While I am sure there are benefits, all the documentation is for static configuration (slapd.conf). I've got a basic tree up and running and several services are using it no problem. There are several things I'd like to do, like replication. For this and some other services, SOGo for example, that don't bind anonymously, I'd like to create some more users for this. I could be mistaken, but perhaps they need some kind of admin privileges. If not, that means that any user can modify anything in the tree. I see various information about ACI and ACL and access.conf. I can't find clear documentation about how any of this relates to dynamic configurations. To conclude, how do I add additional users to a dynamic configured openldap tree and configure those users with specific access permissions? Thank you, Simon

3 3

Mirror mode replication problem
by cbulist 19 Oct '12

19 Oct '12

Hi, We have configured 2 server with openldap 2.4.23-26 version and everything is working well (ppolicy,acl etc). We implemented replication in mirror mode and it is working well. When we add/delete/modify something in serverID 1 it sync the data to serverID2 without problem but when we add/delete/modify in serverID 2 it is not sync to serverID 1. We tried to stop openldap server1 then make changes on server2 and start server 1 again in order to get the changes from server2 but it did not work. According to 2.4 guide: "When a crashed provider is repaired and restarted it will automatically catch up to any changes on the running provider and resync". We appreciate any help to try fix this problem. Thanks in advance! This is the relevant configuration directives: #Server 1 overlay syncprov syscprov-checkpoint 100 10 syscprov-sessionlog 100 serverID 1 syncrepl rid=001 provider=ldap://server2:389 bindmethod=simple binddn="cn=Manager,dc=sample,dc=com" credentials=secret searchbase="dc=sample,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" mirrormode on #Server 2 overlay syncprov syscprov-checkpoint 100 10 syscprov-sessionlog 100 serverID 2 syncrepl rid=001 provider=ldap://server1:389 bindmethod=simple binddn="cn=Manager,dc=sample,dc=com" credentials=secret searchbase="dc=sample,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" mirrormode on

2 2

SSL/TLS issue
by Darouichi, Aziz 19 Oct '12

19 Oct '12

Hi, I am running Openldap-2.4.32, BD-5.3.21 and openssl-1.0.1c on RHEL 5.5. I created CA cert and singed it but when I run ldeapsearch with -ZZ I get the following error: TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 1, err: 19, subject: /C=US/ST=Mass/O=Curry College/OU=Technology Center/CN=LDAP-SSL.curry.edu/emailAddress=adarouic@curry.edu, issuer: /C=US/ST=Mass/O=Curry College/OU=Technology Center/CN=LDAP-SSL.curry.edu/emailAddress=adarouic@curry.edu TLS certificate verification: Error, self signed certificate in certificate chain TLS trace: SSL3 alert write:fatal:unknown CA TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect. ldap_perror ldap_start_tls: Connect error (-11) additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed Please let me know if I missed something in my configuration. Thanks, Aziz

4 8

Virtual view of ldap subtree
by Marco Pizzoli 19 Oct '12

19 Oct '12

1 0

ldapsearch agains Tivoli Directory Server
by Alejandro Rodriguez Luna 18 Oct '12

18 Oct '12

Hi all! I have a TDS (Tivoli Directory Server) in one of my servers, every time i need to query it i need to go to another server and do it, i'd like to be able to query from my machine, but i can't using openldap, do you guys have a hint/idea/clue?? i use this from another server idsldapsearch -h ldapserver.homeluna.org -Z -K /opt/PolicyDirector/ssl/homeluna.kdb -P passw0rd -b "" -s base objectclass=* btw, My servers only accepts SSL conections. btw, i put the following values inside /etc/openldap/ldap.conf without succeed. # # LDAP Defaults # BASE l=world URI ldap://ldapserver.homeluna.org ldap://ldapserver.homeluna.org:636 PORT 636 TLS_CACERT /home/alexrl/Desktop/ldapserver.homeluna.org.cer TLS_REQCERT demand alexrl@localhost ~ $ ldapsearch -v -H ldaps://ldapserver.homeluna.org -Dcn=root -w passw0rd -bl=world uid=alex* ldap_initialize( ldaps://ldapserver.homeluna.org:636/??base ) ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) ---------------------------------- Alejandro Rodriguez Luna E-mail: el_alexluna(a)yahoo.com.mx ----------------------------------

2 1

Generated fields from static rules ?
by Yoann Gini 17 Oct '12

17 Oct '12

Hello, I’m new on this list. I actually try to configure a LDAP server to manage my identities (and use Kerberos as authentication backend). In my goal, I want to minimize information that need to be set by administrator to create entry. Here is a basic example : dn: uid=yoann,ou=people,dc=example,dc=com objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person objectClass: top objectClass: posixAccount cn: Yoann Gini gidNumber: 20 homeDirectory: /home/users/yoann sn: Gini uid: yoann uidNumber: 2000 givenName: Yoann loginShell: /usr/local/bin/zsh mail: yoann(a)example.com userPassword: {SASL}yoann(a)EXAMPLE.COM As you can see, they have many redundant informations… What I looking for is a way to fix some field for posixAccount or *,ou=people,dc=example,dc=com. For example, userPassword should be construct with a static text, a ldap entry and a global variable… {SASL}$uid$#KRB_REALM#. Like the mail : $uid$#domain# If you have any suggestion :-) Yoann

2 2

Re: mdb_stat question
by Roman Rybalko 17 Oct '12

17 Oct '12

17.10.2012 04:19, Howard Chu пишет: > Have a look at mdb_stat in git mdb.master commit > 617769bce5bcac809791adb11301e40d27c31566 > > Use options -e and -f, that should give you everything you want. > Feedback appreciated, I doubt this is its final form yet. > Thanks! Nice tool! But how would I determine storage usage percent? ((Number of pages used)-(Free pages))/(Max pages)*100 or just (Number of pages used)/(Max pages)*100 ? I mean is there possible a situation when (Number of pages used)==(Max pages) and (Free pages)!=0 ? root@log:~# mdb_stat -e /mnt/data/ldap/2 Environment Info Map address: (nil) Map size: 15032385536 Page size: 4096 Max pages: 3670016 Number of pages used: 1042935 Last transaction ID: 2802459 Max readers: 126 Number of readers used: 18 Status of Main DB Tree depth: 1 Branch pages: 0 Leaf pages: 1 Overflow pages: 0 Entries: 12 root@log:~# mdb_stat -f /mnt/data/ldap/2 Freelist Status Tree depth: 3 Branch pages: 7 Leaf pages: 673 Overflow pages: 1 Entries: 2745 Free pages: 140824 Status of Main DB Tree depth: 1 Branch pages: 0 Leaf pages: 1 Overflow pages: 0 Entries: 12 root@log:~# -- WBR, Roman Rybalko

2 1

mdb_stat question
by Frank Swasey 16 Oct '12

16 Oct '12

If I've failed to find this on the mailinglist or in my google searches, I am sorry. However, as I'm experimenting with using mdb for the backend with OpenLDAP-2.4.33 on RHEL 6.3, I'm wondering what am I looking for when I run mdb_stat and it tells me: Page size: 4096 Tree depth: 2 Branch pages: 1 Leaf pages: 2 Overflow pages: 0 Entries: 59 -- Frank Swasey | http://www.uvm.edu/~fcs Sr Systems Administrator | Always remember: You are UNIQUE, University of Vermont | just like everyone else. "I am not young enough to know everything." - Oscar Wilde (1854-1900)

3 4

Three issues with rwm overlay and olcExtraAttrs
by k3kk0n3n k3kk0n3n 16 Oct '12

16 Oct '12

[Resending this as the first one didn't seem to appear on the mailing list, I apologize if this creates a duplicate.] Hi, I believe I have found 3 issues related to the rwm overlay and the extra_attrs (or olcExtraAttrs) setting written to fix the issues described in ITS#6513 ( http://www.openldap.org/its/index.cgi/Software%20Bugs?id=6513;selectid=6513…). The description is long but I tried to provide as much information as possible. I am hoping someone can test and confirm the issues or tell me what I'm doing wrong if there in fact is no issue. I'm running version 2.4.32 on Ubuntu 10 and Debian Squeeze. 1) The documentation in the slapd-config manpage is incorrect. The olcExtraAttrs setting is said to be a global configuration setting when in reality it seems to be database specific. In the slapd.conf manpage, the corresponding setting (extra_attrs) is listed as being database-specific. I believe that is correct although I have not checked it. 2) olcExtraAttrs does not seem to work with the rwm overlay (like in ITS#6513). With the rwm overlay present, ACIs are not evaluated when requesting a specific attribute, regardless of whether olcExtraAttrs is specified or not. In order to apply the ACI, you can pass the ACI attribute name in the search. I'm providing a configuration file that can be used to reproduce the problem as well as some search examples to demonstrate the issue. ----Configuration file---- dn: cn=config objectClass: olcGlobal cn: config olcPidFile: /usr/local/var/run/slapd.pid olcArgsFile: /usr/local/var/run/slapd.args #olcLogLevel: -1 olcToolThreads: 1 dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by * break olcAccess: {1}to dn.base="" by * read olcAccess: {2}to dn.base="cn=subschema" by * read olcRequires: authc dn: olcDatabase=config,cn=config objectClass: olcDatabaseConfig olcDatabase: config olcAccess: to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by * break dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema include: file:///usr/local/etc/openldap/schema/core.ldif dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModuleload: back_hdb olcModuleLoad: rwm dn: olcOverlay=rwm,olcDatabase={-1}frontend,cn=config objectClass: olcOverlayConfig objectClass: olcRwmConfig olcOverlay: rwm dn: olcDatabase={1}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: hdb olcSuffix: dc=example,dc=com olcDbDirectory: /var/lib/ldap olcRootDN: cn=admin,dc=example,dc=com olcRootPW: pass olcDbConfig: set_cachesize 0 2097152 0 olcDbConfig: set_lk_max_objects 1500 olcDbConfig: set_lk_max_locks 1500 olcDbConfig: set_lk_max_lockers 1500 olcExtraAttrs: OpenLDAPaci olcAccess: to attrs=userpassword by anonymous auth olcAccess: to dn.base="dc=example,dc=com" by * search olcAccess: to * by self manage by dynacl/aci=OpenLDAPaci manage ----Note---- To disable the rwm overlay, comment the following 4 lines in the config: dn: olcOverlay=rwm,olcDatabase={-1}frontend,cn=config objectClass: olcOverlayConfig objectClass: olcRwmConfig olcOverlay: rwm ----Test data---- dn: dc=example,dc=com objectClass: dcObject objectClass: top objectClass: organization dc: example o: example dn: cn=a,dc=example,dc=com objectClass: top objectClass: person cn: a sn: a userPassword: pass dn: cn=b,dc=example,dc=com objectClass: top objectClass: person cn: b sn: b userPassword: pass OpenLDAPaci: 1#entry#grant;r,s,c;[all]#access-id#cn=a,dc=example,dc=com ----Search examples---- Without rwm, requesting the whole object (works as expected): ldapsearch -x -D cn=a,dc=example,dc=com -w pass -b cn=b,dc=example,dc=com # b, example.com dn: cn=b,dc=example,dc=com objectClass: top objectClass: person cn: b sn: b # numResponses: 2 # numEntries: 1 Without rwm, requesting an attribute (works as expected): ldapsearch -x -D cn=a,dc=example,dc=com -w pass -b cn=b,dc=example,dc=com sn # b, example.com dn: cn=b,dc=example,dc=com sn: b # numResponses: 2 # numEntries: 1 With rwm, requesting the whole object (works as expected): ldapsearch -x -D cn=a,dc=example,dc=com -w pass -b cn=b,dc=example,dc=com # b, example.com dn: cn=b,dc=example,dc=com objectClass: top objectClass: person cn: b sn: b # numResponses: 2 # numEntries: 1 With rwm, requesting an attribute (notice the object is not returned here): ldapsearch -x -D cn=a,dc=example,dc=com -w pass -b cn=b,dc=example,dc=com sn # numResponses: 1 With rwm, requesting an attribute and openldapaci (works as expected): ldapsearch -x -D cn=a,dc=example,dc=com -w pass -b cn=b,dc=example,dc=com sn openldapaci # b, example.com dn: cn=b,dc=example,dc=com sn: b OpenLDAPaci: 1#entry#grant;r,s,c;[all]#access-id#cn=a,dc=example,dc=com # numResponses: 2 # numEntries: 1 3) The last issue came up when I was attempting to set up a certain kind of access control logic. It is highly similar to the previous problem but it doesn't involve ACIs. The issue is caused by the rwm overlay somehow blocking the ACL from accessing unrequested attributes just like in the previous case. olcExtraAttrs was created to fix this issue but I assume it would not fully solve the problem in my case. I have naturally not been able to test it due to the fact that I haven't gotten olcExtraAttrs to work. The access control logic I was attempting to set up was such that objects could contain 2 new attributes: 'rights' and 'requiredRights', both being multivalued strings. 'requiredRights' tells what rights are required to access the object in question, and 'rights' tells what rights each object has. If the user's 'rights' and the target objects 'requiredRights' have at least one common string, access is granted. Fairly simple. The ACL used to evaluate access is as follows: to * by set="this/requiredRights & user/rights" read This method works unless I use the rwm overlay. I'm guessing the attributes required to evaluate the ACLs are somehow dropped and cannot be used. olcExtraAttrs would (if it worked) automatically add the needed attributes to the target object but, to my understanding, not to the user object. The user's attributes would however be needed to evaluate the set shown earlier. The trick used in the last of the previously shown search examples does not work in this case. I can provide requiredRights and rights as additional attributes in the search and I assume requiredRights is returned for access control to use but rights isn't as it is an attribute of the user object. I don't have a cleaned-up version of the config at this time but one could be created if needed.

1 0

Open LDAP sometimes "Can't contact LDAP server"
by amicale.salmson＠free.fr 15 Oct '12

15 Oct '12

Hello all, I developed a PHP application which use slapd. Sometimes, I have the message "Can't contact LDAP server", but sometimes it works (almost half the time) Just before it hangs, I see the following message: -------------------------------------------------- daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: epoll: listen=9 active_threads=0 tvp=zero daemon: epoll: listen=10 active_threads=0 tvp=zero connection_read(20): input error=-2 id=1530, closing. connection_closing: readying conn=1530 sd=20 for close daemon: removing 20 conn=1530 fd=20 closed (connection lost) daemon: activity on 1 descriptor daemon: activity on: -------------------------------------------------- Sometimes, I also see theses messages: -------------------------------------------------- slapd[9635]: connection_close: deferring conn=1582 sd=22 connection_input: conn=1593 deferring operation: binding -------------------------------------------------- I use : - debian 6.0.5 - slapd 2.4.23-7.2 - OpenSSL 0.9.8o 01 Jun 2010 SSL certificats generated with XCA : - openssl x509 -text -in /etc/ssl/pki/ca.crt Data: Version: 3 (0x2) Signature Algorithm: sha1WithRSAEncryption Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (4096 bit) X509v3 extensions: X509v3 Basic Constraints: critical CA:TRUE X509v3 Key Usage: Certificate Sign, CRL Sign Netscape Cert Type: SSL CA, S/MIME CA, Object Signing CA Netscape Comment: xca certificate - openssl x509 -text -in /etc/ssl/pki/server.crt Data: Version: 3 (0x2) Signature Algorithm: sha1WithRSAEncryption Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (4096 bit) X509v3 extensions: X509v3 Basic Constraints: critical CA:FALSE X509v3 Key Usage: Digital Signature, Non Repudiation, Key Encipherment Netscape Cert Type: SSL Server Netscape Comment: xca certificate Certificats import: ----- BEGIN /etc/ssl/pki/ldap/ldap.ldif ----- dn: cn=config replace: olcTLSCACertificateFile olcTLSCACertificateFile: /etc/ssl/pki/ca.crt - replace: olcTLSCertificateFile olcTLSCertificateFile: /etc/ssl/pki/ldap.crt - replace: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/ssl/pki/server.pem ----- END /etc/ssl/pki/ldap/ldap.ldif ----- ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ssl/pki/ldap/ldap.ldif I don't see at all where the problem can comes from because it works half the time. Can anyone help me? Regards, sms

2 1

OpenLDAP Binding and MD5 Hex Authentication
by S K 15 Oct '12

15 Oct '12

Hi, I am able to bind to LDAP server using MD5 Base 64,SHA1,SHA2 encoding but not using MD5 Hex encoding. Can somebody please let me know which I get error 49 when binding using MD5 Hex encoded passwords. Thanks, SK

2 1

Re: openldap-technical Digest, Vol 59, Issue 15
by amicale.salmson＠free.fr 15 Oct '12

15 Oct '12

Hello, How can I find this informations? I didn't find any information about binding by using the command: #/usr/sbin/slapcat -n 0 -l output.ldif Command result: http://pastebin.com/4ihGjLXf # cat /etc/ldap/ldap.conf URI ldaps:/// BASE dc=sms,dc=fr TLS_CACERT /etc/ssl/pki/fr.sms.ca.crt TLS_REQCERT never cat /etc/default/slapd SLAPD_CONF= SLAPD_USER="openldap" SLAPD_GROUP="openldap" SLAPD_PIDFILE= SLAPD_SERVICES="ldaps:/// ldapi:///" SLAPD_SENTINEL_FILE=/etc/ldap/noslapd SLAPD_OPTIONS="" Does anyone have an ideai why it works half the time? Thanks, sms. ----- Mail original ----- De: "25Dollar Tech" <25dollartechhelp(a)gmail.com> À: "amicale salmson" <amicale.salmson(a)free.fr> Envoyé: Lundi 15 Octobre 2012 14:11:36 Objet: Re: openldap-technical Digest, Vol 59, Issue 15 Hello you must check in your bind details from conf or ldif file Message: 2 Date: Mon, 15 Oct 2012 12:57:56 +0200 (CEST) From: amicale.salmson(a)free.fr To: openldap-technical(a)openldap.org Subject: Open LDAP sometimes "Can't contact LDAP server" Message-ID: < 258228487.277539862.1350298676206.JavaMail.root(a)zimbra63-e11.priv.proxad.net > Content-Type: text/plain; charset=utf-8 Hello all, I developed a PHP application which use slapd. Sometimes, I have the message "Can't contact LDAP server", but sometimes it works (almost half the time) Just before it hangs, I see the following message: -------------------------------------------------- daemon: epoll: listen=8 active_threads=0 tvp=zero daemon: epoll: listen=9 active_threads=0 tvp=zero daemon: epoll: listen=10 active_threads=0 tvp=zero connection_read(20): input error=-2 id=1530, closing. connection_closing: readying conn=1530 sd=20 for close daemon: removing 20 conn=1530 fd=20 closed (connection lost) daemon: activity on 1 descriptor daemon: activity on: -------------------------------------------------- Sometimes, I also see theses messages: -------------------------------------------------- slapd[9635]: connection_close: deferring conn=1582 sd=22 connection_input: conn=1593 deferring operation: binding -------------------------------------------------- I use : - debian 6.0.5 - slapd 2.4.23-7.2 - OpenSSL 0.9.8o 01 Jun 2010 SSL certificats generated with XCA : - openssl x509 -text -in /etc/ssl/pki/ca.crt Data: Version: 3 (0x2) Signature Algorithm: sha1WithRSAEncryption Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (4096 bit) X509v3 extensions: X509v3 Basic Constraints: critical CA:TRUE X509v3 Key Usage: Certificate Sign, CRL Sign Netscape Cert Type: SSL CA, S/MIME CA, Object Signing CA Netscape Comment: xca certificate - openssl x509 -text -in /etc/ssl/pki/server.crt Data: Version: 3 (0x2) Signature Algorithm: sha1WithRSAEncryption Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (4096 bit) X509v3 extensions: X509v3 Basic Constraints: critical CA:FALSE X509v3 Key Usage: Digital Signature, Non Repudiation, Key Encipherment Netscape Cert Type: SSL Server Netscape Comment: xca certificate Certificats import: ----- BEGIN /etc/ssl/pki/ldap/ldap.ldif ----- dn: cn=config replace: olcTLSCACertificateFile olcTLSCACertificateFile: /etc/ssl/pki/ca.crt - replace: olcTLSCertificateFile olcTLSCertificateFile: /etc/ssl/pki/ldap.crt - replace: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/ssl/pki/server.pem ----- END /etc/ssl/pki/ldap/ldap.ldif ----- ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ssl/pki/ldap/ldap.ldif I don't see at all where the problem can comes from because it works half the time. Can anyone help me? Regards, sms ------------------------------ _______________________________________________ openldap-technical mailing list openldap-technical(a)openldap.org http://www.openldap.org/lists/mm/listinfo/openldap-technical End of openldap-technical Digest, Vol 59, Issue 15 ************************************************** -- Thanks & Regards, 25dollarTech Team https://sites.google.com/site/25dollartech/ Email: 25dollartechhelp(a)gmail.com

1 0

ACI module
by Brian Empson 14 Oct '12

14 Oct '12

Is it possible to load ACI support as a module? It would really help when installing from a precompiled package, all of which seem to turn off this very powerful feature. (I really like it anyway)

2 1

MDB Status
by Howard Chu 13 Oct '12

13 Oct '12

For those who haven't been following along, support for OpenLDAP's MDB (memory-mapped database) library is also available for several other open source projects, including Cyrus SASL (sasldb mech), Heimdal Kerberos (hdb module), SQLite3, OpenDKIM, and MemcacheDB. A work-in-progress patch for Postfix is also available, with a final version coming soon. A backend for SQLite4 is also in the works. A port of Android (JellyBean) for the Motorola Droid4 using MDB/SQLite3 is in progress (since my current phone is a Droid4). Other projects are also in progress and will be announced in the near future. The current list is also posted on http://highlandsun.com/hyc/mdb/ - feel free to suggest other projects. OpenLDAP MDB completely outclasses other embedded databases (like Oracle BerkeleyDB, Google LevelDB, SQLite, Kyoto Cabinet) from every angle: performance, efficiency, reliability, administrative ease, simplicity, whatever. With MDB not only have we made the world's fastest LDAP server even faster, but we can also make anything else that uses a database even better. I'll also be presenting an updated talk on MDB at LinuxCon Europe in Barcelona, November 7. http://events.linuxfoundation.org/events/linuxcon-europe/schedule -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

3 3

How indexes used with search
by Roman Rybalko 13 Oct '12

13 Oct '12

I'd like to understand how indexes are used with search. I've found some info http://www.openldap.org/doc/admin24/tuning.html#Understanding how a search works <http://www.openldap.org/doc/admin24/tuning.html#Understanding%20how%20a%20s…> but that's not very precise. Suppose there is a search like (&(attr1=value1)(attr2=value2)), attr1 and attr2 are indexed. As far as I understand, this search fetches objectIDs from the index on attr1, than the objectIDs from the index on attr2, than, according to operation "and" ("&"), objectIDs that present in BOTH sets are determined (using some set-intersection algorithm). When the search is "or" (|(...)(...)), the objectIDs from both sets are joined and duplicates are removed (using some set-union algorithm). If there is no index on attribute, the resulting objectID set is determined by bare iterate-and-compare on all the objects, or so. Am I right? Could anyone advice some docs on this? -- WBR, Roman Rybalko

3 8

Addressbook: setups and/or best practice?
by Patrick Lists 12 Oct '12

12 Oct '12

Hi all, I want to setup an Addressbook for use with Thunderbird (on Linux), Zimbra or Zarafa, Asterisk & VoIP phones. Going through Google and the list archives I did not find a lot of answers other than that it's a bit of a mess and that there is not one setup to rule them all. Does anyone have any pointers where I can read how to avoid pitfalls and setup a decent addressbook? Thanks, Patrick

1 0

Re: OpenLDAP 2.4.33 available
by Clément OUDOT 12 Oct '12

12 Oct '12

2012/10/11 OpenLDAP Project <project(a)openldap.org>: > OpenLDAP 2.4.33 is now available for download as detailed on our download page: > > http://www.openldap.org/software/download/ > For people interested in RPM, you can find some here: http://ltb-project.org/wiki/download#openldap Regards, Clément OUDOT.

1 0

reconfig question
by Mark Molenda 11 Oct '12

11 Oct '12

It's been a little while since I've worked with OpenLdap so I need to frame this as a newbie question. It appears that the slapd.conf file and a lot of configuration step by steps are now different than what was in the O'reilly book I was using. Additionally the build procedures are different as well. ( at least from what I remember ) so after a few attempts at building from source, I scrapped that and decided to try the pre-built option using Mint's Software Manager to install. Well that brought up the slapd program, and I was able to configure a test version at home using steps in this URL. http://ubuntuforums.org/showthread.php?p=8161118. I used this as the Quick Start guide on openldap.org is also out of date and refereed to the "old" way to configure everything. Well here is the rub... The steps in the url above worked great for home with some edits for dc=home,dc=local. However at work , where I really need this to work , I noticed that I missed one edit on the ldifs after I had run the ldapadd. No sweat I thought I'd just unload OpenLdap with Software Manager and reload and start from scratch. This does not work as some configuration is left around even after uninstalling OpenLdap. Can someone tell me where these files exist on Mint / Ubuntu or if this is too platform specific , what directory structures need to be removed prior to reloading to make sure everything is "new". I am assuming someone can tell me just remove "cn=config.ldif" directory etc. in /etc/ldap or something like that to get me up and running. All help is most appreciated. -Mark -- *Mark Molenda* Software Developer / IT Support | Fetch Logistics, Inc. 25 Northpointe Parkway | Suite 200 | Amherst, NY 14228 800-964-4940 x417 | mmolenda(a)fetchlogistics.com <mailto:mmolenda@fetchlogistics.com> Fax: 716-689-9676 | Direct: 716-504-4417 http://www.fetchlogistics.com

2 1

RE24 testing call #1 (OpenLDAP 2.4.33)
by Quanah Gibson-Mount 11 Oct '12

11 Oct '12

If you know how to build OpenLDAP manually, and would like to participate in testing the next set of code for the 2.4.33 release, please do so. Generally, get the code for RE24: <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> Configure & build. Execute the test suite (via make test) after it is built. Thanks! --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

Compiling OpenLDAP 2.4.33 on IBM AIX 7.X
by Tony Huang 11 Oct '12

11 Oct '12

Hi, I am fairly new to this, before I compile OpenLDAP 2.4.33 on IBM AIX 7 platform I'd like to know if there is anything I need to watch out for? I had lots of bad taste with compiling on AIX 5.X ... just wondering if anyone has had experiences in making it work on AIX 7.X Thank you in advance! Regards, --Tony

1 0

Empty Strings attributes in OpenLDAP
by Emilio García 10 Oct '12

10 Oct '12

Dear all, Is there a way to define a string to be empty in OpenLDAP Schema? I read that RFC 2252 doesnt allow empty strings. But is there any workaround for this like a different SYNTAX or attribute type? We have a preexisting software which tries to write empty strings and it is crashing because of this. Kind regards. Cloudreach Limited is a limited company registered in England with registered number 06975407 The above terms reflect a potential business arrangement, are provided solely as a basis for further discussion, and are not intended to be and do not constitute a legally binding obligation. No legally binding obligations will be created, implied, or inferred until an agreement in final form is executed in writing by all parties involved. This email may be confidential or privileged. If you received this communication by mistake, please don't forward it to anyone else, please erase all copies and attachments, and please let us know that it has gone to the wrong person.

3 4

LDAP Search Question (use of * in search filter)
by Παναγιώτης Ψαρράκος 10 Oct '12

10 Oct '12

Dear all My environment consist of a mySWL Cluster database that use ndbcluster storage engine. I have install openLDAP using back ndb in otder to expose my database in LDAP fromat. The main table of LDAP is the table OL_dn2id. Entries in this table have the following format eid | object_class | a0 | a1 | a2 | a3 | a4 | a5 ... | a15 ------------------------------------------------------------------------------------------------------------------------------------------ 1 | usertable@top | ro | mydb | msisdn=40765111111 | billtype=prepaid | null (all other columns are null) ------------------------------------------------------------------------------------------------------------------------------------------ 2 | usertable@top | ro | mydb | msisdn=40765111112 | billtype=postpaid | null (all other columns are null) My database definition in slapd.conf is the following database ndb suffix "dc=mydb,dc=ro" rootdn "cn=Manager,dc=mydb,dc=ro" I want to execute ldap search queries based on msisdn or billtype attribute. I am trying to this using the command i.e. return all postpaid user msisdns - i ma trying to use the * in the filter in order to have all msisdns ldapsearch -h localhost -LLL -x -s sub -d 32 -b bill=postpaid,msisdn=*,dc=cosmote,dc=ro The output of this command: Invalid DN syntax (34) Additional information: invalid DN Any help on this would be very usefull With Regards Panagiotis Psarrakos

4 5

Unable to perform recursive ldapdelete
by Ben Beuchler 10 Oct '12

10 Oct '12

ldapdelete -Wx -H ldapi:/// -r dc=maildomains,dc=example,dc=com Enter LDAP Password: ldap_delete: Other (e.g., implementation specific) error (80) ldap_delete: Operation not allowed on non-leaf (66) additional info: subordinate objects must be deleted first There are a couple of hundred subordinate entries under dc=maildomains,dc=example,dc=com. Am I doing something wrong or have I encountered a bug? I'm running 2.4.21 on Ubuntu 10.04.

1 0

Reasons for bi_db_open failed! (-30793) with back-mdb?
by Michael Ströder 09 Oct '12

09 Oct '12

HI! What are the possible reasons for this message? 5070a03c backend_startup_one (type=mdb, suffix="cn=accesslog,o=example"): bi_db_open failed! (-30793) I'm testing migrating an existing LDAP server with four DBs - two of them accesslog DBs - to back-mdb with RE24 c62a82b07e1bcc4c795cb5185ee9f16406b05bd9. Either slapadd fails or starting slapd fails after slapadd. Ciao, Michael.

3 3

slaptest fails to covnert overlay syncproc?
by Tim Tyler 09 Oct '12

09 Oct '12

Openldap experts? I am trying to convert a slapd.conf file to cn=config version on Redhat 6.3 running openldap 2.4.23-26. when I do the following to convert the slapd.conf file to the cn=config version, I get the following error: [root@ldap openldap]# slaptest -f slapd.conf -F slapd.d overlay "syncprov" not found slaptest: bad configuration directory! I am not loading any modules in slapd.conf as the old Centos 5 version did not require that I load any syncprov modules for syncprov to work. I think I read that it was statically included it in the binary. It always worked without the module call anyways. Do I now need to add in a line for the syncprov module in the slapd.conf file in order to get slaptest to view and convert the overlay of syncprov with the redhat 6 version of openldap? Note: Here are the following lines for synprov in my slapd.conf file: overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 limits dn.exact="cn=xxxx,dc=site,dc=edu" size=unlimited time=unlimited Or is there some other issue I might be missing? Tim Tyler Network Engineer Beloit College

3 2

how to tell client to use ssf=256 instead of ssf=128
by Tobias Hachmer 08 Oct '12

08 Oct '12

Hello, I'm using openldap 2.4.28 on ubuntu server and configured TLS. I want to allow write operations only when ssf=256 is used. (security update_ssf=256) Certificates were set up with openssl CA.pl. When I connect via # ldapadd -Y EXTERNAL -ZZ -f /src/test.ldif I get this: SASL/EXTERNAL authentication started SASL username: cn=ldapadmin,............. SASL SSF: 0 adding new entry "dc=example,dc=com" ldap_add: Confidentiality required (13) additional info: stronger confidentiality required for update the log says: Oct 8 19:38:14 ldap slapd[2205]: conn=1003 fd=13 ACCEPT from IP=127.0.0.1:56698 (IP=0.0.0.0:389) Oct 8 19:38:14 ldap slapd[2205]: conn=1003 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Oct 8 19:38:14 ldap slapd[2205]: conn=1003 op=0 STARTTLS Oct 8 19:38:14 ldap slapd[2205]: conn=1003 op=0 RESULT oid= err=0 text= Oct 8 19:38:14 ldap slapd[2205]: conn=1003 fd=13 TLS established tls_ssf=128 ssf=128 Oct 8 19:38:14 ldap slapd[2205]: conn=1003 op=1 BIND dn="" method=163 Oct 8 19:38:14 ldap slapd[2205]: conn=1003 op=1 BIND authcid="cn=ldapadmin,........." authzid="cn=ldapadmin,........" Oct 8 19:38:14 ldap slapd[2205]: conn=1003 op=1 BIND dn="cn=ldapadmin,......." mech=EXTERNAL sasl_ssf=0 ssf=128 Oct 8 19:38:14 ldap slapd[2205]: conn=1003 op=1 RESULT tag=97 err=0 text= Oct 8 19:38:14 ldap slapd[2205]: connection_input: conn=1003 deferring operation: binding Oct 8 19:38:14 ldap slapd[2205]: conn=1003 op=2 ADD dn="dc=example,dc=com" Oct 8 19:38:14 ldap slapd[2205]: conn=1003 op=2 RESULT tag=105 err=13 text=stronger confidentiality required for update Oct 8 19:38:14 ldap slapd[2205]: conn=1003 op=3 UNBIND Oct 8 19:38:14 ldap slapd[2205]: conn=1003 fd=13 closed 1. Why is the client connecting with ssf=128? 2. Can I influence the ssf used by client, if yes, how? 3. Maybe a certificate issue? Thanks in advance, Tobias Hachmer

4 4

Complete re-sync in MirrorMode
by Santosh Kumar Gupta 07 Oct '12

07 Oct '12

Dear List, I set up two openldap servers in MirrorMode replication. I addeed a user in Master2 and it synced in Master1 but without userPassword. Digging into the problem I found a typo error in olcAccess for replicator user. I fixed the error and any new updates in Master2 get updated in Master1 including userPassword, but not syncing the previously replicated users. I tried running slapd with parameter -c "rid=000" but without success. Please help me to full sync Master1 without recreating db. TIA Santosh

4 3

Openldap Synchronization Issue
by Victor Silva 06 Oct '12

06 Oct '12

Hello folks, I have an ldap base running in 2 machines in a master/slave design. I've tried to do a db2ldiff but as I'm using virtual machines it took a very long time and I aborted the process with crtl C. Since them my bases no longer sync. I have the following erros logs: *[05/Oct/2012:17:44:22 -0300] - 389-Directory/1.2.9.9 B2011.244.2040 starting up [05/Oct/2012:17:44:22 -0300] - from ldbm instance init: line 0: unknown or invalid matching rule "integerOrderingMatch" in index configuration (ignored) [05/Oct/2012:17:44:22 -0300] - from DSE add: line 0: unknown or invalid matching rule "integerOrderingMatch" in index configuration (ignored) [05/Oct/2012:17:44:22 -0300] - from ldbm instance init: line 0: unknown or invalid matching rule "integerOrderingMatch" in index configuration (ignored) [05/Oct/2012:17:44:22 -0300] - from DSE add: line 0: unknown or invalid matching rule "integerOrderingMatch" in index configuration (ignored) *I've read in some other mailing lists many people had this problem but I could not pint point an appropriate solution. I don't know which other logs I can post in order to help you but I will be happy to provide them if you require more info. Regards, vfbsilva

2 1

pwdReset: TRUE not working
by Jason Cwik 05 Oct '12

05 Oct '12

Hi, I've recently configured a new openldap 2.4.32 server with the ppolicy overlay. Most of the features like lockout and minLength work fine, but I can't seem to force the user's password to expire. I've even set pwdReset: TRUE on the user's record to try and force them to reset the password, but it doesn't seem to do anything. Here's my overlay config: MBP2:~ me$ ldapsearch -h 10.242.25.158 -D "cn=root,cn=config" -x -W -b "cn=config" -s sub "olcOverlay=ppolicy" Enter LDAP Password: # extended LDIF # # LDAPv3 # base <cn=config> with scope subtree # filter: olcOverlay=ppolicy # requesting: ALL # # {1}ppolicy, {1}bdb, config dn: olcOverlay={1}ppolicy,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcOverlay: {1}ppolicy olcPPolicyDefault: cn=default,ou=policies,dc=my,dc=domain,dc=com # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 And the default pwdPolicy object: MBP2:~ me$ ldapsearch -h 10.242.25.158 -D "cn=ldapadmin,dc=my,dc=domain,dc=com" -x -W -b "ou=policies,dc=my,dc=domain,dc=com" -s sub "cn=default" Enter LDAP Password: # extended LDIF # # LDAPv3 # base <ou=policies,dc=my,dc=domain,dc=com> with scope subtree # filter: cn=default # requesting: ALL # # default, policies, my.domain.com dn: cn=default,ou=policies,dc=my,dc=domain,dc=com objectClass: person objectClass: top objectClass: pwdPolicy cn: default pwdAllowUserChange: TRUE pwdAttribute: 2.5.4.35 pwdCheckQuality: 2 pwdExpireWarning: 0 pwdFailureCountInterval: 30 pwdInHistory: 5 pwdLockout: TRUE pwdLockoutDuration: 300 pwdMaxAge: 11555200 pwdMaxFailure: 5 pwdMinAge: 0 pwdMinLength: 5 pwdMustChange: TRUE pwdSafeModify: TRUE sn: dummy value I turned on trace debugging and I do see it successfully loading cn=default,ou=policies,dc=my,dc=domain,dc=com during the bind operation, so it appears that ppolicy is running fine and loading the policy object. Any ideas?

4 3

Can not build OpenLDAP with OpenSSL in custom location
by jckidder＠aep.com 05 Oct '12

05 Oct '12

Ok, this is driving me nuts!!!! I can't build OpenLDAP with TLS support. configure fails with a TLS/SSL error. If I disable TLS everything works just fine. Everthing I can find on the net is telling me I'm doing this right but it's not working. I have OpenSSL 0.9.8x built and installed to a custom directory: /appl/openssl I have the following environment variables set: LD_LIBRARY_PATH=/appl/BerkeleyDB/lib:/appl/openssl/lib:/appl/cyrus_sasl/lib:/appl/unixODBC/lib:/appl/openldap/lib:$LD_LIBRARY_PATH CPPFLAGS="-I/appl/BerkeleyDB/include -I/appl/openssl/include/openssl -I/appl/cyrus_sasl/include -I/appl/unixODBC/include -I/appl/openldap/include -I/usr/include -DF00=42" LDFLAGS="-L/appl/BerkeleyDB/lib -L/appl/openssl/lib -L/appl/cyrus_sasl/lib -L/appl/unixODBC/lib -L/appl/openldap/lib -L/usr/lib " I run the following configure command: ./configure --prefix=/appl/openldap --enable-bdb --enable-ldap --enable-sql --enable-overlays --enable-spasswd --with-tls=openssl And I get the following output: checking openssl/ssl.h usability... yes checking openssl/ssl.h presence... yes checking for openssl/ssl.h... yes checking for SSL_library_init in -lssl... no checking for ssl3_accept in -lssl... no configure: error: Could not locate TLS/SSL package What am I missing?? -Jon C. Kidder American Electric Power Middleware Services 614-716-4970

2 2

What does acl-bind exactly
by General Stone 05 Oct '12

05 Oct '12

Hello, what does acl-bind exactly in ldap backend (slapd-ldap)? I don't understand the explenataion in available documentations. The manpage says "... that is internally used by the proxy to collect info related to access control ...", but which informations are needed from the remote server? Further the manpage says "The identity (...) is supposed to have read access on the target server to attributes used on the proxy for ACL checking ...", but which attributes are mean? Kind regards, Markus Martinet -- Key fingerprint = A0D9 F306 0FC0 30E7 62DB E785 A192 2A30 5CF1 224D ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Die Theorie ist immer nur so gut wie ihre Praxis. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Filter a ldap connection for a user comming from an IP source
by Mik J 05 Oct '12

05 Oct '12

Hello, I have this ACL that allows the users myadmin to list encrypted passwords access to attrs=userpassword,shadowMax,shadowExpire,sambaLMPassword,sambaNTPassword,sambaPwdLastSet by dn="uid=myadmin,ou=people,dc=mydomain,dc=org" read However this user my admin is supposed to come from one IP 1.1.1.1 only. I think that the peername directive might help to achive this task but I don't know how to associate it with the user myadmin. In conclusion I would like that the user myadmin coming from IP 1.1.1.1 be able to see the encrypted passwords. If the user myadmin comes from another IP like 2.2.2.2 he would not match the ACL and therefore not be able to see encrypted passwords. Does anyone know what is the syntax ?

2 2

LDAP Stopped Authenticating Samba Shares
by Steve Olszewski 04 Oct '12

04 Oct '12

Hi All-- I'm a fairly new Systems Administrator at my company, and have inherited a mostly undocumented infrastructure, including LDAP and Samba. We had been using LDAP for authentication, allowing access to the Samba shares based on group membership. Recently, users were unable to mount shares, as authentication had broken somehow. A couple of things stand out: 1) Using phpldapadmin, if I compare the sambalmpasswd or the sambantpasswd on any account to the password that *should* be in place, I get a "passwords do not match" error. The standard user password checks out OK, however. I'm not sure why this is happening. 2) Samba will not start. It dies with a "smbd[2902]: ERROR: failed to setup guest info." error. As far as I can tell, this happens when Samba starts and tries to find the "nobody" user, both locally and on the remote LDAP server. The nobody user exists in both places, and I can run 'getent passwd' and 'getent group' and see both local and LDAP users/groups. I am having a terrible time troubleshooting this, and wonder if someone might have an idea about what's going on, or point me in the right direction. Best, Steve Olszewski

1 0

Re: Access denied consumer replication (OpenLDAP+Kerberos)
by Daniel Lopes de Carvalho 04 Oct '12

04 Oct '12

Hi Quanah. Thanks for your reply! I was following this link to configure the provider/consumer: http://www.rjsystems.nl/en/2100-d6-kerberos-openldap-consumer.php. Under item "2. Kerberos client install", at the end, I was guided to create a principal starting with ldap/dns02... But... I created 3 principals: host/dns02... ldap/dns02.. and ldaps/dns02... And under item "8. Provider modifications" I was instruted to map uid=ldap/... to ou=consumers # 1.2.1. add: olcAuthzRegexp olcAuthzRegexp: uid=ldap/([^/\.]+).example.com,cn=example.com,cn=gssapi,cn=auth cn=$1,ou=consumers,dc=example,dc=com I deleted the principals host/dns02... and ldaps/dns02... and the replication started to work. Thanks very mch! Daniel -- Daniel Lopes de Carvalho dlcarvalho(a)gmail.com daniellopescarvalho (skype) 19 9357-5618 (claro) 19 8251-6023 (tim) On Thu, Oct 4, 2012 at 2:57 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, October 04, 2012 1:50 PM -0300 Daniel Lopes de Carvalho > <dlcarvalho(a)gmail.com> wrote: > >> Hi >> >> I try to configure two openldap/kerberos server (provider and >> consumer), but I'm having some issues about replication. Under LDAP >> log, I have many entries like this: "slap_access_allowed: search >> access denied by none(=0)" >> >> These messages are related to consumer access to the Kerberos database >> on provider and the kerberos database can't be replicated to the >> consumer. The others data are replicated normaly. >> >> These are the ACL under privider: >> olcAccess: {0}to attrs=userPassword,shadowLastChange >> by >> dn.one="ou=consumers,ou=ldap,ou=Services,dc=unisim,dc=cepetro,dc=unicamp, >> dc=br" read >> by anonymous auth by * none >> >> olcAccess: {1}to >> dn.subtree="ou=kerberos,ou=Services,dc=unisim,dc=cepetro,dc=unicamp,dc=br" >> by >> dn="cn=krbadm,ou=kerberos,ou=Services,dc=unisim,dc=cepetro,dc=unicamp,dc= >> br" write >> by >> dn="cn=krbkdc,ou=kerberos,ou=Services,dc=unisim,dc=cepetro,dc=unicamp,dc= >> br" read >> by >> dn.one="ou=consumers,ou=ldap,ou=Services,dc=unisim,dc=cepetro,dc=unicamp, >> dc=br" read by * none >> >> olcAccess: {2}to attrs=loginShell >> by self write >> by users read >> by * none >> >> olcAccess: {3}to dn.base="" >> by * read >> >> olcAccess: {4}to * >> by users read >> by * none > > > This is the entity asking permission: > > > Oct 4 12:00:29 dns01 slapd[1163]: => acl_mask: to all values by > "uid=host/dns02.unisim.cepetro.unicamp.br,ou=users,dc=unisim,dc=cepetro,dc=unicamp,dc=br", > (=0) > > This does not match > > by > dn.one="ou=consumers,ou=ldap,ou=Services,dc=unisim,dc=cepetro,dc=unicamp,dc=br" > > It looks like you put the host entry in the users tree and not the consumer > tree. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration

1 0

Problem converting slapd.conf to cn=config format
by Patrick Lists 04 Oct '12

04 Oct '12

Hi all, New to the list and (Open)LDAP so apologies if I'm missing the obvious. I've gone through the Admin Guide and some other docs I found online but I still have problems converting a slapd.conf to the cn=config format on a CentOS 6.3 x86_64 box with openldap-2.4.23-26.el6_3.2 $ cat ~/slapd.conf.new # general parameters include /etc/openldap/schema/corba.schema include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/duaconf.schema include /etc/openldap/schema/dyngroup.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/java.schema include /etc/openldap/schema/misc.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/ppolicy.schema include /etc/openldap/schema/collective.schema allow bind_v2 loglevel 296 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args password-hash {SSHA} modulepath /usr/lib64/openldap TLSCipherSuite HIGH TLSCACertificatePath /etc/openldap/certs TLSCertificateFile "\"OpenLDAP Server\"" TLSCertificateKeyFile /etc/openldap/certs/password lastmod on # databases database config rootdn "cn=admin,cn=config" rootpw {SSHA}LDeTJEEBhqypKL2FpQuFc2j4Na1TLTRW access to * by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * none # enable server status monitoring (cn=monitor) database monitor access to * by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.exact="cn=admin,dc=example,dc=com" read by * none database hdb suffix "dc=example,dc=com" rootdn "cn=admin,dc=example,dc=com" rootpw {SSHA}LDeTJEEBhqypKL2FpQuFc2j4Na1TLTRW mode 600 checkpoint 512 30 cachesize 2097152 index uid pres,eq index cn,sn,mail pres,eq,approx,sub index objectClass eq directory /var/lib/ldap Steps I did: # service slapd stop # rm -rf /var/lib/ldap/* # rm -rf /etc/openldap/slapd.d/* # cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG # echo "" | slapadd -v -d 448 -f ./slapd.conf.new # slaptest -v -d 448 -f ./slapd.conf.new -F /etc/openldap/slapd.d The last step just hangs and does not do anything even after waiting 45 minutes. Anyone know what I'm doing wrong? Pointers most appreciated. Thanks! Patrick

5 9

Access denied consumer replication (OpenLDAP+Kerberos)
by Daniel Lopes de Carvalho 04 Oct '12

04 Oct '12

Hi I try to configure two openldap/kerberos server (provider and consumer), but I'm having some issues about replication. Under LDAP log, I have many entries like this: "slap_access_allowed: search access denied by none(=0)" These messages are related to consumer access to the Kerberos database on provider and the kerberos database can't be replicated to the consumer. The others data are replicated normaly. These are the ACL under privider: olcAccess: {0}to attrs=userPassword,shadowLastChange by dn.one="ou=consumers,ou=ldap,ou=Services,dc=unisim,dc=cepetro,dc=unicamp,dc=br" read by anonymous auth by * none olcAccess: {1}to dn.subtree="ou=kerberos,ou=Services,dc=unisim,dc=cepetro,dc=unicamp,dc=br" by dn="cn=krbadm,ou=kerberos,ou=Services,dc=unisim,dc=cepetro,dc=unicamp,dc=br" write by dn="cn=krbkdc,ou=kerberos,ou=Services,dc=unisim,dc=cepetro,dc=unicamp,dc=br" read by dn.one="ou=consumers,ou=ldap,ou=Services,dc=unisim,dc=cepetro,dc=unicamp,dc=br" read by * none olcAccess: {2}to attrs=loginShell by self write by users read by * none olcAccess: {3}to dn.base="" by * read olcAccess: {4}to * by users read by * none And bellow the ldap log snnipet: => access_allowed: search access to "cn=krbkdc,ou=kerberos,ou=Services,dc=unisim,dc=cepetro,dc=unicamp,dc=br" "objectClass" requested Oct 4 12:00:29 dns01 slapd[1163]: => dn: [2] ou=kerberos,ou=services,dc=unisim,dc=cepetro,dc=unicamp,dc=br Oct 4 12:00:29 dns01 slapd[1163]: => acl_get: [2] matched Oct 4 12:00:29 dns01 slapd[1163]: => acl_get: [2] attr objectClass Oct 4 12:00:29 dns01 slapd[1163]: => acl_mask: access to entry "cn=krbkdc,ou=kerberos,ou=Services,dc=unisim,dc=cepetro,dc=unicamp,dc=br", attr "objectClass" requested Oct 4 12:00:29 dns01 slapd[1163]: => acl_mask: to all values by "uid=host/dns02.unisim.cepetro.unicamp.br,ou=users,dc=unisim,dc=cepetro,dc=unicamp,dc=br", (=0) Oct 4 12:00:29 dns01 slapd[1163]: <= check a_dn_pat: cn=krbadm,ou=kerberos,ou=services,dc=unisim,dc=cepetro,dc=unicamp,dc=br Oct 4 12:00:29 dns01 slapd[1163]: <= check a_dn_pat: cn=krbkdc,ou=kerberos,ou=services,dc=unisim,dc=cepetro,dc=unicamp,dc=br Oct 4 12:00:29 dns01 slapd[1163]: <= check a_dn_pat: ou=consumers,ou=ldap,ou=services,dc=unisim,dc=cepetro,dc=unicamp,dc=br Oct 4 12:00:29 dns01 slapd[1163]: <= check a_dn_pat: * Oct 4 12:00:29 dns01 slapd[1163]: <= acl_mask: [4] applying none(=0) (stop) Oct 4 12:00:29 dns01 slapd[1163]: <= acl_mask: [4] mask: none(=0) Oct 4 12:00:29 dns01 slapd[1163]: => slap_access_allowed: search access denied by none(=0) Oct 4 12:00:29 dns01 slapd[1163]: => access_allowed: no more rules Can anyone help me? Regards Daniel

2 1

Re: RE24 testing call #1 (OpenLDAP 2.4.33)
by devzero2000 03 Oct '12

03 Oct '12

No problem in helping in doing this, but i have just a curiosity. Really a project as openldap doesn't have an automated buildboot environment running on a checked out vcs these days with 6/7 buildslave (or more) ? Best 2012/10/3, Quanah Gibson-Mount <quanah(a)zimbra.com>: > If you know how to build OpenLDAP manually, and would like to participate > in testing the next set of code for the 2.4.33 release, please do so. > > Generally, get the code for RE24: > > <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> > > Configure & build. > > Execute the test suite (via make test) after it is built. > > Thanks! > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > > -- Inviato dal mio dispositivo mobile

3 2

OpenLDAP and Indexing (when to use Slapindex)
by Emilio García 03 Oct '12

03 Oct '12

Hi there, I know that after setting up a new index in slapd.conf all new entries I add will be indexed (and you need to run slapindex for the old ones if you have), *but will they still be indexed if the entry is modified? (An attribute is updated for example).* I assume it will, isn't it? So can anyone confirm if I need to run slapdindex just when I make a change in slapd.conf? Kind regards. -- Cloudreach Limited is a limited company registered in England with registered number 06975407 The above terms reflect a potential business arrangement, are provided solely as a basis for further discussion, and are not intended to be and do not constitute a legally binding obligation. No legally binding obligations will be created, implied, or inferred until an agreement in final form is executed in writing by all parties involved. This email may be confidential or privileged. If you received this communication by mistake, please don't forward it to anyone else, please erase all copies and attachments, and please let us know that it has gone to the wrong person.

2 1

Proper manual for proxy-cache configuring via cn=config
by Tio Teath 03 Oct '12

03 Oct '12

Looks like '12.9.2.5. Example for slapd-config' section of 'Administrator's Guide' contains non-valid information. First, it is impossible to initialize hdb database with no olcSuffix attribute. Second, olcPcache attribute of oclOverlay object contains 'dbd' entry, which, I suppose, instructs slapd for using dbd back-end, while in the section below database with hdb back-end are configured. Anyway, I haven't managed to configure proxy-cache with any type of back-ends, so I have question: is any working example exist for configuring the proxy-cache via cn=config? Any of configuration, I've managed to google in the openldap's mailists, won't work for slapd 2.4.25.

1 0

ldap filter question
by Mik J 02 Oct '12

02 Oct '12

Hello, I have made some tests with the filter option and had this rule that working access to dn.subtree="dc=mycompany,dc=org" filter=(!(|(o=Company2)(o=Company3))) by dn="uid=user1,ou=people,dc=mycompany,dc=org" read by * break Users from Company 1 and 4 are displayed But this rule is not exactly what I need. I wrote a negative condition and I would like this condition to be positive. I tried this rule: access to dn.subtree="dc=mycompany,dc=org" filter=(|(o=Company1)(o=Company4)) by dn="uid=user1,ou=people,dc=mycompany,dc=org" read by * break The ldap search query returns no entry whereas I expected it to return the list of users Companies 1 and 4 # ldapsearch -x -W -D uid=user1,ou=people,dc=mycompany,dc=org -b "ou=people,dc=mycompany,dc=org" Does someone have an idea about what's wrong with my rule ?

1 0

ldapsearch with -y option
by Angel L. Mateo 02 Oct '12

02 Oct '12

Hello, Maybe it's a silly question, but I'm going crazy and I don't found the solution. I want to use the -y option in a ldapsearch command, so I have write my password in a file (plain text file with the password in plain text), then I run the ldapsearch -y <mypasswordfile> <other options> and I get an invalid credential error. I have checked several times that the password is correct. I have debuged the request with wireshark and I have checked that the only difference in the bind request is that -y option is adding a final 0x0a char to the password. Any idea? PS: if this could help, I'm using ubuntu 12.04 and I have created the password file with vi (I have also tried creating it with gedit and with echo "..." > <file>)

3 2

recompile openldap with SSL support
by Darouichi, Aziz 01 Oct '12

01 Oct '12

Hi, We have a direct tunnel connection to a vendor who uses our local LDAP, when I complied Openldap I did not enable SSL. Is possible to re-compile it again with SSL enabled even if it's in production. We are moving to moving one of our in house applications to a hosted/managed but still need to authenticate with local LDAP. Vendor is asking for Secure LDAP connection. Thanks for the help.

3 2

Openldap overloading
by Nick Milas 01 Oct '12

01 Oct '12

Hi, I am running a v2.4.31 consumer on CentOS 5.8 to serve user accounts (and aliases) on a Postfix mail server running locally. It has been running for a long time without problems. Today, after a user sent (on 14:53:39) a mass mail (through a group alias, implemented using ldap dynlist), Postfix stalled and the server (a VM under KVM) became overloaded. I noticed that openldap was using all the cpu: # top top - 15:30:01 up 81 days, 2:11, 1 user, load average: 113.58, 114.36, 104.02 Tasks: 460 total, 3 running, 457 sleeping, 0 stopped, 0 zombie Cpu(s): 98.9%us, 0.0%sy, 0.0%ni, 0.0%id, 0.0%wa, 1.1%hi, 0.0%si, 0.0%st Mem: 3089988k total, 3074912k used, 15076k free, 12180k buffers Swap: 2064376k total, 92k used, 2064284k free, 1909976k cached PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 2209 ldap 18 0 577m 17m 8952 S 93.4 0.6 55:03.67 slapd ... I had to stop and restart openldap manually, and after that I only found in the log (nothing has been logged earlier): Sep 28 15:00:07 mail slapd[2209]: connection_input: conn=14847 deferring operation: too many executing Sep 28 15:00:38 mail slapd[2209]: connection_input: conn=19285 deferring operation: too many executing Sep 28 15:32:46 mail slapd[2209]: connection_input: conn=19419 deferring operation: binding Sep 28 15:32:47 mail slapd[2209]: connection_input: conn=19419 deferring operation: binding Sep 28 15:32:57 mail slapd[4484]: [INFO] Using /etc/default/slapd for configuration Sep 28 15:32:57 mail slapd[4489]: [INFO] Halting OpenLDAP... Sep 28 15:32:57 mail slapd[2209]: daemon: shutdown requested and initiated. Sep 28 15:32:57 mail slapd[2209]: slapd shutdown: waiting for 1 operations/tasks to finish Sep 28 15:33:03 mail slapd[2209]: slapd stopped. Sep 28 15:33:05 mail slapd[4510]: [OK] OpenLDAP stopped after 7 seconds Sep 28 15:33:05 mail slapd[4511]: [INFO] No data backup done Sep 28 15:33:12 mail slapd[4529]: [INFO] Using /etc/default/slapd for configuration Sep 28 15:33:12 mail slapd[4534]: [INFO] Launching OpenLDAP configuration test... Sep 28 15:33:16 mail slapd[4568]: [OK] OpenLDAP configuration test successful Sep 28 15:33:16 mail slapd[4578]: [INFO] No db_recover done Sep 28 15:33:16 mail slapd[4579]: [INFO] Launching OpenLDAP... Sep 28 15:33:16 mail slapd[4580]: [OK] File descriptor limit set to 1024 Sep 28 15:33:17 mail slapd[4581]: @(#) $OpenLDAP: slapd 2.4.31 (Apr 26 2012 19:53:11) $ clement@localhost.localdomain:/home/clement/build/BUILD/openldap-2.4.31/servers/slapd ... Possibly, a number of parallel group alias uses, caused a large number of LDAP queries by Postfix. Can you please advise on what may have caused OpenLDAP overloading, and on how can we avoid it from happening again? Any config changes? My config follows. Thanks in advance for your time and assistance. Regards, Nick # cat /usr/local/openldap/var/openldap-data/DB_CONFIG #==================================================================== # BDB configuration # # Provided by LTB-project (http://www.ltb-project.org) #==================================================================== #==================================================================== # Cache size for DB files #==================================================================== set_cachesize 1 0 1 #==================================================================== # Flags #==================================================================== #set_flags DB_TXN_WRITE_NOSYNC #set_flags DB_TXN_NOSYNC set_flags DB_LOG_AUTOREMOVE #==================================================================== # Logs #==================================================================== # Size set_lg_regionmax 1048576 set_lg_max 10485760 set_lg_bsize 2097152 # Directory set_lg_dir /usr/local/berkeleydb/openldap-logs ************************************************************************ # cat /usr/local/openldap/etc/openldap/slapd.conf # include /usr/local/openldap/etc/openldap/schema/core.schema include /usr/local/openldap/etc/openldap/schema/cosine.schema include /usr/local/openldap/etc/openldap/schema/inetorgperson.schema include /usr/local/openldap/etc/openldap/schema/nis.schema include /usr/local/openldap/etc/openldap/schema/eduperson.schema include /usr/local/openldap/etc/openldap/schema/postfix.schema include /usr/local/openldap/etc/openldap/schema/dyngroup.schema include /usr/local/openldap/etc/openldap/schema/misc.schema include /usr/local/openldap/etc/openldap/schema/ppolicy.schema include /usr/local/openldap/etc/openldap/schema/schac-20090326-1.4.0.schema include /usr/local/openldap/etc/openldap/schema/dnsdomain2.schema include /usr/local/openldap/etc/openldap/schema/proftpd-quota.schema include /usr/local/openldap/etc/openldap/schema/kerberos.schema include /usr/local/openldap/etc/openldap/schema/localemail.schema include /usr/local/openldap/etc/openldap/schema/entryaccess.schema pidfile /usr/local/openldap/var/run/slapd.pid argsfile /usr/local/openldap/var/run/slapd.args modulepath /usr/local/openldap/lib64 loglevel sync sizelimit unlimited timelimit unlimited TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCACertificateFile /usr/local/openldap/etc/openldap/cacerts/chain.pem TLSCertificateFile /usr/local/openldap/etc/openldap/cacerts/cert.pem TLSCertificateKeyFile /usr/local/openldap/etc/openldap/cacerts/key.pem TLSVerifyClient never ####################################################################### # ldbm and/or bdb database definitions ####################################################################### database hdb suffix "dc=example,dc=com" rootdn "cn=Manager,dc=example,dc=com" rootpw secret ######## # ACLs # ######## include /usr/local/openldap/etc/openldap/acl.conf directory /usr/local/openldap/var/openldap-data index objectClass eq,pres index employeeType pres,eq index cn eq,pres,sub index sn,givenname eq,pres,sub index mail eq,pres,sub index uid eq,pres index ou eq,pres index mailacceptinggeneralid eq,pres index owner eq index entryCSN,entryUUID eq index vacationActive eq index associatedDomain pres,eq,sub index dc eq index emailLocalAddress eq,pres,sub overlay dynlist dynlist-attrset nisMailAlias labeledURI dynlist-attrset groupOfURLs labeledURI member syncrepl rid=111 provider=ldaps://ldap.example.com tls_reqcert=never type=refreshAndPersist retry="60 15 180 +" searchbase="dc=example,dc=com" schemachecking=off bindmethod=simple binddn="uid=FullReplAcc1,ou=System,dc=example,dc=com" credentials="mypassword" database monitor access to * by dn.exact="cn=Manager,dc=example,dc=com" read by * none ********************************************************************* # ls -la /usr/local/openldap/var/openldap-data/ total 14120 drwxr-xr-x 2 ldap ldap 4096 Sep 28 15:33 . drwxr-xr-x 4 ldap ldap 4096 Apr 26 20:56 .. -rw-r--r-- 1 ldap ldap 4096 Sep 28 15:33 alock -rw------- 1 ldap ldap 1261568 Sep 28 15:32 associatedDomain.bdb -rw------- 1 ldap ldap 512000 Sep 28 15:32 cn.bdb -rw------- 1 ldap ldap 24576 Sep 28 15:33 __db.001 -rw------- 1 ldap ldap 1294336 Sep 28 16:12 __db.002 -rw------- 1 ldap ldap 32776192 Sep 28 16:12 __db.003 -rw------- 1 ldap ldap 3145728 Sep 28 16:11 __db.004 -rw------- 1 ldap ldap 729088 Sep 28 16:12 __db.005 -rw------- 1 ldap ldap 32768 Sep 28 16:11 __db.006 -rw-r--r-- 1 ldap ldap 924 Apr 26 21:01 DB_CONFIG -rw------- 1 ldap ldap 845 Apr 26 20:56 DB_CONFIG.example -rw------- 1 ldap ldap 61440 Sep 28 15:32 dc.bdb -rw------- 1 ldap ldap 339968 Sep 28 15:33 dn2id.bdb -rw------- 1 ldap ldap 212992 Sep 28 15:33 emailLocalAddress.bdb -rw------- 1 ldap ldap 20480 Sep 28 15:33 employeeType.bdb -rw------- 1 ldap ldap 118784 Sep 28 15:33 entryCSN.bdb -rw------- 1 ldap ldap 81920 Sep 28 15:33 entryUUID.bdb -rw------- 1 ldap ldap 90112 Sep 28 15:32 givenName.bdb -rw------- 1 ldap ldap 2457600 Sep 28 15:33 id2entry.bdb -rw------- 1 ldap ldap 24576 Jul 9 13:13 mailacceptinggeneralid.bdb -rw------- 1 ldap ldap 212992 Sep 28 15:33 mail.bdb -rw------- 1 ldap ldap 266240 Sep 28 15:33 objectClass.bdb -rw------- 1 ldap ldap 40960 Sep 28 15:33 ou.bdb -rw------- 1 ldap ldap 8192 Sep 28 15:32 owner.bdb -rw------- 1 ldap ldap 253952 Sep 28 15:32 sn.bdb -rw------- 1 ldap ldap 28672 Sep 28 15:33 uid.bdb -rw------- 1 ldap ldap 8192 Sep 25 2011 vacationActive.bdb ***************************************************************************

5 11

ldap_add_ext transactions
by Sajid 01 Oct '12

01 Oct '12

hi, i'm trying to do an ldap_add operation using openldap client lib against ActiveDirectory on MAC I want to be able to roll back this add operation so I'm using transactions like this int rc = ldap_add_ext_s(ld, [userDN cStringUsingEncoding: NSUTF8StringEncoding], mods, hcdTC_new, NULL ); hcdTransactionId.ldctl_value.bv_val = (hcdTC_new[0])->ldctl_value.bv_val ; hcdTransactionId.ldctl_value.bv_len = (hcdTC_new[0])->ldctl_value.bv_len ; when I try to rollback rc = ldap_add_ext_s(ld, [userDN cStringUsingEncoding: NSUTF8StringEncoding], mods, hcdTC_rollback, NULL );; it says user already exists which means it created the user without my having to commit the transaction, how can I rollback and ldap add operation here are the definitions of variables static LDAPControl hcdTransactionControl_new = { "1.3.18.0.2.10.3", /* -- hcdTransactionControl -- */ { 3, "\x4E\x45\x57\x00" }, /* -- NEW ------------- */ '\0' /* -- critical --------------- */ } ; static LDAPControl *hcdTC_new[2] = { &hcdTransactionControl_new, NULL }; static LDAPControl hcdTransactionId = { "1.3.18.0.2.10.4", /* -- hcdTransactionId ------ */ { 1, "\x31\x00" }, /* -- TXN Id ---------------- */ '\0' /* -- critical -------------- */ }; static LDAPControl *hcdTC_Id[2] = { &hcdTransactionId, NULL }; static LDAPControl hcdTransactionControl_commit = { "1.3.18.0.2.10.3", /* -- hcdTransactionControl -- */ { 6, "\x43\x4F\x4D\x4D\x49\x54\x00" },/* - COMMIT -- */ '\0' /* -- critical --------------- */ }; static LDAPControl *hcdTC_commit[3] = { &hcdTransactionControl_commit, & hcdTransactionId, NULL }; static LDAPControl hcdTransaction_rollback = { "1.3.18.0.2.10.3", /* -- hcdTransactionControl -- */ { 8, "\x52\x4F\x4C\x4C\x42\x41\x43\x4B\x00" }, /*ROLLBACK*/ '\0' /* -- critical --------------- */ }; static LDAPControl *hcdTC_rollback[3] = { &hcdTransaction_rollback, & hcdTransactionId, NULL };

1 0

Re: slapd ACLs - [SOLVED]
by Mik J 01 Oct '12

01 Oct '12

Olivier, Thank you for your suggestion, it really helped. The problem is now solved. My configuration looks like this now defaultsearchbase dc=mydomain,dc=org sortvals member memberUid roleOccupant access to attrs=userpassword,shadowMax,shadowExpire,sambaLMPassword,sambaNTPassword,sambaPwdLastSet by dn.regex="uid=myadmin,ou=people,dc=mydomain,dc=org" write by self write by anonymous auth by * none access to * by dn.regex="uid=admin,ou=people,dc=mydomain,dc=org" =wrscx by self write by users read by anonymous auth by * none I have made some tests and so far it seems good. Myadmin is able to see everyone's password, a user can see his passwords but not other's people. Non authenticated users cannot do anything. I have noticed that I cannot add a comment line in the middle of an ACL and slapd won't start access to * by dn.regex="uid=admin,ou=people,dc=mydomain,dc=org" =wrscx # by self write by users read But my version 2.4.26 is not the latest so this feature my have been implemented already. ----- Mail original ----- > De : Olivier Guillard <olivier(a)guillard.nom.fr> > À : Mik J <mikydevel(a)yahoo.fr> > Cc : > Envoyé le : Dimanche 30 septembre 2012 22h23 > Objet : Re: slapd ACLs > > Could you activate ACL debug level ? > > since I'm not very familiar with "dn.regex", you might need help > from > someone else anyway. > > --- > Olivier > > 2012/9/30 Mik J <mikydevel(a)yahoo.fr>: >> Thank you for your answer Olivier, I tried to do this but it didn't > work. The logs look like this >> >> conn=1001 op=0 BIND dn="user2,ou=people,dc=mydomain,dc=org" > method=128 >> conn=1001 op=0 BIND dn="user2,ou=people,dc=mydomain,dc=org" > mech=SIMPLE ssf=0 >> conn=1001 op=0 RESULT tag=97 err=0 text= >> conn=1001 op=1 SRCH base="user1,ou=people,dc=mydomain,dc=org" > scope=2 deref=0 filter="(objectClass=*)" >> conn=1001 op=1 SEARCH RESULT tag=101 err=32 nentries=0 text= >> conn=1001 op=2 UNBIND >> >> I triple checked, and when it works, with the dn.subtree permission in the > begining of slapd.conf I have >> conn=1000 op=0 BIND dn="user2,ou=people,dc=mydomain,dc=org" > method=128 >> conn=1000 op=0 BIND dn="user2,ou=people,dc=mydomain,dc=org" > mech=SIMPLE ssf=0 >> conn=1000 op=0 RESULT tag=97 err=0 text= >> conn=1000 op=1 SRCH base="user1,ou=people,dc=mydomain,dc=org" > scope=2 deref=0 filter="(objectClass=*)" >> conn=1000 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= >> conn=1000 op=2 UNBIND >> >> >> >> >> ----- Mail original ----- >>> De : Olivier <ldap(a)guillard.nom.fr> >>> À : Mik J <mikydevel(a)yahoo.fr> >>> Cc : >>> Envoyé le : Dimanche 30 septembre 2012 20h29 >>> Objet : Re: slapd ACLs >>> >>> T ry to put this rule : >>> >>>> access to dn.subtree="" >>>> by * read >>> >>> after the two others. >>> >>> (ionce a rule matches, then the scan stops : order counts) >>> >>> -- >>> Olivier >>> >>> 2012/9/30 Mik J <mikydevel(a)yahoo.fr>: >>>> Hello, >>>> >>>> I'm a bit confused with the ACLs in my slapd.conf considering > I have >>> this >>>> >>>> access to dn.subtree="" >>>> by * read >>>> >>>> access to >>> > attrs=userPassword,shadowMax,shadowExpire,sambaLMPassword,sambaNTPassword >>>> by > dn.regex="uid=[^/]+/admin\+(realm=MYDOMAIN.ORG)?" >>> write >>>> by dn="uid=admin,ou=people,dc=mydomain,dc=org" > write >>>> by self write >>>> by anonymous auth >>>> by * none >>>> >>>> access to * >>>> by > dn.regex="uid=[^/]+/admin\+(realm=MYDOMAIN.ORG)?" >>> =wrscx >>>> by self write >>>> by users read >>>> by anonymous auth >>>> by * none >>>> >>>> >>>> When I do a ldapsearch without authentication, I can see the > user's >>> details including the unencrypted password >>>> >>>> ldapsearch -x -b > "uid=user1,ou=people,dc=mydomain,dc=org" >>>> I think that it's because the rule access to > dn.subtree="" by >>> * read >>>> With an authenticated user is works as well >>>> >>>> ldapsearch -x -D uid=user2,ou=people,dc=mydomain,dc=org -b >>> "uid=user1,ou=people,dc=mydomain,dc=org" -W >>>> >>>> But if I comment these two lines >>>> #access to dn.subtree="" >>>> # by * read >>>> The search doesn't give me any result >>>> >>>> ldapsearch -x -D uid=user2,ou=people,dc=mydomain,dc=org -b >>> "uid=user1,ou=people,dc=mydomain,dc=org" -W >>>> # search result >>>> search: 2 >>>> result: 32 No such object >>>> # numResponses: 1 >>>> >>>> I would have expected that this command matched >>>> access to * >>>> by users read >>>> >>>> My goal is that only authenticated user would be able to access > the ldap >>> directory and users can change their passwords >>>> >>>> Does anyone has an idea on how to explain this behavior. ? >>>> >>>> Thank you >>>> >>> >> >

1 0

Re: slapd ACLs
by Mik J 30 Sep '12

30 Sep '12

Thank you for your answer Olivier, I tried to do this but it didn't work. The logs look like this conn=1001 op=0 BIND dn="user2,ou=people,dc=mydomain,dc=org" method=128 conn=1001 op=0 BIND dn="user2,ou=people,dc=mydomain,dc=org" mech=SIMPLE ssf=0 conn=1001 op=0 RESULT tag=97 err=0 text= conn=1001 op=1 SRCH base="user1,ou=people,dc=mydomain,dc=org" scope=2 deref=0 filter="(objectClass=*)" conn=1001 op=1 SEARCH RESULT tag=101 err=32 nentries=0 text= conn=1001 op=2 UNBIND I triple checked, and when it works, with the dn.subtree permission in the begining of slapd.conf I have conn=1000 op=0 BIND dn="user2,ou=people,dc=mydomain,dc=org" method=128 conn=1000 op=0 BIND dn="user2,ou=people,dc=mydomain,dc=org" mech=SIMPLE ssf=0 conn=1000 op=0 RESULT tag=97 err=0 text= conn=1000 op=1 SRCH base="user1,ou=people,dc=mydomain,dc=org" scope=2 deref=0 filter="(objectClass=*)" conn=1000 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= conn=1000 op=2 UNBIND ----- Mail original ----- > De : Olivier <ldap(a)guillard.nom.fr> > À : Mik J <mikydevel(a)yahoo.fr> > Cc : > Envoyé le : Dimanche 30 septembre 2012 20h29 > Objet : Re: slapd ACLs > >T ry to put this rule : > >> access to dn.subtree="" >> by * read > > after the two others. > > (ionce a rule matches, then the scan stops : order counts) > > -- > Olivier > > 2012/9/30 Mik J <mikydevel(a)yahoo.fr>: >> Hello, >> >> I'm a bit confused with the ACLs in my slapd.conf considering I have > this >> >> access to dn.subtree="" >> by * read >> >> access to > attrs=userPassword,shadowMax,shadowExpire,sambaLMPassword,sambaNTPassword >> by dn.regex="uid=[^/]+/admin\+(realm=MYDOMAIN.ORG)?" > write >> by dn="uid=admin,ou=people,dc=mydomain,dc=org" write >> by self write >> by anonymous auth >> by * none >> >> access to * >> by dn.regex="uid=[^/]+/admin\+(realm=MYDOMAIN.ORG)?" > =wrscx >> by self write >> by users read >> by anonymous auth >> by * none >> >> >> When I do a ldapsearch without authentication, I can see the user's > details including the unencrypted password >> >> ldapsearch -x -b "uid=user1,ou=people,dc=mydomain,dc=org" >> I think that it's because the rule access to dn.subtree="" by > * read >> With an authenticated user is works as well >> >> ldapsearch -x -D uid=user2,ou=people,dc=mydomain,dc=org -b > "uid=user1,ou=people,dc=mydomain,dc=org" -W >> >> But if I comment these two lines >> #access to dn.subtree="" >> # by * read >> The search doesn't give me any result >> >> ldapsearch -x -D uid=user2,ou=people,dc=mydomain,dc=org -b > "uid=user1,ou=people,dc=mydomain,dc=org" -W >> # search result >> search: 2 >> result: 32 No such object >> # numResponses: 1 >> >> I would have expected that this command matched >> access to * >> by users read >> >> My goal is that only authenticated user would be able to access the ldap > directory and users can change their passwords >> >> Does anyone has an idea on how to explain this behavior. ? >> >> Thank you >> >

1 0

slapd ACLs
by Mik J 30 Sep '12

30 Sep '12

Hello, I'm a bit confused with the ACLs in my slapd.conf considering I have this access to dn.subtree="" by * read access to attrs=userPassword,shadowMax,shadowExpire,sambaLMPassword,sambaNTPassword by dn.regex="uid=[^/]+/admin\+(realm=MYDOMAIN.ORG)?" write by dn="uid=admin,ou=people,dc=mydomain,dc=org" write by self write by anonymous auth by * none access to * by dn.regex="uid=[^/]+/admin\+(realm=MYDOMAIN.ORG)?" =wrscx by self write by users read by anonymous auth by * none When I do a ldapsearch without authentication, I can see the user's details including the unencrypted password ldapsearch -x -b "uid=user1,ou=people,dc=mydomain,dc=org" I think that it's because the rule access to dn.subtree="" by * read With an authenticated user is works as well ldapsearch -x -D uid=user2,ou=people,dc=mydomain,dc=org -b "uid=user1,ou=people,dc=mydomain,dc=org" -W But if I comment these two lines #access to dn.subtree="" # by * read The search doesn't give me any result ldapsearch -x -D uid=user2,ou=people,dc=mydomain,dc=org -b "uid=user1,ou=people,dc=mydomain,dc=org" -W # search result search: 2 result: 32 No such object # numResponses: 1 I would have expected that this command matched access to * by users read My goal is that only authenticated user would be able to access the ldap directory and users can change their passwords Does anyone has an idea on how to explain this behavior. ? Thank you

1 0

LDAP search filter on superior/parent attribute
by Roman Rybalko 30 Sep '12

30 Sep '12

Have a schema: olcAttributeTypes: ( 2.999.777.1.1.1.3 NAME 'orderingInteger' DESC 'Integer with ordering' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 ) olcAttributeTypes: ( 2.999.777.1.1.2.16 NAME 'timeInteger' DESC 'Integer time representation' SUP orderingInteger ) olcAttributeTypes: ( 2.999.777.1.1.2.17 NAME 'Mailbox' DESC 'Mailbox name' SUP info ) olcAttributeTypes: ( 2.999.777.1.1.2.16.1 NAME 'timeIntegerYear' DESC 'Integer year representation' SUP timeInteger ) olcAttributeTypes: ( 2.999.777.1.1.2.16.2 NAME 'timeIntegerMonth' DESC 'Integer month representation' SUP timeInteger ) olcAttributeTypes: ( 2.999.777.1.1.2.16.3 NAME 'timeIntegerDay' DESC 'Integer day of the month representation' SUP timeInteger ) olcAttributeTypes: ( 2.999.777.1.1.2.16.4 NAME 'timeIntegerHour' DESC 'Integer hour representation' SUP timeInteger ) olcAttributeTypes: ( 2.999.777.1.1.2.16.5 NAME 'timeIntegerMinute' DESC 'Integer minute representation' SUP timeInteger ) olcObjectClasses: ( 2.999.777.1.2.3 NAME 'entry' SUP top STRUCTURAL MAY ( timeInteger $ timeIntegerYear $ timeIntegerMonth $ timeIntegerDay $ timeIntegerHour $ timeIntegerMinute ) ) Have a search: (&(timeInteger>=1348900000)(timeInteger<=1349000000)) This search may return entries like: timeInteger: 1347014897 timeIntegerYear: 2012 timeIntegerMonth: 9 ... The entry with timeInteger=1347014897 is obviously not in [1348900000,1349000000] range, but it is matched because there are another attributes in the entry with "SUP timeInteger", so timeIntegerYear=2012 is matched the (timeInteger<=1349000000) filter part. I'm looking for RFC that describes such behavior. -- WBR, Roman Rybalko

3 2

Appropriate index for <= >= filter on generalizedTime (Re: reqStart<= slow)
by Roman Rybalko 30 Sep '12

30 Sep '12

Hi, I'm trying to use >= <= filter on eq-indexed generalizedTime attribute. Seems eq-index does not work for <= filter. olcAttributeTypes: ( 2.999.777.1.1.1.5 NAME 'logTime' DESC 'Time' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 ) olcDbIndex: logTime eq (&(logTime>=201209201440+0400)(logTime<=201209201450+0400)) - 57sec (|(logTime=20120920144001+0400)(logTime=20120920144008+0400)) - 0.03sec ~ 1000000 records in db, target = 100000000 records What should I do to make >= filters work efficiently? I may consider using another data type that work with <=/=> filters for sure. Strings? Integers? Anything that can mimic TIME semantics. Any advice? 14.04.2012 19:44, Michael Ströder пишет: > can I influence the order of index usage by order in the filter or slapd index configuration? The same question from me. Is it possible to select indexes using some sort of filter syntax? -- WBR, Roman Rybalko

2 11

mdb_idl_fetch_key: cursor failed: Invalid argument (22)
by Roman Rybalko 30 Sep '12

30 Sep '12

I have such error in logs: null_callback : error code 0x50 syncrepl_entry: rid=001 be_add logID=502,logID=402,logHost=mail.xxx.xxx.xx,logName=main,cn=test failed (80) do_syncrepl: rid=001 rc 80 retrying (2 retries left) and then every 2-3 minutes: => mdb_idl_fetch_key: cursor failed: Invalid argument (22) MDB is running on replication consumer. I shutted down the replication provider for reindexing. The consumer was not fully synced at that time. Than I changed olcDbMaxSize on the replication consumer. Than I started the provider again. Seems the error happened first time right after olcDbMaxSize was increased from 5G to 8G. I've never changed it before. Sep 30 16:07:01 lintest slapd[518]: conn=1089 op=1 MOD dn="olcDatabase={1}mdb,cn=config" Sep 30 16:07:01 lintest slapd[518]: conn=1089 op=1 MOD attr=olcDbMaxSize Sep 30 16:07:03 lintest slapd[518]: conn=1089 op=1 RESULT tag=103 err=0 text= Sep 30 16:07:03 lintest slapd[518]: conn=1089 op=2 UNBIND Sep 30 16:07:03 lintest slapd[518]: conn=1089 fd=12 closed Sep 30 16:07:03 lintest slapd[518]: => mdb_idl_fetch_key: cursor failed: Invalid argument (22) slapd version git a1c2dc6 db size 3.7Gb What this error is about? Is it serious? Should I recreate the DB on the consumer? Seems replication is stalled. -- WBR, Roman Rybalko

1 0

LDAP and MD5 authentication issues.
by S K 30 Sep '12

30 Sep '12

Hi, I am newbie to LDAP and I am having a issue. I have to work with MD5 authentication as the application we are going to use has to bind to a LDAP server with password generated using MD5. I am not able to authenticate with password generate using the perl script or using the md5 executable. But if I generate the passwords using slappassword and MD5 I am fine. Can somebody please explain what I am doing wrong and how I can authenticate using perl or md5 exe generated password. Any help is greatly appreciated. Passwords generated using this perl script. for example. MD5 for hello perl -e 'use Digest::MD5 qw(md5_hex);print uc(md5_hex("hello"))."\n";' 5D41402ABC4B2A76B9719D911017C592 Using slappasswd ./slappasswd -h \{MD5\} -s hello {MD5}XUFAKrxLKna5cZ2REBfFkg== My LDIF file user MD5A assigned perl or md5 exe generated MD5 password and user MD5B assigned slappasswd generated MD5 password. dn: cn=MD5A, ou=hr, o=test objectClass: top objectClass: person objectClass: organizationalPerson cn: MD5A sn: MD5A userpassword: {MD5}5D41402ABC4B2A76B9719D911017C592 title: admin dn: cn=MD5B, ou=hr, o=test objectClass: top objectClass: person objectClass: organizationalPerson cn: MD5B sn: MD5B userpassword: {MD5}XUFAKrxLKna5cZ2REBfFkg== title: admin Import LDIF: # /usr/local/bin/ldapadd -x -W -D "cn=admin" -f users.ldif Enter LDAP Password: adding new entry "o=test" adding new entry "ou=hr,o=test" adding new entry "cn=MD5A, ou=hr, o=test" adding new entry "cn=MD5B, ou=hr, o=test" ldapsearch fails for MD5A with error 49 and for MD5B it works fine. # /usr/local/bin/ldapsearch -x -w hello -D "cn=MD5A, ou=hr, o=test" ldap_bind: Invalid credentials (49) # /usr/local/bin/ldapsearch -x -w hello -D "cn=MD5B, ou=hr, o=test" # extended LDIF # # LDAPv3 # base <> (default) with scope subtree # filter: (objectclass=*) # requesting: ALL # # test dn: o=test objectClass: top objectClass: organization o: test # hr, test dn: ou=hr,o=test objectClass: top objectClass: organizationalUnit ou: asqmatrix ou: hr # MD5A, hr, test dn: cn=MD5A,ou=hr,o=test objectClass: top objectClass: person objectClass: organizationalPerson cn: MD5A sn: MD5A userPassword:: e01ENX01RDQxNDAyQUJDNEIyQTc2Qjk3MTlEOTExMDE3QzU5Mg== title: admin # MD5B, hr, test dn: cn=MD5B,ou=hr,o=test objectClass: top objectClass: person objectClass: organizationalPerson cn: MD5B sn: MD5B userPassword:: e01ENX1YVUZBS3J4TEtuYTVjWjJSRUJmRmtnPT0= title: admin # search result search: 2 result: 0 Success # numResponses: 5 # numEntries: 4 Thanks, SK

2 1

Re: ldapsearch stalling when performing searches with a large number of results
by Mark Cairney 28 Sep '12

28 Sep '12

My olcDB values are listed below (minus the olcDbConfig entries). I'm not sure if you need the indexes but I've left them in anyway: olcDbDirectory: /usr/local/authz/var/openldap-data/authorise olcAddContentAcl: FALSE olcDbCacheFree: 1 olcDbCacheSize: 400000 olcDbCheckpoint: 10240 10 olcDbDirtyRead: FALSE olcDbDNcacheSize: 0 olcDbIDLcacheSize: 1200000 olcDbIndex: autoMountKey eq olcDbIndex: cn pres,eq,sub olcDbIndex: eduniCategory eq olcDbIndex: eduniCollegeCode eq olcDbIndex: eduniIdmsId pres,eq olcDbIndex: eduniIDStatus eq olcDbIndex: eduniLibraryBarcode pres,eq olcDbIndex: eduniOrganisation pres,eq,sub olcDbIndex: eduniOrgCode eq olcDbIndex: eduniSchoolCode eq olcDbIndex: eduniServiceCode pres,eq olcDbIndex: eduniType eq olcDbIndex: eduniUnitCode eq olcDbIndex: eduPersonAffiliation pres,eq olcDbIndex: eduPersonEntitlement pres,eq olcDbIndex: eduPersonPrimaryAffiliation eq olcDbIndex: eduPersonPrincipalName eq olcDbIndex: eduPersonScopedAffiliation pres,eq olcDbIndex: eduPersonTargetedID eq olcDbIndex: entryCSN eq olcDbIndex: entryUUID eq olcDbIndex: gecos pres,eq,sub olcDbIndex: gidNumber pres,eq olcDbIndex: krbName pres,eq olcDbIndex: mail pres,eq,sub olcDbIndex: memberOf pres,eq olcDbIndex: memberUid eq olcDbIndex: objectClass eq olcDbIndex: sn pres,eq,sub olcDbIndex: uid pres,eq,sub olcDbIndex: uidNumber pres,eq olcDbIndex: uniqueMember pres,eq olcDbIndex: userPassword eq olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbNoSync: FALSE olcDbSearchStack: 16 olcDbShmKey: 0 and my DB_CONFIG file contains: set_cachesize 4 0 1 set_flags DB_LOG_AUTOREMOVE set_lk_max_objects 5000 set_lk_max_lockers 5000 set_lg_regionmax 41943040 set_lg_dir /usr/local/authz/slapd/trans-logs set_lk_max_locks 10000 set_lg_bsize 20971520 set_lg_max 83886080 I'm not using an SHM key (should I be?). The search that I spotted this behaviour probably means nothing outside our environment as it's against a value in our local schema but for completeness it was: (&(eduniCategory=201)(objectclass=inetorgperson)) I've seen the same behaviour with similar searches which we would expect to return a large number of results e.g. (&(eduPersonAffiliation=student)(objectclass=inetorgperson)) or indeed against groups with a lot of members. > > You may wish to read over <https://wiki.zimbra.com/wiki/OpenLDAP_Performance_Tuning>. You can easily map the information there to a non-zimbra installation. Thanks- your documentation on the DB tuning and SHM key is excellent. I can see a couple of things which I might change based on it but I'll wait to hear back before I jump in and start playing around with parameters. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > /**************************** Mark R Cairney ITI UNIX Section Information Services Tel: 0131 650 6565 Email: Mark.Cairney(a)ed.ac.uk ****************************/ -- The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336.

3 7

range search on Generalized Time attribute
by Marco Schirrmeister 28 Sep '12

28 Sep '12

Hi, OpenLDAP 2.4.32 and also tried with latest RE24 BDB 4.8.30 My DB_CONFIG looks like this. set_lk_detect DB_LOCK_DEFAULT set_flags DB_TXN_NOSYNC set_flags DB_LOG_AUTOREMOVE set_lg_max 10485760 set_cachesize 0 1073741824 1 set_lk_max_locks 4000 set_lk_max_lockers 4000 set_lk_max_objects 4000 set_lg_regionmax 262144 set_lg_bsize 20971520 set_lg_dir /var/lib/ldap2.4/ogilvy.com/bdb/ In our stage directory I noticed a range search is not returning anything on a specific attribute with generalizedTime syntax. On production it works fine. Here is an example command. $ ldapsearch -x -H ldaps://ds71 -D cn=manager,dc=ogilvy,dc=com -w 'secret' -b ou=people,dc=ogilvy,dc=com -LLL '(&(lastchangeDate<=20111107235959Z)(lastchangeDate>=20111107151200Z))' dn lastchangedate $ I know my entry falls in that range. $ ldapsearch -x -H ldaps://ds71 -D cn=manager,dc=ogilvy,dc=com -w 'secret' -b ou=people,dc=ogilvy,dc=com -LLL '(uid=marco.schirrm*)' lastchangedate dn: uid=marco.schirrmeister(a)ogilvy.com,ou=people,dc=ogilvy,dc=com lastchangeDate: 20111107151301Z $ The attribute is indexed. index lastchangeDate eq Schema has this. SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch I tried recreating the index, but all that did not help. Same problem exists if I use bach-hdb. I tried that same dataset with back-mdb and the search returned what I expected. So I thought it's maybe Berkeley DB bug. I then tried bdb 5.3.15 some time ago and also the latest 5.3.21. I see the same issue with this versions. I first thought it's the amount of entries that cause that issue. It's not really much, but stage has less the prod. So tried to create different test datasets to see if I can reproduce it. I was not able to reproduce it with the test datasets. The ldapsearch always returned what I wanted. I'm now a little bit lost if my DB_CONFIG settings are maybe bad. Or if it is something in Berkeley DB or OpenLDAP. Any ideas? I'm going to switch to mdb soon. But was wondering if that is something serious or not. Here is the slapd.conf. I omitted all the schema includes and index lines. include /etc/openldap2.4/slapd.access.ogilvy.conf pidfile /var/run/ldap2.4/slapd.pid argsfile /var/run/ldap2.4/slapd.args modulepath /usr/lib64/oldap24/openldap2.4 moduleload back_monitor.la moduleload accesslog.la moduleload syncprov.la moduleload auditlog.la TLSCertificateFile /etc/pki/tls/certs/ogilvy.com.crt TLSCertificateKeyFile /etc/pki/tls/private/ogilvy.com.rsa TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt loglevel stats sasl-secprops noplain,noanonymous,noactive serverID 40 ldaps://ds71.ogilvy.com database bdb suffix "dc=ogilvy,dc=com" rootdn "cn=manager,dc=ogilvy,dc=com" rootpw FooBarBaz directory /var/lib/ldap2.4/ogilvy.com limits dn.exact="cn=manager,dc=ogilvy,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited limits dn.exact="uid=replicator,ou=admin,dc=ogilvy,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited limits group/ogilvyGroup/uniqueMember="cn=svcgrp-unlimitedsearch,ou=groups,dc=ogilvy,dc=com" size.soft=unlimited size.hard=unlimited cachesize 150000 dirtyread sizelimit 90000 checkpoint 256 5 conn_max_pending_auth 2000 idlcachesize 450000 dncachesize 150000 monitoring on overlay syncprov syncprov-checkpoint 256 5 syncprov-sessionlog 5000 database config rootdn "cn=admin,cn=config" rootpw FooBarBaz include /etc/openldap2.4/slapd.access.config.conf database monitor rootdn cn=monitor rootpw FooBarBaz -- Marco

1 0

Suggestion about slapd.conf
by Net Warrior 28 Sep '12

28 Sep '12

Hi there I't been long time since I did not administer LDAP, now I have the need to do it again cuz a new proyect , reading the docs I found that lots of interesting things were included and some will be deprecated as for example slapd.conf, I need to apply some ACL, I'm familliar with the old slapd.conf style, but the documentation says slapd.conf will be deprecated sooner latter. My doubt is that it will be deprecated for the core LDAP configuration or if something will be still possible to do through it, reading the documentation ( 2.4 ) I see examples regarding the old style and do not know if that's for compatibility or not. Still I do not get familiar with the oclAccess and the new cn=something structure. Thanks for your time and support Best Regards

1 0

syncrepl failure
by manu＠netbsd.org 28 Sep '12

28 Sep '12

Hi I had a master/replicas setup that has been working for years. Recently, I discovered that a replica sometime failed to return existing entries: no error, it just returned nentries=0, for a few queries, then went back to normal. I suspected some database corruption: I killed slapd, removed the databases, restarted slapd so that it resync from master. It pulled a few hundreds of records and then got its up to date contextCSN while a lot of entries are still missing. Restarting slapd exhibit a stright failure in syncrepl: Sep 28 06:34:29 motul slapd[2901]: do_syncrepl: rid=217 rc -2 retrying How do I debug that? I had the problem with OpenLDAP-2.4.21/ db-4.7.25.3. I tried upgrading the replica to OpenLDAP-2.4.32 / db-4.8.30 but it did not change anything. Is there a chance that upgrading the master (runs 2.4.21 too) will help? During the short time syncrepl runs, logs are filled with stuff like this, I wonder if it is a related problem or not: Sep 28 03:30:16 motul slapd[269]: conn=-1 op=0 => bdb_dn2id_add dn="uid=user,ou=foo,dc=example,dc=net" ID=0x7c: put failed: DB_LOCK_DEADLOCK: Locker killed to r esolve a deadlock -30994 -- Emmanuel Dreyfus http://hcpnet.free.fr/pubz manu(a)netbsd.org

2 2

dynlist, memberof,and authentication
by Richard Pijnenburg 28 Sep '12

28 Sep '12

Hi all, I've created a group with the dynlist overlay to create dynamic groups. Now i want to implement authentication with it but seem to be unable to search on it with nss-pam-lib or sssd. Before i start configuring all that stuff i wanted to see what search/filter string i need to make and been playing around to get the member. When i search with base the dynamic group i get all the members/ # ldapsearch -x -b 'cn=prod,ou=isp,ou=acl,dc=ispavailability,dc=com' dn: cn=prod,ou=isp,ou=acl,dc=ispavailability,dc=com objectClass: groupOfURLs cn: prod memberURL: ldap:///cn=sysadmin,ou=isp,ou=groups,dc=ispavailability,dc=com?memb er?sub? member: uid=richard,ou=people,dc=ispavailability,dc=com So i thought i'll create a search string for the cn and the member. # ldapsearch -x '(&(cn=prod)(member=uid=richard,ou=people,dc=ispavailability,dc=com))' And i get nothing.... So i thought about using the memberof overlay with it. # ldapsearch -x uid=richard memberof I get the static group trough the memberof overlay but not the dynamic group. Am i missing something or am i trying to do something that's simply not possible? Cheers. Richard

3 3

Implementing ACL, using non-local groups
by Tio Teath 27 Sep '12

27 Sep '12

Is it possible to implement ACL, using groups which are accessed via ldap-proxy, i.e. non-local groups? I've managed to setup authentication for users, which are in remote LDAP server only, but looks like remote groups are ignored in case of using 'group.exact=' statement.

2 1

(no subject)
by Tio Teath 27 Sep '12

27 Sep '12

Is it possible to implement ACL, using groups which are accessed via ldap-proxy, i.e. non-local groups? I've managed to setup authentication for users, which are in remote LDAP server only, but looks like remote groups are ignored in case of using 'group.exact=' statement.

1 0

Re: nslcd and Ubuntu 10.04
by Adam Wolfe 27 Sep '12

27 Sep '12

Many thanks, Christopher. I'm on nslcd 0.7.2 right now. Definitely a place to start. Very appreciated. Christopher Wood <christopher_wood(a)pobox.com> wrote: >http://ubuntuforums.org/showthread.php?t=1633524 > >http://lists.arthurdejong.org/nss-pam-ldapd-users/2011/msg00082.html > >My fix was to "apt-get source nslcd" on a Debian Squeeze box, then use those files to build a new deb on Ubuntu and shove the result in my repository. Presto, working nslcd on Ubuntu 10.04. > >On Wed, Sep 26, 2012 at 04:46:30PM -0400, Adam Wolfe wrote: >> I'm having trouble keeping my servers connected to our openLDAP server. >> >> All through syslog I see messages like this: >> >> Sep 26 14:06:01 hostname nslcd[930]: [2aeb87] connected to LDAP server >> [1]ldaps://ldap.domain.com/ >> Sep 26 14:07:01 hostname nslcd[930]: [aae0a3] ldap_result() failed: Can't >> contact LDAP server >> Sep 26 14:07:01 hostname nslcd[930]: [74310e] ldap_result() failed: Can't >> contact LDAP server >> Sep 26 14:07:01 hostname nslcd[930]: [aae0a3] ldap_abandon() failed to >> abandon search: Other (e.g., implementation specific) error >> Sep 26 14:07:01 hostname nslcd[930]: [b2a65f] ldap_result() failed: Can't >> contact LDAP server >> Sep 26 14:07:01 hostname nslcd[930]: [b2a65f] ldap_abandon() failed to >> abandon search: Other (e.g., implementation specific) error >> Sep 26 14:07:01 hostname nslcd[930]: [74310e] ldap_abandon() failed to >> abandon search: Other (e.g., implementation specific) error >> Sep 26 14:07:01 hostname nslcd[930]: [73c9b8] ldap_result() failed: Can't >> contact LDAP server >> Sep 26 14:07:01 hostname nslcd[930]: [73c9b8] ldap_abandon() failed to >> abandon search: Other (e.g., implementation specific) error >> Sep 26 14:07:01 hostname nslcd[930]: [73c9b8] connected to LDAP server >> [2]ldaps://ldap.domain.com/ >> >> I'm at the point where I want to start blaming the server, but this is >> happening on all the new servers I am bringing up (Ubuntu 10.04) and not >> on the older servers (8.04). >> Everything seems fine and we can sudo and su with our ldap accounts and >> then out of no where "so-and-so is not in the sudoers file". A simple "id >> user" re-establishes the connection and all is well again for a while. >> >> Has anyone else ran into this and finally, permanently made it work? >> >> References >> >> Visible links >> 1. file:///tmp/ldaps:/ldap.domain.com/ >> 2. file:///tmp/ldaps:/ldap >

2 1

LDAP URI
by Emmanuel Dreyfus 26 Sep '12

26 Sep '12

Hi When feeding a LDAP URI to ldap_url_parse(), I understand some characters may need to be escaped in filters in order to get a litteral: * => \2a ( => \28 ) => \29 \ => \5c / => \2f Reading the man page, I understand %-encoding is not mandatory, but it is of course required for ?, and obviously for %. ? -> %3F % -> %25 Are there other characters that should be %-encoded? -- Emmanuel Dreyfus manu(a)netbsd.org

6 12

Re: Ldap search that must work
by Amol Kulkarni 26 Sep '12

26 Sep '12

Hi, I had faced similar issue once - the cause was the index on the attribute was corrupt. Reindexing solved the issue. In your case, reindexing the uidnumber attribute should solve the issue. Amol. ----- Original Message ----- From: Aitor Garcia Ortega - Tempel.es Sent: 09/26/12 05:24 PM To: openldap-technical(a)openldap.org Subject: Ldap search that must work I'm feeling som kind of stupid I'm running openldap-servers-2.4.23-26.el6_3.2.x86_64 under Centos 6.3. Using ldapsearch I get this result: ldapsearch -h localhost -x -b 'o=Iddover,c=Net' '(uid=aitiddnet)' > # extended LDIF > # > # LDAPv3 > # base <o=Iddover,c=Net> with scope subtree > # filter: (uid=aitiddnet) > # requesting: ALL > # > > # aitiddnet, People, Iddover, Net > dn: uid=aitiddnet,ou=People,o=Iddover,c=Net > uid: aitiddnet > cn: Aitor Garcia Ortega - Iddover.net > objectClass: account > objectClass: posixAccount > objectClass: top > objectClass: shadowAccount > objectClass: inetLocalMailRecipient > userPassword:: ************** > shadowLastChange: 14363 > shadowMax: 99999 > shadowWarning: 7 > uidNumber: 546 > gidNumber: 546 > gecos: Aitor Garcia Ortega - Iddover.net > mailLocalAddress: aitor.garcia(a)iddover.net > mailHost: localhost > homeDirectory: /home/aitiddnet > loginShell: /bin/bash > > # search result > search: 2 > result: 0 Success > > # numResponses: 2 > # numEntries: 1 But this seconf ldap serch don't work # ldapsearch -h localhost -x -b 'o=Iddover,c=Net' '(uidNumber=546)' > # extended LDIF > # > # LDAPv3 > # base <o=Iddover,c=Net> with scope subtree > # filter: (uidNumber=546) > # requesting: ALL > # > > # search result > search: 2 > result: 0 Success I really don't undertand. In another server with CentOS release 5.6 (Final), openldap-servers-2.3.43-12.el5_6.7 and the same database it works well... # ldapsearch -h localhost -x -b 'o=Iddover,c=Net' '(uidNumber=546)' # extended LDIF # # LDAPv3 # base <o=Iddover,c=Net> with scope subtree # filter: (uidNumber=546) # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 [root@r300te1 ~]# ldapsearch -h 172.16.6.1 -x -b 'o=Iddover,c=Net' '(uidNumber=546)' # extended LDIF # # LDAPv3 # base <o=Iddover,c=Net> with scope subtree # filter: (uidNumber=546) # requesting: ALL # # aitiddnet, People, Iddover, Net dn: uid=aitiddnet,ou=People,o=Iddover,c=Net uid: aitiddnet cn: Aitor Garcia Ortega - Iddover.net objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount objectClass: inetLocalMailRecipient userPassword:: ***************** shadowLastChange: 14363 shadowMax: 99999

2 1

slapd: do_syncrepl: rid=010 rc -2 retrying (4 retries left)
by Roman Rybalko 26 Sep '12

26 Sep '12

slapd[21334]: do_syncrepl: rid=010 rc -2 retrying (4 retries left) olcSyncrepl: {0}rid=010 provider=ldap://ldap binddn="cn=config" bindmethod=simple credentials=XXX searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 slapd-2.4.23 on master & slave This happens when the slave server is restarted. If make some change to cn=config, then the error disappear. I didn't find any explanation about rc -2. What this is about? -- WBR, Roman Rybalko

1 0

TLS error on startup
by Brian Empson 26 Sep '12

26 Sep '12

Hello, I'm having an issue starting up slapd with TLS enabled. I tried to search for the error code but I couldn't find any GnuTLS error codes that match. Here are the log entries that appear: Sep 25 21:07:05 dir0 slapd[15018]: main: TLS init def ctx failed: -1 Sep 25 21:07:05 dir0 slapd[15018]: DIGEST-MD5 common mech free Sep 25 21:07:05 dir0 slapd[15018]: slapd stopped. Sep 25 21:07:05 dir0 slapd[15018]: connections_destroy: nothing to destroy. Is there a way to check and see if this build is enabled with TLS support? I installed it from a package manager rather than compiling it. Here are the TLS portions of the config: # SSL TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCACertificateFile /etc/ssl/ca.pem TLSCertificateFile /etc/openldap/ssl/server.pem TLSCertificateKeyFile /etc/openldap/ssl/server.key TLSVerifyClient demand Here are the files listed: (I changed the permissions during troubleshooting) [09/25/12 9:16PM][root@dir0 /etc/openldap]# ls -lah ssl total 12 drw------- 2 _openldap _openldap 512B Sep 25 19:59 . drwxr-xr-x 4 root wheel 512B Sep 25 19:54 .. -rwxrwxrwx 1 _openldap _openldap 3B Sep 25 20:08 digits.srl -rwxrwxrwx 1 _openldap _openldap 887B Sep 25 19:56 server.key -rwxrwxrwx 1 _openldap _openldap 904B Sep 25 20:08 server.pem -rwxrwxrwx 1 _openldap _openldap 684B Sep 25 19:57 server.req [09/25/12 9:16PM][root@dir0 /etc/openldap]# ls -lah /etc/ssl total 170 drwxr-xr-x 4 root wheel 512B Sep 25 19:52 . drwxr-xr-x 27 root wheel 2.5K Sep 24 20:50 .. -rw-r--r-- 1 root wheel 912B Sep 23 16:30 ca.crt -rw-r--r-- 1 root wheel 912B Sep 25 19:52 ca.pem -rw-r--r-- 1 root wheel 17B Sep 23 17:51 ca.srl -r--r--r-- 1 root bin 147K Feb 12 2012 cert.pem drwxr-xr-x 2 root wheel 512B Feb 12 2012 lib -r--r--r-- 1 root bin 1.6K Feb 12 2012 openssl.cnf drwx------ 2 root wheel 512B Sep 23 16:29 private -rw-r--r-- 1 root wheel 1.0K Sep 25 19:52 privkey.pem -r--r--r-- 1 root bin 1005B Feb 12 2012 x509v3.cnf Is this an issue with the build I'm running? (SSL not enabled or?) Thanks! Brian

4 3

Ldap search that must work
by Aitor Garcia Ortega - Tempel.es 26 Sep '12

26 Sep '12

I'm feeling som kind of stupid I'm running openldap-servers-2.4.23-26.el6_3.2.x86_64 under Centos 6.3. Using ldapsearch I get this result: ldapsearch -h localhost -x -b 'o=Iddover,c=Net' '(uid=aitiddnet)' > # extended LDIF > # > # LDAPv3 > # base <o=Iddover,c=Net> with scope subtree > # filter: (uid=aitiddnet) > # requesting: ALL > # > > # aitiddnet, People, Iddover, Net > dn: uid=aitiddnet,ou=People,o=Iddover,c=Net > uid: aitiddnet > cn: Aitor Garcia Ortega - Iddover.net > objectClass: account > objectClass: posixAccount > objectClass: top > objectClass: shadowAccount > objectClass: inetLocalMailRecipient > userPassword:: ************** > shadowLastChange: 14363 > shadowMax: 99999 > shadowWarning: 7 > uidNumber: 546 > gidNumber: 546 > gecos: Aitor Garcia Ortega - Iddover.net > mailLocalAddress: aitor.garcia(a)iddover.net > mailHost: localhost > homeDirectory: /home/aitiddnet > loginShell: /bin/bash > > # search result > search: 2 > result: 0 Success > > # numResponses: 2 > # numEntries: 1 But this seconf ldap serch don't work # ldapsearch -h localhost -x -b 'o=Iddover,c=Net' '(uidNumber=546)' > # extended LDIF > # > # LDAPv3 > # base <o=Iddover,c=Net> with scope subtree > # filter: (uidNumber=546) > # requesting: ALL > # > > # search result > search: 2 > result: 0 Success I really don't undertand. In another server with CentOS release 5.6 (Final), openldap-servers-2.3.43-12.el5_6.7 and the same database it works well... # ldapsearch -h localhost -x -b 'o=Iddover,c=Net' '(uidNumber=546)' # extended LDIF # # LDAPv3 # base <o=Iddover,c=Net> with scope subtree # filter: (uidNumber=546) # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 [root@r300te1 ~]# ldapsearch -h 172.16.6.1 -x -b 'o=Iddover,c=Net' '(uidNumber=546)' # extended LDIF # # LDAPv3 # base <o=Iddover,c=Net> with scope subtree # filter: (uidNumber=546) # requesting: ALL # # aitiddnet, People, Iddover, Net dn: uid=aitiddnet,ou=People,o=Iddover,c=Net uid: aitiddnet cn: Aitor Garcia Ortega - Iddover.net objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount objectClass: inetLocalMailRecipient userPassword:: ***************** shadowLastChange: 14363 shadowMax: 99999

1 0

ldapsearch stalling when performing searches with a large number of results
by Mark Cairney 25 Sep '12

25 Sep '12

Hi, I've been finding that ldapsearch will freeze when performing searches with a large (typically >10,000) number of results. As far as I can tell this does not appear to be related to server load as according to iostat and top the servers don't appear to be stressed and the servers continue to respond to incoming requests. I'm running OpenLDAP 2.4.30 with BDB 4.8.30 in multi-master mode with syncrepl if this makes any difference. I have tried upgrading to 2.4.32 but this appears to be exhibiting the same behaviour. In terms of the size of the database I've got about 300,000 entries and my bdb database files are currently taking up 5.6G. The servers themselves are 4xquad-cores with 24GB RAM. Has anyone else seen this behaviour or should I file an ITS? /**************************** Mark R Cairney ITI UNIX Section Information Services Tel: 0131 650 6565 Email: Mark.Cairney(a)ed.ac.uk ****************************/ -- The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336.

3 2

Invalid Credentials when using ldappasswd
by Matej Mailing 25 Sep '12

25 Sep '12

Hi all, I have installed open LDAP utilities on Ubuntu 12.04 via apt-get install. I have version 2.4.28-1.1ubuntu4 installed. I can connect successully to the LDAP via phpldapadmin with login cn=admin,dc=mydomain,dc=net and my administrator password. I want to create an administrator for the SOGo login with the following ldif file: "dn: ou=accounts,dc=domain,dc=net objectClass: organizationalUnit ou: accounts dn: uid=adminsogo,ou=accounts,dc=domain,dc=net objectClass: top objectClass: inetOrgPerson objectClass: person objectClass: organizationalPerson uid: adminsogo cn: SOGo Administrator mail: sogo(a)domain.net sn: Administrator givenName: SOGAdmin " When running ldapadd -f admin.ldif -x -W -D cn=admin,dc=domain,dc=net and after entering the administrator password (the same I use to log-in into phpldapadmin), I get: "adding new entry "ou=accounts,dc=domain,dc=net" adding new entry "uid=sogadmin,ou=accounts,dc=domain,dc=net" I assume that everything is OK at this point. The problem is when I enter: ldappasswd -h localhost -x -W -D cn=admin,dc=domain,dc=net,uid=sogadmin,ou=accounts,dc=domain,dc=net -s newpass I have to enter the LDAP password and I enter my administrator password, but always get the output: "ldap_bind: Invalid credentials (49)" When doing "dapsearch -x -h localhost -b "dc=domain,dc=net" -s sub "objectclass=*"" I can see that an object sogadmin is created: "..... dn: uid=adminsogo,ou=accounts,dc=domain,dc=net objectClass: top objectClass: inetOrgPerson objectClass: person objectClass: organizationalPerson uid: adminsogo cn: SOGo Administrator mail: sogo(a)domain.net sn: Administrator givenName:: U09HQWRtaW4g ..." What should I check to get past this "ldap_bind: Invalid credentials (49)" when trying to ldappasswd of a new user? I am pretty sure this must be some basic thing, but I am really a beginner in the LDAP field .. I have spent few days already trying to solve this and any help will be very appreciated. Thanks for any ideas in advance. Regards, Matej

2 2

slapd: way of configuration
by Tobias Hachmer 25 Sep '12

25 Sep '12

Hello list, I want to know what the recommended way is to configure slapd. I'm using openldap package 2.4.28 under ubuntu precise. As default there is no /etc/ldap/slapd.conf and the whole configuration is located under /etc/ldap/slapd.d/ in ldif format. 1. Must I use ldapmodify to change slapd configuration in cn=config backend or can I just change configuration directives directly in the appropriate ldif file under /etc/ldap/slapd.d/cn=config/* ? If the latter, have I to restart slapd after configuration changes? 2. Will the old school way to configure slapd via slapd.conf be deprecated and not available at all in future? Thanks and kind regards, Tobias Hachmer

6 8

Mac Ldap Client login problem
by cbulist 25 Sep '12

25 Sep '12

Hi, I'm trying to configure a Mac client(OS X 10.7.2) with my Openldap server (2.4.23). I configured Directory Utility with my LDAPv3 support and see that Network Account Server on green status. After that I can do: su <username> or id <username> in terminal and I'm able to login or view the data of the user. The problem is when I reset the Mac and I try to login from the initial GUI login screen it does not permit me. I checked the openldap server log and I see the requested without any error. Do I have to do something in Mac's PAM file? I really appreciate any help with this problem. Thanks in advance.

1 0

Problem with olcAccess
by Tobias Hachmer 24 Sep '12

24 Sep '12

Hello list, I simply trying to add an olcAccess entry to the config backend. here the file contents: dn: olcDatabase={1}hdb,cn=config changeType: modify add: olcAccess olcAccess: to dn.subtree="ou=public,ou=addressbook,dc=example,dc=com" by users write What I've get after adding this to the backend is: olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by dn="cn=a dmin,dc=example,dc=com" write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by self write by dn="cn=admin,dc=example,dc=com" write by * read olcAccess:: ezN9dG8gZG4uc3VidHJlZT0ib3U9cHVibGljLG91PWFkZHJlc3Nib29rLGRjPWtva2 VsbmV0LGRjPWRlIiBieSAqIHdyaXRlIA== What's going on here, what did I wrong, I didn't get it yet. Please help me. Regards, Tobias Hachmer

4 6

Logging events to a log file
by Mik J 23 Sep '12

23 Sep '12

Hello List, When I start slapd with the option -d 256 I can see what's happening when there's a connection # /usr/local/libexec/slapd -4 -d 256 -u _openldap -g _openldap -h ldaps:/// However I would like to have this in a log file and I added these lines to slapd.conf loglevel 256 logfile /var/log/slapd.log But my log file remains empty after I start the server with (without -d 256) # /usr/local/libexec/slapd -4 -u _openldap -g _openldap -h ldaps:/// However if I start the server with # /usr/local/libexec/slapd -4 -d 256 -u _openldap -g _openldap -h ldaps:/// The events display on the screen and in the slapd.log file as well. This behavior surprises me, am I missing something ? My ldap server version is 2.4.26p0 Thank you

3 4

Glue slapd-ldap with hdb
by Tio Teath 22 Sep '12

22 Sep '12

I'm trying to glue remote database, provided by ldap backend with local hdb. I have following settings: dn: olcDatabase={1}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq olcLastMod: TRUE olcRootDN: cn=admin,cn=config olcSuffix: dc=local dn: olcOverlay={0}glue,olcDatabase={1}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top olcOverlay: {0}glue ... dn: olcDatabase={3}ldap,cn=config objectClass: olcLDAPConfig objectClass: olcDatabaseConfig objectClass: olcConfig objectClass: top olcDatabase: {3}ldap olcDbChaseReferrals: TRUE olcDbRebindAsUser: TRUE olcDbURI: ldap://remote.server olcRootDN: cn=admin,cn=config olcSubordinate: TRUE olcSuffix: dc=corp,dc=local" But when I try to load it into cn=config, I get next error: [LDAP: error code 80 - <olcSuffix> namingContext "dc=corp,dc=local" already served by a preceding hdb database] Version: 2.4.25-1.1ubuntu4.1

2 1

Re: Message to Change Password
by Guillaume Rousse 21 Sep '12

21 Sep '12

Le 21/09/2012 16:28, Soporte Ti a écrit : > This message appears missing five days for the password expires and > appears until this has expired but only every time I login with the user. Login where ? On a web application ? On a unix workstation ? On an imap mail server ? > There is something more than the passwd command to be used for this? A password is just an attribute in an LDAP server, so any command able to modify LDAP content can be potentially used. ldappassword being the most obvious one here. If, as I'm supposing now, you're actually using an LDAP server to manage Posix user accounts, and you have this issue when logging on an unix host, your problem is merely a client-side issue, and not an LDAP issue. You'll have better answers on the mailing list related to your exact LDAP client (pam_ldap, sssd, nss_pam_ldapd). -- BOFH excuse #70: nesting roaches shorted out the ether cable

1 0

Re: How enforce TLS connection to openldap server only?
by Khosrow Ebrahimpour 20 Sep '12

20 Sep '12

On September 20, 2012 09:59:05 AM Quanah Gibson-Mount wrote: > --On Thursday, September 20, 2012 9:58 AM -0700 Quanah Gibson-Mount > > <quanah(a)zimbra.com> wrote: > > --On Thursday, September 20, 2012 12:02 PM -0400 Yan Gong > > > > <yan(a)fabric.com> wrote: > >> Peter: > >> > >> Thanks for the confirmation! > >> I only used olcSecurity, not olcAccess to enforce the TLS connection. > >> Man, I wish there is more detailed, updated and user-friendly information > >> about OpenLdap on the web. > >> I guess, that's why people are turning to Active Directory because it is > >> much easier to use. > > > > It is documented in the manual pages, which are both on the web, and ship > > with the software itself. Lack of comprehension does not mean lack of > > documentation. > > > > If you think AD is LDAP, then you are in for a world of hurt. > > Meant to send this to the list. ;) > I agree with Quanah that documentation is there, I also think Yan is correct that the information is not very easy to find. I've used the Admin Guide and the Faq-O-Matic on many occassions and found them a good starting point, but not the final answer. I think a wiki-style documentation where the user commuity could more easily contribute to the knowledge base may be a helpful thing. Having said all that, there may already be something like that and I just don't know about it. I can start a new thread if more people want to chime in since I don't want to derail the original thread here.

2 1

RE: How enforce TLS connection to openldap server only?
by Quanah Gibson-Mount 20 Sep '12

20 Sep '12

--On Thursday, September 20, 2012 1:53 PM -0400 Yan Gong <yan(a)fabric.com> wrote: > > > Hmm…when I tried to search for keyword: olsSecurity, nothing shows up: Please keep replies on the list. Since you are looking for configuration options, I suggest you search for slapd-config Also, learn how to use the "man" command from the linux prompt. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

RE: How enforce TLS connection to openldap server only?
by Yan Gong 20 Sep '12

20 Sep '12

Nope, olcSecurity didn't help. Still have the problem. I restared slapd. Please see below: dn: olcDatabase={1}hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=example,dc=com olcSecurity: simple_bind=128 olcSecurity: ssf=128 olcSecurity: tls=1 olcAccess: {0}to attrs=userPassword by tls_ssf=128 ssf=128 dn="cn=admin,dc=example,dc=com" write b y tls_ssf=128 ssf=128 anonymous auth by tls_ssf=128 ssf=128 self write by * none olcAccess: {1}to attrs=shadowLastChange by tls_ssf=128 ssf=128 self write by tls_ssf=128 ssf=128 * read olcAccess: {2}to dn.base="" by tls_ssf=128 ssf=128 * read olcAccess: {3}to * by tls_ssf=128 ssf=128 dn="cn=admin,dc=example,dc=com" write by tls_ssf=128 ssf=128 * read olcLastMod: TRUE olcRootDN: cn=admin,dc=example,dc=com olcRootPW:: c2VjcmV0 olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq olcDbIndex: uidNumber eq olcDbIndex: uid eq,pres,sub structuralObjectClass: olcHdbConfig entryUUID: a1f57758-96d0-1031-93fd-1108a4f5996c creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20120919180734Z entryCSN: 20120919181117.233986Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20120919181117Z Thanks a lot! Yan -----Original Message----- From: Howard Chu [mailto:hyc@symas.com] Sent: Thursday, September 20, 2012 7:50 AM To: Quanah Gibson-Mount Cc: Yan Gong; openldap-technical(a)openldap.org Subject: Re: How enforce TLS connection to openldap server only? Quanah Gibson-Mount wrote: >> Should I use olcAccess or olcSecurity? or both? I couldn't find any >> detailed steps/documentation > > olcSecurity would enforce encryption for any and all connections. > Note that you have to restart slapd for it to take effect. Eh, no. olcSecurity changes take effect immediately. No restart needed. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

4 6

RE: How enforce TLS connection to openldap server only?
by Quanah Gibson-Mount 20 Sep '12

20 Sep '12

--On Thursday, September 20, 2012 9:58 AM -0700 Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, September 20, 2012 12:02 PM -0400 Yan Gong > <yan(a)fabric.com> wrote: > >> Peter: >> >> Thanks for the confirmation! >> I only used olcSecurity, not olcAccess to enforce the TLS connection. >> Man, I wish there is more detailed, updated and user-friendly information >> about OpenLdap on the web. >> I guess, that's why people are turning to Active Directory because it is >> much easier to use. > > It is documented in the manual pages, which are both on the web, and ship > with the software itself. Lack of comprehension does not mean lack of > documentation. > > If you think AD is LDAP, then you are in for a world of hurt. > Meant to send this to the list. ;) --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

translucent-overlay with back-relay and rwm
by Alexander Sulfrian 20 Sep '12

20 Sep '12

Hi, I was trying to get a translucent-overlay working, using the relay backend. But it does not work as expected. I want to merge two existent entries form the same server into a new virtual entry. The problem it, that I could not get the rwm overlay needed for the relay backend to work. If I simply try to add the rwm entry into the config like that: olcOverlay={0}rwm,olcDatabase={0}relay,olcOverlay={0}translucent,olcDatabase={1}hdb,cn=config The server answers with an object class violation error: "no structural objectClass add function". The cause of this error, is that the olcTranslucentDatabase entry is defined as Cfg_Misc and not Cfg_Database and the rwm Entry insists to be initiated in a Cfg_Database entry. I tried even more. I changed the source if the translucent overlay and defined olcTranslucentDatabase to be a Cfg_Database entry. Now the server gives to following error: config_add_internal: DN="olcOverlay={0}rwm,olcDatabase={0}relay,olcOverlay={0}translucent,olcDatabase={1}hdb,cn=config" not child of DN="olcOverlay={0}translucent,olcOverlay={1}hdb,cn=config" Adding some debug output I see that the server is testing if the olcOverlay={0}rwm entry is a child of olcDatabase={-1}relay,olcOverlay={0}translucent,olcOverlay={1}hdb,cn=config. But the relay Database is added with an id of 0. Where does the mysterious "-1" come from? I have seen this in the translucent source: backend_db_init( "ldap", &ov->db, -1, NULL ) Is this maybe the cause? I tried to change this "-1" to "0", but nothing changes. I read somewhere, that the translucent overlay is only supposed to work with the ldap backend. But as far as I can see, I need the same rewriting using the rwm overlay with the ldap backend. So that should not work either. Could someone give me a clue, how to get this working? Thanks, Alex

1 0

How enforce TLS connection to openldap server only?
by Yan Gong 20 Sep '12

20 Sep '12

Sir/Madam: I successfully set up TLS on both openldap server and client through port 389 on ubuntu. I didn't use SSL through port 636. However, I found non encrypted/clear text connections can be made through port 389 to the openldap server as well. How can I enforce TLS connection only and reject any non encrypted connections? Should I use olcAccess or olcSecurity? or both? I couldn't find any detailed steps/documentation about it. Please note, I am not use slapd.conf which is for older version of openldap. Thanks a lot! Yan Thanks a lot! Yan

2 1

Problem when I use alias with deferencing option
by Paola Laguzzi 19 Sep '12

19 Sep '12

Hi, I have a problem when I use the alias. I have an OpenLdap with 450.000 entries and 450.000 alias. When I make a search using the deferencing I obtain a wrong result. For example: - if I search in the alias tree uid=xxxx I obtain zero entry but I have the alias and I have the phisical entry - if I search in the alias tree ou=xxxx I obtain a number of entries that is different from same search performed on the phisical tree This happens only when I use the deferencing option. Why? I find in Internet that: "If you have a thousand or more alias objects, avoid alias dereferencing in the search" .... this means I could get wrong results using alias? Thanks in advance Regards Paola

2 2

Replace nis schema to rfc2307bis.
by Daniel Lopes de Carvalho 19 Sep '12

19 Sep '12

Hello, I'm new to LDAP cn=config and I would like to replace nis schema to rfc2307bis. Is there a way to do this? Someone could help me? I'm using Debian Squeeze 6.0.5 with LDAP 2.4.23-7.2. Thanks and best regards. Daniel

3 2

questions to differences between RFC2253 & RFC4514
by Peter Marschall 19 Sep '12

19 Sep '12

Hi, I am currently in the process of updating the DN parsing routines of perl-ldap and found some differences on border cases between RFC 2253 & RFC 4514 As you are more knowledgeable than I in LDAP (you wrote the specs ;-), could you please give me your opinion on the test cases below and whether my interpretations are correct. Thanks in advance for your help Peter <OU=Sales+CN=J. Smith;O=Widget Inc.;C=US> * illegal in RFC 4514 [I guess this is wrong;-] * in RFC 2253 [ { 'CN' => 'J. Smith', 'OU' => 'Sales' }, { 'O' => 'Widget Inc.' }, { 'C' => 'US' } ]; <OU="Sales"+CN=J. Smith,O=Widget Inc.,C=US> * illegal in RFC 4514 * in RFC 2253 [ { 'CN' => 'J. Smith', 'OU' => 'Sales' }, { 'O' => 'Widget Inc.' }, { 'C' => 'US' } ]; <OU="Sales+CN=J. Smith",O=Widget Inc.,C=US> * illegal in RFC 4514 * in RFC 2253 [ { 'OU' => 'Sales+CN=J. Smith' }, { 'O' => 'Widget Inc.' }, { 'C' => 'US' } ]; <cn=J.\20Smith\+ou=Sales,O=Widget\20Inc.,C=US> * in RFC 4514 [ { 'CN' => 'J. Smith+ou=Sales' }, { 'O' => 'Widget Inc.' }, { 'C' => 'US' } ]; * illegal in RFC 2253 <cn=Clif Harden+IDNumber="a0125589 ",ou=tiPerson,ou=person,o=ti,c=us> * illegal in RFC 4514 * in RFC 2253 [ { 'CN' => 'Clif Harden', 'IDNUMBER' => 'a0125589 ' }, { 'OU' => 'tiPerson' }, { 'OU' => 'person' }, { 'O' => 'ti' }, { 'C' => 'us' } ]; <Cn=" Graham Barr ",OU=person,O=vc,C=us> * illegal in RFC 4514 * in RFC 2253: [ { 'CN' => ' Graham Barr ' }, { 'OU' => 'person' }, { 'O' => 'vc' }, { 'C' => 'us' } ]; <cn=" Graham \20Barr\20 ",OU=person,O=vc,C=us> * illegal in RFC 4514 * in RFC 2253: [ { 'CN' => ' Graham Barr ' }, { 'OU' => 'person' }, { 'O' => 'vc' }, { 'C' => 'us' } ]; <cn=123=345,o=xxx> * in RFC 4514: [ { 'CN' => '123=345' }, { 'O' => 'xxx' } ]; * illegal in RFC 2253 -- Peter Marschall peter(a)adpm.de

1 0

Monitoring using cn=config
by Arturo Borrero 19 Sep '12

19 Sep '12

Hi there. I'm using slapd 2.4.23-7.2 (from Debian Squeeze) and i'm unable to get monitoring running. Here is my config: file /etc/ldap/slapd.d/cn=config/olcDatabase\=\{2\}monitor.ldif dn: olcDatabase={2}monitor objectClass: olcDatabaseConfig objectClass: olcConfig objectClass: top olcDatabase: {2}monitor createTimestamp: 20120918124549Z olcAccess: {0}to * by peername.ip=127.0.0.1 read by peername.ipv6=::1 read by * none olcAddContentAcl: FALSE olcLastMod: TRUE olcMonitoring: FALSE olcReadOnly: FALSE olcMaxDerefDepth: 15 olcSyncUseSubentry: FALSE In file /etc/ldap/slapd.d/cn=config/olcDatabase\=\{1\}hdb.ldif [...] olcMonitoring=TRUE [...] The documentation isn't complete: www.openldap.org/devel/admin/monitoringslapd.html I try: root@server:~# ldapsearch -H ldapi:/// -Y EXTERNAL -s sub -b cn=Monitor SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 # extended LDIF # # LDAPv3 # base <cn=Monitor> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 32 No such object # numResponses: 1 So I guess the database for monitoring doesn't exist. Any idea? Best regards. -- Arturo Borrero González Departamento de Seguridad Informática, @NIS_CICA (twitter) Centro Informático Científico de Andalucía (CICA) Avda. Reina Mercedes s/n - 41012 - Sevilla (Spain) Tfno.: +34 955 056 600 / FAX: +34 955 056 650 Consejería de Economía, Innovación, Ciencia y Empleo Junta de Andalucía

2 1

Replication Provider consumer
by arun.sasi1＠wipro.com 19 Sep '12

19 Sep '12

Hello Team, I have configured a set up in my infra as like below. Provider in OpenLDAP 2.4.19 Consumer in OpenLDAP 2.4.28 When I replicate the data, it all get replicate properly but when I create any entry in consumer server, it is getting writes in master LDAP server. What could be the problem. Please find the below consumer configuration file. cn\=config.ldif # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 9fe00430 dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/slapd/slapd.args olcPidFile: /var/run/slapd/slapd.pid olcToolThreads: 1 structuralObjectClass: olcGlobal entryUUID: 6b8092fc-9667-1031-8a5a-358a8bc96075 creatorsName: cn=config createTimestamp: 20120919053426Z olcAllows: bind_v2 olcServerID: 1 ldap://gb0135embldap01.emb.slb.com olcTLSCACertificateFile: /etc/ssl/certs/Emb.slb.Com-CA.pem olcTLSCACertificatePath: /etc/ssl/certs/ olcTLSCertificateFile: /etc/ldap/emb.slb.com.cert.pem olcTLSCertificateKeyFile: /etc/ldap/emb.slb.com.key.pem olcLogLevel: -1 entryCSN: 20120919053444.175373Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20120919053444Z olcDatabase\=\{1\}hdb.ldif # CRC32 b10d01be dn: olcDatabase={1}hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=emb,dc=slb,dc=com olcLastMod: TRUE olcRootDN: cn=admin,dc=emb,dc=slb,dc=com olcRootPW:: e1NTSEF9b28vRlZuM0JnaEQzWVBDUi9OUGVPODJ0ZktrMzlPNlg= olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq olcDbIndex: entryUUID eq structuralObjectClass: olcHdbConfig entryUUID: 6b816632-9667-1031-8a64-358a8bc96075 creatorsName: cn=config createTimestamp: 20120919053426Z olcSyncrepl: {0}rid=365 provider=ldap://gb0135embldap01.emb.slb.com bindmethod =simple binddn="cn=admin,dc=emb,dc=slb,dc=com" credentials=Bsl@121z searchbas e="dc=emb,dc=slb,dc=com" type=refreshAndPersist retry="5 5 300 5" starttls=yes olcUpdateRef: ldap://gb0135embldap01.emb.slb.com entryCSN: 20120919053435.138086Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20120919053435Z Thanks & Regards, Arun Sasi Venmalassery ------------------------------------------------------------------------------------------------------------------------------------- Sr. Engineer - Server Management (UNIX), Wipro Ltd (Dubai) |Mob: +971 566489491 | E: arun.sasi1(a)wipro.com<mailto:koresh.dash@wipro.com> The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

1 0

Help with ACL to allow member of groupOfNames to read their entry
by Josh Miller 19 Sep '12

19 Sep '12

I am using OpenLDAP 2.4.23 on CentOS 6 and trying to setup ACLs to allow simpleSecurityObjects who are members of a groupOfNames to read their entry (but not write) and ideally not see other member attributes in that same groupOfNames. These simpleSecurityObjects exist in various OUs and reside in the same OU as the groupOfNames that they require access to. I'm using the memberOf overlay to maintain memberOf attributes within each simpleSecurityObject (which works well). Sample simpleSecurityObject and groupOfNames: uid=josh,ou=first string,dc=example,dc=com objectClass: account objectClass: simpleSecurityObject objectClass: top uid: josh dn: cn=group1,ou=first string,dc=example,dc=com objectClass: groupOfNames cn: group1 member: uid=josh,ou=first string,dc=example,dc=com Here is what I have so far for ACLs: dn: olcDatabase={1}bdb,cn=config changetype: modify add: olcAccess olcAccess: {0}to attrs=userPassword by anonymous auth by self write by group.exact="cn=ol-admins,ou=groups,dc=example,dc=com" write by * none - add: olcAccess olcAccess: {1}to dn.subtree="ou=power users,dc=example,dc=com" by anonymous auth by self write by group.exact="cn=ol-admins,ou=groups,dc=example,dc=com" write by dn.exact="uid=power users admin,ou=service accounts,dc=example,dc=com" write by dn.exact="uid=power users readonly,ou=service accounts,dc=example,dc=com" read by dn.exact="uid=global-ro,ou=service accounts,dc=example,dc=com" read by users search by * none - add: olcAccess olcAccess: {2}to dn.subtree="ou=third string,dc=example,dc=com" by self write by anonymous auth by group.exact="cn=ol-admins,ou=groups,dc=example,dc=com" write by dn.exact="uid=third string admin,ou=service accounts,dc=example,dc=com" write by dn.exact="uid=third string readonly,ou=service accounts,dc=example,dc=com" read by dn.exact="uid=global-ro,ou=service accounts,dc=example,dc=com" read by users search by * none - add: olcAccess olcAccess: {3}to dn.subtree="ou=second string,dc=example,dc=com" by self write by anonymous auth by group.exact="cn=ol-admins,ou=groups,dc=example,dc=com" write by dn.exact="uid=second string admin,ou=service accounts,dc=example,dc=com" write by dn.exact="uid=second string readonly,ou=service accounts,dc=example,dc=com" read by dn.exact="uid=global-ro,ou=service accounts,dc=example,dc=com" read by users search by * none - add: olcAccess olcAccess: {4}to dn.subtree="ou=first string,dc=example,dc=com" by self write by anonymous auth by group.exact="cn=ol-admins,ou=groups,dc=example,dc=com" write by dn.exact="uid=first string admin,ou=service accounts,dc=example,dc=com" write by dn.exact="uid=first string readonly,ou=service accounts,dc=example,dc=com" read by dn.exact="uid=global-ro,ou=service accounts,dc=example,dc=com" read by users search by * none - add: olcAccess olcAccess: {5}to dn.subtree="ou=fourth string,dc=example,dc=com" by self write by anonymous auth by group.exact="cn=ol-admins,ou=groups,dc=example,dc=com" write by dn.exact="uid=fourth string admin,ou=service accounts,dc=example,dc=com" write by dn.exact="uid=fourth string readonly,ou=service accounts,dc=example,dc=com" read by dn.exact="uid=global-ro,ou=service accounts,dc=example,dc=com" read by users search by * none - add: olcAccess olcAccess: {6}to * by self write by anonymous auth by group.exact="cn=ol-admins,ou=groups,dc=example,dc=com" write by dn.exact="uid=global-ro,ou=service accounts,dc=example,dc=com" read by dn.exact="uid=readonly,ou=people,dc=example,dc=com" read by * none I've tried placing the following ACL in various places in the list and it has failed to work each time: (re: http://www.openldap.org/doc/admin24/access-control.html) olcAccess: to attrs=member,entry by dnattr=member selfwrite by group.exact="cn=ol-admins,ou=groups,dc=example,dc=com" write by dn.exact="uid=global-ro,ou=service accounts,dc=example,dc=com" read by dn.exact="uid=readonly,ou=people,dc=example,dc=com" read by * none Any assistance would be greatly appreciated. Thanks, Josh

1 0

ldapadd long line problem
by Amol Kulkarni 18 Sep '12

18 Sep '12

Hi, I'm unable to add a long line (more than 4096 chars) in a field using ldapadd. I've openldap 2.4.30. I had 2.4.23 earlier and it used to work. So I tested again by keeping the slapd daemon of 2.4.30 but using ldapadd from 2.4.23. It works with the ldapadd from 2.4.23. Also it works in 2.4.30 if : 1. I reduce it to less than 4096. 2. I break down the long line into multiple lines. Has anyone come across this behaviour ? Is is something new added in the new version ? Thanks in advance, Amol.

1 0

Error, ldap_start_tls failed (-11)
by arun.sasi1＠wipro.com 18 Sep '12

18 Sep '12

Hello Guillaume Rousse/Team, but I can replicate with my old slave OpenLDAP servers without any issues, only changes is below. 1) Master OpenLDAP server in Ubuntu 9.04 OS and OpenLDAP version 2.4.19 2) Slave OpenLDAP servers are in Ubuntu 9.04 and OpenLDAP version 2.4.19 3) New OpenLDAP slave server in Ubuntu 12.04 and OpenLDAP Version in 2.4.28 Did we get any issue with replicattion when I replicate with old version from new slave version ? Is there any issues if I create certificate from old version OS to new version OS. Thanks -Arun Message: 2 Date: Mon, 17 Sep 2012 10:35:03 +0200 From: Guillaume Rousse <guillomovitch(a)gmail.com> To: openldap-technical(a)openldap.org Subject: Re: Error, ldap_start_tls failed (-11) Message-ID: <5056E0B7.4000909(a)gmail.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Le 16/09/2012 08:48, arun.sasi1(a)wipro.com a ?crit : > for 636 > Sep 16 10:47:26 ae0043app05 slapd[10982]: slap_client_connect: URI=ldap://gb0135embldap01.emb.slb.com:636 Error, ldap_start_tls failed (-1) > Sep 16 10:47:26 ae0043app05 slapd[10982]: do_syncrepl: rid=365 rc -1 retrying Using plain ldap protocol on port 636 is bound to fail: either use ldaps on this port, or plain ldap on port 389 with start_tls. > for 389 > Sep 16 10:31:42 ae0043app05 slapd[10282]: slap_client_connect: URI=ldap://gb0135embldap01.emb.slb.com:389 Error, ldap_start_tls failed (-11) > > I dont know how to check TLS manually... could you please help me... ldapsearch -H ldaps://your.server.tld -d 1 BTW, your problem seems to be a generic SSL issue, likely to comes from your server certificate. -- BOFH excuse #87: Password is too complex to decrypt Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

2 1

Proxy setup not caching against Active Directory
by Xavier Garcia 17 Sep '12

17 Sep '12

Dear all, I am setting up a proxy to cache queries against Active Directory, so our Postfix servers do not hammer the AD servers. To do so I am using rwm and pcache with the following configuration: overlay rwm rwm-normalize-mapped-attrs yes rwm-map attribute uid sAMAccountName rwm-map attribute mail proxyAddresses rwm-map attribute maildrop smtp rwm-map attribute mailbox imap rwm-map attribute domain msExchAcceptedDomainName rwm-map attribute * tls ldaps tls_reqcert=never overlay pcache pcache bdb 10000 1 50 900 directory /var/lib/ldap/cache cachesize 10000 #index uid,mail,maildrop,mailbox eq index uid eq index mail eq # cache configuration proxyCacheQueries 10000 pcacheAttrset 0 uid mail maildrop mailbox pcacheTemplate (uid=) 0 900 pcacheTemplate (mail=smtp:) 0 900 When running: ldapsearch -x -LLL -E pr=200/noprompt -h 127.0.0.1 \ -D "CN=username,OU=users,DC=company,DC=com" \ -w "passsssworddddd" \ -b "OU=users,DC=company,DC=com" -s sub "(mail=smtp:me@company.com)" maildrop It never gets cached. query template of incoming query = (mail=) QUERY NOT ANSWERABLE QUERY NOT CACHEABLE I have read the pcache manual many times, but I cannot find the reason. Perhaps you can find the problem. Regards, Xavier Garcia

2 1

ShadowMax is not working
by cbulist 17 Sep '12

17 Sep '12

Hi, I have set a user with ShadowMax to 15 in order to get a expiration warning but it doesn't work and the client gets login. (I'm not using Password Policy) I read some post and them reference to pam_ldap.conf on the client, but I do not see any option about it. My openldap server version is: 2.4.23-26 Any clue with this problem? Thanks!

3 4

Message to Change Password
by Soporte Ti 17 Sep '12

17 Sep '12

Hi all, I have a question to pose, I inherited a FDS or dirsrv installation, which works without problems, but I have a single detail that I would like to ask and see if they can guide me (tell them that my experience is not much in openldap) When accounts are expiring starts giving a message like this: "Your password will expire LDAP in 2 days." the point is that the user changes the password but after that continues with the message, the password expiring after 2 days as indicated in message the question is, what is the command or statement that I use to change the password without this happening again? Best regards. Cristian

3 2

Error, ldap_start_tls failed (-11)
by arun.sasi1＠wipro.com 17 Sep '12

17 Sep '12

Hello Guillaume Rousse/team, I am getting below error from the master server when I give 636 port number in my HDB config file Sep 16 06:41:59 gb0135embldap01 slapd[4672]: conn=349739 fd=39 ACCEPT from IP=163.183.2.145:43965 (IP=0.0.0.0:636) Sep 16 06:41:59 gb0135embldap01 slapd[4672]: conn=349739 fd=39 closed (TLS negotiation failure) and When I gibe 389 in my HDB config, I get below message from master server. Sep 16 06:31:51 gb0135embldap01 slapd[4672]: conn=349046 fd=38 ACCEPT from IP=163.183.2.145:49242 (IP=0.0.0.0:389) Sep 16 06:31:51 gb0135embldap01 slapd[4672]: conn=349046 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Sep 16 06:31:51 gb0135embldap01 slapd[4672]: conn=349046 op=0 STARTTLS Sep 16 06:31:51 gb0135embldap01 slapd[4672]: conn=349046 op=0 RESULT oid= err=0 text= Sep 16 06:31:51 gb0135embldap01 slapd[4672]: conn=349040 op=6 SRCH base="ou=Groups,dc=emb,dc=slb,dc=com" scope=2 deref=0 filter="(&(objectClass=sambaGroupMapping)(gidNumber=443298))" Sep 16 06:31:51 gb0135embldap01 slapd[4672]: conn=349040 op=6 SRCH attr=gidNumber sambaSID sambaGroupType sambaSIDList description displayName cn objectClass Sep 16 06:31:51 gb0135embldap01 slapd[4672]: conn=349040 op=6 SEARCH RESULT tag=101 err=0 nentries=0 text= Sep 16 06:31:51 gb0135embldap01 slapd[4672]: conn=349044 op=2 UNBIND Sep 16 06:31:51 gb0135embldap01 slapd[4672]: conn=349044 fd=19 closed Sep 16 06:31:51 gb0135embldap01 slapd[4672]: conn=349037 fd=60 closed (connection lost) but there is no much data replication happened I get below message from slave server... for 636 Sep 16 10:47:26 ae0043app05 slapd[10982]: slap_client_connect: URI=ldap://gb0135embldap01.emb.slb.com:636 Error, ldap_start_tls failed (-1) Sep 16 10:47:26 ae0043app05 slapd[10982]: do_syncrepl: rid=365 rc -1 retrying for 389 Sep 16 10:31:42 ae0043app05 slapd[10282]: slap_client_connect: URI=ldap://gb0135embldap01.emb.slb.com:389 Error, ldap_start_tls failed (-11) I dont know how to check TLS manually... could you please help me... Thanks & Regards, Arun Sasi Venmalassery ------------------------------------------------------------------------------------------------------------------------------------- Sr. Engineer - Server Management (UNIX), Wipro Ltd (Dubai) |Mob: +971 566489491 | E: arun.sasi1(a)wipro.com ________________________________________ From: openldap-technical-bounces(a)OpenLDAP.org [openldap-technical-bounces(a)OpenLDAP.org] on behalf of openldap-technical-request(a)OpenLDAP.org [openldap-technical-request(a)OpenLDAP.org] Sent: Friday, September 14, 2012 5:30 PM To: openldap-technical(a)openldap.org Subject: openldap-technical Digest, Vol 58, Issue 12 ------------------------------ Message: 3 Date: Thu, 13 Sep 2012 14:38:20 +0200 From: Guillaume Rousse <guillomovitch(a)gmail.com> To: openldap-technical(a)openldap.org Subject: Re: Error, ldap_start_tls failed (-11) Message-ID: <5051D3BC.3020207(a)gmail.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Le 13/09/2012 14:16, arun.sasi1(a)wipro.com a ?crit : > Hello Team, > > I have an issue with OpenLDAP TLS based replication > > Getting below error > slap_client_connect: URI=ldap://gb0135embldap01.emb.slb.com Error, > ldap_start_tls failed (-11) > Sep 13 16:13:34 ae0043app05 slapd[2582]: do_syncrepl: rid=365 rc -11 > retrying > > I have openLDAP in Ubuntu 9.04 version 2.4.19 then I thought to updgrade > it and first I upgraded on my consumer openldap server which I migrated > to Ubuntu 12.04 and version 2.4.28. > > I have created the certificate for my consumer from existing server. but > when I go for TLS based replication, the database is not syncing and it > is synching when remove starttls=no What does the master log say, and did you try a manual connection with the same credentials from the slave to the master, using TLS ? -- BOFH excuse #166: /pub/lunch The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

2 1

Need help on ACL
by Alexis GÜNST HORN 17 Sep '12

17 Sep '12

Hello to all, I need your help with OpenLDAP ACL. Here is my DIT : dc=example,dc=com ou=Users uid=user1 uid=user2 ou=Groups cn=... cn=... I use that to do Unix Auth with pam. It works fine. Now, i need to modify my tree like that : dc=example,dc=com ou=Users uid=user1 uid=user2 ou=Foo uid=user3 uid=user4 ou=Groups cn=... cn=... So, I've added the OU "foo" to "Ou=Users". In my network, all PCs are configured with pam_ldap reading "dc=example,dc=com". So, when i do : $ getent passwd I have : user1 user2 user3 user4 What I want : * if i'm "Ou=Users" member, for example "user1", with pam_ldap suffix : "dc=example,dc=com" : $ getent passwd user1 user2 * if i'm "Ou=Foo" member, for example "user_b", with pam_ldap suffix : "dc=example,dc=com" : $ getent passwd user3 user4 Is it possible to do so without modifying the DIT structure ? (only with ACL ?) Thanks a lot for your help. -- Alexis GÜNST HORN System administrator Exascale Computing Research

2 1

insert an olcAccess line in cn=config?
by Aaron Bennett 13 Sep '12

13 Sep '12

Hi, This might be more of an Apache Directory Studio question, so please forgive me... I'm using Apache Directory studio to edit cn=config and I have some lines like this: olcAccess: {0}to attrs=foo by <stuff> olcAccess: {1}to attrs=bar by <stuff> olcAccess: {2}to attrs=booboo <stuff> olcAccess: {3}to * by <stuff> read Order is important in these - so how do I add a value between {1} and {2}, for example? If I add olcAccess: to mailattr by <stuff> read then it goes in as oldAccess: {4} and as I understand ACLs it will never get it because the preceding * will match first, right? - Aaron --- Aaron Bennett Manager of Systems Administration Clark University ITS

3 3

Openldap to radius
by Jason Sigurdur 13 Sep '12

13 Sep '12

Hi, we have a service that only implement's ldap authentication. We would like to use radius. Is there a method to allow bridging from ldap to radius? jason

2 1

Error, ldap_start_tls failed (-11)
by arun.sasi1＠wipro.com 13 Sep '12

13 Sep '12

Hello Team, I have an issue with OpenLDAP TLS based replication Getting below error slap_client_connect: URI=ldap://gb0135embldap01.emb.slb.com Error, ldap_start_tls failed (-11) Sep 13 16:13:34 ae0043app05 slapd[2582]: do_syncrepl: rid=365 rc -11 retrying I have openLDAP in Ubuntu 9.04 version 2.4.19 then I thought to updgrade it and first I upgraded on my consumer openldap server which I migrated to Ubuntu 12.04 and version 2.4.28. I have created the certificate for my consumer from existing server. but when I go for TLS based replication, the database is not syncing and it is synching when remove starttls=no Any idea why this is causing Thanks & Regards, Arun Sasi Venmalassery ------------------------------------------------------------------------------------------------------------------------------------- Sr. Engineer - Server Management (UNIX), Wipro Ltd (Dubai) |Mob: +971 566489491 | E: arun.sasi1(a)wipro.com<mailto:koresh.dash@wipro.com> Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

2 1

Re: ACL entry creation restricted to objectClass
by deepee＠gmx.net 12 Sep '12

12 Sep '12

>> is it possible to restrict the creation of an entry to a specific >> objectClass? If so, any hint or assistance would be very welcome. >> >> Thank you very much! >> >> Background information follows here: >> >> The attrs "@person" within the following acl statement seems to have no >> effect (during creation). It seems to me attrs=entry already is granting >> access to "all values" (of all kind of attributes?): >@<objectClass name> is a shortcut for "all attributes required/allowed by >objectClass 'name'". In order to restrict access to specific values of >the objectClass attribute you need to use the form >access to attrs=objectClass val=person ... >p. Many thanks for your answer. hmmm, so my usage of @<objectClass name> sound correct to me. Please have a look into my original example: I wanted to restrict newly created entry to be of class "person" only. Thus I restricted the attrs using @person, in the hope that account-specific attributes (uid, serialNumber) are denied. Nevertheless, the logs show that an account entry is created. The sample acl statement works as intended in case of a modify-operation (ldapmodify'ing a single attribute of an existsing entry). During creation the attr=entry seems to overwrite the oc-specific restriction or slapd cannot differ between differen objectclasses and/or attributes during entry creation (ldapadd)? If I'm wrong, could you please give me a short example acl set that denies the creation of account but grants creation of person entries? Thanks again!

2 1

slapindex with mdb
by Marco Schirrmeister 12 Sep '12

12 Sep '12

Hi, when I run slapindex with my mdb backend the data.mdb files grows and grows and when the configured maxsize (100GB) is reached it stops with cannot allocate memory. 50505d1e => mdb_idl_insert_keys: c_put id failed: Cannot allocate memory (12) 50505d1e => mdb_tool_entry_reindex: txn_aborted! err=80 To test, I created a very basic config. See below. Created a test ldif file with the LDIFGen.jar with 100000 DNs. The file is 110MB. In the slapd.conf is only 1 index configured. uid with eq,sub. When I load this file with slapadd the data.mdb file gets 268MB. (Without any configured index 220MB) When I then run a slapindex, the data.mdb grows to 20GB. If I add 2 more attributes to index. data.mdb gets 36GB index givenname eq,sub index sn eq,sub My question is, is this normal? Why does the data file get's so big with a slapindex and not with a slapadd? OpenLDAP version is 2.4.32 on CentOS6 64bit. # cat /etc/openldap2.4/slapd.conf include /usr/share/openldap2.4/schema/core.schema include /usr/share/openldap2.4/schema/cosine.schema include /usr/share/openldap2.4/schema/corba.schema include /usr/share/openldap2.4/schema/inetorgperson.schema include /usr/share/openldap2.4/schema/java.schema include /usr/share/openldap2.4/schema/krb5-kdc.schema include /usr/share/openldap2.4/schema/kerberosobject.schema include /usr/share/openldap2.4/schema/misc.schema include /usr/share/openldap2.4/schema/nis.schema include /usr/share/openldap2.4/schema/openldap.schema include /usr/share/openldap2.4/schema/autofs.schema pidfile /var/run/ldap2.4/slapd.pid argsfile /var/run/ldap2.4/slapd.args modulepath /usr/lib64/oldap24/openldap2.4 moduleload back_monitor.la moduleload accesslog.la moduleload syncprov.la moduleload auditlog.la loglevel stats serverID 40 ldap://ds71.ogilvy.com database mdb suffix "dc=ogilvy,dc=com" rootdn "cn=manager,dc=ogilvy,dc=com" rootpw secret directory /var/lib/ldap2.4/ogilvy.com limits dn.exact="cn=manager,dc=ogilvy,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited sizelimit 90000 checkpoint 256 5 dbnosync maxsize 104857600000 index uid eq,sub monitoring on database config rootdn "cn=admin,cn=config" rootpw secret database monitor rootdn cn=monitor rootpw secret -- Marco

2 1

ACL entry creation restricted to objectClass
by deepee＠gmx.net 12 Sep '12

12 Sep '12

Hi, is it possible to restrict the creation of an entry to a specific objectClass? If so, any hint or assistance would be very welcome. Thank you very much! Background information follows here: The attrs "@person" within the following acl statement seems to have no effect (during creation). It seems to me attrs=entry already is granting access to "all values" (of all kind of attributes?): ----------------------- #slapd version: HEAD (also REL_ENG_2_4) ----------------------- #acl: access to dn.base="dc=example,dc=org" attrs=children by users write access to dn.one="dc=example,dc=org" attrs=entry,@person by users write by anonymous auth ----------------------- #ldapmodify -x -H "ldap://localhost:333/" -D "uid=user,dc=example,dc=org" -w user -f /tmp/example_operation.ldif ----------------------- #/tmp/example_operation.ldif: #add a person entry: dn: cn=hello,dc=example,dc=org changetype: add objectClass: person objectClass: top cn: hello sn: hello userPassword: hello #add an account entry: dn: cn=world,dc=example,dc=org changetype: add objectClass: device objectClass: top cn:world serialNumber: 1 #both operation do succeed, see log below ----------------------- #log (level 128): 5050a940 => access_allowed: result not in cache (userPassword) 5050a940 => access_allowed: auth access to "uid=user,dc=example,dc=org" "userPassword" requested 5050a940 => dn: [1] dc=example,dc=org 5050a940 => dn: [2] dc=example,dc=org 5050a940 => acl_get: [2] matched 5050a940 => acl_get: [2] attr userPassword 5050a940 => acl_mask: access to entry "uid=user,dc=example,dc=org", attr "userPassword" requested 5050a940 => acl_mask: to value by "", (=0) 5050a940 <= check a_dn_pat: users 5050a940 <= check a_dn_pat: anonymous 5050a940 <= acl_mask: [2] applying auth(=xd) (stop) 5050a940 <= acl_mask: [2] mask: auth(=xd) 5050a940 => slap_access_allowed: auth access granted by auth(=xd) 5050a940 => access_allowed: auth access granted by auth(=xd) 5050a940 => access_allowed: add access to "dc=example,dc=org" "children" requested 5050a940 => dn: [1] dc=example,dc=org 5050a940 => acl_get: [1] matched 5050a940 => acl_get: [1] attr children 5050a940 => acl_mask: access to entry "dc=example,dc=org", attr "children" requested 5050a940 => acl_mask: to all values by "uid=user,dc=example,dc=org", (=0) 5050a940 <= check a_dn_pat: users 5050a940 <= acl_mask: [1] applying write(=wrscxd) (stop) 5050a940 <= acl_mask: [1] mask: write(=wrscxd) 5050a940 => slap_access_allowed: add access granted by write(=wrscxd) 5050a940 => access_allowed: add access granted by write(=wrscxd) 5050a940 => access_allowed: add access to "cn=hello,dc=example,dc=org" "entry" requested 5050a940 => dn: [1] dc=example,dc=org 5050a940 => dn: [2] dc=example,dc=org 5050a940 => acl_get: [2] matched 5050a940 => acl_get: [2] attr entry 5050a940 => acl_mask: access to entry "cn=hello,dc=example,dc=org", attr "entry" requested 5050a940 => acl_mask: to all values by "uid=user,dc=example,dc=org", (=0) 5050a940 <= check a_dn_pat: users 5050a940 <= acl_mask: [1] applying write(=wrscxd) (stop) 5050a940 <= acl_mask: [1] mask: write(=wrscxd) 5050a940 => slap_access_allowed: add access granted by write(=wrscxd) 5050a940 => access_allowed: add access granted by write(=wrscxd) 5050a940 => access_allowed: add access to "dc=example,dc=org" "children" requested 5050a940 => dn: [1] dc=example,dc=org 5050a940 => acl_get: [1] matched 5050a940 => acl_get: [1] attr children 5050a940 => acl_mask: access to entry "dc=example,dc=org", attr "children" requested 5050a940 => acl_mask: to all values by "uid=user,dc=example,dc=org", (=0) 5050a940 <= check a_dn_pat: users 5050a940 <= acl_mask: [1] applying write(=wrscxd) (stop) 5050a940 <= acl_mask: [1] mask: write(=wrscxd) 5050a940 => slap_access_allowed: add access granted by write(=wrscxd) 5050a940 => access_allowed: add access granted by write(=wrscxd) 5050a940 => access_allowed: add access to "cn=world,dc=example,dc=org" "entry" requested 5050a940 => dn: [1] dc=example,dc=org 5050a940 => dn: [2] dc=example,dc=org 5050a940 => acl_get: [2] matched 5050a940 => acl_get: [2] attr entry 5050a940 => acl_mask: access to entry "cn=world,dc=example,dc=org", attr "entry" requested 5050a940 => acl_mask: to all values by "uid=user,dc=example,dc=org", (=0) 5050a940 <= check a_dn_pat: users 5050a940 <= acl_mask: [1] applying write(=wrscxd) (stop) 5050a940 <= acl_mask: [1] mask: write(=wrscxd) 5050a940 => slap_access_allowed: add access granted by write(=wrscxd) 5050a940 => access_allowed: add access granted by write(=wrscxd)

2 1

pam_password exop
by teoman.onay＠degroof.be 12 Sep '12

12 Sep '12

Hi, Could you give me some more info on that parameter : pam_password exop All what i've found is this : The directive "pam_password exop" tells pam-ldap to change passwords in a way that allows OpenLDAP to apply the hashing algorithm specified in /etc/ldap/slapd.conf, instead of attempting to hash locally and write the result directly into the database. Does this mean that the password is sent clear to the ldap server then hashed over there ? It looks like a huge security flaw ... i've used tcpdump and unfortunately my password appears clearly ... using does imply enabling TLS ? Regards Teoman ONAY P before printing this email, think about the environment. ******************************************************************************* This e-mail is intended only for the person or entity to which it is addressed. It may contain confidential and/or privileged information. Any copying, disclosure, distribution or other use of the content of this e-mail by persons or entities other than the intended recipient is prohibited. Please contact immediately the sender if you have received this e-mail in error and delete it from all locations of your computer. The company on behalf of which the present e-mail is sent is validly committed only if the rules on the delegation of powers, as set out in the appropriate documents, have been complied with. Furthermore, due to the risks inherent to the use of the Internet, the company is not liable for the content of this e-mail if altered, changed or falsified. *******************************************************************************

4 6

HashCat for {CRYPT}
by Selcuk Yazar 12 Sep '12

12 Sep '12

Hi, Can ve decrypt OpenLDAP userpassword object values with HasCat ? i try with md5 hash type but it gaves line length exception oclHashcat-plus64.exe --hash-type 500 C:\hashcat\oclHashcat-plus\example500.hash C:\rockyou.txt C:\hashcat\oclHashcat-plus\example.dict thanks in advance -- Selçuk YAZAR

2 1

mdb - no space left?
by Frank Swasey 11 Sep '12

11 Sep '12

I'm experimenting with mdb to replace hdb on my test/development set of servers. I've built 2.4.32 and the server is running RHEL 6.3. This morning, I got a confusing error. Attempting to perform a deletion of a member from a groupOfNames, the following was recorded in syslog: mdb_id2entry_put: mdb_put failed: No space left on device(28) "cn=GroupNameNotImportant,ou=groups,dc=uvm,dc=edu" and ldapmodify returned: modifying entry "cn=GroupNameNotImportant,ou=Groups,dc=uvm,dc=edu" ldap_modify: Other (e.g., implementation specific) error (80) additional info: entry update failed However, free shows memory left, df shows filesystem space left (in fact, it is only 22% used) and data.mdb is -rw------- 1 ldap ldap 1547292672 Sep 8 06:22 data.mdb while the maxsize parameter is set to: maxsize 85899345920 So, I am confused about which device mdb is telling me is out of space. What have I missed? -- Frank Swasey | http://www.uvm.edu/~fcs Sr Systems Administrator | Always remember: You are UNIQUE, University of Vermont | just like everyone else. "I am not young enough to know everything." - Oscar Wilde (1854-1900)

4 5

OpenLdap Proxy with CentOS 6.3
by GERF 11 Sep '12

11 Sep '12

Hello all, I have been working with this project for a straight two weeks and i feel lost or stuck. The goal is to query Windows AD from the linux box located in the DMZ So, in my virtual lab I have the following: Windows AD with ip 172.16.5.16 ldap1.gerf02.local CentOS 6.3 with ip 172.16.5.32 upildap01.gerf02.local So, my configuration files are as follows: -*-*-*-*-*-*-*-*-*/etc/openldap/ldap.conf:-*-*-*-*-*-*-*-*-*-* BASE dc=gerf02,dc=local URI ldap://172.16.5.16 ldap://172.16.5.16:636 #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never #TLS_CACERTDIR /etc/openldap/certs TLS_CACERTDIR /etc/pki/tls/certs/stratus_cert.pem *-*--**-*-*-*-*-*-*-*-*-*-*-*-*-*-*-* *-*-*-*-*-*-**-*-*-*-/etc/sysconfig/ldap-*-*-*-*-*-*-*-*-*-*-*-*-*-* SLAPD_LDAP=yes SLAPD_LDAPI=yes SLAPD_LDAPS=yes -**-*-**-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-**-*-*-* -*-*-*-*-*-*-*-*-**-*/etc/openldap/slapd.d/cn=config/olcDatabase={2}bdb.ldif-*-*-*-*-*-*-*-*-*-*-*-*** dn: olcDatabase={2}bdb objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {2}bdb olcSuffix: dc=gerf02,dc=local olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=Ldap Bind Account,dc=gerf02,dc=local olcSyncUseSubentry: FALSE olcMonitoring: TRUE olcDbDirectory: /var/lib/ldap olcDbCacheSize: 1000 olcDbCheckpoint: 1024 15 olcDbNoSync: FALSE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 0 olcDbIndex: objectClass pres,eq olcDbIndex: cn pres,eq,sub olcDbIndex: uid pres,eq,sub olcDbIndex: uidNumber pres,eq olcDbIndex: gidNumber pres,eq olcDbIndex: ou pres,eq,sub olcDbIndex: loginShell pres,eq olcDbIndex: mail pres,eq,sub olcDbIndex: sn pres,eq,sub olcDbIndex: givenName pres,eq,sub olcDbIndex: memberUid pres,eq,sub olcDbIndex: nisMapName pres,eq,sub olcDbIndex: nisMapEntry pres,eq,sub olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 structuralObjectClass: olcBdbConfig entryUUID: 0a5111d8-8f04-1031-8728-33c9f43311c7 creatorsName: cn=config createTimestamp: 20120909195524Z entryCSN: 20120909195524.946151Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20120909195524Z olcRootPW: {SSHA}2LzGLoDUm/iPav9Ijm/nLfAtxn9WndvP olcTLSCertificateFile: /etc/pki/tls/certs/stratus_cert.pem olcTLSCertificateKeyFile: /etc/pki/tls/certs/stratus_key.pem -**--**-*-*--*-*-*-**-*-*-*-*--*-*-*-**-*-**-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-***-** -**-*-*-*-*-*-*-*-**-/etc/openldap/slapd.d/cn=config/olcDatabase={1}monitor.ldif-*-*-*-*-*-*-*-***-*-* dn: olcDatabase={1}monitor objectClass: olcDatabaseConfig olcDatabase: {1}monitor olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=externa l,cn=auth" read by dn.base="cn=Ldap Bind Account,dc=gerf02,dc=local" read by * break olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcSyncUseSubentry: FALSE olcMonitoring: FALSE structuralObjectClass: olcDatabaseConfig entryUUID: 0a5108dc-8f04-1031-8727-33c9f43311c7 creatorsName: cn=config createTimestamp: 20120909195524Z entryCSN: 20120909195524.946151Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20120909195524Z -**--**-*-*--*-*-*-**-*-*-*-*--*-*-*-**-*-**-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-***-**-*-*---*-*-** So, when I execute the following, I get this message ldapsearch -x -b dc=gerf02,dc=local -D cn=Ldap Bind Account,dc=gerf02,dc=local -W Enter LDAP Password: ldap_bind: Invalid credentials (49) additional info: 80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 52e, v1db1 Thanks for your help, G

2 3

Re: Execute a Filter and get the boolean status true/false
by Puneet Khunteta 11 Sep '12

11 Sep '12

Hello, Basically i need the count how many SearchResultEntry responses you get from ldap_search_s(). Note : Pardon, i have mistakenly typed "ldap_search()" instead of "ldap_search_s() "true/false for the particular filter" means following : 1.) If execute a filter , respond with >0 entry ---> true 2.) If execute a filter , respond with = 0 entry --> false. Note : i have nothing to do with the attributes for the corresponding entries return for the search. So i am looking for a optimized way here which just let me know if any entry is available or not for particular filter. Regards, PKHUN On Wed, Sep 5, 2012 at 11:17 PM, Pierangelo Masarati < pierangelo.masarati(a)polimi.it> wrote: > > > Hello, > > > > I am facing an issue to get the result of a filter. > > > > Currently i have used the ldap_search () function to see whether AD has > > some entity corresponding to particular filter execution. > > But i am not able to find the function which returns the number of > entity > > for the particular filter execution. > > Please help me to get the correct function which return the number of > > entity for the particular filter execution and what pre-requesties it > has. > > You need to count how many SearchResultEntry responses you get from > ldap_search(). Or, if slapd is configured to use the "noopsrch" module, > which implements the "noopsrch" control > <http://www.openldap.org/faq/data/cache/1509.html>, you get no results but > a control response that indicates, among other things, how many entries > would be returned by that search. I'm not sure what you mean by > "pre-requesties". > > > If possible, please suggest function which just return true/false for the > > particular filter. > > Please specify what "true/false for the particular filter" means. > > p. > > -- > Pierangelo Masarati > Associate Professor > Dipartimento di Ingegneria Aerospaziale > Politecnico di Milano > >

3 9

RE: OPENLDAP 2.4.32 INSTALLATION TEST ERRORS
by Quanah Gibson-Mount 10 Sep '12

10 Sep '12

--On Friday, September 07, 2012 4:16 PM -0400 "Borresen, John - 0442 - MITLL" <john.borresen(a)ll.mit.edu> wrote: > Thanks, Quanah; > > I just noticed that memberof is set to yes and refint is set to mod. I > could try both as yes, and see if it happens that way, too. That would be worth a test, thanks. Your configure is awfully odd. Why such a mix of modules and built in? I'd just do everything modular myself. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

3 2

Failing syncrepl connections because of an older contextCSN on the master
by Ivan Nejgebauer 10 Sep '12

10 Sep '12

OpenLDAP version(s): 2.4.32 and recent git master (54a111907b48900e1ce5de12a9d87818a334423d) OS: CentOS 5, 32-bit In a master/slave delta-syncrepl configuration, syncrepl connections from the fully synchronized and restarted slave to the freshly loaded master will fail because the master uses an earlier contextCSN. This state persists until the first modification on the master, when the contextCSN will become newer than the consumer's, whose next syncrepl retry will then succeed. Details (master and slave configurations are attached to this message): The master is freshly loaded with the following LDIF: dn: dc=example,dc=com objectClass: locality objectClass: dcObject dc: example dn: ou=People,dc=example,dc=com objectClass: organizationalUnit ou: People When the master is started, there is only one entry in cn=accesslog: dn: cn=accesslog objectClass: auditContainer cn: accesslog structuralObjectClass: auditContainer entryDN: cn=accesslog subschemaSubentry: cn=Subschema contextCSN: 20120910091205.088888Z#000000#000#000000 hasSubordinates: FALSE The root entry of the main database looks like this: dn: dc=example,dc=com objectClass: locality objectClass: dcObject dc: example structuralObjectClass: locality entryUUID: 921f3734-24fc-4efa-ac52-10aa4d293332 creatorsName: cn=Manager,dc=example,dc=com createTimestamp: 20120910090757Z entryCSN: 20120910090757.483217Z#000000#000#000000 modifiersName: cn=Manager,dc=example,dc=com modifyTimestamp: 20120910090757Z entryDN: dc=example,dc=com subschemaSubentry: cn=Subschema auditContext: cn=accesslog contextCSN: 20120910091205.089003Z#000000#000#000000 hasSubordinates: TRUE When the slave server (with an empty database) is started, it connects to the master and synchronizes. Their synchronization dialog, captured with -d sync, looks like this: (master) 504db377 syncprov_search_response: cookie=rid=000,csn=20120910091205.089003Z#000000#000#000000 504db377 syncprov_search_response: cookie=rid=000,csn=20120910091205.088888Z#000000#000#000000 (slave) 504db370 syncrepl_message_to_entry: rid=000 DN: dc=example,dc=com, UUID: 921f3734-24fc-4efa-ac52-10aa4d293332 504db370 syncrepl_entry: rid=000 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) 504db370 syncrepl_entry: rid=000 inserted UUID 921f3734-24fc-4efa-ac52-10aa4d293332 504db370 syncrepl_entry: rid=000 be_search (32) 504db370 syncrepl_entry: rid=000 dc=example,dc=com 504db370 syncrepl_entry: rid=000 be_add dc=example,dc=com (0) 504db370 syncrepl_message_to_entry: rid=000 DN: ou=People,dc=example,dc=com, UUID: 08fe53fb-724a-4eca-a57e-3c271d99dd7e 504db370 syncrepl_entry: rid=000 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) 504db370 syncrepl_entry: rid=000 inserted UUID 08fe53fb-724a-4eca-a57e-3c271d99dd7e 504db370 syncrepl_entry: rid=000 be_search (0) 504db370 syncrepl_entry: rid=000 ou=People,dc=example,dc=com 504db370 syncrepl_entry: rid=000 be_add ou=People,dc=example,dc=com (0) 504db370 do_syncrep2: rid=000 LDAP_RES_SEARCH_RESULT 504db370 do_syncrep2: rid=000 cookie=rid=000,csn=20120910091205.089003Z#000000#000#000000 504db370 slap_queue_csn: queing 0x836dcf8 20120910091205.089003Z#000000#000#000000 504db370 slap_graduate_commit_csn: removing 0x8371328 20120910091205.089003Z#000000#000#000000 504db370 do_syncrep2: rid=000 LDAP_RES_INTERMEDIATE - REFRESH_DELETE 504db370 do_syncrep2: rid=000 cookie=rid=000,csn=20120910091205.088888Z#000000#000#000000 The master sends the cookie with the contextCSN belonging to cn=accesslog. If the slave is now restarted, what happens is this: 504db38d do_syncrep2: rid=000 LDAP_RES_SEARCH_RESULT 504db38d do_syncrep2: rid=000 LDAP_RES_SEARCH_RESULT (53) Server is unwilling to perform 504db38d do_syncrep2: rid=000 (53) Server is unwilling to perform 504db38d do_syncrepl: rid=000 rc -2 retrying The slave sends csn=20120910091205.089003Z#000000#000#000000, but the master uses csn=20120910091205.088888Z#000000#000#000000. When the master is subsequently modified, it will use a newer contextCSN, and the slave's next retry will succeed. Is this worthy of an ITS, since the situation is unlikely to occur in practice, and will correct itself, only leaving the slave out of sync for the duration of the retry interval? i. include ../servers/slapd/schema/core.schema argsfile master/run/slapd.args pidfile master/run/slapd.pid database mdb suffix cn=accesslog directory master/accesslog index entryCSN,objectClass,reqEnd,reqResult,reqStart eq overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE database mdb suffix "dc=example,dc=com" rootdn "cn=Manager,dc=example,dc=com" rootpw secret maxsize 256000000 directory master/main index objectClass eq index entryCSN,entryUUID eq overlay syncprov syncprov-checkpoint 1000 60 overlay accesslog logdb cn=accesslog logops writes logsuccess TRUE logpurge 07+00:00 01+00:00 include ../servers/slapd/schema/core.schema argsfile replica/run/slapd.args pidfile replica/run/slapd.pid database mdb suffix "dc=example,dc=com" rootdn "cn=Manager,dc=example,dc=com" rootpw secret maxsize 256000000 directory replica/main index objectClass eq index entryUUID eq syncrepl rid=0 provider=ldap://localhost:6389/ bindmethod=simple binddn="cn=Manager,dc=example,dc=com" credentials=secret searchbase="dc=example,dc=com" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" schemachecking=on type=refreshAndPersist retry="60 +" syncdata=accesslog updateref "ldap://localhost:6389"

1 0

Object class violation/assertion when adding dynamic chaining configuration
by Ivan Nejgebauer 10 Sep '12

10 Sep '12

OpenLDAP version(s): 2.4.32 and recent git master (54a111907b48900e1ce5de12a9d87818a334423d) OS: CentOS 5, 32-bit While preparing the test cases for ITS#7381 (q.v.) I encountered two issues when trying to add an instance of olcLDAPConfig below the chaining overlay entry. If the instance entry looks like this... dn: olcDatabase={0}ldap,olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config objectClass: olcLDAPConfig objectClass: olcChainDatabase olcDatabase: {0}ldap ...adding the entry (with ldapadd) fails with Error 65 (Object class violation). The server logs the following: 504717ff slapd-chain: subsequent underlying database "olcDatabase={0}ldap,olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config" must contain attribute "olcDbURI". 504717ff conn=1000 op=2: config_add_internal: DN="olcDatabase={0}ldap,olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config" no structural objectClass add function Note that converting a minimal chaining configuration with slaptest generates an olcLDAPConfig entry without an olcDbURI, and that olcDbURI is not listed as a MUST attribute for olcLDAPConfig. Furthermore, if I try to add an olcLDAPConfig entry with an empty olcDbURI... dn: olcDatabase={0}ldap,olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config objectClass: olcLDAPConfig objectClass: olcChainDatabase olcDatabase: {0}ldap olcDbURI: "" ...it triggers an assertion: slapd: chain.c:224: ldap_chain_uri_cmp: Assertion `li2->li_bvuri != ((void *)0)' failed. Should I file an ITS for those two issues (or maybe two separate ITSs), or is this a "don't do that" scenario? i.

1 0

Roles in OpenLDAP with back-sql
by David Rose 08 Sep '12

08 Sep '12

Hi everyone, Is anybody know if it's possible to define roles in OpenLDAP using back-sql? Here's the thing, we need to prevent some of our users to see "everything". We need to filter results for some groups of users. But we need these rules in the database (Postgres) to be able to change them dynamically. Problem is that, currently, when a user send a search query, OpenLDAP does not include in any way the DN of the user who made the query. As a result we have trouble creating scopes by user/group. Thanks

3 3

OPENLDAP 2.4.32 INSTALLATION TEST ERRORS
by Borresen, John - 0442 - MITLL 07 Sep '12

07 Sep '12

All, Any help would be great in resolving the following. I am installing, as the subject states, OpenLDAP_2.4.32 on a CentOS 5.8 x86_64 bit machine(VM). When running the 'make test', it runs for about 30-minutes (it seems) then it bombs out with the following error: >>>>> Starting test057-memberof-refint for hdb... running defines.sh Starting slapd on TCP/IP port 9011... Running ldapadd to build slapd config database... ldapadd failed (21)! >>>>> test057-memberof-refint failed for hdb (exit 21) make[2]: *** [hdb-mod] Error 21 make[2]: Leaving directory `/root/downloads/openldap-2.4.32/tests' make[1]: *** [test] Error 2 make[1]: Leaving directory `/root/downloads/openldap-2.4.32/tests' make: *** [test] Error 2 Looking in the testrun directory for any clues, I find: Test.out: # cat test.out ldap_add: Invalid syntax (21) additional info: objectClass: value #1 invalid per syntax adding new entry "olcDatabase={1}hdb,cn=config" adding new entry "olcOverlay={0}memberof,olcDatabase={1}hdb,cn=config" adding new entry "olcOverlay={1}refint,olcDatabase={1}hdb,cn=config" Then, in the slapd.1.log file: 504a441d conn=1001 op=2 do_add ber_scanf fmt ({m) ber: 504a441d conn=1001 op=2 do_add: dn (olcOverlay={0}memberof,olcDatabase={1}hdb,cn=config) ber_scanf fmt ({m{W}}) ber: ber_scanf fmt ({m{W}}) ber: ber_scanf fmt ({m{W}}) ber: ber_scanf fmt ({m{W}}) ber: ber_scanf fmt ({m{W}}) ber: ber_scanf fmt ({m{W}}) ber: ber_scanf fmt (}) ber: 504a441d >>> dnPrettyNormal: <olcOverlay={0}memberof,olcDatabase={1}hdb,cn=config> => ldap_bv2dn(olcOverlay={0}memberof,olcDatabase={1}hdb,cn=config,0) <= ldap_bv2dn(olcOverlay={0}memberof,olcDatabase={1}hdb,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcOverlay={0}memberof,olcDatabase={1}hdb,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcOverlay={0}memberof,olcDatabase={1}hdb,cn=config)=0 504a441d <<< dnPrettyNormal: <olcOverlay={0}memberof,olcDatabase={1}hdb,cn=config>, <olcOverlay={0}memberof,olcDatabase={1}hdb,cn=config> 504a441d conn=1001 op=2 ADD dn="olcOverlay={0}memberof,olcDatabase={1}hdb,cn=config" 504a441d oc_check_required entry (olcOverlay={0}memberof,olcDatabase={1}hdb,cn=config), objectClass "olcMemberOf" 504a441d oc_check_allowed type "objectClass" 504a441d oc_check_allowed type "olcOverlay" 504a441d oc_check_allowed type "olcMemberOfRefInt" 504a441d oc_check_allowed type "olcMemberOfGroupOC" 504a441d oc_check_allowed type "olcMemberOfMemberAD" 504a441d oc_check_allowed type "olcMemberOfMemberOfAD" 504a441d oc_check_allowed type "structuralObjectClass" 504a441d slap_queue_csn: queing 0x4362d690 20120907185941.705554Z#000000#000#000000 504a441d ldif_back_add: "olcOverlay={0}memberof,olcDatabase={1}hdb,cn=config" 504a441d oc_check_required entry (olcOverlay={0}memberof,olcDatabase={1}hdb,cn=config), objectClass "olcMemberOf" 504a441d oc_check_allowed type "objectClass" 504a441d oc_check_allowed type "olcOverlay" 504a441d oc_check_allowed type "olcMemberOfRefInt" 504a441d oc_check_allowed type "olcMemberOfGroupOC" 504a441d oc_check_allowed type "olcMemberOfMemberAD" 504a441d oc_check_allowed type "olcMemberOfMemberOfAD" 504a441d oc_check_allowed type "structuralObjectClass" 504a441d oc_check_allowed type "entryUUID" 504a441d oc_check_allowed type "creatorsName" 504a441d oc_check_allowed type "createTimestamp" 504a441d oc_check_allowed type "entryCSN" 504a441d oc_check_allowed type "modifiersName" 504a441d oc_check_allowed type "modifyTimestamp" 504a441d ldif_read_file: entry file exists: "/root/downloads/openldap-2.4.32/tests/testrun/confdir/cn=config/olcDatabase ={1}hdb.ldif" 504a441d ldif_write_entry: wrote entry "olcOverlay={0}memberof,olcDatabase={1}hdb,cn=config" 504a441d ldif_back_add: err: 0 text: 504a441d send_ldap_result: conn=1001 op=2 p=3 504a441d send_ldap_result: err=0 matched="" text="" 504a441d send_ldap_result: conn=1001 op=2 p=3 504a441d send_ldap_result: err=0 matched="" text="" 504a441d send_ldap_response: msgid=3 tag=105 err=0 ber_flush2: 14 bytes to sd 8 504a441d conn=1001 op=2 RESULT tag=105 err=0 text= 504a441d slap_graduate_commit_csn: removing 0x51f0320 20120907185941.705554Z#000000#000#000000 504a441d connection_get(8) 504a441d connection_get(8): got connid=1001 504a441d connection_read(8): checking for input on id=1001 ber_get_next ber_get_next: tag 0x30 len 180 contents: 504a441d op tag 0x68, time 1347044381 ber_get_next 504a441d conn=1001 op=3 do_add ber_scanf fmt ({m) ber: 504a441d conn=1001 op=3 do_add: dn (olcOverlay={1}refint,olcDatabase={1}hdb,cn=config) ber_scanf fmt ({m{W}}) ber: ber_scanf fmt ({m{W}}) ber: ber_scanf fmt ({m{W}}) ber: ber_scanf fmt (}) ber: 504a441d >>> dnPrettyNormal: <olcOverlay={1}refint,olcDatabase={1}hdb,cn=config> => ldap_bv2dn(olcOverlay={1}refint,olcDatabase={1}hdb,cn=config,0) <= ldap_bv2dn(olcOverlay={1}refint,olcDatabase={1}hdb,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcOverlay={1}refint,olcDatabase={1}hdb,cn=config)=0 => ldap_dn2bv(272) <= ldap_dn2bv(olcOverlay={1}refint,olcDatabase={1}hdb,cn=config)=0 504a441d <<< dnPrettyNormal: <olcOverlay={1}refint,olcDatabase={1}hdb,cn=config>, <olcOverlay={1}refint,olcDatabase={1}hdb,cn=config> 504a441d conn=1001 op=3 ADD dn="olcOverlay={1}refint,olcDatabase={1}hdb,cn=config" 504a441d send_ldap_result: conn=1001 op=3 p=3 504a441d send_ldap_result: err=21 matched="" text="objectClass: value #1 invalid per syntax" 504a441d send_ldap_response: msgid=4 tag=105 err=21 ber_flush2: 54 bytes to sd 8 504a441d conn=1001 op=3 RESULT tag=105 err=21 text=objectClass: value #1 invalid per syntax 504a441d connection_get(8) 504a441d connection_get(8): got connid=1001 504a441d connection_read(8): checking for input on id=1001 ber_get_next ber_get_next: tag 0x30 len 5 contents: 504a441d op tag 0x42, time 1347044381 ber_get_next 504a441d ber_get_next on fd 8 failed errno=0 (Success) 504a441d conn=1001 op=4 do_unbind 504a441d conn=1001 op=4 UNBIND 504a441d connection_close: conn=1001 sd=8 504a441d conn=1001 fd=8 closed 504a441d daemon: shutdown requested and initiated. 504a441d slapd shutdown: waiting for 0 operations/tasks to finish 504a441d slapd shutdown: initiated 504a441d ====> bdb_cache_release_all 504a441d slapd destroy: freeing system resources. 504a441d slapd stopped. Dave Borresen Solaris/Linux Systems Administrator Surveillance Systems Group (Group 42) MIT Lincoln Laboratory 244 Wood Street Lexington, MA 02420 P: 781-981-2954 F: 781-981-5344 john.borresen(a)ll.mit.edu

2 2

Re: Roles in OpenLDAP with back-sql
by Dan White 07 Sep '12

07 Sep '12

(CCing the list) On 09/07/12 17:02 +0200, David Rose wrote: >On 09/07/2012 04:17 PM, Dan White wrote: >> On 09/07/12 15:59 +0200, David Rose wrote: >>> Hi everyone, >>> >>> Is anybody know if it's possible to define roles in OpenLDAP using >>> back-sql? >>> >>> Here's the thing, we need to prevent some of our users to see >>> "everything". We need to filter results for some groups of users. But >>> we need these rules in the database (Postgres) to be able to change >>> them dynamically. >> >> Consider using the dynamic slapd-config backend instead. See chapters 5 >> and 8 of the OpenLDAP Administrator's Guide. > >We have a WebApp that stores all its data in Pg and we'd like to access >it using LDAP without having to replicate the database. And AFAIK >slapd-config and back-sql aren't compatible. I don't know. >>> Problem is that, currently, when a user send a search query, OpenLDAP >>> does not include in any way the DN of the user who made the query. >> >> That seems counterintuitive. Are your users binding anonymously? If so, >> don't do that. > >None of our users are bind anonymously. They're logged in, LDAP knows >who's logged in, but doesn't tell Pg when a search query is passed. How do they 'log in'. Do they bind using user credentials directly to the LDAP server, or do they log in to a website? If the latter, then see if your webapp supporting binding *using the user's credentials* when querying the ldap server. Or see if it supports binding with an authz identity matching the user. -- Dan White

2 2

TLS error - TLS accept failure error=1
by cbulist 06 Sep '12

06 Sep '12

Hi, I have problem configuring TLS in my server (2.4.23). I got the error TLS accept failure error=1 when a client tries to log in using ssh. But if I do a ldapsearch from the client machine to the server I don't have problem and I get the answer from the server: ldapsearch -x -H ldaps://serverldap -D "cn=Manager,dc=sample,dc=com" -W -b "dc=sample,dc=com" 'uid=user1' These are my config files: The client ldap.conf: URI ldaps://serverldap BASE dc=sample,dc=com TLS_CACERT /etc/openldap/cacerts/server.pem The server slapd.conf TLSCACertificateFile /etc/openldap/certs/server.pem TLSCertificateFile /etc/openldap/certs/server.pem TLSCertificateKeyFile /etc/openldap/certs/server.pem The /etc/sysconfig/ldap.conf SLAPD_LDAPS=yes Any help? Thanks!

1 0

Editing the olcAccess
by S, Mohan (GE Energy) 06 Sep '12

06 Sep '12

Hi, I've configured olcAccess for my bdb database and I can't able to modify that using ldapmodify. I tried deleting that : ldapmodify -x -h xxx.example.org -D "cn=replicator,ou=admins,dc=example,dc=org" -w secret -f delete.ldif No error cat delete.ldif changetype: modify delete: olcAccess olcAccess: {0} olcAccess: {1} ldapmodify -x -h xxx.example.org -D "cn=replicator,ou=admins,dc=example,dc=org" -w secret -f add.ldif No error cat add.ldif changetype: modify add: olcAccess olcAccess: to attrs=userPassword by self write by anonymous auth by dn.children="ou=admins,dc=example,dc=org" write by * none olcAccess: to * by self write by dn.children="ou=admins,dc=example,dc=org" write by * read olcAccess: to * by self write by dn.children="ou=melbourne,dc=example,dc=org" write by * read my ldapsearch -xLLL -b cn=config -D cn=admin,cn=config -W olcDatabase={1}bdb returns old olcaccess. New access are not getting reflected. Can anyone guide my how to add/edit olcaccess? Can anyone please help me ... Thanks, Mohan

2 1

RE: Editing the olcAccess
by S, Mohan (GE Energy) 06 Sep '12

06 Sep '12

I could able to do this.. I missed the line in my ldif file dn: olcDatabase={2}bdb,cn=config. Apologize Regards, Mohan From: S, Mohan (GE Energy) Sent: Thursday, September 06, 2012 8:26 PM To: openldap-technical(a)openldap.org Subject: Editing the olcAccess Hi, I've configured olcAccess for my bdb database and I can't able to modify that using ldapmodify. I tried deleting that : ldapmodify -x -h xxx.example.org -D "cn=replicator,ou=admins,dc=example,dc=org" -w secret -f delete.ldif No error cat delete.ldif changetype: modify delete: olcAccess olcAccess: {0} olcAccess: {1} ldapmodify -x -h xxx.example.org -D "cn=replicator,ou=admins,dc=example,dc=org" -w secret -f add.ldif No error cat add.ldif changetype: modify add: olcAccess olcAccess: to attrs=userPassword by self write by anonymous auth by dn.children="ou=admins,dc=example,dc=org" write by * none olcAccess: to * by self write by dn.children="ou=admins,dc=example,dc=org" write by * read olcAccess: to * by self write by dn.children="ou=melbourne,dc=example,dc=org" write by * read my ldapsearch -xLLL -b cn=config -D cn=admin,cn=config -W olcDatabase={1}bdb returns old olcaccess. New access are not getting reflected. Can anyone guide my how to add/edit olcaccess? Can anyone please help me ... Thanks, Mohan

1 0

ACL (Regex) help needed
by Denny Schierz 06 Sep '12

06 Sep '12

hi, I have the following structure: cn=foobar,ou=aliases,dc=domain1,ou=mail,ou=services,ou=department,dc=domain,dc=foo cn=foobar1,ou=aliases,dc=domain2,ou=mail,ou=services,ou=department,dc=domain,dc=foo cn=foobar2,ou=aliases,dc=domain2,ou=mail,ou=services,ou=department,dc=domain,dc=foo cn=foobar likes like: dn: foobar,ou=aliases,dc=domain1,ou=mail,ou=services,ou=department,dc=domain,dc=foo objectClass: inetLocalMailRecipient objectClass: person objectClass: top cn: admin sn: admin description: added_by_dekanat mailLocalAddress: sysop(a)department.domain.foo mailRoutingAddress: foobar(a)department.domain.foo At the moment I have one role "mail" that has access to: dn.sub="ou=mail,ou=services,ou=department,dc=domain,dc=foo" read it works as expected, the mailserver can read all entries. Now I want to create a role, who has permissions to delete/add/modify all entries below ou=aliases, from all domains (dc=domain,ou=mail...), but only, if "description: <string>" is found (for delete/modify only, but not for add). Is that possible? Otherwise, how does it look, if I throw the idea with "only if" ? cu denny

2 1

LDAP Administration
by Brian Green 06 Sep '12

06 Sep '12

Hello, I have recently taken over a bunch of systems controlled by an LDAP database - however, the previous admin. didn't add me to the needed group so that I can fully administer the LDAP directory. Is there a way I can force LDAP to add me to this group? I have root access to the Linux server where the OpenLDAP system is hosted, if that helps. I've tried changing the .acl documents - that didn't seem to work to allow me to add myself to that group. This is a production system, so taking it down for a long period of time, or messing it up, would be bad. Thanks for any help, Brian

2 1

Slaving from Mirror Mode
by Nick Urbanik 06 Sep '12

06 Sep '12

Dear Folks, I am having trouble understanding http://www.openldap.org/doc/admin24/dual_dc.png. In particular, I do not understand the exact meaning of the bidirectional arrows, and the purpose of the upper pair of load balancers. 1, Are the upper load balancers there to chain writes to both mirror mode masters? 2. Are the "replica pool" configured to replicate from both masters or only from one? I am setting up mirror mode masters both in the same data centre, with one slave offsite. Should all the slaves slave from both masters, or should they slave from a load balancer which decides which master is getting the writes at present? Although our slaves are busy, surviving network issues with data consistent and correct is very important. Network outages and strange disconnects are the rule without automated configuration management for network devices. -- Nick Urbanik http://nicku.org 808-71011 nick.urbanik(a)optusnet.com.au GPG: 7FFA CDC7 5A77 0558 DC7A 790A 16DF EC5B BB9D 2C24 ID: BB9D2C24 I disclaim, therefore I am.

4 6

Re: Execute a Filter and get the boolean status true/false
by Puneet Khunteta 05 Sep '12

05 Sep '12

Hello Quanah, then, what should i do to attach the no-op control for the ldap_search_s() operation ? Regards, PKHUN On Thu, Sep 6, 2012 at 12:48 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Wednesday, September 05, 2012 9:03 PM +0200 Michael Ströder < > michael(a)stroeder.com> wrote: > > Puneet Khunteta wrote: >> >>> Basically i need the count how many SearchResultEntry responses you get >>> from ldap_search_s(). >>> >> >> You won't get the count without retrieving the results. >> > > Incorrect. You can use the noop control to do this. We actually do this > now in Zimbra to get the total number of accounts in LDAP without having to > get the full result set back. > > --Quanah > > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

ldap_count_messages() Vs. ldap_count_entries() Vs. ldap_count_references()
by Puneet Khunteta 05 Sep '12

05 Sep '12

Hello, Please let me know the difference between the following three with their corresponding usage : ldap_count_message() ldap_count_entries() ldap_count_references() If possible narrate with some examples and a test application source code will be much much appreciated. Regards, PKHUN

1 0

ldapsearch SASL/GSSAPI bind really slow
by Matthew B. Brookover 05 Sep '12

05 Sep '12

I am upgrading the openldap servers and ran into a bit of a problem. SASL/GSSAPI binds to the new server are too slow. An ldapsearch to the old server using GSSAPI to bind is much faster on the old server then the same search on the new server. I am not even sure where to start to debug this and am hoping that some one will have some ideas. First off, here are a few details: The old LDAP server is running Openldap 2.3.43 on CentOS 5.2 with the CentOS built MIT Kerberos(1.6.1) and saslauthd (2.1.22). This server is configured with the slapd.conf file. The host name is infinite.mines.edu in the example runs below. The new LDAP server is running Openldap 2.4.31 on CentOS 6.3 with the CentOS built MIT Kerberos (1.9) and saslauthd (2.1.23). This server is configured with slapd-config (new dynamic configuration is very cool!) The host name is infinte-temp.mines.edu in the example runs below. Both the old and new servers are configured to use SASL for GSSAPI and for simple binds. First test, simple bind to new server and then the old server: [testua@merlin ~]$ time ldapsearch -LLL -ZZ -Duid=testua,ou=People,dc=mines,dc=edu -y passwd -x -Hldap://infinite-temp.mines.edu/ -bou=People,dc=mines,dc=edu uid=testua dn: uid=testua,ou=People,dc=mines,dc=edu uid: testua cn: estua, t objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount shadowLastChange: 12780 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash gidNumber: 11192 host: imagine.mines.edu gecos: estua, t homeDirectory: /u/ca/fl/testua userPassword:: e1NBU0x9dGVzdHVhQE1JTkVTLkVEVQ== uidNumber: 11192 real 0m0.324s user 0m0.017s sys 0m0.004s [testua@merlin ~]$ time ldapsearch -LLL -ZZ -Duid=testua,ou=People,dc=mines,dc=edu -y passwd -x -Hldap://infinite.mines.edu/ -bou=People,dc=mines,dc=edu uid=testua dn: uid=testua,ou=People,dc=mines,dc=edu uid: testua cn: estua, t objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount shadowLastChange: 12780 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash gidNumber: 11192 host: imagine.mines.edu gecos: estua, t homeDirectory: /u/ca/fl/testua userPassword:: e1NBU0x9dGVzdHVhQE1JTkVTLkVEVQ== uidNumber: 11192 real 0m0.163s user 0m0.016s sys 0m0.004s [testua@merlin ~]$ As you can see, the new server takes nearly twice as long to perform the search as the old server. Both servers are using saslauthd to send the password to Kerberos for authentication. Next test, GSSAPI bind to the new server and then the old server: [testua@merlin ~]$ kinit Password for testua(a)MINES.EDU: [testua@merlin ~]$ klist Ticket cache: FILE:/tmp/krb5cc_11192_d1yOuC Default principal: testua(a)MINES.EDU Valid starting Expires Service principal 07/25/12 13:32:11 07/26/12 04:32:11 krbtgt/MINES.EDU(a)MINES.EDU renew until 07/26/12 13:32:07 Kerberos 4 ticket cache: /tmp/tkt11192 klist: You have no tickets cached [testua@merlin ~]$ time ldapsearch -LLL -ZZ -Hldap://infinite-temp.mines.edu/ -bou=People,dc=mines,dc=edu uid=testua SASL/GSSAPI authentication started SASL username: testua(a)MINES.EDU SASL SSF: 56 SASL data security layer installed. dn: uid=testua,ou=People,dc=mines,dc=edu uid: testua cn: estua, t objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount shadowLastChange: 12780 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash gidNumber: 11192 host: imagine.mines.edu gecos: estua, t homeDirectory: /u/ca/fl/testua userPassword:: e1NBU0x9dGVzdHVhQE1JTkVTLkVEVQ== uidNumber: 11192 real 0m1.145s user 0m0.021s sys 0m0.004s [testua@merlin ~]$ time ldapsearch -LLL -ZZ -Hldap://infinite.mines.edu/ -bou=People,dc=mines,dc=edu uid=testua SASL/GSSAPI authentication started SASL username: testua(a)MINES.EDU SASL SSF: 56 SASL data security layer installed. dn: uid=testua,ou=People,dc=mines,dc=edu uid: testua cn: estua, t objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount shadowLastChange: 12780 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash gidNumber: 11192 host: imagine.mines.edu gecos: estua, t homeDirectory: /u/ca/fl/testua userPassword:: e1NBU0x9dGVzdHVhQE1JTkVTLkVEVQ== uidNumber: 11192 real 0m0.123s user 0m0.021s sys 0m0.003s [testua@merlin ~]$ klist Ticket cache: FILE:/tmp/krb5cc_11192_d1yOuC Default principal: testua(a)MINES.EDU Valid starting Expires Service principal 07/25/12 13:32:11 07/26/12 04:32:11 krbtgt/MINES.EDU(a)MINES.EDU renew until 07/26/12 13:32:07 07/25/12 13:32:33 07/26/12 04:32:11 ldap/infinite-temp.mines.edu(a)MINES.EDU renew until 07/26/12 13:32:07 07/25/12 13:32:41 07/26/12 04:32:11 ldap/infinite.mines.edu(a)MINES.EDU renew until 07/26/12 13:32:07 Kerberos 4 ticket cache: /tmp/tkt11192 klist: You have no tickets cached [testua@merlin ~]$ The old server is 9 times faster then the new server. This last test is to show that an anonymous bind is very fast and indicates to me that the network, BDB, caching, etc are not the issue. This test is to both servers, using a simple bind, first the old server and then the new server: [testua@merlin ~]$ time ldapsearch -LLL -ZZ -x -Hldap://infinite.mines.edu/ -bou=People,dc=mines,dc=edu uid=testua dn: uid=testua,ou=People,dc=mines,dc=edu uid: testua cn: estua, t objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount shadowLastChange: 12780 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash gidNumber: 11192 host: imagine.mines.edu gecos: estua, t homeDirectory: /u/ca/fl/testua userPassword:: e1NBU0x9dGVzdHVhQE1JTkVTLkVEVQ== uidNumber: 11192 real 0m0.049s user 0m0.017s sys 0m0.005s [testua@merlin ~]$ time ldapsearch -LLL -ZZ -x -Hldap://infinite-temp.mines.edu/ -bou=People,dc=mines,dc=edu uid=testua dn: uid=testua,ou=People,dc=mines,dc=edu uid: testua cn: estua, t objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount shadowLastChange: 12780 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash gidNumber: 11192 host: imagine.mines.edu gecos: estua, t homeDirectory: /u/ca/fl/testua userPassword:: e1NBU0x9dGVzdHVhQE1JTkVTLkVEVQ== uidNumber: 11192 real 0m0.029s user 0m0.014s sys 0m0.006s [testua@merlin ~]$ When using an anonymous bind, the old server takes longer then the new server -- which is what I would expect given that the new server has twice the number of faster processors and double the memory of the old server. Any ideas? Thanks! Matt mbrookov(a)mines.edu

2 2

Master-Master replication different data centers
by S, Mohan (GE Energy) 05 Sep '12

05 Sep '12

Hi, I've been trying to setup OpenLDAP Master-Master replication running on SITE A (Datacenter 1) & SITE B (Datacenter 2) , I could successfully setup the sync between these masters. Changes are synchronized between the sites without any issues. Now I got a new requirement that "SITE A users/entries/objects should not be modifiable by SITE B and vice versa, but both have to send updates(sync) to each other. I'm not aware how do I go with this. Will I need to think of having different OU's configured for each site and sync the OU's, control the write access with ACL? Please suggest. Regards, Mohan

2 1

Execute a Filter and get the boolean status true/false
by Puneet Khunteta 05 Sep '12

05 Sep '12

Hello, I am facing an issue to get the result of a filter. Currently i have used the ldap_search () function to see whether AD has some entity corresponding to particular filter execution. But i am not able to find the function which returns the number of entity for the particular filter execution. Please help me to get the correct function which return the number of entity for the particular filter execution and what pre-requesties it has. If possible, please suggest function which just return true/false for the particular filter. Regards, PKHUN

1 0

Fixing a multi-master divergence
by Guillaume Rousse 04 Sep '12

04 Sep '12

Hello list. I have two openldap servers 2.4.23 running in a multimaster setup whose content diverged at some point. Fortunatly, I had different backup files for both, which allowed to me to reconciliate content manually. I reimported the resulting ldif file in one of the server, re-exported it through slapcat, and reimported it in the other server, after dropping all existing databases (including acceslog one). However, I end up with two bases with multiple and divergent contextCSN values: contextCSN: 20120420144311.217351Z#000000#000#000000 contextCSN: 20120903132738.849382Z#000000#001#000000 contextCSN: 20120903132426.927826Z#000000#002#000000 contextCSN: 20120420144311.217351Z#000000#000#000000 contextCSN: 20120903132426.925966Z#000000#001#000000 contextCSN: 20120903132924.793560Z#000000#002#000000 Any attempt to manually reduce this to a single value in the backup file before restoration ended in infinite refresh request from the second servers and "stale cookie" error messages. So, my questions are: - is this an expectable state to have multiple values for contextCSN ? - does it hurt, beyond making synchronisation checking almost impossible ? - how to return to a stable situation ? I can't change ldap version easily, and I'd rather return to classic master-slave setup if the problem is not fixable otherwise. -- BOFH excuse #213: Change your language to Finnish.

3 5

mdb backend fails to initilize on FreeBSD
by Nikolai Schupbach 04 Sep '12

04 Sep '12

We are testing the mdb backend (OpenLDAP 2.4.32) with FreeBSD 8.3 x64 - when we try to start slapd or populate it with slapadd we get the following error: # slapadd -d 1 -l file.ldif 5045f590 slapadd init: initiated tool. 5045f591 mdb_back_initialize: initialize MDB backend 5045f591 mdb_back_initialize: MDB 0.9.0: ("September 1, 2011") 5045f591 >>> dnNormalize: <cn=admin,ou=users,ou=directory,o=top> ... 5045f591 <<< dnNormalize: <cn=replica,ou=users,ou=directory,o=top> 5045f591 mdb_db_init: Initializing mdb database 5045f591 >>> dnPrettyNormal: <o=top> ... 5045f591 slapadd startup: initiated. 5045f591 backend_startup_one: starting "o=top" 5045f591 mdb_db_open: database "o=top": dbenv_open(/var/db/openldap-data). 5045f591 mdb_db_open: database "o=top" cannot be opened, err 22. Restore from backup! 5045f591 backend_startup_one (type=mdb, suffix="o=top"): bi_db_open failed! (22) slap_startup failed After this the initial empty db directory contains one single file: # ls -l /var/db/openldap-data/ -rw------- 1 root ldap 8192 Sep 5 00:35 lock.mdb Is there something special we need to do to initialize an mdb backend - I couldn't find anything in slapd-mdb man page that indicated anything different than when using bdb? Below is truss output: # truss slapadd -d 1 __sysctl(0x7fffffffe360,0x2,0x7fffffffe37c,0x7fffffffe370,0x0,0x0) = 0 (0x0) mmap(0x0,672,PROT_READ|PROT_WRITE,MAP_ANON,-1,0x0) = 34366238720 (0x800633000) munmap(0x800633000,672) = 0 (0x0) __sysctl(0x7fffffffe3d0,0x2,0x80073d368,0x7fffffffe3c8,0x0,0x0) = 0 (0x0) mmap(0x0,32768,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 34366238720 (0x800633000) issetugid(0x800634015,0x80062e484,0x800749a70,0x800749a40,0x5b91,0x0) = 0 (0x0) open("/etc/libmap.conf",O_RDONLY,0666) ERR#2 'No such file or directory' access("/usr/lib/libldap_r-2.4.so.8",0) ERR#2 'No such file or directory' access("/usr/local/lib/libldap_r-2.4.so.8",0) = 0 (0x0) open("/usr/local/lib/libldap_r-2.4.so.8",O_RDONLY,034751100) = 3 (0x3) fstat(3,{ mode=-rw-r--r-- ,inode=589737,size=348648,blksize=16384 }) = 0 (0x0) pread(0x3,0x80073c220,0x1000,0x0,0x101010101010101,0x8080808080808080) = 4096 (0x1000) mmap(0x0,1351680,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34367381504 (0x80074a000) mmap(0x80074a000,266240,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE,3,0x0) = 34367381504 (0x80074a000) mmap(0x80088b000,28672,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED,3,0x41000) = 34368696320 (0x80088b000) mmap(0x800892000,8192,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_ANON,-1,0x0) = 34368724992 (0x800892000) close(3) = 0 (0x0) access("/usr/lib/liblber-2.4.so.8",0) ERR#2 'No such file or directory' access("/usr/local/lib/liblber-2.4.so.8",0) = 0 (0x0) open("/usr/local/lib/liblber-2.4.so.8",O_RDONLY,034751100) = 3 (0x3) fstat(3,{ mode=-rw-r--r-- ,inode=589725,size=66807,blksize=16384 }) = 0 (0x0) pread(0x3,0x80073c220,0x1000,0x0,0x101010101010101,0x8080808080808080) = 4096 (0x1000) mmap(0x0,1101824,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34368733184 (0x800894000) mmap(0x800894000,49152,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE,3,0x0) = 34368733184 (0x800894000) mmap(0x80099f000,8192,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED,3,0xb000) = 34369826816 (0x80099f000) close(3) = 0 (0x0) access("/usr/lib/libltdl.so.7",0) ERR#2 'No such file or directory' access("/usr/local/lib/libltdl.so.7",0) = 0 (0x0) open("/usr/local/lib/libltdl.so.7",O_RDONLY,034751100) = 3 (0x3) fstat(3,{ mode=-rwxr-xr-x ,inode=166500,size=46951,blksize=16384 }) = 0 (0x0) pread(0x3,0x80073c220,0x1000,0x0,0x101010101010101,0x8080808080808080) = 4096 (0x1000) mmap(0x0,1085440,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34369835008 (0x8009a1000) mmap(0x8009a1000,32768,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE,3,0x0) = 34369835008 (0x8009a1000) mmap(0x800aa8000,8192,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED,3,0x7000) = 34370912256 (0x800aa8000) close(3) = 0 (0x0) access("/usr/lib/libdb-4.6.so.0",0) ERR#2 'No such file or directory' access("/usr/local/lib/libdb-4.6.so.0",0) = 0 (0x0) open("/usr/local/lib/libdb-4.6.so.0",O_RDONLY,034751100) = 3 (0x3) fstat(3,{ mode=-rwxr-xr-x ,inode=52714,size=1406248,blksize=16384 }) = 0 (0x0) pread(0x3,0x80073c220,0x1000,0x0,0x101010101010101,0x8080808080808080) = 4096 (0x1000) mmap(0x0,2342912,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34370920448 (0x800aaa000) mmap(0x800aaa000,1204224,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE,3,0x0) = 34370920448 (0x800aaa000) mmap(0x800cd0000,90112,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED,3,0x126000) = 34373173248 (0x800cd0000) close(3) = 0 (0x0) access("/usr/lib/libssl.so.6",0) = 0 (0x0) open("/usr/lib/libssl.so.6",O_RDONLY,034751100) = 3 (0x3) fstat(3,{ mode=-r--r--r-- ,inode=876356,size=341640,blksize=16384 }) = 0 (0x0) pread(0x3,0x80073c220,0x1000,0x0,0x101010101010101,0x8080808080808080) = 4096 (0x1000) mmap(0x0,1388544,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34373263360 (0x800ce6000) mmap(0x800ce6000,294912,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE,3,0x0) = 34373263360 (0x800ce6000) mmap(0x800e2e000,45056,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED,3,0x48000) = 34374606848 (0x800e2e000) close(3) = 0 (0x0) access("/usr/lib/libcrypto.so.6",0) ERR#2 'No such file or directory' access("/usr/local/lib/libcrypto.so.6",0) ERR#2 'No such file or directory' open("/var/run/ld-elf.so.hints",O_RDONLY,034751100) = 3 (0x3) read(3,"Ehnt\^A\0\0\0\M^@\0\0\0I\0\0\0\0"...,128) = 128 (0x80) lseek(3,0x80,SEEK_SET) = 128 (0x80) read(3,"/lib:/usr/lib:/usr/lib/compat:/u"...,73) = 73 (0x49) close(3) = 0 (0x0) access("/lib/libcrypto.so.6",0) = 0 (0x0) open("/lib/libcrypto.so.6",O_RDONLY,034751100) = 3 (0x3) fstat(3,{ mode=-r--r--r-- ,inode=847935,size=1723032,blksize=16384 }) = 0 (0x0) pread(0x3,0x80073c220,0x1000,0x0,0x101010101010101,0x8080808080808080) = 4096 (0x1000) mmap(0x0,2756608,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34374651904 (0x800e39000) mmap(0x800e39000,1417216,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE,3,0x0) = 34374651904 (0x800e39000) mmap(0x801093000,282624,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED,3,0x15a000) = 34377117696 (0x801093000) mmap(0x8010d8000,8192,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_ANON,-1,0x0) = 34377400320 (0x8010d8000) close(3) = 0 (0x0) access("/usr/lib/libcrypt.so.5",0) ERR#2 'No such file or directory' access("/usr/local/lib/libcrypt.so.5",0) ERR#2 'No such file or directory' access("/lib/libcrypt.so.5",0) = 0 (0x0) open("/lib/libcrypt.so.5",O_RDONLY,034751100) = 3 (0x3) fstat(3,{ mode=-r--r--r-- ,inode=847934,size=62592,blksize=16384 }) = 0 (0x0) pread(0x3,0x80073c220,0x1000,0x0,0x101010101010101,0x8080808080808080) = 4096 (0x1000) mmap(0x0,1179648,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34377408512 (0x8010da000) mmap(0x8010da000,57344,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE,3,0x0) = 34377408512 (0x8010da000) mmap(0x8011e7000,8192,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED,3,0xd000) = 34378510336 (0x8011e7000) mmap(0x8011e9000,69632,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_ANON,-1,0x0) = 34378518528 (0x8011e9000) close(3) = 0 (0x0) access("/usr/lib/libwrap.so.6",0) = 0 (0x0) open("/usr/lib/libwrap.so.6",O_RDONLY,034751100) = 3 (0x3) fstat(3,{ mode=-r--r--r-- ,inode=875652,size=35832,blksize=16384 }) = 0 (0x0) pread(0x3,0x80073c220,0x1000,0x0,0x101010101010101,0x8080808080808080) = 4096 (0x1000) mmap(0x0,1085440,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34378588160 (0x8011fa000) mmap(0x8011fa000,28672,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE,3,0x0) = 34378588160 (0x8011fa000) mmap(0x801301000,8192,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED,3,0x7000) = 34379665408 (0x801301000) close(3) = 0 (0x0) access("/usr/lib/libthr.so.3",0) ERR#2 'No such file or directory' access("/usr/local/lib/libthr.so.3",0) ERR#2 'No such file or directory' access("/lib/libthr.so.3",0) = 0 (0x0) open("/lib/libthr.so.3",O_RDONLY,034751100) = 3 (0x3) fstat(3,{ mode=-r--r--r-- ,inode=847904,size=93864,blksize=16384 }) = 0 (0x0) pread(0x3,0x80073c220,0x1000,0x0,0x101010101010101,0x8080808080808080) = 4096 (0x1000) mmap(0x0,1150976,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34379673600 (0x801303000) mmap(0x801303000,81920,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE,3,0x0) = 34379673600 (0x801303000) mmap(0x801416000,12288,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED,3,0x13000) = 34380800000 (0x801416000) mmap(0x801419000,12288,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_ANON,-1,0x0) = 34380812288 (0x801419000) close(3) = 0 (0x0) access("/usr/lib/libc.so.7",0) ERR#2 'No such file or directory' access("/usr/local/lib/libc.so.7",0) ERR#2 'No such file or directory' access("/lib/libc.so.7",0) = 0 (0x0) open("/lib/libc.so.7",O_RDONLY,034751100) = 3 (0x3) fstat(3,{ mode=-r--r--r-- ,inode=847874,size=1303960,blksize=16384 }) = 0 (0x0) pread(0x3,0x80073c220,0x1000,0x0,0x101010101010101,0x8080808080808080) = 4096 (0x1000) mmap(0x0,2367488,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34380824576 (0x80141c000) mmap(0x80141c000,1085440,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE,3,0x0) = 34380824576 (0x80141c000) mmap(0x801624000,126976,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED,3,0x108000) = 34382954496 (0x801624000) mmap(0x801643000,110592,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_ANON,-1,0x0) = 34383081472 (0x801643000) close(3) = 0 (0x0) mmap(0x0,20432,PROT_READ|PROT_WRITE,MAP_ANON,-1,0x0) = 34366271488 (0x80063b000) munmap(0x80063b000,20432) = 0 (0x0) mmap(0x0,12432,PROT_READ|PROT_WRITE,MAP_ANON,-1,0x0) = 34366271488 (0x80063b000) munmap(0x80063b000,12432) = 0 (0x0) mmap(0x0,3104,PROT_READ|PROT_WRITE,MAP_ANON,-1,0x0) = 34366271488 (0x80063b000) munmap(0x80063b000,3104) = 0 (0x0) mmap(0x0,2208,PROT_READ|PROT_WRITE,MAP_ANON,-1,0x0) = 34366271488 (0x80063b000) munmap(0x80063b000,2208) = 0 (0x0) mmap(0x0,29056,PROT_READ|PROT_WRITE,MAP_ANON,-1,0x0) = 34366271488 (0x80063b000) munmap(0x80063b000,29056) = 0 (0x0) mmap(0x0,12576,PROT_READ|PROT_WRITE,MAP_ANON,-1,0x0) = 34366271488 (0x80063b000) munmap(0x80063b000,12576) = 0 (0x0) mmap(0x0,56176,PROT_READ|PROT_WRITE,MAP_ANON,-1,0x0) = 34366271488 (0x80063b000) munmap(0x80063b000,56176) = 0 (0x0) mmap(0x0,1488,PROT_READ|PROT_WRITE,MAP_ANON,-1,0x0) = 34366271488 (0x80063b000) munmap(0x80063b000,1488) = 0 (0x0) mmap(0x0,2416,PROT_READ|PROT_WRITE,MAP_ANON,-1,0x0) = 34366271488 (0x80063b000) munmap(0x80063b000,2416) = 0 (0x0) mmap(0x0,8144,PROT_READ|PROT_WRITE,MAP_ANON,-1,0x0) = 34366271488 (0x80063b000) munmap(0x80063b000,8144) = 0 (0x0) mmap(0x0,43776,PROT_READ|PROT_WRITE,MAP_ANON,-1,0x0) = 34366271488 (0x80063b000) munmap(0x80063b000,43776) = 0 (0x0) sysarch(0x81,0x7fffffffe450,0x800637608,0x0,0xffffffffff00e0d0,0x8080808080808080) = 0 (0x0) sigprocmask(SIG_BLOCK,SIGHUP|SIGINT|SIGQUIT|SIGKILL|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2,0x0) = 0 (0x0) sigprocmask(SIG_SETMASK,0x0,0x0) = 0 (0x0) __sysctl(0x7fffffffe3e0,0x2,0x801649b80,0x7fffffffe3d8,0x0,0x0) = 0 (0x0) sigprocmask(SIG_BLOCK,SIGHUP|SIGINT|SIGQUIT|SIGKILL|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2,0x0) = 0 (0x0) sigprocmask(SIG_SETMASK,0x0,0x0) = 0 (0x0) getpid() = 15568 (0x3cd0) __sysctl(0x7fffffffe3c0,0x2,0x80141b370,0x7fffffffe3c8,0x0,0x0) = 0 (0x0) __sysctl(0x7fffffffe350,0x2,0x7fffffffe2e0,0x7fffffffe348,0x801315678,0xd) = 0 (0x0) __sysctl(0x7fffffffe2e0,0x3,0x80141a268,0x7fffffffe3c8,0x0,0x0) = 0 (0x0) __sysctl(0x7fffffffe380,0x2,0x801649908,0x7fffffffe378,0x0,0x0) = 0 (0x0) __sysctl(0x7fffffffdea0,0x2,0x8016491c8,0x7fffffffde98,0x0,0x0) = 0 (0x0) __sysctl(0x7fffffffddc0,0x2,0x7fffffffdd50,0x7fffffffddb8,0x801517120,0xc) = 0 (0x0) __sysctl(0x7fffffffdd50,0x2,0x8016493d0,0x7fffffffde18,0x0,0x0) = 0 (0x0) readlink("/etc/malloc.conf",0x7fffffffdec0,1024) ERR#2 'No such file or directory' issetugid(0x801515dd1,0x7fffffffdec0,0xffffffffffffffff,0x0,0x2,0x0) = 0 (0x0) break(0x800000) = 0 (0x0) __sysctl(0x7fffffffe180,0x2,0x7fffffffe19c,0x7fffffffe190,0x0,0x0) = 0 (0x0) mmap(0x0,2097152,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 34383192064 (0x80165e000) mmap(0x80185e000,1712128,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 34385289216 (0x80185e000) munmap(0x80165e000,1712128) = 0 (0x0) thr_self(0x8018041c0,0x0,0x0,0x0,0x188,0x801800080) = 0 (0x0) mmap(0x7fffffbff000,4096,PROT_NONE,MAP_ANON,-1,0x0) = 140737484156928 (0x7fffffbff000) thr_set_name(0x18701,0x8013156c0,0x400000,0x1000,0xffffffff,0x0) = 0 (0x0) rtprio_thread(0x0,0x18701,0x7fffffffe370,0x1000,0xffffffff,0x0) = 0 (0x0) sysarch(0x81,0x7fffffffe390,0x801419e40,0x80141a048,0xffffffff,0x0) = 0 (0x0) sigprocmask(SIG_SETMASK,SIGHUP|SIGINT|SIGQUIT|SIGILL|SIGABRT|SIGEMT|SIGFPE|SIGKILL|SIGBUS|SIGSEGV|SIGSYS|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2,0x0) = 0 (0x0) sigaction(32,{ 0x80130ef50 SA_RESTART|SA_SIGINFO ss_t },0x0) = 0 (0x0) sigprocmask(SIG_SETMASK,0x0,0x0) = 0 (0x0) sigprocmask(SIG_BLOCK,SIGHUP|SIGINT|SIGQUIT|SIGKILL|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2,0x0) = 0 (0x0) sigprocmask(SIG_SETMASK,0x0,0x0) = 0 (0x0) sigprocmask(SIG_BLOCK,SIGHUP|SIGINT|SIGQUIT|SIGKILL|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2,0x0) = 0 (0x0) sigprocmask(SIG_SETMASK,0x0,0x0) = 0 (0x0) sigprocmask(SIG_BLOCK,SIGHUP|SIGINT|SIGQUIT|SIGKILL|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2,0x0) = 0 (0x0) sigprocmask(SIG_SETMASK,0x0,0x0) = 0 (0x0) sigprocmask(SIG_BLOCK,SIGHUP|SIGINT|SIGQUIT|SIGKILL|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2,0x0) = 0 (0x0) sigprocmask(SIG_SETMASK,0x0,0x0) = 0 (0x0) sigprocmask(SIG_BLOCK,SIGHUP|SIGINT|SIGQUIT|SIGKILL|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2,0x0) = 0 (0x0) sigprocmask(SIG_SETMASK,0x0,0x0) = 0 (0x0) sigprocmask(SIG_BLOCK,SIGHUP|SIGINT|SIGQUIT|SIGKILL|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2,0x0) = 0 (0x0) sigprocmask(SIG_SETMASK,0x0,0x0) = 0 (0x0) sigprocmask(SIG_BLOCK,SIGHUP|SIGINT|SIGQUIT|SIGKILL|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2,0x0) = 0 (0x0) sigprocmask(SIG_SETMASK,0x0,0x0) = 0 (0x0) sigprocmask(SIG_BLOCK,SIGHUP|SIGINT|SIGQUIT|SIGKILL|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2,0x0) = 0 (0x0) sigprocmask(SIG_SETMASK,0x0,0x0) = 0 (0x0) sigprocmask(SIG_BLOCK,SIGHUP|SIGINT|SIGQUIT|SIGKILL|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2,0x0) = 0 (0x0) sigprocmask(SIG_SETMASK,0x0,0x0) = 0 (0x0) ioctl(2,TIOCGETA,0xffffe850) = 0 (0x0) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 slapadd init: initiated tool. write(2,"5045f720 slapadd init: initiated"...,39) = 39 (0x27) stat("/usr/local/etc/openldap/slapd.d",0x7fffffffe5d0) ERR#2 'No such file or directory' stat("/usr/local/etc/openldap/slapd.conf",{ mode=-r--r----- ,inode=165496,size=7216,blksize=16384 }) = 0 (0x0) open("/usr/local/etc/openldap/slapd.conf",O_RDONLY,0666) = 3 (0x3) fstat(3,{ mode=-r--r----- ,inode=165496,size=7216,blksize=16384 }) = 0 (0x0) read(3,"################################"...,16384) = 7216 (0x1c30) stat("/usr/local/etc/openldap/schema/core.schema",{ mode=-r--r--r-- ,inode=169782,size=20499,blksize=16384 }) = 0 (0x0) open("/usr/local/etc/openldap/schema/core.schema",O_RDONLY,0666) = 4 (0x4) fstat(4,{ mode=-r--r--r-- ,inode=169782,size=20499,blksize=16384 }) = 0 (0x0) read(4,"# OpenLDAP Core schema\n# $OpenL"...,16384) = 16384 (0x4000) read(4,"sinessCategory $ seeAlso $ owner"...,16384) = 4115 (0x1013) read(4,0x80187a000,16384) = 0 (0x0) close(4) = 0 (0x0) stat("/usr/local/etc/openldap/schema/cosine.schema",{ mode=-r--r--r-- ,inode=169783,size=73994,blksize=16384 }) = 0 (0x0) open("/usr/local/etc/openldap/schema/cosine.schema",O_RDONLY,0666) = 4 (0x4) fstat(4,{ mode=-r--r--r-- ,inode=169783,size=73994,blksize=16384 }) = 0 (0x0) read(4,"# RFC1274: Cosine and Internet X"...,16384) = 16384 (0x4000) read(4,"ibutetype ( 0.9.2342.19200300.10"...,16384) = 16384 (0x4000) read(4,"#\n# This section attempts to f"...,16384) = 16384 (0x4000) read(4," commonName}\n# "...,16384) = 16384 (0x4000) read(4,"uteType 7}\n#\n#\n# userClass"...,16384) = 8458 (0x210a) read(4,0x80187a000,16384) = 0 (0x0) close(4) = 0 (0x0) stat("/usr/local/etc/openldap/schema/nis.schema",{ mode=-r--r--r-- ,inode=169789,size=7640,blksize=16384 }) = 0 (0x0) open("/usr/local/etc/openldap/schema/nis.schema",O_RDONLY,0666) = 4 (0x4) fstat(4,{ mode=-r--r--r-- ,inode=169789,size=7640,blksize=16384 }) = 0 (0x0) read(4,"# $OpenLDAP$\n## This work is pa"...,16384) = 7640 (0x1dd8) read(4,0x80187a000,16384) = 0 (0x0) close(4) = 0 (0x0) stat("/usr/local/etc/openldap/schema/inetorgperson.schema",{ mode=-r--r--r-- ,inode=169786,size=6267,blksize=16384 }) = 0 (0x0) open("/usr/local/etc/openldap/schema/inetorgperson.schema",O_RDONLY,0666) = 4 (0x4) fstat(4,{ mode=-r--r--r-- ,inode=169786,size=6267,blksize=16384 }) = 0 (0x0) read(4,"# inetorgperson.schema -- InetOr"...,16384) = 6267 (0x187b) read(4,0x80187a000,16384) = 0 (0x0) close(4) = 0 (0x0) stat("/usr/local/etc/openldap/schema/misc.schema",{ mode=-r--r--r-- ,inode=165497,size=2543,blksize=16384 }) = 0 (0x0) open("/usr/local/etc/openldap/schema/misc.schema",O_RDONLY,0666) = 4 (0x4) fstat(4,{ mode=-r--r--r-- ,inode=165497,size=2543,blksize=16384 }) = 0 (0x0) read(4,"# misc.schema -- assorted schema"...,16384) = 2543 (0x9ef) read(4,0x80187a000,16384) = 0 (0x0) close(4) = 0 (0x0) stat("/usr/local/etc/openldap/schema/mirapoint.schema",{ mode=-r--r--r-- ,inode=165558,size=28443,blksize=16384 }) = 0 (0x0) open("/usr/local/etc/openldap/schema/mirapoint.schema",O_RDONLY,0666) = 4 (0x4) fstat(4,{ mode=-r--r--r-- ,inode=165558,size=28443,blksize=16384 }) = 0 (0x0) read(4,"#\n# This is a LDAPv3 schema fil"...,16384) = 16384 (0x4000) read(4,"249.1.1.4 cis\nattributetyp"...,16384) = 12059 (0x2f1b) read(4,0x80187a000,16384) = 0 (0x0) close(4) = 0 (0x0) stat("/usr/local/etc/openldap/schema/smp.schema",{ mode=-r--r--r-- ,inode=165556,size=9003,blksize=16384 }) = 0 (0x0) open("/usr/local/etc/openldap/schema/smp.schema",O_RDONLY,0666) = 4 (0x4) fstat(4,{ mode=-r--r--r-- ,inode=165556,size=9003,blksize=16384 }) = 0 (0x0) read(4,"################################"...,16384) = 9003 (0x232b) read(4,0x80187a000,16384) = 0 (0x0) close(4) = 0 (0x0) open("/usr/local/libexec/openldap/back_mdb.la",O_RDONLY,0666) = 4 (0x4) fstat(4,{ mode=-rwxr-xr-x ,inode=589895,size=1029,blksize=16384 }) = 0 (0x0) read(4,"# back_mdb.la - a libtool librar"...,16384) = 1029 (0x405) read(4,0x801878000,16384) = 0 (0x0) close(4) = 0 (0x0) sigprocmask(SIG_BLOCK,SIGHUP|SIGINT|SIGQUIT|SIGKILL|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2,0x0) = 0 (0x0) open("/usr/local/libexec/openldap/back_mdb-2.4.so.8",O_RDONLY,056) = 4 (0x4) fstat(4,{ mode=-rwxr-xr-x ,inode=589894,size=216820,blksize=16384 }) = 0 (0x0) pread(0x4,0x80073c220,0x1000,0x0,0xfffffffffed9b000,0x8080808080808080) = 4096 (0x1000) mmap(0x0,1343488,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34383192064 (0x80165e000) mmap(0x80165e000,180224,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE,4,0x0) = 34383192064 (0x80165e000) mmap(0x80178a000,12288,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED,4,0x2c000) = 34384420864 (0x80178a000) mmap(0x80178d000,102400,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_ANON,-1,0x0) = 34384433152 (0x80178d000) close(4) = 0 (0x0) mmap(0x0,5488,PROT_READ|PROT_WRITE,MAP_ANON,-1,0x0) = 34366271488 (0x80063b000) munmap(0x80063b000,5488) = 0 (0x0) sigprocmask(SIG_SETMASK,0x0,0x0) = 0 (0x0) sigprocmask(SIG_BLOCK,SIGHUP|SIGINT|SIGQUIT|SIGKILL|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2,0x0) = 0 (0x0) sigprocmask(SIG_SETMASK,0x0,0x0) = 0 (0x0) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 mdb_back_initialize: initialize MDB backend write(2,"5045f720 mdb_back_initialize: in"...,53) = 53 (0x35) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 mdb_back_initialize: MDB 0.9.0: ("September 1, 2011") write(2,"5045f720 mdb_back_initialize: MD"...,63) = 63 (0x3f) open("/usr/local/libexec/openldap/back_monitor.la",O_RDONLY,0666) = 4 (0x4) fstat(4,{ mode=-rwxr-xr-x ,inode=589887,size=1053,blksize=16384 }) = 0 (0x0) read(4,"# back_monitor.la - a libtool li"...,16384) = 1053 (0x41d) read(4,0x8018ae000,16384) = 0 (0x0) close(4) = 0 (0x0) sigprocmask(SIG_BLOCK,SIGHUP|SIGINT|SIGQUIT|SIGKILL|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2,0x0) = 0 (0x0) open("/usr/local/libexec/openldap/back_monitor-2.4.so.8",O_RDONLY,062) = 4 (0x4) fstat(4,{ mode=-rwxr-xr-x ,inode=589886,size=122421,blksize=16384 }) = 0 (0x0) pread(0x4,0x80073c220,0x1000,0x0,0xfffffffffedb1a40,0x8080808080808080) = 4096 (0x1000) mmap(0x0,1171456,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34387001344 (0x801a00000) mmap(0x801a00000,94208,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE,4,0x0) = 34387001344 (0x801a00000) mmap(0x801b17000,12288,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED,4,0x17000) = 34388144128 (0x801b17000) mmap(0x801b1a000,16384,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_ANON,-1,0x0) = 34388156416 (0x801b1a000) close(4) = 0 (0x0) mmap(0x0,3504,PROT_READ|PROT_WRITE,MAP_ANON,-1,0x0) = 34366271488 (0x80063b000) munmap(0x80063b000,3504) = 0 (0x0) sigprocmask(SIG_SETMASK,0x0,0x0) = 0 (0x0) sigprocmask(SIG_BLOCK,SIGHUP|SIGINT|SIGQUIT|SIGKILL|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2,0x0) = 0 (0x0) sigprocmask(SIG_SETMASK,0x0,0x0) = 0 (0x0) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 >>> dnNormalize: <cn=admin,ou=users,ou=directory,o=top> write(2,"5045f720 >>> dnNormalize: <cn=ad"...,65) = 65 (0x41) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 <<< dnNormalize: <cn=admin,ou=users,ou=directory,o=top> write(2,"5045f720 <<< dnNormalize: <cn=ad"...,65) = 65 (0x41) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 >>> dnNormalize: <cn=maapi,ou=users,ou=directory,o=top> write(2,"5045f720 >>> dnNormalize: <cn=ma"...,65) = 65 (0x41) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 <<< dnNormalize: <cn=maapi,ou=users,ou=directory,o=top> write(2,"5045f720 <<< dnNormalize: <cn=ma"...,65) = 65 (0x41) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 >>> dnNormalize: <cn=smp,ou=users,ou=directory,o=top> write(2,"5045f720 >>> dnNormalize: <cn=sm"...,63) = 63 (0x3f) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 <<< dnNormalize: <cn=smp,ou=users,ou=directory,o=top> write(2,"5045f720 <<< dnNormalize: <cn=sm"...,63) = 63 (0x3f) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 >>> dnNormalize: <cn=replica,ou=users,ou=directory,o=top> write(2,"5045f720 >>> dnNormalize: <cn=re"...,67) = 67 (0x43) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 <<< dnNormalize: <cn=replica,ou=users,ou=directory,o=top> write(2,"5045f720 <<< dnNormalize: <cn=re"...,67) = 67 (0x43) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 >>> dnNormalize: <ou=provisioning,ou=mail,o=top> write(2,"5045f720 >>> dnNormalize: <ou=pr"...,58) = 58 (0x3a) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 <<< dnNormalize: <ou=provisioning,ou=mail,o=top> write(2,"5045f720 <<< dnNormalize: <ou=pr"...,58) = 58 (0x3a) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 >>> dnNormalize: <cn=admin,ou=users,ou=directory,o=top> write(2,"5045f720 >>> dnNormalize: <cn=ad"...,65) = 65 (0x41) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 <<< dnNormalize: <cn=admin,ou=users,ou=directory,o=top> write(2,"5045f720 <<< dnNormalize: <cn=ad"...,65) = 65 (0x41) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 >>> dnNormalize: <cn=maapi,ou=users,ou=directory,o=top> write(2,"5045f720 >>> dnNormalize: <cn=ma"...,65) = 65 (0x41) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 <<< dnNormalize: <cn=maapi,ou=users,ou=directory,o=top> write(2,"5045f720 <<< dnNormalize: <cn=ma"...,65) = 65 (0x41) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 >>> dnNormalize: <cn=smp,ou=users,ou=directory,o=top> write(2,"5045f720 >>> dnNormalize: <cn=sm"...,63) = 63 (0x3f) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 <<< dnNormalize: <cn=smp,ou=users,ou=directory,o=top> write(2,"5045f720 <<< dnNormalize: <cn=sm"...,63) = 63 (0x3f) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 >>> dnNormalize: <cn=replica,ou=users,ou=directory,o=top> write(2,"5045f720 >>> dnNormalize: <cn=re"...,67) = 67 (0x43) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 <<< dnNormalize: <cn=replica,ou=users,ou=directory,o=top> write(2,"5045f720 <<< dnNormalize: <cn=re"...,67) = 67 (0x43) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 >>> dnNormalize: <ou=provisioning,ou=mail,o=top> write(2,"5045f720 >>> dnNormalize: <ou=pr"...,58) = 58 (0x3a) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 <<< dnNormalize: <ou=provisioning,ou=mail,o=top> write(2,"5045f720 <<< dnNormalize: <ou=pr"...,58) = 58 (0x3a) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 >>> dnNormalize: <cn=admin,ou=users,ou=directory,o=top> write(2,"5045f720 >>> dnNormalize: <cn=ad"...,65) = 65 (0x41) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 <<< dnNormalize: <cn=admin,ou=users,ou=directory,o=top> write(2,"5045f720 <<< dnNormalize: <cn=ad"...,65) = 65 (0x41) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 >>> dnNormalize: <cn=maapi,ou=users,ou=directory,o=top> write(2,"5045f720 >>> dnNormalize: <cn=ma"...,65) = 65 (0x41) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 <<< dnNormalize: <cn=maapi,ou=users,ou=directory,o=top> write(2,"5045f720 <<< dnNormalize: <cn=ma"...,65) = 65 (0x41) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 >>> dnNormalize: <cn=smp,ou=users,ou=directory,o=top> write(2,"5045f720 >>> dnNormalize: <cn=sm"...,63) = 63 (0x3f) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 <<< dnNormalize: <cn=smp,ou=users,ou=directory,o=top> write(2,"5045f720 <<< dnNormalize: <cn=sm"...,63) = 63 (0x3f) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 >>> dnNormalize: <cn=replica,ou=users,ou=directory,o=top> write(2,"5045f720 >>> dnNormalize: <cn=re"...,67) = 67 (0x43) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 <<< dnNormalize: <cn=replica,ou=users,ou=directory,o=top> write(2,"5045f720 <<< dnNormalize: <cn=re"...,67) = 67 (0x43) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 >>> dnNormalize: <ou=cos,ou=mail,o=top> write(2,"5045f720 >>> dnNormalize: <ou=co"...,49) = 49 (0x31) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 <<< dnNormalize: <ou=cos,ou=mail,o=top> write(2,"5045f720 <<< dnNormalize: <ou=co"...,49) = 49 (0x31) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 >>> dnNormalize: <cn=admin,ou=users,ou=directory,o=top> write(2,"5045f720 >>> dnNormalize: <cn=ad"...,65) = 65 (0x41) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 <<< dnNormalize: <cn=admin,ou=users,ou=directory,o=top> write(2,"5045f720 <<< dnNormalize: <cn=ad"...,65) = 65 (0x41) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 >>> dnNormalize: <cn=maapi,ou=users,ou=directory,o=top> write(2,"5045f720 >>> dnNormalize: <cn=ma"...,65) = 65 (0x41) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 <<< dnNormalize: <cn=maapi,ou=users,ou=directory,o=top> write(2,"5045f720 <<< dnNormalize: <cn=ma"...,65) = 65 (0x41) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 >>> dnNormalize: <cn=smp,ou=users,ou=directory,o=top> write(2,"5045f720 >>> dnNormalize: <cn=sm"...,63) = 63 (0x3f) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 <<< dnNormalize: <cn=smp,ou=users,ou=directory,o=top> write(2,"5045f720 <<< dnNormalize: <cn=sm"...,63) = 63 (0x3f) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 >>> dnNormalize: <cn=replica,ou=users,ou=directory,o=top> write(2,"5045f720 >>> dnNormalize: <cn=re"...,67) = 67 (0x43) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 <<< dnNormalize: <cn=replica,ou=users,ou=directory,o=top> write(2,"5045f720 <<< dnNormalize: <cn=re"...,67) = 67 (0x43) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 >>> dnNormalize: <ou=mail,o=top> write(2,"5045f720 >>> dnNormalize: <ou=ma"...,42) = 42 (0x2a) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 <<< dnNormalize: <ou=mail,o=top> write(2,"5045f720 <<< dnNormalize: <ou=ma"...,42) = 42 (0x2a) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 >>> dnNormalize: <cn=admin,ou=users,ou=directory,o=top> write(2,"5045f720 >>> dnNormalize: <cn=ad"...,65) = 65 (0x41) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 <<< dnNormalize: <cn=admin,ou=users,ou=directory,o=top> write(2,"5045f720 <<< dnNormalize: <cn=ad"...,65) = 65 (0x41) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 >>> dnNormalize: <cn=maapi,ou=users,ou=directory,o=top> write(2,"5045f720 >>> dnNormalize: <cn=ma"...,65) = 65 (0x41) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 <<< dnNormalize: <cn=maapi,ou=users,ou=directory,o=top> write(2,"5045f720 <<< dnNormalize: <cn=ma"...,65) = 65 (0x41) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 >>> dnNormalize: <cn=smp,ou=users,ou=directory,o=top> write(2,"5045f720 >>> dnNormalize: <cn=sm"...,63) = 63 (0x3f) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 <<< dnNormalize: <cn=smp,ou=users,ou=directory,o=top> write(2,"5045f720 <<< dnNormalize: <cn=sm"...,63) = 63 (0x3f) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 >>> dnNormalize: <cn=replica,ou=users,ou=directory,o=top> write(2,"5045f720 >>> dnNormalize: <cn=re"...,67) = 67 (0x43) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 <<< dnNormalize: <cn=replica,ou=users,ou=directory,o=top> write(2,"5045f720 <<< dnNormalize: <cn=re"...,67) = 67 (0x43) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 >>> dnNormalize: <ou=directory,o=top> write(2,"5045f720 >>> dnNormalize: <ou=di"...,47) = 47 (0x2f) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 <<< dnNormalize: <ou=directory,o=top> write(2,"5045f720 <<< dnNormalize: <ou=di"...,47) = 47 (0x2f) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 >>> dnNormalize: <cn=monitor,ou=users,ou=directory,o=top> write(2,"5045f720 >>> dnNormalize: <cn=mo"...,67) = 67 (0x43) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 <<< dnNormalize: <cn=monitor,ou=users,ou=directory,o=top> write(2,"5045f720 <<< dnNormalize: <cn=mo"...,67) = 67 (0x43) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 >>> dnNormalize: <cn=replica,ou=users,ou=directory,o=top> write(2,"5045f720 >>> dnNormalize: <cn=re"...,67) = 67 (0x43) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 <<< dnNormalize: <cn=replica,ou=users,ou=directory,o=top> write(2,"5045f720 <<< dnNormalize: <cn=re"...,67) = 67 (0x43) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 >>> dnNormalize: <ou=directory,o=top> write(2,"5045f720 >>> dnNormalize: <ou=di"...,47) = 47 (0x2f) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 <<< dnNormalize: <ou=directory,o=top> write(2,"5045f720 <<< dnNormalize: <ou=di"...,47) = 47 (0x2f) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 >>> dnNormalize: <cn=monitor,ou=users,ou=directory,o=top> write(2,"5045f720 >>> dnNormalize: <cn=mo"...,67) = 67 (0x43) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 <<< dnNormalize: <cn=monitor,ou=users,ou=directory,o=top> write(2,"5045f720 <<< dnNormalize: <cn=mo"...,67) = 67 (0x43) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 >>> dnNormalize: <cn=replica,ou=users,ou=directory,o=top> write(2,"5045f720 >>> dnNormalize: <cn=re"...,67) = 67 (0x43) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 <<< dnNormalize: <cn=replica,ou=users,ou=directory,o=top> write(2,"5045f720 <<< dnNormalize: <cn=re"...,67) = 67 (0x43) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 >>> dnNormalize: <o=top> write(2,"5045f720 >>> dnNormalize: <o=top"...,34) = 34 (0x22) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 <<< dnNormalize: <o=top> write(2,"5045f720 <<< dnNormalize: <o=top"...,34) = 34 (0x22) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 >>> dnNormalize: <cn=replica,ou=users,ou=directory,o=top> write(2,"5045f720 >>> dnNormalize: <cn=re"...,67) = 67 (0x43) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 <<< dnNormalize: <cn=replica,ou=users,ou=directory,o=top> write(2,"5045f720 <<< dnNormalize: <cn=re"...,67) = 67 (0x43) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 mdb_db_init: Initializing mdb database write(2,"5045f720 mdb_db_init: Initializi"...,48) = 48 (0x30) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 >>> dnPrettyNormal: <o=top> write(2,"5045f720 >>> dnPrettyNormal: <o="...,37) = 37 (0x25) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 <<< dnPrettyNormal: <o=top>, <o=top> write(2,"5045f720 <<< dnPrettyNormal: <o="...,46) = 46 (0x2e) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 >>> dnPrettyNormal: <cn=root,o=top> write(2,"5045f720 >>> dnPrettyNormal: <cn"...,45) = 45 (0x2d) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 <<< dnPrettyNormal: <cn=root,o=top>, <cn=root,o=top> write(2,"5045f720 <<< dnPrettyNormal: <cn"...,62) = 62 (0x3e) open("/var/db/openldap-data/DUMMY",O_WRONLY|O_CREAT|O_TRUNC,0666) = 4 (0x4) close(4) = 0 (0x0) unlink("/var/db/openldap-data/DUMMY") = 0 (0x0) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 >>> dnPrettyNormal: <cn=Monitor> write(2,"5045f720 >>> dnPrettyNormal: <cn"...,42) = 42 (0x2a) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 <<< dnPrettyNormal: <cn=Monitor>, <cn=monitor> write(2,"5045f720 <<< dnPrettyNormal: <cn"...,56) = 56 (0x38) read(3,0x801873000,16384) = 0 (0x0) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 >>> dnNormalize: <cn=monitor> write(2,"5045f720 >>> dnNormalize: <cn=mo"...,39) = 39 (0x27) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 <<< dnNormalize: <cn=monitor> write(2,"5045f720 <<< dnNormalize: <cn=mo"...,39) = 39 (0x27) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 >>> dnNormalize: <cn=monitor,ou=users,ou=directory,o=top> write(2,"5045f720 >>> dnNormalize: <cn=mo"...,67) = 67 (0x43) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 <<< dnNormalize: <cn=monitor,ou=users,ou=directory,o=top> write(2,"5045f720 <<< dnNormalize: <cn=mo"...,67) = 67 (0x43) close(3) = 0 (0x0) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 >>> dnNormalize: <cn=Subschema> write(2,"5045f720 >>> dnNormalize: <cn=Su"...,41) = 41 (0x29) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 <<< dnNormalize: <cn=subschema> write(2,"5045f720 <<< dnNormalize: <cn=su"...,41) = 41 (0x29) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 matching_rule_use_init write(2,"5045f720 matching_rule_use_init"...,32) = 32 (0x20) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 1.2.840.113556.1.4.804 (integerBitOrMatch): write(2,"5045f720 1.2.840.113556.1.4."...,57) = 57 (0x39) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 matchingRuleUse: ( 1.2.840.113556.1.4.804 NAME 'integerBitOrMatch' APPLIES ( supportedLDAPVersion $ entryTtl $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcIndexIntLen $ olcListenerThreads $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcWriteTimeout $ olcSpSessionlog $ olcDbMaxReaders $ olcDbMaxSize $ olcDbSearchStack $ mailPreferenceOption $ shadowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpire $ shadowFlag $ ipServicePort $ ipProtocolNumber $ oncRpcNumber $ miWmprefMessageCount $ miWmprefComposeWidth $ miWmprefComposeHeight $ miWmprefSummaryCount $ miDomainQuota $ mpSystemPref $ mpCounterDomain $ mpCounterUser $ mpDomainStorageQuota $ mpDomainMailboxQuota $ mpDomainForwarderQuota ) ) write(2,"5045f720 matchingRuleUse: ( 1.2."...,993) = 993 (0x3e1) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 1.2.840.113556.1.4.803 (integerBitAndMatch): write(2,"5045f720 1.2.840.113556.1.4."...,58) = 58 (0x3a) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 matchingRuleUse: ( 1.2.840.113556.1.4.803 NAME 'integerBitAndMatch' APPLIES ( supportedLDAPVersion $ entryTtl $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcIndexIntLen $ olcListenerThreads $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcWriteTimeout $ olcSpSessionlog $ olcDbMaxReaders $ olcDbMaxSize $ olcDbSearchStack $ mailPreferenceOption $ shadowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpire $ shadowFlag $ ipServicePort $ ipProtocolNumber $ oncRpcNumber $ miWmprefMessageCount $ miWmprefComposeWidth $ miWmprefComposeHeight $ miWmprefSummaryCount $ miDomainQuota $ mpSystemPref $ mpCounterDomain $ mpCounterUser $ mpDomainStorageQuota $ mpDomainMailboxQuota $ mpDomainForwarderQuota ) ) write(2,"5045f720 matchingRuleUse: ( 1.2."...,994) = 994 (0x3e2) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 1.3.6.1.4.1.1466.109.114.2 (caseIgnoreIA5Match): write(2,"5045f720 1.3.6.1.4.1.1466.10"...,62) = 62 (0x3e) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 matchingRuleUse: ( 1.3.6.1.4.1.1466.109.114.2 NAME 'caseIgnoreIA5Match' APPLIES ( altServer $ c $ mail $ dc $ associatedDomain $ email $ aRecord $ mDRecord $ mXRecord $ nSRecord $ sOARecord $ cNAMERecord $ janetMailbox $ gecos $ homeDirectory $ loginShell $ memberUid $ memberNisNetgroup $ ipHostNumber $ ipNetworkNumber $ ipNetmaskNumber $ macAddress $ bootFile $ nisMapEntry $ mailLocalAddress $ mailHost $ mailRoutingAddress $ rfc822MailMember $ miException $ miDeliveryOption $ miForwardingAddress $ miAutoreplyInterval $ miWmprefEmailAddress $ miWmprefReplytoAddress $ miWmprefCharset $ miWmprefTimezone $ miWmprefReplyOption $ miWmprefVersion $ miWmprefColorTheme $ miWmprefUserLocale $ miWmprefShowHtmlContent $ miDomainName $ miDomainAdmin $ miDomainMaxUsers $ miDomainMaxDls $ miService $ miMailExpirePolicy $ miMailUndeleteQuota $ miDefaultJunkmailFilter $ miSpamInSubject $ miGroupName $ miMemberName $ miMemberType $ miMaildom $ miGlobalConfig $ miDelegatedDomain $ miVirtualDomain $ miMemberInhibitSyncwrite(2,"5045f720 matchingRuleUse: ( 1.3."...,1024) = 1024 (0x400) $ miMinFarmVersion $ miMailQuota $ miLoginid $ miUUID $ miQuarantineHost $ miQuarantineQuota $ miFolderName $ miFolderACL $ miFolderType $ miFolderNamecasepreserve $ mpSystemName $ mpSystemRole $ mpMailHost $ mpRelayMailHost $ mpMailRouter $ mpMailUserType $ mpSieveFilter $ mpSpamDeliveryOption $ mpSpamWhitelist $ mpSpamBlacklist ) ) write(2," $ miMinFarmVersion $ miMailQuot"...,337) = 337 (0x151) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 1.3.6.1.4.1.1466.109.114.1 (caseExactIA5Match): write(2,"5045f720 1.3.6.1.4.1.1466.10"...,61) = 61 (0x3d) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 matchingRuleUse: ( 1.3.6.1.4.1.1466.109.114.1 NAME 'caseExactIA5Match' APPLIES ( altServer $ c $ mail $ dc $ associatedDomain $ email $ aRecord $ mDRecord $ mXRecord $ nSRecord $ sOARecord $ cNAMERecord $ janetMailbox $ gecos $ homeDirectory $ loginShell $ memberUid $ memberNisNetgroup $ ipHostNumber $ ipNetworkNumber $ ipNetmaskNumber $ macAddress $ bootFile $ nisMapEntry $ mailLocalAddress $ mailHost $ mailRoutingAddress $ rfc822MailMember $ miException $ miDeliveryOption $ miForwardingAddress $ miAutoreplyInterval $ miWmprefEmailAddress $ miWmprefReplytoAddress $ miWmprefCharset $ miWmprefTimezone $ miWmprefReplyOption $ miWmprefVersion $ miWmprefColorTheme $ miWmprefUserLocale $ miWmprefShowHtmlContent $ miDomainName $ miDomainAdmin $ miDomainMaxUsers $ miDomainMaxDls $ miService $ miMailExpirePolicy $ miMailUndeleteQuota $ miDefaultJunkmailFilter $ miSpamInSubject $ miGroupName $ miMemberName $ miMemberType $ miMaildom $ miGlobalConfig $ miDelegatedDomain $ miVirtualDomain $ miMemberInhibitSync write(2,"5045f720 matchingRuleUse: ( 1.3."...,1024) = 1024 (0x400) $ miMinFarmVersion $ miMailQuota $ miLoginid $ miUUID $ miQuarantineHost $ miQuarantineQuota $ miFolderName $ miFolderACL $ miFolderType $ miFolderNamecasepreserve $ mpSystemName $ mpSystemRole $ mpMailHost $ mpRelayMailHost $ mpMailRouter $ mpMailUserType $ mpSieveFilter $ mpSpamDeliveryOption $ mpSpamWhitelist $ mpSpamBlacklist ) ) write(2,"$ miMinFarmVersion $ miMailQuota"...,336) = 336 (0x150) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 2.5.13.39 (certificateListMatch): write(2,"5045f720 2.5.13.39 (certific"...,47) = 47 (0x2f) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 2.5.13.38 (certificateListExactMatch): write(2,"5045f720 2.5.13.38 (certific"...,52) = 52 (0x34) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 matchingRuleUse: ( 2.5.13.38 NAME 'certificateListExactMatch' APPLIES ( authorityRevocationList $ certificateRevocationList $ deltaRevocationList ) ) write(2,"5045f720 matchingRuleUse: ( 2.5."...,159) = 159 (0x9f) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 2.5.13.35 (certificateMatch): write(2,"5045f720 2.5.13.35 (certific"...,43) = 43 (0x2b) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 2.5.13.34 (certificateExactMatch): write(2,"5045f720 2.5.13.34 (certific"...,48) = 48 (0x30) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 matchingRuleUse: ( 2.5.13.34 NAME 'certificateExactMatch' APPLIES ( userCertificate $ cACertificate ) ) write(2,"5045f720 matchingRuleUse: ( 2.5."...,113) = 113 (0x71) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 2.5.13.30 (objectIdentifierFirstComponentMatch): write(2,"5045f720 2.5.13.30 (objectId"...,62) = 62 (0x3e) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 matchingRuleUse: ( 2.5.13.30 NAME 'objectIdentifierFirstComponentMatch' APPLIES ( supportedControl $ supportedExtension $ supportedFeatures $ ldapSyntaxes $ supportedApplicationContext ) ) write(2,"5045f720 matchingRuleUse: ( 2.5."...,198) = 198 (0xc6) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 2.5.13.29 (integerFirstComponentMatch): write(2,"5045f720 2.5.13.29 (integerF"...,53) = 53 (0x35) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 matchingRuleUse: ( 2.5.13.29 NAME 'integerFirstComponentMatch' APPLIES ( supportedLDAPVersion $ entryTtl $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcIndexIntLen $ olcListenerThreads $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcWriteTimeout $ olcSpSessionlog $ olcDbMaxReaders $ olcDbMaxSize $ olcDbSearchStack $ mailPreferenceOption $ shadowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpire $ shadowFlag $ ipServicePort $ ipProtocolNumber $ oncRpcNumber $ miWmprefMessageCount $ miWmprefComposeWidth $ miWmprefComposeHeight $ miWmprefSummaryCount $ miDomainQuota $ mpSystemPref $ mpCounterDomain $ mpCounterUser $ mpDomainStorageQuota $ mpDomainMailboxQuota $ mpDomainForwarderQuota ) ) write(2,"5045f720 matchingRuleUse: ( 2.5."...,989) = 989 (0x3dd) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 2.5.13.28 (generalizedTimeOrderingMatch): write(2,"5045f720 2.5.13.28 (generali"...,55) = 55 (0x37) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 matchingRuleUse: ( 2.5.13.28 NAME 'generalizedTimeOrderingMatch' APPLIES ( createTimestamp $ modifyTimestamp ) ) write(2,"5045f720 matchingRuleUse: ( 2.5."...,122) = 122 (0x7a) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 2.5.13.27 (generalizedTimeMatch): write(2,"5045f720 2.5.13.27 (generali"...,47) = 47 (0x2f) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 matchingRuleUse: ( 2.5.13.27 NAME 'generalizedTimeMatch' APPLIES ( createTimestamp $ modifyTimestamp ) ) write(2,"5045f720 matchingRuleUse: ( 2.5."...,114) = 114 (0x72) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 2.5.13.24 (protocolInformationMatch): write(2,"5045f720 2.5.13.24 (protocol"...,51) = 51 (0x33) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 matchingRuleUse: ( 2.5.13.24 NAME 'protocolInformationMatch' APPLIES protocolInformation ) write(2,"5045f720 matchingRuleUse: ( 2.5."...,100) = 100 (0x64) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 2.5.13.23 (uniqueMemberMatch): write(2,"5045f720 2.5.13.23 (uniqueMe"...,44) = 44 (0x2c) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 matchingRuleUse: ( 2.5.13.23 NAME 'uniqueMemberMatch' APPLIES uniqueMember ) write(2,"5045f720 matchingRuleUse: ( 2.5."...,86) = 86 (0x56) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 2.5.13.22 (presentationAddressMatch): write(2,"5045f720 2.5.13.22 (presenta"...,51) = 51 (0x33) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 matchingRuleUse: ( 2.5.13.22 NAME 'presentationAddressMatch' APPLIES presentationAddress ) write(2,"5045f720 matchingRuleUse: ( 2.5."...,100) = 100 (0x64) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 2.5.13.20 (telephoneNumberMatch): write(2,"5045f720 2.5.13.20 (telephon"...,47) = 47 (0x2f) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 matchingRuleUse: ( 2.5.13.20 NAME 'telephoneNumberMatch' APPLIES ( telephoneNumber $ homePhone $ mobile $ pager ) ) write(2,"5045f720 matchingRuleUse: ( 2.5."...,125) = 125 (0x7d) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 2.5.13.18 (octetStringOrderingMatch): write(2,"5045f720 2.5.13.18 (octetStr"...,51) = 51 (0x33) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 matchingRuleUse: ( 2.5.13.18 NAME 'octetStringOrderingMatch' APPLIES userPassword ) write(2,"5045f720 matchingRuleUse: ( 2.5."...,93) = 93 (0x5d) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 2.5.13.17 (octetStringMatch): write(2,"5045f720 2.5.13.17 (octetStr"...,43) = 43 (0x2b) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 matchingRuleUse: ( 2.5.13.17 NAME 'octetStringMatch' APPLIES userPassword ) write(2,"5045f720 matchingRuleUse: ( 2.5."...,85) = 85 (0x55) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 2.5.13.16 (bitStringMatch): write(2,"5045f720 2.5.13.16 (bitStrin"...,41) = 41 (0x29) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 matchingRuleUse: ( 2.5.13.16 NAME 'bitStringMatch' APPLIES x500UniqueIdentifier ) write(2,"5045f720 matchingRuleUse: ( 2.5."...,91) = 91 (0x5b) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 2.5.13.15 (integerOrderingMatch): write(2,"5045f720 2.5.13.15 (integerO"...,47) = 47 (0x2f) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 matchingRuleUse: ( 2.5.13.15 NAME 'integerOrderingMatch' APPLIES ( supportedLDAPVersion $ entryTtl $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcIndexIntLen $ olcListenerThreads $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcWriteTimeout $ olcSpSessionlog $ olcDbMaxReaders $ olcDbMaxSize $ olcDbSearchStack $ mailPreferenceOption $ shadowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpire $ shadowFlag $ ipServicePort $ ipProtocolNumber $ oncRpcNumber $ miWmprefMessageCount $ miWmprefComposeWidth $ miWmprefComposeHeight $ miWmprefSummaryCount $ miDomainQuota $ mpSystemPref $ mpCounterDomain $ mpCounterUser $ mpDomainStorageQuota $ mpDomainMailboxQuota $ mpDomainForwarderQuota ) ) write(2,"5045f720 matchingRuleUse: ( 2.5."...,983) = 983 (0x3d7) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 2.5.13.14 (integerMatch): write(2,"5045f720 2.5.13.14 (integerM"...,39) = 39 (0x27) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 matchingRuleUse: ( 2.5.13.14 NAME 'integerMatch' APPLIES ( supportedLDAPVersion $ entryTtl $ uidNumber $ gidNumber $ olcConcurrency $ olcConnMaxPending $ olcConnMaxPendingAuth $ olcIdleTimeout $ olcIndexSubstrIfMinLen $ olcIndexSubstrIfMaxLen $ olcIndexSubstrAnyLen $ olcIndexSubstrAnyStep $ olcIndexIntLen $ olcListenerThreads $ olcLocalSSF $ olcMaxDerefDepth $ olcReplicationInterval $ olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ olcThreads $ olcToolThreads $ olcWriteTimeout $ olcSpSessionlog $ olcDbMaxReaders $ olcDbMaxSize $ olcDbSearchStack $ mailPreferenceOption $ shadowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpire $ shadowFlag $ ipServicePort $ ipProtocolNumber $ oncRpcNumber $ miWmprefMessageCount $ miWmprefComposeWidth $ miWmprefComposeHeight $ miWmprefSummaryCount $ miDomainQuota $ mpSystemPref $ mpCounterDomain $ mpCounterUser $ mpDomainStorageQuota $ mpDomainMailboxQuota $ mpDomainForwarderQuota ) ) write(2,"5045f720 matchingRuleUse: ( 2.5."...,975) = 975 (0x3cf) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 2.5.13.13 (booleanMatch): write(2,"5045f720 2.5.13.13 (booleanM"...,39) = 39 (0x27) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 matchingRuleUse: ( 2.5.13.13 NAME 'booleanMatch' APPLIES ( hasSubordinates $ olcAddContentAcl $ olcGentleHUP $ olcHidden $ olcLastMod $ olcMirrorMode $ olcMonitoring $ olcReadOnly $ olcReverseLookup $ olcSyncUseSubentry $ olcSpNoPresent $ olcSpReloadHint $ olcDbNoSync $ miWmprefSaveSent $ miWmprefUseTrashFolder $ miWmprefIncludeSignature $ miWmprefUseHTML $ miWmprefReqDeliveryReceipt $ miWmprefReqReadReceipt $ miWmprefConfirmReadReceipt $ miWmprefNewArrivalFirst $ miWmprefShowMessagePane ) ) write(2,"5045f720 matchingRuleUse: ( 2.5."...,506) = 506 (0x1fa) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 2.5.13.11 (caseIgnoreListMatch): write(2,"5045f720 2.5.13.11 (caseIgno"...,46) = 46 (0x2e) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 matchingRuleUse: ( 2.5.13.11 NAME 'caseIgnoreListMatch' APPLIES ( postalAddress $ registeredAddress $ homePostalAddress ) ) write(2,"5045f720 matchingRuleUse: ( 2.5."...,133) = 133 (0x85) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 2.5.13.9 (numericStringOrderingMatch): write(2,"5045f720 2.5.13.9 (numericSt"...,52) = 52 (0x34) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 matchingRuleUse: ( 2.5.13.9 NAME 'numericStringOrderingMatch' APPLIES ( x121Address $ internationaliSDNNumber ) ) write(2,"5045f720 matchingRuleUse: ( 2.5."...,123) = 123 (0x7b) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 2.5.13.8 (numericStringMatch): write(2,"5045f720 2.5.13.8 (numericSt"...,44) = 44 (0x2c) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 matchingRuleUse: ( 2.5.13.8 NAME 'numericStringMatch' APPLIES ( x121Address $ internationaliSDNNumber ) ) write(2,"5045f720 matchingRuleUse: ( 2.5."...,115) = 115 (0x73) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 2.5.13.7 (caseExactSubstringsMatch): write(2,"5045f720 2.5.13.7 (caseExact"...,50) = 50 (0x32) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 matchingRuleUse: ( 2.5.13.7 NAME 'caseExactSubstringsMatch' APPLIES ( serialNumber $ destinationIndicator $ dnQualifier ) ) write(2,"5045f720 matchingRuleUse: ( 2.5."...,133) = 133 (0x85) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 2.5.13.6 (caseExactOrderingMatch): write(2,"5045f720 2.5.13.6 (caseExact"...,48) = 48 (0x30) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 matchingRuleUse: ( 2.5.13.6 NAME 'caseExactOrderingMatch' APPLIES ( supportedSASLMechanisms $ vendorName $ vendorVersion $ ref $ name $ cn $ uid $ labeledURI $ description $ olcConfigFile $ olcConfigDir $ olcAccess $ olcAllows $ olcArgsFile $ olcAttributeOptions $ olcAttributeTypes $ olcAuthIDRewrite $ olcAuthzPolicy $ olcAuthzRegexp $ olcBackend $ olcDatabase $ olcDisallows $ olcDitContentRules $ olcExtraAttrs $ olcInclude $ olcLdapSyntaxes $ olcLimits $ olcLogFile $ olcLogLevel $ olcModuleLoad $ olcModulePath $ olcObjectClasses $ olcObjectIdentifier $ olcOverlay $ olcPasswordCryptSaltFormat $ olcPasswordHash $ olcPidFile $ olcPlugin $ olcPluginLogFile $ olcReferral $ olcReplica $ olcReplicaArgsFile $ olcReplicaPidFile $ olcReplogFile $ olcRequires $ olcRestrict $ olcRootDSE $ olcRootPW $ olcSaslAuxprops $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ olcSecurity $ olcServerID $ olcSizeLimit $ olcSortVals $ olcSubordinate $ olcSyncrepl $ olcTCPBuffer $ olcTimeLimit $ olcTLSCACertificateFile $ olcTLwrite(2,"5045f720 matchingRuleUse: ( 2.5."...,1024) = 1024 (0x400) SCACertificatePath $ olcTLSCertificateFile $ olcTLSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ olcTLSCRLFile $ olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ olcTLSProtocolMin $ olcUpdateRef $ olcDbDirectory $ olcSpCheckpoint $ olcDbCheckpoint $ olcDbIndex $ olcDbMode $ knowledgeInformation $ sn $ serialNumber $ c $ l $ st $ street $ o $ ou $ title $ businessCategory $ postalCode $ postOfficeBox $ physicalDeliveryOfficeName $ destinationIndicator $ givenName $ initials $ generationQualifier $ dnQualifier $ houseIdentifier $ dmdName $ pseudonym $ textEncodedORAddress $ info $ drink $ roomNumber $ userClass $ host $ documentIdentifier $ documentTitle $ documentVersion $ documentLocation $ personalTitle $ co $ uniqueIdentifier $ organizationalStatus $ buildingName $ documentPublisher $ ipServiceProtocol $ nisMapName $ carLicense $ departmentNumber $ displayName $ employeeNumber $ employeeType $ preferredLanguage $ miAutoreplyText $ miAutoreplySubject $ miWmprefFullName $ miWmprefSentFoldwrite(2,"SCACertificatePath $ olcTLSCerti"...,1024) = 1024 (0x400) er $ miWmprefTrashFolder $ miWmprefDraftFolder $ miWmprefSignature $ mpCosFriendlyName $ mpCosDescription ) ) write(2,"er $ miWmprefTrashFolder $ miWmp"...,110) = 110 (0x6e) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 2.5.13.5 (caseExactMatch): write(2,"5045f720 2.5.13.5 (caseExact"...,40) = 40 (0x28) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 matchingRuleUse: ( 2.5.13.5 NAME 'caseExactMatch' APPLIES ( supportedSASLMechanisms $ vendorName $ vendorVersion $ ref $ name $ cn $ uid $ labeledURI $ description $ olcConfigFile $ olcConfigDir $ olcAccess $ olcAllows $ olcArgsFile $ olcAttributeOptions $ olcAttributeTypes $ olcAuthIDRewrite $ olcAuthzPolicy $ olcAuthzRegexp $ olcBackend $ olcDatabase $ olcDisallows $ olcDitContentRules $ olcExtraAttrs $ olcInclude $ olcLdapSyntaxes $ olcLimits $ olcLogFile $ olcLogLevel $ olcModuleLoad $ olcModulePath $ olcObjectClasses $ olcObjectIdentifier $ olcOverlay $ olcPasswordCryptSaltFormat $ olcPasswordHash $ olcPidFile $ olcPlugin $ olcPluginLogFile $ olcReferral $ olcReplica $ olcReplicaArgsFile $ olcReplicaPidFile $ olcReplogFile $ olcRequires $ olcRestrict $ olcRootDSE $ olcRootPW $ olcSaslAuxprops $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ olcSecurity $ olcServerID $ olcSizeLimit $ olcSortVals $ olcSubordinate $ olcSyncrepl $ olcTCPBuffer $ olcTimeLimit $ olcTLSCACertificateFile $ olcTLSCACertiwrite(2,"5045f720 matchingRuleUse: ( 2.5."...,1024) = 1024 (0x400) ficatePath $ olcTLSCertificateFile $ olcTLSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ olcTLSCRLFile $ olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ olcTLSProtocolMin $ olcUpdateRef $ olcDbDirectory $ olcSpCheckpoint $ olcDbCheckpoint $ olcDbIndex $ olcDbMode $ knowledgeInformation $ sn $ serialNumber $ c $ l $ st $ street $ o $ ou $ title $ businessCategory $ postalCode $ postOfficeBox $ physicalDeliveryOfficeName $ destinationIndicator $ givenName $ initials $ generationQualifier $ dnQualifier $ houseIdentifier $ dmdName $ pseudonym $ textEncodedORAddress $ info $ drink $ roomNumber $ userClass $ host $ documentIdentifier $ documentTitle $ documentVersion $ documentLocation $ personalTitle $ co $ uniqueIdentifier $ organizationalStatus $ buildingName $ documentPublisher $ ipServiceProtocol $ nisMapName $ carLicense $ departmentNumber $ displayName $ employeeNumber $ employeeType $ preferredLanguage $ miAutoreplyText $ miAutoreplySubject $ miWmprefFullName $ miWmprefSentFolder $ miWwrite(2,"ficatePath $ olcTLSCertificateFi"...,1024) = 1024 (0x400) mprefTrashFolder $ miWmprefDraftFolder $ miWmprefSignature $ mpCosFriendlyName $ mpCosDescription ) ) write(2,"mprefTrashFolder $ miWmprefDraft"...,102) = 102 (0x66) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 2.5.13.4 (caseIgnoreSubstringsMatch): write(2,"5045f720 2.5.13.4 (caseIgnor"...,51) = 51 (0x33) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 matchingRuleUse: ( 2.5.13.4 NAME 'caseIgnoreSubstringsMatch' APPLIES ( serialNumber $ destinationIndicator $ dnQualifier ) ) write(2,"5045f720 matchingRuleUse: ( 2.5."...,134) = 134 (0x86) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 2.5.13.3 (caseIgnoreOrderingMatch): write(2,"5045f720 2.5.13.3 (caseIgnor"...,49) = 49 (0x31) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 matchingRuleUse: ( 2.5.13.3 NAME 'caseIgnoreOrderingMatch' APPLIES ( supportedSASLMechanisms $ vendorName $ vendorVersion $ ref $ name $ cn $ uid $ labeledURI $ description $ olcConfigFile $ olcConfigDir $ olcAccess $ olcAllows $ olcArgsFile $ olcAttributeOptions $ olcAttributeTypes $ olcAuthIDRewrite $ olcAuthzPolicy $ olcAuthzRegexp $ olcBackend $ olcDatabase $ olcDisallows $ olcDitContentRules $ olcExtraAttrs $ olcInclude $ olcLdapSyntaxes $ olcLimits $ olcLogFile $ olcLogLevel $ olcModuleLoad $ olcModulePath $ olcObjectClasses $ olcObjectIdentifier $ olcOverlay $ olcPasswordCryptSaltFormat $ olcPasswordHash $ olcPidFile $ olcPlugin $ olcPluginLogFile $ olcReferral $ olcReplica $ olcReplicaArgsFile $ olcReplicaPidFile $ olcReplogFile $ olcRequires $ olcRestrict $ olcRootDSE $ olcRootPW $ olcSaslAuxprops $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ olcSecurity $ olcServerID $ olcSizeLimit $ olcSortVals $ olcSubordinate $ olcSyncrepl $ olcTCPBuffer $ olcTimeLimit $ olcTLSCACertificateFile $ olcTwrite(2,"5045f720 matchingRuleUse: ( 2.5."...,1024) = 1024 (0x400) LSCACertificatePath $ olcTLSCertificateFile $ olcTLSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ olcTLSCRLFile $ olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ olcTLSProtocolMin $ olcUpdateRef $ olcDbDirectory $ olcSpCheckpoint $ olcDbCheckpoint $ olcDbIndex $ olcDbMode $ knowledgeInformation $ sn $ serialNumber $ c $ l $ st $ street $ o $ ou $ title $ businessCategory $ postalCode $ postOfficeBox $ physicalDeliveryOfficeName $ destinationIndicator $ givenName $ initials $ generationQualifier $ dnQualifier $ houseIdentifier $ dmdName $ pseudonym $ textEncodedORAddress $ info $ drink $ roomNumber $ userClass $ host $ documentIdentifier $ documentTitle $ documentVersion $ documentLocation $ personalTitle $ co $ uniqueIdentifier $ organizationalStatus $ buildingName $ documentPublisher $ ipServiceProtocol $ nisMapName $ carLicense $ departmentNumber $ displayName $ employeeNumber $ employeeType $ preferredLanguage $ miAutoreplyText $ miAutoreplySubject $ miWmprefFullName $ miWmprefSentFolwrite(2,"LSCACertificatePath $ olcTLSCert"...,1024) = 1024 (0x400) der $ miWmprefTrashFolder $ miWmprefDraftFolder $ miWmprefSignature $ mpCosFriendlyName $ mpCosDescription ) ) write(2,"der $ miWmprefTrashFolder $ miWm"...,111) = 111 (0x6f) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 2.5.13.2 (caseIgnoreMatch): write(2,"5045f720 2.5.13.2 (caseIgnor"...,41) = 41 (0x29) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 matchingRuleUse: ( 2.5.13.2 NAME 'caseIgnoreMatch' APPLIES ( supportedSASLMechanisms $ vendorName $ vendorVersion $ ref $ name $ cn $ uid $ labeledURI $ description $ olcConfigFile $ olcConfigDir $ olcAccess $ olcAllows $ olcArgsFile $ olcAttributeOptions $ olcAttributeTypes $ olcAuthIDRewrite $ olcAuthzPolicy $ olcAuthzRegexp $ olcBackend $ olcDatabase $ olcDisallows $ olcDitContentRules $ olcExtraAttrs $ olcInclude $ olcLdapSyntaxes $ olcLimits $ olcLogFile $ olcLogLevel $ olcModuleLoad $ olcModulePath $ olcObjectClasses $ olcObjectIdentifier $ olcOverlay $ olcPasswordCryptSaltFormat $ olcPasswordHash $ olcPidFile $ olcPlugin $ olcPluginLogFile $ olcReferral $ olcReplica $ olcReplicaArgsFile $ olcReplicaPidFile $ olcReplogFile $ olcRequires $ olcRestrict $ olcRootDSE $ olcRootPW $ olcSaslAuxprops $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ olcSecurity $ olcServerID $ olcSizeLimit $ olcSortVals $ olcSubordinate $ olcSyncrepl $ olcTCPBuffer $ olcTimeLimit $ olcTLSCACertificateFile $ olcTLSCACertwrite(2,"5045f720 matchingRuleUse: ( 2.5."...,1024) = 1024 (0x400) ificatePath $ olcTLSCertificateFile $ olcTLSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ olcTLSCRLFile $ olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ olcTLSProtocolMin $ olcUpdateRef $ olcDbDirectory $ olcSpCheckpoint $ olcDbCheckpoint $ olcDbIndex $ olcDbMode $ knowledgeInformation $ sn $ serialNumber $ c $ l $ st $ street $ o $ ou $ title $ businessCategory $ postalCode $ postOfficeBox $ physicalDeliveryOfficeName $ destinationIndicator $ givenName $ initials $ generationQualifier $ dnQualifier $ houseIdentifier $ dmdName $ pseudonym $ textEncodedORAddress $ info $ drink $ roomNumber $ userClass $ host $ documentIdentifier $ documentTitle $ documentVersion $ documentLocation $ personalTitle $ co $ uniqueIdentifier $ organizationalStatus $ buildingName $ documentPublisher $ ipServiceProtocol $ nisMapName $ carLicense $ departmentNumber $ displayName $ employeeNumber $ employeeType $ preferredLanguage $ miAutoreplyText $ miAutoreplySubject $ miWmprefFullName $ miWmprefSentFolder $ miwrite(2,"ificatePath $ olcTLSCertificateF"...,1024) = 1024 (0x400) WmprefTrashFolder $ miWmprefDraftFolder $ miWmprefSignature $ mpCosFriendlyName $ mpCosDescription ) ) write(2,"WmprefTrashFolder $ miWmprefDraf"...,103) = 103 (0x67) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 1.2.36.79672281.1.13.3 (rdnMatch): write(2,"5045f720 1.2.36.79672281.1.1"...,48) = 48 (0x30) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 2.5.13.1 (distinguishedNameMatch): write(2,"5045f720 2.5.13.1 (distingui"...,48) = 48 (0x30) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 matchingRuleUse: ( 2.5.13.1 NAME 'distinguishedNameMatch' APPLIES ( creatorsName $ modifiersName $ subschemaSubentry $ entryDN $ namingContexts $ aliasedObjectName $ dynamicSubtrees $ distinguishedName $ seeAlso $ olcDefaultSearchBase $ olcRootDN $ olcSchemaDN $ olcSuffix $ olcUpdateDN $ olcRelay $ member $ owner $ roleOccupant $ manager $ documentAuthor $ secretary $ associatedName $ dITRedirect $ miCosdn $ mpCosBaseDn $ mpCosDn ) ) write(2,"5045f720 matchingRuleUse: ( 2.5."...,447) = 447 (0x1bf) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 2.5.13.0 (objectIdentifierMatch): write(2,"5045f720 2.5.13.0 (objectIde"...,47) = 47 (0x2f) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 matchingRuleUse: ( 2.5.13.0 NAME 'objectIdentifierMatch' APPLIES ( supportedControl $ supportedExtension $ supportedFeatures $ supportedApplicationContext ) ) write(2,"5045f720 matchingRuleUse: ( 2.5."...,168) = 168 (0xa8) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 slapadd startup: initiated. write(2,"5045f720 slapadd startup: initia"...,37) = 37 (0x25) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 backend_startup_one: starting "o=top" write(2,"5045f720 backend_startup_one: st"...,47) = 47 (0x2f) stat("/var/db/openldap-data",{ mode=drwx------ ,inode=3211,size=512,blksize=16384 }) = 0 (0x0) mmap(0x0,4194304,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 34388172800 (0x801b1e000) mmap(0x801f1e000,925696,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 34392367104 (0x801f1e000) munmap(0x801b1e000,925696) = 0 (0x0) mmap(0x0,2097152,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 34393292800 (0x802000000) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 mdb_db_open: database "o=top": dbenv_open(/var/db/openldap-data). write(2,"5045f720 mdb_db_open: database ""...,75) = 75 (0x4b) open("/var/db/openldap-data/lock.mdb",O_RDWR|O_CREAT|0x100000,0600) = 3 (0x3) fcntl(3,F_SETLK,0x7fffffffe320) = 0 (0x0) lseek(3,0x0,SEEK_END) = 0 (0x0) ftruncate(3,8192,0x0) = 0 (0x0) mmap(0x0,8192,PROT_READ|PROT_WRITE,MAP_SHARED,3,0x0) = 34366271488 (0x80063b000) close(3) = 0 (0x0) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 mdb_db_open: database "o=top" cannot be opened, err 22. Restore from backup! write(2,"5045f720 mdb_db_open: database ""...,86) = 86 (0x56) close(-1) ERR#9 'Bad file descriptor' getpid() = 15568 (0x3cd0) munmap(0x80063b000,8192) = 0 (0x0) close(-1) ERR#9 'Bad file descriptor' munmap(0x801c00000,4194304) = 0 (0x0) clock_gettime(13,{1346762528.000000000 }) = 0 (0x0) 5045f720 backend_startup_one (type=mdb, suffix="o=top"): bi_db_open failed! (22) write(2,"5045f720 backend_startup_one (ty"...,81) = 81 (0x51) slap_startup failed write(2,"slap_startup failed\n",20) = 20 (0x14) sigprocmask(SIG_BLOCK,SIGHUP|SIGINT|SIGQUIT|SIGKILL|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2,0x0) = 0 (0x0) sigprocmask(SIG_SETMASK,0x0,0x0) = 0 (0x0) sigprocmask(SIG_BLOCK,SIGHUP|SIGINT|SIGQUIT|SIGKILL|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2,0x0) = 0 (0x0) sigprocmask(SIG_SETMASK,0x0,0x0) = 0 (0x0) sigprocmask(SIG_BLOCK,SIGHUP|SIGINT|SIGQUIT|SIGKILL|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2,0x0) = 0 (0x0) sigprocmask(SIG_SETMASK,0x0,0x0) = 0 (0x0) sigprocmask(SIG_BLOCK,SIGHUP|SIGINT|SIGQUIT|SIGKILL|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2,0x0) = 0 (0x0) sigprocmask(SIG_SETMASK,0x0,0x0) = 0 (0x0) sigprocmask(SIG_BLOCK,SIGHUP|SIGINT|SIGQUIT|SIGKILL|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2,0x0) = 0 (0x0) sigprocmask(SIG_SETMASK,0x0,0x0) = 0 (0x0) sigprocmask(SIG_BLOCK,SIGHUP|SIGINT|SIGQUIT|SIGKILL|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2,0x0) = 0 (0x0) sigprocmask(SIG_SETMASK,0x0,0x0) = 0 (0x0) sigprocmask(SIG_BLOCK,SIGHUP|SIGINT|SIGQUIT|SIGKILL|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2,0x0) = 0 (0x0) sigprocmask(SIG_SETMASK,0x0,0x0) = 0 (0x0) sigprocmask(SIG_BLOCK,SIGHUP|SIGINT|SIGQUIT|SIGKILL|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2,0x0) = 0 (0x0) sigprocmask(SIG_SETMASK,0x0,0x0) = 0 (0x0) sigprocmask(SIG_BLOCK,SIGHUP|SIGINT|SIGQUIT|SIGKILL|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2,0x0) = 0 (0x0) sigprocmask(SIG_SETMASK,0x0,0x0) = 0 (0x0) sigprocmask(SIG_BLOCK,SIGHUP|SIGINT|SIGQUIT|SIGKILL|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2,0x0) = 0 (0x0) sigprocmask(SIG_SETMASK,0x0,0x0) = 0 (0x0) sigprocmask(SIG_BLOCK,SIGHUP|SIGINT|SIGQUIT|SIGKILL|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2,0x0) = 0 (0x0) sigprocmask(SIG_SETMASK,0x0,0x0) = 0 (0x0) sigprocmask(SIG_BLOCK,SIGHUP|SIGINT|SIGQUIT|SIGKILL|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2,0x0) = 0 (0x0) sigprocmask(SIG_SETMASK,0x0,0x0) = 0 (0x0) sigprocmask(SIG_BLOCK,SIGHUP|SIGINT|SIGQUIT|SIGKILL|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2,0x0) = 0 (0x0) sigprocmask(SIG_SETMASK,0x0,0x0) = 0 (0x0) process exit, rval = 1 Regards, Nikolai Schupbach

2 2

OpenLDAP server V2.4 & OpenLDAP clients V2.3
by S, Mohan (GE Energy) 04 Sep '12

04 Sep '12

We have a situation where all the LDAP client OS runs with RHEL V5.7 and LDAP Server should be in master-master configuration. We can't have the OpenLDAP servers at RHEL V5.7 as multi master configuration is introduced only from RHEL V6 (OpenLDAP V2.4 support). To achieve this we decided to have OpenLDAP Servers running with RHEL V6 and have master-master configuration, retain the clients with RHEL 5.7 (OpenLDAP V2.3). Do you foresee any issue in having OpenLDAP servers with V2.4 and Clients with V2.3? Accordingly, We will be starting the pilot test this week to see is there any issue. Thanks, Mohan

1 0

Slaving from Mirror Mode Masters
by Nick Urbanik 04 Sep '12

04 Sep '12

Dear Folks, We are setting up mirror mode masters with eight fairly heavily loaded slaves (consumers). Should they all slave from both masters? An alternative is to slave from one, where a floating IP address is that of "the master". Please can anyone share their experience? Would all slaves being consumers to two masters result in any marked increased load on any of the servers? -- Nick Urbanik http://nicku.org 808-71011 nick.urbanik(a)optusnet.com.au GPG: 7FFA CDC7 5A77 0558 DC7A 790A 16DF EC5B BB9D 2C24 ID: BB9D2C24 I disclaim, therefore I am.

3 2

In MirrorMode - proxy or external frontend needed?
by Pieter Baele 04 Sep '12

04 Sep '12

I've 2 servers in MirrorMode, a part of the tree wil also be partially replicated to 3 slaves. Do I really need an LDAP proxy or Load balancer(s) so writes are only directed to one server? In our LDAP, the number of writes will be very very low, most of them will be reads (authentication, ssh keys, puppet nodes...) Any benefit in using 'normal' n multimaster instead of MirrorMode?

4 4

LDAP database corrupted
by Adonai Silveira Canez 03 Sep '12

03 Sep '12

Hi, my server restarted because of power failure and corrupted the database. Now the command: slapcat | grep "uid=" | wc -l displays 918 users and the command ldapsearch -LLL -x -h localhost -b "dc=prodemge,dc=gov,dc=br" uid | grep "uid=" | wc -l displays the correct number of 1520 users. I've tested the command: usr/sbin/slapd_db_recover -h /var/lib/ldap -c but not solved the problem. What can I do to try to fix it? Thanks, Adonai S. Canez

1 0

Inherit attributes
by Alexander Sulfrian 03 Sep '12

03 Sep '12

Hi, I have some special requirements for a ldap installation. I want to use a central ldap for a group of users having access to different services. The user should be able to set a different password for each service. I try to keep the effort low, therefor I particularly do not want to modify each of the services. (They all authenticate via ldap-bind.) To archive the desired features I tried to use the following entity tree. dn: uid=alex,ou=People,dc=example,dc=com dn: cn=service1,uid=alex,ou=People,dc=example,dc=com dn: cn=service2,uid=alex,ou=People,dc=example,dc=com The uid=alex entity is the real account. Storing the name, uid, the master password for this account and possibly other attributes. The "sub"-entities with cn=service* should only store the password, if it is set to a special value. Now the problem: It should be find the service entities if matched against attributes of the "master" account. That means that I want to search for (uid=alex) and want to find all the three dns mentioned above (but only the first dn should keep the real data - I do not want to sync all data on every change into all "sub"-entities). What I have tried so far: - collect-overlay: Apart from the problem, that I have to specify the explicit master dn (it is impossible to specify some thing like uid=*,ou=People...), the collected attributes could not be matched with an filter during ldap search. - rwm-overlay: I did not find a context, where I could rewrite the dn, that is matched against a filter and I do not know if it is possible. The searchFilterAttrDN context sounds promising, but I did not find any documentation. So what can I do, to get it working. It seems, that maybe an ldap-backend or meta-backend proxying the requests to the local server, could used to archive that, but I wanted to know if there is any easier way. If the attributes are inherited the ldap-bind with the password fallback could be archived in a way with the rwm-overlay: dn: olcOverlay=rwm,olcDatabase={1}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcRwmConfig olcOverlay: rwm olcRwmRewrite: rwm-rewriteEngine "on" olcRwmRewrite: rwm-rewriteMap slapd usermap "ldap:///ou=People,dc=example,dc=com?dn?sub" olcRwmRewrite: rwm-rewriteContext "bindDN" olcRwmRewrite: rwm-rewriteRule "^(cn=[^,]+),(uid=[^,]+),.*$" "${usermap((&(userPassword=*)($1)($2)))}" ":@I" olcRwmRewrite: rwm-rewriteRule "^cn=[^,]+,(uid=[^,]+),.*$" "${usermap((&(userPassword=*)($1)))}" ":@I" olcRwmTFSupport: no olcRwmNormalizeMapped: FALSE Thanks, Alex

1 0

Configuring ppolicy problem
by cbulist 01 Sep '12

01 Sep '12

Hi, I'm trying to configure ppolicy but It's not working when I set pwdMaxAge and pwdWarning (I am able to login when my password is suppose to be expired) I tried with shadowAccount instead of PwdPolicy and It is working well. This is my relevant setting in slapd.conf include /etc/openldap/schema/ppolicy.schema moduleload ppolicy.la overlay ppolicy ppolicy_default "cn=default,ou=policies,dc=sample,dc=com" ppolicy_use_lockout My ldip file is: objectClass: organizationalUnit objectClass: top ou: policies dn: cn=default,ou=policies,dc=sample,dc=com objectClass: pwdPolicy objectClass: person objectClass: top cn: default pwdAttribute: userPassword sn: dummy pwdAllowUserChange: TRUE pwdCheckQuality: 2 pwdExpireWarning: 50 pwdFailureCountInternal: 30 pwdGraceAuthNLimit: 5 pwdInHistory: 5 pwdLockout: FALSE pwdLockDuration:0 pwdMaxAge: 60 pwdMaxAge: 0 pwdMaxFailure: 5 pwdMinAge: 0 pwdMinLenght: 5 pwdMustChange: FALSE pwdSafeModify: FALSE dn: cn=user1,ou=policies,dc=sample,dc=com objectClass: pwdPolicy objectClass: person objectClass: top objectClass: posixAccount objectClass: pwdPolicy objectClass: shadowAccount cn: user1 pwdAttribute: userPassword gidNumber: 501 homeDirectory: /home/user1 sn: test uid: user1 uidNumber: 501 pwdAllowUserChange: TRUE pwdAge: 20 pwdExpireWarning: 15 userPassword: XXXXX Thanks in advance!

5 11

Re: Performance of MDB and BDB Please suggest?
by Yajuvendra Singh 31 Aug '12

31 Aug '12

Hi Quanah, Thanks for replying, I have few more observation regrading my load runs, real time of load run with MDB is 98% even at 10 TPS. What version of OpenLDAP are you using? ---2.4.32 What type of disk? --root@tspatca2103> fdisk -l /dev/mapper/vg00-root Disk /dev/mapper/vg00-root: 10.7 GB, 10737418240 bytes 255 heads, 63 sectors/track, 1305 cylinders Units = cylinders of 16065 * 512 = 8225280 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disk identifier: 0x00000000 Disk /dev/mapper/vg00-root doesn't contain a valid partition table root@tspatca2103> What type of file system? --ext4 (/dev/mapper/vg00-root on / type ext4 (rw,nouser_xattr)) What is your *exact* slapadd command? --/opt/openldap/yaju/sbin/slapadd -q -w -f /opt/openldap/yaju/etc/openldap/slapd.conf -l /root/yaju/db.ldif I am using jmeter to simulate the load. -- Thanks and Regards Yajuvendra On Tue, Aug 28, 2012 at 8:19 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Tuesday, August 28, 2012 5:29 PM +0530 Yajuvendra Singh < > yajuvendra.singh(a)gmail.com> wrote: > > Dear Experts, >> >> >> Today we tried with to run the load with the below schema. We added about >> .6M entries in the DB. >> Still our performance is severely poor. (10 TPS) >> >> >> Can anybody review our slapd.conf file and point us where we are wrong, >> is there any other config we have missed out. >> > > You don't provide any useful or relevant information, so it is impossible > to help you. > > What version of OpenLDAP are you using? > What type of disk? > What type of file system? > What is your *exact* slapadd command? > etc. > > There is virtually no tuning involved with MDB, although I strongly > recommend you read Howard's notes about the writeback bits for EXT4 etc he > made in a recent post to -technical about MDB. > > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

4 8

help with setting up replication
by Jeff Dickens 30 Aug '12

30 Aug '12

I've been following this page from the Ubuntu Server Guide with generally good results: https://help.ubuntu.com/12.04/serverguide/openldap-server.html Now I'm down to the replication section, at https://help.ubuntu.com/12.04/serverguide/openldap-server.html#openldap-ser… . So far it isn't working. First things first: I create the following ldif file to configure the sync provider: # Add indexes to the frontend db. dn: olcDatabase={1}hdb,cn=config changetype: modify add: olcDbIndex olcDbIndex: entryCSN eq - add: olcDbIndex olcDbIndex: entryUUID eq #Load the syncprov and accesslog modules. dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: syncprov - add: olcModuleLoad olcModuleLoad: accesslog # Accesslog database definitions dn: olcDatabase={2}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {2}hdb olcDbDirectory: /var/lib/ldap/accesslog olcSuffix: cn=accesslog olcRootDN: cn=admin,dc=intranet,dc=seamanpaper,dc=com olcDbIndex: default eq olcDbIndex: entryCSN,objectClass,reqEnd,reqResult,reqStart # Accesslog db syncprov. dn: olcOverlay=syncprov,olcDatabase={2}hdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov olcSpNoPresent: TRUE olcSpReloadHint: TRUE # syncrepl Provider for primary db dn: olcOverlay=syncprov,olcDatabase={1}hdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov olcSpNoPresent: TRUE # accesslog overlay definitions for primary db dn: olcOverlay=accesslog,olcDatabase={1}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcAccessLogConfig olcOverlay: accesslog olcAccessLogDB: cn=accesslog olcAccessLogOps: writes olcAccessLogSuccess: TRUE # scan the accesslog DB every day, and purge entries older than 7 days olcAccessLogPurge: 07+00:00 01+00:00 The guide says you can test the provider with this command: root@grackle:~# ldapsearch -z1 -LLLQY EXTERNAL -H ldapi:/// -s base contextCSN dn: root@grackle:~# but as you see that doesn't return anything. However, this command does find it: root@grackle:~# slapcat | grep -C 10 contextCSN objectClass: organization o: intranet.seamanpaper.com dc: intranet structuralObjectClass: organization entryUUID: 99e43416-73a1-1031-9d82-4f560555aca0 creatorsName: cn=admin,dc=intranet,dc=seamanpaper,dc=com createTimestamp: 20120805233244Z entryCSN: 20120805233244.262007Z#000000#000#000000 modifiersName: cn=admin,dc=intranet,dc=seamanpaper,dc=com modifyTimestamp: 20120805233244Z contextCSN: 20120829024252.920832Z#000000#000#000000 dn: cn=admin,dc=intranet,dc=seamanpaper,dc=com objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator userPassword:: e1NTSEF9Nm9zUVlmUStzd1RCOVJCQXUyL3NhQURpYTZ1R0NuRC8= structuralObjectClass: organizationalRole entryUUID: 99e4f9fa-73a1-1031-9d83-4f560555aca0 creatorsName: cn=admin,dc=intranet,dc=seamanpaper,dc=com root@grackle:~# Before I go on to figure out why the sync isn't working, why isn't the ldapsearch command above returning anything? Thanks in advance for your help. -- * Jeff Dickens* IT Manager 978-632-1513

3 3

LinuxCon Presentation 2012-08-29
by Howard Chu 30 Aug '12

30 Aug '12

Just FYI, I'll be giving a talk on MDB, OpenLDAP's new memory-mapped database library, at LinuxCon in San Diego next month. http://events.linuxfoundation.org/events/linuxcon/schedule Some of the benchmark data I posted here will be part of that talk: http://highlandsun.com/hyc/mdb/microbench/ If you haven't looked into MDB yet, here's your chance to find out all about it! -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

3 3

How to config LDAP client to get data from multiple sub domains in LDAP server?
by Qian Zhang 30 Aug '12

30 Aug '12

Hi All, I encountered one issue when configuring the LDAP client. My question is how to configure the LDAP client to make it get the users and groups information from two sub domains. The base domain of the LDAP server is "dc=main,dc=com", and under the base domain, there are more than one sub domains. Such as, sub domain 1 ("dc=sub1,dc=main,dc=com"), sub domain 2 ("dc=sub2,dc=main,dc=com"), sub domain 3 ("dc=sub3,dc=main,dc=com"), .... Now I just wanna list the users and groups information from sub domain sub1 and sub domain sub2 (by command "getent passwd"). The information from sub domain sub3 must be excluded. My test env is : Rehl6.2_x86_64, openldap-2.4.23 I have tried the following way: Step1, configure the LDAP server. I used the access control item "olcAccess" in file /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{2\}bdb.ldif olcAccess: to dn.subtree="dc=sub1,dc=main,dc=com" by dn="uid=user1,dc=sub1,dc=main,dc=com" read olcAccess: to dn.subtree="dc=sub2,dc=main,dc=com" by dn="uid=user1,dc=sub1,dc=main,dc=com" read See above, I added the access controls, they mean that only the user "uid=user1,dc=sub1,dc=main,dc=com" can access the information of the two sub domains (sub1 and sub2). After added the configurations, I restarted slapd service in server side. Step2, configure the LDAP client, in /etc/nslcd and /etc/pam_ldap.conf, I modified the items blow: base dc=main,dc=com binddn uid=user1,dc=sub1,dc=main,dc=com bindpw *** Then restart the service nslcd, but I can't get any users information by command "getent passwd" in LDAP client side. ( I confirmed my others configuration are correct, if I change the base to "base dc=sub1,dc=main,dc=com", I can get all the information from sub1). I think the problem is from LDAP server side, the user "uid=user1,dc=sub1,dc=main,dc=com" in sub domain "sub1" is only allowed to access the sub doamins (sub1 and sub2) by access control. But I can't change the "base" from "dc=main,dc=com" to "dc=sub1,dc=main,dc=com" or "dc=sub2,dc=main,dc=com". That's because only one sub domain can be the "base", so I only can get the information from one of the sub domains, but this is not my purpose. Then I try to set the search scope to "scope sub", but still can't work. Any comments? I will be really appreciated for your feedback.

1 0

Re: Index Add Failures
by Kyle Smith 29 Aug '12

29 Aug '12

Quanah, Thanks for the info, I have confirmed I'm hitting the lock maxes of 1000. And I will be upgrading to 2.4.32. I was wondering, what steps should be done to have the changes in DB_CONFIG take effect? stop slapd make changes to DB_CONFIG db_recover start slapd Will this also auto remove the log.* files? ( I plan on setting this: "set_flags DB_LOG_AUTOREMOVE" in DB_CONFIG) Thanks! - Kyle 2012/8/28 Quanah Gibson-Mount <quanah(a)zimbra.com> > --On Tuesday, August 28, 2012 9:27 AM -0400 Kyle Smith < > alacer.cogitatus(a)gmail.com> wrote: > > Good Morning All, >> >> I receive events that mention "attribute memberUid index add failure". >> What does this mean? Once I notice these events, I have to restart >> slapd, as writes will not be performed and CPU usage hits 99% >> continuously. It seems to be associated with a high load, as our >> semester just got underway and we are seeing an increase in logins and >> searches (about 150-200 requests per minute). I am using the bdb >> backend. >> >> Specifications >> >> OpenLDAP 2.4.28 and 2.4.26 >> 4-way multi-master >> > > If you are using MMR, you desperately need to upgrade your OpenLDAP > Versions... aside from the error you are seeing is pretty typical from BDB > if you have run out of locks, lockers, or locker objects. You should check > out db_stat to see which resource you have run out of, and fix it > accordingly. > > You may with to read over <https://wiki.zimbra.com/wiki/** > OpenLDAP_Performance_Tuning#**Berkeley_DB_DB_CONFIG_tuning<https://wiki.zimbra.com/wiki/OpenLDAP_Performance_Tuning#Berkeley_DB_DB_CON…> > > > > Regards, > Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

Index Add Failures
by Kyle Smith 28 Aug '12

28 Aug '12

Good Morning All, I receive events that mention "attribute memberUid index add failure". What does this mean? Once I notice these events, I have to restart slapd, as writes will not be performed and CPU usage hits 99% continuously. It seems to be associated with a high load, as our semester just got underway and we are seeing an increase in logins and searches (about 150-200 requests per minute). I am using the bdb backend. Specifications OpenLDAP 2.4.28 and 2.4.26 4-way multi-master index gidnumber,uidnumber,objectClass,automountKey,nodisplay eq index uid,cn,sn,givenname,employeetype,mail,eaiGroup,memberUid,destinationIndicator eq,sub index facsimileTelephoneNumber eq,sub index mgrpRFC822MailMember pres Aug 28 02:40:41 poe slapd[10882]: conn=-1 op=0: attribute "memberUid" index add failure Thanks! Kyle Smith York College of Pennsylvania

2 1

RE: Performance of MDB and BDB Please suggest?
by Chris Card 28 Aug '12

28 Aug '12

Hi all, I am also doing some testing with mdb at the moment, and my initial testing indicates that mdb is faster for reads but slower for writes than bdb. I am using openldap 2.4.32 on centos 6, on a 24 core box with 132 Gb RAM. My test directory has ~ 3 million entries, and I loaded it into mdb using slapadd which took over 2 days (by comparison, the same load into bdb takes 2-3 hours). (as an aside, I initially tried using 2.4.31, but slapadd crashed after having loaded about 90% of the data, and this was repeatable). On disk the directory takes up ~ 13 Gb for mdb and ~ 18Gb for bdb. Cache size for bdb is set to 63 Gb in DB_CONFIG. Directory size for mdb is set to 63 Gb Adding 120000 entries from an ldif file using ldapadd took ~ 10 minutes for mdb and ~ 2 minutes for bdb. Deleting 120000 entries using ldapdelete took ~ 10 minutes for mdb and ~ 3 minutes for bdb A search returning ~ 300000 DNs took ~ 6 seconds for mdb and for bdb it took ~ 6 minutes from a cold start of slapd and then ~ 35 seconds. Chris

5 9

Re: slapd-meta doesn't continue with multiple uri's
by Liam Gretton 28 Aug '12

28 Aug '12

On 22/08/2012 22:14, Pierangelo Masarati wrote: >> But what's the point of specifying multiple targets in the uri >> option if it doesn't fall through to subsequent ones when the first >> is not contactable? >> >> Have I completely missed the point of the documentation? > > The point is that your condition is *not* a server unreachable. There's obviously some subtlety I'm missing here. How would you describe it instead? > Current failover only deals with failures/timeouts of connect(2). I > don't think handling your case using failover is appropriate. Your > case should be handled by removing the non-responding URI from the > list. I don't understand the difference. If a server is unavailable for whatever reason (offline, firewalled, switched off, nothing listening on the specified port), then connect() will timeout as you describe. Which failures are the current mechanism actually expected to cope with that don't include a server being unreachable? -- Liam Gretton liam.gretton(a)le.ac.uk HPC Architect http://www.le.ac.uk/its IT Services Tel: +44 (0)116 2522254 University of Leicester, University Road Leicestershire LE1 7RH, United Kingdom

5 9

acls
by Mundry, Marvin 27 Aug '12

27 Aug '12

Hi, I am trying to write acl statements that implement to following scenario: with the exception of cn=radius,ou=sa,dc=test,dc=com every user should be able to see all objects under ou=users,dc=test,dc=com. cn=radius,ou=sa,dc=test,dc=com should only see objects under ou=users,dc=test,dc=com with objectClass=radiusprofile I have tried the following acl statements which unfortunately do not work: ------------------------------- {11}to filter="(!(objectClass=radiusprofile))" by dn.exact="cn=radius,ou=sa,dc=test,dc=com" none by * break {12}to dn.subtree="ou=users,dc=test,dc=com" attrs=entry,@top,cn,entryUUID by users read by * break ------------------------------- statement {11} results in cn=radius,ou=sa,dc=test,dc=com not being able to see any objects. interestingly if I set the filter in {11} to "(objectClass=radiusprofile)" (without the inversion(!)) cn=radius,ou=sa,dc=test,dc=com can see all objects not having objectClass=radiusprofile, which is exactly the opposite of what I am trying to do. why does the inversion (!) in the filter statement result in cn=radius,ou=sa,dc=test,dc=com not being able to see any objects? Marvin

2 4

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical