- openldap-technical - openldap.org

BDB: Converting mmapped files to shared memory: Need slap{cat,add}?
by Nick Urbanik 27 Aug '12

27 Aug '12

Dear Folks, I have a large production 2.4.32 LDAP server slaving many trees. I set it up with memory-mapped files, and want to change it to use shared memory instead, since shared memory BDB seems to work better after watching the other servers that have been upgraded 2.3 => 2.4.32 with shared memory. To convert this, do I need to slapcat the directories and restore them after the configuration change with slapadd, or is it sufficient to use db_recover in each LDAP database after changing the configuration while slapd is stopped? -- Nick Urbanik http://nicku.org 808-71011 nick.urbanik(a)optusnet.com.au GPG: 7FFA CDC7 5A77 0558 DC7A 790A 16DF EC5B BB9D 2C24 ID: BB9D2C24 I disclaim, therefore I am.

3 3

mdb database protected against any power cut?
by Francois Gnu 25 Aug '12

25 Aug '12

Hello @ll! Is the mdb database protected against any power cut? Is the mechanism of recovery mdb database working fine? Thank you very much Librement, ------ Francois Trachez (kiko) Team Fedora|Lyon (France) http://stg.fedoraproject.org/fr/ http://stg.fedoraproject.org/es/

3 5

Re: OpenLDAP 2.4.32 available
by Clément OUDOT 24 Aug '12

24 Aug '12

2012/7/31 OpenLDAP Project <project(a)openldap.org>: > OpenLDAP 2.4.32 is now available for download as detailed on our download page: > > http://www.openldap.org/software/download/ Hi, you can find some RPMs here: http://ltb-project.org/wiki/download#openldap Clément OUDOT

1 0

Performance of MDB and BDB Please suggest?
by aryan rawat 24 Aug '12

24 Aug '12

Hi, I am working on Open-Ldap for one of my application and I was testing to find out which DB is FAST MDB or BDB for ldapsearch. Tested both the DB’s on same platform for .6 Million records. Configuration Done for BDB (openldap2.4.24) MDB (openldap2.4.32) Slapd.conf database hdb threads 32 Slapd.conf database mdb threads 32 maxsize 2147483648 DB_CONFIG set_cachesize 2 0 1 To test the same developed a java tool to send a bulk search request on Open Ldap for both the DB’s. Pumping the load for 400,500,1000,2000,2500 etc.. search request to openldap. *The outcome was BDB was almost 8 time faster than MDB. * To my surprise it was written that for search MDB is faster than BDB. Please suggest if I have done some wrong configuration in MDB.. BR's, Haroon

3 3

compiled the Openldap 2.4.32 with these setting are they the Best..
by aryan rawat 24 Aug '12

24 Aug '12

Hi , I have compiled the Openldap 2.4.32 with these options for MDB ./configure --prefix=/root/haroon/openldap/new1 --enable-debug=yes --enable-bdb=no --enable-hdb=no --enable-mdb=yes --with-cyrus-sasl --with-threads --with-tls=openssl CC="gcc" LDFLAGS="-L/usr/lib64/sasl2" CPPFLAGS="-I/usr/include/sasl" Are they the best setting or I need to set some thing different. BR's, Haroon

1 0

representing file pathnames
by Chuck Lever 23 Aug '12

23 Aug '12

Hi- (Sorry for the length, it's a pretty wonky problem). I'm working with the IETF NFSv4 working group on a schema for storing file system referral information in LDAP, as part of the FedFS standard (RFC 5716). I'm looking for some opinions about certain details of the schema. A "referral" is a file server response that conveys a table of file server hostname and export pathname pairs that are replicas of the local file set on that file server. When a referral is encountered, a file system client chooses a row from this table and mounts that export automatically as it continues to traverse the file system name space. Referrals are a standard part of both the NFSv4 and SMB protocols. FedFS provides a standard way to store these rows in an LDAP database. Each row is contained in a single LDAP record, called a File Set Location record. A group of these records that live under the same parent record is retrieved by a file server to generate the table in a referral response. Today an FSL record for an NFS referral contains among other things a UTF-8 string server hostname, an integer port number, and a binary blob containing an XDR-marshalled representation of the export pathname. Note that both the pathname components and hostname are represented in UTF-8 in the NFS protocol, which is why they are stored as UTF-8 in LDAP. XDR was chosen because the file server doesn't have to alter the pathname data it reads from the LDAP server; it can just turn it around and send it immediately on to NFS clients. The pathname's components are UTF-8 strings. The pathname is expressed as an ordered variable-length list of these strings. The pathname separator is not stored in the XDR blob, since physical file systems can use different characters for this purpose (HFS+ on Mac OS uses ":", POSIX uses "/", and Windows uses "\"). NFS typically performs single component lookups on the wire, so NFS clients are never concerned with how a file server might separate its pathname components. The downside of using a binary XDR blob is that it's not observable or editable via typical LDAP tools. Plus, ewww. It's been suggested that we use a file URL to represent export pathnames. A file URL is expressed in US-ASCII with escaping, and the pathname separator is stored in the string. A file URL also has the ability to store a hostname. "file://hostname/path/to/some/file" I'm not sure this is the best fit for our purpose. We're especially concerned about some of the complexities of converting escaped US-ASCII to UTF-8, and the use of a fixed pathname separator character. Can we represent the full range of the UTF-8 code set with a US-ASCII file URL? We could also use an NFS URL, which would allow us to express the server hostname, a port number, and the pathname in a single string. But both the hostname and pathname are enocded in US-ASCII, not UTF-8, and the NFS URL format employs a fixed pathname separator character. An alternative we have considered would store the pathname in a single-valued UTF-8 string attribute, including pathname separators, but also store the pathname separator character in a separate attribute. A simple escaping mechanism would be used to represent a separator character embedded in a component. We'd like to have a schema that represents referral data in a way that is considered natural for LDAP, can store the full richness that an NFS referral is capable of, and is easy to access and update with typical LDAP client tools like ldapmodify. Are there other ideas we haven't considered? What is a practical way to store an ordered variable-length list of strings in an LDAP attribute? Is there a similar CIFS URL format that might be used to store SMB share information? Thanks very much for your consideration. -- Chuck Lever chuck[dot]lever[at]oracle[dot]com

3 6

openldap 2.4.23 hangs
by rwsmith＠bislink.net 22 Aug '12

22 Aug '12

Hi, Not sure if I should post this here or with the CentOS mailing list (I am hoping they are monitoring this). I am using a stock CentOS 6.3 32-bit installation with # rpm -qa | grep openldap openldap-devel-2.4.23-26.el6_3.2.i686 openldap-2.4.23-26.el6_3.2.i686 openldap-clients-2.4.23-26.el6_3.2.i686 openldap-servers-2.4.23-26.el6_3.2.i686 I have a 4-way multi-master sync replication set up on four virtual servers using Citrix XenServer 6.2. I am also running Samba 3.5.10 as a PDC on one machine and BDC on the other three. All servers are also running sssd-1.8.0 for the Linux authentication. The problem is that one or more of the LDAP servers will hang, usually the one that acts as the PDC, since this is hit the hardest and is the more critical of the four. Usually but not always the "hang" will trickle to the other servers--usually when I am not watching during the middle of the night. Fortunately we are not yet in full production. Compiling from source is not yet an option. I must use the stock RPMs from CentOS per our design guidelines. LDAP will appear to hang but what appears to be happening is that only the listener becomes busy and will not get out this state. Here is a short pull of the logs that I am collecting: Aug 14 20:34:44 auth-us slapd[10357]: daemon: read active on 69 Aug 14 20:34:44 auth-us slapd[10357]: daemon: epoll: listen=7 active_threads=0 tvp=zero Aug 14 20:34:44 auth-us slapd[10357]: daemon: epoll: listen=8 active_threads=0 tvp=zero Aug 14 20:34:44 auth-us slapd[10357]: conn=1742 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Aug 14 20:34:44 auth-us slapd[10357]: conn=1742 op=0 STARTTLS Aug 14 20:34:44 auth-us slapd[10357]: conn=1742 op=0 RESULT oid= err=0 text= Aug 14 20:34:44 auth-us slapd[10357]: daemon: activity on 1 descriptor Aug 14 20:34:44 auth-us slapd[10357]: daemon: activity on: Aug 14 20:34:44 auth-us slapd[10357]: Aug 14 20:34:44 auth-us slapd[10357]: daemon: epoll: listen=7 active_threads=0 tvp=zero Aug 14 20:34:44 auth-us slapd[10357]: daemon: epoll: listen=8 active_threads=0 tvp=zero Aug 14 20:34:44 auth-us slapd[10357]: daemon: activity on 1 descriptor Aug 14 20:34:44 auth-us slapd[10357]: daemon: activity on: Aug 14 20:34:44 auth-us slapd[10357]: 69r Aug 14 20:34:44 auth-us slapd[10357]: Aug 14 20:34:44 auth-us slapd[10357]: daemon: read active on 69 Aug 14 20:34:44 auth-us slapd[10357]: daemon: epoll: listen=7 active_threads=0 tvp=zero Aug 14 20:34:44 auth-us slapd[10357]: daemon: epoll: listen=8 active_threads=0 tvp=zero Aug 14 20:34:46 auth-us slapd[10357]: daemon: epoll: listen=7 active_threads=0 tvp=zero Aug 14 20:34:46 auth-us slapd[10357]: daemon: epoll: listen=8 active_threads=0 tvp=zero Aug 14 20:34:51 auth-us slapd[10357]: daemon: epoll: listen=7 active_threads=0 tvp=zero Aug 14 20:34:51 auth-us slapd[10357]: daemon: epoll: listen=8 active_threads=0 tvp=zero Aug 14 20:34:54 auth-us slapd[10357]: daemon: activity on 1 descriptor Aug 14 20:34:54 auth-us slapd[10357]: daemon: activity on: Aug 14 20:34:54 auth-us slapd[10357]: 39r Aug 14 20:34:54 auth-us slapd[10357]: Aug 14 20:34:54 auth-us slapd[10357]: daemon: read active on 39 Aug 14 20:34:54 auth-us slapd[10357]: daemon: epoll: listen=7 active_threads=0 tvp=zero Aug 14 20:34:54 auth-us slapd[10357]: daemon: epoll: listen=8 active_threads=0 tvp=zero Aug 14 20:34:54 auth-us slapd[10357]: daemon: activity on 1 descriptor Aug 14 20:34:54 auth-us slapd[10357]: daemon: activity on: Aug 14 20:34:54 auth-us slapd[10357]: Aug 14 20:34:54 auth-us slapd[10357]: daemon: epoll: listen=7 busy Aug 14 20:34:54 auth-us slapd[10357]: daemon: epoll: listen=8 active_threads=0 tvp=zero Aug 14 20:34:56 auth-us slapd[10357]: daemon: epoll: listen=7 busy Aug 14 20:34:56 auth-us slapd[10357]: daemon: epoll: listen=8 active_threads=0 tvp=zero Aug 14 20:35:01 auth-us slapd[10357]: daemon: epoll: listen=7 busy Aug 14 20:35:01 auth-us slapd[10357]: daemon: epoll: listen=8 active_threads=0 tvp=zero Aug 14 20:35:06 auth-us slapd[10357]: daemon: epoll: listen=7 busy Aug 14 20:35:06 auth-us slapd[10357]: daemon: epoll: listen=8 active_threads=0 tvp=zero Aug 14 20:35:11 auth-us slapd[10357]: daemon: epoll: listen=7 busy Aug 14 20:35:11 auth-us slapd[10357]: daemon: epoll: listen=8 active_threads=0 tvp=zero Aug 14 20:35:12 auth-us slapd[10357]: daemon: activity on 1 descriptor Aug 14 20:35:12 auth-us slapd[10357]: daemon: activity on: Aug 14 20:35:12 auth-us slapd[10357]: 42r Aug 14 20:35:12 auth-us slapd[10357]: Aug 14 20:35:12 auth-us slapd[10357]: daemon: read active on 42 Aug 14 20:35:12 auth-us slapd[10357]: daemon: epoll: listen=7 busy Aug 14 20:35:12 auth-us slapd[10357]: daemon: epoll: listen=8 active_threads=0 tvp=zero Aug 14 20:35:14 auth-us slapd[10357]: daemon: activity on 1 descriptor Aug 14 20:35:14 auth-us slapd[10357]: daemon: activity on: Aug 14 20:35:14 auth-us slapd[10357]: 40r Aug 14 20:35:14 auth-us slapd[10357]: Aug 14 20:35:14 auth-us slapd[10357]: daemon: read active on 40 Aug 14 20:35:14 auth-us slapd[10357]: daemon: epoll: listen=7 busy Aug 14 20:35:14 auth-us slapd[10357]: daemon: epoll: listen=8 active_threads=0 tvp=zero Aug 14 20:35:16 auth-us slapd[10357]: daemon: epoll: listen=7 busy Aug 14 20:35:16 auth-us slapd[10357]: daemon: epoll: listen=8 active_threads=0 tvp=zero Aug 14 20:35:21 auth-us slapd[10357]: daemon: epoll: listen=7 busy Aug 14 20:35:21 auth-us slapd[10357]: daemon: epoll: listen=8 active_threads=0 tvp=zero Aug 14 20:35:26 auth-us slapd[10357]: daemon: epoll: listen=7 busy Aug 14 20:35:26 auth-us slapd[10357]: daemon: epoll: listen=8 active_threads=0 tvp=zero Aug 14 20:35:31 auth-us slapd[10357]: daemon: epoll: listen=7 busy Aug 14 20:35:31 auth-us slapd[10357]: daemon: epoll: listen=8 active_threads=0 tvp=zero Every log entry prior to this looks normal in that epoll: listen=7 goes between active_threads=0 to busy when a connection comes in, sets up the connection, and then goes back to active_threads=0. I have yet to understand what is going on to cause it to go into the busy state and never to return until I manually stop and restart the slapd process. It does appear however that slapd can still process any queries on active connections as noted on descriptors 40r and 42r--it just can't process any new connection requests as epoll: listen=7 has hung. Looking through the archives this problem still appears to be present in a few additional later releases but I have not found any thread yet which points to a specific solution or patch that fixes this problem. Unless I can point to a specific solution and/or patch I won't get approval to do a pull from the latest source and compile--I'll have to stick with an hourly cron job that stops and restart slapd. Thanks, Bob Smith --bs

4 4

Re: slapd-meta doesn't continue with multiple uri's
by Liam Gretton 22 Aug '12

22 Aug '12

On 22/08/2012 09:44, Pierangelo Masarati wrote: >> My fault: "timeout" is operation-wide; when it's hit, the >> operation ends as you reported. "network-timeout" is related to >> connect(2) only. As far as I understand, by looking at the code, >> there is no practical means, so far, to perform what you're asking >> for. Either the connection cannot be established, and in this case >> the code works as intended, or if it hangs for ever the operation >> can only be aborted/timed out. In those cases, you definitely need >> to fix the configuration by removing the hung URI. But what's the point of specifying multiple targets in the uri option if it doesn't fall through to subsequent ones when the first is not contactable? Have I completely missed the point of the documentation? -- Liam Gretton liam.gretton(a)le.ac.uk HPC Architect http://www.le.ac.uk/its/ IT Services Tel: +44 (0)116 2522254 University Of Leicester, University Road Leicestershire LE1 7RH, United Kingdom

1 0

Re: LDAP password management
by Dan White 22 Aug '12

22 Aug '12

On 08/22/12 19:43 +0300, Adrian Paleacu wrote: >Hi Dan, > >Thank you for quick response. So is not possible to inform LDAP service >that an already hashed password is passed trough. You can accomplish hashing of your password, over the network, by binding with SASL. Depending on the mechanism you use, doing so will require you to store your passwords in cleartext on the server. See: http://www.cyrussasl.org/docs/cyrus-sasl/2.1.25/mechanisms.php OTP and SRP do not require storing your password in cleartext. In any case, if your desire is to secure the transmission of your password, the use of TLS is recommended. If you're asking how to handle the case where you're transitioning to an ldap based authentication scheme from a hashed password store (such as /etc/shadow), see the manpage for crypt(3), and prepend your hashes with {CRYPT} before storing them within slapd. >On Wed, Aug 22, 2012 at 6:06 PM, Dan White <dwhite(a)olp.net> wrote: > >> On 08/22/12 17:48 +0300, Adrian Paleacu wrote: >> >>> Hi everyone, >>> >>> I have a binding question regarding the password. Is possible to send a >>> hashed password to LDAP system. My passwords are hashed and I don't have a >>> way to send it as plain text. >>> >> >> See Section 14.4 of the OpenLDAP Administrator's guide. >> >> If your passwords are stored on your server in certain hashed forms, then >> slapd will expect you to transmit a cleartext password to be hashed and >> locally compared with the stored password value. -- Dan White

1 0

syncrepl not propagating changes
by Mark Coetser 22 Aug '12

22 Aug '12

Hi current version of openldap 2.4.23-7.2 I have however built and used 2.4.31 with the same results. I have a single provider that has multiple domians ie dc=company dc=subdivision1,dc=company dc=subdivision2,dc=company on some of the consumers, I have a single syncrepl config with the base, so these servers have all the users and replication tends to work fine. olcSyncrepl: {0} rid=00x provider=ldaps://x.x.x.x bindmethod=simple binddn="cn=replica,dc=repl_config,dc=company" credentials="xxxxx" filter="(objectclass=*)" searchbase="dc=company" scope=sub attrs="*,+" schemachecking=off type=refreshAndPersist retry="5 5 300 +" starttls=yes tls_reqcert=never tls_cert=/etc/ldap/ssl/ca-cert.pem tls_key=/etc/ldap/ssl/keys/ca-key.pem on some of the consumers, I have multiple syncrepl configs so that I replicate specific subdivision data to those servers. olcSyncrepl: {0} rid=001 provider=ldaps://x.x.x.x bindmethod=simple binddn="cn=replica,dc=repl_config,dc=company" credentials="xxxxx" filter="(objectclass=*)" searchbase="dc=company" scope=base attrs="*,+" schemachecking=off type=refreshAndPersist retry="5 5 300 +" starttls=yes tls_reqcert=never tls_cert=/etc/ldap/ssl/ca-cert.pem tls_key=/etc/ldap/ssl/keys/ca-key.pem olcSyncrepl: {1} rid=002 provider=ldaps://x.x.x.x bindmethod=simple binddn="cn=replica,dc=repl_config,dc=company" credentials="xxxxx" filter="(objectclass=*)" searchbase="dc=repl_config,dc=company" scope=base attrs="*,+" schemachecking=off type=refreshAndPersist retry="5 5 300 +" starttls=yes tls_reqcert=never tls_cert=/etc/ldap/ssl/ca-cert.pem tls_key=/etc/ldap/ssl/keys/ca-key.pem olcSyncrepl: {2} rid=002 provider=ldaps://x.x.x.x bindmethod=simple binddn="cn=replica,dc=repl_config,dc=company" credentials="xxxxx" filter="(objectclass=*)" searchbase="dc=subdivision,dc=company" scope=base attrs="*,+" schemachecking=off type=refreshAndPersist retry="5 5 300 +" starttls=yes tls_reqcert=never tls_cert=/etc/ldap/ssl/ca-cert.pem tls_key=/etc/ldap/ssl/keys/ca-key.pem whats happening with these consumers is that the initial sync seems to work and some changes to the provider do make it down to the consumer but lately most changes are NOT making it down to the consumer, when I log sync then I am seeing that the csn is committed for the change for the first rid but then for the next rid it logs that the csn is too old? Aug 22 09:56:59 fw1 slapd[30938]: do_syncrep2: rid=080 LDAP_RES_INTERMEDIATE - NEW_COOKIE Aug 22 09:56:59 fw1 slapd[30938]: do_syncrep2: rid=080 NEW_COOKIE: rid=080,csn=20120822075659.107448Z#000000#000#000000 Aug 22 09:56:59 fw1 slapd[30938]: slap_queue_csn: queing 0xb4230120 20120822075659.107448Z#000000#000#000000 Aug 22 09:56:59 fw1 slapd[30938]: do_syncrep2: rid=082 LDAP_RES_INTERMEDIATE - NEW_COOKIE Aug 22 09:56:59 fw1 slapd[30938]: do_syncrep2: rid=082 NEW_COOKIE: rid=082,csn=20120822075659.107448Z#000000#000#000000 Aug 22 09:56:59 fw1 slapd[30938]: do_syncrep2: rid=081 LDAP_RES_INTERMEDIATE - NEW_COOKIE Aug 22 09:56:59 fw1 slapd[30938]: do_syncrep2: rid=081 NEW_COOKIE: rid=081,csn=20120822075659.107448Z#000000#000#000000 Aug 22 09:56:59 fw1 slapd[30938]: do_syncrep2: rid=083 cookie=rid=083,csn=20120822075659.107448Z#000000#000#000000 Aug 22 09:56:59 fw1 slapd[30938]: slap_graduate_commit_csn: removing 0xb422e830 20120822075659.107448Z#000000#000#000000 Aug 22 09:56:59 fw1 slapd[30938]: do_syncrep2: rid=082 LDAP_RES_INTERMEDIATE - NEW_COOKIE Aug 22 09:56:59 fw1 slapd[30938]: do_syncrep2: rid=083 CSN too old, ignoring 20120822075659.107448Z#000000#000#000000 Aug 22 09:56:59 fw1 slapd[30938]: do_syncrep2: rid=082 NEW_COOKIE: rid=082,csn=20120822075659.112753Z#000000#000#000000 Aug 22 09:56:59 fw1 slapd[30938]: do_syncrep2: rid=081 LDAP_RES_INTERMEDIATE - NEW_COOKIE Aug 22 09:56:59 fw1 slapd[30938]: do_syncrep2: rid=081 NEW_COOKIE: rid=081,csn=20120822075659.112753Z#000000#000#000000 Aug 22 09:56:59 fw1 slapd[30938]: do_syncrep2: rid=080 LDAP_RES_INTERMEDIATE - NEW_COOKIE Aug 22 09:56:59 fw1 slapd[30938]: do_syncrep2: rid=080 NEW_COOKIE: rid=080,csn=20120822075659.112753Z#000000#000#000000 Aug 22 09:56:59 fw1 slapd[30938]: do_syncrep2: rid=083 cookie=rid=083,csn=20120822075659.112753Z#000000#000#000000 Aug 22 09:56:59 fw1 slapd[30938]: slap_queue_csn: queing 0xb4f11d20 20120822075659.112753Z#000000#000#000000 Aug 22 09:56:59 fw1 slapd[30938]: slap_graduate_commit_csn: removing 0xb4f18508 20120822075659.112753Z#000000#000#000000 Aug 22 09:56:59 fw1 slapd[30938]: do_syncrep2: rid=083 CSN too old, ignoring 20120822075659.112753Z#000000#000#000000 -- Thank you, Mark Adrian Coetser mark(a)pkfnet.co.za

3 4

LDAP password management
by Adrian Paleacu 22 Aug '12

22 Aug '12

Hi everyone, I have a binding question regarding the password. Is possible to send a hashed password to LDAP system. My passwords are hashed and I don't have a way to send it as plain text. regards, Adrian

2 1

Re: syncrepl not propagating changes
by Mark Coetser 22 Aug '12

22 Aug '12

On 22/08/2012 12:00, Rein Tollevik wrote: > On 22.08.12 10:46, Mark Coetser wrote: >> On 22/08/2012 10:39, Howard Chu wrote: >>> Mark Coetser wrote: >>>> >>>> on some of the consumers, I have multiple syncrepl configs so that I >>>> replicate specific subdivision data to those servers. >>> >>> That is not supported. You can only use multiple consumers in the same >>> database if they are all pointing at different providers (and each of >>> those >>> providers uses a unique serverID). >> >> Can I split them into separate databases on the consumer? Or whats the >> correct way of doing what I am trying to achieve? > > Use a single syncrepl stanza on these consumers too, replicating your > toplevel cn=company dn. Add acl's on the provider which limits the user > these consumers binds as to only see those sub-trees you wish them to see. > > Rein > Hi Please could someone confirm that these acls would be secure, I am trying to allow services like pam/nss on the provider to still function and have access to the entire tree, then allow the replica user from the consumer to see the base of the tree and the whole of the subdivision tree including userPassword,shadowLastChange, also could someone assist with an example of a regex acl that I could use to say that "cn=replica,*" has read access to everything in that users subtree? access to attrs=userPassword,shadowLastChange by dn.base="cn=admin,dc=company" write by dn.base="cn=replica,dc=subdivision,dc=company" read by anonymous auth by self write by * none access to dn.base="" by peername.regex=127\.0\.0\.1 read by * none access to dn.base="dc=company" by dn.base="cn=replica,dc=subdivision,dc=company" read access to dn.subtree="dc=subdivision,dc=company" by dn.base="cn=replica,dc=subdivision,dc=company" read access to * by dn.base="cn=admin,dc=company" write by peername.regex=127\.0\.0\.1 read by * none -- Thank you, Mark Adrian Coetser mark(a)pkfnet.co.za

1 0

Re: syncrepl not propagating changes
by Mark Coetser 22 Aug '12

22 Aug '12

On 22/08/2012 12:00, Rein Tollevik wrote: > On 22.08.12 10:46, Mark Coetser wrote: >> On 22/08/2012 10:39, Howard Chu wrote: >>> Mark Coetser wrote: >>>> >>>> on some of the consumers, I have multiple syncrepl configs so that I >>>> replicate specific subdivision data to those servers. >>> >>> That is not supported. You can only use multiple consumers in the same >>> database if they are all pointing at different providers (and each of >>> those >>> providers uses a unique serverID). >> >> Can I split them into separate databases on the consumer? Or whats the >> correct way of doing what I am trying to achieve? > > Use a single syncrepl stanza on these consumers too, replicating your > toplevel cn=company dn. Add acl's on the provider which limits the user > these consumers binds as to only see those sub-trees you wish them to see. > > Rein > Is there an acl that would prevent slapcat from showing the entire tree? -- Thank you, Mark Adrian Coetser mark(a)pkfnet.co.za

1 1

Re: Query regarding the Database files..
by Howard Chu 22 Aug '12

22 Aug '12

Pierangelo Masarati wrote: >> If you build the mdb_stat program in the libmdb source (it is not built by >> default) you can use it to examine the individual MDB databases. E.g.: > > Time for a slapstat tool? Eh... We lived thru 12 years of BerkeleyDB without needing such a thing. I don't see why we should need it now. It would be useful to flesh out mdb_stat to report more interesting information, but that's a pretty low priority on my list at the moment. For completeness' sake MDB should have mdb_stat, mdb_dump, and mdb_load. Patches welcome... -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Using ldap.searchFilter
by rodrigo tavares 22 Aug '12

22 Aug '12

Hello ! I installed Openfire im my server, and using client spark, with base LDAP. I get log in server, but i can´t search the users. Then a need : ldap.searchFilter. In a doc Openfire: LDAP Guide. I found: ldap.searchFilter -- an optional search filter to append to the default filter when loading users. The default search filter is created using the attribute specified by ldap.usernameField. For example, if the username field is "uid", then the default search filter would be "(uid={0})" where {0} is dynamically replaced with the username being searched for. http://www.igniterealtime.org/builds/openfire/docs/latest/documentation/lda… How I can to define this parameter ? Thanks ! Rodrigo Faria

3 2

Query regarding the Database files..
by aryan rawat 22 Aug '12

22 Aug '12

Hi All, In slapd.conf have these indexes *index objectClass eq* *index msisdn eq* *index entryCSN,entryUUID eq* When I run the same slapd.conf under MDB I can see 2 files * **data.mdb and lock.mdb* When I run the same slapd.conf under BDB (HDB) I can see files on which the index is created *entryCSN.bdb id2entry.bdb objectClass.bdb dn2id.bdb entryUUID.bdb msisdn.bdb alock* So does this means MDB does not do indexing if I am not wrong?? Please clarify the doubt?? BR's, Aryan

3 2

multi-master syncrepl issue
by Chris Card 22 Aug '12

22 Aug '12

Hi All, I have a multi-master openldap setup with 2 machines replicating a directory containing about 3.5 million entries. I'm running openldap 2.4.31 on centos 6, and the directory is using the BDB backend. Although the 2 machines are configured for multi-master syncrepl replication, in practice data is only written to one of the machines (I'll call it the master), and the second machine (which I'll call the slave) only gets data written by openldap replication. Currently the contextCSN of the directory is the same from both machines, which (as I understand it) should mean that the directories are in sync, but I have written a program to compare what is in both directories which finds that there are 16 entries in the master directory not in the slave directory. I have double checked thisusing ldapsearch on both directories. I can't see any error messages in the openldap log and there doesn't appear to be any pattern connecting the entries which are missing from the slave. Most of the missing entries werein the master directory before I created the slave machine and configured replication and have not changed. The syncrepl config looks like this: dn: olcDatabase={1}bdb,cn=configolcSyncrepl: {0}rid=101 provider="ldap://<master>:389" binddn="<binddn>" bindmethod=simple credentials=<bindpw> searchbase="<prefix>" type=refreshAndPersist retry="5 5 300 5" timeout=1olcSyncrepl: {1}rid=110 provider="ldap://<slave>:389" binddn="<binddn>" bindmethod=simple credentials=<bindpw> searchbase="<prefix>" type=refreshAndPersist retry="5 5 300 5" timeout=1 Are there any known issues with openldap replication which could result in missing data? How can I force these missing entries to appear in the slave without rebuilding the whole of the slave directory and without changing the data in the master directory? Chris

3 8

slapadd *very* slow: tuning advice?
by Nick Urbanik 21 Aug '12

21 Aug '12

Dear Folks, I'm upgrading a cluster of OpenLDAP servers from 2.3.43-25.el5 to 2.4.32 with BDB 4.8.30 on CentOS 5, x86_64, on HP BL460cG6 blades with two 4-core CPUs, and 12GB RAM. These are slaves, and have eleven trees on them. I have dumped and restored six of the LDAP databases in reasonable time, but the seventh is taking a long time. Here are the sizes of the slapcatted LDIF files: 320M 252M 80M 225K 246K 833K 2.6G 1.2G 24M 947M 522K It's the 2.6G LDIF file that's taking the time to slapadd: -############ 63.34% eta 02h09m elapsed 03h43m30s spd 2.7 k/s As you can see, it has slowed to a crawl. # cat DB_CONFIG set_flags DB_LOG_AUTOREMOVE set_cachesize 0 286162472 0 # egrep 'tool-threads|cachesize' /etc/openldap/slapd.conf tool-threads 8 cachesize 100000 idlcachesize 100000 cachesize 100000 idlcachesize 100000 cachesize 100000 idlcachesize 100000 cachesize 100000 idlcachesize 100000 cachesize 100000 idlcachesize 100000 cachesize 100000 idlcachesize 100000 cachesize 100000 idlcachesize 100000 cachesize 100000 idlcachesize 100000 cachesize 100000 idlcachesize 100000 cachesize 100000 idlcachesize 100000 cachesize 100000 idlcachesize 100000 On another member of the cluster, not upgraded from 2.3.43 yet, we have, for this big tree: # sudo -u ldap slapd_db_stat -d id2entry.bdb Tue Aug 21 15:15:38 2012 Local time 53162 Btree magic number 9 Btree version number Little-endian Byte order Flags 2 Minimum keys per-page 16384 Underlying database page size 3 Number of levels in the tree 4611665 Number of unique keys in the tree 4611665 Number of data items in the tree 418 Number of tree internal pages 36096 Number of bytes free in tree internal pages (99% ff) 308745 Number of tree leaf pages 871M Number of bytes free in tree leaf pages (82% ff) 0 Number of tree duplicate pages 0 Number of bytes free in tree duplicate pages (0% ff) 0 Number of tree overflow pages 0 Number of bytes free in tree overflow pages (0% ff) 0 Number of empty pages 0 Number of pages on the free list # sudo -u ldap slapd_db_stat -d dn2id.bdb Tue Aug 21 15:34:30 2012 Local time 53162 Btree magic number 9 Btree version number Little-endian Byte order duplicates, sorted duplicates Flags 2 Minimum keys per-page 4096 Underlying database page size 4 Number of levels in the tree 9227811 Number of unique keys in the tree 9263210 Number of data items in the tree 2185 Number of tree internal pages 2781648 Number of bytes free in tree internal pages (68% ff) 219185 Number of tree leaf pages 287M Number of bytes free in tree leaf pages (68% ff) 37 Number of tree duplicate pages 40214 Number of bytes free in tree duplicate pages (73% ff) 0 Number of tree overflow pages 0 Number of bytes free in tree overflow pages (0% ff) 0 Number of empty pages 0 Number of pages on the free list QUESTIONS: ========== Any suggestions on how to optimise this a little more towards slapadd? Would mdb possibly be faster than bdb? -- Nick Urbanik http://nicku.org 808-71011 nick.urbanik(a)optusnet.com.au GPG: 7FFA CDC7 5A77 0558 DC7A 790A 16DF EC5B BB9D 2C24 ID: BB9D2C24 I disclaim, therefore I am.

3 6

RE: multi-master syncrepl issue
by Quanah Gibson-Mount 21 Aug '12

21 Aug '12

--On Tuesday, August 21, 2012 3:33 PM +0000 Chris Card <ctcard(a)hotmail.com> wrote: > > > >> >> --On Tuesday, August 21, 2012 2:50 PM +0000 Chris Card >> >> <ctcard(a)hotmail.com> wrote: >> >> >> >> >> Do you have sync logging enabled? >> >> >> >> >> > >> >> > Log level is set to none, so the slapd log doesn't give much help. >> >> >> >> Fix your log level. >> > olcLogLevel: sync ? >> >> Yes > I turned on sync logging for a short while, loads of stuff was written to > the log, and strangely (coincidently?) the contextCSN is now up to date. > However, the database is still missing a lot of entries (about 25000 I > think) - will syncrepl fix this automatically? Unlikely. What openldap version are you using? --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: I have 2 questions
by Haroon Rawat 21 Aug '12

21 Aug '12

Hi , Howard ... -------------------- It was not my intention to ask the same query again and again. My intention was the performance of MDB on search operation is too low compared to BDB at least in my case. So I thought I might be missing some other configuration parameters. Quanah .. ------------------- Thanks for the Reply. So now At least I am clear that DB_CONFIG not required in case of MDB The performance of MDB on search operation is too low compared to BDB at least in my case. *Am attaching the slap.conf if you can find out the issue..* BR's, Haroon On Tue, Aug 21, 2012 at 10:12 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Tuesday, August 21, 2012 9:37 AM +0530 Haroon Rawat < > haroonrawat(a)gmail.com> wrote: > > Hi All, >> >> I have few queries >> >> 1. How to improve the performance of MDB what all parameteres need to >> be added in slapd.conf. >> > > There are no tuning parameters for MDB. No other database backend can > touch its read performance. > > > >> 2. Does DB_CONFIG file is having any role in MDB if yes then which >> parameters need to added to increase the performance of MDB. >> > > DB_CONFIG is specific to BDB. It has nothing to do with MDB. > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- BR's, Haroon Rawat

1 0

I have 2 questions
by Haroon Rawat 21 Aug '12

21 Aug '12

Hi Experts, I have 2 questions currently using MDB and openldap-2.4.30 1. Slapadd is giving error *"Unrecognized database type (mdb)" *2. Ldapadd after inserting few records successfully then it start giving an error*. * 502a4151 mdb_id2entry_put: *mdb_put failed: Cannot allocate memory(12) "* subdata=pcsprof,msisdn=9800001823,dc=msisdn,dc=c-ntdb" 502a4151 conn=1000 op=1 RESULT tag=105 err=80 text=entry store failed * Waiting for the Ans.. Thanks * -- BR's, Haroon Rawat

3 5

Re: ldap (openldap) dynamic subtree combination for responses
by vlad florentino 21 Aug '12

21 Aug '12

I appreciate the answer. It's good to have a definitive answer.

1 0

ldap (openldap) dynamic subtree combination for responses
by vlad florentino 20 Aug '12

20 Aug '12

LDAP Server: OpenLDAP 2.4.24 Linux Distro: Fedora 15 (I believe this question is generally about returning properties in subentries, when performing searches on a parent entry, in a way that's transparent to clients making the requests. However, I have worded my question to be based on my specific usecase.) ------------------------------ Hi, I have successfully configure the Linux sssd service to fetch user loging information from an LDAP directory service (which happens to be in the same machine). The file to configure for this lives at /etc/sssd/sssd.conf I have tested that I can create a linux user account in the LDAP directory, by creating an entry under the relevant DN. That node includes the objectClass 'posixAccount'. ou=people | - uid=1000 # This entry has the objectClass 'posixAccount' performing a: getent passwd | grep the-ldap-based-linux-username yields correct information. Now, for my problem: I'm trying to configure the LDAP directory such that credentials information is not duplicated. I would like to define the entries like so: ou=people | - uid=1000 # No possixAccount objectClass | + cn=contact-info # contact stuff ... - cn=account # contains subtrees for account related stuff. | - cn=credentials # Fields: uid, userPassword, uidNumber, gidNumber - cn=linux-account # Fields: homeDirectory, loginShell, ... - cn=windows-account # Fields: winHomeDirectory, sambaServerUrl, ... - cn=samba-account # Fields: space-quota, ... The point of what I'm trying to accomplish is that when ldap clients, such as the Linux sssd deamon, perform an account info search/fetch, they do so at the following node (not at it's subnodes): cn=account,uid=1000,ou=people And that, somehow, the OpenLDAP server would know to combine the info contained in the relevant subentries of cn=account, and return those to the client, as if those extries existed at cn=account. This would work, of course, if I were to place all the info at the cn=account node. But, that's what I'm trying to avoid. I've try a few things, which have all been unsuccessful. Is it possible to do this with OpenLDAP (or LDAP in general)? If so, how? Regards, Vlad ------------------------------ PS: A trick that I've found useful, and which can help in the final solution to the problem, is that the sssd deamon allows one to configure the name of the 'posixAccount'-like objectClass that it should use to locate account info. I noticed that I can tell it do look for a certain class, say c-linux-account, which I then define as an empty auxilary class. The daemon will successfully find entries, which contain this class. Then, if those entries contain properties named uid, userPassword, homeDirectory, etc, it will use those properties for their values. So, I can add that property to cn=account, and the deamon will find that entry correctly. I just now have to tell OpenLDAP to combine the entries below that node, and return them in the query.

2 1

2.4.32: mdb stable enough?
by Karsten Heymann 19 Aug '12

19 Aug '12

Hi, I know this is difficult to answer, but is the mdb backend as it comes in 2.4.32 ready for a productive master-master setup with somewhat less tham 1mio entries? slapd-mdb(5) states it's an early release and that incompatible changes may occur, but on the other hand hdb changes disk format from time to time too. So, what are the opinions? The setup will be extensively tested, but if mdb should not be ready yet I could skip the tests and concentrate on hdb. Thanks, Karsten

3 6

LDAP authentication using Radius
by JET JETASIK 18 Aug '12

18 Aug '12

I am investigating 2 factor authentication in which mostly they are radius server actually. My problem is that most of my applications relying on LDAP auth only. I am trying to figure out on how to use openldap/contrib/slapd-modules/passwd/radius.c I did compile and successfully loaded it but not sure how to configure it. This is what I put into slapd.conf to load the module: moduleload pw-radius.so config="/etc/radius.conf" Firstly I couldn't figure out what exactly is the format of /etc/radius.conf (Mandatory items: Radius server IP& Share Secret) Secondly the format of userpassword scheme, {RADIUS}XXXXYYY@ZZZ ?? --- Jetasik (JET) Manager, Transniaga(Thailand)

5 13

Re: ldappasswd gives error ldap_sasl_interactive_bind_s: No such attribute (16)
by Dan White 17 Aug '12

17 Aug '12

Keeping replies on openldap-technical(a)openldap.org is recommended, since it gives you more eyes for your problem. >> On Thu, Aug 16, 2012 at 2:30 PM, Dan White <dwhite(a)olp.net> wrote: >>> On 08/16/12 14:06 -0700, Jeffrey Parker wrote: >>>>> I cannot seem to find anything helpful about this issue. I had it >>>>> working before when I first setup OpenLDAP and I have not changed >>>>> any settings since then. The only thing I can seem to find is >>>>> suggestion saying to use -x when running ldappasswd. When I use -x I >>>>> get the error below >>>>> >>>>> Result: Strong(er) authentication required (8) >>>>> Additional info: only authenticated users may change passwords >>>>> >>>>> >>>> If binding with -x, you'll need to provide a bind dn (-D) and a password. >>>> >>>> I am running OpenLDAP, I am not sure what version but it is somewhat >>>> new. >>>> >>>> The error messages is briefly discussed in the OpenLDAP Administrator's >>>> Guide (section H.17). >>>> >>>> Verify that you are able to bind to the server with 'ldapwhoami', with >>>> your credentials. Once that succeeds, verify that your entry contains >>>> a 'userPassword' attribute, and that the user you are binding with has >>>> the permissions to change it. >On Aug 17, 2012 9:08 AM, "Dan White" <dwhite(a)olp.net> wrote: >> On 08/16/12 15:32 -0700, Jeffrey Parker wrote: >> >>> The setup that I have is a bit strange, I am not using OpenLDAP to >>> authenticate operating system users. I am using it for other >>> authentication. The authentication works for usermin which I am using >>> as an interface to change passwords and for phpldapadmin, and for >>> Hudson continuous integration. That section that you mentioned in the >>> OpenLDAP Administrator's guide does not give any help it just says what >>> that means not any indication on what to do to fix it. As a side note >>> ldapwhoami does not work because I am not authenticated through ldap to >>> login to the computer. I can manually change the password in >>> phpldapadmin, but I need the users to be able to change their own >>> password which was working but now it is not working and I did not >>> change anything since the time that it was working. >> >> A cannot assist you with phpldapadmin or usermin. >> >> If you would like users to change their own passwords with the ldappasswd >> utility, then ldapwhoami is an acid test. Users must be able to >> authenticate to your ldap server before they can change their passwords for >> themselves. This is unrelated to how you, or your users, authenticate to >> the operating system. >> >> When password changes worked, what command (include command line >> parameters) did your users use? On 08/17/12 09:46 -0700, Jeffrey Parker wrote: >Usermin runs ldappasswd. The command-line options when it worked are the >same as I tried before, just ldappasswd. Users can authenticate without any >issue. Common ldappasswd examples include: for simple binds: ldappasswd -x -D "uid=jsmith,dc=example,dc=net" -W -s "new_password" for sasl binds: ldappasswd -Y digest-md5 -U jsmith -s "new_password" What are the contents of the following files, if they exist? /etc/ldap/ldap.conf (or your system's equivalent) $HOME/ldaprc $HOME/.ldaprc ./ldaprc Consult the manpages for ldap.conf and ldappasswd. -- Dan White

1 0

Re: ldappasswd gives error ldap_sasl_interactive_bind_s: No such attribute (16)
by Dan White 17 Aug '12

17 Aug '12

(Readding openldap-technical(a)openldap.org to the CC list) On 08/16/12 15:32 -0700, Jeffrey Parker wrote: >The setup that I have is a bit strange, I am not using OpenLDAP to >authenticate operating system users. I am using it for other >authentication. The authentication works for usermin which I am using as an >interface to change passwords and for phpldapadmin, and for Hudson >continuous integration. That section that you mentioned in the OpenLDAP >Administrator's guide does not give any help it just says what that means >not any indication on what to do to fix it. As a side note ldapwhoami does >not work because I am not authenticated through ldap to login to the >computer. I can manually change the password in phpldapadmin, but I need >the users to be able to change their own password which was working but now >it is not working and I did not change anything since the time that it was >working. A cannot assist you with phpldapadmin or usermin. If you would like users to change their own passwords with the ldappasswd utility, then ldapwhoami is an acid test. Users must be able to authenticate to your ldap server before they can change their passwords for themselves. This is unrelated to how you, or your users, authenticate to the operating system. When password changes worked, what command (include command line parameters) did your users use? >On Thu, Aug 16, 2012 at 2:30 PM, Dan White <dwhite(a)olp.net> wrote: > >> On 08/16/12 14:06 -0700, Jeffrey Parker wrote: >> >>> I cannot seem to find anything helpful about this issue. I had it working >>> before when I first setup OpenLDAP and I have not changed any settings >>> since then. The only thing I can seem to find is suggestion saying to use >>> -x when running ldappasswd. When I use -x I get the error below >>> >>> Result: Strong(er) authentication required (8) >>> Additional info: only authenticated users may change passwords >>> >> >> If binding with -x, you'll need to provide a bind dn (-D) and a password. >> >> >> I am running OpenLDAP, I am not sure what version but it is somewhat new. >>> It is running on Turnkey Linux (ubuntu 10.04 based) and is in a virtual >>> machine. >>> >> >> The error messages is briefly discussed in the OpenLDAP Administrator's >> Guide (section H.17). >> >> Verify that you are able to bind to the server with 'ldapwhoami', with your >> credentials. Once that succeeds, verify that your entry contains a >> 'userPassword' attribute, and that the user you are binding with has the >> permissions to change it. >> >> -- >> Dan White >> >> -- Dan White

1 0

slapd-meta doesn't continue with multiple uri's
by Liam Gretton 17 Aug '12

17 Aug '12

I've been trying to get slapd-meta to failover using multiple URIs but can't get it to work. Initially I was using 2.4.26, but having seen the report in ITS#7050 I've now built 2.4.32 but the problem is still there as far as I can tell. This bug was quashed in 2.4.29 according to the change log. In the example below, if host1 is not contactable at the point a search is performed, host2 will be contacted and the result returned correctly but ldapsearch then hangs indefinitely and the server's debug (level 1) output spews the following messages endlessly: ldap_sasl_bind ldap_send_initial_request ldap_int_poll: fd: 10 tm: 0 502a4634 conn=1001 op=1 <<< meta_search_dobind_init[0]=4 502a4634 conn=1001 op=1 >>> meta_search_dobind_init[0] Here's the relevant portion of slapd.conf: database meta suffix dc=local rootdn cn=administrator,dc=local rootpw secret network-timeout 3 uri ldap://host1:3268/ou=dc1,dc=local uri ldap://host2:3268/ou=dc1,dc=local uri ldap://host3:3268/ou=dc1,dc=local suffixmassage "ou=dc1,dc=local" "dc=example,dc=com" idassert-bind bindmethod=simple binddn="cn=proxyuser,dc=example,dc=com" credentials="password" idassert-authzfrom "dn.exact:cn=administrator,dc=local" Am I doing something wrong or has the bug described in ITS#7050 crept back in? -- Liam Gretton liam.gretton(a)le.ac.uk HPC Architect http://www.le.ac.uk/its IT Services Tel: +44 (0)116 2522254 University of Leicester, University Road Leicestershire LE1 7RH, United Kingdom

3 13

Status of rfc2307bis?
by Pierre Girard 17 Aug '12

17 Aug '12

Hello, When I look at the list of included schema with openldap (http://www.openldap.org/doc/admin24/schema.html#Distributed Schema Files) rfc2307bis isn't listed. What is the status of that schema, is it obsolete? If I understand correctly, it expired in 2009. Is that correct? What we want to do is setup an LDAP server only to put automount information, what would be the proper way of doing that, use the nis.schema? Any recommendation? Thanks for your help.

1 0

syncrepl and glued databases
by Uwe Werler 17 Aug '12

17 Aug '12

Hello List, is it OK to glue a database via replication from different suffixes together? What I tried: syncrepl rid=010 provider=ldap://master01 searchbase="dc=example,dc=com" keepalive=300:5:5 retry="10 10 300 10 600 +" binddn="cn=syncuser,dc=example,dc=com" bindmethod=simple schemachecking=off credentials=secret scope=sub attrs="*,+" type=refreshAndPersist syncrepl rid=020 provider=ldap://master02 searchbase="ou=glue1" keepalive=300:5:5 retry="10 10 300 10 600 +" binddn="cn=syncuser,dc=example,dc=com" bindmethod=simple schemachecking=off credentials=secret scope=sub type=refreshAndPersist attrs="*,+" suffixmassage="ou=glue2,dc=example,dc=com" syncrepl rid=030 provider=ldap://master03 searchbase="ou=glue2" keepalive=300:5:5 retry="10 10 300 10 600 +" binddn="cn=syncuser,dc=example,dc=com" bindmethod=simple schemachecking=off credentials=secret scope=sub type=refreshAndPersist attrs="*,+" suffixmassage="ou=glue2,dc=example,dc=com" This seems to work. Is this OK? Or should I use the traditional way with subordinate and glued databases? Background: this replica should be the sync master for a bunch of other hosts. Thanks for any hint. Regards Uwe

1 0

ldappasswd gives error ldap_sasl_interactive_bind_s: No such attribute (16)
by Jeffrey Parker 16 Aug '12

16 Aug '12

I cannot seem to find anything helpful about this issue. I had it working before when I first setup OpenLDAP and I have not changed any settings since then. The only thing I can seem to find is suggestion saying to use -x when running ldappasswd. When I use -x I get the error below Result: Strong(er) authentication required (8) Additional info: only authenticated users may change passwords I am running OpenLDAP, I am not sure what version but it is somewhat new. It is running on Turnkey Linux (ubuntu 10.04 based) and is in a virtual machine.

2 1

Lazy ACLs and keeping your DIT as flat as possible
by Gavin Henry 16 Aug '12

16 Aug '12

Hi All, I'm pretty sure that this isn't possible, but wanted to check as my head hurts now. I have dynamic lists using slapo-dynlist with the Organization attribute of 'o' and I am trying to keep my DIT as flat as possible. I want to create an ACL that is "by group", which is fine. But....I don't want to hardcode a group. I want to "capture" o via a regex and use that in the "by group" like so: access to dn.subtree="ou=Users,dc=suretec,dc=co,dc=uk" attrs=o val.regex="(.+)" attrs=children,entry by group.expand="cn=$1,ou=Groups,dc=suretec,dc=co,dc=uk" read by self write or something like the following using a previous capture: access to filter=(&(objectClass=inetOrgPerson)(o=$1)) by group/groupOfURLs/memberURL.expand="cn=$1,ou=Groups,dc=suretec,dc=co,dc=uk" read by self write by * none Issue is you can't pass captures between "access by" statements and my ACLs are flawed based on what you're searching for, which would be perfect. The goal being users in the same group can only see users on ou=Users of that group, with out hard coding group name in the conf. I guess I'll have to create branches to split up users. Then again, I'm adding a group to ou=Groups, why shouldn't I at the same time add a new ACL via cn=config? Cheers. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretec.co.uk Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 24 Cormack Park, Rothienorman, Inverurie, Aberdeenshire, AB51 8GL. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html Do you know we have our own VoIP provider called SureVoIP? See http://www.surevoip.co.uk Did you see our API? http://www.surevoip.co.uk/api

1 1

pass-through authentication and base64
by sergio 16 Aug '12

16 Aug '12

Hello. Is it possible to ask openldap not to encode magic tokens for pass-through authentication? Now ldapsearch shows: userPassword:: e1NBU0x9dXNlcm5hbWVAcmVhbG0K== but I'd like to see: userPassword:: {SASL}username@realm instead. -- sergio.

7 16

Fwd: pass-through authentication and base64
by Brett Maxfield 16 Aug '12

16 Aug '12

> This decodes ok as > > {SASL}username@realm > > (omit the trailing ==, before decoding) > > So you mean to delegate auth to a sasl realm called 'realm', containing a user called 'username' ? > > Have you literally added this example value to an ldap entry and dumped it with slapcat ? > > On 15/08/2012, at 10:22 PM, sergio <mailbox(a)sergio.spb.ru> wrote: > >> On 08/15/2012 06:12 PM, Emmanuel Lécharny wrote: >> >>> e1NBU0x9dXNlcm5hbWVAcmVhbG0K== >> >> ONCE AGAIN: >> >> This is my bad example. Real values in the database have no newline or >> some other non-ASCII non printable characters. >> >> It even can't be correctly decoded. >> >> >> -- >> sergio. >

1 0

openldap 2.2 - slapd monitor not showing cachesize, dncachsize etc.
by ping-shin ching 16 Aug '12

16 Aug '12

Hi, I've configured slapd.conf for monitoring with the config below. The backend is bdb ====database monitoraccess to * by * read==== Now when I do the search below, I see a lot of information, but do not see the attibutes 'cachesize', 'dncachesize' etc. ldapsearch -x -D 'cn=Manager,o=bigpond,c=au' -W -b 'cn=Monitor' -s base '(objectClass=*)' '*' '+' version: 1dn: cn=MonitorobjectClass: monitorServerstructuralObjectClass: monitorServercn: Monitordescription: This subtree contains monitoring/managing objects.description: This object contains information about this server.createTimestamp: 20120814040144ZmodifyTimestamp: 20120814040144ZmonitoredInfo: @(#) $OpenLDAP: slapd 2.2.30- (Aug 13 2012 11:53:25) $subschemaSubentry: cn=SubschemahasSubordinates: TRUE dn: cn=Overlay,cn=MonitorobjectClass: monitorContainerstructuralObjectClass: monitorContainercn: OverlaycreateTimestamp: 20120814040144ZmodifyTimestamp: 20120814040144ZsubschemaSubentry: cn=SubschemahasSubordinates: FALSE

2 1

delta-syncrepl stopped receiving changes
by David Hawes 15 Aug '12

15 Aug '12

My environment consists of 1 provider and 6 consumer machines using delta-syncrepl for replication. For some reason, one of the consumer machines stopped receiving changes for several days and did not resume syncing until a restart (SIGKILL). All machines are running 2.4.30 with BerkeleyDB 4.7.25 (plus patches), the hdb backend, and tcmalloc. I notice that 2.4.31 has several syncrepl fixes, and I intend to upgrade in the near future, but my issue seems different than the ITS issues listed in the change log. I'm posting here to determine if this has been fixed or if I need to create a new ITS issue. When I noticed one of the machines was not syncing properly I first ensured that I could still query it. When I verified that, I decided to change the LogLevel to 'any' to make sure I wasn't missing any logs that would help me figure out what the issue was. Unfortunately, this LDAP modify caused OpenLDAP to hang. The operation never finished, and new queries using ldapsearch would simply hang as well. At this point I got a gdb backtrace and db_stat from BDB. db_stat -c: ===== Default locking region information: 640 Last allocated locker ID 0x7fffffff Current maximum unused locker ID 9 Number of lock modes 3000 Maximum number of locks possible 1500 Maximum number of lockers possible 1500 Maximum number of lock objects possible 80 Number of lock object partitions 47 Number of current locks 1262 Maximum number of locks at any one time 19 Maximum number of locks in any one bucket 0 Maximum number of locks stolen by for an empty partition 0 Maximum number of locks stolen for any one partition 340 Number of current lockers 341 Maximum number of lockers at any one time 44 Number of current lock objects 683 Maximum number of lock objects at any one time 6 Maximum number of lock objects in any one bucket 0 Maximum number of objects stolen by for an empty partition 0 Maximum number of objects stolen for any one partition 3799M Total number of locks requested (3799770221) 3799M Total number of locks released (3799714045) 0 Total number of locks upgraded 73 Total number of locks downgraded 73M Lock requests not available due to conflicts, for which we waited (73026840) 5165 Lock requests not available due to conflicts, for which we did not wait 50963 Number of deadlocks 0 Lock timeout value 0 Number of locks that have timed out 0 Transaction timeout value 0 Number of transactions that have timed out 1MB 400KB The size of the lock region 70M The number of partition locks that required waiting (1%) 15M The maximum number of times any partition lock was waited for (0%) 15018 The number of object queue operations that required waiting (0%) 54M The number of locker allocations that required waiting (2%) 0 The number of region locks that required waiting (0%) 6 Maximum hash bucket length ===== The number of deadlocks was pretty shocking; I've never seen that value non-zero. I also have db_stat -C A output if that helps. gdb (syncrepl thread): ===== Thread 12 (Thread 0x444a9950 (LWP 16336)): #0 0x00007f5e087f2b99 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/libpthread.so.0 #1 0x00007f5e08a274fb in __db_pthread_mutex_lock () from /apps/local/depend/BerkeleyDB-4.7.25p4/lib/libdb-4.7.so #2 0x00007f5e08aa5dec in __lock_get_internal () from /apps/local/depend/BerkeleyDB-4.7.25p4/lib/libdb-4.7.so #3 0x00007f5e08aa6d6a in __lock_vec () from /apps/local/depend/BerkeleyDB-4.7.25p4/lib/libdb-4.7.so #4 0x00007f5e08aa72db in __lock_vec_pp () from /apps/local/depend/BerkeleyDB-4.7.25p4/lib/libdb-4.7.so #5 0x000000000054da72 in hdb_cache_entry_db_relock (bdb=0xaec000, txn=0x1031c20, ei=0x3d5e240, rw=1, tryOnly=0, lock=0x444a7b30) at cache.c:198 #6 0x000000000054fe9e in hdb_cache_modify (bdb=0xaec000, e=0x7f5ccb945f58, newAttrs=0x7f5ccf4c1ec0, txn=0x1031c20, lock=0x444a7b30) at cache.c:1231 #7 0x00000000004fc2bd in hdb_modify (op=0x444a86d0, rs=0x444a8040) at modify.c:711 #8 0x00000000004db66f in overlay_op_walk (op=0x444a86d0, rs=0x444a8040, which=op_modify, oi=0xace000, on=0x0) at backover.c:671 #9 0x00000000004db899 in over_op_func (op=0x444a86d0, rs=0x444a8040, which=op_modify) at backover.c:723 #10 0x00000000004db9de in over_op_modify (op=0x444a86d0, rs=0x444a8040) at backover.c:762 #11 0x00000000004c8c59 in syncrepl_message_to_op (si=0xb22000, op=0x444a86d0, msg=0x7f5cf7df5f80) at syncrepl.c:2316 #12 0x00000000004c40dd in do_syncrep2 (op=0x444a86d0, si=0xb22000) at syncrepl.c:986 #13 0x00000000004c61a6 in do_syncrepl (ctx=0x444a8df0, arg=0xb768c0) at syncrepl.c:1522 #14 0x0000000000449003 in connection_read_thread (ctx=0x444a8df0, argv=0x31) at connection.c:1288 #15 0x0000000000591269 in ldap_int_thread_pool_wrapper (xpool=0xa741c0) at tpool.c:688 #16 0x00007f5e087ee3f7 in start_thread () from /lib/libpthread.so.0 #17 0x00007f5e0794dbbd in clone () from /lib/libc.so.6 #18 0x0000000000000000 in ?? () ===== gdb (thread modifying cn=config): ===== Thread 3 (Thread 0x48cb2950 (LWP 29597)): #0 0x00007f5e087f2b99 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/libpthread.so.0 #1 0x0000000000592806 in ldap_pvt_thread_cond_wait (cond=0xa74220, mutex=0xa741c8) at thr_posix.c:277 #2 0x000000000059162f in handle_pause (tpool=0x8b5420, pause_type=96) at tpool.c:788 #3 0x00000000005916fa in ldap_pvt_thread_pool_pause (tpool=0x8b5420) at tpool.c:831 #4 0x0000000000433ac4 in config_back_modify (op=0x7f5cdc507800, rs=0x48cb1c90) at bconfig.c:5837 #5 0x0000000000468e52 in fe_op_modify (op=0x7f5cdc507800, rs=0x48cb1c90) at modify.c:303 #6 0x0000000000468761 in do_modify (op=0x7f5cdc507800, rs=0x48cb1c90) at modify.c:177 #7 0x0000000000448a65 in connection_operation (ctx=0x48cb1df0, arg_v=0x7f5cdc507800) at connection.c:1150 #8 0x0000000000448fe7 in connection_read_thread (ctx=0x48cb1df0, argv=0x15) at connection.c:1286 #9 0x0000000000591269 in ldap_int_thread_pool_wrapper (xpool=0xa741c0) at tpool.c:688 #10 0x00007f5e087ee3f7 in start_thread () from /lib/libpthread.so.0 #11 0x00007f5e0794dbbd in clone () from /lib/libc.so.6 #12 0x0000000000000000 in ?? () ===== I also have bt full output if needed. Since restarting I have seen no issues with any of the instances and the failed instance synced without issue. Let me know if I should create an ITS. Thanks, Dave

6 8

ldap.conf uri syntax
by Ezra Taylor 15 Aug '12

15 Aug '12

Hello All: Is there a difference between the below uri syntax? Thanks for your help. uri ldap://rhino.bull.com/ ldap://bull.blah.com/ uri ldap://rhino.bull.com ldap://bull.blah.com -- Ezra Taylor

1 1

write an acl with sets and compare connecting peername.ip with ipHost entry (ipHostNumber)
by Uwe Werler 15 Aug '12

15 Aug '12

Hallo all, is it possible to write an ACL (with sets) which extracts the peername.ip from within an existing entry of ipHost an then compares the connecting peername.ip? My idea is to only allow access to this entry by connecting peername.ip 192.168.1.1: dn: cn=myhost.wdf.sap.corp,ou=HOSTS objectClass: ipHost objectClass: device cn: myhost.wdf.sap.corp ipHostNumber: 192.168.1.1 Background: I want to use ovleray nssov and therefore I need all host information at each host locally in ldap. 'cause we have several thousands of hosts I dont want to replicate all ipHosts to each local database. Thanks for any advice/hint. Regards Uwe

1 0

OpenLDAP and virtual directory
by Gilles Tual 14 Aug '12

14 Aug '12

Hi, I was wondering if I could use OpenLDAP backend to simulate a virtual directory for a project. Is it possible ? If yes, is there documentation on it, or help (i'm not a pro on LDAP and virtual directory). Thanks a lot, have a nice day !

2 1

Re:
by Gavin Henry 14 Aug '12

14 Aug '12

Excellent. Thanks for following up. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretec.co.uk Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 24 Cormack Park, Rothienorman, Inverurie, Aberdeenshire, AB51 8GL. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html Do you know we have our own VoIP provider called SureVoIP? See http://www.surevoip.co.uk On 14 Aug 2012, at 10:25, "非人協會" <hkuhaorg(a)gmail.com> wrote: Dear Henry, Thanks for the kindness follow up. The problem has fixed. The root cause of the problem is the wrongly configured slapd.conf Thanks and Regards, Donald 2012/8/10 Gavin Henry <ghenry(a)suretecsystems.com> > On 8 August 2012 04:59, 非人協會 <hkuhaorg(a)gmail.com> wrote: > > Dear All, > > I am new to ldap, I would like to have your kindness assistance in > setting > > up the directory. > > > > We are working on move our old ldap server to a new openldap server, I > have > > install the openldap in Solaris 10 x86 successfully. However I am not > able > > to browse the content using the ldap browser, it shows "Invalid > > Credentials". > > Hi Donald, > > All fixed? > > -- > Kind Regards, > > Gavin Henry. > Managing Director. > > T +44 (0) 1224 279484 > M +44 (0) 7930 323266 > F +44 (0) 1224 824887 > E ghenry(a)suretecsystems.com > > Open Source. Open Solutions(tm). > > http://www.suretecsystems.com/ > > Suretec Systems is a limited company registered in Scotland. Registered > number: SC258005. Registered office: 24 Cormack Park, Rothienorman, > Inverurie, > Aberdeenshire, AB51 8GL. > > Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html > > Do you know we have our own VoIP provider called SureVoIP? See > http://www.surevoip.co.uk > > Did you see our API news? > http://www.surevoip.co.uk/news-events/surevoip-launches-innovative-api >

1 0

Re: representing file pathnames
by Chuck Lever 14 Aug '12

14 Aug '12

Hi- On Aug 9, 2012, at 7:22 PM, Howard Chu wrote: > Michael Ströder wrote: >> Chuck Lever wrote: >>> On Aug 9, 2012, at 2:46 PM, Howard Chu wrote: >>>> Michael Ströder wrote: >>>>> Chuck Lever wrote: >>>>>> We could also use an NFS URL, which would allow us to express the server >>>>>> hostname, a port number, and the pathname in a single string. But both the >>>>>> hostname and pathname are enocded in US-ASCII, not UTF-8, and the NFS URL >>>>>> format employs a fixed pathname separator character. >>>>> >>>>> That's what I would prefer. Think of file browsers which can open the NFS >>>>> mount point just by clicking on it. Same encoding steps as with file URLs. >>>> >>>> This seems the most obvious and natural solution (NFS URL). After all, you are >>>> specifying an NFS resource... >>> >>> I've looked more closely at this idea. While it's got some surface appeal, >>> NFS URLs (RFC 2224) don't specify a generic NFS resource. They specify a >>> webDAV like resource that can be accessed with NFS, called WebNFS (RFC >>> 2054, RFC 20550), which gives clients access via a so-called "public file >>> handle," which is a degenerate NFS FH. >>> >>> WebNFS is defined only for legacy versions of NFS, not for NFSv4. >>> Referrals are supported only in NFSv4. In fact, section 4 of RFC 2224 >>> specifies that clients try version 3 then version 2. NFS version 4 is not >>> discussed. >>> >>> Thus, the form of an NFS URL might be rich enough, but the existing >>> semantics are not equivalent. >> >> I see no reason why it should not be able to use NFS URLs and define the exact >> usage of them for NFSv4. Maybe I'm overlooking something though. > > Agreed. AFAICS the semantics of the URL are for your actual application to > define. We're not talking about URLs that are meant to be served up by an HTTP > server. > > IMO RFC2224 is defective in that it specifies both the URL format and its > associated access methods. URL formats are meant to be "Uniform" which should > mean they are independent of their access methods. In order to use the NFS URL format, I think we would be compelled to correct RFC 2224, probably by issuing an RFC that supersedes it. While certainly possible, I'm not sure the NFSv4 working group is prepared to hold up the NSDB draft for such an undertaking at this point. Naturally there may be simpler alternatives. That said, I can present this design choice (the use of an NFS URL to represent an fs_locations entry in LDAP) to them for discussion. Thanks for the excellent feedback. -- Chuck Lever chuck[dot]lever[at]oracle[dot]com

2 3

AW: overlay nssov + SASL
by Uwe Werler 13 Aug '12

13 Aug '12

-----Ursprüngliche Nachricht----- An: openldap-technical(a)openldap.org; Von: Uwe Werler <uwe.werler(a)retiolum.eu> Gesendet: Mo 13.08.2012 09:50 Betreff: overlay nssov + SASL > Hello list, > > I want to use overlay nssov and it works great in my test setup. Up to now we > use pass through authentication with saslauthd to authenticate against an > AD-Domain. > > Internally nssov uses simple binds against the local database so I can't use > pass through authentication. With overlay pbind I can do simple binds against > an external ldap server. Is there another possibility to use overlay nssov in > combination with saslauthd? > > Thanks for any hints. > > Regards Uwe Ok, I found two ways. First use back relay + overlay pbind and second use back-meta/back-ldap. Both within the same naming context as the real database but configured with "hidden on" to avoid naming context issues. Both work now. Another question is if it's possible to use overlay nssov within multiple databases like one for hosts and another for users? Thanks! Regards Uwe

1 0

How to enable LDAP ports in iptables for OpenLDAP client node
by Qian Zhang 13 Aug '12

13 Aug '12

Hi All, I have a RHEL 6.2 machine which is set up as an OpenLDAP client, and I can log into it with LDAP user. Now for security concern, I need to prohibit any not-root user to access the network: # /etc/init.d/iptables status Table: filter Chain INPUT (policy ACCEPT) num target prot opt source destination Chain FORWARD (policy ACCEPT) num target prot opt source destination Chain OUTPUT (policy ACCEPT) num target prot opt source destination 1 REJECT all -- 0.0.0.0/0 0.0.0.0/0 ! owner UID match 0 reject-with icmp-port-unreachable But if I did this in iptables, LDAP has problems, "getent passwd" can not get any LDAP users, and I can no longer log into this machine with LDAP user. So I think I need to open LDAP ports in iptables, what I did is: # /etc/init.d/iptables status Table: filter Chain INPUT (policy ACCEPT) num target prot opt source destination Chain FORWARD (policy ACCEPT) num target prot opt source destination Chain OUTPUT (policy ACCEPT) num target prot opt source destination 1 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp spt:389 dpt:389 2 ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp spt:389 dpt:389 3 REJECT all -- 0.0.0.0/0 0.0.0.0/0 ! owner UID match 0 reject-with icmp-port-unreachable But it did not work, any ports I missed? Or what I set up in iptables are not correct? My /etc/openldap/ldap.conf: URI ldap://172.17.27.159:389 BASE dc=base,dc=com TLS_CACERTDIR /etc/openldap/cacerts Regards, Qian

3 4

overlay nssov + SASL
by Uwe Werler 13 Aug '12

13 Aug '12

Hello list, I want to use overlay nssov and it works great in my test setup. Up to now we use pass through authentication with saslauthd to authenticate against an AD-Domain. Internally nssov uses simple binds against the local database so I can't use pass through authentication. With overlay pbind I can do simple binds against an external ldap server. Is there another possibility to use overlay nssov in combination with saslauthd? Thanks for any hints. Regards Uwe

1 0

Windows SSPI, NTLMSSP and OpenLDAP with SASL/GSSAPI
by Diego Morales 13 Aug '12

13 Aug '12

Hello, I have a proprietary windows application trying to bind on my OpenLDAP server using GSSAPI with NTLMSSP mechanism, instead of Kerberos. Is it possible to support this on a (unix) OpenLDAP server? Another option would be to make the software use GSSAPI + Kerberos instead. Let me further explain: I have a working samba + openldap setup with many windows workstations. The said proprietary app has LDAP auth support, and according to its maker it works with Active Directory and Novell NDS. It does not support simple bind, nor LDAPS, (and probably not StartTLS either). We don't have access to the app's source code and help from its developers/tech-support is pretty unavailable. Checking slapd's debug, we saw the app trying to use SASL+GSSAPI to bind. So we went on and configured a minimal Kerberos setup and SASL+GSSAPI support for OpenLDAP on a test ldap server. It seems to be working perfectly. We acquire a ticket and run ldapsearch from another machine using -Y GSSAPI bind and it works. Logs from slapd debug seem ok. But that evil app still fails. Here's a piece from slapd debug log: conn=1000 op=1 do_bind ber_scanf fmt ({imt) ber: ber_dump: buf=0x7f73f6af8810 ptr=0x7f73f6af8813 end=0x7f73f6af8856 len=67 0000: 60 84 00 00 00 3d 02 01 03 04 00 a3 84 00 00 00 `....=.......... 0010: 32 04 06 47 53 53 41 50 49 04 28 4e 54 4c 4d 53 2..GSSAPI.(NTLMS 0020: 53 50 00 01 00 00 00 97 82 08 e2 00 00 00 00 00 SP.............. 0030: 00 00 00 00 00 00 00 00 00 00 00 06 01 b1 1d 00 ................ 0040: 00 00 0f ... ber_scanf fmt ({m) ber: ber_dump: buf=0x7f73f6af8810 ptr=0x7f73f6af881e end=0x7f73f6af8856 len=56 0000: 00 84 00 00 00 32 04 06 47 53 53 41 50 49 04 28 .....2..GSSAPI.( 0010: 4e 54 4c 4d 53 53 50 00 01 00 00 00 97 82 08 e2 NTLMSSP......... 0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0030: 06 01 b1 1d 00 00 00 0f ........ ber_scanf fmt (m) ber: ber_dump: buf=0x7f73f6af8810 ptr=0x7f73f6af882c end=0x7f73f6af8856 len=42 0000: 00 28 4e 54 4c 4d 53 53 50 00 01 00 00 00 97 82 .(NTLMSSP....... 0010: 08 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0020: 00 00 06 01 b1 1d 00 00 00 0f .......... ber_scanf fmt (}}) ber: ber_dump: buf=0x7f73f6af8810 ptr=0x7f73f6af8856 end=0x7f73f6af8856 len=0 >>> dnPrettyNormal: <> <<< dnPrettyNormal: <>, <> conn=1000 op=1 BIND dn="" method=163 do_bind: dn () SASL mech GSSAPI ==> sasl_bind: dn="" mech=GSSAPI datalen=40 SASL [conn=1000] Failure: GSSAPI Error: An unsupported mechanism was requested (Unknown error) send_ldap_result: conn=1000 op=1 p=3 send_ldap_result: err=49 matched="" text="SASL(-13): authentication failure: GSSAPI Failure: gss_accept_sec_context" send_ldap_response: msgid=11 tag=97 err=49 ber_flush2: 87 bytes to sd 13 0000: 30 55 02 01 0b 61 50 0a 01 31 04 00 04 49 53 41 0U...aP..1...ISA 0010: 53 4c 28 2d 31 33 29 3a 20 61 75 74 68 65 6e 74 SL(-13): authent 0020: 69 63 61 74 69 6f 6e 20 66 61 69 6c 75 72 65 3a ication failure: 0030: 20 47 53 53 41 50 49 20 46 61 69 6c 75 72 65 3a GSSAPI Failure: 0040: 20 67 73 73 5f 61 63 63 65 70 74 5f 73 65 63 5f gss_accept_sec_ 0050: 63 6f 6e 74 65 78 74 context ldap_write: want=87, written=87 0000: 30 55 02 01 0b 61 50 0a 01 31 04 00 04 49 53 41 0U...aP..1...ISA 0010: 53 4c 28 2d 31 33 29 3a 20 61 75 74 68 65 6e 74 SL(-13): authent 0020: 69 63 61 74 69 6f 6e 20 66 61 69 6c 75 72 65 3a ication failure: 0030: 20 47 53 53 41 50 49 20 46 61 69 6c 75 72 65 3a GSSAPI Failure: 0040: 20 67 73 73 5f 61 63 63 65 70 74 5f 73 65 63 5f gss_accept_sec_ 0050: 63 6f 6e 74 65 78 74 context conn=1000 op=1 RESULT tag=97 err=49 text=SASL(-13): authentication failure: GSSAPI Failure: gss_accept_sec_context (btw, this is slapd 2.4.21, from a 10.04 ubuntu package) I believe the application uses Windows SSPI, and I known SSPI supports several GSSAPI mechanisms, including NTLMSSP and Kerberos. I'm afraid Windows is auto selecting NTLMSSP cause its running on a pre-windows 2000 domain (non AD, in this case, Samba). Hoping to make windows use Kerberos instead, I've also tried publishing some SRV records on DNS. I have sniffed DNS queries from the workstation while the app tries to login, caught only one _ldap._tcp SRV request, registered that ... and nothing has changed. I don't know how could I force the app to use GSSAPI + kerberos without touching its source code. And I can't find much about a unix NTLM(SSP)-as-a-mechanism-of-GSSAPI implementation. Maybe there's something inside samba4 or in Likewise software, but I haven't found it yet. So ... does somebody have any advice or info? Thanks in advance, Diego Morales +55 (51) 3024-3568 Propus Informática LTDA. http://www.propus.com.br

2 1

Re: got into a "checksum error" situation
by Gavin Henry 12 Aug '12

12 Aug '12

On 12 August 2012 20:24, Jeff Dickens <jeff(a)seamanpaper.com> wrote: > > Thanks, I will certainly do that in the future. So is there a way to recalculate the checksum on my config as it is now, so that I can get back to normal? slapcat it, check it and make any edits needed, then delete what's in slapd.d/* and then slapadd it back. Checksums will sort themselves. > As an aside, my TLS config does indeed work now. Nice work! -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretec.co.uk Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 24 Cormack Park, Rothienorman, Inverurie, Aberdeenshire, AB51 8GL. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html Do you know we have our own VoIP provider called SureVoIP? See http://www.surevoip.co.uk Did you see our API? http://www.surevoip.co.uk/api

1 0

Re: got into a "checksum error" situation
by Jeff Dickens 12 Aug '12

12 Aug '12

Yes, I edited it by hand. Clearly not advisable since the comments said "don't do that", but since the server wouldn't start I couldn't use ldapmodify. On Fri, Aug 10, 2012 at 6:51 AM, Gavin Henry <ghenry(a)suretecsystems.com>wrote: > Not knowing what else to do, I removed the lines containing > > "olcTLS" from /etc/ldap/slapd.d/cn=config.ldif. Then I was able to > restart > > slapd (congratulating myself) and then re-ran my ldapmodify command to > enter > > the correct locations of the cert and key. But I still get a checksum > error > > in syslog: > > > Aug 8 17:04:53 grackle slapd[2028]: slapd starting > > Aug 8 17:05:01 grackle slapd[2028]: ldif_read_file: checksum error on > > "/etc/ldap /slapd.d/cn=config.ldif" > > So you edited this by hand? > > > > > I haven't even tried to see if I have TLS working, but I have two > > questions: > > > > #1. How should I have recovered from this (human) error? What I did > > didn't seem to work out very well. > > > > and > > > > #2. How do I un-screw my config and resolve the checksum problem? > > > > Thanks in advance for any assistance. > > > > -- > > Jeff Dickens > > IT Manager 978-632-1513 > > > > > > > > -- > Kind Regards, > > Gavin Henry. > Managing Director. > > T +44 (0) 1224 279484 > M +44 (0) 7930 323266 > F +44 (0) 1224 824887 > E ghenry(a)suretecsystems.com > > Open Source. Open Solutions(tm). > > http://www.suretecsystems.com/ > > Suretec Systems is a limited company registered in Scotland. Registered > number: SC258005. Registered office: 24 Cormack Park, Rothienorman, > Inverurie, > Aberdeenshire, AB51 8GL. > > Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html > > Do you know we have our own VoIP provider called SureVoIP? See > http://www.surevoip.co.uk > > Did you see our API news? > http://www.surevoip.co.uk/news-events/surevoip-launches-innovative-api > -- * Jeff Dickens* IT Manager 978-632-1513

3 2

access to inherited attributes
by Michael Ströder 11 Aug '12

11 Aug '12

HI! I cannot find anything in slapd.access(5) indicating that access attrs=mysupattr by <who> <access> also grants <access> to attributes inherited from mysupattr (which have SUP mysupattr in the attribute type description). Is this the expected behaviour? Where is this documented? (testing with 2.4.32) Ciao, Michael.

1 0

Re: ACL: access to all values vs. to value
by Dora Paula 11 Aug '12

11 Aug '12

Gavin Henry wrote: >> is there a possibility to create an acl statement that grants access to any >> (unknown) value of an attribute but denys access to all values of the same >> attribute? > > Can you explain that again? BTW: Your answer didn't find its way into the openldap-technical archive: http://www.openldap.org/lists/openldap-technical/201208/threads.html Nevertheless, please let me try to explain using a short (but complete) example: Sample slapd.conf: ================== include /openldap/schema/core.schema pidfile /openldap/schema/slapd.pid argsfile /openldap/schema/slapd.args access to * by self write by users read by anonymous auth database mdb suffix "o=test" rootdn "cn=Manager,o=test" rootpw secret directory /openldap/var/openldap-data/test index objectClass eq access to dn.one="ou=persons,o=test" attrs=description by users write by * none Sample val.ldif: ================ dn: o=test objectClass: organization objectClass: top o: test dn: ou=persons,o=test objectClass: organizationalUnit objectClass: top ou: persons dn: cn=PersonA,ou=persons,o=test objectClass: person objectClass: top cn: PersonA sn: PersonA userPassword:: UGVyc29uQQ== Sample modifications.ldif: ========================== #mod 1 (should succeed) dn: cn=PersonA,ou=persons,o=test changetype: modify add: description description: Description of A #mod 2 (should succeed) dn: cn=PersonA,ou=persons,o=test changetype: modify add: description description: Another description of A description: Just another description of A #mod 3 (should succeed) dn: cn=PersonA,ou=persons,o=test changetype: modify delete: description description: Another description of A description: Just another description of A #mod 4 (should fail) dn: cn=PersonA,ou=persons,o=test changetype: modify delete: description slapd startup: (version: git master) ==================================== deepee@test:~$ /openldap/libexec/slapd -f slapd.conf.acl -u openldap -g openldap -d 128 -h "ldap://0.0.0.0:1389/ ldapi://%2Ftmp%2Fldapi_acl/" 50258437 @(#) $OpenLDAP: slapd 2.X (Aug 10 2012 20:44:06) $ deepee@test:/.../slapd Backend ACL: access to * by self write by users read by anonymous auth Backend ACL: access to dn.one="ou=persons,o=test" attrs=description by users write by * none Backend ACL: access to * by * none 50258437 config_back_db_open: line 0: warning: cannot assess the validity of the ACL scope within backend naming context 50258437 mdb_monitor_db_open: monitoring disabled; configure monitor database to enable 50258437 slapd starting ldapmodify: =========== deepee@test:~$ cat /tmp/val.ldif | /openldap/bin/ldapmodify -c -x -H "ldap://localhost:1389" -D "cn=PersonA,ou=persons,o=test" -w PersonA modifying entry "cn=PersonA,ou=persons,o=test" modifying entry "cn=PersonA,ou=persons,o=test" modifying entry "cn=PersonA,ou=persons,o=test" modifying entry "cn=PersonA,ou=persons,o=test" slapd.log (level 128): ====================== 50258ca0 => access_allowed: result not in cache (userPassword) 50258ca0 => access_allowed: auth access to "cn=PersonA,ou=persons,o=test" "userPassword" requested 50258ca0 => dn: [1] ou=persons,o=test 50258ca0 => acl_get: [1] matched 50258ca0 => acl_get: [2] attr userPassword 50258ca0 => acl_mask: access to entry "cn=PersonA,ou=persons,o=test", attr "userPassword" requested 50258ca0 => acl_mask: to value by "", (=0) 50258ca0 <= check a_dn_pat: self 50258ca0 <= check a_dn_pat: users 50258ca0 <= check a_dn_pat: anonymous 50258ca0 <= acl_mask: [3] applying auth(=xd) (stop) 50258ca0 <= acl_mask: [3] mask: auth(=xd) 50258ca0 => slap_access_allowed: auth access granted by auth(=xd) 50258ca0 => access_allowed: auth access granted by auth(=xd) 50258ca0 => access_allowed: result not in cache (description) 50258ca0 => access_allowed: add access to "cn=PersonA,ou=persons,o=test" "description" requested 50258ca0 => dn: [1] ou=persons,o=test 50258ca0 => acl_get: [1] matched 50258ca0 => acl_get: [1] attr description 50258ca0 => acl_mask: access to entry "cn=PersonA,ou=persons,o=test", attr "description" requested 50258ca0 => acl_mask: to value by "cn=persona,ou=persons,o=test", (=0) 50258ca0 <= check a_dn_pat: users 50258ca0 <= acl_mask: [1] applying write(=wrscxd) (stop) 50258ca0 <= acl_mask: [1] mask: write(=wrscxd) 50258ca0 => slap_access_allowed: add access granted by write(=wrscxd) 50258ca0 => access_allowed: add access granted by write(=wrscxd) 50258ca0 acl: internal mod entryCSN: modify access granted 50258ca0 acl: internal mod modifiersName: modify access granted 50258ca0 acl: internal mod modifyTimestamp: modify access granted 50258ca0 => access_allowed: result not in cache (description) 50258ca0 => access_allowed: add access to "cn=PersonA,ou=persons,o=test" "description" requested 50258ca0 => dn: [1] ou=persons,o=test 50258ca0 => acl_get: [1] matched 50258ca0 => acl_get: [1] attr description 50258ca0 => acl_mask: access to entry "cn=PersonA,ou=persons,o=test", attr "description" requested 50258ca0 => acl_mask: to value by "cn=persona,ou=persons,o=test", (=0) 50258ca0 <= check a_dn_pat: users 50258ca0 <= acl_mask: [1] applying write(=wrscxd) (stop) 50258ca0 <= acl_mask: [1] mask: write(=wrscxd) 50258ca0 => slap_access_allowed: add access granted by write(=wrscxd) 50258ca0 => access_allowed: add access granted by write(=wrscxd) 50258ca0 => access_allowed: result was in cache (description) 50258ca0 acl: internal mod entryCSN: modify access granted 50258ca0 acl: internal mod modifiersName: modify access granted 50258ca0 acl: internal mod modifyTimestamp: modify access granted 50258ca0 => access_allowed: result not in cache (description) 50258ca0 => access_allowed: delete access to "cn=PersonA,ou=persons,o=test" "description" requested 50258ca0 => dn: [1] ou=persons,o=test 50258ca0 => acl_get: [1] matched 50258ca0 => acl_get: [1] attr description 50258ca0 => acl_mask: access to entry "cn=PersonA,ou=persons,o=test", attr "description" requested 50258ca0 => acl_mask: to value by "cn=persona,ou=persons,o=test", (=0) 50258ca0 <= check a_dn_pat: users 50258ca0 <= acl_mask: [1] applying write(=wrscxd) (stop) 50258ca0 <= acl_mask: [1] mask: write(=wrscxd) 50258ca0 => slap_access_allowed: delete access granted by write(=wrscxd) 50258ca0 => access_allowed: delete access granted by write(=wrscxd) 50258ca0 => access_allowed: result was in cache (description) 50258ca0 acl: internal mod entryCSN: modify access granted 50258ca0 acl: internal mod modifiersName: modify access granted 50258ca0 acl: internal mod modifyTimestamp: modify access granted 50258ca0 => access_allowed: result not in cache (description) 50258ca0 => access_allowed: delete access to "cn=PersonA,ou=persons,o=test" "description" requested 50258ca0 => dn: [1] ou=persons,o=test 50258ca0 => acl_get: [1] matched 50258ca0 => acl_get: [1] attr description 50258ca0 => acl_mask: access to entry "cn=PersonA,ou=persons,o=test", attr "description" requested 50258ca0 => acl_mask: to all values by "cn=persona,ou=persons,o=test", (=0) 50258ca0 <= check a_dn_pat: users 50258ca0 <= acl_mask: [1] applying write(=wrscxd) (stop) 50258ca0 <= acl_mask: [1] mask: write(=wrscxd) 50258ca0 => slap_access_allowed: delete access granted by write(=wrscxd) 50258ca0 => access_allowed: delete access granted by write(=wrscxd) 50258ca0 acl: internal mod entryCSN: modify access granted 50258ca0 acl: internal mod modifiersName: modify access granted 50258ca0 acl: internal mod modifyTimestamp: modify access granted So far so good, all four modification operations succeeded. That's slapd's known default behavior and completely correct in regard to the above defined acl. My intention is to let the first three operations (to value(s)) succeed and the last operation (to all values) fail by "Insufficient access (50)". After studying the documentation, doing some (unstructured, trial and error) testing with various combinations of acl statements, I finally had a closer look into slapd's source: Am I right, that slapd's acl engine currently does not offer a chance to differentiate between these two types of modification?

2 1

Breathing life into the OpenLDAP Cookbook
by Gavin Henry 10 Aug '12

10 Aug '12

Hi All, I started getting this all together in 2008, but never really moved on it and have now opened it up. I'm pretty sure all these topics are still relevant and I've added some more: http://wiki.suretec.org/openldap:cookbook Feel free to add anything in the right place. You'll need to register to edit. Thanks. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretec.co.uk Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 24 Cormack Park, Rothienorman, Inverurie, Aberdeenshire, AB51 8GL. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html Do you know we have our own VoIP provider called SureVoIP? See http://www.surevoip.co.uk Did you see our API? http://www.surevoip.co.uk/api

3 7

Internal telephone extension number
by Gavin Henry 10 Aug '12

10 Aug '12

Hi all, What attribute are you using to represent an internal telephone extension? Can't see any standards based ones. Thanks. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretec.co.uk Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 24 Cormack Park, Rothienorman, Inverurie, Aberdeenshire, AB51 8GL. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html Do you know we have our own VoIP provider called SureVoIP? See http://www.surevoip.co.uk Did you see our API? http://www.surevoip.co.uk/api

4 4

critical applications
by Friedrich Locke 10 Aug '12

10 Aug '12

Dear friends, i am planning to use openldap 2.4.26 and bdb 4.6.21v0 for mission critical application mailing system. I tried some time ago i tried to implement a mail server using qmail, qmail-ldap patch, openldap and bdb but while time passed and email were coming and going, slapd was eating all system memory and needed to be restart. I wonder if someone in the mailing list have used such technologies so far and with which degree of success ? Thanks in advance for your time and cooperation. Best regards. []s gustavo.

2 1

doubt
by Luiz Guilherme Nunes Fernandes 09 Aug '12

09 Aug '12

Dear, i have one doubt, after running slaptest, the error is displayed: slapo-ppolicy cannot be global slaptest: bad configuration file! ########################## My config: # Slapd.conf # Converter slapd.conf para diretório slapd.d # slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d # schema Padrão include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/inetorgperson.schema # schema adicionais include /etc/openldap/schema/collective.schema include /etc/openldap/schema/corba.schema include /etc/openldap/schema/duaconf.schema include /etc/openldap/schema/dyngroup.schema include /etc/openldap/schema/java.schema include /etc/openldap/schema/misc.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/pmi.schema include /etc/openldap/schema/ppolicy.schema include /etc/openldap/schema/qmail.schema include /etc/openldap/schema/sudo.schema # Permitir o protocolo LDAPv2 allow bind_v2 # Arquivo de informação de processos slapd pidfile /var/run/slapd/slapd.pid # Lista de argumentos que são repassados ao servidoe slapd argsfile /var/run/slapd/slapd.args # Nivel de logs loglevel 256 modulepath /usr/lib/ldap/ moduleload back_bdb.la moduleload ppolicy.la # Politicas de senhas overlay ppolicy ppolicy_default "cn=StandardPolicy,dc=abc" ppolicy_use_lockout # Limites Aplicado a toda as buscas no LDAP, Tamanho e Tempo Limite (Segundos) sizelimit 500 # Número de CPUs Utilizada para criar indíces tool-threads 1 # Banco de Dados backend bdb database bdb # Raiz da estrutura hierarquica da base OpenLdap suffix "dc=abc" # Conta admin da base OpenLdap rootdn "cn=admin,dc=abc" # Senha da conta admin OpenLdap # slappasswd -h {SSHA} -s novasenha -v # novasenha = ####### rootpw ######### # Diretório do banco de dados # Obs: Altere a permissão do diretório "chown -R ldap /var/lib/ldap" directory "/var/lib/ldap" # Quantidade de memória RAM para o cache (2Mb) dbconfig set_cachesize 0 2097152 0 # Núḿero de objetos que podem ser bloqueados ao mesmo tempo dbconfig set_lk_max_objects 1500 # Número de bloqueios dbconfig set_lk_max_locks 1500 # Número de travas dbconfig set_lk_max_lockers 1500 # Opções de indexação para a base #index objectClass eq index uid eq # Armazena o tempo e data das entradas modificadas lastmod on # Checagem periódica da base de dados checkpoint 512 30 # Controle de acessos à base de dados access to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=abc" write by anonymous auth by self write by * none access to dn.base="" by * read access to * by dn="cn=admin,dc=abc" write by * read Thanks for attention. -- <<<<<<<<<<<<<<<<<<<------------------------------>>>>>>>>>>>>>>>>>>> -=| A idéia de um fim que termina em um início. |=- Att. ♪ ♫ Luiz Guilherme Nunes Fernandes ♫ ♪ <<<<<<<<<<<<<<<<<<<------------------------------>>>>>>>>>>>>>>>>>>>

2 1

Newbie Question about adding 2nd entry for admin
by Tech Only 09 Aug '12

09 Aug '12

Hello, I am a newbie. Trying to learn ldap. Is it possible to add second admin user to openldap? Like manager/admin? If yes, please post the ldif entry. If this is a wrong forum please let me know where I can post it? Thanks, ST

2 1

ACL: access to all values vs. to value
by Dora Paula 09 Aug '12

09 Aug '12

Hi list, is there a possibility to create an acl statement that grants access to any (unknown) value of an attribute but denys access to all values of the same attribute? For example: # allow this: dn: cn=PersonA,ou=persons,o=test changetype: modify delete: description description: PersonA's description # deny this: dn: cn=PersonA,ou=persons,o=test changetype: modify delete: description - Thank you very much.

1 0

LDAP Entry with gecos
by rodrigo tavares 09 Aug '12

09 Aug '12

Hello ! I create one samba user with command: smbldap-useradd -a xbox -c "Game XBOX" -S "Sell games" -d /home/xbox -s /bin/false Then I type: smbldap-passwd xbox #define password ldap user smbpasswd -a xbox # create user samba So. I can to make login in my domain. I checked atributtes gecos is: SystemUser. After I log in domain, in the top menu windows show:System User. I changed this value gecos, but each login the gecos show System User. It´s no changed never. This command in line 2, not define gecos in LDAP, give default with "System user". If i change the value gecos in LDAP before te fist login, the gecos is with value correct. Any sugesstion ? Thanks. Rodrigo Faria

2 2

openldap + qmail + openbsd
by Friedrich Locke 09 Aug '12

09 Aug '12

Dear fellows, i am planning to build a mail server and would like to use the following technologies : OpenBSD 5.1 amd64 qmail-ldap-1.03-20120221 qmail-1.03 Does anybody here run an environment like ? Are you aware of buggy stuf like openldap eating all system memory while qmail connect/disconnect to it (slapd) ? Is there any problem with the latest ldap patch release to be applied to stock qmail-1.03 ? Thanks a lot for your time and cooperation. []s gustavo. PS: Anyone from Brazil in this mailing list ? Using such technologies ?

1 0

got into a "checksum error" situation
by Jeff Dickens 08 Aug '12

08 Aug '12

I was following an Ubuntu howto at https://help.ubuntu.com/12.04/serverguide/openldap-server.html ,which has served me well so far, and I was working on the part where TLS is set up. I made an ldif file like: dn: cn=config add: olcTLSCACertificateFile olcTLSCACertificateFile: /etc/ssl/certs/cacert.pem - add: olcTLSCertificateFile olcTLSCertificateFile: /etc/ssl/certs/grackle_slapd_cert.pem - add: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/ssl/private/grackle_slapd_key.pem and, well, I blew it.. I initially had a typo in it, and the server cert and key weren't where I said they were. I ran ldapmodify to load the ldif file above: ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ssl/certinfo.ldif Then I tried to restart slapd, and perhaps unsurprisingly it did not restart. Aug 8 16:41:30 grackle slapd[1660]: @(#) $OpenLDAP: slapd (Jul 26 2012 00:10:41) $#012#011buildd@aatxe :/build/buildd/openldap-2.4.28/debian/build/servers/slapd Aug 8 16:41:30 grackle slapd[1660]: main: TLS init def ctx failed: -1 Aug 8 16:41:30 grackle slapd[1660]: slapd stopped. Aug 8 16:41:30 grackle slapd[1660]: connections_destroy: nothing to destroy. So I thought I just fix my ldif file, which I did, and then run ldapmodify again. But no, that clearly wasn't going to work because slapd wasn't running. Not knowing what else to do, I removed the lines containing "olcTLS" from /etc/ldap/slapd.d/cn=config.ldif. Then I was able to restart slapd (congratulating myself) and then re-ran my ldapmodify command to enter the correct locations of the cert and key. But I still get a checksum error in syslog: Aug 8 17:04:53 grackle slapd[2028]: slapd starting Aug 8 17:05:01 grackle slapd[2028]: ldif_read_file: checksum error on "/etc/ldap /slapd.d/cn=config.ldif" I haven't even tried to see if I have TLS working, but I have two questions: #1. How should I have recovered from this (human) error? What I did didn't seem to work out very well. and #2. How do I un-screw my config and resolve the checksum problem? Thanks in advance for any assistance. -- * Jeff Dickens* IT Manager 978-632-1513

1 0

Virtual view using slapd-relay: dn mapping failure
by Guillaume Rousse 08 Aug '12

08 Aug '12

Hello list. I'm trying to provide a virtual view of the user branch in my legacy ldap directory. Basically, the real branch uses 'localLogin' as login attribute, and not 'uid', as usual, which unfortunatly breaks hard-coded rules in some applications. This configuration creates a virtual 'ou=users' branch, mapped on actual 'ou=people', with real 'localLogin' attribute mapped to 'uid', and real 'uid' one removed: # virtual database database relay suffix ou=users,dc=domain relay ou=people,dc=domain overlay rwm rwm-suffixmassage ou=people,dc=domain rwm-map attribute uid localLogin rwm-map attribute uid access to dn.subtree="ou=users,dc=domain" attrs=userPassword by anonymous auth access to dn.subtree="ou=users,dc=domain" by * read # main database database bdb suffix "dc=domain" However, the actual 'uid' attribute is also used as RDN in the actual branch, and bind operation fails, because DN mapping is incomplete: uid=rousse,ou=users,dc=domain -> uid=rousse,ou=people,dc=domain Wheras I'd need this, where somethingelse is the value for the actual 'uid' attribute: uid=rousse,ou=users,dc=domain -> uid=somethingelse,ou=people,dc=domain I read rwm man page carefully, but it is a bit tough to understand. So, how am I supposed to achieve this ? -- BOFH excuse #219: Recursivity. Call back if it happens again.

1 1

(no subject)
by 非人協會 08 Aug '12

08 Aug '12

Dear All, I am new to ldap, I would like to have your kindness assistance in setting up the directory. We are working on move our old ldap server to a new openldap server, I have install the openldap in Solaris 10 x86 successfully. However I am not able to browse the content using the ldap browser, it shows "Invalid Credentials". this is what we change in slapd.conf suffix "o=Cname" rootdn "cn=Manager,ou=Dname,o=Cname" rootpw password This is what we have in slapd.ldif olcSuffix: o=Cname olcRootDN: cn=Manager,ou=Dname,o=Cname olcRootPW: password Herewith is the debug log 5021e2df daemon: activity on 1 descriptor 5021e2df slap_listener_activate(8): 5021e2df daemon: select: listen=7 active_threads=0 tvp=NULL 5021e2df >>> slap_listener(ldap:///) 5021e2df daemon: select: listen=8 busy 5021e2df daemon: listen=8, new connection on 12 5021e2df daemon: activity on 1 descriptor 5021e2df daemon: added 12r (active) listener=0 5021e2df conn=1002 fd=12 ACCEPT from IP=10.122.39.115:54220 (IP=0.0.0.0:389) 5021e2df daemon: waked 5021e2df daemon: select: listen=7 active_threads=0 tvp=NULL 5021e2df daemon: select: listen=8 active_threads=0 tvp=NULL 5021e2df daemon: activity on 1 descriptor 5021e2df daemon: activity on:5021e2df 12r5021e2df 5021e2df daemon: read activity on 12 5021e2df daemon: select: listen=7 active_threads=0 tvp=NULL 5021e2df connection_get(12) 5021e2df connection_get(12): got connid=1002 5021e2df connection_read(12): checking for input on id=1002 5021e2df daemon: select: listen=8 active_threads=0 tvp=NULL ber_get_next ldap_read: want=8, got=8 0000: 30 2f 02 01 04 60 2a 02 0/...`*. ldap_read: want=41, got=41 0000: 01 03 04 1b 63 6e 3d 4d 61 6e 61 67 65 72 2c 6f ....cn=Manager,o 0010: 75 3d 44 6e 61 6d 65 2c 6f 3d 43 6e 61 6d 65 80 u=Dname,o=Cname. 0020: 08 70 61 73 73 77 6f 72 64 .password ber_get_next: tag 0x30 len 47 contents: ber_dump: buf=83e3f10 ptr=83e3f10 end=83e3f3f len=47 0000: 02 01 04 60 2a 02 01 03 04 1b 63 6e 3d 4d 61 6e ...`*.....cn=Man 0010: 61 67 65 72 2c 6f 75 3d 44 6e 61 6d 65 2c 6f 3d ager,ou=Dname,o= 0020: 43 6e 61 6d 65 80 08 70 61 73 73 77 6f 72 64 Cname..password 5021e2df op tag 0x60, time 1344398047 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable 5021e2df daemon: activity on 1 descriptor 5021e2df conn=1002 op=0 do_bind ber_scanf fmt ({imt) ber: ber_dump: buf=83e3f10 ptr=83e3f13 end=83e3f3f len=44 0000: 60 2a 02 01 03 04 1b 63 6e 3d 4d 61 6e 61 67 65 `*.....cn=Manage 0010: 72 2c 6f 75 3d 44 6e 61 6d 65 2c 6f 3d 43 6e 61 r,ou=Dname,o=Cna 0020: 6d 65 80 08 70 61 73 73 77 6f 72 64 me..password ber_scanf fmt (m}) ber: ber_dump: buf=83e3f10 ptr=83e3f35 end=83e3f3f len=10 0000: 00 08 70 61 73 73 77 6f 72 64 ..password 5021e2df >>> dnPrettyNormal: <cn=Manager,ou=Dname,o=Cname> 5021e2df daemon: waked => ldap_bv2dn(cn=Manager,ou=Dname,o=Cname,0) <= ldap_bv2dn(cn=Manager,ou=Dname,o=Cname)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=Manager,ou=Dname,o=Cname)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=manager,ou=dname,o=cname)=0 5021e2df <<< dnPrettyNormal: <cn=Manager,ou=Dname,o=Cname>, <cn=manager,ou=dname,o=cname> 5021e2df conn=1002 op=0 BIND dn="cn=Manager,ou=Dname,o=Cname" method=128 5021e2df daemon: select: listen=7 active_threads=0 tvp=NULL 5021e2df do_bind: version=3 dn="cn=Manager,ou=Dname,o=Cname" method=128 5021e2df daemon: select: listen=8 active_threads=0 tvp=NULL 5021e2df ==> bdb_bind: dn: cn=Manager,ou=Dname,o=Cname 5021e2df bdb_dn2entry("cn=manager,ou=dname,o=cname") 5021e2df => bdb_dn2id("o=cname") 5021e2df <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30988) 5021e2df send_ldap_result: conn=1002 op=0 p=3 5021e2df send_ldap_result: err=49 matched="" text="" 5021e2df send_ldap_response: msgid=4 tag=97 err=49 ber_flush2: 14 bytes to sd 12 0000: 30 0c 02 01 04 61 07 0a 01 31 04 00 04 00 0....a...1.... ldap_write: want=14, written=14 0000: 30 0c 02 01 04 61 07 0a 01 31 04 00 04 00 0....a...1.... 5021e2df conn=1002 op=0 RESULT tag=97 err=49 text= 5021e2df daemon: activity on 1 descriptor 5021e2df daemon: activity on:5021e2df 12r5021e2df 5021e2df daemon: read activity on 12 5021e2df daemon: select: listen=7 active_threads=0 tvp=NULL 5021e2df connection_get(12) 5021e2df connection_get(12): got connid=1002 5021e2df daemon: select: listen=8 active_threads=0 tvp=NULL 5021e2df connection_read(12): checking for input on id=1002 ber_get_next ldap_read: want=8 error=Connection reset by peer 5021e2df ber_get_next on fd 12 failed errno=131 (Connection reset by peer) 5021e2df connection_read(12): input error=-2 id=1002, closing. 5021e2df connection_closing: readying conn=1002 sd=12 for close 5021e2df connection_close: conn=1002 sd=12 5021e2df daemon: removing 12 5021e2df daemon: activity on 1 descriptor 5021e2df conn=1002 fd=12 closed (connection lost) 5021e2df daemon: waked 5021e2df daemon: select: listen=7 active_threads=0 tvp=NULL 5021e2df daemon: select: listen=8 active_threads=0 tvp=NULL Any help would be greatly appreciated Thanks and Regards, Donald

1 0

sasl bind error -1 because of socket error 54
by Max Kunz 07 Aug '12

07 Aug '12

Hello, i try to bind to an server using the ldap_sals_bind_s function. The Host is not localhost, but is accessible via internet. I'v tested the connection with a java based ldap browser. When i try to do this using my simple c++ program, it fails with error -1. Here is what the program actually do: //initialize returns success result = ldap_initialize( &ld, host); result = ldap_set_option( ld, LDAP_OPT_PROTOCOL_VERSION, LDAP_VERSION3); //set this option only after successful bind? result = ldap_set_option(ld, LDAP_OPT_X_TLS_REQUIRE_CERT, LDAP_OPT_X_TLS_NEVER); //the synchronous bind function returns -1 server down result = ldap_sasl_bind_s(ld, root_dn, LDAP_SASL_SIMPLE, &credential, NULL,NULL, &serverReturnedCredentials); When I use the asynchronous ldap_sals_bind() function, it returns 0 ldap_success. (I`m also able to create a simple socket to this particular server and port). The error -1 comes from the following ldap_result() function. The problem here is that the socket throws a sock_errno 54 (connection reset by peer). Someone an idea why the connection always will be disturbed? Thanks for any help best regards, Max

2 1

Referral to single attributes
by Florian Götz 07 Aug '12

07 Aug '12

Hi, maybe someone has experienced the same problem. Take the following example. You would like to use one LDAP server (replicated of course) for multiple Domains. Like ou=users,ou=department1,dc=company,dc=de ou=users,ou=department2,dc=company,dc=de ou=users,ou=maindep,dc=company,dc=de ... Each department has its own domain, all users are part of maindep, some of those users are part of dep1 too and some of dep2. So you have the maindep tree for the general use (uid and password for things like mail, vpn and a genereal purpose domain) and the smaller dep1 or dep2 for the use with the workstations of the department. The uid of a user is always the same across the trees (uid=mikecharlie,ou=dep1,... = uid=mikecharlie,ou=maindep). The single departments are responsible for their users (creation and deletion of accounts in their subtrees). The maindep-Tree gets managed by IT center staff. Now every department could work with their domain and users (and only those) , but all users would have a general "account" for stuff that doesnt belong to their department alone. The big problem is the sync of the passwords from subtree to subtree (dep1 to maindep or dep2 to maindep). Our users get confused if they have password1 for the login at a workstation and password2 for mail etc. But the departments want to have their own domains where they have the control who is able to login or not, BUT they want to have syncronized passwords. Is there a possibility to refer to single attributes? Like uid=mikecharlie,ou=dep1,dc=company,dc=de -> userPassword -> look at uid=mikecharlie,ou=maindep,dc=hs-mannheim,dc=de -> userPassword. Best regards Flo -- Mit freundlichen Grüßen Florian Götz ----------------------------------------------------------------- Dipl.-Inf. (FH) Florian Götz Rechenzentrum Hochschule Mannheim Paul-Wittsack-Straße 10 68163 Mannheim Tel: 0621/292-6232 EMail: f.goetz(a)hs-mannheim.de Internet: http://www.rz.hs-mannheim.de -----

1 0

MDB configuration admin guide
by Yajuvendra Singh 06 Aug '12

06 Aug '12

Hi Experts, I have just started working on openldap and configured my openldap with MDB. I am not able to locate the MDB configuration and admin guide which talks about administration of openldap with mdb. I am not clear about the configuration or changes i need to do to change my release from BDB to MDB. Can anyone point me where i can find these document. Thanks and Regards, Yajuvendra

2 1

personalization
by Jignesh Patel 06 Aug '12

06 Aug '12

I have a requirement to support personalization. I didn't find many articles to do that. Please point me some of the articles related to it. -Jignesh

2 1

ACL processing: subtractive privs (using control continue)
by Dora Paula 06 Aug '12

06 Aug '12

Hi List, just another short question regarding incremental privileges, given the following acl: access to dn.subtree="o=test" attrs=description by self =dxcsraz continue by users -z by * none Subtracting "z" results in the access mask "=dxcsr". As I expected the resulting access mask to be "=dxcsra", I would like to know whether "=dxcsr" is the correct result, and if so, why? Many thanks again! A small testbed containing sample ldif data, ldapmodify test command and the produced slapd.log (level 128) follows here: sample ldif data: =============== dn: o=test objectClass: organization objectClass: top o: test dn: ou=persons,o=test objectClass: organizationalUnit objectClass: top ou: persons dn: cn=PersonA,ou=persons,o=test objectClass: person objectClass: top cn: PersonA sn: PersonA userPassword:: UGVyc29uQQ== test command using ldapmodify: ============================= deepee@test:~$ /opt/openldap-acl/bin/ldapmodify -x -H "ldap://localhost:1389" -D "cn=PersonA,ou=persons,o=test" -w PersonA <<EOF dn: cn=PersonA,ou=persons,o=test changetype: modify add: description description: PersonA1 EOF modifying entry "cn=PersonA,ou=persons,o=test" ldap_modify: Insufficient access (50) slapd.log level 128: ================= 501fb8b7 => access_allowed: result not in cache (userPassword) 501fb8b7 => access_allowed: auth access to "cn=PersonA,ou=persons,o=test" "userPassword" requested 501fb8b7 => dn: [1] o=test 501fb8b7 => acl_get: [1] matched 501fb8b7 => acl_get: [2] attr userPassword 501fb8b7 => acl_mask: access to entry "cn=PersonA,ou=persons,o=test", attr "userPassword" requested 501fb8b7 => acl_mask: to value by "", (=0) 501fb8b7 <= check a_dn_pat: self 501fb8b7 <= check a_dn_pat: users 501fb8b7 <= check a_dn_pat: anonymous 501fb8b7 <= acl_mask: [3] applying auth(=xd) (stop) 501fb8b7 <= acl_mask: [3] mask: auth(=xd) 501fb8b7 => slap_access_allowed: auth access granted by auth(=xd) 501fb8b7 => access_allowed: auth access granted by auth(=xd) 501fb8b7 => access_allowed: result not in cache (description) 501fb8b7 => access_allowed: add access to "cn=PersonA,ou=persons,o=test" "description" requested 501fb8b7 => dn: [1] o=test 501fb8b7 => acl_get: [1] matched 501fb8b7 => acl_get: [1] attr description 501fb8b7 => acl_mask: access to entry "cn=PersonA,ou=persons,o=test", attr "description" requested 501fb8b7 => acl_mask: to value by "cn=persona,ou=persons,o=test", (=0) 501fb8b7 <= check a_dn_pat: self 501fb8b7 <= acl_mask: [1] applying =wrscxd (continue) 501fb8b7 <= acl_mask: [1] mask: =wrscxd 501fb8b7 <= check a_dn_pat: users 501fb8b7 <= acl_mask: [2] applying -z (stop) 501fb8b7 <= acl_mask: [2] mask: =rscxd 501fb8b7 => slap_access_allowed: add access denied by =rscxd 501fb8b7 => access_allowed: no more rules BTW: Replacing the first by clause using "self write" or "self =dxcsrw", also results in "=dxcsr" JFF: Replacing the second by clause using "users -a", the test results in the above mask (=dxcsr), too.

2 1

new versions
by Friedrich Locke 06 Aug '12

06 Aug '12

Hi folks, i have noticed openldap keeps releasing new versions from time to time. I have not noticed changes in protocol specification. So why does openldap release new versions ? Isn't it mature enough yet ? I am asking cause i am used to djb tools like qmail and djbdns and they don't change since a long time ago. Please, don't get me wrong. I am no saying one approach is better than another, i am just curious about openldap. Thanks.

4 3

ACL processing: additive privs (using control continue)
by Dora Paula 06 Aug '12

06 Aug '12

Hi list, just a short question about "continue" and additive privileges, given the following acl statement: access to dn.subtree="o=test" attrs=sn by users =s continue by group/groupOfNames/member="cn=readers,ou=groups,o=test" +r If the current user's bindDn isn't a member of the group "cn=readers,..." or the group's entry does not exist, the previously set privilege "=s" will be reset to "none"? As the slapd.access man page just gives a "silly" and an "even more silly" example regarding "continue" I'm not sure this is the intended behavior. Attached you'll find my minimalistic testbed: slapd.conf sample ldif data two ldapsearch commands (including their slapd.log level 128) I'm using openldap MASTER. Thank you very much. Cheers Dora

4 9

slapcat not printing dn
by Frank Swasey 03 Aug '12

03 Aug '12

I'm using OpenLDAP 2.4.31 which I locally compiled on RHEL 6.3 64-bit. Last night as part of the nightly update process, a slapcat of the main suffix. There were 312,576 dn's in this database, and the last 4,794 entries printed were written out with in the form: dn: objectClass: groupOfNames cn: COURSE-201209-92184 member: uid=notreal,ou=people,dc=uvm,dc=edu structuralObjectClass: groupOfNames entryUUID: 1ee49f30-245e-4804-9be9-9faf0bb7f0c5 creatorsName: cn=theboss,dc=uvm,dc=edu createTimestamp: 20120803002051Z entryCSN: 20120803002051.460963Z#000000#000#000000 modifiersName: cn=theboss,dc=uvm,dc=edu modifyTimestamp: 20120803002051Z which is (as far as I know) not valid. I believe there has to be a dn value (and this morning, slapcat's performed are showing dn's in the output). I am using back-hdb to store this database. This is on the master server which has 10 replicas pulling changes off it using delta-syncrepl. A quick search of the ITS system shows ITS#6365 which hasn't been updated since February 2010 that seems to indicate the same (though in that one it was completely consistent) issue with an hdb database and slapcat. Any ideas? I have never seen this happen before, but I did just move to both OpenLDAP 2.4.31 and RHEL6 (was previously running OpenLDAP 2.4.28 plus fixes on RHEL5u8 64-bit). -- Frank Swasey | http://www.uvm.edu/~fcs Sr Systems Administrator | Always remember: You are UNIQUE, University of Vermont | just like everyone else. "I am not young enough to know everything." - Oscar Wilde (1854-1900)

2 1

Troubles with LDAP SYNC and doubt
by rodrigo tavares 03 Aug '12

03 Aug '12

Hello ! I sent a email to list saying about troubles in LDAP SYNC, this error was:ldap_sasl_bind_s failed (49) I found my error. I change for binddn="cn=admin,dc=defensoria,dc=mg,dc=gov,dc=br". So its is replicating. I have a doubt: the interval=01:00:00:00 This value is one hour ? Thanks ! Rodrigo Faria

3 2

What will happen if a user is a member of a group, but has another group as its primary group
by Qian Zhang 03 Aug '12

03 Aug '12

Hi, In my OpenLDAP server, it is possible to set a user as a member of a group, but it has another group as its primary group (I am using "LDAP Admin" as LDAP client tool). For example, in group1, I can see user1 as its "memberUid" attribute, but the "gidNumber" attribute of user1 is group2. I'd like to know if this is a reasonable configuration, and in this case, should I consider user1 as the member of group2 too? For example, if I configure a machine to only allow gruop2 to login, can user1 log into that machine? BTW, I do not know how to configure PAM to only allow a group or some groups to login the machine, if anyone can tell me the steps, it will be really appreciated! Thanks, Qian

4 7

Trying make a replication
by rodrigo tavares 03 Aug '12

03 Aug '12

Hello ! I have a troubles with replication slapd. Some logs #log of consumer Aug 2 16:21:37 serversamba slapd[1832]: slapd starting Aug 2 16:21:37 serversamba slapd[1832]: slap_client_connect: URI=ldap://10.26.7.46:389 DN="cn=syncrepl,dc=defensoria,dc=mg,dc=gov,dc=br" ldap_sasl_bind_s failed (49) Aug 2 16:21:37 serversamba slapd[1832]: do_syncrepl: rid=123 rc 49 retrying #logs of provider Aug 2 16:21:32 defensoria slapd[6345]: slapd starting Aug 2 16:21:38 defensoria slapd[6345]: conn=1000 fd=13 ACCEPT from IP=10.26.7.45:57491 (IP=0.0.0.0:389) Aug 2 16:21:38 defensoria slapd[6345]: conn=1000 op=0 BIND dn="cn=syncrepl,dc=defensoria,dc=mg,dc=gov,dc=br" method=128 Aug 2 16:21:38 defensoria slapd[6345]: conn=1000 op=0 RESULT tag=97 err=49 text= Aug 2 16:21:38 defensoria slapd[6345]: conn=1000 op=1 UNBIND Aug 2 16:21:38 defensoria slapd[6345]: conn=1000 fd=13 closed My provider: moduleload syncprov.la moduleload back_monitor.la moduleload back_bdb overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 My costumer: syncrepl rid=123 provider=ldap://10.26.7.46:389 type=refreshOnly interval=01:00:00:00 searchbase="dc=defensoria,dc=mg,dc=gov,dc=br" filter="(objectClass=organizationalPerson)" scope=sub attrs="cn,sn,ou,telephoneNumber,title,l" schemachecking=off bindmethod=simple binddn="cn=syncrepl,dc=defensoria,dc=mg,dc=gov,dc=br" credentials=galo When I make this under command, it´s run : ldapsearch -x -v -H 'ldap://10.26.7.46' -b 'dc=defensoria,dc=mg,dc=gov,dc=br' -D 'uid=syncrepl,ou=defensoria,dc=defensoria,dc=mg,dc=gov,dc=br' -W Any suggestion ? Thanks ! Rodrigo Faria Tavares

2 1

Re: What will happen if a user is a member of a group, but has another group as its primary group
by Dan White 03 Aug '12

03 Aug '12

(CCing the list) On 08/03/12 11:31 +0800, Qian Zhang wrote: >I am just wondering if there is a well-known rule for this use case, >I'd like to follow the general acceptable way. So most of people think >user1 should not log into the machine in this case, I will ingore >gidNumber and only care about memberUid attribute. Personally, I prefer to place authorization attributes within the user's dn, rather than to maintain groups for the same purpose, but I have done it both ways in the past. Using 'nssov-pam userhost [...]' would be a good way to do that. -- Dan White

1 0

import ldif does not work
by Karntol Dernsef 02 Aug '12

02 Aug '12

Hi list, I am fighting with openldap for some time now and I can't get it to work. I started clean. I've followed this tutorial, and everything works fine. I used followed the example and only changed dc=company,dc=com into dc=mycompany,dc=org. Then I want to import this file, because I am busy with a WebSphere book from Packtpub, and I need to follow along and setting up a LDAP server with these contents: -------------------------- dn: o=mycompany.org objectclass: top objectclass: organization o: mycompany.org dn: ou=users,o=mycompany.org objectclass:organizationalunit ou: users description: generic users branch dn: ou=groups,o=mycompany.org objectclass:organizationalunit ou: groups description: generic groups branch dn: ou=roles,o=mycompany.org objectclass:organizationalunit ou: roles description: generic roles branch dn: cn=wasadmin,ou=roles,o=mycompany.org cn: wasadmin uid: wasadmin objectclass: top objectclass: person objectclass: organizationalPerson objectclass: inetOrgPerson userpassword: wasadmin sn: wasadmin givenname: wasadmin title: wasadmin description: WAS Administrator dn: cn=ldapbind,ou=users,o=mycompany.org cn: ldapbind uid: ldapbind objectclass: top objectclass: person objectclass: organizationalPerson objectclass: inetOrgPerson userpassword: ldapbind sn: ldapbind givenname: ldapbind title: ldapbind description: ldapbind dn: cn=Bob Jackson,ou=users,o=mycompany.org cn: Bob Jackson uid: bjackson mail: bjackson(a)mycompany.org objectclass: top objectclass: person objectclass: organizationalPerson objectclass: inetOrgPerson userpassword: password sn: Jackson givenname: Bob telephonenumber: 123456789 title: WAS Administrator description: LDAP test user dn: cn=Mary Smith,ou=users,o=mycompany.org cn: Mary Smith uid: msmith mail: msmith(a)mycompany.org objectclass: top objectclass: person objectclass: organizationalPerson objectclass: inetOrgPerson userpassword: password sn: Smith givenname: Mary telephonenumber: 123456789 title: WAS Administrator description: LDAP test user dn: cn=wasadmins,ou=groups,o=mycompany.org objectclass: groupofnames cn: wasadmins description: WAS Admins # add the group members all of which are # assumed to exist under people member: cn=Bob Jackson,ou=users,o=mycompany.org member: cn=Mary Smith,ou=users,o=mycompany.org member: cn=wasadmin,ou=roles,o=mycompany.org But when I want to import, I get this: [root@CentOS-01 cn=config]# ldapadd -W -D cn=admin,dc=mycompany,dc=org -v -x -f /tmp/mycompanyorg.ldif ldap_initialize( <DEFAULT> ) Enter LDAP Password: add objectclass: top organization add o: mycompany.org adding new entry "o=mycompany.org" ldap_add: Server is unwilling to perform (53) additional info: no global superior knowledge When I do this: [root@CentOS-01 cn=config]# ldapsearch -xLLWD cn=admin,dc=mycompany,dc=org -b dc=mycompany,dc=org dn Enter LDAP Password: version: 1 No such object (32) Something tells me it's wrong. So, a friend who helped me said I had to create the company first, and that I should use dc=company,dc=org instead of o=company.org. I had to create the company first in the LDAP he said, so he passed me this file: # usergroups.ldif # # dn: dc=mycompany,dc=org dc: company objectClass: top objectClass: domain dn: ou=users,dc=mycompany,dc=org ou: Users objectClass: top objectClass: organizationalUnit description: Central location for UNIX users dn: ou=groups,dc=mycompany,dc=org ou: Groups objectClass: top objectClass: organizationalUnit description: Central location for UNIX groups # EOF But I can't add that: [root@CentOS-01 cn=config]# ldapadd -W -D cn=admin,dc=mycompany,dc=org -v -x -f /tmp/usergroup.ldif ldap_initialize( <DEFAULT> ) Enter LDAP Password: add dc: company add objectClass: top domain adding new entry "dc=mycompany,dc=org" ldap_add: Naming violation (64) additional info: value of single-valued naming attribute 'dc' conflicts with value present in entry I hope I will ever solve this, I can't complete my study now and have wasted hours and hours on this ldap problem. I hope you can help me out.. Karntol

2 2

AW: modify search base dn depending on search filter
by Robert Eikermann 02 Aug '12

02 Aug '12

Yes, I use rwm and the meta backend. But I'm not fixed to that ----- Ursprüngliche Nachricht ----- Von: Gavin Henry Gesendet: 01.08.2012 23:39 An: Robert Eikermann Cc: openldap-technical(a)openldap.org Betreff: Re: modify search base dn depending on search filter > Hi, > > can please someone give me a hint, how to change the search base dn > depending on the search filter. If someone searches “cn=a@b” at a fixed base > like dc=local I want to rewrite this search to cn=a with search base > “dc=b,dc=local” Hi Robert, Did you read man slapo-rwm ? Thanks. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 24 Cormack Park, Rothienorman, Inverurie, Aberdeenshire, AB51 8GL. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html Do you know we have our own VoIP provider called SureVoIP? See http://www.surevoip.co.uk Did you see our API news? http://www.surevoip.co.uk/news-events/surevoip-launches-innovative-api

1 0

modify search base dn depending on search filter
by Robert Eikermann 01 Aug '12

01 Aug '12

Hi, can please someone give me a hint, how to change the search base dn depending on the search filter. If someone searches "cn=a@b" at a fixed base like dc=local I want to rewrite this search to cn=a with search base "dc=b,dc=local" Thanks for help Robert

2 1

ACL to replicate a single value of an attribute
by Andrei BĂNARU 01 Aug '12

01 Aug '12

Hi, Is it possible to create an ACL entry that will allow only the first value of an attribute to be read ( an example would be nice ) ? For example having userPassword with a first value using MD5 hashing and a second value as plain text. We plan on replicating that object but we don't want to include the plain text value of the attribute userPassword. Using another attribute to store the user's password is out of the question. We need to add plain text passwords for some users in a country that use Active Directory ( AD password sync ). Thx! -- Andrei BĂNARU Internal Support CCNA Security, CCIP StreamWIDE Romania

2 1

Issue with dynlist overlay
by Patrick Hemmer 31 Jul '12

31 Jul '12

So I just ran across an undocumented issue with slapo-dynlist. I'm not sure if this is a bug, or just missing in the documentation. The issue is that if the entry being dynamically added to the parent entry has the objectClass slapo-dynlist is configured to use, that entry is not dynamically added to the parent. For example: ---- olcOverlay=dynlist,olcdatabase=hdb,cn=config objectClass: olcDynamicList objectClass: olcOverlayConfig olcDlAttrSet: groupOfURLs memberUrl ---- dn: cn=parent,dc=example,dc=com objectClass: groupOfNames objectClass: groupOfURLs member: uid=foo,dc=example,dc=com memberUrl: ldap:///cn=child,dc=example,dc=com dn: cn=child,dc=example,dc=com objectClass: groupOfNames objectClass: groupOfURLs member: uid=bar,dc=example,dc=com --- In the above example, I would "member: uid=bar,dc=example,dc=com" to be added to cn=parent,dc=example,dc=com, but it isn't. Now the documentation clearly states recursion is not allowed, so if cn=child were to have a 'memberUrl', this memberUrl would not be expanded. But this is not what is being done here, cn=child has no memberUrl present. It also behaves perfectly fine if I pull the "objetClass: groupOfURLs" off cn=child. So is this supposed to behave this way? If so can the documentation be updated to indicate this restriction? If not I'd be happy to open an ITS on the issue. -Patrick

2 5

Special characters in distinguished name
by chris_news＠arcor.de 31 Jul '12

31 Jul '12

Hello, are special characters, especially German umlauts, acceptable in the distinguished name? I've accidentally discovered that CPAN's Net::LDAP::Entry module doesn't support them (in the distinguished name). Other attributes are escaped correctly. Thank you in advance. Chris

5 5

Advice for distributing schemas for OpenLDAP
by ghudson＠mit.edu 30 Jul '12

30 Jul '12

MIT krb5 has an LDAP back end for its KDC, which uses its own schema. Currently, we distribute just a .schema file for OpenLDAP, which isn't very friendly to a DS using back-config and slapd.d. I have some questions about how we might do better. 1. For initial installs, I take it we should distribute a .ldif file which can be loaded with ldapadd. If we continue to use our .schema file as the master source file for the time being, then I assume we'll want to convert that to the .ldif file using slaptest. If we do that, should we remove the {n} prefix from the cn of the converted output, along with the metadata entries at the end, to match the style of the .ldif files in servers/slapd/schema? 2. If someone is upgrading to a version of krb5 which has new stuff added to the schema, how should we facilitate that upgrade? I don't think the .ldif file mentioned above would be of much use, since ldapadd will refuse to change an existing entry and ldapmodify wants to see change records. One option is to distribute an LDIF file with a bunch of idempotent modify operations to upgrade the schema. Looking at RFC 2849, I'm not sure you can idempotently create an LDAP entry with LDIF (so this input file couldn't be used for initial installs), but perhaps it's a viable option to bring the olc* attributes on an existing schema entry up to date. Has anyone done something like this before, and is there a good way to generate such an ldapmodify input file from either a .schema file or its attrval-record .ldif equivalent? Another option is to distribute delta LDIF files for each specific upgrade. That seems less friendly to OS packagers, who would then have to identify which upgrades to apply, but perhaps it's a better approach for reasons I don't know yet. If it is the best option, again, is there a good way to generate such delta LDIF files automatically? Thanks for any advice, and apologies if I missed anything in the documentation or mailing list archives.

3 2

Translucent Proxy to filter users
by Joel Eidsath 30 Jul '12

30 Jul '12

Hello, I'm trying to use our corporate openldap server for authentication to an application server (Github Enterprise) that does not support any "memberof" filters for allowed users. As a workaround, I am looking into a translucent proxy server that would only return a subset of users. Github Enterprise would only "see" a few hundred users instead of thousands. Is this doable? Is there a better solution? Joel Eidsath

4 4

What will happen if there are two user with same uid in OpenLDAP server
by Qian Zhang 30 Jul '12

30 Jul '12

Hi, I have an OpenLDAP server setup, I am just wondering what will happen when I do login if there are two user in different OU but with same uid. I guess PAM is in flat mode, so when I login with the uid, I can always login as one of the two users, and have no chance to login as the other, right? If that is true, should I add a restriction that the uid of each user must be unique in the whole OpenLDAP server? Thanks, Qian

5 11

Re: slapo-chain on syncrepl slave. I simply can't get it working. Help??
by Gavin Henry 29 Jul '12

29 Jul '12

>> Remove your dn{} line. > > Sorry, which dn line do you mean? > > This? > > authzTo: {0}dn:* Yeah. -- Kind Regards, Gavin Henry. Managing Director. T +44 (0) 1224 279484 M +44 (0) 7930 323266 F +44 (0) 1224 824887 E ghenry(a)suretecsystems.com Open Source. Open Solutions(tm). http://www.suretecsystems.com/ Suretec Systems is a limited company registered in Scotland. Registered number: SC258005. Registered office: 24 Cormack Park, Rothienorman, Inverurie, Aberdeenshire, AB51 8GL. Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html Do you know we have our own VoIP provider called SureVoIP? See http://www.surevoip.co.uk Did you see our API news? http://www.surevoip.co.uk/news-events/surevoip-launches-innovative-api

3 6

slapo-chain on syncrepl slave. I simply can't get it working. Help??
by elekktretterr＠exemail.com.au 29 Jul '12

29 Jul '12

Hi, I've spent 2 days on this now and can't figure it out. Master directory (2.4.21 on FBSD 7, compiled with SASL) Slave (2.4.31 on Debian Squeeze) The goal is to eventually use TLS as both the servers are remote from one to another, but for the sake of simplicity during testing i'm not using TLS at this stage. RefreshAndPersist replication is setup and working Master config(not complete, but related parts): authz-policy to database bdb suffix cn=accesslog directory /db/accesslog rootdn cn=accesslog index default eq index entryCSN,objectClass,reqEnd,reqResult,reqStart overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE # Let the replica DN have limitless searches limits dn.exact="cn=replicator,ou=daemons,dc=webgate,dc=net,dc=au" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited database bdb suffix "dc=webgate,dc=net,dc=au" rootdn "cn=Manager,dc=webgate,dc=net,dc=au" rootpw deleted password-hash {SSHA} directory /var/db/openldap-data mode 0600 cachesize 2000 # syncrepl Provider for primary db overlay syncprov syncprov-checkpoint 1000 60 # accesslog overlay definitions for primary db overlay accesslog logdb cn=accesslog logops writes logsuccess TRUE # scan the accesslog DB every day, and purge entries older than 7 days logpurge 07+00:00 01+00:00 # Let the replica DN have limitless searches limits dn.exact="cn=replicator,ou=daemons,dc=webgate,dc=net,dc=au" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited access to attrs=userPassword by self write by dn="cn=users,ou=daemons,dc=webgate,dc=net,dc=au" write by dn="cn=replicator,ou=daemons,dc=webgate,dc=net,dc=au" read by * auth access to dn.base="ou=zones,dc=webgate,dc=net,dc=au" by dn="cn=replicator,ou=daemons,dc=webgate,dc=net,dc=au" read by dn="cn=dns,ou=daemons,dc=webgate,dc=net,dc=au" read by dn="cn=users,ou=daemons,dc=webgate,dc=net,dc=au" write access to dn.children="ou=zones,dc=webgate,dc=net,dc=au" by dn="cn=replicator,ou=daemons,dc=webgate,dc=net,dc=au" read by dn="cn=dns,ou=daemons,dc=webgate,dc=net,dc=au" read by dn="cn=users,ou=daemons,dc=webgate,dc=net,dc=au" write access to dn.base="ou=emails,dc=webgate,dc=net,dc=au" by dn="cn=replicator,ou=daemons,dc=webgate,dc=net,dc=au" read by dn="cn=postfix,ou=daemons,dc=webgate,dc=net,dc=au" read by dn="cn=users,ou=daemons,dc=webgate,dc=net,dc=au" write access to dn.children="ou=emails,dc=webgate,dc=net,dc=au" by dn="cn=replicator,ou=daemons,dc=webgate,dc=net,dc=au" read by dn="cn=postfix,ou=daemons,dc=webgate,dc=net,dc=au" read by dn="cn=users,ou=daemons,dc=webgate,dc=net,dc=au" write access to dn.children="ou=users,dc=webgate,dc=net,dc=au" by dn="cn=replicator,ou=daemons,dc=webgate,dc=net,dc=au" read by dn="cn=users,ou=daemons,dc=webgate,dc=net,dc=au" write access to dn.base="ou=users,dc=webgate,dc=net,dc=au" by dn="cn=replicator,ou=daemons,dc=webgate,dc=net,dc=au" read by dn="cn=users,ou=daemons,dc=webgate,dc=net,dc=au" write access to dn.base="ou=groups,dc=webgate,dc=net,dc=au" by dn="cn=replicator,ou=daemons,dc=webgate,dc=net,dc=au" read by dn="cn=users,ou=daemons,dc=webgate,dc=net,dc=au" write access to dn.children="ou=groups,dc=webgate,dc=net,dc=au" by dn="cn=replicator,ou=daemons,dc=webgate,dc=net,dc=au" read by dn="cn=users,ou=daemons,dc=webgate,dc=net,dc=au" write access to dn.base="ou=virtualhosts,dc=webgate,dc=net,dc=au" by dn="cn=replicator,ou=daemons,dc=webgate,dc=net,dc=au" read by dn="cn=httpd,ou=daemons,dc=webgate,dc=net,dc=au" read by dn="cn=users,ou=daemons,dc=webgate,dc=net,dc=au" write access to dn.children="ou=virtualhosts,dc=webgate,dc=net,dc=au" by dn="cn=replicator,ou=daemons,dc=webgate,dc=net,dc=au" read by dn="cn=httpd,ou=daemons,dc=webgate,dc=net,dc=au" read by dn="cn=users,ou=daemons,dc=webgate,dc=net,dc=au" write access to * by dn="cn=replicator,ou=daemons,dc=webgate,dc=net,dc=au" read by users read by anonymous none by * none Slave config: overlay chain chain-uri ldap://xxx:389/ chain-rebind-as-user Yes chain-idassert-bind bindmethod="simple" binddn="cn=replicator,ou=daemons,dc=webgate,dc=net,dc=au" credentials="xxx" mode="self" chain-return-error Yes access to attrs=userPassword,shadowLastChange by anonymous auth by * none access to dn.base="" by * read access to * by * read # syncrepl directives syncrepl rid=0 provider=ldap://xxx:389 bindmethod=simple binddn="cn=replicator,ou=daemons,dc=webgate,dc=net,dc=au" credentials=deleted searchbase="dc=webgate,dc=net,dc=au" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" schemachecking=on type=refreshAndPersist retry="60 +" syncdata=accesslog # Refer updates to the master updateref ldap://xxx cn=replicator contains: dn: cn=replicator,ou=daemons,dc=webgate,dc=net,dc=au objectClass: top objectClass: inetOrgPerson cn: replicator sn: replicator userPassword:: xxx authzTo: {0}dn:* No matter what I change, when I run ldapmodify on slave ldapmodify -x -D "cn=replicator,ou=daemons,dc=webgate,dc=net,dc=au" -W -f test_update.ldif modifying entry "uid=xxx,ou=emails,dc=webgate,dc=net,dc=au" ldap_modify: Strong(er) authentication required (8) I run the server with -d 1 to see what's going on and it seems even if i change chain-idassert-bind binddn="cn=replicator,ou=daemons,dc=webgate,dc=net,dc=au" to anything that doesn't even exist in the directory it never gets used... The only thing that makes a difference from the chain-* directives is the chain-return-error Yes, setting it to "no" makes it return just the referral address What am I doing wrong??? Thanks Petr

2 3

RE24 testing call#3 (OpenLDAP 2.4.32)
by Quanah Gibson-Mount 27 Jul '12

27 Jul '12

If you know how to build OpenLDAP manually, and would like to participate in testing the next set of code for the 2.4.32 release, please do so. Generally, get the code for RE24: <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/ heads/OPENLDAP_REL_ENG_2_4;sf=tgz> Configure & build. Execute the test suite (via make test) after it is built. Thanks! --Quanaho -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

4 7

Re: RE24 testing call#3 (OpenLDAP 2.4.32)
by Neil Mcbennett 27 Jul '12

27 Jul '12

All good on Solaris 10 / SPARC On 27 July 2012 03:43, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > If you know how to build OpenLDAP manually, and would like to participate > in testing the next set of code for the 2.4.32 release, please do so. > > Generally, get the code for RE24: > > <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/ > heads/OPENLDAP_REL_ENG_2_4;sf=tgz> > > Configure & build. > > Execute the test suite (via make test) after it is built. > > Thanks! > > --Quanaho > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

Re: RE24 testing call#3 (OpenLDAP 2.4.32)
by devzero2000 27 Jul '12

27 Jul '12

On Fri, Jul 27, 2012 at 4:43 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > If you know how to build OpenLDAP manually, and would like to participate > in testing the next set of code for the 2.4.32 release, please do so. > > Generally, get the code for RE24: > > <http://www.openldap.org/**devel/gitweb.cgi?p=openldap.** > git;a=snapshot;h=refs/<http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/> > heads/OPENLDAP_REL_ENG_2_4;sf=**tgz> > > Configure & build. > > Execute the test suite (via make test) after it is built. > > All good on RHEL 6.2/6.3 e serentos 6.2. > Thanks! > > --Quanaho > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > >

1 0

Openldap Problem
by Chris 27 Jul '12

27 Jul '12

Hi. I am using rhel 6.3, with sssd-1.8.0 and openldap-servers-2.4.23-26, the kernel is 2.6.32-279.2.1.el6.x86_64. The problem I'm having is I get this error message in messages file. "sssd[be[default]]: Could not start TLS encryption. TLS error -5938:Encountered end of file" I started sssd with debugging set to 9. Errors I saw in sssd_default.log is: [dp_get_options] (0x0400): Option ldap_sasl_minssf has value -1 [get_port_status] (0x1000): Port status of port 389 for server 'ibm-01.flamengro.co.za' is 'not working' When I add new users I cannot log in with the new names, a ldapseach shows them but getent passwd nothing. Not all the users show up on my other machines either. Any help will be appreciated. My slapd.conf file looks like this. /include /etc/openldap/schema/corba.schema include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/duaconf.schema include /etc/openldap/schema/dyngroup.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/java.schema include /etc/openldap/schema/misc.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/ppolicy.schema include /etc/openldap/schema/collective.schema allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args database bdb suffix "dc=flamengro,dc=com" checkpoint 1024 15 rootdn "cn=Manager,dc=flamengro,dc=com" rootpw secret directory /var/lib/ldap/flamengro index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub database monitoraccess to * by dn.exact="cn=Manager,dc=flamengro,dc=com" read by * none access to attrs=userPassword,shadowLastChange by anonymous auth by self write by * none/ My sssd.conf file looks like this / [sssd] config_file_version = 2 reconnection_retries = 3 sbus_timeout = 30 services = nss, pam domains = default [nss] filter_groups = root filter_users = root reconnection_retries = 3 [pam] reconnection_retries = 3 [domain/default] auth_provider = ldap cache_credentials = True ldap_id_use_start_tls = True debug_level = 9 ldap_search_base = dc=flamengro,dc=com # krb5_realm = EXAMPLE.COM chpass_provider = ldap id_provider = ldap ldap_uri = ldap://ibm-01.flamengro.co.za # krb5_kdcip = kerberos.example.com ldap_tls_cacertdir = /etc/openldap/cacerts enumerate = True ldap_sasl_canonicalize = true # krb5_server = kerberos.example.com /

4 3

Re: Openldap Problem
by devzero2000 26 Jul '12

26 Jul '12

Very often i see answer like this on rhel, in particular. So why don't tell or, better, write in some faq : the openldap version shipped and packaged with rhel is seriously borken, please don't use it. Should not be better ? regards (footnote) i am not a redhat folk 2012/7/26, Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Thursday, July 26, 2012 12:55 PM +0200 Chris <chris(a)flamengro.co.za> > wrote: > >> Hi. >> >> I am using rhel 6.3, with sssd-1.8.0 and openldap-servers-2.4.23-26, the >> kernel is 2.6.32-279.2.1.el6.x86_64. >> The problem I'm having is I get this error message in messages file. > > Upgrade to a newer version of OpenLDAP that has fixes for sssd. Upgrade to > > a version of OpenLDAP that doesn't use MozNSS for its SSL/TLS bits, and > instead uses the saner and reliable OpenSSL. > > --Quanah > > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > > -- Inviato dal mio dispositivo mobile

3 2

Does OpenLDAP 2.4 support nested group
by Qian Zhang 26 Jul '12

26 Jul '12

Hi, I'd like to know in OpenLDAP 2.4, if I create a group (objectClass is posixGroup), is it possible that I create another group as the member of this group? Or I have to do this with group which has groupOfNames as its objectClass? Thanks, Qian

3 2

Re: The Last Sysadmin Prayer: Discussion Returns to Wrap and Base64 World
by Peter Gietz 24 Jul '12

24 Jul '12

Hi Angel, you might want to post feature requests (after double checking that the feature does not already exists) to the ITS (http://www.openldap.org/its/). This list is, as Howard made quite clear, not the right place. Technical discussions can be made on openldap-technical. Although it is far better to use proper LDAP libraries of a proper scripting language, I second your request for a don't base64 feature for all those admins who only use bash and pray instead of learning python or perl ;-) But we should first discuss (on openldap-technical) how exactly such a feature should work (there are binary values that you don't want to have not base64ed). And: it is even nicer to post a proper patch than a feature request to ITS Cheers, Peter Am 23.07.2012 00:36, schrieb Angel Bosch: >> De: "Howard Chu" <hyc(a)symas.com> >> This is the Developer's list. Your post is off topic and you should be >> ashamed >> of yourself for posting it here. >> > sorry for the noise, I knew this is the developer's list but after seeing all lists: > > openldap-announce OpenLDAP announcements list > openldap-bugs OpenLDAP bugs discussion list > openldap-commit OpenLDAP source repository 'commit' list > openldap-devel OpenLDAP development discussion list > openldap-fortress OpenLDAP Fortress Discussion list > openldap-technical OpenLDAP Technical Discussion list > > > I thought this belongs here because the nature of the discussion. If you want me to move this thread to another list, please let me know. > > > >> An option for LDIF wrapping was released in 2.4.24, 2011-02-10. You >> should be >> ashamed of yourself for asking for something that has already been >> available >> for over a year and a half. >> > I was using lastest Centos 6.3 packages and I assumed that there was no wrapping option, sorry about that. I see now that Centos is packaging 2.4.23. That was close. I'm really happy to see that it was finally included upstream and I can't wait to see it on packages. > > > I think rest of the complain is still valid, though. Decoding values i still an issue, and the suggestion of Michael that best way is learning other languages instead of using ldapsearch reaffirms my pov. How broken can be a simple search such as > > FULLNAME=`ldapsearch -x -LLL "(uid=$1)" gecos | grep "^gecos: " | cut -d" " -f2- ` > > ? > > > I really thought that we could start a healthy discussion about what and when a widely requested feature should be included. And judging from amount of posts/discussions I've found digging last weeks I'm pretty sure that isn't the opinion of a single undocumented obtuse sysadmin. > > Instead of being double-ashamed because of my ignorance, I'm really proud of being part of the free software community and being able to address to people I admire and respect profundly. Even when I'm wrong and even more when I hardly find the right words to explain my boss that this "creppy guy with a violin" is the main developer of this huge project. > > > àngel > > > ps: english is not my native language, excuse my strange composition > > -- _______________________________________________________________________ Peter Gietz (CEO) DAASI International GmbH phone: +49 7071 407109-0 Europaplatz 3 Fax: +49 7071 407109-9 D-72072 Tübingen mail: peter.gietz(a)daasi.de Germany Web: www.daasi.de DAASI International GmbH, Tübingen Geschäftsführer Peter Gietz, Amtsgericht Stuttgart HRB 382175 Directory Applications for Advanced Security and Information Management _______________________________________________________________________

1 0

syncrepl and deleted entries
by Roman Serbski 22 Jul '12

22 Jul '12

Hello list, I'm having problems with deleted entries in a provider/consumer setup. Any hints would be greatly appreciated! ===PROVIDER=== Ubuntu 10.04.2 (lucid) OpenLDAP 2.4.21-0ubuntu5.3 (installed from packages) slapd.conf: moduleload syncprov overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 ===CONSUMER=== Ubuntu 12.04 (precise) OpenLDAP 2.4.28-1.1ubuntu4 (installed from packages) slapd.conf: syncrepl rid=001 provider=ldaps://provider.domain.org:636 tls_reqcert=never searchbase="dc=domain,dc=org" filter="(objectClass=*)" bindmethod=simple binddn="cn=admin,dc=domain,dc=org" credentials=xxxxxx retry="60 +" type=refreshAndPersist scope=sub attrs="*,+" schemachecking=off interval=00:00:05:00 Everything works fine and added/modified entries from the provider are immediately replicated to the consumer, but it doesn't work with deleted entries - if I delete an entry from the provider it gets never deleted from the consumer. Debug log files could be found here: http://pastebin.com/AmXRAXHp The first part is successful entry modification, and the last one is unsuccessful deletion. The only anomaly that I can spot is at the line 131: "<= bdb_index_read: failed (-30987)", but then I don't understand how adding/modifying works... Many thanks! Roman

2 1

slapd mmr failure due to tls cert name mismatch
by Patrick Hemmer 20 Jul '12

20 Jul '12

I have 2 servers (version 2.4.31) in multi-master-replication behind a single IP. Whenever replication tries to start, it fails because the cert name does not match the hostname. ---- TLS: hostname (per5-unity-ldap02.mbox.net) does not match common name in certificate (unity-ldap.mbox.net). 5009c52e slap_client_connect: URI=ldap://per5-unity-ldap02.mbox.net Error, ldap_start_tls failed (-11) 5009c52e do_syncrepl: rid=523 rc -11 retrying (5 retries left) ---- However in the slapd configuration, I have the olcSyncrepl tls_reqcert parameter set to 'never' ---- olcSyncrepl: {0}rid=523 provider="ldap://per5-unity-ldap02.mbox.net" network-timeout=2 retry="1 10 10 60 60 +" keepalive="60:3:60" starttls=critical tls_reqcert=never bindmethod=simple timeout=2 binddn="uid=foo,cn=bar" credentials="baz" type=refreshAndPersist searchbase="dc=my,dc=domain" ---- Why is this happening? I even ran across ITS#7014 which is about this exact issue, and with tls_reqcert=allow and tls_reqcert=never, it's not supposed to happen. Thanks -Patrick

2 1

replication verification
by Boyd Duffee 20 Jul '12

20 Jul '12

Hi all, I've been dropped in a the LDAP deep end due to a retirement in the office. The documentation I have regarding dealing with the failure of a master tells me how to fail over by promoting one of the replicas and then, when the problem with the master has been sorted, to re-configure it as a replica. My problem is with his following line When it is fully synchronised with the temporary master it can then be re-instated as the master. How do I know when it has fully synchronised? I'm running openldap v2.4.16, but I don't seem to have syncrepl in my path. Where should I be starting? thanks, -- Boyd Duffee Keele University (01782) 734225 Student Facing Systems It kind of makes me sad that all the dystopian capabilities are being created, but are mainly being used for advertising instead of the hot-evil-cool dystopia we were promised - phantomfive

3 3

Re[10]: Searching few domains for one uid
by kefast＠o2.pl 20 Jul '12

20 Jul '12

> --On Saturday, July 14, 2012 12:42 PM +0200 kefast(a)o2.pl wrote: >> Ok, thanx, I do understand that, but my point is, where I can put >> those "" in configuration files ? On a client side set BASE "" and in >> slapd.conf >> >> database bdb >> suffix "" >> rootdn "cn=admin" >> >> ? >> >> How persisly set config files (client, server) to search for all of >> those domains You listed. > Use an empty base. > --Quanah > -- > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration I can not import an ldif with an empty base on an server side. slapadd -v -b 'dc=""' -l ./root.ldif slapadd: slap_init invalid suffix ("dc=""") slapadd -v -b 'dc=' -l ./root.ldif slapadd: slap_init invalid suffix ("dc=") slapadd -v -b "dc=" -l ./root.ldif slapadd: slap_init invalid suffix ("dc=") slappadd -v -b "dc=" -l ./root.ldif slapadd: slap_init invalid suffix ("dc=") slapadd -v -b "dc=''" -l ./root.ldif slapadd: slap_init no backend for "dc=''" -- Pozdrowienia, kefast(a)o2.pl

2 1

slapo-chain + TLS = help
by Warren Howard 19 Jul '12

19 Jul '12

Hi, I'm not able to get slapo-chain + TLS to work. Slapo-chain without TLS works, syncrepl + TLS works, the ldapclients with TLS works, just slapo-chain + TLS does not work. "man slapo-chain" contains no information about the tls options for slapo-chain, but with I enable "chain-tls start" (as described in the OpenLDAP Admin Guide) I get the error : TLS negotiation failure. What TLS options for slapo-chain are available for me to configure to get this working? Note : I'm using Ubuntu 12.04 with slapd 2.4.28 provided by the distribution. Regards, Warren.

5 7

database ldap and acl-bind
by Nerijus Kislauskas 19 Jul '12

19 Jul '12

Hi everyone, As I understand from documentation, acl-bind is a technique to fetch acls from backend ldap to ldap proxy and apply them in there. Is this correct? I can't find any working example with shown logs to prove my idea nor i can get my configs to work. Maybe there is something i don't know? My configs: /etc/ldap/slapd.d/cn=config/olcDatabase={2}ldap.ldif: dn: olcDatabase={2}ldap objectClass: olcDatabaseConfig objectClass: olcLDAPConfig olcDatabase: {2}ldap structuralObjectClass: olcLDAPConfig entryUUID: da219748-6515-1031-9486-41b4d47f5b36 olcSuffix: dc=ktu,dc=lt olcDbURI: ldap://83.171.20.45 olcDbIdleTimeout: 60 olcDbACLBind: bindmethod=simple binddn="cn=test,dc=ktu,dc=lt" credentials="test" Logs: Jul 19 12:17:36 bijote slapd[1435]: => acl_mask: access to entry "dc=ktu,dc=lt", attr "entry" requested Jul 19 12:17:36 bijote slapd[1435]: => acl_mask: to all values by "cn=admin,dc=ktu,dc=lt", (=0) Jul 19 12:17:36 bijote slapd[1435]: <= check a_dn_pat: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth Jul 19 12:17:36 bijote slapd[1435]: <= check a_dn_pat: * Jul 19 12:17:36 bijote slapd[1435]: <= acl_mask: [2] applying +0 (break) Jul 19 12:17:36 bijote slapd[1435]: <= acl_mask: [2] mask: =0 Jul 19 12:17:36 bijote slapd[1435]: => dn: [2] Jul 19 12:17:36 bijote slapd[1435]: => dn: [3] cn=subschema Jul 19 12:17:36 bijote slapd[1435]: <= acl_get: done. Jul 19 12:17:36 bijote slapd[1435]: => slap_access_allowed: no more rules Clearly visible, that there is no ACL configs in database definition, and ACL's comes from frontend database (defaults): /etc/ldap/slapd.d/cn=config/olcDatabase\={2}ldap.ldif: ... olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth manage by * break olcAccess: {1}to dn.exact="" by * read olcAccess: {2}to dn.base="cn=Subschema" by * read .... As I understand, there should be ACL in ldap proxy (custom or defaults, tied to backends ACL's or not). Please help me to clear things out. -- Sincerely, Nerijus Kislauskas KTU ITPI, Litnet valdymo centras

1 0

openldap groups and roles
by Jignesh Patel 18 Jul '12

18 Jul '12

We are using OpenLDAP at present. But we are anticipating a huge growth in number of users. We are intented to support 300,000 users. Is that possible with openLDAP?Has any body tried it? Also can i define various roles inside openldap?Can I also define groups inside openldap? Jignesh Patel Chief Architect iCare.com LLC  Las Olas City Centre, Suite 2250 401 East Las Olas Boulevard Fort Lauderdale, Florida 33301 O: 954-616-5604 F: 954-616-5609 jignesh(a)icare.com CONFIDENTIALITY NOTE: The information contained in this transmission is privileged and confidential information intended only for the use of the individual or entity named above. If you are not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, please immediately reply to the sender that you have received this communication in error and then delete it. Thank you. On Jul 18, 2012, at 2:57 PM, openldap-technical-request(a)OpenLDAP.org wrote: > openldap-technical(a)openldap.org

2 3

replicating accesslog
by Marvin Mundry 18 Jul '12

18 Jul '12

Hello everybody, I am trying to replicate an accesslog database (cn=accesslog) from a provider to 2 consumers. The replication works fine except that old accesslog entries that get removed via "logpurge 07+00:00 01+00:00" on the provider do not get removed from the replicas. over time the accesslog databases on the consumers get rather huge. a workaround seems to be running a script from time to time that identifies and removes old accesslog entries via ldap. deletions in cn=accesslog made via ldap get replicated correctly. is there a way to have the deletions by logpurge replicated as well? bests, Marvin

2 1

ACL syntax for delegating a subdomain to a group
by Brian Riffle 18 Jul '12

18 Jul '12

I am struggling to find documentation on how to use the cn=config syntax for delegating a subdomain to a group of users. In my situation, I have an OU setup for customer accounts. (ou=subdomain,ou=People,dc=example,dc=com). I can currently edit that if I log in as a user that is our admin OU, ou=admins,dc=example,dc=com. However, I don't want to give our front facing support that much access. basically, I want the following: - any user can update their info. - anyone in ou=admin can update anything - anybody in group cn=cust_support,ou=group,dc=example,dc=com can do anything to anyone in the ou=subdomain,ou=People OU. (create/edit/update/delete) However, I am struggling to get the syntax right. I have tried many permutations, and the most recent example was to use these rules for setting olcAccess in the o=config database: {0}to attrs=userPassword by self write by anonymous auth by dn.children="ou=admins,dc=example,dc=com" write by group.exact="cn=cust_support,ou=group,dc=example,dc=com" write by * none {1}to dn.subtree="ou=subdomain,ou=People,dc=example,dc=com" by self write by dn.children="ou=admins,dc=example,dc=com" write by group.exact="cn=cust_support,ou=group,dc=example,dc=com" write by * read {2}to * by self write by dn.children="ou=admins,dc=example,dc=com" write by * read I have tried making cn=cust_support,ou=group,dc=example,dc=com both a posixGroup, and a groupOfNames. Both of them, when I go to save a new users, I get "insufficient access" If anyone could guide me in the correct direction, it would be greatly appreciated.. thanks! Brian

2 1

syncrepl with mirrormode compatible with OpenLDAP version 2.3.43?
by Houston Ray 18 Jul '12

18 Jul '12

I have setup my slapd.conf file with the directives for syncrepl with mirrormode on. This seems to cause issues with any write operations that occur after setup. (syncrepl does work with the provider/consumer setup but so far not with mirrormode) I am now guessing that mirrormode is in fact NOT available in version prior to 2.4 I have searched for an answer, but have yet to find any clear statement saying that it is not supported. thanks in advance to anyone who can confirm or deny that syncrepl with * mirrormode* is or is not supported in version 2.3.43 -h

2 1

Glueing together backend databases - meta, glue or chain?
by Pieter Baele 18 Jul '12

18 Jul '12

Hi, I have several backend databases on my master servers, and need to present a combined view to clients on slaves (Unix authentication) I think this a common question/issue... Scenario: 5 backend DB's, 2 of these are needed on each slave server Each of these has an ou=Groups,ou=Nodes, ou=People etc. --- dc=common,dc=example,dc=org --- dc=shared,dc=example,dc=org --- dc=companyA,dc=example,dc=org --- dc=companyB,dc=example,dc=org --- dc=companyC,dc=example,dc=org So one of the slaves uses companyA, common and shared another one uses companyB, commmon and shared and the last one companyC, common and shared all slaves represent this as "dc=example,dc=org" The easiest way seems using meta backend, but I've the feeling this has drawbacks??? You can't use cn=config, performance? Maybe there is an approach with chain or glue? I can change my DIT if necessary. Sincerely, Pieter

3 5

Re: Glueing together backend databases - meta, glue or chain?
by Francois Gnu 18 Jul '12

18 Jul '12

Hello Aaron, You say that: > One method also worth putting on the table is hosting the single backend > "dc=example,dc=org" on your master and selectively replicating appropriate > portions of the DIT using appropriate filters. (Howard recently posted to > the list on the best practices to execute this.) Can you put the link of the Howard's post, please? Thank you very much. Librement, ------ Francois Trachez (kiko) Team Fedora|Lyon (France) http://stg.fedoraproject.org/fr/ http://stg.fedoraproject.org/es/

2 1

Private E-Mail Address
by chris_news＠arcor.de 18 Jul '12

18 Jul '12

Hi, whereis the best place to store the private e-mail address of an inetOrgPerson? Is the order of the attribute's values fixed? So I could save the business address as first value and the private as second? May the first value be empty? Would an auxiliary class be better? Which one? Thank you in advance. - Chris

2 1

syncrepl and attribute order
by Evgeniy Kosov 18 Jul '12

18 Jul '12

Hi there, First of all, I'm new to this list, so, please, forgive me if this is a wrong place for the questions below, and feel free to redirect me wherever is more appropriate. The issue I'm facing as stated above is regarding the syncrepl and attribute order. I'm writing a Perl module to be used with back_perl and noticed behaviour that seems strange. Making some modifications on the master server (provider) and looking on the relevant modifications on the slave I saw that they didn't quite match. There were some extra REPLACE operations made by syncrepl. Later investigation showed that the cause of those REPLACE's was different attribute order on the master and slave nodes. synrepl.c says that: /* We assume that attributes are saved in the same order * in the remote and local databases. So if we walk through * the attributeDescriptions one by one they should match in * lock step. If not, look for an add or delete. */ Which seems strange to me. As a result syncrepl makes a REPLACE for every attribute whuch is "misplaced" in the local object. This is probably not an issue if master and slave both use the same back-end module. Which is not true in my case. So, the questions are: Is that replacing of "misplaced" attributes by syncrepl is expected behaviour or just a side effect of its syncrepl_diff_entry diff'ing algorithm? Does attribute order matter? Is it specified somehow (sorted by modification time?)? Should this issue be reported as bug? Thank you. -- Regards, Evgeniy Kosov

3 8

More efficient way to represent local+remote views?
by Kartik Subbarao 17 Jul '12

17 Jul '12

I'm currently using the following configuration for an application-specific LDAP directory to present a unified view of its local data (ou=localapp) and remote data (ou=people), all under dc=example,dc=com: database hdb suffix ou=localapp,dc=example,dc=com # ... database meta suffix dc=example,dc=com uri ldapi:///ou=localapp,dc=example,dc=com uri ldap://remoteldap.example.com/ou=people,dc=example,dc=com The idea being that clients of this directory can simply set the base DN to dc=example,dc=com without needing to know which parts are local and which parts are pulled in remotely. My understanding is that this approach incurs some overhead in going through the ldapi interface for each operation that ends up being performed on the local backend. Is it possible to eliminate that overhead through an alternate approach? I looked at back_relay, but couldn't get it to do what I wanted. I don't want to rewrite any of the suffixes -- I just want it to do exactly as above in the back-meta configuration, but replace "ldapi:///" with "internal-backend-api:///", as mentioned in this part of the back-relay docs: "back-relay bypasses the real database frontend operations by short-circuiting operations through the internal backend API". Thanks, -Kartik

2 2

ppolicy and replication issues
by Guillaume Rousse 16 Jul '12

16 Jul '12

Hello list. I'm planning to deploy ppolicy on our directory, but I'm facing a problem with replication, as I only control the master server, and not the slaves configuration for the moment. Despite being only active on the master server, a local experiment told me than the slaves need the following items: - the ppolicy schema, for replicating policies objects - the ppolicy overlay, for replicating operational attributes of user objects The first requisite is quite easy to achieve, as it is just a file I need other admins to add in their configuration. The second is a bit more difficult, as it is an additional binary, and given the lack of consistency between servers, I'm not sure it is available for each installation... So, is there some way of either configuring ppolicy or the replication, to avoid the need for the ppolicy overlay on the slaves, while I don't have full control over all the servers ? -- A system software crash will cause hardware to act strangely and the programmers will blame the customer engineer. -- Murphy's Laws of Computer Programming n°6

2 3

Tutorial to start ldap replication ?
by Frank Bonnet 16 Jul '12

16 Jul '12

Hello All is in the subject ! I need to start a replication server. Actually I run only one server and would like to start another one just in case the main stop/crash. Both machines runs FreeBSD , slapd is installed from FreeBSD ports on both machines, OpenLDAPversion is the same. Thanks for any pointers/links.

3 2

substitute a schema
by paulo bruck 15 Jul '12

15 Jul '12

Hi Guys I develop a simple schema and now I would like to suibstitute the actual schema for another one with same attributes and objectclass + another attibutes and obcejtclass . See its a superseed of ther previus one... I have already try using : ldapdelete -Y EXTERNAL -H ldapi:/// cn={6}squid,cn=schema,cn=config but received a: ldap_delete: Server is unwilling to perform (53) Doing it by hand it worked ( stoping ldap, substituted cn=squid with new one and restarting ldap), but I know that is not correct... How can I do it using ldapdelete ? best regards

4 3

Re[8]: Searching few domains for one uid
by kefast＠o2.pl 14 Jul '12

14 Jul '12

> --On Friday, July 13, 2012 10:12 AM +0200 kefast(a)o2.pl wrote: >> >>> --On Thursday, July 12, 2012 11:16 AM +0200 kefast(a)o2.pl wrote: >> >> >>>> >>>> I've got 3 databases on a server >>>> dc=a,dc=com >>>> dc=b,dc=com,dc=de >>>> dc=c,dc=com,dc=fr >>>> >>>> When on a client side a pointed BASE "" >>>> the server says: >>>> slapd[13330]: do_search: invalid dn ("") >>>> >>>> Should I reconfigure my database maybe and set dn to "" ? >>>> If yes how should the root dn look like ? >>>> dn: "" >>>> dc: "" >>>> objectClass: top >>>> objectClass: domain >>>> structuralObjectClass: domain >> >>> The easiest thing to do is to create a single database, with a root of >>> "". You don't need to create an entry for "" itself, as it is inherent >>> to the openldap directory server. >> >>> First entry would (in your case) likely be for dn: dc=com >> >>> dn: dc=com >>> objectClass: organization >>> objectClass: dcObject >>> o: com domain >>> dc: com >> >> >>> --Quanah >> >> >>> -- >> >>> Quanah Gibson-Mount >>> Sr. Member of Technical Staff >>> Zimbra, Inc >>> A Division of VMware, Inc. >>> -------------------- >>> Zimbra :: the leader in open source messaging and collaboration >> >> >> But in my case not all of my domains finishs on .com in the end. >> So beside a.com I've got b.com.de and b.com.fr, so in that case I'm >> not sure the root "com" would do, so maybe making root as .corp and then >> a.com.corp, b.com.de.corp, c.com.fr.corp. >> And one more think, is that statement which combines all parts of a >> domain in one dc would be ok ? >> dn="ou=People,dc=b.com.de,dc=corp" >> Would't it spoil something ? > You are missing the point of using "". ;) The point of using "" is that > you can store any and all domains in the same database. > In your case, if you have .de and .fr, then create entries for them too: > dn: dc=com > objectClass: organization > objectClass: dcObject > o: com domain > dc: com > dn: dc=de > objectClass: organization > objectClass: dcObject > o: de domain > dc: de > dn: dc=com, dc=de > objectClass: organization > objectClass: dcObject > o: com.de domain > dc: com > dn: dc=fr > objectClass: organization > objectClass: dcObject > o: fr domain > dc: fr > dn: dc=com, dc=fr > objectClass: organization > objectClass: dcObject > o: com.fr domain > dc: com > etc. > You could even create: > dn: cn=IamWildAndCrazy > objectClass: organizationalRole > description: Insane entry > cn: IamWildAndCrazy > --Quanah > -- > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration Ok, thanx, I do understand that, but my point is, where I can put those "" in configuration files ? On a client side set BASE "" and in slapd.conf database bdb suffix "" rootdn "cn=admin" ? How persisly set config files (client, server) to search for all of those domains You listed. -- Pozdrowienia, kefast(a)o2.pl

2 1

olcSubordinate versus Chaining
by Warren Howard 13 Jul '12

13 Jul '12

Dear all, I'm setting up a replicated directory service, so far I have a single provider and a single consumer with Syncrepl in refreshOnly mode. The consumer is a complete shadow copy of the provider, ldap clients can read from the consumer but not write to the consumer because it is a shadow copy. Next I would like "refer" ldap clients that wish to write to the consumer to the provider. Based on the notes here : http://www.openldap.org/doc/admin24/referrals.html, I would like to how to do this by using the olcSubordinate keyword. I've read the olcSubordinate section in slapd-config man page and I don't see a way forward and I'm not even sure that using olcSubordinate is the correct approach, since the steps described in http://www.openldap.org/doc/admin24/overlays.html#Chaining appear more relevant to set up I'm attempting. Any guidance much appreciated. Regards, Warren.

3 3

modifying network timeout behavior of ldap clients
by Ryan Palamara 13 Jul '12

13 Jul '12

I am running several CentOS servers that have 2 ldap servers defined. I would like to modify the ldap network timeout, so that if the first ldap server listed goes down entirely, that it will go to the next server quickly. I know that the setting will be LDAP_OPT_NETWORK_TIMEOUT, but I am not sure when this change is made. Can this be done in the ldap.conf file, or is it done elsewhere? Thank you, Ryan Palamara ZAIS Group, LLC 2 Bridge Avenue, Suite 322 Red Bank, New Jersey 07701 Phone: (732) 450-7444 Ryan.palamara(a)zaisgroup.com<mailto:Ryan.palamara@zaisgroup.com> ________________________________ This e-mail message is intended only for the named recipient(s) above. It may contain confidential information. If you are not the intended recipient you are hereby notified that any dissemination, distribution or copying of this e-mail and any attachment(s) is strictly prohibited. If you have received this e-mail in error, please immediately notify the sender by replying to this e-mail and delete the message and any attachment(s) from your system. Thank you. This is not an offer (or solicitation of an offer) to buy/sell the securities/instruments mentioned or an official confirmation. This is not research and is not from ZAIS Group but it may refer to a research analyst/research report. Unless indicated, these views are the author's and may differ from those of ZAIS Group research or others in the Firm. We do not represent this is accurate or complete and we may not update this. Past performance is not indicative of future returns. IRS CIRCULAR 230 NOTICE:. To comply with requirements imposed by the IRS, we inform you that any U.S. federal tax advice contained herein (including any attachments), unless specifically stated otherwise, is not intended or written to be used, and cannot be used, for the purpose of (i) avoiding penalties under the Internal Revenue Code or (ii) promoting, marketing or recommending any transaction or matter addressed herein to another party. Each taxpayer should seek advice based on the taxpayer's particular circumstances from an independent tax advisor. "ZAIS", "ZAIS Group" and "ZAIS Solutions" are trademarks of ZAIS Group, LLC.

2 2

Re[6]: Searching few domains for one uid
by kefast＠o2.pl 13 Jul '12

13 Jul '12

> --On Thursday, July 12, 2012 11:16 AM +0200 kefast(a)o2.pl wrote: >> >> I've got 3 databases on a server >> dc=a,dc=com >> dc=b,dc=com,dc=de >> dc=c,dc=com,dc=fr >> >> When on a client side a pointed BASE "" >> the server says: >> slapd[13330]: do_search: invalid dn ("") >> >> Should I reconfigure my database maybe and set dn to "" ? >> If yes how should the root dn look like ? >> dn: "" >> dc: "" >> objectClass: top >> objectClass: domain >> structuralObjectClass: domain > The easiest thing to do is to create a single database, with a root of "". > You don't need to create an entry for "" itself, as it is inherent to the > openldap directory server. > First entry would (in your case) likely be for dn: dc=com > dn: dc=com > objectClass: organization > objectClass: dcObject > o: com domain > dc: com > --Quanah > -- > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration But in my case not all of my domains finishs on .com in the end. So beside a.com I've got b.com.de and b.com.fr, so in that case I'm not sure the root "com" would do, so maybe making root as .corp and then a.com.corp, b.com.de.corp, c.com.fr.corp. And one more think, is that statement which combines all parts of a domain in one dc would be ok ? dn="ou=People,dc=b.com.de,dc=corp" Would't it spoil something ? -- Pozdrowienia, kefast(a)o2.pl

2 1

Re[4]: Searching few domains for one uid
by kefast＠o2.pl 12 Jul '12

12 Jul '12

Witaj Quanah, W Twoim liście datowanym 12 lipca 2012 (10:58:52) można przeczytać: > --On Thursday, July 12, 2012 10:55 AM +0200 kefast(a)o2.pl wrote: >> >> Thanx for Your response, and I'm sorry, cause I didn't catch that. >> Do You mean I should set var in ldap.conf on a client to >> BASE "dc=a,dc=com dc=b,dc=com,dc=de dc=c,dc=com,dc=fr" ? > Please keep your reply on the list. > You should use a base of "", which is the root base. On your LDAP server > too. Then everything is stored under "", and any search of "" for uid will > return all entries below it. > If this was a file system, "" would be equivalent to / > --Quanah > -- > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration I've got 3 databases on a server dc=a,dc=com dc=b,dc=com,dc=de dc=c,dc=com,dc=fr When on a client side a pointed BASE "" the server says: slapd[13330]: do_search: invalid dn ("") Should I reconfigure my database maybe and set dn to "" ? If yes how should the root dn look like ? dn: "" dc: "" objectClass: top objectClass: domain structuralObjectClass: domain -- Pozdrowienia, kefast(a)o2.pl

2 1

Binlogs Growing umlimited
by Thomas Spycher 12 Jul '12

12 Jul '12

Hi We are maintaining a huge LDAP Directory with x thousands records. This OpenLDAP instance is only for load and performance tests of our software. I've recently noticed that the bin logs of the bdb backend are growing nearly unlimited. (The LDAP Server gets replicated to an other one in an active/passive cluster). To gain the "wasted" space back, we're writing the bin logs back to to the main database every 24 hours. Now we are faced with an ldap server which can only read from its database. After an restart of the server everything works as expected but the same happens again irregularly... My Questions are: 1. what could happen with the server, which makes it only being able to read of its own db? 2. why are the bin logs are growing so dramatically? Thanks for any help Tom

2 1

Re: Re[2]: Searching few domains for one uid
by Quanah Gibson-Mount 12 Jul '12

12 Jul '12

--On Thursday, July 12, 2012 10:55 AM +0200 kefast(a)o2.pl wrote: > > Thanx for Your response, and I'm sorry, cause I didn't catch that. > Do You mean I should set var in ldap.conf on a client to > BASE "dc=a,dc=com dc=b,dc=com,dc=de dc=c,dc=com,dc=fr" ? Please keep your reply on the list. You should use a base of "", which is the root base. On your LDAP server too. Then everything is stored under "", and any search of "" for uid will return all entries below it. If this was a file system, "" would be equivalent to / --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Searching few domains for one uid
by kefast＠o2.pl 12 Jul '12

12 Jul '12

Hello, I've got 3 domains (departments), for egzample: a.com b.com.de c.com.fr and each of them has it's own posixAccount users (moved from nis). I want every user in each department to be albe to login with his credencials, localized under people.$(domainname) to machines under all domains, but as far as I know, You cant search for uid or anyting else in more then one domain, cause a BASE attrib in ldap.conf accept only one search base. Is the only way to do this is change the schema to: a.com.corp b.com.de.corp c.com.fr.corp and set the search base to dc=corp ? I've also read about setting base to config and put it there. -- Pozdrowienia, kefast(a)o2.pl

2 1

RE: Setting up multiple proxies on openldap 2.4.23
by Bhargav Mistry 10 Jul '12

10 Jul '12

Gentle bump ! From: Bhargav Mistry Sent: Friday, July 06, 2012 6:43 PM To: openldap-technical(a)openldap.org Subject: Setting up multiple proxies on openldap 2.4.23 Hi, I am trying to configure multiple proxy so that the ldap master can push data to more than one proxy servers. My olcDatabase={3}ldap.ldif file looks like this: dn: olcDatabase={3}ldap objectClass: olcDatabaseConfig objectClass: olcLDAPConfig olcDatabase: {3}ldap olcHidden: TRUE olcSuffix: dc=amdocs,dc=com olcRootDN: cn=ldap,dc=amdocs,dc=com olcSyncUseSubentry: FALSE olcMonitoring: TRUE structuralObjectClass: olcLDAPConfig entryUUID: c7d2672e-5c10-1031-9a08-0f8186de202c creatorsName: cn=config createTimestamp: 20120706234807Z olcSyncrepl:: <syncrepl entry here> olcDbACLBind: bindmethod=simple timeout=0 network-timeout=0 binddn="cn=Manager ,dc=something,dc=com" credentials="secret" olcDbURI: ldap://proxy-1.server.com entryCSN: 20120707001006.061485Z#000000#001#000000 modifiersName: cn=config modifyTimestamp: 20120707001006Z With this configuration it is currently pushing only to proxy-1.server.com, how do I add more than one olcDbURI values so that it can push to multiple servers? Thanks. Bhargav. This message and the information contained herein is proprietary and confidential and subject to the Amdocs policy statement, you may review at http://www.amdocs.com/email_disclaimer.asp

1 0

Re: Reindex failed on MDB backend (cn=config)
by Quanah Gibson-Mount 10 Jul '12

10 Jul '12

--On Tuesday, July 10, 2012 10:44 AM +0200 Pieter Baele <pieter.baele(a)gmail.com> wrote: > > > On Tue, Jul 10, 2012 at 8:42 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> > wrote: > > > --On Tuesday, July 10, 2012 8:26 AM +0200 Pieter Baele > <pieter.baele(a)gmail.com> wrote: > > >>> I added some indexes on a mdb database (Mirror) using ADS, and then tried >>> to reindex using the LTB init script. > >> What version of OpenLDAP? > openldap-ltb-2.4.31-1.el6.x86_64 Hi Pieter, Please keep replies on the list if you want assistance. Can you reproduce this issue using the latest RE24 code? Thanks, Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Reindex failed on MDB backend (cn=config)
by Pieter Baele 10 Jul '12

10 Jul '12

I added some indexes on a mdb database (Mirror) using ADS, and then tried to reindex using the LTB init script. service slapd reindex slapd: [INFO] Using /etc/default/slapd for configuration slapd: [INFO] Launching OpenLDAP database reindexing... slapindex: ./../../../libraries/libmdb/mdb.c:1361: mdb_page_touch: Assertion `mp->mp_p.p_pgno != np->mp_p.p_pgno' failed. slapd: [ALERT] OpenLDAP database reindexing failed I don't have additional details, because only Stats2 and Sync loglevel is enabled, and I already recovered. My question: how do I add indexes correctly so this doesn't happen again? directly with the use of an ldif file? Note: I want to use MDB in production, because our db will be small (never above 2GB, or 128TB ;-) ) Any recommendations? Sincerely, PieterB

2 1

Filter character encoding independent
by Philip Brusten 09 Jul '12

09 Jul '12

Hi, Our OpenLDAP information is stored in UTF-8 character encoding, like any other default installation I guess. Some of the records have special characters in their name, like ë, é, è, ç, etc. We want to make a webapplication that can do lookups on these names, without forcing the user to enter the correct characters. E.g. if they search for "Francois", it should match all givenNames "François" in LDAP. However if people do search for "François" if should also match all givenNames "François". I've looked for certain matching rules that could do this, but I haven't found what I'm looking for so far. Can anybody help me out? Kr, Philip

3 4

Accesslog purge doesn't work in Openldap 2.4.21 - Ubuntu Lucid
by Miguel Montero Rodríguez 08 Jul '12

08 Jul '12

Hi everyone, I've just seen that /var/lib/ldap/accesslog is growing so I've realized that olcAccessLogPurge is not working properly (for example, I have log.0000000001 file from 2011-09-10). The files that I used to configure accesslog are: ---------------------------------------------------------------- dn: olcDatabase={2}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {2}hdb olcDbDirectory: /var/lib/ldap/accesslog olcSuffix: cn=accesslog olcRootDN: cn=Administrator,dc=example,dc=net olcDbIndex: default eq olcDbIndex: entryCSN,objectClass,reqEnd,reqResult,reqStart ---------------------------------------------------------------- The other file for configuring the accesslog is: ---------------------------------------------------------------- dn: olcOverlay=accesslog,olcDatabase={1}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcAccessLogConfig olcOverlay: accesslog olcAccessLogDB: cn=accesslog olcAccessLogOps: all olcAccessLogSuccess: TRUE # scan the accesslog DB every day, and purge entries older than 7 days olcAccessLogPurge: 07+00:00 01+00:00 ---------------------------------------------------------------- LDAP is working properly but not this. Anyone can tell me any clue about this? Thank you in advance. Best regards, Miguel.

4 6

Increase size of id2entry.bdb in DB_CONFIG ?
by Frank Bonnet 08 Jul '12

08 Jul '12

Hello My slapd server suddenly refuse to generate an LDIF file though th slapcat command. It is asking to increase the size of the id2entry.bdb database. I restart slapd and it works fine again but I would like to know what happened. Is there any configurable parameter that I would be able to write down into DB_CONFIG file to increase the size of this database ? I haven't found any precise documentation about this when googling about this. Or is it totally anything else ? see below the actual result of the db_stat command applied to this base : ldap# db_stat-4.6 -d id2entry.bdb Wed Jul 4 09:23:56 2012 Local time 53162 Btree magic number 9 Btree version number Little-endian Byte order Flags 2 Minimum keys per-page 16384 Underlying database page size 4079 Overflow key/data size 3 Number of levels in the tree 18735 Number of unique keys in the tree 18735 Number of data items in the tree 4 Number of tree internal pages 28130 Number of bytes free in tree internal pages (57% ff) 1694 Number of tree leaf pages 3940820 Number of bytes free in tree leaf pages (85% ff) 0 Number of tree duplicate pages 0 Number of bytes free in tree duplicate pages (0% ff) 7 Number of tree overflow pages 67789 Number of bytes free in tree overflow pages (40% ff) 0 Number of empty pages 0 Number of pages on the free list Thank you very much

5 11

Re: Increase size of id2entry.bdb in DB_CONFIG ?
by Quanah Gibson-Mount 07 Jul '12

07 Jul '12

--On Friday, July 06, 2012 10:40 AM +0200 Frank Bonnet <f.bonnet(a)esiee.fr> wrote: >> set_lg_regionmax 262144 >> set_lg_max 10485760 >> set_lg_bsize 2097152 > > Do you know if there is somewhere a documentation > that describe in details all DB_CONFIG statements ? > > thanks Hi Frank, Please keep this discussion on the list, thanks. I would advise consulting the BDB documentation that came with the version of BDB your OpenLDAP build is linked with. It often is in the Appendices, for example: <http://docs.oracle.com/cd/E17076_02/html/api_reference/C/set_lg_regionmax_p…> --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

Setting up multiple proxies on openldap 2.4.23
by Bhargav Mistry 07 Jul '12

07 Jul '12

Hi, I am trying to configure multiple proxy so that the ldap master can push data to more than one proxy servers. My olcDatabase={3}ldap.ldif file looks like this: dn: olcDatabase={3}ldap objectClass: olcDatabaseConfig objectClass: olcLDAPConfig olcDatabase: {3}ldap olcHidden: TRUE olcSuffix: dc=amdocs,dc=com olcRootDN: cn=ldap,dc=amdocs,dc=com olcSyncUseSubentry: FALSE olcMonitoring: TRUE structuralObjectClass: olcLDAPConfig entryUUID: c7d2672e-5c10-1031-9a08-0f8186de202c creatorsName: cn=config createTimestamp: 20120706234807Z olcSyncrepl:: <syncrepl entry here> olcDbACLBind: bindmethod=simple timeout=0 network-timeout=0 binddn="cn=Manager ,dc=something,dc=com" credentials="secret" olcDbURI: ldap://proxy-1.server.com entryCSN: 20120707001006.061485Z#000000#001#000000 modifiersName: cn=config modifyTimestamp: 20120707001006Z With this configuration it is currently pushing only to proxy-1.server.com, how do I add more than one olcDbURI values so that it can push to multiple servers? Thanks. Bhargav. This message and the information contained herein is proprietary and confidential and subject to the Amdocs policy statement, you may review at http://www.amdocs.com/email_disclaimer.asp

1 0

syncrepl selective sync?
by jimy 06 Jul '12

06 Jul '12

Hello, what ist the best way to sync all contained in ou=group1,ou=sync,dc=example,dc=com AND ou=group2,ou=sync,dc=example,dc=com only with a of searchbase="ou=sync,dc=example,dc=com" ? Can this be done with filter= or do I need subordinate dbs? thx jimy

3 2

Uniqueness constraint over multiple attributes
by Jan Beerden 06 Jul '12

06 Jul '12

Hello, Is there a way to have a unique constraint over multiple attributes? We have different attributes for the primary email address of a person, and for additional aliases, and we'd like to enforce global uniqueness in such a way that the primary email address for one person can not be used as an email alias for another person. The slapo-unique manpage doesn't make this very clear. Regards -- Jan Beerden jan.beerden(a)fks.be fks bvba - Formal and Knowledge Systems http://www.fks.be/ Schampbergstraat 32 Tel: ++32-(0)11-21 49 11 B-3511 Kuringen Fax: ++32-(0)11-22 04 19

4 10

Anyone using ejabberd with OpenLDAP?
by Gavin Henry 06 Jul '12

06 Jul '12

HI all, Taking advantage of the technical list for once and the OpenLDAP "related" questions :-) Anyone messed with ejabberd and OpenLDAP? I'm looking for an XMPP server with the best LDAP support. ejabberd does auth, rosters and vcards but the ability to load a list of hosts/domains from LDAP like you can do with Exim etc. would rule. Any suggestions? -- http://www.suretecsystems.com/services/openldap/ http://www.surevoip.co.uk

3 4

Re: Docs To Do list and other ideas. Please contribute
by Gavin Henry 06 Jul '12

06 Jul '12

On 5 July 2012 16:44, Gavin Henry <gavin.henry(a)gmail.com> wrote: > On 5 July 2012 08:23, Michael Ströder <michael(a)stroeder.com> wrote: >> xsun wrote: >>> I don't remember if we talked about a wiki in the past but it's definitely a >>> good idea. I mean, if available, we could start to migrate/review the content >>> of openldap documentation page (AdminGuid, FAQ, etc) to the wiki. >> >> While Wikis seem to be attractive at first glance the biggest caveat is that >> you can't cut a doc release of all the pages for a certain software release. >> >> In other open source projects which have all the docs in a Wiki this turned >> out to be a major issue. > Good point. We would just need to decide what docs go in the Wiki and what format we export them as for the guide. > Gavin. -- http://www.suretecsystems.com/services/openldap/ http://www.surevoip.co.uk -- http://www.suretecsystems.com/services/openldap/ http://www.surevoip.co.uk

6 5

consumer doesn't send search requests
by jimy 06 Jul '12

06 Jul '12

Hello, migrating from slurpd I try to setup syncrepl. I read the slapd.conf man page and http://www.openldap.org/doc/admin24/replication.html#LDAP%20Sync%20Replicat… to get it up and running but I can't even get the consumer to send search requests to the provider. tcpdump shows that the consumer doesn't even start to talk with the provider after startup and openldap -d 16384 doesn't give me a hint also. Can someone here point me to the right direction how to proceed please? My configs can be viewed here: provider config: http://58c.om.sl.pt consumer config: http://58c.oy.sl.pt I also gathered the logging output from slapd -d -1 but this are two ~1.5MB files and too big to paste them in pastebin. I'll happily email the files per request. thx jimy

2 2

Fwd: [Foswiki-discuss] Mass import advice from OpenLDAP project Faq-O-Matic to foswiki?
by Gavin Henry 06 Jul '12

06 Jul '12

I found this from last year I misplaced. ---------- Forwarded message ---------- From: lars.eik(a)gmail.com <lars.eik(a)gmail.com> Date: 3 May 2011 23:43 Subject: Re: [Foswiki-discuss] Mass import advice from OpenLDAP project Faq-O-Matic to foswiki? To: foswiki-discuss(a)lists.sourceforge.net Hi Gavin, I have only done some minor text hacking but here's some feedback anyways. THIS will help you. If you make out the structure between file names then you can script creation and set the relevant parameters, like 'topicparent' and get the breadcrumb right. That could be a start. Another way could be by using JQuery and doing import from 'GUI' in Foswiki. Prepare much the same structure as you would if using CLI and use your browser to do the 'save' script. This would let you preview etc (by INCLUDE url) and give som other options, like let other users do some import and quality checking. Your old pages have a structure where the meaningful info is in the first two tables. Maybe even only the first if you don't really need the Previous/Next bit. So the structure seem simple enough but I have not examined all of the FAQ's. Perhaps create a mapping table between the old '226.html' and new 'WhichVersionShouldIUse'. The new names can be created by removing the spaces and ' signs in the title so it would be a valid wikiname. You can override so it doesnt have to be tough. Another name scenario is LdapFaqAUTOINC0 where the AUTOINC0 will get next available nr, like LdapFaq38 etc.. table1, tbody row1, skip first td, row1, second td has a tags that are top, second, third, fourth level/category. row1, last b tag is the current document "name" or caption. Could be your page name (topic name) other tablerows are data/info ..and that's about all I had time for :) Jquery is really nice when doing stuff like html tags, children, find the 'b' tag etc. About text files, you can copy them all into a new 'test web' and rename them to .txt but and it will work butt will need heavy refactoring. If you take out the first table of each and saved at txt file it would be much easier. Best of luck Lars 2011/5/2 Olivier 'Babar' Raginel <wiki(a)babar.us> > > On Mon, May 02, 2011 at 09:46:07PM +0100, Gavin Henry wrote: > > I'm the doc dev for the OpenLDAP project (ghenry(a)OpenLDAP.org) and I'm > > moving our Faq content from Faq-O-Matic to our new wiki: > > That's great news! > > > Any tips for moving over? I can scrape the HTML into wiki syntax but > > I'm sure others have done this before. > > Hum, I'm afraid most if not all of us have no idea how a Faq-O-Matic > text looks like. From what I could grasp with 3 minutes web-browsing, > it seems a very old and simple syntax, with not that many rules or fancy > stuff, so writing a converter should be pretty much trivial. > > > Please save me from copy and paste! > > I'm not sure we can save you from copy and paste, but I'm pretty sure > you can save yourself easily with one not so complex perl script, which > should be able to migrate your content pretty easily. > > But the hard part is not migrating, it's defining the structure you want > your new content to use. In Foswiki, things like FAQs are usually best > used through pre-defined structures, either strict topic format, or > forms, or both. So before migrating I suggest you think of what you want > to achieve, and then you start hacking some perl script to convert your > Faq-O-Matic to what you want. > > And if you need help in the process, you know where to find us :) > > Good luck, > > -- > Babar > > ------------------------------------------------------------------------------ > WhatsUp Gold - Download Free Network Management Software > The most intuitive, comprehensive, and cost-effective network > management toolset available today. Delivers lowest initial > acquisition cost and overall TCO of any competing solution. > http://p.sf.net/sfu/whatsupgold-sd > _______________________________________________ > Foswiki-discuss mailing list > Foswiki-discuss(a)lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/foswiki-discuss ------------------------------------------------------------------------------ WhatsUp Gold - Download Free Network Management Software The most intuitive, comprehensive, and cost-effective network management toolset available today. Delivers lowest initial acquisition cost and overall TCO of any competing solution. http://p.sf.net/sfu/whatsupgold-sd _______________________________________________ Foswiki-discuss mailing list Foswiki-discuss(a)lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/foswiki-discuss -- http://www.suretecsystems.com/services/openldap/ http://www.surevoip.co.uk

1 0

Re: Docs To Do list and other ideas. Please contribute
by Gavin Henry 06 Jul '12

06 Jul '12

So where are we? Wiki - no then? Or Wiki like dokuwiki which does plain text files, stick them in the back of a git repo, add some hooks to do commits so we can all work offline and use the Dokuwiki PDF exports? We just need something to look "new" :-) -- http://www.suretecsystems.com/services/openldap/ http://www.surevoip.co.uk

1 1

Ldap Replication Query
by Hanumanth Rao 05 Jul '12

05 Jul '12

Hello LDAP Brains, I have setup a Samba PDC (192.168.1.2) and a Samba BDC (192.168.4.2) both are on different subnets, there are two issues for me as below *PDC - SUSE Linux Enterprise Server 11 (x86_64), VERSION = 11, PATCHLEVEL = 2, samba-3.6.3-0.18.3, openldap2-2.4.26-0.12.1 BDC - SUSE Linux Enterprise Server 10 (i586) , VERSION = 10, samba-3.0.22-13.16, openldap2-2.3.19-18.7* 1. On the BDC if I give the command below I get Unable to find a suitable server BDC2:~ # net rpc info Unable to find a suitable server 2. I am not able to sync ldap database, BDC with the PDC I have enclosed my slapd.conf of PDC and BDC, can anybody let me know where I have gone wrong. Your help is highly appreciated, thanks in advance. Hanumanth Rao

2 1

SASL passthrough - multiple domains
by Liam Gretton 05 Jul '12

05 Jul '12

I have a working configuration with pass-through auth to an AD domain using saslauthd. However now there is a requirement to be able to handle another domain too, and I cannot work out how to do this. It seems that saslauthd cannot deal with multiple Kerberos realms, no matter what hoops one jumps through it eventually boils down to only using whatever 'default_realm' is set to in the krb5.conf file. Using multiple saslauthd daemons isn't possible either as there's no way (that I can work out) of getting OpenLDAP to use anything other than the single socket specified in /etc/sasl2/slapd.conf. My final idea was to run an LDAP instance per realm, each talking to the separate saslauthd daemons, and have another outward facing LDAP service with these as the backends but that's a non starter too because there's no way of specifying the sasl slapd.conf file, it seems sasl always looks in /etc/sasl2 for a file derived from the process name (a chroot environment for each LDAP server is therefore the next thing to look at). But this seems like a lot of work just to be able to authenticate users against multiple domains. I appreciate this is a SASL issue rather than a problem with OpenLDAP, but I'm hoping that someone here has cracked this already. Googling hasn't thrown up an solution that I can find. -- Liam Gretton liam.gretton(a)le.ac.uk HPC Architect http://www.le.ac.uk/its IT Services Tel: +44 (0)116 2522254 University of Leicester, University Road Leicestershire LE1 7RH, United Kingdom

8 10

Docs To Do list and other ideas. Please contribute
by Gavin Henry 05 Jul '12

05 Jul '12

On 4 July 2012 22:34, xsun <matheus.morais(a)gmail.com> wrote: > Hello guys, > > I can help on documentation in my spare time. I tryed to submit a patch for > ITS#6339 in the past but I don't know why it was not accepted and I did not > received any feedback about it. There is some TODO list for documentation? > There is a TODO list which, I can't believe, I started in 2008 and haven't made much progress: OpenLDAP Test suite Go through Samba stuff again OpenLDAP contrib scripts for generating LDIF etc. OpenLDAP Admin Guide - Intro Tighten "LDAP vs RDBMS" Check "What is slapd and what can it do?" "Replicated Directory Service" - add MultiMaster picture. "Configuring slapd" - check DIT layout is right "The slapd Configuration File" - check backends are correct and in above "Access Control" - Finish "Converting from slapd.conf(5) to a cn=config directory format" Backends section to finish Overlays section to finish Maintenance section to finish Monitoring section to finish Tuning section to finish More in Troubleshooting section More in Upgrading from 2.3.x section Check "Recommended OpenLDAP Software Dependency Versions" section Do some "Real World OpenLDAP Deployments and Examples" "OpenLDAP Software Contributions" to complete "Configuration File Examples" to complete Some are done and I'd rather build a build farm RESTful API now so we can have a central build farm. We did get a server from Google for that with 32GB Ram but last I heard it was down. Kurt? I'll check out your ITS and also we talked about a new wiki at some point?

3 2

Cannot remove LDAP entry ...
by Frank Bonnet 03 Jul '12

03 Jul '12

Hello I have a problem removing ONE ( and only ONE !!! ) entry in my directory server ldapdelete fails like the following ldap_delete: Other (e.g., implementation specific) error (80) additional info: entry index delete failed I've checked online openldap documentation and this error refers to a access rights problem, but it is not the case for my server , all db files belong to ldap:ldap which is the identity the slapd deamon runs on. the server runs 2.4.23 version on a FreeBSD 8.1-RELEASE-p5 compiled and installed from ports. ldap# /usr/local/libexec/slapd -V @(#) $OpenLDAP: slapd 2.4.23 (Oct 15 2010 16:35:06) $ root@ldap3.esiee.fr:/usr/ports/net/openldap24-server/work/openldap-2.4.23/servers/slapd Any help welcome thank you

2 1

bug in unique overlay
by Anton Yuzhaninov 03 Jul '12

03 Jul '12

According to slapo-unique(5) it is possible to specify several URLs in one domain (in single unique_uri dircetive). I have in my slapd.conf settings like: unique_uri ldap:///ou=lists,dc=example.ru,ou=mail,o=foo?cn?sub?(objectClass=nisMailAlias) ldap:///ou=aliases,dc=example.ru,ou=mail,o=foo?cn?sub?(objectClass=nisMailAlias) But in OpenLDAP 2.4.31 all URLs except first one is silently ignored. Debug logs show: 4ff309e3 line 208 (unique_uri ldap:///ou=lists,dc=example.ru,ou=mail,o=foo?cn?sub?(objectClass=nisMailAlias) ldap:///ou=aliases,dc=example.ru,ou=mail,o=foo?cn?sub?(objectClass=nisMailAlias)) 4ff309e3 ==> unique_new_domain <ldap:///ou=lists,dc=example.ru,ou=mail,o=foo?cn?sub?(objectClass=nisMailAlias)> ldap_url_parse_ext(ldap:///ou=lists,dc=example.ru,ou=mail,o=foo?cn?sub?(objectClass=nisMailAlias)) 4ff309e3 >>> dnPrettyNormal: <ou=lists,dc=example.ru,ou=mail,o=foo> 4ff309e3 <<< dnPrettyNormal: <ou=lists,dc=example.ru,ou=mail,o=foo>, <ou=lists,dc=example.ru,ou=mail,o=foo> Prblem is around this code in servers/slapd/overlays/unique.c: if ( c->line ) rc = unique_new_domain ( &domain, c->line, c ); else rc = unique_new_domain ( &domain, c->argv[1], c ); c->line is empty by some reason. c->argv[1] contains only first URL. Is anybody know how to fix this bug? Is it normal, that c->line is empty? -- Anton Yuzhaninov

3 3

overlay nssov and pass-though authentication
by Uwe Werler 02 Jul '12

02 Jul '12

Hello list, sis there a way to use pass-through authentication with saslauthd and the new nssov overlay? The only thing I got working at the moment was to use overlay pbind. But then I have to split my database 'cause I need local passwords stored in the database too. Thanks in aadvance! Uwe

1 0

overlay nssov and pass-through authentication
by Uwe Werler 02 Jul '12

02 Jul '12

Hello list, sis there a way to use pass-through authentication with saslauthd and the new nssov overlay? The only thing I got working at the moment was to use overlay pbind. But then I have to split my database 'cause I need local passwords stored in the database too. Thanks in aadvance! Uwe

1 0

New release of LinID OpenLDAP Manager
by Clément OUDOT 29 Jun '12

29 Jun '12

Hi all, I wanted to inform you that we just released a new version (0.7) of our OpenLDAP configuration web console. You can know more about this version here: https://redmine.linid.org/news/16 LinID OpenLDAP Manager is free software (AGPLv3), I hope it might be useful for some of you. Regards, Clément OUDOT.

2 2

chaining and returning errors
by Frank Van Damme 29 Jun '12

29 Jun '12

List, I'm setting up chaining. And I want to get errors, no referrals :) my olcDatabase looks like this: olcDatabase={0}ldap,olcOverlay={1}chain,olcDatabase={1}hdb,cn=config objectClass: olcChainDatabase (auxiliary) objectClass: olcConfig (abstract) objectClass: olcDatabaseConfig (structural) objectClass: olcLDAPConfig (structural) objectClass: top (abstract) olcDatabase: {0}ldap olcDbIDAssertBind: bindmethod="simple" binddn="uid=lalalala" credentials="foo" mode="self" olcDbURI: ldap://example.com here is this object's parent: olcOverlay={1}chain,olcDatabase={1}hdb,cn=config objectClass: olcConfig (abstract) objectClass: olcOverlayConfig (structural) objectClass: top (abstract) olcOverlay: {1}chain The problem is that I can't insert an olcChainReturnError attribute into it. The schema doesn't allow it. I tried to add the olcChainConfig objectClass to the olcDatabase={1} object, which requires me to fill in an extra attribute "olcOverlay" - I tried {1}chain and "chain" and "{0}ldap" but either give me an error 65 "invalid structural object class chain". -- Frank Van Damme No part of this copyright message may be reproduced, read or seen, dead or alive or by any means, including but not limited to telepathy without the benevolence of the author.

2 2

Re: Memberof overlay with posixGroup
by Marcio Merlone 29 Jun '12

29 Jun '12

Em 28-06-2012 12:39, Julien Soula escreveu: > On Thu, Jun 28, 2012 at 10:34:48AM -0300, Marcio Merlone wrote: >> I am trying to implement memberof overlay on Ubuntu 10.04.4 LTS and >> OpenLDAP 2.4.21-0ubuntu5.7 over posixGroup, not groupOfNames. I >> created the following ldif: >> >> .../... >> >> adding new entry "olcOverlay={2}memberof,olcDatabase={1}hdb,cn=config" >> ldap_add: Other (e.g., implementation specific) error (80) >> additional info: member attribute="memberUid" must either >> have DN (1.3.6.1.4.1.1466.115.121.1.12) or nameUID >> (1.3.6.1.4.1.1466.115.121.1.34) syntax > overlay memberof only supports DN as membership attribute (as DN and > nameUID type). I don't know any workaround for your case. Sorry for the noise, I SWEAR, I was so sure posixGroup use DN as membership, overlooked that. Thanks and best regards. -- *Marcio Merlone*

1 0

Memberof overlay with posixGroup
by Marcio Merlone 28 Jun '12

28 Jun '12

Greetings, I am trying to implement memberof overlay on Ubuntu 10.04.4 LTS and OpenLDAP 2.4.21-0ubuntu5.7 over posixGroup, not groupOfNames. I created the following ldif: root@venus:~# cat memberof.ldif dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: memberof - add: olcModuleLoad olcModuleLoad: refint dn: olcOverlay={2}memberof,olcDatabase={1}hdb,cn=config objectClass: olcConfig objectClass: olcMemberOf objectClass: olcOverlayConfig objectClass: top olcOverlay: {2}memberof olcMemberOfRefInt: TRUE olcMemberOfGroupOC: posixGroup olcMemberOfMemberAD: memberUid olcMemberOfMemberOfAD: memberOf dn: olcOverlay={3}refint,olcDatabase={1}hdb,cn=config objectClass: olcConfig objectClass: olcOverlayConfig objectClass: olcRefintConfig objectClass: top olcOverlay: {3}refint olcRefintAttribute: memberof memberuid manager owner seeAlso roleOccupant root@venus:~# And got the error: root@venus:~# ldapadd -x -D "cn=admin,cn=config" -W -f memberof.ldif Enter LDAP Password: modifying entry "cn=module{0},cn=config" adding new entry "olcOverlay={2}memberof,olcDatabase={1}hdb,cn=config" ldap_add: Other (e.g., implementation specific) error (80) additional info: member attribute="memberUid" must either have DN (1.3.6.1.4.1.1466.115.121.1.12) or nameUID (1.3.6.1.4.1.1466.115.121.1.34) syntax root@venus:~# Is this a specific version problem, is it not doable or have I screwed something? Thanks for any help, please let me know if you need further information. Regards. -- *Marcio Merlone*

1 0

Strange TLS issue while upgrading from openldap 2.3 to 2.4
by Guillaume Rousse 28 Jun '12

28 Jun '12

Hello list. I recently faced a strange issue while upgrading from openldap 2.3 to 2.4 (from centos 5.7 to 6.2, actually): the change was transparent for every applications excepted Zimbra, for which any authentication attempt was suffering from an unexplained 30s additional delay. Just switching from explicit TLS usage on port 389 to explicit SSL usage on port 636 was enough to fix the issue. The logs shows than the delay occurs between the moment where the bind operation succeed, and the moment the client connection get closed: Jun 14 11:56:04 ildapslave2 slapd[16618]: conn=2787 fd=135 ACCEPT from IP=128.93.142.13:41191 (IP=0.0.0.0:389) Jun 14 11:56:04 ildapslave2 slapd[16618]: conn=2787 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Jun 14 11:56:04 ildapslave2 slapd[16618]: conn=2787 op=0 STARTTLS Jun 14 11:56:04 ildapslave2 slapd[16618]: conn=2787 op=0 RESULT oid= err=0 text= Jun 14 11:56:04 ildapslave2 slapd[16618]: conn=2787 fd=135 TLS established tls_ssf=256 ssf=256 Jun 14 11:56:04 ildapslave2 slapd[16618]: conn=2787 op=1 BIND dn="uid=fauge00C,ou=people,dc=inria,dc=fr" method=128 Jun 14 11:56:04 ildapslave2 slapd[16618]: conn=2787 op=1 BIND dn="uid=fauge00C,ou=people,dc=inria,dc=fr" mech=SIMPLE ssf=0 Jun 14 11:56:04 ildapslave2 slapd[16618]: conn=2787 op=1 RESULT tag=97 err=0 text= ... Jun 14 11:56:34 ildapslave2 slapd[16618]: conn=2787 fd=135 closed (connection lost) Before the upgrade, the connection get closed immediatly, and there is no such delay. Using higher logging level doesn't provide additional useful details, excepted maybe more details about connection termination: Jun 14 12:53:21 ildapslave2 slapd[7156]: connection_read(109): checking for input on id=1135 Jun 14 12:53:21 ildapslave2 slapd[7156]: ber_get_next on fd 109 failed errno=0 (Success) Jun 14 12:53:21 ildapslave2 slapd[7156]: connection_read(109): input error=-2 id=1135, closing. I'm aware than this behaviour change may actually come from underlying libraries, such as bdb for instance, rather than openldap itself, but that's still quite a curious issue. Does anyone have a clue about this problem ? -- The more cordial the buyer's secretary, the greater the odds that the competition already has the order -- Murphy's Laws on Technology n°38

3 7

back-meta and SSL
by Peter Ga 26 Jun '12

26 Jun '12

Hello, one question to back-meta: Is it possible to have several ldaps:// URLs as entries, without client-side authentication? I.e. I just want to configure the CA cert path and connect to a ldaps repository ('normal' ssl, no starttls). I saw the section in the man page about idassert-bind, but was not completely sure they apply to ldaps URLs without authentication. Best regards, Peter

1 0

Security Deadlock?
by suomi 26 Jun '12

26 Jun '12

Hi listers this is on Fedora 17 running openldap-servers-2.4.31-2.fc17.x86_64 When trying to start slapd on this sysem, I run into the following deadlock: 1. [root@myws ~]# systemctl status slapd.service slapd.service - OpenLDAP Server Daemon Loaded: loaded (/usr/lib/systemd/system/slapd.service; enabled) Active: failed (Result: timeout) since Tue, 26 Jun 2012 14:23:02 +0200; 16s ago Process: 2531 ExecStart=/usr/sbin/slapd -u ldap -h ${SLAPD_URLS} $SLAPD_OPTIONS (code=exited, status=0/SUCCESS) Process: 2467 ExecStartPre=/usr/libexec/openldap/check-config.sh (code=exited, status=0/SUCCESS) CGroup: name=systemd:/system/slapd.service When I checked /var/log/localmessages, I found Jun 26 13:08:21 casablanca slapd[838]: ldif_read_file: checksum error on "/etc/openldap/slapd.d/cn=config/olcDatabase={0}config.ldif" I remembered, that this was exactly the file, where I had introduced the olcRootPW attribute for the cn=config subtree. So I removed the olcRootPW attribute from this file. 2. Then I could start slapd, no problem. 3. I tried to go into the cn=config subtree of the DIT on that slapd server. I tried it withoud password, since I had removed the password from this subtree. I got: Return Code from Bind: 48 Message: LDAP_INAPPROPRIATE_AUTH: The server requires the client which had attempted to bind anonymously or without supplying credentials to provide some form of credentials 4. I tried to go into the cn=config subtree of the DIT on that slapd server using the password I had usually used at this point. I got: Return Code from Bind: 49 Message: LDAP_INVALID_CREDENTIALS: The wrong password was supplied or the SASL credentials could not be processed 5. I googled around and found the following: ... Obvious approach: slapcat -n0 -F old/slapd.d > config.ldif edit config.ldif slapadd -n0 -F new/slapd.d -l config.ldif test using new/slapd.d deploy ... which I followed because I thought that such a clever approach can come only from a clever openldap guy. But when I tried to introduce the edited config.ldif into the DIT, I got [root@myws /etc/openldap]# slapadd -n0 -F slapd.d -l /tmp/slapd.config.ldif slapadd: could not add entry dn="cn=config" (line=1): _ 1.03% eta none elapsed none spd 4.5 M/s Closing DB... [root@myws /etc/openldap]# 6. I am now at the point, that I cannot access the cn=config subtree, because I cannot define the password to access this subtree and because, to access that subtree, I need to have defined the appropriate password. Looks very much kin'o like a deadlock. Is there anybody out there who knows how to circumvent this deadlock or do I need to file a bug to openldap? Thanks for your patience. suomi

2 1

Controlled LDAP Proxy/Relay
by W.Siebert＠t-systems.com 25 Jun '12

25 Jun '12

Hello, thanks for your answer. But I don't have any local users. All users are in two targets: domain01.com and domain99.net (AD). Where I should place userPassword attribute? My problem: We have a VoIP realized by Cisco Unified Call Manager (CUCM). There are several thousand users in the customers directory (domain01.com) using CUCM for Voice and ca 100 adminusers in the supplier directory (domain99.net). No trusting, different companies. Because CUCM can use only one directory to authenticate users I've implemented a OpenLDAP Metadirectory that proxying this 2 Microsft AD targets. But meta backend tries to authenticate by the first target, if the user was not found, by the second. Result: Intrusion detection register a lot of unsuccessfully login attempts. Therefore my question: Is it possible to implement the controlled proxy with OpenLDAP ? E.g., like Radiusproxy based on realm: when username is _xxx(a)domain01.com_<mailto:_xxx@domain01.com_> go to the target1, and when username is _xxx(a)domain99.net_<mailto:_xxx@domain99.net_> go to the target2. Can you help me please Kind regards Waldemar ################################################################ On 08/02/2012 09:58, W.Siebert(a)t-systems.com<mailto:W.Siebert@t-systems.com> wrote: > Is it possible to implement the controlled proxy with OpenLDAP ? > E.g., like Radiusproxy based on realm: when username is > _xxx(a)domain01.com_<mailto:_xxx@domain01.com_> <mailto:xxx@domain01.com> go to the target1, and > when username is _xxx(a)domain99.net_<mailto:xxx@domain99.net<mailto:_xxx@domain99.net_<mailto:xxx@domain99.net>> go to the target2. Yes, a combination of meta database config in slapd.conf and appropriate SASL config. In your schema, use the following in userPassword: userPassword: {SASL}xxx@DOMAIN where DOMAIN is whichever domain the user needs to be authenticated against. In slapd.conf: database meta suffix dc=local rootdn cn=administrator,dc=local rootpw secret # domain01 uri ldaps://domain01.com:3269/ou=domain01.com,dc=local lastmod off suffixmassage "ou=domain01.com=local" "dc=domain01,dc=com" idassert-bind bindmethod=simple binddn="cn=binder,dc=domain01,dc=com" credentials="password" flags=non-prescriptive idassert-authzFrom "dn.exact:cn=administrator,dc=local" # domain02 uri ldaps://domain02.com:3269/ou=domain02.com,dc=local lastmod off suffixmassage "ou=domain02.com=local" "dc=domain02,dc=com" idassert-bind bindmethod=simple binddn="cn=binder,dc=domain02,dc=com" credentials="password" flags=non-prescriptive idassert-authzFrom "dn.exact:cn=administrator,dc=local" In saslauthd.conf you need to create the appropriate search base for authentication based on the domain in the userPassword field: ldap_servers: ldapi://%2Fvar%2Frun%2Fslapd%2Fldapi-meta ldap_search_base: ou=%d,dc=local ldap_filter: (sAMAccountName=%U) ldap_auth_method: bind ldap_bind_dn: cn=administrator,dc=local ldap_password: secret ldap_deref: never ldap_use_sasl: no Hopefully this is enough info to get you going. -- Liam Gretton liam.gretton(a)le.ac.uk<mailto:liam.gretton@le.ac.uk> HPC Architect http://www.le.ac.uk/its IT Services Tel: +44 (0)116 2522254 University of Leicester, University Road Leicestershire LE1 7RH, United Kingdom

2 3

Ldap filter to get group members
by dhanushka ranasinghe 25 Jun '12

25 Jun '12

Hi... guys i have a LDAP server and its has a group called . cn=internal ou=group,dc=example,dc=com --users of this group is : uid=user1,ou=user,dc=example,dc=com uid=user2,ou=user,dc=example,dc=com i need to only to authenticate the users under cn=internal .... LDAP search for the cn=internal group as follows , dn: cn=internal,ou=group,dc=example,dc=com objectClass: groupOfNames objectClass: top cn: internal member: uid=user1,ou=user,dc=example,dc=com member: uid=user2,ou=user,dc=example,dc=com member: uid=user3,ou=user,dc=example,dc=com member: uid=user4,ou=user,dc=example,dc=com by the way All the users are stored at base OU=user,DC=example,DC=com This is what we are using (&(objectClass=groupOfNames)(memberOf=CN=internal,OU=group,DC=example,DC=com)) seems like its not working .. what the LDAP search filter i need to use to get only the members of the cn=internal group authenticated... Thanks

3 4

Reject requests on non-secure connections
by Terry Gardner 23 Jun '12

23 Jun '12

Is it possible to configure the server to reject requests on non-secure connections with the exception of the StartTLS extended request? In other words, when an LDAP client connects on the clear-text port, can the server be configured to reject all requests on that exception except for the StartTLS extended request in order to prevent clients from transmitting data in the clear?

2 1

Full Backup/Restore slapd
by galemberti greg 22 Jun '12

22 Jun '12

Hi, I want to implement a full backup procedure of my LDAP (schema, ACL, Data ...). * To save my schema i used the command: "slapcat -H ldap:///cn={4}my,cn=schema,cn=config -l schema.ldif" * To save my config, i used the command: "slapcat -H ldap:///olcDatabase={1}hdb,cn=config = config -l config.ldif * To save my accounts, i used the command: "slapcat -H ldap:///dc=my,dc=my -l accounts.ldif Now, when I want to test the restore on another server : * To restore my schema i used the command: "sudo -u openldap slapadd -v -b cn=config -l schema.ldiff " > OK * To restore my accounts i used the command: "sudo -u openldap slapadd -v -c -b cn=config -l accounts.ldiff " > OK * To restore my config i used the command: "sudo -u openldap slapadd -v -c -b olcDatabase={1}hdb,cn=config -l config.ldiff > KO. Indeed the slapadd command does not update the record so I get an error because they already exist. Also, how do I restore my configuration? Tks for your help PS : i use a debian squeeze server.

3 3

Subtree replication: when removing object outside of subtree, contextCSN is not updating!
by Konstantin Menshikov 22 Jun '12

22 Jun '12

Hi. I have replication setup, when i replicate not entire tree, but only part of it. Configuration provider and consumer attached. I use openldap-server-2.4.31 and db47-4.7.25.4 While adding object outside of the replicated subtree: e.g. ou=TestBranch1,dc=example,dc=com contextCSN of dn dc=example,dc=com on consumer server updated, ok. But while removing object, contextCSN not updated! Is it expected behavior or not? At first I added object *ou=hosts,ou=TestBranch2,dc=example,dc=com*.1 After I removed object. Provider log: Jun 22 06:37:53 ro1 slapd[62268]: conn=1002 op=52 SRCH base="ou=hosts,ou=TestBranch2,dc=example,dc=com" scope=0 deref=0 filter="(objectClass=*)" Jun 22 06:37:53 ro1 slapd[62268]: conn=1002 op=52 SRCH attr=hasSubordinates objectClass Jun 22 06:37:53 ro1 slapd[62268]: conn=1002 op=52 SEARCH RESULT tag=101 err=32 nentries=0 text= Jun 22 06:37:54 ro1 slapd[62268]: conn=1002 op=53 ADD dn="ou=hosts,ou=TestBranch2,dc=example,dc=com" Jun 22 06:37:54 ro1 slapd[62268]: slap_queue_csn: queing 0x7ffffe3fb100 20120622063754.599740Z#000000#000#000000 Jun 22 06:37:54 ro1 slapd[62268]: conn=1002 op=53 RESULT tag=105 err=0 text= Jun 22 06:37:54 ro1 slapd[62268]: slap_graduate_commit_csn: removing 0x80191bfd0 20120622063754.599740Z#000000#000#000000 Jun 22 06:37:54 ro1 slapd[62268]: conn=1002 op=54 SRCH base="ou=hosts,ou=TestBranch2,dc=example,dc=com" scope=0 deref=0 filter="(objectClass=*)" Jun 22 06:37:54 ro1 slapd[62268]: conn=1002 op=54 SRCH attr=hasSubordinates objectClass Jun 22 06:37:54 ro1 slapd[62268]: conn=1002 op=54 SEARCH RESULT tag=101 err=0 nentries=1 text= Jun 22 06:38:01 ro1 slapd[62268]: conn=1002 op=55 DEL dn="ou=hosts,ou=TestBranch2,dc=example,dc=com" Jun 22 06:38:01 ro1 slapd[62268]: slap_queue_csn: queing 0x7ffffebfc590 20120622063801.799710Z#000000#000#000000 Jun 22 06:38:01 ro1 slapd[62268]: conn=1002 op=55 RESULT tag=107 err=0 text= Jun 22 06:38:01 ro1 slapd[62268]: slap_graduate_commit_csn: removing 0x802738970 20120622063801.799710Z#000000#000#000000 Jun 22 06:38:02 ro1 slapd[62268]: conn=1002 op=56 SRCH base="ou=TestBranch2,dc=example,dc=com" scope=1 deref=3 filter="(objectClass=*)" Jun 22 06:38:02 ro1 slapd[62268]: conn=1002 op=56 SRCH attr=hasSubordinates objectClass Jun 22 06:38:02 ro1 slapd[62268]: conn=1002 op=56 SEARCH RESULT tag=101 err=0 nentries=2 text= Consumer log: Jun 22 06:37:54 ro2 slapd[62298]: do_syncrep2: rid=111 LDAP_RES_INTERMEDIATE - NEW_COOKIE Jun 22 06:37:54 ro2 slapd[62298]: do_syncrep2: rid=111 NEW_COOKIE: rid=111,csn=20120622063754.599740Z#000000#000#000000 Jun 22 06:37:54 ro2 slapd[62298]: slap_queue_csn: queing 0x8019eca90 20120622063754.599740Z#000000#000#000000 Jun 22 06:37:54 ro2 slapd[62298]: slap_graduate_commit_csn: removing 0x8019ec2b0 20120622063754.599740Z#000000#000#000000 -- Konstantin Menshikov

1 0

ACLs being ignored with rwm/relay
by Tim Watts 21 Jun '12

21 Jun '12

Hi, Sorry - can't figure this out - would welcome any ideas :) The slapd.conf below contains an ACL: access to attrs=userPassword,shadowLastChange by peername.path="/var/run/slapd/ldapi" write by dn="cn=admin,dc=dighum,dc=kcl,dc=ac,dc=uk" write by anonymous auth by self write by * none which works fine on the "real" DN dc=dighum,dc=kcl,dc=ac,dc=uk - I can add extra attrs like homeDirectory and an unauth'd ldapsearch will not list them - eg: ldapsearch -H ldap://localhost/ -D cn=admin,dc=dighum,dc=kcl,dc=ac,dc=uk -b dc=dighum,dc=kcl,dc=ac,dc=uk However, an ldapsearch -H ldap://localhost/ -D cn=admin,dc=dighum,dc=kcl,dc=ac,dc=uk -b dc=cch,dc=kcl,dc=ac,dc=uk lists the "virtual copy" tree AND includes the userPassword attr for each entry which of course, is rather bad. Anyone see why the ACLs are not being applied to the results of the relay/rwm section? Many thanks, Tim slapd.conf ####################################################################### # Global Directives: # Features to permit #allow bind_v2 # Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema # Where the pid file is put. The init.d script # will not stop the server if you change this. pidfile /var/run/slapd/slapd.pid # List of arguments that were passed to the server argsfile /var/run/slapd/slapd.args # Read slapd.conf(5) for possible values loglevel -1 # Where the dynamically loaded modules are stored modulepath /usr/lib/ldap moduleload back_hdb moduleload back_relay moduleload rwm # The maximum number of entries that is returned for a search operation sizelimit 500 # The tool-threads parameter sets the actual amount of cpu's that is used # for indexing. tool-threads 1 allow bind_anon_cred bind_anon_dn update_anon backend hdb #backend <other> overlay rwm rwm-rewriteEngine on # Virtual maps # # map ou=staff,dc=cch to dc=dighum # database relay suffix "ou=staff,dc=cch,dc=kcl,dc=ac,dc=uk" relay "dc=dighum,dc=kcl,dc=ac,dc=uk" overlay rwm rwm-suffixmassage "dc=dighum,dc=kcl,dc=ac,dc=uk" ####################################################################### # Specific Directives for database dighum # database hdb suffix dc=dighum,dc=kcl,dc=ac,dc=uk rootdn "cn=admin,dc=dighum,dc=kcl,dc=ac,dc=uk" rootpw "CENSORED" directory "/var/lib/ldap" dbconfig set_cachesize 0 2097152 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 index objectClass eq lastmod on checkpoint 512 30 ####################################################################### # ACLs # access to attrs=userPassword,shadowLastChange by peername.path="/var/run/slapd/ldapi" write by dn="cn=admin,dc=dighum,dc=kcl,dc=ac,dc=uk" write by anonymous auth by self write by * none access to dn.base="" by * read access to * by peername.path="/var/run/slapd/ldapi" write by dn="cn=admin,dc=dighum,dc=kcl,dc=ac,dc=uk" write by self write by * read ####################################################################### # Specific Directives for database #2, of type 'other' (can be @BACKEND@ too): #database <other> #suffix "dc=debian,dc=org" -- Tim Watts Personal Blog: http://www.dionic.net/tim/

4 10

authentication problem
by Chris 21 Jun '12

21 Jun '12

Hi I use openldap to do authentication on RHEL 6 machines. The problem I'm having is that 2 users doesn't get authenticated. When I do a getent passwd for these users it is as if they doesn't exist but a "ldapsearch -x" shows them. I would appreciate it if someone can point me int the right direction.

4 6

Replication and acl: moddn operation problem.
by Konstantin Menshikov 20 Jun '12

20 Jun '12

Hi. I have replication setup . Full replication of o=company, but user for replication (uid=replica,ou=users,o=company) is limited by ACL. Master configuration: access to dn.subtree="ou=users,o=company" attrs=userPassword by anonymous auth access to dn.base="o=company" by dn.exact="uid=replica,ou=users,o=company" read access to dn.subtree="ou=dev,o=company" by dn.exact="uid=replica,ou=users,o=company" read ####################################################################### # BDB database definitions ####################################################################### database hdb suffix "o=company" rootdn "cn=ldapadm,o=company" rootpw password directory /var/db/openldap-data/o=company overlay syncprov Slave configuration: ####################################################################### # BDB database definitions ####################################################################### database hdb suffix "o=company" rootdn "cn=ldapadm,o=company" rootpw password directory /var/db/openldap-data/o=company syncrepl rid=001 provider=ldap://ro1.devel.ldap.company.ru:389 type=refreshAndPersist retry="5 10 300 +" searchbase="o=company" scope=sub schemachecking=off starttls=critical bindmethod=simple tls_reqcert=never binddn="uid=replica,ou=users,o=company" credentials="password" Replication works. When i move object in forbidden by ACL subtree, then no information about this modification goes to the replica server e.g. operation on master server: dn: ou=groups2,ou=dev,o=company changetype: moddn newrdn: ou=groups2 deleteoldrdn: 1 newsuperior: ou=corp,o=company This object is not deleted and contextCSN is not updated on the replica. Is it expected behavior or not? -- Konstantin Menshikov

2 7

adding schema to master
by Stefano Zanmarchi 20 Jun '12

20 Jun '12

Hi, our master slapd (openldap 2.4.26 on RHEL 5.6) has just one slave, same version, not easily modifiable since not directly under our control. We need to have some more attributes in the master and don't need them to be replicated to the slave. Can I safely add a new schema in the slapd.conf of the master, without doing anything to the slave? Thanks a lot for your help, Stefano

2 1

Re: PAM authentication and PPolicy issues
by Clément OUDOT 20 Jun '12

20 Jun '12

2012/6/20 Francesco Belli <Francesco.Belli(a)vegaspace.com>: > Hi Clement, > I already used pam_password directive, I set it to cleartext, but this parameter is used for password change and not for authentication. As man pam_ldap says "Specifies the password change protocol to use", so not the authentication method. Now my situation is that I have some users in the LDAP server that they have a SHA hash in the userPassword field, and they are correctly authenticated, others that have a clear text password and cannot be authenticated via PAM. Password scheme used in LDAP directory do not prevent any application to authenticate to LDAP. Dig into logs to see what is the real reason of your problem. Clément.

4 4

Re: Uniqueness constraint over multiple attributes
by Michael Ströder 20 Jun '12

20 Jun '12

Jan, please follow-up on the mailing list (Cc:-ed) so others can answer and learn as well. Jan Beerden wrote: > We already tried that. We are trying to prevent user1 to have an email alias > that is the same as user2's primary email address. > [..] > What we would like is that a certain value (email address) has to be unique > across both the email and the alias attribute. Uniqueness is only per attribute. So this is not possible. Ciao, Michael.

1 0

Sun(oracle) directory server to openldap
by Stanislas LEVEAU 20 Jun '12

20 Jun '12

Hi I wonder if someone has already migrated from a Sun DSEE to openldap and establishment of a replication from SUN DSEE to openldap. thanks in advance Regards -- *Stanislas LEVEAU** *Rectorat de Caen 168, rue Caponière B.P. 6184 14061 CAEN Cedex Direction des Systèmes d'Information de l'Académie de Caen Département des infrastructures stanislas.leveau(a)ac-caen.fr Tel : 02.31.30.17.86

4 4

Binding to openldap fails
by Bjoern Wuest 20 Jun '12

20 Jun '12

Hello, I have OpenLDAP running on Ubuntu 12.04 . I use it as central directory for authentication as well as contact list. Authentication with LDAP works - locally and remotely. Also authentication via samba (run on same server as OpenLDAP) works. However, setting up the mail system (dovecot + postfix) I encountered a problem new to me. When I try to bind as a "normal" user (here: bjoern) to LDAP it fails with wrong credentials. I can assure that I did not mistyped the password (tried multiple times). Login to the Linux system and samba with same credentials (i.e. bjoern and his password) works. Here is the part of syslog I expect to be the cause: Jun 17 19:36:45 server slapd[23241]: <<< dnPrettyNormal: <cn=bjoern,ou=Users,dc=domain,dc=my>, <cn=bjoern,ou=users,dc=domain,dc=my> Jun 17 19:36:45 server slapd[23241]: conn=1003 op=0 BIND dn="cn=bjoern,ou=Users,dc=domain,dc=my" method=128 Jun 17 19:36:45 server slapd[23241]: do_bind: version=3 dn="cn=bjoern,ou=Users,dc=domain,dc=my" method=128 Jun 17 19:36:45 server slapd[23241]: Jun 17 19:36:45 server slapd[23241]: ==> hdb_bind: dn: cn=bjoern,ou=Users,dc=domain,dc=my Jun 17 19:36:45 server slapd[23241]: bdb_dn2entry("cn=bjoern,ou=users,dc=domain,dc=my") Jun 17 19:36:45 server slapd[23241]: daemon: epoll: listen=8 active_threads=0 tvp=zero Jun 17 19:36:45 server slapd[23241]: => hdb_dn2id("cn=bjoern,ou=users,dc=domain,dc=my") Jun 17 19:36:45 server slapd[23241]: daemon: epoll: listen=9 active_threads=0 tvp=zero Jun 17 19:36:45 server slapd[23241]: daemon: epoll: listen=10 active_threads=0 tvp=zero Jun 17 19:36:45 server slapd[23241]: daemon: epoll: listen=11 active_threads=0 tvp=zero Jun 17 19:36:45 server slapd[23241]: <= hdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30987) Jun 17 19:36:45 server slapd[23241]: send_ldap_result: conn=1003 op=0 p=3 Jun 17 19:36:45 server slapd[23241]: send_ldap_result: err=49 matched="" text="" Jun 17 19:36:45 server slapd[23241]: send_ldap_response: msgid=1 tag=97 err=49 As I configure OpenLDAP "old school" with slapd.conf, here is the ACL set in slapd.conf: access to attrs=userPassword,shadowLastChange,sambaLMPassword,sambaNTPassword by anonymous auth by self write by * none access to * by dn="cn=root,dc=domain,dc=my" write by * read access to dn.base="" by * read Googling for the above "DB_NOTFOUND", the only hint I could find were wrong file permissions. As I have setup my system for quick backup / restore I gave it a try and did "chmod -R 777 /" and also disabled apparmor. Yet, there was no difference in the error message. Could you please give me any indication for a solution? Mit freundlichen Grüßen / Kind regards Bjoern Wuest Hausener Strasse 6a 82269 Geltendorf Mobile: +49 1522 8777840

3 4

TLS issues when setting olcTLSCACertificateFile to the CA bundle
by Patrick Hemmer 20 Jun '12

20 Jun '12

Whenever I set olcTLSCACertificateFile to /etc/pki/tls/certs/ca-bundle.crt LDAP clients get cert errors connecting to the server. But it works fine when I point olcTLSCACertificateFile at the actual server cert instead of the CA bundle. With olcTLSCACertificateFile pointed at /etc/pki/tls/certs/ca-bundle.crt: CLIENT: # LDAPTLS_CACERT=/etc/pki/tls/certs/ca-bundle.crt ldapsearch -H 'ldap://fqdn.to.my.server' -ZZ -x -b '' -s base '+' ldap_start_tls: Connect error (-11) additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (unable to get local issuer certificate) SERVER (from "slapd -d conns"): TLS: can't accept: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca. Why is this happening. olcTLSCACertificateFile is supposed to control the certificates that OpenLDAP will recognize, not affect the certificate it gives to clients (right?). This is OpenLDAP 2.4.31 -Patrick

5 8

PAM authentication and PPolicy issues
by Francesco Belli 20 Jun '12

20 Jun '12

Hi Everybody, I'm have some RHEL6 machines that use an LDAP server to authenticate. I need to introduce in the server some checks on passwords using PPolicy. PPolicy works fine, the problem is that to use pwdCheckQuality and pwdInHistory I need to save passwords in clear text in the LDAP server. I did a search to find out if there is a way to let PAM to use clear text password to authenticate but it seems that it sends SHA hashes, so authentication fails. Do you have any suggestion? Thanks, Francesco

2 1

autogenerated/virtual attributes
by btb＠bitrate.net 19 Jun '12

19 Jun '12

given an entry such as: dn=cn=abuse,ou=example.net,ou=mail,ou=groups,dc=example,dc=com objectclass=mailgroup cn=abuse member=uid=jdoe,ou=people,ou=accounts,dc=example,dc=com i'd like the entry to also include an attribute, generated automatically, based on the rdn of the entry and the superior's rdn. for example: dn=cn=abuse,ou=example.net,ou=mail,ou=groups,dc=example,dc=com objectclass=mailgroup cn=abuse member=uid=jdoe,ou=people,ou=accounts,dc=example,dc=com maillocaladdress=abuse(a)example.com where maillocaladdress is the automatically generated attribute. is this possible? it seems like something an overlay might accommodate, so i thought i might try experimenting with slapo-rwm, but wanted to also ask here in the meantime. thanks -ben

3 4

How does slapd get "secret" for a DN?
by ctosgh 19 Jun '12

19 Jun '12

Greetings, As section 15.2.3 in http://www.openldap.org/doc/admin24/sasl.html said "The server's copy of the shared-secret may be stored in Cyrus SASL's own sasldb database, in an external system accessed via saslauthd, or in LDAP database itself" How does slapd know where the secret is stored? Does slapd try each place in a predefined sequence? Thanks, Jacky

2 1

LDAP Educational Resources
by Roger Martinez 18 Jun '12

18 Jun '12

Hello all, Does anyone have any websites that they can recommend for a simple "getting started" approach to configuring OLC configuration of LDAP? I'm stuck at trying to figure out how to add my own DIT (dc=example,dc=net) so that i can add entries to it. Any guidance will be much appreciated. And thanks to Quanah and Nick for replying to my last request for help! -- Roger Martinez Intern incNETWORKS, inc.

2 2

syncrepl in refreshOnly mode, why nentries=0?
by Warren Howard 18 Jun '12

18 Jun '12

Dear All, I have a single provider and a single consumer setup. The consumer is set up to do syncrepl of type=refreshOnly and everything looks to be in order i.e. comparing the output of ldapsearch for provider and consumer shows that the directories are in sync. When I look at the logs on the provider I see that at times when there is "nothing to do" (the directories are in sync) that nentries=0 in the SEARCH RESULT from the syncrepl connection initiated by the consumer. Then, for example, when one new entry is on the provider, I see nentries=1 in the SEARCH RESULT when the consumer connects. So for syncrepl, nentries represents the difference in entries between the provider and the consumer. But this is not what I expected to find, I expected nentries from a syncrepl connection to match nentries from an equivalent (i.e. same search parameters) ldapsearch connection. Is my logic wrong and if so why? Regards, Warren.

2 3

contextCSN wanished on 2.3 consumers
by Turbo Fredriksson 18 Jun '12

18 Jun '12

Everything was working yesterday, I had upgraded my provider and two consumers to 2.4.31 and got a Nagios test working - all four consumers (two 2.4.31 and two 2.3.43 which can't/won't be upgraded at this time for various reasons) where all in sync. Their contextCSN mached perfectly. I got in this morning, showed of (with some pride :) the Nagios checks etc to my co workers. Started working on other things and a few minutes later another coworker came in complaining that the Nagios tests showed that the two 2.3 servers where 10 days old! Looking at the contextCSN on all servers showed that they where (suddenly!!) missing from the 2.3 servers. And No one have been fiddeling with the config or the database. Any idea what could have happened and how to fix it? -- ... but you know as soon as Oracle starts waving its wallet at a Company it's time to run - fast. /illumos mailing list

1 0

GCC 4.7
by Turbo Fredriksson 17 Jun '12

17 Jun '12

Has anyone tried compile OpenLDAP with gcc 4.7? Is there any speed increase noticed? Gcc 4.7 'is supposed' to make applications up to 50% faster, so... ? -- ... but you know as soon as Oracle starts waving its wallet at a Company it's time to run - fast. /illumos mailing list

1 0

Re: Problem with slapo-lastbind => segfault
by Mark Goldenstein 17 Jun '12

17 Jun '12

Hello, I'm trying to set up LDAP to track the last login of users via the slapo-lastbind overlay. I'm using the the OpenLDAP package supplied with Ubuntu 10.04 LTS. I've cloned the git repository referenced on openldap.org, switched to the lastbind directory in contrib and then ran make and make install. Then I've copied the lastbind.so* and lastbind.la files to /usr/lib/ldap and adjusted the permissions accordingly. Afterwards, I've added lastbind to cn=module to load the module. However, slapd does not start anymore and I get the following error in syslog: kernel: [2716850.919891] slapd[15422]: segfault at 6 ip 00007f0e1555ba36 sp 00007fff70b26118 error 4 in libc-2.11.1.so[7f0e15435000+17a000] Am I doing something wrong? Best regards, Mark

2 2

Monitoring 2.3.43?
by Turbo Fredriksson 16 Jun '12

16 Jun '12

First of: I know it's old, we ARE going to upgrade at the next service interval in a few weeks! But in the meantime, is there any way to know/figure out if the master and it's slave(s) are in sync? One idea, of using a special object which is written to every x minute and then checked for consistency came up... Of course it's not a nice solution, but it is A solution... The reason for this is that yesterday our secondary LDAP server (the primary read server) stopped returning queries (might be a file lock or open filehandles problem - exact reason unknown for the moment). And for some reason, the primary LDAP server (the one we use for writes, the sync master) had an old version of the database - we THINK it happened at the last power failure in that serverroom. It brought up an old version (bdb problems possibly). So the failover to the master worked, but it was to old. And i didn't manage to do a recover on the failed bdb database. Luckily we had a SECOND replica in another city (which was in sync with the changes we did just a few hours earlier), so I did a dump of that database and loaded the primary replica (the one that failed/hung/crashed) with that. But the fact that the replica master and the slaves where out of sync worries us a little. This will be fixed correctly with an upgrade, but until then we would like to have at least _some_ way of checking the status of the sync... Any ideas for a quick hack? -- ... but you know as soon as Oracle starts waving its wallet at a Company it's time to run - fast. /illumos mailing list

6 10

Access Log: dynamic configuration problems.
by Francesco Belli 15 Jun '12

15 Jun '12

Hello everybody, I'm using OpenLdap version 2.4.24 (4 Oct 2011) on a RedHat 6 machine. I use dynamic configuration and I'm having some problems setting up accesslog overlay. I didn't change the following file in etc/openldap/slapd.d/cn=config/ : olcDatabase={-1}frontend.ldif olcDatabase={0}config.ldif olcDatabase={1}monitor.ldif I moved olcDatabase={2}bdb.ldif to olcDatabase={3}bdb.ldif, in this way it is loaded after the access log database that is defined in the new olcDatabase={2}bdb.ldif Here there are the two configuration files: ######### olcDatabase={2}bdb.ldif ############### dn: olcDatabase={2}bdb objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {2}bdb olcDbDirectory: /var/lib/ldap/accesslog/ olcSuffix: cn=accesslog olcAccess: {0}to dn.subtree="cn=accesslog" by dn.exact="uid=manager,ou=Users,dc=domain,dc=com" manage by dn.exact="cn=config" read olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=accesslog olcSizeLimit: unlimited olcTimeLimit: unlimited olcMonitoring: TRUE olcDbCacheSize: 10000 olcDbCheckpoint: 64 5 olcDbNoSync: FALSE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 10000 olcDbIndex: entryCSN eq olcDbIndex: objectClass eq olcDbIndex: reqEnd eq olcDbIndex: reqResult eq olcDbIndex: reqStart eq olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 ######### olcDatabase={3}bdb.ldif ############### dn: olcDatabase={3}bdb objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {3}bdb olcSuffix: dc=domain,dc=com olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=Manager, dc=domain,dc=com olcRootPW: pippopippo olcSyncUseSubentry: FALSE olcMonitoring: TRUE olcDbDirectory: /var/lib/ldap olcDbCacheSize: 1000 olcDbCheckpoint: 1024 15 olcDbNoSync: FALSE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 0 olcDbIndex: objectClass pres,eq olcDbIndex: cn pres,eq,sub olcDbIndex: uid pres,eq,sub olcDbIndex: uidNumber pres,eq olcDbIndex: gidNumber pres,eq olcDbIndex: mail pres,eq,sub olcDbIndex: ou pres,eq,sub olcDbIndex: loginShell pres,eq olcDbIndex: sn pres,eq,sub olcDbIndex: givenName pres,eq,sub olcDbIndex: memberUid pres,eq,sub olcDbIndex: nisMapName pres,eq,sub olcDbIndex: nisMapEntry pres,eq,sub olcDbIndex: entryCSN eq olcDbIndex: entryUUID eq olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 structuralObjectClass: olcBdbConfig entryUUID: 9ef24df8-376a-1031-947f-692d47ac0213 creatorsName: cn=config createTimestamp: 20120521082800Z entryCSN: 20120521082800.652940Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20120521082800Z olcOverlay: syncprov olcSpCheckpoint: 50 10 olcSpSessionlog: 100 olcOverlay: accesslog olcAccessLogDB: cn=accesslog olcAccessLogOps: writes olcAccessLogSuccess: TRUE olcAccessLogPurge: 07+00:00 01+00:00 When I run slapd -d 1 I obtain the following error that makes slapd to terminate: backend_startup_one: starting "cn=accesslog" bdb_db_open: warning - no DB_CONFIG file found in directory /var/lib/ldap/accesslog/: (2). Expect poor performance for suffix "cn=accesslog". bdb_db_open: database "cn=accesslog": dbenv_open(/var/lib/ldap/accesslog/). backend_startup_one: starting "dc=domain,dc=com" bdb_db_open: warning - no DB_CONFIG file found in directory /var/lib/ldap: (2). Expect poor performance for suffix "dc=domain,dc=com". bdb_db_open: database "dc=domain,dc=com": dbenv_open(/var/lib/ldap). accesslog: "logdb <suffix>" missing or invalid. backend_startup_one (type=bdb, suffix="dc=domain,dc=com"): bi_db_open failed! (1) slapd shutdown: initiated It seems that for some reason slapd doesn't like the olcAccessLogDB directive specified in olcDatabase={3}bdb.ldif. I tried some other configuration (I think that this is the more correct) but the problem is always there. Thanks for any help, Francesco

2 1

Re: syncrepl, version compatibility, partial sync
by Quanah Gibson-Mount 14 Jun '12

14 Jun '12

--On Thursday, June 14, 2012 11:00 AM -0700 Ryan Lovett <relovett(a)gmail.com> wrote: > > On Thu, Jun 14, 2012 at 10:55 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> > wrote: > > > --On Thursday, June 14, 2012 10:31 AM -0700 Ryan Lovett > <relovett(a)gmail.com> wrote: > > Are there any known syncrepl compatibility issues between different 2.4.x > versions? We have a master slapd running 2.4.9 and a consumer running > 2.4.21 and are having a syncrepl problem and only some of the data is > being synced. The consumer slapd logs messsages of the form: > > > a) Always run the same versions everywhere > > b) Both of those versions are out of date, and have known issues with > syncrepl. > > c) Upgrade to 2.4.31. > > > > > > I see, thanks for your feedback. We had been hoping we could rely on our > vendor's (Ubuntu LTS; 8.04 and 10.04) releases. I'll build from source. a) Please keep replies on the list b) Read <http://www.openldap.org/faq/data/cache/1456.html> from Debian c) Link to OpenSSL when you build your own d) Read <http://www.openldap.org/software/release/changes.html> --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 1

Re: syncrepl, version compatibility, partial sync
by Quanah Gibson-Mount 14 Jun '12

14 Jun '12

--On Thursday, June 14, 2012 11:00 AM -0700 Ryan Lovett <relovett(a)gmail.com> wrote: > > On Thu, Jun 14, 2012 at 10:55 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> > wrote: > > > --On Thursday, June 14, 2012 10:31 AM -0700 Ryan Lovett > <relovett(a)gmail.com> wrote: > > Are there any known syncrepl compatibility issues between different 2.4.x > versions? We have a master slapd running 2.4.9 and a consumer running > 2.4.21 and are having a syncrepl problem and only some of the data is > being synced. The consumer slapd logs messsages of the form: > > > a) Always run the same versions everywhere > > b) Both of those versions are out of date, and have known issues with > syncrepl. > > c) Upgrade to 2.4.31. > > > > > > I see, thanks for your feedback. We had been hoping we could rely on our > vendor's (Ubuntu LTS; 8.04 and 10.04) releases. I'll build from source. Please keep replies on-list. Thanks. You may wish to read: <http://www.openldap.org/faq/data/cache/1456.html> written by one of the Debian OpenLDAP maintainers. I also suggest reading: <http://www.openldap.org/software/release/changes.html> Finally, when you go to build it yourself, I highly recommend linking to OpenSSL, rather than GnuTLS. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

syncrepl, version compatibility, partial sync
by Ryan Lovett 14 Jun '12

14 Jun '12

Are there any known syncrepl compatibility issues between different 2.4.x versions? We have a master slapd running 2.4.9 and a consumer running 2.4.21 and are having a syncrepl problem and only some of the data is being synced. The consumer slapd logs messsages of the form: entries have identical CSN ou=something,dc=something 20120614015145.546743Z#000000#000#000000 and syncrepl_entry: rid=200 entry unchanged, ignored (ou=other,dc=something) syncrepl_message_to_entry: rid=200 mods check (objectClass: value #8 invalid per syntax) do_syncrepl: rid=200 rc 21 retrying (9 retries left) In searching for similar reports we came across various solutions such as making sure the provider URI in the consumer's slapd.conf matches the server's URI at launch. The server was listening on ldap:/// and the consumer was set to connect to ldap://server.name/ though we modified the server to only listen on ldap://server.name/. We also tried stopping both consumer and master, flushing the databases on both, slapadding data back into the master, then starting both instances. The log messages return however just with updated CSN stamps. The consumer is never able to pull down the full data even with refreshAndPersist with sensible retry intervals. Thanks for your time, Ryan

2 1

loglevel expected performance impact
by Berend De Schouwer 14 Jun '12

14 Jun '12

I'm running some 2.4.23 servers, and I've encountered some slowdown on loglevel other than 0. Even 256 (stats; recommended) impacts about a 4x slowdown on queries. Logging is to syslog. Running ldapsearch slows from 0.005-0.010 seconds to about 0.030-0.040 seconds; and that includes loading the binary. That's from localhost to remove potential DNS lookups. I stumbled across this when logging was wrong, and the slowdown was 100x. I'm aware that 2.4.23 isn't the latest version. I'm also quite happy, for now, to run loglevel 0. I'm wondering if this is the expected behaviour, given that it's the recommended configuration. Or should I go dig to find the slowdown? (I did check the indexes, and db_stats, etc. All seems fine.) I apologise for the disclaimer, Berend CONFIDENTIALITY NOTICE The contents of and attachments to this e-mail are intended for the addressee only, and may contain the confidential information of Argility (Proprietary) Limited and/or its subsidiaries. Any review, use or dissemination thereof by anyone other than the intended addressee is prohibited. If you are not the intended addressee please notify the writer immediately and destroy the e-mail. Argility (Proprietary) Limited and its subsidiaries distance themselves from and accept no liability for unauthorised use of their e-mail facilities or e-mails sent other than strictly for business purposes.

3 3

OLC Configuration on RHEL6
by Roger Martinez 12 Jun '12

12 Jun '12

Greetings all, I've only just recently learned about configuring and using LDAP using slapd.conf configuration. Recently, however, I have been asked to configure LDAP on a server running Red Hat Enterprise Linux 6. I've run into a few problems. First of all, when I try to connect via LDAP Browser/Editor to view the cn=config list, it connects but gives me Error 32 - No Such Object. The following is the the cfg file that Ldap Browser/Editor uses to connect to the session: ################################# # # # LDAP Browser v2.8 config file # # # # cn=config all attributes # # # ################################# host=[my server's IP address] port=389 sslport=636 basedn=cn=config version=3 managerdn=cn=Manager,cn=config managerlogin=no autoconnect=no leafindicatortype=int leafindicator=numsubordinates managereferrals=no supportsmovetree=no derefaliases=never sorttree=ascending ldap.attributes.list=* + The managerdn i got from the olcRootDN line in olcDatabase={2}bdb.ldif file. And the rest i got from zytrax.com online book ( http://www.zytrax.com/books/ldap/ch14/cn=config.cfg ) My question is, is there any other configuration or any other additional steps that I need to take after yum install in order to make this LDAP server functional? What have I missed? Any help will be much appreciated! Thank you. -- Roger Martinez Intern incNETWORKS, inc.

3 3

attrs=@objectClassName affects objectClass attribute
by Nick Milas 12 Jun '12

12 Jun '12

I am facing the following problem (with v2.4.31 on CentOS 5.8). I am using a - recently added - custom schema with one AUX objectclass and 3 optional attrs; I am trying to use an ACL of the form: access to dn.subtree="ou=people,dc=example,dc=com" attrs=@entryAccessEntities by group/groupOfNames/member.exact="cn=Admins,ou=groups,dc=example,dc=com" read but strangely this ALSO changes the privileges for the objectClass attribute of the entry! If I list the attrs of that object class instead, there is no problem: access to dn.subtree="ou=people,dc=example,dc=com" attrs=writeAccessEntities,readAccessEntities,searchAccessEntities by group/groupOfNames/member.exact="cn=Admins,ou=groups,dc=example,dc=com" read Now, the ACL works correctly, and it does not affect the entry objectClass attribute. Surprisingly, this does not happen with other object classes. If I use, for example: access to dn.subtree="ou=people,dc=example,dc=com" attrs=@eduPerson by group/groupOfNames/member.exact="cn=Admins,ou=groups,dc=example,dc=com" read then, it correctly assigns privileges to only the attrs of eduPerson object class (also an AUX class with only optional attrs), without affecting the entry objectclass attribute. Does anyone have an idea what is happening? Am I doing anything wrong? Any help will be appreciated. For reference I include the schema below. Note: I am using dynamic config, but I have listed schema and ACLs in their "standard" form, for better readability. Thanks, Nick ===================================================== entryaccess.schema ===================================================== attributetype ( 1.3.6.1.4.1.39349.4.1.11 NAME 'writeAccessEntities' DESC 'DNs of Groups which should be allowed write (full) access to this entry' SUP distinguishedName ) attributetype ( 1.3.6.1.4.1.39349.4.1.12 NAME 'readAccessEntities' DESC 'DNs of Groups which should be allowed read (read-only) access to this entry' SUP distinguishedName ) attributetype ( 1.3.6.1.4.1.39349.4.1.13 NAME 'searchAccessEntities' DESC 'DNs of Groups which should be allowed search (search-only) access to this entry' SUP distinguishedName ) objectclass ( 1.3.6.1.4.1.39349.4.2.101 NAME 'entryAccessEntities' DESC 'Allow access to the entry, to which this class is added, to the entities specified as the values (DNs) of this class attributes' SUP top AUXILIARY MAY ( writeAccessEntities $ readAccessEntities $ searchAccessEntities ) ) =====================================================

6 13

slapd hangs - subtree insert failed: -30995
by Meike Stone 11 Jun '12

11 Jun '12

Hello, after inserting (ADD) one object, I get following messages in the logfile and the sapld hangs: Jun 1 09:02:24 ldap-01 slapd[8836]: conn=633789 op=1 ADD dn="cn=3,cn=2,cn=node,cn=1,cn=BBB,cn=AAA,cn=companies,ou=root" Jun 1 09:02:24 ldap-01 slapd[8836]: => bdb_idl_insert_key: c_get failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30995) Jun 1 09:02:24 ldap-01 slapd[8836]: => bdb_dn2id_add 0x205e7e: subtree (cn=BBB,cn=AAA,cn=companies,ou=root) insert failed: -30995 After this, I don't see any messages in the log till the staff was initiating a stop/start: Jun 1 09:09:29 ldap-01 slapd[8836]: daemon: shutdown requested and initiated. Jun 1 09:09:29 ldap-01 slapd[8836]: conn=633113 fd=9 closed (slapd shutdown) Jun 1 09:09:29 ldap-01 slapd[8836]: conn=405426 fd=12 closed (slapd shutdown) Jun 1 09:09:29 ldap-01 slapd[8836]: conn=633787 fd=13 closed (slapd shutdown) Jun 1 09:09:29 ldap-01 slapd[8836]: conn=1011 fd=14 closed (slapd shutdown) Jun 1 09:09:29 ldap-01 slapd[8836]: conn=1013 fd=18 closed (slapd shutdown) Jun 1 09:09:29 ldap-01 slapd[8836]: conn=632703 fd=33 closed (slapd shutdown) Jun 1 09:09:29 ldap-01 slapd[8836]: conn=632710 fd=37 closed (slapd shutdown) Jun 1 09:09:29 ldap-01 slapd[8836]: conn=632883 fd=39 closed (slapd shutdown) Jun 1 09:09:29 ldap-01 slapd[8836]: conn=632762 fd=40 closed (slapd shutdown) Jun 1 09:09:29 ldap-01 slapd[8836]: conn=633211 fd=41 closed (slapd shutdown) Jun 1 09:09:29 ldap-01 slapd[8836]: conn=633735 fd=45 closed (slapd shutdown) Jun 1 09:09:29 ldap-01 slapd[8836]: conn=632829 fd=47 closed (slapd shutdown) Jun 1 09:09:29 ldap-01 slapd[8836]: conn=633170 fd=48 closed (slapd shutdown) Jun 1 09:09:29 ldap-01 slapd[8836]: conn=633200 fd=50 closed (slapd shutdown) Jun 1 09:09:29 ldap-01 slapd[8836]: conn=633788 fd=55 closed (slapd shutdown) Jun 1 09:09:29 ldap-01 slapd[8836]: slapd shutdown: waiting for 22 operations/tasks to finish Jun 1 09:09:42 ldap-01 slapd[20945]: @(#) $OpenLDAP: slapd 2.4.30 $ opensuse-buildservice(a)opensuse.org Jun 1 09:09:43 ldap-01 slapd[20945]: slapd starting After the error message at 09:02:24 the slapd did not answer any request. I cannot recover that problem in a test environment. The server is running in a MM environment (two masters), and the server gets 200-1200 search request/s Because of this high rate, we set "loglevel 0". Since we updated the slapd to 2.4.30 (from 2.4.28) the server crashes/hangs about on times a week. Because of this we set loglevel 256 back again. Would be very nice, if I can fix the problem, please help. Thanks in advance Meike PS: The slapd is a modified, self compiled version because of larger IDL with following changes: openldap-2.4.30/servers/slapd/back-bdb/idl.h: -#define BDB_IDL_LOGN 16 /* DB_SIZE is 2^16, UM_SIZE is 2^17 */ +#define BDB_IDL_LOGN 17 /* DB_SIZE is 2^17, UM_SIZE is 2^18 */ openldap-2.4.30/include/ldap_pvt_thread.h: -# define LDAP_PVT_THREAD_STACK_SIZE ( 1 * 1024 * 1024 * sizeof(void *) ) +# define LDAP_PVT_THREAD_STACK_SIZE ( 2 * 1024 * 1024 * sizeof(void *) ) All tests where running well!

1 2

LDAP backend filtering
by Smarti9＠gmx.de 11 Jun '12

11 Jun '12

Hi everybody, I'm quite new to openldap and I'm currently trying to find a solution for the following problem: To populate an address book I need to read users and some attributes from an Active Directory. I need to map several attributes to a new attribute name. More important is to filter on active users and skip the disabled ones. My address book application is not able to do this, it can simply query the whole AD. My idea was to use openldap as some kind of proxy between the application and the AD. I've setup openldap with the following configuration: database ldap suffix "dc=xxxx,dc=local" uri "ldap://192.168.50.1" rebind-as-user protocol-version 3 overlay rwm rwm-map attribute uid samaccountname rwm-map attribute address street This works perfect for getting the data out of the AD and remap the attribute names. Unfortunately I wasn't able to restrict the results to active users. The query string which does this looks like this: "(&(objectClass=User)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))" Can anyone please point me to the right direction how I can set this as a filter towards the AD to only get back the results matching this filter? Thanks a lot to everyone for your help! Michael -- NEU: FreePhone 3-fach-Flat mit kostenlosem Smartphone! Jetzt informieren: http://mobile.1und1.de/?ac=OM.PW.PW003K20328T7073a

2 1

back-sql slow searches
by Martijn van Duren 08 Jun '12

08 Jun '12

Hello, I'm currently setting up a postgresql database which parts need to be accesible through LDAP. The initial setup turned out great. I can bind to my user accounts and I can dump the database through ldapsearch. The problem I'm currently facing is that searches take to long. The ldap_entries table currently contains 3563 entries and searching for any attribute (even when it's part of the dn) takes about 1.25 minutes, which seems rather long for a db backend. Looking at my postgresql logs it appears that when a search is being done every relation gets fully retrieved and most likely filtered in slapd. Is there a certain configuration option I've missed to speed up the searches or is this something I can view as a bug. Thanks for your response.

1 0

Migrating 2.4 issue
by Luc MAIGNAN 07 Jun '12

07 Jun '12

Hi, I try to upgrade openldap to 2.4. Considering the documentation on my new freshly installed server on which I've restored the slapd.conf of a previous server, I try : slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d This gives me this issue : bdb_db_open: database "dc=domain,dc=com": db_open(/var/lib/ldap/id2entry.bdb) failed: No such file or directory (2). backend_startup_one (type=bdb, suffix="dc=domain,dc=com"): bi_db_open failed! (2) I've found on internet that I can safely ignore this, but it doesn't really work (slapd doesn't want to start correctly after) How can I fix it ? Thanks for any help Regards

2 1

Syncrepl replication does not work always
by Efstathios Xagoraris 07 Jun '12

07 Jun '12

Hello to everyone, I have a working OpenLDAP setup ( 2.3.43 - Centos 5.8 RPM ) with a Master LDAP and consumers worldwide across datacenters. I also monitor if directories from Consumers are in Sync with the master. Consumers sometimes fail to communicate with master ldap and replicate.Syncrepl retry interval does not work at that time. If i restart consumer LDAP service everything works as expected,changes replicate successfully. My consumer interval is 1 minute but when the directories are not in sync i dont see syncrepl messages in my logs. My logs: Jun 7 02:22:12 xxx slapd[26433]: do_syncrep2: rid 007 LDAP_RES_SEARCH_RESULT (Normal ...) Jun 7 02:23:12 xxx slapd[26433]: do_syncrep2: rid 007 LDAP_RES_SEARCH_RESULT (Normal ...) >From now on .. syncrepl does not appear on logs, i got only that line Jun 7 02:27:22 xxx slapd[26433]: do_syncrep1: rid 007 ldap_sasl_bind_s failed (-1) I restart ldap service and everything works as expected Jun 7 17:06:40 xxx slapd[4397]: syncrepl_entry: rid 007 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Jun 7 17:06:40 xxx slapd[4397]: syncrepl_entry: rid 007 be_search (0) Jun 7 17:06:42 xxx slapd[4397]: do_syncrep2: rid 007 LDAP_RES_SEARCH_RESULT Jun 7 17:07:44 xxx slapd[4397]: do_syncrep2: rid 007 LDAP_RES_SEARCH_RESULT Jun 7 17:08:45 xxx slapd[4397]: do_syncrep2: rid 007 LDAP_RES_SEARCH_RESULT My consumers config: syncrepl rid=007 provider=ldaps://master:636 bindmethod=simple binddn="cn=xxx,dc=xxx,dc=xxx" credentials=xxxx searchbase="dc=xxx,dc=xxx" scope=sub schemachecking=on #type=refreshAndPersist #retry="30 20 60 +" type=refreshOnly interval=00:00:01:00 updateref ldaps://master And my master config: database bdb suffix "dc=xxx,dc=xxx" rootdn "cn=xxx,dc=xxx,dc=xxx" rootpw {SSHA}xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx directory /var/lib/ldap index objectClass eq,pres index ou,cn,mail,surname,givenname,gecos,description eq,pres,sub index uidNumber,gidNumber,uniqueMember,homeDirectory,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub loglevel 256 16384 logfile /var/log/ldap.log overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 At the same time,when my directories are not in sync,my consumer in the same datacenter as the master is always in sync.This is fixed when i restart ldap service on consumers.Replication works for some hours after the restart and the interval consumers do not replicate is kind of random. Maybe a network issue as passing through firewall to reach consumers in other datacenters ? I have also tried changing the type of syncrepl to refreshAndPersist and the issue still exists. It seems this issue is similar to this ( http://www.openldap.org/lists/openldap-technical/200905/msg00024.html ) but i thought pull bashed syncrepl from refreshOnly should not be impacted from states being dropped. << This sort of problem with long-lived connections is often due to state being dropped from IP-level devices. >> Thanks a lot everyone

3 3

there is no schema by the directory
by Daniel Peinado Lopez 07 Jun '12

07 Jun '12

Hello, I have installed openldap in Fedora. First I deleted the openldap installation. (var/lib/ldap and etc/openldap) Then I wrote: yum reinstall openldap-client openldap-server openldap I configured slapd.conf with my domain, the root password with slappasswd, ldap.conf with my BASE and HOST. I copied the DB_CONFIG.example to /var/lib/ldap. I did my base.ldif of the structure of my LDAP and "ldapadd" everything succesfully. I use jXplore and Apache Directory Studio to manage my LDAP from Windows, because it´s installed in one server. The problem is that when I try to add users it says I have no schema. Apache Directory Studio creates its own schema, and I can add data. But after that schema disapears and I can't work with jXplorer. Thank you very much * * Daniel Peinado López *IANT - APPLIED NGN-TECHNOLOGIES **Turn-Key VoIP/UC Solutions and More... *Fon: +49 (5331) 6794 400 Fax: +49 (5331) 6794 499 Mail: daniel.peinado(a)iant.de <jan.schumacher(a)iant.de> Web: www.iant.de <http://www.iant.de/en/startseite> IANT is eZuce <http://www.ezuce.com/> Elite Partner for EMEA IANT is Member of GROUPLINK <http://www.grouplink.de/>

2 1

bind as users logging/authenticating into solaris with ldap client configured
by curious penguin 07 Jun '12

07 Jun '12

My solaris machine is configured to authenticate to an openldap server but is currently binding anonymously. How do I reconfigure its ldap client to bind as the user that its trying to query from the ldap server?

1 0

Pass-though Authentication with Saslauthd and Kerberos
by Jeff B 06 Jun '12

06 Jun '12

I'm attempting to get pass-though auth to work against saslauthd and kerberos and while the problem seems to be in sasl I think it's most likely to be seen in this type of configuration with opendap which I why I chose this mailing list. When I run testsaslauthd it works but when I run ldapsearch it fails. But the curious thing is where it is failing. in doing straces of saslauthd and packet traces I've found that when ldapsearch calls salsauthd, and not when I run saslauthd kerberos does not deliver the AS-REP packets till just after saslauthd times out. I can't find any difference in how I'm invoking saslauthd with testdaslauthd and how ldapsearch is invoking saslauthd. However the packet traces are quite different as you will see below. I've seen these kind of errors here and there on google but no resolutions that I can find. (http://www.openldap.org/lists/openldap-software/200602/msg00278.html) Centos 6 openldap-2.4.23-15.el6_1.3.x86_64 openldap-clients-2.4.23-15.el6_1.3.x86_64 openldap-servers-2.4.23-15.el6_1.3.x86_64 openldap-devel-2.4.23-15.el6_1.3.x86_64 krb5-server-1.9-9.el6_1.2.x86_64 krb5-server-ldap-1.9-9.el6_1.2.x86_64 krb5-workstation-1.9-9.el6_1.2.x86_64 krb5-libs-1.9-9.el6_1.2.x86_64 cyrus-sasl-2.1.23-8.el6.x86_64 cyrus-sasl-lib-2.1.23-8.el6.x86_64 cyrus-sasl-gssapi-2.1.23-8.el6.x86_64 cyrus-sasl-plain-2.1.23-8.el6.x86_64 cyrus-sasl-devel-2.1.23-8.el6.x86_64 My slapd.conf contains nothing regarding kerberos / sasl / pass-through authentication. I'm using a slapd.conf file for the time being till i get it all worked out and plan on converting it to a cn=config configuration. In my DIT the userPassword field contains: {SASL}myuser@MYREALM where myuser and my realm are replaced with the proper values. /etc/sasl2/slapd.conf: mech_list: plain pwcheck_method: saslauthd saslauthd_path: /var/run/saslauthd/mux /etc/sysconfig/saslauthd KRB5_KTNAME=/etc/krb5.keytab SOCKETDIR=/var/run/saslauthd MECH=kerberos5 Which builds a daemon command line of: /usr/sbin/saslauthd -m /var/run/saslauthd -a kerberos5 My system keytab is: /etc/krb5.keytab (root.ldap 0640) host/my.hostname@realm ldap/my.hostname@realm My socket parent dir is: /var/run/saslauthd (root.ldap 0770) When I run testsaslauthd I get a packet trace between saslauthd and kerberos is all UDP and works: > AS-REQ < KRB5KDC_ERR_PREAUTH_REQUIRED (25) > AS-REQ < AS-REP > TGS-REQ < TGS-REP When I run ldapsearch the packet trace between saslauthd and kerberos is UDP and TCP communication. None of the kerberos replies come back for 18 seconds, the time it takes saslauthd to time out. > AS-REQ < KRB5KDC_ERR_PREAUTH_REQUIRED (25) > AS-REQ > TCP SYN < TCP SYN, ACK > TCP ACK > TCP AS-REQ < TCP ACK > AS-REQ > AS-REQ > TCP FIN, ACK <-- saslauthd times out and the AS-REPS all come back at once. < AS-REP < AS-REP < AS-REP < TCP AS-REP > TCP RST an strace of saslauthd supports this timeout theory as it shows the the timeouts and backoffs. I can't find any info regarding saslauthd and TCP or UDP or timeouts like this. Any ideas?

5 7

Wildcard and Internal Domain
by Leonardo 06 Jun '12

06 Jun '12

Dear Colleagues. I attempted implementing certificates with wildcard to my internals servers. I have a Internal Certification Authority and it certificate was distributed to ours Browsers on Workstations that have a need to access the servers by Web Browser. I generated a certificate with wildcard for my servers and when i access the servers by web browser the following message is showed "O servidor v221t001.prevnet usa um certificado de segurança inválido. O certificado é válido somente para *.prevnet. (Código do erro: ssl_error_bad_cert_domain)". I would like some help to solve it problem. I thank everyone for attention.

2 3

slaptest conversion of acl regex's drops backslashes
by Nick Milas 06 Jun '12

06 Jun '12

Hi, I used slaptest to convert a set of ACLs from standard to dynamic format using slaptest. I noticed that backslashes (used to escape characters) in regexes are silently dropped after conversion. For example: access to dn.regex="^dc=\b\d{1,3}\.\d{1,3}\.\d{1,3}\b\.in-addr\.arpa,ou=dns,dc=example,dc=com$" by group.exact="cn=Admins,ou=Groups,dc=example,dc=com" write becomes: olcAccess: {xx}to dn.regex="^dc=\b\d{1,3}\.\d{1,3}\.\d{1,3}\b\.in-addr\.arpa,ou=dns,dc=example,dc=com$" by group/groupOfNames/member.exact="cn=admins,ou=groups,dc=noa,dc=gr" write Is this expected behavior? Or am I doing something wrong? Please advise. Thanks, Nick

2 6

ACL rule match if client certificate was used?
by Patrick Hemmer 06 Jun '12

06 Jun '12

Is there any way to create an ACL rule which will match if a client certificate was used on the connection or not? I'd like to do an ACL such as to attrs=userPassword by peername.ip="1.2.3.0%255.255.255.0" auth by client_ssf="64" auth Also set olcTLSVerifyClient=try This will let our internal network authenticate against ldap without needing a client cert, but anyone outside our internal network must have one. We would then use our own CA to create certificates for all the clients and tell OpenLDAP to trust only that CA. Obviously client_ssf doesnt exist, but is there another way of accomplishing this goal? -Patrick

3 4

openldap gssapi bind
by Sajid K 05 Jun '12

05 Jun '12

hi, i'm writing an AD client for mac i'm able to get a kerberos ticket and can also bind to AD using ldap_gssapi_bind and everything works fine I can do searches modify/create attributes etc. when I unbind and try to bind to a different server, it hangs in a "select" call inside openldap lib. even though I've successfully got a TGS ticket before binding. I'm using heimdal for kerberos implementation. I also have cyrusSASL in the project. in one of my test environments it tries to go back to old "server" to get ticket. so I'm assuming there is some sort of caching involved here. before rebinding I always delete the credential cache file and krb5.conf and re create them for new server. I'm not using an conf file with openldap. What could be going on is there some kind of caching somewhere in library? there are no errors when unbinding and I can also see a call getting to server when I unbind. Thanks..

3 2

Re: Replication and user password change
by Hugo Deprez 04 Jun '12

04 Jun '12

Hello, I am trying to do some quite the same thing : trying to send failed authentification made on the consumer to the master. I am using ppolicy overlay. I added the following to the consumer : # Referal updateref ldaps://master.domain.fr ppolicy_forward_updates When I add this on the consumer, accounts are not anymore locked on failed authentification. pwdFailureTime are not register or sent to the master.. Should I use slapo-chain too ? Regards, Hugo On 6 April 2012 18:12, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Friday, April 06, 2012 3:57 PM +0200 Jacques Foucry > <jacques.foucry(a)novasparks.com> wrote: > >> On 04/04/2012 05:59 PM, anax wrote: >> >> Hello, >> >>> updateref ldap://ldapmaster.symas.com >>> >>> http://www.openldap.org/doc/admin24/replication.html#Replication%20Techn >>> ology >> >> >> Well after reading the docs, I made some test on a VM. >> >> My goal is to allow users to change there password. >> >> I have a working replication VM. On this VM I can login with my LDAP >> password (PAM on this VM is client of the replica). >> >> When I try to change the password, using the passwd cmd this error occurs: > > > I suggest you look at slapo-chain. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

3 4

ACL control with break
by Nick Milas 04 Jun '12

04 Jun '12

At slapd.access we read (about the control keywords): One useful application is to easily grant write privileges to an updatedn that is different from the rootdn. In this case, since the updatedn needs write access to (almost) all data, one can use access to * by dn.exact="cn=The Update DN,dc=example,dc=com" write by * break as the first access rule. As a consequence, unless the operation is performed with the updatedn identity, control is passed straight to the subsequent rules. I have the following question. If below the above ACL we add another ACL like: access to dn.subtree="ou=people,dc=example,dc=com" by dn.exact="cn=Some Other DN,dc=example,dc=com" by * none ...doesn't this mean that the second ACL will override the first, so that "The Update DN" will no longer have access to the whole DIT (as was intended), since, based on the second ACL, "The Update DN"does not have access to "ou=people" branch? If this is the case, then the first ACL is not enough, but care must be taken to avoid any privilege revocation(s) from "The Update DN", by following ACLs. Or the existence of the former rule means that access has been *definitively decided* for "The Update DN" (i.e. "by" clause match(es) in the first ACL) and any subsequent access statements (later ACLs) can affect *ONLY* other users (i.e. whatever "by" clause matches, *except* "The Update DN")?? This is what I understand from the statement "As a consequence, unless the operation is performed with the updatedn identity, control is passed straight to the subsequent rules." Can you please clarify which is the case? Thanks, Nick

3 9

Syncrepl partial replication based on attribute problem
by Jeffrey Crawford 02 Jun '12

02 Jun '12

Hello, I had thought I tested this beforehand but I seem to be able to reliably reproduce the following situation: We have an installation where the provider server has information that is replicated to downstream replicas using the syncrepl protocol. The account used to replicate is allowed to see records where certain attributes meet specific values, a silly example is an attribute is set dn: uid=somerecord,ou=people,dc=ucsc,dc=edu replicateMe: TRUE ... When an account has that attribute set it then replicates to the downstream replica, however if later we set replicateMe to FALSE so that the account used for replication can no longer see the entry, it seems to be orphaned and is not removed in the replica. We are using OpenLDAP 2.4.26 and I have the syncprov sessionlog set to 500 and the replica is set to refreshAndPersist. Is this something that is simply not supported? or would a case like this be expected to work and I've either got a configuration issue or a bug? Thanks Jeffrey

3 7

Several questions on Openldap for migration
by Francois Gnu 02 Jun '12

02 Jun '12

Hello everybody, First of all, sorry in advance for my approximate English. I have several questions. Questions for which I did not find answer until today, despite one very large number of reading of docs, faqs, tickets etc. (I did not necessarily read everything, internet is so vast). Presentation: I have to migrate all the servers of the company, from ubuntu 10.04.3lts (package openldap 2.4.21) to ubuntu 12.04lts (package openldap 2.4.28). Configuration: Configuration of openldap, identical on all the servers (Masters and Slaves), configuration of dynamic type (with cn=config ), with reference ldap Masters in the config of slaves ; syncrepl (N-Way) Multi-Master mode. All servers are VMs on kvm. Questions: Questions according to several scenarios: - there are problems of synchronization between 2 Masters, if the one is in 2.4.21 and the other one in 2.4.28? - there are problems of synchronization between 2 servers, if 1 Master is in 2.4.21 and 1/severals Slave(s) in 2.4.28? - there are problems of synchronization between 2 servers, if 1 Master is in 2.4.28 and 1/several Slaves in 2.4.21? - I want to do an update of part of the slaves servers. What it is better to use?: acl or in syscrepl? Which is the most flexible? MDB backend: - can one use now the backend-mdb new in "production mode" with openldap 2.4.28? Is it with good/enough stability? Or do I have to stay with the backend-hdb and migrate towards backend-mdb later? - Is it pisible to migrate from backend-hdb towards backend-mdb for server in production, in the future? Tcmalloc: - I placed tcmalloc in this file '/etc/init.d/slapd' as this "LD_PRELOAD=/usr/lib/libtcmalloc_minimal.so.0". Is it good? Is it the good place/file? - where can I find track of its load (of tcmalloc)? How can I see the functioning of tcmalloc? In what file of log? The LSOF command no give nothing. - it is indicated in the site "[URL="http://code.google.com/r/heybrowny-higmysql/source/browse/google-perftools-…"]http://code.google.com/.../google-perftools-1.8.3/README[/URL]" > "TCMALLOC_DEBUG=<level> -- the higher level, the more messages malloc emits". It is indicated that more the number increase and more tcmalloc verbose. But it is not indicated/informed has what corresponds the numeros (levels) of log and until how much? -to use "TCMALLOC_DEBUG", I have to use "LD_PRELOAD=/usr/lib/libtcmalloc_minimal_debug.so.0" or keep "LD_PRELOAD=/usr/lib/libtcmalloc_minimal.so.0"? Backups and restore: -the opinions diverge. Indeed, to make a backup/restore, slapadd command is enough with the file created with slapcat? Or i need to integrate (with slapadd) at first the config file (cn=config file) and then the acl config file and then the data of the users that were created at the first installation of openldap 2.4.21? So, I installed and configured openldap in 2005 on a debian for the needs of a company but today many things changed and difficult to find itself there. Thank you in advance for taking time and your answers. Francois ------ Librement

1 0

dsaOperation attributes, relax control and syncrepl
by Clément OUDOT 01 Jun '12

01 Jun '12

Hello, an attribute declared 'dsaOperation' in the schema is not replicated with Syncrepl, this behavior was coded some years ago and it seems right. Today, I updated such attribute (pwdFailureTime) with the relax control and noticed the modification has been replicated. I just wanted to know if this behavior was expected with the relax control, or if this is an issue (the test was done with OpenLDAP 2.4.31). Thanks, Clément OUDOT.

2 3

About not enoguh space - unable to allocate memory for transaction detail
by emiliano ricci 01 Jun '12

01 Jun '12

Hello. I have this error: unable to allocate memory for transaction detail - not enoguh space when I try to modify an entry. Any help? Regards Emiliano

1 0

shadowMax
by zingalo 31 May '12

31 May '12

good morning, I've a question about password managing in ldap with samba. I've seen that samba schema's attributes don't have effect on password managing. Only shadowAccount's attribute do it. So i changed shadowMax to "0" for a user and at the next login it tells me "You are required to change your password immediately (password aged) LDAP administrator password: " After entering ldap admin's password it tells me "Authentication token manipulation error". Why? the admin'password is correct, am sure Thanks

2 3

Re: ~*~ [spam] Re: OpenLDAP freeze
by Quanah Gibson-Mount 30 May '12

30 May '12

--On Wednesday, May 30, 2012 7:35 PM +0300 Ioan Indreias <indreias(a)gmail.com> wrote: >> One other thing I would note is that you have failed to provide your >> OpenLDAP configuration (either slapd.conf for a slapcat -n 0 of your >> cn=config DB). > > Actually I have provided the slapd.conf file in my first mail - please > find attached what I have sent at that time. Please keep replies on the list. I looked back at the start of the thread and didn't see any attachments. In any case, I have the following comments and questions. Comments: a) Why are you setting serverID? You aren't doing MMR, or if you are, you have not configured it correctly (There is no mirrormode line set). b) Get rid of the filters=... line in syncrepl config. Just use the default. c) Your attrs=... line in the syncrepl config is invalid. Remove it and just use the default. Questions: a) What kind of filesystem is /storage, where you are storing the databases? b) if you remove the "logold" line from your accesslog configuration, do the deadlocks still occur? --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Attributes host and personal (mail, telephone...)
by Carlos Barrero Martínez 30 May '12

30 May '12

Good afternoon to all! I am a newbie and I'm installing and configuring my first ldap server for my company. I want to use LDAP as an authentication method on my intranet ( Drupal) and as authentication for ssh. I have read that's what I need to have the attribute 'host' but this attribute is incompatible with 'person', so I can not have fields (name, surname, phone, email) and host. Can you help solve it? Thank you very much!

2 1

Very quick pointer
by Tim Watts 30 May '12

30 May '12

Hi :) My LDAP skillz are (very) slowly coming along - thanks to good folk here, I think I have figured out ACLs and I have managed to get rwm/relay to emulate an old tree structure (well enough) whilst being able to design a better structure for our department. My next question is just a request for a pointer. My understanding of LDAP authentication is very limited. What I would like to do is a 2 phase transition to kerberos (which I do understand): 1) Rig OpenLDAP so all password changes get sent to the kerberos server but do not use it for authentication. In the meantime we will continue authenticate with the SSHA1 hashes in the user's LDAP entry. 2) After some time (months) when everyone has eventually done a password change, the Kerberos server will be well enough in sync. Now I would like to switch OpenLDAP to using kerberos on the backend (ie for binds etc) and I will purge the SSHA1 hashes. ================== I most interested in some pointers for stage 1) is someone could be kind enough to help me out - is there a particular name for this mechanism, or a module that handles this kind of stuff? ================== 2) I think I can probably google for myslef (keywords SASL and/or GSSAPI and/or LDAP+Kerberos. I've had a skim but did not notice an obvious way to handle 1) without 2) I apologise if it's a dumb question :-o Many thanks in advance :) Cheers Tim -- Tim Watts Personal Blog: http://www.dionic.net/tim/

6 11

Re: Attributes host and personal (mail, telephone...)
by Carlos Barrero Martínez 30 May '12

30 May '12

Thank you for your answer. I'm reading the book published by O'Reilly, LDAP System Administration. However, the world of LDAP is very large and used for many tasks. I am creating my content tree and I can define it in many ways. And I know how to do it or not. Only that. I'm not that person who prefers to ask to learn. Still, thanks! 2012/5/30 Turbo Fredriksson <turbo(a)bayour.com> > On Wed, 30 May 2012 16:58:54 +0200, Carlos Barrero Martínez wrote: > >> Thank you Turbo. >> >> I'm going to see this page to learn more about ldap. However... can >> you tell me how can I do it (attributes host and personal attributes)? >> > > I can, but I'm not going to... And the reason is that LDAP is _way_ to > complicated to teach in a mail or two... > > You really (really, really!!) need to get to the grips on the basics before > you continue. And the others on the list will basically tell you the same > thing. We've all been through this so many times before... > > My HOWTO, but mostly my book, is designed for this specific purpose - teach > beginners the basics and then some. > >

1 0

Re: Attributes host and personal (mail, telephone...)
by Carlos Barrero Martínez 30 May '12

30 May '12

Thank you Turbo. I'm going to see this page to learn more about ldap. However... can you tell me how can I do it (attributes host and personal attributes)? Thanks! 2012/5/30 Turbo Fredriksson <turbo(a)bayour.com> > On Wed, 30 May 2012 15:46:37 +0200, Carlos Barrero Martínez wrote: > >> I am a newbie and I'm installing and configuring my first ldap server >> for my company. >> > > Have a look at http://www.bayour.com/LDAPv3-**HOWTO.html<http://www.bayour.com/LDAPv3-HOWTO.html> > -- > ... but you know as soon as Oracle starts waving its wallet at a Company > it's time to run - fast. > /illumos mailing list >

1 0

acl filter using attribute memberof
by Dorit 30 May '12

30 May '12

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical