- openldap-technical - openldap.org

Multi-Master Replication
by Brian Carpio 30 May '12

30 May '12

Hi, I'm currently using Ubuntu 10.04 (I've set this up on RHEL 5.x but the config is way different in Ubuntu). Anyway, at first I figured I had everything working. When I made an update to ldap01 I immediately saw the change on ldap02. However, if I take down slapd on ldap02 (or 01) and I add LDAP entries into ldap01, then bring ldap02's slapd process back online I never see the entries created while slapd was down on ldap02. New entries continue to propigate between ldap01 and ldap02 and long as both servers have the slapd process running, but the entries created when slapd was down on ldap02 never propagate to 02. Here are my configs and ldap versions: ii slapd 2.4.21-0ubuntu5.7 OpenLDAP server (slapd) ---- /etc/ldap/slapd.d/cn=config/olcDatabase={0}config.ldif ----- # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 deacdc79 dn: olcDatabase={0}config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth manage by * break olcAccess: {1}to attrs=userPassword,shadowLastChange by self write by anonymou s auth by dn="cn=admin,dc=example,dc=net" write by * none olcAccess: {2}to * by self write by dn="cn=admin,dc=example,dc=net" write b y * read structuralObjectClass: olcDatabaseConfig entryUUID: 19eb3cc6-3898-1031-954c-351a2fbb42e9 creatorsName: cn=config createTimestamp: 20120522202605Z olcSyncrepl: {0}rid=001 provider="ldap://ldap-01:389" type=refreshAndPer sist retry="5 5 300 +" searchbase="cn=config" attrs="*,+" bindmethod=simple b inddn="cn=admin,dc=example,dc=net" credentials="secret" olcSyncrepl: {1}rid=002 provider="ldap://arch-ldap-02:389" type=refreshAndPer sist retry="5 5 300 +" searchbase="cn=config" attrs="*,+" bindmethod=simple b inddn="cn=admin,dc=example,dc=net" credentials="secret" olcMirrorMode: TRUE entryCSN: 20120528195647.027315Z#000000#000#000000 modifiersName: cn=admin,dc=example,dc=net modifyTimestamp: 20120528195647Z ---- /etc/ldap/slapd.d/cn=config/olcDatabase={0}config/olcOverlay={0}syncprov.ldif ---- # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 807029fa dn: olcOverlay={0}syncprov objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpNoPresent: TRUE structuralObjectClass: olcSyncProvConfig entryUUID: 3be00cb6-3dee-1031-8f60-519aa1b6f74f creatorsName: cn=admin,dc=example,dc=net createTimestamp: 20120529152514Z entryCSN: 20120529152514.987191Z#000000#000#000000 modifiersName: cn=admin,dc=example,dc=net modifyTimestamp: 20120529152514Z ---- /etc/ldap/slapd.d/cn=config/olcDatabase={1}hdb.ldif ---- # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 1b0a3130 dn: olcDatabase={1}hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=example,dc=net olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymou s auth by dn="cn=admin,dc=example,dc=net" write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by self write by dn="cn=admin,dc=example,dc=net" write b y * read olcLastMod: TRUE olcRootDN: cn=admin,dc=example,dc=net olcRootPW:: e1NTSEF9Ni9IZWJCczRTbmJQYlc4NHFOMWxHWUI5NVNoVUl4U20= olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq structuralObjectClass: olcHdbConfig entryUUID: 19ebfdc8-3898-1031-9554-351a2fbb42e9 creatorsName: cn=config createTimestamp: 20120522202605Z olcSyncrepl: {0}rid=001 provider="ldap://ldap-01:389" type=refreshAndPer sist retry="5 5 300 +" searchbase="dc=example,dc=net" attrs="*,+" bindmeth od=simple binddn="cn=admin,dc=example,dc=net" credentials="secret" olcSyncrepl: {1}rid=002 provider="ldap://ldap-02:389" type=refreshAndPer sist retry="5 5 300 +" searchbase="dc=example,dc=net" attrs="*,+" bindmeth od=simple binddn="cn=admin,dc=example,dc=net" credentials="secret" olcMirrorMode: TRUE entryCSN: 20120528195647.026244Z#000000#000#000000 modifiersName: cn=admin,dc=example,dc=net modifyTimestamp: 20120528195647Z ----- /etc/ldap/slapd.d/cn=config/olcDatabase={1}hdb/olcOverlay={0}syncprov.ldif ---- # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 807029fa dn: olcOverlay={0}syncprov objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpNoPresent: TRUE structuralObjectClass: olcSyncProvConfig entryUUID: 3be00cb6-3dee-1031-8f60-519aa1b6f74f creatorsName: cn=admin,dc=example,dc=net createTimestamp: 20120529152514Z entryCSN: 20120529152514.987191Z#000000#000#000000 modifiersName: cn=admin,dc=example,dc=net modifyTimestamp: 20120529152514Z

2 1

Re: OpenLDAP freeze
by Ioan Indreias 29 May '12

29 May '12

Are there any chances to have your feedback on the information provided? Best regards, Ioan On Fri, May 18, 2012 at 11:25 AM, Ioan Indreias <indreias(a)gmail.com> wrote: > Hello all, > > We are running OpenLDAP in a SLAVE-MASTER configuratiorn (Slave for > another OpenLDAP server //L1// and Master for 2 Axigen Back End nodes > //B1 and B2//). > > Currently we have ~31000 accounts and experience random freeze events > of the slapd (nothing writing in the logs, CPU 0%) when a series of > add/delete operations are performed over the normal LDAP > traffic.Random means an interval between 15 and 80 minutes after we > start add/delete accounts. > > The add/delete bash script is running in loop, adding 60 accounts, > sleep 20 sec, delete the accounts and sleep another 40 sec. All > operations are performed on the MASTER L1 server and are propagated > correctly to our server (till is freezing of course). > > Running with 2.4.23 we have considered to upgrade to 2.4.31 but the > same problem was observed. On both cases we have used BDB 4.7.25, with > all available patches. > > The server is a RHEL 5.5, 64 bits with plenty of memory and CPUs. > > I am attaching 3 archives: the slapd configuration and gdb+db_stat for > 2 freeeze events. > > Could somebody point if there is a slapd or bdb problem? Any hints are > appreciated. > > Best regards, > Ioan Indreias > www.modulo.ro > > === > May 18 09:37:10 saevrvmp11 slapd[13834]: @(#) $OpenLDAP: slapd 2.4.31 > (May 10 2012 16:11:06) $ > root@host64.modulo.ro:/root/openldap-2.4.31/servers/slapd > > [root@host tmp]# ldd /usr/sbin/slapd > libuuid.so.1 => /lib64/libuuid.so.1 (0x0000003efe000000) > libssl.so.6 => /lib64/libssl.so.6 (0x0000003f05400000) > libcrypto.so.6 => /lib64/libcrypto.so.6 (0x0000003f00800000) > libresolv.so.2 => /lib64/libresolv.so.2 (0x0000003f01800000) > libpthread.so.0 => /lib64/libpthread.so.0 (0x0000003efb800000) > libc.so.6 => /lib64/libc.so.6 (0x0000003efac00000) > /lib64/ld-linux-x86-64.so.2 (0x0000003efa800000) > libgssapi_krb5.so.2 => /usr/lib64/libgssapi_krb5.so.2 > (0x0000003f02800000) > libkrb5.so.3 => /usr/lib64/libkrb5.so.3 (0x0000003f03000000) > libcom_err.so.2 => /lib64/libcom_err.so.2 (0x0000003f01000000) > libk5crypto.so.3 => /usr/lib64/libk5crypto.so.3 (0x0000003f02c00000) > libdl.so.2 => /lib64/libdl.so.2 (0x0000003efb000000) > libz.so.1 => /usr/lib64/libz.so.1 (0x0000003efbc00000) > libkrb5support.so.0 => /usr/lib64/libkrb5support.so.0 > (0x0000003f02400000) > libkeyutils.so.1 => /lib64/libkeyutils.so.1 (0x0000003f02000000) > libselinux.so.1 => /lib64/libselinux.so.1 (0x0000003efc400000) > libsepol.so.1 => /lib64/libsepol.so.1 (0x0000003efc000000) > ===

2 7

UPGRADING OPENLDAP
by Borresen, John - 0442 - MITLL 29 May '12

29 May '12

Planning to upgrade our OpenLDAP from 2.4.23 to 2.4.31 shortly and just getting my ducks in a row. 1) my current Berkeley flavor is 4.8.30 2) As stated, OpenLDAP is 2.4.23 (using slapd.d) Looking for any "gotchas" to be on look out for. Can I do the upgrade on top of the current directory structure, restore the config then restart? Am I going to need to upgrade my flavor of Berkeley? I had originally attempted to use Berkeley 5.2.36 but never could get it to build/compile correctly on my platform (too many compilation errors to list). Dave Borresen Solaris/Linux Systems Administrator Surveillance Systems Group MIT Lincoln Laboratory john.borresen(a)ll.mit.edu

2 1

Replication Design Advice
by Andrei Bănaru 29 May '12

29 May '12

Hello OpenLDAP users, I’m looking for some advice concerning an OpenLDAP solution I’m about to deploy between 4 locations in company I work for. Currently I’ve implemented a LDAP DIT in my country and we’ve had exquisite results. I’ve integrated RADIUS for wireless authentication, MIT Kerberos, Samba PDC, dovecot and the list can continue but that’s not the scope of this message. We have some global services located in one of the countries that all other 3 countries use ( trac, svn, web2project, alfresco ). We want that each country to have it’s own LDAP DIT ( we don’t want to have a global LDAP with slaves in each country because some of us want locally significant objects ( for authorization purposes ) and having a slave LDAP means read-only ). That’s why I thought of using multi-n-master on each of the four LDAP servers. The ideea I had was that each country will have only a portion of the DIT being sent to the others ( we narrow the searchbase in syncrepl ): Country 1 sends ou=COUNTRY-1,dc=example,dc=com Country 2 sends ou=COUNTRY-2,dc=example,dc=com Country 3 sends ou=COUNTRY-3,dc=example,dc=com Country 4 sends ou=COUNTRY-4,dc=example,dc=com In each ou=COUNTRY-{1..4} they will have ou=People and ou=Groups. Basically that’s the only thing I want to be consistent across all LDAP DITs. I’ve tested the solution using some virtual machines and besides the starttls and some things each administrator will have to be cautious about things went smoothly. I've also read something about slapo-translucent - will now test to see how it works. Can I get some suggestions / maybe a whole new architecture for my needs in case I didn’t foresee problems ? Thx! -- Andrei BĂNARU Internal Support CCNA Security, CCIP StreamWIDE Romania

1 0

How do tool verify certs with ldapi:// ?
by Peter Marschall 28 May '12

28 May '12

Hi, how do the openldap tools technically verfify certificates with ldapi:// ? With ldapi, you don't have a hostname or IP address, so how do the openldap tools do it? I tried to browse the code but got losat somewhere ion the way. Any hints to the code or a short step-by-step explanation will help. Background of this question: I want to implement the feature in perl-ldap. Thanks in advance for your help Peter -- Peter Marschall peter(a)adpm.de

3 13

Re: how can make slave use tls to connect to master for syncrepl (solved)
by zhong ming wu 28 May '12

28 May '12

Never mind. I had to put this line in the sysrepl section of the slave starttls=yes Sorry about the noise. On Sun, May 27, 2012 at 10:29 PM, zhong ming wu <mr.z.m.wu(a)gmail.com> wrote: > Hello > > I am using version 2.4 and in the process of setting up a master/slave > pair using syncrepl. > > This is working as expected if I don't have enforce security and > confidentiality with "security ssf=128" global directive in the > master. > As soon as I turn it on, replication stops working. > > It seems that the slave consumer is not using TLS to connect to > master. However I can use 'ldapsearch' with '-ZZ' option to connect > to master from slave and get all records I want. > > On my slave machine, I also have the following directive > > TLS_CACERT /etc/pki/tls/certs/ca.crt.crl > > in ldap.conf > > Notice that without this line 'ldapXXX' commands with '-ZZ' fails from > slave to master. This confirms that at least 'ldap.conf' is in the > correct location at least as far as 'ldapXXX' commands are concerned. > > Can someone point me in the right direction? I have read many > chapters on this page > > http://www.openldap.org/doc/admin24/index.html > > Both slave and master are on centos 6.2 and openldap software is > standard centos rpm. > > Here are the log entries on the master when slave fails to bind with TLS > > May 27 22:14:53 cat slapd[2456]: conn=1000 fd=13 ACCEPT from > IP=192.168.0.2:41083 (IP=0.0.0.0:389) > May 27 22:14:53 cat slapd[2456]: conn=1000 op=0 BIND > dn="cn=root,dc=example,dc=com" method=128 > May 27 22:14:53 cat slapd[2456]: conn=1000 op=0 RESULT tag=97 err=13 > text=confidentiality required > May 27 22:14:53 cat slapd[2456]: conn=1000 op=1 UNBIND > May 27 22:14:53 cat slapd[2456]: conn=1000 fd=13 closed > > Sincerely > > Mr Wu

1 0

OpenLDAP proxy to Active Directory
by Jonathan van der Wat 28 May '12

28 May '12

Greetings, I'm new to OpenLDAP and am trying to implement the following: User authentication (PAM + SSSD) on CentOS Linux servers via OpenLDAP proxy to Active Directory. I am able to perform the following search from the OpenLDAP proxy without any apparent issues: * [root@openldap ~]# ldapsearch -x -h /mydomaincontroller/ -LLL -b dc=msad,dc=inet,dc=com -D cn=ldap,cn=users,dc=msad,dc=inet,dc=com -W '(sAMAccountName=jonathanv)' cn sAMAccountName Enter LDAP Password: dn: CN=jonathan,CN=Users,DC=msad,DC=inet,DC=com cn: jonathan sAMAccountName: jonathanv # refldap://ForestDnsZones.msad.inet.com/DC=ForestDnsZones,DC=msad,DC=inet,DC… # refldap://DomainDnsZones.msad.inet.com/DC=DomainDnsZones,DC=msad,DC=inet,DC… # refldap://msad.inet.com/CN=Configuration,DC=msad,DC=inet,DC=com* However, when asking the OpenLDAP proxy: *[root@openldap ~]# ldapsearch -x -h /localhost/ -LLL -b dc=msad,dc=inet,dc=com -D cn=ldap,cn=users,dc=msad,dc=inet,dc=com -W '(sAMAccountName=jonathanv)' cn sAMAccountName Enter LDAP Password: # refldap://ForestDnsZones.msad.inet.com/DC=ForestDnsZones,DC=msad,DC=inet,DC… # refldap://DomainDnsZones.msad.inet.com/DC=DomainDnsZones,DC=msad,DC=inet,DC… # refldap://msad.inet.com/CN=Configuration,DC=msad,DC=inet,DC=com* Also, I've configured my CentOS server's using SSSD. When trying to authenticate as user jonathanv, I receive a message that user jonathanv is not found. I am using OpenLDAP server version 2.4.23-20. I am starting the OpenLDAP from the command line as follows: *slapd -f -d 2 -f /etc/openldap/slapd.conf -g ldap -h ldap:/// -l LOCAL4 -u ldap -n slapd-ldap* Here is the output of my slapd.conf file: *# # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/corba.schema include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/duaconf.schema include /etc/openldap/schema/dyngroup.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/java.schema include /etc/openldap/schema/misc.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/ppolicy.schema include /etc/openldap/schema/collective.schema # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Load dynamic backend modules # - modulepath is architecture dependent value (32/64-bit system) # - back_sql.la overlay requires openldap-server-sql package # - dyngroup.la and dynlist.la cannot be used at the same time # modulepath /usr/lib/openldap # modulepath /usr/lib64/openldap # moduleload accesslog.la # moduleload auditlog.la # moduleload back_sql.la # moduleload chain.la # moduleload collect.la # moduleload constraint.la # moduleload dds.la # moduleload deref.la # moduleload dyngroup.la # moduleload dynlist.la # moduleload memberof.la # moduleload pbind.la # moduleload pcache.la # moduleload ppolicy.la # moduleload refint.la # moduleload retcode.la moduleload rwm.la # moduleload seqmod.la # moduleload smbk5pwd.la # moduleload sssvlv.la # moduleload syncprov.la # moduleload translucent.la # moduleload unique.la # moduleload valsort.la # The next three lines allow use of TLS for encrypting connections using a # dummy test certificate which you can generate by changing to # /etc/pki/tls/certs, running "make slapd.pem", and fixing permissions on # slapd.pem so that the ldap user or group can read it. Your client software # may balk at self-signed certificates, however. # TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt # TLSCertificateFile /etc/pki/tls/certs/slapd.pem # TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! # enable on-the-fly configuration (cn=config) database config access to * by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * none # enable server status monitoring (cn=monitor) database monitor access to * by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.exact="cn=Manager,dc=my-domain,dc=com" read by * none ####################################################################### # database definitions ####################################################################### database bdb suffix "dc=inet,dc=local" checkpoint 1024 15 rootdn "cn=Manager,dc=inet,dc=local" rootpw xxxxxxxxxxxxxxxx # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret # rootpw {crypt}ijFYNcSNctBYg # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub # Our slapd-ldap back end to connect to AD database ldap suffix "dc=msad,dc=inet,dc=com" #subordinate rebind-as-user uri "ldap://172.16.132.253/" chase-referrals yes overlay rwm rwm-suffixmassage dc=msad,dc=inet,dc=com rwm-map attribute uid sAMAccountName rwm-map attribute cn cn rwm-map attribute displayName displayName rwm-map attribute givenName givenName rwm-map attribute sn sn rwm-map attribute mail mail rwm-map attribute userPassword userPassword rwm-map attribute * rwm-map objectclass inetOrgPerson user # Replicas of this database #replogfile /var/lib/ldap/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com(a)EXAMPLE.COM #* Any ideas as to why I'm unable to authenticate my user against the AD? Any advice or info on this topic would be greatly appreciated. Greetings, Jonathan Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. This email has been scanned for viruses and malware, and automatically archived by Mimecast SA (Pty) Ltd, an innovator in Software as a Service (SaaS) for business. Mimecast Unified Email Management (UEM) offers email continuity, security, archiving and compliance with all current legislation. To find out more, visit http://www.mimecast.co.za/uem-ppc.

2 3

how can make slave use tls to connect to master for syncrepl
by zhong ming wu 28 May '12

28 May '12

Hello I am using version 2.4 and in the process of setting up a master/slave pair using syncrepl. This is working as expected if I don't have enforce security and confidentiality with "security ssf=128" global directive in the master. As soon as I turn it on, replication stops working. It seems that the slave consumer is not using TLS to connect to master. However I can use 'ldapsearch' with '-ZZ' option to connect to master from slave and get all records I want. On my slave machine, I also have the following directive TLS_CACERT /etc/pki/tls/certs/ca.crt.crl in ldap.conf Notice that without this line 'ldapXXX' commands with '-ZZ' fails from slave to master. This confirms that at least 'ldap.conf' is in the correct location at least as far as 'ldapXXX' commands are concerned. Can someone point me in the right direction? I have read many chapters on this page http://www.openldap.org/doc/admin24/index.html Both slave and master are on centos 6.2 and openldap software is standard centos rpm. Here are the log entries on the master when slave fails to bind with TLS May 27 22:14:53 cat slapd[2456]: conn=1000 fd=13 ACCEPT from IP=192.168.0.2:41083 (IP=0.0.0.0:389) May 27 22:14:53 cat slapd[2456]: conn=1000 op=0 BIND dn="cn=root,dc=example,dc=com" method=128 May 27 22:14:53 cat slapd[2456]: conn=1000 op=0 RESULT tag=97 err=13 text=confidentiality required May 27 22:14:53 cat slapd[2456]: conn=1000 op=1 UNBIND May 27 22:14:53 cat slapd[2456]: conn=1000 fd=13 closed Sincerely Mr Wu

1 0

syncrepl for cn=config, changes fail with "tag=103 err=53 text=shadow context; no update referral"
by Elias Probst 28 May '12

28 May '12

Hi List, I'm trying to setup a master/master replication scenario, starting with getting cn=config replicated properly using OpenLDAP 2.4.30 on Gentoo. I've tried to start with a minimal config which is now up and running on both servers. As long as I start only one of both servers I can edit everything in cn=config just fine, but as soon as they both run at the same time, they get into a state which causes some trouble. Even shutting down one of both doesn't help then, I need to start from scratch again at this point. Submitting any changes results in this error message: RESULT tag=103 err=53 text=shadow context; no update referral There are two servers, connected via OpenVPN: ID 1, 10.44.0.1 ID 2, 10.44.0.7 I use the following configuration file to seed the initial online configuration for each server, before bringing them up both, using: slapd -f /tmp/slapd.conf -F /etc/openldap/slapd.d -u ldap -g ldap -d1 moduleload memberof.so moduleload syncprov.so moduleload refint.so include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/openssh.schema TLSCACertificateFile /etc/ssl/slapd/slapd.cacrt TLSCertificateFile /etc/ssl/slapd/slapd.crt TLSCertificateKeyFile /etc/ssl/slapd/slapd.key TLSVerifyClient allow pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args loglevel 256 access to attrs=userPassword by self write by * auth access to * by * read ServerID 1 ldap://10.44.0.1 ServerID 2 ldap://10.44.0.7 backend bdb database config rootdn cn=config rootpw {SSHA}RI/d8i2R7XXlo2+kf2LcYzYOcIry+qaa syncrepl rid=001 provider="ldap://10.44.0.7" binddn="cn=config" bindmethod="simple" credentials="nothingtoseehere" searchbase="cn=config" type=refreshAndPersist retry="10 +" filter="(!(olcDatabase={0}config))" syncrepl rid=002 provider="ldap://10.44.0.1" binddn="cn=config" bindmethod="simple" credentials="nothingtoseehere" searchbase="cn=config" type=refreshAndPersist retry="10 +" filter="(!(olcDatabase={0}config))" overlay syncprov I don't quite understand the error message, as it somehow indicates the servers would be running in shadow context/MirrorMode, which is set to FALSE. So does anyone have an idea, what's wrong with my setup? Thanks a lot! - Elias

5 8

more on migrating from 2.3 to 2.4
by Bobby Krupczak 27 May '12

27 May '12

Hi! I did my nfs/nis/ldap/smb/dns swap this morning. I'm struggling with getting my ldap server to work as before. slapd is running and answering anonymous queries (like logging in and checking passwords) from other machines. >From the slapd host, I can do an ldapsearch (over ssl) and everything works. I authenticate as rootdn just fine. >From a different host, I cant do an ldapsearch; I receive an "invalid creditionals (49)" error. I have enabled debugging in ldapsearch and dont see anything interesting. The server ssl cert verifies fine. No config has changed on my client. I'm thinking its ssl, ipv6, and client cert related or maybe ACLs? In my slapd.conf file, I've put TLSVerifyClient never Any suggestions? slapd is 2.4.26-7.fc16.x86_64 Yes I know I'm running the fedora package. As soon as I can get the machine up and running as before I will start migrating. Thanks, Bobby

1 0

question on syncprov
by Steve Reveliotty 25 May '12

25 May '12

Hi, I'm trying to migrate from OpenLDAP 2.3.43-12.el5_6.7 to OpenLDAP 2.4.23-20.el6.x86_6. In 2.3, we currently have one master, replicating changes to 2 consumers via slurpd. I'm trying to configure 2.4 w/ syncrepl, and have tried using refreshAndPersist to mimic that same routine of pushing changes from the master. I'm getting failures though: on the master: ay 25 13:55:25 slapd[6855]: send_search_entry: conn 1064 ber write failed. May 25 13:55:45 slapd[6855]: send_search_entry: conn 1066 ber write failed. May 25 13:56:45 slapd[6855]: send_search_entry: conn 1068 ber write failed. May 25 13:57:45 slapd[6855]: send_search_entry: conn 1078 ber write failed. May 25 13:58:45 slapd[6855]: send_search_entry: conn 1084 ber write failed. May 25 13:59:05 slapd[6855]: send_search_entry: conn 1086 ber write failed. May 25 13:59:15 slapd[6855]: send_search_entry: conn 1087 ber write failed. on a consumer: May 25 13:45:15 slapd[28707]: do_syncrepl: rid=002 rc 68 retrying (9 retries left) May 25 13:45:25 slapd[28707]: syncrepl_entry: rid=002 be_add cn=XXXXXXX,dc=edu failed (68) here are snippets from the master's slapd.conf and from one of the consumers: master - ------- database hdb include /etc/openldap/slapd.access suffix "dc=XXXXdc=edu" checkpoint 1024 5 cachesize 30000 idlcachesize 90000 rootdn "cn=Manager,XXXXX,dc=edu" # NOTE: "updatedn" MUST BE COMMENTED OUT FOR INITIAL CREATION/LOAD OF # ROOT INFO overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. #rootpw secret # needs to be changed to something someone knows. rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap # Indices to maintain # review these index default pres,eq index uid eq,sub index entryUUID,entryCSN index cn,sn,givenName,ou,mail,telephoneNumber pres,eq,sub index employeeNumber,mailAlternateAddress,eduPersonPrincipalName index eduPersonAffiliation,eduPersonPrimaryAffiliation index objectClass,serialNumber eq index isMemberOf eq,subany TLSCertificateFile /etc/openldap/newcert.pem TLSCertificateKeyFile /etc/openldap/newkey.pem TLSCACertificateFile /etc/openldap/chain.pem consumer - ------------------ database hdb suffix "dc=XXXXX=edu" checkpoint 1024 5 cachesize 30000 idlcachesize 90000 rootdn "cn=Manager,dc=XXXX,dc=edu" # NOTE: "updatedn" MUST BE COMMENTED OUT FOR INITIAL CREATION/LOAD OF # ROOT INFO # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. #rootpw secret # needs to be changed to something someone knows. rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap # Indices to maintain # review these index default pres,eq index uid eq,sub index entryUUID,entryCSN index cn,sn,givenName,ou,mail,telephoneNumber pres,eq,sub index employeeNumber,mailAlternateAddress,eduPersonPrincipalName index eduPersonAffiliation,eduPersonPrimaryAffiliation index objectClass,serialNumber eq index isMemberOf eq,subany TLSCertificateFile /etc/openldap/newcert.pem TLSCertificateKeyFile /etc/openldap/newkey.pem TLSCACertificateFile /etc/openldap/chain.pem syncrepl rid=002 provider=ldap://providername-taken-out-here:389 type=refreshAndPersist retry="10 10 60 +" searchbase="dc=XXXX,dc=edu" filter="(objectClass=*)" attrs="*" scope=sub schemachecking=off bindmethod=simple binddn="cn=Replicator,dc=XXXX,dc=edu" credentials="password" updateref ldap://providername-takenout-here:389 the account I"m using to bind from the consumer has read access to everything on the master. Thanks in advance

2 4

slapd keeps crashing
by David Massie 25 May '12

25 May '12

Our slapd instance keeps crashing. We do not see an obvious reason for the crashes. I am posting the crash report in the hope that someone will see something and can point us in the right direction. Thanks, Dave Massie Duplicate check ===== Common information ===== package ----- architecture ----- x86_64 kernel ----- 2.6.32-220.13.1.el6.x86_64 Additional information ===== uid ----- 0 time ----- 1337786308 executable ----- /var/services/openldap/libexec/slapd component ----- hostname ----- aaaprod-master.uis.georgetown.edu username ----- root reason ----- Process /var/services/openldap/libexec/slapd was killed by signal 6 (SIGABRT) analyzer ----- CCpp maps ----- 00400000-00624000 r-xp 00000000 fd:00 3675557 /var/services/openldap/libexec/slapd 00824000-00831000 rw-p 00224000 fd:00 3675557 /var/services/openldap/libexec/slapd 00831000-008d6000 rw-p 00000000 00:00 0 0104f000-012eb000 rw-p 00000000 00:00 0 012eb000-01441000 rw-p 00000000 00:00 0 394f800000-394f820000 r-xp 00000000 fd:00 1703938 /lib64/ld-2.12.so 394fa1f000-394fa20000 r--p 0001f000 fd:00 1703938 /lib64/ld-2.12.so 394fa20000-394fa21000 rw-p 00020000 fd:00 1703938 /lib64/ld-2.12.so 394fa21000-394fa22000 rw-p 00000000 00:00 0 394fc00000-394fd86000 r-xp 00000000 fd:00 1703939 /lib64/libc-2.12.so 394fd86000-394ff86000 ---p 00186000 fd:00 1703939 /lib64/libc-2.12.so 394ff86000-394ff8a000 r--p 00186000 fd:00 1703939 /lib64/libc-2.12.so 394ff8a000-394ff8b000 rw-p 0018a000 fd:00 1703939 /lib64/libc-2.12.so 394ff8b000-394ff90000 rw-p 00000000 00:00 0 3950000000-3950002000 r-xp 00000000 fd:00 1703950 /lib64/libdl-2.12.so 3950002000-3950202000 ---p 00002000 fd:00 1703950 /lib64/libdl-2.12.so 3950202000-3950203000 r--p 00002000 fd:00 1703950 /lib64/libdl-2.12.so 3950203000-3950204000 rw-p 00003000 fd:00 1703950 /lib64/libdl-2.12.so 3950400000-3950417000 r-xp 00000000 fd:00 1703943 /lib64/libpthread-2.12.so 3950417000-3950616000 ---p 00017000 fd:00 1703943 /lib64/libpthread-2.12.so 3950616000-3950617000 r--p 00016000 fd:00 1703943 /lib64/libpthread-2.12.so 3950617000-3950618000 rw-p 00017000 fd:00 1703943 /lib64/libpthread-2.12.so 3950618000-395061c000 rw-p 00000000 00:00 0 3950800000-395081d000 r-xp 00000000 fd:00 1703962 /lib64/libselinux.so.1 395081d000-3950a1c000 ---p 0001d000 fd:00 1703962 /lib64/libselinux.so.1 3950a1c000-3950a1d000 r--p 0001c000 fd:00 1703962 /lib64/libselinux.so.1 3950a1d000-3950a1e000 rw-p 0001d000 fd:00 1703962 /lib64/libselinux.so.1 3950a1e000-3950a1f000 rw-p 00000000 00:00 0 3951400000-3951416000 r-xp 00000000 fd:00 1703956 /lib64/libresolv-2.12.so 3951416000-3951616000 ---p 00016000 fd:00 1703956 /lib64/libresolv-2.12.so 3951616000-3951617000 r--p 00016000 fd:00 1703956 /lib64/libresolv-2.12.so 3951617000-3951618000 rw-p 00017000 fd:00 1703956 /lib64/libresolv-2.12.so 3951618000-395161a000 rw-p 00000000 00:00 0 3951c00000-3951c15000 r-xp 00000000 fd:00 1703994 /lib64/libz.so.1.2.3 3951c15000-3951e14000 ---p 00015000 fd:00 1703994 /lib64/libz.so.1.2.3 3951e14000-3951e15000 r--p 00014000 fd:00 1703994 /lib64/libz.so.1.2.3 3951e15000-3951e16000 rw-p 00015000 fd:00 1703994 /lib64/libz.so.1.2.3 3952000000-3952007000 r-xp 00000000 fd:00 1703999 /lib64/libcrypt-2.12.so 3952007000-3952207000 ---p 00007000 fd:00 1703999 /lib64/libcrypt-2.12.so 3952207000-3952208000 r--p 00007000 fd:00 1703999 /lib64/libcrypt-2.12.so 3952208000-3952209000 rw-p 00008000 fd:00 1703999 /lib64/libcrypt-2.12.so 3952209000-3952237000 rw-p 00000000 00:00 0 3952400000-395245d000 r-xp 00000000 fd:00 1703997 /lib64/libfreebl3.so 395245d000-395265c000 ---p 0005d000 fd:00 1703997 /lib64/libfreebl3.so 395265c000-395265d000 r--p 0005c000 fd:00 1703997 /lib64/libfreebl3.so 395265d000-395265e000 rw-p 0005d000 fd:00 1703997 /lib64/libfreebl3.so 395265e000-3952662000 rw-p 00000000 00:00 0 3952c00000-3952d6f000 r-xp 00000000 fd:00 1703948 /lib64/libdb-4.7.so 3952d6f000-3952f6e000 ---p 0016f000 fd:00 1703948 /lib64/libdb-4.7.so 3952f6e000-3952f74000 rw-p 0016e000 fd:00 1703948 /lib64/libdb-4.7.so 3953000000-3953019000 r-xp 00000000 fd:00 2361953 /usr/lib64/libsasl2.so.2.0.23 3953019000-3953218000 ---p 00019000 fd:00 2361953 /usr/lib64/libsasl2.so.2.0.23 3953218000-3953219000 r--p 00018000 fd:00 2361953 /usr/lib64/libsasl2.so.2.0.23 3953219000-395321a000 rw-p 00019000 fd:00 2361953 /usr/lib64/libsasl2.so.2.0.23 3953c00000-3953c2a000 r-xp 00000000 fd:00 1703964 /lib64/libk5crypto.so.3.1 3953c2a000-3953e29000 ---p 0002a000 fd:00 1703964 /lib64/libk5crypto.so.3.1 3953e29000-3953e2b000 r--p 00029000 fd:00 1703964 /lib64/libk5crypto.so.3.1 3953e2b000-3953e2c000 rw-p 0002b000 fd:00 1703964 /lib64/libk5crypto.so.3.1 3954000000-3954002000 r-xp 00000000 fd:00 1703952 /lib64/libkeyutils.so.1.3 3954002000-3954201000 ---p 00002000 fd:00 1703952 /lib64/libkeyutils.so.1.3 3954201000-3954202000 r--p 00001000 fd:00 1703952 /lib64/libkeyutils.so.1.3 3954202000-3954203000 rw-p 00002000 fd:00 1703952 /lib64/libkeyutils.so.1.3 3954400000-395440a000 r-xp 00000000 fd:00 1703963 /lib64/libkrb5support.so.0.1 395440a000-3954609000 ---p 0000a000 fd:00 1703963 /lib64/libkrb5support.so.0.1 3954609000-395460a000 r--p 00009000 fd:00 1703963 /lib64/libkrb5support.so.0.1 395460a000-395460b000 rw-p 0000a000 fd:00 1703963 /lib64/libkrb5support.so.0.1 3955800000-395583f000 r-xp 00000000 fd:00 1703977 /lib64/libgssapi_krb5.so.2.2 395583f000-3955a3f000 ---p 0003f000 fd:00 1703977 /lib64/libgssapi_krb5.so.2.2 3955a3f000-3955a40000 r--p 0003f000 fd:00 1703977 /lib64/libgssapi_krb5.so.2.2 3955a40000-3955a42000 rw-p 00040000 fd:00 1703977 /lib64/libgssapi_krb5.so.2.2 3955c00000-3955cd4000 r-xp 00000000 fd:00 1703973 /lib64/libkrb5.so.3.3 3955cd4000-3955ed4000 ---p 000d4000 fd:00 1703973 /lib64/libkrb5.so.3.3 3955ed4000-3955edd000 r--p 000d4000 fd:00 1703973 /lib64/libkrb5.so.3.3 3955edd000-3955edf000 rw-p 000dd000 fd:00 1703973 /lib64/libkrb5.so.3.3 3956800000-3956973000 r-xp 00000000 fd:00 2363773 /usr/lib64/libcrypto.so.1.0.0 3956973000-3956b73000 ---p 00173000 fd:00 2363773 /usr/lib64/libcrypto.so.1.0.0 3956b73000-3956b8c000 r--p 00173000 fd:00 2363773 /usr/lib64/libcrypto.so.1.0.0 3956b8c000-3956b96000 rw-p 0018c000 fd:00 2363773 /usr/lib64/libcrypto.so.1.0.0 3956b96000-3956b9a000 rw-p 00000000 00:00 0 3957800000-3957853000 r-xp 00000000 fd:00 2363947 /usr/lib64/libssl.so.1.0.0 3957853000-3957a53000 ---p 00053000 fd:00 2363947 /usr/lib64/libssl.so.1.0.0 3957a53000-3957a56000 r--p 00053000 fd:00 2363947 /usr/lib64/libssl.so.1.0.0 3957a56000-3957a5b000 rw-p 00056000 fd:00 2363947 /usr/lib64/libssl.so.1.0.0 7f70d8000000-7f70d80e8000 rw-p 00000000 00:00 0 7f70d80e8000-7f70dc000000 ---p 00000000 00:00 0 7f70e0000000-7f70e8000000 rw-p 00000000 00:00 0 7f70e8000000-7f70ed94c000 rw-p 00000000 00:00 0 7f70ed94c000-7f70f0000000 ---p 00000000 00:00 0 7f70f4000000-7f70ffff8000 rw-p 00000000 00:00 0 7f70ffff8000-7f7100000000 ---p 00000000 00:00 0 7f7100000000-7f7100458000 rw-p 00000000 00:00 0 7f7100458000-7f7104000000 ---p 00000000 00:00 0 7f7108000000-7f7110000000 rw-p 00000000 00:00 0 7f7110000000-7f7118000000 rw-p 00000000 00:00 0 7f7118000000-7f711c69d000 rw-p 00000000 00:00 0 7f711c69d000-7f7120000000 ---p 00000000 00:00 0 7f7120000000-7f7124000000 rw-p 00000000 00:00 0 7f7128000000-7f7130000000 rw-p 00000000 00:00 0 7f7130000000-7f7135fe7000 rw-p 00000000 00:00 0 7f7135fe7000-7f7138000000 ---p 00000000 00:00 0 7f7138000000-7f7140000000 rw-p 00000000 00:00 0 7f7140000000-7f7148000000 rw-p 00000000 00:00 0 7f7148000000-7f714fa52000 rw-p 00000000 00:00 0 7f714fa52000-7f7150000000 ---p 00000000 00:00 0 7f7150000000-7f7158000000 rw-p 00000000 00:00 0 7f7158000000-7f715e575000 rw-p 00000000 00:00 0 7f715e575000-7f7160000000 ---p 00000000 00:00 0 7f7160000000-7f7168000000 rw-p 00000000 00:00 0 7f7168000000-7f716c000000 rw-p 00000000 00:00 0 7f716c000000-7f7170000000 rw-p 00000000 00:00 0 7f7170000000-7f7174000000 rw-p 00000000 00:00 0 7f71777ff000-7f7177800000 ---p 00000000 00:00 0 7f7177800000-7f7178000000 rw-p 00000000 00:00 0 7f7178000000-7f717bfff000 rw-p 00000000 00:00 0 7f717bfff000-7f717c000000 ---p 00000000 00:00 0 7f717c000000-7f717cd6a000 rw-p 00000000 00:00 0 7f717cd6a000-7f7180000000 ---p 00000000 00:00 0 7f7180000000-7f7180d78000 rw-p 00000000 00:00 0 7f7180d78000-7f7184000000 ---p 00000000 00:00 0 7f7186fff000-7f7188000000 rw-p 00000000 00:00 0 7f7188000000-7f7188dab000 rw-p 00000000 00:00 0 7f7188dab000-7f718c000000 ---p 00000000 00:00 0 7f718cffd000-7f7190000000 rw-p 00000000 00:00 0 7f7190000000-7f7190d8d000 rw-p 00000000 00:00 0 7f7190d8d000-7f7194000000 ---p 00000000 00:00 0 7f71947fc000-7f71977ff000 rw-p 00000000 00:00 0 7f71977ff000-7f7197800000 ---p 00000000 00:00 0 7f7197800000-7f7198000000 rw-p 00000000 00:00 0 7f7198000000-7f719c000000 rw-p 00000000 00:00 0 7f719c7fb000-7f719e7fd000 rw-p 00000000 00:00 0 7f719e7fd000-7f719e7fe000 ---p 00000000 00:00 0 7f719e7fe000-7f719effe000 rw-p 00000000 00:00 0 7f719effe000-7f719efff000 ---p 00000000 00:00 0 7f719efff000-7f719f7ff000 rw-p 00000000 00:00 0 7f719f7ff000-7f719f800000 ---p 00000000 00:00 0 7f719f800000-7f71a0000000 rw-p 00000000 00:00 0 7f71a0000000-7f71a0d21000 rw-p 00000000 00:00 0 7f71a0d21000-7f71a4000000 ---p 00000000 00:00 0 7f71a4000000-7f71a8000000 rw-p 00000000 00:00 0 7f71a87fa000-7f71a87fb000 ---p 00000000 00:00 0 7f71a87fb000-7f71a8ffb000 rw-p 00000000 00:00 0 7f71a8ffb000-7f71a8ffc000 ---p 00000000 00:00 0 7f71a8ffc000-7f71a97fc000 rw-p 00000000 00:00 0 7f71a97fc000-7f71a97fd000 ---p 00000000 00:00 0 7f71a97fd000-7f71a9ffd000 rw-p 00000000 00:00 0 7f71a9ffd000-7f71a9ffe000 ---p 00000000 00:00 0 7f71a9ffe000-7f71ab7ff000 rw-p 00000000 00:00 0 7f71ab7ff000-7f71ab800000 ---p 00000000 00:00 0 7f71ab800000-7f71ac000000 rw-p 00000000 00:00 0 7f71ac000000-7f71b0000000 rw-p 00000000 00:00 0 7f71b0000000-7f71b133a000 rw-p 00000000 00:00 0 7f71b133a000-7f71b4000000 ---p 00000000 00:00 0 7f71b47fc000-7f71b67fe000 rw-p 00000000 00:00 0 7f71b67fe000-7f71b67ff000 ---p 00000000 00:00 0 7f71b67ff000-7f71b8000000 rw-p 00000000 00:00 0 7f71b8000000-7f71be8e6000 rw-p 00000000 00:00 0 7f71be8e6000-7f71c0000000 ---p 00000000 00:00 0 7f71c0000000-7f71c7ffd000 rw-p 00000000 00:00 0 7f71c7ffd000-7f71c8000000 ---p 00000000 00:00 0 7f71c8000000-7f71d0000000 rw-p 00000000 00:00 0 7f71d0000000-7f71d4000000 rw-p 00000000 00:00 0 7f71d47fb000-7f71d47fc000 ---p 00000000 00:00 0 7f71d47fc000-7f71d4ffc000 rw-p 00000000 00:00 0 7f71d4ffc000-7f71d4ffd000 ---p 00000000 00:00 0 7f71d4ffd000-7f71d67fe000 rw-p 00000000 00:00 0 7f71d67fe000-7f71d67ff000 ---p 00000000 00:00 0 7f71d67ff000-7f71d8000000 rw-p 00000000 00:00 0 7f71d8000000-7f71dc000000 rw-p 00000000 00:00 0 7f71dc000000-7f71e0000000 rw-p 00000000 00:00 0 7f71e0000000-7f71e0021000 rw-p 00000000 00:00 0 7f71e0021000-7f71e4000000 ---p 00000000 00:00 0 7f71e4253000-7f71e5254000 rw-p 00000000 00:00 0 7f71e5254000-7f71e5255000 ---p 00000000 00:00 0 7f71e5255000-7f71e5a55000 rw-p 00000000 00:00 0 7f71e5a55000-7f71e5a56000 ---p 00000000 00:00 0 7f71e5a56000-7f71e7257000 rw-p 00000000 00:00 0 7f71e7257000-7f71e7258000 ---p 00000000 00:00 0 7f71e7258000-7f71ece46000 rw-p 00000000 00:00 0 7f71ece46000-7f71ece4e000 rw-s 00000000 fd:00 3675649 /var/services/openldap/var/openldap-data/__db.006 7f71ece4e000-7f71ed230000 rw-s 00000000 fd:00 3675587 /var/services/openldap/var/openldap-data/__db.005 7f71ed230000-7f71ed470000 rw-s 00000000 fd:00 3675569 /var/services/openldap/var/openldap-data/__db.004 7f71ed470000-7f722d470000 rw-s 00000000 fd:00 3675566 /var/services/openldap/var/openldap-data/__db.003 7f722d470000-7f722f722000 rw-s 00000000 fd:00 3675035 /var/services/openldap/var/openldap-data/__db.002 7f722f722000-7f722f9e3000 rw-p 00000000 00:00 0 7f722f9e3000-7f722f9e7000 r-xp 00000000 fd:00 2360495 /usr/lib64/sasl2/libanonymous.so.2.0.23 7f722f9e7000-7f722fbe6000 ---p 00004000 fd:00 2360495 /usr/lib64/sasl2/libanonymous.so.2.0.23 7f722fbe6000-7f722fbe7000 r--p 00003000 fd:00 2360495 /usr/lib64/sasl2/libanonymous.so.2.0.23 7f722fbe7000-7f722fbe8000 rw-p 00004000 fd:00 2360495 /usr/lib64/sasl2/libanonymous.so.2.0.23 7f722fbe8000-7f722fbec000 r-xp 00000000 fd:00 2364158 /usr/lib64/sasl2/libplain.so.2.0.23 7f722fbec000-7f722fdeb000 ---p 00004000 fd:00 2364158 /usr/lib64/sasl2/libplain.so.2.0.23 7f722fdeb000-7f722fdec000 r--p 00003000 fd:00 2364158 /usr/lib64/sasl2/libplain.so.2.0.23 7f722fdec000-7f722fded000 rw-p 00004000 fd:00 2364158 /usr/lib64/sasl2/libplain.so.2.0.23 7f722fded000-7f722fdf2000 r-xp 00000000 fd:00 2360498 /usr/lib64/sasl2/libsasldb.so.2.0.23 7f722fdf2000-7f722fff1000 ---p 00005000 fd:00 2360498 /usr/lib64/sasl2/libsasldb.so.2.0.23 7f722fff1000-7f722fff2000 r--p 00004000 fd:00 2360498 /usr/lib64/sasl2/libsasldb.so.2.0.23 7f722fff2000-7f722fff3000 rw-p 00005000 fd:00 2360498 /usr/lib64/sasl2/libsasldb.so.2.0.23 7f722fff3000-7f722fff7000 r-xp 00000000 fd:00 2364155 /usr/lib64/sasl2/liblogin.so.2.0.23 7f722fff7000-7f72301f6000 ---p 00004000 fd:00 2364155 /usr/lib64/sasl2/liblogin.so.2.0.23 7f72301f6000-7f72301f7000 r--p 00003000 fd:00 2364155 /usr/lib64/sasl2/liblogin.so.2.0.23 7f72301f7000-7f72301f8000 rw-p 00004000 fd:00 2364155 /usr/lib64/sasl2/liblogin.so.2.0.23 7f72301f8000-7f7230231000 rw-p 00000000 00:00 0 7f7230231000-7f723023d000 r-xp 00000000 fd:00 1704002 /lib64/libnss_files-2.12.so 7f723023d000-7f723043d000 ---p 0000c000 fd:00 1704002 /lib64/libnss_files-2.12.so 7f723043d000-7f723043e000 r--p 0000c000 fd:00 1704002 /lib64/libnss_files-2.12.so 7f723043e000-7f723043f000 rw-p 0000d000 fd:00 1704002 /lib64/libnss_files-2.12.so 7f723043f000-7f7230445000 rw-p 00000000 00:00 0 7f7230445000-7f7230448000 r-xp 00000000 fd:00 1703972 /lib64/libcom_err.so.2.1 7f7230448000-7f7230647000 ---p 00003000 fd:00 1703972 /lib64/libcom_err.so.2.1 7f7230647000-7f7230648000 r--p 00002000 fd:00 1703972 /lib64/libcom_err.so.2.1 7f7230648000-7f7230649000 rw-p 00003000 fd:00 1703972 /lib64/libcom_err.so.2.1 7f7230649000-7f723064d000 rw-p 00000000 00:00 0 7f723064d000-7f7230656000 r-xp 00000000 fd:00 2371184 /usr/lib64/libltdl.so.7.2.1 7f7230656000-7f7230855000 ---p 00009000 fd:00 2371184 /usr/lib64/libltdl.so.7.2.1 7f7230855000-7f7230856000 rw-p 00008000 fd:00 2371184 /usr/lib64/libltdl.so.7.2.1 7f7230856000-7f7230857000 rw-p 00000000 00:00 0 7f7230857000-7f723085d000 rw-s 00000000 fd:00 3674284 /var/services/openldap/var/openldap-data/__db.001 7f723085d000-7f723085e000 rw-p 00000000 00:00 0 7fffe0384000-7fffe0399000 rw-p 00000000 00:00 0 [stack] 7fffe03f9000-7fffe03fa000 r-xp 00000000 00:00 0 [vdso] ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall] cmdline ----- /var/services/openldap/libexec/slapd -h 'ldap://*:389 ldaps://*:636' -f /var/services/openldap/etc/openldap/slapd.conf os_release ----- Red Hat Enterprise Linux Server release 6.2 (Santiago) environ ----- REMOTEHOST=10.212.141.90 HOSTNAME=aaaprod-master.uis.georgetown.edu SELINUX_ROLE_REQUESTED= HOST=aaaprod-master.uis.georgetown.edu TERM=vt100 SHELL=/bin/bash 'SSH_CLIENT=10.212.141.90 62167 22' SELINUX_USE_CURRENT_RANGE= SSH_TTY=/dev/pts/0 GROUP=wheel USER=dhm24.a LS_COLORS=rs=0:di=01;34:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:mi=01;05;37;41:su=37;41:sg=30;43:ca=30;41:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arj=01;31:*.taz=01;31:*.lzh=01;31:*.lzma=01;31:*.tlz=01;31:*.txz=01;31:*.zip=01;31:*.z=01;31:*.Z=01;31:*.dz=01;31:*.gz=01;31:*.lz=01;31:*.xz=01;31:*.bz2=01;31:*.tbz=01;31:*.tbz2=01;31:*.bz=01;31:*.tz=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.rar=01;31:*.ace=01;31:*.zoo=01;31:*.cpio=01;31:*.7z=01;31:*.rz=01;31:*.jpg=01;35:*.jpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.svg=01;35:*.svgz=01;35:*.mng=01;35:*.pcx=01;35:*.mov=01;35:*.mpg=01;35:*.mpeg=01;35:*.m2v=01;35:*.mkv=01;35:*.ogm=01;35:*.mp4=01;35:*.m4v=01;35:*.mp4v=01;35:*.vob=01;35:*.qt=01;35:*.nuv=01;35:*.wmv=01;35:*.asf=01;35:*.rm=01;35:*.rmvb=01;35:*.flc=01;35:*.avi=01;35:*.fli=01;35:*.flv=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.yuv=01;35:*.cgm=01;35:*.emf=01;35:*.axv=01;35:*.anx=01;35:*.ogv=01;35:*.ogx=01;35:*.aac=01;36:*.au=01;36:*.flac=01;36:*.mid=01;36:*.midi=01;36:*.mka=01;36:*.mp3=01;36:*.mpc=01;36:*.ogg=01;36:*.ra=01;36:*.wav=01;36:*.axa=01;36:*.oga=01;36:*.spx=01;36:*.xspf=01;36: HOSTTYPE=x86_64-linux MAIL=/var/spool/mail/dhm24.a PATH=/opt/ruby-enterprise/bin:/usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/bin:/bin:/usr/bin PWD=/ LANG=en_US.UTF-8 SELINUX_LEVEL_REQUESTED= KRB5CCNAME=FILE:/tmp/krb5cc_0.1 SHLVL=4 HOME=/root OSTYPE=linux VENDOR=unknown MACHTYPE=x86_64 LOGNAME=dhm24.a CVS_RSH=ssh 'SSH_CONNECTION=10.212.141.90 62167 141.161.152.76 22' 'LESSOPEN=|/usr/bin/lesspipe.sh %s' G_BROKEN_FILENAMES=1 _=/var/services/openldap/libexec/slapd

2 5

Memory leak in 2.4.31 w/ hdb and MMR?
by Brandon Hume 25 May '12

25 May '12

I've got my two-node setup up and running, MMR w/ delta-syncrepl. Node 1 is up and running with ~340k entries in the main DIT. It consumes about 4G of VM on a Redhat AS6 box, and the data dir is around 2.3G on-disk (including __db.* and the one log.* file...), and another 100M in cn=accesslog. I'm bringing up node 2 after nuking the data dir, and letting it syncrepl from nothing. I was tracking a SIGBUS error, but that turned out to be olcLogLevel=Stats+Sync generating a huge amount of logging and filling up the disk. Fixed that, moved on. Now, it's still crashing... but that's because slapd is bloating up hugely and causing the machine to run out of VM and kill the process. I've added about 8G of temporary swap, and it's still going. slapd on node2 is 5.5G resident, and nearly 15G in size total now. On-disk the hdb is only around 1.6G, so it still has a long ways to go. Can I assume this is not the way it should be? vmstat shows a lot of swap-out but almost no swap-in, so it's not thrashing. pmap shows a large number of 64M "anon" segments. 140 of those at one point, and 157 when I checked just now. It looks a lot like a memory leak, though I can't tell offhand whether the problem is in OpenLDAP (2.4.31) or in BerkeleyDB (5.3.15). When it finishes, I'm planning on turning off delta-syncrepl and pave/rebuild again, and see if it behaves the same. I could also give mdb a shot, but since this is a mirror I'd have to rebuild both sides. Any suggestions as to where I could start looking for the source of the problem? Obviously I'm not planning on rebuilding this node on a regular basis (and certainly not all via syncrepl) but I'm concerned that over an extended period of time it'll leak memory even during normal use. I'm including my DB_CONFIG, just in case. I can supply more of the config as necessary. DB_CONFIG: set_cachesize 0 536870912 0 set_lg_regionmax 10485760 set_lg_max 104857600 set_lg_bsize 26214400 set_lk_max_locks 4096 set_lk_max_objects 4096 set_flags DB_LOG_AUTOREMOVE (If anything looks particularly stupid in here, even unrelated to the leak, I'd love the advice...)

3 7

Multi Master syncrepl issue
by Neil Mcbennett 25 May '12

25 May '12

Hello, This is my first post to this list and unfortunately I come here with a problem. I'm not new to LDAP but I am new to OpenLDAP especially the 2.4 release. I am trying to get multi master replication working and I've read the documentation several times. I did wonder if this might be a bug but I still think it's probably a misunderstanding on my part. I have 2 servers configured for multi master replcation which I will refer to as server A and B. If I start both servers I can make changes on server A which are immediately replicated to server B. However if I then start making changes to server B I don't see replication back to A. The same thing happens if I initiate replication from B, then replication to A works but not the other way around. i.e. replication only works in 1 direction which is determined by which server I make changes on first. I am using slapd.conf as I didn't want to complicate matters by introducing online config. The specific version is 2.4.31. Connectivity between the servers is working fine - I can perform LDAP operations in both directions. If someone could take a look at my config I'd much appreciate it. Thanks Neil #slapd.conf Server A (10.5.1.110) pidfile /usr/local/openldap/var/run/slapd.pid argsfile /usr/local/openldap/var/run/slapd.args include /usr/local/openldap/etc/schema/core.schema include /usr/local/openldap/etc/schema/cosine.schema include /usr/local/openldap/etc/schema/solaris.schema include /usr/local/openldap/etc/schema/inetorgperson.schema include /usr/local/openldap/etc/schema/DUAConfigProfile.schema include /usr/local/openldap/etc/schema/sudo.schema modulepath /usr/local/openldap/libexec moduleload syncprov.la access to attrs=userPassword by self write by * auth by dn="cn=ldapclient,ou=profile,dc=example,dc=com" write access to dn.base="" by * read access to * by self write by users read by anonymous read serverID 1 database hdb suffix "dc=example,dc=com" rootdn "cn=Manager,dc=example,dc=com" rootpw {SSHA}pnqaqMcoMhnDbSRa9WAgDbhBMr/QnUGY lastmod on directory /usr/local/openldap/var/openldap-data index objectclass,uid,uidNumber,memberUid,entryCSN,entryUUID,automountKey eq index cn,sn,gn,mail eq,sub syncrepl rid=001 provider=ldap://10.7.82.3 type=refreshAndPersist searchbase="dc=example,dc=com" attrs="*,+" bindmethod=simple binddn="cn=manager,dc=example,dc=com" credentials="secret" mirrormode TRUE overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 ####################################################### #slapd.conf server B (10.7.82.3) pidfile /usr/local/openldap/var/run/slapd.pid argsfile /usr/local/openldap/var/run/slapd.args include /usr/local/openldap/etc/schema/core.schema include /usr/local/openldap/etc/schema/cosine.schema include /usr/local/openldap/etc/schema/solaris.schema include /usr/local/openldap/etc/schema/inetorgperson.schema include /usr/local/openldap/etc/schema/DUAConfigProfile.schema include /usr/local/openldap/etc/schema/sudo.schema modulepath /usr/local/openldap/libexec moduleload syncprov.la access to attrs=userPassword by self write by * auth by dn="cn=ldapclient,ou=profile,dc=example,dc=com" write access to dn.base="" by * read access to * by self write by users read by anonymous read serverID 2 database hdb suffix "dc=example,dc=com" rootdn "cn=Manager,dc=example,dc=com" rootpw {SSHA}pnqaqMcoMhnDbSRa9WAgDbhBMr/QnUGY lastmod on directory /usr/local/openldap/var/openldap-data index objectclass,uid,uidNumber,memberUid,entryCSN,entryUUID,automountKey eq index cn,sn,gn,mail eq,sub syncrepl rid=001 provider=ldap://10.5.1.110 type=refreshAndPersist searchbase="dc=example,dc=com" attrs="*,+" bindmethod=simple binddn="cn=manager,dc=example,dc=com" credentials="secret" mirrormode TRUE overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 #######################################################

1 0

ACL for nssov-overlay
by Uwe Werler 24 May '12

24 May '12

Hello list, does someone know how I can define an ACL for the socket used by the nssov-overlay? I tried by socket.url="/var/run/nslcd/socket" read but it won't work. Any suggestions? Thanks in advance! Regards Uwe

2 1

slapd hangs upon performing modification of cn=config
by Patrick Hemmer 24 May '12

24 May '12

I have a database which was working fine, but now whenever I go to perform any sort of modification on the database, the modification just hangs. No error, no timeout, just sits there. However while that first modification is hung, I can perform modifications of another database (other than cn=config) and they work just fine. I can even do further searches against cn=config while the modification is still hung. Also when I run slapd in the foreground, and then send it a SIGINT, it says "slapd shutdown: waiting for X operations/tasks to finish" and never ends. I end up having to SIGKILL it. The database is part of a MMR group of servers I was building, but I shut down all the other servers to troubleshoot the issue (it makes no difference whether the other servers are up or down, and they all exhibit the same problem). Where should I start looking to figure out whats going on (the specific operation/task thats hanging)? I can run slapd in debug mode with '-1', but theres a ton of info, and I dont know whats relevant, or which debug mode I should use other than '-1'. Thanks -Patrick

3 7

Anonymous bind allowed when configured not to.
by Kyle Smith 24 May '12

24 May '12

Good Morning, I was recently made aware of a problem with my OpenLDAP 2.4.26 and 2.4.28 servers. I have configured each server to disallow anony using the below directive. ### Disable anony disallow bind_anon This works great for Softerra Ldap Administrator, and the ldapsearch command (linux). $ ldapsearch -x -H ldaps://openldap.example.com -b "ou=peoples,dc=example,dc=com" "(uid=someuser)" ldap_bind: Inappropriate authentication (48) additional info: anonymous bind disallowed However, when I use Jxplorer (http://jxplorer.org/) it not only allows the bind, but allows the search. Right now the ACL is set for "by anonymous read", but shouldn't the disallow directive even prevent the connection? I'm working on getting some debug logs, but if any one has experienced this, please let me know. Thanks. Kyle Smith

2 2

Re: size of bdb database, master vs replica
by Quanah Gibson-Mount 24 May '12

24 May '12

--On Tuesday, May 22, 2012 10:06 AM +0200 Jehan Procaccia <jehan.procaccia(a)tem-tsp.eu> wrote: > Le 21/05/2012 18:33, Quanah Gibson-Mount a écrit : > > --On Monday, May 21, 2012 3:15 PM +0200 jehan procaccia > <jehan.procaccia(a)it-sudparis.eu> wrote: > > > ok __dd.xxx files are memory mapped files, > then which is the file(s) that contains the database ? I suspect > id2entry.bdb, but why on the master the size in KB is: > 195412 id2entry.bdb > and on the slave > 32 id2entry.bdb > > > It doesn't look to me like your replica is replicating at all. Have you > done a slapcat of the two and verified they are identical? > > --Quanah > > > > Ok, then I did a slapcat on a replica and to my big surprise, before I > did the slapcat, bdb files on the replica were very small, then as soon > as I did the slapcat (while slapd is off), now they are similar in size > to the master !? > Do we need to run regularly slapcat on replicas in order to "really" > replicate ? > No. It sounds like you don't have a checkpoint directive set for your database. You should fix that. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 2

dn.exact vs dn.base
by Nick Milas 24 May '12

24 May '12

I was wondering whether there is any difference between dn.exact and dn.base constructs. For example, theoretically (according to the documentation) we can use either: access to dn.base="ou=system,dc=example,dc=com" by dn.exact="uid=userx,ou=people,dc=example,dc=com" write or: access to dn.exact="ou=system,dc=example,dc=com" by dn.base="uid=userx,ou=people,dc=example,dc=com" write It seems to me that the two forms are interchangeable (as used, e.g. here: http://www.openldap.org/faq/data/cache/1140.html) Can you please clarify? Thanks, Nick

3 2

Problem with localhost unauthenticated bind
by Tim Watts 24 May '12

24 May '12

Hi, I'm having a problem with a new LDAP server (slapd 2.4.23-7.2) I'd like to have root@localhost be able to perform "manage" operations on the slapd on the localhost *only* - all other ACLs would be pretty standard. The machine itself is considered secure. Ideally, I'd like to do this with a mode(600) Unix Domain Socket owned by root. How do you enable an "manage" ACL for the entire DN if and only if the access comes via the unix socket? ================ On an aside - I've tried unauthenticated localhost access - but cannot get that to work. This would be less desirable as anyone with ssh access to the server would be abloe to bypass security - but I'm still curious to know what I did wrong. My slapd.d entries are: cat /etc/ldap/slapd.d/cn\=config.ldif ======================================================================= dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/slapd/slapd.args olcLogLevel: none olcPidFile: /var/run/slapd/slapd.pid olcToolThreads: 1 structuralObjectClass: olcGlobal entryUUID: 62952116-3777-1031-8e1b-bfeeb6e70114 creatorsName: cn=config createTimestamp: 20120521095922Z entryCSN: 20120521095922.839791Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20120521095922Z olcAllows: bind_anon_cred bind_anon_dn update_anon ### <<< Added this ======================================================================= cat /etc/ldap/slapd.d/cn\=config/olcDatabase\=\{1\}hdb.ldif ======================================================================= dn: olcDatabase={1}hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=cch,dc=kcl,dc=ac,dc=uk olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymous auth by dn="cn=admin,dc=cch,dc=kcl,dc=ac,dc=uk" write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by peername.regex=127\.0\.0\.1 manage ###<<< Added olcAccess: {3}to * by self write by dn="cn=admin,dc=cch,dc=kcl,dc=ac,dc=uk" write by * read olcLastMod: TRUE olcRootDN: cn=admin,dc=cch,dc=kcl,dc=ac,dc=uk olcRootPW:: e1NTSEF9TVFtdlA4Q2FJUjZqOEdpMytlcWd5Zk1BUWFjVmpGM1c= olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq structuralObjectClass: olcHdbConfig entryUUID: 62964ee2-3777-1031-8e25-bfeeb6e70114 creatorsName: cn=admin,cn=config createTimestamp: 20120521095922Z entryCSN: 20120521095922.847576Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20120521095922Z ======================================================================= Sorry this is a bit of a numpty question - I'm learning slapd - in a hurry(!) Many thanks in advance :) Tim -- Tim Watts Personal Email Personal website and blog: http://www.dionic.net/tim/

2 3

Issue upgrading openldap-clients from 2.4.19-15 to 2.4.23-20
by Esther Garcia 24 May '12

24 May '12

Hi all, We have an OpenLDAP server (RHEL6) running version 2.4.23-15, and we have clients in RHEL5 and RHEL6. With clients in RHEL5 works properly but I found some problems with RHEL6 clients in versions newer than 2.4.19-15. In the clients, if I try to upgrade to new versions than 2.4.19-15 then the client stops working: [root@XX ~]# rpm -qa | grep openldap openldap-2.4.19-15.el6.x86_64 openldap-clients-2.4.19-15.el6.x86_64 [root@XX ~]# ldapsearch -x -D 'cn=authenticate, ou=System,dc=test, dc=es' '(objectclass=*)' -W -ZZ Enter LDAP Password: # extended LDIF # # LDAPv3 ...... [root@XX ~]# id esther uid=63004(esther) gid=50041(test) groups=50041(test) [root@XX ~]# yum upgrade openldap* ..... Updating : openldap-2.4.23-20.el6.x86_64 1/4 warning: /etc/openldap/ldap.conf created as /etc/openldap/ldap.conf.rpmnew Updating : openldap-clients-2.4.23-20.el6.x86_64 2/4 Cleanup : openldap-clients-2.4.19-15.el6.x86_64 3/4 Cleanup : openldap-2.4.19-15.el6.x86_64 4/4 Updated: openldap.x86_64 0:2.4.23-20.el6 openldap-clients.x86_64 0:2.4.23-20.el6 Complete! [root@XX ~]# service nslcd restart Stopping nslcd: [ OK ] Starting nslcd: [ OK ] [root@XX ~]# id esther id: esther: No such user [root@XX ~]# ldapsearch -x -D 'cn=authenticate, ou=System,dc=test, dc=es' '(objectclass=*)' -W -ZZ ldap_start_tls: Connect error (-11) I have the same configuration files that used with the older version. I use these configuration files: */etc/pam_ldap.conf:* base dc=test,dc=es binddn cn=authenticate,ou=System,dc=test,dc=es bindpw XXXX timelimit 120 bind_timelimit 120 idle_timelimit 3600 pam_lookup_policy yes pam_password exop nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman,nscd,gdm ssl start_tls uri ldap://ldap1-test ldap://ldap2-test tls_cacertdir /etc/openldap/cacerts pam_password md5 */etc/nslcd.conf* uid nslcd gid ldap uri ldap://ldap1-test ldap://ldap2-test base dc=test,dc=es binddn cn=authenticate,ou=System,dc=test,dc=es bindpw XXXX ssl start_tls tls_cacertdir /etc/openldap/cacerts timelimit 120 bind_timelimit 120 idle_timelimit 3600 */etc/openldap/ldap.conf:* URI ldap://ldap1-test/ ldap://ldap2-test/ BASE dc=test,dc=es TLS_CACERT /etc/openldap/cacerts/catest.crt *CAcert file:* [root@XX ~]# ls -l /etc/openldap/cacerts/catest.crt -rw-r--r--. 1 root root 1655 May 23 15:23 /etc/openldap/cacerts/catest.crt Any idea on what the issue is? Am I missing anything? Thanks in advance, Esther

2 3

Re: dn.exact vs dn.base
by Turbo Fredriksson 24 May '12

24 May '12

[sorry, should have gone to the list] On Thu, 24 May 2012 14:02:28 +0300, Nick Milas wrote: > access to dn.base="ou=system,dc=example,dc=com" > by dn.exact="uid=userx,ou=people,dc=example,dc=com" write This gives 'uid=userx,...' access to 'ou=system,...' _and everything below it_. > access to dn.exact="ou=system,dc=example,dc=com" > by dn.base="uid=userx,ou=people,dc=example,dc=com" write While this is the opposite - it gives 'uid=userx,...' and any objects below this (not much point in this exact example :) to ONLY the base object 'ou=system,...'. For example: ----- s n i p ----- access to dn.exact="" attrs=supportedSASLMechanisms,namingContexts,subschemaSubentry,objectClass,monitorContext,configContext,entry by domain.subtree="bayour.com" read by peername.ip="127\.0\.0\.1" read by peername.ip="192\.168\.69\.8" read by peername.path="/var/run/slapd/ldapi" read ----- s n i p ----- This gives almost anonymous access to certain attributes to the base DN...

2 1

Re: Migrating from slapd 2.3 to 2.4
by Bobby Krupczak 23 May '12

23 May '12

Hi! > This is an old can of worms, Bobby. > Basically, Quanah & the OpenLDAP developers are not interested in > supporting old versions, because it takes away from the time they have > to work on the current version. We as users should support this, > because the software will stop growing if the devs spend too much time > on older versions. I understand completely. I write software myself and only admin my network enough to support my software development. I have a small number of users but a large number of machines hence why I use ldaps. I dont want to support years old releases of my own software. However, I dont radically change my config file formats either :) > I've followed this policy for the decade or so that I've been using > OpenLDAP and been very successful. I am running a large infrastructure > of Red Hat OL builds right now - dozens of replicas, with no problems > whatsoever. Thanks!! I'm going to tackle the conversion after I get this new system in place. Bobby

5 11

Re: checking replica dbs for consistency
by Nick Milas 23 May '12

23 May '12

On 23/5/2012 5:51 μμ, Charles T. Brooks wrote: > > <Mail content is a bit scrambled (text with spaces between chars), but I managed to read !!> > Charles, Thank you for your thoughts. I agree with you. There can/should be a number of consumers fully replicating the DIT so that they can be promoted to masters whenever needed. However, we do have and want some consumers with limited data replication. For example, our mail server runs a consumer replicating only the user accounts needed and only the ldap-hosted aliases. I don't want to replicate more ldap data there, there is no need to expose more data there and to load the server with unneeded replication operations. We are replicating on the mail server so that we can do *local* ldap lookups and achieve better mail server performance. Additionally, our DNS masters, replicate only the DNS resource records (also ldap-hosted). They don't need any info about users and aliases. We are also replicating there so that we can do local ldap lookups and achieve better DNS server performance. But I want to be able to check whether all partially replicated data are replicating as they should! One solution would be to define some non-root DN which *will be able to* replicate the whole DIT and use it in consumer configuration, then limit replication *using filters*. But this limits options and affects DIT architecture in the first place (not necessarily bad, but we would need to re-evaluate some things and it's not easy when in production). Thank you again for your time and thoughts, Nick

1 0

Re: checking replica dbs for consistency
by Nick Milas 23 May '12

23 May '12

On 23/5/2012 4:39 μμ, Charles T. Brooks wrote: > I u s e s l a p c a t t o d u m p t h e d a t a b a s e s t o L D I F f i l e s , s o r t t o n o r m a l i z e t h e o r d e r i n g , a n d d i f f t o c h e c k f o r d i f f e r e n c e s . Thank you, As I said, this actually would work only when replicating *the whole* DIT. By the way, what happens with the operational attributes - are they (supposed to be) identical on both ends? I am expecting any hints on comparing partial replicated data (based on consumer bind DN) ! Nick

2 1

ppolicy 'Constraint violation' with no additional info
by Jean-Philippe Braun 23 May '12

23 May '12

Hi all, I'm using ppolicy for some time now but sometimes when a user changes its password we get a 'Constraint violation' error without any additional info like 'Password is too young to change' or 'Password is in history of old passwords'. So I'm not sure where it fails. Does anybody have some idea on which case(s) this could happen ? (still using 2.4.23 on debian stable) Thanks

2 1

Re: Concerns with OLC (cn=config) for editing schema, ACLs, and deleting entries
by Michael Ströder 22 May '12

22 May '12

harry.jede(a)arcor.de wrote: > Michael Ströder wrote: >> The goal was to make the ACLs more readable for the admin. > This is my intend. Now the question is: Where to make them more readable. >> The GUI >> just makes it possible for the admin to add the LFs and display the >> ACL as multiple lines. And now this has the effect that the >> attributes values in LDIF are base64-encoded. The admin decides >> whether to add LFs or not. > Right, but are you sure all admins, can handle base64 encoded strings > properly. Tools, especially GUI-Tools should make life easier, not more > complex. Again: Did you read the whole thread in the mailing list archive? >> Please add it via LDAP and display it in a LDAP client. It will be a >> single line which was considered to be less readable. > Yes, and it should be a single line. It's entirely up to you whether you want to add LFs or not. There's no GUI tool forcing you to do so. Not my web2ldap nor Apache Directory Studio mentioned in this thread. Ciao, Michael.

2 2

Re: Fwd: Root cause: Strange OpenLdap performace issue
by Michele Mase' 22 May '12

22 May '12

Sorry, I'didn't understand. Which should be better compile/build options? Michele MAsè On Tue, May 22, 2012 at 12:40 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Tuesday, May 22, 2012 12:06 AM +0200 Michele Mase' < > michele.mase(a)gmail.com> wrote: > > > This is how redhat builds openldap; which are the bad libs? Are they the >> lib crypt (--enable-crypt); what should I use instead? >> Michele Masè >> > > Not crypt. crypto. as in using NSS instead of OpenSSL. > > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 3

Compiling on Windows, using VC or Windows SDK
by Tom Schuetz 22 May '12

22 May '12

Has anyone successfully compiled openldap using Visual Studio, or Windows SDK? If so, could you share your process with me, what you used for a makefile (or vcproj), approach to dependencies, etc? I have VC 2010 Express on a 64-bit Windows 7 box, and then I also have Windows SDK 7.1. I am comfortable with POSIX OSs and have MinGW installed, but for this I would prefer not to use it to actually compile. Am open to using MinGW to make a useable / translatable makefile, though. Thanks very much, Tom S

3 3

Re: Fwd: Root cause: Strange OpenLdap performace issue
by Michele Mase' 22 May '12

22 May '12

configure \ --with-threads=posix \ --enable-local \ --enable-rlookups \ --with-tls=no \ --with-cyrus-sasl \ --enable-wrappers \ --enable-passwd \ --enable-cleartext \ --enable-crypt \ --enable-spasswd \ --disable-lmpasswd \ --enable-modules \ --disable-sql \ --libexecdir=%{_libdir} build \ --enable-plugins \ --enable-slapd \ --enable-multimaster \ --enable-bdb \ --enable-hdb \ --enable-ldap \ --enable-ldbm \ --with-ldbm-api=%{ldbm_backend} \ --enable-meta \ --enable-monitor \ --enable-null \ --enable-shell \ --enable-sql=mod \ --disable-ndb \ --enable-passwd \ --enable-sock \ --disable-perl \ --enable-relay \ --disable-shared \ --disable-dynamic \ --with-kerberos=k5only \ --enable-overlays=mod This is how redhat builds openldap; which are the bad libs? Are they the lib crypt (--enable-crypt); what should I use instead? Michele Masè On Mon, May 21, 2012 at 11:47 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Monday, May 21, 2012 11:40 PM +0200 Michele Mase' < > michele.mase(a)gmail.com> wrote: > > Is it really bad? Is it buggy? Since redhat has its own ldap 389 dir. >> server, I suppose they don't care of openldap. isn't it? >> Michele Masè >> > > There are known issues with the release they use, and the crypto libraries > it is linked to. > > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

Re: Fwd: Root cause: Strange OpenLdap performace issue
by Michele Mase' 21 May '12

21 May '12

Is it really bad? Is it buggy? Since redhat has its own ldap 389 dir. server, I suppose they don't care of openldap. isn't it? Michele Masè On Mon, May 21, 2012 at 6:33 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Sunday, May 20, 2012 2:13 PM +0200 Michele Mase' < > michele.mase(a)gmail.com> wrote: > > Tx for the suggestion! We plan to migrate where possible to rhel6, that >> has included the 2.4.x openldap (and the possibility of hot adding ram >> and cpu in VM env). We have already tested a multi-master conf. that >> works fine. >> > > Using the OpenLDAP included with RHEL6 is a terrible idea. If you want to > use OpenLDAP as a server, then build it yourself, or use packages from any > of the numerous other sites that will build it out for you, so that you can > stay current. Distro packages are in general only for using the client > libraries. > > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

Migrating from slapd 2.3 to 2.4
by Bobby Krupczak 21 May '12

21 May '12

Hi! I'm finally updating my file/ldap server and am struggling with converting my 2.3 slapd.conf file to 2.4 ldif format. My plan to upgrade was: - dump my old ldap db to a single ldif file - convert slapd.conf using slaptest - connect to slapd using an ldap browser and import my old db via the ldif file I created Is this an appropriate approach that will work? Am I missing something? I ran the slaptest program on my old slapd.conf file and generated a slew of configs under slapd.d. However, I'm now running into an error when I try to start slapd. slapd[4320]: config error processing cn={1}core,cn=schema,cn=config: olcAttributeTypes: Duplicate attributeType: "2.5.4.2" slaptest: bad configuration file! systemd[1]: PID file /var/run/slapd.pid not readable (yet?) after start. I saw via google where the attribute is duplicated but I never could find how to edit/modify the configs to remove the duplicate entry. Any ideas how to remove this duplicate entry? Thanks, Bobby

4 19

RE: Migrating from slapd 2.3 to 2.4
by Quanah Gibson-Mount 21 May '12

21 May '12

--On Monday, May 21, 2012 5:18 PM -0400 "Charles T. Brooks" <brooksct(a)hbcs.org> wrote: > I prefer testing and solid evidence rather than trusting to luck. And > I'm well aware of OpenSSL/NSS issues. But I think our architectures are > based on different assumptions, Quanah. > > I don't use syncrepl. I use slurpd, and I run it without incident for > years at a time. I am currently feeding OL 2.4 systems (Red Hat 6.2) > and 2.3 systems (Red Hat 5.x) from a master 2.3 system without issues, > all using Red Hat packages. Slurpd is more bandwidth efficient than > syncrepl, and I do not have any of the problems syncrepl was designed to > solve, so using syncrepl would be a regression for me. I already have > the ability to sync any or all replicas in minutes if needed, and all my > applications implement LDAP failover at the client, so I can bring down > any server any time I wish. Syncrepl offers me nothing. Cn=config > offers less; it does not yet have all the functions of slapd.conf > (although I am running it on the 2.4 nodes) and it puts a master > password in the database, a password which previously was not LDAP > accessible. Then your usage vastly differs from the norm, and should not in any way, shape, or form, be used as a platform for giving advice to people who are freshly deploying OpenLDAP. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

size of bdb database, master vs replica
by jehan procaccia 21 May '12

21 May '12

hello I use syncrepl between my master and replicas I am surprise with the apparent size of my database (~4000 people entries with jpegphotos of ~10KB each) on the master I have # du -sk *.bdb | sort -n 172 gidNumber.bdb 188 uidNumber.bdb 332 memberUid.bdb 772 ou.bdb 812 modifyTimestamp.bdb 1020 givenName.bdb 1204 uid.bdb 1368 dn2id.bdb 1620 sn.bdb 1908 IntEPersInetServ.bdb 2068 objectClass.bdb 2804 eduPersonOrgUnitDN.bdb 2828 eduPersonPrimaryOrgUnitDN.bdb 3064 cn.bdb 3368 schacUserStatus.bdb 6784 mail.bdb *195412 id2entry.bdb * Plus BDB # du -sk __db* | sort -n 12 __db.001 12 __db.006 464 __db.005 548 __db.004 67540 __db.002 205072 __db.003 but these are shared memory and doesn't matter I suppose !? On the replica I have # du -sk *.bdb | sort -n 8 cn.bdb 8 dn2id.bdb 8 eduPersonOrgUnitDN.bdb 8 eduPersonPrimaryOrgUnitDN.bdb 8 entryCSN.bdb 8 entryUUID.bdb 8 gidNumber.bdb 8 givenName.bdb 8 IntEPersInetServ.bdb 8 mail.bdb 8 memberUid.bdb 8 modifyTimestamp.bdb 8 objectClass.bdb 8 ou.bdb 8 schacUserStatus.bdb 8 sn.bdb 8 uid.bdb 8 uidNumber.bdb *32 id2entry.bdb* # du -sk __* | sort -n 12 __db.001 12 __db.006 380 __db.005 740 __db.004 7060 __db.002 53860 __db.003 So the size of the file are very different, why ? 4000 objects with at least 3000 jpegphoto of 10K each seems to fit in a 32K id2entry.bdb, but why then on the master it is at 195412K id2entry.bdb !? Thanks .

3 4

Re: Fwd: Root cause: Strange OpenLdap performace issue
by Michele Mase' 21 May '12

21 May '12

Tx! We'plan to upgrade the system, so we'll use openldap2.4.x. We have more than 1500 server and about 50% of them are linux, we must use rhel rpms (due to our datacenter roles, all the servers should be identical). The worst thing was that testing with the same db without the index files, all the results of the query are almost immediate. I'm unable to reproduce the problem in test environment. Regards Michele MAsè On Tue, May 15, 2012 at 6:24 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Tuesday, May 15, 2012 2:55 PM +0200 Michele Mase' < > michele.mase(a)gmail.com> wrote: > > Anyone??????? >> >> > OpenLDAP 2.3 has not been supported for several years. Since it stopped > development, there have been hundreds, if not over a thousand, bug fixes > and improvements. Furthermore, I'm going to guess that you are running > RH's build of OpenLDAP 2.3, which was even further behind than the last > release of OpenLDAP 2.3. Given the information you provided, I would guess > that there is some bug in the version of BDB that OpenLDAP was linked to > that caused the error. I would note that at one point RH was linking > OpenLDAP against BDB version 4.3, despite the fact OpenLDAP's configure > script explicitly disabled such linking because BDB 4.3 was known to have > serious issues. If your 2.3 OpenLDAP is linked to BDB 4.3 that could well > be the cause of your issue. > > Beyond that, trying to investigate any further is a waste of everyone's > time. Upgrade to a modern supported version of OpenLDAP, and build your > own packages, don't rely on distribution packages. > > <http://www.openldap.org/faq/**data/cache/1456.html<http://www.openldap.org/faq/data/cache/1456.html> > > > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

4 5

Concerns with OLC (cn=config) for editing schema, ACLs, and deleting entries
by Chris Hiestand 20 May '12

20 May '12

Part 1: Readability I know you veterans are probably sick to death of us late-comers asking questions about cn=config. I understand but please hear me out because I feel I have done due diligence; but I still have some concerns with the transition. Workflow has been discussed before, but I suspect it hasn't been fleshed out because the switch from editing schema and ACLs in flat files to LDAP entries reduces readability. I have no problem using cn=config for most configuration attributes, but it gets a lot less user friendly when the value is, what used to be in slapd.conf, a multi-line string. But I could just be missing something. Your help is appreciated. Attached are some screenshots of editing ACLs and a custom schema via 3 methods: 1. cn=config via ldap client (ie apache directory studio) 2. cn=config via ldif 3. old style slapd.conf Look at the pictures and pick which method you'd like to use to edit ACLs or a schema: http://snl.salk.edu/~chiestand/openldap/ACLs-via-ldap.png http://snl.salk.edu/~chiestand/openldap/ACLs-via-ldif.png http://snl.salk.edu/~chiestand/openldap/ACLs-via-slapd.conf.png http://snl.salk.edu/~chiestand/openldap/schema-via-ldap.png http://snl.salk.edu/~chiestand/openldap/schema-via-ldif.png http://snl.salk.edu/~chiestand/openldap/schema-via-slapd.conf.png I think the choice is clearly old style slapd.conf. Otherwise you miss comments and ordering (until Howard Chu's X-ORDERED ldap extension is implemented), and unlimited whitespace to substantially improve readability. The LDIF files are a mess because of the way words are split unpredictably by new lines. You can't use a simple search and replace with any hope of it working. Readability would be vastly improved with new lines before keywords (eg to, filter, attrs …) but I don't think it's possible to have ldapsearch output this way. Editing via an ldap client is easy if you're just editing an attribute here and there, but because of the interacting nature of ACLs and schema elements, poor readability (no newlines) makes editing via an ldap client more difficult (a gui with smart sorting and syntax highlighting could make it better). Am I just missing workflow techniques or key concepts that improves readability? Or is your advice to just suck it up and get used to it? Part 2: Deleting entries in cn=config Quanah Gibson-Mount has said entry deletes are coming in 2.5, is that still the plan? The Roadmap page isn't specific. What about whole schema deletes? From a sysadmin perspective, I should be able to add, modify, or delete anything from the configuration. For QA reasons, you want to be have the exact configuration you want; not the configuration you want plus legacy boogers. I understand if this isn't trivial to achieve from the developer perspective. Granted I don't have the whole picture here, but I'd argue that it's worth it. Lastly, I thank everyone who contributes to OpenLDAP.

16 47

OLC version of plugin directive
by Joseph L. Casale 19 May '12

19 May '12

I am trying to adapt a plugin preoperation|postoperation setup from an older slapd.conf to my current OLC based config. I can not seem to find any applicable olc based directives that accomplish the same, anyone have a pointer? Thanks! jlc

2 2

SSL client cert authc problems with OpenLDAP client and OpenDJ server
by Michael Ströder 18 May '12

18 May '12

HI! (cross-posted since OpenLDAP and OpenDJ are involved) I have some SSL client cert authc problems with a OpenLDAP 2.4.23 LDAP client (dynamically linked to OpenSSL 0.9.8e on RHEL 5.6) and OpenDJ 2.4.5 running under control of Java 1.6.0_31. I cross-checked all the cert and trust stuff several times. It seems to be correct. Unfortunately we're stuck with 2.4.23 in this setup because of OpenLDAP's ITS#6997. (I manually obfuscated parameters and log lines herein.) At first glance OpenLDAP's ldapwhoami seems to work correctly with the first OpenDJ replica: $ LDAPTLS_CERT=ldap-client.crt LDAPTLS_KEY=client.key ldapwhoami -H ldaps://master1.example.com -Y EXTERNAL SASL/EXTERNAL authentication started SASL username: cn=ldapclient,o=example,c=DE SASL SSF: 0 dn:cn=ldapclient,ou=Users,cn=example But in OpenDJ's access-log file there's written: [18/May/2012:16:52:00 +0200] CONNECT conn=15 from=x.x.x.x:33358 to=x.x.x.x:63677 protocol=LDAPS [18/May/2012:16:52:00 +0200] BIND REQ conn=15 op=0 msgID=1 type=SASL mechanism=EXTERNAL dn="" [18/May/2012:16:52:00 +0200] BIND RES conn=15 op=0 msgID=1 result=0 authDN="cn=ldapclient,o=example,c=DE" etime=0 [18/May/2012:16:52:00 +0200] EXTENDED REQ conn=15 op=1 msgID=2 name="Who Am I?" oid="1.3.6.1.4.1.4203.1.11.3" [18/May/2012:16:52:00 +0200] EXTENDED RES conn=15 op=1 msgID=2 result=0 additionalInfo="authzID="dn:cn=ldapclient,ou=Users,cn=example"" etime=1 [18/May/2012:16:52:00 +0200] DISCONNECT conn=15 reason="Protocol Error" msg="The client sent a request to the Directory Server that could not be properly decoded as an LDAP message: javax.net.ssl.SSLException: Inbound closed before receiving peer's close_notify: possible truncation attack?" The attempt to do the same on another OpenDJ replica fails completely (no differences in TLS configuration - checked cn=config for potential differences with diff): $ LDAPTLS_CERT=ldap-client.crt LDAPTLS_KEY=client.key ldapwhoami -H ldaps://consumer1.example.com -Y EXTERNAL ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) In OpenDJ's access-log file there's written: [18/May/2012:16:52:38 +0200] CONNECT conn=6 from=x.x.x.x:61841 to=x.x.x.x:63677 protocol=LDAPS [18/May/2012:16:52:38 +0200] DISCONNECT conn=6 reason="Protocol Error" msg="The client sent a request to the Directory Server that could not be properly decoded as an LDAP message: javax.net.ssl.SSLHandshakeException: General SSLEngine problem" [18/May/2012:16:53:06 +0200] CONNECT conn=7 from=x.x.x.x:61842 to=x.x.x.x:63677 protocol=LDAPS [18/May/2012:16:53:07 +0200] DISCONNECT conn=7 reason="Protocol Error" msg="The client sent a request to the Directory Server that could not be properly decoded as an LDAP message: javax.net.ssl.SSLHandshakeException: General SSLEngine problem" Any clue what's going on here? Ciao, Michael.

3 3

slapadd -S defaulting to 0
by Mark 18 May '12

18 May '12

Why does the '-S' option on slapadd to default 0 instead of the (olc)ServerID value currently being used? (according to the manpage) Thank you, Mark

1 0

ACL syntax with wildcards
by Nick Milas 18 May '12

18 May '12

Hi, We would like to use ACL statements of the form (used for illustration purposes): access to dn.subtree="ou=people,dc=example,dc=com" filter="(ou=xxxxx)" attrs="someAttrs" by group.exact="cn=xxxxxAdmins,ou=Groups,dc=example,dc=com" write by group.exact="cn=allAdmins,ou=Groups,dc=example,dc=com" read by self read where xxxxx is some string. In essence, we assign people entries to various administrative groups, depending on the value of the ou attribute of the entry. Of course we can write many statements, one per ou value / admin group, but it would be much more concise to use just one statement using wildcards. Could someone please suggest if and how the above can be written correctly, using e.g. regex? I appreciate any suggestions. Thanks, Nick

7 15

ACL Manual Additions request
by Nick Milas 18 May '12

18 May '12

Hi, I think it would be important to add some text in http://www.openldap.org/doc/admin24/access-control.html regarding the use of <control> keywords (i.e. stop, continue, break), esp "break". These are not explained at all in the particular page, and IMHO they are notsatisfactorily explained in FAQ-O-Matic as well (unless there is a page which I missed, in which case please add the appropriate info in the above page which is a main point of reference). For example, the above man page does not even include an example with a break keyword. At least one example should be included for children, entry attributes (and the significance of break there should be explained). There are some examples in FAQ-O-Matic, for example: http://www.openldap.org/faq/data/cache/1474.html http://www.openldap.org/faq/data/cache/429.html http://www.openldap.org/faq/data/cache/189.html but they do not provide sufficient insight. So, currently the significance and use of <control> keywords is obscure. Although I am now (after almost two years) in a position to be able to understand and handle ACLs to an extensive degree successfully (not without effort), yet I am far from writing a tutorial or manual text, I felt the above addition is a real need (esp. for new users) that I should mention, asking the project team for it. Regards and thanks for the project's efforts, Nick

1 0

translucent overlay and local objects?
by Eugene Vilensky 17 May '12

17 May '12

Greetings, Pardon if this is an RTFM (I'd love a link), but is it possible to store entities locally using the translucent overlay? The overlay works for what we are trying to do when it comes to search and modifying attributes on an entry, but I would like to create an entire local groupofnames, consisting of remote UIDs. For example, this LDIF imports OK: #!RESULT OK #!CONNECTION ldap://xxxxx #!DATE 2012-04-09T16:01:33.961 dn: cn=instructors,ou=Groups,dc=xxxx,dc=zzz changetype: add objectClass: groupofnames member: uid=nate member: uid=penelope member: uid=rhonda cn: instructors But searching for it does not bring back a result. However, it must have gone somewhere since if I try to import the same LDIF again: #!RESULT ERROR #!CONNECTION ldap://xxxxx #!DATE 2012-04-09T16:21:28.221 #!ERROR [LDAP: error code 68 - Entry Already Exists] Kind regards, Eugene

4 11

CAN I MADE MY OWN SCHEMA
by amine boubou 16 May '12

16 May '12

hi i've installed openldap correctly, but now i want to use some attributs that not exist in default objectclass. My question: can i configure openldap with new specifique schema without using the default (core.schema cosine.schema nis.schema and inetorgperson.schema). thanks for answer :)

2 1

Adding ODERING to a core attribute
by Emmanuel Dreyfus 16 May '12

16 May '12

Hi I have a VoIP phone that insist on having ORDERING set on sn and givenName in core.schema. Is there any smart way of doing it without modifying the core.schema file? -- Emmanuel Dreyfus manu(a)netbsd.org

2 1

HowTo to setup LDAP
by Luc MAIGNAN 16 May '12

16 May '12

Hi, I've found a lot of howto to setup openLDAP using the slapd.conf but none using the actual database feature. But I want to configure a freshly installed openLDAP without writing a slapd.conf and doing a migration on it. Is there somewhere a step-by-step howto to setup an openLDAP using the new feature (all parameters in the LDAP) ? Thanks for any help Best regards

4 6

"do_bind: invalid dn" while trying to monitor slapd using pacemaker `slapd' resource agent
by Igor Zinovik 16 May '12

16 May '12

Hello. I'm deploing mirrormode openldap cluster. I have two hosts running openSUSE 12.1 with openldap2-2.4.30-83.3.x86_64 I created special user for mirrormode and tuned limits, so replication works fine. But for transparent switch between two nodes in case of failure i need some additional software to monitor ldap daemons and manage IP addresses on which my consumers connect. So i went for pacemaker and used following document to set it up: http://www.daasi.de/ldapcon2011/downloads/Haferkamp-paper.pdf I decided to create a special uid for monitoring my tree which can read only root element: ldap2:~# grep -C 2 pcmk /etc/openldap/slapd.conf # access to dn.base="dc=test,dc=org" by dn="uid=slapd-pcmk,ou=Services,dc=test,dc=org" read And here is my problem: I can successfully execute search query by hands using ldapsearch(1): ldap2:~# ldapsearch -H "ldap:/// ldaps:/// ldapi:///" -b dc=test,dc=org -LLL -s base -x -D 'uid=slapd-pcmk,ou=Services,dc=test,dc=org -w 'P@ssw0rd,' Enter LDAP Password: dn: dc=test,dc=org dc: test objectClass: organization objectClass: dcObject o: Test org ldap2:~# echo $? 0 Pacemaker uses resource agents to monitor various daemons, so i downloaded resource agent for slapd. Resource agent is just a script file (e.g. resource agent for slapd) and it executes same query as i do by hand, but slapd complains about "invalid dn": Here is how slapd resource was defined: ldap2:~# crm configure primitive slapd_mirrormode ocf:heartbeat:slapd params \ slapd="/usr/lib/openldap/slapd" config="/etc/openldap/slapd.conf" \ user="ldap" group="ldap" services="ldap:/// ldaps:/// ldapi:///" \ watch_suffix="dc=test,dc=org" \ bind_dn="uid=slapd-pcmk,ou=Services,dc=test,dc=org" \ password="P@ssw0rd," parameters="-o slp=on" \ meta migration-threshold="3" op monitor interval="10s" I changed loglevel in slapd to `1' and see following in log: May 16 13:07:00 ldap2 slapd[7641]: slap_listener_activate(8): May 16 13:07:00 ldap2 slapd[7641]: >>> slap_listener(ldap:///) May 16 13:07:00 ldap2 slapd[7641]: connection_get(17): got connid=1013 May 16 13:07:00 ldap2 slapd[7641]: connection_read(17): checking for input on id=1013 May 16 13:07:00 ldap2 slapd[7641]: op tag 0x60, time 1337159220 May 16 13:07:00 ldap2 slapd[7641]: conn=1013 op=0 do_bind May 16 13:07:00 ldap2 slapd[7641]: >>> dnPrettyNormal: <'uid=slapd-pcmk,ou=Services,dc=test,dc=org'> May 16 13:07:00 ldap2 slapd[7641]: conn=1013 op=0 do_bind: invalid dn ('uid=slapd-pcmk,ou=Services,dc=test,dc=org') May 16 13:07:00 ldap2 slapd[7641]: send_ldap_result: conn=1013 op=0 p=3 May 16 13:07:00 ldap2 slapd[7641]: send_ldap_response: msgid=1 tag=97 err=34 May 16 13:07:00 ldap2 slapd[7641]: connection_get(17): got connid=1013 May 16 13:07:00 ldap2 slapd[7641]: connection_read(17): checking for input on id=1013 May 16 13:07:00 ldap2 slapd[7641]: op tag 0x42, time 1337159220 May 16 13:07:00 ldap2 slapd[7641]: conn=1013 op=1 do_unbind May 16 13:07:00 ldap2 slapd[7641]: connection_close: conn=1013 sd=17 May 16 13:07:01 ldap2 slapd[7641]: slap_listener_activate(8): May 16 13:07:01 ldap2 slapd[7641]: >>> slap_listener(ldap:///) May 16 13:07:01 ldap2 slapd[7641]: connection_get(17): got connid=1014 May 16 13:07:01 ldap2 slapd[7641]: connection_read(17): checking for input on id=1014 May 16 13:07:01 ldap2 slapd[7641]: op tag 0x60, time 1337159221 May 16 13:07:01 ldap2 slapd[7641]: conn=1014 op=0 do_bind May 16 13:07:01 ldap2 slapd[7641]: >>> dnPrettyNormal: <'uid=slapd-pcmk,ou=Services,dc=test,dc=org'> May 16 13:07:01 ldap2 slapd[7641]: conn=1014 op=0 do_bind: invalid dn ('uid=slapd-pcmk,ou=Services,dc=test,dc=org') May 16 13:07:01 ldap2 slapd[7641]: send_ldap_result: conn=1014 op=0 p=3 May 16 13:07:01 ldap2 slapd[7641]: send_ldap_response: msgid=1 tag=97 err=34 May 16 13:07:01 ldap2 slapd[7641]: connection_get(17): got connid=1014 May 16 13:07:01 ldap2 slapd[7641]: connection_read(17): checking for input on id=1014 May 16 13:07:01 ldap2 slapd[7641]: op tag 0x42, time 1337159221 May 16 13:07:01 ldap2 slapd[7641]: ber_get_next on fd 17 failed errno=0 (Success) May 16 13:07:01 ldap2 slapd[7641]: conn=1014 op=1 do_unbind May 16 13:07:01 ldap2 slapd[7641]: connection_close: conn=1014 sd=17 May 16 13:07:02 ldap2 slapd[7641]: slap_listener_activate(8): May 16 13:07:02 ldap2 slapd[7641]: >>> slap_listener(ldap:///) May 16 13:07:02 ldap2 slapd[7641]: connection_get(17): got connid=1015 May 16 13:07:02 ldap2 slapd[7641]: connection_read(17): checking for input on id=1015 May 16 13:07:02 ldap2 slapd[7641]: op tag 0x60, time 1337159222 May 16 13:07:02 ldap2 slapd[7641]: conn=1015 op=0 do_bind May 16 13:07:02 ldap2 slapd[7641]: >>> dnPrettyNormal: <'uid=slapd-pcmk,ou=Services,dc=test,dc=org'> May 16 13:07:02 ldap2 slapd[7641]: conn=1015 op=0 do_bind: invalid dn ('uid=slapd-pcmk,ou=Services,dc=test,dc=org') May 16 13:07:02 ldap2 slapd[7641]: send_ldap_result: conn=1015 op=0 p=3 May 16 13:07:02 ldap2 slapd[7641]: send_ldap_response: msgid=1 tag=97 err=34 May 16 13:07:02 ldap2 slapd[7641]: connection_get(17): got connid=1015 May 16 13:07:02 ldap2 slapd[7641]: connection_read(17): checking for input on id=1015 May 16 13:07:02 ldap2 slapd[7641]: op tag 0x42, time 1337159222 May 16 13:07:02 ldap2 slapd[7641]: conn=1015 op=1 do_unbind May 16 13:07:02 ldap2 slapd[7641]: connection_close: conn=1015 sd=17 May 16 13:07:04 ldap2 slapd[7641]: slap_listener_activate(8): May 16 13:07:04 ldap2 slapd[7641]: >>> slap_listener(ldap:///) May 16 13:07:04 ldap2 slapd[7641]: connection_get(17): got connid=1016 May 16 13:07:04 ldap2 slapd[7641]: connection_read(17): checking for input on id=1016 May 16 13:07:04 ldap2 slapd[7641]: op tag 0x60, time 1337159224 May 16 13:07:04 ldap2 slapd[7641]: conn=1016 op=0 do_bind May 16 13:07:04 ldap2 slapd[7641]: >>> dnPrettyNormal: <'uid=slapd-pcmk,ou=Services,dc=test,dc=org'> May 16 13:07:04 ldap2 slapd[7641]: conn=1016 op=0 do_bind: invalid dn ('uid=slapd-pcmk,ou=Services,dc=test,dc=org') May 16 13:07:04 ldap2 slapd[7641]: send_ldap_result: conn=1016 op=0 p=3 May 16 13:07:04 ldap2 slapd[7641]: send_ldap_response: msgid=1 tag=97 err=34 May 16 13:07:04 ldap2 slapd[7641]: connection_get(17): got connid=1016 May 16 13:07:04 ldap2 slapd[7641]: connection_read(17): checking for input on id=1016 May 16 13:07:04 ldap2 slapd[7641]: op tag 0x42, time 1337159224 May 16 13:07:04 ldap2 slapd[7641]: conn=1016 op=1 do_unbind May 16 13:07:04 ldap2 slapd[7641]: connection_close: conn=1016 sd=17 May 16 13:07:05 ldap2 slapd[7641]: slap_listener_activate(8): May 16 13:07:05 ldap2 slapd[7641]: >>> slap_listener(ldap:///) May 16 13:07:05 ldap2 slapd[7641]: connection_get(17): got connid=1017 May 16 13:07:05 ldap2 slapd[7641]: connection_read(17): checking for input on id=1017 May 16 13:07:05 ldap2 slapd[7641]: op tag 0x60, time 1337159225 May 16 13:07:05 ldap2 slapd[7641]: conn=1017 op=0 do_bind May 16 13:07:05 ldap2 slapd[7641]: >>> dnPrettyNormal: <'uid=slapd-pcmk,ou=Services,dc=test,dc=org'> May 16 13:07:05 ldap2 slapd[7641]: conn=1017 op=0 do_bind: invalid dn ('uid=slapd-pcmk,ou=Services,dc=test,dc=org') May 16 13:07:05 ldap2 slapd[7641]: send_ldap_result: conn=1017 op=0 p=3 May 16 13:07:05 ldap2 slapd[7641]: send_ldap_response: msgid=1 tag=97 err=34 May 16 13:07:05 ldap2 slapd[7641]: connection_get(17): got connid=1017 May 16 13:07:05 ldap2 slapd[7641]: connection_read(17): checking for input on id=1017 May 16 13:07:05 ldap2 slapd[7641]: op tag 0x42, time 1337159225 May 16 13:07:05 ldap2 slapd[7641]: conn=1017 op=1 do_unbind May 16 13:07:05 ldap2 slapd[7641]: connection_close: conn=1017 sd=17 May 16 13:07:06 ldap2 slapd[7641]: daemon: shutdown requested and initiated. May 16 13:07:06 ldap2 slapd[7641]: slapd shutdown: waiting for 1 operations/tasks to finish May 16 13:07:06 ldap2 slapd[7641]: slapd shutdown: initiated May 16 13:07:06 ldap2 slapd[7641]: ====> bdb_cache_release_all May 16 13:07:06 ldap2 slapd[7641]: slapd destroy: freeing system resources. May 16 13:07:06 ldap2 slapd[7641]: syncinfo_free: rid=001 May 16 13:07:06 ldap2 slapd[7641]: connection_get(14): got connid=0 May 16 13:07:06 ldap2 slapd[7641]: slapd stopped. I understand that there might be a problem in pacemakers `slapd' resource agent. Maybe it corrupts bind dn somehow... Agent executes `monitor' operation, here is a snippet from resource agent code: ldap2:~# less /usr/lib/ocf/resource.d/heartbeat/slapd ... slapd_monitor() { ... options="-LLL -s base -x" if [ -n "$bind_dn" ]; then options="$options -D '$bind_dn' -w '$password'" fi [ -z "$1" ] && err_option="" for suffix in $suffixes; do ocf_run -q $err_option "$ldapsearch" -H "$services" -b "$suffix" $options >/dev/null 2>&1; rc=$? case "$rc" in "0") ocf_log debug "slapd database with suffix '$suffix' reachable" ;; "49") ocf_log err "slapd database with suffix '$suffix' unreachable. Invalid credentials." return $OCF_ERR_CONFIGURED ;; *) if [ -z "$1" ] || [ -n "$1" -a $rc -ne 1 ]; then ocf_log err "slapd database with suffix '$suffix' unreachable. exit code ($rc)" fi ... Still scratching head...

2 1

OpenLDAP 2.4.23 multi-master replication of the cn=config tree error: could not put entry file in place
by Cyril Grosjean 16 May '12

16 May '12

I've a sandbox environment with 2 CentOS 6.2 servers running the genuine openldap-servers rpms, that is OpenLDAP 2.4.23 . I've setup a multi-master replication between the servers, so that both my data DIT (dc=....,dc=.... ) and the cn=config should be replicated. Actually, the replication of data works fine, as expected in either way, but the replication of the configuration tree fails: each time I update the configuration on the second node, I get this error in my LDAP client (Apache Directory Studio): could not put entry file in place I've tried to run the second master in debug (-d -1) mode, and it seems like there's a write access error when the slapd daemon (on the 2nd master) tries to update/modify/replace the /etc/openldap/slapd.d/cn=config.ldif file: <= acl_access_allowed: granted to database root ldif_write_entry: could not put entry file for "cn=config" in place: Permission denied send_ldap_result: conn=-1 op=0 p=3 send_ldap_result: err=80 matched="" text="internal error (could not put entry file in place)" send_ldap_result: conn=-1 op=0 p=3 send_ldap_result: err=80 matched="" text="internal error (could not put entry file in place)" null_callback : error code 0x50 slap_graduate_commit_csn: removing 0x7fd19412f090 20120510163105.003156Z#000000#001#000000 syncrepl_updateCookie: rid=001 be_modify failed (80) ldap_msgfree The OpenLDAP error log shows the following error: May 10 19:12:39 sashimi slapd[24866]: slapd starting May 10 19:12:40 sashimi slapd[24866]: ldif_write_entry: cannot create file for "olcDatabase={0}config,cn=config": Permission denied May 10 19:12:40 sashimi slapd[24866]: null_callback : error code 0x50 May 10 19:12:40 sashimi slapd[24866]: syncrepl_entry: rid=001 be_modify failed (80) May 10 19:12:40 sashimi slapd[24866]: do_syncrepl: rid=001 rc -1 quitting May 10 19:12:50 sashimi slapd[24866]: ldif_write_entry: could not put entry file for "cn=config" in place: Permission denied May 10 19:12:50 sashimi slapd[24866]: null_callback : error code 0x50 May 10 19:12:50 sashimi slapd[24866]: syncrepl_updateCookie: rid=001 be_modify failed (80) May 10 19:13:00 sashimi slapd[24866]: ldif_write_entry: could not put entry file for "cn=config" in place: Permission denied May 10 19:13:00 sashimi slapd[24866]: null_callback : error code 0x50 May 10 19:13:00 sashimi slapd[24866]: syncrepl_updateCookie: rid=001 be_modify failed (80) May 10 19:13:10 sashimi slapd[24866]: ldif_write_entry: could not put entry file for "cn=config" in place: Permission denied May 10 19:13:10 sashimi slapd[24866]: null_callback : error code 0x50 May 10 19:13:10 sashimi slapd[24866]: syncrepl_updateCookie: rid=001 be_modify failed (80) Of course, I don't have any right access problems at the file system level, I don't have any file system ACLs, I don't use SELinux and I've checked that I can update or create any file under /etc/openldap/slapd.d, when logged in as the ldap user (who's the account used to run slapd). So, this error looks like a bug to me. Already fixed ? To setup the replication of both data and configuration, I've copied the full /etc/openldap directory from one server to the other, with the same file system rights. I've just changed the server certificate files since I use TLS to replicate both the data and the configuration. So, I don't have any TLS problem since the data tree replication works fine. Here's my replication configuration for the cn=config database: dn: olcDatabase={0}config,cn=config ... .... olcSyncRepl: rid=001 provider=ldap://......:389 binddn="cn=config" bindmethod=simple credentials="......" searchbase="cn=config" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 starttls=yes tls_cacert=/etc/openldap/conf/cacert.pem olcSyncRepl: rid=002 provider=ldap://.....:389 binddn="cn=config" bindmethod=simple credentials="....... " searchbase="cn=config" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 starttls=yes tls_cacert=/etc/openldap/conf/cacert.pem olcMirrorMode: TRUE I actually use the same setup than for the data replication, excepted that I have rid=003 and rid=004 of course for data replication, and the BIND DN and passwords are different too. -- Cyril

4 4

SASL AD + SASL SCRAM
by Pieter Baele 16 May '12

16 May '12

Hi, My current LDAP setup uses SASL PTA to authenticate against Active Directory. For users only existing in OpenLDAP, I would use SASL SCRAM, so no passes over the wire except for these in AD ;-) But I believe only 1 method can be used by SASL External? Any guidelines on configuring something as this? Do I really need the meta backend or is there a better way? -- PieterB

2 1

AW: overlay nssov + pass-through authentication
by Uwe Werler 16 May '12

16 May '12

> Hello list, > > up to now we have pam_ldap/nss_ldap running from padl and all user accounts have > > pass-through authentication configured to authenticate against an > external ldap server.* > > Now I try the overlay nssov and except authentication all is running fine. > > If I use the userPassword directly the user can authenticate without problems. > > Isn't it possible to use pass-through authentication with overlay nssov? > > Thanks in advance! > > Regards Uwe > > *userPassword: {SASL}uid > > > Ok, I found overlay pbind - it does what I want 'cause we use saslauthd with ldap auth against an external ldap server for some user accounts. Drawback in this setup is that I have to split my database for this.

1 0

Re: options for meta when using configuration backend
by Scott Koranda 16 May '12

16 May '12

On Tue, May 15, 2012 at 10:52 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, May 15, 2012 9:32 PM -0500 Scott Koranda <skoranda(a)gmail.com> > wrote: > >> Does slapd-meta built from 2.4.31 source support using >> slapd-config? > > > You never mentioned slapd-meta in your original post. The subject of the post was "options for meta when using configuration backend". I agree that the note could have been more clear. > olcDbURI is usually > associated with slapd-ldap. I don't believe slapd-meta has cn=config > support at this time. Thank you. I will proceed with slapd.conf. Scott > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration

1 0

options for meta when using configuration backend
by Scott Koranda 16 May '12

16 May '12

Hi, I am using slapd 2.4.23 on Debian Squeeze. Is 'olcDbURI' the correct configuration option to use with the configuration backend? Put another way, is 'olcDbURI' the configuration backend analog of the 'uri' target specification option used in the slapd.conf file? If 'olcDbURI' is not the correct option I would be grateful to know the correct option to use. Thanks, Scott

2 3

extracting
by Alex Samad - Yieldbroker 16 May '12

16 May '12

Hi Wondering if anyone can help me, I need to extra schema info out of MS AD and then add it to openldap . try to get openldap - proxy to - MS AD working... I can do simple type of searches like on cn, but I can do search on attributes like samaccountype ... I am guess that's it's a scheme issues... A

3 6

Re: options for meta when using configuration backend
by André Ribas 16 May '12

16 May '12

2012/5/15 Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Tuesday, May 15, 2012 5:35 PM -0500 Scott Koranda <skoranda(a)gmail.com> > wrote: > >> Hi, >> >> I am using slapd 2.4.23 on Debian Squeeze. > > > Bad idea. Build your own package. > Can I ask you why is it a bad idea? > > [...] > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > André Ribas

1 0

2.4.31 slapd-meta
by Eugene Vilensky 15 May '12

15 May '12

Hello, I am trying to move a meta-directory from version 2.3.43 (included with RHEL 5) to version 2.4.31 (openldap-ltb packages on RHEL6). I've tried to follow the man pages and FAQ properly in using newer directives for the same functionality, but searches that previously worked on 2.3.43 no longer work. The meta database in the 2.3.43 is defined like so: ----- database meta suffix "dc=example,dc=edu" uri "ldap://central-ldap.example.edu/ou=people,dc=example,dc=edu" idassert-bind bindmethod=simple binddn "cn=account,ou=service,dc=example,dc=edu" bindpw secret uri "ldap://localhost/ou=groups,dc=local,dc=example,dc=edu" idassert-bind bindmethod=simple binddn "cn=Manager,dc=local,dc=example,dc=edu" bindpw supersecret ---------- This seems to work (People are retrieved from the upstream ldap and a local bdb [not shown] database serves groupofnames memberships specific to our org unit), with deprecation warnings: /etc/openldap/slapd.conf: line 118: "binddn" statement is deprecated; use "acl-authcDN" instead /etc/openldap/slapd.conf: line 119: "bindpw" statement is deprecated; use "acl-passwd" instead /etc/openldap/slapd.conf: line 123: "binddn" statement is deprecated; use "acl-authcDN" instead /etc/openldap/slapd.conf: line 124: "bindpw" statement is deprecated; use "acl-passwd" instead [1] I've assumed binddn and bindpw are used by slapd-meta to perform searches against the remote directory. Is this wrong? Moving these configuration options to 2.4.31, my <database meta> is defined like so (focusing on the remote LDAP entry): database meta suffix "dc=example,dc=edu" uri "ldap://central-ldap.example.edu/ou=people,dc=example,dc=edu" idassert-bind bindmethod=simple binddn="cn=account,ou=service,dc=example,dc=edu" credentials="secret" Searches don't work and debug output includes among other information: 4fb288b5 conn=1001 op=11 meta_search_dobind_init[0] mc=0x7ff4c0104b20: non-empty dn with empty cred; binding anonymously request done: ld 0x7ff4c4101f40 msgid 2 res_errno: 48, res_error: <binds with a dn require a password>, res_matched: <> Is there a reason why credentials aren't being used along with bind dn? Was I wrong about assumption [1]? Hmm..the search works if I use "rebind-as-user yes" as an option for the remote URI, but I've not figured out from slapd-ldap(5) why this is so...the client credentials are not valid upstream, its a dn specific to the local database. Any help greatly appreciated (as before!) -Eugene

1 0

Root cause: Strange OpenLdap performace issue
by Michele Mase' 15 May '12

15 May '12

I've a tiny ldap service (only 6000 records) vith openldap 2.3.x rhel5.x master/slave; The first query takes me over 4 seconds (instead of taking less than 0.1.seconds): time ldapsearch -x -b "c=it" -s sub "(o=*)" -D "cn=Manager,dc=sir" -h www.example.com -w mypasswd The same query using one level takes only 0.4 seconds time ldapsearch -x -b "c=it" -s one "(o=*)" -D "cn=Manager,dc=sir" -h www.example.com -w mypasswd I've tested the following: New brand system with openldap 2.4.x rhel6.x mirror mode: both queries take me less than 0.2 seconds New brand system with the same releases, 2.3.x rhel5.x: both queries take me less than 0.2 seconds The problem should be in the prod. system: I've tried almost all: reindexing operations, better indexing options, more cache, better threads tuning, more cpu and ram to the servers ... nothing to do: the first quey takes more than 4 seconds. The last operation was a "disaster recovery" of the prod. ldap: 1 stop ldap on both systems 2 slapcat to save the last good ldif 3 remove of all databases (rm -fr /var/lib/ldap/*) on both systems 4 recreate dirs, DB_CONFIG and restore ldif; restore permissions 5 start ldap service on both servers And magically, the issue has gone! Now first query, yes the "bad" query with the subtree options, works like a charm, giving me the results in less than 0.1 seconds .... Which could be the root cause? DB defragmentation? I was unable to find the root cause. PLS, help me to find some suggestions. Regards Michele Masè

2 2

overlay nssov + pass-through authentication
by Uwe Werler 15 May '12

15 May '12

Hello list, up to now we have pam_ldap/nss_ldap running from padl and all user accounts have pass-through authentication configured to authenticate against an external ldap server.* Now I try the overlay nssov and except authentication all is running fine. If I use the userPassword directly the user can authenticate without problems. Isn't it possible to use pass-through authentication with overlay nssov? Thanks in advance! Regards Uwe *userPassword: {SASL}uid

1 0

Cannot mount users's home directories
by zingalo 15 May '12

15 May '12

Hi, i have problems mounting on the client ubuntu the users's home directories that are on a server debian squeeze with ldap-samba. First of all, which is the correct syntax for homeDirectory attribute if that home is on a server. I wrote: homeDirectory: //192.168.5.219/users/username but pam_mount tells me volume not found. am not sure of samba and smbldap configurations also. could you take a look of my conf files? this is smb.conf: [global] #identificazione workgroup = AMAHORO server string = amahoro security = user #opzioni di rete hosts allow = 192.168.5.0/24 localhost #opzioni per il log log file = /var/log/samba/log.%u max log size = 1000 log level = 3 #opzioni per l'accesso alle condivisioni encrypt passwords = yes null passwords = no security = user #smb passwd file = /etc/samba/smbpasswd username map = /etc/samba/smbusers #LDAP passdb backend = ldapsam:ldap://127.0.0.1/ ldap admin dn = cn=Manager,dc=amahoro,dc=bi ldap suffix = dc=amahoro,dc=bi ldap machine suffix = ou=Computers ldap user suffix = ou=Users ldap group suffix = ou=Groups ldap ssl = no add user script = /usr/local/sbin/smbldap-useradd -m "%u" add group script = /usr/local/sbin/smbldap-groupadd "%g" delete user from group script = /usr/local/sbin/smbldap-groupmod -x "%u" "%g" delete user script = /usr/local/sbin/smbldap-userdel "%u" delete group script = /usr/loca/sbin/smbldap-groupdel "%g" [homes] path = /users/%u browseable = no writable = yes valid users = %S read only = no guest ok = no admin users = %u write list = %u read list = %u create mask = 0700 directory mask = 0700 [user_data] comment = Leçon browseable = yes public = yes writable = no path = /user_data and this is smbldap.conf: # $Source: $ # $Id: smbldap.conf,v 1.18 2005/05/27 14:28:47 jtournier Exp $ # # smbldap-tools.conf : Q & D configuration file for smbldap-tools # This code was developped by IDEALX (http://IDEALX.org/) and # contributors (their names can be found in the CONTRIBUTORS file). # # Copyright (C) 2001-2002 IDEALX # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License # as published by the Free Software Foundation; either version 2 # of the License, or (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, # USA. # Purpose : # . be the configuration file for all smbldap-tools scripts ############################################################################## # # General Configuration # ############################################################################## # Put your own SID. To obtain this number do: "net getlocalsid". # If not defined, parameter is taking from "net getlocalsid" return SID="S-1-5-21-251852451-2940789264-3475694606" # Domain name the Samba server is in charged. # If not defined, parameter is taking from smb.conf configuration file # Ex: sambaDomain="IDEALX-NT" sambaDomain="AMAHORO" #realm="amahoro.bi" ############################################################################## # # LDAP Configuration # ############################################################################## # Notes: to use to dual ldap servers backend for Samba, you must patch # Samba with the dual-head patch from IDEALX. If not using this patch # . one master LDAP server where all writing operations must be done # . one slave LDAP server where all reading operations must be done # (typically a replication directory) # Slave LDAP server # Ex: slaveLDAP=127.0.0.1 # If not defined, parameter is set to "127.0.0.1" slaveLDAP="127.0.0.1" # Slave LDAP port # If not defined, parameter is set to "389" slavePort="389" # Master LDAP server: needed for write operations # Ex: masterLDAP=127.0.0.1 # If not defined, parameter is set to "127.0.0.1" masterLDAP="127.0.0.1" # Master LDAP port # If not defined, parameter is set to "389" #masterPort="389" masterPort="389" # Use TLS for LDAP # If set to 1, this option will use start_tls for connection # (you should also used the port 389) # If not defined, parameter is set to "0" ldapTLS="0" # Use SSL for LDAP # If set to 1, this option will use SSL for connection # (standard port for ldaps is 636) # If not defined, parameter is set to "0" ldapSSL="0" # How to verify the server's certificate (none, optional or require) # see "man Net::LDAP" in start_tls section for more details verify="require" # CA certificate # see "man Net::LDAP" in start_tls section for more details cafile="/etc/smbldap-tools/ca.pem" # certificate to use to connect to the ldap server # see "man Net::LDAP" in start_tls section for more details clientcert="/etc/smbldap-tools/smbldap-tools.iallanis.info.pem" # key certificate to use to connect to the ldap server # see "man Net::LDAP" in start_tls section for more details clientkey="/etc/smbldap-tools/smbldap-tools.iallanis.info.key" # LDAP Suffix # Ex: suffix=dc=IDEALX,dc=ORG suffix="dc=amahoro,dc=bi" # Where are stored Users # Ex: usersdn="ou=Users,dc=IDEALX,dc=ORG" # Warning: if 'suffix' is not set here, you must set the full dn for usersdn usersdn="ou=Users,${suffix}" # Where are stored Computers # Ex: computersdn="ou=Computers,dc=IDEALX,dc=ORG" # Warning: if 'suffix' is not set here, you must set the full dn for computersdn computersdn="ou=Computers,${suffix}" # Where are stored Groups # Ex: groupsdn="ou=Groups,dc=IDEALX,dc=ORG" # Warning: if 'suffix' is not set here, you must set the full dn for groupsdn groupsdn="ou=Groups,${suffix}" # Where are stored Idmap entries (used if samba is a domain member server) # Ex: groupsdn="ou=Idmap,dc=IDEALX,dc=ORG" # Warning: if 'suffix' is not set here, you must set the full dn for idmapdn idmapdn="ou=Idmap,${suffix}" # Where to store next uidNumber and gidNumber available for new users and groups # If not defined, entries are stored in sambaDomainName object. # Ex: sambaUnixIdPooldn="sambaDomainName=${sambaDomain},${suffix}" # Ex: sambaUnixIdPooldn="cn=NextFreeUnixId,${suffix}" sambaUnixIdPooldn="sambaDomainName=AMAHORO,${suffix}" # Default scope Used scope="sub" # Unix password encryption (CRYPT, MD5, SMD5, SSHA, SHA, CLEARTEXT) hash_encrypt="SSHA" # if hash_encrypt is set to CRYPT, you may set a salt format. # default is "%s", but many systems will generate MD5 hashed # passwords if you use "$1$%.8s". This parameter is optional! crypt_salt_format="%s" ############################################################################## # # Unix Accounts Configuration # ############################################################################## # Login defs # Default Login Shell # Ex: userLoginShell="/bin/bash" userLoginShell="/bin/bash" # Home directory # Ex: userHome="/home/%U" userHome="/users/%U" # Default mode used for user homeDirectory userHomeDirectoryMode="700" # Gecos userGecos="System User" # Default User (POSIX and Samba) GID defaultUserGid="513" # Default Computer (Samba) GID defaultComputerGid="550" # Skel dir skeletonDir="/etc/skel" # Default password validation time (time in days) Comment the next line if # you don't want password to be enable for defaultMaxPasswordAge days (be # careful to the sambaPwdMustChange attribute's value) defaultMaxPasswordAge="45" ############################################################################## # # SAMBA Configuration # ############################################################################## # The UNC path to home drives location (%U username substitution) # Just set it to a null string if you want to use the smb.conf 'logon home' # directive and/or disable roaming profiles # Ex: userSmbHome="\\PDC-SMB3\%U" userSmbHome="\\amahoro\users\%U" # The UNC path to profiles locations (%U username substitution) # Just set it to a null string if you want to use the smb.conf 'logon path' # directive and/or disable roaming profiles # Ex: userProfile="\\PDC-SMB3\profiles\%U" userProfile="\\amahoro\profiles\%U" # The default Home Drive Letter mapping # (will be automatically mapped at logon time if home directory exist) # Ex: userHomeDrive="H:" #userHomeDrive="H:" # The default user netlogon script name (%U username substitution) # if not used, will be automatically username.cmd # make sure script file is edited under dos # Ex: userScript="startup.cmd" # make sure script file is edited under dos userScript="logon.bat" # Domain appended to the users "mail"-attribute # when smbldap-useradd -M is used # Ex: mailDomain="idealx.com" mailDomain="iallanis.info" ############################################################################## # # SMBLDAP-TOOLS Configuration (default are ok for a RedHat) # ############################################################################## # Allows not to use smbpasswd (if with_smbpasswd == 0 in smbldap_conf.pm) but # prefer Crypt::SmbHash library with_smbpasswd="0" #smbpasswd="/usr/bin/smbpasswd" # Allows not to use slappasswd (if with_slappasswd == 0 in smbldap_conf.pm) # but prefer Crypt:: libraries with_slappasswd="0" slappasswd="/usr/sbin/slappasswd" # comment out the following line to get rid of the default banner # no_banner="1" Thanks for your time

2 4

LDAP & AUTOMOUNT QUESTION
by Borresen, John - 0442 - MITLL 14 May '12

14 May '12

All, Running OpenLDAP 2.4.23 on CentOS5.8. Looking into modifying our automount a bit. For example, say we have the following LDIF for an automap: from the auto.master: objectClass automount(structural) automountInformation auto.admin -nosuid automountKey /admin The auto.admin LDIF has this: objectClass automount(structural) automountInformation server:/vol/vol2/admin/documents automountKey docs There is another entry, same automountInformation (server:/vol/vol2/admin/documents) for documents and doc. Is there any way that we can combine those entries into one? For example, something like this: objectClass automount(structural) automountInformation server:/vol/vol2/admin/documents automountKey docs automountKey documents automountKey doc I tried to modify things in this fashion but, it failed, "only one automountKey is permitted". Thanks for the help, I hope I made our intentions clear. In the long run we would like to have the option for an EU (end-user) to be able to change directories to /admin/docs, /admin/documents, or /admin/doc. Dave Borresen Solaris/Linux Systems Administrator Surveillance Systems Group MIT Lincoln Laboratory john.borresen(a)ll.mit.edu

1 0

ACL for nssov-overlay
by Uwe Werler 14 May '12

14 May '12

Hello list, does someone know how I can define an ACL for the socket used by the nssov-overlay? I tried by socket.url="/var/run/nslcd/socket" read but it won't work. Any suggestions? Thanks in advance! Regards Uwe

1 0

Re: OpenLDAP 2.4.23 multi-master replication of the cn=config tree error: could not put entry file in place
by Brandon Hume 11 May '12

11 May '12

(Please reply to the list, so any useful information gets archived for others in the future...) On 05/11/12 05:39 AM, Cyril Grosjean wrote: > 26374 open("/etc/openldap/slapd.d/cn=config.ldif", O_RDONLY) = 16 > 26374 open("/etc/openldap/slapd.d/cn=config.40TIFd", > O_RDWR|O_CREAT|O_EXCL, 0600) = 16 > 26374 rename("/etc/openldap/slapd.d/cn=config.40TIFd", > "/etc/openldap/slapd.d/cn=config.ldif") = -1 EACCES (Permission denied) > 26374 unlink("/etc/openldap/slapd.d/cn=config.40TIFd") = 0 > So it really looks to me like a bug. As suggested by Quanah, I'll try > OpenLDAP 2.4.31 if I've time for that, but my goal was possibly to > stick to "official" rpms, for obvious support reasons. If it's a bug, then it's a bug in the operating system. strace traces system calls ("_s_ystem trace"). You can plainly see OpenLDAP creating the new cn=config.ldif as a tempfile, trying to rename it to overwrite the old, and being told by the *OS* that it's not allowed to do so. Here's the exact same operation on my own server: 5596 open("/appl/ldap/etc/slapd.d/cn=config.ldif", O_RDONLY) = 57 5596 open("/appl/ldap/etc/slapd.d/cn=config.Zi6PH7", O_RDWR|O_CREAT|O_EXCL, 0600) = 57 5596 rename("/appl/ldap/etc/slapd.d/cn=config.Zi6PH7", "/appl/ldap/etc/slapd.d/cn=config.ldif") = 0 How about showing us the exact permissions on the directory and that file? What's the output of: ls -lZd /etc/openldap/slapd.d /etc/openldap/slapd.d/cn=config.ldif and: getfacl /etc/openldap/slapd.d /etc/openldap/slapd.d/cn=config.ldif

3 2

2-node MMR w/ delta-syncrepl setup, out of sync, best way to resync?
by Brandon Hume 10 May '12

10 May '12

I have a new MMR setup, "kil-ds-3" and "kil-ds-4". I turns out that I was missing syncprov on the cn=accesslog tree, which the guys on IRC helped me out with correcting (thanks again, JoBbZ!). But even though I corrected that, and syncrepl is working great now, kil-ds-4 is not discovering and replicating the ~15k changes made on kil-ds-3 while syncing was broken, even when restarting the server. Howard pointed me at the -c command line argument for slapd, and I've given it a try with "slapd -c rid=002", as well as "slapd -c rid=002,sin=2,csn=0", and neither one causes the server to do a full resync, although the manpage says "-c rid=002" should be sufficient. Do the rules for that change in a mirrormode setup? Is the only real fix an "/etc/init.d/ldapd stop && rm -f ${DBDIR}/* && /etc/init.d/ldapd start"? *Somewhat* related to that... we have an "updater" process that runs through the directory and changes departmental affiliations, organizational affiliations, entitlements, and so on. Most of the time only a few dozen records get touched, but of course about three times a year new students come in, more graduate, and so on... and on those landmark days I might see tens of thousands of entries getting updated in about 30 minutes. With that kind of situation, what kind of value should I keep for olcSpSessionLog (syncprov-sessionlog)? If, for example, I had one side of the mirror down during this update process, would I lose any replication or performance if the sessionlog overflowed (olcSpSessionLog = 10000, and 25k changes are made)? I'm assuming the recovering node would simply fall back to a "present phase" synchronization and syncing'll just take a bit longer, and even then that will only happen if > 10k entries are *deleted* as opposed to modified. Am I understanding the process correctly?

2 2

RE: openldap to AD proxy
by Alex Samad - Yieldbroker 10 May '12

10 May '12

Still haven't been able to get this working. And can't find any way to turn on any debugging for ldap backend. If anyone has done this if they could provide some feed back. A -----Original Message----- From: Alex Samad - Yieldbroker Sent: Friday, 4 May 2012 2:32 PM To: 'openldap-technical(a)openldap.org' Subject: openldap to AD proxy Hi I am still struggling with the my openldap to AD proxy connection. I have successfully connected such that I can do search when I bind to openldap with an AD dn, but I want to be able to do anon search and I want anon to map through to a dn I have created in AD which has read only rights. dn: olcDatabase={3}ldap,cn=config objectClass: olcDatabaseConfig objectClass: olcLDAPConfig olcDatabase: {3}ldap olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * read olcReadOnly: TRUE olcRootDN: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth olcSizeLimit: 500 olcSuffix: dc=xyz,dc=com olcDburi: "ldap://ldap. xyz.com " olcDbRebindAsUser: TRUE olcDbChaseReferrals: TRUE olcdbaclbind: bindmethod=simple binddn="CN=ad readonly,OU=YB Services,OU= xyz,DC= xyz,DC=com" credentials=":)" starttls=no olcDbIDAssertBind: bindmethod=none binddn="CN=ad readonly,OU=YB Services,OU= xyz,DC= xyz,DC=com" credentials=":)" starttls=no I have a subordinate db at ou=external, DC= xyz,DC=com I can do a ldapsearch -x -D " CN=ad readonly,OU=YB Services,OU= xyz,DC= xyz,DC=com" -b " DC= xyz,DC=com" -w :) what I can't do is ldapsearch -x -b " DC= xyz,DC=com" I am thinking I want to map anon request through to the readonly DN. But still leave it such that when people bind to openldap as themselves they bind to AD as themselves How would I do that ? Thanks Alex

1 0

Re: slapadd hanging initializing mdb backend
by Mark 09 May '12

09 May '12

On Wed, May 2, 2012 at 3:37 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Monday, April 30, 2012 10:37 AM -0500 Mark <mah042(a)gmail.com> wrote: > > When I try to slapadd initial data into an empty mdb backend, the slapadd >> hangs: >> >> $ /tmp/openldap-2.4.31/sbin/**slapadd -w -S 1 -c -F >> /tmp/openldap-2.4.31/etc/**slapd.d -b dc=example,dc=com -l >> /tmp/openldap-2.4.31/etc/**initdb.ldif >> _#################### 100.00% eta none elapsed >> none fast! >> (does not return to a shell prompt. I have to INT it.) >> > > Caused by using -w, ITS#7225, currently fixed in git master. > Did you mean ITS#7255 ?

2 1

Lock table is out of available locks
by Marc Patermann 09 May '12

09 May '12

Hi, while extending an object by adding a lot of maildrop values, slapd refused to MOD with err 80: May 4 15:31:57 rzhs720 slapd[27004]: conn=1007 op=3 MOD dn="ou=infogroup,ou=foo" May 4 15:31:57 rzhs720 slapd[27004]: conn=1007 op=3 MOD attr=objectClass ou cn mail member maildrop May 4 15:31:57 rzhs720 slapd[27004]: slap_queue_csn: queing 0x7fd30c0c20f0 20120504133157.956217Z#000000#000#000000 May 4 15:31:57 rzhs720 slapd[27004]: bdb(ou=foo): Lock table is out of available locks May 4 15:31:57 rzhs720 slapd[27004]: => bdb_idl_insert_key: c_put id failed: Cannot allocate memory (12) May 4 15:31:57 rzhs720 slapd[27004]: conn=1007 op=3: attribute "maildrop" index add failure Adding the object with less maildrop entries is not a problem. # db_stat -c -h /var/lib/ldap/main-data/ 1834 Last allocated locker ID 0x7fffffff Current maximum unused locker ID 9 Number of lock modes 1000 Maximum number of locks possible 1000 Maximum number of lockers possible 1000 Maximum number of lock objects possible 7 Number of current locks 1000 Maximum number of locks at any one time 131 Number of current lockers 196 Maximum number of lockers at any one time 8 Number of current lock objects 611 Maximum number of lock objects at any one time 447M Total number of locks requested (447627426) 447M Total number of locks released (447627285) 0 Total number of locks upgraded 550 Total number of locks downgraded 17M Lock requests not available due to conflicts, for which we waited (17614104) 0 Lock requests not available due to conflicts, for which we did not wait 0 Number of deadlocks 0 Lock timeout value 0 Number of locks that have timed out 0 Transaction timeout value 0 Number of transactions that have timed out 544KB The size of the lock region 70M The number of region locks that required waiting (9%) -rw------- 1 ldap ldap 14M May 4 16:16 mail.bdb -rw------- 1 ldap ldap 9.0M May 4 16:16 maildrop.bdb # db_stat -m 2GB Total cache size 1 Number of caches 2GB Pool individual cache size 0 Maximum memory-mapped file size 0 Maximum open file descriptors 0 Maximum sequential buffer writes 0 Sleep after writing maximum sequential buffers 0 Requested pages mapped into the process' address space 511M Requested pages found in the cache (99%) 40787 Requested pages not found in the cache 14 Pages created in the cache 40787 Pages read into the cache 20862 Pages written from the cache to the backing file 0 Clean pages forced from the cache 0 Dirty pages forced from the cache 0 Dirty pages written by trickle-sync thread 40801 Current total page count 40801 Current clean page count 0 Current dirty page count 262147 Number of hash buckets used for page location 510M Total number of times hash chains searched for a page (510897500) 2 The longest hash chain searched for a page 564M Total number of hash chain entries checked for page (564617346) 1375049 The number of hash bucket locks that required waiting (0%) 364335 The maximum number of times any hash bucket lock was waited for (0%) 7486 The number of region locks that required waiting (12%) 0 The number of buffers frozen 0 The number of buffers thawed 0 The number of frozen buffers freed 49931 The number of page allocations 0 The number of hash buckets examined during allocations 0 The maximum number of hash buckets examined for an allocation 0 The number of pages examined during allocations 0 The max number of pages examined for an allocation 18790 Threads waited on page I/O Pool File: ou.bdb 4096 Page size 0 Requested pages mapped into the process' address space 8568 Requested pages found in the cache (99%) 30 Requested pages not found in the cache 0 Pages created in the cache 30 Pages read into the cache 579 Pages written from the cache to the backing file Pool File: givenName.bdb 4096 Page size 0 Requested pages mapped into the process' address space 9744 Requested pages found in the cache (92%) 811 Requested pages not found in the cache 0 Pages created in the cache 811 Pages read into the cache 508 Pages written from the cache to the backing file Pool File: mail.bdb 4096 Page size 0 Requested pages mapped into the process' address space 82597 Requested pages found in the cache (96%) 2802 Requested pages not found in the cache 1 Pages created in the cache 2802 Pages read into the cache 3687 Pages written from the cache to the backing file Pool File: uidNumber.bdb 4096 Page size 0 Requested pages mapped into the process' address space 911 Requested pages found in the cache (93%) 63 Requested pages not found in the cache 0 Pages created in the cache 63 Pages read into the cache 134 Pages written from the cache to the backing file Pool File: relativeDomainName.bdb 4096 Page size 0 Requested pages mapped into the process' address space 31932 Requested pages found in the cache (98%) 605 Requested pages not found in the cache 0 Pages created in the cache 605 Pages read into the cache 1890 Pages written from the cache to the backing file Pool File: cn.bdb 4096 Page size 0 Requested pages mapped into the process' address space 51546 Requested pages found in the cache (95%) 2683 Requested pages not found in the cache 2 Pages created in the cache 2683 Pages read into the cache 3198 Pages written from the cache to the backing file Pool File: maildrop.bdb 4096 Page size 0 Requested pages mapped into the process' address space 3908380 Requested pages found in the cache (99%) 2291 Requested pages not found in the cache 0 Pages created in the cache 2291 Pages read into the cache 3938 Pages written from the cache to the backing file Pool File: gidNumber.bdb 4096 Page size 0 Requested pages mapped into the process' address space 1097 Requested pages found in the cache (92%) 89 Requested pages not found in the cache 0 Pages created in the cache 89 Pages read into the cache 172 Pages written from the cache to the backing file Pool File: version.bdb 4096 Page size 0 Requested pages mapped into the process' address space 1744 Requested pages found in the cache (97%) 41 Requested pages not found in the cache 0 Pages created in the cache 41 Pages read into the cache 76 Pages written from the cache to the backing file Pool File: zoneName.bdb 4096 Page size 0 Requested pages mapped into the process' address space 3370 Requested pages found in the cache (99%) 30 Requested pages not found in the cache 0 Pages created in the cache 30 Pages read into the cache 131 Pages written from the cache to the backing file Pool File: entryCSN.bdb 4096 Page size 0 Requested pages mapped into the process' address space 83520 Requested pages found in the cache (99%) 306 Requested pages not found in the cache 0 Pages created in the cache 306 Pages read into the cache 1015 Pages written from the cache to the backing file Pool File: sn.bdb 4096 Page size 0 Requested pages mapped into the process' address space 10019 Requested pages found in the cache (92%) 765 Requested pages not found in the cache 0 Pages created in the cache 765 Pages read into the cache 643 Pages written from the cache to the backing file Pool File: objectClass.bdb 4096 Page size 0 Requested pages mapped into the process' address space 115341 Requested pages found in the cache (99%) 321 Requested pages not found in the cache 0 Pages created in the cache 321 Pages read into the cache 826 Pages written from the cache to the backing file Pool File: uid.bdb 4096 Page size 0 Requested pages mapped into the process' address space 2273 Requested pages found in the cache (91%) 216 Requested pages not found in the cache 0 Pages created in the cache 216 Pages read into the cache 171 Pages written from the cache to the backing file Pool File: id2entry.bdb 16384 Page size 0 Requested pages mapped into the process' address space 499M Requested pages found in the cache (99%) 17796 Requested pages not found in the cache 11 Pages created in the cache 17796 Pages read into the cache 1463 Pages written from the cache to the backing file Pool File: entryUUID.bdb 4096 Page size 0 Requested pages mapped into the process' address space 2183 Requested pages found in the cache (87%) 317 Requested pages not found in the cache 0 Pages created in the cache 317 Pages read into the cache 415 Pages written from the cache to the backing file Pool File: dn2id.bdb 4096 Page size 0 Requested pages mapped into the process' address space 7462379 Requested pages found in the cache (99%) 11621 Requested pages not found in the cache 0 Pages created in the cache 11621 Pages read into the cache 2016 Pages written from the cache to the backing file # ps -eLf | grep slapd | wc -l 19 Can anyone tell me what happens here and what to do about it? Marc

2 5

RE: pwdPolicySubentry & replication user
by Michael Starling 09 May '12

09 May '12

I also have no issues if I run syncrepl with a provider and consumer. Only mirror mode. Perhaps I'll try downgrading openLDAP. Thanks. Mike Date: Tue, 8 May 2012 16:54:25 -0400 From: brooksct(a)hbcs.org To: mlstarling31(a)hotmail.com CC: openldap-technical(a)openldap.org Subject: RE: pwdPolicySubentry & replication user I run that version without issues, but my infrastructure is still using good old reliable low-bandwidth slurpd, which is no longer supported. I don’t think syncrepl is sufficiently reliable yet, although others disagree. --Charlie From: Michael Starling [mailto:mlstarling31@hotmail.com] Sent: 2012 May 08 4:20 PM To: quanah(a)zimbra.com Cc: openldap Subject: RE: pwdPolicySubentry & replication user Re: Take the issue to Redhat Easier said than done. The policy is what it is but I didn't think it would do any harm to see if anyone has run into this issue. > Date: Tue, 8 May 2012 12:22:58 -0700 > From: quanah(a)zimbra.com > To: mlstarling31(a)hotmail.com > CC: openldap-technical(a)openldap.org > Subject: RE: pwdPolicySubentry & replication user > > --On Tuesday, May 08, 2012 3:07 PM -0400 Michael Starling > <mlstarling31(a)hotmail.com> wrote: > > > > > Unfortunately I have no choice as this is the latest available in the > > RHEL tree and my company won't allow us to deviate and compile. > > Then you will need to take issues to RedHat since your company has an > utterly broken policy. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration ------------------ CONFIDENTIALITY NOTICE --------------- This message, including any attachments, is for the sole use of the intended recipient(s) and may contain privileged confidential information protected by law. Any unauthorized review, use, disclosure or distribution of this message is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of this message. ------------------ CONFIDENTIALITY NOTICE ---------------

1 1

Questions about getting membership of a user
by ctosgh 09 May '12

09 May '12

Hi,All With openldap 2.4.x which supports memberOf overlay. I can get group info with only one search with following configs. <1> [root@/jacky/var]$cat user.ldif dn: cn=jacky,ou=users,dc=jacky,dc=com objectClass: organizationalPerson cn: jacky sn: sun userPassword: 11111111 [root@/jacky/var]$cat JackyGroup.ldif dn: cn=JackyGroup,ou=groups,dc=jacky,dc=com objectClass: groupOfNames cn: JackyGroup member: cn=jacky,ou=users,dc=jacky,dc=com <2> memberOf overlay is configured correctly <3> [root@/jacky/var]$ldapsearch -x -D "cn=root,dc=jacky,dc=com" -b "dc=jacky,dc=com" -H "ldap://x.x.x.x:389" -w xxx -s sub "(cn=jacky)" memberOf # extended LDIF # # LDAPv3 # base <dc=jacky,dc=com> with scope subtree # filter: (cn=jacky) # requesting: memberOf # # jacky, users, jacky.com dn: cn=jacky,ou=users,dc=jacky,dc=com memberOf: cn=JackyGroup,ou=groups,dc=jacky,dc=com [This is what I want] # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 My questions are here: A1: With openldap 2.4.x, if posixAccount is used to manage users, then attribute 'gidNumber' which is a number will represent user's membership. With this case, is it possible that I can get group info(DN format as above) of a user entry by ONLY one search? A2: With older openldap whihc does NOT support memberOf overlay: <1> If organizationalPerson is used to manage users, is it possible that I can get group info(DN format) of a user entry by ONLY one search? <2> If posixAccount is used to manage users, is it possible that I can get group info(DN format) of a user entry by ONLY one search?Any reply is appreciated~TIA Thanks, Jacky

1 1

pwdPolicySubentry & replication user
by Michael Starling 08 May '12

08 May '12

Consider the following password policy entry to disable password expiration. dn: cn=noexpire,ou=policies,dc=umlott,dc=lott cn: noexpire objectClass: pwdPolicy objectClass: person objectClass: top sn: Password Policy pwdAttribute: UserPassword pwdMaxAge: 0 pwdLockout: FALSE description: Non-Expiring password policy for service accounts. =============================================== The following LDIF attaches this policy to the 3 users below: dn: cn=ldapmgr,ou=Service,dc=umlott,dc=lott changetype: modify add: pwdPolicySubentry pwdPolicySubentry: cn=noexpire,ou=policies,dc=umlott,dc=lott dn: cn=bind,ou=Service,dc=umlott,dc=lott changetype: modify add: pwdPolicySubentry pwdPolicySubentry: cn=noexpire,ou=policies,dc=umlott,dc=lott dn: cn=replicator,ou=Service,dc=umlott,dc=lott changetype: modify add: pwdPolicySubentry pwdPolicySubentry: cn=noexpire,ou=policies,dc=umlott,dc=lott This all works well and good when setting up my first LDAP server, however when I setup another LDAP server in mirror mode to the first server the pwdPolicySubentry attribute doesn't carry over to the the second node and I start to see this in the slapd logs: ppolicy_bind: Setting warning for password expiry for cn=replicator,ou=service,dc=umlott,dc=lott = 0 seconds What's interesting is that the other two accounts that have the noexpire policy attached carry over the pwdPolicySubentry attribute just fine to the second node. Any insight would be greatly appreciated. Mike

3 6

acl filter problem
by Dorit 08 May '12

08 May '12

2 4

Memory consumption when increasing BDB_IDL_LOGN
by Meike Stone 07 May '12

07 May '12

Hello, how does the memory usage increase if I increase the BDB_IDL_LOGN? I tried to discover and understand this by searching in the mailing list (Is there is a good guide to understand all of this?). After a search, each returned up ID from bdb is located in one slot in the IDL list. On a x86_64 system, each slot is 8Byte. Each search stack in each thread (threads in slapd.conf) gets his own IDL slots. The default value for the threads are 16. With 16 bit BDB_IDL_LOGN (default) on x86_64 with default threads, we need 64k*8*16 = 1024KB memory? If I increase the BDB_IDL_LOGN to 20 we need 512k*8*16 = 8MB? 1) Are my assumptions above correct? 2) How do I increase LDAP_PVT_THREAD_STACK_SIZE? In my tests I used "4 * 1024 * 1024 * sizeof(void *)" and all tests where running well. 3) Are there other variables to increase before compiling? 4) Here we talk about 8MB memory, did I miss something, that is not the problem today or are there other things I did not catch (other caches in memory e.g. cachesize, dncachesize, idlcachesize or shared memory ...)? 5) What is the amount overall I have to expect for memory consumption? I understand, that after adding and deleting entires, the IDs "sparse out" for one index and we loose precision (if we have after search more IDs than BDB_IDL_LOGN), because using ranges. This Problem will increase as older the database becomes. But if I increase the BDB_IDL_LOGN to my needed size (max expected returned IDs from during search a indexed attibute), the problem with "getting older" is not important for me? Thanks a lot, Meike

2 2

Cached user info?
by Braden McDaniel 07 May '12

07 May '12

I found it necessary to change the GID of a POSIX group defined in LDAP. But when I log in with a user that is a member of this group, I find that the user's group membership still reflects the old GID. At this point, I've tried removing the user from the group, and adding it back--it still comes up with the old GID when logged in (or, specifically, typing "groups" at the command prompt lists a group associated with the old GID), even though I can't see *anything* referencing the old GID in the LDAP database. I am stumped. Anyone have ideas about what might be going on here? -- Braden McDaniel <braden(a)endoframe.com>

4 8

HowTo index generalizedTimeOrderingMatch
by Meike Stone 07 May '12

07 May '12

Hello, I have in my own schema an attribute defined: attributetype (1.3.6.1.4.... NAME ('InsertTime') EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 ) Now I can use this and search, but it takes very long. So I want index it for searching: * greater (">=") * less ("<=") Is it possible and how can I do this? I have only seen "eq" and "pres". Thanks in advance Meike

3 3

open ldap gruop syncing
by dhanushka ranasinghe 07 May '12

07 May '12

hi guys ,,, i have a master LDAP server and its has a group called . cn=internal ou=group,dc=example,dc=com --users of this group is : uid=user1,ou=staff,dc=example,dc=com uid=user2,ou=staff,dc=example,dc=com and i want to sync this users to slave ldap server. under OU=staff , in my slave config file i used the following configuration , syncrepl rid=004 provider=ldap://masterldapserver bindmethod=simple binddn="cn=admin,dc=example,dc=com" credentials="passWord" searchbase="cn=internal,ou=group,dc=example,dc=com" schemachecking=off type=refreshAndPersist retry="60 +" sync seems to be working fine but users appers as [1] but not under OU=staff, [1] dn: cn=internal,ou=group,dc=example,dc=com objectClass: groupOfNames objectClass: top cn: internal member: uid=user1,ou=user,dc=example,dc=com member: uid=user1,ou=user,dc=example,dc=com is there any way sort out this issue Thank You Dhanushka

1 0

Can't login with ldap user
by zingalo 04 May '12

04 May '12

Hi, trying to login from my laptop ubuntu 11.10 using ldap user zingalo, appears a black screen and it comes back to login screen. Could you take a look of this paste of syslog please and tell me what do i have to fix? http://pastebin.com/k0dQq6NN Are many lines! Thanks

2 4

openldap to AD proxy
by Alex Samad - Yieldbroker 04 May '12

04 May '12

Hi I am still struggling with the my openldap to AD proxy connection. I have successfully connected such that I can do search when I bind to openldap with an AD dn, but I want to be able to do anon search and I want anon to map through to a dn I have created in AD which has read only rights. dn: olcDatabase={3}ldap,cn=config objectClass: olcDatabaseConfig objectClass: olcLDAPConfig olcDatabase: {3}ldap olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * read olcReadOnly: TRUE olcRootDN: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth olcSizeLimit: 500 olcSuffix: dc=xyz,dc=com olcDburi: "ldap://ldap. xyz.com " olcDbRebindAsUser: TRUE olcDbChaseReferrals: TRUE olcdbaclbind: bindmethod=simple binddn="CN=ad readonly,OU=YB Services,OU= xyz,DC= xyz,DC=com" credentials=":)" starttls=no olcDbIDAssertBind: bindmethod=none binddn="CN=ad readonly,OU=YB Services,OU= xyz,DC= xyz,DC=com" credentials=":)" starttls=no I have a subordinate db at ou=external, DC= xyz,DC=com I can do a ldapsearch -x -D " CN=ad readonly,OU=YB Services,OU= xyz,DC= xyz,DC=com" -b " DC= xyz,DC=com" -w :) what I can't do is ldapsearch -x -b " DC= xyz,DC=com" I am thinking I want to map anon request through to the readonly DN. But still leave it such that when people bind to openldap as themselves they bind to AD as themselves How would I do that ? Thanks Alex

1 0

SMB+OPENLDAP
by Alejandro Iacobelli 03 May '12

03 May '12

Hello to all, my name is Alejandro and I have a little question to anyone of this list. I´ve created ,6 years ago, an ldap+smb proyect for a big company. Back then, samba (Lenny server) only worked with NT hashes but now (Squeeze server) they want to authenticate with Win7 (ntlm2 protocols) And configurating windows7 to accept old NT hashes is not an exit. I want to update ONLY the smb package from samba (2:3.2.5-4lenny15) to samba (2:3.5.6~dfsg-3squeeze8). My question is this: Can you give me some information about if openldap could crash if only I update the samba module and not the ldap one? i need to know if something could go wrong in the relation with openldap. ( I will not touch openldap because i've modified that version by myself ).

2 1

Re: Slapd Error
by Andy Carlson 03 May '12

03 May '12

Michael, Thanks for your help. We found that it was the audit log that was slightly over 2GB, so I cleaned that up and it is good now. Andy Carlson Moody Bible Institute Identity Administrator | Information Systems 312-329-4385 www.moody.edu Michael Ströder <michael(a)stroeder.com> wrote: Andy Carlson wrote: > Here are the files [..] And what does ulimit -a say? Ciao, Michael.

1 0

Slapd Error
by Andy Carlson 02 May '12

02 May '12

I am running OpenLDAP 2.4.11 and I am getting an error when I attempt to modify, delete, or add to the directory with a credentialed user (has worked for the past few years perfectly). I did a debug-level report on the server and it's giving me with respect to my modify request, I am getting the following results: bdb_modify: updated id=00013892 dn="mbiUniqueID=669103f11bb82ef68f6adbcf75216c1b,ou=people, dc=XXXXXX,dc=XXX " send_ldap_result: conn=1057 op=1 p=3 send_ldap_result: err=0 matched="" text="" => bdb_entry_get: ndn: "mbiUniqueID=669103f11bb82ef68f6adbcf75216c1b,ou=people, dc=XXXXXX,dc=XXX " => bdb_entry_get: oc: "(null)", at: "(null)" bdb_dn2entry("mbiUniqueID=669103f11bb82ef68f6adbcf75216c1b,ou=people, dc=XXXXXX,dc=XXX ") => bdb_entry_get: found entry: "mbiUniqueID=669103f11bb82ef68f6adbcf75216c1b,ou=people, dc=XXXXXX,dc=XXX " bdb_entry_get: rc=0 => test_filter PRESENT => access_allowed: search access to "mbiUniqueID=669103f11bb82ef68f6adbcf75216c1b,ou=people, dc=XXXXXX,dc=XXX " "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) <= test_filter 6 syncprov_matchops: sid 000 fscope 1 rc 6 ./slapd-PRODM1: line 227: 26203 File size limit exceeded$SLAPD_BIN -h "$SLAPD_SERVICES" $SLAPD_PARAMS slapd-PRODM1[26473]: [ALERT] slapd not running Also, the service script in /etc/init.d is named slapd-PRODM1. The line number given in the second to last line of the error corresponds to the line where the start_slapd function (to start the service) is declared. The function is as follows: start_slapd() { # Check if db_recover is required if [ $RECOVER_AT_STARTUP -eq 1 ] then db_recover else message "info" "[INFO] no db_recover done" fi # Start message message "info" "Launching OpenLDAP..." # File descriptor limit, only for root if [ `id -u` -eq 0 ] then ulimit -n $FD_LIMIT if [ $? -eq 0 ] then message "info" "[OK] file descriptor limit set to $FD_LIMIT" else message "warning" "[WARNING] Fail to set file descriptor limit to $FD_LIMIT, going to next step" fi else message "info" "[INFO] file descriptor limit not modified (require root privileges)" fi # Parameters # if [ "$SLAPD_CONF" ] # then # SLAPD_PARAMS="$SLAPD_PARAMS -f $SLAPD_CONF" # fi # if [ "$SLAPDD_DIR" ] # then # SLAPD_PARAMS="$SLAPD_PARAMS -F $SLAPDD_DIR" # fi SLAPD_PARAMS="$SLAPD_PARAMS $SLAPD_CONF_LOAD" if [ "$SLAPD_USER" -a `id -u` -eq 0 ] then SLAPD_PARAMS="$SLAPD_PARAMS -u $SLAPD_USER" fi if [ "$SLAPD_GROUP" -a `id -u` -eq 0 ] then SLAPD_PARAMS="$SLAPD_PARAMS -g $SLAPD_GROUP" fi # It's time to start slapd $SLAPD_BIN -h "$SLAPD_SERVICES" $SLAPD_PARAMS sleep 1 # Presence of PID file if [ ! -r $SLAPD_PID_FILE ] then message "alert" "[ALERT] no PID file for slapd" exit 1 fi # Is slapd launched? PID=`cat $SLAPD_PID_FILE` if [ ! -e /proc/$PID ] then message "alert" "[ALERT] slapd not running" exit 1 else message "info" "[OK] OpenLDAP started on port $PORT" fi } It should be noted that this machine has been working without problems for the past year or more, so I can only assume that the "File Size Limit Exceeded" error above relates to one of the Berkley DB files. Is this correct? Let me know if you have any thoughts. Thanks much!!!, Andy Carlson Moody Bible Institute Identity Administrator | Information Systems 312-329-4385 www.moody.edu<http://www.moody.edu>

3 4

slapadd hanging initializing mdb backend
by Mark 02 May '12

02 May '12

When I try to slapadd initial data into an empty mdb backend, the slapadd hangs: $ /tmp/openldap-2.4.31/sbin/slapadd -w -S 1 -c -F /tmp/openldap-2.4.31/etc/slapd.d -b dc=example,dc=com -l /tmp/openldap-2.4.31/etc/initdb.ldif _#################### 100.00% eta none elapsed none fast! (does not return to a shell prompt. I have to INT it.) I add '-d -1' to get some debugging output and I get this after removing the data.mdb and lock.mdb created above: $ /tmp/openldap-2.4.31/sbin/slapadd -d -1 -w -S 1 -c -F /tmp/openldap-2.4.31/etc/slapd.d -b dc=example,dc=com -l /tmp/openldap-2.4.31/etc/initdb.ldif (lines removed for brevity but can be submitted if need be) 4f9ea9c0 => str2entry: "dn: ou=Users,dc=example,dc=com objectClass: organizationalUnit ou: Users " 4f9ea9c0 >>> dnPrettyNormal: <ou=Users,dc=example,dc=com> 4f9ea9c0 <<< dnPrettyNormal: <ou=Users,dc=example,dc=com>, <ou=users,dc=example,dc=com> 4f9ea9c0 <= str2entry(ou=Users,dc=example,dc=com) -> 0x6afeba8 4f9ea9c0 oc_check_required entry (ou=Users,dc=example,dc=com), objectClass "organizationalUnit" 4f9ea9c0 oc_check_allowed type "objectClass" 4f9ea9c0 oc_check_allowed type "ou" 4f9ea9c0 oc_check_allowed type "structuralObjectClass" 4f9ea9c0 => mdb_tool_entry_put( -1, "ou=Users,dc=example,dc=com" ) 4f9ea9c0 => mdb_dn2id("ou=users,dc=example,dc=com") 4f9ea9c0 <= mdb_dn2id: get failed: MDB_NOTFOUND: No matching key/data pair found (-30798) 4f9ea9c0 => mdb_dn2id_add 0x6: "ou=users,dc=example,dc=com" 4f9ea9c0 <= mdb_dn2id_add 0x6: 0 4f9ea9c0 => index_entry_add( 6, "ou=Users,dc=example,dc=com" ) 4f9ea9c0 mdb_idl_insert_keys: 6 [9bee355f] 4f9ea9c0 mdb_idl_insert_keys: 6 [ef1184ca] 4f9ea9c0 mdb_idl_insert_keys: 6 4f9ea9c0 <= index_entry_add( 6, "ou=Users,dc=example,dc=com" ) success 4f9ea9c0 => mdb_entry_encode(0x00000006): ou=Users,dc=example,dc=com 4f9ea9c0 <= mdb_entry_encode(0x00000006): ou=Users,dc=example,dc=com 4f9ea9c0 => mdb_dn2id("dc=example,dc=com") 4f9ea9c0 <= mdb_dn2id: got id=0x1 4f9ea9c0 => mdb_entry_decode: 4f9ea9c0 <= mdb_entry_decode 4f9ea9c0 => mdb_tool_entry_modify( 1, "(null)" ) (it's hung) Here is the /tmp/openldap-2.4.31/etc/initdb.ldif: ### BEGIN INITDB.LDIF dn: dc=example,dc=com objectClass: organization objectClass: dcObject dc: example o: example.com dn: cn=manager,dc=example,dc=com objectClass: organizationalRole objectClass: simpleSecurityObject cn: manager userPassword: {SSHA}asif dn: cn=replicator,dc=example,dc=com objectClass: organizationalRole objectClass: simpleSecurityObject cn: replicator userPassword: {SSHA}asif dn: ou=Groups,dc=example,dc=com objectClass: organizationalUnit ou: Groups dn: cn=LDAP Admins,ou=Groups,dc=example,dc=com objectClass: top objectClass: groupOfUniqueNames cn: LDAP Admins uniqueMember: cn=manager,dc=example,dc=com dn: ou=Users,dc=example,dc=com objectClass: organizationalUnit ou: Users ### END INITDB.LDIF I used the following slaptest commands to create the initial slapd.d/ directory from a slapd.conf file: $ /tmp/openldap-2.4.31/sbin/slaptest -u -f /tmp/openldap-2.4.31/etc/slapd.conf -F /tmp/openldap-2.4.31/etc/slapd.d config file testing succeeded $ /tmp/openldap-2.4.31/sbin/slaptest -f /tmp/openldap-2.4.31/etc/slapd.conf -F /tmp/openldap-2.4.31/etc/slapd.d 4f9eab15 mdb_db_open: database "dc=example,dc=com" cannot be opened, err 2. Restore from backup! 4f9eab15 backend_startup_one (type=mdb, suffix="dc=example,dc=com"): bi_db_open failed! (2) slap_startup failed (test would succeed using the -u switch) Here is the /tmp/openldap-2.4.31/etc/slapd.conf: ### BEGIN SLAPD.CONF include /tmp/openldap-2.4.31/etc/schema/core.schema include /tmp/openldap-2.4.31/etc/schema/cosine.schema include /tmp/openldap-2.4.31/etc/schema/nis.schema include /tmp/openldap-2.4.31/etc/schema/inetorgperson.schema argsfile /tmp/openldap-2.4.31/var/run/slapd.args pidfile /tmp/openldap-2.4.31/var/run/slapd.pid threads 8 tool-threads 2 idletimeout 0 writetimeout 0 reverse-lookup off loglevel stats serverid 1 ldap://boardwalk:2389 modulepath /tmp/openldap-2.4.31/libexec moduleload back_monitor.la moduleload back_mdb.la moduleload syncprov.la password-hash {SSHA} sizelimit unlimited database config rootdn "cn=manager,dc=example,dc=com" access to * by group="cn=LDAP Admins,ou=Groups,dc=example,dc=com" write by users read by * none database monitor rootdn "cn=manager,dc=example,dc=com" access to * by users read by * none database mdb suffix "dc=example,dc=com" rootdn "cn=manager,dc=example,dc=com" directory /tmp/openldap-2.4.31/var/data index objectClass eq index entryCSN eq index entryUUID eq syncrepl rid=001 provider=ldap://boardwalk:2389 type=refreshAndPersist retry="15 +" bindmethod=simple binddn="cn=replicator,dc=example,dc=com" credentials="asif" searchbase="dc=example,dc=com" starttls=no schemachecking=off syncrepl rid=002 provider=ldap://chance:2389 type=refreshAndPersist retry="15 +" bindmethod=simple binddn="cn=replicator,dc=example,dc=com" credentials="asif" searchbase="dc=example,dc=com" starttls=no schemachecking=off syncrepl rid=003 provider=ldap://freeparking:2389 type=refreshAndPersist retry="15 +" bindmethod=simple binddn="cn=replicator,dc=example,dc=com" credentials="asif" searchbase="dc=example,dc=com" starttls=no schemachecking=off mirrormode TRUE overlay syncprov syncprov-checkpoint 50 10 syncprov-sessionlog 100 access to attrs=userPassword by anonymous auth by self write by dn.exact="cn=replicator,dc=example,dc=com" read by * none access to * by group="cn=LDAP Admins,ou=Groups,dc=example,dc=com" write by dn.exact="cn=replicator,dc=example,dc=com" read by users read by * none limits dn.exact="cn=replicator,dc=example,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited ### END SLAPD.CONF I compiled from the following source: OpenLDAP 2.4.31 OpenSSL 1.0.1b Cyrus-SASL 2.1.25 I am running in the following environment: Dell Poweredge 2950; dual-core Intel(R) Xeon(R) CPU 5110 @ 1.60GHz; 8GB RAM Scientific Linux 5.7 Am I doing something wrong (besides the ACLs for cn=LDAP Admins,ou=Groups,dc=example,dc=com. I'm still struggling there) ? Thank you, Mark

2 1

DEL don't get synced
by Marc Patermann 02 May '12

02 May '12

Hi, under some circumstances DEL don't get replicated to the consumers (SyncRepl). I think this has to do with other changes at the some moment. I attached two logs excepts in sync.log. In the first except there is only a DEL Jan 31 09:16:01 ldapserver slapd[10641]: conn=79138 op=2 DEL dn="employeeNumber=19676,ou=humans,ou=foo" For this there is a Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 line for every connected consumer. In the second step there is a MOD and a DEL Jan 31 10:31:01 ldapserver slapd[10641]: conn=79938 op=2 MOD dn="ou=FA-WF,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=79938 op=3 DEL dn="employeeNumber=24387,ou=humans,ou=foo" As far as I can see, there is only sync activity for the MOD action, and not for the DEL action. The DEL is not synced. Marc

11 44

Monitor : HOW TO ?
by Olivier 02 May '12

02 May '12

I have worked on looked for help to configure and use slapd monitor abilities under redhat 6 with no success. Here is my monitor section : cat /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{2\}monitor.ldif dn: olcDatabase={2}monitor,cn=config objectclass: olcDatabaseConfig olcaccess: {0}to * by dn.exact=”cn=Manager,dc=exemple,dc=fr” by * none olcaddcontentacl: FALSE olcdatabase: {2}monitor olclastmod: TRUE olcmaxderefdepth: 15 olcmonitoring: FALSE olcreadonly: FALSE olcsyncusesubentry: FALSE …. slapd runs and respond : # ldapsearch -x -D ‘cn=Manager,dc=exemple,dc=fr’ -W -b ‘olcDatabase={2}monitor,cn=config’ -s base 1.1 # {2}monitor, config dn: olcDatabase={2}monitor,cn=config # search result search: 2 result: 0 Success However I can’t get any monitoring information : $ ldapsearch -x -D ‘cn=Manager,dc=exemple,dc=fr’ -W -b ‘cn=Monitor’ -s base 1.1 # search result search: 2 result: 32 No such object Would you have any advice to use openldap monitoring abilities ? # cat /etc/issue Red Hat Enterprise Linux Server release 6.2 (Santiago) # rpm -qa | grep openldap-servers openldap-servers-2.4.23-20.el6.x86_64 # slapd -VVV @(#) $OpenLDAP: slapd 2.4.23 (Oct 4 2011 07:43:22) $ mockbuild@x86-010.build.bos.redhat.com:/builddir/build/BUILD/openldap-2.4.23/openldap-2.4.23/build-servers/servers/slapd Thanks for any help one could provide ! --- Olivier

2 1

Tightening up ppolicy
by Kline, Sara 02 May '12

02 May '12

We are using ppolicy to manage the password policy on our LDAP server. It at least checks the minimum length and the minimum amount of time needed before a person can change their password again, but is there a way to get it to check for upper case, lower case, numbers, etc? We need to force our users to make complex passwords. Sara Kline System Administrator Transaction Network Services, Inc 4501 Intelco Loop, Lacey WA 98503 Wk: (360) 493-6736 Cell: (360) 280-2495 ________________________________ This e-mail message is for the sole use of the intended recipient(s)and may contain confidential and privileged information of Transaction Network Services. Any unauthorised review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

4 7

cannot populate with smbldap-populate
by stefano malini 30 Apr '12

30 Apr '12

Hi, i cannot end the populating process using smbldap-populate due to this errors: root@amahoro:~# smbldap-populate Populating LDAP directory for domain AMAHORO (S-1-5-21-251852451-2940789264-3475694606) (using builtin directory structure) entry dc=amahoro,dc=bi already exist. entry ou=Users,dc=amahoro,dc=bi already exist. entry ou=Groups,dc=amahoro,dc=bi already exist. entry ou=Computers,dc=amahoro,dc=bi already exist. entry ou=Idmap,dc=amahoro,dc=bi already exist. adding new entry: uid=root,ou=Users,dc=amahoro,dc=bi failed to add entry: index generation failed at /usr/sbin/smbldap-populate line 498, <GEN1> line 58. adding new entry: uid=nobody,ou=Users,dc=amahoro,dc=bi failed to add entry: index generation failed at /usr/sbin/smbldap-populate line 498, <GEN1> line 89. adding new entry: cn=Domain Admins,ou=Groups,dc=amahoro,dc=bi failed to add entry: index generation failed at /usr/sbin/smbldap-populate line 498, <GEN1> line 101. adding new entry: cn=Domain Users,ou=Groups,dc=amahoro,dc=bi failed to add entry: index generation failed at /usr/sbin/smbldap-populate line 498, <GEN1> line 112. adding new entry: cn=Domain Guests,ou=Groups,dc=amahoro,dc=bi failed to add entry: index generation failed at /usr/sbin/smbldap-populate line 498, <GEN1> line 123. adding new entry: cn=Domain Computers,ou=Groups,dc=amahoro,dc=bi failed to add entry: index generation failed at /usr/sbin/smbldap-populate line 498, <GEN1> line 134. adding new entry: cn=Administrators,ou=Groups,dc=amahoro,dc=bi failed to add entry: index generation failed at /usr/sbin/smbldap-populate line 498, <GEN1> line 179. adding new entry: cn=Account Operators,ou=Groups,dc=amahoro,dc=bi failed to add entry: index generation failed at /usr/sbin/smbldap-populate line 498, <GEN1> line 201. adding new entry: cn=Print Operators,ou=Groups,dc=amahoro,dc=bi failed to add entry: index generation failed at /usr/sbin/smbldap-populate line 498, <GEN1> line 212. adding new entry: cn=Backup Operators,ou=Groups,dc=amahoro,dc=bi failed to add entry: index generation failed at /usr/sbin/smbldap-populate line 498, <GEN1> line 223. adding new entry: cn=Replicators,ou=Groups,dc=amahoro,dc=bi failed to add entry: index generation failed at /usr/sbin/smbldap-populate line 498, <GEN1> line 234. entry sambaDomainName=AMAHORO,dc=amahoro,dc=bi already exist. Updating it... Please provide a password for the domain root: /usr/sbin/smbldap-passwd: user root doesn't exist i don't find the error "index generation failed" on internet. Do you know the problem? Thanks

7 21

Problem adding sambaGroupMapping
by stefano malini 28 Apr '12

28 Apr '12

Hi, i show the command-output trying to add the objectClass sambaGroupMapping to some entries that have posixGroup objectClass: root@amahoro:~# ldapmodify -x -W -D 'cn=Manager,dc=amahoro,dc=bi' Enter LDAP Password: dn: cn=Students,ou=Groups,dc=amahoro,dc=bi changetype: modify add: objectClass objectClass: posixGroup objectClass: sambaGroupMapping sambaSID: S-1-5-21-251852451-2940789264-3475694606 sambaGroupType: 5 ldapmodify: wrong attributeType at line 6, entry "cn=Students,ou=Groups,dc=amahoro,dc=bi" I don't know what is wrong, sambaSID is a correct attribute. Do you have ideas? Thanks

2 2

Remove a schema using OpenLDAP dynamic configuration
by Jean-Philippe Braun 27 Apr '12

27 Apr '12

Hi all, I'm trying to add/remove schemas dynamically using the cn=config database (using slapd 2.4.23-7.2 on debian stable). I'm connected to slapd with the SASL/External method as root and I'm able to search but delete breaks: # ldapdelete -Y EXTERNAL -H ldapi:/// "cn={2}nis,cn=schema,cn=config" SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 ldap_delete: Server is unwilling to perform (53) The ACL seems correct to me: # ldapsearch -LLL -Y EXTERNAL -H ldapi:/// -b "cn=config" "olcDatabase={0}config" olcAccess SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 dn: olcDatabase={0}config,cn=config olcAccess: {0}to * by dn.exact=gidNumber=0 +uidNumber=0,cn=peercred,cn=external ,cn=auth manage by * break So is it possible to remove a schema like this ? I should miss something... Thank you

3 4

Re: OpenLDAP 2.4.31 available
by Clément OUDOT 27 Apr '12

27 Apr '12

Le 23 avril 2012 18:49, OpenLDAP Project <project(a)openldap.org> a écrit : > OpenLDAP 2.4.31 is now available for download as detailed on our download page: > > http://www.openldap.org/software/download/ > Hi, for people using RPMs, I published some here: http://ltb-project.org/wiki/download#openldap Clément.

2 1

replicating and refint
by Marc Patermann 26 Apr '12

26 Apr '12

Hi, on a master server overlay syncprov and overlay refint (refint_attributes member memberOf) are set. Now on object, which is in a group is deleted. Refint changes the group by deleting the member. The changed user object and the group are to be replicated. The user is. The group is not: Apr 26 17:31:04 server slapd[6475]: syncrepl_entry: rid=401 ou=group,ou=foo Apr 26 17:31:04 server slapd[6475]: syncrepl_entry: rid=401 entry unchanged, ignored (ou=group,ou=foo) dn: ou=group,ou=foo modifyTimestamp: 20110704123836Z modifiersName: cn=Referential Integrity Overlay entryCSN: 20110704123836.000000Z#000001#000#000000 So this is advertised for replication, but the does not happen. This is 2.4.26, has this changed in later versions? Marc

2 1

ldapsearch: Search for Operational Attributes using wildcards
by Uncle Hildegard 26 Apr '12

26 Apr '12

Hi there, I don't understand what's happening here so hopefully someone can help me with this. I have a DIT that contains objects like this: uid=test,ou=user,ou=sales,o=Testcompany Now I want to find out all objects that have "sales" in their DN. Since DN is not an attribute one can search for I used the the operational attribute "entryDN": ldapsearch -x "(entryDN=*sales*)" cn That search didn't find anything. After that I tried ldapsearch -x "(entryDN=uid=test,ou=user,ou=sales,o=Testcompany)" cn and got the expected result. Now it seems that as soon as I use a wildcard in the filter argument the search returns nothing. Even ldapsearch -x "(entryDN=uid=test,ou=user,ou=sales,o=Testcompan*)" cn returns nothing. I've also tried things like ldapsearch -x "(entryDN:dnSubtreeMatch:=*sales*)" cn which returned no result either. Any ideas what I'm doing wrong? Any help would be greatly appreciated! Cheers -- Markus

3 4

OpenLDAP unresponsible after modify/replication operation
by Arturo Borrero Gonzalez 26 Apr '12

26 Apr '12

Hi there, I have an active-active LDAP cluster with N-way multi-master configuration. The slapd version is: 2.4.23-7.2 (Debian Squeeze) After a modify operation in the cn=config tree, we get and unresponsible server (all nodes in the cluster) This is the log (256 loglevel) for the node who gets the original MOD operation. Note the time cut between 12:23:55 and 12:42:54 The deferring operation message was repeated before that cut, and today It's the first time I see it. [...] Apr 26 12:23:55 ldap2 slapd[19556]: conn=7352 op=0 RESULT tag=97 err=0 text= Apr 26 12:23:55 ldap2 slapd[19556]: conn=7352 op=2 UNBIND Apr 26 12:23:55 ldap2 slapd[19556]: conn=7352 fd=204 closed Apr 26 12:23:55 ldap2 slapd[19556]: conn=1399 op=27 MOD dn="olcDatabase={1}hdb,cn=config" Apr 26 12:23:55 ldap2 slapd[19556]: conn=1399 op=27 MOD attr=olcAccess *** Apr 26 12:42:54 ldap2 slapd[19556]: do_syncrepl: rid=001 rc -5 retrying (4 retries left) Apr 26 12:42:54 ldap2 slapd[19556]: do_syncrepl: rid=006 rc -5 retrying (4 retries left) Apr 26 12:42:54 ldap2 slapd[19556]: do_syncrepl: rid=003 rc -5 retrying (4 retries left) Apr 26 12:42:54 ldap2 slapd[19556]: conn=1399 op=27 RESULT tag=103 err=0 text= Apr 26 12:42:54 ldap2 slapd[19556]: conn=7353 fd=135 ACCEPT from IP=[xxx:xx:xx:xx::xx]:58394 (IP=[::]:636) Apr 26 12:42:54 ldap2 slapd[19556]: conn=7354 fd=136 ACCEPT from IP=xx.xx.x.xx:58617 (IP=0.0.0.0:636) Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=5551 deferring operation: too many executing Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=3876 deferring operation: too many executing Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=3876 deferring operation: too many executing Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=3876 deferring operation: pending operations Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=3876 deferring operation: too many executing Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=3876 deferring operation: pending operations Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=3876 deferring operation: too many executing Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=3876 deferring operation: pending operations Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=3876 deferring operation: too many executing Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=3876 deferring operation: pending operations Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=3876 deferring operation: too many executing Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=3876 deferring operation: pending operations Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=3876 deferring operation: too many executing Apr 26 12:42:54 ldap2 slapd[19556]: conn=1399 fd=48 closed (connection lost) Apr 26 12:42:54 ldap2 slapd[19556]: conn=1451 fd=50 closed (connection lost) [...] Apr 26 12:42:54 ldap2 slapd[19556]: conn=7224 op=2 UNBIND Apr 26 12:42:54 ldap2 slapd[19556]: conn=7224 fd=134 closed Apr 26 12:42:54 ldap2 slapd[19556]: conn=6456 op=6 RESULT tag=97 err=0 text= Apr 26 12:42:54 ldap2 slapd[19556]: conn=5551 op=8 ABANDON msg=8 Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=2035 deferring operation: too many executing Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=2035 deferring operation: pending operations Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=2035 deferring operation: too many executing Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=2035 deferring operation: pending operations Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=2035 deferring operation: too many executing Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=2035 deferring operation: pending operations Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=2035 deferring operation: too many executing Apr 26 12:42:54 ldap2 slapd[19556]: conn=5551 op=10 ABANDON msg=10 Apr 26 12:42:54 ldap2 slapd[19556]: conn=3876 op=13 ABANDON msg=13 Apr 26 12:42:54 ldap2 slapd[19556]: conn=1242 op=24 ABANDON msg=24 Apr 26 12:42:54 ldap2 slapd[19556]: conn=1242 op=26 ABANDON msg=26 Apr 26 12:42:54 ldap2 slapd[19556]: conn=1242 op=28 ABANDON msg=28 Apr 26 12:42:54 ldap2 slapd[19556]: conn=1242 op=30 ABANDON msg=30 Apr 26 12:42:54 ldap2 slapd[19556]: conn=1242 op=31 UNBIND Apr 26 12:42:54 ldap2 slapd[19556]: conn=1242 fd=38 closed Apr 26 12:42:54 ldap2 slapd[19556]: conn=5967 op=7 ABANDON msg=7 Apr 26 12:42:54 ldap2 slapd[19556]: conn=5967 op=8 UNBIND Apr 26 12:42:54 ldap2 slapd[19556]: conn=5967 fd=118 closed Apr 26 12:42:54 ldap2 slapd[19556]: conn=2405 op=12 ABANDON msg=12 Apr 26 12:42:54 ldap2 slapd[19556]: conn=2405 op=13 UNBIND Apr 26 12:42:54 ldap2 slapd[19556]: conn=2405 fd=44 closed Apr 26 12:42:54 ldap2 slapd[19556]: conn=2181 op=24 ABANDON msg=24 Apr 26 12:42:54 ldap2 slapd[19556]: conn=2181 op=26 ABANDON msg=26 Apr 26 12:42:54 ldap2 slapd[19556]: conn=2181 op=28 ABANDON msg=28 Apr 26 12:42:54 ldap2 slapd[19556]: conn=2181 op=30 ABANDON msg=30 Apr 26 12:42:54 ldap2 slapd[19556]: conn=5551 op=6 ABANDON msg=6 Apr 26 12:42:54 ldap2 slapd[19556]: conn=2181 op=31 UNBIND Apr 26 12:42:54 ldap2 slapd[19556]: conn=5924 op=5 ABANDON msg=5 Apr 26 12:42:54 ldap2 slapd[19556]: conn=5924 op=7 ABANDON msg=7 Apr 26 12:42:54 ldap2 slapd[19556]: conn=5924 op=9 ABANDON msg=9 Apr 26 12:42:54 ldap2 slapd[19556]: conn=5924 op=10 UNBIND Apr 26 12:42:54 ldap2 slapd[19556]: conn=5924 fd=115 closed Apr 26 12:42:54 ldap2 slapd[19556]: conn=1389 op=9 ABANDON msg=9 Apr 26 12:42:54 ldap2 slapd[19556]: conn=1167 op=15 UNBIND Apr 26 12:42:54 ldap2 slapd[19556]: conn=1167 fd=37 closed Apr 26 12:42:54 ldap2 slapd[19556]: conn=1903 op=10 ABANDON msg=10 Apr 26 12:42:54 ldap2 slapd[19556]: conn=1903 op=11 UNBIND Apr 26 12:42:54 ldap2 slapd[19556]: conn=1903 fd=58 closed Apr 26 12:42:54 ldap2 slapd[19556]: conn=4400 op=3 ABANDON msg=3 Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=6631 deferring operation: too many executing Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=6631 deferring operation: pending operations Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=6631 deferring operation: too many executing Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=6631 deferring operation: pending operations Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=6631 deferring operation: too many executing Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=6631 deferring operation: pending operations Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=6631 deferring operation: too many executing Apr 26 12:42:54 ldap2 slapd[19556]: conn=4400 op=5 UNBIND [...] In other node, also a cut in the log [...] Apr 26 12:22:40 ldap3 slapd[7650]: conn=8292 op=1 SRCH base="dc=xxx,dc=es" scope=2 deref=0 filter="(objectClass=*)" Apr 26 12:22:40 ldap3 slapd[7650]: conn=8292 op=1 SRCH attr=* + Apr 26 12:22:40 ldap3 slapd[7650]: conn=8292 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= Apr 26 12:22:40 ldap3 slapd[7650]: conn=8292 op=2 UNBIND Apr 26 12:22:40 ldap3 slapd[7650]: conn=8292 fd=158 closed Apr 26 12:22:41 ldap3 slapd[7650]: conn=8293 fd=158 ACCEPT from IP=192.168.21.21:44703 (IP=0.0.0.0:636) Apr 26 12:22:41 ldap3 slapd[7650]: conn=8294 fd=163 ACCEPT from IP=192.168.21.22:58503 (IP=0.0.0.0:636) Apr 26 12:22:41 ldap3 slapd[7650]: conn=8295 fd=164 ACCEPT from IP=192.168.21.22:58506 (IP=0.0.0.0:636) Apr 26 12:22:41 ldap3 slapd[7650]: conn=8293 fd=158 TLS established tls_ssf=128 ssf=128 Apr 26 12:22:41 ldap3 slapd[7650]: conn=8294 fd=163 TLS established tls_ssf=128 ssf=128 Apr 26 12:22:41 ldap3 slapd[7650]: conn=8295 fd=164 TLS established tls_ssf=128 ssf=128 Apr 26 12:22:42 ldap3 slapd[7650]: slap_client_connect: URI=ldaps://ldap1.xxx.xx/ DN="cn=admin,cn=config" ldap_sasl_bind_s failed (-5) *** Apr 26 12:42:54 ldap3 slapd[7650]: do_syncrepl: rid=001 rc -5 retrying (4 retries left) Apr 26 12:42:54 ldap3 slapd[7650]: null_callback : error code 0x35 Apr 26 12:42:54 ldap3 slapd[7650]: null_callback : error code 0x35 Apr 26 12:42:54 ldap3 slapd[7650]: null_callback : error code 0x35 Apr 26 12:42:54 ldap3 slapd[7650]: conn=8297 fd=165 ACCEPT from IP=[xxx:xxx:xxx:xx::5]:42973 (IP=[::]:636) Apr 26 12:42:54 ldap3 slapd[7650]: conn=8296 fd=160 ACCEPT from IP=192.168.21.22:58509 (IP=0.0.0.0:636) Apr 26 12:42:54 ldap3 slapd[7650]: conn=8293 op=1 UNBIND Apr 26 12:42:54 ldap3 slapd[7650]: conn=8293 op=0 BIND dn="cn=admin,cn=config" method=128 [...] In other node, also a cut after the replication operation, the my service restart: [...] Apr 26 12:22:37 ldap1 slapd[5945]: conn=8377 fd=159 closed (connection lost) Apr 26 12:22:37 ldap1 slapd[5945]: conn=8373 fd=156 closed (connection lost) Apr 26 12:22:37 ldap1 slapd[5945]: conn=8374 fd=157 closed (connection lost) Apr 26 12:22:37 ldap1 slapd[5945]: conn=8375 fd=158 closed (connection lost) Apr 26 12:22:41 ldap1 slapd[5945]: conn=8378 fd=158 ACCEPT from IP=192.168.21.23:57377 (IP=0.0.0.0:636) Apr 26 12:22:41 ldap1 slapd[5945]: conn=8379 fd=159 ACCEPT from IP=192.168.21.23:57379 (IP=0.0.0.0:636) Apr 26 12:22:41 ldap1 slapd[5945]: conn=8380 fd=160 ACCEPT from IP=192.168.21.22:33628 (IP=0.0.0.0:636) Apr 26 12:22:41 ldap1 slapd[5945]: conn=8381 fd=161 ACCEPT from IP=192.168.21.22:33629 (IP=0.0.0.0:636) Apr 26 12:22:41 ldap1 slapd[5945]: conn=8379 fd=159 TLS established tls_ssf=128 ssf=128 Apr 26 12:22:41 ldap1 slapd[5945]: conn=8380 fd=160 TLS established tls_ssf=128 ssf=128 Apr 26 12:22:41 ldap1 slapd[5945]: conn=8379 op=0 BIND dn="cn=admin,dc=xxx,dc=es" method=128 Apr 26 12:22:41 ldap1 slapd[5945]: conn=8379 op=0 BIND dn="cn=admin,dc=xxx,dc=es" mech=SIMPLE ssf=0 Apr 26 12:22:41 ldap1 slapd[5945]: conn=8379 op=0 RESULT tag=97 err=0 text= Apr 26 12:22:41 ldap1 slapd[5945]: conn=8379 op=1 SRCH base="dc=xxx,dc=es" scope=2 deref=0 filter="(objectClass=*)" Apr 26 12:22:41 ldap1 slapd[5945]: conn=8379 op=1 SRCH attr=* + Apr 26 12:22:41 ldap1 slapd[5945]: conn=8381 fd=161 TLS established tls_ssf=128 ssf=128 Apr 26 12:22:41 ldap1 slapd[5945]: conn=8381 op=0 BIND dn="cn=admin,dc=xxx,dc=es" method=128 Apr 26 12:22:41 ldap1 slapd[5945]: conn=8381 op=0 BIND dn="cn=admin,dc=xxx,dc=es" mech=SIMPLE ssf=0 Apr 26 12:22:41 ldap1 slapd[5945]: conn=8381 op=0 RESULT tag=97 err=0 text= Apr 26 12:22:41 ldap1 slapd[5945]: conn=8381 op=1 SRCH base="dc=xxx,dc=es" scope=2 deref=0 filter="(objectClass=*)" Apr 26 12:22:41 ldap1 slapd[5945]: conn=8381 op=1 SRCH attr=* + Apr 26 12:22:41 ldap1 slapd[5945]: conn=8378 fd=158 TLS established tls_ssf=128 ssf=128 Apr 26 12:22:42 ldap1 slapd[5945]: conn=8379 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Apr 26 12:22:42 ldap1 slapd[5945]: conn=8381 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Apr 26 12:22:42 ldap1 slapd[5945]: slap_client_connect: URI=ldaps://ldap3.xxx.xx/ DN="cn=admin,cn=config" ldap_sasl_bind_s failed (-5) *** Apr 26 12:42:54 ldap1 slapd[5945]: daemon: shutdown requested and initiated. Apr 26 12:42:54 ldap1 slapd[5945]: conn=1009 fd=13 closed (slapd shutdown) Apr 26 12:42:54 ldap1 slapd[5945]: conn=1013 fd=20 closed (slapd shutdown) Apr 26 12:42:54 ldap1 slapd[5945]: conn=1014 fd=21 closed (slapd shutdown) [...] Any idea? Best regards. -- /* Arturo Borrero Gonzalez || cer.inet(a)linuxmail.org */ /* Use debian gnu/linux! Best OS ever! */

2 1

How to query ldap root DNs ?
by Bhargav Mistry 26 Apr '12

26 Apr '12

Hi, I have written a java tool which configures ldap servers for master master replication and proxy push. I need to query the root DNs for config and bdb databases so that I can use it in the tool but I am not sure how to query it ? I want to query the dn from the file olcDatabase={2}bdb.ldif but I don't know how? olcDatabase={2}bdb.ldif dn: olcDatabase={2}bdb objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {2}bdb olcSuffix: dc=my-domain,dc=com olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=Manager,dc=my-domain,dc=com olcSyncUseSubentry: FALSE I tried using the following command line search query but it doesn't return any results: ldapsearch -x -b "" -s base "objectClass=olcBdbConfig" -H ldap://myserver-1:389 -D "cn=config" -w 'secret' any help is highly appreciated. Thanks. This message and the information contained herein is proprietary and confidential and subject to the Amdocs policy statement, you may review at http://www.amdocs.com/email_disclaimer.asp

4 4

Open ldap master slave replication not properly syncing
by dhanushka ranasinghe 26 Apr '12

26 Apr '12

Hi guys , i have master slave LDAP replication setup , where master have close to 38000 records, when i start the slave server its starts syncing from master , but when the sync finished slave only sync records close to 30000,. is there any reson for this. please note that , and in slave slapd.conf file it has entry "sizelimit 55000" both the servers have identical times: and in the slave log file i can see the "do_syncrep2: rid=004 CSN too old, ignoring" entry. is there any way sort this issue. Thank You Dhanushka

2 1

ldap server doesn't run after inserting some groups (cn)
by stefano malini 26 Apr '12

26 Apr '12

Hi, I had a good LDAP server on Debian Squeeze, everything was ok. I was able to login using ldap users, i was able to make research using ldapsearch. Now, after adding an ldif file with some groups it doesn't run. Trying ldapsearch the answer is ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) What can be happened?

2 3

Way to email users when their password is about to expire?
by Kline, Sara 25 Apr '12

25 Apr '12

Hey all, Our OpenLDAP environment is up and functional and is working great. I was asked if there is a way to have the server email users when their account password is about to expire. For instance, 7 days before expiration they get an email that lets them know their password will expire on date x. Is there functionality within OpenLDAP to do this, or has anyone written a script that would do it? We are using the policy overlay to enforce the password policy. Sara Kline System Administrator Transaction Network Services, Inc 4501 Intelco Loop, Lacey WA 98503 Wk: (360) 493-6736 Cell: (360) 280-2495 ________________________________ This e-mail message is for the sole use of the intended recipient(s)and may contain confidential and privileged information of Transaction Network Services. Any unauthorised review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

4 3

mismatch between slapd.conf and olcDatabase
by Nagaraj Panyam 25 Apr '12

25 Apr '12

Hi, This is a question from an absolute novice. I just installed openldap (RHEL 6.1), and created a config file with suffix "dc=example, dc=com" And started up slapd. However, the value of "dc" in the olcDatabase files remains "dc=my-domain,dc=com" How does one remove this mismatch? Secondly, how does one see the contents of /var/lib/ldap/log.0000000001 Thanks a lot for the support. - Raj

3 2

syncrepl issue not replicating all changes
by Mark Coetser 25 Apr '12

25 Apr '12

Hi Guys debian stable openldap 2.4.23-7.2 I have multiple consumers with a single provider, when making changes too the provider ie creating a new user, sometimes the change doesnt propagate too all the consumers some have the correct entries and some dont. If I then compare the contextcsn on both the provider and the consumer it is identical on the consumers with the missing entry. The only way I can then resync is by shutting down openldap on the consumer deleting the tree and restarting which then syncs the directory with the missing entry. How would I go about troubleshooting this issue? Or am I missing something simple? Any help would be appreciated. -- Thank you,

2 3

Fwd: Re: getent passwd doesn't show ldap user
by stefano malini 23 Apr '12

23 Apr '12

any ideas? -------- Original Message -------- Subject: Re: getent passwd doesn't show ldap user Date: Mon, 23 Apr 2012 12:20:03 +0200 From: stefano malini <lozingalo(a)gmail.com> To: openldap-technical(a)openldap.org hi, installed openldap and configured nslcd.conf and nsswitch.conf. At the moment getent passwd doesn't show ldap user. I create a user nslcd_proc for nslcd lookups. this user belong to the System organizationalUnit. You can see some checks. FIRST SHELL nslcd -d nslcd: DEBUG: add_uri(ldap://localhost:389) nslcd: version 0.7.15 starting nslcd: DEBUG: unlink() of /var/run/nslcd/socket failed (ignored): No such file or directory nslcd: DEBUG: setgroups(0,NULL) done nslcd: DEBUG: setgid(107) done nslcd: DEBUG: setuid(105) done nslcd: accepting connections SECOND SHELL: getent passwd-->shows only local users FIRST SHELL shows: nslcd: [8b4567] DEBUG: connection from pid=2055 uid=0 gid=0 nslcd: [8b4567] DEBUG: nslcd_passwd_all() nslcd: [8b4567] DEBUG: myldap_search(base="dc=amahoro,dc=bi", filter="(objectClass=posixAccount)") nslcd: [8b4567] DEBUG: ldap_initialize(ldap://localhost:389) nslcd: [8b4567] DEBUG: ldap_set_rebind_proc() nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_PROTOCOL_VERSION,3) nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_DEREF,0) nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_TIMELIMIT,0) nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_TIMEOUT,0) nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_NETWORK_TIMEOUT,0) nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_REFERRALS,LDAP_OPT_ON) nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_RESTART,LDAP_OPT_ON) nslcd: [8b4567] DEBUG: ldap_simple_bind_s("uid=nslcd_proc,ou=System,dc=amahoro,dc=bi","***") (uri="ldap://localhost:389") nslcd: [8b4567] ldap_result() failed: No such object These are the permissions of nslcd files and folder ls -ld /etc/nslcd.conf /var/run/nslcd/ /var/run/nslcd/* -rw-r----- 1 root nslcd 635 Apr 21 11:54 /etc/nslcd.conf drwxr-xr-x 2 nslcd nslcd 4096 Apr 21 11:55 /var/run/nslcd/ -rw-r--r-- 1 root root 5 Apr 21 11:55 /var/run/nslcd/nslcd.pid srw-rw-rw- 1 root root 0 Apr 21 11:55 /var/run/nslcd/socket Opening /var/run/nslcd/socket it shows: Error reading /var/run/nslcd/socket: No such device or address Follow nslcd.conf and slapd.conf. __________________________________________________________________ # /etc/nslcd.conf # nslcd configuration file. See nslcd.conf(5) # for details. # The user and group nslcd should run as. uid nslcd gid nslcd # The location at which the LDAP server(s) should be reachable. uri ldap://localhost:389 # The search base that will be used for all queries. base dc=amahoro,dc=bi # The LDAP protocol version to use. #ldap_version 3 # The DN to bind with for normal lookups. binddn uid=nslcd_proc,ou=System,dc=amahoro,dc=bi bindpw ***** # The DN used for password modifications by root. #rootpwmoddn cn=admin,dc=example,dc=com # SSL options #ssl off #tls_reqcert never # The search scope. #scope sub ___________________________________________________________________ slapd.conf slapd.conf #Basics include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/nis.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel trace modulepath /usr/lib/ldap moduleload back_hdb #Database Configuration backend hdb database hdb suffix "dc=amahoro,dc=bi" rootdn "cn=Manager,dc=amahoro,dc=bi" rootpw {SSHA}zH2A+jeSlbl2/UcAXm596KPV4IB/R6x9 directory /var/lib/ldap index objectClass,cn eq #ACLs access to attrs=userPassword by anonymous auth by self write by * none access to * by dn.base="uid=nslcd_proc,ou=System,dc=amahoro,dc=bi" read by self write by * none Please, do you have some ideas? thanks

1 0

Re: getent passwd doesn't show ldap user
by stefano malini 23 Apr '12

23 Apr '12

hi, installed openldap and configured nslcd.conf and nsswitch.conf. At the moment getent passwd doesn't show ldap user. I create a user nslcd_proc for nslcd lookups. this user belong to the System organizationalUnit. You can see some checks. FIRST SHELL nslcd -d nslcd: DEBUG: add_uri(ldap://localhost:389) nslcd: version 0.7.15 starting nslcd: DEBUG: unlink() of /var/run/nslcd/socket failed (ignored): No such file or directory nslcd: DEBUG: setgroups(0,NULL) done nslcd: DEBUG: setgid(107) done nslcd: DEBUG: setuid(105) done nslcd: accepting connections SECOND SHELL: getent passwd-->shows only local users FIRST SHELL shows: nslcd: [8b4567] DEBUG: connection from pid=2055 uid=0 gid=0 nslcd: [8b4567] DEBUG: nslcd_passwd_all() nslcd: [8b4567] DEBUG: myldap_search(base="dc=amahoro,dc=bi", filter="(objectClass=posixAccount)") nslcd: [8b4567] DEBUG: ldap_initialize(ldap://localhost:389) nslcd: [8b4567] DEBUG: ldap_set_rebind_proc() nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_PROTOCOL_VERSION,3) nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_DEREF,0) nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_TIMELIMIT,0) nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_TIMEOUT,0) nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_NETWORK_TIMEOUT,0) nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_REFERRALS,LDAP_OPT_ON) nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_RESTART,LDAP_OPT_ON) nslcd: [8b4567] DEBUG: ldap_simple_bind_s("uid=nslcd_proc,ou=System,dc=amahoro,dc=bi","***") (uri="ldap://localhost:389") nslcd: [8b4567] ldap_result() failed: No such object These are the permissions of nslcd files and folder ls -ld /etc/nslcd.conf /var/run/nslcd/ /var/run/nslcd/* -rw-r----- 1 root nslcd 635 Apr 21 11:54 /etc/nslcd.conf drwxr-xr-x 2 nslcd nslcd 4096 Apr 21 11:55 /var/run/nslcd/ -rw-r--r-- 1 root root 5 Apr 21 11:55 /var/run/nslcd/nslcd.pid srw-rw-rw- 1 root root 0 Apr 21 11:55 /var/run/nslcd/socket Opening /var/run/nslcd/socket it shows: Error reading /var/run/nslcd/socket: No such device or address Follow nslcd.conf and slapd.conf. __________________________________________________________________ # /etc/nslcd.conf # nslcd configuration file. See nslcd.conf(5) # for details. # The user and group nslcd should run as. uid nslcd gid nslcd # The location at which the LDAP server(s) should be reachable. uri ldap://localhost:389 # The search base that will be used for all queries. base dc=amahoro,dc=bi # The LDAP protocol version to use. #ldap_version 3 # The DN to bind with for normal lookups. binddn uid=nslcd_proc,ou=System,dc=amahoro,dc=bi bindpw ***** # The DN used for password modifications by root. #rootpwmoddn cn=admin,dc=example,dc=com # SSL options #ssl off #tls_reqcert never # The search scope. #scope sub ___________________________________________________________________ slapd.conf slapd.conf #Basics include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/nis.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel trace modulepath /usr/lib/ldap moduleload back_hdb #Database Configuration backend hdb database hdb suffix "dc=amahoro,dc=bi" rootdn "cn=Manager,dc=amahoro,dc=bi" rootpw {SSHA}zH2A+jeSlbl2/UcAXm596KPV4IB/R6x9 directory /var/lib/ldap index objectClass,cn eq #ACLs access to attrs=userPassword by anonymous auth by self write by * none access to * by dn.base="uid=nslcd_proc,ou=System,dc=amahoro,dc=bi" read by self write by * none Please, do you have some ideas? thanks

1 0

slapd crash in slap_listener
by Stefan Wold 23 Apr '12

23 Apr '12

Hi! It seems slapd crash when it's hammered with ~30 simultaneous connections in our test environment. Each client connecting to the server run "ldapsearch -YGSSAPI -H ldap://ldap.example.com uid=user". In earlier versions of openldap we noticed crashes in SASL with the same setup, however that doesn't seem to happen anymore. The test server is running openldap 2.4.28 on Ubuntu 12.04. After a while slapd segfault with the following backtrace: (gdb) bt #0 0x00007f8577401445 in raise () from /lib/x86_64-linux-gnu/libc.so.6 #1 0x00007f8577404bab in abort () from /lib/x86_64-linux-gnu/libc.so.6 #2 0x00007f85773fa10e in ?? () from /lib/x86_64-linux-gnu/libc.so.6 #3 0x00007f85773fa1b2 in __assert_fail () from /lib/x86_64-linux-gnu/libc.so.6 #4 0x00007f8578cf17e0 in slap_listener (sl=0x7f857978b2e0) at ../../../../servers/slapd/daemon.c:1890 #5 0x00007f8578cf17f9 in slap_listener_thread (ctx=<optimized out>, ptr=0x7f857978b2e0) at ../../../../servers/slapd/daemon.c:2092 #6 0x00007f85788579aa in ldap_int_thread_pool_wrapper (xpool=0x7f85797c8c80) at ../../../../libraries/libldap_r/tpool.c:685 #7 0x00007f857778fe9a in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0 #8 0x00007f85774bd4bd in clone () from /lib/x86_64-linux-gnu/libc.so.6 #9 0x0000000000000000 in ?? () For a full bt: https://gist.github.com/112c3bf7a98a5df69907 Let me know if anything else is needed. -- Sincerely Stefan Wold IT-services, Stockholm University

2 2

Configuring Proxy on Master Master replication set issues - openldap version 2.4.23
by Bhargav Mistry 23 Apr '12

23 Apr '12

Hi, I have 2 set of servers and each set contains 2 servers. I have setup n-way multi master replication per set. FirstMaster-1 <-- --> FirstMaster-2 - set1 SecondMaster-1 <-- --> SecondMaster-2 - set2 There is no replication between set1 and set2. Set 2 is inside a service network so in order to setup replication on set 2 I am trying to setup proxy on FirstMaster-1 which will point to SecondMaster-1 and FirstMaster-2 which will point to SecondMaster-2. I tried to google it but I didn't find any body doing it for version 2.4.23. I am able to setup a standalone proxy and configure it but I want to do it on the master servers itself. I am trying to setup proxy for the tree Cn=Manager, dc=my-domain,dc=com on both first masters but in order to do that I have to create a ldap database with the same suffix and rootDN correct? In order to setup replication for ldap database. Ldap throws error saying "dc=my-domain,dc=com" is already defined. FirstMaster-1 : olcDatabase={3}ldap.ldif dn: olcDatabase={3}ldap objectClass: olcDatabaseConfig objectClass: olcLDAPConfig olcDatabase: {3}ldap olcSuffix: dc=my-domain,dc=com olcRootDN: cn=ldap olcSyncUseSubentry: FALSE olcMonitoring: TRUE structuralObjectClass: olcLDAPConfig entryUUID: 633dcaac-1eb1-1031-884a-f7149142768b creatorsName: cn=config createTimestamp: 20120419212135Z entryCSN: 20120419212135.686069Z#000000#001#000000 modifiersName: cn=config modifyTimestamp: 20120419212135Z olcSyncrepl: rid=000 provider=ldap://FirstMaster-1:389 binddn="cn=Manager,dc=my-domain,dc=com" bindmethod=simple credentials="secret" searchbase="dc=my-domain,dc=com" filter="(objectClass=*)" scope=sub schemachecking=off type=refreshAndPersist retry="5 5 300 5" timeout=1 olcDbURI: ldap://SecondMaster-1.eng.qpass.net:389 olcDbACLBind: bindmethod=simple timeout=0 network-timeout=0 binddn="cn=Manager,dc=my-domain,dc=com" credentials="secret" The above configuration is giving me errors when I try to reload it saying the "dc=my-domain,dc=com" is already used by the preceding database (bdb) then how do I setup the proxy on the master itself? Your help is appreciated. Thanks. Bhargav. This message and the information contained herein is proprietary and confidential and subject to the Amdocs policy statement, you may review at http://www.amdocs.com/email_disclaimer.asp

2 2

slapd-ldap proxy database
by Ismael Gil 20 Apr '12

20 Apr '12

Hello all, I'm trying to configure a ldap proxy to conect to a windows active directory to get data. My /etc/openldap/slapd.conf, looks like that (the databases definition only): # Our slapd-ldap back end to connect to AD database ldap suffix "cn=users,dc=XXX,dc=XXX" #rootdn "cn=Administrador,dc=XXX,dc=XXX" subordinate lastmod off rebind-as-user uri "ldap://serverip/" chase-referrals yes database bdb suffix "dc=XXX,dc=XXX" rootdn "cn=Administrador,dc=XXX,dc=XXX" #rootdn "dc=XXX,dc=XXX" rootpw {SSHA}YYYYYYYYYYYYYYYYYyyy Whit this config, I only can query the "users" directory, on the Active Directory server, but I need to be able to query all OUs inside the Active Directory. Why I only can get data from users ou, instead the whole Active Directory? How could I get to proxy all my querys to the Active directory server? If I have an ou called "Bussines", in the Active Directory server, ¿how could I make a database definition or other configuration to get that working? Thanks in advance, Ismaeleitor

1 0

getent passwd doesn't show ldap user
by stefano malini 20 Apr '12

20 Apr '12

hi, as said before i reinstalled openldap and configured nslcd.conf and nsswitch.conf. at the moment geten passwd doesn't show ldap user. as follow you see that i create a user nslcd_proc for nslcd lookups. this user belong to the System organizationalUnit. follow nslcd.conf and slapd.conf (please take a look of ACLs for nslcd_proc): ------------------------------------------------------------------ # /etc/nslcd.conf # nslcd configuration file. See nslcd.conf(5) # for details. # The user and group nslcd should run as. uid nslcd gid nslcd # The location at which the LDAP server(s) should be reachable. uri ldap://localhost:389 # The search base that will be used for all queries. base dc=amahoro,dc=bi # The LDAP protocol version to use. #ldap_version 3 # The DN to bind with for normal lookups. binddn uid=nslcd_proc,ou=System,dc=amahoro,dc=bi bindpw ***** # The DN used for password modifications by root. #rootpwmoddn cn=admin,dc=example,dc=com # SSL options #ssl off #tls_reqcert never # The search scope. #scope sub ------------------------------------------------------------------ slapd.conf ACLs: access to attrs=userPassword by anonymous auth by self write by * none access to * by dn.base="uid=nslcd_proc,ou=System,dc=amahoro,dc=bi" read by self write by * none thanks

1 1

Behavior change on overlay sssvlv
by Clément OUDOT 20 Apr '12

20 Apr '12

Hello, I noticed that with OpenLDAP 2.4.30, a search request with a non criticical sss control on an attribute without ordering matching rule returns an error: clement@ader:~/Programmes/openldap$ bin/ldapsearch -H ldap://localhost:3389 -D ou=lsc,ou=accounts,ou=XXX -w secret -b ou=people,ou=XXX -E sss=cn # extended LDIF # # LDAPv3 # with server side sorting control # # search result search: 2 result: 18 Inappropriate matching text: serverSort control: No ordering rule # numResponses: 1 Before, the error was only returned if the control was set to critical. This was discussed in this ITS: http://www.openldap.org/its/index.cgi/Software%20Bugs?id=6647 Is this behavior change intentional or is this a side effect of of recent commit? Clément.

3 4

memberof overlay
by Marvin Mundry 20 Apr '12

20 Apr '12

Hello everybody, i am running SLES 11.2 x64 with slapd 2.4.30 obtained from this repository: http://download.opensuse.org/repositories/home:/meikestone/SLE_11_SP2/ I am experiencing a problem that should have been solved in 2.4.26: Fixed slapo-memberof with accesslog (ITS#6329,ITS#6766,ITS#6915) (http://www.openldap.org/software/release/changes.html) i am running a master with multiple slaves, when adding a user to a group the memberof overlay updates the memberof attribute of the user on the master. the modification of the memberof attribute neither appears in the accesslog nor it gets replicated on the slaves. any ideas? best regards, marvin

2 3

cannot login using ldap user credential
by stefano malini 20 Apr '12

20 Apr '12

Hi, I installed and configured an ldap server on debian squeeze and i've a problem trying the login using ldap user credential. nslcd debug shows "user not found". using getent passwd i can see every user and also ldap users but i don't understand why i can't login. Could you help me please? Thanks

3 5

Distribution List in Outlook
by Krisztián Bielik 19 Apr '12

19 Apr '12

Running Openldap 2.4.30, with Berkeley DB I'd like to create an address book which is usable under Outlook 2007. There are no problems with single contacts, but regarding distribution lists i wasn't able to found any working solution. Checked back all the mailing list, also searched on internet, but there was only a few threads about this subject, without solution. Every tries(groupOfNames, proxyAddresses etc.) had the same results: Outlooks sees groups I created, but no addresses are associated with those groups. Any help would be appreciated. Thank you, Krisztian ______________________________________ Take a green step today. Think before you print. ********************************NOTICE************************************* This transmittal and/or attachments have been issued by Agility. The information contained here within may be privileged or confidential. If you are not the intended recipient, you are hereby notified that you have received this transmittal in error; any review, dissemination, distribution or copying of this transmittal is strictly prohibited. If you have received this transmittal and/or attachments in error, please notify us immediately by reply or by telephone (Tel. +965-1809-222) and immediately delete this message and all its attachments.

1 0

Distribution List on Outlook
by Krisztián Bielik 19 Apr '12

19 Apr '12

Running Openldap 2.4.30, with Berkeley DB I'd like to create an address book which is usable under Outlook 2007. There are no problems with single contacts, but regarding distribution lists i wasn't able to found any working solution. Checked back all the mailing list, also searched on internet, but there was only a few threads about this subject, without solution. Every tries(groupOfNames, proxyAddresses etc.) had the same results: Outlooks sees groups I created, but no addresses are associated with those groups. Any help would be appreciated. Thank you, Krisztian ______________________________________ Take a green step today. Think before you print. ********************************NOTICE************************************* This transmittal and/or attachments have been issued by Agility. The information contained here within may be privileged or confidential. If you are not the intended recipient, you are hereby notified that you have received this transmittal in error; any review, dissemination, distribution or copying of this transmittal is strictly prohibited. If you have received this transmittal and/or attachments in error, please notify us immediately by reply or by telephone (Tel. +965-1809-222) and immediately delete this message and all its attachments.

1 0

Add 'EQUALITY' to an existing attribute definition
by RICHARDSON Matt (SPARQ) 19 Apr '12

19 Apr '12

Hello all, I've got a problem with a user-defined attribute. The schema was written locally and used in a 389-DS directory. I made the necessary changes so that OpenLDAP 2.4.23-20.el6 could use it (attributeTypes -> olcAtrributeTypes, etc.). There is an attribute that needs to be added multiple times with different values. Under 389, this worked: olcAttributeTypes: {0}(1.3.6...1000 NAME 'x-myGroup' DESC 'My Group' SYNTAX 1.3...1.15 X-ORIGIN 'user defined') It works for adding one 'x-myGroup' attribute to an entry. However, if I try to add a second I get: Ldap_modify: Inappropriate matching (18) additional info: modify/add: x-myGroup: no equality matching rule The syntax specifies it's a directory string type, but adding 'EQUALITY caseIgnoreMatch' to the definition causes slapd to crash when I run ldapmodify to add an x-myGroup attribute to an existing entry. This seemed to be similar to this issue http://www.openldap.org/its/index.cgi/Software%20Bugs?id=5540 , so I did a slapcat, deleted the files in /var/lib/ldap/ and restarted slapd. Loading the ldif with ldapadd caused slapd to crash again. Removing the EQUALITY statement from the attribute definition allowed me to load the ldif. If someone could point me in the right direction, I would greatly appreciate it. Matt ************************************************************************************************** This email message (including any file attachments transmitted with it) is for the sole use of the intended recipient(s) and may contain confidential and legally privileged information. Any unauthorised review, use, alteration, disclosure or distribution of this email (including any attachments) by an unintended recipient is prohibited. If you have received this email in error, please notify the sender by return email and destroy all copies of the original message. Any confidential or legal professional privilege is not waived or lost by any mistaken delivery of the email. SPARQ Solutions accepts no responsibility for the content of any email which is sent by an employee which is of a personal nature. Sender Details: SPARQ Solutions PO Box 15760 City East, Brisbane QLD Australia 4002 +61 7 4931 2222 SPARQ Solutions policy is to not send unsolicited electronic messages. Suspected breaches of this policy can be reported by replying to this message including the original message and the word "UNSUBSCRIBE" in the subject. **************************************************************************************************

1 1

RE24 testing call #2 (2.4.31)
by Quanah Gibson-Mount 18 Apr '12

18 Apr '12

If you know how to build OpenLDAP manually, and would like to participate in testing the next set of code for the 2.4.31 release, please do so. Generally, get the code for RE24: <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> Configure & build. Execute the test suite (via make test) after it is built. Thanks! --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

7 18

RE: ldapd vs. slapd
by Richards, Toby 18 Apr '12

18 Apr '12

I meant in terms of the LDIF file: objectClass: top objectClass: account objectClass: person objectClass: posixAccount objectClass: shadowAccount objectClass: organizationalPerson objectClass: inetOrgPerson The above doesn't work. It says that top/account isn't a valid chain. -Toby -----Original Message----- From: Kline, Sara [mailto:SKline@tnsi.com] Sent: Tuesday, April 17, 2012 8:45 AM To: Richards, Toby Subject: RE: ldapd vs. slapd 1. This is the order mine are in, you can ignore solaris and DUA as those are for the solaris boxes, also you can ignore policy that is for the password policy overlay. include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/ppolicy.schema include /etc/openldap/schema/DUAConfigProfile.schema include /etc/openldap/schema/solaris.schema 2. What do you have in your slapd.conf? TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCertificateFile /etc/pki/tls/certs/slapd-cert.pem TLSCertificateKeyFile /etc/pki/tls/certs/slapd-key.pem TLSCACertificateFile /etc/pki/tls/certs/slapd-cert.pem TLSVerifyClient never security update_ssf=1 update_ssf=112 simple_bind=64 Thanks, Sara Kline -----Original Message----- From: openldap-technical-bounces(a)OpenLDAP.org [mailto:openldap-technical-bounces@OpenLDAP.org] On Behalf Of Richards, Toby Sent: Tuesday, April 17, 2012 8:25 AM To: Brandon Hume; openldap-technical(a)openldap.org Subject: RE: ldapd vs. slapd OK got it. I realized that ldapd is a different product after some more research this morning. I've got slapd running & responding; however: 1. I cannot figure out the correct order of objectClass statements to reach inetOrgPerson. I do have the core, cosine, nis, and inetorgperson schemas included in slapd.conf. 2. slapd won't run on port 636 even though I put "TLS_CACERT /path/to/cert.crt" and "URI ldaps://toby.org.org" into ldap.conf -Toby -----Original Message----- From: openldap-technical-bounces(a)OpenLDAP.org [mailto:openldap-technical-bounces@OpenLDAP.org] On Behalf Of Brandon Hume Sent: Tuesday, April 17, 2012 7:58 AM To: openldap-technical(a)openldap.org Subject: Re: ldapd vs. slapd On 04/16/12 11:02 PM, Richards, Toby wrote: > For those of you wondering, I'm running OpenBSD 5.0. openldap-server-2.4.25p0.tgz (depends on: openldap-client-2.4.25.tgz (depends on cyrus-sasl-2.1.23p7-ldap.tgz)). Typing "ldapd" gets the appropriate tcp/ip ports responding. Typing "/etc/rc.d/slapd start" does something, but doesn't give me responses on 349 or 636. "ldapd" is a service that comes with OpenBSD, and it definitely is not OpenLDAP. It will start and sit on the same ports, however, making it impossible for you to start slapd. So don't start ldapd. Kill it if it's already running, then you might be able to start OpenLDAP. Also, this might have been a typo, but the non-SSL port for LDAP is 389/tcp, not 349. This e-mail message is for the sole use of the intended recipient(s)and may contain confidential and privileged information of Transaction Network Services. Any unauthorised review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

4 10

overlays and frontend database
by Jan Vcelak 18 Apr '12

18 Apr '12

Hello list. I have some questions about defining overlays on the frontend database. Documentation (manual pages) is not very consistent about it: slapd.overlays | Most of the overlays are only allowed to be configured on | individual databases, but some may also be configured | globally. slapd.conf | Note that all of the database's regular settings should be | configured before any overlay settings. slapd-config | Settings in the frontend database are inherited by the other | databases, unless they are explicitly overridden in a | specific database. | Overlays must be configured as child entries of a specific | database. FAQ | Starting from OpenLDAP 2.3 they can be stacked on the | frontend as well; this means that they can be executed after | a request is parsed and validated, but right before the | appropriate database is selected. Are there are some overlays that can be applied on the fronted database (globally)? What about the inheritance as mentioned in slapd-config? (Maybe I didn't understand this correctly.) >From what I have tried, enabling an overlay on fronted database makes slapd to segfault due to accessing a null pointer or due to a heap overflow. It seems that there are no verifications of overlay settings, because both slapadd and ldapmodify succeed when enabling the void configuration. Please, what is the expected behavior? Regards, Jan

2 2

Authenticate a Samba box to a pre-existing LDAP server
by Marcelo Pereira 17 Apr '12

17 Apr '12

Hello, I have been reading some documentation on how to setup a Samba+LDAP environment, but they are all considering that I'm setting up a "new" LDAP server on the same machine. I want to set up a Samba server (which is my server) but I would like to use an external LDAP server (which I don't have any access other than just authenticate myself) to authenticate the users in my Samba box. The LDAP server is up and running (I can't do anything there). I just need to connect my Samba box to this LDAP server in order to authenticate the users. Would you please suggest the right documentation so I could read it?? I will appreciate any help on this regard!! Thanks, Marcelo

1 0

ldapd vs. slapd
by Richards, Toby 17 Apr '12

17 Apr '12

I've been attempting to get an OpenLDAP server running all day, and I've been reading official documentation, tutorials, and anything else relevant on Google. I have some questions: 1. What is the difference between ldapd & slapd (and commands such as ldapadd & slapdadd)? Slapd doesn't seem to respond on LDAP ports, but ldapd does. 2. When using commands & configuring ldap.conf, can I use an IP address instead of an FQDN for the host URI? 3. Do self-signed certificates break ldapadd? 4. I'm running with an SSL certificate, but no TLS. I commonly get the error "Confidentiality Required." The -Z option is for TLS. How do I tell ldapadd that I'm using SSL only? I tried with -Hldaps://hostname:636, but then I get "ldap_sasl_bind(SIMPLE): Can't connect to LDAP server" (even if I use the -x option). I know that the ldap server is running because when ldapd is running, I can connect with external tools such as jxplorer or ldap-at (but trying to make changes to my database will crash both of those utilities). Respectfully Submitted, R. Toby Richards Network Administrator Superior Court of California In and For the County of San Luis Obispo (805) 781-4150

4 7

Multiple error codes defined as (-1)
by Jan Synacek 17 Apr '12

17 Apr '12

Hello all, There are multiple error codes defined as (-1) in ldap.h. When you call ldap_result() followed by a ldap_get_option(ld, LDAP_OPT_RESULT_CODE, &err) how do you distinguish between the meanings of -1? How does ldap_err2string() do that? -- Jan Synacek Software Engineer, BaseOS team Brno, Red Hat

2 1

Unexpected slapd shutdown (bad file descriptor)
by Stefan Wold 17 Apr '12

17 Apr '12

Hi, I've got an issue with OpenLDAP 2.4.28 on Ubuntu 12.04 where it unexpectedly shutdown due to a bad file descriptor. I wonder if anyone know what could be causing this problem or where I should be looking to figure it out. This seems to occur when the server is handling many simultaneous queries. Judging by the bugtracker there has been similar issues in earlier versions. A few log entries: Apr 13 15:03:14 sukat-test-ldapro02 slapd[30273]: slapd(23): setsockopt(SO_KEEPALIVE) failed errno=9 (Bad file descriptor) Apr 13 15:03:14 sukat-test-ldapro02 slapd[30273]: slapd(23): setsockopt(TCP_NODELAY) failed errno=9 (Bad file descriptor) Apr 13 15:03:14 sukat-test-ldapro02 slapd[30273]: daemon: epoll_ctl(ADD,fd=23) failed, errno=1, shutting down Apr 13 15:03:14 sukat-test-ldapro02 slapd[30273]: daemon: abnormal condition, shutdown initiated. Apr 13 15:03:14 sukat-test-ldapro02 slapd[30273]: conn=109877 fd=18 closed (slapd shutdown) Apr 13 15:03:14 sukat-test-ldapro02 slapd[30273]: conn=109881 fd=20 closed (slapd shutdown) Apr 13 15:03:14 sukat-test-ldapro02 slapd[30273]: conn=109879 fd=21 closed (slapd shutdown) Apr 13 15:03:14 sukat-test-ldapro02 slapd[30273]: conn=109880 fd=22 closed (slapd shutdown) For a complete log: https://gist.github.com/2994c23ff506ffdaf21f -- Stefan Wold IT-services, Stockholm University

1 0

ldapdelete "ldap_bind: Invalid DN syntax (34)"
by Tianyin Xu 16 Apr '12

16 Apr '12

Hi, Sorry for the newbie question, but I really cannot figure out the problem. I just follow the "A Quick-Start Guide", what I did is build a example.ldif as follows: -------------------------example.ldif---------------- dn: dc=example,dc=com objectclass: dcObject objectclass: organization o: Example Company dc: example dn: cn=Manager,dc=example,dc=com objectclass: organizationalRole cn: Manager ----------------------------------------------------------- Then, using ldapadd to insert these entries: ldapadd -x -D "cn=Manager,dc=example,dc=com" -f example.ldif -w secret adding new entry "dc=example,dc=com" adding new entry "cn=Manager,dc=example,dc=com" Everything is fine. ***** Then, I want to use ldapdelete to delete the entries I added just now. I tried ldapdelete "cn=Manager,dc=example,dc=com" -x -w secret ldap_bind: Invalid DN syntax (34) additional info: invalid DN and, also, I tried ldapdelete -D "cn=Manager,dc=example,dc=com" -x -w secret but this time the client just hangs. I read the manuals and search on google but still does not have idea. my ldap.conf is as follows database bdb suffix "dc=example,dc=com" rootdn "cn=Manager,dc=example,dc=com" rootpw secret directory /usr/local/var/openldap-data Could anyone take a look and tell me why? Thanks a lot! -- Tianyin

3 6

Re: JLDAP problem
by Bahadir Konu 16 Apr '12

16 Apr '12

What I m working on is an integration component that will listen to LDAP server. When a change occurs on LDAP entries, my component will publish a message. (actually call a web service). LDAP admins offer that I can use "change logs" to detect changes. But I think notification mechanism is a better choice. Do you think JLDAP and asynch "search" method a good enough choice? Is UnboundID SDK better for me and why? Thanks. Bahadır Konu On 13 April 2012 19:43, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Friday, April 13, 2012 5:00 PM +0300 Bahadir Konu <bah.konu(a)gmail.com> > wrote: > > Thanks Nick. >> After building from source, problem dissapeared. And I was able to debug. >> > > If you are serious about using Java to talk to LDAP, then I would advise > using the UnboundID SDK. > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

reqStart<= slow
by Michael Ströder 14 Apr '12

14 Apr '12

HI! I'm trying to retrieve change events from accesslog DB (all with today's RE24). I tried searching with this filter: (&(reqDN=cn=Test-Mail-Gruppe 1,dc=example,dc=com)(reqStart<=20120413180000Z)) This turned out to be quite slow though. reqDN is indexed and there are only two possible entries. Using a filter reqStart>= even when negated with (!()) is pretty fast. I really wonder why that is. Ciao, Michael.

2 4

Re: AW: Re: How can I set an LDAP-attribute to "null" (empty)?
by masarati＠aero.polimi.it 14 Apr '12

14 Apr '12

[please keep replies on the list] > IŽm sorry, but that is not a qualified answer... OK, I'll try to be more precise. 1) "TelUser": not a standard track attribute. Please provide its specification (significantly, its syntax) otherwise the point is moot. 2) few standard track syntaxes allow zero length strings; see RFC4517. In short, RTFM to see if the syntax of your "TelUser" allows a zero length string. It appears from the description of your problem, that you want to zero out a value, not actually store a zero length value. This is common of rdbms users, where tables have a fixed structure and when some field is not defined one just wants to store an empty value in it. LDAP, instead allows object to have optional attributes; when optional attributes are not needed, they should not appear at all. If your problem is with the tool you're using, that has nothing to do with OpenLDAP; so please ask the appropriate forum. p. > > ----- Ursprüngliche Nachricht ----- > Von: masarati(a)aero.polimi.it > An: norbert.weckert(a)arcor.de > Cc: openldap-technical(a)openldap.org > Gesendet: 13.04.12 23:26 > Betreff: Re: How can I set an LDAP-attribute to "null" (empty)? > >> Hello, >> >> to fill data into an LDAP-structure, I use the software HP Connect IT. >> Sometimes it is necessary to clear an attribute. >> >> But there is the following error message: >> >> Error occured while modifiying the entry (LDAP) >> TelUser value #0 invalid per Syntax >> LDAP API Invalid Syntax >> >> Can you tell me, what I have to do, so that LDAP accepts an "empty >> value"? > > Nearly no syntax accepts the empty value. What you need to do is delete > the attribute using a standard LDAP modify operation. In LDIF: > > dn: (the DN) > changetype: modify > delete: TelUser > - > > How to do it using that specific software is up to you. > > p. > > >

1 0

How can I set an LDAP-attribute to "null" (empty)?
by norbert.weckert＠arcor.de 13 Apr '12

13 Apr '12

Hello, to fill data into an LDAP-structure, I use the software HP Connect IT. Sometimes it is necessary to clear an attribute. But there is the following error message: Error occured while modifiying the entry (LDAP) TelUser value #0 invalid per Syntax LDAP API Invalid Syntax Can you tell me, what I have to do, so that LDAP accepts an "empty value"? Thank you in advance. Kind regards Norbert Weckert

2 1

JLDAP problem
by Bahadir Konu 13 Apr '12

13 Apr '12

Hi everybody, I m working on an application that will listen to LDAP server (IBM Tivoli) and detect changes to LDAP entries. I saw the SearchPersist example and done the same: http://developer.novell.com/documentation/samplecode/jldap_sample/controls/… This example works fine as a standalone Java application. But when I try to make this a scheduled quartz job and deploy my application as an Enterprise Application to IBM Websphere ESB server, this line does not work: // Asynchronous queue = lc.search(searchBase, // container to search LDAPConnection.SCOPE_SUB, // search container's subtree "(objectClass=*)", // search filter, all objects attrs, // don't return attributes false, // return attrs and values, ignored null, // use default search queue constraints); // use default search constraints When I debug, the thread hangs here. And right now I cannot debug the JLDAP itself because my .class files was not produced with line number info. Synchronous version of the method works fine: LDAPSearchResults results = lc.search(searchBase, LDAPConnection.SCOPE_SUB, "(objectClass=*)", attrs, false ); I guess that the quartz scheduler is creating a seperate thread and the asynch version of the method doesnt work. But I m not sure what actually is happening. Am I doing something wrong? Is it possible to use the asynch search method in a scheduled job? (And the app is deployed to ESB server but that may not be relevant to my problem.) Ask me and I can give more details about the application, if needed. Any help is appreciated. Bahadır Konu

3 4

Was: (ITS#7130) OpenLDAP with BackSQL and Postgres. Upper on bigint?
by masarati＠aero.polimi.it 12 Apr '12

12 Apr '12

> I'm sorry, I send my issue to the wrong mailinglist at first (to the > bugs list) and then tried to send it to technical twice. It doesnt > seem to go through. Do you have any idea which column it is that > defines this behaviour? I can't seem to find it.. It is not a boolean, but rather a separate field. As far as I recall, in the original design uppercasing was intended as a form of normalization. In table "ldap_attr_mappings" you find a "sel_expr_u" that contains the "uppercasing" select expression. If not given, and if an uppercasing function is known, it is constructed as "<uppercasing>(<sel_expr>)", but you have a chance to provide a specific one. Please test and report through the openldap-technical mailing list, unless you find a bug. p.

1 0

ppolicy overlay doesn't apply
by Cosmin Ciuraru 12 Apr '12

12 Apr '12

Hello, I am trying to use the ppolicy overlay with openldap, version 2.4.20, installed on a SLES 11 SP1 x64, as a package. I have made the following settings in the openldap.conf: - included the ppolicy.schema - overlay ppolicy - ppolicy_default "cn=pwd,ou=Policies,o=...." I saw that a"'moduleload ppolicy.la" is also required, but I cannot find the library in /usr/lib/openldap/modules (which is empty). I have compiled the source with --enable-ppolicy=mod/yes with --enable-modules=yes, to see if it would generate the library ppolicy.la, but just generated the slapd binary, so, as it gives no error for the config file, I suppose that the ppolicy part is embedded in the slapd. The problem: When I try to change the password for a user in LDAP, the policy doesn't apply. The clients run on the same OS, but different machines, with pam_ldap-184 and nss-ldap-262. If I open the yast2-ldap-client, I can see that it finds the password policy, but it doesn't get applied. If I follow the requests to the LDAP server, I can see that the client issues a request with the filter objectClass=passwordPolicy, which comes from the pam_ldap, which is written to use the Netscape password policy schema. But in my LDAP I use the pwdPolicy schema, which is a more recent one. I know that the password doesn't get applied because I set the checkQuality attribute to 0 and I expect to let me use whatever password I like. The client has the pam_lookup_policy set to yes. Can you please point out what I am missing? Thank you!

3 2

CentOS 6.2 ldap client -> CentOS 5.8 server = all fields *but* password (kinda)?
by Phillippe Welsh 12 Apr '12

12 Apr '12

I know C6 client -> C5 ldap server works. I have a couple of systems that do it. I have one crazy system that just went into production that does not properly authenticate. Here is the scenario: 1. "getent passwd" will show *all* users *and* passwords. 2. "getent passwd USERNAME" will show all user info and *NOT* the password(the field is a "*"). Has anyone come across this behavior? There must be some option I messed up and did not realize it. I have checked for differences from a working system in nsswitch.conf, authconfig, sssd.conf, pam_ldap.conf, nslcd.conf and ldap.conf with no luck. I have looked at "rpm -V openldap" and "rpm -V openldap-clients" with no luck. This is making me crazy! It has to be something simple. Additionally, I have "nscd -i passwd" and tried to stop/start both the nslcd and nscd daemons. Google has not been of very much help with the pattern of search I've tried so far, either... Thanks for any help pj

1 0

Re: slow or inconsistent syncrepl
by Amol Kulkarni 12 Apr '12

12 Apr '12

As per the recommendations, we have done following : 1. Installed openldap 2.4.30 on master & all replicas. 2. We have cascaded the replication by adding another replica in lan which acts as provider for the consumers on wan. There are definite improvements but still we are observing following problem : 1. Bulk changes (1000 records changed) in LDAP on the provider, do not replicate to replicas with busy ldap unless a) the records are updated in smaller batches on provider b) the replication database on the consumer is reset - i.e ldap restarted with -c rid=001 Is there a buffer/queue at the consumer side which overflows? Can it be tuned? Does a busy server drop replication requests? Thanks, Amol. ----- Original Message ----- From: Quanah Gibson-Mount Sent: 03/12/12 03:36 AM To: Amol Kulkarni Subject: Re: slow or inconsistent syncrepl --On Sunday, March 11, 2012 8:51 AM +0100 Amol Kulkarni <amolkulkarni(a)gmx.com> wrote: > > I see that I'm outdated in my tuning as per > http://wiki.zimbra.com/wiki/OpenLDAP_Performance_Tuning. > I'll do these changes and observe the servers. > > In the mean time a new observation regarding syncrepl is that if I do > ldapmodify for 5 - 10 entries in one go the changes get replicated but if > I change about 300 entries in one go, then some entries do not get > replicated on some servers. These changes dont get replicated until I > change those entries again. > > Does this indicate provider resource problem or consumer resource problem > ( or normal behaviour ) ? Changes failing to replicate is not a desired behavior. It is expected to occur in older known buggy releases. If all of your masters & replicas are on 2.4.30, hopefully you won't see that issue any more. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

home directory of added user with him profile environment
by stefano malini 11 Apr '12

11 Apr '12

Hi, i installed an ldap server on debian squeeze. i've to add every user but i don't how to set him home directory with him profile environment. The home directory can be created using mkdir? how to keep the profile environment from /etc/skel? thanks

1 0

RE24 testing call #1 (2.4.31)
by Quanah Gibson-Mount 10 Apr '12

10 Apr '12

If you know how to build OpenLDAP manually, and would like to participate in testing the next set of code for the 2.4.31 release, please do so. Generally, get the code for RE24: <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> Configure & build. Execute the test suite (via make test) after it is built. Thanks! --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

6 5

Referral Problem with SQL Backend
by Robert Eikermann 10 Apr '12

10 Apr '12

Hi, I have a problem with my Openldap Server 2.4.23 with SQL Backend. I have configured a referral to another Openldap server, but the referral dn is always the same as the bind dn from my ldapsearch command. So the referral dn is overwritten with the bind dn. The server localhost:389 has rootdn="dc=sselab,dc=de" And localhost:390 has rootdn="dc=tim,dc=sselab,dc=de" Following are the configuration and the Log files of the LDAP Server with SQL Backend at Loglevel -1. In the Logfile you can see the starting of the server + the search "ldapsearch -xLLL -h localhost:389 -b dc=sselab,dc=de". I think at line 4114 one can see how the referral is used. Slapd.conf : <http://pastebin.com/tvtdNaZ6> http://pastebin.com/tvtdNaZ6 sql attribute mappings: <http://image-upload.de/image/WcDeaB/fd191aa422.png> http://image-upload.de/image/WcDeaB/fd191aa422.png sql entries: <http://image-upload.de/image/qGiBOY/51496a9462.png> http://image-upload.de/image/qGiBOY/51496a9462.png sql object classes: <http://image-upload.de/image/Rei0X3/4f6b2b43f5.png> http://image-upload.de/image/Rei0X3/4f6b2b43f5.png sql oc mapping: <http://image-upload.de/image/TRscIQ/7141e04af6.png> http://image-upload.de/image/TRscIQ/7141e04af6.png sql referral: <http://image-upload.de/image/LGxZKQ/28773fadf7.png> http://image-upload.de/image/LGxZKQ/28773fadf7.png ldap Log: <http://pastebin.com/N8NCyLzt> http://pastebin.com/N8NCyLzt To demonstrate the behavior: Search for the referral Object: user@user-desktop:~$ ldapsearch -M -xLLL -h localhost:389 "(objectClass=referral)" '*' ref dn: dc=tim,dc=sselab,dc=de objectClass: referral objectClass: extensibleObject dc: tim ref: ldap://localhost:390/dc=tim,dc=sselab,dc=de# which is exactly what I want! But searching all objects: user@user-desktop:~$ ldapsearch -xLLL -h localhost:389 -b dc=sselab,dc=de dn: dc=sselab,dc=de objectClass: dcObject dc: sselab . # refldap://localhost:390/dc=sselab,dc=de??sub Results with the wrong dn in refldap! Search with the dc=tim DN : user@user-desktop:~$ ldapsearch -xLLL -h localhost:389 -b dc=tim,dc=sselab,dc=de Referral (10) Referral: ldap://localhost:390/dc=tim,dc=sselab,dc=de??sub If you need more Information please let me know. Best regards Robert Eikermann

2 1

Minimum length for uid attribute
by Priscilla V 10 Apr '12

10 Apr '12

Hi all, I am trying to use openldap users for authentication with postfix. For users with uid length 2 it says user unknown in local recipient table. But ldapsearch returns the result if queried. Is there any configuration for minimum length or what could be the issue? Kindly help. Regards Priscilla

3 3

Translucent overlay and local entities
by Eugene Vilensky 09 Apr '12

09 Apr '12

Greetings, Pardon if this is an RTFM, but is it possible to store entities locally using the translucent overlay? The overlay works for what we are trying to do when it comes to search and modifying attributes on an entry, but I would like to create a local groupofnames, consisting of remote UIDs. For example, this LDIF imports OK: #!RESULT OK #!CONNECTION ldap://xxxxx #!DATE 2012-04-09T16:01:33.961 dn: cn=instructors,ou=Groups,dc=xxxx,dc=zzz changetype: add objectClass: groupofnames member: uid=nate member: uid=penelope member: uid=rhonda cn: instructors But searching for it does not bring back a result. However, it must have gone somewhere since if I try to import the same LDIF again: #!RESULT ERROR #!CONNECTION ldap://xxxxx #!DATE 2012-04-09T16:21:28.221 #!ERROR [LDAP: error code 68 - Entry Already Exists] Kind regards, Eugene

1 0

Re: Hashing the userPassword
by Michael Ströder 09 Apr '12

09 Apr '12

Please post your follow-ups on the mailing list so others can respond and learn as well. Suneet Shah wrote: > So if create a user and then set the password on an existing user then, the > password-hash attribute will work? And I can send the password to OpenLDAP in > clear text? Yes. Also note the other poster's hint about using slapo-ppolicy and ppolicy_hash_cleartext if you're allowed to configure the server. > I am curious - if the client hashes the password, in my case it would be my > java program, how will openldap use that hashed password during authentication? > > Wouldnt both (openldap and my java program) need to have the salt used for > hashing? And in this case, only my java program would have that salt. The salt is part of the userPassword value. See more information in OpenLDAP's FAQ-O-MATIC: http://www.openldap.org/faq/data/cache/419.html Ciao, Michael.

2 3

ldapadd: invalid format (line 5) entry for LDAP replication
by Brajabasi Padhy 09 Apr '12

09 Apr '12

Hello Sir, I'm trying to set up a LDAP provider server, but facing problime with folowing command sudo ldapadd -Y EXTERNAL -H ldapi:/// -f provider_sync.ldif I followed all steps provided in th following link, but still failing. https://help.ubuntu.com/10.04/serverguide/C/openldap-server.html I'm getting this error ldapadd: invalid format (line 5) entry: "olcDatabase={1}hdb,cn=config" Please help me if possible. The provider_sync.ldif file copied from the above link. Thnaks for your support. Brajabasi

1 0

Replication and user password change
by Jacques Foucry 06 Apr '12

06 Apr '12

Hello the list, I'm new here, new at OpenLDAP and I have an issue. I've search for many time now an explanation but I saw nothing. Here is my problem. I ran a OpenLDAP server on a Debian VM # slapd -V @(#) $OpenLDAP: slapd 2.4.11 (Jul 23 2010 21:37:26) $ @barber:/build/buildd-openldap_2.4.11-1+lenny2-amd64-WJ2jlD/openldap-2.4.11/debian/build/servers/slapd I have many direct client (desktop computer who query the ldap server) and everything work well. I made this ACL on slapd.conf to allow users to change there password: access to attrs=userPassword,shadowLastChange by self write by dn="cn=syncuser,dc=example,dc=com" read by anonymous auth by * none access to * by self write by * read And it works fine. These are the only ACL I have. I also have 2 replications of this LDAP Server. syncrepl rid=002 provider=ldaps://ldap.example.com type=refreshOnly interval=00:01:00:00 retry="60 10 300 +" filter="(objectClass=*)" scope=sub attrs="*" bindmethod=simple schemachecking=off searchbase="dc=example,dc=com" binddn="cn=syncuser,dc=example,dc=com" credentials=youdonthavetoknow tls_reqcert=never The replications work well to and user can connect to those replication computer (I don't have client of those replication). But the trouble is when a user, connected to these replication try to change his password: % passwd Enter login(LDAP) password: New password: Re-enter new password: LDAP password information update failed: Strong(er) authentication required modifications require authentication passwd: Permission denied passwd: password unchanged In the /var/log/auth.log file I found: Apr 4 16:10:45 ovhstorage sshd[22056]: pam_unix(sshd:account): password for user test will expire in 4 days Apr 4 16:10:45 ovhstorage sshd[22056]: Accepted publickey for test from 88.162.182.86 port 49955 ssh2 Apr 4 16:10:45 ovhstorage sshd[22056]: pam_unix(sshd:session): session opened for user test by (uid=0) Apr 4 16:10:48 ovhstorage passwd[22064]: pam_unix(passwd:chauthtok): user "test" does not exist in /etc/passwd Apr 4 16:10:55 ovhstorage passwd[22064]: pam_unix(passwd:chauthtok): user "test" does not exist in /etc/passwd I know that modification must be done on the master server,but how can I send modifications to the master. Did I have to use "referrals"? Thanks in advance for giving the correct pointers. Best regards Jacques Foucry

3 3

Re: 2.4.30 - libldap & libldap_r do not coexist
by Amol Kulkarni 06 Apr '12

06 Apr '12

I'm experiencing the following problem on CentOS6 - although I've not tested on other Os'es. On the same machine I've tested following combinations of client & server versions : Client=2.4.23, Server=2.4.30, Crash=No Client=2.4.30, Server=2.4.23, Crash=Yes So I believe the problem lies in 2.4.30 client libraries which I have compiled. However I'm not able to find something from Changelog related to this. I'll now gdb my program and see if I get anything. Till then does anybody have any idea abt the prb? Thanks, Amol. ----- Original Message ----- From: Amol Kulkarni Sent: 03/24/12 04:27 PM To: Openldap-technical Subject: 2.4.30 - libldap & libldap_r do not coexist Hi, I've a program which links to both libldap & libldap_r dynamically. I've been running this program with openldap 2.4.23 without any problem. But when I upgraded to openldap 2.4.30, the program crashes with segfault. The crash occurs at the end when the program is closing connections. I googled and found that libldap & libldap_r should not be used in same process space bcos they one is non-threadsafe and other is threadsafe and they have same symbols. It is difficult for me to solve the problem by changing my compile configuration bcos my program loads 2 third party libraries which load these different versions of ldaplibraries. One solution for me is to make a soft link from libldap to libldap_r, i.e make everyone use the threadsafe library. Would it be create any problems ? Also, can anyone tell why I did not face the problem in 2.4.23 - I mean is there any compile time setting in openldap for this - which I've missed in 2.4.30 ? Thanks and Regards, Amol Kulkarni.

2 1

LDAP entries missing from search results depending on search base.
by Brandon Hume 06 Apr '12

06 Apr '12

I have a large number of mail aliases stored in LDAP used by sendmail. They're stored off by themselves as opposed to hung off the user objects, so that the mail servers can have their own LDAP replicas containing only a portion of the tree rather than all the user objects as well. An example entry would be thus: dn: cn=broken2,cn=dal,cn=Mailmaps,cn=Services,dc=DAL,dc=CA objectClass: top objectClass: applicationProcess objectClass: inetLocalMailRecipient cn: broken2 mailRoutingAddress: broken2(a)dal.ca mailLocalAddress: broken2(a)imap.dal.ca However, this entry will not show up in searches, depending on what I use as a search base: A successful search looks like: $ /opt/csw/bin/ldapsearch -x -W -D cn=noc,dc=dal,dc=ca -h kil-ds-3.its.dal.ca -b dc=dal,dc=ca -LLL -s sub '(cn=broken2)' dn Enter LDAP Password: dn: cn=broken2,cn=dal,cn=Mailmaps,cn=Services,dc=DAL,dc=CA $ However, if I change *only* the search base: $ /opt/csw/bin/ldapsearch -x -W -D cn=noc,dc=dal,dc=ca -h kil-ds-3.its.dal.ca -b cn=services,dc=dal,dc=ca -LLL -s sub '(cn=broken2)' dn Enter LDAP Password: $ A base of cn=Mailmaps,cn=Services,dc=DAL,dc=CA likewise doesn't work, but the entry appears again if I use cn=dal,cn=Mailmaps,cn=Services,dc=DAL,dc=CA. This server is running 2.4.30 built with BerkeleyDB 5.3.15. The backend I'm using is HDB. I've *completely* removed any ACLs I had defined and it made no difference... not that I expected it to, since cn=noc,dc=dal,dc=ca is the rootDN. I thought I might have been running into a limit of number of objects inside a container (there's about 123k entries under cn=dal) so I tried dumping the DIT, and moving everything into subcontainers based on first character of the alias (cn=a,cn=dal ; cn=b,cn=dal and so on) which made sure there was no container with more than 10k objects... it still made no difference. I've run the server with olcLogLevel=Any, and I see the following difference in the syslog: A "good" search: Apr 4 16:12:43 kil-ds-3 slapd[29544]: conn=1035 op=1 SRCH base="dc=dal,dc=ca" scope=2 deref=0 filter="(cn=broken2)" Apr 4 16:12:43 kil-ds-3 slapd[29544]: conn=1035 op=1 SRCH attr=dn Apr 4 16:12:43 kil-ds-3 slapd[29544]: => hdb_search Apr 4 16:12:43 kil-ds-3 slapd[29544]: bdb_dn2entry("dc=dal,dc=ca") Apr 4 16:12:43 kil-ds-3 slapd[29544]: => access_allowed: search access to "dc=DAL,dc=CA" "entry" requested Apr 4 16:12:43 kil-ds-3 slapd[29544]: <= root access granted Apr 4 16:12:43 kil-ds-3 slapd[29544]: => access_allowed: search access granted by manage(=mwrscxd) Apr 4 16:12:43 kil-ds-3 slapd[29544]: search_candidates: base="dc=dal,dc=ca" (0x00000001) scope=2 Apr 4 16:12:43 kil-ds-3 slapd[29544]: daemon: activity on 1 descriptor Apr 4 16:12:43 kil-ds-3 slapd[29544]: daemon: activity on: Apr 4 16:12:43 kil-ds-3 slapd[29544]: Apr 4 16:12:43 kil-ds-3 slapd[29544]: daemon: epoll: listen=7 active_threads=0 tvp=zero Apr 4 16:12:43 kil-ds-3 slapd[29544]: daemon: epoll: listen=8 active_threads=0 tvp=zero Apr 4 16:12:43 kil-ds-3 slapd[29544]: daemon: epoll: listen=9 active_threads=0 tvp=zero Apr 4 16:12:43 kil-ds-3 slapd[29544]: => hdb_dn2idl("dc=dal,dc=ca") Apr 4 16:12:43 kil-ds-3 slapd[29544]: => bdb_filter_candidates Apr 4 16:12:43 kil-ds-3 slapd[29544]: #011AND Apr 4 16:12:43 kil-ds-3 slapd[29544]: => bdb_list_candidates 0xa0 Apr 4 16:12:43 kil-ds-3 slapd[29544]: => bdb_filter_candidates Apr 4 16:12:43 kil-ds-3 slapd[29544]: #011OR Apr 4 16:12:43 kil-ds-3 slapd[29544]: => bdb_list_candidates 0xa1 Apr 4 16:12:43 kil-ds-3 slapd[29544]: => bdb_filter_candidates Apr 4 16:12:43 kil-ds-3 slapd[29544]: #011EQUALITY Apr 4 16:12:43 kil-ds-3 slapd[29544]: => bdb_equality_candidates (objectClass) Apr 4 16:12:43 kil-ds-3 slapd[29544]: => key_read Apr 4 16:12:43 kil-ds-3 slapd[29544]: bdb_idl_fetch_key: [b49d1940] Apr 4 16:12:43 kil-ds-3 slapd[29544]: <= bdb_index_read: failed (-30988) Apr 4 16:12:43 kil-ds-3 slapd[29544]: <= bdb_equality_candidates: id=0, first=0, last=0 Apr 4 16:12:43 kil-ds-3 slapd[29544]: <= bdb_filter_candidates: id=0 first=0 last=0 Apr 4 16:12:43 kil-ds-3 slapd[29544]: => bdb_filter_candidates Apr 4 16:12:43 kil-ds-3 slapd[29544]: #011EQUALITY Apr 4 16:12:43 kil-ds-3 slapd[29544]: => bdb_equality_candidates (cn) Apr 4 16:12:43 kil-ds-3 slapd[29544]: => key_read Apr 4 16:12:43 kil-ds-3 slapd[29544]: bdb_idl_fetch_key: [2714190a] Apr 4 16:12:43 kil-ds-3 slapd[29544]: <= bdb_index_read 1 candidates Apr 4 16:12:43 kil-ds-3 slapd[29544]: <= bdb_equality_candidates: id=1, first=338261, last=338261 Apr 4 16:12:43 kil-ds-3 slapd[29544]: <= bdb_filter_candidates: id=1 first=338261 last=338261 Apr 4 16:12:43 kil-ds-3 slapd[29544]: <= bdb_list_candidates: id=1 first=338261 last=338261 Apr 4 16:12:43 kil-ds-3 slapd[29544]: <= bdb_filter_candidates: id=1 first=338261 last=338261 Apr 4 16:12:43 kil-ds-3 slapd[29544]: <= bdb_list_candidates: id=1 first=338261 last=338261 Apr 4 16:12:43 kil-ds-3 slapd[29544]: <= bdb_filter_candidates: id=1 first=338261 last=338261 Apr 4 16:12:43 kil-ds-3 slapd[29544]: bdb_search_candidates: id=1 first=338261 last=338261 Apr 4 16:12:43 kil-ds-3 slapd[29544]: => test_filter Apr 4 16:12:43 kil-ds-3 slapd[29544]: EQUALITY Apr 4 16:12:43 kil-ds-3 slapd[29544]: => access_allowed: search access to "cn=broken2,cn=b,cn=dal,cn=Mailmaps,cn=Services,dc=DAL,dc=CA" "cn" requested And a "bad" search: Apr 4 16:13:43 kil-ds-3 slapd[29544]: conn=1036 op=1 SRCH base="cn=services,dc=dal,dc=ca" scope=2 deref=0 filter="(cn=broken2)" Apr 4 16:13:43 kil-ds-3 slapd[29544]: conn=1036 op=1 SRCH attr=dn Apr 4 16:13:43 kil-ds-3 slapd[29544]: => hdb_search Apr 4 16:13:43 kil-ds-3 slapd[29544]: bdb_dn2entry("cn=services,dc=dal,dc=ca") Apr 4 16:13:43 kil-ds-3 slapd[29544]: => access_allowed: search access to "cn=Services,dc=DAL,dc=CA" "entry" requested Apr 4 16:13:43 kil-ds-3 slapd[29544]: <= root access granted Apr 4 16:13:43 kil-ds-3 slapd[29544]: => access_allowed: search access granted by manage(=mwrscxd) Apr 4 16:13:43 kil-ds-3 slapd[29544]: search_candidates: base="cn=services,dc=dal,dc=ca" (0x00000003) scope=2 Apr 4 16:13:43 kil-ds-3 slapd[29544]: => hdb_dn2idl("cn=services,dc=dal,dc=ca") Apr 4 16:13:43 kil-ds-3 slapd[29544]: daemon: activity on 1 descriptor Apr 4 16:13:43 kil-ds-3 slapd[29544]: daemon: activity on: Apr 4 16:13:43 kil-ds-3 slapd[29544]: Apr 4 16:13:43 kil-ds-3 slapd[29544]: daemon: epoll: listen=7 active_threads=0 tvp=zero Apr 4 16:13:43 kil-ds-3 slapd[29544]: daemon: epoll: listen=8 active_threads=0 tvp=zero Apr 4 16:13:43 kil-ds-3 slapd[29544]: daemon: epoll: listen=9 active_threads=0 tvp=zero Apr 4 16:13:43 kil-ds-3 slapd[29544]: => bdb_filter_candidates Apr 4 16:13:43 kil-ds-3 slapd[29544]: #011AND Apr 4 16:13:43 kil-ds-3 slapd[29544]: => bdb_list_candidates 0xa0 Apr 4 16:13:43 kil-ds-3 slapd[29544]: => bdb_filter_candidates Apr 4 16:13:43 kil-ds-3 slapd[29544]: #011OR Apr 4 16:13:43 kil-ds-3 slapd[29544]: => bdb_list_candidates 0xa1 Apr 4 16:13:43 kil-ds-3 slapd[29544]: => bdb_filter_candidates Apr 4 16:13:43 kil-ds-3 slapd[29544]: #011EQUALITY Apr 4 16:13:43 kil-ds-3 slapd[29544]: => bdb_equality_candidates (objectClass) Apr 4 16:13:43 kil-ds-3 slapd[29544]: => key_read Apr 4 16:13:43 kil-ds-3 slapd[29544]: bdb_idl_fetch_key: [b49d1940] Apr 4 16:13:43 kil-ds-3 slapd[29544]: <= bdb_index_read: failed (-30988) Apr 4 16:13:43 kil-ds-3 slapd[29544]: <= bdb_equality_candidates: id=0, first=0, last=0 Apr 4 16:13:43 kil-ds-3 slapd[29544]: <= bdb_filter_candidates: id=0 first=0 last=0 Apr 4 16:13:43 kil-ds-3 slapd[29544]: => bdb_filter_candidates Apr 4 16:13:43 kil-ds-3 slapd[29544]: #011EQUALITY Apr 4 16:13:43 kil-ds-3 slapd[29544]: => bdb_equality_candidates (cn) Apr 4 16:13:43 kil-ds-3 slapd[29544]: => key_read Apr 4 16:13:43 kil-ds-3 slapd[29544]: bdb_idl_fetch_key: [2714190a] Apr 4 16:13:43 kil-ds-3 slapd[29544]: <= bdb_index_read 1 candidates Apr 4 16:13:43 kil-ds-3 slapd[29544]: <= bdb_equality_candidates: id=1, first=338261, last=338261 Apr 4 16:13:43 kil-ds-3 slapd[29544]: <= bdb_filter_candidates: id=1 first=338261 last=338261 Apr 4 16:13:43 kil-ds-3 slapd[29544]: <= bdb_list_candidates: id=1 first=338261 last=338261 Apr 4 16:13:43 kil-ds-3 slapd[29544]: <= bdb_filter_candidates: id=1 first=338261 last=338261 Apr 4 16:13:43 kil-ds-3 slapd[29544]: <= bdb_list_candidates: id=0 first=3 last=0 Apr 4 16:13:43 kil-ds-3 slapd[29544]: <= bdb_filter_candidates: id=0 first=3 last=0 Apr 4 16:13:43 kil-ds-3 slapd[29544]: bdb_search_candidates: id=0 first=3 last=0 Apr 4 16:13:43 kil-ds-3 slapd[29544]: hdb_search: no candidates Apr 4 16:13:43 kil-ds-3 slapd[29544]: send_ldap_result: conn=1036 op=1 p=3 Apr 4 16:13:43 kil-ds-3 slapd[29544]: send_ldap_result: err=0 matched="" text="" Apr 4 16:13:43 kil-ds-3 slapd[29544]: send_ldap_response: msgid=2 tag=101 err=0 Apr 4 16:13:43 kil-ds-3 slapd[29544]: conn=1036 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= Notable is hdb_search finding no candidates. Is there anything obviously wrong, here?

4 14

db in shadow context without replication
by Julien Soula 05 Apr '12

05 Apr '12

hello, I have a problem with a cancelation of replication of cn=config. I configured replication of cn=config in slapd.d (without slapd.conf) and I wanted to stop it. First one, I didn't see how to cancel replication in cn=config otherwise that deleting olcSyncRepl attribute directly in slapd.d files since database was in shadow context. Is there a proper way ? So I stopped slapd and deleted olcSyncRepl attribute and restarted it. But when I commited change, it failed with error : "shadow context without update referral" (there is no more olcSyncRepl in config) ! I tried to enable olcMirrorMode (directly in files again) but slapd crashed at start saying that the database was not in shadow context ! I cannot explain this behaviour. How the server determine that a database is in shadow context or not ? Is there a cache somewhere ? Sincerly, -- Julien << Vous n'avez rien a dire... Parlons-en! >>

1 1

Re: AD proxy in OpenLDAP
by Christopher O'Kelly 05 Apr '12

05 Apr '12

(feeling a tad silly, now that I have discovered I was not replying to the actual mailing list but to single people.) OK so I have managed to get both the ldap and hdb databases to coexist, mostly through copying code straight from the ldapglue test in the OpenLDAP build files. The ldif file I use now for my backend is as follows - dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulepath: /usr/lib/ldap olcModuleload: back_hdb olcModuleload: back_ldap dn: olcDatabase={1}ldap,cn=config objectClass: olcDatabaseConfig objectClass: olcLDAPConfig olcDatabase: {1}ldap olcSuffix: ou=internal,dc=companyname,dc=local olcSubordinate: TRUE olcDbURI: "ldap://companyname.local" olcDbRebindAsUser: FALSE olcDbChaseReferrals: TRUE dn: olcDatabase={2}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {2}hdb olcSuffix: dc=companyname,dc=local olcLastMod: TRUE olcRootDN: cn=admin,dc=companyname,dc=local olcRootPW: {SSHA}hashed password olcDbDirectory: /var/lib/ldap olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq olcDbIndex: cn pres,eq,sub olcDbIndex: uid pres,eq,sub olcDbIndex: sn pres,eq,sub olcDbCheckpoint: 512 30 olcAccess: to attrs=userPassword by dn="cn=admin,dc=minecorp,dc=local" write by anonymous auth by self write by * none olcAccess: to attrs=shadowLastChange by self write by * read olcAccess: to dn.base="" by * read olcAccess: to * by dn="cn=admin,dc=companyname,dc=local" write by * read I can search dc=companyname,dc=local fine, I see the users in this tree and the Internal OU. However I do not see any of the users from the AD linked to by this database. I know I can ldap search it from the server and get results, so I believe that either I need to construct my search differently or it is an authentication issue. As I read it, I need to use idassert-bind, specifying a user from AD with read access, and that user will be used to search AD. I have a few questions leading from this - The first is: does anyone know the syntax for idassert-bind as it applies to ldif files to be ldapadded to the RTC? As I read it, if it were slapd.conf I would want - idassert-bind bindmethod=simple binddn="cn=proxy,ou=service accounts,ou=users,dc=companyname,dc=local" credentials="password" mode=self but I am unsure how to structure this for RTC. The second is - am I correct in thinking that, once this is all working, a search with (objectclass=*) on the dc=companyname,dc=local should return all the users in that branch as well as all the users in AD? Or will I need to craft my search differently to deal with the proxy? The third is also just a confirmation - is idassert-bind meant for what I think it is? Should it contain a user not in the local DSA but in the one I am proxying to? Or have I misread?

1 0

RE: ppolicy master/slave issue
by Chris Jacobs 04 Apr '12

04 Apr '12

Nope - I merely left out the chain directives. Given the choice between "forward ppolicy updates" or "allow users to change their passwords anywhere", we went with the former. We never identified how to get them to /both/ work and require actual user authentication. This is ok in our environment - and as it turns out we kind of like this limitation. Our corp environment authenticates off the master servers and we simply tell people to use a corp servers to change their password. We don't have any users (besides myself) whose desktop's authenticate from our OpenLDAP infrastructure - it's only our servers. Here's the bits we simply removed from the conf (from the thread you're quoting, the rest is largely the same): chain-uri ldaps://ldap-vip.corp.example.net/ chain-rebind-as-user TRUE chain-idassert-bind bindmethod="simple" binddn="cn=root,dc=example,dc=net" credentials="secret" mode="self" chain-tls ldaps chain-return-error TRUE Someone else hopped onto the thread indicating they had the same problems - but no one ever chimed in with "this is what's going on" or "this is what you're doing wrong". Such is free community support. :) We're now using the RHEL6/CentOS6 2.4.23 supplied packages (nearly a sin in this mailing list, but everything is working fine for us) but haven't approached attempting this again as we're used to this limitation. Of course, that wouldn't be the case if user desktops authenticated from local slave ldap servers, but we're not in that situation and really, we've a lot of other fish in the frying pan. Good luck! - chris From: Limb, Jong (VDSS) [mailto:Jong.Limb@dss.virginia.gov] Sent: Wednesday, April 04, 2012 7:45 AM To: Chris Jacobs Subject: ppolicy master/slave issue Were you ever able to figure out why the authentication against a slave works regardless of the password as you describe below? I am having the exact same problem. Thanks. Jong Limb Division of Information Systems Virginia Department of Social Services 804-726-7823 Hello again, I'm having an odd issue with ppolicy and my master/slave config. First, my goals General use: Slave handles all reads locally. Writes get forwarded to the master by the slave. Password policy: When password failures happen on clients using slave ldap servers, the failures, etc, get passed to the master to get replicated to the slaves. I understand this would be done using the ppolicy option: ppolicy_forward_updates Authentication: Actually authenticate (more later). To the problem: --------------- When I leave the section in the chain bit of SLAVE slapd.conf below marked by lines intact (which bind as root): * ppolicy_forward_updates seems to work great - the master shows matching "pwdFailureTime" attributes. * Regardless of password entered, you get a shell. User/bad password = get a shell! This being a problem should be obvious. I suspect that's due to the chain overlay section... ________________________________ This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

1 0

openldap proxy to AD
by Induni, Marco 04 Apr '12

04 Apr '12

Hi all, I'm building an openldap proxy to an AD server and adding a little of "intelligence" based on the client request. Unfortunately the client/program asking information about an account, need to be setup with user and password. There is a way to let the proxy "ignore" this user and password and instead just use the ones specified on the slapd.conf file ? Or setup fake credential somewhere ? In detail, query are something like: ldapsearch -x -h openldap-proxy -w "secret" -D "CN=MGRADREAD05,CN=MGR,DC=example,DC=com" -b "dc=pmm,dc=int" userPrincipalName=TST-USER10 but I need that the proxy exclude the "-w "secret" -D "CN=MGRADREAD05,CN=MGR,DC=example,DC=com" part, and use the one on the conf file. In fact if I do a query like: ldapsearch -x -h openldap-proxy -w "secret" -D "CN=MGRADREAD05,CN=MGR,DC=example,DC=com" -b "dc=pmm,dc=int" userPrincipalName=TST-USER10 it works. Here the slapd.conf database meta suffix "dc=pmm,dc=int" uri "ldap://10.10.10.1/dc=pmm,dc=int" suffixmassage "dc=pmm,dc=int" "dc=media,dc=int" rewriteContext searchFilter rewriteRule "userPrincipalName=(.*)(a)rtsi.ch" "userPrincipalName=%1(a)rsi.ch" ":" rewriteRule "sAMAccountName=([:alnum:])" "userPrincipalName=%1(a)rtr.ch" ":" idassert-bind bindmethod=simple binddn="CN=svc-adread05,CN=AdminAccounts,OU=RSI,OU=Units,DC=media,DC=int " credentials="Comano2012" mode=self idassert-authzFrom "dn.regex:.*" Any idea ? Many thank's and best regards. Marco ****************************************************** Visit: http://www.rsi.ch This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify postmaster(a)rsi.ch

2 2

Convert *.schema to *.ldif
by Francis Swasey 04 Apr '12

04 Apr '12

I don't see any description in the admin guide about how to convert a *.schema file into a *.ldif file. Google tells me that most people are using slaptest with the -F and -f parameters with a specially crafted slapd.conf file. As the person who is responsible for a *.schema file and develops it not on a machine that has the openldap server software installed, that process is not anything I'm interested in. Looks like it should be a fairly simple set of transformations. Looking at the *.schema and *.ldif that are provided with the openldap source - I am left wondering how they were created, since they have comments, they were obviously not created via the slaptest -F <x> -f <y> method. I would like to programatically do this -- my ability to vi two files and make identical changes has been known to be fallable! I found the fusiondirectory-schema2ldif perl script - but it is not complete and silently drops keywords it doesn't like which is a really nasty coding style generating garbage from quality schemas. Suggestions? Code examples? Thanks, -- Frank Swasey | http://www.uvm.edu/~fcs Sr Systems Administrator | Always remember: You are UNIQUE, University of Vermont | just like everyone else. "I am not young enough to know everything." - Oscar Wilde (1854-1900)

6 7

Password expiration
by Collins, Cris L. 04 Apr '12

04 Apr '12

I am running OpenLDAP as packaged for CentOS 5 and having problems with password expiration. Users are being told every time they login that their password has expired and to change their password. When ShadowMax is changed to 99999 their passwords are not expiring. The preferable setting is 90 days. ShadowLastChange is updating to the correct date when they input a new password. Thank you for you time and input as to why this might be occurring.

4 3

centralized sudo policies : ACL issue
by Olivier 04 Apr '12

04 Apr '12

A quite trivial issue I have : I have installed centralized policy sudo rules in ldap server (I use "schema.OpenLDAP" from "http://www.sudo.ws" ). I also have configured linux clients to check ldap rules to grant sudo access to certain ressources ( I declared "sudoers_base" in nslcd.conf and "sudoers: ldap" in nsswitch.conf ). That works, but I'm still not happy :-) To make it work, I need to authorize reading on the sudoers DIT branch for user, which I would like to avoid ( BTW, normally /etc/sudoers is not readable by users ). Anyone knows any way to remove sudo rules reading rights to usual users while having rules working for everyone ( I was thinking about an ldap proxy user used to read sudo rules in ldap, but I haven't found how to declare it ) ? Thanks, --- Olivier

2 1

Hashing the userPassword
by Suneet Shah 04 Apr '12

04 Apr '12

Hello, I am creating a user in OpenLDAP using Java. The user is being successfully created, but the passwords are being stored in clear text. Is there something that I need to change in the OpenLDAP configuration to enable storing the password securely using ssha? thank you for your help suneet

3 2

modifyTimeStamp not modified on replica
by jehan procaccia 03 Apr '12

03 Apr '12

Hello when I modify the mail attribute on the master, the attribute is correctly replicated on the replica, but the modifyTimeStamp isn't !? shouldn't it be modified !? The master is runing openldap-servers-2.3.43-12.el5_7.10 the replica that failes to replicate modifyTimeStamp is an openldap-servers-2.4.23-20.el6.i686 on a openldap-servers-2.3.43-12.el5_7.10 replica, modifyTimeStamp is correctly updated ! could it be a openldap version incompatibility ? or perhaps an ACL miss-configuration !? Thanks for your help .

2 5

Ubuntu can't connect to SambaPDC
by Imre Bertalan 03 Apr '12

03 Apr '12

Hi guys. This is not really an OpenLDAP question, but it seems we have some fine qualified users here, so I'll ask this question here. :) I have a nice working Zentyal 2.2 server with DNS and SambaPDC. Windows client's can join the domain with the network users ans they see all the shared folders too. My problem is that I don't know how to join a domain with Ubuntu. Tried with likewise-open and likewise-open-gui, but all the time, it sais Bad_DNS_Package. Same error message comes when I try to join from terminal with the command "*sudo domainjoin-cli join DOMAIN USER*" I also installed samba, smbclient, winbind on the client. I heard that it could be because the server is set to allow Win clients only. Could that be? Thanks in advance! Imi

2 1

Active Directory connected to OpenLDAP (master)
by Sylvain 03 Apr '12

03 Apr '12

Hi ! Currently, we've got an OpenLDAP which acts as a master and contains 20000+ users and groups, we want to keep it. CIO ask us to deploy Windows with AD connected to our master OpenLDAP. I've googled a lot and I don't find any clean solutions like replica (OpenLDAP -> AD). Another solution could be use of referrals on the AD but I doubt ? Unclean solutions found are use of LSC or MIIS/FIM which are not real-time... A little help would be cool :) Best regards, Sylvain

3 8

Replication stops working due to objectClass=glue
by frank.offermanns＠caseris.de 03 Apr '12

03 Apr '12

Hi, I have a synrepl-master and one slave. I delete both databases and do a slapadd on the master. After doing so I start the slave. Our system has a few dozen processes changing values every minute, so they also do it when the inital replication is running. >From time to time replication stops working while doing the initial replication. It then always has problems with the values being edited while the intial replication is running (full replication needs a few minutes). Here's a quote concerning master/master. "Both servers will initialize their accesslogs separately from their main DB since they are empty, and the two logs will have different timestamps. You need to make sure that the main DB and log DB are initialized together on at least one of the servers." But this quote should not count for master/slave, does it? If replication works I have slavelogentrys like this: 30.03.2012 11:40:24 4f757f88 oc_check_required entry (ou=Trinity64.ub2.cae.local,ou=SystemStatus,o=caesar), objectClass "Server" If it fails the objectClass is "glue" 30.03.2012 11:25:23 4f757c03 bdb_modify_internal: 0x000006af: ou=Trinity64.ub2.cae.local,ou=SystemStatus,o=caesar 30.03.2012 11:25:23 4f757c03 oc_check_required entry (ou=Trinity64.ub2.cae.local,ou=SystemStatus,o=caesar), objectClass "glue" 30.03.2012 11:25:23 4f757c03 oc_check_allowed type "structuralObjectClass" 30.03.2012 11:25:23 4f757c03 oc_check_allowed type "objectClass" 30.03.2012 11:25:23 4f757c03 oc_check_allowed type "entryUUID" 30.03.2012 11:25:23 4f757c03 oc_check_allowed type "creatorsName" 30.03.2012 11:25:23 4f757c03 oc_check_allowed type "createTimestamp" 30.03.2012 11:25:23 4f757c03 oc_check_allowed type "LastModifiedApplication" 30.03.2012 11:25:23 4f757c03 Entry (ou=Trinity64.ub2.cae.local,ou=SystemStatus,o=caesar), attribute 'LastModifiedApplication' not allowed 30.03.2012 11:25:23 4f757c03 entry failed schema check: attribute 'LastModifiedApplication' not allowed 30.03.2012 11:25:23 4f757c03 hdb_modify: modify failed (65) 30.03.2012 11:25:23 4f757c03 send_ldap_result: conn=-1 op=0 p=3 30.03.2012 11:25:23 4f757c03 null_callback : error code 0x41 30.03.2012 11:25:23 4f757c03 syncrepl_message_to_op: rid=001 be_modify ou=Trinity64.ub2.cae.local,ou=SystemStatus,o=caesar (65) According to post: http://www.openldap.org/lists/openldap-bugs/200608/msg00044.html "But eventually the entry should get replicated, and the consumer should replace everything with the correct objectclasses. I guess there's a possibility that we're not setting the right flags to allow the consumer to change the entry's structuralObjectClass." there has been a possible problem here. Is this fixed? Version is 2.4.30, Berkeley DB 5.1 using hdb and OS is Windows. If I should post my config please tell me, but I posted it in different threads before and I also don't think the config is the problem here, since it sometimes works. Regards, Frank

1 0

AD proxy in OpenLDAP
by Chris O'Kelly 03 Apr '12

03 Apr '12

Hi guys, Posted a while back but didn't get far, just trying again to see if I can get this working. We have AD on our DC server, working fine, and a list of external clients in OpenLDAP, also working fine. We have a new web service that needs to authenticate against only one DSA, so I need to have the OpenLDAP DSA proxy to AD. The initial setup in OpenLDAP is - dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulepath: /usr/lib/ldap olcModuleload: back_hdb olcModuleload: back_ldap dn: olcDatabase=hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcSuffix: dc=companyname,dc=local olcDbDirectory: /var/lib/ldap olcRootDN: cn=admin,dc=companyname,dc=local olcRootPW: secret olcDbConfig: set_cachesize 0 2097152 0 olcDbConfig: set_lk_max_objects 1500 olcDbConfig: set_lk_max_locks 1500 olcDbConfig: set_lk_max_lockers 1500 olcDbIndex: objectClass eq olcLastMod: TRUE olcDbCheckpoint: 512 30 olcAccess: to attrs=userPassword by dn="cn=admin,dc=companyname,dc=local" write by anonymous auth by self write by * none olcAccess: to attrs=shadowLastChange by self write by * read olcAccess: to dn.base="" by * read olcAccess: to * by dn="cn=admin,dc=companyname,dc=local" write by * read the ldap backend I have added with ldapadd is - olcDatabase: ldap olcSuffix: dc=internal,dc=companyname,dc=local olcDbDirectory: /var/lib/ldap uri: ldap://companyname.local acl-bind: bindmethod=simple binddn="CN=proxy,OU=Service Accounts,OU=Users,OU=MyBusiness,DC=companyname,DC=local" credentials=secret. When I attempt to search on dc=companyname,dc=local I get results. When I attempt to search AD directly from the server running OpenLDAP I get results. However if I search dc=internal,dc=companyname,dc=local pointed at OpenLDAP I get No Such Object (32). I believe this could be related to one of two things, however I have been unable to find the fix (I have read the slapd, slapd-ldap, slapd-relay, slapd-pbind manpages, as well as numerous tutorials). I believe it is either that I am missing the schema files for AD or that I am incorrect in putting the LDAP backend in a seperate dc (internal). On AD the base suffix is also just dc=companyname, dc=local, I put the LDAP backend in this suffix as the rest of the directory is already in dc=companyname,dc=local in OpenLDAP and I wished for it to be separate, I don't know if this has caused the issue. As for the scema files, I used Apache directory studio to export the cn=schema branch from AD into an LDIF file and attempted to add it using ldapadd, the result was adding new entry "CN=Schema,CN=Configuration,DC=companyname,DC=local" ldap_add: Undefined attribute type (17) additional info: instanceType: attribute type undefined I have been trying to figure out this issue for weeks and I am at my wits end. I am seriously at the point of contemplating trying to find someone I can pay to show me the fix.

3 2

groups added to provider not replicating to consumer
by btb＠bitrate.net 03 Apr '12

03 Apr '12

hi- i've recently set up delta-syncrepl, with one provider and one consumer. things seemed to be generally working, but i recently noticed that member attributes in group entries were not getting replicated. after a bit of testing, i also found that new groups added to the provider appear to not be replicated to the consumer. it also appears that the operation of adding a group is not being written to the accesslog. on a possibly related note, i'm using the memberof overlay, and the memberof attribute modifications which occur as a result of adding a group are written to the accesslog, and are replicated to the consumer. i'm using 2.4.25, courtesy of ubuntu 11.10. what can i do to better understand what is happening, and why? below is some preliminary data, and log entries using olcloglevel: any thanks -ben >cat add_group.ldif dn: cn=test_group,ou=general,ou=groups,dc=example,dc=net changetype: add objectClass: top objectClass: groupOfNames description: test group cn: test_group member: uid=dummy_default,ou=dummy_accounts,ou=other,ou=accounts,dc=example,dc=net >ldapadd -xZZD 'uid=dit_admin,ou=role_accounts,ou=accounts,dc=example,dc=net' -w 'xxxxxxxxxxxx' -f add_group.ldif adding new entry "cn=test_group,ou=general,ou=groups,dc=example,dc=net" subsequent ldapsearch on provider: >ldapsearch -xLLLZZD 'uid=dit_admin,ou=role_accounts,ou=accounts,dc=example,dc=net' -w 'xxxxxxxxxxxx' -b 'cn=test_group,ou=general,ou=groups,dc=example,dc=net' -s base '*' '+' dn: cn=test_group,ou=general,ou=groups,dc=example,dc=net objectClass: top objectClass: groupOfNames description: test group cn: test_group member: uid=dummy_default,ou=dummy_accounts,ou=other,ou=accounts,dc=example, dc=net structuralObjectClass: groupOfNames entryUUID: d68c73e4-10c1-1031-8246-9dfa8daa46e0 creatorsName: uid=dit_admin,ou=role_accounts,ou=accounts,dc=example,dc=net createTimestamp: 20120402034404Z entryCSN: 20120402034404.808333Z#000000#000#000000 modifiersName: uid=dit_admin,ou=role_accounts,ou=accounts,dc=example,dc=net modifyTimestamp: 20120402034404Z entryDN: cn=test_group,ou=general,ou=groups,dc=example,dc=net subschemaSubentry: cn=Subschema hasSubordinates: FALSE subsequent ldapsearch on consumer: >ldapsearch -xLLLZZD 'uid=dit_admin,ou=role_accounts,ou=accounts,dc=example,dc=net' -w 'xxxxxxxxxxxx' -b 'cn=test_group,ou=general,ou=groups,dc=example,dc=net' -s base '*' '+' No such object (32) Matched DN: ou=general,ou=groups,dc=example,dc=net provider log entries: Apr 1 23:44:04 flip slapd[9255]: daemon: activity on 1 descriptor Apr 1 23:44:04 flip slapd[9255]: daemon: activity on: Apr 1 23:44:04 flip slapd[9255]: Apr 1 23:44:04 flip slapd[9255]: slap_listener_activate(8): Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=8 busy Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=9 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=10 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=11 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: >>> slap_listener(ldap:///) Apr 1 23:44:04 flip slapd[9255]: daemon: listen=8, new connection on 54 Apr 1 23:44:04 flip slapd[9255]: daemon: added 54r (active) listener=(nil) Apr 1 23:44:04 flip slapd[9255]: conn=1378 fd=54 ACCEPT from IP=192.168.1.1:47610 (IP=0.0.0.0:389) Apr 1 23:44:04 flip slapd[9255]: daemon: activity on 2 descriptors Apr 1 23:44:04 flip slapd[9255]: daemon: activity on: Apr 1 23:44:04 flip slapd[9255]: 54r Apr 1 23:44:04 flip slapd[9255]: Apr 1 23:44:04 flip slapd[9255]: daemon: read active on 54 Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=8 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=9 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=10 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=11 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: connection_get(54) Apr 1 23:44:04 flip slapd[9255]: connection_get(54): got connid=1378 Apr 1 23:44:04 flip slapd[9255]: connection_read(54): checking for input on id=1378 Apr 1 23:44:04 flip slapd[9255]: op tag 0x77, time 1333338244 Apr 1 23:44:04 flip slapd[9255]: daemon: activity on 1 descriptor Apr 1 23:44:04 flip slapd[9255]: daemon: activity on: Apr 1 23:44:04 flip slapd[9255]: Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=8 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=9 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=10 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=11 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: conn=1378 op=0 do_extended Apr 1 23:44:04 flip slapd[9255]: conn=1378 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Apr 1 23:44:04 flip slapd[9255]: do_extended: oid=1.3.6.1.4.1.1466.20037 Apr 1 23:44:04 flip slapd[9255]: conn=1378 op=0 STARTTLS Apr 1 23:44:04 flip slapd[9255]: send_ldap_extended: err=0 oid= len=0 Apr 1 23:44:04 flip slapd[9255]: send_ldap_response: msgid=1 tag=120 err=0 Apr 1 23:44:04 flip slapd[9255]: conn=1378 op=0 RESULT oid= err=0 text= Apr 1 23:44:04 flip slapd[9255]: daemon: activity on 1 descriptor Apr 1 23:44:04 flip slapd[9255]: daemon: activity on: Apr 1 23:44:04 flip slapd[9255]: 54r Apr 1 23:44:04 flip slapd[9255]: Apr 1 23:44:04 flip slapd[9255]: daemon: read active on 54 Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=8 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=9 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=10 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=11 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: connection_get(54) Apr 1 23:44:04 flip slapd[9255]: connection_get(54): got connid=1378 Apr 1 23:44:04 flip slapd[9255]: connection_read(54): checking for input on id=1378 Apr 1 23:44:04 flip slapd[9255]: daemon: activity on 1 descriptor Apr 1 23:44:04 flip slapd[9255]: daemon: activity on: Apr 1 23:44:04 flip slapd[9255]: Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=8 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=9 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=10 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=11 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: daemon: activity on 1 descriptor Apr 1 23:44:04 flip slapd[9255]: daemon: activity on: Apr 1 23:44:04 flip slapd[9255]: 54r Apr 1 23:44:04 flip slapd[9255]: Apr 1 23:44:04 flip slapd[9255]: daemon: read active on 54 Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=8 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=9 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: connection_get(54) Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=10 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: connection_get(54): got connid=1378 Apr 1 23:44:04 flip slapd[9255]: connection_read(54): checking for input on id=1378 Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=11 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: daemon: activity on 1 descriptor Apr 1 23:44:04 flip slapd[9255]: daemon: activity on: Apr 1 23:44:04 flip slapd[9255]: Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=8 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=9 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=10 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=11 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: daemon: activity on 1 descriptor Apr 1 23:44:04 flip slapd[9255]: daemon: activity on: Apr 1 23:44:04 flip slapd[9255]: 54r Apr 1 23:44:04 flip slapd[9255]: Apr 1 23:44:04 flip slapd[9255]: daemon: read active on 54 Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=8 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=9 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=10 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=11 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: connection_get(54) Apr 1 23:44:04 flip slapd[9255]: connection_get(54): got connid=1378 Apr 1 23:44:04 flip slapd[9255]: connection_read(54): checking for input on id=1378 Apr 1 23:44:04 flip slapd[9255]: connection_read(54): unable to get TLS client DN, error=49 id=1378 Apr 1 23:44:04 flip slapd[9255]: conn=1378 fd=54 TLS established tls_ssf=128 ssf=128 Apr 1 23:44:04 flip slapd[9255]: daemon: activity on 1 descriptor Apr 1 23:44:04 flip slapd[9255]: daemon: activity on: Apr 1 23:44:04 flip slapd[9255]: Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=8 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=9 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=10 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=11 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: daemon: activity on 1 descriptor Apr 1 23:44:04 flip slapd[9255]: daemon: activity on: Apr 1 23:44:04 flip slapd[9255]: 54r Apr 1 23:44:04 flip slapd[9255]: Apr 1 23:44:04 flip slapd[9255]: daemon: read active on 54 Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=8 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=9 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=10 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=11 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: connection_get(54) Apr 1 23:44:04 flip slapd[9255]: connection_get(54): got connid=1378 Apr 1 23:44:04 flip slapd[9255]: connection_read(54): checking for input on id=1378 Apr 1 23:44:04 flip slapd[9255]: op tag 0x60, time 1333338244 Apr 1 23:44:04 flip slapd[9255]: conn=1378 op=1 do_bind Apr 1 23:44:04 flip slapd[9255]: >>> dnPrettyNormal: <uid=dit_admin,ou=role_accounts,ou=accounts,dc=example,dc=net> Apr 1 23:44:04 flip slapd[9255]: <<< dnPrettyNormal: <uid=dit_admin,ou=role_accounts,ou=accounts,dc=example,dc=net>, <uid=dit_admin,ou=role_accounts,ou=accounts,dc=example,dc=net> Apr 1 23:44:04 flip slapd[9255]: conn=1378 op=1 BIND dn="uid=dit_admin,ou=role_accounts,ou=accounts,dc=example,dc=net" method=128 Apr 1 23:44:04 flip slapd[9255]: do_bind: version=3 dn="uid=dit_admin,ou=role_accounts,ou=accounts,dc=example,dc=net" method=128 Apr 1 23:44:04 flip slapd[9255]: ==> hdb_bind: dn: uid=dit_admin,ou=role_accounts,ou=accounts,dc=example,dc=net Apr 1 23:44:04 flip slapd[9255]: bdb_dn2entry("uid=dit_admin,ou=role_accounts,ou=accounts,dc=example,dc=net") Apr 1 23:44:04 flip slapd[9255]: => access_allowed: result not in cache (userPassword) Apr 1 23:44:04 flip slapd[9255]: => access_allowed: auth access to "uid=dit_admin,ou=role_accounts,ou=accounts,dc=example,dc=net" "userPassword" requested Apr 1 23:44:04 flip slapd[9255]: => acl_get: [1] attr userPassword Apr 1 23:44:04 flip slapd[9255]: => acl_mask: access to entry "uid=dit_admin,ou=role_accounts,ou=accounts,dc=example,dc=net", attr "userPassword" requested Apr 1 23:44:04 flip slapd[9255]: => acl_mask: to value by "", (=0) Apr 1 23:44:04 flip slapd[9255]: <= check a_dn_pat: anonymous Apr 1 23:44:04 flip slapd[9255]: <= acl_mask: [1] applying auth(=xd) (stop) Apr 1 23:44:04 flip slapd[9255]: <= acl_mask: [1] mask: auth(=xd) Apr 1 23:44:04 flip slapd[9255]: => slap_access_allowed: auth access granted by auth(=xd) Apr 1 23:44:04 flip slapd[9255]: => access_allowed: auth access granted by auth(=xd) Apr 1 23:44:04 flip slapd[9255]: conn=1378 op=1 BIND dn="uid=dit_admin,ou=role_accounts,ou=accounts,dc=example,dc=net" mech=SIMPLE ssf=0 Apr 1 23:44:04 flip slapd[9255]: do_bind: v3 bind: "uid=dit_admin,ou=role_accounts,ou=accounts,dc=example,dc=net" to "uid=dit_admin,ou=role_accounts,ou=accounts,dc=example,dc=net" Apr 1 23:44:04 flip slapd[9255]: send_ldap_result: conn=1378 op=1 p=3 Apr 1 23:44:04 flip slapd[9255]: send_ldap_result: err=0 matched="" text="" Apr 1 23:44:04 flip slapd[9255]: send_ldap_response: msgid=2 tag=97 err=0 Apr 1 23:44:04 flip slapd[9255]: daemon: activity on 1 descriptor Apr 1 23:44:04 flip slapd[9255]: daemon: activity on: Apr 1 23:44:04 flip slapd[9255]: Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=8 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=9 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=10 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=11 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: daemon: activity on 1 descriptor Apr 1 23:44:04 flip slapd[9255]: daemon: activity on: Apr 1 23:44:04 flip slapd[9255]: 54r Apr 1 23:44:04 flip slapd[9255]: Apr 1 23:44:04 flip slapd[9255]: daemon: read active on 54 Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=8 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=9 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=10 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: daemon: epoll: listen=11 active_threads=0 tvp=zero Apr 1 23:44:04 flip slapd[9255]: connection_get(54) Apr 1 23:44:04 flip slapd[9255]: conn=1378 op=1 RESULT tag=97 err=0 text= Apr 1 23:44:04 flip slapd[9255]: connection_get(54): got connid=1378 Apr 1 23:44:04 flip slapd[9255]: connection_read(54): checking for input on id=1378 Apr 1 23:44:04 flip slapd[9255]: op tag 0x68, time 1333338244 Apr 1 23:44:04 flip slapd[9255]: conn=1378 op=2 do_add Apr 1 23:44:04 flip slapd[9255]: conn=1378 op=2 do_add: dn (cn=test_group,ou=general,ou=groups,dc=example,dc=net) Apr 1 23:44:04 flip slapd[9255]: >>> dnPrettyNormal: <cn=test_group,ou=general,ou=groups,dc=example,dc=net> Apr 1 23:44:04 flip slapd[9255]: <<< dnPrettyNormal: <cn=test_group,ou=general,ou=groups,dc=example,dc=net>, <cn=test_group,ou=general,ou=groups,dc=example,dc=net> Apr 1 23:44:04 flip slapd[9255]: conn=1378 op=2 ADD dn="cn=test_group,ou=general,ou=groups,dc=example,dc=net" Apr 1 23:44:04 flip slapd[9255]: >>> dnPretty: <uid=dummy_default,ou=dummy_accounts,ou=other,ou=accounts,dc=example,dc=net> Apr 1 23:44:04 flip slapd[9255]: <<< dnPretty: <uid=dummy_default,ou=dummy_accounts,ou=other,ou=accounts,dc=example,dc=net> Apr 1 23:44:04 flip slapd[9255]: >>> dnNormalize: <uid=dummy_default,ou=dummy_accounts,ou=other,ou=accounts,dc=example,dc=net> Apr 1 23:44:04 flip slapd[9255]: <<< dnNormalize: <uid=dummy_default,ou=dummy_accounts,ou=other,ou=accounts,dc=example,dc=net> Apr 1 23:44:04 flip slapd[9255]: bdb_dn2entry("cn=test_group,ou=general,ou=groups,dc=example,dc=net") Apr 1 23:44:04 flip slapd[9255]: => hdb_dn2id("cn=test_group,ou=general,ou=groups,dc=example,dc=net") Apr 1 23:44:04 flip slapd[9255]: <= hdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30988) Apr 1 23:44:04 flip slapd[9255]: hdb_referrals: tag=104 target="cn=test_group,ou=general,ou=groups,dc=example,dc=net" matched="ou=general,ou=groups,dc=example,dc=net" Apr 1 23:44:04 flip slapd[9255]: ==> unique_add <cn=test_group,ou=general,ou=groups,dc=example,dc=net> Apr 1 23:44:04 flip slapd[9255]: ==> hdb_add: cn=test_group,ou=general,ou=groups,dc=example,dc=net Apr 1 23:44:04 flip slapd[9255]: oc_check_required entry (cn=test_group,ou=general,ou=groups,dc=example,dc=net), objectClass "groupOfNames" Apr 1 23:44:04 flip slapd[9255]: oc_check_allowed type "objectClass" Apr 1 23:44:04 flip slapd[9255]: oc_check_allowed type "description" Apr 1 23:44:04 flip slapd[9255]: oc_check_allowed type "cn" Apr 1 23:44:04 flip slapd[9255]: oc_check_allowed type "member" Apr 1 23:44:04 flip slapd[9255]: oc_check_allowed type "structuralObjectClass" Apr 1 23:44:04 flip slapd[9255]: slap_queue_csn: queing 0xb2fcd8ce 20120402034404.808333Z#000000#000#000000 Apr 1 23:44:04 flip slapd[9255]: bdb_dn2entry("cn=test_group,ou=general,ou=groups,dc=example,dc=net") Apr 1 23:44:04 flip slapd[9255]: => hdb_dn2id("cn=test_group,ou=general,ou=groups,dc=example,dc=net") Apr 1 23:44:04 flip slapd[9255]: <= hdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30988) Apr 1 23:44:04 flip slapd[9255]: => access_allowed: add access to "ou=general,ou=groups,dc=example,dc=net" "children" requested Apr 1 23:44:04 flip slapd[9255]: <= root access granted Apr 1 23:44:04 flip slapd[9255]: => access_allowed: add access granted by manage(=mwrscxd) Apr 1 23:44:04 flip slapd[9255]: => access_allowed: add access to "cn=test_group,ou=general,ou=groups,dc=example,dc=net" "entry" requested Apr 1 23:44:04 flip slapd[9255]: <= root access granted Apr 1 23:44:04 flip slapd[9255]: => access_allowed: add access granted by manage(=mwrscxd) Apr 1 23:44:04 flip slapd[9255]: => hdb_dn2id_add 0xe8: "cn=test_group,ou=general,ou=groups,dc=example,dc=net" Apr 1 23:44:04 flip slapd[9255]: <= hdb_dn2id_add 0xe8: 0 Apr 1 23:44:04 flip slapd[9255]: => index_entry_add( 232, "cn=test_group,ou=general,ou=groups,dc=example,dc=net" ) Apr 1 23:44:04 flip slapd[9255]: => key_change(ADD,e8) Apr 1 23:44:04 flip slapd[9255]: bdb_idl_insert_key: e8 [0096defd] Apr 1 23:44:04 flip slapd[9255]: <= key_change 0 Apr 1 23:44:04 flip slapd[9255]: => key_change(ADD,e8) Apr 1 23:44:04 flip slapd[9255]: bdb_idl_insert_key: e8 [c14a3e76] Apr 1 23:44:04 flip slapd[9255]: <= key_change 0 Apr 1 23:44:04 flip slapd[9255]: => key_change(ADD,e8) Apr 1 23:44:04 flip slapd[9255]: bdb_idl_insert_key: e8 [943e86da] Apr 1 23:44:04 flip slapd[9255]: <= key_change 0 Apr 1 23:44:04 flip slapd[9255]: => key_change(ADD,e8) Apr 1 23:44:04 flip slapd[9255]: bdb_idl_insert_key: e8 [c866ab14] Apr 1 23:44:04 flip slapd[9255]: <= key_change 0 consumer log entries: Apr 1 23:44:04 exo slapd[8007]: daemon: activity on 1 descriptor Apr 1 23:44:04 exo slapd[8007]: daemon: activity on: Apr 1 23:44:04 exo slapd[8007]: 12r Apr 1 23:44:04 exo slapd[8007]: Apr 1 23:44:04 exo slapd[8007]: daemon: read active on 12 Apr 1 23:44:04 exo slapd[8007]: daemon: epoll: listen=8 active_threads=0 tvp=NULL Apr 1 23:44:04 exo slapd[8007]: daemon: epoll: listen=9 active_threads=0 tvp=NULL Apr 1 23:44:04 exo slapd[8007]: connection_get(12) Apr 1 23:44:04 exo slapd[8007]: connection_get(12): got connid=0 Apr 1 23:44:04 exo slapd[8007]: =>do_syncrepl rid=000 Apr 1 23:44:04 exo slapd[8007]: =>do_syncrep2 rid=000 Apr 1 23:44:04 exo slapd[8007]: do_syncrep2: rid=000 cookie=rid=000,csn=20120402034404.869559Z#000000#000#000000 Apr 1 23:44:04 exo slapd[8007]: >>> dnPrettyNormal: <uid=dummy_default,ou=dummy_accounts,ou=other,ou=accounts,dc=example,dc=net> Apr 1 23:44:04 exo slapd[8007]: <<< dnPrettyNormal: <uid=dummy_default,ou=dummy_accounts,ou=other,ou=accounts,dc=example,dc=net>, <uid=dummy_default,ou=dummy_accounts,ou=other,ou=accounts,dc=example,dc=net> Apr 1 23:44:04 exo slapd[8007]: slap_queue_csn: queing 0x7f6bd2694710 20120402034404.869559Z#000000#000#000000 Apr 1 23:44:04 exo slapd[8007]: >>> dnPretty: <cn=test_group,ou=general,ou=groups,dc=example,dc=net> Apr 1 23:44:04 exo slapd[8007]: <<< dnPretty: <cn=test_group,ou=general,ou=groups,dc=example,dc=net> Apr 1 23:44:04 exo slapd[8007]: >>> dnNormalize: <cn=test_group,ou=general,ou=groups,dc=example,dc=net> Apr 1 23:44:04 exo slapd[8007]: <<< dnNormalize: <cn=test_group,ou=general,ou=groups,dc=example,dc=net> Apr 1 23:44:04 exo slapd[8007]: >>> dnPretty: <uid=dit_admin,ou=role_accounts,ou=accounts,dc=example,dc=net> Apr 1 23:44:04 exo slapd[8007]: <<< dnPretty: <uid=dit_admin,ou=role_accounts,ou=accounts,dc=example,dc=net> Apr 1 23:44:04 exo slapd[8007]: >>> dnNormalize: <uid=dit_admin,ou=role_accounts,ou=accounts,dc=example,dc=net> Apr 1 23:44:04 exo slapd[8007]: <<< dnNormalize: <uid=dit_admin,ou=role_accounts,ou=accounts,dc=example,dc=net> Apr 1 23:44:04 exo slapd[8007]: => bdb_entry_get: ndn: "uid=dummy_default,ou=dummy_accounts,ou=other,ou=accounts,dc=example,dc=net" Apr 1 23:44:04 exo slapd[8007]: => bdb_entry_get: oc: "(null)", at: "(null)" Apr 1 23:44:04 exo slapd[8007]: bdb_dn2entry("uid=dummy_default,ou=dummy_accounts,ou=other,ou=accounts,dc=example,dc=net") Apr 1 23:44:04 exo slapd[8007]: => bdb_entry_get: found entry: "uid=dummy_default,ou=dummy_accounts,ou=other,ou=accounts,dc=example,dc=net" Apr 1 23:44:04 exo slapd[8007]: bdb_entry_get: rc=0 Apr 1 23:44:04 exo slapd[8007]: hdb_modify: uid=dummy_default,ou=dummy_accounts,ou=other,ou=accounts,dc=example,dc=net Apr 1 23:44:04 exo slapd[8007]: bdb_dn2entry("uid=dummy_default,ou=dummy_accounts,ou=other,ou=accounts,dc=example,dc=net") Apr 1 23:44:04 exo slapd[8007]: bdb_modify_internal: 0x0000001a: uid=dummy_default,ou=dummy_accounts,ou=other,ou=accounts,dc=example,dc=net Apr 1 23:44:04 exo slapd[8007]: <= acl_access_allowed: granted to database root Apr 1 23:44:04 exo slapd[8007]: bdb_modify_internal: add memberOf Apr 1 23:44:04 exo slapd[8007]: dnMatch 17#012#011"cn=dummy_default,ou=dummy_groups,ou=other,ou=groups,dc=example,dc=net"#012#011"cn=test_group,ou=general,ou=groups,dc=example,dc=net" Apr 1 23:44:04 exo slapd[8007]: dnMatch -19#012#011"cn=all_people,ou=general,ou=groups,dc=example,dc=net"#012#011"cn=test_group,ou=general,ou=groups,dc=example,dc=net" Apr 1 23:44:04 exo slapd[8007]: dnMatch 2#012#011"cn=docs,ou=flip,ou=servers,ou=groups,dc=example,dc=net"#012#011"cn=test_group,ou=general,ou=groups,dc=example,dc=net" Apr 1 23:44:04 exo slapd[8007]: dnMatch 5#012#011"cn=monitor,ou=flip,ou=servers,ou=groups,dc=example,dc=net"#012#011"cn=test_group,ou=general,ou=groups,dc=example,dc=net" Apr 1 23:44:04 exo slapd[8007]: dnMatch 5#012#011"cn=systems,ou=flip,ou=servers,ou=groups,dc=example,dc=net"#012#011"cn=test_group,ou=general,ou=groups,dc=example,dc=net" Apr 1 23:44:04 exo slapd[8007]: dnMatch 14#012#011"cn=mail_submitters-non_auth,ou=general,ou=groups,dc=example,dc=net"#012#011"cn=test_group,ou=general,ou=groups,dc=example,dc=net" Apr 1 23:44:04 exo slapd[8007]: bdb_modify_internal: replace modifiersName Apr 1 23:44:04 exo slapd[8007]: bdb_modify_internal: replace entryCSN Apr 1 23:44:04 exo slapd[8007]: bdb_modify_internal: replace modifyTimestamp Apr 1 23:44:04 exo slapd[8007]: oc_check_required entry (uid=dummy_default,ou=dummy_accounts,ou=other,ou=accounts,dc=example,dc=net), objectClass "inetOrgPerson" Apr 1 23:44:04 exo slapd[8007]: oc_check_allowed type "uid" Apr 1 23:44:04 exo slapd[8007]: oc_check_allowed type "objectClass" Apr 1 23:44:04 exo slapd[8007]: oc_check_allowed type "sn" Apr 1 23:44:04 exo slapd[8007]: oc_check_allowed type "cn" Apr 1 23:44:04 exo slapd[8007]: oc_check_allowed type "structuralObjectClass" Apr 1 23:44:04 exo slapd[8007]: oc_check_allowed type "entryUUID" Apr 1 23:44:04 exo slapd[8007]: oc_check_allowed type "creatorsName" Apr 1 23:44:04 exo slapd[8007]: oc_check_allowed type "createTimestamp" Apr 1 23:44:04 exo slapd[8007]: oc_check_allowed type "memberOf" Apr 1 23:44:04 exo slapd[8007]: oc_check_allowed type "modifiersName" Apr 1 23:44:04 exo slapd[8007]: oc_check_allowed type "entryCSN" Apr 1 23:44:04 exo slapd[8007]: oc_check_allowed type "modifyTimestamp" Apr 1 23:44:04 exo slapd[8007]: => key_change(DELETE,1a) Apr 1 23:44:04 exo slapd[8007]: bdb_idl_delete_key: 1a Apr 1 23:44:04 exo slapd[8007]: <= key_change 0 Apr 1 23:44:04 exo slapd[8007]: => key_change(ADD,1a) Apr 1 23:44:04 exo slapd[8007]: bdb_idl_insert_key: 1a [768b75dc] Apr 1 23:44:04 exo slapd[8007]: <= key_change 0 Apr 1 23:44:04 exo slapd[8007]: => key_change(ADD,1a) Apr 1 23:44:04 exo slapd[8007]: bdb_idl_insert_key: 1a [7f0c99d1] Apr 1 23:44:04 exo slapd[8007]: <= key_change 0 Apr 1 23:44:04 exo slapd[8007]: => key_change(ADD,1a) Apr 1 23:44:04 exo slapd[8007]: bdb_idl_insert_key: 1a [0f345f5f] Apr 1 23:44:04 exo slapd[8007]: <= key_change 0 Apr 1 23:44:04 exo slapd[8007]: => key_change(ADD,1a) Apr 1 23:44:04 exo slapd[8007]: bdb_idl_insert_key: 1a [86c8d479] Apr 1 23:44:04 exo slapd[8007]: <= key_change 0 Apr 1 23:44:04 exo slapd[8007]: => key_change(ADD,1a) Apr 1 23:44:04 exo slapd[8007]: bdb_idl_insert_key: 1a [da3d54f3] Apr 1 23:44:04 exo slapd[8007]: <= key_change 0 Apr 1 23:44:04 exo slapd[8007]: => key_change(ADD,1a) Apr 1 23:44:04 exo slapd[8007]: bdb_idl_insert_key: 1a [8d6b497f] Apr 1 23:44:04 exo slapd[8007]: <= key_change 0 Apr 1 23:44:04 exo slapd[8007]: => key_change(ADD,1a) Apr 1 23:44:04 exo slapd[8007]: bdb_idl_insert_key: 1a [144a6a9d] Apr 1 23:44:04 exo slapd[8007]: <= key_change 0 Apr 1 23:44:04 exo slapd[8007]: => key_change(ADD,1a) Apr 1 23:44:04 exo slapd[8007]: bdb_idl_insert_key: 1a Apr 1 23:44:04 exo slapd[8007]: <= key_change 0 Apr 1 23:44:04 exo slapd[8007]: => entry_encode(0x0000001a): Apr 1 23:44:04 exo slapd[8007]: <= entry_encode(0x0000001a): Apr 1 23:44:04 exo slapd[8007]: hdb_modify: updated id=0000001a dn="uid=dummy_default,ou=dummy_accounts,ou=other,ou=accounts,dc=example,dc=net" Apr 1 23:44:04 exo slapd[8007]: send_ldap_result: conn=-1 op=0 p=0 Apr 1 23:44:04 exo slapd[8007]: send_ldap_result: err=0 matched="" text="" Apr 1 23:44:04 exo slapd[8007]: slap_graduate_commit_csn: removing 0x7f6bd267ec10 20120402034404.869559Z#000000#000#000000 Apr 1 23:44:04 exo slapd[8007]: syncrepl_message_to_op: rid=000 be_modify uid=dummy_default,ou=dummy_accounts,ou=other,ou=accounts,dc=example,dc=net (0) Apr 1 23:44:04 exo slapd[8007]: slap_queue_csn: queing 0x7f6bd268f8c0 20120402034404.869559Z#000000#000#000000 Apr 1 23:44:04 exo slapd[8007]: => bdb_entry_get: ndn: "dc=example,dc=net" Apr 1 23:44:04 exo slapd[8007]: => bdb_entry_get: oc: "(null)", at: "(null)" Apr 1 23:44:04 exo slapd[8007]: bdb_dn2entry("dc=example,dc=net") Apr 1 23:44:04 exo slapd[8007]: => bdb_entry_get: found entry: "dc=example,dc=net" Apr 1 23:44:04 exo slapd[8007]: bdb_entry_get: rc=0 Apr 1 23:44:04 exo slapd[8007]: hdb_modify: dc=example,dc=net Apr 1 23:44:04 exo slapd[8007]: bdb_dn2entry("dc=example,dc=net") Apr 1 23:44:04 exo slapd[8007]: bdb_modify_internal: 0x00000001: dc=example,dc=net Apr 1 23:44:04 exo slapd[8007]: <= acl_access_allowed: granted to database root Apr 1 23:44:04 exo slapd[8007]: bdb_modify_internal: replace contextCSN Apr 1 23:44:04 exo slapd[8007]: oc_check_required entry (dc=example,dc=net), objectClass "organization" Apr 1 23:44:04 exo slapd[8007]: oc_check_required entry (dc=example,dc=net), objectClass "dcObject" Apr 1 23:44:04 exo slapd[8007]: oc_check_allowed type "dc" Apr 1 23:44:04 exo slapd[8007]: oc_check_allowed type "objectClass" Apr 1 23:44:04 exo slapd[8007]: oc_check_allowed type "o" Apr 1 23:44:04 exo slapd[8007]: oc_check_allowed type "structuralObjectClass" Apr 1 23:44:04 exo slapd[8007]: oc_check_allowed type "entryUUID" Apr 1 23:44:04 exo slapd[8007]: oc_check_allowed type "creatorsName" Apr 1 23:44:04 exo slapd[8007]: oc_check_allowed type "createTimestamp" Apr 1 23:44:04 exo slapd[8007]: oc_check_allowed type "l" Apr 1 23:44:04 exo slapd[8007]: oc_check_allowed type "st" Apr 1 23:44:04 exo slapd[8007]: oc_check_allowed type "postalCode" Apr 1 23:44:04 exo slapd[8007]: oc_check_allowed type "entryCSN" Apr 1 23:44:04 exo slapd[8007]: oc_check_allowed type "modifiersName" Apr 1 23:44:04 exo slapd[8007]: oc_check_allowed type "modifyTimestamp" Apr 1 23:44:04 exo slapd[8007]: oc_check_allowed type "contextCSN" Apr 1 23:44:04 exo slapd[8007]: => entry_encode(0x00000001): Apr 1 23:44:04 exo slapd[8007]: <= entry_encode(0x00000001): Apr 1 23:44:04 exo slapd[8007]: hdb_modify: updated id=00000001 dn="dc=example,dc=net" Apr 1 23:44:04 exo slapd[8007]: send_ldap_result: conn=-1 op=0 p=0 Apr 1 23:44:04 exo slapd[8007]: send_ldap_result: err=0 matched="" text="" Apr 1 23:44:04 exo slapd[8007]: slap_graduate_commit_csn: removing 0x7f6bd2674970 20120402034404.869559Z#000000#000#000000 Apr 1 23:44:04 exo slapd[8007]: daemon: activity on 1 descriptor Apr 1 23:44:04 exo slapd[8007]: daemon: activity on: Apr 1 23:44:04 exo slapd[8007]: Apr 1 23:44:04 exo slapd[8007]: daemon: epoll: listen=8 active_threads=0 tvp=NULL Apr 1 23:44:04 exo slapd[8007]: daemon: epoll: listen=9 active_threads=0 tvp=NULL

3 3

RE: Solaris client configuration
by Juergen.Sprenger＠swisscom.com 02 Apr '12

02 Apr '12

Hi Sara, what You listed is just a part of which has to be done to get a Solaris client authenticated against an OpenLDAP server. Recommended steps: - upgrade to OpenLDAP 2.4.30 - upgrade and patch Solaris. You didn't mention the release level of Your Solaris box, and there are quite some patches out which affect Solaris LDAP client. Consult file /etc/release on that box. - beside output of 'ldapclient list' have a look at config files /etc/nsswitch.conf and /etc/pam.conf - use more than just one LDAP server in production. - check Your setup by running ldaplist, getent passwd and getent group - don't edit files in /var/ldap manually, use ldapclient - get access to a Solaris person at Your site. - use duaconfig profiles in Your LDAP server to provide standard configs. - get proper set up certificates with X509v3 Subject Alternative Names. Solaris client will need that. - check first whether client is working properly without tls to detect a certificate issue. - sample output of 'ldapclient list': NS_LDAP_FILE_VERSION= 2.0 NS_LDAP_BINDDN= cn=ourAgent,dc=ourdomain,dc=com NS_LDAP_BINDPASSWD= ={NS1}ourpassword NS_LDAP_SERVERS= oly-infra-ldap1.ourdomain.com, oly-infra-ldap2.ourdomain.com, oly-infra-ldap3.ourdomain.com, oly-infra-ldap4.ourdomain.com NS_LDAP_SEARCH_BASEDN= dc=ourdomain,dc=com NS_LDAP_AUTH= tls:simple NS_LDAP_SEARCH_REF= TRUE NS_LDAP_SEARCH_SCOPE= one NS_LDAP_SEARCH_TIME= 30 NS_LDAP_CACHETTL= 0 NS_LDAP_PROFILE= default NS_LDAP_CREDENTIAL_LEVEL= proxy NS_LDAP_SERVICE_SEARCH_DESC= sudoers: ou=sudoers,dc=ourdomain,dc=com?one NS_LDAP_SERVICE_SEARCH_DESC= passwd: ou=Account,dc=ourdomain,dc=com?one NS_LDAP_SERVICE_SEARCH_DESC= shadow: ou=Account,dc=ourdomain,dc=com?one NS_LDAP_SERVICE_SEARCH_DESC= group: ou=group,dc=ourdomain,dc=com?one NS_LDAP_SERVICE_SEARCH_DESC= netgroup: ou=netgroup,dc=ourdomain,dc=com?one NS_LDAP_BIND_TIME= 2 - Ymmv depending on Your environment. Not all arising questions will fit into this mailing list. Regards Juergen Sprenger -----Original Message----- Message: 2 Date: Thu, 29 Mar 2012 10:55:10 -0700 From: "Kline, Sara" <SKline(a)tnsi.com> To: "openldap-technical(a)openldap.org" <openldap-technical(a)openldap.org> Subject: Solaris client configuration Message-ID: <C0C9408742654B429ECD3D1FF11A118D16EB097A0D(a)TNS-MAIL-NA1.win2k.corp.tnsi.com> Content-Type: text/plain; charset="us-ascii" Hey all, I am trying to get a Solaris 10 client to authenticate to our OpenLDAP (2.3.43) server, which was built on Red Hat 5.7. Linux clients (RHEL 4,5 and 6, and Oracle 5.7) authenticate without issue. I think it may be a simple misconfiguration but I am really not a Solaris person at all. Would someone be willing to send an ldapclient list to me? I would really appreciate it. Steps I have taken: 1. Imported the SSL cert according to Oracle's instructions 2. Made the 3 files cert8, keys3, and secmod readable to everyone with chmod 444 My current ldapclient list looks like this: LDAP_CLIENT_FILE_VERSION= 2.0 NS_LDAP_BINDDN= cn=admin,dc=prod,dc=ourdomain,dc=com NS_LDAP_BINDPASSWD={NS1}ourpassword NS_LDAP_SERVERS=oly-infra-ldap1 (this is how the name appears on the cert, it is in the hosts file) NS_LDAP_SEARCH_BASEDN=dc=prod,dc=ourdomain,dc=com NS_LDAP_AUTH=tls:simple NS_LDAP_CACHETTL=0 NS_LDAP_CREDENTIAL_LEVEL=proxy NS_LDAP_SERVICE_AUTH_METHOD=pam_ldap:tls:simple NS_LDAP_HOST_CERTPATH=/var/ldap Any help would be greatly appreciated. Sara Kline System Administrator Transaction Network Services, Inc 4501 Intelco Loop, Lacey WA 98503 Wk: (360) 493-6736 Cell: (360) 280-2495

1 0

LDAP transactions
by Chris Card 02 Apr '12

02 Apr '12

Hi all, what is the current state of the support for LDAP transactions (http://tools.ietf.org/html/rfc5805) in openldap? I can see code for it, protected by #ifdef LDAP_X_TXN, but it looks like it hasn't been touched for several years. Does the code work? Is anyone actively working on it? If not, are there any plans to in the future? Chris

1 0

problem with ldap backend
by Alex Samad - Yieldbroker 01 Apr '12

01 Apr '12

Hi I am trying to setup a connection from openldap to MS AD I am using this dn: olcDatabase={3}ldap objectClass: olcDatabaseConfig objectClass: olcLDAPConfig olcDatabase: {3}ldap olcSuffix: dc=xyz,dc=com olcAccess: {0}to dn.base="" by * read olcAccess: {1}to dn.base="cn=Subschema" by * read olcAccess: {2}to * by self write by users read by anonymous auth olcReadOnly: TRUE olcRootDN: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth olcSizeLimit: 500 olcDbURI: "ldap://dc101. xyz.com ldap://dc201. xyz.com" olcDbRebindAsUser: TRUE olcDbChaseReferrals: TRUE This works fine when I pass a bind DN. I would like to convert this to allow anon access to ldap, which does a user bind to MS AD so I added this olcdbaclbind: bindmethod=simple binddn="CN=ad readonly,OU= xyz,DC= xyz,DC=com" credentials="secret" starttls=no but it is not working, I can not make a anon search request, they retrieve any thing frome the MSAD ldap server. Thanks

2 4

REL_ENG versions produce different libraries?
by Nick Milas 01 Apr '12

01 Apr '12

Hi, I noticed that in an installation of openldap-ltb 2.4.30 the libraries are in the form: "libldap-2.4.so.2" etc. However, in an installation of a pre-30 (e.g. openldap-OPENLDAP_REL_ENG_2_4-eb3ea42.tar.gz with LTB 2.4.28 src.rpm on Centos 5.7 64bit) I see that libraries are in the form: "libldap-2.4-releng.so.2" etc. I guess these differences between the (names of the) libraries of the official release and the REL_ENG are intentional. (Probably to emphasize the fact that the package is not final.) ***The Question***: What should we change so as to build the package as a normal (i.e. non-test) package? This will allow better compatibility on the system (where the package is tested), because packages built with ldap lib dependencies expect the same ldap lib names (liblber-2.4.so.2 and libldap-2.4.so.2). I would expect some "test" parameter in build/version.var, but I didn't see any. An easy solution could be to edit build/version.sh to remove "-releng", but I don't think this is the best approach. Please advise. Thanks, Nick

4 6

Solaris client configuration
by Kline, Sara 29 Mar '12

29 Mar '12

Hey all, I am trying to get a Solaris 10 client to authenticate to our OpenLDAP (2.3.43) server, which was built on Red Hat 5.7. Linux clients (RHEL 4,5 and 6, and Oracle 5.7) authenticate without issue. I think it may be a simple misconfiguration but I am really not a Solaris person at all. Would someone be willing to send an ldapclient list to me? I would really appreciate it. Steps I have taken: 1. Imported the SSL cert according to Oracle's instructions 2. Made the 3 files cert8, keys3, and secmod readable to everyone with chmod 444 My current ldapclient list looks like this: LDAP_CLIENT_FILE_VERSION= 2.0 NS_LDAP_BINDDN= cn=admin,dc=prod,dc=ourdomain,dc=com NS_LDAP_BINDPASSWD={NS1}ourpassword NS_LDAP_SERVERS=oly-infra-ldap1 (this is how the name appears on the cert, it is in the hosts file) NS_LDAP_SEARCH_BASEDN=dc=prod,dc=ourdomain,dc=com NS_LDAP_AUTH=tls:simple NS_LDAP_CACHETTL=0 NS_LDAP_CREDENTIAL_LEVEL=proxy NS_LDAP_SERVICE_AUTH_METHOD=pam_ldap:tls:simple NS_LDAP_HOST_CERTPATH=/var/ldap Any help would be greatly appreciated. Sara Kline System Administrator Transaction Network Services, Inc 4501 Intelco Loop, Lacey WA 98503 Wk: (360) 493-6736 Cell: (360) 280-2495 ________________________________ This e-mail message is for the sole use of the intended recipient(s)and may contain confidential and privileged information of Transaction Network Services. Any unauthorised review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

2 1

OpenLDAP integration with RSA Authentication Manager
by Michael Ströder 29 Mar '12

29 Mar '12

HI! We're trying to configure RSA Authentication Manager 7.1 (SecurID) to access an OpenLDAP server which is unfortunately not officially supported by this product. We chose SunONE DS as "identity source type" but it seems this brain-dead component checks something in rootDSE to determine whether it's the "right" type of LDAP server. Not sure what it expects. Before asking the RSA support and just receive a dumb "not supported": Anyone here having experience with this combination? Some insights what it expects in rootDSE? (I'd fake the expected attribute values with rootDSE <file>). Ciao, Michael.

1 0

help with openldap-2.4.29-sasl-2.1.25 bind problems
by luxInteg 29 Mar '12

29 Mar '12

Greetings, i am new to this list. I have a computer with these:- cpu: amd64 2 cores os linux 64bit distro=cblfs kernel-3.2.1, gcc-4.5.2 auth progs: MIT-kerberos-1.10, sasl-2.1.25. openldap-2.4.29 ( I have an inhouse CA and generated a signed Certicate/Key pair on this machine running openssl-0.9.8 I transferred these and the cacert.pem file securely to the machine above and these are included in the slapd.conf file ) I verified ldap is running without sasl with the ldapsearch command like so:- ldapsearch -xWLLL "ou=people" -H ldaps://tester.example.com When I tried the same command for a sasl bind:- ldappsearch -LLL "ou=people" -H ldaps://tester.example.com I get this ################################################### SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: SASL(-13): authentication failure: GSSAPI Failure: gss_accept_sec_context ################################################### (For debugging ) I did the same with the -d -1 switch ldappsearch -LLL -d -1 "ou=people" -H ldaps://tester.example.com and excerpts from the output are below:- ###################################################### ldap_url_parse_ext(ldaps://tester.example.com) ldap_create ldap_url_parse_ext(ldaps://tester.example.com:636/??base) ldap_sasl_interactive_bind: user selected: GSSAPI ldap_int_sasl_bind: GSSAPI ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP tester.example.com:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 10.10.10.10:636 ldap_pvt_connect: fd: 3 tm: -1 async: 0 TLS trace: SSL_connect:before/connect initialization tls_write: want=211, written=211 0000: 16 03 01 00 ce 01 00 00 ca 03 01 4f 52 8f 3c 49 ...........OR.<I 0010: ca 19 83 08 c8 85 c3 00 94 20 0b 48 32 1a c1 40 ......... .H2..@ -------------- TLS trace: SSL_connect:SSLv2/v3 write client hello A tls_read: want=7, got=7 ------------- -------------- TLS trace: SSL_connect:SSLv3 read server hello A tls_read: want=5, got=5 0000: 16 03 01 06 5b -------------- -------------- TLS trace: SSL_connect:SSLv3 read server certificate A tls_read: want=5, got=5 0000: 16 03 01 00 8d ..... tls_read: want=141, got=141 -------------- TLS trace: SSL_connect:SSLv3 read server certificate request A TLS trace: SSL_connect:SSLv3 read server done A TLS trace: SSL_connect:SSLv3 write client certificate A TLS trace: SSL_connect:SSLv3 write client key exchange A TLS trace: SSL_connect:SSLv3 write change cipher spec A TLS trace: SSL_connect:SSLv3 write finished A tls_write: want=210, written=210 -------------- TLS trace: SSL_connect:SSLv3 flush data tls_read: want=5, got=5 0000: 16 03 01 00 ba ..... tls_read: want=186, got=186 ------------------ -------------- TLS trace: SSL_connect:SSLv3 read server session ticket A tls_read: want=5, got=5 0000: 14 03 01 00 01 ..... tls_read: want=1, got=1 0000: 01 . tls_read: want=5, got=5 0000: 16 03 01 00 30 ....0 tls_read: want=48, got=48 -------------- TLS trace: SSL_connect:SSLv3 read finished A ldap_int_sasl_open: host=tester.example.com SASL/GSSAPI authentication started ldap_sasl_bind ldap_send_initial_request ldap_send_server_request ber_scanf fmt ({it) ber: ber_dump: buf=0x20ebed0 ptr=0x20ebed0 end=0x20ec16a len=666 -------------- ldap_msgfree ldap_result ld 0x2018010 msgid 1 wait4msg ld 0x2018010 msgid 1 (infinite timeout) wait4msg continue ld 0x2018010 msgid 1 all 1 ** ld 0x2018010 Connections: * host: tester.example.com port: 636 (default) refcnt: 2 status: Connected last used: Sat Mar 3 21:38:04 2012 ** ld 0x2018010 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x2018010 request count 1 (abandoned 0) ** ld 0x2018010 Response Queue: Empty ld 0x2018010 response count 0 ldap_chkResponseList ld 0x2018010 msgid 1 all 1 ldap_chkResponseList returns ld 0x2018010 NULL ldap_int_select read1msg: ld 0x2018010 msgid 1 all 1 ber_get_next tls_read: want=5, got=5 0000: 17 03 01 00 20 .... tls_read: want=32, got=32 -------------- tls_read: want=5, got=5 0000: 17 03 01 00 70 ....p tls_read: want=112, got=112 -------------- ldap_read: want=79, got=79 0000: 01 31 04 00 04 49 53 41 53 4c 28 2d 31 33 29 3a .1...ISASL(-13): 0010: 20 61 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 authentication 0020: 66 61 69 6c 75 72 65 3a 20 47 53 53 41 50 49 20 failure: GSSAPI 0030: 46 61 69 6c 75 72 65 3a 20 67 73 73 5f 61 63 63 Failure: gss_acc 0040: 65 70 74 5f 73 65 63 5f 63 6f 6e 74 65 78 74 ept_sec_context ber_get_next: tag 0x30 len 85 contents: -------------- read1msg: ld 0x2018010 0 new referrals read1msg: mark request completed, ld 0x2018010 msgid 1 request done: ld 0x2018010 msgid 1 res_errno: 49, res_error: <SASL(-13): authentication failure: GSSAPI Failure: gss_accept_sec_context>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_int_sasl_bind: <null> ldap_parse_sasl_bind_result ber_scanf fmt ({eAA) ber: ber_dump: buf=0x20eb750 ptr=0x20eb753 end=0x20eb7a5 len=82 -------------- ######################################################################### advice would be appreciated sincerely lux-integ

3 4

Help with password policy
by Gabriella Turek 29 Mar '12

29 Mar '12

Setup: OpenLDAP 2.4 SUSE SLES11, chaining (read only) to an AD directory I've set up a simple default pwd policy and configured it in slapd.conf: - Included the schema /etc/openldap/schema/ppolicy.schema - Under my db configuration added the entries overlay ppolicy ppolicy_default "cn=default,ou=pwpolicies,dc=niwa,dc=local" - The policy is simply: dn: cn=default,ou=pwpolicies,dc=example,dc=com cn: default ….. pwdMinLength: 8 pwdAllowUserChange: TRUE But when I run tests with too short a password the password still gets changed. No error messages. One thing I am confused about is that the documentation says to include the moduleload directive in slapd.con but I can't find any modules, the directory where they are supposed to be is empty. slapd –VVV indicates that it includes the static overlay. Any help is highly appreciated, I am quite a newby at this. Gaby -- Dr Gabriella Turek Sr. Software Engineer, Systems Development Team NIWA Auckland, New Zealand Tel: +64 9 3754645 www.niwa.co.nz NIWA - Enhancing the benefit of New Zealand’s natural resources. -- Please consider the environment before printing this email. NIWA is the trading name of the National Institute of Water & Atmospheric Research Ltd.

3 2

Can dynlist query from database hdb access entries in a database ldap on the same slapd?
by Judd Maltin 28 Mar '12

28 Mar '12

START slapd.conf: overlay dynlist dynlist-attrset myGroupOfURLs myMemberURL # happy.net: I can query through this proxy just fine. database ldap suffix "dc=happy,dc=net" uri "ldap://ldap1.lga6.us.happy.net" acl-bind bindmethod=simple binddn="cn=replicant,ou=Service Accounts,dc=happy,dc=net" credentials=my!!replicant # happy.com: the following database has dc=happy,dc=com data in it already. database hdb suffix "" rootdn "cn=Manager,dc=happy,dc=com" rootpw secret directory /var/lib/ldap index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub # indexes for replication index entryCSN,entryUUID eq overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 200 END slapd.conf START good dynlist entry dn: cn=admin2,ou=Groups,dc=happy,dc=com objectClass: posixGroup objectClass: top objectClass: myGroupOfURLs cn: admin2 gidNumber: 20005 myMemberURL: ldap:///cn=sysadmins,ou=Groups,dc=happy,dc=com?memberUID?base?(objectClass=posixGroup) works great and populates my memberUID just great. END good dynlist entry START bad dynlist entry dn: cn=admin2,ou=Groups,dc=happy,dc=com objectClass: posixGroup objectClass: top objectClass: myGroupOfURLs cn: admin2 gidNumber: 20005 myMemberURL: ldap:///cn=sysadmins,ou=Groups,dc=happy,dc=net?memberUID?base?(objectClass=posixGroup) FAILS no entries in memeberUID - it a naming context mixup because "suffix ''" above? -- Judd Maltin T: 917-882-1270 F: 501-694-7809 A loving heart is never wrong.

3 3

Not deleted in Syncrepl
by s_hira＠nifty.com 28 Mar '12

28 Mar '12

Hi, All I confirmed the problem that was not deleted in syncrepl of V2.4.30. The provider operates it in "syncprov-sessionlog 100". After I delete 150 in a provider, and going syncrepl Only 100 cases are deleted in the consumer side. After examining it, the following parts seem to have a problem. servers/slapd/overlays/syncprov.c:2638 if ( sl->sl_num > 0 ) { int i; for ( i=0; i<sl->sl_numcsns; i++ ) { /* SID not present == new enough */ if ( minsid < sl->sl_sids[i] ) { do_play = 1; break; } /* SID present and new enough */ if ( minsid == sl->sl_sids[i] && ber_bvcmp( &mincsn, &sl->sl_mincsn[i] ) >= 0 ) { do_play = 1; break; } } /* SID not present == new enough */ if ( i == sl->sl_numcsns ) do_play = 1; } if ( do_play ) { do_present = 0; /* mutex is unlocked in playlog */ syncprov_playlog( op, rs, sl, srs, ctxcsn, numcsns, sids ); } else { ldap_pvt_thread_mutex_unlock( &sl->sl_mutex ); } Then, it corrected as follows. === - if ( minsid == sl->sl_sids[i] - && ber_bvcmp( &mincsn, &sl->sl_mincsn[i] ) >= 0 ) { + if ( minsid == sl->sl_sids[i] ) { + if ( ber_bvcmp( &mincsn, &sl->sl_mincsn[i] ) >= 0 ) { do_play = 1; + } break; } Is this correction wrong? HIRABAYASHI Satoshi s_hira(a)nifty.com

2 1

How to bind ldap2.4 with user certificate ?
by Olivier 27 Mar '12

27 Mar '12

Hello, is there any way to bind an ldap server using user certificates rather than user/password ? I have experimented that using "bindmethod=sasl" and "saslmech=external" "tls_cacert=CAFILE" and "tls_cert=PROXYUSERFILE" in olcSyncRepl section, but I would like to also be able to bind ldap with a personnal certificate rather than with a "user/passwd" when using ldapsearch for example. How should I configure my "ldap.conf" and call "ldapsearch" to bind as such ? Thanks --- Olivier

2 1

Cannot convert slapd.conf with blanks in pathes
by frank.offermanns＠caseris.de 27 Mar '12

27 Mar '12

slaptest has problems with blanks in pathes: slapd.conf extraction: logfile "C:/temp/Blank Dir/log/slapd.log" ... directory "C:/temp/Blank Dir/accessdata" slaptest -f "C:\temp\Blank Dir\slapd.conf" -F "C:\temp\Blank Dir\slapd.d" will succeed when a blank is in the path of "logfile" or "directory" but when I start slapd I get a "<olcLogFile> extra cruft after <file>". When I remove the quotation marks slaptest fails with the message "<logfile> extra cruft after <file>". I can only fix this by manually editing the config.ldif-files, which I know is forbidden. But due to the fact that I can't start slapd I can't use ldapmodify to modify it. So what to do? I tested with windows version of OpenLDAP. Regards, Frank

1 0

client ldap with 2 ldap.conf
by stefano 27 Mar '12

27 Mar '12

hi, a second question. i installed ldap-auth-config on a client. i've seen that i have /etc/ldap.conf and also /etc/ldap/ldap.conf which one is available? how could i understand which is in use?

2 1

clients: libnss-ldapd or libnss-ldap?
by stefano 27 Mar '12

27 Mar '12

hi, am installing ldap clients. the server is squeeze so i used libnss-ldapd. what about ubuntu 9.10-10-10 clients? libnss-ldap or libnss-ldapd?

2 2

Re: can't modify or add uidNumber attribute
by stefano 27 Mar '12

27 Mar '12

On 03/27/2012 09:34 AM, Hallvard B Furuseth wrote: > On Tue, 27 Mar 2012 09:10:17 +0200, stefano <stefano.malini(a)gmail.com> > wrote: >> On 03/27/2012 08:13 AM, Hallvard B Furuseth wrote: I wrote: >> Have you done something as root, so root owns some of the >> database files but you try to run slapd as another user (with -u)? >> If so, fix the file permsisions and then avoid working as root. >> >> Sorry, I mean file ownerships. Though it could be file or >> directory permissions too, come to think of it. >> >> thanks, but, which permissions of which file do i have to check? > > The directory and contentes named by the 'directory' > directive(s) in slapd.conf, aka olcDbDirectory in cn=config. > these are the permissions of 'directory' /var/lib/ldap/ drwxr-xr-x 2 openldap openldap 4096 Mar 27 07:58 ldap must be writable by users also? i mean rwxrwxr-x? and its contents is: root@amahoro:/var/lib/ldap# ls -l total 11448 -rw-r--r-- 1 openldap openldap 4096 Mar 27 07:58 alock -rw------- 1 root root 24576 Mar 26 16:08 __db.001 -rw------- 1 root root 352256 Mar 26 16:08 __db.002 -rw------- 1 root root 2629632 Mar 26 16:08 __db.003 -rw------- 1 root root 163840 Mar 26 16:07 __db.004 -rw------- 1 root root 876544 Mar 26 16:08 __db.005 -rw------- 1 root root 32768 Mar 26 16:08 __db.006 -rw-r--r-- 1 openldap openldap 96 Mar 23 08:24 DB_CONFIG -rw------- 1 openldap openldap 8192 Mar 26 16:07 dn2id.bdb -rw------- 1 openldap openldap 32768 Mar 26 15:14 id2entry.bdb -rw------- 1 openldap openldap 10485760 Mar 26 16:07 log.0000000001 -rw------- 1 root root 8192 Mar 26 16:07 objectClass.bdb

2 1

Re: can't modify or add uidNumber attribute
by stefano 27 Mar '12

27 Mar '12

The situationis worsethan expected the situation is worse. now, trying to run an ldapsearch i have the message "can't contact LDAP server". on syslog the last lines are: Mar 26 16:11:33 amahoro slapd[1603]: @(#) $OpenLDAP: slapd 2.4.23 (Jun 16 2011 02:53:39) $#012#011buildd@murphy:/build/buildd-openldap_2.4.23-7.2-i386-Y1mwvF/openldap-2.4.23/debian/build/servers/slapd Mar 26 16:11:33 amahoro slapd[1604]: hdb_db_open: database "dc=amahoro,dc=bi" cannot be opened, err 13. Restore from backup! Mar 26 16:11:33 amahoro slapd[1604]: bdb(dc=amahoro,dc=bi): txn_checkpoint interface requires an environment configured for the transaction subsystem Mar 26 16:11:33 amahoro slapd[1604]: bdb_db_close: database "dc=amahoro,dc=bi": txn_checkpoint failed: Invalid argument (22). Mar 26 16:11:33 amahoro slapd[1604]: backend_startup_one (type=hdb, suffix="dc=amahoro,dc=bi"): bi_db_open failed! (13) Mar 26 16:11:33 amahoro slapd[1604]: bdb_db_close: database "dc=amahoro,dc=bi": alock_close failed Mar 26 16:11:33 amahoro slapd[1604]: slapd stopped. what's happens? -------- Original Message -------- Subject: can't modify or add uidNumber attribute Date: Mon, 26 Mar 2012 16:21:17 +0200 From: stefano <stefano.malini(a)gmail.com> To: openldap-technical(a)openldap.org hi, i was modifying uidNumber attribute of a user but then has been standing for a few minutes and I stopped it: root@amahoro:~# ldapmodify -x -W -D 'cn=Manager,dc=amahoro,dc=bi' Enter LDAP Password: dn: uid=stefano,cn=Admins,dc=amahoro,dc=bi changetype: modify replace: uidNumber uidNumber: 1001 modifying entry "uid=stefano,cn=Admins,dc=amahoro,dc=bi" . . . ctrl+c then with an ldapsearch for this user there was not the uidNumber attribute: dn: uid=stefano,cn=Admins,dc=amahoro,dc=bi uid: stefano cn: Stefano Malini sn: Malini gidNumber: 1000 homeDirectory: /home/Admins/stefano mail: stefano.malini(a)gmail.com objectClass: inetOrgPerson objectClass: top objectClass: posixAccount objectClass: shadowAccount userPassword:: e1NTSEF9b2pNOG1UT3NrT2ZVaDVyd1pUWUpSeWg3YXNxc1lXSHo= uidNumber: 1001 trying to add it root@amahoro:~# ldapmodify -x -W -D 'cn=Manager,dc=amahoro,dc=bi' Enter LDAP Password: dn: uid=stefano,cn=Admins,dc=amahoro,dc=bi changetype: add add: uidNumber uidNumber: 1001 adding new entry "uid=stefano,cn=Admins,dc=amahoro,dc=bi" ldap_add: Undefined attribute type (17) additional info: add: attribute type undefined you can see the error message what is wrong?

2 2

idletimeout and writetimeout
by Tianyin Xu 27 Mar '12

27 Mar '12

Hi, Who can kindly tell me what are the two directives "idletimeout" and "writetimeout" used for? I do appreciate if someone can give me some sample examples. I set the values of the two configurations to be very small but no connections are terminated. :-( Thanks in advance! Tianyin -- Tianyin XU, http://cseweb.ucsd.edu/~tixu/

1 0

database cannot be opened
by stefano 26 Mar '12

26 Mar '12

hi, am working on my ldap server. it was ok until 2 hours ago but now, ldapsearch doesn't run. this is the output on syslog: @(#) $OpenLDAP: slapd 2.4.23 (Jun 16 2011 02:53:39) $#012#011buildd@murphy:/build/buildd-openldap_2.4.23-7.2-i386-Y1mwvF/openldap-2.4.23/debian/build/servers/slapd Mar 26 16:11:33 amahoro slapd[1604]: hdb_db_open: database "dc=amahoro,dc=bi" cannot be opened, err 13. Restore from backup! Mar 26 16:11:33 amahoro slapd[1604]: bdb(dc=amahoro,dc=bi): txn_checkpoint interface requires an environment configured for the transaction subsystem Mar 26 16:11:33 amahoro slapd[1604]: bdb_db_close: database "dc=amahoro,dc=bi": txn_checkpoint failed: Invalid argument (22). Mar 26 16:11:33 amahoro slapd[1604]: backend_startup_one (type=hdb, suffix="dc=amahoro,dc=bi"): bi_db_open failed! (13) Mar 26 16:11:33 amahoro slapd[1604]: bdb_db_close: database "dc=amahoro,dc=bi": alock_close failed Mar 26 16:11:33 amahoro slapd[1604]: slapd stopped. what is the problem?

2 1

can't modify or add uidNumber attribute
by stefano 26 Mar '12

26 Mar '12

hi, i was modifying uidNumber attribute of a user but then has been standing for a few minutes and I stopped it: root@amahoro:~# ldapmodify -x -W -D 'cn=Manager,dc=amahoro,dc=bi' Enter LDAP Password: dn: uid=stefano,cn=Admins,dc=amahoro,dc=bi changetype: modify replace: uidNumber uidNumber: 1001 modifying entry "uid=stefano,cn=Admins,dc=amahoro,dc=bi" . . . ctrl+c then with an ldapsearch for this user there was not the uidNumber attribute: dn: uid=stefano,cn=Admins,dc=amahoro,dc=bi uid: stefano cn: Stefano Malini sn: Malini gidNumber: 1000 homeDirectory: /home/Admins/stefano mail: stefano.malini(a)gmail.com objectClass: inetOrgPerson objectClass: top objectClass: posixAccount objectClass: shadowAccount userPassword:: e1NTSEF9b2pNOG1UT3NrT2ZVaDVyd1pUWUpSeWg3YXNxc1lXSHo= uidNumber: 1001 trying to add it root@amahoro:~# ldapmodify -x -W -D 'cn=Manager,dc=amahoro,dc=bi' Enter LDAP Password: dn: uid=stefano,cn=Admins,dc=amahoro,dc=bi changetype: add add: uidNumber uidNumber: 1001 adding new entry "uid=stefano,cn=Admins,dc=amahoro,dc=bi" ldap_add: Undefined attribute type (17) additional info: add: attribute type undefined you can see the error message what is wrong?

4 5

usage of slapadd with replication/option -w
by frank.offermanns＠caseris.de 26 Mar '12

26 Mar '12

Hi all, at the end of the thread "Re: delta-syncrepl and mirrormode problem (2.4.29 and 2.4.30)/ slapadd Usage" I already asked some questions. But probably due to the wrong threadname I got no answer. So here again with a clearer threadname: Multimaster only works when slapdadd for initial filling is used with -w Is this a bug or does it work as designed? If it works as designed maybe the manualpage for slapadd should be more clearly that when you work with replication you always have to use the -w option. Wouldn't it be helpfull if slapadd internally always use the -w option or are there cases in which this option could be harmfull? What happens if I use -w and have no replication configured? Regards, Frank

2 3

syncrepl and structuralObjectClass operational attribute
by Jehan PROCACCIA 26 Mar '12

26 Mar '12

Hello I installed a new openldap replica (openldap-servers-2.4.23-20.el6.i686) , with a partial replication enabled by restricting certain branches/attributes to the binddn account that replicate from the master. However, on some operation (modify userPassword for example) the modification fails: Mar 22 17:51:20 ldapz2 slapd[24456]: No structuralObjectClass for entry (uid=bde,ou=People,dc=int-evry,dc=fr) Mar 22 17:51:20 ldapz2 slapd[24456]: entry failed schema check: no structuralObjectClass operational attribute Mar 22 17:51:20 ldapz2 slapd[24456]: null_callback : error code 0x50 Mar 22 17:51:20 ldapz2 slapd[24456]: syncrepl_entry: rid=001 be_modify failed (80) Mar 22 17:51:20 ldapz2 slapd[24456]: do_syncrepl: rid=001 rc 80 retrying (9 retries left) what's wrong ? could it be related to the fact that the binddn account cannot read all attributes from the master ? I did checked that he can read userpassword attribute though . is there an ACL to be set to hte replica binddn account to allow him to read operational attributes ? thanks for your help.

3 3

Desperate JuniorAdmin needs help ASAP
by Imre Bertalan 26 Mar '12

26 Mar '12

Hello out there! I'm Imre from Hungary and I need some help with LDAP. My main problem is the time. I have 2 weeks to finish a project and a part of it is setting up an LDAP server. To be honest I'll be a big problem if anybody wishes to help me because there is quite a chaos on my head right now and I'm very desperate. I need someone who I can chat with and he/she can show me ( not just write ) how to manage an LDAP server and how to install the client. I wanted to use Webmin because it looks simple enough, but since I don't really getting the point I can't go onward. My suggestion is that someone enters my desktop ( with teamview-er optionally ) and shows me the method on a virtual computer. I would be very, very grateful for you guys. :( PLZ help a poor guy. Best Regards: Imre Bertalan

2 1

i don't find slapd.pid
by stefano 26 Mar '12

26 Mar '12

Hi, am creating a database ldap on squeeze. the configuration was ok. due to some errors adding new entries, following the guide "Mastering OpenLDAP", page 96, i deleted with this command: rm __db.* *.bdb log.* then i succesfully added two ldif files using slapdadd. i started slapd with /etc/init.d/slapd start. i launching ldapsearch but the answer ii can't contact the server. i checked with ps -aux about the slapd process but i didn't find it. i checked in /var/run/slapd/ and there is not slapd.pid. have you got idea about this? what could i do? thanks

3 3

Copying entries without access to all attributes
by Nick Milas 26 Mar '12

26 Mar '12

Hi, In case we have entries which include some (administrative) attributes not visible or writable by a number of our administrator accounts, is there a way to allow these administrator accounts to create new entries which will forcibly include the aforementioned attributes, e.g. by providing default values to them? Ideally, these default attribute values should be dependent on the logged-in user (administrator). {In practice, these admins will be using a GUI to copy existing entries to new ones; we want to make sure that any non-visible/non-writable attributes will also be copied.} Any hint regarding such an implementation would be appreciated. Of course, we could create a front-end application where such operations would be executed with elevated privileges so as to ensure writing of any required attributes, but it would be nice if this is possible without resorting to such a solution (by using standard openldap functionality). Thanks, Nick

1 1

Perl Programmable backend does not work
by Tianyin Xu 26 Mar '12

26 Mar '12

Hi, all, I wanna set "backend perl" in my OpenLDAP configuration. I used "--enable-perl" option to enable the perl programming backend. From the config.log, it seems everything is fine. I list all the perl-related entries in the config.log as below. I also attach my config.log in case you want to check it. --------------------------------------------------- configure:12106: checking for perl configure:12124: found /usr/bin/perl configure:12137: result: /usr/bin/perl ...... ac_cv_path_PERLBIN=/usr/bin/perl ..... PERLBIN='/usr/bin/perl' PERL_CPPFLAGS=' -D_REENTRANT -D_GNU_SOURCE -DDEBIAN -fno-strict-aliasing -pipe -fstack-protector -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/lib/perl/5.10/CORE ' ...... SLAPD_PERL_LDFLAGS='-Wl,-E -fstack-protector -L/usr/local/lib -L/usr/lib/perl/5.10/CORE -lperl -ldl -lm -lpthread -lcrypt' --------------------------------------------------- However, when I start the slapd, the server fails to start with the following message printed: Mar 26 00:37:32 tianyin-desktop slapd[11062]: /home/tianyin/openldap-2.4.30/etc/openldap/slapd.conf: line 103: <backend> failed init (perl)! I used GDB to trace the code and find the bomb point is in backend_info() as follows. slapd failed to find the corresponding backend information, and finally return NULL. BackendInfo* backend_info(const char *type) { BackendInfo *bi; /* search for the backend type */ => LDAP_STAILQ_FOREACH(bi,&backendInfo,bi_next) { if( strcasecmp(bi->bi_type, type) == 0 ) { return bi; } } return NULL; } The backtrace is: #0 backend_info (type=0x91fb88 "perl") at backend.c:533 #1 0x000000000041f627 in config_generic (c=0x9201f0) at bconfig.c:1502 #2 0x0000000000434674 in config_set_vals (Conf=0x81a460, c=0x9201f0) at config.c:345 #3 0x0000000000434bd3 in config_add_vals (Conf=0x81a460, c=0x9201f0) at config.c:418 #4 0x0000000000435e27 in read_config_file (fname=0x5a5c40 "/home/tianyin/openldap-2.4.30/etc/openldap/slapd.conf", depth=0, cf=0x0, cft=0x81a1a0) at config.c:783 #5 0x00000000004290de in read_config (fname=0x0, dir=0x0) at bconfig.c:4213 #6 0x000000000041ccf7 in main (argc=1, argv=0x7fffffffe2f8) at main.c:792 Does anyone use the perl programmable backend before? Thanks in advance! Tianyin -- Tianyin XU, http://cseweb.ucsd.edu/~tixu/

1 0

GSSAPI (SASL) + LDAP
by Daniel Savard 25 Mar '12

25 Mar '12

Hi everyone, I am trying to implement Kerberos authentication and I believe I am almost there, however when I run the ldapwhoami command I am getting a segmentation fault rather than a success message. Here is the output of the ldapwhoami (yes, I have a Kerberos ticket): SASL/GSSAPI authentication started SASL username: dsavard(a)CIDS.CA SASL SSF: 56 SASL data security layer installed. dn:cn=daniel savard,dc=cids,dc=ca Segmentation fault The cn is properly mapped. When switching debug on I am getting the following messages and the only thing I find as a potential indication of my problem is this message (res_errno: 14, res_error: <SASL(0): successful result: security flags do not match required>, res_matched: <>) however I am not able to decipher what it means exactly: ldap_create ldap_pvt_sasl_getmech ldap_search put_filter: "(objectclass=*)" put_filter: simple put_simple_filter: "objectclass=*" ldap_build_search_req ATTRS: supportedSASLMechanisms ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_path ldap_new_socket: 4 ldap_connect_to_path: Trying /var/run/openldap/slapd.sock ldap_connect_timeout: fd: 4 tm: -1 async: 0 ldap_ndelay_on: 4 ldap_ndelay_off: 4 ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_dump: buf=0x8058928 ptr=0x8058928 end=0x8058968 len=64 0000: 30 3e 02 01 01 63 39 04 00 0a 01 00 0a 01 00 02 0>...c9......... 0010: 01 00 02 01 02 01 01 00 87 0b 6f 62 6a 65 63 74 ..........object 0020: 63 6c 61 73 73 30 19 04 17 73 75 70 70 6f 72 74 class0...support 0030: 65 64 53 41 53 4c 4d 65 63 68 61 6e 69 73 6d 73 edSASLMechanisms ber_scanf fmt ({) ber: ber_dump: buf=0x8058928 ptr=0x805892d end=0x8058968 len=59 0000: 63 39 04 00 0a 01 00 0a 01 00 02 01 00 02 01 02 c9.............. 0010: 01 01 00 87 0b 6f 62 6a 65 63 74 63 6c 61 73 73 .....objectclass 0020: 30 19 04 17 73 75 70 70 6f 72 74 65 64 53 41 53 0...supportedSAS 0030: 4c 4d 65 63 68 61 6e 69 73 6d 73 LMechanisms ber_flush2: 64 bytes to sd 4 0000: 30 3e 02 01 01 63 39 04 00 0a 01 00 0a 01 00 02 0>...c9......... 0010: 01 00 02 01 02 01 01 00 87 0b 6f 62 6a 65 63 74 ..........object 0020: 63 6c 61 73 73 30 19 04 17 73 75 70 70 6f 72 74 class0...support 0030: 65 64 53 41 53 4c 4d 65 63 68 61 6e 69 73 6d 73 edSASLMechanisms ldap_write: want=64, written=64 0000: 30 3e 02 01 01 63 39 04 00 0a 01 00 0a 01 00 02 0>...c9......... 0010: 01 00 02 01 02 01 01 00 87 0b 6f 62 6a 65 63 74 ..........object 0020: 63 6c 61 73 73 30 19 04 17 73 75 70 70 6f 72 74 class0...support 0030: 65 64 53 41 53 4c 4d 65 63 68 61 6e 69 73 6d 73 edSASLMechanisms ldap_result ld 0x8058520 msgid 1 wait4msg ld 0x8058520 msgid 1 (infinite timeout) wait4msg continue ld 0x8058520 msgid 1 all 1 ** ld 0x8058520 Connections: * host: (null) port: 0 (default) refcnt: 2 status: Connected last used: Thu Feb 9 15:30:01 2012 ** ld 0x8058520 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x8058520 request count 1 (abandoned 0) ** ld 0x8058520 Response Queue: Empty ld 0x8058520 response count 0 ldap_chkResponseList ld 0x8058520 msgid 1 all 1 ldap_chkResponseList returns ld 0x8058520 NULL ldap_int_select read1msg: ld 0x8058520 msgid 1 all 1 ber_get_next ldap_read: want=8, got=8 0000: 30 62 02 01 01 64 5d 04 0b...d]. ldap_read: want=92, got=92 0000: 00 30 59 30 57 04 17 73 75 70 70 6f 72 74 65 64 .0Y0W..supported 0010: 53 41 53 4c 4d 65 63 68 61 6e 69 73 6d 73 31 3c SASLMechanisms1< 0020: 04 05 50 4c 41 49 4e 04 04 4e 54 4c 4d 04 05 4c ..PLAIN..NTLM..L 0030: 4f 47 49 4e 04 06 47 53 53 41 50 49 04 0a 44 49 OGIN..GSSAPI..DI 0040: 47 45 53 54 2d 4d 44 35 04 08 43 52 41 4d 2d 4d GEST-MD5..CRAM-M 0050: 44 35 04 08 45 58 54 45 52 4e 41 4c D5..EXTERNAL ber_get_next: tag 0x30 len 98 contents: ber_dump: buf=0x8059a58 ptr=0x8059a58 end=0x8059aba len=98 0000: 02 01 01 64 5d 04 00 30 59 30 57 04 17 73 75 70 ...d]..0Y0W..sup 0010: 70 6f 72 74 65 64 53 41 53 4c 4d 65 63 68 61 6e portedSASLMechan 0020: 69 73 6d 73 31 3c 04 05 50 4c 41 49 4e 04 04 4e isms1<..PLAIN..N 0030: 54 4c 4d 04 05 4c 4f 47 49 4e 04 06 47 53 53 41 TLM..LOGIN..GSSA 0040: 50 49 04 0a 44 49 47 45 53 54 2d 4d 44 35 04 08 PI..DIGEST-MD5.. 0050: 43 52 41 4d 2d 4d 44 35 04 08 45 58 54 45 52 4e CRAM-MD5..EXTERN 0060: 41 4c AL read1msg: ld 0x8058520 msgid 1 message type search-entry wait4msg continue ld 0x8058520 msgid 1 all 1 ** ld 0x8058520 Connections: * host: (null) port: 0 (default) refcnt: 2 status: Connected last used: Thu Feb 9 15:30:01 2012 ** ld 0x8058520 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x8058520 request count 1 (abandoned 0) ** ld 0x8058520 Response Queue: * msgid 1, type 100 ld 0x8058520 response count 1 ldap_chkResponseList ld 0x8058520 msgid 1 all 1 ldap_chkResponseList returns ld 0x8058520 NULL ldap_int_select read1msg: ld 0x8058520 msgid 1 all 1 ber_get_next ldap_read: want=8, got=8 0000: 30 0c 02 01 01 65 07 0a 0....e.. ldap_read: want=6, got=6 0000: 01 00 04 00 04 00 ...... ber_get_next: tag 0x30 len 12 contents: ber_dump: buf=0x8059b10 ptr=0x8059b10 end=0x8059b1c len=12 0000: 02 01 01 65 07 0a 01 00 04 00 04 00 ...e........ read1msg: ld 0x8058520 msgid 1 message type search-result ber_scanf fmt ({eAA) ber: ber_dump: buf=0x8059b10 ptr=0x8059b13 end=0x8059b1c len=9 0000: 65 07 0a 01 00 04 00 04 00 e........ read1msg: ld 0x8058520 0 new referrals read1msg: mark request completed, ld 0x8058520 msgid 1 request done: ld 0x8058520 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) adding response ld 0x8058520 msgid 1 type 101: ldap_parse_result ber_scanf fmt ({iAA) ber: ber_dump: buf=0x8059b10 ptr=0x8059b13 end=0x8059b1c len=9 0000: 65 07 0a 01 00 04 00 04 00 e........ ber_scanf fmt (}) ber: ber_dump: buf=0x8059b10 ptr=0x8059b1c end=0x8059b1c len=0 ldap_get_values ber_scanf fmt ({x{{a) ber: ber_dump: buf=0x8059a58 ptr=0x8059a5b end=0x8059aba len=95 0000: 64 5d 04 00 30 59 30 57 04 17 73 75 70 70 6f 72 d]..0Y0W..suppor 0010: 74 65 64 53 41 53 4c 4d 65 63 68 61 6e 69 73 6d tedSASLMechanism 0020: 73 31 3c 04 05 50 4c 41 49 4e 04 04 4e 54 4c 4d s1<..PLAIN..NTLM 0030: 04 05 4c 4f 47 49 4e 04 06 47 53 53 41 50 49 04 ..LOGIN..GSSAPI. 0040: 0a 44 49 47 45 53 54 2d 4d 44 35 04 08 43 52 41 .DIGEST-MD5..CRA 0050: 4d 2d 4d 44 35 04 08 45 58 54 45 52 4e 41 4c M-MD5..EXTERNAL ber_scanf fmt ([v]) ber: ber_dump: buf=0x8059a58 ptr=0x8059a7c end=0x8059aba len=62 0000: 31 3c 04 05 50 4c 41 49 4e 04 04 4e 54 4c 4d 04 1<..PLAIN..NTLM. 0010: 05 4c 4f 47 49 4e 04 06 47 53 53 41 50 49 04 0a .LOGIN..GSSAPI.. 0020: 44 49 47 45 53 54 2d 4d 44 35 04 08 43 52 41 4d DIGEST-MD5..CRAM 0030: 2d 4d 44 35 04 08 45 58 54 45 52 4e 41 4c -MD5..EXTERNAL ldap_msgfree ldap_sasl_interactive_bind: server supports: PLAIN NTLM LOGIN GSSAPI DIGEST-MD5 CRAM-MD5 EXTERNAL ldap_int_sasl_bind: PLAIN NTLM LOGIN GSSAPI DIGEST-MD5 CRAM-MD5 EXTERNAL ldap_int_sasl_open: host=charpak.cids.ca SASL/GSSAPI authentication started ldap_sasl_bind ldap_send_initial_request ldap_send_server_request ber_scanf fmt ({it) ber: ber_dump: buf=0x80671b0 ptr=0x80671b0 end=0x8067429 len=633 0000: 30 82 02 75 02 01 02 60 82 02 6e 02 01 03 04 00 0..u...`..n..... 0010: a3 82 02 65 04 06 47 53 53 41 50 49 04 82 02 59 ...e..GSSAPI...Y 0020: 60 82 02 55 06 09 2a 86 48 86 f7 12 01 02 02 01 `..U..*.H....... 0030: 00 6e 82 02 44 30 82 02 40 a0 03 02 01 05 a1 03 .n..D0..@....... 0040: 02 01 0e a2 07 03 05 00 20 00 00 00 a3 82 01 5a ........ ......Z 0050: 61 82 01 56 30 82 01 52 a0 03 02 01 05 a1 09 1b a..V0..R........ 0060: 07 43 49 44 53 2e 43 41 a2 22 30 20 a0 03 02 01 .CIDS.CA."0 .... 0070: 03 a1 19 30 17 1b 04 6c 64 61 70 1b 0f 63 68 61 ...0...ldap..cha 0080: 72 70 61 6b 2e 63 69 64 73 2e 63 61 a3 82 01 1a rpak.cids.ca.... 0090: 30 82 01 16 a0 03 02 01 12 a1 03 02 01 07 a2 82 0............... 00a0: 01 08 04 82 01 04 46 c7 d2 fb b5 63 13 9d ce 54 ......F....c...T 00b0: a8 bc 61 02 7c 9b a4 4a b5 e4 97 5d 04 6d 68 26 ..a.|..J...].mh& 00c0: e3 1a 4c 34 2d d5 ac 13 1d ee a4 24 53 2b 27 d8 ..L4-......$S+'. 00d0: 5e 3a 72 f3 7d 38 09 8b 0b b0 10 3a 84 66 fa 49 ^:r.}8.....:.f.I 00e0: 04 76 92 14 0b e4 91 0a 5f 08 d0 d7 36 5b cf c2 .v......_...6[.. 00f0: 0e a6 05 b9 77 28 73 43 62 85 0e 6e 86 c0 d1 3e ....w(sCb..n...> 0100: a5 2e 7b ba c8 1e 1d e2 ce c0 53 04 aa f3 5c ac ..{.......S...\. 0110: 2b 98 d5 b2 0c b9 95 be 21 c7 df cf 6b ce 9f af +.......!...k... 0120: 29 c4 b5 ea 89 04 16 ec 6a 3b 93 79 34 99 9e c1 ).......j;.y4... 0130: c1 92 66 f3 d1 3f c2 87 84 a2 b4 1b 69 ea 11 eb ..f..?......i... 0140: 93 bc d3 9b 55 eb 4f 8b 3b c2 dc 18 10 9d 89 76 ....U.O.;......v 0150: 0b 1d 5a 9f 8c 82 47 d8 de 24 5c e1 18 e1 e1 a3 ..Z...G..$\..... 0160: e1 e2 db 94 fa 20 c4 63 c6 68 03 d3 79 d8 37 b1 ..... .c.h..y.7. 0170: 67 a5 21 18 4e 38 37 2d 57 7d e5 83 97 a4 df 9f g.!.N87-W}...... 0180: d0 72 18 76 b9 1b 7d 6b fd 2b db 0d ce 7a 1c f5 .r.v..}k.+...z.. 0190: cf 47 35 fd ef e0 86 15 a7 79 d0 91 f0 31 0c 02 .G5......y...1.. 01a0: f5 f9 96 07 15 b5 d1 bf cf 6e a4 81 cc 30 81 c9 .........n...0.. 01b0: a0 03 02 01 12 a2 81 c1 04 81 be f4 d4 c2 6c 9f ..............l. 01c0: 6b 72 ad 63 cf ed a5 9b 09 e2 b9 d1 8a 75 4f 95 kr.c.........uO. 01d0: 0d 02 7c 8f 30 c6 39 3f 77 8d 05 09 18 bc 6c 6f ..|.0.9?w.....lo 01e0: 28 cb a2 8d 25 6f cd c0 d0 5f 1e 30 81 02 88 1a (...% o..._.0.... 01f0: 8d 90 2d 0a a8 e4 89 d6 a4 52 00 58 7b 85 d1 6a ..-......R.X{..j 0200: 7b c6 d5 6e 3b d1 c6 5e db 86 3a 21 bb ea ff 33 {..n;..^..:!...3 0210: b1 e6 0c c6 8f cc 71 46 a4 29 7c 29 4b dd 7f 7b ......qF.)| )K..{ 0220: 40 03 4d 79 e4 54 b5 21 08 e9 a5 96 9f 3c 96 3c @.My.T.!.....<.< 0230: 0b 89 ed 52 d6 1a 74 44 f6 95 cc 77 db 03 38 86 ...R..tD...w..8. 0240: 65 b3 db 87 75 3d 1b 1d f0 ad f2 f1 b3 e8 29 17 e...u=........). 0250: a5 2d 43 d1 d3 35 9d fe 87 72 90 44 bd d0 b1 58 .-C..5...r.D...X 0260: e8 64 dd 93 5c b8 f8 5c 70 9f 7f 1d a0 9b 6e be .d..\..\p.....n. 0270: 29 24 a7 3e 9a 34 f4 c3 6a )$.>.4..j ber_scanf fmt ({i) ber: ber_dump: buf=0x80671b0 ptr=0x80671b7 end=0x8067429 len=626 0000: 60 82 02 6e 02 01 03 04 00 a3 82 02 65 04 06 47 `..n........e..G 0010: 53 53 41 50 49 04 82 02 59 60 82 02 55 06 09 2a SSAPI...Y`..U..* 0020: 86 48 86 f7 12 01 02 02 01 00 6e 82 02 44 30 82 .H........n..D0. 0030: 02 40 a0 03 02 01 05 a1 03 02 01 0e a2 07 03 05 .@.............. 0040: 00 20 00 00 00 a3 82 01 5a 61 82 01 56 30 82 01 . ......Za..V0.. 0050: 52 a0 03 02 01 05 a1 09 1b 07 43 49 44 53 2e 43 R.........CIDS.C 0060: 41 a2 22 30 20 a0 03 02 01 03 a1 19 30 17 1b 04 A."0 .......0... 0070: 6c 64 61 70 1b 0f 63 68 61 72 70 61 6b 2e 63 69 ldap..charpak.ci 0080: 64 73 2e 63 61 a3 82 01 1a 30 82 01 16 a0 03 02 ds.ca....0...... 0090: 01 12 a1 03 02 01 07 a2 82 01 08 04 82 01 04 46 ...............F 00a0: c7 d2 fb b5 63 13 9d ce 54 a8 bc 61 02 7c 9b a4 ....c...T..a.|.. 00b0: 4a b5 e4 97 5d 04 6d 68 26 e3 1a 4c 34 2d d5 ac J...].mh&..L4-.. 00c0: 13 1d ee a4 24 53 2b 27 d8 5e 3a 72 f3 7d 38 09 ....$S +'.^:r.}8. 00d0: 8b 0b b0 10 3a 84 66 fa 49 04 76 92 14 0b e4 91 ....:.f.I.v..... 00e0: 0a 5f 08 d0 d7 36 5b cf c2 0e a6 05 b9 77 28 73 ._...6[......w(s 00f0: 43 62 85 0e 6e 86 c0 d1 3e a5 2e 7b ba c8 1e 1d Cb..n...>..{.... 0100: e2 ce c0 53 04 aa f3 5c ac 2b 98 d5 b2 0c b9 95 ...S...\.+...... 0110: be 21 c7 df cf 6b ce 9f af 29 c4 b5 ea 89 04 16 .!...k...)...... 0120: ec 6a 3b 93 79 34 99 9e c1 c1 92 66 f3 d1 3f c2 .j;.y4.....f..?. 0130: 87 84 a2 b4 1b 69 ea 11 eb 93 bc d3 9b 55 eb 4f .....i.......U.O 0140: 8b 3b c2 dc 18 10 9d 89 76 0b 1d 5a 9f 8c 82 47 .;......v..Z...G 0150: d8 de 24 5c e1 18 e1 e1 a3 e1 e2 db 94 fa 20 c4 ..$\.......... . 0160: 63 c6 68 03 d3 79 d8 37 b1 67 a5 21 18 4e 38 37 c.h..y.7.g.!.N87 0170: 2d 57 7d e5 83 97 a4 df 9f d0 72 18 76 b9 1b 7d -W}.......r.v..} 0180: 6b fd 2b db 0d ce 7a 1c f5 cf 47 35 fd ef e0 86 k.+...z...G5.... 0190: 15 a7 79 d0 91 f0 31 0c 02 f5 f9 96 07 15 b5 d1 ..y...1......... 01a0: bf cf 6e a4 81 cc 30 81 c9 a0 03 02 01 12 a2 81 ..n...0......... 01b0: c1 04 81 be f4 d4 c2 6c 9f 6b 72 ad 63 cf ed a5 .......l.kr.c... 01c0: 9b 09 e2 b9 d1 8a 75 4f 95 0d 02 7c 8f 30 c6 39 ......uO...|.0.9 01d0: 3f 77 8d 05 09 18 bc 6c 6f 28 cb a2 8d 25 6f cd ?w.....lo(...%o. 01e0: c0 d0 5f 1e 30 81 02 88 1a 8d 90 2d 0a a8 e4 89 .._.0......-.... 01f0: d6 a4 52 00 58 7b 85 d1 6a 7b c6 d5 6e 3b d1 c6 ..R.X{..j{..n;.. 0200: 5e db 86 3a 21 bb ea ff 33 b1 e6 0c c6 8f cc 71 ^..:!...3......q 0210: 46 a4 29 7c 29 4b dd 7f 7b 40 03 4d 79 e4 54 b5 F.)| )K..{@.My.T. 0220: 21 08 e9 a5 96 9f 3c 96 3c 0b 89 ed 52 d6 1a 74 !.....<.<...R..t 0230: 44 f6 95 cc 77 db 03 38 86 65 b3 db 87 75 3d 1b D...w..8.e...u=. 0240: 1d f0 ad f2 f1 b3 e8 29 17 a5 2d 43 d1 d3 35 9d .......)..-C..5. 0250: fe 87 72 90 44 bd d0 b1 58 e8 64 dd 93 5c b8 f8 ..r.D...X.d..\.. 0260: 5c 70 9f 7f 1d a0 9b 6e be 29 24 a7 3e 9a 34 f4 \p.....n.)$.>.4. 0270: c3 6a .j ber_flush2: 633 bytes to sd 4 0000: 30 82 02 75 02 01 02 60 82 02 6e 02 01 03 04 00 0..u...`..n..... 0010: a3 82 02 65 04 06 47 53 53 41 50 49 04 82 02 59 ...e..GSSAPI...Y 0020: 60 82 02 55 06 09 2a 86 48 86 f7 12 01 02 02 01 `..U..*.H....... 0030: 00 6e 82 02 44 30 82 02 40 a0 03 02 01 05 a1 03 .n..D0..@....... 0040: 02 01 0e a2 07 03 05 00 20 00 00 00 a3 82 01 5a ........ ......Z 0050: 61 82 01 56 30 82 01 52 a0 03 02 01 05 a1 09 1b a..V0..R........ 0060: 07 43 49 44 53 2e 43 41 a2 22 30 20 a0 03 02 01 .CIDS.CA."0 .... 0070: 03 a1 19 30 17 1b 04 6c 64 61 70 1b 0f 63 68 61 ...0...ldap..cha 0080: 72 70 61 6b 2e 63 69 64 73 2e 63 61 a3 82 01 1a rpak.cids.ca.... 0090: 30 82 01 16 a0 03 02 01 12 a1 03 02 01 07 a2 82 0............... 00a0: 01 08 04 82 01 04 46 c7 d2 fb b5 63 13 9d ce 54 ......F....c...T 00b0: a8 bc 61 02 7c 9b a4 4a b5 e4 97 5d 04 6d 68 26 ..a.|..J...].mh& 00c0: e3 1a 4c 34 2d d5 ac 13 1d ee a4 24 53 2b 27 d8 ..L4-......$S+'. 00d0: 5e 3a 72 f3 7d 38 09 8b 0b b0 10 3a 84 66 fa 49 ^:r.}8.....:.f.I 00e0: 04 76 92 14 0b e4 91 0a 5f 08 d0 d7 36 5b cf c2 .v......_...6[.. 00f0: 0e a6 05 b9 77 28 73 43 62 85 0e 6e 86 c0 d1 3e ....w(sCb..n...> 0100: a5 2e 7b ba c8 1e 1d e2 ce c0 53 04 aa f3 5c ac ..{.......S...\. 0110: 2b 98 d5 b2 0c b9 95 be 21 c7 df cf 6b ce 9f af +.......!...k... 0120: 29 c4 b5 ea 89 04 16 ec 6a 3b 93 79 34 99 9e c1 ).......j;.y4... 0130: c1 92 66 f3 d1 3f c2 87 84 a2 b4 1b 69 ea 11 eb ..f..?......i... 0140: 93 bc d3 9b 55 eb 4f 8b 3b c2 dc 18 10 9d 89 76 ....U.O.;......v 0150: 0b 1d 5a 9f 8c 82 47 d8 de 24 5c e1 18 e1 e1 a3 ..Z...G..$\..... 0160: e1 e2 db 94 fa 20 c4 63 c6 68 03 d3 79 d8 37 b1 ..... .c.h..y.7. 0170: 67 a5 21 18 4e 38 37 2d 57 7d e5 83 97 a4 df 9f g.!.N87-W}...... 0180: d0 72 18 76 b9 1b 7d 6b fd 2b db 0d ce 7a 1c f5 .r.v..}k.+...z.. 0190: cf 47 35 fd ef e0 86 15 a7 79 d0 91 f0 31 0c 02 .G5......y...1.. 01a0: f5 f9 96 07 15 b5 d1 bf cf 6e a4 81 cc 30 81 c9 .........n...0.. 01b0: a0 03 02 01 12 a2 81 c1 04 81 be f4 d4 c2 6c 9f ..............l. 01c0: 6b 72 ad 63 cf ed a5 9b 09 e2 b9 d1 8a 75 4f 95 kr.c.........uO. 01d0: 0d 02 7c 8f 30 c6 39 3f 77 8d 05 09 18 bc 6c 6f ..|.0.9?w.....lo 01e0: 28 cb a2 8d 25 6f cd c0 d0 5f 1e 30 81 02 88 1a (...% o..._.0.... 01f0: 8d 90 2d 0a a8 e4 89 d6 a4 52 00 58 7b 85 d1 6a ..-......R.X{..j 0200: 7b c6 d5 6e 3b d1 c6 5e db 86 3a 21 bb ea ff 33 {..n;..^..:!...3 0210: b1 e6 0c c6 8f cc 71 46 a4 29 7c 29 4b dd 7f 7b ......qF.)| )K..{ 0220: 40 03 4d 79 e4 54 b5 21 08 e9 a5 96 9f 3c 96 3c @.My.T.!.....<.< 0230: 0b 89 ed 52 d6 1a 74 44 f6 95 cc 77 db 03 38 86 ...R..tD...w..8. 0240: 65 b3 db 87 75 3d 1b 1d f0 ad f2 f1 b3 e8 29 17 e...u=........). 0250: a5 2d 43 d1 d3 35 9d fe 87 72 90 44 bd d0 b1 58 .-C..5...r.D...X 0260: e8 64 dd 93 5c b8 f8 5c 70 9f 7f 1d a0 9b 6e be .d..\..\p.....n. 0270: 29 24 a7 3e 9a 34 f4 c3 6a )$.>.4..j ldap_write: want=633, written=633 0000: 30 82 02 75 02 01 02 60 82 02 6e 02 01 03 04 00 0..u...`..n..... 0010: a3 82 02 65 04 06 47 53 53 41 50 49 04 82 02 59 ...e..GSSAPI...Y 0020: 60 82 02 55 06 09 2a 86 48 86 f7 12 01 02 02 01 `..U..*.H....... 0030: 00 6e 82 02 44 30 82 02 40 a0 03 02 01 05 a1 03 .n..D0..@....... 0040: 02 01 0e a2 07 03 05 00 20 00 00 00 a3 82 01 5a ........ ......Z 0050: 61 82 01 56 30 82 01 52 a0 03 02 01 05 a1 09 1b a..V0..R........ 0060: 07 43 49 44 53 2e 43 41 a2 22 30 20 a0 03 02 01 .CIDS.CA."0 .... 0070: 03 a1 19 30 17 1b 04 6c 64 61 70 1b 0f 63 68 61 ...0...ldap..cha 0080: 72 70 61 6b 2e 63 69 64 73 2e 63 61 a3 82 01 1a rpak.cids.ca.... 0090: 30 82 01 16 a0 03 02 01 12 a1 03 02 01 07 a2 82 0............... 00a0: 01 08 04 82 01 04 46 c7 d2 fb b5 63 13 9d ce 54 ......F....c...T 00b0: a8 bc 61 02 7c 9b a4 4a b5 e4 97 5d 04 6d 68 26 ..a.|..J...].mh& 00c0: e3 1a 4c 34 2d d5 ac 13 1d ee a4 24 53 2b 27 d8 ..L4-......$S+'. 00d0: 5e 3a 72 f3 7d 38 09 8b 0b b0 10 3a 84 66 fa 49 ^:r.}8.....:.f.I 00e0: 04 76 92 14 0b e4 91 0a 5f 08 d0 d7 36 5b cf c2 .v......_...6[.. 00f0: 0e a6 05 b9 77 28 73 43 62 85 0e 6e 86 c0 d1 3e ....w(sCb..n...> 0100: a5 2e 7b ba c8 1e 1d e2 ce c0 53 04 aa f3 5c ac ..{.......S...\. 0110: 2b 98 d5 b2 0c b9 95 be 21 c7 df cf 6b ce 9f af +.......!...k... 0120: 29 c4 b5 ea 89 04 16 ec 6a 3b 93 79 34 99 9e c1 ).......j;.y4... 0130: c1 92 66 f3 d1 3f c2 87 84 a2 b4 1b 69 ea 11 eb ..f..?......i... 0140: 93 bc d3 9b 55 eb 4f 8b 3b c2 dc 18 10 9d 89 76 ....U.O.;......v 0150: 0b 1d 5a 9f 8c 82 47 d8 de 24 5c e1 18 e1 e1 a3 ..Z...G..$\..... 0160: e1 e2 db 94 fa 20 c4 63 c6 68 03 d3 79 d8 37 b1 ..... .c.h..y.7. 0170: 67 a5 21 18 4e 38 37 2d 57 7d e5 83 97 a4 df 9f g.!.N87-W}...... 0180: d0 72 18 76 b9 1b 7d 6b fd 2b db 0d ce 7a 1c f5 .r.v..}k.+...z.. 0190: cf 47 35 fd ef e0 86 15 a7 79 d0 91 f0 31 0c 02 .G5......y...1.. 01a0: f5 f9 96 07 15 b5 d1 bf cf 6e a4 81 cc 30 81 c9 .........n...0.. 01b0: a0 03 02 01 12 a2 81 c1 04 81 be f4 d4 c2 6c 9f ..............l. 01c0: 6b 72 ad 63 cf ed a5 9b 09 e2 b9 d1 8a 75 4f 95 kr.c.........uO. 01d0: 0d 02 7c 8f 30 c6 39 3f 77 8d 05 09 18 bc 6c 6f ..|.0.9?w.....lo 01e0: 28 cb a2 8d 25 6f cd c0 d0 5f 1e 30 81 02 88 1a (...% o..._.0.... 01f0: 8d 90 2d 0a a8 e4 89 d6 a4 52 00 58 7b 85 d1 6a ..-......R.X{..j 0200: 7b c6 d5 6e 3b d1 c6 5e db 86 3a 21 bb ea ff 33 {..n;..^..:!...3 0210: b1 e6 0c c6 8f cc 71 46 a4 29 7c 29 4b dd 7f 7b ......qF.)| )K..{ 0220: 40 03 4d 79 e4 54 b5 21 08 e9 a5 96 9f 3c 96 3c @.My.T.!.....<.< 0230: 0b 89 ed 52 d6 1a 74 44 f6 95 cc 77 db 03 38 86 ...R..tD...w..8. 0240: 65 b3 db 87 75 3d 1b 1d f0 ad f2 f1 b3 e8 29 17 e...u=........). 0250: a5 2d 43 d1 d3 35 9d fe 87 72 90 44 bd d0 b1 58 .-C..5...r.D...X 0260: e8 64 dd 93 5c b8 f8 5c 70 9f 7f 1d a0 9b 6e be .d..\..\p.....n. 0270: 29 24 a7 3e 9a 34 f4 c3 6a )$.>.4..j ldap_msgfree ldap_result ld 0x8058520 msgid 2 wait4msg ld 0x8058520 msgid 2 (infinite timeout) wait4msg continue ld 0x8058520 msgid 2 all 1 ** ld 0x8058520 Connections: * host: (null) port: 0 (default) refcnt: 2 status: Connected last used: Thu Feb 9 15:30:01 2012 ** ld 0x8058520 Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ld 0x8058520 request count 1 (abandoned 0) ** ld 0x8058520 Response Queue: Empty ld 0x8058520 response count 0 ldap_chkResponseList ld 0x8058520 msgid 2 all 1 ldap_chkResponseList returns ld 0x8058520 NULL ldap_int_select read1msg: ld 0x8058520 msgid 2 all 1 ber_get_next ldap_read: want=8, got=8 0000: 30 81 ec 02 01 02 61 81 0.....a. ldap_read: want=231, got=231 0000: e6 0a 01 0e 04 00 04 40 53 41 53 4c 28 30 29 3a .......@SASL(0): 0010: 20 73 75 63 63 65 73 73 66 75 6c 20 72 65 73 75 successful resu 0020: 6c 74 3a 20 73 65 63 75 72 69 74 79 20 66 6c 61 lt: security fla 0030: 67 73 20 64 6f 20 6e 6f 74 20 6d 61 74 63 68 20 gs do not match 0040: 72 65 71 75 69 72 65 64 87 81 9c 60 81 99 06 09 required...`.... 0050: 2a 86 48 86 f7 12 01 02 02 02 00 6f 81 89 30 81 *.H........o..0. 0060: 86 a0 03 02 01 05 a1 03 02 01 0f a2 7a 30 78 a0 ............z0x. 0070: 03 02 01 12 a2 71 04 6f 7e 89 45 11 0e 7a 4b 05 .....q.o~.E..zK. 0080: 37 fe ac 8f 2c 71 5f ed 60 af 26 39 57 b2 2e f4 7...,q_.`.&9W... 0090: 68 e2 01 39 27 19 55 a6 2d 27 06 8c a8 ba b1 db h..9'.U.-'...... 00a0: 33 e3 91 51 89 0a 3b 7a 8b 41 03 ec 2d 44 f0 88 3..Q..;z.A..-D.. 00b0: 31 e5 32 12 98 5f db 22 cd b1 2e d2 15 22 d1 7c 1.2.._.".....".| 00c0: d9 7f 48 aa 9e 27 84 a2 cd 36 02 cf 26 94 0d 71 ..H..'...6..&..q 00d0: 26 5e 66 45 af 86 34 de b1 5d 9a 53 40 df ce f1 &^fE..4..].S@... 00e0: 65 d7 7e d2 b5 1f d9 e.~.... ber_get_next: tag 0x30 len 236 contents: ber_dump: buf=0x8066930 ptr=0x8066930 end=0x8066a1c len=236 0000: 02 01 02 61 81 e6 0a 01 0e 04 00 04 40 53 41 53 ...a........@SAS 0010: 4c 28 30 29 3a 20 73 75 63 63 65 73 73 66 75 6c L(0): successful 0020: 20 72 65 73 75 6c 74 3a 20 73 65 63 75 72 69 74 result: securit 0030: 79 20 66 6c 61 67 73 20 64 6f 20 6e 6f 74 20 6d y flags do not m 0040: 61 74 63 68 20 72 65 71 75 69 72 65 64 87 81 9c atch required... 0050: 60 81 99 06 09 2a 86 48 86 f7 12 01 02 02 02 00 `....*.H........ 0060: 6f 81 89 30 81 86 a0 03 02 01 05 a1 03 02 01 0f o..0............ 0070: a2 7a 30 78 a0 03 02 01 12 a2 71 04 6f 7e 89 45 .z0x......q.o~.E 0080: 11 0e 7a 4b 05 37 fe ac 8f 2c 71 5f ed 60 af 26 ..zK.7...,q_.`.& 0090: 39 57 b2 2e f4 68 e2 01 39 27 19 55 a6 2d 27 06 9W...h..9'.U.-'. 00a0: 8c a8 ba b1 db 33 e3 91 51 89 0a 3b 7a 8b 41 03 .....3..Q..;z.A. 00b0: ec 2d 44 f0 88 31 e5 32 12 98 5f db 22 cd b1 2e .-D..1.2.._."... 00c0: d2 15 22 d1 7c d9 7f 48 aa 9e 27 84 a2 cd 36 02 ..".|..H..'...6. 00d0: cf 26 94 0d 71 26 5e 66 45 af 86 34 de b1 5d 9a .&..q&^fE..4..]. 00e0: 53 40 df ce f1 65 d7 7e d2 b5 1f d9 S@...e.~.... read1msg: ld 0x8058520 msgid 2 message type bind ber_scanf fmt ({eAA) ber: ber_dump: buf=0x8066930 ptr=0x8066933 end=0x8066a1c len=233 0000: 61 81 e6 0a 01 0e 04 00 04 40 53 41 53 4c 28 30 a........@SASL(0 0010: 29 3a 20 73 75 63 63 65 73 73 66 75 6c 20 72 65 ): successful re 0020: 73 75 6c 74 3a 20 73 65 63 75 72 69 74 79 20 66 sult: security f 0030: 6c 61 67 73 20 64 6f 20 6e 6f 74 20 6d 61 74 63 lags do not matc 0040: 68 20 72 65 71 75 69 72 65 64 87 81 9c 60 81 99 h required...`.. 0050: 06 09 2a 86 48 86 f7 12 01 02 02 02 00 6f 81 89 ..*.H........o.. 0060: 30 81 86 a0 03 02 01 05 a1 03 02 01 0f a2 7a 30 0.............z0 0070: 78 a0 03 02 01 12 a2 71 04 6f 7e 89 45 11 0e 7a x......q.o~.E..z 0080: 4b 05 37 fe ac 8f 2c 71 5f ed 60 af 26 39 57 b2 K.7...,q_.`.&9W. 0090: 2e f4 68 e2 01 39 27 19 55 a6 2d 27 06 8c a8 ba ..h..9'.U.-'.... 00a0: b1 db 33 e3 91 51 89 0a 3b 7a 8b 41 03 ec 2d 44 ..3..Q..;z.A..-D 00b0: f0 88 31 e5 32 12 98 5f db 22 cd b1 2e d2 15 22 ..1.2.._."....." 00c0: d1 7c d9 7f 48 aa 9e 27 84 a2 cd 36 02 cf 26 94 .|..H..'...6..&. 00d0: 0d 71 26 5e 66 45 af 86 34 de b1 5d 9a 53 40 df .q&^fE..4..].S@. 00e0: ce f1 65 d7 7e d2 b5 1f d9 ..e.~.... read1msg: ld 0x8058520 0 new referrals read1msg: mark request completed, ld 0x8058520 msgid 2 request done: ld 0x8058520 msgid 2 res_errno: 14, res_error: <SASL(0): successful result: security flags do not match required>, res_matched: <> ldap_free_request (origid 2, msgid 2) ldap_int_sasl_bind: <null> ldap_parse_sasl_bind_result ber_scanf fmt ({eAA) ber: ber_dump: buf=0x8066930 ptr=0x8066933 end=0x8066a1c len=233 0000: 61 81 e6 0a 01 0e 04 00 04 40 53 41 53 4c 28 30 a........@SASL(0 0010: 29 3a 20 73 75 63 63 65 73 73 66 75 6c 20 72 65 ): successful re 0020: 73 75 6c 74 3a 20 73 65 63 75 72 69 74 79 20 66 sult: security f 0030: 6c 61 67 73 20 64 6f 20 6e 6f 74 20 6d 61 74 63 lags do not matc 0040: 68 20 72 65 71 75 69 72 65 64 87 81 9c 60 81 99 h required...`.. 0050: 06 09 2a 86 48 86 f7 12 01 02 02 02 00 6f 81 89 ..*.H........o.. 0060: 30 81 86 a0 03 02 01 05 a1 03 02 01 0f a2 7a 30 0.............z0 0070: 78 a0 03 02 01 12 a2 71 04 6f 7e 89 45 11 0e 7a x......q.o~.E..z 0080: 4b 05 37 fe ac 8f 2c 71 5f ed 60 af 26 39 57 b2 K.7...,q_.`.&9W. 0090: 2e f4 68 e2 01 39 27 19 55 a6 2d 27 06 8c a8 ba ..h..9'.U.-'.... 00a0: b1 db 33 e3 91 51 89 0a 3b 7a 8b 41 03 ec 2d 44 ..3..Q..;z.A..-D 00b0: f0 88 31 e5 32 12 98 5f db 22 cd b1 2e d2 15 22 ..1.2.._."....." 00c0: d1 7c d9 7f 48 aa 9e 27 84 a2 cd 36 02 cf 26 94 .|..H..'...6..&. 00d0: 0d 71 26 5e 66 45 af 86 34 de b1 5d 9a 53 40 df .q&^fE..4..].S@. 00e0: ce f1 65 d7 7e d2 b5 1f d9 ..e.~.... ber_scanf fmt (O) ber: ber_dump: buf=0x8066930 ptr=0x806697d end=0x8066a1c len=159 0000: 87 81 9c 60 81 99 06 09 2a 86 48 86 f7 12 01 02 ...`....*.H..... 0010: 02 02 00 6f 81 89 30 81 86 a0 03 02 01 05 a1 03 ...o..0......... 0020: 02 01 0f a2 7a 30 78 a0 03 02 01 12 a2 71 04 6f ....z0x......q.o 0030: 7e 89 45 11 0e 7a 4b 05 37 fe ac 8f 2c 71 5f ed ~.E..zK.7...,q_. 0040: 60 af 26 39 57 b2 2e f4 68 e2 01 39 27 19 55 a6 `.&9W...h..9'.U. 0050: 2d 27 06 8c a8 ba b1 db 33 e3 91 51 89 0a 3b 7a -'......3..Q..;z 0060: 8b 41 03 ec 2d 44 f0 88 31 e5 32 12 98 5f db 22 .A..-D..1.2.._." 0070: cd b1 2e d2 15 22 d1 7c d9 7f 48 aa 9e 27 84 a2 .....".|..H..'.. 0080: cd 36 02 cf 26 94 0d 71 26 5e 66 45 af 86 34 de .6..&..q&^fE..4. 0090: b1 5d 9a 53 40 df ce f1 65 d7 7e d2 b5 1f d9 .].S@...e.~.... ldap_parse_result ber_scanf fmt ({iAA) ber: ber_dump: buf=0x8066930 ptr=0x8066933 end=0x8066a1c len=233 0000: 61 81 e6 0a 01 0e 04 00 04 40 53 41 53 4c 28 30 a........@SASL(0 0010: 29 3a 20 73 75 63 63 65 73 73 66 75 6c 20 72 65 ): successful re 0020: 73 75 6c 74 3a 20 73 65 63 75 72 69 74 79 20 66 sult: security f 0030: 6c 61 67 73 20 64 6f 20 6e 6f 74 20 6d 61 74 63 lags do not matc 0040: 68 20 72 65 71 75 69 72 65 64 87 81 9c 60 81 99 h required...`.. 0050: 06 09 2a 86 48 86 f7 12 01 02 02 02 00 6f 81 89 ..*.H........o.. 0060: 30 81 86 a0 03 02 01 05 a1 03 02 01 0f a2 7a 30 0.............z0 0070: 78 a0 03 02 01 12 a2 71 04 6f 7e 89 45 11 0e 7a x......q.o~.E..z 0080: 4b 05 37 fe ac 8f 2c 71 5f ed 60 af 26 39 57 b2 K.7...,q_.`.&9W. 0090: 2e f4 68 e2 01 39 27 19 55 a6 2d 27 06 8c a8 ba ..h..9'.U.-'.... 00a0: b1 db 33 e3 91 51 89 0a 3b 7a 8b 41 03 ec 2d 44 ..3..Q..;z.A..-D 00b0: f0 88 31 e5 32 12 98 5f db 22 cd b1 2e d2 15 22 ..1.2.._."....." 00c0: d1 7c d9 7f 48 aa 9e 27 84 a2 cd 36 02 cf 26 94 .|..H..'...6..&. 00d0: 0d 71 26 5e 66 45 af 86 34 de b1 5d 9a 53 40 df .q&^fE..4..].S@. 00e0: ce f1 65 d7 7e d2 b5 1f d9 ..e.~.... ber_scanf fmt (x) ber: ber_dump: buf=0x8066930 ptr=0x806697d end=0x8066a1c len=159 0000: 87 81 9c 60 81 99 06 09 2a 86 48 86 f7 12 01 02 ...`....*.H..... 0010: 02 02 00 6f 81 89 30 81 86 a0 03 02 01 05 a1 03 ...o..0......... 0020: 02 01 0f a2 7a 30 78 a0 03 02 01 12 a2 71 04 6f ....z0x......q.o 0030: 7e 89 45 11 0e 7a 4b 05 37 fe ac 8f 2c 71 5f ed ~.E..zK.7...,q_. 0040: 60 af 26 39 57 b2 2e f4 68 e2 01 39 27 19 55 a6 `.&9W...h..9'.U. 0050: 2d 27 06 8c a8 ba b1 db 33 e3 91 51 89 0a 3b 7a -'......3..Q..;z 0060: 8b 41 03 ec 2d 44 f0 88 31 e5 32 12 98 5f db 22 .A..-D..1.2.._." 0070: cd b1 2e d2 15 22 d1 7c d9 7f 48 aa 9e 27 84 a2 .....".|..H..'.. 0080: cd 36 02 cf 26 94 0d 71 26 5e 66 45 af 86 34 de .6..&..q&^fE..4. 0090: b1 5d 9a 53 40 df ce f1 65 d7 7e d2 b5 1f d9 .].S@...e.~.... ber_scanf fmt (}) ber: ber_dump: buf=0x8066930 ptr=0x8066a1c end=0x8066a1c len=0 sasl_client_step: 1 ldap_sasl_bind ldap_send_initial_request ldap_send_server_request ber_scanf fmt ({it) ber: ber_dump: buf=0x80673c8 ptr=0x80673c8 end=0x80673de len=22 0000: 30 14 02 01 03 60 0f 02 01 03 04 00 a3 08 04 06 0....`.......... 0010: 47 53 53 41 50 49 GSSAPI ber_scanf fmt ({i) ber: ber_dump: buf=0x80673c8 ptr=0x80673cd end=0x80673de len=17 0000: 60 0f 02 01 03 04 00 a3 08 04 06 47 53 53 41 50 `..........GSSAP 0010: 49 I ber_flush2: 22 bytes to sd 4 0000: 30 14 02 01 03 60 0f 02 01 03 04 00 a3 08 04 06 0....`.......... 0010: 47 53 53 41 50 49 GSSAPI ldap_write: want=22, written=22 0000: 30 14 02 01 03 60 0f 02 01 03 04 00 a3 08 04 06 0....`.......... 0010: 47 53 53 41 50 49 GSSAPI ldap_msgfree ldap_result ld 0x8058520 msgid 3 wait4msg ld 0x8058520 msgid 3 (infinite timeout) wait4msg continue ld 0x8058520 msgid 3 all 1 ** ld 0x8058520 Connections: * host: (null) port: 0 (default) refcnt: 2 status: Connected last used: Thu Feb 9 15:30:01 2012 ** ld 0x8058520 Outstanding Requests: * msgid 3, origid 3, status InProgress outstanding referrals 0, parent count 0 ld 0x8058520 request count 1 (abandoned 0) ** ld 0x8058520 Response Queue: Empty ld 0x8058520 response count 0 ldap_chkResponseList ld 0x8058520 msgid 3 all 1 ldap_chkResponseList returns ld 0x8058520 NULL ldap_int_select read1msg: ld 0x8058520 msgid 3 all 1 ber_get_next ldap_read: want=8, got=8 0000: 30 6e 02 01 03 61 69 0a 0n...ai. ldap_read: want=104, got=104 0000: 01 0e 04 00 04 40 53 41 53 4c 28 30 29 3a 20 73 .....@SASL(0): s 0010: 75 63 63 65 73 73 66 75 6c 20 72 65 73 75 6c 74 uccessful result 0020: 3a 20 73 65 63 75 72 69 74 79 20 66 6c 61 67 73 : security flags 0030: 20 64 6f 20 6e 6f 74 20 6d 61 74 63 68 20 72 65 do not match re 0040: 71 75 69 72 65 64 87 20 05 04 05 ff 00 0c 00 00 quired. ........ 0050: 00 00 00 00 12 b9 aa 10 07 01 00 00 df 4c f1 71 .............L.q 0060: 90 07 ff bd 17 a8 c4 a4 ........ ber_get_next: tag 0x30 len 110 contents: ber_dump: buf=0x8066ea0 ptr=0x8066ea0 end=0x8066f0e len=110 0000: 02 01 03 61 69 0a 01 0e 04 00 04 40 53 41 53 4c ...ai......@SASL 0010: 28 30 29 3a 20 73 75 63 63 65 73 73 66 75 6c 20 (0): successful 0020: 72 65 73 75 6c 74 3a 20 73 65 63 75 72 69 74 79 result: security 0030: 20 66 6c 61 67 73 20 64 6f 20 6e 6f 74 20 6d 61 flags do not ma 0040: 74 63 68 20 72 65 71 75 69 72 65 64 87 20 05 04 tch required. .. 0050: 05 ff 00 0c 00 00 00 00 00 00 12 b9 aa 10 07 01 ................ 0060: 00 00 df 4c f1 71 90 07 ff bd 17 a8 c4 a4 ...L.q........ read1msg: ld 0x8058520 msgid 3 message type bind ber_scanf fmt ({eAA) ber: ber_dump: buf=0x8066ea0 ptr=0x8066ea3 end=0x8066f0e len=107 0000: 61 69 0a 01 0e 04 00 04 40 53 41 53 4c 28 30 29 ai......@SASL(0) 0010: 3a 20 73 75 63 63 65 73 73 66 75 6c 20 72 65 73 : successful res 0020: 75 6c 74 3a 20 73 65 63 75 72 69 74 79 20 66 6c ult: security fl 0030: 61 67 73 20 64 6f 20 6e 6f 74 20 6d 61 74 63 68 ags do not match 0040: 20 72 65 71 75 69 72 65 64 87 20 05 04 05 ff 00 required. ..... 0050: 0c 00 00 00 00 00 00 12 b9 aa 10 07 01 00 00 df ................ 0060: 4c f1 71 90 07 ff bd 17 a8 c4 a4 L.q........ read1msg: ld 0x8058520 0 new referrals read1msg: mark request completed, ld 0x8058520 msgid 3 request done: ld 0x8058520 msgid 3 res_errno: 14, res_error: <SASL(0): successful result: security flags do not match required>, res_matched: <> ldap_free_request (origid 3, msgid 3) ldap_int_sasl_bind: <null> ldap_parse_sasl_bind_result ber_scanf fmt ({eAA) ber: ber_dump: buf=0x8066ea0 ptr=0x8066ea3 end=0x8066f0e len=107 0000: 61 69 0a 01 0e 04 00 04 40 53 41 53 4c 28 30 29 ai......@SASL(0) 0010: 3a 20 73 75 63 63 65 73 73 66 75 6c 20 72 65 73 : successful res 0020: 75 6c 74 3a 20 73 65 63 75 72 69 74 79 20 66 6c ult: security fl 0030: 61 67 73 20 64 6f 20 6e 6f 74 20 6d 61 74 63 68 ags do not match 0040: 20 72 65 71 75 69 72 65 64 87 20 05 04 05 ff 00 required. ..... 0050: 0c 00 00 00 00 00 00 12 b9 aa 10 07 01 00 00 df ................ 0060: 4c f1 71 90 07 ff bd 17 a8 c4 a4 L.q........ ber_scanf fmt (O) ber: ber_dump: buf=0x8066ea0 ptr=0x8066eec end=0x8066f0e len=34 0000: 87 20 05 04 05 ff 00 0c 00 00 00 00 00 00 12 b9 . .............. 0010: aa 10 07 01 00 00 df 4c f1 71 90 07 ff bd 17 a8 .......L.q...... 0020: c4 a4 .. ldap_parse_result ber_scanf fmt ({iAA) ber: ber_dump: buf=0x8066ea0 ptr=0x8066ea3 end=0x8066f0e len=107 0000: 61 69 0a 01 0e 04 00 04 40 53 41 53 4c 28 30 29 ai......@SASL(0) 0010: 3a 20 73 75 63 63 65 73 73 66 75 6c 20 72 65 73 : successful res 0020: 75 6c 74 3a 20 73 65 63 75 72 69 74 79 20 66 6c ult: security fl 0030: 61 67 73 20 64 6f 20 6e 6f 74 20 6d 61 74 63 68 ags do not match 0040: 20 72 65 71 75 69 72 65 64 87 20 05 04 05 ff 00 required. ..... 0050: 0c 00 00 00 00 00 00 12 b9 aa 10 07 01 00 00 df ................ 0060: 4c f1 71 90 07 ff bd 17 a8 c4 a4 L.q........ ber_scanf fmt (x) ber: ber_dump: buf=0x8066ea0 ptr=0x8066eec end=0x8066f0e len=34 0000: 87 20 05 04 05 ff 00 0c 00 00 00 00 00 00 12 b9 . .............. 0010: aa 10 07 01 00 00 df 4c f1 71 90 07 ff bd 17 a8 .......L.q...... 0020: c4 a4 .. ber_scanf fmt (}) ber: ber_dump: buf=0x8066ea0 ptr=0x8066f0e end=0x8066f0e len=0 sasl_client_step: 0 ldap_sasl_bind ldap_send_initial_request ldap_send_server_request ber_scanf fmt ({it) ber: ber_dump: buf=0x80675e0 ptr=0x80675e0 end=0x8067618 len=56 0000: 30 36 02 01 04 60 31 02 01 03 04 00 a3 2a 04 06 06...`1......*.. 0010: 47 53 53 41 50 49 04 20 05 04 04 ff 00 0c 00 00 GSSAPI. ........ 0020: 00 00 00 00 14 7c 59 12 04 ff ff ff df d0 e2 d4 .....| Y......... 0030: ba 92 ed 68 ba 85 78 97 ...h..x. ber_scanf fmt ({i) ber: ber_dump: buf=0x80675e0 ptr=0x80675e5 end=0x8067618 len=51 0000: 60 31 02 01 03 04 00 a3 2a 04 06 47 53 53 41 50 `1......*..GSSAP 0010: 49 04 20 05 04 04 ff 00 0c 00 00 00 00 00 00 14 I. ............. 0020: 7c 59 12 04 ff ff ff df d0 e2 d4 ba 92 ed 68 ba | Y............h. 0030: 85 78 97 .x. ber_flush2: 56 bytes to sd 4 0000: 30 36 02 01 04 60 31 02 01 03 04 00 a3 2a 04 06 06...`1......*.. 0010: 47 53 53 41 50 49 04 20 05 04 04 ff 00 0c 00 00 GSSAPI. ........ 0020: 00 00 00 00 14 7c 59 12 04 ff ff ff df d0 e2 d4 .....| Y......... 0030: ba 92 ed 68 ba 85 78 97 ...h..x. ldap_write: want=56, written=56 0000: 30 36 02 01 04 60 31 02 01 03 04 00 a3 2a 04 06 06...`1......*.. 0010: 47 53 53 41 50 49 04 20 05 04 04 ff 00 0c 00 00 GSSAPI. ........ 0020: 00 00 00 00 14 7c 59 12 04 ff ff ff df d0 e2 d4 .....| Y......... 0030: ba 92 ed 68 ba 85 78 97 ...h..x. ldap_msgfree ldap_result ld 0x8058520 msgid 4 wait4msg ld 0x8058520 msgid 4 (infinite timeout) wait4msg continue ld 0x8058520 msgid 4 all 1 ** ld 0x8058520 Connections: * host: (null) port: 0 (default) refcnt: 2 status: Connected last used: Thu Feb 9 15:30:01 2012 ** ld 0x8058520 Outstanding Requests: * msgid 4, origid 4, status InProgress outstanding referrals 0, parent count 0 ld 0x8058520 request count 1 (abandoned 0) ** ld 0x8058520 Response Queue: Empty ld 0x8058520 response count 0 ldap_chkResponseList ld 0x8058520 msgid 4 all 1 ldap_chkResponseList returns ld 0x8058520 NULL ldap_int_select read1msg: ld 0x8058520 msgid 4 all 1 ber_get_next ldap_read: want=8, got=8 0000: 30 0c 02 01 04 61 07 0a 0....a.. ldap_read: want=6, got=6 0000: 01 00 04 00 04 00 ...... ber_get_next: tag 0x30 len 12 contents: ber_dump: buf=0x8066a10 ptr=0x8066a10 end=0x8066a1c len=12 0000: 02 01 04 61 07 0a 01 00 04 00 04 00 ...a........ read1msg: ld 0x8058520 msgid 4 message type bind ber_scanf fmt ({eAA) ber: ber_dump: buf=0x8066a10 ptr=0x8066a13 end=0x8066a1c len=9 0000: 61 07 0a 01 00 04 00 04 00 a........ read1msg: ld 0x8058520 0 new referrals read1msg: mark request completed, ld 0x8058520 msgid 4 request done: ld 0x8058520 msgid 4 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 4, msgid 4) ldap_int_sasl_bind: <null> ldap_parse_sasl_bind_result ber_scanf fmt ({eAA) ber: ber_dump: buf=0x8066a10 ptr=0x8066a13 end=0x8066a1c len=9 0000: 61 07 0a 01 00 04 00 04 00 a........ ldap_parse_result ber_scanf fmt ({iAA) ber: ber_dump: buf=0x8066a10 ptr=0x8066a13 end=0x8066a1c len=9 0000: 61 07 0a 01 00 04 00 04 00 a........ ber_scanf fmt (}) ber: ber_dump: buf=0x8066a10 ptr=0x8066a1c end=0x8066a1c len=0 SASL username: dsavard(a)CIDS.CA SASL SSF: 56 ldap_pvt_sasl_generic_install SASL data security layer installed. ldap_msgfree ldap_extended_operation ldap_send_initial_request ldap_send_server_request ber_scanf fmt ({it) ber: ber_dump: buf=0x80685e8 ptr=0x80685e8 end=0x8068608 len=32 0000: 30 1e 02 01 05 77 19 80 17 31 2e 33 2e 36 2e 31 0....w...1.3.6.1 0010: 2e 34 2e 31 2e 34 32 30 33 2e 31 2e 31 31 2e 33 .4.1.4203.1.11.3 ber_scanf fmt ({) ber: ber_dump: buf=0x80685e8 ptr=0x80685ed end=0x8068608 len=27 0000: 77 19 80 17 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e w...1.3.6.1.4.1. 0010: 34 32 30 33 2e 31 2e 31 31 2e 33 4203.1.11.3 ber_flush2: 32 bytes to sd 4 0000: 30 1e 02 01 05 77 19 80 17 31 2e 33 2e 36 2e 31 0....w...1.3.6.1 0010: 2e 34 2e 31 2e 34 32 30 33 2e 31 2e 31 31 2e 33 .4.1.4203.1.11.3 sasl_generic_write: want=96, written=96 0000: 00 00 00 5c 05 04 06 ff 00 00 00 00 00 00 00 00 ...\............ 0010: 14 7c 59 13 19 70 b3 cc d8 3f 49 e8 75 23 72 34 .| Y..p...?I.u#r4 0020: e3 36 1f 76 8b b5 33 a9 f0 f7 b7 e7 a6 03 39 5a .6.v..3.......9Z 0030: aa ff 48 4a f1 7d ff 50 1e 4c 70 42 1e 70 f9 1a ..HJ.}.P.LpB.p.. 0040: 1b a6 98 d3 ac 1f fa 0b 7c 74 5f a2 bb 33 8a 11 ........| t_..3.. 0050: d5 71 97 a5 22 e6 cb 58 4a b9 22 c7 9e 49 f0 ac .q.."..XJ."..I.. ldap_write: want=32, written=32 0000: 30 1e 02 01 05 77 19 80 17 31 2e 33 2e 36 2e 31 0....w...1.3.6.1 0010: 2e 34 2e 31 2e 34 32 30 33 2e 31 2e 31 31 2e 33 .4.1.4203.1.11.3 ldap_result ld 0x8058520 msgid -1 wait4msg ld 0x8058520 msgid -1 (timeout 100000 usec) wait4msg continue ld 0x8058520 msgid -1 all 1 ** ld 0x8058520 Connections: * host: (null) port: 0 (default) refcnt: 2 status: Connected last used: Thu Feb 9 15:30:01 2012 ** ld 0x8058520 Outstanding Requests: * msgid 5, origid 5, status InProgress outstanding referrals 0, parent count 0 ld 0x8058520 request count 1 (abandoned 0) ** ld 0x8058520 Response Queue: Empty ld 0x8058520 response count 0 ldap_chkResponseList ld 0x8058520 msgid -1 all 1 ldap_chkResponseList returns ld 0x8058520 NULL ldap_int_select read1msg: ld 0x8058520 msgid -1 all 1 ber_get_next sasl_generic_read: want=4, got=4 0000: 00 00 00 6d ...m sasl_generic_read: want=109, got=109 0000: 05 04 07 ff 00 00 00 00 00 00 00 00 12 b9 aa 11 ................ 0010: 2c b0 59 b7 a7 26 8a 02 2e 10 76 24 d1 2a 65 7f ,.Y..&....v $.*e. 0020: 06 fd ba 3c a5 23 0d d9 7a 3a 9d 05 0c 29 fc 1d ...<.#..z:...).. 0030: 7e 4f 6f db 0c 0e da 33 33 5b dc fb 58 2c 76 d9 ~Oo....33[..X,v. 0040: af ff 86 32 cc f2 08 9e e4 05 01 db 55 e8 9d 41 ...2........U..A 0050: 79 07 3f fc 60 bb e8 09 bb 67 a9 84 9c e6 61 28 y.?.`....g....a( 0060: dc f7 ee 69 eb a4 25 bf 93 42 14 4d e7 ...i..%..B.M. ldap_read: want=8, got=8 0000: 30 2f 02 01 05 78 2a 0a 0/...x*. ldap_read: want=41, got=41 0000: 01 00 04 00 04 00 8b 21 64 6e 3a 63 6e 3d 64 61 .......! dn:cn=da 0010: 6e 69 65 6c 20 73 61 76 61 72 64 2c 64 63 3d 63 niel savard,dc=c 0020: 69 64 73 2c 64 63 3d 63 61 ids,dc=ca ber_get_next: tag 0x30 len 47 contents: ber_dump: buf=0x8069af8 ptr=0x8069af8 end=0x8069b27 len=47 0000: 02 01 05 78 2a 0a 01 00 04 00 04 00 8b 21 64 6e ...x*........!dn 0010: 3a 63 6e 3d 64 61 6e 69 65 6c 20 73 61 76 61 72 :cn=daniel savar 0020: 64 2c 64 63 3d 63 69 64 73 2c 64 63 3d 63 61 d,dc=cids,dc=ca read1msg: ld 0x8058520 msgid 5 message type extended-result ber_scanf fmt ({eAA) ber: ber_dump: buf=0x8069af8 ptr=0x8069afb end=0x8069b27 len=44 0000: 78 2a 0a 01 00 04 00 04 00 8b 21 64 6e 3a 63 6e x*........! dn:cn 0010: 3d 64 61 6e 69 65 6c 20 73 61 76 61 72 64 2c 64 =daniel savard,d 0020: 63 3d 63 69 64 73 2c 64 63 3d 63 61 c=cids,dc=ca read1msg: ld 0x8058520 0 new referrals read1msg: mark request completed, ld 0x8058520 msgid 5 request done: ld 0x8058520 msgid 5 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 5, msgid 5) ldap_parse_result ber_scanf fmt ({iAA) ber: ber_dump: buf=0x8069af8 ptr=0x8069afb end=0x8069b27 len=44 0000: 78 2a 0a 01 00 04 00 04 00 8b 21 64 6e 3a 63 6e x*........! dn:cn 0010: 3d 64 61 6e 69 65 6c 20 73 61 76 61 72 64 2c 64 =daniel savard,d 0020: 63 3d 63 69 64 73 2c 64 63 3d 63 61 c=cids,dc=ca ber_scanf fmt (x) ber: ber_dump: buf=0x8069af8 ptr=0x8069b04 end=0x8069b27 len=35 0000: 8b 21 64 6e 3a 63 6e 3d 64 61 6e 69 65 6c 20 73 .! dn:cn=daniel s 0010: 61 76 61 72 64 2c 64 63 3d 63 69 64 73 2c 64 63 avard,dc=cids,dc 0020: 3d 63 61 =ca ber_scanf fmt (}) ber: ber_dump: buf=0x8069af8 ptr=0x8069b27 end=0x8069b27 len=0 ldap_parse_extended_result ber_scanf fmt ({eAA) ber: ber_dump: buf=0x8069af8 ptr=0x8069afb end=0x8069b27 len=44 0000: 78 2a 0a 01 00 04 00 04 00 8b 21 64 6e 3a 63 6e x*........! dn:cn 0010: 3d 64 61 6e 69 65 6c 20 73 61 76 61 72 64 2c 64 =daniel savard,d 0020: 63 3d 63 69 64 73 2c 64 63 3d 63 61 c=cids,dc=ca ber_scanf fmt (O) ber: ber_dump: buf=0x8069af8 ptr=0x8069b04 end=0x8069b27 len=35 0000: 8b 21 64 6e 3a 63 6e 3d 64 61 6e 69 65 6c 20 73 .! dn:cn=daniel s 0010: 61 76 61 72 64 2c 64 63 3d 63 69 64 73 2c 64 63 avard,dc=cids,dc 0020: 3d 63 61 =ca dn:cn=daniel savard,dc=cids,dc=ca ldap_msgfree ldap_free_connection 1 1 ldap_send_unbind ber_flush2: 7 bytes to sd 4 0000: 30 05 02 01 06 42 00 0....B. sasl_generic_write: want=71, written=71 0000: 00 00 00 43 05 04 06 ff 00 00 00 00 00 00 00 00 ...C............ 0010: 14 7c 59 14 62 4d d1 00 e2 51 30 43 8b bb 63 30 .| Y.bM...Q0C..c0 0020: 8e 74 4e 91 57 f8 10 4a 9f ec b4 d2 b2 0c 33 bc .tN.W..J......3. 0030: 67 c8 06 09 2b 22 7f f2 be 26 12 b1 96 cc 8f 10 g...+"...&...... 0040: 09 89 32 2a 02 11 d8 ..2*... ldap_write: want=7, written=7 0000: 30 05 02 01 06 42 00 0....B. ldap_free_connection: actually freed Segmentation fault THX -- Daniel Savard

4 7

Re: Root not allowed to login
by SYeen Su 25 Mar '12

25 Mar '12

Hi Chris, Wow, amazingly, it only happens to root. When I logged in as test, this is the message in /var/log/secure : Mar 23 11:03:16 mgrc-prod-sdb9 login: LOGIN ON tty1 BY test The password for root is a known value, not some paswordless phrase or some passphrase. What settings do I need to do for root? On Fri, Mar 23, 2012 at 10:50 AM, Chris Jacobs <Chris.Jacobs(a)apollogrp.edu>wrote: > Is your root passwd set to a known value? Can you sudo or su to root? Is > this an issue with any other local accounts? > > > - chris > > Chris Jacobs > Systems Administrator, Technology Services Group > > Apollo Group | Apollo Marketing & Product Development | Aptimus, Inc. > 1501 4th Ave | Suite 2500 | Seattle, WA 98101 > direct 206.839.8245 | cell 206.601.3256 | Fax 206.644.0628 > email: chris.jacobs(a)apollogrp.edu > > ------------------------------ > *From*: SYeen Su <seauyeen(a)mgrc.com.my> > *To*: Chris Jacobs > *Cc*: mlstarling31(a)hotmail.com <mlstarling31(a)hotmail.com>; > openldap-technical(a)openldap.org <openldap-technical(a)openldap.org> > *Sent*: Thu Mar 22 19:47:06 2012 > > *Subject*: Re: Root not allowed to login > > Hello Chris, > > THis is what I got when I tried logging in from the KVM console/ILOM: > > login: pam_ldap: error trying to bind as user > "uid=root,ou=People,dc=synamatix,dc=com" (Invalid credentials) > Mar 23 10:44:40 mgrc-prod-sdb9 login: ROOT LOGIN ON tty1 > > It will alaways try to bind as user "uid=root" even though root is local. > > On Fri, Mar 23, 2012 at 10:37 AM, Chris Jacobs <Chris.Jacobs(a)apollogrp.edu > > wrote: > >> What do your logs say when root tries to login? >> >> >> Chris Jacobs >> Systems Administrator, Technology Services Group >> >> Apollo Group | Apollo Marketing & Product Development | Aptimus, Inc. >> 1501 4th Ave | Suite 2500 | Seattle, WA 98101 >> direct 206.839.8245 | cell 206.601.3256 | Fax 206.644.0628 >> email: chris.jacobs(a)apollogrp.edu >> >> ------------------------------ >> *From*: SYeen Su <seauyeen(a)mgrc.com.my> >> *To*: Chris Jacobs >> *Cc*: mlstarling31(a)hotmail.com <mlstarling31(a)hotmail.com>; >> openldap-technical(a)openldap.org <openldap-technical(a)openldap.org> >> *Sent*: Thu Mar 22 19:32:07 2012 >> >> *Subject*: Re: Root not allowed to login >> >> Hi Chris, >> >> For testing purpose I disabled the PermitRootLogin to yes temporarily. >> Usually it's no and the failure was noticed when the server lost connection >> to the ldap server and even root ( that's local) is not able to log in. >> Hence, I started investigating what is wrong. Bottomline, via console, root >> is not able to log in if there is no network connectivity to ldap and I am >> trying to solve this issue because if even root and any othe rlocal users >> cannot log in via console, I am not able to check what is wrong with the >> network, the only option is to reboot, which is what I'd like to avoid. >> >> >> On Fri, Mar 23, 2012 at 10:14 AM, Chris Jacobs < >> Chris.Jacobs(a)apollogrp.edu> wrote: >> >>> Syeen, >>> >>> Are you trying to login remotely? Or at the local console? >>> >>> If remotely, this may be standard behavior as usually PermitRootLogin is >>> set to no in /etc/ssh/sshd_config - which I would NOT recommend changing. >>> During an outage, local console access would have to be used (via ILO, some >>> KVM over IP, etc, solution). >>> >>> Other than that, everything in your system-auth-ac and nsswitch.conf >>> look fine to me. >>> >>> - chris >>> >>> >>> *Chris Jacobs,** *Jr. Unix System Administrator >>> Apollo Group | Apollo Marketing | ITG >>> >>> 2001 6th Ave, Suite 3200 | Seattle, WA 98121-2522 >>> phone: 206.441.9100 x1245 | mobile: 206.601.3256 | fax: 206.441.9661 >>> >>> email: chris.jacobs(a)apollogrp.edu >>> >>> ------------------------------ >>> *From:* SYeen Su [seauyeen(a)mgrc.com.my] >>> *Sent:* Thursday, March 22, 2012 7:13 PM >>> >>> *To:* Chris Jacobs >>> *Cc:* mlstarling31(a)hotmail.com; openldap-technical(a)openldap.org >>> *Subject:* Re: Root not allowed to login >>> >>> Hi Chris, >>> >>> Exactly, all my configuration seems correct as I have compared. Hmm >>> let's just say i am not familiar with sssd and to migrate to sssd, I think >>> i gotta spend some time studying it. So, i know, i took the easy way out by >>> just porting over my previous ldap configuration to RHEL6. >>> >>> Anyway, my snippets from /etc/nsswitch.conf file as below: >>> >>> *passwd: files ldap >>> shadow: files ldap >>> group: files ldap >>> * >>> It matches yours too, right? If i put the sequence the other way round, >>> root practically cannot log in at all! >>> >>> What else do I need to configure on my client side? I am lost! >>> >>> On Fri, Mar 23, 2012 at 10:10 AM, Chris Jacobs < >>> Chris.Jacobs(a)apollogrp.edu> wrote: >>> >>>> Again, this isn't an openldap issue, but... >>>> >>>> Your /etc/pam.d/system-auth-ac file looks fine to me - it matches both >>>> our CentOS5 and CentOS6 machines. >>>> >>>> I looked and was unable to find any attachments or included snippets >>>> from your /etc/nsswitch.conf file. >>>> >>>> On our systems using PADL's pam_ldap, you should have in there: >>>> passwd: files ldap >>>> shadow: files ldap >>>> group: files ldap >>>> >>>> Digression: I'm a little surprised you're using pam's padl software. >>>> Between nss-pam-ldapd and sssd we decided to embrace the apparent future >>>> and have successfully moved to sssd for our CentOS 6 boxes. >>>> ** This doesn't impact your problem though. ** >>>> >>>> *Chris Jacobs,** *Jr. Unix System Administrator >>>> Apollo Group | Apollo Marketing | ITG >>>> >>>> 2001 6th Ave, Suite 3200 | Seattle, WA 98121-2522 >>>> phone: 206.441.9100 x1245 | mobile: 206.601.3256 | fax: 206.441.9661 >>>> >>>> email: chris.jacobs(a)apollogrp.edu >>>> >>>> ------------------------------ >>>> *From:* SYeen Su [seauyeen(a)mgrc.com.my] >>>> *Sent:* Thursday, March 22, 2012 6:22 PM >>>> *To:* Chris Jacobs >>>> *Cc:* mlstarling31(a)hotmail.com; openldap-technical(a)openldap.org >>>> >>>> *Subject:* Re: Root not allowed to login >>>> >>>> Hi Chris, >>>> >>>> That's what I suspect too but I am not sure how else to tweak my pam >>>> and nsswitch files. Do you have any suggestions? Below is my >>>> pam.d/system-auth file and my nsswitch file excerpt has been attached >>>> previously. >>>> >>>> #%PAM-1.0 >>>> # This file is auto-generated. >>>> # User changes will be destroyed the next time authconfig is run. >>>> auth required pam_env.so >>>> auth sufficient pam_unix.so nullok try_first_pass >>>> auth requisite pam_succeed_if.so uid >= 500 quiet >>>> auth sufficient pam_ldap.so use_first_pass >>>> auth required pam_deny.so >>>> >>>> account required pam_unix.so broken_shadow >>>> account sufficient pam_localuser.so >>>> account sufficient pam_succeed_if.so uid < 500 quiet >>>> account [default=bad success=ok user_unknown=ignore] pam_ldap.so >>>> account required pam_permit.so >>>> >>>> password requisite pam_cracklib.so try_first_pass retry=3 >>>> dcredit=-2 ucredit=-2 lcredit=-2 ocredit=-2 minlen=8 type=strong >>>> password sufficient pam_unix.so md5 shadow nullok try_first_pass >>>> use_authtok >>>> password sufficient pam_ldap.so use_authtok >>>> password required pam_deny.so >>>> >>>> session optional pam_keyinit.so revoke >>>> session required pam_limits.so >>>> session [success=1 default=ignore] pam_succeed_if.so service in >>>> crond quiet use_uid >>>> session required pam_unix.so >>>> session optional pam_ldap.so >>>> >>>> Is there anything amiss with my pam file? If you need to have a look at >>>> my login and sshd pam file, please tell me so. >>>> >>>> Thanks a lot. >>>> >>>> On Fri, Mar 23, 2012 at 9:17 AM, Chris Jacobs < >>>> Chris.Jacobs(a)apollogrp.edu> wrote: >>>> >>>>> The timeouts are how long to wait for ldap to respond. It should >>>>> check local (normally via pam) next. >>>>> >>>>> We have our user's in LDAP and can still login using the local >>>>> accounts. >>>>> >>>>> Your issue isn't an LDAP problem, it's a pam/nsswitch/local issue. >>>>> >>>>> - chris >>>>> >>>>> Chris Jacobs >>>>> Systems Administrator, Technology Services Group >>>>> >>>>> Apollo Group | Apollo Marketing & Product Development | Aptimus, >>>>> Inc. >>>>> 1501 4th Ave | Suite 2500 | Seattle, WA 98101 >>>>> direct 206.839.8245 | cell 206.601.3256 | Fax 206.644.0628 >>>>> email: chris.jacobs(a)apollogrp.edu >>>>> >>>>> ------------------------------ >>>>> *From*: openldap-technical-bounces(a)OpenLDAP.org<openldap-technical-bounces(a)OpenLDAP.org> >>>>> >>>>> *To*: Michael Starling <mlstarling31(a)hotmail.com> >>>>> *Cc*: openldap <openldap-technical(a)openldap.org> >>>>> *Sent*: Thu Mar 22 18:10:55 2012 >>>>> *Subject*: Re: Root not allowed to login >>>>> >>>>> Hi Michael, >>>>> >>>>> I have changed the timelimit and bind_timelimit to 4 but it still >>>>> checks with ldap immediately ( I mean when root logs in ). i doubt it has >>>>> anything to do with the time because it checks immediately without any >>>>> delay. >>>>> >>>>> On Thu, Mar 22, 2012 at 9:51 PM, Michael Starling < >>>>> mlstarling31(a)hotmail.com> wrote: >>>>> >>>>>> Try setting your timelimt and bind_timelimit to something like a >>>>>> bit lower. >>>>>> >>>>>> timelimit 4 >>>>>> >>>>>> bind_timelimit 4 >>>>>> >>>>>> ------------------------------ >>>>>> Date: Thu, 22 Mar 2012 17:03:56 +0800 >>>>>> Subject: Root not allowed to login >>>>>> From: seauyeen(a)mgrc.com.my >>>>>> To: openldap-technical(a)openldap.org >>>>>> >>>>>> >>>>>> Hi, >>>>>> >>>>>> My client is installed with RHEL 6.0 and I am using OpenLDAP 2.4. >>>>>> When the box loses connection with the ldap server, even the root cannot >>>>>> log in as it tries to bind with the ldap server. This can be seen when I >>>>>> log in with root and the message below appears : >>>>>> >>>>>> sshd: pam_ldap: error trying to bind as user "uid=root, ou=People, >>>>>> dc=example,dc=com" (Invalid credentials). >>>>>> >>>>>> My root user is not even in the ldap database. When connection is >>>>>> fine, the message above does not affect the login of root. The login of >>>>>> root is only screwed up when the box loses connectivity. >>>>>> >>>>>> Attached are my pam.d/system-auth file, pam.d/login, pam./dsshd and >>>>>> ldap.conf files. >>>>>> >>>>>> I have been googling around but some either switch to kerberos, or >>>>>> the question is left unatttended to. Please help. I can only resort to >>>>>> restarting the box whenever this happens. How can I configure the ldap so >>>>>> that local users can login when there's no connectivity to ldap server? >>>>>> >>>>>> Thanks heaps! >>>>>> >>>>>> -- >>>>>> >>>>>> >>>>>> >>>>>> ------------------------------ >>>>>> MGRC - *Sequence. Analyse. Innovate.* >>>>>> *Su Seau Yeen >>>>>> Manager, IT Operations >>>>>> *** >>>>>> *Malaysian Genomics Resource Centre Berhad (MGRC)* >>>>>> T: +6 03 2283 1820 | F: +6 03 2282 8102 | M: +6 012 6784642 | >>>>>> www.mgrc.com.my >>>>>> ------------------------------ >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> This e-mail is intended only for the use of the individual or >>>>>> entity to which it is addressed and may contain confidential and/or >>>>>> privileged material. Any review, retransmission, dissemination or other use >>>>>> of or taking of any action in reliance upon this information by persons or >>>>>> entities other than the intended recipient, is strictly prohibited. If you >>>>>> receive this e-mail in error, please contact us immediately by return >>>>>> e-mail and delete the original message(s). >>>>>> >>>>> >>>>> >>>>> >>>>> -- >>>>> >>>>> >>>>> >>>>> ------------------------------ >>>>> MGRC - *Sequence. Analyse. Innovate.* >>>>> *Su Seau Yeen >>>>> Manager, IT Operations >>>>> *** >>>>> *Malaysian Genomics Resource Centre Berhad (MGRC)* >>>>> T: +6 03 2283 1820 | F: +6 03 2282 8102 | M: +6 012 6784642 | >>>>> www.mgrc.com.my >>>>> ------------------------------ >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> This e-mail is intended only for the use of the individual or >>>>> entity to which it is addressed and may contain confidential and/or >>>>> privileged material. Any review, retransmission, dissemination or other use >>>>> of or taking of any action in reliance upon this information by persons or >>>>> entities other than the intended recipient, is strictly prohibited. If you >>>>> receive this e-mail in error, please contact us immediately by return >>>>> e-mail and delete the original message(s). >>>>> >>>>> ------------------------------ >>>>> This message is private and confidential. If you have received it in >>>>> error, please notify the sender and remove it from your system. >>>>> >>>>> >>>> >>>> >>>> -- >>>> >>>> >>>> >>>> ------------------------------ >>>> MGRC - *Sequence. Analyse. Innovate.* >>>> *Su Seau Yeen >>>> Manager, IT Operations >>>> *** >>>> *Malaysian Genomics Resource Centre Berhad (MGRC)* >>>> T: +6 03 2283 1820 | F: +6 03 2282 8102 | M: +6 012 6784642 | >>>> www.mgrc.com.my >>>> ------------------------------ >>>> >>>> >>>> >>>> >>>> >>>> >>>> >>>> This e-mail is intended only for the use of the individual or entity >>>> to which it is addressed and may contain confidential and/or privileged >>>> material. Any review, retransmission, dissemination or other use of or >>>> taking of any action in reliance upon this information by persons or >>>> entities other than the intended recipient, is strictly prohibited. If you >>>> receive this e-mail in error, please contact us immediately by return >>>> e-mail and delete the original message(s). >>>> >>>> ------------------------------ >>>> This message is private and confidential. If you have received it in >>>> error, please notify the sender and remove it from your system. >>>> >>>> >>> >>> >>> -- >>> >>> >>> >>> ------------------------------ >>> MGRC - *Sequence. Analyse. Innovate.* >>> *Su Seau Yeen >>> Manager, IT Operations >>> *** >>> *Malaysian Genomics Resource Centre Berhad (MGRC)* >>> T: +6 03 2283 1820 | F: +6 03 2282 8102 | M: +6 012 6784642 | >>> www.mgrc.com.my >>> ------------------------------ >>> >>> >>> >>> >>> >>> >>> >>> This e-mail is intended only for the use of the individual or entity >>> to which it is addressed and may contain confidential and/or privileged >>> material. Any review, retransmission, dissemination or other use of or >>> taking of any action in reliance upon this information by persons or >>> entities other than the intended recipient, is strictly prohibited. If you >>> receive this e-mail in error, please contact us immediately by return >>> e-mail and delete the original message(s). >>> >>> ------------------------------ >>> This message is private and confidential. If you have received it in >>> error, please notify the sender and remove it from your system. >>> >>> >> >> >> -- >> >> >> >> ------------------------------ >> MGRC - *Sequence. Analyse. Innovate.* >> *Su Seau Yeen >> Manager, IT Operations >> *** >> *Malaysian Genomics Resource Centre Berhad (MGRC)* >> T: +6 03 2283 1820 | F: +6 03 2282 8102 | M: +6 012 6784642 | >> www.mgrc.com.my >> ------------------------------ >> >> >> >> >> >> >> >> This e-mail is intended only for the use of the individual or entity >> to which it is addressed and may contain confidential and/or privileged >> material. Any review, retransmission, dissemination or other use of or >> taking of any action in reliance upon this information by persons or >> entities other than the intended recipient, is strictly prohibited. If you >> receive this e-mail in error, please contact us immediately by return >> e-mail and delete the original message(s). >> >> ------------------------------ >> This message is private and confidential. If you have received it in >> error, please notify the sender and remove it from your system. >> >> > > > -- > > > > ------------------------------ > MGRC - *Sequence. Analyse. Innovate.* > *Su Seau Yeen > Manager, IT Operations > *** > *Malaysian Genomics Resource Centre Berhad (MGRC)* > T: +6 03 2283 1820 | F: +6 03 2282 8102 | M: +6 012 6784642 | > www.mgrc.com.my > ------------------------------ > > > > > > > > This e-mail is intended only for the use of the individual or entity to > which it is addressed and may contain confidential and/or privileged > material. Any review, retransmission, dissemination or other use of or > taking of any action in reliance upon this information by persons or > entities other than the intended recipient, is strictly prohibited. If you > receive this e-mail in error, please contact us immediately by return > e-mail and delete the original message(s). > > ------------------------------ > This message is private and confidential. If you have received it in > error, please notify the sender and remove it from your system. > > -- ------------------------------ MGRC - *Sequence. Analyse. Innovate.* *Su Seau Yeen Manager, IT Operations ** * *Malaysian Genomics Resource Centre Berhad (MGRC)* T: +6 03 2283 1820 | F: +6 03 2282 8102 | M: +6 012 6784642 | www.mgrc.com.my ------------------------------ This e-mail is intended only for the use of the individual or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of or taking of any action in reliance upon this information by persons or entities other than the intended recipient, is strictly prohibited. If you receive this e-mail in error, please contact us immediately by return e-mail and delete the original message(s).

3 4

Where I can report bugs of OpenLDAP?
by Tianyin Xu 25 Mar '12

25 Mar '12

Hi, all, Does anyone know where I can report bugs in OpenLDAP? It seems that OpenLDAP does not have bugzilla. Thanks, Tianyin -- Tianyin XU, http://cseweb.ucsd.edu/~tixu/

2 1

clarification on N-way MMR
by mallapadi niranjan 25 Mar '12

25 Mar '12

Hi all, I am configuring N-way mmr between 2 Providers (there are no consumers as of now) . My master servers are in this case: ldap1.example.org and ldap2.example.org . version used are: openldap-servers-2.4.23-20.el6.x86_64 I am using http://www.openldap.org/doc/admin24/replication.html#N-Way%20Multi-Masteras my reference for configuration. My syncrepl for cn=config database is as follows: #Specify ServerID for both the masters dn: cn=config changetype: modify add: olcServerID olcServerID: 101 ldap://ldap1.example.org olcServerID: 201 ldap://ldap2.example.org #Enable Syncprov Overlay for config database dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config changetype: add objectclass: olcOverlayConfig objectclass: olcSyncProvConfig olcOverlay: syncprov #Configure SyncRepl for config database dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=ldap://ldap1.example.orgbinddn="cn=admin,cn=config" bindmethod=simple credentials=config searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncRepl: rid=002 provider=ldap://ldap2.example.orgbinddn="cn=admin,cn=config" bindmethod=simple credentials=config searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 - add: olcMirrorMode olcMirrorMode: TRUE my syncrepl for bdb is as follows: dn: olcDatabase={2}bdb,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=003 provider=ldap://ldap1.example.orgbinddn="cn=replicator,ou=Admins,dc=example,dc=org" bindmethod=simple credentials=Secret123 searchbase="dc=example,dc=org" type=refreshAndPersist retry="5 5 5 +" olcSyncRepl: rid=004 provider=ldap://ldap2.example.orgbinddn="cn=replicator,ou=Admins,dc=example,dc=org" bindmethod=simple credentials=Secret123 searchbase="dc=example,dc=org" type=refreshAndPersist retry="5 5 5 +" - add: olcMirrorMode olcMirrorMode: TRUE dn: olcOverlay=syncprov,olcDatabase={2}bdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov Q) I would like to know should i have 2 syncrepl agreements in both Masters (ldap1.example.org and ldap2.example.org) Q) On provider-1 (ldap1.example.org) can i just have 1 single olcsyncrepl specifying the provider as "ldap2" ? dn: olcDatabase={2}bdb,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=003 provider=ldap://ldap2.example.orgbinddn="cn=replicator,ou=Admins,dc=example,dc=org" bindmethod=simple credentials=Secret123 searchbase="dc=example,dc=org" type=refreshAndPersist retry="5 5 5 +" - add: olcMirrorMode olcMirrorMode: TRUE Q) What is the use of specify the olcsyncrepl which is pointing to it's own provider ? Any pointers on the above would be helpful Regards Niranjan

1 0

moduleload is buggy because of libltdl
by Tianyin Xu 25 Mar '12

25 Mar '12

I used the newest version, i.e., OpenLDAP-2.4.30, my OS is ubuntu 10.04, and the libltdl version is 2.2.6b-2ubuntu1. I used the following configuration setting in my slapd.conf, trying to load a module. moduleload /home/tianyin/openldap-2.4.30/module/mod_info.so start slapd, and the log shows that: Mar 24 22:06:49 tianyin-desktop slapd[7952]: lt_dlopenext failed: (/home/tianyin/openldap-2.4.30/module/mod_info.so) file not found I'm sure that I used the correct path by ls the path (i'm not stupid) # ll /home/tianyin/openldap-2.4.30/module/mod_info.so -rwxr-xr-x 1 tianyin tianyin 194708 2012-03-24 21:05 /home/tianyin/openldap-2.4.30/module/mod_info.so* use gdb to trace the code. I find the problem is caused by libltdl: if ((module->lib = lt_dlopenext(file)) == NULL) { error = lt_dlerror(); #ifdef HAVE_EBCDIC strcpy( ebuf, error ); __etoa( ebuf ); error = ebuf; #endif => Debug(LDAP_DEBUG_ANY, "lt_dlopenext failed: (%s) %s\n", file_name, error, 0); the call chain is as follows: #0 module_load (file_name=0x91507b "/home/tianyin/openldap-2.4.30/module/mod_info.so", argc=0, argv=0x0) at module.c:190 #1 0x0000000000421284 in config_generic (c=0x915760) at bconfig.c:2021 #2 0x0000000000433a00 in config_set_vals (Conf=0x814a40, c=0x915760) at config.c:345 #3 0x0000000000433f5f in config_add_vals (Conf=0x814a40, c=0x915760) at config.c:418 #4 0x00000000004351b3 in read_config_file (fname=0x5a0a98 "/home/tianyin/openldap-2.4.30/etc/openldap/slapd.conf", depth=0, cf=0x0, cft=0x8140c0) at config.c:783 #5 0x000000000042846b in read_config (fname=0x0, dir=0x0) at bconfig.c:4213 #6 0x000000000041c217 in main (argc=1, argv=0x7fffffffe2f8) at main.c:792 error returned by lt_dlerror() is a misleading log message, which is really annoying. Thanks, Tianyin -- Tianyin XU, http://cseweb.ucsd.edu/~tixu/

1 0

2.4.30 - libldap & libldap_r do not coexist
by Amol Kulkarni 24 Mar '12

24 Mar '12

Hi, I've a program which links to both libldap & libldap_r dynamically. I've been running this program with openldap 2.4.23 without any problem. But when I upgraded to openldap 2.4.30, the program crashes with segfault. The crash occurs at the end when the program is closing connections. I googled and found that libldap & libldap_r should not be used in same process space bcos they one is non-threadsafe and other is threadsafe and they have same symbols. It is difficult for me to solve the problem by changing my compile configuration bcos my program loads 2 third party libraries which load these different versions of ldaplibraries. One solution for me is to make a soft link from libldap to libldap_r, i.e make everyone use the threadsafe library. Would it be create any problems ? Also, can anyone tell why I did not face the problem in 2.4.23 - I mean is there any compile time setting in openldap for this - which I've missed in 2.4.30 ? Thanks and Regards, Amol Kulkarni.

1 0

nested groups for openldap v2.2
by Utsav Mohata 23 Mar '12

23 Mar '12

Hi All, Versions of my software are : OpenLDAP 2.2.13-7.4E Samba : 3.0.10-1.4E.11 I am a newbie trying to implement nested groups for openLDAP. Does the above version of OpenLDAP support nested groups ? I have been trying multiple ways to implement nested groups (1) As per my understanding, I could add sids of the subgroups as value of sambSIDList My ldif file : dn: cn=PDM,ou=Groups,dc=example,dc=com cn: PDM objectClass: posixGroup objectClass: sambaGroupMapping gidNumber: 625 sambaSid: S-1-5-21-3782130030-2455357663-1162092550-626 sambaGroupType: 2 sambaSIDList: S-1-5-21-3782130030-2455357663-1162092550-620 <-- another group entry sambaSIDList: S-1-5-21-3782130030-2455357663-1162092550-622 <- another group entry This does not work for me. I read somewhere that this just works for local groups and not domain groups which all of the above groups are. (2) Another idea was to edit the nis.schema and include "member" attribute in posixGroup, which can take other group entries as members. My ldif file is: dn: cn=LKM2,ou=Groups,dc=example,dc=com cn: LKM2 objectClass: posixGroup objectClass: sambaGroupMapping objectClass: top gidNumber: 6099 sambaSid: S-1-5-21-3782130030-2455357663-1162092550-6090 sambaGroupType: 5 displayName: example member: cn=LKM,ou=groups,dc=example,dc=com member: cn=ken1,ou=People, dc=example,dc=com Even this did not work. Am I missing something? Do let me know if I should post output of something else also. Thanks in advance. Apologies if I posted this twice. Rgds, Utsav

1 0

which is the structural object class for posixAccount/shadowAccount?
by stefano 23 Mar '12

23 Mar '12

hi, i've a second question: posixAccount and posixShadow are auxiliary objectClasses but i don't understand which is their structural objectclass. i've seen some examples with account object class. is it this one?

2 1

access to ... by Administrator
by stefano 23 Mar '12

23 Mar '12

Hi, i've a question. am configuring the ACLs in slapd.conf. is it necessary to specify the Administrator DN in the "who" field? ex: access to attrs=userPassword by dn="cn=Manager,dc=example,dc=com" Do i have to specify it or the administrator has the access right to every attribute?

3 3

Re: ACLs for children entry
by Hallvard Breien Furuseth 23 Mar '12

23 Mar '12

On Thu, 22 Mar 2012 14:22:45 +0100, Natalia <nata.cs2(a)gmail.com> wrote: > I have the following tree structure in LDAP: > ou=people,dc=example,dc=com > uid=user1,ou=people,dc=example,dc=com > > cn=child1,uid=user1,ou=people,dc=example,dc=com > cn=child2,uid=user1,ou=people,dc=example,dc=com > uid=user2,ou=people,dc=example,dc=com > .. > > I would like to make access in such a way: if fathers account > (uid=user1,ou=people,dc=example,dc=com) is inactivated > (description=inaktiv), all children become inaccessible. Something like this, I think. Untested, sorry. to dn.regex=",(uid=[^,]+,ou=people,dc=example,dc=com)$" by set.expand="[$1]/description & inaktiv" none by group.exact="cn=ldapadmin,dc=example,dc=com" tls_ssf=128 sasl_ssf=56 write by * +0 break I.e. access to: any children of an uid=... entry. 1. Look up 'description' in entry $1 ("uid=...), and refuse access if it matches 'inaktiv'. 2. For other entries, ldap admin over TLS+SASL gets full access. 3. For everyone else, skip this access statement and go on to check the following access 'to' statements. Drop the regexps' initial "," to also control the uid=... entry. Swap (1) and (2) to also give admin access to inactive subtrees. Replace (3) with e.g. 'by * read' to instead give others read access. > I have tried with this, but it has not functioned: > to dn.regex="uid=([^,]+),ou=people,dc=example,dc=com" > filter="(description=inaktiv)" attrs=children > by group.exact="cn=ldapadmin,dc=example,dc=com" tls_ssf=128 > sasl_ssf=56 write > by * none That's not what "()" in regexps, filter, and children mean. See man slapd.access. The access syntax tries to make sensible access statements readable, but that doesn't mean any readable access statement is sensible:-) This is what your access statement means: When accessing e.g. the entry "cn=child1,...", your dn.regex is checked against the DN, and matches. But the filter is checked against the cn=child1 entry, not against a parent entry. That does not match. Nor does attrs=children usually match - that's a pseudo-attribute which Add/Delete/Rename check in the parent entry of the entry being added. So this access statement is skipped, since the 'to' statement normally does not match. If it had matched, you'd then give write access to ldapadmin if they use TLS and SASL. Nobody else would get access. -- Hallvard

2 1

Replicating a translucent database
by David Arroyo 23 Mar '12

23 Mar '12

Hello, Does anyone have experience with replicating the "local" part of a translucent proxy? I've gotten into the habit of running redundant pairs for everything. Since translucent uses back-ldap, which sets lastmod off, traditional replication via syncrepl doesn't work. Right now I'm only supporting a directory of about 2000 engineers, so it is feasible to use some combination of slapcat and ldapadd/ldapmodify magic to update a secondary server. I could also slapcat the translucent database and take down the secondary server while the database is rebuilt. One idea I had is to copy the local translucent database to a separate (non-proxy)server every N hours, and have any slaves replicate off of that. However, due to schema checking I cannot simply copy a translucent db to a non-translucent one due to all the glue and missing attributes. I've found the translucent overlay (and openLDAP's flexibility in general) to be a lifesaver. If anyone has any ideas or experience with this particular challenge, I'd love to hear about it. Cheers, David Arroyo

1 0

Re: Root not allowed to login
by SYeen Su 23 Mar '12

23 Mar '12

Hello Chris, THis is what I got when I tried logging in from the KVM console/ILOM: login: pam_ldap: error trying to bind as user "uid=root,ou=People,dc=synamatix,dc=com" (Invalid credentials) Mar 23 10:44:40 mgrc-prod-sdb9 login: ROOT LOGIN ON tty1 It will alaways try to bind as user "uid=root" even though root is local. On Fri, Mar 23, 2012 at 10:37 AM, Chris Jacobs <Chris.Jacobs(a)apollogrp.edu>wrote: > What do your logs say when root tries to login? > > > Chris Jacobs > Systems Administrator, Technology Services Group > > Apollo Group | Apollo Marketing & Product Development | Aptimus, Inc. > 1501 4th Ave | Suite 2500 | Seattle, WA 98101 > direct 206.839.8245 | cell 206.601.3256 | Fax 206.644.0628 > email: chris.jacobs(a)apollogrp.edu > > ------------------------------ > *From*: SYeen Su <seauyeen(a)mgrc.com.my> > *To*: Chris Jacobs > *Cc*: mlstarling31(a)hotmail.com <mlstarling31(a)hotmail.com>; > openldap-technical(a)openldap.org <openldap-technical(a)openldap.org> > *Sent*: Thu Mar 22 19:32:07 2012 > > *Subject*: Re: Root not allowed to login > > Hi Chris, > > For testing purpose I disabled the PermitRootLogin to yes temporarily. > Usually it's no and the failure was noticed when the server lost connection > to the ldap server and even root ( that's local) is not able to log in. > Hence, I started investigating what is wrong. Bottomline, via console, root > is not able to log in if there is no network connectivity to ldap and I am > trying to solve this issue because if even root and any othe rlocal users > cannot log in via console, I am not able to check what is wrong with the > network, the only option is to reboot, which is what I'd like to avoid. > > > On Fri, Mar 23, 2012 at 10:14 AM, Chris Jacobs <Chris.Jacobs(a)apollogrp.edu > > wrote: > >> Syeen, >> >> Are you trying to login remotely? Or at the local console? >> >> If remotely, this may be standard behavior as usually PermitRootLogin is >> set to no in /etc/ssh/sshd_config - which I would NOT recommend changing. >> During an outage, local console access would have to be used (via ILO, some >> KVM over IP, etc, solution). >> >> Other than that, everything in your system-auth-ac and nsswitch.conf look >> fine to me. >> >> - chris >> >> >> *Chris Jacobs,** *Jr. Unix System Administrator >> Apollo Group | Apollo Marketing | ITG >> >> 2001 6th Ave, Suite 3200 | Seattle, WA 98121-2522 >> phone: 206.441.9100 x1245 | mobile: 206.601.3256 | fax: 206.441.9661 >> >> email: chris.jacobs(a)apollogrp.edu >> >> ------------------------------ >> *From:* SYeen Su [seauyeen(a)mgrc.com.my] >> *Sent:* Thursday, March 22, 2012 7:13 PM >> >> *To:* Chris Jacobs >> *Cc:* mlstarling31(a)hotmail.com; openldap-technical(a)openldap.org >> *Subject:* Re: Root not allowed to login >> >> Hi Chris, >> >> Exactly, all my configuration seems correct as I have compared. Hmm let's >> just say i am not familiar with sssd and to migrate to sssd, I think i >> gotta spend some time studying it. So, i know, i took the easy way out by >> just porting over my previous ldap configuration to RHEL6. >> >> Anyway, my snippets from /etc/nsswitch.conf file as below: >> >> *passwd: files ldap >> shadow: files ldap >> group: files ldap >> * >> It matches yours too, right? If i put the sequence the other way round, >> root practically cannot log in at all! >> >> What else do I need to configure on my client side? I am lost! >> >> On Fri, Mar 23, 2012 at 10:10 AM, Chris Jacobs < >> Chris.Jacobs(a)apollogrp.edu> wrote: >> >>> Again, this isn't an openldap issue, but... >>> >>> Your /etc/pam.d/system-auth-ac file looks fine to me - it matches both >>> our CentOS5 and CentOS6 machines. >>> >>> I looked and was unable to find any attachments or included snippets >>> from your /etc/nsswitch.conf file. >>> >>> On our systems using PADL's pam_ldap, you should have in there: >>> passwd: files ldap >>> shadow: files ldap >>> group: files ldap >>> >>> Digression: I'm a little surprised you're using pam's padl software. >>> Between nss-pam-ldapd and sssd we decided to embrace the apparent future >>> and have successfully moved to sssd for our CentOS 6 boxes. >>> ** This doesn't impact your problem though. ** >>> >>> *Chris Jacobs,** *Jr. Unix System Administrator >>> Apollo Group | Apollo Marketing | ITG >>> >>> 2001 6th Ave, Suite 3200 | Seattle, WA 98121-2522 >>> phone: 206.441.9100 x1245 | mobile: 206.601.3256 | fax: 206.441.9661 >>> >>> email: chris.jacobs(a)apollogrp.edu >>> >>> ------------------------------ >>> *From:* SYeen Su [seauyeen(a)mgrc.com.my] >>> *Sent:* Thursday, March 22, 2012 6:22 PM >>> *To:* Chris Jacobs >>> *Cc:* mlstarling31(a)hotmail.com; openldap-technical(a)openldap.org >>> >>> *Subject:* Re: Root not allowed to login >>> >>> Hi Chris, >>> >>> That's what I suspect too but I am not sure how else to tweak my pam and >>> nsswitch files. Do you have any suggestions? Below is my pam.d/system-auth >>> file and my nsswitch file excerpt has been attached previously. >>> >>> #%PAM-1.0 >>> # This file is auto-generated. >>> # User changes will be destroyed the next time authconfig is run. >>> auth required pam_env.so >>> auth sufficient pam_unix.so nullok try_first_pass >>> auth requisite pam_succeed_if.so uid >= 500 quiet >>> auth sufficient pam_ldap.so use_first_pass >>> auth required pam_deny.so >>> >>> account required pam_unix.so broken_shadow >>> account sufficient pam_localuser.so >>> account sufficient pam_succeed_if.so uid < 500 quiet >>> account [default=bad success=ok user_unknown=ignore] pam_ldap.so >>> account required pam_permit.so >>> >>> password requisite pam_cracklib.so try_first_pass retry=3 >>> dcredit=-2 ucredit=-2 lcredit=-2 ocredit=-2 minlen=8 type=strong >>> password sufficient pam_unix.so md5 shadow nullok try_first_pass >>> use_authtok >>> password sufficient pam_ldap.so use_authtok >>> password required pam_deny.so >>> >>> session optional pam_keyinit.so revoke >>> session required pam_limits.so >>> session [success=1 default=ignore] pam_succeed_if.so service in >>> crond quiet use_uid >>> session required pam_unix.so >>> session optional pam_ldap.so >>> >>> Is there anything amiss with my pam file? If you need to have a look at >>> my login and sshd pam file, please tell me so. >>> >>> Thanks a lot. >>> >>> On Fri, Mar 23, 2012 at 9:17 AM, Chris Jacobs < >>> Chris.Jacobs(a)apollogrp.edu> wrote: >>> >>>> The timeouts are how long to wait for ldap to respond. It should >>>> check local (normally via pam) next. >>>> >>>> We have our user's in LDAP and can still login using the local accounts. >>>> >>>> Your issue isn't an LDAP problem, it's a pam/nsswitch/local issue. >>>> >>>> - chris >>>> >>>> Chris Jacobs >>>> Systems Administrator, Technology Services Group >>>> >>>> Apollo Group | Apollo Marketing & Product Development | Aptimus, >>>> Inc. >>>> 1501 4th Ave | Suite 2500 | Seattle, WA 98101 >>>> direct 206.839.8245 | cell 206.601.3256 | Fax 206.644.0628 >>>> email: chris.jacobs(a)apollogrp.edu >>>> >>>> ------------------------------ >>>> *From*: openldap-technical-bounces(a)OpenLDAP.org<openldap-technical-bounces(a)OpenLDAP.org> >>>> >>>> *To*: Michael Starling <mlstarling31(a)hotmail.com> >>>> *Cc*: openldap <openldap-technical(a)openldap.org> >>>> *Sent*: Thu Mar 22 18:10:55 2012 >>>> *Subject*: Re: Root not allowed to login >>>> >>>> Hi Michael, >>>> >>>> I have changed the timelimit and bind_timelimit to 4 but it still >>>> checks with ldap immediately ( I mean when root logs in ). i doubt it has >>>> anything to do with the time because it checks immediately without any >>>> delay. >>>> >>>> On Thu, Mar 22, 2012 at 9:51 PM, Michael Starling < >>>> mlstarling31(a)hotmail.com> wrote: >>>> >>>>> Try setting your timelimt and bind_timelimit to something like a bit >>>>> lower. >>>>> >>>>> timelimit 4 >>>>> >>>>> bind_timelimit 4 >>>>> >>>>> ------------------------------ >>>>> Date: Thu, 22 Mar 2012 17:03:56 +0800 >>>>> Subject: Root not allowed to login >>>>> From: seauyeen(a)mgrc.com.my >>>>> To: openldap-technical(a)openldap.org >>>>> >>>>> >>>>> Hi, >>>>> >>>>> My client is installed with RHEL 6.0 and I am using OpenLDAP 2.4. When >>>>> the box loses connection with the ldap server, even the root cannot log in >>>>> as it tries to bind with the ldap server. This can be seen when I log in >>>>> with root and the message below appears : >>>>> >>>>> sshd: pam_ldap: error trying to bind as user "uid=root, ou=People, >>>>> dc=example,dc=com" (Invalid credentials). >>>>> >>>>> My root user is not even in the ldap database. When connection is >>>>> fine, the message above does not affect the login of root. The login of >>>>> root is only screwed up when the box loses connectivity. >>>>> >>>>> Attached are my pam.d/system-auth file, pam.d/login, pam./dsshd and >>>>> ldap.conf files. >>>>> >>>>> I have been googling around but some either switch to kerberos, or the >>>>> question is left unatttended to. Please help. I can only resort to >>>>> restarting the box whenever this happens. How can I configure the ldap so >>>>> that local users can login when there's no connectivity to ldap server? >>>>> >>>>> Thanks heaps! >>>>> >>>>> -- >>>>> >>>>> >>>>> >>>>> ------------------------------ >>>>> MGRC - *Sequence. Analyse. Innovate.* >>>>> *Su Seau Yeen >>>>> Manager, IT Operations >>>>> *** >>>>> *Malaysian Genomics Resource Centre Berhad (MGRC)* >>>>> T: +6 03 2283 1820 | F: +6 03 2282 8102 | M: +6 012 6784642 | >>>>> www.mgrc.com.my >>>>> ------------------------------ >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> This e-mail is intended only for the use of the individual or >>>>> entity to which it is addressed and may contain confidential and/or >>>>> privileged material. Any review, retransmission, dissemination or other use >>>>> of or taking of any action in reliance upon this information by persons or >>>>> entities other than the intended recipient, is strictly prohibited. If you >>>>> receive this e-mail in error, please contact us immediately by return >>>>> e-mail and delete the original message(s). >>>>> >>>> >>>> >>>> >>>> -- >>>> >>>> >>>> >>>> ------------------------------ >>>> MGRC - *Sequence. Analyse. Innovate.* >>>> *Su Seau Yeen >>>> Manager, IT Operations >>>> *** >>>> *Malaysian Genomics Resource Centre Berhad (MGRC)* >>>> T: +6 03 2283 1820 | F: +6 03 2282 8102 | M: +6 012 6784642 | >>>> www.mgrc.com.my >>>> ------------------------------ >>>> >>>> >>>> >>>> >>>> >>>> >>>> >>>> This e-mail is intended only for the use of the individual or entity >>>> to which it is addressed and may contain confidential and/or privileged >>>> material. Any review, retransmission, dissemination or other use of or >>>> taking of any action in reliance upon this information by persons or >>>> entities other than the intended recipient, is strictly prohibited. If you >>>> receive this e-mail in error, please contact us immediately by return >>>> e-mail and delete the original message(s). >>>> >>>> ------------------------------ >>>> This message is private and confidential. If you have received it in >>>> error, please notify the sender and remove it from your system. >>>> >>>> >>> >>> >>> -- >>> >>> >>> >>> ------------------------------ >>> MGRC - *Sequence. Analyse. Innovate.* >>> *Su Seau Yeen >>> Manager, IT Operations >>> *** >>> *Malaysian Genomics Resource Centre Berhad (MGRC)* >>> T: +6 03 2283 1820 | F: +6 03 2282 8102 | M: +6 012 6784642 | >>> www.mgrc.com.my >>> ------------------------------ >>> >>> >>> >>> >>> >>> >>> >>> This e-mail is intended only for the use of the individual or entity >>> to which it is addressed and may contain confidential and/or privileged >>> material. Any review, retransmission, dissemination or other use of or >>> taking of any action in reliance upon this information by persons or >>> entities other than the intended recipient, is strictly prohibited. If you >>> receive this e-mail in error, please contact us immediately by return >>> e-mail and delete the original message(s). >>> >>> ------------------------------ >>> This message is private and confidential. If you have received it in >>> error, please notify the sender and remove it from your system. >>> >>> >> >> >> -- >> >> >> >> ------------------------------ >> MGRC - *Sequence. Analyse. Innovate.* >> *Su Seau Yeen >> Manager, IT Operations >> *** >> *Malaysian Genomics Resource Centre Berhad (MGRC)* >> T: +6 03 2283 1820 | F: +6 03 2282 8102 | M: +6 012 6784642 | >> www.mgrc.com.my >> ------------------------------ >> >> >> >> >> >> >> >> This e-mail is intended only for the use of the individual or entity >> to which it is addressed and may contain confidential and/or privileged >> material. Any review, retransmission, dissemination or other use of or >> taking of any action in reliance upon this information by persons or >> entities other than the intended recipient, is strictly prohibited. If you >> receive this e-mail in error, please contact us immediately by return >> e-mail and delete the original message(s). >> >> ------------------------------ >> This message is private and confidential. If you have received it in >> error, please notify the sender and remove it from your system. >> >> > > > -- > > > > ------------------------------ > MGRC - *Sequence. Analyse. Innovate.* > *Su Seau Yeen > Manager, IT Operations > *** > *Malaysian Genomics Resource Centre Berhad (MGRC)* > T: +6 03 2283 1820 | F: +6 03 2282 8102 | M: +6 012 6784642 | > www.mgrc.com.my > ------------------------------ > > > > > > > > This e-mail is intended only for the use of the individual or entity to > which it is addressed and may contain confidential and/or privileged > material. Any review, retransmission, dissemination or other use of or > taking of any action in reliance upon this information by persons or > entities other than the intended recipient, is strictly prohibited. If you > receive this e-mail in error, please contact us immediately by return > e-mail and delete the original message(s). > > ------------------------------ > This message is private and confidential. If you have received it in > error, please notify the sender and remove it from your system. > > -- ------------------------------ MGRC - *Sequence. Analyse. Innovate.* *Su Seau Yeen Manager, IT Operations ** * *Malaysian Genomics Resource Centre Berhad (MGRC)* T: +6 03 2283 1820 | F: +6 03 2282 8102 | M: +6 012 6784642 | www.mgrc.com.my ------------------------------ This e-mail is intended only for the use of the individual or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of or taking of any action in reliance upon this information by persons or entities other than the intended recipient, is strictly prohibited. If you receive this e-mail in error, please contact us immediately by return e-mail and delete the original message(s).

1 0

Root not allowed to login
by SYeen Su 23 Mar '12

23 Mar '12

Hi, My client is installed with RHEL 6.0 and I am using OpenLDAP 2.4. When the box loses connection with the ldap server, even the root cannot log in as it tries to bind with the ldap server. This can be seen when I log in with root and the message below appears : sshd: pam_ldap: error trying to bind as user "uid=root, ou=People, dc=example,dc=com" (Invalid credentials). My root user is not even in the ldap database. When connection is fine, the message above does not affect the login of root. The login of root is only screwed up when the box loses connectivity. Attached are my pam.d/system-auth file, pam.d/login, pam./dsshd and ldap.conf files. I have been googling around but some either switch to kerberos, or the question is left unatttended to. Please help. I can only resort to restarting the box whenever this happens. How can I configure the ldap so that local users can login when there's no connectivity to ldap server? Thanks heaps! -- ------------------------------ MGRC - *Sequence. Analyse. Innovate.* *Su Seau Yeen Manager, IT Operations ** * *Malaysian Genomics Resource Centre Berhad (MGRC)* T: +6 03 2283 1820 | F: +6 03 2282 8102 | M: +6 012 6784642 | www.mgrc.com.my ------------------------------ This e-mail is intended only for the use of the individual or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of or taking of any action in reliance upon this information by persons or entities other than the intended recipient, is strictly prohibited. If you receive this e-mail in error, please contact us immediately by return e-mail and delete the original message(s).

4 10

OPENLDAP & SSL -- FOR FAILOVER
by Borresen, John - 0442 - MITLL 22 Mar '12

22 Mar '12

Question: Right now, we have two OpenLDAP servers running in Delta-syncrepl and talking fine. All the clients are connecting to the primary over port 636. The question is on the best (practices) way of getting the secondary server into the certificate without re-hashing all the clients to the failover server's certificate. 1) Should I set up a Wildcard certificate? 2) Should I put both systems in the "subjectAltName" line and create the certifiate, etc? 3) DNS Round-Robin? Not 100% sure in which direction to go. Dave Borresen Solaris/Linux Systems Administrator Surveillance Systems Group MIT Lincoln Laboratory 244 Wood Street Lexington, MA 02420 john.borresen(a)ll.mit.edu

4 3

ACLs for children entry
by Natalia 22 Mar '12

22 Mar '12

Hello, I have the following tree structure in LDAP: ou=people,dc=example,dc=com uid=user1,ou=people,dc=example,dc=com cn=child1,uid=user1,ou=people,dc=example,dc=com cn=child2,uid=user1,ou=people,dc=example,dc=com uid=user2,ou=people,dc=example,dc=com .. I would like to make access in such a way: if father's account (uid=user1,ou=people,dc=example,dc=com) is inactivated (description=inaktiv), all children become inaccessible. I have tried with this, but it has not functioned: to dn.regex="uid=([^,]+),ou=people,dc=example,dc=com" filter="(description=inaktiv)" attrs=children by group.exact="cn=ldapadmin,dc=example,dc=com" tls_ssf=128 sasl_ssf=56 write by * none Is it possible to implement such a thing? Thanks in advance for help! Natalia

1 0

RE: openLDAP as a proxy for AD
by Chris O'Kelly 22 Mar '12

22 Mar '12

>Thanks Alex for replying, >... >... OK, a days work has led me to discover that while apt-get purge --auto-remove slapd ldap-utils does not actually purge slapd or ldap-utils, but appears to uninstall them and purge all their dependencies. I think this was behind my larger issues with openldap, apt-get purge slapd ldap-utils fixed that for me. I am now circling back around to my original problem. to clarify, there are 2 servers. DC Server - AD set up, internal users and groups and policy etc. All working fine. ubuntu server - OpenLDAP set up, external users usernames and passwords. we need our various web apps to point to this for authentication and return users from either of the DSA's backend of openLDAP currently set up like this (basically straight from a tutorial) - # Load dynamic backend modules dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulepath: /usr/lib/ldap olcModuleload: back_hdb olcModuleload: back_ldap # Database settings dn: olcDatabase=hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcSuffix: dc=companyname,dc=local olcDbDirectory: /var/lib/ldap olcRootDN: cn=admin,dc=companyname,dc=local olcRootPW: secret olcDbConfig: set_cachesize 0 2097152 0 olcDbConfig: set_lk_max_objects 1500 olcDbConfig: set_lk_max_locks 1500 olcDbConfig: set_lk_max_lockers 1500 olcDbIndex: objectClass eq olcLastMod: TRUE olcDbCheckpoint: 512 30 olcAccess: to attrs=userPassword by dn="cn=admin,dc=companyname,dc=local" write by anonymous auth by self write by * none olcAccess: to attrs=shadowLastChange by self write by * read olcAccess: to dn.base="" by * read olcAccess: to * by dn="cn=admin,dc=companyname,dc=local" write by * read I am trying to get the proxy set up at dc=AD,dc=companyname,dc=local. so far my slapd.conf is - # AD server proxy database ldap suffix "dc=AD,dc=companyname,dc=local" uri ldap://companyname.local/ idassert-bind bindmethod=simple binddn="cn=admin,dc=companyname,dc=local" credentials=secret authzID="dn:cn=admin,dc=companyname,dc=local" however on running slaptest I get slapd.conf: line 4: <suffix> invalid DN 21 (Invalid syntax) slaptest: bad configuration directory! I tried suffix with and without the "s to no avail. A side question which neither man slaptest nor google has answered for me thusfar, will slaptest add the configuration to slapd.d or overwrite it? I do totally get that I am basically asking someone to do my job for me here, which is not a habit I like to cultivate but I would be eternally grateful if anyone could just point me in the right direction. I have done enough tech support to be frustrated to be on this side of the RTFM coin but I assure you I have trawled man pages, tutorials and forums before I came here.

1 0

RE: openLDAP as a proxy for AD
by Chris O'Kelly 22 Mar '12

22 Mar '12

Thanks Alex for replying, I was rather optimistic about this until I realized I have bigger problems now, I had been putting the subordinate directive in the definition for the back_ldap db, not the normal hdb on openldap OK so I have a whole lot of problems at this point. I believe I have seriously broken something in trying to slaptest or ldapadd a bunch of slapd.conf/ldif files, following various tutorials. Tried to follow your steps this morning but found I was getting - ldap_add: Server is unwilling to perform (53) additional info: no global superior knowledge and more often than not was unable to authenticate, either in CLI or by Apache directory studio. So once again I apt-get purge --auto-remove slapd ldap-utils and installed again, however I found that all the broken configuration I had tried so far was immediately back in /etc/ldap/slapd.d again as soon as I installed. (not the default config which would be in there immediately after install, the big list of faulty databases I had added erroneously before). I had checked and the whole /etc/ldap directory WAS removed during the purge. So I ran the purge again, then ran a find and deleted /var/lib/ldap and /usr/lib/ldap, then installed again. Now, when I tried to start again, following http://doc.ubuntu.com/ubuntu/serverguide/C/openldap-server.html to start with, I can't even get off the starting line! My first step, running sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/cosine.ldif returns - ldap_add: Other (e.g., implementation specific) error (80) additional info: olcAttributeTypes: Duplicate attributeType: "0.9.2342.19200300.100.1.2" and I get the same response ldapadding pretty much anything, with a different value for attributeType. Again it appears that purging and reinstalling does not get me back to a default installation but I am not sure what else I need to delete. On another note, following your advice, this is essentially what I have boiled my slapd.conf down to (for once I can actually use openLDAP again). Do you see any glaring omissions or obvious errors here? include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema moduleload back_ldap.la moduleload back_hdb.la # Specify first database database hdb suffix "dc=external users,dc=companyname,dc=local" rootdn "cn=admin,dc=companyname,dc=local" rootpw secret directory /var/lib/ldap/ subordinate advertise # Specify other databases database ldap suffix "dc=companyname,dc=local" rootdn "cn=admin,dc=companyname,dc=local" uri ldap://companyname.local/ rebind-as-user TRUE chase-referrals TRUE

1 0

OpenLDAP client and SSL handshaek
by Jon Dufresne 21 Mar '12

21 Mar '12

Hi, I am using OpenLDAP as a client to connect to a 3rd party Oracle Internet Directory 10g. After recent updates, I have been unable to successfully bind with the LDAP server. I believe this is an error with the SSL handshake because the following command will not negotiate an SSL protocol: $ openssl s_client -connect HOST:636 ... Failure While adding the -no_tls1 flag will: $ openssl s_client -connect HOST:636 -no_tls1 ... Success When I attempt to connect to the server using ldapsearch, I receive the following: $ ldapsearch -d7 -x -H ldaps://HOST:636 -D "BIND_DN" -W ldap_url_parse_ext(ldaps://HOST:636) ldap_create ldap_url_parse_ext(ldaps://HOST:636/??base) ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP HOST:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying HOST_IP:636 ldap_pvt_connect: fd: 3 tm: -1 async: 0 TLS: could not add the certificate (null) - error -8018:Unknown PKCS #11 error.. TLS: /etc/openldap/cacerts/addtrust-ca.crt is not a valid CA certificate file - error -8018:Unknown PKCS #11 error.. TLS: could perform TLS system initialization. TLS: error: could not initialize moznss security context - error -8018:Unknown PKCS #11 error. TLS: can't create ssl handle. ldap_err2string ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) TLS: could not shutdown NSS - error -8053:NSS could not shutdown. Objects are still in use.. Is there a way, either through the ldap.conf, an environment variable, or through the API, to ignore the TLS portion of the handshake? Am I mistaken and something else is wrong here? Regards, Jon

5 12

Multimaster assumptions
by Ondrej Kuznik 21 Mar '12

21 Mar '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, we are preparing to set up a more or less extensive test suite for deltasync multimaster replication. Since the resolution of conflicts can be arbitrary (as long as it is consistent), I would like to have a way to compare the outcome to a single authoritative DIT, the "observer" below. Preconditions: - - all servers start with an identical database - - each server has unique serverID assigned A thought experiment: There are N servers acting as delta-syncrepl providers, arbitrary changes flow to some/all of the servers. The "replication topology" is arbitrary and volatile, but from some moment on it is guaranteed that it will stay strongly connected. Let us add another server and call it an "observer". An observer acts as a delta-syncrepl consumer to a (possibly changing) set of providers and it never acts as a provider to any of the servers. Given the above and barring any software bugs, I guess it is intended that if all servers are running recent OpenLDAP the following should hold for the experiment: - - given that the flow of changes stops eventually, the (actual) replication traffic will eventually stop too with all N servers holding the exact same DIT - - given the above, the (actual) replication traffic to the observer too will stop eventually with the observer holding the exact same DIT as the servers. Are my expectations reasonable or should the experiment be restricted to achieve that outcome of having a reliable observer node? How about generalizing the experiment by allowing that some of the replication connections be plain syncrepl? Even though this experiment might be exaggerated, I still feel like stating what is a tautology according to the design from my point of view, but I would like to hear whether it is supposed to work even under these conditions. Cheers, - -- Ondrej Kuznik -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAk9p0z0ACgkQ9GWxeeH+cXuUYgCgiy0RS7wC4H6Vw67Mjv673Gm1 V20AnjL/qz8e0vw7HcJdUwA9rJaBM05a =ygxQ -----END PGP SIGNATURE----- This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you for understanding.

1 0

Re: Scaling LDAP
by Gaurav Gugnani 21 Mar '12

21 Mar '12

Hello Gibson, Thks for replying. However, my concern is: In our production system we have 8GB of ram with 100GB hard disk. So till what limit it the Read/Write operation to LDAP goes smoothly. Lets say - 1 row of data is 10K bytes. Please don't mind - but we are planning for the afterwards approach. (What to do - when LDAP goes slow with this configuration) For Example - In mysql we could do first level partitioning the tables and afterwards at last resort we could do its sharding. So, my query is - Can we do anything other than upgrading H/W or OS if the I/O operation to LDAP gets slow? Thanks and Regards, Gaurav Gugnani On Thu, Mar 15, 2012 at 12:20 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Wednesday, March 14, 2012 11:08 AM +0530 Gaurav Gugnani < > gugnanigaurav(a)gmail.com> wrote: > > Hi All, >> >> First of all thks for helping me out with the issues on openLDAP. >> Well today, my query is pretty generic and lot many people working on >> LDAP would face such an issues. >> >> >> >> We are using openldap 2.4.26 with BDB as backend. We've installed the >> setup on linux machine of 64 bit with 4GB ram. Now, currently we have >> some 10K records in it and its working perfectly fine. Our systems is >> running under replication - syncrepl. >> >> >> However, in near future we can foresee some million of records to turn >> up. So, Can any one please advise - What are the different Scaling >> options available with LDAP? >> > > I'm not sure what you mean by scaling options. OpenLDAP scales, and that > has been shown numerous times. How well/far it scales depends entirely on > your hardware and operating system and the size of the DB in relation to > those things. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

4 6

openLDAP as a proxy for AD
by Chris O'Kelly 21 Mar '12

21 Mar '12

Hi guys, I have been trying for a few weeks to integrate 2 directories. One is an AD directory which holds internal employees and is used for windows domain logins/policy etc. The other is an openLDAP directory I set up myself last week which contains external users (not employed by the company but need access to various web applications we serve). As some of our web applications do not support chaining multiple authentication sources we are trying to get all the AD content available in OpenLDAP, so we can use that for web app authentication and AD for Windows Domain stuff. Before this I have basically no experience with LDAP (if I don't count adding and removing the odd user or group from AD). As a result I went into this project rather optimistically, having read great stuff about syncrepl and how easy it is to set up replication to openLDAP. By now I am guessing most people have guessed the realisation I came to when I tried to go down that path, being that AD doesn't play nicely with others and syncrepl is not going to help here. Since then I have been doing a good deal of RTFMing and JFGIing and I believe what I need to do is to use the back-ldap database type to set up a proxy. Unfortunately that's where I hit a dead end. Every tutorial I can find seems to relate to slapd.conf, whereas I am setup with RTC in the slapd.d directory. In attempting to get around this I have been doing things like adding olc to the beginning of pretty much everything I would put into slapd.conf, saving as a .ldif and ldapadding it. After a while of trial and error runs I discovered what modules needed to be loaded and what not in order to complete the ldapadd without error, but still saw no change, searching found the results in OpenLDAP but never the ones in AD. In desperation, today I apt-get purged OpenLDAP and its dependencies and reinstalled it. I deleted the basic configuration loaded into slapd.d and set up a slapd.conf file as best I could with the setup I needed plus the back-ldap stuff I had found in tutorials. I successfully slaptested it but I am hitting the exact same problem, and the changes I have made since then seem to have only succeeded in breaking OpenLDAP to the point where I was no longer able to connect to it with Apache Directory Studio. So now I have purged the lot again, and I suppose I am looking for some help as to where to go from here. OpenLDAP is running on Ubuntu and the ldif I have been trying to add for the proxy is- olcDatabase: ldap olcSuffix: dc=companyname,dc=local olcSubordinate: yes olcRebind-as-user: yes olcUri: "ldap://companyname.local/" olcChase-referrals: yes Thanks in advance to anyone who can help!

2 1

cannot get base DN / suffix from ldap browsers
by Jehan Procaccia 20 Mar '12

20 Mar '12

Hello, I cannot figure out why on one of my replicas, I cannot browse the DIT . Apache Directory Studio for example, only show the "root DSE(2)", but the base DN (namingContext or directory suffix, whatever you call it ...) isn't visible !? on my others replicas and the master, everything is fine, I do browse the DIT, the browser shows "root DSE(3)" with the suffix visible. I might be missing something obvious, but cannot figure out what. I checked ACL: access to dn.base="" by * read access to dn.base="cn=Subschema" by * read access to dn.subtree="dc=int-evry,dc=fr" by dn="cn=admin,dc=int-evry,dc=fr" write by users read but still, the suffix dc=int-evry,dc=f doesn't shows up on that particular replica !? I run openldap-servers-2.4.23-20.el6.i686 with cn=config created from a slapd.conf transformed with slaptest -f . Any help greatly appreciated .

3 4

replication issues
by Marvin Mundry 20 Mar '12

20 Mar '12

Hello everybody, i am experiencing 2 issues while using syncrepl. i am running slapd 2.4.20 shipping with SLES 11.2. 1. replication of an accesslog database. ============================= the accesslog overlay does not assign an entryUUID to its logdb database. therefore replication of this database is not possible. dn: cn=accesslog objectClass: auditContainer cn: accesslog entryCSN: 20120317121350.967741Z#000000#000#000000 structuralObjectClass: auditContainer contextCSN: 20120320154322.642649Z#000000#000#000000 To be able to replicate cn=accesslog anyways, i initialize the accesslog database via slapadd from an ldif file that contains a made up entryUUID for dn:cn=accesslog, afterwards i fire up the slapd. Replication now seems to work fine. My question is, does this method have any unwanted side effects? 2. replication of cn=config =================== when replicating cn=config all objects below cn=schema,cn=config get replicated when the consumer is initially started. for dn:olcDatabase={-1}frontend,cn=config and dn:cn=config (olcGlobal) initially no synchronization happens. Both objects get replicated only after they have been modified on the on the provider ie. when starting a new consumer i have to carry out meaningless modifications to both objects on the provider to initiate the replication. is this behavior to be expected? my syncrepl config is: syncrepl rid=15 provider=ldap://192.168.2.100 type=refreshAndPersist retry="1 1 1 1" searchbase="cn=config" filter="(|(objectClass=olcGlobal)(objectClass=olcSchemaConfig)(objectClass=olcFrontendConfig))" attrs="*,+" bindmethod=simple binddn="cn=admin,cn=config" credentials="secret" Best regards, Marvin

2 2

mdb hmmm....
by Francis Swasey 20 Mar '12

20 Mar '12

I thought I'd give mdb a try to see if it will solve a performance problem I'm approaching with my current ldap servers. But, I have obviously missed some key step. I have been running 2.4.28 on RHEL5 64-bit, using an hdb database. The steps I followed were: - slapcat the existing database - stop slapd - build 2.4.30 and install it - update my slapd.conf to use mdb, remove the cachesize, cachefree, and idlcachesize options (which are not valid with mdb), and add the maxsize option set to 100GB (107374182400). Then, I ran slapadd with -q and it blew up on me: slapadd -q -b dc=uvm,dc=edu -l ../cheese.ldif 4f68cc21 => mdb_idl_insert_keys: c_get failed: Invalid argument (22) 4f68cc21 => mdb_tool_entry_put: index_entry_add failed: err=80 4f68cc21 => mdb_tool_entry_put: txn_aborted! Internal error (80) slapadd: could not add entry dn="cn=XXobfuscatedXX,ou=People,dc=uvm,dc=edu" (line=771): txn_aborted! Internal error (80) _ 0.01% eta 02m06s elapsed none spd 3.4 M/s Closing DB... Now, just to convince myself that I wasn't bonkers, I updated the slapd.conf file to go back to hdb and the slapadd command runs just fine. I've read the slapd-mdb man page, scoured the openldap-technical mailing list, even the faq-o-matic and the admin guide. I'm not finding any clues to what is causing slapadd to fail here. -- Frank Swasey | http://www.uvm.edu/~fcs Sr Systems Administrator | Always remember: You are UNIQUE, University of Vermont | just like everyone else. "I am not young enough to know everything." - Oscar Wilde (1854-1900)

2 1

error entry store failed
by Wen, Nancy 20 Mar '12

20 Mar '12

Hi folks, Can anyone help me on this problem? Note we were trying to know what happen on a previous error - Sizelimit exceeded. However, after we turned the log level up, and we saw this: => id2entry_add( 322, "uid=jason,ou=people,ou=0019,l=taiwan,dc=039,dc=com" ) => ldbm_cache_open( "id2entry.dbb", 73, 600 ) <= ldbm_cache_open (cache 1) <= id2entry_add 30988 id2entry_add failed => dn2id_delete( "uid=jason,ou=people,ou=0019,l=taiwan,dc=039,dc=com", 322 ) => ldbm_cache_open( "dn2id.dbb", 73, 600 ) <= ldbm_cache_open (cache 0) <= dn2id_delete 0 send_ldap_result: conn=0 op=40 p=3 send_ldap_result: err=80 matched="" text="entry store failed" send_ldap_response: msgid=41 tag=105 err=80 conn=0 op=40 RESULT tag=105 err=80 text=entry store failed ====> cache_return_entry_w( 206 ): returned (0) ====> cache_return_entry_w( 322 ): deleted (0) @(#) $OpenLDAP: slapd 2.2.13 (Aug 13 2006 01:27:00) $ buildcentos@build-i386 :/home/buildcentos/rpmbuild/BUILD/openldap-2.2.13/openldap-2.2.13/build-servers/servers/slapd daemon: bind(6) failed errno=98 (Address already in use) daemon: bind(6) failed errno=98 (Address already in use) slapd stopped. Thanks million, Nancy Wen

2 1

translucent plugin
by Alex Samad - Yieldbroker 19 Mar '12

19 Mar '12

Hi I was wondering if the translucent plugin will allow me to add whole objects So if I had Openldap translucent -> MS AD Suffix dc=test,dc-com Could I add who objects and not just attributes into the tree ? Alex

1 0

mirrormode and N-way multimaster replication
by mallapadi niranjan 19 Mar '12

19 Mar '12

Hi all I am trying to understand the differences between mirrormode and N-way multimaster replication. I am using openldap-2.4.23-20.el6 , From the admin guide from www.openldap.org , I would like to clarify the below point In Mirromode . if i have two openldap servers(m1-m2), I can do add/del/mod operations only on m1, but cannot do add/del/mod operations simultaneously on both m1 and m2 , I can do add/del/mod operations on m2 only when m1 is down. Where as In N-Way multimaster replication, (if m1 and m2 are two openldap servers), i can do add/mod/del operations on both m1 and m2 simultaneously , Can some body clarify if the above understanding is correct. Regards Niranjan

2 1

src rpms for 2.4.30 / RHEL 6
by Aaron Bennett 19 Mar '12

19 Mar '12

Hello, For a number of reasons, I wanted to package OpenLDAP 2.4.30 for RHEL 6. If anyone's interested, you can get my package here... http://wordpress.clarku.edu/abennett/2012/03/16/openldap-src-rpms-for-rhel-… It depends on DB5 so you'll find a src rpm for that as well. All the binaries go into /usr/local; configuration is in /etc/openldap and /etc/sysconfig; bdb files go in /var/lib/ldap. The init script is the regular RHEL 5 patched to run the binary from a different location. It conflicts with openldap-servers and openldap-clients but NOT with the base system openldap. Let me know if it works for you or if you find issues with it. Best, Aaron --- Aaron Bennett Manager, Systems Administration Clark University ITS

4 7

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical