- openldap-technical - openldap.org

Re: Reindex failed on MDB backend (cn=config)
by Quanah Gibson-Mount 10 Jul '12

10 Jul '12

--On Tuesday, July 10, 2012 10:44 AM +0200 Pieter Baele <pieter.baele(a)gmail.com> wrote: > > > On Tue, Jul 10, 2012 at 8:42 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> > wrote: > > > --On Tuesday, July 10, 2012 8:26 AM +0200 Pieter Baele > <pieter.baele(a)gmail.com> wrote: > > >>> I added some indexes on a mdb database (Mirror) using ADS, and then tried >>> to reindex using the LTB init script. > >> What version of OpenLDAP? > openldap-ltb-2.4.31-1.el6.x86_64 Hi Pieter, Please keep replies on the list if you want assistance. Can you reproduce this issue using the latest RE24 code? Thanks, Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Reindex failed on MDB backend (cn=config)
by Pieter Baele 09 Jul '12

09 Jul '12

I added some indexes on a mdb database (Mirror) using ADS, and then tried to reindex using the LTB init script. service slapd reindex slapd: [INFO] Using /etc/default/slapd for configuration slapd: [INFO] Launching OpenLDAP database reindexing... slapindex: ./../../../libraries/libmdb/mdb.c:1361: mdb_page_touch: Assertion `mp->mp_p.p_pgno != np->mp_p.p_pgno' failed. slapd: [ALERT] OpenLDAP database reindexing failed I don't have additional details, because only Stats2 and Sync loglevel is enabled, and I already recovered. My question: how do I add indexes correctly so this doesn't happen again? directly with the use of an ldif file? Note: I want to use MDB in production, because our db will be small (never above 2GB, or 128TB ;-) ) Any recommendations? Sincerely, PieterB

2 1

Filter character encoding independent
by Philip Brusten 09 Jul '12

09 Jul '12

Hi, Our OpenLDAP information is stored in UTF-8 character encoding, like any other default installation I guess. Some of the records have special characters in their name, like ë, é, è, ç, etc. We want to make a webapplication that can do lookups on these names, without forcing the user to enter the correct characters. E.g. if they search for "Francois", it should match all givenNames "François" in LDAP. However if people do search for "François" if should also match all givenNames "François". I've looked for certain matching rules that could do this, but I haven't found what I'm looking for so far. Can anybody help me out? Kr, Philip

3 4

Accesslog purge doesn't work in Openldap 2.4.21 - Ubuntu Lucid
by Miguel Montero Rodríguez 08 Jul '12

08 Jul '12

Hi everyone, I've just seen that /var/lib/ldap/accesslog is growing so I've realized that olcAccessLogPurge is not working properly (for example, I have log.0000000001 file from 2011-09-10). The files that I used to configure accesslog are: ---------------------------------------------------------------- dn: olcDatabase={2}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {2}hdb olcDbDirectory: /var/lib/ldap/accesslog olcSuffix: cn=accesslog olcRootDN: cn=Administrator,dc=example,dc=net olcDbIndex: default eq olcDbIndex: entryCSN,objectClass,reqEnd,reqResult,reqStart ---------------------------------------------------------------- The other file for configuring the accesslog is: ---------------------------------------------------------------- dn: olcOverlay=accesslog,olcDatabase={1}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcAccessLogConfig olcOverlay: accesslog olcAccessLogDB: cn=accesslog olcAccessLogOps: all olcAccessLogSuccess: TRUE # scan the accesslog DB every day, and purge entries older than 7 days olcAccessLogPurge: 07+00:00 01+00:00 ---------------------------------------------------------------- LDAP is working properly but not this. Anyone can tell me any clue about this? Thank you in advance. Best regards, Miguel.

4 6

Increase size of id2entry.bdb in DB_CONFIG ?
by Frank Bonnet 08 Jul '12

08 Jul '12

Hello My slapd server suddenly refuse to generate an LDIF file though th slapcat command. It is asking to increase the size of the id2entry.bdb database. I restart slapd and it works fine again but I would like to know what happened. Is there any configurable parameter that I would be able to write down into DB_CONFIG file to increase the size of this database ? I haven't found any precise documentation about this when googling about this. Or is it totally anything else ? see below the actual result of the db_stat command applied to this base : ldap# db_stat-4.6 -d id2entry.bdb Wed Jul 4 09:23:56 2012 Local time 53162 Btree magic number 9 Btree version number Little-endian Byte order Flags 2 Minimum keys per-page 16384 Underlying database page size 4079 Overflow key/data size 3 Number of levels in the tree 18735 Number of unique keys in the tree 18735 Number of data items in the tree 4 Number of tree internal pages 28130 Number of bytes free in tree internal pages (57% ff) 1694 Number of tree leaf pages 3940820 Number of bytes free in tree leaf pages (85% ff) 0 Number of tree duplicate pages 0 Number of bytes free in tree duplicate pages (0% ff) 7 Number of tree overflow pages 67789 Number of bytes free in tree overflow pages (40% ff) 0 Number of empty pages 0 Number of pages on the free list Thank you very much

5 11

Re: Increase size of id2entry.bdb in DB_CONFIG ?
by Quanah Gibson-Mount 06 Jul '12

06 Jul '12

--On Friday, July 06, 2012 10:40 AM +0200 Frank Bonnet <f.bonnet(a)esiee.fr> wrote: >> set_lg_regionmax 262144 >> set_lg_max 10485760 >> set_lg_bsize 2097152 > > Do you know if there is somewhere a documentation > that describe in details all DB_CONFIG statements ? > > thanks Hi Frank, Please keep this discussion on the list, thanks. I would advise consulting the BDB documentation that came with the version of BDB your OpenLDAP build is linked with. It often is in the Appendices, for example: <http://docs.oracle.com/cd/E17076_02/html/api_reference/C/set_lg_regionmax_p…> --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

Setting up multiple proxies on openldap 2.4.23
by Bhargav Mistry 06 Jul '12

06 Jul '12

Hi, I am trying to configure multiple proxy so that the ldap master can push data to more than one proxy servers. My olcDatabase={3}ldap.ldif file looks like this: dn: olcDatabase={3}ldap objectClass: olcDatabaseConfig objectClass: olcLDAPConfig olcDatabase: {3}ldap olcHidden: TRUE olcSuffix: dc=amdocs,dc=com olcRootDN: cn=ldap,dc=amdocs,dc=com olcSyncUseSubentry: FALSE olcMonitoring: TRUE structuralObjectClass: olcLDAPConfig entryUUID: c7d2672e-5c10-1031-9a08-0f8186de202c creatorsName: cn=config createTimestamp: 20120706234807Z olcSyncrepl:: <syncrepl entry here> olcDbACLBind: bindmethod=simple timeout=0 network-timeout=0 binddn="cn=Manager ,dc=something,dc=com" credentials="secret" olcDbURI: ldap://proxy-1.server.com entryCSN: 20120707001006.061485Z#000000#001#000000 modifiersName: cn=config modifyTimestamp: 20120707001006Z With this configuration it is currently pushing only to proxy-1.server.com, how do I add more than one olcDbURI values so that it can push to multiple servers? Thanks. Bhargav. This message and the information contained herein is proprietary and confidential and subject to the Amdocs policy statement, you may review at http://www.amdocs.com/email_disclaimer.asp

1 0

syncrepl selective sync?
by jimy 06 Jul '12

06 Jul '12

Hello, what ist the best way to sync all contained in ou=group1,ou=sync,dc=example,dc=com AND ou=group2,ou=sync,dc=example,dc=com only with a of searchbase="ou=sync,dc=example,dc=com" ? Can this be done with filter= or do I need subordinate dbs? thx jimy

3 2

Uniqueness constraint over multiple attributes
by Jan Beerden 06 Jul '12

06 Jul '12

Hello, Is there a way to have a unique constraint over multiple attributes? We have different attributes for the primary email address of a person, and for additional aliases, and we'd like to enforce global uniqueness in such a way that the primary email address for one person can not be used as an email alias for another person. The slapo-unique manpage doesn't make this very clear. Regards -- Jan Beerden jan.beerden(a)fks.be fks bvba - Formal and Knowledge Systems http://www.fks.be/ Schampbergstraat 32 Tel: ++32-(0)11-21 49 11 B-3511 Kuringen Fax: ++32-(0)11-22 04 19

4 10

Anyone using ejabberd with OpenLDAP?
by Gavin Henry 06 Jul '12

06 Jul '12

HI all, Taking advantage of the technical list for once and the OpenLDAP "related" questions :-) Anyone messed with ejabberd and OpenLDAP? I'm looking for an XMPP server with the best LDAP support. ejabberd does auth, rosters and vcards but the ability to load a list of hosts/domains from LDAP like you can do with Exim etc. would rule. Any suggestions? -- http://www.suretecsystems.com/services/openldap/ http://www.surevoip.co.uk

3 4

Re: Docs To Do list and other ideas. Please contribute
by Gavin Henry 06 Jul '12

06 Jul '12

On 5 July 2012 16:44, Gavin Henry <gavin.henry(a)gmail.com> wrote: > On 5 July 2012 08:23, Michael Ströder <michael(a)stroeder.com> wrote: >> xsun wrote: >>> I don't remember if we talked about a wiki in the past but it's definitely a >>> good idea. I mean, if available, we could start to migrate/review the content >>> of openldap documentation page (AdminGuid, FAQ, etc) to the wiki. >> >> While Wikis seem to be attractive at first glance the biggest caveat is that >> you can't cut a doc release of all the pages for a certain software release. >> >> In other open source projects which have all the docs in a Wiki this turned >> out to be a major issue. > Good point. We would just need to decide what docs go in the Wiki and what format we export them as for the guide. > Gavin. -- http://www.suretecsystems.com/services/openldap/ http://www.surevoip.co.uk -- http://www.suretecsystems.com/services/openldap/ http://www.surevoip.co.uk

6 5

consumer doesn't send search requests
by jimy 06 Jul '12

06 Jul '12

Hello, migrating from slurpd I try to setup syncrepl. I read the slapd.conf man page and http://www.openldap.org/doc/admin24/replication.html#LDAP%20Sync%20Replicat… to get it up and running but I can't even get the consumer to send search requests to the provider. tcpdump shows that the consumer doesn't even start to talk with the provider after startup and openldap -d 16384 doesn't give me a hint also. Can someone here point me to the right direction how to proceed please? My configs can be viewed here: provider config: http://58c.om.sl.pt consumer config: http://58c.oy.sl.pt I also gathered the logging output from slapd -d -1 but this are two ~1.5MB files and too big to paste them in pastebin. I'll happily email the files per request. thx jimy

2 2

Fwd: [Foswiki-discuss] Mass import advice from OpenLDAP project Faq-O-Matic to foswiki?
by Gavin Henry 05 Jul '12

05 Jul '12

I found this from last year I misplaced. ---------- Forwarded message ---------- From: lars.eik(a)gmail.com <lars.eik(a)gmail.com> Date: 3 May 2011 23:43 Subject: Re: [Foswiki-discuss] Mass import advice from OpenLDAP project Faq-O-Matic to foswiki? To: foswiki-discuss(a)lists.sourceforge.net Hi Gavin, I have only done some minor text hacking but here's some feedback anyways. THIS will help you. If you make out the structure between file names then you can script creation and set the relevant parameters, like 'topicparent' and get the breadcrumb right. That could be a start. Another way could be by using JQuery and doing import from 'GUI' in Foswiki. Prepare much the same structure as you would if using CLI and use your browser to do the 'save' script. This would let you preview etc (by INCLUDE url) and give som other options, like let other users do some import and quality checking. Your old pages have a structure where the meaningful info is in the first two tables. Maybe even only the first if you don't really need the Previous/Next bit. So the structure seem simple enough but I have not examined all of the FAQ's. Perhaps create a mapping table between the old '226.html' and new 'WhichVersionShouldIUse'. The new names can be created by removing the spaces and ' signs in the title so it would be a valid wikiname. You can override so it doesnt have to be tough. Another name scenario is LdapFaqAUTOINC0 where the AUTOINC0 will get next available nr, like LdapFaq38 etc.. table1, tbody row1, skip first td, row1, second td has a tags that are top, second, third, fourth level/category. row1, last b tag is the current document "name" or caption. Could be your page name (topic name) other tablerows are data/info ..and that's about all I had time for :) Jquery is really nice when doing stuff like html tags, children, find the 'b' tag etc. About text files, you can copy them all into a new 'test web' and rename them to .txt but and it will work butt will need heavy refactoring. If you take out the first table of each and saved at txt file it would be much easier. Best of luck Lars 2011/5/2 Olivier 'Babar' Raginel <wiki(a)babar.us> > > On Mon, May 02, 2011 at 09:46:07PM +0100, Gavin Henry wrote: > > I'm the doc dev for the OpenLDAP project (ghenry(a)OpenLDAP.org) and I'm > > moving our Faq content from Faq-O-Matic to our new wiki: > > That's great news! > > > Any tips for moving over? I can scrape the HTML into wiki syntax but > > I'm sure others have done this before. > > Hum, I'm afraid most if not all of us have no idea how a Faq-O-Matic > text looks like. From what I could grasp with 3 minutes web-browsing, > it seems a very old and simple syntax, with not that many rules or fancy > stuff, so writing a converter should be pretty much trivial. > > > Please save me from copy and paste! > > I'm not sure we can save you from copy and paste, but I'm pretty sure > you can save yourself easily with one not so complex perl script, which > should be able to migrate your content pretty easily. > > But the hard part is not migrating, it's defining the structure you want > your new content to use. In Foswiki, things like FAQs are usually best > used through pre-defined structures, either strict topic format, or > forms, or both. So before migrating I suggest you think of what you want > to achieve, and then you start hacking some perl script to convert your > Faq-O-Matic to what you want. > > And if you need help in the process, you know where to find us :) > > Good luck, > > -- > Babar > > ------------------------------------------------------------------------------ > WhatsUp Gold - Download Free Network Management Software > The most intuitive, comprehensive, and cost-effective network > management toolset available today. Delivers lowest initial > acquisition cost and overall TCO of any competing solution. > http://p.sf.net/sfu/whatsupgold-sd > _______________________________________________ > Foswiki-discuss mailing list > Foswiki-discuss(a)lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/foswiki-discuss ------------------------------------------------------------------------------ WhatsUp Gold - Download Free Network Management Software The most intuitive, comprehensive, and cost-effective network management toolset available today. Delivers lowest initial acquisition cost and overall TCO of any competing solution. http://p.sf.net/sfu/whatsupgold-sd _______________________________________________ Foswiki-discuss mailing list Foswiki-discuss(a)lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/foswiki-discuss -- http://www.suretecsystems.com/services/openldap/ http://www.surevoip.co.uk

1 0

Re: Docs To Do list and other ideas. Please contribute
by Gavin Henry 05 Jul '12

05 Jul '12

So where are we? Wiki - no then? Or Wiki like dokuwiki which does plain text files, stick them in the back of a git repo, add some hooks to do commits so we can all work offline and use the Dokuwiki PDF exports? We just need something to look "new" :-) -- http://www.suretecsystems.com/services/openldap/ http://www.surevoip.co.uk

1 1

Ldap Replication Query
by Hanumanth Rao 05 Jul '12

05 Jul '12

Hello LDAP Brains, I have setup a Samba PDC (192.168.1.2) and a Samba BDC (192.168.4.2) both are on different subnets, there are two issues for me as below *PDC - SUSE Linux Enterprise Server 11 (x86_64), VERSION = 11, PATCHLEVEL = 2, samba-3.6.3-0.18.3, openldap2-2.4.26-0.12.1 BDC - SUSE Linux Enterprise Server 10 (i586) , VERSION = 10, samba-3.0.22-13.16, openldap2-2.3.19-18.7* 1. On the BDC if I give the command below I get Unable to find a suitable server BDC2:~ # net rpc info Unable to find a suitable server 2. I am not able to sync ldap database, BDC with the PDC I have enclosed my slapd.conf of PDC and BDC, can anybody let me know where I have gone wrong. Your help is highly appreciated, thanks in advance. Hanumanth Rao

2 1

SASL passthrough - multiple domains
by Liam Gretton 05 Jul '12

05 Jul '12

I have a working configuration with pass-through auth to an AD domain using saslauthd. However now there is a requirement to be able to handle another domain too, and I cannot work out how to do this. It seems that saslauthd cannot deal with multiple Kerberos realms, no matter what hoops one jumps through it eventually boils down to only using whatever 'default_realm' is set to in the krb5.conf file. Using multiple saslauthd daemons isn't possible either as there's no way (that I can work out) of getting OpenLDAP to use anything other than the single socket specified in /etc/sasl2/slapd.conf. My final idea was to run an LDAP instance per realm, each talking to the separate saslauthd daemons, and have another outward facing LDAP service with these as the backends but that's a non starter too because there's no way of specifying the sasl slapd.conf file, it seems sasl always looks in /etc/sasl2 for a file derived from the process name (a chroot environment for each LDAP server is therefore the next thing to look at). But this seems like a lot of work just to be able to authenticate users against multiple domains. I appreciate this is a SASL issue rather than a problem with OpenLDAP, but I'm hoping that someone here has cracked this already. Googling hasn't thrown up an solution that I can find. -- Liam Gretton liam.gretton(a)le.ac.uk HPC Architect http://www.le.ac.uk/its IT Services Tel: +44 (0)116 2522254 University of Leicester, University Road Leicestershire LE1 7RH, United Kingdom

8 10

Docs To Do list and other ideas. Please contribute
by Gavin Henry 05 Jul '12

05 Jul '12

On 4 July 2012 22:34, xsun <matheus.morais(a)gmail.com> wrote: > Hello guys, > > I can help on documentation in my spare time. I tryed to submit a patch for > ITS#6339 in the past but I don't know why it was not accepted and I did not > received any feedback about it. There is some TODO list for documentation? > There is a TODO list which, I can't believe, I started in 2008 and haven't made much progress: OpenLDAP Test suite Go through Samba stuff again OpenLDAP contrib scripts for generating LDIF etc. OpenLDAP Admin Guide - Intro Tighten "LDAP vs RDBMS" Check "What is slapd and what can it do?" "Replicated Directory Service" - add MultiMaster picture. "Configuring slapd" - check DIT layout is right "The slapd Configuration File" - check backends are correct and in above "Access Control" - Finish "Converting from slapd.conf(5) to a cn=config directory format" Backends section to finish Overlays section to finish Maintenance section to finish Monitoring section to finish Tuning section to finish More in Troubleshooting section More in Upgrading from 2.3.x section Check "Recommended OpenLDAP Software Dependency Versions" section Do some "Real World OpenLDAP Deployments and Examples" "OpenLDAP Software Contributions" to complete "Configuration File Examples" to complete Some are done and I'd rather build a build farm RESTful API now so we can have a central build farm. We did get a server from Google for that with 32GB Ram but last I heard it was down. Kurt? I'll check out your ITS and also we talked about a new wiki at some point?

3 2

Cannot remove LDAP entry ...
by Frank Bonnet 03 Jul '12

03 Jul '12

Hello I have a problem removing ONE ( and only ONE !!! ) entry in my directory server ldapdelete fails like the following ldap_delete: Other (e.g., implementation specific) error (80) additional info: entry index delete failed I've checked online openldap documentation and this error refers to a access rights problem, but it is not the case for my server , all db files belong to ldap:ldap which is the identity the slapd deamon runs on. the server runs 2.4.23 version on a FreeBSD 8.1-RELEASE-p5 compiled and installed from ports. ldap# /usr/local/libexec/slapd -V @(#) $OpenLDAP: slapd 2.4.23 (Oct 15 2010 16:35:06) $ root@ldap3.esiee.fr:/usr/ports/net/openldap24-server/work/openldap-2.4.23/servers/slapd Any help welcome thank you

2 1

bug in unique overlay
by Anton Yuzhaninov 03 Jul '12

03 Jul '12

According to slapo-unique(5) it is possible to specify several URLs in one domain (in single unique_uri dircetive). I have in my slapd.conf settings like: unique_uri ldap:///ou=lists,dc=example.ru,ou=mail,o=foo?cn?sub?(objectClass=nisMailAlias) ldap:///ou=aliases,dc=example.ru,ou=mail,o=foo?cn?sub?(objectClass=nisMailAlias) But in OpenLDAP 2.4.31 all URLs except first one is silently ignored. Debug logs show: 4ff309e3 line 208 (unique_uri ldap:///ou=lists,dc=example.ru,ou=mail,o=foo?cn?sub?(objectClass=nisMailAlias) ldap:///ou=aliases,dc=example.ru,ou=mail,o=foo?cn?sub?(objectClass=nisMailAlias)) 4ff309e3 ==> unique_new_domain <ldap:///ou=lists,dc=example.ru,ou=mail,o=foo?cn?sub?(objectClass=nisMailAlias)> ldap_url_parse_ext(ldap:///ou=lists,dc=example.ru,ou=mail,o=foo?cn?sub?(objectClass=nisMailAlias)) 4ff309e3 >>> dnPrettyNormal: <ou=lists,dc=example.ru,ou=mail,o=foo> 4ff309e3 <<< dnPrettyNormal: <ou=lists,dc=example.ru,ou=mail,o=foo>, <ou=lists,dc=example.ru,ou=mail,o=foo> Prblem is around this code in servers/slapd/overlays/unique.c: if ( c->line ) rc = unique_new_domain ( &domain, c->line, c ); else rc = unique_new_domain ( &domain, c->argv[1], c ); c->line is empty by some reason. c->argv[1] contains only first URL. Is anybody know how to fix this bug? Is it normal, that c->line is empty? -- Anton Yuzhaninov

3 3

overlay nssov and pass-though authentication
by Uwe Werler 02 Jul '12

02 Jul '12

Hello list, sis there a way to use pass-through authentication with saslauthd and the new nssov overlay? The only thing I got working at the moment was to use overlay pbind. But then I have to split my database 'cause I need local passwords stored in the database too. Thanks in aadvance! Uwe

1 0

overlay nssov and pass-through authentication
by Uwe Werler 02 Jul '12

02 Jul '12

Hello list, sis there a way to use pass-through authentication with saslauthd and the new nssov overlay? The only thing I got working at the moment was to use overlay pbind. But then I have to split my database 'cause I need local passwords stored in the database too. Thanks in aadvance! Uwe

1 0

New release of LinID OpenLDAP Manager
by Clément OUDOT 29 Jun '12

29 Jun '12

Hi all, I wanted to inform you that we just released a new version (0.7) of our OpenLDAP configuration web console. You can know more about this version here: https://redmine.linid.org/news/16 LinID OpenLDAP Manager is free software (AGPLv3), I hope it might be useful for some of you. Regards, Clément OUDOT.

2 2

chaining and returning errors
by Frank Van Damme 29 Jun '12

29 Jun '12

List, I'm setting up chaining. And I want to get errors, no referrals :) my olcDatabase looks like this: olcDatabase={0}ldap,olcOverlay={1}chain,olcDatabase={1}hdb,cn=config objectClass: olcChainDatabase (auxiliary) objectClass: olcConfig (abstract) objectClass: olcDatabaseConfig (structural) objectClass: olcLDAPConfig (structural) objectClass: top (abstract) olcDatabase: {0}ldap olcDbIDAssertBind: bindmethod="simple" binddn="uid=lalalala" credentials="foo" mode="self" olcDbURI: ldap://example.com here is this object's parent: olcOverlay={1}chain,olcDatabase={1}hdb,cn=config objectClass: olcConfig (abstract) objectClass: olcOverlayConfig (structural) objectClass: top (abstract) olcOverlay: {1}chain The problem is that I can't insert an olcChainReturnError attribute into it. The schema doesn't allow it. I tried to add the olcChainConfig objectClass to the olcDatabase={1} object, which requires me to fill in an extra attribute "olcOverlay" - I tried {1}chain and "chain" and "{0}ldap" but either give me an error 65 "invalid structural object class chain". -- Frank Van Damme No part of this copyright message may be reproduced, read or seen, dead or alive or by any means, including but not limited to telepathy without the benevolence of the author.

2 2

Re: Memberof overlay with posixGroup
by Marcio Merlone 29 Jun '12

29 Jun '12

Em 28-06-2012 12:39, Julien Soula escreveu: > On Thu, Jun 28, 2012 at 10:34:48AM -0300, Marcio Merlone wrote: >> I am trying to implement memberof overlay on Ubuntu 10.04.4 LTS and >> OpenLDAP 2.4.21-0ubuntu5.7 over posixGroup, not groupOfNames. I >> created the following ldif: >> >> .../... >> >> adding new entry "olcOverlay={2}memberof,olcDatabase={1}hdb,cn=config" >> ldap_add: Other (e.g., implementation specific) error (80) >> additional info: member attribute="memberUid" must either >> have DN (1.3.6.1.4.1.1466.115.121.1.12) or nameUID >> (1.3.6.1.4.1.1466.115.121.1.34) syntax > overlay memberof only supports DN as membership attribute (as DN and > nameUID type). I don't know any workaround for your case. Sorry for the noise, I SWEAR, I was so sure posixGroup use DN as membership, overlooked that. Thanks and best regards. -- *Marcio Merlone*

1 0

Memberof overlay with posixGroup
by Marcio Merlone 28 Jun '12

28 Jun '12

Greetings, I am trying to implement memberof overlay on Ubuntu 10.04.4 LTS and OpenLDAP 2.4.21-0ubuntu5.7 over posixGroup, not groupOfNames. I created the following ldif: root@venus:~# cat memberof.ldif dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: memberof - add: olcModuleLoad olcModuleLoad: refint dn: olcOverlay={2}memberof,olcDatabase={1}hdb,cn=config objectClass: olcConfig objectClass: olcMemberOf objectClass: olcOverlayConfig objectClass: top olcOverlay: {2}memberof olcMemberOfRefInt: TRUE olcMemberOfGroupOC: posixGroup olcMemberOfMemberAD: memberUid olcMemberOfMemberOfAD: memberOf dn: olcOverlay={3}refint,olcDatabase={1}hdb,cn=config objectClass: olcConfig objectClass: olcOverlayConfig objectClass: olcRefintConfig objectClass: top olcOverlay: {3}refint olcRefintAttribute: memberof memberuid manager owner seeAlso roleOccupant root@venus:~# And got the error: root@venus:~# ldapadd -x -D "cn=admin,cn=config" -W -f memberof.ldif Enter LDAP Password: modifying entry "cn=module{0},cn=config" adding new entry "olcOverlay={2}memberof,olcDatabase={1}hdb,cn=config" ldap_add: Other (e.g., implementation specific) error (80) additional info: member attribute="memberUid" must either have DN (1.3.6.1.4.1.1466.115.121.1.12) or nameUID (1.3.6.1.4.1.1466.115.121.1.34) syntax root@venus:~# Is this a specific version problem, is it not doable or have I screwed something? Thanks for any help, please let me know if you need further information. Regards. -- *Marcio Merlone*

1 0

Strange TLS issue while upgrading from openldap 2.3 to 2.4
by Guillaume Rousse 28 Jun '12

28 Jun '12

Hello list. I recently faced a strange issue while upgrading from openldap 2.3 to 2.4 (from centos 5.7 to 6.2, actually): the change was transparent for every applications excepted Zimbra, for which any authentication attempt was suffering from an unexplained 30s additional delay. Just switching from explicit TLS usage on port 389 to explicit SSL usage on port 636 was enough to fix the issue. The logs shows than the delay occurs between the moment where the bind operation succeed, and the moment the client connection get closed: Jun 14 11:56:04 ildapslave2 slapd[16618]: conn=2787 fd=135 ACCEPT from IP=128.93.142.13:41191 (IP=0.0.0.0:389) Jun 14 11:56:04 ildapslave2 slapd[16618]: conn=2787 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Jun 14 11:56:04 ildapslave2 slapd[16618]: conn=2787 op=0 STARTTLS Jun 14 11:56:04 ildapslave2 slapd[16618]: conn=2787 op=0 RESULT oid= err=0 text= Jun 14 11:56:04 ildapslave2 slapd[16618]: conn=2787 fd=135 TLS established tls_ssf=256 ssf=256 Jun 14 11:56:04 ildapslave2 slapd[16618]: conn=2787 op=1 BIND dn="uid=fauge00C,ou=people,dc=inria,dc=fr" method=128 Jun 14 11:56:04 ildapslave2 slapd[16618]: conn=2787 op=1 BIND dn="uid=fauge00C,ou=people,dc=inria,dc=fr" mech=SIMPLE ssf=0 Jun 14 11:56:04 ildapslave2 slapd[16618]: conn=2787 op=1 RESULT tag=97 err=0 text= ... Jun 14 11:56:34 ildapslave2 slapd[16618]: conn=2787 fd=135 closed (connection lost) Before the upgrade, the connection get closed immediatly, and there is no such delay. Using higher logging level doesn't provide additional useful details, excepted maybe more details about connection termination: Jun 14 12:53:21 ildapslave2 slapd[7156]: connection_read(109): checking for input on id=1135 Jun 14 12:53:21 ildapslave2 slapd[7156]: ber_get_next on fd 109 failed errno=0 (Success) Jun 14 12:53:21 ildapslave2 slapd[7156]: connection_read(109): input error=-2 id=1135, closing. I'm aware than this behaviour change may actually come from underlying libraries, such as bdb for instance, rather than openldap itself, but that's still quite a curious issue. Does anyone have a clue about this problem ? -- The more cordial the buyer's secretary, the greater the odds that the competition already has the order -- Murphy's Laws on Technology n°38

3 7

back-meta and SSL
by Peter Ga 26 Jun '12

26 Jun '12

Hello, one question to back-meta: Is it possible to have several ldaps:// URLs as entries, without client-side authentication? I.e. I just want to configure the CA cert path and connect to a ldaps repository ('normal' ssl, no starttls). I saw the section in the man page about idassert-bind, but was not completely sure they apply to ldaps URLs without authentication. Best regards, Peter

1 0

Security Deadlock?
by suomi 26 Jun '12

26 Jun '12

Hi listers this is on Fedora 17 running openldap-servers-2.4.31-2.fc17.x86_64 When trying to start slapd on this sysem, I run into the following deadlock: 1. [root@myws ~]# systemctl status slapd.service slapd.service - OpenLDAP Server Daemon Loaded: loaded (/usr/lib/systemd/system/slapd.service; enabled) Active: failed (Result: timeout) since Tue, 26 Jun 2012 14:23:02 +0200; 16s ago Process: 2531 ExecStart=/usr/sbin/slapd -u ldap -h ${SLAPD_URLS} $SLAPD_OPTIONS (code=exited, status=0/SUCCESS) Process: 2467 ExecStartPre=/usr/libexec/openldap/check-config.sh (code=exited, status=0/SUCCESS) CGroup: name=systemd:/system/slapd.service When I checked /var/log/localmessages, I found Jun 26 13:08:21 casablanca slapd[838]: ldif_read_file: checksum error on "/etc/openldap/slapd.d/cn=config/olcDatabase={0}config.ldif" I remembered, that this was exactly the file, where I had introduced the olcRootPW attribute for the cn=config subtree. So I removed the olcRootPW attribute from this file. 2. Then I could start slapd, no problem. 3. I tried to go into the cn=config subtree of the DIT on that slapd server. I tried it withoud password, since I had removed the password from this subtree. I got: Return Code from Bind: 48 Message: LDAP_INAPPROPRIATE_AUTH: The server requires the client which had attempted to bind anonymously or without supplying credentials to provide some form of credentials 4. I tried to go into the cn=config subtree of the DIT on that slapd server using the password I had usually used at this point. I got: Return Code from Bind: 49 Message: LDAP_INVALID_CREDENTIALS: The wrong password was supplied or the SASL credentials could not be processed 5. I googled around and found the following: ... Obvious approach: slapcat -n0 -F old/slapd.d > config.ldif edit config.ldif slapadd -n0 -F new/slapd.d -l config.ldif test using new/slapd.d deploy ... which I followed because I thought that such a clever approach can come only from a clever openldap guy. But when I tried to introduce the edited config.ldif into the DIT, I got [root@myws /etc/openldap]# slapadd -n0 -F slapd.d -l /tmp/slapd.config.ldif slapadd: could not add entry dn="cn=config" (line=1): _ 1.03% eta none elapsed none spd 4.5 M/s Closing DB... [root@myws /etc/openldap]# 6. I am now at the point, that I cannot access the cn=config subtree, because I cannot define the password to access this subtree and because, to access that subtree, I need to have defined the appropriate password. Looks very much kin'o like a deadlock. Is there anybody out there who knows how to circumvent this deadlock or do I need to file a bug to openldap? Thanks for your patience. suomi

2 1

Controlled LDAP Proxy/Relay
by W.Siebert＠t-systems.com 25 Jun '12

25 Jun '12

Hello, thanks for your answer. But I don't have any local users. All users are in two targets: domain01.com and domain99.net (AD). Where I should place userPassword attribute? My problem: We have a VoIP realized by Cisco Unified Call Manager (CUCM). There are several thousand users in the customers directory (domain01.com) using CUCM for Voice and ca 100 adminusers in the supplier directory (domain99.net). No trusting, different companies. Because CUCM can use only one directory to authenticate users I've implemented a OpenLDAP Metadirectory that proxying this 2 Microsft AD targets. But meta backend tries to authenticate by the first target, if the user was not found, by the second. Result: Intrusion detection register a lot of unsuccessfully login attempts. Therefore my question: Is it possible to implement the controlled proxy with OpenLDAP ? E.g., like Radiusproxy based on realm: when username is _xxx(a)domain01.com_<mailto:_xxx@domain01.com_> go to the target1, and when username is _xxx(a)domain99.net_<mailto:_xxx@domain99.net_> go to the target2. Can you help me please Kind regards Waldemar ################################################################ On 08/02/2012 09:58, W.Siebert(a)t-systems.com<mailto:W.Siebert@t-systems.com> wrote: > Is it possible to implement the controlled proxy with OpenLDAP ? > E.g., like Radiusproxy based on realm: when username is > _xxx(a)domain01.com_<mailto:_xxx@domain01.com_> <mailto:xxx@domain01.com> go to the target1, and > when username is _xxx(a)domain99.net_<mailto:xxx@domain99.net<mailto:_xxx@domain99.net_<mailto:xxx@domain99.net>> go to the target2. Yes, a combination of meta database config in slapd.conf and appropriate SASL config. In your schema, use the following in userPassword: userPassword: {SASL}xxx@DOMAIN where DOMAIN is whichever domain the user needs to be authenticated against. In slapd.conf: database meta suffix dc=local rootdn cn=administrator,dc=local rootpw secret # domain01 uri ldaps://domain01.com:3269/ou=domain01.com,dc=local lastmod off suffixmassage "ou=domain01.com=local" "dc=domain01,dc=com" idassert-bind bindmethod=simple binddn="cn=binder,dc=domain01,dc=com" credentials="password" flags=non-prescriptive idassert-authzFrom "dn.exact:cn=administrator,dc=local" # domain02 uri ldaps://domain02.com:3269/ou=domain02.com,dc=local lastmod off suffixmassage "ou=domain02.com=local" "dc=domain02,dc=com" idassert-bind bindmethod=simple binddn="cn=binder,dc=domain02,dc=com" credentials="password" flags=non-prescriptive idassert-authzFrom "dn.exact:cn=administrator,dc=local" In saslauthd.conf you need to create the appropriate search base for authentication based on the domain in the userPassword field: ldap_servers: ldapi://%2Fvar%2Frun%2Fslapd%2Fldapi-meta ldap_search_base: ou=%d,dc=local ldap_filter: (sAMAccountName=%U) ldap_auth_method: bind ldap_bind_dn: cn=administrator,dc=local ldap_password: secret ldap_deref: never ldap_use_sasl: no Hopefully this is enough info to get you going. -- Liam Gretton liam.gretton(a)le.ac.uk<mailto:liam.gretton@le.ac.uk> HPC Architect http://www.le.ac.uk/its IT Services Tel: +44 (0)116 2522254 University of Leicester, University Road Leicestershire LE1 7RH, United Kingdom

2 3

Ldap filter to get group members
by dhanushka ranasinghe 25 Jun '12

25 Jun '12

Hi... guys i have a LDAP server and its has a group called . cn=internal ou=group,dc=example,dc=com --users of this group is : uid=user1,ou=user,dc=example,dc=com uid=user2,ou=user,dc=example,dc=com i need to only to authenticate the users under cn=internal .... LDAP search for the cn=internal group as follows , dn: cn=internal,ou=group,dc=example,dc=com objectClass: groupOfNames objectClass: top cn: internal member: uid=user1,ou=user,dc=example,dc=com member: uid=user2,ou=user,dc=example,dc=com member: uid=user3,ou=user,dc=example,dc=com member: uid=user4,ou=user,dc=example,dc=com by the way All the users are stored at base OU=user,DC=example,DC=com This is what we are using (&(objectClass=groupOfNames)(memberOf=CN=internal,OU=group,DC=example,DC=com)) seems like its not working .. what the LDAP search filter i need to use to get only the members of the cn=internal group authenticated... Thanks

3 4

Reject requests on non-secure connections
by Terry Gardner 23 Jun '12

23 Jun '12

Is it possible to configure the server to reject requests on non-secure connections with the exception of the StartTLS extended request? In other words, when an LDAP client connects on the clear-text port, can the server be configured to reject all requests on that exception except for the StartTLS extended request in order to prevent clients from transmitting data in the clear?

2 1

Full Backup/Restore slapd
by galemberti greg 22 Jun '12

22 Jun '12

Hi, I want to implement a full backup procedure of my LDAP (schema, ACL, Data ...). * To save my schema i used the command: "slapcat -H ldap:///cn={4}my,cn=schema,cn=config -l schema.ldif" * To save my config, i used the command: "slapcat -H ldap:///olcDatabase={1}hdb,cn=config = config -l config.ldif * To save my accounts, i used the command: "slapcat -H ldap:///dc=my,dc=my -l accounts.ldif Now, when I want to test the restore on another server : * To restore my schema i used the command: "sudo -u openldap slapadd -v -b cn=config -l schema.ldiff " > OK * To restore my accounts i used the command: "sudo -u openldap slapadd -v -c -b cn=config -l accounts.ldiff " > OK * To restore my config i used the command: "sudo -u openldap slapadd -v -c -b olcDatabase={1}hdb,cn=config -l config.ldiff > KO. Indeed the slapadd command does not update the record so I get an error because they already exist. Also, how do I restore my configuration? Tks for your help PS : i use a debian squeeze server.

3 3

Subtree replication: when removing object outside of subtree, contextCSN is not updating!
by Konstantin Menshikov 21 Jun '12

21 Jun '12

Hi. I have replication setup, when i replicate not entire tree, but only part of it. Configuration provider and consumer attached. I use openldap-server-2.4.31 and db47-4.7.25.4 While adding object outside of the replicated subtree: e.g. ou=TestBranch1,dc=example,dc=com contextCSN of dn dc=example,dc=com on consumer server updated, ok. But while removing object, contextCSN not updated! Is it expected behavior or not? At first I added object *ou=hosts,ou=TestBranch2,dc=example,dc=com*.1 After I removed object. Provider log: Jun 22 06:37:53 ro1 slapd[62268]: conn=1002 op=52 SRCH base="ou=hosts,ou=TestBranch2,dc=example,dc=com" scope=0 deref=0 filter="(objectClass=*)" Jun 22 06:37:53 ro1 slapd[62268]: conn=1002 op=52 SRCH attr=hasSubordinates objectClass Jun 22 06:37:53 ro1 slapd[62268]: conn=1002 op=52 SEARCH RESULT tag=101 err=32 nentries=0 text= Jun 22 06:37:54 ro1 slapd[62268]: conn=1002 op=53 ADD dn="ou=hosts,ou=TestBranch2,dc=example,dc=com" Jun 22 06:37:54 ro1 slapd[62268]: slap_queue_csn: queing 0x7ffffe3fb100 20120622063754.599740Z#000000#000#000000 Jun 22 06:37:54 ro1 slapd[62268]: conn=1002 op=53 RESULT tag=105 err=0 text= Jun 22 06:37:54 ro1 slapd[62268]: slap_graduate_commit_csn: removing 0x80191bfd0 20120622063754.599740Z#000000#000#000000 Jun 22 06:37:54 ro1 slapd[62268]: conn=1002 op=54 SRCH base="ou=hosts,ou=TestBranch2,dc=example,dc=com" scope=0 deref=0 filter="(objectClass=*)" Jun 22 06:37:54 ro1 slapd[62268]: conn=1002 op=54 SRCH attr=hasSubordinates objectClass Jun 22 06:37:54 ro1 slapd[62268]: conn=1002 op=54 SEARCH RESULT tag=101 err=0 nentries=1 text= Jun 22 06:38:01 ro1 slapd[62268]: conn=1002 op=55 DEL dn="ou=hosts,ou=TestBranch2,dc=example,dc=com" Jun 22 06:38:01 ro1 slapd[62268]: slap_queue_csn: queing 0x7ffffebfc590 20120622063801.799710Z#000000#000#000000 Jun 22 06:38:01 ro1 slapd[62268]: conn=1002 op=55 RESULT tag=107 err=0 text= Jun 22 06:38:01 ro1 slapd[62268]: slap_graduate_commit_csn: removing 0x802738970 20120622063801.799710Z#000000#000#000000 Jun 22 06:38:02 ro1 slapd[62268]: conn=1002 op=56 SRCH base="ou=TestBranch2,dc=example,dc=com" scope=1 deref=3 filter="(objectClass=*)" Jun 22 06:38:02 ro1 slapd[62268]: conn=1002 op=56 SRCH attr=hasSubordinates objectClass Jun 22 06:38:02 ro1 slapd[62268]: conn=1002 op=56 SEARCH RESULT tag=101 err=0 nentries=2 text= Consumer log: Jun 22 06:37:54 ro2 slapd[62298]: do_syncrep2: rid=111 LDAP_RES_INTERMEDIATE - NEW_COOKIE Jun 22 06:37:54 ro2 slapd[62298]: do_syncrep2: rid=111 NEW_COOKIE: rid=111,csn=20120622063754.599740Z#000000#000#000000 Jun 22 06:37:54 ro2 slapd[62298]: slap_queue_csn: queing 0x8019eca90 20120622063754.599740Z#000000#000#000000 Jun 22 06:37:54 ro2 slapd[62298]: slap_graduate_commit_csn: removing 0x8019ec2b0 20120622063754.599740Z#000000#000#000000 -- Konstantin Menshikov

1 0

ACLs being ignored with rwm/relay
by Tim Watts 21 Jun '12

21 Jun '12

Hi, Sorry - can't figure this out - would welcome any ideas :) The slapd.conf below contains an ACL: access to attrs=userPassword,shadowLastChange by peername.path="/var/run/slapd/ldapi" write by dn="cn=admin,dc=dighum,dc=kcl,dc=ac,dc=uk" write by anonymous auth by self write by * none which works fine on the "real" DN dc=dighum,dc=kcl,dc=ac,dc=uk - I can add extra attrs like homeDirectory and an unauth'd ldapsearch will not list them - eg: ldapsearch -H ldap://localhost/ -D cn=admin,dc=dighum,dc=kcl,dc=ac,dc=uk -b dc=dighum,dc=kcl,dc=ac,dc=uk However, an ldapsearch -H ldap://localhost/ -D cn=admin,dc=dighum,dc=kcl,dc=ac,dc=uk -b dc=cch,dc=kcl,dc=ac,dc=uk lists the "virtual copy" tree AND includes the userPassword attr for each entry which of course, is rather bad. Anyone see why the ACLs are not being applied to the results of the relay/rwm section? Many thanks, Tim slapd.conf ####################################################################### # Global Directives: # Features to permit #allow bind_v2 # Schema and objectClass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema # Where the pid file is put. The init.d script # will not stop the server if you change this. pidfile /var/run/slapd/slapd.pid # List of arguments that were passed to the server argsfile /var/run/slapd/slapd.args # Read slapd.conf(5) for possible values loglevel -1 # Where the dynamically loaded modules are stored modulepath /usr/lib/ldap moduleload back_hdb moduleload back_relay moduleload rwm # The maximum number of entries that is returned for a search operation sizelimit 500 # The tool-threads parameter sets the actual amount of cpu's that is used # for indexing. tool-threads 1 allow bind_anon_cred bind_anon_dn update_anon backend hdb #backend <other> overlay rwm rwm-rewriteEngine on # Virtual maps # # map ou=staff,dc=cch to dc=dighum # database relay suffix "ou=staff,dc=cch,dc=kcl,dc=ac,dc=uk" relay "dc=dighum,dc=kcl,dc=ac,dc=uk" overlay rwm rwm-suffixmassage "dc=dighum,dc=kcl,dc=ac,dc=uk" ####################################################################### # Specific Directives for database dighum # database hdb suffix dc=dighum,dc=kcl,dc=ac,dc=uk rootdn "cn=admin,dc=dighum,dc=kcl,dc=ac,dc=uk" rootpw "CENSORED" directory "/var/lib/ldap" dbconfig set_cachesize 0 2097152 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_locks 1500 dbconfig set_lk_max_lockers 1500 index objectClass eq lastmod on checkpoint 512 30 ####################################################################### # ACLs # access to attrs=userPassword,shadowLastChange by peername.path="/var/run/slapd/ldapi" write by dn="cn=admin,dc=dighum,dc=kcl,dc=ac,dc=uk" write by anonymous auth by self write by * none access to dn.base="" by * read access to * by peername.path="/var/run/slapd/ldapi" write by dn="cn=admin,dc=dighum,dc=kcl,dc=ac,dc=uk" write by self write by * read ####################################################################### # Specific Directives for database #2, of type 'other' (can be @BACKEND@ too): #database <other> #suffix "dc=debian,dc=org" -- Tim Watts Personal Blog: http://www.dionic.net/tim/

4 10

authentication problem
by Chris 21 Jun '12

21 Jun '12

Hi I use openldap to do authentication on RHEL 6 machines. The problem I'm having is that 2 users doesn't get authenticated. When I do a getent passwd for these users it is as if they doesn't exist but a "ldapsearch -x" shows them. I would appreciate it if someone can point me int the right direction.

4 6

Replication and acl: moddn operation problem.
by Konstantin Menshikov 20 Jun '12

20 Jun '12

Hi. I have replication setup . Full replication of o=company, but user for replication (uid=replica,ou=users,o=company) is limited by ACL. Master configuration: access to dn.subtree="ou=users,o=company" attrs=userPassword by anonymous auth access to dn.base="o=company" by dn.exact="uid=replica,ou=users,o=company" read access to dn.subtree="ou=dev,o=company" by dn.exact="uid=replica,ou=users,o=company" read ####################################################################### # BDB database definitions ####################################################################### database hdb suffix "o=company" rootdn "cn=ldapadm,o=company" rootpw password directory /var/db/openldap-data/o=company overlay syncprov Slave configuration: ####################################################################### # BDB database definitions ####################################################################### database hdb suffix "o=company" rootdn "cn=ldapadm,o=company" rootpw password directory /var/db/openldap-data/o=company syncrepl rid=001 provider=ldap://ro1.devel.ldap.company.ru:389 type=refreshAndPersist retry="5 10 300 +" searchbase="o=company" scope=sub schemachecking=off starttls=critical bindmethod=simple tls_reqcert=never binddn="uid=replica,ou=users,o=company" credentials="password" Replication works. When i move object in forbidden by ACL subtree, then no information about this modification goes to the replica server e.g. operation on master server: dn: ou=groups2,ou=dev,o=company changetype: moddn newrdn: ou=groups2 deleteoldrdn: 1 newsuperior: ou=corp,o=company This object is not deleted and contextCSN is not updated on the replica. Is it expected behavior or not? -- Konstantin Menshikov

2 7

adding schema to master
by Stefano Zanmarchi 20 Jun '12

20 Jun '12

Hi, our master slapd (openldap 2.4.26 on RHEL 5.6) has just one slave, same version, not easily modifiable since not directly under our control. We need to have some more attributes in the master and don't need them to be replicated to the slave. Can I safely add a new schema in the slapd.conf of the master, without doing anything to the slave? Thanks a lot for your help, Stefano

2 1

Re: PAM authentication and PPolicy issues
by Clément OUDOT 20 Jun '12

20 Jun '12

2012/6/20 Francesco Belli <Francesco.Belli(a)vegaspace.com>: > Hi Clement, > I already used pam_password directive, I set it to cleartext, but this parameter is used for password change and not for authentication. As man pam_ldap says "Specifies the password change protocol to use", so not the authentication method. Now my situation is that I have some users in the LDAP server that they have a SHA hash in the userPassword field, and they are correctly authenticated, others that have a clear text password and cannot be authenticated via PAM. Password scheme used in LDAP directory do not prevent any application to authenticate to LDAP. Dig into logs to see what is the real reason of your problem. Clément.

4 4

Re: Uniqueness constraint over multiple attributes
by Michael Ströder 20 Jun '12

20 Jun '12

Jan, please follow-up on the mailing list (Cc:-ed) so others can answer and learn as well. Jan Beerden wrote: > We already tried that. We are trying to prevent user1 to have an email alias > that is the same as user2's primary email address. > [..] > What we would like is that a certain value (email address) has to be unique > across both the email and the alias attribute. Uniqueness is only per attribute. So this is not possible. Ciao, Michael.

1 0

Sun(oracle) directory server to openldap
by Stanislas LEVEAU 20 Jun '12

20 Jun '12

Hi I wonder if someone has already migrated from a Sun DSEE to openldap and establishment of a replication from SUN DSEE to openldap. thanks in advance Regards -- *Stanislas LEVEAU** *Rectorat de Caen 168, rue Caponière B.P. 6184 14061 CAEN Cedex Direction des Systèmes d'Information de l'Académie de Caen Département des infrastructures stanislas.leveau(a)ac-caen.fr Tel : 02.31.30.17.86

4 4

Binding to openldap fails
by Bjoern Wuest 20 Jun '12

20 Jun '12

Hello, I have OpenLDAP running on Ubuntu 12.04 . I use it as central directory for authentication as well as contact list. Authentication with LDAP works - locally and remotely. Also authentication via samba (run on same server as OpenLDAP) works. However, setting up the mail system (dovecot + postfix) I encountered a problem new to me. When I try to bind as a "normal" user (here: bjoern) to LDAP it fails with wrong credentials. I can assure that I did not mistyped the password (tried multiple times). Login to the Linux system and samba with same credentials (i.e. bjoern and his password) works. Here is the part of syslog I expect to be the cause: Jun 17 19:36:45 server slapd[23241]: <<< dnPrettyNormal: <cn=bjoern,ou=Users,dc=domain,dc=my>, <cn=bjoern,ou=users,dc=domain,dc=my> Jun 17 19:36:45 server slapd[23241]: conn=1003 op=0 BIND dn="cn=bjoern,ou=Users,dc=domain,dc=my" method=128 Jun 17 19:36:45 server slapd[23241]: do_bind: version=3 dn="cn=bjoern,ou=Users,dc=domain,dc=my" method=128 Jun 17 19:36:45 server slapd[23241]: Jun 17 19:36:45 server slapd[23241]: ==> hdb_bind: dn: cn=bjoern,ou=Users,dc=domain,dc=my Jun 17 19:36:45 server slapd[23241]: bdb_dn2entry("cn=bjoern,ou=users,dc=domain,dc=my") Jun 17 19:36:45 server slapd[23241]: daemon: epoll: listen=8 active_threads=0 tvp=zero Jun 17 19:36:45 server slapd[23241]: => hdb_dn2id("cn=bjoern,ou=users,dc=domain,dc=my") Jun 17 19:36:45 server slapd[23241]: daemon: epoll: listen=9 active_threads=0 tvp=zero Jun 17 19:36:45 server slapd[23241]: daemon: epoll: listen=10 active_threads=0 tvp=zero Jun 17 19:36:45 server slapd[23241]: daemon: epoll: listen=11 active_threads=0 tvp=zero Jun 17 19:36:45 server slapd[23241]: <= hdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30987) Jun 17 19:36:45 server slapd[23241]: send_ldap_result: conn=1003 op=0 p=3 Jun 17 19:36:45 server slapd[23241]: send_ldap_result: err=49 matched="" text="" Jun 17 19:36:45 server slapd[23241]: send_ldap_response: msgid=1 tag=97 err=49 As I configure OpenLDAP "old school" with slapd.conf, here is the ACL set in slapd.conf: access to attrs=userPassword,shadowLastChange,sambaLMPassword,sambaNTPassword by anonymous auth by self write by * none access to * by dn="cn=root,dc=domain,dc=my" write by * read access to dn.base="" by * read Googling for the above "DB_NOTFOUND", the only hint I could find were wrong file permissions. As I have setup my system for quick backup / restore I gave it a try and did "chmod -R 777 /" and also disabled apparmor. Yet, there was no difference in the error message. Could you please give me any indication for a solution? Mit freundlichen Grüßen / Kind regards Bjoern Wuest Hausener Strasse 6a 82269 Geltendorf Mobile: +49 1522 8777840

3 4

TLS issues when setting olcTLSCACertificateFile to the CA bundle
by Patrick Hemmer 20 Jun '12

20 Jun '12

Whenever I set olcTLSCACertificateFile to /etc/pki/tls/certs/ca-bundle.crt LDAP clients get cert errors connecting to the server. But it works fine when I point olcTLSCACertificateFile at the actual server cert instead of the CA bundle. With olcTLSCACertificateFile pointed at /etc/pki/tls/certs/ca-bundle.crt: CLIENT: # LDAPTLS_CACERT=/etc/pki/tls/certs/ca-bundle.crt ldapsearch -H 'ldap://fqdn.to.my.server' -ZZ -x -b '' -s base '+' ldap_start_tls: Connect error (-11) additional info: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (unable to get local issuer certificate) SERVER (from "slapd -d conns"): TLS: can't accept: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca. Why is this happening. olcTLSCACertificateFile is supposed to control the certificates that OpenLDAP will recognize, not affect the certificate it gives to clients (right?). This is OpenLDAP 2.4.31 -Patrick

5 8

PAM authentication and PPolicy issues
by Francesco Belli 20 Jun '12

20 Jun '12

Hi Everybody, I'm have some RHEL6 machines that use an LDAP server to authenticate. I need to introduce in the server some checks on passwords using PPolicy. PPolicy works fine, the problem is that to use pwdCheckQuality and pwdInHistory I need to save passwords in clear text in the LDAP server. I did a search to find out if there is a way to let PAM to use clear text password to authenticate but it seems that it sends SHA hashes, so authentication fails. Do you have any suggestion? Thanks, Francesco

2 1

autogenerated/virtual attributes
by btb＠bitrate.net 19 Jun '12

19 Jun '12

given an entry such as: dn=cn=abuse,ou=example.net,ou=mail,ou=groups,dc=example,dc=com objectclass=mailgroup cn=abuse member=uid=jdoe,ou=people,ou=accounts,dc=example,dc=com i'd like the entry to also include an attribute, generated automatically, based on the rdn of the entry and the superior's rdn. for example: dn=cn=abuse,ou=example.net,ou=mail,ou=groups,dc=example,dc=com objectclass=mailgroup cn=abuse member=uid=jdoe,ou=people,ou=accounts,dc=example,dc=com maillocaladdress=abuse(a)example.com where maillocaladdress is the automatically generated attribute. is this possible? it seems like something an overlay might accommodate, so i thought i might try experimenting with slapo-rwm, but wanted to also ask here in the meantime. thanks -ben

3 4

How does slapd get "secret" for a DN?
by ctosgh 19 Jun '12

19 Jun '12

Greetings, As section 15.2.3 in http://www.openldap.org/doc/admin24/sasl.html said "The server's copy of the shared-secret may be stored in Cyrus SASL's own sasldb database, in an external system accessed via saslauthd, or in LDAP database itself" How does slapd know where the secret is stored? Does slapd try each place in a predefined sequence? Thanks, Jacky

2 1

LDAP Educational Resources
by Roger Martinez 18 Jun '12

18 Jun '12

Hello all, Does anyone have any websites that they can recommend for a simple "getting started" approach to configuring OLC configuration of LDAP? I'm stuck at trying to figure out how to add my own DIT (dc=example,dc=net) so that i can add entries to it. Any guidance will be much appreciated. And thanks to Quanah and Nick for replying to my last request for help! -- Roger Martinez Intern incNETWORKS, inc.

2 2

syncrepl in refreshOnly mode, why nentries=0?
by Warren Howard 18 Jun '12

18 Jun '12

Dear All, I have a single provider and a single consumer setup. The consumer is set up to do syncrepl of type=refreshOnly and everything looks to be in order i.e. comparing the output of ldapsearch for provider and consumer shows that the directories are in sync. When I look at the logs on the provider I see that at times when there is "nothing to do" (the directories are in sync) that nentries=0 in the SEARCH RESULT from the syncrepl connection initiated by the consumer. Then, for example, when one new entry is on the provider, I see nentries=1 in the SEARCH RESULT when the consumer connects. So for syncrepl, nentries represents the difference in entries between the provider and the consumer. But this is not what I expected to find, I expected nentries from a syncrepl connection to match nentries from an equivalent (i.e. same search parameters) ldapsearch connection. Is my logic wrong and if so why? Regards, Warren.

2 3

contextCSN wanished on 2.3 consumers
by Turbo Fredriksson 18 Jun '12

18 Jun '12

Everything was working yesterday, I had upgraded my provider and two consumers to 2.4.31 and got a Nagios test working - all four consumers (two 2.4.31 and two 2.3.43 which can't/won't be upgraded at this time for various reasons) where all in sync. Their contextCSN mached perfectly. I got in this morning, showed of (with some pride :) the Nagios checks etc to my co workers. Started working on other things and a few minutes later another coworker came in complaining that the Nagios tests showed that the two 2.3 servers where 10 days old! Looking at the contextCSN on all servers showed that they where (suddenly!!) missing from the 2.3 servers. And No one have been fiddeling with the config or the database. Any idea what could have happened and how to fix it? -- ... but you know as soon as Oracle starts waving its wallet at a Company it's time to run - fast. /illumos mailing list

1 0

GCC 4.7
by Turbo Fredriksson 17 Jun '12

17 Jun '12

Has anyone tried compile OpenLDAP with gcc 4.7? Is there any speed increase noticed? Gcc 4.7 'is supposed' to make applications up to 50% faster, so... ? -- ... but you know as soon as Oracle starts waving its wallet at a Company it's time to run - fast. /illumos mailing list

1 0

Re: Problem with slapo-lastbind => segfault
by Mark Goldenstein 16 Jun '12

16 Jun '12

Hello, I'm trying to set up LDAP to track the last login of users via the slapo-lastbind overlay. I'm using the the OpenLDAP package supplied with Ubuntu 10.04 LTS. I've cloned the git repository referenced on openldap.org, switched to the lastbind directory in contrib and then ran make and make install. Then I've copied the lastbind.so* and lastbind.la files to /usr/lib/ldap and adjusted the permissions accordingly. Afterwards, I've added lastbind to cn=module to load the module. However, slapd does not start anymore and I get the following error in syslog: kernel: [2716850.919891] slapd[15422]: segfault at 6 ip 00007f0e1555ba36 sp 00007fff70b26118 error 4 in libc-2.11.1.so[7f0e15435000+17a000] Am I doing something wrong? Best regards, Mark

2 2

Monitoring 2.3.43?
by Turbo Fredriksson 16 Jun '12

16 Jun '12

First of: I know it's old, we ARE going to upgrade at the next service interval in a few weeks! But in the meantime, is there any way to know/figure out if the master and it's slave(s) are in sync? One idea, of using a special object which is written to every x minute and then checked for consistency came up... Of course it's not a nice solution, but it is A solution... The reason for this is that yesterday our secondary LDAP server (the primary read server) stopped returning queries (might be a file lock or open filehandles problem - exact reason unknown for the moment). And for some reason, the primary LDAP server (the one we use for writes, the sync master) had an old version of the database - we THINK it happened at the last power failure in that serverroom. It brought up an old version (bdb problems possibly). So the failover to the master worked, but it was to old. And i didn't manage to do a recover on the failed bdb database. Luckily we had a SECOND replica in another city (which was in sync with the changes we did just a few hours earlier), so I did a dump of that database and loaded the primary replica (the one that failed/hung/crashed) with that. But the fact that the replica master and the slaves where out of sync worries us a little. This will be fixed correctly with an upgrade, but until then we would like to have at least _some_ way of checking the status of the sync... Any ideas for a quick hack? -- ... but you know as soon as Oracle starts waving its wallet at a Company it's time to run - fast. /illumos mailing list

6 10

Access Log: dynamic configuration problems.
by Francesco Belli 15 Jun '12

15 Jun '12

Hello everybody, I'm using OpenLdap version 2.4.24 (4 Oct 2011) on a RedHat 6 machine. I use dynamic configuration and I'm having some problems setting up accesslog overlay. I didn't change the following file in etc/openldap/slapd.d/cn=config/ : olcDatabase={-1}frontend.ldif olcDatabase={0}config.ldif olcDatabase={1}monitor.ldif I moved olcDatabase={2}bdb.ldif to olcDatabase={3}bdb.ldif, in this way it is loaded after the access log database that is defined in the new olcDatabase={2}bdb.ldif Here there are the two configuration files: ######### olcDatabase={2}bdb.ldif ############### dn: olcDatabase={2}bdb objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {2}bdb olcDbDirectory: /var/lib/ldap/accesslog/ olcSuffix: cn=accesslog olcAccess: {0}to dn.subtree="cn=accesslog" by dn.exact="uid=manager,ou=Users,dc=domain,dc=com" manage by dn.exact="cn=config" read olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=accesslog olcSizeLimit: unlimited olcTimeLimit: unlimited olcMonitoring: TRUE olcDbCacheSize: 10000 olcDbCheckpoint: 64 5 olcDbNoSync: FALSE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 10000 olcDbIndex: entryCSN eq olcDbIndex: objectClass eq olcDbIndex: reqEnd eq olcDbIndex: reqResult eq olcDbIndex: reqStart eq olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 ######### olcDatabase={3}bdb.ldif ############### dn: olcDatabase={3}bdb objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {3}bdb olcSuffix: dc=domain,dc=com olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=Manager, dc=domain,dc=com olcRootPW: pippopippo olcSyncUseSubentry: FALSE olcMonitoring: TRUE olcDbDirectory: /var/lib/ldap olcDbCacheSize: 1000 olcDbCheckpoint: 1024 15 olcDbNoSync: FALSE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 0 olcDbIndex: objectClass pres,eq olcDbIndex: cn pres,eq,sub olcDbIndex: uid pres,eq,sub olcDbIndex: uidNumber pres,eq olcDbIndex: gidNumber pres,eq olcDbIndex: mail pres,eq,sub olcDbIndex: ou pres,eq,sub olcDbIndex: loginShell pres,eq olcDbIndex: sn pres,eq,sub olcDbIndex: givenName pres,eq,sub olcDbIndex: memberUid pres,eq,sub olcDbIndex: nisMapName pres,eq,sub olcDbIndex: nisMapEntry pres,eq,sub olcDbIndex: entryCSN eq olcDbIndex: entryUUID eq olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 structuralObjectClass: olcBdbConfig entryUUID: 9ef24df8-376a-1031-947f-692d47ac0213 creatorsName: cn=config createTimestamp: 20120521082800Z entryCSN: 20120521082800.652940Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20120521082800Z olcOverlay: syncprov olcSpCheckpoint: 50 10 olcSpSessionlog: 100 olcOverlay: accesslog olcAccessLogDB: cn=accesslog olcAccessLogOps: writes olcAccessLogSuccess: TRUE olcAccessLogPurge: 07+00:00 01+00:00 When I run slapd -d 1 I obtain the following error that makes slapd to terminate: backend_startup_one: starting "cn=accesslog" bdb_db_open: warning - no DB_CONFIG file found in directory /var/lib/ldap/accesslog/: (2). Expect poor performance for suffix "cn=accesslog". bdb_db_open: database "cn=accesslog": dbenv_open(/var/lib/ldap/accesslog/). backend_startup_one: starting "dc=domain,dc=com" bdb_db_open: warning - no DB_CONFIG file found in directory /var/lib/ldap: (2). Expect poor performance for suffix "dc=domain,dc=com". bdb_db_open: database "dc=domain,dc=com": dbenv_open(/var/lib/ldap). accesslog: "logdb <suffix>" missing or invalid. backend_startup_one (type=bdb, suffix="dc=domain,dc=com"): bi_db_open failed! (1) slapd shutdown: initiated It seems that for some reason slapd doesn't like the olcAccessLogDB directive specified in olcDatabase={3}bdb.ldif. I tried some other configuration (I think that this is the more correct) but the problem is always there. Thanks for any help, Francesco

2 1

Re: syncrepl, version compatibility, partial sync
by Quanah Gibson-Mount 14 Jun '12

14 Jun '12

--On Thursday, June 14, 2012 11:00 AM -0700 Ryan Lovett <relovett(a)gmail.com> wrote: > > On Thu, Jun 14, 2012 at 10:55 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> > wrote: > > > --On Thursday, June 14, 2012 10:31 AM -0700 Ryan Lovett > <relovett(a)gmail.com> wrote: > > Are there any known syncrepl compatibility issues between different 2.4.x > versions? We have a master slapd running 2.4.9 and a consumer running > 2.4.21 and are having a syncrepl problem and only some of the data is > being synced. The consumer slapd logs messsages of the form: > > > a) Always run the same versions everywhere > > b) Both of those versions are out of date, and have known issues with > syncrepl. > > c) Upgrade to 2.4.31. > > > > > > I see, thanks for your feedback. We had been hoping we could rely on our > vendor's (Ubuntu LTS; 8.04 and 10.04) releases. I'll build from source. a) Please keep replies on the list b) Read <http://www.openldap.org/faq/data/cache/1456.html> from Debian c) Link to OpenSSL when you build your own d) Read <http://www.openldap.org/software/release/changes.html> --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 1

Re: syncrepl, version compatibility, partial sync
by Quanah Gibson-Mount 14 Jun '12

14 Jun '12

--On Thursday, June 14, 2012 11:00 AM -0700 Ryan Lovett <relovett(a)gmail.com> wrote: > > On Thu, Jun 14, 2012 at 10:55 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> > wrote: > > > --On Thursday, June 14, 2012 10:31 AM -0700 Ryan Lovett > <relovett(a)gmail.com> wrote: > > Are there any known syncrepl compatibility issues between different 2.4.x > versions? We have a master slapd running 2.4.9 and a consumer running > 2.4.21 and are having a syncrepl problem and only some of the data is > being synced. The consumer slapd logs messsages of the form: > > > a) Always run the same versions everywhere > > b) Both of those versions are out of date, and have known issues with > syncrepl. > > c) Upgrade to 2.4.31. > > > > > > I see, thanks for your feedback. We had been hoping we could rely on our > vendor's (Ubuntu LTS; 8.04 and 10.04) releases. I'll build from source. Please keep replies on-list. Thanks. You may wish to read: <http://www.openldap.org/faq/data/cache/1456.html> written by one of the Debian OpenLDAP maintainers. I also suggest reading: <http://www.openldap.org/software/release/changes.html> Finally, when you go to build it yourself, I highly recommend linking to OpenSSL, rather than GnuTLS. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

syncrepl, version compatibility, partial sync
by Ryan Lovett 14 Jun '12

14 Jun '12

Are there any known syncrepl compatibility issues between different 2.4.x versions? We have a master slapd running 2.4.9 and a consumer running 2.4.21 and are having a syncrepl problem and only some of the data is being synced. The consumer slapd logs messsages of the form: entries have identical CSN ou=something,dc=something 20120614015145.546743Z#000000#000#000000 and syncrepl_entry: rid=200 entry unchanged, ignored (ou=other,dc=something) syncrepl_message_to_entry: rid=200 mods check (objectClass: value #8 invalid per syntax) do_syncrepl: rid=200 rc 21 retrying (9 retries left) In searching for similar reports we came across various solutions such as making sure the provider URI in the consumer's slapd.conf matches the server's URI at launch. The server was listening on ldap:/// and the consumer was set to connect to ldap://server.name/ though we modified the server to only listen on ldap://server.name/. We also tried stopping both consumer and master, flushing the databases on both, slapadding data back into the master, then starting both instances. The log messages return however just with updated CSN stamps. The consumer is never able to pull down the full data even with refreshAndPersist with sensible retry intervals. Thanks for your time, Ryan

2 1

loglevel expected performance impact
by Berend De Schouwer 14 Jun '12

14 Jun '12

I'm running some 2.4.23 servers, and I've encountered some slowdown on loglevel other than 0. Even 256 (stats; recommended) impacts about a 4x slowdown on queries. Logging is to syslog. Running ldapsearch slows from 0.005-0.010 seconds to about 0.030-0.040 seconds; and that includes loading the binary. That's from localhost to remove potential DNS lookups. I stumbled across this when logging was wrong, and the slowdown was 100x. I'm aware that 2.4.23 isn't the latest version. I'm also quite happy, for now, to run loglevel 0. I'm wondering if this is the expected behaviour, given that it's the recommended configuration. Or should I go dig to find the slowdown? (I did check the indexes, and db_stats, etc. All seems fine.) I apologise for the disclaimer, Berend CONFIDENTIALITY NOTICE The contents of and attachments to this e-mail are intended for the addressee only, and may contain the confidential information of Argility (Proprietary) Limited and/or its subsidiaries. Any review, use or dissemination thereof by anyone other than the intended addressee is prohibited. If you are not the intended addressee please notify the writer immediately and destroy the e-mail. Argility (Proprietary) Limited and its subsidiaries distance themselves from and accept no liability for unauthorised use of their e-mail facilities or e-mails sent other than strictly for business purposes.

3 3

OLC Configuration on RHEL6
by Roger Martinez 12 Jun '12

12 Jun '12

Greetings all, I've only just recently learned about configuring and using LDAP using slapd.conf configuration. Recently, however, I have been asked to configure LDAP on a server running Red Hat Enterprise Linux 6. I've run into a few problems. First of all, when I try to connect via LDAP Browser/Editor to view the cn=config list, it connects but gives me Error 32 - No Such Object. The following is the the cfg file that Ldap Browser/Editor uses to connect to the session: ################################# # # # LDAP Browser v2.8 config file # # # # cn=config all attributes # # # ################################# host=[my server's IP address] port=389 sslport=636 basedn=cn=config version=3 managerdn=cn=Manager,cn=config managerlogin=no autoconnect=no leafindicatortype=int leafindicator=numsubordinates managereferrals=no supportsmovetree=no derefaliases=never sorttree=ascending ldap.attributes.list=* + The managerdn i got from the olcRootDN line in olcDatabase={2}bdb.ldif file. And the rest i got from zytrax.com online book ( http://www.zytrax.com/books/ldap/ch14/cn=config.cfg ) My question is, is there any other configuration or any other additional steps that I need to take after yum install in order to make this LDAP server functional? What have I missed? Any help will be much appreciated! Thank you. -- Roger Martinez Intern incNETWORKS, inc.

3 3

attrs=@objectClassName affects objectClass attribute
by Nick Milas 12 Jun '12

12 Jun '12

I am facing the following problem (with v2.4.31 on CentOS 5.8). I am using a - recently added - custom schema with one AUX objectclass and 3 optional attrs; I am trying to use an ACL of the form: access to dn.subtree="ou=people,dc=example,dc=com" attrs=@entryAccessEntities by group/groupOfNames/member.exact="cn=Admins,ou=groups,dc=example,dc=com" read but strangely this ALSO changes the privileges for the objectClass attribute of the entry! If I list the attrs of that object class instead, there is no problem: access to dn.subtree="ou=people,dc=example,dc=com" attrs=writeAccessEntities,readAccessEntities,searchAccessEntities by group/groupOfNames/member.exact="cn=Admins,ou=groups,dc=example,dc=com" read Now, the ACL works correctly, and it does not affect the entry objectClass attribute. Surprisingly, this does not happen with other object classes. If I use, for example: access to dn.subtree="ou=people,dc=example,dc=com" attrs=@eduPerson by group/groupOfNames/member.exact="cn=Admins,ou=groups,dc=example,dc=com" read then, it correctly assigns privileges to only the attrs of eduPerson object class (also an AUX class with only optional attrs), without affecting the entry objectclass attribute. Does anyone have an idea what is happening? Am I doing anything wrong? Any help will be appreciated. For reference I include the schema below. Note: I am using dynamic config, but I have listed schema and ACLs in their "standard" form, for better readability. Thanks, Nick ===================================================== entryaccess.schema ===================================================== attributetype ( 1.3.6.1.4.1.39349.4.1.11 NAME 'writeAccessEntities' DESC 'DNs of Groups which should be allowed write (full) access to this entry' SUP distinguishedName ) attributetype ( 1.3.6.1.4.1.39349.4.1.12 NAME 'readAccessEntities' DESC 'DNs of Groups which should be allowed read (read-only) access to this entry' SUP distinguishedName ) attributetype ( 1.3.6.1.4.1.39349.4.1.13 NAME 'searchAccessEntities' DESC 'DNs of Groups which should be allowed search (search-only) access to this entry' SUP distinguishedName ) objectclass ( 1.3.6.1.4.1.39349.4.2.101 NAME 'entryAccessEntities' DESC 'Allow access to the entry, to which this class is added, to the entities specified as the values (DNs) of this class attributes' SUP top AUXILIARY MAY ( writeAccessEntities $ readAccessEntities $ searchAccessEntities ) ) =====================================================

6 13

slapd hangs - subtree insert failed: -30995
by Meike Stone 11 Jun '12

11 Jun '12

Hello, after inserting (ADD) one object, I get following messages in the logfile and the sapld hangs: Jun 1 09:02:24 ldap-01 slapd[8836]: conn=633789 op=1 ADD dn="cn=3,cn=2,cn=node,cn=1,cn=BBB,cn=AAA,cn=companies,ou=root" Jun 1 09:02:24 ldap-01 slapd[8836]: => bdb_idl_insert_key: c_get failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30995) Jun 1 09:02:24 ldap-01 slapd[8836]: => bdb_dn2id_add 0x205e7e: subtree (cn=BBB,cn=AAA,cn=companies,ou=root) insert failed: -30995 After this, I don't see any messages in the log till the staff was initiating a stop/start: Jun 1 09:09:29 ldap-01 slapd[8836]: daemon: shutdown requested and initiated. Jun 1 09:09:29 ldap-01 slapd[8836]: conn=633113 fd=9 closed (slapd shutdown) Jun 1 09:09:29 ldap-01 slapd[8836]: conn=405426 fd=12 closed (slapd shutdown) Jun 1 09:09:29 ldap-01 slapd[8836]: conn=633787 fd=13 closed (slapd shutdown) Jun 1 09:09:29 ldap-01 slapd[8836]: conn=1011 fd=14 closed (slapd shutdown) Jun 1 09:09:29 ldap-01 slapd[8836]: conn=1013 fd=18 closed (slapd shutdown) Jun 1 09:09:29 ldap-01 slapd[8836]: conn=632703 fd=33 closed (slapd shutdown) Jun 1 09:09:29 ldap-01 slapd[8836]: conn=632710 fd=37 closed (slapd shutdown) Jun 1 09:09:29 ldap-01 slapd[8836]: conn=632883 fd=39 closed (slapd shutdown) Jun 1 09:09:29 ldap-01 slapd[8836]: conn=632762 fd=40 closed (slapd shutdown) Jun 1 09:09:29 ldap-01 slapd[8836]: conn=633211 fd=41 closed (slapd shutdown) Jun 1 09:09:29 ldap-01 slapd[8836]: conn=633735 fd=45 closed (slapd shutdown) Jun 1 09:09:29 ldap-01 slapd[8836]: conn=632829 fd=47 closed (slapd shutdown) Jun 1 09:09:29 ldap-01 slapd[8836]: conn=633170 fd=48 closed (slapd shutdown) Jun 1 09:09:29 ldap-01 slapd[8836]: conn=633200 fd=50 closed (slapd shutdown) Jun 1 09:09:29 ldap-01 slapd[8836]: conn=633788 fd=55 closed (slapd shutdown) Jun 1 09:09:29 ldap-01 slapd[8836]: slapd shutdown: waiting for 22 operations/tasks to finish Jun 1 09:09:42 ldap-01 slapd[20945]: @(#) $OpenLDAP: slapd 2.4.30 $ opensuse-buildservice(a)opensuse.org Jun 1 09:09:43 ldap-01 slapd[20945]: slapd starting After the error message at 09:02:24 the slapd did not answer any request. I cannot recover that problem in a test environment. The server is running in a MM environment (two masters), and the server gets 200-1200 search request/s Because of this high rate, we set "loglevel 0". Since we updated the slapd to 2.4.30 (from 2.4.28) the server crashes/hangs about on times a week. Because of this we set loglevel 256 back again. Would be very nice, if I can fix the problem, please help. Thanks in advance Meike PS: The slapd is a modified, self compiled version because of larger IDL with following changes: openldap-2.4.30/servers/slapd/back-bdb/idl.h: -#define BDB_IDL_LOGN 16 /* DB_SIZE is 2^16, UM_SIZE is 2^17 */ +#define BDB_IDL_LOGN 17 /* DB_SIZE is 2^17, UM_SIZE is 2^18 */ openldap-2.4.30/include/ldap_pvt_thread.h: -# define LDAP_PVT_THREAD_STACK_SIZE ( 1 * 1024 * 1024 * sizeof(void *) ) +# define LDAP_PVT_THREAD_STACK_SIZE ( 2 * 1024 * 1024 * sizeof(void *) ) All tests where running well!

1 2

LDAP backend filtering
by Smarti9＠gmx.de 11 Jun '12

11 Jun '12

Hi everybody, I'm quite new to openldap and I'm currently trying to find a solution for the following problem: To populate an address book I need to read users and some attributes from an Active Directory. I need to map several attributes to a new attribute name. More important is to filter on active users and skip the disabled ones. My address book application is not able to do this, it can simply query the whole AD. My idea was to use openldap as some kind of proxy between the application and the AD. I've setup openldap with the following configuration: database ldap suffix "dc=xxxx,dc=local" uri "ldap://192.168.50.1" rebind-as-user protocol-version 3 overlay rwm rwm-map attribute uid samaccountname rwm-map attribute address street This works perfect for getting the data out of the AD and remap the attribute names. Unfortunately I wasn't able to restrict the results to active users. The query string which does this looks like this: "(&(objectClass=User)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))" Can anyone please point me to the right direction how I can set this as a filter towards the AD to only get back the results matching this filter? Thanks a lot to everyone for your help! Michael -- NEU: FreePhone 3-fach-Flat mit kostenlosem Smartphone! Jetzt informieren: http://mobile.1und1.de/?ac=OM.PW.PW003K20328T7073a

2 1

back-sql slow searches
by Martijn van Duren 08 Jun '12

08 Jun '12

Hello, I'm currently setting up a postgresql database which parts need to be accesible through LDAP. The initial setup turned out great. I can bind to my user accounts and I can dump the database through ldapsearch. The problem I'm currently facing is that searches take to long. The ldap_entries table currently contains 3563 entries and searching for any attribute (even when it's part of the dn) takes about 1.25 minutes, which seems rather long for a db backend. Looking at my postgresql logs it appears that when a search is being done every relation gets fully retrieved and most likely filtered in slapd. Is there a certain configuration option I've missed to speed up the searches or is this something I can view as a bug. Thanks for your response.

1 0

Migrating 2.4 issue
by Luc MAIGNAN 07 Jun '12

07 Jun '12

Hi, I try to upgrade openldap to 2.4. Considering the documentation on my new freshly installed server on which I've restored the slapd.conf of a previous server, I try : slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d This gives me this issue : bdb_db_open: database "dc=domain,dc=com": db_open(/var/lib/ldap/id2entry.bdb) failed: No such file or directory (2). backend_startup_one (type=bdb, suffix="dc=domain,dc=com"): bi_db_open failed! (2) I've found on internet that I can safely ignore this, but it doesn't really work (slapd doesn't want to start correctly after) How can I fix it ? Thanks for any help Regards

2 1

Syncrepl replication does not work always
by Efstathios Xagoraris 07 Jun '12

07 Jun '12

Hello to everyone, I have a working OpenLDAP setup ( 2.3.43 - Centos 5.8 RPM ) with a Master LDAP and consumers worldwide across datacenters. I also monitor if directories from Consumers are in Sync with the master. Consumers sometimes fail to communicate with master ldap and replicate.Syncrepl retry interval does not work at that time. If i restart consumer LDAP service everything works as expected,changes replicate successfully. My consumer interval is 1 minute but when the directories are not in sync i dont see syncrepl messages in my logs. My logs: Jun 7 02:22:12 xxx slapd[26433]: do_syncrep2: rid 007 LDAP_RES_SEARCH_RESULT (Normal ...) Jun 7 02:23:12 xxx slapd[26433]: do_syncrep2: rid 007 LDAP_RES_SEARCH_RESULT (Normal ...) >From now on .. syncrepl does not appear on logs, i got only that line Jun 7 02:27:22 xxx slapd[26433]: do_syncrep1: rid 007 ldap_sasl_bind_s failed (-1) I restart ldap service and everything works as expected Jun 7 17:06:40 xxx slapd[4397]: syncrepl_entry: rid 007 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Jun 7 17:06:40 xxx slapd[4397]: syncrepl_entry: rid 007 be_search (0) Jun 7 17:06:42 xxx slapd[4397]: do_syncrep2: rid 007 LDAP_RES_SEARCH_RESULT Jun 7 17:07:44 xxx slapd[4397]: do_syncrep2: rid 007 LDAP_RES_SEARCH_RESULT Jun 7 17:08:45 xxx slapd[4397]: do_syncrep2: rid 007 LDAP_RES_SEARCH_RESULT My consumers config: syncrepl rid=007 provider=ldaps://master:636 bindmethod=simple binddn="cn=xxx,dc=xxx,dc=xxx" credentials=xxxx searchbase="dc=xxx,dc=xxx" scope=sub schemachecking=on #type=refreshAndPersist #retry="30 20 60 +" type=refreshOnly interval=00:00:01:00 updateref ldaps://master And my master config: database bdb suffix "dc=xxx,dc=xxx" rootdn "cn=xxx,dc=xxx,dc=xxx" rootpw {SSHA}xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx directory /var/lib/ldap index objectClass eq,pres index ou,cn,mail,surname,givenname,gecos,description eq,pres,sub index uidNumber,gidNumber,uniqueMember,homeDirectory,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub loglevel 256 16384 logfile /var/log/ldap.log overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 At the same time,when my directories are not in sync,my consumer in the same datacenter as the master is always in sync.This is fixed when i restart ldap service on consumers.Replication works for some hours after the restart and the interval consumers do not replicate is kind of random. Maybe a network issue as passing through firewall to reach consumers in other datacenters ? I have also tried changing the type of syncrepl to refreshAndPersist and the issue still exists. It seems this issue is similar to this ( http://www.openldap.org/lists/openldap-technical/200905/msg00024.html ) but i thought pull bashed syncrepl from refreshOnly should not be impacted from states being dropped. << This sort of problem with long-lived connections is often due to state being dropped from IP-level devices. >> Thanks a lot everyone

3 3

there is no schema by the directory
by Daniel Peinado Lopez 07 Jun '12

07 Jun '12

Hello, I have installed openldap in Fedora. First I deleted the openldap installation. (var/lib/ldap and etc/openldap) Then I wrote: yum reinstall openldap-client openldap-server openldap I configured slapd.conf with my domain, the root password with slappasswd, ldap.conf with my BASE and HOST. I copied the DB_CONFIG.example to /var/lib/ldap. I did my base.ldif of the structure of my LDAP and "ldapadd" everything succesfully. I use jXplore and Apache Directory Studio to manage my LDAP from Windows, because it´s installed in one server. The problem is that when I try to add users it says I have no schema. Apache Directory Studio creates its own schema, and I can add data. But after that schema disapears and I can't work with jXplorer. Thank you very much * * Daniel Peinado López *IANT - APPLIED NGN-TECHNOLOGIES **Turn-Key VoIP/UC Solutions and More... *Fon: +49 (5331) 6794 400 Fax: +49 (5331) 6794 499 Mail: daniel.peinado(a)iant.de <jan.schumacher(a)iant.de> Web: www.iant.de <http://www.iant.de/en/startseite> IANT is eZuce <http://www.ezuce.com/> Elite Partner for EMEA IANT is Member of GROUPLINK <http://www.grouplink.de/>

2 1

bind as users logging/authenticating into solaris with ldap client configured
by curious penguin 06 Jun '12

06 Jun '12

My solaris machine is configured to authenticate to an openldap server but is currently binding anonymously. How do I reconfigure its ldap client to bind as the user that its trying to query from the ldap server?

1 0

Pass-though Authentication with Saslauthd and Kerberos
by Jeff B 06 Jun '12

06 Jun '12

I'm attempting to get pass-though auth to work against saslauthd and kerberos and while the problem seems to be in sasl I think it's most likely to be seen in this type of configuration with opendap which I why I chose this mailing list. When I run testsaslauthd it works but when I run ldapsearch it fails. But the curious thing is where it is failing. in doing straces of saslauthd and packet traces I've found that when ldapsearch calls salsauthd, and not when I run saslauthd kerberos does not deliver the AS-REP packets till just after saslauthd times out. I can't find any difference in how I'm invoking saslauthd with testdaslauthd and how ldapsearch is invoking saslauthd. However the packet traces are quite different as you will see below. I've seen these kind of errors here and there on google but no resolutions that I can find. (http://www.openldap.org/lists/openldap-software/200602/msg00278.html) Centos 6 openldap-2.4.23-15.el6_1.3.x86_64 openldap-clients-2.4.23-15.el6_1.3.x86_64 openldap-servers-2.4.23-15.el6_1.3.x86_64 openldap-devel-2.4.23-15.el6_1.3.x86_64 krb5-server-1.9-9.el6_1.2.x86_64 krb5-server-ldap-1.9-9.el6_1.2.x86_64 krb5-workstation-1.9-9.el6_1.2.x86_64 krb5-libs-1.9-9.el6_1.2.x86_64 cyrus-sasl-2.1.23-8.el6.x86_64 cyrus-sasl-lib-2.1.23-8.el6.x86_64 cyrus-sasl-gssapi-2.1.23-8.el6.x86_64 cyrus-sasl-plain-2.1.23-8.el6.x86_64 cyrus-sasl-devel-2.1.23-8.el6.x86_64 My slapd.conf contains nothing regarding kerberos / sasl / pass-through authentication. I'm using a slapd.conf file for the time being till i get it all worked out and plan on converting it to a cn=config configuration. In my DIT the userPassword field contains: {SASL}myuser@MYREALM where myuser and my realm are replaced with the proper values. /etc/sasl2/slapd.conf: mech_list: plain pwcheck_method: saslauthd saslauthd_path: /var/run/saslauthd/mux /etc/sysconfig/saslauthd KRB5_KTNAME=/etc/krb5.keytab SOCKETDIR=/var/run/saslauthd MECH=kerberos5 Which builds a daemon command line of: /usr/sbin/saslauthd -m /var/run/saslauthd -a kerberos5 My system keytab is: /etc/krb5.keytab (root.ldap 0640) host/my.hostname@realm ldap/my.hostname@realm My socket parent dir is: /var/run/saslauthd (root.ldap 0770) When I run testsaslauthd I get a packet trace between saslauthd and kerberos is all UDP and works: > AS-REQ < KRB5KDC_ERR_PREAUTH_REQUIRED (25) > AS-REQ < AS-REP > TGS-REQ < TGS-REP When I run ldapsearch the packet trace between saslauthd and kerberos is UDP and TCP communication. None of the kerberos replies come back for 18 seconds, the time it takes saslauthd to time out. > AS-REQ < KRB5KDC_ERR_PREAUTH_REQUIRED (25) > AS-REQ > TCP SYN < TCP SYN, ACK > TCP ACK > TCP AS-REQ < TCP ACK > AS-REQ > AS-REQ > TCP FIN, ACK <-- saslauthd times out and the AS-REPS all come back at once. < AS-REP < AS-REP < AS-REP < TCP AS-REP > TCP RST an strace of saslauthd supports this timeout theory as it shows the the timeouts and backoffs. I can't find any info regarding saslauthd and TCP or UDP or timeouts like this. Any ideas?

5 7

Wildcard and Internal Domain
by Leonardo 06 Jun '12

06 Jun '12

Dear Colleagues. I attempted implementing certificates with wildcard to my internals servers. I have a Internal Certification Authority and it certificate was distributed to ours Browsers on Workstations that have a need to access the servers by Web Browser. I generated a certificate with wildcard for my servers and when i access the servers by web browser the following message is showed "O servidor v221t001.prevnet usa um certificado de segurança inválido. O certificado é válido somente para *.prevnet. (Código do erro: ssl_error_bad_cert_domain)". I would like some help to solve it problem. I thank everyone for attention.

2 3

slaptest conversion of acl regex's drops backslashes
by Nick Milas 06 Jun '12

06 Jun '12

Hi, I used slaptest to convert a set of ACLs from standard to dynamic format using slaptest. I noticed that backslashes (used to escape characters) in regexes are silently dropped after conversion. For example: access to dn.regex="^dc=\b\d{1,3}\.\d{1,3}\.\d{1,3}\b\.in-addr\.arpa,ou=dns,dc=example,dc=com$" by group.exact="cn=Admins,ou=Groups,dc=example,dc=com" write becomes: olcAccess: {xx}to dn.regex="^dc=\b\d{1,3}\.\d{1,3}\.\d{1,3}\b\.in-addr\.arpa,ou=dns,dc=example,dc=com$" by group/groupOfNames/member.exact="cn=admins,ou=groups,dc=noa,dc=gr" write Is this expected behavior? Or am I doing something wrong? Please advise. Thanks, Nick

2 6

ACL rule match if client certificate was used?
by Patrick Hemmer 05 Jun '12

05 Jun '12

Is there any way to create an ACL rule which will match if a client certificate was used on the connection or not? I'd like to do an ACL such as to attrs=userPassword by peername.ip="1.2.3.0%255.255.255.0" auth by client_ssf="64" auth Also set olcTLSVerifyClient=try This will let our internal network authenticate against ldap without needing a client cert, but anyone outside our internal network must have one. We would then use our own CA to create certificates for all the clients and tell OpenLDAP to trust only that CA. Obviously client_ssf doesnt exist, but is there another way of accomplishing this goal? -Patrick

3 4

openldap gssapi bind
by Sajid K 05 Jun '12

05 Jun '12

hi, i'm writing an AD client for mac i'm able to get a kerberos ticket and can also bind to AD using ldap_gssapi_bind and everything works fine I can do searches modify/create attributes etc. when I unbind and try to bind to a different server, it hangs in a "select" call inside openldap lib. even though I've successfully got a TGS ticket before binding. I'm using heimdal for kerberos implementation. I also have cyrusSASL in the project. in one of my test environments it tries to go back to old "server" to get ticket. so I'm assuming there is some sort of caching involved here. before rebinding I always delete the credential cache file and krb5.conf and re create them for new server. I'm not using an conf file with openldap. What could be going on is there some kind of caching somewhere in library? there are no errors when unbinding and I can also see a call getting to server when I unbind. Thanks..

3 2

Re: Replication and user password change
by Hugo Deprez 04 Jun '12

04 Jun '12

Hello, I am trying to do some quite the same thing : trying to send failed authentification made on the consumer to the master. I am using ppolicy overlay. I added the following to the consumer : # Referal updateref ldaps://master.domain.fr ppolicy_forward_updates When I add this on the consumer, accounts are not anymore locked on failed authentification. pwdFailureTime are not register or sent to the master.. Should I use slapo-chain too ? Regards, Hugo On 6 April 2012 18:12, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Friday, April 06, 2012 3:57 PM +0200 Jacques Foucry > <jacques.foucry(a)novasparks.com> wrote: > >> On 04/04/2012 05:59 PM, anax wrote: >> >> Hello, >> >>> updateref ldap://ldapmaster.symas.com >>> >>> http://www.openldap.org/doc/admin24/replication.html#Replication%20Techn >>> ology >> >> >> Well after reading the docs, I made some test on a VM. >> >> My goal is to allow users to change there password. >> >> I have a working replication VM. On this VM I can login with my LDAP >> password (PAM on this VM is client of the replica). >> >> When I try to change the password, using the passwd cmd this error occurs: > > > I suggest you look at slapo-chain. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

3 4

ACL control with break
by Nick Milas 04 Jun '12

04 Jun '12

At slapd.access we read (about the control keywords): One useful application is to easily grant write privileges to an updatedn that is different from the rootdn. In this case, since the updatedn needs write access to (almost) all data, one can use access to * by dn.exact="cn=The Update DN,dc=example,dc=com" write by * break as the first access rule. As a consequence, unless the operation is performed with the updatedn identity, control is passed straight to the subsequent rules. I have the following question. If below the above ACL we add another ACL like: access to dn.subtree="ou=people,dc=example,dc=com" by dn.exact="cn=Some Other DN,dc=example,dc=com" by * none ...doesn't this mean that the second ACL will override the first, so that "The Update DN" will no longer have access to the whole DIT (as was intended), since, based on the second ACL, "The Update DN"does not have access to "ou=people" branch? If this is the case, then the first ACL is not enough, but care must be taken to avoid any privilege revocation(s) from "The Update DN", by following ACLs. Or the existence of the former rule means that access has been *definitively decided* for "The Update DN" (i.e. "by" clause match(es) in the first ACL) and any subsequent access statements (later ACLs) can affect *ONLY* other users (i.e. whatever "by" clause matches, *except* "The Update DN")?? This is what I understand from the statement "As a consequence, unless the operation is performed with the updatedn identity, control is passed straight to the subsequent rules." Can you please clarify which is the case? Thanks, Nick

3 9

Syncrepl partial replication based on attribute problem
by Jeffrey Crawford 02 Jun '12

02 Jun '12

Hello, I had thought I tested this beforehand but I seem to be able to reliably reproduce the following situation: We have an installation where the provider server has information that is replicated to downstream replicas using the syncrepl protocol. The account used to replicate is allowed to see records where certain attributes meet specific values, a silly example is an attribute is set dn: uid=somerecord,ou=people,dc=ucsc,dc=edu replicateMe: TRUE ... When an account has that attribute set it then replicates to the downstream replica, however if later we set replicateMe to FALSE so that the account used for replication can no longer see the entry, it seems to be orphaned and is not removed in the replica. We are using OpenLDAP 2.4.26 and I have the syncprov sessionlog set to 500 and the replica is set to refreshAndPersist. Is this something that is simply not supported? or would a case like this be expected to work and I've either got a configuration issue or a bug? Thanks Jeffrey

3 7

Several questions on Openldap for migration
by Francois Gnu 01 Jun '12

01 Jun '12

Hello everybody, First of all, sorry in advance for my approximate English. I have several questions. Questions for which I did not find answer until today, despite one very large number of reading of docs, faqs, tickets etc. (I did not necessarily read everything, internet is so vast). Presentation: I have to migrate all the servers of the company, from ubuntu 10.04.3lts (package openldap 2.4.21) to ubuntu 12.04lts (package openldap 2.4.28). Configuration: Configuration of openldap, identical on all the servers (Masters and Slaves), configuration of dynamic type (with cn=config ), with reference ldap Masters in the config of slaves ; syncrepl (N-Way) Multi-Master mode. All servers are VMs on kvm. Questions: Questions according to several scenarios: - there are problems of synchronization between 2 Masters, if the one is in 2.4.21 and the other one in 2.4.28? - there are problems of synchronization between 2 servers, if 1 Master is in 2.4.21 and 1/severals Slave(s) in 2.4.28? - there are problems of synchronization between 2 servers, if 1 Master is in 2.4.28 and 1/several Slaves in 2.4.21? - I want to do an update of part of the slaves servers. What it is better to use?: acl or in syscrepl? Which is the most flexible? MDB backend: - can one use now the backend-mdb new in "production mode" with openldap 2.4.28? Is it with good/enough stability? Or do I have to stay with the backend-hdb and migrate towards backend-mdb later? - Is it pisible to migrate from backend-hdb towards backend-mdb for server in production, in the future? Tcmalloc: - I placed tcmalloc in this file '/etc/init.d/slapd' as this "LD_PRELOAD=/usr/lib/libtcmalloc_minimal.so.0". Is it good? Is it the good place/file? - where can I find track of its load (of tcmalloc)? How can I see the functioning of tcmalloc? In what file of log? The LSOF command no give nothing. - it is indicated in the site "[URL="http://code.google.com/r/heybrowny-higmysql/source/browse/google-perftools-…"]http://code.google.com/.../google-perftools-1.8.3/README[/URL]" > "TCMALLOC_DEBUG=<level> -- the higher level, the more messages malloc emits". It is indicated that more the number increase and more tcmalloc verbose. But it is not indicated/informed has what corresponds the numeros (levels) of log and until how much? -to use "TCMALLOC_DEBUG", I have to use "LD_PRELOAD=/usr/lib/libtcmalloc_minimal_debug.so.0" or keep "LD_PRELOAD=/usr/lib/libtcmalloc_minimal.so.0"? Backups and restore: -the opinions diverge. Indeed, to make a backup/restore, slapadd command is enough with the file created with slapcat? Or i need to integrate (with slapadd) at first the config file (cn=config file) and then the acl config file and then the data of the users that were created at the first installation of openldap 2.4.21? So, I installed and configured openldap in 2005 on a debian for the needs of a company but today many things changed and difficult to find itself there. Thank you in advance for taking time and your answers. Francois ------ Librement

1 0

dsaOperation attributes, relax control and syncrepl
by Clément OUDOT 01 Jun '12

01 Jun '12

Hello, an attribute declared 'dsaOperation' in the schema is not replicated with Syncrepl, this behavior was coded some years ago and it seems right. Today, I updated such attribute (pwdFailureTime) with the relax control and noticed the modification has been replicated. I just wanted to know if this behavior was expected with the relax control, or if this is an issue (the test was done with OpenLDAP 2.4.31). Thanks, Clément OUDOT.

2 3

About not enoguh space - unable to allocate memory for transaction detail
by emiliano ricci 31 May '12

31 May '12

Hello. I have this error: unable to allocate memory for transaction detail - not enoguh space when I try to modify an entry. Any help? Regards Emiliano

1 0

shadowMax
by zingalo 31 May '12

31 May '12

good morning, I've a question about password managing in ldap with samba. I've seen that samba schema's attributes don't have effect on password managing. Only shadowAccount's attribute do it. So i changed shadowMax to "0" for a user and at the next login it tells me "You are required to change your password immediately (password aged) LDAP administrator password: " After entering ldap admin's password it tells me "Authentication token manipulation error". Why? the admin'password is correct, am sure Thanks

2 3

Re: ~*~ [spam] Re: OpenLDAP freeze
by Quanah Gibson-Mount 30 May '12

30 May '12

--On Wednesday, May 30, 2012 7:35 PM +0300 Ioan Indreias <indreias(a)gmail.com> wrote: >> One other thing I would note is that you have failed to provide your >> OpenLDAP configuration (either slapd.conf for a slapcat -n 0 of your >> cn=config DB). > > Actually I have provided the slapd.conf file in my first mail - please > find attached what I have sent at that time. Please keep replies on the list. I looked back at the start of the thread and didn't see any attachments. In any case, I have the following comments and questions. Comments: a) Why are you setting serverID? You aren't doing MMR, or if you are, you have not configured it correctly (There is no mirrormode line set). b) Get rid of the filters=... line in syncrepl config. Just use the default. c) Your attrs=... line in the syncrepl config is invalid. Remove it and just use the default. Questions: a) What kind of filesystem is /storage, where you are storing the databases? b) if you remove the "logold" line from your accesslog configuration, do the deadlocks still occur? --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Attributes host and personal (mail, telephone...)
by Carlos Barrero Martínez 30 May '12

30 May '12

Good afternoon to all! I am a newbie and I'm installing and configuring my first ldap server for my company. I want to use LDAP as an authentication method on my intranet ( Drupal) and as authentication for ssh. I have read that's what I need to have the attribute 'host' but this attribute is incompatible with 'person', so I can not have fields (name, surname, phone, email) and host. Can you help solve it? Thank you very much!

2 1

Very quick pointer
by Tim Watts 30 May '12

30 May '12

Hi :) My LDAP skillz are (very) slowly coming along - thanks to good folk here, I think I have figured out ACLs and I have managed to get rwm/relay to emulate an old tree structure (well enough) whilst being able to design a better structure for our department. My next question is just a request for a pointer. My understanding of LDAP authentication is very limited. What I would like to do is a 2 phase transition to kerberos (which I do understand): 1) Rig OpenLDAP so all password changes get sent to the kerberos server but do not use it for authentication. In the meantime we will continue authenticate with the SSHA1 hashes in the user's LDAP entry. 2) After some time (months) when everyone has eventually done a password change, the Kerberos server will be well enough in sync. Now I would like to switch OpenLDAP to using kerberos on the backend (ie for binds etc) and I will purge the SSHA1 hashes. ================== I most interested in some pointers for stage 1) is someone could be kind enough to help me out - is there a particular name for this mechanism, or a module that handles this kind of stuff? ================== 2) I think I can probably google for myslef (keywords SASL and/or GSSAPI and/or LDAP+Kerberos. I've had a skim but did not notice an obvious way to handle 1) without 2) I apologise if it's a dumb question :-o Many thanks in advance :) Cheers Tim -- Tim Watts Personal Blog: http://www.dionic.net/tim/

6 11

Re: Attributes host and personal (mail, telephone...)
by Carlos Barrero Martínez 30 May '12

30 May '12

Thank you for your answer. I'm reading the book published by O'Reilly, LDAP System Administration. However, the world of LDAP is very large and used for many tasks. I am creating my content tree and I can define it in many ways. And I know how to do it or not. Only that. I'm not that person who prefers to ask to learn. Still, thanks! 2012/5/30 Turbo Fredriksson <turbo(a)bayour.com> > On Wed, 30 May 2012 16:58:54 +0200, Carlos Barrero Martínez wrote: > >> Thank you Turbo. >> >> I'm going to see this page to learn more about ldap. However... can >> you tell me how can I do it (attributes host and personal attributes)? >> > > I can, but I'm not going to... And the reason is that LDAP is _way_ to > complicated to teach in a mail or two... > > You really (really, really!!) need to get to the grips on the basics before > you continue. And the others on the list will basically tell you the same > thing. We've all been through this so many times before... > > My HOWTO, but mostly my book, is designed for this specific purpose - teach > beginners the basics and then some. > >

1 0

Re: Attributes host and personal (mail, telephone...)
by Carlos Barrero Martínez 30 May '12

30 May '12

Thank you Turbo. I'm going to see this page to learn more about ldap. However... can you tell me how can I do it (attributes host and personal attributes)? Thanks! 2012/5/30 Turbo Fredriksson <turbo(a)bayour.com> > On Wed, 30 May 2012 15:46:37 +0200, Carlos Barrero Martínez wrote: > >> I am a newbie and I'm installing and configuring my first ldap server >> for my company. >> > > Have a look at http://www.bayour.com/LDAPv3-**HOWTO.html<http://www.bayour.com/LDAPv3-HOWTO.html> > -- > ... but you know as soon as Oracle starts waving its wallet at a Company > it's time to run - fast. > /illumos mailing list >

1 0

acl filter using attribute memberof
by Dorit 30 May '12

30 May '12

1 0

Multi-Master Replication
by Brian Carpio 29 May '12

29 May '12

Hi, I'm currently using Ubuntu 10.04 (I've set this up on RHEL 5.x but the config is way different in Ubuntu). Anyway, at first I figured I had everything working. When I made an update to ldap01 I immediately saw the change on ldap02. However, if I take down slapd on ldap02 (or 01) and I add LDAP entries into ldap01, then bring ldap02's slapd process back online I never see the entries created while slapd was down on ldap02. New entries continue to propigate between ldap01 and ldap02 and long as both servers have the slapd process running, but the entries created when slapd was down on ldap02 never propagate to 02. Here are my configs and ldap versions: ii slapd 2.4.21-0ubuntu5.7 OpenLDAP server (slapd) ---- /etc/ldap/slapd.d/cn=config/olcDatabase={0}config.ldif ----- # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 deacdc79 dn: olcDatabase={0}config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth manage by * break olcAccess: {1}to attrs=userPassword,shadowLastChange by self write by anonymou s auth by dn="cn=admin,dc=example,dc=net" write by * none olcAccess: {2}to * by self write by dn="cn=admin,dc=example,dc=net" write b y * read structuralObjectClass: olcDatabaseConfig entryUUID: 19eb3cc6-3898-1031-954c-351a2fbb42e9 creatorsName: cn=config createTimestamp: 20120522202605Z olcSyncrepl: {0}rid=001 provider="ldap://ldap-01:389" type=refreshAndPer sist retry="5 5 300 +" searchbase="cn=config" attrs="*,+" bindmethod=simple b inddn="cn=admin,dc=example,dc=net" credentials="secret" olcSyncrepl: {1}rid=002 provider="ldap://arch-ldap-02:389" type=refreshAndPer sist retry="5 5 300 +" searchbase="cn=config" attrs="*,+" bindmethod=simple b inddn="cn=admin,dc=example,dc=net" credentials="secret" olcMirrorMode: TRUE entryCSN: 20120528195647.027315Z#000000#000#000000 modifiersName: cn=admin,dc=example,dc=net modifyTimestamp: 20120528195647Z ---- /etc/ldap/slapd.d/cn=config/olcDatabase={0}config/olcOverlay={0}syncprov.ldif ---- # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 807029fa dn: olcOverlay={0}syncprov objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpNoPresent: TRUE structuralObjectClass: olcSyncProvConfig entryUUID: 3be00cb6-3dee-1031-8f60-519aa1b6f74f creatorsName: cn=admin,dc=example,dc=net createTimestamp: 20120529152514Z entryCSN: 20120529152514.987191Z#000000#000#000000 modifiersName: cn=admin,dc=example,dc=net modifyTimestamp: 20120529152514Z ---- /etc/ldap/slapd.d/cn=config/olcDatabase={1}hdb.ldif ---- # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 1b0a3130 dn: olcDatabase={1}hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=example,dc=net olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymou s auth by dn="cn=admin,dc=example,dc=net" write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by self write by dn="cn=admin,dc=example,dc=net" write b y * read olcLastMod: TRUE olcRootDN: cn=admin,dc=example,dc=net olcRootPW:: e1NTSEF9Ni9IZWJCczRTbmJQYlc4NHFOMWxHWUI5NVNoVUl4U20= olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq structuralObjectClass: olcHdbConfig entryUUID: 19ebfdc8-3898-1031-9554-351a2fbb42e9 creatorsName: cn=config createTimestamp: 20120522202605Z olcSyncrepl: {0}rid=001 provider="ldap://ldap-01:389" type=refreshAndPer sist retry="5 5 300 +" searchbase="dc=example,dc=net" attrs="*,+" bindmeth od=simple binddn="cn=admin,dc=example,dc=net" credentials="secret" olcSyncrepl: {1}rid=002 provider="ldap://ldap-02:389" type=refreshAndPer sist retry="5 5 300 +" searchbase="dc=example,dc=net" attrs="*,+" bindmeth od=simple binddn="cn=admin,dc=example,dc=net" credentials="secret" olcMirrorMode: TRUE entryCSN: 20120528195647.026244Z#000000#000#000000 modifiersName: cn=admin,dc=example,dc=net modifyTimestamp: 20120528195647Z ----- /etc/ldap/slapd.d/cn=config/olcDatabase={1}hdb/olcOverlay={0}syncprov.ldif ---- # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 807029fa dn: olcOverlay={0}syncprov objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpNoPresent: TRUE structuralObjectClass: olcSyncProvConfig entryUUID: 3be00cb6-3dee-1031-8f60-519aa1b6f74f creatorsName: cn=admin,dc=example,dc=net createTimestamp: 20120529152514Z entryCSN: 20120529152514.987191Z#000000#000#000000 modifiersName: cn=admin,dc=example,dc=net modifyTimestamp: 20120529152514Z

2 1

Re: OpenLDAP freeze
by Ioan Indreias 29 May '12

29 May '12

Are there any chances to have your feedback on the information provided? Best regards, Ioan On Fri, May 18, 2012 at 11:25 AM, Ioan Indreias <indreias(a)gmail.com> wrote: > Hello all, > > We are running OpenLDAP in a SLAVE-MASTER configuratiorn (Slave for > another OpenLDAP server //L1// and Master for 2 Axigen Back End nodes > //B1 and B2//). > > Currently we have ~31000 accounts and experience random freeze events > of the slapd (nothing writing in the logs, CPU 0%) when a series of > add/delete operations are performed over the normal LDAP > traffic.Random means an interval between 15 and 80 minutes after we > start add/delete accounts. > > The add/delete bash script is running in loop, adding 60 accounts, > sleep 20 sec, delete the accounts and sleep another 40 sec. All > operations are performed on the MASTER L1 server and are propagated > correctly to our server (till is freezing of course). > > Running with 2.4.23 we have considered to upgrade to 2.4.31 but the > same problem was observed. On both cases we have used BDB 4.7.25, with > all available patches. > > The server is a RHEL 5.5, 64 bits with plenty of memory and CPUs. > > I am attaching 3 archives: the slapd configuration and gdb+db_stat for > 2 freeeze events. > > Could somebody point if there is a slapd or bdb problem? Any hints are > appreciated. > > Best regards, > Ioan Indreias > www.modulo.ro > > === > May 18 09:37:10 saevrvmp11 slapd[13834]: @(#) $OpenLDAP: slapd 2.4.31 > (May 10 2012 16:11:06) $ > root@host64.modulo.ro:/root/openldap-2.4.31/servers/slapd > > [root@host tmp]# ldd /usr/sbin/slapd > libuuid.so.1 => /lib64/libuuid.so.1 (0x0000003efe000000) > libssl.so.6 => /lib64/libssl.so.6 (0x0000003f05400000) > libcrypto.so.6 => /lib64/libcrypto.so.6 (0x0000003f00800000) > libresolv.so.2 => /lib64/libresolv.so.2 (0x0000003f01800000) > libpthread.so.0 => /lib64/libpthread.so.0 (0x0000003efb800000) > libc.so.6 => /lib64/libc.so.6 (0x0000003efac00000) > /lib64/ld-linux-x86-64.so.2 (0x0000003efa800000) > libgssapi_krb5.so.2 => /usr/lib64/libgssapi_krb5.so.2 > (0x0000003f02800000) > libkrb5.so.3 => /usr/lib64/libkrb5.so.3 (0x0000003f03000000) > libcom_err.so.2 => /lib64/libcom_err.so.2 (0x0000003f01000000) > libk5crypto.so.3 => /usr/lib64/libk5crypto.so.3 (0x0000003f02c00000) > libdl.so.2 => /lib64/libdl.so.2 (0x0000003efb000000) > libz.so.1 => /usr/lib64/libz.so.1 (0x0000003efbc00000) > libkrb5support.so.0 => /usr/lib64/libkrb5support.so.0 > (0x0000003f02400000) > libkeyutils.so.1 => /lib64/libkeyutils.so.1 (0x0000003f02000000) > libselinux.so.1 => /lib64/libselinux.so.1 (0x0000003efc400000) > libsepol.so.1 => /lib64/libsepol.so.1 (0x0000003efc000000) > ===

2 7

UPGRADING OPENLDAP
by Borresen, John - 0442 - MITLL 29 May '12

29 May '12

Planning to upgrade our OpenLDAP from 2.4.23 to 2.4.31 shortly and just getting my ducks in a row. 1) my current Berkeley flavor is 4.8.30 2) As stated, OpenLDAP is 2.4.23 (using slapd.d) Looking for any "gotchas" to be on look out for. Can I do the upgrade on top of the current directory structure, restore the config then restart? Am I going to need to upgrade my flavor of Berkeley? I had originally attempted to use Berkeley 5.2.36 but never could get it to build/compile correctly on my platform (too many compilation errors to list). Dave Borresen Solaris/Linux Systems Administrator Surveillance Systems Group MIT Lincoln Laboratory john.borresen(a)ll.mit.edu

2 1

Replication Design Advice
by Andrei Bănaru 29 May '12

29 May '12

Hello OpenLDAP users, I’m looking for some advice concerning an OpenLDAP solution I’m about to deploy between 4 locations in company I work for. Currently I’ve implemented a LDAP DIT in my country and we’ve had exquisite results. I’ve integrated RADIUS for wireless authentication, MIT Kerberos, Samba PDC, dovecot and the list can continue but that’s not the scope of this message. We have some global services located in one of the countries that all other 3 countries use ( trac, svn, web2project, alfresco ). We want that each country to have it’s own LDAP DIT ( we don’t want to have a global LDAP with slaves in each country because some of us want locally significant objects ( for authorization purposes ) and having a slave LDAP means read-only ). That’s why I thought of using multi-n-master on each of the four LDAP servers. The ideea I had was that each country will have only a portion of the DIT being sent to the others ( we narrow the searchbase in syncrepl ): Country 1 sends ou=COUNTRY-1,dc=example,dc=com Country 2 sends ou=COUNTRY-2,dc=example,dc=com Country 3 sends ou=COUNTRY-3,dc=example,dc=com Country 4 sends ou=COUNTRY-4,dc=example,dc=com In each ou=COUNTRY-{1..4} they will have ou=People and ou=Groups. Basically that’s the only thing I want to be consistent across all LDAP DITs. I’ve tested the solution using some virtual machines and besides the starttls and some things each administrator will have to be cautious about things went smoothly. I've also read something about slapo-translucent - will now test to see how it works. Can I get some suggestions / maybe a whole new architecture for my needs in case I didn’t foresee problems ? Thx! -- Andrei BĂNARU Internal Support CCNA Security, CCIP StreamWIDE Romania

1 0

How do tool verify certs with ldapi:// ?
by Peter Marschall 28 May '12

28 May '12

Hi, how do the openldap tools technically verfify certificates with ldapi:// ? With ldapi, you don't have a hostname or IP address, so how do the openldap tools do it? I tried to browse the code but got losat somewhere ion the way. Any hints to the code or a short step-by-step explanation will help. Background of this question: I want to implement the feature in perl-ldap. Thanks in advance for your help Peter -- Peter Marschall peter(a)adpm.de

3 13

Re: how can make slave use tls to connect to master for syncrepl (solved)
by zhong ming wu 28 May '12

28 May '12

Never mind. I had to put this line in the sysrepl section of the slave starttls=yes Sorry about the noise. On Sun, May 27, 2012 at 10:29 PM, zhong ming wu <mr.z.m.wu(a)gmail.com> wrote: > Hello > > I am using version 2.4 and in the process of setting up a master/slave > pair using syncrepl. > > This is working as expected if I don't have enforce security and > confidentiality with "security ssf=128" global directive in the > master. > As soon as I turn it on, replication stops working. > > It seems that the slave consumer is not using TLS to connect to > master. However I can use 'ldapsearch' with '-ZZ' option to connect > to master from slave and get all records I want. > > On my slave machine, I also have the following directive > > TLS_CACERT /etc/pki/tls/certs/ca.crt.crl > > in ldap.conf > > Notice that without this line 'ldapXXX' commands with '-ZZ' fails from > slave to master. This confirms that at least 'ldap.conf' is in the > correct location at least as far as 'ldapXXX' commands are concerned. > > Can someone point me in the right direction? I have read many > chapters on this page > > http://www.openldap.org/doc/admin24/index.html > > Both slave and master are on centos 6.2 and openldap software is > standard centos rpm. > > Here are the log entries on the master when slave fails to bind with TLS > > May 27 22:14:53 cat slapd[2456]: conn=1000 fd=13 ACCEPT from > IP=192.168.0.2:41083 (IP=0.0.0.0:389) > May 27 22:14:53 cat slapd[2456]: conn=1000 op=0 BIND > dn="cn=root,dc=example,dc=com" method=128 > May 27 22:14:53 cat slapd[2456]: conn=1000 op=0 RESULT tag=97 err=13 > text=confidentiality required > May 27 22:14:53 cat slapd[2456]: conn=1000 op=1 UNBIND > May 27 22:14:53 cat slapd[2456]: conn=1000 fd=13 closed > > Sincerely > > Mr Wu

1 0

OpenLDAP proxy to Active Directory
by Jonathan van der Wat 28 May '12

28 May '12

Greetings, I'm new to OpenLDAP and am trying to implement the following: User authentication (PAM + SSSD) on CentOS Linux servers via OpenLDAP proxy to Active Directory. I am able to perform the following search from the OpenLDAP proxy without any apparent issues: * [root@openldap ~]# ldapsearch -x -h /mydomaincontroller/ -LLL -b dc=msad,dc=inet,dc=com -D cn=ldap,cn=users,dc=msad,dc=inet,dc=com -W '(sAMAccountName=jonathanv)' cn sAMAccountName Enter LDAP Password: dn: CN=jonathan,CN=Users,DC=msad,DC=inet,DC=com cn: jonathan sAMAccountName: jonathanv # refldap://ForestDnsZones.msad.inet.com/DC=ForestDnsZones,DC=msad,DC=inet,DC… # refldap://DomainDnsZones.msad.inet.com/DC=DomainDnsZones,DC=msad,DC=inet,DC… # refldap://msad.inet.com/CN=Configuration,DC=msad,DC=inet,DC=com* However, when asking the OpenLDAP proxy: *[root@openldap ~]# ldapsearch -x -h /localhost/ -LLL -b dc=msad,dc=inet,dc=com -D cn=ldap,cn=users,dc=msad,dc=inet,dc=com -W '(sAMAccountName=jonathanv)' cn sAMAccountName Enter LDAP Password: # refldap://ForestDnsZones.msad.inet.com/DC=ForestDnsZones,DC=msad,DC=inet,DC… # refldap://DomainDnsZones.msad.inet.com/DC=DomainDnsZones,DC=msad,DC=inet,DC… # refldap://msad.inet.com/CN=Configuration,DC=msad,DC=inet,DC=com* Also, I've configured my CentOS server's using SSSD. When trying to authenticate as user jonathanv, I receive a message that user jonathanv is not found. I am using OpenLDAP server version 2.4.23-20. I am starting the OpenLDAP from the command line as follows: *slapd -f -d 2 -f /etc/openldap/slapd.conf -g ldap -h ldap:/// -l LOCAL4 -u ldap -n slapd-ldap* Here is the output of my slapd.conf file: *# # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/corba.schema include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/duaconf.schema include /etc/openldap/schema/dyngroup.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/java.schema include /etc/openldap/schema/misc.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/ppolicy.schema include /etc/openldap/schema/collective.schema # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Load dynamic backend modules # - modulepath is architecture dependent value (32/64-bit system) # - back_sql.la overlay requires openldap-server-sql package # - dyngroup.la and dynlist.la cannot be used at the same time # modulepath /usr/lib/openldap # modulepath /usr/lib64/openldap # moduleload accesslog.la # moduleload auditlog.la # moduleload back_sql.la # moduleload chain.la # moduleload collect.la # moduleload constraint.la # moduleload dds.la # moduleload deref.la # moduleload dyngroup.la # moduleload dynlist.la # moduleload memberof.la # moduleload pbind.la # moduleload pcache.la # moduleload ppolicy.la # moduleload refint.la # moduleload retcode.la moduleload rwm.la # moduleload seqmod.la # moduleload smbk5pwd.la # moduleload sssvlv.la # moduleload syncprov.la # moduleload translucent.la # moduleload unique.la # moduleload valsort.la # The next three lines allow use of TLS for encrypting connections using a # dummy test certificate which you can generate by changing to # /etc/pki/tls/certs, running "make slapd.pem", and fixing permissions on # slapd.pem so that the ldap user or group can read it. Your client software # may balk at self-signed certificates, however. # TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt # TLSCertificateFile /etc/pki/tls/certs/slapd.pem # TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! # enable on-the-fly configuration (cn=config) database config access to * by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * none # enable server status monitoring (cn=monitor) database monitor access to * by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.exact="cn=Manager,dc=my-domain,dc=com" read by * none ####################################################################### # database definitions ####################################################################### database bdb suffix "dc=inet,dc=local" checkpoint 1024 15 rootdn "cn=Manager,dc=inet,dc=local" rootpw xxxxxxxxxxxxxxxx # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret # rootpw {crypt}ijFYNcSNctBYg # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub # Our slapd-ldap back end to connect to AD database ldap suffix "dc=msad,dc=inet,dc=com" #subordinate rebind-as-user uri "ldap://172.16.132.253/" chase-referrals yes overlay rwm rwm-suffixmassage dc=msad,dc=inet,dc=com rwm-map attribute uid sAMAccountName rwm-map attribute cn cn rwm-map attribute displayName displayName rwm-map attribute givenName givenName rwm-map attribute sn sn rwm-map attribute mail mail rwm-map attribute userPassword userPassword rwm-map attribute * rwm-map objectclass inetOrgPerson user # Replicas of this database #replogfile /var/lib/ldap/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com(a)EXAMPLE.COM #* Any ideas as to why I'm unable to authenticate my user against the AD? Any advice or info on this topic would be greatly appreciated. Greetings, Jonathan Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. This email has been scanned for viruses and malware, and automatically archived by Mimecast SA (Pty) Ltd, an innovator in Software as a Service (SaaS) for business. Mimecast Unified Email Management (UEM) offers email continuity, security, archiving and compliance with all current legislation. To find out more, visit http://www.mimecast.co.za/uem-ppc.

2 3

how can make slave use tls to connect to master for syncrepl
by zhong ming wu 27 May '12

27 May '12

Hello I am using version 2.4 and in the process of setting up a master/slave pair using syncrepl. This is working as expected if I don't have enforce security and confidentiality with "security ssf=128" global directive in the master. As soon as I turn it on, replication stops working. It seems that the slave consumer is not using TLS to connect to master. However I can use 'ldapsearch' with '-ZZ' option to connect to master from slave and get all records I want. On my slave machine, I also have the following directive TLS_CACERT /etc/pki/tls/certs/ca.crt.crl in ldap.conf Notice that without this line 'ldapXXX' commands with '-ZZ' fails from slave to master. This confirms that at least 'ldap.conf' is in the correct location at least as far as 'ldapXXX' commands are concerned. Can someone point me in the right direction? I have read many chapters on this page http://www.openldap.org/doc/admin24/index.html Both slave and master are on centos 6.2 and openldap software is standard centos rpm. Here are the log entries on the master when slave fails to bind with TLS May 27 22:14:53 cat slapd[2456]: conn=1000 fd=13 ACCEPT from IP=192.168.0.2:41083 (IP=0.0.0.0:389) May 27 22:14:53 cat slapd[2456]: conn=1000 op=0 BIND dn="cn=root,dc=example,dc=com" method=128 May 27 22:14:53 cat slapd[2456]: conn=1000 op=0 RESULT tag=97 err=13 text=confidentiality required May 27 22:14:53 cat slapd[2456]: conn=1000 op=1 UNBIND May 27 22:14:53 cat slapd[2456]: conn=1000 fd=13 closed Sincerely Mr Wu

1 0

syncrepl for cn=config, changes fail with "tag=103 err=53 text=shadow context; no update referral"
by Elias Probst 27 May '12

27 May '12

Hi List, I'm trying to setup a master/master replication scenario, starting with getting cn=config replicated properly using OpenLDAP 2.4.30 on Gentoo. I've tried to start with a minimal config which is now up and running on both servers. As long as I start only one of both servers I can edit everything in cn=config just fine, but as soon as they both run at the same time, they get into a state which causes some trouble. Even shutting down one of both doesn't help then, I need to start from scratch again at this point. Submitting any changes results in this error message: RESULT tag=103 err=53 text=shadow context; no update referral There are two servers, connected via OpenVPN: ID 1, 10.44.0.1 ID 2, 10.44.0.7 I use the following configuration file to seed the initial online configuration for each server, before bringing them up both, using: slapd -f /tmp/slapd.conf -F /etc/openldap/slapd.d -u ldap -g ldap -d1 moduleload memberof.so moduleload syncprov.so moduleload refint.so include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/openssh.schema TLSCACertificateFile /etc/ssl/slapd/slapd.cacrt TLSCertificateFile /etc/ssl/slapd/slapd.crt TLSCertificateKeyFile /etc/ssl/slapd/slapd.key TLSVerifyClient allow pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args loglevel 256 access to attrs=userPassword by self write by * auth access to * by * read ServerID 1 ldap://10.44.0.1 ServerID 2 ldap://10.44.0.7 backend bdb database config rootdn cn=config rootpw {SSHA}RI/d8i2R7XXlo2+kf2LcYzYOcIry+qaa syncrepl rid=001 provider="ldap://10.44.0.7" binddn="cn=config" bindmethod="simple" credentials="nothingtoseehere" searchbase="cn=config" type=refreshAndPersist retry="10 +" filter="(!(olcDatabase={0}config))" syncrepl rid=002 provider="ldap://10.44.0.1" binddn="cn=config" bindmethod="simple" credentials="nothingtoseehere" searchbase="cn=config" type=refreshAndPersist retry="10 +" filter="(!(olcDatabase={0}config))" overlay syncprov I don't quite understand the error message, as it somehow indicates the servers would be running in shadow context/MirrorMode, which is set to FALSE. So does anyone have an idea, what's wrong with my setup? Thanks a lot! - Elias

5 8

more on migrating from 2.3 to 2.4
by Bobby Krupczak 27 May '12

27 May '12

Hi! I did my nfs/nis/ldap/smb/dns swap this morning. I'm struggling with getting my ldap server to work as before. slapd is running and answering anonymous queries (like logging in and checking passwords) from other machines. >From the slapd host, I can do an ldapsearch (over ssl) and everything works. I authenticate as rootdn just fine. >From a different host, I cant do an ldapsearch; I receive an "invalid creditionals (49)" error. I have enabled debugging in ldapsearch and dont see anything interesting. The server ssl cert verifies fine. No config has changed on my client. I'm thinking its ssl, ipv6, and client cert related or maybe ACLs? In my slapd.conf file, I've put TLSVerifyClient never Any suggestions? slapd is 2.4.26-7.fc16.x86_64 Yes I know I'm running the fedora package. As soon as I can get the machine up and running as before I will start migrating. Thanks, Bobby

1 0

question on syncprov
by Steve Reveliotty 25 May '12

25 May '12

Hi, I'm trying to migrate from OpenLDAP 2.3.43-12.el5_6.7 to OpenLDAP 2.4.23-20.el6.x86_6. In 2.3, we currently have one master, replicating changes to 2 consumers via slurpd. I'm trying to configure 2.4 w/ syncrepl, and have tried using refreshAndPersist to mimic that same routine of pushing changes from the master. I'm getting failures though: on the master: ay 25 13:55:25 slapd[6855]: send_search_entry: conn 1064 ber write failed. May 25 13:55:45 slapd[6855]: send_search_entry: conn 1066 ber write failed. May 25 13:56:45 slapd[6855]: send_search_entry: conn 1068 ber write failed. May 25 13:57:45 slapd[6855]: send_search_entry: conn 1078 ber write failed. May 25 13:58:45 slapd[6855]: send_search_entry: conn 1084 ber write failed. May 25 13:59:05 slapd[6855]: send_search_entry: conn 1086 ber write failed. May 25 13:59:15 slapd[6855]: send_search_entry: conn 1087 ber write failed. on a consumer: May 25 13:45:15 slapd[28707]: do_syncrepl: rid=002 rc 68 retrying (9 retries left) May 25 13:45:25 slapd[28707]: syncrepl_entry: rid=002 be_add cn=XXXXXXX,dc=edu failed (68) here are snippets from the master's slapd.conf and from one of the consumers: master - ------- database hdb include /etc/openldap/slapd.access suffix "dc=XXXXdc=edu" checkpoint 1024 5 cachesize 30000 idlcachesize 90000 rootdn "cn=Manager,XXXXX,dc=edu" # NOTE: "updatedn" MUST BE COMMENTED OUT FOR INITIAL CREATION/LOAD OF # ROOT INFO overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. #rootpw secret # needs to be changed to something someone knows. rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap # Indices to maintain # review these index default pres,eq index uid eq,sub index entryUUID,entryCSN index cn,sn,givenName,ou,mail,telephoneNumber pres,eq,sub index employeeNumber,mailAlternateAddress,eduPersonPrincipalName index eduPersonAffiliation,eduPersonPrimaryAffiliation index objectClass,serialNumber eq index isMemberOf eq,subany TLSCertificateFile /etc/openldap/newcert.pem TLSCertificateKeyFile /etc/openldap/newkey.pem TLSCACertificateFile /etc/openldap/chain.pem consumer - ------------------ database hdb suffix "dc=XXXXX=edu" checkpoint 1024 5 cachesize 30000 idlcachesize 90000 rootdn "cn=Manager,dc=XXXX,dc=edu" # NOTE: "updatedn" MUST BE COMMENTED OUT FOR INITIAL CREATION/LOAD OF # ROOT INFO # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. #rootpw secret # needs to be changed to something someone knows. rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap # Indices to maintain # review these index default pres,eq index uid eq,sub index entryUUID,entryCSN index cn,sn,givenName,ou,mail,telephoneNumber pres,eq,sub index employeeNumber,mailAlternateAddress,eduPersonPrincipalName index eduPersonAffiliation,eduPersonPrimaryAffiliation index objectClass,serialNumber eq index isMemberOf eq,subany TLSCertificateFile /etc/openldap/newcert.pem TLSCertificateKeyFile /etc/openldap/newkey.pem TLSCACertificateFile /etc/openldap/chain.pem syncrepl rid=002 provider=ldap://providername-taken-out-here:389 type=refreshAndPersist retry="10 10 60 +" searchbase="dc=XXXX,dc=edu" filter="(objectClass=*)" attrs="*" scope=sub schemachecking=off bindmethod=simple binddn="cn=Replicator,dc=XXXX,dc=edu" credentials="password" updateref ldap://providername-takenout-here:389 the account I"m using to bind from the consumer has read access to everything on the master. Thanks in advance

2 4

slapd keeps crashing
by David Massie 25 May '12

25 May '12

Our slapd instance keeps crashing. We do not see an obvious reason for the crashes. I am posting the crash report in the hope that someone will see something and can point us in the right direction. Thanks, Dave Massie Duplicate check ===== Common information ===== package ----- architecture ----- x86_64 kernel ----- 2.6.32-220.13.1.el6.x86_64 Additional information ===== uid ----- 0 time ----- 1337786308 executable ----- /var/services/openldap/libexec/slapd component ----- hostname ----- aaaprod-master.uis.georgetown.edu username ----- root reason ----- Process /var/services/openldap/libexec/slapd was killed by signal 6 (SIGABRT) analyzer ----- CCpp maps ----- 00400000-00624000 r-xp 00000000 fd:00 3675557 /var/services/openldap/libexec/slapd 00824000-00831000 rw-p 00224000 fd:00 3675557 /var/services/openldap/libexec/slapd 00831000-008d6000 rw-p 00000000 00:00 0 0104f000-012eb000 rw-p 00000000 00:00 0 012eb000-01441000 rw-p 00000000 00:00 0 394f800000-394f820000 r-xp 00000000 fd:00 1703938 /lib64/ld-2.12.so 394fa1f000-394fa20000 r--p 0001f000 fd:00 1703938 /lib64/ld-2.12.so 394fa20000-394fa21000 rw-p 00020000 fd:00 1703938 /lib64/ld-2.12.so 394fa21000-394fa22000 rw-p 00000000 00:00 0 394fc00000-394fd86000 r-xp 00000000 fd:00 1703939 /lib64/libc-2.12.so 394fd86000-394ff86000 ---p 00186000 fd:00 1703939 /lib64/libc-2.12.so 394ff86000-394ff8a000 r--p 00186000 fd:00 1703939 /lib64/libc-2.12.so 394ff8a000-394ff8b000 rw-p 0018a000 fd:00 1703939 /lib64/libc-2.12.so 394ff8b000-394ff90000 rw-p 00000000 00:00 0 3950000000-3950002000 r-xp 00000000 fd:00 1703950 /lib64/libdl-2.12.so 3950002000-3950202000 ---p 00002000 fd:00 1703950 /lib64/libdl-2.12.so 3950202000-3950203000 r--p 00002000 fd:00 1703950 /lib64/libdl-2.12.so 3950203000-3950204000 rw-p 00003000 fd:00 1703950 /lib64/libdl-2.12.so 3950400000-3950417000 r-xp 00000000 fd:00 1703943 /lib64/libpthread-2.12.so 3950417000-3950616000 ---p 00017000 fd:00 1703943 /lib64/libpthread-2.12.so 3950616000-3950617000 r--p 00016000 fd:00 1703943 /lib64/libpthread-2.12.so 3950617000-3950618000 rw-p 00017000 fd:00 1703943 /lib64/libpthread-2.12.so 3950618000-395061c000 rw-p 00000000 00:00 0 3950800000-395081d000 r-xp 00000000 fd:00 1703962 /lib64/libselinux.so.1 395081d000-3950a1c000 ---p 0001d000 fd:00 1703962 /lib64/libselinux.so.1 3950a1c000-3950a1d000 r--p 0001c000 fd:00 1703962 /lib64/libselinux.so.1 3950a1d000-3950a1e000 rw-p 0001d000 fd:00 1703962 /lib64/libselinux.so.1 3950a1e000-3950a1f000 rw-p 00000000 00:00 0 3951400000-3951416000 r-xp 00000000 fd:00 1703956 /lib64/libresolv-2.12.so 3951416000-3951616000 ---p 00016000 fd:00 1703956 /lib64/libresolv-2.12.so 3951616000-3951617000 r--p 00016000 fd:00 1703956 /lib64/libresolv-2.12.so 3951617000-3951618000 rw-p 00017000 fd:00 1703956 /lib64/libresolv-2.12.so 3951618000-395161a000 rw-p 00000000 00:00 0 3951c00000-3951c15000 r-xp 00000000 fd:00 1703994 /lib64/libz.so.1.2.3 3951c15000-3951e14000 ---p 00015000 fd:00 1703994 /lib64/libz.so.1.2.3 3951e14000-3951e15000 r--p 00014000 fd:00 1703994 /lib64/libz.so.1.2.3 3951e15000-3951e16000 rw-p 00015000 fd:00 1703994 /lib64/libz.so.1.2.3 3952000000-3952007000 r-xp 00000000 fd:00 1703999 /lib64/libcrypt-2.12.so 3952007000-3952207000 ---p 00007000 fd:00 1703999 /lib64/libcrypt-2.12.so 3952207000-3952208000 r--p 00007000 fd:00 1703999 /lib64/libcrypt-2.12.so 3952208000-3952209000 rw-p 00008000 fd:00 1703999 /lib64/libcrypt-2.12.so 3952209000-3952237000 rw-p 00000000 00:00 0 3952400000-395245d000 r-xp 00000000 fd:00 1703997 /lib64/libfreebl3.so 395245d000-395265c000 ---p 0005d000 fd:00 1703997 /lib64/libfreebl3.so 395265c000-395265d000 r--p 0005c000 fd:00 1703997 /lib64/libfreebl3.so 395265d000-395265e000 rw-p 0005d000 fd:00 1703997 /lib64/libfreebl3.so 395265e000-3952662000 rw-p 00000000 00:00 0 3952c00000-3952d6f000 r-xp 00000000 fd:00 1703948 /lib64/libdb-4.7.so 3952d6f000-3952f6e000 ---p 0016f000 fd:00 1703948 /lib64/libdb-4.7.so 3952f6e000-3952f74000 rw-p 0016e000 fd:00 1703948 /lib64/libdb-4.7.so 3953000000-3953019000 r-xp 00000000 fd:00 2361953 /usr/lib64/libsasl2.so.2.0.23 3953019000-3953218000 ---p 00019000 fd:00 2361953 /usr/lib64/libsasl2.so.2.0.23 3953218000-3953219000 r--p 00018000 fd:00 2361953 /usr/lib64/libsasl2.so.2.0.23 3953219000-395321a000 rw-p 00019000 fd:00 2361953 /usr/lib64/libsasl2.so.2.0.23 3953c00000-3953c2a000 r-xp 00000000 fd:00 1703964 /lib64/libk5crypto.so.3.1 3953c2a000-3953e29000 ---p 0002a000 fd:00 1703964 /lib64/libk5crypto.so.3.1 3953e29000-3953e2b000 r--p 00029000 fd:00 1703964 /lib64/libk5crypto.so.3.1 3953e2b000-3953e2c000 rw-p 0002b000 fd:00 1703964 /lib64/libk5crypto.so.3.1 3954000000-3954002000 r-xp 00000000 fd:00 1703952 /lib64/libkeyutils.so.1.3 3954002000-3954201000 ---p 00002000 fd:00 1703952 /lib64/libkeyutils.so.1.3 3954201000-3954202000 r--p 00001000 fd:00 1703952 /lib64/libkeyutils.so.1.3 3954202000-3954203000 rw-p 00002000 fd:00 1703952 /lib64/libkeyutils.so.1.3 3954400000-395440a000 r-xp 00000000 fd:00 1703963 /lib64/libkrb5support.so.0.1 395440a000-3954609000 ---p 0000a000 fd:00 1703963 /lib64/libkrb5support.so.0.1 3954609000-395460a000 r--p 00009000 fd:00 1703963 /lib64/libkrb5support.so.0.1 395460a000-395460b000 rw-p 0000a000 fd:00 1703963 /lib64/libkrb5support.so.0.1 3955800000-395583f000 r-xp 00000000 fd:00 1703977 /lib64/libgssapi_krb5.so.2.2 395583f000-3955a3f000 ---p 0003f000 fd:00 1703977 /lib64/libgssapi_krb5.so.2.2 3955a3f000-3955a40000 r--p 0003f000 fd:00 1703977 /lib64/libgssapi_krb5.so.2.2 3955a40000-3955a42000 rw-p 00040000 fd:00 1703977 /lib64/libgssapi_krb5.so.2.2 3955c00000-3955cd4000 r-xp 00000000 fd:00 1703973 /lib64/libkrb5.so.3.3 3955cd4000-3955ed4000 ---p 000d4000 fd:00 1703973 /lib64/libkrb5.so.3.3 3955ed4000-3955edd000 r--p 000d4000 fd:00 1703973 /lib64/libkrb5.so.3.3 3955edd000-3955edf000 rw-p 000dd000 fd:00 1703973 /lib64/libkrb5.so.3.3 3956800000-3956973000 r-xp 00000000 fd:00 2363773 /usr/lib64/libcrypto.so.1.0.0 3956973000-3956b73000 ---p 00173000 fd:00 2363773 /usr/lib64/libcrypto.so.1.0.0 3956b73000-3956b8c000 r--p 00173000 fd:00 2363773 /usr/lib64/libcrypto.so.1.0.0 3956b8c000-3956b96000 rw-p 0018c000 fd:00 2363773 /usr/lib64/libcrypto.so.1.0.0 3956b96000-3956b9a000 rw-p 00000000 00:00 0 3957800000-3957853000 r-xp 00000000 fd:00 2363947 /usr/lib64/libssl.so.1.0.0 3957853000-3957a53000 ---p 00053000 fd:00 2363947 /usr/lib64/libssl.so.1.0.0 3957a53000-3957a56000 r--p 00053000 fd:00 2363947 /usr/lib64/libssl.so.1.0.0 3957a56000-3957a5b000 rw-p 00056000 fd:00 2363947 /usr/lib64/libssl.so.1.0.0 7f70d8000000-7f70d80e8000 rw-p 00000000 00:00 0 7f70d80e8000-7f70dc000000 ---p 00000000 00:00 0 7f70e0000000-7f70e8000000 rw-p 00000000 00:00 0 7f70e8000000-7f70ed94c000 rw-p 00000000 00:00 0 7f70ed94c000-7f70f0000000 ---p 00000000 00:00 0 7f70f4000000-7f70ffff8000 rw-p 00000000 00:00 0 7f70ffff8000-7f7100000000 ---p 00000000 00:00 0 7f7100000000-7f7100458000 rw-p 00000000 00:00 0 7f7100458000-7f7104000000 ---p 00000000 00:00 0 7f7108000000-7f7110000000 rw-p 00000000 00:00 0 7f7110000000-7f7118000000 rw-p 00000000 00:00 0 7f7118000000-7f711c69d000 rw-p 00000000 00:00 0 7f711c69d000-7f7120000000 ---p 00000000 00:00 0 7f7120000000-7f7124000000 rw-p 00000000 00:00 0 7f7128000000-7f7130000000 rw-p 00000000 00:00 0 7f7130000000-7f7135fe7000 rw-p 00000000 00:00 0 7f7135fe7000-7f7138000000 ---p 00000000 00:00 0 7f7138000000-7f7140000000 rw-p 00000000 00:00 0 7f7140000000-7f7148000000 rw-p 00000000 00:00 0 7f7148000000-7f714fa52000 rw-p 00000000 00:00 0 7f714fa52000-7f7150000000 ---p 00000000 00:00 0 7f7150000000-7f7158000000 rw-p 00000000 00:00 0 7f7158000000-7f715e575000 rw-p 00000000 00:00 0 7f715e575000-7f7160000000 ---p 00000000 00:00 0 7f7160000000-7f7168000000 rw-p 00000000 00:00 0 7f7168000000-7f716c000000 rw-p 00000000 00:00 0 7f716c000000-7f7170000000 rw-p 00000000 00:00 0 7f7170000000-7f7174000000 rw-p 00000000 00:00 0 7f71777ff000-7f7177800000 ---p 00000000 00:00 0 7f7177800000-7f7178000000 rw-p 00000000 00:00 0 7f7178000000-7f717bfff000 rw-p 00000000 00:00 0 7f717bfff000-7f717c000000 ---p 00000000 00:00 0 7f717c000000-7f717cd6a000 rw-p 00000000 00:00 0 7f717cd6a000-7f7180000000 ---p 00000000 00:00 0 7f7180000000-7f7180d78000 rw-p 00000000 00:00 0 7f7180d78000-7f7184000000 ---p 00000000 00:00 0 7f7186fff000-7f7188000000 rw-p 00000000 00:00 0 7f7188000000-7f7188dab000 rw-p 00000000 00:00 0 7f7188dab000-7f718c000000 ---p 00000000 00:00 0 7f718cffd000-7f7190000000 rw-p 00000000 00:00 0 7f7190000000-7f7190d8d000 rw-p 00000000 00:00 0 7f7190d8d000-7f7194000000 ---p 00000000 00:00 0 7f71947fc000-7f71977ff000 rw-p 00000000 00:00 0 7f71977ff000-7f7197800000 ---p 00000000 00:00 0 7f7197800000-7f7198000000 rw-p 00000000 00:00 0 7f7198000000-7f719c000000 rw-p 00000000 00:00 0 7f719c7fb000-7f719e7fd000 rw-p 00000000 00:00 0 7f719e7fd000-7f719e7fe000 ---p 00000000 00:00 0 7f719e7fe000-7f719effe000 rw-p 00000000 00:00 0 7f719effe000-7f719efff000 ---p 00000000 00:00 0 7f719efff000-7f719f7ff000 rw-p 00000000 00:00 0 7f719f7ff000-7f719f800000 ---p 00000000 00:00 0 7f719f800000-7f71a0000000 rw-p 00000000 00:00 0 7f71a0000000-7f71a0d21000 rw-p 00000000 00:00 0 7f71a0d21000-7f71a4000000 ---p 00000000 00:00 0 7f71a4000000-7f71a8000000 rw-p 00000000 00:00 0 7f71a87fa000-7f71a87fb000 ---p 00000000 00:00 0 7f71a87fb000-7f71a8ffb000 rw-p 00000000 00:00 0 7f71a8ffb000-7f71a8ffc000 ---p 00000000 00:00 0 7f71a8ffc000-7f71a97fc000 rw-p 00000000 00:00 0 7f71a97fc000-7f71a97fd000 ---p 00000000 00:00 0 7f71a97fd000-7f71a9ffd000 rw-p 00000000 00:00 0 7f71a9ffd000-7f71a9ffe000 ---p 00000000 00:00 0 7f71a9ffe000-7f71ab7ff000 rw-p 00000000 00:00 0 7f71ab7ff000-7f71ab800000 ---p 00000000 00:00 0 7f71ab800000-7f71ac000000 rw-p 00000000 00:00 0 7f71ac000000-7f71b0000000 rw-p 00000000 00:00 0 7f71b0000000-7f71b133a000 rw-p 00000000 00:00 0 7f71b133a000-7f71b4000000 ---p 00000000 00:00 0 7f71b47fc000-7f71b67fe000 rw-p 00000000 00:00 0 7f71b67fe000-7f71b67ff000 ---p 00000000 00:00 0 7f71b67ff000-7f71b8000000 rw-p 00000000 00:00 0 7f71b8000000-7f71be8e6000 rw-p 00000000 00:00 0 7f71be8e6000-7f71c0000000 ---p 00000000 00:00 0 7f71c0000000-7f71c7ffd000 rw-p 00000000 00:00 0 7f71c7ffd000-7f71c8000000 ---p 00000000 00:00 0 7f71c8000000-7f71d0000000 rw-p 00000000 00:00 0 7f71d0000000-7f71d4000000 rw-p 00000000 00:00 0 7f71d47fb000-7f71d47fc000 ---p 00000000 00:00 0 7f71d47fc000-7f71d4ffc000 rw-p 00000000 00:00 0 7f71d4ffc000-7f71d4ffd000 ---p 00000000 00:00 0 7f71d4ffd000-7f71d67fe000 rw-p 00000000 00:00 0 7f71d67fe000-7f71d67ff000 ---p 00000000 00:00 0 7f71d67ff000-7f71d8000000 rw-p 00000000 00:00 0 7f71d8000000-7f71dc000000 rw-p 00000000 00:00 0 7f71dc000000-7f71e0000000 rw-p 00000000 00:00 0 7f71e0000000-7f71e0021000 rw-p 00000000 00:00 0 7f71e0021000-7f71e4000000 ---p 00000000 00:00 0 7f71e4253000-7f71e5254000 rw-p 00000000 00:00 0 7f71e5254000-7f71e5255000 ---p 00000000 00:00 0 7f71e5255000-7f71e5a55000 rw-p 00000000 00:00 0 7f71e5a55000-7f71e5a56000 ---p 00000000 00:00 0 7f71e5a56000-7f71e7257000 rw-p 00000000 00:00 0 7f71e7257000-7f71e7258000 ---p 00000000 00:00 0 7f71e7258000-7f71ece46000 rw-p 00000000 00:00 0 7f71ece46000-7f71ece4e000 rw-s 00000000 fd:00 3675649 /var/services/openldap/var/openldap-data/__db.006 7f71ece4e000-7f71ed230000 rw-s 00000000 fd:00 3675587 /var/services/openldap/var/openldap-data/__db.005 7f71ed230000-7f71ed470000 rw-s 00000000 fd:00 3675569 /var/services/openldap/var/openldap-data/__db.004 7f71ed470000-7f722d470000 rw-s 00000000 fd:00 3675566 /var/services/openldap/var/openldap-data/__db.003 7f722d470000-7f722f722000 rw-s 00000000 fd:00 3675035 /var/services/openldap/var/openldap-data/__db.002 7f722f722000-7f722f9e3000 rw-p 00000000 00:00 0 7f722f9e3000-7f722f9e7000 r-xp 00000000 fd:00 2360495 /usr/lib64/sasl2/libanonymous.so.2.0.23 7f722f9e7000-7f722fbe6000 ---p 00004000 fd:00 2360495 /usr/lib64/sasl2/libanonymous.so.2.0.23 7f722fbe6000-7f722fbe7000 r--p 00003000 fd:00 2360495 /usr/lib64/sasl2/libanonymous.so.2.0.23 7f722fbe7000-7f722fbe8000 rw-p 00004000 fd:00 2360495 /usr/lib64/sasl2/libanonymous.so.2.0.23 7f722fbe8000-7f722fbec000 r-xp 00000000 fd:00 2364158 /usr/lib64/sasl2/libplain.so.2.0.23 7f722fbec000-7f722fdeb000 ---p 00004000 fd:00 2364158 /usr/lib64/sasl2/libplain.so.2.0.23 7f722fdeb000-7f722fdec000 r--p 00003000 fd:00 2364158 /usr/lib64/sasl2/libplain.so.2.0.23 7f722fdec000-7f722fded000 rw-p 00004000 fd:00 2364158 /usr/lib64/sasl2/libplain.so.2.0.23 7f722fded000-7f722fdf2000 r-xp 00000000 fd:00 2360498 /usr/lib64/sasl2/libsasldb.so.2.0.23 7f722fdf2000-7f722fff1000 ---p 00005000 fd:00 2360498 /usr/lib64/sasl2/libsasldb.so.2.0.23 7f722fff1000-7f722fff2000 r--p 00004000 fd:00 2360498 /usr/lib64/sasl2/libsasldb.so.2.0.23 7f722fff2000-7f722fff3000 rw-p 00005000 fd:00 2360498 /usr/lib64/sasl2/libsasldb.so.2.0.23 7f722fff3000-7f722fff7000 r-xp 00000000 fd:00 2364155 /usr/lib64/sasl2/liblogin.so.2.0.23 7f722fff7000-7f72301f6000 ---p 00004000 fd:00 2364155 /usr/lib64/sasl2/liblogin.so.2.0.23 7f72301f6000-7f72301f7000 r--p 00003000 fd:00 2364155 /usr/lib64/sasl2/liblogin.so.2.0.23 7f72301f7000-7f72301f8000 rw-p 00004000 fd:00 2364155 /usr/lib64/sasl2/liblogin.so.2.0.23 7f72301f8000-7f7230231000 rw-p 00000000 00:00 0 7f7230231000-7f723023d000 r-xp 00000000 fd:00 1704002 /lib64/libnss_files-2.12.so 7f723023d000-7f723043d000 ---p 0000c000 fd:00 1704002 /lib64/libnss_files-2.12.so 7f723043d000-7f723043e000 r--p 0000c000 fd:00 1704002 /lib64/libnss_files-2.12.so 7f723043e000-7f723043f000 rw-p 0000d000 fd:00 1704002 /lib64/libnss_files-2.12.so 7f723043f000-7f7230445000 rw-p 00000000 00:00 0 7f7230445000-7f7230448000 r-xp 00000000 fd:00 1703972 /lib64/libcom_err.so.2.1 7f7230448000-7f7230647000 ---p 00003000 fd:00 1703972 /lib64/libcom_err.so.2.1 7f7230647000-7f7230648000 r--p 00002000 fd:00 1703972 /lib64/libcom_err.so.2.1 7f7230648000-7f7230649000 rw-p 00003000 fd:00 1703972 /lib64/libcom_err.so.2.1 7f7230649000-7f723064d000 rw-p 00000000 00:00 0 7f723064d000-7f7230656000 r-xp 00000000 fd:00 2371184 /usr/lib64/libltdl.so.7.2.1 7f7230656000-7f7230855000 ---p 00009000 fd:00 2371184 /usr/lib64/libltdl.so.7.2.1 7f7230855000-7f7230856000 rw-p 00008000 fd:00 2371184 /usr/lib64/libltdl.so.7.2.1 7f7230856000-7f7230857000 rw-p 00000000 00:00 0 7f7230857000-7f723085d000 rw-s 00000000 fd:00 3674284 /var/services/openldap/var/openldap-data/__db.001 7f723085d000-7f723085e000 rw-p 00000000 00:00 0 7fffe0384000-7fffe0399000 rw-p 00000000 00:00 0 [stack] 7fffe03f9000-7fffe03fa000 r-xp 00000000 00:00 0 [vdso] ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall] cmdline ----- /var/services/openldap/libexec/slapd -h 'ldap://*:389 ldaps://*:636' -f /var/services/openldap/etc/openldap/slapd.conf os_release ----- Red Hat Enterprise Linux Server release 6.2 (Santiago) environ ----- REMOTEHOST=10.212.141.90 HOSTNAME=aaaprod-master.uis.georgetown.edu SELINUX_ROLE_REQUESTED= HOST=aaaprod-master.uis.georgetown.edu TERM=vt100 SHELL=/bin/bash 'SSH_CLIENT=10.212.141.90 62167 22' SELINUX_USE_CURRENT_RANGE= SSH_TTY=/dev/pts/0 GROUP=wheel USER=dhm24.a LS_COLORS=rs=0:di=01;34:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:mi=01;05;37;41:su=37;41:sg=30;43:ca=30;41:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arj=01;31:*.taz=01;31:*.lzh=01;31:*.lzma=01;31:*.tlz=01;31:*.txz=01;31:*.zip=01;31:*.z=01;31:*.Z=01;31:*.dz=01;31:*.gz=01;31:*.lz=01;31:*.xz=01;31:*.bz2=01;31:*.tbz=01;31:*.tbz2=01;31:*.bz=01;31:*.tz=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.rar=01;31:*.ace=01;31:*.zoo=01;31:*.cpio=01;31:*.7z=01;31:*.rz=01;31:*.jpg=01;35:*.jpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.svg=01;35:*.svgz=01;35:*.mng=01;35:*.pcx=01;35:*.mov=01;35:*.mpg=01;35:*.mpeg=01;35:*.m2v=01;35:*.mkv=01;35:*.ogm=01;35:*.mp4=01;35:*.m4v=01;35:*.mp4v=01;35:*.vob=01;35:*.qt=01;35:*.nuv=01;35:*.wmv=01;35:*.asf=01;35:*.rm=01;35:*.rmvb=01;35:*.flc=01;35:*.avi=01;35:*.fli=01;35:*.flv=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.yuv=01;35:*.cgm=01;35:*.emf=01;35:*.axv=01;35:*.anx=01;35:*.ogv=01;35:*.ogx=01;35:*.aac=01;36:*.au=01;36:*.flac=01;36:*.mid=01;36:*.midi=01;36:*.mka=01;36:*.mp3=01;36:*.mpc=01;36:*.ogg=01;36:*.ra=01;36:*.wav=01;36:*.axa=01;36:*.oga=01;36:*.spx=01;36:*.xspf=01;36: HOSTTYPE=x86_64-linux MAIL=/var/spool/mail/dhm24.a PATH=/opt/ruby-enterprise/bin:/usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/bin:/bin:/usr/bin PWD=/ LANG=en_US.UTF-8 SELINUX_LEVEL_REQUESTED= KRB5CCNAME=FILE:/tmp/krb5cc_0.1 SHLVL=4 HOME=/root OSTYPE=linux VENDOR=unknown MACHTYPE=x86_64 LOGNAME=dhm24.a CVS_RSH=ssh 'SSH_CONNECTION=10.212.141.90 62167 141.161.152.76 22' 'LESSOPEN=|/usr/bin/lesspipe.sh %s' G_BROKEN_FILENAMES=1 _=/var/services/openldap/libexec/slapd

2 5

Memory leak in 2.4.31 w/ hdb and MMR?
by Brandon Hume 25 May '12

25 May '12

I've got my two-node setup up and running, MMR w/ delta-syncrepl. Node 1 is up and running with ~340k entries in the main DIT. It consumes about 4G of VM on a Redhat AS6 box, and the data dir is around 2.3G on-disk (including __db.* and the one log.* file...), and another 100M in cn=accesslog. I'm bringing up node 2 after nuking the data dir, and letting it syncrepl from nothing. I was tracking a SIGBUS error, but that turned out to be olcLogLevel=Stats+Sync generating a huge amount of logging and filling up the disk. Fixed that, moved on. Now, it's still crashing... but that's because slapd is bloating up hugely and causing the machine to run out of VM and kill the process. I've added about 8G of temporary swap, and it's still going. slapd on node2 is 5.5G resident, and nearly 15G in size total now. On-disk the hdb is only around 1.6G, so it still has a long ways to go. Can I assume this is not the way it should be? vmstat shows a lot of swap-out but almost no swap-in, so it's not thrashing. pmap shows a large number of 64M "anon" segments. 140 of those at one point, and 157 when I checked just now. It looks a lot like a memory leak, though I can't tell offhand whether the problem is in OpenLDAP (2.4.31) or in BerkeleyDB (5.3.15). When it finishes, I'm planning on turning off delta-syncrepl and pave/rebuild again, and see if it behaves the same. I could also give mdb a shot, but since this is a mirror I'd have to rebuild both sides. Any suggestions as to where I could start looking for the source of the problem? Obviously I'm not planning on rebuilding this node on a regular basis (and certainly not all via syncrepl) but I'm concerned that over an extended period of time it'll leak memory even during normal use. I'm including my DB_CONFIG, just in case. I can supply more of the config as necessary. DB_CONFIG: set_cachesize 0 536870912 0 set_lg_regionmax 10485760 set_lg_max 104857600 set_lg_bsize 26214400 set_lk_max_locks 4096 set_lk_max_objects 4096 set_flags DB_LOG_AUTOREMOVE (If anything looks particularly stupid in here, even unrelated to the leak, I'd love the advice...)

3 7

Multi Master syncrepl issue
by Neil Mcbennett 25 May '12

25 May '12

Hello, This is my first post to this list and unfortunately I come here with a problem. I'm not new to LDAP but I am new to OpenLDAP especially the 2.4 release. I am trying to get multi master replication working and I've read the documentation several times. I did wonder if this might be a bug but I still think it's probably a misunderstanding on my part. I have 2 servers configured for multi master replcation which I will refer to as server A and B. If I start both servers I can make changes on server A which are immediately replicated to server B. However if I then start making changes to server B I don't see replication back to A. The same thing happens if I initiate replication from B, then replication to A works but not the other way around. i.e. replication only works in 1 direction which is determined by which server I make changes on first. I am using slapd.conf as I didn't want to complicate matters by introducing online config. The specific version is 2.4.31. Connectivity between the servers is working fine - I can perform LDAP operations in both directions. If someone could take a look at my config I'd much appreciate it. Thanks Neil #slapd.conf Server A (10.5.1.110) pidfile /usr/local/openldap/var/run/slapd.pid argsfile /usr/local/openldap/var/run/slapd.args include /usr/local/openldap/etc/schema/core.schema include /usr/local/openldap/etc/schema/cosine.schema include /usr/local/openldap/etc/schema/solaris.schema include /usr/local/openldap/etc/schema/inetorgperson.schema include /usr/local/openldap/etc/schema/DUAConfigProfile.schema include /usr/local/openldap/etc/schema/sudo.schema modulepath /usr/local/openldap/libexec moduleload syncprov.la access to attrs=userPassword by self write by * auth by dn="cn=ldapclient,ou=profile,dc=example,dc=com" write access to dn.base="" by * read access to * by self write by users read by anonymous read serverID 1 database hdb suffix "dc=example,dc=com" rootdn "cn=Manager,dc=example,dc=com" rootpw {SSHA}pnqaqMcoMhnDbSRa9WAgDbhBMr/QnUGY lastmod on directory /usr/local/openldap/var/openldap-data index objectclass,uid,uidNumber,memberUid,entryCSN,entryUUID,automountKey eq index cn,sn,gn,mail eq,sub syncrepl rid=001 provider=ldap://10.7.82.3 type=refreshAndPersist searchbase="dc=example,dc=com" attrs="*,+" bindmethod=simple binddn="cn=manager,dc=example,dc=com" credentials="secret" mirrormode TRUE overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 ####################################################### #slapd.conf server B (10.7.82.3) pidfile /usr/local/openldap/var/run/slapd.pid argsfile /usr/local/openldap/var/run/slapd.args include /usr/local/openldap/etc/schema/core.schema include /usr/local/openldap/etc/schema/cosine.schema include /usr/local/openldap/etc/schema/solaris.schema include /usr/local/openldap/etc/schema/inetorgperson.schema include /usr/local/openldap/etc/schema/DUAConfigProfile.schema include /usr/local/openldap/etc/schema/sudo.schema modulepath /usr/local/openldap/libexec moduleload syncprov.la access to attrs=userPassword by self write by * auth by dn="cn=ldapclient,ou=profile,dc=example,dc=com" write access to dn.base="" by * read access to * by self write by users read by anonymous read serverID 2 database hdb suffix "dc=example,dc=com" rootdn "cn=Manager,dc=example,dc=com" rootpw {SSHA}pnqaqMcoMhnDbSRa9WAgDbhBMr/QnUGY lastmod on directory /usr/local/openldap/var/openldap-data index objectclass,uid,uidNumber,memberUid,entryCSN,entryUUID,automountKey eq index cn,sn,gn,mail eq,sub syncrepl rid=001 provider=ldap://10.5.1.110 type=refreshAndPersist searchbase="dc=example,dc=com" attrs="*,+" bindmethod=simple binddn="cn=manager,dc=example,dc=com" credentials="secret" mirrormode TRUE overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 #######################################################

1 0

ACL for nssov-overlay
by Uwe Werler 24 May '12

24 May '12

Hello list, does someone know how I can define an ACL for the socket used by the nssov-overlay? I tried by socket.url="/var/run/nslcd/socket" read but it won't work. Any suggestions? Thanks in advance! Regards Uwe

2 1

slapd hangs upon performing modification of cn=config
by Patrick Hemmer 24 May '12

24 May '12

I have a database which was working fine, but now whenever I go to perform any sort of modification on the database, the modification just hangs. No error, no timeout, just sits there. However while that first modification is hung, I can perform modifications of another database (other than cn=config) and they work just fine. I can even do further searches against cn=config while the modification is still hung. Also when I run slapd in the foreground, and then send it a SIGINT, it says "slapd shutdown: waiting for X operations/tasks to finish" and never ends. I end up having to SIGKILL it. The database is part of a MMR group of servers I was building, but I shut down all the other servers to troubleshoot the issue (it makes no difference whether the other servers are up or down, and they all exhibit the same problem). Where should I start looking to figure out whats going on (the specific operation/task thats hanging)? I can run slapd in debug mode with '-1', but theres a ton of info, and I dont know whats relevant, or which debug mode I should use other than '-1'. Thanks -Patrick

3 7

Anonymous bind allowed when configured not to.
by Kyle Smith 24 May '12

24 May '12

Good Morning, I was recently made aware of a problem with my OpenLDAP 2.4.26 and 2.4.28 servers. I have configured each server to disallow anony using the below directive. ### Disable anony disallow bind_anon This works great for Softerra Ldap Administrator, and the ldapsearch command (linux). $ ldapsearch -x -H ldaps://openldap.example.com -b "ou=peoples,dc=example,dc=com" "(uid=someuser)" ldap_bind: Inappropriate authentication (48) additional info: anonymous bind disallowed However, when I use Jxplorer (http://jxplorer.org/) it not only allows the bind, but allows the search. Right now the ACL is set for "by anonymous read", but shouldn't the disallow directive even prevent the connection? I'm working on getting some debug logs, but if any one has experienced this, please let me know. Thanks. Kyle Smith

2 2

Re: size of bdb database, master vs replica
by Quanah Gibson-Mount 24 May '12

24 May '12

--On Tuesday, May 22, 2012 10:06 AM +0200 Jehan Procaccia <jehan.procaccia(a)tem-tsp.eu> wrote: > Le 21/05/2012 18:33, Quanah Gibson-Mount a écrit : > > --On Monday, May 21, 2012 3:15 PM +0200 jehan procaccia > <jehan.procaccia(a)it-sudparis.eu> wrote: > > > ok __dd.xxx files are memory mapped files, > then which is the file(s) that contains the database ? I suspect > id2entry.bdb, but why on the master the size in KB is: > 195412 id2entry.bdb > and on the slave > 32 id2entry.bdb > > > It doesn't look to me like your replica is replicating at all. Have you > done a slapcat of the two and verified they are identical? > > --Quanah > > > > Ok, then I did a slapcat on a replica and to my big surprise, before I > did the slapcat, bdb files on the replica were very small, then as soon > as I did the slapcat (while slapd is off), now they are similar in size > to the master !? > Do we need to run regularly slapcat on replicas in order to "really" > replicate ? > No. It sounds like you don't have a checkpoint directive set for your database. You should fix that. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 2

dn.exact vs dn.base
by Nick Milas 24 May '12

24 May '12

I was wondering whether there is any difference between dn.exact and dn.base constructs. For example, theoretically (according to the documentation) we can use either: access to dn.base="ou=system,dc=example,dc=com" by dn.exact="uid=userx,ou=people,dc=example,dc=com" write or: access to dn.exact="ou=system,dc=example,dc=com" by dn.base="uid=userx,ou=people,dc=example,dc=com" write It seems to me that the two forms are interchangeable (as used, e.g. here: http://www.openldap.org/faq/data/cache/1140.html) Can you please clarify? Thanks, Nick

3 2

Problem with localhost unauthenticated bind
by Tim Watts 24 May '12

24 May '12

Hi, I'm having a problem with a new LDAP server (slapd 2.4.23-7.2) I'd like to have root@localhost be able to perform "manage" operations on the slapd on the localhost *only* - all other ACLs would be pretty standard. The machine itself is considered secure. Ideally, I'd like to do this with a mode(600) Unix Domain Socket owned by root. How do you enable an "manage" ACL for the entire DN if and only if the access comes via the unix socket? ================ On an aside - I've tried unauthenticated localhost access - but cannot get that to work. This would be less desirable as anyone with ssh access to the server would be abloe to bypass security - but I'm still curious to know what I did wrong. My slapd.d entries are: cat /etc/ldap/slapd.d/cn\=config.ldif ======================================================================= dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/slapd/slapd.args olcLogLevel: none olcPidFile: /var/run/slapd/slapd.pid olcToolThreads: 1 structuralObjectClass: olcGlobal entryUUID: 62952116-3777-1031-8e1b-bfeeb6e70114 creatorsName: cn=config createTimestamp: 20120521095922Z entryCSN: 20120521095922.839791Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20120521095922Z olcAllows: bind_anon_cred bind_anon_dn update_anon ### <<< Added this ======================================================================= cat /etc/ldap/slapd.d/cn\=config/olcDatabase\=\{1\}hdb.ldif ======================================================================= dn: olcDatabase={1}hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=cch,dc=kcl,dc=ac,dc=uk olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymous auth by dn="cn=admin,dc=cch,dc=kcl,dc=ac,dc=uk" write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by peername.regex=127\.0\.0\.1 manage ###<<< Added olcAccess: {3}to * by self write by dn="cn=admin,dc=cch,dc=kcl,dc=ac,dc=uk" write by * read olcLastMod: TRUE olcRootDN: cn=admin,dc=cch,dc=kcl,dc=ac,dc=uk olcRootPW:: e1NTSEF9TVFtdlA4Q2FJUjZqOEdpMytlcWd5Zk1BUWFjVmpGM1c= olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq structuralObjectClass: olcHdbConfig entryUUID: 62964ee2-3777-1031-8e25-bfeeb6e70114 creatorsName: cn=admin,cn=config createTimestamp: 20120521095922Z entryCSN: 20120521095922.847576Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20120521095922Z ======================================================================= Sorry this is a bit of a numpty question - I'm learning slapd - in a hurry(!) Many thanks in advance :) Tim -- Tim Watts Personal Email Personal website and blog: http://www.dionic.net/tim/

2 3

Issue upgrading openldap-clients from 2.4.19-15 to 2.4.23-20
by Esther Garcia 24 May '12

24 May '12

Hi all, We have an OpenLDAP server (RHEL6) running version 2.4.23-15, and we have clients in RHEL5 and RHEL6. With clients in RHEL5 works properly but I found some problems with RHEL6 clients in versions newer than 2.4.19-15. In the clients, if I try to upgrade to new versions than 2.4.19-15 then the client stops working: [root@XX ~]# rpm -qa | grep openldap openldap-2.4.19-15.el6.x86_64 openldap-clients-2.4.19-15.el6.x86_64 [root@XX ~]# ldapsearch -x -D 'cn=authenticate, ou=System,dc=test, dc=es' '(objectclass=*)' -W -ZZ Enter LDAP Password: # extended LDIF # # LDAPv3 ...... [root@XX ~]# id esther uid=63004(esther) gid=50041(test) groups=50041(test) [root@XX ~]# yum upgrade openldap* ..... Updating : openldap-2.4.23-20.el6.x86_64 1/4 warning: /etc/openldap/ldap.conf created as /etc/openldap/ldap.conf.rpmnew Updating : openldap-clients-2.4.23-20.el6.x86_64 2/4 Cleanup : openldap-clients-2.4.19-15.el6.x86_64 3/4 Cleanup : openldap-2.4.19-15.el6.x86_64 4/4 Updated: openldap.x86_64 0:2.4.23-20.el6 openldap-clients.x86_64 0:2.4.23-20.el6 Complete! [root@XX ~]# service nslcd restart Stopping nslcd: [ OK ] Starting nslcd: [ OK ] [root@XX ~]# id esther id: esther: No such user [root@XX ~]# ldapsearch -x -D 'cn=authenticate, ou=System,dc=test, dc=es' '(objectclass=*)' -W -ZZ ldap_start_tls: Connect error (-11) I have the same configuration files that used with the older version. I use these configuration files: */etc/pam_ldap.conf:* base dc=test,dc=es binddn cn=authenticate,ou=System,dc=test,dc=es bindpw XXXX timelimit 120 bind_timelimit 120 idle_timelimit 3600 pam_lookup_policy yes pam_password exop nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman,nscd,gdm ssl start_tls uri ldap://ldap1-test ldap://ldap2-test tls_cacertdir /etc/openldap/cacerts pam_password md5 */etc/nslcd.conf* uid nslcd gid ldap uri ldap://ldap1-test ldap://ldap2-test base dc=test,dc=es binddn cn=authenticate,ou=System,dc=test,dc=es bindpw XXXX ssl start_tls tls_cacertdir /etc/openldap/cacerts timelimit 120 bind_timelimit 120 idle_timelimit 3600 */etc/openldap/ldap.conf:* URI ldap://ldap1-test/ ldap://ldap2-test/ BASE dc=test,dc=es TLS_CACERT /etc/openldap/cacerts/catest.crt *CAcert file:* [root@XX ~]# ls -l /etc/openldap/cacerts/catest.crt -rw-r--r--. 1 root root 1655 May 23 15:23 /etc/openldap/cacerts/catest.crt Any idea on what the issue is? Am I missing anything? Thanks in advance, Esther

2 3

Re: dn.exact vs dn.base
by Turbo Fredriksson 24 May '12

24 May '12

[sorry, should have gone to the list] On Thu, 24 May 2012 14:02:28 +0300, Nick Milas wrote: > access to dn.base="ou=system,dc=example,dc=com" > by dn.exact="uid=userx,ou=people,dc=example,dc=com" write This gives 'uid=userx,...' access to 'ou=system,...' _and everything below it_. > access to dn.exact="ou=system,dc=example,dc=com" > by dn.base="uid=userx,ou=people,dc=example,dc=com" write While this is the opposite - it gives 'uid=userx,...' and any objects below this (not much point in this exact example :) to ONLY the base object 'ou=system,...'. For example: ----- s n i p ----- access to dn.exact="" attrs=supportedSASLMechanisms,namingContexts,subschemaSubentry,objectClass,monitorContext,configContext,entry by domain.subtree="bayour.com" read by peername.ip="127\.0\.0\.1" read by peername.ip="192\.168\.69\.8" read by peername.path="/var/run/slapd/ldapi" read ----- s n i p ----- This gives almost anonymous access to certain attributes to the base DN...

2 1

Re: Migrating from slapd 2.3 to 2.4
by Bobby Krupczak 23 May '12

23 May '12

Hi! > This is an old can of worms, Bobby. > Basically, Quanah & the OpenLDAP developers are not interested in > supporting old versions, because it takes away from the time they have > to work on the current version. We as users should support this, > because the software will stop growing if the devs spend too much time > on older versions. I understand completely. I write software myself and only admin my network enough to support my software development. I have a small number of users but a large number of machines hence why I use ldaps. I dont want to support years old releases of my own software. However, I dont radically change my config file formats either :) > I've followed this policy for the decade or so that I've been using > OpenLDAP and been very successful. I am running a large infrastructure > of Red Hat OL builds right now - dozens of replicas, with no problems > whatsoever. Thanks!! I'm going to tackle the conversion after I get this new system in place. Bobby

5 11

Re: checking replica dbs for consistency
by Nick Milas 23 May '12

23 May '12

On 23/5/2012 5:51 μμ, Charles T. Brooks wrote: > > <Mail content is a bit scrambled (text with spaces between chars), but I managed to read !!> > Charles, Thank you for your thoughts. I agree with you. There can/should be a number of consumers fully replicating the DIT so that they can be promoted to masters whenever needed. However, we do have and want some consumers with limited data replication. For example, our mail server runs a consumer replicating only the user accounts needed and only the ldap-hosted aliases. I don't want to replicate more ldap data there, there is no need to expose more data there and to load the server with unneeded replication operations. We are replicating on the mail server so that we can do *local* ldap lookups and achieve better mail server performance. Additionally, our DNS masters, replicate only the DNS resource records (also ldap-hosted). They don't need any info about users and aliases. We are also replicating there so that we can do local ldap lookups and achieve better DNS server performance. But I want to be able to check whether all partially replicated data are replicating as they should! One solution would be to define some non-root DN which *will be able to* replicate the whole DIT and use it in consumer configuration, then limit replication *using filters*. But this limits options and affects DIT architecture in the first place (not necessarily bad, but we would need to re-evaluate some things and it's not easy when in production). Thank you again for your time and thoughts, Nick

1 0

Re: checking replica dbs for consistency
by Nick Milas 23 May '12

23 May '12

On 23/5/2012 4:39 μμ, Charles T. Brooks wrote: > I u s e s l a p c a t t o d u m p t h e d a t a b a s e s t o L D I F f i l e s , s o r t t o n o r m a l i z e t h e o r d e r i n g , a n d d i f f t o c h e c k f o r d i f f e r e n c e s . Thank you, As I said, this actually would work only when replicating *the whole* DIT. By the way, what happens with the operational attributes - are they (supposed to be) identical on both ends? I am expecting any hints on comparing partial replicated data (based on consumer bind DN) ! Nick

2 1

ppolicy 'Constraint violation' with no additional info
by Jean-Philippe Braun 23 May '12

23 May '12

Hi all, I'm using ppolicy for some time now but sometimes when a user changes its password we get a 'Constraint violation' error without any additional info like 'Password is too young to change' or 'Password is in history of old passwords'. So I'm not sure where it fails. Does anybody have some idea on which case(s) this could happen ? (still using 2.4.23 on debian stable) Thanks

2 1

Re: Concerns with OLC (cn=config) for editing schema, ACLs, and deleting entries
by Michael Ströder 22 May '12

22 May '12

harry.jede(a)arcor.de wrote: > Michael Ströder wrote: >> The goal was to make the ACLs more readable for the admin. > This is my intend. Now the question is: Where to make them more readable. >> The GUI >> just makes it possible for the admin to add the LFs and display the >> ACL as multiple lines. And now this has the effect that the >> attributes values in LDIF are base64-encoded. The admin decides >> whether to add LFs or not. > Right, but are you sure all admins, can handle base64 encoded strings > properly. Tools, especially GUI-Tools should make life easier, not more > complex. Again: Did you read the whole thread in the mailing list archive? >> Please add it via LDAP and display it in a LDAP client. It will be a >> single line which was considered to be less readable. > Yes, and it should be a single line. It's entirely up to you whether you want to add LFs or not. There's no GUI tool forcing you to do so. Not my web2ldap nor Apache Directory Studio mentioned in this thread. Ciao, Michael.

2 2

Re: Fwd: Root cause: Strange OpenLdap performace issue
by Michele Mase' 22 May '12

22 May '12

Sorry, I'didn't understand. Which should be better compile/build options? Michele MAsè On Tue, May 22, 2012 at 12:40 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Tuesday, May 22, 2012 12:06 AM +0200 Michele Mase' < > michele.mase(a)gmail.com> wrote: > > > This is how redhat builds openldap; which are the bad libs? Are they the >> lib crypt (--enable-crypt); what should I use instead? >> Michele Masè >> > > Not crypt. crypto. as in using NSS instead of OpenSSL. > > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 3

Compiling on Windows, using VC or Windows SDK
by Tom Schuetz 21 May '12

21 May '12

Has anyone successfully compiled openldap using Visual Studio, or Windows SDK? If so, could you share your process with me, what you used for a makefile (or vcproj), approach to dependencies, etc? I have VC 2010 Express on a 64-bit Windows 7 box, and then I also have Windows SDK 7.1. I am comfortable with POSIX OSs and have MinGW installed, but for this I would prefer not to use it to actually compile. Am open to using MinGW to make a useable / translatable makefile, though. Thanks very much, Tom S

3 3

Re: Fwd: Root cause: Strange OpenLdap performace issue
by Michele Mase' 21 May '12

21 May '12

configure \ --with-threads=posix \ --enable-local \ --enable-rlookups \ --with-tls=no \ --with-cyrus-sasl \ --enable-wrappers \ --enable-passwd \ --enable-cleartext \ --enable-crypt \ --enable-spasswd \ --disable-lmpasswd \ --enable-modules \ --disable-sql \ --libexecdir=%{_libdir} build \ --enable-plugins \ --enable-slapd \ --enable-multimaster \ --enable-bdb \ --enable-hdb \ --enable-ldap \ --enable-ldbm \ --with-ldbm-api=%{ldbm_backend} \ --enable-meta \ --enable-monitor \ --enable-null \ --enable-shell \ --enable-sql=mod \ --disable-ndb \ --enable-passwd \ --enable-sock \ --disable-perl \ --enable-relay \ --disable-shared \ --disable-dynamic \ --with-kerberos=k5only \ --enable-overlays=mod This is how redhat builds openldap; which are the bad libs? Are they the lib crypt (--enable-crypt); what should I use instead? Michele Masè On Mon, May 21, 2012 at 11:47 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Monday, May 21, 2012 11:40 PM +0200 Michele Mase' < > michele.mase(a)gmail.com> wrote: > > Is it really bad? Is it buggy? Since redhat has its own ldap 389 dir. >> server, I suppose they don't care of openldap. isn't it? >> Michele Masè >> > > There are known issues with the release they use, and the crypto libraries > it is linked to. > > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

Re: Fwd: Root cause: Strange OpenLdap performace issue
by Michele Mase' 21 May '12

21 May '12

Is it really bad? Is it buggy? Since redhat has its own ldap 389 dir. server, I suppose they don't care of openldap. isn't it? Michele Masè On Mon, May 21, 2012 at 6:33 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Sunday, May 20, 2012 2:13 PM +0200 Michele Mase' < > michele.mase(a)gmail.com> wrote: > > Tx for the suggestion! We plan to migrate where possible to rhel6, that >> has included the 2.4.x openldap (and the possibility of hot adding ram >> and cpu in VM env). We have already tested a multi-master conf. that >> works fine. >> > > Using the OpenLDAP included with RHEL6 is a terrible idea. If you want to > use OpenLDAP as a server, then build it yourself, or use packages from any > of the numerous other sites that will build it out for you, so that you can > stay current. Distro packages are in general only for using the client > libraries. > > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

Migrating from slapd 2.3 to 2.4
by Bobby Krupczak 21 May '12

21 May '12

Hi! I'm finally updating my file/ldap server and am struggling with converting my 2.3 slapd.conf file to 2.4 ldif format. My plan to upgrade was: - dump my old ldap db to a single ldif file - convert slapd.conf using slaptest - connect to slapd using an ldap browser and import my old db via the ldif file I created Is this an appropriate approach that will work? Am I missing something? I ran the slaptest program on my old slapd.conf file and generated a slew of configs under slapd.d. However, I'm now running into an error when I try to start slapd. slapd[4320]: config error processing cn={1}core,cn=schema,cn=config: olcAttributeTypes: Duplicate attributeType: "2.5.4.2" slaptest: bad configuration file! systemd[1]: PID file /var/run/slapd.pid not readable (yet?) after start. I saw via google where the attribute is duplicated but I never could find how to edit/modify the configs to remove the duplicate entry. Any ideas how to remove this duplicate entry? Thanks, Bobby

4 19

RE: Migrating from slapd 2.3 to 2.4
by Quanah Gibson-Mount 21 May '12

21 May '12

--On Monday, May 21, 2012 5:18 PM -0400 "Charles T. Brooks" <brooksct(a)hbcs.org> wrote: > I prefer testing and solid evidence rather than trusting to luck. And > I'm well aware of OpenSSL/NSS issues. But I think our architectures are > based on different assumptions, Quanah. > > I don't use syncrepl. I use slurpd, and I run it without incident for > years at a time. I am currently feeding OL 2.4 systems (Red Hat 6.2) > and 2.3 systems (Red Hat 5.x) from a master 2.3 system without issues, > all using Red Hat packages. Slurpd is more bandwidth efficient than > syncrepl, and I do not have any of the problems syncrepl was designed to > solve, so using syncrepl would be a regression for me. I already have > the ability to sync any or all replicas in minutes if needed, and all my > applications implement LDAP failover at the client, so I can bring down > any server any time I wish. Syncrepl offers me nothing. Cn=config > offers less; it does not yet have all the functions of slapd.conf > (although I am running it on the 2.4 nodes) and it puts a master > password in the database, a password which previously was not LDAP > accessible. Then your usage vastly differs from the norm, and should not in any way, shape, or form, be used as a platform for giving advice to people who are freshly deploying OpenLDAP. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

size of bdb database, master vs replica
by jehan procaccia 21 May '12

21 May '12

hello I use syncrepl between my master and replicas I am surprise with the apparent size of my database (~4000 people entries with jpegphotos of ~10KB each) on the master I have # du -sk *.bdb | sort -n 172 gidNumber.bdb 188 uidNumber.bdb 332 memberUid.bdb 772 ou.bdb 812 modifyTimestamp.bdb 1020 givenName.bdb 1204 uid.bdb 1368 dn2id.bdb 1620 sn.bdb 1908 IntEPersInetServ.bdb 2068 objectClass.bdb 2804 eduPersonOrgUnitDN.bdb 2828 eduPersonPrimaryOrgUnitDN.bdb 3064 cn.bdb 3368 schacUserStatus.bdb 6784 mail.bdb *195412 id2entry.bdb * Plus BDB # du -sk __db* | sort -n 12 __db.001 12 __db.006 464 __db.005 548 __db.004 67540 __db.002 205072 __db.003 but these are shared memory and doesn't matter I suppose !? On the replica I have # du -sk *.bdb | sort -n 8 cn.bdb 8 dn2id.bdb 8 eduPersonOrgUnitDN.bdb 8 eduPersonPrimaryOrgUnitDN.bdb 8 entryCSN.bdb 8 entryUUID.bdb 8 gidNumber.bdb 8 givenName.bdb 8 IntEPersInetServ.bdb 8 mail.bdb 8 memberUid.bdb 8 modifyTimestamp.bdb 8 objectClass.bdb 8 ou.bdb 8 schacUserStatus.bdb 8 sn.bdb 8 uid.bdb 8 uidNumber.bdb *32 id2entry.bdb* # du -sk __* | sort -n 12 __db.001 12 __db.006 380 __db.005 740 __db.004 7060 __db.002 53860 __db.003 So the size of the file are very different, why ? 4000 objects with at least 3000 jpegphoto of 10K each seems to fit in a 32K id2entry.bdb, but why then on the master it is at 195412K id2entry.bdb !? Thanks .

3 4

Re: Fwd: Root cause: Strange OpenLdap performace issue
by Michele Mase' 21 May '12

21 May '12

Tx! We'plan to upgrade the system, so we'll use openldap2.4.x. We have more than 1500 server and about 50% of them are linux, we must use rhel rpms (due to our datacenter roles, all the servers should be identical). The worst thing was that testing with the same db without the index files, all the results of the query are almost immediate. I'm unable to reproduce the problem in test environment. Regards Michele MAsè On Tue, May 15, 2012 at 6:24 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Tuesday, May 15, 2012 2:55 PM +0200 Michele Mase' < > michele.mase(a)gmail.com> wrote: > > Anyone??????? >> >> > OpenLDAP 2.3 has not been supported for several years. Since it stopped > development, there have been hundreds, if not over a thousand, bug fixes > and improvements. Furthermore, I'm going to guess that you are running > RH's build of OpenLDAP 2.3, which was even further behind than the last > release of OpenLDAP 2.3. Given the information you provided, I would guess > that there is some bug in the version of BDB that OpenLDAP was linked to > that caused the error. I would note that at one point RH was linking > OpenLDAP against BDB version 4.3, despite the fact OpenLDAP's configure > script explicitly disabled such linking because BDB 4.3 was known to have > serious issues. If your 2.3 OpenLDAP is linked to BDB 4.3 that could well > be the cause of your issue. > > Beyond that, trying to investigate any further is a waste of everyone's > time. Upgrade to a modern supported version of OpenLDAP, and build your > own packages, don't rely on distribution packages. > > <http://www.openldap.org/faq/**data/cache/1456.html<http://www.openldap.org/faq/data/cache/1456.html> > > > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

4 5

Concerns with OLC (cn=config) for editing schema, ACLs, and deleting entries
by Chris Hiestand 20 May '12

20 May '12

Part 1: Readability I know you veterans are probably sick to death of us late-comers asking questions about cn=config. I understand but please hear me out because I feel I have done due diligence; but I still have some concerns with the transition. Workflow has been discussed before, but I suspect it hasn't been fleshed out because the switch from editing schema and ACLs in flat files to LDAP entries reduces readability. I have no problem using cn=config for most configuration attributes, but it gets a lot less user friendly when the value is, what used to be in slapd.conf, a multi-line string. But I could just be missing something. Your help is appreciated. Attached are some screenshots of editing ACLs and a custom schema via 3 methods: 1. cn=config via ldap client (ie apache directory studio) 2. cn=config via ldif 3. old style slapd.conf Look at the pictures and pick which method you'd like to use to edit ACLs or a schema: http://snl.salk.edu/~chiestand/openldap/ACLs-via-ldap.png http://snl.salk.edu/~chiestand/openldap/ACLs-via-ldif.png http://snl.salk.edu/~chiestand/openldap/ACLs-via-slapd.conf.png http://snl.salk.edu/~chiestand/openldap/schema-via-ldap.png http://snl.salk.edu/~chiestand/openldap/schema-via-ldif.png http://snl.salk.edu/~chiestand/openldap/schema-via-slapd.conf.png I think the choice is clearly old style slapd.conf. Otherwise you miss comments and ordering (until Howard Chu's X-ORDERED ldap extension is implemented), and unlimited whitespace to substantially improve readability. The LDIF files are a mess because of the way words are split unpredictably by new lines. You can't use a simple search and replace with any hope of it working. Readability would be vastly improved with new lines before keywords (eg to, filter, attrs …) but I don't think it's possible to have ldapsearch output this way. Editing via an ldap client is easy if you're just editing an attribute here and there, but because of the interacting nature of ACLs and schema elements, poor readability (no newlines) makes editing via an ldap client more difficult (a gui with smart sorting and syntax highlighting could make it better). Am I just missing workflow techniques or key concepts that improves readability? Or is your advice to just suck it up and get used to it? Part 2: Deleting entries in cn=config Quanah Gibson-Mount has said entry deletes are coming in 2.5, is that still the plan? The Roadmap page isn't specific. What about whole schema deletes? From a sysadmin perspective, I should be able to add, modify, or delete anything from the configuration. For QA reasons, you want to be have the exact configuration you want; not the configuration you want plus legacy boogers. I understand if this isn't trivial to achieve from the developer perspective. Granted I don't have the whole picture here, but I'd argue that it's worth it. Lastly, I thank everyone who contributes to OpenLDAP.

16 47

OLC version of plugin directive
by Joseph L. Casale 19 May '12

19 May '12

I am trying to adapt a plugin preoperation|postoperation setup from an older slapd.conf to my current OLC based config. I can not seem to find any applicable olc based directives that accomplish the same, anyone have a pointer? Thanks! jlc

2 2

SSL client cert authc problems with OpenLDAP client and OpenDJ server
by Michael Ströder 18 May '12

18 May '12

HI! (cross-posted since OpenLDAP and OpenDJ are involved) I have some SSL client cert authc problems with a OpenLDAP 2.4.23 LDAP client (dynamically linked to OpenSSL 0.9.8e on RHEL 5.6) and OpenDJ 2.4.5 running under control of Java 1.6.0_31. I cross-checked all the cert and trust stuff several times. It seems to be correct. Unfortunately we're stuck with 2.4.23 in this setup because of OpenLDAP's ITS#6997. (I manually obfuscated parameters and log lines herein.) At first glance OpenLDAP's ldapwhoami seems to work correctly with the first OpenDJ replica: $ LDAPTLS_CERT=ldap-client.crt LDAPTLS_KEY=client.key ldapwhoami -H ldaps://master1.example.com -Y EXTERNAL SASL/EXTERNAL authentication started SASL username: cn=ldapclient,o=example,c=DE SASL SSF: 0 dn:cn=ldapclient,ou=Users,cn=example But in OpenDJ's access-log file there's written: [18/May/2012:16:52:00 +0200] CONNECT conn=15 from=x.x.x.x:33358 to=x.x.x.x:63677 protocol=LDAPS [18/May/2012:16:52:00 +0200] BIND REQ conn=15 op=0 msgID=1 type=SASL mechanism=EXTERNAL dn="" [18/May/2012:16:52:00 +0200] BIND RES conn=15 op=0 msgID=1 result=0 authDN="cn=ldapclient,o=example,c=DE" etime=0 [18/May/2012:16:52:00 +0200] EXTENDED REQ conn=15 op=1 msgID=2 name="Who Am I?" oid="1.3.6.1.4.1.4203.1.11.3" [18/May/2012:16:52:00 +0200] EXTENDED RES conn=15 op=1 msgID=2 result=0 additionalInfo="authzID="dn:cn=ldapclient,ou=Users,cn=example"" etime=1 [18/May/2012:16:52:00 +0200] DISCONNECT conn=15 reason="Protocol Error" msg="The client sent a request to the Directory Server that could not be properly decoded as an LDAP message: javax.net.ssl.SSLException: Inbound closed before receiving peer's close_notify: possible truncation attack?" The attempt to do the same on another OpenDJ replica fails completely (no differences in TLS configuration - checked cn=config for potential differences with diff): $ LDAPTLS_CERT=ldap-client.crt LDAPTLS_KEY=client.key ldapwhoami -H ldaps://consumer1.example.com -Y EXTERNAL ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1) In OpenDJ's access-log file there's written: [18/May/2012:16:52:38 +0200] CONNECT conn=6 from=x.x.x.x:61841 to=x.x.x.x:63677 protocol=LDAPS [18/May/2012:16:52:38 +0200] DISCONNECT conn=6 reason="Protocol Error" msg="The client sent a request to the Directory Server that could not be properly decoded as an LDAP message: javax.net.ssl.SSLHandshakeException: General SSLEngine problem" [18/May/2012:16:53:06 +0200] CONNECT conn=7 from=x.x.x.x:61842 to=x.x.x.x:63677 protocol=LDAPS [18/May/2012:16:53:07 +0200] DISCONNECT conn=7 reason="Protocol Error" msg="The client sent a request to the Directory Server that could not be properly decoded as an LDAP message: javax.net.ssl.SSLHandshakeException: General SSLEngine problem" Any clue what's going on here? Ciao, Michael.

3 3

slapadd -S defaulting to 0
by Mark 18 May '12

18 May '12

Why does the '-S' option on slapadd to default 0 instead of the (olc)ServerID value currently being used? (according to the manpage) Thank you, Mark

1 0

ACL syntax with wildcards
by Nick Milas 18 May '12

18 May '12

Hi, We would like to use ACL statements of the form (used for illustration purposes): access to dn.subtree="ou=people,dc=example,dc=com" filter="(ou=xxxxx)" attrs="someAttrs" by group.exact="cn=xxxxxAdmins,ou=Groups,dc=example,dc=com" write by group.exact="cn=allAdmins,ou=Groups,dc=example,dc=com" read by self read where xxxxx is some string. In essence, we assign people entries to various administrative groups, depending on the value of the ou attribute of the entry. Of course we can write many statements, one per ou value / admin group, but it would be much more concise to use just one statement using wildcards. Could someone please suggest if and how the above can be written correctly, using e.g. regex? I appreciate any suggestions. Thanks, Nick

7 15

ACL Manual Additions request
by Nick Milas 18 May '12

18 May '12

Hi, I think it would be important to add some text in http://www.openldap.org/doc/admin24/access-control.html regarding the use of <control> keywords (i.e. stop, continue, break), esp "break". These are not explained at all in the particular page, and IMHO they are notsatisfactorily explained in FAQ-O-Matic as well (unless there is a page which I missed, in which case please add the appropriate info in the above page which is a main point of reference). For example, the above man page does not even include an example with a break keyword. At least one example should be included for children, entry attributes (and the significance of break there should be explained). There are some examples in FAQ-O-Matic, for example: http://www.openldap.org/faq/data/cache/1474.html http://www.openldap.org/faq/data/cache/429.html http://www.openldap.org/faq/data/cache/189.html but they do not provide sufficient insight. So, currently the significance and use of <control> keywords is obscure. Although I am now (after almost two years) in a position to be able to understand and handle ACLs to an extensive degree successfully (not without effort), yet I am far from writing a tutorial or manual text, I felt the above addition is a real need (esp. for new users) that I should mention, asking the project team for it. Regards and thanks for the project's efforts, Nick

1 0

translucent overlay and local objects?
by Eugene Vilensky 16 May '12

16 May '12

Greetings, Pardon if this is an RTFM (I'd love a link), but is it possible to store entities locally using the translucent overlay? The overlay works for what we are trying to do when it comes to search and modifying attributes on an entry, but I would like to create an entire local groupofnames, consisting of remote UIDs. For example, this LDIF imports OK: #!RESULT OK #!CONNECTION ldap://xxxxx #!DATE 2012-04-09T16:01:33.961 dn: cn=instructors,ou=Groups,dc=xxxx,dc=zzz changetype: add objectClass: groupofnames member: uid=nate member: uid=penelope member: uid=rhonda cn: instructors But searching for it does not bring back a result. However, it must have gone somewhere since if I try to import the same LDIF again: #!RESULT ERROR #!CONNECTION ldap://xxxxx #!DATE 2012-04-09T16:21:28.221 #!ERROR [LDAP: error code 68 - Entry Already Exists] Kind regards, Eugene

4 11

CAN I MADE MY OWN SCHEMA
by amine boubou 16 May '12

16 May '12

hi i've installed openldap correctly, but now i want to use some attributs that not exist in default objectclass. My question: can i configure openldap with new specifique schema without using the default (core.schema cosine.schema nis.schema and inetorgperson.schema). thanks for answer :)

2 1

Adding ODERING to a core attribute
by Emmanuel Dreyfus 16 May '12

16 May '12

Hi I have a VoIP phone that insist on having ORDERING set on sn and givenName in core.schema. Is there any smart way of doing it without modifying the core.schema file? -- Emmanuel Dreyfus manu(a)netbsd.org

2 1

HowTo to setup LDAP
by Luc MAIGNAN 16 May '12

16 May '12

Hi, I've found a lot of howto to setup openLDAP using the slapd.conf but none using the actual database feature. But I want to configure a freshly installed openLDAP without writing a slapd.conf and doing a migration on it. Is there somewhere a step-by-step howto to setup an openLDAP using the new feature (all parameters in the LDAP) ? Thanks for any help Best regards

4 6

"do_bind: invalid dn" while trying to monitor slapd using pacemaker `slapd' resource agent
by Igor Zinovik 16 May '12

16 May '12

Hello. I'm deploing mirrormode openldap cluster. I have two hosts running openSUSE 12.1 with openldap2-2.4.30-83.3.x86_64 I created special user for mirrormode and tuned limits, so replication works fine. But for transparent switch between two nodes in case of failure i need some additional software to monitor ldap daemons and manage IP addresses on which my consumers connect. So i went for pacemaker and used following document to set it up: http://www.daasi.de/ldapcon2011/downloads/Haferkamp-paper.pdf I decided to create a special uid for monitoring my tree which can read only root element: ldap2:~# grep -C 2 pcmk /etc/openldap/slapd.conf # access to dn.base="dc=test,dc=org" by dn="uid=slapd-pcmk,ou=Services,dc=test,dc=org" read And here is my problem: I can successfully execute search query by hands using ldapsearch(1): ldap2:~# ldapsearch -H "ldap:/// ldaps:/// ldapi:///" -b dc=test,dc=org -LLL -s base -x -D 'uid=slapd-pcmk,ou=Services,dc=test,dc=org -w 'P@ssw0rd,' Enter LDAP Password: dn: dc=test,dc=org dc: test objectClass: organization objectClass: dcObject o: Test org ldap2:~# echo $? 0 Pacemaker uses resource agents to monitor various daemons, so i downloaded resource agent for slapd. Resource agent is just a script file (e.g. resource agent for slapd) and it executes same query as i do by hand, but slapd complains about "invalid dn": Here is how slapd resource was defined: ldap2:~# crm configure primitive slapd_mirrormode ocf:heartbeat:slapd params \ slapd="/usr/lib/openldap/slapd" config="/etc/openldap/slapd.conf" \ user="ldap" group="ldap" services="ldap:/// ldaps:/// ldapi:///" \ watch_suffix="dc=test,dc=org" \ bind_dn="uid=slapd-pcmk,ou=Services,dc=test,dc=org" \ password="P@ssw0rd," parameters="-o slp=on" \ meta migration-threshold="3" op monitor interval="10s" I changed loglevel in slapd to `1' and see following in log: May 16 13:07:00 ldap2 slapd[7641]: slap_listener_activate(8): May 16 13:07:00 ldap2 slapd[7641]: >>> slap_listener(ldap:///) May 16 13:07:00 ldap2 slapd[7641]: connection_get(17): got connid=1013 May 16 13:07:00 ldap2 slapd[7641]: connection_read(17): checking for input on id=1013 May 16 13:07:00 ldap2 slapd[7641]: op tag 0x60, time 1337159220 May 16 13:07:00 ldap2 slapd[7641]: conn=1013 op=0 do_bind May 16 13:07:00 ldap2 slapd[7641]: >>> dnPrettyNormal: <'uid=slapd-pcmk,ou=Services,dc=test,dc=org'> May 16 13:07:00 ldap2 slapd[7641]: conn=1013 op=0 do_bind: invalid dn ('uid=slapd-pcmk,ou=Services,dc=test,dc=org') May 16 13:07:00 ldap2 slapd[7641]: send_ldap_result: conn=1013 op=0 p=3 May 16 13:07:00 ldap2 slapd[7641]: send_ldap_response: msgid=1 tag=97 err=34 May 16 13:07:00 ldap2 slapd[7641]: connection_get(17): got connid=1013 May 16 13:07:00 ldap2 slapd[7641]: connection_read(17): checking for input on id=1013 May 16 13:07:00 ldap2 slapd[7641]: op tag 0x42, time 1337159220 May 16 13:07:00 ldap2 slapd[7641]: conn=1013 op=1 do_unbind May 16 13:07:00 ldap2 slapd[7641]: connection_close: conn=1013 sd=17 May 16 13:07:01 ldap2 slapd[7641]: slap_listener_activate(8): May 16 13:07:01 ldap2 slapd[7641]: >>> slap_listener(ldap:///) May 16 13:07:01 ldap2 slapd[7641]: connection_get(17): got connid=1014 May 16 13:07:01 ldap2 slapd[7641]: connection_read(17): checking for input on id=1014 May 16 13:07:01 ldap2 slapd[7641]: op tag 0x60, time 1337159221 May 16 13:07:01 ldap2 slapd[7641]: conn=1014 op=0 do_bind May 16 13:07:01 ldap2 slapd[7641]: >>> dnPrettyNormal: <'uid=slapd-pcmk,ou=Services,dc=test,dc=org'> May 16 13:07:01 ldap2 slapd[7641]: conn=1014 op=0 do_bind: invalid dn ('uid=slapd-pcmk,ou=Services,dc=test,dc=org') May 16 13:07:01 ldap2 slapd[7641]: send_ldap_result: conn=1014 op=0 p=3 May 16 13:07:01 ldap2 slapd[7641]: send_ldap_response: msgid=1 tag=97 err=34 May 16 13:07:01 ldap2 slapd[7641]: connection_get(17): got connid=1014 May 16 13:07:01 ldap2 slapd[7641]: connection_read(17): checking for input on id=1014 May 16 13:07:01 ldap2 slapd[7641]: op tag 0x42, time 1337159221 May 16 13:07:01 ldap2 slapd[7641]: ber_get_next on fd 17 failed errno=0 (Success) May 16 13:07:01 ldap2 slapd[7641]: conn=1014 op=1 do_unbind May 16 13:07:01 ldap2 slapd[7641]: connection_close: conn=1014 sd=17 May 16 13:07:02 ldap2 slapd[7641]: slap_listener_activate(8): May 16 13:07:02 ldap2 slapd[7641]: >>> slap_listener(ldap:///) May 16 13:07:02 ldap2 slapd[7641]: connection_get(17): got connid=1015 May 16 13:07:02 ldap2 slapd[7641]: connection_read(17): checking for input on id=1015 May 16 13:07:02 ldap2 slapd[7641]: op tag 0x60, time 1337159222 May 16 13:07:02 ldap2 slapd[7641]: conn=1015 op=0 do_bind May 16 13:07:02 ldap2 slapd[7641]: >>> dnPrettyNormal: <'uid=slapd-pcmk,ou=Services,dc=test,dc=org'> May 16 13:07:02 ldap2 slapd[7641]: conn=1015 op=0 do_bind: invalid dn ('uid=slapd-pcmk,ou=Services,dc=test,dc=org') May 16 13:07:02 ldap2 slapd[7641]: send_ldap_result: conn=1015 op=0 p=3 May 16 13:07:02 ldap2 slapd[7641]: send_ldap_response: msgid=1 tag=97 err=34 May 16 13:07:02 ldap2 slapd[7641]: connection_get(17): got connid=1015 May 16 13:07:02 ldap2 slapd[7641]: connection_read(17): checking for input on id=1015 May 16 13:07:02 ldap2 slapd[7641]: op tag 0x42, time 1337159222 May 16 13:07:02 ldap2 slapd[7641]: conn=1015 op=1 do_unbind May 16 13:07:02 ldap2 slapd[7641]: connection_close: conn=1015 sd=17 May 16 13:07:04 ldap2 slapd[7641]: slap_listener_activate(8): May 16 13:07:04 ldap2 slapd[7641]: >>> slap_listener(ldap:///) May 16 13:07:04 ldap2 slapd[7641]: connection_get(17): got connid=1016 May 16 13:07:04 ldap2 slapd[7641]: connection_read(17): checking for input on id=1016 May 16 13:07:04 ldap2 slapd[7641]: op tag 0x60, time 1337159224 May 16 13:07:04 ldap2 slapd[7641]: conn=1016 op=0 do_bind May 16 13:07:04 ldap2 slapd[7641]: >>> dnPrettyNormal: <'uid=slapd-pcmk,ou=Services,dc=test,dc=org'> May 16 13:07:04 ldap2 slapd[7641]: conn=1016 op=0 do_bind: invalid dn ('uid=slapd-pcmk,ou=Services,dc=test,dc=org') May 16 13:07:04 ldap2 slapd[7641]: send_ldap_result: conn=1016 op=0 p=3 May 16 13:07:04 ldap2 slapd[7641]: send_ldap_response: msgid=1 tag=97 err=34 May 16 13:07:04 ldap2 slapd[7641]: connection_get(17): got connid=1016 May 16 13:07:04 ldap2 slapd[7641]: connection_read(17): checking for input on id=1016 May 16 13:07:04 ldap2 slapd[7641]: op tag 0x42, time 1337159224 May 16 13:07:04 ldap2 slapd[7641]: conn=1016 op=1 do_unbind May 16 13:07:04 ldap2 slapd[7641]: connection_close: conn=1016 sd=17 May 16 13:07:05 ldap2 slapd[7641]: slap_listener_activate(8): May 16 13:07:05 ldap2 slapd[7641]: >>> slap_listener(ldap:///) May 16 13:07:05 ldap2 slapd[7641]: connection_get(17): got connid=1017 May 16 13:07:05 ldap2 slapd[7641]: connection_read(17): checking for input on id=1017 May 16 13:07:05 ldap2 slapd[7641]: op tag 0x60, time 1337159225 May 16 13:07:05 ldap2 slapd[7641]: conn=1017 op=0 do_bind May 16 13:07:05 ldap2 slapd[7641]: >>> dnPrettyNormal: <'uid=slapd-pcmk,ou=Services,dc=test,dc=org'> May 16 13:07:05 ldap2 slapd[7641]: conn=1017 op=0 do_bind: invalid dn ('uid=slapd-pcmk,ou=Services,dc=test,dc=org') May 16 13:07:05 ldap2 slapd[7641]: send_ldap_result: conn=1017 op=0 p=3 May 16 13:07:05 ldap2 slapd[7641]: send_ldap_response: msgid=1 tag=97 err=34 May 16 13:07:05 ldap2 slapd[7641]: connection_get(17): got connid=1017 May 16 13:07:05 ldap2 slapd[7641]: connection_read(17): checking for input on id=1017 May 16 13:07:05 ldap2 slapd[7641]: op tag 0x42, time 1337159225 May 16 13:07:05 ldap2 slapd[7641]: conn=1017 op=1 do_unbind May 16 13:07:05 ldap2 slapd[7641]: connection_close: conn=1017 sd=17 May 16 13:07:06 ldap2 slapd[7641]: daemon: shutdown requested and initiated. May 16 13:07:06 ldap2 slapd[7641]: slapd shutdown: waiting for 1 operations/tasks to finish May 16 13:07:06 ldap2 slapd[7641]: slapd shutdown: initiated May 16 13:07:06 ldap2 slapd[7641]: ====> bdb_cache_release_all May 16 13:07:06 ldap2 slapd[7641]: slapd destroy: freeing system resources. May 16 13:07:06 ldap2 slapd[7641]: syncinfo_free: rid=001 May 16 13:07:06 ldap2 slapd[7641]: connection_get(14): got connid=0 May 16 13:07:06 ldap2 slapd[7641]: slapd stopped. I understand that there might be a problem in pacemakers `slapd' resource agent. Maybe it corrupts bind dn somehow... Agent executes `monitor' operation, here is a snippet from resource agent code: ldap2:~# less /usr/lib/ocf/resource.d/heartbeat/slapd ... slapd_monitor() { ... options="-LLL -s base -x" if [ -n "$bind_dn" ]; then options="$options -D '$bind_dn' -w '$password'" fi [ -z "$1" ] && err_option="" for suffix in $suffixes; do ocf_run -q $err_option "$ldapsearch" -H "$services" -b "$suffix" $options >/dev/null 2>&1; rc=$? case "$rc" in "0") ocf_log debug "slapd database with suffix '$suffix' reachable" ;; "49") ocf_log err "slapd database with suffix '$suffix' unreachable. Invalid credentials." return $OCF_ERR_CONFIGURED ;; *) if [ -z "$1" ] || [ -n "$1" -a $rc -ne 1 ]; then ocf_log err "slapd database with suffix '$suffix' unreachable. exit code ($rc)" fi ... Still scratching head...

2 1

OpenLDAP 2.4.23 multi-master replication of the cn=config tree error: could not put entry file in place
by Cyril Grosjean 16 May '12

16 May '12

I've a sandbox environment with 2 CentOS 6.2 servers running the genuine openldap-servers rpms, that is OpenLDAP 2.4.23 . I've setup a multi-master replication between the servers, so that both my data DIT (dc=....,dc=.... ) and the cn=config should be replicated. Actually, the replication of data works fine, as expected in either way, but the replication of the configuration tree fails: each time I update the configuration on the second node, I get this error in my LDAP client (Apache Directory Studio): could not put entry file in place I've tried to run the second master in debug (-d -1) mode, and it seems like there's a write access error when the slapd daemon (on the 2nd master) tries to update/modify/replace the /etc/openldap/slapd.d/cn=config.ldif file: <= acl_access_allowed: granted to database root ldif_write_entry: could not put entry file for "cn=config" in place: Permission denied send_ldap_result: conn=-1 op=0 p=3 send_ldap_result: err=80 matched="" text="internal error (could not put entry file in place)" send_ldap_result: conn=-1 op=0 p=3 send_ldap_result: err=80 matched="" text="internal error (could not put entry file in place)" null_callback : error code 0x50 slap_graduate_commit_csn: removing 0x7fd19412f090 20120510163105.003156Z#000000#001#000000 syncrepl_updateCookie: rid=001 be_modify failed (80) ldap_msgfree The OpenLDAP error log shows the following error: May 10 19:12:39 sashimi slapd[24866]: slapd starting May 10 19:12:40 sashimi slapd[24866]: ldif_write_entry: cannot create file for "olcDatabase={0}config,cn=config": Permission denied May 10 19:12:40 sashimi slapd[24866]: null_callback : error code 0x50 May 10 19:12:40 sashimi slapd[24866]: syncrepl_entry: rid=001 be_modify failed (80) May 10 19:12:40 sashimi slapd[24866]: do_syncrepl: rid=001 rc -1 quitting May 10 19:12:50 sashimi slapd[24866]: ldif_write_entry: could not put entry file for "cn=config" in place: Permission denied May 10 19:12:50 sashimi slapd[24866]: null_callback : error code 0x50 May 10 19:12:50 sashimi slapd[24866]: syncrepl_updateCookie: rid=001 be_modify failed (80) May 10 19:13:00 sashimi slapd[24866]: ldif_write_entry: could not put entry file for "cn=config" in place: Permission denied May 10 19:13:00 sashimi slapd[24866]: null_callback : error code 0x50 May 10 19:13:00 sashimi slapd[24866]: syncrepl_updateCookie: rid=001 be_modify failed (80) May 10 19:13:10 sashimi slapd[24866]: ldif_write_entry: could not put entry file for "cn=config" in place: Permission denied May 10 19:13:10 sashimi slapd[24866]: null_callback : error code 0x50 May 10 19:13:10 sashimi slapd[24866]: syncrepl_updateCookie: rid=001 be_modify failed (80) Of course, I don't have any right access problems at the file system level, I don't have any file system ACLs, I don't use SELinux and I've checked that I can update or create any file under /etc/openldap/slapd.d, when logged in as the ldap user (who's the account used to run slapd). So, this error looks like a bug to me. Already fixed ? To setup the replication of both data and configuration, I've copied the full /etc/openldap directory from one server to the other, with the same file system rights. I've just changed the server certificate files since I use TLS to replicate both the data and the configuration. So, I don't have any TLS problem since the data tree replication works fine. Here's my replication configuration for the cn=config database: dn: olcDatabase={0}config,cn=config ... .... olcSyncRepl: rid=001 provider=ldap://......:389 binddn="cn=config" bindmethod=simple credentials="......" searchbase="cn=config" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 starttls=yes tls_cacert=/etc/openldap/conf/cacert.pem olcSyncRepl: rid=002 provider=ldap://.....:389 binddn="cn=config" bindmethod=simple credentials="....... " searchbase="cn=config" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 starttls=yes tls_cacert=/etc/openldap/conf/cacert.pem olcMirrorMode: TRUE I actually use the same setup than for the data replication, excepted that I have rid=003 and rid=004 of course for data replication, and the BIND DN and passwords are different too. -- Cyril

4 4

SASL AD + SASL SCRAM
by Pieter Baele 16 May '12

16 May '12

Hi, My current LDAP setup uses SASL PTA to authenticate against Active Directory. For users only existing in OpenLDAP, I would use SASL SCRAM, so no passes over the wire except for these in AD ;-) But I believe only 1 method can be used by SASL External? Any guidelines on configuring something as this? Do I really need the meta backend or is there a better way? -- PieterB

2 1

AW: overlay nssov + pass-through authentication
by Uwe Werler 16 May '12

16 May '12

> Hello list, > > up to now we have pam_ldap/nss_ldap running from padl and all user accounts have > > pass-through authentication configured to authenticate against an > external ldap server.* > > Now I try the overlay nssov and except authentication all is running fine. > > If I use the userPassword directly the user can authenticate without problems. > > Isn't it possible to use pass-through authentication with overlay nssov? > > Thanks in advance! > > Regards Uwe > > *userPassword: {SASL}uid > > > Ok, I found overlay pbind - it does what I want 'cause we use saslauthd with ldap auth against an external ldap server for some user accounts. Drawback in this setup is that I have to split my database for this.

1 0

Re: options for meta when using configuration backend
by Scott Koranda 15 May '12

15 May '12

On Tue, May 15, 2012 at 10:52 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, May 15, 2012 9:32 PM -0500 Scott Koranda <skoranda(a)gmail.com> > wrote: > >> Does slapd-meta built from 2.4.31 source support using >> slapd-config? > > > You never mentioned slapd-meta in your original post. The subject of the post was "options for meta when using configuration backend". I agree that the note could have been more clear. > olcDbURI is usually > associated with slapd-ldap. I don't believe slapd-meta has cn=config > support at this time. Thank you. I will proceed with slapd.conf. Scott > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration

1 0

options for meta when using configuration backend
by Scott Koranda 15 May '12

15 May '12

Hi, I am using slapd 2.4.23 on Debian Squeeze. Is 'olcDbURI' the correct configuration option to use with the configuration backend? Put another way, is 'olcDbURI' the configuration backend analog of the 'uri' target specification option used in the slapd.conf file? If 'olcDbURI' is not the correct option I would be grateful to know the correct option to use. Thanks, Scott

2 3

extracting
by Alex Samad - Yieldbroker 15 May '12

15 May '12

Hi Wondering if anyone can help me, I need to extra schema info out of MS AD and then add it to openldap . try to get openldap - proxy to - MS AD working... I can do simple type of searches like on cn, but I can do search on attributes like samaccountype ... I am guess that's it's a scheme issues... A

3 6

Re: options for meta when using configuration backend
by André Ribas 15 May '12

15 May '12

2012/5/15 Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Tuesday, May 15, 2012 5:35 PM -0500 Scott Koranda <skoranda(a)gmail.com> > wrote: > >> Hi, >> >> I am using slapd 2.4.23 on Debian Squeeze. > > > Bad idea. Build your own package. > Can I ask you why is it a bad idea? > > [...] > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > André Ribas

1 0

2.4.31 slapd-meta
by Eugene Vilensky 15 May '12

15 May '12

Hello, I am trying to move a meta-directory from version 2.3.43 (included with RHEL 5) to version 2.4.31 (openldap-ltb packages on RHEL6). I've tried to follow the man pages and FAQ properly in using newer directives for the same functionality, but searches that previously worked on 2.3.43 no longer work. The meta database in the 2.3.43 is defined like so: ----- database meta suffix "dc=example,dc=edu" uri "ldap://central-ldap.example.edu/ou=people,dc=example,dc=edu" idassert-bind bindmethod=simple binddn "cn=account,ou=service,dc=example,dc=edu" bindpw secret uri "ldap://localhost/ou=groups,dc=local,dc=example,dc=edu" idassert-bind bindmethod=simple binddn "cn=Manager,dc=local,dc=example,dc=edu" bindpw supersecret ---------- This seems to work (People are retrieved from the upstream ldap and a local bdb [not shown] database serves groupofnames memberships specific to our org unit), with deprecation warnings: /etc/openldap/slapd.conf: line 118: "binddn" statement is deprecated; use "acl-authcDN" instead /etc/openldap/slapd.conf: line 119: "bindpw" statement is deprecated; use "acl-passwd" instead /etc/openldap/slapd.conf: line 123: "binddn" statement is deprecated; use "acl-authcDN" instead /etc/openldap/slapd.conf: line 124: "bindpw" statement is deprecated; use "acl-passwd" instead [1] I've assumed binddn and bindpw are used by slapd-meta to perform searches against the remote directory. Is this wrong? Moving these configuration options to 2.4.31, my <database meta> is defined like so (focusing on the remote LDAP entry): database meta suffix "dc=example,dc=edu" uri "ldap://central-ldap.example.edu/ou=people,dc=example,dc=edu" idassert-bind bindmethod=simple binddn="cn=account,ou=service,dc=example,dc=edu" credentials="secret" Searches don't work and debug output includes among other information: 4fb288b5 conn=1001 op=11 meta_search_dobind_init[0] mc=0x7ff4c0104b20: non-empty dn with empty cred; binding anonymously request done: ld 0x7ff4c4101f40 msgid 2 res_errno: 48, res_error: <binds with a dn require a password>, res_matched: <> Is there a reason why credentials aren't being used along with bind dn? Was I wrong about assumption [1]? Hmm..the search works if I use "rebind-as-user yes" as an option for the remote URI, but I've not figured out from slapd-ldap(5) why this is so...the client credentials are not valid upstream, its a dn specific to the local database. Any help greatly appreciated (as before!) -Eugene

1 0

Root cause: Strange OpenLdap performace issue
by Michele Mase' 15 May '12

15 May '12

I've a tiny ldap service (only 6000 records) vith openldap 2.3.x rhel5.x master/slave; The first query takes me over 4 seconds (instead of taking less than 0.1.seconds): time ldapsearch -x -b "c=it" -s sub "(o=*)" -D "cn=Manager,dc=sir" -h www.example.com -w mypasswd The same query using one level takes only 0.4 seconds time ldapsearch -x -b "c=it" -s one "(o=*)" -D "cn=Manager,dc=sir" -h www.example.com -w mypasswd I've tested the following: New brand system with openldap 2.4.x rhel6.x mirror mode: both queries take me less than 0.2 seconds New brand system with the same releases, 2.3.x rhel5.x: both queries take me less than 0.2 seconds The problem should be in the prod. system: I've tried almost all: reindexing operations, better indexing options, more cache, better threads tuning, more cpu and ram to the servers ... nothing to do: the first quey takes more than 4 seconds. The last operation was a "disaster recovery" of the prod. ldap: 1 stop ldap on both systems 2 slapcat to save the last good ldif 3 remove of all databases (rm -fr /var/lib/ldap/*) on both systems 4 recreate dirs, DB_CONFIG and restore ldif; restore permissions 5 start ldap service on both servers And magically, the issue has gone! Now first query, yes the "bad" query with the subtree options, works like a charm, giving me the results in less than 0.1 seconds .... Which could be the root cause? DB defragmentation? I was unable to find the root cause. PLS, help me to find some suggestions. Regards Michele Masè

2 2

overlay nssov + pass-through authentication
by Uwe Werler 15 May '12

15 May '12

Hello list, up to now we have pam_ldap/nss_ldap running from padl and all user accounts have pass-through authentication configured to authenticate against an external ldap server.* Now I try the overlay nssov and except authentication all is running fine. If I use the userPassword directly the user can authenticate without problems. Isn't it possible to use pass-through authentication with overlay nssov? Thanks in advance! Regards Uwe *userPassword: {SASL}uid

1 0

Cannot mount users's home directories
by zingalo 15 May '12

15 May '12

Hi, i have problems mounting on the client ubuntu the users's home directories that are on a server debian squeeze with ldap-samba. First of all, which is the correct syntax for homeDirectory attribute if that home is on a server. I wrote: homeDirectory: //192.168.5.219/users/username but pam_mount tells me volume not found. am not sure of samba and smbldap configurations also. could you take a look of my conf files? this is smb.conf: [global] #identificazione workgroup = AMAHORO server string = amahoro security = user #opzioni di rete hosts allow = 192.168.5.0/24 localhost #opzioni per il log log file = /var/log/samba/log.%u max log size = 1000 log level = 3 #opzioni per l'accesso alle condivisioni encrypt passwords = yes null passwords = no security = user #smb passwd file = /etc/samba/smbpasswd username map = /etc/samba/smbusers #LDAP passdb backend = ldapsam:ldap://127.0.0.1/ ldap admin dn = cn=Manager,dc=amahoro,dc=bi ldap suffix = dc=amahoro,dc=bi ldap machine suffix = ou=Computers ldap user suffix = ou=Users ldap group suffix = ou=Groups ldap ssl = no add user script = /usr/local/sbin/smbldap-useradd -m "%u" add group script = /usr/local/sbin/smbldap-groupadd "%g" delete user from group script = /usr/local/sbin/smbldap-groupmod -x "%u" "%g" delete user script = /usr/local/sbin/smbldap-userdel "%u" delete group script = /usr/loca/sbin/smbldap-groupdel "%g" [homes] path = /users/%u browseable = no writable = yes valid users = %S read only = no guest ok = no admin users = %u write list = %u read list = %u create mask = 0700 directory mask = 0700 [user_data] comment = Leçon browseable = yes public = yes writable = no path = /user_data and this is smbldap.conf: # $Source: $ # $Id: smbldap.conf,v 1.18 2005/05/27 14:28:47 jtournier Exp $ # # smbldap-tools.conf : Q & D configuration file for smbldap-tools # This code was developped by IDEALX (http://IDEALX.org/) and # contributors (their names can be found in the CONTRIBUTORS file). # # Copyright (C) 2001-2002 IDEALX # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License # as published by the Free Software Foundation; either version 2 # of the License, or (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, # USA. # Purpose : # . be the configuration file for all smbldap-tools scripts ############################################################################## # # General Configuration # ############################################################################## # Put your own SID. To obtain this number do: "net getlocalsid". # If not defined, parameter is taking from "net getlocalsid" return SID="S-1-5-21-251852451-2940789264-3475694606" # Domain name the Samba server is in charged. # If not defined, parameter is taking from smb.conf configuration file # Ex: sambaDomain="IDEALX-NT" sambaDomain="AMAHORO" #realm="amahoro.bi" ############################################################################## # # LDAP Configuration # ############################################################################## # Notes: to use to dual ldap servers backend for Samba, you must patch # Samba with the dual-head patch from IDEALX. If not using this patch # . one master LDAP server where all writing operations must be done # . one slave LDAP server where all reading operations must be done # (typically a replication directory) # Slave LDAP server # Ex: slaveLDAP=127.0.0.1 # If not defined, parameter is set to "127.0.0.1" slaveLDAP="127.0.0.1" # Slave LDAP port # If not defined, parameter is set to "389" slavePort="389" # Master LDAP server: needed for write operations # Ex: masterLDAP=127.0.0.1 # If not defined, parameter is set to "127.0.0.1" masterLDAP="127.0.0.1" # Master LDAP port # If not defined, parameter is set to "389" #masterPort="389" masterPort="389" # Use TLS for LDAP # If set to 1, this option will use start_tls for connection # (you should also used the port 389) # If not defined, parameter is set to "0" ldapTLS="0" # Use SSL for LDAP # If set to 1, this option will use SSL for connection # (standard port for ldaps is 636) # If not defined, parameter is set to "0" ldapSSL="0" # How to verify the server's certificate (none, optional or require) # see "man Net::LDAP" in start_tls section for more details verify="require" # CA certificate # see "man Net::LDAP" in start_tls section for more details cafile="/etc/smbldap-tools/ca.pem" # certificate to use to connect to the ldap server # see "man Net::LDAP" in start_tls section for more details clientcert="/etc/smbldap-tools/smbldap-tools.iallanis.info.pem" # key certificate to use to connect to the ldap server # see "man Net::LDAP" in start_tls section for more details clientkey="/etc/smbldap-tools/smbldap-tools.iallanis.info.key" # LDAP Suffix # Ex: suffix=dc=IDEALX,dc=ORG suffix="dc=amahoro,dc=bi" # Where are stored Users # Ex: usersdn="ou=Users,dc=IDEALX,dc=ORG" # Warning: if 'suffix' is not set here, you must set the full dn for usersdn usersdn="ou=Users,${suffix}" # Where are stored Computers # Ex: computersdn="ou=Computers,dc=IDEALX,dc=ORG" # Warning: if 'suffix' is not set here, you must set the full dn for computersdn computersdn="ou=Computers,${suffix}" # Where are stored Groups # Ex: groupsdn="ou=Groups,dc=IDEALX,dc=ORG" # Warning: if 'suffix' is not set here, you must set the full dn for groupsdn groupsdn="ou=Groups,${suffix}" # Where are stored Idmap entries (used if samba is a domain member server) # Ex: groupsdn="ou=Idmap,dc=IDEALX,dc=ORG" # Warning: if 'suffix' is not set here, you must set the full dn for idmapdn idmapdn="ou=Idmap,${suffix}" # Where to store next uidNumber and gidNumber available for new users and groups # If not defined, entries are stored in sambaDomainName object. # Ex: sambaUnixIdPooldn="sambaDomainName=${sambaDomain},${suffix}" # Ex: sambaUnixIdPooldn="cn=NextFreeUnixId,${suffix}" sambaUnixIdPooldn="sambaDomainName=AMAHORO,${suffix}" # Default scope Used scope="sub" # Unix password encryption (CRYPT, MD5, SMD5, SSHA, SHA, CLEARTEXT) hash_encrypt="SSHA" # if hash_encrypt is set to CRYPT, you may set a salt format. # default is "%s", but many systems will generate MD5 hashed # passwords if you use "$1$%.8s". This parameter is optional! crypt_salt_format="%s" ############################################################################## # # Unix Accounts Configuration # ############################################################################## # Login defs # Default Login Shell # Ex: userLoginShell="/bin/bash" userLoginShell="/bin/bash" # Home directory # Ex: userHome="/home/%U" userHome="/users/%U" # Default mode used for user homeDirectory userHomeDirectoryMode="700" # Gecos userGecos="System User" # Default User (POSIX and Samba) GID defaultUserGid="513" # Default Computer (Samba) GID defaultComputerGid="550" # Skel dir skeletonDir="/etc/skel" # Default password validation time (time in days) Comment the next line if # you don't want password to be enable for defaultMaxPasswordAge days (be # careful to the sambaPwdMustChange attribute's value) defaultMaxPasswordAge="45" ############################################################################## # # SAMBA Configuration # ############################################################################## # The UNC path to home drives location (%U username substitution) # Just set it to a null string if you want to use the smb.conf 'logon home' # directive and/or disable roaming profiles # Ex: userSmbHome="\\PDC-SMB3\%U" userSmbHome="\\amahoro\users\%U" # The UNC path to profiles locations (%U username substitution) # Just set it to a null string if you want to use the smb.conf 'logon path' # directive and/or disable roaming profiles # Ex: userProfile="\\PDC-SMB3\profiles\%U" userProfile="\\amahoro\profiles\%U" # The default Home Drive Letter mapping # (will be automatically mapped at logon time if home directory exist) # Ex: userHomeDrive="H:" #userHomeDrive="H:" # The default user netlogon script name (%U username substitution) # if not used, will be automatically username.cmd # make sure script file is edited under dos # Ex: userScript="startup.cmd" # make sure script file is edited under dos userScript="logon.bat" # Domain appended to the users "mail"-attribute # when smbldap-useradd -M is used # Ex: mailDomain="idealx.com" mailDomain="iallanis.info" ############################################################################## # # SMBLDAP-TOOLS Configuration (default are ok for a RedHat) # ############################################################################## # Allows not to use smbpasswd (if with_smbpasswd == 0 in smbldap_conf.pm) but # prefer Crypt::SmbHash library with_smbpasswd="0" #smbpasswd="/usr/bin/smbpasswd" # Allows not to use slappasswd (if with_slappasswd == 0 in smbldap_conf.pm) # but prefer Crypt:: libraries with_slappasswd="0" slappasswd="/usr/sbin/slappasswd" # comment out the following line to get rid of the default banner # no_banner="1" Thanks for your time

2 4

LDAP & AUTOMOUNT QUESTION
by Borresen, John - 0442 - MITLL 14 May '12

14 May '12

All, Running OpenLDAP 2.4.23 on CentOS5.8. Looking into modifying our automount a bit. For example, say we have the following LDIF for an automap: from the auto.master: objectClass automount(structural) automountInformation auto.admin -nosuid automountKey /admin The auto.admin LDIF has this: objectClass automount(structural) automountInformation server:/vol/vol2/admin/documents automountKey docs There is another entry, same automountInformation (server:/vol/vol2/admin/documents) for documents and doc. Is there any way that we can combine those entries into one? For example, something like this: objectClass automount(structural) automountInformation server:/vol/vol2/admin/documents automountKey docs automountKey documents automountKey doc I tried to modify things in this fashion but, it failed, "only one automountKey is permitted". Thanks for the help, I hope I made our intentions clear. In the long run we would like to have the option for an EU (end-user) to be able to change directories to /admin/docs, /admin/documents, or /admin/doc. Dave Borresen Solaris/Linux Systems Administrator Surveillance Systems Group MIT Lincoln Laboratory john.borresen(a)ll.mit.edu

1 0

ACL for nssov-overlay
by Uwe Werler 14 May '12

14 May '12

Hello list, does someone know how I can define an ACL for the socket used by the nssov-overlay? I tried by socket.url="/var/run/nslcd/socket" read but it won't work. Any suggestions? Thanks in advance! Regards Uwe

1 0

Re: OpenLDAP 2.4.23 multi-master replication of the cn=config tree error: could not put entry file in place
by Brandon Hume 11 May '12

11 May '12

(Please reply to the list, so any useful information gets archived for others in the future...) On 05/11/12 05:39 AM, Cyril Grosjean wrote: > 26374 open("/etc/openldap/slapd.d/cn=config.ldif", O_RDONLY) = 16 > 26374 open("/etc/openldap/slapd.d/cn=config.40TIFd", > O_RDWR|O_CREAT|O_EXCL, 0600) = 16 > 26374 rename("/etc/openldap/slapd.d/cn=config.40TIFd", > "/etc/openldap/slapd.d/cn=config.ldif") = -1 EACCES (Permission denied) > 26374 unlink("/etc/openldap/slapd.d/cn=config.40TIFd") = 0 > So it really looks to me like a bug. As suggested by Quanah, I'll try > OpenLDAP 2.4.31 if I've time for that, but my goal was possibly to > stick to "official" rpms, for obvious support reasons. If it's a bug, then it's a bug in the operating system. strace traces system calls ("_s_ystem trace"). You can plainly see OpenLDAP creating the new cn=config.ldif as a tempfile, trying to rename it to overwrite the old, and being told by the *OS* that it's not allowed to do so. Here's the exact same operation on my own server: 5596 open("/appl/ldap/etc/slapd.d/cn=config.ldif", O_RDONLY) = 57 5596 open("/appl/ldap/etc/slapd.d/cn=config.Zi6PH7", O_RDWR|O_CREAT|O_EXCL, 0600) = 57 5596 rename("/appl/ldap/etc/slapd.d/cn=config.Zi6PH7", "/appl/ldap/etc/slapd.d/cn=config.ldif") = 0 How about showing us the exact permissions on the directory and that file? What's the output of: ls -lZd /etc/openldap/slapd.d /etc/openldap/slapd.d/cn=config.ldif and: getfacl /etc/openldap/slapd.d /etc/openldap/slapd.d/cn=config.ldif

3 2

2-node MMR w/ delta-syncrepl setup, out of sync, best way to resync?
by Brandon Hume 10 May '12

10 May '12

I have a new MMR setup, "kil-ds-3" and "kil-ds-4". I turns out that I was missing syncprov on the cn=accesslog tree, which the guys on IRC helped me out with correcting (thanks again, JoBbZ!). But even though I corrected that, and syncrepl is working great now, kil-ds-4 is not discovering and replicating the ~15k changes made on kil-ds-3 while syncing was broken, even when restarting the server. Howard pointed me at the -c command line argument for slapd, and I've given it a try with "slapd -c rid=002", as well as "slapd -c rid=002,sin=2,csn=0", and neither one causes the server to do a full resync, although the manpage says "-c rid=002" should be sufficient. Do the rules for that change in a mirrormode setup? Is the only real fix an "/etc/init.d/ldapd stop && rm -f ${DBDIR}/* && /etc/init.d/ldapd start"? *Somewhat* related to that... we have an "updater" process that runs through the directory and changes departmental affiliations, organizational affiliations, entitlements, and so on. Most of the time only a few dozen records get touched, but of course about three times a year new students come in, more graduate, and so on... and on those landmark days I might see tens of thousands of entries getting updated in about 30 minutes. With that kind of situation, what kind of value should I keep for olcSpSessionLog (syncprov-sessionlog)? If, for example, I had one side of the mirror down during this update process, would I lose any replication or performance if the sessionlog overflowed (olcSpSessionLog = 10000, and 25k changes are made)? I'm assuming the recovering node would simply fall back to a "present phase" synchronization and syncing'll just take a bit longer, and even then that will only happen if > 10k entries are *deleted* as opposed to modified. Am I understanding the process correctly?

2 2

RE: openldap to AD proxy
by Alex Samad - Yieldbroker 09 May '12

09 May '12

Still haven't been able to get this working. And can't find any way to turn on any debugging for ldap backend. If anyone has done this if they could provide some feed back. A -----Original Message----- From: Alex Samad - Yieldbroker Sent: Friday, 4 May 2012 2:32 PM To: 'openldap-technical(a)openldap.org' Subject: openldap to AD proxy Hi I am still struggling with the my openldap to AD proxy connection. I have successfully connected such that I can do search when I bind to openldap with an AD dn, but I want to be able to do anon search and I want anon to map through to a dn I have created in AD which has read only rights. dn: olcDatabase={3}ldap,cn=config objectClass: olcDatabaseConfig objectClass: olcLDAPConfig olcDatabase: {3}ldap olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * read olcReadOnly: TRUE olcRootDN: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth olcSizeLimit: 500 olcSuffix: dc=xyz,dc=com olcDburi: "ldap://ldap. xyz.com " olcDbRebindAsUser: TRUE olcDbChaseReferrals: TRUE olcdbaclbind: bindmethod=simple binddn="CN=ad readonly,OU=YB Services,OU= xyz,DC= xyz,DC=com" credentials=":)" starttls=no olcDbIDAssertBind: bindmethod=none binddn="CN=ad readonly,OU=YB Services,OU= xyz,DC= xyz,DC=com" credentials=":)" starttls=no I have a subordinate db at ou=external, DC= xyz,DC=com I can do a ldapsearch -x -D " CN=ad readonly,OU=YB Services,OU= xyz,DC= xyz,DC=com" -b " DC= xyz,DC=com" -w :) what I can't do is ldapsearch -x -b " DC= xyz,DC=com" I am thinking I want to map anon request through to the readonly DN. But still leave it such that when people bind to openldap as themselves they bind to AD as themselves How would I do that ? Thanks Alex

1 0

Re: slapadd hanging initializing mdb backend
by Mark 09 May '12

09 May '12

On Wed, May 2, 2012 at 3:37 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Monday, April 30, 2012 10:37 AM -0500 Mark <mah042(a)gmail.com> wrote: > > When I try to slapadd initial data into an empty mdb backend, the slapadd >> hangs: >> >> $ /tmp/openldap-2.4.31/sbin/**slapadd -w -S 1 -c -F >> /tmp/openldap-2.4.31/etc/**slapd.d -b dc=example,dc=com -l >> /tmp/openldap-2.4.31/etc/**initdb.ldif >> _#################### 100.00% eta none elapsed >> none fast! >> (does not return to a shell prompt. I have to INT it.) >> > > Caused by using -w, ITS#7225, currently fixed in git master. > Did you mean ITS#7255 ?

2 1

Lock table is out of available locks
by Marc Patermann 09 May '12

09 May '12

Hi, while extending an object by adding a lot of maildrop values, slapd refused to MOD with err 80: May 4 15:31:57 rzhs720 slapd[27004]: conn=1007 op=3 MOD dn="ou=infogroup,ou=foo" May 4 15:31:57 rzhs720 slapd[27004]: conn=1007 op=3 MOD attr=objectClass ou cn mail member maildrop May 4 15:31:57 rzhs720 slapd[27004]: slap_queue_csn: queing 0x7fd30c0c20f0 20120504133157.956217Z#000000#000#000000 May 4 15:31:57 rzhs720 slapd[27004]: bdb(ou=foo): Lock table is out of available locks May 4 15:31:57 rzhs720 slapd[27004]: => bdb_idl_insert_key: c_put id failed: Cannot allocate memory (12) May 4 15:31:57 rzhs720 slapd[27004]: conn=1007 op=3: attribute "maildrop" index add failure Adding the object with less maildrop entries is not a problem. # db_stat -c -h /var/lib/ldap/main-data/ 1834 Last allocated locker ID 0x7fffffff Current maximum unused locker ID 9 Number of lock modes 1000 Maximum number of locks possible 1000 Maximum number of lockers possible 1000 Maximum number of lock objects possible 7 Number of current locks 1000 Maximum number of locks at any one time 131 Number of current lockers 196 Maximum number of lockers at any one time 8 Number of current lock objects 611 Maximum number of lock objects at any one time 447M Total number of locks requested (447627426) 447M Total number of locks released (447627285) 0 Total number of locks upgraded 550 Total number of locks downgraded 17M Lock requests not available due to conflicts, for which we waited (17614104) 0 Lock requests not available due to conflicts, for which we did not wait 0 Number of deadlocks 0 Lock timeout value 0 Number of locks that have timed out 0 Transaction timeout value 0 Number of transactions that have timed out 544KB The size of the lock region 70M The number of region locks that required waiting (9%) -rw------- 1 ldap ldap 14M May 4 16:16 mail.bdb -rw------- 1 ldap ldap 9.0M May 4 16:16 maildrop.bdb # db_stat -m 2GB Total cache size 1 Number of caches 2GB Pool individual cache size 0 Maximum memory-mapped file size 0 Maximum open file descriptors 0 Maximum sequential buffer writes 0 Sleep after writing maximum sequential buffers 0 Requested pages mapped into the process' address space 511M Requested pages found in the cache (99%) 40787 Requested pages not found in the cache 14 Pages created in the cache 40787 Pages read into the cache 20862 Pages written from the cache to the backing file 0 Clean pages forced from the cache 0 Dirty pages forced from the cache 0 Dirty pages written by trickle-sync thread 40801 Current total page count 40801 Current clean page count 0 Current dirty page count 262147 Number of hash buckets used for page location 510M Total number of times hash chains searched for a page (510897500) 2 The longest hash chain searched for a page 564M Total number of hash chain entries checked for page (564617346) 1375049 The number of hash bucket locks that required waiting (0%) 364335 The maximum number of times any hash bucket lock was waited for (0%) 7486 The number of region locks that required waiting (12%) 0 The number of buffers frozen 0 The number of buffers thawed 0 The number of frozen buffers freed 49931 The number of page allocations 0 The number of hash buckets examined during allocations 0 The maximum number of hash buckets examined for an allocation 0 The number of pages examined during allocations 0 The max number of pages examined for an allocation 18790 Threads waited on page I/O Pool File: ou.bdb 4096 Page size 0 Requested pages mapped into the process' address space 8568 Requested pages found in the cache (99%) 30 Requested pages not found in the cache 0 Pages created in the cache 30 Pages read into the cache 579 Pages written from the cache to the backing file Pool File: givenName.bdb 4096 Page size 0 Requested pages mapped into the process' address space 9744 Requested pages found in the cache (92%) 811 Requested pages not found in the cache 0 Pages created in the cache 811 Pages read into the cache 508 Pages written from the cache to the backing file Pool File: mail.bdb 4096 Page size 0 Requested pages mapped into the process' address space 82597 Requested pages found in the cache (96%) 2802 Requested pages not found in the cache 1 Pages created in the cache 2802 Pages read into the cache 3687 Pages written from the cache to the backing file Pool File: uidNumber.bdb 4096 Page size 0 Requested pages mapped into the process' address space 911 Requested pages found in the cache (93%) 63 Requested pages not found in the cache 0 Pages created in the cache 63 Pages read into the cache 134 Pages written from the cache to the backing file Pool File: relativeDomainName.bdb 4096 Page size 0 Requested pages mapped into the process' address space 31932 Requested pages found in the cache (98%) 605 Requested pages not found in the cache 0 Pages created in the cache 605 Pages read into the cache 1890 Pages written from the cache to the backing file Pool File: cn.bdb 4096 Page size 0 Requested pages mapped into the process' address space 51546 Requested pages found in the cache (95%) 2683 Requested pages not found in the cache 2 Pages created in the cache 2683 Pages read into the cache 3198 Pages written from the cache to the backing file Pool File: maildrop.bdb 4096 Page size 0 Requested pages mapped into the process' address space 3908380 Requested pages found in the cache (99%) 2291 Requested pages not found in the cache 0 Pages created in the cache 2291 Pages read into the cache 3938 Pages written from the cache to the backing file Pool File: gidNumber.bdb 4096 Page size 0 Requested pages mapped into the process' address space 1097 Requested pages found in the cache (92%) 89 Requested pages not found in the cache 0 Pages created in the cache 89 Pages read into the cache 172 Pages written from the cache to the backing file Pool File: version.bdb 4096 Page size 0 Requested pages mapped into the process' address space 1744 Requested pages found in the cache (97%) 41 Requested pages not found in the cache 0 Pages created in the cache 41 Pages read into the cache 76 Pages written from the cache to the backing file Pool File: zoneName.bdb 4096 Page size 0 Requested pages mapped into the process' address space 3370 Requested pages found in the cache (99%) 30 Requested pages not found in the cache 0 Pages created in the cache 30 Pages read into the cache 131 Pages written from the cache to the backing file Pool File: entryCSN.bdb 4096 Page size 0 Requested pages mapped into the process' address space 83520 Requested pages found in the cache (99%) 306 Requested pages not found in the cache 0 Pages created in the cache 306 Pages read into the cache 1015 Pages written from the cache to the backing file Pool File: sn.bdb 4096 Page size 0 Requested pages mapped into the process' address space 10019 Requested pages found in the cache (92%) 765 Requested pages not found in the cache 0 Pages created in the cache 765 Pages read into the cache 643 Pages written from the cache to the backing file Pool File: objectClass.bdb 4096 Page size 0 Requested pages mapped into the process' address space 115341 Requested pages found in the cache (99%) 321 Requested pages not found in the cache 0 Pages created in the cache 321 Pages read into the cache 826 Pages written from the cache to the backing file Pool File: uid.bdb 4096 Page size 0 Requested pages mapped into the process' address space 2273 Requested pages found in the cache (91%) 216 Requested pages not found in the cache 0 Pages created in the cache 216 Pages read into the cache 171 Pages written from the cache to the backing file Pool File: id2entry.bdb 16384 Page size 0 Requested pages mapped into the process' address space 499M Requested pages found in the cache (99%) 17796 Requested pages not found in the cache 11 Pages created in the cache 17796 Pages read into the cache 1463 Pages written from the cache to the backing file Pool File: entryUUID.bdb 4096 Page size 0 Requested pages mapped into the process' address space 2183 Requested pages found in the cache (87%) 317 Requested pages not found in the cache 0 Pages created in the cache 317 Pages read into the cache 415 Pages written from the cache to the backing file Pool File: dn2id.bdb 4096 Page size 0 Requested pages mapped into the process' address space 7462379 Requested pages found in the cache (99%) 11621 Requested pages not found in the cache 0 Pages created in the cache 11621 Pages read into the cache 2016 Pages written from the cache to the backing file # ps -eLf | grep slapd | wc -l 19 Can anyone tell me what happens here and what to do about it? Marc

2 5

RE: pwdPolicySubentry & replication user
by Michael Starling 08 May '12

08 May '12

I also have no issues if I run syncrepl with a provider and consumer. Only mirror mode. Perhaps I'll try downgrading openLDAP. Thanks. Mike Date: Tue, 8 May 2012 16:54:25 -0400 From: brooksct(a)hbcs.org To: mlstarling31(a)hotmail.com CC: openldap-technical(a)openldap.org Subject: RE: pwdPolicySubentry & replication user I run that version without issues, but my infrastructure is still using good old reliable low-bandwidth slurpd, which is no longer supported. I don’t think syncrepl is sufficiently reliable yet, although others disagree. --Charlie From: Michael Starling [mailto:mlstarling31@hotmail.com] Sent: 2012 May 08 4:20 PM To: quanah(a)zimbra.com Cc: openldap Subject: RE: pwdPolicySubentry & replication user Re: Take the issue to Redhat Easier said than done. The policy is what it is but I didn't think it would do any harm to see if anyone has run into this issue. > Date: Tue, 8 May 2012 12:22:58 -0700 > From: quanah(a)zimbra.com > To: mlstarling31(a)hotmail.com > CC: openldap-technical(a)openldap.org > Subject: RE: pwdPolicySubentry & replication user > > --On Tuesday, May 08, 2012 3:07 PM -0400 Michael Starling > <mlstarling31(a)hotmail.com> wrote: > > > > > Unfortunately I have no choice as this is the latest available in the > > RHEL tree and my company won't allow us to deviate and compile. > > Then you will need to take issues to RedHat since your company has an > utterly broken policy. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration ------------------ CONFIDENTIALITY NOTICE --------------- This message, including any attachments, is for the sole use of the intended recipient(s) and may contain privileged confidential information protected by law. Any unauthorized review, use, disclosure or distribution of this message is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of this message. ------------------ CONFIDENTIALITY NOTICE ---------------

1 1

Questions about getting membership of a user
by ctosgh 08 May '12

08 May '12

Hi,All With openldap 2.4.x which supports memberOf overlay. I can get group info with only one search with following configs. <1> [root@/jacky/var]$cat user.ldif dn: cn=jacky,ou=users,dc=jacky,dc=com objectClass: organizationalPerson cn: jacky sn: sun userPassword: 11111111 [root@/jacky/var]$cat JackyGroup.ldif dn: cn=JackyGroup,ou=groups,dc=jacky,dc=com objectClass: groupOfNames cn: JackyGroup member: cn=jacky,ou=users,dc=jacky,dc=com <2> memberOf overlay is configured correctly <3> [root@/jacky/var]$ldapsearch -x -D "cn=root,dc=jacky,dc=com" -b "dc=jacky,dc=com" -H "ldap://x.x.x.x:389" -w xxx -s sub "(cn=jacky)" memberOf # extended LDIF # # LDAPv3 # base <dc=jacky,dc=com> with scope subtree # filter: (cn=jacky) # requesting: memberOf # # jacky, users, jacky.com dn: cn=jacky,ou=users,dc=jacky,dc=com memberOf: cn=JackyGroup,ou=groups,dc=jacky,dc=com [This is what I want] # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 My questions are here: A1: With openldap 2.4.x, if posixAccount is used to manage users, then attribute 'gidNumber' which is a number will represent user's membership. With this case, is it possible that I can get group info(DN format as above) of a user entry by ONLY one search? A2: With older openldap whihc does NOT support memberOf overlay: <1> If organizationalPerson is used to manage users, is it possible that I can get group info(DN format) of a user entry by ONLY one search? <2> If posixAccount is used to manage users, is it possible that I can get group info(DN format) of a user entry by ONLY one search?Any reply is appreciated~TIA Thanks, Jacky

1 1

pwdPolicySubentry & replication user
by Michael Starling 08 May '12

08 May '12

Consider the following password policy entry to disable password expiration. dn: cn=noexpire,ou=policies,dc=umlott,dc=lott cn: noexpire objectClass: pwdPolicy objectClass: person objectClass: top sn: Password Policy pwdAttribute: UserPassword pwdMaxAge: 0 pwdLockout: FALSE description: Non-Expiring password policy for service accounts. =============================================== The following LDIF attaches this policy to the 3 users below: dn: cn=ldapmgr,ou=Service,dc=umlott,dc=lott changetype: modify add: pwdPolicySubentry pwdPolicySubentry: cn=noexpire,ou=policies,dc=umlott,dc=lott dn: cn=bind,ou=Service,dc=umlott,dc=lott changetype: modify add: pwdPolicySubentry pwdPolicySubentry: cn=noexpire,ou=policies,dc=umlott,dc=lott dn: cn=replicator,ou=Service,dc=umlott,dc=lott changetype: modify add: pwdPolicySubentry pwdPolicySubentry: cn=noexpire,ou=policies,dc=umlott,dc=lott This all works well and good when setting up my first LDAP server, however when I setup another LDAP server in mirror mode to the first server the pwdPolicySubentry attribute doesn't carry over to the the second node and I start to see this in the slapd logs: ppolicy_bind: Setting warning for password expiry for cn=replicator,ou=service,dc=umlott,dc=lott = 0 seconds What's interesting is that the other two accounts that have the noexpire policy attached carry over the pwdPolicySubentry attribute just fine to the second node. Any insight would be greatly appreciated. Mike

3 6

acl filter problem
by Dorit 08 May '12

08 May '12

2 4

Memory consumption when increasing BDB_IDL_LOGN
by Meike Stone 07 May '12

07 May '12

Hello, how does the memory usage increase if I increase the BDB_IDL_LOGN? I tried to discover and understand this by searching in the mailing list (Is there is a good guide to understand all of this?). After a search, each returned up ID from bdb is located in one slot in the IDL list. On a x86_64 system, each slot is 8Byte. Each search stack in each thread (threads in slapd.conf) gets his own IDL slots. The default value for the threads are 16. With 16 bit BDB_IDL_LOGN (default) on x86_64 with default threads, we need 64k*8*16 = 1024KB memory? If I increase the BDB_IDL_LOGN to 20 we need 512k*8*16 = 8MB? 1) Are my assumptions above correct? 2) How do I increase LDAP_PVT_THREAD_STACK_SIZE? In my tests I used "4 * 1024 * 1024 * sizeof(void *)" and all tests where running well. 3) Are there other variables to increase before compiling? 4) Here we talk about 8MB memory, did I miss something, that is not the problem today or are there other things I did not catch (other caches in memory e.g. cachesize, dncachesize, idlcachesize or shared memory ...)? 5) What is the amount overall I have to expect for memory consumption? I understand, that after adding and deleting entires, the IDs "sparse out" for one index and we loose precision (if we have after search more IDs than BDB_IDL_LOGN), because using ranges. This Problem will increase as older the database becomes. But if I increase the BDB_IDL_LOGN to my needed size (max expected returned IDs from during search a indexed attibute), the problem with "getting older" is not important for me? Thanks a lot, Meike

2 2

Cached user info?
by Braden McDaniel 07 May '12

07 May '12

I found it necessary to change the GID of a POSIX group defined in LDAP. But when I log in with a user that is a member of this group, I find that the user's group membership still reflects the old GID. At this point, I've tried removing the user from the group, and adding it back--it still comes up with the old GID when logged in (or, specifically, typing "groups" at the command prompt lists a group associated with the old GID), even though I can't see *anything* referencing the old GID in the LDAP database. I am stumped. Anyone have ideas about what might be going on here? -- Braden McDaniel <braden(a)endoframe.com>

4 8

HowTo index generalizedTimeOrderingMatch
by Meike Stone 07 May '12

07 May '12

Hello, I have in my own schema an attribute defined: attributetype (1.3.6.1.4.... NAME ('InsertTime') EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 ) Now I can use this and search, but it takes very long. So I want index it for searching: * greater (">=") * less ("<=") Is it possible and how can I do this? I have only seen "eq" and "pres". Thanks in advance Meike

3 3

open ldap gruop syncing
by dhanushka ranasinghe 06 May '12

06 May '12

hi guys ,,, i have a master LDAP server and its has a group called . cn=internal ou=group,dc=example,dc=com --users of this group is : uid=user1,ou=staff,dc=example,dc=com uid=user2,ou=staff,dc=example,dc=com and i want to sync this users to slave ldap server. under OU=staff , in my slave config file i used the following configuration , syncrepl rid=004 provider=ldap://masterldapserver bindmethod=simple binddn="cn=admin,dc=example,dc=com" credentials="passWord" searchbase="cn=internal,ou=group,dc=example,dc=com" schemachecking=off type=refreshAndPersist retry="60 +" sync seems to be working fine but users appers as [1] but not under OU=staff, [1] dn: cn=internal,ou=group,dc=example,dc=com objectClass: groupOfNames objectClass: top cn: internal member: uid=user1,ou=user,dc=example,dc=com member: uid=user1,ou=user,dc=example,dc=com is there any way sort out this issue Thank You Dhanushka

1 0

Can't login with ldap user
by zingalo 04 May '12

04 May '12

Hi, trying to login from my laptop ubuntu 11.10 using ldap user zingalo, appears a black screen and it comes back to login screen. Could you take a look of this paste of syslog please and tell me what do i have to fix? http://pastebin.com/k0dQq6NN Are many lines! Thanks

2 4

openldap to AD proxy
by Alex Samad - Yieldbroker 03 May '12

03 May '12

Hi I am still struggling with the my openldap to AD proxy connection. I have successfully connected such that I can do search when I bind to openldap with an AD dn, but I want to be able to do anon search and I want anon to map through to a dn I have created in AD which has read only rights. dn: olcDatabase={3}ldap,cn=config objectClass: olcDatabaseConfig objectClass: olcLDAPConfig olcDatabase: {3}ldap olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * read olcReadOnly: TRUE olcRootDN: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth olcSizeLimit: 500 olcSuffix: dc=xyz,dc=com olcDburi: "ldap://ldap. xyz.com " olcDbRebindAsUser: TRUE olcDbChaseReferrals: TRUE olcdbaclbind: bindmethod=simple binddn="CN=ad readonly,OU=YB Services,OU= xyz,DC= xyz,DC=com" credentials=":)" starttls=no olcDbIDAssertBind: bindmethod=none binddn="CN=ad readonly,OU=YB Services,OU= xyz,DC= xyz,DC=com" credentials=":)" starttls=no I have a subordinate db at ou=external, DC= xyz,DC=com I can do a ldapsearch -x -D " CN=ad readonly,OU=YB Services,OU= xyz,DC= xyz,DC=com" -b " DC= xyz,DC=com" -w :) what I can't do is ldapsearch -x -b " DC= xyz,DC=com" I am thinking I want to map anon request through to the readonly DN. But still leave it such that when people bind to openldap as themselves they bind to AD as themselves How would I do that ? Thanks Alex

1 0

SMB+OPENLDAP
by Alejandro Iacobelli 03 May '12

03 May '12

Hello to all, my name is Alejandro and I have a little question to anyone of this list. I´ve created ,6 years ago, an ldap+smb proyect for a big company. Back then, samba (Lenny server) only worked with NT hashes but now (Squeeze server) they want to authenticate with Win7 (ntlm2 protocols) And configurating windows7 to accept old NT hashes is not an exit. I want to update ONLY the smb package from samba (2:3.2.5-4lenny15) to samba (2:3.5.6~dfsg-3squeeze8). My question is this: Can you give me some information about if openldap could crash if only I update the samba module and not the ldap one? i need to know if something could go wrong in the relation with openldap. ( I will not touch openldap because i've modified that version by myself ).

2 1

Re: Slapd Error
by Andy Carlson 03 May '12

03 May '12

Michael, Thanks for your help. We found that it was the audit log that was slightly over 2GB, so I cleaned that up and it is good now. Andy Carlson Moody Bible Institute Identity Administrator | Information Systems 312-329-4385 www.moody.edu Michael Ströder <michael(a)stroeder.com> wrote: Andy Carlson wrote: > Here are the files [..] And what does ulimit -a say? Ciao, Michael.

1 0

Slapd Error
by Andy Carlson 02 May '12

02 May '12

I am running OpenLDAP 2.4.11 and I am getting an error when I attempt to modify, delete, or add to the directory with a credentialed user (has worked for the past few years perfectly). I did a debug-level report on the server and it's giving me with respect to my modify request, I am getting the following results: bdb_modify: updated id=00013892 dn="mbiUniqueID=669103f11bb82ef68f6adbcf75216c1b,ou=people, dc=XXXXXX,dc=XXX " send_ldap_result: conn=1057 op=1 p=3 send_ldap_result: err=0 matched="" text="" => bdb_entry_get: ndn: "mbiUniqueID=669103f11bb82ef68f6adbcf75216c1b,ou=people, dc=XXXXXX,dc=XXX " => bdb_entry_get: oc: "(null)", at: "(null)" bdb_dn2entry("mbiUniqueID=669103f11bb82ef68f6adbcf75216c1b,ou=people, dc=XXXXXX,dc=XXX ") => bdb_entry_get: found entry: "mbiUniqueID=669103f11bb82ef68f6adbcf75216c1b,ou=people, dc=XXXXXX,dc=XXX " bdb_entry_get: rc=0 => test_filter PRESENT => access_allowed: search access to "mbiUniqueID=669103f11bb82ef68f6adbcf75216c1b,ou=people, dc=XXXXXX,dc=XXX " "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) <= test_filter 6 syncprov_matchops: sid 000 fscope 1 rc 6 ./slapd-PRODM1: line 227: 26203 File size limit exceeded$SLAPD_BIN -h "$SLAPD_SERVICES" $SLAPD_PARAMS slapd-PRODM1[26473]: [ALERT] slapd not running Also, the service script in /etc/init.d is named slapd-PRODM1. The line number given in the second to last line of the error corresponds to the line where the start_slapd function (to start the service) is declared. The function is as follows: start_slapd() { # Check if db_recover is required if [ $RECOVER_AT_STARTUP -eq 1 ] then db_recover else message "info" "[INFO] no db_recover done" fi # Start message message "info" "Launching OpenLDAP..." # File descriptor limit, only for root if [ `id -u` -eq 0 ] then ulimit -n $FD_LIMIT if [ $? -eq 0 ] then message "info" "[OK] file descriptor limit set to $FD_LIMIT" else message "warning" "[WARNING] Fail to set file descriptor limit to $FD_LIMIT, going to next step" fi else message "info" "[INFO] file descriptor limit not modified (require root privileges)" fi # Parameters # if [ "$SLAPD_CONF" ] # then # SLAPD_PARAMS="$SLAPD_PARAMS -f $SLAPD_CONF" # fi # if [ "$SLAPDD_DIR" ] # then # SLAPD_PARAMS="$SLAPD_PARAMS -F $SLAPDD_DIR" # fi SLAPD_PARAMS="$SLAPD_PARAMS $SLAPD_CONF_LOAD" if [ "$SLAPD_USER" -a `id -u` -eq 0 ] then SLAPD_PARAMS="$SLAPD_PARAMS -u $SLAPD_USER" fi if [ "$SLAPD_GROUP" -a `id -u` -eq 0 ] then SLAPD_PARAMS="$SLAPD_PARAMS -g $SLAPD_GROUP" fi # It's time to start slapd $SLAPD_BIN -h "$SLAPD_SERVICES" $SLAPD_PARAMS sleep 1 # Presence of PID file if [ ! -r $SLAPD_PID_FILE ] then message "alert" "[ALERT] no PID file for slapd" exit 1 fi # Is slapd launched? PID=`cat $SLAPD_PID_FILE` if [ ! -e /proc/$PID ] then message "alert" "[ALERT] slapd not running" exit 1 else message "info" "[OK] OpenLDAP started on port $PORT" fi } It should be noted that this machine has been working without problems for the past year or more, so I can only assume that the "File Size Limit Exceeded" error above relates to one of the Berkley DB files. Is this correct? Let me know if you have any thoughts. Thanks much!!!, Andy Carlson Moody Bible Institute Identity Administrator | Information Systems 312-329-4385 www.moody.edu<http://www.moody.edu>

3 4

slapadd hanging initializing mdb backend
by Mark 02 May '12

02 May '12

When I try to slapadd initial data into an empty mdb backend, the slapadd hangs: $ /tmp/openldap-2.4.31/sbin/slapadd -w -S 1 -c -F /tmp/openldap-2.4.31/etc/slapd.d -b dc=example,dc=com -l /tmp/openldap-2.4.31/etc/initdb.ldif _#################### 100.00% eta none elapsed none fast! (does not return to a shell prompt. I have to INT it.) I add '-d -1' to get some debugging output and I get this after removing the data.mdb and lock.mdb created above: $ /tmp/openldap-2.4.31/sbin/slapadd -d -1 -w -S 1 -c -F /tmp/openldap-2.4.31/etc/slapd.d -b dc=example,dc=com -l /tmp/openldap-2.4.31/etc/initdb.ldif (lines removed for brevity but can be submitted if need be) 4f9ea9c0 => str2entry: "dn: ou=Users,dc=example,dc=com objectClass: organizationalUnit ou: Users " 4f9ea9c0 >>> dnPrettyNormal: <ou=Users,dc=example,dc=com> 4f9ea9c0 <<< dnPrettyNormal: <ou=Users,dc=example,dc=com>, <ou=users,dc=example,dc=com> 4f9ea9c0 <= str2entry(ou=Users,dc=example,dc=com) -> 0x6afeba8 4f9ea9c0 oc_check_required entry (ou=Users,dc=example,dc=com), objectClass "organizationalUnit" 4f9ea9c0 oc_check_allowed type "objectClass" 4f9ea9c0 oc_check_allowed type "ou" 4f9ea9c0 oc_check_allowed type "structuralObjectClass" 4f9ea9c0 => mdb_tool_entry_put( -1, "ou=Users,dc=example,dc=com" ) 4f9ea9c0 => mdb_dn2id("ou=users,dc=example,dc=com") 4f9ea9c0 <= mdb_dn2id: get failed: MDB_NOTFOUND: No matching key/data pair found (-30798) 4f9ea9c0 => mdb_dn2id_add 0x6: "ou=users,dc=example,dc=com" 4f9ea9c0 <= mdb_dn2id_add 0x6: 0 4f9ea9c0 => index_entry_add( 6, "ou=Users,dc=example,dc=com" ) 4f9ea9c0 mdb_idl_insert_keys: 6 [9bee355f] 4f9ea9c0 mdb_idl_insert_keys: 6 [ef1184ca] 4f9ea9c0 mdb_idl_insert_keys: 6 4f9ea9c0 <= index_entry_add( 6, "ou=Users,dc=example,dc=com" ) success 4f9ea9c0 => mdb_entry_encode(0x00000006): ou=Users,dc=example,dc=com 4f9ea9c0 <= mdb_entry_encode(0x00000006): ou=Users,dc=example,dc=com 4f9ea9c0 => mdb_dn2id("dc=example,dc=com") 4f9ea9c0 <= mdb_dn2id: got id=0x1 4f9ea9c0 => mdb_entry_decode: 4f9ea9c0 <= mdb_entry_decode 4f9ea9c0 => mdb_tool_entry_modify( 1, "(null)" ) (it's hung) Here is the /tmp/openldap-2.4.31/etc/initdb.ldif: ### BEGIN INITDB.LDIF dn: dc=example,dc=com objectClass: organization objectClass: dcObject dc: example o: example.com dn: cn=manager,dc=example,dc=com objectClass: organizationalRole objectClass: simpleSecurityObject cn: manager userPassword: {SSHA}asif dn: cn=replicator,dc=example,dc=com objectClass: organizationalRole objectClass: simpleSecurityObject cn: replicator userPassword: {SSHA}asif dn: ou=Groups,dc=example,dc=com objectClass: organizationalUnit ou: Groups dn: cn=LDAP Admins,ou=Groups,dc=example,dc=com objectClass: top objectClass: groupOfUniqueNames cn: LDAP Admins uniqueMember: cn=manager,dc=example,dc=com dn: ou=Users,dc=example,dc=com objectClass: organizationalUnit ou: Users ### END INITDB.LDIF I used the following slaptest commands to create the initial slapd.d/ directory from a slapd.conf file: $ /tmp/openldap-2.4.31/sbin/slaptest -u -f /tmp/openldap-2.4.31/etc/slapd.conf -F /tmp/openldap-2.4.31/etc/slapd.d config file testing succeeded $ /tmp/openldap-2.4.31/sbin/slaptest -f /tmp/openldap-2.4.31/etc/slapd.conf -F /tmp/openldap-2.4.31/etc/slapd.d 4f9eab15 mdb_db_open: database "dc=example,dc=com" cannot be opened, err 2. Restore from backup! 4f9eab15 backend_startup_one (type=mdb, suffix="dc=example,dc=com"): bi_db_open failed! (2) slap_startup failed (test would succeed using the -u switch) Here is the /tmp/openldap-2.4.31/etc/slapd.conf: ### BEGIN SLAPD.CONF include /tmp/openldap-2.4.31/etc/schema/core.schema include /tmp/openldap-2.4.31/etc/schema/cosine.schema include /tmp/openldap-2.4.31/etc/schema/nis.schema include /tmp/openldap-2.4.31/etc/schema/inetorgperson.schema argsfile /tmp/openldap-2.4.31/var/run/slapd.args pidfile /tmp/openldap-2.4.31/var/run/slapd.pid threads 8 tool-threads 2 idletimeout 0 writetimeout 0 reverse-lookup off loglevel stats serverid 1 ldap://boardwalk:2389 modulepath /tmp/openldap-2.4.31/libexec moduleload back_monitor.la moduleload back_mdb.la moduleload syncprov.la password-hash {SSHA} sizelimit unlimited database config rootdn "cn=manager,dc=example,dc=com" access to * by group="cn=LDAP Admins,ou=Groups,dc=example,dc=com" write by users read by * none database monitor rootdn "cn=manager,dc=example,dc=com" access to * by users read by * none database mdb suffix "dc=example,dc=com" rootdn "cn=manager,dc=example,dc=com" directory /tmp/openldap-2.4.31/var/data index objectClass eq index entryCSN eq index entryUUID eq syncrepl rid=001 provider=ldap://boardwalk:2389 type=refreshAndPersist retry="15 +" bindmethod=simple binddn="cn=replicator,dc=example,dc=com" credentials="asif" searchbase="dc=example,dc=com" starttls=no schemachecking=off syncrepl rid=002 provider=ldap://chance:2389 type=refreshAndPersist retry="15 +" bindmethod=simple binddn="cn=replicator,dc=example,dc=com" credentials="asif" searchbase="dc=example,dc=com" starttls=no schemachecking=off syncrepl rid=003 provider=ldap://freeparking:2389 type=refreshAndPersist retry="15 +" bindmethod=simple binddn="cn=replicator,dc=example,dc=com" credentials="asif" searchbase="dc=example,dc=com" starttls=no schemachecking=off mirrormode TRUE overlay syncprov syncprov-checkpoint 50 10 syncprov-sessionlog 100 access to attrs=userPassword by anonymous auth by self write by dn.exact="cn=replicator,dc=example,dc=com" read by * none access to * by group="cn=LDAP Admins,ou=Groups,dc=example,dc=com" write by dn.exact="cn=replicator,dc=example,dc=com" read by users read by * none limits dn.exact="cn=replicator,dc=example,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited ### END SLAPD.CONF I compiled from the following source: OpenLDAP 2.4.31 OpenSSL 1.0.1b Cyrus-SASL 2.1.25 I am running in the following environment: Dell Poweredge 2950; dual-core Intel(R) Xeon(R) CPU 5110 @ 1.60GHz; 8GB RAM Scientific Linux 5.7 Am I doing something wrong (besides the ACLs for cn=LDAP Admins,ou=Groups,dc=example,dc=com. I'm still struggling there) ? Thank you, Mark

2 1

DEL don't get synced
by Marc Patermann 02 May '12

02 May '12

Hi, under some circumstances DEL don't get replicated to the consumers (SyncRepl). I think this has to do with other changes at the some moment. I attached two logs excepts in sync.log. In the first except there is only a DEL Jan 31 09:16:01 ldapserver slapd[10641]: conn=79138 op=2 DEL dn="employeeNumber=19676,ou=humans,ou=foo" For this there is a Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 line for every connected consumer. In the second step there is a MOD and a DEL Jan 31 10:31:01 ldapserver slapd[10641]: conn=79938 op=2 MOD dn="ou=FA-WF,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=79938 op=3 DEL dn="employeeNumber=24387,ou=humans,ou=foo" As far as I can see, there is only sync activity for the MOD action, and not for the DEL action. The DEL is not synced. Marc

11 44

Monitor : HOW TO ?
by Olivier 02 May '12

02 May '12

I have worked on looked for help to configure and use slapd monitor abilities under redhat 6 with no success. Here is my monitor section : cat /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{2\}monitor.ldif dn: olcDatabase={2}monitor,cn=config objectclass: olcDatabaseConfig olcaccess: {0}to * by dn.exact=”cn=Manager,dc=exemple,dc=fr” by * none olcaddcontentacl: FALSE olcdatabase: {2}monitor olclastmod: TRUE olcmaxderefdepth: 15 olcmonitoring: FALSE olcreadonly: FALSE olcsyncusesubentry: FALSE …. slapd runs and respond : # ldapsearch -x -D ‘cn=Manager,dc=exemple,dc=fr’ -W -b ‘olcDatabase={2}monitor,cn=config’ -s base 1.1 # {2}monitor, config dn: olcDatabase={2}monitor,cn=config # search result search: 2 result: 0 Success However I can’t get any monitoring information : $ ldapsearch -x -D ‘cn=Manager,dc=exemple,dc=fr’ -W -b ‘cn=Monitor’ -s base 1.1 # search result search: 2 result: 32 No such object Would you have any advice to use openldap monitoring abilities ? # cat /etc/issue Red Hat Enterprise Linux Server release 6.2 (Santiago) # rpm -qa | grep openldap-servers openldap-servers-2.4.23-20.el6.x86_64 # slapd -VVV @(#) $OpenLDAP: slapd 2.4.23 (Oct 4 2011 07:43:22) $ mockbuild@x86-010.build.bos.redhat.com:/builddir/build/BUILD/openldap-2.4.23/openldap-2.4.23/build-servers/servers/slapd Thanks for any help one could provide ! --- Olivier

2 1

Tightening up ppolicy
by Kline, Sara 01 May '12

01 May '12

We are using ppolicy to manage the password policy on our LDAP server. It at least checks the minimum length and the minimum amount of time needed before a person can change their password again, but is there a way to get it to check for upper case, lower case, numbers, etc? We need to force our users to make complex passwords. Sara Kline System Administrator Transaction Network Services, Inc 4501 Intelco Loop, Lacey WA 98503 Wk: (360) 493-6736 Cell: (360) 280-2495 ________________________________ This e-mail message is for the sole use of the intended recipient(s)and may contain confidential and privileged information of Transaction Network Services. Any unauthorised review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

4 7

cannot populate with smbldap-populate
by stefano malini 30 Apr '12

30 Apr '12

Hi, i cannot end the populating process using smbldap-populate due to this errors: root@amahoro:~# smbldap-populate Populating LDAP directory for domain AMAHORO (S-1-5-21-251852451-2940789264-3475694606) (using builtin directory structure) entry dc=amahoro,dc=bi already exist. entry ou=Users,dc=amahoro,dc=bi already exist. entry ou=Groups,dc=amahoro,dc=bi already exist. entry ou=Computers,dc=amahoro,dc=bi already exist. entry ou=Idmap,dc=amahoro,dc=bi already exist. adding new entry: uid=root,ou=Users,dc=amahoro,dc=bi failed to add entry: index generation failed at /usr/sbin/smbldap-populate line 498, <GEN1> line 58. adding new entry: uid=nobody,ou=Users,dc=amahoro,dc=bi failed to add entry: index generation failed at /usr/sbin/smbldap-populate line 498, <GEN1> line 89. adding new entry: cn=Domain Admins,ou=Groups,dc=amahoro,dc=bi failed to add entry: index generation failed at /usr/sbin/smbldap-populate line 498, <GEN1> line 101. adding new entry: cn=Domain Users,ou=Groups,dc=amahoro,dc=bi failed to add entry: index generation failed at /usr/sbin/smbldap-populate line 498, <GEN1> line 112. adding new entry: cn=Domain Guests,ou=Groups,dc=amahoro,dc=bi failed to add entry: index generation failed at /usr/sbin/smbldap-populate line 498, <GEN1> line 123. adding new entry: cn=Domain Computers,ou=Groups,dc=amahoro,dc=bi failed to add entry: index generation failed at /usr/sbin/smbldap-populate line 498, <GEN1> line 134. adding new entry: cn=Administrators,ou=Groups,dc=amahoro,dc=bi failed to add entry: index generation failed at /usr/sbin/smbldap-populate line 498, <GEN1> line 179. adding new entry: cn=Account Operators,ou=Groups,dc=amahoro,dc=bi failed to add entry: index generation failed at /usr/sbin/smbldap-populate line 498, <GEN1> line 201. adding new entry: cn=Print Operators,ou=Groups,dc=amahoro,dc=bi failed to add entry: index generation failed at /usr/sbin/smbldap-populate line 498, <GEN1> line 212. adding new entry: cn=Backup Operators,ou=Groups,dc=amahoro,dc=bi failed to add entry: index generation failed at /usr/sbin/smbldap-populate line 498, <GEN1> line 223. adding new entry: cn=Replicators,ou=Groups,dc=amahoro,dc=bi failed to add entry: index generation failed at /usr/sbin/smbldap-populate line 498, <GEN1> line 234. entry sambaDomainName=AMAHORO,dc=amahoro,dc=bi already exist. Updating it... Please provide a password for the domain root: /usr/sbin/smbldap-passwd: user root doesn't exist i don't find the error "index generation failed" on internet. Do you know the problem? Thanks

7 21

Problem adding sambaGroupMapping
by stefano malini 27 Apr '12

27 Apr '12

Hi, i show the command-output trying to add the objectClass sambaGroupMapping to some entries that have posixGroup objectClass: root@amahoro:~# ldapmodify -x -W -D 'cn=Manager,dc=amahoro,dc=bi' Enter LDAP Password: dn: cn=Students,ou=Groups,dc=amahoro,dc=bi changetype: modify add: objectClass objectClass: posixGroup objectClass: sambaGroupMapping sambaSID: S-1-5-21-251852451-2940789264-3475694606 sambaGroupType: 5 ldapmodify: wrong attributeType at line 6, entry "cn=Students,ou=Groups,dc=amahoro,dc=bi" I don't know what is wrong, sambaSID is a correct attribute. Do you have ideas? Thanks

2 2

Remove a schema using OpenLDAP dynamic configuration
by Jean-Philippe Braun 27 Apr '12

27 Apr '12

Hi all, I'm trying to add/remove schemas dynamically using the cn=config database (using slapd 2.4.23-7.2 on debian stable). I'm connected to slapd with the SASL/External method as root and I'm able to search but delete breaks: # ldapdelete -Y EXTERNAL -H ldapi:/// "cn={2}nis,cn=schema,cn=config" SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 ldap_delete: Server is unwilling to perform (53) The ACL seems correct to me: # ldapsearch -LLL -Y EXTERNAL -H ldapi:/// -b "cn=config" "olcDatabase={0}config" olcAccess SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 dn: olcDatabase={0}config,cn=config olcAccess: {0}to * by dn.exact=gidNumber=0 +uidNumber=0,cn=peercred,cn=external ,cn=auth manage by * break So is it possible to remove a schema like this ? I should miss something... Thank you

3 4

Re: OpenLDAP 2.4.31 available
by Clément OUDOT 27 Apr '12

27 Apr '12

Le 23 avril 2012 18:49, OpenLDAP Project <project(a)openldap.org> a écrit : > OpenLDAP 2.4.31 is now available for download as detailed on our download page: > > http://www.openldap.org/software/download/ > Hi, for people using RPMs, I published some here: http://ltb-project.org/wiki/download#openldap Clément.

2 1

replicating and refint
by Marc Patermann 26 Apr '12

26 Apr '12

Hi, on a master server overlay syncprov and overlay refint (refint_attributes member memberOf) are set. Now on object, which is in a group is deleted. Refint changes the group by deleting the member. The changed user object and the group are to be replicated. The user is. The group is not: Apr 26 17:31:04 server slapd[6475]: syncrepl_entry: rid=401 ou=group,ou=foo Apr 26 17:31:04 server slapd[6475]: syncrepl_entry: rid=401 entry unchanged, ignored (ou=group,ou=foo) dn: ou=group,ou=foo modifyTimestamp: 20110704123836Z modifiersName: cn=Referential Integrity Overlay entryCSN: 20110704123836.000000Z#000001#000#000000 So this is advertised for replication, but the does not happen. This is 2.4.26, has this changed in later versions? Marc

2 1

ldapsearch: Search for Operational Attributes using wildcards
by Uncle Hildegard 26 Apr '12

26 Apr '12

Hi there, I don't understand what's happening here so hopefully someone can help me with this. I have a DIT that contains objects like this: uid=test,ou=user,ou=sales,o=Testcompany Now I want to find out all objects that have "sales" in their DN. Since DN is not an attribute one can search for I used the the operational attribute "entryDN": ldapsearch -x "(entryDN=*sales*)" cn That search didn't find anything. After that I tried ldapsearch -x "(entryDN=uid=test,ou=user,ou=sales,o=Testcompany)" cn and got the expected result. Now it seems that as soon as I use a wildcard in the filter argument the search returns nothing. Even ldapsearch -x "(entryDN=uid=test,ou=user,ou=sales,o=Testcompan*)" cn returns nothing. I've also tried things like ldapsearch -x "(entryDN:dnSubtreeMatch:=*sales*)" cn which returned no result either. Any ideas what I'm doing wrong? Any help would be greatly appreciated! Cheers -- Markus

3 4

OpenLDAP unresponsible after modify/replication operation
by Arturo Borrero Gonzalez 26 Apr '12

26 Apr '12

Hi there, I have an active-active LDAP cluster with N-way multi-master configuration. The slapd version is: 2.4.23-7.2 (Debian Squeeze) After a modify operation in the cn=config tree, we get and unresponsible server (all nodes in the cluster) This is the log (256 loglevel) for the node who gets the original MOD operation. Note the time cut between 12:23:55 and 12:42:54 The deferring operation message was repeated before that cut, and today It's the first time I see it. [...] Apr 26 12:23:55 ldap2 slapd[19556]: conn=7352 op=0 RESULT tag=97 err=0 text= Apr 26 12:23:55 ldap2 slapd[19556]: conn=7352 op=2 UNBIND Apr 26 12:23:55 ldap2 slapd[19556]: conn=7352 fd=204 closed Apr 26 12:23:55 ldap2 slapd[19556]: conn=1399 op=27 MOD dn="olcDatabase={1}hdb,cn=config" Apr 26 12:23:55 ldap2 slapd[19556]: conn=1399 op=27 MOD attr=olcAccess *** Apr 26 12:42:54 ldap2 slapd[19556]: do_syncrepl: rid=001 rc -5 retrying (4 retries left) Apr 26 12:42:54 ldap2 slapd[19556]: do_syncrepl: rid=006 rc -5 retrying (4 retries left) Apr 26 12:42:54 ldap2 slapd[19556]: do_syncrepl: rid=003 rc -5 retrying (4 retries left) Apr 26 12:42:54 ldap2 slapd[19556]: conn=1399 op=27 RESULT tag=103 err=0 text= Apr 26 12:42:54 ldap2 slapd[19556]: conn=7353 fd=135 ACCEPT from IP=[xxx:xx:xx:xx::xx]:58394 (IP=[::]:636) Apr 26 12:42:54 ldap2 slapd[19556]: conn=7354 fd=136 ACCEPT from IP=xx.xx.x.xx:58617 (IP=0.0.0.0:636) Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=5551 deferring operation: too many executing Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=3876 deferring operation: too many executing Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=3876 deferring operation: too many executing Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=3876 deferring operation: pending operations Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=3876 deferring operation: too many executing Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=3876 deferring operation: pending operations Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=3876 deferring operation: too many executing Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=3876 deferring operation: pending operations Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=3876 deferring operation: too many executing Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=3876 deferring operation: pending operations Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=3876 deferring operation: too many executing Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=3876 deferring operation: pending operations Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=3876 deferring operation: too many executing Apr 26 12:42:54 ldap2 slapd[19556]: conn=1399 fd=48 closed (connection lost) Apr 26 12:42:54 ldap2 slapd[19556]: conn=1451 fd=50 closed (connection lost) [...] Apr 26 12:42:54 ldap2 slapd[19556]: conn=7224 op=2 UNBIND Apr 26 12:42:54 ldap2 slapd[19556]: conn=7224 fd=134 closed Apr 26 12:42:54 ldap2 slapd[19556]: conn=6456 op=6 RESULT tag=97 err=0 text= Apr 26 12:42:54 ldap2 slapd[19556]: conn=5551 op=8 ABANDON msg=8 Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=2035 deferring operation: too many executing Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=2035 deferring operation: pending operations Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=2035 deferring operation: too many executing Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=2035 deferring operation: pending operations Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=2035 deferring operation: too many executing Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=2035 deferring operation: pending operations Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=2035 deferring operation: too many executing Apr 26 12:42:54 ldap2 slapd[19556]: conn=5551 op=10 ABANDON msg=10 Apr 26 12:42:54 ldap2 slapd[19556]: conn=3876 op=13 ABANDON msg=13 Apr 26 12:42:54 ldap2 slapd[19556]: conn=1242 op=24 ABANDON msg=24 Apr 26 12:42:54 ldap2 slapd[19556]: conn=1242 op=26 ABANDON msg=26 Apr 26 12:42:54 ldap2 slapd[19556]: conn=1242 op=28 ABANDON msg=28 Apr 26 12:42:54 ldap2 slapd[19556]: conn=1242 op=30 ABANDON msg=30 Apr 26 12:42:54 ldap2 slapd[19556]: conn=1242 op=31 UNBIND Apr 26 12:42:54 ldap2 slapd[19556]: conn=1242 fd=38 closed Apr 26 12:42:54 ldap2 slapd[19556]: conn=5967 op=7 ABANDON msg=7 Apr 26 12:42:54 ldap2 slapd[19556]: conn=5967 op=8 UNBIND Apr 26 12:42:54 ldap2 slapd[19556]: conn=5967 fd=118 closed Apr 26 12:42:54 ldap2 slapd[19556]: conn=2405 op=12 ABANDON msg=12 Apr 26 12:42:54 ldap2 slapd[19556]: conn=2405 op=13 UNBIND Apr 26 12:42:54 ldap2 slapd[19556]: conn=2405 fd=44 closed Apr 26 12:42:54 ldap2 slapd[19556]: conn=2181 op=24 ABANDON msg=24 Apr 26 12:42:54 ldap2 slapd[19556]: conn=2181 op=26 ABANDON msg=26 Apr 26 12:42:54 ldap2 slapd[19556]: conn=2181 op=28 ABANDON msg=28 Apr 26 12:42:54 ldap2 slapd[19556]: conn=2181 op=30 ABANDON msg=30 Apr 26 12:42:54 ldap2 slapd[19556]: conn=5551 op=6 ABANDON msg=6 Apr 26 12:42:54 ldap2 slapd[19556]: conn=2181 op=31 UNBIND Apr 26 12:42:54 ldap2 slapd[19556]: conn=5924 op=5 ABANDON msg=5 Apr 26 12:42:54 ldap2 slapd[19556]: conn=5924 op=7 ABANDON msg=7 Apr 26 12:42:54 ldap2 slapd[19556]: conn=5924 op=9 ABANDON msg=9 Apr 26 12:42:54 ldap2 slapd[19556]: conn=5924 op=10 UNBIND Apr 26 12:42:54 ldap2 slapd[19556]: conn=5924 fd=115 closed Apr 26 12:42:54 ldap2 slapd[19556]: conn=1389 op=9 ABANDON msg=9 Apr 26 12:42:54 ldap2 slapd[19556]: conn=1167 op=15 UNBIND Apr 26 12:42:54 ldap2 slapd[19556]: conn=1167 fd=37 closed Apr 26 12:42:54 ldap2 slapd[19556]: conn=1903 op=10 ABANDON msg=10 Apr 26 12:42:54 ldap2 slapd[19556]: conn=1903 op=11 UNBIND Apr 26 12:42:54 ldap2 slapd[19556]: conn=1903 fd=58 closed Apr 26 12:42:54 ldap2 slapd[19556]: conn=4400 op=3 ABANDON msg=3 Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=6631 deferring operation: too many executing Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=6631 deferring operation: pending operations Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=6631 deferring operation: too many executing Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=6631 deferring operation: pending operations Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=6631 deferring operation: too many executing Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=6631 deferring operation: pending operations Apr 26 12:42:54 ldap2 slapd[19556]: connection_input: conn=6631 deferring operation: too many executing Apr 26 12:42:54 ldap2 slapd[19556]: conn=4400 op=5 UNBIND [...] In other node, also a cut in the log [...] Apr 26 12:22:40 ldap3 slapd[7650]: conn=8292 op=1 SRCH base="dc=xxx,dc=es" scope=2 deref=0 filter="(objectClass=*)" Apr 26 12:22:40 ldap3 slapd[7650]: conn=8292 op=1 SRCH attr=* + Apr 26 12:22:40 ldap3 slapd[7650]: conn=8292 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= Apr 26 12:22:40 ldap3 slapd[7650]: conn=8292 op=2 UNBIND Apr 26 12:22:40 ldap3 slapd[7650]: conn=8292 fd=158 closed Apr 26 12:22:41 ldap3 slapd[7650]: conn=8293 fd=158 ACCEPT from IP=192.168.21.21:44703 (IP=0.0.0.0:636) Apr 26 12:22:41 ldap3 slapd[7650]: conn=8294 fd=163 ACCEPT from IP=192.168.21.22:58503 (IP=0.0.0.0:636) Apr 26 12:22:41 ldap3 slapd[7650]: conn=8295 fd=164 ACCEPT from IP=192.168.21.22:58506 (IP=0.0.0.0:636) Apr 26 12:22:41 ldap3 slapd[7650]: conn=8293 fd=158 TLS established tls_ssf=128 ssf=128 Apr 26 12:22:41 ldap3 slapd[7650]: conn=8294 fd=163 TLS established tls_ssf=128 ssf=128 Apr 26 12:22:41 ldap3 slapd[7650]: conn=8295 fd=164 TLS established tls_ssf=128 ssf=128 Apr 26 12:22:42 ldap3 slapd[7650]: slap_client_connect: URI=ldaps://ldap1.xxx.xx/ DN="cn=admin,cn=config" ldap_sasl_bind_s failed (-5) *** Apr 26 12:42:54 ldap3 slapd[7650]: do_syncrepl: rid=001 rc -5 retrying (4 retries left) Apr 26 12:42:54 ldap3 slapd[7650]: null_callback : error code 0x35 Apr 26 12:42:54 ldap3 slapd[7650]: null_callback : error code 0x35 Apr 26 12:42:54 ldap3 slapd[7650]: null_callback : error code 0x35 Apr 26 12:42:54 ldap3 slapd[7650]: conn=8297 fd=165 ACCEPT from IP=[xxx:xxx:xxx:xx::5]:42973 (IP=[::]:636) Apr 26 12:42:54 ldap3 slapd[7650]: conn=8296 fd=160 ACCEPT from IP=192.168.21.22:58509 (IP=0.0.0.0:636) Apr 26 12:42:54 ldap3 slapd[7650]: conn=8293 op=1 UNBIND Apr 26 12:42:54 ldap3 slapd[7650]: conn=8293 op=0 BIND dn="cn=admin,cn=config" method=128 [...] In other node, also a cut after the replication operation, the my service restart: [...] Apr 26 12:22:37 ldap1 slapd[5945]: conn=8377 fd=159 closed (connection lost) Apr 26 12:22:37 ldap1 slapd[5945]: conn=8373 fd=156 closed (connection lost) Apr 26 12:22:37 ldap1 slapd[5945]: conn=8374 fd=157 closed (connection lost) Apr 26 12:22:37 ldap1 slapd[5945]: conn=8375 fd=158 closed (connection lost) Apr 26 12:22:41 ldap1 slapd[5945]: conn=8378 fd=158 ACCEPT from IP=192.168.21.23:57377 (IP=0.0.0.0:636) Apr 26 12:22:41 ldap1 slapd[5945]: conn=8379 fd=159 ACCEPT from IP=192.168.21.23:57379 (IP=0.0.0.0:636) Apr 26 12:22:41 ldap1 slapd[5945]: conn=8380 fd=160 ACCEPT from IP=192.168.21.22:33628 (IP=0.0.0.0:636) Apr 26 12:22:41 ldap1 slapd[5945]: conn=8381 fd=161 ACCEPT from IP=192.168.21.22:33629 (IP=0.0.0.0:636) Apr 26 12:22:41 ldap1 slapd[5945]: conn=8379 fd=159 TLS established tls_ssf=128 ssf=128 Apr 26 12:22:41 ldap1 slapd[5945]: conn=8380 fd=160 TLS established tls_ssf=128 ssf=128 Apr 26 12:22:41 ldap1 slapd[5945]: conn=8379 op=0 BIND dn="cn=admin,dc=xxx,dc=es" method=128 Apr 26 12:22:41 ldap1 slapd[5945]: conn=8379 op=0 BIND dn="cn=admin,dc=xxx,dc=es" mech=SIMPLE ssf=0 Apr 26 12:22:41 ldap1 slapd[5945]: conn=8379 op=0 RESULT tag=97 err=0 text= Apr 26 12:22:41 ldap1 slapd[5945]: conn=8379 op=1 SRCH base="dc=xxx,dc=es" scope=2 deref=0 filter="(objectClass=*)" Apr 26 12:22:41 ldap1 slapd[5945]: conn=8379 op=1 SRCH attr=* + Apr 26 12:22:41 ldap1 slapd[5945]: conn=8381 fd=161 TLS established tls_ssf=128 ssf=128 Apr 26 12:22:41 ldap1 slapd[5945]: conn=8381 op=0 BIND dn="cn=admin,dc=xxx,dc=es" method=128 Apr 26 12:22:41 ldap1 slapd[5945]: conn=8381 op=0 BIND dn="cn=admin,dc=xxx,dc=es" mech=SIMPLE ssf=0 Apr 26 12:22:41 ldap1 slapd[5945]: conn=8381 op=0 RESULT tag=97 err=0 text= Apr 26 12:22:41 ldap1 slapd[5945]: conn=8381 op=1 SRCH base="dc=xxx,dc=es" scope=2 deref=0 filter="(objectClass=*)" Apr 26 12:22:41 ldap1 slapd[5945]: conn=8381 op=1 SRCH attr=* + Apr 26 12:22:41 ldap1 slapd[5945]: conn=8378 fd=158 TLS established tls_ssf=128 ssf=128 Apr 26 12:22:42 ldap1 slapd[5945]: conn=8379 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Apr 26 12:22:42 ldap1 slapd[5945]: conn=8381 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Apr 26 12:22:42 ldap1 slapd[5945]: slap_client_connect: URI=ldaps://ldap3.xxx.xx/ DN="cn=admin,cn=config" ldap_sasl_bind_s failed (-5) *** Apr 26 12:42:54 ldap1 slapd[5945]: daemon: shutdown requested and initiated. Apr 26 12:42:54 ldap1 slapd[5945]: conn=1009 fd=13 closed (slapd shutdown) Apr 26 12:42:54 ldap1 slapd[5945]: conn=1013 fd=20 closed (slapd shutdown) Apr 26 12:42:54 ldap1 slapd[5945]: conn=1014 fd=21 closed (slapd shutdown) [...] Any idea? Best regards. -- /* Arturo Borrero Gonzalez || cer.inet(a)linuxmail.org */ /* Use debian gnu/linux! Best OS ever! */

2 1

How to query ldap root DNs ?
by Bhargav Mistry 26 Apr '12

26 Apr '12

Hi, I have written a java tool which configures ldap servers for master master replication and proxy push. I need to query the root DNs for config and bdb databases so that I can use it in the tool but I am not sure how to query it ? I want to query the dn from the file olcDatabase={2}bdb.ldif but I don't know how? olcDatabase={2}bdb.ldif dn: olcDatabase={2}bdb objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {2}bdb olcSuffix: dc=my-domain,dc=com olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=Manager,dc=my-domain,dc=com olcSyncUseSubentry: FALSE I tried using the following command line search query but it doesn't return any results: ldapsearch -x -b "" -s base "objectClass=olcBdbConfig" -H ldap://myserver-1:389 -D "cn=config" -w 'secret' any help is highly appreciated. Thanks. This message and the information contained herein is proprietary and confidential and subject to the Amdocs policy statement, you may review at http://www.amdocs.com/email_disclaimer.asp

4 4

Open ldap master slave replication not properly syncing
by dhanushka ranasinghe 26 Apr '12

26 Apr '12

Hi guys , i have master slave LDAP replication setup , where master have close to 38000 records, when i start the slave server its starts syncing from master , but when the sync finished slave only sync records close to 30000,. is there any reson for this. please note that , and in slave slapd.conf file it has entry "sizelimit 55000" both the servers have identical times: and in the slave log file i can see the "do_syncrep2: rid=004 CSN too old, ignoring" entry. is there any way sort this issue. Thank You Dhanushka

2 1

ldap server doesn't run after inserting some groups (cn)
by stefano malini 26 Apr '12

26 Apr '12

Hi, I had a good LDAP server on Debian Squeeze, everything was ok. I was able to login using ldap users, i was able to make research using ldapsearch. Now, after adding an ldif file with some groups it doesn't run. Trying ldapsearch the answer is ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) What can be happened?

2 3

Way to email users when their password is about to expire?
by Kline, Sara 25 Apr '12

25 Apr '12

Hey all, Our OpenLDAP environment is up and functional and is working great. I was asked if there is a way to have the server email users when their account password is about to expire. For instance, 7 days before expiration they get an email that lets them know their password will expire on date x. Is there functionality within OpenLDAP to do this, or has anyone written a script that would do it? We are using the policy overlay to enforce the password policy. Sara Kline System Administrator Transaction Network Services, Inc 4501 Intelco Loop, Lacey WA 98503 Wk: (360) 493-6736 Cell: (360) 280-2495 ________________________________ This e-mail message is for the sole use of the intended recipient(s)and may contain confidential and privileged information of Transaction Network Services. Any unauthorised review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

4 3

mismatch between slapd.conf and olcDatabase
by Nagaraj Panyam 25 Apr '12

25 Apr '12

Hi, This is a question from an absolute novice. I just installed openldap (RHEL 6.1), and created a config file with suffix "dc=example, dc=com" And started up slapd. However, the value of "dc" in the olcDatabase files remains "dc=my-domain,dc=com" How does one remove this mismatch? Secondly, how does one see the contents of /var/lib/ldap/log.0000000001 Thanks a lot for the support. - Raj

3 2

syncrepl issue not replicating all changes
by Mark Coetser 25 Apr '12

25 Apr '12

Hi Guys debian stable openldap 2.4.23-7.2 I have multiple consumers with a single provider, when making changes too the provider ie creating a new user, sometimes the change doesnt propagate too all the consumers some have the correct entries and some dont. If I then compare the contextcsn on both the provider and the consumer it is identical on the consumers with the missing entry. The only way I can then resync is by shutting down openldap on the consumer deleting the tree and restarting which then syncs the directory with the missing entry. How would I go about troubleshooting this issue? Or am I missing something simple? Any help would be appreciated. -- Thank you,

2 3

Fwd: Re: getent passwd doesn't show ldap user
by stefano malini 23 Apr '12

23 Apr '12

any ideas? -------- Original Message -------- Subject: Re: getent passwd doesn't show ldap user Date: Mon, 23 Apr 2012 12:20:03 +0200 From: stefano malini <lozingalo(a)gmail.com> To: openldap-technical(a)openldap.org hi, installed openldap and configured nslcd.conf and nsswitch.conf. At the moment getent passwd doesn't show ldap user. I create a user nslcd_proc for nslcd lookups. this user belong to the System organizationalUnit. You can see some checks. FIRST SHELL nslcd -d nslcd: DEBUG: add_uri(ldap://localhost:389) nslcd: version 0.7.15 starting nslcd: DEBUG: unlink() of /var/run/nslcd/socket failed (ignored): No such file or directory nslcd: DEBUG: setgroups(0,NULL) done nslcd: DEBUG: setgid(107) done nslcd: DEBUG: setuid(105) done nslcd: accepting connections SECOND SHELL: getent passwd-->shows only local users FIRST SHELL shows: nslcd: [8b4567] DEBUG: connection from pid=2055 uid=0 gid=0 nslcd: [8b4567] DEBUG: nslcd_passwd_all() nslcd: [8b4567] DEBUG: myldap_search(base="dc=amahoro,dc=bi", filter="(objectClass=posixAccount)") nslcd: [8b4567] DEBUG: ldap_initialize(ldap://localhost:389) nslcd: [8b4567] DEBUG: ldap_set_rebind_proc() nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_PROTOCOL_VERSION,3) nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_DEREF,0) nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_TIMELIMIT,0) nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_TIMEOUT,0) nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_NETWORK_TIMEOUT,0) nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_REFERRALS,LDAP_OPT_ON) nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_RESTART,LDAP_OPT_ON) nslcd: [8b4567] DEBUG: ldap_simple_bind_s("uid=nslcd_proc,ou=System,dc=amahoro,dc=bi","***") (uri="ldap://localhost:389") nslcd: [8b4567] ldap_result() failed: No such object These are the permissions of nslcd files and folder ls -ld /etc/nslcd.conf /var/run/nslcd/ /var/run/nslcd/* -rw-r----- 1 root nslcd 635 Apr 21 11:54 /etc/nslcd.conf drwxr-xr-x 2 nslcd nslcd 4096 Apr 21 11:55 /var/run/nslcd/ -rw-r--r-- 1 root root 5 Apr 21 11:55 /var/run/nslcd/nslcd.pid srw-rw-rw- 1 root root 0 Apr 21 11:55 /var/run/nslcd/socket Opening /var/run/nslcd/socket it shows: Error reading /var/run/nslcd/socket: No such device or address Follow nslcd.conf and slapd.conf. __________________________________________________________________ # /etc/nslcd.conf # nslcd configuration file. See nslcd.conf(5) # for details. # The user and group nslcd should run as. uid nslcd gid nslcd # The location at which the LDAP server(s) should be reachable. uri ldap://localhost:389 # The search base that will be used for all queries. base dc=amahoro,dc=bi # The LDAP protocol version to use. #ldap_version 3 # The DN to bind with for normal lookups. binddn uid=nslcd_proc,ou=System,dc=amahoro,dc=bi bindpw ***** # The DN used for password modifications by root. #rootpwmoddn cn=admin,dc=example,dc=com # SSL options #ssl off #tls_reqcert never # The search scope. #scope sub ___________________________________________________________________ slapd.conf slapd.conf #Basics include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/nis.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel trace modulepath /usr/lib/ldap moduleload back_hdb #Database Configuration backend hdb database hdb suffix "dc=amahoro,dc=bi" rootdn "cn=Manager,dc=amahoro,dc=bi" rootpw {SSHA}zH2A+jeSlbl2/UcAXm596KPV4IB/R6x9 directory /var/lib/ldap index objectClass,cn eq #ACLs access to attrs=userPassword by anonymous auth by self write by * none access to * by dn.base="uid=nslcd_proc,ou=System,dc=amahoro,dc=bi" read by self write by * none Please, do you have some ideas? thanks

1 0

Re: getent passwd doesn't show ldap user
by stefano malini 23 Apr '12

23 Apr '12

hi, installed openldap and configured nslcd.conf and nsswitch.conf. At the moment getent passwd doesn't show ldap user. I create a user nslcd_proc for nslcd lookups. this user belong to the System organizationalUnit. You can see some checks. FIRST SHELL nslcd -d nslcd: DEBUG: add_uri(ldap://localhost:389) nslcd: version 0.7.15 starting nslcd: DEBUG: unlink() of /var/run/nslcd/socket failed (ignored): No such file or directory nslcd: DEBUG: setgroups(0,NULL) done nslcd: DEBUG: setgid(107) done nslcd: DEBUG: setuid(105) done nslcd: accepting connections SECOND SHELL: getent passwd-->shows only local users FIRST SHELL shows: nslcd: [8b4567] DEBUG: connection from pid=2055 uid=0 gid=0 nslcd: [8b4567] DEBUG: nslcd_passwd_all() nslcd: [8b4567] DEBUG: myldap_search(base="dc=amahoro,dc=bi", filter="(objectClass=posixAccount)") nslcd: [8b4567] DEBUG: ldap_initialize(ldap://localhost:389) nslcd: [8b4567] DEBUG: ldap_set_rebind_proc() nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_PROTOCOL_VERSION,3) nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_DEREF,0) nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_TIMELIMIT,0) nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_TIMEOUT,0) nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_NETWORK_TIMEOUT,0) nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_REFERRALS,LDAP_OPT_ON) nslcd: [8b4567] DEBUG: ldap_set_option(LDAP_OPT_RESTART,LDAP_OPT_ON) nslcd: [8b4567] DEBUG: ldap_simple_bind_s("uid=nslcd_proc,ou=System,dc=amahoro,dc=bi","***") (uri="ldap://localhost:389") nslcd: [8b4567] ldap_result() failed: No such object These are the permissions of nslcd files and folder ls -ld /etc/nslcd.conf /var/run/nslcd/ /var/run/nslcd/* -rw-r----- 1 root nslcd 635 Apr 21 11:54 /etc/nslcd.conf drwxr-xr-x 2 nslcd nslcd 4096 Apr 21 11:55 /var/run/nslcd/ -rw-r--r-- 1 root root 5 Apr 21 11:55 /var/run/nslcd/nslcd.pid srw-rw-rw- 1 root root 0 Apr 21 11:55 /var/run/nslcd/socket Opening /var/run/nslcd/socket it shows: Error reading /var/run/nslcd/socket: No such device or address Follow nslcd.conf and slapd.conf. __________________________________________________________________ # /etc/nslcd.conf # nslcd configuration file. See nslcd.conf(5) # for details. # The user and group nslcd should run as. uid nslcd gid nslcd # The location at which the LDAP server(s) should be reachable. uri ldap://localhost:389 # The search base that will be used for all queries. base dc=amahoro,dc=bi # The LDAP protocol version to use. #ldap_version 3 # The DN to bind with for normal lookups. binddn uid=nslcd_proc,ou=System,dc=amahoro,dc=bi bindpw ***** # The DN used for password modifications by root. #rootpwmoddn cn=admin,dc=example,dc=com # SSL options #ssl off #tls_reqcert never # The search scope. #scope sub ___________________________________________________________________ slapd.conf slapd.conf #Basics include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/nis.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel trace modulepath /usr/lib/ldap moduleload back_hdb #Database Configuration backend hdb database hdb suffix "dc=amahoro,dc=bi" rootdn "cn=Manager,dc=amahoro,dc=bi" rootpw {SSHA}zH2A+jeSlbl2/UcAXm596KPV4IB/R6x9 directory /var/lib/ldap index objectClass,cn eq #ACLs access to attrs=userPassword by anonymous auth by self write by * none access to * by dn.base="uid=nslcd_proc,ou=System,dc=amahoro,dc=bi" read by self write by * none Please, do you have some ideas? thanks

1 0

slapd crash in slap_listener
by Stefan Wold 22 Apr '12

22 Apr '12

Hi! It seems slapd crash when it's hammered with ~30 simultaneous connections in our test environment. Each client connecting to the server run "ldapsearch -YGSSAPI -H ldap://ldap.example.com uid=user". In earlier versions of openldap we noticed crashes in SASL with the same setup, however that doesn't seem to happen anymore. The test server is running openldap 2.4.28 on Ubuntu 12.04. After a while slapd segfault with the following backtrace: (gdb) bt #0 0x00007f8577401445 in raise () from /lib/x86_64-linux-gnu/libc.so.6 #1 0x00007f8577404bab in abort () from /lib/x86_64-linux-gnu/libc.so.6 #2 0x00007f85773fa10e in ?? () from /lib/x86_64-linux-gnu/libc.so.6 #3 0x00007f85773fa1b2 in __assert_fail () from /lib/x86_64-linux-gnu/libc.so.6 #4 0x00007f8578cf17e0 in slap_listener (sl=0x7f857978b2e0) at ../../../../servers/slapd/daemon.c:1890 #5 0x00007f8578cf17f9 in slap_listener_thread (ctx=<optimized out>, ptr=0x7f857978b2e0) at ../../../../servers/slapd/daemon.c:2092 #6 0x00007f85788579aa in ldap_int_thread_pool_wrapper (xpool=0x7f85797c8c80) at ../../../../libraries/libldap_r/tpool.c:685 #7 0x00007f857778fe9a in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0 #8 0x00007f85774bd4bd in clone () from /lib/x86_64-linux-gnu/libc.so.6 #9 0x0000000000000000 in ?? () For a full bt: https://gist.github.com/112c3bf7a98a5df69907 Let me know if anything else is needed. -- Sincerely Stefan Wold IT-services, Stockholm University

2 2

Configuring Proxy on Master Master replication set issues - openldap version 2.4.23
by Bhargav Mistry 22 Apr '12

22 Apr '12

Hi, I have 2 set of servers and each set contains 2 servers. I have setup n-way multi master replication per set. FirstMaster-1 <-- --> FirstMaster-2 - set1 SecondMaster-1 <-- --> SecondMaster-2 - set2 There is no replication between set1 and set2. Set 2 is inside a service network so in order to setup replication on set 2 I am trying to setup proxy on FirstMaster-1 which will point to SecondMaster-1 and FirstMaster-2 which will point to SecondMaster-2. I tried to google it but I didn't find any body doing it for version 2.4.23. I am able to setup a standalone proxy and configure it but I want to do it on the master servers itself. I am trying to setup proxy for the tree Cn=Manager, dc=my-domain,dc=com on both first masters but in order to do that I have to create a ldap database with the same suffix and rootDN correct? In order to setup replication for ldap database. Ldap throws error saying "dc=my-domain,dc=com" is already defined. FirstMaster-1 : olcDatabase={3}ldap.ldif dn: olcDatabase={3}ldap objectClass: olcDatabaseConfig objectClass: olcLDAPConfig olcDatabase: {3}ldap olcSuffix: dc=my-domain,dc=com olcRootDN: cn=ldap olcSyncUseSubentry: FALSE olcMonitoring: TRUE structuralObjectClass: olcLDAPConfig entryUUID: 633dcaac-1eb1-1031-884a-f7149142768b creatorsName: cn=config createTimestamp: 20120419212135Z entryCSN: 20120419212135.686069Z#000000#001#000000 modifiersName: cn=config modifyTimestamp: 20120419212135Z olcSyncrepl: rid=000 provider=ldap://FirstMaster-1:389 binddn="cn=Manager,dc=my-domain,dc=com" bindmethod=simple credentials="secret" searchbase="dc=my-domain,dc=com" filter="(objectClass=*)" scope=sub schemachecking=off type=refreshAndPersist retry="5 5 300 5" timeout=1 olcDbURI: ldap://SecondMaster-1.eng.qpass.net:389 olcDbACLBind: bindmethod=simple timeout=0 network-timeout=0 binddn="cn=Manager,dc=my-domain,dc=com" credentials="secret" The above configuration is giving me errors when I try to reload it saying the "dc=my-domain,dc=com" is already used by the preceding database (bdb) then how do I setup the proxy on the master itself? Your help is appreciated. Thanks. Bhargav. This message and the information contained herein is proprietary and confidential and subject to the Amdocs policy statement, you may review at http://www.amdocs.com/email_disclaimer.asp

2 2

slapd-ldap proxy database
by Ismael Gil 20 Apr '12

20 Apr '12

Hello all, I'm trying to configure a ldap proxy to conect to a windows active directory to get data. My /etc/openldap/slapd.conf, looks like that (the databases definition only): # Our slapd-ldap back end to connect to AD database ldap suffix "cn=users,dc=XXX,dc=XXX" #rootdn "cn=Administrador,dc=XXX,dc=XXX" subordinate lastmod off rebind-as-user uri "ldap://serverip/" chase-referrals yes database bdb suffix "dc=XXX,dc=XXX" rootdn "cn=Administrador,dc=XXX,dc=XXX" #rootdn "dc=XXX,dc=XXX" rootpw {SSHA}YYYYYYYYYYYYYYYYYyyy Whit this config, I only can query the "users" directory, on the Active Directory server, but I need to be able to query all OUs inside the Active Directory. Why I only can get data from users ou, instead the whole Active Directory? How could I get to proxy all my querys to the Active directory server? If I have an ou called "Bussines", in the Active Directory server, ¿how could I make a database definition or other configuration to get that working? Thanks in advance, Ismaeleitor

1 0

getent passwd doesn't show ldap user
by stefano malini 20 Apr '12

20 Apr '12

hi, as said before i reinstalled openldap and configured nslcd.conf and nsswitch.conf. at the moment geten passwd doesn't show ldap user. as follow you see that i create a user nslcd_proc for nslcd lookups. this user belong to the System organizationalUnit. follow nslcd.conf and slapd.conf (please take a look of ACLs for nslcd_proc): ------------------------------------------------------------------ # /etc/nslcd.conf # nslcd configuration file. See nslcd.conf(5) # for details. # The user and group nslcd should run as. uid nslcd gid nslcd # The location at which the LDAP server(s) should be reachable. uri ldap://localhost:389 # The search base that will be used for all queries. base dc=amahoro,dc=bi # The LDAP protocol version to use. #ldap_version 3 # The DN to bind with for normal lookups. binddn uid=nslcd_proc,ou=System,dc=amahoro,dc=bi bindpw ***** # The DN used for password modifications by root. #rootpwmoddn cn=admin,dc=example,dc=com # SSL options #ssl off #tls_reqcert never # The search scope. #scope sub ------------------------------------------------------------------ slapd.conf ACLs: access to attrs=userPassword by anonymous auth by self write by * none access to * by dn.base="uid=nslcd_proc,ou=System,dc=amahoro,dc=bi" read by self write by * none thanks

1 1

Behavior change on overlay sssvlv
by Clément OUDOT 20 Apr '12

20 Apr '12

Hello, I noticed that with OpenLDAP 2.4.30, a search request with a non criticical sss control on an attribute without ordering matching rule returns an error: clement@ader:~/Programmes/openldap$ bin/ldapsearch -H ldap://localhost:3389 -D ou=lsc,ou=accounts,ou=XXX -w secret -b ou=people,ou=XXX -E sss=cn # extended LDIF # # LDAPv3 # with server side sorting control # # search result search: 2 result: 18 Inappropriate matching text: serverSort control: No ordering rule # numResponses: 1 Before, the error was only returned if the control was set to critical. This was discussed in this ITS: http://www.openldap.org/its/index.cgi/Software%20Bugs?id=6647 Is this behavior change intentional or is this a side effect of of recent commit? Clément.

3 4

memberof overlay
by Marvin Mundry 20 Apr '12

20 Apr '12

Hello everybody, i am running SLES 11.2 x64 with slapd 2.4.30 obtained from this repository: http://download.opensuse.org/repositories/home:/meikestone/SLE_11_SP2/ I am experiencing a problem that should have been solved in 2.4.26: Fixed slapo-memberof with accesslog (ITS#6329,ITS#6766,ITS#6915) (http://www.openldap.org/software/release/changes.html) i am running a master with multiple slaves, when adding a user to a group the memberof overlay updates the memberof attribute of the user on the master. the modification of the memberof attribute neither appears in the accesslog nor it gets replicated on the slaves. any ideas? best regards, marvin

2 3

cannot login using ldap user credential
by stefano malini 20 Apr '12

20 Apr '12

Hi, I installed and configured an ldap server on debian squeeze and i've a problem trying the login using ldap user credential. nslcd debug shows "user not found". using getent passwd i can see every user and also ldap users but i don't understand why i can't login. Could you help me please? Thanks

3 5

Distribution List in Outlook
by Krisztián Bielik 19 Apr '12

19 Apr '12

Running Openldap 2.4.30, with Berkeley DB I'd like to create an address book which is usable under Outlook 2007. There are no problems with single contacts, but regarding distribution lists i wasn't able to found any working solution. Checked back all the mailing list, also searched on internet, but there was only a few threads about this subject, without solution. Every tries(groupOfNames, proxyAddresses etc.) had the same results: Outlooks sees groups I created, but no addresses are associated with those groups. Any help would be appreciated. Thank you, Krisztian ______________________________________ Take a green step today. Think before you print. ********************************NOTICE************************************* This transmittal and/or attachments have been issued by Agility. The information contained here within may be privileged or confidential. If you are not the intended recipient, you are hereby notified that you have received this transmittal in error; any review, dissemination, distribution or copying of this transmittal is strictly prohibited. If you have received this transmittal and/or attachments in error, please notify us immediately by reply or by telephone (Tel. +965-1809-222) and immediately delete this message and all its attachments.

1 0

Distribution List on Outlook
by Krisztián Bielik 19 Apr '12

19 Apr '12

Running Openldap 2.4.30, with Berkeley DB I'd like to create an address book which is usable under Outlook 2007. There are no problems with single contacts, but regarding distribution lists i wasn't able to found any working solution. Checked back all the mailing list, also searched on internet, but there was only a few threads about this subject, without solution. Every tries(groupOfNames, proxyAddresses etc.) had the same results: Outlooks sees groups I created, but no addresses are associated with those groups. Any help would be appreciated. Thank you, Krisztian ______________________________________ Take a green step today. Think before you print. ********************************NOTICE************************************* This transmittal and/or attachments have been issued by Agility. The information contained here within may be privileged or confidential. If you are not the intended recipient, you are hereby notified that you have received this transmittal in error; any review, dissemination, distribution or copying of this transmittal is strictly prohibited. If you have received this transmittal and/or attachments in error, please notify us immediately by reply or by telephone (Tel. +965-1809-222) and immediately delete this message and all its attachments.

1 0

Add 'EQUALITY' to an existing attribute definition
by RICHARDSON Matt (SPARQ) 18 Apr '12

18 Apr '12

Hello all, I've got a problem with a user-defined attribute. The schema was written locally and used in a 389-DS directory. I made the necessary changes so that OpenLDAP 2.4.23-20.el6 could use it (attributeTypes -> olcAtrributeTypes, etc.). There is an attribute that needs to be added multiple times with different values. Under 389, this worked: olcAttributeTypes: {0}(1.3.6...1000 NAME 'x-myGroup' DESC 'My Group' SYNTAX 1.3...1.15 X-ORIGIN 'user defined') It works for adding one 'x-myGroup' attribute to an entry. However, if I try to add a second I get: Ldap_modify: Inappropriate matching (18) additional info: modify/add: x-myGroup: no equality matching rule The syntax specifies it's a directory string type, but adding 'EQUALITY caseIgnoreMatch' to the definition causes slapd to crash when I run ldapmodify to add an x-myGroup attribute to an existing entry. This seemed to be similar to this issue http://www.openldap.org/its/index.cgi/Software%20Bugs?id=5540 , so I did a slapcat, deleted the files in /var/lib/ldap/ and restarted slapd. Loading the ldif with ldapadd caused slapd to crash again. Removing the EQUALITY statement from the attribute definition allowed me to load the ldif. If someone could point me in the right direction, I would greatly appreciate it. Matt ************************************************************************************************** This email message (including any file attachments transmitted with it) is for the sole use of the intended recipient(s) and may contain confidential and legally privileged information. Any unauthorised review, use, alteration, disclosure or distribution of this email (including any attachments) by an unintended recipient is prohibited. If you have received this email in error, please notify the sender by return email and destroy all copies of the original message. Any confidential or legal professional privilege is not waived or lost by any mistaken delivery of the email. SPARQ Solutions accepts no responsibility for the content of any email which is sent by an employee which is of a personal nature. Sender Details: SPARQ Solutions PO Box 15760 City East, Brisbane QLD Australia 4002 +61 7 4931 2222 SPARQ Solutions policy is to not send unsolicited electronic messages. Suspected breaches of this policy can be reported by replying to this message including the original message and the word "UNSUBSCRIBE" in the subject. **************************************************************************************************

1 1

RE24 testing call #2 (2.4.31)
by Quanah Gibson-Mount 18 Apr '12

18 Apr '12

If you know how to build OpenLDAP manually, and would like to participate in testing the next set of code for the 2.4.31 release, please do so. Generally, get the code for RE24: <http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=snapshot;h=refs/h…> Configure & build. Execute the test suite (via make test) after it is built. Thanks! --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

7 18

RE: ldapd vs. slapd
by Richards, Toby 18 Apr '12

18 Apr '12

I meant in terms of the LDIF file: objectClass: top objectClass: account objectClass: person objectClass: posixAccount objectClass: shadowAccount objectClass: organizationalPerson objectClass: inetOrgPerson The above doesn't work. It says that top/account isn't a valid chain. -Toby -----Original Message----- From: Kline, Sara [mailto:SKline@tnsi.com] Sent: Tuesday, April 17, 2012 8:45 AM To: Richards, Toby Subject: RE: ldapd vs. slapd 1. This is the order mine are in, you can ignore solaris and DUA as those are for the solaris boxes, also you can ignore policy that is for the password policy overlay. include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/ppolicy.schema include /etc/openldap/schema/DUAConfigProfile.schema include /etc/openldap/schema/solaris.schema 2. What do you have in your slapd.conf? TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCertificateFile /etc/pki/tls/certs/slapd-cert.pem TLSCertificateKeyFile /etc/pki/tls/certs/slapd-key.pem TLSCACertificateFile /etc/pki/tls/certs/slapd-cert.pem TLSVerifyClient never security update_ssf=1 update_ssf=112 simple_bind=64 Thanks, Sara Kline -----Original Message----- From: openldap-technical-bounces(a)OpenLDAP.org [mailto:openldap-technical-bounces@OpenLDAP.org] On Behalf Of Richards, Toby Sent: Tuesday, April 17, 2012 8:25 AM To: Brandon Hume; openldap-technical(a)openldap.org Subject: RE: ldapd vs. slapd OK got it. I realized that ldapd is a different product after some more research this morning. I've got slapd running & responding; however: 1. I cannot figure out the correct order of objectClass statements to reach inetOrgPerson. I do have the core, cosine, nis, and inetorgperson schemas included in slapd.conf. 2. slapd won't run on port 636 even though I put "TLS_CACERT /path/to/cert.crt" and "URI ldaps://toby.org.org" into ldap.conf -Toby -----Original Message----- From: openldap-technical-bounces(a)OpenLDAP.org [mailto:openldap-technical-bounces@OpenLDAP.org] On Behalf Of Brandon Hume Sent: Tuesday, April 17, 2012 7:58 AM To: openldap-technical(a)openldap.org Subject: Re: ldapd vs. slapd On 04/16/12 11:02 PM, Richards, Toby wrote: > For those of you wondering, I'm running OpenBSD 5.0. openldap-server-2.4.25p0.tgz (depends on: openldap-client-2.4.25.tgz (depends on cyrus-sasl-2.1.23p7-ldap.tgz)). Typing "ldapd" gets the appropriate tcp/ip ports responding. Typing "/etc/rc.d/slapd start" does something, but doesn't give me responses on 349 or 636. "ldapd" is a service that comes with OpenBSD, and it definitely is not OpenLDAP. It will start and sit on the same ports, however, making it impossible for you to start slapd. So don't start ldapd. Kill it if it's already running, then you might be able to start OpenLDAP. Also, this might have been a typo, but the non-SSL port for LDAP is 389/tcp, not 349. This e-mail message is for the sole use of the intended recipient(s)and may contain confidential and privileged information of Transaction Network Services. Any unauthorised review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

4 10

overlays and frontend database
by Jan Vcelak 18 Apr '12

18 Apr '12

Hello list. I have some questions about defining overlays on the frontend database. Documentation (manual pages) is not very consistent about it: slapd.overlays | Most of the overlays are only allowed to be configured on | individual databases, but some may also be configured | globally. slapd.conf | Note that all of the database's regular settings should be | configured before any overlay settings. slapd-config | Settings in the frontend database are inherited by the other | databases, unless they are explicitly overridden in a | specific database. | Overlays must be configured as child entries of a specific | database. FAQ | Starting from OpenLDAP 2.3 they can be stacked on the | frontend as well; this means that they can be executed after | a request is parsed and validated, but right before the | appropriate database is selected. Are there are some overlays that can be applied on the fronted database (globally)? What about the inheritance as mentioned in slapd-config? (Maybe I didn't understand this correctly.) >From what I have tried, enabling an overlay on fronted database makes slapd to segfault due to accessing a null pointer or due to a heap overflow. It seems that there are no verifications of overlay settings, because both slapadd and ldapmodify succeed when enabling the void configuration. Please, what is the expected behavior? Regards, Jan

2 2

Authenticate a Samba box to a pre-existing LDAP server
by Marcelo Pereira 17 Apr '12

17 Apr '12

Hello, I have been reading some documentation on how to setup a Samba+LDAP environment, but they are all considering that I'm setting up a "new" LDAP server on the same machine. I want to set up a Samba server (which is my server) but I would like to use an external LDAP server (which I don't have any access other than just authenticate myself) to authenticate the users in my Samba box. The LDAP server is up and running (I can't do anything there). I just need to connect my Samba box to this LDAP server in order to authenticate the users. Would you please suggest the right documentation so I could read it?? I will appreciate any help on this regard!! Thanks, Marcelo

1 0

ldapd vs. slapd
by Richards, Toby 17 Apr '12

17 Apr '12

I've been attempting to get an OpenLDAP server running all day, and I've been reading official documentation, tutorials, and anything else relevant on Google. I have some questions: 1. What is the difference between ldapd & slapd (and commands such as ldapadd & slapdadd)? Slapd doesn't seem to respond on LDAP ports, but ldapd does. 2. When using commands & configuring ldap.conf, can I use an IP address instead of an FQDN for the host URI? 3. Do self-signed certificates break ldapadd? 4. I'm running with an SSL certificate, but no TLS. I commonly get the error "Confidentiality Required." The -Z option is for TLS. How do I tell ldapadd that I'm using SSL only? I tried with -Hldaps://hostname:636, but then I get "ldap_sasl_bind(SIMPLE): Can't connect to LDAP server" (even if I use the -x option). I know that the ldap server is running because when ldapd is running, I can connect with external tools such as jxplorer or ldap-at (but trying to make changes to my database will crash both of those utilities). Respectfully Submitted, R. Toby Richards Network Administrator Superior Court of California In and For the County of San Luis Obispo (805) 781-4150

4 7

Multiple error codes defined as (-1)
by Jan Synacek 17 Apr '12

17 Apr '12

Hello all, There are multiple error codes defined as (-1) in ldap.h. When you call ldap_result() followed by a ldap_get_option(ld, LDAP_OPT_RESULT_CODE, &err) how do you distinguish between the meanings of -1? How does ldap_err2string() do that? -- Jan Synacek Software Engineer, BaseOS team Brno, Red Hat

2 1

Unexpected slapd shutdown (bad file descriptor)
by Stefan Wold 16 Apr '12

16 Apr '12

Hi, I've got an issue with OpenLDAP 2.4.28 on Ubuntu 12.04 where it unexpectedly shutdown due to a bad file descriptor. I wonder if anyone know what could be causing this problem or where I should be looking to figure it out. This seems to occur when the server is handling many simultaneous queries. Judging by the bugtracker there has been similar issues in earlier versions. A few log entries: Apr 13 15:03:14 sukat-test-ldapro02 slapd[30273]: slapd(23): setsockopt(SO_KEEPALIVE) failed errno=9 (Bad file descriptor) Apr 13 15:03:14 sukat-test-ldapro02 slapd[30273]: slapd(23): setsockopt(TCP_NODELAY) failed errno=9 (Bad file descriptor) Apr 13 15:03:14 sukat-test-ldapro02 slapd[30273]: daemon: epoll_ctl(ADD,fd=23) failed, errno=1, shutting down Apr 13 15:03:14 sukat-test-ldapro02 slapd[30273]: daemon: abnormal condition, shutdown initiated. Apr 13 15:03:14 sukat-test-ldapro02 slapd[30273]: conn=109877 fd=18 closed (slapd shutdown) Apr 13 15:03:14 sukat-test-ldapro02 slapd[30273]: conn=109881 fd=20 closed (slapd shutdown) Apr 13 15:03:14 sukat-test-ldapro02 slapd[30273]: conn=109879 fd=21 closed (slapd shutdown) Apr 13 15:03:14 sukat-test-ldapro02 slapd[30273]: conn=109880 fd=22 closed (slapd shutdown) For a complete log: https://gist.github.com/2994c23ff506ffdaf21f -- Stefan Wold IT-services, Stockholm University

1 0

ldapdelete "ldap_bind: Invalid DN syntax (34)"
by Tianyin Xu 16 Apr '12

16 Apr '12

Hi, Sorry for the newbie question, but I really cannot figure out the problem. I just follow the "A Quick-Start Guide", what I did is build a example.ldif as follows: -------------------------example.ldif---------------- dn: dc=example,dc=com objectclass: dcObject objectclass: organization o: Example Company dc: example dn: cn=Manager,dc=example,dc=com objectclass: organizationalRole cn: Manager ----------------------------------------------------------- Then, using ldapadd to insert these entries: ldapadd -x -D "cn=Manager,dc=example,dc=com" -f example.ldif -w secret adding new entry "dc=example,dc=com" adding new entry "cn=Manager,dc=example,dc=com" Everything is fine. ***** Then, I want to use ldapdelete to delete the entries I added just now. I tried ldapdelete "cn=Manager,dc=example,dc=com" -x -w secret ldap_bind: Invalid DN syntax (34) additional info: invalid DN and, also, I tried ldapdelete -D "cn=Manager,dc=example,dc=com" -x -w secret but this time the client just hangs. I read the manuals and search on google but still does not have idea. my ldap.conf is as follows database bdb suffix "dc=example,dc=com" rootdn "cn=Manager,dc=example,dc=com" rootpw secret directory /usr/local/var/openldap-data Could anyone take a look and tell me why? Thanks a lot! -- Tianyin

3 6

Re: JLDAP problem
by Bahadir Konu 15 Apr '12

15 Apr '12

What I m working on is an integration component that will listen to LDAP server. When a change occurs on LDAP entries, my component will publish a message. (actually call a web service). LDAP admins offer that I can use "change logs" to detect changes. But I think notification mechanism is a better choice. Do you think JLDAP and asynch "search" method a good enough choice? Is UnboundID SDK better for me and why? Thanks. Bahadır Konu On 13 April 2012 19:43, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Friday, April 13, 2012 5:00 PM +0300 Bahadir Konu <bah.konu(a)gmail.com> > wrote: > > Thanks Nick. >> After building from source, problem dissapeared. And I was able to debug. >> > > If you are serious about using Java to talk to LDAP, then I would advise > using the UnboundID SDK. > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

reqStart<= slow
by Michael Ströder 14 Apr '12

14 Apr '12

HI! I'm trying to retrieve change events from accesslog DB (all with today's RE24). I tried searching with this filter: (&(reqDN=cn=Test-Mail-Gruppe 1,dc=example,dc=com)(reqStart<=20120413180000Z)) This turned out to be quite slow though. reqDN is indexed and there are only two possible entries. Using a filter reqStart>= even when negated with (!()) is pretty fast. I really wonder why that is. Ciao, Michael.

2 4

Re: AW: Re: How can I set an LDAP-attribute to "null" (empty)?
by masarati＠aero.polimi.it 13 Apr '12

13 Apr '12

[please keep replies on the list] > IŽm sorry, but that is not a qualified answer... OK, I'll try to be more precise. 1) "TelUser": not a standard track attribute. Please provide its specification (significantly, its syntax) otherwise the point is moot. 2) few standard track syntaxes allow zero length strings; see RFC4517. In short, RTFM to see if the syntax of your "TelUser" allows a zero length string. It appears from the description of your problem, that you want to zero out a value, not actually store a zero length value. This is common of rdbms users, where tables have a fixed structure and when some field is not defined one just wants to store an empty value in it. LDAP, instead allows object to have optional attributes; when optional attributes are not needed, they should not appear at all. If your problem is with the tool you're using, that has nothing to do with OpenLDAP; so please ask the appropriate forum. p. > > ----- Ursprüngliche Nachricht ----- > Von: masarati(a)aero.polimi.it > An: norbert.weckert(a)arcor.de > Cc: openldap-technical(a)openldap.org > Gesendet: 13.04.12 23:26 > Betreff: Re: How can I set an LDAP-attribute to "null" (empty)? > >> Hello, >> >> to fill data into an LDAP-structure, I use the software HP Connect IT. >> Sometimes it is necessary to clear an attribute. >> >> But there is the following error message: >> >> Error occured while modifiying the entry (LDAP) >> TelUser value #0 invalid per Syntax >> LDAP API Invalid Syntax >> >> Can you tell me, what I have to do, so that LDAP accepts an "empty >> value"? > > Nearly no syntax accepts the empty value. What you need to do is delete > the attribute using a standard LDAP modify operation. In LDIF: > > dn: (the DN) > changetype: modify > delete: TelUser > - > > How to do it using that specific software is up to you. > > p. > > >

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical