- openldap-technical - openldap.org

OpenLDAP high CPU usage when performing mass changes
by Jeffrey Crawford 18 Mar '12

18 Mar '12

We are using openldap 2.4.26 with BDB 4.8 and have replication set up in mirror mode for our main ldap database. There are a couple of other replicas that have a subset of the data that the main cluster has but we are seeing the following behavior on all of them. When performing mass updates via LDAP, lets say on the order of 30,000 entries being added to existing entries. We've noticed that the CPU use of the slapd instances goes through the roof (between 65% and 95% continuously), and seems to stay there until it is restarted. The Problem is that this system has to be highly available, even for writing and when these updates "shock" the system, the response time goes way down when the process are turning like that. I don't think they are trying to catch up to the data changes because if I let them run a while after the updates are done. (Talking like 1hr) and then restart the instances, they go back to their normal state. So far the only way I've been able to mitigate the issues is to reconfigure our ldap proxy instances to a machine that is having less trouble, restart the instances that are chugging along, then repoint the proxies back to the one just started, and start the others. Not exactly a quick operation. I've played with cache settings for both OpenLDAP and BDB and have gotten the frequency of this issue reduced but I can't seem to get rid of it completely and it shows up quite often after large data manipulations. I'm at a loss of how to debug since nothing is crashing. Any suggestions on how to find out what's causing this would be very helpful. The logs are not throwing any warnings or posting messages that would seem out of the ordinary and I have played with the log settings but nothing seems to relate to anything that might explain why we are seeing CPU usage to go so high. Thanks in advance -- I fly because it releases my mind from the tyranny of petty things . . . — Antoine de Saint-Exupéry Jeffrey E. Crawford ITS Application Administrator (IDM) 831-459-4365 jeffreyc(a)ucsc.edu

3 7

ldapi vs ldap
by Nick Milas 18 Mar '12

18 Mar '12

Hi, For applications accessing a directory (mainly Postfix, Dovecot, PowerDNS), we are replicating locally and applications connect using: ldap://localhost. We are considering using ldapi://localhost instead. Would there be any performance / reliability pros/cons? Thanks, Nick

3 2

Re: URI="(null)" DN="" (Was: ldap && rwm && pcache && transparent)
by Brian Thompson 17 Mar '12

17 Mar '12

Hello, We're running into almost exactly the same issue that Turbo described a few months ago and I'm not exactly sure what to try next... Basically there are two remote directories that we only have read-only access to via fixed set of bind credentials. Both directories have the same naming contexts and same user entry DNs but a slightly different non-conflicting set of user attributes. What we would like to do is create a combined merged view that contains the user entry attribute responses from both remote directories displayed as a single entry and allow anonymous access via the local lan. Only one of the two directories has the specific attribute being searched for but again we would like the response to include the full set of attributes from both directories and the entry DNs do match. So, I'm attempting to use slapd-ldap for the first remote directory and slapo-translucent for the second remote directory but can't seem to make the two mechanisms cooperate with each other. The errors are the same as what Turbo described. If I change the database from slapd-ldap to slapd-shell or slapd-hdb (empty db), the slapo-translucent portion works correctly and I can see the attributes in the searched entry retrieved from the second remote directory. If I leave the slapd-ldap configuration in place and comment out the overlay translucent portion, the slapd-ldap portion works correctly and I can see the attributes in the searched entry retrieved from the first remote directory. Still no luck on getting both to work at the same time though so that it combines the attributes from both entries into a single response. Here's the pertinent portion of the config: backend ldap database ldap suffix "dc=example,dc=com" uri "ldap://172.16.16.16/" idassert-bind mode=none bindmethod=simple binddn="uid=readonly1,cn=admins,dc=example,dc=com" credentials="secret1" flags=override,non-prescriptive overlay translucent uri "ldap://172.17.17.17/" idassert-bind mode=none bindmethod=simple binddn="uid=readonly2,cn=admins,dc=example,dc=com" credentials="secret2" flags=override,non-prescriptive If anyone has any ideas why the above isn't working or knows of a cleaner way to do it, please let me know. It would be much appreciated. Thanks, Brian ----- Original Message ----- > On Wed, 14 Sep 2011 20:53:03 +0200, Turbo Fredriksson wrote: > > I'm trying to proxy an AD and an OpenLDAP server on a > > separate machine to get a 'combined' view. > > Some more testing and finding a loglevel that doesn't drown me > in information, I see this: > > ----- s n i p ----- > [...] > slapd starting > conn=1000 fd=13 ACCEPT from IP=127.0.0.1:54815 (IP=0.0.0.0:389) > conn=1000 op=0 BIND dn="" method=128 > conn=1000 op=0 RESULT tag=97 err=0 text= > conn=1000 op=1 SRCH base="dc=company,dc=tld" scope=2 deref=0 > filter="(uid=kpxb140)" > conn=1000 op=1 SRCH attr=uid > [...] > conn=1015 fd=43 ACCEPT from IP=127.0.0.1:54830 (IP=0.0.0.0:389) > conn=1015 op=0 BIND dn="" method=128 > conn=1015 op=0 RESULT tag=97 err=0 text= > conn=1015 op=1 SRCH base="dc=company,dc=tld" scope=2 deref=0 > filter="(uid=kpxb140)" > conn=1015 op=1 SRCH attr=* + > daemon: shutdown requested and initiated. > conn=1015 op=1 SEARCH RESULT tag=101 err=52 nentries=0 text=Proxy > operation retry failed > slapd shutdown: waiting for 18 operations/tasks to finish > conn=1015 fd=43 closed (slapd shutdown) > daemon: accept(-1) failed errno=9 (Bad file descriptor) > [...] > conn=1000 op=1 ldap_back_retry: retrying URI="(null)" DN="" > conn=1000 fd=13 closed (slapd shutdown) > RESETTING CACHED QUERY URLS > slapd stopped. > ----- s n i p ----- > > > So on the last connection, I get 'Proxy operation retry failed' and on > all > the rest 'retrying URI="(null)" DN=""'. So I'll asume that there's a > URI > on conn=1000. > > > But why do I get these problems? Isn't slapo-translucent supposed to > work > with slapd-{ldap,meta}? > > > > ------------------------------

2 1

segfault in slapd
by A Malaviya 16 Mar '12

16 Mar '12

Hi, I've a provider-consumer setup using syncrepl on which I'm experiencing segfaults on the provider. Daily there are about 4 - 5 segfaults. Weirdly it seems as if the segfaults happen when we do ldapsearch on the entire database within short intervals. The segfault line gives 'error 4' at the end. My openldap version is 2.4.23. Pls suggest some resolution for the prb. A Malaviya.

2 1

ACL in dynamic configuration
by Nick Milas 16 Mar '12

16 Mar '12

Hello, I have converted from static (slapd.conf) to dynamic (cn=config) configuration using auto file conversion. I would like to ask a couple of questions regarding ACL conversion. Here follows one of the rules we have in initial form (a), and after conversion (b): (a) access to dn.subtree="dc=xxx.xxx.xxx.in-addr.arpa,ou=dns1,dc=example,dc=gr" attrs="children,entry" by group.exact="cn=TechAdmins,ou=Groups,dc=example,dc=gr" write by group.exact="cn=Dept1Admins,ou=Groups,dc=example,dc=gr" read by group.exact="cn=Dept2Admins,ou=Groups,dc=example,dc=gr" write by group.exact="cn=Dept3Admins,ou=Groups,dc=example,dc=gr" read by group.exact="cn=Dept4Admins,ou=Groups,dc=example,dc=gr" read by group.exact="cn=Dept5Admins,ou=Groups,dc=example,dc=gr" read by group.exact="cn=GuestAdmins,ou=Groups,dc=example,dc=gr" read by dn.exact="uid=dnsauthusr,ou=System,dc=example,dc=gr" read by * break (b) as an olcAccess attribute value: {10}to dn.subtree="dc=xxx.xxx.xxx.in-addr.arpa,ou=dns1,dc=example,dc=gr" attrs=children,entry by group/groupOfNames/member.exact="cn=techadmins,ou=groups,dc=example,dc=gr" write by group/groupOfNames/member.exact="cn=Dept1Admins,ou=groups,dc=example,dc=gr" read by group/groupOfNames/member.exact="cn=Dept2Admins,ou=groups,dc=example,dc=gr" write by group/groupOfNames/member.exact="cn=Dept3Admins,ou=groups,dc=example,dc=gr" read by group/groupOfNames/member.exact="cn=Dept4Admins,ou=groups,dc=example,dc=gr" read by group/groupOfNames/member.exact="cn=Dept5Admins,ou=groups,dc=example,dc=gr" read by group/groupOfNames/member.exact="cn=guestadmins,ou=groups,dc=example,dc=gr" read by dn.base="uid=dnsauthusr,ou=system,dc=example,dc=gr" read by * +0 break Question 1. Why "group.exact" was changed to "group/groupOfNames/member.exact" ? Yes, groups are defined as entries of groupOfNames objectClass, with members defined as values of attribute "member". But should it be like that? Should we change (manually) "group/groupOfNames/member.exact" back to "group.exact" again or not (and why)? Question 2. Is there a way we can add (manually, since conversion removed the ones which existed in initial configuration files) line breaks in olcAccess attribute value so it can be more legible (for administrative purposes)? Question 3. What is the "+0" added before "break" and why is needed? Thanks in advance, Nick

3 3

Is this a sensible architecture?
by Brett Watson 16 Mar '12

16 Mar '12

Folks, I'm currently planning a shift in our use of LDAP to incorporate mirror mode masters for the sake of high availability. The plan is to hide a mirror mode master pair behind a virtual IP using "sorry server" fail-over, such that the primary mirror server takes 100% of the load when it's up and responsive, with fall-back to the secondary mirror server when the primary is down. In this way, the virtual IP presents a "virtual master" to the outside world, and the plan is for *all* outside LDAP interaction with the masters to happen over this single virtual IP. There will be other "slave" servers which replicate the master (to distribute read-only load), and the plan is for them to syncrepl from the master virtual IP. I gather that a possible alternative to this arrangement is to have the "slave" servers act as syncrepl consumers to *both* masters simultaneously, via their real IP addresses. If this is indeed a valid configuration, does it convey any advantages? The single "virtual master" approach seems architecturally simpler, but is it considered robust by those in the know? Thanks in advance.

5 5

Fwd: OpenLdap Startup Failure
by Swapnesh sharma 15 Mar '12

15 Mar '12

Hi All, I have installed OpenLdap-2.4.26 on Solaris 10 (SunOS xxx 5.10 Generic_142900-09 sun4v sparc SUNW,SPARC-Enterprise-T5220) using the packages available from sunfreeware ( http://www.sunfreeware.com/indexsparc10.html) Installation was successful without any error. But when starting slapd, I am getting below error. Can anyone please help/redirect me ? I am trying to find a solution using the documents and archive mails. Let me know if you require more information. bash-3.00#/usr/local/libexec/slapd -d 255 slapd startup: initiated. backend_startup_one: starting "cn=config" config_back_db_open Backend ACL: access to * by * none config_back_db_open: line 0: warning: cannot assess the validity of the ACL scope within backend naming context config_build_entry: "cn=config" config_build_entry: "cn=schema" >>> dnNormalize: <cn={0}core> <<< dnNormalize: <cn={0}core> config_build_entry: "cn={0}core" config_build_entry: "olcDatabase={-1}frontend" config_build_entry: "olcDatabase={0}config" config_build_entry: "olcDatabase={1}bdb" backend_startup_one: starting "dc=my-domain,dc=com" bdb_db_open: "dc=my-domain,dc=com" *bdb_db_open: database "dc=my-domain,dc=com": dbenv_open(/usr/local/var/openldap-data).* *bdb(dc=my-domain,dc=com): Ignoring log file: /usr/local/var/openldap-data/log.0000000001: magic number 88090400, not 40988* *bdb(dc=my-domain,dc=com): Invalid log file: log.0000000001: Invalid argument* *bdb(dc=my-domain,dc=com): PANIC: Invalid argument* *bdb(dc=my-domain,dc=com): unable to join the environment* *bdb_db_open: database "dc=my-domain,dc=com" cannot be opened, err -30974. Restore from backup!* ====> bdb_cache_release_all bdb(dc=my-domain,dc=com): txn_checkpoint interface requires an environment configured for the transaction subsystem bdb_db_close: database "dc=my-domain,dc=com": txn_checkpoint failed: Invalid argument (22). backend_startup_one (type=bdb, suffix="dc=my-domain,dc=com"): bi_db_open failed! (-30974) slapd shutdown: initiated ====> bdb_cache_release_all bdb_db_close: database "dc=my-domain,dc=com": alock_close failed slapd destroy: freeing system resources. slapd stopped. Regards, Swapnesh

2 1

FW: Partial LDAP replication with syncrepl
by Patrick Krauer 15 Mar '12

15 Mar '12

-----Original message----- To:+openldap+pkrauer+4a901aeb3d.openldap-technical#openldap.org@spamgourmet.com; From:Patrick Krauer <patrick(a)krauer.org> Sent:Thu 15-03-2012 08:05 Subject:Partial LDAP replication with syncrepl Hi all, I'm using OpenLDAP for different purposes (e.g. zarafa, ssh authentication and HTTP authentication). Each Service (zarafa, apache) is running on a different server. SSH for sure runs on every server. For stability reasons, I replicate my LDAP database to each slave server (zarafa, apache and others). I'm using syncrepl which works fine by know. Now I want to use LDAP for another service (typo3). For this I need to apply another schema. If I do this on the master LDAP server only, all slave servers will claim. If I set schemachecking off in the slave configuration, the LDAP server does not stop, but it does not load entities which use the new objectClass. I tried to select only particular attributes on the slave server (like cn, uid but not objectClass) but that doesn't help. I don't want to apply the new schema to each and every server which doesn't use it at all. How can I solve this issue? What is the common way for such a setup? Best regards, Patrick -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

1 0

RE: OPENLDAP SYNCREPL
by Quanah Gibson-Mount 15 Mar '12

15 Mar '12

--On Thursday, March 15, 2012 1:08 PM -0400 "Borresen, John - 0442 - MITLL" <john.borresen(a)ll.mit.edu> wrote: > Quanah; > > A question about the "entryCSN" attributes, the three zeros (entryCSN:= > 20120308173545.066786Z#000000#000#000000) between the #-marks correspond > to the Server ID, correct? If they do, why are some "000" and others > "001" when I only have one server? Some entries were created before it considered itself a provider. I wouldn't worry about 000 vs 001 at this time. ;) > Thank you for your assistance on getting me over the syncrepl wall. > > I noticed in the 2.4 Admin Guide that configuring the monitor database for > cn=config has not been published yet; and, there isn't a lot online, > period, about it. The manpages are not overly helpful either from > cn=config is concerned. > > I am seeing this: "bdb_monitor_db_open: monitoring disabled; configure > monitor database to enable" > > on both the Provider and Consumer. > > Can you recommend something, relevant to cn=config monitor setup? Add the monitor DB to your cn=config, and add any acl you want applied to it. That's all there is to it. For example, mine is: dn: olcDatabase={1}monitor,cn=config objectClass: olcDatabaseConfig olcDatabase: {1}monitor olcAccess: {0}to dn.children="cn=monitor" by dn.children="cn=admins,cn=zimbra " read olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=config olcMonitoring: FALSE --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

WINDOWS AD CLIENTS & LINUX LDAP CLIENTS UNABLE TO OPEN X-WINDOWS EMULATORS
by Borresen, John - 0442 - MITLL 15 Mar '12

15 Mar '12

All, Sorry for the long subject line. 1) We are migrating away from NIS to LDAP for our Linux/Unix clients and servers. 2) All our Windows clients authenticate with the main Active Directory server. Now the issue: Many of our end-users utilize various X-Windows Emulators (Exceed, XWin32, Xming, etc) to open a connection to a Linux server. When we used NIS, the End-users had no problem opening a X-Win session to a server. Now under LDAP, the users get authenticated properly but the X-Win session gets blocked and never opens. In the messages file, and secure file, you can see the users getting authenticated and granted access but the X-win session never opens on the client machine. Has anyone else seen this issue? Thanks, Dave Borresen Solaris/Linux Systems Administrator Surveillance Systems Group MIT Lincoln Laboratory 244 Wood Street Lexington, MA 02420 john.borresen(a)ll.mit.edu

1 0

RE: OPENLDAP SYNCREPL
by Quanah Gibson-Mount 15 Mar '12

15 Mar '12

--On Wednesday, March 14, 2012 4:25 PM -0400 "Borresen, John - 0442 - MITLL" <john.borresen(a)ll.mit.edu> wrote: > Saw a post of yours from a while back, so I backed up the consumer's dbase > and moved the directory out of the way, then ran slapadd and brought slapd > up on the consumer. Yes, when you go to reload a server, you must delete the existing DB. > Things look more in-sync with each other than they did. > > Question: I noticed that there are seven "reqStart" entries in the > cn=accesslog on the Provider machine. They were there when I was testing > and beating my head against the wall. Should they be deleted manually > since I used slapcat/slapadd? Or does it matter? It doesn't matter. The point of syncrepl is it is intelligent enough to ignore data it's already replicated. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

Scaling LDAP
by Gaurav Gugnani 15 Mar '12

15 Mar '12

Hi All, First of all thks for helping me out with the issues on openLDAP. Well today, my query is pretty generic and lot many people working on LDAP would face such an issues. We are using openldap 2.4.26 with BDB as backend. We've installed the setup on linux machine of 64 bit with 4GB ram. Now, currently we have some 10K records in it and its working perfectly fine. Our systems is running under replication - syncrepl. However, in near future we can foresee some million of records to turn up. So, Can any one please advise - What are the different Scaling options available with LDAP? I need to do some research and test our cases. Please suggest. Thanks and Regards, Gaurav Gugnani

3 3

RE: OPENLDAP SYNCREPL
by Quanah Gibson-Mount 14 Mar '12

14 Mar '12

--On Wednesday, March 14, 2012 2:44 PM -0400 "Borresen, John - 0442 - MITLL" <john.borresen(a)ll.mit.edu> wrote: > Quanah; Pesonally, I use a specific replicator ID for replication that has full read to all data on the master, and make that the first ACL. Then I don't have to worry whether or not the other ACLs interfere. At this point, if you haven't, I'd wipe out the replicas DB and make it do a fresh sync, so you can confirm it is working properly, OR slapcat the master, and use the appropriate flags to slapadd to reload it, and then ensure the replica keeps up to date. If you're using the replica as-is, where you've had an invalid configuration for days, I fully expect the data on the replica to be in an odd state. Make sure nothing is using the replica if you choose to reload it in either method. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 2

RE: OPENLDAP SYNCREPL
by Quanah Gibson-Mount 14 Mar '12

14 Mar '12

--On Tuesday, March 13, 2012 3:38 PM -0400 "Borresen, John - 0442 - MITLL" <john.borresen(a)ll.mit.edu> wrote: > Maybe it's just that it is near the end of the day...but, first here is my > ldif to add the provider to my cn=accesslog: Look at the example LDIF I provided you. Clearly your base DN of the entry you are trying to add is invalid. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 4

test060-mt-hot failed for bdb (SunOS 5.10, SPARC)
by Claus Assmann 14 Mar '12

14 Mar '12

test060-mt-hot fails from time to time on SunOS 5.10 (SPARC). Is that a known problem? I can make the logs available (maybe on a webserver); they are large, so I don't want to send them to the list. >>>>> Starting test060-mt-hot for bdb... running defines.sh Running slapadd to build slapd database... 4f5a412b bdb_db_open: warning - no DB_CONFIG file found in directory /obj.SunOS.5.10.sun4/openldap/work/src/tests/testrun/db.1.a: (2). Expect poor performance for suffix "dc=example,dc=com". _#################### 100.00% eta none elapsed none fast! Closing DB... Running slapindex to index slapd database... Starting slapd on TCP/IP port 9011... /obj.SunOS.5.10.sun4/openldap/work/src/tests/../servers/slapd/slapd -s0 -f /obj.SunOS.5.10.sun4/openldap/work/src/tests/testrun/slapd.1.conf -h ldap://localhost:9011/ -d stats Testing basic monitor search... Monitor searches Testing basic mt-hot search: 1 threads (1 x 50000) loops... ./progs/slapd-mtread -H ldap://localhost:9011/ -D cn=Manager,dc=example,dc=com -w secret -e cn=Monitor -m 1 -L 1 -l 50000 Testing basic mt-hot search: 5 threads (1 x 10000) loops... ./progs/slapd-mtread -H ldap://localhost:9011/ -D cn=Manager,dc=example,dc=com -w secret -e cn=Monitor -m 5 -L 1 -l 10000 Testing basic mt-hot search: 100 threads (5 x 100) loops... ./progs/slapd-mtread -H ldap://localhost:9011/ -D cn=Manager,dc=example,dc=com -w secret -e cn=Monitor -m 100 -L 5 -l 100 Random searches Testing random mt-hot search: 1 threads (1 x 50000) loops... ./progs/slapd-mtread -H ldap://localhost:9011/ -D cn=Manager,dc=example,dc=com -w secret -e dc=example,dc=com -f (objectclass=*) -m 1 -L 1 -l 50000 Testing random mt-hot search: 5 threads (1 x 10000) loops... ./progs/slapd-mtread -H ldap://localhost:9011/ -D cn=Manager,dc=example,dc=com -w secret -e dc=example,dc=com -f (objectclass=*) -m 5 -L 1 -l 10000 Testing random mt-hot search: 100 threads (5 x 100) loops... ./progs/slapd-mtread -H ldap://localhost:9011/ -D cn=Manager,dc=example,dc=com -w secret -e dc=example,dc=com -f (objectclass=*) -m 100 -L 5 -l 100 Multiple threads and connection searches Testing basic mt-hot search: 5 threads 5 conns (1 x 10000) loops... ./progs/slapd-mtread -H ldap://localhost:9011/ -D cn=Manager,dc=example,dc=com -w secret -e cn=Monitor -c 5 -m 5 -L 1 -l 10000 slapd-mtread failed (1)! >>>>> test060-mt-hot failed for bdb (exit 1)

1 0

authenticating users !
by Alex Samad - Yieldbroker 14 Mar '12

14 Mar '12

Hi I have 2 backend db setup {2}bdb -> suffix: ou=external,dc=xyz,dc=com {3)ldap -> uri ldap://msad.xyz.com, suffix: dc=xyz,dc=com Say I have a user dn: cn=alex samad,cn=users, dc=xyz,dc=com I create an ldap alias record dn: uid=alex.samad(a)xyz.com, ou=external,dc=xyz,dc=com objectclass: top, extensibleObject, alias aliasedObjectName: cn=alex samad,cn=users, dc=xyz,dc=com I try and login with this DN "uid=alex.samad(a)xyz.com, ou=external,dc=xyz,dc=com" and it fails, when I logging with " cn=alex samad,cn=users, dc=xyz,dc=com " it works. So can I presume the authentication code doesn't follow ldap alias ? Alex

1 0

how to delete backend DB
by Alex Samad - Yieldbroker 14 Mar '12

14 Mar '12

Hi I am trying to delete a backend DB Currently have dn: olcDatabase={-1}frontend,cn=config dn: olcDatabase={0}config,cn=config dn: olcDatabase={1}monitor,cn=config dn: olcDatabase={2}bdb,cn=config I would like to delete olcDatabase={2}bdb,cn=config I tried ldapdelete -v "olcDatabase={2}bdb,cn=config" note- I have ~/.ldaprc setup with URI & SAS_MECH slapd will not let me do it ? I know I can shut down slapd and remove the file. But I am wondering if there is a "proper" way to do it Thanks Alex

2 3

problem about smooth migration from files to ldap
by huwenfeng 14 Mar '12

14 Mar '12

Hi all: I got a non-technical problem here. I have managed to solved the problem of using OpenLDAP to store user and group infomation and successfully logined into Linux Servers using OpenLDAP. In the Linux Server, i got LOCAL groups named like `devel` and `www`, and LOCAL users belong to these groups. Through the /etc/sudoers file, I give different groups with different privileges. In the OpenLDAP database, i defined my own `devel` and `www` groups. and users in OpenLDAP belongs to their corresponding groups. The problem is , if i add ldap into /etc/nsswitch.conf, then only the first pair of (users/groups) get the right privileges from /etc/sudoers. That means, if I put `ldap` before `files`, only the users login through OpenLDAP can use the privileges defined in /etc/sudoers. But if I put `files` before `ldap` in /etc/nsswitch.conf, then only Local (users/groups) pair got the privileges from /etc/sudoer2. I got a bad solution here: give different names to groups from OpenLDAP, and define new privileges in /etc/sudoers for these groups. and after migration, delete the old local groups and old sudo privileges. But this seems to be not that good a solution. I wonder, what might be the best or right way to migrate from (local user/group) to (ldap user/group) smoothly. Any clue or advice will be greatly appreciated. Thank you In advance.

3 3

OPENLDAP SYNCREPL
by Borresen, John - 0442 - MITLL 13 Mar '12

13 Mar '12

All, I've read and re-read (not to mentioned googled) configuring SyncRepl in OpenLDAP dynamic configuration (cn=config)--v2.4.23. Missing something somewhere. Current logging is set to "256" on both Provider and Consumer. On my Master/Provider LDAP server seeing the following: slapd shutdown: waiting for 0 operations/tasks to finish slapd shutdown: initiated bdb_modify: dc=group42,dc=ldap bdb_dn2entry("dc=group42,dc=ldap") bdb_modify_internal: 0x00000001: dc=group42,dc=ldap bdb_modify_internal: replace contextCSN => entry_encode(0x00000001): dc=group42,dc=ldap <= entry_encode(0x00000001): dc=group42,dc=ldap bdb_modify: updated id=00000001 dn="dc=group42,dc=ldap" send_ldap_result: conn=-1 op=0 p=0 send_ldap_result: err=0 matched="" text="" ====> bdb_cache_release_all ====> bdb_cache_release_all slapd destroy: freeing system resources. On my Consumer/Slave Server I am seeing the following: slapd destroy: freeing system resources. syncinfo_free: rid=001 slapd stopped. tail: /var/log/slapd: file truncated do_syncrep2: rid=001 got search entry without Sync State control do_syncrepl: rid=001 rc -1 retrying do_syncrep2: rid=001 got search entry without Sync State control do_syncrepl: rid=001 rc -1 retrying do_syncrep2: rid=001 got search entry without Sync State control do_syncrepl: rid=001 rc -1 retrying do_syncrep2: rid=001 got search entry without Sync State control do_syncrepl: rid=001 rc -1 retrying do_syncrep2: rid=001 got search entry without Sync State control do_syncrepl: rid=001 rc -1 retrying do_syncrep2: rid=001 got search entry without Sync State control do_syncrepl: rid=001 rc -1 retrying do_syncrep2: rid=001 got search entry without Sync State control do_syncrepl: rid=001 rc -1 retrying do_syncrep2: rid=001 got search entry without Sync State control do_syncrepl: rid=001 rc -1 retrying do_syncrep2: rid=001 got search entry without Sync State control do_syncrepl: rid=001 rc -1 retrying do_syncrep2: rid=001 got search entry without Sync State control do_syncrepl: rid=001 rc -1 retrying >From my readings, I understand that the "Sync State Control" error normally indicates that my provider is not set up correctly. As far as I can tell, my modules are correctly loaded and the overlays are loaded to the appropriate database (my case, bdb) to be replicated. The following is from the Provider/Master LDAP Server: My olcDatabase-{1}bdb.ldif (truncated): # more olcDatabase={1}bdb.ldif dn: olcDatabase={1}bdb objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcSuffix: dc=group42,dc=ldap olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=ldapadmin,dc=group42,dc=ldap olcRootPW:: ******* olcSyncUseSubentry: FALSE olcMonitoring: TRUE olcDbDirectory: /var/lib/ldap_db/openldap-data olcDbCacheSize: 1000 ... olcDbNoSync: FALSE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 0 olcDbIndex: objectClass eq olcDbIndex: sn eq,sub olcDbIndex: mail eq,sub olcDbIndex: departmentNumber eq olcDbIndex: cn,uid eq,sub olcDbIndex: uidNumber eq olcDbIndex: entryCSN eq olcDbIndex: entryUUID eq olcDbIndex: ipHostNumber eq olcDbIndex: gidNumber,memberUID eq olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 structuralObjectClass: olcBdbConfig entryUUID: 101e6d86-dd1c-4eaa-a26e-d7e201a727f8 creatorsName: cn=config createTimestamp: 20111219143532Z olcDbSearchStack: 32 olcAccess: {0} to attrs=userPassword,shadowLastChange by self write by anonymo us auth by * none olcAccess: {1} to * by * read olcDatabase: {1}bdb entryCSN: 20120313143637.046410Z#000000#001#000000 modifiersName: cn=config modifyTimestamp: 20120313143637Z # ll olcDatabase={1}bdb total 16 -rw------- 1 ldap ldap 453 Mar 12 10:50 olcOverlay={0}syncprov.ldif -rw------- 1 ldap ldap 505 Feb 29 11:16 olcOverlay={1}accesslog.ldif The olcOverlay={0}syncrpov.ldif # more olcDatabase={1}bdb/olcOverlay={0}syncprov.ldif dn: olcOverlay={0}syncprov objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpNoPresent: TRUE structuralObjectClass: olcSyncProvConfig entryUUID: 8572b589-f594-44a6-91fe-0de741afbcca creatorsName: cn=admin,cn=config createTimestamp: 20120224171809Z olcSpReloadHint: TRUE olcSpCheckpoint: 1000 60 entryCSN: 20120312145000.123929Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20120312145000Z The olcOverlay={1}accesslog.ldif: # more olcDatabase={1}bdb/olcOverlay={1}accesslog.ldif dn: olcOverlay={1}accesslog objectClass: olcOverlayConfig objectClass: olcAccessLogConfig olcOverlay: {1}accesslog olcAccessLogDB: cn=accesslog olcAccessLogOps: writes olcAccessLogPurge: 07+00:00 01+00:00 olcAccessLogSuccess: TRUE structuralObjectClass: olcAccessLogConfig entryUUID: eea1e438-6385-4660-807b-bb270eb4843a creatorsName: cn=admin,cn=config createTimestamp: 20120229161649Z entryCSN: 20120229161649.880441Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20120229161649Z ***The following is on the Consumer/Slave Server*** The olcDatabase={2}bdb.ldif (truncated): # more olcDatabase={2}bdb.ldif dn: olcDatabase={2}bdb objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcSuffix: dc=group42,dc=ldap olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=ldapadmin,dc=group42,dc=ldap olcRootPW:: ********* olcMonitoring: TRUE olcDbDirectory: /var/lib/ldap_db/openldap-data olcDbCacheSize: 1000 ... olcDbNoSync: FALSE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 0 olcDbIndex: objectClass eq olcDbIndex: cn,uid eq,sub olcDbIndex: sn eq,sub olcDbIndex: mail eq,sub olcDbIndex: departmentNumber eq olcDbIndex: entryCSN eq olcDbIndex: entryUUID eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbSearchStack: 16 olcAccess: {0} to attrs=userPassword,shadowLastChange by self write by anonymo us auth by * none olcAccess: {1} to * by * read olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 structuralObjectClass: olcBdbConfig entryUUID: e6971058-e0f0-4160-aaca-a18b24d22008 creatorsName: cn=config createTimestamp: 20120229205835Z olcDatabase: {2}bdb olcUpdateRef: ldaps://gp42-admin2.group42.ldap:636 olcMirrorMode: TRUE olcSyncrepl: {0}rid=1 provider=ldaps://gp42-admin2.group42.ldap:636 bindmethod =simple binddn="cn=ldapadmin,dc=group42,dc=ldap" credentials=******* interva l=01:00:00:00 searchbase="dc=group42,dc=ldap" logbase="cn=accesslog" schemach ecking=on type=refreshAndPersist retry="60 +" filter="(objectClass=*)" attrs= "*,+" syncdata=accesslog starttls=no tls_cacertdir=/usr/local/openldap-2.4.23 /etc/openldap/cacerts entryCSN: 20120313150609.224840Z#000000#000#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20120313150609Z Not sure what I am missing, nor where I am missing it. Any assistance would be helpful. Dave Borresen Solaris/Linux Systems Administrator Surveillance Systems Group MIT Lincoln Laboratory 244 Wood Street Lexington, MA 02420 P: 781-981-2954 F: 781-981-5344 john.borresen(a)ll.mit.edu

3 6

Re: olcTLSVerifyClient: demand not taking effect
by Peter Wood 13 Mar '12

13 Mar '12

On Mon, Mar 12, 2012 at 9:41 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Monday, March 12, 2012 6:52 PM -0700 Peter Wood < > peterwood.sd(a)gmail.com> wrote: > > Hi, >> >> >> I setup openldap-2.4.23 server >> > > Why? I'd suggest you start with the current release, 2.4.30. You may > also want to look at <http://www.openldap.org/its/**index.cgi/?findid=7197<http://www.openldap.org/its/index.cgi/?findid=7197> > > > > That's the openldap version in centos6.2 repo. In production I try to stick with stock versions. Also I tried all variations of olcTLSVerifyClient: [demand|hard|true] with the same result. I don't think StartTLS is enabled. I'm wondering if just setting olcTLSCACertificateFile, olcTLSCertificateFile and olcTLSCertificateKeyFile is enough to get StartTLS enabled. It's very frustrating. I'd hate to go to ldaps just because I can't get StartTLS working. Is there anything else I have to set on the server to get StartTLS working? Thanks Peter

6 6

RE: OPENLDAP SYNCREPL
by Quanah Gibson-Mount 13 Mar '12

13 Mar '12

--On Tuesday, March 13, 2012 2:36 PM -0400 "Borresen, John - 0442 - MITLL" <john.borresen(a)ll.mit.edu> wrote: > Thanks, Howard; You are clearly missing the syncprov overlay on the accesslog DB, as I already stated. If you fix that, you'll get a lot further. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

RE: OPENLDAP SYNCREPL
by Quanah Gibson-Mount 13 Mar '12

13 Mar '12

--On Tuesday, March 13, 2012 1:12 PM -0400 "Borresen, John - 0442 - MITLL" <john.borresen(a)ll.mit.edu> wrote: > Thanks, Quanah; > > As requested: > > cn=config]# ll > total 140 > -rw------- 1 ldap ldap 398 Jan 24 11:28 cn=module{0}.ldif > -rw------- 1 ldap ldap 398 Feb 8 14:02 cn=module{1}.ldif > -rw------- 1 ldap ldap 397 Feb 21 09:06 cn=module{2}.ldif > -rw------- 1 ldap ldap 399 Feb 24 12:32 cn=module{3}.ldif You really don't need 4 separate files. ;) Use my cn=module{0}.ldif as a template for fixing yours. ;) I would also note that you're using delta-syncrepl, not syncrepl, and you failed to provide any of the configuration for the accesslog DB on the provider. My guess is that is the actual source of the error you are encountering. I.e., my guess is that you never loaded the syncprov overlay on the master's accesslog DB, which is also required. Here's an example configuration from my master's cn=accesslog configuration for the syncprov overlay there. Note that they *do* differ between your primary DB and your accesslog DB. root@zre-ldap002:/opt/zimbra/data/ldap/config/cn=config# ls olcDatabase\=\{2\}mdb olcOverlay={0}syncprov.ldif root@zre-ldap002:/opt/zimbra/data/ldap/config/cn=config# cat olcDatabase\=\{2\}mdb/olcOverlay\=\{0\}syncprov.ldif # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 fd177258 dn: olcOverlay={0}syncprov objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpNoPresent: TRUE olcSpReloadHint: TRUE structuralObjectClass: olcSyncProvConfig entryUUID: e97228d0-edf0-1030-98ed-dbd1519e60e2 creatorsName: cn=config createTimestamp: 20120217202252Z entryCSN: 20120217202252.161808Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20120217202252Z --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re-binding to a failed connection segfaults
by Jan Synacek 13 Mar '12

13 Mar '12

Hi list, I've created a small reproducer, that calls ldap_sasl_interactive_bind_s after it has been called once and failed, which causes a segfault. I've traced this bug with gdb: $ gdb ./reproducer GNU gdb (GDB) Fedora (7.3.50.20110722-10.fc16) Copyright (C) 2011 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-redhat-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /home/jsynacek/work/bz784989-openldap-rebinding/reproducer...done. (gdb) r Starting program: /home/jsynacek/work/bz784989-openldap-rebinding/reproducer [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib64/libthread_db.so.1". ldap_sasl_interactive_bind: user selected: GSSAPI ldap_int_sasl_bind: GSSAPI ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP localhost:636 ldap_new_socket: 7 ldap_prepare_socket: 7 ldap_connect_to_host: Trying ::1 636 ldap_pvt_connect: fd: 7 tm: -1 async: 0 TLS: error: tlsm_PR_Recv returned 0 - error 21:Is a directory TLS: error: connect - force handshake failure: errno 21 - moznss error -5938 TLS: can't connect: TLS error -5938:Encountered end of file. ldap_msgfree ldap_err2string bind failed: Can't contact LDAP server, retrying for fun and profit! ldap_sasl_interactive_bind: user selected: GSSAPI ldap_int_sasl_bind: GSSAPI Program received signal SIGSEGV, Segmentation fault. ldap_int_sasl_bind (ld=0x603130, dn=0x0, mechs=0x401a30 "GSSAPI", sctrls=0x0, cctrls=0x0, flags=1, interact=0x401660 <lutil_sasl_interact>, defaults=0x60cae0, result=0x0, rmech=0x7fffffffd878, msgid=0x7fffffffd88c) at ../../../libraries/libldap/cyrus.c:444 444 oldctx = ld->ld_defconn->lconn_sasl_authctx; (gdb) p ld->ldc->ldc_defconn $1 = (LDAPConn *) 0x0 If you set slapd to use TLS certs (uncomment the 'TLS*' lines in the config), there is no segfault. Reproducer and cn=config.ldif attached. Original bugreport: https://bugzilla.redhat.com/show_bug.cgi?id=784989 Regards, -- Jan Synacek BaseOS team Brno

2 1

olcTLSVerifyClient: demand not taking effect
by Peter Wood 13 Mar '12

13 Mar '12

Hi, I setup openldap-2.4.23 server on centos6.2 using cn=config. The server itself doesn't authenticate through ldap. Network clients are able to authenticate but the network traffic is unencrypted. Next step is to configure SSL/TLS. I was reading multiple sources of documentation, trying to understand what I'm doing not just follow instructions. I created a CA, generated certificate for the server and setup these in cn=config: olcTLSCACertificateFile: /etc/openldap/cacerts/CA.crt olcTLSCertificateFile: /etc/pki/tls/certs/ldapserver.crt olcTLSCertificateKeyFile: /etc/pki/tls/private/ldapserver-nopass.key olcTLSVerifyClient: demand I was expecting that after slapd restart clients will not being able to authenticate but they still can and the traffic is still unencrypted. On the server if I run tcpdump I can clearly see usernames and passwords. Service slapd is running as user ldap and I made sure the user has read access to all cert files and private keys. I enabled logging level "olcLogLevel: stats" but I don't see any errors in the log file. Shouldn't "olcTLSVerifyClient: demand" drop the connection if the client doesn't provide valid certificate? Thank you for any pointers. -- Peter

2 1

Dynamic to Static LDAP
by Gaurav Gugnani 13 Mar '12

13 Mar '12

Hello All, We are using openldap 2.4 in our systems with berkley DB as a backend. Now, in current scenario we are using static LDAP i.e. /etc/openldap/slapd.conf and whenever we want to change any configuration parameter then we need to re-start LDAP. So, we decided to switch to dynamic LDAP i.e. using cn=config. So, *my Q's is:* I made my system running on dynamic LDAP like from past 2 months and in this span of time i implemented several changes. Now, suppose today i plan to again move back to use static configuration - Will i able to save all my changes what i did in all this time? OR All changes made are lost? If Lost - Is there any way to retrieve the changes which i made? Please suggest. Thanks and Regards, Gaurav Gugnani

4 5

How to Modify OpenLDAP Entry for Replication
by Scott McLane Gardner 12 Mar '12

12 Mar '12

OpenLDAP newbie here, hopefully this is the right list to send this sort of thing to. I have successfully set up two OpenLDAP servers one as the master and the other replicating the masters database using the instructions in the ubuntu documentation, here: https://help.ubuntu.com/11.10/serverguide/C/openldap-server.html#openldap-s erver-replication What I'd like to do now is change the admin password on the master, but that will break the replication. How can I change the consumer configuration (further down the page linked above) to update it with the new password? I'm sure that using ldapmodify is probably what I want, I just don't know enough to do it correctly.

1 0

Large delay before transmitting search result
by Rene B. Elgaard 12 Mar '12

12 Mar '12

Hello, OpenLDAP 2.4.26 + BerkeleyDB 5.2.28, also seen on OpenLDAP 2.4.22 + BerkeleyDB 4.6.21 I am trying to investigate a response time issue. Basically I am doing a search with ldapsearch that results in the transfer of an 8.5 Mb binary entry. This takes around 800 ms measured on the server itself from the request has been received until the response has been delivered.. Looking at what is going on on the network I see a large delay between slapd receiving the search request and the actual start of the transfer. This delay accounts for around 600ms. So what is going on during this time ? I am on Solaris 10, so I use dtrace to look at slapd, and it turns out that it calls memmove(<ADDR>,<ADDR> + 1, ~8.5 Mb). That is it shifts the result 1 byte, and it does this 4 times. Each memmove takes around 150 ms, which accounts almost completely for the delay before doing the transfer over network. I have written a small C program which does the same memmove and verified that on my setup, it does indeed take 150ms to shift 8.5 Mb 1 byte. The stacktrace up until each memmove is 0 42451 memmove:entry *** Moving from 213650401 to 213650402 *** libc.so.1`memmove slapd`0x82461c9 slapd`ber_printf+0x4ff slapd`slap_send_search_entry+0x1a94 slapd`bdb_search+0x1ce0 slapd`fe_op_search+0x574 slapd`do_search+0xc82 slapd`0x80927a9 slapd`0x8092d21 slapd`0x8210034 The first line shows the source and destination address for memmove. The numbers themselves are not interesting, but the difference (1) is. Why is it shifting the buffer 1 byte ? If this could be optimized somehow, it could lead to a huge improvement in response time. Thanks, Rene

4 3

Re: slow or inconsistent syncrepl
by Amol Kulkarni 11 Mar '12

11 Mar '12

I see that I'm outdated in my tuning as per http://wiki.zimbra.com/wiki/OpenLDAP_Performance_Tuning. I'll do these changes and observe the servers. In the mean time a new observation regarding syncrepl is that if I do ldapmodify for 5 - 10 entries in one go the changes get replicated but if I change about 300 entries in one go, then some entries do not get replicated on some servers. These changes dont get replicated until I change those entries again. Does this indicate provider resource problem or consumer resource problem ( or normal behaviour ) ? ----- Original Message ----- From: Quanah Gibson-Mount Sent: 03/11/12 02:05 AM To: Amol Kulkarni, Howard Chu Subject: Re: slow or inconsistent syncrepl --On Saturday, March 10, 2012 2:34 PM +0100 Amol Kulkarni <amolkulkarni(a)gmx.com> wrote: > > >>> That depends entirely on the speed of your server and network. > > Taking the server part first - I'm also doubt that my provider server is > underpowered. > > Following are the ldap specific parameters on our provider server : > > entries : 0.5 million > avg entry size : 1k to 4k > cachesize : 0.5 million > dncachesize : 0.5 million > database type : bdb > bdb cachesize : 3 gb > ldap threads : 16 > > Foll is hardware configuration of the provider server : > ram : 8gb > swap : 8gb > cpu : Virtual machine with 4 cpus. (vmware vsphere) > architecture : 64 bit > > Also we have some administrative services/tasks running on the provider > server other than openldap. But the sar output seems normal i.e iowait > below 10 and idle time above 50. > > Does the hardware configuration seem ok for the given ldap size and > configuration ? > > If not, can u suggest some changes? You don't provide any useful information for suggesting changes. I would advise you read over <http://wiki.zimbra.com/wiki/OpenLDAP_Performance_Tuning> -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

Re: slow or inconsistent syncrepl
by Amol Kulkarni 10 Mar '12

10 Mar '12

>>That depends entirely on the speed of your server and network. Taking the server part first - I'm also doubt that my provider server is underpowered. Following are the ldap specific parameters on our provider server : entries : 0.5 million avg entry size : 1k to 4k cachesize : 0.5 million dncachesize : 0.5 million database type : bdb bdb cachesize : 3 gb ldap threads : 16 Foll is hardware configuration of the provider server : ram : 8gb swap : 8gb cpu : Virtual machine with 4 cpus. (vmware vsphere) architecture : 64 bit Also we have some administrative services/tasks running on the provider server other than openldap. But the sar output seems normal i.e iowait below 10 and idle time above 50. Does the hardware configuration seem ok for the given ldap size and configuration ? If not, can u suggest some changes? Thanks and Regards, Amol Kulkarni. ----- Original Message ----- From: Howard Chu Sent: 03/10/12 01:29 PM To: Amol Kulkarni Subject: Re: slow or inconsistent syncrepl Amol Kulkarni wrote: > Dear Quanah, > > Thanks a lot for these 2 pointers. I'll check out the 2.4.30 version. > We had used delta syncrepl earlier but our accesslog size used to grow > suddenly sometimes and the disk used to get full crashing/hanging the ldap > service itself on the provider. But at that time we had kept the max age for > the accesslog to be 7 days. I'll reduce it and give it a try again. > > Also it would be helpful if you can throw some light on : > > 2. On a really busy ldap server, can replication slow down drastically? i.e > does the read operations affect the replication in any way? Syncrepl executes as an LDAP Search operation, so of course it competes for server resources with other Search activity on the server. > 4. We are currently having about 60 consumers - is this too much ? What can be > the max numbers of consumers ? That depends entirely on the speed of your server and network. If you're seeing that replication speed is inconsistent, you probably should reduce the load on the provider. A simple approach in your scenario would be to just point the 10 consumers on the fast LAN at the provider, and configure these consumers to act as providers for your WAN nodes (i.e., cascaded replication). > 5. Sometimes we urgently need some particular node to be present on the > consumer - for which we cannot wait - in that case we get ldif of that node > from provider and do ldapadd on the consumer ( mirrormode is ON on the > consumers ). Is this safe and correct or could it cause some side effects ? Is > there a better way to handle it? If you have configured distinct serverIDs for each consumer, this might work. Otherwise, no, not safe, not correct. Fix your configuration layout, or fix your apps. If your apps can't wait then they are mis-designed; there is no such thing as instantaneous propagation of information in the real world. > Thanks and Regards, > Amol Kulkarni. > >> ----- Original Message ----- >> >> From: Quanah Gibson-Mount >> >> Sent: 03/09/12 11:57 PM >> >> To: Amol Kulkarni, openldap-technical(a)openldap.org >> >> Subject: Re: slow or inconsistent syncrepl >> >> >> >> --On Friday, March 09, 2012 2:20 PM +0100 Amol Kulkarni >> <amolkulkarni(a)gmx.com> wrote: >> >> > I have a following openldap setup with syncrepl : >> > - openldap version 2.4.23 >> >> This is your #1 issue. >> >> > - 1 provider and about 10 consumers in lan and 50 consumers on wan >> >> This is your #2 issue. >> >> Upgrade to a stable release. Use delta-syncrepl, which uses significantly >> less bandwidth than syncrepl. >> >> --Quanah >> >> -- >> >> Quanah Gibson-Mount >> Sr. Member of Technical Staff >> Zimbra, Inc >> A Division of VMware, Inc. >> -------------------- >> Zimbra :: the leader in open source messaging and collaboration -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

OpenLDAP 2.4 : replication doesn't work when customer is stopped
by PROST Frédéric 10 Mar '12

10 Mar '12

Hello, I configured MirrorMode replication between 2 openldap 2.4 node installed on Debian (from apt). Everything is working fine when the two nodes are online but if I stop the second node, and add new datas to the first node, then restart the second node, the new data are not synced. However, if I then add new datas on node 1, they are replicated to node2 without problem. Here is a scenario of this problem : 1/ node1 and node 2 are online : I add user1 to node 1 => user1 appears on node2 => ok 2/ node1 is online and node2 is off : I add user2 on node1 => nothing happens on node2 as it is off => ok 3/ I restart node2 => user2 is not replicated to node2 => not ok 4/ node1 and node 2 are online : I add user3 to node 1 => user3 appears on node2 => ok At the end of this scenario, node1 contains user1, user2 and user3 and node2 contains only user1 and user3 (but not user2). How can I slove this problem ? Thank you for your help, Best regards, Fred Here is my config : version: 1 dn: cn=config objectClass: olcGlobal cn: config olcAllows: bind_v2 olcArgsFile: /var/run/slapd/slapd.args olcLogLevel: any olcPidFile: /var/run/slapd/slapd.pid olcServerID: 1 ldap://192.168.1.103 olcServerID: 2 ldap://192.168.1.104 olcSizeLimit: 1000000 olcToolThreads: 1 dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModuleLoad: {0}back_hdb olcModuleLoad: {1}syncprov olcModulePath: /usr/lib/ldap dn: olcBackend={0}hdb,cn=config objectClass: olcBackendConfig olcBackend: {0}hdb dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: {-1}frontend olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=extern al,cn=auth manage by * break olcAccess: {1}to dn.exact="" by * read olcAccess: {2}to dn.base="cn=Subschema" by * read olcSizeLimit: 500 dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.exact="uid=syncrepl,dc=tracteur91,dc=local" read by * break olcAccess: {1}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=extern al,cn=auth manage by * break olcLimits: {0}dn.exact="uid=syncrepl,dc=tracteur91,dc=local" size=unlimited olcMirrorMode: TRUE olcRootDN: cn=admin,cn=config olcRootPW: {MD5}BkY718PMIcgBNjpfXmGpOA== olcSyncrepl: {0}rid=001 provider="ldap://192.168.1.103" searchbase="cn=confi g" type=refreshAndPersist bindmethod=simple binddn="uid=syncrepl,dc=tracteu r91,dc=local" credentials="Tr@cteur91" retry="30 +" network-timeout=5 timeo ut=30 olcSyncrepl: {1}rid=002 provider="ldap://192.168.1.104" searchbase="cn=confi g" type=refreshAndPersist bindmethod=simple binddn="uid=syncrepl,dc=tracteu r91,dc=local" credentials="Tr@cteur91" retry="30 +" network-timeout=5 timeo ut=30 dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpCheckpoint: 100 5 dn: olcDatabase={1}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcAccess: {0}to * by dn.exact="uid=syncrepl,dc=tracteur91,dc=local" read by * break olcAccess: {1}to attrs=userPassword,shadowLastChange by self write by anonym ous auth by dn="cn=admin,dc=tracteur91,dc=local" write by * none olcAccess: {2}to dn.base="" by * read olcAccess: {3}to * by self write by dn="cn=admin,dc=tracteur91,dc=local" wri te by * read olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq olcDbIndex: uid eq olcDbIndex: cn eq olcDbIndex: ou eq olcDbIndex: dc eq olcDbIndex: entryCSN eq olcDbIndex: entryUUID eq olcLastMod: TRUE olcLimits: {0}dn.exact="uid=syncrepl,dc=tracteur91,dc=local" size=unlimited olcMirrorMode: TRUE olcRootDN: cn=admin,dc=tracteur91,dc=local olcRootPW: {SSHA}ZtvvlHUQYloI17cv2/cjPFmx51+Ut/+5 olcSuffix: dc=tracteur91,dc=local olcSyncrepl: {0}rid=003 provider="ldap://192.168.1.103" searchbase="dc=tract eur91,dc=local" type=refreshAndPersist bindmethod=simple binddn="uid=syncre pl,dc=tracteur91,dc=local" credentials="Tr@cteur91" retry="30 +" network-ti meout=5 timeout=30 olcSyncrepl: {1}rid=004 provider="ldap://192.168.1.104" searchbase="dc=tract eur91,dc=local" type=refreshAndPersist bindmethod=simple binddn="uid=syncre pl,dc=tracteur91,dc=local" credentials="Tr@cteur91" retry="30 +" network-ti meout=5 timeout=30 dn: olcOverlay={0}syncprov,olcDatabase={1}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpCheckpoint: 100 5

3 8

Re: slow or inconsistent syncrepl
by Amol Kulkarni 10 Mar '12

10 Mar '12

Dear Quanah, Thanks a lot for these 2 pointers. I'll check out the 2.4.30 version. We had used delta syncrepl earlier but our accesslog size used to grow suddenly sometimes and the disk used to get full crashing/hanging the ldap service itself on the provider. But at that time we had kept the max age for the accesslog to be 7 days. I'll reduce it and give it a try again. Also it would be helpful if you can throw some light on : 2. On a really busy ldap server, can replication slow down drastically? i.e does the read operations affect the replication in any way? 4. We are currently having about 60 consumers - is this too much ? What can be the max numbers of consumers ? 5. Sometimes we urgently need some particular node to be present on the consumer - for which we cannot wait - in that case we get ldif of that node from provider and do ldapadd on the consumer ( mirrormode is ON on the consumers ). Is this safe and correct or could it cause some side effects ? Is there a better way to handle it? Thanks and Regards, Amol Kulkarni. ----- Original Message ----- From: Quanah Gibson-Mount Sent: 03/09/12 11:57 PM To: Amol Kulkarni, openldap-technical(a)openldap.org Subject: Re: slow or inconsistent syncrepl --On Friday, March 09, 2012 2:20 PM +0100 Amol Kulkarni <amolkulkarni(a)gmx.com> wrote: > I have a following openldap setup with syncrepl : > - openldap version 2.4.23 This is your #1 issue. > - 1 provider and about 10 consumers in lan and 50 consumers on wan This is your #2 issue. Upgrade to a stable release. Use delta-syncrepl, which uses significantly less bandwidth than syncrepl. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

slow or inconsistent syncrepl
by Amol Kulkarni 09 Mar '12

09 Mar '12

I have a following openldap setup with syncrepl : - openldap version 2.4.23 - 1 provider and about 10 consumers in lan and 50 consumers on wan - The replication type is push - refreshAndPersist. - There are about 0.5 million nodes - The physical size of ldap folder is about 5gb. - All the lan servers have identical hardware configuration. I have following problems/questions. 1. We observe that LDAP replication works better on one server as opposed to another in same LAN and having the same configuration ? Is ldap replication affected by the ldap read operations on the consumers? So if 2 consumers are getting different amount of ldap reads, will replication speed be different? 2. On a really busy ldap server, can replication slow down drastically? 3. We find that even though the contextcsn of provider & consumer is same - actually there are nodes which are different and there are nodes which are not added or deleted. So we have created a custom script which compares entrycsn's of each and every node. Is this ok ? 4. We are currently having about 60 consumers - is this too much ? What can be the max numbers of consumers ? 5. Sometimes we urgently need some particular node to be present on the consumer - for which we cannot wait - in that case we get ldif of that node from provider and do ldapadd on the consumer ( mirrormode is ON on the consumers ). Is this safe and correct or could it cause some side effects ? Kindly help me in troubleshooting these issues. Right now I cant think of what server configuration I could provide so I dint give it in this mail so pls tell me if anyone needs some particular configuration. Thanks and Regards, Amol Kulkarni.

4 4

Re: configure options
by Brett ＠Google 09 Mar '12

09 Mar '12

Turned out there was an LD_LIBRARY_PATH used for the already running openldap, but was set, so the "make test" prior to installation, was run against the installed libraries, instead of the newly compiled (but as yet uninstalled) ones in the build directory. Arguably the test could "unset LD_LIBRARY_PATH" but that variable might be used to find berkeley dn or other thrid part libraries, so maybe LD_LIBRARY_PATH="`pwd`/libraries/liblber/.libs `pwd`/libraries/libldap/.libs" to the script that launches tests ? Has there ever been any thought of having a --with-bdb=<prefix> which implies the addition of CPPFLAGS="-I<prefix>/include" and LDFLAGS="-L<prefix>/lib" and similarly for things like --with-ssl=<another prefix> ? Personally i alway have to add -R<prefix>/lib also, but this varies by platform, eg. linux has removed this in preference of a gcc option which passes options through to the linker, so it's probably hard to do in a platform-agnostic manner. On Fri, Mar 9, 2012 at 12:07 PM, Howard Chu <hyc(a)symas.com> wrote: > Quanah Gibson-Mount wrote: > >> --On Friday, March 09, 2012 10:49 AM +1000 "Brett @Google" >> <brett.maxfield(a)gmail.com> wrote: >> >> Hello, >>> >>> Are the tests in test050 (multimaster concurrency) for release 2.4.30, >>> still likely or expected to fail on solaris 10 with bdb 4.8.30 ? >>> >>> We dont use multimaster, but at one point in recent history the tests in >>> test050 (multimaster concurrency) were expected to fail. >>> >>> I'll log an ITS if it is now unexpected for this test to fail.. >>> >>> Cheers >>> Brett >>> >>> Waiting 5 seconds for slapd to start... >>> Waiting 5 seconds for slapd to start... >>> 29490 Segmentation Fault - core dumped >>> >> >> segmentation faults are never expected. You should file an ITS with the >> backtrace on the core file. >> > > And the last few lines of slapd.1.log. > > -- > -- Howard Chu > CTO, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc/ > Chief Architect, OpenLDAP http://www.openldap.org/**project/<http://www.openldap.org/project/> > -- *The only thing that interferes with my learning is my education.* * Albert Einstein*

1 0

fw: multimaster
by Brett ＠Google 09 Mar '12

09 Mar '12

Hello, Are the tests in test050 (multimaster concurrency) for release 2.4.30, still likely or expected to fail on solaris 10 with bdb 4.8.30 ? We dont use multimaster, but at one point in recent history the tests in test050 (multimaster concurrency) were expected to fail. I'll log an ITS if it is now unexpected for this test to fail.. Cheers Brett Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... 29490 Segmentation Fault - core dumped Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... Waiting 5 seconds for slapd to start... ldapsearch failed (255)! ./scripts/test050-syncrepl-multimaster: kill: no such process >>>>> test050-syncrepl-multimaster failed for hdb (exit 255) *** Error code 255 The following command caused the error: ./run -b hdb all make: Fatal error: Command failed for target `hdb-yes' Current working directory /home/govops/build/openldap/openldap-2.4.30/tests *** Error code 1 The following command caused the error: make hdb make: Fatal error: Command failed for target `test' Current working directory /home/govops/build/openldap/openldap-2.4.30/tests gmake: *** [test] Error 1 -- *The only thing that interferes with my learning is my education.* * Albert Einstein*

3 2

multi-master syncrepl with sasl/gssapi authentication
by travis.bean＠assuretech.net 08 Mar '12

08 Mar '12

I am having trouble getting multi-master syncrepl to sync when using "bindmethod=sasl" and "saslmech=gssapi". I achieved success when I tried "bindmethod=simple", so at least I know it has been narrowed down to a sasl/gssapi authentication problem (incorrect/missing sasl AuthzRegexp or perhaps an incorrect/missing slapd ACL?). My syncrepl config is as follows (do I need to specify an authcid/authzid or is this id automatically obtained from gssapi?): olcMirrorMode: TRUE olcSyncRepl: rid=001 provider=ldap://or-dc1-db.example.corp retry="5 10 30 +" bindmethod=sasl saslmech=gssapi type=refreshAndPersist searchbase="cn=config" olcSyncRepl: rid=002 provider=ldap://or-dc2-db.example.corp retry="5 10 30 +" bindmethod=sasl saslmech=gssapi type=refreshAndPersist searchbase="cn=config" # Syncprov overlay dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov olcMirrorMode: TRUE olcSyncRepl: rid=003 provider=ldap://or-dc1-db.example.corp retry="5 10 30 +" bindmethod=sasl saslmech=gssapi type=refreshAndPersist searchbase="dc=example,dc=corp" olcSyncRepl: rid=004 provider=ldap://or-dc2-db.example.corp retry="5 10 30 +" bindmethod=sasl saslmech=gssapi type=refreshAndPersist searchbase="dc=example,dc=corp" # Syncprov overlay dn: olcOverlay=syncprov,olcDatabase={1}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov My access control: olcAccess: to attrs=userPassword,shadowLastChange by dn="uid=ldap-admin,ou=people,dc=example,dc=corp" write by dn="uid=ldap/or-dc1-db.example.corp,cn=example.corp,cn=gssapi,cn=auth" write by dn="uid=ldap/or-dc2-db.example.corp,cn=example.corp,cn=gssapi,cn=auth" write by anonymous auth by self write by * none olcAccess: to dn.subtree="ou=krb5,dc=example,dc=corp" by dn="cn=kdc-srv,ou=krb5,dc=example,dc=corp" read by dn="cn=adm-srv,ou=krb5,dc=example,dc=corp" write by * none olcAccess: to * by dn="uid=ldap-admin,ou=people,dc=example,dc=corp" write by dn="uid=ldap/or-dc1-db.example.corp,cn=example.corp,cn=gssapi,cn=auth" write by dn="uid=ldap/or-dc2-db.example.corp,cn=example.corp,cn=gssapi,cn=auth" write by peername.ip="192.168.0.0%255.255.255.0" read My sasl AuthzRegexp: olcAuthzRegexp: uid=([^,]+),cn=example.corp,cn=gssapi,cn=auth uid=$1,ou=people,dc=example,dc=corp I know sasl/gssapi are working since ldapwhoami on or-dc1-db returns: SASL/GSSAPI authentication started SASL username: ldap/or-dc1-db.example.corp(a)EXAMPLE.CORP SASL SSF: 56 SASL data security layer installed. dn:uid=ldap/or-dc1-db.example.corp,ou=people,dc=example,dc=corp ldapwhoami on or-dc2-db returns: SASL/GSSAPI authentication started SASL username: ldap/or-dc2-db.example.corp(a)EXAMPLE.CORP SASL SSF: 56 SASL data security layer installed. dn:uid=ldap/or-dc2-db.example.corp,ou=people,dc=example,dc=corp I get the following /var/log/syslog errors on or-dc1-db: OR-DC1-DB slapd[5446]: slap_client_connect: URI=ldap://or-dc2-db.example.corp ldap_sasl_interactive_bind_s failed (-2) OR-DC1-DB slapd[5446]: do_syncrepl: rid=004 rc -2 retrying OR-DC1-DB slapd[5446]: slap_client_connect: URI=ldap://or-dc2-db.example.corp ldap_sasl_interactive_bind_s failed (-2) OR-DC1-DB slapd[5446]: do_syncrepl: rid=002 rc -2 retrying /var/log/syslog errors on or-dc2-db: OR-DC2-DB slapd[5455]: slap_client_connect: URI=ldap://or-dc1-db.example.corp ldap_sasl_interactive_bind_s failed (-2) OR-DC2-DB slapd[5455]: do_syncrepl: rid=003 rc -2 retrying OR-DC2-DB slapd[5455]: slap_client_connect: URI=ldap://or-dc1-db.example.corp ldap_sasl_interactive_bind_s failed (-2) OR-DC2-DB slapd[5455]: do_syncrepl: rid=001 rc -2 retrying

3 3

replication without making the consumer database readonly
by Wuensche Michael 08 Mar '12

08 Mar '12

I have an Openldap 2.4 environment with 2 servers, one serving as provider for 2 databases and one as consumer. On one of the databases I only want to replicate certain entries, filtered by objectclass. I use sync repl for replication. Now I would like to be able to write database entries on the consumer server, which are not covered by the filter and so are not replicated. But Openldap sends me a referral to the master on write attempts if I use the updateref directive. If I don't use this directive, I get error 53: unwilling to perform. Is there a way to have part of a databases entries to be replicated and others being allowed to write locally? Alternatively I'm considering to split the suffix into several databases. Kind regards, Michael

1 0

[SOLVED] RE: OpenLDAP 2.4 : replication doesn't work when customer is stopped
by PROST Frédéric 08 Mar '12

08 Mar '12

After so many days of testing I finally found the solution, which is working on both the last version built from source and the Debian version : I found it thanks to this post : http://www.openldap.org/lists/openldap-technical/201008/msg00274.html When we check the csn value it appears that ServerID is not transmitted : csn=20120308091919.539118Z#000000#000#000000 (the string #000# should be serverID) . To correct this problem, I simply changed the slapd -h option in my startup script (/etc/default/slapd on Debian) from : SLAPD_SERVICES="ldap:/// ldapi:///" To : SLAPD_SERVICES="ldap://<ip or hostname of the server (same as oclServerID)>" This has to be done on both nodes with the correct IP. Then, my csn is now someting like : csn=20120308111043.060040Z#000000#001#000000 (note the #001# corresponding to the serverId) Then retart the server and everything is runnig fine. Regards, -- Frédéric PROST -----Message d'origine----- De : Quanah Gibson-Mount [mailto:quanah@zimbra.com] Envoyé : mercredi 7 mars 2012 18:02 À : PROST Frédéric; openldap-technical(a)openldap.org Objet : RE: OpenLDAP 2.4 : replication doesn't work when customer is stopped --On Wednesday, March 07, 2012 8:06 AM +0100 PROST Frédéric <f.prost(a)mb-line.com> wrote: > Hello, > > My OpenLDAP version is 2.4.23 (installed with apt-get install slapd on > Debian Squeeze). Using 2.4.23 from Debian is a bad decision, for numerous reasons, which have been discussed multiple times on the list. Please see: <http://www.openldap.org/faq/data/cache/1456.html> for just a beginning of the reasons as to why this is a bad idea. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Migration of Openldap server from Solaris 8 to 10
by jay.chouhan＠indiatimes.com 08 Mar '12

08 Mar '12

Dear Admin, We are running Openldap server on Solaris 9 (Kernel version: SunOS 5.9 Generic 122300-30 Jul 2008) Could you please guide me how to migrate Openldap server from Solais9 to Solaris10, We are planning to upgrade OS from Solaris 9 to Solaris 10 by re-installing the OS.. Appreciate your kind reply on this. thanks Kind regards, Jay

2 1

Help tweaking settings so slapd is not writing to disk so much
by Marc Roos 07 Mar '12

07 Mar '12

Hi I am running on a vm dovecot and sendmail with authentication through pam agains ldap. I have got strange spikes in the load and I think slapd is writing to much to disk. I want to reduce disk io. Anybody an idea why slapd is so often writing to disk instead of reading? The slapd process keeps writing to disk although it is setup as a 'consumer' and it does not receive any new data. There are only 2200 records and olcDbDNcacheSize and olcDbIDLcacheSize are both set to 3000. Thanks in advance for suggestions. Total DISK READ: 0.00 B/s | Total DISK WRITE: 0.00 B/s TID PRIO USER DISK READ DISK WRITE SWAPIN IO> COMMAND 10297 be/4 ldap 0.00 B/s 42.66 K/s 0.00 % 0.00 % slapd -h ldap:///~/ ldapi:/// -u ldap 10298 be/4 ldap 0.00 B/s 11.64 K/s 0.00 % 0.00 % slapd -h ldap:///~/ ldapi:/// -u ldap 10299 be/4 ldap 0.00 B/s 11.64 K/s 0.00 % 0.00 % slapd -h ldap:///~/ ldapi:/// -u ldap 1 be/4 root 0.00 B/s 0.00 B/s 0.00 % 0.00 % init 2 be/4 root 0.00 B/s 0.00 B/s 0.00 % 0.00 % [kthreadd] 3 rt/4 root 0.00 B/s 0.00 B/s 0.00 % 0.00 % [migration/0] 4 be/4 root 0.00 B/s 0.00 B/s 0.00 % 0.00 % [ksoftirqd/0] 5 rt/4 root 0.00 B/s 0.00 B/s 0.00 % 0.00 % [migration/0] 6 rt/4 root 0.00 B/s 0.00 B/s 0.00 % 0.00 % [watchdog/0] 7 rt/4 root 0.00 B/s 0.00 B/s 0.00 % 0.00 % [migration/1] 8 rt/4 root 0.00 B/s 0.00 B/s 0.00 % 0.00 % [migration/1]

5 6

syncrepl consumer retry and sync questions
by Nick Milas 06 Mar '12

06 Mar '12

Hi, Concluding from the documentation (I think it's not clear on this), retry="60 +" should mean that the consumer retries indefinitely every 60 seconds. However, I am observing that consumers with the config: syncrepl rid=111 provider=ldaps://ldap.example.com tls_reqcert=never type=refreshAndPersist retry="60 +" searchbase="dc=example,dc=com" schemachecking=off bindmethod=simple binddn="cn=Manager,dc=example,dc=com" credentials="secret" retry the first time after 60 seconds, then retry again after 2 hours: (Note: Consumers lose connection to the provider at 18:47:59 as the provider is stopped for a few minutes to become upgraded to 2.4.pre30.) Feb 25 18:47:59 consumer111 slapd[2482]: do_syncrep2: rid=111 (-1) Can't contact LDAP server Feb 25 18:47:59 consumer111 slapd[2482]: do_syncrepl: rid=111 rc -1 retrying Feb 25 18:48:59 consumer111 slapd[2482]: do_syncrep2: rid=111 LDAP_RES_INTERMEDIATE - REFRESH_DELETE Feb 25 20:48:59 consumer111 slapd[2482]: do_syncrep2: rid=111 (-1) Can't contact LDAP server Feb 25 20:48:59 consumer111 slapd[2482]: do_syncrepl: rid=111 rc -1 retrying Feb 25 20:48:59 consumer111 slapd[2482]: connection_read(35): no connection! Feb 25 20:48:59 consumer111 slapd[2482]: connection_read(35): no connection! Feb 25 20:49:59 consumer111 slapd[2482]: syncrepl_entry: rid=111 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) ...sync continues... Note that there were a bunch of edits on the provider between 19:47 and 19:55 but they were not propagated to this consumer, until 20:49. About my other two consumers (which have identical configuration, but they bind with a non-root user), on which I wrote on my earlier email: It seems they were also in some kind of delay (for two hours too??), but I didn't wait and restarted slapd: The first: Feb 25 18:47:59 consumer222 slapd2.4[2140]: do_syncrep2: rid=222 (-1) Can't contact LDAP server Feb 25 18:47:59 consumer222 slapd2.4[2140]: do_syncrepl: rid=222 rc -1 retrying Feb 25 18:48:59 consumer222 slapd2.4[2140]: do_syncrep2: rid=222 LDAP_RES_INTERMEDIATE - REFRESH_DELETE Feb 25 20:18:04 consumer222 slapd2.4[2141]: slapd starting Feb 25 20:18:04 consumer222 slapd2.4[2141]: syncrepl_entry: rid=222 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) ...sync continues... and the second: This one was stopped and upgraded to 2.4.30b3 (as I named it - it was pre-30): At 18:54:45 (and later at 19:29) it was started after upgrade, then, as it was not syncing, it was restarted at 20:02:55 and it synced. Feb 25 18:47:59 consumer333 slapd[2357]: do_syncrep2: rid=333 (-1) Can't contact LDAP server Feb 25 18:47:59 consumer333 slapd[2357]: do_syncrepl: rid=333 rc -1 retrying Feb 25 18:48:59 consumer333 slapd[2357]: do_syncrep2: rid=333 LDAP_RES_INTERMEDIATE - REFRESH_DELETE Feb 25 18:52:39 consumer333 slapd[2357]: daemon: shutdown requested and initiated. Feb 25 18:52:39 consumer333 slapd[2357]: slapd shutdown: waiting for 1 operations/tasks to finish Feb 25 18:52:40 consumer333 slapd[2357]: slapd stopped. Feb 25 18:52:40 consumer333 slapd[23371]: [OK] OpenLDAP stopped after 1 seconds Feb 25 18:52:40 consumer333 slapd[23372]: [INFO] no data backup done Feb 25 18:52:40 consumer333 slapd[23373]: [INFO] Halting OpenLDAP replication... Feb 25 18:52:40 consumer333 slapd[23374]: [INFO] no replica found in configuration, aborting stopping slurpd Feb 25 18:54:27 consumer333 slapd[23425]: [INFO] Using /etc/default/slapd for configuration Feb 25 18:54:27 consumer333 slapd[23430]: [INFO] Halting OpenLDAP... Feb 25 18:54:27 consumer333 slapd[23431]: [INFO] can't read PID file, to stop slapd try: /etc/init.d/slapd forcestop Feb 25 18:54:27 consumer333 slapd[23432]: [INFO] Halting OpenLDAP replication... Feb 25 18:54:27 consumer333 slapd[23433]: [INFO] no replica found in configuration, aborting stopping slurpd Feb 25 18:54:44 consumer333 slapd[23458]: [INFO] Using /etc/default/slapd for configuration Feb 25 18:54:44 consumer333 slapd[23463]: [INFO] Launching OpenLDAP configuration test... Feb 25 18:54:45 consumer333 slapd[23486]: [OK] OpenLDAP configuration test successful Feb 25 18:54:45 consumer333 slapd[23496]: [INFO] No db_recover done Feb 25 18:54:45 consumer333 slapd[23497]: [INFO] Launching OpenLDAP... Feb 25 18:54:45 consumer333 slapd[23498]: [OK] File descriptor limit set to 1024 Feb 25 18:54:45 consumer333 slapd[23499]: @(#) $OpenLDAP: slapd 2.4.X (Feb 25 2012 18:38:31) $ swbuilder@vdev.example.com:/home/swbuilder/rpmbuild/BUILD/openldap-2.4.30b3/servers/slapd Feb 25 18:54:45 consumer333 slapd[23500]: slapd starting Feb 25 18:54:45 consumer333 slapd[23500]: do_syncrep2: rid=333 LDAP_RES_INTERMEDIATE - REFRESH_DELETE Feb 25 18:54:46 consumer333 slapd[23505]: [OK] OpenLDAP started Feb 25 19:29:14 consumer333 slapd[2318]: [INFO] Using /etc/default/slapd for configuration Feb 25 19:29:14 consumer333 slapd[2323]: [INFO] Launching OpenLDAP configuration test... Feb 25 19:29:15 consumer333 slapd[2346]: [OK] OpenLDAP configuration test successful Feb 25 19:29:15 consumer333 slapd[2356]: [INFO] No db_recover done Feb 25 19:29:15 consumer333 slapd[2357]: [INFO] Launching OpenLDAP... Feb 25 19:29:15 consumer333 slapd[2358]: [OK] File descriptor limit set to 1024 Feb 25 19:29:15 consumer333 slapd[2359]: @(#) $OpenLDAP: slapd 2.4.X (Feb 25 2012 18:38:31) $ swbuilder@vdev.example.com:/home/swbuilder/rpmbuild/BUILD/openldap-2.4.30b3/servers/slapd Feb 25 19:29:15 consumer333 slapd[2360]: slapd starting Feb 25 19:29:15 consumer333 slapd[2360]: do_syncrep2: rid=333 LDAP_RES_INTERMEDIATE - REFRESH_DELETE Feb 25 19:29:16 consumer333 slapd[2365]: [OK] OpenLDAP started Feb 25 20:02:42 consumer333 slapd[2943]: [INFO] Using /etc/default/slapd for configuration Feb 25 20:02:42 consumer333 slapd[2948]: [INFO] Halting OpenLDAP... Feb 25 20:02:42 consumer333 slapd[2360]: daemon: shutdown requested and initiated. Feb 25 20:02:42 consumer333 slapd[2360]: slapd shutdown: waiting for 1 operations/tasks to finish Feb 25 20:02:42 consumer333 slapd[2360]: slapd stopped. Feb 25 20:02:43 consumer333 slapd[2952]: [OK] OpenLDAP stopped after 1 seconds Feb 25 20:02:43 consumer333 slapd[2953]: [INFO] No data backup done Feb 25 20:02:55 consumer333 slapd[2983]: [INFO] Using /etc/default/slapd for configuration Feb 25 20:02:55 consumer333 slapd[2988]: [INFO] Launching OpenLDAP configuration test... Feb 25 20:02:55 consumer333 slapd[3011]: [OK] OpenLDAP configuration test successful Feb 25 20:02:55 consumer333 slapd[3021]: [INFO] No db_recover done Feb 25 20:02:55 consumer333 slapd[3022]: [INFO] Launching OpenLDAP... Feb 25 20:02:55 consumer333 slapd[3023]: [OK] File descriptor limit set to 1024 Feb 25 20:02:55 consumer333 slapd[3024]: @(#) $OpenLDAP: slapd 2.4.X (Feb 25 2012 18:38:31) $ swbuilder@vdev.example.com:/home/swbuilder/rpmbuild/BUILD/openldap-2.4.30b3/servers/slapd Feb 25 20:02:55 consumer333 slapd[3025]: slapd starting Feb 25 20:02:55 consumer333 slapd[3025]: syncrepl_message_to_entry: rid=333 DN: dc=bridge-o.admin,dc=example.com,ou=dns1,dc=example,dc=com, UUID: a483715a-56bd-102f-9a9d-87b8bcc59e1e Feb 25 20:02:55 consumer333 slapd[3025]: syncrepl_entry: rid=333 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) ...sync continues... Questions: 1. What does the message "connection_read(35): no connection!" signify? (On this consumer -only- I also get occasional messages, like the following: Feb 27 22:25:56 consumer111 slapd[2939]: connection_input: conn=1001 deferring operation: binding ) 2. Why there was a stop in retrying for two hours on the running consumers (111, 222)? 3. Why the upgraded consumer (333) did not sync? It was started after the provider and it was running when the changes were made on the provider. Thanks, Nick

2 2

Re: Re: delta-syncrepl and mirrormode problem (2.4.29 and 2.4.30)
by frank.offermanns＠caseris.de 06 Mar '12

06 Mar '12

I tested with 2.4.30 and still have the same problems. Frank -- Von: Frank Offermanns/CAE An: openldap-technical(a)openldap.org Datum: 17.02.2012 11:35 Betreff: Re: delta-syncrepl and mirrormode problem (2.4.29) I wanted to add, that one database is empty when I start and the other has only some data. But with master/slave this is no problem, so I think it should also work for master/master, doesn't it? I retried with a patched version with these patches: < http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=patch;h=8e7af6331… > < http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commitdiff;h=d4b3… > < http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commitdiff;h=eace… > Unfortunately the problem still persists. Could at least anyone confirm that the configuration is correct? Then I can at last stop searching for a error I possibly did and accept that OpenLDAP with Master/Master (delta-syncrepl) for Windows simply does not work. Best regards, Frank -- openldap-technical-bounces(a)OpenLDAP.org schrieb am 13.02.2012 11:53:16: > Von: frank.offermanns(a)caseris.de > An: openldap-technical(a)openldap.org > Datum: 13.02.2012 12:07 > Betreff: delta-syncrepl and mirrormode problem (2.4.29) > Gesendet von: openldap-technical-bounces(a)OpenLDAP.org > > Hi, > > I want to use delta-syncrepl replication with 2 masters. > But each slapd-process permanently needs about 25 % CPU usage without any > traffic on it. > > The log looks endless like this: > > ** ld 01e43698 Outstanding Requests: > * msgid 55, origid 55, status InProgress > outstanding referrals 0, parent count 0 > ld 01e43698 request count 1 (abandoned 18) > ** ld 01e43698 Response Queue: > Empty > ld 01e43698 response count 0 > ldap_chkResponseList ld 01e43698 msgid 55 all 0 > ldap_chkResponseList returns ld 01e43698 NULL > ldap_int_select > read1msg: ld 01e43698 msgid 55 all 0 > ber_get_next > ber_get_next: tag 0x30 len 1187 contents: > abandoned/discarded ld 01e43698 msgid 53 message type search-entry > wait4msg continue ld 01e43698 msgid 55 all 0 > ** ld 01e43698 Connections: > * host: secondmaster.mydomain.local port: 389 (default) > refcnt: 2 status: Connected > last used: Mon Feb 13 11:26:53 2012 > > > ** ld 01e43698 Outstanding Requests: > * msgid 55, origid 55, status InProgress > outstanding referrals 0, parent count 0 > ld 01e43698 request count 1 (abandoned 18) > ** ld 01e43698 Response Queue: > Empty > ld 01e43698 response count 0 > ldap_chkResponseList ld 01e43698 msgid 55 all 0 > ldap_chkResponseList returns ld 01e43698 NULL > ldap_int_select > read1msg: ld 01e43698 msgid 55 all 0 > ber_get_next > ber_get_next: tag 0x30 len 1187 contents: > abandoned/discarded ld 01e43698 msgid 53 message type search-entry > wait4msg continue ld 01e43698 msgid 55 all 0 > ** ld 01e43698 Connections: > * host: secondmaster.mydomain.local port: 389 (default) > refcnt: 2 status: Connected > last used: Mon Feb 13 11:26:53 2012 > > > here is my configuration (completely the same for both masters): > ----------------------------------------------------------------------------------------------------- > ucdata-path ./ucdata > include ./schema/core.schema > include ./schema/cosine.schema > include ./schema/Personcaesar.schema > include ./schema/ConfigObjects.schema > > loglevel 0 > logfile "C:/test/slapd.log" > > pidfile ./run/slapd.pid > argsfile ./run/slapd.args > > access to * by dn.one="ou=Admins,o=caesar" write > by anonymous auth > > ServerID 1 "ldap://firstmaster.mydomain.local" > ServerID 2 "ldap://secondmaster.mydomain.local" > > ###################################################################### > database config > rootdn cn=config > rootpw {SHA}secret > > ####################################################################### > # BDB database definitions > ####################################################################### > # Accesslog database definitions > database hdb > suffix cn=accesslog > checkpoint 1024 5 > cachesize 10000 > directory "C:/test/accessdata" > dbconfig set_cachesize 0 30000000 1 > dbconfig set_flags DB_LOG_AUTOREMOVE > dbconfig set_lg_regionmax 1048576 > dbconfig set_lg_max 10485760 > dbconfig set_lg_bsize 2097152 > rootdn cn=accesslog > index objectClass,entryCSN,entryUUID eq > # I even tried removing reqMod, reading your docs I am not sure if this is > needed here > index reqEnd,reqResult,reqMod,reqStart eq > > overlay syncprov > syncprov-nopresent TRUE > syncprov-reloadhint TRUE > # Let the replica DN have limitless searches > limits dn.exact="cn=Replicator,ou=admins,o=caesar" time.soft=unlimited > time.hard=unlimited size.soft=unlimited size.hard=unlimited > > # Primary database definitions > database hdb > suffix "o=caesar" > checkpoint 1024 5 > cachesize 10000 > idlcachesize 30000 > rootdn "cn=Administrator,o=caesar" > rootpw {SHA}secret > directory "C:/test/data" > dbconfig set_cachesize 0 100000000 1 > dbconfig set_flags DB_LOG_AUTOREMOVE > dbconfig set_lg_regionmax 1048576 > dbconfig set_lg_max 10485760 > dbconfig set_lg_bsize 2097152 > > > # syncprov specific indexing > index sn pres,eq > index cn pres,eq,sub > ... > index entryUUID eq > index entryCSN eq > index objectClass eq > > # syncrepl Provider for primary db > overlay syncprov > syncprov-checkpoint 1000 60 > syncprov-sessionlog 10000 > > # accesslog overlay definitions for primary db > overlay accesslog > logdb cn=accesslog > logops writes > logsuccess TRUE > # scan the accesslog DB every day, and purge entries older than 7 days > logpurge 07+00:00 01+00:00 > > sizelimit size.soft=100 size.hard=1000 size.prtotal=unlimited > # Let the replica DN have limitless searches > limits dn.exact="cn=Replicator,ou=admins,o=caesar" time.soft=unlimited > time.hard=unlimited size.soft=unlimited size.hard=unlimited > > syncrepl rid=001 > provider="ldap://firstmaster.mydomain.local" > searchbase="o=caesar" > type=refreshAndPersist > retry="5 3 15 +" > binddn="cn=Replicator,ou=admins,o=caesar" > bindmethod=simple > credentials="secret" > logbase="cn=accesslog" > logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" > schemachecking=on > syncdata=accesslog > > > syncrepl rid=002 > provider="ldap://secondmaster.mydomain.local" > searchbase="o=caesar" > type=refreshAndPersist > retry="5 3 15 +" > binddn="cn=Replicator,ou=admins,o=caesar" > bindmethod=simple > credentials="secret" > logbase="cn=accesslog" > logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" > schemachecking=on > syncdata=accesslog > > > MirrorMode On > ----------------------------------------------------------------------------------------------------- > > I did my test on 2 Windows PCs and OpenLDAP 2.4.29 with Berkeley 5.1 . > > > > Thanks for any hints, > FO >

3 6

<what> in ACL defined by set?
by Michael Ströder 05 Mar '12

05 Mar '12

HI! Is it possible to specify the <what> clause in an ACL with a set? We have several applications and for each application there's a specific AUXILIARY object class for application-specific user attributes. So for each application I add ACLs like this: access to dn.onelevel="ou=Users,dc=example,dc=org" attrs=@app1User by dn.subtree="cn=app1,ou=Systems,dc=example,dc=org" read by * break Obviously I'd like to have one ACL which references an attribute specifying the auxiliary object class in the app's system entry. Is that possible? Ciao, Michael.

2 3

production best-practices for cn=monitor
by Aaron Bennett 05 Mar '12

05 Mar '12

Hi, I'm curious what people think about best practices for cn=monitor in production environments. Do people generally keep it enabled? Is there a drawback to keeping it enabled? Are there any specific security or performance concerns? Best, Aaron Bennett

2 1

syncrepl simple bind
by S.A. 05 Mar '12

05 Mar '12

Hello, For syncrepl to work do we need to enable the sasl? I had the sasl disabled and configured to replicate using simple bindmethod, with the following config: syncrepl rid=001 provider=ldap://ldap2.example.com type=refreshAndPersist retry="5 5 300 +" searchbase="o=tld" bindmethod=simple binddn="uid=admin,ou=users,o=tld" credentials=password schemachecking=on but I get the following error: slap_client_connect: URI=ldap://ldap2.example.com DN="uid=admin,ou=users,o=tld" ldap_sasl_bind_s failed (-1) However, I can bind and search entries both in cn=config and o=tld from command line using the above binddn and credentials. Thanks

2 3

LDAP_OPT_X_TLS_xxx option in SSL/TLS connection
by Qiang Xu 05 Mar '12

05 Mar '12

Hello All, Today I came across a strange problem. I wrote a program to test ldap ssl/tls connection with OpenLDAP library. Something like the code snippet as follows: int ret = LDAP_OPT_SUCCESS; int cert_flag = LDAP_OPT_X_TLS_NEVER; ... ret = ldap_set_option(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, &cert_flag); if (ret != LDAP_OPT_SUCCESS) { fprintf(stderr, "unable to set require cert option (LDAP_OPT_X_TLS_REQUIRE_CERT): %s\n", ldap_err2string(ret)); } ... // bind to the server cert_flag = LDAP_OPT_X_TLS_DEMAND; ret = ldap_set_option(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, &cert_flag); if (ret != LDAP_OPT_SUCCESS) { fprintf(stderr, "unable to set require cert option (LDAP_OPT_X_TLS_REQUIRE_CERT): %s\n", ldap_err2string(ret)); } ... // bind to the server The first binding is successful, as expected. However, the second binding is also successful, which is contrary to my expectation, because I didn't create any cert file yet. Another observation here is that if the first binding with LDAP_OPT_X_TLS_NEVER is removed, and the second binding with LDAP_OPT_X_TLS_DEMAND set is done right from the beginning, then it will fail, as expected. So, it seems the first value set to the option LDAP_OPT_X_TLS_REQUIRE_CERT will override the later values, isn't it? Is it possible to change this option's value on the fly (means different bindings use different values for this cert option)? Thanks, Qiang

4 8

Connection timeouts
by Marcin S 05 Mar '12

05 Mar '12

Hello, I have a question, lets say i have web application with ldap authentication. User that log in to page opens new LDAP connection, our LDAP also holds some security attributes per application and they are verified for certain app operations, so connections remains open for a whole time. Question is when user close web browser or suddenly disconnects, will this connection be timed out and closed by server? Marcin

3 4

A question about the sssvlv overlay
by Chris Card 05 Mar '12

05 Mar '12

Hi all, When using the sssvlv overlay I see the following behaviour: (a) Updating an attribute value while an sssvlv request is active: 1. do a request containing a vlv control and a sort control, which returns a subset of a total result set defined by the search parameters, and the context id for the request. 2. update an attribute value in one of the objects which was returned in the result set 3. repeat the request in step 1, specifying the context id in the vlv control, which returns the same results as in step 1, except that the attribute value updated in step 2 has changed (b) Deleting an object while an sssvlv request is active: 1. do a request containing a vlv control and a sort control, which returns a subset of a total result set defined by the search parameters, and the context id for the request. 2. delete one of the objects which was returned in the result set 3. repeat the request in step 1, specifying the context id in the vlv control, which returns the same results as in step 1, except that the object deleted in step 2 has gone (c) Adding an object while an sssvlv request is active: 1. do a request containing a vlv control and a sort control, which returns a subset of a total result set defined by the search parameters, and the context id for the request. 2. add a new object which would have been returned by step 1 if the object had existed already 3. repeat the request in step 1, specifying the context id in the vlv control, which returns the same results as in step 1. The new object is not returned in the results. (d) Deleting and re-adding an object while an sssvlv request is active: 1. do a request containing a vlv control and a sort control, which returns a subset of a total result set defined by the search parameters, and the context id for the request. 2. delete one of the objects which was returned in the result set 3. repeat the request in step 1, specifying the context id in the vlv control, which returns the same results as in step 1, except that the object deleted in step 2 has gone 4. add the deleted object back in 5. repeat the request in step 1, specifying the context id in the vlv control, which returns the same results as in step 1. The object deleted in step 2 is back. Is this the expected behaviour of the sssvlv overlay? Or is the behaviour in (c) a bug? The draft RFC http://tools.ietf.org/html/draft-ietf-ldapext-ldapv3-vlv-09 does not specify what the behaviour ought to be as far as I can see, but the current behaviour seems inconsistent. [tested using openldap 2.4.26 patched with all the available fixes to the sssvlv overlay] Chris

1 0

Collabograte project
by Kartik Subbarao 04 Mar '12

04 Mar '12

I'm integrating OpenLDAP as an LDAP Directory component in the open source Collabograte project that I recently announced: http://kartiksubbarao.com/announcing-collabograte Here are some areas of integration configured with OpenLDAP: + Username and password authentication to MediaWiki, WordPress Multisite, Cyrus IMAP, Sympa, and ejabberd + LDAP Groups used as Sympa Mailing Lists and ejabberd groups If you want to see the implementation details, you can look at the puppet manifest and other files: https://github.com/kartiksubbarao/collabograte/blob/master/puppet/modules/o… https://github.com/kartiksubbarao/collabograte/tree/master/puppet/modules/o… https://github.com/kartiksubbarao/collabograte/tree/master/puppet/modules/o… I'd be very interested in hearing any comments, ideas, suggestions, or questions you might have on this. I want to help Enterprise IT do a better job of integrating open source into their environments, as well as improve the collaboration between Enterprise IT and open source project communities. Please feel free to respond here, on the Collabograte mailing list, or email me directly, whichever you prefer. Thanks, -Kartik

2 4

OpenLDAP TLS server authority verification
by Daniel Pocock 03 Mar '12

03 Mar '12

http://tools.ietf.org/html/rfc4513#section-3.1.3 gives some detail about how a client should check an LDAP server's TLS certificate. The language used there is very general though. Can anyone comment on how OpenLDAP does this, and whether it can be tweaked from the client side (e.g. through settings in /etc/ldap/ldap.conf or URI parameters) to mandate a particular policy for choosing the `reference identity'? >From RFC 4513, "The client determines the type (e.g., DNS name or IP address) of the reference identity and performs a comparison between the reference identity and each subjectAltName value of the corresponding type until a match is produced" is very vague. My understanding of `reference identity' is that it should be a statically/administratively configured value on the client host. On the other hand, a value derived/mapped from a network source (e.g. DNS SRV lookup) can never be trusted as a reference identity. To give an example: ldap[12].outsource.com: - are the OpenLDAP hosts (run by an external company) - both have a TLS certificate with CN=ldap[12].outsource.com, and subjectAltName mycompany.com _ldap._tcp.mycompany.com: - an SRV record pointing to ldap[12].outsource.com - mycompany.com DNS is not secured (no DNSSEC) webserver.mycompany.com: - wants to authenticate a user logging in - has dc=mycompany,dc=com statically configured in some cfg file, so it trusts mycompany.com as a `reference identity' - discovers ldap1.outsource.com from DNS SRV lookup on mycompany.com, (so the LDAP client should not consider ldap1.outsource.com as a reference identity, because it is a value from DNS) - therefore, when it connects to ldap1.outsource.com, if the TLS certificate contains CN=ldap1.outsource.com only, it would not trust the connection, - but when it finds the subjectAltName mycompany.com in the cert too, it should trust the connection

3 7

SSL, TLS and DNS SRV
by Daniel Pocock 03 Mar '12

03 Mar '12

I have slapd listening on port 636 only because I want to enforce use of SSL/TLS It all works successfully (I now have my UNIX users, mail, and about a dozen apps authenticating against it), however... I wanted fault tolerance, and I thought that the way to achieve this would be using DNS SRV and replication (which was also easy to get working) What I've observed: - if I create _ldaps._tcp.example.org SRV records, they are ignored - if I create _ldap._tcp.example.org SRV records, and I ldapsearch with a URI of the form "ldaps:///dc%3Dexample%2Cdc%3Dorg" it works So, it seems to be the combination of the ldaps URI prefix with the _ldap._tcp SRV record that is working, this doesn't seem right I've also found that other LDAP apps have slightly different expectations too: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=661955 I went searching for a definite answer: +site:ietf.org ldaps srv http://tools.ietf.org/html/rfc2782 refers to the name of the service from `Assigned Numbers', http://tools.ietf.org/html/rfc1700 which omits ldaps, but it is defined elsewhere as a distinct service name: http://www.ietf.org/assignments/service-names-port-numbers/service-names-po… Therefore, my feeling is that - if an ldaps: URI is used, the SRV query should be seeking _ldaps._tcp, and -if an ldap: URI is used (and StartTLS may or may not be requested by the user), the SRV query should be looking for _ldap._tcp Also, can anyone comment on why the URI needs to be escaped manually when using DNS SRV?

2 3

i don't find a new user added in getent passwd list
by stefano 02 Mar '12

02 Mar '12

hi, i started to work with posixAccount objectClass. i installed libnss-ldap on debian squeeze server. i configured it during install time and i modified nsswitch.conf as follow: passwd files ldap group files ldap shadow files ldap and i didn't modify the remains lines. i succesfully added a structure.ldif file as follow #the root of the directory dn: dc=amahoro,dc=bi dc: amahoro o: amahoro.bi objectClass: top objectClass: dcObject objectClass: organization #subtree for the administrators dn: cn=Administrators,dc=amahoro,dc=bi cn: Administrators gidNumber: 100 objectClass: posixGroup i succesfully added a administrators.ldif file as follow: #Stefano Malini dn: uid=name,cn=Administrators,dc=amahoro,dc=bi cn: Administrators uid: name uidNumber: 100 gidNumber:100 homeDirectory: /home/name/ #Name info cn: Name Surname sn: Surname givenName: Name displayName: Name Surname #Work info title: System Administrator mail: address@mail #Misc userPassword: {SSHA}vB/RyxNdsVkwc9dDxEuS/sIGESBAkzTw objectClass: posixAccount objectClass: inetOrgPerson Now, with getent command-line there is not this user. Why?

3 7

memberOf and glued databases
by Marc Patermann 02 Mar '12

02 Mar '12

Hi, short question first: Is overlay memberOf supposed to work with glued databases in any direction? I tried with 2.4.28 and get the following results: slapd.conf with two databases 1. step ------- This is simple. MemberOf overlay only in one database ou=groups,ou=foo,ou=bar (subordinated). database hbd suffix ou=groups,ou=foo,ou=bar subordinate ... overlay memberof memberof-group-ac groupOfNames memberof-member-ad member memberof-memberof-ad memberof database bdb suffix ou=bar ... - created one inetOrgPerson object employeenumber=11,ou=groups,ou=foo,ou=bar - created one group ou=2,ou=groups,ou=foo,ou=bar with member: employeenumber=11,ou=groups,ou=foo,ou=bar => memberOf in employeenumber=11,ou=groups,ou=foo,ou=bar is set and unset just fine. => no modifications in superior database ou=bar 2. step ------- overlay loaded in both databases database hbd suffix ou=groups,ou=foo,ou=bar subordinate ... overlay memberof memberof-group-ac groupOfNames memberof-member-ad member memberof-memberof-ad memberof database bdb suffix ou=bar ... overlay memberof memberof-group-ac groupOfNames memberof-member-ad member memberof-memberof-ad memberof => modification in the subordinated database work in 1. step. - created one inetOrgPerson object employeenumber=1,ou=bar - created one group ou=1,ou=bar with member: employeenumber=1,ou=bar => memberOf in employeenumber=1,ou=bar is set and unset just fine. memberOf is working in the superior database. - setting group ou=1,ou=bar member: employeenumber=11,ou=groups,ou=foo,ou=bar => memberOf in employeenumber=11,ou=groups,ou=foo,ou=bar is set and unset just fine. Changes in groups of superior databases work in subordinate databases! - setting group ou=2,ou=groups,ou=foo,ou=bar member: employeenumber=1,ou=bar => does _not_ work: memberof_value_modify DN="employeenumber=1,ou=bar" add memberOf ="ou=2,ou=groups,ou=foo,ou=bar" failed err=32 Changes in groups of subordinated databases do not work in the superior database! 3. step ------- setting "overlay glue" explicitly and removing overlay memberof from the subordinate database: database hbd suffix ou=groups,ou=foo,ou=bar subordinate ... database bdb suffix ou=bar ... overlay memberof memberof-group-ac groupOfNames memberof-member-ad member memberof-memberof-ad memberof overlay glue => changes in the subordinated database are _not_ managed by the overlay. => changes in groups of superior databases work in subordinate databases and in the superior database! 3. step II ---------- if glue is located in slapd.conf before memberof (which is IMHO wrong) and MOD on member in a group in the subordinated database is send, slapd segfaults! 4. step ------- setting "overlay glue" explicitly and overlay memberof in both databases: database hbd suffix ou=groups,ou=foo,ou=bar subordinate ... overlay memberof memberof-group-ac groupOfNames memberof-member-ad member memberof-memberof-ad memberof database bdb suffix ou=bar ... overlay memberof memberof-group-ac groupOfNames memberof-member-ad member memberof-memberof-ad memberof overlay glue => like 2. step So the best I get is - memberOf works in the database, where it is set - memberOf works for group changes in superior database on members in subordinated databases - memberOf does not work for group changes in subordinated databases to members in superior databases. Is this the way it is supposed to work? What I really wanted to achieve is to get memerOf to work between database (under glue) of the same level. (Like ou=1,ou=foo and ou=2,ou=foo both subordinated of ou=foo.) But while my testings above did not succeed, it did not tried. Marc

9 15

delta-syncrepl and mirrormode problem (2.4.29)
by frank.offermanns＠caseris.de 02 Mar '12

02 Mar '12

Hi, I want to use delta-syncrepl replication with 2 masters. But each slapd-process permanently needs about 25 % CPU usage without any traffic on it. The log looks endless like this: ** ld 01e43698 Outstanding Requests: * msgid 55, origid 55, status InProgress outstanding referrals 0, parent count 0 ld 01e43698 request count 1 (abandoned 18) ** ld 01e43698 Response Queue: Empty ld 01e43698 response count 0 ldap_chkResponseList ld 01e43698 msgid 55 all 0 ldap_chkResponseList returns ld 01e43698 NULL ldap_int_select read1msg: ld 01e43698 msgid 55 all 0 ber_get_next ber_get_next: tag 0x30 len 1187 contents: abandoned/discarded ld 01e43698 msgid 53 message type search-entry wait4msg continue ld 01e43698 msgid 55 all 0 ** ld 01e43698 Connections: * host: secondmaster.mydomain.local port: 389 (default) refcnt: 2 status: Connected last used: Mon Feb 13 11:26:53 2012 ** ld 01e43698 Outstanding Requests: * msgid 55, origid 55, status InProgress outstanding referrals 0, parent count 0 ld 01e43698 request count 1 (abandoned 18) ** ld 01e43698 Response Queue: Empty ld 01e43698 response count 0 ldap_chkResponseList ld 01e43698 msgid 55 all 0 ldap_chkResponseList returns ld 01e43698 NULL ldap_int_select read1msg: ld 01e43698 msgid 55 all 0 ber_get_next ber_get_next: tag 0x30 len 1187 contents: abandoned/discarded ld 01e43698 msgid 53 message type search-entry wait4msg continue ld 01e43698 msgid 55 all 0 ** ld 01e43698 Connections: * host: secondmaster.mydomain.local port: 389 (default) refcnt: 2 status: Connected last used: Mon Feb 13 11:26:53 2012 here is my configuration (completely the same for both masters): ----------------------------------------------------------------------------------------------------- ucdata-path ./ucdata include ./schema/core.schema include ./schema/cosine.schema include ./schema/Personcaesar.schema include ./schema/ConfigObjects.schema loglevel 0 logfile "C:/test/slapd.log" pidfile ./run/slapd.pid argsfile ./run/slapd.args access to * by dn.one="ou=Admins,o=caesar" write by anonymous auth ServerID 1 "ldap://firstmaster.mydomain.local" ServerID 2 "ldap://secondmaster.mydomain.local" ###################################################################### database config rootdn cn=config rootpw {SHA}secret ####################################################################### # BDB database definitions ####################################################################### # Accesslog database definitions database hdb suffix cn=accesslog checkpoint 1024 5 cachesize 10000 directory "C:/test/accessdata" dbconfig set_cachesize 0 30000000 1 dbconfig set_flags DB_LOG_AUTOREMOVE dbconfig set_lg_regionmax 1048576 dbconfig set_lg_max 10485760 dbconfig set_lg_bsize 2097152 rootdn cn=accesslog index objectClass,entryCSN,entryUUID eq # I even tried removing reqMod, reading your docs I am not sure if this is needed here index reqEnd,reqResult,reqMod,reqStart eq overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE # Let the replica DN have limitless searches limits dn.exact="cn=Replicator,ou=admins,o=caesar" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited # Primary database definitions database hdb suffix "o=caesar" checkpoint 1024 5 cachesize 10000 idlcachesize 30000 rootdn "cn=Administrator,o=caesar" rootpw {SHA}secret directory "C:/test/data" dbconfig set_cachesize 0 100000000 1 dbconfig set_flags DB_LOG_AUTOREMOVE dbconfig set_lg_regionmax 1048576 dbconfig set_lg_max 10485760 dbconfig set_lg_bsize 2097152 # syncprov specific indexing index sn pres,eq index cn pres,eq,sub ... index entryUUID eq index entryCSN eq index objectClass eq # syncrepl Provider for primary db overlay syncprov syncprov-checkpoint 1000 60 syncprov-sessionlog 10000 # accesslog overlay definitions for primary db overlay accesslog logdb cn=accesslog logops writes logsuccess TRUE # scan the accesslog DB every day, and purge entries older than 7 days logpurge 07+00:00 01+00:00 sizelimit size.soft=100 size.hard=1000 size.prtotal=unlimited # Let the replica DN have limitless searches limits dn.exact="cn=Replicator,ou=admins,o=caesar" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited syncrepl rid=001 provider="ldap://firstmaster.mydomain.local" searchbase="o=caesar" type=refreshAndPersist retry="5 3 15 +" binddn="cn=Replicator,ou=admins,o=caesar" bindmethod=simple credentials="secret" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" schemachecking=on syncdata=accesslog syncrepl rid=002 provider="ldap://secondmaster.mydomain.local" searchbase="o=caesar" type=refreshAndPersist retry="5 3 15 +" binddn="cn=Replicator,ou=admins,o=caesar" bindmethod=simple credentials="secret" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" schemachecking=on syncdata=accesslog MirrorMode On ----------------------------------------------------------------------------------------------------- I did my test on 2 Windows PCs and OpenLDAP 2.4.29 with Berkeley 5.1 . Thanks for any hints, FO

2 4

Does OpenLDAP affect leap second?
by ITPFS oota 02 Mar '12

02 Mar '12

At 2012-06-30, leap second will be introduced. ftp://hpiers.obspm.fr/iers/bul/bulc/bulletinc.dat Does OpenLDAP affect leap second? -- --- Oota Toshiya --- t-oota at dh.jp.nec.com NEC Systems Software Operations Unit Shiba,Minato,Tokyo IT Platform Solutions Division Japan,Earth,Solar system (samba-jp/ldap-jp Staff,mutt-j/samba-jp postmaster)

1 0

Controlled LDAP Proxy/Relay
by W.Siebert＠t-systems.com 01 Mar '12

01 Mar '12

Hello, I'v implemented a OpenLDAP Metadirectory that proxying 2 Microsft AD targets. One target is customers AD, the second our AD for management purposes. Problem: slapd-meta tries to authenticate the user first by one target and if this user there not exist will be the second target connected. Means: in both directories Intrusion Detection register a lot of unsuccessfully authentication. Is it possible to implement the controlled proxy with OpenLDAP ? E.g., like Radiusproxy based on realm: when username is xxx(a)domain01.com<mailto:xxx@domain01.com> go to the target1, and when username is xxx(a)domain99.net<mailto:xxx@domain99.net> go to the target2. Kind regards Waldemar

3 2

ssl negotiation and openldap
by Brett ＠Google 01 Mar '12

01 Mar '12

Hello, I've recently had issues with a 3rd party java client using jdk 1.4.x, trying to connect with ldaps:// to openldap 2.4.26, compiled with OpenSSL 1.0.0d It would appear that the client's jdk 1.4.x has a few harsh restrictions with regard to modulus size in certiicates, even with all unrestricted "export" policies installed. So i was wondering a few things : 1. does openldap do anything with the CA certs, other than verify local or remote certiticates, such as sending them over the ssl connection ? 2. it's my understanding that in SSL negotiation, only server or client certiticates are exchanged, and ca certs's are not sent over the wire (as IMHO it would literally bet a "trust" issue to do otherwise :). 3. other than providing certificates / keys to the openssl API, is there anything special that happens other than hand off to stock openssl negotiation ? Trying to work out what is being sent to the client to trigger a "modulus size" error on the client, other than clients inherent badness which i cannot control :) If 3. is no, then i'm open to any suggestions with regard to interesting or useful SSL negotiation documents out there, that might shed some light. Cheers Brett -- *The only thing that interferes with my learning is my education.* * Albert Einstein*

2 1

ssh group membership access
by Daniel Bahena 29 Feb '12

29 Feb '12

Hi, I have a set of servers in which I want to configure ssh access based on the users group membership. I'm using CentOS 5 and this version of openldap [root@centos5 ldifs]# rpm -qa | grep ldap openldap-servers-2.3.43-12.el5_7.10 php-ldap-5.1.6-27.el5_7.5 openldap-servers-overlays-2.3.43-12.el5_7.10 openldap-2.3.43-12.el5_7.10 nss_ldap-253-42.el5_7.4 openldap-2.3.43-12.el5_7.10 nss_ldap-253-42.el5_7.4 openldap-clients-2.3.43-12.el5_7.10 [root@centos5 ldifs]# And this is my ldap.conf base dc=homelinux,dc=net timelimit 120 bind_timelimit 120 idle_timelimit 3600 pam_groupdn cn=access,ou=Group,dc=homelinux,dc=net pam_member_attribute member nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman,nscd,gdm uri ldap://127.0.0.1/ ssl no tls_cacertdir /etc/openldap/cacerts pam_password md5 And this is the contents of cn=access [root@centos5 ldifs]# ldapsearch -x -W -D 'cn=Manager,dc=homelinux,dc=net' -h 127.0.0.1 "cn=access" # access, Group, homelinux.net dn: cn=access,ou=Group,dc=homelinux,dc=net cn: access objectClass: top objectClass: groupOfNames objectClass: labeledURIObject member: uid=nobody,ou=People,dc=homelinux,dc=net labeledURI: ldap:///ou=People,dc=homelinux,dc=net??one?(gidNumber=10060) labeledURI: ldap:///ou=People,dc=homelinux,dc=net??one?(host=jumpbox) [root@centos5 ldifs]# And this is the contents of the gid 10060 (unixsa) [root@centos5 ldifs]# ldapsearch -x -W -D 'cn=Manager,dc=homelinux,dc=net' -h 127.0.0.1 "cn=unixsa" # unixsa, Group, homelinux.net dn: cn=unixsa,ou=Group,dc=homelinux,dc=net gidNumber: 10060 description: unixsa objectClass: top objectClass: posixGroup cn: unixsa memberUid: uid=dan,ou=People,dc=homelinux,dc=net memberUid: dan [root@centos5 ldifs]# And when I try to ssh into this box I get the following: [kwame@vader ~]$ ssh dan@centos5 dan@centos5's password: You must be a member of cn=access,ou=Group,dc=homelinux,dc=net to login. Connection closed by 192.168.122.225 [kwame@vader ~]$ This is the info for the user dan [root@centos5 ldifs]# id dan uid=10051(uid=dan,ou=People,dc=homelinux,dc=net) gid=10051(dan) groups=10051(dan),10060(unixsa) Comments? Thoughts? Words of wisdom? Best regards

1 0

SSL handshake failure
by Bryce Powell 29 Feb '12

29 Feb '12

Hi, I can't get slapd to respond successfully to TLS or SSL connections using an RSA 2048-bit PEM certificate: $ ldapsearch -x -ZZ -d1 -H ldap://FQDNhostname TLS: loaded CA certificate file /etc/openldap/cacerts/FQDNhostname.cacert.pem. TLS: error: tlsm_PR_Recv returned 0 - error 21:Is a directory TLS: error: connect - force handshake failure: errno 21 - moznss error -5938 TLS: can't connect: TLS error -5938:Encountered end of file. ldap_err2string ldap_start_tls: Connect error (-11) additional info: TLS error -5938:Encountered end of file $ openssl s_client -connect FQDNhostname:636 -CAfile /etc/openldap/cacerts/FQDNhostname.cacert.pem CONNECTED(00000003) 140457427965768:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:184: --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 0 bytes and written 113 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE --- The following packages are installed on CentOS 6.2: openldap-servers-2.4.23-20.el6.x86_64 openldap-2.4.23-20.el6.x86_64 openldap-clients-2.4.23-20.el6.x86_64 openssl-1.0.0-20.el6_2.1.x86_64 openssl-devel-1.0.0-20.el6_2.1.x86_64 gnutls-2.8.5-4.el6.x86_64 gnutls-devel-2.8.5-4.el6.x86_64 nss-pam-ldapd-0.7.5-14.el6_2.1.x86_64 The /etc/openldap/ldap.conf file contains: TLS_CACERT /etc/openldap/cacerts/FQDNhostname.cacert.pem , which contains a chain of three certificates (root CA, intermediate/functional, and issuing). The /etc/openldap/slapd.conf file contains: TLSCipherSuite HIGH:+SSLv3 TLSCertificateFile /etc/openldap/FQDNhostname.cert.pem TLSCertificateKeyFile /etc/openldap/FQDNhostname.key.pem The server is acting as a proxy to an Active Directory, and therefore I only have one LDAP database defined. My intention is to use LDAPS for communication between the client and LDAP proxy servers: database ldap suffix "dc=abc,dc=local" rebind-as-user uri "ldap://IPaddress1/ ldap://IPaddress2/ ldap://IPaddress3/ ldap://IPaddress4/" chase-referrals yes noundeffilter yes use-temporary-conn yes The certificate and private key are located in /etc/openldap/, with the following permissions : -r--r-----. 1 ldap ldap 2076 Feb 21 15:30 FQDNhostname.cert.pem -r--r-----. 1 ldap ldap 1675 Feb 21 15:35 FQDNhostname.sdi.key.pem The CN of the certificate matches the FQDN host name of the LDAP server. The private key is not password protected. Everything checks out OK by testing the certificate using openssl: $ openssl verify -purpose sslserver -CAfile /etc/openldap/cacerts/FQDNhostname.cacert.pem /etc/openldap/FQDNhostname.cert.pem /etc/openldap/FQDNhostname.cert.pem: OK OpenSSL client/server connections work fine too: openssl s_server -cert /etc/openldap/FQDNhostname.cert.pem -key /etc/openldap/FQDNhostname.key.pem -cipher 'HIGH:+SSLv3 openssl s_client -connect FQDNhostname:4433 -CAfile /etc/openldap/cacerts/FQDNhostname.cacert.pem Bryce Powell

3 6

slapd-meta and LDAPS/SSL problem.
by Jim Vanes 29 Feb '12

29 Feb '12

Hello, Sorry, I tried posting this yesterday but it didn't seem to make it on the list - trying again. I currently have OpenLDAP (2.4.28) running on a Linux box with a local database and a meta backend which represents the local database along with a remote Active Directory server (2008 R2). Below is a snapshot of my slapd.conf. #------------------------------------------------------------ include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/samba.schema loglevel -1 modulepath /usr/lib/openldap/ allow bind_v2 database bdb suffix "dc=local,dc=example,dc=com" directory /var/lib/ldap rootdn "cn=root,dc=local,dc=example,dc=com" rootpw secret database meta suffix "dc=example,dc=com" rootdn "cn=root,dc=example,dc=com" rootpw secret ## Local uri ldap://localhost/ou=Users,dc=local,dc=example,dc=com idassert-bind bindmethod=simple binddn="cn=root,dc=local,dc=example,dc=com" credentials=secret ##Remote Active Directory uri ldap://ad.example.com/cn=Users,dc=example,dc=com idassert-bind bindmethod=simple binddn="cn=sync,cn=users,dc=example,dc=com" credentials=secret # tls_cacert=/etc/openldap/cacerts/ad-ca.cer # tls_cert=/etc/openldap/local.pem # tls_key=/etc/openldap/local.key #----------------------------------------------------------- When I run the following command: ldapsearch -x -D "cn=root, dc=example,dc=com" -w secret -b " dc=example,dc=com " -H ldap://localhost Everything works as expected with the above config , meaning I see the local and remote/proxied entries on AD with the root credentials specified above. Logs on AD indicate that a user sync preformed a search. As I understand, id-assertion is working?? Now if I change the remote entry to the following (enable ssl): ##Remote Active Directory uri ldaps://ad.example.com/cn=Users,dc=example,dc=com idassert-bind bindmethod=simple binddn="cn=sync,cn=users,dc=example,dc=com" credentials=secret tls_cacert=/etc/openldap/cacerts/ad-ca.cer tls_cert=/etc/openldap/local.pem tls_key=/etc/openldap/local.key The same command (ldapsearch -x -D "cn=root, dc=example,dc=com" -w secret -b " dc=example,dc=com " -H ldap://localhost) binds locally successfully but does not list any remote attributes from AD. Verbose logging enabled on Active Directory indicates an anonymous bind and subsequent failure. This is what I'm trying to understand. However, if I search using an account that resides on the AD server (-D " cn=sync,cn=users,dc=example,dc=com" -w secret) it works and the traffic is encrypted. The root account "seems" to be ignored when it comes to the assertion butonly when ssl is enabled. Now, if I use TLS instead, ##Remote Active Directory uri ldap://ad.example.com/cn=Users,dc=example,dc=com tls start idassert-bind bindmethod=simple binddn="cn=sync,cn=users,dc=example,dc=com" credentials=secret tls_cacert=/etc/openldap/cacerts/ad-ca.cer tls_cert=/etc/openldap/local.pem tls_key=/etc/openldap/local.key Everything works, and I see the remote entries in AD using the meta root credentials. I've verified the network traffic to ensure it was indeed encrypted. I've also verified that using ldapsearch directly (ex: -H ldaps://ad.exmaple.com) to AD and it also functions as intended. I did play around with slapd-ldap and it seemed behave the same as meta regarding ldaps. In my eyes, something in my configuration makes the proxy seemingly ignore ldaps entries. Hopefully I didn't miss anything painfully obvious in the docs :) Thanks,

1 0

Configure OpenLDAP with MySQL backend
by Bruce Wen 29 Feb '12

29 Feb '12

Hi Dears, Do you have experience in configuring OpenLDAP with MySQL backend? If true, could you please share the key points? Bruce Wen iSoftStone Information Technology ( Group ) Co. Ltd. Jiahua Plaza, Shangdi 3rd Rd, Haidian District / Phone: 86-10-58749844 / Mobile: 13466687621 地址：北京市海淀区上地三街9号嘉华大厦E座8层

1 0

JIS X 0213
by suzuka46 29 Feb '12

29 Feb '12

Hi, I would like to install Openldap in Japanese environment. Is "JIS X 0213" of a Japanese character code supported in OpenLDAP?

2 2

cert options in ssl/tls connections
by Qiang Xu 28 Feb '12

28 Feb '12

Hello All, Today I came across a strange problem. I wrote a program to test ldap ssl/tls connection with OpenLDAP library. Something like the code snippet as follows: int ret = LDAP_OPT_SUCCESS; int cert_flag = LDAP_OPT_X_TLS_NEVER; ... ret = ldap_set_option(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, &cert_flag); if (ret != LDAP_OPT_SUCCESS) { fprintf(stderr, "unable to set require cert option (LDAP_OPT_X_TLS_REQUIRE_CERT): %s\n", ldap_err2string(ret)); } ... // bind to the server cert_flag = LDAP_OPT_X_TLS_DEMAND; ret = ldap_set_option(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, &cert_flag); if (ret != LDAP_OPT_SUCCESS) { fprintf(stderr, "unable to set require cert option (LDAP_OPT_X_TLS_REQUIRE_CERT): %s\n", ldap_err2string(ret)); } ... // bind to the server The first binding is successful, as expected. However, the second binding is also successful, which is contrary to my expectation, because I didn't create any cert file yet. Another observation here is that if the first binding with LDAP_OPT_X_TLS_NEVER is removed, and the second binding with LDAP_OPT_X_TLS_DEMAND set is done right from the beginning, then it will fail, as expected. So, it seems the first value set to the option LDAP_OPT_X_TLS_REQUIRE_CERT will override the later values, isn't it? Is it possible to change this option's value on the fly (means different bindings use different values for this cert option)? Thanks, Qiang

1 0

Delta-syncrepl issue
by Abderamane Hamani 28 Feb '12

28 Feb '12

Good morning, Is it possible to use always delta-syncrepl even the replica consumer is too far from the provider ?? Many thanks in advance

2 3

Re: Delta-syncrepl issue
by Mauricio Tavares 28 Feb '12

28 Feb '12

On Tue, Feb 28, 2012 at 1:24 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, February 28, 2012 3:54 PM +0100 Abderamane Hamani > <ahamani(a)escpeurope.eu> wrote: > >> Good morning, >> Is it possible to use always delta-syncrepl even the replica consumer is >> too far from the provider ?? Many thanks in advance > > > Your question doesn't make sense as worded. Delta-syncrepl is not limited > by physical distance. > > --Quanah > Also, depending on the traffic and connection speed between both machines, you might experience some slowdown, but it will just catch up eventually. Unless you keep changing your ldap database all the time. ;) > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

olcMirrorMode attribute in N-way multimaster
by Christopher Jones 28 Feb '12

28 Feb '12

Hi all, I'm working on an multimaster setup using the LDIF configuration (as opposed to slapd.conf). From my understanding of the documentation, Mirror Mode is distinct from N-way Multimaster in that it is an 'active-active/hot swap' configuration, and writes need to go a single server. In the admin guide's example found here: http://www.openldap.org/doc/admin24/replication.html#N-Way%20Multi-Master the N-way multimaster has this attribute set: add: olcMirrorMode olcMirrorMode: TRUE Could someone clarify what the olcMirrorMode attribute is for in the N-way multimaster configuration? Thanks for your help in advance, Chris

2 1

slapd/slaptest fail with cyrus-sasl-2.1.25
by Markus Wernig 28 Feb '12

28 Feb '12

Hello all I have openldap-2.4.29 on x86 Solaris 11, compiled from source. It links against cyrus-sasl libraries, also compiled from source. All was working well with cyrus-sasl-2.1.23. After upgrading sasl to 2.1.25 slapd refuses to start: # /usr/local/libexec/slapd -d 8 4f4a8bad @(#) $OpenLDAP: slapd 2.4.29 (Feb 26 2012 19:45:45) $ @xfer-srv01:/opt/build.d/openldap-2/tmp/openldap-2.4.29/servers/slapd 4f4a8bad slap_sasl_init: auxprop add plugin failed 4f4a8bad slapd stopped. 4f4a8bad connections_destroy: nothing to destroy. If i downgrade cyrus-sasl again to 2.1.23, the error does not occur and slapd works normally without recompiling. I have seen bug reports about a similar problem with debian, and from that report (http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=628237) it seemed that the problem lies with the sasl library, but should be fixed in the meantime. But still, I keep getting that error, and no configuration or compilation option (apart from totally disabling sasl) will help. Does anybody have an idea of how I could debug this further? Is this still a known issue? Thanks /markus

3 4

Re: the root of the directory tree
by stefano 28 Feb '12

28 Feb '12

ok, thanks other question: i'm working on a lan with students, teachers, some guests and a pair of administrators. i need that everyone can authenticate himself on the lan. there are some computers in a room and i want they will be powered on will appear a display to log in. the same thing for every computer that will be connect to our local network. every user will have his permissions to visit different sites, to see server resources, etc. i don't know how prepare this but for the moment am preparing the server populating it with every user. Now i need to know one thing. with the my configuration idea, is it enough to have the Simple Binding inserting only the userPassword of Person objectClass? do i need also account and simpleSecurityObject classes? On 02/28/2012 10:11 AM, Turbo Fredriksson wrote: > On Tue, 28 Feb 2012 08:02:42 +0100, stefano wrote: >> I am preparing an ldap server to allow every user to access the LAN >> only with his username and password. the root of the directorytree can >> be invented? i invented a domain amahoro.bi, can be correct? > > Sure. As long as you don't plan on publish it in any way and ONLY use > it internally, > that would work. > > Your base DN would then be: 'dc=amahora,dc=bi'. > > It's not the best of ideas (best is to register a domain name and use > that), but > functionally perfectly fine. > -- > ... but you know as soon as Oracle starts waving its wallet at a > Company it's time to run - fast. > /illumos mailing list >

4 4

the root of the directory tree
by stefano 28 Feb '12

28 Feb '12

good morning. i have a simple question for you. I am preparinganldapserverto allowevery user toaccess theLANonly withhis usernameand password.therootof thedirectorytreecanbeinvented?iinventeda domainamahoro.bi, canbecorrect? thanks

1 0

Mozilla NSS -- how to deploy intermediate certificate
by Aaron Bennett 27 Feb '12

27 Feb '12

Hello, I need to publish the GeoTrust intermediate certificate; I'm using 2.4.29 built against Mozilla NSS. In OpenSSL world, I'd use -- I think -- TLSCACertificateFile /path/to/CA-certificates. Here's what I've tried: Download GeoTrust cert from https://knowledge.geotrust.com/support/knowledge-base/index?page=content&id… ; save as intermediate.crt Import with: # certutil -d /etc/openldap/nssdb/ -A -t ",," -n geotrust-intermediate -i intermediate.crt Certutil -L now shows: # certutil -d /etc/openldap/nssdb/ -L Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI geotrust-intermediate ,, ds.clarku.edu Pu,Pu,Pu cn=config looks like this: olcTLSCACertificateFile: geotrust-intermediate olcTLSCACertificatePath: /etc/openldap/nssdb olcTLSCertificateFile: ds.clarku.edu But still clients cannot verify the cert. Any Mozilla NSS guru's know what I'm going wrong? Thanks, Aaron

4 14

Resync DEL
by Marc Patermann 27 Feb '12

27 Feb '12

Hi, due to the "DEL don't get replicated" issue, I have inconsistent data on the consumers. I set up a test pair with a provider with current master data and a consumer with current slave data. The data set differs in a few entries which DEL were not replicated. Is there any way to get the two server on sync again other then completely delete the database and refill (by slapadd from master or full resync) on the consumer? I tried (with various combinations of 2.4.26, 2.4.28 and current pre 2.4.30) to start the consumer with "-c rid=xxx,csn=" which starts a full sync, but the (on the master not existing) objects don't get deleted (on the slave). Marc

4 7

require StartTLS
by Daniel Pocock 26 Feb '12

26 Feb '12

Is there some way to ensure that a client who connects on port 389 can do nothing without StartTLS? Or is it necessary to just disable port 389 and only listen for ldaps:/// ?

6 7

Private OID range(s) ?
by Nick Milas 26 Feb '12

26 Feb '12

Hello, I was wondering whether there exists - officially or unofficially - a range of private OIDs which can be used internally (privately) in an organization, and is not allowed for schema distribution; something like private network IP address ranges (10.0.0.0/8, etc.) The existence of such private OIDs would allow organizations to avoid registering their own OID branch, since the "private" OID range would guarrantee that these OIDs can be used internally by the organization safely and would not be included in a new schema distribution; thus, conflicts can be excluded. Any organization which would be using such a "private OID range", should not be allowed to make the associated LDAP attributes publicly available (not even searchable) in its Directory interations. Secondarily, the above would also serve as an "example" range of OIDs which could be used for communication of schema drafts. I haven't come across something like this until now. Thanks, Nick

5 10

Re: RE24 testing call#1 (2.4.30)
by Jens Vagelpohl 26 Feb '12

26 Feb '12

On Feb 24, 2012, at 19:20 , Quanah Gibson-Mount wrote: > If you know how to build OpenLDAP manually, and would like to participate in testing the next set of code for the 2.4.30 release, please do so. All OK on OS X 10.7.3 x86_64 against BDB 4.7.52+patches jens

2 1

Controlling access based on group membership
by Nick Milas 24 Feb '12

24 Feb '12

Hi, I have a problem of long and complex ACLs which I need to improve. Therefore, I am thinking of a way to change privilege (access) management. I have dc=example,dc=com, with branches ou=people, ou=aliases (for email use), ou=dns (dns entries), ou=Groups. In ou=Groups entries are of the form: dn: cn=TechAdmins,ou=Groups,dc=example,dc=com objectClass: groupOfNames cn: TechAdmins member: uid=jack,ou=people,dc=example,dc=com member: uid=jeff,ou=people,dc=example,dc=com I would like to be able to control access to any and all entries based on attributes (to be added to the entries) which specify a group to be used for administration. So, for example, I could add to all entries an AUXiliary objectClass (hypothetical at the moment) "AdminGroupOwnership" with (multi-valued) attributes: AdminGroups and ReadGroups, SearchGroups with values of the form: cn=<groupname>,ou=Groups,dc=example,dc=com. Members of the first would have write access, members of the second would have read access, and members of the third would have search access only. I would like to ask the list: 1. Can someone demonstrate how we should formulate an ACL which would accomplish the above? The ACL should say: access to <some entries> <some attribute> by {a DN which belongs to a Group specified in the AdminGroups attr of the entry} write by {a DN which belongs to a Group specified in the ReadGroups attr of the entry} read by {a DN which belongs to a Group specified in the SearchGroups attr of the entry} search 2. Is there an existing (included in the distribution or available from a third-party) schema or similar mechanism available (so that I don't re-invent the wheel)? Thanks in advance, Nick

3 10

How to delete openldap database
by Peter Blajev 24 Feb '12

24 Feb '12

Fresh install of openldap 2.4.23 and friends on RHEL6/CentOS6 comes with dc=my-domain,dc=com database. After starting slapd when I try to delete it the server is not willing to perform: ==== # ldapsearch -x -LLL -s base namingContexts dn: namingContexts: dc=my-domain,dc=com # ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b cn=config dn dn: cn=config dn: cn=schema,cn=config dn: cn={0}corba,cn=schema,cn=config ... (snip) ... dn: olcDatabase={2}bdb,cn=config # ldapdelete -Q -Y EXTERNAL -H ldapi:/// -v olcDatabase={2}bdb,cn=config ldap_initialize( ldapi:///??base ) deleting entry "olcDatabase={2}bdb,cn=config" ldap_delete: Server is unwilling to perform (53) ==== I can delete /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{2\}bdb.ldif file before starting slapd but what is the proper way of deleting this database? Thank you -- Peter

1 0

TLS/SSL issues
by Paul Stephens 24 Feb '12

24 Feb '12

Hi, Having problems getting my TLS setup working. Current setup: Ubuntu 11.10 (3.0.0-16 server) OpenLDAP 2.4.25 I have been using the instructions at: https://help.ubuntu.com/11.10/serverguide/C/openldap-server.html though to be honest I am relatively new to TLS and using certtool, etc. I have now been copy and pasting the commands given in case my typing is as good as it usually is. Unencrypted LDAP works fine including syncing with a slave and samba authentication (non-TLS that is!) It appears to be something to do with the self-signed certificate not being trusted and seems to be a common problem people run into. I have been researching it for a while but at this stage I’m kind of just trying randomly browsed suggestions, with most admittedly geared towards pervious OpenLDAP versions and not really assisting with my understanding of the problem in the first place. I’ll probably give away more information than I should below but at this stage I will just blow everything away and start again once I understand where I’m going wrong anyway. So when I try: # nutls-cli --print-cert -p 636 cabernet.burnet.edu.au Resolving 'cabernet.burnet.edu.au'... Connecting to '10.10.0.3:636'... - Certificate type: X.509 - Got a certificate list of 2 certificates. - Certificate[0] info: - subject `O=Burnet Institute,CN=cabernet.burnet.edu.au', issuer `CN= cabernet.burnet.edu.au', RSA key 1024 bits, signed using RSA-SHA1, activated `2012-02-23 04:57:57 UTC', expires `2022-02-20 04:57:57 UTC', SHA-1 fingerprint `346ed1e006ce7975afbcaf81d58de886b25953de' -----BEGIN CERTIFICATE----- MIICzTCCAbWgAwIBAgIET0XHVTANBgkqhkiG9w0BAQUFADAhMR8wHQYDVQQDExZj YWJlcm5ldC5idXJuZXQuZWR1LmF1MB4XDTEyMDIyMzA0NTc1N1oXDTIyMDIyMDA0 NTc1N1owPDEZMBcGA1UEChMQQnVybmV0IEluc3RpdHV0ZTEfMB0GA1UEAxMWY2Fi ZXJuZXQuYnVybmV0LmVkdS5hdTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA wwwwl9aNyiAsAktsYbWhS6ePMOIcE3pSt0tT4BG3CUu22/ER9iV9NTZ2JlPiduHr Tq7NBp6PCCz9jpH+k9LZcMwbH+3d1HXK7trKM+JZo4oWHW08Iy7FsW+zIxHVhbwr 2P1qxG7FrSOJ0pchYgVMkZ6UqMJKfKXlbdwdt28DqKcCAwEAAaN2MHQwDAYDVR0T AQH/BAIwADATBgNVHSUEDDAKBggrBgEFBQcDATAPBgNVHQ8BAf8EBQMDB6AAMB0G A1UdDgQWBBT3BkevTphmj4dd+D6NbwRSQWdlOzAfBgNVHSMEGDAWgBSeTWcMd+Ku cx3LyZwwmlVCqf4QhzANBgkqhkiG9w0BAQUFAAOCAQEAORZl+B7XZ+7ygXWKcAph 3pfwImm1SevJqmtDnzNz3XW7zm/8MKBtVjZsvS7l8/pxpGDThuop5RvQMZY7RwiS SCFo7QglnM+kGqAuqIIBPCiQSNP3cxBBCcjUC88Mzm34+iIZIzvabjHHD+/7bD2x Sd5pSJxH6zvyVbZcEwHgVtK6gBQ3r1fMFrgC6ggu21pS+J8lVCvTG4gvRx8VIVG8 BusdlMbtiOOz+MY9XrDIfjQ0vyE6y+lYy/SdFOcUCmfd+vH6aT/yl4sMVMUXXGo6 BrIkPLBzUjJzXJAyfMq0qiRKaxqLXloAvAsu/7uP25ldrIbjsHEBSfTR0d984BMW ow== -----END CERTIFICATE----- - Certificate[1] info: - subject `CN=cabernet.burnet.edu.au', issuer `CN=cabernet.burnet.edu.au', RSA key 2048 bits, signed using RSA-SHA1, activated `2012-02-23 04:54:42 UTC', expires `2013-02-22 04:54:42 UTC', SHA-1 fingerprint `d666459a5417a25adc7dbbf6f4bad5c6345166ee' -----BEGIN CERTIFICATE----- MIIDAzCCAeugAwIBAgIET0XGkjANBgkqhkiG9w0BAQUFADAhMR8wHQYDVQQDExZj YWJlcm5ldC5idXJuZXQuZWR1LmF1MB4XDTEyMDIyMzA0NTQ0MloXDTEzMDIyMjA0 NTQ0MlowITEfMB0GA1UEAxMWY2FiZXJuZXQuYnVybmV0LmVkdS5hdTCCASIwDQYJ KoZIhvcNAQEBBQADggEPADCCAQoCggEBAPSW4LRc/C0u9DcwA7twyZnKJblGkMt1 mRmoyZUnUu60bSmZB5ulf1IVICWg2Rdv9mfGoB4zmixLJINg6TPiHXpCw7ad2Ci9 hUx30BFpy4H0qOElV1ZPnA/hi2fNgFODB7TSMuV+EoNPosxWkufhYH0mfaWyfIFH ZlfJUPtF2Lg1U4nyDjVKq4QNyFM/Hzhk3M/kSlSwSIQbw2b4U6QaprVc31RKUPsp 9i44k+2eA5SMXGafCGyvH/3pprnWil4t+Snr4IBrv+w63T5Ip7JT1S//fSN48+0E vwTJbZp0+8MoHHbFeutJCh6Omwj/8+H2sKqftXVqMglqbv2WWMIV/V0CAwEAAaND MEEwDwYDVR0TAQH/BAUwAwEB/zAPBgNVHQ8BAf8EBQMDBwQAMB0GA1UdDgQWBBSe TWcMd+Kucx3LyZwwmlVCqf4QhzANBgkqhkiG9w0BAQUFAAOCAQEAiFNzqT2C8gFw sSGA1OJ30yZPVRajvZgyJS4y4tdxOzfQtSKy1sZwCfFSb8z8Ejuj75WhLFvJ+8UV fpmmBwT/o83BbCDoI6eayt0lBqeEGcEciOtKsrds+Qa8rhywVdXcO+cdE5SgjtdL DsVHWXp9krYy7cDM2Fthidwz+TdifgMWjEMI8M/zO+51ceGRPpfOjlmFsRFW2aQp YJP/MaQEkxN2UgN+K4OXHJo7l/NcLVu+e34JKeRd/l7xfxnjfMxvoPXmxzCNOVd8 RAsWd3McOL4osTY5O5sQYnu5/L3Kbyqear88reVFfJwvYAp/UXy/ozVcebXo5M+p dNpyevLA2g== -----END CERTIFICATE----- - The hostname in the certificate matches 'cabernet.burnet.edu.au'. - Peer's certificate issuer is unknown - Peer's certificate is NOT trusted - Version: TLS1.2 - Key Exchange: RSA - Cipher: AES-128-CBC - MAC: SHA256 - Compression: NULL - Handshake was completed ******* LDAP search TLS test ****** # ldapsearch -ZZ -d -1 ldap_create ldap_extended_operation_s ldap_extended_operation ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP localhost:389 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 127.0.0.1:389 ldap_pvt_connect: fd: 3 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_dump: buf=0x7ff66fe28680 ptr=0x7ff66fe28680 end=0x7ff66fe2869f len=31 0000: 30 1d 02 01 01 77 18 80 16 31 2e 33 2e 36 2e 31 0....w...1.3.6.1 0010: 2e 34 2e 31 2e 31 34 36 36 2e 32 30 30 33 37 .4.1.1466.20037 ber_scanf fmt ({) ber: ber_dump: buf=0x7ff66fe28680 ptr=0x7ff66fe28685 end=0x7ff66fe2869f len=26 0000: 77 18 80 16 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e w...1.3.6.1.4.1. 0010: 31 34 36 36 2e 32 30 30 33 37 1466.20037 ber_flush2: 31 bytes to sd 3 0000: 30 1d 02 01 01 77 18 80 16 31 2e 33 2e 36 2e 31 0....w...1.3.6.1 0010: 2e 34 2e 31 2e 31 34 36 36 2e 32 30 30 33 37 .4.1.1466.20037 ldap_write: want=31, written=31 0000: 30 1d 02 01 01 77 18 80 16 31 2e 33 2e 36 2e 31 0....w...1.3.6.1 0010: 2e 34 2e 31 2e 31 34 36 36 2e 32 30 30 33 37 .4.1.1466.20037 ldap_result ld 0x7ff66fe1f160 msgid 1 wait4msg ld 0x7ff66fe1f160 msgid 1 (infinite timeout) wait4msg continue ld 0x7ff66fe1f160 msgid 1 all 1 ** ld 0x7ff66fe1f160 Connections: * host: localhost port: 389 (default) refcnt: 2 status: Connected last used: Thu Feb 23 16:54:28 2012 ** ld 0x7ff66fe1f160 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x7ff66fe1f160 request count 1 (abandoned 0) ** ld 0x7ff66fe1f160 Response Queue: Empty ld 0x7ff66fe1f160 response count 0 ldap_chkResponseList ld 0x7ff66fe1f160 msgid 1 all 1 ldap_chkResponseList returns ld 0x7ff66fe1f160 NULL ldap_int_select read1msg: ld 0x7ff66fe1f160 msgid 1 all 1 ber_get_next ldap_read: want=8, got=8 0000: 30 0c 02 01 01 78 07 0a 0....x.. ldap_read: want=6, got=6 0000: 01 00 04 00 04 00 ...... ber_get_next: tag 0x30 len 12 contents: ber_dump: buf=0x7ff66fe297e0 ptr=0x7ff66fe297e0 end=0x7ff66fe297ec len=12 0000: 02 01 01 78 07 0a 01 00 04 00 04 00 ...x........ read1msg: ld 0x7ff66fe1f160 msgid 1 message type extended-result ber_scanf fmt ({eAA) ber: ber_dump: buf=0x7ff66fe297e0 ptr=0x7ff66fe297e3 end=0x7ff66fe297ec len=9 0000: 78 07 0a 01 00 04 00 04 00 x........ read1msg: ld 0x7ff66fe1f160 0 new referrals read1msg: mark request completed, ld 0x7ff66fe1f160 msgid 1 request done: ld 0x7ff66fe1f160 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_parse_extended_result ber_scanf fmt ({eAA) ber: ber_dump: buf=0x7ff66fe297e0 ptr=0x7ff66fe297e3 end=0x7ff66fe297ec len=9 0000: 78 07 0a 01 00 04 00 04 00 x........ ldap_parse_result ber_scanf fmt ({iAA) ber: ber_dump: buf=0x7ff66fe297e0 ptr=0x7ff66fe297e3 end=0x7ff66fe297ec len=9 0000: 78 07 0a 01 00 04 00 04 00 x........ ber_scanf fmt (}) ber: ber_dump: buf=0x7ff66fe297e0 ptr=0x7ff66fe297ec end=0x7ff66fe297ec len=0 ldap_msgfree tls_write: want=126, written=126 0000: 16 03 03 00 79 01 00 00 75 03 03 4f 45 d4 94 f1 ....y...u..OE... 0010: 7c 3e 41 05 6a 43 c7 96 05 77 9d f3 83 22 c7 c5 |>A.jC...w...".. 0020: d8 b0 06 7c 6f fe 70 b6 b4 fa 78 00 00 30 00 67 ...|o.p...x..0.g 0030: 00 33 00 45 00 6b 00 39 00 88 00 16 00 40 00 32 .3.E.k.9.....@.2 0040: 00 44 00 6a 00 38 00 87 00 13 00 66 00 3c 00 2f .D.j.8.....f.<./ 0050: 00 41 00 3d 00 35 00 84 00 0a 00 05 00 04 01 00 .A.=.5.......... 0060: 00 1c 00 09 00 03 02 00 01 ff 01 00 01 00 00 0d ................ 0070: 00 0c 00 0a 02 01 02 02 04 01 05 01 06 01 .............. tls_read: want=5, got=5 0000: 16 03 03 00 51 ....Q tls_read: want=81, got=81 0000: 02 00 00 4d 03 03 4f 45 d4 94 9e 56 0b 56 c2 c1 ...M..OE...V.V.. 0010: 6b 05 2b 45 e1 bd 0b 64 32 58 b7 0e 12 ad e2 99 k.+E...d2X...... 0020: bd 8e de c7 97 c5 20 0d ab 14 f0 0b 42 44 47 20 ...... .....BDG 0030: 95 67 22 45 74 ab 50 51 9f a8 b8 f1 d4 14 73 2e .g"Et.PQ......s. 0040: 9f 0d 61 6d 4d d1 a7 00 3c 00 00 05 ff 01 00 01 ..amM...<....... 0050: 00 . tls_read: want=5, got=5 0000: 16 03 03 05 e5 ..... tls_read: want=1509, got=1509 0000: 0b 00 05 e1 00 05 de 00 02 d1 30 82 02 cd 30 82 ..........0...0. 0010: 01 b5 a0 03 02 01 02 02 04 4f 45 c7 55 30 0d 06 .........OE.U0.. 0020: 09 2a 86 48 86 f7 0d 01 01 05 05 00 30 21 31 1f .*.H........0!1. 0030: 30 1d 06 03 55 04 03 13 16 63 61 62 65 72 6e 65 0...U....caberne 0040: 74 2e 62 75 72 6e 65 74 2e 65 64 75 2e 61 75 30 t.burnet.edu.au0 0050: 1e 17 0d 31 32 30 32 32 33 30 34 35 37 35 37 5a ...120223045757Z 0060: 17 0d 32 32 30 32 32 30 30 34 35 37 35 37 5a 30 ..220220045757Z0 0070: 3c 31 19 30 17 06 03 55 04 0a 13 10 42 75 72 6e <1.0...U....Burn 0080: 65 74 20 49 6e 73 74 69 74 75 74 65 31 1f 30 1d et Institute1.0. 0090: 06 03 55 04 03 13 16 63 61 62 65 72 6e 65 74 2e ..U....cabernet. 00a0: 62 75 72 6e 65 74 2e 65 64 75 2e 61 75 30 81 9f burnet.edu.au0.. 00b0: 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 0...*.H......... 00c0: 81 8d 00 30 81 89 02 81 81 00 c3 0c 30 97 d6 8d ...0........0... 00d0: ca 20 2c 02 4b 6c 61 b5 a1 4b a7 8f 30 e2 1c 13 . ,.Kla..K..0... 00e0: 7a 52 b7 4b 53 e0 11 b7 09 4b b6 db f1 11 f6 25 zR.KS....K.....% 00f0: 7d 35 36 76 26 53 e2 76 e1 eb 4e ae cd 06 9e 8f }56v&S.v..N..... 0100: 08 2c fd 8e 91 fe 93 d2 d9 70 cc 1b 1f ed dd d4 .,.......p...... 0110: 75 ca ee da ca 33 e2 59 a3 8a 16 1d 6d 3c 23 2e u....3.Y....m<#. 0120: c5 b1 6f b3 23 11 d5 85 bc 2b d8 fd 6a c4 6e c5 ..o.#....+..j.n. 0130: ad 23 89 d2 97 21 62 05 4c 91 9e 94 a8 c2 4a 7c .#...!b.L.....J| 0140: a5 e5 6d dc 1d b7 6f 03 a8 a7 02 03 01 00 01 a3 ..m...o......... 0150: 76 30 74 30 0c 06 03 55 1d 13 01 01 ff 04 02 30 v0t0...U.......0 0160: 00 30 13 06 03 55 1d 25 04 0c 30 0a 06 08 2b 06 .0...U.%..0...+. 0170: 01 05 05 07 03 01 30 0f 06 03 55 1d 0f 01 01 ff ......0...U..... 0180: 04 05 03 03 07 a0 00 30 1d 06 03 55 1d 0e 04 16 .......0...U.... 0190: 04 14 f7 06 47 af 4e 98 66 8f 87 5d f8 3e 8d 6f ....G.N.f..].>.o 01a0: 04 52 41 67 65 3b 30 1f 06 03 55 1d 23 04 18 30 .RAge;0...U.#..0 01b0: 16 80 14 9e 4d 67 0c 77 e2 ae 73 1d cb c9 9c 30 ....Mg.w..s....0 01c0: 9a 55 42 a9 fe 10 87 30 0d 06 09 2a 86 48 86 f7 .UB....0...*.H.. 01d0: 0d 01 01 05 05 00 03 82 01 01 00 39 16 65 f8 1e ...........9.e.. 01e0: d7 67 ee f2 81 75 8a 70 0a 61 de 97 f0 22 69 b5 .g...u.p.a..."i. 01f0: 49 eb c9 aa 6b 43 9f 33 73 dd 75 bb ce 6f fc 30 I...kC.3s.u..o.0 0200: a0 6d 56 36 6c bd 2e e5 f3 fa 71 a4 60 d3 86 ea .mV6l.....q.`... 0210: 29 e5 1b d0 31 96 3b 47 08 92 48 21 68 ed 08 25 )...1.;G..H!h..% 0220: 9c cf a4 1a a0 2e a8 82 01 3c 28 90 48 d3 f7 73 .........<(.H..s 0230: 10 41 09 c8 d4 0b cf 0c ce 6d f8 fa 22 19 23 3b .A.......m..".#; 0240: da 6e 31 c7 0f ef fb 6c 3d b1 49 de 69 48 9c 47 .n1....l=.I.iH.G 0250: eb 3b f2 55 b6 5c 13 01 e0 56 d2 ba 80 14 37 af .;.U.\...V....7. 0260: 57 cc 16 b8 02 ea 08 2e db 5a 52 f8 9f 25 54 2b W........ZR..%T+ 0270: d3 1b 88 2f 47 1f 15 21 51 bc 06 eb 1d 94 c6 ed .../G..!Q....... 0280: 88 e3 b3 f8 c6 3d 5e b0 c8 7e 34 34 bf 21 3a cb .....=^..~44.!:. 0290: e9 58 cb f4 9d 14 e7 14 0a 67 dd fa f1 fa 69 3f .X.......g....i? 02a0: f2 97 8b 0c 54 c5 17 5c 6a 3a 06 b2 24 3c b0 73 ....T..\j:..$<.s 02b0: 52 32 73 5c 90 32 7c ca b4 aa 24 4a 6b 1a 8b 5e R2s\.2|...$Jk..^ 02c0: 5a 00 bc 0b 2e ff bb 8f db 99 5d ac 86 e3 b0 71 Z.........]....q 02d0: 01 49 f4 d1 d1 df 7c e0 13 16 a3 00 03 07 30 82 .I....|.......0. 02e0: 03 03 30 82 01 eb a0 03 02 01 02 02 04 4f 45 c6 ..0..........OE. 02f0: 92 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 .0...*.H........ 0300: 30 21 31 1f 30 1d 06 03 55 04 03 13 16 63 61 62 0!1.0...U....cab 0310: 65 72 6e 65 74 2e 62 75 72 6e 65 74 2e 65 64 75 ernet.burnet.edu 0320: 2e 61 75 30 1e 17 0d 31 32 30 32 32 33 30 34 35 .au0...120223045 0330: 34 34 32 5a 17 0d 31 33 30 32 32 32 30 34 35 34 442Z..1302220454 0340: 34 32 5a 30 21 31 1f 30 1d 06 03 55 04 03 13 16 42Z0!1.0...U.... 0350: 63 61 62 65 72 6e 65 74 2e 62 75 72 6e 65 74 2e cabernet.burnet. 0360: 65 64 75 2e 61 75 30 82 01 22 30 0d 06 09 2a 86 edu.au0.."0...*. 0370: 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 H.............0. 0380: 01 0a 02 82 01 01 00 f4 96 e0 b4 5c fc 2d 2e f4 ...........\.-.. 0390: 37 30 03 bb 70 c9 99 ca 25 b9 46 90 cb 75 99 19 70..p...%.F..u.. 03a0: a8 c9 95 27 52 ee b4 6d 29 99 07 9b a5 7f 52 15 ...'R..m).....R. 03b0: 20 25 a0 d9 17 6f f6 67 c6 a0 1e 33 9a 2c 4b 24 %...o.g...3.,K$ 03c0: 83 60 e9 33 e2 1d 7a 42 c3 b6 9d d8 28 bd 85 4c .`.3..zB....(..L 03d0: 77 d0 11 69 cb 81 f4 a8 e1 25 57 56 4f 9c 0f e1 w..i.....%WVO... 03e0: 8b 67 cd 80 53 83 07 b4 d2 32 e5 7e 12 83 4f a2 .g..S....2.~..O. 03f0: cc 56 92 e7 e1 60 7d 26 7d a5 b2 7c 81 47 66 57 .V...`}&}..|.GfW 0400: c9 50 fb 45 d8 b8 35 53 89 f2 0e 35 4a ab 84 0d .P.E..5S...5J... 0410: c8 53 3f 1f 38 64 dc cf e4 4a 54 b0 48 84 1b c3 .S?.8d...JT.H... 0420: 66 f8 53 a4 1a a6 b5 5c df 54 4a 50 fb 29 f6 2e f.S....\.TJP.).. 0430: 38 93 ed 9e 03 94 8c 5c 66 9f 08 6c af 1f fd e9 8......\f..l.... 0440: a6 b9 d6 8a 5e 2d f9 29 eb e0 80 6b bf ec 3a dd ....^-.)...k..:. 0450: 3e 48 a7 b2 53 d5 2f ff 7d 23 78 f3 ed 04 bf 04 >H..S./.}#x..... 0460: c9 6d 9a 74 fb c3 28 1c 76 c5 7a eb 49 0a 1e 8e .m.t..(.v.z.I... 0470: 9b 08 ff f3 e1 f6 b0 aa 9f b5 75 6a 32 09 6a 6e ..........uj2.jn 0480: fd 96 58 c2 15 fd 5d 02 03 01 00 01 a3 43 30 41 ..X...]......C0A 0490: 30 0f 06 03 55 1d 13 01 01 ff 04 05 30 03 01 01 0...U.......0... 04a0: ff 30 0f 06 03 55 1d 0f 01 01 ff 04 05 03 03 07 .0...U.......... 04b0: 04 00 30 1d 06 03 55 1d 0e 04 16 04 14 9e 4d 67 ..0...U.......Mg 04c0: 0c 77 e2 ae 73 1d cb c9 9c 30 9a 55 42 a9 fe 10 .w..s....0.UB... 04d0: 87 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 .0...*.H........ 04e0: 03 82 01 01 00 88 53 73 a9 3d 82 f2 01 70 b1 21 ......Ss.=...p.! 04f0: 80 d4 e2 77 d3 26 4f 55 16 a3 bd 98 32 25 2e 32 ...w.&OU....2%.2 0500: e2 d7 71 3b 37 d0 b5 22 b2 d6 c6 70 09 f1 52 6f ..q;7.."...p..Ro 0510: cc fc 12 3b a3 ef 95 a1 2c 5b c9 fb c5 15 7e 99 ...;....,[....~. 0520: a6 07 04 ff a3 cd c1 6c 20 e8 23 a7 9a ca dd 25 .......l .#....% 0530: 06 a7 84 19 c1 1c 88 eb 4a b2 b7 6c f9 06 bc ae ........J..l.... 0540: 1c b0 55 d5 dc 3b e7 1d 13 94 a0 8e d7 4b 0e c5 ..U..;.......K.. 0550: 47 59 7a 7d 92 b6 32 ed c0 cc d8 5b 61 89 dc 33 GYz}..2....[a..3 0560: f9 37 62 7e 03 16 8c 43 08 f0 cf f3 3b ee 75 71 .7b~...C....;.uq 0570: e1 91 3e 97 ce 8e 59 85 b1 11 56 d9 a4 29 60 93 ..>...Y...V..)`. 0580: ff 31 a4 04 93 13 76 52 03 7e 2b 83 97 1c 9a 3b .1....vR.~+....; 0590: 97 f3 5c 2d 5b be 7b 7e 09 29 e4 5d fe 5e f1 7f ..\-[.{~.).].^.. 05a0: 19 e3 7c cc 6f a0 f5 e6 c7 30 8d 39 57 7c 44 0b ..|.o....0.9W|D. 05b0: 16 77 73 1c 38 be 28 b1 36 39 3b 9b 10 62 7b b9 .ws.8.(.69;..b{. 05c0: fc bd ca 6f 2a 9e 6a bf 3c ad e5 45 7c 9c 2f 60 ...o*.j.<..E|./` 05d0: 0a 7f 51 7c bf a3 35 5c 79 b5 e8 e4 cf a9 74 da ..Q|..5\y.....t. 05e0: 72 7a f2 c0 da rz... tls_read: want=5, got=5 0000: 16 03 03 00 04 ..... tls_read: want=4, got=4 0000: 0e 00 00 00 .... tls_write: want=139, written=139 0000: 16 03 03 00 86 10 00 00 82 00 80 27 8b cb 55 4b ...........'..UK 0010: 5e 9f 1c 8f e0 f6 40 3f b8 2e c7 39 58 54 2a a5 ^.....@?...9XT*. 0020: c7 02 a3 07 b4 20 e0 b4 cd 04 c9 de 4e 43 71 ef ..... ......NCq. 0030: e2 f4 1e ae f0 f4 fb 97 cb 5f e2 d9 58 28 f3 e4 ........._..X(.. 0040: 98 ee 1f 75 7f b9 50 e0 79 7a 85 1a 45 99 7c a2 ...u..P.yz..E.|. 0050: 9f d4 d6 02 21 b8 b8 e5 0b 00 d4 87 36 8f 16 d2 ....!.......6... 0060: f1 92 fb 6e 34 06 a9 eb 2b 07 6d be 5e 6a 8f 13 ...n4...+.m.^j.. 0070: d2 1a b5 76 51 65 b4 bb c9 54 da 9c b8 eb 22 1c ...vQe...T....". 0080: 24 b0 7e 4c a6 d8 9c 3e 1d ec 97 $.~L...>... tls_write: want=6, written=6 0000: 14 03 03 00 01 01 ...... tls_write: want=149, written=149 0000: 16 03 03 00 90 42 db 5e 66 fe 67 8d 28 5c 2b 4e .....B.^f.g.(\+N 0010: 30 83 de f3 e5 9b 72 1c ad 0a 47 fc bb e5 00 86 0.....r...G..... 0020: 15 38 99 7e 65 32 7a 83 dd d3 38 da 1f 02 19 90 .8.~e2z...8..... 0030: ce 52 04 ca 19 f9 23 64 eb 95 32 f7 99 1a e6 70 .R....#d..2....p 0040: 87 91 8d fd de 91 99 34 15 24 95 dc 9b 18 6e 2c .......4.$....n, 0050: d0 61 08 5f 8a d6 67 ef 07 0d ac f7 97 f0 ee ec .a._..g......... 0060: 06 c5 34 27 55 af 0e c2 41 df df 5f 2a 3f 70 e7 ..4'U...A.._*?p. 0070: 6a 15 e8 d2 b3 30 8e d2 b7 02 1d 41 87 c0 3c 09 j....0.....A..<. 0080: 2c 3e 74 aa 10 b1 5a 89 22 73 16 ff c4 99 0b d4 ,>t...Z."s...... 0090: c8 30 5f 78 3a .0_x: tls_read: want=5, got=5 0000: 14 03 03 00 01 ..... tls_read: want=1, got=1 0000: 01 . tls_read: want=5, got=5 0000: 16 03 03 01 20 .... tls_read: want=288, got=288 0000: 25 02 9a a1 d7 69 40 00 ba 2b 75 2c 4e 7b 82 21 %....i@..+u,N{.! 0010: f9 0d 2e 55 1b 3f 34 c9 5e 59 43 7f 6c d2 c2 52 ...U.?4.^YC.l..R 0020: 5d bf 44 e9 93 65 33 bc a8 9b f8 b7 d3 f2 f6 15 ].D..e3......... 0030: b1 e9 58 3a 16 c3 22 f9 9b 0c ff 4f 19 d0 cc f9 ..X:.."....O.... 0040: cd 2d 76 15 48 20 57 c5 c0 6b cd 2c 4a 5b b1 9d .-v.H W..k.,J[.. 0050: 1b d3 9b bf 16 c4 36 ee ca 2e af 23 7c b7 e7 e1 ......6....#|... 0060: f9 bf 46 b6 06 12 fe fe ab 3d 34 5e c7 9c 4a 52 ..F......=4^..JR 0070: 99 70 70 0f d1 8d fd 55 bb f9 f5 2b 56 dc 5b 00 .pp....U...+V.[. 0080: f2 75 f3 74 89 65 91 a5 5f 70 09 5b 09 c0 e8 48 .u.t.e.._p.[...H 0090: 4a db f6 15 14 4a 41 fe 14 09 73 cf fa 5b 1c 7c J....JA...s..[.| 00a0: 68 82 fd 1d da 49 2d 12 83 b0 67 15 56 7c f8 ee h....I-...g.V|.. 00b0: 75 08 7a 3d 1a a6 87 aa bc 7d ff b4 71 43 93 8c u.z=.....}..qC.. 00c0: b4 c6 3e a0 5b 3b 10 e9 16 62 b0 dc cb a8 08 77 ..>.[;...b.....w 00d0: d0 51 31 ed 8b 05 62 1f 3f a1 9d 45 ff d8 3f ba .Q1...b.?..E..?. 00e0: ae a1 d6 ac 29 e6 f8 75 87 33 8e a7 19 9f 69 ec ....)..u.3....i. 00f0: fd d5 49 20 4e 09 aa 3d da c4 50 a5 0d 50 0b f9 ..I N..=..P..P.. 0100: c1 2a b9 bd 71 6a 5a 6e e7 01 0c df 1c 44 33 34 .*..qjZn.....D34 0110: 6e ac e6 db 1a 7d ef 10 5e 68 d3 4b cc 56 59 01 n....}..^h.K.VY. TLS: peer cert untrusted or revoked (0x42) TLS: can't connect: (unknown error code). ldap_err2string ldap_start_tls: Connect error (-11) additional info: (unknown error code) I also get quite a few these errors in the syslog, though they don’t appear to be coincide with my manual connection attempts: Feb 23 16:20:41 cabernet slapd[9024]: connection_read(25): no connection! Feb 23 16:20:41 cabernet slapd[9024]: <= bdb_equality_candidates: (objectClass) not indexed Please let me know if there is anything else you want and thanks in advance for any suggestions Cheers Paul

3 2

Re: alias entries across database bounds, allowed if DBs are "subordinate"?
by Judd Maltin 24 Feb '12

24 Feb '12

On Fri, Feb 24, 2012 at 11:47 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, February 23, 2012 5:04 PM -0800 Howard Chu <hyc(a)symas.com> > wrote: > >> Judd Maltin wrote: >>> >>> Hey folks, >>> >>> On the same slapd server, I have two databases with different suffixes. >>> >>> I'd like to create an alias entry in one database and suffix to return >>> an entry from the other database and suffix. >>> >>> Would this be possible if the second database were subordinate to the >>> other? Or, because it does not share namingContext by being in the >>> same suffix, would it fail? >>> >>> Otherwise I'm going to setup another slapd and use back-ldap/meta to >>> proxy what I need. >> >> >> No, aliases cannot cross DB boundaries, regardless of subordinate. > > > Any reason why you don't make it all a single DB? > > --Quanah > Thanks for the responses, guys. I inherited the existing and will be replacing with one DB. I'm now slapcatting the DBs and loading into a single DB as POC. -judd -- Judd Maltin T: 917-882-1270 F: 501-694-7809 A loving heart is never wrong.

1 0

OpenLDAP training Europe
by Pieter Baele 24 Feb '12

24 Feb '12

Any recommendations for OpenLDAP traing going further then the basics? location: Belgium, France, Germany or UK Sincerely, PieterB

2 1

alias entries across database bounds, allowed if DBs are "subordinate"?
by Judd Maltin 24 Feb '12

24 Feb '12

Hey folks, On the same slapd server, I have two databases with different suffixes. I'd like to create an alias entry in one database and suffix to return an entry from the other database and suffix. Would this be possible if the second database were subordinate to the other? Or, because it does not share namingContext by being in the same suffix, would it fail? Otherwise I'm going to setup another slapd and use back-ldap/meta to proxy what I need. Thanks! -judd -- Judd Maltin T: 917-882-1270 F: 501-694-7809 A loving heart is never wrong.

3 2

bdb to hdb conversion
by btb＠bitrate.net 24 Feb '12

24 Feb '12

i've just converted an existing database/directory from bdb to hdb. it appears to have worked, and all seems to be in order, but is there something i can do to demonstrate empirically that it is in fact hdb now?

2 2

Re: Howto implement RBAC with OU's and posixGroups
by Fred van Zwieten 23 Feb '12

23 Feb '12

What I mean with "this" in "in AD this is possible" is the fact that you can assign group membership to OU membership (When user A is member of OU B, user A will become member of group C". Afaik this is not possible with OpenLDAP. If it is, I would really like to know how. My only bet is with dynamic groups/list, but I have no idea how. Fred 2012/2/23 Buchan Milne <bgmilne(a)staff.telkomsa.net> > On Wednesday, 22 February 2012 11:22:55 Fred van Zwieten wrote: > > Hi all, > > > > warning: openldap newbie.. > > > > is it possible to have a person put into an OU and, because of this, will > > become member of some group in such a way that this group shows up in > linux > > using "id". This to implement some form of RBAC. I found GroupofMembers, > > but that has nothing to do with OU's. Also, it seems posixGroup and > > groupOfMembers objecttypes are no longer allowed together because the are > > both STRUCTURAL. > > Not in nis.schema, but in rfc2307bis.schema, posixGroup is not structural. > > > In AD this is possible. > > It is possible in OpenLDAP too. Just now with nis.schema. Most LDAP clients > support rfc2307bis. > > Regards, > Buchan >

2 1

2.4.29 memberof: entry_encode: Assertion `i == a->a_numvals' failed.
by Colin Hudler 23 Feb '12

23 Feb '12

Greetings, Haven't used OpenLDAP since 2.1; I see it has come a long way. I have a few hundred static groups and am using the memberOf overlay. There's a hundred thousand or so people entries and thousands of memberships. The overlay is configured thusly: # {0}memberof, {1}bdb, config dn: olcOverlay={0}memberof,olcDatabase={1}bdb,cn=config objectClass: olcOverlayConfig objectClass: olcMemberOf olcOverlay: {0}memberof olcMemberOfDangling: drop olcMemberOfRefInt: TRUE olcMemberOfGroupOC: groupOfUniqueNames olcMemberOfMemberAD: uniqueMember olcMemberOfMemberOfAD: isMemberOf (I know a number of these attributes are not strictly correct -- a legacy encumbrance) When the replica starts a total update, it goes well for a while, then stops right here every time: 4f450e2d syncrepl_entry: rid=004 be_search (0) 4f450e2d syncrepl_entry: rid=004 cn=uc:org:nsit:integration:techag,ou=groups,dc=uchicago,dc=edu 4f450e2d conn=-1 op=0: memberof_op_add("cn=uc:org:nsit:integration:techag,ou=groups,dc=uchicago,dc=edu"): member="uid=chudler,ou=people,dc=uchicago,dc=edu" does not exist (stripping...) slapd: entry.c:773: entry_encode: Assertion `i == a->a_numvals' failed. The member ("uid=chudler") does exist in the master, I can find it with ldapsearch. I believe it does not yet exist in the replica. I'd like for total replication to succeed without doing an initial slapcat. Has anyone encountered this before? I am happy to debug if you need more information. Version 2.4.29, also using the refint overlay if that matters.

1 1

Re: daemon: bind(6) failed errno=98 (Address,already in use)
by Marc Patermann 23 Feb '12

23 Feb '12

stefano, stefano schrieb (23.02.2012 10:40 Uhr): > STATE "B" slapd is stopped run "/etc/init.d/slapd start"--->it works > checking pid "pgrep slaps"--->2237 stopping slapd "/etc/init.d/slapd > stop"---> slapd is stopped pgrep slapd--->2237 -the process is still > active- starting slapd "/etc/init.d/slapd start" ---> failed > > why stopping slapd "/etc/init.d/slapd stop" doesn't free the PID? This is out of scope of this mailing list. Check with your distribution "support". Marc

2 1

LDAP guide, manuals
by stefano 23 Feb '12

23 Feb '12

Hi, am searching documentation, guide, manuals, about Ldap. on line there are many and differents things. where can i find a guide complete and reliable about ldap on linux to understand everything? thank you

10 9

daemon: bind(6) failed errno=98 (Address,already in use)
by stefano 23 Feb '12

23 Feb '12

Hi folks, i don't understand a little problem with mi ldap server I installed and configuring my ldap server. after configuring slapd.conf, restarting the server was ok. then i prepared the client with ldap.conf # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. URI ldap://localhost BASE dc=amahoro,dc=bi BINDDN cn=Administrator,dc=amahoro,dc=bi #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never and tryed to test the server: ldapsearch -x -W -D 'cn=Administrator,dc=amahoro,dc=bi' -b "" -s base and it asks me Enter LDAP Password. i wrote the password asked me during the ldap installation without success. i tried to change it with ldappasswd it asked me the password, i wrote the same password but the answer is ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: SASL(-13): user not found: no secret in database. i tryied to comment everything in ldap.conf and restart the ldap server but is failed. checking in syslog the error is daemon: bind(6) failed errno=98 (Address,already in use) do you have any idea about the resolution of this problem? thank you

3 2

Join my network on LinkedIn
by Nathaniel Simch de Morais via LinkedIn 22 Feb '12

22 Feb '12

LinkedIn ------------ Nathaniel Simch de Morais requested to add you as a connection on LinkedIn: ------------------------------------------ I'd like to add you to my professional network on LinkedIn. Accept invitation from Nathaniel Simch de Morais http://www.linkedin.com/e/-48cabe-gyyo5kj5-2j/IxIpDd2wsdsod7c6kW2TzgvFvx58f… View invitation from Nathaniel Simch de Morais http://www.linkedin.com/e/-48cabe-gyyo5kj5-2j/IxIpDd2wsdsod7c6kW2TzgvFvx58f… ------------------------------------------ Why might connecting with Nathaniel Simch de Morais be a good idea? Nathaniel Simch de Morais's connections could be useful to you: After accepting Nathaniel Simch de Morais's invitation, check Nathaniel Simch de Morais's connections to see who else you may know and who you might want an introduction to. Building these connections can create opportunities in the future. -- (c) 2012, LinkedIn Corporation

1 0

request for brief documentation
by tirumala chenchala 22 Feb '12

22 Feb '12

Dear team, This is tirumala rao, working as a system administrator in infronics systems ltd, and i want to configure the open ldap server in my office and i have choose open ldap version-2.4.29 in the centos-6 and my problem is that i refered open ldap documentation but i didn't under stand "how to configure slapd" and i didn't find slapd.conf file in my centos-6.2 Actually i installed the open ldap in centos by using the command yum install openldap* and the out put as i have enclosed in to attachment 1, please find the attachment and guide me how to configure slapd after install in centos-6.2 And in /etc/openldap folder i found the files as in attachment 2 Thanks for advance and Please help me how to done the issue.

4 3

Re: daemon: bind(6) failed errno=98 (Address,already in use)
by stefano 22 Feb '12

22 Feb '12

thank you! there was a process: openldap 1797 0.0 0.3 23752 4004 ? Ssl 11:48 0:00 /usr/sbin/slapd -h ldap:/// ldapi:/// -g openldap -u openldap -f /etc/ldap/slapd.conf after kill it i restarted without problems. i increased the loglevel to "4" and tried another time to test the server: ldapsearch -x -W -D 'cn=Administrator,dc=amahoro,dc=bi' -b "" -s base with the next answer: ldap_bind: Invalid credentials (49) and then restarting server is failed. checking on syslog: Feb 22 12:06:40 debservbis slapd[1890]: connection_get(13) Feb 22 12:06:40 debservbis slapd[1890]: ==> hdb_bind: dn: cn=Administrator,dc=amahoro,dc=bi Feb 22 12:06:40 debservbis slapd[1890]: send_ldap_result: err=49 matched="" text="" Feb 22 12:06:40 debservbis slapd[1890]: connection_get(13) killed another time the openldap process. restarting is ok. trying to change the password with ldappasswd the answer is ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: SASL(-13): user not found: no secret in database on syslog: Feb 22 12:12:42 debservbis slapd[1958]: @(#) $OpenLDAP: slapd 2.4.23 (Jun 16 2011 02:53:39) $#012#011buildd@murphy:/build/buildd-openldap_2.4.23-7.2-i386-Y1mwvF/openldap-2.4.23/debian/build/servers/slapd Feb 22 12:12:42 debservbis slapd[1958]: daemon: bind(8) failed errno=98 (Address already in use) Feb 22 12:12:42 debservbis slapd[1958]: daemon: bind(8) failed errno=98 (Address already in use) Feb 22 12:12:42 debservbis slapd[1958]: slapd stopped. Feb 22 12:12:42 debservbis slapd[1958]: connections_destroy: nothing to destroy. and restarting failed. mmmmmmmmmmmm!

1 1

TIME_WAIT
by arun.sasi1＠wipro.com 22 Feb '12

22 Feb '12

Hello Team, I have a problem with my LDAP server. There are many TIME_WAIT connections (more than 5000). MinimumConnectionsInPool=1 MaximumConnectionsInpool=20 Thanks & Regards, Arun Sasi V ------------------------------------------------------------------------ ------------------------------------------------------------- Sr. Engineer - Server Management (UNIX), Wipro Infotech (GSMC) |Direct +918213029356 Mob: +919731031500 | E: arun.sasi1(a)wipro.com <mailto:koresh.dash@wipro.com> Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

1 0

Re: Howto implement RBAC with OU's and posixGroups
by Fred van Zwieten 22 Feb '12

22 Feb '12

*Hi Milan, I know RedHat's IPA server can do this, but that based on 389 Directory Server. Also, have a look here: http://www.mail-archive.com/sssd-devel@lists.fedorahosted.org/msg06902.html This guy succeeded, but with a combi of posixGroup and groupOfMembers. I'll try to see if I get you suggestion working, although I don't like to change the default schema too much. Ideally nss_ldap should give us more options in this regard. *Greetz, Fred <http://epsilon.eridani.nl> 2012/2/22 Ponjevic, Milan <Milan.Ponjevic(a)travelocity.com> > Hi Fred,**** > > ** ** > > Have you tried ‘hacking’ your schema, and change for example ‘STRUCTURAL’ > to ‘AUXILIARY’. In that case you would be able to specify both posixGroup > and groupOfMembers, or even use groupOfNames.**** > > ** ** > > Have a lok at this**** > > > http://serverfault.com/questions/224750/dn-based-linux-groups-from-ldap/226… > **** > > ** ** > > I am also struggling to understand what is the best way to implement this, > and I would really appreciate if somebody already done it, and can share > the idea.**** > > ** ** > > Regards**** > > ** ** > > ** ** > > ** ** > > *From:* openldap-technical-bounces(a)OpenLDAP.org [mailto: > openldap-technical-bounces(a)OpenLDAP.org] *On Behalf Of *Fred van Zwieten > *Sent:* 22 February 2012 11:00 > *To:* openldap-technical(a)openldap.org > *Subject:* Re: Howto implement RBAC with OU's and posixGroups**** > > ** ** > > Howard, > > So, what is the right way? Could you give me an example how to set this up > or give me a reference to a good source on this? > > Thank you! > > Greetz,**** > > ** ** > > Fred <http://epsilon.eridani.nl>**** > > > > **** > > 2012/2/22 Howard Chu <hyc(a)symas.com>**** > > Fred van Zwieten wrote:**** > > Hi llg, > > I fail to see how this solves my RBAC need. > > Let me give an example: > > Say, personA is in ou DeptA. Then, ideally personA would based on being in > this ou, become member of group webserver > > No, when I move personA to ou DeptB, this would mean that, on the next > login, > it looses it's membership to group Webserver, but now becomes member of ie > group mailservers > > This way, you implement security policies based on the role of a person.** > ** > > ** ** > > This is not the right way to implement roles. Generally DNs are intended > to be constant (though obviously they are allowed to change, changes should > be infrequent).**** > > > How could this ideally be done with OpenLDAP? > > Greetz,**** > > Fred <http://epsilon.eridani.nl> > > > > 2012/2/22 llg <llg(a)portaildulibre.fr <mailto:llg@portaildulibre.fr>>**** > > > > Hi, > persons should use inetOrgPerson and PosixAccount schemas : > gidNumber > gives primary group. > > Then define specific branch ou=posix based on PosixGroup schema and add > the uid of the person in memberUid multiple values attribute to specify > secondary gid. > > Regards > Llg > > Le 22/02/2012 10:22, Fred van Zwieten a écrit :**** > > Hi all, > > warning: openldap newbie.. > > is it possible to have a person put into an OU and, because of this, > will become member of some group in such a way that this group shows up > in linux using "id". This to implement some form of RBAC. I found > GroupofMembers, but that has nothing to do with OU's. Also, it seems > posixGroup and groupOfMembers objecttypes are no longer allowed together > because the are both STRUCTURAL. > > In AD this is possible. > > Greetz,**** > > Fred <http://epsilon.eridani.nl>**** > > ** ** > > > > -- > -- Howard Chu > CTO, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc/ > Chief Architect, OpenLDAP http://www.openldap.org/project/**** > > ** ** >

1 0

Howto implement RBAC with OU's and posixGroups
by Fred van Zwieten 22 Feb '12

22 Feb '12

Hi all, warning: openldap newbie.. is it possible to have a person put into an OU and, because of this, will become member of some group in such a way that this group shows up in linux using "id". This to implement some form of RBAC. I found GroupofMembers, but that has nothing to do with OU's. Also, it seems posixGroup and groupOfMembers objecttypes are no longer allowed together because the are both STRUCTURAL. In AD this is possible. Greetz, Fred <http://epsilon.eridani.nl>

4 5

adding new databases and olc*dbconfig must attributes
by ben thielsen 22 Feb '12

22 Feb '12

i was experimenting a bit with adding new databases to the config, and found that if the olcsuffix attribute was not provided, it would fail: >cat db.ldif dn: olcDatabase=hdb,cn=config changetype: add objectClass: olcHdbConfig olcDatabase: hdb olcDbDirectory: /var/lib/ldap/example.org >ldapadd -xWZZH 'ldap://dsa.example.com/' -D 'uid=dit_admin,ou=role_accounts,ou=accounts,dc=example,dc=com' -f db.ldif Enter LDAP Password: adding new entry "olcDatabase=hdb,cn=config" ldap_add: Other (e.g., implementation specific) error (80) additional info: <olcDbDirectory> failed startup >tail -F slapd.log Feb 21 19:39:41 flip slapd[19134]: conn=1535 fd=64 ACCEPT from IP=192.168.1.1:36891 (IP=0.0.0.0:389) Feb 21 19:39:41 flip slapd[19134]: conn=1535 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Feb 21 19:39:41 flip slapd[19134]: conn=1535 op=0 STARTTLS Feb 21 19:39:41 flip slapd[19134]: conn=1535 op=0 RESULT oid= err=0 text= Feb 21 19:39:41 flip slapd[19134]: conn=1535 fd=64 TLS established tls_ssf=128 ssf=128 Feb 21 19:39:43 flip slapd[19134]: conn=1535 op=1 BIND dn="uid=dit_admin,ou=role_accounts,ou=accounts,dc=example,dc=com" method=128 Feb 21 19:39:43 flip slapd[19134]: conn=1535 op=1 BIND dn="uid=dit_admin,ou=role_accounts,ou=accounts,dc=example,dc=com" mech=SIMPLE ssf=0 Feb 21 19:39:43 flip slapd[19134]: conn=1535 op=1 RESULT tag=97 err=0 text= Feb 21 19:39:43 flip slapd[19134]: conn=1535 op=2 ADD dn="olcDatabase=hdb,cn=config" Feb 21 19:39:43 flip slapd[19134]: hdb_db_open: need suffix. Feb 21 19:39:43 flip slapd[19134]: backend_startup_one (type=hdb, suffix="(null)"): bi_db_open failed! (-1) Feb 21 19:39:43 flip slapd[19134]: olcDbDirectory: value #0: <olcDbDirectory> failed startup (0?:?X#024c?/ldap/example.org)! Feb 21 19:39:43 flip slapd[19134]: conn=1535 op=2 RESULT tag=105 err=80 text=<olcDbDirectory> failed startup Feb 21 19:39:43 flip slapd[19134]: conn=1535 op=3 UNBIND Feb 21 19:39:43 flip slapd[19134]: conn=1535 fd=64 closed providing an olcSuffix attribute in the ldif allowed the new database to be added without error: >ldapadd -xWZZH 'ldap://dsa.example.com/' -D 'uid=dit_admin,ou=role_accounts,ou=accounts,dc=example,dc=com' -f db.ldif Enter LDAP Password: adding new entry "olcDatabase=hdb,cn=config" >tail -F slapd.log Feb 21 19:43:21 flip slapd[19134]: conn=1537 fd=44 ACCEPT from IP=192.168.1.1:36900 (IP=0.0.0.0:389) Feb 21 19:43:21 flip slapd[19134]: conn=1537 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Feb 21 19:43:21 flip slapd[19134]: conn=1537 op=0 STARTTLS Feb 21 19:43:21 flip slapd[19134]: conn=1537 op=0 RESULT oid= err=0 text= Feb 21 19:43:21 flip slapd[19134]: conn=1537 fd=44 TLS established tls_ssf=128 ssf=128 Feb 21 19:43:23 flip slapd[19134]: conn=1537 op=1 BIND dn="uid=dit_admin,ou=role_accounts,ou=accounts,dc=example,dc=com" method=128 Feb 21 19:43:23 flip slapd[19134]: conn=1537 op=1 BIND dn="uid=dit_admin,ou=role_accounts,ou=accounts,dc=example,dc=com" mech=SIMPLE ssf=0 Feb 21 19:43:23 flip slapd[19134]: conn=1537 op=1 RESULT tag=97 err=0 text= Feb 21 19:43:23 flip slapd[19134]: conn=1537 op=2 ADD dn="olcDatabase=hdb,cn=config" Feb 21 19:43:24 flip slapd[19134]: conn=1537 op=2 RESULT tag=105 err=0 text= Feb 21 19:43:24 flip slapd[19134]: conn=1537 op=3 UNBIND this behavior wasn't really all that surprising to me, as i don't really know in what capacity there might be a database without a suffix defined, even if it were just "", but what i am curious about is the schema definition for the olcHdbConfig object class. the best i can tell, only olcDatabase and olcDbDirectory are MUST attributes, while olcSuffix is not: >ldapsearch -xH 'ldap://dsa.example.com/' -s base -b 'cn=subschema' '*' '+' | grep -iFA 5 "NAME 'olcHdbConfig'" objectClasses: ( 1.3.6.1.4.1.4203.1.12.2.4.2.1.2 NAME 'olcHdbConfig' DESC 'HDB backend configuration' SUP olcDatabaseConfig STRUCTURAL MUST olcDbDirectory MAY ( olcDbCacheSize $ olcDbCheckpoint $ olcDbConfig $ olcDbCryptFile $ olcDb CryptKey $ olcDbNoSync $ olcDbDirtyRead $ olcDbIDLcacheSize $ olcDbIndex $ ol cDbLinearIndex $ olcDbLockDetect $ olcDbMode $ olcDbSearchStack $ olcDbShmKey $ olcDbCacheFree $ olcDbDNcacheSize $ olcDbPageSize ) ) >ldapsearch -xH 'ldap://dsa.example.com/' -s base -b 'cn=subschema' '*' '+' | grep -iFA 7 "NAME 'olcDatabaseConfig'" objectClasses: ( 1.3.6.1.4.1.4203.1.12.2.4.0.4 NAME 'olcDatabaseConfig' DESC ' OpenLDAP Database-specific options' SUP olcConfig STRUCTURAL MUST olcDatabase MAY ( olcHidden $ olcSuffix $ olcSubordinate $ olcAccess $ olcAddContentAcl $ olcLastMod $ olcLimits $ olcMaxDerefDepth $ olcPlugin $ olcReadOnly $ olcRe plica $ olcReplicaArgsFile $ olcReplicaPidFile $ olcReplicationInterval $ olc ReplogFile $ olcRequires $ olcRestrict $ olcRootDN $ olcRootPW $ olcSchemaDN $ olcSecurity $ olcSizeLimit $ olcSyncUseSubentry $ olcSyncrepl $ olcTimeLimi t $ olcUpdateDN $ olcUpdateRef $ olcMirrorMode $ olcMonitoring ) ) why is olcSuffix not a MUST attribute if the database can't be added without it? are there cases different than my exercise where a database might be added without the need for a suffix? it's not anything that's causing an insurmountable hurdle, just mostly curious if this was intended. -ben

2 1

Re: slapd.conf & ldap.conf - Re: LDAP guide, manuals
by stefano 21 Feb '12

21 Feb '12

thanks! i downloaded Mastering OpenLDAP. i will follow it hope to improve competence thanks

1 0

Issue with using ldap replace with memberof−dangling set as error.
by Vikram 21 Feb '12

21 Feb '12

Hi, I'm working on writing an custom authorization app on top of openldap. I am currently using openldap version 2.4.26, and using the c api to interact with it. I am trying to use the memberof overlay with memberof−dangling set to error and memberof−refint set to true. I noticed a weird issue which happens here. Steps: 1. I add a group with one/zero members who is present in the system. 2. I update the group with one or more non existent users using ldap_modify_ext with mod_op as LDAP_MOD_REPLACE. In this case, ldap throws up the error 'send_ldap_result: err=19 matched="" text="adding non-existing object as group member" ' , but still goes ahead and adds the non existing member to the group even though the operation should fail. Note that in the "memberof−dangling drop" case the non existent users are not added, though no error is thrown. This seems to be working as expected. Also doing ldap_modify_ext with LDAP_MOD_ADD works as expected too, where the same error this thrown but users are not added. Am I missing something? My slapd.conf has the following relevant configurations: overlay memberof memberof-group-oc customGroup memberof-dangling error memberof-refint true Thanks, Vikram [Reposting as I do not see my first attempt in the archives]

1 0

slapd.conf & ldap.conf
by stefano 20 Feb '12

20 Feb '12

hi, i need help about ldap configuration, please. i configured slapd.conf like this: /include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd.args loglevel none modulepath /usr/lib/ldap moduleload back_hdb sizelimit 500 backend hdb database hdb suffix "dc=amahoro,dc=bi" directory "/var/lib/ldap" dbconfig set_cachesize 0 2097152 0 dbconfig set_lk_max_objects 1500 dbconfig set_lk_max_lockers 1500 index objectClass eq lastmod on checkpoint 512 30 / andldap.conf like this: /# # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. BASE dc=amahoro,dc=bi URI ldap://192.168.5.4 #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never/ but running ldapsearch the answer is /ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1)/ what is wrong? thanks

2 3

Ldap users "not seen" by application
by teoman.onay＠degroof.be 20 Feb '12

20 Feb '12

Hi, I hope i'm in the right place to ask my question... I use openldap for user authentication on linux servers. Everything seems ok except for scheduled jobs. We use a software to launch processes based on event or schedule. An agent is installed on every servers. Unfortunately it doesn't "see" the users from the ldap. When it tries to launch the process it fails with an error like the user doesn't exists. The workaround is to create a local user but i'd prefer to use an ldap one. Do you know how i could solve that ? Tkx Teo P before printing this email, think about the environment. ******************************************************************************* This e-mail is intended only for the person or entity to which it is addressed. It may contain confidential and/or privileged information. Any copying, disclosure, distribution or other use of the content of this e-mail by persons or entities other than the intended recipient is prohibited. Please contact immediately the sender if you have received this e-mail in error and delete it from all locations of your computer. The company on behalf of which the present e-mail is sent is validly committed only if the rules on the delegation of powers, as set out in the appropriate documents, have been complied with. Furthermore, due to the risks inherent to the use of the Internet, the company is not liable for the content of this e-mail if altered, changed or falsified. *******************************************************************************

2 3

Re: circularly MMR Replication ?
by Meike Stone 19 Feb '12

19 Feb '12

> If you've got 5 hosts, Each host should connect to 3 other hosts for a mesh > network wherein any node can fail and the others remain online without > requiring every host be connected to every other host. Ok, But what is a/the recommended replication setup? It depends on the requirements if availability but also on the bandwidth between the loaction, hardware. If I configure such setup, it is much more complex like a circle. The hardware and bandwidth using for each server increases a lot. We also want use one load balancer (one vrrp pair) in each location. So each master has additionally a few ro slaves! The application separates write and read access to two vips on the load balancer. If the load balancer can't reach the local master, all further request (ro and rw) are directed to the closest remote location and LDAP-Servers. I also saw the last mail from Howard in the openldap-devel ml regarding "ITS#7052" and ITS#6024. So I'm absolutely unsure, what I should configure! Are there recommendations or practical experiences? > If any one host > should be considdered a true master, you're better off with a standard star > topology where all updates go to the master. You mean "If only one host ..."? then I understand this recommendation Thanks Meike

2 2

Changing schema OID values in cn=config
by Nick Milas 17 Feb '12

17 Feb '12

Hello, In my config there is: DN: cn={5}postfix,cn=schema,cn=config objectClass: olcSchemaConfig cn: {5}postfix olcAttributeTypes: {0}( 1.3.6.1.4.1.25260.1.000 NAME 'mailacceptinggeneralid' DESC 'Defines an address that we accept mail for' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {1}( 1.3.6.1.4.1.25260.1.001 NAME 'maildrop' DESC 'Defines the address mail goes to' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {2}( 1.3.6.1.4.1.25260.1.002 NAME 'mailacceptinguser' DESC 'Defines if this user accepts mail' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) olcAttributeTypes: {3}( 1.3.6.1.4.1.25260.1.003 NAME 'aliasInactive' DESC 'A flag, for marking the alias as not in use' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) olcObjectClasses: {0}( 1.3.6.1.4.1.25260.1.1.100 NAME 'virtualaccount' DESC 'Holds mail info for a virtual account' STRUCTURAL MUST ( owner $ mailacceptinggeneralid $ maildrop $ cn ) MAY ( description $ aliasInactive ) ) olcObjectClasses: {1}( 1.3.6.1.4.1.25260.1.1.101 NAME 'maillist' DESC 'Virtual account for holding mailing list info' STRUCTURAL MUST ( mailacceptinggeneralid $ maildrop $ cn ) MAY ( owner $ description $ aliasInactive ) ) olcObjectClasses: {2}( 1.3.6.1.4.1.25260.1.1.102 NAME 'mailAccount' DESC 'Email account details' AUXILIARY MUST ( mailacceptinguser $ maildrop $ cn ) MAY ( mailacceptinggeneralid $ aliasInactive ) ) olcObjectClasses: {3}( 1.3.6.1.4.1.25260.1.1.105 NAME 'virtualbox' DESC 'Mailbox for system use' STRUCTURAL MUST ( owner $ mail $ uid $ cn ) MAY description ) When I try to change attribute OID value, for example: 1.3.6.1.4.1.25260.1.000 to 1.3.6.1.4.1.25260.1.0 (using a visual LDAP client) then the server hangs and will not restart. (I had to restore from backup and restart.) What is the recommended way to do this change? Thanks, Nick

4 14

Re: problems populating hdb
by stefano 16 Feb '12

16 Feb '12

now it's okay. i deleted with rm .../ldap/* and i added with slapadd the init.ldif. now i'va the corrects entries! thanks (for the moment, see you soon!) On 02/15/2012 04:54 PM, anax wrote: > Ciao Stefano > > your ldif file cannot be inserted into the DIT via slapadd, use > ldapadd ... > > your entries in dn: dc=nodomain may have been created when you > installed the ldap-server. > > you can find out what the naming-context of your DIT is by > ldapsearch -h localhost -x -b '' -s base objectclass=* namingContexts > > adjust the "-h localhost" parameter. > > suomi > > On 02/15/2012 04:28 PM, stefano wrote: >> Hi. >> >> i'm installing a ldap server on debian squeeze server. my goal is to >> assign to every users of different groups a username and password. >> my slapd.conf is: >> >> include /etc/ldap/schema/core.schema >> include /etc/ldap/schema/cosine.schema >> include /etc/ldap/schema/nis.schema >> include /etc/ldap/schema/inetorgperson.schema >> pidfile /var/run/slapd/slapd.pid >> argsfile /var/run/slapd/slapd.args >> loglevel none >> modulepath /usr/lib/ldap >> moduleload back_hdb >> sizelimit 500 >> >> backend hdb >> database hdb >> suffix "dc=pippo,dc=it" >> rootdn "cn=admin,dc=pippo,dc=it" >> rootpw {SSHA}ho2O8N4lyVnAIi6E/7kQrGl9U9iuGLbC >> directory "/var/lib/ldap" >> #index: definisce quali informazioni indicizzare per un accesso più >> veloce ai dati >> index objectClass eq >> #lastmod: richiede che il server memorizzi nel db le info relative >> all'ultima modifca di un oggetto >> lastmod on >> #checkpoint: frequenza con cui scarica su disco il registro delle >> transazioni >> checkpoint 512 30 >> #le impostazioni più sofisticate relative ai berkeleyDB si trovano nel >> file /var/lib/ldap/DB_CONFIG >> >> >> i created my first ldif file, init.ldif. i added the following >> information: >> >> dn: dc=pippo,dc=it >> objectClass: dcObject >> objectClass: organizationalUnit >> dc: pippo >> ou: pippo.it >> >> dn: o=Iuss,dc=pippo,dc=it >> objectClass: Organization >> o: Iuss >> >> dn: ou=Amministratori,o=Iuss,dc=pippo,dc=it >> objectClass: organizationalUnit >> ou: Amministratori >> >> dn: ou=Professori,o=Iuss,dc=pippo,dc=it >> objectClass: organizationalUnit >> ou: Professori >> >> dn: ou=Stud_Iuss,o=Iuss,dc=pippo,dc=it >> objectClass: organizationalUnit >> ou: Stud_Iuss >> >> dn: ou=Stud_Medicina,o=Iuss,dc=pippo,dc=it >> objectClass: organizationalUnit >> ou: Stud_Medicina >> >> dn: uid=stefano,ou=Amministratori,o=Iuss,dc=pippo,dc=it >> objectClass: inetOrgPerson >> uid: nome >> sn: cognome >> cn: nome cognome >> >> >> if i run >> >> slapadd -l init.ldif -b "dc=pippo","dc=it" >> >> i get the following result: >> >> => hdb_tool_entry_put: id2entry_add failed: DB_KEYEXIST: Key/data pair >> already exists (-30995) >> => hdb_tool_entry_put: txn_aborted! DB_KEYEXIST: Key/data pair already >> exists (-30995) >> slapadd: could not add entry dn="dc=pippo,dc=it" (line=1): txn_aborted! >> DB_KEYEXIST: Key/data pair already exists (-30995) >> _### 16.07% eta none elapsed none spd 11.8 k/s >> >> then with: >> >> slapcat -b "dc=pippo","dc=it" >> >> i can see this: >> >> dn: dc=nodomain >> objectClass: top >> objectClass: dcObject >> objectClass: organization >> o: nodomain >> dc: nodomain >> structuralObjectClass: organization >> entryUUID: 805b9568-e687-1030-82d7-a7960b556dcd >> creatorsName: cn=admin,dc=nodomain >> createTimestamp: 20120208100040Z >> entryCSN: 20120208100040.557042Z#000000#000#000000 >> modifiersName: cn=admin,dc=nodomain >> modifyTimestamp: 20120208100040Z >> >> dn: cn=admin,dc=nodomain >> objectClass: simpleSecurityObject >> objectClass: organizationalRole >> cn: admin >> description: LDAP administrator >> userPassword:: e1NTSEF9ZVJjelJ0cS9UWWFiMDR2N3o5TUlvWHZaaDBESUNPZko= >> structuralObjectClass: organizationalRole >> entryUUID: 805c070a-e687-1030-82d8-a7960b556dcd >> creatorsName: cn=admin,dc=nodomain >> createTimestamp: 20120208100040Z >> entryCSN: 20120208100040.559953Z#000000#000#000000 >> modifiersName: cn=admin,dc=nodomain >> modifyTimestamp: 20120208100040Z >> >> dn: dc=pippo,dc=it >> objectClass: dcObject >> objectClass: organizationalUnit >> dc: pippo >> ou: pippo.it >> structuralObjectClass: organizationalUnit >> entryUUID: 90734578-e8ca-1030-8109-57345a76d294 >> creatorsName: >> createTimestamp: 20120211070546Z >> entryCSN: 20120211070546.162263Z#000000#000#000000 >> modifiersName: >> modifyTimestamp: 20120211070546Z >> >> why do i have the first error? >> why there are not the others informations about the tree? >> >> thanks >> >> stefano >

1 0

canonical way to force full refresh in 2.4.28 / n-way multimaster
by Aaron Bennett 16 Feb '12

16 Feb '12

Hi, I'm preparing to rollout 2.4.28 with n-way multimaster (in this case, it's really 2-way multimaster but could become more), and I'm looking to clarify what the exact canonical way to force a full refresh. Here's what I've come up with: By "full refresh" I mean, blow away whatever is on machine Y with whatever's on machine X. olcServerID: 1 ldaps://animal.clarku.edu olcServerID: 2 ldaps://zoot.clarku.edu olcSyncrepl: {0}rid=001 provider=ldaps://animal.clarku.edu binddn="DN OF REPLICATION USER" bindmethod=simple credentials=<PASSWORD> searchbase="dc=clarku,dc=edu" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncrepl: {1}rid=002 provider=ldaps://zoot.clarku.edu binddn="DN OF REPLICATION USER " bindmethod=simple credentials=<PASSWORD> searchbase="dc=clarku,dc=edu" type=refreshAndPersist retry="5 5 300 5" timeout=1 1. Stop slapd on zoot. 2. slapcat > ocrap-backup.ldif 3. rm -rf /var/lib/ldap/* on zoot 4. SLAPD_OPTIONS="-c \"rid=001,sid=001\"" /etc/init.d/slapd start Then wait and it will refresh. Is this correct? Is there some easier way? Is there a way to do it without the rm -rf ? After it's done, do I need to restart slapd again without the -c option? Thanks, and if I'm doing something stupid, I'm happy to look stupid in exchange for knowledge. :) --- Aaron Bennett Manager of Systems Administration Clark University ITS

2 1

Valid RDN or not ?
by Emmanuel Lécharny 16 Feb '12

16 Feb '12

Hi guys, I have read the RFC carefully, and still can't decide if such a RDN is valid : cn=test1+cn=test2 AFAICT, yes, but OpenLDAP reject the creation of an entry with such a RDN. I may have missed something in the 20+ RFCs and hundred of pages, is anyone able to tell me where in the RFC it's explicitely sad that it's not a valid RDN ? Many thanks ! PS : I can live with the fact that OpenLDAP reject such a RDN, it's not a big deal, I just want to be sure that the LDAP API we are working on should accept or not such a RDN. -- Regards, Cordialement, Emmanuel Lécharny www.iktek.com

1 1

password policy
by Christian Bösch 16 Feb '12

16 Feb '12

hi, i want to force a password change for a user. therefor i set pwdreset: true but to change the password, bind attempts are still allowed. i thinks thats the reason why a user with pwdreset=true still can login to an apache webresource which is protected with ldap authentication. is there a way to prohibit that? i want the user to only allow the password change. /thanks,chris

3 3

authentification issue with clear text password
by Szilard Gyorgy 16 Feb '12

16 Feb '12

HI Can anybody help me with the next issue ? ldapcompare -D "uid=testuser,ou=Users,dc=domain,dc=net" -w test "uid=testuser,ou=Users,dc=domain,dc=net" -v userPassword:test ldap_initialize( <DEFAULT> ) DN:uid=testuser,ou=Users,dc=domain,dc=net, attr:userPassword, value:test Compare Result: Compare False (5) FALSE BUT ldapcompare -D "uid=testuser,ou=Users,dc=domain,dc=net" -w test "uid= testuser,ou=Users,dc=domain,dc=net" -v userPassword::e1NTSEF9L0NFMERQNTVtOU82T09HK1AzQVdNZG9nU2x6Z0FwTGw= ldap_initialize( <DEFAULT> ) DN:uid= testuser,ou=Users,dc=domain,dc=net, attr:userPassword, value::e1NTSEF9L0NFMERQNTVtOU82T09HK1AzQVdNZG9nU2x6Z0FwTGw= Compare Result: Compare True (6) TRUE I know that the problem is not with ldapcompare but I can't figure our where it is. Thank You, Szilard Gyorgy

4 6

problems populating hdb
by stefano 15 Feb '12

15 Feb '12

Hi. i'm installing a ldap server on debian squeeze server. my goal is to assign to every users of different groups a username and password. my slapd.conf is: include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel none modulepath /usr/lib/ldap moduleload back_hdb sizelimit 500 backend hdb database hdb suffix "dc=pippo,dc=it" rootdn "cn=admin,dc=pippo,dc=it" rootpw {SSHA}ho2O8N4lyVnAIi6E/7kQrGl9U9iuGLbC directory "/var/lib/ldap" #index: definisce quali informazioni indicizzare per un accesso più veloce ai dati index objectClass eq #lastmod: richiede che il server memorizzi nel db le info relative all'ultima modifca di un oggetto lastmod on #checkpoint: frequenza con cui scarica su disco il registro delle transazioni checkpoint 512 30 #le impostazioni più sofisticate relative ai berkeleyDB si trovano nel file /var/lib/ldap/DB_CONFIG i created my first ldif file, init.ldif. i added the following information: dn: dc=pippo,dc=it objectClass: dcObject objectClass: organizationalUnit dc: pippo ou: pippo.it dn: o=Iuss,dc=pippo,dc=it objectClass: Organization o: Iuss dn: ou=Amministratori,o=Iuss,dc=pippo,dc=it objectClass: organizationalUnit ou: Amministratori dn: ou=Professori,o=Iuss,dc=pippo,dc=it objectClass: organizationalUnit ou: Professori dn: ou=Stud_Iuss,o=Iuss,dc=pippo,dc=it objectClass: organizationalUnit ou: Stud_Iuss dn: ou=Stud_Medicina,o=Iuss,dc=pippo,dc=it objectClass: organizationalUnit ou: Stud_Medicina dn: uid=stefano,ou=Amministratori,o=Iuss,dc=pippo,dc=it objectClass: inetOrgPerson uid: nome sn: cognome cn: nome cognome if i run slapadd -l init.ldif -b "dc=pippo","dc=it" i get the following result: => hdb_tool_entry_put: id2entry_add failed: DB_KEYEXIST: Key/data pair already exists (-30995) => hdb_tool_entry_put: txn_aborted! DB_KEYEXIST: Key/data pair already exists (-30995) slapadd: could not add entry dn="dc=pippo,dc=it" (line=1): txn_aborted! DB_KEYEXIST: Key/data pair already exists (-30995) _### 16.07% eta none elapsed none spd 11.8 k/s then with: slapcat -b "dc=pippo","dc=it" i can see this: dn: dc=nodomain objectClass: top objectClass: dcObject objectClass: organization o: nodomain dc: nodomain structuralObjectClass: organization entryUUID: 805b9568-e687-1030-82d7-a7960b556dcd creatorsName: cn=admin,dc=nodomain createTimestamp: 20120208100040Z entryCSN: 20120208100040.557042Z#000000#000#000000 modifiersName: cn=admin,dc=nodomain modifyTimestamp: 20120208100040Z dn: cn=admin,dc=nodomain objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator userPassword:: e1NTSEF9ZVJjelJ0cS9UWWFiMDR2N3o5TUlvWHZaaDBESUNPZko= structuralObjectClass: organizationalRole entryUUID: 805c070a-e687-1030-82d8-a7960b556dcd creatorsName: cn=admin,dc=nodomain createTimestamp: 20120208100040Z entryCSN: 20120208100040.559953Z#000000#000#000000 modifiersName: cn=admin,dc=nodomain modifyTimestamp: 20120208100040Z dn: dc=pippo,dc=it objectClass: dcObject objectClass: organizationalUnit dc: pippo ou: pippo.it structuralObjectClass: organizationalUnit entryUUID: 90734578-e8ca-1030-8109-57345a76d294 creatorsName: createTimestamp: 20120211070546Z entryCSN: 20120211070546.162263Z#000000#000#000000 modifiersName: modifyTimestamp: 20120211070546Z why do i have the first error? why there are not the others informations about the tree? thanks stefano

2 1

Error - not compiled with SASL support
by Gaurav Gugnani 15 Feb '12

15 Feb '12

Hello All, I'm *trying to implement SASL on the openldap of version 2.4.26.* First we install the openldap and then we install the necessary packages of cyrus-sasl. *Packages of cyrus-sasl:* (installed in below mentioned order) cyrus-sasl-lib-2.1.22-5.el5_4.3.x86_64.rpm cyrus-sasl-devel-2.1.22-5.el5_4.3.x86_64.rpm cyrus-sasl-plain-2.1.22-5.el5_4.3.x86_64.rpm cyrus-sasl-2.1.22-5.el5_4.3.x86_64.rpm cyrus-sasl-ldap-2.1.22-5.el5_4.3.x86_64.rpm cyrus-sasl-md5-2.1.22-5.el5_4.3.x86_64.rpm After then i set up the SASL with proper ACL's (having the steps and also i setup the same on some other box where it running fine) *Steps:* *1> *Modify /usr/lib64/sasl2/slapd.conf *# SASL Configuration pwcheck_method: auxprop auxprop_plugin: slapd mech_list: PLAIN LOGIN CRAM-MD5 DIGEST-MD5* *2> *Modify $LDAP_HOME/etc/openladp/slapd.conf *password-hash {CLEARTEXT} authz-regexp uid=(.*),cn=DIGEST-MD5,cn=auth uid=$1,ou=System,o=xyz* but it throws all together different error to me: /u01/app/openldap/product/2.4.26/etc/openldap> ldapwhoami -Y DIGEST-MD5 ldapwhoami: not compiled with SASL support And similar errors for ldapsearch and other commands. It suggests to me that some package installation is not proper. Can any one guide me on this. Thanks and Regards, Gaurav Gugnani

5 7

SASL authentication
by Rakesh Aggarwal 15 Feb '12

15 Feb '12

Hi! I am using OpenLDAP 2.4.26 and trying DIGEST-MD5 authentication using "ldapwhoami". I get the error "SASL(-13): user not found: no secret in database". While specifying the user with -U option, bind DN was showing empty in the server's trace. I have tried specifying complete DN with -D option but the result is the same error. User were added using sasldblistusers2 command. sasldblistusers shows the users though it has appended the hostname where I issued the add command from. What am I missing? Can someone point me to working instructions as the documentation for configuring SASL with openLdap seems really sparse? Thanks -Rakesh

3 2

to anyone who uses slapo-lastbind on their ldap server
by curious penguin 14 Feb '12

14 Feb '12

Hi, I've been dumbfounded since starting to dive into openldap. I've been trying to set up and make this overlay work on my current openldap server. I might be looking in the wrong place or might have missed something but I've tried all sorts of approach to this and haven't been successfull in making it work. I've done the following: 1. Compile the source of lastbind against the rpm version of openldap... 2. Compile openldap from source tarball... 3. Compile openldap via source rpm... 4. Compile the openldap source rpm from ltb-project.org.... ...to no avail. I've been able to compile and run each and every single install above, this includes being able to load the lastbind overlay successfully(I assume it is because I don't get any error or warning via the logs or stdout). The reason why I'm saying it isn't working is I can't see the AuthTimestamp attribute anywhere in my database. Here's an output of slapcat and ldapsearch for your review: [VIA SLAPCAT] dn: uid=pepe,ou=People,dc=mydomain,dc=org uid: pepe cn: Pepe Longstocking objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword:: e2NyeXB0fSQ2JEtyZGVTbWt4JHh2RlVPNDBES1pQYXpsQjhNdFlZT0xQQzJlbzJ shadowLastChange: 15358 shadowMax: 35 shadowWarning: 35 loginShell: /bin/ksh uidNumber: 415 gidNumber: 211 homeDirectory: /home/pepe gecos: Pepe Longstocking structuralObjectClass: account entryUUID: c3f61524-eb3b-1030-9440-fbc6b87b1061 creatorsName: cn=Manager,dc=mydomain,dc=org createTimestamp: 20120214094108Z entryCSN: 20120214094108.039363Z#000000#000#000000 modifiersName: cn=Manager,dc=mydomain,dc=org modifyTimestamp: 20120214094108Z [LDAPSEARCH] dn: uid=pepe,ou=People,dc=mydomain,dc=org uid: pepe cn: Pepe Longstocking objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword:: e2NyeXB0fSQ2JEtyZGVTbWt4JHh2RlVPNDBES1pQYXpsQjhNdFlZT0xQQzJlbzJ shadowLastChange: 15278 loginShell: /bin/ksh uidNumber: 416 gidNumber: 211 homeDirectory: /home/pepe gecos: Pepe Longstocking

3 3

Missing Syntax description in the cn=subschema's LDAPSyntaxes AT
by Emmanuel Lécharny 14 Feb '12

14 Feb '12

Hi guys, the following Syntax are missing in the cn=subschema LDAPSyntaxes list, while those syntaxes are refered by many ATs : AttributeTypeDescription DataQualitySyntax DSAQualitySyntax EnhancedGuide Fax Guide LdapSyntaxDescription MatchingRuleDescription MatchingRuleUse Description ObjectClassDescription PresentationAddress ProtocolInformation TeletexTerminalInformation I guess that the server does not care too much as most of those Syntax (and associated AT) are not manipulated frequently by users, and the server might have a default handling of AT without syntax. In Apache Directory Studio and the Java LDAP API, it's a bit more annoying, as we try to load the full schema from the server to locally check that values are correct before sending them back to the server. We have a mechanism to 'bypass' the missing syntaxes, of course, but I think that from a completness POV, it would be better if OpenLDAP add those missing syntaxes... Does it deserver an ITS ? -- Regards, Cordialement, Emmanuel Lécharny www.iktek.com

3 5

Help with Solaris LDAP client (how to make client read shadow information)
by curious penguin 14 Feb '12

14 Feb '12

Hi, I have ldap clients on two different OS platforms, Solaris and Linux. When "shadowExpire" for a specific user is set, the Linux client sees the change and denies logon for the user which is what I'm trying to implement. But this behaviour doesn't work in my Solaris client. It seems like it doesn't respect the rest of the shadow attributes on the Ldap server. I've been scratching my head for days now but doing so haven't help me figure out what the problem or reason is. Could anyone shed some light on this.

2 2

OpenLDAP 2.4.23 killed by linux oom-killer
by Igor Zinovik 14 Feb '12

14 Feb '12

Hello, openldap-technical@ readers. I'm running openSUSE 11.4 with openldap 2.4.23 and libdb-4_8 (berkeleydb) in vmware environment. Last friday my slapd was killed by oom killer. Seems that it consumed all available memory. It is the first time i see that openldap was killed. My database is rather small (15953 entries, 22 mb on disk id2entry.bdb + dn2id.bdb). Could somebody point me to place where i can limit memory usage in openldap? Here is part of log: Jan 20 18:23:42 ldap kernel: [5636879.604870] slapd invoked oom-killer: gfp_mask=0x201da, order=0, oom_adj=0, oom_score_adj=0 Jan 20 18:23:42 ldap kernel: [5636879.604894] slapd cpuset=/ mems_allowed=0 Jan 20 18:23:42 ldap kernel: [5636879.604905] Pid: 11984, comm: slapd Not tainted 2.6.37.6-0.5-desktop #1 Jan 20 18:23:42 ldap kernel: [5636879.604907] Call Trace: Jan 20 18:23:42 ldap kernel: [5636879.605070] [<ffffffff810059b9>] dump_trace+0x79/0x340 Jan 20 18:23:42 ldap kernel: [5636879.605144] [<ffffffff81521752>] dump_stack+0x69/0x6f Jan 20 18:23:42 ldap kernel: [5636879.605207] [<ffffffff810fd4e2>] dump_header+0xa2/0x240 Jan 20 18:23:42 ldap kernel: [5636879.605234] [<ffffffff810fdbe4>] oom_kill_process+0xa4/0x1d0 Jan 20 18:23:42 ldap kernel: [5636879.605246] [<ffffffff810fe03c>] out_of_memory+0x10c/0x250 Jan 20 18:23:42 ldap kernel: [5636879.605251] [<ffffffff811030bb>] __alloc_pages_nodemask+0x6fb/0x710 Jan 20 18:23:42 ldap kernel: [5636879.605281] [<ffffffff81139089>] alloc_pages_current+0x99/0x110 Jan 20 18:23:42 ldap kernel: [5636879.605302] [<ffffffff81105bb1>] __do_page_cache_readahead+0xe1/0x230 Jan 20 18:23:42 ldap kernel: [5636879.605313] [<ffffffff8110603c>] ra_submit+0x1c/0x30 Jan 20 18:23:42 ldap kernel: [5636879.605317] [<ffffffff810fc937>] filemap_fault+0x487/0x4a0 Jan 20 18:23:42 ldap kernel: [5636879.605337] [<ffffffff8111c202>] __do_fault+0x52/0x560 Jan 20 18:23:42 ldap kernel: [5636879.605349] [<ffffffff81120cd1>] handle_mm_fault+0x1a1/0x410 Jan 20 18:23:42 ldap kernel: [5636879.605369] [<ffffffff81527dd9>] do_page_fault+0x1a9/0x520 Jan 20 18:23:42 ldap kernel: [5636879.605382] [<ffffffff8152520f>] page_fault+0x1f/0x30 Jan 20 18:23:42 ldap kernel: [5636879.605481] [<00007ff68a86fffe>] 0x7ff68a86fffe Jan 20 18:23:42 ldap kernel: [5636879.605483] Mem-Info: Jan 20 18:23:42 ldap kernel: [5636879.605485] Node 0 DMA per-cpu: Jan 20 18:23:42 ldap kernel: [5636879.605490] CPU 0: hi: 0, btch: 1 usd: 0 Jan 20 18:23:42 ldap kernel: [5636879.605491] Node 0 DMA32 per-cpu: Jan 20 18:23:42 ldap kernel: [5636879.605493] CPU 0: hi: 186, btch: 31 usd: 31 Jan 20 18:23:42 ldap kernel: [5636879.605498] active_anon:55520 inactive_anon:55653 isolated_anon:0 Jan 20 18:23:42 ldap kernel: [5636879.605499] active_file:75 inactive_file:114 isolated_file:96 Jan 20 18:23:42 ldap kernel: [5636879.605500] unevictable:0 dirty:18 writeback:10 unstable:0 Jan 20 18:23:42 ldap kernel: [5636879.605500] free:1190 slab_reclaimable:1125 slab_unreclaimable:3921 Jan 20 18:23:42 ldap kernel: [5636879.605501] mapped:59 shmem:8 pagetables:4707 bounce:0 Jan 20 18:23:42 ldap kernel: [5636879.605503] Node 0 DMA free:2044kB min:84kB low:104kB high:124kB active_anon:6072kB inactive_anon:6424kB active_file:0kB inactive_file:0kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:15684kB mlocked:0kB dirty:4kB writeback:0kB mapped:8kB shmem:0kB slab_reclaimable:28kB slab_unreclaimable:588kB kernel_stack:360kB pagetables:268kB unstable:0kB bounce:0kB writeback_tmp:0kB pages_scanned:1 all_unreclaimable? yes Jan 20 18:23:42 ldap kernel: [5636879.605515] lowmem_reserve[]: 0 489 489 489 Jan 20 18:23:42 ldap kernel: [5636879.605518] Node 0 DMA32 free:2716kB min:2784kB low:3480kB high:4176kB active_anon:216008kB inactive_anon:216188kB active_file:300kB inactive_file:456kB unevictable:0kB isolated(anon):0kB isolated(file):384kB present:500896kB mlocked:0kB dirty:68kB writeback:40kB mapped:228kB shmem:32kB slab_reclaimable:4472kB slab_unreclaimable:15096kB kernel_stack:1032kB pagetables:18560kB unstable:0kB bounce:0kB writeback_tmp:0kB pages_scanned:1154 all_unreclaimable? yes Jan 20 18:23:42 ldap kernel: [5636879.605527] lowmem_reserve[]: 0 0 0 0 Jan 20 18:23:42 ldap kernel: [5636879.605529] Node 0 DMA: 77*4kB 3*8kB 1*16kB 1*32kB 0*64kB 1*128kB 0*256kB 1*512kB 1*1024kB 0*2048kB 0*4096kB = 2044kB Jan 20 18:23:42 ldap kernel: [5636879.605542] Node 0 DMA32: 677*4kB 1*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 2716kB Jan 20 18:23:42 ldap kernel: [5636879.605550] 20332 total pagecache pages Jan 20 18:23:42 ldap kernel: [5636879.605551] 20056 pages in swap cache Jan 20 18:23:42 ldap kernel: [5636879.605553] Swap cache stats: add 681283, delete 661227, find 13544302/13638161 Jan 20 18:23:42 ldap kernel: [5636879.605555] Free swap = 0kB Jan 20 18:23:42 ldap kernel: [5636879.605556] Total swap = 262140kB Jan 20 18:23:42 ldap kernel: [5636879.608604] 131056 pages RAM Jan 20 18:23:42 ldap kernel: [5636879.608607] 5288 pages reserved Jan 20 18:23:42 ldap kernel: [5636879.608609] 33759 pages shared Jan 20 18:23:42 ldap kernel: [5636879.608610] 122516 pages non-shared Jan 20 18:23:42 ldap kernel: [5636879.608612] [ pid ] uid tgid total_vm rss cpu oom_adj oom_score_adj name Jan 20 18:23:42 ldap kernel: [5636879.608627] [ 320] 0 320 5295 1 0 -17 -1000 udevd Jan 20 18:23:42 ldap kernel: [5636879.608634] [ 816] 100 816 6904 1 0 0 0 dbus-daemon Jan 20 18:23:42 ldap kernel: [5636879.608638] [ 1902] 0 1902 60161 1038 0 0 0 radiusd Jan 20 18:23:42 ldap kernel: [5636879.608641] [ 1949] 0 1949 5142 28 0 0 0 master Jan 20 18:23:42 ldap kernel: [5636879.608644] [ 1971] 51 1971 5225 26 0 0 0 qmgr Jan 20 18:23:42 ldap kernel: [5636879.608648] [ 2030] 0 2030 3871 21 0 0 0 cron Jan 20 18:23:42 ldap kernel: [5636879.608651] [ 2034] 0 2034 4179 16 0 0 0 rpcbind Jan 20 18:23:42 ldap kernel: [5636879.608654] [ 2044] 0 2044 20429 76 0 0 0 vmtoolsd Jan 20 18:23:42 ldap kernel: [5636879.608658] [ 2045] 0 2045 992 0 0 0 0 startpar Jan 20 18:23:42 ldap kernel: [5636879.608661] [ 2049] 0 2049 990 2 0 0 0 mingetty Jan 20 18:23:42 ldap kernel: [5636879.608664] [ 2050] 0 2050 990 2 0 0 0 mingetty Jan 20 18:23:42 ldap kernel: [5636879.608667] [ 2051] 0 2051 990 2 0 0 0 mingetty Jan 20 18:23:42 ldap kernel: [5636879.608670] [ 2052] 0 2052 990 2 0 0 0 mingetty Jan 20 18:23:42 ldap kernel: [5636879.608674] [ 2053] 0 2053 990 2 0 0 0 mingetty Jan 20 18:23:42 ldap kernel: [5636879.608677] [ 2054] 0 2054 990 2 0 0 0 mingetty Jan 20 18:23:42 ldap kernel: [5636879.608689] [24805] 74 24805 3944 32 0 0 0 ntpd Jan 20 18:23:42 ldap kernel: [5636879.608692] [24855] 0 24855 11339 27 0 -17 -1000 sshd Jan 20 18:23:42 ldap kernel: [5636879.608695] [28273] 0 28273 29976 90 0 0 0 rsyslogd Jan 20 18:23:42 ldap kernel: [5636879.608699] [ 5665] 105 5665 4121 9 0 0 0 nrpe Jan 20 18:23:42 ldap kernel: [5636879.608702] [29623] 0 29623 2844 0 0 0 0 mysqld_safe Jan 20 18:23:42 ldap kernel: [5636879.608706] [29744] 60 29744 55304 999 0 0 0 mysqld Jan 20 18:23:42 ldap kernel: [5636879.608709] [30102] 0 30102 5294 2 0 -17 -1000 udevd Jan 20 18:23:42 ldap kernel: [5636879.608713] [30103] 0 30103 5294 1 0 -17 -1000 udevd Jan 20 18:23:42 ldap kernel: [5636879.608717] [30788] 0 30788 4127 1 0 0 0 automount Jan 20 18:23:42 ldap kernel: [5636879.608721] [31053] 0 31053 31139 6849 0 0 0 puppetd Jan 20 18:23:42 ldap kernel: [5636879.608724] [10627] 0 10627 63600 828 0 0 0 httpd2-prefork Jan 20 18:23:42 ldap kernel: [5636879.608727] [23310] 76 23310 300113 76212 0 0 0 slapd Jan 20 18:23:42 ldap kernel: [5636879.608737] [32555] 51 32555 13882 166 0 0 0 pickup Jan 20 18:23:42 ldap kernel: [5636879.608742] [ 1137] 30 1137 67563 1005 0 0 0 httpd2-prefork Jan 20 18:23:42 ldap kernel: [5636879.608745] [ 1156] 30 1156 67563 1004 0 0 0 httpd2-prefork Jan 20 18:23:42 ldap kernel: [5636879.608748] [ 1158] 30 1158 67563 1004 0 0 0 httpd2-prefork Jan 20 18:23:42 ldap kernel: [5636879.608752] [ 1160] 30 1160 67563 1005 0 0 0 httpd2-prefork Jan 20 18:23:42 ldap kernel: [5636879.608755] [ 1161] 30 1161 67563 1005 0 0 0 httpd2-prefork Jan 20 18:23:42 ldap kernel: [5636879.608758] [ 1164] 30 1164 67563 1005 0 0 0 httpd2-prefork Jan 20 18:23:42 ldap kernel: [5636879.608761] [ 1166] 30 1166 67563 1005 0 0 0 httpd2-prefork Jan 20 18:23:42 ldap kernel: [5636879.608765] [ 1169] 30 1169 67563 1005 0 0 0 httpd2-prefork Jan 20 18:23:42 ldap kernel: [5636879.608769] [ 1171] 30 1171 67563 1005 0 0 0 httpd2-prefork Jan 20 18:23:42 ldap kernel: [5636879.608777] [ 1172] 30 1172 67563 1003 0 0 0 httpd2-prefork Jan 20 18:23:42 ldap kernel: [5636879.608780] [ 1175] 30 1175 67563 999 0 0 0 httpd2-prefork Jan 20 18:23:42 ldap kernel: [5636879.608786] [ 1181] 30 1181 67563 999 0 0 0 httpd2-prefork Jan 20 18:23:42 ldap kernel: [5636879.608789] [ 1183] 30 1183 67563 999 0 0 0 httpd2-prefork Jan 20 18:23:42 ldap kernel: [5636879.608792] [ 1188] 30 1188 67563 999 0 0 0 httpd2-prefork Jan 20 18:23:42 ldap kernel: [5636879.608795] [ 1189] 30 1189 67563 999 0 0 0 httpd2-prefork Jan 20 18:23:42 ldap kernel: [5636879.608798] [ 1190] 30 1190 67563 999 0 0 0 httpd2-prefork Jan 20 18:23:42 ldap kernel: [5636879.608802] [ 1191] 30 1191 67563 999 0 0 0 httpd2-prefork Jan 20 18:23:42 ldap kernel: [5636879.608805] [ 1192] 30 1192 67563 999 0 0 0 httpd2-prefork Jan 20 18:23:42 ldap kernel: [5636879.608808] [ 1193] 30 1193 67563 999 0 0 0 httpd2-prefork Jan 20 18:23:42 ldap kernel: [5636879.608811] [ 1194] 30 1194 67563 999 0 0 0 httpd2-prefork Jan 20 18:23:42 ldap kernel: [5636879.608814] [ 1195] 30 1195 67563 999 0 0 0 httpd2-prefork Jan 20 18:23:42 ldap kernel: [5636879.608822] [ 1196] 30 1196 67563 1001 0 0 0 httpd2-prefork Jan 20 18:23:42 ldap kernel: [5636879.608825] [ 1197] 30 1197 67563 999 0 0 0 httpd2-prefork Jan 20 18:23:42 ldap kernel: [5636879.608829] [ 1198] 30 1198 67563 999 0 0 0 httpd2-prefork Jan 20 18:23:42 ldap kernel: [5636879.608832] [ 1199] 30 1199 67563 999 0 0 0 httpd2-prefork Jan 20 18:23:42 ldap kernel: [5636879.608835] [ 1200] 30 1200 67563 999 0 0 0 httpd2-prefork Jan 20 18:23:42 ldap kernel: [5636879.608838] [ 1201] 30 1201 67563 999 0 0 0 httpd2-prefork Jan 20 18:23:42 ldap kernel: [5636879.608841] [ 1202] 30 1202 67563 999 0 0 0 httpd2-prefork Jan 20 18:23:42 ldap kernel: [5636879.608844] [ 1203] 30 1203 67563 999 0 0 0 httpd2-prefork Jan 20 18:23:42 ldap kernel: [5636879.608847] [ 1204] 30 1204 67563 999 0 0 0 httpd2-prefork Jan 20 18:23:42 ldap kernel: [5636879.608851] [ 1205] 30 1205 67563 999 0 0 0 httpd2-prefork Jan 20 18:23:42 ldap kernel: [5636879.608859] [ 1206] 30 1206 67563 1003 0 0 0 httpd2-prefork Jan 20 18:23:42 ldap kernel: [5636879.608862] [ 1207] 30 1207 67563 999 0 0 0 httpd2-prefork Jan 20 18:23:42 ldap kernel: [5636879.608865] [ 1208] 30 1208 57304 1069 0 0 0 httpd2-prefork Jan 20 18:23:42 ldap kernel: [5636879.608868] [ 1209] 30 1209 67563 963 0 0 0 httpd2-prefork Jan 20 18:23:42 ldap kernel: [5636879.608872] [ 1210] 30 1210 67563 962 0 0 0 httpd2-prefork Jan 20 18:23:42 ldap kernel: [5636879.608875] [ 1211] 30 1211 67563 963 0 0 0 httpd2-prefork Jan 20 18:23:42 ldap kernel: [5636879.608878] [ 1212] 30 1212 67563 963 0 0 0 httpd2-prefork Jan 20 18:23:42 ldap kernel: [5636879.608906] Out of memory: Kill process 23310 (slapd) score 685 or sacrifice child Jan 20 18:23:42 ldap kernel: [5636879.608912] Killed process 23310 (slapd) total-vm:1200452kB, anon-rss:304848kB, file-rss:0kB Jan 20 18:23:42 ldap kernel: [5636879.645240] httpd2-prefork invoked oom-killer: gfp_mask=0x201da, order=0, oom_adj=0, oom_score_adj=0 Jan 20 18:23:42 ldap kernel: [5636879.645250] httpd2-prefork cpuset=/ mems_allowed=0 Jan 20 18:23:42 ldap kernel: [5636879.645254] Pid: 1206, comm: httpd2-prefork Not tainted 2.6.37.6-0.5-desktop #1 Jan 20 18:23:42 ldap kernel: [5636879.645256] Call Trace: Jan 20 18:23:42 ldap kernel: [5636879.645279] [<ffffffff810059b9>] dump_trace+0x79/0x340 Jan 20 18:23:42 ldap kernel: [5636879.645285] [<ffffffff81521752>] dump_stack+0x69/0x6f Jan 20 18:23:42 ldap kernel: [5636879.645291] [<ffffffff810fd4e2>] dump_header+0xa2/0x240 Jan 20 18:23:42 ldap kernel: [5636879.645296] [<ffffffff810fdbe4>] oom_kill_process+0xa4/0x1d0 Jan 20 18:23:42 ldap kernel: [5636879.645301] [<ffffffff810fe03c>] out_of_memory+0x10c/0x250 Jan 20 18:23:42 ldap kernel: [5636879.645305] [<ffffffff811030bb>] __alloc_pages_nodemask+0x6fb/0x710

4 3

CentOS 5 OpenLDAP Causes Server to Hang
by Zachary Musselman 14 Feb '12

14 Feb '12

Hello, I am running 2.6.18-274.17.1.el5 with openldap-2.3.43-12.el5_7.10. Lately I've been seeing the following errors in /var/log/messages. Once this error starts it appears to almost freeze the server. I cannot connect via ssh and restarting services take minutes to restart if not restarting at all. My only option is to reboot the server. All is fine for a few days then it happens again. nss_ldap: could not search LDAP server - Server is unavailable This disconnects my samba shares and does not allow users to login to Windows anymore. Can anyone help me with this issue? Thanks for your time.

3 2

Is putting slapd into read-only mode sufficient for backups?
by Brian Reichert 14 Feb '12

14 Feb '12

I'm curious if the tactics described in this thread are currently sufficient: http://www.openldap.org/lists/openldap-software/200608/msg00152.html The thread overall suggests the tried-and-true tactic of using slapcat to extract and LDIF file, to be imported later. But, our application's DB if large enough that reimportation is prohibitive. We're using OpenLDAP 2.3.43 under CentOS 5.7. What we're doing currently is: - stopping slapd - using db_checkpoint and db_archive to manage the BDB logs - copy away the directory - restart slapd This results in a window of time during which the LDAP server is not available. My hope was that my managing the olcReadOnly attribute via the config database (or as that cited message in the thread suggests, use the monitor database), we could perform those middle two steps while leaving a RO server in place. Is that feasible? Recommended? -- Brian Reichert <reichert(a)numachi.com> BSD admin/developer at large

8 31

Mirror to MultiMaster cluster transform
by Andrey Konovalov 13 Feb '12

13 Feb '12

Dear developers and users of OpenLDAP! I'm wondering to know something awful again :) Now i have a cluster replicated in Mirror mode (without replication of cn=config) with configuration like below: Server0: dn: cn=config olcServerID: 1 dn: olcDatabase={1}hdb,cn=config olcSyncRepl: rid=001 provider=ldap://server1 Server1: dn: cn=config olcServerID: 2 dn: olcDatabase={1}hdb,cn=config olcSyncRepl: rid=001 provider=ldap://server0 And now i want to convert this to multimaster cluster (with possibility to add other writeable nodes) So... can i do something like this and get what i desire? on Server0 and on Server1 do the same: dn: cn=config changeType: modify replace: olcServerID olcServerID: 1 ldap://server0 olcServerID: 2 ldap://server1 dn: olcDatabase={1}hdb,cn=config changeType: modify replace: olcSyncRepl olcSyncRepl: rid=001 provider=ldap://server0 olcSyncRepl: rid=002 provider=ldap://server1 Am i write and this will lead to cluster transformation from Mirror to MultiMaster? Maybe, i have to convert olcDatabase={0}config to mirror/multimaster too? Thanks a lot!

1 0

OpenLDAP cannot start if some TLS cert value gets invalid
by Nick Milas 13 Feb '12

13 Feb '12

Hi, I found out that if, in a working OpenLDAP installation, we inadvertently change the value of: olcTLSCertificateKeyFile: /path/to/key.pem to some invalid value, like: olcTLSCertificateKeyFile: /path/to/non/existing/key.pem then OpenLDAP continues to work (and we see no error message whatsoever), but if it is stopped, it refuses to restart. In the logs, while OpenLDAP is starting, we see: Feb 11 16:20:44 vdev slapd[15272]: main: TLS init def ctx failed: -1 and then service is immediately stopped. I believe that in such cases at least OpenLDAP could start without TLS support, logging the problem and not being unable to restart. The same should hold true for the other associated attributes (olcTLSCACertificateFile, olcTLSCertificateFile), for which I didn't test separately. A workaround if this happens (because, since OpenLDAP server is not running, we cannot easily change the dynamic config) could be to create a symbolic link (/path/to/non/existing/key.pem)to the true file (/path/to/working/key.pem), and thus OpenLDAP can start. Any comments/advice? Thanks, Nick

2 6

help with replication
by Aditya Kalabarigi 13 Feb '12

13 Feb '12

Hello Everyone, I am trying to migrate our existing LDAP setup running on rhel4 to virtual hosts. I am able to setup the ldap server on the virtual host but cannot get the replication working. I cannot find the slapd.replog on the server. Please let me know how can I get this running. Server A - virtual host running rhel 5 (master server) slapd.conf is as follows replogfile /var/lib/ldap/slapd.replog replica host=abc.ex.com:389 suffix="o=xxx,dc=xx,dc=xx,dc=xx" binddn="cn=Replica,o=xxx,dc=xx,dc=xx,dc=xx" credentials="slavepasswd" bindmethod=simple tls=yes Server B - virtual host running rhel5 (slave server) slapd.conf is as follows updatedn "cn=Replica,o=xxx,dc=xx,dc=xx,dc=xx" updateref ldap://xyz.ex.com I have added the ldap database on the exisitng on to the new virtual master and slave servers using an ldif file , slapcat and slapadd. Everything is working fine as it should, except the replication is not working. I have checked the configuration of the running setup and the only difference i could find is in the /var/lib/ldap/ directory. I couldnt find slurpd.replog file in it on the master server. Any help on this is greatly appreciated. Thank you. Regards, Aditya

2 3

Got error while enabling SASL
by Gaurav Gugnani 13 Feb '12

13 Feb '12

Hello All, I'm a new bie to LDAP and trying to enable SASL on the newly created user. I read link at open ldap forum: http://www.openldap.org/doc/admin24/sasl.html#DIGEST-MD5 *and performed following steps:* Step-1: saslpasswd2 -c sasluser2 <asked for password> Step-2: sasldblistusers2 sasluser2(a)test0.devcs: userPassword add_sasl_accnt.ldif ---------------------------- # TEST Account for SASL: dn: uid=sasluser2,ou=System,o=db uid: sasluser2 ou: System description: Special account for SASL Testing userPassword: sasluser2 objectClass: account objectClass: simpleSecurityObject Step-3: ldapadd -x -D cn=Manager,o=db -W -f add_sasl_accnt.ldif After performing these stpes, i tried to perform ldapsearch and landed up in getting error: ldapsearch -U sasluser2 -b 'o=db' '(objectclass=*)' *ldap_sasl_interactive_bind_s: No such attribute (16)* ldapsearch -LLL -U sasluser2 -b 'o=db' *ldap_sasl_interactive_bind_s: No such attribute (16)* Kindly help. Thanks and Regards, Gaurav Gugnani

4 22

replication problem after provider crash
by mimo benjamin 13 Feb '12

13 Feb '12

I'm using a single provider and one consumer (Open Ldap 2.4.26 on Windows). The replication seems to work only if the provider is online. E.g. if i unplug the provider from the network, the consumer replication will stop and never retries, although retry and interval parameter are set. Only after I restart the consumer, the replication will be continued. Here are my slapd.conf for provider/consumer: ServerID 1 "ldap://ldapmaster:389" ServerID 2 "ldap://ldapslave:10389" ####################################################################### # bdb database definitions ####################################################################### database bdb suffix "o=userManagement" rootdn "uid=admin,o=userManagement" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw admin rootpw {MD5}ISMvKXpXpadDiUoOSoAfww== # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory ./data # Indices to maintain index objectClass eq overlay syncprov syncprov-checkpoint 1 10 syncprov-sessionlog 100 password-hash {md5} and for consumer ServerID 1 "ldap://ldapmaster:389" ServerID 2 "ldap://ldapslave:10389" ####################################################################### # bdb database definitions ####################################################################### database bdb suffix "o=userManagement" rootdn "uid=admin,o=userManagement" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw admin rootpw {MD5}ISMvKXpXpadDiUoOSoAfww== # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory ./data # Indices to maintain index objectClass eq syncrepl rid=002 provider=ldap://ldapmaster:389 type=refreshOnly interval=00:00:05:00 searchbase="o=userManagement" attrs="*,+" scope=sub schemachecking=off retry="5 2 1 +" bindmethod=simple binddn="uid=admin,o=userManagement" credentials=admin password-hash {md5} Are my settings bad or did I misunderstood it? My assumption was that this setup should do a replication between provider and consumer in the given interval yielding a r/o replica in the consumer ldap. Thanks for any help, mimo -- Empfehlen Sie GMX DSL Ihren Freunden und Bekannten und wir belohnen Sie mit bis zu 50,- Euro! https://freundschaftswerbung.gmx.de

1 0

ldapmodify is crashing the slapd process
by Daniel Savard 12 Feb '12

12 Feb '12

Hi everyone, I am trying to do a number of changes into the configuration database using the following ldif entries: dn: cn=config changetype: modify add: olcTLSCACertificatePath olcTLSCACertificatePath: /etc/ssl/certs - add: olcTLSCertificateFile olcTLSCertificateFile: /etc/openldap/ssl/slapd.cert - add: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/openldap/ssl/slapd.key - add: olcTLSCipherSuite olcTLSCipherSuite: AES256 - replace: olcTLSVerifyClient olcTLSVerifyClient: allow - When running the ldapmodify command as follow: ldapmodify -f tlsmods.ldir -D cn=config -H ldapi:/// -x -W the slapd process is crashing. I tried to gather some info into the syslog using -s 255 and I cannot find any hints why the process is crashing. I am running OpenLDAP 2.4.24 and here are the entries generated in the syslog after the ldapmodify command: Feb 7 16:00:27 charpak ldapmodify: mdns: Couldn't open nss_mdns configuration file /etc/nss_mdns.conf, using default. Feb 7 16:00:31 charpak slapd[23821]: daemon: activity on 1 descriptor Feb 7 16:00:31 charpak slapd[23821]: daemon: activity on: Feb 7 16:00:31 charpak slapd[23821]: Feb 7 16:00:31 charpak slapd[23821]: slap_listener_activate(9): Feb 7 16:00:31 charpak slapd[23821]: daemon: epoll: listen=7 active_threads=0 tvp=zero Feb 7 16:00:31 charpak slapd[23821]: daemon: epoll: listen=8 active_threads=0 tvp=zero Feb 7 16:00:31 charpak slapd[23821]: daemon: epoll: listen=9 busy Feb 7 16:00:31 charpak slapd[23821]: >>> slap_listener(ldapi://%2fvar% 2frun%2fopenldap%2fslapd.sock) Feb 7 16:00:31 charpak slapd[23821]: daemon: listen=9, new connection on 15 Feb 7 16:00:31 charpak slapd[23821]: daemon: added 15r (active) listener=(nil) Feb 7 16:00:31 charpak slapd[23821]: conn=1000 fd=15 ACCEPT from PATH=/var/run/openldap/slapd.sock (PATH=/var/run/openldap/slapd.sock) Feb 7 16:00:31 charpak slapd[23821]: daemon: activity on 1 descriptor Feb 7 16:00:31 charpak slapd[23821]: daemon: activity on: Feb 7 16:00:31 charpak slapd[23821]: Feb 7 16:00:31 charpak slapd[23821]: daemon: epoll: listen=7 active_threads=0 tvp=zero Feb 7 16:00:31 charpak slapd[23821]: daemon: epoll: listen=8 active_threads=0 tvp=zero Feb 7 16:00:31 charpak slapd[23821]: daemon: epoll: listen=9 active_threads=0 tvp=zero Feb 7 16:00:31 charpak slapd[23821]: daemon: activity on 1 descriptor Feb 7 16:00:31 charpak slapd[23821]: daemon: activity on: Feb 7 16:00:31 charpak slapd[23821]: 15r Feb 7 16:00:31 charpak slapd[23821]: Feb 7 16:00:31 charpak slapd[23821]: daemon: read active on 15 Feb 7 16:00:31 charpak slapd[23821]: daemon: epoll: listen=7 active_threads=0 tvp=zero Feb 7 16:00:31 charpak slapd[23821]: daemon: epoll: listen=8 active_threads=0 tvp=zero Feb 7 16:00:31 charpak slapd[23821]: daemon: epoll: listen=9 active_threads=0 tvp=zero Feb 7 16:00:31 charpak slapd[23821]: connection_get(15) Feb 7 16:00:31 charpak slapd[23821]: connection_get(15): got connid=1000 Feb 7 16:00:31 charpak slapd[23821]: connection_read(15): checking for input on id=1000 Feb 7 16:00:31 charpak slapd[23821]: op tag 0x60, time 1328648431 Feb 7 16:00:31 charpak slapd[23821]: conn=1000 op=0 do_bind Feb 7 16:00:31 charpak slapd[23821]: >>> dnPrettyNormal: <cn=config> Feb 7 16:00:31 charpak slapd[23821]: <<< dnPrettyNormal: <cn=config>, <cn=config> Feb 7 16:00:31 charpak slapd[23821]: conn=1000 op=0 BIND dn="cn=config" method=128 Feb 7 16:00:31 charpak slapd[23821]: do_bind: version=3 dn="cn=config" method=128 Feb 7 16:00:31 charpak slapd[23821]: conn=1000 op=0 BIND dn="cn=config" mech=SIMPLE ssf=0 Feb 7 16:00:31 charpak slapd[23821]: do_bind: v3 bind: "cn=config" to "cn=config" Feb 7 16:00:31 charpak slapd[23821]: send_ldap_result: conn=1000 op=0 p=3 Feb 7 16:00:31 charpak slapd[23821]: send_ldap_result: err=0 matched="" text="" Feb 7 16:00:31 charpak slapd[23821]: send_ldap_response: msgid=1 tag=97 err=0 Feb 7 16:00:31 charpak slapd[23821]: conn=1000 op=0 RESULT tag=97 err=0 text= Feb 7 16:00:31 charpak slapd[23821]: daemon: activity on 1 descriptor Feb 7 16:00:31 charpak slapd[23821]: daemon: activity on: Feb 7 16:00:31 charpak slapd[23821]: Feb 7 16:00:31 charpak slapd[23821]: daemon: epoll: listen=7 active_threads=0 tvp=zero Feb 7 16:00:31 charpak slapd[23821]: daemon: epoll: listen=8 active_threads=0 tvp=zero Feb 7 16:00:31 charpak slapd[23821]: daemon: epoll: listen=9 active_threads=0 tvp=zero Feb 7 16:00:31 charpak slapd[23821]: daemon: activity on 1 descriptor Feb 7 16:00:31 charpak slapd[23821]: daemon: activity on: Feb 7 16:00:31 charpak slapd[23821]: 15r Feb 7 16:00:31 charpak slapd[23821]: Feb 7 16:00:31 charpak slapd[23821]: daemon: read active on 15 Feb 7 16:00:31 charpak slapd[23821]: daemon: epoll: listen=7 active_threads=0 tvp=zero Feb 7 16:00:31 charpak slapd[23821]: daemon: epoll: listen=8 active_threads=0 tvp=zero Feb 7 16:00:31 charpak slapd[23821]: daemon: epoll: listen=9 active_threads=0 tvp=zero Feb 7 16:00:31 charpak slapd[23821]: connection_get(15) Feb 7 16:00:31 charpak slapd[23821]: connection_get(15): got connid=1000 Feb 7 16:00:31 charpak slapd[23821]: connection_read(15): checking for input on id=1000 Feb 7 16:00:31 charpak slapd[23821]: op tag 0x66, time 1328648431 Feb 7 16:00:31 charpak slapd[23821]: conn=1000 op=1 do_modify Feb 7 16:00:31 charpak slapd[23821]: conn=1000 op=1 do_modify: dn (cn=config) Feb 7 16:00:31 charpak slapd[23821]: >>> dnPrettyNormal: <cn=config> Feb 7 16:00:31 charpak slapd[23821]: <<< dnPrettyNormal: <cn=config>, <cn=config> Feb 7 16:00:31 charpak slapd[23821]: conn=1000 op=1 modifications: Feb 7 16:00:31 charpak slapd[23821]: add: olcTLSCACertificatePath Feb 7 16:00:31 charpak slapd[23821]: one value, length 14 Feb 7 16:00:31 charpak slapd[23821]: add: olcTLSCertificateFile Feb 7 16:00:31 charpak slapd[23821]: one value, length 28 Feb 7 16:00:31 charpak slapd[23821]: add: olcTLSCertificateKeyFile Feb 7 16:00:31 charpak slapd[23821]: one value, length 27 Feb 7 16:00:31 charpak slapd[23821]: add: olcTLSCipherSuite Feb 7 16:00:31 charpak slapd[23821]: one value, length 6 Feb 7 16:00:31 charpak slapd[23821]: replace: olcTLSVerifyClient Feb 7 16:00:31 charpak slapd[23821]: one value, length 5 Feb 7 16:00:31 charpak slapd[23821]: conn=1000 op=1 MOD dn="cn=config" Feb 7 16:00:31 charpak slapd[23821]: conn=1000 op=1 MOD attr=olcTLSCACertificatePath olcTLSCertificateFile olcTLSCertificateKeyFile olcTLSCipherSuite olcTLSVerifyClient Feb 7 16:00:31 charpak slapd[23821]: <= acl_access_allowed: granted to database root Feb 7 16:00:31 charpak slapd[23821]: oc_check_required entry (cn=config), objectClass "olcGlobal" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "objectClass" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "cn" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcConfigFile" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcConfigDir" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcArgsFile" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcAttributeOptions" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcAuthzPolicy" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcAuthzRegexp" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcConcurrency" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcConnMaxPending" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcConnMaxPendingAuth" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcGentleHUP" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcIdleTimeout" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcIndexSubstrIfMaxLen" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcIndexSubstrIfMinLen" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcIndexSubstrAnyLen" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcIndexSubstrAnyStep" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcIndexIntLen" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcLocalSSF" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcPidFile" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcReadOnly" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcReverseLookup" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcSaslHost" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcSaslSecProps" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcServerID" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcSockbufMaxIncoming" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcSockbufMaxIncomingAuth" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcThreads" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcToolThreads" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcWriteTimeout" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "structuralObjectClass" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "entryUUID" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "creatorsName" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "createTimestamp" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcTLSCACertificatePath" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcTLSCertificateFile" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcTLSCertificateKeyFile" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcTLSCipherSuite" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "olcTLSVerifyClient" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "entryCSN" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "modifiersName" Feb 7 16:00:31 charpak slapd[23821]: oc_check_allowed type "modifyTimestamp" Feb 7 16:00:31 charpak slapd[23821]: daemon: activity on 1 descriptor Feb 7 16:00:31 charpak slapd[23821]: daemon: activity on: Feb 7 16:00:31 charpak slapd[23821]: Feb 7 16:00:31 charpak slapd[23821]: daemon: epoll: listen=7 active_threads=0 tvp=zero Feb 7 16:00:31 charpak slapd[23821]: daemon: epoll: listen=8 active_threads=0 tvp=zero Feb 7 16:00:31 charpak slapd[23821]: daemon: epoll: listen=9 active_threads=0 tvp=zero Any hints? -- Daniel Savard

5 9

howto prepare automatic backups
by deconya 11 Feb '12

11 Feb '12

Hi Im looking how to prepare automatic backups to openldap database. In last mail I comment problem with a crash report, and Im testing how can I do backups and restore it. Only I view slapcat command, but you need to stop the database, and is a critical server and I can't do this stop without create problems to users. There is not any other form? And for other part I would like to understand the content of every folder, because Im with a ubuntu 9.04 server and Im checking what folder I need to control for future restores. Can someone explain the funcition of /var/lib/ldap and /etc/ldap/??? Where is the users data? Thanks

3 3

Loging problem in Ubuntu 11.10 with rsyslog
by rey sebastien 11 Feb '12

11 Feb '12

Hi, I'm using the last release of slapd compiled with --debug option on ubuntu 11.10 :) ./configure --with-tls=openssl --with-threads --with-cyrus-sasl --enable-crypt --enable-debug --enable-cleartext --enable-spasswd --enable-dynacl --enable-aci --enable-modules --enable-wrappers --enable-rewrite --enable-rlookups The ldap is functionnal, i add and modify data without problem, except the logging .. I read tutorial, and documentation, and make some modification to ldap and rsyslog : a > My modification on config : /dn: cn=config replace: olcLogLevel olcLogLevel: Stats dn: cn=config replace: olcLogFile olcLogFile:/var/log/ldap.log/ b > Modification on /etc/rsyslog.d/50-default.conf (syslog.conf doesn't exist anymore on ubuntu ...) I change the last line on this block of rules : /# # First some standard log files. Log by facility. # auth,authpriv.* /var/log/auth.log *.*;auth,authpriv.none -/var/log/syslog #cron.* /var/log/cron.log #daemon.* -/var/log/daemon.log kern.* -/var/log/kern.log #lpr.* -/var/log/lpr.log mail.* -/var/log/mail.log #user.* -/var/log/user.log local4.* /var/log/ldap.log/ c > /touch /var/log/ldap.log / d > /chown openldap:openldap /var/log/ldap.log/ I restart ( service rsyslog restart) and restart slapd ... But this procedure doesn't work, and syslog continue to catch all debug information :( Do you have and idea to help me ? Best regards, SR

1 0

GnuTLS / OpenSSL certificates compatibilty
by rey sebastien 11 Feb '12

11 Feb '12

Hi, One or two question about certificate compatibility, I have self signed certificate generated by openSSL, and the official package of openldap in Ubuntu is compilated with gnutls library. Do you think this configuration could create error ? If this is the case, and if i want to maintain the easy deb package upgrade system, do you know a repository with deb version of openldap compiled with openssl library ? Thanks for advice, SR

5 5

problem recovering ldap database
by deconya 11 Feb '12

11 Feb '12

Hi Im having a big problem with a database user for ldap and samba users. Without reason the database crashes with the error: Feb 11 09:46:23 earth slapd[5395]: bdb(dc=esci,dc=es): file id2entry.bdb has LSN 26/7816674, past end of log at 26/1025642 Feb 11 09:46:23 earth slapd[5395]: bdb(dc=esci,dc=es): Commonly caused by moving a database from one database environment Feb 11 09:46:23 earth slapd[5395]: bdb(dc=esci,dc=es): to another without clearing the database LSNs, or by removing all of Feb 11 09:46:23 earth slapd[5395]: bdb(dc=esci,dc=es): the log files from a database environment Feb 11 09:46:23 earth slapd[5395]: bdb(dc=esci,dc=es): /var/lib/ldap/id2entry.bdb: unexpected file type or format Feb 11 09:46:23 earth slapd[5395]: hdb_db_open: database "dc=esci,dc=es": db_open(/var/lib/ldap/id2entry.bdb) failed: Invalid argument (22). Feb 11 09:46:23 earth slapd[5395]: backend_startup_one: bi_db_open failed! (22) Feb 11 09:46:23 earth slapd[5395]: bdb_db_close: database "dc=esci,dc=es": alock_close failed Feb 11 09:46:23 earth slapd[5395]: slapd stopped. And only I have backups from files, but this not works NEVER!!!!!! How it's possible? How I can restore the database? I was looking for internet and only sais to recover from ldif file, How can be possible If I replace the files continues appearing the same error? Any help will be appreciated Best Regards

1 0

Linux Authentication
by Andy Carlson 10 Feb '12

10 Feb '12

I am getting the following error when I attempt to add the account objectclass to an existing LDAP account: invalid structural object class chain (inetOrgPerson/account) I read an explanation of which the cliffnote version was "an person is a person, not an account, so the two objectclasses can't be on the same entry". While that logic makes sense, I have many accounts on a Sun Directory instance that have both objectclasses. I am trying to migrate entries from Sun to an existing OpenLDAP instance, but because of this error I am unable to implement this objectclass. Ultimately, the functionality I am trying to implement is Linux Authentication. I have successfully added posixAccount and shadowAccount objectclasses, but am unable to add account. Any thoughts? Thanks much!!!, Andy Carlson Moody Bible Institute Identity Administrator | Information Systems 312-329-4385 www.moody.edu<http://www.moody.edu>

3 2

Migration of old LDAP / old schema to new release of openLDAP and new GOSA schema!
by rey sebastien 10 Feb '12

10 Feb '12

Hi, here the step i begin to make a clean migration between ldap(s) with different version of gosa schema : a ) I export all my users from old ldap + old gosa 2.6.2 into a backup ldif file backup.ldif, b) I create a new openLdap (last release version) on a server wich run with all the new schema for gosa 2.7.1 c) I start with a new bdb which get the data from my backup.ldif : database config rootdn "cn=admin,cn=config" rootpw {SSHA}... database bdb suffix "dc=parisgeo,dc=cnrs,dc=fr" rootdn "cn=admin,dc=parisgeo,dc=cnrs,dc=fr" rootpw {SSHA}.... c ) I import the backup.ldif into the new ldap, no problem at this step ! d ) i install the new version of Gosa on apache2, and i configure gosa.conf to connect to this dn ="cn=admin,cn=config" with the good admin password. At this step i'm not sure, but i think gosa want a specific administrator dn, not THE config dn, can you certify me this point ? If it's the case, the new LDAP doesn't have the correct ACL and i think i need to import old ACL for specific administrors of Gosa. But i'm not sure, it is possible to use the cn=config access to use with gosa ? Thansk for enlightements, SR

1 0

Simple bind error in CAS-Openldap authentication.
by Darouichi, Aziz 10 Feb '12

10 Feb '12

Hi, I am trying to use CAS-Openldap authentication for a local application. At this point I am not sure if this error is a CAS problem or Openldap: This is the error in catalina.out: WHAT: simple bind failed: ldap1.curry.edu:389; nested exception is javax.naming.CommunicationException: simple bind failed: ldap1.curry.edu:389 [Root exception is javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake] ACTION: TICKET_GRANTING_TICKET_NOT_CREATED APPLICATION: CAS WHEN: Fri Feb 10 11:15:48 EST 2012 CLIENT IP ADDRESS: 192.168.1.91 SERVER IP ADDRESS: 192.168.60.44 Thanks, Aziz

1 0

Syncreplication configuration - olcSyncProvConfig no such objectClass
by Valentin Bud 10 Feb '12

10 Feb '12

Hello Community, I am trying to setup LDAP replication using the syncrepl overlay. I am using Debian Squeeze up to date as of today. # dpkg -l | grep slapd ii slapd 2.4.23-7.2 OpenLDAP server (slapd) As far as I understand on the master/provider I just have to tell him that it is a syncrepl provider. I have tried to achieve just that using: # ldapadd -a -x -W -D cn=admin,cn=config -H ldapi:/// << 'SYNCREPL' dn: olcOverlay=syncprov,olcDatabase={1}hdb,cn=config objectClass: olcSyncProvConfig olcOverlay: syncprov olcSpCheckpoint: 100 10 olcSpSessionlog: 100 SYNCREPL The following error occurs: ldap_add: Invalid syntax (21) additional info: objectClass: value #0 invalid per syntax I have searched in the schemas for olcSyncProvConfig objectClass but it is no where to be found. What do you suggest to do next? Have a great day, -- w: http://databus.ro/blog in: http://www.linkedin.com/pub/valentin-bud/9/881/830 t: https://twitter.com/valentinbud

2 1

Re: Question on LDAP Schema(s) for Intranet Mail Routing
by Nick Milas 09 Feb '12

09 Feb '12

On 9/2/2012 7:08 μμ, Charles T. Brooks wrote: > I wish I could help more than I have, Nick, but as far as I know there > is no useable RFC standard for mail routing that covers real world > needs. Working pragmatic implementations are based on someone's > interpretation of an expired internet draft, at best. > > I would love for someone to prove me wrong, though! Thanks Charles, First, the reason I started this new thread is that the whole discussion we had was under an irrelevant subject. Second, your advice re. the Lachman / Laser / Sendmail schema was very insightful. After reading the associated draft, I found that I could improve my setup by implementing it (at least to some extent), following your suggestions and experience. Note: In the meantime, I found this: http://www.qmail-ldap.org/wiki/index.php/Qmail.schema. I agree that real world needs vary enormously, yet it is very helpful to avoid re-inventing the wheel. Adding a safe schema with some objectClasses and attributes which seem to cover a range of needs re. ldap-based MTAs, aids both design and implementation. The qmail-ldap schema adds some really helpful and needed attributes, like mailForwardingAddress (also mentioned in Lachman draft) and accountStatus (and even mailQuotaSize; I am using an irrelevant attribute to store this info at the moment). Since I am already using misc.schema file and the basic attributes are available (inetLocalMailRecipient objectClass with mailLocalAddress, mailHost, mailRoutingAddress attributes), I am tempted to manually add selectively attributes from the qmail schema. In order to avoid messing things, I am hoping this thread might attract some more experienced users here, like you, to provide some ideas on how to proceed. (My applications to use these attributes are mainly Postfix/Dovecot.) All advice will be welcome. Thanks, Nick

1 0

Question on LDAP Schema(s) for Intranet Mail Routing
by Nick Milas 09 Feb '12

09 Feb '12

Hello, In file misc.schema, included in the standard OpenLDAP distribution, we read about the Lachman/Laser mail routing schema (which defines inetLocalMailRecipient objectClass with mailLocalAddress, mailHost, mailRoutingAddress attributes, drafted e.g. here: http://www.sendmail.org/m4/laser.txt): # Not recommended for production use! # Use with extreme caution! #----------------------------------------------------------- # draft-lachman-laser-ldap-mail-routing-02.txt !!!EXPIRED!!! # (a work in progress) and: # ...Contents of this file are # subject to change (including deletion) without notice. Question 1: Should this schema be considered now, after all these years, as being stable and a solid basis for implementation? If so, perhaps in next releases these comments could/should be removed? Question 2: As far as I can tell, qmail-ldap schema is also used around for the same purpose. It seems this can be found in different versions, as the initial one had problems (ref.: http://www.openldap.org/lists/openldap-software/200304/msg00378.html). This schema is a considerably extended version of the Lachman/laser one. So: 2.a: Is there some kind of draft elaborating on this schema? 2.b: Is there some official and working (with no issues) version of the schema? 2.c: If 2.b is No, where can we find even an unofficial, yet corrected/working version of the schema? I've only found a reference here: http://www.openldap.org/lists/openldap-software/200304/msg00418.html but no the schema itself. Also, I don't know if we can trust the one here: http://www.zytrax.com/books/ldap/ape/qmail.html (which interestingly mentions that "This schema is released with a standard OpenLDAP distribution" but I haven't seen it in the schema directory of OpenLDAP distros). Thanks, Nick

1 0

circularly MMR Replication ?
by Meike Stone 09 Feb '12

09 Feb '12

Hello, I have 5 different locations and want use MMR. I could configure the replication in a chain, but if on *in* the chain fails, the complete replication fails. So is it a good idea to configure/organize the replication circularly? If one of the "replication member" fails, the replication between the others should still work. Thanks for help Meike

1 0

Compound query question - organization with cn vs. o?
by Matthew M. DeLoera 08 Feb '12

08 Feb '12

Hello, Apologies if this isn't the appropriate list. Searched archives but didn't manage to find anything that seemed related… This query does not return any results: (|(&(objectClass=groupOfNames)(cn=Domain Users))(&(objectClass=inetorgperson)(cn=Domain Users))(&(objectClass=organization)(o=Domain Users))) But, this query does: (|(&(objectClass=groupOfNames)(cn=Domain Users))(&(objectClass=inetorgperson)(cn=Domain Users))(&(objectClass=organization)(cn=Domain Users))) Since RFC 2256 defines organization as STRUCTURAL, with o as MUST, and does not associate cn at all, I'm stumped. FYI, there exists a groupOfNames object with cn=Domain Users. I guess, why would my organization (3rd) clause matter at all? Since the groupOfNames object satisfies the groupOfNames (1st) clause, I was expecting it to be returned regardless of whether the subsequent 2 clauses match anything. And out of curiosity, this query fails: (|(&(objectClass=groupOfNames)(cn=Domain Users))(&(objectClass=inetorgperson)(o=Domain Users))(&(objectClass=organization)(cn=Domain Users))) My guess is that if a subsequent clause specifies an attribute that's not defined for an objectClass, the query fails even if the first clause is known to be good? If that's how things work, I can deal with that. But I just can't find any documentation that clarifies this (or I'm totally missing something super obvious!). Can anyone explain this to me, or point me to some docs that I should go read? Is there a missing piece of info that I should mention? Any suggestions would be really, really appreciated! Regards, - Matthew

2 1

Chinese characters in mail search causes failed assertion in slapd
by Alfie John 08 Feb '12

08 Feb '12

Hi guys, When searching for Chinese names in the "to:" field under Thunderbird, I get an assertion failing in slapd. I see that this is because the "mail" attribute in the default schema is of type "IA5 String" but the Chinese name that I'm searching for falls outside the character set. The work around I have is to modify the "mail" attributetype in the core.schema from: attributetype ( 0.9.2342.19200300.100.1.3 NAME ( 'mail' 'rfc822Mailbox' ) DESC 'RFC1274: RFC822 Mailbox' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} ) to: attributetype ( 0.9.2342.19200300.100.1.3 NAME ( 'mail' 'rfc822Mailbox' ) DESC 'RFC1274: RFC822 Mailbox' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) Can anyone see a problem with the above, or is there a better way of accomplishing this? Thanks Alfie -- Alfie John alfiej(a)opera.com

4 10

Password-less operation
by Jean-Luc Wasmer 08 Feb '12

08 Feb '12

Hi, The user db on my system is stored in LDAP and integrated with PAM and NSS. The LDAP db also contain address book data for each user. I would like to be able to call ldap utilities (e.g. ldapsearch) without having the user to enter his/her password everytime. I would also like for scripts running as those users to have access to the respective LDAP entries. I noticed ldapsearch supports SASL binds, so I was wondering if that could be used in conjunction with Kerberos to accomplish my goal (from what I understand, the kinit command would have to be called before ldapsearch). Is there any other way to do this? Thanks, Jean-Luc

3 2

RE: Chinese characters in mail search causes failed assertion in slapd
by Alfie John 08 Feb '12

08 Feb '12

On Tue, Feb 7, 2012, at 11:34 AM, Charles T. Brooks wrote: > Non-english character sets are going to become part of hostnames and > DNS. That's inevitable. > > Mail addresses are based on DNS hostnames. > > Ergo, mail attributes will one day need to support all possible > characters. Thanks for that. It makes sense and it was enough to convince me to submit a bug. Alfie -- Alfie John alfiej(a)opera.com

2 1

SYNC_ID_SET missing?
by Marc Patermann 07 Feb '12

07 Feb '12

Hi, on a consumer with two replicated databases I get this on startup: # grep sync Feb 7 17:16:52 rfas099 slapd[4263]: Config: ** successfully added syncrepl rid=401 "ldap://master.foo.de" Feb 7 17:16:52 rfas099 slapd[4263]: line 124 (syncrepl ***) Feb 7 17:16:52 rfas099 slapd[4263]: Config: ** successfully added syncrepl rid=402 "ldap://master.foo.de" Feb 7 17:16:52 rfas099 slapd[4264]: do_syncrep2: rid=401 LDAP_RES_INTERMEDIATE - REFRESH_DELETE Feb 7 17:16:52 rfas099 slapd[4264]: do_syncrep2: rid=402 LDAP_RES_INTERMEDIATE - SYNC_ID_SET Feb 7 17:16:52 rfas099 slapd[4264]: do_syncrep2: rid=402 LDAP_RES_INTERMEDIATE - REFRESH_DELETE There is do_syncrep2: rid=402 LDAP_RES_INTERMEDIATE - SYNC_ID_SET for one database, but not for the other. From the list archive I got this: "The SYNC_ID_SET messages in this case are the provider telling the consumer what entries it has, so the consumer can delete entries not present on the provider. This is normal operation in some situations. It shouldn't happen too often if you specify a sufficient sessionlog size on the provider." http://www.openldap.org/lists/openldap-technical/201104/msg00079.html So, if there is no SYNC_ID_SET for a database, is this a bad sign? Marc

1 0

Non-personal mail accounts
by Nick Milas 07 Feb '12

07 Feb '12

Hello, We are storing user accounts in OpenLDAP. Main classes used are: objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: eduPerson User email address(es) is (are) stored in the "mail" attribute and are also used by Postfix (which uses virtual accounts based on LDAP). I would like to define some email accounts (with associated email addresses) which do NOT belong to a particular user; so, in these accounts a mail attribute would not be associated (both conceptually and practically) with a person objectClass. Is there a suggestion on which existing objectClass(es) (and associated schemas, if applicable) should we use for such use? I thought of "account" (defined in cosine.schema), but it does not accept a mail attribute. The idea would be to use something like an extended "account" objectClass, (or "account" itself, with some additional auxiliary class to define an email address) together with simpleSecurityObject to allow definition of a password. Any experiences, suggestions will be appreciated. Thanks, Nick

2 1

dynlist and DSA IT Control
by Angel L. Mateo 07 Feb '12

07 Feb '12

Hello, I have an openldap using dynlist to get some attributes of the entries. When I manually performs search, I can get these attributes (obtained through the dynlist overlay) without any problem, but when an application (a CAS server to be precise) tries to do the same search, with the same bind dn, I can't see those attributes. I have used wireshark to check any difference and I have found that the only difference between my search and the one made by the application is that this one use a control parameter in the search, to be precise the control 2.16.840.1.113730.3.4.2.. Then I have checked and I have realized that if I used the -M option then I get the same behaviour and I can't get the attributes from the dynlist overlay. As far as I know I can't configure this behaviour in my application (although I'm also looking for any way to configure CAS not to use that control), so, why openldap does not use the dynlist overlay when this dsa it control is used? Is there any way to change this behaviour? Any help? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 868887590 Fax: 868888337

2 2

Re: Global modifications
by Nick Milas 07 Feb '12

07 Feb '12

On 31/1/2012 9:52 μμ, Charles T. Brooks wrote: > T > Hi Charles, (Note that your last message was strangely encoded and I had some trouble reading it.) Thanks for all this info. I noticed that most (if not all) of the sendmail.schema definitions are actually included in the misc.schema bundled in openldap package. I guess I could use: inetLocalMailRecipient objectClass (attribute: mailLocalAddress); the only thing that disturbs me is that mailLocalAddress does not have a substring match rule (contrary to mail attribute) and I am afraid this might cause issues under particular scenarios... Best regards, Nick.

1 0

Help on ACL
by Hanns Mattes 07 Feb '12

07 Feb '12

Dear list-members, I want to grant write access to users to a kind of personal addressbook. User-DNs are for example: uid=user(a)example.com,ou=example.com,ou=virtualmail,dc=my,dc=company The personal Addressbook is stored under ou=user(a)example.com,ou=addressbook,dc=my,dc=company and an entry in the addressbook looks: uid=someuniqeid@mail.my.company,ou=user@example.com,dc=addressbook,dc=my,dc=company so far I didn't have success with constructing an ACL, which grants write access. I've tried modifying the example found in http://www.horde.org/apps/turba/docs/LDAP (in fact that's the application, which the addressbook is for), but no success so far (but a lot of "no such object"-entries in the log). Any help appreciated Regards Hanns

2 2

LDAP authentication fails
by Abhinav Jauhri 06 Feb '12

06 Feb '12

Hi, I have two client machines(CLIENT1 & CLIENT2) on which users are authenticated using a LDAP_SERVER. They also have autofs to mount the home directory at login. The issue is that on CLIENT1 authentication and mount works fine, but not on CLIENT2. Although, both have the same configuration files. Errors on CLIENT2: *Case 1:* When PasswordAuthentication is set to No in sshd_config ssh user(a)client2.isl.com <user(a)client1.isl.com> Permission denied (publickey). *Case 2*: When PasswordAuthentication is commented in sshd_config ssh user(a)client2.com <user(a)client1.com> user(a)clent2.isl.com <user(a)clent1.isl.com>'s password: Linux client2.isl.com <http://client1.isl.com> 2.6.31-14-generic #48-Ubuntu SMP Fri Oct 16 14:05:01 UTC 2009 x86_64 Creating directory '/home/user'. Unable to create and initialize directory '/home/user'. Configurations files on CLIENT2: 1) /etc/pam.d/sshd auth required pam_env.so # [1] auth required pam_env.so envfile=/etc/default/locale @include common-auth account required pam_nologin.so @include common-account @include common-session session optional pam_motd.so # [1] session optional pam_mail.so standard noenv # [1] session required pam_limits.so session required pam_mkhomedir.so skel=/etc/skel/ umask=0022 @include common-password 2) /etc/ldap.conf base dc=auth,dc=ldap_server,dc=isl,dc=com uri ldaps://192.169.214.54 ldap_version 3 rootbinddn cn=admin,dc=ldap_server,dc=isl,dc=com pam_password md5 ssl start_tls ssl on tls_checkpeer yes tls_cacertfile /etc/ssl/certs/ldap_server.isl.com.pem 3) /etc/nsswitch.conf passwd: compat ldap group: compat ldap shadow: compat ldap hosts: files dns networks: files protocols: db files services: db files ethers: db files rpc: db files netgroup: nis 4) /etc/ssh/sshd_config Port 22 Protocol 2 HostKey /etc/ssh/ssh_host_rsa_key HostKey /etc/ssh/ssh_host_dsa_key UsePrivilegeSeparation yes KeyRegenerationInterval 3600 ServerKeyBits 768 SyslogFacility AUTH LogLevel INFO LoginGraceTime 120 PermitRootLogin yes StrictModes yes RSAAuthentication yes PubkeyAuthentication yes #AuthorizedKeysFile %h/.ssh/authorized_keys IgnoreRhosts yes RhostsRSAAuthentication no HostbasedAuthentication no PermitEmptyPasswords no ChallengeResponseAuthentication no #PasswordAuthentication no X11Forwarding yes X11DisplayOffset 10 PrintMotd no PrintLastLog yes TCPKeepAlive yes AcceptEnv LANG LC_* Subsystem sftp /usr/lib/openssh/sftp-server UsePAM yes 5) /etc/auto.home * 192.169.214.54:/home/& 6) /etc/auto.master +auto.master /home /etc/auto.home Also, there exist no local user by the same name in any of the client machines. The public keys are correctly inserted in the //LDAP_SERVER/home/user/.ssh/authorized_keys or else login wouldn't have been possible on CLIENT1. `getent passwd` on CLIENT2 shows all LDAP users. Any suggestions would be of great help. Thanks! -- Abhinav

1 0

Search on whole tree gives result, search on subtree not
by Karsten Heymann 06 Feb '12

06 Feb '12

Hi, I've started playing around with slapd (2.4.23-7.2 from debian squeeze) again and stumbled across a very strange phenomenon: When searching the whole tree for an entry it is found immediately: 0|kheymann@ds1-01:~$ ldapsearch -x -h localhost -b o=mycompany uid=aaa uid # extended LDIF # # LDAPv3 # base <o=mycompany> with scope subtree # filter: uid=aaa # requesting: uid # # aaa, 2, customers, marketing, mycompany dn: uid=aaa,contractID=2,ou=customers,ou=marketing,o=mycompany uid: aaa # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 But when searching any of the intermediate subtrees, no result is returned after a short delay: 0|kheymann@ds1-01:~$ ldapsearch -x -h localhost -b ou=marketing,o=mycompany uid=aaa uid # extended LDIF # # LDAPv3 # base <ou=tc,o=mycompany> with scope subtree # filter: uid=aaa # requesting: uid # # search result search: 2 result: 0 Success # numResponses: 1 The uid attribute is indexed with 0|root@ds1-01:/etc/ldap/slapd.d/cn=config# grep -e ' uid ' *ldif olcDatabase={1}hdb.ldif:olcDbIndex: uid eq and slapindex generated the index without any error messages. This also seems to happen only with entries created while the slapd is running while the entries from the initial import do not whoe this. This seems very weird to me. Any hints what could cause this behaviour and what could possibly fix it? Thanks in advance, Karsten

3 4

Does openldap support multicore CPU.
by arun.sasi1＠wipro.com 06 Feb '12

06 Feb '12

Hello Team, I have a small question... does OpenLDAP support multi core CPU... Thanks & Regards, Arun Sasi V ------------------------------------------------------------------------ ------------------------------------------------------------- Sr. Engineer - Server Management (UNIX), Wipro Infotech (GSMC) |Direct +918213029356 Mob: +919731031500 | E: arun.sasi1(a)wipro.com <mailto:koresh.dash@wipro.com> Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

3 4

Using NSS
by Braden McDaniel 06 Feb '12

06 Feb '12

I am trying to get OpenLDAP (2.4.24) working with NSS on Fedora 15. In cn=config.ldif I have: olcTLSCACertificatePath: /etc/pki/nssdb olcTLSCertificateFile: endoframe I have used certutil to create a self-signed certificate: # certutil -d /etc/pki/nssdb -L Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI endoframe Cu,Cu,Cu But this doesn't appear to be working: $ ldapsearch -H ldaps://rail -b dc=endoframe,dc=net -x -d1 ldap_url_parse_ext(ldaps://rail) ldap_create ldap_url_parse_ext(ldaps://rail:636/??base) ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP rail:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying ::1 636 ldap_pvt_connect: fd: 3 tm: -1 async: 0 ldap_close_socket: 3 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 127.0.0.1:636 ldap_pvt_connect: fd: 3 tm: -1 async: 0 ldap_close_socket: 3 ldap_err2string ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) slapd is running: # systemctl status slapd.service slapd.service - LSB: starts and stopd OpenLDAP server daemon Loaded: loaded (/etc/rc.d/init.d/slapd) Active: active (running) since Wed, 05 Oct 2011 02:24:11 -0400; 3 weeks and 0 days ago Main PID: 1429 (slapd) CGroup: name=systemd:/system/slapd.service └ 1429 /usr/sbin/slapd -h ldap:/// -u ldap Any ideas of what I might be doing wrong, or where I should be looking to debug this? -- Braden McDaniel <braden(a)endoframe.com>

8 19

How do I reset rootdn password?
by Daniel Savard 05 Feb '12

05 Feb '12

I would like to know how to reset the rootpw in OpenLDAP 2.4? Do I need to recreate over the entire configuration database and the database itself or there is a trick? -- Daniel Savard

7 11

Accursed LDAP+SSL Breakage When Using libgcrypt
by Ken Stailey 05 Feb '12

05 Feb '12

Hi, I abandoned any efforts to get anyone to hack the broken libgcrypt11 so that it would stop dropping setuid permissions. This was motivated largely by the fact that upstream GnuTLS started releasing versions that were intended to stop using libcrypt as the crypto back-end along with support for multiple crypto back-ends. The preferred crypto library for GnuTLS is nettle now. This change requires a minimum of GnuTLS 2.11.x and Ubuntu 12.04 is using GnuTLS 2.12.x. There were miscellaneous announcements made about this change: Andreas Metzler http://lists.debian.org/debian-legal/2011/02/msg00006.html {{ GnuTLS upstream has added support for different crypto backends in 2.11.x and has chosen nettle as prefered [sic] backend (2.10.x is using libgcrypt). }} It works for me, when I configure GnuTLS on Ubuntu 12.04 to use nettle the painful regression goes away and I can use setuid binaries from an LDAP account configured to access an LDAP server via SSL. To test on Ubuntu 12.04 or Debian Testing or Unstable simply: apt-get build-dep libgnutls26 apt-get source gnutls26 to fetch the source for gnutls26-2.12.14 (or 2.12.16-1 on Debian) then chop out --with-libgcrypt from the debian/rules file and rebuild gnutls26 debuild -i -uc -us -b and install the resulting .deb files. Much to my chagrin, upstream Debian still configures GnuTLS to use the horribly defective and rejected-by-upstream libgcrypt11 instead of the preferred-by-upstream nettle despite both Debian Testing and Debian Unstable having GnuTLS 2.12.16-1 $ grep with-libgcrypt sid/gnutls26-2.12.16/debian/rules --cache-file=$(CURDIR)/config.cache --with-libgcrypt \ So I opened two bug reports: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=658739 https://bugs.launchpad.net/bugs/926350 Hope that helps.

1 0

2.4.28 cn=config replication trouble
by Aaron Bennett 03 Feb '12

03 Feb '12

Hello, I've got two 2.4.28 boxes and I'm trying to get two-way multimaster replication set up - first for cn=config, and then for the entire tree. I can attach more of config.ldif if needed, but here are what I think are the relevant snippets: First thing that leaps out is, of course, the certificate is for ds.clarku.edu and the hosts are called animal.clarku.edu and zoot.clarku.edu; that's needed because I intend to round-robin those two hosts. I have TLS_REQCERT never in ldap.conf on each machine and I can do a successful "ldapsearch -H ldaps://animal.clarku.edu -x -D "cn=config" -W -b cn=config" from each machine to the other. dn: cn=config objectClass: olcGlobal cn: config olcAllows: bind_v2 olcArgsFile: /var/run/openldap/slapd.args olcAttributeOptions: lang- olcAuthzPolicy: none olcConcurrency: 25 olcConfigDir: /etc/openldap/ldap/slapd.d olcConfigFile: /etc/openldap/slapd.conf olcConnMaxPending: 400 olcConnMaxPendingAuth: 1000 olcGentleHUP: FALSE olcIdleTimeout: 0 olcIndexIntLen: 4 olcIndexSubstrAnyLen: 4 olcIndexSubstrAnyStep: 2 olcIndexSubstrIfMaxLen: 4 olcIndexSubstrIfMinLen: 2 olcLocalSSF: 71 olcLogLevel: stats sync olcPidFile: /var/run/openldap/slapd.pid olcReadOnly: FALSE olcReverseLookup: FALSE olcServerID: 1 ldaps://animal.clarku.edu olcServerID: 2 ldaps://zoot.clarku.edu olcSockbufMaxIncoming: 262143 olcSockbufMaxIncomingAuth: 16777215 olcThreads: 25 olcTLSCACertificatePath: /etc/openldap/nssdb olcTLSCertificateFile: ds.clarku.edu olcTLSVerifyClient: never olcToolThreads: 1 olcWriteTimeout: 0 dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by * none olcAddContentAcl: TRUE olcLastMod: TRUE olcMaxDerefDepth: 15 olcMirrorMode: TRUE olcMonitoring: FALSE olcReadOnly: FALSE olcRootDN: cn=config olcRootPW: {SSHA}<PASSWORD> olcSyncrepl: {0}rid=001 provider=ldaps://animal.clarku.edu binddn="cn=config " bindmethod="simple" credentials="<PASSWORD>" searchbase="cn=config" type= refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncrepl: {1}rid=002 provider=ldaps://zoot.clarku.edu binddn="cn=config" bindmethod="simple" credentials="<PASSWORD>" searchbase="cn=config" type=r efreshAndPersist retry="5 5 300 5" timeout=1 Here's the -d1 output: 4f2ae081 do_syncrepl: rid=001 rc -1 retrying (4 retries left) 4f2ae081 slap_listener_activate(9): 4f2ae081 >>> slap_listener(ldaps:///) 4f2ae081 connection_get(15): got connid=1000 4f2ae081 connection_read(15): checking for input on id=1000 TLS: using moznss security dir /etc/openldap/nssdb prefix . TLS: certificate [CN=ds.clarku.edu,OU=ITS,O=Clark University,L=Worcester,ST=Massachusetts,C=US,serialNumber=HUpyuTQIxJ8ShXHOBGZo7j-BC9l4ykNA] is valid 4f2ae081 connection_get(15): got connid=1000 4f2ae081 connection_read(15): checking for input on id=1000 TLS certificate verification: subject: no certificate, issuer: no certificate, cipher: AES-256, security level: high, secret key bits: 256, total key bits: 256, cache hits: 0, cache misses: 1, cache not reusable: 0 4f2ae081 connection_read(15): unable to get TLS client DN, error=49 id=1000 4f2ae081 connection_get(15): got connid=1000 4f2ae081 connection_read(15): checking for input on id=1000 ber_get_next 4f2ae081 ber_get_next on fd 15 failed errno=0 (Success) 4f2ae081 connection_close: conn=1000 sd=15 4f2ae086 =>do_syncrepl rid=001 ldap_create ldap_url_parse_ext(ldaps://animal.clarku.edu) ldap_sasl_bind_s ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP animal.clarku.edu:636 4f2ae086 slap_listener_activate(9): 4f2ae086 >>> slap_listener(ldaps:///) 4f2ae086 connection_get(18): got connid=1001 4f2ae086 connection_read(18): checking for input on id=1001 ldap_new_socket: 15 ldap_prepare_socket: 15 ldap_connect_to_host: Trying 140.232.1.12:636 ldap_pvt_connect: fd: 15 tm: -1 async: 0 4f2ae086 connection_get(18): got connid=1001 4f2ae086 connection_read(18): checking for input on id=1001 TLS certificate verification: subject: no certificate, issuer: no certificate, cipher: AES-256, security level: high, secret key bits: 256, total key bits: 256, cache hits: 0, cache misses: 2, cache not reusable: 0 4f2ae086 connection_read(18): unable to get TLS client DN, error=49 id=1001 4f2ae086 connection_get(18): got connid=1001 4f2ae086 connection_read(18): checking for input on id=1001 ber_get_next ber_get_next: tag 0x30 len 31 contents: 4f2ae086 op tag 0x60, time 1328210054 ber_get_next 4f2ae086 conn=1001 op=0 do_bind ber_scanf fmt ({imt) ber: ber_scanf fmt (m}) ber: 4f2ae086 >>> dnPrettyNormal: <cn=config> 4f2ae086 <<< dnPrettyNormal: <cn=config>, <cn=config> 4f2ae086 do_bind: version=3 dn="cn=config" method=128 4f2ae086 do_bind: v3 bind: "cn=config" to "cn=config" 4f2ae086 send_ldap_result: conn=1001 op=0 p=3 4f2ae086 send_ldap_response: msgid=1 tag=97 err=0 ber_flush2: 14 bytes to sd 18 4f2ae086 connection_get(18): got connid=1001 4f2ae086 connection_read(18): checking for input on id=1001 ber_get_next ber_get_next: tag 0x30 len 185 contents: 4f2ae086 op tag 0x63, time 1328210054 ber_get_next 4f2ae086 conn=1001 op=1 do_search ber_scanf fmt ({miiiib) ber: 4f2ae086 >>> dnPrettyNormal: <cn=config> 4f2ae086 <<< dnPrettyNormal: <cn=config>, <cn=config> ber_scanf fmt (m) ber: ber_scanf fmt ({M}}) ber: 4f2ae086 => get_ctrls ber_scanf fmt ({m) ber: ber_scanf fmt (m) ber: 4f2ae086 => get_ctrls: oid="1.3.6.1.4.1.4203.1.9.1.1" (noncritical) ber_scanf fmt ({i) ber: ber_scanf fmt (m) ber: ber_scanf fmt (b) ber: ber_scanf fmt (}) ber: ber_scanf fmt ({m) ber: ber_scanf fmt (b) ber: 4f2ae086 => get_ctrls: oid="2.16.840.1.113730.3.4.2" (critical) 4f2ae086 <= get_ctrls: n=2 rc=0 err="" 4f2ae086 send_ldap_result: conn=1001 op=1 p=3 4f2ae086 send_ldap_result: conn=1001 op=1 p=3 4f2ae086 send_ldap_intermediate: err=0 oid=1.3.6.1.4.1.4203.1.9.1.4 len=2 4f2ae086 send_ldap_response: msgid=2 tag=121 err=0 ber_flush2: 37 bytes to sd 18 TLS: certificate [CN=ds.clarku.edu,OU=ITS,O=Clark University,L=Worcester,ST=Massachusetts,C=US,serialNumber=HUpyuTQIxJ8ShXHOBGZo7j-BC9l4ykNA] is valid TLS certificate verification: subject: CN=ds.clarku.edu,OU=ITS,O=Clark University,L=Worcester,ST=Massachusetts,C=US,serialNumber=HUpyuTQIxJ8ShXHOBGZo7j-BC9l4ykNA, issuer: CN=GeoTrust SSL CA,O="GeoTrust, Inc.",C=US, cipher: AES-256, security level: high, secret key bits: 256, total key bits: 256, cache hits: 0, cache misses: 2, cache not reusable: 0 ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({i) ber: ber_flush2: 33 bytes to sd 15 ldap_result ld 0x7f59cc100910 msgid 1 wait4msg ld 0x7f59cc100910 msgid 1 (timeout 1000000 usec) wait4msg continue ld 0x7f59cc100910 msgid 1 all 1 ** ld 0x7f59cc100910 Connections: * host: animal.clarku.edu port: 636 (default) refcnt: 2 status: Connected last used: Thu Feb 2 14:14:14 2012 ** ld 0x7f59cc100910 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x7f59cc100910 request count 1 (abandoned 0) ** ld 0x7f59cc100910 Response Queue: Empty ld 0x7f59cc100910 response count 0 ldap_chkResponseList ld 0x7f59cc100910 msgid 1 all 1 ldap_chkResponseList returns ld 0x7f59cc100910 NULL ldap_int_select read1msg: ld 0x7f59cc100910 msgid 1 all 1 ber_get_next ber_get_next: tag 0x30 len 12 contents: read1msg: ld 0x7f59cc100910 msgid 1 message type bind ber_scanf fmt ({eAA) ber: read1msg: ld 0x7f59cc100910 0 new referrals read1msg: mark request completed, ld 0x7f59cc100910 msgid 1 request done: ld 0x7f59cc100910 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_parse_result ber_scanf fmt ({iAA) ber: ber_scanf fmt (}) ber: ldap_msgfree ldap_search_ext put_filter: "(objectclass=*)" put_filter: simple put_simple_filter: "objectclass=*" ldap_send_initial_request ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({) ber: ber_flush2: 188 bytes to sd 15 4f2ae086 =>do_syncrep2 rid=001 ldap_result ld 0x7f59cc100910 msgid 2 wait4msg ld 0x7f59cc100910 msgid 2 (timeout 1000000 usec) wait4msg continue ld 0x7f59cc100910 msgid 2 all 0 ** ld 0x7f59cc100910 Connections: * host: animal.clarku.edu port: 636 (default) refcnt: 2 status: Connected last used: Thu Feb 2 14:14:14 2012 ** ld 0x7f59cc100910 Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ld 0x7f59cc100910 request count 1 (abandoned 0) ** ld 0x7f59cc100910 Response Queue: Empty ld 0x7f59cc100910 response count 0 ldap_chkResponseList ld 0x7f59cc100910 msgid 2 all 0 ldap_chkResponseList returns ld 0x7f59cc100910 NULL ldap_int_select read1msg: ld 0x7f59cc100910 msgid 2 all 0 ber_get_next ber_get_next: tag 0x30 len 35 contents: read1msg: ld 0x7f59cc100910 msgid 2 message type intermediate ldap_parse_intermediate ber_scanf fmt ({) ber: ber_scanf fmt (a) ber: ber_scanf fmt (O) ber: ber_scanf fmt (t{) ber: ber_scanf fmt (}) ber: ldap_msgfree ldap_result ld 0x7f59cc100910 msgid 2 wait4msg ld 0x7f59cc100910 msgid 2 (timeout 0 usec) wait4msg continue ld 0x7f59cc100910 msgid 2 all 0 ** ld 0x7f59cc100910 Connections: * host: animal.clarku.edu port: 636 (default) refcnt: 2 status: Connected last used: Thu Feb 2 14:14:14 2012 ** ld 0x7f59cc100910 Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ld 0x7f59cc100910 request count 1 (abandoned 0) ** ld 0x7f59cc100910 Response Queue: Empty ld 0x7f59cc100910 response count 0 ldap_chkResponseList ld 0x7f59cc100910 msgid 2 all 0 ldap_chkResponseList returns ld 0x7f59cc100910 NULL ldap_int_select 4f2ae08a connection_get(15): got connid=0 4f2ae08a =>do_syncrepl rid=001 4f2ae08a =>do_syncrep2 rid=001 ldap_result ld 0x7f59cc100910 msgid 2 wait4msg ld 0x7f59cc100910 msgid 2 (timeout 0 usec) wait4msg continue ld 0x7f59cc100910 msgid 2 all 0 ** ld 0x7f59cc100910 Connections: * host: animal.clarku.edu port: 636 (default) refcnt: 2 status: Connected last used: Thu Feb 2 14:14:14 2012 ** ld 0x7f59cc100910 Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ld 0x7f59cc100910 request count 1 (abandoned 0) ** ld 0x7f59cc100910 Response Queue: Empty ld 0x7f59cc100910 response count 0 ldap_chkResponseList ld 0x7f59cc100910 msgid 2 all 0 ldap_chkResponseList returns ld 0x7f59cc100910 NULL ldap_int_select read1msg: ld 0x7f59cc100910 msgid 2 all 0 ber_get_next ldap_err2string 4f2ae08a do_syncrep2: rid=001 (-1) Can't contact LDAP server ldap_err2string 4f2ae08a connection_get(15): got connid=0 ldap_free_request (origid 2, msgid 2) ldap_free_connection 1 1 ldap_free_connection: actually freed Thanks for your time - any help is appreciated. - Aaron --- Aaron Bennett Manager of Systems Administration Clark University ITS

3 8

RE: Best Practices for configuration management with cn=config?
by Quanah Gibson-Mount 03 Feb '12

03 Feb '12

--On Friday, February 03, 2012 1:57 PM -0500 "Charles T. Brooks" <brooksct(a)hbcs.org> wrote: > Quanah, could you elaborate at little on this comment? > >> The cn=config method IS a database, not a set of flat text files. >> Modifications to the configuration are immediate with the exception of >> changes to olcSecurity. > > I'm just starting to convert a heavily replicated environment to > cn=config, and I (apparently stupidly) thought that slapd.d was a live > database. Is the cn=config database held by sleepycat then, mixed up > with my user and system data in /var/lib/ldap? Or is it in memory only? cn=config is indeed a live database, so thinking that is in no way stupid ;). My point was, that you cannot just go and edit the cn=config database with something like 'vi'. The correct method is to use something like ldapmodify, etc. > Also, the olcSecurity exception - why aren't changes to security also > immediate? Because it requires restarting slapd to take effect, due to the way in which it affects the connection handler. AFAIK, this is the only exception. Security changes to acls (such as SSF lines) are immediate. > I'll appreciate any insights you can share - I prefer slapd.conf > personally, but I want to proceed in the direction the code authors > favor, since they almost certainly have a clearer vision of what's > optimal for the future of the software than I do. > > Currently I make changes by shutting down slapd, deleting slapd.d, > rebuilding slapd.d from my slapd.conf with slaptest, and restarting > slapd. Works for me right now, but I hope to progress past it. That definitely is not the correct approach. You should just be using ldapmodify or similar to update the cn=config db. ;) --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

3 4

Best Practices for configuration management with cn=config?
by Jeff B 03 Feb '12

03 Feb '12

I'm using puppet for configuration management and with the slapd.conf it was dumb simple to push configs to the master and the slave servers and have the server reload when the config was updated. However I'm running an overlay that pukes with a slapd.conf and had to convert over to cn=config. Now I'm not sure how I want to manage this. Can I safely modify the files while slapd is running? I wouldn't expect it to pick up the config changes without a reload, but if I want puppet to push configs and reload will this be a valid method? Or do I need to do something with an LDIF of the config and have some kind of ldapadd/ldapmodify mojo? Are there any puppet modules for cn=config that I missed when I looked?

4 3

Openldap 2.4.28 master/slave crash after upgrade?
by Raffael Sahli 03 Feb '12

03 Feb '12

Hi I did an upgrade of two ldap server (master/slave) from 2.4.21 to 2.4.28 two days ago. And today, the master crashed, if I do an ldapsearch: root@ldap-master001 /]#---> ldapsearch -ZZ -hlocalhost -d-1 ldap_create ldap_url_parse_ext(ldap://localhost) ldap_extended_operation_s ldap_extended_operation ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP localhost:389 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying ::1 389 ldap_pvt_connect: fd: 3 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_dump: buf=0x13c3910 ptr=0x13c3910 end=0x13c392f len=31 0000: 30 1d 02 01 01 77 18 80 16 31 2e 33 2e 36 2e 31 0....w...1.3.6.1 0010: 2e 34 2e 31 2e 31 34 36 36 2e 32 30 30 33 37 .4.1.1466.20037 ber_scanf fmt ({) ber: ber_dump: buf=0x13c3910 ptr=0x13c3915 end=0x13c392f len=26 0000: 77 18 80 16 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e w...1.3.6.1.4.1. 0010: 31 34 36 36 2e 32 30 30 33 37 1466.20037 ber_flush2: 31 bytes to sd 3 0000: 30 1d 02 01 01 77 18 80 16 31 2e 33 2e 36 2e 31 0....w...1.3.6.1 0010: 2e 34 2e 31 2e 31 34 36 36 2e 32 30 30 33 37 .4.1.1466.20037 ldap_write: want=31, written=31 0000: 30 1d 02 01 01 77 18 80 16 31 2e 33 2e 36 2e 31 0....w...1.3.6.1 0010: 2e 34 2e 31 2e 31 34 36 36 2e 32 30 30 33 37 .4.1.1466.20037 ldap_result ld 0x13bb660 msgid 1 wait4msg ld 0x13bb660 msgid 1 (infinite timeout) wait4msg continue ld 0x13bb660 msgid 1 all 1 ** ld 0x13bb660 Connections: * host: localhost port: 389 (default) refcnt: 2 status: Connected last used: Thu Jan 26 21:43:50 2012 ** ld 0x13bb660 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x13bb660 request count 1 (abandoned 0) ** ld 0x13bb660 Response Queue: Empty ld 0x13bb660 response count 0 ldap_chkResponseList ld 0x13bb660 msgid 1 all 1 ldap_chkResponseList returns ld 0x13bb660 NULL ldap_int_select It hangs at ldap_int_select (There's nothing in the slapd debug log) Same problem again after a few seconds, if I kill the daemon and start it again. (The daemon crashed, only a kill -9 helped) And now, after one hour of debug, the same problem occurred on our first slave server.... Has someone similar problems, or can somone helps me? The next thing I'll do is go back to 2.4.21, maybe that helps.... Thanks -- Raffael Sahli public(a)raffaelsahli.com

2 3

BayLISA OpenLDAP talk
by Howard Chu 02 Feb '12

02 Feb '12

For any folks in the San Francisco area who haven't already heard, I'll be giving a talk on OpenLDAP's new memory-mapped database and backend (back-mdb) there on February 16. http://www.baylisa.org/ -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Directory Manager (cn=config) ACLs
by Andy Carlson 02 Feb '12

02 Feb '12

Are there any ACLs that control what cn=directory manager,cn=config can modify or is it a LDAP superuser sort-of account? I only ask because I want to blow away my ACLs (olcAccess attributes in olcDatabase={2}bdb) and re-add updated ones them (I know it sounds silly, but I have valid reasons for doing this) and I want to make sure that I can still make these modifications as this directory manager even if I have no ACLs. Thanks, Andy Carlson Moody Bible Institute Identity Administrator | Information Systems 312-329-4385 www.moody.edu<http://www.moody.edu>

2 1

openldap 2.4.28 and "allow bind_v2"
by Francis Swasey 02 Feb '12

02 Feb '12

I have built and upgraded one of my openldap servers from 2.4.26 to 2.4.28 (on RHEL release 5.7 x86_64) and with the identical configuration to my other servers, I am seeing the following messages in the slapd.log file: slapd[4434]: conn=115331 fd=263 ACCEPT from IP=X.X.X.X:51856 (IP=0.0.0.0:389) slapd[4434]: conn=115331 op=0 do_extended: protocol version (2) too low slapd[4434]: conn=115331 op=0 DISCONNECT tag=120 err=2 text=requires LDAPv3 slapd[4434]: conn=115331 fd=263 closed (operations error) I'm not seeing anything leaping out at me from the change log for 2.4.27/2.4.28 that indicates what I have gotten wrong that worked until now. As I said, I am running the same slapd.conf file on my 2.4.26 installations and not seeing these failures there at all (and since I use an F5 load balancer, these connections are sprayed all across my pool of servers). Where should I start looking? Thanks, -- Frank Swasey | http://www.uvm.edu/~fcs Sr Systems Administrator | Always remember: You are UNIQUE, University of Vermont | just like everyone else. "I am not young enough to know everything." - Oscar Wilde (1854-1900)

3 6

cn=Connection 0,cn=Connections,cn=Monitor?!?
by Michael Ströder 02 Feb '12

02 Feb '12

HI! on one platform on various servers I see strange entries in back-monitor (see below). It's an installation of RE24 committ-id 22ee28752e3e0d2a6910a22922fc69befd78578a self-compiled on RHEL 6.2 x86_64 linked to BDB, SASL and OpenSSL shipped with RHEL. We have two custom overlays in this setup but disabling them did not make this monitor entries disappear. On my local test system on openSUSE 11.4 x86_64 I don't see this. Any idea under which condition such monitor entries can appear and where to look in my configuration? Ciao, Michael. --------------------------------- snip --------------------------------- dn: cn=Connection 0,cn=Connections,cn=Monitor structuralObjectClass: monitorConnection creatorsName: modifiersName: createTimestamp: 19700101000000Z modifyTimestamp: 19700101000000Z monitorConnectionNumber: 0 monitorConnectionProtocol: 0 monitorConnectionOpsReceived: 0 monitorConnectionOpsExecuting: 0 monitorConnectionOpsPending: 0 monitorConnectionOpsCompleted: 0 monitorConnectionGet: 0 monitorConnectionRead: 0 monitorConnectionWrite: 0 monitorConnectionMask: L monitorConnectionListener: monitorConnectionPeerDomain: unknown monitorConnectionPeerAddress: unknown monitorConnectionLocalAddress: monitorConnectionStartTime: 19700101000000Z monitorConnectionActivityTime: 19700101000000Z entryDN: cn=Connection 0,cn=Connections,cn=Monitor subschemaSubentry: cn=Subschema hasSubordinates: FALSE dn: cn=Connection 0,cn=Connections,cn=Monitor structuralObjectClass: monitorConnection creatorsName: modifiersName: createTimestamp: 19700101000000Z modifyTimestamp: 19700101000000Z monitorConnectionNumber: 0 monitorConnectionProtocol: 0 monitorConnectionOpsReceived: 0 monitorConnectionOpsExecuting: 0 monitorConnectionOpsPending: 0 monitorConnectionOpsCompleted: 0 monitorConnectionGet: 0 monitorConnectionRead: 0 monitorConnectionWrite: 0 monitorConnectionMask: L monitorConnectionListener: monitorConnectionPeerDomain: unknown monitorConnectionPeerAddress: unknown monitorConnectionLocalAddress: monitorConnectionStartTime: 19700101000000Z monitorConnectionActivityTime: 19700101000000Z entryDN: cn=Connection 0,cn=Connections,cn=Monitor subschemaSubentry: cn=Subschema hasSubordinates: FALSE

2 5

[pasword Policy Control]How to use it in java
by Jacquot, Pierre 01 Feb '12

01 Feb '12

Hello everyone, I'm new on OpenLdap and I discover it since 2 or 3 month. Actually I'm working on using of password policies, and I encounter some problems when I try to get the password Policy control on my Java Application. In my case, I use JNDI connection and I make my connection like this : Control controls[]={new BasicControl("1.3.6.1.4.1.42.2.27.8.5.1")}; ld= new InitialLdapContext(env, controls); // env contains url connection, Credential, password and kind of authentification javax.naming.ldap.Control[] controls = ld.getResponseControls(); In result of this action, I receive one control object, but I don't know how to use it to obtains the control message associated to my user (account blocked for example or number of grace that I can use etc.). Do you know a good tutorial that explain how can I use password policies control in my application, or something else like that ? Thanks for your time spent on my message :) Cordially Pierre JACQUOT Think green - keep it on the screen. This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.

2 1

making a full replica: slapd -c "rid=xxx" doesn't seem to work
by Jephte CLAIN 01 Feb '12

01 Feb '12

hello, I'm new on this list. I use OpenLDAP 2.4.23 on debian squeeze I'm currently testing full replication with the small configuration seed on the consumer side, but the replication is not complete. Let me explain in details: so, the consumer starts with no data at all (I wipe /etc/ldap/slapd.d/* files, and /var/lib/ldap/*) Based on the test049, I do 'slapadd -F /etc/ldap/slapd.d -b cn=config -l initial.ldif' with initial.ldif as: ------------- 8< ------------- dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/slapd/slapd.args olcPidFile: /var/run/slapd/slapd.pid dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcSyncrepl: {0}rid=0 provider="ldap://master.tld/" searchbase=cn=config bindmethod=simple binddn=cn=config credentials=password type=refreshAndPersist retry="60 10 300 +" schemachecking=off ------------- 8< ------------- on the provider side, cn=config is the rootdn of cn=config so the database cn=config is replicated, except for the above objects. Indeed, the logs says: dn_callback : new entry is older than ours cn=config ours 20120127114737.207735Z#000000#000#000000, new 20120127112957.179717Z#000000#000#000000 dn_callback : new entry is older than ours olcDatabase={0}config,cn=config ours 20120127114737.207985Z#000000#000#000000, new 20120127112953.813862Z#000000#000#000000 and this makes sense. I searched the archives, and found a message from Howard Chu made on 19 Apr 2011: ------------- 8< ------------- >The problem I now face is that the initial cn=config entries used to do >the first sync do not get overwritten by the data from the master. So >the install password doesn't get replaced nor do the updated retry >timeouts for olcSyncRepl, because, I'm assuming, the 'stub' entries >have newer timestamps than those on the master. > >How can this be overcome from the perspective of the slave server. >Updating the entries on the master triggers the update as you would >expect. Is there a way to put the stub entries onto the slave with a >timestamp in the past so that they get overwritten during the first >sync? Or is there another way to trigger them to be updated? Use slapd -c. Read the slapd(8) manpage. ------------- 8< ------------- The manpage says: ------------- 8< ------------- -c cookie (...) Use only the rid part to force a full reload. ------------- 8< ------------- So I tried '/usr/sbin/slapd -c "rid=0" -d 16384 ...' but I got the message above about the entry not overwritten because of the timestamp. I wonder what I am doing wrong... I'd prefer not to have to use a more recent version, because debian already does a good job following the patches and keeping the whole thing stable :-) But If this is a known issue, what are my options? I mean, my goal is to replicate schemas, indexes, limits, acls and Authz definitions. I thought that a whole replica would the easiest. how do you guys do this? thanks in advance for your inputs. best regards, Jephté Clain Direction des Systèmes d'Information et des Usages Numériques - 2IG Tél. 0262 93 86 31 Fax. 0262 93 81 06

3 8

Re: Global modifications
by Nick Milas 31 Jan '12

31 Jan '12

On 31/1/2012 4:30 μμ, Charles T. Brooks wrote: > You could always make an LDIF with your preferred awk > > ldapsearch -x -LLL -Dcn=manager,dc=example,dc=com -W 'mail=*' mail|gawk > '/^dn/{printf "%s\nchangetype: modify\nadd: acceptedEmail\n", > $0};/^mail/{printf "acceptedEmail: %s\n\n", $2}' > > and pipe it to ldapadd/ldapmodify... if you need to add the objectClass > as well, just modify the printf on the /^dn/ pattern. > > Seems like you might be independently recreating the Lachman schema, > though. > Thanks Charles, Your solution looks fine. Obviously ldapmodify cannot use existing data directly for new entries. I didn't know of Lachman schema, I guess you mean: http://www.sendmail.org/m4/laser.txt (which I found with a bit of googling). I'll take a look. From a first glance, however, it is more extensive than what I want. In fact, I want to disassociate mail attribute from use in our applications (mainly Postfix), and I want to use a different attribute for that use. Can I find the Lachman schema anywhere in a complete form, ready for Openldap? Nick

1 0

OpenLDAP/AD 2 way password sync.
by Darouichi, Aziz 31 Jan '12

31 Jan '12

Hi, Please forgive me if this topic was raised in the past. We have an SSO portal and all our applications have been moved to SSO. Authentication is done via an Openldap 2.4.23 Database. Also we run Microsoft Active Directory services on 2003 Domain. We are looking for a two way password synch between AD and Openldap so that a single password can be used for both AD domain and Portal. Thanks, Aziz

1 0

Re: slapcat and slapadd
by NetNinja 31 Jan '12

31 Jan '12

I don't use the slapadd command, I use ldapadd or ldapmodify. Try the ldap commands. example; ldapmodify -D "cn=manger,dc=SPSC,dc=TUGRAZ,dc=AT" -W -f ldapFullCat.ldif There are also some commands you can add inside of the ldif file as well. These commands are add, replace and delete. Check the man page for ldif for details. I hope this helps On Tue, Jan 24, 2012 at 1:54 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, January 24, 2012 9:59 AM +0100 Andreas Laesser > <andreas.laesser(a)tugraz.at> wrote: > >> -----BEGIN PGP SIGNED MESSAGE----- >> Hash: SHA1 >> >> I don't know!? It was there so I thought that it should be there, but as >> tested I know that the new server won't work without these two entries... > > > Sounds like you have a corrupted database to me. > > > --Quanah > > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

Global modifications
by Nick Milas 31 Jan '12

31 Jan '12

Hello, Is there a way to apply changes to all entries using ldapmodify or a similar tool? I would like to add automatically to all our entries with a "mail" attribute, a new acceptedEmail attribute with the same values as the existing mail attribute. The acceptedEmail attribute would be defined in a custom schema, under a new custom auxiliary objectClass: orgFunctionalData. What would be the simplest way to do it? Thanks in advance, Nick

2 1

smbk5pwd overlay assert/crash
by "Tiziano Müller" 31 Jan '12

31 Jan '12

Hi everyone I tried to get the smbk5pwd overlay working on SLES11 (openldap 2.4.26). Unfortunately the slapd server crashes when I try to change a password as soon as the overlay is enabled. Running the server either with strace or gdb shows the following as cause for the crash: mods.c:64: modify_add_values: Assertion `mod->sm_numvals == i' failed. To build the smbk5pwd on SLES I patched the original spec file and the Makefile for smbk5pwd to enable only Shadow- and LM/NT-Hash password synchronization (no Kerberos/Heimdal support). Other overlays in the stack are (in their respective order): * syncprov * dynlist * unique * (smbk5pwd) * ppolicy (disabling this does not help) Has anyone seen this problem? How can/should I proceed to (help) debug this bug? Thanks in advance, Best regards, Tiziano -- stepping stone GmbH Neufeldstrasse 9 CH-3012 Bern Telefon: +41 31 332 53 63 www.stepping-stone.ch tiziano.mueller(a)stepping-stone.ch

4 7

DEL don't get synced
by Marc Patermann 31 Jan '12

31 Jan '12

Hi, under some circumstances DEL don't get replicated to the consumers (SyncRepl). I think this has to do with other changes at the some moment. I attached two logs excepts in sync.log. In the first except there is only a DEL Jan 31 09:16:01 ldapserver slapd[10641]: conn=79138 op=2 DEL dn="employeeNumber=19676,ou=humans,ou=foo" For this there is a Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 line for every connected consumer. In the second step there is a MOD and a DEL Jan 31 10:31:01 ldapserver slapd[10641]: conn=79938 op=2 MOD dn="ou=FA-WF,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=79938 op=3 DEL dn="employeeNumber=24387,ou=humans,ou=foo" As far as I can see, there is only sync activity for the MOD action, and not for the DEL action. The DEL is not synced. Marc Jan 31 09:16:01 ldapserver slapd[10641]: conn=79138 fd=344 ACCEPT from IP=10.49.8.54:55702 (IP=0.0.0.0:389) Jan 31 09:16:01 ldapserver slapd[10641]: conn=79138 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Jan 31 09:16:01 ldapserver slapd[10641]: conn=79138 op=0 STARTTLS Jan 31 09:16:01 ldapserver slapd[10641]: conn=79138 op=0 RESULT oid= err=0 text= Jan 31 09:16:01 ldapserver slapd[10641]: conn=79138 fd=344 TLS established tls_ssf=256 ssf=256 Jan 31 09:16:01 ldapserver slapd[10641]: conn=79138 op=1 BIND dn="cn=human,ou=mgr,ou=foo" method=128 Jan 31 09:16:01 ldapserver slapd[10641]: conn=79138 op=1 BIND dn="cn=human,ou=mgr,ou=foo" mech=SIMPLE ssf=0 Jan 31 09:16:01 ldapserver slapd[10641]: conn=79138 op=1 RESULT tag=97 err=0 text= Jan 31 09:16:01 ldapserver slapd[10641]: conn=79138 op=2 DEL dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: slap_queue_csn: queing 0x7fb9186ee300 20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: slap_graduate_commit_csn: removing 0x7fb8c83c28d0 20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: conn=1639 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: conn=1640 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: conn=1641 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: conn=1642 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: conn=1645 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: conn=1648 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: conn=1643 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: conn=1647 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: conn=1655 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: conn=1644 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: conn=1664 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: conn=1660 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: conn=1665 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: conn=1670 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: conn=1649 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: conn=1683 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: conn=1692 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: conn=1646 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: conn=1659 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: conn=1658 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: conn=1666 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: conn=1653 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: conn=1675 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: slap_queue_csn: queing 0x7fb9fd5dccd8 20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: conn=1674 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: conn=1672 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: conn=1677 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: conn=1668 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: conn=1685 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: conn=1689 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: conn=1662 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: conn=1656 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: conn=1687 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: conn=1682 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: conn=1688 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: conn=1652 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: conn=1700 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: conn=1654 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: conn=1701 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: conn=1695 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: conn=1702 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: conn=1706 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: conn=1697 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: conn=1707 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: conn=1704 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: conn=1709 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: conn=68291 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: conn=1705 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: conn=68347 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: conn=1661 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: conn=1676 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: conn=1671 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: conn=1663 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: conn=1680 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: conn=1669 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: conn=1681 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: conn=1667 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: conn=1678 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: conn=1679 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: slap_graduate_commit_csn: removing 0x7fba2edfc470 20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: conn=1651 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: conn=79138 op=2 RESULT tag=107 err=0 text= Jan 31 09:16:01 ldapserver slapd[10641]: conn=1673 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: conn=1690 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: conn=1694 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: conn=1691 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: conn=1698 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131081601.377028Z#000000#000#000000 Jan 31 09:16:01 ldapserver slapd[10641]: conn=1703 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: conn=1657 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: conn=1719 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: conn=1708 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: conn=1650 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: conn=1717 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: conn=1686 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: conn=1684 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: conn=1693 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: conn=1699 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: conn=1696 op=1 ENTRY dn="employeeNumber=19676,ou=humans,ou=foo" Jan 31 09:16:01 ldapserver slapd[10641]: conn=79138 fd=344 closed (connection lost) Jan 31 10:31:01 ldapserver slapd[10641]: conn=79938 fd=344 ACCEPT from IP=10.49.8.54:44064 (IP=0.0.0.0:389) Jan 31 10:31:01 ldapserver slapd[10641]: conn=79938 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Jan 31 10:31:01 ldapserver slapd[10641]: conn=79938 op=0 STARTTLS Jan 31 10:31:01 ldapserver slapd[10641]: conn=79938 op=0 RESULT oid= err=0 text= Jan 31 10:31:01 ldapserver slapd[10641]: conn=79938 fd=344 TLS established tls_ssf=256 ssf=256 Jan 31 10:31:01 ldapserver slapd[10641]: conn=79938 op=1 BIND dn="cn=human,ou=mgr,ou=foo" method=128 Jan 31 10:31:01 ldapserver slapd[10641]: conn=79938 op=1 BIND dn="cn=human,ou=mgr,ou=foo" mech=SIMPLE ssf=0 Jan 31 10:31:01 ldapserver slapd[10641]: conn=79938 op=1 RESULT tag=97 err=0 text= Jan 31 10:31:01 ldapserver slapd[10641]: conn=79938 op=2 MOD dn="ou=FA-WF,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=79938 op=2 MOD attr=member Jan 31 10:31:01 ldapserver slapd[10641]: slap_queue_csn: queing 0x7fba1dff8e80 20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: slap_graduate_commit_csn: removing 0x7fba20314a80 20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: conn=68347 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: conn=1706 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=68291 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=1704 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=1709 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=1719 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: conn=1673 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: conn=1692 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: conn=1697 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=1717 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: conn=1643 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: conn=1659 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: conn=1271 op=1 INTERM oid=1.3.6.1.4.1.4203.1.9.1.4 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: conn=1708 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=1684 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=1683 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: slap_queue_csn: queing 0x7fb9fcc32cd0 20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: conn=1695 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=1672 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: conn=1677 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: conn=1674 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: conn=1701 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: conn=1679 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: conn=1675 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=1703 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=1678 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: conn=1681 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=1667 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: conn=1687 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=1670 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=1680 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: conn=1705 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: conn=1671 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=1676 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=1665 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=1669 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: conn=1660 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=1661 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=1650 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=1668 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: conn=1699 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: conn=1657 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=1694 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: conn=1656 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=1666 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=1663 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=1649 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: conn=1651 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: conn=1646 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: conn=1702 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: conn=1693 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=1664 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=1686 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: conn=1688 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: conn=1682 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: conn=1641 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: conn=1685 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: conn=1707 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=1645 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=1642 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=1640 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=1690 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=1700 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: slap_graduate_commit_csn: removing 0x7fbacf061590 20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: conn=79938 op=2 RESULT tag=103 err=0 text= Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: syncprov_sendresp: cookie=rid=401,csn=20120131093101.898916Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: conn=1662 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=1654 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=1696 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=1644 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=1691 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=1648 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=1655 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=1652 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=1689 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=1647 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=1639 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=1653 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=79938 op=3 DEL dn="employeeNumber=24387,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=1658 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: conn=1698 op=1 ENTRY dn="ou=fa-wf,ou=gruppen,ou=humans,ou=foo" Jan 31 10:31:01 ldapserver slapd[10641]: slap_queue_csn: queing 0x7fb9126e2300 20120131093101.913856Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: slap_queue_csn: queing 0x7fb9fd6e2b20 20120131093101.913856Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: slap_graduate_commit_csn: removing 0x7fbac92d6750 20120131093101.913856Z#000000#000#000000 Jan 31 10:31:01 ldapserver slapd[10641]: conn=79938 op=3 RESULT tag=107 err=0 text= Jan 31 10:31:01 ldapserver slapd[10641]: slap_graduate_commit_csn: removing 0x7fbacf061590 20120131093101.913856Z#000000#000#000000

1 0

Back-Shell and binary attribute
by llg 31 Jan '12

31 Jan '12

Hi, I'm trying to develop a back_shell to intercept modifications and I got difficulties with binary attributes on modify operations (userCertificate to be exact). My input ldif contains userCertificate in Base 64 written like : userCertificate;binary:: XXXXXXXXXX The shell begins with printing input attributes via a logger : logger -t "$0" "$@" When we call the shell via ldapadd command, output is OK, but with ldap_modify command, output seems to have been decoded and the shell received binary data. Same problem with : < file:/// syntax in ldif. If we send this ldif directly to our ldap instance, modification is OK. Any ideas ? Thks LLG PS : same problem with back_perl

1 1

openldap default username/password?
by Kwasi Gyasi - Agyei 30 Jan '12

30 Jan '12

Hi, I'm trying to configure openldap using slapd.d style configuration, however command: #ldapadd -vxh localhost -D cn=admin,cn=config -w "" -f /usr/local/conf/shared/openldap/init-config.ldif fails with error ldap_initialize( ldap://localhost ) ldap_bind: Server is unwilling to perform (53) additional info: unauthenticated bind (DN with no password) disallowed #ldapadd -vxh localhost -f /usr/local/conf/shared/openldap/init-config.ldif fails with error ldap_initialize( ldap://localhost ) add objectClass: olcGlobal add olcLogFile: /var/log/openldap/openldap.log add olcLogLevel: -1 adding new entry "cn=config" ldap_add: Strong(er) authentication required (8) additional info: modifications require authentication any ideas? -- Multimedia and Communication | Property | Entertainment Kwasi Owusu Gyasi - Agyei *cell* (+27) (0) 76 466 4488 *website *www.4things.co.za *email *kwasi.gyasiagyei(a)4things.co.za *skype *kwasi.gyasiagyei *role* Developer.Designer.Software Architect

2 1

Issues in implementing SASL
by Gaurav Gugnani 30 Jan '12

30 Jan '12

Hello All, I'm trying to configure SASL on openldap and did following steps: 1> Modify the password of the user: saslpasswd2 -c -u <realm> <username> 2> Then i modify slapd.conf: sasl-regexp uid=(.*),cn=<realm>,cn=DIGEST-MD5,cn=auth uid=$1,ou=System,o=<realm> 3> After this i try to do ldapsearch and it gave me an error: ldap_bind: Server is unwilling to perform (53) additional info: unauthenticated bind (DN with no password) disallowed Somewhere i read that we have to provide SASL information in slapd.conf however when i write below mentioned content - then ldap doesn't re-start. dn:uid=<username>,ou=System,o=<realm> bindmethod=sasl saslmech=DIGEST-MD5 credentials=<password> realm=<realm> Please help in resolving SASL mechanism to be used. Thanks and Regards, Gaurav Gugnani

2 1

OpenLDAP with BackSQL and Postgres. Upper on bigint?
by Manny 30 Jan '12

30 Jan '12

Hi there. I'm sorry for the SPAM. I'm posting this again as apparently I sent it to the wrong mailing list before. I then opened a bug report (ITS#7130) and was hinted that I should write to this mailing list instead, which I did, but it didn't go through (not in the archive) so I subscribed and now try it again. Really sorry if you got my mail many times :( I'm using the latest stable release of openldap, with back-sql and postgresql as a backend. I have an sssd which uses this openldap server for ID providing and authentication. A recent update in this sssd changed the filter used to retrieve groupids of users, which surfaced what seems to be a bug in backsql. >From my investigation it seems to me that when constructing the search query, openldap tries to use the UPPER function on every criteria in the WHERE clause, no matter which type it is. This causes an error in postgresql, as the gidNumber that is supposed to be filtered is of type "bigint". I could simply remove "upper_func" from my slapd.conf, but I need it for other queries. Changing the field gidNumber in the database to text would also be a workaround, but I'd rather prefer this fixed in backsql. Anyways, here is the important part of my slapd.conf: #----------------------------------------------- database sql suffix "dc=mydomain,dc=at" rootdn "cn=Manager,dc=mydomain,dc=at" rootpw mysecret dbname mydbname dbuser mydbuser dbpasswd myuserpw subtree_cond "UPPER(ldap_entries.dn) LIKE UPPER('%'||?)" insentry_stmt "insert into ldap_entries (id,dn,oc_map_id,parent,keyval) values ((select max(id)+1 from ldap_entries),?,?,?,?)" upper_func "upper" upper_needs_cast "yes" strcast_func "text" concat_pattern "?||?" has_ldapinfo_dn_ru no sizelimit -1 #----------------------------------------------- The error can be reproduced in my case when running this command: #----------------------------------------------- ldapsearch -H ldaps://127.0.0.1/ -b ou=groups,ou=myserver,dc=mydomain,dc=at -D "uid=myuser,ou=users,ou=myserver,dc=mydomain,DC=at" '(gidNumber=512)' -W #----------------------------------------------- Which results in this output: #----------------------------------------------- # extended LDIF # # LDAPv3 # base <ou=groups,ou=myserver,dc=mydomain,dc=at> with scope subtree # filter: (gidNumber=512) # requesting: ALL # # search result search: 2 result: 80 Other (e.g., implementation specific) error #----------------------------------------------- Here is the interesting part of the level 255 log output: #----------------------------------------------- <==backsql_oc_get_candidates(): 0 ==>backsql_oc_get_candidates(): oc="sambaDomain" ==>backsql_srch_query() ==>backsql_process_filter() <==backsql_process_filter() succeeded <==backsql_srch_query() returns SELECT DISTINCT ldap_entries.id,samba_domain_ldap.id,text('sambaDomain') AS objectClass,ldap_entries.dn AS dn FROM ldap_entries,samba_domain_ldap WHERE samba_domain_ldap.id=ldap_entries.keyval AND ldap_entries.oc_map_id=? AND UPPER(ldap_entries.dn) LIKE UPPER('%'||?) AND 7=7 Constructed query: SELECT DISTINCT ldap_entries.id,samba_domain_ldap.id,text('sambaDomain') AS objectClass,ldap_entries.dn AS dn FROM ldap_entries,samba_domain_ldap WHERE samba_domain_ldap.id=ldap_entries.keyval AND ldap_entries.oc_map_id=? AND UPPER(ldap_entries.dn) LIKE UPPER('%'||?) AND 7=7 id: '6' (sub)dn: "%OU=GROUPS,OU=MYSERVER,DC=MYDOMAIN,DC=AT" <==backsql_oc_get_candidates(): 0 ==>backsql_oc_get_candidates(): oc="inetOrgPerson" ==>backsql_srch_query() ==>backsql_process_filter() ==>backsql_process_filter_attr(gidNumber) <==backsql_process_filter_attr(gidNumber) <==backsql_process_filter() succeeded <==backsql_srch_query() returns SELECT DISTINCT ldap_entries.id,OS_USER.id,text('inetOrgPerson') AS objectClass,ldap_entries.dn AS dn FROM ldap_entries,OS_USER WHERE OS_USER.id=ldap_entries.keyval AND ldap_entries.oc_map_id=? AND UPPER(ldap_entries.dn) LIKE UPPER('%'||?) AND (upper(OS_USER.gidnumber)='512') Constructed query: SELECT DISTINCT ldap_entries.id,OS_USER.id,text('inetOrgPerson') AS objectClass,ldap_entries.dn AS dn FROM ldap_entries,OS_USER WHERE OS_USER.id=ldap_entries.keyval AND ldap_entries.oc_map_id=? AND UPPER(ldap_entries.dn) LIKE UPPER('%'||?) AND (upper(OS_USER.gidnumber)='512') id: '8' (sub)dn: "%OU=GROUPS,OU=MYSERVER,DC=MYDOMAIN,DC=AT" backsql_oc_get_candidates(): error executing query Return code: -1 nativeErrCode=7 SQLengineState=S1000 msg="[unixODBC]ERROR: function upper(bigint) does not exist at character 288;#012Error while executing the query" #----------------------------------------------- I got a hint that I might be able to configure this in ldap_attr_mappings, but as I can find no documentation on what the columns in this table mean, it's hard for me to figure out what to do. The only thing that I can tell is that I can not see the word UPPER anywhere in the sel_expr field (or any other field for that matter). Thanks a lot in advance for your help.

1 0

ftp.openldap.org/incoming: No space left on device
by SATOH Fumiyasu 30 Jan '12

30 Jan '12

Hi, ftp://ftp.openldap.org/incoming has no disk free. ---> PASV <--- 227 Entering Passive Mode (204,152,186,57,233,61) ---- Connecting data socket to (204.152.186.57) port 59709 ---> STOR openldap-2.4.28-man1-add-o-option.patch <--- 150 Opening BINARY mode data connection for 'openldap-2.4.28-man1-add-o-option.patch'. <--- 452 Error writing to file: No space left on device. -- -- Name: SATOH Fumiyasu (fumiyas @ osstech co jp) -- Business Home: http://www.OSSTech.co.jp/ -- Personal Home: http://www.SFO.jp/blog/

1 0

Re: Assertion failure -- using relay backend and translucent overlay
by Mattias Andersson 29 Jan '12

29 Jan '12

On Sun, 29 Jan 2012 17:10:00 +0100, Hallvard B Furuseth <h.b.furuseth(a)usit.uio.no> wrote: >>> ldapsearch -x -h localhost -b "dc=example,dc=com" -s base >>> "(objectClass=*)" 1.1 >> (...) >> Ok, here's the debug output from the above ldapsearch query: >> (...) >> conn=1000 op=1 SRCH base="dc=chalmers,dc=se" scope=2 deref=0 >> filter="(objectClass=*)" >> conn=1000 op=1 SRCH attr=1.1 > > Strange. Did you include -s base? scope=2 in the log is subtree. It automatically changed to scope=2 when I appended 1.1. > Anyway, I suggest you answer in the ITS instead. > A crash is certainly a bug which needs fixing. Ok, I'll post a bug report. Btw, I'm using slapd 2.4.25 (Nov 14 2011 21:34:11). Mattias

1 1

Assertion failure -- using relay backend and translucent overlay
by Mattias Andersson 29 Jan '12

29 Jan '12

Hi, I have configured a proxy server with its own local database that is used both to override existing attributes of a remote database and to add its own entries to the directory. I have configured the local database as subordinate and I have configured a relay database that is also pointing to the local database, but it is using the translucent overlay to connect to the remote ldap directory. My slapd.conf configuration: backend hdb backend ldap database hdb directory /var/lib/ldap suffix "dc=foo,dc=example,dc=com" rootdn "cn=admin,dc=foo,dc=example,dc=com" rootpw secret index objectClass eq subordinate database relay suffix "dc=example,dc=com" overlay rwm rwm-suffixmassage "dc=foo,dc=example,dc=com" overlay translucent uri ldap://ldap.example.com translucent_bind_local This configuration actually does exactly what I have been trying to achieve. I can override user attributes and at the same time I can add additional group entries without having root access to the remote server. I have tested it with the ldap nss service in linux and it works without errors. The updated user accounts are correctly retrieved and the new groups are added transparently. If I use ldapsearch, it will search both the local and the remote server. The problem that I've experienced is that when I'm using a different ldap client, such as Softerra LDAP Administrator, then the daemon crashes when a search query is performed: slapd starting conn=1000 fd=11 ACCEPT from IP=X.X.X.X:61230 (IP=0.0.0.0:389) conn=1000 op=0 BIND dn="" method=128 conn=1000 op=0 RESULT tag=97 err=0 text= conn=1000 op=1 SRCH base="dc=example,dc=com" scope=0 deref=0 filter="(objectClass=*)" conn=1000 op=1 SRCH attr=1.1 conn=1000 op=1: back-relay for DN="dc=example,dc=com" would call self. slapd: /build/buildd/openldap-2.4.25/servers/slapd/attr.c:236: attr_dup2: Assertion `j < i' failed. Aborted The message that "back-relay would call itself" is also logged when using ldapsearch, but ldapsearch does not cause an assertion failure: slapd starting conn=1000 fd=11 ACCEPT from IP=127.0.0.1:36760 (IP=0.0.0.0:389) conn=1000 op=0 BIND dn="" method=128 conn=1000 op=0 RESULT tag=97 err=0 text= conn=1000 op=1 SRCH base="dc=example,dc=com" scope=2 deref=0 filter="(objectClass=*)" conn=1000 op=1: back-relay for DN="dc=example,dc=com" would call self. PROXIED attributeDescription "ORCLNETDESCSTRING" inserted. conn=1000 op=1 SEARCH RESULT tag=101 err=4 nentries=300 text= conn=1000 op=2 UNBIND conn=1000 fd=11 closed I'm happy with the proxy functionality that I've managed to configure (which is working), but it's definitely a security vulnerability when simply using a different LDAP client causes the server to crash. Is there any way I could avoid the assertion failure? Should I post a bug report? TIA, Mattias

2 2

syncrepl failing with ldap_start_tls failed (-11)
by Iain Georgeson 29 Jan '12

29 Jan '12

Hello, * Summary: I'm trying to set up syncrepl in my LDAP infrastructure. The logs on my consumer show that syncrepl is failing to negotiate TLS when connecting to the provider. Other LDAP commands such as ldapsearch and sssd show no problem connecting using the same TLS configuration. At this point, I don't have a good idea of how to continue debugging this problem. Are there any more configuration items affecting TLS I should be looking at? Or any way of getting more details on the TLS nagotiation? * The provider ("auth-00.[MYDOMAIN]"): slapd 2.4.23 from openldap-servers-2.4.23-15.el6.x86_64 on Scientific Linux 6. TLS is configured with [cn=config] olcTLSCACertificateFile: /etc/ssl/[MYCA].pem olcTLSCertificateFile: /etc/ssl/certs/auth-00.crt.pem # Has CN=auth-00.[MYDOMAIN] olcTLSCertificateKeyFile: /etc/ssl/private/auth-00.key.pem olcTLSVerifyClient: never If I try: $ ldapsearch -ZZ -x -H ldap://auth-00.[MYDOMAIN]/ uid=iain it connects and cheerfully returns objects * The provider ("auth-01.MYDOMAIN"): Same slapd version, same package, same OS. syncrepl configuration: olcSyncrepl: rid=001 provider=ldap://auth-00.[MYDOMAIN]:389 bindmethod=simple timeout=0 network-timeout=0 binddn="cn=syncrepl,dc=[MYDOMAIN]" credentials="[MYPASSWORD]" keepalive=0:0:0 filter="(objectClass=*)" searchbase="dc=[MYDOMAIN]" scope=sub schemachecking=off type=refreshAndPersist retry="10 3 120 5 600 +" starttls=critical tls_cacert=/etc/ssl/MYCA.pem * The error Consumer: Jan 28 11:53:12 auth-01 slapd[5595]: slapd starting Jan 28 11:53:12 auth-01 slapd[5595]: slap_client_connect: URI=ldap://auth-00.[MYDOMAIN]:389 Error, ldap_start_tls failed (-11) Jan 28 11:53:13 auth-01 slapd[5595]: do_syncrepl: rid=001 rc -11 retrying (2 retries left) Provider receiving syncrepl connection: Jan 28 11:53:23 auth-00 slapd[10701]: conn=7849 fd=32 ACCEPT from IP=[AUTH-01'S IP]:42669 (IP=0.0.0.0:389) Jan 28 11:53:23 auth-00 slapd[10701]: conn=7849 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Jan 28 11:53:23 auth-00 slapd[10701]: conn=7849 op=0 STARTTLS Jan 28 11:53:23 auth-00 slapd[10701]: conn=7849 op=0 RESULT oid= err=0 text= Jan 28 11:53:23 auth-00 slapd[10701]: conn=7849 fd=32 closed (TLS negotiation failure) Provider receiving ldapsearch connection: Jan 28 13:55:59 auth-00 slapd[22621]: conn=1099 fd=103 ACCEPT from IP=[AUTH-01'S IP]:42765 (IP=0.0.0.0:389) Jan 28 13:55:59 auth-00 slapd[22621]: conn=1099 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Jan 28 13:55:59 auth-00 slapd[22621]: conn=1099 op=0 STARTTLS Jan 28 13:55:59 auth-00 slapd[22621]: conn=1099 op=0 RESULT oid= err=0 text= Jan 28 13:55:59 auth-00 slapd[22621]: conn=1099 fd=103 TLS established tls_ssf=256 ssf=256 Jan 28 13:55:59 auth-00 slapd[22621]: conn=1099 op=1 BIND [...] Thanks, Iain. -- Systems Engineer KAUST Visualisation Laboratory

2 2

ldapsearch -y works great, -w barks
by Randy Schultz 28 Jan '12

28 Jan '12

Howdy, I'm confused as to why an operation with the -y filename works great, but the same operation with the -w pw dies with "ldap_bind: Invalid credentials (49)". The first file I've attached is with the -y, it works. The second is with the -w. I did notice the difference where the working one had a "." at the end of the pw, which was not present when using the -w option. To make sure I was not entering a typo on the commandline pw, I wrote a quick script, just a #!/bin/sh P=`cat p2` echo "|$P|" ldapsearch -v -d -1 -x -w "$P" -D cn=manager,dc=earlham,dc=edu -b ou=People,dc=earlham,dc=edu -h xaga This also died with invalid credentials after printing out the pw. Anybody have an idea what's going on? -- Randy (schulra(a)earlham.edu) 765.983.1283 <*> nosce te ipsum

4 4

Trying to get passthrough auth working with OpenLDAP and Kerberos
by Chastity Blackwell 27 Jan '12

27 Jan '12

For the last two weeks I have been on a sojourn through the wonderful world of LDAP, Kerberos, and SASL, which has had me banging my head against the desk more often than not. Today I'm finally crying uncle and asking for some help. We're running Centos 5.4, currently with OpenLDAP for user info and Kerberos for authentication, but we want to be able to use LDAP for authentication on a bunch of devices that can't use Kerberos natively. So I've been trying to get the passthrough auth working. So far, I think I've made a lot of progress, but I've run into a wall. Kerberos and LDAP are working in my testbed, and I can kinit and do an ldapwhoami no problem. testsaslauthd also gives me a success when I run it. However, when try to do a simple bind: [chas@ldapsandbox]$ ldapwhoami -x -D 'uid=chas,ou=People,dc=test,dc=domain' -W Enter LDAP Password: ldap_bind: Invalid credentials (49) [chas@ldapsandbox]$ syslog shows this: 2012-01-25T12:04:55-08:00 ldapsandbox slapd[14363]: conn=6 fd=15 ACCEPT from IP=10.17.136.50:55923 (IP=0.0.0.0:389) 2012-01-25T12:04:55-08:00 ldapsandbox slapd[14363]: conn=6 op=0 BIND dn="uid=chas,ou=People,dc=test,dc=domain" method=128 2012-01-25T12:04:55-08:00 ldapsandbox slapd[14363]: SASL [conn=6] Failure: cannot connect to saslauthd server: No such file or directory 2012-01-25T12:04:55-08:00 ldapsandbox slapd[14363]: conn=6 op=0 RESULT tag=97 err=49 text= 2012-01-25T12:04:55-08:00 ldapsandbox slapd[14363]: conn=6 fd=15 closed (connection lost) Meanwhile, the saslauthd I'm running with /usr/sbin/saslauthd -a kerberos5 -d doesn't even show a connection or anything to the console. Any idea why it can't connect to the saslauthd server? Here's my OpenLDAP slapd.conf: include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args TLSCACertificateFile /etc/openldap/cacert.crt TLSCertificateFile /etc/openldap/ldapsandbox.crt TLSCertificateKeyFile /etc/openldap/ldapsandbox.key authz-regexp uid=([^/]*),cn=gssapi,cn=auth uid= $1,ou=People,dc=test,dc=domain access to * by dn.regex="uid=.*/admin,cn=GSSAPI,cn=auth" write by * read database bdb suffix "dc=test,dc=domain" directory /var/lib/ldap index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub And here's my /etc/sasl2/slapd.conf: pwcheck_method: saslauthd saslauthd_path: /var/run/sasl2/mux Any ideas?

4 18

How to enable monitoring in OpenLdap with cn=config Backend
by Axel Birndt 25 Jan '12

25 Jan '12

Hi @All, i would like to ask you how could i enable the monitoring backend in Openldap. I'am using the cn=config Backend. A little bit "googling" does not give me the needed information. I found something like this: http://dkluenter.gmxhome.de/ffg-tutorium.pdf , but with no information, how to enable the monitoring. At openldap.org, the section http://www.openldap.org/devel/admin/monitoringslapd.html#Monitor configuration via cn=config(5) the section "18.1. Monitor configuration via cn=config(5)" is empty. In the archive from this list i found the following thread http://www.openldap.org/lists/openldap-technical/201110/msg00122.html but this thread don't help me to got an idea what i should do, to configure the monitoring in openldap. Do you have a doc or howto with further information about this? I need the documentation for the cn=config backend. I don't have an slapd.conf! Thanks and regards, Axel -- Gruß Axel ------------------------------

6 24

Creating a special entry
by Frank Bonnet 25 Jan '12

25 Jan '12

Hello Due to the usage of a third party software I need to create a special account into our OpenLDAP directory that have the following privileges read, compare, browse Help greatly appreciated on guidance to create such entry. info links welcome thank you

2 1

slapadd not allowed on first database
by Kwasi Gyasi - Agyei 25 Jan '12

25 Jan '12

Hi, I'm trying to migrate data using openldap migrations tools, however I keep get error below which I don't understand. I don;t even know where ldap is getting the second database from cause I don;t have that defined anywhere slapd.conf has only one database. Error: ------------------ The first database does not allow slapadd; using the first available one (2) slapadd: line 1: database #2 (dc=my-domain,dc=com) not configured to hold "dc=4things,dc=co,dc=za"; no database configured for that naming context slapd.conf : ------------------ # ###### SAMPLE 1 - SIMPLE DIRECTORY ############ # # NOTES: inetorgperson picks up attributes and objectclasses # from all three schemas # # NB: RH Linux schemas in /etc/openldap # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema # NO SECURITY - no access clause # defaults to anonymous access for read # only rootdn can write # NO REFERRALS # DON'T bother with ARGS file unless you feel strongly # slapd scripts stop scripts need this to work pidfile /var/run/slapd.pid # enable a lot of logging - we might need it # but generates huge logs loglevel -1 # MODULELOAD definitions # not required (comment out) before version 2.3 moduleload back_bdb.la # NO TLS-enabled connections # backend definition not required ####################################################################### # bdb database definitions # # replace example and com below with a suitable domain # # If you don't have a domain you can leave it since example.com # is reserved for experimentation or change them to my and inc # ####################################################################### database bdb suffix "dc=4things, dc=co, dc=za" # root or superuser rootdn "cn=system-admin, dc=4things, dc=co, dc=za" rootpw {SSHA}password # The database directory MUST exist prior to running slapd AND # change path as necessary directory /var/lib/ldap/4things.co.za # Indices to maintain for this directory # unique id so equality match only index uid eq # allows general searching on commonname, givenname and email index cn,gn,mail eq,sub # allows multiple variants on surname searching index sn eq,sub # sub above includes subintial,subany,subfinal # optimise department searches index ou eq # if searches will include objectClass uncomment following # index objectClass eq # shows use of default index parameter index default eq,sub # indices missing - uses default eq,sub index telephonenumber # other database parameters # read more in slapd.conf reference section cachesize 10000 checkpoint 128 15 Any ideas? I have Googled for almost a week now and I come across nothing... -- Multimedia and Communication | Property | Entertainment Kwasi Owusu Gyasi - Agyei *cell* (+27) (0) 76 466 4488 *website *www.4things.co.za *email *kwasi.gyasiagyei(a)4things.co.za *skype *kwasi.gyasiagyei *role* Developer.Designer.Software Architect

3 2

slapcat and slapadd
by Andreas Laesser 24 Jan '12

24 Jan '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi @all, I've a problem doing a slapcat and adding the dump again to another (empty) ldap server... doing a slapcat on my "master" gives me a file with: <snip> root@foobar /etc/ldap # head -100 ldapFullCat.ldif dn: objectClass: top objectClass: dcObject objectClass: organization o: spsc.tugraz.at dc: spsc structuralObjectClass: organization entryUUID: 292ab862-cb04-1030-9e71-dd10406d8585 creatorsName: cn=admin,dc=spsc,dc=tugraz,dc=at createTimestamp: 20120104094228Z entryCSN: 20120104094228.808452Z#000000#000#000000 modifiersName: cn=admin,dc=spsc,dc=tugraz,dc=at modifyTimestamp: 20120104094228Z dn: objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator userPassword:: e1NTSEF9WlQ5UmdyUFpJVDVuM3ByS0ErM3M5TFplU0RHcnFMN3g= structuralObjectClass: organizationalRole entryUUID: 292b04fc-cb04-1030-9e72-dd10406d8585 creatorsName: cn=admin,dc=spsc,dc=tugraz,dc=at createTimestamp: 20120104094228Z entryCSN: 20120104094228.810430Z#000000#000#000000 modifiersName: cn=admin,dc=spsc,dc=tugraz,dc=at modifyTimestamp: 20120104094228Z dn: dc=SPSC,dc=TUGRAZ,dc=AT dc: SPSC objectClass: dcObject objectClass: organizationalUnit ou: SPSC structuralObjectClass: organizationalUnit entryUUID: ffae9024-9a0c-1028-8a8f-881a13d527c4 creatorsName: cn=admin,dc=SPSC,dc=TUGRAZ,dc=AT createTimestamp: 20040913201236Z entryCSN: 20040913201236.000000Z#000001#000#000000 modifiersName: cn=admin,dc=SPSC,dc=TUGRAZ,dc=AT modifyTimestamp: 20040913201236Z contextCSN: 20120119135137.038345Z#000000#000#000000 contextCSN: 20120120100955.690312Z#000000#001#000000 dn: ou=people,dc=SPSC,dc=TUGRAZ,dc=AT ou: people objectClass: organizationalUnit structuralObjectClass: organizationalUnit entryUUID: ffc2d0b6-9a0c-1028-8a90-881a13d527c4 creatorsName: cn=admin,dc=SPSC,dc=TUGRAZ,dc=AT createTimestamp: 20040913201236Z entryCSN: 20040913201236.000000Z#000002#000#000000 modifiersName: cn=admin,dc=SPSC,dc=TUGRAZ,dc=AT modifyTimestamp: 20040913201236Z .... </snip> But if I want to add this file at my other server, it gives me: root@barfoo /etc/ldap # slapadd -l ldapFullCat.ldif -f ./slapd.conf slapadd: line 1: cannot add entry with empty dn="" _ 0.02% eta elapsed none spd 3.0 M/s Closing DB... Any Ideas? Of course, if I delete the first two entries it works, but then the ldap didn't work correctly. thanks and regards Andreas - -- ========================================================================= _____________ / ___________/ Andreas Laesser / //_// /____/ Signal Proc.& Speech Communication Lab. __/ /___/ / __ Graz University of Technology /___//____//___/ Inffeldgasse 16c/EG | A-8010 Graz | Austria http://www.spsc.tugraz.at Tel: +43 (0)316 873 -4443 Fax: DW 104439 ========================================================================= -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAk8ZQBUACgkQ1nmbrmNF2lObwQCeKnF+elTztwQCu9DhjbN4eKhB 8nQAn2CuBh2WNyjlTfWZhbzMeh6IFXbg =xheX -----END PGP SIGNATURE-----

3 4

Need help to change ldap password from client side
by sivakumar R 24 Jan '12

24 Jan '12

*Dear All, I've recently configured a LDAP Server, I am facing a small problem when i'm trying to change my password from client side by giving the command "passwd". It is giving the following error in terminal Changing password for user ****. Enter login(LDAP) password: New password: Retype new password: LDAP password information update failed: Insufficient access passwd: Authentication token manipulation error Also in /var/log/messages it is showing the following error message Jan 24 15:43:57 mail passwd: pam_ldap: ldap_modify_s Insufficient access Jan 24 15:43:57 mail gnome-keyring-daemon[6329]: gck_module_new: assertion `funcs' failed Jan 24 15:43:57 mail gnome-keyring-daemon[6329]: module_instances: assertion `module' failed Jan 24 15:43:57 mail gnome-keyring-daemon[6329]: egg_error_message: assertion `error' failed Jan 24 15:43:57 mail gnome-keyring-daemon[6329]: couldn't find secret store module: (unknown) Jan 24 15:43:57 mail gnome-keyring-daemon[6329]: lookup_login_keyring: assertion `GCK_IS_SESSION (session)' failed Jan 24 15:43:57 mail gnome-keyring-daemon[6329]: create_credential: assertion `GCK_IS_SESSION (session)' failed Jan 24 15:43:57 mail gnome-keyring-daemon[6329]: egg_error_message: assertion `error' failed Jan 24 15:43:57 mail gnome-keyring-daemon[6329]: couldn't create new login credential: (unknown) Also this is my ACL configuration details of /etc/openldap/slapd.conf access to attr=userPassword by anonymous auth by self write by * none access to * by * read Please help to resolve this Cordially Shiv *

3 2

How to configure Openldap with the new LDIF configuration
by André Ribas 20 Jan '12

20 Jan '12

Hi there, I am trying to setup a Samba + OpenLDAP server here but it has been a while since the last time that I did it. Last time that I did it, the slapd was configured by the file slapd.conf but now I realized that it has a new configuration method based on LDIF files. I'm a little confused with this new method and every tutorial that I find on the Internet says that I should write a slapd.conf and use the migration tool. But doing that I'll not be using the best feature of the new method (on-line updates) so I want to learn the new way. Sorry for this newbie question but I am not understanding how to use it to add a schema file or even change some configuration. Do anyone have some tips or even a good tutorial (maybe even a samba related one) that teaches how to do it in the "right" way? Thanks and sorry for any English mistakes (this is one of my very first mail to an English listing) André Ribas

3 2

TLS hostname check failure and subjectAltname extension
by Michael Ströder 19 Jan '12

19 Jan '12

HI! We're using self-compiled OpenLDAP 2.4.27 under RHEL 6.1 linked against OpenSSL 1.0.0 libs shipped with RHEL. (some names are consistently obfuscated herein to keep real names confidential) Unfortunately we can't get StartTLS to work. It always fails: # /opt/xxxdir/bin/ldapsearch -x -ZZ ldap://ldap-srv01.rz.domain ldap_start_tls: Connect error (-11) additional info: TLS: hostname does not match CN in peer certificate # /opt/xxxdir/bin/ldapsearch -x -ZZ ldap://ldap.domain ldap_start_tls: Connect error (-11) additional info: TLS: hostname does not match CN in peer certificate But OpenSSL lists the (IMO correct) hostnames in the server's certificate: ---------------------------------- snip ---------------------------------- Subject: CN=ldap.domain,OU=xxx,O=xxx,C=DE [..] X509v3 Subject Alternative Name: email:certificate@xxx.domain, DNS:ldap.domain, DNS:ldap-srv01.rz.domain, DNS:ldap-srv02.rz.domain ---------------------------------- snip ---------------------------------- Is the hostname check confused by the email in the first subjectAltName sequence value? Ciao, Michael.

2 2

syncprov_db_open: invalid config, lastmod must be enabled
by Angel L. Mateo 19 Jan '12

19 Jan '12

Hi, I'm trying to configure chain overlay in a ldap replica consumer. My final purpose is that if this node receives an update, it directly tries to make it in the provider node, instead of returning the referrral. Is that possible? I think so... But I have a problem with the configuration. My config is ... moduleload back_ldap moduleload syncprov ... database hdb suffix dc=<mysuffix> ... overlay syncprov syncrepl rid=31 provider="ldap://<provider>" binddn="<replica user dn>" bindmethod=simple credentials=<password> searchbase="dc=<mysuffix>" type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 +" timeout=1 overlay chain chain-max-depth 1 chain-return-error true chain-uri ldap://<provider> chain-rebind-as-user yes chain-idassert-bind bindmethod=simple binddn=<replica user dn> credentials=<password> starttls=no mode="self" But when I test configuration with slaptest, I get: root@canis32:/etc/ldap# slaptest -f /etc/ldap/slapd.conf syncprov_db_open: invalid config, lastmod must be enabled backend_startup_one (type=hdb, suffix="<mysuffix>"): bi_db_open failed! (-1) slap_startup failed (test would succeed using the -u switch) and I can't run slapd. Any idea? I'm running slapd 2.4.21 (ubuntu lucid package) -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 868887590 Fax: 868888337

3 10

ldap error codes during modification
by Rohan J 18 Jan '12

18 Jan '12

Hello, I was going through RFCs to have a clear requirement of the expected ldap error codes during an ldapmodify with insufficient access . Does Openldap always have to return error code 50 during a modify even though the modification may contain errors related to invalid attribute syntax, notAllowedOnRDN or any protocol errors. I am guessing that it should be fine to allow error codes except 16,20,32 etc. Please let me know if there is a reference to this information.

1 0

eDirectory -> openLDAP password synchronization with jdap
by Martin Anastasov 18 Jan '12

18 Jan '12

Hi, I'm trying to synchronize passwords from eDirectory to openLDAP using jdap. The passwords in eDirectory are not stored in plain text i.e. Secure Login SSO is used (protocom-SSO-Entries in ldiff flie). In ldiff are also present: nDSPKIUserCertificateInfo, userCertificate. Is it possible to do the synchronization ? Thanks in advance. Regards, Martin

2 1

Openldap/Sasl/GSSAPI on Debian: Key table entry not found
by Toomas Vendelin 18 Jan '12

18 Jan '12

The goal: to make an OpenLDAP server to authenticate using Kerberos V via GSSAPI Setup: several virtual machines running on freshly installed/updated Debian Squeeze A master KDC server kdc.example.com A LDAP server, running OpenLDAP ldap.example.com The problem: tom@ldap:~$ ldapsearch -b 'dc=example,dc=com' SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Other (e.g., implementation specific) error (80) additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Key table entry not found) One might suggest to add that keytab entry, but: ktutil: rkt /etc/ldap/ldap.keytab ktutil: list slot KVNO Principal ---- ---- --------------------------------------------------------------------- 1 2 ldap/ldap.example.com(a)EXAMPLE.COM 2 2 ldap/ldap.example.com(a)EXAMPLE.COM 3 2 ldap/ldap.example.com(a)EXAMPLE.COM 4 2 ldap/ldap.example.com(a)EXAMPLE.COM So, the entry as suggested by the OpenLDAP manual is there allright. Deleting and re-creating both service principal and the keytab on ldap.example.com didn't help, I get the same error. And before I make the keytab file readable by openldap, I get "Permission denied" error instead of the one in the subject. Which implies that the right keytab file is being accessed, as set in /etc/default/slapd. I have my doubts about the following part of slapd config: root@ldap:~# cat /etc/ldap/slapd.d/cn\=config.ldif | grep -v "^#" dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/slapd/slapd.args olcLogLevel: 256 olcPidFile: /var/run/slapd/slapd.pid olcToolThreads: 1 structuralObjectClass: olcGlobal entryUUID: d6737f5c-d321-1030-9dbe-27d2a7751e11 olcSaslHost: kdc.example.com olcSaslRealm: EXAMPLE.COM olcSaslSecProps: noplain,noactive,noanonymous,minssf=56 olcAuthzRegexp: {0}"uid=([^/]*),cn=EXAMPLE.COM,cn=GSSAPI,cn=auth" "uid=$1,ou=People,dc=example,dc=com" olcAuthzRegexp: {1}"uid=host/([^/]*).example.com,cn=example.com,cn=gssapi,cn=auth" "cn=$1,ou=hosts,dc=example,dc=com" A HOWTO at https://help.ubuntu.com/community/OpenLDAPServer#Kerberos_Authentication mentiones: Also, it is frequently necessary to map the Distinguished Name (DN) of an authorized Kerberos client to an existing entry in the DIT. I fail to understand where in the tree this should be defined, what schema should be used, etc. After hours of googling, it's official: I'm stuck! Please, help. Other things checked: Kerberos as such works fine (I can ssh without using a password to any machine in this setup). That means there should be no DNS-related problems. ldapsearch -b 'dc=example,dc=com' -x works OK. SASL/GSSAPI has been tested using sasl-sample-server -m GSSAPI -s ldap and sasl-sample-client -s ldap -n ldap.example.com -u tom without errors: root@ldap:~# sasl-sample-server -m GSSAPI -s ldap Forcing use of mechanism GSSAPI Sending list of 1 mechanism(s) S: R1NTQVBJ Waiting for client mechanism... C: R1NTQVBJAGCCAmUGCSqGSIb3EgECAgEAboICVDCCAlCgAwIBBaEDAgEOogcDBQAgAAAAo4IBamGCAWYwggFioAMCAQWhDRsLRVhBTVBMRS5DT02iIzAhoAMCAQOhGjAYGwRsZGFwGxBsZGFwLmV4YW1wbGUuY29to4IBJTCCASGgAwIBEqEDAgECooIBEwSCAQ8Re8XUnscB8dx6V/cXL+uzSF2/olZvcrVAJHZBZrfRKUFEQmU1Li46bUGK3GZwsn6qUVwmW6lyqVctOIYwGvBpz81Rw/5mj4V5iQudZbIRa+5Ew6W1oBB7ALi2cnPsbUroqzGmEh8/Vw8zSFk7W1gND4DLuWrPXD2xhLDUMMekBn5nXEPTnNAnV4w81Sj3ZlyLZz5OSitGVUEnQweV53z1spWsASHHWod/tSuxb19YeWmY5QHXPLG+lL5+w+Cykr0EhYVj8f8MDWFB8qoN1cr85xDfn18r8JldSw+i18nFKOo8usG+37hZTWynHYvBfMONtG9mLJv82KGPZMydWK7pzyTZDcnSsIjo2AftMZd5pIHMMIHJoAMCARKigcEEgb5aG1k4xgxmUXX7RKfvAbVBVJ12dWOgFFjMYceKjziXwrrOkv8ZwIvef9Yn2KsWznb5L55SXt2c/zlPa5mLKIktvw77hsK1h/GYc7p//BGOsmr47aCqVWsGuTqVT129uo5LNQDeSFwl2jXCkCZJZavOVrqYsM6flrPYE4n5lASTcPitX+/WNsf6WrvZoaexiv1JqyM/MWqS/vMBRMMc5xlurj6OARFvP9aFZoK/BLmfkSyAJj6MLbLVXZtkHiIPgot 'GSSAPI' Sending response... S: YIGZBgkqhkiG9xIBAgICAG+BiTCBhqADAgEFoQMCAQ+iejB4oAMCARKicQRvkxggi9pW+yJ1ExbTwLDclqw/VQ98aPq8mt39hkO6PPfcO2cB+t6vJ01xRKBrT9D2qF2XK0SWD4PQNb5UFbH4RM/bKAxDuCfZ1MHKgIWTLu4bK7VGZTbYydcckU2d910jIdvkkHhaRqUEM4cqp/cR Waiting for client reply... C: got '' Sending response... S: BQQF/wAMAAAAAAAAMBOWqQcACAAlCodrXW66ZObsEd4= Waiting for client reply... C: BQQE/wAMAAAAAAAAFUYbXQQACAB0b20VynB4uGH/iIzoRhw=got '?' Negotiation complete Username: tom Realm: (NULL) SSF: 56 sending encrypted message 'srv message 1' S: AAAASgUEB/8AAAAAAAAAADATlqrqrBW0NRfPMXMdMz+zqY32YakrHqFps3o/vO6yDeyPSaSqprrhI+t7owk7iOsbrZ/idJRxCBm8Wazx Waiting for encrypted message... C: AAAATQUEBv8AAAAAAAAAABVGG17WC1+/kIV9xTMUdq6Y4qYmmTahHVCjidgGchTOOOrBLEwA9IqiTCdRFPVbK1EgJ34P/vxMQpV1v4WZpcztgot '' recieved decoded message 'client message 1' root@ldap:~# sasl-sample-client -s ldap -n ldap.example.com -u tom service=ldap Waiting for mechanism list from server... S: R1NTQVBJrecieved 6 byte message Choosing best mechanism from: GSSAPI returning OK: tom Using mechanism GSSAPI Preparing initial. Sending initial response... C: R1NTQVBJAGCCAmUGCSqGSIb3EgECAgEAboICVDCCAlCgAwIBBaEDAgEOogcDBQAgAAAAo4IBamGCAWYwggFioAMCAQWhDRsLRVhBTVBMRS5DT02iIzAhoAMCAQOhGjAYGwRsZGFwGxBsZGFwLmV4YW1wbGUuY29to4IBJTCCASGgAwIBEqEDAgECooIBEwSCAQ8Re8XUnscB8dx6V/cXL+uzSF2/olZvcrVAJHZBZrfRKUFEQmU1Li46bUGK3GZwsn6qUVwmW6lyqVctOIYwGvBpz81Rw/5mj4V5iQudZbIRa+5Ew6W1oBB7ALi2cnPsbUroqzGmEh8/Vw8zSFk7W1gND4DLuWrPXD2xhLDUMMekBn5nXEPTnNAnV4w81Sj3ZlyLZz5OSitGVUEnQweV53z1spWsASHHWod/tSuxb19YeWmY5QHXPLG+lL5+w+Cykr0EhYVj8f8MDWFB8qoN1cr85xDfn18r8JldSw+i18nFKOo8usG+37hZTWynHYvBfMONtG9mLJv82KGPZMydWK7pzyTZDcnSsIjo2AftMZd5pIHMMIHJoAMCARKigcEEgb5aG1k4xgxmUXX7RKfvAbVBVJ12dWOgFFjMYceKjziXwrrOkv8ZwIvef9Yn2KsWznb5L55SXt2c/zlPa5mLKIktvw77hsK1h/GYc7p//BGOsmr47aCqVWsGuTqVT129uo5LNQDeSFwl2jXCkCZJZavOVrqYsM6flrPYE4n5lASTcPitX+/WNsf6WrvZoaexiv1JqyM/MWqS/vMBRMMc5xlurj6OARFvP9aFZoK/BLmfkSyAJj6MLbLVXZtkHiIP Waiting for server reply... S: YIGZBgkqhkiG9xIBAgICAG+BiTCBhqADAgEFoQMCAQ+iejB4oAMCARKicQRvkxggi9pW+yJ1ExbTwLDclqw/VQ98aPq8mt39hkO6PPfcO2cB+t6vJ01xRKBrT9D2qF2XK0SWD4PQNb5UFbH4RM/bKAxDuCfZ1MHKgIWTLu4bK7VGZTbYydcckU2d910jIdvkkHhaRqUEM4cqp/cRrecieved 156 byte message C: Waiting for server reply... S: BQQF/wAMAAAAAAAAMBOWqQcACAAlCodrXW66ZObsEd4=recieved 32 byte message Sending response... C: BQQE/wAMAAAAAAAAFUYbXQQACAB0b20VynB4uGH/iIzoRhw= Negotiation complete Username: tom SSF: 56 Waiting for encoded message... S: AAAASgUEB/8AAAAAAAAAADATlqrqrBW0NRfPMXMdMz+zqY32YakrHqFps3o/vO6yDeyPSaSqprrhI+t7owk7iOsbrZ/idJRxCBm8Wazxrecieved 78 byte message recieved decoded message 'srv message 1' sending encrypted message 'client message 1' C: AAAATQUEBv8AAAAAAAAAABVGG17WC1+/kIV9xTMUdq6Y4qYmmTahHVCjidgGchTOOOrBLEwA9IqiTCdRFPVbK1EgJ34P/vxMQpV1v4WZpczt

3 3

Translucent attribute local search problem
by benoit 18 Jan '12

18 Jan '12

I've setup a simple translucent conf like described here http://www.openldap.org/doc/admin24/overlays.html#Translucent Proxy , on a Debian squeeze, 2.4.23 server. lastmod off overlay translucent translucent_local telephoneNumber3,gidNumber uri "ldap://master.example.com" acl-bind binddn="cn=manager,dc=example,dc=com" credentials="{SHA}ABC123" I can overridde (gidNumber) or add attributes(telephoneNumber3): $ cat add.ldif dn: uid=bob,ou=people,dc=example,dc=com gidNumber: 00000 telephoneNumber3: 0000000 $ ldapadd -H ldap://proxy.example.com -x -W -D 'cn=Manager,dc=example,dc=com' -f add.ldif adding new entry "uid=bob,ou=people,dc=example,dc=com" A query on translucent server retrieve remote and local attribute: $ ldapsearch -LLL -H ldap://proxy.example.com -x -b "ou=people,dc=example, dc=com" '(uid=bob)' dn: uid=bob,ou=people,dc=example,dc=com ... gidNumber: 00000 telephoneNumber: 1111111 telephoneNumber3: 0000000 But searches against locally added or overridden attributes fail: $ ldapsearch -LLL -H ldap://proxy.example.com -x -b "ou=people,dc=example, dc=com" '(gidNumber=00000)' $ ldapsearch -LLL -H ldap://proxy.example.com -x -b "ou=people,dc=example, dc=com" '(telephoneNumber3=0000000)' thank you for your help

1 0

migrating from shadowAccount to password policy overlays
by Jonathon Anderson 18 Jan '12

18 Jan '12

We are in the midst of migrating from `shadowAccount` objects to the password policy overlay. Everything seems to be working so far, but I have been unable to migrate the data from `shadowLastChange` to `pwdChangedTime`. In particular, once I have the desired value for `pwdChangedTime`, I don't know how to write it into the attribute. ldap_modify: Constraint violation (19) additional info: pwdChangedTime: no user modification allowed I read something about "relax rules" and oid `1.3.6.1.4.1.4203.666.5.12`, but I haven't figured out how to use it. How do I execute an `ldapmodify` that writes into `pwdChangedTime`? ~jonathon

2 2

smbldap-populate error
by Adrián Arévalo Tirado 17 Jan '12

17 Jan '12

OpenLDAP version: 2.4.23-7.2 Samba Version: 2:3.5.6 Operating System Debian 6.0 "Squeeze" Hello everybody. I'm trying to install a Samba + LDAP PDC but when I try to create the database with smbldap-populate I get this error: -------------------------------------------------------------------------------- Populating LDAP directory for domain empresa (S-1-5-21-802753395-3202467916-1484007712) (using builtin directory structure) entry dc=empresa,dc=com already exist. entry ou=Users,dc=empresa,dc=com already exist. entry ou=Groups,dc=empresa,dc=com already exist. entry ou=Computers,dc=empresa,dc=com already exist. entry ou=Idmap,dc=empresa,dc=com already exist. adding new entry: uid=root,ou=Users,dc=empresa,dc=com failed to add entry: objectClass: value #4 invalid per syntax at /usr/sbin/smbldap-populate line 498, <GEN1> line 58. adding new entry: uid=nobody,ou=Users,dc=empresa,dc=com failed to add entry: objectClass: value #4 invalid per syntax at /usr/sbin/smbldap-populate line 498, <GEN1> line 89. adding new entry: cn=Domain Admins,ou=Groups,dc=empresa,dc=com failed to add entry: objectClass: value #2 invalid per syntax at /usr/sbin/smbldap-populate line 498, <GEN1> line 101. adding new entry: cn=Domain Users,ou=Groups,dc=empresa,dc=com failed to add entry: objectClass: value #2 invalid per syntax at /usr/sbin/smbldap-populate line 498, <GEN1> line 112. adding new entry: cn=Domain Guests,ou=Groups,dc=empresa,dc=com failed to add entry: objectClass: value #2 invalid per syntax at /usr/sbin/smbldap-populate line 498, <GEN1> line 123. adding new entry: cn=Domain Computers,ou=Groups,dc=empresa,dc=com failed to add entry: objectClass: value #2 invalid per syntax at /usr/sbin/smbldap-populate line 498, <GEN1> line 134. adding new entry: cn=Administrators,ou=Groups,dc=empresa,dc=com failed to add entry: objectClass: value #2 invalid per syntax at /usr/sbin/smbldap-populate line 498, <GEN1> line 179. adding new entry: cn=Account Operators,ou=Groups,dc=empresa,dc=com failed to add entry: objectClass: value #2 invalid per syntax at /usr/sbin/smbldap-populate line 498, <GEN1> line 201. adding new entry: cn=Print Operators,ou=Groups,dc=empresa,dc=com failed to add entry: objectClass: value #2 invalid per syntax at /usr/sbin/smbldap-populate line 498, <GEN1> line 212. adding new entry: cn=Backup Operators,ou=Groups,dc=empresa,dc=com failed to add entry: objectClass: value #2 invalid per syntax at /usr/sbin/smbldap-populate line 498, <GEN1> line 223. adding new entry: cn=Replicators,ou=Groups,dc=empresa,dc=com failed to add entry: objectClass: value #2 invalid per syntax at /usr/sbin/smbldap-populate line 498, <GEN1> line 234. adding new entry: sambaDomainName=empresa,dc=empresa,dc=com failed to add entry: invalid DN at /usr/sbin/smbldap-populate line 498, <GEN1> line 242. Please provide a password for the domain root: /usr/sbin/smbldap-passwd: user root doesn't exist ---------------------------------------------------------------------------------- In the log file I get this other error: ---------------------------------------------------------------------------------- slapd[1369]: conn=1005 op=28 do_search: invalid dn: "sambaDomainName=empresa,dc=empresa,dc=com" slapd[1369]: conn=1005 op=29 do_add: invalid dn (sambaDomainName=empresa,dc=empresa,dc=com) ---------------------------------------------------------------------------------- I included in slapd.conf the samba.schema. Any ideas? I've been looking for any solution for 4 days and nobody seems to know anything. Thanks in advance for the responses. -- Adrian <adri58(a)gmail.com>

4 5

The problem of BINDDN/BINDPW in ldap.conf
by Tianyin Xu 17 Jan '12

17 Jan '12

Hi, all, I'm using Ubuntu 10.04 and LDAP 2.4.23. I'm having difficulty with the basic binding. I don't want to allow anonymous ldapsearch on the LDAP server so I specify a dn and password for the bind. If I use the following parameters for ldapsearch like ldapsearch -b "dc=ucsd,dc=edu" -D "cn=admin,dc=ucsd,dc=edu" -w 1234 This works quite fine. Then, I write the parameters into ldap.conf as follows: -----------------ldap.conf----------------------- BASE dc=ucsd,dc=edu BINDDN cn=admin,dc=ucsd,dc=edu BINDPW 12345 ----------------------------------------------------- Then only BASE has effect. According to the ldap.conf manual, BINDDN is a "user-only" attribute and needs to go in ~/.ldaprc; it doesn't mention BINDPW at all. But searching on the web, I found several cases that used "binddn" and "bindpw" in ldap.conf and worked successfully. So I'm quite confused for these two directives. Could anyone explain a little bit to me on BINDDN and BINDPW? Thanks a lot!! Tianyin -- Tianyin XU, http://cseweb.ucsd.edu/~tixu/

3 3

Extending smbk5pwd overlay
by Clément OUDOT 16 Jan '12

16 Jan '12

Hello, I am interested in extending the features of smbk5pwd overlay to manage more password mechanisms: * Digest MD5 for authentication (see http://en.wikipedia.org/wiki/Digest_access_authentication): we will have MD5(user:domain:password), with configuration for user attribute to use and the domain string * Active Directory password: will use the syntax of AD unicodePwd, in order to sync the attribute into AD Are you interested by adding these features in the current smbk5pwd overlay or do you prefer that we create new overlay(s) for this? Another question: would you accept an option on the smbk5pwd overlay so it can be triggered by simple userPassword modifications instead of only extended password modification operation? Regards, Clément OUDOT.

3 2

Heavy load problems
by Angel L. Mateo 16 Jan '12

16 Jan '12

Hello, We have a openldap (2.3.30, debian etch version 32bits) with 4 nodes (xen vm with one cpu core, Intel Xeon 3.20GHz and 2GB of RAM). It that farm we have two databases one with 121K entries (for authenticating users, with lots of connections) and other with 40K entries (with public information of our students, for example). Now we have migrated to two openldap (2.4.21, ubuntu lucid 64btis) farms. One with 4 nodes (xen vm with two cpu cores, Xeon E5450 3GHz, 2 GB of RAM) for the authentication database, and other with 2 nodes (with the same resources than the other) for the other database. The problem is that in the authentication farm we are having lot of problems due to heavy load, although we are not completely migrate all clients to this new farm (we already have clients querying the old farm), but in the old farm we didn't have any problem (just some punctual problems long time ago). The only difference between the old and the new farm is that the old farm was replicating information with slurpd. The new one is a multimaster configuration. The configuration of the replica is: mirrormode on syncrepl rid=11 provider="ldap://<server1>.um.es" binddn="<replica user dn>" bindmethod=simple credentials=<creds> searchbase="<base of database>" type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 +" timeout=1 syncrepl rid=12 provider="ldap://<server2>.um.es" binddn="<replica user dn>" bindmethod=simple credentials=<creds> searchbase="<base of database>" type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 +" timeout=1 syncrepl rid=13 provider="ldap://<server3>.um.es" binddn="<replica user dn>" bindmethod=simple credentials=<creds> searchbase="<base of database>" type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 +" timeout=1 syncrepl rid=14 provider="ldap://<server4>.um.es" binddn="<replica user dn>" bindmethod=simple credentials=<creds> searchbase="<base of database>" type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 +" timeout=1 This configuration is in the 4 farm nodes. We have checked indexes and both farms have the same. Another difference is that authentication database entries have some attributes obtained from the other database via dynlist overlay. In the old farm, because the two databases are in the same server we had no problem, but in the new one we have to configure this database as an ldap proxy to the other farm, with cache overlay used in this. Heavy loads appears randomly in all nodes (not always with all nodes at the same time). When this happens, slapd is using 100% (well... top reports 200% because we have two cpus), there is no swap, no iowait.... Any idea of what could it be the problem? Is this multimaster configuration so heavy load? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 868887590 Fax: 868888337

3 4

OpenLDAP 2.4.28 causing Apache 2.2 to hang
by Kyle Smith 16 Jan '12

16 Jan '12

I recently upgraded OpenLDAP 2.4.26 to 2.4.28. When I did that, a separate server running apache 2.2 and php 5 started to hang every 10-15 minutes. It freezes to the point that it no longer accepts requests. This apache server is using a wildcard cert for https and uses php5-ldap which depends on libgnutls26 and libldap2.4-2. I am currently investigating further, but was wondering if the changes to MozNSS or GNUTls in 2.4.27 (ITS #7051, 6980, 6998, 7001, 7002, 7022, 7034 & 7006) may be interfering with apache. I don't think OpenLDAP is the cause, I am leaning towards an apache/php configuration error but the problem only occurs when I use 2.4.28. OpenLDAP 2.4.26 operates normally and is stable across the board. Any ideas? ldapsearch -H ldaps://ldap.my.com works fine, no errors with connecting or searching.

2 2

Syncrepl: consumer ignores bindmethod=sasl
by Tim Dijkstra 15 Jan '12

15 Jan '12

Hi All, I'm trying to get syncrepl to work with TLS, and SASL External. I think I configured everything correctly; I explicitly state it should use bindmethod=sasl, but in the logs I see it is using simple nonetheless. Replication subsequently fails because lack of access rights. Using ldapsearch with identical setting in .ldaprc works... I'm at a loss. Anybody knows what is going on? Excerpt from slapd.conf of consumer: syncrepl rid=13 provider=ldaps://example.org:636 type=refreshAndPersist interval=00:00:30:00 searchbase="ou=People,dc=example,dc=org" scope=sub bindmethod=sasl saslmech=EXTERNAL schemachecking=off authcid=cn=kelderlied,ou=hosts,o=example authzid=cn=kelderlied,ou=hosts,o=example tls_cacert=/etc/ldap/trusted/ca.drs.p-cacert_root_3.pem tls_cert /etc/ssl/CA/kelderlied.crt tls_key /etc/ssl/CA/kelderlied.key tls_reqcert=demand starttls=critical When Syncrepl from the consumer is started in the logs of the provider I see: > ACCEPT from IP=A.B.C.D:55428 (IP=0.0.0.0:636) > TLS established tls_ssf=128 ssf=128 > BIND dn="" method=128 > conn=1099 op=0 RESULT tag=97 err=0 text= > SRCH BASE..... So, TLS is successful (I have TLS_REQ = demand on the provider), but bind simple is requested Here I do a search by hand with identical settings in my .ldaprc that succeeds > ldapsearch -H ldaps://example.org:636 -Y EXTERNAL -b "ou=people,dc=example,dc=org" "(objectClass=*)" > In the logs: > ACCEPT from IP=A.B.C.D:55434 (IP=0.0.0.0:636) > TLS established tls_ssf=128 ssf=128 > BIND dn="" method=163 > BIND authcid="cn=kelderlied,ou=hosts,o=example" authzid="cn=kelderlied,ou=hosts,o=example" > BIND dn="cn=libnss,dc=example,dc=org" mech=EXTERNAL sasl_ssf=0 ssf=128 > RESULT tag=97 err=0 text= > Any help is appreciated... Tim

1 0

what is the pretty function and the validate function in OpenLDAP?
by Tianyin Xu 14 Jan '12

14 Jan '12

Hi, all, I'm trying to understand the internal workflow of the attribute type checking and syntax validation in OpenLDAP. For example, if I use an attribute whose syntax is not implemented like "presentationAddress", the log message "no validator for syntax" will occur. I trace this message in the source code and find this's done by checking "pretty" and "validate", as follows: -------------------------------------servers/slapd/modify.c-------------------------------- slap_syntax_validate_func *validate = ad->ad_type->sat_syntax->ssyn_validate; slap_syntax_transform_func *pretty = ad->ad_type->sat_syntax->ssyn_pretty; if( !pretty && !validate ) { *text = "no validator for syntax"; snprintf( textbuf, textlen, "%s: no validator for syntax %s", ml->sml_type.bv_val, ad->ad_type->sat_syntax->ssyn_oid ); *text = textbuf; return LDAP_INVALID_SYNTAX; } ----------------------------------------------------------------------------------------------------- Moreover, the pretty function and validate function are treat differently in the latter code like: if ( pretty ) { rc = ordered_value_pretty( ad, &ml->sml_values[nvals], &pval, ctx ); // wrapper for pretty function } else { rc = ordered_value_validate( ad, &ml->sml_values[nvals], ml->sml_op ); // wrapper for validate function } I'm very confused on the "pretty" function and the "validate" function. I tried to google but no related results. Could anyone tell me WHAT is the pretty function and what is the validate function? And HOW can OpenLDAP knows which function is pretty and which is validate? Sorry for the newbie question. Thanks a lot!!! Best, Tianyin -- Tianyin XU, http://cseweb.ucsd.edu/~tixu/

3 2

View or filter based on ldaps://FQDN
by Ronie Gilberto Henrich 14 Jan '12

14 Jan '12

Hello, I need to be able to restrict ldap ou's access based on the ldaps://FQDN used to query the ldap server. Let say I have the following in my ldap server: ou=domain ou=raincoatcompany.com ou=umbrellacompany.com Considering that both ldap.raincoatcompany.com and ldap.umbrellacompany.com are resolving to IP address 10.0.0.10 So, querying the ldap server using ldaps://ldap.raincoatcompany.com/ou=domain should grant access only to the following: ou=domain ou=raincoatcompany.com Is there any way to accomplish that with OpenLDAP? Thanks, -- *Ronie Henrich* *GIT - Sistemas Ltda* <http://www.git.com.br> Novo Hamburgo, RS Brazil <http://maps.google.com/maps?q=%2CNovo+Hamburgo%2CRS%2CBrazil&hl=en> *http://br.linkedin.com/in/roniegh* See who we know in common <http://www.linkedin.com/e/wwk/11684020/>

5 7

Password Policy pwdFailureTime count limits?
by Jeffrey Crawford 14 Jan '12

14 Jan '12

Hello Everyone, I'm having trouble enforcing our password policy for login attempts within a particular time frame. After looking into the issue a little further it seems to stem from the fact that the operational attribute pwdFailureTime can only resolve time down to the second. so if there are three Bind attempts within a single second we only get a single pwdFailureTime entry for that time. Our policy is geared more to try and prevent brute force attacks since this instance of the ldap server will be available publicly. However someone can continuously try to bind and not lock the account for as many seconds as is defined in the pwdMaxFailure attribute in the policy definition. For example: if the following account locking configs are set pwdMaxFailure: 10 pwdFailureCountInterval: 3600 pwdLockout: TRUE pwdLockoutDuration: 30 If I try to lock my account by providing the incorrect credentials 11 times, it didn't lock if my 11 attempts were shorter than 10 seconds, I then tried 100 in a for loop which finished in 7 seconds, it still didn't lock. I looked at the account and counted the number of pwdFailureTime's and found 7. I then place a one second sleep between each bad bind attempt and low an behold it would lock as expected. Therefore there seems to be a limitation of pwdFailureTime to only resolve down to the second and its inability to store the same time multiple times. I'm not sure if this is expected behavior, but it makes locking policies against brute force attacks more difficult to fend against. I did a quick look to see if there was a way of delaying a incorrect credential bind so it wouldn't return for at least a second, but didn't see one. If such a config exists it might help if someone can point me to it. Thanks Jeffrey Crawford

2 1

Changing ACLs in dynamic configuration off-line
by Nick Milas 13 Jan '12

13 Jan '12

When we want to do some non-trivial re-engineering in ACLs, on-line configuration using ldapmodify might be cumbersome. So I think we could slapcat the config database, change ACLs in the output, and slapadd it while the server is offline. So, if we have a set of >100 ACL rules and we want to add one ACL rule after, say, 22, would we have to *manually* renumber all the ACLs after the new 23 so that they are numbered n+1? Or, when the config db is read, is OpenLDAP able to resolve such conflicts (two ACLs with the same number) and renumber automatically? If so, what is the logic? (Maintenance of ACLs in the dynamic configuration remains one of my concerns.) Thanks, Nick

2 1

Bind with alternative DN pattern
by Mathias 13 Jan '12

13 Jan '12

Hi, I have trouble understanding a rather simple LDAP config issue that I'm sure someone on this list can easily help with: How do I add a (or change the) pattern of the bind DN that slapd lets me authenticate with? I have a working slapd setup that I can happily bind to using DNs of the form "cn=Bob Parr,dc=example,dc=com". However, all accounts also have a unique "uid" attribute that I would like to use in addition to (or, if not possible, instead of) the "cn"-based RDN for binding. So, I'd like to (also) bind using the DN "uid=bob,dc=example,dc=com". My understanding is that one entry can have several DNs as long as each one is unambiguous. Shouldn't I be able to bind with anyone of these? I have spent hours on searching for documentation on this and turned up surprisingly little. The problem is not an ACL issue since the logged error when trying a "uid"-based bind is "DB_NOTFOUND: No matching key/data pair found" rather than anything else... I'd be _very_ grateful for any pointers on this... Cheers, Mathias

4 3

RE: How to check syncrepl?
by Juergen.Sprenger＠swisscom.com 13 Jan '12

13 Jan '12

Hi Marco, depending on Your needs this page might help: http://itsecureadmin.com/wiki/index.php/LDAP_Synchronization_Replication http://itsecureadmin.com/wiki/index.php/OpenLDAP_syncrepl_check Regards Jürgen

2 1

openldap admin guide and 'slapd from scratch'
by Stefan Skoglund 13 Jan '12

13 Jan '12

Howdy. I wonder if the ldif sample example the end of chapter 5 is correct ? See below: ---- 1. # example config file - global configuration entry 2. dn: cn=config 3. objectClass: olcGlobal 4. cn: config 5. olcReferral: ldap://root.openldap.org 6. Line 1 is a comment. Lines 2-4 identify this as the global configuration entry. The olcReferral: directive on line 5 means that queries not local to one of the databases defined below will be referred to the LDAP server running on the standard port (389) at the host root.openldap.org. Line 6 is a blank line, indicating the end of this entry. 7. # internal schema 8. dn: cn=schema,cn=config 9. objectClass: olcSchemaConfig 10. cn: schema 11. Line 7 is a comment. Lines 8-10 identify this as the root of the schema subtree. The actual schema definitions in this entry are hardcoded into slapd so no additional attributes are specified here. Line 11 is a blank line, indicating the end of this entry. 12. # include the core schema 13. include: file:///usr/local/etc/openldap/schema/core.ldif 14. Line 12 is a comment. Line 13 is an LDIF include directive which accesses the core schema definitions in LDIF format. Line 14 is a blank line. Next comes the database definitions. The first database is the special frontend database whose settings are applied globally to all the other databases. 15. # global database parameters 16. dn: olcDatabase=frontend,cn=config 17. objectClass: olcDatabaseConfig 18. olcDatabase: frontend 19. olcAccess: to * by * read 20. Line 15 is a comment. Lines 16-18 identify this entry as the global database entry. Line 19 is a global access control. It applies to all entries (after any applicable database-specific access controls). Line 20 is a blank line. The next entry defines the config backend. 21. # set a rootpw for the config database so we can bind. 22. # deny access to everyone else. 23. dn: olcDatabase=config,cn=config 24. objectClass: olcDatabaseConfig 25. olcDatabase: config 26. olcRootPW: {SSHA}XKYnrjvGT3wZFQrDD5040US592LxsdLy 27. olcAccess: to * by * none 28. Lines 21-22 are comments. Lines 23-25 identify this entry as the config database entry. Line 26 defines the super-user password for this database. (The DN defaults to "cn=config".) Line 27 denies all access to this database, so only the super-user will be able to access it. (This is already the default access on the config database. It is just listed here for illustration, and to reiterate that unless a means to authenticate as the super-user is explicitly configured, the config database will be inaccessible.) ----- The trouble i had is regarding the olcDatabase=frontend and olcDatabase=config stanzas. slapadd could do its work but the layout in cn=config/ would look like this afterwards: ----- olcDatabase=frontent.ldif olcDatabase=config.ldif olcDatabase=hdb.ldif ----- And as soon as slapd started an extraneous ghostly olcDatabase={-1}frontend.ldif would show up. I had to instantiate the frontend and config as this. --- dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig olcDatabase: {-1}frontend --- and ---- dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config ---- Which works for me.

1 0

Modify or add information after conversion of slapd.conf to cn=config with fresh install of OpenLdap
by rey sebastien 13 Jan '12

13 Jan '12

Hi! I start with a fresh installation of openldap 2.4.28 on debian. They are some problem with the debian package, and with gnuTLS, so i compile a version with opennSSL library. It's hard to understand with the official documentation how to start a from scratch installation with the new cn=config administration of openLDAP. So, i make a conversion ( with the great help of users on this mailling list ) from slapd.conf to cn=config on the first launch of openLDAP with this commands : |/usr/local/libexec/slapd -u openldap -g openldap -f slapd.conf.seb -F /usr/local/etc/openldap/slapd.d/ -d -1 | My slapd.conf.seb, really simple, equal : |include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/nis.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/openldap.schema include /usr/local/etc/openldap/schema/misc.schema include /usr/local/etc/openldap/schema/ppolicy.schema include /usr/local/etc/openldap/schema/gosa/samba3.schema include /usr/local/etc/openldap/schema/gosa/trust.schema include /usr/local/etc/openldap/schema/gosa/gofax.schema include /usr/local/etc/openldap/schema/gosa/gofon.schema include /usr/local/etc/openldap/schema/gosa/gosystem.schema include /usr/local/etc/openldap/schema/gosa/goto-mime.schema include /usr/local/etc/openldap/schema/gosa/goto.schema include /usr/local/etc/openldap/schema/gosa/goserver.schema include /usr/local/etc/openldap/schema/gosa/gosa-samba3.schema include /usr/local/etc/openldap/schema/gosa/openssh-lpk.schema include /usr/local/etc/openldap/schema/gosa/dnszone.schema include /usr/local/etc/openldap/schema/gosa/nagios.schema include /usr/local/etc/openldap/schema/gosa/dhcp.schema include /usr/local/etc/openldap/schema/gosa/sudo.schema pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args database bdb suffix "dc=parisgeo,dc=cnrs,dc=fr" rootdn "cn=admin,cn=config,dc=parisgeo,dc=cnrs,dc=fr" rootpw {SSHA} secret directory /srv/openldap-data index objectClass eq | I have no problem with this simple conversion, but after that, it's impossible to import data with this command ldapadd or ldapmodify. I don't understand the default right for read/write for openLDAP, i try with ldapmodify, with bind and password, and i have the same problem : || |root@xxxx:/usr/local/etc/openldap# ldapadd -x -D "cn=admin,cn=config,dc=parisgeo,dc=cnrs,dc=fr" -W -f sauvegarde.ldif Enter LDAP Password: xxx adding new entry "cn=admin,dc=parisgeo,dc=cnrs,dc=fr" ldap_add: Constraint violation (19) additional info: structuralObjectClass: no user modification allowed | I try to modify the right for cn=config with this sample : |dn: olcDatabase={-1}frontend,cn=config changetype: modify delete: olcAccess dn: olcDatabase={0}config,cn=config changetype: modify add: olcRootDN olcRootDN: cn=admin,cn=config dn: olcDatabase={0}config,cn=config changetype: modify add: olcRootPW olcRootPW: {SSHA} secret dn: olcDatabase={0}config,cn=config changetype: modify delete: olcAccess ldapadd -Y EXTERNAL -H ldapi:/// -f slapd.modify.root.ldif | Same problem, i have no right todo that, with or without option the password entry -W or bind option -D "cn=config,cn=admin,dc=parisgeo,dc=cnrs,dc=fr" |root@xxxx:/usr/local/etc/openldap# ldapadd -Y EXTERNAL -H ldapi:/// -f slapd.modify.root.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "olcDatabase={-1}frontend,cn=config" ldap_modify: Insufficient access (50) root@xxxx:/usr/local/etc/openldap# ldapadd -x -W -H ldapi:/// -f slapd.modify.root.ldif Enter LDAP Password: ldap_bind: Invalid credentials (49) root@xxxxx:/usr/local/etc/openldap# ldapadd -D "cn=config,cn=admin,dc=parisgeo,dc=cnrs,dc=fr" -W -Y EXTERNAL -H ldapi:/// -f slapd.modify.root.ldif Enter LDAP Password: SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "olcDatabase={-1}frontend,cn=config" ldap_modify: Insufficient access (50)| Anybody have this problem in the past, and have an idea of the solution to create a good start configuration from scratch installation ? Do you think there is mistake in my simple installation/configuration ? I also create a post on serverFault.Com site, but i have no answer at this time http://serverfault.com/questions/342086/impossible-to-modify-or-add-informa… Best regards, SR

3 3

RE: OpenLDAP replciation issue with MirrorMode
by ZHOU Eric JP 13 Jan '12

13 Jan '12

Dear OpenLDAP Administrators, Not sure if you get time to look into this issue yet. This issue only happens when power-off/power cut-off one of the mirror servers, and could be probably prevented by “sending heart beat” to verify the established connections. Thanks for your time looking at this email thread and your effort :) Thanks, Eric ________________________________ From: owner-qdlcp-security(a)LIST.ALCATEL-LUCENT.COM [mailto:owner-qdlcp-security@LIST.ALCATEL-LUCENT.COM] On Behalf Of ZHOU Eric JP Sent: 2012年1月4日 15:56 To: openldap-bugs(a)openldap.org; info(a)OpenLDAP.org; openldap-technical(a)openldap.org; openldap-devel(a)openldap.org Cc: qdlcp-security(a)list.alcatel-lucent.com; ANTHONY Michael; HO Yao; VAN RANGELROOIJ Ardo Subject: OpenLDAP replciation issue with MirrorMode Dear OpenLDAP Administrators, Recently we come across an OpenLDAP replication issue with OpenLDAP Mirror Mode. After configuring MIRROR-A and MIRROR-B in mirror mode with below configuration, it worked pretty well for a long period. But an issue comes up after MIRROR-A reboot, MIRROR-B could not get modification from MIRROR-A any more. After investigating the issue we find the original socket on MIRROR-B (consumer) is not reconnected. ==================================== ## MIRROR-A ---------------------------------------------------------------------- ## ---------------------------------------------------------------------- serverID 1 ## Consumer syncrepl rid=001 provider=ldap://10.207.131.1:389 bindmethod=simple binddn="uid=PrivDirUsr,o=CSOSSO" credentials=mypassword searchbase="o=CSOSSO" schemachecking=on type=refreshAndPersist interval=00:00:01:00 retry="10 +" mirrormode on ## MIRROR-A ---------------------------------------------------------------------- ## ---------------------------------------------------------------------- serverID 2 ## Consumer syncrepl rid=001 provider=ldap://10.207.130.1:389 bindmethod=simple binddn="uid=PrivDirUsr,o=CSOSSO" credentials=mypassword searchbase="o=CSOSSO" schemachecking=on type=refreshAndPersist interval=00:00:01:00 retry="10 +" mirrormode on Below is the socket information after MIRROR-A reboot, ==================================== ## MIRROR-A ---------------------------------------------------------------------- # lsof -i :389 | grep ldap | grep -v sshd | grep -v localhost | grep 10 slapd 16842 root 14u IPv4 36160 TCP ln007-cnfg-p00m000-d0:51114->10.207.131.1:ldap (ESTABLISHED) ## MIRROR-B ---------------------------------------------------------------------- # lsof -i :389 | grep ldap | grep -v sshd | grep -v localhost | grep 10 slapd 4825 root 14u IPv4 168497 TCP ln007-cnfg-p00m001-d0:52239->10.207.131.0:ldap (ESTABLISHED) slapd 4825 root 18u IPv4 193403 TCP ln007-mi-p00m001-d0:ldap->10.207.130.0:51114 (ESTABLISHED) Normally it should be, ## MIRROR-A ---------------------------------------------------------------------- # lsof -i :389 | grep ldap | grep -v sshd | grep -v localhost | grep 10 slapd 16842 root 14u IPv4 36160 TCP ln007-cnfg-p00m000-d0:51114->10.207.131.1:ldap (ESTABLISHED) slapd 4825 root 18u IPv4 193403 TCP ln007-mi-p00m000-d0:ldap->10.207.130.1: 52239 (ESTABLISHED) // This link is missing ## MIRROR-B ---------------------------------------------------------------------- # lsof -i :389 | grep ldap | grep -v sshd | grep -v localhost | grep 10 slapd 4825 root 14u IPv4 168497 TCP ln007-cnfg-p00m001-d0:52239->10.207.131.0:ldap (ESTABLISHED) slapd 4825 root 18u IPv4 193403 TCP ln007-mi-p00m001-d0:ldap->10.207.130.0:51114 (ESTABLISHED) I would greatly apreicate if you could provide some suggestions/comments upon this or improve OpenLDAP functionality to avoid this. For me I think this is normal TCP server down scenario, but probably you people could prohibit this from happening in below two methods? 1. Let OpenLDAP send mutual heart beat so that client knows when server is dead. 2. Let OpenLDAP send message to all its client when it is dying (e.g. receiving SIGTERM) // this does not work when MIRROR-A power cycle. Sincerely, Eric Zhou Jianping P please save a tree by not printing this e-mail. ________________________________ To unsubscribe: qdlcp-security-unsubscribe-request(a)list.alcatel-lucent.com<mailto:qdlcp-security-unsubscribe-request@list.alcatel-lucent.com>

5 4

Copy ldap to another with different schema
by rey sebastien 13 Jan '12

13 Jan '12

Hi, I have two ldap, one full of users, with gosa open source project specific schema (https://oss.gonicus.de/labs/gosa), and one which is empty, without this schema. I want to make a clean copy of my users into the first ldap to the second ldap, because my version of gosa installed is not functionnal :-/ Is it possible with slapcat to extract only useful information (so information without gosa schema information) ? Is there any solution to resolve this use case ? Thanks a lot, Best regards, SR

1 0

Interacting with LDAP via Python module
by Munroe Sollog 13 Jan '12

13 Jan '12

I'm experimenting with Python and its ability to interact with ldap. I wrote a program that is taking a DiT from one server and altering it a bit and writing to another server: http://bpaste.net/show/3nd2N4jQqNIHbPMKbgkb/ The error is at the bottom of the pastebin, I'm not really sure where the problem is.

3 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical