- openldap-technical - openldap.org

How to check syncrepl?
by Marco Weber 12 Jan '12

12 Jan '12

Hi, We have a MirrorMode replication setup that uses openldap's syncrepl. The HA setup seems work fine with pacemaker. Now i would like to setup a nagios check for the replication. But before i can do that, i've got a simple question: How can i poll the replication status? Thanks in advance for any reply, Marco

2 1

Disabling SASL auth at server side
by Angel L. Mateo 12 Jan '12

12 Jan '12

Hello, I have an application I need to authenticate in my LDAP server. The problem I have is that this application is trying to authenticate its user (to search for user DNs) with SASL although I haven't configured SASL in my LDAP server. More detailed, the application does: * First, it checks for supported mechanisms with a search like: Jan 11 12:13:28 canis13 slapd[22380]: conn=41690 op=0 SRCH base="" scope=0 deref=0 filter="(objectClass=*)" Jan 11 12:13:28 canis13 slapd[22380]: conn=41690 op=0 SRCH attr=supportedSASLMechanisms Jan 11 12:13:28 canis13 slapd[22380]: conn=41690 op=0 SEARCH RESULT tag=101 err=0 nentries=1 text= * This search gets supportedSASLMechanisms: CRAM-MD5 supportedSASLMechanisms: DIGEST-MD5 supportedSASLMechanisms: NTLM * Then it tries to bind using a SASL mechanism that I haven't configured. With older version of openldap (2.3.30, debian etch version) I didn't have any problem because this search returns no result. Now I'm using openldap 2.4.21 (ubuntu lucid version) and I get this behaviour. Is there any way to configure the openldap server to disable this mechanisms?, because I don't want any sasl authentication. -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 868887590 Fax: 868888337

4 3

OpenLDAP Meta-Backend & Active Directory
by Seale, Ryan 10 Jan '12

10 Jan '12

I'm running OpenLDAP 2.3.43 and have a copy of OpenLDAP 2.4 installed on another server to test with. I'm not sure which is better for this. I'm trying to simplify LDAP structure and group authorized users into a few sub-OUs and have decided that OpenLDAP and a meta-backend is the way to proxy AD. My problem is I'm hitting some snags and need some help from an expert. Our AD users are structured as ou=employees,dc=org,dc=com and ou=clients,dc=org,dc=com. I basically just want to proxy them to be: ou=employees,ou=users,O=org and ou=clients,ou=users,o=org and move away from the dc naming convention for clarification of which system we're authenticating to. # settings for clients database meta suffix "ou=clients,dc=org,dc=com" subordinate uri "ldap://ldap/ou=clients,dc=org,dc=com" suffixmassage " ou=clients,dc=org,dc=com" "ou=clients,ou=Users,o=org" rewriteEngine on RewriteRule "sAMAccountName=(.*)ou=clients,dc=org,dc=com$" "%1ou=clients,ou=Users,o=org" ":" rebind-as-user true chase-referrals yes # settings for employees database meta suffix "ou= employees,dc=org,dc=com" subordinate uri "ldap://ldap/ou= employees,dc=org,dc=com" suffixmassage " ou= employees,dc=org,dc=com" "ou= employees,ou=Users,o=org" rewriteEngine on RewriteRule "sAMAccountName=(.*)ou= employees,dc=org,dc=com$" "%1ou= employees,ou=Users,o=org" ":" rebind-as-user true chase-referrals yes #primary database meta suffix "dc=org,dc=com" uri "ldap://jcdc1.etsu.edu/dc=org,dc=com" suffixmassage "dc=org,dc=com" "ou=Users,o=org" rewriteEngine on RewriteRule "sAMAccountName=(.*)dc=org,dc=com$" "%1ou=Users,o=org" ":" rebind-as-user true chase-referrals yes I also have a local bdb database for o=org. I can connect to the ldap server using a local account that exists in the bdb database, but cannot connect as a user that exists in the proxied ldaps. For example, if I pass credentials of cn=user,ou=employees,ou=users,o=org....I get auth failures. Can anyone shed a little light on the subject? In testing, I was able to struggle and get a similar configuration working with an ldap backend, but it wouldn't allow me to connect to more than one container and I wasn't willing to do a blanket LDAP search. Thanks, -Ryan

1 0

Implementing password policy
by Laurent CARON 10 Jan '12

10 Jan '12

Hi, I'm currently implementing a password policy on my openldap directory. Most of it is working (password length, password history). I just can't make the account lockout work. The attribute pwdAccountLockedTime is never created in my directory. Entries used for the test: dn: cn=lcaron_99,ou=ppolicy,dc=local sn: lcaron_99 pwdCheckQuality: 0 pwdMaxFailure: 3 pwdAllowUserChange: TRUE pwdInHistory: 10 pwdLockout: TRUE pwdMinLength: 8 structuralObjectClass: person pwdExpireWarning: 720000 pwdGraceAuthNLimit: 5 cn: lcaron_99 pwdAttribute: userPassword objectClass: pwdPolicy objectClass: person objectClass: top pwdMaxAge: 10 pwdFailureCountInterval: 1200 pwdLockoutDuration: 3600 modifyTimestamp: 20120106194803Z dn: uid=lcaron_99,ou=People,dc=local objectClass: top objectClass: inetOrgPerson objectClass: posixAccount objectClass: sambaSamAccount cn: lcaron_99 sn: lcaron_99 uid: lcaron_99 uidNumber: 4082 gidNumber: 513 homeDirectory: /home/lcaron_99 loginShell: /bin/bash ...samba attributes snipped ... userPassword:: ...snipped... pwdPolicySubentry: cn=lcaron_99,ou=ppolicy,dc=local pwdChangedTime: 20120106193917Z structuralObjectClass: inetOrgPerson creatorsName: cn=admin,dc=local createTimestamp: 20120106193917Z pwdFailureTime: 20120106193928Z pwdFailureTime: 20120106194040Z entryCSN: 20120106194040.970726Z#000000#000#000000 modifiersName: modifyTimestamp: 20120106194040Z in slapd.conf: # Password Policy overlay ppolicy Did I miss something obvious ? Thanks

3 5

pam_check_host_attr
by Michael Starling 10 Jan '12

10 Jan '12

I'm unable to get host checking to work. I have followed what I think are the correct steps but I still get "Access denied for this host" when I specify a server or the * wildcard for all servers. The hostname command returns cadb5 so host lookups are working. Do you actually need a full blown DNS solution rather than host files to get this working? RHEL 5.5 openldap-2.3.43-12.el5_6.7 nss_ldap-253-37.el5_6.1 /etc/openldap/slapd.conf include /etc/openldap/schema/ldapns.schema /etc/ldap.conf pam_check_host_attr yes The users account has the hostObject class and the host attribute: dn: uid=testuser,ou=admins,ou=ORG,ou=people,dc=test,dc=lott objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount objectClass: sambaSamAccount objectClass: hostObject cn: testuser sn: testuser givenName: testuser uid: testuser uidNumber: 1002 gidNumber: 512 homeDirectory: /home/testuser loginShell: /bin/bash gecos: Infrastructure Engineer structuralObjectClass: inetOrgPerson entryUUID: 79bc2d6e-7f0b-1030-9efe-3f6966a39ce0 creatorsName: cn=root,dc=test,dc=lott createTimestamp: 20110929172322Z sambaLogonTime: 0 sambaLogoffTime: 2147483647 sambaKickoffTime: 2147483647 sambaPwdCanChange: 0 displayName: mphan sambaSID: S-1-5-21-590332452-794431873-1853597743-3004 sambaPrimaryGroupSID: S-1-5-21-590332452-794431873-1853597743-512 sambaLogonScript: logon.bat sambaProfilePath: \\FTP3\profiles\testuser sambaHomePath: \\FTP3\testuser sambaHomeDrive: H: sambaLMPassword: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx sambaAcctFlags: [U] sambaNTPassword: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx sambaPwdLastSet: 1326133136 sambaPwdMustChange: 1333909136 userPassword:: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx shadowLastChange: 15348 shadowMax: 90 pwdChangedTime: 20120109181856Z pwdHistory: 20120109181856Z#1.3.6.1.4.1.1466.115.121.1.40#8#{crypt}x host: cadb5 entryCSN: 20120109193817Z#000000#00#000000 modifiersName: uid=ldapmgr,ou=people,dc=test,dc=lott modifyTimestamp: 20120109193817Z Relevant system-auth file: auth required pam_env.so auth sufficient pam_ldap.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth required pam_deny.so account required pam_unix.so broken_shadow account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_ldap.so account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 minlen=8 lcredit=-1 ucredit=-1 dcredit=-1 ocredit=-1 password sufficient pam_unix.so shadow nullok try_first_pass use_authtok password sufficient pam_ldap.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_ldap.so session required pam_mkhomedir.so skel=/etc/skel umask=0027

1 2

How to setup bindmethod=sasl
by Gaurav Gugnani 10 Jan '12

10 Jan '12

Hello All, I need to setup the encrypted password for replicator user in the slapd.conf Currently we have setup the replication process, however it is using: bindmethod=simple credentials=[password] But the requirement is like: that we want to specify encrypted password at credentials column. I know this can be achieved with bindmethod=sasl etc. I tried lot but got stuck with some or the other thing and ends up getting error at last. Can we have some document explaining step-by-step how to achieve it? Or some document putting more light on this issue? Thanks for your support. Regards, Gaurav Gugnani Version of OpenLdap - 2.4.26

1 0

ldif_back_add: err: 68 text:
by Maxim Vetrov 08 Jan '12

08 Jan '12

Hi! Trying to start test server (openldap 2.4.25) on my home box (FreeBSD 8.2 i386) I get this error: ... ldif_back_add: "olcDatabase={0}config,cn=config" oc_check_required entry (olcDatabase={0}config,cn=config), objectClass "olcDatabaseConfig" oc_check_allowed type "objectClass" oc_check_allowed type "olcDatabase" oc_check_allowed type "olcAddContentAcl" oc_check_allowed type "olcLastMod" oc_check_allowed type "olcMaxDerefDepth" oc_check_allowed type "olcReadOnly" oc_check_allowed type "olcRootDN" oc_check_allowed type "olcSyncUseSubentry" oc_check_allowed type "olcMonitoring" oc_check_allowed type "structuralObjectClass" oc_check_allowed type "entryUUID" oc_check_allowed type "creatorsName" oc_check_allowed type "createTimestamp" oc_check_allowed type "entryCSN" oc_check_allowed type "modifiersName" oc_check_allowed type "modifyTimestamp" ldif_back_add: err: 68 text: send_ldap_result: conn=-1 op=0 p=0 send_ldap_result: err=68 matched="" text="" slapd destroy: freeing system resources. slapd stopped. connections_destroy: nothing to destroy. Config I use: # global configuration entry dn: cn=config objectClass: olcGlobal cn: config olcAttributeOptions: x-hidden lang- olcLogLevel: conns config acl # internal schema dn: cn=schema,cn=config objectClass: olcSchemaConfig cn: schema include: file:///usr/local/etc/openldap/schema/core.ldif include: file:///usr/local/etc/openldap/schema/cosine.ldif include: file:///usr/local/etc/openldap/schema/inetorgperson.ldif #include: file:///usr/local/etc/openldap/schema/collective.ldif include: file:///usr/local/etc/openldap/schema/nis.ldif # Load modules for database type dn: cn=module,cn=config objectclass: olcModuleList cn: module olcModulePath: /usr/local/libexec/openldap olcModuleLoad: back_bdb.so # global database parameters dn: olcDatabase=frontend,cn=config objectClass: olcDatabaseConfig objectClass: olcFrontendConfig olcDatabase: frontend olcAccess: to attrs=name;x-hidden by * =cs olcAccess: to attrs=userPassword by * auth olcAccess: to * by * read dn: olcDatabase=config,cn=config objectClass: olcDatabaseConfig olcDatabase: config olcRootPW: {SSHA}PHExDMWET41b/KoOHyTY1finE7Em3Xdo olcAccess: to * by * none # BDB definition for muxas.net dn: olcDatabase=bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: bdb olcSuffix: dc=muxas,dc=net olcDbDirectory: /home/ldap/databases/muxas.net olcRootDN: cn=Administrator,ou=Users,dc=muxas,dc=net olcDbIndex: cn,sn,uid pres,eq,approx,sub olcDbIndex: objectClass eq olcAccess: to attrs=userPassword by self write by anonymous auth by * none olcAccess: to * by self write by * read I'm new to openldap software, so I have no guess what's the reason behind the error. I googled that error 68 means that there is duplicate entry in the DIT but there is no text part in the message so I don't know what entry is causing the error. Any help would be greatly appreciated! Maxim

2 3

OpenLDAP 2.4.28 RPMs for CentOS 5 and CentOS 6
by Clément OUDOT 06 Jan '12

06 Jan '12

Hi, I just published new versions of OpenLDAP 2.4.28 RPMs, for CentOS 5 and CentOS 6, see http://ltb-project.org/wiki/download#openldap They include a new version of init script in which I added two commands: # service slapd backupconfig # service slapd restoreconfig This allows to dump your cn=config, edit it and reload it very quick. Hope it helps, Clément.

1 0

misconfigured read-only replica causes master slapd to crash
by Kevan Carstensen 05 Jan '12

05 Jan '12

Hi, We use a single master and two read-only replicas; we use back-bdb on all systems. Each read-only replica replicates from the master with syncrepl, configured to refreshAndPersist. During a particularly heavy update load recently, replication on one of the read-only replicas started to fail due to a misconfigured DB_CONFIG. The replica wrote the following messages to its log repeatedly: Dec 14 04:01:08 pip-dev slapd[12645]: bdb(dc=csupomona,dc=edu): Lock table is out of available lock entries Dec 14 04:01:08 pip-dev slapd[12645]: => bdb_idl_delete_key: c_get failed: Cannot allocate memory (12) Dec 14 04:01:08 pip-dev slapd[12645]: conn=-1 op=0: attribute "memberUid" index delete failure Dec 14 04:01:08 pip-dev slapd[12645]: null_callback : error code 0x50 Dec 14 04:01:08 pip-dev slapd[12645]: syncrepl_entry: rid=001 be_modify failed (80) Dec 14 04:01:08 pip-dev slapd[12645]: do_syncrepl: rid=001 rc 80 retrying as it tried and failed to start replication again. Shortly after, the master slapd crashed, writing nothing to its log indicating why (or even referencing the crash at all). We initially noticed this behavior with a 2.4.26 master and a 2.4.28 read-only replica (we came upon this problem while performing some maintenance, which is why there's a version mismatch). I reproduced the problem on a 2.4.28 master while researching ITS #7113 [1] (which describes this problem more precisely and in more detail). Has anyone else run into this issue? Is there a good way to insulate the master slapd from misconfigured replicas? Our replicas shouldn't break like this (we've tuned our DB_CONFIG to ensure that they don't in the future), and hopefully slapd can be modified so that the master doesn't crash even if replicas do break, but we'd rather not have to worry about our master crashing if our DB_CONFIG proves inadequate in the meantime. [1] http://www.openldap.org/its/index.cgi/Incoming?id=7113 Thanks for any help, -- Kevan Carstensen <kacarstensen(a)csupomona.edu> Operating Systems Analyst, I&IT Systems, Cal Poly Pomona

3 2

Re: Issue with index in OpenLDAP?
by External Mathieu DEDECKER (CAMPUS) 05 Jan '12

05 Jan '12

Hi Quanah and thank you again for your quick reply, I did not deleted the *.bdb files, but I moved them in a backup folder. My /db folder was empty, but the slapindex command failed because both "dn2id.bdb" and "id2entry.bdb" files was not present. I needed to add them in the /db folder in order to run the slapindex command. Then, all index have been re-generated. After the reindexation, the "cardnumber.bdb" file had the same size than before. Could you confirm me that it's the best process to reindex an OpenLDAP? Thank you, Mathieu 2012/1/5 Quanah Gibson-Mount <quanah(a)zimbra.com> > Hi Mathieu, > > It sounds like you didn't delete the cardnumber.bdb file before > reindexing? That is what I'd have done. > > Also, you previously had some questions about OpenLDAP tuning. You may > wish to read over <http://wiki.zimbra.com/wiki/** > OpenLDAP_Performance_Tuning<http://wiki.zimbra.com/wiki/OpenLDAP_Performance_Tuning>>. > Some of the bits in there have Zimbra specific names, but they all apply > directly to OpenLDAP and BDB in general. > > --Quanah > > > --On Wednesday, January 04, 2012 2:46 PM +0100 "External Mathieu DEDECKER > (CAMPUS)" <external.z02mdebe(a)oxylane.com**> wrote: > > I will read the man page in order to have more informations about the >> command. >> >> I tried to reindex all the index of the database with the slapindex >> command, but I allways the same behaviour: >> >> Request1: cardnumber=2098001010034 (less than 1sec) >> Request2: cardnumber=2090389917486 (nearly 20 sec). >> >> Other .bdb files size have been updated, but my "cardnumber.bdb" has >> still the same size. >> >> Regards, >> >> Mathieu >> >> >> 2012/1/4 Quanah Gibson-Mount <quanah(a)zimbra.com> >> >> Hi Mathieu, >> >> If you read the slapindex man page, it is possibly to just recreate a >> specific index file (for situations like this), rather than generating >> all of them. >> >> --Quanah >> >> >> --On Wednesday, January 04, 2012 10:39 AM +0100 "External Mathieu >> DEDECKER (CAMPUS)" <external.z02mdebe(a)oxylane.com**> wrote: >> >> >> >> Hello Quanah, >> >> First I would like to thank you for your answer. >> >> Indeed, I also think that the "cardnumber" index is somehow corrupted. >> His size is to small in comparison to other indexes >> >> We suppressed all existing index and Used slapindex to re-create them all. >> >> It's undergoing. >> >> I will keep you informed about the solution. >> >> Best Regards, >> >> Mathieu >> >> >> 2012/1/3 Quanah Gibson-Mount <quanah(a)zimbra.com> >> >> >> >> >> >> --On Friday, December 23, 2011 11:27 AM +0100 "External Mathieu DEDECKER >> (CAMPUS)" <external.z02mdebe(a)oxylane.com**> wrote: >> >> >> Hi @All, >> >> We meet a performance problem with our OpenLDAP. >> >> We think that we face a problem with the index of the database, and we >> think that the problem can be resolve by tunning the config (but not >> sure). >> >> We would like to be sure that our configuration is correct, in order to >> confirm if we are on a wrong track or not. >> >> [Description] >> >> We have an attribute (cardNumber) which is indexed. >> >> When we request the indexed attribute (cardNumber) with an LDAP Client >> (Ldapbrowser), we have either fast or very long response time. >> >> For the long response time, the CPU of the server hits 100%. >> >> For example: >> >> Request1: cardnumber=2098001010034 (less than 1sec) >> Request2: cardnumber=2090389917486 (nearly 20 sec). >> >> By checking the hit ratio of the attribute, we can see that cache is >> correctly used (97%). >> >> >> It sounds like you added an index to cardnumber after there was already >> data for cardnumber in your database, and didn't run slapindex for that >> attribute. Alternatively, your cardnumber.bdb file is corrupted. >> >> --Quanah >> >> >> -- >> >> Quanah Gibson-Mount >> Sr. Member of Technical Staff >> Zimbra, Inc >> A Division of VMware, Inc. >> -------------------- >> Zimbra :: the leader in open source messaging and collaboration >> >> >> >> >> >> >> >> >> >> -- >> >> Quanah Gibson-Mount >> Sr. Member of Technical Staff >> Zimbra, Inc >> A Division of VMware, Inc. >> -------------------- >> Zimbra :: the leader in open source messaging and collaboration >> >> >> > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

problem with authentication to AD server with translucent overlay
by juhlig 05 Jan '12

05 Jan '12

I am using openldap 2.4.23-20 on Centos 6.2 server and trying to configure the translucent overlay to do simple user/password authentication (or anything that works) to our Microsoft AD servers. I can do authenticated commandline ldap searches with a Windows test account and password with no problems. I have tried to build a config based on the examples in the openldap admin and faq-o-matic web pages without success. All I get from the AD servers through my server are anonymous bind results. If anyone has this working, I would appreciate any information or config file samples as I need to deploy the server ASAP. thanks, John. p.s. I am not including my config files (ldap.conf,slapd.conf,etc.) as they are essentially copies of the ones from the openldap website. However, if you wish to see them, I can reply with the latest of 100 iterations :(

1 0

Re: Issue with index in OpenLDAP?
by External Mathieu DEDECKER (CAMPUS) 05 Jan '12

05 Jan '12

I will read the man page in order to have more informations about the command. I tried to reindex all the index of the database with the slapindex command, but I allways the same behaviour: Request1: cardnumber=2098001010034 (less than 1sec) Request2: cardnumber=2090389917486 (nearly 20 sec). Other .bdb files size have been updated, but my "cardnumber.bdb" has still the same size. Regards, Mathieu 2012/1/4 Quanah Gibson-Mount <quanah(a)zimbra.com> > Hi Mathieu, > > If you read the slapindex man page, it is possibly to just recreate a > specific index file (for situations like this), rather than generating all > of them. > > --Quanah > > > --On Wednesday, January 04, 2012 10:39 AM +0100 "External Mathieu DEDECKER > (CAMPUS)" <external.z02mdebe(a)oxylane.com**> wrote: > > Hello Quanah, >> >> First I would like to thank you for your answer. >> >> Indeed, I also think that the "cardnumber" index is somehow corrupted. >> His size is to small in comparison to other indexes >> >> We suppressed all existing index and Used slapindex to re-create them all. >> >> It's undergoing. >> >> I will keep you informed about the solution. >> >> Best Regards, >> >> Mathieu >> >> >> 2012/1/3 Quanah Gibson-Mount <quanah(a)zimbra.com> >> >> >> --On Friday, December 23, 2011 11:27 AM +0100 "External Mathieu DEDECKER >> (CAMPUS)" <external.z02mdebe(a)oxylane.com**> wrote: >> >> >> Hi @All, >> >> We meet a performance problem with our OpenLDAP. >> >> We think that we face a problem with the index of the database, and we >> think that the problem can be resolve by tunning the config (but not >> sure). >> >> We would like to be sure that our configuration is correct, in order to >> confirm if we are on a wrong track or not. >> >> [Description] >> >> We have an attribute (cardNumber) which is indexed. >> >> When we request the indexed attribute (cardNumber) with an LDAP Client >> (Ldapbrowser), we have either fast or very long response time. >> >> For the long response time, the CPU of the server hits 100%. >> >> For example: >> >> Request1: cardnumber=2098001010034 (less than 1sec) >> Request2: cardnumber=2090389917486 (nearly 20 sec). >> >> By checking the hit ratio of the attribute, we can see that cache is >> correctly used (97%). >> >> >> It sounds like you added an index to cardnumber after there was already >> data for cardnumber in your database, and didn't run slapindex for that >> attribute. Alternatively, your cardnumber.bdb file is corrupted. >> >> --Quanah >> >> >> -- >> >> Quanah Gibson-Mount >> Sr. Member of Technical Staff >> Zimbra, Inc >> A Division of VMware, Inc. >> -------------------- >> Zimbra :: the leader in open source messaging and collaboration >> >> >> > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

TLS issue (again)
by Olivier 04 Jan '12

04 Jan '12

I had to renew my openssl certificates and now my ldap tls negociation doesn't work anymore : $ ldapsearch -ZZ -D uid=guillard,ou=staff,ou=people,dc=example,dc=fr -W uid=guillard -h ldap2.th3.example.fr ldap_start_tls: Connect error (-11) additional info: TLS error -8172:Unknown code ___f 20 Here are the server configuration relevant directives : olcTLSCACertificateFile /etc/openldap/cacerts/CA.crt olcTLSCertificateFile /etc/openldap/cacerts/server.crt olcTLSCertificateKeyFile /etc/openldap/cacerts/server.key olcTLSCipherSuite HIGH ( see at the very end of this mail : these certificates are correct since I have successfully proceed to openssl connexion tests). and here are logs collected on the server side when receiving ldapsearch request : daemon: activity on 1 descriptor daemon: activity on: slap_listener_activate(7): daemon: epoll: listen=7 busy >>> slap_listener(ldap://ldap2.th3.example.fr:389) daemon: listen=7, new connection on 15 daemon: added 15r (active) listener=(nil) conn=1003 fd=15 ACCEPT from IP=10.10.86.93:41013 (IP=10.1.92.25:389) daemon: activity on 2 descriptors daemon: activity on: 15r daemon: read active on 15 daemon: epoll: listen=7 active_threads=0 tvp=zero connection_get(15) connection_get(15): got connid=1003 connection_read(15): checking for input on id=1003 ber_get_next ldap_read: want=8, got=8 0000: 30 1d 02 01 01 77 18 80 0....w.. ldap_read: want=23, got=23 0000: 16 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e 31 34 36 .1.3.6.1.4.1.146 0010: 36 2e 32 30 30 33 37 6.20037 ber_get_next: tag 0x30 len 29 contents: ber_dump: buf=0x7f272017aa70 ptr=0x7f272017aa70 end=0x7f272017aa8d len=29 0000: 02 01 01 77 18 80 16 31 2e 33 2e 36 2e 31 2e 34 ...w...1.3.6.1.4 0010: 2e 31 2e 31 34 36 36 2e 32 30 30 33 37 .1.1466.20037 op tag 0x77, time 1325683329 ber_get_next ldap_read: want=8 error=Resource temporarily unavailable conn=1003 op=0 do_extended ber_scanf fmt ({m) ber: ber_dump: buf=0x7f272017aa70 ptr=0x7f272017aa73 end=0x7f272017aa8d len=26 0000: 77 18 80 16 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e w...1.3.6.1.4.1. 0010: 31 34 36 36 2e 32 30 30 33 37 1466.20037 conn=1003 op=0 EXT oid=1.3.6.1.4.1.1466.20037 do_extended: oid=1.3.6.1.4.1.1466.20037 conn=1003 op=0 STARTTLS send_ldap_extended: err=0 oid= len=0 send_ldap_response: msgid=1 tag=120 err=0 ber_flush2: 14 bytes to sd 15 0000: 30 0c 02 01 01 78 07 0a 01 00 04 00 04 00 0....x........ ldap_write: want=14, written=14 0000: 30 0c 02 01 01 78 07 0a 01 00 04 00 04 00 0....x........ conn=1003 op=0 RESULT oid= err=0 text= daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: activity on 1 descriptor daemon: activity on: 15r daemon: read active on 15 daemon: epoll: listen=7 active_threads=0 tvp=zero connection_get(15) connection_get(15): got connid=1003 connection_read(15): checking for input on id=1003 tls_read: want=3, got=3 0000: 80 3a 01 .:. tls_read: want=57, got=57 0000: 03 01 00 21 00 00 00 10 00 00 35 00 00 04 00 00 ...!......5..... 0010: 05 00 00 2f 00 00 0a 00 00 09 00 00 64 00 00 62 .../........d..b 0020: 00 00 03 00 00 06 00 00 ff 70 1e 75 15 46 04 b3 .........p.u.F.. 0030: 16 ed d1 87 1c 77 58 06 48 .....wX.H tls_write: want=2157, written=2157 0000: 16 03 01 08 68 02 00 00 4d 03 01 4f 04 52 81 3c ....h...M..O.R.< 0010: c6 b8 b6 8a d8 4a 75 83 a7 fc 09 13 2c c8 d4 d4 .....Ju.....,... 0020: ce e7 12 73 80 bc 42 f6 f2 05 de 20 6c db 35 d1 ...s..B.... l.5. 0030: e0 2b bb 93 a4 c2 8c 82 df 51 58 0a 93 e6 c9 ff .+.......QX..... 0040: 10 0d 92 08 6c 96 3e f8 92 aa d8 83 00 35 00 00 ....l.>......5.. 0050: 05 ff 01 00 01 00 0b 00 06 d3 00 06 d0 00 02 e3 ................ 0060: 30 82 02 df 30 82 01 c7 02 09 00 a6 1d 1f 28 63 0...0.........(c 0070: 5e 6a 57 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 ^jW0...*.H...... 0080: 05 00 30 81 87 31 0b 30 09 06 03 55 04 06 13 02 ..0..1.0...U.... 0090: 66 72 31 0f 30 0d 06 03 55 04 08 0c 06 66 72 61 fr1.0...U....fra 00a0: 6e 63 65 31 11 30 0f 06 03 55 04 07 0c 08 6d 6f nce1.0...U....mo 00b0: 6e 74 69 67 6e 79 31 0e 30 0c 06 03 55 04 0a 0c ntigny1.0...U... 00c0: 05 61 66 6e 69 63 31 0d 30 0b 06 03 55 04 0b 0c .example1.0...U... 00d0: 04 6c 64 61 70 31 0d 30 0b 06 03 55 04 03 0c 04 .ldap1.0...U.... 00e0: 6c 64 61 70 31 26 30 24 06 09 2a 86 48 86 f7 0d ldap1&0$..*.H... 00f0: 01 09 01 16 17 6f 6c 69 76 69 65 72 2e 67 75 69 .....olivier.gui 0100: 6c 6c 61 72 64 40 6e 69 63 2e 66 72 30 1e 17 0d llard(a)example.fr0... 0110: 31 31 31 32 32 39 31 35 33 39 35 38 5a 17 0d 32 111229153958Z..2 0120: 31 30 37 32 39 31 35 33 39 35 38 5a 30 81 a2 31 10729153958Z0..1 0130: 0b 30 09 06 03 55 04 06 13 02 66 72 31 0f 30 0d .0...U....fr1.0. 0140: 06 03 55 04 08 0c 06 66 72 61 6e 63 65 31 11 30 ..U....france1.0 0150: 0f 06 03 55 04 07 0c 08 6d 6f 6e 74 69 67 6e 79 ...U....myplace 0160: 31 0e 30 0c 06 03 55 04 0a 0c 05 61 66 6e 69 63 1.0...U....example 0170: 31 0d 30 0b 06 03 55 04 0b 0c 04 6c 64 61 70 31 1.0...U....ldap1 0180: 28 30 26 06 03 55 04 03 0c 1f 6c 64 61 70 32 2e (0&..U....ldap2. 0190: 64 61 74 61 62 61 73 65 2e 70 72 69 76 65 2e 74 t 01a0: 68 33 2e 6e 69 63 2e 66 72 31 26 30 24 06 09 2a h3.example.fr1&0$..* 01b0: 86 48 86 f7 0d 01 09 01 16 17 4f 6c 69 76 69 65 .H........Olivie 01c0: 72 2e 47 75 69 6c 6c 61 72 64 40 6e 69 63 2e 66 r.Guillard(a)example.f 01d0: 72 30 5c 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 r0\0...*.H...... 01e0: 05 00 03 4b 00 30 48 02 41 00 bf 72 68 cc 54 9d ...K.0H.A..rh.T. 01f0: 10 d3 8b c0 4a 1b 5c 90 d6 03 7a 41 5e 05 6f 8d ....J.\...zA^.o. 0200: cc 2d 61 31 7b 94 0f c2 f7 c1 51 8a 4f d5 59 89 .-a1{.....Q.O.Y. 0210: 51 79 87 3f fa c3 5f af 30 8c 87 f8 ca be bb 0b Qy.?.._.0....... 0220: 28 8c d5 4a 3a 73 b5 a9 e3 d9 02 03 01 00 01 30 (..J:s.........0 0230: 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 82 ...*.H.......... 0240: 01 01 00 c0 3c 2a 0a d4 af 13 24 b5 2a 2b e3 cd ....<*....$.*+.. 0250: 0f 57 f6 86 99 e1 ae ba d7 b2 87 4e 02 a6 d6 a3 .W.........N.... 0260: 7d 9f 7b 89 03 61 ac b6 40 9e 93 ca 8d 3a d4 95 }.{..a..@....:.. 0270: 7a 48 e2 9a 01 2f ed 3d 2b c3 96 41 c0 58 39 cf zH.../.=+..A.X9. 0280: 52 a2 db 08 78 85 c4 85 17 08 d8 11 62 60 8e d0 R...x.......b`.. 0290: b5 61 71 fe 83 d5 94 9d f2 42 1d b5 56 bd fa 67 .aq......B..V..g 02a0: db 8e bf 09 af ef e3 b0 c8 0a f1 38 8b bf 59 75 ...........8..Yu 02b0: 6a 21 01 c0 0b 8c cf 87 20 d2 2f d9 89 a0 37 11 j!...... ./...7. 02c0: a0 62 6a a1 32 4b ff e4 cf 30 4c 8f 8e ef d2 51 .bj.2K...0L....Q 02d0: ec cc d1 fc 21 43 58 5e 09 40 8b bf ca bb fc 4f ....!CX^.@.....O 02e0: d1 d4 e9 cf 80 8f b1 af 72 d0 ff c1 d7 52 f3 4b ........r....R.K 02f0: e3 85 69 ef e9 36 6e 4d 54 13 d2 bd 3b 93 ad ed ..i..6nMT...;... 0300: 6e 36 cc 4f e6 b9 c5 01 1e 86 c8 88 aa de a6 7b n6.O...........{ 0310: c1 99 9a 3f c5 69 9e af e0 94 6e ba 51 5b ec 2a ...?.i....n.Q[.* 0320: 2c aa 09 ff 4a 27 15 96 ad 9f b0 5c f0 c4 9c 34 ,...J'.....\...4 0330: 53 32 03 1c d4 e2 dd b8 96 88 d2 5d b2 c6 e1 5e S2.........]...^ 0340: 32 ba 81 00 03 e7 30 82 03 e3 30 82 02 cb a0 03 2.....0...0..... 0350: 02 01 02 02 09 00 a1 67 1e 44 66 c6 f6 59 30 0d .......g.Df..Y0. 0360: 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 30 81 87 ..*.H........0.. 0370: 31 0b 30 09 06 03 55 04 06 13 02 66 72 31 0f 30 1.0...U....fr1.0 0380: 0d 06 03 55 04 08 0c 06 66 72 61 6e 63 65 31 11 ...U....france1. 0390: 30 0f 06 03 55 04 07 0c 08 6d 6f 6e 74 69 67 6e 0...U....montign 03a0: 79 31 0e 30 0c 06 03 55 04 0a 0c 05 61 66 6e 69 y1.0...U....afni 03b0: 63 31 0d 30 0b 06 03 55 04 0b 0c 04 6c 64 61 70 c1.0...U....ldap 03c0: 31 0d 30 0b 06 03 55 04 03 0c 04 6c 64 61 70 31 1.0...U....ldap1 03d0: 26 30 24 06 09 2a 86 48 86 f7 0d 01 09 01 16 17 &0$..*.H........ 03e0: 6f 6c 69 76 69 65 72 2e 67 75 69 6c 6c 61 72 64 olivier.guillard 03f0: 40 6e 69 63 2e 66 72 30 1e 17 0d 31 31 31 32 32 @example.fr0...11122 0400: 39 31 34 31 33 35 35 5a 17 0d 33 31 31 32 32 34 9141355Z..311224 0410: 31 34 31 33 35 35 5a 30 81 87 31 0b 30 09 06 03 141355Z0..1.0... 0420: 55 04 06 13 02 66 72 31 0f 30 0d 06 03 55 04 08 U....fr1.0...U.. 0430: 0c 06 66 72 61 6e 63 65 31 11 30 0f 06 03 55 04 ..france1.0...U. 0440: 07 0c 08 6d 6f 6e 74 69 67 6e 79 31 0e 30 0c 06 ...myplace1.0.. 0450: 03 55 04 0a 0c 05 61 66 6e 69 63 31 0d 30 0b 06 .U....example1.0.. 0460: 03 55 04 0b 0c 04 6c 64 61 70 31 0d 30 0b 06 03 .U....ldap1.0... 0470: 55 04 03 0c 04 6c 64 61 70 31 26 30 24 06 09 2a U....ldap1&0$..* 0480: 86 48 86 f7 0d 01 09 01 16 17 6f 6c 69 76 69 65 .H........olivie 0490: 72 2e 67 75 69 6c 6c 61 72 64 40 6e 69 63 2e 66 r.guillard(a)example.f 04a0: 72 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 r0.."0...*.H.... 04b0: 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 .........0...... 04c0: 01 00 c8 90 e1 61 d2 28 38 aa 35 a9 21 5b f7 2b .....a.(8.5.![.+ 04d0: f2 ed 04 5c 73 03 c5 f8 f9 97 5a 53 3b 39 bf aa ...\s.....ZS;9.. 04e0: 20 b8 45 c1 92 2e 27 ea bf b1 78 57 f9 41 a3 b3 .E...'...xW.A.. 04f0: 23 11 fc 8d 79 ea 21 a9 01 c0 ce 01 27 e6 0f a6 #...y.!.....'... 0500: 13 8d 12 5c 72 bf ba 60 41 71 76 94 99 da 43 f7 ...\r..`Aqv...C. 0510: e0 f9 b4 2f e7 25 7c 36 4f e9 4f dc 18 26 a9 7c .../.%|6O.O..&.| 0520: ad 98 2a 9c 91 16 76 41 31 1e 5d dd 81 2a b9 38 ..*...vA1.]..*.8 0530: ec 91 5c 91 11 03 fb 14 7d 59 d5 49 6d 32 42 c7 ..\.....}Y.Im2B. 0540: 66 73 58 b0 fb 02 b4 a0 4d 3e e3 3c ab ff 8c 42 fsX.....M>.<...B 0550: 83 51 b5 51 b7 19 71 61 f8 39 5c b7 8d 1a 70 97 .Q.Q..qa.9\...p. 0560: 69 5d e6 47 9e 7e ae ec 5c 7c be 73 7b d0 df df i].G.~..\|.s{... 0570: a7 53 6d a8 d3 d3 f6 7e e6 2f 13 3e c5 80 e6 f2 .Sm....~./.>.... 0580: fe 2a cc d4 1e 4d 3d 6a bc b0 a9 fa a5 51 12 31 .*...M=j.....Q.1 0590: 0e 41 2d 7a 8a 52 de 66 bd 3b 0c ef fa 9b fe 82 .A-z.R.f.;...... 05a0: df ad 1c 7f d9 53 4b c0 db fe f3 e6 b9 3d ea 5d .....SK......=.] 05b0: 66 7f fb 14 41 b5 0a e7 70 11 4e 5d 80 69 04 bd f...A...p.N].i.. 05c0: 9e 97 02 03 01 00 01 a3 50 30 4e 30 1d 06 03 55 ........P0N0...U 05d0: 1d 0e 04 16 04 14 24 05 af 2a 63 a4 0b 0f ae a4 ......$..*c..... 05e0: e2 2c e9 13 40 5a 8b d7 a4 41 30 1f 06 03 55 1d .,..@Z...A0...U. 05f0: 23 04 18 30 16 80 14 24 05 af 2a 63 a4 0b 0f ae #..0...$..*c.... 0600: a4 e2 2c e9 13 40 5a 8b d7 a4 41 30 0c 06 03 55 ..,..@Z...A0...U 0610: 1d 13 04 05 30 03 01 01 ff 30 0d 06 09 2a 86 48 ....0....0...*.H 0620: 86 f7 0d 01 01 05 05 00 03 82 01 01 00 57 2d 0a .............W-. 0630: d5 88 d0 98 2b 9e f9 d7 bc e6 82 08 65 25 d9 65 ....+.......e%.e 0640: 84 98 e3 da a3 36 a1 6f 40 3b d0 d8 16 3d 48 06 .....6.o@;...=H. 0650: 6c ee 99 fd b6 4c f3 3b 10 50 bb 71 97 6e 4d e0 l....L.;.P.q.nM. 0660: 77 48 57 5b db d1 e6 ca c8 80 79 d0 f5 17 94 5d wHW[......y....] 0670: 11 93 07 74 8b 5c 4b b1 ad 45 1f 5a 2c d9 6e e8 ...t.\K..E.Z,.n. 0680: d4 7a e4 99 e7 ba 86 36 93 1d 4c 0e 9b 13 4d ef .z.....6..L...M. 0690: 25 72 7b ae b0 f1 95 c0 17 dc 4a c0 ed 04 b5 54 %r{.......J....T 06a0: 98 90 47 2f dc f0 1c 5a ca b0 2e 0d ee 58 14 e8 ..G/...Z.....X.. 06b0: 2c d0 cd a8 d9 2c ae 2f 65 81 89 70 af f9 d8 01 ,....,./e..p.... 06c0: 1b 14 ae 63 1d 90 af 3d 29 71 7d 74 4a e8 7a e5 ...c...=)q}tJ.z. 06d0: ed a0 fb 9b ce 1d 5a e2 82 7e c4 bc 97 88 e7 06 ......Z..~...... 06e0: 66 86 77 23 85 29 2c b1 28 72 8c af a5 51 96 b1 f.w#.),.(r...Q.. 06f0: d5 dc 51 62 bd 2d e6 8f 4c 22 24 4e e1 c6 a3 64 ..Qb.-..L"$N...d 0700: 40 fc e9 d8 6d b1 48 d8 80 10 3a 6a bc 35 06 d9 @...m.H...:j.5.. 0710: 4c e8 4c e6 66 82 9d fd a9 a2 9f 3e 13 37 c0 52 L.L.f......>.7.R 0720: 3f c3 15 e1 3e 9c 05 67 b2 11 0d 38 a4 0d 00 01 ?...>..g...8.... 0730: 38 02 01 02 01 33 00 8a 30 81 87 31 0b 30 09 06 8....3..0..1.0.. 0740: 03 55 04 06 13 02 66 72 31 0f 30 0d 06 03 55 04 .U....fr1.0...U. 0750: 08 0c 06 66 72 61 6e 63 65 31 11 30 0f 06 03 55 ...france1.0...U 0760: 04 07 0c 08 6d 6f 6e 74 69 67 6e 79 31 0e 30 0c ....myplace1.0. 0770: 06 03 55 04 0a 0c 05 61 66 6e 69 63 31 0d 30 0b ..U....example1.0. 0780: 06 03 55 04 0b 0c 04 6c 64 61 70 31 0d 30 0b 06 ..U....ldap1.0.. 0790: 03 55 04 03 0c 04 6c 64 61 70 31 26 30 24 06 09 .U....ldap1&0$.. 07a0: 2a 86 48 86 f7 0d 01 09 01 16 17 6f 6c 69 76 69 *.H........olivi 07b0: 65 72 2e 67 75 69 6c 6c 61 72 64 40 6e 69 63 2e er.guillard@example. 07c0: 66 72 00 a5 30 81 a2 31 0b 30 09 06 03 55 04 06 fr..0..1.0...U.. 07d0: 13 02 66 72 31 0f 30 0d 06 03 55 04 08 0c 06 66 ..fr1.0...U....f 07e0: 72 61 6e 63 65 31 11 30 0f 06 03 55 04 07 0c 08 rance1.0...U.... 07f0: 6d 6f 6e 74 69 67 6e 79 31 0e 30 0c 06 03 55 04 myplace1.0...U. 0800: 0a 0c 05 61 66 6e 69 63 31 0d 30 0b 06 03 55 04 ...example1.0...U. 0810: 0b 0c 04 6c 64 61 70 31 28 30 26 06 03 55 04 03 ...ldap1(0&..U.. 0820: 0c 1f 6c 64 61 70 32 2e 64 61 74 61 62 61 73 65 ..ldap2. 0830: 2e 70 72 69 76 65 2e 74 68 33 2e 6e 69 63 2e 66 .th3.example.fr 0840: 72 31 26 30 24 06 09 2a 86 48 86 f7 0d 01 09 01 1&0$..*.H....... 0850: 16 17 4f 6c 69 76 69 65 72 2e 47 75 69 6c 6c 61 .Olivier.Guilla 0860: 72 64 40 6e 69 63 2e 66 72 0e 00 00 00 rd(a)example.fr.... tls_read: want=5 error=Resource temporarily unavailable daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=zero daemon: activity on 1 descriptor daemon: activity on: 15r daemon: read active on 15 daemon: epoll: listen=7 active_threads=0 tvp=zero connection_get(15) connection_get(15): got connid=1003 connection_read(15): checking for input on id=1003 tls_read: want=5, got=5 0000: 15 03 01 00 02 ..... tls_read: want=2, got=2 0000: 02 30 .0 TLS: error: accept - force handshake failure: errno 11 - moznss error -12195 TLS: can't accept: TLS error -12195:Unknown code ___P 93. connection_read(15): TLS accept failure error=-1 id=1003, closing connection_closing: readying conn=1003 sd=15 for close connection_close: conn=1003 sd=15 daemon: removing 15 conn=1003 fd=15 closed (TLS negotiation failure) daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=zero ^Cdaemon: shutdown requested and initiated. daemon: closing 7 connection_closing: readying conn=1000 sd=13 for close connection_close: conn=1000 sd=13 daemon: removing 13 conn=1000 fd=13 closed (slapd shutdown) As far as I can see it doesn't looks like [root@ldap2 cacerts]# openssl s_server -accept 5555 -key /etc/openldap/cacerts/server.key -cert /etc/openldap/cacerts/server.crt -state Using default temp DH parameters ACCEPT SSL_accept:before/accept initialization SSL_accept:SSLv3 read client hello A SSL_accept:SSLv3 write server hello A SSL_accept:SSLv3 write certificate A SSL_accept:SSLv3 write key exchange A SSL_accept:SSLv3 write server done A SSL_accept:SSLv3 flush data SSL_accept:SSLv3 read client key exchange A SSL_accept:SSLv3 read finished A SSL_accept:SSLv3 write session ticket A SSL_accept:SSLv3 write change cipher spec A SSL_accept:SSLv3 write finished A SSL_accept:SSLv3 flush data -----BEGIN SSL SESSION PARAMETERS----- MFoCAQECAgMBBAIAOQQABDB88nXC0TcyHgrQcZ+51a/16Nw874VzV1cEEkOMwfSy VCIJ8jOiylXmk2gHkAK7y6OhBgIETwRP56IEAgIBLKQGBAQBAAAAqwMEAQE= -----END SSL SESSION PARAMETERS----- Shared ciphers:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:DHE-RSA-CAMELLIA256-SHA:DHE-DSS-CAMELLIA256-SHA:AES256-SHA:CAMELLIA256-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DES-CBC3-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:DHE-RSA-SEED-SHA:DHE-DSS-SEED-SHA:DHE-RSA-CAMELLIA128-SHA:DHE-DSS-CAMELLIA128-SHA:AES128-SHA:SEED-SHA:CAMELLIA128-SHA:RC4-SHA:RC4-MD5:EDH-RSA-DES-CBC-SHA:EDH-DSS-DES-CBC-SHA:DES-CBC-SHA:EXP-EDH-RSA-DES-CBC-SHA:EXP-EDH-DSS-DES-CBC-SHA:EXP-DES-CBC-SHA:EXP-RC2-CBC-MD5:EXP-RC4-MD5 CIPHER is DHE-RSA-AES256-SHA Secure Renegotiation IS supported ERROR shutting down SSL CONNECTION CLOSED ACCEPT [guillard@fouine ~]$ openssl s_client -CAfile /etc/openldap/cacerts/CA.crt -connect ldap2.th3.example.fr:5555 CONNECTED(00000003) depth=1 C = fr, ST = france, L = myplace, O = example, OU = ldap, CN = ldap, emailAddress = olivier.guillard(a)example.fr verify return:1 depth=0 C = fr, ST = france, L = myplace, O = example, OU = ldap, CN = ldap2.th3.example.fr, emailAddress = Olivier.Guillard(a)example.fr verify return:1 --- Certificate chain 0 s:/C=fr/ST=france/L=myplace/O=example/OU=ldap/CN=ldap2.th3.example.fr/emailAddress=Olivier.Guillard@example.fr i:/C=fr/ST=france/L=myplace/O=example/OU=ldap/CN=ldap/emailAddress=olivier.guillard@example.fr --- Server certificate -----BEGIN CERTIFICATE----- MIIC3zCCAccCCQCmHR8oY15qVzANBgkqhkiG9w0BAQUFADCBhzELMAkGA1UEBhMC ZnIxDzANBgNVBAgMBmZyYW5jZTERMA8GA1UEBwwIbW9udGlnbnkxDjAMBgNVBAoM BWFmbmljMQ0wCwYDVQQLDARsZGFwMQ0wCwYDVQQDDARsZGFwMSYwJAYJKoZIhvcN AQkBFhdvbG24KJJD7GJVBIYTIVHTFJCGFDHGFXGRFCYTDFYTDjkxNTM5NThaFw0y MTA3MjkxNTM5NThaMIGiMQswCQYDVQQGEwJmcjEPMA0GA1UECAwGZnJhbmNlMREw DwYDVQQHDAhtb250aWdueTEOMAwGA1UECgwFYWZuaWMxDTALBgNVBAsMBGxkYXAx KDAmBgNVBAMMH2xkYXAyLmRhdGFiYXNlLnByaXZlLnRoMy5uaWMuZnIxJjAkBgkq hkiG9w0BCQEWFNBIHGJ4UTFHGXCYTDCYXDYCYTFCUGCUTTFUYFUJKoZIhvcNAQEB BQADSwAwSAJBAL9yaMxUnRDTi8BKG1yQ1gN6QV4Fb43MLWExe5QPwvfBUYpP1VmJ UXmHP/rDX68wjIf4yr67CyiM1Uo6c7Wp49kCAwEAATANBgkqhkiG9w0BAQUFAAOC AQEAwDwqCtSvEyS1KivjzQ9X9oaZ4a6617KHTgKm1qN9n3uJA2GstkCek8qNOtSV ekjimgEv7T0rw5ZBwFg5z1Ki2wh4hcSFFwjYEWJgjtC1YXH+g9WUnfJCHbVWvfpn 246NBVJHJHVJVJJKVJHVJHVJKHVJHVJHVJHVJHVJHVJHVJHVJHVJHVJHVJHV79JR 7MzR/CFDWF4JQIu/yrv8T9HU6c+Aj7GvctD/wddS80vjhWnv6TZuTVQT0r07k63t bjbMT+a5xQEehsiIqt6me8GZmj/FaZ6v4JRuulFb7Cosqgn/SicVlq2fsFzwxJw0 UzIDHNTi3biWiNJdssbhXjK6gQ== -----END CERTIFICATE----- subject=/C=fr/ST=france/L=myplace/O=example/OU=ldap/CN=ldap2.th3.example.fr/emailAddress=Olivier.Guillard(a)example.fr issuer=/C=fr/ST=france/L=myplace/O=example/OU=ldap/CN=ldap/emailAddress=olivier.guillard(a)example.fr --- No client certificate CA names sent --- SSL handshake has read 1265 bytes and written 247 bytes --- New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA Server public key is 512 bit Secure Renegotiation IS supported Compression: zlib compression Expansion: zlib compression SSL-Session: Protocol : TLSv1 Cipher : DHE-RSA-AES256-SHA Session-ID: DBCDE5CD6EB4D7FF8C38DD1557CA90EDBEDDCB27600CFA4D1FD9D58388A11EBE Session-ID-ctx: Master-Key: 7CF275C2D137321E0AD0719FB9D5AFF5E8DC3CEF857357570412438CC1F4B2542209F233A2CA55E69368079002BBCBA3 Key-Arg : None Krb5 Principal: None PSK identity: None PSK identity hint: None TLS session ticket: 0000 - c2 bb 20 23 85 0a cf b0-bc b2 6d cd 4b d2 32 0e .. #......m.K.2. 0010 - 6f 51 29 7f 3a 44 c3 95-76 c2 c6 23 e5 8d 98 3c oQ).:D..v..#...< 0020 - 7a b9 eb 6b 8e d1 c5 c4-57 74 26 34 4c db ec fe z..k....Wt&4L... 0030 - a9 3b 77 12 fb 74 67 fb-57 f1 8f 2a 71 d3 a6 ae .;w..tg.W..*q... 0040 - 17 48 9e bf 7d 94 1f c3-d4 02 6e 7f 27 07 f4 d6 .H..}.....n.'... 0050 - 98 6f 24 6c f9 63 b7 4c-cd ce d8 85 e5 be 3e fd .o$l.c.L......>. 0060 - 65 a2 1b 36 cc 26 76 3b-d3 f6 cf e1 f9 a7 c3 c2 e..6.&v;........ 0070 - 2f fe 8f 3c 7c d1 0f 58-43 be d7 a5 64 69 04 91 /..<|..XC...di.. 0080 - cb 68 08 82 fe 8d 9d 4e-1b 0f 96 27 59 5e d8 76 .h.....N...'Y^.v 0090 - be 44 01 6d 53 2e 9e 67-22 07 35 d1 6f a4 80 e1 .D.mS..g".5.o... Compression: 1 (zlib compression) Start Time: 1325682663 Timeout : 300 (sec) Verify return code: 0 (ok) --- ^C

3 2

Re: slapd-ldap as proxy to active directory
by Juan Miscaro 04 Jan '12

04 Jan '12

On 14 December 2011 17:44, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Wednesday, December 14, 2011 3:40 PM -0500 Juan Miscaro > <jmiscaro(a)gmail.com> wrote: >> I would like to use the slapd-ldap backend as a proxy to Active >> Directory (Windows Server 2008 R2). >> >> Firstly, AD can be queried directly: > Does your local OpenLDAP have a schema file that defines the AD attributes > you are using? No. I read that since OpenLDAP 2.3 this was not necessary (I'm running 2.4.25 on Ubuntu 11.10). I got my project from a tutorial [1] where this all worked. [1]: http://is.gd/dqM1Ts (see section "Using OpenLDAP 2.3 to Pass Unknown Schema" on page 2) -- /jm

5 7

Re: Issue with index in OpenLDAP?
by Quanah Gibson-Mount 04 Jan '12

04 Jan '12

Hi Mathieu, If you read the slapindex man page, it is possibly to just recreate a specific index file (for situations like this), rather than generating all of them. --Quanah --On Wednesday, January 04, 2012 10:39 AM +0100 "External Mathieu DEDECKER (CAMPUS)" <external.z02mdebe(a)oxylane.com> wrote: > Hello Quanah, > > First I would like to thank you for your answer. > > Indeed, I also think that the "cardnumber" index is somehow corrupted. > His size is to small in comparison to other indexes > > We suppressed all existing index and Used slapindex to re-create them all. > > It's undergoing. > > I will keep you informed about the solution. > > Best Regards, > > Mathieu > > > 2012/1/3 Quanah Gibson-Mount <quanah(a)zimbra.com> > > > --On Friday, December 23, 2011 11:27 AM +0100 "External Mathieu DEDECKER > (CAMPUS)" <external.z02mdebe(a)oxylane.com> wrote: > > > Hi @All, > > We meet a performance problem with our OpenLDAP. > > We think that we face a problem with the index of the database, and we > think that the problem can be resolve by tunning the config (but not > sure). > > We would like to be sure that our configuration is correct, in order to > confirm if we are on a wrong track or not. > > [Description] > > We have an attribute (cardNumber) which is indexed. > > When we request the indexed attribute (cardNumber) with an LDAP Client > (Ldapbrowser), we have either fast or very long response time. > > For the long response time, the CPU of the server hits 100%. > > For example: > > Request1: cardnumber=2098001010034 (less than 1sec) > Request2: cardnumber=2090389917486 (nearly 20 sec). > > By checking the hit ratio of the attribute, we can see that cache is > correctly used (97%). > > > It sounds like you added an index to cardnumber after there was already > data for cardnumber in your database, and didn't run slapindex for that > attribute. Alternatively, your cardnumber.bdb file is corrupted. > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > > -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Re: Issue with index in OpenLDAP?
by External Mathieu DEDECKER (CAMPUS) 04 Jan '12

04 Jan '12

Hello Quanah, First I would like to thank you for your answer. Indeed, I also think that the "cardnumber" index is somehow corrupted. His size is to small in comparison to other indexes We suppressed all existing index and Used slapindex to re-create them all. It's undergoing. I will keep you informed about the solution. Best Regards, Mathieu 2012/1/3 Quanah Gibson-Mount <quanah(a)zimbra.com> > --On Friday, December 23, 2011 11:27 AM +0100 "External Mathieu DEDECKER > (CAMPUS)" <external.z02mdebe(a)oxylane.com**> wrote: > > Hi @All, >> >> We meet a performance problem with our OpenLDAP. >> >> We think that we face a problem with the index of the database, and we >> think that the problem can be resolve by tunning the config (but not >> sure). >> >> We would like to be sure that our configuration is correct, in order to >> confirm if we are on a wrong track or not. >> >> [Description] >> >> We have an attribute (cardNumber) which is indexed. >> >> When we request the indexed attribute (cardNumber) with an LDAP Client >> (Ldapbrowser), we have either fast or very long response time. >> >> For the long response time, the CPU of the server hits 100%. >> >> For example: >> >> Request1: cardnumber=2098001010034 (less than 1sec) >> Request2: cardnumber=2090389917486 (nearly 20 sec). >> >> By checking the hit ratio of the attribute, we can see that cache is >> correctly used (97%). >> > > It sounds like you added an index to cardnumber after there was already > data for cardnumber in your database, and didn't run slapindex for that > attribute. Alternatively, your cardnumber.bdb file is corrupted. > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

Issue with index in OpenLDAP?
by External Mathieu DEDECKER (CAMPUS) 03 Jan '12

03 Jan '12

Hi @All, We meet a performance problem with our OpenLDAP. We think that we face a problem with the index of the database, and we think that the problem can be resolve by tunning the config (but not sure). We would like to be sure that our configuration is correct, in order to confirm if we are on a wrong track or not. *[Description]* We have an attribute (cardNumber) which is indexed. When we request the indexed attribute (cardNumber) with an LDAP Client (Ldapbrowser), we have either fast or very long response time. For the long response time, the CPU of the server hits 100%. *For example*: Request1: cardnumber=2098001010034 (less than 1sec) Request2: cardnumber=2090389917486 (nearly 20 sec). By checking the hit ratio of the attribute, we can see that cache is correctly used (97%). *[Details]* - We are running on a VM with RedHat with 4 process with 24 Go RAM. - The version of the OpenLDAP is 2.4.16. - We have 2 500 000 accounts. *[Attachment]* - *201111223_os.txt* -> informations about OS and Hardware. - *openldap_version.txt* -> informations about the version of OpenLDAP. - *20111220_stats.txt* -> informations about index and perf. - *olcDatabase={1}hdb.ldif.txt * -> informations about hdb config. Do not hesitate if you need some more informations. Thank you for your help (: Mathieu

2 2

Syncrepl problem
by Bram Cymet 03 Jan '12

03 Jan '12

Hi, I have a syncrepl setup that I thought was working fine because whenever I would change an attribute in an entry the changes would be reflected in slave. Recently I noticed that if I remove and entry or add a new entry that will not get synced. Any idea what would be going on? Thanks, -- Bram Cymet Software Developer Canadian Bank Note Co. Ltd. 613-608-9752

2 3

suggestion regarding updating server and clients
by Götz Reinicke 03 Jan '12

03 Jan '12

Hi, we do run an Red Hat EL 6.x server with the openldap package from Red Hat currently version 2.4.19-15.el6_0.2. The ldap is used by our mail and fileserver for authentication. The last time I updated I had a big problem with the deamon crashing after some time. That problem should be solved now in the recent version 2.4.23-20.el6. My question: Could I 'mix' the installed version for now, meaning leave the ldap clients at the current installed version .19 and only update the server first to version .23 or should / do I have to update all systems to the same version? Thanks for any suggestion and best regards . Götz -- Götz Reinicke IT-Koordinator Tel. +49 7141 969 420 Fax +49 7141 969 55 420 E-Mail goetz.reinicke(a)filmakademie.de Filmakademie Baden-Württemberg GmbH Akademiehof 10 71638 Ludwigsburg www.filmakademie.de Eintragung Amtsgericht Stuttgart HRB 205016 Vorsitzender des Aufsichtsrats: Jürgen Walter MdL Staatssekretär im Ministerium für Wissenschaft, Forschung und Kunst Baden-Württemberg Geschäftsführer: Prof. Thomas Schadt

2 1

Merging LDAP DB's
by Alex Samad - Yieldbroker 03 Jan '12

03 Jan '12

Hi I would like to merge data from 2 LDAP DB's into 1. So I have windows 2008R2 AD which has all of our corporate users in there, with passwords. I would like to create another ldap DB for all the non-Windows users. The aim is to use this LDAP db as a userid/password repo for our product. So for example if my ad naming it ad.com, so that the base DN: dc=ad,dc=com I would like to say create a openldap server (say abc.local. ) on a server and attach another DB as say dc=ldap,dc=ad,dc=com So server abc.local I would setup 2 DB definitions 1) for a local db with base dn dc=ldap,dc=ad,dc=com 2) for a proxy (? Is this the best way or rewrite / proxy ?) with base dn dc=ad,dc=com Now if I make a ldapsearch using -H abc.local and a base dn of dc=ad,dc=com, will it include information from both DB's ? All I want to be able to do, is to authenticate people against LDAP but my information need to come from both sources. I don't want to have to pay a cal for each user I am going to add and I don't want to have to places to store my companys userid/passwords. Thanks Alex

1 0

openldap ssl/tls not getting started
by Jayavant Patil 02 Jan '12

02 Jan '12

Hi, I am using openldap-2.4.19-4.fc12.x86_64 on fedora 12 machine. I want to start slapd with ssl/tls enabled. I have followed all the necessary steps as per specified in admin guide but still slapd not getting started in ssl/tls mode. Whenever I do ldapsearch with -ZZ option, it shows can't contact LDAP server(-1). Can anybody tell me the detailed steps and settings so that I can match those with my followed steps? Server file names are as follows: /etc/openldap/slapd.conf /etc/openldap/ldap.conf /etc/ldap.conf /etc/nsswitch.conf Client file names are as follows: /etc/openldap/ldap.conf /etc/ldap.conf /etc/nsswitch.conf -- Thanks & Regards, Jayavant Ningoji Patil Engineer: System Software Computational Research Laboratories Ltd. Pune-411 004. Maharashtra, India. +91 9923536030.

2 1

Question about using memberOf attribute in OpenLDAP
by Suneet Shah 02 Jan '12

02 Jan '12

Hello, Java and its native libraries to work with OpenLDAP in our application. I need to be able to associate users to groups and this part works file. I can do an ldap search and I can see the membership ie: dn: cn=NURSE,ou=roles,dc=mydir,dc=com uniqueMember: uid=Suneet.LDAP-TEST-1,ou=users,dc=mydir,dc=com ldif for Role dn: ou=roles,dc=mydir,dc=com objectClass: top objectClass: organizationalUnit ou: roles Sample user that created for above: dn: uid=Suneet.LDAP-TEST-1,ou=users,dc=mydir,dc=com preferredLanguage: E displayName: LDAP-TEST-1,Suneet employeeType: PERM FULL TIME userPassword:: cGFzc3dvcmQ= ou: OpenIAM givenName: Suneet uid: Suneet.LDAP-TEST-1 telephoneNumber: 234-123-4567 mail: suneet_shah(a)openiam.com cn: Suneet LDAP-TEST-1 manager: uid=abc,ou=users,dc=mydir,dc=com o: OpenIAM departmentNumber: - sn: LDAP-TEST-1 title: Test User x-com-mydir-userStatus: Inactive objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: DIRUser I also need to be able to remove users from a group. In this case, I am looking up the user to see if they a have memberOf attribute. However, when I do this, my search results are always empty. My code and search filter are below. Any thoughts on what I am doing wrong? I tried this OpenDS and it works, but I need to get this work with OpenLDAP. Also I noticed that my user in ldap does not contain any attributes that show membership to a group. I have pasted below my code where I add a user to a group incase that is the source of my error Code snippet to search for a user before adding/removing from a group: String[] attrIds = {"memberOf", "isMemberOf"}; NamingEnumeration results = null; try { SearchControls searchCtls = new SearchControls(); searchCtls.setReturningAttributes(attrIds); String searchFilter =" (&(objectclass=inetOrgPerson)(uid=Suneet.LDAP-TEST-1))" results = ldapctx.search(objectBaseDN, searchFilter, searchCtls); Code to add a users to a group: ModificationItem mods[] = new ModificationItem[1]; mods[0] = new ModificationItem(DirContext.ADD_ATTRIBUTE, new BasicAttribute("uniqueMember", ldapName)); ldapctx.modifyAttributes(s, mods); thanks for your help

2 1

Ldap Tree References and Timeouts
by Klemens Kittan 29 Dec '11

29 Dec '11

Hello, I incorporated a subtree in our LDAP tree by reference. This subtree is offered by two servers. That's why I set the uri parameter to ldap1 and ldap2. If one of these servers is down, searches take very long (>10 min). The manpage says: "The URI list is space- or comma-separated. Whenever the server that responds is not the first one in the list, the list is rearranged and the responsive server is moved to the head, so that it will be first contacted the next time a connection needs be created." Have I missed something here or is there a timeout value to be set? This is our configuration for that part: # ---------------------------------------------------------- # --- Specific Backend Directives for ldap ----------------- # ---------------------------------------------------------- backend ldap # ---------------------------------------------------------- # --- Specific Directives for database ldap (babylon) ------ # ---------------------------------------------------------- database ldap # --- The base of your directory suffix "dc=subtree,dc=xyz,dc=de" uri "ldap://ldap1.xyz.de ldap://ldap2.xyz.de" # --- Save the time that the entry gets modified lastmod off # --- Specify that the current backend database is a subordinate subordinate Regards, Klemens

1 0

memory leak
by Paul DiSciascio 29 Dec '11

29 Dec '11

We are running a cluster of 2 ldap servers using the syncrepl overlay with mirror mode. After upgrading from SLES 10 SP2 (openldap 2.4.11) to SLES 11 SP1 (openldap 2.4.20), we have encountered a memory problem. The slapd process grows unbounded to the point that it uses all of the memory available to the ldap user on the server, currently 2.5GB, in a matter of hours. The database only contains around 30,000 records, so this amount of memory usage seems unusually high. No changes to the server configuration were made during the upgrade. In an attempt to address the issue, we upgraded both instances further to openldap version 2.4.28, but this has not helped. Below is the slapd.conf (security related pieces have been redacted) that we are using. ~Paul -------------------BEGIN SLAPD.CONF-------------- # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/rfc2307bis.schema include /etc/openldap/schema/ppolicy.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args # Load dynamic backend modules: modulepath /usr/lib/openldap/modules TLSCipherSuite HIGH:MEDIUM:-SSLv2 TLSCertificateFile /etc/openldap/cert.pem TLSCertificateKeyFile /etc/openldap/cert.key <ACLs go Here> loglevel none ServerID 1 ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=redacted" checkpoint 1024 5 cachesize 10000 overlay ppolicy rootdn "cn=redacted" sizelimit -1 ppolicy_default "cn=redacted" ppolicy_use_lockout directory /var/lib/ldap # Indices to maintain index cn,sn,uid eq index entryUUID eq index entryCSN eq index member eq index objectClass eq overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 limits dn.exact="uid=replica,ou=redacted" time=unlimited size=unlimited syncrepl rid=501 provider=ldap://peerhost:389 type=refreshAndPersist retry="5 5 300 +" searchbase="dc=redacted" attrs="*,+" scope=sub bindmethod=simple binddn="uid=redacted" credentials= interval=00:01:00:00 mirrormode on database monitor -------------------END SLAPD.CONF--------------

2 1

Re: LDAP and file based authentication co-exist
by Daniel Qian 29 Dec '11

29 Dec '11

On 11-12-28 8:37 PM, yang feng电话 wrote: > > No, i configure /etc/openldap/ldap.conf, need /etc/ldap.conf Also? > > Generally speaking /etc/openldap/ldap.conf is for Ldap application software/utilities whereas /etc/ldap.conf is for system. Apparently You need the later for Ldap users to show up in your system.

1 0

LDAP and file based authentication co-exist
by 杨峰 29 Dec '11

29 Dec '11

It's a strange problem, I settle down LDAP setting and can get correct ldapsearch result at the mgmt node, but when I use "su" to the user, the system prompt "the user is not existed". It seems the LDAP service ( slaped ) is running and the user authentication goes through /etc/passwd still. How to move the user authentication to LDAP only? I had changed /etc/nsswitch.conf to use ldap also. [root@xcat user]# ldapsearch -x -v -D "cn=root,dc=isilon,dc=cn" -W -b "ou=People,dc=isilon,dc=cn" "uid=demo" ldap_initialize( <DEFAULT> ) Enter LDAP Password: filter: uid=demo requesting: All userApplication attributes # extended LDIF # # LDAPv3 # base <ou=People,dc=isilon,dc=cn> with scope subtree # filter: uid=demo # requesting: ALL # # demo, People, isilon.cn dn: uid=demo,ou=People,dc=isilon,dc=cn uid: demo cn: demo sn: demo mail: demo(a)isilon.cn objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword:: e2NyeXB0fSQ2JHkuMjUwS3hlJE9VZ3BidXJDdlg0UFk2NVFSSXBKNjhtNnpxYVp OVHdZYnBpZkdJVUJuQk1ZZnlVdmtEMHNwMTZLUmtaQmhoT0xrQ1NZdEhUU2NEUDRhTmhGUnJNSWIv shadowLastChange: 15334 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 501 gidNumber: 500 homeDirectory: /ifs/home/demo # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 [root@xcat user]# su - demo su: user demo is not existed

2 1

Value of contextCSN not persisted
by Torsten Schlabach (Tascel eG) 28 Dec '11

28 Dec '11

Dear list! We found one issue with a quite simple syncrepl replication; we have one provider and just one consumer. The consumer got set up about a week ago and loaded its initial database content from the provider. Then - after a couple of days - one object got deleted on the provider. So the consumer had to perform that delete operation as well; which is what it did fine. No problem so far. Today we compared the contextCSN values for the provider and the consumer and first thought we may have a problem, actually, because we found the contextCSN on the consumer to be newer than on the provider. Here are the actual values: consumer contextCSN: 20111216215531.923716Z#000000#003#000000 provider contextCSN: 20110124140058.246484Z#000000#003#000000 Looking twice, we found out that on the provider we got the above contextCSN value (the one which is too small) using slapcat. If we ask the provider using ldapsearch it actually reports the expectec contextCSN value, i.e. the same one which we can see on the consumer. (Note: The above value on the consumer has been taken from slapcat as well. In other words: The provider's latest contextCSN value has not been written to the disk until now; actually 4 days since the change. I guess if the power would fail now for example, the provider would load it's context CSN from the database, reading the lower value, and thus replication would get seriously out of sync, wouldn't it. Also we found that the result of the operation which increased the contextCSN (deleting an object on the provider) has been written to the disk, in contrast to the contextCSN value. Is that epxected behaviour or would we need to configure the flushing to the disk? We're using OpenLDAP 2.4.23 on Debian Linux. The backend is a back-hdb. Regards, Torsten

3 7

memberOf doesn't list members from an autogroup
by Felipe Augusto van de Wiel 28 Dec '11

28 Dec '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello, I'm using 2.4.23 packaged from Debian (2.4.23-7.2) and I'm trying to combine autogroup and memberof. autogroup (and dynlist) seems to be working, but it seems that memberof fails. :-( In terms of slapd.conf I load the modules memberof, dynlist and autogroup, the relevant configuration: overlay memberof memberof-refint TRUE overlay dynlist dynlist-attrset groupOfNames labeledURI member overlay autogroup autogroup-attrset groupOfURLs memberURL member I created the following test group: dn: cn=TEST,ou=Groups,dc=hpp,dc=org,dc=br cn: TEST memberURL: ldap:///ou=People,dc=hpp,dc=org,dc=br?member?sub?(gidnumber=1000) gidNumber: 12345 objectClass: groupOfURLs objectClass: top objectClass: posixGroup It correctly lists all the users with gidnumber 1000, I'm planning to change the filter to have a group of users from different groups. If I try to search per membership: ldapsearch -LLL -x memberof=cn=TESTE,ou=Groups,dc=hpp,dc=org,dc=b Nothing returns. :-( In other groups where I have a member field added statically, the memberof query works as expected. Am I missing something? Thanks in advance! Kind regards, - -- Felipe Augusto van de Wiel <felipe.wiel(a)hpp.org.br> Tecnologia da Informação (TI) - Complexo Pequeno Príncipe http://www.pequenoprincipe.org.br/ T: +55 41 3310 1747 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQIcBAEBCgAGBQJO+leVAAoJECCPPxLgxLxPw8oP/29cK3UrBphqpCFp5ce6toQN Y3JdhxX8brO5ffgv2hWYc/m+MOlsOjlxI5bEuIED0VlpnXtSJloT48GzGVNoTJoF nKt/tV9ndphJuH4MOYioybOP4aMXaOjvr0TYk4eNWZl2C/RYtR1WtTExHCt30+UV Iy3/hzNQyLiBURgRiTOR2+qCHMVSqMXJM+TuvwDXQMm89oEoZWiQHJGVZ9HDcMYE Xg3A7UBZQwPxxXjARVLX8w/n9z2M75yABQxK1p3SnJHX7JxAE5lzzhpQRV3nIXI5 kL41sXarI8Xfa/NyClf54xzOUNqnMBeNBZJQe9SSfn/E9wBw2FRvq1QAJB1Zhgde 2bu3lFPi6gdWJF5inlHVrhT3Q186oa037UljZx0Ey5sxL1XKK6oQEPxVIEbTS13n nwbEthEFjbpLE7Hgz4S9x/cYDRrVM+dFNZFvOp+1xg+kJnEfL5nkadHN+DU97QQ1 4ZuqZNnJq7GgXE3GyAadc5S2eVn10YmOx5OJf8Yct5kpLWSxRfozxGQgAtj4Zkni oGTo5w8IgYdhGXYUh1mLgTbW8PZzUCI3uxzyBXYS8uHRlyG88PCa1BtNGpoOrEGz WKDbib3wLsaaJcvLVrjtp2MO4rII+lgO2O8kei6LQ2nUp0HQxXAyDFbdLzMO3TQR YNswzdah34WWWdPBQYHE =sAbW -----END PGP SIGNATURE-----

1 0

[OT] Schema Catalog
by Reinaldo de Carvalho 27 Dec '11

27 Dec '11

Hi, To avoid us create another schema to the same objective, I'd like consult if exist a website that have a catalog of schemas? []s -- Reinaldo de Carvalho http://korreio.sf.net http://python-cyrus.sf.net "While not fully understand a software, don't try to adapt this software to the way you work, but rather yourself to the way the software works" (myself)

1 0

syncrepl: target DIT & directory server compatibility
by Asplund Marko 27 Dec '11

27 Dec '11

Hi, I'm planning on using OpenLDAP syncrepl for replicating a DIT fragment from Novell eDirectory using pull-based synchronisation. If i understood correctly synchronisation requires LDAP Sync protocol support from both the provider and the consumer sides. Any practical experience synchronising between these two different types of directory servers? How do I configure the syncrepl target DIT? For example if i have a database with suffix "dc=example,dc=com" and locally managed entries stored in o=foo,dc=example,dc=com and i'd like to synchronise a DIT from another server to o=bar,dc=example,dc=com How can i configure OpenLDAP to do that? thanks, marko

2 1

cn=config partial replication
by The Ranger 24 Dec '11

24 Dec '11

Hello, I have multiple v. 2.4.23 and 2.4.26 servers doing the master-slave replication using syncrepl. The main server contains multiple subordinate DIT-s that get replicated to different servers: * DIT1 from master to server A, B, C * DIT2 from master to server D, E, F * DIT3 from master to server G etc. Now I would like also to setup the cn=config replication. Actually the most important for me would be the cn=schema,cn=config since everything else is rather static. What would be the best setup with minimal configuration settings/values duplication? There are many howtos on the net how to sync only cn=schema,cn=config, but putting the olcSyncrepl value to olcDatabase={0}config will make the whole DB shadowed and redirect the database config changes to master server which is not the reasonable solution. The best solution would be when the cn=schema,cn=config (and maybe olso the proper olcDatabase subtree) would be synchronized with the master. All the rest of the config database should be locally manageable. I read about the suffixmassage, but this needs ldap server upgrade on 2.4.23 servers (there is no package in debian 6.0.3 for that). And as far as I understand it also requires separate cn=config,cn=slave subtrees on the server with duplicated database configuration and acl definitions etc. I simply try to find the best solution to hit as much problems at once as I can and reduce the config overhead as much as possible. Could you please advise what are my options? -- rgrds, Ivari

1 0

Using ldap_opt_x_tls_require_cert
by Thiyagu Rajendran 23 Dec '11

23 Dec '11

Hi all, I have few question on proper usage of ldap_opt_x_tls_require_cert option. when ldap_opt_x_tls_require_cert is set to LDAP_OPT_X_TLS_ALLOW on ldap handle after ldap_initialize, it was not working. It failed with certificate verify error. But according to the ldap.conf man page, setting LDAP_OPT_X_TLS_ALLOW option should not verify the server certificate After googling around found that LDAP_OPT_X_TLS_ALLOW should be set on global handle. Then got rid of certificate verify error. But I faced a new problem ,changing LDAP_OPT_X_TLS_ALLOW to LDAP_OPT_X_TLS_TRY in the same process doesnt verify the certificate. When i kill the process and restart it, it verifies the certificate properly. Somehow i managed to solve the problem by setting clearing the context using *LDAP_OPT_X_TLS_NEWCTX int tls=**LDAP_OPT_X_TLS_ALLOW* *ldap_set_option(NULL,**LDAP_OPT_X_TLS_REQUIRE_CERT,*&tls) *j=0 ldap_set_option(NULL,**LDAP_OPT_X_TLS_NEWCTX,&j) *But when i try to set *LDAP_OPT_X_TLS_REQUIRE_CERT *after clearing context, it is not working. Can someone explain the correct usage of *LDAP_OPT_X_TLS_REQUIRE_CERT * option* *Regards, Thiyagu

1 0

password-policy configuration problems: cannot change passwords
by Marco Weber 23 Dec '11

23 Dec '11

Hello, I'm running openldap with password policy overlay. after the overlay installation and configuration, we cannot change the passwords anymore. Michael Ströder told that an LDAP modify request should resolve this issue, but it didn't help. [root@ldapsrv ~]# ldappasswd -e ppolicy -D cn=username,dc=domain,dc=tld -S -W New password: Re-enter new password: Enter LDAP Password: Result: Constraint violation (19) Additional info: Password policy only allows one password value control: 1.3.6.1.4.1.42.2.27.8.5.1 false MAA= ppolicy: This is the log: Dec 22 11:15:31 ldapsrv slapd[5056]: conn=4431 fd=39 ACCEPT from IP=192.168.41.41:48899 (IP=0.0.0.0:636) Dec 22 11:15:31 ldapsrv slapd[5056]: conn=4431 fd=39 TLS established tls_ssf=256 ssf=256 Dec 22 11:15:31 ldapsrv slapd[5056]: conn=4431 op=0 BIND dn="cn= username,dc=domain,dc=tld" method=128 Dec 22 11:15:31 ldapsrv slapd[5056]: conn=4431 op=0 BIND dn="cn= username,dc=domain,dc=tld" mech=SIMPLE ssf=0 Dec 22 11:15:31 ldapsrv slapd[5056]: conn=4431 op=0 RESULT tag=97 err=0 text= Dec 22 11:15:31 ldapsrv slapd[5056]: conn=4431 op=1 EXT oid=1.3.6.1.4.1.4203.1.11.1 Dec 22 11:15:31 ldapsrv slapd[5056]: conn=4431 op=1 PASSMOD new Dec 22 11:15:31 ldapsrv slapd[5056]: conn=4431 op=1 RESULT oid= err=19 text=Password policy only allows one password value Dec 22 11:15:31 ldapsrv slapd[5056]: conn=4431 op=2 UNBIND Dec 22 11:15:31 ldapsrv slapd[5056]: conn=4431 fd=39 closed this is my default password policy: dn: cn=password-policy,dc=policies,dc=domain,dc=tld objectClass: person objectClass: pwdPolicy objectClass: top cn: password-policy pwdAttribute: userPassword sn: Default Password Policy pwdAllowUserChange: TRUE pwdExpireWarning: 604800 pwdInHistory: 3 pwdLockout: TRUE pwdLockoutDuration: 7200 pwdMaxAge: 7776000 pwdMaxFailure: 5 pwdMinAge: 180 pwdMinLength: 8 pwdMustChange: TRUE this is my password policy configuration: dn: olcOverlay=ppolicy,dc=policies,dc=domain,dc=tld objectClass: olcConfig objectClass: olcOverlayConfig objectClass: olcPPolicyConfig objectClass: top olcOverlay: ppolicy olcPPolicyDefault: cn=password-policy,dc=policies,dc=domain,dc=tld olcPPolicyUseLockout: TRUE Thanks in advance for any reply, Marco

4 5

Re: ACL Problem
by Selcuk Yazar 23 Dec '11

23 Dec '11

Hi, Ok my rule is access to dn.regex="^mail=([^,]+),ou=([^,]+),jvd=([^,]+),o=hosting,dc=myhosting,dc=example$" attrs=userPassword by dn.exact="mail=$1,ou=$2,jvd=$3,o=hosting,dc=myhosting,dc=example" write by dn.exact,expand="mail=$1,ou=$2,jvd=$3,o=hosting,dc=myhosting,dc=example" read by dn="cn=Manager,dc=myhosting,dc=example" write by users none by * none this doesn't work , users can't change their own password. Also try this; access to attrs=userpassword by self write by anonymous auth by dn="cn=Manager,dc=myhosting,dc=example" write by users none by * none doesn't work again. open ldap have another parameter for these things ??? ?? On Tue, Dec 20, 2011 at 8:56 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Tuesday, December 20, 2011 4:28 PM +0200 Selcuk Yazar < > selcuk.yazar(a)gmail.com> wrote: > > access to >> dn.regex="(.*,ou=(.+),jvd=([^,**]+),o=hosting,dc=myhosting,dc=**example)" >> attrs=userPassword >> by self write >> by users write >> > > "by users write" will allow any authenticated user to overwrite anyone's > password. I'm guessing you really do *not* want this rule. > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Selçuk YAZAR http://www.selcukyazar.blogspot.com

3 3

userCertificate, wrong attribute type?
by Nicolas KOWALSKI 22 Dec '11

22 Dec '11

Hello, Using OpenLDAP 2.4.12 (SLES 2011 SP1), I am trying to add a userCertificate attribute to an existing user (inetOrgPerson object). I converted the PEM file containing the certificate to DER format, then created this ldif: dn: cn=Nicolas.Kowalski,ou=people,dc=home,dc=lan changetype: modify add: userCertificate userCertificate;binary:< file:///root/ssl/Nicolas.Kowalski-crt.der But when I try to update the entry, I always get this error: # ldapmodify -x -W-D "cn=Manager,dc=home,dc=lan" -f the-ldif-above ldapmodify: wrong attributeType at line 4, entry "cn=Nicolas.Kowalski,ou=people,dc=home,dc=lan" What am I doing wrong? Thanks, -- Nicolas

1 1

Ldap problems in paradise, working with suse 12.1 miles stone 5
by John Tobin 22 Dec '11

22 Dec '11

Dear Ralf, Hi, I hope you are still here before the holidays, I would appreciate your advice and counsel. I have Suse 12.1 up, mile stone 5. It works well. I have installed and used ldap 2.4.26. It is also working with nss_ldap code. I am having some trouble on 2 counts. First I tried to get start_tls, and / or ldaps to work in that environment. I have not gotten tls to work. Was this tested at all in SUSE? TLS is critical to some success in the university lab I am running over here. I have posted the problem to the open ldap crew, and have heard nothing from anyone for solving the problem, or even assistance in how to debug it, or understand the failure I get.....[this is from nss_ldap] >> Oct 28 11:29:01 nightmare slapd[11118]: conn=1217 op=0 STARTTLS >> Oct 28 11:29:01 nightmare worker_nscd: nss-ldap: do_open: do_start_tls >> failed:stat=-1 >> Oct 28 11:29:01 nightmare slapd[11118]: connection_read(14): TLS accept >> failure error=-1 id=1217, closing >> Oct 28 11:29:01 nightmare slapd[11118]: conn=1217 fd=14 closed (TLS >> negotiation failure) >> Oct 28 11:29:01 nightmare slapd[11118]: conn=1218 op=0 STARTTLS >> Oct 28 11:29:01 nightmare worker_nscd: nss-ldap: do_open: do_start_tls >> failed:stat=-1 In the middle of this mess Chris wood mentioned this would be easier, and may well work under nslcd. OK. I installed nslcd.... I have the lastest I believe: 0.7.13-7.3 I setup nslcd.conf to the best of my ability. With just a : Uri ldap://192.168.0.10/ Base dc=dark,dc=net Scope sub It works fine. For user jtobin [is only in ldap server] I get a login But in a similar fashion to nss_ldap, when I turn on ssl start_tls And add to the nslcd.conf above: Ssl start_tls Tls_reqcert allow Tls_cacertfile /var/lib/ldap/cacert.pem Tls_cert /var/lib/ldap/server.crt Tls_key /var/lib/ldap/server.key It fails.... I get: user jtobin does not exist But worse... I get nothing in the /var/log/localmessages file for debugging. Certificates were created using www.opeldap.org/faq/data/cache/185.html Which to my knowledge is the referenced site for openldap The certificate is a self signed cert. Most of my testing at the moment is local.... Client and slapd server are on the same machine, so same certificate file for tls_cacertfile, tls_cert, tls_key, though I have tested on remote clients with the same results. I see your name on a number of the nslcd doc and email. Help me out here.... How can I get this working / debugged? Who would have some of the information I need? Who would be interested in helping me to get this working. So far all I have gotten is a number of messages from interested parties asking me if I have gotten to work yet... Drop me aline with some advice as to how to get this resolved, or if it is probably not a short term Priority for anyone, tell me that. I will find a different strategy for securing my lab ldap client and server machines. [is getting this to work a priority at SUSE? Is there someone I can work with?] Sincerely tob There are a number of comments but the real statements are: Uri ldap://192.168.0.10/ Base dc=dark,dc=net Scope sub Ssl start_tls

2 1

Auto increment (uidNext and uidNumber)
by Pablo 21 Dec '11

21 Dec '11

Hello, Based on this article: http://www.rexconsulting.net/ldap-protocol-uidNumber.html. I am trying to increment 'uidNumber'. For doing that, I am using this LDIF file: --------------- autoinc.ldif --------------------------- dn: cn=uidNext,dc=example,dc=com changetype: modify delete:uidNumber uidNumber: 610 - add: uidNumber uidNumber: 611 ------------------- EOF -------------------------------- And this command; but produce an error: $ ldapadd -x -D "cn=Admin,dc=example,dc=com" -wsecret -f ./autoinc.ldif adding new entry "cn=uidNext,dc=example,dc=com" ldapadd: Undefined attribute type (17) additional info: add: attribute type undefined $ This is the definition of the uidNext objectClass: ---------------------------------------------- objectClass ( 1.3.6.1.4.1.4203.666.599 NAME 'uidNext' SUP top STRUCTURAL MUST ( cn $ uidNumber ) ) ---------------------------------------------- Any idea of what I am doing wrong here? Thanks in advance. Pablo.

5 6

(no subject)
by Molo CoC 21 Dec '11

21 Dec '11

hi all, i hope i am in the correct list :( for lpic train iam using ldap 2.3.43 mit BerkleyDB 4.2 and libdb4.2 + libdb4.2-dev on latest Debian (64B) unfortunatly i am facing 2 Errors during installation of openLDAP: first is: getpeereid.c:52: error: storage size of ‘peercred’ isn’t known (during executing command: make) and a lot of: missing binary operator befor "(" i hope you can give ma an advice thanks a lot! ___________________________________________________________ SMS schreiben mit WEB.DE FreeMail - einfach, schnell und kostenguenstig. Jetzt gleich testen! http://f.web.de/?mc=021192

3 2

problem with openldap identity assertion to AD server
by John Uhlig 21 Dec '11

21 Dec '11

Hello. I am new to this list so please forgive any protocol violations :) I am starting with simple steps towards our goal to use the openldap server translucent overlay config to merge AD authentication for people at our company with local ldap account authentication for non-company people. I am using openldap 2.4.23 on RHEL6 server. At this point, the ldap server can access our AD servers with anonymous bind but I need authenticated access to get more information. I have been using variations of the "Identity Assertion" steps from the openldap FAQ page (http://www.openldap.org/faq/data/cache/532.html) without success. I am initially trying the simplest config e.g. bindmethod=simple with a valid AD account/password for this access. I have included my current minimalist slapd.conf file if of any help. If anyone can point me to sample working configuration file(s) or provide any recommendations, I would appreciate it. thanks, John. ------------------------------------------ # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/misc.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ###TLSCipherSuite HIGH:MEDIUM:+SSLv2 #TLSCACertificateFile /usr/var/openldap-data/cacert.pem ###TLSCertificateFile /etc/openldap/cacerts/parcldscert.pem ###TLSCertificateKeyFile /etc/openldap/cacerts/parclds.pem ###TLSVerifyClient allow TLSVerifyClient never ### Will use TLS after I get authenticated bind working ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=corp,dc=ad,dc=parc,dc=com" rootdn "cn=Manager,dc=corp,dc=ad,dc=parc,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw {SSHA}EwrR01/GdI4+sdOVzZcK6Y94QbIXIw0j # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. sizelimit unlimited directory /var/lib/ldap # Indices to maintain index objectClass eq ### debug logging loglevel -1 # try transl overlay config here moduleload translucent overlay translucent translucent_local carLicense uri ldap://ADserver.corp.ad.parc.com lastmod off # idassert-bind bindmethod=simple binddn=cn=ldapacct,OU=Pseudo_User_Accounts,OU=PARC_Users,DC=corp,DC=ad,DC=parc,DC=com credentials="password" authzID=dn:cn=ldapacct,OU=Pseudo_User_Accounts,OU=PARC_Users,DC=corp,DC=ad,DC=parc,DC=com [root@virtuosity-vm84 configs]#

2 1

ACL Problem
by Selcuk Yazar 20 Dec '11

20 Dec '11

Hi, I want to ldap users to change their password. sample user dn is mail=edergi@.....mail......edu.tr<http://193.255.140.119/phpldapadmin/htdocs/cmd.php?cmd=template_engine&serv…> ,ou=<http://193.255.140.119/phpldapadmin/htdocs/cmd.php?cmd=template_engine&serv…> SOME_UNIT,jvd=.....mail.......edu.tr<http://193.255.140.119/phpldapadmin/htdocs/cmd.php?cmd=template_engine&serv…> ,o=hosting<http://193.255.140.119/phpldapadmin/htdocs/cmd.php?cmd=template_engine&serv…> and we have acl rules in slapd.conf access to dn.regex=".*,ou=.*,jvd=([^,]+),o=hosting,dc=myhosting,dc=example" attrs=userPassword by self write by group/jammPostmaster/roleOccupant.expand="cn=postmaster,jvd=$1,o=hosting,dc=myhosting,dc=example" write by * auth by * none access to dn.regex=".*jvd=([^,]+),o=hosting,dc=myhosting,dc=example" by self write by group/jammPostmaster/roleOccupant.expand="cn=postmaster,jvd=$1,o=hosting,dc=myhosting,dc=example" write by * read access to * by * read i apply various rules from openldap documentation, but no one works. why users can't chage their password ? thanks in advance -- Selçuk YAZAR

5 6

ppolicy overlay
by Selcuk Yazar 20 Dec '11

20 Dec '11

Hi i've installed succefully, ppolicy overlay and ldap password policy objects my directroy. So what do i expected for now ? because nothing happened. we are using jamm mail account schemas and sample accounts very old, and i expected expire all of them but nothing happened. what is the correct settigns of ppolicy_default_dn ? thanks inadvance.

2 1

Ver2.4.23 - Delta syncrepl stops responding
by david m 20 Dec '11

20 Dec '11

I have a problem that has just started happening in the last few weeks. Replication of modifications and/or adds from one LDAP node to the other will work fine ( repl time <1s) for a while, then suddenly stop working all together. The only way to get replication working again is to restart each node 2 or 3 times (sometimes it comes back after 2 restarts, sometimes it takes 3). On the last restart, I usually find that one node is stuck in an infinite loop trying to process a transaction from the other node's accesslog - the only way to get around this is to delete the the accesslog entry (see below for accesslog entry and slapd output). Any ideas? OS: OpenSuse 11.1 64-bit w/ 2GB RAM Version: OpenLDAP 2.4.23 Network Setup: 2 read/write nodes, with delta syncrepl between the nodes SERVER 1 Configs: dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/slapd/slapd.args olcAuthzRegexp: {0}gidNumber=0\+uidNumber=0,cn=peercred,cn=external,cn=auth dn:cn=config olcLogLevel: stats sync olcPidFile: /var/run/slapd/slapd.pid olcServerID: 1 ldap://LDAP1:389 olcServerID: 2 ldap://LDAP2:389 olcSizeLimit: 10000 dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig olcDatabase: {-1}frontend olcAccess: {0}to dn.base="" by * read olcAccess: {1}to dn.base="cn=Subschema" by * read olcAccess: {2}to * by dn.base="cn=admin,o=o" manage dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.base="cn=admin,o=o" manage olcAccess: {1}to * by * read olcRootDN: cn=config dn: olcDatabase={1}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcAccess: {0}to attrs=pwdChangedTime,pwdAccountLockedTime,pwdFailureTime,pwdHistory,pwdGraceUseTime,pwdReset by * none olcAccess: {1}to attrs=userPassword by self write by * auth by dn.base="cn=admin,o=o" manage olcAccess: {2}to attrs=shadowLastChange by self write by * read olcAccess: {3}to attrs=userPKCS12 by self read by * none olcAccess: {4}to * by * read by dn.base="cn=admin,o=o" manage olcDbCheckpoint: 1024 5 olcDbConfig: {0}set_cachesize 0 151200000 1 olcDbConfig: {1}set_lg_regionmax 262144 olcDbConfig: {2}set_lg_bsize 2097152 olcDbConfig: {3}set_flags DB_LOG_AUTOREMOVE olcDbIDLcacheSize: 151200000 olcDbIndex: objectclass eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: member eq olcDbIndex: memberUid eq olcDbIndex: mail eq olcDbIndex: cn eq,sub olcDbIndex: displayName eq,sub olcDbIndex: uid eq,sub olcDbIndex: sn eq,sub olcDbIndex: givenName eq,sub olcDbIndex: entryCSN eq olcDbIndex: entryUUID eq olcLimits: {0}dn.exact="cn=admin,o=o" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited olcMirrorMode: TRUE olcRootDN: cn=admin,o=o olcRootPW: {SSHA}PWD olcSuffix: o=o olcSyncrepl: {0}rid=2 provider=ldap://LDAP2:389 binddn="cn=admin,o=o" bindmethod=simple credentials=PWD searchbase="ou=USERS,o=o" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" schemachecking=off type=refreshAndPersist retry="60 +" syncdata=accesslog dn: olcOverlay={0}ppolicy,olcDatabase={1}hdb,cn=config objectClass: olcPPolicyConfig olcOverlay: {0}ppolicy olcPPolicyDefault: cn=Default Policy,o=o olcPPolicyHashCleartext: TRUE olcPPolicyUseLockout: TRUE dn: olcOverlay={1}syncprov,olcDatabase={1}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {1}syncprov olcSpCheckpoint: 100 1 olcSpSessionlog: 100 dn: olcOverlay={2}accesslog,olcDatabase={1}hdb,cn=config objectClass: olcAccessLogConfig objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top olcAccessLogDB: cn=accesslog olcOverlay: {2}accesslog olcAccessLogOps: writes olcAccessLogPurge: 03+00:00 01+00:00 olcAccessLogSuccess: TRUE dn: olcDatabase={2}accesslog,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {2}hdb olcDbDirectory: /var/lib/ldap_accesslog olcAccess:: ezB9dG8gKiBieSBkbi5iYXNlPSJjbj1hZG1pbixvPWNvIiBtYW5hZ2Ug olcDbCheckpoint: 1024 5 olcDbConfig: {0}set_cachesize 0 9948000 1 olcDbConfig: {1}set_lg_regionmax 262144 olcDbConfig: {2}set_lg_bsize 2097152 olcDbConfig: {3}set_flags DB_LOG_AUTOREMOVE olcDbIDLcacheSize: 9948000 olcDbIndex: entryCSN eq olcDbIndex: objectClass eq olcDbIndex: reqEnd eq olcDbIndex: reqResult eq olcDbIndex: reqStart eq olcDbIndex: default eq olcLimits: {0}dn.exact="cn=admin,o=o" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited olcSuffix: cn=accesslog dn: olcOverlay={0}syncprov,olcDatabase={2}accesslog,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpCheckpoint: 100 1 olcSpNoPresent: TRUE olcSpReloadHint: TRUE olcSpSessionlog: 100 dn: olcDatabase={3}monitor,cn=config objectClass: olcMonitorConfig olcDatabase: {3}monitor olcAccess: {0}to * by dn.base="cn=admin,o=o" manage olcAccess: {1}to * by * none olcMonitoring: true -------------------------- SERVER 2 Configs: version: 1 dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/slapd/slapd.args olcAuthzRegexp: {0}gidNumber=0\+uidNumber=0,cn=peercred,cn=external,cn=auth dn:cn=config olcLogLevel: stats sync olcPidFile: /var/run/slapd/slapd.pid olcServerID: 1 ldap://LDAP1:389 olcServerID: 2 ldap://LDAP2:389 olcSizeLimit: 10000 dn: olcDatabase={-1}frontend,cn=config objectClass: olcDatabaseConfig olcDatabase: {-1}frontend olcAccess: {0}to dn.base="" by * read olcAccess: {1}to dn.base="cn=Subschema" by * read olcAccess: {2}to * by dn.base="cn=admin,o=o" manage dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.base="cn=admin,o=o" manage olcAccess: {1}to * by * read olcRootDN: cn=config dn: olcDatabase={1}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcAccess: {0}to attrs=pwdChangedTime,pwdAccountLockedTime,pwdFailureTime,pwdHistory,pwdGraceUseTime,pwdReset by * none olcAccess: {1}to attrs=userPassword by self write by * auth by dn.base="cn=admin,o=o" manage olcAccess: {2}to attrs=shadowLastChange by self write by * read olcAccess: {3}to attrs=userPKCS12 by self read by * none olcAccess: {4}to * by * read by dn.base="cn=admin,o=o" manage olcDbCheckpoint: 1024 5 olcDbConfig: {0}set_cachesize 0 151200000 1 olcDbConfig: {1}set_lg_regionmax 262144 olcDbConfig: {2}set_lg_bsize 2097152 olcDbConfig: {3}set_flags DB_LOG_AUTOREMOVE olcDbIDLcacheSize: 151200000 olcDbIndex: objectclass eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: member eq olcDbIndex: memberUid eq olcDbIndex: mail eq olcDbIndex: cn eq,sub olcDbIndex: displayName eq,sub olcDbIndex: uid eq,sub olcDbIndex: sn eq,sub olcDbIndex: givenName eq,sub olcDbIndex: entryCSN eq olcDbIndex: entryUUID eq olcLimits: {0}dn.exact="cn=admin,o=o" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited olcMirrorMode: TRUE olcRootDN: cn=admin,o=o olcRootPW: {SSHA}PWD olcSuffix: o=o olcSyncrepl: {0}rid=1 provider=ldap://LDAP1:389 binddn="cn=admin,o=o" bindmethod=simple credentials=PWD searchbase="ou=USERS,o=o" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" schemachecking=off type=refreshAndPersist retry="60 +" syncdata=accesslog dn: olcOverlay={0}ppolicy,olcDatabase={1}hdb,cn=config objectClass: olcPPolicyConfig olcOverlay: {0}ppolicy olcPPolicyDefault: cn=Default Policy,o=o olcPPolicyHashCleartext: TRUE olcPPolicyUseLockout: TRUE dn: olcOverlay={1}syncprov,olcDatabase={1}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {1}syncprov olcSpCheckpoint: 100 1 olcSpSessionlog: 100 dn: olcOverlay={2}accesslog,olcDatabase={1}hdb,cn=config objectClass: olcAccessLogConfig objectClass: olcOverlayConfig objectClass: olcConfig objectClass: top olcAccessLogDB: cn=accesslog olcOverlay: {2}accesslog olcAccessLogOps: writes olcAccessLogPurge: 03+00:00 01+00:00 olcAccessLogSuccess: TRUE dn: olcDatabase={2}accesslog,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {2}hdb olcDbDirectory: /var/lib/ldap_accesslog olcAccess:: ezB9dG8gKiBieSBkbi5iYXNlPSJjbj1hZG1pbixvPWNvIiBtYW5hZ2Ug olcDbCheckpoint: 1024 5 olcDbConfig: {0}set_cachesize 0 9948000 1 olcDbConfig: {1}set_lg_regionmax 262144 olcDbConfig: {2}set_lg_bsize 2097152 olcDbConfig: {3}set_flags DB_LOG_AUTOREMOVE olcDbIDLcacheSize: 9948000 olcDbIndex: entryCSN eq olcDbIndex: objectClass eq olcDbIndex: reqEnd eq olcDbIndex: reqResult eq olcDbIndex: reqStart eq olcDbIndex: default eq olcLimits: {0}dn.exact="cn=admin,o=o" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited olcSuffix: cn=accesslog dn: olcOverlay={0}syncprov,olcDatabase={2}accesslog,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpCheckpoint: 100 1 olcSpNoPresent: TRUE olcSpReloadHint: TRUE olcSpSessionlog: 100 dn: olcDatabase={3}monitor,cn=config objectClass: olcMonitorConfig olcDatabase: {3}monitor olcAccess: {0}to * by dn.base="cn=admin,o=o" manage olcAccess: {1}to * by * none olcMonitoring: true -------------------------- Bad accesslog entry & slapd output version: 1 ####From Transaction recorded in accesslog on LDAP1 dn: reqStart=20111212033402.000002Z,cn=accesslog objectClass: auditModify reqAuthzID: cn=admin,o=co reqDN: cn=bob,ou=users,o=co reqEnd: 20111212033402.000003Z reqMod: userPassword:= {SSHA}PWD reqMod: pwdChangedTime:= 20111212033402Z reqMod: entryCSN:= 2011 12 12 03 34 02.374746Z#000000#001#000000 reqMod: modifiersName:= cn=admin,o=o reqMod: modifyTimestamp:= 20111212033402Z reqResult: 0 reqSession: 3296 reqStart: 20111212033402.000002Z reqType: modify #####Log Of LDAP2 after 2nd restart (No Related Log info on LDAP1 during that timeframe) Dec 12 07:54:43 LDAP2 slapd[2732]: slap_queue_csn: queing 0x7f093b746ea5 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_graduate_commit_csn: removing 0x7f093b639100 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: do_syncrep2: rid=001 cookie=rid=001,sid=001,csn=20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_queue_csn: queing 0x7f093b746ea5 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_graduate_commit_csn: removing 0x7f093b568240 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: do_syncrep2: rid=001 cookie=rid=001,sid=001,csn=20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_queue_csn: queing 0x7f093b746ea5 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_graduate_commit_csn: removing 0x7f093b639100 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: do_syncrep2: rid=001 cookie=rid=001,sid=001,csn=20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_queue_csn: queing 0x7f093b746ea5 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_graduate_commit_csn: removing 0x7f093b568240 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: do_syncrep2: rid=001 cookie=rid=001,sid=001,csn=20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_queue_csn: queing 0x7f093b746ea5 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_graduate_commit_csn: removing 0x7f093b639100 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: do_syncrep2: rid=001 cookie=rid=001,sid=001,csn=20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_queue_csn: queing 0x7f093b746ea5 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_graduate_commit_csn: removing 0x7f093b568240 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: do_syncrep2: rid=001 cookie=rid=001,sid=001,csn=20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_queue_csn: queing 0x7f093b746ea5 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_graduate_commit_csn: removing 0x7f093b639100 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: do_syncrep2: rid=001 cookie=rid=001,sid=001,csn=20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_queue_csn: queing 0x7f093b746ea5 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_graduate_commit_csn: removing 0x7f093b568240 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: do_syncrep2: rid=001 cookie=rid=001,sid=001,csn=20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_queue_csn: queing 0x7f093b746ea5 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_graduate_commit_csn: removing 0x7f093b639100 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: do_syncrep2: rid=001 cookie=rid=001,sid=001,csn=20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_queue_csn: queing 0x7f093b746ea5 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_graduate_commit_csn: removing 0x7f093b568240 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: do_syncrep2: rid=001 cookie=rid=001,sid=001,csn=20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_queue_csn: queing 0x7f093b746ea5 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_graduate_commit_csn: removing 0x7f093b639100 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: do_syncrep2: rid=001 cookie=rid=001,sid=001,csn=20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_queue_csn: queing 0x7f093b746ea5 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_graduate_commit_csn: removing 0x7f093b568240 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: do_syncrep2: rid=001 cookie=rid=001,sid=001,csn=20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_queue_csn: queing 0x7f093b746ea5 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_graduate_commit_csn: removing 0x7f093b639100 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: do_syncrep2: rid=001 cookie=rid=001,sid=001,csn=20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_queue_csn: queing 0x7f093b746ea5 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: slap_graduate_commit_csn: removing 0x7f093b568240 20111212033402.374746Z#000000#001#000000 Dec 12 07:54:43 LDAP2 slapd[2732]: do_syncrep2: rid=001 cookie=rid=001,sid=001,csn=20111212033402.374746Z#000000#001#000000

2 1

re: OpenLDAP for Central Auth?
by Juergen.Sprenger＠swisscom.com 19 Dec '11

19 Dec '11

Hi Craig, > Hi, > > Has anyone successfully deployed OpenLDAP for central auth in a very mixed unix environment? With Host > based access control? Plus any documentation would be really great. > > My needs; > - Central Auth > - Host based access control (e.g. user "John" from group "accounts" can't log into "development servers". > - Caching for Client logins on laptops. I figure SSSD will be useful here? > - Encryption (This looks pretty straight forward in the OpenLDAP 2.4 doco) > > Client OS's involved; > - Solaris 9/10 > - Fedora 15/16 > - Centos 5/6 > > > cya > > Craig A solution which will cover most of Your needs is in production here: Central Auth Client OS's: - Solaris 9/10 (working on 11) - HPUX 11.x - AIX 5/6 - Fedora/Redhat Host based access control: - nis-netgroups for hosts - nis-netgroups for users - members of user-netgroup 'oracle_dba' can log into machines from host-netgroup 'oracle_db_server' Role based access control: - sudo profiles for each role - sudoUser by user-netgroups (example: 'oracle_dba') - sudoHost by host-netgroups (example: oracle_db_server') Encryption: tls/ssl Pretty much straight forward from standard docs. Juergen Sprenger

2 1

Trying to add vacation.schema - object class violation error
by Andreas Cieslak 19 Dec '11

19 Dec '11

Hi list, I need some urgent advices on the openldap-scheme extension. My openldap version is slapd 2.4.23 on a debian squezze machine. When I try to activate vacation on the webmail-system roundcube (the webmailer and the plugins are working fine) it says the the activation is stored, but when I have a look into the logs of round cube, they say: [16-Dec-2011 11:20:29] Could not add new values to attribute vacationActive: Object class violation: LDAP_OBJECT_CLASS_VIOLATION (65): [16-Dec-2011 11:20:29] Could not modify entry: Could not add new values to attribute vacationActive: Object class violation: LDAP_OBJECT_CLASS_VIOLATION: (1000): The slapd-logs shows the following when I try to activate vacation: conn=1221 op=4 MOD dn="cn=admin,dc=domain,dc=de" slapd[14608]: conn=1221 op=4 MOD attr=vacationActive serv slapd[14608]: slap_queue_csn: queing 0xb58969b6 20111216110200.012914Z#000000#000#000000 serv slapd[14608]: Entry (cn=ldapadmin,dc=folkwang-hochschule,dc=de), attribute 'vacationActive' not allowed serv slapd[14608]: entry failed schema check: attribute 'vacationActive' not allowed serv slapd[14608]: conn=1221 op=4 RESULT tag=103 err=65 text=attribute 'vacationActive' not allowed The following is my vacation.schema which I add to /etc/ldap/slapd.conf: attributetype ( 1.3.6.1.4.1.39116.1.1.11 NAME 'vacationActive' SINGLE-VALUE EQUALITY booleanMatch DESC 'A flag, for marking the user as being away' SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 ) attributetype ( 1.3.6.1.4.1.39116.1.1.12 NAME 'vacationInfo' SINGLE-VALUE SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 DESC 'Absentee note to leave behind, while on vacation' EQUALITY octetStringMatch ) attributetype ( 1.3.6.1.4.1.39116.1.1.13 NAME 'vacationStart' SINGLE-VALUE SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 DESC 'Beginning of vacation' EQUALITY octetStringMatch ) attributetype ( 1.3.6.1.4.1.39116.1.1.14 NAME 'vacationEnd' SINGLE-VALUE SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 DESC 'End of vacation' EQUALITY octetStringMatch ) attributetype (1.3.6.1.4.1.39116.1.1.15 NAME 'vacationForward' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} DESC 'Where to forward mails to, while on vacation' ) # # Objects start here # objectclass ( 1.3.6.1.4.1.39116.1.2.10 NAME 'vacation' SUP top AUXILIARY DESC 'Users vacation status information' MUST vacationActive MAY ( vacationInfo $ vacationStart $ vacationEnd $ vacationForward ) ) I imported a user with the object class vacation and the attributes vacationActive, vacationInfo . into my ldap database. There the import looks fine. The user has got the privileges to modify the vacation attributes. But when I try to modify the entries via vacation-plugin on roundcube, the above errors occur. Can anybody give me some advices, please? Thanks Andreas

3 4

OpenLDAP for Central Auth?
by Craig T 19 Dec '11

19 Dec '11

Hi, Has anyone successfully deployed OpenLDAP for central auth in a very mixed unix environment? With Host based access control? Plus any documentation would be really great. My needs; - Central Auth - Host based access control (e.g. user "John" from group "accounts" can't log into "development servers". - Caching for Client logins on laptops. I figure SSSD will be useful here? - Encryption (This looks pretty straight forward in the OpenLDAP 2.4 doco) Client OS's involved; - Solaris 9/10 - Fedora 15/16 - Centos 5/6 cya Craig

5 7

Password Policy Effects
by Selcuk Yazar 18 Dec '11

18 Dec '11

Hi i've installed succefully, ppolicy overlay and ldap password policy objects my directroy. So what do i expected for now ? because nothing happened. we are using jamm mail account schemas and sample accounts very old, and i expected expire all of them but nothing happened. what is the correct settigns of ppolicy_default_dn ? thanks inadvance. -- Selçuk YAZAR http://www.selcukyazar.blogspot.com

1 0

Password Policy
by Selcuk Yazar 17 Dec '11

17 Dec '11

Hi, we are using openldap on redhat EL6 with postfix and JAMM schema. I wantto activate password policy for ldap but i cannot add default password schema , i try to apply step that tells on http://www.zytrax.com/books/ldap/ch6/ppolicy.html but i cannot add dn: cn=default,ou=policies,dc=myhosting,dc=example class, it gives ldap_bind: Invalid DN syntax (34) additional info: invalid DN error. what is the problem ? thanks in advance [image: image.png] -- Selçuk YAZAR http://www.selcukyazar.blogspot.com

2 2

Adding an object class with required attributes to an existing entry
by Nick Milas 16 Dec '11

16 Dec '11

Hi, I want to add a new objectclass using an ldif; this objectclass requires some attributes (according to schema). I can't make it work. For posixAccount class, required attributes are: cn gidNumber homeDirectory uid uidNumber I already have cn and uid. I am trying: dn: uid=userx,ou=people,dc=example,dc=com changetype: modify add: ObjectClass objectClass: posixAccount uidNumber: 1700 homeDirectory: /var/members/userx gidNumber: 48 loginShell: /bin/false and it fails. I've tried other ways too, like including existing objectclasses in the LDIF (I've read about that in a blog), using a separate add statement for optional attribute loginShell, etc. but nothing worked. If the ObjectClass to add does not specify REQUIRED attributes in the schema, there is no problem in adding it. How should I formulate the LDIF? Please advise. Thanks, Nick

3 6

Mozilla NSS / OpenLdap 2.4.23 cert not readable?
by Aaron Bennett 16 Dec '11

16 Dec '11

Hello, I'm trying to grok Mozilla NSS prior to deploying Openldap 2.4.23 on RHEL 6.2. I've been working through creating a self-signed cert and I think I have one that works. At least, if I do: [root@animal ~]# certutil -d /etc/pki/nssdb/ -L Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI its Cu,Cu,Cu animal.clarku.edu p,p,p the its cert is the one I used to sign. If I do: [root@animal ~]# certutil -d /etc/pki/nssdb/ -L -n animal.clarku.edu Then I see a normal looking cert: Certificate: Data: Version: 3 (0x2) Serial Number: 00:96:7c:e7:ea Signature Algorithm: PKCS #1 SHA-1 With RSA Encryption Issuer: "CN=ITS Self Signed" Validity: Not Before: Mon Dec 12 16:01:27 2011 Not After : Mon Mar 12 16:01:27 2012 Subject: "CN=animal.clarku.edu,O=Clark University ITS,L=Worcester,ST= Massachusetts,C=US" Here's what I've got in cn=config: olcTLSCACertificatePath: /etc/pki/nssdb/ olcTLSCertificateFile: animal.clarku.edu If do those commands as the ldap user with sudo -u ldap, I get the same output. I can even run "certutil -V -n animal.clarku.edu -u SR -d /etc/pki/nssdb/" and I get "certificate is valid". However when I start slapd, I get: [root@animal slapd.d]# service slapd start animal.clarku.edu is not readable by "ldap" [WARNING] Starting slapd: [ OK ] What am I missing? Thanks, Aaron --- Aaron Bennett Manager of Systems Administration Clark University ITS

4 8

Ldap+Nfsv4+kerberos *nix / *bsd puzzle.
by Harry Coin 16 Dec '11

16 Dec '11

Hello group! Looking for guidance on an ldap+NFS4+Kerberos puzzle in a mixed OS local environment. Simple demo case, four computers on a little net. box 1: Running openlap server, kerberos KDC, kadmin, lets say it's running freebsd, doesn't matter. nfs server & client. box 2: Linux box. nfs server & client. box 3: *bsd/Solaris box. nfs server & client. box 4: misc user box, could be *bsd or *nix. Networking: Nfs4 secured with kerberos. That means No uid/gid numbers on the wire, only user@box. NSS is active on all boxes, reaching out to the ldap server on box 1 for info for what is not in the local passwd file searched first. Popular package X gets installed on box 2 and box 3. Package X is a drop-root privilege package, has its own uid/gid!=0. It is active on the net, might write log files or get data files via nfs on either of the other two computers in the setup. The maintainers for package X in the *bsd world have chosen a different number for the uid / gid for the package X daemon than the maintainers for package X have chosen in the *nix world. Those get written in the local passwd file on each system at package X install / download time. Note: Package X does _not_ get installed on the ldap server box #1, or box #4. There is no entry in the #1 or #4 system's passwd file for nss to find for the daemon associated with package X. nfsuserd via nss must find the package X user in ldap or the files will be unreadable or seem 'owned' by nobody:nogroup on 1 or 4 if say config or log files edited/accessed from there. Puzzle: What should the posixAccount uidNumber and gidNumber value be in ldap for uid=packageXdaemon? Alternatives: 1: Choose no entry, leave it out of the ldap db: PackageXDaemon's files will be owned by nobody:nogroup on box 1. Security Fail. 2: Choose *nix for the uid/gid in the ldap database on box 1. Fail: The files will be stored with a uid/gid that might collide with another account in the passwd database on the *bsd server. 3: Choose *bsd for the uid/gid in the ldap database on box 1: Fail: The *nix user on box 4's nfsuserid will get the bsd uid/gid from ldap which could create files not actually owned by something colliding in the *nix passwd database on box 4. 4: Instead storing all the users once under an ou=Account... create ou=AccountBSD and ou=AccountNix, duplicate the whole account tree but vary the apropos uid/gid pair under each tree with all the other remaining equal, manage collisions when amending the database. Not so pretty. 5: Edit the schema to replace uidNumber and gidNumber with uidNixNumber / uidBsdNumber & etc. for gid. Breaks code expecting standard uidNumber gidNumber in the default ldap schemas. There are so many packages that could be X, you can imagine not wanting to have to qualify and patch all of them to use a common uid/gid number. (And it gets even worse in a mixed nfs3 / nfs4 environment where uid/gid numbers actually go over the wire in some cases, and user@box in others, let's leave that to the side for now). I'm leaning toward #5 to avoid storing all the other account information under two different trees. But I'd prefer a scheme were there is a not-edited standard schema tree stored once under 'ou=Account' but with a different overlay for the uid/gid elements if looked up as AccountNix or AccountBsd. I'm sure someone has done battle with this already, what's the right answer? Thanks Harry Coin

3 3

slapdindex
by Allan E. Johannesen 16 Dec '11

16 Dec '11

First, I'm running 2.4.27 A year and a half ago, running 2.4.something-less-than-27, we installed a device which queried LDAP and was causing a load on the ldap servers. I found it was looking for an attribute we didn't have. I indexed the attribute and I believed that the load was reduced. I did not add the objectclass which offered the attribute to our objectclasses. Was I imagining things? Recently, we have another black box that queries ldap. I can't control the attributes which it requests. I added the attributes to the index and ran the slapindex and no new .bdb files were generated, even using the -q -t flags, which claims to truncate a database before scanning for the attribute. That sounded like a way to maybe trick it into making an empty database, but no dice. As an experiment, I ran slapadd to create a new database, with those attributes in the index list. It didn't add any of them, nor did it create that single attribute which I believed I had "fixed" last year. I'm reasonably sure that prior openldap versions of both slapindex and slapadd would create the index for an attribute listed as indexed without it appearing in the data. I'm curious to know if I was wrong that indexing an attribute would speed the search even if the attribute did not appear in the schemas used. Also, does this mean that I have to add whatever schema that new ldap-client black-box wants to search in order to make the index in order to reduce that client's ldap server load? Thanks for any insights.

1 0

Fresh install on debian with cn=config and slapd.conf conversion
by reyman 16 Dec '11

16 Dec '11

On Thu, Dec 15, 2011 at 10:24 AM, Raffael Sahli <public(a)raffaelsahli.com>wrote: > On 12/15/2011 09:46 AM, rey sebastien wrote: > >> Le jeu. 15 déc. 2011 08:51:29 CET, Raffael Sahli a écrit : >> >>> >>> >>>> OK, it's work, i have a fonctionnal slapd.d/cn=config folder, but i >>>> don't understand why i can't access to openldap with >>>> cn=admin,dc=parisgeo,dc=cnrs,**dc=fr and good password generated by >>>> >>>> >>>> My slapd.conf before conversion contain the SSHA password generated by >>>> slappasswd for rootDn : >>>> ----- >>>> >>>> database bdb >>>> suffix "dc=parisgeo,dc=cnrs,dc=fr" >>>> rootdn "cn=admin,dc=parisgeo,dc=cnrs,**dc=fr" >>>> rootpw {SSHA}xxxxxxxxxxxxxxxxxxxxx >>>> >>>> ---- >>>> I try this : root@xxxxx:/usr/local/etc/**openldap/slapd.d# ldapsearch >>>> -D cn=admin,dc=parisgeo,dc=cnrs,**dc=fr -W -x 'userName=*' >>>> Enter LDAP Password: ldap_bind: Invalid credentials (49) >>>> >>>> Bizarre ... >>>> Perhaps i can try to redefine the rootdn, because it disapear with >>>> conversion ? >>>> Do you have an idea about this ? >>>> >>>> Thanks, >>>> SR. >>>> >>>> >Use slapadd. Again, RTFM. Everything you've asked in the past week or >>> so has been documented in the manpages and the Admin Guide. Read and learn. >>> >>> Yes right, @rey rtfm, and ask your question again, if you're sure your >>> point is not in the OpenLDAP manual. >>> But i'm sure you will find your answer there. >>> >>> >>> >>> >Please trim irrelevant text from your emails. Please update your >>> Subject line to something relevant to the actual discussion topic. >>> @Howard, please say that to the guy who ask questions, and not me^^ >>> >>> >>> Raffael Sahli wrote: >>> >>>> On 14.12.2011 16:54, rey sebastien wrote: >>>> >>>>> Le 13/12/2011 16:48, Raffael Sahli a écrit : >>>>> >>>> >>> Hi! >>>>> It's not easy to start with zero configuration with cn=config new >>>>> openldap administration .. >>>>> I create my bd.ldif based on the slapd.ldif example in the >>>>> /usr/local/etc/openldap directory. >>>>> But how can i insert this ldif with >>>>> >>>>> ldapadd -Y EXTERNAL -H ldapi:/// -f myldiffile.ldif >>>>> >>>>> if i cannot run slapd without configuration ? >>>>> How do you start a fresh install of openldap in this case? there is an >>>>> option to run slapd without zero configuration? >>>>> Thanks a lot, >>>>> >>>> >>> Use slapadd. Again, RTFM. Everything you've asked in the past week or so >>> has been documented in the manpages and the Admin Guide. Read and learn. >>> >>> >>> >> Everything ? really ... Install from sources with specific init script >> installation on debian ? Also, i find nothing about a fresh install >> directly with cn=config (without conversion of slapd.conf) into the admin >> guide ... >> >> I'm not a junior system administrator, i make a phd in geography / >> geomatics, and i have only one week before christmas to create and populate >> a new ldap in my laboratory. I try to learn the maximum with google/debian >> tutorial and a lot of false tutorial, but actually, and i'm sorry about >> that, i have no time to read all the man page, and all the admin guide ... >> >> Thanks you again for the time you take to answer to my question Raffael, >> and others. >> > > First, change the subject, your problem has nothing to do with SSL. > > And to your root password problem, if you just convert your offline config > to online config, you root password will be the same as before. > Did it worked with the offline configuration? > Or change the olcRootPW manually in the config ldif of your database. > > Hum i check into my config ldif and olcRootPW doesn't appear. # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 7bbc1dd2 dn: cn=config objectClass: olcGlobal cn: config olcConfigFile: slapd.conf.seb olcConfigDir: /usr/local/etc/openldap/slapd.d/ olcArgsFile: /usr/local/var/run/slapd.args olcAttributeOptions: lang- olcAuthzPolicy: none olcConcurrency: 0 olcConnMaxPending: 100 olcConnMaxPendingAuth: 1000 olcGentleHUP: FALSE olcIdleTimeout: 0 olcIndexSubstrIfMaxLen: 4 olcIndexSubstrIfMinLen: 2 olcIndexSubstrAnyLen: 4 olcIndexSubstrAnyStep: 2 olcIndexIntLen: 4 olcLocalSSF: 71 olcLogLevel: Stats olcPidFile: /usr/local/var/run/slapd.pid olcReadOnly: FALSE olcReverseLookup: FALSE olcSaslHost: claroline.parisgeo.cnrs.fr olcSaslSecProps: noplain,noanonymous olcSockbufMaxIncoming: 262143 olcSockbufMaxIncomingAuth: 16777215 olcThreads: 16 olcTLSCRLCheck: none olcTLSVerifyClient: never olcToolThreads: 1 olcWriteTimeout: 0 structuralObjectClass: olcGlobal entryUUID: 065b0668-632b-4573-a915-bbe2caf96586 creatorsName: cn=config createTimestamp: 20111214212046Z entryCSN: 20111214212046.446261Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20111214212046Z I try to re-add the pasword with slapmodify : dn:cn=config changetype: modify add: olcRootDN olcRootDN: cn=admin,dc=parisgeo,dc=cnrs,dc=fr dn: cn=config changetype: modify add: olcRootPW olcRootPW: {SSHA}1dWxkkRtyUJt5fDga0Pn4EAyKQ5RPI4+ root@xxxxx:/usr/local/etc/openldap# ldapadd -Y EXTERNAL -H ldapi:/// -f initSlapd.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "cn=config" ldap_modify: Insufficient access (50) Hum, i don't really understand why i have not access, i change only password, rootsuffix, and rootdn into the slapd.conf before conversion .. I try to add manually the attribute olcRootPw, olcSuffix,olcRootDN olcSuffix: dc=parisgeo,dc=cnrs,dc=fr olcRootDN: cn=admin,dc=parisgeo,dc=cnrs,dc=fr olcRootPW: {SSHA}1dWxkkRtyUJt5fDga0Pn4EAyKQ5RPI4+ I have this error at restart : Dec 15 10:52:04 claroline slapd[11462]: olcSuffix: value #0: suffix <DC=parisgeo,DC=cnrs,DC=fr> not allowed in frontend database. Hum i think it's a good idea to remove all config/data file, restart with a fresh slapd.conf and retry the conversion .. > > -- > Raffael Sahli > public(a)raffaelsahli.com > Switzerland > > -- <http://stackoverflow.com/users/385881/reyman64>

3 4

ACL question - minimum rights for Apache HTTP Server Bind User
by Axel Birndt 15 Dec '11

15 Dec '11

Hi @All, currently i'am using a special user "cn=bind,ou=technical,ou=user,dc=2axels-company,dc=de" as bind user in my apache.conf file. ----apache.conf------- ..... AuthType basic AuthBasicProvider ldap AuthName "LDAP-geschuetztes Verzeichnis" AuthLDAPUrl "ldap://localhost:389/ou=user,dc=2axels-company,dc=de?cn?sub" AuthLDAPBindDN "cn=bind,ou=technical,ou=user,dc=2axels-company,dc=de" # it doesn't work, if the bind password is encrypted... isn't it ?? #AuthLDAPBindPassword {SHA}pfiSFDDFSAAE$$%j8BTtCUqs9IZWsQ= # Because this, the password is currently used as an unencrypted one: AuthLDAPBindPassword xxxxxxxxxxx Require ldap-group cn=awstats,ou=groups,dc=2axels-company,dc=de .... ---------------------------------- Now my question: which minimum acl rights are needed for the Bind User: "cn=bind,ou=technical,ou=user,dc=2axels-company,dc=de" to connect to the ldap server and check the group from the user who try to login. I hope my description is understandable... Thanks and regards Axel -- Gruß Axel ------------------------------

4 4

Account question
by NetNinja 15 Dec '11

15 Dec '11

Hello, I have a two different user accounts and one works the other not so much. The account user03 works on both Solaris 10 and RHEL clients. While test01 can do everything but login to the Solaris 10 client, I can use this account to login to the RHEL client though. Can someone look at my accounts below and tell me why user03 works and test01 doesn't? # user03, People, test.net dn: uid=user03,ou=People,dc=test,dc=net uid: user03 cn: user03 objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 603 gidNumber: 500 homeDirectory: /home/user03 gecos: user03 # test01, People, test.net dn: uid:test01,ou=People,dc=test,dc=net uid: test01 cn: test01 objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount shadowMax: 0 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 701 gidNumber: 500 homeDirectory: /home/test01 # ldapclient list NS_LDAP_FILE_VERSION= 2.0 NS_LDAP_BINDDN= uid=proxyagent,ou=People,dc=test,dc=net NS_LDAP_BINDPASSWD= password NS_LDAP_SERVERS= X.X.X.X:389 NS_LDAP_SEARCH_BASEDN= dc=test,dc=net NS_LDAP_SERVER_PREF= X.X.X.X NS_LDAP_CACHETTL= 0 NS_LDAP_CREDENTIAL_LEVEL= proxy NS_LDAP_SERVICE_SEARCH_DESC= passwd:ou=People,dc=test,dc=net NS_LDAP_SERVICE_SEARCH_DESC= group:ou=People,dc=test,dc=net NS_LDAP_SERVICE_SEARCH_DESC= shadow:ou=People,dc=test,dc=net NS_LDAP_SERVICE_AUTH_METHOD= pam_ldap:simple I'm still testing so I ran ldapclient manual. When I feel that I have the the right setting, I will load the profile into LDAP. Any suggestions will be great.

3 4

Re: N-Way Multimaster. No base DN returned from server.
by Arturo Borrero Gonzalez 15 Dec '11

15 Dec '11

2011/12/15 Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Thursday, December 15, 2011 12:59 AM +0100 Arturo Borrero Gonzalez > <cer.inet(a)linuxmail.org> wrote: > >> Hi there. >> >> I followed the documentation in openldap website for setting up a >> N-Way multimaster LDAP cluster. I have two nodes, but I will be >> expanding to 3 or 4 in a near future. >> When doing an ldapsearch, I get all the server data, but when accesing >> with ApacheDirectoryStudio (with same credentials) I get nothing. >> Nothing is wrong in logfiles. I guess a problem in ACLs, but it >> doesn't work even when binding as RootDN (and as seen in oficial >> documentation, rootdn is over the scope of any ACL) > > > If it works with ldapsearch, and it doesn't work with Apache Directory > Studio, then it sounds to me like there is a bug with Apache Directory > Studio. I would advise you take the issue up with that project. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration I've installed phpLDAPadmin and it's tells me: dc=example,dc=es -- The object doesn't exist. Create it now? And this seem to be the same problem I have with Apache Directory Studio. Doing slapcat i get the database, and doing ldapsearch I get the database only if I set the base dn with -b "dc=example,dc=es". But something is misconfigured in my server ¿Any idea? -- /* Arturo Borrero Gonzalez || cer.inet(a)linuxmail.org */ /* Use debian gnu/linux! Best OS ever! */

1 1

SSL/TLS testing
by Jayavant Patil 15 Dec '11

15 Dec '11

Hi, I am using openldap-2.4.19-4.x86_64 on fedora 12 machine. I have enabled openldap SSL/TLS. How do I know (test) that I am using SSL/TLS connections instead of normal ldap:///? -- Thanks & Regards, Jayavant Ningoji Patil Engineer: System Software Computational Research Laboratories Ltd. Pune-411 004. Maharashtra, India. +91 9923536030.

8 26

"controls require LDAPv3" on cn=config syncrepl
by Brandon Hume 15 Dec '11

15 Dec '11

I had a medium-size post describing some problems I'm having with an N-Way setup with 2.4.28, but I saw a post from Quanah that sent me in a new direction so I'm doing some more testing before whining about *that* problem... But meanwhile... can anyone tell me if seeing errors like the following is normal when replicating cn=config? On the provider: Nov 30 14:41:22 kil-ds-3 slapd[7540]: conn=1027 fd=26 ACCEPT from IP=172.30.96.203:55371 (IP=172.30.96.202:389) Nov 30 14:41:22 kil-ds-3 slapd[7540]: conn=1026 op=0 BIND dn="cn=config" mech=SIMPLE ssf=0 Nov 30 14:41:22 kil-ds-3 slapd[7540]: conn=1026 op=0 RESULT tag=97 err=0 text= Nov 30 14:41:22 kil-ds-3 slapd[7540]: conn=1026 op=1 DISCONNECT tag=101 err=2 text=controls require LDAPv3 Nov 30 14:41:22 kil-ds-3 slapd[7540]: conn=1026 op=1 do_search: get_ctrls failed Nov 30 14:41:22 kil-ds-3 slapd[7540]: conn=1026 fd=27 closed (operations error) ... and on the consumer: Nov 30 14:41:22 kil-ds-4 slapd[8178]: do_syncrep2: rid=001 LDAP_RES_SEARCH_RESULT (2) Protocol error Nov 30 14:41:22 kil-ds-4 slapd[8178]: do_syncrep2: rid=001 (2) Protocol error Nov 30 14:41:22 kil-ds-4 slapd[8178]: do_syncrepl: rid=001 rc -2 retrying (3 retries left)

4 5

N-Way Multimaster. No base DN returned from server.
by Arturo Borrero Gonzalez 15 Dec '11

15 Dec '11

Hi there. I followed the documentation in openldap website for setting up a N-Way multimaster LDAP cluster. I have two nodes, but I will be expanding to 3 or 4 in a near future. When doing an ldapsearch, I get all the server data, but when accesing with ApacheDirectoryStudio (with same credentials) I get nothing. Nothing is wrong in logfiles. I guess a problem in ACLs, but it doesn't work even when binding as RootDN (and as seen in oficial documentation, rootdn is over the scope of any ACL) The replication system is working well, afaik. I've readed folk with same problems, but not exactly; here: http://www.openldap.org/lists/openldap-technical/201004/msg00195.html Anyone could take a look on this? Version: 2.4.23-7.2 My cfg (slapd.d over Debian Stable ): dn: olcDatabase={1}hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=example,dc=es olcLastMod: TRUE olcRootDN: cn=admin,dc=example,dc=es olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 structuralObjectClass: olcHdbConfig olcRootPW: asdasd olcLimits: dn.exact="cn=admin,dc=example,dc=es" time.soft=unlimited time.hard=unl imited size.soft=unlimited size.hard=unlimited olcSyncrepl: {0}rid=003 provider="ldaps://ldap1.example.es/" binddn="cn=admin,dc= example,dc=es" bindmethod=simple credentials=asdasd se archbase="dc=example,dc=es" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcSyncrepl: {1}rid=004 provider="ldaps://ldap2.example.es/" binddn="cn=admin,dc= example,dc=es" bindmethod=simple credentials=asdasd se archbase="dc=example,dc=es" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 olcMirrorMode: TRUE olcDbIndex: objectClass,eduPersonEntitlement,memberUID,uid,mail eq olcAccess: {0}to dn.base="dc=example,dc=es" by dn="cn=admin,dc=example,dc=es" manage olcAccess: {1}to dn.base="cn=Subschema" by * read -- /* Arturo Borrero Gonzalez || cer.inet(a)linuxmail.org */ /* Use debian gnu/linux! Best OS ever! */

2 1

slapd-ldap as proxy to active directory
by Juan Miscaro 14 Dec '11

14 Dec '11

Good day. I would like to use the slapd-ldap backend as a proxy to Active Directory (Windows Server 2008 R2). Firstly, AD can be queried directly: $ ldapsearch -LLL -D "cn=John Doe,cn=users,dc=support,dc=com" -w okay -H ldap://ad.support.com -b cn=users,dc=support,dc=com '(sAMAccountName=jdoe)' cn sAMAccountName dn: CN=John Doe,CN=Users,DC=support,DC=com cn: John Doe sAMAccountName: jdoe Now, I have the following in slapd: ========== dn: cn=module{1},cn=config objectClass: olcModuleList cn: module{1} olcModulePath: /usr/lib/ldap olcModuleLoad: {0}back_ldap dn: olcDatabase={2}ldap,cn=config objectClass: olcDatabaseConfig objectClass: olcLDAPConfig olcDatabase: {2}ldap olcDbURI: ldap://ad.support.com olcDbRebindAsUser: TRUE olcDbChaseReferrals: TRUE olcSuffix: cn=users,dc=support,dc=com ========== But when querying via the slapd instance I don't get anything back: $ ldapsearch -D "cn=John Doe,cn=users,dc=support,dc=com" -w okay -H ldap://slapd.example.com -b cn=users,dc=support,dc=com '(sAMAccountName=jdoe)' cn sAMAccountName # extended LDIF # # LDAPv3 # base <cn=users,dc=support,dc=com> with scope subtree # filter: (sAMAccountName=jdoe) # requesting: cn sAMAccountName # # search result search: 2 result: 32 No such object # numResponses: 1 I can query my normal/local DIT fine (even while authenticating as the remote AD user, which looks weird): $ ldapsearch -D "cn=John Doe,cn=users,dc=support,dc=com" -w okay -H ldap://slapd.example.com -b dc=example,dc=com '(ou=People)' cn # extended LDIF # # LDAPv3 # base <dc=example,dc=com> with scope subtree # filter: (ou=People) # requesting: cn # # People, example.com dn: ou=People,dc=example,dc=com # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 What am I missing? TIA. -- /jm

2 1

Bind as an authenticated user for fetching directory information
by Jayavant Patil 14 Dec '11

14 Dec '11

Hi, I am using openldap-2.4.19-4.x86_64 on fedora 12 machine. On client node, in /etc/ldap.conf file, we specify binddn and bindpw. If not specified, the request will be anonymous. I have on each client machine more than 500 users. I want to send the request to server as an authenticated user but users are 500+. Then, how do I specify this in binddn and bindpw. I don't want to specify 'root' (admin) in binddn and bindpw. I have rootbinddn as root's dn and his password in /etc/ldap.secret (mode 600). As earlier said, anonymous request is creating 'I have no name!' problem while doing $ssh <user>@client, since I have given anonymous user auth access. If I specify anonymous read access, 'I have no name!' problem disappears but security is getting compromised. I think there is no problem with nscd daemon, since it is stopped or even I uninstalled that, the problem still persists. -- Thanks & Regards, Jayavant Ningoji Patil Engineer: System Software Computational Research Laboratories Ltd. Pune-411 004. Maharashtra, India. +91 9923536030.

2 2

Ldap is up, trying to get tls working.
by John Tobin 13 Dec '11

13 Dec '11

Folks, I have openldap up, it supports vsftpd, sshd, and 5 client linux machines for remote login. I would like to get tls working. I would support either ldaps [port 636], or the tls available on port 389, I am aware of the differences in implementation, and the fact that an administrator effectively has to make a decision to support one or the other in most cases. Currently: I have slapd running configured for tls under ldap [std port 389]. I am testing it on the slapd machine, with a client on the same machine. I am pointing to the same cacertificate in slapd.d [cn=config.ldif] and ldap.conf. With that in place, and the ldap.conf below: nightmare:/etc # cat ldap.conf base dc=dark,dc=net uri ldap://nightmare.dark.net # scope sub # binddn "cn=admin,dc=dark,dc=net" # bindpw jackie bind_policy soft # The user ID attribute (defaults to uid) pam_login_attribute uid pam_lookup_policy yes pam_password exop nss_schema rfc2307bis tls_reqcert never pam_filter objectClass=posixAccount ldap_version 3 nss_map_attribute uniqueMember uniqueMember ssl start_tls tls_cacert /var/lib/ldap/cacert.pem tls_cert /var/lib/server.crt tls_key /var/lib/ldap/server.key I have run ldapsearch: nightmare:/media # ldapsearch -v -x -H ldap://nightmare.dark.net:389/ -b "dc=dark,dc=net" -Z ldap_initialize( ldap://nightmare.dark.net:389/??base ) filter: (objectclass=*) requesting: All userApplication attributes # extended LDIF # # LDAPv3 # base <dc=dark,dc=net> with scope subtree # filter: (objectclass=*) # requesting: ALL # # dark.net dn: dc=dark,dc=net dc: dark o: dark objectClass: organization objectClass: dcObject # admin, dark.net dn: cn=admin,dc=dark,dc=net objectClass: organizationalRole cn: admin # Default Policy, dark.net dn: cn=Default Policy,dc=dark,dc=net objectClass: namedObject objectClass: pwdPolicy cn: Default Policy # People, dark.net dn: ou=People,dc=dark,dc=net objectClass: organizationalUnit ou: People description: People is used in mapping the /etc/passwd entries # jtobin, People, dark.net dn: uid=jtobin,ou=People,dc=dark,dc=net uid: jtobin cn: John C. Tobin objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount loginShell: /bin/ksh uidNumber: 5000 gidNumber: 100 homeDirectory: /home/jtobin gecos: John C. Tobin # defaultDNS, dark.net dn: cn=defaultDNS,dc=dark,dc=net cn: defaultDNS objectClass: top objectClass: suseDnsConfiguration suseDefaultBase: ou=DNS,dc=dark,dc=net # DNS, dark.net dn: ou=DNS,dc=dark,dc=net objectClass: top objectClass: organizationalUnit ou: DNS # search result search: 3 result: 0 Success # numResponses: 8 # numEntries: 7 nightmare:~ # ##### So I am assuming the ldapserver on ldap://nightmare.dark.net:389/ with tls works. [I looked through the message output in /var/log/message and see the ³STARTTLS² and ³TLS established tls_ssf=256²] I have done a number of similar ldapsearches. This appears to work correctly. On the client machine I now do : nightmare:/media # su - jtobin su: user jtobin does not exist nightmare:/media # /var/log/message - output...... nightmare:/var/log # tail f |grep I tls Oct 28 11:29:01 nightmare slapd[11118]: conn=1217 op=0 STARTTLS Oct 28 11:29:01 nightmare worker_nscd: nss-ldap: do_open: do_start_tls failed:stat=-1 Oct 28 11:29:01 nightmare slapd[11118]: connection_read(14): TLS accept failure error=-1 id=1217, closing Oct 28 11:29:01 nightmare slapd[11118]: conn=1217 fd=14 closed (TLS negotiation failure) Oct 28 11:29:01 nightmare slapd[11118]: conn=1218 op=0 STARTTLS Oct 28 11:29:01 nightmare worker_nscd: nss-ldap: do_open: do_start_tls failed:stat=-1 Oct 28 11:29:01 nightmare slapd[11118]: connection_read(14): TLS accept failure error=-1 id=1218, closing Oct 28 11:29:01 nightmare slapd[11118]: conn=1218 fd=14 closed (TLS negotiation failure) [if you want more of the log, I can obviously get it, but these appear to be the important parts.] This is probably a configuration error, or a logical / architecture misunderstanding, ok, I m a newbie. Do I have certificates incorrectly generated? [certificates were generated via http://www.openldap.org/faq/data/cache/185.html]. What did I do wrong? This is running openldap 2.4.26 off of Suse 12.1 milestone 5. Thanks in advance. tob

4 6

Need help regarding rfc for Jldap
by Brajabasi Padhy 13 Dec '11

13 Dec '11

Hello Sir, I'm Brajabasi from india. I wanted to use OpenLDAP for my project. I found OpeLDAP( Java version and C version) 1) OpenLDAP(Java version) compliant to RFC 2251-2256,2829-2830 2) OpenLDAP(C version) compliant ti RFC 4511-RFC 4520 RFC 4511 is the latest RFC which obseletes the RFC 2251-2256,2819-2830. Could you please suggest which version i should use for my application and why? Thanks with Regards, Brajabasi

1 0

(no subject)
by Brajabasi Padhy 13 Dec '11

13 Dec '11

Hello Sir, I'm Brajabasi from india. I wanted to use OpenLDAP for my project. I found OpeLDAP( Java version and C version) 1) OpenLDAP(Java version) compliant to RFC 2251-2256,2829-2830 2) OpenLDAP(C version) compliant ti RFC 4511-RFC 4520 RFC 4511 is the latest RFC which obseletes the RFC 2251-2256,2819-2830. Could you please suggest which version i should use for my application and why? Thanks with Regards, Braj

1 0

Re:
by rey sebastien 12 Dec '11

12 Dec '11

Le lun. 12 déc. 2011 22:20:14 CET, Quanah Gibson-Mount a écrit : > --On Monday, December 12, 2011 9:55 PM +0100 rey sebastien > <reyman64(a)gmail.com> wrote: > >> IMHO i know this problem but i think this is better than nothing, and >> actually i have nothing. I wait for valid certificate... >> And sorry but your RTFM answer doesn't help me to resolve this problem >> with gnutls and debian, i take many hours to find a valid solution in my >> use case, and the manual doesn't help me particulary on this point. >> >> OpenLdap is a great software, but documentation it's a little "cryptic" >> for beginner like me, so i think it's easy to be rude with beginner on >> many points. > > You're using bad documentation from a questionable source, and are > pointed at the correct documentation, and have an issue with that? > That seems a little odd to me. When i add TLSCACertificateFile attribute with correct path, openldap with gnutls don't re-start.. I'm ok with Raffael, it's probably a bad idea to use the debian package, but i need one day or more to understand why an "official" package from debian create all this configuration's problem. If you want to use SSL/TLS, then > clearly you want a secure server. To blindly follow a guide that turns > off all of those security features leaves you back at square one. If > you don't understand the OpenLDAP documentation, then ask questions > about it rather than falling back to something unreliable that's going > to leave questionable state. > This is why i'm register on this mailling list, with hope some answers or experiences of other members resolve/enlight my beginner problems :) There a lot and a lot of old documentation for openLdap, with old slapd.conf configuration, old generation of certificates, incompatibility between certificate gnutls and openssl .. It's not easy to find the right and exhaustive documentation .. > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration

1 0

Re: I have no name!
by Denis Witt 12 Dec '11

12 Dec '11

On 12.12.2011 16:44, Craig White wrote: >>> I am using openldap-2.4.19-4.x86_64 on fedora 12 machine. I am facing >>> the 'I have no name !' while I do ssh on client machine(All user info is >>> getting propagated to client machines properly (checked with getent >> are you using nscd (Name Service Cache Daemon)? If so uninstall it and the error should be gone. See google for details. >> If you want to verify before uninstall just restart/stop nscd and check if the name is shown. > FTR - I don't personally care for nscd very much but it seems that with Ubuntu 10.04 LTS that I am forced to use it or my host-based ACL's (pam_check_host_attr yes) will fail. Hi, please always reply to the list, thanks. Another "solution" might be to restart nscd every hour (or something), it seems that the cache is refreshed then and everything works fine. Bye.

3 2

decoding attrs error
by Angel L. Mateo 12 Dec '11

12 Dec '11

Hello, I have a web application that doesn't work with openldap 2.4.21. The same application is working with an old openldap 2.3.30. The problem I have is that for some reason this application performs a search with an undefined filter, the error I get in normal run is: Dec 12 13:26:47 canis21 slapd[29241]: get_filter: unknown filter type=48 In the older slapd, log is: Dec 12 03:59:14 canis5 slapd[16830]: conn=3220865 op=3 SRCH base="dc=unidades,dc=vistas,dc=um,dc=es" scope=1 deref=0 filter="(?=undefined)" Dec 12 03:59:14 canis5 slapd[16830]: conn=3220865 op=3 SEARCH RESULT tag=101 err=0 nentries=0 text= If I run slapd in debug mode, I get: ber_scanf fmt ({miiiib) ber: ber_dump: buf=0x7f23d5a0a9d0 ptr=0x7f23d5a0a9d3 end=0x7f23d5a0aa0d len=58 0000: 63 38 04 24 64 63 3d 75 6e 69 64 61 64 65 73 2c c8.$dc=unidades, 0010: 20 64 63 3d 76 69 73 74 61 73 2c 20 64 63 3d 75 dc=vistas, dc=u 0020: 6d 2c 20 64 63 3d 65 73 0a 01 01 0a 01 00 02 02 m, dc=es........ 0030: 00 96 02 01 00 01 01 00 30 00 ........0. >>> dnPrettyNormal: <dc=unidades, dc=vistas, dc=um, dc=es> => ldap_bv2dn(dc=unidades, dc=vistas, dc=um, dc=es,0) <= ldap_bv2dn(dc=unidades, dc=vistas, dc=um, dc=es)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=unidades,dc=vistas,dc=um,dc=es)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=unidades,dc=vistas,dc=um,dc=es)=0 <<< dnPrettyNormal: <dc=unidades,dc=vistas,dc=um,dc=es>, <dc=unidades,dc=vistas,dc=um,dc=es> SRCH "dc=unidades, dc=vistas, dc=um, dc=es" 1 0 150 0 0 begin get_filter ber_scanf fmt (x) ber: ber_dump: buf=0x7f23d5a0a9d0 ptr=0x7f23d5a0aa0b end=0x7f23d5a0aa0d len=2 0000: 30 00 0. get_filter: unknown filter type=48 end get_filter 0 filter: (?=undefined) ber_scanf fmt ({M}}) ber: ber_dump: buf=0x7f23d5a0a9d0 ptr=0x7f23d5a0aa0d end=0x7f23d5a0aa0d len=0 send_ldap_disconnect 2:decoding attrs error send_ldap_response: msgid=0 tag=120 err=2 ber_flush2: 58 bytes to sd 15 0000: 30 38 02 01 00 78 33 0a 01 02 04 00 04 14 64 65 08...x3.......de 0010: 63 6f 64 69 6e 67 20 61 74 74 72 73 20 65 72 72 coding attrs err 0020: 6f 72 8a 16 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e or..1.3.6.1.4.1. 0030: 31 34 36 36 2e 32 30 30 33 36 1466.20036 ldap_write: want=58, written=58 0000: 30 38 02 01 00 78 33 0a 01 02 04 00 04 14 64 65 08...x3.......de 0010: 63 6f 64 69 6e 67 20 61 74 74 72 73 20 65 72 72 coding attrs err 0020: 6f 72 8a 16 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e or..1.3.6.1.4.1. 0030: 31 34 36 36 2e 32 30 30 33 36 1466.20036 conn=1000 op=3 DISCONNECT tag=120 err=2 text=decoding attrs error connection_closing: readying conn=1000 sd=15 for close Any idea? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 868887590 Fax: 868888337

1 0

scheme extension with own OID
by Andreas Cieslak 12 Dec '11

12 Dec '11

Hi list, Because of a concern to modify our ldap environment I need to extend the scheme. The attribute I need is vacationActive and some other attributes which I didn't find in the existing OpenLDAP schemes. My question to you is, if I need to get a registered OID for our company to define the objectclass "vacation" with some further attributes? -I have read some articles about this- Or is there an up to date OID-list where I can search for a vacation objectclass or the vacation attributes which maybe already exist? - I only found the following - http://www.alvestrand.no/objectid/2.16.840.1.113730.3.1.html http://www.oid-info.com/get/2.16.840.1.113730.3.1.14 Any hints would be very appreciated. Thanks in advance. Kind regards. Andreas

1 0

OpenLDAP reader-only users , and removing anonymous user reading ?
by rey sebastien 12 Dec '11

12 Dec '11

Hello, I search some information to make reader-only users on my openLDAP .. I have already cn=reader-only, and my dn equal "dc=parisgeo,dc=cnrs,dc=fr" How can i create a .ldif with specific configuration to remove anonymous user reading, and authorize the read of my ldap only with the cn=reader-only authentification ? Thanks a lot, Best regards, SR

3 3

French tutorial
by reyman 12 Dec '11

12 Dec '11

Hello, I work on a tutorial (based on the many tutorial existing) to make TLS/SSL connexion possible with debian and the new cn=config mode (no slapd.conf) At this moment, you can see my work here (in french only) : http://www.services.parisgeo.cnrs.fr/2011/12/ldap-securise/ Thanks Best regards, Sr -- <http://stackoverflow.com/users/385881/reyman64>

1 0

I have no name!
by Jayavant Patil 12 Dec '11

12 Dec '11

Hi, I am using openldap-2.4.19-4.x86_64 on fedora 12 machine. I am facing the 'I have no name !' while I do ssh on client machine(All user info is getting propagated to client machines properly (checked with getent passwd,getent passwd and getent shadow)), and this is because I specify no access to anonymous. But, when I specify read access to anonymous this problem is getting resolved but my security is getting compromised since anonymous is reading everything. How do I write ACL rule to achieve both each user to see his data only i.e. security and getting user-name while doing ssh on client.? -- Thanks & Regards, Jayavant Ningoji Patil Engineer: System Software Computational Research Laboratories Ltd. Pune-411 004. Maharashtra, India. +91 9923536030.

2 1

Re: slapd hanging - meta backend - Solaris 10
by Lincoln Souzek 12 Dec '11

12 Dec '11

Hello, I compiled 2.4.28 and I'm trying to recreate the issue with that version but I've run into two other issues that are causing slapd to crash in the meantime. I compiled with the following options: ./configure --enable-ldap --enable-meta --prefix="/opt/local/openldap-2.4.28" --enable-dynlist --enable-memberof --enable-rwm --enable-mdb=no The first issue is that slapd has crashed twice with a SIGBUS and dumped a core file. I haven't been able to regularly reproduce it but both times it happened on the initial query after a bind. The stack of the thread where that signal originates wasn't identical both times but the two instances look similar: ----------------- lwp# 6 / thread# 6 -------------------- fedd446c _malloc_unlocked (28, 0, 1a40cb8, 1646c0, 0, 0) + 22c fedd4224 malloc (28, 1, 940a8, 59550, fee68288, fee709b0) + 4c 001646c0 ber_memalloc_x (28, 0, 0, 0, 0, 2fcfc8) + 58 00059550 ch_malloc (28, 427390, 0, fbfff428, 8000, 4551c8) + 8 00047910 ???????? (7864d4, 7866e4, 0, 0, 0, 2fcfc8) 00047b20 attrs_dup (7866e4, 427390, 0, fbfff428, 8000, 63) + 48 0004a980 entry_dup2 (4273d4, 427384, 0, 0, 0, 2fcfc8) + ac 0011f1d4 ???????? (fffffff6, fbfffcb8, 2932d0, fbfff428, 8000, 63) 0011f938 ???????? (1a3cfe0, fbfffcb8, 0, 0, 1, 0) 000a2fe4 ???????? (8000, fbfffcb8, 1b5b298, 2627c8, 8000, a2f70) 0004e978 ???????? (1a3cfe0, fbfffcb8, 2, 41a10, ffffffff, ffffffff) 00050d88 slap_send_search_entry (0, fbfffcb8, 1b5b298, 2627c8, 262750, 1ee000) + 3d4 00041de8 fe_op_search (1a3cfe0, fbfffcb8, 2, 41a10, 1, 0) + 3d8 000a39cc overlay_op_walk (8000, fbfffcb8, 8000, 1ee5f8, 8000, 200) + c8 000a3ae4 ???????? (1a3cfe0, fbfffcb8, 2, 0, 2b9d88, 1ee6f0) 00041528 do_search (1a3cfe0, fbfffcb8, fee6cbc0, fe020c00, 40f98, fbfffa38) + 590 0003f8e4 ???????? (fbfffe08, 1a3cfe0, fee6cbc0, fe020c00, 2fcfe8, 0) 00040270 ???????? (0, 20, fee6cbc0, fe020c00, 268328, 0) 0013ca30 ???????? (268318, fc000000, 0, 0, 13c8d4, 1) fee40368 _lwp_start (0, 0, 0, 0, 0, 0) ----------------- lwp# 5 / thread# 5 -------------------- fedd446c _malloc_unlocked (800, 1, 420780, fedd4224, 0, 0) + 22c fedd416c _smalloc (18, 0, 9415c, 16cbc8, fffffff9, fee6fa48) + 4c fedd4224 malloc (17, 1, 940a8, 16cf38, fee68288, fee709b0) + 4c 0016cbc8 ber_memalloc_x (17, 0, 0, 0, 0, 30dc98) + 58 0016cf38 ber_dupbv_x (8dea98, 12f6ab0, 0, fc3ff4c8, 8000, 8de950) + 3c 0004990c ???????? (750174, 750024, 0, 0, 0, 30dc98) 00049a20 attrs_dup (750024, 3fbc50, 0, fc3ff4c8, 8000, 63) + 48 0004c7b0 entry_dup2 (3fbc6c, 3fbc44, 0, 0, 0, 30dc98) + ac 0012556c ???????? (fffffff6, fc3ffd58, 2c7208, fc3ff4c8, 8000, 63) 00125d68 ???????? (423350, fc3ffd58, 0, 0, 0, 0) 000a71c0 ???????? (8000, fc3ffd58, 9e1f38, 275fb8, 8000, a714c) 00050818 ???????? (423350, fc3ffd58, ffffffff, ffffffff, 0, 0) 00052cb8 slap_send_search_entry (0, fc3ffd58, 9e1f38, 275fb8, 3, 1f9400) + 3e0 00043c94 fe_op_search (423350, fc3ffd58, 2, 43894, 1, 0) + 400 000a7b98 overlay_op_walk (8000, fc3ffd58, 8000, 1f9b90, 8000, 200) + c8 000a7cb0 ???????? (423350, fc3ffd58, 2, fc3ffad8, 2a0bd8, 1f9c88) 00043364 do_search (423350, fc3ffd58, fee6cbc0, 1edc00, 177400, fc3ffad8) + 618 00041698 ???????? (fc3ffe08, 423350, fee6cbc0, fdcf0800, 27bb18, 0) The second issue, which I can reproduce, is that slapd is crashing with a SIGSEGV when it encounters the following entry in a Sun Directory Server configured as a meta backend: c=undef,dc=company Is undef a reserved word that's causing an issue here? In earlier versions (2.4.23, at least), it seems like that entry was just discarded and not returned as a search result. Thanks, Lincoln On Mon, Dec 5, 2011 at 10:32 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Monday, December 05, 2011 6:09 PM +0100 Lincoln Souzek < > lsouzek(a)gmail.com> wrote: > > Hello, >> >> I've seen a couple of instances where slapd becomes unresponsive, >> apparently because the threads are waiting on a backend meta DB. We're >> running slapd 2.4.23 on Solaris 10 (update 11/06). We have 128 threads >> configured and when I attach with truss, I see 130 allocated, most of >> which look like this: >> > > I would note there have been some re-entry fixes for back-meta since > 2.4.23 was released. I would suggest you re-try with the latest OpenLDAP > version as a first step. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

Re: Solaris 10 Native Client connecting to OpenLdap How to needed
by adam＠spoontech.biz 12 Dec '11

12 Dec '11

Hi, I have scripted the following which is what we use when joining a new client to ldap: setup_ldap.sh #!/bin/sh if [ ! -d /var/ldap ] ; then mkdir /var/ldap chown root:sys /var/ldap chmod 755 /var/ldap fi cd /var/ldap rm -rf /var/ldap/* >/dev/null 2>&1 /usr/sfw/bin/sparcv9/certutil -N -d /var/ldap if [ -f /etc/ssl/our_CA_cert.pem ] ; then /usr/sfw/bin/sparcv9/certutil -A -n "ca-cert1" -i /etc/ssl/our_CA_cert.pem -a -t CT -d . else echo 'Could not find /etc/ssl/our_CA_cert.pem' fi if [ -f /etc/ssl/our_CA_cert2.pem ] ; then /usr/sfw/bin/sparcv9/certutil -A -n "ca-cert2" -i /etc/ssl/our_CA_cert2.pem -a -t CT -d . else echo 'Could not find /etc/ssl/our_CA_cert2.pem' fi if [ -f /etc/ssl/our_root_CA.pem ] ; then /usr/sfw/bin/sparcv9/certutil -A -n "ca-cert-root" -i /etc/ssl/our_root_CA.pem -a -t CT -d . else echo 'Could not find /etc/ssl/our_root_CA.pem' fi ldapclient init -v -a profileName=ldapprofilename -a domainName=example.com -a proxyDN=cn=proxyagent,ou=profile,dc=example,dc=com -a proxyPassword=examplepasswd ldapserver1 svcadm enable svc:/network/ldap/client:default svcadm restart svc:/network/ldap/client:default svcadm enable svc:/system/name-service-cache:default svcadm restart svc:/system/name-service-cache:default Obviously from the script above you can see that we have created profiles in ldap storing settings like uri etc. We did this so that machines authenticate to our local ldap server first, then connect to remote servers if unable to get a response from the local server. Let me know if you need anything else. Cheers, > Adam, > > What is the ldapclient init command you are using? > > > > On Sun, Dec 11, 2011 at 5:14 AM, <adam(a)spoontech.biz> wrote: > >> Hi, I manage an OpenLDAP environment consisting of Linux, Solaris and >> AIX. >> >> Here is the Schema I use for Solaris 10. >> >> Hope this helps. >> >> # Sun nisMapEntry attributes >> attributetype ( 1.3.6.1.1.1.1.28 >> NAME 'nisPublickey' >> DESC 'nisPublickey' >> EQUALITY caseIgnoreIA5Match >> SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) >> >> attributetype ( 1.3.6.1.1.1.1.29 >> NAME 'nisSecretkey' >> DESC 'nisSecretkey' >> EQUALITY caseIgnoreIA5Match >> SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) >> >> attributetype ( 1.3.6.1.4.1.1.1.1.12 SUP name >> NAME 'nisDomain' ) >> >> # Sun additional attributes to RFC2307 attributes (NIS) >> attributetype ( 2.16.840.1.113730.3.1.30 >> NAME 'mgrpRFC822MailMember' >> DESC 'mgrpRFC822MailMember' >> EQUALITY caseIgnoreIA5Match >> SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) >> >> #attributetype ( 1.3.6.1.4.1.42.2.27.2.1.15 >> # NAME 'rfc822MailMember' >> # DESC 'rfc822MailMember' >> # EQUALITY caseIgnoreIA5Match >> # SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.1.1.12 >> NAME 'nisNetIdUser' >> DESC 'nisNetIdUser' >> EQUALITY caseExactIA5Match >> SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.1.1.13 >> NAME 'nisNetIdGroup' >> DESC 'nisNetIdGroup' >> EQUALITY caseExactIA5Match >> SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.1.1.14 >> NAME 'nisNetIdHost' >> DESC 'nisNetIdHost' >> EQUALITY caseExactIA5Match >> SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) >> >> # Sun NIS publickey objectclass >> objectclass ( 1.3.6.1.1.1.2.14 >> NAME 'NisKeyObject' >> DESC 'NisKeyObject' >> SUP top >> MUST ( cn $ nisPublickey $ nisSecretkey ) >> MAY ( uidNumber $ description ) ) >> >> # Sun NIS domain objectclass >> objectclass ( 1.3.1.6.1.1.1.2.15 >> NAME 'nisDomainObject' >> DESC 'nisDomainObject' >> SUP top AUXILIARY >> MUST ( nisDomain ) ) >> >> # Sun NIS mailGroup objectclass >> objectclass ( 2.16.840.1.113730.3.2.4 >> NAME 'mailGroup' >> DESC 'mailGroup' >> SUP top >> MUST ( mail ) >> MAY ( cn $ mgrpRFC822MailMember ) ) >> >> # Sun NIS nisMailAlias objectclass >> #objectclass ( 1.3.6.1.4.1.42.2.27.1.2.5 >> # NAME 'nisMailAlias' >> # DESC 'nisMailAlias' >> # SUP top >> # MUST ( cn ) >> # MAY ( rfc822mailMember ) ) >> >> # Sun NIS nisNetId objectclass >> objectclass ( 1.3.6.1.4.1.42.2.27.1.2.6 >> NAME 'nisNetId' >> DESC 'nisNetId' >> SUP top >> MUST ( cn ) >> MAY ( nisNetIdUser $ nisNetIdGroup $ nisNetIdHost ) ) >> >> # Below is optional unless you want to use ldap_gen_profile >> attributetype ( 1.3.6.1.4.1.42.2.27.5.1.15 SUP name >> NAME 'SolarisLDAPServers' >> DESC 'SolarisLDAPServers' >> SINGLE-VALUE ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.5.1.16 SUP name >> NAME 'SolarisSearchBaseDN' >> DESC 'SolarisSearchBaseDN' >> SINGLE-VALUE ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.5.1.17 >> NAME 'SolarisCacheTTL' >> DESC 'SolarisCacheTTL' >> EQUALITY integerMatch >> SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 >> SINGLE-VALUE ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.5.1.18 SUP name >> NAME 'SolarisBindDN' >> DESC 'SolarisBindDN' >> SINGLE-VALUE ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.5.1.19 SUP name >> NAME 'SolarisBindPassword' >> DESC 'SolarisBindPassword' >> SINGLE-VALUE ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.5.1.20 SUP name >> NAME 'SolarisAuthMethod' >> DESC 'SolarisAuthMethod' >> SINGLE-VALUE ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.5.1.21 SUP name >> NAME 'SolarisTransportSecurity' >> DESC 'SolarisTransportSecurity' >> SINGLE-VALUE ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.5.1.24 SUP name >> NAME 'SolarisDataSearchDN' >> DESC 'SolarisDataSearchDN' >> SINGLE-VALUE ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.5.1.25 SUP name >> NAME 'SolarisSearchScope' >> DESC 'SolarisSearchScope' >> SINGLE-VALUE ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.5.1.26 >> NAME 'SolarisSearchTimeLimit' >> DESC 'SolarisSearchTimeLimit' >> EQUALITY integerMatch >> SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 >> SINGLE-VALUE ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.5.1.27 SUP name >> NAME 'SolarisPreferedServer' >> DESC 'SolarisPreferedServer' ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.5.1.28 SUP name >> NAME 'SolarisPreferedServerOnly' >> DESC 'SolarisPreferedServerOnly' >> SINGLE-VALUE ) >> >> attributetype ( 1.3.6.1.4.1.42.2.27.5.1.29 SUP name >> NAME 'SolarisSearchReferral' >> DESC 'SolarisSearchReferral' >> SINGLE-VALUE ) >> >> objectclass ( 1.3.6.1.4.1.42.2.27.5.2.7 >> NAME 'SolarisNamingProfile' >> DESC 'Solaris LDAP NSS Profile' >> SUP top STRUCTURAL >> MUST ( cn $ SolarisLDAPServers ) >> MAY ( SolarisBindDN $ SolarisBindPassword $ >> SolarisSearchBaseDN $ SolarisAuthMethod $ >> SolarisTransportSecurity $ SolarisSearchReferral $ >> SolarisDataSearchDN $ SolarisSearchScope $ >> SolarisSearchTimeLimit $ SolarisCacheTTL ) ) >> >> # End of solaris.schema >> > I am working on getting a bunch of Solaris 10 hosts connected to >> OpenLdap. >> > I am not Ldap expert by far however I must get this working. >> > >> > I have 0 issues getting Linux clients to connect but Solaris 10 how >> to's >> > docs are very evasive. >> > >> > I have searched everywhere the best I can find is a few online docs >> that >> > say you need to load a custom schema. >> > >> > I just need user / passwd authentication to a directory nothing more. >> Will >> > not be using TLS.. >> > >>

1 0

Solaris 10 Native Client connecting to OpenLdap How to needed
by Jeremy Loukinas 11 Dec '11

11 Dec '11

I am working on getting a bunch of Solaris 10 hosts connected to OpenLdap. I am not Ldap expert by far however I must get this working. I have 0 issues getting Linux clients to connect but Solaris 10 how to's docs are very evasive. I have searched everywhere the best I can find is a few online docs that say you need to load a custom schema. I just need user / passwd authentication to a directory nothing more. Will not be using TLS..

3 3

Debugging OpenLDAP client: Where are the log files?
by daisy.wu＠emc.com 11 Dec '11

11 Dec '11

Hi, OpenLDAP developers, I've been able to successfully built OpenLDAP client libraries liblber and libldap for Window 64 bit OS. I wrote a test program to connect to Microsoft AD (hosted on Win 2008 R2, a 64 bit OS) over SSL. I made sure the root certificate file is converted to X509 base 64 PEM format. And the certificate file name is named using the hash value returned from "openssl" command. I made sure I can telnet to the AD host at port 636 from my test machine (where I run my test program). This is to make sure there's not network connectivity problem between my client test machine and the LDAP server host. Here's snippet of my source code: int debug_flag = -1; // debug all rc = ldap_set_option( ld, LDAP_OPT_DEBUG_LEVEL, &debug_flag); rc = ldap_sasl_bind_s( ld, dn, LDAP_SASL_SIMPLE, &passwd, NULL, NULL, NULL); if (rc != LDAP_SUCCESS) { trace("%15s: %s (%s: %d = %s)", "FAILED", "ldap_sasl_bind_s() failed!", "Return value is", rc, ldap_err2string(rc)); } However, my OpenLDAP client test program fails with the following error: 0011-12-10 16:08:59 [5296]: FAILED: ldap_sasl_bind_s() failed! (Return value is: -1 = Can't contact LDAP server) My question is: I need to troubleshoot this problem. I will need to examine the OpenLDAP log files to find the root cause. Where are the OpenLDAP log files located? I read that the log file location is configured in slapd.conf. But where is slapd.conf file on Windows? Considering I am not running OpenLDAP server on this test machine. Any input or feedback will be much appreciated. Thanks. Daisy

1 0

Syncrepl SSL fail
by Hugo Deprez 10 Dec '11

10 Dec '11

Dear community, I setup a syncrepl between my master openldap server and a consumer. I am trying to use SSL for this syncrepl I got the following error in the log when I start slapd on the consumer : Oct 13 17:04:59 server slapd[16905]: slapd starting Oct 13 17:04:59 server slapd[16905]: slap_client_connect: URI=ldaps://ldap.mydomain.fr:1024/ DN="cn=syncrepluser,o=others,dc=mydomain,dc=fr" ldap_sasl_bind_s failed (-1) Oct 13 17:04:59 server slapd[16905]: do_syncrepl: rid=003 rc -1 retrying (9 retries left) I don't understand why it is failing as a single ldapsearch from the same server with the syncrepl user is working. here is my syncrepl configuration : Syncrepl rid=003 provider=ldaps://ldap.mydomain.fr:1024/ type=refreshOnly retry="60 10 600 +" interval=00:00:00:10 searchbase="dc=mydomain,dc=fr" scope=sub schemachecking=on bindmethod=simple binddn="cn=syncrepluser,o=others,dc=mydomain,dc=fr" credentials=my_password Any idea ? Regards, Hugo

8 14

Starting out with NSS overlay - Guidance required
by ptw 09 Dec '11

09 Dec '11

Hi gang! I'm looking for some guidance in what is most probably a very common objective. Which is to manage all authentication to network hosts from slapd. To begin, my goal is to have: 1. one machine (generically-configured LDAP client) running sshd (10.153.107.100) 2. multiple LDAP users 3. specify, from slapd, that only one user (tony) can log in over ssh to the machine Surprisingly, I have not found much documentation on this stuff beyond the slapo-nssov man page. Anyway, I have some LDIF entries ready to go but I'm feeling very uneasy about dumping them in and hoping for the best. I would rather learn more about how this all works together and hopefully get some pointers/gotchas from others who have done this before. That's why I'm writing this email. In particular, at this point I only want the bare necessities to achieve my simple goad specified above. My slapd server has the nis and ldapns schemas configured and the client machine has libnss-ldapd (applied to group and passwd services) and libpam-ldapd. All systems are running Ubuntu 11.10. I have manually disabled nslcd on the Ubuntu client machine (sudo update-rc.d nslcd disable). These are the entries I have so far: for slapd-config: # NSSOV dn: olcOverlay=nssov,ocDatabase={1}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcNssOvConfig olcOverlay: nssov olcNssSsd: passwd ldap:///ou=People,dc=example,dc=com??one olcNssSsd: group ldap:///ou=People,dc=example,dc=com??one olcNssSsd: hosts ldap:///ou=People,dc=example,dc=com??one olcNssPam: hostservice uid2dn olcNssPamSession: sshd # ACL dn: olcDatabase={1}hdb,cn=config olcAccess: to attrs=userPassword by anonymous auth by self write by * none olcAccess: to attrs=shadowLastChange by self write by * none olcAccess: to * by self write by * read olcAccess: to dn.exact=cn=host1.example.com,ou=Hosts,dc=example,dc=com attrs=authorizedservice by dn.exact=cn=ssh,ou=host1,ou=server_access,ou=Groups,dc=example,dc=com compare by * read ================== The sshd host, user & group entries from my regular hdb-based DIT: # NSSOV HOST and USER dn: cn=host1.example.com,ou=Hosts,dc=example,dc=com objectClass: device objectClass: top objectClass: ipHost objectClass: authorizedServiceObject cn=host1.example.com ipHostNumber: 10.153.107.100 authorizedService: sshd dn: cn=ssh,ou=host1,ou=server_access,ou=Groups,dc=example,dc=com objectClass: posixGroup cn: ssh-host1-server_access gidNumber: 6000 dn: uid=tony,ou=People,dc=example,dc=com objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount uid: tony cn: Tony Doe uidNumber: 11000 gidNumber: 6000 userPassword: tonyldap loginShell: /bin/bash homeDirectory: /home/tony =================== Anyone? Thanks in advance, Peter

2 1

Seemingly broken database
by Peter Mogensen 09 Dec '11

09 Dec '11

Hi, I have a large database with several million entries, which for a few specific entries takes very long (several minutes) to search. Looking at the debug output the search suddenly goes into a mode where it tests a lot of completely irrelevant entries and outputs a lot of "bdb_search: <number> scope not okay" messages - which takes very long time before the query ends. I've tried deleting all indexes and re-indexing with slapdindex, but the problem persists - also with 2.4.28. It's BDB 4.8.26 with back_bdb. However... loading the entire database with slapadd made the problem go away. So I suspect the id2entry or dn2id database is broken. So now I'm wondering... how do these situations occur and is there anyway to fix the database without reloading. It takes several hourse to reload, so it's not an ideal situation to have to do that every time such an event occurs. They are rather rare compared to the total number of entries, but they pop up once in a while, so it'll be a rutine job to start the database over from ldif, if that's the solution. Is there any tool to inspect the BDB database, find the problem, fix it and re-index? /Peter

3 4

creating databases corruption
by mark cunningham 09 Dec '11

09 Dec '11

Default install with debian, dc=nodomain as the database... This is my ldif dn: olcDatabase=hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: hdb olcSuffix: o=myTestDB olcDbDirectory: /var/lib/ldap olcAccess: to attrs=userPassword,shadowLastChange by self write by anonymou s auth by dn="cn=admin,o=myTestDB" write by * none olcAccess: to dn.base="" by * read olcAccess: to * by self write by dn="cn=admin,o=myTestDB" write by * read olcRootDN: cn=admin,o=myTestDB olcRootPW:: e1NTSEF9MERCYWRzYXpicy9zQ1dSRmJUbFRuRlUyVFdwK0p6Qi8= olcDbIndex: objectClass eq ldapadd -vH ldapi:/// -Y EXTERNAL -f filewithldif Now slapcat just freezes when run, doesn't end, doesn't give out any text. slapcat -n 0 does give: dn: olcDatabase={2}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {2}hdb olcDbDirectory: /var/lib/ldap olcSuffix: o=myTestDB olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymou s auth by dn="cn=admin,o=myTestDB" write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by self write by dn="cn=admin,o=myTestDB" write by * read olcRootDN: cn=admin,o=myTestDB olcRootPW:: e1NTSEF9MERCYWRzYXpicy9zQ1dSRmJUbFRuRlUyVFdwK0p6Qi8= olcDbIndex: objectClass eq structuralObjectClass: olcHdbConfig entryUUID: 8f41159e-b658-1030-8ee3-253edcff5134 creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20111209022343Z entryCSN: 20111209022343.389564Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20111209022343Z slapd -V @(#) $OpenLDAP: slapd 2.4.23 (Jun 16 2011 02:53:39) $ buildd@murphy :/build/buildd-openldap_2.4.23-7.2-i386-Y1mwvF/openldap-2.4.23/debian/build/servers/slapd Fresh install on squeeze debian along with nodomain one. Mark

1 0

Re: memberof overlay deployment
by Asplund Marko 08 Dec '11

08 Dec '11

Masarati wrote: > slapo-memberof(5) does not support tool mode; in order to populate the > memberOf attribute of an existing database you need to use ldapadd(1). > You could, for example, dump your group entries, remove them, and re-add > them via ldapadd(1). Thanks for clearing that out. Could this be mentioned in the documentation somewhere (e.g. slapo-memberof(5))? So, the procedure would look something like this? Scripting would be a lot easier if ldapsearch could optionally output DNs without wrapping lines. # dump existing groups ldapsearch -H ldap://localhost:389 -b dc=example,dc=org -x -w XXXX -D cn=manager,dc=example,dc=org '(objectclass=groupofnames)' > groups.ldif # list existing groups by DN cat groups.ldif | perl -p00e 's/\r?\n //g' |grep '^dn: ' | sed -e 's/^dn: //' > groups_to_del.ldif # remove existing groups ldapdelete -v -c -H ldap://localhost:389 -x -w XXXX -D cn=manager,dc=example,dc=org -f groups_to_del.ldif # re-add groups ldapadd -v -H ldap://localhost:389 -x -w XXXX -D cn=manager,dc=example,dc=org -f groups.ldif best regards, marko

3 5

Test - disregard
by Peter Matulis 08 Dec '11

08 Dec '11

Pardon the noise. I've had trouble sending to this mailing list so I'm testing with this (3rd) address. Peter

1 0

RootDSE search, add attributes
by W.Siebert＠t-systems.com 08 Dec '11

08 Dec '11

Hello, my application sends a root_dse search, (objectclass=*) without any attributes. So openldap answers with 2 lines: Top objectClass: top objectClass: OpenLDAProotDSE But I need all attributes and controls Application is a blackbox, I can't change the search filter. Question: is it posible to add an attribute with '+' to get all system features by using rewritting/remapping to substitute the ampty attribute witch '+' regards Waldemar

2 1

OpenLDAP 2.3.4.3: modrdn and synrepl
by Brian C. Hill 08 Dec '11

08 Dec '11

Hello, I am using OpenLDAP 2.3.43 from the RHEL 5 rpm (openldap-2.3.43-12.el5_7.10) on RHEL 5 with syncrepl from one master to multiple slaves. This works fine for add/deletes/mods but seemingly not for modrdns. I have a perl script that uses Net::LDAP to rename logins with moddn (modrdn). When I do this, the master updates properly, but the slaves generally crash or hang, or less often just don't sync the change. A slapd_db_recovery usually fixes this. I vaguely remember seeing a mention in a post on some other list that modrdn wasn't supported by syncrepl, but I can't find that post now. Is modrdn in fact not supported by syncrepl up to 2.3.43? If it is, is there something special I need to do in slapd.conf do to make modrn+syncrepl work? If it is not, do I simply add the new entry and delete the old entry, or is there a more specific recommendation? If I update to the latest to 2.4, I'll need to do that by hand which I'd prefer not to do if I can avoid it. Thanks for any help. Brian

2 1

db_recover question
by frank.offermanns＠caseris.de 07 Dec '11

07 Dec '11

Since I haven't got an answer to my previous question. Maybe you could answer me this questions: In the cases slapd.exe performes internal database cleanup at startup is it possible for LDAP clients to access the database while cleanup is running or will connect attempts from clients fail at that state. If the database is locked while recovering we would be able to assume safely, that internal database recovery at startup has completed when a client connect attempt succeeds. Can we? > I searched the list and found several different informations to db_recover. > In older versions it was not advised to do a manual db_recover. > Can db_recover still harm a consistent database (I use db-5.1.25.NC / hdb)? > To be more precise, should I try to find out, if a unclean shutdown occured and then db_recover manually or can I db_recover with the 5.1.25 DB and Openldap 2.4.26 at every startup? Thanks & Regards, Frank

2 1

cn=config repl failure with 2.4.28
by Brandon Hume 07 Dec '11

07 Dec '11

Hrm... my previous post seems to have gone MIA, hopefully this one won't do the same. I have a pair of servers running 2.4.28 built with BerkeleyDB 5.2.36, in a multi-master setup. I was having issues with synchronization (namely, it wasn't syncing) and decided to rebuild the second server. I nuked etc/slapd.d/* as well as the contents of the cn=accesslog and main DIT directories, leaving behind only the DB_CONFIG files. I dumped the first server's cn=config tree using slapcat -b cn=config, copied the file over to the second server, and re-added the config using 'slapadd -F slapd.d -b cn=config -l slapcat_output.ldif'. Then I fired up the server, and let it pull over the main DIT from the first server. That went fine. It doesn't seem to have fixed my issue, though, which is the cn=config tree not synchronizing changes. When I make a change to olcDatabase={1}hdb,cn=config (which is cn=accesslog) to add some new indexes on server2, I see the following errors in syslog on server1 (after restarting slapd on server2 to try to force a sync...): Dec 7 12:13:04 server1 slapd[5984]: conn=1308 fd=25 ACCEPT from IP=172.30.96.203:52788 (IP=172.30.96.202:389) Dec 7 12:13:04 server1 slapd[5984]: conn=1308 op=0 BIND dn="cn=config" method=128 Dec 7 12:13:04 server1 slapd[5984]: conn=1308 op=0 BIND dn="cn=config" mech=SIMPLE ssf=0 Dec 7 12:13:04 server1 slapd[5984]: conn=1308 op=0 RESULT tag=97 err=0 text= Dec 7 12:13:04 server1 slapd[5984]: conn=1308 op=1 DISCONNECT tag=101 err=2 text=controls require LDAPv3 Dec 7 12:13:04 server1 slapd[5984]: conn=1308 op=1 do_search: get_ctrls failed Dec 7 12:13:04 server1 slapd[5984]: conn=1308 fd=25 closed (operations error) ... and on server2: Dec 7 12:13:04 server2 slapd[7798]: do_syncrep2: rid=001 LDAP_RES_SEARCH_RESULT (2) Protocol error Dec 7 12:13:04 server2 slapd[7798]: do_syncrep2: rid=001 (2) Protocol error Dec 7 12:13:04 server2 slapd[7798]: do_syncrepl: rid=001 rc -2 retrying Dec 7 12:13:04 server2 slapd[7798]: do_syncrep2: rid=001 LDAP_RES_SEARCH_RESULT (2) Protocol error Dec 7 12:13:04 server2 slapd[7798]: do_syncrep2: rid=001 (2) Protocol error Dec 7 12:13:04 server2 slapd[7798]: do_syncrepl: rid=001 rc -2 retrying The "controls require LDAPv3" error confuses me, as a wireshark capture of the conversation shows the bind asking for LDAPv3. Can anyone give me some guidance here?

1 0

OpenLdap + TLS error : ldap_start_tls: Connect error (-11)
by reyman 07 Dec '11

07 Dec '11

Hello, I try to create a openLdap + TLS server for my university laboratory. My configuration is : Linux ***** 2.6.32-5-686 #1 SMP Mon Oct 3 04:15:24 UTC 2011 i686 GNU/Linux slapd 2.4.23 (*This version use gnutls library)* I apply this tutorial on help.ubuntu.com (see TLS and SSL section) https://help.ubuntu.com/10.04/serverguide/C/openldap-server.html<%20https://help.ubuntu.com/10.04/serverguide/C/openldap-server.html> * The command i use to make the auto-signed certificate *: (with cn=localhost in my localhost.info and ca.info) sh -c "certtool --generate-privkey > /etc/ssl/myLdapKey/cakey.pem" certtool --generate-self-signed --load-privkey /etc/ssl/myLdapKey/cakey.pem --template /etc/ssl/myLdapKey/ca.info --outfile /etc/ssl/myLdapKey/cacert.pem sh -c "certtool --generate-privkey > /etc/ssl/myLdapKey/localhost_slapd_key.pem" * After that :* adduser openldap ssl-cert chgrp ssl-cert /etc/ssl/myLdapKey/localhost_slapd_key.pem chmod g+r /etc/ssl/myLdapKey/localhost_slapd_key.pem * -I add the cert path info file into ldap with a file, tls-config.ldif which contain : * dn: cn=config add: olcTLSCACertificateFile olcTLSCACertificateFile: /etc/ssl/myLdapKey/cacert.pem dd: olcTLSCertificateFile olcTLSCertificateFile: /etc/ssl/myLdapKey/localhost_slapd_cert.pem add: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/myLdapKey/localhost_slapd_key.pem ldapmodify -QY EXTERNAL -H ldapi:/// -f tls-config.ldif * I uncomment this in my etc/default/slapd *SLAPD_SERVICES="ldap://127.0.0.1:389/ ldaps:/// ldapi:///"* After, i use for my client in my ldap.conf : * BASE dc=parisgeo,dc=cnrs,dc=fr URI ldap://localhost <ldaps://localhost> SSL start_tls TLS_CACERT /etc/ssl/myLdapKey/cacert.pem TLS_REQCERT demand I restart server with succes, but when i try to connect, i have this error (botom off this mail), do you have an explanation ? Thanks a lot if you can help me ... *Best regards, SR.* root@*****:/etc/ldap# ldapsearch -x -LLL -ZZ -d 1 ldap_create ldap_extended_operation_s ldap_extended_operation ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP localhost:389 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 127.0.0.1:389 ldap_pvt_connect: fd: 3 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({) ber: ber_flush2: 31 bytes to sd 3 ldap_result ld 0x978b280 msgid 1 wait4msg ld 0x978b280 msgid 1 (infinite timeout) wait4msg continue ld 0x978b280 msgid 1 all 1 ** ld 0x978b280 Connections: * host: localhost port: 389 (default) refcnt: 2 status: Connected last used: Wed Dec 7 16:29:19 2011 ** ld 0x978b280 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x978b280 request count 1 (abandoned 0) ** ld 0x978b280 Response Queue: Empty ld 0x978b280 response count 0 ldap_chkResponseList ld 0x978b280 msgid 1 all 1 ldap_chkResponseList returns ld 0x978b280 NULL ldap_int_select read1msg: ld 0x978b280 msgid 1 all 1 ber_get_next ber_get_next: tag 0x30 len 12 contents: read1msg: ld 0x978b280 msgid 1 message type extended-result ber_scanf fmt ({eAA) ber: read1msg: ld 0x978b280 0 new referrals read1msg: mark request completed, ld 0x978b280 msgid 1 request done: ld 0x978b280 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_parse_extended_result ber_scanf fmt ({eAA) ber: ldap_parse_result ber_scanf fmt ({iAA) ber: ber_scanf fmt (}) ber: ldap_msgfree TLS: can't connect: A TLS packet with unexpected length was received.. ldap_err2string* ldap_start_tls: Connect error (-11) additional info: A TLS packet with unexpected length was received. * * * -- <http://stackoverflow.com/users/385881/reyman64>SR.

1 0

Strange slapd-meta search problem
by Liam Gretton 07 Dec '11

07 Dec '11

Hi, I have a meta DB pointing to an Active Directory backend. This is used by SASL for authentication. The meta DB does not contain a schema definition for the AD. I've configured SASL to lookup sAMAccountName in AD, but this always fails until a lookup against the meta DB has first been performed against an attribute that the meta DB does understand (e.g. cn). Once that's been done, the system is rock solid and can be searched on any attribute. Looking at the debug output it seems that any initial search does not honour the specified filter unless the attribute being searched for is defined in the schema, but after one successful search, the LDAP server is happy to search for these attributes. I can work around this by doing a dummy search when the LDAP server starts, but I'd like to understand the cause of the problem properly. Any suggestions as to the cause of this? I'm using 2.4.20 on SLES 11. Here's how to reproduce the problem. Meta LDAP server is listening on a socket /var/run/slapd/slapd (configuration at end), providing dc=meta. AD is dc=ad,dc=org,dc=uk. After startup: ldapsearch -H ldapi://%2Fvar%2Frun%2Fslapd%2Fldapi-meta -x -D "cn=administrator,dc=meta" -b dc=meta -w secret sAMAccountName=user1 <nothing returned> Try again with cn: ldapsearch -H ldapi://%2Fvar%2Frun%2Fslapd%2Fldapi-meta -x -D "cn=administrator,dc=meta" -b dc=meta -w secret cn=user1 <AD record returned successfully> After this, the original search on sAMAccountName or any other attribute will also be successful. Debug output from slapd shows an incorrect filter on objectClass with the original failed search: ==> rewrite_context_apply [depth=1] string='ou=ad.org.uk,dc=meta' ==> rewrite_rule_apply rule='((.+),)?ou=ad.org.uk,[ ]?dc=meta$' string='ou=ad.org.uk,dc=meta' [1 pass(es)] ==> rewrite_context_apply [depth=1] res={0,'dc=ad,dc=org,dc=uk'} ==> rewrite_context_apply [depth=1] string='(!(objectClass=*))' ==> rewrite_context_apply [depth=1] res={0,'NULL'} ldap_search_ext put_filter: "(!(objectClass=*))" put_filter: NOT put_filter_list "(objectClass=*)" put_filter: "(objectClass=*)" put_filter: simple put_simple_filter: "objectClass=*" ldap_send_initial_request ldap_send_server_request A successful search with cn shows the following: ==> rewrite_context_apply [depth=1] string='ou=ad.org.uk,dc=meta' ==> rewrite_rule_apply rule='((.+),)?ou=ad.org.uk,[ ]?dc=meta$' string='ou=ad.org.uk,dc=meta' [1 pass(es)] ==> rewrite_context_apply [depth=1] res={0,'dc=ad,dc=org,dc=uk'} ==> rewrite_context_apply [depth=1] string='(cn=user1)' ==> rewrite_context_apply [depth=1] res={0,'NULL'} ldap_search_ext put_filter: "(cn=user1)" put_filter: simple put_simple_filter: "cn=user1" ldap_send_initial_request ldap_send_server_request Here's the minimal slapd.conf file: include /etc/openldap/schema/core.schema modulepath /usr/lib/openldap/modules moduleload back_meta.so argsfile /var/run/slapd/slapd.args pidfile /var/run/slapd/slapd.pid ################################################################# # # Meta DB config # # dc=meta # ################################################################# database meta suffix dc=meta rootdn cn=administrator,dc=meta rootpw secret uri ldap://ad.org.uk:3268/ou=ad.org.uk,dc=meta suffixmassage "ou=ad.org.uk,dc=meta" "dc=ad,dc=org,dc=uk" lastmod off idassert-bind bindmethod=simple binddn="cn=adldap,dc=ad,dc=org,dc=uk credentials="password" flags=non-prescriptive idassert-authzFrom "dn.exact:cn=administrator,dc=meta" Thanks for any help offered. -- Liam Gretton liam.gretton(a)le.ac.uk HPC Architect http://www.le.ac.uk/its IT Services Tel: +44 (0)116 2522254 University of Leicester, University Road Leicestershire LE1 7RH, United Kingdom

2 2

openldap user login
by Jayavant Patil 07 Dec '11

07 Dec '11

Hi, I am using openldap-2.4.19-4 on fedora 12 machine. In order to protect roobindpw, I removed that from /etc/ldap.conf and written it in /etc/ldap.secret with root access only. Now, /etc/ldap.conf file (with permissions 644) contents w.r.t. bind are as follows: # The distinguished name to bind to the server with. # Optional: default is to bind anonymously. #binddn cn=root,dc=abc,dc=com # The credentials to bind with. # Optional: default is no credential. #bindpw cluster # The distinguished name to bind to the server with # if the effective user ID is root. Password is # stored in /etc/ldap.secret (mode 600) rootbinddn cn=root,dc=abc,dc=com but now when I do $ssh ldap_6@client-node-name, I get the following message: id: cannot find name for user ID 514 id: cannot find name for user ID 514 [I have no name!@client-node-name ~]$ when i do $id on client node I get the followng: uid=514 gid=514(ldap_6) groups=514(ldap_6) Any idea what could be the problem? -- Thanks & Regards, Jayavant Ningoji Patil Engineer: System Software Computational Research Laboratories Ltd. Pune-411 004. Maharashtra, India. +91 9923536030.

3 4

Fixed : SHELL env variable not red
by Olivier 07 Dec '11

07 Dec '11

Just to update on that : I have received this RedHat update notification last night : Synopsis openldap bug fix and enhancement update updated : 06/12/11 Subject Updated openldap packages that fix number of bugs and add various enhancements are now available for Red Hat Enterprise Linux 6. Description ... https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/6.2_Tech… I updated and the loginShell variable is now properly used over authentication ( with no change on my initial configuration). I also see that many TLS issues that I have faced in the passed seem to have been fixed : I'm going to check that. Best, --- olivier On Thu, Dec 1, 2011 at 3:00 PM, Olivier <ldap(a)guillard.nom.fr> wrote: > > Hello, > > I have configured nss/pam on a REDHAT6 box to authenticate users > against an ldap : it works but I have a problem with getting my favorite > user shell when I log in. > > The "loginShell" shell attribute sounds to not been used to provide users > with their favorite shell when they log in : may be I misunderstood the > usage of this "posixAccount" attribute ? > > Thanks for your help, see below for additional indications : > > $ ssh olivier(a)redhatbox.example.fr > olivier(a)redhatbox.example.fr's password: < MY LDAP PASSWORD> > > RHN Satellite kickstart on 2011-06-16 > > ##################### > # redhatbox.example.fr # > # # > # Hello # > ##################### > > > sh-4.1$ grep olivier /etc/passwd > <returns nothing (no local entry for olivier)> > > -sh-4.1$ pwd > > /home/olivier (my home directory found in ldap) > > -sh-4.1$ env | grep -i shell > SHELL=/bin/sh ( my shell user environnment is not picked in ldap) > > sh-4.1$ ldapsearch -D uid=olivier,ou=staff,ou=people,dc=example,dc=fr > -W uid=olivier > > Enter LDAP Password: < MY LDAP PASSWORD> > > # olivier, staff, people, example.fr > dn: uid=olivier,ou=staff,ou=people,dc=example,dc=fr > cn: Olivier G > gidNumber: 18000 > homeDirectory: /home/olivier > objectClass: top > objectClass: person > objectClass: organizationalPerson > objectClass: inetOrgPerson > objectClass: posixAccount > objectClass: shadowAccount > sn: olivier > uid: olivier > uidNumber: 1000 > shadowLastChange: 15282 > loginShell: /bin/tcsh > givenName: Olivier > mail: olivier(a)example.fr > userPassword:: xxxxxxxxxxxxxxxxxxxxxxx > > -sh-4.1$ cat /etc/shells > /bin/sh > /bin/bash > /sbin/nologin > /bin/tcsh (my favorite shell is allowed) > /bin/csh > > ANY HELP ??? > > > Thanks > > --- > Olivier

1 0

openldap with Ipv6 link local ip?
by Richard Knight 07 Dec '11

07 Dec '11

Is it possible to use an IPv6 Link-Local ip with openlap clients? address would be of the form ldaps://[fe80::abcd:346:123%eth0]:636 where %eth0 is the interface specifier Richard

2 1

Adding many users together
by Andreas Rudat 06 Dec '11

06 Dec '11

Hello, I have 100 users which I have to add into my ldap database, how can I do that? With a ldif file? Like that? dn: cn=John Doe, ou=Rochester, o=IBM, c=US objectclass: person objectclass: inetOrgPerson objectclass: top objectclass: organizationalPerson objectclass: ePerson cn: John Doe sn: Doe uid: jdoe userpassword: secretpass I think its realy horrible if I want to add 100 users in this way? thanks

4 4

memberof overlay deployment
by Asplund Marko 06 Dec '11

06 Dec '11

Hi, I'm planning on deploying the memberof overlay feature in our OpenLDAP v2.3 directory and I'd like to get some practical advice on this. So far, I've done some testing in my test environment. I've added an overlay directive in slapd.conf: overlay memberof and imported group info to populate data. memberof queries appear to be working fine. Is there something else I should consider in addition? What would be the best way to get the memberof attribute values populated in the production database? Should I reimport all the data? What would be the best way for doing that? Or is it possible to somehow get the attribute values populated without reimporting? marko

5 7

slapd hanging - meta backend - Solaris 10
by Lincoln Souzek 05 Dec '11

05 Dec '11

Hello, I've seen a couple of instances where slapd becomes unresponsive, apparently because the threads are waiting on a backend meta DB. We're running slapd 2.4.23 on Solaris 10 (update 11/06). We have 128 threads configured and when I attach with truss, I see 130 allocated, most of which look like this: /53: lwp_park(0x00000000, 0) (sleeping...) When I run pstack against the PID, the stack for almost all of the threads looks like one of the two threads below, both of which are somewhere within meta_back_search: ----------------- lwp# 20 / thread# 20 -------------------- fee40408 lwp_park (0, 0, 0) 00140e64 ldap_build_search_req (110f0c0, 599eb90, 2, 79db010, 79db0a0, 0) + 2c 001412bc ldap_pvt_search (110f0c0, 599eb90, 2, 79db010, 79db0a0, 0) + d4 000cd494 ???????? (3f45d70, f4fffd58, f4fff478, f4fff294, 0, 2b822c0) 000cd7fc meta_back_search (3f45d70, f4fffd58, 2, 2, 24d400, 0) + 1e0 000a0928 ???????? (3f45d70, f4fffd58, f4fff8e0, 28ff20, 2ac1b8, 14) 000a12dc ???????? (f4fff8e0, f4fffd58, 2, 2, 24d400, 28ff20) 000a3950 overlay_op_walk (8000, f4fffd58, 8000, 28fe18, 28ff20, 818) + 4c 000a3ae4 ???????? (3f45d70, f4fffd58, 2, 1e6000, a3ba0, 28fe18) 00041e08 fe_op_search (3f45d70, f4fffd58, 3f45e70, f4fffad8, 1ee5f8, 1ee6f0) + 3f8 00041528 do_search (3f45d70, f4fffd58, fee6cbc0, 1e6000, 16ec00, f4fffad8) + 590 0003f8e4 ???????? (f4fffe08, 3f45d70, fee6cbc0, fe2d4400, 2683c8, 0) 0013ca30 ???????? (2683b8, f5000000, 0, 0, 13c8d4, 1) fee40368 _lwp_start (0, 0, 0, 0, 0, 0) ----------------- lwp# 21 / thread# 21 -------------------- fee40408 lwp_park (0, 0, 0) 0013e5c8 ldap_result (10ea3b0, 43e, 2, f47ff488, f47ff290, 0) + 3c 000cddf0 meta_back_search (53fe5b8, f47ffd58, 2, 2, 0, 1) + 7d4 000a0928 ???????? (53fe5b8, f47ffd58, f47ff8e0, 28ff20, 2ac1b8, 14) 000a12dc ???????? (f47ff8e0, f47ffd58, 2, 2, 24d400, 28ff20) 000a3950 overlay_op_walk (8000, f47ffd58, 8000, 28fe18, 28ff20, 818) + 4c 000a3ae4 ???????? (53fe5b8, f47ffd58, 2, 1e6000, a3ba0, 28fe18) 00041e08 fe_op_search (53fe5b8, f47ffd58, 53fe6b8, f47ffad8, 1ee5f8, 1ee6f0) + 3f8 00041528 do_search (53fe5b8, f47ffd58, fee6cbc0, 1e6000, 16ec00, f47ffad8) + 590 0003f8e4 ???????? (f47ffe08, 53fe5b8, fee6cbc0, fe2d4800, 2683c8, 0) 0013ca30 ???????? (2683b8, f4800000, 0, 0, 13c8d4, 1) fee40368 _lwp_start (0, 0, 0, 0, 0, 0) I took a core dump while the process was running but I'm not really sure how to proceed from here. Is there any way to get more information on what was happening with these threads at the time? In either case, is this a situation that should be handled with a general timeout directive? We currently only have a network-timeout and a bind timeout specified: network-timeout 3 timeout bind=3 Thanks, Lincoln

2 1

ldap_add_s - mods.mod_values empty
by Sean Ryan 05 Dec '11

05 Dec '11

Hello, Firstly, I hope this is the correct list Relevant versions: O/S: Debian Etch (server) - Debian Lenny (client) Slapd : OpenLDAP: slapd 2.3.30 Client libs : libldap2 (debian) I'm seeing some problems using the ldap_add_s function call - For some reason the mods.mod_values array *appears* to be empty - slapd reports that it's missing values for the attribute type and wireshark confirms that to be the case (partial extract below). addRequest entry: macaddress=002145ccfadf,dc=nodomain attributes: 2 items Item macaddress type: macaddress vals: 0 items The below is the partial source code involved. Code : char * vals[LdapDefaults::MAX_MODS][2]; ACE_DEBUG((LM_DEBUG, "(%t) Add Entry %s:%s %D \n", tempName, tempValue)); vals[loopcount][0] = new char [LdapDefaults::MAX_OPTION_LEN]; vals[loopcount][1] = 0; opTypes[loopcount] = new char [LdapDefaults::MAX_OPTION_LEN]; mod[loopcount].mod_op = 0; strcpy (opTypes[loopcount], tempName); strcpy (vals[loopcount][0], tempValue); mod[loopcount].mod_type = new char [LdapDefaults::MAX_OPTION_LEN]; strcpy (mod[loopcount].mod_type ,opTypes[loopcount]); mod[loopcount].mod_values = vals[loopcount]; loopcount ++; ++ nvpBegin ; for (int counter = 0 ; counter < loopcount ; counter ++) { mods[counter] = &mod[counter]; mods[counter]->mod_values = sn_values; ADA_DEBUG ((LM_DEBUG, "Value == %s\n", mods[counter]->mod_values[0])); } mods[loopcount] = 0; errCode = ldap_add_s(pld, tempDn , mods) ; addRequest entry: macaddress=002145ccfadf,dc=nodomain attributes: 2 items Item macaddress type: macaddress vals: 0 items There are a couple of curious things here. 1. Assigning mod->mod_values to a statically declared array ( char *sn_values[] = { "Jensen", NULL }; mods[counter]->mod_values = sn_values;) does not change the behavior 2. Debugging the contents of mods[i]->mod_values[0] immediately before and after the call to ldap_add_s shows that the correct values as being present in the structure. 3. Building a standalone test application and directly linking my library produced works as expected. Any thoughts on how to debug this further much appreciated. Thanks Sean

1 0

Re: LDAP query to Active Directory backend
by Khaled Blah 05 Dec '11

05 Dec '11

Thanks for your reply, Michael! I should have mentioned that I have tested this code with an OpenLDAP server (2.4.23) and a Lotus Notes server (ver. 8) and both of them return UTF-8 encoded data (like I expected it). The only difference are the parameters which I use to start the query on these backends (bind DN, filter, etc...). Regards, Khaled

1 1

rootDSE
by W.Siebert＠t-systems.com 05 Dec '11

05 Dec '11

Hello, is it posible to add an attribute to rootDSE? regards Waldemar

2 1

Re: RWM
by masarati＠aero.polimi.it 04 Dec '11

04 Dec '11

> Hello, > > the slapd-meta backend (OpenLDAP version: 2.4.26 and 2.4.28) has an own > rewriting module. If I want to use rewriting and remaping, do I have to > install rwm-overlay although I have meta installed? not sure what you mean by "installed"; if you mean "loaded" when built as run-time loadable modules, then the answer is "no". The two modules (back-meta and slapo-rwm) are orthogonal. p.

1 0

extract response controls after ldap_sasl_interactive_bind_s()
by Michael Ströder 04 Dec '11

04 Dec '11

HI! Disclaimer: I'm not a C programmer. I'd like to evaluate response controls (e.g. ppolicy) also when doing a SASL bind. I'm using python-ldap which in turn uses OpenLDAP C API's function ldap_sasl_interactive_bind_s(). But currently there's no way to extract the server's response controls. The server I'm testing with is returning the ppolicy response control and others. I looked at clients/tools/common.c but it seems to me it also uses ldap_sasl_interactive_bind_s() and no response controls are extracted. Do I have to use ldap_get_option(ld,LDAP_OPT_SERVER_CONTROLS) separately? Does that work? Ciao, Michael.

2 5

RWM
by W.Siebert＠t-systems.com 03 Dec '11

03 Dec '11

Hello, the slapd-meta backend (OpenLDAP version: 2.4.26 and 2.4.28) has an own rewriting module. If I want to use rewriting and remaping, do I have to install rwm-overlay although I have meta installed? My predecessor recently left the company. How can I check which backends and overlays are already installed? Kind regards Waldemar

1 0

Re: OpenLDAP syncrepl woes
by Jeffrey Crawford 03 Dec '11

03 Dec '11

Ok will give that a try stay tuned. Jeffrey On Thu, Dec 1, 2011 at 11:39 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, December 01, 2011 9:38 AM -0800 Jeffrey Crawford > <jeffreyc(a)ucsc.edu> wrote: > >>> Humm that didn't seem to work. I'm rebuilding so I'll give that another >>> try. >> >> >> Finally got to do another test. I tested by changing the permissions >> of the replication account permissions and tried restarting with slapd >> -c rid=<number> where the number is the id of the rid= definition in >> the olcSyncrepl configuration. It didn't seem to work (Note the >> permission changes were just what attributes the account could see) >> >> Just for grins I also tried rid=0 and rid by itself. None seemed to >> work. I'm guessing I'm just doing something wrong but not sure what it >> is. > > > Well, rid can't be zero. rid has to be the rid you selected in the replica > for that master connection. Looking at test058, it looks like the correct > syntax is to use -c rid=<rid>,csn=0 > > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration

1 0

Failure while importing an exported ldif file
by Axel Birndt 02 Dec '11

02 Dec '11

Hi @All, now while my ldapserver is working on my testmachine, i'am trying to import my ldif files. I read the thread http://www.openldap.org/lists/openldap-software/200711/msg00069.html but the import isn't working for me. abirndt@lvps83-169-33-218:~/openldap_2axels-company$ sudo slapadd -F /etc/ldap/slapd.d -n 0 -l dc_2axels-company_dc_de_export.ldif slapadd: line 1: database (cn=config) not configured to hold "dc=2axels-company,dc=de" slapadd: line 1: database (cn=config) not configured to hold "dc=2axels-company,dc=de" abirndt@lvps83-169-33-218:~/openldap_2axels-company$ sudo slapadd -F /etc/ldap/slapd.d -n 0 -l cn_config_export.ldif I created my backupfiles with the following commands: sudo slapcat -b cn=config -F /etc/ldap/slapd.d/ >cn_Config_export.ldif sudo slapcat -b dc=2axels-company,dc=de -F /etc/ldap/slapd.d/ >dc_2axels-company_dc_de_export.ldif I'am also looking in google for solving this, but in my mind i haven't the right keywords... Could anyone give me a hint or a link for reading, how to import the created ldif files from above to a new ldap-server? -- Gruß Axel ------------------------------

2 4

Re: memberof overlay deployment
by Bryce Powell 02 Dec '11

02 Dec '11

Hi, I tried the method suggested by Marco to populate memberOf attributes of existing entries: >> How would you recommend getting memberof values populated in the existing directory? > If you can afford a sequence of: > stop -> slapcat -> drop db -> slapadd > Everything gets populated as desired. I tried this and the directory was restored minus the memberOf attributes. I used the following commands on version 2.4.11 (yes, I know I have to upgrade ...) : /usr/local/sbin/slapcat -l data_20111201.ldif (..drop db..) /usr/local/sbin/slapadd -c -v -l data_20111201.ldif 'Manual' group membership updates do result in the memberOf attributes getting updated, so I know the overlay is working. Thanks, Bryce Powell

5 5

Security between server and client nodes.
by Jayavant Patil 02 Dec '11

02 Dec '11

Hi, I am using openLDAP-2.4.19-4 on fedora 12 machine. I want to make server secure from client nodes so that clients don't hack the server node. Hack in the sense that one client doesn't even read the data of another client, client doesn't tamper the server directory information or try to spoof the server. Does anybody have any suggestions how to avoid these things in openLDAP? Thanks in advance. -- Regards, Jayavant Ningoji Patil Engineer: System Software Computational Research Laboratories Ltd. Pune-411 004. Maharashtra, India. +91 9923536030.

3 14

Re: OpenLDAP syncrepl woes
by Jeffrey Crawford 01 Dec '11

01 Dec '11

On Wed, Nov 23, 2011 at 10:13 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Wednesday, November 23, 2011 9:26 AM -0800 Jeffrey Crawford > <jeffreyc(a)ucsc.edu> wrote: > >> read that already: >> >> my original question was the following: >> >> Granted the above issues might be explained away in that we don't yet >> have enough ram on the machines yet, however it does seem to present >> us with a problem when we notice the discrepancy, how do we during run >> time re-sync the data from the provider server? I have tried the slapd >> -c rid=2,csn=20111114000000.000000Z but that doesn't seem to do any >> good. (I've tried several different values of csn=0 >> csn=20111114000000.000000Z#000000#000#000000 etc. to no avail) > > > Regardless of RAM limitations, you should never have an inconsistent > database. However, so far, the only replication mechanism I've seen > guarantee this is delta-syncrepl. This may be better in the upcoming > OpenLDAP 2.4.27 for syncrepl. > > If you read the slapd man page for the -c option, it is quite clear: > > Use only the rid part to force a full reload. Humm that didn't seem to work. I'm rebuilding so I'll give that another try. > > >> from man slapadd >> >> LIMITATIONS >> Your slapd(8) should not be running when you do this to ensure >> consis- tency of the database. >> >> So how can I have slapd run, respond to what data it has currently yet >> understand that it will update all it's data with the source provider >> updating, adding, removing entries as necessary without removing the >> database first? > > I don't understand why you would want slapd to respond with completely bogus > data to any clients doing queries. If you're going to force reload the > replica anyway, it makes much more sense to use slapadd from the master > rather than trying to do it via syncrepl, which can take numerous amounts of > time longer than doing it via slapadd, and during that entire time period, > you have the possibility of sending out significantly erroneous data. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 2

[***** SPAM 3.5 *****] Re: pwdCheckModule not loaded
by Raffael Sahli 01 Dec '11

01 Dec '11

Is OpenLDAP compiled with enable-modules? You should see something in the syslog with loglevel -1 or run the daemon in forderground. Are you sure your daemon reads the config file and not a config db? Clément OUDOT <clem.oudot(a)gmail.com> schrieb: >Le 1 décembre 2011 17:00, Fabian Heinz <fabian.heinz(a)xinfo.de> a écrit : >> Sorry ... >> My outbox contains the mail with list, could be some problem with my >> mailclient html vs txt >> >> It shows as text so I hope list will be kept... > >Fail. > >> I'm using Ubuntu 11.10 >> And I have tried blank and column separated with /usr/lib/ /usr/lib/ldap >> /usr/local/libexec >> Which are the directories I installed the modules to. >> There was no error in logging but also no pwdCheckModule >> > >Sorry, no other idea. Maybe someone else can help you. > >Clément. >

1 0

Re: pwdCheckModule not loaded
by Clément OUDOT 01 Dec '11

01 Dec '11

Le 1 décembre 2011 17:00, Fabian Heinz <fabian.heinz(a)xinfo.de> a écrit : > Sorry ... > My outbox contains the mail with list, could be some problem with my > mailclient html vs txt > > It shows as text so I hope list will be kept... Fail. > I'm using Ubuntu 11.10 > And I have tried blank and column separated with /usr/lib/ /usr/lib/ldap > /usr/local/libexec > Which are the directories I installed the modules to. > There was no error in logging but also no pwdCheckModule > Sorry, no other idea. Maybe someone else can help you. Clément.

1 0

Re: pwdCheckModule not loaded
by Clément OUDOT 01 Dec '11

01 Dec '11

Le 1 décembre 2011 16:33, Fabian Heinz <fabian.heinz(a)xinfo.de> a écrit : > I already did that after your last mail > > => no effect > > Must there one modulepath or are there multiple possible > It seems like the second one but I better ask ... Please keep the list in copy! man slapd.conf: modulepath <pathspec> Specify a list of directories to search for loadable modules. Typically the path is colon-separated but this depends on the operating system. The default is /home/clement/Programmes/openldap/libexec/openldap, which is where the standard OpenLDAP install will place its modules. Clément.

1 0

Re: pwdCheckModule not loaded
by Clément OUDOT 01 Dec '11

01 Dec '11

Le 1 décembre 2011 14:53, Fabian Heinz <fabian.heinz(a)xinfo.de> a écrit : > > Hi > > Thanks for the fast reply. > > > > But didn’t help > > > > Modulepath points to /usr/lib/ldap > > > > I also tried to add a second modulepath, don’t know if this is correct… > > modulepath /usr/lib/ldap > > moduleload back_bdb.la > > moduleload back_hdb.la > > moduleload back_ldap.la > > moduleload back_bdb.lda > > moduleload ppolicy.la > > > > modulepath /usr/local/lib > > > > I installed the library in /usr/local/libexec > > > > Added the modulepath > > But still no effect > > > > Is there any logging for loading of the function? Please keep the list in copy. You said: > modulepath /usr/local/lib > I installed the library in /usr/local/libexec Try modulepath /usr/local/libexec Clément.

1 0

SHELL env variable not red
by Olivier 01 Dec '11

01 Dec '11

Hello, I have configured nss/pam on a REDHAT6 box to authenticate users against an ldap : it works but I have a problem with getting my favorite user shell when I log in. The "loginShell" shell attribute sounds to not been used to provide users with their favorite shell when they log in : may be I misunderstood the usage of this "posixAccount" attribute ? Thanks for your help, see below for additional indications : $ ssh olivier(a)redhatbox.example.fr olivier(a)redhatbox.example.fr's password: < MY LDAP PASSWORD> RHN Satellite kickstart on 2011-06-16 ##################### # redhatbox.example.fr # # # # Hello # ##################### sh-4.1$ grep olivier /etc/passwd <returns nothing (no local entry for olivier)> -sh-4.1$ pwd /home/olivier (my home directory found in ldap) -sh-4.1$ env | grep -i shell SHELL=/bin/sh ( my shell user environnment is not picked in ldap) sh-4.1$ ldapsearch -D uid=olivier,ou=staff,ou=people,dc=example,dc=fr -W uid=olivier Enter LDAP Password: < MY LDAP PASSWORD> # olivier, staff, people, example.fr dn: uid=olivier,ou=staff,ou=people,dc=example,dc=fr cn: Olivier G gidNumber: 18000 homeDirectory: /home/olivier objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount sn: olivier uid: olivier uidNumber: 1000 shadowLastChange: 15282 loginShell: /bin/tcsh givenName: Olivier mail: olivier(a)example.fr userPassword:: xxxxxxxxxxxxxxxxxxxxxxx -sh-4.1$ cat /etc/shells /bin/sh /bin/bash /sbin/nologin /bin/tcsh (my favorite shell is allowed) /bin/csh ANY HELP ??? Thanks --- Olivier

1 0

pwdCheckModule not loaded
by Fabian Heinz 01 Dec '11

01 Dec '11

Hi together, I want to setup password policy in a small company. Were using openldap for a while without any pw constraints. Now I got ppolicy working and pw update fails correctly on the defined constraints. But I am not able to load the pwdCheckModule. I implemented some basic function which should always fail, just to see it is working. But it seems not be loaded. I compiled it as shared library with libtool and tried different locations with no result. I even cannot find any logging information about that. Can you give some tips where to find the loggings or how to increase them. At the moment I configured slapd.conf to loglevel -1 And can only find logging in the syslog Here my policy ldif version: 1 DN: cn=default,ou=policies,dc=company,dc=com objectClass: top objectClass: device objectClass: pwdPolicy objectClass: pwdPolicyChecker cn: default pwdAllowUserChange: TRUE pwdAttribute: userPassword pwdCheckModule: libcheck_password.so pwdCheckQuality: 1 pwdExpireWarning: 432000 pwdFailureCountInterval: 0 pwdGraceAuthNLimit: 0 pwdInHistory: 0 pwdLockout: TRUE pwdLockoutDuration: 1920 pwdMaxAge: 7516800 pwdMaxFailure: 4 pwdMinLength: 8 pwdMustChange: TRUE pwdSafeModify: FALSE I tried to put the shared library to /usr/local/lib and /usr/lib/ldap Both had not effect. Thanks and greetings fabs Beschreibung: C:\Users\fabs\AppData\Roaming\Microsoft\Signatures\xinfo-Dateien\bgleft.png Fabian Heinz Tel.: +49-89-1891788-34 Mobile.: +49-176-36107036 Mail: <mailto:fabian.heinz@xinfo.de> fabian.heinz(a)xinfo.de Beschreibung: C:\Users\fabs\AppData\Roaming\Microsoft\Signatures\xinfo-Dateien\bgbottom.pn g X-info Wieland Sacher GmbH IT-Beratung · Dienstleistung · Entwicklung Automotive IT · Application Solutions · Communications Am Stichgartl 6 | 85764 Oberschleißheim | Tel +49-89-31770785 | Fax +49-89-31770786 | <http://www.xinfo.de> www.xinfo.de Geschäftsführung: Dipl. Phys. Wieland Sacher | Sitz der Gesellschaft:Oberschleißheim Amtsgericht München HRB 1088 49 | UST-Nr:143-828-10155 | UID-NR: DE170540430 <http://www.app-solut.com/> Beschreibung: APP-SOLUT Mobile Applications · Internet Applications · Customized Software

2 1

Possible ACL Issue while try to read Root DSE
by Axel Birndt 01 Dec '11

01 Dec '11

Hi @All, i'am new on this list and i have a question. While i'am using the tool web2ldap from Michael Stroeder and try to create a new entry with this tool. I'am using openldap with cn=config backend on ubuntu 10.04 Michael mentioned it could be a acl problem, because his tool couldn't read the Root DSE If i specify the search base and the adminuser i could see the content of the Tree root. ldapsearch -b "dc=2axels-company,dc=de" -s base 'objectclass=*' -h localhost -D cn=admin,dc=2axels-company,dc=de -W -------------------->> abirndt@ubuntunb:~$ ldapsearch -b "dc=2axels-company,dc=de" -s base 'objectclass=*' -h localhost -D cn=admin,dc=2axels-company,dc=de -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=2axels-company,dc=de> with scope baseObject # filter: objectclass=* # requesting: ALL # # 2axels-company.de dn: dc=2axels-company,dc=de objectClass: dcObject objectClass: organization o: 2axels-company.de dc: 2axels-company description: Tree root <<<<---------------------------------------- But if i use ldapsearch with the following command i got nothing: ldapsearch -b "" -s base 'objectclass=*' ldap_sasl_interactive_bind_s: No such object (32) Could you help me please to identify if there is a problem with reading the Root DSE? What could i do next ? Any help is very appreciated. -- Gruß Axel ------------------------------

6 14

Overlay ordering and compatibility
by Nick Milas 01 Dec '11

01 Dec '11

Hello, We are using overlays: auditlog, dynlist, syncrprov and we would like to evaluate the deployment of MemberOf overlay as well. Is there a suggested ordering of the above overlays? (I've read that ordering matters.) In general: * Is there a suggested ordering list of all standard overlays (i.e. of overlays included in the distibution and/or "officially" documented in http://www.openldap.org/doc/admin24/overlays.html)? * Is there a list of possibly incompatible overlays, i.e. overlays which cannot or should not be used at the same time? * Are there any direct or indirect limitations in the number of used overlays? (e.g. software-related limitations, performance / stability risks etc.) Thanks, Nick

1 0

unclean shutdown detected; attempting recovery - question
by frank.offermanns＠caseris.de 01 Dec '11

01 Dec '11

Hello, I am using OpenLDAP 2.4.25. After reboot I see logs (Logsetting -d 256) like : => bdb_idl_delete_key: c_del id failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30994) I checked this and found that I can ignore this. But one minute after this message OpenLDAP stopped working. I automatically detected it and restarted OpenLDAP. After restarting I see a logmessage: hdb_db_open: database "o=mydomain": unclean shutdown detected; attempting recovery. Then I see for 1 to 3 minutes that OpenLDAP seems to work, before stopping the work again. I repeated restarting. After the sixths restarts LDAP now seems to work correctly. So now my question: When I see the message: "unclean shutdown detected; attempting recovery" How long does the recovery take? Is it possbile that the recovery was still in progress as I restarted (after 5 mins) OpenLDAP? Is there a Logsetting I could activate to see when the recovery is finished? Would it be better to manually do the recovery after stopping slapd? Regards, Frank

2 2

Re: Ldap+Nfsv4+kerberos *nix / *bsd puzzle.
by Harry Coin 30 Nov '11

30 Nov '11

On 11/30/2011 7:23 AM, Juergen.Sprenger(a)swisscom.com wrote: > Hi Harry, > > have done this here with an extended schema for a > heterogeneous environment of AIX, HPUX, Solaris and Linux. > > Extended posixaccount to x-posixaccount with attributetypes (complete schema on request): > 'x-homeDirectory' > 'x-SolarishomeDirectory' > 'x-AIXhomeDirectory' > 'x-LinuxhomeDirectory' > 'x-HPUXhomeDirectory' > > 'x-loginShell' > 'x-SolarisloginShell' > 'x-AIXloginShell' > 'x-LinuxloginShell' > 'x-HPUXloginShell' > > 'x-uidNumber' > 'x-SolarisuidNumber' > 'x-AIXuidNumber' > 'x-LinuxuidNumber' > 'x-HPUXuidNumber' > > 'x-gidNumber' > 'x-SolarisgidNumber' > 'x-AIXgidNumber' > 'x-LinuxgidNumber' > 'x-HPUXgidNumber' > > 'x-AIX5shadowLastChange' > 'x-AIX5shadowMin' > 'x-AIX5shadowMax' > 'x-AIX5shadowWarning' > 'x-AIX5shadowInactive' > 'x-AIX5shadowExpire' > 'x-AIX5shadowFlag' > > Objectclasses: > 'x-posixAccount' > 'x-shadowAccount' > 'x-posixGroup' > > Then configure ldap clients with proper attribute mapping, example for Solaris: > NS_LDAP_ATTRIBUTEMAP= passwd:uidNumber=x-SolarisuidNumber > NS_LDAP_ATTRIBUTEMAP= passwd:gidNumber=x-SolarisgidNumber > NS_LDAP_ATTRIBUTEMAP= passwd:homeDirectory=x-SolarishomeDirectory > NS_LDAP_ATTRIBUTEMAP= passwd:loginSHell=x-SolarisloginShell > > Now each operating system can have its own uid/gid combination and shadow > attributes for a given username. > > Disadvantage is, that You have slightly more complex users and You have to > provide consistent settings on all machines of the same operating system. > > dn: uid=myname,ou=Person,dc=myEnterprise,dc=com > objectClass: top > objectClass: person > objectClass: organizationalPerson > objectClass: inetOrgPerson > objectClass: posixAccount > objectClass: x-posixAccount > objectClass: shadowAccount > sn: myname > cn: myname > uid: myname > mail: myname(a)myEnterpsiem.com > uidNumber: 287564 > gecos: myname > displayName: myname > x-LinuxuidNumber: 287564 > x-SolarisuidNumber: 287564 > x-HPUXuidNumber: 287564 > x-AIXuidNumber: 287564 > homeDirectory: /home/myname > x-AIXhomeDirectory: /home/myname > x-HPUXhomeDirectory: /home/myname > x-LinuxhomeDirectory: /home/myname > x-SolarishomeDirectory: /home/myname > loginShell: /usr/bin/bash > x-LinuxloginShell: /bin/bash > x-HPUXloginShell: /bin/ksh > x-SolarisloginShell: /usr/bin/bash > x-AIXloginShell:: /bin/sh > gidNumber: 50001 > x-HPUXgidNumber: 50001 > x-SolarisgidNumber: 50001 > x-LinuxgidNumber: 50001 > x-AIXgidNumber: 50001 > . > . > . > > > Kind regards > > Juergen Sprenger > Juergen, thanks very much for this. I think your approach strikes a balance between storing the same data in more than one place (separate whole ou trees for each os duplicating other information -- at the benefit of no schema changes), returning exactly the one result wanted given a search (a practical necessity as those who aren't given to maintain ldap clients like nslcd/nss_ldap are not able to cause them to iterate through a number of home-directory results with the same name looking for attributes to discern which is intended). The downside of your approach is as you note no machine specific variants, but those are few enough they can be put in the relevant machine's passwd file and that set to be searched before ldap.

1 0

How to synchornize in ldap? Please help.
by meena jain 30 Nov '11

30 Nov '11

Hi I am new to ldap. In my project , I need to send employee's information to the third party software. For the first time set up , may be I can export the ldap data and push the information to the third party software but later I want to send delta changes. We don't want to write all employee changes every day. How do I achieve this in ldap? Meena

3 2

CUCM search
by W.Siebert＠t-systems.com 30 Nov '11

30 Nov '11

> check your suffixmassage rules and compare to the rewritten suffix. Sorry, now with the right congig bellow, suffixmassage and rewritten suffix matchs, but the problem still the same ----------------------------------------------------------- Hello, now I extended the schema and filter appears without of "?", but my problem still not solved: slapd[20876]: ber_get_next on fd 8 failed errno=0 (Success) slapd[20876]: connection_read(8): input error=-2 id=1001, closing. Nov 28 20:27:39 walrhel5 If I send the same search with various LDAP-Browsers (Softerra, LDP, Perlscript...), all is OK. I tried witch OpenLDAP version: 2.4.26 and 2.4.28 FullLog: Nov 29 22:23:51 despcdarmradtest01 slapd[20876]: conn=1001 fd=8 ACCEPT from IP=10.28.113.34:53476 (IP=0.0.0.0:389) Nov 29 22:23:51 despcdarmradtest01 slapd[20876]: connection_get(8) Nov 29 22:23:51 despcdarmradtest01 slapd[20876]: connection_get(8): got connid=1001 Nov 29 22:23:51 despcdarmradtest01 slapd[20876]: connection_read(8): checking for input on id=1001 Nov 29 22:23:51 despcdarmradtest01 slapd[20876]: op tag 0x60, time 1322601831 Nov 29 22:23:51 despcdarmradtest01 slapd[20876]: conn=1001 op=0 do_bind Nov 29 22:23:51 despcdarmradtest01 slapd[20876]: >>> dnPrettyNormal: <cn=metaguru,dc=meta,dc=pov> Nov 29 22:23:51 despcdarmradtest01 slapd[20876]: <<< dnPrettyNormal: <cn=metaguru,dc=meta,dc=pov>, <cn=metaguru,dc=meta,dc=pov> Nov 29 22:23:51 despcdarmradtest01 slapd[20876]: conn=1001 op=0 BIND dn="cn=metaguru,dc=meta,dc=pov" method=128 Nov 29 22:23:51 despcdarmradtest01 slapd[20876]: do_bind: version=3 dn="cn=metaguru,dc=meta,dc=pov" method=128 Nov 29 22:23:51 despcdarmradtest01 slapd[20876]: conn=1001 op=0 meta_back_bind: dn="cn=metaguru,dc=meta,dc=pov". Nov 29 22:23:51 despcdarmradtest01 slapd[20876]: conn=1001 op=0: rootdn="cn=metaguru,dc=meta,dc=pov" bind succeeded Nov 29 22:23:51 despcdarmradtest01 slapd[20876]: conn=1001 op=0 BIND dn="cn=metaguru,dc=meta,dc=pov" mech=SIMPLE ssf=0 Nov 29 22:23:51 despcdarmradtest01 slapd[20876]: do_bind: v3 bind: "cn=metaguru,dc=meta,dc=pov" to "cn=metaguru,dc=meta,dc=pov" Nov 29 22:23:51 despcdarmradtest01 slapd[20876]: send_ldap_result: conn=1001 op=0 p=3 Nov 29 22:23:51 despcdarmradtest01 slapd[20876]: send_ldap_result: err=0 matched="" text="" Nov 29 22:23:51 despcdarmradtest01 slapd[20876]: send_ldap_response: msgid=1 tag=97 err=0 Nov 29 22:23:51 despcdarmradtest01 slapd[20876]: conn=1001 op=0 RESULT tag=97 err=0 text= Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: connection_get(8) Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: connection_get(8): got connid=1001 Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: connection_read(8): checking for input on id=1001 Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: op tag 0x63, time 1322601833 Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: conn=1001 op=1 do_search Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: >>> dnPrettyNormal: <dc=meta,dc=pov> Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: <<< dnPrettyNormal: <dc=meta,dc=pov>, <dc=meta,dc=pov> Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: SRCH "dc=meta,dc=pov" 0 3 Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: 0 0 0 Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: begin get_filter Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: AND Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: begin get_filter_list Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: begin get_filter Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: EQUALITY Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: end get_filter 0 Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: begin get_filter Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: NOT Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: begin get_filter Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: EQUALITY Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: end get_filter 0 Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: end get_filter 0 Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: end get_filter_list Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: end get_filter 0 Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: filter: (&(objectClass=user)(!(objectClass=computer))) Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: => get_ctrls Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: => get_ctrls: oid="2.16.840.1.113730.3.4.2" (noncritical) Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: <= get_ctrls: n=1 rc=0 err="" Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: attrs: Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: conn=1001 op=1 SRCH base="dc=meta,dc=pov" scope=0 deref=3 filter="(&(objectClass=user)(!(objectClass=computer)))" Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: conn=1001 op=1: meta_back_getconn[0] Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: conn=1001 op=1: meta_back_getconn[1] Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: conn=1001 op=1 meta_back_getconn: candidates=2 conn=ROOTDN fetched Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: conn=1001 op=1 >>> meta_back_search_start[0] Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: conn=1001 op=1 >>> meta_search_dobind_init[0] Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: conn=1001 op=1 <<< meta_search_dobind_init[0]=1 Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: ==> rewrite_context_apply [depth=1] string='dc=meta,dc=pov' Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: ==> rewrite_rule_apply rule='((.+),)?dc=meta,[ ]?dc=pov$' string='dc=meta,dc=pov' [1 pass(es)] Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: ==> rewrite_context_apply [depth=1] res={0,'dc=spcdom,dc=udb'} Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: [rw] searchBase: "dc=meta,dc=pov" -> "dc=spcdom,dc=udb" Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: ==> rewrite_context_apply [depth=1] string='(&(objectClass=user)(!(objectClass=computer)))' Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: ==> rewrite_context_apply [depth=1] res={0,'NULL'} Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: [rw] searchFilter: "(&(objectClass=user)(!(objectClass=computer)))" -> "(&(objectClass=user)(!(objectClass=computer)))" Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: conn=1001 op=1 <<< meta_back_search_start[0]=1 Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: conn=1001 op=1 >>> meta_back_search_start[1] Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: conn=1001 op=1 >>> meta_search_dobind_init[1] Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: conn=1001 op=1 <<< meta_search_dobind_init[1]=1 Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: ==> rewrite_context_apply [depth=1] string='dc=meta,dc=pov' Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: ==> rewrite_rule_apply rule='((.+),)?dc=meta,[ ]?dc=pov$' string='dc=meta,dc=pov' [1 pass(es)] Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: ==> rewrite_context_apply [depth=1] res={0,'dc=metdom,dc=net'} Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: [rw] searchBase: "dc=meta,dc=pov" -> "dc=metdom,dc=net" Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: ==> rewrite_context_apply [depth=1] string='(&(objectClass=user)(!(objectClass=computer)))' Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: ==> rewrite_context_apply [depth=1] res={0,'NULL'} Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: [rw] searchFilter: "(&(objectClass=user)(!(objectClass=computer)))" -> "(&(objectClass=user)(!(objectClass=computer)))" Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: conn=1001 op=1 <<< meta_back_search_start[1]=1 Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: conn=1001 op=1 meta_back_search: ncandidates=2 cnd="**" Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: conn=1001 op=1 meta_back_search[0] match="" err=0. Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: conn=1001 op=1 meta_back_search[1] match="" err=0. Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: send_ldap_result: conn=1001 op=1 p=3 Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: send_ldap_result: err=0 matched="" text="" Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: send_ldap_response: msgid=2 tag=101 err=0 Nov 29 22:23:53 despcdarmradtest01 slapd[20876]: conn=1001 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= Nov 29 22:23:55 despcdarmradtest01 slapd[20876]: connection_get(8) Nov 29 22:23:55 despcdarmradtest01 slapd[20876]: connection_get(8): got connid=1001 Nov 29 22:23:55 despcdarmradtest01 slapd[20876]: connection_read(8): checking for input on id=1001 Nov 29 22:23:55 despcdarmradtest01 slapd[20876]: op tag 0x42, time 1322601835 Nov 29 22:23:55 despcdarmradtest01 slapd[20876]: ber_get_next on fd 8 failed errno=0 (Success) Nov 29 22:23:55 despcdarmradtest01 slapd[20876]: connection_read(8): input error=-2 id=1001, closing. Nov 29 22:23:55 despcdarmradtest01 slapd[20876]: connection_closing: readying conn=1001 sd=8 for close Nov 29 22:23:55 despcdarmradtest01 slapd[20876]: connection_close: deferring conn=1001 sd=8 Nov 29 22:23:55 despcdarmradtest01 slapd[20876]: conn=1001 op=2 do_unbind Nov 29 22:23:55 despcdarmradtest01 slapd[20876]: conn=1001 op=2 UNBIND Kind regards Waldemar -----Ursprüngliche Nachricht----- Von: masarati(a)aero.polimi.it [mailto:masarati@aero.polimi.it] Gesendet: Dienstag, 29. November 2011 12:42 An: Siebert, Waldemar Cc: openldap-technical(a)openldap.org Betreff: Re: CUCM search > Hello, > > I'v implemented a OpenLDAP Metadirectory that proxying 2 Microsft AD > targets. ... > Nov 28 20:27:39 walrhel5 slapd[7447]: filter: > (&(?objectClass=user)(!(?objectClass=Computer))) The objectClasses "user" and "computer" are unknown. They need to be defined in the proxy's schema. p. ########################################################################################## Hello, I'v implemented a OpenLDAP Metadirectory that proxying 2 Microsft AD targets. Cisco Unified Call Manager (CUCM) sends a rather simpy query: (&(objectclass=user)(!(objectclass=Computer))) If CUCM connects AD server directly, all is OK, gets a search result. But sending this search to Meta, does not work. Log: Nov 28 20:27:39 walrhel5 slapd[7447]: ber_get_next on fd 10 failed errno=0 (Success) Nov 28 20:27:39 walrhel5 slapd[7447]: connection_read(10): input error=-2 id=1000, closing. If I send the same search with various LDAP-Browsers (Softerra, LDP, Perlscript...), all is OK. I tried witch OpenLDAP version: 2.4.26 and 2.4.28 My config: include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/ts_ext.schema pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args loglevel -1 ####################################################################### database meta lastmod off suffix "dc=meta,dc=pov" rootdn "cn=metaguru,dc=meta,dc=pov" rootpw Makaka77 uri "ldap://10.28.4.37:389/dc=meta,dc=pov" suffixmassage "dc=meta,dc=pov" "dc=spcdom,dc=udb" idassert-authzFrom "dn:*" idassert-bind bindmethod=simple binddn="cn=radiator,cn=Users,dc=spcdom,dc=udb" credentials="Makaka77" mode=none uri "ldap://10.28.4.39:389/dc=meta,dc=pov" suffixmassage "dc=meta,dc=pov" "dc=metdom,dc=net" idassert-authzFrom "dn:*" idassert-bind bindmethod=simple binddn="cn=predator,cn=Users,dc=metdom,dc=net" credentials="Makaka99" mode=none

2 1

Re: OpenLDAP 2.4.27 RPMs available on LTB-project
by Clément OUDOT 30 Nov '11

30 Nov '11

2011/11/28 Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Friday, November 25, 2011 8:01 PM +0100 Clément OUDOT > <clem.oudot(a)gmail.com> wrote: > >> 2011/11/25, Howard Chu <hyc(a)symas.com>: >>> >>> Clément OUDOT wrote: >>>> >>>> Hello, >>>> >>>> I built today RPMs for OpenLDAP 2.4.27, for those who are interested, >>>> they are available here: http://ltb-project.org/wiki/download#openldap >>> >>> You are probably going to want to respin these with the last 3 commits in >>> master. >>> 26dc16e9f634ed5dc061088ff3bd156dec5170c0 >>> 2c4d548206916676026a5b57298ae3086500eb66 >>> 2a8b55b1c55cb99c09543f1b5648da98f5d28a8d >> >> Thanks for this information, do you plan to release 2.4.28 to include >> these commits? > > Yes. It is out now. Hi, RPMs for OpenLDAP 2.4.28 are now available: http://ltb-project.org/wiki/download#openldap A new RPM has been created to provide overlays lastbind and smbk5pwd. Clément.

1 0

Re: CUCM search
by masarati＠aero.polimi.it 30 Nov '11

30 Nov '11

> Hello, > > I'v implemented a OpenLDAP Metadirectory that proxying 2 Microsft AD > targets. ... > Nov 28 20:27:39 walrhel5 slapd[7447]: filter: > (&(?objectClass=user)(!(?objectClass=Computer))) The objectClasses "user" and "computer" are unknown. They need to be defined in the proxy's schema. p.

3 2

Read/Write Replication setup
by benoit 29 Nov '11

29 Nov '11

Hello, I have setup a ldap replicate, replicating data from an offsite ldap master. Replication is ok, but being a consumer replicate, my ldap server is read only. I need to add and modify attributes to this replicate, but i have no write access to the master and ldap master admin won't change/update schemas... >From the guide, i can't figure if it's possible. Please, let me know what solution i have (on any Linux distro). thanks Ben,

3 4

Trust between two server
by Raffael Sahli 29 Nov '11

29 Nov '11

Hi I have a huge openldap server and a small one with maybe 10 users. The small one contains it admistrator objects (or most of them are admins) and is complitly different from the huge one. So what I want is to include some userobjects or a specific basedn from the small one in the huge one. Im not sure whats the best way for that, maybe meta backend..? or some proxy auth points to the small one.. dc=hugeldap,dc=com |-ou=users |-ou=admins |->point to ldap://ldapserver.com?dc=smallldap,dc=net/memberof=hugeldap Thanks for your help -- Raffael Sahli public(a)raffaelsahli.com

2 1

multi-byte utf8 characters in DNs
by Chris Card 29 Nov '11

29 Nov '11

[I tried searching the docs for the answer without much luck, so apologies if I've missed it] Does openldap (2.4.26) support DNs containing utf8 multi-byte characters? e.g. a DN containing é like cn=été,dc=a,dc=b ? If not, what's the recommended way of handling such DNs? Chris

4 7

CUCM search
by W.Siebert＠t-systems.com 29 Nov '11

29 Nov '11

Hello, I'v implemented a OpenLDAP Metadirectory that proxying 2 Microsft AD targets. Cisco Unified Call Manager (CUCM) sends a rather simpy query: (&(objectclass=user)(!(objectclass=Computer))) If CUCM connects AD server directly, all is OK, gets a search result. But sending this search to Meta, does not work. Log: Nov 28 20:27:39 walrhel5 slapd[7447]: ber_get_next on fd 10 failed errno=0 (Success) Nov 28 20:27:39 walrhel5 slapd[7447]: connection_read(10): input error=-2 id=1000, closing. If I send the same search with various LDAP-Browsers (Softerra, LDP, Perlscript...), all is OK. I tried witch OpenLDAP version: 2.4.26 and 2.4.28 My config: include /usr/local/etc/openldap/schema/core.schema pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args loglevel -1 ####################################################################### database meta lastmod off suffix "dc=meta,dc=pov" rootdn "cn=metaguru,dc=meta,dc=pov" rootpw XXXXXXX uri "ldap://10.11.11.112:389/dc=meta,dc=pov" suffixmassage "dc=meta,dc=pov" "dc=adwal,dc=corporate,dc=net" idassert-authzFrom "dn:*" idassert-bind bindmethod=simple binddn="cn=radiator,cn=Users,dc=adwal,dc=corporate,dc=net" credentials="XXXXXXX" mode=none uri "ldap://10.11.11.114:389/dc=meta,dc=pov" suffixmassage "dc=meta,dc=pov" "dc=second,dc=crocus,dc=com" idassert-authzFrom "dn:*" idassert-bind bindmethod=simple binddn="cn=predator,cn=Users,dc=second,dc=crocus,dc=com" credentials="XXXXXXX" mode=none Full Log: Nov 28 20:27:39 walrhel5 slapd[7447]: conn=1000 fd=10 ACCEPT from IP=10.11.11.119:40478 (IP=0.0.0.0:389) Nov 28 20:27:39 walrhel5 slapd[7447]: connection_get(10) Nov 28 20:27:39 walrhel5 slapd[7447]: connection_get(10): got connid=1000 Nov 28 20:27:39 walrhel5 slapd[7447]: connection_read(10): checking for input on id=1000 Nov 28 20:27:39 walrhel5 slapd[7447]: op tag 0x60, time 1322508459 Nov 28 20:27:39 walrhel5 slapd[7447]: conn=1000 op=0 do_bind Nov 28 20:27:39 walrhel5 slapd[7447]: >>> dnPrettyNormal: <cn=metaguru,dc=meta,dc=pov> Nov 28 20:27:39 walrhel5 slapd[7447]: <<< dnPrettyNormal: <cn=metaguru,dc=meta,dc=pov>, <cn=metaguru,dc=meta,dc=pov> Nov 28 20:27:39 walrhel5 slapd[7447]: conn=1000 op=0 BIND dn="cn=metaguru,dc=meta,dc=pov" method=128 Nov 28 20:27:39 walrhel5 slapd[7447]: do_bind: version=3 dn="cn=metaguru,dc=meta,dc=pov" method=128 Nov 28 20:27:39 walrhel5 slapd[7447]: conn=1000 op=0 meta_back_bind: dn="cn=metaguru,dc=meta,dc=pov". Nov 28 20:27:39 walrhel5 slapd[7447]: conn=1000 op=0: rootdn="cn=metaguru,dc=meta,dc=pov" bind succeeded Nov 28 20:27:39 walrhel5 slapd[7447]: conn=1000 op=0 BIND dn="cn=metaguru,dc=meta,dc=pov" mech=SIMPLE ssf=0 Nov 28 20:27:39 walrhel5 slapd[7447]: do_bind: v3 bind: "cn=metaguru,dc=meta,dc=pov" to "cn=metaguru,dc=meta,dc=pov" Nov 28 20:27:39 walrhel5 slapd[7447]: send_ldap_result: conn=1000 op=0 p=3 Nov 28 20:27:39 walrhel5 slapd[7447]: send_ldap_result: err=0 matched="" text="" Nov 28 20:27:39 walrhel5 slapd[7447]: send_ldap_response: msgid=1 tag=97 err=0 Nov 28 20:27:39 walrhel5 slapd[7447]: conn=1000 op=0 RESULT tag=97 err=0 text= Nov 28 20:27:39 walrhel5 slapd[7447]: connection_get(10) Nov 28 20:27:39 walrhel5 slapd[7447]: connection_get(10): got connid=1000 Nov 28 20:27:39 walrhel5 slapd[7447]: connection_read(10): checking for input on id=1000 Nov 28 20:27:39 walrhel5 slapd[7447]: op tag 0x63, time 1322508459 Nov 28 20:27:39 walrhel5 slapd[7447]: conn=1000 op=1 do_search Nov 28 20:27:39 walrhel5 slapd[7447]: >>> dnPrettyNormal: <dc=meta,dc=pov> Nov 28 20:27:39 walrhel5 slapd[7447]: <<< dnPrettyNormal: <dc=meta,dc=pov>, <dc=meta,dc=pov> Nov 28 20:27:39 walrhel5 slapd[7447]: SRCH "dc=meta,dc=pov" 0 3 Nov 28 20:27:39 walrhel5 slapd[7447]: 0 0 0 Nov 28 20:27:39 walrhel5 slapd[7447]: begin get_filter Nov 28 20:27:39 walrhel5 slapd[7447]: AND Nov 28 20:27:39 walrhel5 slapd[7447]: begin get_filter_list Nov 28 20:27:39 walrhel5 slapd[7447]: begin get_filter Nov 28 20:27:39 walrhel5 slapd[7447]: EQUALITY Nov 28 20:27:39 walrhel5 slapd[7447]: get_ava: illegal value for attributeType objectclass Nov 28 20:27:39 walrhel5 slapd[7447]: end get_filter 0 Nov 28 20:27:39 walrhel5 slapd[7447]: begin get_filter Nov 28 20:27:39 walrhel5 slapd[7447]: NOT Nov 28 20:27:39 walrhel5 slapd[7447]: begin get_filter Nov 28 20:27:39 walrhel5 slapd[7447]: EQUALITY Nov 28 20:27:39 walrhel5 slapd[7447]: get_ava: illegal value for attributeType objectclass Nov 28 20:27:39 walrhel5 slapd[7447]: end get_filter 0 Nov 28 20:27:39 walrhel5 slapd[7447]: end get_filter 0 Nov 28 20:27:39 walrhel5 slapd[7447]: end get_filter_list Nov 28 20:27:39 walrhel5 slapd[7447]: end get_filter 0 Nov 28 20:27:39 walrhel5 slapd[7447]: filter: (&(?objectClass=user)(!(?objectClass=Computer))) Nov 28 20:27:39 walrhel5 slapd[7447]: => get_ctrls Nov 28 20:27:39 walrhel5 slapd[7447]: => get_ctrls: oid="2.16.840.1.113730.3.4.2" (noncritical) Nov 28 20:27:39 walrhel5 slapd[7447]: <= get_ctrls: n=1 rc=0 err="" Nov 28 20:27:39 walrhel5 slapd[7447]: attrs: Nov 28 20:27:39 walrhel5 slapd[7447]: Nov 28 20:27:39 walrhel5 slapd[7447]: conn=1000 op=1 SRCH base="dc=meta,dc=pov" scope=0 deref=3 filter="(&(?objectClass=user)(!(?objectClass=Computer)))" Nov 28 20:27:39 walrhel5 slapd[7447]: conn=1000 op=1: meta_back_getconn[0] Nov 28 20:27:39 walrhel5 slapd[7447]: conn=1000 op=1: meta_back_getconn[1] Nov 28 20:27:39 walrhel5 slapd[7447]: conn=1000 op=1 meta_back_getconn: candidates=2 conn=ROOTDN inserted Nov 28 20:27:39 walrhel5 slapd[7447]: conn=1000 op=1 >>> meta_back_search_start[0] Nov 28 20:27:39 walrhel5 slapd[7447]: conn=1000 op=1 >>> meta_search_dobind_init[0] Nov 28 20:27:39 walrhel5 slapd[7447]: conn=1000 op=1 <<< meta_search_dobind_init[0]=4 Nov 28 20:27:39 walrhel5 slapd[7447]: conn=1000 op=1 <<< meta_back_search_start[0]=4 Nov 28 20:27:39 walrhel5 slapd[7447]: conn=1000 op=1 >>> meta_back_search_start[1] Nov 28 20:27:39 walrhel5 slapd[7447]: conn=1000 op=1 >>> meta_search_dobind_init[1] Nov 28 20:27:39 walrhel5 slapd[7447]: conn=1000 op=1 <<< meta_search_dobind_init[1]=4 Nov 28 20:27:39 walrhel5 slapd[7447]: conn=1000 op=1 <<< meta_back_search_start[1]=4 Nov 28 20:27:39 walrhel5 slapd[7447]: conn=1000 op=1 meta_back_search: ncandidates=2 cnd="**" Nov 28 20:27:39 walrhel5 slapd[7447]: conn=1000 op=1 >>> meta_search_dobind_init[0] Nov 28 20:27:39 walrhel5 slapd[7447]: conn=1000 op=1 <<< meta_search_dobind_init[0]=2 Nov 28 20:27:39 walrhel5 slapd[7447]: conn=1000 op=1 >>> meta_search_dobind_init[1] Nov 28 20:27:39 walrhel5 slapd[7447]: conn=1000 op=1 <<< meta_search_dobind_init[1]=2 Nov 28 20:27:39 walrhel5 slapd[7447]: conn=1000 op=1 >>> meta_back_search_start[0] Nov 28 20:27:39 walrhel5 slapd[7447]: conn=1000 op=1 >>> meta_search_dobind_init[0] Nov 28 20:27:39 walrhel5 slapd[7447]: conn=1000 op=1 <<< meta_search_dobind_init[0]=1 Nov 28 20:27:39 walrhel5 slapd[7447]: ==> rewrite_context_apply [depth=1] string='dc=meta,dc=pov' Nov 28 20:27:39 walrhel5 slapd[7447]: ==> rewrite_rule_apply rule='((.+),)?dc=meta,[ ]?dc=pov$' string='dc=meta,dc=pov' [1 pass(es)] Nov 28 20:27:39 walrhel5 slapd[7447]: ==> rewrite_context_apply [depth=1] res={0,'dc=adwal,dc=corporate,dc=net'} Nov 28 20:27:39 walrhel5 slapd[7447]: [rw] searchBase: "dc=meta,dc=pov" -> "dc=adwal,dc=corporate,dc=net" Nov 28 20:27:39 walrhel5 slapd[7447]: ==> rewrite_context_apply [depth=1] string='(&(objectClass=user)(!(objectClass=Computer)))' Nov 28 20:27:39 walrhel5 slapd[7447]: ==> rewrite_context_apply [depth=1] res={0,'NULL'} Nov 28 20:27:39 walrhel5 slapd[7447]: [rw] searchFilter: "(&(objectClass=user)(!(objectClass=Computer)))" -> "(&(objectClass=user)(!(objectClass=Computer)))" Nov 28 20:27:39 walrhel5 slapd[7447]: conn=1000 op=1 <<< meta_back_search_start[0]=1 Nov 28 20:27:39 walrhel5 slapd[7447]: conn=1000 op=1 >>> meta_back_search_start[1] Nov 28 20:27:39 walrhel5 slapd[7447]: conn=1000 op=1 >>> meta_search_dobind_init[1] Nov 28 20:27:39 walrhel5 slapd[7447]: conn=1000 op=1 <<< meta_search_dobind_init[1]=1 Nov 28 20:27:39 walrhel5 slapd[7447]: ==> rewrite_context_apply [depth=1] string='dc=meta,dc=pov' Nov 28 20:27:39 walrhel5 slapd[7447]: ==> rewrite_rule_apply rule='((.+),)?dc=meta,[ ]?dc=pov$' string='dc=meta,dc=pov' [1 pass(es)] Nov 28 20:27:39 walrhel5 slapd[7447]: ==> rewrite_context_apply [depth=1] res={0,'dc=second,dc=crocus,dc=com'} Nov 28 20:27:39 walrhel5 slapd[7447]: [rw] searchBase: "dc=meta,dc=pov" -> "dc=second,dc=crocus,dc=com" Nov 28 20:27:39 walrhel5 slapd[7447]: ==> rewrite_context_apply [depth=1] string='(&(objectClass=user)(!(objectClass=Computer)))' Nov 28 20:27:39 walrhel5 slapd[7447]: ==> rewrite_context_apply [depth=1] res={0,'NULL'} Nov 28 20:27:39 walrhel5 slapd[7447]: [rw] searchFilter: "(&(objectClass=user)(!(objectClass=Computer)))" -> "(&(objectClass=user)(!(objectClass=Computer)))" Nov 28 20:27:39 walrhel5 slapd[7447]: conn=1000 op=1 <<< meta_back_search_start[1]=1 Nov 28 20:27:39 walrhel5 slapd[7447]: conn=1000 op=1 meta_back_search[0] match="" err=0. Nov 28 20:27:39 walrhel5 slapd[7447]: conn=1000 op=1 meta_back_search[1] match="" err=0. Nov 28 20:27:39 walrhel5 slapd[7447]: send_ldap_result: conn=1000 op=1 p=3 Nov 28 20:27:39 walrhel5 slapd[7447]: send_ldap_result: err=0 matched="" text="" Nov 28 20:27:39 walrhel5 slapd[7447]: send_ldap_response: msgid=2 tag=101 err=0 Nov 28 20:27:39 walrhel5 slapd[7447]: conn=1000 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= Nov 28 20:27:39 walrhel5 slapd[7447]: connection_get(10) Nov 28 20:27:39 walrhel5 slapd[7447]: connection_get(10): got connid=1000 Nov 28 20:27:39 walrhel5 slapd[7447]: connection_read(10): checking for input on id=1000 Nov 28 20:27:39 walrhel5 slapd[7447]: op tag 0x42, time 1322508459 Nov 28 20:27:39 walrhel5 slapd[7447]: ber_get_next on fd 10 failed errno=0 (Success) Nov 28 20:27:39 walrhel5 slapd[7447]: connection_read(10): input error=-2 id=1000, closing. Nov 28 20:27:39 walrhel5 slapd[7447]: connection_closing: readying conn=1000 sd=10 for close Nov 28 20:27:39 walrhel5 slapd[7447]: connection_close: deferring conn=1000 sd=10 Nov 28 20:27:39 walrhel5 slapd[7447]: conn=1000 op=2 do_unbind Nov 28 20:27:39 walrhel5 slapd[7447]: conn=1000 op=2 UNBIND Nov 28 20:27:39 walrhel5 slapd[7447]: connection_resched: attempting closing conn=1000 sd=10 Nov 28 20:27:39 walrhel5 slapd[7447]: connection_close: conn=1000 sd=10 Nov 28 20:27:39 walrhel5 slapd[7447]: =>meta_back_conn_destroy: fetching conn=1000 DN="cn=metaguru,dc=meta,dc=pov" Nov 28 20:27:39 walrhel5 slapd[7447]: daemon: removing 10 Nov 28 20:27:39 walrhel5 slapd[7447]: conn=1000 fd=10 closed Where is my mistake ? Can you help me please Kind regards Waldemar

1 0

Re: Unable to login on client nodes.
by Raffael Sahli 29 Nov '11

29 Nov '11

On 11/29/2011 07:00 AM, Jayavant Patil wrote: > > > On Mon, Nov 28, 2011 at 4:49 PM, Raffael Sahli > <public(a)raffaelsahli.com <mailto:public@raffaelsahli.com>> wrote: > > On 11/28/2011 11:38 AM, Jayavant Patil wrote: >> >> >> On Mon, Nov 28, 2011 at 3:43 PM, Raffael Sahli >> <public(a)raffaelsahli.com <mailto:public@raffaelsahli.com>> wrote: >> >> >>Hi >> >> >> >>>but $cat /etc/shadow doesn't show any password information >> for user ldap_6. So, how do I know that userPassword >> attribute information is getting propagated to client nodes? >> >> >>/etc/shadow is only for local user accounts. >> >> >> >>su ldap_6 works? >> >> yes, su ldap_6 works. > > >How did you test that? With root acceess? > > From server machine > [root@server]$ssh root@n20 > [root@n20]$su ldap_6 > it doesn't ask password and switches to ldap_6 > [ldap_6@n20]$ Yes, it doesn't ask with root access, test it with a non root account...Then you should see a password prompt, and check the authentification syslog! You should see some PAM entries.... > On client node > $getent passwd shows > ldap_6:x:514:514:ldap_6:/home/ldap_6:/bin/bash > > $getent shadow shows > ldap_6:*:13998::99999:7::: > > That means password is not getting propagated. So, how to sync up the password? Thats correct, you don't have to sync the passwords! The password is only stored in the ldap tree. I guess with NSS everything is fine, you should check your pam log entries! > > >Test it with a normal user, so you have to enter a password for > the ldap account > > > I have set password for user ldap_6 with ldappasswd command and > userPassword attribute shows the hash of it when I do ldapsearch for > ldap_6. > > Why the password for ldap_6 is not getting propagated to client > nodes? Because of which I am unable to do $ssh > ldap_6@<client-node-name> from server node. > > > > >And kill the nscd daemon for ldap tests. > > > >> >> >Pam LDAP libraries installed and configured? >> >> nss_ldap and pam_ldap installed. >> >> >ldapsearch bind works? >> >> ldapsearch works on client nodes. >> >> >> >> >SSH Debug log? >> >> >> OpenSSH_5.3p1, OpenSSL 1.0.0a-fips 1 Jun 2010 >> debug1: Reading configuration data /root/.ssh/config >> debug1: Reading configuration data /etc/ssh/ssh_config >> debug1: Applying options for * >> debug1: Connecting to n20 port 22. >> debug1: Connection established. >> debug1: permanently_set_uid: 0/0 >> debug1: identity file /root/.ssh/identity type -1 >> debug1: identity file /root/.ssh/id_rsa type 1 >> debug1: identity file /root/.ssh/id_dsa type -1 >> debug1: Remote protocol version 2.0, remote software version >> OpenSSH_5.3 >> debug1: match: OpenSSH_5.3 pat OpenSSH* >> debug1: Enabling compatibility mode for protocol 2.0 >> debug1: Local version string SSH-2.0-OpenSSH_5.3 >> debug1: SSH2_MSG_KEXINIT sent >> debug1: SSH2_MSG_KEXINIT received >> debug1: kex: server->client aes128-ctr hmac-md5 none >> debug1: kex: client->server aes128-ctr hmac-md5 none >> debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent >> debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP >> debug1: SSH2_MSG_KEX_DH_GEX_INIT sent >> debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY >> debug1: Host 'n20' is known and matches the RSA host key. >> debug1: Found key in /root/.ssh/known_hosts:3 >> debug1: ssh_rsa_verify: signature correct >> debug1: SSH2_MSG_NEWKEYS sent >> debug1: expecting SSH2_MSG_NEWKEYS >> debug1: SSH2_MSG_NEWKEYS received >> debug1: SSH2_MSG_SERVICE_REQUEST sent >> debug1: SSH2_MSG_SERVICE_ACCEPT received >> debug1: Authentications that can continue: >> publickey,gssapi-keyex,gssapi-with-mic,password >> debug1: Next authentication method: gssapi-with-mic >> debug1: Unspecified GSS failure. Minor code may provide more >> information >> Credentials cache file '/tmp/krb5cc_0' not found >> >> debug1: Unspecified GSS failure. Minor code may provide more >> information >> Credentials cache file '/tmp/krb5cc_0' not found >> >> debug1: Unspecified GSS failure. Minor code may provide more >> information >> >> >> debug1: Next authentication method: publickey >> debug1: Trying private key: /root/.ssh/identity >> debug1: Offering public key: /root/.ssh/id_rsa >> debug1: Authentications that can continue: >> publickey,gssapi-keyex,gssapi-with-mic,password >> debug1: Trying private key: /root/.ssh/id_dsa >> debug1: Next authentication method: password >> ldap_6@n20's password: >> >> > > > Öhm, We need the server side log entries... And with debug log level > ? > > > >> >> >> >> >> -- >> Raffael Sahli >> public(a)raffaelsahli.com <mailto:public@raffaelsahli.com> >> >> >> >> >> On 11/28/2011 09:49 AM, Jayavant Patil wrote: >> >> Hi, >> >> I am using openLDAP-2.4.19-4 on fedora 12 machine. I >> have done all server and client configurations. The >> directory containing user information is getting >> available on client nodes(checked by $getent passwd) but >> I am unable to do >> >> $ssh <user-name>@client-node-name >> >> it shows >> Permission denied >> (publickey,gssapi-keyex,gssapi-with-mic,password). >> >> My client node .ssh/config file contents are as follows: >> >> ForwardX11 yes >> StrictHostKeyChecking no >> FallBackToRsh no >> BatchMode yes >> ConnectionAttempts 5 >> UsePrivilegedPort no >> Compression no >> Cipher blowfish >> UserKnownHostsFile /dev/null >> CheckHostIP no >> >> >> Even I am unable to login on the client node from >> console(i.e. from client node login window itself), it >> shows authentication failure message. >> >> On client node with $getent passwd, it shows >> >> ldap_6:x:514:514:ldap_6:/home/ldap_6:/bin/bash >> >> but $cat /etc/shadow doesn't show any password >> information for user ldap_6. So, how do I know that >> userPassword attribute information is getting propagated >> to client nodes? >> >> >> >> >> -- >> >> Thanks & Regards, >> Jayavant Ningoji Patil >> Engineer: System Software >> Computational Research Laboratories Ltd. >> Pune-411 004. >> Maharashtra, India. >> +91 9923536030. >> >> >> >> >> -- >> >> Thanks & Regards, >> Jayavant Ningoji Patil >> Engineer: System Software >> Computational Research Laboratories Ltd. >> Pune-411 004. >> Maharashtra, India. >> +91 9923536030. >> > > > -- > Raffael Sahli > public(a)raffaelsahli.com <mailto:public@raffaelsahli.com> > > > > > -- > > Thanks & Regards, > Jayavant Ningoji Patil > Engineer: System Software > Computational Research Laboratories Ltd. > Pune-411 004. > Maharashtra, India. > +91 9923536030. > -- Raffael Sahli public(a)raffaelsahli.com

1 0

Syncrepl error causes consumers to freeze
by Nick Milas 28 Nov '11

28 Nov '11

Hi, I am using 2.4.26 on syncrepl master (provider) (package on CentOS 5.7 x86_64) and 2.4.22, 2.4.26 on two consumers respectively. Last night, I edited a user account (hosted in LDAP) and when this tried to replicate to two consumers, both froze. This did not happen on another consumer (also 2.4.26) which was using replication over the Manager account. The two ones which froze are using a limited-privileged BindDN for replication which does not have access to user accounts (so, the user account should/would not be replicated on those two consumers). On the master: Nov 23 23:12:04 ldap slapd[2295]: syncprov_sendresp: cookie=rid=333,csn=20111123211204.601542Z#000000#000#000000 Nov 23 23:12:04 ldap slapd[2295]: syncprov_sendresp: cookie=rid=222,csn=20111123211204.601542Z#000000#000#000000 On slave 222: Nov 23 23:12:04 vdns slapd2.4[2145]: do_syncrep2: rid=222 cookie=rid=222,csn=20111123211204.601542Z#000000#000#000000 Nov 23 23:12:04 vdns slapd2.4[2145]: syncrepl_entry: rid=222 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_MODIFY) Nov 23 23:12:04 vdns slapd2.4[2145]: syncrepl_entry: rid=222 be_search (0) Nov 23 23:12:04 vdns slapd2.4[2145]: syncrepl_entry: rid=222 uid=userx,ou=people,dc=example,dc=com Nov 23 23:12:04 vdns slapd2.4[2145]: slap_queue_csn: queing 0x2aaab0019970 20111123211204.601542Z#000000#000#000000 and /var/log/messages: Nov 23 23:12:04 vdns kernel: slapd2.4[2164]: segfault at 00000001075c61a8 rip 0000000000480ecb rsp 00000000424e04c0 error 4 On slave 333: Nov 23 23:12:04 dns2 slapd[2364]: do_syncrep2: rid=333 cookie=rid=333,csn=20111123211204.601542Z#000000#000#000000 Nov 23 23:12:04 dns2 slapd[2364]: syncrepl_entry: rid=333 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_MODIFY) Nov 23 23:12:04 dns2 slapd[2364]: syncrepl_entry: rid=333 be_search (0) Nov 23 23:12:04 dns2 slapd[2364]: syncrepl_entry: rid=333 uid=userx,ou=people,dc=example,dc=com Nov 23 23:12:04 dns2 slapd[2364]: slap_queue_csn: queing 0x19e8cfa0 20111123211204.601542Z#000000#000#000000 and /var/log/messages: Nov 23 23:12:04 dns2 kernel: slapd[2736] general protection rip:4b5342 rsp:43c54530 error:0 I have not seen this behavior in months and months of use. Any advice? Thanks, Nick

4 6

Re: Unable to login on client nodes.
by Raffael Sahli 28 Nov '11

28 Nov '11

On 11/28/2011 11:38 AM, Jayavant Patil wrote: > > > On Mon, Nov 28, 2011 at 3:43 PM, Raffael Sahli > <public(a)raffaelsahli.com <mailto:public@raffaelsahli.com>> wrote: > > >Hi > > > >>but $cat /etc/shadow doesn't show any password information for > user ldap_6. So, how do I know that userPassword attribute > information is getting propagated to client nodes? > > >/etc/shadow is only for local user accounts. > > > >su ldap_6 works? > > yes, su ldap_6 works. How did you test that? With root acceess? Test it with a normal user, so you have to enter a password for the ldap account And kill the nscd daemon for ldap tests. > > >Pam LDAP libraries installed and configured? > > nss_ldap and pam_ldap installed. > > >ldapsearch bind works? > > ldapsearch works on client nodes. > > > > >SSH Debug log? > > > OpenSSH_5.3p1, OpenSSL 1.0.0a-fips 1 Jun 2010 > debug1: Reading configuration data /root/.ssh/config > debug1: Reading configuration data /etc/ssh/ssh_config > debug1: Applying options for * > debug1: Connecting to n20 port 22. > debug1: Connection established. > debug1: permanently_set_uid: 0/0 > debug1: identity file /root/.ssh/identity type -1 > debug1: identity file /root/.ssh/id_rsa type 1 > debug1: identity file /root/.ssh/id_dsa type -1 > debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3 > debug1: match: OpenSSH_5.3 pat OpenSSH* > debug1: Enabling compatibility mode for protocol 2.0 > debug1: Local version string SSH-2.0-OpenSSH_5.3 > debug1: SSH2_MSG_KEXINIT sent > debug1: SSH2_MSG_KEXINIT received > debug1: kex: server->client aes128-ctr hmac-md5 none > debug1: kex: client->server aes128-ctr hmac-md5 none > debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent > debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP > debug1: SSH2_MSG_KEX_DH_GEX_INIT sent > debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY > debug1: Host 'n20' is known and matches the RSA host key. > debug1: Found key in /root/.ssh/known_hosts:3 > debug1: ssh_rsa_verify: signature correct > debug1: SSH2_MSG_NEWKEYS sent > debug1: expecting SSH2_MSG_NEWKEYS > debug1: SSH2_MSG_NEWKEYS received > debug1: SSH2_MSG_SERVICE_REQUEST sent > debug1: SSH2_MSG_SERVICE_ACCEPT received > debug1: Authentications that can continue: > publickey,gssapi-keyex,gssapi-with-mic,password > debug1: Next authentication method: gssapi-with-mic > debug1: Unspecified GSS failure. Minor code may provide more information > Credentials cache file '/tmp/krb5cc_0' not found > > debug1: Unspecified GSS failure. Minor code may provide more information > Credentials cache file '/tmp/krb5cc_0' not found > > debug1: Unspecified GSS failure. Minor code may provide more information > > > debug1: Next authentication method: publickey > debug1: Trying private key: /root/.ssh/identity > debug1: Offering public key: /root/.ssh/id_rsa > debug1: Authentications that can continue: > publickey,gssapi-keyex,gssapi-with-mic,password > debug1: Trying private key: /root/.ssh/id_dsa > debug1: Next authentication method: password > ldap_6@n20's password: > > Öhm, We need the server side log entries... And with debug log level > > > > > -- > Raffael Sahli > public(a)raffaelsahli.com <mailto:public@raffaelsahli.com> > > > > > On 11/28/2011 09:49 AM, Jayavant Patil wrote: > > Hi, > > I am using openLDAP-2.4.19-4 on fedora 12 machine. I have > done all server and client configurations. The directory > containing user information is getting available on client > nodes(checked by $getent passwd) but I am unable to do > > $ssh <user-name>@client-node-name > > it shows > Permission denied > (publickey,gssapi-keyex,gssapi-with-mic,password). > > My client node .ssh/config file contents are as follows: > > ForwardX11 yes > StrictHostKeyChecking no > FallBackToRsh no > BatchMode yes > ConnectionAttempts 5 > UsePrivilegedPort no > Compression no > Cipher blowfish > UserKnownHostsFile /dev/null > CheckHostIP no > > > Even I am unable to login on the client node from console(i.e. > from client node login window itself), it shows authentication > failure message. > > On client node with $getent passwd, it shows > > ldap_6:x:514:514:ldap_6:/home/ldap_6:/bin/bash > > but $cat /etc/shadow doesn't show any password information for > user ldap_6. So, how do I know that userPassword attribute > information is getting propagated to client nodes? > > > > > -- > > Thanks & Regards, > Jayavant Ningoji Patil > Engineer: System Software > Computational Research Laboratories Ltd. > Pune-411 004. > Maharashtra, India. > +91 9923536030. > > > > > -- > > Thanks & Regards, > Jayavant Ningoji Patil > Engineer: System Software > Computational Research Laboratories Ltd. > Pune-411 004. > Maharashtra, India. > +91 9923536030. > -- Raffael Sahli public(a)raffaelsahli.com

1 0

per-dn limits
by Markus Wernig 28 Nov '11

28 Nov '11

Hello all I do not seem to be able to get per-dn limits working ... openldap-2.4.25 on Solaris 11 x86 I have put the following in slapd.conf: limits dn.exact="cn=repl_ldap,dc=domain,dc=com" size=unlimited time=unlimited access to * by dn="cn=repl_ldap,dc=domain,dc=com" read ... (obviously the syncrepl user ;-) and also: syncrepl rid=1 ... sizelimit="unlimited" timelimit="unlimited" searchbase="dc=domain,dc=com" binddn="n=repl_ldap,dc=domain,dc=com" on the consumer side But the DN always gets a maximum of 500 entries, whether using ldapsearch or during replication: # ldapsearch -x -h localhost '(objectClass=*)' -D"cn=repl_ldap,dc=domain,dc=com" -W -b "dc=domain,dc=com" Enter LDAP Password:XXXX [...] # search result search: 2 result: 4 Size limit exceeded # numResponses: 501 # numEntries: 500 While there are ~700 entries in the directory. The same happens during replication, where only 500 entries are synced to the consumer (eg. if I delete the local DB on the consumer and restart slapd) Only if I set ... sizelimit unlimited timelimit unlimited ... globally in the provider's slapd.conf (i.e. before any database definition), does repl_ldap receive all entries. Is there anything else I need to configure in order to allow the DN access to all entries? thx /markus PS: I have also tried different variants of the following: limits dn.exact="cn=repl_ldap,dc=domain,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited

2 3

Re: Unable to login on client nodes.
by Raffael Sahli 28 Nov '11

28 Nov '11

Hi >but $cat /etc/shadow doesn't show any password information for user ldap_6. So, how do I know that userPassword attribute information is getting propagated to client nodes? /etc/shadow is only for local user accounts. su ldap_6 works? Pam LDAP libraries installed and configured? ldapsearch bind works? SSH Debug log? -- Raffael Sahli public(a)raffaelsahli.com On 11/28/2011 09:49 AM, Jayavant Patil wrote: > Hi, > > I am using openLDAP-2.4.19-4 on fedora 12 machine. I have done all > server and client configurations. The directory containing user > information is getting available on client nodes(checked by $getent > passwd) but I am unable to do > > $ssh<user-name>@client-node-name > > it shows > Permission denied > (publickey,gssapi-keyex,gssapi-with-mic,password). > > My client node .ssh/config file contents are as follows: > > ForwardX11 yes > StrictHostKeyChecking no > FallBackToRsh no > BatchMode yes > ConnectionAttempts 5 > UsePrivilegedPort no > Compression no > Cipher blowfish > UserKnownHostsFile /dev/null > CheckHostIP no > > > Even I am unable to login on the client node from console(i.e. from > client node login window itself), it shows authentication failure message. > > On client node with $getent passwd, it shows > > ldap_6:x:514:514:ldap_6:/home/ldap_6:/bin/bash > > but $cat /etc/shadow doesn't show any password information for user > ldap_6. So, how do I know that userPassword attribute information is > getting propagated to client nodes? > > > > > -- > > Thanks& Regards, > Jayavant Ningoji Patil > Engineer: System Software > Computational Research Laboratories Ltd. > Pune-411 004. > Maharashtra, India. > +91 9923536030. >

1 0

Unable to login on client nodes.
by Jayavant Patil 28 Nov '11

28 Nov '11

Hi, I am using openLDAP-2.4.19-4 on fedora 12 machine. I have done all server and client configurations. The directory containing user information is getting available on client nodes(checked by $getent passwd) but I am unable to do $ssh <user-name>@client-node-name it shows Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password). My client node .ssh/config file contents are as follows: ForwardX11 yes StrictHostKeyChecking no FallBackToRsh no BatchMode yes ConnectionAttempts 5 UsePrivilegedPort no Compression no Cipher blowfish UserKnownHostsFile /dev/null CheckHostIP no Even I am unable to login on the client node from console(i.e. from client node login window itself), it shows authentication failure message. On client node with $getent passwd, it shows ldap_6:x:514:514:ldap_6:/home/ldap_6:/bin/bash but $cat /etc/shadow doesn't show any password information for user ldap_6. So, how do I know that userPassword attribute information is getting propagated to client nodes? -- Thanks & Regards, Jayavant Ningoji Patil Engineer: System Software Computational Research Laboratories Ltd. Pune-411 004. Maharashtra, India. +91 9923536030.

1 0

OpenLDAP 2.4.27 RPMs available on LTB-project
by Clément OUDOT 28 Nov '11

28 Nov '11

Hello, I built today RPMs for OpenLDAP 2.4.27, for those who are interested, they are available here: http://ltb-project.org/wiki/download#openldap You can find the description of the RPMs here: http://ltb-project.org/wiki/documentation/openldap-rpm They include an init script described here: http://ltb-project.org/wiki/documentation/openldap-initscript Hope it helps, Clément.

3 3

OpenLDAP Statistics
by Felip Moll 25 Nov '11

25 Nov '11

Hello all, I am new to this list and I would like to ask you a question regarding OpenLDAP. The fact is that I have an OpenLDAP server that receive a lot of operations every day. I have different kind of services that make use of LDAP and bind to this server. In a particular case, there are an ou=Users that contain approx. 200 users with their attributes. I am using also a private LDAP schema developed by me in which I have some extra attributes. Recently we have managed an audit promoted by our government in which a lot of security items had been checked and corrected if had found some issue. One of this security checks was about the management of user passowrds and an other regarding to user accounts. The first one could be satisfied by implementing the ppolicy overlay in LDAP. But in the second one, the audit people imposed us to have a control of which accounts were not being used in the last year, and to delete/backup/etc them if it were the case. The fact is that I searched for ways of gathering statistics of account usage. The alternatives that I found were: First, save the statistics in 2 attributes in each user: lastBind, failedBinds. 1. For each service, whenever a bind from a user has done to LDAP, send a ldapmodify operation for this user and if the bind was successful, write in user.lastBind the timestamp. If it was not, increment failedBinds++. It implies the modification of each service, taking in account that all has to be documented, that in many services the implementation is not trivial, and also taking care of the upgrades of the services. In conclusion, a lot of work and constant modifications and checks. 2. Act on the LDAP server and activate the "overlay accesslog" funcionality. In this case, monitor every bind operation, then create a daemon that reads every X time the LDAP accesslog tree and process it. For each entry processed: - Delete it from the ldap accesslog tree. - Check if the reqResult was 49 (invalid creds.) or 0 (success). - If it was 49, ldapsearch the reqDN who made the bind request, and read his failedBins attribute. Increment it in one, and send a ldapmodify to the user and with the new value of failedBinds. - If it was 0, ldapmodify the reqDN setting the lastBind as reqEnd. I programmed it in C++ and ldapc++ library, and it works. But the fact is that I am not convinced of this solution. It saved us from the audit but for the future there are some problems to take into account: - Deleting the ldap entry every time it's read is bad, because then we cannot use the overlay for delta syncrepl. - Every 10 minutes, ldap deletes the oldest entries, making that in some cases my dameon can fail (treated with an exception, but not cool). - 3000 binds / 10 minutes in normal hours. Up to 40.000 binds in one Monday morning. My question is obvious. Is there any way other than the daemon, the first option, or suicide, to accomplish the requeriments of the audit? How does a big company to register the last bind of every user account, if this account can use many different and heterogenous services? (VPN, FTP, WEBs, propietary software, Windows samba, Linux login, etc.) Best regards, sorry for my bad english and for my big post!. Felip Moll

4 6

Enforce remote SSL/TLS
by Kasper Loopstra 24 Nov '11

24 Nov '11

Dear list, We are using PAM to authenticate posixUsers against OpenLDAP. This works great, and allows 'local' (ssh) logins. However, we also use LDAP for a number of other services, including remote access and editing via other software. This means we would like to keep our users passwords as secure as possible, and enforce encrypted logins for all remote hosts. However, PAM should still be able to authenticate. The manner of encryption is not really important, it just has to be strong enough to be useful over the internet, and usable for all (or most) clients. We have tried various solutions with ssf directives in /etc/ldap/slapd.conf as well as the security tls=1 directive. All of these attempts broke PAM. Is what we are trying to do possible with OpenLDAP? If so, could someone maybe point us to an example configuration? Thank you for your time, Kasper Loopstra.

3 3

How to remove global slapd config values
by David Donn 24 Nov '11

24 Nov '11

Hi, I set the config value for "directory" to /var/openldap-data in my slapd.conf. But now I would like to remove my setting and just go with the default for this (/var/lib/ldap AFAIK). But I can't seem to get rid of the old value. I have tried removing /etc/openldap/slapd.d/*, /var/openldap-data and /var/lib/ldap/*. Whenever I run "slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d" it complains that /var/openldap-data doesn't exist. How does it even know about this directory any more? I'm using OpenLDAP 2.4.23 on RHEL 6.1. Cheers, David

2 1

Re: Limiting host access
by Jayavant Patil 24 Nov '11

24 Nov '11

Hi, I want to restrict login access to some selected client nodes (by default, openldap allows user access to all client nodes). I have googled for this, tried many different configurations like host attribute,hostObject class etc. but failed to get the required. On Mon, Nov 21, 2011 at 11:47 AM, Bill MacAllister <whm(a)stanford.edu> wrote: > > > --On Monday, November 21, 2011 11:06:21 AM +0530 Jayavant Patil < > jayavant.patil82(a)gmail.com> wrote: > > Hi, >> >> I am using openldap-2.4.19-4 on fedora 12 machine. My question is as >> follows: >> >> How to restrict a user access to some client nodes? >> >> Please, explain in detail. >> > > It is not clear what you want to do. You need to provide more details > before you will get the answer that you want. > > For example, if you just want to restrict access to the directory from > some nodes, why not use iptables. > > If you are talking about restricting login access to some linux nodes > using PAM, this is probably a better question for a PAM list. Of course, > there will be folks on this list that can answer that question as well, > but not without knowing what you are storing in your directory. > > Bill > > > -- > > Bill MacAllister > Infrastructure Delivery Group, Stanford University > > -- Thanks & Regards, Jayavant Ningoji Patil +91 9923536030.

3 7

Re: OpenLDAP syncrepl woes
by Jeffrey Crawford 23 Nov '11

23 Nov '11

read that already: my original question was the following: Granted the above issues might be explained away in that we don't yet have enough ram on the machines yet, however it does seem to present us with a problem when we notice the discrepancy, how do we during run time re-sync the data from the provider server? I have tried the slapd -c rid=2,csn=20111114000000.000000Z but that doesn't seem to do any good. (I've tried several different values of csn=0 csn=20111114000000.000000Z#000000#000#000000 etc. to no avail) from man slapadd LIMITATIONS Your slapd(8) should not be running when you do this to ensure consis- tency of the database. So how can I have slapd run, respond to what data it has currently yet understand that it will update all it's data with the source provider updating, adding, removing entries as necessary without removing the database first? Thanks Jeffrey On Tue, Nov 22, 2011 at 7:01 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, November 22, 2011 5:50 PM -0800 Jeffrey Crawford > <jeffreyc(a)ucsc.edu> wrote: > > >> Starting slapd with the -c option isn't working or I'm using the wrong >> combination. > > man "slapadd". > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

Enable/Disable user account in openLDAP
by Jayavant Patil 23 Nov '11

23 Nov '11

Hi, I am using openldap-2.4.19-4 on fedora 12 machine. Does anybody know how to enable/disable a user account in openLDAP? I know ppolicy overlay but I don't require this password based locking. Thanks in advance. -- Regards, Jayavant Ningoji Patil Engineer: System Software Computational Research Laboratories Ltd. Pune-411 004. Maharashtra, India. +91 9923536030.

5 11

Problem with sambaAccount user entry
by Darko Marshauzer 23 Nov '11

23 Nov '11

Hi, I have a problem with my shares on a open-e storage. I cannot get the sambaSid of the system. However, the support of open-e advise me to add a test user entry including the objectclass sambaAccount. As I try this I run into a strage behaviour getting an Invalid syntax error. adding new entry "uid=test,ou=people,dc=xxx,dc=xx" ldapadd: Invalid syntax (21) additional info: objectClass: value #2 invalid per syntax my test user ldif file is dn: uid=test,ou=people,dc=xxx,dc=xx objectClass: posixAccount objectClass: top objectClass: sambaAccount objectClass: inetOrgPerson uid: test cn: test userPassword: {CRYPT}xxxxxxxxx loginShell: /bin/bash sn: test rid: 3000 uidNumber: 900 gidNumber: 1000 homeDirectory: /home/test I am using openldap server 2.3.43-12.el5_7.9.x86_64 What could be the reason? Normally shouldn´t be a problem, or not? Thanks Darko -- Dipl.-Inf. Darko Maršhauzer Hochschule Reutlingen Robert Bosch Zentrum für Leistungselektronik Alteburgstraße 150 72762 Reutlingen Phone: +49 (7121) 271-7080 Email: Darko.Marshauzer(a)Reutlingen-University.de www.reutlingen-university.de www.rbzentrum.de

1 0

Re: OpenLDAP syncrepl woes
by Jeffrey Crawford 23 Nov '11

23 Nov '11

On Thu, Nov 17, 2011 at 11:47 PM, Howard Chu <hyc(a)symas.com> wrote: > Jeffrey Crawford wrote: >> >> On Thu, Nov 17, 2011 at 9:21 PM, Howard Chu<hyc(a)symas.com> wrote: >>> >>> Jeffrey Crawford wrote: >>>> >>>> On Thu, Nov 17, 2011 at 5:50 PM, Howard Chu<hyc(a)symas.com> wrote: >>>>> >>>>> There ought to be other error messages in your log, immediately >>>>> preceding >>> >>>>> the one you quoted. Post those too. >>> >>>> There really isn't much there but here is an example really not much >>>> around it: (I've modified the usernames only) >>>> >>>> Nov 17 21:11:55 localhost slapd[1912]: conn=1478 op=10706 DEL >>>> dn="uid=user1,ou=people,dc=ucsc,dc=edu" >>>> Nov 17 21:11:55 localhost slapd[1912]: conn=1478 op=10706 RESULT >>>> tag=107 err=0 text= >>>> Nov 17 21:11:55 localhost slapd[1912]: conn=1478 op=10707 DEL >>>> dn="uid=user2,ou=people,dc=ucsc,dc=edu" >>>> Nov 17 21:11:55 localhost slapd[1912]: conn=1478 op=10707 RESULT >>>> tag=107 err=0 text= >>>> Nov 17 21:11:55 localhost slapd[1912]: conn=1478 op=10708 DEL >>>> dn="uid=user3,ou=people,dc=ucsc,dc=edu" >>>> Nov 17 21:11:55 localhost slapd[1912]: conn=1478 op=10708 RESULT >>>> tag=107 err=0 text= >>>> Nov 17 21:11:55 localhost slapd[1912]: conn=1478 op=10709 DEL >>>> dn="uid=user4,ou=people,dc=ucsc,dc=edu" >>>> Nov 17 21:11:55 localhost slapd[1912]: bdb(dc=ucsc,dc=edu): previous >>>> transaction deadlock return not resolved >>>> Nov 17 21:11:55 localhost slapd[1912]: => bdb_idl_delete_key: cursor >>>> failed: Invalid argument (22) >>>> Nov 17 21:11:55 localhost slapd[1912]: conn=1478 op=10709 RESULT >>>> tag=107 err=80 text=entry index delete failed >>>> Nov 17 21:11:55 localhost slapd[1912]: conn=1478 op=10710 DEL >>>> dn="uid=user5,ou=people,dc=ucsc,dc=edu" >>>> Nov 17 21:11:55 localhost slapd[1912]: conn=1478 op=10710 RESULT >>>> tag=107 err=0 text= >>> >>> Strange. The log shows an error occurring while deleting an index. The >>> error >>> message indicates that there was already a deadlock before, but there's >>> no >>> message from the original deadlock, and the indexing code logs *every* >>> error >>> that occurs. Seems more likely a BDB bug. >>> >>> Also your client is broken, it looks like it completely ignored the >>> failure >>> result from the ldapdelete operation, it just went right on to issue >>> another >>> request. > >> ldapdelete was using the -c option so it just continued I've actually >> was able to replicate the error on a small local installation using >> the default openldap install. When I changed it to BDB 4.8 I've yet to >> see the error. So I'm going to run this a few more times and see if it >> does indeed fix things. >> >> Fingers crossed > > Sounds promising. Looking forward to your conclusion. > > Of course, with back-mdb, none of this type of nonsense can ever happen... > > -- > -- Howard Chu > CTO, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc/ > Chief Architect, OpenLDAP http://www.openldap.org/project/ > Things look pretty good since going to bdb 4.8. However for future reference, what is the best way to force a replica to simply discard what it has and reload from the provider ldaps. So far all I can do is remove the database and restart. However this means any record it has yet to see is not available until the replica get to that record. I would rather re-sync in such a way that it looks at each records and re-updates or deletes if it cant find the original record on the provider server. Starting slapd with the -c option isn't working or I'm using the wrong combination. Thanks Jeffrey

2 1

W.: Newbie: can't connect and enable logging
by cfisi＠arcor.de 22 Nov '11

22 Nov '11

Hi list, I installed OpenLdap on Debian Squeeze. When trying to connect to Openldap jxplorer just says: "Opening connection to ldap://192.168.1.102:389". Nothing more happens. How can I enable logging (in Openldap or jxplorer) and above all how can I connect? Thank you in advance. - Chris

2 2

Using a bitwise filter
by W.Siebert＠t-systems.com 22 Nov '11

22 Nov '11

Hello, I'v implemented a OpenLDAP Metadirectory that proxying 2 Microsft AD targets. Some attributes on Active Directory objects are composed of bitwise flags. Using a bitwise operator is necessary to return only objects that match a particular bit being set. To query Active Directory for user class objects that are disabled: (UserAccountControl:1.2.840.113556.1.4.803:=2) I'm trying to create a filter that selects entries for which the object class is a user but not a computer, and for which the account is not flagged as disabled: (&(objectclass=user)(!(objectclass=Computer))(!(UserAccountControl:1.2.840.113556.1.4.803:=2))) If I connect AD server directly, all is OK, I get a search result. But sending this search to Meta, does not work. Log: slapd[22461]: conn=1004 op=3 SRCH base="dc=meta,dc=pov" scope=2 deref=2 filter="(&(?objectClass=user)(!(?objectClass=Computer))(?=error))" slapd[22461]: conn=1004 op=3 meta_back_search: base="dc=meta,dc=pov" scope=2: no candidate could be selected slapd[22461]: conn=1004 op=3 SEARCH RESULT tag=101 err=32 nentries=0 text= slapd[22461]: conn=1004 op=4 UNBIND My OpenLDAP version: 2.4.26 my config: database meta lastmod off suffix "dc=meta,dc=pov" rootdn "cn=metaguru,dc=meta,dc=pov" rootpw xxxxxxxx uri "ldap://w3kvm.adwal.corporate.net:389/dc=meta,dc=pov" suffixmassage "dc=meta,dc=pov" "dc=adwal,dc=corporate,dc=net" idassert-authzFrom "dn:*" idassert-bind bindmethod=simple binddn="cn=radiator,cn=Users,dc=adwal,dc=corporate,dc=net" credentials="xxxxx" mode=none uri "ldap://w3kvm02.adwal.corporate.net:389/dc=meta,dc=pov" suffixmassage "dc=meta,dc=pov" "dc=second,dc=crocus,dc=com" idassert-authzFrom "dn:*" idassert-bind bindmethod=simple binddn="cn=predator,cn=Users,dc=second,dc=crocus,dc=com" credentials="xxxxxxxx" mode=none Where is my mistake ? Can you help me please Kind regards Waldemar

3 2

Rewrite inside a database backend ?
by Mathieu MILLET 22 Nov '11

22 Nov '11

Hello, I was trying to enable rewrite of partial DN inside a database backend context, but I would like to not add a specific context for this rewrite. Slapo-rwm's man says that this overlay is intended for back-ldap and back-meta, but doesn't say it is restricted to these backends. Is this possible ? Let me explain and give some more details of what I would like to do : My context is : "dc=example,dc=local", which is stored inside a back-bdb (or back-hdb). User Objects would be added by client such as : uid=AA0000000,ou=users,dc=example,dc=local But, I would like to store these objects as : uid=AA0000000,ou=AA,ou=users,dc=example,dc=local So my rewriting configuration lines would be like : rwm-rewriteContext addDN rwm-rewriteRule "^uid=(..)([^,]+),ou=users,dc=example,dc=local$" "^uid=$1$2,ou=$1,ou=users,dc=example,dc=local$" ":" I know that the main purpose of adding one level of OU may not be very elegant, but it could be useful in the future for being able to partition the directory. Sincerely yours, Mathieu. -- Mathieu MILLET mailto:ldap@htam.net

1 0

proxy authentication
by LALOT Dominique 22 Nov '11

22 Nov '11

I am coming back on a thread as there was no answer master or replica (managed by a central team) /\ | (proxied bind) partial replica (no userpassword) (managed by another team) /\ | simple bind Is there a simple way to do that (no kerberos/sasl)? The bind on the partial replica is proxied to another server. Thanks Dom -- Dominique LALOT Ingénieur Systèmes et Réseaux http://annuaire.univmed.fr/showuser.php?uid=lalot

2 1

Limiting host access
by Juergen.Sprenger＠swisscom.com 22 Nov '11

22 Nov '11

Hi, You might want to check out nisNetgroup functionality. 1. add rfc2307bis to Your nis.schema: #attributetype ( 1.3.6.1.1.1.1.14 NAME 'nisNetgroupTriple' # DESC 'Netgroup triple' # SYNTAX 1.3.6.1.1.1.0.0 ) # rfc2307bis attributetype ( 1.3.6.1.1.1.1.14 NAME 'nisNetgroupTriple' DESC 'Netgroup triple' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) 2. add nis-netgroups to Your directory: dn: cn=myhostname,ou=Netgroup,dc=example,dc=com objectClass: top objectClass: nisNetgroup description: users allowed to log in to myhostname cn: myhostname nisNetgroupTriple: (,user1,) nisNetgroupTriple: (,user2,) ... 3. add compat-mode to nsswitch.conf: passwd: compat passwd_compat: ldap group: compat group_compat: ldap 4. add netgroup-entries to /etc/passwd and /etc/shadow: Last line of /etc/passwd: +@ myhostname:x::::: Last line of /etc/shadow: +@ myhostname:NP::::::: Now only local users and users listed in dn: cn=myhostname,ou=Netgroup,dc=example,dc=com can log in to the machine. For easy administration You can group together users in netgroups and allow those as memberNisNetgroup: dn: cn=myhostname,ou=Netgroup,dc=example,dc=com objectClass: top objectClass: nisNetgroup description: users allowed to log in to myhostname cn: myhostname memberNisNetgroup: rhdmin memberNisNetgroup: mysqldba ... Regards Juergen Sprenger

1 0

Re: OpenLDAP syncrepl woes
by Jeffrey Crawford 21 Nov '11

21 Nov '11

Okay using bdb 4.8 seems to be working better, I ran through several mass adds and deletes. I stil get periodic failures of: Nov 21 10:32:27 idm-prod-ldap-2 slapd[41275]: conn=-1 op=0: attribute "reqEnd" index delete failure which is obviously part of the acceslog overlay. I am replicating that DB between the Mirror mode masters so there may be some other issues at play here. I'm attempting to make sure that the accesslog is in sync between them so that if a failover occurs we only need to look at the current active ldap server to see the changes made. On Mon, Nov 21, 2011 at 10:05 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Wednesday, November 16, 2011 3:49 PM -0800 Jeffrey Crawford > <jeffreyc(a)ucsc.edu> wrote: > >>>> Oh and we are using bdb 4.6 right now (forgot to answer that) > > With all the patches? Oracle lists 4. > > 4.6.21 > Requires log file format upgrade. change log - patches ( 4) good question it's the default FreeBSD build would hope they have included them but I'm not the sysadmin on the box itself. in any case using 4.8 seems to be working (I think) > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

OpenLDAP syncrepl woes
by Jeffrey Crawford 21 Nov '11

21 Nov '11

I'm trying to stabilize our openldap server farm before going live and am finding that despite the contextCSN matching between providers and replicas, the actual content of the server is getting out of sync. This is most prominent when we are testing our population routine and we need to remove all accounts before starting. right now it's only about 22000 entries (It will get much larger). During the mass delete we got the following sprinkled throughout the logs on all machines: ==== Nov 15 15:47:16 idm-prod-ldap-2 slapd[33070]: bdb(dc=domain,dc=name): previous transaction deadlock return not resolved Nov 15 15:47:16 idm-prod-ldap-2 slapd[33070]: => bdb_idl_delete_key: cursor failed: Invalid argument (22) and the various replicas would still have accounts left over but they wouldn't match each other. Granted the above issues might be explained away in that we don't yet have enough ram on the machines yet, however it does seem to present us with a problem when we notice the discrepancy, how do we during run time re-sync the data from the provider server? I have tried the slapd -c rid=2,csn=20111114000000.000000Z but that doesn't seem to do any good. (I've tried several different values of csn=0 csn=20111114000000.000000Z#000000#000#000000 etc. to no avail) I guess my question is two fold, how do I really verify replication is working properly and is in sync, and how to I force a replica to just take the current content from a provider without question. (I don't really want to remove the database and have it re-sync, rather have it go through and check the content and update as needed). Thanks Jeffrey Crawford

3 11

slapo-rwm and NAME aliases
by Michael Ströder 21 Nov '11

21 Nov '11

HI! Some address book LDAP clients are stupid and cannot be re-configured which LDAP attributes contain the specific address information. In particular I'm struggling with Outlook's LDAP address book which expects 'streetAddress' instead of 'street'. I'm using slapo-rwm for mapping other attributes. That works. But rwm-map attribute streetAddress street does not return streetAddress in the search result probably because 'streetAddress' and 'street' gets normalized to the same attribute type description. What to do in such a case? It' part of the standard schema shipped with OpenLDAP and I don't want to mess up this. Ciao, Michael.

1 0

LDAP query to Active Directory backend
by Khaled Blah 21 Nov '11

21 Nov '11

Hello to all, I've been witnessing a strange thing when (LDAP-) querying an Active Directory backend (Windows Server 2003): the output data I receive seems to be encoded in the ISO8859 character set when I would expect it to be UTF-8. Has anyone else experienced anything like this? I'd be glad to learn how to make sure the AD backend gives UTF-8 data back. I use OpenLDAP 2.4.23 on Ubuntu 10.04 and 11.04 Regards, Khaled

2 1

OpenLDAP SASL Passthrough
by Raffael Sahli 21 Nov '11

21 Nov '11

Hi, I'm so confused with the sasl passthrough implementation. I set for the user test in my ldap tree the password {SASL}test@MY_REALM Keytab: [test@ldap-master001 /]#--> ls /etc/krb5.keytab -l -rw-r----- 1 root openldap 1078 2011-11-11 11:56 /etc/krb5.keytab SASL GSSAPI Auth: works well [test@ldap-master001 /]#--> ldapwhoami SASL/GSSAPI authentication started SASL username: test@MY_REALM SASL SSF: 56 SASL data security layer installed. dn:uid=test,cn=mycomany.net,cn=gssapi,cn=auth SASL SLAPD Config: [root@ldap-master001 /]#---> cat /usr/lib/sasl2/slapd.conf pwcheck_method: saslauthd saslauthd_path: /var/run/saslauthd/mux keytab: /etc/krb5.keytab testsaslauthd works well: [root@ldap-master001 /]#---> testsaslauthd -u test -p MYPASSWORD -r MY_REALM -s ldap 0: OK "Success." sasl debug log: saslauthd[26077] :do_auth : auth success: [user=test] [service=ldap] [realm=MY_REALM] [mech=kerberos5] saslauthd[26077] :do_request : response: OK But the ldapsearch simplebind command takes 7-10s... [test@ldap-master001 /]#--> ldapsearch -D uid=test,ou=users,dc=my,dc=company -w MYPASSWORD -s base -b '' -x ldap_bind: Invalid credentials (49) And the sasl debug log shows: saslauthd[26076] :do_auth : auth failure: [user=test] [service=ldap] [realm=MY_REALM] [mech=kerberos5] [reason=saslauthd internal error] WTF, why works testsaslauthd well but failed with ldap auth? The kerberos server works well in both commands..... root@ldap-master001:/usr/local/etc/openldap# /usr/local/libexec/slapd -V @(#) $OpenLDAP: slapd 2.4.21 (Nov 10 2011 11:20:35) $ root@ldap-master001:/usr/local/src/openldap-2.4.21/servers/slapd root@ldap-master001:/usr/local/etc/openldap# saslauthd -v saslauthd: /usr/local/lib/liblber-2.4.so.2: no version information available (required by saslauthd) saslauthd: /usr/local/lib/libldap_r-2.4.so.2: no version information available (required by saslauthd) saslauthd 2.1.23 authentication mechanisms: sasldb getpwent kerberos5 pam rimap shadow ldap Thank you

3 6

Limiting host access
by Jayavant Patil 21 Nov '11

21 Nov '11

Hi, I am using openldap-2.4.19-4 on fedora 12 machine. My question is as follows: How to restrict a user access to some client nodes? Please, explain in detail. -- Thanks & Regards, Jayavant Ningoji Patil +91 9923536030.

2 1

Newbie: can't connect and enable logging
by cfisi＠arcor.de 20 Nov '11

20 Nov '11

Hi list, I installed OpenLdap on Debian Squeeze. When trying to connect to Openldap jxplorer just says: "Opening connection to ldap://192.168.1.102:389". Nothing more happens. How can I enable logging (in Openldap or jxplorer) and above all how can I connect? Thank you in advance. - Chris

3 4

Re: How to configure Unique Overlay in cn=config
by Igor Blanco 19 Nov '11

19 Nov '11

Thanks Quanah: I'm using Debian Stable's repository and would prefer to stay in sync with the repo to ease the maintenance process. AFAIK Debian usually applies critical patches in its own packaging version so maybe some of those issues are already addressed. My exact version is 2.4.23-7.2, which I think that means that is version 7.2 of Debian package or something like this. I'll take some time and check it just in case there is something really nasty that I should be aware of, thank you very much. Going back to unique overlay. I finally managed to configure it, as you say I just added a new module entry but I wasn't seeing the corresponding configuration objectclasses needed. After restarting slapd they appeared. Thank you very much. 2011/11/9 Quanah Gibson-Mount <quanah(a)zimbra.com> > --On Monday, November 07, 2011 7:05 PM +0100 Igor Blanco < > iblanco(a)binovo.es> wrote: > > Hello everyone, >> >> >> I'm trying to configure the uniqueness overlay in Debian Squeeze >> (OpenLDAP 2.4.23) using "cn=config" but I can't figure how to do it and >> can't find any good doc about it, the FAQ-O-Matic wasn't very helpful >> this time. >> >> >> I've added a new "olcModuleLoad=unique" attribute in >> "cn=module{0},cn=config" and it hasn't complained, but how and where do I >> set "olcUniqueURI" ? in "olcDatabase={1}hdb,cn=config" ? This attribute >> does not seem to be present in my OpenLDAP installation, do I have to add >> any new schema? >> >> >> Any reference to documentation explaining how to configure "unique" >> overlay within "cn=config" would be much appreciated. A dump of a >> "cn=config" branch correctly configured would be fantastic. >> > > First, I would seriously advise you to upgrade to 2.4.26. 2.4.23 has > numerous, serious issues. You may also want to grab the patch for ITS#7030 > from the git repo (<http://www.openldap.org/**devel/gitweb.cgi?p=openldap. > **git;a=commitdiff;h=**eae46d35d252f5e7cfd623984f0896**e951d507c9<http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commitdiff;h=eae4…> > >) > > As for adding unique, it's pretty trivial. I have a perl script that does > it using Net::LDAP, but you can trivially change this for ldapadd: > > my $ldap = Net::LDAP->new('ldapi://%**2fopt%2fzimbra%2fopenldap%**2fvar%2frun%2fldapi/') > or die "$@"; > my $mesg = $ldap->bind("cn=config", password=>"$ldap_root_**password"); > $mesg->code && die "Bind: ". $mesg->error . "\n"; > my $dn="cn=module{0},cn=config"; > $mesg = $ldap->modify( > $dn, > add =>{olcModuleLoad => 'unique.la'}, > ); > my $bdn="olcDatabase={2}hdb,cn=**config"; > $mesg = $ldap ->search( > base=>"$bdn", > filter=>"(objectClass=**olcUniqueConfig)", > scope=>"sub", > attrs => ['1.1'], > ); > > my $size = $mesg->count; > if ($size == 0) { > $dn="olcOverlay=unique,$bdn"; > $mesg = $ldap->add( "$dn", > attr => [ > 'olcUniqueURI' => 'ldap:///?mail?sub', > 'objectclass' => ['olcOverlayConfig', > 'olcUniqueConfig', ], > ] > ); > $mesg->code && warn "failed to add entry: ", $mesg->error ; > } > $ldap->unbind; > > > > The basic idea is you add a new entry, olcOverlay=unique,<base database > DN> with the objectClasses and the unique URI. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Igor Blanco González Binovo IT Human Project e-mail: iblanco(a)binovo.es Telf. : 943 493611 - 690229375 Dirección: Astigarraga Bidea 2 Planta 6. - Ofi. 3-2 20180 Oiartzun ( Gipuzkoa )

2 1

Question to an ACL
by Andreas Rudat 18 Nov '11

18 Nov '11

Hi, I'm trying to understand these acl's: {0} to attrs=userPassword,shadowLastChange,sambaNTPassword,sambaLMPassword by dn="cn=admin,dc=foo,dc=bar" write <--admin can read/write by anonymous auth <--anonyomous can auth by self write <--- object owner can read/write by * none <--all other users denied {1}to dn.base="" by * read <-- all can read the root dc=foo, dc=bar {2}to * by dn="cn=admin,dc=studsemi,dc=intern" write <-- by * read so with acl 0: users and admin can read/write passwords, all others can do nothing with that acl 1: ALL can read the root dc=foo,dc=bar acl 2: all other attributes can be read by all others and only admin can also modify all other attributes? so if that is correct, then I think acl 1 isnt needed? Thanks

2 3

MDB (Memory-Mapped Database) for OpenLDAP at UKUUG Spring 2012
by Jan-Piet Mens 18 Nov '11

18 Nov '11

Just a short heads-up for those interested in MDB: I note Howard Chu will be speaking at the Spring 2012 UKUUG conference in Edinburg, UK. More details at [1]. -JP [1]: http://www.flossuk.org/Events/Spring2012/Talks

1 0

trigger script on change to db
by E.S. Rosenberg 17 Nov '11

17 Nov '11

I was wondering is it possible to set a slapd syncprov consumer to trigger a script when it receives changes to the db (updates of specific attributes). Basically we have a bunch of flat files that are created and maintained based on information kept in slapd which need to either: - run every X time and just dumbly regenerate the files. - run every X time and somehow establish whether changes happened before regenerating the files (maybe by using the contextCSN attribute of the root object) - run whenever a change happens In a situation with not too many changes the third option is best, and in situations with lots of changes the second option is probably better. But is the third option even possible? Thanks and best regards, Eli

4 6

Search access does not return any result
by sim123 15 Nov '11

15 Nov '11

Hi All, I am playing with access controls on openldap 2.4.26, I have a user with search access on everything access to * by anonymous auth by dn="uid=102,ou=system,dc=example,dc=com" search And when I perform search I get nothing ldapsearch -H "ldap://testldap:389" -D "uid=102,ou=system,dc=example,dc=com" -b "ou=users,dc=example,dc=com" -x -W '(uid=1)' mail cn dn Enter LDAP Password: # extended LDIF # # LDAPv3 # base <ou=users,dc=example,dc=com> with scope subtree # filter: (uid=1) # requesting: mail cn dn # # search result search: 2 result: 0 Success # numResponses: 1 so I get a success but no value, is it a valid response? I want to control access so that the "uid=102" user can do lookup from given attributes but can not do (objectClass=*) to get a list of every entry in the ldap. Thanks for the help

2 4

A question about Mirror mode sync
by Andrew Liu 15 Nov '11

15 Nov '11

Hi All, I set up two machines as LDAP server under mirror replication mode using openldap-2.4.26。 I found a problem: when a server was down, any LDAP *add *operation on the running server will not propagate *immediately *to the previous down server after it has restarted, but the LDAP *delete* operation can do. and I found *after 5-10 *minutes, the *add *operation content can be found on the previous down server. but it seems the time is not constant. My question: How to enable the add operations content to propagates to the previous down server *immediately*? I have ever tried "-c rid=001,sid=001,csn=0 " to force a full load, but didn't take effect. I read the OpenLDAP doc, found the session-log doesn't include add operation, what's sync mechanism of the add operation. Thanks BRs, Andrew I

1 0

Overlays syncrepl and smbk5pwd
by Francesco Storti 15 Nov '11

15 Nov '11

Hi, I am using both syncrepl (for replication) and smbk5pwd (for password synchronisation between samba and ldap account) overlays. I have configured replication in the simplest way: a read-only producer that forwards updates to the provider thought updateref. If I change my password thought passwd command on a client with pam modules configured for gaining information from the provider everything works fine (userPassword, sambaLMPassword and sambaNTPassword are correctly syncronized). Instead, if I change my password thought passwd command on another client with pam modules configured for gaining information from the consumer only the userPassword is changed. I do not understand why. Has someone experimented the same problem? Thank you in advance.

3 3

Re: cn=config ACL consultation (BUG)
by Olivier 15 Nov '11

15 Nov '11

Addendum : Ldap is up and running with my configuration : [root@ldap2]# ps auxwww | grep slapd ldap 17190 0.0 1.1 426480 44384 ? Ssl Nov14 0:05 /usr/sbin/slapd -h ldap:/// -u ldap And the directory sounds to respond exactly as I wish to usual queries. However, here is a slapcat output : [root@ldap2]/usr/sbin/slapcat -F /etc/openldap/slapd.d -l ldap-conf.ldif PROXIED attributeDescription "OU" inserted. PROXIED attributeDescription "DC" inserted. olcSyncrepl: value #0: rootDN must be defined before syncrepl may be used config error processing olcDatabase={1}bdb,cn=config: rootDN must be defined before syncrepl may be used slapcat: bad configuration directory! I checked and that's true that the synchronisation doesn't work properly anymore. I had to reinserted this to have everything working well : dn: olcDatabase={1}bdb,cn=config OlcrootDN cn=Manager,dc=example,dc=fr ( no need for OlcrootPW) -- Olivier On Mon, Nov 14, 2011 at 5:15 PM, Olivier Guillard <olivier(a)guillard.nom.fr> wrote: > Hi there, > > I would like to have your feeling or advices about the following acl > strategy for ldap administration issues (cn=config and actual directory > administration). I have tested that and it sounds to work properly : > > My idea is to create two groups of people : one for those > that administrates accounts in the directory, and another for > those that are able to tune "cn=config" > > Basically, I have the following DIT : cn=config and dn: dc=example,dc=fr > > I have then created two "groupOfnames" (admin-ldap and > admin-dir) and tuned ACL so that : directory admins can modify > accounts and ldap admins can modify "slapd.d" > > I also have removed RootDN as well as RootPW both in : > olcDatabase={0}config,cn=config > as well as in > olcDatabase={1}bdb,cn=config > > so that maintenance operation are not performed as "RootDN" > anymore. > > ANY REACTIONS OR ADVICES ON THAT ? > > > HARE IS HOW I HAVE TUNED THAT : > > # Entries for the two groupofnames : > > dn: cn=admin-dir,ou=system,dc=example,dc=fr > cn: admin-dir > member: uid=guillard,ou=people,dc=example,dc=fr > member: uid=foo,ou=people,dc=example,dc=fr > member: uid=shmol,ou=people,dc=example,dc=fr > objectclass: groupOfNames > objectclass: top > > dn: cn=admin-ldap,ou=system,dc=example,dc=fr > cn: admin-ldap > member: uid=guillard,ou=staff,ou=people,dc=example,dc=fr > member: uid=pick,ou=staff,ou=people,dc=example,dc=fr > objectclass: groupOfNames > objectclass: top > > > ### ACL : > > dn: olcDatabase={0}config,cn=config > objectclass: olcDatabaseConfig > olcaccess: {0}to * by group.exact="cn=admin-ldap,ou=system,dc=example > ,dc=fr" write by * none > ... > > ### And : > > dn: olcDatabase={1}bdb,cn=config > objectclass: olcDatabaseConfig > objectclass: olcBdbConfig > ... > olcaccess: {0}to dn.base="dc=example,dc=fr" by > group.exact="cn=admin-ldap,ou=system,dc=example,dc=fr" write > by group.exact="cn=admin-dir,ou=system,dc=example,dc=fr" read > by dn.base="cn=replication,ou=system,dc=example,dc=fr" read > by * search > olcaccess: {1}to dn.one="dc=example,dc=fr" > by group.exact="cn=admin-ldap,ou=system,dc=example,dc=fr" write > by group.exact="cn=admin-dir,ou=system,dc=example,dc=fr" read > by dn.base="cn=replicator,ou=system,dc=example,dc=fr" > read by users search > by anonymous auth > > ### then : > olcaccess: {2}to dn.subtree="ou=system,dc=example,dc=fr" > by group.exact="cn=admin-ldap,ou=system,dc=example,dc=fr" write > by dn.base="cn=replicator,ou=system,dc=example,dc=fr" read by * none > > ### and : > olcaccess: {3}to dn.subtree="dc=example,dc=fr" > attrs=userPassword,shadowLastChange,loginShell > by group.exact="cn=admin-annuaire,ou=system,dc=example,dc=fr" write > by self write by dn.base="cn=replicator,ou=system,dc=example,dc=fr" > read by users auth by anonymous auth > > ### finally : > olcaccess: {4}to dn.subtree="dc=example,dc=fr" > by group.exact="cn=admin-annuaire,ou=system,dc=example,dc=fr" > write by dn.base="cn=replicator,ou=system,dc=example,dc=fr" > read by users read by anonymous read >

1 0

About set LDAP passwd expires
by Gary Jsz 14 Nov '11

14 Nov '11

Hi,All I want set my ldap user's password expires in linux server. how can to do? or the LDAP service read the linux system's /etc/login.defs file? Thanks.

4 4

biometric authentication
by Chris Lee 14 Nov '11

14 Nov '11

Dear all, I am a newbie to OpenLDAP. I would like to know whether OpenLDAP can interface with other authentication method. For example, finger print authentication. Thanks in advance for all your help. Best regards, Chris

4 4

MDB distribution
by Brett ＠Google 14 Nov '11

14 Nov '11

On Mon, Nov 14, 2011 at 3:20 PM, Howard Chu <hyc(a)symas.com> wrote: > Brett @Google wrote: > > Sorry for the "fuzzy" logic :P, but : >> >> My thoughts for no: >> >> 1. The name will affect only the name of the backend module, which is >> logically a unit under the scope of openldap (and all backends share a >> prefix), it can't exist by itself. >> > > This point is false; libmdb builds on its own and is intended for use in > more than just OpenLDAP. (I already spelled this out in my LDAPCon > presentation...) I've ported SQLite to use it, for example, and I will be > porting it to Cyrus SASL (sasldb), Heimdal, and various other miscellaneous > stuff that comes along. The API is fully documented in Doxygen, and part of > the reason I went to that trouble was to ensure that other programmers > could use it easily. Mmm. That sounds interesting. I have only just read your LDAPCon presentation, i have been away. Will the source for mmdb library itself eventually live separately somewhere, or just bundled with ldap ? Cheers Brett -- *The only thing that interferes with my learning is my education.* * Albert Einstein*

2 1

Re: MDB name
by Brett ＠Google 14 Nov '11

14 Nov '11

FDB (fast db?) - off the top of my head, seems unique enough On Sun, Nov 13, 2011 at 5:17 PM, Howard Chu <hyc(a)symas.com> wrote: > What's in a name... Apparently "MDB" is already a well-known suffix for > Microsoft Access database files. "mdb" is also the name of a debugger tool > in Solaris. To avoid confusion with those unrelated items, it might be a > good idea to rename our MDB to something else. Now, before the next > OpenLDAP release is published. Comments? > -- *The only thing that interferes with my learning is my education.* * Albert Einstein*

3 4

Re: ACL using Group
by Rakesh Aggarwal 11 Nov '11

11 Nov '11

That was just an example I wrote while writing the email. Actual one does have a "by". The ACLs parse without warning (except the catch-all where dn=*). This is the real one in my slapd config: access to dn.regex="^[^,]+,ou=resources,(ou=[^,]+,ou=MyNs,dc=MyCompany,dc=com)$" attrs="entry,@MyResourceClasss" by group/groupOfNames/member.expand="cn=admins,ou=groups,$1" +w continue by * break Thanks -Rakesh On Fri, Nov 11, 2011 at 11:58 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Friday, November 11, 2011 11:40 AM -0800 Rakesh Aggarwal < > rakesh.aggarwal(a)gmail.com> wrote: > > >> Hi folks! >> >> I am using OpenLdap 2.4.23 on RedHat, and using Apache Directory Studio >> as the client on a different machine. >> >> I am having issues trying to setup ACL using Group. The only non-standard >> aspect in my schema design is that the groups container is located in a >> organization specific sub-tree of DIT and not under DIT root, e.g. >> >> access to dn.subtree="ou=resources,ou=**dept1,ou=ns1,dc=example,dc=** >> com" >> attrs = "entry,@myResourceClass" >> group.exact="cn=myadmin,ou=**groups,ou=dept1,ou=ns1,dc=**example,dc=com" >> write continue >> by * break >> >> access to * by * read >> > > What you pasted is not a valid ACL statement. I expect it to fail. You > may want to try adding the word "by" in front of "group.exact". > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

ACL using Group
by Rakesh Aggarwal 11 Nov '11

11 Nov '11

Hi folks! I am using OpenLdap 2.4.23 on RedHat, and using Apache Directory Studio as the client on a different machine. I am having issues trying to setup ACL using Group. The only non-standard aspect in my schema design is that the groups container is located in a organization specific sub-tree of DIT and not under DIT root, e.g. * access to dn.subtree="ou=resources,ou=dept1,ou=ns1,dc=example,dc=com" attrs = "entry,@myResourceClass" group.exact="cn=myadmin,ou=groups,ou=dept1,ou=ns1,dc=example,dc=com" write continue by * break* *access to * by * read* I am logging in with a user who is a member to this group but not getting the desired write access to the entry. Is the location of the group entries in DIT really matter for ACL to work? Thanks -Rakesh

2 1

Setting userPassword and pwdChangedTime together with Relax Rules Control
by Michael Ströder 11 Nov '11

11 Nov '11

HI! I've implemented a sync job which has to also sync passwords with a password modification timestamp from an Oracle DB to OpenLDAP. There's a latency in this password sync so the exact password modification timestamp has to be copied from the source DB to attribute pwdChangedTime in OpenLDAP. Setting the pwdChangedTime alone with the Relax Rules control is no problem. But when the add or modify request also contains the userPassword attribute slapo-ppolicy also wants to add a (later) value for pwdChangedTime and this results in: Constraint violation: attribute 'pwdChangedTime' cannot have multiple values Any chance to achieve this in a single add/modify request? I think this scenario is not so unusual in the real world. So slapo-ppolicy should not generate 'pwdChangedTime' if it's already in the write request in case of Relax Rules control enabled. Ciao, Michael.

2 1

Re: Help needed chaining to active directory for authentication - not quite there yet
by Gabriella Turek 10 Nov '11

10 Nov '11

Hello, One thing that stopped working since I introduced the new directives which fixed the authentication problem is being able to peruse the directories using Apache Directory Studio. I can still see the AD branches but when I try to look at them I get an error which in the server logs is reported as res_errno: 1, res_error: <000004DC: LdapErr: DSID-0C0906E8, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1db1>, res_matched: <> ldap_free_request (origid 2, msgid 2) So I must still be missing something in my configuration. Thanx Gaby >On 09/11/11 19:34 +0000, Gabriella Turek wrote: >>Hi Dan, >> >>The way I got it to work (by pure chance mind you , I just happened on a >>blog entry somewhere) was to add this entry to the slapd.config file: >> >> >># Configure slapd-ldap back end to connect to AD >>database ldap >>suffix "ou=user accounts,dc=niwa,dc=local" >>subordinate >>rebind-as-user >>uri "ldap://aucwdfp01.niwa.local:389" >>chase-referrals yes >> >>Nowhere in any documentation did I see this mentioned, and yet it worked >>immediately, >>So I don't know what to think. >>Gaby >> >> >> >> >>On 10/11/11 6:37 AM, "Dan White" <dwhite(a)olp.net> wrote: >> >>>On 07/11/11 21:57 +0000, Gabriella Turek wrote: >>>>Hello, I've set up an openLDAP server (2.4.23) which chains to an >>>>Active Directory (2008). I can successfully search for users, it will >>>>find them in Active Directory if they are not in openLDAP, but I >>>>cannot >>>>authenticate the Active Directory users. >>>>The error is "Invalid credentials (49)" >>>>Everything is currently configured with clear text >>>>ldapSearch works fine when pointed directly to the Active Directory. >>>> >>>>The chaining configuration in the slapd.conf is: >>>> >>>>overlay chain >>>>chain-uri ldap://aucwdfp01.niwa.local:389 >>>>chain-rebind-as-user TRUE >>>>chain-idassert-bind bindmethod="simple" >>>> binddn="cn=SDT Tester,ou=NIWA Staff >>>>Accounts,ou=User Accounts, dc=niwa,dc=local" >>>> credentials=xxxxxxx >>>> mode="self" >>>> flags=non-prescriptive >>>>chain-return-error TRUE >>> >>>Does mode="none" work? If my reading of slapd-ldap(5) is correct, with >>>any >>>config other than 'none', slapd will attempt to assert the proxyAuthz >>>control. >>> >>>I checked our local AD server (2003) and it does not appear to support >>>that >>>control: >>> >>>ldapsearch -LLL -x -H ldap://<AD.ip> -s "base" -b "" supportedControl >>>dn: >>>supportedControl: 1.2.840.113556.1.4.319 >>>supportedControl: 1.2.840.113556.1.4.801 >>>supportedControl: 1.2.840.113556.1.4.473 >>>supportedControl: 1.2.840.113556.1.4.528 >>>supportedControl: 1.2.840.113556.1.4.417 >>>supportedControl: 1.2.840.113556.1.4.619 >>>supportedControl: 1.2.840.113556.1.4.841 >>>supportedControl: 1.2.840.113556.1.4.529 >>>supportedControl: 1.2.840.113556.1.4.805 >>>supportedControl: 1.2.840.113556.1.4.521 >>>supportedControl: 1.2.840.113556.1.4.970 >>>supportedControl: 1.2.840.113556.1.4.1338 >>>supportedControl: 1.2.840.113556.1.4.474 >>>supportedControl: 1.2.840.113556.1.4.1339 >>>supportedControl: 1.2.840.113556.1.4.1340 >>>supportedControl: 1.2.840.113556.1.4.1413 >>>supportedControl: 2.16.840.1.113730.3.4.9 >>>supportedControl: 2.16.840.1.113730.3.4.10 >>>supportedControl: 1.2.840.113556.1.4.1504 >>>supportedControl: 1.2.840.113556.1.4.1852 >>>supportedControl: 1.2.840.113556.1.4.802 >>>supportedControl: 1.2.840.113556.1.4.1907 >>>supportedControl: 1.2.840.113556.1.4.1948 >>> >>> >>>proxyAuthz control == 2.16.840.1.113730.3.4.18 (RFC 4370) >>> >>>-- >>>Dan White >> >> > >-- >Dan White >BTC Broadband >Ph 918.366.0248 (direct) main: (918)366-8000 >Fax 918.366.6610 email: dwhite(a)olp.net >http://www.btcbroadband.com

1 0

proxy authentication
by LALOT Dominique 10 Nov '11

10 Nov '11

Hello, We would like to setup a kind of replica. We don't want to replicate some attributes like userpassword, lmpassword, ntpassword. How can we configure the replica to proxy the authentication somewhere else. Is there a way to do that via an overlay or something else? Thanks Dom -- Dominique LALOT Ingénieur Systèmes et Réseaux http://annuaire.univmed.fr/showuser.php?uid=lalot

3 2

Searches causing disk writes
by Adam Wale 10 Nov '11

10 Nov '11

Hi, I'm observing an issue where a large number of searches against an openldap server results in a large amount of disk writes occurring. I have 10 hosts performing the same workload, the hosts are running slapd 2.4.21 under Ubuntu Lucid. If I stop searching against one of the hosts I see disk write activity from that host drop dramatically. I initially noticed the high write activity in the VMware stats for the hosts and have used iostat on the hosts to gather further info. The hosts being searched are slaves in a slurpd replication environment; they do not have replication logging enabled, the directory is using a hdb backend. Over a 5 minute period the average disk write activity is 8517KB/s when being searched, and 41KB/s when not being searched; over the same time period the average disk read activity is 8KB/s. When performing searches against a host an average workload is 300 searches/second, average entry size is 450bytes, and average entries returned is 30. The hosts have plenty of free RAM and are not using any swap. I have disabled the monitor backend but haven't seen much of an improvement by doing this, given the monitor database is instantiated at startup is this stored in memory? (if not, why not make that an option?) Does anyone have any ideas as to why reading from the directory would be causing disk writes at such a high rate? Thanks, Adam

7 10

Accesslog overlay access
by Hugo Deprez 10 Nov '11

10 Nov '11

Dear community, I configured accesslog overlay on a test server. Everything is working fine. But when I use my LDAP client (aka Ldap Admin) I get an error : "Size Limit Exceeded" The thing is I specified in the slapd.conf configuration file to rotate the data after 30 days. Does this message occur because there is too much data in the database ? Regards, Hugo

2 1

ldap_search: No such object
by Aaron Roberts 10 Nov '11

10 Nov '11

Hi all, I am trying to get openldap working with a mysql backend. Unfortunately, I always get "ldap_search: No such object" when I try to query. I am not familiar with LDAP and I am trying to get a simple phone directory up and running from a very small existing DB. I can see from my mysql query log that slapd is working with the first entry from the ldap_entries table and then never requesting any subsequent rows. I'm not sure what information will be needed for debugging this, I have start with debug output from slapd taken when running a search. Many thanks for any assistance, Aaron [root@test ~]# /usr/lib/mozldap/ldapsearch -x -b 'o=sql,c=RU' '(cn=*)' ldap_search: No such object /usr/sbin/slapd -d -1 -u ldap -h ldap:/// daemon: activity on 1 descriptor daemon: activity on: slap_listener_activate(8): daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 busy >>> slap_listener(ldap:///) daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL daemon: listen=8, new connection on 9 daemon: added 9r (active) listener=(nil) daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL conn=0 fd=9 ACCEPT from IP=127.0.0.1:51444 (IP=0.0.0.0:389) daemon: activity on 1 descriptor daemon: activity on: 9r daemon: read active on 9 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL connection_get(9) connection_get(9): got connid=0 connection_read(9): checking for input on id=0 ber_get_next ldap_read: want=8, got=8 0000: 30 26 02 01 01 63 21 04 0&...c!. ldap_read: want=32, got=32 0000: 0a 6f 3d 73 71 6c 2c 63 3d 52 55 0a 01 02 0a 01 .o=sql,c=RU..... 0010: 00 02 01 00 02 01 00 01 01 00 87 02 63 6e 30 00 ............cn0. ber_get_next: tag 0x30 len 38 contents: ber_dump: buf=0x96cb690 ptr=0x96cb690 end=0x96cb6b6 len=38 0000: 02 01 01 63 21 04 0a 6f 3d 73 71 6c 2c 63 3d 52 ...c!..o=sql,c=R 0010: 55 0a 01 02 0a 01 00 02 01 00 02 01 00 01 01 00 U............... 0020: 87 02 63 6e 30 00 ..cn0. ber_get_next ldap_read: want=8 error=Resource temporarily unavailable daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL do_search ber_scanf fmt ({miiiib) ber: ber_dump: buf=0x96cb690 ptr=0x96cb693 end=0x96cb6b6 len=35 0000: 63 21 04 0a 6f 3d 73 71 6c 2c 63 3d 52 55 0a 01 c!..o=sql,c=RU.. 0010: 02 0a 01 00 02 01 00 02 01 00 01 01 00 87 02 63 ...............c 0020: 6e 30 00 n0. >>> dnPrettyNormal: <o=sql,c=RU> => ldap_bv2dn(o=sql,c=RU,0) <= ldap_bv2dn(o=sql,c=RU)=0 => ldap_dn2bv(272) <= ldap_dn2bv(o=sql,c=RU)=0 => ldap_dn2bv(272) <= ldap_dn2bv(o=sql,c=ru)=0 <<< dnPrettyNormal: <o=sql,c=RU>, <o=sql,c=ru> SRCH "o=sql,c=RU" 2 0 0 0 0 begin get_filter PRESENT ber_scanf fmt (m) ber: ber_dump: buf=0x96cb690 ptr=0x96cb6b0 end=0x96cb6b6 len=6 0000: 87 02 63 6e 30 00 ..cn0. end get_filter 0 filter: (cn=*) ber_scanf fmt ({M}}) ber: ber_dump: buf=0x96cb690 ptr=0x96cb6b4 end=0x96cb6b6 len=2 0000: 00 00 .. attrs: conn=0 op=0 SRCH base="o=sql,c=RU" scope=2 deref=0 filter="(cn=*)" ==> limits_get: conn=0 op=0 dn="[anonymous]" ==>backsql_search(): base="o=sql,c=ru", filter="(cn=*)", scope=2, deref=0, attrsonly=0, attributes to load: all ==>backsql_get_db_conn() ==>backsql_open_db_conn(0) <==backsql_open_db_conn(0) backsql_open_db_conn(0): connected, adding to tree. <==backsql_get_db_conn() ==>backsql_dn2id("o=sql,c=ru") matched expected backsql_dn2id("o=sql,c=ru"): id_query "SELECT id,keyval,oc_map_id,dn FROM ldap_entries WHERE dn LIKE CONCAT('%,',?)" backsql_dn2id("o=sql,c=ru"): id=800 keyval=800 oc_id=1 dn=cn=Facsimile,o=sql,c=RU >>> dnPrettyNormal: <cn=Facsimile,o=sql,c=RU> => ldap_bv2dn(cn=Facsimile,o=sql,c=RU,0) <= ldap_bv2dn(cn=Facsimile,o=sql,c=RU)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=Facsimile,o=sql,c=RU)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=facsimile,o=sql,c=ru)=0 <<< dnPrettyNormal: <cn=Facsimile,o=sql,c=RU>, <cn=facsimile,o=sql,c=ru> <==backsql_dn2id("o=sql,c=ru"): err=0 ==>backsql_id2entry() backsql_id2entry(): retrieving all attributes ==>backsql_get_attr_vals(): oc="person" attr="cn" keyval=800 backsql_get_attr_vals(): number of values in query: 1 <==backsql_get_attr_vals() ==>backsql_get_attr_vals(): oc="person" attr="sn" keyval=800 backsql_get_attr_vals(): number of values in query: 1 <==backsql_get_attr_vals() ==>backsql_get_attr_vals(): oc="person" attr="objectClass" keyval=800 backsql_get_attr_vals(): number of values in query: 1 <==backsql_get_attr_vals() ==>backsql_get_attr_vals(): oc="person" attr="telephoneNumber" keyval=800 backsql_get_attr_vals(): number of values in query: 1 <==backsql_get_attr_vals() <==backsql_id2entry() send_ldap_result: conn=0 op=0 p=3 send_ldap_result: err=32 matched="" text="" send_ldap_response: msgid=1 tag=101 err=32 ber_flush: 14 bytes to sd 9 0000: 30 0c 02 01 01 65 07 0a 01 20 04 00 04 00 0....e... .... daemon: activity on 1 descriptor daemon: activity on: 9r daemon: read active on 9 daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL connection_get(9) ldap_write: want=14, written=14 0000: 30 0c 02 01 01 65 07 0a 01 20 04 00 04 00 0....e... .... connection_get(9): got connid=0 connection_read(9): checking for input on id=0 ber_get_next ldap_read: want=8, got=7 0000: 30 05 02 01 02 42 00 0....B. ber_get_next: tag 0x30 len 5 contents: ber_dump: buf=0x96ed058 ptr=0x96ed058 end=0x96ed05d len=5 0000: 02 01 02 42 00 ...B. ber_get_next ldap_read: want=8, got=0 ber_get_next on fd 9 failed errno=0 (Success) connection_read(9): input error=-2 id=0, closing. connection_closing: readying conn=0 sd=9 for close daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL connection_close: deferring conn=0 sd=9 do_unbind conn=0 op=1 UNBIND connection_resched: attempting closing conn=0 sd=9 connection_close: deferring conn=0 sd=9 conn=0 op=0 SEARCH RESULT tag=101 err=32 nentries=0 text= <==backsql_search() connection_resched: attempting closing conn=0 sd=9 connection_close: conn=0 sd=9 ==>backsql_connection_destroy() ==>backsql_free_db_conn() backsql_free_db_conn(): closing db connection 0 (0x96b8458) ==>backsql_close_db_conn(0) <==backsql_close_db_conn(0) <==backsql_free_db_conn() <==backsql_connection_destroy() daemon: removing 9 conn=0 fd=9 closed

2 2

Compile Error for ldapc++ library
by sim123 10 Nov '11

10 Nov '11

I am trying to compile ldapc++ library distributed with openldap-2.4.26 and getting following error during make: ../src/LDAPAsynConnection.h: In function ‘int main(int, char**)’: ../src/LDAPAsynConnection.h:310: error: ‘LDAPAsynConnection::LDAPAsynConnection(const LDAPAsynConnection&)’ is private startTls.cpp:43: error: within this context make[1]: *** [startTls.o] Error 1 make[1]: Leaving directory `/opt/source/openldap-2.4.26/contrib/ldapc++/examples' make: *** [all-recursive] Error 1 I am attaching my config log as well, is there anything which I am missing here? Another thing, I would like to know does this library have Referral Chasing capability during bind, also is it thread safe or its caller's responsibility to make it thread safe? Thanks for the help, I appreciate it very much.

2 1

AW: OpenLDAP 2.4 and cn=config replication
by Michael Kolowicz 10 Nov '11

10 Nov '11

In a book about Openldap i have read the way to replicate the cn=config-data. But the author descripte the slapd.conf method. My OpenLDAP use the database-backend. so I try to combine it and most of them works fine On the Master I have import following LDIF dn: cn=config changetype: modify add: olcReferral olcReferral: "ldap://ldap.example.de" dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: syncprov dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov dn: olcOverlay=syncprov,olcDatabase={1}hdb,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncrepl olcSyncrepl: rid=002 provider=ldap://ldap.example.de type=refreshAndPersist retry="5 +" searchbase="cn=config" filter="(!(olcDatabase={0}config))" bindmethod=simple binddn="cn=admin,dc=example,dc=de" credentials=secret add: olcUpdateRef olcUpdateRef: ldap://ldap.example.de dn: olcDatabase={1}hdb,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=ldap://ldap.example.de type=refreshAndPersist retry="5 +" searchbase="dc=example,dc=de" bindmethod=simple binddn="cn=admin,dc=example,dc=de" credentials=secret add: olcUpdateRef olcUpdateRef: <ldap://ldap.example.de> ldap://ldap.example.de On the Client-LDAP I import the following LDIF dn: cn=config #objectClass: olcGlobal #cn: config changetype: modify add: olcReferral olcreferral: ldap://ldap.example.de dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcSyncRepl: rid=002 provider="ldap://ldap.example.de" binddn="cn=admin,dc=example,dc=de" bindmethod=simple credentials=secret searchbase="cn=config" filter="(!olcDatabase={0}config)" type=refreshAndPersist retry="10 +" olcRootDN: cn=admin,dc=example,dc=de olcUpdateRef: <ldap://ldap.example.de> ldap://ldap.example.de As result the complete ldap will be replicated. But when i restart the Slave-LDAP-Server then come up following error: Starting OpenLDAP: slapd - failed. The operation failed but no output was produced. For hints on what went wrong please refer to the system's logfiles (e.g. /var/log/syslog) or try running the daemon in Debug mode like via "slapd -d 16383" (warning: this will create copious output). Below, you can find the command line options used by this script to run slapd. Do not forget to specify those options if you want to look to debugging output: slapd -h 'ldap:/// ldapi:///' -g openldap -u openldap -F /etc/ldap/slapd.d/ And in syslog i find following entry: Nov 9 20:54:03 SMS002092 slapd[3376]: @(#) $OpenLDAP: slapd 2.4.21 (Jun 2 2011 19:36:19) $#012#011buildd@allspice:/build/buildd/openldap-2.4$ Nov 9 20:54:03 SMS002092 slapd[3376]: config error processing olcDatabase={2}config,cn=config: Nov 9 20:54:03 SMS002092 slapd[3376]: slapd stopped. Nov 9 20:54:03 SMS002092 slapd[3376]: connections_destroy: nothing to destroy. I can understand this error: ALL data will replicated and on the Slave another config [olcDatatbase={2}config) will be created. How can I avoid the creation of the second , incomplete database? Freundliche Grüße / Best regards Michael

1 0

Need help with failing test
by Gabriella Turek 09 Nov '11

09 Nov '11

Hello, I have built openldap 2.4.23 (with Berkeley DB 5.2.36) on a Suse SLES11 64bit machine and I am trying to verify the install by running the tests. The following test fails: >>>>> Starting test005-modrdn for bdb... running defines.sh Running slapadd to build slapd database... Starting slapd on TCP/IP port 9011... Testing slapd modrdn operations... Testing modrdn(deleteoldrdn=0)... ./scripts/test005-modrdn: line 65: 2291 Segmentation fault $SLAPD -f $CONF1 -h $URI1 -d $LVL $TIMING > $LOG1 2>&1 ldapmodrdn failed (255)! ./scripts/test005-modrdn: line 70: kill: (2291) - No such process >>>>> ./scripts/test005-modrdn failed for bdb (exit 255) make: *** [bdb-yes] Error 255 The log output for this test is: >>> slap_listener(ldap://localhost:9011/) conn=1001 fd=21 ACCEPT from IP=127.0.0.1:60661 (IP=127.0.0.1:9011) connection_get(21) connection_get(21): got connid=1001 connection_read(21): checking for input on id=1001 ber_get_next ber_get_next: tag 0x30 len 46 contents: op tag 0x60, time 1320032341 ber_get_next conn=1001 op=0 do_bind ber_scanf fmt ({imt) ber: ber_scanf fmt (m}) ber: >>> dnPrettyNormal: <cn=Manager,dc=example,dc=com> => ldap_bv2dn(cn=Manager,dc=example,dc=com,0) <= ldap_bv2dn(cn=Manager,dc=example,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=Manager,dc=example,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=manager,dc=example,dc=com)=0 <<< dnPrettyNormal: <cn=Manager,dc=example,dc=com>, <cn=manager,dc=example,dc=com> conn=1001 op=0 BIND dn="cn=Manager,dc=example,dc=com" method=128 do_bind: version=3 dn="cn=Manager,dc=example,dc=com" method=128 ==> bdb_bind: dn: cn=Manager,dc=example,dc=com conn=1001 op=0 BIND dn="cn=Manager,dc=example,dc=com" mech=SIMPLE ssf=0 do_bind: v3 bind: "cn=Manager,dc=example,dc=com" to "cn=Manager,dc=example,dc=com" send_ldap_result: conn=1001 op=0 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_response: msgid=1 tag=97 err=0 ber_flush2: 14 bytes to sd 21 conn=1001 op=0 RESULT tag=97 err=0 text= connection_get(21) connection_get(21): got connid=1001 connection_read(21): checking for input on id=1001 ber_get_next ber_get_next: tag 0x30 len 104 contents: op tag 0x6c, time 1320032341 ber_get_next conn=1001 op=1 do_modrdn ber_scanf fmt ({mmb) ber: do_modrdn: dn (cn=James A Jones 1, ou=Alumni Association, ou=People, dc=example, dc=com) newrdn (cn=James A Jones III) n ewsuperior () ber_scanf fmt (}) ber: >>> dnPrettyNormal: <cn=James A Jones 1, ou=Alumni Association, ou=People, >>>dc=example, dc=com> => ldap_bv2dn(cn=James A Jones 1, ou=Alumni Association, ou=People, dc=example, dc=com,0) <= ldap_bv2dn(cn=James A Jones 1, ou=Alumni Association, ou=People, dc=example, dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=James A Jones 1,ou=Alumni Association,ou=People,dc=example,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=james a jones 1,ou=alumni association,ou=people,dc=example,dc=com)=0 <<< dnPrettyNormal: <cn=James A Jones 1,ou=Alumni Association,ou=People,dc=example,dc=com>, <cn=james a jones 1,ou=alumn i association,ou=people,dc=example,dc=com> >>> dnPrettyNormal: <cn=James A Jones III> => ldap_bv2dn(cn=James A Jones III,0) <= ldap_bv2dn(cn=James A Jones III)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=James A Jones III)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=james a jones iii)=0 <<< dnPrettyNormal: <cn=James A Jones III>, <cn=james a jones iii> conn=1001 op=1 MODRDN dn="cn=James A Jones 1,ou=Alumni Association,ou=People,dc=example,dc=com" bdb_dn2entry("cn=james a jones 1,ou=alumni association,ou=people,dc=example,dc=com") ==>bdb_modrdn(cn=James A Jones 1,ou=Alumni Association,ou=People,dc=example,dc=com,cn=James A Jones III,NULL) slap_queue_csn: queing 0x2b3f483d6210 20111031033901.351643Z#000000#000#000000 bdb_dn2entry("cn=james a jones 1,ou=alumni association,ou=people,dc=example,dc=com") => bdb_dn2id_children("cn=james a jones 1,ou=alumni association,ou=people,dc=example,dc=com") <= bdb_dn2id_children("cn=james a jones 1,ou=alumni association,ou=people,dc=example,dc=com"): no (-30988) bdb_modrdn: wr to children of entry ou=alumni association,ou=people,dc=example,dc=com OK bdb_modrdn: parent dn=ou=Alumni Association,ou=People,dc=example,dc=com >>> dnNormalize: <cn=James A Jones III,ou=Alumni >>>Association,ou=People,dc=example,dc=com> => ldap_bv2dn(cn=James A Jones III,ou=Alumni Association,ou=People,dc=example,dc=com,0) <= ldap_bv2dn(cn=James A Jones III,ou=Alumni Association,ou=People,dc=example,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=james a jones iii,ou=alumni association,ou=people,dc=example,dc=com)=0 <<< dnNormalize: <cn=james a jones iii,ou=alumni association,ou=people,dc=example,dc=com> bdb_modrdn: new ndn=cn=james a jones iii,ou=alumni association,ou=people,dc=example,dc=com => bdb_dn2id("cn=james a jones iii,ou=alumni association,ou=people,dc=example,dc=com") <= bdb_dn2id: get failed: BDB0073 DB_NOTFOUND: No matching key/data pair found (-30988) => bdb_dn2id_delete 0xc: "cn=james a jones 1,ou=alumni association,ou=people,dc=example,dc=com" Any ideas what may be wrong? Is this a significant failure? Thank you Gaby -- Gabriella Turek Sr. Software Engineer National Institute for Water & Atmospheric Research (NIWA)

2 2

Re: How to configure Unique Overlay in cn=config
by Quanah Gibson-Mount 09 Nov '11

09 Nov '11

--On Thursday, November 10, 2011 3:07 AM +0800 Stewart Walters <stewart.walters(a)gmail.com> wrote: > Hi Quanah, > > Could you please elaborate a bit more on what you mean by serious issues? > > Are you talking about missing features or just general bugs in the 2.4.23 > code base? Bugs. <http://www.openldap.org/software/release/changes.html> --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

How to configure Unique Overlay in cn=config
by Igor Blanco 09 Nov '11

09 Nov '11

Hello everyone, I'm trying to configure the uniqueness overlay in Debian Squeeze (OpenLDAP 2.4.23) using "cn=config" but I can't figure how to do it and can't find any good doc about it, the FAQ-O-Matic wasn't very helpful this time. I've added a new "olcModuleLoad=unique" attribute in "cn=module{0},cn=config" and it hasn't complained, but how and where do I set "olcUniqueURI" ? in "olcDatabase={1}hdb,cn=config" ? This attribute does not seem to be present in my OpenLDAP installation, do I have to add any new schema? Any reference to documentation explaining how to configure "unique" overlay within "cn=config" would be much appreciated. A dump of a "cn=config" branch correctly configured would be fantastic. Thanks. -- Igor Blanco González Binovo IT Human Project e-mail: iblanco(a)binovo.es Telf. : 943 493611 - 690229375 Dirección: Astigarraga Bidea 2 Planta 6. - Ofi. 3-2 20180 Oiartzun ( Gipuzkoa )

2 1

Help needed chaining to active directory for authentication
by Gabriella Turek 09 Nov '11

09 Nov '11

Hello, I've set up an openLDAP server (2.4.23) which chains to an Active Directory (2008). I can successfully search for users, it will find them in Active Directory if they are not in openLDAP, but I cannot authenticate the Active Directory users. The error is "Invalid credentials (49)" Everything is currently configured with clear text ldapSearch works fine when pointed directly to the Active Directory. The chaining configuration in the slapd.conf is: overlay chain chain-uri ldap://aucwdfp01.niwa.local:389 chain-rebind-as-user TRUE chain-idassert-bind bindmethod="simple" binddn="cn=SDT Tester,ou=NIWA Staff Accounts,ou=User Accounts, dc=niwa,dc=local" credentials=xxxxxxx mode="self" flags=non-prescriptive chain-return-error TRUE Any tips would be greatly appreciated. Cheers Gaby

2 1

loadbalancer in OopenLDAP environment
by Meike Stone 09 Nov '11

09 Nov '11

Hello, does anywhere use loadbalancer in his OpenLDAP setup? I have two locations (data center). In each location I want install a OpenLDAP server who replicate with the other (MM N-Way) Then I want install a few (depends on the load) OpenLDAP ro replicas (replicate from the local OpenLDAP). - In the location are setup loadbalancers who are asked from the local clients. - The loadbalancer direct the searches to the local ro replicas and writes/modifies to the local "rw Master". - Only if all local ro resources are down or have a long response time, the loadbalancer redirects the searches to the remote ro replicas. - Same way with write access, if local rw master is down, write/modify access is redirect to the remote rw master. Is this a possible setup? What are the experiences with such setups, can you share them? Are there snares? I saw one example in the admin guide, but it shows 4 loadbalancers. Thats to much for my budget. Thanks for help, Meike

3 5

Base64 Attribute Encryption
by Scot Hollingsworth 09 Nov '11

09 Nov '11

Hi. I'm upgrading from RHEL 5 to RHEL 6. I'm having no problem in RHEL 5. In RHEL 6 I'm using openldap-2.4.23-15.el6_1.3.x86_64. I have the master/slave setup and working. Now, I use ldapmodify to edit an entry and instead of plain text, I getting the attribute as base64. I don't want this. I'm looking everyone but haven't found where to disable this. Anyone know? Thanks. Scot This message may contain confidential and/or proprietary information, and is intended for the person/entity to whom it was originally addressed. Any use by others is strictly prohibited.

3 3

Re: Help with Cyrus configuration - testsaslauthd not working
by Gabriella Turek 08 Nov '11

08 Nov '11

Hi Dan, Awesome I got it to work, but I have a couple of comments to add for future reference: 1) I was using quotes around the ldap_bind_dn, because it has blanks in it, but by looking at wireshark I realized that the string is also being quoted by saslauthd so I was ending up with double quotes and therefore an invalid DN 2) The ldap_filter has to read (distinguishedName=%u), there is no "dn" attribute in Active Directory. If that's not correct then authentication also fails, because - as it was pointed out in some other list I was reading - authentication is a two pass affair. First it binds the ldap_bind_dn user with which it does a search for the authenticating user. Then, the result of that search is used to bind the authenticating user. Since the DN is required for binding, the filter must return the distinguishedName in case of AD. On 8/11/11 12:11 PM, "Dan White" <dwhite(a)olp.net> wrote: >On 07/11/11 21:49 +0000, Gabriella Turek wrote: >>Hello, I am trying to set up Cyrus sasl so I can use it for pass-through >>authentication with OpenLDAP. The OS is SUSE sles11 and I thought I'd >>start with what is already there preinstalled (v.2.1.22) I am trying to >>authenticate against Active Directory 2008. >>My configuration file looks like: >> >>ldap_servers: ldap://hamwdc01.niwa.local/ >>ldap_search_base: DC=niwa=,DC=local > >You have a typo here, with an extra equals sign. > >>ldap_scope: sub >>ldap_sasl_mech: plain > >Since you're not using ldap_use_sasl: yes, you should remove >ldap_sasl_mech from your config. > >>ldap_auth_method: bind >>ldap_bind_dn: "CN=SDT Tester,OU=NIWA Staff Accounts,OU=User >>Accounts,DC=niwa,DC=local" >>ldap_password: mypassword >>ldap_filter: (dn=%u) >> >>When I try authenticate using testsaslauthd I get: >>>Authentication failed for some-user: Bind to ldap server failed (invalid >>>user/password or insufficient access) (-7) >> >>If I try a ldap_bind_dn of the form >>sdttester(a)niwa.local<mailto:sdttester@niwa.local> in the config file I >>get: >>Authentication failed for some-user: Retry condition (ldap server >>connection reset or broken) (-3) > >You should be using the DN, when using 'ldap_auth_method: bind'. > >>This is all very puzzling, as I can ldapsearch perfectly fine with any >>valid user I chose in either form (DN or userPrincipalName) >> >>Is it possible that this installation of cyrus has not been compiled with >>ldap support? I would expect a bit more feedback. > >You can verify saslauthd was compiled with LDAP support with 'saslauthd >-v'. You use it by specifying '-a ldap' as a command line option. > >Your saslauthd.conf file should typically go in /etc, but you can specify >an >alternate location with '-O <path/file>'. > >See saslauthd/LDAP_SASLAUTHD in the source for documentation. > >You can simulate the function of saslauthd (in bind mode) with: > >ldapsearch -x -H ldap://hamwdc01.niwa.local/ -D "CN=SDT Tester,OU=NIWA >Staff Accounts,OU=User Accounts,DC=niwa,DC=local" -w mypassword -b >"DC=niwa,DC=local" "(dn=testusername)" dn > >and then with the returned dn: > >ldapwhoami -x -H ldap://hamwdc01.niwa.local/ -D "$DN" -w <user_password> > >and if successful, ldapwhoami should return the DN again. If so, then your >saslauthd.conf config is probably correct. > >For further trouble shooting, you can add 'ldap_debug: -1' to your >saslauthd.conf, and start saslauthd in debug mode. > >After verifying testsaslauthd is working, make sure that your OpenLDAP >user >(-u option) has filesystem permissions to access the saslauthd mux. > >For OpenLDAP pass-through documentation, see "14.5. Pass-Through >authentication" of the OpenLDAP Administrator's Guide. > >-- >Dan White

1 0

LD_LIBRARY_PATH exported but libdb-4.6.so not found
by Pablo Chamorro C. 08 Nov '11

08 Nov '11

I updated from 2.4.21 to 2.4.23 in some old Fedoras and also in a CentOS 5.4. Before compiling, I run: export LD_LIBRARY_PATH=/usr/local/BerkeleyDB.4.6/lib export CPPFLAGS="-I/usr/local//BerkeleyDB.4.6/include" export LDFLAGS="-L/usr/local/BerkeleyDB.4.6/lib" and it compiles ok. But after installed, in 3 out 4 of the used servers, slapd doesn't start unless I execute first: export LD_LIBRARY_PATH=/usr/local/BerkeleyDB.4.6/lib Attached, the output of ldd /usr/local/libexec/slapd, before and after running export LD_LIBRARY_PATH=/usr/local/BerkeleyDB.4.6/lib. In short: without LD_LIBRARY_PATH defined: libdb-4.6.so => not found with LD_LIBRARY_PATH as above: libdb-4.6.so => /usr/local/BerkeleyDB.4.6/lib/libdb-4.6.so (0x00002b4eb2c16000) Could you please explain me why this might be happening? Is this a bug? This issue ocurred to me in at least 3 server, but I have another CentOS 5.4, where the compilation and the install process run just fine, and I didn't need that workaround. Thank you, Pablo Chamorro La informaci�n contenida en este mensaje y cualquiera de sus adjuntos es confidencial, para el uso exclusivo de la persona o entidad destinataria. Si usted ha recibido este mensaje por equivocaci�n, se le notifica que no est� autorizado para revisarlo, reenviarlo, imprimirlo, copiarlo o distribuirlo de forma parcial o total; por favor comunique el error a la persona que lo env�a y elim�nelo. Las opiniones y puntos de vista presentados en este mensaje son responsabilidad de quien firma el mensaje y no representan necesariamente la posici�n y puntos de vista de INGEOMINAS. Este mensaje de correo electr�nico ha sido analizado por el antivirus Mcafee. Confidentiality Notice The information in this message and any attachments is confidential, it is for exclusive use of the person or entity to which it is addressed. If you have received this message in error, you are notified that you are not authorized to review, re-transmit, print out, disseminate, copy or distribute it in partial or total way; please communicate the mistake to the person who sent this message and delete it. The opinions and points of view stated in this message with responsibility by who signed the message, do not necessarily represent the opinion or point of view of INGEOMINAS. This electronic mail message was scanned by the Mcafee anti-virus.

2 2

Error when creating realm in openldap from kerberos
by Ethan Koh 07 Nov '11

07 Nov '11

Hello I have been at this for a week now, and i would really appreciate any help. I'm setting up both kerberos and openldap on the same ubuntu VM for testing purposes. I was following the configuration for kerberos-ldap ( https://help.ubuntu.com/11.04/serverguide/C/kerberos-ldap.html) when I got this error: sudo kdb5_ldap_util -D cn=admin,dc=example,dc=com create -subtrees dc=example,dc=com -r EXAMPLE.COM -s -H ldap://ldap.example.com <......entered password for cn=admin and new KDC database.....> kdb5_ldap_util: Hostname cannot be canonicalized krb5_sname_to_principal, while adding entries to the database I think its something to do with the /etc/hosts file, but I'm not sure. Here are my configurations: ---------------------- kdc.conf ---------------------- [kdcdefaults] kdc_ports = 88 acl_file = /usr/local/var/krb5kdc/kadm5.acl admin_keytab = /usr/local/var/krb5kdc/kadm5.keytab dict_file = /usr/local/var/krb5kdc/kadm5.dict [realms] EXAMPLE.COM = { database_name = /usr/local/var/krb5kdc/principal admin_keytab = /usr/local/var/krb5kdc/kadm5.keytab acl_file = /usr/local/var/krb5kdc/kadm5.acl dict_file = /usr/local/var/krb5kdc/kadm5.dict key_stash_file = /usr/local/var/krb5kdc/.k5.EXAMPLE.COM kadmind_port = 749 max_life = 10h 0m 0s max_renewable_life = 7d 0h 0m 0s master_key_type = des3-hmac-sha1 supported_enctypes = des3-hmac-sha1:normal des-cbc-crc:normal } ---------------------- kdc.conf ---------------------- [libdefaults] ticket_lifetime = 2400 default_realm = EXAMPLE.COM default_tkt_enctypes = des3-hmac-sha1 des-cbc-crc default_tgs_enctypes = des3-hmac-sha1 des-cbc-crc [realms] EXAMPLE.COM = { kdc = kerberos.example.com:88 admin_server = kerberos.example.com:749 default_domain = example.com database_module = openldap_ldapconf } [domain_realm] .example.com = EXAMPLE.COM example.com = EXAMPLE.COM [dbdefaults] ldap_kerberos_container_dn = dc=example,dc=com [dbmodules] openldap_ldapconf = { db_library = kldap ldap_kdc_dn = "cn=admin,dc=example,dc=com" # this object needs to have read rights on # the realm container, principal container and realm sub-trees ldap_kadmind_dn = "cn=admin,dc=example,dc=com" # this object needs to have read and write rights on # the realm container, principal container and realm sub-trees ldap_service_password_file = /etc/krb5kdc/service.keyfile ldap_servers = ldaps://ldap.example.com ldap_conns_per_server = 5 } [logging] kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmin.log default = FILE:/var/log/krb5lib.log ---------------------- backend.example.com.ldif ---------------------- # Load dynamic backend modules dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulepath: /usr/lib/ldap olcModuleload: back_hdb.la # Database settings dn: olcDatabase=hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcSuffix: dc=example,dc=com olcDbDirectory: /var/lib/ldap olcRootDN: cn=admin,dc=example,dc=com olcRootPW: {SSHA}0tWXk3nWCfFXeyv3cGF39KmW3Wukbgj8 olcDbConfig: set_cachesize 0 2097152 0 olcDbConfig: set_lk_max_objects 1500 olcDbConfig: set_lk_max_locks 1500 olcDbConfig: set_lk_max_lockers 1500 olcDbIndex: objectClass eq olcLastMod: TRUE olcDbCheckpoint: 512 30 olcAccess: to attrs=userPassword,shadowLastChange,krbPrincipalKey by dn="cn=admin,dc=example,dc=com" write by anonymous auth by self write by * none olcAccess: to dn.base="" by * read olcAccess: to * by dn="cn=admin,dc=example,dc=com" write by * read ---------------------- frontend.example.com.ldif ---------------------- # Create top-level object in domain dn: dc=example,dc=com objectClass: top objectClass: dcObject objectclass: organization o: Example Organization dc: Example description: LDAP Example # Admin user. dn: cn=admin,dc=example,dc=com objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin1 description: LDAP administrator #userPassword: aa userPassword: {SSHA}0tWXk3nWCfFXeyv3cGF39KmW3Wukbgj8 dn: ou=people,dc=example,dc=com objectClass: organizationalUnit ou: people dn: ou=groups,dc=example,dc=com objectClass: organizationalUnit ou: groups dn: uid=john,ou=people,dc=example,dc=com objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount uid: john sn: Doe givenName: John cn: John Doe displayName: John Doe uidNumber: 1000 gidNumber: 10000 userPassword: {SSHA}0tWXk3nWCfFXeyv3cGF39KmW3Wukbgj8 gecos: John Doe loginShell: /bin/bash homeDirectory: /home/john shadowExpire: -1 shadowFlag: 0 shadowWarning: 7 shadowMin: 8 shadowMax: 999999 shadowLastChange: 10877 mail: admin(a)example.com postalCode: 31000 l: Toulouse o: Example mobile: +33 (0)6 xx xx xx xx homePhone: +33 (0)5 xx xx xx xx title: System Administrator postalAddress: initials: JD dn: cn=example,ou=groups,dc=example,dc=com objectClass: posixGroup cn: example gidNumber: 10000 ---------------------- ldap.conf ---------------------- BASE dc=example,dc=com URI ldap://ldap.example.com ldapi://ldap.example.com ldaps:// ldap.example.com TLS_CACERT /etc/ssl/certs/cacert.pem SIZELIMIT 12 TIMELIMIT 15 DEREF never ---------------------- /etc/hosts ---------------------- 127.0.0.1 kerberos.example.com kerberos 127.0.0.1 ldap.example.com ldap 192.168.0.101 ubuntu # The following lines are desirable for IPv6 capable hosts ::1 localhost ip6-localhost ip6-loopback fe00::0 ip6-localnet ff00::0 ip6-mcastprefix ff02::1 ip6-allnodes ff02::2 ip6-allrouters ff02::3 ip6-allhosts

1 0

smbk5pwd not respecting olcSmbK5PwdEnable on 64-bit platforms
by David Adam 06 Nov '11

06 Nov '11

There are a few threads on the web [1][2] where people are running into problems with smbk5PwdEnable being set to 'samba' but the smbk5pwd module still insisting on loading all the Kerberos configuration regardless, which fails if you aren't actually using Kerberos at all. We have also been experiencing this but I have noticed (and confirmed by spinning up two brand-new Debian VMs) that it is only a problem on 64-bit machines; 32-bit architectures respect the attribute's value. I suspect this has something to do with the call to verbs_to_mask() in smbk5pwd_cf_func (under the case PC_SMB_ENABLE)[3] - my very basic printf() debugging shows that m is set correctly on 32-bit architectures but on 64-bit architectures returns a varying and strangely-numbered value (4511419, -1407332384, 353253328 in subsequent runs). The problem goes away if the m variable is initialised to 0 before the call to verbs_to_mask(). I wonder if verbs_to_mask() is possibly not 64-bit clean but my C foo is not strong enough to confirm or deny this. Any ideas? For the moment I'm simply using case PC_SMB_ENABLE: { - slap_mask_t mode = pi->mode, m; + slap_mask_t mode = pi->mode, m = 0; but I'm not sure if this could have unintended consequences. Thanks, David Adam zanchey(a)ucc.gu.uwa.edu.au [1]: http://www.openldap.org/lists/openldap-technical/201105/msg00136.html [2]: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=631120 [3]: http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=blob;f=contrib/sl…

2 1

Special characters in bindpw
by Alex Moen 05 Nov '11

05 Nov '11

Hi all, Say that my bindpw is d!ffs3r^ (it, of course, is not). What is the proper way to use this passwd in ldap.conf or nslcd.conf so that the special characters are not interpreted incorrectly? Thanks! Alex

2 2

ACL issue for unix authentication
by Olivier 04 Nov '11

04 Nov '11

I have a weired ACL issue using my ldap server for authentication. My plan was to use a "proxyuser" to forbid "anonymous" queries to the ldap directory, but it sounds like pam needs in all cases to perform anonymous retreivals before any other binding, even if the "rootbinddn" directive is correctly configured for pam in /etc/pam_ldap.conf. Where is my mistake ? (see below) I have configured this first olcAccess to allow password self changed : {0}to attrs=userPassword,shadowLastChange,loginShell by dn.base="cn=proxyuser,ou=system,dc=example,dc=fr" read by self write by anonymous auth by * none The issue comes with this second ACL. THIS DOESN'T WORK : If I configure this : {1}to * by dn.base="cn=proxyuser,ou=system,dc=example,dc=fr" read by users read by anonymous auth by * none I CAN'T log in ( ssh guillard@client ) weither or not I configure rootbinddn cn=proxyuser,ou=system,dc=example,dc=fr in /etc/pam_ldap.conf on the client side. I get a "Permission denied" and I see this in logs, on the client side : tail -f /var/log/secure Nov 4 16:33:21 ldap2 sshd[22730]: Invalid user guillard from 10.1.86.93 Nov 4 16:33:21 ldap2 sshd[22731]: input_userauth_request: invalid user guillard on the ldap server side I see this : tail -f /var/log/ldap.log | grep BIND returns NOTHING TO MAKE IT WORK : I must authorize anonymous to read everything to be able to log in, if I change the previous ACL for this one on the ldap server : {1}to * by dn.base="cn=proxyuser,ou=system,dc=example,dc=fr" read by users read by anonymous auth by * READ ^^^^^ Then I can log in properly weither or nor I add rootbinddn in /etc/pam_ldap.conf : rootbinddn cn=proxyuser,ou=system,dc=example,dc=fr If I configure rootbinddn cn=proxyuser,ou=system,dc=example,dc=fr in /etc/pam_ldap.conf, I have this on the client side tail -f /var/log/secure : Nov 4 16:43:15 ldap2 sshd[22813]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=fouine.tech.prive.example.fr user=guillard Nov 4 16:43:15 ldap2 sshd[22813]: Accepted password for guillard from 10.1.x.x port 44953 ssh2 Nov 4 16:43:15 ldap2 sshd[22813]: pam_unix(sshd:session): session opened for user guillard by (uid=0) tail -f /var/log/ldap.log | grep BIND Nov 4 16:39:36 ldap1 slapd[11600]: conn=1616 op=1 BIND dn="cn=proxyuser,ou=system,dc=example,dc=fr" method=128 Nov 4 16:39:36 ldap1 slapd[11600]: conn=1616 op=1 BIND dn="cn=proxyuser,ou=system,dc=example,dc=fr" mech=SIMPLE ssf=0 Nov 4 16:39:36 ldap1 slapd[11600]: conn=1616 op=3 BIND anonymous mech=implicit ssf=0 Nov 4 16:39:36 ldap1 slapd[11600]: conn=1616 op=3 BIND dn="uid=guillard,ou=staff,ou=people,dc=example,dc=fr" method=128 Nov 4 16:39:36 ldap1 slapd[11600]: conn=1616 op=3 BIND dn="uid=guillard,ou=staff,ou=people,dc=example,dc=fr" mech=SIMPLE ssf=0 Nov 4 16:39:36 ldap1 slapd[11600]: conn=1616 op=4 BIND anonymous mech=implicit ssf=0 Nov 4 16:39:36 ldap1 slapd[11600]: conn=1616 op=4 BIND dn="cn=proxyuser,ou=system,dc=example,dc=fr" method=128 Nov 4 16:39:36 ldap1 slapd[11600]: conn=1616 op=4 BIND dn="cn=proxyuser,ou=system,dc=example,dc=fr" mech=SIMPLE ssf=0 Nov 4 16:39:36 ldap1 slapd[11600]: conn=1616 op=5 UNBIND If I don't configure rootbinddn I have the some logs on the client side tail -f /var/log/secure : Nov 4 16:49:47 ldap2 sshd[22863]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=fouine.tech.prive.example.fr user=guillard Nov 4 16:49:47 ldap2 sshd[22863]: Accepted password for guillard from 10.1.x.x port 45639 ssh2 Nov 4 16:49:47 ldap2 sshd[22863]: pam_unix(sshd:session): session opened for user guillard by (uid=0) and this slighty different one on the server side : tail -f /var/log/ldap.log | grep BIND Nov 4 16:51:23 ldap1 slapd[11600]: conn=1622 op=1 BIND dn="" method=128 Nov 4 16:51:23 ldap1 slapd[11600]: conn=1622 op=3 BIND dn="uid=guillard,ou=staff,ou=people,dc=example,dc=fr" method=128 Nov 4 16:51:23 ldap1 slapd[11600]: conn=1622 op=3 BIND dn="uid=guillard,ou=staff,ou=people,dc=example,dc=fr" mech=SIMPLE ssf=0 Nov 4 16:51:23 ldap1 slapd[11600]: conn=1622 op=4 BIND anonymous mech=implicit ssf=0 Nov 4 16:51:23 ldap1 slapd[11600]: conn=1622 op=4 BIND dn="" method=128 Nov 4 16:51:23 ldap1 slapd[11600]: conn=1622 op=5 UNBIND >From what I see in my logs, I don't manage to do what I want, and BTW, I don't see neither any interest to use a proxyuser : Any idea ? --- Olivier

2 1

Per server cn=config parameter in multi-master mode
by Jens Thomas 04 Nov '11

04 Nov '11

Hi, i am playing around with a multi-master setup. The documentation suggests to start with replication of the cn=config database, so that all member server have the same configuration. To solve the problem of the unique server ID we list all member server with their ID and their URL, so that every server can determine his own server ID on the basis of his own URL. OK. But how i can handle all the individual parameter like olcThreads, olcTLS* and all the other parameter, that may differ from server to server? With kind regards Jens -- linux systeme thomas Jens Thomas Völklinger Straße 9 42285 Wuppertal Telefon: +49.202.3097507 Mobil: +49.177.9301386 eFax: +49.202.85064329 Web: http://linux-systeme-thomas.de USt-ID: DE250711901

1 0

delta-syncrepl based N-way MMR/Mirror mode replication
by Meike Stone 03 Nov '11

03 Nov '11

Hello, a second question I have. I read in the list, that OpenLDAP 2.4.27 will support delta-syncrepl based N-way MMR/Mirror mode replication setups. That would solve my problem with a small WAN line and the MM replication between my two LDAP-Servers. 1) Is it reliable enough, to configure this in a production setup? 2) Does it need more CPU and/or RAM than the full replication on the servers? Thanks Meike

2 1

Configuring shared memory / memory mapped files
by Meike Stone 03 Nov '11

03 Nov '11

Hello, time ago, we installed a Linux Guest with OpenLDAP (db size appox. 650MByte / ) server in a ESXi environment. Maybe because of a read/write ratio 100:1, the hard discs where heavy used by writing bdb backends memory mapped files. The CPU in that Linux system had iowait (top) between 80% and 100% and the other VMs on the ESXi went slow down. After changing to shared memory (shm_key), all problems with disc IO where gone. I read in the mailing list and on "OpenLDAP performance tuning" guide, that it does not matter if using memory mapped files or shared memory until the database is over 8GB. But why we had such problems? Please note, the OpenLDAP was operating very fast with the memory mapped files, because of using indexes and proper caching. Now, I want install more than one OpenLDAP server on one Linux system (now real Hardware). Every OpenLDAP server will be bind on a separate IP and DNS host name. So in this scenario it is hard to calculate the shared memory and assign each LDAP server to the right shared memory region (key). Therefore I want go back to memory mapped files. Are there any recommendation for sizing the Linux system like: - type of file system (ext3, ext4, xfs, ..) - parameters of file system (syncing -> commit=nrsec, data=*, ... ) - swap using (swappiness, dirty_background_ratio) - ??? Thanks for any help. Meike

5 10

OpenLDAP Replication configuration error!
by pradyumna dash 03 Nov '11

03 Nov '11

Hi, I am facing an issue with multi master replication in Redhat Enterprise linux 5.7 with Openldap 2.3.43-12.el5_6.7 When am trying to delete or create any user , in the log it says : "err=53 text=shadow context; no update referral." My Configuration file is attached, in the other node i have changed the ServerID and the refereal server IP. Please help me to fix this issue. Regards, Neo

1 0

problem changing {0}config
by Christopher Wood 03 Nov '11

03 Nov '11

Question: What is happening that I can turn a multimaster replica into a "shadow context"? (I'm more or less fine with the behaviour since I don't mind stopping the multimaster slapd's to do a password change, but I'm concerned that I may have missed some underlying problem in my setup.) I've found that issuing a particular set of changes to one or both cn=config multimaster replicas means that I cannot issue any more changes to cn=config until I restart slapd. The ldif I paste into my ldapmodify session is this (changed the hostname and credentials from the real ones): dn: olcDatabase={0}config,cn=config changetype: modify replace: olcSyncrepl olcSyncrepl: {0}rid=1 provider=ldap://ldap-supplier-lab-01.company.com binddn="cn=config" bindmethod=simple credentials=newpw searchbase="cn=config" type=refreshAndPersist retry="5 5 30 +" timeout=5 olcSyncrepl: {1}rid=2 provider=ldap://ldap-supplier-lab-02.company.com binddn="cn=config" bindmethod=simple credentials=newpw searchbase="cn=config" type=refreshAndPersist retry="5 5 30 +" timeout=5 - replace: olcRootPW olcRootPW: newpw I get this output: modifying entry "olcDatabase={0}config,cn=config" Then I observe the following behaviour: I can ldapsearch with the new password and get the expected result (ldif output of the cn=config database). When I ldapmodify with the new password I get this output: modifying entry "olcDatabase={0}config,cn=config" ldap_modify: Server is unwilling to perform (53) additional info: shadow context; no update referral After I restart slapd I get the expected behaviours with both ldapsearch (get ldif output) and ldapmodify (can change cn=config). Further, I've diffed the ldif output of directories before and after this change, and I do not see any difference apart from the attributes that I've changed.

3 4

SyncRepl for subtree
by sim123 03 Nov '11

03 Nov '11

Hi All, I am trying to setup syncrepl, and consumer needs only one subtree from provider and I want to create another subtrees in consumer side, something like this mentioned in this post: http://www.openldap.org/lists/openldap-software/200610/msg00126.html and I am getting same error with openldap-2.4.26, just wanted to check if its possible now? I can't update provider so updateref is not a solution for me. I would greatly appreciate any help. Thanks

2 1

Password policy complexity
by Hugo Deprez 03 Nov '11

03 Nov '11

Dear community, I would like to specify the complexity of the password for users. For exemple a password must contain : one specific character such as : !£"$%^&*()-_+=:;'@~#?<> one capital letter etc... The password policy overlay only authorize to specify the number of character. Is that possible ? Regards, Hugo

2 4

Debugging database crashes
by Ian Collins 01 Nov '11

01 Nov '11

I have a freshly built system db-5.2.36 and openldap-2.4.23. I keep seeing these entries in slapd.log: @(#) $OpenLDAP: slapd 2.4.23 (Oct 31 2011 23:39:29) $ @ldaphost:/build/openldap-2.4.23/servers/slapd hdb_db_open: database "": unclean shutdown detected; attempting recovery. hdb_monitor_db_open: monitoring disabled; configure monitor database to enable slapd starting Any hints on tracing what is crashing and why? -- Ian.

1 0

Pb with sasl2 digest - md5 and openldap
by bea chataigne 30 Oct '11

30 Oct '11

On a redhat 6, openldap 2.4 and cyrus-sasl 2.1.23. I create a sasldb syncuser user, in my slapd.d configuration I add: OlcAuthzRegexp: {0} " uid=syncuser, cn=DIGEST-MD5, cn=auth " " cn=syncuser, dc=xxx, dc=fr " I give the right of reading has the utisilsateur ldap on sasldb. PB during a ldapsearch: # ldapsearch -Y DIGEST-MD5-U syncuser ldap_sasl_interactive_bind_s: Invalid credentials ( 49 ) additional information: SASL ( 13 ): use(wear out) not found: no secret in database Slapd in debug mode(fashion) sends back(dismisses) to me: slapd[2608]: do_bind: dn () SASL mech DIGEST-MD5 slapd[2608]:slapd[2608]: ==> sasl_bind: dn="" mech=<continuing> datalen=277 slapd[2608]: SASL [conn=1002] Debug: DIGEST-MD5 server step 2 slapd[2608]: SASL Canonicalize [conn=1002]: authcid="syncuser" slapd[2608]: slap_sasl_getdn: conn 1002 id=syncuser [len=8] slapd[2608]: slap_sasl_getdn: u:id converted to uid=syncuser,cn=DIGEST-MD5,cn=auth slapd[2608]: >>> dnNormalize: <uid=syncuser,cn=DIGEST-MD5,cn=auth> slapd[2608]: <<< dnNormalize: <uid=syncuser,cn=digest-md5,cn=auth> slapd[2608]: ==>slap_sasl2dn: converting SASL name uid=syncuser,cn=digest-md5,cn=auth to a DN slapd[2608]: [rw] authid: "uid=syncuser,cn=digest-md5,cn=auth" -> "cn=syncuser,dc=xxx,dc=fr" slapd[2608]: slap_parseURI: parsing cn=syncuser,dc=xxx,dc=fr slapd[2608]: >>> dnNormalize: <cn=syncuser,dc=xxx,dc=fr> slapd[2608]: <<< dnNormalize: <cn=syncuser,dc=xxx,dc=fr> slapd[2608]: <==slap_sasl2dn: Converted SASL name to cn=syncuser,dc=xxx,dc=fr slapd[2608]: slap_sasl_getdn: dn:id converted to cn=syncuser,dc=xxx,dc=fr slapd[2608]: SASL Canonicalize [conn=1002]: slapAuthcDN="cn=syncuser,dc=xxx,dc=fr" slapd[2608]: => hdb_search slapd[2608]: daemon: activity on 1 descriptor slapd[2608]: daemon: activity on: slapd[2608]: slapd[2608]: daemon: epoll: listen=7 active_threads=1 tvp=zero slapd[2608]: daemon: epoll: listen=8 active_threads=1 tvp=zero slapd[2608]: daemon: epoll: listen=9 active_threads=1 tvp=zero slapd[2608]: daemon: epoll: listen=10 active_threads=1 tvp=zero slapd[2608]: bdb_dn2entry("cn=syncuser,dc=xxx,dc=fr") slapd[2608]: => hdb_dn2id("cn=syncuser,dc=xxx,dc=fr") slapd[2608]: <= hdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30988) slapd[2608]: => access_allowed: disclose access to "dc=xxx,dc=fr" "entry" requested slapd[2608]: => dnpat: [5] uid=([^,].*),ou=People,dc=xxx,dc=fr nsub: 1 slapd[2608]: => dnpat: [6] uid=([^,].*),ou=People,dc=xxx,dc=fr nsub: 1 slapd[2608]: => dn: [7] ou=people,dc=xxx,dc=fr slapd[2608]: => dn: [8] ou=admin,dc=xxx,dc=fr slapd[2608]: => dn: [9] ou=services,dc=xxx,dc=fr slapd[2608]: => dnpat: [10] ou=groups,ou=(.*),ou=web,dc=xxx,dc=fr nsub: 1 slapd[2608]: => dnpat: [11] ou=(.*),ou=web,dc=xxx,dc=fr nsub: 1 slapd[2608]: => acl_get: [12] attr entry slapd[2608]: => acl_mask: access to entry "dc=xxx,dc=fr", attr "entry" requested slapd[2608]: => acl_mask: to all values by "", (=0) slapd[2608]: <= check a_dn_pat: * slapd[2608]: <= acl_mask: [2] applying read(=rscxd) (stop) slapd[2608]: <= acl_mask: [2] mask: read(=rscxd) slapd[2608]: => slap_access_allowed: disclose access granted by read(=rscxd) slapd[2608]: => access_allowed: disclose access granted by read(=rscxd) slapd[2608]: send_ldap_result: conn=1002 op=1 p=3 slapd[2608]: send_ldap_result: err=10 matched="dc=xxx,dc=fr" text="" slapd[2608]: SASL Canonicalize [conn=1002]: authzid="syncuser" slapd[2608]: SASL [conn=1002] Failure: no secret in database slapd[2608]: send_ldap_result: conn=1002 op=1 p=3 slapd[2608]: send_ldap_result: err=49 matched="" text="SASL(-13): user not found: no secret in database" slapd[2608]: send_ldap_response: msgid=2 tag=97 err=49 slapd[2608]: conn=1002 op=1 RESULT tag=97 err=49 text=SASL(-13): user not found: no secret in database slapd[2608]: <== slap_sasl_bind: rc=49 slapd[2608]: daemon: activity on 1 descriptor slapd[2608]: daemon: activity on: slapd[2608]: 31r Thank you for your suggestions. B Chataigne

2 2

directory performance on modifytimestamp and createtimestamp
by Flack, Simon 29 Oct '11

29 Oct '11

All, Has anyone tried creating an index in openldap to speed-up inequality searches ( eg of the form modifyTimestamp>=20111025162408Z ) on the modifytimestamp or createtimestamp attributes ? If so, what type of index did you create , did openldap perform reads faster than with no index and did the presence of the index slow down writes to openldap appreciably ? Many Thanks, Simon Flack. This e-mail has been scanned for viruses by the Cable&Wireless Worldwide e-mail security system. For more information on a proactive managed e-mail secure service, visit http://www.cw.com/managed-exchange The information contained in this e-mail is confidential and may also be subject to legal privilege. It is intended only for the recipient(s) named above. If you are not named above as a recipient, you must not read, copy, disclose, forward or otherwise use the information contained in this email. If you have received this e-mail in error, please notify the sender (whose contact details are above) immediately by reply e-mail and delete the message and any attachments without retaining any copies. Cable & Wireless Worldwide plc Registered in England and Wales. Company Number 07029206 Registered office: Liberty House, 76 Hammersmith Road, London W14 8UD, England

2 1

[Autofs for Linux and OSX] back-relay ? aliases ?
by Frava 28 Oct '11

28 Oct '11

Hello, I'm configuring Autofs maps via OpenLDAP for some OS X (10.5/6/7) and Linux CentOS (5/6) boxes, and I'm running into a little problem. OS X needs to have an "automountMapName=auto_master" and "automountMapName=auto_home" located in "cn=automountMap,dc=subnet,dc=example,dc=com" Linux needs to have an "automountMapName=auto.master" and "automountMapName=auto.home" located wherever I want in "dc=subnet,dc=example,dc=com" The entries contained in "automountMapName=auto_home" and "automountMapName=auto.home" will be exactly the same ones; SO what is the best way to implement it without duplicate them ? Using aliases or rwm+relay ? Cheers, Rafael.

3 4

Re: [Autofs for Linux and OSX] back-relay ? aliases ?
by Frava 28 Oct '11

28 Oct '11

Well, if your automount-informations are not the same on both OSes then you clearly have to duplicate/arrange them ;). People here use several programs which save the working directory for each project. That (and the fact that users can log onto whatever worstation they want to) makes me mount all the nfs directories in the same place on each computer. Cheers, Rafael. 2011/10/28 myron <kowalskM(a)cs.moravian.edu> > I ran into the same config issue. I ended up duplicating the maps because I > had the macs mount on /home and linux on /users; > otherwise, I would have just renamed the auto maps on either OS to be the > same. > > --myron > ==============================**=== > Myron Kowalski > MoCoSIN Network/Systems Administrator > Moravian College > myron(a)cs.moravian.edu > > > > > On Oct 28, 2011, at 10:13 AM, Frava wrote: > > Hello, >> >> I'm configuring Autofs maps via OpenLDAP for some OS X (10.5/6/7) and >> Linux CentOS (5/6) boxes, and I'm running into a little problem. >> >> OS X needs to have an "automountMapName=auto_master" and >> "automountMapName=auto_home" located in "cn=automountMap,dc=subnet,dc=** >> example,dc=com" >> Linux needs to have an "automountMapName=auto.master" and >> "automountMapName=auto.home" located wherever I want in >> "dc=subnet,dc=example,dc=com" >> >> The entries contained in "automountMapName=auto_home" and >> "automountMapName=auto.home" will be exactly the same ones; SO >> what is the best way to implement it without duplicate them ? Using >> aliases or rwm+relay ? >> >> Cheers, >> Rafael. >> > >

1 0

Re: LDAP + Freeradius + Samba
by Andreas Rudat 28 Oct '11

28 Oct '11

Am 28.10.2011 09:44, schrieb Stewart Walters: > On any given Linux system (assuming that's what your using), NSS and PAM do all the authentication. > > In terms of client tools, they link to (and therefore leverage) NSS and PAM, which OpemLDAP plugs in to. > > It's often irrelevant if you use ntlm_pam, mschap, samba+winbind, pam_ldap, freeradius, Authz or any other client tool. They all link back to NSS and PAM, which when configured correctly plugs in to OpenLDAP. > > Stewart Ok thanks but if I don't missunderstand the documentation, then it only works with clear passwords? But is it save enough then? Because peap isn't supported then, too. Andreas > > On 28/10/2011, at 2:49 PM, Andreas Rudat <rudat(a)endstelle.de> wrote: > >> Am 28.10.2011 04:28, schrieb Stewart Walters: >>> Freeradius already supports posixAccount attributes for LDAP account authentication - check the Freeradius website for a howto. >>> >>> Freeradius and OpenLDAP also supports the storing of 802.1x attributes using the RADIUS schema. >>> >>> There are numerous howto's available on the web for how to implement either. >>> >>> >>> >>> >>> On 28/10/2011, at 3:28 AM, Andreas Rudat <rudat(a)endstelle.de> wrote: >>> >>>> Hello, >>>> >>>> I got openldap running as user db for samba, now I want to use it also >>>> as database for radius, I think it should be possible to use it without >>>> big modifications or? >>>> >>>> Thanks >>>> >> ok thanks, I will look. Another question is, does I need any other >> client tools for windows/linux? At the moment I'm using ntlm_auth + mschap >> >> Andreas >> >> -- >> >> -----BEGIN PGP PUBLIC KEY BLOCK----- >> Version: GnuPG v2.0.17 (MingW32) >> >> mQGNBE6jHfABDACyzFkn6k+OtbRANjKZ6NEQOxnnsBSBSs6sT9EBF0U3MnnYW3/p >> YTW+7aUa/1FZTOWt9wb9H7t0SOqpgqUBmRo/sPteepXblnDaGEh8tzIWfaC9MKc1 >> QobU5zK9KcDKrs3SyGXEPOOQM8QdtE8KfSJFdUxfanFJUbfTbxq5Gqz1eaU4cWxp >> gR6GeVYnd11J8AdDDwkjPjx4ZJ5guZ+D646Qi3CT7KT6y8sXVPwpNA3CvGweYX0r >> STKyBf+nlQtOtByrgZW7BiSAxilYUL4mGE4KmuYAadJ+O6X7NOtz3OQaWgSGjqxH >> YxDu6orTzL4/csjoVXS9dgeGkhLJgAg72a2yxA4tx/8IXrGp3JVGYGEY2kYcq3k9 >> jq5hJezoy6s1N//mgm5KaB84zrU5cUcu8kXDppmnp7eXUPnBqj2g2O82buBNa48S >> wAtnbY4K5fbcnog8g6ouYXpAJo9yHcj+wraQ8+TNFx5nbkg3fZKuf3UeyL3dPKXf >> wsKehnZ3Ipqkb08AEQEAAbQiQW5kcmVhcyBSdWRhdCA8cnVkYXRAZW5kc3RlbGxl >> LmRlPokBuAQTAQIAIgUCTqMd8AIbDwYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AA >> CgkQBw5gh+kRIv+yGQv5AQCRZt8wR2McgsTurZEZXz5UpxEPZB/dA/iXtPzZXJih >> XLRZFqcdT+c8DCLbhXjO5aLndOCIDwWmsnqX2fuGAjlM4GJAAUEARSNtWY7V+rUt >> PhdOz/flCZo/+p7wBi0XOJcWhysS7DV/ssSYdnuJvONUBXCQ/MpJsVXuKdgPa9IR >> hvi37Ang1Cxb7htKHIuA4wCuqz1/4VGNez/65qwjuYakbB4/rXkKWb17XqCZrtoo >> YiQSxPU7fP5lM4ybQXxP1qrptmaF9EqGTnj/xAU3tCE+PhB3baoVw6VG9nr9xYwh >> bqCGtTbtrkmYlgioC2fFHDgg3U1GVBIbi0AoddXSs5OekgSvt827OcyWVSyjobyn >> tH4/jwb8X8iOM/x8RZhzwKhpHA0k7ltTm7qXApARcL1tV6y4GIKwuy1RLZqkpNh1 >> teqYaxAKlxC77s6gftxqr7G6NCssgCCy2Y50LSvcQbZDPZeBdrPoGI/xAWNy4Otv >> 33k4P9hxJKHNqLYJN+Gn >> =UaS9 >> -----END PGP PUBLIC KEY BLOCK----- >> -- -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v2.0.17 (MingW32) mQGNBE6jHfABDACyzFkn6k+OtbRANjKZ6NEQOxnnsBSBSs6sT9EBF0U3MnnYW3/p YTW+7aUa/1FZTOWt9wb9H7t0SOqpgqUBmRo/sPteepXblnDaGEh8tzIWfaC9MKc1 QobU5zK9KcDKrs3SyGXEPOOQM8QdtE8KfSJFdUxfanFJUbfTbxq5Gqz1eaU4cWxp gR6GeVYnd11J8AdDDwkjPjx4ZJ5guZ+D646Qi3CT7KT6y8sXVPwpNA3CvGweYX0r STKyBf+nlQtOtByrgZW7BiSAxilYUL4mGE4KmuYAadJ+O6X7NOtz3OQaWgSGjqxH YxDu6orTzL4/csjoVXS9dgeGkhLJgAg72a2yxA4tx/8IXrGp3JVGYGEY2kYcq3k9 jq5hJezoy6s1N//mgm5KaB84zrU5cUcu8kXDppmnp7eXUPnBqj2g2O82buBNa48S wAtnbY4K5fbcnog8g6ouYXpAJo9yHcj+wraQ8+TNFx5nbkg3fZKuf3UeyL3dPKXf wsKehnZ3Ipqkb08AEQEAAbQiQW5kcmVhcyBSdWRhdCA8cnVkYXRAZW5kc3RlbGxl LmRlPokBuAQTAQIAIgUCTqMd8AIbDwYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AA CgkQBw5gh+kRIv+yGQv5AQCRZt8wR2McgsTurZEZXz5UpxEPZB/dA/iXtPzZXJih XLRZFqcdT+c8DCLbhXjO5aLndOCIDwWmsnqX2fuGAjlM4GJAAUEARSNtWY7V+rUt PhdOz/flCZo/+p7wBi0XOJcWhysS7DV/ssSYdnuJvONUBXCQ/MpJsVXuKdgPa9IR hvi37Ang1Cxb7htKHIuA4wCuqz1/4VGNez/65qwjuYakbB4/rXkKWb17XqCZrtoo YiQSxPU7fP5lM4ybQXxP1qrptmaF9EqGTnj/xAU3tCE+PhB3baoVw6VG9nr9xYwh bqCGtTbtrkmYlgioC2fFHDgg3U1GVBIbi0AoddXSs5OekgSvt827OcyWVSyjobyn tH4/jwb8X8iOM/x8RZhzwKhpHA0k7ltTm7qXApARcL1tV6y4GIKwuy1RLZqkpNh1 teqYaxAKlxC77s6gftxqr7G6NCssgCCy2Y50LSvcQbZDPZeBdrPoGI/xAWNy4Otv 33k4P9hxJKHNqLYJN+Gn =UaS9 -----END PGP PUBLIC KEY BLOCK-----

1 0

back-config and Post Read Control?
by Michael Ströder 28 Oct '11

28 Oct '11

HI! Does back-config support the Post Read Control? That would be handy for retrieving the renumbered DN after an Add or Modify request. Ciao, Michael.

4 6

Re: LDAP + Freeradius + Samba
by Andreas Rudat 28 Oct '11

28 Oct '11

Am 28.10.2011 04:28, schrieb Stewart Walters: > Freeradius already supports posixAccount attributes for LDAP account authentication - check the Freeradius website for a howto. > > Freeradius and OpenLDAP also supports the storing of 802.1x attributes using the RADIUS schema. > > There are numerous howto's available on the web for how to implement either. > > > > > On 28/10/2011, at 3:28 AM, Andreas Rudat <rudat(a)endstelle.de> wrote: > >> Hello, >> >> I got openldap running as user db for samba, now I want to use it also >> as database for radius, I think it should be possible to use it without >> big modifications or? >> >> Thanks >> ok thanks, I will look. Another question is, does I need any other client tools for windows/linux? At the moment I'm using ntlm_auth + mschap Andreas

1 0

Referral and Chain configuration and multiple directories
by sim sim 28 Oct '11

28 Oct '11

Hi All, I have an LDAP server running with all users and respective groups say ( a.example.net). I was wondering if there is any way I could separate user subtree into another OpenLDAP server (b.example.net) and still be able to define those users as member of groups in a.example.net (for a new requirement). Basically I want to separate user repository (which is global) from all other subsystems like my groups or organization units which contains these users as members. If its possible, please point me to the documentation, I tried searching all over but could not find enough example of Referrals or proxying. Another thing I would like to understand that is it a good idea to create another directory server just for user authentication and read, how common it is? Or should I consider replication? Thanks for the help and support.

1 0

LDAP + Freeradius + Samba
by Andreas Rudat 27 Oct '11

27 Oct '11

Hello, I got openldap running as user db for samba, now I want to use it also as database for radius, I think it should be possible to use it without big modifications or? Thanks

2 1

New overlay, your opinion?
by Johan Jakus 27 Oct '11

27 Oct '11

Hi everyone, I've been developing an overlay and I got to a well working solution. But,I would really appreciate your opinions about it before sending it to the contribs. You can see my source on my site: http://www.dataworld.be/johan/openldap/parsearch/parsearch.htm Since I'm a student and I needed to this for my stage, I'will have to write a rapport on how to write an overlay for OverLDAP, I'll be glad to share it as a tutorial for the next overlay developers. Thanks allot! Johan Jakus

2 6

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical