- openldap-technical - openldap.org

password-policy configuration problems: cannot change passwords
by Marco Weber 27 Oct '11

27 Oct '11

Hello, i'm running openldap with password policy overlay. after the overlay installation and configuration, we cannot change the passwords anymore. ldappasswd -D cn=username,dc=domain,dc=tld -S -W New password: ******** Re-enter new password: ******** Enter LDAP Password: ******** Result: Constraint violation (19) Additional info: Password policy only allows one password value this is my default password policy: dn: cn=password-policy,dc=policies,dc=domain,dc=tld objectClass: person objectClass: pwdPolicy objectClass: top cn: password-policy pwdAttribute: userPassword sn: Default Password Policy pwdAllowUserChange: TRUE pwdExpireWarning: 604800 pwdInHistory: 3 pwdLockout: TRUE pwdLockoutDuration: 7200 pwdMaxAge: 7776000 pwdMaxFailure: 5 pwdMinAge: 180 pwdMinLength: 8 pwdMustChange: TRUE this is my password policy configuration: dn: olcOverlay=ppolicy,dc=policies,dc=domain,dc=tld objectClass: olcConfig objectClass: olcOverlayConfig objectClass: olcPPolicyConfig objectClass: top olcOverlay: ppolicy olcPPolicyDefault: cn=password-policy,dc=policies,dc=domain,dc=tld olcPPolicyUseLockout: TRUE Does anyone know what to do? Thanks in advance for any reply, Marco

2 6

Securing cn=config and allowing micro-engineering
by Nick Milas 27 Oct '11

27 Oct '11

Hello, Having migrated from slapd.conf, I would like to ask some questions regarding cases/scenarios where someone - unintentionally - breaks the configuration. So, let's assume that, due to some misspelling or use of wrong values (esp. when using a graphical LDAP Browser - like JXplorer - to maintain the configuration DIT), we have added/modified a setting that would break the installation without warning. *Question 1*: Are there cases where: 1/ LDAP Server will stop immediately? (It is stated that "Beware: You can configure cn=config to an unusable state.", ref. with example: http://www.zytrax.com/books/ldap/ch6/slapd-config.html) 2/ LDAP Server will continue to operate but, if stopped, when restarted it will not be able to restart? If the answer to Q1.2 above is yes: *Question 2*: How can we test at any given point the current configuration to make sure it will be OK if/when restarted (AFAIK, slaptest only tests slapd.conf and not slapd.d configuration)? *Question 3* (especially critical if the answer to Q1.1 or Q1.2 above is yes): If the server is stopped, how can we change manually the config settings (e.g. by editing slapd.d/ files) to attempt to correct it? (In one such test I did, I changed - directly in "cn=config.ldif" file - olcLogLevel as follows: Initial state: olcLogLevel: Config olcLogLevel: Sync New state (removed one attribute value and changed the other): olcLogLevel: -1 and when I tried to start I got: ldif_read_file: checksum error on "/usr/local/openldap/etc/openldap/slapd.d/cn=config.ldif" so I had to re-edit the file and change the values as they were initially, which allowed the server to start. So (to *repeat Question 3*), how can we "re-engineer" cn=config settings when off-line? It is always desirable to be able to do some "low-level engineering" to the configuration (under administrator's or system engineer's responsibility) in case something goes wrong. This is also important in cases of "cloning" the server where we want a copy of the config but we need to change a few settings in the new context. We need to avoid things like "checksum error"! Finally, there might be cases where - after having migrated and worked for a period using cn=config - business/technical needs require the use of overlay(s) or other modules like SLAPI, which would not be supported by cn=config and someone would need to move to slapd.conf configuration (at least temporarily). If such a need arises, *Question 4*: Is there a tool/method to "migrate" to slapd.conf from a slapd.d configuration? Thanks in advance, Nick

9 17

bdb version(s)
by Brett ＠Google 27 Oct '11

27 Oct '11

Hello, Anybody want to comment with regards to what version of bdb they have in use & what they recommend ? Personally i have in installations running 4.8 and 5.2, and both seem fine. Cheers Brett -- *The only thing that interferes with my learning is my education.* * Albert Einstein*

2 1

slapcat -n 0 and slapadd
by Craig White 27 Oct '11

27 Oct '11

Having migrated to dynamic config, I'm looking for a reasonable way to restore in the event of a disaster. The discussion last week got me curious and though I can slapcat -n 0 -l $SOME_FILE I can't slapadd this same file because it complains that I don't have a slapd.conf file, which of course is true... I haven't needed it with the dynamic configuration backend. What's the minimum that I would need in a slapd.conf file so I can simply 'rm -fr /var/lib/ldap/* && slapadd -l $SLAPD_BACKUP' ? -- Craig White ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ craig.white(a)ttiltd.com 1.800.869.6908 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ www.ttiassessments.com Need help communicating between generations at work to achieve your desired success? Let us help!

3 8

OpenLDAP documentation Doxygen
by Johan Jakus 26 Oct '11

26 Oct '11

Hi everyone! While working on my overlay, I add real hard time trying to understand the structure used by OpenLDAP. To help me out, I used Doxygen that automatically generates a map of the structures (and much more) from the source code. You can check this out on my website ( http://www.dataworld.be/johan/openldap/doxygen/). I would highly recommend you to use this tool so that future developers can easily find their way in your structures. The best solution would be to add this kind of documentation to the OpenLDAP website, so that everyone could easily access it. I don't want to judge your way of doing things, I just want to share something that helped me out allot! Best regards, Johan Jakus

1 0

RE: Overlays : Cache - Entry - AttributeDescription
by Hallvard B Furuseth 26 Oct '11

26 Oct '11

A correction to my last message: > If you want to free the entry yourself, instead you can do > > rs_replace_entry(entry_dup(rs->sr_entry)); e = rs->sr_entry; .... send the entry, or whatever... entry_free(e); /* instead of entry_free(rs->sr_entry); */ I don't quite remember, but I think when rs->sr_flags does not assert ownership of the entry, some other module may change the sr_entry pointer. So entry_free(rs->sr_entry) could free the wrong entry. Johan Jakus writes: > I'd like to make the attributes I merged in the entry > "read-only". Because the clients will receive an attribute from the > parents of an object, and I don't want them to to be able to save that > attribute in the object,when for example they change other attributes > values and click on the modify button in a program. Would You have any > idea on how to make that possible? Don't know, but try access controls to prevent user modifications, then bypass that for the mods done by the overlay with <Modifications>.sml_flags |= SLAP_MOD_INTERNAL; Maybe something like objectclass ( <oid> NAME 'jakusAddedAttrs' AUXILIARY MAY ( managed_attr1 $ managed_attr2 $ ... ) ) ... access to filter=(objectclass=jakusAddedAttrs) attrs=@jakusAddedAttrs by * read The alternative would be to intercept update operations and return (prohibited mod ? LDAP_UNWILLING_TO_PERFORM : SLAP_CB_CONTINUE). -- Hallvard

2 1

Cannot confirm uidNumber 1001 is free: checking for the next on
by Juan Diego Calle 25 Oct '11

25 Oct '11

Hi, I have an issue with openldap and smbldap-tools. Maybe I am wrong, and it has nothing to do with openldap. At first I notice that for some reason when I was trying to create users with phpldapadmin all my users had the same ID, 1001, so I tried to create users with smbldap-useradd and found the following warnings: I know Cannot confirm uidNumber 1001 is free: checking for the next on .... Cannot confirm uidNumber 2670 is free: checking for the next on So after hours of looking at the code in php of phpldapadmin, and looking to i think it doesn't find the right number, for some weird reason in my configuration. It seems like this problems are related since for some reason the UID of the users is not easy to confirm. Could it be that I added the ids from my backup and some posix accounts users already had those ids and since then the rest of my UID got screwed. Has anyone had any similar problem in the past. Thanks

1 0

SLAPI plugins do not load
by Dimitri 24 Oct '11

24 Oct '11

Hi, Seems like loading SLAPI plugins is broken. I tried to play with addrdnvalues.c from the distribution, compiled it like it was recommended in the README: gcc -shared -I../../../include -Wall -g -o libaddrdnvalues-plugin.so addrdnvalues.c and tried to load from slapd.conf: plugin preoperation /usr/local/lib/libaddrdnvalues-plugin.so addrdnvalues_preop_init Here is what I've got running slapd: ================================================================================ [root@localhost ~]# /usr/local/libexec/slapd -u ldap -g ldap -d stats -f /etc/openldap/slapd.conf 4e9e21b0 @(#) $OpenLDAP: slapd 2.X (Oct 19 2011 02:18:15) $ mitya@localhost.localdomain:/usr/local/libexec/slapd failed to load plugin /usr/local/lib/libaddrdnvalues-plugin.so: file not found 4e9e21b0 slapd stopped. 4e9e21b0 connections_destroy: nothing to destroy. ================================================================================ The file /usr/local/lib/libaddrdnvalues-plugin.so exists and is readable; strace shows that it is in fact being opened successfully. Putting it into /usr/lib, /usr/lib/openldap and other locations does not help. This "file not found" message in fact is a well-known libltdl issue: lt_dlerror() reports "file not found" in any case of unsuccessful library loading attempt, including missing dependencies and unresolved symbols. Libtoolizing this plugin and supplying a .la file instead of .so does not help either. I am running current git master under Mandriva 2010.2 with libtool 2.2.6b, tried libtool 2.4 with the same result. Linking the plugin with explicit -lldap -lslapi (to satisfy potentially unresolved symbols) does not help. libslapi.so is in the library path. Statically linked slapd (with slapi_, ldap_ and ber_ functions) works the same way. Any suggestions? Dimitri

4 10

Need filter that allows members of specific group to authenticate, not sure how to build it
by Josh Cole 24 Oct '11

24 Oct '11

I am attempting to configure OpenVPN to use openldap to authenticate our Active Directory users who are a member of our VPN group in AD. Here is my ldap config for OpenVPN. Specifically I need the filter string to allow enabled users who are a member of the _VPN group. The one you see below is from an example script I found that explains how to configure LDAP for openvpn. SearchFilter "(&(objectClass=mailUser)(accountStatus=active)(enabledService=vpn))" Any help is appreciated! <LDAP> # LDAP server URL URL ldap://172.16.1.70 # Bind DN (If your LDAP server doesn't support anonymous binds) BindDN CN=ldapusername,OU=LDAP,DC=example,DC=local # Bind Password cn=vmail password Password ******* # Network timeout (in seconds) Timeout 15 </LDAP> <Authorization> # Base DN BaseDN "dc=example,dc=local" # User Search Filter SearchFilter "(&(objectClass=mailUser)(accountStatus=active)(enabledService=vpn))" # Require Group Membership RequireGroup false </Authorization> Josh Cole Network and Systems Engineer Fresno Pacific University (559) 453-3414

1 0

Logging region out of memory; you may need to increase its size
by Frank Bonnet 24 Oct '11

24 Oct '11

Hello I have a problem when trying to perform the command : slapcat -l toto.ldif I get this error message bdb_db_open: database "dc=xxxx,dc=fr": unclean shutdown detected; attempting recovery. bdb_db_open: database "dc=xxxx,dc=fr": recovery skipped in read-only mode. Run manual recovery if errors are encountered. bdb(dc=xxxx,dc=fr): Logging region out of memory; you may need to increase its size bdb_db_open: database "dc=xxxx,dc=fr": db_open(/var/db/openldap-data/id2entry.bdb) failed: Cannot allocate memory (12). backend_startup_one (type=bdb, suffix="dc=xxxx,dc=fr"): bi_db_open failed! (12) slap_startup failed I use berkeley DB 4.6 on a FreeBSD 8.1 system Thanks for any info

1 0

Can I use LDAP_VALID within my app/library?
by Khaled Blah 24 Oct '11

24 Oct '11

Hello to all, I would like to ask whether there is a way which allows me to use the macro "LDAP_VALID" in my own code. I would like to be able to check an LDAP* handle for its validity before I use that handle on any of the LDAP operation functions. Regards, Khaled

3 5

Abwesenheit: openldap-technical Digest, Vol 47, Issue 23
by tkircht＠ipodion.at 23 Oct '11

23 Oct '11

Ich bin vom 21.10.2011 bis einschließlich 2.11.2011 nicht in Wien. Ich werde meine Mailbox in dieser Zeit nur sporadisch abfragen können. Bitte wenden Sie sich mit Ihren Anfragen in dieser Zeit an unser Büro unter office(a)ipodion.at bzw. der Telefonnummer 01/21632985-00. Vielen Dank Thomas Kirchtag

1 0

Re: Patching openldap?
by Christian Manal 22 Oct '11

22 Oct '11

Am 11.10.2011 22:12, schrieb NetNinja: > I tryed your command today. I still can't get it to work. I listed all > the files I have edited. Can you look over it and tell if I'm missing > anything. Thanks for your help. Please keep your replies on the list. Others might run into similar problems and find this helpful. > I ran this: > ldapclient manual -v > -a defaultSearchBase="dc=test,dc=net" > -a domainName="test.net" > -a authenticationMethod="simple" > -a defaultServerList="10.0.0.2" > -a preferredServerList="10.0.0.2" > -a serviceSearchDescriptor="passwd:ou=People,dc=test,dc=net" > -a serviceSearchDescriptor="group:ou=Group,dc=test,dc=net" > 10.0.0.2 > > I don't have TLS, automount or netgroups setup yet. > > bash-3.00# ldapclient list > NS_LDAP_FILE_VERSION= 2.0 > NS_LDAP_SERVERS= 10.0.0.2 > NS_LDAP_SEARCH_BASEDN= dc=test,dc=net > NS_LDAP_CACHETTL= 0 > NS_LDAP_SERVICE_SEARCH_DESC= passwd:ou=People,dc=test,dc=net > NS_LDAP_SERVICE_SEARCH_DESC= group:ou=Group,dc=test,dc=net > > I tried to add more lines but I was getting a lot of errors. What kind of errors? > /etc/nsswitch.conf > passwd: files ldap > group: files ldap > host: files ldap Are you sure you want to resolve hostnames via LDAP and not DNS? > what i have running on RHEL > ldapsearch -x <snip> > ---------------- I have added a proxy entry before I have not done so > yet. Do I still need one if I'm useing manual and not init? If your data can be accessed anonymously, you don't need proxy credentials. > My PAM file > > # login service (explicit because of pam_dial_auth) > # > login auth requisite pam_authtok_get.so.1 > login auth required pam_dhkeys.so.1 > login auth required pam_unix_cred.so.1 > login auth sufficient pam_unix_auth.so.1 > login auth required pam_dial_auth.so.1 > login auth required pam_ldap.so.1 My "auth" blocks look like this: login auth requisite pam_authtok_get.so.1 login auth required pam_dhkeys.so.1 login auth required pam_unix_cred.so.1 login auth required pam_dial_auth.so.1 login auth sufficient pam_ldap.so.1 use_first_pass ignore_unknown_user login auth required pam_unix_auth.so.1 > # > # rlogin service (explicit because of pam_rhost_auth) > # > rlogin auth sufficient pam_rhosts_auth.so.1 > rlogin auth requisite pam_authtok_get.so.1 > rlogin auth required pam_dhkeys.so.1 > rlogin auth required pam_unix_cred.so.1 > rlogin auth sufficient pam_unix_auth.so.1 > rlogin auth required pam_ldap.so.1 > # > # Kerberized rlogin service > # > krlogin auth required pam_unix_cred.so.1 > krlogin auth required pam_krb5.so.1 > # > # rsh service (explicit because of pam_rhost_auth, > # and pam_unix_auth for meaningful pam_setcred) > # > rsh auth sufficient pam_rhosts_auth.so.1 > rsh auth required pam_unix_cred.so.1 > # > # Kerberized rsh service > # > krsh auth required pam_unix_cred.so.1 > krsh auth required pam_krb5.so.1 > # > # Kerberized telnet service > # > ktelnet auth required pam_unix_cred.so.1 > ktelnet auth required pam_krb5.so.1 > # > # PPP service (explicit because of pam_dial_auth) > # > ppp auth requisite pam_authtok_get.so.1 > ppp auth required pam_dhkeys.so.1 > ppp auth required pam_unix_cred.so.1 > ppp auth sufficient pam_unix_auth.so.1 > ppp auth required pam_dial_auth.so.1 > ppp auth required pam_ldap.so.1 > # > # Default definitions for Authentication management > # Used when service name is not explicitly mentioned for authentication > # > other auth requisite pam_authtok_get.so.1 > other auth required pam_dhkeys.so.1 > other auth required pam_unix_cred.so.1 > other auth sufficient pam_unix_auth.so.1 > other auth required pam_dial_auth.so.1 > other auth required pam_ldap.so.1 > # > # passwd command (explicit because of a different authentication module) > # > passwd auth sufficient pam_passwd_auth.so.1 > passwd auth required pam_ldap.so.1 > # > # cron service (explicit because of non-usage of pam_roles.so.1) > # > cron account required pam_unix_account.so.1 > # > # Default definition for Account management > # Used when service name is not explicitly mentioned for account management > # > other account sufficient pam_ldap.so.1 > other account requisite pam_roles.so.1 > other account required pam_unix_account.so.1 You can omit pam_ldap here. It only produces error messages in the logs for me. > # > # Default definition for Session management > # Used when service name is not explicitly mentioned for session management > # > other session required pam_unix_session.so.1 > # > # Default definition for Password management > # Used when service name is not explicitly mentioned for password management > # > other password required pam_dhkeys.so.1 > other password requisite pam_authtok_get.so.1 > other password requisite pam_authtok_check.so.1 > other password required pam_authtok_store.so.1 > # > > > On Sun, Oct 9, 2011 at 10:31 AM, Christian Manal > <moenoel(a)informatik.uni-bremen.de> wrote: >> Am 09.10.2011 14:33, schrieb NetNinja: >>> On Sat, Oct 8, 2011 at 4:54 AM, Christian Manal >>> <moenoel(a)informatik.uni-bremen.de> wrote: >>>> Am 07.10.2011 23:58, schrieb NetNinja: >>>>> Ok that's good to know. >>>>> I was reading in the book "Solaris 10 System Administration Essential" >>>>> and it says on pg 365 that the openldap server needs to be patched so >>>>> that the ldapclient init utility will configure properly. >>>>> >>>>> Do you happen to remeber how you setup the Solaris Native client? This >>>>> my current issue, I installed openldap on a RHEL 5.5 server and have all >>>>> the Linux servers working with the ldap server but the Solaris servers >>>>> won't let me login as a ldap user. I can do a ldapsearch, id, getent and >>>>> get info on ldap users. I am in the process of troubleshooting the issue >>>>> and I'm not sure what I'm doing wrong? My setup is very basic, no TLS, >>>>> uatomount or replication. I will add these later when I know what i'm doing. >>>>> >>>>> Anyway thanks for your help. If you have any advice on ldapclient setup >>>>> let me know. >>>>> >>>>> On Fri, Oct 7, 2011 at 3:41 PM, Christian Manal >>>>> <moenoel(a)informatik.uni-bremen.de >>>>> <mailto:moenoel@informatik.uni-bremen.de>> wrote: >>>>> >>>>> Am 07.10.2011 20:25, schrieb NetNinja: >>>>> > Hello, >>>>> > I have been reading up on OpenLDAP. I have installed it on RHEL >>>>> 5.5 but >>>>> > I have seen documention saying that openldap needs to be patched >>>>> to work >>>>> > with Solaris. Can someone tell me if this still the case and if so >>>>> where >>>>> > to get the patch. If not any info you can provide wold be great. >>>>> > >>>>> > Thanks >>>>> > >>>>> > >>>>> >>>>> Hi, >>>>> >>>>> I've been running OpenLDAP on Solaris 10 for years now. It works out of >>>>> the tarball, no patches needed. >>>>> >>>>> >>>>> Regards, >>>>> Christian Manal >>>>> >>>>> >>>>> >>>>> >>>>> >>>> >>>> >>>> Here's an example of an ldapclient invocation that works for me: >>>> >>>> ldapclient manual \ >>>> -a authenticationMethod="tls:simple" \ >>>> -a credentialLevel="proxy" \ >>>> -a defaultSearchBase="dc=example,dc=org" \ >>>> -a defaultSearchScope="sub" \ >>>> -a defaultServerList="ldap1.example.org,ldap2.example.org" \ >>>> -a domainName="example.org" \ >>>> -a preferredServerList="ldap1.example.org,ldap2.example.org" \ >>>> -a serviceSearchDescriptor="passwd:ou=People,dc=example,dc=org" \ >>>> -a serviceSearchDescriptor="group:ou=Group,dc=example,dc=org" \ >>>> -a serviceSearchDescriptor="netgroup:ou=Netgroup,dc=example,dc=org" \ >>>> -a >>>> serviceSearchDescriptor="auto_home:ou=auto_home,ou=Mounts,dc=example,dc=org" >>>> \ >>>> -a attributeMap="auto_home:automountMapName=ou" \ >>>> -a attributeMap="auto_home:automountKey=cn" \ >>>> -a proxyDN="uid=proxyauth,ou=people,dc=example,dc=org" \ >>>> -a proxyPassword="foobar" >>>> >>>> >>>> Before you invoke that, you need to modify /etc/nsswitch.ldap to your >>>> needs (ldapclient will copy that to /etc/nsswitch.conf). You also need >>>> to put your TLS certs into /var/ldap in NSS format (you can >>>> generate/convert them with certutil[1]) and edit /etc/pam.conf for LDAP >>>> authentication. >>>> >>>> >>>> Regards, >>>> Christian Manal >>>> >>>> >>>> [1] http://www.mozilla.org/projects/security/pki/nss/tools/certutil.html >>>> >>> >>> Thanks, >>> >>> I will try your command. Since you used ldapclient manual and not >>> ldapclient init I don't need to add a profile of proxy ldif file to >>> the ldap server, right? >> >> Right. It's possible to deposit most of those infos in a profile in the >> DIT, but since I have a script for configuring LDAP clients it doesn't >> make any difference for me. I have only one set of settings for Solaris >> boxes. Though, it might be worth looking into for you, if you have >> different setups. >> >> >>> I have been using examples like the one you >>> just gave me and I can only get the info from the server. The password >>> seems to not work. I get the same erros on the prompt that I would get >>> if the password or username where wrong. Though I have not tried the >>> command with the serviceSearchDescriptor before maybe this is what I'm >>> missing. >> >> You replaced the credentials with existing ones from your DIT, right? Do >> they work with ldapsearch? Does the DN have read access to the user and >> group data in your DIT? >> >> You might want to call ldapclient with '-v' to get some debugging info. >> >> >>> I'm also not using TLS or automount can I leave these out, for now? >>> Sotls:simple would be simple, right. >> >> Right. >> >> >>> Also could Solaris 10 not want to >>> work because I'm not using TLS? >> >> I don't think so. It shouldn't make any difference. Though, I'd >> recommend adding TLS support before putting anything in production. >> >> >>> Anyway thanks for your time. I will let you know if it works. >>> >> >> >> Regards, >> Christian Manal >> >> > > >

2 3

Abwesenheit: openldap-technical Digest, Vol 47, Issue 22
by tkircht＠ipodion.at 22 Oct '11

22 Oct '11

Ich bin vom 21.10.2011 bis einschließlich 2.11.2011 nicht in Wien. Ich werde meine Mailbox in dieser Zeit nur sporadisch abfragen können. Bitte wenden Sie sich mit Ihren Anfragen in dieser Zeit an unser Büro unter office(a)ipodion.at bzw. der Telefonnummer 01/21632985-00. Vielen Dank Thomas Kirchtag

1 0

Abwesenheit: openldap-technical Digest, Vol 47, Issue 21
by tkircht＠ipodion.at 21 Oct '11

21 Oct '11

Ich bin vom 21.10.2011 bis einschließlich 2.11.2011 nicht in Wien. Ich werde meine Mailbox in dieser Zeit nur sporadisch abfragen können. Bitte wenden Sie sich mit Ihren Anfragen in dieser Zeit an unser Büro unter office(a)ipodion.at bzw. der Telefonnummer 01/21632985-00. Vielen Dank Thomas Kirchtag

1 0

Overlays : Cache - Entry - AttributeDescription
by Johan Jakus 21 Oct '11

21 Oct '11

Hi everyone, I’m still working on my overlay for an OpenLDAP server, and I’ve a few questions, I hope you could help me with: 1. In my overlay, I search for the attribute of a parent (recursively) and then, I return it in the response using the “attr_merge” function as used in the “content” overlay. But, this seems to be a permanent change, the server will always return that attribute, till I restart the server. It’s like if the “attr_merge” function add the attribute in some kind of cache that is only cleared when the server shuts down. I ‘would like my attribute to be return only when I ask it, is there some other function that allow this or maybe a way to clear that cache? 2. I need to free some variables at the end of the request. It seems that the server goes through the response function one last time at the end of the request with an empty entry, I used that condition to free my variable. This seems to work perfectly, but is there may be another way to do that? 3. To determine what attribute I need to look up for parent’s attributes, I use a symbol before the attribute in the search request (ex: “_street”). This means that when the attribute arrives in the search function, it has no attribute description because the attribute name isn’t valid of course! So, I change the name, save the attribute name for later use and then use the “slap_str2ad” function do add the attribute description! But this means that the server as to go look for that attribute description again and this means decreasing the performance. My question is: Is there a way to change and saved the attribute name before the server loads the attribute descriptions and calls the search function? Since I’ve found a workarounds for question 2 and 3, question 1 is my biggest problem to make my overlay work properly! Thanks for your coming answers! Johan Jakus

2 4

Re: howto view slapd configuration : ldapsearch VS slapcat
by Howard Chu 20 Oct '11

20 Oct '11

Olivier Guillard wrote: > Thanks Howard, > >> you can't ask for just a specific list of attributes. slapcat always >> returns whole entries. > > That's what I didn't get : thanks. The slapcat(8) manpage says: The entry records will include all (user and operational) attributes stored in the database. >> You haven't shown an example of the command you attempted > > I tried almost the same with the attribute that I try to retreive included : > >> slapcat -H "ldap:///cn=config??sub?(olcDatabase=*)" > slapcat -H "ldap:///cn=config?olcAccess?sub?(olcDatabase=*)" > >> but obviously you did it wrong. > > You are obviously right since I get this : > > usage: slapcat [-v] [-d debuglevel] [-f configfile] [-F configdir] [-o > <name>[=<value>]] [-c] > [-g] [-n databasenumber | -b suffix] [-l ldiffile] [-a filter] [-s > subtree] [-H url] > > I thought that my URI was correct though. The slapcat(8) manpage says: -H URI use dn, scope and filter from URI to only handle matching entries. It says nothing about using an attribute list in the URI. Did you think we were just joking? That what the docs say is not what is actually meant? -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: howto view slapd configuration : ldapsearch VS slapcat
by Sébastien Bernard 20 Oct '11

20 Oct '11

Le 19/10/2011 15:51, Olivier Guillard a écrit : > Hi Seb, > > Isn't there any way to pass filters to slapcat see spécific > part of the configuration ? > >>> ldapsearch -x -LLL -D uid=admin,cn=config -W -s sub -b "cn=config" >>> "(olcDatabase=*)" olcAccess > [snip ...] Unfortunately not. Slapcat is meant to dump the whole context. You can eventualy use a small perl script to sort the relevant nodes afterwards. Else ldapsearch with '*' '+' should give you all the attributes included in the database. ldapsearch -x -LLL -D uid=admin,cn=config -W -s sub -b "cn=config" "(olcDatabase=*)" '*' '+' The '+' adds the operational attributes. S. Bernard

3 4

Query filter on number of values in multi-valued attributes
by Nick Milas 19 Oct '11

19 Oct '11

A quick question: Is there a way to formulate a query filter to say: "Find all entries which include two or more values (or exactly n values) in attribute xYZ" or we must create a script to test? Thanks, Nick

2 1

syncrepl + slapd-relay + slapo-rwm some clarification needed
by Jeffrey Crawford 19 Oct '11

19 Oct '11

Hello all, We have a need to populate one of our replicas with mapped attributes long story short, using a ldap proxy to perform the mapping will not be sufficient since the attributes are being used by OpenLDAP itself. I've found that when setting up a slapd-relay to virtualize the suffix and then use rwm to perform the mapping I get the desired view. However when trying to replicate the content using a replication account things start acting weird I think mostly because syncrepl processes changes via logs and update instructions from the provider to the consumer. That being the case the syncrepl RefreshAndPersist actually changes the values from the original update instruction. Ergo the replica looking at the virtualized suffix (using relay) actually gets the attribute populated that I wanted mapped. Meaning the replica and the relay view don't agree rather the replica and the original data agree. I've found that if I use the syncrepl RefreshOnly the replica yields the desired results however that is performed on intervals so the data isn't immediately available. So Have I missed something on the RefreshAndPersist method that would also yield the desired results? Or is RefreshAndPersist always going to see the original change being made even if the underlying relay view shows the mapped attributes? Ugh the above is so complex to describe Below is an example to facilitate a quick explanation. ### Provider hdb database dn: cn=record,dc=suffix,dc=org cn: record attr1: value1 attr2: value2 attr3: value3 ### Provider relay database dn: cn=record,dc=suffix,dc=org,cn=mapped cn: record attr1: value1 attr2: value3 | | attr3: value2 | Values switched | #### { Replica Section } ##################################### ### replica from cn=mapped using RefreshAndPersist (Undesired) dn: cn=record,dc=suffix,dc=org cn: record attr1: value1 attr2: value2 attr3: value3 ### replica from cn=mapped using RefreshOnly (Desired) dn: cn=record,dc=suffix,dc=org,cn=mapped cn: record attr1: value1 attr2: value3 | | attr3: value2 | Values switched |

2 2

howto view slapd configuration : ldapsearch VS slapcat
by Olivier 19 Oct '11

19 Oct '11

Hello, I have trouble to use slapcat to browse in my slapd configuration? For example, with ldapsearch I use this to see ACL : ldapsearch -x -LLL -D uid=admin,cn=config -W -s sub -b "cn=config" "(olcDatabase=*)" olcAccess What would be the equivalent with slapcat (run with "-F /etc/openldap/slapd.d") ? Thanks --- Olivier

2 1

syncrepl provider not working after upgrade to 2.4.26
by Nick Milas 19 Oct '11

19 Oct '11

Hi, I have a syncrepl provider v2.4.22 working fine (the only provider in our organization). I upgraded with the same configuration to v2.4.26 and provider is not working (neither over ldaps: nor over ldap:). Otherwise connectivity is fine (with any ldap client) both with ldap and with ldaps. I get (in all consumers): Oct 17 21:21:32 vmail slapd[14621]: do_syncrep2: rid=111 LDAP_RES_SEARCH_RESULT Oct 17 21:21:32 vmail slapd[14621]: do_syncrep2: rid=111 LDAP_RES_SEARCH_RESULT (53) Server is unwilling to perform Oct 17 21:21:32 vmail slapd[14621]: do_syncrep2: rid=111 (53) Server is unwilling to perform Oct 17 21:21:32 vmail slapd[14621]: do_syncrepl: rid=111 rc -2 retrying How can I troubleshoot the issue further? Current config on the provider is: overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 and on consumers: syncrepl rid=111 provider=ldaps://ldap.example.com tls_reqcert=never type=refreshAndPersist retry="60 +" searchbase="dc=example,dc=com" schemachecking=off bindmethod=simple binddn="cn=someuser,dc=example,dc=com" credentials="password" Thanks, Nick

4 6

Loading LDAP schema files into cn=config
by Mark Cave-Ayland 19 Oct '11

19 Oct '11

Hi all, Having started to look at the changes required to migrate from a slapd.conf setup to a cn=config setup, one of things I'm struggling with is how to load new LDAP schemas into cn=config. I've seen the guides similar to this one here: http://blogger.ziesemer.com/2011/01/ldap-authentication-for-samba.html which suggest hacking together a temporary slapd.conf file containing just the include directives, run slaptest, and then hack the output so that it can be loaded into cn=config using ldapadd. Given that this is a quite a common task, is there no way of generating the LDIF directly to be loaded into the directory, e.g. slaptest -s /etc/ldap/schema/myschema.schema [ -n <schemanum> ] -l myschema.ldif Or then again, is this functionality already there but I just haven't managed to find it yet? I'd be grateful if someone could point me in the right direction and/or give me some hints as to the best way to manage schemas in the new regime. Many thanks, Mark. -- Mark Cave-Ayland - Senior Technical Architect PostgreSQL - PostGIS Sirius Corporation plc - control through freedom http://www.siriusit.co.uk t: +44 870 608 0063 Sirius Labs: http://www.siriusit.co.uk/labs

13 49

What's the java equivalent of ldap_set_option( NULL, LDAP_OPT_X_TLS_CACERTDIR, cert_path)?
by daisy.wu＠emc.com 19 Oct '11

19 Oct '11

Hi, OpenLDAP developers, I have been able to successfully write a simple C program using the OpenLDAP C-SDK to establish connection to Microsoft Active Directory Server over SSL. In my test program, I call ldap_set_option( NULL, LDAP_OPT_X_TLS_CACERTDIR, cert_path) to set the path to a directory where all my CA Root certificates are. OpenLDAP uses OpenSSL format of certificate management, the trusted CA Root Certificates are no longer imported into a single file (aka the certificate store). OpenSSL hashes the certificate file (.pem format), and uses symbolic link to link to the actual certificate.pem file. Here's content of my cert_path dir: wud2@pleoski:[/emc/wud2/ldap_certdb]> ls -altr total 80 -rw-r--r-- 1 wud2 dctmuser 1688 Sep 16 09:36 ldap112_rootca.pem drwxr-xr-x 2 wud2 dctmuser 1024 Sep 16 09:37 ./ lrwxrwxrwx 1 wud2 dctmuser 18 Sep 16 10:11 e8332e5a.0 -> ldap112_rootca.pem drwxr-xr-x 67 wud2 dctmuser 9216 Oct 14 14:04 ../ I am trying to write a Java LDAP client program using Novell's JLDAP to connect to Microsoft Active Directory server, over SSL. I would like to use my current cert_path (listed above) to establish LDAP SSL connection, in Java. I found an example listed on the Novell site: http://developer.novell.com/documentation/samplecode/jldap_sample/security/… // Dynamically set JSSE as a security provider Security.addProvider(new com.sun.net.ssl.internal.ssl.Provider()); // Dynamically set the property that JSSE uses to identify // the keystore that holds trusted root certificates System.setProperty("javax.net.ssl.trustStore", path); As you can see, in this Java example, the "path" value is expected to be "keystore file that holds trusted root certificates". But in my case, I only have a directory where trusted root certificates are present. I don't exactly have a single keystore file. So, my questions is, what is the Java equivalent for ldap_set_option( NULL, LDAP_OPT_X_TLS_CACERTDIR, cert_path)? Any comments/input would be much appreciated. Thanks. Daisy

5 4

SCRAM-SHA-1
by Michael Ströder 17 Oct '11

17 Oct '11

HI! I'd like to do some interop testing using SCRAM-SHA-1. But I don't know how to set the userPassword value in OpenLDAP for that. I guess I have to write my own tool... Did anybody here already play with it? Ciao, Michael.

2 1

Migrating ACLs to cn=config
by Nick Milas 17 Oct '11

17 Oct '11

Hello, I have used: slaptest -f slapd.conf -F slapd.d to migrate my slapd.conf-based config, but ACLs included in slapd.conf as: include /path/to/acl.conf where not included in the produced configuration. Instead a default(?) rule of "olcAccess: {0}to * by * none" was included. How can we migrate all rules from acl.conf automatically (it's a fairly big file - about 1000 lines). Thanks in advance, Nick

2 2

multi master no syncing.
by Sébastien Bernard 17 Oct '11

17 Oct '11

Hi, I've setup a multimaster cluster composed of two machine (in my example 192.168.0.204 and 192.168.0.197). Everything is working ok and both side are replicating ok. However, I've a problem I'd like to submit to your sagacity. When I put down a server, and modify the other server (delete or add), when the first server comes back, the modifications are not pushed in the old server. Server 1 says Entry cn=seb,ou=orgunit,o=org,dc=example,dc=com changed by peer, ignored Adding new entries works ok and synchronisation happens but for the nodes altered while one of the servers was down, the modifications are lost (or more precisely ignored by the other). My questions: Is this normal behaviour (Maybe I got the configuration wrong) ? How may I force the missing entries to be replicated to the other ? (Only solution I found is to wipe the entire database on the down server that force a replication from its peer). sincerely, Seb Here an extract of the slapd.log from server 1: Sep 22 10:12:32 dhcp204 slapd[2689]: do_syncrep2: rid=002 (-1) Can't contact LDAP server Sep 22 10:12:32 dhcp204 slapd[2689]: do_syncrepl: rid=002 rc -1 retrying (4 retries left) Sep 22 10:12:32 dhcp204 slapd[2689]: do_syncrep2: rid=004 (-1) Can't contact LDAP server Sep 22 10:12:32 dhcp204 slapd[2689]: do_syncrepl: rid=004 rc -1 retrying (4 retries left) Sep 22 10:12:32 dhcp204 slapd[2689]: conn=1002 op=2 UNBIND Sep 22 10:12:32 dhcp204 slapd[2689]: conn=1002 fd=19 closed Sep 22 10:12:32 dhcp204 slapd[2689]: conn=1003 op=2 UNBIND Sep 22 10:12:32 dhcp204 slapd[2689]: conn=1003 fd=20 closed Sep 22 10:12:37 dhcp204 slapd[2689]: slap_client_connect: URI=ldap://192.168.0.197 DN="cn=config" ldap_sasl_bind_s failed (-1) Sep 22 10:12:37 dhcp204 slapd[2689]: do_syncrepl: rid=002 rc -1 retrying (3 retries left) Sep 22 10:12:37 dhcp204 slapd[2689]: slap_client_connect: URI=ldap://192.168.0.197 DN="cn=manager,dc=example,dc=com" ldap_sasl_bind_s failed (-1) Sep 22 10:12:37 dhcp204 slapd[2689]: do_syncrepl: rid=004 rc -1 retrying (3 retries left) Sep 22 10:12:42 dhcp204 slapd[2689]: slap_client_connect: URI=ldap://192.168.0.197 DN="cn=manager,dc=example,dc=com" ldap_sasl_bind_s failed (-1) Sep 22 10:12:42 dhcp204 slapd[2689]: do_syncrepl: rid=004 rc -1 retrying (2 retries left) Sep 22 10:12:42 dhcp204 slapd[2689]: slap_client_connect: URI=ldap://192.168.0.197 DN="cn=config" ldap_sasl_bind_s failed (-1) Sep 22 10:12:42 dhcp204 slapd[2689]: do_syncrepl: rid=002 rc -1 retrying (2 retries left) Sep 22 10:12:47 dhcp204 slapd[2689]: slap_client_connect: URI=ldap://192.168.0.197 DN="cn=manager,dc=example,dc=com" ldap_sasl_bind_s failed (-1) Sep 22 10:12:47 dhcp204 slapd[2689]: do_syncrepl: rid=004 rc -1 retrying (1 retries left) Sep 22 10:12:47 dhcp204 slapd[2689]: slap_client_connect: URI=ldap://192.168.0.197 DN="cn=config" ldap_sasl_bind_s failed (-1) Sep 22 10:12:47 dhcp204 slapd[2689]: do_syncrepl: rid=002 rc -1 retrying (1 retries left) Sep 22 10:12:52 dhcp204 slapd[2689]: slap_client_connect: URI=ldap://192.168.0.197 DN="cn=config" ldap_sasl_bind_s failed (-1) Sep 22 10:12:52 dhcp204 slapd[2689]: do_syncrepl: rid=002 rc -1 retrying Sep 22 10:12:52 dhcp204 slapd[2689]: slap_client_connect: URI=ldap://192.168.0.197 DN="cn=manager,dc=example,dc=com" ldap_sasl_bind_s failed (-1) Sep 22 10:12:52 dhcp204 slapd[2689]: do_syncrepl: rid=004 rc -1 retrying Sep 22 10:12:57 dhcp204 slapd[2689]: slap_client_connect: URI=ldap://192.168.0.197 DN="cn=config" ldap_sasl_bind_s failed (-1) Sep 22 10:12:57 dhcp204 slapd[2689]: do_syncrepl: rid=002 rc -1 retrying (4 retries left) Sep 22 10:12:57 dhcp204 slapd[2689]: slap_client_connect: URI=ldap://192.168.0.197 DN="cn=manager,dc=example,dc=com" ldap_sasl_bind_s failed (-1) Sep 22 10:12:57 dhcp204 slapd[2689]: do_syncrepl: rid=004 rc -1 retrying (4 retries left) Sep 22 10:13:02 dhcp204 slapd[2689]: conn=1007 fd=13 ACCEPT from IP=192.168.0.197:55471 (IP=0.0.0.0:389) Sep 22 10:13:02 dhcp204 slapd[2689]: conn=1007 op=0 BIND dn="cn=manager,dc=example,dc=com" method=128 Sep 22 10:13:02 dhcp204 slapd[2689]: conn=1007 op=0 BIND dn="cn=manager,dc=example,dc=com" mech=SIMPLE ssf=0 Sep 22 10:13:02 dhcp204 slapd[2689]: conn=1007 op=0 RESULT tag=97 err=0 text= Sep 22 10:13:02 dhcp204 slapd[2689]: conn=1008 fd=15 ACCEPT from IP=192.168.0.197:55473 (IP=0.0.0.0:389) Sep 22 10:13:02 dhcp204 slapd[2689]: conn=1008 op=0 BIND dn="cn=config" method=128 Sep 22 10:13:02 dhcp204 slapd[2689]: conn=1008 op=0 BIND dn="cn=config" mech=SIMPLE ssf=0 Sep 22 10:13:02 dhcp204 slapd[2689]: conn=1008 op=0 RESULT tag=97 err=0 text= Sep 22 10:13:02 dhcp204 slapd[2689]: conn=1008 op=1 SRCH base="cn=config" scope=2 deref=0 filter="(objectClass=*)" Sep 22 10:13:02 dhcp204 slapd[2689]: conn=1008 op=1 SRCH attr=* + Sep 22 10:13:02 dhcp204 slapd[2689]: conn=1008 op=1 INTERM oid=1.3.6.1.4.1.4203.1.9.1.4 Sep 22 10:13:02 dhcp204 slapd[2689]: conn=1007 op=1 SRCH base="dc=example,dc=com" scope=2 deref=0 filter="(objectClass=*)" Sep 22 10:13:02 dhcp204 slapd[2689]: conn=1007 op=1 SRCH attr=* + Sep 22 10:13:02 dhcp204 slapd[2689]: srs csn 20110922081225.199039Z#000000#000#000000 Sep 22 10:13:02 dhcp204 slapd[2689]: log csn 20110922081225.199039Z#000000#000#000000 Sep 22 10:13:02 dhcp204 slapd[2689]: cmp 0, too old Sep 22 10:13:02 dhcp204 slapd[2689]: Entry cn=seb,ou=orgunit,o=org,dc=example,dc=com changed by peer, ignored Sep 22 10:13:02 dhcp204 slapd[2689]: syncprov_search_response: cookie=rid=003,csn=20110922081235.611410Z#000000#000#000000 Sep 22 10:13:02 dhcp204 slapd[2689]: conn=1007 op=1 INTERM oid=1.3.6.1.4.1.4203.1.9.1.4 Sep 22 10:17:57 dhcp204 slapd[2689]: do_syncrep2: rid=002 LDAP_RES_INTERMEDIATE - REFRESH_DELETE Sep 22 10:17:57 dhcp204 slapd[2689]: do_syncrep2: rid=004 LDAP_RES_INTERMEDIATE - REFRESH_DELET

3 4

adding monitor to cn=config on already running slapd
by Craig White 17 Oct '11

17 Oct '11

The openldap guide suggests that the configuration for dynamic configuration is yet to be written and it seems it is probably easy to get configured from the start but not intuitive enough for me to add to an already running server. (this is my consumer if that makes a difference) # cat monitor-add.ldif # Load dynamic backend modules dn: cn=module,cn=config changetype: add add: module olcModuleload: back_monitor - # http://www.openldap.org/doc/admin24/monitoringslapd.html dn: olcDatabase=monitor,cn=config #objectClass: olcDatabaseConfig changetype: add add: olcDatabase olcDatabase: {2}monitor # ./monitor-add.sh Enter LDAP Password: adding new entry "cn=module,cn=config" ldapmodify: update failed: cn=module,cn=config ldap_add: Bad parameter to an ldap routine (-9) I can't seem to find the right ldif combination to add monitor (Ubuntu Lucid / slapd 2.4.21-0ubuntu5.5) # grep ModulePath /etc/ldap/slapd.d/cn\=config/cn\=module\{0\}.ldif olcModulePath: /usr/lib/ldap -- Craig White ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ craig.white(a)ttiltd.com 1.800.869.6908 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ www.ttiassessments.com Need help communicating between generations at work to achieve your desired success? Let us help!

4 5

Re: Syncrepl SSL fail
by Hugo Deprez 17 Oct '11

17 Oct '11

Hello, tls_reqcert=never is necessary for the replication. If it is not defined, I get an error. The weird thing, is that I do have the same configuration on another host, running Debian Lenny with slapd version 2.4.23-3 and I don't have to define this parameter. The server I report the error, is running 2.4.23-7 on Squeeze. Is there any way to explain this difference ? Regards, Hugo On 17 October 2011 04:27, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Sunday, October 16, 2011 12:51 AM -0700 Howard Chu <hyc(a)symas.com> > wrote: > >> Quanah Gibson-Mount wrote: >>> >>> >>> --On October 13, 2011 10:43:55 AM -0700 Josh Miller >>> <joshua(a)itsecureadmin.com> wrote: >>> >>>> >>>> On Oct 13, 2011, at 10:29 AM, Quanah Gibson-Mount wrote: >>>>> >>>>> I don't see any of the tls_* options to the syncrepl configuration >>>>> here. Likely the syncrepl client is unable to verify the master's >>>>> cert. I would note that using refreshOnly is ill-advised. >>>> >>>> Hi Quanah, >>>> >>>> Why is RefreshOnly ill-advised? That is the recommendation in the docs >>>> (very timely as I just set this up again myself). >>>> >>>> re: http://www.openldap.org/doc/admin24/replication.html >>> >>> The admin guide has examples, not recommendations. In any case, I fully >>> intend to change those examples to be refreshAndPersist so people stop >>> defaulting to refreshOnly. It is not always reliable, and your >>> significantly delay your replication by using it. >> >> Of course, it may be the only thing that works reliably if you have a >> firewall that silently kills old connections. >> >> The examples should stand as-is. We cannot predict what environment it's >> going to be deployed in. It's up to administrators to use their brains >> and know these details of their network. > > I think at the least we should document both. Virtually everyone takes the > admin guide verbatim without comprehending what it is they are doing. Giving > them two options would hopefully at least make them have to consider why > there are multiple options. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > >

1 0

"TLS_REQCERT allow" rejects CN and hostname mismatch?
by Noël Köthe 17 Oct '11

17 Oct '11

Hello, (openldap 2.4.25 on Debian GNU/Linux) TLS_REQCERT allow is documented with "The server certificate is requested. If no certificate is provided, the session proceeds normally. If a bad certificate is provided, it will be ignored and the session proceeds normally." But if I test it it looks like the common name (CN) is checked against the hostname of the server: $ cat /etc/ldap/ldap.conf BASE dc=domain,dc=lan URI ldaps://localhost TLS_CACERT /etc/ldap/ca.crt TLS_REQCERT allow $ ldapsearch -x -d320 cn=* TLS: hostname (thinker.domain.lan) does not match common name in certificate (localhost). ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) If I change TLS_REQCERT to never the ldapsearch command works like expected. Is it correct that "TLS_REQCERT allow" checks the CN and the hostname and stops when they mismatch? I found this old ITS entry with a patch which would document my described behaviour in the manpage. http://www.openldap.org/its/index.cgi/Documentation?id=4941;selectid=4941 Is this part of "TLS_REQCERT allow" just missing in the documentation or do I have a problem to understand this correctly? thx for your answer. -- Noël Köthe <noel debian.org> Debian GNU/Linux, www.debian.org

3 2

Adding new Indexes while the directory is running
by Diego Lima 16 Oct '11

16 Oct '11

Hello all, I've recently migrated my OpenLDAP servers configurations to the online configuration (cn=config) and I have a question on how to deal with indexes. I can add a new index directive while the base is running, but should I do this? Don't I need to stop the directory and reindex the whole database when I add the new index entry? Or can I add it and postpone running slapindex to a later time? Thank you! -- Diego Lima http://www.diegolima.org

5 5

Re: Syncrepl SSL fail
by Nick Milas 15 Oct '11

15 Oct '11

On 15/10/2011 2:30 μμ, Olivier Guillard wrote: > If you youldaps:// add this : > > tls_reqcert=demand > and add starttls=critical In my installations, syncrepl doesn't work with these directives (although ldapsearch using ldaps: works fine). I wonder what may be the cause... Nick

2 1

FW: Request for Support to Create new Object Class in OpenLDAP
by Hitesh Gondalia 15 Oct '11

15 Oct '11

Dear OpenLDAP Gurus OpenLDAP Softwares:==> Openldap-2.3.11.zip We have compiled OpenLDAP in Redhat Linux Platform with Back-sql (with Oracle11g) We have one session management table in our schema and which contain the 75 columns and all of them are number, varchar and timestamp data types Whether we need any extra object class in OpenLDAP or we are able to do with existing sample objects class which is available with OpenLDAP!!!!!! Please guide for create new auxiliary class for support the extra attributes in OpenLDAP. Yours valuable suggestions and Supports will appreciate for testing the same. Thanks & Regards Hitesh Gondalia DBA | CSM Dept EliteCore Technologies Pvt. Ltd. www.elitecore.com <http://www.elitecore.com/>

1 0

Re: TLS very strange behaviour
by Rich Megginson 14 Oct '11

14 Oct '11

On 10/14/2011 01:48 AM, Olivier Guillard wrote: > Hi Rich > > as far as I remember, when I used this version : > openldap-servers-2.4.23-15.el6_1.1.x86_64 > > I could use external mecanism in syncrepl and was > able to present the client certificate without asking for > the server one. > > My syncrepl sections looked like this : > > syncrepl rid=121 > provider=ldap://ldap2.example.fr > searchbase="dc=example,dc=fr" > schemachecking=on > type=refreshOnly > interval=00:00:00:05 > retry="10 +" > bindmethod=sasl > saslmech=external > tls_cert=/etc/openldap/cacerts/syncrepl.crt > tls_key=/etc/openldap/cacerts/syncrepl.key > > And that worked. BTW, I'm not sure that his should have > worked since I think normaly the protocole indicates that > the client should check the server cert before sending its. Yes, that's odd. > Anyway that worked (-: > > With openldap-servers-2.4.23-15.el6_1.3.x86_64, I'm not > able to use the external mecanism anymore if I don't add > explicitely the following directives in syncrepl: "starttls=yes", > "tls_cacert=.../cacerts/CA.crt" and "tls_reqcert=allow/try/demand" I don't think it ever should have worked without at least specifying starttls=yes (and assuming that didn't fallback - I think starttls=yes is misleading, as it will just silently fallback to plain LDAP if it doesn't establish a TLS connection - everything will seem to be working, but unless you have set up the server to require a TLS connection, it will just work and you won't know that it is not using TLS). I recommend always using starttls=critical to make sure your client will only work if TLS was successfully established. > That works in master/slave mode, that doesn't in multimaster. > > Now last thing : I've never been able to make work syncrepl > with : "starttls=yes", "tls_cacert=.../cacerts/CA.crt" and > "tls_reqcert=allow/try/demand" in multimaster N-WAY mode > anyway (nor now, nor before). > > I only made it work in master/salve and that weither using > simple or sasl bindmethod. > > So the problem is not linked to sasl in my view but with > tls in synchrepl (may be both slapd try to use the first > TLS session opened to exchange in both direction in > multimaster, a shared variable mixing information about > certicates ? something like that). Would it be possible for you to get it working with simple binddn/password auth first, to see if that is working? Then we could at least narrow down the problem to being related to sasl/external auth. > I just realise that I had a core dump collected by abrtd (not > sure if that could help nor how to use it, I'm not familiar with > this kind of debugging) : let me know if that file could help > (or if I could try to run any gdb command using that file). Yes indeed that would be very helpful. https://bugzilla.redhat.com/show_bug.cgi?id=701678#c6 has some information about handling openldap core dumps on RHEL6 > Best, > > --- > Olivier > > On Wed, Oct 12, 2011 at 10:25 PM, Rich Megginson > <rich.megginson(a)gmail.com> wrote: >> On 10/11/2011 02:38 AM, Olivier Guillard wrote: >>> Thanks Rich, see below : >>> >>>> -12272 is SSL_ERROR_BAD_MAC_ALERT and -12273 is SSL_ERROR_BAD_MAC_READ >>>> I've seen this when the client and server do not have the same SSL >>>> certificate signature algorithm support. Is everything running on RHEL6 >>>> and/or Fedora 14 and later? >>> [root@ldap2 ~]# cat /etc/issue >>> Red Hat Enterprise Linux Server release 6.1 (Santiago) >>> Kernel \r on an \m >>> >>> [root@ldap2 ~]# rpm -qa | grep -i openldap >>> openldap-2.4.23-15.el6_1.3.x86_64 >>> openldap-servers-2.4.23-15.el6_1.3.x86_64 >>> openldap-debuginfo-2.4.23-15.el6_1.1.x86_64 >>> openldap-clients-2.4.23-15.el6_1.3.x86_64 >>> >>> [root@ldap1 ~]# cat /etc/issue >>> Red Hat Enterprise Linux Server release 6.1 (Santiago) >>> Kernel \r on an \m >>> >>> [root@ldap1 ~]# rpm -qa | grep -i openldap >>> openldap-debuginfo-2.4.23-15.el6_1.1.x86_64 >>> openldap-clients-2.4.23-15.el6_1.3.x86_64 >>> openldap-2.4.23-15.el6_1.3.x86_64 >>> openldap-servers-2.4.23-15.el6_1.3.x86_64 >>> >>> [root@ldap2 cacerts]# rpm -qa | grep openssl >>> openssl-1.0.0-10.el6_1.4.x86_64 >>> >>> [root@ldap1 ldap1]# rpm -qa | grep openssl >>> openssl-1.0.0-10.el6_1.4.x86_64 >>> >>> Not sure if that made a difference but I "yum-updated" >>> on last friday and openldap servers version passed : >>> >>> from >>> openldap-servers-2.4.23-15.el6_1.1.x86_64 >>> to >>> openldap-servers-2.4.23-15.el6_1.3.x86_64 >> Was it working before you yum updated? >>> --- >>> Olivier >>> >>> On Mon, Oct 10, 2011 at 9:54 PM, Rich Megginson >>> <rich.megginson(a)gmail.com> wrote: >>> >>>>> here is what I get : >>>>> >>>>> ldap1 # /usr/sbin/slapd -f slapd.conf -h ldap:/// -u ldap -d Sync >>>>> ... >>>>> TLS: error: accept - force handshake failure: errno 11 - moznss error >>>>> -12273 >>>>> TLS: can't accept: TLS error -12273:Unknown code ___P 15. >>>>> TLS: error: connect - force handshake failure: errno 0 - moznss error >>>>> -12272 >>>>> TLS: can't connect: TLS error -12272:Unknown code ___P 16. >>>>> slap_client_connect: URI=ldap://ldap2.example.fr Warning, >>>>> ldap_start_tls failed (-11) >>>>> slap_client_connect: URI=ldap://ldap2.example.fr >>>>> ldap_sasl_interactive_bind_s failed (-6) >>>>> do_syncrepl: rid=121 rc -6 retrying >>>>> >>>>> ldap2 # /usr/sbin/slapd -f slapd.conf -h ldap:/// -u ldap -d Sync >>>>> ... >>>>> TLS: error: connect - force handshake failure: errno 0 - moznss error >>>>> -12272 >>>>> TLS: can't connect: TLS error -12272:Unknown code ___P 16. >>>>> slap_client_connect: URI=ldap://ldap1.eaxample.fr:389 Warning, >>>>> ldap_start_tls failed (-11) >>>>> slap_client_connect: URI=ldap://ldap1.example.fr:389 >>>>> ldap_sasl_interactive_bind_s failed (-6) >>>>> do_syncrepl: rid=211 rc -6 retrying >>>>> TLS: error: accept - force handshake failure: errno 11 - moznss error >>>>> -12273 >>>>> TLS: can't accept: TLS error -12273:Unknown code ___P 15. >>>>> >>>>> Any idea ? >>

1 0

Re: Syncrepl SSL fail
by Hugo Deprez 14 Oct '11

14 Oct '11

Hello, On the provider I have the following settings : TLSCACertificateFile /etc/ssl/certs/ldap-cert.pem TLSCertificateFile /etc/ssl/certs/ldap-cert.pem TLSCertificateKeyFile /etc/ldap/ssl/ldap-key.pem but no TLSCipherSuite defined. I added the starttls=yes on the consumer : Syncrepl rid=003 provider=ldaps://ldap.mydomain.fr:1024/ type=refreshOnly retry="60 10 600 +" interval=00:00:00:10 searchbase="dc=mydomain,dc=fr" scope=sub schemachecking=on bindmethod=simple starttls=yes tls_cert=/etc/ssl/certs/ldap-cert.pem tls_cacert=/etc/ssl/certs/ldap-cert-ca.pem binddn="cn=syncrepluser,o=others,dc=mydomain,dc=fr" credentials=my_password But still the same error. Any idea ? Hugo On 14 October 2011 13:52, Olivier Guillard <olivier(a)guillard.nom.fr> wrote: > Hi, > > Have you set up the follwing appropriately : > > TLSCertificateFile > TLSCertificateKeyFile > TLSCipherSuite > > On the provider ? > > You probably also want to set this up correctly in > your syncrepl section : > > starttls=yes > tls_cacert=/path/to/certificate > > I suspect better if TLS_CACERT is also properly > set up in both ldap server slapd config. > > --- > Olivier > > On Thu, Oct 13, 2011 at 6:38 PM, Hugo Deprez <hugo.deprez(a)gmail.com> wrote: >> Dear community, >> >> I setup a syncrepl between my master openldap server and a consumer. >> >> I am trying to use SSL for this syncrepl >> I got the following error in the log when I start slapd on the consumer : >> >> Oct 13 17:04:59 server slapd[16905]: slapd starting >> Oct 13 17:04:59 server slapd[16905]: slap_client_connect: >> URI=ldaps://ldap.mydomain.fr:1024/ >> DN="cn=syncrepluser,o=others,dc=mydomain,dc=fr" ldap_sasl_bind_s >> failed (-1) >> Oct 13 17:04:59 server slapd[16905]: do_syncrepl: rid=003 rc -1 >> retrying (9 retries left) >> >> >> I don't understand why it is failing as a single ldapsearch from the >> same server with the syncrepl user is working. >> >> here is my syncrepl configuration : >> >> Syncrepl rid=003 >> provider=ldaps://ldap.mydomain.fr:1024/ >> type=refreshOnly >> retry="60 10 600 +" >> interval=00:00:00:10 >> searchbase="dc=mydomain,dc=fr" >> scope=sub >> schemachecking=on >> bindmethod=simple >> binddn="cn=syncrepluser,o=others,dc=mydomain,dc=fr" >> credentials=my_password >> >> >> Any idea ? >> >> Regards, >> >> Hugo >> >> >

3 2

Re: Syncrepl SSL fail
by Hugo Deprez 14 Oct '11

14 Oct '11

Hello, I use the following ldapsearch command : ldapsearch -H ldaps://ldap.mydomain.fr:1024 -x -W -D "cn=syncrepluser,o=others,dc=mydomain,dc=fr" I did configure TLS cert file before syncrepl configuration : TLSCACertificateFile /etc/ssl/certs/ldap-replic-cert.pem TLSCertificateFile /etc/ssl/certs/ldap-replic-cert.pem TLSCertificateKeyFile /etc/ssl/certs/ldap-replic-cert.pem But those certificate are for the ldap consumer if I'm not wrong. I am currently trying the following configuration thanks to your information : Syncrepl rid=003 provider=ldaps://ldap.mydomain.fr:1024/ type=refreshOnly retry="60 10 600 +" interval=00:00:00:10 searchbase="dc=mydomain,dc=fr" scope=sub schemachecking=on bindmethod=simple tls_cert=/etc/ssl/certs/ldap-cert.pem tls_cacert=/etc/ssl/certs/ldap-cert-ca.pem binddn="cn=syncrepluser,o=others,dc=mydomain,dc=fr" credentials=my_password where tls_cert and tls_cacert provide the cert from the master server. It seems that the replication is working but I get an other error confusing : ct 14 12:46:53 server slapd[32470]: slap_client_connect: URI=ldaps://ldap.mydomain.fr:1024/ TLS context initialization failed (-1) Oct 14 12:46:53 server slapd[32470]: do_syncrepl: rid=003 rc -1 retrying (9 retries left) Oct 14 12:47:53 server slapd[32470]: do_syncrep2: rid=003 LDAP_RES_INTERMEDIATE - SYNC_ID_SET Oct 14 12:47:53 server slapd[32470]: do_syncrep2: rid=003 LDAP_RES_INTERMEDIATE - SYNC_ID_SET Oct 14 12:47:53 server slapd[32470]: do_syncrep2: rid=003 LDAP_RES_INTERMEDIATE - SYNC_ID_SET I don't really understand the TLS context initialization failed (-1) as my replication is working ? Thanks for the tips. Hugo On 13 October 2011 19:29, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, October 13, 2011 6:38 PM +0200 Hugo Deprez > <hugo.deprez(a)gmail.com> wrote: > >> Dear community, >> >> I setup a syncrepl between my master openldap server and a consumer. >> >> I am trying to use SSL for this syncrepl >> I got the following error in the log when I start slapd on the consumer : >> >> Oct 13 17:04:59 server slapd[16905]: slapd starting >> Oct 13 17:04:59 server slapd[16905]: slap_client_connect: >> URI=ldaps://ldap.mydomain.fr:1024/ >> DN="cn=syncrepluser,o=others,dc=mydomain,dc=fr" ldap_sasl_bind_s >> failed (-1) >> Oct 13 17:04:59 server slapd[16905]: do_syncrepl: rid=003 rc -1 >> retrying (9 retries left) >> >> >> I don't understand why it is failing as a single ldapsearch from the >> same server with the syncrepl user is working. >> >> here is my syncrepl configuration : >> >> Syncrepl rid=003 >> provider=ldaps://ldap.mydomain.fr:1024/ >> type=refreshOnly >> retry="60 10 600 +" >> interval=00:00:00:10 >> searchbase="dc=mydomain,dc=fr" >> scope=sub >> schemachecking=on >> bindmethod=simple >> binddn="cn=syncrepluser,o=others,dc=mydomain,dc=fr" >> credentials=my_password >> >> >> Any idea ? > > I don't see any of the tls_* options to the syncrepl configuration here. > Likely the syncrepl client is unable to verify the master's cert. I would > note that using refreshOnly is ill-advised. > > --Quanah > > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

Re: Borked olcDatabase={1}hdb.ldif
by Jan Geep 14 Oct '11

14 Oct '11

On Thu, Oct 13, 2011 at 10:57 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > I would suggest you go and read the LDIF specification, so you can realize > this is not a bug nor a problem. Mea culpa, a rather naive question I guess, still cutting my teeth with openldap. I was aware of the line spanning, but it was I perceived as an errant space in "anonymou s" that threw me. Looks like the ldapmodify will do after all...

1 0

Borked olcDatabase={1}hdb.ldif
by Jan Geep 13 Oct '11

13 Oct '11

Somewhere along the way I've discovered that somehow my olcDatabase={1}hdb.ldif is missing "olcAccess:" for samba* entries. To fix this I wanted to update using ldapmodify and the following ldif: ----- modify.ldif ------------ dn: olcDatabase={1}hdb,cn=config changetype: modify delete: olcAccess olcAccess: {0} - add: olcAccess olcAccess: {0} to attrs=userPassword,shadowLastChange,sambaPwdMustChange,sambaLMPassword,sambaPwdLastSet,sambaNTPassword by dn="cn=admin,dc=domain,dc=tld" write by anonymous auth by self write by * none - ----- modify.ldif ------------ The "olcAccess: {0}...." contents all being on one line. (adding via: ldapmodify -x -D "cn=admin,dc=domain,dc=tld" -W -f modify.ldif) But manually looking at my current olcDatabase={1}hdb.ldif I see that somehow the current "olcAccess: {0}" entry that I want to update has been split into two lines, as follows: ----- oldAccess: {0} ------------ olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymou s auth by dn="cn=admin,dc=frontline" write by * none ----- oldAccess: {0} ------------ As this is a live system at the moment, is there any way, other than stopping slapd and manually viming olcDatabase={1}hdb.ldif to fix the split line and add the samba* entries? For what it's worth: OS: Ubuntu 11.04 OpenLDAP 2.4.23 Samba: 3.5.8 t.i.a Jan

2 1

authentication failure: bad digest-uri: doesn't match service
by Juergen.Sprenger＠swisscom.com 13 Oct '11

13 Oct '11

Hi, I am trying to authenticate an Oracle db user against OpenLDAP. Porting of schema information is ok, ssl-handshake ok, sasl-bind seems ok, SASL works: ldapwhoami -U testuser -R us.oracle.com -H ldap:/// -Y DIGEST-MD5 SASL/DIGEST-MD5 authentication started Please enter your password: SASL username: testuser SASL SSF: 128 SASL data security layer installed. dn:cn=testuser,cn=users,dc=its Trying to authenticate the oracle-client throws a 'bad digest-uri'-error assuming digest-uri="ldap:/us.oracle.com": ber_dump: buf=60b898 ptr=60b8c7 end=60b9e3 len=284 0000: 00 82 01 18 04 0a 44 49 47 45 53 54 2d 4d 44 35 ......DIGEST-MD5 0010: 04 82 01 08 64 69 67 65 73 74 2d 75 72 69 3d 22 ....digest-uri=" 0020: 6c 64 61 70 3a 2f 75 73 2e 6f 72 61 63 6c 65 2e ldap:/us.oracle. 0030: 63 6f 6d 22 2c 6d 61 78 62 75 66 3d 36 35 35 33 com",maxbuf=6553 0040: 36 2c 63 68 61 72 73 65 74 3d 75 74 66 2d 38 2c 6,charset=utf-8, 0050: 71 6f 70 3d 61 75 74 68 2c 75 73 65 72 6e 61 6d qop=auth,usernam 0060: 65 3d 22 63 6e 3d 6c 64 61 70 74 65 73 74 2c 63 e="cn=ldaptest,c 0070: 6e 3d 6f 72 61 63 6c 65 63 6f 6e 74 65 78 74 2c n=oraclecontext, 0080: 64 63 3d 69 74 73 22 2c 6e 6f 6e 63 65 3d 22 30 dc=its",nonce="0 0090: 2f 41 41 52 37 47 39 48 39 2f 44 72 34 56 36 32 /AAR7G9H9/Dr4V62 00a0: 6f 50 54 6c 45 48 75 36 56 72 6b 41 46 6f 33 52 oPTlEHu6VrkAFo3R 00b0: 66 31 56 30 6b 73 35 47 71 6f 3d 22 2c 63 6e 6f f1V0ks5Gqo=",cno 00c0: 6e 63 65 3d 22 38 35 33 32 33 35 45 30 44 39 38 nce="853235E0D98 00d0: 41 32 37 39 43 43 30 36 30 34 45 45 39 31 36 31 A279CC0604EE9161 00e0: 34 42 39 30 38 22 2c 6e 63 3d 30 30 30 30 30 30 4B908",nc=000000 00f0: 30 31 2c 72 65 73 70 6f 6e 73 65 3d 37 33 61 64 01,response=73ad 0100: 37 38 31 33 64 31 39 38 34 37 38 63 34 39 37 65 7813d198478c497e 0110: 64 66 30 63 31 36 61 36 61 32 34 36 df0c16a6a246 ber_scanf fmt (m) ber: ber_dump: buf=60b898 ptr=60b8d7 end=60b9e3 len=268 0000: 00 82 01 08 64 69 67 65 73 74 2d 75 72 69 3d 22 ....digest-uri=" 0010: 6c 64 61 70 3a 2f 75 73 2e 6f 72 61 63 6c 65 2e ldap:/us.oracle. 0020: 63 6f 6d 22 2c 6d 61 78 62 75 66 3d 36 35 35 33 com",maxbuf=6553 0030: 36 2c 63 68 61 72 73 65 74 3d 75 74 66 2d 38 2c 6,charset=utf-8, 0040: 71 6f 70 3d 61 75 74 68 2c 75 73 65 72 6e 61 6d qop=auth,usernam 0050: 65 3d 22 63 6e 3d 6c 64 61 70 74 65 73 74 2c 63 e="cn=ldaptest,c 0060: 6e 3d 6f 72 61 63 6c 65 63 6f 6e 74 65 78 74 2c n=oraclecontext, 0070: 64 63 3d 69 74 73 22 2c 6e 6f 6e 63 65 3d 22 30 dc=its",nonce="0 0080: 2f 41 41 52 37 47 39 48 39 2f 44 72 34 56 36 32 /AAR7G9H9/Dr4V62 0090: 6f 50 54 6c 45 48 75 36 56 72 6b 41 46 6f 33 52 oPTlEHu6VrkAFo3R 00a0: 66 31 56 30 6b 73 35 47 71 6f 3d 22 2c 63 6e 6f f1V0ks5Gqo=",cno 00b0: 6e 63 65 3d 22 38 35 33 32 33 35 45 30 44 39 38 nce="853235E0D98 00c0: 41 32 37 39 43 43 30 36 30 34 45 45 39 31 36 31 A279CC0604EE9161 00d0: 34 42 39 30 38 22 2c 6e 63 3d 30 30 30 30 30 30 4B908",nc=000000 00e0: 30 31 2c 72 65 73 70 6f 6e 73 65 3d 37 33 61 64 01,response=73ad 00f0: 37 38 31 33 64 31 39 38 34 37 38 63 34 39 37 65 7813d198478c497e 0100: 64 66 30 63 31 36 61 36 61 32 34 36 df0c16a6a246 ber_scanf fmt (}}) ber: ber_dump: buf=60b898 ptr=60b9e3 end=60b9e3 len=0 >>> dnPrettyNormal: <cn=ldaptest,cn=oraclecontext,dc=its> => ldap_bv2dn(cn=ldaptest,cn=oraclecontext,dc=its,0) <= ldap_bv2dn(cn=ldaptest,cn=oraclecontext,dc=its)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=ldaptest,cn=oraclecontext,dc=its)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=ldaptest,cn=oraclecontext,dc=its)=0 <<< dnPrettyNormal: <cn=ldaptest,cn=oraclecontext,dc=its>, <cn=ldaptest,cn=oraclecontext,dc=its> conn=1014 op=1 BIND dn="cn=ldaptest,cn=oraclecontext,dc=its" method=163 do_bind: dn (cn=ldaptest,cn=oraclecontext,dc=its) SASL mech DIGEST-MD5 ==> sasl_bind: dn="cn=ldaptest,cn=oraclecontext,dc=its" mech=<continuing> datalen=264 SASL [conn=1014] Debug: DIGEST-MD5 server step 2 SASL [conn=1014] Failure: bad digest-uri: doesn't match service send_ldap_result: conn=1014 op=1 p=3 send_ldap_result: err=49 matched="" text="SASL(-13): authentication failure: bad digest-uri: doesn't match service" send_ldap_response: msgid=2 tag=97 err=49 ber_flush2: 86 bytes to sd 16 0000: 30 54 02 01 02 61 4f 0a 01 31 04 00 04 48 53 41 0T...aO..1...HSA 0010: 53 4c 28 2d 31 33 29 3a 20 61 75 74 68 65 6e 74 SL(-13): authent 0020: 69 63 61 74 69 6f 6e 20 66 61 69 6c 75 72 65 3a ication failure: 0030: 20 62 61 64 20 64 69 67 65 73 74 2d 75 72 69 3a bad digest-uri: 0040: 20 64 6f 65 73 6e 27 74 20 6d 61 74 63 68 20 73 doesn't match s 0050: 65 72 76 69 63 65 ervice tls_write: want=146, written=146 0000: 17 03 00 00 18 c7 75 ac 06 20 dd 58 b7 38 55 82 ......u.. .X.8U. 0010: ab f0 ea 72 79 d0 22 ad 95 dc ab 26 d3 17 03 00 ...ry."....&.... 0020: 00 70 64 23 8e ce fc 05 73 d5 16 a2 cc 62 e4 ae .pd#....s....b.. 0030: ee 02 96 ff 16 3d 42 15 54 25 54 7b 60 6d 25 ef .....=B.T%T{`m%. 0040: e3 82 84 1f 42 ec 38 96 82 78 8c 09 b4 be 96 e5 ....B.8..x...... 0050: b9 95 01 e0 58 f3 a4 49 a0 58 53 6d 24 8e 0a 9b ....X..I.XSm$... 0060: 8b cd 4b fd cd 0e cd 51 0b e0 89 73 c6 b6 88 2f ..K....Q...s.../ 0070: 66 05 49 4a 89 0e 29 0e 53 5a 0c 0d ce 1d 8e 40 f.IJ..).SZ.....@ 0080: 90 dd 9f b2 4d b4 6e 7d 2b cf a1 ed 13 96 df 1a ....M.n}+....... 0090: 44 1c D. ldap_write: want=86, written=86 0000: 30 54 02 01 02 61 4f 0a 01 31 04 00 04 48 53 41 0T...aO..1...HSA 0010: 53 4c 28 2d 31 33 29 3a 20 61 75 74 68 65 6e 74 SL(-13): authent 0020: 69 63 61 74 69 6f 6e 20 66 61 69 6c 75 72 65 3a ication failure: 0030: 20 62 61 64 20 64 69 67 65 73 74 2d 75 72 69 3a bad digest-uri: 0040: 20 64 6f 65 73 6e 27 74 20 6d 61 74 63 68 20 73 doesn't match s 0050: 65 72 76 69 63 65 ervice conn=1014 op=1 RESULT tag=97 err=49 text=SASL(-13): authentication failure: bad digest-uri: doesn't match service <== slap_sasl_bind: rc=49 daemon: activity on 1 descriptor daemon: activity on: 16r daemon: read activity on 16 daemon: select: listen=7 active_threads=0 tvp=NULL connection_get(16) daemon: select: listen=8 active_threads=0 tvp=NULL connection_get(16): got connid=1014 daemon: select: listen=9 active_threads=0 tvp=NULL connection_read(16): checking for input on id=1014 ber_get_next daemon: select: listen=10 active_threads=0 tvp=NULL tls_read: want=5, got=5 0000: 17 03 00 00 20 .... tls_read: want=32, got=32 0000: 93 5b 37 05 07 4b dd 2b a9 1c 7e 70 db b4 8f c7 .[7..K.+..~p.... 0010: a5 f7 d7 d0 b8 e0 17 cf b9 08 dd a2 c9 df 28 7b ..............({ ldap_read: want=8, got=7 0000: 30 05 02 01 03 42 00 0....B. ber_get_next: tag 0x30 len 5 contents: ber_dump: buf=5f7de0 ptr=5f7de0 end=5f7de5 len=5 0000: 02 01 03 42 00 ...B. op tag 0x42, time 1317892029 ber_get_next tls_read: want=5, got=5 0000: 15 03 00 00 18 ..... tls_read: want=24, got=24 0000: d7 de f4 58 8a 4e fc 6b d5 6f 93 55 ee 5e 72 cd ...X.N.k.o.U.^r. 0010: 3c 8b a2 e1 ba 87 94 5a <......Z TLS trace: SSL3 alert read:warning:close notify ldap_read: want=8, got=0 ber_get_next on fd 16 failed errno=0 (Error 0) connection_read(16): input error=-2 id=1014, closing. connection_closing: readying conn=1014 sd=16 for close connection_close: deferring conn=1014 sd=16 daemon: activity on 1 descriptor conn=1014 op=2 do_unbind daemon: waked conn=1014 op=2 UNBIND daemon: select: listen=7 active_threads=0 tvp=NULL daemon: select: listen=8 active_threads=0 tvp=NULL connection_resched: attempting closing conn=1014 sd=16 connection_close: conn=1014 sd=16 daemon: select: listen=9 active_threads=0 tvp=NULL daemon: select: listen=10 active_threads=0 tvp=NULL daemon: removing 16 tls_write: want=29, written=29 0000: 15 03 00 00 18 1c 8a dd b1 bb 30 32 1b ca c2 a1 ..........02.... 0010: 2d e8 33 fc 9e 7b 6b e4 49 cf ce f2 fb -.3..{k.I.... TLS trace: SSL3 alert write:warning:close notify conn=1014 fd=16 closed On the Oracle client: SQL> connect testuser Enter password: ERROR: ORA-28043: invalid bind credentials for DB-OID connection Warning: You are no longer connected to ORACLE. SQL> Any suggestions how to make digest-uri match service? Regards Juergen

3 4

syncrepl tls_cert file not red ?
by Olivier 12 Oct '11

12 Oct '11

I now have a new issue with TLS : certificate files are even not red and presented to the server anymore. I have this on server ldap2 : syncrepl rid=211 provider=ldap://ldap1.example.fr:389 searchbase="dc=example,dc=fr" schemachecking=on type=refreshOnly interval=00:00:00:05 retry="10 +" bindmethod=sasl saslmech=external authcid="cn=replicator,ou=system,dc=example,dc=fr" authzid="dn:cn=replicator,ou=system,dc=example,dc=fr" tls_cacert=/etc/openldap/cacerts/CA.crt tls_cert=/etc/openldap/cacerts/syncrepl.crt tls_key=/etc/openldap/cacerts/syncrepl.key tls_reqcert=demand I get this as error : "ldap_sasl_interactive_bind_s failed (-6)" and if I launch slapd through strace I see that /etc/openldap/cacerts/syncrepl.crt is never opened (then never presented to the server). Note that on the server I have configured : TLSVerifyClient demand To be sure that the server ask for the certificate. What have I forgotten ? Please help me to diag where is the problem. --- Olivier P.S : I can't be absolutely affirmative since I'm under testing, but I think that worked before, and I start to beleive that update from openldap-servers-2.4.23-15.el6_1.1.x86_64 to openldap-servers-2.4.23-15.el6_1.3.x86_64 on redhat 6 produces problems.

3 4

Re: TLS very strange behaviour
by Rich Megginson 12 Oct '11

12 Oct '11

On 10/11/2011 02:38 AM, Olivier Guillard wrote: > Thanks Rich, see below : > >> -12272 is SSL_ERROR_BAD_MAC_ALERT and -12273 is SSL_ERROR_BAD_MAC_READ >> I've seen this when the client and server do not have the same SSL >> certificate signature algorithm support. Is everything running on RHEL6 >> and/or Fedora 14 and later? > [root@ldap2 ~]# cat /etc/issue > Red Hat Enterprise Linux Server release 6.1 (Santiago) > Kernel \r on an \m > > [root@ldap2 ~]# rpm -qa | grep -i openldap > openldap-2.4.23-15.el6_1.3.x86_64 > openldap-servers-2.4.23-15.el6_1.3.x86_64 > openldap-debuginfo-2.4.23-15.el6_1.1.x86_64 > openldap-clients-2.4.23-15.el6_1.3.x86_64 > > [root@ldap1 ~]# cat /etc/issue > Red Hat Enterprise Linux Server release 6.1 (Santiago) > Kernel \r on an \m > > [root@ldap1 ~]# rpm -qa | grep -i openldap > openldap-debuginfo-2.4.23-15.el6_1.1.x86_64 > openldap-clients-2.4.23-15.el6_1.3.x86_64 > openldap-2.4.23-15.el6_1.3.x86_64 > openldap-servers-2.4.23-15.el6_1.3.x86_64 > > [root@ldap2 cacerts]# rpm -qa | grep openssl > openssl-1.0.0-10.el6_1.4.x86_64 > > [root@ldap1 ldap1]# rpm -qa | grep openssl > openssl-1.0.0-10.el6_1.4.x86_64 > > Not sure if that made a difference but I "yum-updated" > on last friday and openldap servers version passed : > > from > openldap-servers-2.4.23-15.el6_1.1.x86_64 > to > openldap-servers-2.4.23-15.el6_1.3.x86_64 Was it working before you yum updated? > --- > Olivier > > On Mon, Oct 10, 2011 at 9:54 PM, Rich Megginson > <rich.megginson(a)gmail.com> wrote: > >>> here is what I get : >>> >>> ldap1 # /usr/sbin/slapd -f slapd.conf -h ldap:/// -u ldap -d Sync >>> ... >>> TLS: error: accept - force handshake failure: errno 11 - moznss error >>> -12273 >>> TLS: can't accept: TLS error -12273:Unknown code ___P 15. >>> TLS: error: connect - force handshake failure: errno 0 - moznss error >>> -12272 >>> TLS: can't connect: TLS error -12272:Unknown code ___P 16. >>> slap_client_connect: URI=ldap://ldap2.example.fr Warning, >>> ldap_start_tls failed (-11) >>> slap_client_connect: URI=ldap://ldap2.example.fr >>> ldap_sasl_interactive_bind_s failed (-6) >>> do_syncrepl: rid=121 rc -6 retrying >>> >>> ldap2 # /usr/sbin/slapd -f slapd.conf -h ldap:/// -u ldap -d Sync >>> ... >>> TLS: error: connect - force handshake failure: errno 0 - moznss error >>> -12272 >>> TLS: can't connect: TLS error -12272:Unknown code ___P 16. >>> slap_client_connect: URI=ldap://ldap1.eaxample.fr:389 Warning, >>> ldap_start_tls failed (-11) >>> slap_client_connect: URI=ldap://ldap1.example.fr:389 >>> ldap_sasl_interactive_bind_s failed (-6) >>> do_syncrepl: rid=211 rc -6 retrying >>> TLS: error: accept - force handshake failure: errno 11 - moznss error >>> -12273 >>> TLS: can't accept: TLS error -12273:Unknown code ___P 15. >>> >>> Any idea ? >>

1 0

adding module with cn=config and bdd
by Hubert Chomette 12 Oct '11

12 Oct '11

Hi folks, I'm newbie on openldap and try to add memberof overlay to my openldap configuration. I use cn=config and have a bdb database. All documentations I fund uses hdb database. I add memberof.la to module {0}. I fund that I should add too this entry: " cn=config/olcDatabase={1}hdb/olcOverlay\=\{0\}member of " What will be the equivalent using bdb frontend? Thank's for your Help,

1 0

syncrepl failing with TLS negotiation failure
by Iain Georgeson 12 Oct '11

12 Oct '11

Hello, I'm trying to get syncrepl working, using simple bind over TLS. TLS is failing with Consumer: Oct 12 17:21:53 auth-01 slapd[23241]: slap_client_connect: URI=ldap://auth-00.vis.kaust.edu.sa Error, ldap_start_tls failed (-11) Oct 12 17:21:53 auth-01 slapd[23241]: do_syncrepl: rid=000 rc -11 retrying (3 retries left) Provider: Oct 12 17:21:53 auth-00 slapd[7190]: conn=451 fd=137 ACCEPT from IP=109.171.138.17:39458 (IP=0.0.0.0:389) Oct 12 17:21:53 auth-00 slapd[7190]: conn=451 op=0 STARTTLS Oct 12 17:21:53 auth-00 slapd[7190]: conn=451 op=0 RESULT oid= err=0 text= Oct 12 17:21:53 auth-00 slapd[7190]: conn=451 fd=137 closed (TLS negotiation failure) TLS is working for other uses of the server including ldapsearch: auth-01$ ldapsearch -ZZ -x -D cn=syncrepl,dc=vis,dc=kaust,dc=edu,dc=sa -W -H ldap://auth-00.vis.kaust.edu.sa uid=iain Oct 12 17:23:58 auth-00 slapd[7190]: conn=466 fd=137 ACCEPT from IP=109.171.138.17:39460 (IP=0.0.0.0:389) Oct 12 17:23:58 auth-00 slapd[7190]: conn=466 op=0 STARTTLS Oct 12 17:23:58 auth-00 slapd[7190]: conn=466 op=0 RESULT oid= err=0 text= Oct 12 17:23:58 auth-00 slapd[7190]: conn=466 fd=137 TLS established tls_ssf=256 ssf=256 Oct 12 17:24:15 auth-00 slapd[7190]: conn=466 op=1 BIND dn="cn=syncrepl,dc=vis,dc=kaust,dc=edu,dc=sa" method=128 Oct 12 17:24:15 auth-00 slapd[7190]: conn=466 op=1 BIND dn="cn=syncrepl,dc=vis,dc=kaust,dc=edu,dc=sa" mech=SIMPLE ssf=0 Oct 12 17:24:15 auth-00 slapd[7190]: conn=466 op=1 RESULT tag=97 err=0 text= Oct 12 17:24:15 auth-00 slapd[7190]: conn=466 op=2 SRCH base="dc=vis,dc=kaust,dc=edu,dc=sa" scope=2 deref=0 filter="(uid=iain)" Oct 12 17:24:15 auth-00 slapd[7190]: conn=466 op=2 ENTRY dn="uid=iain,ou=people,dc=vis,dc=kaust,dc=edu,dc=sa" Oct 12 17:24:15 auth-00 slapd[7190]: conn=466 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text= Oct 12 17:24:15 auth-00 slapd[7190]: conn=466 op=3 UNBIND Oct 12 17:24:15 auth-00 slapd[7190]: conn=466 fd=137 closed and any number of clients are cheerfully using it through {pam,nss}_ldap and sssd. I'm not sure where to attack this from. The TLS settings should be identical. Any thoughts on how to proceed would be appreciated. consumer: $ lsb_release -a LSB Version: :core-4.0-amd64:core-4.0-noarch:graphics-4.0-amd64:graphics-4.0-noarch:printing-4.0-amd64:printing-4.0-noarch Distributor ID: Scientific Description: Scientific Linux release 6.1 (Carbon) Release: 6.1 Codename: Carbon $ rpm -q openldap-servers openldap-servers-2.4.23-15.el6.x86_64 >From slapd.conf: syncrepl rid=000 provider=ldap://auth-00.vis.kaust.edu.sa searchbase=dc=vis,dc=kaust,dc=edu,dc=sa bindmethod=simple binddn=cn=syncrepl,dc=vis,dc=kaust,dc=edu,dc=sa credentials=mysecret type=refreshOnly retry="10 3 120 5 600 +" tls_cacert=/etc/ssl/VisLabCA.pem tls_reqcert=allow starttls=critical provider: $ lsb_release -a LSB Version: :core-4.0-amd64:core-4.0-ia32:core-4.0-noarch:graphics-4.0-amd64:graphics-4.0-ia32:graphics-4.0-noarch:printing-4.0-amd64:printing-4.0-ia32:printing-4.0-noarch Distributor ID: CentOS Description: CentOS release 5.6 (Final) Release: 5.6 Codename: Final $ rpm -q openldap-servers openldap-servers-2.3.43-12.el5_5.3 Iain. -- Systems Engineer KAUST Visualisation Laboratory

1 0

Removing cn=config elements (Not at runtime)
by Jeffrey Crawford 12 Oct '11

12 Oct '11

I have seen in the list archives that using ldapmodify to remove cn=config elements while openldap is running is not supported. However I do need to be able to disable overlays in certain cases sometimes (Even if it's for testing). I tried shutting down the server and then modifying the cn=config directory area, by renaming the .ldif file to ldif.disable. That seems to work but I'm wondering if there are other caveats I should be considering when performing actions like that. One thing I did notice is that it seems like the openldap server goes ahead and re-numbers the overlays so there are no gaps. however the cn=config filesystem area did NOT renumber the files and the server behaved strangely when I tried to ldapmodify the "disabled" config back into the running system. (I got a err=32 no such object using openldap 2.4.26) Stopping the server again and then renaming the extension .disable to .ldif brought everything back to where it was. As a side note the ldif I used to create the overlay is the same I tried to use in this last step. If I disable using the above method and then renumber the files myself before restarting the server I'm able to add the the config back in using ldapmodify but it prompts the question what else should I be considering. Thanks Jeffrey

2 1

howto distribute logs in multiple files
by Olivier 12 Oct '11

12 Oct '11

Hi, is there a way to distribute various openldap loglevels in different files ? Let say, I want ACL Stats and Sync so I add: olcLogLevel: sync stats ACL Is there any way to distribute logs into files : /var/log/ldap/ldap-sync /var/log/ldap/ldap-stats /var/log/ldap/ldap-ACL Thanks, --- Olivier

3 5

Partial and Fractional Replication Details
by Jeffrey Crawford 11 Oct '11

11 Oct '11

I've been playing around with replication trying to prepare a deployment into our enterprise so I've been trying to put syncrepl through it's paces. As such I've been discovering some behaviors that may be intended but have me scratching my head a little. Since Openldap is using replication accounts and we have some pretty specific security models it's desirable to have partial and fractional replication restrictions placed on the replication account itself and the syncrepl filter simply use the default 'objectClass=*'. The "scratching my head" part shows up if I want to try to modify the permissions of the replication account to see more or less of the supplier database. There doesn't seem to be a way to get the replica to just ignore session/accesslogs and perform a comparative sync to match it's data to the view it has of the source. Process intensive I know but would only need to be done when we make those kinds of changes I then assumed since syncrepl is on the "client" side of things, it might try to re-sync if the syncrepl filter was updated. However that also didn't bring the replication accounts view of thing in sync with it's local database. even starting slapd with -c "rid=##,csn=0" didn't work. Furthermore when I took permissions away from the replication account so it could no longer see record(s), if that record was still present from it's earlier sync it would receive changes (presumibly from the accesslog delta-syncrepl access) and apply them to the replica. That means that there is no way to really restrict a replication accounts access to sensitive data if it needs read access to cn=accesslog. Does the synclog act in a simmilar manner? (I didn't seem like it but I didn't get all the details yet about how that works). If the sessionlog and accesslog are not configured then everything falls back to present and delete states which can be a lot of traffic if we have a batch job run that only changes a few attributes. however it looks like that may be the safest way to proceed. Any other ideas about what to try or to clarify my understanding of this system would be appreciated. Sorry to be so long winded but I want to make sure that I'm considering all the variables in this project since we may be stuck with it for a while ;) Thanks Jeffrey

1 0

Re: syncrepl tls_cert file not red ?
by Olivier 11 Oct '11

11 Oct '11

Thanks Quanah. I think I will wait then (-: Best --- Olivier On Tue, Oct 11, 2011 at 6:54 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, October 11, 2011 12:49 PM +0200 Olivier <ldap(a)guillard.nom.fr> > wrote: > >> mmhhh.. >> >> In summary : >> >> I manage to set up servers so that usual clients can use TLS >> to connect to the server (ldapsearch with -ZZ works) > > Rebuild your OpenLDAP against OpenSSL, or get the latest 2.4.26 and the > numerous patches to MozNSS since 2.4.26 was released, or wait until 2.4.27 > is released. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

LDAPCon MDB presentation
by Howard Chu 11 Oct '11

11 Oct '11

My paper and slides are now available here. Will upload to openldap.org site later. http://highlandsun.com/hyc/mdb/20111010LDAPCon%20MDB.pdf (paper) http://highlandsun.com/hyc/mdb/20111010LDAPCon-MDB.pdf (slides) -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Creating samba3 users with phpldapadmin
by Juan Diego Calle 11 Oct '11

11 Oct '11

Hi I have a problem with samba3 users created over phpldapadmin, the users created over phpldapadmin can log in from their windows machines. I if try to use smbclient to log I receive this NT_STATUS_PASSWORD_MUST_CHANGE if I try to change the password with smbldap-passwd I receive this Failed to modify shadowLastChange: attribute 'shadowLastChange' not allowed at /usr/sbin/smbldap-passwd line 292, <STDIN> line 2. Failed to modify shadowMax: attribute 'shadowMax' not allowed at /usr/sbin/smbldap-passwd line 299, <STDIN> line 2. So looking around it seems like the problem is that users dont have the objectClass shadowAccount. It seems that phpldapadmin doesnt use. When I add the objectClass shadow account, from windows, I manage to log on to windows the first time then It asks me to change the password, then I can log in anymore. For some reason all the users created from phpldapadmin have the uid 1000, i changed one from my test users to 6000 but i have the same results: windows users: The User name or password is incorrect. When use smbclient i have no problems listing the file. I can find any error on samba or ldap. This is the log when I try to log with the user "testuser2" 6927679-Oct 10 17:06:27 prosrvuiosmb151 slapd[13037]: <= bdb_equality_candidates: (sambaSID) not indexed 6927680-Oct 10 17:06:27 prosrvuiosmb151 slapd[13037]: conn=52 op=38 SEARCH RESULT tag=101 err=0 nentries=0 text= 6927681-Oct 10 17:06:27 prosrvuiosmb151 slapd[13037]: conn=52 op=39 SRCH base="dc=mydomain,dc=com,dc=ec" scope=2 deref=0 filter="(&(objectClass=sambaGroupMapping)(sambaSID=s-1-5-2))" 6927682-Oct 10 17:06:27 prosrvuiosmb151 slapd[13037]: conn=52 op=39 SRCH attr=gidNumber sambaSID sambaGroupType sambaSIDList description displayName cn objectClass 6927683-Oct 10 17:06:27 prosrvuiosmb151 slapd[13037]: <= bdb_equality_candidates: (sambaSID) not indexed 6927684-Oct 10 17:06:27 prosrvuiosmb151 slapd[13037]: conn=52 op=39 SEARCH RESULT tag=101 err=0 nentries=0 text= 6927685-Oct 10 17:06:27 prosrvuiosmb151 slapd[13037]: conn=52 op=40 SRCH base="dc=mydomain,dc=com,dc=ec" scope=2 deref=0 filter="(&(objectClass=sambaGroupMapping)(sambaSID=s-1-5-11))" 6927686-Oct 10 17:06:27 prosrvuiosmb151 slapd[13037]: conn=52 op=40 SRCH attr=gidNumber sambaSID sambaGroupType sambaSIDList description displayName cn objectClass 6927687-Oct 10 17:06:27 prosrvuiosmb151 slapd[13037]: <= bdb_equality_candidates: (sambaSID) not indexed 6927688-Oct 10 17:06:27 prosrvuiosmb151 slapd[13037]: conn=52 op=40 SEARCH RESULT tag=101 err=0 nentries=0 text= 6927689:Oct 10 17:06:34 prosrvuiosmb151 slapd[13037]: conn=5 op=697 SRCH base="dc=mydomain,dc=com,dc=ec" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=testuser2))" 6927690-Oct 10 17:06:34 prosrvuiosmb151 slapd[13037]: conn=5 op=697 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass 6927691-Oct 10 17:06:34 prosrvuiosmb151 slapd[13037]: conn=5 op=697 SEARCH RESULT tag=101 err=0 nentries=1 text= 6927692-Oct 10 17:06:37 prosrvuiosmb151 slapd[13037]: conn=52 op=41 SRCH base="dc=mydomain,dc=com,dc=ec" scope=2 deref=0 filter="(&(uid=administrator)(objectClass=sambaSamAccount))" 6927693-Oct 10 17:06:37 prosrvuiosmb151 slapd[13037]: conn=52 op=41 SRCH attr=uid uidNumber gidNumber homeDirectory sambaPwdLastSet sambaPwdCanChange sambaPwdMustChange sambaLogonTime sambaLogoffTime sambaKickoffTime cn sn displayName sambaHomeDrive sambaHomePath sambaLogonScript sambaProfilePath description sambaUserWorkstations sambaSID sambaPrimaryGroupSID sambaLMPassword sambaNTPassword sambaDomainName objectClass sambaAcctFlags sambaMungedDial sambaBadPasswordCount sambaBadPasswordTime sambaPasswordHistory modifyTimestamp sambaLogonHours modifyTimestamp uidNumber gidNumber homeDirectory loginShell gecos 6927694-Oct 10 17:06:37 prosrvuiosmb151 slapd[13037]: conn=52 op=41 SEARCH RESULT tag=101 err=0 nentries=1 text= 6927695-Oct 10 17:06:37 prosrvuiosmb151 slapd[13037]: conn=52 op=42 SRCH base="dc=mydomain,dc=com,dc=ec" scope=2 deref=0 filter="(&(objectClass=sambaGroupMapping)(gidNumber=0))" 6927696-Oct 10 17:06:37 prosrvuiosmb151 slapd[13037]: conn=52 op=42 SRCH attr=gidNumber sambaSID sambaGroupType sambaSIDList description displayName cn objectClass 6927697-Oct 10 17:06:37 prosrvuiosmb151 slapd[13037]: conn=52 op=42 SEARCH RESULT tag=101 err=0 nentries=0 text= 6927698-Oct 10 17:06:37 prosrvuiosmb151 slapd[13037]: conn=52 op=43 SRCH base="dc=mydomain,dc=com,dc=ec" scope=2 deref=0 filter="(&(objectClass=sambaGroupMapping)(sambaSID=s-1-5-32-545))" 6927699-Oct 10 17:06:37 prosrvuiosmb151 slapd[13037]: conn=52 op=43 SRCH attr=gidNumber sambaSID sambaGroupType sambaSIDList description displayName cn objectClass I can log with users created with smbldap-tools, Juan Diego

1 0

TLS very strange behaviour
by Olivier 10 Oct '11

10 Oct '11

Hello, I have two ldap servers, my goal is to configure them in multimaster mode with an sasl authentication based on certificates. With the following configurations, that works well : ### slapd.conf for ldap1 : syncrepl rid=121 provider=ldap://ldap2.example.fr searchbase="dc=example,dc=fr" schemachecking=on type=refreshOnly interval=00:00:00:05 retry="10 +" bindmethod=sasl saslmech=external authcid="cn=replicator,ou=system,dc=example,dc=fr" authzid="dn:cn=replicator,ou=system,dc=example,dc=fr" tls_cert=/etc/openldap/cacerts/syncrepl.crt tls_key=/etc/openldap/cacerts/syncrepl.key tls_reqcert=demand mirrormode on ### slapd.conf for ldap1 : syncrepl rid=121 provider=ldap://ldap2.example.fr searchbase="dc=example,dc=fr" schemachecking=on type=refreshOnly interval=00:00:00:05 retry="10 +" bindmethod=sasl saslmech=external authcid="cn=replicator,ou=system,dc=example,dc=fr" authzid="dn:cn=replicator,ou=system,dc=example,dc=fr" tls_cert=/etc/openldap/cacerts/syncrepl.crt tls_key=/etc/openldap/cacerts/syncrepl.key tls_reqcert=demand mirrormode on # of course I have provided the CA certificate in both files. TLSCACertificateFile /etc/openldap/cacerts/CA.crt # I also configured properly acl for "replicator" # and have issued the right certificate -> No problem, it works. Now I also have configured certificates to be able to talk with the servers on TLS : ### slapd.conf for ldap1 : TLSCertificateFile /etc/openldap/cacerts/server1.crt TLSCertificateKeyFile /etc/openldap/cacerts/server1.key TLSCipherSuite HIGH ### slapd.conf for ldap2 : TLSCertificateFile /etc/openldap/cacerts/server2.crt TLSCertificateKeyFile /etc/openldap/cacerts/server2.key TLSCipherSuite HIGH That also works perfectly ( ldapsearch with -ZZ responds properly ) I therefore decided to try to starttls for synchronisation. I added in syncrepl for ldap1 : ## ldap1 syncrepl ... starttls=yes tls_cacert=/etc/openldap/cacerts/CA.crt ... And the synchronizations worked well, TLS being started when ldap1 is client. I then added the starttls directive on server ldap2 and removed it on server ldap1 : ## ldap2 syncrepl ... starttls=yes tls_cacert=/etc/openldap/cacerts/CA.crt ... The synchronization also worked well, TLS being started this time when ldap2 is client. HERE IS THE PROBLEM : II tried to starttls in bothe syncrepl directives on both servers ldap1 and ldap2, here is what I get : ldap1 # /usr/sbin/slapd -f slapd.conf -h ldap:/// -u ldap -d Sync ... TLS: error: accept - force handshake failure: errno 11 - moznss error -12273 TLS: can't accept: TLS error -12273:Unknown code ___P 15. TLS: error: connect - force handshake failure: errno 0 - moznss error -12272 TLS: can't connect: TLS error -12272:Unknown code ___P 16. slap_client_connect: URI=ldap://ldap2.example.fr Warning, ldap_start_tls failed (-11) slap_client_connect: URI=ldap://ldap2.example.fr ldap_sasl_interactive_bind_s failed (-6) do_syncrepl: rid=121 rc -6 retrying ldap2 # /usr/sbin/slapd -f slapd.conf -h ldap:/// -u ldap -d Sync ... TLS: error: connect - force handshake failure: errno 0 - moznss error -12272 TLS: can't connect: TLS error -12272:Unknown code ___P 16. slap_client_connect: URI=ldap://ldap1.eaxample.fr:389 Warning, ldap_start_tls failed (-11) slap_client_connect: URI=ldap://ldap1.example.fr:389 ldap_sasl_interactive_bind_s failed (-6) do_syncrepl: rid=211 rc -6 retrying TLS: error: accept - force handshake failure: errno 11 - moznss error -12273 TLS: can't accept: TLS error -12273:Unknown code ___P 15. Any idea ? --- Olivier

2 1

Overlays: using search attributes
by Johan Jakus 10 Oct '11

10 Oct '11

Hello everyone, As mentioned before, I'm working on an overlay. And, I need to retrieve all the attributes send with the search request. Here is a part of my source: AttributeDescription* patt = op->oq_search.rs_attrs->an_desc; while(patt != NULL) { fprintf(fdebug, "attributes: %*s \n", (int) patt->ad_cname.bv_len, patt->ad_cname.bv_val); patt = patt->ad_next; } This only writes the name of the first attribute to the "fdebug" file. And the "patt->ad_next" is NULL (even when I've lots of attributes in my request). I tried using the AttributeName with the "an_name", but in the AttibuteName structure there is no pointer to the next AttibuteName. I could realy use some help! Thanks! Johan Jakus

2 1

State of the relay backend and rwm overlay, is it safe?
by Jeffrey Crawford 09 Oct '11

09 Oct '11

Hello, I'm sorry if this is answered somewhere already but I haven't found it. In short we need to re-map some attributes for specific replication schenerios where the replica actually records the data that we've mapped on the master server. Everything works as needed however I did notice that both relay and rwm have been tagged as experimental. This would be used in a production environment so I'm trying to get a sense if I can offer to use these features in our architechture. Or if these backends/overlays are not considered safe to use. I'm using openldap 2.4.26 Thanks Jeffrey

4 4

Re: Patching openldap?
by Christian Manal 09 Oct '11

09 Oct '11

Am 07.10.2011 23:58, schrieb NetNinja: > Ok that's good to know. > I was reading in the book "Solaris 10 System Administration Essential" > and it says on pg 365 that the openldap server needs to be patched so > that the ldapclient init utility will configure properly. > > Do you happen to remeber how you setup the Solaris Native client? This > my current issue, I installed openldap on a RHEL 5.5 server and have all > the Linux servers working with the ldap server but the Solaris servers > won't let me login as a ldap user. I can do a ldapsearch, id, getent and > get info on ldap users. I am in the process of troubleshooting the issue > and I'm not sure what I'm doing wrong? My setup is very basic, no TLS, > uatomount or replication. I will add these later when I know what i'm doing. > > Anyway thanks for your help. If you have any advice on ldapclient setup > let me know. > > On Fri, Oct 7, 2011 at 3:41 PM, Christian Manal > <moenoel(a)informatik.uni-bremen.de > <mailto:moenoel@informatik.uni-bremen.de>> wrote: > > Am 07.10.2011 20:25, schrieb NetNinja: > > Hello, > > I have been reading up on OpenLDAP. I have installed it on RHEL > 5.5 but > > I have seen documention saying that openldap needs to be patched > to work > > with Solaris. Can someone tell me if this still the case and if so > where > > to get the patch. If not any info you can provide wold be great. > > > > Thanks > > > > > > Hi, > > I've been running OpenLDAP on Solaris 10 for years now. It works out of > the tarball, no patches needed. > > > Regards, > Christian Manal > > > > > Here's an example of an ldapclient invocation that works for me: ldapclient manual \ -a authenticationMethod="tls:simple" \ -a credentialLevel="proxy" \ -a defaultSearchBase="dc=example,dc=org" \ -a defaultSearchScope="sub" \ -a defaultServerList="ldap1.example.org,ldap2.example.org" \ -a domainName="example.org" \ -a preferredServerList="ldap1.example.org,ldap2.example.org" \ -a serviceSearchDescriptor="passwd:ou=People,dc=example,dc=org" \ -a serviceSearchDescriptor="group:ou=Group,dc=example,dc=org" \ -a serviceSearchDescriptor="netgroup:ou=Netgroup,dc=example,dc=org" \ -a serviceSearchDescriptor="auto_home:ou=auto_home,ou=Mounts,dc=example,dc=org" \ -a attributeMap="auto_home:automountMapName=ou" \ -a attributeMap="auto_home:automountKey=cn" \ -a proxyDN="uid=proxyauth,ou=people,dc=example,dc=org" \ -a proxyPassword="foobar" Before you invoke that, you need to modify /etc/nsswitch.ldap to your needs (ldapclient will copy that to /etc/nsswitch.conf). You also need to put your TLS certs into /var/ldap in NSS format (you can generate/convert them with certutil[1]) and edit /etc/pam.conf for LDAP authentication. Regards, Christian Manal [1] http://www.mozilla.org/projects/security/pki/nss/tools/certutil.html

2 2

Re: Patching openldap?
by NetNinja 09 Oct '11

09 Oct '11

On Fri, Oct 7, 2011 at 5:47 PM, NetNinja <2bitninja(a)gmail.com> wrote: > > I'm sorry about that. I was reading in the book "Solaris 10 System Administration Essential" and it says on pg 365 that the openldap server needs to be patched so that the ldapclient init utility will configure properly. Most stuff I have read say I need to add these two schemas, solaris and DUAConfigProfile. > > Anyway I'm having issues getting the Solaris servers to work right with the openldap server I installed on a RHEL 5.5 box. The servers can see the data when I do a search and a Id but I can't login with the ldap accouts. > > Thanks for reading my email. > > On Fri, Oct 7, 2011 at 3:31 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: >> >> --On Friday, October 07, 2011 2:25 PM -0400 NetNinja <2bitninja(a)gmail.com> wrote: >> >>> Hello, >>> I have been reading up on OpenLDAP. I have installed it on RHEL 5.5 but I >>> have seen documention saying that openldap needs to be patched to work >>> with Solaris. Can someone tell me if this still the case and if so where >>> to get the patch. If not any info you can provide wold be great. >> >> Your question is so vague as to be unanswerable. OpenLDAP compiles and runs just fine on Solaris. If you are asking something other than that, than you need to provide more details than vague "I read something somewhere" comments. >> >> --Quanah >> >> -- >> >> Quanah Gibson-Mount >> Sr. Member of Technical Staff >> Zimbra, Inc >> A Division of VMware, Inc. >> -------------------- >> Zimbra :: the leader in open source messaging and collaboration > > > >

3 3

Best way to set up TLS certificates when using syncrepl?
by Bob Fitch 09 Oct '11

09 Oct '11

Hi, I'm trying to figure out the best way to create certificates for LDAPS on servers that replicate to each other. I'm not huge on PKI knowledge, so I'm not exactly sure if what I have is correct. I have two openldap servers that essentially look like this: serverA (provider) ----> serverB (consumer) serverA, serverB and all clients have "URI ldaps://serverA ldaps://serverB" in ldap.conf. I'm trying to make sure all clients can query both serverA and serverB via LDAPS - without extensive re-configuration of ldap.conf should serverA fail. In otherwords, I want the clients to just work, so it doesn't distract the Admin's from fixing serverA. I figured the best way to do this would be to create a single private key on serverA, and from that create certificates for serverA, serverB and any other client. serverB get's a copy of the single private key, just in case. serverA: olcTLSCACertificateFile: /path/to/certificate-authority.crt olcTLSCertificateKeyFile: /path/to/shared-key.key olcTLSCertificateFile: /path/to/serverA-certificate.crt ldap.conf: TLS_CACERT /path/to/certificate-authority.crt serverB: olcTLSCACertificateFile: /path/to/certificate-authority.crt olcTLSCertificateKeyFile: /path/to/shared-key.key olcTLSCertificateFile: /path/to/serverB-certificate.crt ldap.conf: TLS_CACERT /path/to/certificate-authority.crt Does this look correct, given that syncrepl needs to occur between serverA+serverB during normal operation, but LDAPS needs to function correctly between serverB+clients when serverA has failed? Thanks in advance, Bob.

1 0

Overlay memberof does not work with groupOfUniqueNames
by JOSE L MARTINEZ-AVIAL 08 Oct '11

08 Oct '11

Hi, I've an openldap 2.4.23 over RHEL4. I compilled it with the option to use overlay memberof, and it's been working well so far when I created groupOfNames. The issue is that I need to switch to groupOfUniqueNames instead of groupOfNames. When I do that, it seems that the overlay does not work, so I don't receive any group at all when I do a search returning memberof. Is it possible to setup the overlay to do that? Thank you Jose Luis

3 5

ldapbin : Invalid DN Syntax (34)
by Joseph vasanth 07 Oct '11

07 Oct '11

Hi, I am a newbie on openldap. I have just installed openldap on FC11. I am facing issues when i try to bind. When i do an ldapsearch it throws the ldapbin : Invalid DN Syntax (34) error. I have the following information slapd.conf # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include/etc/openldap/schema/corba.schema include/etc/openldap/schema/core.schema include/etc/openldap/schema/cosine.schema include/etc/openldap/schema/duaconf.schema include/etc/openldap/schema/dyngroup.schema include/etc/openldap/schema/inetorgperson.schema include/etc/openldap/schema/java.schema include/etc/openldap/schema/misc.schema include/etc/openldap/schema/nis.schema include/etc/openldap/schema/openldap.schema include/etc/openldap/schema/ppolicy.schema include/etc/openldap/schema/collective.schema # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referralldap://root.openldap.org pidfile/var/run/openldap/slapd.pid argsfile/var/run/openldap/slapd.args # Load dynamic backend modules: # modulepath/usr/lib/openldap # or /usr/lib64/openldap # moduleload accesslog.la # moduleload auditlog.la # moduleload back_sql.la # moduleload denyop.la # moduleload dyngroup.la # moduleload dynlist.la # moduleload lastmod.la # moduleload pcache.la # moduleload ppolicy.la # moduleload refint.la # moduleload retcode.la # moduleload rwm.la # moduleload syncprov.la # moduleload translucent.la # moduleload unique.la # moduleload valsort.la # The next three lines allow use of TLS for encrypting connections using a # dummy test certificate which you can generate by changing to # /etc/pki/tls/certs, running "make slapd.pem", and fixing permissions on # slapd.pem so that the ldap user or group can read it. Your client software # may balk at self-signed certificates, however. # TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt # TLSCertificateFile /etc/pki/tls/certs/slapd.pem # TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem # Sample security restrictions #Require integrity protection (prevent hijacking) #Require 112-bit (3DES or better) encryption for updates #Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: #Root DSE: allow anyone to read it #Subschema (sub)entry DSE: allow anyone to read it #Other DSEs: #Allow self write access #Allow authenticated users read access #Allow anonymous users to authenticate #Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * #by self write #by users read #by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # ldbm and/or bdb database definitions ####################################################################### databasebdb suffix"dc=primecorp,dc=com" checkpoint1024 15 rootdn"cn=Manager,dc=primecorp,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpwpassword rootpw{MD5}X03MO1qnZdYdgyfeuILPmQ== # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory/var/lib/ldap # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub # Replicas of this database #replogfile /var/lib/ldap/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com(a)EXAMPLE.COM # enable monitoring database monitor access to attrs=userPassword by self write by dn="cn=Manager,dc=primecorp,dc=com" write by anonymous auth by * none # allow onlu rootdn to read the monitor access to * by dn="cn=Manager,dc=primecorp,dc=com" write by self write by * read /etc/ldap.conf # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. #BASEdc=example,dc=com #URIldap://ldap.example.com ldap://ldap-master.example.com:666 #SIZELIMIT12 #TIMELIMIT15 #DEREFnever URI ldap://127.0.0.1/ BASE dc=primecorp,dc=com TLS_CACERTDIR /etc/openldap/cacerts /etc/opnldap/ldap.conf # @(#)$Id: ldap.conf,v 1.38 2006/05/15 08:13:31 lukeh Exp $ # # This is the configuration file for the LDAP nameservice # switch library and the LDAP PAM module. # # The man pages for this file are nss_ldap(5) and pam_ldap(5) # # PADL Software # http://www.padl.com # # Your LDAP server. Must be resolvable without using LDAP. # Multiple hosts may be specified, each separated by a # space. How long nss_ldap takes to failover depends on # whether your LDAP client library supports configurable # network or connect timeouts (see bind_timelimit). #host 127.0.0.1 # The distinguished name of the search base. base dc=primecorp,dc=com # Another way to specify your LDAP server is to provide an # uri with the server name. This allows to use # Unix Domain Sockets to connect to a local LDAP Server. #uri ldap://127.0.0.1/ #uri ldaps://127.0.0.1/ #uri ldapi://%2fvar%2frun%2fldapi_sock/ # Note: %2f encodes the '/' used as directory separator # The LDAP version to use (defaults to 3 # if supported by client library) #ldap_version 3 # The distinguished name to bind to the server with. # Optional: default is to bind anonymously. #binddn cn=proxyuser,dc=example,dc=com # The credentials to bind with. # Optional: default is no credential. #bindpw secret # The distinguished name to bind to the server with # if the effective user ID is root. Password is # stored in /etc/ldap.secret (mode 600) #rootbinddn cn=manager,dc=example,dc=com # The port. # Optional: default is 389. #port 389 # The search scope. #scope sub #scope one #scope base # Search timelimit #timelimit 30 timelimit 120 # Bind/connect timelimit #bind_timelimit 30 bind_timelimit 120 # Reconnect policy: hard (default) will retry connecting to # the software with exponential backoff, soft will fail # immediately. #bind_policy hard # Idle timelimit; client will close connections # (nss_ldap only) if the server has not been contacted # for the number of seconds specified below. #idle_timelimit 3600 idle_timelimit 3600 # Filter to AND with uid=%s #pam_filter objectclass=account # The user ID attribute (defaults to uid) #pam_login_attribute uid # Search the root DSE for the password policy (works # with Netscape Directory Server) #pam_lookup_policy yes # Check the 'host' attribute for access control # Default is no; if set to yes, and user has no # value for the host attribute, and pam_ldap is # configured for account management (authorization) # then the user will not be allowed to login. #pam_check_host_attr yes # Check the 'authorizedService' attribute for access # control # Default is no; if set to yes, and the user has no # value for the authorizedService attribute, and # pam_ldap is configured for account management # (authorization) then the user will not be allowed # to login. #pam_check_service_attr yes # Group to enforce membership of #pam_groupdn cn=PAM,ou=Groups,dc=example,dc=com # Group member attribute #pam_member_attribute uniquemember # Specify a minium or maximum UID number allowed #pam_min_uid 0 #pam_max_uid 0 # Template login attribute, default template user # (can be overriden by value of former attribute # in user's entry) #pam_login_attribute userPrincipalName #pam_template_login_attribute uid #pam_template_login nobody # HEADS UP: the pam_crypt, pam_nds_passwd, # and pam_ad_passwd options are no # longer supported. # # Do not hash the password at all; presume # the directory server will do it, if # necessary. This is the default. #pam_password clear # Hash password locally; required for University of # Michigan LDAP server, and works with Netscape # Directory Server if you're using the UNIX-Crypt # hash mechanism and not using the NT Synchronization # service. #pam_password crypt # Remove old password first, then update in # cleartext. Necessary for use with Novell # Directory Services (NDS) #pam_password clear_remove_old #pam_password nds # RACF is an alias for the above. For use with # IBM RACF #pam_password racf # Update Active Directory password, by # creating Unicode password and updating # unicodePwd attribute. #pam_password ad # Use the OpenLDAP password change # extended operation to update the password. #pam_password exop # Redirect users to a URL or somesuch on password # changes. #pam_password_prohibit_message Please visit http://internal to change your password. # RFC2307bis naming contexts # Syntax: # nss_base_XXXbase?scope?filter # where scope is {base,one,sub} # and filter is a filter to be &'d with the # default filter. # You can omit the suffix eg: # nss_base_passwdou=People, # to append the default base DN but this # may incur a small performance impact. #nss_base_passwdou=People,dc=example,dc=com?one #nss_base_shadowou=People,dc=example,dc=com?one #nss_base_groupou=Group,dc=example,dc=com?one #nss_base_hostsou=Hosts,dc=example,dc=com?one #nss_base_servicesou=Services,dc=example,dc=com?one #nss_base_networksou=Networks,dc=example,dc=com?one #nss_base_protocolsou=Protocols,dc=example,dc=com?one #nss_base_rpcou=Rpc,dc=example,dc=com?one #nss_base_ethersou=Ethers,dc=example,dc=com?one #nss_base_netmasksou=Networks,dc=example,dc=com?ne #nss_base_bootparamsou=Ethers,dc=example,dc=com?one #nss_base_aliasesou=Aliases,dc=example,dc=com?one #nss_base_netgroupou=Netgroup,dc=example,dc=com?one # Just assume that there are no supplemental groups for these named users nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman,nscd,gdm,polkituser # attribute/objectclass mapping # Syntax: #nss_map_attributerfc2307attributemapped_attribute #nss_map_objectclassrfc2307objectclassmapped_objectclass # configure --enable-nds is no longer supported. # NDS mappings #nss_map_attribute uniqueMember member # Services for UNIX 3.5 mappings #nss_map_objectclass posixAccount User #nss_map_objectclass shadowAccount User #nss_map_attribute uid msSFU30Name #nss_map_attribute uniqueMember msSFU30PosixMember #nss_map_attribute userPassword msSFU30Password #nss_map_attribute homeDirectory msSFU30HomeDirectory #nss_map_attribute homeDirectory msSFUHomeDirectory #nss_map_objectclass posixGroup Group #pam_login_attribute msSFU30Name #pam_filter objectclass=User #pam_password ad # configure --enable-mssfu-schema is no longer supported. # Services for UNIX 2.0 mappings #nss_map_objectclass posixAccount User #nss_map_objectclass shadowAccount user #nss_map_attribute uid msSFUName #nss_map_attribute uniqueMember posixMember #nss_map_attribute userPassword msSFUPassword #nss_map_attribute homeDirectory msSFUHomeDirectory #nss_map_attribute shadowLastChange pwdLastSet #nss_map_objectclass posixGroup Group #nss_map_attribute cn msSFUName #pam_login_attribute msSFUName #pam_filter objectclass=User #pam_password ad # RFC 2307 (AD) mappings #nss_map_objectclass posixAccount user #nss_map_objectclass shadowAccount user #nss_map_attribute uid sAMAccountName #nss_map_attribute homeDirectory unixHomeDirectory #nss_map_attribute shadowLastChange pwdLastSet #nss_map_objectclass posixGroup group #nss_map_attribute uniqueMember member #pam_login_attribute sAMAccountName #pam_filter objectclass=User #pam_password ad # configure --enable-authpassword is no longer supported # AuthPassword mappings #nss_map_attribute userPassword authPassword # AIX SecureWay mappings #nss_map_objectclass posixAccount aixAccount #nss_base_passwd ou=aixaccount,?one #nss_map_attribute uid userName #nss_map_attribute gidNumber gid #nss_map_attribute uidNumber uid #nss_map_attribute userPassword passwordChar #nss_map_objectclass posixGroup aixAccessGroup #nss_base_group ou=aixgroup,?one #nss_map_attribute cn groupName #nss_map_attribute uniqueMember member #pam_login_attribute userName #pam_filter objectclass=aixAccount #pam_password clear # Netscape SDK LDAPS #ssl on # Netscape SDK SSL options #sslpath /etc/ssl/certs # OpenLDAP SSL mechanism # start_tls mechanism uses the normal LDAP port, LDAPS typically 636 #ssl start_tls #ssl on # OpenLDAP SSL options # Require and verify server certificate (yes/no) # Default is to use libldap's default behavior, which can be configured in # /etc/openldap/ldap.conf using the TLS_REQCERT setting. The default for # OpenLDAP 2.0 and earlier is "no", for 2.1 and later is "yes". #tls_checkpeer yes # CA certificates for server certificate verification # At least one of these are required if tls_checkpeer is "yes" #tls_cacertfile /etc/ssl/ca.cert #tls_cacertdir /etc/ssl/certs # Seed the PRNG if /dev/urandom is not provided #tls_randfile /var/run/egd-pool # SSL cipher suite # See man ciphers for syntax #tls_ciphers TLSv1 # Client certificate and key # Use these, if your server requires client authentication. #tls_cert #tls_key # Disable SASL security layers. This is needed for AD. #sasl_secprops maxssf=0 # Override the default Kerberos ticket cache location. #krb5_ccname FILE:/etc/.ldapcache # SASL mechanism for PAM authentication - use is experimental # at present and does not support password policy control #pam_sasl_mech DIGEST-MD5 uri ldap://127.0.0.1/ ssl no tls_cacertdir /etc/openldap/cacerts pam_password md5 base.ldif # create new dn: dc=primecorp,dc=com objectClass: dcObject objectClass: organization o: primecorp Organization dc: primecorp dn: cn=Manager,dc=primecorp,dc=com objectClass: organizationalRole cn: manager dn: ou=People,dc=primecorp,dc=com objectClass: organizationalUnit ou: People dn: ou=Group,dc=primecorp,dc=com objectClass: organizationalUnit ou: Group ldapsearch -x -h 10.127.1.146 -b "dc=primecorp,dc=com" -D 'admin(a)primecorp.com' -W "cn=admin" Enter LDAP Password: ldap_bind: Invalid DN syntax (34) additional info: invalid DN I have installed and the installation went fine. but ldapsearch keeps giving the same error i also tried other combinations on the dn like adding a ou=Peopledc=primecorp,dc=com, many other combinations but i stll kept hitting the same error or "invalid credentials". I completley stuck as to whether i am putting the correct information.I am not able to see what is exactly wrong with the config. I am using Fedora Core 11 by the way. If someone could please help me with this i would be so appreciative, LDAP looks so easy to set up yet there is something probably so small preventing it being set up correctly. if you need any more information on this just ask me. Regards Joseph

3 2

bind using CN instead of UID
by Craig White 07 Oct '11

07 Oct '11

Obviously there is something that I don't understand because I would expect to be able to bind using CN as well as UID attribute... version: 2.4.21-0ubuntu5.5 ***** this as you can see works ***** # ldapsearch -x -D 'uid=cwhite,ou=people,dc=ttinet,dc=local' -W '(uid=cwhite)' uid, cn Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=ttinet,dc=local> (default) with scope subtree # filter: (uid=cwhite) # requesting: uid, cn # # cwhite, people, ttinet.local dn: uid=cwhite,ou=people,dc=ttinet,dc=local cn: Craig White # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 ***** same as above but using cn instead of uid ***** # ldapsearch -x -D 'cn=Craig White,ou=people,dc=ttinet,dc=local' -W '(uid=cwhite)' uid, cn Enter LDAP Password: ldap_bind: Invalid credentials (49) I have to believe that if this is an ACL issue, then the very first rule is the problem... olcAccess: {0}to attrs=userPassword,shadowLastChange by dn.exact="uid=administ rator,ou=people,dc=ttinet,dc=local" write by self write by anonymous auth by * none What is it that I am missing? -- Craig White ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ craig.white(a)ttiltd.com 1.800.869.6908 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ www.ttiassessments.com Need help communicating between generations at work to achieve your desired success? Let us help!

4 4

Patching openldap?
by NetNinja 07 Oct '11

07 Oct '11

Hello, I have been reading up on OpenLDAP. I have installed it on RHEL 5.5 but I have seen documention saying that openldap needs to be patched to work with Solaris. Can someone tell me if this still the case and if so where to get the patch. If not any info you can provide wold be great. Thanks

4 3

Re: Ldap logs accounting
by Hugo Deprez 07 Oct '11

07 Oct '11

Hello, thank you that was exactly what I was looking for. Does anyone know a software such as a web interface, which will be able to read the data from the accesslog base and display them in a more friendly way ? Regards, Hugo On 6 October 2011 04:55, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Wednesday, October 05, 2011 11:41 AM +0200 Hugo Deprez > <hugo.deprez(a)gmail.com> wrote: > >> Dear community, >> >> I am currently using openldap 2.4.23-3 on Debian Lenny. I need to be >> able to log all the change made on the directory. >> For exemple if a account is delete I would like to log who did it and >> at what time. >> I want to do some accounting. >> >> Do you know how I could do that ? I didn't found anything on google. > > man slapo-accesslog > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

3 4

Re: Unable to create home directory (LDAP Authentication)
by vijay s sheelavantar 07 Oct '11

07 Oct '11

Hi,I am sorry for the inconvenience caused due to the unreadable format. On fedora I don't have this file. /etc/pam.d/common-session. Below logs for your reference. in the log file /var/log/messages i found the following error Oct  6 13:37:56 localhost setroubleshoot: SELinux is preventing sshd (sshd_t) "write" to ./home (home_root_t). For complete SELinux messages. run sealert -l ecdf3def-df6e-4d5b-851b-4e9bf155e57d and in the log file /var/log/secure below error found. Oct  6 15:14:04 localhost sshd[3844]: pam_unix(sshd:session): session closed for user kimOct  6 15:14:07 localhost sshd[3900]: Accepted password for kim from 10.254.194.148 port 57079 ssh2Oct  6 15:14:07 localhost sshd[3900]: pam_mkhomedir(sshd:session): unable to create directory /home/kim: Permission deniedOct  6 15:14:07 localhost sshd[3900]: pam_unix(sshd:session): session opened for user kim by (uid=0)Oct  6 15:14:07 localhost sshd[3900]: error: ssh_selinux_setup_pty: security_compute_relabel: Invalid argument please help me to find a solution. Warm Regards,Vijay S.

2 1

Not getting Password expiry message
by pradyumna dash 07 Oct '11

07 Oct '11

Hi, I have setted up ppolicy schema for password handling, its working fine except am not getting the password expiry message. Is it a known issue or am doing something wrong. am using OpenLDAP 2.4 on SLES 11 SP1 Please suggest. Regards, Neo

3 3

LDAP + Winbind + Windows Domain
by Dana, Eric 06 Oct '11

06 Oct '11

I have a Linux server configured as a domain member of a Windows domain using Winbind. I want to use the server to: 1. Maintain GID/UID definitions for Linux <-> Windows domain mapping. 2. Serve Linux file shares. 3. Handle LDAP requests for id mappings (see #1) and LDAP information from the master LDAP server (Windows domain controller). 4. Authenticate users using the password on the Windows DC. I'm trying to find the best way to setup LDAP on the Linux server to handle issues #1 and #3. Issues #4 is working using Winbind. I cannot change/add configuration/program on the Windows LDAP (DC) server. This LDAP server would primarily be used by other Linux machines. I've seen suggestions using proxy and/or referrals, would like some more clarity on the best approach. Thanks. Eric Dana

1 0

OATH HOTP authentication with OpenLDAP
by Dimitri 06 Oct '11

06 Oct '11

Hi, For a long time our company has been planning to implement one-time password authentication as a LDAP SIMPLE auth mechanism. The goal behind that is to enable unified OTP authentication for a wide range of server applications that are capable of LDAP SIMPLE auth. The list of most important applications includes (but is not limited too): a Dovecot IMAP + RoundCube tandem; third-party JavaEE applications, like Atlassian Confluence and JIRA; in-house web-applications; etc. OATH HOTP [1] has been chosen as the actual OTP mechanism, due to its openness and wide availability of cheap hardware HOTP-compliant tokens, as well as software "tokens" for mobile phones. Implementing OTP on a LDAP server side will not only provide unified OTP auth, but also will allow to centralize authentication-related information (user database + token database) and will let us benefit from OpenLDAP out-of-the box features like replication. Right now we are entering the actual implementation phase, and I will be very glad to hear general architectural considerations as well as answers to my questions that already arose. 1. We have chosen to use SLAPI, not overlay API, to make our authentication plugin portable to other LDAP servers; but still our main target is OpenLDAP and we're not going to migrate to any other LDAP server (but our clients might). In terms of SLAPI, this will be a "preoperation bind plugin". If somebody thinks our choice is awfully bad, please don't hesitate to share your considerations. 2. Another reason for choosing SLAPI was much clearer API and, most importantly, availability of simple, synchronous functions for performing internal operations (searches, modifications). It seemed to me that overlay API provides only complex, callback-based functions for internal operations. Please let me know if I've overlooked that in the documentation (or, better say, source code, since overlay API is actually undocumented, opposite to SLAPI [2]). 3. Current state of SLAPI support in OpenLDAP completely lacks functions like slapi_is_root_suffix(), slapi_dn_isroot(), as well as the whole slapi_be_* function family. This makes impossible to determine root DN for authenticating principal. If we decide to actually implement those functions, what is the preferred way to submit the code to mainstream? To open an ITS issue and attach a patch to it? 4. For SLAPI plugins, is there a preferred way of obtaining plugin configuration, other than parsing ARGV? I know that in RedHat Directory server plugins often use their corresponding cn=plugins,cn=config entries to store config, but what about OpenLDAP? 5. HOTP algorithm uses SHA1 cryptographic hash. We clearly understand that if using SLAPI we won't be able to use OpenLDAP SHA1 implementation available via lutil_sha1.h. In order not to implement SHA1 ourselves, is it okay to introduce a dependency on OpenSSL/GnuTLS/NSS? For example, two RedHat plugins from their distribution (namely "http" and "pwdstorage" [3]) do use NSS and hence include ssl.h. 6. We decided to store token information in its dedicated subtree, like "ou=Tokens,dc=example,dc=com" (configurable). Each token will have its own entry that will store its serial number, seed, counter, PIN and its current owner (a single DN of user that this token has been assigned to), thus introducing a many-to-one relationship between tokens and users. Entries with absent "owner" attribute will form a pool of tokens available for assignment. Token synchronization (computing actual counter value from two successive passwords) will be implemented as an extended operation. A preliminary version of schema is available and we can publish it right now for review. Again, if there are any considerations and/or critical remarks, don't hesitate to share them. That's all for the first post; I beg my pardon for a long and verbose text. We will be very thankful for any feedback on the topic. Thanks! Dimitri CargoSoft LLC, Russia [1] OATH HOTP: http://tools.ietf.org/html/rfc4226 [2] RedHat Directory Server Plugin Guide: http://docs.redhat.com/docs/en-US/Red_Hat_Directory_Server/8.2/html/Plug-in… [3] http://git.fedorahosted.org/git/?p=389/ds.git;a=tree;f=ldap/servers/plugins…

3 2

Installation Problem with BDB 4.8
by Rajeshwar Bharathi 06 Oct '11

06 Oct '11

All, I am trying to install Open LDAP 2.4.23 with Berkley DB v4.8. I am getting errors with the BDB version etc My Server is a: *CentOS release 5.6 (Final)* *2.6.18-238.19.1.el5 x86_64 GNU/Linux* The system already has older versions od BDB installed already on it. [root@myserver]# rpm -qa|grep db4 db4-4.3.29-10.el5_5.2 db4-4.3.29-10.el5_5.2 db4-devel-4.3.29-10.el5_5.2 db4-devel-4.3.29-10.el5_5.2 To use the newly installed/supported BDB 4.8 version I use the environment flags with my consfigure and make commands Step 1: $env CPPFLAGS="-I/usr/local/BerkeleyDB.4.8/include/"LDFLAGS="-L/usr/local/BerkeleyDB.4.8/lib" ./configure Step 2: $make depend Step 3: $make Step 1-3 goes thru fine At Step 4: when I run make install $make install I get the fol erros towards the end. make[3]: Entering directory `/u001/projects/cyrusIMAP/openldap-2.4.23/servers/slapd/back-bdb' /bin/sh ../../../libtool --tag=disable-shared --mode=compile cc -g -O2 -I../../../include -I../../../include -I.. -I./.. -I/usr/local/BerkeleyDB.4.8/include/LDFLAGS=-L/usr/local/BerkeleyDB.4.8/lib -c init.c cc -g -O2 -I../../../include -I../../../include -I.. -I./.. -I/usr/local/BerkeleyDB.4.8/include/LDFLAGS=-L/usr/local/BerkeleyDB.4.8/lib -c init.c -o init.o init.c: In function 'bdb_db_open': init.c:532: error: 'DB_READ_COMMITTED' undeclared (first use in this function) init.c:532: error: (Each undeclared identifier is reported only once init.c:532: error: for each function it appears in.) make[3]: *** [init.lo] Error 1 make[3]: Leaving directory `/u001/projects/cyrusIMAP/openldap-2.4.23/servers/slapd/back-bdb' make[2]: *** [.backend] Error 1 make[2]: Leaving directory `/u001/projects/cyrusIMAP/openldap-2.4.23/servers/slapd' make[1]: *** [all-common] Error 1 make[1]: Leaving directory `/u001/projects/cyrusIMAP/openldap-2.4.23/servers' make: *** [all-common] Error 1 Can anyone please let me know why the init.c program is unable to open the bdb. Any help would be appreciated. -- Rajeshwar BM Bangalore INDIA

2 1

Ldap logs accounting
by Hugo Deprez 06 Oct '11

06 Oct '11

Dear community, I am currently using openldap 2.4.23-3 on Debian Lenny. I need to be able to log all the change made on the directory. For exemple if a account is delete I would like to log who did it and at what time. I want to do some accounting. Do you know how I could do that ? I didn't found anything on google. Regards, Hugo

2 1

Anonymous access
by jm130794 06 Oct '11

06 Oct '11

Hello, I have a little question. I've installed a kerberized openldap server. All works fine with kerberos tickets :) My problem : is it possible to get a ldap awser with a anonymous access ? I can't ! When I try a resquest, I get that : ldapsearch -x -h 192.168.1.1 # extended LDIF # # LDAPv3 # base <> (default) with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 32 No such object # numResponses: 1 I certainely made a mistake, but where ? Thanks, JM

2 1

Microsoft Windows Terminal Service integration with OpenLDAP
by pradyumna dash 05 Oct '11

05 Oct '11

Hi, I would like to know, how to integrate Microsoft windows terminal service with OpenLDAP, can pGINA will help me to achieve this ? or i have to look for something else. Please suggest. Regards, Neo

3 3

Compare-Request on hashed userPassword
by Michael Ströder 05 Oct '11

05 Oct '11

HI! We have {SSHA}-hashed passwords in attribute userPassword. One application sends CompareRequests with the clear-text password instead of a BindRequest to validate the password which obviously fails. The application vendor claims it is too much effort to change that behaviour in the application. I guess this can only be solved in slapd by a custom overlay intercepting the CompareRequest (which is effort too). Or is there any other solution I don't know of? Ciao, Michael.

6 10

Re: V 2.4.x schema extensions
by Bryce Powell 05 Oct '11

05 Oct '11

Hi, Thanks to both responders. The final working version of local.schema now looks like this: attributeType ( 1.3.6.1.4.1.22280.1021.3.1 NAME 'x-sdids-passwordExpirationTime' DESC 'TELUS defined password policy attribute type used by enPortal.' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE USAGE userApplications ) objectclass ( 1.3.6.1.4.1.22280.1021.4.1 NAME 'x-sdids-enPortal' DESC 'Indicates that this entry has additional attributes used by enPortal.' AUXILIARY MAY x-sdids-passwordExpirationTime ) After restarting slapd, and adding the 'x-sdids-enPortal' objectClass to an existing entry, I was able to add a 'x-sdids-passwordExpirationTime' attribute value. Nice. Thanks, Bryce Powell

1 0

Unable to create home directory (LDAP Authentication)
by vijay s sheelavantar 05 Oct '11

05 Oct '11

Hi,I am trying to create the home directories for the users automatically(using pam_mkhomedir.so) when they login using SSH.I have added the below line to /etc/pam.d/system-auth file.PHP Code:session     optional        pam_mkhomedir.so skel=/etc/skel umask=0022   user authentication is done by a LDAP server, and the machine is running Fedora OS.I am getting the below errors.PHP Code:Creating directory '/home/vijay'. Unable to create directory /home/vijay: Permission denied Last login: Wed Oct  5 16:03:53 2011 from 10.254.194.148 Could not chdir to home directory /home/vijay: No such file or directory   Kindly help me to solve this problem.Warm Regards,Vijay S.

2 1

V 2.4.x schema extensions
by Bryce Powell 05 Oct '11

05 Oct '11

Hi, I need an attribute to store password expiry date for the inetOrgPerson objectClass entries in my directory. Since I could not find this or similar attribute in the existing set of schemas (including the ppolicy schema), I have tried to implemented an extension in a custom local.schema: objectclass ( 1.3.6.1.4.1.22280.1021.4.1 NAME 'x-sdids-enPortal' DESC 'Indicates that this entry has additional attributes used by enPortal.' AUXILIARY ) # The "MAY" directive below prevents slapd form starting, and is therefore commented out. # MAY 1.3.6.1.4.1.22280.1021.3.1 ) attributeType ( 1.3.6.1.4.1.22280.1021.3.1 NAME 'x-sdids-passwordExpirationTime' DESC 'TELUS defined password policy attribute type used by enPortal.' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE USAGE userApplications ) I figured the best bet would be an auxiliary objectClass. After including the new local.schema file in the slapd.conf, and restarting slapd, I get an error when trying to add the new attribute value to an existing or new inetOrgPerson entry: Oct 4 10:37:43 vmsdildap04 slapd[31176]: conn=1 op=22 MOD dn="uid=john(a)abc.com,ou=CUSTOMER,ou=Users,dc=private,dc=sdi" Oct 4 10:37:43 vmsdildap04 slapd[31176]: conn=1 op=22 MOD attr=x-sdids-passwordExpirationTime Oct 4 10:37:43 vmsdildap04 slapd[31176]: Entry (uid= john(a)abc.com,ou=CUSTOMER,ou=Users,dc=private,dc=sdi), attribute 'x-sdids-passwordExpirationTime' not allowed Oct 4 10:37:43 vmsdildap04 slapd[31176]: entry failed schema check: attribute 'x-sdids-passwordExpirationTime' not allowed Oct 4 10:37:43 vmsdildap04 slapd[31176]: conn=1 op=22 RESULT tag=103 err=65 text=attribute 'x-sdids-passwordExpirationTime' not allowed I believe this error 65, as per the OpenLDAP docs, is: H.35. objectClassViolation (65) Indicates that the entry violates object class restrictions. The value I am specifying for the attribute is 20111004164129Z I have also tried to first add an objectClass attribute value to an existing entry with value 'x-sdids-enPortal', and then add the 'x-sdids-passwordExpirationTime' attribute value, with the same outcome. Thanks, Bryce Powell

3 2

connection problem with ldapmodify -Y EXTERNAL -H ldapi:///
by Andreas Rudat 05 Oct '11

05 Oct '11

Hello, everytime I try *ldapmodify -Y EXTERNAL -H ldapi:///* * I get the following SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 and thats all, same with password (-W), it stopped at all and no log messages. Thanks Andreas *

4 11

Re: Login takes more time (LDAP)
by vijay s sheelavantar 05 Oct '11

05 Oct '11

Hello, This was problem with the directory permissions where cacert.pem file was stored. The directory on the client machine had the permissions "drwx------" but the correct permission required was "drwxr-xr-x" this. I changed the directory permissions where cacert.pem file is stored on client machine to "drwxr-xr-x" and now there is no delay. This problem is fixed now.  Thank you very much. Warm Regards,VIJAY S.

1 0

Re: Login takes more time (LDAP)
by vijay s sheelavantar 04 Oct '11

04 Oct '11

Hi,I followed your suggestions, I have set 'UseDNS no' in sshd_config and restarted sshd. I tried 'getent passwd' and 'getent group' there is no delay in the output of these commands. I tried to create home directory after login using pam_mkhomedir.so but failed.  I am getting delay only while login. I am getting below errors during login. Please see the below error and kindly help me to fix this delay problem. Last login: Fri Sep 30 15:22:53 2011 from 10.254.194.148Could not chdir to home directory /home/kim: No such file or directoryid: cannot find name for user ID 105-bash-3.2$ Thanks and Regards,Vijay S.

3 2

Different replication methods in OpenLDAP 2.4
by Bob Fitch 03 Oct '11

03 Oct '11

Hi, I'm trying to correctly conceptualize the different replication models in OpenLDAP 2.4 and I'm a little unsure if I have my facts right. As far as I can tell from the OpenLDAP 2.4 Administrator's Manual the following is true: LDAP Sync Replication (a.k.a syncrepl) - Single Master Replication - Provides HA for reads to the directory but not for writes. - Provides data consistency - Replicates all attributes of the modified DN, even the unchanged ones. Delta Sync Replication - Single Master Replication - Provides HA for reads to the directory but not for writes - Provides data consistency - Replicates only the modified attributes of the modified DN N-Way Multi-Master Replication - As the name suggests, Multi-Master Replication - Provides HA for reads and writes to the directory. - Does not provide data consistency MirrorMode Replication - Hybrid between SMR and MMR - Creates chicken and egg problem with regards to HA - external frontend is a potential failure point and must also be made HA - Provides HA for reads and writes to the directory (assuming external frontend is made HA) - Both OpenLDAP servers can replicate changes to each other, however all directory writes are forced through one server at a time by the external frontend. - Provides data consistency - Does not support Delta Sync Repl (yet) Unfortunately I do not have the capacity to test MirrorMode Replication, so I was hoping I could hear from someone who has practical experience with it to let me know if I'm off-base there. Also, does N-Way Multi-Master Replication support Delta Sync Replication? Unlike MirrorMode Replication which specifically denotes that it can't, the section on N-Way Multi-Master Replication doesn't implicitly say one way or another. I guess I could assume then that it does, but I'd prefer not to - you know what they say about assumptions ;-) Many thanks in advance, Bob

2 1

Core dump in ldap_unbind_ext_s
by sachinv1821＠gmail.com 03 Oct '11

03 Oct '11

I have a wrapper manager code on top of openldap stack(ver.2.4.11), there manager code is responsible for creating the ldap connecting to the LDAP servers by using the standard ldap API(). u32_t rc=ldap_sasl_bind(ld, loginDN, LDAP_SASL_SIMPLE, &cred, NULL, NULL, &msgid); //asynchronous bind if (rc != LDAP_SUCCESS ) { ldapErrorLog(":connect: LDAP Bind send Failed:%s \n ", ldap_err2string(rc)); ldap_unbind_ext_s(ld, NULL,NULL); m_connInitialized = false; return(LDAPRC_FAIL); } return LDAPRC_SUCCESS; by using this wrapper code I am creating many ldap links ,most of time this is working fine some times when the ldap_sasl_bind() returns -1 (can't contact server) or unknown error the code is crashing in ldap_unbind_ext_s. can anyone help out. the log and gdb trace are pasted below (gdb) bt #0 ldap_free_request (ld=0x16fd370, lr=0x1010001020001) at request.c:866 #1 0x00000000005372e8 in ldap_ld_free (ld=0x16fd370, close=1, sctrls=<value optimized out>, cctrls=<value optimized out>) at unbind.c:88 #2 0x000000000044b020 in LdapConnection::connect (this=0x157bcd0, loginDN=0x157b3ec "cn=TASuser", pwd=<value optimized out>) logs.. <18:06:56.414 **ERR** LDAP 22603:22470 3:0><LdapConnection.cpp(171)>:connect: LDAP Bind send Failed:Can't contact LDAP server <18:06:56.414 *WRN* MX 22603:22470 3:0>receive SEGV signal <18:06:56.414 *WRN* MX 22603:22470 3:0>Message dump is disabl Regards, Sachin Vastrad

2 1

ldapscripts
by Andreas Rudat 03 Oct '11

03 Oct '11

Hello, if I try to ad auser with ldapadduser I get the error >> 10/01/11 - 19:29 : Command : /usr/sbin/ldapadduser andi test ldap_add: No such object (32) matched DN: dc=foo,dc=intern Error adding user andi to LDAP but it's not a problem to add groups

2 1

translucent proxy add more then one group to user on proxy side
by joaosf 03 Oct '11

03 Oct '11

Hi All, I have a translucent proxy who connect's to other ldap server. I need this kind of solutions because I need to manage groups by my own. So, when a user connect over my translucent proxy everything goes ok, gets the password from the backend ldap server and groups, but user just see the prefered group of my translucent proxy (I have more) and the groups of the backend ldaps. I want the user to see all groups of my translucent proxy, is this possible, do I miss something? Thanks, João SF

1 0

[Re: ldap proxy acl filter problem]
by Ron Peterson 03 Oct '11

03 Oct '11

Had to turn away from this problem to deal w/ other stuff, but it's still an issue for me. Does anyone have a working example of a working proxy configuration they would be willing to share that: * includes a filter expression restricting the result set * allows you to query for the value of an individual attribute I would be very grateful. Right now I'm thinking I may try a different tack: put the filter expression on the master directory in an acl specific to the proxy base dn I'm dealing with. -Ron- ----- Forwarded message from Ron Peterson <rpeterso(a)mtholyoke.edu> ----- Date: Fri, 16 Sep 2011 09:25:41 -0400 From: Ron Peterson <rpeterso(a)mtholyoke.edu> To: Howard Chu <hyc(a)symas.com> Subject: Re: ldap proxy acl filter problem Organization: Mount Holyoke College X-Spam-Score: -0.504 () RP_MATCHES_RCVD Cc: openldap-technical(a)openldap.org 2011-09-15_08:22:54-0400 Ron Peterson <rpeterso(a)mtholyoke.edu>: > 2011-09-14_16:54:56-0400 Howard Chu <hyc(a)symas.com>: > > >I've turned my logging way up, and the hiccup seems to be that the DN > > >I've authenticated as > > >(uid=email,ou=admin,ou=accounts,ou=prod,dc=mtholyoke,dc=edu) needs read > > >access to the attributes in the filter expression. But how do I give > > >that account read access to those attributes, without then exposing the > > >objects that I'm trying to hide with the filter expression? > > > > Give it auth access, not read access. My previous example had too much going on for any sane person to wade through, so I've distilled this configuration down to illustrate the essence of the problem. No fancy rewrite rules, etc. The problem remains: adding a filter expression makes it impossible to query the value of particular attributes, although I can retrieve the entire object. It must be possible to filter the result set in a back-ldap proxy setup when querying for particular attributes, but how? ________________________________________________________________________ ldaprc like: BASE ou=people,ou=accounts,ou=prod,dc=mtholyoke,dc=edu BINDDN uid=email,ou=admin,ou=accounts,ou=prod,dc=mtholyoke,dc=edu URI ldap://dirt.mtholyoke.edu SIZELIMIT 40000 TLS_CACERT /local/etc/cert/ca/cacert.pem ________________________________________________________________________ proxy config like: database ldap suffix "ou=accounts,ou=prod,dc=mtholyoke,dc=edu" uri "ldapi://%2Fvar%2Frun%2Fslapd%2Fmastertest%2Fldapi" access to dn.sub="ou=people,ou=accounts,ou=prod,dc=mtholyoke,dc=edu" attrs="entry" by dn="uid=email,ou=admin,ou=accounts,ou=prod,dc=mtholyoke,dc=edu" read by * none # log file (see below) seems to indicate proxy wants search permission on this attribute, # but this doesn't help access to dn.sub="ou=people,ou=accounts,ou=prod,dc=mtholyoke,dc=edu" attrs="yApplicationPermission" by dn="uid=email,ou=admin,ou=accounts,ou=prod,dc=mtholyoke,dc=edu" search by * none access to dn.sub="ou=people,ou=accounts,ou=prod,dc=mtholyoke,dc=edu" filter="(yApplicationPermission=email)" by dn="uid=email,ou=admin,ou=accounts,ou=prod,dc=mtholyoke,dc=edu" read by * none ________________________________________________________________________ (1) This query works (returns all attributes): ldapsearch -LLL -Z -x -y ../../private/pwemail '(yUsername=rpeterso)' (2) This query does not (only returns DN, but not yPrimaryEmail): ldapsearch -LLL -Z -x -y ../../private/pwemail '(yUsername=rpeterso)' yPrimaryEmail ________________________________________________________________________ Log for both master and proxy database (loglevel 256 128 64 32), for query (2) above: pid 32160 = proxy server pid 24268 = master directory server Sep 16 09:17:41 mid slapd[32160]: conn=1001 fd=13 ACCEPT from IP=138.110.86.129:51010 (IP=138.110.86.129:389) Sep 16 09:17:41 mid slapd[32160]: conn=1001 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Sep 16 09:17:41 mid slapd[32160]: conn=1001 op=0 STARTTLS Sep 16 09:17:41 mid slapd[32160]: conn=1001 op=0 RESULT oid= err=0 text= Sep 16 09:17:41 mid slapd[32160]: conn=1001 fd=13 TLS established tls_ssf=256 ssf=256 Sep 16 09:17:41 mid slapd[32160]: conn=1001 op=1 BIND dn="uid=email,ou=admin,ou=accounts,ou=prod,dc=mtholyoke,dc=edu" method=128 Sep 16 09:17:41 mid slapd[24268]: conn=1025 fd=13 ACCEPT from PATH=/var/run/slapd/mastertest/ldapi (PATH=/var/run/slapd/mastertest/ldapi) Sep 16 09:17:41 mid slapd[24268]: conn=1025 op=0 BIND dn="uid=email,ou=admin,ou=accounts,ou=prod,dc=mtholyoke,dc=edu" method=128 Sep 16 09:17:41 mid slapd[24268]: => access_allowed: result not in cache (userPassword) Sep 16 09:17:41 mid slapd[24268]: => access_allowed: auth access to "uid=email,ou=admin,ou=accounts,ou=prod,dc=mtholyoke,dc=edu" "userPassword" requested Sep 16 09:17:41 mid slapd[24268]: => acl_get: [1] attr userPassword Sep 16 09:17:41 mid slapd[24268]: => acl_mask: access to entry "uid=email,ou=admin,ou=accounts,ou=prod,dc=mtholyoke,dc=edu", attr "userPassword" requested Sep 16 09:17:41 mid slapd[24268]: => acl_mask: to value by "", (=0) Sep 16 09:17:41 mid slapd[24268]: <= check a_dn_pat: self Sep 16 09:17:41 mid slapd[24268]: <= check a_dn_pat: anonymous Sep 16 09:17:41 mid slapd[24268]: <= acl_mask: [2] applying auth(=xd) (stop) Sep 16 09:17:41 mid slapd[24268]: <= acl_mask: [2] mask: auth(=xd) Sep 16 09:17:41 mid slapd[24268]: => slap_access_allowed: auth access granted by auth(=xd) Sep 16 09:17:41 mid slapd[24268]: => access_allowed: auth access granted by auth(=xd) Sep 16 09:17:41 mid slapd[24268]: conn=1025 op=0 BIND dn="uid=email,ou=admin,ou=accounts,ou=prod,dc=mtholyoke,dc=edu" mech=SIMPLE ssf=0 Sep 16 09:17:41 mid slapd[24268]: conn=1025 op=0 RESULT tag=97 err=0 text= Sep 16 09:17:41 mid slapd[32160]: conn=1001 op=1 BIND dn="uid=email,ou=admin,ou=accounts,ou=prod,dc=mtholyoke,dc=edu" mech=SIMPLE ssf=0 Sep 16 09:17:41 mid slapd[32160]: conn=1001 op=1 RESULT tag=97 err=0 text= Sep 16 09:17:41 mid slapd[32160]: begin get_filter Sep 16 09:17:41 mid slapd[32160]: EQUALITY Sep 16 09:17:41 mid slapd[32160]: end get_filter 0 Sep 16 09:17:41 mid slapd[32160]: conn=1001 op=2 SRCH base="ou=people,ou=accounts,ou=prod,dc=mtholyoke,dc=edu" scope=2 deref=0 filter="(yUsername=rpeterso)" Sep 16 09:17:41 mid slapd[32160]: conn=1001 op=2 SRCH attr=yPrimaryEmail Sep 16 09:17:41 mid slapd[24268]: conn=1025 op=1 SRCH base="ou=people,ou=accounts,ou=prod,dc=mtholyoke,dc=edu" scope=2 deref=0 filter="(yUsername=rpeterso)" Sep 16 09:17:41 mid slapd[24268]: conn=1025 op=1 SRCH attr=yPrimaryEmail Sep 16 09:17:41 mid slapd[24268]: => access_allowed: search access to "ou=people,ou=accounts,ou=prod,dc=mtholyoke,dc=edu" "entry" requested Sep 16 09:17:41 mid slapd[24268]: => dn: [3] dc=mtholyoke,dc=edu Sep 16 09:17:41 mid slapd[24268]: => acl_get: [3] matched Sep 16 09:17:41 mid slapd[24268]: => acl_get: [3] attr entry Sep 16 09:17:41 mid slapd[24268]: => acl_mask: access to entry "ou=people,ou=accounts,ou=prod,dc=mtholyoke,dc=edu", attr "entry" requested Sep 16 09:17:41 mid slapd[24268]: => acl_mask: to all values by "uid=email,ou=admin,ou=accounts,ou=prod,dc=mtholyoke,dc=edu", (=0) Sep 16 09:17:41 mid slapd[24268]: <= check a_dn_pat: ^uid=[^,]*,ou=admin,ou=accounts,ou=prod,dc=mtholyoke,dc=edu Sep 16 09:17:41 mid slapd[24268]: => acl_string_expand: pattern: ^uid=[^,]*,ou=admin,ou=accounts,ou=prod,dc=mtholyoke,dc=edu Sep 16 09:17:41 mid slapd[24268]: => acl_string_expand: expanded: ^uid=[^,]*,ou=admin,ou=accounts,ou=prod,dc=mtholyoke,dc=edu Sep 16 09:17:41 mid slapd[24268]: <= acl_mask: [1] applying read(=rscxd) (stop) Sep 16 09:17:41 mid slapd[24268]: <= acl_mask: [1] mask: read(=rscxd) Sep 16 09:17:41 mid slapd[24268]: => slap_access_allowed: search access granted by read(=rscxd) Sep 16 09:17:41 mid slapd[24268]: => access_allowed: search access granted by read(=rscxd) Sep 16 09:17:41 mid slapd[24268]: => access_allowed: search access to "yDirectoryID=c44883ba-ac62-d28c-556f-99ccbf532da7,ou=people,ou=accounts,ou=prod,dc=mtholyoke,dc=edu" "yUsername" requested Sep 16 09:17:41 mid slapd[24268]: => dn: [3] dc=mtholyoke,dc=edu Sep 16 09:17:41 mid slapd[24268]: => acl_get: [3] matched Sep 16 09:17:41 mid slapd[24268]: => dn: [4] dc=mtholyoke,dc=edu Sep 16 09:17:41 mid slapd[24268]: => acl_get: [4] matched Sep 16 09:17:41 mid slapd[24268]: => acl_get: [4] attr yUsername Sep 16 09:17:41 mid slapd[24268]: => acl_mask: access to entry "yDirectoryID=c44883ba-ac62-d28c-556f-99ccbf532da7,ou=people,ou=accounts,ou=prod,dc=mtholyoke,dc=edu", attr "yUsername" requested Sep 16 09:17:41 mid slapd[24268]: => acl_mask: to value by "uid=email,ou=admin,ou=accounts,ou=prod,dc=mtholyoke,dc=edu", (=0) Sep 16 09:17:41 mid slapd[24268]: <= check a_dn_pat: ^uid[^,]*,ou=admin,ou=accounts,ou=prod,dc=mtholyoke,dc=edu Sep 16 09:17:41 mid slapd[24268]: => acl_string_expand: pattern: ^uid[^,]*,ou=admin,ou=accounts,ou=prod,dc=mtholyoke,dc=edu Sep 16 09:17:41 mid slapd[24268]: => acl_string_expand: expanded: ^uid[^,]*,ou=admin,ou=accounts,ou=prod,dc=mtholyoke,dc=edu Sep 16 09:17:41 mid slapd[24268]: <= acl_mask: [1] applying read(=rscxd) (stop) Sep 16 09:17:41 mid slapd[24268]: <= acl_mask: [1] mask: read(=rscxd) Sep 16 09:17:41 mid slapd[24268]: => slap_access_allowed: search access granted by read(=rscxd) Sep 16 09:17:41 mid slapd[24268]: => access_allowed: search access granted by read(=rscxd) Sep 16 09:17:41 mid slapd[24268]: => access_allowed: read access to "yDirectoryID=c44883ba-ac62-d28c-556f-99ccbf532da7,ou=people,ou=accounts,ou=prod,dc=mtholyoke,dc=edu" "entry" requested Sep 16 09:17:41 mid slapd[24268]: => dn: [3] dc=mtholyoke,dc=edu Sep 16 09:17:41 mid slapd[24268]: => acl_get: [3] matched Sep 16 09:17:41 mid slapd[24268]: => acl_get: [3] attr entry Sep 16 09:17:41 mid slapd[24268]: => acl_mask: access to entry "yDirectoryID=c44883ba-ac62-d28c-556f-99ccbf532da7,ou=people,ou=accounts,ou=prod,dc=mtholyoke,dc=edu", attr "entry" requested Sep 16 09:17:41 mid slapd[24268]: => acl_mask: to all values by "uid=email,ou=admin,ou=accounts,ou=prod,dc=mtholyoke,dc=edu", (=0) Sep 16 09:17:41 mid slapd[24268]: <= check a_dn_pat: ^uid=[^,]*,ou=admin,ou=accounts,ou=prod,dc=mtholyoke,dc=edu Sep 16 09:17:41 mid slapd[24268]: => acl_string_expand: pattern: ^uid=[^,]*,ou=admin,ou=accounts,ou=prod,dc=mtholyoke,dc=edu Sep 16 09:17:41 mid slapd[24268]: => acl_string_expand: expanded: ^uid=[^,]*,ou=admin,ou=accounts,ou=prod,dc=mtholyoke,dc=edu Sep 16 09:17:41 mid slapd[24268]: <= acl_mask: [1] applying read(=rscxd) (stop) Sep 16 09:17:41 mid slapd[24268]: <= acl_mask: [1] mask: read(=rscxd) Sep 16 09:17:41 mid slapd[24268]: => slap_access_allowed: read access granted by read(=rscxd) Sep 16 09:17:41 mid slapd[24268]: => access_allowed: read access granted by read(=rscxd) Sep 16 09:17:41 mid slapd[24268]: => access_allowed: result not in cache (yPrimaryEmail) Sep 16 09:17:41 mid slapd[24268]: => access_allowed: read access to "yDirectoryID=c44883ba-ac62-d28c-556f-99ccbf532da7,ou=people,ou=accounts,ou=prod,dc=mtholyoke,dc=edu" "yPrimaryEmail" requested Sep 16 09:17:41 mid slapd[24268]: => dn: [3] dc=mtholyoke,dc=edu Sep 16 09:17:41 mid slapd[24268]: => acl_get: [3] matched Sep 16 09:17:41 mid slapd[24268]: => dn: [4] dc=mtholyoke,dc=edu Sep 16 09:17:41 mid slapd[24268]: => acl_get: [4] matched Sep 16 09:17:41 mid slapd[24268]: => acl_get: [4] attr yPrimaryEmail Sep 16 09:17:41 mid slapd[24268]: => acl_mask: access to entry "yDirectoryID=c44883ba-ac62-d28c-556f-99ccbf532da7,ou=people,ou=accounts,ou=prod,dc=mtholyoke,dc=edu", attr "yPrimaryEmail" requested Sep 16 09:17:41 mid slapd[24268]: => acl_mask: to value by "uid=email,ou=admin,ou=accounts,ou=prod,dc=mtholyoke,dc=edu", (=0) Sep 16 09:17:41 mid slapd[24268]: <= check a_dn_pat: ^uid[^,]*,ou=admin,ou=accounts,ou=prod,dc=mtholyoke,dc=edu Sep 16 09:17:41 mid slapd[24268]: => acl_string_expand: pattern: ^uid[^,]*,ou=admin,ou=accounts,ou=prod,dc=mtholyoke,dc=edu Sep 16 09:17:41 mid slapd[24268]: => acl_string_expand: expanded: ^uid[^,]*,ou=admin,ou=accounts,ou=prod,dc=mtholyoke,dc=edu Sep 16 09:17:41 mid slapd[24268]: <= acl_mask: [1] applying read(=rscxd) (stop) Sep 16 09:17:41 mid slapd[24268]: <= acl_mask: [1] mask: read(=rscxd) Sep 16 09:17:41 mid slapd[24268]: => slap_access_allowed: read access granted by read(=rscxd) Sep 16 09:17:41 mid slapd[24268]: => access_allowed: read access granted by read(=rscxd) Sep 16 09:17:41 mid slapd[24268]: conn=1025 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Sep 16 09:17:41 mid slapd[32160]: => access_allowed: read access to "yDirectoryID=c44883ba-ac62-d28c-556f-99ccbf532da7,ou=people,ou=accounts,ou=prod,dc=mtholyoke,dc=edu" "entry" requested Sep 16 09:17:41 mid slapd[32160]: => dn: [1] ou=people,ou=accounts,ou=prod,dc=mtholyoke,dc=edu Sep 16 09:17:41 mid slapd[32160]: => acl_get: [1] matched Sep 16 09:17:41 mid slapd[32160]: => acl_get: [1] attr entry Sep 16 09:17:41 mid slapd[32160]: => acl_mask: access to entry "yDirectoryID=c44883ba-ac62-d28c-556f-99ccbf532da7,ou=people,ou=accounts,ou=prod,dc=mtholyoke,dc=edu", attr "entry" requested Sep 16 09:17:41 mid slapd[32160]: => acl_mask: to all values by "uid=email,ou=admin,ou=accounts,ou=prod,dc=mtholyoke,dc=edu", (=0) Sep 16 09:17:41 mid slapd[32160]: <= check a_dn_pat: uid=email,ou=admin,ou=accounts,ou=prod,dc=mtholyoke,dc=edu Sep 16 09:17:41 mid slapd[32160]: <= acl_mask: [1] applying read(=rscxd) (stop) Sep 16 09:17:41 mid slapd[32160]: <= acl_mask: [1] mask: read(=rscxd) Sep 16 09:17:41 mid slapd[32160]: => slap_access_allowed: read access granted by read(=rscxd) Sep 16 09:17:41 mid slapd[32160]: => access_allowed: read access granted by read(=rscxd) Sep 16 09:17:41 mid slapd[32160]: => access_allowed: result not in cache (yPrimaryEmail) Sep 16 09:17:41 mid slapd[32160]: => access_allowed: read access to "yDirectoryID=c44883ba-ac62-d28c-556f-99ccbf532da7,ou=people,ou=accounts,ou=prod,dc=mtholyoke,dc=edu" "yPrimaryEmail" requested Sep 16 09:17:41 mid slapd[32160]: => dn: [1] ou=people,ou=accounts,ou=prod,dc=mtholyoke,dc=edu Sep 16 09:17:41 mid slapd[32160]: => acl_get: [1] matched Sep 16 09:17:41 mid slapd[32160]: => dn: [2] ou=people,ou=accounts,ou=prod,dc=mtholyoke,dc=edu Sep 16 09:17:41 mid slapd[32160]: => acl_get: [2] matched Sep 16 09:17:41 mid slapd[32160]: => dn: [3] ou=people,ou=accounts,ou=prod,dc=mtholyoke,dc=edu Sep 16 09:17:41 mid slapd[32160]: => acl_get: [3] matched Sep 16 09:17:41 mid slapd[32160]: => test_filter Sep 16 09:17:41 mid slapd[32160]: EQUALITY Sep 16 09:17:41 mid slapd[32160]: => access_allowed: search access to "yDirectoryID=c44883ba-ac62-d28c-556f-99ccbf532da7,ou=people,ou=accounts,ou=prod,dc=mtholyoke,dc=edu" "yApplicationPermission" requested Sep 16 09:17:41 mid slapd[32160]: <= test_filter 5 Sep 16 09:17:41 mid slapd[32160]: <= acl_get: done. Sep 16 09:17:41 mid slapd[32160]: => slap_access_allowed: no more rules Sep 16 09:17:41 mid slapd[32160]: => access_allowed: no more rules Sep 16 09:17:41 mid slapd[32160]: send_search_entry: conn 1001 access to attribute yPrimaryEmail, value #0 not allowed Sep 16 09:17:41 mid slapd[32160]: conn=1001 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text= Sep 16 09:17:41 mid slapd[32160]: conn=1001 op=3 UNBIND Sep 16 09:17:41 mid slapd[24268]: conn=1025 op=2 UNBIND Sep 16 09:17:41 mid slapd[32160]: conn=1001 fd=13 closed Sep 16 09:17:41 mid slapd[24268]: conn=1025 fd=13 closed Sep 16 09:17:41 mid slapd[24268]: connection_read(13): no connection! Sep 16 09:17:41 mid slapd[24268]: connection_read(13): no connection! -- Ron Peterson Network & Systems Administrator Mount Holyoke College http://www.mtholyoke.edu/~rpeterso ----- End forwarded message -----

1 0

back-sql usage
by Worgan, Craig (Craig) 03 Oct '11

03 Oct '11

Hi, The documentation for back-sql indicates that it is experimental and warns against using it in a production environment. It also says that it is not intended as a general purpose back-end for OpenLDAP. My organization is looking at doing both of those things and I am trying to convince them not to do so. It is proving to be a difficult thing to do. Initially, I found the results of a performance analysis of back-sql that showed it was significantly slower than BDB and used that as an argument. I was asked to prove it so I built a prototype. The prototype showed that, at least for our purposes, performance was not an issue. Now I am falling back on the documentation, but very few people are listening. I fear that if we continue down the path we are on we will face significant problems with back-sql. I was hoping someone on the list could provide me with more concrete technical information as to why back-sql should not be used as a general purpose backend for OpenLDAP and/or in a production environment. Any information is greatly appreciated. Thanks, Craig Worgan Avaya| System Management Solutions | 250 Sidney Street | Belleville, Ontario Canada K8N 5B7 | (613) 967-5233 | worganc(a)avaya.com<mailto:worganc@avaya.com>

1 0

Question to smbldap-tools
by Andreas Rudat 02 Oct '11

02 Oct '11

Hi, does anyone knows a patch for the "Password" problem? I mean that's saved in cleartext, I tried to add some code to ask for the pass instead of "read it from file" but I got errors after my input. I dont have any perl skills. Andreas

2 1

tunning search with less tha filter
by CHIROSSEL, Olivier 30 Sep '11

30 Sep '11

Hi i have to found entry with this filter in my ldap : (&(statusprefix=free)(datefinjachere<=20110926)) i defined the datefinjachere attribut like this attributetype ( 1.3.6.1.4.1.11594.1.2.5.1.7 NAME 'datefinjachere' DESC 'datefinjachere' EQUALITY numericStringMatch SUBSTR numericStringSubstringsMatch ORDERING numericStringOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.36{8} SINGLE-VALUE ) and i declare in my slapd.conf : index datefinjachere eq index statusprefix eq in the base where i search there is 1024 entry which corresponding or not at the filter a search take 200 millisecondes for the moment, could someone tell me if there is some tunning configuration for better performances ? i see when i log with debug Sep 26 17:53:09 olivier slapd[3402]: => bdb_presence_candidates (datefinjachere) Sep 26 17:53:09 olivier slapd[3402]: <= bdb_presence_candidates: (datefinjachere) not indexed perhaps i have to put index datefinjachere pres,eq in my conf ? my *.bdb file take 2G on the disk and i declare 500M of cache berkeley in my myconf bdb4.8 openldap 2.4.23 in advance, thank you for your time Regards, Olivier

1 1

Login takes more time (LDAP)
by vijay s sheelavantar 30 Sep '11

30 Sep '11

Hi,I am using openldap-2.4.26 on one machine, and pam_ldap-186 and nss_ldap-265 on another machine, both machines running Fedora-10. I am trying for a secure communication using TLS/SSL. when I try to connect to the LDAP client machine using SSH, after authentication success the shell prompt is returned after 3 min or 4 mins. I don't know why it is taking so much time. This is happening for the users which are present only in LDAP database i.e. this user is not created on the client machine. At the server side I am getting following errors. TLS: can't accept: (unknown).connection_read(18): TLS accept failure error=-1 id=1068, closingconnection_closing: readying conn=1068 sd=18 for closeconnection_close: conn=1068 sd=18daemon: removing 18conn=1068 fd=18 closed (TLS negotiation failure)daemon: epoll: listen=7 active_threads=0 tvp=NULLdaemon: activity on 1 descriptordaemon: activity on:daemon: epoll: listen=7 active_threads=0 tvp=NULL I have created the CA certificate with CA.sh script. I followed the procedure given below.http://octaldream.com/~scottm/talks/ssl/opensslca.html I copied the same cacert.pem file from server to the client machine afte running the above procedure on server machine. The configuration files are as follows.slapd.conf include         /usr/local/etc/openldap/schema/core.schemainclude         /usr/local/etc/openldap/schema/cosine.schemainclude         /usr/local/etc/openldap/schema/inetorgperson.schemainclude         /usr/local/etc/openldap/schema/nis.schema LSCipherSuite          HIGH:MEDIUM:+SSLv2:+SSLv3:RSATLSCACertificateFile    /etc/pki/CA/cacert.pemTLSCertificateFile      /etc/pki/tls/misc/newcert.pemTLSCertificateKeyFile   /etc/pki/tls/misc/newkey.pemTLSVerifyClient         allow pidfile         /usr/local/var/run/slapd.pidargsfile        /usr/local/var/run/slapd.args access to attrs=userPassword by self       write by anonymous  auth by *          none access to * by *         read######################################################################## BDB database definitions####################################################################### database        bdbsuffix          "dc=samsung,dc=com"rootdn          "cn=Manager,dc=samsung,dc=com"# Cleartext passwords, especially for the rootdn, should# be avoid.  See slappasswd(8) and slapd.conf(5) for details.# Use of strong authentication encouraged.rootpw          123qwe# The database directory MUST exist prior to running slapd AND# should only be accessible by the slapd and slap tools.# Mode 700 recommended.directory       /usr/local/var/openldap-data# Indices to maintain#unique id so equality match onlyindex   uid     eqindex   userPassword    eq#allows general searching on commonname,givenname and mailindex   cn,gn,sn,ou,o,mail eq,subindex   objectClass     eq and ldap.conf has the following configuration base dc=samsung,dc=comuri ldaps://localhost.localdomain/tls_cacertfile  /etc/pki/CA/cacert.pempam_password md5nss_map_attribute gecos description Please let me know where I am making mistake? how to fix this problem. Warm RegardsVijay S.

2 1

lastbind overlay issue
by Mudimbi, Satish (VDSS) 30 Sep '11

30 Sep '11

Hi, I have built the last bind overlay and followed the steps. I get an error line 63 (overlay lastbind) overlay "lastbind" not found /usr/local/etc/openldap/slapd.conf: line 63: <overlay> handler exited with 1! What did it do wrong? Here is the information of my LDAP Libexec/openldap has all the files [root@pacman openldap]# ls -l /usr/local/libexec/openldap total 28 -rwxr-xr-x 1 root root 808 Sep 29 09:18 lastbind.la -rwxr-xr-x 1 root root 324 Sep 29 09:18 lastbind.lo -rwxr-xr-x 1 root root 4440 Sep 29 09:18 lastbind.o slapd.conf file # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args # Load dynamic backend modules: [root@pacman openldap]# ls -l /usr/local/libexec/openldap total 28 -rwxr-xr-x 1 root root 808 Sep 29 09:18 lastbind.la -rwxr-xr-x 1 root root 324 Sep 29 09:18 lastbind.lo -rwxr-xr-x 1 root root 4440 Sep 29 09:18 lastbind.o modulepath /usr/local/libexec/openldap moduleload back_bdb.la moduleload back_hdb.la moduleload back_ldap.la moudleload lastbind.la # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: access to dn.base="" by * read access to dn.base="cn=Subschema" by * read access to * by self write by users read by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "o=DSS,c=US" overlay lastbind lastbind-precision 604800 rootdn "cn=Manager,o=DSS,c=US" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret # The database directory MUST exist prior to running slapd AND Thanks, Satish

1 0

Referral record presonse
by Roy Lam 30 Sep '11

30 Sep '11

Dear All, I have two ldap servers.sever a and server are two separate server. server a has a record refer to server b. After a search. server a indicate that b only have 1000 record which should more than that. How Can I fix it? Roy

1 0

How do you have LDAP Setup for Apps
by criderkevin＠aol.com 30 Sep '11

30 Sep '11

I'm learning and testing different ways of configure my LDAP to handle multiple apps. I gave up on groupofnames because I couldn't get searches to pull out the Users in a Group. I have probably 6 or so apps that will use the LDAP. I am leaning towards a simple structure, where each app has it's own branch in the LDAP. My reasoning is: it's easy to configure, may make ACL's easier to setup and manage, it will make searches easier to setup and test, and...why not...after all this isn't a database and duplicated "people" records don't matter. We may end up with 2 synching LDAPS, one for our network and email, and the other for our other apps, simply because the email system requires a very specific structure. Just curious to hear from the more experienced what they do in their structure to handle multiple apps, and how sound my thinking is.

6 6

pwcheck module for slapo-ppolicy
by Lukas Grässlin 29 Sep '11

29 Sep '11

Hi there, I wrote a new pwcheck module for the slapo-ppolicy overlay which is able to handle multiple different policies. My problem was: I have multiple password policies which are applied to different users. The policies differ in strength etc. The problem was that with the only pwcheck modul you can find on the net (https://ltb-project.org/svn/openldap-ppolicy-check-password/trunk/) you just define one 'policy-thing' which will be checked if check-password.so is run. I wanted to have something were you also can define multiple policies which also can differ, so I wrote my own module which reads two config files: $CONFDIR/ppolicies: There are the policies defined. Example: [Default] min_len = 8 min_digit = 1 min_lower = 1 min_special = 1 min_upper = 1 $CONFDIR/users: These file holds the relation between users and policies: uid=lukas,ou=People,dc=example,dc=com : Default Well, it would have been nicer if that policy definition & co would also be stored in ldap, but the config-file-way was the faster one as it had to be finished quick. Whatever, maybe some of you could need this or improve it: http://dl.dropbox.com/u/32193848/pwcheck.tar.bz2 You have to build it within ldap (like the old one). So put it there: $ldapsrcdir/contrib/slapd-modules -- Lukas Grässlin Software Developer Collax GmbH . Basler Str. 115a . 79115 Freiburg . Germany p: +49 (0) 89-990 157-23 Collax - Flexible IT. Geschäftsführer: Bernd Bönte, Boris Nalbach Amtsgericht München, HRB 173695 USt-ID: DE270819312

3 3

Pass-Through Authentication
by Tim Gustafson 29 Sep '11

29 Sep '11

How hard would it be to create a new pass-through authentication mechanism (something other than SASL) for OpenLDAP? Can this be done in an overlay? The reason I ask is that I'm investigating using two-factor authentication. If I understand the marketing materials correctly, both the RSA SecureID system and the WiKID system expose a RADIUS server that clients can authenticate with. The suggested set-up seems to be: OpenLDAP -> SASL -> pam -> RADIUS (on 3rd party token server) This seems like a lot of intermediaries, and a lot of potential "breaking" points. I wonder if there isn't any way to just cut the middle man out, so to speak, and have OpenLDAP talk directly to a RADIUS server, eliminating the other layers inbetween: OpenLDAP -> RADIUS (on 3rd party token server) Perhaps a password scheme like: {RADIUS}user@radius-server I've worked with RADIUS before, and it's not all that bad from a client implementation perspective, especially if you ignore the challenge/response part of the protocol (which most simple authentication services seem to do). Or should I just shut up and use the first method? :) -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Tim Gustafson tjg(a)soe.ucsc.edu Baskin School of Engineering 831-459-5354 UC Santa Cruz Baskin Engineering 317B -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

3 3

keep posixGroup, memberUID and groupOfNames with member synchronous
by andreas.moroder＠sb-brixen.it 28 Sep '11

28 Sep '11

Hello, for samba, pam on linux, squid and others we use the standard posixGroup with memberUID attributes for the groupmemebershios. Now we would like to user the LDAP autentication module in the checkpoint firewall. This expects the members of a group as groupOfNames member attributes with the full dn . Is there a way to configure openLDAP to keep keep the groupofNames automatically in sync with the posixGroup ? Thanks Andreas

2 1

OpenLDAP Proxy to Active Directory
by Allen, Dedrick 28 Sep '11

28 Sep '11

I am currently attempting to configure our OpenLDAP 2.4.26 (on SUSE Enterprise 10) server to act as an proxy to Active Directory as well as using a local database. The local database works fine but I cannot for the life of me get the ldap backend to authenticate/bind correctly to the AD ldap server. I can use ldapsearch to search AD just fine with the credentials passed as follows: ldapsearch -x -h ldap.mydomain.com -D 'myldapuser' -w 'myldappw' -b 'dc=mydomain,dc=com' '(sAMAccountName=myusername)' Returns all the associated data of "myusername" from AD. Here is the section of my slapd.conf for my databases and backends. I have read several different sites on how to configure this and they all use different methods and claim it works for them. None has worked for me. I continue to get bind errors. Any guidance would be much appreciated. database bdb suffix dc=zlinux,dc=mydomain,dc=com rootdn cn=admin,dc=zlinux,dc=mydomain,dc=com rootpw myrootdnpw directory /usr/local/openldap/var/openldap-data index objectClass,uidNumber,gidNumber eq index cn,sn,uid,displayName pres,sub,eq index memberUid,mail,givenname eq,subinitial # # database ldap suffix "dc=Company Users,dc=mydomain,dc=com" uri ldap://ldap.mydomain.com idassert-bind bindmethod=simple binddn="cn=myldapuser,dc=Company Service Accounts,dc=mydomain,dc=com" credentials=myldappw mode=none idassert-authzFrom "dn.exact:cn=cn=myldapuser,dc=Company Service Accounts,dc=mydomain,dc=com" chase-referrals no overlay rwm rwm-map objectclass account user rwm-map attribute uidNumber employeeID rwm-map attribute uid sAMAccountname rwm-map attribute cn name rwm-map attribute sn sn rwm-map attribute mail mail rwm-map attribute company company rwm-map attribute entry entry rwm-map attribute userPassword unicodePassword rwm-map attribute * Thanks Dedrick ----------------------------------------------------- Please see the following link for the BlueCross BlueShield of Tennessee E-mail disclaimer: http://www.bcbst.com/email_disclaimer.shtm

3 3

Installing OpenLDAP OpenSSL not found
by W.Siebert＠t-systems.com 28 Sep '11

28 Sep '11

Hello, I'm trying to install the openldap-2.4.26 on a RHEL 5 server. OpenSSL Version 0.9.8e installed and works pretty with other application e.g. Radiator Header files are present: # find / -name "ssl.h" /usr/include/openssl/ssl.h ./configure CPPFLAGS="-I/usr/include -I/usr/include/openssl/" Result: ................... checking openssl/ssl.h usability... no checking openssl/ssl.h presence... no checking for openssl/ssl.h... no checking gnutls/gnutls.h usability... no checking gnutls/gnutls.h presence... no checking for gnutls/gnutls.h... no checking nssutil.h usability... no checking nssutil.h presence... no checking for nssutil.h... no configure: error: MozNSS not found - please specify the location to the NSPR and NSS header files in CPPFLAGS and the location to the NSPR and NSS libraries in LDFLAGS (if not in the system location) Where is my mistake ? Can you help me please Kind Regards Waldemar Kind regards Waldemar Siebert

3 3

How to install ppolicy?
by Дмитрий Огородников 28 Sep '11

28 Sep '11

Hi dear all I need to install ppolicy overlay on my slapd configured via "cn=config". All that I can find for "cn=config" is a manpage (without describing installation), posts in blogs (mostly very poor) and this mailing list (with many unsolved problems). Is there an initial installation manual, an official documentation or so? Thanks in advance Dmitry

2 1

Startup problem
by Andreas Rudat 28 Sep '11

28 Sep '11

Hello, I have big problems to setup my ldap server. I want it to use for samba later. Here my config. Samba 3.4.7 slapd 2.4.21 ldap.conf BASE dc=stud,dc=intern URI ldap://127.0.0.1 slapd.conf include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/samba.schema database bdb suffix „dc=stud,dc=intern" rootdn „cn=root,dc=stud,dc=intern" rootpw test directory /var/lib/ldap admin.ldif dn: cn=root,dc=stud,dc=intern objectclass: organizationalRole cn: root uid: root uidNumber: 0 gidNumber: 100 ldapadd -D "cn=root,dc=stud,dc=intern" -x -W -f admin.ldif Enter LDAP Password: ldap_bind: Invalid credentials (49) debug output slapd starting connection_get(10) ldap_read: want=8, got=8 0000: 30 2d 02 01 01 60 28 02 0-...`(. ldap_read: want=39, got=39 0000: 01 03 04 19 63 6e 3d 72 6f 6f 74 2c 64 63 3d 73 ....cn=root,dc=s 0010: 74 75 64 2c 64 63 3d 69 6e 74 65 72 6e 80 08 54 tud,dc=intern..t 0020: 65 73 74 65 72 33 32 est ldap_read: want=8 error=Resource temporarily unavailable => ldap_bv2dn(cn=root,dc=stud,dc=intern,0) <= ldap_bv2dn(cn=root,dc=stud,dc=intern)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=root,dc=stud,dc=intern)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=root,dc=stud,dc=intern)=0 send_ldap_result: err=49 matched="" text="" ldap_write: want=14, written=14 0000: 30 0c 02 01 01 61 07 0a 01 31 04 00 04 00 0....a...1.... connection_get(10) ldap_read: want=8, got=0 any idea? Much Thanks Andreas

2 1

deref overlay
by Chris Card 28 Sep '11

28 Sep '11

Hi, I'm trying to use the deref overlay with openldap 2.4.26. I have added this to my slapd.d config: dn: olcOverlay={2}deref,olcDatabase={1}bdb,cn=configobjectClass: olcOverlayConfigobjectClass: olcConfigobjectClass: topolcOverlay: {2}deref which is my guess at what the config for the deref overlay should look like, but when I try and use it with ldap search I get this: /opt/ods/openldap/bin/ldapsearch -h localhost -x -w ***** -D "cn=admin,dc=********,dc=com" -b "dc=**********,dc=com" -E\!deref=member:mail '(objectclass=groupOfNames)'# extended LDIF## LDAPv3# base <dc=blackspider,dc=com> with scope subtree# filter: (objectclass=groupOfNames)# requesting: ALL# with dereference critical control# # search resultsearch: 2result: 12 Critical extension is unavailabletext: critical control unavailable in context # numResponses: 1 slapd was built with these options: ./configure --with-threads=posix \ --with-tls \ --with-cyrus-sasl \ --enable-ldap \ --enable-debug \ --prefix=%{ldapserverdir} \ --libdir=%{ldapserverdir}/%{_lib} \ --enable-spasswd \ --enable-overlays \ --enable-modules \ --enable-slapi so I assume that slapd has the deref overlay built into it ok. I guess my config for the deref overlay is wrong or incomplete. I looked for a slapo-deref man page, but couldn't find one. Is there documentation of the deref overlay config anywhere? Chris

1 0

HP-UX, BDB cache size, db_private
by Michael Ströder 27 Sep '11

27 Sep '11

HI! In a project we have to use HP-UX 11.31 for the OpenLDAP server. But for whatever reason it's not possible to configure more than a certain limit of shared memory cache on this system. The admins responsible for this system claim that there's no limit set for this system user and there's still plenty of RAM...hmmm...does anybody here have a clue? (I'm not familiar with HP-UX at all and the admin files cannot be viewed.) Now they suggested to set BDB-option db_private to use the heap instead of file-based shared memory. I pointed out that the caveats are that 1. one cannot query the cache hit ratio etc. with db_stat and 2. cache is always empty on server restart. db_private turned out to be even worse on this system but still this question: Anymore issues with db_private? Thanks in advance. Ciao, Michael.

2 1

LDAP and SSL
by criderkevin＠aol.com 27 Sep '11

27 Sep '11

I'm struggling with the need for SSL... We will use our new LDAP for apps. These servers are all locally housed so each app server will talk to the LDAP server over our network. (why) Would we need SSL? What about for mail services? It seems to me that our mail server would also talk directly to the LDAP server...what am I missing here that dictates the use of SSL with LDAP? I could see if one had their LDAP open to be accessible direct access from off-network. Perhaps SSL is used simply as a means to authenitcate? Kevin

7 8

JLDAP Search
by criderkevin＠aol.com 26 Sep '11

26 Sep '11

I'm using the example code from the Novell site to perform a Java JLDAP search by uid of my directory. http://developer.novell.com/documentation/samplecode/jldap_sample/index.htm the one called "search.java" My program does this: the main java class prompts the user over and over (it's in a while(true) loop) for search parameters, then executes this search.java method. I'm using this (above) code as is except for the Systems.exit(0). The first time it runs it returns the correct result...but every run after that it returns 0 results. I have to restart my Java program to get it to return the correct result again. There's no public variables in the way...I'm not sure what could be the issue. I've looked through the LDAPConnection.java and nothing looks looks like anything that would corrupt, clear a cache, or queue, or do anything more than what the disconnect (should) does. Anyone run into this?...or have any ideas? Thanks! Kevin

1 1

Migrating from local LDAP auth to LDAP+kerberos
by Tim Watts 26 Sep '11

26 Sep '11

Hi, I like kerberos - been using it for years at other sites. New job - have LDAP, no kerberos. I'd like to backend the existing LDAP server with kerberos - I have some hope as I've just ready this excellent article: http://www.linux-mag.com/id/4765/ (free registration needed) Traditionally, I would have probably have made LDAP open for browsing (no auth) and adapted PAM on the clients to do auth via kerberos. However, I have a load of apps here that only know how to talk and auth against LDAP. Am I right in thinking: 1) Once LDAP is backended with kerberos, that "LDAP authentication" can take place using either a) plain password via LDAP which auths to kerberos; b) GSSAPI (ie using a client side kerberos ticket from a previous kinit) 2) Can I migrate users piecemeal, eg remove their LDAP psswords one by one and (possibly tweaking something on the LDAP directory) have those users auth through to kerberos, while other users auth to the LDAP directory, until everyone is moved? Please excuse the dumbness - I know kerberos, I am just learning LDAP. Or is this going to have to be a big-bang switchover? Cheers Tim -- Tim Watts Personal Blog: http://www.dionic.net/tim/

2 3

inetUserStatus
by Fred 26 Sep '11

26 Sep '11

Hi all, How to process to extend openldap 2.4.23 schema to get netscape inetUserStatus available in my direcdtory ? I don't find links to download this schema. Best regards, Fred

2 1

OpenLDAP with MySQL backend not working
by Victor LAZA 25 Sep '11

25 Sep '11

Hi all, I am using OpenLDAP with MySQL backend for testing purpose, a future project of linux authentication via LDAP but with MySQL backend. For this I am using 2 virtual machines with the following configurations: Centos 5.6 x86_64 Iptables is off Memory: 1 GB of RAM Packages installed on server: openldap.x86_64 , openldap-servers-sql.x86_64 , openldap-servers.x86_64 , openldap-clients.x86_64 (all are version 2.3.43) , openldap24-libs.x86_64 (version 2.4.23) , mysql-connector-odbc.x86_64 (version 3.51.26r1127 ) Packages installed on client: openldap-clients.x86_64 (version 2.3.43) On the server I have created a user ldap, group ldap and granted him FULL access on ldap_test database After that I imported from /usr/share/doc/openldap-servers-sql-2.3.43/rdbms_depend/mysql/ the files: backsql_create.sql , testdb_create.sql , testdb_data.sql , testdb_metadata.sql into the database ldap_test When I try to ldap search from the CLIENT computer with ldapsearch -x it should show me all the contents in the database tried also with ldapsearch -x -D "cn=admin,dc=example,dc=com" -W still no result In a manual check the data is in the MySQL database, in all tables Can someone provide me some info/ideeas on how to configure it to work? Thank you in advance. Below are all my config files and the output from slapd ############ /etc/odbc.ini ############ ; ; odbc.ini configuration for Connector/ODBC and Connector/ODBC 3.51 drivers ; [ODBC Data Sources] mysql = MySQL 3.51 [mysql] driver = mysql server = localhost port = 3306 database = ldap_test user = ldap password = ldappass socket = /var/lib/mysql/mysql.sock [default] driver = MySQL server = localhost port = 3306 database = ldap_test user = ldap password = ldappass socket = /var/lib/mysql/mysql.sock ########## /etc/odbcinst.ini ########## mysql] driver = /usr/lib64/libmyodbc3.so usagecount = 1 ############ /etc/openldap/slapd.conf ############ # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org # Level of LOG loglevel -1 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # Load dynamic backend modules: #modulepath /usr/lib64/openldap/ # Modules available in openldap-servers-overlays RPM package # Module syncprov.la is now statically linked with slapd and there # is no need to load it here # moduleload accesslog.la # moduleload auditlog.la # moduleload denyop.la # moduleload dyngroup.la # moduleload dynlist.la # moduleload lastmod.la # moduleload pcache.la # moduleload ppolicy.la # moduleload refint.la # moduleload retcode.la # moduleload rwm.la # moduleload smbk5pwd.la # moduleload translucent.la # moduleload unique.la # moduleload valsort.la # modules available in openldap-servers-sql RPM package: moduleload /usr/lib64/openldap/back_sql.la # The next three lines allow use of TLS for encrypting connections using a # dummy test certificate which you can generate by changing to # /etc/pki/tls/certs, running "make slapd.pem", and fixing permissions on # slapd.pem so that the ldap user or group can read it. Your client software # may balk at self-signed certificates, however. # TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt # TLSCertificateFile /etc/pki/tls/certs/slapd.pem # TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read access to * by self write by users read by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # SQL database definitions ####################################################################### database sql suffix "dc=example,dc=com" rootdn "cn=admin,dc=example,dc=com" rootpw {SHA}28Jb9vUzoK2ufUP85ZVsNUV9kJ4= dbname ldap_test dbuser ldap dbpasswd ldappass at_query "SELECT name,sel_expr,from_tbls,join_where,add_proc,delete_proc,param_order,expect_r eturn FROM `ldap_test`.`ldap_attr_mappings` WHERE oc_map_id=?" oc_query "SELECT id,name,keytbl,keycol,create_proc,delete_proc,expect_return FROM `ldap_test`.`ldap_oc_mappings`" insentry_query "INSERT INTO `ldap_test`.`ldap_entries` (id,dn,oc_map_id,parent,keyval) values ((select max(id)+1 from `ldap_test`.`ldap_entries`),?,?,?,?)" id_query "SELECT id,keyval,oc_map_id,dn FROM `ldap_test`.`ldap_entries` WHERE dn=?" ######### /etc/openldap/ldap.conf ######### # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. #BASE dc=example, dc=com #URI ldap://ldap.example.com ldap://ldap-master.example.com:666 #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never URI ldap://192.168.200.128/ BASE dc=example,dc=com TLS_CACERTDIR /etc/openldap/cacerts Slapd -d -1 output when in do a ldapsearch -x -D "cn=admin,dc=example,dc=com" -W ##### daemon: activity on 1 descriptor daemon: activity on: slap_listener_activate(7): daemon: epoll: listen=7 busy >>> slap_listener(ldap:///) daemon: activity on 1 descriptor daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: listen=7, new connection on 8 daemon: added 8r (active) listener=(nil) conn=0 fd=8 ACCEPT from IP=192.168.200.131:50069 (IP=0.0.0.0:389) daemon: activity on 2 descriptors daemon: activity on: 8r daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: activity on 1 descriptor daemon: activity on: 8r daemon: read active on 8 daemon: epoll: listen=7 active_threads=0 tvp=NULL connection_get(8) connection_get(8): got connid=0 connection_read(8): checking for input on id=0 ber_get_next ldap_read: want=8, got=8 0000: 30 2e 02 01 01 60 29 02 0....`). ldap_read: want=40, got=40 0000: 01 03 04 1a 63 6e 3d 61 64 6d 69 6e 2c 64 63 3d ....cn=admin,dc= 0010: 65 78 61 6d 70 6c 65 2c 64 63 3d 63 6f 6d 80 08 example,dc=com.. 0020: 61 6c 66 61 62 65 74 61 alfabeta ber_get_next: tag 0x30 len 46 contents: ber_dump: buf=0x2b23ef734cb0 ptr=0x2b23ef734cb0 end=0x2b23ef734cde len=46 0000: 02 01 01 60 29 02 01 03 04 1a 63 6e 3d 61 64 6d ...`).....cn=adm 0010: 69 6e 2c 64 63 3d 65 78 61 6d 70 6c 65 2c 64 63 in,dc=example,dc 0020: 3d 63 6f 6d 80 08 61 6c 66 61 62 65 74 61 =com..alfabeta ber_get_next ldap_read: want=8 error=Resource temporarily unavailable daemon: activity on 1 descriptor do_bind ber_scanf fmt ({imt) ber: ber_dump: buf=0x2b23ef734cb0 ptr=0x2b23ef734cb3 end=0x2b23ef734cde len=43 0000: 60 29 02 01 03 04 1a 63 6e 3d 61 64 6d 69 6e 2c `).....cn=admin, 0010: 64 63 3d 65 78 61 6d 70 6c 65 2c 64 63 3d 63 6f dc=example,dc=co 0020: 6d 80 08 61 6c 66 61 62 65 74 61 m..alfabeta ber_scanf fmt (m}) ber: ber_dump: buf=0x2b23ef734cb0 ptr=0x2b23ef734cd4 end=0x2b23ef734cde len=10 0000: 00 08 61 6c 66 61 62 65 74 61 ..alfabeta >>> dnPrettyNormal: <cn=admin,dc=example,dc=com> => ldap_bv2dn(cn=admin,dc=example,dc=com,0) <= ldap_bv2dn(cn=admin,dc=example,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=admin,dc=example,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=admin,dc=example,dc=com)=0 <<< dnPrettyNormal: <cn=admin,dc=example,dc=com>, <cn=admin,dc=example,dc=com> do_bind: version=3 dn="cn=admin,dc=example,dc=com" method=128 daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL conn=0 op=0 BIND dn="cn=admin,dc=example,dc=com" method=128 ==>backsql_bind() <==backsql_bind() root bind conn=0 op=0 BIND dn="cn=admin,dc=example,dc=com" mech=SIMPLE ssf=0 do_bind: v3 bind: "cn=admin,dc=example,dc=com" to "cn=admin,dc=example,dc=com" send_ldap_result: conn=0 op=0 p=3 send_ldap_result: err=0 matched="" text="" send_ldap_response: msgid=1 tag=97 err=0 ber_flush: 14 bytes to sd 8 0000: 30 0c 02 01 01 61 07 0a 01 00 04 00 04 00 0....a........ ldap_write: want=14, written=14 0000: 30 0c 02 01 01 61 07 0a 01 00 04 00 04 00 0....a........ conn=0 op=0 RESULT tag=97 err=0 text= daemon: activity on 1 descriptor daemon: activity on: 8r daemon: read active on 8 daemon: epoll: listen=7 active_threads=0 tvp=NULL connection_get(8) connection_get(8): got connid=0 connection_read(8): checking for input on id=0 ber_get_next ldap_read: want=8, got=8 0000: 30 36 02 01 02 63 31 04 06...c1. ldap_read: want=48, got=48 0000: 11 64 63 3d 65 78 61 6d 70 6c 65 2c 64 63 3d 63 .dc=example,dc=c 0010: 6f 6d 0a 01 02 0a 01 00 02 01 00 02 01 00 01 01 om.............. 0020: 00 87 0b 6f 62 6a 65 63 74 63 6c 61 73 73 30 00 ...objectclass0. ber_get_next: tag 0x30 len 54 contents: ber_dump: buf=0x2b23ef734cb0 ptr=0x2b23ef734cb0 end=0x2b23ef734ce6 len=54 0000: 02 01 02 63 31 04 11 64 63 3d 65 78 61 6d 70 6c ...c1..dc=exampl 0010: 65 2c 64 63 3d 63 6f 6d 0a 01 02 0a 01 00 02 01 e,dc=com........ 0020: 00 02 01 00 01 01 00 87 0b 6f 62 6a 65 63 74 63 .........objectc 0030: 6c 61 73 73 30 00 lass0. ber_get_next ldap_read: want=8 error=Resource temporarily unavailable do_search daemon: activity on 1 descriptor ber_scanf fmt ({miiiib) ber: ber_dump: buf=0x2b23ef734cb0 ptr=0x2b23ef734cb3 end=0x2b23ef734ce6 len=51 0000: 63 31 04 11 64 63 3d 65 78 61 6d 70 6c 65 2c 64 c1..dc=example,d 0010: 63 3d 63 6f 6d 0a 01 02 0a 01 00 02 01 00 02 01 c=com........... 0020: 00 01 01 00 87 0b 6f 62 6a 65 63 74 63 6c 61 73 ......objectclas 0030: 73 30 00 s0. >>> dnPrettyNormal: <dc=example,dc=com> => ldap_bv2dn(dc=example,dc=com,0) <= ldap_bv2dn(dc=example,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=example,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(dc=example,dc=com)=0 <<< dnPrettyNormal: <dc=example,dc=com>, <dc=example,dc=com> daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL SRCH "dc=example,dc=com" 2 0 0 0 0 begin get_filter PRESENT ber_scanf fmt (m) ber: ber_dump: buf=0x2b23ef734cb0 ptr=0x2b23ef734cd7 end=0x2b23ef734ce6 len=15 0000: 87 0b 6f 62 6a 65 63 74 63 6c 61 73 73 30 00 ..objectclass0. end get_filter 0 filter: (objectClass=*) ber_scanf fmt ({M}}) ber: ber_dump: buf=0x2b23ef734cb0 ptr=0x2b23ef734ce4 end=0x2b23ef734ce6 len=2 0000: 00 00 .. attrs: conn=0 op=1 SRCH base="dc=example,dc=com" scope=2 deref=0 filter="(objectClass=*)" ==>backsql_search(): base="dc=example,dc=com", filter="(objectClass=*)", scope=2, deref=0, attrsonly=0, attributes to load: all ==>backsql_get_db_conn() ==>backsql_open_db_conn(0) <==backsql_open_db_conn(0) backsql_open_db_conn(0): connected, adding to tree. <==backsql_get_db_conn() ==>backsql_dn2id("dc=example,dc=com") matched expected backsql_dn2id("dc=example,dc=com"): id_query "SELECT id,keyval,oc_map_id,dn FROM `ldap_test`.`ldap_entries` WHERE dn=?" backsql_dn2id("dc=example,dc=com"): upperdn="MOC=CD,ELPMAXE=CD" <==backsql_dn2id("dc=example,dc=com"): err=32 send_ldap_result: conn=0 op=1 p=3 send_ldap_result: err=32 matched="" text="" send_ldap_response: msgid=2 tag=101 err=32 ber_flush: 14 bytes to sd 8 0000: 30 0c 02 01 02 65 07 0a 01 20 04 00 04 00 0....e... .... ldap_write: want=14, written=14 0000: 30 0c 02 01 02 65 07 0a 01 20 04 00 04 00 0....e... .... conn=0 op=1 SEARCH RESULT tag=101 err=32 nentries=0 text= daemon: activity on 1 descriptor <==backsql_search() daemon: activity on: 8r daemon: read active on 8 daemon: epoll: listen=7 active_threads=0 tvp=NULL connection_get(8) connection_get(8): got connid=0 connection_read(8): checking for input on id=0 ber_get_next ldap_read: want=8, got=7 0000: 30 05 02 01 03 42 00 0....B. ber_get_next: tag 0x30 len 5 contents: ber_dump: buf=0x2b23ef5e0ba0 ptr=0x2b23ef5e0ba0 end=0x2b23ef5e0ba5 len=5 0000: 02 01 03 42 00 ...B. ber_get_next ldap_read: want=8, got=0 ber_get_next on fd 8 failed errno=0 (Success) connection_read(8): input error=-2 id=0, closing. connection_closing: readying conn=0 sd=8 for close daemon: activity on 1 descriptor connection_close: deferring conn=0 sd=8 daemon: activity on: do_unbind daemon: epoll: listen=7 active_threads=0 tvp=NULL conn=0 op=2 UNBIND connection_resched: attempting closing conn=0 sd=8 connection_close: conn=0 sd=8 ==>backsql_connection_destroy() ==>backsql_free_db_conn() backsql_free_db_conn(): closing db connection 0 (0x2b23ef754530) ==>backsql_close_db_conn(0) <==backsql_close_db_conn(0) <==backsql_free_db_conn() <==backsql_connection_destroy() daemon: removing 8 conn=0 fd=8 closed

2 4

Not able to run OpenLDAP in SLES11
by pradyumna dash 25 Sep '11

25 Sep '11

Hi, I am not able to run OpenLDAP, if am trying to configure it from slapd.conf file. Please find the configuration files as attached. When i run the below command i get the output ldapsearch -x -h 192.168,0.1 -D "cn=Manager,dc=example,dc=com" -b "dc=example,dc=com" -W but when i try either ldapsearch -x or ldapsearch -x -h 192.168.0.1 -b "cn=Manager,dc=example,dc=com" it shows : base <cn=Manager,dc=example,dc=com> with scope subtree filter: (objectclass=*) requesting: ALL #search result search: 2 result: 32 No such object #numResponse: 1 OS : SLES 11 SP1 LDAP : 2.4.20-0.4.29 What i have changed is insted of dynamic backend i am trying to use slapd.conf file so i have changed in /etc/sysconfig/openldap file OPENLDAP_CONFIG_BACKEND="files". Please suggest how to solve this. Regards, Neo

3 3

Unable to start slapd, syncrepl error
by William S. 24 Sep '11

24 Sep '11

Oh the wise and mighty of the openLDAP community, I have an issue that I have not been able to understand. Partially because Im an enthusitis, not an expert in the domain. That being said, I've used an openLDAP RPM compiled by one of the fellow *nix admins: http://staff.telkomsa.net/packages - Yes, besides the security reasons I'm desparate enough to try this. I'll eventually use the spec to compile my own RPM. I'm running CentOS 5.7 x86_64 with the latest packages. I was able to successfully install and configure openLDAP but when I attempt to start it with MIrrorMode, it will not start. I ran slaptest to figure out where it's hanging up on: [root@ldap1 ~]# slaptest2.4 -f /etc/openldap2.4/slapd.conf /etc/openldap2.4/slapd.conf: line 207: rootDN must be defined before syncrepl may be used slaptest2.4: bad configuration file! Any suggestions why it continues to complain about rootDN? I have it specified and if slapd is going through the lines, it should have picked up the rootdn before syncrepl. Thoughts? Here is my slapd.conf: include /usr/share/openldap2.4/schema/core.schema include /usr/share/openldap2.4/schema/cosine.schema include /usr/share/openldap2.4/schema/corba.schema include /usr/share/openldap2.4/schema/inetorgperson.schema include /usr/share/openldap2.4/schema/java.schema include /usr/share/openldap2.4/schema/krb5-kdc.schema include /usr/share/openldap2.4/schema/kerberosobject.schema include /usr/share/openldap2.4/schema/misc.schema include /usr/share/openldap2.4/schema/nis.schema include /usr/share/openldap2.4/schema/openldap.schema include /usr/share/openldap2.4/schema/autofs.schema include /usr/share/openldap2.4/schema/samba.schema include /usr/share/openldap2.4/schema/kolab.schema include /usr/share/openldap2.4/schema/evolutionperson.schema include /usr/share/openldap2.4/schema/calendar.schema include /usr/share/openldap2.4/schema/sudo.schema include /usr/share/openldap2.4/schema/dnszone.schema include /usr/share/openldap2.4/schema/dhcp.schema #include /usr/share/openldap2.4/schema/rfc822-MailMember.schema #include /usr/share/openldap2.4/schema/pilot.schema #include /usr/share/openldap2.4/schema/qmail.schema #include /usr/share/openldap2.4/schema/mull.schema #include /usr/share/openldap2.4/schema/netscape-profile.schema #include /usr/share/openldap2.4/schema/trust.schema include /etc/openldap2.4/schema/local.schema include /etc/openldap2.4/slapd.access.conf access to dn.subtree="dc=domain,dc=pvt" by group="cn=Replicator,ou=Group,dc=domain,dc=pvt" by users read by anonymous read pidfile /var/run/ldap2.4/slapd.pid argsfile /var/run/ldap2.4/slapd.args modulepath /usr/lib64/openldap2.4 # database backend modules available: #moduleload back_dnssrv.la #moduleload back_ldap.la #moduleload back_meta.la moduleload back_monitor.la #moduleload back_passwd.la #moduleload back_sql.la # overlay modules available: #moduleload accesslog.la #moduleload denyop.la #moduleload dyngroup.la #moduleload dynlist.la #moduleload glue.la #moduleload lastmod.la #moduleload pcache.la #moduleload ppolicy.la #moduleload refint.la #moduleload retcode.la #moduleload rwm.la moduleload syncprov.la #moduleload translucent.la #moduleload unique.la #contrib overlays #moduleload smbk5pwd.so # SASL config #sasl-host ldap.domain.com # To allow TLS-enabled connections, create /etc/ssl/openldap2.4/ldap.pem # and uncomment the following lines. #TLSRandFile /dev/random #TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCertificateFile /etc/pki/tls/private/ldap.pem TLSCertificateKeyFile /etc/pki/tls/private/ldap.pem #TLSCACertificatePath /etc/ssl/openldap2.4/ #TLSCACertificateFile /etc/ssl/cacert.pem TLSCACertificateFile /etc/pki/tls/private/ldap.pem #TLSVerifyClient never # ([never]|allow|try|demand) # logging #loglevel 256 ####################################################################### # database definitions ####################################################################### database bdb suffix "dc=domain,dc=pvt" #suffix "o=My Organization Name,c=US" rootdn "cn=Manager,dc=domain,dc=pvt" #rootdn "cn=Manager,o=My Organization Name,c=US" # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret # rootpw {crypt}ijFYNcSNctBYg rootpw {SSHA}[NeeeNer NeeeNer NeeeNer] # The database directory MUST exist prior to running slapd AND # should only be accessable by the slapd/tools. Mode 700 recommended. directory /var/lib/ldap2.4 # Tuning settings, please see the man page for slapd-bdb for more information # as well as the DB_CONFIG file in the database directory # commented entries are at their defaults # In-memory cache size in entries #cachesize 1000 # Checkpoint the bdb database after 256kb of writes or 5 minutes have passed # since the last checkpoint checkpoint 256 5 # Indices to maintain index objectClass eq # persion-type searches index cn,mail,surname,givenname eq,subinitial # nss_ldap exact searches: index uidNumber,gidNumber,memberuid,member,uniqueMember eq # username completion via nss_ldap needs uid indexed sub: index uid eq,subinitial # samba: index sambaSID,sambaDomainName,displayName eq # autofs: #index nisMapName eq # bind sdb_ldap: #index zoneName,relativeDomainName eq # sudo index sudoUser eq # syncprov #index entryCSN,entryUUID eq limits group="cn=Replicator,ou=Group,dc=domain,dc=pvt" size=unlimited time=unlimited database monitor overlay syncprov syncprov-checkpoint 10 1 syncprov-sessionlog 100 syncrepl rid=000 provider=ldap://ldap1.oak.domain.pvt type=refreshAndPersist interval=01:00:00:00 retry="5 5 300 +" rootdn="dc=domain,dc=pvt" attrs="*,+" bindmethod=simple binddn="cn=Manager,dc=domain,dc=pvt" credentials=domain1 syncrepl rid=001 provider=ldap://ldap2.oak.domain.pvt type=refreshAndPersist interval=01:00:00:00 retry="5 5 300 +" rootdn="dc=domain,dc=pvt" attrs="*,+" bindmethod=simple binddn="cn=Manager,dc=domain,dc=pvt" credentials=domain1 mirrormode TRUE serverID 1

2 1

Schema question... userPassword doesn't work
by John Tobin 24 Sep '11

24 Sep '11

To the ldap forum: I have loaded suse 12.1 m5. I have setup an openldap server, which was the main mission of this machine, and it works. It has ssl /tls, certificates are loaded, that works. I used ldap client to setup the ldap browser and that works also. This is the new 2.4.26 server, which has some rather major changes in how ldap is setup. After about 2 weeks I have that under control. My little domain is setup on dark.net [dc=dark,dc=net]. I used ldapadd to put in the administrator, and I have used ldapsearch to list the subschema. I took the default schema. The list of the subschema includes everything I would like to use. Now I want to go about the real business of defining users. I have reviewed a number of pages to ensure I am doing what appears to be the correct procedure, for instance : http://www.yolinux.com/TUTORIALS/LinuxTutorialLDAP-BindPW.html Which lists: File: fratbrother.ldif dn: cn=fratbrother,o=delta cn: fratbrother sn: fratbrother objectclass: top objectclass: person userPassword: fratsecret ldapadd -f fratbrother.ldif -cxv -D "cn=DeanWormer,o=delta" -w secret2 And other similar updates. But on my machine I create something simple like: File : dark.ldif dn: cn=jctobin,dc=dark,dc=net cn: jctobin userPassword: Hello1$ Ldapadd -x -D ³cn=admin,dc=dark,dc=net² -W -f dark.ldif Enter LDAP Password: Adding new entry ³cn=jctobin,dc=dark,dc=net² Ldap_add: Object class violation (65) Additional info: no objectClass attribute Obviously my ldap server does not like the ³userPassword² class. I have not been able to use any of the other classes I would like to either [ou: (organizational Unit), uid (unix term for a number corresponding to the user id), etc.] What have I not setup correctly? I need to get these users up and running. What can you do for me? Sincerely, Tob

2 1

Tutorial to make an overlay‏?
by Johan Jakus 24 Sep '11

24 Sep '11

Hello everyone, I'm Johan and I am in the final year of my studies in industrial engineering. For my stage, I've been asked to make an overlay for an OpenLDAP server. But, I can't find any documentation on how to make an overlay, could someone please redirect me to a tutorial or something likewise? I would really appreciate it! Thanks! Best regards, Johan

2 1

rwm + cn=config
by Frava 24 Sep '11

24 Sep '11

Hello, I use the rwm overlay to forward the authentication of some users to the general ldap replicas of my corp. Part of slapd.conf : ########################### ... overlay rwm rwm-rewriteEngine on rwm-rewriteContext bindDN rwm-rewriteMap ldap mysearch "ldap:// ldap.example.com:389/ou=users,dc=example,dc=com?dn?sub" rwm-rewriteRule "^uid=([^,]+),ou=people,dc=[^,]+,dc=example,dc=com$" "${mysearch((&(objectClass=posixAccount)(uid=$1)))}" ":@I" database ldap suffix "ou=users,dc=example,dc=com" uri "ldap://ldap.example.com:389/" restrict read write extended database bdb suffix "dc=example,dc=com" rootdn "cn=admin,dc=example,dc=com" rootpw mypassword directory /var/db/openldap-data/mydb ... ############################ Now I converted the 'slapd.conf' to 'cn=config' with slaptest, the remote authentication stopped working; and looking at cn=config, all the rules are there... Any Ideas ? Rafael NAVAZA.

2 2

schema question
by John Tobin 24 Sep '11

24 Sep '11

To the ldap forum: I have loaded suse 12.1 m5. I have setup an openldap server, which was the main mission of this machine, and it works. It has ssl /tls, certificates are loaded, that works. I used ldap client to setup the ldap browser and that works also. This is the new 2.4.26 server, which has some rather major changes in how ldap is setup. After about 2 weeks I have that under control. My little domain is setup on dark.net [dc=dark,dc=net]. I used ldapadd to put in the administrator, and I have used ldapsearch to list the subschema. I took the default schema. The list of the subschema includes everything I would like to use. Now I want to go about the real business of defining users. I have reviewed a number of pages to ensure I am doing what appears to be the correct procedure, for instance : http://www.yolinux.com/TUTORIALS/LinuxTutorialLDAP-BindPW.html Which lists: File: fratbrother.ldif dn: cn=fratbrother,o=delta cn: fratbrother sn: fratbrother objectclass: top objectclass: person userPassword: fratsecret ldapadd -f fratbrother.ldif -cxv -D "cn=DeanWormer,o=delta" -w secret2 And other similar updates. But on my machine I create something simple like: File : dark.ldif dn: cn=jctobin,dc=dark,dc=net cn: jctobin userPassword: Hello1$ Ldapadd -x -D “cn=admin,dc=dark,dc=net” -W -f dark.ldif Enter LDAP Password: Adding new entry “cn=jctobin,dc=dark,dc=net” Ldap_add: Object class violation (65) Additional info: no objectClass attribute Obviously my ldap server does not like the “userPassword” class. I have not been able to use any of the other classes I would like to either [ou: (organizational Unit), uid (unix term for a number corresponding to the user id), etc.] What have I not setup correctly? I need to get these users up and running. tob

2 1

migrating from (old) /etc/shadow to LDAP
by Gerardo Herzig 23 Sep '11

23 Sep '11

Hi all. Im migrating the /etc/shadow accounts to an LDAP enviroment. As the /etc/shadow containing server has suffered several upgrades, there is more than one crypto mechanism applied. Some entries are in the form $2a$10$..... this is an {CRYPT} entry, and have no problems with that. Others (the oldest ones) doesn't seem to have a prefix at all. There are "short" strings like bHwTgdCTnfpco lJvWLr8sfW.Hg and so on... I tried with {MD5}, {SHA} + encrypted password with no luck. Any one knows which crypto mechanism is applied here? I think they are from an old Suse 9.1 (not the Enterprise Server Edition, the realy old SuSE 9.1) Thanks! Gerardo

5 12

Re: migrating from (old) /etc/shadow to LDAP
by Juergen.Sprenger＠swisscom.com 23 Sep '11

23 Sep '11

Hi Gerardo, the 'short strings' You mentioned are 13-character DES password hashes. For security reasons they should not be used anymore if possible. Putting {crypt} in front of them should be sufficient for conversion. Normalizing the passwords might become difficult if only their DES hashes are available. Especially in a heterogenous environment using simple authentication together with ssl/tls will prevent some trouble. In that case OpenLDAP will take care of the crypto algorithm, creation of password hashes and so on while clients just send plaintext passwords over an encrypted ssl/tls connection to the LDAP server. This will also prevent trouble if there is no common algorithm supported by all OS flavors and releases in Your environment which use LDAP for authentication. Regards Juergen

2 1

MirrorMode sync only happening in one direction
by Daniel Qian 23 Sep '11

23 Sep '11

The problem direction has the same syncrepl configuration as the working one except for the rid and provider name: olcSyncrepl: {0} rid=102 provider="ldap://server2.prod:389/" type=refreshAndPersist retry="60 30 300 +" keepalive=1200:10:3 searchbase="dc=mydomain,dc=com" bindmethod=simple binddn="cn=replica,dc=mydomain,dc=com" credentials=xxxxxx starttls=critical tls_cacert="/etc/pki/CA/cacert.pem" On the consumer side I am seeing these messages: Sep 22 22:02:02 ldaprov1 slapd[15466]: do_syncrep2: rid=102 got search entry without Sync State control Sep 22 22:02:02 ldaprov1 slapd[15466]: do_syncrepl: rid=102 rc -1 retrying (29 retries left) and on the provider side I am seeing these: Sep 22 18:02:36 localhost slapd[20718]: conn=1071 fd=21 ACCEPT from IP=10.10.2.103:35671 (IP=0.0.0.0:389) Sep 22 18:02:36 localhost slapd[20718]: conn=1071 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Sep 22 18:02:36 localhost slapd[20718]: conn=1071 op=0 STARTTLS Sep 22 18:02:36 localhost slapd[20718]: conn=1071 op=0 RESULT oid= err=0 text= Sep 22 18:02:36 localhost slapd[20718]: conn=1071 fd=21 TLS established tls_ssf=256 ssf=256 Sep 22 18:02:36 localhost slapd[20718]: conn=1071 op=1 BIND dn="cn=replica,dc=mydomain,dc=com" method=128 Sep 22 18:02:36 localhost slapd[20718]: conn=1071 op=1 BIND dn="cn=replica,dc=mydomain,dc=com" mech=SIMPLE ssf=0 Sep 22 18:02:36 localhost slapd[20718]: conn=1071 op=1 RESULT tag=97 err=0 text= Sep 22 18:02:36 localhost slapd[20718]: conn=1071 op=2 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(objectClass=*)" Sep 22 18:02:36 localhost slapd[20718]: conn=1071 op=2 SRCH attr=* + Sep 22 18:02:36 localhost slapd[20718]: conn=1071 op=2 SEARCH RESULT tag=101 err=0 nentries=22 text= Sep 22 18:02:36 localhost slapd[20718]: conn=1071 op=3 UNBIND Sep 22 18:02:36 localhost slapd[20718]: conn=1071 fd=21 closed Sep 22 18:02:36 localhost slapd[20718]: connection_read(21): no connection! Sep 22 18:02:36 localhost slapd[20718]: connection_read(21): no connection! Sep 22 18:03:37 localhost slapd[20718]: conn=1072 fd=21 ACCEPT from IP=10.10.2.103:35672 (IP=0.0.0.0:389) Sep 22 18:03:37 localhost slapd[20718]: conn=1072 op=0 EXT oid=1.3.6.1.4.1.1466.20037 Sep 22 18:03:37 localhost slapd[20718]: conn=1072 op=0 STARTTLS Sep 22 18:03:37 localhost slapd[20718]: conn=1072 op=0 RESULT oid= err=0 text= Sep 22 18:03:37 localhost slapd[20718]: conn=1072 fd=21 TLS established tls_ssf=256 ssf=256 Sep 22 18:03:37 localhost slapd[20718]: conn=1072 op=1 BIND dn="cn=replica,dc=mydomain,dc=com" method=128 Sep 22 18:03:37 localhost slapd[20718]: conn=1072 op=1 BIND dn="cn=replica,dc=mydomain,dc=com" mech=SIMPLE ssf=0 Sep 22 18:03:37 localhost slapd[20718]: conn=1072 op=1 RESULT tag=97 err=0 text= Sep 22 18:03:37 localhost slapd[20718]: conn=1072 op=2 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(objectClass=*)" Sep 22 18:03:37 localhost slapd[20718]: conn=1072 op=2 SRCH attr=* + Sep 22 18:03:37 localhost slapd[20718]: conn=1072 op=2 SEARCH RESULT tag=101 err=0 nentries=22 text= Sep 22 18:03:37 localhost slapd[20718]: conn=1072 op=3 UNBIND Sep 22 18:03:37 localhost slapd[20718]: conn=1072 fd=21 closed Sep 22 18:03:37 localhost slapd[20718]: connection_read(21): no connection! Sep 22 18:03:37 localhost slapd[20718]: connection_read(21): no connection! The sync connection is supposed to be persistent but it keeps closing down and reconnecting. Anyone know what could be the reason? Thanks, Daniel

3 5

Newbie here
by brown wrap 23 Sep '11

23 Sep '11

I have downloaded and installed OpenLDAP from www.sunfreeware.com. I have also installed the required supporting software. I know nothing about OpenLDAP. This is my first exposure. It will be on a test setup, running on old SPARCstations. I have settup the conf file, started slapd and it returns to the the prompt. Adding the debug flag shows its complaining about Berkley DB. Has someone here made a similar setup? I don't have access to the machine at this point. Its not connected to the net. I was just wondering if someone else had a like install. Thanks.

1 0

virtually merging objects under a single DIT
by Perrin, David 22 Sep '11

22 Sep '11

I'm hoping to support an administrator of an application who would like to authenticate users that may exist in one of multiple LDAP sources. The application can provide a single base DN, username, and password. I can get close by using database ldap and rwm to rewrite the base of multiple sources to a common one: ou=DC Users 1,dc=proxy,dc=myorg,dc=org ou=DC Users 2,dc=proxy,dc=myorg,dc=org But I'd like to go a step further and present user objects from both sources under a single suffix point like: ou=DC Users 1 and 2,dc=proxy,dc=myorg,dc=org. Is there a way to virtually merge / flatten the structure from multiple sources? Thank you, Dave

1 1

ldappasswd -T
by David Dumortier 22 Sep '11

22 Sep '11

Hello, I tried to set a password with the -T option. It failed so I tried -d 11 to see the dump in hexa. I discovered that a 0xa is append to the password. Is it a bug ? if so please confirm I will open a bugreport. Version : squeeze/debian -- David Dumortier

3 4

slapo-pcache and multiple hits won't cache
by turbo＠bayour.com 21 Sep '11

21 Sep '11

I'm using slapd-meta to merge a proxied AD (proxy is OL running on 'hidden' port) with a external OL server (running on separate host). The meta seems to work, using '(uid=kpxb140)' (which is my UNIX account name at work) gives me two results, one from the AD and one from the external OL server. This is verified, because the objects look different (and comparing them with the 'original' source verifies this as well). But on top (tail) of that, I'm using pcache... The afformentioned search gives: QUERY NOT ANSWERABLE QUERY CACHEABLE each time (i.e., it doesn't actually write to the cache). A modified search '(&(objectClass=account)(uid=kpxb140))' or '(&(objectClass=person)(uid=kpxb140))' gives only ONE hit (the first from the OL server, the second from AD). This time I get the correct behaviour - it is cached into BDB... Is this expected behaviour or a bug? If the latter, ITS# and expected fix?

2 2

ldap && rwm && pcache && transparent
by Turbo Fredriksson 20 Sep '11

20 Sep '11

I'm trying to proxy an AD and an OpenLDAP server on a separate machine to get a 'combined' view. First problem (or the primary one?) is that the DN doesn't match. AD: cn=turbo,ou=Office,ou=Users,ou=org1,dc=org2,dc=company,dc=tld OL: uid=turbo,ou=People,dc=org3,dc=company,dc=tld We have absolutely no write/modify access to the AD (we barely got search/compare access to parts of the AD! And the OL server... There's way to much work to modify (as in massaging the DB and reload it) that (at the moment). It's also running 2.3 at the moment, and we don't want to upgrade that any time soon. The theory is/was to: 1. Setup a LDAP/META proxy to the AD to act as the 'local' DB. 2. Rewrite the AD DNs to match the OL DB 3. Cache some common queries 4. Glue the OL DB with the AD DB, the OL acting as the 'remote' DB. Unfortunately, I can't get step four to work. Any queries seem to loop to the localhost. I guess I could use rwm on the OL server to massage the DN (before it's presented to clients and the proxy), but I much rather do any rewrite etc on my new proxy server if possible. OR Setup a second OL server on the current OL server, but on a different port (hidden), which proxies the main OL and rewrites the DN to match the AD. This hidden server could then be proxied by the new LDAP proxy, cached etc... But either of the alternative solution isn't pretty :). I'll have to maintain and support THREE LDAP servers (one DB and two proxies), which seems a little to much work. And besides, the OL have all the UNIX (posixAccount etc) stuff (only), with very few users (most of the organization don't need UNIX accounts) and most of the clients is configured to use that when searching etc. There's also other reasons why we would like to keep the OL server layout... Parts of my slapd.conf: ####################################################################### database ldap suffix "dc=company,dc=tld" rootdn "cn=Manager,dc=company,dc=tld" rootpw "secret" # --------------------------------------------------------------------- ##### Active Directory Server (will act as LOCAL DB) uri ldap://ad.company.tld idassert-bind bindmethod=simple binddn ="cn=unixldap,ou=service,ou=users,ou=selud,dc=rd,dc=company,dc=tld" credentials="Secret1" mode=none idassert-authzFrom "*" # --------------------------------------------------------------------- #### Rewrite/Remap # http://www.openldap.org/its/index.cgi/Software%20Bugs?id=5941#followup7 overlay rwm rwm-rewriteEngine yes rwm-normalize-mapped-attrs yes rwm-map attribute uid sAMAccountName rwm-map attribute gecos displayName rwm-map attribute workPhone telephoneNumber rwm-map attribute address1 streetAddress rwm-map attribute city l rwm-map attribute state st rwm-map attribute zip postalCode rwm-map attribute country co rwm-map attribute c country rwm-map attribute distinguishedName entryDN rwm-map objectclass inetOrgPerson user rwm-map objectclass groupOfNames group rwm-rewriteContext searchEntryDN rwm-rewriteRule "cn=(.*)?ou=Office,ou=Users,ou=ORG1,dc=ORG2,(.*)" "uid=$1ou=People,dc=ORG3,$2" ":@" rwm-rewriteContext searchAttrDN alias searchEntryDN rwm-rewriteContext matchedDN alias searchEntryDN # --------------------------------------------------------------------- #### Proxy Cache overlay pcache pcache hdb 2500 3 1 300 pcacheAttrset 0 uid uidNumber gidNumber cn sn givenName distinguishedName pcacheAttrset 1 c physicalDeliveryOfficeName streetAddress mail pcacheAttrset 2 uid uidNumber gidNumber cn sn givenName distinguishedName c physicalDeliveryOfficeName streetAddress mail pcacheTemplate (uid=) 0 3600 pcacheTemplate (cn=) 0 3600 pcacheTemplate (|(uid=)(cn=)) 0 3600 pcacheTemplate (|(cn=)(uid=)) 0 3600 pcacheTemplate (objectClass=) 2 3600 pcacheTemplate (|(objectClass=)(cn=)) 2 3600 pcacheTemplate (gecos=) 1 3600 pcacheTemplate (&(sn=)(givenName=)) 1 3600 cachesize 20 directory /usr/local/turbo/var/openldap-data index objectClass eq index cn,sn,uid,mail pres,eq,sub # --------------------------------------------------------------------- #### Translucent Proxy overlay translucent translucent_strict yes #translucent_local uid,uidNumber,gidNumber,cn,sn,givenName,distinguishedName,mail #translucent_remote uid,uidNumber,gidNumber,cn,sn,givenName,distinguishedName,mail ### OpenLDAP Server (will act as REMOTE DB) uri "ldap://ol.company.tld/" network-timeout 3 chase-referrals no acl-bind binddn="cn=Manager,dc=company,dc=tld" credentials="secret" idassert-bind bindmethod=simple binddn="cn=Manager,dc=company,dc=tld" credentials="Secret2" mode=none idassert-authzFrom "*" ####################################################################### Disclaimer: Much of this haven't been optimized yet. I'll fine tune and tweak stuff once I could get it to work... -- Life sucks and then you die

2 2

slapindex with translucent overlay
by Hugo Monteiro 20 Sep '11

20 Sep '11

Hello, I have recently discovered that i'm not using the indexes i should, in one translucent overlay database, for the locally stored attributes. This being a production server, i would like to know if changing index configuration and running slapindex on that database is enough to reindex the data. Regards, Hugo Monteiro. -- fct.unl.pt:~# cat .signature Hugo Monteiro Email : hugo.monteiro(a)fct.unl.pt Telefone : +351 212948300 Ext.15307 Web : http://hmonteiro.net Divisão de Informática Faculdade de Ciências e Tecnologia da Universidade Nova de Lisboa Quinta da Torre 2829-516 Caparica Portugal Telefone: +351 212948596 Fax: +351 212948548 www.fct.unl.pt apoio(a)fct.unl.pt fct.unl.pt:~# _

2 3

slapd crash on bad indexed translucent
by Hugo Monteiro 20 Sep '11

20 Sep '11

Hello, I would like to report that i have been able to replicate a crash on slapd. Problem was noticed when performing a substring query on a translucent overlay database attribute, locally stored, which only had equality index. slapd version is 2.4.23 (debian squeeze slapd-2.4.23-7.2) on an amd64 xen vm. Should i file an ITS for this one? Regards, Hugo Monteiro. -- fct.unl.pt:~# cat .signature Hugo Monteiro Email : hugo.monteiro(a)fct.unl.pt Telefone : +351 212948300 Ext.15307 Web : http://hmonteiro.net Divisão de Informática Faculdade de Ciências e Tecnologia da Universidade Nova de Lisboa Quinta da Torre 2829-516 Caparica Portugal Telefone: +351 212948596 Fax: +351 212948548 www.fct.unl.pt apoio(a)fct.unl.pt fct.unl.pt:~# _

2 1

Double passwords in accounts
by Nick Milas 20 Sep '11

20 Sep '11

Hello, Based on the fact that the userPassword attribute is NOT single-valued in the schema definition, I was wondering whether there are cases where we could use a double-password approach or if doing that would just cause a mess. For example, could we store both a clear-text password (to be used e.g. in DIGEST authentication) AND an encrypted (SSHA or MD5) one for standard use? If that could work, (I assume that) openldap would know which one to use based on the negotiation with the client application, which would normally try different authentication methods in a particular order. Openldap would then use the right password automatically (ideally), depending on the authentication method used each time. Any info would be appreciated. Thanks, Nick

2 2

What expect to log at info level?
by Nick Urbanik 20 Sep '11

20 Sep '11

Dear Team, I'm using CentOS 5, some machines with OpenLDAP 2.3.43-12, some with 2.4.23-15, on both 32 and 64-bit architectures. I am puzzled by the lack of logging I see. In all cases, I am using slapd.conf OpenLDAP configuration. I am running slapd with the option -l local0: # ps auxwww | grep slap[d] ldap 17866 0.0 1.7 242104 9000 ? Ssl 15:54 0:00 /usr/sbin/slapd -h ldap:/// -u ldap -l local0 With this in /etc/syslog.conf: local0.info -/var/log/ldap and this: # grep loglevel /etc/openldap/slapd.conf loglevel -1 I get nothing logged when I restart OpenLDAP, nor when I search (and get output). However, if I change the /etc/syslog.conf entry to: local0.* -/var/log/ldap I get plenty of output into /var/log/ldap. QUESTIONS: 1. What should I expect to be logged at info priority with loglevel -1? 2. Does anyone have any suggestions of what I may be missing here? -- Nick Urbanik http://nicku.org 808-71011 nick.urbanik(a)optusnet.com.au GPG: 7FFA CDC7 5A77 0558 DC7A 790A 16DF EC5B BB9D 2C24 ID: BB9D2C24 I disclaim, therefore I am.

5 12

open LDAP + TLS/SSL mini draft howto
by Olivier 20 Sep '11

20 Sep '11

Vijay, This may help. Check that each file is properly readable Best --- Olivier ---------- Forwarded message ---------- From: Olivier <ldap(a)guillard.nom.fr> Date: Thu, Aug 11, 2011 at 2:23 PM Subject: tls extra mini howto To: openldap-technical(a)openldap.org Having spent quite some time to make a TLS work I thought this may be usefull to some : 1/ Create a self CA certificate : a/ create the CA.key private key : $ openssl genrsa -des3 -out CA.key 1024 b/ create the CA.crt certificate : $ openssl req -new -key CA.key -x509 -days 1095 -out CA.crt 2/ for each ldap server (if you have more than one) create a certificat : a/ create the server.key private key : openssl genrsa -out server.key b/ create a server.csr certificate request: openssl req -new -key server.key -out server.csr c/ create the server.crt certificate signed by your own CA : openssl x509 -req -days 2000 -in server.csr -CA CA.crt -CAkey CA.key -CAcreateserial -out server.crt 3/ configure slapd.conf ( the correct "server.key" and "server.crt" files must be copied on each server): TLSCACertificateFile /etc/openldap/cacerts/CA.crt TLSCertificateFile /etc/openldap/cacerts/server.crt TLSCertificateKeyFile /etc/openldap/cacerts/server.key TLSCipherSuite HIGH:MEDIUM:+SSLv2 # personnally, I only check servers from client. # If you do, add this : TLSVerifyClient never 4/ on clients : copy CA.crt to the right place ( normally should be somewhere in /etc/pki..), and add this in ldap.conf : TLS_CACERT /etc/openldap/cacerts/CA.crt If you use sssd, add this in /etc/sssd/sssd.conf : lldap_tls_cacert = /etc/openldap/cacerts/CA.crt ldap_tls_reqcert = demand Then you can test using ldapsearch with -Z Best --- Olivier NOTE : I have'nt been able to make it work with mozilla certutil

1 0

Re: open LDAP + TLS/SSL bind Failed.
by vijay s sheelavantar 20 Sep '11

20 Sep '11

Thank you very much Buchan. I have changed the certificate creation method. Now I created the certificates using CA.sh of openssl.I followed the instruction given in the below link to create the certificates. http://octaldream.com/~scottm/talks/ssl/opensslca.html 1. At the server side now i am able to do ldapsearch and ldapadd, as i have chenged the /usr/local/etc/openldap/ldap.conf on server to remove IP address. I have made necessary changes in /etc/hosts file also. BASE    dc=samsung,dc=comURI     ldaps://localhost.localdomain/TLS_CACERT      /etc/pki/CA/cacert.pemTLS_CACERTDIR   /etc/pki/CA/ 2.slapd.conf details for TLS are as follows TLSCipherSuite          HIGH:MEDIUM:+SSLv2:+SSLv3:RSATLSCACertificatePath    /etc/pki/CA/TLSCACertificateFile    /etc/pki/CA/cacert.pemTLSCertificateFile      /etc/pki/tls/misc/newcert.pemTLSCertificateKeyFile   /etc/pki/tls/misc/newkey.pemTLSVerifyClient         allow 3. I have copied the "cacert.pem" which is CA and "newcert.pem" which my server certificate to the client machine. I have copied these files to /etc/openldap/cacerts directory on client machine. and I have made the following configuration changes to "/etc/ldap.conf" file at the client side. base dc=samsung,dc=comuri ldaps://localhost.localdomain/tls_cacertfile  /etc/openldap/cacerts/cacert.pemtls_cert /etc/openldap/cacerts/newcert.pempam_password md5nss_map_attribute gecos description When the "TLSVerifyClient  allow" is specified in slapd.conf, I am able to login to the client machine properly, authentication is succesful. but when "TLSVerifyClient  demand" and when I try to login to the client machine the authentication is failing. I am getting the following error at the server side. TLS trace: SSL3 alert write:fatal:handshake failureTLS trace: SSL_accept:error in SSLv3 read client certificate BTLS: can't accept: error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate.connection_read(12): TLS accept failure error=-1 id=1005, closingconnection_closing: readying conn=1005 sd=12 for closeconnection_close: conn=1005 sd=12daemon: activity on 1 descriptordaemon: activity on:daemon: removing 12conn=1005 fd=12 closed (TLS negotiation failure) please let me know where i am making mistake? how can i correct this and make it work properly? Thanks & Regards,Vijay S.

1 0

Re: LDAP Dynamic Library Creation Failed.
by vijay s sheelavantar 19 Sep '11

19 Sep '11

I checked in the config.log file it's really a huge file. I found few errors. which are as below. configure:10558: checking for shl_load in -ldldconfigure:10583: /opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc -o conftest -g -O2 -I/product/wibro/premium/src/APP/Protocols/ASNGW/vijay/db-4.8.26/build_unix -Bshareable conftest.c -ldld   >&5/opt/montavista/pro/devkit/mips/fp_be/bin/../lib/gcc-lib/mips-hardhat-linux/3.3.1/../../../../mips-hardhat-linux/bin/ld: cannot find -ldldcollect2: ld returned 1 exit status configure:15013: /opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc -o conftest -g -O2 -I/product/wibro/premium/src/APP/Protocols/ASNGW/vijay/db-4.8.26/build_unix -Bshareable conftest.c  -lrpcrt4 >&5conftest.c:88: error: parse error before "UuidCreate"conftest.c:88: warning: data definition has no type or storage classconftest.c:89: error: parse error before "UuidToStringA"conftest.c:89: warning: data definition has no type or storage classconfigure:15013: $? = 1 configure:19146: /opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc -o conftest -g -O2 -I/product/wibro/premium/src/APP/Protocols/ASNGW/vijay/db-4.8.26/build_unix -Bshareable conftest.c  -pthread -lresolv  >&5conftest.c:106: error: parse error before "rwlock"conftest.c:106: warning: data definition has no type or storage class conftest.c:125: error: too many arguments to function `ctime_r'conftest.c:133: error: too few arguments to function `gethostbyname_r'conftest.c:136: error: too few arguments to function `gethostbyaddr_r' onfigure:22645: /opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc -c -g -O2 -I/product/wibro/premium/src/APP/Protocols/ASNGW/vijay/db-4.8.26/build_unix conftest.c >&5conftest.c: In function `main':conftest.c:170: error: parse error before ')' token conftest.c:173: error: size of array `test_array' is negative conftest.c:247: error: structure has no member named `msg_accrightslen' Is there any problem with the libtool? I am not quite familiar with libtool.  

2 1

Quick newbie pointer - unauth ldap* commands as root on ldap master
by Tim Watts 19 Sep '11

19 Sep '11

Hi, Sorry - this will sound really dumb... For people who aren't very LDAP savvy, what the cleanest way to rig an LDAP server that I have root access to to: allow unprompted ldap* commands (eg ldapmodify). GoSA has got confused creating a user and I need to manually force some ldif files with minor changes through... MIT Kerberos has a kdamin.local command that does not care about authentication because it has direct access to the database files. Is there something similar for OpenLDAP? This is a files based ldap server, not using SQL. I have located an ldap.secret file but am having trouble authenticating with its content. I'm fairly confused because LDAP appears to have many many ways to handle authentication... Many thanks, Tim -- Tim Watts Personal Blog: http://www.dionic.net/tim/

2 4

Fwd: Re: pcache crashes server
by turbo＠bayour.com 19 Sep '11

19 Sep '11

[My reply should have gone to the list - using a new webclient at work] -------- Original Message -------- Subject: Re: pcache crashes server Date: Mon, 19 Sep 2011 12:09:37 +0200 From: Pierangelo Masarati <masarati(a)aero.polimi.it> To: turbo(a)bayour.com On 09/19/2011 11:39 AM, turbo(a)bayour.com wrote: > On Mon, 19 Sep 2011 10:57:53 +0200, Pierangelo Masarati wrote: >> On 09/19/2011 09:48 AM, turbo(a)bayour.com wrote: >>> I'm trying to use pcache on my server, but it crashes every time it >>> gets a >>> 'QUERY CACHABLE'... >>> >>> See my config in my other thread... >> >> What other thread? Please, always provide a link to the archives, to >> help others help you. > > http://www.openldap.org/lists/openldap-technical/201109/msg00160.html I know, maybe others don't. You should reply to the list. I already gave all the advice I could. p. >>> So it gets the value from the AD, transmogrifying it using rwm and >>> sends >>> the reply to the >>> client. But when getting to the pcache overlay, it crashes... >> >> The root cause is likely rwm. This won't fix at least until 2.5, for >> reasons explained in ITSes involving slapo-rwm. Please decouple the >> two overlays, at the cost of adding an intermediate proxy. > > Where you thinking of ITS#6166 here (it was referenced in ITS#6997) > or > some other ITS? >

1 2

Re: open LDAP + TLS/SSL bind Failed.
by arun.sasi1＠wipro.com 19 Sep '11

19 Sep '11

Daniel, Please perform the below steps to create certificate... $ /usr/lib/ssl/misc/CA.pl -newreq $ /usr/lib/ssl/misc/CA.pl -signreq $ openssl rsa < newkey.pem > clearkey.pem then $ sudo cp cacert.pem /usr/share/ca-certificates/Domain.crt Then, edit the /etc/ca-certificates.conf file, and add Domain.crt at the end of the file. Finally, run update-ca-certificates: $ sudo update-ca-certificates Updating certificates in /etc/ssl/certs....done. Thanks, -Arun Message: 9 Date: Sun, 18 Sep 2011 22:59:51 -0400 From: Daniel Qian <daniel(a)up247solution.com> To: openldap-technical(a)openldap.org Subject: Re: open LDAP + TLS/SSL bind Failed. Message-ID: <4E76B027.9020800(a)up247solution.com> Content-Type: text/plain; charset="utf-8"; Format="flowed" On 11-09-16 3:57 AM, vijay s sheelavantar wrote: > Hi, > I am trying to configure LDAP Client/server on 2 Fedora-10 linux machines. > > I have installed and configured openldap-2.4.26 server on one machine > and pam_ldap-186, nss_ldap-265 on the other machines. > > I have created the TLS certificates using following command on the server. > > openssl req -newkey rsa:1024 -x509 -nodes -out \ server.pem -keyout > server.pem -days 3650 > > and I have created the client.pem by copying CERTIFICATE portion of > the server.pem. > > When my client try to connect to the server I get following errors. > > *TLS trace: SSL3 alert read:fatal:unknown CA > TLS trace: SSL_accept:failed in SSLv3 read client certificate A > TLS: can't accept: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 > alert unknown ca. > connection_read(12): TLS accept failure error=-1 id=1012, closing > connection_closing: readying conn=1012 sd=12 for close > connection_close: conn=1012 sd=12 > daemon: removing 12 > conn=1012 fd=12 closed (TLS negotiation failure) > * > My Configurations are as follows. > > slapd.conf > > access to attrs=userPassword > by self write > by anonymous auth > by * none > > access to * > by * read > > #TLS Certificate section > TLSCipherSuite HIGH:MEDIUM:+SSLv2:+SSLv3:RSA > TLSCACertificateFile /etc/openldap/cacerts/server.pem > TLSCertificateFile /etc/openldap/cacerts/server.pem > TLSCertificateKeyFile /etc/openldap/cacerts/server.pem > TLSVerifyClient allow > > and client side ldap.conf > > base dc=samsung,dc=com > uri ldaps://10.254.204.181/ > TLS_CACERT /etc/openldap/cacerts/client.pem > pam_password md5 > > nsswitch.conf > > passwd: files ldap > shadow: files ldap > group: files ldap > > netgroup: files ldap > automount: files ldap > > I am not getting why it is saying Unknown ca. even though the > certificate is created on server machine itself. > > Kindly help me to solve this problem. > <http://sigads.rediff.com/RealMedia/ads/click_nx.ads/www.rediffmail.com/ signatureline.htm@Middle?> > Treat yourself at a restaurant, spa, resort and much more with *Rediff > Deal ho jaye! > <http://track.rediff.com/click?url=___http://dealhojaye.rediff.com?sc_ci d=mailsignature___&cmp=signature&lnk=rediffmailsignature&newservice=deal s>* you may try this cd /etc/openldap/cacerts/ ln -s client.pem `openssl x509 -noout -hash -in client.pem`.0

1 0

Re: open LDAP + TLS/SSL bind Failed.
by vijay s sheelavantar 19 Sep '11

19 Sep '11

Thank you very much Buchan. I have changed the certificate creation method. Now I created the certificates using CA.sh of openssl.I followed the instruction given in the below link to create the certificates. http://octaldream.com/~scottm/talks/ssl/opensslca.html 1. At the server side now i am able to do ldapsearch and ldapadd, as i have chenged the /usr/local/etc/openldap/ldap.conf on server to remove IP address. I have made necessary changes in /etc/hosts file also. BASE    dc=samsung,dc=comURI     ldaps://localhost.localdomain/TLS_CACERT      /etc/pki/CA/cacert.pemTLS_CACERTDIR   /etc/pki/CA/ 2.slapd.conf details for TLS are as follows TLSCipherSuite          HIGH:MEDIUM:+SSLv2:+SSLv3:RSATLSCACertificatePath    /etc/pki/CA/TLSCACertificateFile    /etc/pki/CA/cacert.pemTLSCertificateFile      /etc/pki/tls/misc/newcert.pemTLSCertificateKeyFile   /etc/pki/tls/misc/newkey.pemTLSVerifyClient         allow 3. I have copied the "cacert.pem" which is CA and "newcert.pem" which my server certificate to the client machine. I have copied these files to /etc/openldap/cacerts directory on client machine. and I have made the following configuration changes to "/etc/ldap.conf" file at the client side. base dc=samsung,dc=comuri ldaps://localhost.localdomain/tls_cacertfile  /etc/openldap/cacerts/cacert.pemtls_cert /etc/openldap/cacerts/newcert.pempam_password md5nss_map_attribute gecos description When the "TLSVerifyClient  allow" is specified in slapd.conf, I am able to login to the client machine properly, authentication is succesful. but when "TLSVerifyClient  demand" and when I try to login to the client machine the authentication is failing. I am getting the following error at the server side. TLS trace: SSL3 alert write:fatal:handshake failureTLS trace: SSL_accept:error in SSLv3 read client certificate BTLS: can't accept: error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate.connection_read(12): TLS accept failure error=-1 id=1005, closingconnection_closing: readying conn=1005 sd=12 for closeconnection_close: conn=1005 sd=12daemon: activity on 1 descriptordaemon: activity on:daemon: removing 12conn=1005 fd=12 closed (TLS negotiation failure) please let me know where i am making mistake? how can i correct this and make it work properly? Thanks & Regards,Vijay S.

1 0

pcache crashes server
by turbo＠bayour.com 19 Sep '11

19 Sep '11

I'm trying to use pcache on my server, but it crashes every time it gets a 'QUERY CACHABLE'... See my config in my other thread... This is a localy compiled OpenLDAP v2.4.26 with localy compiled Berkeley DB v5.1.25 on a CentOS v5.6 (Final). ----- s n i p ----- [...] => access_allowed: read access granted by read(=rscxd) conn=1000 op=1 ENTRY dn="uid=kpxb140,ou=people,dc=seml,dc=company,dc=tld" ber_flush2: 80 bytes to sd 17 0000: 30 4e 02 01 02 64 49 04 33 75 69 64 3d 6b 70 78 0N...dI.3uid=kpx 0010: 62 31 34 30 2c 6f 75 3d 50 65 6f 70 6c 65 2c 64 b140,ou=People,d 0020: 63 3d 73 65 6d 6c 2c 64 63 3d 00 00 00 00 00 00 c=seml,dc=xxxxxx 0030: 65 6e 65 63 61 2c 64 63 3d 6e 65 74 30 12 30 10 xxxxx,dc=net0.0. 0040: 00 00 00 00 00 31 09 04 07 6b 70 78 62 31 34 30 ..uid1...kpxb140 ldap_write: want=80, written=80 0000: 30 4e 02 01 02 64 49 04 33 75 69 64 3d 6b 70 78 0N...dI.3uid=kpx 0010: 62 31 34 30 2c 6f 75 3d 50 65 6f 70 6c 65 2c 64 b140,ou=People,d 0020: 63 3d 73 65 6d 6c 2c 64 63 3d 00 00 00 00 00 00 c=seml,dc=xxxxxx 0030: 00 00 00 00 00 2c 64 63 3d 6e 65 74 30 12 30 10 xxxxx,dc=net0.0. 0040: 04 03 75 69 64 31 09 04 07 6b 70 78 62 31 34 30 ..uid1...kpxb140 <= send_search_entry: conn 1000 exit. Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x41001940 (LWP 16414)] 0x00002aaaad0919c9 in pcache_op_cleanup (op=0x89ad40, rs=0x41000c10) at pcache.c:2369 2369 Attribute *a = rs->sr_entry->e_attrs; (gdb) bt #0 0x00002aaaad0919c9 in pcache_op_cleanup (op=0x89ad40, rs=0x41000c10) at pcache.c:2369 #1 0x000000000043f797 in ?? () #2 0x0000000000441a7a in slap_send_search_entry () #3 0x00002aaaaca0d9fe in ldap_back_search (op=0x89ad40, rs=0x41000c10) at search.c:361 #4 0x0000000000494722 in overlay_op_walk () #5 0x0000000000494c87 in ?? () #6 0x0000000000432f09 in fe_op_search () #7 0x0000000000433715 in do_search () #8 0x0000000000430c65 in ?? () #9 0x000000000043123f in ?? () #10 0x00002aaaaaac1f38 in ldap_int_thread_pool_wrapper (xpool=0x79d1d0) at tpool.c:685 #11 0x000000397c80673d in start_thread () from /lib64/libpthread.so.0 #12 0x000000397bcd40cd in clone () from /lib64/libc.so.6 ----- s n i p ----- ----- s n i p ----- [kpxb140@semldx00135 LDAPv3]$ alias ldapsearch.local alias ldapsearch.local='/usr/local/turbo/bin/ldapsearch -LLL -x -h localhost -b dc=company,dc=tld' [kpxb140@semldx00135 LDAPv3]$ ldapsearch.local 'uid=kpxb140' uid dn: uid=kpxb140,ou=People,dc=org1,dc=company,dc=tld uid: kpxb140 ldap_result: Can't contact LDAP server (-1) ----- s n i p ----- So it gets the value from the AD, transmogrifying it using rwm and sends the reply to the client. But when getting to the pcache overlay, it crashes...

2 1

Rename DN ?
by Tim Watts 19 Sep '11

19 Sep '11

Hi folks, Quick question if I may: Is it possible to rename a DN, eg this LDIF file: dn: cn=Fred,ou=people,dc=example,dc=com changetype: modify replace: dn dn: cn=Fred,ou=people,ou=external,dc=example,dc=com I tried that, and ldapmodify does not seem to like it :( Many thanks, Tim -- Tim Watts Personal Blog: http://www.dionic.net/tim/

3 3

open LDAP + TLS/SSL bind Failed.
by vijay s sheelavantar 19 Sep '11

19 Sep '11

Hi, I am trying to configure LDAP Client/server on 2 Fedora-10 linux machines. I have installed and configured openldap-2.4.26 server on one machine and pam_ldap-186, nss_ldap-265 on the other machines. I have created the TLS certificates using following command on the server. openssl req -newkey rsa:1024 -x509 -nodes -out \ server.pem -keyout server.pem -days 3650 and I have created the client.pem by copying CERTIFICATE portion of the server.pem. When my client try to connect to the server I get following errors. TLS trace: SSL3 alert read:fatal:unknown CA TLS trace: SSL_accept:failed in SSLv3 read client certificate A TLS: can't accept: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca. connection_read(12): TLS accept failure error=-1 id=1012, closing connection_closing: readying conn=1012 sd=12 for close connection_close: conn=1012 sd=12 daemon: removing 12 conn=1012 fd=12 closed (TLS negotiation failure) My Configurations are as follows. slapd.conf access to attrs=userPassword by self write by anonymous auth by * none access to * by * read #TLS Certificate section TLSCipherSuite HIGH:MEDIUM:+SSLv2:+SSLv3:RSA TLSCACertificateFile /etc/openldap/cacerts/server.pem TLSCertificateFile /etc/openldap/cacerts/server.pem TLSCertificateKeyFile /etc/openldap/cacerts/server.pem TLSVerifyClient allow and client side ldap.conf  base dc=samsung,dc=com uri ldaps://10.254.204.181/ TLS_CACERT /etc/openldap/cacerts/client.pem pam_password md5 nsswitch.conf passwd: files ldap shadow: files ldap group: files ldap netgroup: files ldap automount: files ldap I am not getting why it is saying Unknown ca. even though the certificate is created on server machine itself. Kindly help me to solve this problem.

4 3

Re: SASL and non-cleartext passwords storage
by Julien Vehent 18 Sep '11

18 Sep '11

On 18.09.2011 14:36, Jacobus brogly.decap wrote: > No, encrypting passwords over the wire is somthing TOTALLY different > and > seperate from how they are stored on disk (in case you want to > migrate or > export) > Dont solve 2 different problems at the same time,..I recommend you > read > chapter 2 of IBM redbook on LDAP. > My apologies for not being clear. Let me go back to the initial problem. I have postfix, cyrus-imapd and openldap installed on a debian. I do not care about protecting passwords over the wire because I already use ldaps for all communications with slapd. postfix and cyrus-imapd both use ldapdb plugins to verify users against slapd. ldapdb is configured to authenticate postfix and cyrus-imap with their own private users, and then a proxy authorization is performed to take the identify of the real users. ex: postfix uses the user "postfixldap" and once authenticated, takes the identity of user "julien" +--------+ +----------+ |postfix | | cyrus | +--------+ +--------+-+ | | proxy | |proxy ldapdb ldapdb | +-----------+ |user "cyrusldap" user | | slapd | | +------->user=julien<--------+ "postfixldap" | | +-----------+ This method is nice because it avoid having an additional software in between postfix and cyrus (pam-ldap or saslauthd). But the problem is that ldapdb requires to use DIGEST-MD5 and therefore to store the passwords in cleartext in the directory. I'm looking for a solution to avoid storing the messages in cleartext. Is it possible while still using ldapdb in postfix and cyrus-imap ? Julien

2 1

Re: SASL and non-cleartext passwords storage
by Julien Vehent 18 Sep '11

18 Sep '11

On 18.09.2011 12:30, Jacobus brogly.decap wrote: > Sure, just choose "a schema" there are many hashes to choose from > SHA1-SHA2, MD5 etc...you can look it up in the admin guide on the > openldap.org [2] website...setting it up is really trivial! How is this going to work with proxy authorization ? the ldapdb auxprop plugin in postfix doesn't work with hash passwords. Should I go back to using saslauthd ? > 2011/9/18 Julien Vehent > >> Hi List, >> >> I'm working on a setup where postfix and cyrus-imap do proxy >> authorization against openldap (my setup is here http://1nw.eu/!cD >> [1] >> ). I love this solution, it's a lot more elegant that using >> saslauthd. >> But I'm concerned about passwords stored in cleartext, as required >> by >> DIGEST-MD5. >> >> I know of the many ways to protect the data stored in openldap (file >> system encryption, etc...), but if somebody gets a root access, >> passwords will be disclosed, and I want to prevent that. >> >> My question is: Is there a way to use hashed passwords with sasl and >> proxy authorization ? >> >> Thanks, >> Julien Links: ------ [1] http://1nw.eu/!cD [2] http://openldap.org [3] mailto:julien@linuxwall.info

1 0

SASL and non-cleartext passwords storage
by Julien Vehent 18 Sep '11

18 Sep '11

Hi List, I'm working on a setup where postfix and cyrus-imap do proxy authorization against openldap (my setup is here http://1nw.eu/!cD ). I love this solution, it's a lot more elegant that using saslauthd. But I'm concerned about passwords stored in cleartext, as required by DIGEST-MD5. I know of the many ways to protect the data stored in openldap (file system encryption, etc...), but if somebody gets a root access, passwords will be disclosed, and I want to prevent that. My question is: Is there a way to use hashed passwords with sasl and proxy authorization ? Thanks, Julien

1 0

Re: How to disable cn=config module in OpenLDAP
by pradyumna dash 17 Sep '11

17 Sep '11

Hi, Please find the configuration files as attached. When i run the below command i get the output ldapsearch -x -h 192.168,0.1 -D "cn=Manager,dc=example,dc=com" -b "dc=example,dc=com" -W but when i try either ldapsearch -x or ldapsearch -x -h 192.168.0.1 -b "cn=Manager,dc=example,dc=com" it shows : base <cn=Manager,dc=example,dc=com> with scope subtree filter: (objectclass=*) requesting: ALL #search result search: 2 result: 32 No such object #numResponse: 1 OS : SLES 11 SP1 LDAP : 2.4.20-0.4.29 What i have changed is insted of dynamic backend i am trying to use slapd.conf file so i have changed in /etc/sysconfig/openldap file OPENLDAP_CONFIG_BACKEND="files". Please suggest how to solve this. Regards, Neo On Wed, Sep 14, 2011 at 8:47 PM, Bill MacAllister <whm(a)stanford.edu> wrote: > > > --On Wednesday, September 14, 2011 07:46:17 PM +0200 pradyumna dash < > neomatrixgem(a)gmail.com> wrote: > > Hi, >> >> Yes i tried below >> >> ldapsearch -x -h l <http://somehost.com/>dap1.**example.com<http://dap1.example.com/>-b >> >> cn=Manager,dc=example,dc=com >> > > If that is the command line that you used no wonder you didn't get > the results you expected. > > > It asked me to provide the password i have provided that then it shows the >> same error, nothing came up. >> > > Why don't you provide exactly what you typed and and what the response > was? Just cut and paste it into a _text_ message. Sending HTML just > muddies the waters already murky waters. > > The -x requests a simple bind and since you have not provided a bind DN > or bind password it will attempt an anonymous bind. It is hard to believe > that you are seeing what you report. The host where the ldap server is > running is actually named 'ldap1.example.com'? > > > I have checked my ldap.conf as well it looks okay. >> > > Unless you were going to include the ldap.conf file this statement was > a waste of bytes. > > > Bill > > Regards, >> Neo >> >> On Wed, Sep 14, 2011 at 6:41 PM, Bill MacAllister <whm(a)stanford.edu> >> wrote: >> >> >>> >>> --On Wednesday, September 14, 2011 06:35:09 PM +0200 pradyumna dash < >>> neomatrixgem(a)gmail.com> wrote: >>> >>> Hi, >>> >>>> >>>> ldapsearch -x shows the content of LDAP database as well wothout any >>>> additional options. I can see the same in one of my servers,I took a >>>> dump >>>> of >>>> the running server by slapcat and restored the same in this server. >>>> >>>> I can see the data by slapcat but ldapsearch is not working. >>>> >>>> The box where ldap running fine its using slapd.d backend, but this >>>> server >>>> i >>>> have configured to run from slapd.conf file, can it be a issue with the >>>> DB >>>> backup and restore as they are both using different backend? >>>> >>>> Regards, >>>> Neo >>>> >>>> >>> Did you even try my suggestion? The error message that you got back, >>> i.e. >>> "32 no such object" is telling you that you have not supplied a baseDN >>> for the search. >>> >>> Bill >>> >>> P.S. Top posting to replies sucks. >>> >>> >>> On Wed, Sep 14, 2011 at 6:29 PM, Bill MacAllister <whm(a)stanford.edu> >>> >>>> wrote: >>>> >>>> >>>> >>>>> --On Wednesday, September 14, 2011 06:20:03 PM +0200 pradyumna dash < >>>>> neomatrixgem(a)gmail.com> wrote: >>>>> >>>>> I have fixed this by deleting the slapd.d and also changed the script >>>>> to >>>>> >>>>> read slapd.conf file but now >>>>>> >>>>>> when am trying ldapserach -x its showing 32 no such object >>>>>> >>>>>> but the below command works >>>>>> >>>>>> ldapsearch -LLL -Wx -D "cn=Manager,dc=mail,dc=domain,******dc=com >>>>>> >>>>>> why is that ? >>>>>> >>>>>> >>>>>> Because you did it wrong. There is not enough information in your >>>>> message to tell much more than you contacted an LDAP server and >>>>> got an error message. You might want to try using a fully specified >>>>> search and work back from there. For example: >>>>> >>>>> ldapsearch -x -h somehost.com -b cn=sometree,dc=domain,dc=com >>>>> >>>>> Bill >>>>> >>>>> >>>>> Regards, >>>>> >>>>> Neo >>>>>> On Wed, Sep 14, 2011 at 5:34 PM, pradyumna dash < >>>>>> neomatrixgem(a)gmail.com >>>>>> > wrote: >>>>>> >>>>>> Hi , >>>>>> >>>>>> >>>>>>> Can i disable cn=config module, I just want to use plain old >>>>>>> slapd.conf >>>>>>> file. How to disable that. So that LDAP wont use the directory. >>>>>>> >>>>>>> Am using SLES 11 SP1 and i tried deleteting the directory but if i am >>>>>>> unable to restart the service. >>>>>>> >>>>>>> Regards, >>>>>>> Neo >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>> -- >>>>> >>>>> Bill MacAllister >>>>> Infrastructure Delivery Group, Stanford University >>>>> >>>>> >>>>> >>>>> >>> >>> -- >>> >>> Bill MacAllister >>> Infrastructure Delivery Group, Stanford University >>> >>> >>> > > > -- > > Bill MacAllister > Infrastructure Delivery Group, Stanford University > >

1 1

Re: slapd does not creating pid file
by sim123 17 Sep '11

17 Sep '11

On Fri, Sep 16, 2011 at 12:01 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Friday, September 16, 2011 11:46 AM -0700 sim123 <Sim3159(a)gmail.com> > wrote: > > Hi, >> >> >> I am using openldap 2.4.25 and configured location of pidfile and >> argsfile in slapd.conf. However, when running slapd its not creating pid >> file or args file. On searching for this issue I found the bug reported >> earlier stating similar problem. Is that fixed or do I need to do some >> other configuration. >> > > It works for me. Perhaps slapd can't write to the location you specified. > I am running it as root. And found out that if I CD into libexec directory and run slapd from there it all works. However if I run it like /opt/openldap-2.4.25/libexec/slapd no .pid or .args get created. And I am giving absolute path for pidFile and argsFile in slapd.conf Thanks > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

slapd does not creating pid file
by sim123 16 Sep '11

16 Sep '11

Hi, I am using openldap 2.4.25 and configured location of pidfile and argsfile in slapd.conf. However, when running slapd its not creating pid file or args file. On searching for this issue I found the bug reported earlier stating similar problem. Is that fixed or do I need to do some other configuration. Thanks

2 1

Re: secure passwords
by sim123 16 Sep '11

16 Sep '11

On Wed, Sep 14, 2011 at 3:28 PM, Jacobus brogly.decap < jacobusbogers(a)gmail.com> wrote: > > > I want to do the same thing, > > Best way is to do it via a module , there is an example in the src > distribution > > /openldap-2.4.23/contrib/slapd-modules/passwd/sha2 > > basicly you dont want cleartext password stored in the DIT, so you want to > hash it > > I tried ppolicy overlay with ppolicy_hash_cleartext on, looks like its doing SSHA with ldapadd or ldapmodify operations. However, just wondering if this is the best way. Thanks > Cheers, > > Jacob > 2011/9/14 sim123 <Sim3159(a)gmail.com> > >> >> >> On Wed, Sep 14, 2011 at 3:00 AM, Buchan Milne <bgmilne(a)staff.telkomsa.net >> > wrote: >> >>> On Tuesday, 13 September 2011 23:01:23 sim123 wrote: >>> > Hi All, >>> > >>> > I am trying to store SSHA passwords in openldap instead of plain text >>> via C >>> > code and wondering how this works. I tried exploring archives, FAQ etc >>> and >>> > what I gathered from there is openLDAP has built in support for various >>> > password encryption algorithm however it does not have any APIs for >>> > generating passwords >>> >>> Are you sure? >>> >>> > and password-has directive works with ldpapassword >>> > utility only. >>> >>> Really? It seems to work fine from pam_ldap (using 'pam_password exop'), >>> Net::LDAP and various other tools. >>> >>> > http://www.openldap.org/faq/data/cache/906.html >>> > >>> > If I use some tool like Apache DS and modify my userPassword attribute >>> to >>> > be SSHA instead of plain text it all works. I want to know how this >>> works >>> > under the hood? Who is responsible for generating hashed passwords? If >>> I >>> > generate it using some C routine how does LDAP Server retrieves it >>> during >>> > the bind operation? I would really appreciate if there is any related >>> > documentation available. >>> >>> Maybe you should read about the Password Modification extended operation >>> .... >>> >>> IMHO, you shouldn't be hashing passwords on the client-side, it is much >>> better >>> to let the DS hash the password in the format it is configured for (so >>> you >>> know it will actually be able to use the password, and allowing you to >>> use >>> newer/stronger hashes as and when the DS supports them, without coding >>> the >>> support yourself). >>> >> >> I agree that DS should hash the password, however I am not sure what >> password modification extended operation is, is it ldappasswd utility or >> does openLDAP offer some kind of API to do so? Also can how can I configure >> hashing in SLAPD? >> >> Basically my C program will call ldap_add_ext_s() operation, while doing >> that how can I make sure that userPassword attribute be treated differently >> (hashed)? I was looking into password policy and not sure if it suffice my >> needs. >> >>> >>> Regards, >>> Buchan >>> >> >> >

1 0

LDAP Dynamic Library Creation Failed.
by vijay s sheelavantar 16 Sep '11

16 Sep '11

Hi, I am trying to cross compile openldap-2.4.26 using the following command for MIPS. ./configure --host=mips CC=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc LD=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-ld LDFLAGS=-Bshareable CPPFLAGS="-I/product/wibro/premium/src/APP/Protocols/ASNGW/vijay/db-4.8.26/build_unix" AR=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-ar RANLIB=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-ranlib NM=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-nm STRIP=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-strip OBJDUMP=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-objdump --enable-dynamic=yes AS=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-as --enable-shared=yes --with-yielding_select=no The configuration and make is going well, but at the end it is not creating the required dynamic libraries.only static libraries are getting created.  I have observed the following points during configuration checking whether a program can dlopen itself... cross checking if libtool supports shared libraries... no checking whether to build shared libraries... no checking whether to build static libraries... yes I tried to enable dynamic library creation by giving option --enable-shared=yes. But it didn't work out. please help me how can i solve this problem. Thanks & Regards,Vijay S.

2 1

Moving LDAP DB directory
by Bram Cymet 16 Sep '11

16 Sep '11

Hi, I am wondering if I have an ldap tree with olcDbDirectory: /var/lib/ldap. Would I be able to move just that tree to a different directory. Say /var/lib/ldap/someotherdir? Or do I have to throw everything away and start over? -- Bram Cymet Software Developer Canadian Bank Note Co. Ltd. 613-608-9752

1 0

ldap proxy acl filter problem
by Ron Peterson 16 Sep '11

16 Sep '11

Hi, (OpenLDAP version 2.4.23) I have a filter expression in an ACL that is somehow affecting my ability to retrieve specific attributes. What's strange (to me) is that with or without the filter expression in place, I can retrieve all attributes, i.e. the full object. 4986# ldapsearch -LLL -Z -x -y ../../private/pwemail '(uid=rpeterso)' dn: yDirectoryID=c44883ba-ac62-d28c-556f-99ccbf532da7,ou=email yDirectoryID: c44883ba-ac62-d28c-556f-99ccbf532da7 objectClass: yAccount objectClass: inetOrgPerson uid: rpeterso mail: rpeterso(a)mtholyoke.edu etc... But if I specify a particular attribute, then having the filter expression in place somehow inhibits my ability to retrieve the specific attribute(s). Without filter expression: 4987# ldapsearch -LLL -Z -x -y ../../private/pwemail '(uid=rpeterso)' mail dn: yDirectoryID=c44883ba-ac62-d28c-556f-99ccbf532da7,ou=email mail: rpeterso(a)mtholyoke.edu With filter expression in place: 4990# ldapsearch -LLL -Z -x -y ../../private/pwemail '(uid=rpeterso)' mail dn: yDirectoryID=c44883ba-ac62-d28c-556f-99ccbf532da7,ou=email The ACL in question looks like: access to dn.regex="(yDirectoryID=.*),ou=email" filter="(&(yInstitution=mtholyoke.edu)(yGlobalPermission=allow)(|(yApplicationPermission=email)(&(yDefaultApplicationPermission=allow)(!(yApplicationPermission=email)))))" by dn.regex=$1,ou=people,ou=accounts,ou=prod,dc=mtholyoke,dc=edu read by dn="uid=email,ou=admin,ou=accounts,ou=prod,dc=mtholyoke,dc=edu" read by * none I've turned my logging way up, and the hiccup seems to be that the DN I've authenticated as (uid=email,ou=admin,ou=accounts,ou=prod,dc=mtholyoke,dc=edu) needs read access to the attributes in the filter expression. But how do I give that account read access to those attributes, without then exposing the objects that I'm trying to hide with the filter expression? -- Ron Peterson Network & Systems Administrator Mount Holyoke College http://www.mtholyoke.edu/~rpeterso

2 3

Generating unique identifier
by sim123 16 Sep '11

16 Sep '11

Does openldap support generating unique identifier or guids, I need to generate it using a ldap C API and wondering if DS does that for me or do I need my own GUID generator in application. Thanks for the help and support.

2 1

authz-regexp in conf.d
by Bram Cymet 15 Sep '11

15 Sep '11

Hi, I would like to use authz-regexp so that I can map users DN's to the auth DN that sasl with GSSAPI expects. I have found lots of slapd.conf examples of how to do this but I am using conf.d for my configuration. Does anyone have an example ldif file that I can use to add authz-regexp? Thanks, -- Bram Cymet Software Developer Canadian Bank Note Co. Ltd. 613-608-9752

2 2

OpenLDAP / PAM: No Username
by Denis Witt 15 Sep '11

15 Sep '11

Hi, I'm running OpenLDAP 2.4.23-7.2 (from Debian Squeeze). Most of the time everything works fine, the LDAP-Server is used by libpam/libnss, Samba, Dovecot and Postfix. Sometimes when I log into the Server via SSH the command prompt displays "Ich habe keinen Benutzernamen@servername" (which means "I don't have a username") instead of my username. The login itself works fine. The real problem is that if this happens the Mailserver isn't able to deliver mails: status=bounced (unknown user: "myusername") Using google I found some other users with the "don't have a username"-Problem, but most of the time they had a ACL-Problem. As the LDAP-Server usually is working it seems that this isn't the problem. Also the problem is gone when I restart the whole machine (just restarting slapd doesn't help). Any ideas? -- Regards, Denis Witt

2 4

Where to get valid LDAP library (libldap.so)?
by vijay s sheelavantar 15 Sep '11

15 Sep '11

Hi, I am getting following error while compiling pam_ldap for MIPS. configure: error: could not locate a valid LDAP library I compiled openldap-2.4.26 for mips and gave the path, but I couldn't find libldap.so in that openldap-2.3.26. I need libldap.so source code so that I can compile it for my architecture. please help me to get libldap.so. Warm Regards VIJAY S.

1 0

Re: Open LDAP Installation/Configuration Failed.
by vijay s sheelavantar 15 Sep '11

15 Sep '11

Thanq very much Aaron Richton. Now I am able to cross compile openldap successfully. but it didn't create the libldap.so library? Please let me know how i can create this libldap.so library??

1 0

Deleting database config
by Styopa Semenukha 15 Sep '11

15 Sep '11

Hi, I have a testing database which appears in slapcat output as: --- dn: olcDatabase={2}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {2}hdb olcDbDirectory: /var/mytest olcSuffix: dc=example,dc=org olcRootDN: cn=admin,dc=example,dc=org olcRootPW:: <password cut> olcDbIndex: objectClass eq olcDbIndex: memberUid eq structuralObjectClass: olcHdbConfig entryUUID: cdabedf0-6a03-1030-90e5-d10501c8fbf2 creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20110902230532Z olcAccess: {0}to attrs=userPassword by anonymous auth by dn="cn=replication,dc=example,dc=org" read by self write by * none olcAccess: {1}to dn.subtree="ou=People,dc=example,dc=org" by users read by * none olcAccess: {2}to * by dn="cn=replication,dc=example,dc=org" read entryCSN: 20110905234735.466413Z#000000#000#000000 modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth modifyTimestamp: 20110905234735Z --- I need to drop it completely. To delete data I stop slapd, rm /var/mytest/* and restart slapd. But I also need to drop database config. I tried: # ldapdelete -r -Y EXTERNAL -H ldapi:/// "olcDatabase={2}hdb,cn=config" SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 ldap_delete: Server is unwilling to perform (53) The debug log says I get manage privilege to all. Maybe there is another way to address this DB (e.g. by UUID)? How do I delete this DB config? Thank you. -- Best regards, Styopa Semenukha. xmpp:styopa@jabber.org

2 1

OpenLDAP 2.4.23 - Syncrepl - TLS Trouble
by Alexey Tyurikov 15 Sep '11

15 Sep '11

Dear OpenLDAP experts, I'm about to setup an OpenLDAP server with the following features: - TLS/SSL with self-signed certificates - TLS-encrypted N-way replication (Syncrepl) My environment: - 2 x RHEL 6.0 - OpenLDAP 2.4.23 I try to sync both databases: cn=config and backend-db. The problem is that I'm not able to turn on TLS for both sync-connections at the same time. It works for each connection but only if the second one is unencrypted. Working configuration: ----- olcDatabase={0}config,cn=config ... olcSyncrepl: {0}rid=001 provider=ldap://ldapserver1.com binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncrepl: {1}rid=002 provider=ldap://ldapserver2.com binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 ... olcDatabase={1}bdb,cn=config ... olcSyncrepl: {0}rid=003 provider=ldap://ldapserver1.com binddn="cn=manager,dc=ldap,dc=com" bindmethod=simple credentials=password searchbase="dc=ldap,dc=com" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 starttls=yes tls_cacert=/etc/openldap/cacerts/ca.pem olcSyncrepl: {1}rid=004 provider=ldap://ldapserver2.com binddn="cn=manager,dc=ldap,dc=com" bindmethod=simple credentials=password searchbase="dc=ldap,dc=com" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 starttls=yes tls_cacert=/etc/openldap/cacerts/ca.pem ----- (desired) Configuration, which doesn't work: ----- olcDatabase={0}config,cn=config ... olcSyncrepl: {0}rid=001 provider=ldap://ldapserver1.com binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 starttls=yes tls_cacert=/etc/openldap/cacerts/ca.pem olcSyncrepl: {1}rid=002 provider=ldap://ldapserver2.com binddn="cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 starttls=yes tls_cacert=/etc/openldap/cacerts/ca.pem ... olcDatabase={1}bdb,cn=config ... olcSyncrepl: {0}rid=003 provider=ldap://ldapserver1.com binddn="cn=manager,dc=ldap,dc=com" bindmethod=simple credentials=password searchbase="dc=ldap,dc=com" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 starttls=yes tls_cacert=/etc/openldap/cacerts/ca.pem olcSyncrepl: {1}rid=004 provider=ldap://ldapserver2.com binddn="cn=manager,dc=ldap,dc=com" bindmethod=simple credentials=password searchbase="dc=ldap,dc=com" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 starttls=yes tls_cacert=/etc/openldap/cacerts/ca.pem ----- /etc/openldap/cacerts/ca.pem contains CA certificates of both servers. What is wrong? I would be very thankful for every advise.

2 1

Re: How to disable cn=config module in OpenLDAP
by pradyumna dash 14 Sep '11

14 Sep '11

Hi, Yes i tried below ldapsearch -x -h l <http://somehost.com/>dap1.example.com -b cn=Manager,dc=example,dc=com It asked me to provide the password i have provided that then it shows the same error, nothing came up. I have checked my ldap.conf as well it looks okay. Regards, Neo On Wed, Sep 14, 2011 at 6:41 PM, Bill MacAllister <whm(a)stanford.edu> wrote: > > > --On Wednesday, September 14, 2011 06:35:09 PM +0200 pradyumna dash < > neomatrixgem(a)gmail.com> wrote: > > Hi, >> >> ldapsearch -x shows the content of LDAP database as well wothout any >> additional options. I can see the same in one of my servers,I took a dump >> of >> the running server by slapcat and restored the same in this server. >> >> I can see the data by slapcat but ldapsearch is not working. >> >> The box where ldap running fine its using slapd.d backend, but this server >> i >> have configured to run from slapd.conf file, can it be a issue with the DB >> backup and restore as they are both using different backend? >> >> Regards, >> Neo >> > > Did you even try my suggestion? The error message that you got back, i.e. > "32 no such object" is telling you that you have not supplied a baseDN > for the search. > > Bill > > P.S. Top posting to replies sucks. > > > On Wed, Sep 14, 2011 at 6:29 PM, Bill MacAllister <whm(a)stanford.edu> >> wrote: >> >> >>> >>> --On Wednesday, September 14, 2011 06:20:03 PM +0200 pradyumna dash < >>> neomatrixgem(a)gmail.com> wrote: >>> >>> I have fixed this by deleting the slapd.d and also changed the script to >>> >>>> read slapd.conf file but now >>>> >>>> when am trying ldapserach -x its showing 32 no such object >>>> >>>> but the below command works >>>> >>>> ldapsearch -LLL -Wx -D "cn=Manager,dc=mail,dc=domain,****dc=com >>>> >>>> why is that ? >>>> >>>> >>> Because you did it wrong. There is not enough information in your >>> message to tell much more than you contacted an LDAP server and >>> got an error message. You might want to try using a fully specified >>> search and work back from there. For example: >>> >>> ldapsearch -x -h somehost.com -b cn=sometree,dc=domain,dc=com >>> >>> Bill >>> >>> >>> Regards, >>> >>>> Neo >>>> On Wed, Sep 14, 2011 at 5:34 PM, pradyumna dash <neomatrixgem(a)gmail.com >>>> > wrote: >>>> >>>> Hi , >>>> >>>>> >>>>> Can i disable cn=config module, I just want to use plain old slapd.conf >>>>> file. How to disable that. So that LDAP wont use the directory. >>>>> >>>>> Am using SLES 11 SP1 and i tried deleteting the directory but if i am >>>>> unable to restart the service. >>>>> >>>>> Regards, >>>>> Neo >>>>> >>>>> >>>>> >>> >>> -- >>> >>> Bill MacAllister >>> Infrastructure Delivery Group, Stanford University >>> >>> >>> > > > -- > > Bill MacAllister > Infrastructure Delivery Group, Stanford University > >

2 1

secure passwords
by sim123 14 Sep '11

14 Sep '11

Hi All, I am trying to store SSHA passwords in openldap instead of plain text via C code and wondering how this works. I tried exploring archives, FAQ etc and what I gathered from there is openLDAP has built in support for various password encryption algorithm however it does not have any APIs for generating passwords and password-has directive works with ldpapassword utility only. http://www.openldap.org/faq/data/cache/906.html If I use some tool like Apache DS and modify my userPassword attribute to be SSHA instead of plain text it all works. I want to know how this works under the hood? Who is responsible for generating hashed passwords? If I generate it using some C routine how does LDAP Server retrieves it during the bind operation? I would really appreciate if there is any related documentation available. Thanks for the help and support.

4 10

Re: How to disable cn=config module in OpenLDAP
by pradyumna dash 14 Sep '11

14 Sep '11

Hi, ldapsearch -x shows the content of LDAP database as well wothout any additional options. I can see the same in one of my servers,I took a dump of the running server by slapcat and restored the same in this server. I can see the data by slapcat but ldapsearch is not working. The box where ldap running fine its using slapd.d backend, but this server i have configured to run from slapd.conf file, can it be a issue with the DB backup and restore as they are both using different backend? Regards, Neo On Wed, Sep 14, 2011 at 6:29 PM, Bill MacAllister <whm(a)stanford.edu> wrote: > > > --On Wednesday, September 14, 2011 06:20:03 PM +0200 pradyumna dash < > neomatrixgem(a)gmail.com> wrote: > > I have fixed this by deleting the slapd.d and also changed the script to >> read slapd.conf file but now >> >> when am trying ldapserach -x its showing 32 no such object >> >> but the below command works >> >> ldapsearch -LLL -Wx -D "cn=Manager,dc=mail,dc=domain,**dc=com >> >> why is that ? >> > > Because you did it wrong. There is not enough information in your > message to tell much more than you contacted an LDAP server and > got an error message. You might want to try using a fully specified > search and work back from there. For example: > > ldapsearch -x -h somehost.com -b cn=sometree,dc=domain,dc=com > > Bill > > > Regards, >> Neo >> On Wed, Sep 14, 2011 at 5:34 PM, pradyumna dash <neomatrixgem(a)gmail.com >> >wrote: >> >> Hi , >>> >>> Can i disable cn=config module, I just want to use plain old slapd.conf >>> file. How to disable that. So that LDAP wont use the directory. >>> >>> Am using SLES 11 SP1 and i tried deleteting the directory but if i am >>> unable to restart the service. >>> >>> Regards, >>> Neo >>> >>> > > > -- > > Bill MacAllister > Infrastructure Delivery Group, Stanford University > >

2 1

How to disable cn=config module in OpenLDAP
by pradyumna dash 14 Sep '11

14 Sep '11

Hi , Can i disable cn=config module, I just want to use plain old slapd.conf file. How to disable that. So that LDAP wont use the directory. Am using SLES 11 SP1 and i tried deleteting the directory but if i am unable to restart the service. Regards, Neo

2 2

Bind with attribute + RDN instead of DN
by sim123 13 Sep '11

13 Sep '11

Hi All, I want third party applications to authenticate against my ldap using any attribute (specially mail & password) is it possible to do a bind using any attribute with/without RDN rather then DN? For example my LDAP user looks like this : dn: uid=1,ou=users,dc=example,dc=local objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person objectClass: top cn: Josh sn: Cho mail: joshcho(a)example.com uid: 1 userPassword: joshcho I can bind to ldap if I use DN & password but I can not bind to ldap if I use any attribute like mail=joshcho(a)example.com,ou=users,dc=example,dc,local & password Would greatly appreciate any help. Thanks *simon*

3 5

Problem replicating ACL changes in back-config from master to slaves: SEGFAULT
by Uwe Werler 13 Sep '11

13 Sep '11

Hello list, I created a ldap master serving a ldif-db cn=config,cn=server for a bunch of slave servers replicating their config with suffixmassage cn=config. The master is 2.4.25 and the slaves are 2.4.25 and 2.4.26. If I change ACL's in the db definition of a bdb database at the master db cn=config,cn=server all slave servers segfault with: Error: closing the transaction region with active transactions slapd daemon: abnormal condition, shutdown initiated. slapd shutdown: waiting for 2 operations/tasks to finish Segmentation fault Any hint? Regards Uwe

1 0

Re: Need Help On Master-Master Replication Setup!!
by pradyumna dash 13 Sep '11

13 Sep '11

Hi, Thanks for the suggestion, but i never did it before , if you can share a doc or something would be great. I use the openssl to generate the certificate, so even i dont know how to configure subjectAltNames. Also if you can explain a bit how i should i proceed would be appreciated. Example : ldap1.example.com ldap2.example.com So in the load balancer what to configure and how to create the certificate. Please help. Regards, Pradyumna On Fri, Sep 9, 2011 at 7:35 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Thursday, September 08, 2011 10:17 PM +0200 pradyumna dash < > neomatrixgem(a)gmail.com> wrote: > > Hi, >> >> >> I would like to setup OpenLDAP Mater-Master replication, before that i >> would like to know something more about it, because i >> never implemented the same. >> >> >> Suppose i have 2 servers ldap1.example.com and ldap2.example.com >> >> >> I will configure M-M replication with LDAPS, in this scenario how my >> architecture should be? Do i need to keep it behind the loadbalancer or >> what are the steps to do it? >> How come the client will come to know if any of the server is down, it >> will talk to the other server, because in my ldap.conf file i will have a >> single URI/host entry >> pointing to one of the server and also how to create the certificate, do >> i need 2 individiual certificate 1 for ldap1 and 1 for ldap2? >> > > I would suggest a cert for ldap1 and ldap2, both with having > subjectAltNames for a load balanced name too, so clients can work directly > to the servers and directly with the LB name. > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

3 11

OpenLDAP Windows setup
by Ashish Chawla 13 Sep '11

13 Sep '11

Hi, I installed OpenLDAP on windows XP by running the application installer. I am new to OpenLDAP and facing lots of issues while running client tools. Am not able to add new users or run utilities like slapcat.exe- it gives error: " slapcat: database doesn't support necessary operations". Can somebody tell me a quick way of adding users and organizations and also if there is a way of capturing the detailed errors. I know that I can get help from this forum only. Any help in this regard will be of great use to me. Thanks, Ashish Chawla ________________________________ ::DISCLAIMER:: ----------------------------------------------------------------------------------------------------------------------- The contents of this e-mail and any attachment(s) are confidential and intended for the named recipient(s) only. It shall not attach any liability on the originator or HCL or its affiliates. Any views or opinions presented in this email are solely those of the author and may not necessarily reflect the opinions of HCL or its affiliates. Any form of reproduction, dissemination, copying, disclosure, modification, distribution and / or publication of this message without the prior written consent of the author of this e-mail is strictly prohibited. If you have received this email in error please delete it and notify the sender immediately. Before opening any mail and attachments please check them for viruses and defect. -----------------------------------------------------------------------------------------------------------------------

1 0

Re: Change a user dn
by Juan Diego Calle 13 Sep '11

13 Sep '11

Ok, let me rephrase this, I have read many books, like O'reilly s LDAP system administratoro, or docs like Or http://tools.ietf.org/html/rfc4511#section-4.9, that explains this exactly The Modify DN operation allows a client to change the Relative Distinguished Name (RDN) of an entry in the Directory and/or to move a subtree of entries to a new location in the Directory. The Modify DN Request is defined as follows: ModifyDNRequest ::= [APPLICATION 12] SEQUENCE { entry LDAPDN, newrdn RelativeLDAPDN, deleteoldrdn BOOLEAN, newSuperior [0] LDAPDN OPTIONAL } Fields of the Modify DN Request are: - entry: the name of the entry to be changed. This entry may or may not have subordinate entries. - newrdn: the new RDN of the entry. The value of the old RDN is supplied when moving the entry to a new superior without changing its RDN. Attribute values of the new RDN not matching any attribute value of the entry are added to the entry, and an appropriate error is returned if this fails. I read the paragraph above, and it seems pretty straight forward, I believe I understand how it works, but when I try to apply this to what I need I dont know what to do. I can change the UID, or other fields from the users or groups, but i can change the dn. For me Openldap has being really hard to understand, it is really technical, usually i am really good at this stuff. I am pretty sure I have huge gaps of knowledge that requires more reading, and a better understanding of the standards. But that is why I usually ask here when I am stuck. This is usually the last place I resort when I dont have answers. Thanks, Juan Diego ----- Original Message ----- From: masarati(a)aero.polimi.it To: "Juan Diego Calle" <juandiego.calle(a)soportelibre.com> Cc: openldap-technical(a)openldap.org Sent: Monday, September 12, 2011 4:08:57 PM GMT -05:00 Colombia Subject: Re: Change a user dn You didn't try all combinations of parameters, you need to be exhaustive when doing trial and error, otherwise there is no guarantee you get to the right combination in a finite amount of time. Or, you can read RFC4511 and find out how to do things right the first time. p. > Hi thanks for the helo I have being tryinn a few things with ldapmodify, > > I need to modify the user from > dn: uid=user1,ou=People,dc=mydomain,dc=com, > to > dn: uid=user1,ou=Group1,ou=People,dc=mydomain,dc=com, > > I have try some of the following attempts > > dn: uid=user1,ou=People,dc=mydomain,dc=com > changetype: modify > replace: dn > dn: uid=user1,ou=Group1,ou=People,dc=mydomain,dc=com > > that according to what i have read it doesnt have work, because dn is not > exactly like an attribute > > dn: uid=user1,ou=People,dc=mydomain,dc=com > changeType: modrdn > newRDN: uid=user1,ou=Group1,ou=People,dc=mydomain,dc=com > deleteOldRDN: 1 > > and this ones gives me > > modifying rdn of entry "uid=user1,ou=People,dc=mydomain,dc=com" > rename completed > ldapmodify: Invalid DN syntax (34) > additional info: invalid new RDN > > I dont know how to add an ou to the dn. > > Thanks > > > > > > ----- Original Message ----- > From: "Andrey A. Konovalov" <mudraia(a)list.ru> > To: openldap-technical(a)openldap.org > Sent: Friday, September 9, 2011 12:43:01 PM GMT -05:00 Colombia > Subject: Re: Change a user dn > >> Hi >> >> I have Openldap with samba, and some users. >> My users are part of ou=People,dc=mydomain,dc=com, >> like this, >> dn: uid=user1,ou=People,dc=mydomain,dc=com, >> >> So i wanted some of my users to be able to administer a group of users >> and be able to create users, so a friend of mine recommended me to do >> the following, create a group like this >> >> dn: cn=Admin Group1,cn=Admins,ou=People,dc=mydomain,dc=com, >> objectClass: groupOfNames >> objectClass: top >> cn: Admin Group1 >> member: uid=adming1,ou=People,dc=mydomain,dc=com, >> >> and >> >> dn: ou=Group1,ou=People,dc=mydomain,dc=com >> objectClass: organizationalUnit >> objectClass: top >> ou: U.A.A. Group1 >> >> the users of this "group" whould have to be >> >> dn: uid=user1,ou=Group1,ou=People,dc=mydomain,dc=com, >> >> >> And with and acl I give Admin Group1 users complete control over that >> ou. >> >> >> So this seems to work. But I already have users that use my ldap, is it >> possible to change their dn, I am not clear on how to do this. >> >> Thanks, >> >> Juan Diego >> > > > Maybe, > (do it with ldapmodify, fex.) > dn: uid=user1,dc=tratata,dc=com > changeType: modrdn > newRDN: user2 > deleteOldRDN: 1 > > ??? > -- > Andrey A. Konovalov <mudraia(a)list.ru> > > >

2 1

Change a user dn
by Juan Diego Calle 12 Sep '11

12 Sep '11

Hi I have Openldap with samba, and some users. My users are part of ou=People,dc=mydomain,dc=com, like this, dn: uid=user1,ou=People,dc=mydomain,dc=com, So i wanted some of my users to be able to administer a group of users and be able to create users, so a friend of mine recommended me to do the following, create a group like this dn: cn=Admin Group1,cn=Admins,ou=People,dc=mydomain,dc=com, objectClass: groupOfNames objectClass: top cn: Admin Group1 member: uid=adming1,ou=People,dc=mydomain,dc=com, and dn: ou=Group1,ou=People,dc=mydomain,dc=com objectClass: organizationalUnit objectClass: top ou: U.A.A. Group1 the users of this "group" whould have to be dn: uid=user1,ou=Group1,ou=People,dc=mydomain,dc=com, And with and acl I give Admin Group1 users complete control over that ou. So this seems to work. But I already have users that use my ldap, is it possible to change their dn, I am not clear on how to do this. Thanks, Juan Diego

3 3

LDAP proxy with back_ldap: (?=undefined)
by Torsten Schlabach (Tascel eG) 12 Sep '11

12 Sep '11

Hi all! I am trying to setup the simplest possible LDAP proxy with OpenLDAP. Actually, I do have a machine with one interface on a public IP address and the other one on the private network. So all I want is a pass-through of any LDAP query 1:1 from the proxy which sits on the public IP to an LDAP server which can be reached only through a private IP on our internal network. Here is my config: database ldap suffix "o=top" uri "ldap://192.168.12.34/" My problem is: The query sent to the backend server always contains a (?=undefined) condition, which leads to no objects found. In other words, the query I send to the proxy is for example: (&(?objectClass=mailalias)(dc=xxxx.yy)) The back_ldap will send to the backend server: (&(&(?objectClass=mailalias)(dc=xxxx.yy))(?=undefined)) Any idea? Regards, Torsten

3 4

Can't contact LDAP server
by Mark 09 Sep '11

09 Sep '11

I have a 2-way multi-master setup on srv1.foo.com (EDT) and srv2.foo.com (PDT). For about 2hrs this morning srv2 was syslog'ing "Can't contact LDAP server" while it was in a replication conversation with srv1: Sep 9 05:29:45 srv2 slapd[9413]: do_syncrep2: rid=001 (-1) Can't contact LDAP server Sep 9 05:29:45 srv2 slapd[9413]: do_syncrepl: rid=001 rc -1 retrying Sep 9 05:30:00 srv2 slapd[9413]: do_syncrep2: rid=001 LDAP_RES_INTERMEDIATE - SYNC_ID_SET Sep 9 05:30:01 srv2 last message repeated 34 times Sep 9 05:30:01 srv2 slapd[9413]: syncrepl_entry: rid=001 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Sep 9 05:30:01 srv2 slapd[9413]: syncrepl_entry: rid=001 be_search (0) Sep 9 05:30:01 srv2 slapd[9413]: syncrepl_entry: rid=001 ... Sep 9 05:30:01 srv2 slapd[9413]: syncprov_matchops: skipping original sid 003 Sep 9 05:30:01 srv2 slapd[9413]: syncprov_matchops: skipping original sid 003 Sep 9 05:30:01 srv2 slapd[9413]: syncrepl_entry: rid=001 be_modify ... (0) Sep 9 05:30:01 srv2 slapd[9413]: syncrepl_entry: rid=001 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Sep 9 05:30:01 srv2 slapd[9413]: syncrepl_entry: rid=001 be_search (0) Sep 9 05:30:01 srv2 slapd[9413]: syncrepl_entry: rid=001 ... Sep 9 05:30:01 srv2 slapd[9413]: syncprov_matchops: skipping original sid 003 Sep 9 05:30:01 srv2 slapd[9413]: syncprov_matchops: skipping original sid 003 Sep 9 05:30:01 srv2 slapd[9413]: syncrepl_entry: rid=001 be_modify ... (0 ... Sep 9 05:30:29 srv2 slapd[9413]: syncrepl_entry: rid=001 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Sep 9 05:30:29 srv2 slapd[9413]: syncrepl_entry: rid=001 be_search (0) Sep 9 05:30:29 srv2 slapd[9413]: syncrepl_entry: rid=001 ... Sep 9 05:30:29 srv2 slapd[9413]: syncprov_matchops: skipping original sid 003 Sep 9 05:30:29 srv2 slapd[9413]: syncprov_matchops: skipping original sid 003 Sep 9 05:30:29 srv2 slapd[9413]: syncrepl_entry: rid=001 be_modify ... (0) Sep 9 05:30:29 srv2 slapd[9413]: do_syncrep2: rid=001 (-1) Can't contact LDAP server Sep 9 05:30:29 srv2 slapd[9413]: do_syncrepl: rid=001 rc -1 retrying Sep 9 05:30:45 srv2 slapd[9413]: do_syncrep2: rid=001 LDAP_RES_INTERMEDIATE - SYNC_ID_SET Sep 9 05:30:45 srv2 last message repeated 34 times Sep 9 05:30:45 srv2 slapd[9413]: syncrepl_entry: rid=001 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Sep 9 05:30:45 srv2 slapd[9413]: syncrepl_entry: rid=001 be_search (0) Sep 9 05:30:45 srv2 slapd[9413]: syncrepl_entry: rid=001 ... Sep 9 05:30:45 srv2 slapd[9413]: syncprov_matchops: skipping original sid 003 Sep 9 05:30:45 srv2 slapd[9413]: syncprov_matchops: skipping original sid 003 Sep 9 05:30:45 srv2 slapd[9413]: syncrepl_entry: rid=001 be_modify ... (0) ... During that time no errors or closes were logged in the srv2 syslog. I tried bouncing each slapd, but the issue continued. After about 2hrs it stopped occurring. My question is: What would cause the "Can't contact LDAP server message"? The srv1 side doesn't log any error or log that the connection was closed. The text "Can't contact" would seem to imply that the error occurred during a connection attempt, but these errors seemed to occur during a active conversation. Does the srv2 side notice an read or write error on the socket and abandon the connection? I've been looking through the code trying to determine what causes that error message. Does it happen on a single read/write error? Does it retry a few times? I hate to just say "Must be a network error" without some due diligence. My env: RHEL 5.5 OpenLDAP 2.4.25 BerkeleyDB 4.8.40 OpenSSL 1.0.0d Cyrus SASL 2.1.23 2-way Multi-master ==================== #srv1 slapd.conf -> slapd.d include /appl/openldap/etc/schema/core.schema include /appl/openldap/etc/schema/cosine.schema include /appl/openldap/etc/schema/nis.schema include /appl/openldap/etc/schema/inetorgperson.schema include /appl/openldap/etc/schema/foo.com.schema argsfile /appl/openldap/var/run/slapd.args pidfile /appl/openldap/var/run/slapd.pid threads 16 tool-threads 4 idletimeout 300 writetimeout 5 reverse-lookup off timelimit time.soft=30 time.hard=300 sizelimit size.soft=500 size.hard=1000 password-hash {SSHA} loglevel stats sync serverid 1 ldap://srv1.foo.com:10806 modulepath /appl/openldap/libexec moduleload back_monitor.la moduleload back_hdb.la moduleload syncprov.la database config rootdn cn=manager,dc=foo,dc=com database monitor rootdn cn=manager,dc=foo,dc=com database hdb rootdn cn=manager,dc=foo,dc=com suffix dc=foo,dc=com directory /appl/openldap/var/data/dc=foo,dc=com cachesize 1000 idlcachesize 3000 cachefree 5 checkpoint 128 15 index objectClass eq index entryCSN eq index entryUUID eq syncrepl rid=001 provider=ldap://srv1.foo.com:10806 type=refreshAndPersist retry="15 +" bindmethod=simple binddn="cn=replicator,dc=foo,dc=com" credentials="secret" searchbase="dc=foo,dc=com" starttls=no schemachecking=off syncrepl rid=002 provider=ldap://srv2.foo.com:10806 type=refreshAndPersist retry="15 +" bindmethod=simple binddn="cn=replicator,dc=foo,dc=com" credentials="secret" searchbase="dc=foo,dc=com" starttls=no schemachecking=off mirrormode TRUE overlay syncprov syncprov-checkpoint 50 10 syncprov-sessionlog 100 limits dn.exact="cn=replicator,dc=foo,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited ==================== #srv2 slapd.conf -> slapd.d include /appl/openldap/etc/schema/core.schema include /appl/openldap/etc/schema/cosine.schema include /appl/openldap/etc/schema/nis.schema include /appl/openldap/etc/schema/inetorgperson.schema include /appl/openldap/etc/schema/foo.com.schema argsfile /appl/openldap/var/run/slapd.args pidfile /appl/openldap/var/run/slapd.pid threads 16 tool-threads 4 idletimeout 300 writetimeout 5 reverse-lookup off timelimit time.soft=30 time.hard=300 sizelimit size.soft=500 size.hard=1000 password-hash {SSHA} loglevel stats sync serverid 2 ldap://srv2.foo.com:10806 modulepath /appl/openldap/libexec moduleload back_monitor.la moduleload back_hdb.la moduleload syncprov.la database config rootdn cn=manager,dc=foo,dc=com database monitor rootdn cn=manager,dc=foo,dc=com database hdb rootdn cn=manager,dc=foo,dc=com suffix dc=foo,dc=com directory /appl/openldap/var/data/dc=foo,dc=com cachesize 1000 idlcachesize 3000 cachefree 5 checkpoint 128 15 index objectClass eq index entryCSN eq index entryUUID eq syncrepl rid=001 provider=ldap://srv1.foo.com:10806 type=refreshAndPersist retry="15 +" bindmethod=simple binddn="cn=replicator,dc=foo,dc=com" credentials="secret" searchbase="dc=foo,dc=com" starttls=no schemachecking=off syncrepl rid=002 provider=ldap://srv2.foo.com:10806 type=refreshAndPersist retry="15 +" bindmethod=simple binddn="cn=replicator,dc=foo,dc=com" credentials="secret" searchbase="dc=foo,dc=com" starttls=no schemachecking=off mirrormode TRUE overlay syncprov syncprov-checkpoint 50 10 syncprov-sessionlog 100 limits dn.exact="cn=replicator,dc=foo,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited

1 0

Need Help On Master-Master Replication Setup!!
by pradyumna dash 09 Sep '11

09 Sep '11

Hi, I would like to setup OpenLDAP Mater-Master replication, before that i would like to know something more about it, because i never implemented the same. Suppose i have 2 servers ldap1.example.com and ldap2.example.com I will configure M-M replication with LDAPS, in this scenario how my architecture should be? Do i need to keep it behind the loadbalancer or what are the steps to do it? How come the client will come to know if any of the server is down, it will talk to the other server, because in my ldap.conf file i will have a single URI/host entry pointing to one of the server and also how to create the certificate, do i need 2 individiual certificate 1 for ldap1 and 1 for ldap2? Please help me. Regards, Neo

2 1

Re:Slapd-meta stop at the first unreachable candidate
by Michel Gruau 09 Sep '11

09 Sep '11

I performed many new tests and provide below several new comments. I recall that of them concern the fact to perform an ldapsearch on the meta suffix while one URI is unrechable. 1/ When network-timeout is not set for the unreachable URI, then no entry is returned. Unless the URI becomes unreachable after the meta startup AND for the first request only. 2/ When network-timeout is set, then the meta always returns entries, but only from the URI which are above the unreachable URI is slapd.conf. 3/ When conn-ttl is set, the walk-around which is to perform a search below the root node in order to open the channel to the different URI, is not working. Channels are always lost after the ttl expire. 4/ I saw slightly different behaviours when the unrechable URI is the first one in slapd.conf. Most of my earlier tests were performed with an unreachable URI which is the second one in slapd.conf. 4/ Such behaviour concern the case in which the URI contains valid IP (I mean pingable) but the port is unreachable (remote ldap server is stopped or port in wrong). I mean : each time the connect error is returned very quickly from network layers. But there are other cases in which connect error is returned more slowly (for instance IP address is not "pingable" or IP address is a LB virtual IP address and the remote server is unreachable). In these later cases, the meta behaviour is greatly different. I mean the meta behaviour is quite normal and entries from all reachable URI are returned ... once the different timer have elapsed. However, this later case led me to several new problems described below. 5/ The timer which is taken into account for the connection is not the "network-timeout" parameter but the "timeout" parameter. According to the slapd-meta man page, this timeout is supposed to be intended for LDAP operations and not for the network connection step. 6/ The value of the "timeout" parameter is the only one which is taken into account, but ... only if the "network-timeout" parameter is set. In other cases, a default (and longer) timeout seems to be applied. The value of network-timeout remains meaningless, it has only to be set with any value. 7/ The "timeout" parameter which is used is not the parameter corresponding to the unreachable URI. After many tests, I discovered it is the maximum value among all "timeout" in the "database meta" section, whatever the URI is !!! Conclusions: all these parameters provide a really powerfull way to cutomize the configuration but few of them are working as excepted. Could anyone explain me whether I can provide all those details as a bug report ? Or should I wait that anyone could reproduce ? Thanks for all. Michel > Message du 05/09/11 16:31 > De : "Michel Gruau" > A : "openldap-technical openldap org" > Copie à : > Objet : Re:Slapd-meta stop at the first unreachable candidate > > Below is a sample configuration allowing to reproduce the problem : > > Three openldap data instances configured as follows: > include /opt/openldap/etc/openldap/schema/core.schema > include /opt/openldap/etc/openldap/schema/cosine.schema > include /opt/openldap/etc/openldap/schema/inetorgperson.schema > include /opt/openldap/etc/openldap/schema/nis.schema > include /opt/openldap/etc/openldap/schema/dyngroup.schema > include /opt/openldap/etc/openldap/schema/misc.schema > pidfile /opt/openldap/var/run/server1.pid > argsfile /opt/openldap/var/run/server1.args > loglevel stats > database bdb > suffix ou=orgunit,o=gouv,c=fr > directory /opt/openldap/var/server1 > > Note: server1 is changed by server2 and server3 for other instances. > > Each instance contains the following data: (only 4 entries): > dn: ou=orgunit,o=gouv,c=fr > objectClass: top > objectClass: organizationalUnit > ou: orgunit > > dn: ou=dept1,ou=orgunit,o=gouv,c=fr > ou: dept1 > objectClass: top > objectClass: organizationalUnit > > dn: uid=user11,ou=dept1,ou=orgunit,o=gouv,c=fr > objectClass: top > objectClass: person > objectClass: organizationalPerson > objectClass: inetOrgPerson > mail: user11(a)server1.com > cn: User 11 > uid: user11 > givenName: User > sn: 11 > > dn: uid=user12,ou=dept1,ou=orgunit,o=gouv,c=fr > objectClass: top > objectClass: person > objectClass: organizationalPerson > objectClass: inetOrgPerson > mail: user12(a)server1.com > cn: User 12 > uid: user12 > givenName: User > sn: 12 > > Note: user1x and dept1 are substituted in instances 2 and 3 by user2x, dept2, user3x,dept3. > > Data instances are launched using this command: > /opt/openldap/libexec/slapd -n server1 -f /opt/openldap/etc/openldap/server1.conf -h ldap://0.0.0.0:1001/ > /opt/openldap/libexec/slapd -n server2 -f /opt/openldap/etc/openldap/server2.conf -h ldap://0.0.0.0:1002/ > /opt/openldap/libexec/slapd -n server3 -f /opt/openldap/etc/openldap/server3.conf -h ldap://0.0.0.0:1003/ > > Meta instance is configured as follows: > include /opt/openldap/etc/openldap/schema/core.schema > include /opt/openldap/etc/openldap/schema/cosine.schema > include /opt/openldap/etc/openldap/schema/inetorgperson.schema > include /opt/openldap/etc/openldap/schema/nis.schema > include /opt/openldap/etc/openldap/schema/dyngroup.schema > include /opt/openldap/etc/openldap/schema/anais.schema > include /opt/openldap/etc/openldap/schema/misc.schema > pidfile /opt/openldap/var/run/meta.pid > argsfile /opt/openldap/var/run/meta.args > database meta > suffix ou=orgunit,o=gouv,c=fr > uri ldap://localhost:1001/ou=dept1,ou=orgunit,o=gouv,c=fr > #network-timeout 5 > #timeout 3 > uri ldap://localhost:1002/ou=dept2,ou=orgunit,o=gouv,c=fr > #network-timeout 5 > #timeout 4 > uri ldap://localhost:1003/ou=dept3,ou=orgunit,o=gouv,c=fr > #network-timeout 5 > #timeout 4 > > and it is launched as follows: > /opt/openldap/libexec/slapd -n meta -f /opt/openldap/etc/openldap/meta.conf -h ldap://0.0.0.0:1000/ -d 256 > > # test with the 3 servers up > /opt/openldap/bin/ldapsearch -LLL -x -H ldap://pp-ae2-proxy1.alize:1000 -b ou=orgunit,o=gouv,c=fr objectclass=person dn |grep dn: > dn: uid=user11,ou=dept1,ou=orgunit,o=gouv,c=fr > dn: uid=user31,ou=dept3,ou=orgunit,o=gouv,c=fr > dn: uid=user12,ou=dept1,ou=orgunit,o=gouv,c=fr > dn: uid=user32,ou=dept3,ou=orgunit,o=gouv,c=fr > dn: uid=user21,ou=dept2,ou=orgunit,o=gouv,c=fr > dn: uid=user22,ou=dept2,ou=orgunit,o=gouv,c=fr > => entries from the three servers are returned > > # stop server 2 (kill -INT ...) and perfom a new search: > /opt/openldap/bin/ldapsearch -LLL -x -H ldap://pp-ae2-proxy1.alize:1000 -b ou=orgunit,o=gouv,c=fr objectclass=person dn |grep dn: > dn: uid=user11,ou=dept1,ou=orgunit,o=gouv,c=fr > dn: uid=user12,ou=dept1,ou=orgunit,o=gouv,c=fr > dn: uid=user31,ou=dept3,ou=orgunit,o=gouv,c=fr > dn: uid=user32,ou=dept3,ou=orgunit,o=gouv,c=fr > => looks good : entries from server1 and server 3 are returned > > Below are the meta instance logs: > conn=1001 fd=9 ACCEPT from IP=172.30.8.13:55048 (IP=0.0.0.0:1000) > conn=1001 op=0 BIND dn="" method=128 > conn=1001 op=0 RESULT tag=97 err=0 text= > conn=1001 op=1 SRCH base="ou=orgunit,o=gouv,c=fr" scope=2 deref=0 filter="(objectClass=person)" > conn=1001 op=1 SRCH attr=dn > conn=1001 op=1 meta_back_retry[1]: retrying URI="ldap://localhost:1002" DN="". > conn=1001 op=1 meta_back_retry[1]: meta_back_single_dobind=52 > conn=1001 op=1 SEARCH RESULT tag=101 err=0 nentries=4 text= > conn=1001 op=2 UNBIND > conn=1001 fd=9 closed > => looks good as nentries=4 > > # perform numerous new search without changing anything: > [root@pp-ae2-proxy2 log]# /opt/openldap/bin/ldapsearch -LLL -x -H ldap://pp-ae2-proxy1.alize:1000 -b ou=orgunit,o=gouv,c=fr objectclass=person dn |grep dn: > => nothing returned > > Below are the corresponding logs: > conn=1002 fd=9 ACCEPT from IP=172.30.8.13:55049 (IP=0.0.0.0:1000) > conn=1002 op=0 BIND dn="" method=128 > conn=1002 op=0 RESULT tag=97 err=0 text= > conn=1002 op=1 SRCH base="ou=orgunit,o=gouv,c=fr" scope=2 deref=0 filter="(objectClass=person)" > conn=1002 op=1 SRCH attr=dn > conn=1002 op=1 meta_search_dobind_init[1]: retrying URI="ldap://localhost:1002" DN="". > conn=1002 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= > conn=1002 op=2 UNBIND > conn=1002 fd=9 closed > => looks bad as nentries=0 > => Only the first search after server2 stop is successfull. > > # new search but using server1 ou: > /opt/openldap/bin/ldapsearch -LLL -x -H ldap://pp-ae2-proxy1.alize:1000 -b ou=dept1,ou=orgunit,o=gouv,c=fr objectclass=person dn |grep dn: > dn: uid=user11,ou=dept1,ou=orgunit,o=gouv,c=fr > dn: uid=user12,ou=dept1,ou=orgunit,o=gouv,c=fr > => looks good > > # same search as earlier i.e. using root node: > /opt/openldap/bin/ldapsearch -LLL -x -H ldap://pp-ae2-proxy1.alize:1000 -b ou=orgunit,o=gouv,c=fr objectclass=person dn |grep dn: > dn: uid=user11,ou=dept1,ou=orgunit,o=gouv,c=fr > dn: uid=user12,ou=dept1,ou=orgunit,o=gouv,c=fr > => Looks good also. It looks like all is OK but only once a channel is opened to server1 using another manner > > # new search but using server3 base object: > /opt/openldap/bin/ldapsearch -LLL -x -H ldap://pp-ae2-proxy1.alize:1000 -b ou=dept3,ou=orgunit,o=gouv,c=fr objectclass=person dn |grep dn: > dn: uid=user31,ou=dept3,ou=orgunit,o=gouv,c=fr > dn: uid=user32,ou=dept3,ou=orgunit,o=gouv,c=fr > => looks good > > # new search but using slapd-meta base object: > /opt/openldap/bin/ldapsearch -LLL -x -H ldap://pp-ae2-proxy1.alize:1000 -b ou=orgunit,o=gouv,c=fr objectclass=person dn |grep dn: > dn: uid=user11,ou=dept1,ou=orgunit,o=gouv,c=fr > dn: uid=user12,ou=dept1,ou=orgunit,o=gouv,c=fr > dn: uid=user31,ou=dept3,ou=orgunit,o=gouv,c=fr > dn: uid=user32,ou=dept3,ou=orgunit,o=gouv,c=fr > => entries from server1 and server3 are returned > => this confirms lookups in server1 and server3 are not performed until a channel is opened to both of them using their repective base object > => another strange behavior : if search using server3 ou is performed before serach using server ou, then next search attempt using root node allows to retrieve entries from both server1 and server3 ... > > # new search after server2 restart: > /opt/openldap/bin/ldapsearch -LLL -x -H ldap://pp-ae2-proxy1.alize:1000 -b ou=orgunit,o=gouv,c=fr objectclass=person dn |grep dn: > dn: uid=user11,ou=dept1,ou=orgunit,o=gouv,c=fr > dn: uid=user12,ou=dept1,ou=orgunit,o=gouv,c=fr > dn: uid=user21,ou=dept2,ou=orgunit,o=gouv,c=fr > dn: uid=user31,ou=dept3,ou=orgunit,o=gouv,c=fr > dn: uid=user22,ou=dept2,ou=orgunit,o=gouv,c=fr > dn: uid=user32,ou=dept3,ou=orgunit,o=gouv,c=fr > => good, all entries are returned > > # new search after meta instance restart while server2 is already stopped > opt/openldap/bin/ldapsearch -LLL -x -H ldap://pp-ae2-proxy1.alize:1000 -b ou=orgunit,o=gouv,c=fr objectclass=person dn |grep dn: > => unlike the previous test case (server2 stopped while meta instance is already running) we do not see the single successfull search. > > Then, behaviour is the same i.e. search on root node works again, but only once a search has been performed using ou=dept1 and ou=dept3. > > In addition, behaviour is slightly different adding the "conn-ttl" parameter set to 3 (3 seconds). I could expose it in a new post. > > Thanks for anyone who could help to identify whether it is a misconfiguration or a bug. > > Michel Gruau > > > Message du 19/08/11 13:13 > > De : "Michel Gruau" > > A : "openldap-technical openldap org" > > Copie à : > > Objet : Slapd-meta stop at the first unreachable candidate > > > > Hello, > > It have a slapd-meta configuration as follows: > > database meta > suffix dc=com > uri ldap://server1:389/dc=suffix1,dc=com > uri ldap://server2:389/dc=suffix2,dc=com > uri ldap://server3:389/dc=suffix3,dc=com > > I performed numerous tests using "base=com" and changing the order of the above list of uri (in slapd.cnof) and I see that as soon as a candidate directory is unreachable, all other directories located below the directory in failure are not requested by the proxy. For instance, in example below: > - if server2 is down, then server 3 is not requeted > - if server1 is down, then none of the directories is requested. > > I have the felling this is a bug ... could you confirm ? > > FYI, I also tried the "'onerrr continue" config, but did not change annything > > Thanks in advance. > > Michel > > > > > > > Une messagerie gratuite, garantie à vie et des services en plus, ça vous tente ? > Je crée ma boîte mail www.laposte.net > Une messagerie gratuite, garantie à vie et des services en plus, ça vous tente ? Je crée ma boîte mail www.laposte.net

1 0

How to replace account with inetOrgPerson?
by Mi 09 Sep '11

09 Sep '11

I am trying to add the "inetOrgPerson" objectClass, but some users already have the "account" objectClass. After a long search, I found that you cannot have both. So I am trying to remove "account", and add "inetOrgPerson". But I cannot do that either. I just get the following error : err=69 text=structural object class modification from 'account' to 'inetOrgPerson' not allowed If I just try to remove "account", I get entry failed schema check: no structural object class provided So, how can I add "inetOrgPerson" and remove "account" ? Also, I notice that I don't have "account" listed under dn: cn=schema,cn=config. What I have is: {0}core {1}cosine {2}nis {3}inetorgperson {4}samba {5}apple Thanks for any help mi PS: I just need a "mail" attribute. Maybe there is a simpler way than to add inetOrgPerson with all it's ridiculous attributes like "audio" or "carLicense" ?

9 25

pcache template doesn't allow negative assertions?
by Ron Peterson 08 Sep '11

08 Sep '11

OpenLDAP version 2.4.23 Negative assertions don't appear to work in pcacheTemplate filter expressions. Is this intentional? line 435 (pcacheTemplate (!(globalOff=)) 0 900) /local/etc/openldap/proxy/slapd.conf: line 435: unable to parse template: AttributeDescription contains inappropriate characters. slaptest: bad configuration file! Works fine without the negative assertion. - Somewhat related question. I'm attempting to use pcache to expedite the application of a filter expression used in an ACL context (ldap backend). I haven't done this before. Does pcache work for this purpose? e.g. access to dn.sub="ou=email" filter="(!(globalOff=))" ... (this is a simplification of what I'm really doing, for illustrative purposes only). -- Ron Peterson Network & Systems Administrator Mount Holyoke College http://www.mtholyoke.edu/~rpeterso

2 2

Open LDAP Installation/Configuration Failed.
by vijay s sheelavantar 08 Sep '11

08 Sep '11

Hi,I think I fixed the Database related error during openldap configure step. I have downloaded the new DB "db-4.8.26" and I configured it for unix i.e build_unix. and compiled it successfully. after this I configured the openldap-2.4.26 successfully with the following command. ./configure --host=mips CC=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc LD=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-ld CFLAGS="-g -O2" CPPFLAGS="-I/product/wibro/premium/src/APP/Protocols/ASNGW/vijay/db-4.8.26/build_unix" --prefix=/mips/ldap --with-yielding_select=no after that I build teh dependencies successfully with the command "make depend" but when I compile I am getting the following error. /bin/sh ../../libtool  --mode=compile /opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc -g -O2 -I../../include -I../../include   -I/product/wibro/premium/src/APP/Protocols/ASNGW/vijay/db-4.8.26/build_unix   -DLBER_LIBRARY -c version.c /opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc -g -O2 -I../../include -I../../include -I/product/wibro/premium/src/APP/Protocols/ASNGW/vijay/db-4.8.26/build_unix -DLBER_LIBRARY -c version.c -o version.o/bin/sh ../../libtool  --mode=link /opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc -g -O2    -release 2.4 -version-info 9:1:7 -rpath /mips/ldap/lib -o liblber.la assert.lo decode.lo encode.lo io.lo bprint.lo debug.lo memory.lo options.lo sockbuf.lo stdio.lo version.lo  -lresolv rm -fr  .libs/liblber.a .libs/liblber.la .libs/liblber.laiar cru .libs/liblber.a  assert.o decode.o encode.o io.o bprint.o debug.o memory.o options.o sockbuf.o stdio.o version.oranlib .libs/liblber.acreating liblber.la(cd .libs && rm -f liblber.la && ln -s ../liblber.la liblber.la)/bin/sh ../../libtool --mode=link /opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc -static -g -O2     -o dtest dtest.o liblber.la ../../libraries/liblutil/liblutil.a  -lresolv  /opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc -g -O2 -o dtest dtest.o  ./.libs/liblber.a ../../libraries/liblutil/liblutil.a -lresolv./.libs/liblber.a: could not read symbols: Archive has no index; run ranlib to add onecollect2: ld returned 1 exit statusmake[2]: *** [dtest] Error 1make[2]: Leaving directory `/product/wibro/premium/src/APP/Protocols/ASNGW/openldap-2.4.26/libraries/liblber'make[1]: *** [all-common] Error 1make[1]: Leaving directory `/product/wibro/premium/src/APP/Protocols/ASNGW/openldap-2.4.26/libraries'make: *** [all-common] Error 1 I thought this is because I am compiling openldap for MIPS architecture and db-4.8.26 is compiled for normal linux. So i thought I'll compile db-4.8.26 for MIPS and run the following command ../dist/configure --host=mips CC=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc LD=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-ld CFLAGS="-g -O2" and tried to compile this for MIPS, but same error is happening here also. please check the below error [vijay@trlx6 build_unix]$ make./libtool --mode=link /opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc -g -O2  -o db_archive  \    db_archive.o util_sig.o libdb-4.8.a -lpthreadlibtool: link: /opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc -g -O2 -o db_archive db_archive.o util_sig.o  libdb-4.8.a -lpthread/opt/montavista/pro/devkit/mips/fp_be/bin/../lib/gcc-lib/mips-hardhat-linux/3.3.1/../../../../mips-hardhat-linux/bin/ld: db_archive.o: Relocations in generic ELF (EM: 3)db_archive.o: could not read symbols: File in wrong formatcollect2: ld returned 1 exit statusmake: *** [db_archive] Error 1 Kindly help me where I am making mistake and how it can be fixed?? Thank you. RegardsVijay S.

2 1

Search queries with greater-than or smaller-than
by Tobias Prinz 08 Sep '11

08 Sep '11

Hello there, I am just starting with LDAP, but there is some basic thing that I do not understand and that does not make sense at all: I have got an OpenLDAP server and it does contain data. This search returns a bunch of results: ldapsearch -x -v -H ldap://localhost -b ou=something,dc=domainname,dc=com -LLL '(gidNumber=500)' Yet this returns no results: ldapsearch -x -v -H ldap://localhost -b ou=something,dc=domainname,dc=com -LLL '(gidNumber>=500)' So I invert it and this returns no results either: ldapsearch -x -v -H ldap://localhost -b ou=something,dc=domainname,dc=com -LLL '(!(gidNumber>=500))' This simply fails (okay, I knew that, but at least I know the ones above are not syntax errors, because the greater-sign alone is not defined as a filter in RFC 1960 nor RFC 4515): ldapsearch -x -v -H ldap://localhost -b ou=something,dc=domainname,dc=com -LLL '(gidNumber>499)' Can someone point me in the right direction, please? Thanks in advance, Tobias

3 3

Re: Open LDAP Installation/Configuration Failed.
by vijay s sheelavantar 08 Sep '11

08 Sep '11

I have removed the "-I/usr/include" and added "-I/opt/montavista/pro/devkit/mips/fp_be/include" in the configuration command. The command and options used for configuration is as follows. ./configure --host=mips CC=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc LD=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-ld CFLAGS="-g -O2 -I/opt/montavista/pro/devkit/mips/fp_be/include" LDFLAGS=-Bsharable --prefix=/mips/ldap --with-yielding_select=no The error which i got is  configure: error: BerkeleyDB version incompatible with BDB/HDB backends The erros observed in the config.log files are as follows. conftest.c:29:36: __FOO__/generate_error.h: No such file or directoryconfigure:12289: $? = 1configure: failed program was:| /* confdefs.h */| #define PACKAGE_NAME "" conftest.c:30:38: __ASCII__/generate_error.h: No such file or directory configure:14968: result: noconfigure:14992: checking to see if -lrpcrt4 is needed for win32 UUID supportconfigure:15013: /opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc -o conftest -g -O2 -I/opt/montavista/pro/devkit/mips/fp_be/include  -Bsharable conftest.c  -lrpcrt4 >&5conftest.c:88: error: parse error before "UuidCreate"conftest.c:88: warning: data definition has no type or storage classconftest.c:89: error: parse error before "UuidToStringA"conftest.c:89: warning: data definition has no type or storage classconfigure:15013: $? = 1configure: failed program was:| /* confdefs.h */ configure:19126: checking for pthread_rwlock_destroy with <pthread.h>configure:19146: /opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc -o conftest -g -O2 -I/opt/montavista/pro/devkit/mips/fp_be/include  -Bsharable conftest.c  -pthread -lresolv  >&5conftest.c:106: error: parse error before "rwlock"conftest.c:106: warning: data definition has no type or storage class conftest.c:125: error: too many arguments to function `ctime_r'conftest.c:133: error: too few arguments to function `gethostbyname_r'conftest.c:136: error: too few arguments to function `gethostbyaddr_r' configure:20250: checking for db.hconfigure:20250: result: yesconfigure:20261: checking for Berkeley DB major version in db.hconfigure:20281: result: 3configure:20287: checking for Berkeley DB minor version in db.hconfigure:20307: result: 2configure:20313: checking if Berkeley DB version supported by BDB/HDB backendsconfigure:20349: result: noconfigure:20354: error: BerkeleyDB version incompatible with BDB/HDB backends I am not getting what is the exact problem. :(

1 0

Disable Anonymous Access
by Srini Avula 07 Sep '11

07 Sep '11

Hi I am using OpenLDAP 2.4 version. Is there any way to disable Anonymous access? Advise me please. Srini http://www.e-computingltd.com

5 4

manage vs write
by Christopher Wood 07 Sep '11

07 Sep '11

What access privileges over a particular suffix are granted to somebody with the "manage" level that somebody with the "write" level does not get? As background, using 2.4.26: This document specifies that somebody with the level "manage" gets everything else: http://www.openldap.org/doc/admin24/access-control.html#The%20access%20to%2… On the other hand, slapd.access(5) specifies that "manage grants all access including administrative access. The write access is actually the combination of add and delete, which respectively restrict the write privilege to add or delete the specified <what>." (I am very puzzled. It strikes me that once I can write (add/delete) any entry in a subtree I effectively manage it.)

2 1

Authenticate Mac OS X users against OpenLDAP on Debian
by Mi 07 Sep '11

07 Sep '11

We added a Mac to our network, and I would like the network users to be able to login with their existing credentials on our Debian openLDAP server. I configured the LDAP access on the Mac, and it can indeed see the users and groups from the openldap server. But when I try to login after clicking "Other...", the login window shakes around, and nothing happens. The server logs show the connection from the Mac and it's searches ( http://pastebin.com/MB2JswAa). (Logging is configured with Parse, Stats, Stats2, Sync. Is there something else I should add to logging that may be useful?) On the Mac, I didn't find anything looking helpful in the logs (http://pastebin.com/yRreFQrJ), but maybe I don't know what to look for. I found many instructions on the Internet which concentrate on mounting user homes from the server over NFS. This is NOT what we want. Users would be authenticated with openldap, but have their homes locally on the Mac, like normal users. I also saw many mentions of adding the apple schema, and I have done that. But maybe I now need to actually use parts of that schema in the user records? Thanks for any help...

3 3

Open LDAP Installation/Configuration Failed.
by vijay s sheelavantar 07 Sep '11

07 Sep '11

Hi,I am trying to configure and compile the pam_ldap and nss_ldap for MIPS architecture. for this they need ldap library. so I am trying to compile openldap code for MIPS first, but the configuration is failing. The command and options used for configuration is as follows. ./configure --host=mips CC=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-gcc LD=/opt/montavista/pro/devkit/mips/fp_be/bin/mips_fp_be-ld CFLAGS="-g -O2 -I/usr/include -I/usr/include/openssl" LDFLAGS="-L/usr/lib" --prefix=/mips/ldap --with-yielding_select=no and the errors got are as follows. hecking for sys/un.h... yes checking openssl/ssl.h usability... no checking openssl/ssl.h presence... yes configure: WARNING: openssl/ssl.h: present but cannot be compiled configure: WARNING: openssl/ssl.h: check for missing prerequisite headers? configure: WARNING: openssl/ssl.h: see the Autoconf documentation configure: WARNING: openssl/ssl.h: section "Present But Cannot Be Compiled" configure: WARNING: openssl/ssl.h: proceeding with the compiler's result configure: WARNING: ## --------------------------------------------- ## configure: WARNING: ## Report this to <http://www.openldap.org/its/> ## configure: WARNING: ## --------------------------------------------- ## checking for openssl/ssl.h... no checking gnutls/gnutls.h usability... no checking gnutls/gnutls.h presence... no checking for gnutls/gnutls.h... no checking nssutil.h usability... no checking nssutil.h presence... no checking for nssutil.h... no configure: error: MozNSS not found - please specify the location to the NSPR and NSS header files in CPPFLAGS and the location to the NSPR and NSS libraries in LDFLAGS (if not in the system location) Kindly help me to fix this error. Thank you. Regards,Vijay S.

2 1

About the information acquisition from slapd.d
by nozawat 07 Sep '11

07 Sep '11

Hi It is a question about the setting when I use slapd.d. 1.I acquire PID information in the following scripts, but will not have any problem? $config_file appoints slapd.d directory. ---- pid_file=`sed -ne \ 's/^olcPidFile:[[:space:]]\+$.\+$[[:space:]]*/\1/p' \ "$config_file"/'cn=config.ldif' 2>/dev/null` ---- 2.I am going to acquire information to use in the following scripts in ldapsearch -b. ---- for suffix in `find "$config_file"/'cn=config' -type f -name olcDatabase* -exec \ sed -ne 's/^[[:space:]]*olcSuffix:[[:space:]]\+$.\+$/\1/p' {} \;` ---- The script mentioned above is a part of a script for slapd monitoring to use it in pacemaker. Because ldap is not an expert, I want to hear the opinion of the person of the expert. Regards, Tomo

2 2

memberOf question
by Chris Jackson 06 Sep '11

06 Sep '11

Running OpenLDAP: slapd 2.4.23. My server currently returns memberOf info only when directly queried using memberOf. Is there a way to allow a base uid=me ldapsearch to return group memberships without specifying the memberOf? ldapsearch -x -h someserver.test.net -W -D cn=someuser,dc=test,dc=net -b dc=test,dc=net uid=me versus ldapsearch -x -h someserver.test.net -W -D cn=someuser,dc=test,dc=net -b dc=test,dc=net uid=me memberOf Here is the result of memberOf query: # extended LDIF # # LDAPv3 # base <dc=test,dc=net> with scope subtree # filter: uid=me # requesting: memberOf # # me, test.net dn: uid=me,dc=test,dc=net memberOf: cn=agroup,dc=test,dc=net

2 1

Re-binding to a different LDAP tree from an overlay
by Abu Marcose 06 Sep '11

06 Sep '11

I have a unique situation where we have developed a custom overlay that intercepts & processes bind requests. As part of the processing I need to bind to a different LDAP tree as a different user (with write access) and delete an object. How can I accomplish this ? Would anyone be able to point me to some sample code that would accomplish this ? Thanks in advance

1 0

Cross compilation of LDAP clients.
by vijay s sheelavantar 06 Sep '11

06 Sep '11

Hello,I want to compile pam_ldap and nss_ldap for MIPS architecture. I am getting lot of errors while doing this. it is asking for lldap and other libraries, and  ldap.h, ber.h, sasl.h header files. Kindly tell me the exact steps to follow for compiling these libraries for a particular architecture(MIPS,PPC etc). Thanks and Regards, VIJAY S.

2 1

Assigning Groups to LDAP users
by pradyumna dash 06 Sep '11

06 Sep '11

Guys, I have a query, lets take a scenario : Assume we have 2 servers "Server1" and "Server2" and 2 groups "Admin" and "ITTech", What is needed is like say when a user "bob" logging in to "Server1" he will get the group "Admin", but when he logs in to "Server2" he will get group "ITTech". Also it may vary for different users like when "Kris" logs in to Server1 he may get a group called "ITTech" and when he logs in to "Server2" he will get some other group say "Security". Can it be possible by OpenLDAP ? If this is achieved then we are planning to have SUDO files based on the grooups. It would be great if you can provide me some pointers or how-to. Regards, Neo

6 6

Re: syncrepl giving error "CSN too old, ignoring " for detla replication
by Yuri Bank 05 Sep '11

05 Sep '11

Hmm. I thought you only needed NTP time sync with N-way and MMR. But not with single Provider. I guess I never noticed an issue with this since my servers run ntp ayways. On Sat, Sep 3, 2011 at 1:57 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Saturday, September 03, 2011 1:02 AM -0700 Yuri Bank < > yuribank(a)gmail.com> wrote: > > I've seen a very similar issue (ContextCSNs being newer on my consumers), >> and I believe it was fixed in OpenLDAP (2.4.26). Do the "CSN too old, >> ignoring" error messages spam endlessly in your consumer logs? >> >> As for your other questions. You only need a single accesslog, and the >> clocks on your consumer nodes do not need to be in synch with the >> Provider (in deltasync replication). >> > > Wrong. Your clocks should *always* be tightly in sync. Particularly with > the advent of delta-sync MMR in the next release. > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

Slapd-meta stop at the first unreachable candidate
by Michel Gruau 05 Sep '11

05 Sep '11

Hello, It have a slapd-meta configuration as follows: database meta suffix dc=com uri ldap://server1:389/dc=suffix1,dc=com uri ldap://server2:389/dc=suffix2,dc=com uri ldap://server3:389/dc=suffix3,dc=com I performed numerous tests using "base=com" and changing the order of the above list of uri (in slapd.cnof) and I see that as soon as a candidate directory is unreachable, all other directories located below the directory in failure are not requested by the proxy. For instance, in example below: - if server2 is down, then server 3 is not requeted - if server1 is down, then none of the directories is requested. I have the felling this is a bug ... could you confirm ? FYI, I also tried the "'onerrr continue" config, but did not change annything Thanks in advance. Michel Une messagerie gratuite, garantie à vie et des services en plus, ça vous tente ? Je crée ma boîte mail www.laposte.net

4 6

Re:Slapd-meta stop at the first unreachable candidate
by Michel Gruau 05 Sep '11

05 Sep '11

Below is a sample configuration allowing to reproduce the problem : Three openldap data instances configured as follows: include /opt/openldap/etc/openldap/schema/core.schema include /opt/openldap/etc/openldap/schema/cosine.schema include /opt/openldap/etc/openldap/schema/inetorgperson.schema include /opt/openldap/etc/openldap/schema/nis.schema include /opt/openldap/etc/openldap/schema/dyngroup.schema include /opt/openldap/etc/openldap/schema/misc.schema pidfile /opt/openldap/var/run/server1.pid argsfile /opt/openldap/var/run/server1.args loglevel stats database bdb suffix ou=orgunit,o=gouv,c=fr directory /opt/openldap/var/server1 Note: server1 is changed by server2 and server3 for other instances. Each instance contains the following data: (only 4 entries): dn: ou=orgunit,o=gouv,c=fr objectClass: top objectClass: organizationalUnit ou: orgunit dn: ou=dept1,ou=orgunit,o=gouv,c=fr ou: dept1 objectClass: top objectClass: organizationalUnit dn: uid=user11,ou=dept1,ou=orgunit,o=gouv,c=fr objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson mail: user11(a)server1.com cn: User 11 uid: user11 givenName: User sn: 11 dn: uid=user12,ou=dept1,ou=orgunit,o=gouv,c=fr objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson mail: user12(a)server1.com cn: User 12 uid: user12 givenName: User sn: 12 Note: user1x and dept1 are substituted in instances 2 and 3 by user2x, dept2, user3x,dept3. Data instances are launched using this command: /opt/openldap/libexec/slapd -n server1 -f /opt/openldap/etc/openldap/server1.conf -h ldap://0.0.0.0:1001/ /opt/openldap/libexec/slapd -n server2 -f /opt/openldap/etc/openldap/server2.conf -h ldap://0.0.0.0:1002/ /opt/openldap/libexec/slapd -n server3 -f /opt/openldap/etc/openldap/server3.conf -h ldap://0.0.0.0:1003/ Meta instance is configured as follows: include /opt/openldap/etc/openldap/schema/core.schema include /opt/openldap/etc/openldap/schema/cosine.schema include /opt/openldap/etc/openldap/schema/inetorgperson.schema include /opt/openldap/etc/openldap/schema/nis.schema include /opt/openldap/etc/openldap/schema/dyngroup.schema include /opt/openldap/etc/openldap/schema/anais.schema include /opt/openldap/etc/openldap/schema/misc.schema pidfile /opt/openldap/var/run/meta.pid argsfile /opt/openldap/var/run/meta.args database meta suffix ou=orgunit,o=gouv,c=fr uri ldap://localhost:1001/ou=dept1,ou=orgunit,o=gouv,c=fr #network-timeout 5 #timeout 3 uri ldap://localhost:1002/ou=dept2,ou=orgunit,o=gouv,c=fr #network-timeout 5 #timeout 4 uri ldap://localhost:1003/ou=dept3,ou=orgunit,o=gouv,c=fr #network-timeout 5 #timeout 4 and it is launched as follows: /opt/openldap/libexec/slapd -n meta -f /opt/openldap/etc/openldap/meta.conf -h ldap://0.0.0.0:1000/ -d 256 # test with the 3 servers up /opt/openldap/bin/ldapsearch -LLL -x -H ldap://pp-ae2-proxy1.alize:1000 -b ou=orgunit,o=gouv,c=fr objectclass=person dn |grep dn: dn: uid=user11,ou=dept1,ou=orgunit,o=gouv,c=fr dn: uid=user31,ou=dept3,ou=orgunit,o=gouv,c=fr dn: uid=user12,ou=dept1,ou=orgunit,o=gouv,c=fr dn: uid=user32,ou=dept3,ou=orgunit,o=gouv,c=fr dn: uid=user21,ou=dept2,ou=orgunit,o=gouv,c=fr dn: uid=user22,ou=dept2,ou=orgunit,o=gouv,c=fr => entries from the three servers are returned # stop server 2 (kill -INT ...) and perfom a new search: /opt/openldap/bin/ldapsearch -LLL -x -H ldap://pp-ae2-proxy1.alize:1000 -b ou=orgunit,o=gouv,c=fr objectclass=person dn |grep dn: dn: uid=user11,ou=dept1,ou=orgunit,o=gouv,c=fr dn: uid=user12,ou=dept1,ou=orgunit,o=gouv,c=fr dn: uid=user31,ou=dept3,ou=orgunit,o=gouv,c=fr dn: uid=user32,ou=dept3,ou=orgunit,o=gouv,c=fr => looks good : entries from server1 and server 3 are returned Below are the meta instance logs: conn=1001 fd=9 ACCEPT from IP=172.30.8.13:55048 (IP=0.0.0.0:1000) conn=1001 op=0 BIND dn="" method=128 conn=1001 op=0 RESULT tag=97 err=0 text= conn=1001 op=1 SRCH base="ou=orgunit,o=gouv,c=fr" scope=2 deref=0 filter="(objectClass=person)" conn=1001 op=1 SRCH attr=dn conn=1001 op=1 meta_back_retry[1]: retrying URI="ldap://localhost:1002" DN="". conn=1001 op=1 meta_back_retry[1]: meta_back_single_dobind=52 conn=1001 op=1 SEARCH RESULT tag=101 err=0 nentries=4 text= conn=1001 op=2 UNBIND conn=1001 fd=9 closed => looks good as nentries=4 # perform numerous new search without changing anything: [root@pp-ae2-proxy2 log]# /opt/openldap/bin/ldapsearch -LLL -x -H ldap://pp-ae2-proxy1.alize:1000 -b ou=orgunit,o=gouv,c=fr objectclass=person dn |grep dn: => nothing returned Below are the corresponding logs: conn=1002 fd=9 ACCEPT from IP=172.30.8.13:55049 (IP=0.0.0.0:1000) conn=1002 op=0 BIND dn="" method=128 conn=1002 op=0 RESULT tag=97 err=0 text= conn=1002 op=1 SRCH base="ou=orgunit,o=gouv,c=fr" scope=2 deref=0 filter="(objectClass=person)" conn=1002 op=1 SRCH attr=dn conn=1002 op=1 meta_search_dobind_init[1]: retrying URI="ldap://localhost:1002" DN="". conn=1002 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= conn=1002 op=2 UNBIND conn=1002 fd=9 closed => looks bad as nentries=0 => Only the first search after server2 stop is successfull. # new search but using server1 ou: /opt/openldap/bin/ldapsearch -LLL -x -H ldap://pp-ae2-proxy1.alize:1000 -b ou=dept1,ou=orgunit,o=gouv,c=fr objectclass=person dn |grep dn: dn: uid=user11,ou=dept1,ou=orgunit,o=gouv,c=fr dn: uid=user12,ou=dept1,ou=orgunit,o=gouv,c=fr => looks good # same search as earlier i.e. using root node: /opt/openldap/bin/ldapsearch -LLL -x -H ldap://pp-ae2-proxy1.alize:1000 -b ou=orgunit,o=gouv,c=fr objectclass=person dn |grep dn: dn: uid=user11,ou=dept1,ou=orgunit,o=gouv,c=fr dn: uid=user12,ou=dept1,ou=orgunit,o=gouv,c=fr => Looks good also. It looks like all is OK but only once a channel is opened to server1 using another manner # new search but using server3 base object: /opt/openldap/bin/ldapsearch -LLL -x -H ldap://pp-ae2-proxy1.alize:1000 -b ou=dept3,ou=orgunit,o=gouv,c=fr objectclass=person dn |grep dn: dn: uid=user31,ou=dept3,ou=orgunit,o=gouv,c=fr dn: uid=user32,ou=dept3,ou=orgunit,o=gouv,c=fr => looks good # new search but using slapd-meta base object: /opt/openldap/bin/ldapsearch -LLL -x -H ldap://pp-ae2-proxy1.alize:1000 -b ou=orgunit,o=gouv,c=fr objectclass=person dn |grep dn: dn: uid=user11,ou=dept1,ou=orgunit,o=gouv,c=fr dn: uid=user12,ou=dept1,ou=orgunit,o=gouv,c=fr dn: uid=user31,ou=dept3,ou=orgunit,o=gouv,c=fr dn: uid=user32,ou=dept3,ou=orgunit,o=gouv,c=fr => entries from server1 and server3 are returned => this confirms lookups in server1 and server3 are not performed until a channel is opened to both of them using their repective base object => another strange behavior : if search using server3 ou is performed before serach using server ou, then next search attempt using root node allows to retrieve entries from both server1 and server3 ... # new search after server2 restart: /opt/openldap/bin/ldapsearch -LLL -x -H ldap://pp-ae2-proxy1.alize:1000 -b ou=orgunit,o=gouv,c=fr objectclass=person dn |grep dn: dn: uid=user11,ou=dept1,ou=orgunit,o=gouv,c=fr dn: uid=user12,ou=dept1,ou=orgunit,o=gouv,c=fr dn: uid=user21,ou=dept2,ou=orgunit,o=gouv,c=fr dn: uid=user31,ou=dept3,ou=orgunit,o=gouv,c=fr dn: uid=user22,ou=dept2,ou=orgunit,o=gouv,c=fr dn: uid=user32,ou=dept3,ou=orgunit,o=gouv,c=fr => good, all entries are returned # new search after meta instance restart while server2 is already stopped opt/openldap/bin/ldapsearch -LLL -x -H ldap://pp-ae2-proxy1.alize:1000 -b ou=orgunit,o=gouv,c=fr objectclass=person dn |grep dn: => unlike the previous test case (server2 stopped while meta instance is already running) we do not see the single successfull search. Then, behaviour is the same i.e. search on root node works again, but only once a search has been performed using ou=dept1 and ou=dept3. In addition, behaviour is slightly different adding the "conn-ttl" parameter set to 3 (3 seconds). I could expose it in a new post. Thanks for anyone who could help to identify whether it is a misconfiguration or a bug. Michel Gruau > Message du 19/08/11 13:13 > De : "Michel Gruau" > A : "openldap-technical openldap org" > Copie à : > Objet : Slapd-meta stop at the first unreachable candidate > > Hello, It have a slapd-meta configuration as follows: database meta suffix dc=com uri ldap://server1:389/dc=suffix1,dc=com uri ldap://server2:389/dc=suffix2,dc=com uri ldap://server3:389/dc=suffix3,dc=com I performed numerous tests using "base=com" and changing the order of the above list of uri (in slapd.cnof) and I see that as soon as a candidate directory is unreachable, all other directories located below the directory in failure are not requested by the proxy. For instance, in example below: - if server2 is down, then server 3 is not requeted - if server1 is down, then none of the directories is requested. I have the felling this is a bug ... could you confirm ? FYI, I also tried the "'onerrr continue" config, but did not change annything Thanks in advance. Michel > > Une messagerie gratuite, garantie à vie et des services en plus, ça vous tente ? Je crée ma boîte mail www.laposte.net

1 0

RE: N-way multi master configuration issue
by Naga Chaitanya Palle 05 Sep '11

05 Sep '11

Hi, I was able to get the syncronization working between 2 providers. I had to remove data on both the servers and start from beginning. It worked. Now i am facing another issue. In case of single provider-client configuration, fot tls, i used to generate certificate on server and copy the same certificate to client for encrypted communication between provider and client. Now in case of N-way multimaster, i created server1 certificate and copied that certificate to server2 and vice versa. but there is no communication happening between the servers now. Can you please let me know how to use tls with N-way multimaster for N=2 and N>2. Thanks and Regards, Naga Chaitanya ________________________________________ From: Naga Chaitanya Palle Sent: Monday, August 29, 2011 1:37 PM To: Buchan Milne Cc: openldap-technical(a)openldap.org Subject: RE: N-way multi master configuration issue Hi Buchan, After making the changes are per your suggestions, I am still not able to read data between the servers. Also, I deleted DI data on server 2 and restarted to import data from server1 , but no use. Can you please check the slapd.conf files and suggest. Server 1 slapd.conf file # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/share/openldap2.4/schema/sudo.schema include /usr/share/openldap2.4/schema/core.schema include /usr/share/openldap2.4/schema/cosine.schema include /usr/share/openldap2.4/schema/inetorgperson.schema include /usr/share/openldap2.4/schema/nis.schema include /usr/share/openldap2.4/schema/misc.schema include /usr/share/openldap2.4/schema/openldap.schema include /usr/share/openldap2.4/schema/ppolicy.schema include /usr/share/openldap2.4/schema/corba.schema loglevel 296 # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/ldap2.4/slapd.pid argsfile /var/run/ldap2.4/slapd.args access to attrs=userPassword by self write by users read by anonymous auth #access to attrs=shadowLastChange # by self write # by * auth access to * by * read access to * by dn.base="cn=Manager,dc=comverse-in,dc=com" read by * break # Load dynamic backend modules: # modulepath /usr/lib/openldap # dummy test certificate which you can generate by changing to # /etc/pki/tls/certs, running "make slapd.pem", and fixing permissions on # slapd.pem so that the ldap user or group can read it. Your client software # may balk at self-signed certificates, however. # TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt # TLSCertificateFile /etc/pki/tls/certs/slapd.pem # TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem #TLSCipherSuite HIGH:MEDIUM:+SSLv2 #TLSCACertificateFile /etc/openldap2.4/cacerts/cacert.pem #TLSCertificateFile /etc/openldap2.4/cacerts/slapd-cert.pem #TLSCertificateKeyFile /etc/openldap2.4/cacerts/slapd-key.pem # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # ldbm and/or bdb database definitions ####################################################################### serverId 001 database bdb suffix "dc=comverse-in,dc=com" rootdn "cn=Manager,dc=comverse-in,dc=com" rootpw {SSHA}9tKeVZfgKFCfgIFQxXt5esH0HhQk1dIS # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret # rootpw {crypt}ijFYNcSNctBYg # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap2.4 # Indices to maintain for this database #index objectClass eq,pres #index ou,cn,mail,surname,givenname eq,pres,sub #index uidNumber,gidNumber,loginShell eq,pres #index uid,memberUid eq,pres,sub #index nisMapName,nisMapEntry eq,pres,sub #index sudoUser eq index sudoUser eq index member eq index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub #index objectclass,entryCSN,entryUUID eq # Load dynamic backend modules: # modulepath /usr/lib/openldap modulepath /usr/lib/openldap2.4 # modules available in openldap-servers-overlays RPM package: # moduleload accesslog.la # moduleload auditlog.la # moduleload denyop.la # moduleload dyngroup.la # moduleload dynlist.la # moduleload lastmod.la # moduleload pcache.la moduleload ppolicy.la # moduleload refint.la # moduleload retcode.la # moduleload rwm.la # moduleload smbk5pwd.la moduleload syncprov.la # moduleload translucent.la # moduleload unique.la # moduleload valsort.la # modules available in openldap-servers-sql RPM package: # moduleload back_sql.la syncrepl rid=123 provider=ldap://devonly144.comverse-in.com type=refreshAndPersist interval=00:00:01:00 searchbase="dc=comverse-in,dc=com" filter="(objectClass=*)" scope=sub attrs="*" schemachecking=off bindmethod=simple binddn="cn=Manager,dc=comverse-in,dc=com" credentials=sonora index objectClass,entryCSN,entryUUID eq mirrormode true overlay syncprov syncprov-checkpoint 100 10 overlay ppolicy ppolicy_default "cn=DefaultPassword,ou=pwpolicies,dc=comverse-in,dc=com" ppolicy_hash_cleartext ppolicy_use_lockout #SUDOERS_BASE=ou=SUDOers,dc=comverse-in,dc=com # Replicas of this database #replogfile /var/lib/ldap/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com(a)EXAMPLE.COM #replogfile /var/lib/ldap/openldap-master-replog #replica uri=ldaps://rht144.comverse-in.com:389 starttls=critical Server2 slapd.conf file # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/share/openldap2.4/schema/sudo.schema include /usr/share/openldap2.4/schema/core.schema include /usr/share/openldap2.4/schema/cosine.schema include /usr/share/openldap2.4/schema/inetorgperson.schema include /usr/share/openldap2.4/schema/nis.schema include /usr/share/openldap2.4/schema/misc.schema include /usr/share/openldap2.4/schema/openldap.schema include /usr/share/openldap2.4/schema/ppolicy.schema include /usr/share/openldap2.4/schema/corba.schema loglevel 296 # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/ldap2.4/slapd.pid argsfile /var/run/ldap2.4/slapd.args access to attrs=userPassword by self write by users read by anonymous auth #access to attrs=shadowLastChange # by self write # by * auth access to * by * read access to * by dn.base="cn=Manager,dc=comverse-in,dc=com" read by * break # Load dynamic backend modules: # modulepath /usr/lib/openldap # dummy test certificate which you can generate by changing to # /etc/pki/tls/certs, running "make slapd.pem", and fixing permissions on # slapd.pem so that the ldap user or group can read it. Your client software # may balk at self-signed certificates, however. # TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt # TLSCertificateFile /etc/pki/tls/certs/slapd.pem # TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem #TLSCipherSuite HIGH:MEDIUM:+SSLv2 #TLSCACertificateFile /etc/openldap2.4/cacerts/cacert.pem #TLSCertificateFile /etc/openldap2.4/cacerts/slapd-cert.pem #TLSCertificateKeyFile /etc/openldap2.4/cacerts/slapd-key.pem # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # ldbm and/or bdb database definitions ####################################################################### serverId 002 #database bdb database bdb #suffix "dc=comverse-in,dc=com" suffix "dc=comverse-in,dc=com" #rootdn "cn=Manager,dc=comverse-in,dc=com" rootdn "cn=Manager,dc=comverse-in,dc=com" rootpw {SSHA}4qLml3DcOyfwiKlN/garIms4a8fmsNkx #rootpw sonora # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret # rootpw {crypt}ijFYNcSNctBYg # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap2.4 # Indices to maintain for this database #index objectClass eq,pres #index ou,cn,mail,surname,givenname eq,pres,sub #index uidNumber,gidNumber,loginShell eq,pres #index uid,memberUid eq,pres,sub #index nisMapName,nisMapEntry eq,pres,sub #index sudoUser eq index sudoUser eq index member eq index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub #index objectclass,entryCSN,entryUUID eq # Load dynamic backend modules: # modulepath /usr/lib/openldap modulepath /usr/lib/openldap2.4 # modules available in openldap-servers-overlays RPM package: # moduleload accesslog.la # moduleload auditlog.la # moduleload denyop.la # moduleload dyngroup.la # moduleload dynlist.la # moduleload lastmod.la # moduleload pcache.la moduleload ppolicy.la # moduleload refint.la # moduleload retcode.la # moduleload rwm.la # moduleload smbk5pwd.la moduleload syncprov.la # moduleload translucent.la # moduleload unique.la # moduleload valsort.la # modules available in openldap-servers-sql RPM package: # moduleload back_sql.la overlay ppolicy ppolicy_default "cn=DefaultPassword,ou=pwpolicies,dc=comverse-in,dc=com" ppolicy_hash_cleartext ppolicy_use_lockout #SUDOERS_BASE=ou=SUDOers,dc=comverse-in,dc=com # Replicas of this database #replogfile /var/lib/ldap/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com(a)EXAMPLE.COM #replogfile /var/lib/ldap/openldap-master-replog #replica uri=ldaps://rht144.comverse-in.com:389 starttls=critical binddn="cn=Manager,dc=comverse-in,dc=com" bindmethod=simple credentials=sonora #serverId 2 syncrepl rid=124 provider=ldap://uplite98.comverse-in.com type=refreshAndPersist interval=00:00:01:00 searchbase="dc=comverse-in,dc=com" filter="(objectClass=*)" scope=sub attrs="*" schemachecking=off bindmethod=simple binddn="cn=Manager,dc=comverse-in,dc=com" credentials=sonora #updateref ldap://uplite98.comverse-in.com index objectClass,entryCSN,entryUUID eq mirrormode true overlay syncprov syncprov-checkpoint 100 10 Thanks and Regards, Naga Chaitanya -----Original Message----- From: Buchan Milne [mailto:bgmilne@staff.telkomsa.net] Sent: Friday, August 26, 2011 7:15 PM To: Naga Chaitanya Palle Cc: openldap-technical(a)openldap.org Subject: Re: N-way multi master configuration issue On Friday, 26 August 2011 15:28:13 Naga Chaitanya Palle wrote: > Hi buchan, > > My server 1 is uplite98.comverse-in.com. In its slapd.conf, I have syncrepl > pointing to server 2 devonly144.comverse-in.com and vice versa for > server2. Then your serverid (and, it should actually be serverId) is wrong: > > serverid 124 ldap://devonly144.comverse-in.com > > syncrepl rid=124 > > > > provider=ldap://devonly144.comverse-in.com:389 The URI form of serverId is useful if you have the same configuration on all your masters, in which case the listening address of your server must match one of the URIs. You may want to use this form for now: serverId 1 If your serverId's weren't correct (check the contextCSNs), you should probably re-import an export of one server on the other one. > I did not exactly understand what you indicated. > Can you please be more specific about what changes needs to be done in the > slapd.conf file? In a multi-master setup, each server should be replicating off *all* servers, including itself. > Thanks and Regards, > Naga Chaitanya > > -----Original Message----- > From: Buchan Milne [mailto:bgmilne@staff.telkomsa.net] > Sent: Friday, August 26, 2011 6:56 PM > To: openldap-technical(a)openldap.org > Cc: Naga Chaitanya Palle > Subject: Re: N-way multi master configuration issue > > On Friday, 26 August 2011 12:56:38 Naga Chaitanya Palle wrote: > > Hi, > > > > I am trying to set up N-way multimaster configuration using syncrepl on > > openldap2.4 for RHEL 5.4 > > > > Currently I am using two masters for testing. > > > > The slapd.conf on server1 is > > moduleload syncprov.la > > serverid 124 ldap://devonly144.comverse-in.com > > syncrepl rid=124 > > > > provider=ldap://devonly144.comverse-in.com:389 > > type=refreshAndPersist > > interval=00:00:01:00 > > searchbase="dc=comverse-in,dc=com" > > filter="(objectClass=*)" > > scope=sub > > attrs="*" > > schemachecking=off > > bindmethod=simple > > binddn="cn=Manager,dc=comverse-in,dc=com" > > credentials=sonora > > > > index objectClass,entryCSN,entryUUID eq > > mirrormode true > > > > overlay syncprov > > syncprov-checkpoint 100 10 > > > > > > The slapd.conf on server2 is > > moduleload syncprov.la > > serverid 123 ldap://uplite98.comverse-in.com > > syncrepl rid=123 > > > > provider=ldap://uplite98.comverse-in.com:389 > > type=refreshAndPersist > > interval=00:00:01:00 > > searchbase="dc=comverse-in,dc=com" > > filter="(objectClass=*)" > > scope=sub > > attrs="*" > > schemachecking=off > > bindmethod=simple > > binddn="cn=Manager,dc=comverse-in,dc=com" > > credentials=sonora > > > > index objectClass,entryCSN,entryUUID eq > > mirrormode true > > > > overlay syncprov > > syncprov-checkpoint 100 10 > > > > But there is no data synchronization happening between the severs. > > Of course not, you have configured each server only to replicate from > itself. > > > When I added test3 user on server1, it is not reflecting on server 2. > > Same way when I added test4 user on server2 it is not reflecting on > > server1. > > > > Please let me know what is missing in this configuration. > > syncrepl statements pointing to the other master. > > Regards, > Buchan > > > > > =========================================================================== > ==== Please refer to http://www.aricent.com/legal/email_disclaimer.html for > important disclosures regarding this electronic communication. > ========================================================================== > ===== =============================================================================== Please refer to http://www.aricent.com/legal/email_disclaimer.html for important disclosures regarding this electronic communication. ===============================================================================

4 5

OpenLDAP proxy, identity assertion and suffix massage
by Clément OUDOT 05 Sep '11

05 Sep '11

Hello, I am using OpenLDAP 2.4.26 on GNU/Linux. I would like to configure a simple proxy with identity assertion and suffix massage and assert identity for the rootdn of my LDAP backend, to match the rootdn of the proxied backend (on port 390). Here is my configuration : ------------ database ldap suffix "ou=am,dc=local" rootdn "cn=manager,ou=am,dc=local" rootpw secretproxy uri ldap://127.0.0.1:390 idassert-bind bindmethod=simple binddn="cn=admin,dc=example,dc=com" credentials="secret" mode=none idassert-authzFrom "dn.exact:cn=manager,ou=am,dc=local" overlay rwm rwm-suffixmassage "ou=am,dc=local" "dc=example,dc=com" ------------ When I try to authenticate with "cn=manager,ou=am,dc=local" on the proxy, the bind is forwarded to the proxied directory directly, as "cn=manager,dc=example,dc=com". It seems the rwm overlay has done the substitution, so the idassert-authzFrom does not match. This ended with an LDAP error 48, as we can see here: ------------ >>> dnPrettyNormal: <cn=manager,ou=am,dc=local> => ldap_bv2dn(cn=manager,ou=am,dc=local,0) <= ldap_bv2dn(cn=manager,ou=am,dc=local)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=manager,ou=am,dc=local)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=manager,ou=am,dc=local)=0 <<< dnPrettyNormal: <cn=manager,ou=am,dc=local>, <cn=manager,ou=am,dc=local> conn=1001 op=0 BIND dn="cn=manager,ou=am,dc=local" method=128 do_bind: version=3 dn="cn=manager,ou=am,dc=local" method=128 ==> rewrite_context_apply [depth=1] string='cn=manager,ou=am,dc=local' ==> rewrite_rule_apply rule='((.+),)?ou=am,[ ]?dc=local$' string='cn=manager,ou=am,dc=local' [1 pass(es)] ==> rewrite_context_apply [depth=1] res={0,'cn=manager,dc=example,dc=com'} [rw] bindDN: "cn=manager,ou=am,dc=local" -> "cn=manager,dc=example,dc=com" >>> dnPrettyNormal: <cn=manager,dc=example,dc=com> => ldap_bv2dn(cn=manager,dc=example,dc=com,0) <= ldap_bv2dn(cn=manager,dc=example,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=manager,dc=example,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(cn=manager,dc=example,dc=com)=0 <<< dnPrettyNormal: <cn=manager,dc=example,dc=com>, <cn=manager,dc=example,dc=com> ===>slap_sasl_match: comparing DN cn=manager,dc=example,dc=com to rule dn:cn=manager,ou=am,dc=local slap_parseURI: parsing dn:cn=manager,ou=am,dc=local <===slap_sasl_match: comparison returned 48 send_ldap_result: conn=1001 op=0 p=3 send_ldap_result: err=48 matched="" text="" send_ldap_response: msgid=1 tag=97 err=48 ------------ Do you have any suggestion for using the idassert-authzFrom parameter with the suffixmassage? Thanks for your help, Clément.

2 2

how to access 'description' attribute from LDAP server??
by vijay s sheelavantar 05 Sep '11

05 Sep '11

Hi, Please let me know how can i access 'description' attribute stored in LDAP server from LDAP  client(pam_ldap,nss_ldap). Thank you. Regards, Vijay S.

1 0

Re: LDAP authentication of unregistered user at client side.
by vijay s sheelavantar 05 Sep '11

05 Sep '11

Thank you very much Buchan. There was some problem with /etc/nsswitch.conf  file.I changed this configuration using "env LANG=C authconfig-tui" command and selected LDAP option. This will change the nsswitch.conf file properly. Thank you.

1 0

RE : Slapd-meta stop at the first unreachable candidate
by Rodrigo Souza dos Santos 04 Sep '11

04 Sep '11

2 1

s_client working against 636 but not 389
by Nate Marks 04 Sep '11

04 Sep '11

[root@ldap01 cacerts]# netstat -panv | grep slap ... tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 3220/slapd tcp 0 0 0.0.0.0:636 0.0.0.0:* LISTEN 3220/slapd [root@ldap01 cacerts]# grep TL /etc/openldap/slapd.conf # The next three lines allow use of TLS for encrypting connections using a # TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt # TLSCACertificateFile /etc/pki/CA/cacert.pem TLSCACertificateFile /etc/pki/tls/certs/cacert.pem # TLSCertificateFile /etc/pki/tls/certs/slapd.pem TLSCertificateFile /etc/openldap/cacerts/ldap01.infra.ops.hcs.cert.pem # TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem TLSCertificateKeyFile /etc/openldap/cacerts/ldap01.infra.ops.hcs.key.pem ***COMMENT: This command seems a little slow, but it succeeds *** [root@ldap01 cacerts]# openssl s_client -CAfile /etc/pki/tls/certs/cacert.pem -connect 10.60.1.57:636 CONNECTED(00000003) depth=1 /C=US/ST=MA/O=NWN Corporation/OU=hcs/CN=ca.ops.hcs/emailAddress=ca(a)ops.hcs verify return:1 depth=0 /C=US/ST=MA/L=Waltham/O=NWN Corporation/OU=hcs/CN=ldap01.infra.ops.hcs/emailAddress=support(a)nwnit.com verify return:1 --- Certificate chain 0 s:/C=US/ST=MA/L=Waltham/O=NWN Corporation/OU=hcs/CN=ldap01.infra.ops.hcs/emailAddress=support(a)nwnit.com i:/C=US/ST=MA/O=NWN Corporation/OU=hcs/CN=ca.ops.hcs/emailAddress=ca(a)ops.hcs 1 s:/C=US/ST=MA/O=NWN Corporation/OU=hcs/CN=ca.ops.hcs/emailAddress=ca(a)ops.hcs i:/C=US/ST=MA/O=NWN Corporation/OU=hcs/CN=ca.ops.hcs/emailAddress=ca(a)ops.hcs --- Server certificate -----BEGIN CERTIFICATE----- MIIDATCCAmqgAwIBAgIJANZXaZL0G6eAMA0GCSqGSIb3DQEBBQUAMHIxCzAJBgNV BAYTAlVTMQswCQYDVQQIEwJNQTEYMBYGA1UEChMPTldOIENvcnBvcmF0aW9uMQww CgYDVQQLEwNoY3MxEzARBgNVBAMTCmNhLm9wcy5oY3MxGTAXBgkqhkiG9w0BCQEW CmNhQG9wcy5oY3MwHhcNMTEwODMxMDkwOTEyWhcNMTIwODMwMDkwOTEyWjCBlTEL MAkGA1UEBhMCVVMxCzAJBgNVBAgTAk1BMRAwDgYDVQQHEwdXYWx0aGFtMRgwFgYD VQQKEw9OV04gQ29ycG9yYXRpb24xDDAKBgNVBAsTA2hjczEdMBsGA1UEAxMUbGRh cDAxLmluZnJhLm9wcy5oY3MxIDAeBgkqhkiG9w0BCQEWEXN1cHBvcnRAbnduaXQu Y29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDV/XlgAuwbisnokbCXUvXz M5SXTeG6D697Sgh7ggcvdwVprKlfFWCLu3RcSkBbJ69bTDgRQS6qlplUm9kB44XB Ej+8w+YVvTGxZWYIxyr3u2SKYFrIVj4DpeCZyYrgFds9JK9YGh6cDj57PGXbw9aK ApE1SKPNx2SCkMy9WSzLOwIDAQABo3sweTAJBgNVHRMEAjAAMCwGCWCGSAGG+EIB DQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUdO79 lD14LPMt0cviy00Bi/zoVz8wHwYDVR0jBBgwFoAURUA5pElJg/XvOcDIdWZ6W+EN 54IwDQYJKoZIhvcNAQEFBQADgYEANOSnNbRW+US5xf4fQrz0M765wuOKjvuWK4yG K5GcWPv8zAM9bEf0Ju9A9RiMzxwDfQndRQ84fTELXKQeHFYa0ELse8G4ZdxRyEtN GzigGoPQYqtofW3N2mIRb85RntHoIBwfrhnogsY2UXssIWc/8CGgwp4OjtYhiXMU JtHLAms= -----END CERTIFICATE----- subject=/C=US/ST=MA/L=Waltham/O=NWN Corporation/OU=hcs/CN=ldap01.infra.ops.hcs/emailAddress=support(a)nwnit.com issuer=/C=US/ST=MA/O=NWN Corporation/OU=hcs/CN=ca.ops.hcs/emailAddress=ca(a)ops.hcs --- No client certificate CA names sent --- SSL handshake has read 1775 bytes and written 319 bytes --- New, TLSv1/SSLv3, Cipher is AES256-SHA Server public key is 1024 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1 Cipher : AES256-SHA Session-ID: 1F3B030DD062E3EFC3E143DF978A622DD8B0E2167331EAC45C307C8997F59BC3 Session-ID-ctx: Master-Key: 834A1CF62289DB6C4367109B9EF2172796A4AF403F4FE040C4EDDC48ED722437E96717A860038A70323DFFD1EDE3562D Key-Arg : None Krb5 Principal: None Start Time: 1315065479 Timeout : 300 (sec) Verify return code: 0 (ok) --- *** COMMENT: This obviosly doesn't *** [root@ldap01 cacerts]# openssl s_client -CAfile /etc/pki/tls/certs/cacert.pem -connect 10.60.1.57:389 CONNECTED(00000003) 4392:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:188: [root@ldap01 cacerts]# The only thing I could think of is a timeout difference between ssl and tls, iun which case I'll be fine wheh I figure out why it's slow, but I'd like to validate that before moving on to the slowness problem. ANyone have ideas?

2 1

same users / groups in different openldap instances
by Bernhard Dübi 04 Sep '11

04 Sep '11

Hello everybody, I'm new to openldap and I don't know if this is the right place to ask. If not, please direct me to the correct tool. Thanks I have a openldap instance for unix / Linux users with Kerberos integration. Now I need an LDAP server for Oracle Names (or what ever the correct term is for that service). In a book I read that it is not a good idea to have multiple databases in the same openldap instance. So I decided to create a new instance of openldap. The unix directory has the base dn="dc=unix,dc=mycorp,dc=org". The oracle directory has the base dn="dc=oracle,dc=mycorp,dc=org". Now my problem is, I want to allow a group of people from my unix directory to update the oracle directory. Is that possible? If yes, how? if no, what is best practice to implement such a problem? Sincerely Bernhard

1 0

syncrepl giving error "CSN too old, ignoring " for detla replication
by Rupesh Thakkar 03 Sep '11

03 Sep '11

Hi, I am using openldap 2.4.23-12.el6.i686 for provider and openldap version 2.2.28-4AV1.1 for slave. My configuration is Provider with proxy consumer on one machin and slave on another machine. I am getting error “CSN too old, ignoring” in logs(provide-proxycosumer config) slap_queue_csn: queing 0x8d7fe85e 20110901223155.770109Z#000000#000#000000 slap_graduate_commit_csn: removing 0x8d805020 20110901223155.770109Z#000000#000#000000 slap_queue_csn: queing 0x8b9fb300 20110901223155.770109Z#000000#000#000000 syncprov_sendresp: cookie=rid=128,csn=20110901223155.770109Z#000000#000#000000 do_syncrep2: rid=128 cookie=rid=128,csn=20110901223155.770109Z#000000#000#000000 do_syncrep2: rid=128 CSN too old, ignoring 20110901223155.770109Z#000000#000#000000 slap_graduate_commit_csn: removing 0x8d80b9a8 20110901223155.770109Z#000000#000#000000 Do my both provider and slave machines needs times synched using NTP or lag of few seconds is allowed (1-2 seconds)? Thanks Rupesh

3 3

RH EL Openldap dies after update at night ....
by Götz Reinicke 03 Sep '11

03 Sep '11

Hi, recently I updated our ldapd on our RH EL 6.1 to the most recent RH EL version openldap-2.4.23-15.el6_1.1.x86_64 (from 2.4.19-15) Since than the deamon died in the middle of the night nearly every night, leaving no traces to me why. The 2.4.19-15-version never died ... Any hints or suggestions on how to debug that problem? What information may I provide? Thanks and best regards . Götz -- Götz Reinicke IT-Koordinator Tel. +49 7141 969 420 Fax +49 7141 969 55 420 E-Mail goetz.reinicke(a)filmakademie.de Filmakademie Baden-Württemberg GmbH Akademiehof 10 71638 Ludwigsburg www.filmakademie.de Eintragung Amtsgericht Stuttgart HRB 205016 Vorsitzender des Aufsichtsrats: Jürgen Walter MdL Staatssekretär im Ministerium für Wissenschaft, Forschung und Kunst Baden-Württemberg Geschäftsführer: Prof. Thomas Schadt

3 2

Question on best way to partially disable users
by Ski Kacoroski 02 Sep '11

02 Sep '11

Hi, I have an openldap server that several applications use for authenication. What we need to do is when a person is disabled, we need to disable access for that user for all applications but one (employeeonline). My first thought was simply to move the disabled person to a different OU (e.g. ou=eoonly,dc=... instead of ou=people,dc=...). The problem I am running into is that employeeonline is windows/vbscript that uses SASL to bind which means that I cannot just move the user to a different OU as they are always coming in as sasl-realm OL.NSD.ORG. Does any one have a good trick for how to do this? So far all I have come up with is: 1. Bind as a admin user and then check the user's password instead of binding as the user. 2. Figure out someway for vbscript to bind as a different SASL realms. Thanks in advance for your advice. cheers, ski -- "When we try to pick out anything by itself, we find it connected to the entire universe" John Muir Chris "Ski" Kacoroski, Unix Admin, NSD 206-501-9803, ski98033 on IRC and most IM services

2 2

change syncrepl creds with no restart?
by Christopher Wood 02 Sep '11

02 Sep '11

(I'm having trouble finding the answer with Google, so inquiring here. If you have RTFM urls I will be quite happy indeed.) It looks like I'm unable to change syncrepl (client) credentials without restarting slapd. When I tried this I couldn't modify an entry after the change, with an error message apparently indicating that this was a replicated consumer. Things went back to multimaster-normal after restarting both slapd's involved. My questions (more details are below): 1) Is this intended? 2) Is there something that I can prod slapd with in order to have it change syncrepl credentials without restarting slapd? (Details caveats: s/${companyname}/base/; munged hostnames too; I have checked that all passwords are the same on the real hosts just like here; I have checked that the syncrepl provider= are correct on the real hosts): The "before" state is me using the olcRootDN for multimaster syncrepl, on the grounds that I wanted to set it up quickly in the lab. Now I want to use a less privileged user. All changes to cn=config were replicated between supplier hosts. First I added a new user: dn: uid=sync,o=base userPassword:: YmFzZQ== objectClass: account objectClass: shadowAccount uid: sync Then I gave that user read access to everything: dn: olcDatabase={1}hdb,cn=config changetype: modify replace: olcAccess olcAccess: to dn.subtree="uid=basero,o=base" by anonymous auth by dn=uid=basero,o=base by dn=uid=sync,o=base read olcAccess: to attrs="userPassword" by anonymous auth by self read by dn=uid=basero,o=base by dn=uid=sync,o=base read olcAccess: to dn.subtree="ou=groups,o=base" by * read olcAccess: to dn.subtree="ou=people,o=base" by * read olcAccess: to * by dn=uid=sync,o=base read The acls for the o=base tree were then: olcAccess: {0}to dn.subtree="uid=basero,o=base" by anonymous auth by dn=uid=basero,o=base read olcAccess: {1}to attrs="userPassword" by anonymous auth by self read by dn=uid=basero,o=base read olcAccess: {2}to dn.subtree="ou=groups,o=base" by * read olcAccess: {3}to dn.subtree="ou=people,o=base" by * read olcAccess: {4}to * by dn=uid=sync,o=base read So I updated the olcSyncrepl rules: dn: olcDatabase={1}hdb,cn=config changetype: modify replace: olcSyncRepl olcSyncrepl: rid=003 provider=ldap://ldap-supplier-lab-01 binddn="uid=sync,o=base" bindmethod=simple credentials=base searchbase="o=base" type=refreshOnly interval=00:00:00:10 retry="5 5 30 +" timeout=1 olcSyncrepl: rid=004 provider=ldap://ldap-supplier-lab-02 binddn="uid=sync,o=base" bindmethod=simple credentials=base searchbase="o=base" type=refreshOnly interval=00:00:00:10 retry="5 5 30 +" timeout=1 However, when I attempted to change my password on one of the hosts (using o=base not cn=config)... dn: uid=cwood,ou=people,o=base changetype: modify add: userPassword userPassword: fakefakefake I got this: modifying entry "uid=cwood,ou=people,o=base" ldap_modify: Server is unwilling to perform (53) additional info: shadow context; no update referral And this is what turned up in the logs: Sep 1 11:34:03 ldap-supplier-lab-01 slapd[8549]: conn=42902 op=1 MOD dn="uid=cwood,ou=people,o=base" Sep 1 11:34:03 ldap-supplier-lab-01 slapd[8549]: conn=42902 op=1 MOD attr=userPassword Sep 1 11:34:03 ldap-supplier-lab-01 slapd[8549]: conn=42902 op=1 RESULT tag=103 err=53 text=shadow context; no update referral Sep 1 11:34:03 ldap-supplier-lab-01 slapd[8549]: conn=42902 op=2 UNBIND

2 2

LDAP authentication of unregistered user at client side.
by vijay s sheelavantar 02 Sep '11

02 Sep '11

Hi Friends, I have a openldap server running on one machine (fedora10) and pam_ldap.so and nss_ldap.so running on the other machine. I have added a new user to the LDAP server database, this user is not created on client machine. 1. Can i login to the client machine using this new user?2. Now if i try logging with this new user I am getting error messages, the error messages are as follows at client side Sep  2 10:34:36 localhost sshd[8484]: Invalid user kim from 10.254.194.148Sep  2 10:34:36 localhost sshd[8485]: input_userauth_request: invalid user kim Sep  2 10:35:16 localhost sshd[8484]: pam_ldap: error trying to bind as user "cn=min soo,ou=people,dc=samsung,dc=com" (Invalid credentials)Sep  2 10:35:16 localhost sshd[8484]: pam_succeed_if(sshd:auth): error retrieving information about user kimSep  2 10:35:16 localhost sshd[8484]: Failed password for invalid user kim from 10.254.194.148 port 52652 ssh2 Kindly let me know is it a limitation with LDAP ??? Thanks and Regards,VIJAY S.

2 1

OpenLDAP client test program connecting to LDAP server over SSL failed
by daisy.wu＠emc.com 02 Sep '11

02 Sep '11

I am trying to write a simple client test program using OpenLDAP client API to connect to Microsoft Active Directory Server over SSL. Below is code snippet. The program failed to connect. It failed because of this error: ldap_sasl_bind_s: Can't contact LDAP server (-1) error:14090086:SSL routines: SSL3_GET_SERVER_CERTIFICATE:certificate verify failed I know there's no problem with LDAP certificate store /path/to/ldap_certdb because a simple LDAP client test program written in Mozilla LDAP C-SDK worked fine connecting to this same AD server, over SSL. I need to know if I am using the correct OpenLDAP client API calls. Any input would be much appreciated. Thanks. Source Code: ldap_initialize( &ld, uri ); if ( ld == NULL ) { tester_perror( "ldap_initialize", NULL ); exit( EXIT_FAILURE ); } rc = ldap_set_option( ld, LDAP_OPT_PROTOCOL_VERSION, &version ); printf("rc=ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, %d)=%d, error=%s\n", version, rc, ldap_err2string(rc)); rc = ldap_set_option( ld, LDAP_OPT_REFERRALS, chaserefs ? LDAP_OPT_ON : LDAP_OPT_OFF ); printf("rc=ldap_set_option(ld, LDAP_OPT_REFERRALS, %d)=%d, error=%s\n", chaserefs, rc, ldap_err2string(rc)); int debug_flag1 = -1; // LDAP_DEBUG_ANY ; rc = ldap_set_option( ld, LDAP_OPT_DEBUG_LEVEL, &debug_flag1); printf("rc=ldap_set_option(ld, LDAP_OPT_DEBUG_LEVEL, %d)=%d, error=%s\n", debug_flag1, rc, ldap_err2string(rc)); char *cert_path="/path/to/ldap_certdb"; rc = ldap_set_option( ld, LDAP_OPT_X_TLS_CACERTDIR, &cert_path); printf("rc=ldap_set_option(ld, LDAP_OPT_X_TLS_CACERTDIR, %s)=%d, error=%s\n", cert_path, rc, ldap_err2string(rc)); int reqcert = LDAP_OPT_X_TLS_ALLOW; rc = ldap_set_option(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, &reqcert); printf("rc=ldap_set_option(ld, LDAP_OPT_X_TLS_REQUIRE_CERT, %d)=%d, error=%s\n", reqcert, rc, ldap_err2string(rc)); rc = ldap_sasl_bind_s( ld, manager, LDAP_SASL_SIMPLE, passwd, NULL, NULL, NULL ); if ( rc != LDAP_SUCCESS ) { tester_ldap_error( ld, "ldap_sasl_bind_s", NULL ); switch ( rc ) { case LDAP_BUSY: case LDAP_UNAVAILABLE: /* fallthru */ default: break; } exit( EXIT_FAILURE ); } Here's program output: rc=ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, 3)=0, error=Success rc=ldap_set_option(ld, LDAP_OPT_REFERRALS, 0)=0, error=Success rc=ldap_set_option(ld, LDAP_OPT_DEBUG_LEVEL, -1)=0, error=Success rc=ldap_set_option(ld, LDAP_OPT_X_TLS_CACERTDIR, /path/to/ldap_certdb)=0, error=Success rc=ldap_set_option(ld, LDAP_OPT_X_TLS_REQUIRE_CERT, 3)=0, error=Success PID=4781 - Search(2): base="OU=people,OU=documentum,DC=adldap112,DC=dctmlabs,DC=com", filter="cn=aduser2*" attr="cn". slapd-search PID=4781: ldap_sasl_bind_s: Can't contact LDAP server (-1) error:14090086:SSL routines: SSL3_GET_SERVER_CERTIFICATE:certificate verify failed From: Wu, Daisy Sent: Friday, August 26, 2011 4:53 PM To: openldap-technical(a)openldap.org; 'openldap-devel-request(a)openldap.org' Subject: Need sample OpenLDAP client test program connecting to LDAP server over SSL Hi, OpenLDAP developers, Do you have any sample test programs (or code snippets) that uses OpenLDAP client API to connect to LDAP server over SSL? Thanks in advance. Daisy

3 11

Status of persistent search in OpenLDAP
by Clément OUDOT 01 Sep '11

01 Sep '11

Hello, I tried to know if the persistent search control (OID 2.16.840.1.113730.3.4.3) was supported in OpenLDAP. The latests messages I read were saying "no", as we can see in this discussion: http://www.openldap.org/lists/openldap-technical/201008/msg00246.html But this blog entry is saying this control was introduced in OpenLDAP 2.2: http://www.connexitor.com/blog/pivot/entry.php?id=112 So can you confirm that OpenLDAP 2.4 does not support persistent search control? Is this feature planned? Thanks for your help, Clément.

4 7

task slapd blocked for more than 120 seconds.
by ml+openldap＠esmtp.org 01 Sep '11

01 Sep '11

I'm trying some scenarios to see how syncrepl behaves in certain error conditions. In one of these slapd blocks and is terminated(?) (2.4.23 and 2.4.26, running on RH 5.5): slapd D ffff810002536420 0 21032 1 21037 4521 (NOTLB) slapd D ffff810002536420 0 21032 1 21037 4521 (NOTLB) ffff810003f3fce8 0000000000000082 ffff81007eaae080 ffff81007faec100 000ec08328ac597e 0000000000000007 ffff81007eaae080 ffffffff80311b60 000ec0832bef5b8d 0000000000000990 ffff81007eaae268 0000000000000001 Call Trace: [<ffffffff8006315f>] wait_for_completion+0x79/0xa2 [<ffffffff8008e430>] default_wake_function+0x0/0xe [<ffffffff8004213e>] exit_mm+0x76/0xf5 [<ffffffff800158e6>] do_exit+0x305/0x965 [<ffffffff80049392>] cpuset_exit+0x0/0x88 [<ffffffff8002b42d>] get_signal_to_deliver+0x465/0x494 [<ffffffff8005af5e>] do_notify_resume+0x9c/0x7af [<ffffffff8008e430>] default_wake_function+0x0/0xe [<ffffffff80031545>] do_fork+0x148/0x1c1 [<ffffffff800a6061>] sys_futex+0x10a/0x12b [<ffffffff8005d19f>] sysret_signal+0x1c/0x27 [<ffffffff8005d427>] ptregscall_common+0x67/0xac INFO: task slapd:21037 blocked for more than 120 seconds. How to reproduce: Configuration: one master with a push replica (see also ITS 6999). On the replica: stop slapd, clean out the database directory, set up the essential files, start slapd. On the master: add a new entry to LDAP and run ldapsearch on that entry afterwards: the command hangs. ldap log entries for this: conn=1002 fd=20 ACCEPT from PATH=/var/run/ldapi (PATH=/var/run/ldapi) conn=1002 op=0 BIND dn="cn=Manager" method=128 conn=1002 op=0 BIND dn="cn=Manager" mech=SIMPLE ssf=0 conn=1002 op=0 RESULT tag=97 err=0 text= conn=1002 op=1 ADD dn="uid=user2002,ou=People,dc=example,dc=com" slap_queue_csn: queing 0x43224150 20110831224446.739440Z#000000#001#000000 syncprov_sendresp: cookie=rid=001,sid=001,csn=20110831224446.739440Z#000000#001#000000 do_syncrep2: rid=001 cookie=rid=001,sid=001,csn=20110831224446.739440Z#000000#001#000000 syncrepl_entry: rid=001 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) conn=1002 op=2 UNBIND conn=1002 op=1 RESULT tag=105 err=0 text= slap_graduate_commit_csn: removing 0x2aaab0004160 20110831224446.739440Z#000000#001#000000 conn=1002 fd=20 closed syncrepl_entry: rid=001 be_search (0) syncrepl_entry: rid=001 uid=user2002,ou=People,dc=example,dc=com slap_queue_csn: queing 0x5d4ea70 20110831224446.739440Z#000000#001#000000 syncrepl_entry: rid=001 be_add uid=user2002,ou=People,dc=example,dc=com (32) Is this an error in slapd or in RH?

1 0

Multi Master replication error
by arun.sasi1＠wipro.com 01 Sep '11

01 Sep '11

Hello Team, Issue:- Multi master replication, I have configured multimaster server in the infra, but only one server can replicate and write the data... and another server I can write but it is not replicating to another server. Server names Oldap01.domain.com > Yes I am able replicate and write the data to oldap03.domain.com Oldap03.domain.com > I can write the data but changes are not replicating to oldap01.domain.com Below are the logs from oldap03.domain com server. Sep 2 22:33:02 oldap03 slapd[6767]: do_syncrep2: rid=003 LDAP_RES_SEARCH_RESULT Sep 2 22:33:12 oldap03 slapd[6767]: daemon: epoll: listen=8 active_threads=0 tvp=zero Sep 2 22:33:12 oldap03 slapd[6767]: daemon: epoll: listen=9 active_threads=0 tvp=zero Sep 2 22:33:12 oldap03 slapd[6767]: daemon: epoll: listen=10 active_threads=0 tvp=zero Sep 2 22:33:12 oldap03 slapd[6767]: daemon: epoll: listen=11 active_threads=0 tvp=zero Sep 2 22:33:12 oldap03 slapd[6767]: daemon: epoll: listen=12 active_threads=0 tvp=zero Configuration in oldap01.domain.com vi olcDatabase\=\{0\}config.ldif dn: olcDatabase={0}config objectClass: olcDatabaseConfig olcDatabase: {0}config structuralObjectClass: olcDatabaseConfig entryUUID: 8b9b46f4-69c2-1030-9437-4bf7fbbdbef2 creatorsName: cn=config createTimestamp: 20110902151824Z olcRootDN: cn=admin,cn=config olcRootPW:: c2VjcmV0 olcSyncrepl: {0}rid=001 provider=ldap://oldap01.emb.slb.com binddn="cn=admin,c n=config" bindmethod=simple credentials=secret searchbase="cn=config" type=re freshAndPersist retry="5 5 300 5" timeout=1 olcSyncrepl: {1}rid=002 provider=ldap://oldap03.emb.slb.com binddn="cn=admin,c n=config" bindmethod=simple credentials=secret searchbase="cn=config" type=re freshAndPersist retry="5 5 300 5" timeout=1 olcMirrorMode: TRUE entryCSN: 20110902151840.657300Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20110902151840Z vi olcDatabase\=\{1\}hdb.ldif dn: olcDatabase={1}hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=emb,dc=slb,dc=com olcLastMod: TRUE olcRootPW:: c2VjcmV0 olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 structuralObjectClass: olcHdbConfig entryUUID: 8cbd67d8-69c2-1030-944e-7d5b88770cfe creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth createTimestamp: 20110902151826Z olcDbIndex: entryUUID eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: loginShell eq olcDbIndex: uid eq,pres,sub olcDbIndex: memberUid eq,pres,sub olcDbIndex: uniqueMember eq,pres olcDbIndex: sambaSID eq olcDbIndex: sambaPrimaryGroupSID eq olcDbIndex: sambaGroupType eq olcDbIndex: sambaSIDList eq olcDbIndex: sambaDomainName eq olcDbIndex: default sub olcDbIndex: entryCSN eq olcRootDN: cn=admin,dc=emb,dc=slb,dc=com olcSyncrepl: {0}rid=003 provider=ldap://oldap01.emb.slb.com binddn="cn=admin,d c=emb,dc=slb,dc=com" bindmethod=simple credentials=secret searchbase="dc=emb, dc=slb,dc=com" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeou t=1 olcSyncrepl: {1}rid=004 provider=ldap://oldap03.emb.slb.com binddn="cn=admin,d c=emb,dc=slb,dc=com" bindmethod=simple credentials=secret searchbase="dc=emb, dc=slb,dc=com" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeou t=1 olcMirrorMode: TRUE entryCSN: 20110902151842.375156Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20110902151842Z Configuration in oldap03.domain.com The same as above configuration Could you please help me to solve this issue.. Thanks & Regards, Arun Sasi V ------------------------------------------------------------------------ ------------------------------------------------------------- Sr. Engineer - Server Management (UNIX), Wipro Infotech (GSMC) |Direct +918213029356 Mob: +919731031500 | E: arun.sasi1(a)wipro.com <mailto:koresh.dash@wipro.com> Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

1 0

Memory Leak in slapd (or did I miss something configuring?)
by Thomas Rasmussen 01 Sep '11

01 Sep '11

Hello (originally posted to -bugs list, but think this might be the correct list) I have an openldap installation setup which appears to have a memory leak which I have not been able to solve by upgrading software etc. which is why I'm submitting this, if this is the wrong list, please let me know. The setup is: - OpenLDAP server running 2.4.26, compiled against db-5.2.28, heimdal 1.2.1. - Server is SunOS servername 5.10 Generic_141445-09 i86pc i386 i86pc, 6GB of RAM and 5GB of swap (in a VMWare ESX environment) I have the following in my DB_CONFIG file: set_cachesize 0 52428800 0 set_lg_regionmax 1048576 set_lg_max 10485760 set_lg_bsize 2097152 set_lg_dir /pack/openldap/var/openldap-crl-logs In my slapd.conf I have the following entries (I stripped out some restricts and other irrelevant lines) include /pack/openldap/etc/openldap/schema/core.schema include /pack/openldap/etc/openldap/schema/entrust.attributes.cfg include /pack/openldap/etc/openldap/schema/entrust.objectclasses.cfg idletimeout 300 pidfile /pack/openldap/var/run/slapd-crl.pid argsfile /pack/openldap/var/run/slapd-crl.args threads 4 database bdb suffix "c=DK" directory /pack/openldap/var/openldap-crl index objectClass,entryCSN,entryUUID eq checkpoint 128 1 dbnosync overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 serverID 2 monitoring off idletimeout 10 Just FYI, the server is a clone of another server currently running syncprov replication between two nodes, hence the syncprov lines. This server has the same databases as the production ones, but I just moved it to isolated area and removed all sync options from slapd. My database is rather big: vs24n02z2.prl1:/pack/openldap/var/openldap-crl root$ du -sh *.bdb 961M dn2id.bdb 162M entryCSN.bdb 67M entryUUID.bdb 10G id2entry.bdb 4.0M objectClass.bdb but I'd imagine this not beeing a problem (other than some performance issues, but this is not the problem here). Now, when I start up my slapd, it consumes around 6MB RAM, all is fine, I can perform searches and updates without problems. But my memory consumption is going through the roof! If I perform a search through the part of the database having alot of data, I suddenly find slapd using 500+ MB of memory... In our production setup, we actually see that after a couple of weeks, slapd is consuming 3+ GB of memory, and then at some point hits a Out of memory, and crashes. Our production setup is infact a openldap 2.4.22 with berkeley db 4.6.21, and my test server (cloned in a vmware environment) has just upgraded this environment by this recipe: Using db-4.6.21 * db_checkpoint -1 * db_recover -h <path to bdb files> install db-5.2.28 * Loop through all bdb files: db_upgrade <bdb file> * install openldap 2.4.26 (compiled against db-5.2.28) * start slapd The server which updates the LDAP is performing many search and updates, which is probably why memory consumption is exploding after restarts? Now, my main concern is, how (if possible) can we procede with this? We really need to find the problem as this causes production problems whenever the ldap crashes. Regards Thomas

3 7

TLS issue with SLES11
by pradyumna dash 01 Sep '11

01 Sep '11

List, It would be great if someone can share doc on TLS with OpenLDAP configuration on SLES 11, I tried all the possible ways to make it happen but no luck. I tried with both yast2 and by CA.pl and openssl commands, but no luck, When i do netstat .lnap |grep ldap it shows both 636 and 389 port listtening to the hostname, When i check the logs it shows the destination port its showing is 389. But when i try ldapsearch -x -H ldaps://hostname, its also showing me the ldap contents, dont know whats wrong, I also tried to open /etc/sysconfig/openldap and assigned the LDAP service to run on 127.0.0.1, but if i do so then its not able to get the server. Please help. Regards, Neo

4 6

slapd-meta per operation server
by Kapetanakis Giannis 01 Sep '11

01 Sep '11

Hi, I'm trying to setup an LDAP Proxy using the slapd-meta database. Is there a way to define different servers per operation? I want servers r1 and r2 for read only operations and server w1 w2 for write operations (add, delete etc) for a single suffix. Is this possible with openldap? I've seen about the "default-target" directive but it's not clear what it actually does. best regards, Giannis

2 2

rewritting binds and attempting to cache search for attr=1.1 - segmentation fault
by Perrin, David 31 Aug '11

31 Aug '11

Hello, thank you for reading this post! Is it possible to configure openldap to cache the search operation necessary to perform mapped bind rewrites? The slapo-pcache man page has given me hope but I'm stuck making it happen. I'm able to map and rewrite a bind, cache binds, and cache search results. But I'm stuck trying to cache the search operation that openldap completes for looking up a mapped attribute. For example I can bind with a string like: mail=pfoo(a)somedomain.com,ou=Students,dc=domain,dc=com slapd.conf maps that through overlay rwm like: rwm-rewriteMap ldap source2dn "ldap:///ou=Students,dc=TEST_HOST,dc=TEST_COM?dn?sub" rwm-rewriteContext bindDN rwm-rewriteRule "(.+,)?dc=TEST_HOST,dc=TEST_COM" "$1dc=TEST_HOST,dc=TEST_COM" ":" to an actual DN of: cn=Foo\, Peter (pfoo),ou=Students,dc=domain,dc=com and some pcache definitions will cache binds and certain searches - this works great. In reviewing the openldap log and network packets to confirm caching, I noticed search requests to attr=1.1. So I tried to define a pcachetemplate for those requests like this: pcacheAttrset 0 1.1 pcacheTemplate (mail=) 0 1800 When I search for attribute 1.1 and bind using a dn that doesn't need to be rewritten, I get search results and they are cached. However, when I search for 1.1 and bind using a dn that needs to be rewritten, the server complains of a segmentation fault. conn=1000 fd=12 ACCEPT from IP=127.0.0.1:54533 (IP=0.0.0.0:389) conn=1000 op=0 BIND dn="mail=pfoo(a)somedomain.com,ou=Students,dc=TEST_HOST,dc=TEST_COM" method=128 conn=1001 fd=14 ACCEPT from IP=127.0.0.1:54534 (IP=0.0.0.0:389) conn=1001 op=0 SRCH base="ou=Students,dc=TEST_HOST,dc=TEST_COM" scope=2 deref=0 filter="(mail=pfoo(a)somedomain.com)" conn=1001 op=0 SRCH attr=1.1 query template of incoming query = (mail=) Entering QC, querystr = (mail=pfoo(a)somedomain.com) Lock QC index = 0xa2d8798 Not answerable: Unlock QC index=0xa2d8798 QUERY NOT ANSWERABLE QUERY CACHEABLE Segmentation fault And with loglevel -1: ** ld 0xb3a08480 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0xb3a08480 request count 1 (abandoned 0) ** ld 0xb3a08480 Response Queue: * msgid 1, type 100 ld 0xb3a08480 response count 1 ldap_chkResponseList ld 0xb3a08480 msgid 1 all 1 ldap_chkResponseList returns ld 0xb3a08480 NULL ldap_int_select Segmentation fault Is there a setting to have openldap cache internal operations like that or is there a way to cache that special attr=1.1 search operation? Any suggestions would be greatly appreciated. Many thanks! Dave # from slapd.conf # 2.4.26 (--enable-overlays --enable-bdb --enable-ldap --enable-meta --with-tls=openssl) include /opt/openldap/proxy/etc/openldap/schema/core.schema include /opt/openldap/proxy/etc/openldap/schema/cosine.schema include /opt/openldap/proxy/etc/openldap/schema/inetorgperson.schema include /opt/openldap/proxy/etc/openldap/schema/myorg.schema pidfile /opt/openldap/proxy/var/run/slapd.pid argsfile /opt/openldap/proxy/var/run/slapd.args loglevel -1 database ldap lastmod off suffix "dc=TEST_HOST,dc=TEST_COM" rootdn "cn=admin,dc=TEST_HOST,dc=TEST_COM" rootpw config uri "ldap://10.100.142.132" idassert-bind bindmethod=simple mode=self binddn="cn=testadmin,cn=Users,dc=TEST_HOST,dc=TEST_COM" credentials="secret" idassert-authzFrom "dn.regex:.*" # cache of ldap is in bdb format overlay pcache pcache bdb 100000 2 50 900 pcacheAttrset 0 * pcacheTemplate (&(sn=)(givenname=)) 0 1800 pcacheBind (&(sn=)(givenname=)) 0 1800 sub "ou=Students,dc=TEST_HOST,dc=TEST_COM" # with this definition, the server will segmentation fault after search/bind requests where the bind needs to be rewritten #pcacheAttrset 1 1.1 #pcacheTemplate (mail=) 1 1800 cachesize 100000 pcachePosition tail directory /var/lib/ldap index sn,givenname pres,eq,sub index cn pres,eq,sub index mail eq index objectclass eq # *************************************************************** # start of rewrite stuff overlay rwm rwm-rewriteEngine on rwm-map attribute studentID employeeID ## source DN map rwm-rewriteMap ldap source2dn "ldap:///ou=Students,dc=TEST_HOST,dc=TEST_COM?dn?sub" rwm-rewriteContext default rwm-rewriteRule "(.+,)?dc=TEST_HOST,dc=TEST_COM" "$1dc=TEST_HOST,dc=TEST_COM" ":" rwm-rewriteContext bindDN rwm-rewriteRule "^mail=([^,]*),ou=Students,dc=TEST_HOST,dc=TEST_COM" "${source2dn(mail=$1)}" ":"

2 1

No connection message.
by Daniel Lopes de Carvalho 31 Aug '11

31 Aug '11

Hi, I was looking to my log messages and slapd always send a message like this: slapd[PID]: connection_read(##): no connection! Is there a way to correct this issue or supress this message? Why the slapd getting this message? Thanks Daniel

3 2

User quota control under LDAP.
by Daniel Lopes de Carvalho 31 Aug '11

31 Aug '11

Hi, I would like to know if there is a way to get control of my users disk quota with LDAP. Is there any attribute, objectclass or schema to do that? I have Windows and Linux users and would like to control NFS and Samba quota. Thanks Daniel

3 2

RE: N-way multi master configuration issue
by Naga Chaitanya Palle 31 Aug '11

31 Aug '11

Any inputs please? ________________________________________ From: Naga Chaitanya Palle Sent: Monday, August 29, 2011 1:37 PM To: Buchan Milne Cc: openldap-technical(a)openldap.org Subject: RE: N-way multi master configuration issue Hi Buchan, After making the changes are per your suggestions, I am still not able to read data between the servers. Also, I deleted DI data on server 2 and restarted to import data from server1 , but no use. Can you please check the slapd.conf files and suggest. Server 1 slapd.conf file # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/share/openldap2.4/schema/sudo.schema include /usr/share/openldap2.4/schema/core.schema include /usr/share/openldap2.4/schema/cosine.schema include /usr/share/openldap2.4/schema/inetorgperson.schema include /usr/share/openldap2.4/schema/nis.schema include /usr/share/openldap2.4/schema/misc.schema include /usr/share/openldap2.4/schema/openldap.schema include /usr/share/openldap2.4/schema/ppolicy.schema include /usr/share/openldap2.4/schema/corba.schema loglevel 296 # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/ldap2.4/slapd.pid argsfile /var/run/ldap2.4/slapd.args access to attrs=userPassword by self write by users read by anonymous auth #access to attrs=shadowLastChange # by self write # by * auth access to * by * read access to * by dn.base="cn=Manager,dc=comverse-in,dc=com" read by * break # Load dynamic backend modules: # modulepath /usr/lib/openldap # dummy test certificate which you can generate by changing to # /etc/pki/tls/certs, running "make slapd.pem", and fixing permissions on # slapd.pem so that the ldap user or group can read it. Your client software # may balk at self-signed certificates, however. # TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt # TLSCertificateFile /etc/pki/tls/certs/slapd.pem # TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem #TLSCipherSuite HIGH:MEDIUM:+SSLv2 #TLSCACertificateFile /etc/openldap2.4/cacerts/cacert.pem #TLSCertificateFile /etc/openldap2.4/cacerts/slapd-cert.pem #TLSCertificateKeyFile /etc/openldap2.4/cacerts/slapd-key.pem # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # ldbm and/or bdb database definitions ####################################################################### serverId 001 database bdb suffix "dc=comverse-in,dc=com" rootdn "cn=Manager,dc=comverse-in,dc=com" rootpw {SSHA}9tKeVZfgKFCfgIFQxXt5esH0HhQk1dIS # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret # rootpw {crypt}ijFYNcSNctBYg # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap2.4 # Indices to maintain for this database #index objectClass eq,pres #index ou,cn,mail,surname,givenname eq,pres,sub #index uidNumber,gidNumber,loginShell eq,pres #index uid,memberUid eq,pres,sub #index nisMapName,nisMapEntry eq,pres,sub #index sudoUser eq index sudoUser eq index member eq index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub #index objectclass,entryCSN,entryUUID eq # Load dynamic backend modules: # modulepath /usr/lib/openldap modulepath /usr/lib/openldap2.4 # modules available in openldap-servers-overlays RPM package: # moduleload accesslog.la # moduleload auditlog.la # moduleload denyop.la # moduleload dyngroup.la # moduleload dynlist.la # moduleload lastmod.la # moduleload pcache.la moduleload ppolicy.la # moduleload refint.la # moduleload retcode.la # moduleload rwm.la # moduleload smbk5pwd.la moduleload syncprov.la # moduleload translucent.la # moduleload unique.la # moduleload valsort.la # modules available in openldap-servers-sql RPM package: # moduleload back_sql.la syncrepl rid=123 provider=ldap://devonly144.comverse-in.com type=refreshAndPersist interval=00:00:01:00 searchbase="dc=comverse-in,dc=com" filter="(objectClass=*)" scope=sub attrs="*" schemachecking=off bindmethod=simple binddn="cn=Manager,dc=comverse-in,dc=com" credentials=sonora index objectClass,entryCSN,entryUUID eq mirrormode true overlay syncprov syncprov-checkpoint 100 10 overlay ppolicy ppolicy_default "cn=DefaultPassword,ou=pwpolicies,dc=comverse-in,dc=com" ppolicy_hash_cleartext ppolicy_use_lockout #SUDOERS_BASE=ou=SUDOers,dc=comverse-in,dc=com # Replicas of this database #replogfile /var/lib/ldap/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com(a)EXAMPLE.COM #replogfile /var/lib/ldap/openldap-master-replog #replica uri=ldaps://rht144.comverse-in.com:389 starttls=critical Server2 slapd.conf file # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/share/openldap2.4/schema/sudo.schema include /usr/share/openldap2.4/schema/core.schema include /usr/share/openldap2.4/schema/cosine.schema include /usr/share/openldap2.4/schema/inetorgperson.schema include /usr/share/openldap2.4/schema/nis.schema include /usr/share/openldap2.4/schema/misc.schema include /usr/share/openldap2.4/schema/openldap.schema include /usr/share/openldap2.4/schema/ppolicy.schema include /usr/share/openldap2.4/schema/corba.schema loglevel 296 # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/ldap2.4/slapd.pid argsfile /var/run/ldap2.4/slapd.args access to attrs=userPassword by self write by users read by anonymous auth #access to attrs=shadowLastChange # by self write # by * auth access to * by * read access to * by dn.base="cn=Manager,dc=comverse-in,dc=com" read by * break # Load dynamic backend modules: # modulepath /usr/lib/openldap # dummy test certificate which you can generate by changing to # /etc/pki/tls/certs, running "make slapd.pem", and fixing permissions on # slapd.pem so that the ldap user or group can read it. Your client software # may balk at self-signed certificates, however. # TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt # TLSCertificateFile /etc/pki/tls/certs/slapd.pem # TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem #TLSCipherSuite HIGH:MEDIUM:+SSLv2 #TLSCACertificateFile /etc/openldap2.4/cacerts/cacert.pem #TLSCertificateFile /etc/openldap2.4/cacerts/slapd-cert.pem #TLSCertificateKeyFile /etc/openldap2.4/cacerts/slapd-key.pem # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! ####################################################################### # ldbm and/or bdb database definitions ####################################################################### serverId 002 #database bdb database bdb #suffix "dc=comverse-in,dc=com" suffix "dc=comverse-in,dc=com" #rootdn "cn=Manager,dc=comverse-in,dc=com" rootdn "cn=Manager,dc=comverse-in,dc=com" rootpw {SSHA}4qLml3DcOyfwiKlN/garIms4a8fmsNkx #rootpw sonora # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. # rootpw secret # rootpw {crypt}ijFYNcSNctBYg # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap2.4 # Indices to maintain for this database #index objectClass eq,pres #index ou,cn,mail,surname,givenname eq,pres,sub #index uidNumber,gidNumber,loginShell eq,pres #index uid,memberUid eq,pres,sub #index nisMapName,nisMapEntry eq,pres,sub #index sudoUser eq index sudoUser eq index member eq index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub #index objectclass,entryCSN,entryUUID eq # Load dynamic backend modules: # modulepath /usr/lib/openldap modulepath /usr/lib/openldap2.4 # modules available in openldap-servers-overlays RPM package: # moduleload accesslog.la # moduleload auditlog.la # moduleload denyop.la # moduleload dyngroup.la # moduleload dynlist.la # moduleload lastmod.la # moduleload pcache.la moduleload ppolicy.la # moduleload refint.la # moduleload retcode.la # moduleload rwm.la # moduleload smbk5pwd.la moduleload syncprov.la # moduleload translucent.la # moduleload unique.la # moduleload valsort.la # modules available in openldap-servers-sql RPM package: # moduleload back_sql.la overlay ppolicy ppolicy_default "cn=DefaultPassword,ou=pwpolicies,dc=comverse-in,dc=com" ppolicy_hash_cleartext ppolicy_use_lockout #SUDOERS_BASE=ou=SUDOers,dc=comverse-in,dc=com # Replicas of this database #replogfile /var/lib/ldap/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com(a)EXAMPLE.COM #replogfile /var/lib/ldap/openldap-master-replog #replica uri=ldaps://rht144.comverse-in.com:389 starttls=critical binddn="cn=Manager,dc=comverse-in,dc=com" bindmethod=simple credentials=sonora #serverId 2 syncrepl rid=124 provider=ldap://uplite98.comverse-in.com type=refreshAndPersist interval=00:00:01:00 searchbase="dc=comverse-in,dc=com" filter="(objectClass=*)" scope=sub attrs="*" schemachecking=off bindmethod=simple binddn="cn=Manager,dc=comverse-in,dc=com" credentials=sonora #updateref ldap://uplite98.comverse-in.com index objectClass,entryCSN,entryUUID eq mirrormode true overlay syncprov syncprov-checkpoint 100 10 Thanks and Regards, Naga Chaitanya -----Original Message----- From: Buchan Milne [mailto:bgmilne@staff.telkomsa.net] Sent: Friday, August 26, 2011 7:15 PM To: Naga Chaitanya Palle Cc: openldap-technical(a)openldap.org Subject: Re: N-way multi master configuration issue On Friday, 26 August 2011 15:28:13 Naga Chaitanya Palle wrote: > Hi buchan, > > My server 1 is uplite98.comverse-in.com. In its slapd.conf, I have syncrepl > pointing to server 2 devonly144.comverse-in.com and vice versa for > server2. Then your serverid (and, it should actually be serverId) is wrong: > > serverid 124 ldap://devonly144.comverse-in.com > > syncrepl rid=124 > > > > provider=ldap://devonly144.comverse-in.com:389 The URI form of serverId is useful if you have the same configuration on all your masters, in which case the listening address of your server must match one of the URIs. You may want to use this form for now: serverId 1 If your serverId's weren't correct (check the contextCSNs), you should probably re-import an export of one server on the other one. > I did not exactly understand what you indicated. > Can you please be more specific about what changes needs to be done in the > slapd.conf file? In a multi-master setup, each server should be replicating off *all* servers, including itself. > Thanks and Regards, > Naga Chaitanya > > -----Original Message----- > From: Buchan Milne [mailto:bgmilne@staff.telkomsa.net] > Sent: Friday, August 26, 2011 6:56 PM > To: openldap-technical(a)openldap.org > Cc: Naga Chaitanya Palle > Subject: Re: N-way multi master configuration issue > > On Friday, 26 August 2011 12:56:38 Naga Chaitanya Palle wrote: > > Hi, > > > > I am trying to set up N-way multimaster configuration using syncrepl on > > openldap2.4 for RHEL 5.4 > > > > Currently I am using two masters for testing. > > > > The slapd.conf on server1 is > > moduleload syncprov.la > > serverid 124 ldap://devonly144.comverse-in.com > > syncrepl rid=124 > > > > provider=ldap://devonly144.comverse-in.com:389 > > type=refreshAndPersist > > interval=00:00:01:00 > > searchbase="dc=comverse-in,dc=com" > > filter="(objectClass=*)" > > scope=sub > > attrs="*" > > schemachecking=off > > bindmethod=simple > > binddn="cn=Manager,dc=comverse-in,dc=com" > > credentials=sonora > > > > index objectClass,entryCSN,entryUUID eq > > mirrormode true > > > > overlay syncprov > > syncprov-checkpoint 100 10 > > > > > > The slapd.conf on server2 is > > moduleload syncprov.la > > serverid 123 ldap://uplite98.comverse-in.com > > syncrepl rid=123 > > > > provider=ldap://uplite98.comverse-in.com:389 > > type=refreshAndPersist > > interval=00:00:01:00 > > searchbase="dc=comverse-in,dc=com" > > filter="(objectClass=*)" > > scope=sub > > attrs="*" > > schemachecking=off > > bindmethod=simple > > binddn="cn=Manager,dc=comverse-in,dc=com" > > credentials=sonora > > > > index objectClass,entryCSN,entryUUID eq > > mirrormode true > > > > overlay syncprov > > syncprov-checkpoint 100 10 > > > > But there is no data synchronization happening between the severs. > > Of course not, you have configured each server only to replicate from > itself. > > > When I added test3 user on server1, it is not reflecting on server 2. > > Same way when I added test4 user on server2 it is not reflecting on > > server1. > > > > Please let me know what is missing in this configuration. > > syncrepl statements pointing to the other master. > > Regards, > Buchan > > > > > =========================================================================== > ==== Please refer to http://www.aricent.com/legal/email_disclaimer.html for > important disclosures regarding this electronic communication. > ========================================================================== > ===== =============================================================================== Please refer to http://www.aricent.com/legal/email_disclaimer.html for important disclosures regarding this electronic communication. ===============================================================================

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical