- openldap-technical - openldap.org

LDAP ACL configuration Problem ???
by vijay s sheelavantar 30 Aug '11

30 Aug '11

Hi,I am running openldap-2.4.26 on one machine (fedora 10) and pam_ldap-186 (fedora 10) on another machine.(anonymous binding) whenever a user authentication request is recieved by ldap server, it is giving the following error. ldap_read: want=8 error=Resource temporarily unavailable ldap.conf configuration is as follows.base dc=samsung,dc=comhost 10.254.204.181 slapd.conf configuration is as follows. include         /usr/local/etc/openldap/schema/core.schemainclude         /usr/local/etc/openldap/schema/cosine.schemainclude         /usr/local/etc/openldap/schema/inetorgperson.schema#include                /usr/local/etc/openldap/schema/nis.schema pidfile         /usr/local/var/run/slapd.pidargsfile        /usr/local/var/run/slapd.args access to attrs=userpassword by self       write by anonymous  auth by *          none access to *       by self       write#       by group.exact="cn=hrpeople,ou=groups,dc=example,dc=com"#                     write       by users      read       by *          none ######################################################################## BDB database definitions####################################################################### database        bdbsuffix          "dc=samsung,dc=com"rootdn          "cn=Manager,dc=samsung,dc=com"# Cleartext passwords, especially for the rootdn, should# be avoid.  See slappasswd(8) and slapd.conf(5) for details.# Use of strong authentication encouraged.rootpw          123qwe# The database directory MUST exist prior to running slapd AND# should only be accessible by the slapd and slap tools.# Mode 700 recommended.directory       /usr/local/var/openldap-data# Indices to maintain#unique id so equality match onlyindex   uid     eqindex   userPassword    eq#allows general searching on commonname,givenname and mailindex   cn,gn,sn,ou,o,mail eq,subindex   objectClass     eq and my LDIF file has user entry as follows. dn: cn=vijay s,ou=people,dc=samsung,dc=comobjectClass: inetOrgPersoncn:vijay sheelavantarcn: vijay suid: vijayuserPassword: 123qwesn: sheelavantar Kindly let me know where I am making mistake... Warm Regards,VIJAY S.

1 0

sudoers: not able to execute commands with sudo
by Naga Chaitanya Palle 29 Aug '11

29 Aug '11

Hi, I have configured sudoers in my environment. But when I try to execute a command using sudo, the commands fails to get executed saying "sysadmin is not in the sudoers file. This incident will be reported." . I am using sysadmin account as mentioned in the below sudoers ldif file. login as: sysadmin sysadmin(a)10.150.14.144's password: Last login: Mon Aug 29 14:58:50 2011 from 10.150.10.158 Could not chdir to home directory /home/sysadmin: No such file or directory -bash-3.2$ sudo ls [sudo] password for sysadmin: sysadmin is not in the sudoers file. This incident will be reported. -bash-3.2$ sudo -V Sudo version 1.7.2p1 -bash-3.2$ sudo -l [sudo] password for sysadmin: Sorry, user sysadmin may not run sudo on devonly144. -bash-3.2 On Server the sudoers file is /etc/openldap/slapd.conf include /usr/share/openldap2.4/schema/sudo.schema index sudoUser eq /etc/openldap/ldap.conf sudoers_base ou=SUDOers,dc=comverse-in,dc=com sudoers.ldif # SUDOers, comverse-in.com dn: ou=SUDOers,dc=comverse-in,dc=com objectClass: top objectClass: organizationalUnit ou: SUDOers dn: cn=defaults,ou=SUDOers,dc=comverse-in,dc=com objectClass: top objectClass: sudoRole cn: defaults description: Default sudoOption's go here sudoOption: syslog=auth dn: cn=root,ou=SUDOers,dc=comverse-in,dc=com objectClass: top objectClass: sudoRole cn: root sudoUser: root sudoUser: sysadmin sudoHost: ALL sudoRunAsUser: ALL sudoCommand: ALL dn: cn=%wheel,ou=SUDOers,dc=comverse-in,dc=com objectClass: top objectClass: sudoRole cn: %wheel sudoUser: %wheel sudoHost: ALL sudoRunAsUser: ALL sudoCommand: ALL dn: cn=operator,ou=SUDOers,dc=comverse-in,dc=com objectClass: top objectClass: sudoRole cn: operator sudoUser: operator sudoHost: ALL sudoCommand: /usr/sbin/dump sudoCommand: /usr/sbin/rdump sudoCommand: /usr/sbin/restore sudoCommand: /usr/sbin/rrestore sudoCommand: /usr/bin/mt sudoCommand: /usr/bin/kill sudoCommand: /usr/sbin/shutdown sudoCommand: /usr/sbin/halt sudoCommand: /usr/sbin/reboot sudoCommand: /usr/sbin/lpc sudoCommand: /usr/bin/lprm sudoCommand: sudoedit /etc/printcap sudoCommand: /usr/oper/bin/ dn: cn=ALL,ou=SUDOers,dc=comverse-in,dc=com objectClass: top objectClass: sudoRole cn: ALL sudoUser: ALL sudoHost: orion sudoCommand: /sbin/umount /CDROM sudoCommand: /sbin/mount -o nosuid\ sudoCommand: nodev /dev/cd0a /CDROM sudoOption: !authenticate On client: /etc/ldap.conf sudoers_base ou=SUDOers,dc=comverse-in,dc=com nss_base_passwd ou=People,dc=comverse-in,dc=com?one nss_base_shadow ou=People,dc=comverse-in,dc=com?one nss_base_group ou=Group,dc=comverse-in,dc=com?one /etc/pam.d/login #%PAM-1.0 auth [user_unknown=ignore success=ok ignore=ignore default=bad] pam_securetty.so auth include system-auth auth required pam_securetty.so auth sufficient pam_ldap.so auth required pam_stack.so service=system-auth auth required pam_nologin.so account required pam_nologin.so account include system-auth account sufficient pam_ldap.so account required pam_stack.so service=system-auth password include system-auth password sufficient pam_ldap.so password required pam_stack.so service=system-auth # pam_selinux.so close should be the first session rule session required pam_selinux.so close session include system-auth session required pam_loginuid.so session optional pam_console.so # pam_selinux.so open should only be followed by sessions to be executed in the user context session required pam_selinux.so open session optional pam_keyinit.so force revoke session sufficient pam_ldap.so session required pam_stack.so service=system-auth session optional pam_console.so session required /lib/security/pam_limits.so /etc/nsswitch.conf passwd: ldap files shadow: ldap files group: ldap files Thanks and Regards, Naga Chaitanya =============================================================================== Please refer to http://www.aricent.com/legal/email_disclaimer.html for important disclosures regarding this electronic communication. ===============================================================================

3 3

Syncrepl over TLS for mirrormode
by Daniel Qian 29 Aug '11

29 Aug '11

From the openldap website the two nodes have to use different URLs like below: syncrepl rid=001 provider=ldap://ldap-sid2.example.com bindmethod=simple binddn="cn=mirrormode,dc=example,dc=com" credentials=mirrormode searchbase="dc=example,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" and syncrepl rid=001 provider=ldap://ldap-sid1.example.com bindmethod=simple binddn="cn=mirrormode,dc=example,dc=com" credentials=mirrormode searchbase="dc=example,dc=com" schemachecking=on type=refreshAndPersist retry="60 +" I can set two different certificates so that TLS is fine for sync between the two nodes. However we will have regular Ldap client access these two nodes behind a loadbalancer over TLS too. Obviously the client can't connect with ldap-sid2.example.com, nor with ldap-sid1.example.com. So what is the solution to this scenario? Setup a pool of consumers with same hostname? Thanks, Daniel

5 8

How to delete LDAP Data base bdb
by vijay s sheelavantar 29 Aug '11

29 Aug '11

Hello Friends, Please let me know how to delete/flush complete LDAP database ? I tried deleting all files from /var/openldap-data. but still top level data base attributes remains. initially I had set shadowExpire,shadowFlag etc, I want to remove all these. Kindly help me to build my new database. LDAP server log for your reference. ber_dump: buf=0x9a0ba80 ptr=0x9a0bab5 end=0x9a0bb3d len=136  0000:  00 81 85 04 04 68 6f 73  74 04 11 61 75 74 68 6f   .....host..autho  0010:  72 69 7a 65 64 53 65 72  76 69 63 65 04 0c 73 68   rizedService..sh  0020:  61 64 6f 77 45 78 70 69  72 65 04 0a 73 68 61 64   adowExpire..shad  0030:  6f 77 46 6c 61 67 04 0e  73 68 61 64 6f 77 49 6e   owFlag..shadowIn  0040:  61 63 74 69 76 65 04 10  73 68 61 64 6f 77 4c 61   active..shadowLa  0050:  73 74 43 68 61 6e 67 65  04 09 73 68 61 64 6f 77   stChange..shadow  0060:  4d 61 78 04 09 73 68 61  64 6f 77 4d 69 6e 04 0d   Max..shadowMin..  0070:  73 68 61 64 6f 77 57 61  72 6e 69 6e 67 04 09 75   shadowWarning..u  0080:  69 64 4e 75 6d 62 65 72                            idNumber Thanks and Regards,Vijay S.

1 0

N-way multi master configuration issue
by Naga Chaitanya Palle 29 Aug '11

29 Aug '11

Hi, I am trying to set up N-way multimaster configuration using syncrepl on openldap2.4 for RHEL 5.4 Currently I am using two masters for testing. The slapd.conf on server1 is moduleload syncprov.la serverid 124 ldap://devonly144.comverse-in.com syncrepl rid=124 provider=ldap://devonly144.comverse-in.com:389 type=refreshAndPersist interval=00:00:01:00 searchbase="dc=comverse-in,dc=com" filter="(objectClass=*)" scope=sub attrs="*" schemachecking=off bindmethod=simple binddn="cn=Manager,dc=comverse-in,dc=com" credentials=sonora index objectClass,entryCSN,entryUUID eq mirrormode true overlay syncprov syncprov-checkpoint 100 10 The slapd.conf on server2 is moduleload syncprov.la serverid 123 ldap://uplite98.comverse-in.com syncrepl rid=123 provider=ldap://uplite98.comverse-in.com:389 type=refreshAndPersist interval=00:00:01:00 searchbase="dc=comverse-in,dc=com" filter="(objectClass=*)" scope=sub attrs="*" schemachecking=off bindmethod=simple binddn="cn=Manager,dc=comverse-in,dc=com" credentials=sonora index objectClass,entryCSN,entryUUID eq mirrormode true overlay syncprov syncprov-checkpoint 100 10 But there is no data synchronization happening between the severs. When I added test3 user on server1, it is not reflecting on server 2. Same way when I added test4 user on server2 it is not reflecting on server1. Please let me know what is missing in this configuration. Thanks and Regards, Naga Chaitanya =============================================================================== Please refer to http://www.aricent.com/legal/email_disclaimer.html for important disclosures regarding this electronic communication. ===============================================================================

2 4

Re: Read-only Back-SQL
by masarati＠aero.polimi.it 28 Aug '11

28 Aug '11

> Hi, > > I have a little bit of, mainly experimental, experience configuring > back-sql to connect to a PostgreSQL database. I have a requirement in > front of me to expose a small table of user data in the database to an > existing LDAP client. The data in the database is already in the database > and managed by another application through the database directly. The > LDAP API I am being asked to provide will be read-only. In other words, > the data will continue to be managed by the existing management app. I > foresee two problems with this approach. > > First, since the database table is already populated when the new ldap > service is turned on, there is no data in the ldap_entries table. Is > there a way to populate ldap_entries after the fact so that the records > can be seen by OpenLDAP? > > Second, since the data is mastered by another application that goes > through SQL directly, is there a way to update the ldap_entries table on > the fly to reflect the additions and deletions that occur once the ldap > service is up and running? > > Right now I am looking at writing a custom procedure to initially populate > the ldap_entries table and then triggers to manage the additions and > deletions from that point onward. I was just wondering if there was > something in back-sql already that might provide a better solution. > > We are currently using OpenLDAP 2.4.21. In terms of a trigger, you could use ldapsync (RFC4533). Another "trick" that allows to automatically generate the ldap_entries table consists in using SQL views. This works relatively well for simple data structure (e.g. a single type of entries). p.

2 1

About... bdb_db_open: warning - no DB_CONFIG file found in directory /usr/local/openldap/var/openldap-data: (2)
by Nguyen, Quoc Khanh 28 Aug '11

28 Aug '11

Hi all, I have a notification when using slapadd: bdb_db_open: warning - no DB_CONFIG file found in directory /usr/local/openldap/var/openldap-data: (2) I try to fix it following site: http://www.secure-computing.net/wiki/index.php/OpenLDAP chown -R ldap:ldap /usr/local/openldap/var/openldap-data buit it failed: chown: invalid user: `ldap:ldap' What's i'm doing wrong? Maybe i don't understand about openldap 2.4.6... Please help, Best Regards, -- *********************************** EVERYTHING HAS JUST BEGUN...

2 3

Migrating server results in user password issues
by greep elem 27 Aug '11

27 Aug '11

Hi all, Hopefully someone can point me in the right direction as I appear to be going around in circles at this stage. I am attempting to migrate from one server running OpenLDAP 2.4.9 configured with old style slapd.conf to a new server running openldap 2.4.23 with the dynamic cn=config setup. I've successfully exported / imported via slapcat and slapadd and using phpLDAPadmin I can browse all my users. The issue I run into is the use passwords do not work when I try to log into services (e.g. IMAP). Using phpLDAPadmin I perform a password compare and it returns a mismatch. Looking at the slapcat output for a user, the "userPassword" is afaik md5 run though base64 and presented as such but once bas64 is decoded it matches what phpLDAPadmin reports if I export the user. userPassword:: e01somedandomdataPT0= I docode this : user(a)server.tld$ perl <<EOF > use MIME::Base64; > print decode_base64('e01somedandomdataPT0=') . "\n"; > EOF {MD5}thisisahash== Exporting the user in phpLDAPadmin and compare it's reported userPassword to the above perl output and they match. As they match I am at a loss as to why the password is not accepted when I try to login via IMAP or check password in phpLDAPadmin. As soon as I change the password, the account works find and the user can log in. Any help greatly appreciated, as I would rather not have to reset user passwords!

1 0

OpenLDAP create children only
by Derek Yarnell 27 Aug '11

27 Aug '11

Hi, I would like to give a set of users the ability to create objects in the directory under a specific dn. It seems by reading the Admin Manual (specifically the bottom of 8.3.1) that setting the children attribute I can create correctly. I do not wish that they can remove the DN after they have added. So I can't just give them write access to the DN or that will give them the ability to delete. Am I missing something or is this just not possible with the current ACL structure. Eg. olcAccess: {9} to dn="ou=groups,dc=example,dc=com" attrs=children by dn.children="ou=people,dc=example,dc=com" write So I would like to add a group, cn=foo,ou=groups,dc=example,dc=com but not allow someone in ou=people,dc=example,dc=com to delete the DN after it is created. Thanks, derek -- --- Derek T. Yarnell University of Maryland Institute for Advanced Computer Studies

2 1

Need sample OpenLDAP client test program connecting to LDAP server over SSL
by daisy.wu＠emc.com 27 Aug '11

27 Aug '11

Hi, OpenLDAP developers, Do you have any sample test programs (or code snippets) that uses OpenLDAP client API to connect to LDAP server over SSL? Thanks in advance. Daisy

2 1

Re: syncrepl consumer(with delta replication configuration) skipping updates
by Rupesh Thakkar 26 Aug '11

26 Aug '11

Thank Quanah,delta replication is working now. I increased "interval" and changed "type" to RefreshAndPersist, but real cause was "logfilter" ,I corrected it as below. syncrepl rid=124 .......... logfilter="(&(objectClass=auditWriteObject)(reqResult=0))". ....... Thanks Rupesh On Fri, Aug 26, 2011 at 1:56 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Friday, August 26, 2011 3:06 AM +0700 Rupesh Thakkar < > rupeshthakkar(a)gmail.com> wrote: > > >> I have configured syncrepl provider and consumer with syncrepl delta >> replication as in document >> > > The first piece of data to *always* provide is the version of OpenLDAP you > are running. > > > syncrepl rid=125 >> provider=ldap://10.52.35.204:**389<http://10.52.35.204:389> >> type=refreshOnly >> > > Save yourself headaches and use RefreshAndPersist > > > interval=00:00:00:10 >> > > This interval is probably not long enough between connections. Use > RefreshAndPersist instead, see above. > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

SASL Authentication Pass-Trough on several LDAP directories
by Clément OUDOT 26 Aug '11

26 Aug '11

Hi all, I searched in the mailing list archives but did not found any solution for my problem. Here it is: I want to enable SASL passwords with saslauthd but I have more than one LDAP directory as authentication backend. So the goal is to delegate the authentication to a specific directory depending on a user attribute. I know this is not directly possible with saslauthd and OpenLDAP, as OpenLDAP uses only one saslauthd socket, and saslauthd can use only one LDAP directory as backend (several for failover, but all with the same suffix, bind DN, etc.) My idea was to add an OpenLDAP meta between saslauthd and the LDAP backends, and use the domain part of the SASL credential to route the LDAP request to the good LDAP directory. For example: {SASL}alice@LDAP1 would bind to LDAP 1 and {SASL}bob@LDAP2 would bind to LDAP 2. As the domain part can be used in saslauthd configuration for the LDAP filter or the LDAP search base, we can maybe have this configuration in saslauthd.conf : ldap_search_base: ou=%d,dc=example,dc=com ldap_filter: uid=%U And then the OpenLDAP Meta would manage the ou=LDAP1,dc=example,dc=com and ou=LDAP2,dc=example,dc=com to access the target LDAP directory. Has everyone ever tried something like this? Do you have other suggestions? Thanks for your help, Clément.

1 1

syncrepl consumer(with delta replication configuration) skipping updates
by Rupesh Thakkar 25 Aug '11

25 Aug '11

I have configured syncrepl provider and consumer with syncrepl delta replication as in document http://www.openldap.org/doc/admin24/replication.html. The consumer log shows it receives synchronization cookies for new updates on provider. But actual entries are not getting reflected in consumer, the log below doesn’t seems show any errors. ----------------------------------------------------------------------------------------------------------------- do_syncrep2: rid=125 LDAP_RES_SEARCH_RESULT do_syncrep2: rid=125 cookie=rid=125,csn=20110823211754.204723Z#000000#000#000000 slap_queue_csn: queing 0xa2209020 20110823211754.204723Z#000000#000#000000 slap_graduate_commit_csn: removing 0xa2209050 20110823211754.204723Z#000000#000#000000 do_syncrep2: rid=125 LDAP_RES_SEARCH_RESULT ----------------------------------------------------------------------------------------------------------------- Any thoughts on this ? Below is consumer configuration syncrepl rid=125 provider=ldap://10.52.35.204:389 type=refreshOnly interval=00:00:00:10 retry="5 5 20 5" searchbase="dc=suretecsystems,dc=com" filter="(objectClass=person)" scope=sub attrs="cn,sn,objectClass" schemachecking=off bindmethod=simple binddn="cn=Replicator,dc=suretecsystems,dc=com" credentials=secret logbase="cn=accesslog" logfilter="(&(objectClass=person)(reqResult=0))" syncdata=accesslog limits dn.exact="cn=Replicator,dc=suretecsystems,dc=com" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited updateref ldap://10.52.35.204 Thanks Rupesh

2 1

sudo configuration details
by Naga Chaitanya Palle 25 Aug '11

25 Aug '11

Hi, I am planning to configure sudoers on openldap2.4 for RHEL 5.4. Can anyone share the configuration steps needs to be done at server and client end? Thanks and Regards, Naga Chaitanya =============================================================================== Please refer to http://www.aricent.com/legal/email_disclaimer.html for important disclosures regarding this electronic communication. ===============================================================================

1 0

Re: How to slapadd cn=config
by Olivier 25 Aug '11

25 Aug '11

Thanks Ralf, > slapadd -F <empty/slapd.d/directory> -bcn=config -l <ldiffile> That works to recover the db, but I would like to also use slapadd also to configure from scratch rather than editing files (and frankly I'm getting mad). Basic question : what would be the ldif file and slapadd command to be executed to modify let say "olcSuffix" and "olcRootDN" from the default to what I want, for example: olcSuffix: dc=nom,dc=fr olcRootDN: cn=Manager,dc=nom,dc=fr Thanks, --- Olivier Note: Here is an extract thart I get from a fresh ldap2.4 install, here is what I get in the ldap file generated by this : "slapcat -b 'cn=config' > ldif" dn: olcDatabase={1}bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {1}bdb olcSuffix: dc=my-domain,dc=com olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=Manager,dc=my-domain,dc=com On Fri, Aug 26, 2011 at 1:33 PM, Ralf Haferkamp <rhafer(a)suse.de> wrote: > On Tuesday 21 September 2010 13:55:08 Torsten Schlabach (Tascel eG) > wrote: >> Hi Howard! >> >> > Exactly the same way as you slapcat'd it. >> >> I don't actually understand ... ?? >> >> > What was the exact command line you used for slapcat? >> >> slapcat -b 'cn=config' > > Then try: > > slapadd -F <empty/slapd.d/directory> -bcn=config -l <ldiffile> > >> >> Regards, >> Torsten >> > [..] > > -- > Ralf > > > -- > Olivier >

1 0

replication breaks ppolicy
by rocke.robertson＠pch.gc.ca 24 Aug '11

24 Aug '11

Good morning all After quite a bit of work, I got replication working (thank you all). So I forged ahead and deployed the server in our RHEL 5.5 environment. But now I just realized that none of my ppolicy rules work. Also, the Redhat clients are configured to use MD5 hash. When I look at the accounts in webmin, it shows it being crypt????? I know openldap likes salted SHA, but I thought I'd do what Redhat wanted, which was MD5. Password history, aging etc... A search used to show me all of my ppolicy objects. ldapsearch -v -x -b 'dc=chin,dc=ca' cn=default But now returns nothing. Users can reuse passwords, so no history or aging is working. No locking. I had to change ACL's on the provider and consumer to get the replication working. Would that cause the problem? Here is my policy LDIF file I added to the server: # policies, chin.com dn: ou=policies,dc=chin,dc=ca objectClass: organizationalUnit objectClass: top ou: policies # default, policies, chin.com dn: cn=default,ou=policies,dc=chin,dc=ca objectClass: top objectClass: device objectClass: pwdPolicy cn: default pwdAttribute: userPassword pwdInHistory: 6 pwdCheckQuality: 1 pwdMinLength: 8 pwdMaxFailure: 4 pwdLockout: TRUE pwdLockoutDuration: 1920 pwdGraceAuthNLimit: 0 pwdFailureCountInterval: 0 pwdMustChange: TRUE pwdAllowUserChange: TRUE pwdSafeModify: FALSE pwdMaxAge: 10368000 pwdExpireWarning: 1209600 pwdMinAge: 86400 Provider: # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/misc.schema include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/redhat/autofs.schema include /etc/openldap/schema/ppolicy.schema ### added for host_attr access, this scheme gives me a host object for wrappers include /usr/share/doc/nss_ldap-253/ldapns.schema # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 bind_anon_cred # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args # note, enabling debbuging info really slows the beast down #loglevel 128 loglevel 256 #loglevel conns filter logfile /var/log/slapd.log # Load dynamic backend modules using this path!!! modulepath /usr/lib/openldap moduleload ppolicy.la moduleload accesslog.la # modules available in openldap-servers-sql RPM package: # moduleload back_sql.la ################################################################# schemacheck on lastmod on access to attrs=userPassword by self write by anonymous auth by * none ######################################## ### ACL for syncrepl. ######################################## #access to attrs=userPassword # by self write #by uid=replicator,ou=people,dc=chin,dc=ca read # by anonymous auth # by * none access to attrs=userPassword,shadowLastChange by dn="dc=admin,dc=chin,dc=ca" write by anonymous auth access to * by dn="dc=admin,dc=chin,dc=ca" write by * read #access to attrs=shadowLastChange # by self write # by * read access to * by * read #### WIDE OPEN - For testing only ##NOPE access to * by * write access to * by * read # ------------------------------------------------------------------- # # Access log database instance for replication # ------------------------------------------------------------------- # # Accesslog database definitions database bdb suffix cn=accesslog directory /var/lib/db/accesslog rootdn cn=accesslog index default eq index entryCSN,objectClass,reqEnd,reqResult,reqStart overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE # ------------------------------------------------------------------- # # Primary database instance # ------------------------------------------------------------------- # database bdb suffix "dc=chin,dc=ca" rootdn "cn=admin, dc=chin,dc=ca" # rootpw rootpw {SSHA}TCYoUVYYYXXXXXbQsitJ3V7zo+c887NC directory /var/lib/ldap index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index entryCSN,entryUUID eq # define the default policy overlay ppolicy ppolicy_default "cn=default,ou=policies,dc=chin,dc=ca" ppolicy_use_lockout # syncrepl Provider for primary db overlay syncprov syncprov-checkpoint 1000 60 # accesslog overlay definitions for primary db overlay accesslog logdb cn=accesslog logops writes logsuccess TRUE # scan the accesslog DB every day, and purge entries older than 7 days logpurge 07+00:00 01+00:00 # Let the replica DN have limitless searches limits dn.exact="uid=replicator,ou=People,dc=chin,dc=ca" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited Consumer: # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/misc.schema include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/redhat/autofs.schema include /etc/openldap/schema/ppolicy.schema ### added for host_attr access, this scheme gives me a host object for wrappers include /usr/share/doc/nss_ldap-253/ldapns.schema # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 bind_anon_cred pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args loglevel 256 logfile /var/log/slapd.log modulepath /usr/lib/openldap # ------------------------------------------------------------------- # # Primary database instance # ------------------------------------------------------------------- # database bdb suffix "dc=chin,dc=ca" rootdn "cn=admin,dc=chin,dc=ca" directory /var/lib/ldap moduleload ppolicy.la overlay ppolicy ppolicy_default "cn=default,ou=policies,dc=chin,dc=ca" ppolicy_use_lockout # ------------------------------------------------------------------- # # Replica configuration instance # ------------------------------------------------------------------- # # syncrepl specific indices index entryUUID eq uniqueMember index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index entryCSN eq # syncrepl directives syncrepl rid=0 provider=ldap://ldap bindmethod=simple binddn="uid=replicator,ou=people,dc=chin,dc=ca" #binddn="cn=admin,dc=chin,dc=ca" credentials=xxxxx searchbase="dc=chin,dc=ca" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" schemachecking=off type=refreshAndPersist retry="60 +" syncdata=accesslog # Refer updates to the master updateref ldap://ldap Any suggestions would be dandy and much appreciated. I'm new to LDAP, as you can tell. Thanks

3 5

RE: openldap syncrepl Provider with Slave(older version)
by Rupesh Thakkar 24 Aug '11

24 Aug '11

I missed to include "/usr/share/openldap-servers/slapd.acl" in proxy.conf(Consumer proxy configuration).I included this, still getting same error in consumer proxy log. *syncrepl_entry: rid=001 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD)* *syncrepl_entry: rid=001 be_search (49)* *syncrepl_entry: rid=001 dc=suretecsystems,dc=com* *null_callback : error code 0x31* *syncrepl_entry: rid=001 be_add dc=suretecsystems,dc=com (49)* *syncrepl_entry: rid=001 be_add dc=suretecsystems,dc=com failed (49)* *do_syncrepl: rid=001 rc 49 retrying (4 retries left)* *I have one question consumer proxy configuration .* database ldap # ignore conflicts with other databases, as we need to push out to same suffix hidden on suffix "dc=suretecsystems,dc=com" rootdn "cn=slapd-ldap" uri ldap://10.52.35.204:9012/ syncrepl rid=001 provider=ldap://10.52.35.204:389/ Shall "uri" directive above point to master database ldap://10.52.35.204:389 instead ldap://10.52.35.204:9012 ? Regards Rupesh

1 1

OCSP in OpenLDAP
by Thomas Kwan 23 Aug '11

23 Aug '11

Hi, I would like to ask something about OCSP with OpenLDAP. Is there any setup for OCSP in OpenLDAP? How can I config it? Cheers! TKwan

2 1

Unable to build MinGW OpenLDAP in Cygwin: gcc no longer supports the "-mno-cygwin" flag?
by daisy.wu＠emc.com 23 Aug '11

23 Aug '11

Hi, OpenLDAP developers, I am trying to build OpenLDAP client libraries on Windows by following the instructions listed on the OpenLDAP.org Faq-O-Matic. Building MinGW OpenLDAP in a Cygwin Environment http://www.openldap.org/faq/data/cache/302.html In the MinGW Support in Cygwin section http://www.openldap.org/faq/data/cache/301.html To create the wrapper script, start the Cygwin bash shell, and execute the following: $ cd /usr/bin $ cat > mgcc #!/bin/sh gcc -mno-cygwin $* ^D The problem is that it seems gcc no longer supports the "-mno-cygwin" flag: $ gcc -mno-cygwin gcc: The -mno-cygwin flag has been removed; use a mingw-targeted cross-compiler. I am currently using Cygwin version ... $ uname -a CYGWIN_NT-6.1-WOW64 hostname 1.7.9(0.237/5/3) 2011-03-29 10:10 i686 Cygwin And my gcc version is ... $ gcc -v Using built-in specs. Target: i686-pc-cygwin Configured with: /gnu/gcc/releases/respins/4.3.4-4/gcc4-4.3.4-4/src/gcc-4.3.4/configure --srcdir=/gnu/gcc/releases/respins/4.3.4-4/gcc4-4.3.4-4/src/gcc-4.3.4 --prefix=/usr --exec-prefix=/usr --bindir=/usr/bin --sbindir=/usr/sbin --libexecdir=/usr/lib --datadir=/usr/share --localstatedir=/var --sysconfdir=/etc --infodir=/usr/share/info --mandir=/usr/share/man -C --datadir=/usr/share --infodir=/usr/share/info --mandir=/usr/share/man -v --with-gmp=/usr --with-mpfr=/usr --enable-bootstrap --enable-version-specific-runtime-libs --with-slibdir=/usr/bin --libexecdir=/usr/lib --enable-static --enable-shared --enable-shared-libgcc --disable-__cxa_atexit --with-gnu-ld --with-gnu-as --with-dwarf2 --disable-sjlj-exceptions --enable-languages=ada,c,c++,fortran,java,objc,obj-c++ --disable-symvers --enable-libjava --program-suffix=-4 --enable-libgomp --enable-libssp --enable-libada --enable-threads=posix --with-arch=i686 --with-tune=generic --enable-libgcj-sublibs CC=gcc-4 CXX=g++-4 CC_FOR_TARGET=gcc-4 CXX_FOR_TARGET=g++-4 GNATMAKE_FOR_TARGET=gnatmake GNATBIND_FOR_TARGET=gnatbind --with-ecj-jar=/usr/share/java/ecj.jar Thread model: posix gcc version 4.3.4 20090804 (release) 1 (GCC) Any help would be much appreciated. Thanks. Daisy Wu Daisy.wu(a)emc.com<mailto:Daisy.wu@emc.com>

1 0

syncrepl broken, and I can't update anything on the server
by Alister Forbes 23 Aug '11

23 Aug '11

All, I have two servers, bru-1 and rtp-1 At one point I had cn=config working properly, and somehow managed to mess that up. The situation I'm in now is that syncing between the two machines doesn't work, and I can't make any changes to the configs. There are no special configurations, no SASL, or Kerberos, just plain passwords. I've been through the Server guide, and hopefully I'm just missing something, but I can't seem to find any indication of a way to solve my problem. bru-1 is running solaris10, and rtp-1 is running RHEL 5 , both with hand compiled openldap 2.4.23 bru-1: dn: cn=config olcServerID: 1 ldap://rtp-1.cisco.com olcServerID: 5 ldap://bru-1.cisco.com # {0}config, config dn: olcDatabase={0}config,cn=config olcSyncrepl: {0}rid=005 provider=ldap://bru-1.cisco.com binddn ="cn=admin,cn=config" bindmethod=simple credentials="testpass" searchbase="cn =config" type=refreshAndPersist retry="5 5 300 5" timeout=3 rtp-1 dn: cn=config olcServerID: 1 ldap://rtp-1.cisco.com olcServerID: 5 ldap://bru-1.cisco.com # {0}config, config dn: olcDatabase={0}config,cn=config olcSyncrepl: {0}rid=005 provider=ldap://bru-1.cisco.com binddn ="cn=admin,cn=config" bindmethod=simple credentials="testpass" searchbase="cn =config" type=refreshAndPersist retry="5 5 300 5" timeout=3 I'm having to run them with olcMirrorMode set to False at the moment, because if I try to startup bru-1 with mirror mode enabled, it crashes out. Aug 16 13:35:32 bru-1.cisco.com slapd[14591]: [ID 600618 local4.debug] olcServerID: value #2: SID=0x005 (listener=ldap:///) Aug 16 13:35:33 bru-1.cisco.com slapd[14591]: [ID 309573 local4.debug] olcSyncrepl: value #0: syncrepl will eventually stop retrying; the "retry" parameter should end with a '+'. Aug 16 13:35:33 bru-1.cisco.com slapd[14591]: [ID 942748 local4.debug] Config: ** successfully added syncrepl rid=005 "ldap://bru-1.cisco.com" Aug 16 13:35:33 bru-1.cisco.com slapd[14591]: [ID 801593 local4.debug] olcMirrorMode: value #0: <olcMirrorMode> database is not a shadow Aug 16 13:35:33 bru-1.cisco.com slapd[14591]: [ID 183426 local4.debug] config error processing olcDatabase={0}config,cn=config: <olcMirrorMode> database is not a shadow Aug 16 13:35:33 bru-1.cisco.com slapd[14591]: [ID 486161 local4.debug] slapd stopped. Aug 16 13:35:33 bru-1.cisco.com slapd[14591]: [ID 432338 local4.debug] connections_destroy: nothing to destroy. Can anyone give me a pointer in the right direction please? Even just how to get my database back to being a shadow so I can work on the replication problem later. I realise it could all be linked, so this is the sort of log error I'm seeing when I try running. It looks almost like a password problem, but that doesn't make any sense, as I can do searches on both machines with ldapsearch, or even phpldapadmin. Bru-1: Aug 16 13:39:51 bru-1.cisco.com slapd[14662]: [ID 445809 local4.debug] do_syncrepl: rid=008 rc -1 retrying (4 retries left) Aug 16 13:39:51 bru-1.cisco.com slapd[14662]: [ID 445809 local4.debug] do_syncrepl: rid=007 rc -1 retrying (4 retries left) Aug 16 13:39:51 bru-1.cisco.com slapd[14662]: [ID 319573 local4.debug] slap_client_connect: URI=ldap://rtp-1.cisco.com DN="cn=root,dc=ca" ldap_sasl_bind_s failed (49) Aug 16 13:39:51 bru-1.cisco.com slapd[14662]: [ID 445809 local4.debug] do_syncrepl: rid=006 rc 49 retrying (4 retries left) rtp-1: Aug 16 05:16:11 rtp-1 slapd[19928]: syncrepl_entry: rid=005 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Aug 16 05:16:11 rtp-1 slapd[19928]: syncrepl_entry: rid=005 be_search (0) Aug 16 05:16:11 rtp-1 slapd[19928]: syncrepl_entry: rid=005 cn={1}DUAConfigProfile,cn=schema,cn=config Aug 16 05:16:11 rtp-1 slapd[19928]: null_callback : error code 0x35 Aug 16 05:16:11 rtp-1 slapd[19928]: syncrepl_entry: rid=005 be_add cn={1}DUAConfigProfile,cn=schema,cn=config (53) Aug 16 05:16:11 rtp-1 slapd[19928]: syncrepl_entry: rid=005 be_add cn={1}DUAConfigProfile,cn=schema,cn=config failed (53) Aug 16 05:16:11 rtp-1 slapd[19928]: do_syncrepl: rid=005 rc 53 retrying (4 retries left) Any clues or hints, would be greatly appreciated -- Alister Forbes TACSUNS _.|._.|._ Cisco Systems Please avoid sending me Word or PowerPoint attachments. See - http://www.gnu.org/philosophy/no-word-attachments.html

2 3

Indexing, use of slapindex
by anax 22 Aug '11

22 Aug '11

Hi listers Installation here: openldap-servers-2.4.15-7.fc11.i586 One master server, two backup servers (syncrepl). All authentication and mailing is managed by ldap. 1. About indexing: When i check the slapd-log, i see many <= bdb_equality_candidates: (uidNumber) not indexed <= bdb_equality_candidates: (gidNumber) not indexed In the discussion about slapd tuning http://www.openldap.org/doc/admin24/tuning.html#Indexes, however, i read that if each entry in a certain set of ldap-entries has got the candidate-attribute, it is not worth while to index the attribute, because slapd needs to read each entry in any case in order to find the requested one. this is the case for uidNumber as well as gidNumber, because both are compulsory attributes for objectClass posixAccount. My first question: is it therefore correct to disregard the above indexing requests of slapd? 2. About slapindex: When it comes to use slapindex, the docu is not clear about how to do that. Some places say, that you need to stop slapd entirely, some places say that it is sufficient to put slapd in read-only mode for the corresponding background database, which in this case would be /etc/openldap/slapd.d/cn=config/olcDatabase\=\{2\}bdb.ldif this file contains both the olcReadOnly and the olcDbIndex attributes. So i could just add the following two lines in the above file: olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq set the olcReadOnly attribute to TRUE, and restart slapd, and everything would be done automatically? Or would i need to invoke slapindex additionally with the following command slapindex -c And if i had to start slapindex additionally, would slapindex tell me, that the database is in read-only mode, so no changes are possible, not even index changes? And, if i had to start slapindex additionally, i would do it as root. the files generated by slapindex would they be owned by root (inaccessible by slapd) or by the slapd user? Would the new indexes be propagated to the backup servers by syncrepl automatically? If not, what would i have to change on the backup servers? Thank you for your attention suomi

2 2

openldap syncrepl Provider with Slave(older version)
by Rupesh Thakkar 21 Aug '11

21 Aug '11

Hi , My application was using replication using Slurpd . Now, we want to move to openldap version 2.4 (RHEL 6.x)from 2.2, so I should use syncrepl instead slurpd. Replication clients(slaves) can still be of older version(2.2) I am tried to replication setup using sincerely using doc http://www.openldap.org/doc/admin24/replication.html I am following first of two topologies suggested for replacing slurped in doc http://www.openldap.org/doc/admin24/replication.html It says (Master/Provider configuration) ----->Proxy consumer configuration --sincerely--->old Slaves(which were working with slurpd) Following are my Master and Proxy configuration file they are similar to what above documents says Master slapd.conf [ /usr/sbin/slapd -h ldap://localhost:389 -f /usr/share/openldap-servers/slapd.conf ] -------------------------------------------------------------------------------------------------------------------------------------------------------------- access to * by dn.base="cn=replicator,dc=Avaya" write by dn.base="cn=root,dc=Avaya" write by dn.base=umObjectGUID=31ff609ecb5e11e09542001a64e587d4,ou=People,dc=Avaya read by * break access to dn.base="" by * read access to dn.base="dc=Avaya" by * read access to dn.subtree="ou=People,dc=Avaya" by dn.exact="cn=root,dc=Avaya" write by users read by * read access to * by self write by * read database bdb suffix "dc=Avaya" rootdn "cn=root,dc=Avaya" rootpw secret rootpw Testpw # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. password-hash {CLEARTEXT},{SHA},{SSHA} directory /var/lib/ldap index objectClass eq index default sub index ou,cn,mail,surname,givenname eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index entryCSN eq index entryUUID eq checkpoint 1024 15 cachesize 10000 idlcachesize 10000 #syncrepl Provider for primary db overlay syncprov syncprov-checkpoint 1000 60 # Let the replica DN have limitless searches limits dn.exact="umObjectGUID=218afb42cb5e11e09542001a64e587d4,ou=People,dc=Avaya" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited limits dn.exact="cn=replicator,dc=Avaya" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited Proxy slapd_p.conf [ /usr/sbin/slapd -h ldap://localhost:50389 -f /usr/share/openldap-servers/slapd_p.conf ] -------------------------------------------------------------------------------------------------------------------------------------------------------------- access to * by * read # Consumer Proxy that pulls in data via Syncrepl and pushes out via slapd-ldap database ldap # ignore conflicts with other databases, as we need to push out to same suffix hidden on suffix "dc=Avaya" rootdn "cn=slapd-ldap,dc=Avaya" uri ldap://localhost:50389 rootpw secret rootpw testing lastmod on acl-bind bindmethod=simple binddn="cn=replicator,dc=Avaya" credentials=Testpw #binddn="umObjectGUID=31ff609ecb5e11e09542001a64e587d4,ou=People,dc=Avaya" #credentials=1234 syncrepl rid=001 provider=ldap://localhost:389/ binddn="cn=replicator,dc=Avaya" #binddn="umObjectGUID=31ff609ecb5e11e09542001a64e587d4,ou=People,dc=Avaya bindmethod=simple credentials=Testpw #credentials=1234 searchbase="dc=Avaya" type=refreshAndPersist retry="5 5 300 5" overlay syncprov 1)I am able to query Master database but not to proxy database why so ? ps -ef | grep slapd /usr/sbin/slapd -h ldap://localhost:389 -f /usr/share/openldap-servers/slapd.conf /usr/sbin/slapd -h ldap://localhost:50389 -f /usr/share/openldap-servers/slapd_P.conf lsearch query to master database(port 389) is working /usr/bin/ldapsearch -x -h localhost -p 389 -D"cn=root,dc=Avaya" -w w00dstock -b"dc=Avaya" '(objectClass=*)' Why following query to proxy (50389) is failing even though database has read permissions to everyone . /usr/bin/ldapsearch -x -h localhost -p 50389 -D"cn=slapd-ldap" -w w00dstock -b"dc=Avaya" '(objectClass=*)' ldap_bind: Invalid credentials (49) 2)is "cn=replicator,dc=Avaya" here should be rootdn user or normal database(slapd) user ?. I tried this ldap slapd user "umObjectGUID=31ff609ecb5e11e09542001a64e587d4,ou=People,dc=Avaya" and with password "1234" and restarting both master and proxy still query fails Can you point me where am I wrong ? Thanks Rupesh "This email and any files transmitted with it contain confidential, proprietary, privileged information of Symphony Services Corp (India) Pvt. Ltd. and are intended solely for the use of the recipient/s to whom it is addressed. Any unauthorized notifying, copying or distributing of this e-mail, directly or indirectly, and the contents therein in full or part is prohibited by any entity who is not a recipient. Any email received inadvertently or by mistake should be deleted by the entity who is not a recipient thereof. You may be pleased to notify the sender immediately by email and the email should be deleted from your system".

2 2

setting max ssf with ldap_set_option
by Ken Dreyer 19 Aug '11

19 Aug '11

I have a small LDAP utility (msktutil) that talks to Active Directory using GSSAPI over TLS. I'm trying to set the SASL parameter "maxssf" to "0" in the code. I've found that in a recent version of OpenLDAP (2.4.24), modifying LDAP_OPT_X_SASL_SSF_MAX with ldap_set_option() has no effect. The basic code is sasl_ssf_t max_ssf = 0; printf( "setting max ssf to %d\n", max_ssf ); ldap_set_option(ld, LDAP_OPT_X_SASL_SSF_MAX, &max_ssf) Subsequent ldap_get_option() calls show that the value is not changing, as does the output when I bind with ldap_sasl_interactive_bind_s(). I would at the very least expect ldap_set_option() to return something other than LDAP_OPT_SUCCESS here. Am I hitting a bug in OpenLDAP, or am I really off track ? :) I've attached a small test case (gcc -o test test.c -lldap -llber). This works as I expect in both 2.3.43 and 2.4.23, and fails in 2.4.24. RHEL5: openldap-2.3.43-12.el5_6.7 ./test LDAP_OPT_X_SASL_SSF_MAX before setting = 2147483647 setting max ssf to 0 LDAP_OPT_X_SASL_SSF_MAX after setting = 0 RHEL6: openldap-2.4.23-15.el6_1.1.x86_64 ./test LDAP_OPT_X_SASL_SSF_MAX before setting = 2147483647 setting max ssf to 0 LDAP_OPT_X_SASL_SSF_MAX after setting = 0 Fedora 15: openldap-2.4.24-3.fc15.i686 ./test LDAP_OPT_X_SASL_SSF_MAX before setting = 2147483647 setting max ssf to 0 LDAP_OPT_X_SASL_SSF_MAX after setting = 2147483647

3 3

Re: Server Hangs
by Quanah Gibson-Mount 19 Aug '11

19 Aug '11

--On Tuesday, August 16, 2011 3:51 PM -0700 David Engeset <davidke(a)whidbey.net> wrote: > Below is how I generally configure BDB and OpenLDAP for normal > operational use. > I configured BDB with no parameters for all versions from 4.2 to > 5.1, so I ran: > > ../dist/configure > make&& make install For building BDB on *nix systems, you should specify: --enable-posixmutexes --with-mutex=POSIX/pthreads > For the debugging I did the following for BDB: > > env CFLAGS=-O2 ../dist/configure --enable-debug You need to use "-g" as I stated previously. CFLAGS="-g -O2 -fPIC" are the flags I pass to BDB. What we are looking for is the gcc debugging symbols. The --enable-debug flag looks like it does some internal debugging stuff in the BDB code which isn't really what we're asking for. > make&& make install > > For OpenLDAP: > > export LD_LIBRARY_PATH="/usr/local/BerkeleyDB.4.8/lib" > env CPPFLAGS="-I/usr/local/BerkeleyDB.4.8/include" CFLAGS="-g -O0" \ > LDFLAGS="-L/usr/local/BerkeleyDB.4.8/lib" ./configure --enable-wrappers \ > --enable-crypt --with-cyrus-sasl --with-tls --enable-debug > make depend&& make&& make install STRIP='' This looks good. Can you please re-generate your stack trace with a correctly build BDB behind openldap? Thanks! --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

3 5

Replication with cn=config
by Nocturn 18 Aug '11

18 Aug '11

I'm trying to set up repliction with OpenLDAP on SL:RHEL 6.1. OpenLDAP is by default configured with cn=config, but the replication documentation is still in the old slapd.conf format. Can anyone point me out how to get this up and running with cn=config? Thanks

3 3

migrating contents from openldap-2.1 to openldap-2.3.37
by Michael Kershaw 18 Aug '11

18 Aug '11

All, I've currently been tasked with migrating the contents of a contained ldap environment running openldap-2.1 to a new development server running sles11 with openldap-2.3.37. I've begun to populate the new environment, but have hit an "Invalid DN syntax" error that I'm not quite sure how to get around yet. I'm new to ldap from a server point of view, so I'm learning as I chug through this. This piece is what's in the existing 2.1: dn: group-name=EDI Technician,ou=group,ou=edi,dc=coat,dc=com objectClass: group-roles group-name: EDI Technician roles: EDI Technician And when I go to add: ldapadd -x -W -D "cn=edi_admin,ou=edi,dc=coat,dc=com" -f ./edi-tech_roles.ldif Enter LDAP Password: adding new entry "group-name=EDI Technician,ou=group,ou=edi,dc=coat,dc=com" ldap_add: Invalid DN syntax (34) additional info: invalid DN Is it the "group-name" that's no longer valid syntax? If so, is there an equivalent? Any help is appreciated! Mike

4 3

LDAP Stopping Frequently
by Nishant Goli -X (ngoli - Exobase Corporation at Cisco) 18 Aug '11

18 Aug '11

Hi Team, I have set up Open LDAP with Oracle as backend DB using back sql. Everything was running fine until recently. LDAP started going down frequently with the following line in the log. slapd: entry-id.c:867: backsql_get_attr_vals: Assertion `j < oldcount + count' failed and then the process goes down. Any help in troubleshooting this issue is greatly appreciated. Thanks Nishant

1 0

synchronizing ppolicy across different suffixes
by Tyler Gates 18 Aug '11

18 Aug '11

Is it possible to synchronize the same ppolicy across different suffixes on the same server? I would have thought referrals would take care of this and they to an extent but when the suffix that doesn't actually contain the policy entry gets a lockout request from failed attempts, pwdAccountLockedTime gets recorded on the same suffix from where it was originating -not the one being referenced. In the manual it states that ppolicy_forward_updates should take care of this but it requires updateref and the chain overlay (which must be setup under back_ldap) in order to work. The problem is when I setup back_ldap and point its database to the original policy entry, it complains that a previous database declaration has already claimed it -which is true because I have the database containing that policy entry on the same machine. Is there a way to do this or am I going about this wrong? Thanks, Tyler

1 0

DIT structure advice
by Olivier 18 Aug '11

18 Aug '11

Hi, My primary goal with an openldap directory is to store information to manage people authentification and autorisation to resources on my local network. But I also feel this directory to be a cool opportunity to maintain a registry that would include administrative information such as telephone number. Here is the DIT structure that I plan to deploy to to do that. If anyone has a comment or advice I would be grateful ! Summary : | ----------------------------- | STAFF=organizationalUnit | ----------------------------- _____| | | | | | | | | -> [ one entry per employee ] | | ------------------------- | John Doe=inetOrgPerson | -> [administrative data such as tel number] ------------------------- | ------------------ | doe=posixAccount | -> [ uid, password on so on ] ------------------ LDIF : Staff is a branch of people : # Entry 1: ou=staff,ou=people,dc=example,dc=fr dn: ou=staff,ou=people,dc=example,dc=fr objectclass: organizationalUnit objectclass: top ou: staff that contains as many inetOrgPerson as I have people in staff (here are recorded administrative data such as telephone number and so on) : # Entry 12: uid=doe,ou=staff,ou=people,dc=example,dc=fr dn: sn=doe,ou=staff,ou=people,dc=example,dc=fr sn: doe cn: john doe objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson Each "inetOrgPerson" may also have a "posixAccount" child that record information usable to access resources : dn: uid=doe,sn=doe,ou=staff,ou=people,dc=example,dc=fr cn: john doe gidnumber: 1800 homedirectory: /home/doe loginshell: /bin/tcsh objectclass: account objectclass: posixAccount objectclass: top objectclass: shadowAccount uid: doe uidnumber: 510 userpassword: {SSHA}*********************** --- Olivier

4 4

Server Hangs
by David Engeset 18 Aug '11

18 Aug '11

I upgraded and updated four of our OpenLDAP servers that we have back in May to run the latest stable version of OpenLDAP (2.4.23) along with BDB (4.8.30). Everything was running with no issues until a little over a month later one of the servers slapd processes hung, the only way I could restart the process was to use kill -9, all other kill options failed. Over the next month and a half the issue reoccurred on the same server and occurred on two of the other servers. There was nothing in the logs to indicate an issue with running out of file descriptors, dead locks or anything else. I set out to see if I could recreate the issue and I found if I had around 20000 entries, which our database is roughly around 21000, and ran a script to randomly query, one a time, the entries in the database and then run another script that added 1000 entries, one at a time, then deleted them in reverse order, one at a time, and will continue to do so infinitely. When I ran the two scripts simultaneously they would hang after 3 to 16 deletes were completed. I attempted to use the latest version of OpenLDAP (2.4.26) to see if any of the bug fixes in it would help and I still get the same results, I even tried to run it with all of the supported versions of BDB, 4.4, 4.5, 4.6, 4.7, 5.0 and 5.1 with the same results. I ran it with full logging on and I was not able to find any thing that pointed to the problem. We have been running OpenLDAP 2.2 and 2.3 for years (many servers without any restarting of slapd for over a year) without any lockups, so I decided to test with OpenLDAP 2.3.43 with BDB 4.2.52 (with patches) and loaded the same exact database and the same exact tests and it runs literally for hours with no issues. I attempted to upgrade the version of BDB to 4.4 and I started to experience the hanging again, so it appears to be a BDB issue. I searched for related issues with no success and considering that others are running 2.4 with newer versions of BDB for a couple of years now I find it odd that I am running into this issue on my first use of 2.4. I tested all of this on CentOS 5.4, 5.6 and Fedora 17 with the same results. Does anyone have any ideas or suggestions on what I can try to do to fix this issue? Below are some of the configs I am using on my last attempts to resolve the issue: DB_CONFIG: set_cachesize 0 536870912 1 set_lg_regionmax 10485760 set_lg_max 104857600 set_lg_bsize 2097152 set_lg_dir /var/log/bdb set_tmp_dir /var/log/bdb # This one I added recently to see if it might help. set_lk_detect DB_LOCK_DEFAULT slapd.conf: include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/nis.schema include /usr/local/etc/openldap/schema/misc.schema include /usr/local/etc/openldap/schema/inetorgperson.schema pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args conn_max_pending 1000 database bdb cachesize 20000 suffix "dc=example,dc=net" checkpoint 5120 30 rootdn "cn=Manager,dc=example,dc=net" rootpw secrect directory /usr/local/var/openldap-data # Indices to maintain index default pres,eq index cn,uid #index WhidNetCustID,CustID,ID index sn pres,eq,sub index objectClass eq index uidNumber eq index gidNumber eq index memberUid eq # database access control definitions access to attrs=userPassword by self write by anonymous auth by dn="cn=Admin,dc=example,dc=net" write by * none access to * by self write by dn="cn=Admin,dc=example,dc=net" write by * read I can send out the LDIF I am using and the perl scripts that I run to break it for anyone who is interested. Thank you, -- David Whidbey Telecom Internet and Broadband Software Engineer

4 4

How to design an architecture of OpenLDAP for satisfy our needs?
by ma hao (163) 17 Aug '11

17 Aug '11

Hi all, We got a problem about our authentication architecture. Here is our situation: We are using two parts for user authentication, which both are openldap service. One is password OpenLDAP service on remote server. One is groups information OpenLDAP service, which also is user's permission info, on local server. In fact we could not get the user password in our local Openldap, pasword information stored in remote openldap which could not get our local group inforamtion. Do you have any idea to make our local OpenLDAP using remote OpenLDAP authorize the password and using local OpenLDAP supply groups information? Best Regards Ma Hao

2 1

seg fault with TLS syncrepl ?
by Olivier 17 Aug '11

17 Aug '11

My N-WAY replication works properly with a "bindmethod=simple". However, I don't like keeping a password in clear in a configuration file, then I tryed this : On server "ldap-master1.example.fr" : TLSVerifyClient allow syncrepl rid=101 provider=ldap://ldap-master2.example.fr:389 searchbase="dc=example,dc=fr" schemachecking=on type=refreshOnly interval=00:00:01:00 retry="10 +" bindmethod=sasl saslmech=EXTERNAL starttls=critical tls_cert=/etc/openldap/cacerts/master1/server.crt tls_key=/etc/openldap/cacerts/master1/server.key tls_cacert=/etc/openldap/cacerts/CA.crt tls_reqcert=demand On server "ldap-master2.example.fr" : TLSVerifyClient allow syncrepl rid=201 provider=ldap://ldap-master1.example.fr:389 searchbase="dc=example,dc=fr" schemachecking=on type=refreshOnly interval=00:00:01:00 retry="10 +" bindmethod=sasl saslmech=EXTERNAL starttls=critical tls_cert=/etc/openldap/cacerts/master2/server.crt tls_key=/etc/openldap/cacerts/master2/server.key tls_cacert=/etc/openldap/cacerts/CA.crt I get a segmentation fault : ldap-master1 #$ /usr/sbin/slapd -h ldap:/// -u ldap -d256 @(#) $OpenLDAP: slapd 2.4.23 (Apr 12 2011 19:26:36) $ mockbuild@x86-001.build.bos.redhat.com:/builddir/build/BUILD/openldap-2.4.23/openldap-2.4.23/build-servers/servers/slapd bdb_monitor_db_open: monitoring disabled; configure monitor database to enable <= bdb_inequality_candidates: (entryCSN) not indexed slapd starting slap_client_connect: URI=ldap://ldap-master2.example.fr:389 Error, ldap_start_tls failed (-1) do_syncrepl: rid=101 rc -1 retrying conn=1000 fd=12 ACCEPT from IP=10.1.92.25:47353 (IP=0.0.0.0:389) conn=1000 op=0 EXT oid=1.3.6.1.4.1.1466.20037 conn=1000 op=0 STARTTLS conn=1000 op=0 RESULT oid= err=0 text= conn=1000 fd=12 TLS established tls_ssf=256 ssf=256 conn=1000 op=1 BIND dn="" method=163 conn=1000 op=1 BIND authcid="email=max(a)example.fr,cn=ldap-master2.example.fr,ou=ldap,o=example,l=somewhere,st=france,c=fr" authzid="email=max(a)example.fr,cn=ldap-master2.example.fr,ou=ldap,o=example,l=somewhere,st=france,c=fr" conn=1000 op=1 BIND dn="email=max(a)example.fr,cn=ldap-master2.example.fr,ou=ldap,o=example,l=somewhere,st=france,c=fr" mech=EXTERNAL sasl_ssf=0 ssf=256 conn=1000 op=1 RESULT tag=97 err=0 text= conn=1000 op=2 SRCH base="dc=example,dc=fr" scope=2 deref=0 filter="(objectClass=*)" conn=1000 op=2 SRCH attr=* + conn=1000 op=2 SEARCH RESULT tag=101 err=0 nentries=0 text= conn=1000 op=3 UNBIND conn=1000 fd=12 closed Erreur de segmentation The segfault happened when the second server tried to sync with the first one : [root@ldap-master2 cacerts]# /usr/sbin/slapd -h ldap:/// -u ldap -d256 @(#) $OpenLDAP: slapd 2.4.23 (Apr 12 2011 19:26:36) $ mockbuild@x86-001.build.bos.redhat.com:/builddir/build/BUILD/openldap-2.4.23/openldap-2.4.23/build-servers/servers/slapd bdb_monitor_db_open: monitoring disabled; configure monitor database to enable slapd starting conn=1000 fd=12 ACCEPT from IP=10.1.92.24:55208 (IP=0.0.0.0:389) conn=1000 op=0 EXT oid=1.3.6.1.4.1.1466.20037 conn=1000 op=0 STARTTLS conn=1000 op=0 RESULT oid= err=0 text= TLS: error: accept - force handshake failure: errno 2 - moznss error -5938 TLS: can't accept: TLS error -5938:Encountered end of file. conn=1000 fd=12 closed (TLS negotiation failure) ^C daemon: shutdown requested and initiated. slapd shutdown: waiting for 0 operations/tasks to finish slapd stopped. Any idea ? NOTE : if I start the daemon on ldap-master2, that's ldap-master2 that produce the seg fault. --- Olivier

2 2

ldapadd file size question?
by Pavan Kakunoori 17 Aug '11

17 Aug '11

Hello, With the command "ldapadd -f " what is the max size of file,that ldapadd can handle? is there any command with which mupltiple records can be inserted efficiently other than ldapadd command? Thanks, Pavan ________________________________ NOTICE: The information contained in this electronic mail transmission is intended by Convergys Corporation for the use of the named individual or entity to which it is directed and may contain information that is privileged or otherwise confidential. If you have received this electronic mail transmission in error, please delete it from your system without copying or forwarding it, and notify the sender of the error by reply email or by telephone (collect), so that the sender's address records can be corrected.

1 0

pwdReset error!
by pradyumna dash 17 Aug '11

17 Aug '11

Hi, I would like that my LDAP users should be change their password for the first time login. But when am adding pwdReset attribute to ppolicy.schema file its throwing me error and ppolicy schema file is not getting loaded. Please help. Regards, Pradyumna

2 1

openldap install questions
by Washington, Andrea 17 Aug '11

17 Aug '11

I recently installed version openldap-2.4.23 on one of our Degreeworks servers as root. During the ./configure piece, I had to disable slapd because it complained about a BDB database. Every installation step after the configure piece, completed without a problem. I am uncertain how openldap is being utilized by the Degreeworks software but I think something may be wrong with the setup or configuration files. Did slapd need to be installed and what do I do about the BDB issue. I am trying to get single sign-on via Luminis to Degreeworks. The logins for luminis and degreeworks are not the same. Any help would be appreciated on setting up openldap to work properly with Degreeworks. Thanks in advance for your time. Andrea Washington

4 6

Re: Assigning Groups to LDAP users
by pradyumna dash 16 Aug '11

16 Aug '11

Hi, I have create 2 groups and modified the ldap.conf file in the client as below nss_base_passwd ou=people,dc=example,dc=com?one nss_base_shadow ou=people,dc=example,dc=com?one nss_base_group ou=Group,dc=example,dc=com?one >From the client when i run getent i can see my groups and users, but when i login to a user and try id it shows me the primary group not the secondary groups i have added. I am using SLES 11 SP1. Regards, Pradyumna 2011/8/15 Dmitriy Kirhlarov <dimma(a)higis.ru> > please, keep a list address in the Cc. > > WNBR > > > On 08/14/2011 04:20 PM, pradyumna dash wrote: > >> Thank you so much. >> >> I will try it this week and get back to you in case of any issues. >> >> Thanks for your time. >> >> Regards, >> Pradyumna >> >> 2011/8/14 Dmitriy Kirhlarov <dimma(a)higis.ru <mailto:dimma@higis.ru>> >> >> >> >> >> On 08/14/2011 03:18 PM, pradyumna dash wrote: >> >> Hi, >> >> Thank you so much. I have never worked a lot on nss_ldap so >> asking some >> basic questions. >> >> As per you said you guys are running the same in your env. >> >> ldap: >> personals user groups: >> ou=groups,o=company >> first project groups: >> cn=group1,ou=project1,o=____**company >> cn=group2,ou=project1,o=____**company >> >> -- Do i need to create separate OU's for different groups? >> >> >> Up to you. >> >> You need some "separator" between projects. It can be branch in the >> tree, or scope "base" in filter configuration from nss_ldap.conf file. >> >> We are prefer branches. It's more readable, when you have many >> groups and many projects. >> >> >> second project groups: >> cn=group1,ou=project2,o=____**company >> cn=group2,ou=project2,o=____**company >> -- How i can specify the users who are a part of which group? >> >> >> cn=group1,ou=project1,o=__**company >> objectClass: posixGroup >> cn: group1 >> gidNumber: 1000 >> description: project1 admin group >> memberUid: user1 >> memberUid: user2 >> memberUid: user3 >> >> >> "Server1" nss_ldap.conf: >> nss_base_group ou=groups,o=company?sub >> nss_base_group ou=project1,o=company?one >> --The syntax in the conf file will be like above ?? Because i >> have never >> used ?sub and ?one >> >> >> It's URI (http://en.wikipedia.org/wiki/**__URI_scheme<http://en.wikipedia.org/wiki/__URI_scheme> >> <http://en.wikipedia.org/wiki/**URI_scheme<http://en.wikipedia.org/wiki/URI_scheme>>) >> syntax. >> You should to write second part of URI (after connection >> description) with base, scope and filter. >> >> >> "Server2" nss_ldap.conf: >> nss_base_group ou=groups,o=company?sub >> nss_base_group ou=project2,o=company?one >> >> Also if you can help, am trying "pwdReset" for my ldap users, in >> the >> ppolicy.schema file i have uncommented this attribute but not >> able to >> load the schema, if you can give me some pointers would be >> appreciated. >> What i want is when firsttime any user logs in he will asked >> to change >> his password. >> >> >> 1. try to start slapd with "-d config" >> 2. take a look to >> http://www.zytrax.com/books/__**ldap/ch6/ppolicy.html<http://www.zytrax.com/books/__ldap/ch6/ppolicy.html> >> <http://www.zytrax.com/books/**ldap/ch6/ppolicy.html<http://www.zytrax.com/books/ldap/ch6/ppolicy.html> >> > >> >> WBR >> >> >> Regards, >> Neo >> >> I am not a expert in OpenLDAP so please help me. >> 2011/8/14 Dmitriy Kirhlarov <dimma(a)higis.ru >> <mailto:dimma@higis.ru> <mailto:dimma@higis.ru >> >> <mailto:dimma@higis.ru>>> >> >> >> Hi. >> >> >> On 08/12/2011 07:40 PM, Buchan Milne wrote: >> >> On Wednesday, 10 August 2011 10:11:17 pradyumna dash wrote: >> >> Guys, >> >> I have a query, lets take a scenario : >> >> Assume we have 2 servers "Server1" and "Server2" and 2 >> groups "Admin" and >> "ITTech", What is needed is like say when a user "bob" logging >> in to "Server1" he will get the group "Admin", but >> when he >> logs in to >> "Server2" he will get group "ITTech". Also it may vary for >> different users >> like when "Kris" logs in to Server1 he may get a group >> called "ITTech" and >> when he logs in to "Server2" he will get some other >> group >> say "Security". >> Can it be possible by OpenLDAP ? >> >> >> IMHO, this is a bad idea. It will specifically be >> problematic if >> you have any >> files shared/replicated/backed up between servers (e.g. >> via NFS). >> >> >> We are using this functionality without any problems. :) >> This is feature of nss_ldap. >> >> ldap: >> personals user groups: >> ou=groups,o=company >> >> first project groups: >> cn=group1,ou=project1,o=____**company >> cn=group2,ou=project1,o=____**company >> >> second project groups: >> cn=group1,ou=project2,o=____**company >> cn=group2,ou=project2,o=____**company >> >> "Server1" nss_ldap.conf: >> nss_base_group ou=groups,o=company?sub >> nss_base_group ou=project1,o=company?one >> >> "Server2" nss_ldap.conf: >> nss_base_group ou=groups,o=company?sub >> nss_base_group ou=project2,o=company?one >> >> >> WBR >> >> >> If this is achieved then we are planning >> to have SUDO files based on the grooups. >> >> >> It would be much more effective to have your sudo rules >> in LDAP, >> and apply a >> rule to a set of users/groups to a collection/netgroup >> of hosts. >> >> Regards, >> Buchan >> >> >> >> >>

2 3

Kudos to OpenLDAP developers
by Brent Bice 16 Aug '11

16 Aug '11

After skimming my OpenLDAP email and seeing a few snide comments about OpenLDAP and/or documentation, I felt compelled to post a thank-you to all the folks working on OpenLDAP. Our LDAP needs have been uber-simple until recently but OpenLDAP has been rock solid and just worked without complaint, failures, or replication problems. I recently had to setup a fancier set of LDAP servers for doing authentication/authorization for giant clusters of servers, so for the first time I found myself needing other overlays like accesslog and ppolicy and although I had to spend a bit of time RTFM'ing (oh no, not that! - grin) I found them like my previous experience with OpenLDAP - they just worked. And other than needing to start slapd with a larger max number of File descriptors to handle thousands of clients all suddenly connecting and doing queries simultaneously (slaps forehead - I shoulda expected this), we've had no problems. So to everyone who's spent late nights 'n weekends digging through the source code looking for bugs, or adding new overlays, thanks. It's appreciated... Brent

1 0

provider crash on high replication load
by Marc Patermann 16 Aug '11

16 Aug '11

Hi, I have the following problem: On a sycrepl provider I have lots (100+) consumers in refresh and persist mode. After upgrading the provider from 2.3.x to 2.4.25 I can crash the server by a single mod on the root object of one database. Aug 15 14:18:37 trzs721boot kernel: [544888.798212] slapd[2861]: segfault at 0 ip 00007fbf89494522 sp 00007fbe8cfa7ca0 error 4 in slapd[7fbf8942c000+1b6000] I reproduced this on a test system, even with 2.4.26. The consumer are ldapsearch clients like this "-E!sync=rp/rid=xxx,csn= * +" on a single 2.4.25 machine. All SLES 11 SP1 64bit. Here is the gbd output. http://pastebin.com/6y83ZjqX I tried to create a core dump, but I could not get it work. I used this howto. The "top" example works, I get a core file for user ldap. With slapd it is not. Why does slapd crash here? Marc

3 8

replication
by rocke.robertson＠pch.gc.ca 16 Aug '11

16 Aug '11

Good morning list I am having no end of problems trying to setup a delta synchronized replication. One consumer and one provider. Symptoms are as follows: User can authenticate and login using provider. If user changes password, new password does not get replicated to consumer. If password has not changed the user can authenticate and login using the consumer. Provider configuration is as follows: include /etc/openldap/schema/misc.schema include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/redhat/autofs.schema include /etc/openldap/schema/ppolicy.schema ### added for host_attr access, this scheme gives me a host object for wrappers include /usr/share/doc/nss_ldap-253/ldapns.schema # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 bind_anon_cred # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args loglevel 256 logfile /var/log/slapd.log # Load dynamic backend modules using this path!!! modulepath /usr/lib/openldap moduleload ppolicy.la moduleload accesslog.la schemacheck on lastmod on access to attrs=userPassword by self write by anonymous auth by * none access to attrs=shadowLastChange by self write by * read access to * by * read ##NOPE access to * by * write # ------------------------------------------------------------------- # # Access log database instance for replication # ------------------------------------------------------------------- # # Accesslog database definitions database bdb suffix cn=accesslog directory /var/lib/db/accesslog rootdn cn=accesslog index default eq index entryCSN,objectClass,reqEnd,reqResult,reqStart overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE # Let the replica DN have limitless searches limits dn.exact="uid=replicator,ou=people,dc=chin,dc=ca" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited # ------------------------------------------------------------------- # # Primary database instance # ------------------------------------------------------------------- # database bdb suffix "dc=chin,dc=ca" rootdn "cn=admin, dc=chin,dc=ca" # rootpw rootpw {SSHA}xxxyyyzzzz directory /var/lib/ldap index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index entryCSN,entryUUID eq # define the default policy overlay ppolicy ppolicy_default "cn=default,ou=policies,dc=chin,dc=ca" ppolicy_use_lockout # syncrepl Provider for primary db overlay syncprov syncprov-checkpoint 1000 60 # accesslog overlay definitions for primary db overlay accesslog logdb cn=accesslog logops writes logsuccess TRUE # scan the accesslog DB every day, and purge entries older than 7 days logpurge 07+00:00 01+00:00 # Let the replica DN have limitless searches limits dn.exact="uid=replicator,ou=people,dc=chin,dc=ca" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited The consumer configuration is as follows: # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/misc.schema include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/redhat/autofs.schema include /etc/openldap/schema/ppolicy.schema ### added for host_attr access, this scheme gives me a host object for wrappers include /usr/share/doc/nss_ldap-253/ldapns.schema # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 bind_anon_cred pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args loglevel 256 #loglevel -1 #loglevel 16384 logfile /var/log/slapd.log modulepath /usr/lib/openldap # ------------------------------------------------------------------- # # Primary database instance # ------------------------------------------------------------------- # database bdb suffix "dc=chin,dc=ca" rootdn "cn=admin,dc=chin,dc=ca" directory /var/lib/ldap # ------------------------------------------------------------------- # # Replica configuration instance # ------------------------------------------------------------------- # # syncrepl specific indices index entryUUID eq # syncrepl directives syncrepl rid=0 provider=ldap://ldap bindmethod=simple binddn="uid=replicator,ou=people,dc=chin,dc=ca" #binddn="cn=admin,dc=chin,dc=ca" credentials=xyzyzzz searchbase="dc=chin,dc=ca" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" schemachecking=on type=refreshAndPersist retry="60 +" syncdata=accesslog # Refer updates to the master updateref ldap://ldap Error messages on the consumer is: Aug 15 09:28:08 stgvir009 slapd[31110]: do_syncrepl: rid 000 retrying Aug 15 09:29:09 stgvir009 slapd[31110]: syncrepl_message_to_entry: rid 000 mods check (pwdAttribute: value #0 invalid per syntax) Aug 15 09:29:09 stgvir009 slapd[31110]: do_syncrepl: rid 000 retrying Which looks like it is missing a schema. But I can't find a schema that is missing. Log messages on provider showing replicator account activity. Aug 15 09:29:53 provir009 slapd[27606]: conn=6736 fd=17 ACCEPT from IP=172.16.50.40:45510 (IP=0.0.0.0:389) Aug 15 09:29:53 provir009 slapd[27606]: conn=6736 op=0 BIND dn="uid=replicator,ou=people,dc=chin,dc=ca" method=128 Aug 15 09:29:53 provir009 slapd[27606]: conn=6736 op=0 BIND dn="uid=Replicator,ou=People,dc=chin,dc=ca" mech=SIMPLE ssf=0 Aug 15 09:29:53 provir009 slapd[27606]: conn=6736 op=0 RESULT tag=97 err=0 text= Aug 15 09:29:53 provir009 slapd[27606]: conn=6736 op=1 SRCH base="dc=chin,dc=ca" scope=2 deref=0 filter="(objectClass=*)" Aug 15 09:29:53 provir009 slapd[27606]: conn=6736 op=1 SRCH attr=* + Aug 15 09:29:53 provir009 slapd[27606]: send_search_entry: conn 6736 ber write failed. Aug 15 09:29:53 provir009 slapd[27606]: conn=6736 fd=17 closed (connection lost on write) Aug 15 09:29:53 provir009 slapd[27606]: connection_read(17): no connection! Aug 15 09:30:54 provir009 slapd[27606]: conn=6737 fd=17 ACCEPT from IP=172.16.50.40:45511 (IP=0.0.0.0:389) Aug 15 09:30:54 provir009 slapd[27606]: conn=6737 op=0 BIND dn="uid=replicator,ou=people,dc=chin,dc=ca" method=128 Aug 15 09:30:54 provir009 slapd[27606]: conn=6737 op=0 BIND dn="uid=Replicator,ou=People,dc=chin,dc=ca" mech=SIMPLE ssf=0 Aug 15 09:30:54 provir009 slapd[27606]: conn=6737 op=0 RESULT tag=97 err=0 text= Aug 15 09:30:54 provir009 slapd[27606]: conn=6737 op=1 SRCH base="dc=chin,dc=ca" scope=2 deref=0 filter="(objectClass=*)" I don't know what this means I'm afraid. But intuitively it doesn't look good. Any guidance would be astoundingly great. I am new to ldap so this is a bit of a learning curve. Many thanks Rocke Robertson Gouvernement du Canada | Government of Canada

3 2

aliased objects follow across different suffixes on same server?
by Tyler Gates 16 Aug '11

16 Aug '11

Hello, I would like to know if it is possible to have an aliasedobjectname reference an object that is defined in a different database as a different suffix on the same server. I have deref set to always but it doesn't seem to be following the alias as long as it is not on its own suffix. Below is an example of what I am trying to do. suffix1: dc=example,dc=com dn: cn=entry,dc=example,dc=com ... suffix2: dc=example,dc=net dn: cn=entry2,dc=example,dc=net objectClass: alias objectClass: extensibleObject aliasedobjectname: cn=entry,dc=example,dc=com

2 3

Re: Assigning Groups to LDAP users
by Dmitriy Kirhlarov 14 Aug '11

14 Aug '11

On 08/14/2011 03:18 PM, pradyumna dash wrote: > Hi, > > Thank you so much. I have never worked a lot on nss_ldap so asking some > basic questions. > > As per you said you guys are running the same in your env. > > ldap: > personals user groups: > ou=groups,o=company > first project groups: > cn=group1,ou=project1,o=__company > cn=group2,ou=project1,o=__company > > -- Do i need to create separate OU's for different groups? Up to you. You need some "separator" between projects. It can be branch in the tree, or scope "base" in filter configuration from nss_ldap.conf file. We are prefer branches. It's more readable, when you have many groups and many projects. > second project groups: > cn=group1,ou=project2,o=__company > cn=group2,ou=project2,o=__company > -- How i can specify the users who are a part of which group? cn=group1,ou=project1,o=company objectClass: posixGroup cn: group1 gidNumber: 1000 description: project1 admin group memberUid: user1 memberUid: user2 memberUid: user3 > "Server1" nss_ldap.conf: > nss_base_group ou=groups,o=company?sub > nss_base_group ou=project1,o=company?one > --The syntax in the conf file will be like above ?? Because i have never > used ?sub and ?one It's URI (http://en.wikipedia.org/wiki/URI_scheme) syntax. You should to write second part of URI (after connection description) with base, scope and filter. > "Server2" nss_ldap.conf: > nss_base_group ou=groups,o=company?sub > nss_base_group ou=project2,o=company?one > > Also if you can help, am trying "pwdReset" for my ldap users, in the > ppolicy.schema file i have uncommented this attribute but not able to > load the schema, if you can give me some pointers would be appreciated. > What i want is when firsttime any user logs in he will asked to change > his password. 1. try to start slapd with "-d config" 2. take a look to http://www.zytrax.com/books/ldap/ch6/ppolicy.html WBR > > Regards, > Neo > > I am not a expert in OpenLDAP so please help me. > 2011/8/14 Dmitriy Kirhlarov <dimma(a)higis.ru <mailto:dimma@higis.ru>> > > Hi. > > > On 08/12/2011 07:40 PM, Buchan Milne wrote: > > On Wednesday, 10 August 2011 10:11:17 pradyumna dash wrote: > > Guys, > > I have a query, lets take a scenario : > > Assume we have 2 servers "Server1" and "Server2" and 2 > groups "Admin" and > "ITTech", What is needed is like say when a user "bob" logging > in to "Server1" he will get the group "Admin", but when he > logs in to > "Server2" he will get group "ITTech". Also it may vary for > different users > like when "Kris" logs in to Server1 he may get a group > called "ITTech" and > when he logs in to "Server2" he will get some other group > say "Security". > Can it be possible by OpenLDAP ? > > > IMHO, this is a bad idea. It will specifically be problematic if > you have any > files shared/replicated/backed up between servers (e.g. via NFS). > > > We are using this functionality without any problems. :) > This is feature of nss_ldap. > > ldap: > personals user groups: > ou=groups,o=company > > first project groups: > cn=group1,ou=project1,o=__company > cn=group2,ou=project1,o=__company > > second project groups: > cn=group1,ou=project2,o=__company > cn=group2,ou=project2,o=__company > > "Server1" nss_ldap.conf: > nss_base_group ou=groups,o=company?sub > nss_base_group ou=project1,o=company?one > > "Server2" nss_ldap.conf: > nss_base_group ou=groups,o=company?sub > nss_base_group ou=project2,o=company?one > > > WBR > > > If this is achieved then we are planning > to have SUDO files based on the grooups. > > > It would be much more effective to have your sudo rules in LDAP, > and apply a > rule to a set of users/groups to a collection/netgroup of hosts. > > Regards, > Buchan > > >

1 0

acl confusion in proxy server config
by Ron Peterson 14 Aug '11

14 Aug '11

I have a proxy server ('ldap' backend) sitting in front of a master directory. The DNs on my master directory are UUIDs + ou + domain, e.g. myid=1234...89,dc=yada,dc=com. Each object has a (unique) username attrbute. Logging in on the proxy server involves mapping the username to the DN rwm-rewriteMap ldap uid2DN "ldaps://server.somewhere.com/ou=something,dc=xyz,dc=com?dn?sub" binddn="uid=..." credentials="xxx" rwm-rewriteContext bindDN rwm-rewriteRule "^uid=([a-z0-9_]{3,24}),ou=zzz" "${uid2DN(myusername=$1)}" ":@I" I would like anyone logging in as themselves to be able to read their own attributes. I'm having trouble doing this. 'Self' doesn't seem to work because of the mapping going on, e.g. access to dn.sub="ou=vpn" by self read by anonymous auth by * non Aug 11 11:22:09 mid slapd[5848]: => acl_mask: access to entry "myid=c44883ba-ac62-d28c-556f-99ccbf532da7,ou=zzz", attr "entry" requested Aug 11 11:22:09 mid slapd[5848]: => acl_mask: to all values by "myid=c44883ba-ac62-d28c-556f-99ccbf532da7,ou=something,dc=xyz,dc=com", (read(=rscxd)) Aug 11 11:22:09 mid slapd[5848]: <= check a_dn_pat: self Aug 11 11:22:09 mid slapd[5848]: <= check a_dn_pat: anonymous Aug 11 11:22:09 mid slapd[5848]: <= check a_dn_pat: * Aug 11 11:22:09 mid slapd[5848]: <= acl_mask: [3] applying none(=0) (stop) Aug 11 11:22:09 mid slapd[5848]: <= acl_mask: [3] mask: none(=0) Aug 11 11:22:09 mid slapd[5848]: => slap_access_allowed: read access denied by none(=0 I think 'self' doesn't match because myid=c44883ba-ac62-d28c-556f-99ccbf532da7,ou=zzz does not equal myid=c44883ba-ac62-d28c-556f-99ccbf532da7,ou=something,dc=xyz,dc=com (is my thinking correct on this?) How do I allow a user to read their own attributes in this situation? -Ron-

2 1

Problem with overlay uniqe
by Ruud Baart 13 Aug '11

13 Aug '11

I use slapd 2.4.23 (debian package) with some overlays: syncprov, unique and valsort. I have a problem with the unique overlay. This is the unique constraint: olcUniqueURI: ldap://ou=Workstations,ou=Devices,dc=example,dc=com/?uid?sub I try to add a ldif like this: dn: uid=userabc,ou=MozillaAddressBook,ou=Users,dc=example,dc=com objectClass: person ... objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: .. ... uid: userabc ... with ldapadd I get: ldap_add: Constraint violation (19) additional info: some attributes not unique When I remove the unique constraint the ldif file is accepted. It seems to me that something is wrong: the base of olcUniqueURI is different from the base where I try to add a entry. I don't understand this. Is the olcUniqueURI wrong? -- Regards, Ruud Baart

5 8

Re: Group Members
by Michael Ströder 13 Aug '11

13 Aug '11

Cc:-ed openldap-technical(a)openldap.org criderkevin(a)aol.com wrote: > Not many users, only about 400-500. I'm thinking just due to our need to > multiple admins needing access to different apps we may want different > branches...but them the Users are duplicated but perhaps in an LDAP world > that's not a no-no. I believe this sort of thing can be controlled by ACL's as > well?...but 1 branch per App seems to be easiest. (woudl you agree?) Yes, you should make yourself familiar with ACLs for achieving degelated administration. > Also, are there decent free LDAP amin gui interface tools anyone would > recommend? I've tried a few that Google search has come up with but thought > I'd ask... There are several with different focus. You should try out yourself and choose the one which fits your needs best. Being the author of web2ldap I'm biased anyway. Ciao, Michael.

1 0

can't get memberof filter working
by Gerardo Herzig 12 Aug '11

12 Aug '11

Hi all. Im having hard time triyng to figure out what is wrong with this ldap query: Im triyng to filter a specific user inside a specific group. Like this /usr/bin/ldapsearch -x -D ".." -w.. -b "o=Work" "(&(uniquemember=uid=gherzig,ou=People,o=Work) (memberof=cn=MailUsers,ou=Groups,o=Work))" It gets no results, but if i remove the memberof part, it works good. "(&(uniquemember=uid=gherzig,ou=People,o=Work))" as a filter gives me all the entries that users is in. What is wrong? BTW specifiyng a different basesearch is not an option, i need that base as it is. Thanks!! Gerardo

4 7

Group Members
by criderkevin＠aol.com 12 Aug '11

12 Aug '11

Whats the best way to design my LDAP for use by multiple apps? I need to be able to tell if a user if a member of different apps to allow access. I started by adding custom attributes for each app, boolean and such, and that works fine but somehow just doesn't feel right. Now I'm experimenting with Groups. I have a few Groups setup of objectClass groupOfNames and I've added "member"s to them...the problem is I can't seem to find an ldapsearch that returns a list of users for a particular group. What am I missing here? This query was the closest I came as it returns the list of member attributes: /usr/bin/ldapsearch -h 127.0.0.1 -x -b "dc=mydomain,dc=com" "(&(objectclass=groupOfNames)(cn=GroupA))" Perhaps I am misunderstanding that ldap can do what I'm asking...(???) Would I be better off with the custom attributes on my Users ou? I also need to consider that we need to provide access to seveal admins for maintenance, so we need to make sure one admin can't change the application access that they shouldn't be. Should we have a seperate branch for each app then??? tia, Kevin

3 2

list of replics
by Dmitriy Kirhlarov 12 Aug '11

12 Aug '11

Hi, list. Our company has some core ldap servers. Also we have many replicas from this core, all supported by different persons. I need to get the full list of these replicas. I supposed to find this information in slapd.log, with "sync" enabled, but I couldn't find any replica indicators. Could you please let me know how to find replicas information in slapd.log? WBR

3 3

chaining and referral object with two referrals
by Meike Stone 12 Aug '11

12 Aug '11

Hello, sorry for asking again. If I use the chaining overlay (slapo-chain), and I put more then one referral in the referral-object, how does the overlay behave and can I configure this? Background is, that I want put two referrals to two LDAP-Servers (multi master) and if one of them is missing, the secondary should be asked from the slapo. (http://www.openldap.org/lists/openldap-technical/201107/msg00267.html) Thanks, Meike! (Excuse me for using the mail address from my colleague last time)..

2 2

Read-only Back-SQL
by Worgan, Craig (Craig) 11 Aug '11

11 Aug '11

Hi, I have a little bit of, mainly experimental, experience configuring back-sql to connect to a PostgreSQL database. I have a requirement in front of me to expose a small table of user data in the database to an existing LDAP client. The data in the database is already in the database and managed by another application through the database directly. The LDAP API I am being asked to provide will be read-only. In other words, the data will continue to be managed by the existing management app. I foresee two problems with this approach. First, since the database table is already populated when the new ldap service is turned on, there is no data in the ldap_entries table. Is there a way to populate ldap_entries after the fact so that the records can be seen by OpenLDAP? Second, since the data is mastered by another application that goes through SQL directly, is there a way to update the ldap_entries table on the fly to reflect the additions and deletions that occur once the ldap service is up and running? Right now I am looking at writing a custom procedure to initially populate the ldap_entries table and then triggers to manage the additions and deletions from that point onward. I was just wondering if there was something in back-sql already that might provide a better solution. We are currently using OpenLDAP 2.4.21. Thanks, Craig Worgan Avaya| System Management Solutions | 250 Sidney Street | Belleville, Ontario Canada K8N 5B7 | (613) 967-5233 | worganc(a)avaya.com<mailto:worganc@avaya.com>

1 0

Multi-master setup
by Nocturn 11 Aug '11

11 Aug '11

I'm trying to set up a multi-master ldap with openldap on SL/RHEL 6.1 from the docs here: http://www.openldap.org/doc/admin24/replication.html#N-WayMulti-Master I created an ldif file with: dn: cn=config objectClass: olcGlobal cn: config olcServerID: 1 dn: olcDatabase={0}config,cn=config objectClass: olcDatabaseConfig olcDatabase: {0}config olcRootPW: *** But all attempts to import it fail, both with ldapadd as with slapadd. I think I may be getting the whole cn=config way of doing things wrong. Can anyone point me in the right direction? Thanks

1 0

XDAS, SNMP, Auditing, Architecture, Systemrequirement, Replication, Administration - Request
by Kai Pohl 11 Aug '11

11 Aug '11

Dear Sir or Madam, i have some questions about OpenLDAP 2.4.23 or 2.4.26. Does it have a XDAS interface or implementation possibility of another company? Can it use SNMP for monitoring/administration? A question of the architecture of OpenLDAP: Provide it Read-Only/Multi-Read/Write/Multi-Server System? Where can i find Requirments for the system, on which OpenLDAP should installed? My last question is about replication, which replicationforms cann be used, partitioning? Kind Regards Kai Pohl ====================================== Kai Pohl Computer & Competence GmbH, www.cuc.de Warnstedtstrasse 12-16, D22525 Hamburg Tel: +49 (0)40 54882 - 163, Fax: -288 CuC ist als "Computer & Competence" Beratungs- und Vertriebs GmbH beim Hamburger Amtsgericht im Register B unter der Nummer 46306 registriert. Geschäftsführer: Constantin Albrecht AGB: https://www.cuc.de/AGB.agb.0.html ======================================

2 1

Problem in authentication when multiple CA certificates are present
by sachin mishra 10 Aug '11

10 Aug '11

LDAP authentication was working fine when I had single CA certificate at my client machine. I was using ldap_set_option(NULL, LDAP_OPT_X_TLS_CACERTFILE, tls_cacert_file)) to set the path of CA certificate. Now, there are multiple CA certificates in my certificate hosting path. I tried by reading all the files and then assign the first one using the set option above and if it fails, I perform ldap_unbind and then create a fresh request and set all the options before calling "ldap_start_tls_s". So the steps are: 1. ld = ldap_init() 2. ldap_set_option for number of options including LDAP_OPT_X_TLS_CACERTFILE which points to first file in the directory containing multiple CA certificates 3. ldap_start_tls_s(ld, NULL, NULL) 4. If step 3 is successful continue with normal operation 5. If step 3 fails, ldap_unbind (ld), start from step1 again except that LDAP_OPT_X_TLS_CACERTFILE will now have the next entry in the directory as input. Is there anything wrong in this? Is there any better approach for this? Thanks, Sachin

2 1

Hello, please help build a query for LDAP
by Alexey Shalin 10 Aug '11

10 Aug '11

Hello, please help build a query for LDAP, to get a list of accounts whose password has expired Thank you ------------------------------------------------------------------------------- С уважением, Алексей Шалин Системный Администратор Отдел системного администрирования ЗАО "Межбанковский процессинговый центр" 720083, Кыргызская Республика г. Бишкек, ул. Ауэзова 1/2 тел.: +996 (312) 637738 (вн. 138) факс: +996 (312) 637748 e-mail: <mailto:a.shalin@ipc.kg> a.shalin(a)ipc.kg

2 1

TLS handshake failure
by Daniel Qian 09 Aug '11

09 Aug '11

Hi, I have slapd 2.4.24 and everything works without TLS. but if I add a -Z option to the ldapsearch command I get this: [root@ldaprov1 cacerts]# ldapsearch -x -LLL -b cn=config -D cn=admin,cn=config -wxxxxxxx -Z -H ldap://ldaprov1.prod cn=config ldap_start_tls: Connect error (-11) ldap_result: Can't contact LDAP server (-1) slapd.log shows something like this : connection_read(16): TLS accept failure error=-1 id=1006, closing Output from openssl debug: [root@ldaprov1 cacerts]# openssl s_client -connect hostname:389 -showcerts -state -CAfile cacert.pem CONNECTED(00000003) SSL_connect:before/connect initialization SSL_connect:SSLv2/v3 write client hello A 140225133647680:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:177: --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 0 bytes and written 113 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE --- The configurations are as follow (same command as above but without the -Z option): [root@ldaprov1 cacerts]# ldapsearch -x -LLL -b cn=config -D cn=admin,cn=config -wxxxxxx -H ldap://hostname cn=config dn: cn=config objectClass: olcGlobal cn: config olcConfigFile: /etc/openldap/slapd.conf olcConfigDir: /etc/openldap/slapd.d olcAllows: bind_v2 olcArgsFile: /var/run/openldap/slapd.args olcAttributeOptions: lang- olcAuthzPolicy: none olcConcurrency: 0 olcConnMaxPending: 100 olcConnMaxPendingAuth: 1000 olcGentleHUP: FALSE olcIdleTimeout: 0 olcIndexSubstrIfMaxLen: 4 olcIndexSubstrIfMinLen: 2 olcIndexSubstrAnyLen: 4 olcIndexSubstrAnyStep: 2 olcIndexIntLen: 4 olcLocalSSF: 71 olcLogLevel: 9 olcPidFile: /var/run/openldap/slapd.pid olcReadOnly: FALSE olcReverseLookup: FALSE olcSaslSecProps: noplain,noanonymous olcSockbufMaxIncoming: 262143 olcSockbufMaxIncomingAuth: 16777215 olcThreads: 16 olcTLSCACertificateFile: /etc/openldap/cacerts/cacert.pem olcTLSCertificateFile: /etc/openldap/cacerts/ldaprov1.crt olcTLSCertificateKeyFile: /etc/openldap/cacerts/ldaprov1.key olcTLSVerifyClient: never olcToolThreads: 1 olcWriteTimeout: 0 I verified the ldap user can read all the TLS files and they are setup fine [root@ldaprov1 cacerts]# openssl verify -purpose sslserver -CAfile cacert.pem ldaprov1.crt ldaprov1.crt: OK Anyone can tell me what I am missing here? Thanks, Daniel

2 17

Re: Compiling OpenLDAP 2.4.23 on AIX 6.1
by Matheus Morais 09 Aug '11

09 Aug '11

I've just found the follow link on IBM support and seems to be a bug on AIX internals, I don't know precisely where. https://www-304.ibm.com/support/docview.wss?uid=isg1IV00150 There is no fix for version 6.1 yet but seems to be a patch for version 5.3 [1]. [1] - https://www-304.ibm.com/support/docview.wss?uid=isg1fixinfo123037 Em Seg, 2011-08-08 às 17:08 -0300, Matheus Morais escreveu: > Hi there, > > I'm trying to compile OpenLDAP 2.4.23 on AIX 6.1 but I'm receiving the > following erros after 'make': > > ar: Creating an archive file liblutil.a. > ar: Creating an archive file liblunicode.a. > ar: Creating an archive file librewrite.a. > ld: 0711-596 SEVERE ERROR: Object librewrite.a[xmap.o] > An RLD for section 2 (.data) refers to symbol 1030, > but the storage class of the symbol is not C_EXT or C_HIDEXT. > collect2: ld returned 12 exit status > make: 1254-004 The error code from the last command is 1. > > > Stop. > make: 1254-004 The error code from the last command is 2. > > > Stop. > make: 1254-004 The error code from the last command is 2. > > > Stop. > > I have attached the execution log files for 'configure', 'make depend' > and 'make'. I also tryed to compile the latest release (2.4.26) but have > found the same error. This could be a compatibility problem with ld from > AIX or something like that? > > Thanks. > -- Classificação da Informação: Uso Interno Matheus Morais Infraestrutura de TI Confederação SICREDI – Porto Alegre 51 3358-4700 ramal 7143 www.sicredi.com.br As informacoes contidas neste e-mail e anexos podem ser confidenciais e privilegiadas, protegidas por sigilo legal. Qualquer forma de utilizacao deste documento depende de autorizacao do emissor, sujeito as penalidades cabiveis. O emissor utiliza o recurso somente para fins profissionais, eximindo o empregador de responsabilidades por uso pessoal ou improprio. Se esta mensagem foi recebida por engano, o conteudo deve ser apagado e o remetente avisado imediatamente, atraves de resposta a este e-mail.

1 1

Re: Undefined reference to `ldap_int_tls_impl'
by Michael Alexeev 09 Aug '11

09 Aug '11

On Mon, Aug 8, 2011 at 5:47 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Thursday, August 04, 2011 5:42 AM +0200 Michael Alexeev < > michael.alexeev(a)gmail.com> wrote: > > Sorry, if this is a duplicate e-mail but it looks like my original one >> didn't make it through. >> >> Hi All, >> >> I am trying to build OpenLDAP with the MySQL Cluster but make is exiting >> with the following error: >> ./.libs/libldap.a(tls2.o):(.**data+0x0): undefined reference to >> `ldap_int_tls_impl' >> collect2: ld returned 1 exit status >> >> the configure command I use is: >> ./configure --enable-ndb=yes --enable-bdb=no --enable-hdb=no >> --with-tls=moznss >> >> Omitting --with-tls option didn't help. >> >> additional flags are >> export CPPFLAGS="-I/usr/include -I/usr/include/nss -I/usr/include/nspr" >> export LDFLAGS="-L/usr/lib/nss -L/usr/local/lib -L/usr/local/libexec >> -L/usr/lib64" >> >> OpenLDAP version is 2.4.26 >> OS is ubuntu 2.6.32-30-server x86_64 >> Compiler is gcc 4.4.3 >> >> The config file is attached. >> >> I found an email thread with the exact same problem >> http://www.openldap.org/lists/**openldap-technical/201102/**msg00273.html<http://www.openldap.org/lists/openldap-technical/201102/msg00273.html> >> > > Please file an ITS and include your config.log. Your end result clearly > has both a TLS implementation selected and TLS defined: > > #define HAVE_MOZNSS 1 > #define HAVE_TLS 1 > > Perhaps statlic libldap isn't correctly linking to tls_m.o > > --Quanah > Thank you Quanah. Will do > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

Undefined reference to `ldap_int_tls_impl'
by Michael Alexeev 09 Aug '11

09 Aug '11

Sorry, if this is a duplicate e-mail but it looks like my original one didn't make it through. Hi All, I am trying to build OpenLDAP with the MySQL Cluster but make is exiting with the following error: ./.libs/libldap.a(tls2.o):(.data+0x0): undefined reference to `ldap_int_tls_impl' collect2: ld returned 1 exit status the configure command I use is: ./configure --enable-ndb=yes --enable-bdb=no --enable-hdb=no --with-tls=moznss Omitting --with-tls option didn't help. additional flags are export CPPFLAGS="-I/usr/include -I/usr/include/nss -I/usr/include/nspr" export LDFLAGS="-L/usr/lib/nss -L/usr/local/lib -L/usr/local/libexec -L/usr/lib64" OpenLDAP version is 2.4.26 OS is ubuntu 2.6.32-30-server x86_64 Compiler is gcc 4.4.3 The config file is attached. I found an email thread with the exact same problem http://www.openldap.org/lists/openldap-technical/201102/msg00273.html but no solution was mentioned there. Thank you in advance, Mike Alexeev

3 3

Compiling OpenLDAP 2.4.23 on AIX 6.1
by Matheus Morais 08 Aug '11

08 Aug '11

Hi there, I'm trying to compile OpenLDAP 2.4.23 on AIX 6.1 but I'm receiving the following erros after 'make': ar: Creating an archive file liblutil.a. ar: Creating an archive file liblunicode.a. ar: Creating an archive file librewrite.a. ld: 0711-596 SEVERE ERROR: Object librewrite.a[xmap.o] An RLD for section 2 (.data) refers to symbol 1030, but the storage class of the symbol is not C_EXT or C_HIDEXT. collect2: ld returned 12 exit status make: 1254-004 The error code from the last command is 1. Stop. make: 1254-004 The error code from the last command is 2. Stop. make: 1254-004 The error code from the last command is 2. Stop. I have attached the execution log files for 'configure', 'make depend' and 'make'. I also tryed to compile the latest release (2.4.26) but have found the same error. This could be a compatibility problem with ld from AIX or something like that? Thanks. -- Matheus Morais Infraestrutura de TI Confederação SICREDI – Porto Alegre 51 3358-4700 ramal 7143 www.sicredi.com.br As informacoes contidas neste e-mail e anexos podem ser confidenciais e privilegiadas, protegidas por sigilo legal. Qualquer forma de utilizacao deste documento depende de autorizacao do emissor, sujeito as penalidades cabiveis. O emissor utiliza o recurso somente para fins profissionais, eximindo o empregador de responsabilidades por uso pessoal ou improprio. Se esta mensagem foi recebida por engano, o conteudo deve ser apagado e o remetente avisado imediatamente, atraves de resposta a este e-mail.

1 0

OpenLDAP freezes and doesn't respond
by Cyril GROSJEAN 08 Aug '11

08 Aug '11

I randomly notice my OpenLDAP server freezes, and I can't udnerstand why. I have a few LDAP clients (ldapsearch, a legacy Java app. and ApacheDirectoryStudio), running from different systems, either locally on the OpenLDAP server, or on another OpenLDAP server, or on a remote workstation, and none manages to get an answer from OpenLDAP. The connection is established but each client gets stuck waiting for any result. The last time, it occured only a few minutes after the OpenLDAP daemon was restarted, under very low load. I use OpenLDAP 2.4.23, over Red Hat Enterprise Linux Server release 5.4 (Tikanga), Kernel version 2.6.18-164.el5, amd64 architecture over VMWare. I also use BDB 4.8.30, and OpenLDAP's been compiled with the following options: ./configure --prefix=/opt/openldap-2.4.23 --enable-dynamic=yes --enable-dynlist=yes --enable-memberof=yes --enable-ppolicy=yes --enable-accesslog=yes --enable-sssvlv=yes I noticed only 60 to 70 established connections on port 389 (according to netstat) when the freeze occurs. The OpenLDAP server is set in syncrepl mirror mode replication, and the other OpenLDAP server (only used as a hot stand-by) works fine (but doesn't receive any load) In the OpenLDAP accesslog, I usually see the client requests, but no lines for the responses. Also, I noticed sometimes the "deferring operation: binding" message : Jul 12 10:20:05 dev-ldap1 slapd[28525]: connection_input: conn=3377 deferring operation: binding Jul 12 10:20:07 dev-ldap1 slapd[28525]: conn=3378 fd=66 ACCEPT from IP=......:3823 (IP=0.0.0.0:389) I don't know if this message is linked or not to the main problem so I'd like to know if this message is harmless or not. The stack of the slapd process is as follows when the freeze occurs: Thread 18 (Thread 0x40d4b940 (LWP 1893)): #0 0x00000031a7ad4018 in epoll_wait () from /lib64/libc.so.6 #1 0x000000000041d76e in ldap_pvt_sasl_mutex_dispose () #2 0x00000031a86064a7 in start_thread () from /lib64/libpthread.so.0 #3 0x00000031a7ad3c2d in clone () from /lib64/libc.so.6 Thread 17 (Thread 0x4154c940 (LWP 1894)): #0 0x00000031a860ab99 in pthread_cond_wait@@GLIBC_2.3.2 () #1 0x00002b710a3ad7fb in ldap_pvt_thread_rmutex_lock () #2 0x00000000004d4c74 in ldap_pvt_sasl_mutex_dispose () #3 0x0000000000481b4a in ldap_pvt_sasl_mutex_dispose () #4 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #5 0x00000000004de44d in ldap_pvt_sasl_mutex_dispose () #6 0x000000000042ee25 in ldap_pvt_sasl_mutex_dispose () #7 0x00000000004319c8 in ldap_pvt_sasl_mutex_dispose () #8 0x0000000000432749 in ldap_pvt_sasl_mutex_dispose () #9 0x00000000004ae91b in ldap_pvt_sasl_mutex_dispose () #10 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #11 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #12 0x000000000043be3e in ldap_pvt_sasl_mutex_dispose () #13 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #14 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #15 0x000000000043c83f in ldap_pvt_sasl_mutex_dispose () #16 0x00000000004205a5 in ldap_pvt_sasl_mutex_dispose () #17 0x0000000000420b7f in ldap_pvt_sasl_mutex_dispose () #18 0x00002b710a3ae8a8 in ldap_int_thread_pool_wrapper () #19 0x00000031a86064a7 in start_thread () from /lib64/libpthread.so.0 #20 0x00000031a7ad3c2d in clone () from /lib64/libc.so.6 Thread 16 (Thread 0x42771940 (LWP 1895)): #0 0x00000031a860ab99 in pthread_cond_wait@@GLIBC_2.3.2 () #1 0x00002b710a833dd2 in __db_pthread_mutex_lock () #2 0x00002b710a833426 in __db_tas_mutex_lock () #3 0x00002b710a8c3b49 in __lock_get_internal () #4 0x00002b710a8c42c2 in __lock_get_pp () #5 0x00000000004af398 in ldap_pvt_sasl_mutex_dispose () #6 0x00000000004b04ca in ldap_pvt_sasl_mutex_dispose () #7 0x00000000004b4183 in ldap_pvt_sasl_mutex_dispose () #8 0x00000000004b802e in ldap_pvt_sasl_mutex_dispose () #9 0x0000000000481a7a in ldap_pvt_sasl_mutex_dispose () #10 0x0000000000482547 in ldap_pvt_sasl_mutex_dispose () #11 0x00000000004decab in ldap_pvt_sasl_mutex_dispose () #12 0x0000000000481b4a in ldap_pvt_sasl_mutex_dispose () #13 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #14 0x000000000043be3e in ldap_pvt_sasl_mutex_dispose () #15 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #16 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #17 0x000000000043c83f in ldap_pvt_sasl_mutex_dispose () #18 0x00000000004205a5 in ldap_pvt_sasl_mutex_dispose () #19 0x0000000000420b7f in ldap_pvt_sasl_mutex_dispose () #20 0x00002b710a3ae8a8 in ldap_int_thread_pool_wrapper () #21 0x00000031a86064a7 in start_thread () from /lib64/libpthread.so.0 #22 0x00000031a7ad3c2d in clone () from /lib64/libc.so.6 Thread 15 (Thread 0x42f72940 (LWP 1896)): #0 0x00000031a860ab99 in pthread_cond_wait@@GLIBC_2.3.2 () #1 0x00002b710a833dd2 in __db_pthread_mutex_lock () #2 0x00002b710a833426 in __db_tas_mutex_lock () #3 0x00002b710a8c3b49 in __lock_get_internal () #4 0x00002b710a8c42c2 in __lock_get_pp () #5 0x00000000004af398 in ldap_pvt_sasl_mutex_dispose () #6 0x00000000004b04ca in ldap_pvt_sasl_mutex_dispose () #7 0x0000000000492a80 in ldap_pvt_sasl_mutex_dispose () #8 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #9 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #10 0x0000000000422736 in ldap_pvt_sasl_mutex_dispose () #11 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #12 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #13 0x0000000000422ec7 in ldap_pvt_sasl_mutex_dispose () #14 0x00000000004205a5 in ldap_pvt_sasl_mutex_dispose () #15 0x0000000000420b7f in ldap_pvt_sasl_mutex_dispose () #16 0x00002b710a3ae8a8 in ldap_int_thread_pool_wrapper () #17 0x00000031a86064a7 in start_thread () from /lib64/libpthread.so.0 #18 0x00000031a7ad3c2d in clone () from /lib64/libc.so.6 Thread 14 (Thread 0x43773940 (LWP 1897)): #0 0x00000031a860ab99 in pthread_cond_wait@@GLIBC_2.3.2 () #1 0x00002b710a833dd2 in __db_pthread_mutex_lock () #2 0x00002b710a833426 in __db_tas_mutex_lock () #3 0x00002b710a8c3b49 in __lock_get_internal () #4 0x00002b710a8c42c2 in __lock_get_pp () #5 0x00000000004af398 in ldap_pvt_sasl_mutex_dispose () #6 0x00000000004b04ca in ldap_pvt_sasl_mutex_dispose () #7 0x0000000000492a80 in ldap_pvt_sasl_mutex_dispose () #8 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #9 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #10 0x0000000000422736 in ldap_pvt_sasl_mutex_dispose () #11 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #12 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #13 0x0000000000422ec7 in ldap_pvt_sasl_mutex_dispose () #14 0x00000000004205a5 in ldap_pvt_sasl_mutex_dispose () #15 0x0000000000420b7f in ldap_pvt_sasl_mutex_dispose () #16 0x00002b710a3ae8a8 in ldap_int_thread_pool_wrapper () #17 0x00000031a86064a7 in start_thread () from /lib64/libpthread.so.0 #18 0x00000031a7ad3c2d in clone () from /lib64/libc.so.6 Thread 13 (Thread 0x43f74940 (LWP 1898)): #0 0x00000031a860ab99 in pthread_cond_wait@@GLIBC_2.3.2 () #1 0x00002b710a833dd2 in __db_pthread_mutex_lock () #2 0x00002b710a833426 in __db_tas_mutex_lock () #3 0x00002b710a8c3b49 in __lock_get_internal () #4 0x00002b710a8c42c2 in __lock_get_pp () #5 0x00000000004af398 in ldap_pvt_sasl_mutex_dispose () #6 0x00000000004b04ca in ldap_pvt_sasl_mutex_dispose () #7 0x0000000000492a80 in ldap_pvt_sasl_mutex_dispose () #8 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #9 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #10 0x0000000000422736 in ldap_pvt_sasl_mutex_dispose () #11 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #12 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #13 0x0000000000422ec7 in ldap_pvt_sasl_mutex_dispose () #14 0x00000000004205a5 in ldap_pvt_sasl_mutex_dispose () #15 0x0000000000420b7f in ldap_pvt_sasl_mutex_dispose () #16 0x00002b710a3ae8a8 in ldap_int_thread_pool_wrapper () #17 0x00000031a86064a7 in start_thread () from /lib64/libpthread.so.0 #18 0x00000031a7ad3c2d in clone () from /lib64/libc.so.6 Thread 12 (Thread 0x44775940 (LWP 1902)): #0 0x00000031a860ab99 in pthread_cond_wait@@GLIBC_2.3.2 () #1 0x00002b710a833dd2 in __db_pthread_mutex_lock () #2 0x00002b710a833426 in __db_tas_mutex_lock () #3 0x00002b710a8c3b49 in __lock_get_internal () #4 0x00002b710a8c42c2 in __lock_get_pp () #5 0x00000000004af398 in ldap_pvt_sasl_mutex_dispose () #6 0x00000000004b04ca in ldap_pvt_sasl_mutex_dispose () #7 0x0000000000492a80 in ldap_pvt_sasl_mutex_dispose () #8 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #9 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #10 0x0000000000422736 in ldap_pvt_sasl_mutex_dispose () #11 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #12 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #13 0x0000000000422ec7 in ldap_pvt_sasl_mutex_dispose () #14 0x00000000004205a5 in ldap_pvt_sasl_mutex_dispose () #15 0x0000000000420b7f in ldap_pvt_sasl_mutex_dispose () #16 0x00002b710a3ae8a8 in ldap_int_thread_pool_wrapper () #17 0x00000031a86064a7 in start_thread () from /lib64/libpthread.so.0 #18 0x00000031a7ad3c2d in clone () from /lib64/libc.so.6 Thread 11 (Thread 0x41d4d940 (LWP 1947)): #0 0x00000031a860ab99 in pthread_cond_wait@@GLIBC_2.3.2 () #1 0x00002b710a833dd2 in __db_pthread_mutex_lock () #2 0x00002b710a833426 in __db_tas_mutex_lock () #3 0x00002b710a8c3b49 in __lock_get_internal () #4 0x00002b710a8c42c2 in __lock_get_pp () #5 0x00000000004af398 in ldap_pvt_sasl_mutex_dispose () #6 0x00000000004b04ca in ldap_pvt_sasl_mutex_dispose () #7 0x0000000000492a80 in ldap_pvt_sasl_mutex_dispose () #8 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #9 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #10 0x0000000000422736 in ldap_pvt_sasl_mutex_dispose () #11 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #12 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #13 0x0000000000422ec7 in ldap_pvt_sasl_mutex_dispose () #14 0x00000000004205a5 in ldap_pvt_sasl_mutex_dispose () #15 0x0000000000420b7f in ldap_pvt_sasl_mutex_dispose () #16 0x00002b710a3ae8a8 in ldap_int_thread_pool_wrapper () #17 0x00000031a86064a7 in start_thread () from /lib64/libpthread.so.0 #18 0x00000031a7ad3c2d in clone () from /lib64/libc.so.6 Thread 10 (Thread 0x44f76940 (LWP 1948)): #0 0x00000031a860ab99 in pthread_cond_wait@@GLIBC_2.3.2 () #1 0x00002b710a3ad7fb in ldap_pvt_thread_rmutex_lock () #2 0x00000000004d4c74 in ldap_pvt_sasl_mutex_dispose () #3 0x0000000000481b4a in ldap_pvt_sasl_mutex_dispose () #4 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #5 0x00000000004de44d in ldap_pvt_sasl_mutex_dispose () #6 0x000000000042ee25 in ldap_pvt_sasl_mutex_dispose () #7 0x00000000004319c8 in ldap_pvt_sasl_mutex_dispose () #8 0x0000000000432749 in ldap_pvt_sasl_mutex_dispose () #9 0x00000000004ae91b in ldap_pvt_sasl_mutex_dispose () #10 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #11 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #12 0x000000000043be3e in ldap_pvt_sasl_mutex_dispose () #13 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #14 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #15 0x000000000043c83f in ldap_pvt_sasl_mutex_dispose () #16 0x00000000004205a5 in ldap_pvt_sasl_mutex_dispose () #17 0x0000000000420b7f in ldap_pvt_sasl_mutex_dispose () #18 0x00002b710a3ae8a8 in ldap_int_thread_pool_wrapper () #19 0x00000031a86064a7 in start_thread () from /lib64/libpthread.so.0 #20 0x00000031a7ad3c2d in clone () from /lib64/libc.so.6 Thread 9 (Thread 0x45777940 (LWP 1949)): #0 0x00000031a860ab99 in pthread_cond_wait@@GLIBC_2.3.2 () #1 0x00002b710a833dd2 in __db_pthread_mutex_lock () #2 0x00002b710a833426 in __db_tas_mutex_lock () #3 0x00002b710a8c3b49 in __lock_get_internal () #4 0x00002b710a8c42c2 in __lock_get_pp () #5 0x00000000004af398 in ldap_pvt_sasl_mutex_dispose () #6 0x00000000004b04ca in ldap_pvt_sasl_mutex_dispose () #7 0x00000000004b4183 in ldap_pvt_sasl_mutex_dispose () #8 0x00000000004b802e in ldap_pvt_sasl_mutex_dispose () #9 0x0000000000481a7a in ldap_pvt_sasl_mutex_dispose () #10 0x0000000000482547 in ldap_pvt_sasl_mutex_dispose () #11 0x00000000004decab in ldap_pvt_sasl_mutex_dispose () #12 0x0000000000481b4a in ldap_pvt_sasl_mutex_dispose () #13 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #14 0x000000000043be3e in ldap_pvt_sasl_mutex_dispose () #15 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #16 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #17 0x000000000043c83f in ldap_pvt_sasl_mutex_dispose () #18 0x00000000004205a5 in ldap_pvt_sasl_mutex_dispose () #19 0x0000000000420b7f in ldap_pvt_sasl_mutex_dispose () #20 0x00002b710a3ae8a8 in ldap_int_thread_pool_wrapper () #21 0x00000031a86064a7 in start_thread () from /lib64/libpthread.so.0 #22 0x00000031a7ad3c2d in clone () from /lib64/libc.so.6 Thread 8 (Thread 0x45f78940 (LWP 1950)): #0 0x00000031a860ab99 in pthread_cond_wait@@GLIBC_2.3.2 () #1 0x00002b710a3ad7fb in ldap_pvt_thread_rmutex_lock () #2 0x00000000004d4c74 in ldap_pvt_sasl_mutex_dispose () #3 0x0000000000481b4a in ldap_pvt_sasl_mutex_dispose () #4 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #5 0x00000000004de44d in ldap_pvt_sasl_mutex_dispose () #6 0x000000000042ee25 in ldap_pvt_sasl_mutex_dispose () #7 0x00000000004319c8 in ldap_pvt_sasl_mutex_dispose () #8 0x0000000000432749 in ldap_pvt_sasl_mutex_dispose () #9 0x00000000004ae91b in ldap_pvt_sasl_mutex_dispose () #10 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #11 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #12 0x000000000043be3e in ldap_pvt_sasl_mutex_dispose () #13 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #14 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #15 0x000000000043c83f in ldap_pvt_sasl_mutex_dispose () #16 0x00000000004205a5 in ldap_pvt_sasl_mutex_dispose () #17 0x0000000000420b7f in ldap_pvt_sasl_mutex_dispose () #18 0x00002b710a3ae8a8 in ldap_int_thread_pool_wrapper () #19 0x00000031a86064a7 in start_thread () from /lib64/libpthread.so.0 #20 0x00000031a7ad3c2d in clone () from /lib64/libc.so.6 Thread 7 (Thread 0x46779940 (LWP 1951)): #0 0x00000031a860ab99 in pthread_cond_wait@@GLIBC_2.3.2 () #1 0x00002b710a3ad7fb in ldap_pvt_thread_rmutex_lock () #2 0x00000000004d4c74 in ldap_pvt_sasl_mutex_dispose () #3 0x0000000000481b4a in ldap_pvt_sasl_mutex_dispose () #4 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #5 0x00000000004de44d in ldap_pvt_sasl_mutex_dispose () #6 0x000000000042ee25 in ldap_pvt_sasl_mutex_dispose () #7 0x00000000004319c8 in ldap_pvt_sasl_mutex_dispose () #8 0x0000000000432749 in ldap_pvt_sasl_mutex_dispose () #9 0x00000000004ae91b in ldap_pvt_sasl_mutex_dispose () #10 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #11 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #12 0x000000000043be3e in ldap_pvt_sasl_mutex_dispose () #13 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #14 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #15 0x000000000043c83f in ldap_pvt_sasl_mutex_dispose () #16 0x00000000004205a5 in ldap_pvt_sasl_mutex_dispose () #17 0x0000000000420b7f in ldap_pvt_sasl_mutex_dispose () #18 0x00002b710a3ae8a8 in ldap_int_thread_pool_wrapper () #19 0x00000031a86064a7 in start_thread () from /lib64/libpthread.so.0 #20 0x00000031a7ad3c2d in clone () from /lib64/libc.so.6 Thread 6 (Thread 0x46f7a940 (LWP 1952)): #0 0x00000031a860ab99 in pthread_cond_wait@@GLIBC_2.3.2 () #1 0x00002b710a833dd2 in __db_pthread_mutex_lock () #2 0x00002b710a833426 in __db_tas_mutex_lock () #3 0x00002b710a8c3b49 in __lock_get_internal () #4 0x00002b710a8c42c2 in __lock_get_pp () #5 0x00000000004af398 in ldap_pvt_sasl_mutex_dispose () #6 0x00000000004b04ca in ldap_pvt_sasl_mutex_dispose () #7 0x0000000000492a80 in ldap_pvt_sasl_mutex_dispose () #8 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #9 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #10 0x0000000000422736 in ldap_pvt_sasl_mutex_dispose () #11 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #12 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #13 0x0000000000422ec7 in ldap_pvt_sasl_mutex_dispose () #14 0x00000000004205a5 in ldap_pvt_sasl_mutex_dispose () #15 0x0000000000420b7f in ldap_pvt_sasl_mutex_dispose () #16 0x00002b710a3ae8a8 in ldap_int_thread_pool_wrapper () #17 0x00000031a86064a7 in start_thread () from /lib64/libpthread.so.0 #18 0x00000031a7ad3c2d in clone () from /lib64/libc.so.6 Thread 5 (Thread 0x4777b940 (LWP 2149)): #0 0x00000031a860ab99 in pthread_cond_wait@@GLIBC_2.3.2 () #1 0x00002b710a833dd2 in __db_pthread_mutex_lock () #2 0x00002b710a833426 in __db_tas_mutex_lock () #3 0x00002b710a8c3b49 in __lock_get_internal () #4 0x00002b710a8c44ea in __lock_vec () #5 0x00002b710a8c512b in __lock_vec_pp () #6 0x00000000004af514 in ldap_pvt_sasl_mutex_dispose () #7 0x00000000004af900 in ldap_pvt_sasl_mutex_dispose () #8 0x000000000048d323 in ldap_pvt_sasl_mutex_dispose () #9 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #10 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #11 0x00000000004de44d in ldap_pvt_sasl_mutex_dispose () #12 0x000000000042ee25 in ldap_pvt_sasl_mutex_dispose () #13 0x00000000004319c8 in ldap_pvt_sasl_mutex_dispose () #14 0x0000000000432749 in ldap_pvt_sasl_mutex_dispose () #15 0x00000000004ae91b in ldap_pvt_sasl_mutex_dispose () #16 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #17 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #18 0x000000000043be3e in ldap_pvt_sasl_mutex_dispose () #19 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #20 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #21 0x000000000043c83f in ldap_pvt_sasl_mutex_dispose () #22 0x00000000004205a5 in ldap_pvt_sasl_mutex_dispose () #23 0x0000000000420b7f in ldap_pvt_sasl_mutex_dispose () #24 0x00002b710a3ae8a8 in ldap_int_thread_pool_wrapper () #25 0x00000031a86064a7 in start_thread () from /lib64/libpthread.so.0 #26 0x00000031a7ad3c2d in clone () from /lib64/libc.so.6 Thread 4 (Thread 0x47f7c940 (LWP 2150)): #0 0x00000031a860ab99 in pthread_cond_wait@@GLIBC_2.3.2 () #1 0x00002b710a3ad7fb in ldap_pvt_thread_rmutex_lock () #2 0x00000000004d4c74 in ldap_pvt_sasl_mutex_dispose () #3 0x0000000000481b4a in ldap_pvt_sasl_mutex_dispose () #4 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #5 0x00000000004de44d in ldap_pvt_sasl_mutex_dispose () #6 0x000000000042ee25 in ldap_pvt_sasl_mutex_dispose () #7 0x00000000004319c8 in ldap_pvt_sasl_mutex_dispose () #8 0x0000000000432749 in ldap_pvt_sasl_mutex_dispose () #9 0x00000000004ae91b in ldap_pvt_sasl_mutex_dispose () #10 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #11 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #12 0x000000000043be3e in ldap_pvt_sasl_mutex_dispose () #13 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #14 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #15 0x000000000043c83f in ldap_pvt_sasl_mutex_dispose () #16 0x00000000004205a5 in ldap_pvt_sasl_mutex_dispose () #17 0x0000000000420b7f in ldap_pvt_sasl_mutex_dispose () #18 0x00002b710a3ae8a8 in ldap_int_thread_pool_wrapper () #19 0x00000031a86064a7 in start_thread () from /lib64/libpthread.so.0 #20 0x00000031a7ad3c2d in clone () from /lib64/libc.so.6 Thread 3 (Thread 0x4877d940 (LWP 2151)): #0 0x00000031a860ab99 in pthread_cond_wait@@GLIBC_2.3.2 () #1 0x00002b710a833dd2 in __db_pthread_mutex_lock () #2 0x00002b710a833426 in __db_tas_mutex_lock () #3 0x00002b710a8c3b49 in __lock_get_internal () #4 0x00002b710a8c42c2 in __lock_get_pp () #5 0x00000000004af398 in ldap_pvt_sasl_mutex_dispose () #6 0x00000000004b04ca in ldap_pvt_sasl_mutex_dispose () #7 0x0000000000492a80 in ldap_pvt_sasl_mutex_dispose () #8 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #9 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #10 0x0000000000422736 in ldap_pvt_sasl_mutex_dispose () #11 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #12 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #13 0x0000000000422ec7 in ldap_pvt_sasl_mutex_dispose () #14 0x00000000004205a5 in ldap_pvt_sasl_mutex_dispose () #15 0x0000000000420b7f in ldap_pvt_sasl_mutex_dispose () #16 0x00002b710a3ae8a8 in ldap_int_thread_pool_wrapper () #17 0x00000031a86064a7 in start_thread () from /lib64/libpthread.so.0 #18 0x00000031a7ad3c2d in clone () from /lib64/libc.so.6 Thread 2 (Thread 0x48f7e940 (LWP 2152)): #0 0x00000031a860ab99 in pthread_cond_wait@@GLIBC_2.3.2 () #1 0x00002b710a3ad7fb in ldap_pvt_thread_rmutex_lock () #2 0x00000000004d4c74 in ldap_pvt_sasl_mutex_dispose () #3 0x0000000000481b4a in ldap_pvt_sasl_mutex_dispose () #4 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #5 0x00000000004de44d in ldap_pvt_sasl_mutex_dispose () #6 0x000000000042ee25 in ldap_pvt_sasl_mutex_dispose () #7 0x00000000004319c8 in ldap_pvt_sasl_mutex_dispose () #8 0x0000000000432749 in ldap_pvt_sasl_mutex_dispose () #9 0x00000000004ae91b in ldap_pvt_sasl_mutex_dispose () #10 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #11 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #12 0x000000000043be3e in ldap_pvt_sasl_mutex_dispose () #13 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #14 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #15 0x000000000043c83f in ldap_pvt_sasl_mutex_dispose () #16 0x00000000004205a5 in ldap_pvt_sasl_mutex_dispose () #17 0x0000000000420b7f in ldap_pvt_sasl_mutex_dispose () #18 0x00002b710a3ae8a8 in ldap_int_thread_pool_wrapper () #19 0x00000031a86064a7 in start_thread () from /lib64/libpthread.so.0 #20 0x00000031a7ad3c2d in clone () from /lib64/libc.so.6 Thread 1 (Thread 0x2b710ab80bd0 (LWP 1892)): #0 0x00000031a86077e5 in pthread_join () from /lib64/libpthread.so.0 #1 0x000000000041b3e2 in ldap_pvt_sasl_mutex_dispose () #2 0x000000000040960e in ldap_pvt_sasl_mutex_dispose () #3 0x00000031a7a1d994 in __libc_start_main () from /lib64/libc.so.6 #4 0x00000000004080d9 in ldap_pvt_sasl_mutex_dispose () #5 0x00007fff4c26b148 in ?? () #6 0x0000000000000000 in ?? () Any idea of what's wrong ? Known bug ?

3 10

Filter in referrals ?
by Cyril LAVIER 08 Aug '11

08 Aug '11

Hi. I'm wondering if it's possible to add a filter at the end of the referral "ref:" field. I tried this, but it's not working : dn: ou=sambausers,dc=domain,dc=tld objectClass: referral objectClass: extensibleObject ou: sambausers ref: ldap:///ou=Users,dc=domain,dc=tld??sub?(objectclass=samSamAccount) Did I wrongly wrote the filter ? Thanks for helping. -- Cyril LAVIER | Systems Administrator | LTU Technologies LTU technologies - Making Sense of Visual Content | www.LTUtech.com

1 0

OpenLDAP freezes and doesn't respond
by Cyril GROSJEAN 08 Aug '11

08 Aug '11

I randomly notice my OpenLDAP server freezes, and I can't udnerstand why. I have a few LDAP clients (ldapsearch, a legacy Java app. and ApacheDirectoryStudio), running from different systems, either locally on the OpenLDAP server, or on another OpenLDAP server, or on a remote workstation, and none manages to get an answer from OpenLDAP. The connection is established but each client gets stuck waiting for any result. The last time, it occured only a few minutes after the OpenLDAP daemon was restarted, under very low load. I use OpenLDAP 2.4.23, over Red Hat Enterprise Linux Server release 5.4 (Tikanga), Kernel version 2.6.18-164.el5, amd64 architecture over VMWare. I also use BDB 4.8.30, and OpenLDAP's been compiled with the following options: ./configure --prefix=/opt/openldap-2.4.23 --enable-dynamic=yes --enable-dynlist=yes --enable-memberof=yes --enable-ppolicy=yes --enable-accesslog=yes --enable-sssvlv=yes I noticed only 74 established connections on port 389 (according to netstat) when the freeze occurs. The OpenLDAP server is set in syncrepl mirror mode replication, and the other OpenLDAP server (only used as a hot stand-by) works fine (but doesn't receive any load) I only have the following lines at the end of the OpenLDAP log: (IP @ and suffixes voluntarily hidden) Jul 12 10:19:32 dev-ldap1 slapd[28525]: conn=3377 fd=65 ACCEPT from IP=.......:3820 (IP=0.0.0.0:389) Jul 12 10:19:32 dev-ldap1 slapd[28525]: conn=3377 op=0 BIND dn="employeeNumber=02071,ou= people,dc=...." method=128 Jul 12 10:20:05 dev-ldap1 slapd[28525]: connection_input: conn=3377 deferring operation: binding Jul 12 10:20:07 dev-ldap1 slapd[28525]: conn=3378 fd=66 ACCEPT from IP=......:3823 (IP=0.0.0.0:389) The stack of the slapd process shows the following: # *pstack 28525* Thread 18 (Thread 0x408e4940 (LWP 28529)): #0 0x0000003a53ad4018 in epoll_wait () from /lib64/libc.so.6 #1 0x000000000041d76e in ldap_pvt_sasl_mutex_dispose () #2 0x0000003a546064a7 in start_thread () from /lib64/libpthread.so.0 #3 0x0000003a53ad3c2d in clone () from /lib64/libc.so.6 Thread 17 (Thread 0x41360940 (LWP 28530)): #0 0x0000003a5460ab99 in pthread_cond_wait@@GLIBC_2.3.2 () #1 0x00002ba988b6cdd2 in __db_pthread_mutex_lock () #2 0x00002ba988b6c426 in __db_tas_mutex_lock () #3 0x00002ba988bfcb49 in __lock_get_internal () #4 0x00002ba988bfd2c2 in __lock_get_pp () #5 0x00000000004af398 in ldap_pvt_sasl_mutex_dispose () #6 0x00000000004b04ca in ldap_pvt_sasl_mutex_dispose () #7 0x0000000000492a80 in ldap_pvt_sasl_mutex_dispose () #8 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #9 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #10 0x0000000000422736 in ldap_pvt_sasl_mutex_dispose () #11 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #12 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #13 0x0000000000422ec7 in ldap_pvt_sasl_mutex_dispose () #14 0x00000000004205a5 in ldap_pvt_sasl_mutex_dispose () #15 0x0000000000420b7f in ldap_pvt_sasl_mutex_dispose () #16 0x00002ba9886e08a8 in ldap_int_thread_pool_wrapper () #17 0x0000003a546064a7 in start_thread () from /lib64/libpthread.so.0 #18 0x0000003a53ad3c2d in clone () from /lib64/libc.so.6 Thread 16 (Thread 0x41b61940 (LWP 28531)): #0 0x0000003a5460ab99 in pthread_cond_wait@@GLIBC_2.3.2 () #1 0x00002ba988b6cdd2 in __db_pthread_mutex_lock () #2 0x00002ba988b6c426 in __db_tas_mutex_lock () #3 0x00002ba988bfcb49 in __lock_get_internal () #4 0x00002ba988bfd2c2 in __lock_get_pp () #5 0x00000000004af398 in ldap_pvt_sasl_mutex_dispose () #6 0x00000000004b04ca in ldap_pvt_sasl_mutex_dispose () #7 0x00000000004b4183 in ldap_pvt_sasl_mutex_dispose () #8 0x00000000004b802e in ldap_pvt_sasl_mutex_dispose () #9 0x0000000000481a7a in ldap_pvt_sasl_mutex_dispose () #10 0x0000000000482547 in ldap_pvt_sasl_mutex_dispose () #11 0x00000000004decab in ldap_pvt_sasl_mutex_dispose () #12 0x0000000000481b4a in ldap_pvt_sasl_mutex_dispose () #13 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #14 0x000000000043be3e in ldap_pvt_sasl_mutex_dispose () #15 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #16 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #17 0x000000000043c83f in ldap_pvt_sasl_mutex_dispose () #18 0x00000000004205a5 in ldap_pvt_sasl_mutex_dispose () #19 0x0000000000420b7f in ldap_pvt_sasl_mutex_dispose () #20 0x00002ba9886e08a8 in ldap_int_thread_pool_wrapper () #21 0x0000003a546064a7 in start_thread () from /lib64/libpthread.so.0 #22 0x0000003a53ad3c2d in clone () from /lib64/libc.so.6 Thread 15 (Thread 0x42362940 (LWP 28532)): #0 0x0000003a5460ab99 in pthread_cond_wait@@GLIBC_2.3.2 () #1 0x00002ba988b6cdd2 in __db_pthread_mutex_lock () #2 0x00002ba988b6c426 in __db_tas_mutex_lock () #3 0x00002ba988bfcb49 in __lock_get_internal () #4 0x00002ba988bfd2c2 in __lock_get_pp () #5 0x00000000004af398 in ldap_pvt_sasl_mutex_dispose () #6 0x00000000004b04ca in ldap_pvt_sasl_mutex_dispose () #7 0x00000000004b4183 in ldap_pvt_sasl_mutex_dispose () #8 0x00000000004b802e in ldap_pvt_sasl_mutex_dispose () #9 0x0000000000481a7a in ldap_pvt_sasl_mutex_dispose () #10 0x0000000000482547 in ldap_pvt_sasl_mutex_dispose () #11 0x00000000004decab in ldap_pvt_sasl_mutex_dispose () #12 0x0000000000481b4a in ldap_pvt_sasl_mutex_dispose () #13 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #14 0x000000000043be3e in ldap_pvt_sasl_mutex_dispose () #15 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #16 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #17 0x000000000043c83f in ldap_pvt_sasl_mutex_dispose () #18 0x00000000004205a5 in ldap_pvt_sasl_mutex_dispose () #19 0x0000000000420b7f in ldap_pvt_sasl_mutex_dispose () #20 0x00002ba9886e08a8 in ldap_int_thread_pool_wrapper () #21 0x0000003a546064a7 in start_thread () from /lib64/libpthread.so.0 #22 0x0000003a53ad3c2d in clone () from /lib64/libc.so.6 Thread 14 (Thread 0x42b63940 (LWP 28533)): #0 0x0000003a5460ab99 in pthread_cond_wait@@GLIBC_2.3.2 () #1 0x00002ba988b6cdd2 in __db_pthread_mutex_lock () #2 0x00002ba988b6c426 in __db_tas_mutex_lock () #3 0x00002ba988bfcb49 in __lock_get_internal () #4 0x00002ba988bfd2c2 in __lock_get_pp () #5 0x00000000004af398 in ldap_pvt_sasl_mutex_dispose () #6 0x00000000004b04ca in ldap_pvt_sasl_mutex_dispose () #7 0x00000000004b4183 in ldap_pvt_sasl_mutex_dispose () #8 0x00000000004b802e in ldap_pvt_sasl_mutex_dispose () #9 0x0000000000481a7a in ldap_pvt_sasl_mutex_dispose () #10 0x0000000000482547 in ldap_pvt_sasl_mutex_dispose () #11 0x00000000004decab in ldap_pvt_sasl_mutex_dispose () #12 0x0000000000481b4a in ldap_pvt_sasl_mutex_dispose () #13 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #14 0x000000000043be3e in ldap_pvt_sasl_mutex_dispose () #15 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #16 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #17 0x000000000043c83f in ldap_pvt_sasl_mutex_dispose () #18 0x00000000004205a5 in ldap_pvt_sasl_mutex_dispose () #19 0x0000000000420b7f in ldap_pvt_sasl_mutex_dispose () #20 0x00002ba9886e08a8 in ldap_int_thread_pool_wrapper () #21 0x0000003a546064a7 in start_thread () from /lib64/libpthread.so.0 #22 0x0000003a53ad3c2d in clone () from /lib64/libc.so.6 Thread 13 (Thread 0x43364940 (LWP 28534)): #0 0x0000003a5460ab99 in pthread_cond_wait@@GLIBC_2.3.2 () #1 0x00002ba988b6cdd2 in __db_pthread_mutex_lock () #2 0x00002ba988b6c426 in __db_tas_mutex_lock () #3 0x00002ba988bfcb49 in __lock_get_internal () #4 0x00002ba988bfd2c2 in __lock_get_pp () #5 0x00000000004af398 in ldap_pvt_sasl_mutex_dispose () #6 0x00000000004b04ca in ldap_pvt_sasl_mutex_dispose () #7 0x00000000004b4183 in ldap_pvt_sasl_mutex_dispose () #8 0x00000000004b802e in ldap_pvt_sasl_mutex_dispose () #9 0x0000000000481a7a in ldap_pvt_sasl_mutex_dispose () #10 0x0000000000482547 in ldap_pvt_sasl_mutex_dispose () #11 0x00000000004decab in ldap_pvt_sasl_mutex_dispose () #12 0x0000000000481b4a in ldap_pvt_sasl_mutex_dispose () #13 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #14 0x000000000043be3e in ldap_pvt_sasl_mutex_dispose () #15 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #16 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #17 0x000000000043c83f in ldap_pvt_sasl_mutex_dispose () #18 0x00000000004205a5 in ldap_pvt_sasl_mutex_dispose () #19 0x0000000000420b7f in ldap_pvt_sasl_mutex_dispose () #20 0x00002ba9886e08a8 in ldap_int_thread_pool_wrapper () #21 0x0000003a546064a7 in start_thread () from /lib64/libpthread.so.0 #22 0x0000003a53ad3c2d in clone () from /lib64/libc.so.6 Thread 12 (Thread 0x43b65940 (LWP 28535)): #0 0x0000003a5460ab99 in pthread_cond_wait@@GLIBC_2.3.2 () #1 0x00002ba988b6cdd2 in __db_pthread_mutex_lock () #2 0x00002ba988b6c426 in __db_tas_mutex_lock () #3 0x00002ba988bfcb49 in __lock_get_internal () #4 0x00002ba988bfd2c2 in __lock_get_pp () #5 0x00000000004af398 in ldap_pvt_sasl_mutex_dispose () #6 0x00000000004b04ca in ldap_pvt_sasl_mutex_dispose () #7 0x00000000004b4183 in ldap_pvt_sasl_mutex_dispose () #8 0x00000000004b802e in ldap_pvt_sasl_mutex_dispose () #9 0x0000000000481a7a in ldap_pvt_sasl_mutex_dispose () #10 0x0000000000482547 in ldap_pvt_sasl_mutex_dispose () #11 0x00000000004decab in ldap_pvt_sasl_mutex_dispose () #12 0x0000000000481b4a in ldap_pvt_sasl_mutex_dispose () #13 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #14 0x000000000043be3e in ldap_pvt_sasl_mutex_dispose () #15 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #16 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #17 0x000000000043c83f in ldap_pvt_sasl_mutex_dispose () #18 0x00000000004205a5 in ldap_pvt_sasl_mutex_dispose () #19 0x0000000000420b7f in ldap_pvt_sasl_mutex_dispose () #20 0x00002ba9886e08a8 in ldap_int_thread_pool_wrapper () #21 0x0000003a546064a7 in start_thread () from /lib64/libpthread.so.0 #22 0x0000003a53ad3c2d in clone () from /lib64/libc.so.6 Thread 11 (Thread 0x44366940 (LWP 29755)): #0 0x0000003a5460ab99 in pthread_cond_wait@@GLIBC_2.3.2 () #1 0x00002ba988b6cdd2 in __db_pthread_mutex_lock () #2 0x00002ba988b6c426 in __db_tas_mutex_lock () #3 0x00002ba988bfcb49 in __lock_get_internal () #4 0x00002ba988bfd2c2 in __lock_get_pp () #5 0x00000000004af398 in ldap_pvt_sasl_mutex_dispose () #6 0x00000000004b04ca in ldap_pvt_sasl_mutex_dispose () #7 0x0000000000492a80 in ldap_pvt_sasl_mutex_dispose () #8 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #9 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #10 0x0000000000422736 in ldap_pvt_sasl_mutex_dispose () #11 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #12 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #13 0x0000000000422ec7 in ldap_pvt_sasl_mutex_dispose () #14 0x00000000004205a5 in ldap_pvt_sasl_mutex_dispose () #15 0x0000000000420b7f in ldap_pvt_sasl_mutex_dispose () #16 0x00002ba9886e08a8 in ldap_int_thread_pool_wrapper () #17 0x0000003a546064a7 in start_thread () from /lib64/libpthread.so.0 #18 0x0000003a53ad3c2d in clone () from /lib64/libc.so.6 Thread 10 (Thread 0x44b67940 (LWP 29756)): #0 0x0000003a5460ab99 in pthread_cond_wait@@GLIBC_2.3.2 () #1 0x00002ba988b6cdd2 in __db_pthread_mutex_lock () #2 0x00002ba988b6c426 in __db_tas_mutex_lock () #3 0x00002ba988bfcb49 in __lock_get_internal () #4 0x00002ba988bfd2c2 in __lock_get_pp () #5 0x00000000004af398 in ldap_pvt_sasl_mutex_dispose () #6 0x00000000004b04ca in ldap_pvt_sasl_mutex_dispose () #7 0x00000000004b4183 in ldap_pvt_sasl_mutex_dispose () #8 0x00000000004b802e in ldap_pvt_sasl_mutex_dispose () #9 0x0000000000481a7a in ldap_pvt_sasl_mutex_dispose () #10 0x0000000000482547 in ldap_pvt_sasl_mutex_dispose () #11 0x00000000004decab in ldap_pvt_sasl_mutex_dispose () #12 0x0000000000481b4a in ldap_pvt_sasl_mutex_dispose () #13 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #14 0x000000000043be3e in ldap_pvt_sasl_mutex_dispose () #15 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #16 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #17 0x000000000043c83f in ldap_pvt_sasl_mutex_dispose () #18 0x00000000004205a5 in ldap_pvt_sasl_mutex_dispose () #19 0x0000000000420b7f in ldap_pvt_sasl_mutex_dispose () #20 0x00002ba9886e08a8 in ldap_int_thread_pool_wrapper () #21 0x0000003a546064a7 in start_thread () from /lib64/libpthread.so.0 #22 0x0000003a53ad3c2d in clone () from /lib64/libc.so.6 Thread 9 (Thread 0x45368940 (LWP 29757)): #0 0x0000003a5460ab99 in pthread_cond_wait@@GLIBC_2.3.2 () #1 0x00002ba988b6cdd2 in __db_pthread_mutex_lock () #2 0x00002ba988b6c426 in __db_tas_mutex_lock () #3 0x00002ba988bfcb49 in __lock_get_internal () #4 0x00002ba988bfd2c2 in __lock_get_pp () #5 0x00000000004af398 in ldap_pvt_sasl_mutex_dispose () #6 0x00000000004b04ca in ldap_pvt_sasl_mutex_dispose () #7 0x0000000000492a80 in ldap_pvt_sasl_mutex_dispose () #8 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #9 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #10 0x0000000000422736 in ldap_pvt_sasl_mutex_dispose () #11 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #12 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #13 0x0000000000422ec7 in ldap_pvt_sasl_mutex_dispose () #14 0x00000000004205a5 in ldap_pvt_sasl_mutex_dispose () #15 0x0000000000420b7f in ldap_pvt_sasl_mutex_dispose () #16 0x00002ba9886e08a8 in ldap_int_thread_pool_wrapper () #17 0x0000003a546064a7 in start_thread () from /lib64/libpthread.so.0 #18 0x0000003a53ad3c2d in clone () from /lib64/libc.so.6 Thread 8 (Thread 0x45b69940 (LWP 29758)): #0 0x0000003a5460ab99 in pthread_cond_wait@@GLIBC_2.3.2 () #1 0x00002ba988b6cdd2 in __db_pthread_mutex_lock () #2 0x00002ba988b6c426 in __db_tas_mutex_lock () #3 0x00002ba988bfcb49 in __lock_get_internal () #4 0x00002ba988bfd4ea in __lock_vec () #5 0x00002ba988bfe12b in __lock_vec_pp () #6 0x00000000004af514 in ldap_pvt_sasl_mutex_dispose () #7 0x00000000004af900 in ldap_pvt_sasl_mutex_dispose () #8 0x000000000048d323 in ldap_pvt_sasl_mutex_dispose () #9 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #10 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #11 0x00000000004de44d in ldap_pvt_sasl_mutex_dispose () #12 0x000000000042ee25 in ldap_pvt_sasl_mutex_dispose () #13 0x00000000004319c8 in ldap_pvt_sasl_mutex_dispose () #14 0x0000000000432749 in ldap_pvt_sasl_mutex_dispose () #15 0x00000000004ae91b in ldap_pvt_sasl_mutex_dispose () #16 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #17 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #18 0x000000000043be3e in ldap_pvt_sasl_mutex_dispose () #19 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #20 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #21 0x000000000043c83f in ldap_pvt_sasl_mutex_dispose () #22 0x00000000004205a5 in ldap_pvt_sasl_mutex_dispose () #23 0x0000000000420b7f in ldap_pvt_sasl_mutex_dispose () #24 0x00002ba9886e08a8 in ldap_int_thread_pool_wrapper () #25 0x0000003a546064a7 in start_thread () from /lib64/libpthread.so.0 #26 0x0000003a53ad3c2d in clone () from /lib64/libc.so.6 Thread 7 (Thread 0x4636a940 (LWP 29759)): #0 0x0000003a5460ab99 in pthread_cond_wait@@GLIBC_2.3.2 () #1 0x00002ba988b6cdd2 in __db_pthread_mutex_lock () #2 0x00002ba988b6c426 in __db_tas_mutex_lock () #3 0x00002ba988bfcb49 in __lock_get_internal () #4 0x00002ba988bfd2c2 in __lock_get_pp () #5 0x00000000004af398 in ldap_pvt_sasl_mutex_dispose () #6 0x00000000004b04ca in ldap_pvt_sasl_mutex_dispose () #7 0x00000000004b4183 in ldap_pvt_sasl_mutex_dispose () #8 0x00000000004b802e in ldap_pvt_sasl_mutex_dispose () #9 0x0000000000481a7a in ldap_pvt_sasl_mutex_dispose () #10 0x0000000000482547 in ldap_pvt_sasl_mutex_dispose () #11 0x00000000004decab in ldap_pvt_sasl_mutex_dispose () #12 0x0000000000481b4a in ldap_pvt_sasl_mutex_dispose () #13 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #14 0x000000000043be3e in ldap_pvt_sasl_mutex_dispose () #15 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #16 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #17 0x000000000043c83f in ldap_pvt_sasl_mutex_dispose () #18 0x00000000004205a5 in ldap_pvt_sasl_mutex_dispose () #19 0x0000000000420b7f in ldap_pvt_sasl_mutex_dispose () #20 0x00002ba9886e08a8 in ldap_int_thread_pool_wrapper () #21 0x0000003a546064a7 in start_thread () from /lib64/libpthread.so.0 #22 0x0000003a53ad3c2d in clone () from /lib64/libc.so.6 Thread 6 (Thread 0x46b6b940 (LWP 29760)): #0 0x0000003a5460ab99 in pthread_cond_wait@@GLIBC_2.3.2 () #1 0x00002ba9886df7fb in ldap_pvt_thread_rmutex_lock () #2 0x00000000004d4c74 in ldap_pvt_sasl_mutex_dispose () #3 0x0000000000481b4a in ldap_pvt_sasl_mutex_dispose () #4 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #5 0x00000000004de44d in ldap_pvt_sasl_mutex_dispose () #6 0x000000000042ee25 in ldap_pvt_sasl_mutex_dispose () #7 0x00000000004319c8 in ldap_pvt_sasl_mutex_dispose () #8 0x0000000000432749 in ldap_pvt_sasl_mutex_dispose () #9 0x00000000004ae91b in ldap_pvt_sasl_mutex_dispose () #10 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #11 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #12 0x000000000043be3e in ldap_pvt_sasl_mutex_dispose () #13 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #14 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #15 0x000000000043c83f in ldap_pvt_sasl_mutex_dispose () #16 0x00000000004205a5 in ldap_pvt_sasl_mutex_dispose () #17 0x0000000000420b7f in ldap_pvt_sasl_mutex_dispose () #18 0x00002ba9886e08a8 in ldap_int_thread_pool_wrapper () #19 0x0000003a546064a7 in start_thread () from /lib64/libpthread.so.0 #20 0x0000003a53ad3c2d in clone () from /lib64/libc.so.6 Thread 5 (Thread 0x4736c940 (LWP 29761)): #0 0x0000003a5460ab99 in pthread_cond_wait@@GLIBC_2.3.2 () #1 0x00002ba988b6cdd2 in __db_pthread_mutex_lock () #2 0x00002ba988b6c426 in __db_tas_mutex_lock () #3 0x00002ba988bfcb49 in __lock_get_internal () #4 0x00002ba988bfd2c2 in __lock_get_pp () #5 0x00000000004af398 in ldap_pvt_sasl_mutex_dispose () #6 0x00000000004b04ca in ldap_pvt_sasl_mutex_dispose () #7 0x00000000004b4183 in ldap_pvt_sasl_mutex_dispose () #8 0x00000000004b802e in ldap_pvt_sasl_mutex_dispose () #9 0x0000000000481a7a in ldap_pvt_sasl_mutex_dispose () #10 0x0000000000482547 in ldap_pvt_sasl_mutex_dispose () #11 0x00000000004decab in ldap_pvt_sasl_mutex_dispose () #12 0x0000000000481b4a in ldap_pvt_sasl_mutex_dispose () #13 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #14 0x000000000043be3e in ldap_pvt_sasl_mutex_dispose () #15 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #16 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #17 0x000000000043c83f in ldap_pvt_sasl_mutex_dispose () #18 0x00000000004205a5 in ldap_pvt_sasl_mutex_dispose () #19 0x0000000000420b7f in ldap_pvt_sasl_mutex_dispose () #20 0x00002ba9886e08a8 in ldap_int_thread_pool_wrapper () #21 0x0000003a546064a7 in start_thread () from /lib64/libpthread.so.0 #22 0x0000003a53ad3c2d in clone () from /lib64/libc.so.6 Thread 4 (Thread 0x47b6d940 (LWP 29762)): #0 0x0000003a5460ab99 in pthread_cond_wait@@GLIBC_2.3.2 () #1 0x00002ba988b6cdd2 in __db_pthread_mutex_lock () #2 0x00002ba988b6c426 in __db_tas_mutex_lock () #3 0x00002ba988bfcb49 in __lock_get_internal () #4 0x00002ba988bfd2c2 in __lock_get_pp () #5 0x00000000004af398 in ldap_pvt_sasl_mutex_dispose () #6 0x00000000004b04ca in ldap_pvt_sasl_mutex_dispose () #7 0x00000000004b4183 in ldap_pvt_sasl_mutex_dispose () #8 0x00000000004b802e in ldap_pvt_sasl_mutex_dispose () #9 0x0000000000481a7a in ldap_pvt_sasl_mutex_dispose () #10 0x0000000000482547 in ldap_pvt_sasl_mutex_dispose () #11 0x00000000004decab in ldap_pvt_sasl_mutex_dispose () #12 0x0000000000481b4a in ldap_pvt_sasl_mutex_dispose () #13 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #14 0x000000000043be3e in ldap_pvt_sasl_mutex_dispose () #15 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #16 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #17 0x000000000043c83f in ldap_pvt_sasl_mutex_dispose () #18 0x00000000004205a5 in ldap_pvt_sasl_mutex_dispose () #19 0x0000000000420b7f in ldap_pvt_sasl_mutex_dispose () #20 0x00002ba9886e08a8 in ldap_int_thread_pool_wrapper () #21 0x0000003a546064a7 in start_thread () from /lib64/libpthread.so.0 #22 0x0000003a53ad3c2d in clone () from /lib64/libc.so.6 Thread 3 (Thread 0x4836e940 (LWP 29763)): #0 0x0000003a5460ab99 in pthread_cond_wait@@GLIBC_2.3.2 () #1 0x00002ba988b6cdd2 in __db_pthread_mutex_lock () #2 0x00002ba988b6c426 in __db_tas_mutex_lock () #3 0x00002ba988bfcb49 in __lock_get_internal () #4 0x00002ba988bfd2c2 in __lock_get_pp () #5 0x00000000004af398 in ldap_pvt_sasl_mutex_dispose () #6 0x00000000004b04ca in ldap_pvt_sasl_mutex_dispose () #7 0x0000000000492a80 in ldap_pvt_sasl_mutex_dispose () #8 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #9 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #10 0x00000000004758a4 in ldap_pvt_sasl_mutex_dispose () #11 0x000000000047ce54 in ldap_pvt_sasl_mutex_dispose () #12 0x00000000004214d3 in ldap_pvt_sasl_mutex_dispose () #13 0x00002ba9886e08a8 in ldap_int_thread_pool_wrapper () #14 0x0000003a546064a7 in start_thread () from /lib64/libpthread.so.0 #15 0x0000003a53ad3c2d in clone () from /lib64/libc.so.6 Thread 2 (Thread 0x48b6f940 (LWP 29764)): #0 0x0000003a5460ab99 in pthread_cond_wait@@GLIBC_2.3.2 () #1 0x00002ba988b6cdd2 in __db_pthread_mutex_lock () #2 0x00002ba988b6c426 in __db_tas_mutex_lock () #3 0x00002ba988bfcb49 in __lock_get_internal () #4 0x00002ba988bfd2c2 in __lock_get_pp () #5 0x00000000004af398 in ldap_pvt_sasl_mutex_dispose () #6 0x00000000004b04ca in ldap_pvt_sasl_mutex_dispose () #7 0x00000000004b4183 in ldap_pvt_sasl_mutex_dispose () #8 0x00000000004b802e in ldap_pvt_sasl_mutex_dispose () #9 0x0000000000481a7a in ldap_pvt_sasl_mutex_dispose () #10 0x0000000000482547 in ldap_pvt_sasl_mutex_dispose () #11 0x00000000004decab in ldap_pvt_sasl_mutex_dispose () #12 0x0000000000481b4a in ldap_pvt_sasl_mutex_dispose () #13 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #14 0x000000000043be3e in ldap_pvt_sasl_mutex_dispose () #15 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () #16 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () #17 0x000000000043c83f in ldap_pvt_sasl_mutex_dispose () #18 0x00000000004205a5 in ldap_pvt_sasl_mutex_dispose () #19 0x0000000000420b7f in ldap_pvt_sasl_mutex_dispose () #20 0x00002ba9886e08a8 in ldap_int_thread_pool_wrapper () #21 0x0000003a546064a7 in start_thread () from /lib64/libpthread.so.0 #22 0x0000003a53ad3c2d in clone () from /lib64/libc.so.6 Thread 1 (Thread 0x2ba988eb9bd0 (LWP 28525)): #0 0x0000003a546077e5 in pthread_join () from /lib64/libpthread.so.0 #1 0x000000000041b3e2 in ldap_pvt_sasl_mutex_dispose () #2 0x000000000040960e in ldap_pvt_sasl_mutex_dispose () #3 0x0000003a53a1d994 in __libc_start_main () from /lib64/libc.so.6 #4 0x00000000004080d9 in ldap_pvt_sasl_mutex_dispose () #5 0x00007ffff6e2df58 in ?? () #6 0x0000000000000000 in ?? () I have 2 different suffixes, but didn't notice any obvious problem with the database or file system (space left, corruption, bad file owner and so on). For example, the db_stat -c gives the following result on the main database: 579 Last allocated locker ID 0x7fffffff Current maximum unused locker ID 9 Number of lock modes 10000 Maximum number of locks possible 10000 Maximum number of lockers possible 10000 Maximum number of lock objects possible 1 Number of lock object partitions 951 Number of current locks 1686 Maximum number of locks at any one time 16 Maximum number of locks in any one bucket 0 Maximum number of locks stolen by for an empty partition 0 Maximum number of locks stolen for any one partition 114 Number of current lockers 130 Maximum number of lockers at any one time 933 Number of current lock objects 1586 Maximum number of lock objects at any one time 3 Maximum number of lock objects in any one bucket 0 Maximum number of objects stolen by for an empty partition 0 Maximum number of objects stolen for any one partition 125M Total number of locks requested (125419838) 125M Total number of locks released (125418879) 0 Total number of locks upgraded 138 Total number of locks downgraded 15 Lock requests not available due to conflicts, for which we waited 0 Lock requests not available due to conflicts, for which we did not wait 0 Number of deadlocks 0 Lock timeout value 0 Number of locks that have timed out 0 Transaction timeout value 0 Number of transactions that have timed out 8MB 464KB The size of the lock region 0 The number of partition locks that required waiting (0%) 0 The maximum number of times any partition lock was waited for (0%) 0 The number of object queue operations that required waiting (0%) 0 The number of locker allocations that required waiting (0%) 45 The number of region locks that required waiting (0%) 3 Maximum hash bucket length I've also backed up the content of the /proc/28525 directory for further analysis. What else could I do ?

4 4

Documentation for backend configuration in cn=config
by Emmanuel Lesouef 08 Aug '11

08 Aug '11

Hi, I was searching for documentation about configuration of backends with openldap 2.4 (with cn=config). Are there some that are up to date ? Are there any configuration examples ? Thanks for helping. -- Emmanuel Lesouef

2 1

The difference between the meta and ldap backends
by Lars Kellogg-Stedman 07 Aug '11

07 Aug '11

Hello all, I'm been working with OpenLDAP in a metadirectory configuration -- I'm using it to provide a merged view of two organization LDAP servers, along with a local database to support "external collaborators" (that is, people not otherwise affiliated with our organization). In my limited testing it seems to be working reasonably well, but I'm not sure I completely understand all the components. For example, I'm unsure of the difference between this: database meta uri ldap://serverA.example.com/ou=A,o=organization uri ldap://serverB.example.com/ou=B,o=organization # ...necessary suffix massaging... database hdb suffix o=organization And this: database ldap subordinate suffix ou=A,o=organization uri ldap://serverA.example.com # ...rewriting... database ldap subordinate suffix ou=B,o=organization uri ldap://serverB.example.com # ...rewriting... database hdb suffix o=organization Both seem to provide the same behavior; a search against o=organization will search all three directories. Is either configuration preferable? Is one backend considered more stable than the other? is there some subtle difference in behavior that I'm missing? I'd appreciate your input. Thanks, -- Lars

2 2

custom password attribute
by Janez Barbič 06 Aug '11

06 Aug '11

Hi, I started with LDAP just recently and I successfully built and implemented a custom schema. However there is one problem. I am required to add "userPasswordAtt" attribute to my custom schema which is similar to "userPassword" attribute in "inetOrgPerson" schema. This is what I tried so far: attributetype ( 1.28.7.2011.13.1 NAME 'userPasswordAtt' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40) It is basically a copy/paste of "userPassword" attribute. objectclass ( 1.28.7.2011.1.1 NAME 'eOskrbaPerson' DESC 'e-oskrba participant' SUP top STRUCTURAL MUST ( bidAtt $ uidAtt $ cnPatient $ userPasswordAtt ) MAY ( patientCoopFlagAtt $ patientsDoctorAtt $ eMailAtt $ dateOfBirthAtt $ sexAtt $ healthcareInstitutionAtt $ memberAtt $ mobilePhoneAtt $ experimentalGroupAtt ) ) But with this attribute I can not log in to phpLDAPadmin for example. It also doesn't cover password with dots on creation as it does with "userPassword". As far as I know "userPassword" is never defined as password in any schema, I am suspecting that it has to be somehow hardcoded (I also checked inheritance which goes all the way from core.schema). So far I also tried to avoid inheriting attributes from defined schemas. How can I use my custom attribute in the same way as "inetOrgPerson->userPassword"? Some pointers for future research would be greatly appreciated. Regards, Janez Barbic

2 1

Re: Customizing organizationalUnit
by Erwann ABALEA 06 Aug '11

06 Aug '11

Le 6 août 2011 15:49, "Michael Ströder" <michael(a)stroeder.com> a écrit : > > harry.jede(a)arcor.de wrote: > > The cleanest approach is to modify your OU entries: > > > > objectClass: top > > objectClass: organizationalUnit > > objectClass: extensibleObject > > > > Now, all attributes which are defined in any schema are allowed :-) . > > That's what I consider bad advice and definitely not the cleanest approach. This is equivalent to your solutions 1 and 2, described 3 days ago.

2 2

Customizing organizationalUnit
by Derek Chen-Becker 06 Aug '11

06 Aug '11

Hello all, I'm migrating a server from an older OpenLDAP 2.1 install to 2.4.21 and I've run into a (hopefully) small issue. On our old install we had added some attributes to organizationalUnit ("mail" is really the important one) just by editing the schema files, but I can't figure out how to do the same on 2.4.21 using the LDAP interface. I found this email on the list: http://www.openldap.org/lists/openldap-technical/201106/msg00182.html But it doesn't seem to have any replies. I've been fiddling with ldapmodify but I keep on getting strange errors: root@lsmail:/etc/ldap/schema# ldapmodify -x -D cn=admin,dc=cpicorp,dc=com -W -f CPI-core.ldif Enter LDAP Password: modifying entry "cn=core,cn=schema,cn=config" ldap_modify: No such object (32) matched DN: cn=schema,cn=config Is this possible with 2.4.21, or do I need to stick with an older version of OpenLDAP? Thanks, Derek

4 6

copying a multi-master node to a standalone node
by Patrick H. 05 Aug '11

05 Aug '11

I am trying to create a duplicate of a production node that is in a multi-master replication setup to a standalone node for testing purposes. However whenever I try to make any changes to the testing database, I get the "shadow context; no update referral" error. I have removed all olcServerID attributes, set olcMirrorMode to false, removed the syncprov module and its overlay entries, and removed the olcSyncrepl attributes. But after all this its still giving the error. What am I missing here?

1 0

RE: TLS issue
by Naga Chaitanya Palle 05 Aug '11

05 Aug '11

Thanks Rosenberg for your suggestions. The issue was with wrong path mentioned for certificate files. Without commenting the TLSCipherSuite HIGH:MEDIUM:+SSLv2 line, also I could start slapd -----Original Message----- From: E.S. Rosenberg [mailto:esr@g.jct.ac.il] Sent: Thursday, August 04, 2011 10:06 PM To: Naga Chaitanya Palle Cc: openldap-technical(a)openldap.org Subject: Re: TLS issue 2011/8/4 Naga Chaitanya Palle <Naga.Chaitanya(a)aricent.com>: > Hi, > > > > I am trying to configure tls for my ldap server. > > After successfully creating the below files, I try to start the ldap server > and it fails. > > > > /etc/openldap/cacerts/cacert.pem > > /etc/openldap/cacerts/slapd-cert.pem > > /etc/openldap/cacerts/slapd-key.pem > > > > The log shows the below messages > > > > main: TLS init def ctx failed: -1 > > slapd stopped. > > connections_destroy: nothing to destry. > > > > Slapd.conf > > > > TLSCipherSuite HIGH:MEDIUM:+SSLv2 Try removing this line, if I'm not mistaken it's according to openssl syntax while openldap is (usually) compiled against gnu-tls which uses a different syntax. Also SSLv2 is generally not considered secure so unless you have some apps that cant do SSLv3 or better (TLSv1 == SSLv3.1) you should turn SSLv2 of. > > TLSCACertificateFile /etc/openldap/cacerts/cacert.pem > > TLSCertificateFile /etc/openldap/cacerts/slapd-cert.pem > > TLSCertificateKeyFile /etc/openldap/cacerts/slapd-key.pem Are your certs self-signed or from a CA? Did you make sure that the private key cert (and the other certs too?) are not stored encrypted (-nodes switch in openssl). > > > > database bdb > > suffix "dc=comverse-in,dc=com" > > rootdn "cn=Manager,dc=comverse-in,dc=com" > > rootpw {SSHA}hBlwVEbzHMzm1Wof9Lb1dA/fcuJDt6pr You may want to change your password since you have posted the hash (and also your domain) it is now possible to start brute forcing (or use rainbow tables) the hash and since the domain where this hash was used is known (and at least the LDAP username) that is a big security leak. Other than that version info and debug info (as Dan asks) is always good to provide when you have a question. Regards, Eli > > > > /etc/openldap/ldap.conf > > BASE dc=comverse-in,dc=com > > URI ldaps://devonly144.comverse-in.com > > > > TLS_CACERT /etc/openldap/cacerts/cacert.pem > > TLS_CACERTDIR /etc/openldap/cacerts > > TLS_REQCERT allow > > > > /etc/ldap.conf > > base dc=comverse-in,dc=com > > uri ldaps://devonly144.comverse-in.com > > ssl on > > > > Thanks and Regards, > > Naga chaitanya > > =============================================================================== > Please refer to http://www.aricent.com/legal/email_disclaimer.html > for important disclosures regarding this electronic communication. > =============================================================================== > =============================================================================== Please refer to http://www.aricent.com/legal/email_disclaimer.html for important disclosures regarding this electronic communication. ===============================================================================

1 0

TLS issue
by Naga Chaitanya Palle 05 Aug '11

05 Aug '11

Hi, I am trying to configure tls for my ldap server. After successfully creating the below files, I try to start the ldap server and it fails. /etc/openldap/cacerts/cacert.pem /etc/openldap/cacerts/slapd-cert.pem /etc/openldap/cacerts/slapd-key.pem The log shows the below messages main: TLS init def ctx failed: -1 slapd stopped. connections_destroy: nothing to destry. Slapd.conf TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCACertificateFile /etc/openldap/cacerts/cacert.pem TLSCertificateFile /etc/openldap/cacerts/slapd-cert.pem TLSCertificateKeyFile /etc/openldap/cacerts/slapd-key.pem database bdb suffix "dc=comverse-in,dc=com" rootdn "cn=Manager,dc=comverse-in,dc=com" rootpw {SSHA}hBlwVEbzHMzm1Wof9Lb1dA/fcuJDt6pr /etc/openldap/ldap.conf BASE dc=comverse-in,dc=com URI ldaps://devonly144.comverse-in.com TLS_CACERT /etc/openldap/cacerts/cacert.pem TLS_CACERTDIR /etc/openldap/cacerts TLS_REQCERT allow /etc/ldap.conf base dc=comverse-in,dc=com uri ldaps://devonly144.comverse-in.com ssl on Thanks and Regards, Naga chaitanya =============================================================================== Please refer to http://www.aricent.com/legal/email_disclaimer.html for important disclosures regarding this electronic communication. ===============================================================================

4 4

ldap.conf search order problem
by Michel Gruau 04 Aug '11

04 Aug '11

Hello, I have a proxy configuration with severall backend directories and one of them in TLS. I thus added the following line in ldap.conf in order to let it know the remote server server CA certificate TLS_CACERT /opt/openldap/etc/openldap/cacert.pem This is working when this line is inserted in $HOME/ldaprc or $HOME/.ldaprc but never working when inserted in the system-wide ldap configuration file (/usr/local/etc/openldap/ldap.conf). Not working neither when inserted in /opt/openldap/etc/openldap/ldap.conf (my proxy is installed in /opt/openldap). Is this a bug ? if not, what is the real ldap.conf search order ? Thanks, Michel Une messagerie gratuite, garantie à vie et des services en plus, ça vous tente ? Je crée ma boîte mail www.laposte.net

3 3

Ldap issue
by renu abraham 03 Aug '11

03 Aug '11

*Ldap issue* I tried to search using below commnad and I am getting following error ldapsearch -x -H ldap://127.0.0.1:389/ -D "cn=manager,ou=system,o=example" -w secret *error:* ldap_bind: Invalid credentials (49) *My slapd.conf contents is as below:* database bdb suffix o=example.com rootdn cn=manager,ou=system,o=example.com # Cleartext passwords, especially for the rootdn, should # be avoided. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret #rootpw {SSHA}JvA5Ovk302pb39afL2yVk9VeAeMNCZAm # rootpw {crypt}ijFYNcSNctBYg #access to * # by * write access to dn.subtree="o=example.com" by dn="cn=ldaproot,ou=system,o=example.com" write by * auth allow update_anon access to * by anonymous read # This allows the ldaproot to extract as much info as possible from the DB limits dn.exact="cn=ldaproot,ou=system,o=example.com" size=unlimited time=unlimited # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/lib/ldap # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub # logging setting loglevel none # Replicas of this database #replogfile /var/lib/ldap/openldap-master-replog #replica host=ldap-1.example.com:389 starttls=critical # bindmethod=sasl saslmech=GSSAPI # authcId=host/ldap-master.example.com(a)EXAMPLE.COM

3 2

Re: Ldap issue
by Erwann ABALEA 03 Aug '11

03 Aug '11

Le 3 août 2011 19:08, "renu abraham" <ace.renu(a)gmail.com> a écrit : > ldapsearch -x -H ldap://127.0.0.1:389/ -D "cn=manager,ou=system,o=example" -w secret Is that the real command? There's a mismatch between "o=example" here, and the declared "o=example.com" below. > suffix o=example.com > rootdn cn=manager,ou=system,o=example.com

1 0

Using SSLv2 with ldapclient.
by Friedrich Clausen 03 Aug '11

03 Aug '11

Hi, We have a check (shell script) that talks to a customer's LDAP server (over which we have no control) and only SSLv2 seems to work when using "openssl s_client -connect". I am trying to make ldapclient use SSLv2 but it does not work (Our machine is running RHEL 5.4 x86_64.). First an the OpenSSL illustration ]# openssl s_client -ssl3 -connect 10.1.2.3:636 CONNECTED(00000003) depth=3 <omitted for privacy> verify return:1 depth=2 <omitted for privacy> verify return:1 depth=1 <omitted for privacy> verify return:1 depth=0 <omitted for privacy> verify return:1 6759:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:530: # but if we use SSLv2 then it works - I am able to establish a connection and see the certificate used. I have created a small ldap client config file with the following contents TLS_REQCERT never TLS_CIPHER_SUITE SSLv2 I make sure that config is used by setting the "LDAPCONF" variable while calling ldapsearch, like so # LDAPCONF=./ldaprc ldapsearch -H ldaps://10.1.2.3:636 -x -s base -D 'CN=binder,OU=Service Accounts,OU=example ou,dc=example,dc=com' -w 'secret' -b '' -d 1 ldap_create ldap_url_parse_ext(ldaps://10.1.2.3:636) ldap_bind ldap_simple_bind ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP 10.1.2.3:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 10.1.2.3:636 ldap_connect_timeout: fd: 3 tm: -1 async: 0 TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS: can't connect. ldap_perror ldap_bind: Can't contact LDAP server (-1) # but it mysteriously fails. If I make the configuration file us SSLv3, then the following output is given (but that is expected as the server does not seem to want to speak SSLv3) - # LDAPCONF=./ldaprc ldapsearch -H ldaps://10.1.2.3:636 -x -s base -D 'CN=binder,OU=Service Accounts,OU=example ou,dc=example,dc=com' -w 'secret' -b '' -d 1 ldap_create ldap_url_parse_ext(ldaps://10.1.2.3:636) ldap_bind ldap_simple_bind ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP 10.1.2.3:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 10.1.2.3:636 ldap_connect_timeout: fd: 3 tm: -1 async: 0 TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 3, <omitted> TLS certificate verification: depth: 2, <omitted> TLS certificate verification: depth: 1, <omitted> TLS certificate verification: depth: 0, <omitted> TLS trace: SSL_connect:SSLv3 read server certificate A TLS trace: SSL_connect:SSLv3 read server certificate request A TLS trace: SSL_connect:SSLv3 read server done A TLS trace: SSL_connect:SSLv3 write client certificate A TLS trace: SSL_connect:SSLv3 write client key exchange A TLS trace: SSL_connect:SSLv3 write change cipher spec A TLS trace: SSL_connect:SSLv3 write finished A TLS trace: SSL_connect:SSLv3 flush data TLS trace: SSL_connect:failed in SSLv3 read finished A TLS: can't connect. ldap_perror ldap_bind: Can't contact LDAP server (-1) any suggestions would be much appreciated. Regards, Fred.

1 0

Problems using idassert-bind
by michel.gruau 03 Aug '11

03 Aug '11

Hello, A have a slapd-meta configuration with 6 backend directories. All of them can be accessed anonymously except One of them need that need to be accessed through a technical account. This technical must be used whatever the proxy bind DN is: - anonymous - user account - manager account (cn=Manager,dc=example,dc=com) Below is my test configuration: database meta suffix dc=example,dc=com uri ldap://remote:389/dc=example,dc=com idassert-bind bindmethod=simple binddn="uid=tech,dc=example,dc=com" credentials="password" As no anonymous access were allowed, I had to add the following line: idassert-authzFrom "dn.regex:.*" This configuration allowed me to perform an anonymous search but the technical account were not used when connecting to the remote directory (anonymous account were used instead). I then tested "mode=self" and "mode=anonymous". But I received "protocol error" from the remote server when performing an anonymous search (search using user account and search using manager account were working). I managed to make it working using "mode=none". As the technical account were still not used when connecting to the proxy with a user account, I finally add the "flag=override". This latest configuration looks good to me but I have to questions : 1/ Do you confirm that "none" is the rigth mode for my need ? 2/ Do you now why I cannot use "self" and "anonymous" ? What could be the reason why I receive the "protocol error" using mode=none and mode=self ? FYI, remote server is a Sun One DS 5.2. I don't know whether it could explain. Thank you very much for your expertise. Michel Une messagerie gratuite, garantie à vie et des services en plus, ça vous tente ? Je crée ma boîte mail www.laposte.net

1 0

Ldappasswd failure
by Naga Chaitanya Palle 03 Aug '11

03 Aug '11

Hi, I have configured a openldap2.4.25 server on RHEL5.4 and added few users to the ldap. I want to assign password to the user and I am trying it out this way, but getting Naming violation error [root@dtr98 bin]# ldappasswd -xvv -D "cn=Manager,dc=comverse-in,dc=com" -W -S "uid=cbsuser,ou=People,dc=comverse-in,dc=com" New password: Re-enter new password: ldap_initialize( <DEFAULT> ) Enter LDAP Password: Result: Naming violation (64) [root@dtr98 bin]# The user info is [root@dtr98 bin]# ldapsearch -x -LLL -s sub -b "dc=comverse-in,dc=com" "cn=cbsuser" dn: uid=cbsuser,ou=People,dc=comverse-in,dc=com cn: cbsuser objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount uidNumber: 300 [root@dtr98 bin]# Please let me know what the problem is Thanks and Regards, Naga Chaitanya =============================================================================== Please refer to http://www.aricent.com/legal/email_disclaimer.html for important disclosures regarding this electronic communication. ===============================================================================

2 2

syncrepl: consumer state is newer than provider
by Mahadevan, Venkatasubramanian 03 Aug '11

03 Aug '11

Hello, I have 2 OpenLDAP servers with the following configuration: -- OpenLDAP 2.4.26-Release running on Red Hat Enterprise 5.5 -- The two servers are setup in a mirrored multi-master configuration. Below is the relevant portion of the slapd.conf: server1 ---------- syncrepl rid=002 provider=ldaps://server2 type=refreshAndPersist retry="5 5 300 +" searchbase="o=ourdomain.ca" attrs="*,+" bindmethod=simple binddn="cn=Replication Manager,o=ubc.ca" credentials=something mirrormode TRUE overlay syncprov syncprov-checkpoint 100 10 server2 ---------- syncrepl rid=001 provider=ldaps://server1 type=refreshAndPersist retry="5 5 300 +" searchbase="o=ourdomain.ca" attrs="*,+" bindmethod=simple binddn="cn=Replication Manager,o=ubc.ca" credentials=something mirrormode TRUE overlay syncprov syncprov-checkpoint 100 10 The servers have their clocks synchronized using ntp. Below is the output of ntpq: server1 ---------- ntpq> peer remote refid st t when poll reach delay offset jitter ============================================================================== +hub.ubc.ca 93.113.2.250 3 u 594 1024 377 1.252 1.110 1.520 *dns3.ubc.ca 192.53.103.108 2 u 92 1024 377 1.648 2.670 0.157 server2 ---------- ntpq> peer remote refid st t when poll reach delay offset jitter ============================================================================== +hub.ubc.ca 93.113.2.250 3 u 332 1024 377 0.706 3.487 0.900 *dns3.ubc.ca 192.53.103.108 2 u 325 1024 377 1.631 3.668 0.022 As far as I can tell the clocks appear to be in sync with each other, so hopefully this is not a cause of the replication issues I am having. The problem is that the servers are now refusing to synchronize with each other (replication was working before) but not it does not. The log files on the servers are filled with entries like: server1 ---------- Jul 29 13:48:54 ldapdev1 slapd[11989]: do_syncrep2: rid=002 LDAP_RES_SEARCH_RESULT Jul 29 13:48:54 ldapdev1 slapd[11989]: do_syncrep2: rid=002 LDAP_RES_SEARCH_RESULT (53) Server is unwilling to perform Jul 29 13:48:54 ldapdev1 slapd[11989]: do_syncrep2: rid=002 (53) Server is unwilling to perform Jul 29 13:48:57 ldapdev1 slapd[11989]: conn=1081 op=1 SRCH base="o=ubc.ca" scope=2 deref=0 filter="(objectClass=*)" Jul 29 13:48:57 ldapdev1 slapd[11989]: conn=1081 op=1 SRCH attr=* + Jul 29 13:48:57 ldapdev1 slapd[11989]: conn=1081 op=1 SEARCH RESULT tag=101 err=53 nentries=0 text=consumer state is newer than provider! server2 ---------- Jul 29 13:50:52 ldapdev2 slapd[7996]: do_syncrep2: rid=001 LDAP_RES_SEARCH_RESULT Jul 29 13:50:52 ldapdev2 slapd[7996]: do_syncrep2: rid=001 LDAP_RES_SEARCH_RESULT (53) Server is unwilling to perform Jul 29 13:50:52 ldapdev2 slapd[7996]: do_syncrep2: rid=001 (53) Server is unwilling to perform Jul 29 13:50:55 ldapdev2 slapd[7996]: conn=1102 op=1 SRCH base="o=ubc.ca" scope=2 deref=0 filter="(objectClass=*)" Jul 29 13:50:55 ldapdev2 slapd[7996]: conn=1102 op=1 SRCH attr=* + Jul 29 13:50:55 ldapdev2 slapd[7996]: conn=1102 op=1 SEARCH RESULT tag=101 err=53 nentries=0 text=consumer state is newer than provider! So it is looking like the ContextCSN cookies on both servers are out of sync. Digging further into this, I did a search for the ContextCSN values on both servers and got the following values: server1 ---------- 20110729165747.697237Z#000000#001#000000;20110726161604.535176Z#000000#002#000000 server2 ---------- 20110728220449.050499Z#000000#001#000000;20110728223211.933995Z#000000#002#000000 So my question is: how does one get the server synchronization cookies back into sync and ensure that replication is restarted succesfully again? As of now, all I see is the log files filling up with messages as shown above and the sync cookies not being updated. Any help or pointers are appreciated. Thanks! cheers, Ven

4 5

Memory usage (ITS 6660): Is there a patch to 2.4.23 version to fix the problem ?
by Friedrich Locke 02 Aug '11

02 Aug '11

Dear list members, i am running openlda 2.4.23 and i am facing memory usage problems (ITS 6660). I am not given the option to change to 2.4.23. Is there a patch to fix this problem? Thanks once more.

4 12

SSL server certificate that has an intermediary certificate in the chain
by Francis Swasey 02 Aug '11

02 Aug '11

I have searched the faq-o-matic, google, the admin guide, and I cannot find any documentation that will allow me to set up my OpenLDAP 2.4.25 server using an SSL certificate that was issued from a CA that uses intermediate certificates (by, which I mean to indicate any commercial SSL cert company currently selling certs). Apache has the SSLCertificateChainFile directive to handle this. OpenLDAP seems to be lacking this functionality. I have tried placing both the server certificate and the intermediate certificate in the same file. OpenLDAP won't start if I put the intermediate certificate first, and openssl fails to verify the certificate chain if I put the server certificate first in the file. Have I missed something obvious or has OpenLDAP really forced me into the position of needing to add the intermediate certificate from my SSL CA Vendor into my trusted store on all my clients? -- Frank Swasey | http://www.uvm.edu/~fcs Sr Systems Administrator | Always remember: You are UNIQUE, University of Vermont | just like everyone else. "I am not young enough to know everything." - Oscar Wilde (1854-1900)

6 16

rewrite on bindDN
by Perrin, David 02 Aug '11

02 Aug '11

Hi, thank you for reading this message! I'm configuring openldap (2.4.26) as a proxy for active directory (Win 2003) and encountered some inconsistent responses to bind/search requests that may relate to a misconfiguration around an rwm mapping. Hopefully this is the right place to ask for this kind of assistance. I haven't yet been able to see what I'm missing but have spent a lot of time with slapd.conf man, slap-rwm man, and tailing logs even at loglevel -1. Here's what happens: On the console of the openldap server, I'll start the slapd service like: ./slapd -4 -n slapd-ldap -u ldap -g ldap then run an ldapsearch command to the openldap server using a bindDN that requires no rewrite, and a base that requires a rewrite. I get successful binds and search results 100% of the time. If I then run an ldapsearch where the bindDN requires a rewrite, occasionally I'll get a "bind massage" error on the console. Tailing the log file, shows a line like this: Aug 1 16:45:12 localhost slapd-ldap[19490]: conn=1001 op=0 SEARCH RESULT tag=101 err=1 nentries=0 text=00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece If I stop slapd, restart the service, and run the ldapsearch where the bindDN requires a rewrite, I'll only get errors. Then if I do an ldapsearch with a bindDN that doesn't need a rewrite (which always binds and searches successfully), subsequent ldapsearch bind/search attempts with a bindDN that requires a rewrite will succeed most of the time. Below I've included some shell interaction and log output (loglevel 256 for brevity), non-comment lines from my slapd.conf, and other configuration details. Any suggestions for how I could debug this further or glaring mistakes would be greatly appreciated. Humbly yours, Dave # Start openldap Aug 1 16:38:42 localhost slapd-ldap[19426]: @(#) $OpenLDAP: slapd 2.4.26 (Jul 29 2011 14:11:30) $#012#011dave@localhost.localdomain:/usr/src/openldap-2.4.26/servers/sla pd Aug 1 16:38:42 localhost slapd-ldap[19427]: slapd starting # bind and search that requires no rewrite on bind but a rewrite on base (ou=App Auth 1 -> ou=Students) - this always works /opt/openldap/proxy/bin/ldapsearch -b "ou=App Auth 1,dc=TEST_STUDENT,dc=TEST_EDU" -D "CN=Addott\, Steven (saddott),ou=Students,DC=TEST_STUDENT,DC=TEST_EDU" -w "saddott" -x "(mail=sadd*)" name Aug 1 16:40:01 localhost slapd-ldap[19427]: conn=1001 fd=8 ACCEPT from IP=127.0.0.1:36499 (IP=0.0.0.0:389) Aug 1 16:40:01 localhost slapd-ldap[19427]: conn=1001 op=0 BIND dn="cn=Addott\2C Steven (saddott),ou=Students,dc=TEST_STUDENT,dc=TEST_EDU" method=128 Aug 1 16:40:01 localhost slapd-ldap[19427]: conn=1001 op=0 BIND dn="cn=Addott\2C Steven (saddott),ou=Students,dc=TEST_STUDENT,dc=TEST_EDU" mech=SIMPLE ssf=0 Aug 1 16:40:01 localhost slapd-ldap[19427]: conn=1001 op=0 RESULT tag=97 err=0 text= Aug 1 16:40:01 localhost slapd-ldap[19427]: conn=1001 op=1 SRCH base="ou=App Auth 1,dc=TEST_STUDENT,dc=TEST_EDU" scope=2 deref=0 filter="(mail=sadd*)" Aug 1 16:40:01 localhost slapd-ldap[19427]: conn=1001 op=1 SRCH attr=name Aug 1 16:40:01 localhost slapd-ldap[19427]: conn=1001 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Aug 1 16:40:01 localhost slapd-ldap[19427]: conn=1001 op=2 UNBIND Aug 1 16:40:01 localhost slapd-ldap[19427]: conn=1001 fd=8 closed # success! this comes back in the console: # extended LDIF # # LDAPv3 # base <ou=App Auth 1,dc=TEST_STUDENT,dc=TEST_EDU> with scope subtree # filter: (mail=sadd*) # requesting: name # # Addott\2C Steven (saddott), Students, TEST_STUDENT.TEST_EDU dn: cn=Addott\2C Steven (saddott),ou=Students,dc=TEST_STUDENT,dc=TEST_EDU name: Addott, Steven (saddott) # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 # now search and bind requiring a search base rewrite and bind rewrite (mail -> cn) /opt/openldap/proxy/bin/ldapsearch -b "ou=App Auth 1,dc=TEST_STUDENT,dc=TEST_EDU" -D "mail=saddott(a)localhost.localdomain,ou=Students,DC=TEST_STUDENT,DC=TEST_ EDU" -w "saddott" -x "(mail=sadd*)" name Aug 1 16:40:59 localhost slapd-ldap[19427]: conn=1002 fd=8 ACCEPT from IP=127.0.0.1:36502 (IP=0.0.0.0:389) Aug 1 16:40:59 localhost slapd-ldap[19427]: conn=1002 op=0 BIND dn="mail=saddott(a)localhost.localdomain,ou=Students,dc=TEST_STUDENT,dc=TE ST_EDU" method=128 Aug 1 16:40:59 localhost slapd-ldap[19427]: conn=1003 fd=12 ACCEPT from IP=127.0.0.1:36503 (IP=0.0.0.0:389) Aug 1 16:40:59 localhost slapd-ldap[19427]: conn=1003 op=0 SRCH base="ou=Students,dc=TEST_STUDENT,dc=TEST_EDU" scope=2 deref=0 filter="(mail=saddott(a)localhost.localdomain)" Aug 1 16:40:59 localhost slapd-ldap[19427]: conn=1003 op=0 SRCH attr=1.1 Aug 1 16:40:59 localhost slapd-ldap[19427]: conn=1003 op=0 SEARCH RESULT tag=101 err=0 nentries=1 text= Aug 1 16:40:59 localhost slapd-ldap[19427]: conn=1003 op=1 UNBIND Aug 1 16:40:59 localhost slapd-ldap[19427]: conn=1003 fd=12 closed Aug 1 16:40:59 localhost slapd-ldap[19427]: conn=1002 op=0 BIND dn="cn=Addott\2C Steven (saddott),ou=Students,dc=TEST_STUDENT,dc=TEST_EDU" mech=SIMPLE ssf=0 Aug 1 16:40:59 localhost slapd-ldap[19427]: conn=1002 op=0 RESULT tag=97 err=0 text= Aug 1 16:40:59 localhost slapd-ldap[19427]: conn=1002 op=1 SRCH base="ou=App Auth 1,dc=TEST_STUDENT,dc=TEST_EDU" scope=2 deref=0 filter="(mail=sadd*)" Aug 1 16:40:59 localhost slapd-ldap[19427]: conn=1002 op=1 SRCH attr=name Aug 1 16:40:59 localhost slapd-ldap[19427]: conn=1002 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Aug 1 16:40:59 localhost slapd-ldap[19427]: conn=1002 op=2 UNBIND Aug 1 16:40:59 localhost slapd-ldap[19427]: conn=1002 fd=8 closed # and again, success! this comes back # extended LDIF # # LDAPv3 # base <ou=App Auth 1,dc=TEST_STUDENT,dc=TEST_EDU> with scope subtree # filter: (mail=sadd*) # requesting: name # # Addott\2C Steven (saddott), Students, TEST_STUDENT.TEST_EDU dn: cn=Addott\2C Steven (saddott),ou=Students # restarting the service Aug 1 16:44:54 localhost slapd-ldap[19427]: daemon: shutdown requested and initiated. Aug 1 16:44:54 localhost slapd-ldap[19427]: slapd shutdown: waiting for 0 operations/tasks to finish Aug 1 16:44:54 localhost slapd-ldap[19427]: slapd stopped. Aug 1 16:45:02 localhost slapd-ldap[19489]: @(#) $OpenLDAP: slapd 2.4.26 (Jul 29 2011 14:11:30) $#012#011dave@localhost.localdomain:/usr/src/openldap-2.4.26/servers/sla pd Aug 1 16:45:02 localhost slapd-ldap[19490]: slapd starting # here's where I get a failure, attempting to bind where the bind requires a rewrite # same request as above but this time I'm doing it right after a service restart [root@localhost openldap]# /opt/openldap/proxy/bin/ldapsearch -b "ou=App Auth 1,dc=TEST_STUDENT,dc=TEST_EDU" -D "mail=saddott(a)localhost.localdomain,ou=Students,DC=TEST_STUDENT,DC=TEST_ EDU" -w "saddott" -x "(mail=sadd*)" name ldap_bind: Other (e.g., implementation specific) error (80) additional info: bindDN massage error .. log file shows Aug 1 16:45:12 localhost slapd-ldap[19490]: conn=1000 fd=8 ACCEPT from IP=127.0.0.1:46174 (IP=0.0.0.0:389) Aug 1 16:45:12 localhost slapd-ldap[19490]: conn=1000 op=0 BIND dn="mail=saddott(a)localhost.localdomain,ou=Students,dc=TEST_STUDENT,dc=TE ST_EDU" method=128 Aug 1 16:45:12 localhost slapd-ldap[19490]: conn=1001 fd=10 ACCEPT from IP=127.0.0.1:46175 (IP=0.0.0.0:389) Aug 1 16:45:12 localhost slapd-ldap[19490]: conn=1001 op=0 SRCH base="ou=Students,dc=TEST_STUDENT,dc=TEST_EDU" scope=2 deref=0 filter="(mail=saddott(a)localhost.localdomain)" Aug 1 16:45:12 localhost slapd-ldap[19490]: conn=1001 op=0 SRCH attr=1.1 Aug 1 16:45:12 localhost slapd-ldap[19490]: ==> rewrite_context_apply error ... Aug 1 16:45:12 localhost slapd-ldap[19490]: conn=1000 op=0 RESULT tag=97 err=80 text=bindDN massage error Aug 1 16:45:12 localhost slapd-ldap[19490]: conn=1001 op=0 SEARCH RESULT tag=101 err=1 nentries=0 text=00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece Aug 1 16:45:12 localhost slapd-ldap[19490]: conn=1000 fd=8 closed (connection lost) Aug 1 16:45:12 localhost slapd-ldap[19490]: conn=1001 op=1 UNBIND Aug 1 16:45:12 localhost slapd-ldap[19490]: conn=1001 fd=10 closed Now back to the request that required no bind rewrite [root@localhost openldap]# /opt/openldap/proxy/bin/ldapsearch -b "ou=App Auth 1,dc=TEST_STUDENT,dc=TEST_EDU" -D "CN=Addott\, Steven (saddott),ou=Students,DC=TEST_STUDENT,DC=TEST_EDU" -w "saddott" -x "(mail=sadd*)" name # extended LDIF # # LDAPv3 # base <ou=App Auth 1,dc=TEST_STUDENT,dc=TEST_EDU> with scope subtree # filter: (mail=sadd*) # requesting: name # # Addott\2C Steven (saddott), Students, TEST_STUDENT.TEST_EDU dn: cn=Addott\2C Steven (saddott),ou=Students,dc=TEST_STUDENT,dc=TEST_EDU name: Addott, Steven (saddott) # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Aug 1 16:45:47 localhost slapd-ldap[19490]: conn=1002 fd=8 ACCEPT from IP=127.0.0.1:46177 (IP=0.0.0.0:389) Aug 1 16:45:47 localhost slapd-ldap[19490]: conn=1002 op=0 BIND dn="cn=Addott\2C Steven (saddott),ou=Students,dc=TEST_STUDENT,dc=TEST_EDU" method=128 Aug 1 16:45:47 localhost slapd-ldap[19490]: conn=1002 op=0 BIND dn="cn=Addott\2C Steven (saddott),ou=Students,dc=TEST_STUDENT,dc=TEST_EDU" mech=SIMPLE ssf=0 Aug 1 16:45:47 localhost slapd-ldap[19490]: conn=1002 op=0 RESULT tag=97 err=0 text= Aug 1 16:45:47 localhost slapd-ldap[19490]: conn=1002 op=1 SRCH base="ou=App Auth 1,dc=TEST_STUDENT,dc=TEST_EDU" scope=2 deref=0 filter="(mail=sadd*)" Aug 1 16:45:47 localhost slapd-ldap[19490]: conn=1002 op=1 SRCH attr=name Aug 1 16:45:47 localhost slapd-ldap[19490]: conn=1002 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Aug 1 16:45:47 localhost slapd-ldap[19490]: conn=1002 op=2 UNBIND Aug 1 16:45:47 localhost slapd-ldap[19490]: conn=1002 fd=8 closed and searching again with the bindDN requiring a map rewrite - this time it failed [root@localhost openldap]# /opt/openldap/proxy/bin/ldapsearch -b "ou=App Auth 1,dc=TEST_STUDENT,dc=TEST_KSC" -D "mail=saddott(a)localhost.localdomain,ou=Students,DC=TEST_STUDENT,DC=TEST_ EDU" -w "saddott" -x "(mail=sadd*)" name ldap_bind: Other (e.g., implementation specific) error (80) additional info: bindDN massage error Aug 1 16:45:56 localhost slapd-ldap[19490]: conn=1003 fd=8 ACCEPT from IP=127.0.0.1:46180 (IP=0.0.0.0:389) Aug 1 16:45:56 localhost slapd-ldap[19490]: conn=1003 op=0 BIND dn="mail=saddott(a)localhost.localdomain,ou=Students,dc=TEST_STUDENT,dc=TE ST_EDU" method=128 Aug 1 16:45:56 localhost slapd-ldap[19490]: conn=1004 fd=13 ACCEPT from IP=127.0.0.1:46181 (IP=0.0.0.0:389) Aug 1 16:45:56 localhost slapd-ldap[19490]: conn=1004 op=0 SRCH base="ou=Students,dc=TEST_STUDENT,dc=TEST_EDU" scope=2 deref=0 filter="(mail=saddott(a)localhost.localdomain)" Aug 1 16:45:56 localhost slapd-ldap[19490]: conn=1004 op=0 SRCH attr=1.1 Aug 1 16:45:56 localhost slapd-ldap[19490]: conn=1004 op=0 SEARCH RESULT tag=101 err=1 nentries=0 text=00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece Aug 1 16:45:56 localhost slapd-ldap[19490]: conn=1004 op=1 UNBIND Aug 1 16:45:56 localhost slapd-ldap[19490]: conn=1004 fd=13 closed Aug 1 16:45:56 localhost slapd-ldap[19490]: ==> rewrite_context_apply error ... Aug 1 16:45:56 localhost slapd-ldap[19490]: conn=1003 op=0 RESULT tag=97 err=80 text=bindDN massage error Aug 1 16:45:56 localhost slapd-ldap[19490]: conn=1003 fd=8 closed (connection lost) I tried the same ldapsearch command again and this time it succeeded Aug 1 16:46:12 localhost slapd-ldap[19490]: conn=1005 fd=8 ACCEPT from IP=127.0.0.1:46182 (IP=0.0.0.0:389) Aug 1 16:46:12 localhost slapd-ldap[19490]: conn=1005 op=0 BIND dn="mail=saddott(a)localhost.localdomain,ou=Students,dc=TEST_STUDENT,dc=TE ST_EDU" method=128 Aug 1 16:46:12 localhost slapd-ldap[19490]: conn=1006 fd=13 ACCEPT from IP=127.0.0.1:46183 (IP=0.0.0.0:389) Aug 1 16:46:12 localhost slapd-ldap[19490]: conn=1006 op=0 SRCH base="ou=Students,dc=TEST_STUDENT,dc=TEST_EDU" scope=2 deref=0 filter="(mail=saddott(a)localhost.localdomain)" Aug 1 16:46:12 localhost slapd-ldap[19490]: conn=1006 op=0 SRCH attr=1.1 Aug 1 16:46:12 localhost slapd-ldap[19490]: conn=1006 op=0 SEARCH RESULT tag=101 err=0 nentries=1 text= Aug 1 16:46:12 localhost slapd-ldap[19490]: conn=1006 op=1 UNBIND Aug 1 16:46:12 localhost slapd-ldap[19490]: conn=1006 fd=13 closed Aug 1 16:46:12 localhost slapd-ldap[19490]: conn=1005 op=0 BIND dn="cn=Addott\2C Steven (saddott),ou=Students,dc=TEST_STUDENT,dc=TEST_EDU" mech=SIMPLE ssf=0 Aug 1 16:46:12 localhost slapd-ldap[19490]: conn=1005 op=0 RESULT tag=97 err=0 text= Aug 1 16:46:12 localhost slapd-ldap[19490]: conn=1005 op=1 SRCH base="ou=App Auth 1,dc=TEST_STUDENT,dc=TEST_EDU" scope=2 deref=0 filter="(mail=sadd*)" Aug 1 16:46:12 localhost slapd-ldap[19490]: conn=1005 op=1 SRCH attr=name Aug 1 16:46:12 localhost slapd-ldap[19490]: conn=1005 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Aug 1 16:46:12 localhost slapd-ldap[19490]: conn=1005 op=2 UNBIND Aug 1 16:46:12 localhost slapd-ldap[19490]: conn=1005 fd=8 closed AD is running on a VM openldap-2.4.26 was configured on a Fedora 15 (2.6.38.8-35.fc15.i686) VM with: ./configure --prefix=/opt/openldap/proxy --enable-ldap --enable-rewrite --enable-rwm --enable-memberof --with-tls=no non-comment lines from my slapd.conf look like: include /opt/openldap/proxy/etc/openldap/schema/core.schema include /opt/openldap/proxy/etc/openldap/schema/cosine.schema include /opt/openldap/proxy/etc/openldap/schema/inetorgperson.schema # schema to add sAMAccountName include /opt/openldap/proxy/etc/openldap/schema/myorg.schema pidfile /opt/openldap/proxy/var/run/slapd.pid argsfile /opt/openldap/proxy/var/run/slapd.args moduleload rwm.la ####################################################################### # BDB database definitions ####################################################################### database ldap suffix "dc=TEST_STUDENT,dc=TEST_EDU" uri "ldap://..." # ... is the ip of my AD host acl-bind bindmethod=simple binddn="cn=serviceuser,cn=Users,dc=TEST_STUDENT,dc=TEST_EDU" credentials="pwd" idassert-bind bindmethod=simple binddn="cn=serviceuser,cn=Users,dc=TEST_STUDENT,dc=TEST_EDU" credentials="pwd" authzID="dn:cn=serviceuser,cn=Users,dc=TEST_STUDENT,dc=TEST_EDU" loglevel 256 # much of this was borrowed from slapo-rwm man page overlay rwm rwm-rewriteEngine on # all dataflow from client to server referring to DNs rwm-rewriteContext default rwm-rewriteRule "(.+,)?<virtualnamingcontext>$" "$1<realnamingcontext>" ":" # empty filter rwm-rewriteContext searchFilter # from server to client rwm-rewriteContext searchEntryDN rwm-rewriteRule "(.+,)?<realnamingcontext>$" "$1<virtualnamingcontext>" ":" rwm-rewriteContext searchAttrDN alias searchEntryDN rwm-rewriteContext matchedDN alias searchEntryDN # misc empty rules rwm-rewriteContext referralAttrDN rwm-rewriteContext referralDN # define default rewrite for virtual of anything # ou=App Auth 1 -> ou=Students rwm-rewriteContext searchDN rwm-rewriteRule "(.+)?ou=App Auth 1,dc=TEST_STUDENT,dc=TEST_EDU$" "$1ou=Students,dc=TEST_STUDENT,dc=TEST_EDU" ":" # bind map from source rwm-rewriteMap ldap source2dn "ldap:///ou=Students,dc=TEST_STUDENT,dc=TEST_EDU?dn?sub" rwm-rewriteContext bindDN rwm-rewriteRule "^mail=([^,]*),ou=Students,dc=TEST_STUDENT,dc=TEST_EDU" "${source2dn(mail=$1)}" ":"

1 0

openldap 2.4.15 with error
by deconya 02 Aug '11

02 Aug '11

HI Im using openldap database with samba and Im with the database broken with this message Aug 2 11:20:43 earth slapd[4145]: slap_client_connect: URI=ldap://earth.esci.es DN="cn=admin,dc=esci,dc=es" ldap_sasl_bind_s failed (80) Aug 2 11:20:43 earth slapd[4145]: do_syncrepl: rid=005 retrying (1 retries left) Aug 2 11:20:43 earth slapd[4145]: slap_client_connect: URI=ldap://moon.esci.es DN="cn=admin,dc=esci,dc=es" ldap_sasl_bind_s failed (-1) Aug 2 11:20:43 earth slapd[4145]: do_syncrepl: rid=008 retrying (4 retries left) Aug 2 11:20:43 earth slapd[4145]: slap_client_connect: URI=ldap://moon.esci.es DN="cn=admin,cn=config" ldap_sasl_bind_s failed (-1) Aug 2 11:20:43 earth slapd[4145]: do_syncrepl: rid=004 retrying (4 retries left) Aug 2 11:20:43 earth slapd[4145]: bdb(dc=esci,dc=es): PANIC: fatal region error detected; run recovery Aug 2 11:20:43 earth last message repeated 9 times Aug 2 11:20:43 earth slapd[4145]: null_callback : error code 0x50 Aug 2 11:20:43 earth slapd[4145]: syncrepl_entry: rid=007 be_add failed (80) Aug 2 11:20:43 earth slapd[4145]: do_syncrepl: rid=007 retrying (4 retries left) Aug 2 11:20:45 earth slapd[4145]: bdb(dc=esci,dc=es): PANIC: fatal region error detected; run recovery Aug 2 11:20:48 earth last message repeated 9 times Aug 2 11:20:48 earth slapd[4145]: slap_client_connect: URI=ldap://earth.esci.es DN="cn=admin,dc=esci,dc=es" ldap_sasl_bind_s failed (80) Aug 2 11:20:48 earth slapd[4145]: do_syncrepl: rid=005 retrying Aug 2 11:20:48 earth slapd[4145]: bdb(dc=esci,dc=es): PANIC: fatal region error detected; run recovery Really I don't know how to repair and all information speaks to use db_recovery but inside ubuntu I dont' know how to install this commands. For example. http://sdb.open-xchange.com/node/29 It's some important to recover this databse because has information without backup and never has problems. Any help will be appreciate Thanks

2 1

chaining and referral object with two referrals
by Andreas Haubod 31 Jul '11

31 Jul '11

Hello, I use the overlay "chain" on one Server (lets call "global-ldap-01.site." ). How does the overlay chain behave, if it get an referral object with two referrals: dn: ou=finance,dc=mycomapny,dc=com objectClass: referral objectClass: extensibleObject ref: ldap://ldap-01-p.site/ou=finance, dc=mycomapny,dc=com ref: ldap://ldap-01-s.site/ou=finance, dc=mycomapny,dc=com This referral is in the DIT from the global-ldap-01 database, but refers to other ldap-servers. (ldap-01-p and ldap-01-s are configured as N-Way multi-master and located in different data centers) The objective is, that I can shut down one server (or if one Server fails) and the system is running without "bigger" disruption. If I turn off the ldap-01-p, ldap-01-s will be used from the global-ldap-01 So that works fine. If the ldap-01-p comes back, the global-ldap-01 use it again automatically. But if the Server ldap-01-p is down a longer time and I turn on this server, it has to replicate with the running ldap-01-s first. Can I control or configure this preemption and behavior? Thank and kindly regards Meike

1 0

Re: SlapD is using more CPU
by Édnei 31 Jul '11

31 Jul '11

Hello, sorry for the message delayed. So, how many clients you have in this server ? On 28-07-2011 05:28, arun.sasi1(a)wipro.com wrote: > > Hi, > > Below are the latest unexpected service outage log > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3273 op=2 SEARCH > RESULT tag=101 err=32 nentries=0 text= > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3276 fd=36 ACCEPT > from IP=134.32.44.37:60341 (IP=0.0.0.0:389) > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3276 op=0 BIND > dn="cn=admin,dc=emb,dc=slb,dc=com" method=128 > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3276 op=0 BIND > dn="cn=admin,dc=emb,dc=slb,dc=com" mech=SIMPLE ssf=0 > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3276 op=0 RESULT > tag=97 err=0 text= > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3276 op=1 SRCH > base="dc=emb,dc=slb,dc=com" scope=2 deref=0 > filter="(&(objectClass=posixAccount)(uidNumber=470649))" > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3276 op=1 SRCH > attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell > gecos description objectClass > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3276 op=1 SEARCH > RESULT tag=101 err=0 nentries=1 text= > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3262 op=8 SRCH > base="ou=Groups,dc=emb,dc=slb,dc=com" scope=2 deref=0 > filter="(&(objectClass=sambaGroupMapping)(sambaSID=s-1-1-0))" > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3262 op=8 SRCH > attr=gidNumber sambaSID sambaGroupType sambaSIDList description > displayName cn objectClass > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3262 op=8 SEARCH > RESULT tag=101 err=0 nentries=0 text= > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3273 op=3 SRCH > base="ou=Groups,dc=emb,dc=slb,dc=com" scope=2 deref=0 > filter="(&(objectClass=sambaGroupMapping)(gidNumber=65534))" > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3273 op=3 SRCH > attr=gidNumber sambaSID sambaGroupType sambaSIDList description > displayName cn objectClass > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3273 op=3 SEARCH > RESULT tag=101 err=0 nentries=0 text= > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3260 op=3 SRCH > base="ou=Groups,dc=emb,dc=slb,dc=com" scope=2 deref=0 > filter="(&(objectClass=sambaGroupMapping)(gidNumber=65534))" > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3260 op=3 SRCH > attr=gidNumber sambaSID sambaGroupType sambaSIDList description > displayName cn objectClass > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3260 op=3 SEARCH > RESULT tag=101 err=0 nentries=0 text= > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3262 op=9 SRCH > base="ou=Groups,dc=emb,dc=slb,dc=com" scope=2 deref=0 > filter="(&(objectClass=sambaGroupMapping)(sambaSID=s-1-5-2))" > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3262 op=9 SRCH > attr=gidNumber sambaSID sambaGroupType sambaSIDList description > displayName cn objectClass > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3262 op=9 SEARCH > RESULT tag=101 err=0 nentries=0 text= > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3276 fd=36 closed > (connection lost) > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: daemon: shutdown > requested and initiated. > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3173 fd=19 closed > (slapd shutdown) > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=4 fd=21 closed > (slapd shutdown) > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=0 fd=22 closed > (slapd shutdown) > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=1 fd=23 closed > (slapd shutdown) > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3230 fd=24 closed > (slapd shutdown) > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=6 fd=25 closed > (slapd shutdown) > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=805 fd=26 closed > (slapd shutdown) > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3223 fd=27 closed > (slapd shutdown) > > Jul 28 08:05:02 gb0135embldap01 slapd[23254]: conn=3246 fd=28 closed > (slapd shutdown) > > Thanks, > > -Arun > > *From:*Arun Sasi V (WI01 - Manage IT) > *Sent:* Tuesday, July 26, 2011 9:39 AM > *To:* 'Édnei' > *Subject:* RE: SlapD is using more CPU > > Hi, > > I can show you the settings by live meeting session... there we can > chat or can call too... > > Can I have your number and also let me know your convenient time to > share the session... > > Thanks, > > -Arun > > *From:*Arun Sasi V (WI01 - Manage IT) > *Sent:* Tuesday, July 26, 2011 9:16 AM > *To:* 'Édnei' > *Cc:* openldap-technical(a)openldap.org > *Subject:* RE: SlapD is using more CPU > > Fyi... > > Thanks, > > -Arun > > *From:*Édnei [mailto:ednei.felipe.rodrigues@gmail.com] > *Sent:* Tuesday, July 26, 2011 2:11 AM > *To:* Arun Sasi V (WI01 - Manage IT) > *Cc:* openldap-technical(a)openldap.org > *Subject:* Re: SlapD is using more CPU > > Hello. > Do you show us the settings ? > On 25-07-2011 04:54, arun.sasi1(a)wipro.com > <mailto:arun.sasi1@wipro.com> wrote: > > Hello Team, > > Whenever the number of search increase to the master server... slapd > is utilizing more about more than 100%... What could be the reason and > also is there any bench mark defined... > > Whenver it goes 100% slapd server is getting stopped... > > Thanks & Regards, > > *Arun Sasi V* > > *Please do not print this email unless it is absolutely necessary. * > > The information contained in this electronic message and any > attachments to this message are intended for the exclusive use of the > addressee(s) and may contain proprietary, confidential or privileged > information. If you are not the intended recipient, you should not > disseminate, distribute or copy this e-mail. Please notify the sender > immediately and destroy all copies of this message and any attachments. > > WARNING: Computer viruses can be transmitted via email. The recipient > should check this email and any attachments for the presence of > viruses. The company accepts no liability for any damage caused by any > virus transmitted by this email. > > www.wipro.com <http://www.wipro.com> > > *Please do not print this email unless it is absolutely necessary. * > > The information contained in this electronic message and any > attachments to this message are intended for the exclusive use of the > addressee(s) and may contain proprietary, confidential or privileged > information. If you are not the intended recipient, you should not > disseminate, distribute or copy this e-mail. Please notify the sender > immediately and destroy all copies of this message and any attachments. > > WARNING: Computer viruses can be transmitted via email. The recipient > should check this email and any attachments for the presence of > viruses. The company accepts no liability for any damage caused by any > virus transmitted by this email. > > www.wipro.com >

2 2

sudo via ldap
by Tim Dunphy 31 Jul '11

31 Jul '11

Hello list! I have configured an ldap server to include the sudo schema. In my slapd.conf file i have the following entry in my schemas section: include /usr/local/etc/openldap/schema/sudo.schema On my one test client I have the following ldap.conf: host 127.0.0.1 base dc=summitnjhome,dc=com sudoers_base ou=sudoers,ou=Services,dc=summitnjhome,dc=com binddn cn=pam_ldap,ou=services,dc=summitnjhome,dc=com bindpw secret scope sub pam_password exop nss_base_passwd ou=staff,dc=summitnjhome,dc=com nss_base_shadow ou=staff,dc=summitnjhome,dc=com And in my nsswitch I have the following entry: sudoers: ldap I can authenticate and search through the pam_ldap account as well as anonymously. I have my user account setup in the directory this way: # summitnjhome.com dn: dc=summitnjhome,dc=com dc: summitnjhome objectClass: dcObject objectClass: organization o: Summit NJ Home # staff, summitnjhome.com dn: ou=staff,dc=summitnjhome,dc=com ou: staff objectClass: organizationalUnit # sudoers, Services, summitnjhome.com dn: ou=sudoers,ou=Services,dc=summitnjhome,dc=com ou: sudoers objectClass: organizationalUnit objectClass: top # defaults, sudoers, Services, summitnjhome.com dn: cn=defaults,ou=sudoers,ou=Services,dc=summitnjhome,dc=com objectClass: top objectClass: sudoRole cn: defaults description: Default sudoOption's go here # %summitnjops, sudoers, Services, summitnjhome.com dn: cn=%summitnjops,ou=sudoers,ou=Services,dc=summitnjhome,dc=com objectClass: top objectClass: sudoRole cn: %summitnjops sudoHost: ALL sudoRunAsUser: ALL sudoCommand: ALL sudoOption: !authenticate sudoUser: %summitnjops sudoUser: bluethundr # bluethundr, summitnjops, staff, summitnjhome.com dn: uid=bluethundr,ou=summitnjops,ou=staff,dc=summitnjhome,dc=com uid: bluethundr cn: Timothy P. Dunphy givenName: Timothy P. sn: Dude mail: bluethundr(a)example.com mailRoutingAddress: bluethundr(a)mail.example.com mailHost: mail.summitnjhome.com objectClass: inetLocalMailRecipient objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: top userPassword:: e0NSWVBUfWNySmg3NGtXbHRXeVE= uidNumber: 1001 gidNumber: 1002 homeDirectory: /home/bluethundr gecos: Timothy P. loginShell: /bin/bash But when I attempt to sudo from the user account, the ladap server searches the correct DN but does not find the user account from what I can tell, tho I am still trying to get the hang of parsing ldap log files: [bluethundr@LBSD2:/usr/home/bluethundr]$sudo -i Password: bluethundr is not in the sudoers file. This incident will be reported. >From the log: Jul 30 22:02:30 LBSD2 slapd[95958]: conn=349346 op=1 SRCH base="ou=sudoers,ou=Services,dc=summitnjhome,dc=com" scope=2 deref=0 filter="(cn=defaults)" I was hoping I could get some advice on how to perhaps adjust either the directory structure or the ldap query so that the sudo user can be found. I'm including my slapd.conf file, dump of the directory (named snjh.ldif) and more complete logs in hopes that someone out there can help track down the solution to the problem. The log file is basically a snapshot in time of the event when I try to log in as the sudo user. Thanks in advance! Tim

1 0

Re: Memory usage (ITS 6660): Is there a patch to 2.4.23 version to fix the problem ?
by Friedrich Locke 30 Jul '11

30 Jul '11

On Sat, Jul 30, 2011 at 6:31 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Saturday, July 30, 2011 6:23 PM -0300 Friedrich Locke > <friedrich.locke(a)gmail.com> wrote: > > Please don't top post. > Sorry. > >> It is not that's using 63MB. It is that is uses 63MB after performing >> 4 lookup, i.e., its memory usage grows from 15MB to 63MB. > > >> cachesize 4096 > > How many entries do you have in your database? > No more than 50 entries at most. >> dbnosync >> dirtyread > > These are *not* good values to set. You should remove them. I will remove then. > > You have failed to provide some key pieces of information. Please provide > your DB_CONFIG file. Please provide the total size of your BDB database (du > -c -h *.bdb). Please provide the number of real cores your system has > available. ITS6660 *only* affects systems with 4+ CPUs. All I've seen you > say so far is that as slapd is used, it grows in size. That's typical of > slapd loading entries from off of disk into memory. Unless we know how > large your database itself *is*, there is no telling if what it is doing is > wrong or not. My DB_CONFIG is: set_cachesize 0 16777216 1 set_lg_regionmax 262144 set_lg_bsize 2097152 My database size is: gustav# du -c -h *.bdb 32.0K cn.bdb 32.0K dn2id.bdb 64.0K id2entry.bdb 32.0K mail.bdb 32.0K mailAlternateAddress.bdb 32.0K mailHost.bdb 32.0K objectClass.bdb 32.0K uid.bdb 288K total gustav# My system has 2 cores! > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

Re: Memory usage (ITS 6660): Is there a patch to 2.4.23 version to fix the problem ?
by Friedrich Locke 30 Jul '11

30 Jul '11

It is not that's using 63MB. It is that is uses 63MB after performing 4 lookup, i.e., its memory usage grows from 15MB to 63MB. If i try more ldap lookup (15 in total), it goes to 425 MB of usage. I tried to limit data usage via unix resource control (/etc/login.conf, yes, i am using openbsd). The process (slapd) die after reaching the limit for data memory usage. Here is my configuration (/etc/openldap/slapd.conf) # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/qmail.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /var/run/oldap/slapd.pid argsfile /var/run/oldap/slapd.args database bdb #suffix "dc=my-domain,dc=com" suffix "dc=ufv,dc=br" #rootdn "cn=Manager,dc=my-domain,dc=com" rootdn "cn=oldap,dc=ufv,dc=br" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. #rootpw secret rootpw {SSHA}HBjSmSCbiE8J26EuDg3ULnSj2SmN1x5g # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /var/openldap-data # Indices to maintain index cn eq index objectClass eq index mail,mailalternateaddress,uid eq,sub index accountstatus,mailhost,deliverymode eq index default eq cachesize 4096 checkpoint 128 15 dbnosync dirtyread sasl-host gustav.cpd.ufv.br sasl-realm UFV.BR sasl-regexp uid=([^,]+),cn=UFV.BR,cn=gssapi,cn=auth uid=$1,ou=people,dc=ufv,dc=br limits dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" time=2048 size=16384 limits dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" time=2048 size=16384 limits dn.onelevel="ou=people,dc=ufv,dc=br" time=4 size=1 access to dn.one="ou=appsrv,dc=ufv,dc=br" attrs=userpassword by self read by anonymous auth # by * none access to dn.one="ou=appsrv,dc=ufv,dc=br" by self read # by * none access to dn.one="ou=people,dc=ufv,dc=br" attrs=userpassword by self read by anonymous auth # by * none access to dn.one="ou=people,dc=ufv,dc=br" attrs=objectclass by self read by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" search by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read # by * none access to dn.one="ou=people,dc=ufv,dc=br" attrs=homedirectory by self read by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read # by * none access to dn.one="ou=people,dc=ufv,dc=br" attrs=entry,uid by self read by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read # by * none access to dn.one="ou=people,dc=ufv,dc=br" attrs=cn,uidnumber,gidnumber,loginshell,gecos,description by self read by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read # by * none access to dn.one="ou=people,dc=ufv,dc=br" attrs=mail,mailalternateaddress,qmailuid,qmailgid,mailmessagestore,mailquotasize,mailquotacount,mailsizemax,mailforwardingaddress,deliveryprogrampath,mailhost,deliverymode,mailreplytext,qmaildotmode,accountstatus,qmailaccountpurge by self read by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read # by * none access to dn.one="ou=people,dc=ufv,dc=br" by self read # by * none access to dn.base="ou=people,dc=ufv,dc=br" attrs=entry by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read # by * none access to dn.base="dc=ufv,dc=br" attrs=entry by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read # by * none access to dn.one="ou=group,dc=ufv,dc=br" by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read # by * none access to dn.base="ou=group,dc=ufv,dc=br" attrs=entry by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read # by * none ####################################################################### # Monitor database definitions ####################################################################### database monitor access to dn.subtree="cn=monitor" by dn.base="cn=oldap,dc=ufv,dc=br" read # by * none =============== END OF CONFIGURATION ==================== On Sat, Jul 30, 2011 at 4:10 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Friday, July 29, 2011 12:51 PM -0300 Friedrich Locke > <friedrich.locke(a)gmail.com> wrote: > >> Dear list members, >> >> i am running openlda 2.4.23 and i am facing memory usage problems (ITS >> 6660). I am not given the option to change to 2.4.23. >> Is there a patch to fix this problem? > > Given your stated database size, I sincerely doubt you are hitting the issue > in ITS6660. You also fail to note any of your configuration settings. I > personally don't see a slapd size of 63MB particularly large. Does it > continually grow, or does it stay steady at 63MB? > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

3 2

Re: invalid syntax when teletexstring
by Erwann ABALEA 30 Jul '11

30 Jul '11

First, sorry for having placed this thread in private, that was unintentional (maybe I should reconsider using a "reply to all" by default). Group added. 2011/7/29 Howard Chu <hyc(a)symas.com>: > Erwann ABALEA wrote: [...] >> In fact, I know such a CA that was generated some months ago, with a >> very large audience, and whose certificates are to be stored in an >> LDAP structure. Czech Republic passport CA certificate. If you want to >> know how it's used, and by who, we can talk about it in private, or >> you can look at www.icao.int, search for Doc9303 documents, PKD >> structure, etc. (In fact, I didn't know of this limitation, and I'll >> look forward its impact in integrating the Czech certificates in the >> OpenLDAP structures we sell and deploy). >> I agree that UTF8String would have been a much better choice, but >> X.509 doesn't prevent the use of T61String. >> In the meantime, some products still don't support UTF8String in >> certificates, a Novell proxy product (I don't remember its exact name) >> is an example I encountered recently. > > If that's the case, what solutions do you propose? We could accept T61String > if it only uses characters that are present in 7-bit ASCII of course. But > once you venture into 8-bit and extended/accented characters all bets are > off. I'll need to grab this CA certificate back. I was asked to give my opinion on whether it was to be considered valid or not. Despite the fact that T61String is clearly deprecated in RFC5280/3280/2459, and that ICAO has chosen to base their certificate profile on RFC3280 (a bad choice), asking for a country to change its root CA cert signing all its passports because that doesn't follow rules I personally don't adhere to is difficult and counterproductive. I wasn't the only one to have this idea, and it was accepted. I'm 99% sure 7 bits didn't suffice. The remaining 1% will be fixed as soon as I find the certificate. Do you have any document or pointer to understand the task of converting to/from T.61, and incompatible character sets you talked about? I Googled for this, but I'm not sure of what I found (what I found reminds me of old character sets we used many years ago in France for the Minitel, with G1/G2 character groups, etc, not that far from VT consoles). The ICAO group or PKD Board could ask the Czechs to produce X.509 certificates with UTF8String encoding for the issuerName's fields, it's perfectly valid by X.520 rules (as long as the content is semantically identical, differently encoded strings are equal, as you know), but that's asking for implementors to produce completely compliant code. And such code will have to be clearly written by dozens of staffs in the world, and used by autonomous devices reading passports, etc. A big bet. Given what I see in different countries' certificates, we're far from this. I'll try to take a look tomorrow. -- Erwann.

3 10

OpenLDAP Stable?
by Friedrich Locke 30 Jul '11

30 Jul '11

I am running the lastest openldap version considered stable, AFAIK: 2.4.23. But it has simple problems about memory usage (ITS 6660). How may openldap project consider such release as a stable version? Thanks in advance.

2 1

invalid syntax when teletexstring
by Vangelis Karatsiolis 30 Jul '11

30 Jul '11

Hi, while trying to store an attribute with syntax DistinguishedName containing a TeletexString on an OpenLDAP 2.4.23 there are errors in the normalization process and the attribute cannot be stored due to invalid syntax (21). A certificate containing such a subjectDN is also not possible to be stored. Is it possible to deactivate this in this version of OpenLDAP, for example through configuration or during the compilation? Best Regards Vangelis

5 7

Version
by Friedrich Locke 29 Jul '11

29 Jul '11

hi folks, i just wonder what are the most common versions of openldap you have running on production systems right now. Thanks in advance.

2 1

OpenLDAP configuration
by Andreas Laesser 29 Jul '11

29 Jul '11

Hi @all I've some questions regarding the "new" config interface from LDAP cn=config. For one month I was trying to set up a MultiMaster configuration with GSSAPI-auth (Kerb5) over TLS/SSL for three servers. I tried many ways to create a config with the cn=config interface but I failed every time. Now my question: Is there a tutorial or howto which describes exactly my problem? Or does anybody run a bunch of server in this configuration? Thanks a lot for your help, regards Andreas -- ========================================================================= _____________ / ___________/ Andreas Laesser / //_// /____/ Signal Proc.& Speech Communication Lab. __/ /___/ / __ Graz University of Technology /___//____//__ Inffeldgasse 12 | A-8010 Graz | Austria http://www.spsc.tugraz.at Tel: +43 (0)316 873 -4443 Fax: DW 104439 =========================================================================

5 5

OpenLDAP is using lots of memory
by Friedrich Locke 28 Jul '11

28 Jul '11

Hi folks, i have installed qmail-ldap and everything is going fine. The only problem i am seeing is that slapd is using too much memory. I have a small scenario: 20 user account, 15 group all "inside" slapd. The problem happens when local email is delivered. I take the following approach: First i disable qmail: # svc -d qmail Then i send 10 email to a local user: # echo to: localuser@localdomain | /var/qmail/bin/qmail-inject Than i monitor slapd process with "top" on another shell. I sent 10 email for a local user. # echo to: localuser@localdomain | /var/qmail/bin/qmail-inject Then i turn on qmail # svc -u qmail Now, top's column "SIZE" goes from 13MB to 63MB Is that correct? it gives 5 MB per connection from qmail to openldap! What am i doing wrong ? Thanks in advance for your time and cooperation. Best regards, Fried.

1 0

RE: SlapD is using more CPU
by Maucci, Cyrille 28 Jul '11

28 Jul '11

Dear Arun, >> And also I just want to know why my ldap service are getting stopped.... What do you mean? Do you mean the ldap unix process disappears ? If so, did you enable core dumps to be written (ulimit -c) ? Do you get a core file ? I would not expect slapd to simply 'exit'. Thanks ++Cyrille ________________________________ From: arun.sasi1(a)wipro.com [mailto:arun.sasi1@wipro.com] Sent: Monday, July 25, 2011 2:45 PM To: Maucci, Cyrille; openldap-technical(a)openldap.org Subject: RE: SlapD is using more CPU Dear Cyrille, I am using Ubuntu 9.04 OS (Configured in VM), and OpenLdap OpenLDAP: slapd 2.4.15... I have configured Multi-Master setup here... i.e two location servers will act as multimaster and remaining 7 locations are act as slave servers(read only copy). Each location sync with master ldap and fetch the update from master Ldap (syncrepl)... My infra the number of users are accessing the LDAP more on Sundays hence Ldap server is utilizing more cpu on those days and getting hang... Please find the attached some report which I took from Ldap server. I have increased my cache size.. will it cause to high CPU ...? And also I just want to know why my ldap service are getting stopped.... Thanks, -Arun From: Maucci, Cyrille [mailto:cyrille.maucci@hp.com] Sent: Monday, July 25, 2011 5:59 PM To: Arun Sasi V (WI01 - Manage IT); openldap-technical(a)openldap.org Subject: RE: SlapD is using more CPU Hello Arun Sasi, are you saying you are surprised by the fact that the more LDAP search the more CPU consumption ? ( ! ). I must have misunderstood your statement. Since slapd is multi-threaded, I've myself pushed slapd to much more than 100% CPU. So what do you mean by 'slapd is getting stopped' ? Do you mean the process vanishes ? Does it leave a baby core file around there ? If so, you should probably send the back trace. ++Cyrille ________________________________ From: openldap-technical-bounces(a)OpenLDAP.org [mailto:openldap-technical-bounces@OpenLDAP.org] On Behalf Of arun.sasi1(a)wipro.com Sent: Monday, July 25, 2011 9:55 AM To: openldap-technical(a)openldap.org Subject: SlapD is using more CPU Hello Team, Whenever the number of search increase to the master server... slapd is utilizing more about more than 100%... What could be the reason and also is there any bench mark defined... Whenver it goes 100% slapd server is getting stopped... Thanks & Regards, Arun Sasi V Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

3 5

slapd memory consumption
by Friedrich Locke 28 Jul '11

28 Jul '11

I have openldap running ok. But when i run "top" i see slapd using 315MB in the column "SIZE". The only software using slapd is qmail-ldap i installed. Does anbody know what may be happening ? How to diagnose this problem? Thanks in advance. Fried.

1 0

Installing
by Dalen, van William 28 Jul '11

28 Jul '11

Hi, When i want to install OpenLDAP i began with install the deamon and utils with the command sudo apt-get install slapd ldap-utils I got an error. This is the output: Preconfiguring packages ... Unquoted string "pm" may clash with future reserved word at /usr/share/perl5/Deb conf/Element/Noninteractive/Boolean.pm line 5, <GEN1> line 1. Can't locate object method "new" via package "Debconf::Element::Noninteractive:: Boolean" (perhaps you forgot to load "Debconf::Element::Noninteractive::Boolean" ?) at /usr/share/perl5/Debconf/FrontEnd.pm line 68, <GEN1> line 1. (Reading database ... 52208 files and directories currently installed.) Unpacking slapd (from .../slapd_2.4.23-6ubuntu6_amd64.deb) ... Unquoted string "pm" may clash with future reserved word at /usr/share/perl5/Deb conf/Element/Noninteractive/Boolean.pm line 5, <GEN1> line 2. Can't locate object method "new" via package "Debconf::Element::Noninteractive:: Boolean" (perhaps you forgot to load "Debconf::Element::Noninteractive::Boolean" ?) at /usr/share/perl5/Debconf/FrontEnd.pm line 68, <GEN1> line 2. dpkg: error processing /var/cache/apt/archives/slapd_2.4.23-6ubuntu6_amd64.deb ( --unpack): subprocess new pre-installation script returned error exit status 9 Errors were encountered while processing: /var/cache/apt/archives/slapd_2.4.23-6ubuntu6_amd64.deb E: Sub-process /usr/bin/dpkg returned an error code (1) I am a newbie to Linux and OpenLAP. I don't know what this output means, so i can't solve the problem (for now). Please can anyone help me? With regards, William

3 2

cn=config configuration method
by Giles Coochey 28 Jul '11

28 Jul '11

I'm trying to get my head round configuring OpenLDAP 2.4 until Centos 6. So much documentation refers to slapd.conf Under Centos 6, it appears that cn=config is in use. So is reconfiguring OpenLDAP simply a case of editing the .ldif files in /etc/openldap/slapd.d Or should I be modifying the directory to reconfigure - presumably by some combination of slapadd etc... Thanks Giles

3 3

after restart slapd server I cannot search single record in ldap servers
by Marcin Więcek 28 Jul '11

28 Jul '11

Hello, I set up an slapd with slapd-meta backend. I have two Active Directory servers which don't share any portion of naming context. I would like to get one virtual domain. I configure it and it works fine until I restart slapd server. When I restart slapd server then I am unable to search in my ldap servers single record. When I search one single record (samAccountName=testdom1) then I have got 0 result. root@slapd:~# ldapsearch -b 'dc=dom,dc=com' -h 172.30.14.190 -p 389 -D 'cn=Manager,dc=dom,dc=com' -w secret '(samAccountName=testdom1)' # extended LDIF # # LDAPv3 # base <dc=dom,dc=com> with scope subtree # filter: (samAccountName=testdom1) # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 root@slapd:~# In the log (full debug) I have: Jul 27 16:12:17 dom slapd[12096]: daemon: read active on 9 Jul 27 16:12:17 dom slapd[12096]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Jul 27 16:12:17 dom slapd[12096]: daemon: epoll: listen=8 active_threads=0 tvp=NULL Jul 27 16:12:17 dom slapd[12096]: connection_get(9) Jul 27 16:12:17 dom slapd[12096]: connection_get(9): got connid=1000 Jul 27 16:12:17 dom slapd[12096]: connection_read(9): checking for input on id=1000 Jul 27 16:12:17 dom slapd[12096]: op tag 0x42, time 1311775937 Jul 27 16:12:17 dom slapd[12096]: ber_get_next on fd 9 failed errno=0 (Success) Jul 27 16:12:17 dom slapd[12096]: connection_read(9): input error=-2 id=1000, closing. Jul 27 16:12:17 dom slapd[12096]: connection_closing: readying conn=1000 sd=9 for close Jul 27 16:12:17 dom slapd[12096]: connection_close: deferring conn=1000 sd=9 Jul 27 16:12:17 dom slapd[12096]: conn=1000 op=2 do_unbind Jul 27 16:12:17 dom slapd[12096]: conn=1000 op=2 UNBIND Jul 27 16:12:17 dom slapd[12096]: connection_resched: attempting closing conn=1000 sd=9 Jul 27 16:12:17 dom slapd[12096]: connection_close: deferring conn=1000 sd=9 Jul 27 16:12:17 dom slapd[12096]: daemon: activity on 1 descriptor Jul 27 16:12:17 dom slapd[12096]: daemon: activity on: Jul 27 16:12:17 dom slapd[12096]: Jul 27 16:12:17 dom slapd[12096]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Jul 27 16:12:17 dom slapd[12096]: daemon: epoll: listen=8 active_threads=0 tvp=NULL Jul 27 16:12:17 dom slapd[12096]: conn=1000 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= Jul 27 16:12:17 dom slapd[12096]: connection_resched: attempting closing conn=1000 sd=9 Jul 27 16:12:17 dom slapd[12096]: connection_close: conn=1000 sd=9 Jul 27 16:12:17 dom slapd[12096]: =>meta_back_conn_destroy: fetching conn=1000 DN="cn=manager,dc=dom,dc=com" Jul 27 16:12:17 dom slapd[12096]: daemon: removing 9 Jul 27 16:12:17 dom slapd[12096]: conn=1000 fd=9 closed Then when I search full list of record (samAccountName=*) I have got full list of records from two ldap servers. root@slapd:~# ldapsearch -b 'dc=dom,dc=com' -h 172.30.14.190 -p 389 -D 'cn=Manager,dc=dom,dc=com' -w secret '(samAccountName=*)' # search result search: 2 result: 0 Success # numResponses: 39 # numEntries: 38 root@slapd:~# And this is the trick. From now... When I again search one single record I got correct result - until I restart slapd server again. I don't know what can be wrong. Any ideas? root@slapd:~# ldapsearch -b 'dc=dom,dc=com' -h 172.30.14.190 -p 389 -D 'cn=Manager,dc=dom,dc=com' -w secret '(samAccountName=testdom1)' # extended LDIF # # LDAPv3 # base <dc=dom,dc=com> with scope subtree # filter: (samAccountName=testdom1) # requesting: ALL # # testdom1, dom.com dn: cn=testdom1,dc=dom,dc=com objectClass: top objectClass: person objectClass: organizationalPerson objectClass: USER cn: testdom1 givenName: testdom1 distinguishedName: cn=testdom1,dc=dom,dc=com INSTANCETYPE: 4 WHENCREATED: 20110726100434.0Z WHENCHANGED: 20110726160313.0Z DISPLAYNAME: testdom1 USNCREATED: 24630 USNCHANGED: 24756 name: testdom1 OBJECTGUID:: +ERwSjOp5Uex1n86v5CurA== USERACCOUNTCONTROL: 66048 BADPWDCOUNT: 0 CODEPAGE: 0 COUNTRYCODE: 0 BADPASSWORDTIME: 129561692315625000 LASTLOGOFF: 0 LASTLOGON: 129561692402968750 PWDLASTSET: 129561697935781250 PRIMARYGROUPID: 513 OBJECTSID:: AQUAAAAAAAUVAAAAMkafw9OC5FYbZ2/5UwQAAA== ACCOUNTEXPIRES: 9223372036854775807 LOGONCOUNT: 0 SAMACCOUNTNAME: testdom1 SAMACCOUNTTYPE: 805306368 USERPRINCIPALNAME: testdom1(a)dom1.com OBJECTCATEGORY: CN=Person,CN=Schema,CN=Configuration,DC=dom1,DC=com # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 root@slapd:~# The log: Jul 27 16:19:22 dom slapd[12096]: => access_allowed: read access to "cn=testdom1,dc=dom,dc=com" "BADPWDCOUNT" requested Jul 27 16:19:22 dom slapd[12096]: <= root access granted Jul 27 16:19:22 dom slapd[12096]: => access_allowed: read access granted by manage(=mwrscxd) Jul 27 16:19:22 dom slapd[12096]: => access_allowed: result not in cache (CODEPAGE) Jul 27 16:19:22 dom slapd[12096]: => access_allowed: read access to "cn=testdom1,dc=dom,dc=com" "CODEPAGE" requested Jul 27 16:19:22 dom slapd[12096]: <= root access granted Jul 27 16:19:22 dom slapd[12096]: => access_allowed: read access granted by manage(=mwrscxd) Jul 27 16:19:22 dom slapd[12096]: => access_allowed: result not in cache (COUNTRYCODE) Jul 27 16:19:22 dom slapd[12096]: => access_allowed: read access to "cn=testdom1,dc=dom,dc=com" "COUNTRYCODE" requested Jul 27 16:19:22 dom slapd[12096]: <= root access granted Jul 27 16:19:22 dom slapd[12096]: => access_allowed: read access granted by manage(=mwrscxd) Jul 27 16:19:22 dom slapd[12096]: => access_allowed: result not in cache (BADPASSWORDTIME) Jul 27 16:19:22 dom slapd[12096]: => access_allowed: read access to "cn=testdom1,dc=dom,dc=com" "BADPASSWORDTIME" requested Jul 27 16:19:22 dom slapd[12096]: <= root access granted Jul 27 16:19:22 dom slapd[12096]: => access_allowed: read access granted by manage(=mwrscxd) Jul 27 16:19:22 dom slapd[12096]: => access_allowed: result not in cache (LASTLOGOFF) Jul 27 16:19:22 dom slapd[12096]: => access_allowed: read access to "cn=testdom1,dc=dom,dc=com" "LASTLOGOFF" requested Jul 27 16:19:22 dom slapd[12096]: <= root access granted Jul 27 16:19:22 dom slapd[12096]: => access_allowed: read access granted by manage(=mwrscxd) Jul 27 16:19:22 dom slapd[12096]: => access_allowed: result not in cache (LASTLOGON) Jul 27 16:19:22 dom slapd[12096]: => access_allowed: read access to "cn=testdom1,dc=dom,dc=com" "LASTLOGON" requested Jul 27 16:19:22 dom slapd[12096]: <= root access granted Jul 27 16:19:22 dom slapd[12096]: => access_allowed: read access granted by manage(=mwrscxd) Jul 27 16:19:22 dom slapd[12096]: => access_allowed: result not in cache (PWDLASTSET) Jul 27 16:19:22 dom slapd[12096]: => access_allowed: read access to "cn=testdom1,dc=dom,dc=com" "PWDLASTSET" requested Jul 27 16:19:22 dom slapd[12096]: <= root access granted Jul 27 16:19:22 dom slapd[12096]: => access_allowed: read access granted by manage(=mwrscxd) Jul 27 16:19:22 dom slapd[12096]: => access_allowed: result not in cache (PRIMARYGROUPID) Jul 27 16:19:22 dom slapd[12096]: => access_allowed: read access to "cn=testdom1,dc=dom,dc=com" "PRIMARYGROUPID" requested Jul 27 16:19:22 dom slapd[12096]: <= root access granted Jul 27 16:19:22 dom slapd[12096]: => access_allowed: read access granted by manage(=mwrscxd) Jul 27 16:19:22 dom slapd[12096]: => access_allowed: result not in cache (OBJECTSID) Jul 27 16:19:22 dom slapd[12096]: => access_allowed: read access to "cn=testdom1,dc=dom,dc=com" "OBJECTSID" requested Jul 27 16:19:22 dom slapd[12096]: <= root access granted Jul 27 16:19:22 dom slapd[12096]: => access_allowed: read access granted by manage(=mwrscxd) Jul 27 16:19:22 dom slapd[12096]: => access_allowed: result not in cache (ACCOUNTEXPIRES) Jul 27 16:19:22 dom slapd[12096]: => access_allowed: read access to "cn=testdom1,dc=dom,dc=com" "ACCOUNTEXPIRES" requested Jul 27 16:19:22 dom slapd[12096]: <= root access granted Jul 27 16:19:22 dom slapd[12096]: => access_allowed: read access granted by manage(=mwrscxd) Jul 27 16:19:22 dom slapd[12096]: => access_allowed: result not in cache (LOGONCOUNT) Jul 27 16:19:22 dom slapd[12096]: => access_allowed: read access to "cn=testdom1,dc=dom,dc=com" "LOGONCOUNT" requested Jul 27 16:19:22 dom slapd[12096]: <= root access granted Jul 27 16:19:22 dom slapd[12096]: => access_allowed: read access granted by manage(=mwrscxd) Jul 27 16:19:22 dom slapd[12096]: => access_allowed: result not in cache (SAMACCOUNTNAME) Jul 27 16:19:22 dom slapd[12096]: => access_allowed: read access to "cn=testdom1,dc=dom,dc=com" "SAMACCOUNTNAME" requested Jul 27 16:19:22 dom slapd[12096]: <= root access granted Jul 27 16:19:22 dom slapd[12096]: => access_allowed: read access granted by manage(=mwrscxd) Jul 27 16:19:22 dom slapd[12096]: => access_allowed: result not in cache (SAMACCOUNTTYPE) Jul 27 16:19:22 dom slapd[12096]: => access_allowed: read access to "cn=testdom1,dc=dom,dc=com" "SAMACCOUNTTYPE" requested Jul 27 16:19:22 dom slapd[12096]: <= root access granted Jul 27 16:19:22 dom slapd[12096]: => access_allowed: read access granted by manage(=mwrscxd) Jul 27 16:19:22 dom slapd[12096]: => access_allowed: result not in cache (USERPRINCIPALNAME) Jul 27 16:19:22 dom slapd[12096]: => access_allowed: read access to "cn=testdom1,dc=dom,dc=com" "USERPRINCIPALNAME" requested Jul 27 16:19:22 dom slapd[12096]: <= root access granted Jul 27 16:19:22 dom slapd[12096]: => access_allowed: read access granted by manage(=mwrscxd) Jul 27 16:19:22 dom slapd[12096]: => access_allowed: result not in cache (OBJECTCATEGORY) Jul 27 16:19:22 dom slapd[12096]: => access_allowed: read access to "cn=testdom1,dc=dom,dc=com" "OBJECTCATEGORY" requested Jul 27 16:19:22 dom slapd[12096]: <= root access granted Jul 27 16:19:22 dom slapd[12096]: => access_allowed: read access granted by manage(=mwrscxd) Jul 27 16:19:22 dom slapd[12096]: conn=1003 op=1 ENTRY dn="cn=testdom1,dc=dom,dc=com" Jul 27 16:19:22 dom slapd[12096]: <= send_search_entry: conn 1003 exit. Jul 27 16:19:22 dom slapd[12096]: send_ldap_result: conn=1003 op=1 p=3 Jul 27 16:19:22 dom slapd[12096]: send_ldap_result: err=0 matched="" text="" Jul 27 16:19:22 dom slapd[12096]: send_ldap_response: msgid=2 tag=101 err=0 Jul 27 16:19:22 dom slapd[12096]: conn=1003 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= Jul 27 16:19:22 dom slapd[12096]: daemon: activity on 1 descriptor Jul 27 16:19:22 dom slapd[12096]: daemon: activity on: Jul 27 16:19:22 dom slapd[12096]: 9r Jul 27 16:19:22 dom slapd[12096]: Jul 27 16:19:22 dom slapd[12096]: daemon: read active on 9 Jul 27 16:19:22 dom slapd[12096]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Jul 27 16:19:22 dom slapd[12096]: daemon: epoll: listen=8 active_threads=0 tvp=NULL Jul 27 16:19:22 dom slapd[12096]: connection_get(9) Jul 27 16:19:22 dom slapd[12096]: connection_get(9): got connid=1003 Jul 27 16:19:22 dom slapd[12096]: connection_read(9): checking for input on id=1003 Jul 27 16:19:22 dom slapd[12096]: op tag 0x42, time 1311776362 Jul 27 16:19:22 dom slapd[12096]: ber_get_next on fd 9 failed errno=0 (Success) Jul 27 16:19:22 dom slapd[12096]: connection_read(9): input error=-2 id=1003, closing. Jul 27 16:19:22 dom slapd[12096]: connection_closing: readying conn=1003 sd=9 for close Jul 27 16:19:22 dom slapd[12096]: connection_close: deferring conn=1003 sd=9 Jul 27 16:19:22 dom slapd[12096]: conn=1003 op=2 do_unbind Jul 27 16:19:22 dom slapd[12096]: conn=1003 op=2 UNBIND Jul 27 16:19:22 dom slapd[12096]: connection_resched: attempting closing conn=1003 sd=9 Jul 27 16:19:22 dom slapd[12096]: connection_close: deferring conn=1003 sd=9 Jul 27 16:19:22 dom slapd[12096]: daemon: activity on 1 descriptor Jul 27 16:19:22 dom slapd[12096]: daemon: activity on: Jul 27 16:19:22 dom slapd[12096]: Jul 27 16:19:22 dom slapd[12096]: daemon: epoll: listen=7 active_threads=0 tvp=NULL Jul 27 16:19:22 dom slapd[12096]: daemon: epoll: listen=8 active_threads=0 tvp=NULL Jul 27 16:19:22 dom slapd[12096]: connection_resched: attempting closing conn=1003 sd=9 Jul 27 16:19:22 dom slapd[12096]: connection_close: conn=1003 sd=9 Jul 27 16:19:22 dom slapd[12096]: =>meta_back_conn_destroy: fetching conn=1003 DN="cn=manager,dc=dom,dc=com" Jul 27 16:19:22 dom slapd[12096]: daemon: removing 9 Jul 27 16:19:22 dom slapd[12096]: conn=1003 fd=9 closed My OpenLDAP version: root@slapd:~# slapd -V @(#) $OpenLDAP: slapd 2.4.23 (Jul 26 2011 14:53:23) $ root@slapd:/root/openldap-2.4.23/servers/slapd My slapd.conf: root@slapd:~# cat /usr/local/etc/openldap/slapd.conf # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args # Load dynamic backend modules: # modulepath /usr/local/libexec/openldap # moduleload back_bdb.la # moduleload back_hdb.la # moduleload back_ldap.la loglevel 0xFFFF access to * by * read ####################################################################### # database definitions ####################################################################### database meta suffix "dc=dom,dc=com" rootdn "cn=Manager,dc=dom,dc=com" rootpw secret chase-referrals no #nretries forever nretries 3 # 1 sec timeout for binds bind-timeout 1000000 #norefs true dncache-ttl DISABLED conn-ttl 90 idle-timeout 1m30s onerr CONTINUE # ldap1 uri "ldap://dc1.dom1.com:389/dc=dom,dc=com" suffixmassage "dc=dom,dc=com" "cn=Users,dc=dom1,dc=com" idassert-bind bindmethod=simple binddn="cn=LDAPconnector,cn=Users,dc=dom1,dc=com" credentials="pass" mode=none flags=non-prescriptive # ldap2 uri "ldap://dc2.dom2.com:389/dc=dom,dc=com" suffixmassage "dc=dom,dc=com" "cn=Users,dc=dom2,dc=com" idassert-bind bindmethod=simple binddn="cn=LDAPconnector2,cn=Users,dc=dom2,dc=com" credentials="pass" mode=none flags=non-prescriptive root@slapd:~# King regards, Marcin

2 1

Excessive logging at stats loglevel: any useful alternative to none?
by Nick Urbanik 28 Jul '11

28 Jul '11

Dear Folks, We are running openldap-servers-2.3.43-12.el5_6.7 on CentOS 5 on four HP blades. We have only stats loglevel: grep level /etc/openldap/slapd.conf loglevel stats ...but these servers are rather busy, and the logfiles are massive: # ls -lSr | tail -n4 -rw------- 1 root root 7160148590 Jul 28 10:48 ldap -rw------- 1 root root 24102619198 Jul 26 04:02 ldap.3 -rw------- 1 root root 25034865261 Jul 27 04:02 ldap.2 -rw------- 1 root root 25504838803 Jul 28 04:02 ldap.1 and are threatening to fill the disk. We want *some* logging, but we don't want too much. Can anyone suggest a useful log level here? It would be great to have some control over the verbosity of logging of each subsystem; for example, we cannot log any information about syncrepl, as that would totally fill our disks. -- Nick Urbanik http://nicku.org 808-71011 nick.urbanik(a)optusnet.com.au GPG: 7FFA CDC7 5A77 0558 DC7A 790A 16DF EC5B BB9D 2C24 ID: BB9D2C24 I disclaim, therefore I am.

1 1

Translucent overlay
by Conger,Keith 25 Jul '11

25 Jul '11

Hi List Members I'm using OpenLDAP in a translucent overlay configuration to store the attributes for our custom schema. All other attributes come from the backend LDAP server(ActiveDirectory). When I try to modify an attribute that is stored on the backend LDAP Server(ActiveDirectory), the change is stored in the translucent overlays database and not written to the backend LDAP server(ActiveDirectory). Is it possible for a client connected to OpenLDAP to modify an attribute in the backend LDAP server(ActiveDirectory)? The attribute I'm mainly concerned with is "unicodePwd" which Active Directory uses for password storage. If this isn't possible, does anyone have a different approach I'm missing? Background: Were creating a password reset web app that I'd like to only communicate to OpenLDAP. OpenLDAP will store of password question/answer along with some other identity verification data, but the password needs to be set within Active Directory since there are Desktops authenticating users. Thanks for any help -- Keith Conger Enterprise Systems Administrator Onondaga Community College 4585 West Seneca Turnpike Syracuse, N.Y. 13215-4585 Phone: 315.498.2767 Email/JID: congerk(a)sunyocc.edu Web: http://myhome.sunyocc.edu/~congerk/

1 0

client LDAP configuration issue
by Christophe Thibault 25 Jul '11

25 Jul '11

Hello, I'm currently encountering a weird issue I don't understand. I'm working on this problem since 3 days now, withount any clue. My problem: I built a sample client that connect to a LDAP server, to test authentication. It works fine for LDAP, but fails for LDAPS, as long as I don't provide the right certs. The issue is that I tried setting the TLS_CACERT in different locations without success (I tried in the system /etc/ldap/ldap.conf, custom location by setting the LDAPCONF env variable, setting environment variable LDAPTLS_CACERT, etc.) What is weird (for me) is that using the same ldap.conf (global or user), or environment variable works for the ldapsearch client that comes witth the openldap distribution. More strange, is that setting the TLS_REQCERT parameter (either in ldap.conf or in an environment variable) works for my custom client. In my client, displaying I probably missed something, do I need to explicitely call some function to initialize these parameters? Is there any way to trace calls to these internal functions that should read the ldap.conf or environment variables? Any idead is welcome! thanks, chris

2 1

SASL Pass-through password reset
by Conger,Keith 25 Jul '11

25 Jul '11

Hi, Does anyone know if its possible to reset a password when using OpenLDAP with SASL pass-through to an 2008 Active Directory either through GSSAPI or LDAPS. I've read that you you can change a password, but we need to be able to reset with an administrative level account when a user forgets their password. Thanks in Advance, Keith -- Keith Conger

1 0

SlapD is using more CPU
by arun.sasi1＠wipro.com 25 Jul '11

25 Jul '11

Hello Team, Whenever the number of search increase to the master server... slapd is utilizing more about more than 100%... What could be the reason and also is there any bench mark defined... Whenver it goes 100% slapd server is getting stopped... Thanks & Regards, Arun Sasi V Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

3 2

Active Directory OpenLDAP Proxy
by Marc Schöchlin 25 Jul '11

25 Jul '11

Hello OpenLDAP Users, i setup da openldap-instance as described at https://help.ubuntu.com/10.04/serverguide/C/openldap-server.html. It seems that the Objectclass "olcOverlayConfig" is missed - where can i find that objectclass? Is there a complete manual available which describes how to setup a active directory proxy server? Is it possible to modify the configuration using a ldap browser like active directory studio? To use that server to be a proxy to a active directory server i am trying to add the following configuration: proxy2.ldif --- dn: olcDatabase={2}ldap objectClass: olcDatabaseConfig objectClass: olcLDAPConfig olcDatabase: {2}ldap olcSuffix: dc=proxy,dc=foobar,dc=de olcRootDN: dc=foobar,dc=local olcDbURI: "ldap://10.45.2.11:389" dn: olcOverlay={0}pcache objectClass: olcOverlayConfig objectClass: olcPcacheConfig olcOverlay: {0}pcache olcPcache: bdb 100000 1 1000 100 olcPcacheAttrset: 0 mail postalAddress telephoneNumber olcPcacheTemplate: "(sn=)" 0 3600 0 0 0 olcPcacheTemplate: "(&(sn=)(givenName=))" 0 3600 0 0 0 olcPcacheTemplate: "(&(departmentNumber=)(secretary=))" 0 3600 dn: olcDatabase={0}hdb objectClass: olcHdbConfig objectClass: olcPcacheDatabase olcDatabase: {0}hdb olcDbDirectory: ./proxy-db.2.a olcDbCacheSize: 20 olcDbIndex: objectClass eq olcDbIndex: cn,sn,uid,mail pres,eq,sub --- LDAP-ADD Complains: # ldapadd -vvv -Y EXTERNAL -H ldapi:/// -f /etc/ldap/proxy.ldif ldap_initialize( ldapi:///??base ) SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 add objectClass: olcDatabaseConfig olcLDAPConfig add olcDatabase: {2}ldap add olcSuffix: dc=proxy,dc=foobar,dc=de add olcRootDN: dc=foobar,dc=local add olcDbURI: "ldap://10.41.2.12:389" adding new entry "olcDatabase={2}ldap" ldap_add: Invalid syntax (21) additional info: objectClass: value #1 invalid per syntax I

2 2

retry: counter not reaching zero, continuing on
by ml+openldap＠esmtp.org 23 Jul '11

23 Jul '11

While trying to determine how syncrepl behaves in various error conditions, I encountered an unexpected behaviour in which the retry specification doesn't seem to work. A MASTER is set up to use push replication to a REPLICA as follows: database ldap hidden on suffix "" rootdn "cn=slapd-ldap" uri ldap://REPLICA/ lastmod on restrict all sync_use_subentry true acl-bind bindmethod=simple binddn="cn=Monitor" credentials=password syncrepl rid=001 provider=ldapi://%2Fvar%2Frun%2Fldapi binddn="cn=Manager" bindmethod=simple credentials=passwd searchbase="" type=refreshAndPersist retry="5 5 60 +" When I stop the REPLICA and add an entry on the MASTER, then the MASTER is retrying every 5s and claims that 4 (sometimes 3) retries are left: Jul 22 13:12:52 MASTER slapd[23778]: do_syncrepl: rid=001 rc 52 retrying (4 retries left) Jul 22 13:12:57 MASTER slapd[23778]: do_syncrepl: rid=001 rc 52 retrying (3 retries left) Jul 22 13:13:02 MASTER slapd[23778]: do_syncrepl: rid=001 rc 52 retrying (4 retries left) Jul 22 13:13:07 MASTER slapd[23778]: do_syncrepl: rid=001 rc 52 retrying (3 retries left) Jul 22 13:13:12 MASTER slapd[23778]: do_syncrepl: rid=001 rc 52 retrying (4 retries left) Jul 22 13:13:17 MASTER slapd[23778]: do_syncrepl: rid=001 rc 52 retrying (4 retries left) Jul 22 13:13:22 MASTER slapd[23778]: do_syncrepl: rid=001 rc 52 retrying (4 retries left) Jul 22 13:13:28 MASTER slapd[23778]: do_syncrepl: rid=001 rc 52 retrying (4 retries left) Jul 22 13:13:33 MASTER slapd[23778]: do_syncrepl: rid=001 rc 52 retrying (4 retries left) Jul 22 13:13:38 MASTER slapd[23778]: do_syncrepl: rid=001 rc 52 retrying (4 retries left) Jul 22 13:13:43 MASTER slapd[23778]: do_syncrepl: rid=001 rc 52 retrying (4 retries left) Jul 22 13:13:48 MASTER slapd[23778]: do_syncrepl: rid=001 rc 52 retrying (4 retries left) Jul 22 13:13:53 MASTER slapd[23778]: do_syncrepl: rid=001 rc 52 retrying (4 retries left) Jul 22 13:13:58 MASTER slapd[23778]: do_syncrepl: rid=001 rc 52 retrying (4 retries left) When I start REPLICA again, syncrepl succeeds. Do I have to set some other option such that the retry specification is actually used? That is, try every 5s for 5 times, then try every 60s. Or is the retry logic dependent on the error syncrepl encounters? The full log for one failed retry is: conn=1004 op=0 BIND dn="cn=manager" method=128 conn=1004 op=0 BIND dn="cn=manager" mech=SIMPLE ssf=0 conn=1004 op=0 RESULT tag=97 err=0 text= conn=1004 op=1 SRCH base="" scope=2 deref=0 filter="(objectClass=*)" conn=1004 op=1 SRCH attr=* + srs csn 20110722201233.471069Z#000000#001#000000 log csn 20110722201233.471069Z#000000#001#000000 cmp 0, too old log csn 20110722201252.820971Z#000000#001#000000 Entry uid=user68,ou=People,dc=example,dc=com CSN 20110722201233.471069Z#000000#001#000000 older or equal to ctx 20110722201233.471069Z#000000#001#000000 syncprov_search_response: cookie=rid=001,sid=001,csn=20110722201252.820971Z#000000#001#000000 syncrepl_entry: rid=001 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) syncrepl_entry: rid=001 inserted UUID 95b838a2-4b55-4bcc-8b00-be329b138db0 conn=1004 fd=15 ACCEPT from PATH=/var/run/ldapi (PATH=/var/run/ldapi) syncrepl_entry: rid=001 be_search (52) syncrepl_entry: rid=001 uid=user69,ou=People,dc=example,dc=com null_callback : error code 0x34 syncrepl_entry: rid=001 be_add uid=user69,ou=People,dc=example,dc=com (52) syncrepl_entry: rid=001 be_add uid=user69,ou=People,dc=example,dc=com failed (52) do_syncrepl: rid=001 rc 52 retrying (4 retries left) conn=1004 op=2 UNBIND conn=1004 fd=15 closed connection_read(15): no connection! connection_read(15): no connection!

2 1

Kerberos with LDAP backend: password sync
by Nick Milas 22 Jul '11

22 Jul '11

Hello, We've been using OpenLDAP for all major services (mainly mail, Shibboleth, web service authentication etc.) based on authentication over the standard userPassword attribute (and uid as the username) of the person objectClass. Now, for particular authentication needs (because particular applications - like SQUID - do not support the standard PLAIN auth over TLS/SSL which we usually use), we consider installing Kerberos using our LDAP server as backend. Such a setup is meant to continue to allow the standard PLAIN auth over TLS/SSL (directly by LDAP) in some applications and provide Kerberos authentication in others, based on the same user/password database (stored and maintained in LDAP). [I know that in many environments, userPassword and krbPrincipalKey are deliberately different.] Generally, the Kerberos installation and user administration process involves creating Principals (krbPrincipalName) and Principal Keys (krbPrincipalKey). My question: Is there a way to automatically populate (either internally, via LDAP configuration, or externally, by running - for example - an external script) the values of krbPrincipalName and krbPrincipalKey attributes, so that these values can be produced by the values of the currently used attributes (uid, userPassword, including possibly others.)? This would allow initial creation of values for the above attributes using the same password value. Here: https://help.ubuntu.com/10.04/serverguide/C/kerberos-ldap.html I have found a quite descriptive tutorial, which, unfortunately, does not cover the above issues. Any feedback and system design advice will be appreciated. Thanks in advance, Nick

5 10

Two bases on same ldap server
by Édnei 21 Jul '11

21 Jul '11

Hi Guys! I don't know if it is possible, but....... What I do: sudo apt-get install slapd ldap-utils ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/cosine.ldif ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/nis.ldif ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/inetorgperson.ldif ldapadd -Y EXTERNAL -H ldapi:/// -f backend.example.com.ldif ldapadd -x -D cn=admin,dc=felipemeirelles,dc=com,dc=br -W -f frontend.example.com.ldif *backend Base *felipemeirelles*:* # Load dynamic backend modules dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulepath: /usr/lib/ldap olcModuleload: back_hdb # Database settings dn: olcDatabase=hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcSuffix: dc=felipemeirelles,dc=com,dc=br olcDbDirectory: /var/lib/ldap olcRootDN: cn=admin,dc=felipemeirelles,dc=com,dc=br olcRootPW: 123456 olcDbConfig: set_cachesize 0 2097152 0 olcDbConfig: set_lk_max_objects 1500 olcDbConfig: set_lk_max_locks 1500 olcDbConfig: set_lk_max_lockers 1500 olcDbIndex: objectClass eq olcLastMod: TRUE olcDbCheckpoint: 512 30 olcAccess: to attrs=userPassword by dn="cn=admin,dc=felipemeirelles,dc=com,dc=br" write by anonymous auth by self write by * none olcAccess: to attrs=shadowLastChange by self write by * read olcAccess: to dn.base="" by * read olcAccess: to * by dn="cn=admin,dc=felipemeirelles,dc=com,dc=br" write by * read *Frontend* *Base *felipemeirelles: # Create top-level object in domain dn: dc=felipemeirelles,dc=com,dc=br objectClass: top objectClass: dcObject objectclass: organization o: Example Organization dc: felipemeirelles description: LDAP SIJ # Admin user. dn: cn=admin,dc=felipemeirelles,dc=com,dc=br objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator userPassword: 123456 dn: ou=people,dc=felipemeirelles,dc=com,dc=br objectClass: organizationalUnit ou: people dn: ou=groups,dc=felipemeirelles,dc=com,dc=br objectClass: organizationalUnit ou: groups dn: uid=contato,ou=people,dc=felipemeirelles,dc=com,dc=br objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount uid: contato sn: Contato givenName: Contato cn: Contato Contato displayName: Contato uidNumber: 1000 gidNumber: 10000 userPassword: 123456 gecos: Contato Contato loginShell: /bin/bash homeDirectory: /home/contato shadowExpire: -1 shadowFlag: 0 shadowWarning: 7 shadowMin: 8 shadowMax: 999999 shadowLastChange: 10877 mail: contato(a)felipemeirelles.com.br postalCode: 31000 l: Toulouse o: Example mobile: +33 (0)6 xx xx xx xx homePhone: +33 (0)5 xx xx xx xx title: System Administrator postalAddress: initials: JD dn: cn=felipemeirelles,ou=groups,dc=felipemeirelles,dc=com,dc=br objectClass: posixGroup cn: felipemeirelles gidNumber: 10000 Ok ? This is my first base. Now, i try added more: ldapadd -Y EXTERNAL -H ldapi:/// -f backend_sij_com.example.com.ldif ldapadd -x -D cn=admin,dc=sij,dc=com,dc=br -W -f frontend_sij_com.example.com.ldif ldap_bind: Invalid credentials (49) *BASE SIJ.COM.BR* ( Other backend: backend_sij_com.example.com.ldif ) # Load dynamic backend modules dn: cn=module,cn=config objectClass: olcModuleList cn: module olcModulepath: /usr/lib/ldap olcModuleload: back_hdb # Database settings dn: olcDatabase=hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcSuffix: dc=sij,dc=com,dc=br olcDbDirectory: /var/lib/ldap olcRootDN: cn=admin,dc=sij,dc=com,dc=br olcRootPW: 123456 olcDbConfig: set_cachesize 0 2097152 0 olcDbConfig: set_lk_max_objects 1500 olcDbConfig: set_lk_max_locks 1500 olcDbConfig: set_lk_max_lockers 1500 olcDbIndex: objectClass eq olcLastMod: TRUE olcDbCheckpoint: 512 30 olcAccess: to attrs=userPassword by dn="cn=admin,dc=sij,dc=com,dc=br" write by anonymous auth by self write by * none olcAccess: to attrs=shadowLastChange by self write by * read olcAccess: to dn.base="" by * read olcAccess: to * by dn="cn=admin,dc=sij,dc=com,dc=br" write by * read *Other FrontEnd: frontend_sij_com.example.com.ldif* # Create top-level object in domain dn: dc=sij,dc=com,dc=br objectClass: top objectClass: dcObject objectclass: organization o: Example Organization dc: sij description: LDAP SIJ # Admin user. dn: cn=admin,dc=sij,dc=com,dc=br objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator userPassword: 123456 dn: ou=people,dc=sij,dc=com,dc=br objectClass: organizationalUnit ou: people dn: ou=groups,dc=sij,dc=com,dc=br objectClass: organizationalUnit ou: groups dn: uid=caho.lopes,ou=people,dc=sij,dc=com,dc=br objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount uid: caho.lopes sn: caho givenName: Caho cn: Caho Lopes displayName: caho uidNumber: 1000 gidNumber: 10000 userPassword: testecahosij gecos: Caho Lopes loginShell: /bin/bash homeDirectory: /home/caho.lopes shadowExpire: -1 shadowFlag: 0 shadowWarning: 7 shadowMin: 8 shadowMax: 999999 shadowLastChange: 10877 mail: caho.lopes(a)sij.com.br postalCode: 31000 l: Toulouse o: Example mobile: +33 (0)6 xx xx xx xx homePhone: +33 (0)5 xx xx xx xx title: System Administrator postalAddress: initials: JD dn: cn=sij,ou=groups,dc=sij,dc=com,dc=br objectClass: posixGroup cn: sij gidNumber: 10000 root@PythonAPP:~# ldapadd -d 65535 -x -D cn=admin,dc=sij,dc=com,dc=br -W -f frontend_sij_com.example.com.ldif ldap_create Enter LDAP Password: ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP localhost:389 ldap_new_socket: 4 ldap_prepare_socket: 4 ldap_connect_to_host: Trying ::1 389 ldap_pvt_connect: fd: 4 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_dump: buf=0x7f75c3f32540 ptr=0x7f75c3f32540 end=0x7f75c3f32570 len=48 0000: 30 2e 02 01 01 60 29 02 01 03 04 1c 63 6e 3d 61 0....`).....cn=a 0010: 64 6d 69 6e 2c 64 63 3d 73 69 6a 2c 64 63 3d 63 dmin,dc=sij,dc=c 0020: 6f 6d 2c 64 63 3d 62 72 80 06 31 32 33 34 35 36 om,dc=br..123456 ber_scanf fmt ({i) ber: ber_dump: buf=0x7f75c3f32540 ptr=0x7f75c3f32545 end=0x7f75c3f32570 len=43 0000: 60 29 02 01 03 04 1c 63 6e 3d 61 64 6d 69 6e 2c `).....cn=admin, 0010: 64 63 3d 73 69 6a 2c 64 63 3d 63 6f 6d 2c 64 63 dc=sij,dc=com,dc 0020: 3d 62 72 80 06 31 32 33 34 35 36 =br..123456 ber_flush2: 48 bytes to sd 4 0000: 30 2e 02 01 01 60 29 02 01 03 04 1c 63 6e 3d 61 0....`).....cn=a 0010: 64 6d 69 6e 2c 64 63 3d 73 69 6a 2c 64 63 3d 63 dmin,dc=sij,dc=c 0020: 6f 6d 2c 64 63 3d 62 72 80 06 31 32 33 34 35 36 om,dc=br..123456 ldap_write: want=48, written=48 0000: 30 2e 02 01 01 60 29 02 01 03 04 1c 63 6e 3d 61 0....`).....cn=a 0010: 64 6d 69 6e 2c 64 63 3d 73 69 6a 2c 64 63 3d 63 dmin,dc=sij,dc=c 0020: 6f 6d 2c 64 63 3d 62 72 80 06 31 32 33 34 35 36 om,dc=br..123456 ldap_result ld 0x7f75c3f2a2b0 msgid 1 wait4msg ld 0x7f75c3f2a2b0 msgid 1 (infinite timeout) wait4msg continue ld 0x7f75c3f2a2b0 msgid 1 all 1 ** ld 0x7f75c3f2a2b0 Connections: * host: localhost port: 389 (default) refcnt: 2 status: Connected last used: Wed Jul 20 17:53:53 2011 ** ld 0x7f75c3f2a2b0 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x7f75c3f2a2b0 request count 1 (abandoned 0) ** ld 0x7f75c3f2a2b0 Response Queue: Empty ld 0x7f75c3f2a2b0 response count 0 ldap_chkResponseList ld 0x7f75c3f2a2b0 msgid 1 all 1 ldap_chkResponseList returns ld 0x7f75c3f2a2b0 NULL ldap_int_select read1msg: ld 0x7f75c3f2a2b0 msgid 1 all 1 ber_get_next ldap_read: want=8, got=8 0000: 30 0c 02 01 01 61 07 0a 0....a.. ldap_read: want=6, got=6 0000: 01 31 04 00 04 00 .1.... ber_get_next: tag 0x30 len 12 contents: ber_dump: buf=0x7f75c3f33920 ptr=0x7f75c3f33920 end=0x7f75c3f3392c len=12 0000: 02 01 01 61 07 0a 01 31 04 00 04 00 ...a...1.... read1msg: ld 0x7f75c3f2a2b0 msgid 1 message type bind ber_scanf fmt ({eAA) ber: ber_dump: buf=0x7f75c3f33920 ptr=0x7f75c3f33923 end=0x7f75c3f3392c len=9 0000: 61 07 0a 01 31 04 00 04 00 a...1.... read1msg: ld 0x7f75c3f2a2b0 0 new referrals read1msg: mark request completed, ld 0x7f75c3f2a2b0 msgid 1 request done: ld 0x7f75c3f2a2b0 msgid 1 res_errno: 49, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_parse_result ber_scanf fmt ({iAA) ber: ber_dump: buf=0x7f75c3f33920 ptr=0x7f75c3f33923 end=0x7f75c3f3392c len=9 0000: 61 07 0a 01 31 04 00 04 00 a...1.... ber_scanf fmt (}) ber: ber_dump: buf=0x7f75c3f33920 ptr=0x7f75c3f3392c end=0x7f75c3f3392c len=0 ldap_msgfree ldap_err2string ldap_bind: Invalid credentials (49) In the slapd -D, the log: ..... 0000: 30 2e 02 01 01 60 29 02 0....`). ldap_read: want=40, got=40 0000: 01 03 04 1c 63 6e 3d 61 64 6d 69 6e 2c 64 63 3d ....cn=admin,dc= 0010: 73 69 6a 2c 64 63 3d 63 6f 6d 2c 64 63 3d 62 72 sij,dc=com,dc=br 0020: 80 06 31 32 33 34 35 36 ..123456 *ldap_read: want=8 error=Resource temporarily unavailable* ldap_write: want=14, written=14 0000: 30 0c 02 01 01 61 07 0a 01 31 04 00 04 00 0....a...1.... ldap_bind: Invalid credentials (49) *Help ?* Thanks! ldap_read: want=8, got=0

3 4

installation problem on CentOS 6
by Jonathan Camilleri 19 Jul '11

19 Jul '11

I am trying to install OpenLDAP on my virtual machine, however, I am getting an error: configure: error: BDB/HDB: BerkeleyDB not available. I have tried running env=/usr/local/Berkeley.5.1/include, however, I still get this error when I re-run .*/configure*. Any ideas? -- Jonathan Camilleri Mobile (MT): 00356 7982 7113 E-mail: camilleri.jon(a)gmail.com Please consider your environmental responsibility before printing this e-mail. I usually reply to e-mails within 2 business days. If it's urgent, give me a call.

2 2

Inconsistent duplicate attributeType: "memberOf"
by Christian Ramseyer 19 Jul '11

19 Jul '11

(sorry if this appears twice, I've posted this some time ago before I was subscribed to the list and it didn't seem to appear) I'm trying to migrate an LDAP from Solaris/OpenLDAP 2.3 to Linux/OpenLDAP 2.4, and I have an issue with a custom schema: # slaptest -f etc/slapd.conf /data/openldap/etc/schema/nxx.schema: line 10 attributetype: Inconsistent duplicate attributeType: "memberOf" Now the problem is, I have no idea where this previous definiton of memberOf comes from.... These are the included schemas: # grep include etc/slapd.conf include /data/openldap/etc/schema/core.schema include /data/openldap/etc/schema/cosine.schema include /data/openldap/etc/schema/inetorgperson.schema include /data/openldap/etc/schema/nis.schema include /data/openldap/etc/schema/nxx.schema And none of them besides nxx defines a memberOf: # grep memberOf etc/schema/* etc/schema/nxx.schema:attributetype ( NxxLDAPattributeType:1 NAME 'memberOf' etc/schema/nxx.schema: MAY ( memberOf $ host $ lastLogin $ passwordHistory $ loginFailures $ passwordRecoveryMailAddress $ passwordRecoveryChallenge) ) <end of grep output> Also, nxx defines it only once (it's pasted below). After commenting nxx and generating a config directory with slaptest, I found this in cn=schema.ldif: # grep memberOf openldap-config/cn\=config/cn\=schema.ldif olcAttributeTypes: ( 1.2.840.113556.1.2.102 NAME 'memberOf' DESC 'Group that t Where does this come from? Apparently not from the schemas I included, as a grep for memberOf doesn't return anything. There are also no other includes in these schema files. Is there any default schema data included besides what is given in include statements? Can I somehow get rid of this? Any help appreciated. Also I know that the attribute in the custom schema had better been prefixed, but this is an installation running since 2004 and "memberOf" is in scripts all over the place, so I'd rather not rename it. Thanks Christian nxx.schema objectIdentifier NxxRoot 1.3.6.1.4.1.21654 objectIdentifier NxxLDAP NxxRoot:3 objectIdentifier NxxLDAPattributeType NxxLDAP:1 objectIdentifier NxxLDAPobjectClass NxxLDAP:2 attributetype ( NxxLDAPattributeType:1 NAME 'memberOf' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) # for password aging attributetype ( NxxLDAPattributeType:2 NAME 'lastLogin' DESC 'Stores the last successful login of a user' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) attributetype ( NxxLDAPattributeType:3 NAME 'passwordHistory' DESC 'Stores all password ever used by a user' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) attributetype ( NxxLDAPattributeType:4 NAME 'loginFailures' DESC 'Stores successives login failures for a user' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) attributetype ( NxxLDAPattributeType:5 NAME 'passwordRecoveryMailAddress' EQUALITY caseExactIA5Match DESC 'Stores mail address for self password recovery' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) attributetype ( NxxLDAPattributeType:6 NAME 'passwordRecoveryChallenge' DESC 'Stores challenge for self password recovery' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) objectclass ( NxxLDAPobjectClass:1 NAME 'OssAccount' SUP top AUXILIARY DESC 'Additional attributes for OSS Accounts' MUST uid MAY ( memberOf $ host $ lastLogin $ passwordHistory $ loginFailures $ passwordRecoveryMailAddress $ passwordRecoveryChallenge) ) objectclass ( NxxLDAPobjectClass:2 NAME 'OssHost' SUP top AUXILIARY DESC 'Additional attributes for OSS Accounts' MUST uid MAY ( host ) )

2 3

Database indexing: slapindex
by openldap＠ayni.com 19 Jul '11

19 Jul '11

Hi listers Installation here: openldap-servers-2.4.15-7.fc11.i586 One master server, two backup servers (syncrepl). All authentication and mailing is managed by ldap. 1. About indexing: When i check the slapd-log, i see many <= bdb_equality_candidates: (uidNumber) not indexed <= bdb_equality_candidates: (gidNumber) not indexed In the discussion about slapd tuning http://www.openldap.org/doc/admin24/tuning.html#Indexes, however, i read that if each entry in a certain set of ldap-entries has got the candidate-attribute, it is not worth while to index the attribute, because slapd needs to read each entry in any case in order to find the requested one. this is the case for uidNumber as well as gidNumber, because both are compulsory attributes for objectClass posixAccount. My first question: is it therefore correct to disregard the above indexing requests of slapd? 2. About slapindex: When it comes to use slapindex, the docu is not clear about how to do that. Some places say, that you need to stop slapd entirely, some places say that it is sufficient to put slapd in read-only mode for the corresponding background database, which in this case would be /etc/openldap/slapd.d/cn=config/olcDatabase\=\{2\}bdb.ldif this file contains both the olcReadOnly and the olcDbIndex attributes. So i could just add the following two lines in the above file: olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq set the olcReadOnly attribute to TRUE, and restart slapd, and everything would be done automatically? Or would i need to invoke slapindex additionally with the following command slapindex -c And if i had to start slapindex additionally, would slapindex tell me, that the database is in read-only mode, so no changes are possible, not even index changes? And, if i had to start slapindex additionally, i would do it as root. the files generated by slapindex would they be owned by root (inaccessible by slapd) or by the slapd user? Would the new indexes be propagated to the backup servers by syncrepl automatically? If not, what would i have to change on the backup servers? Thank you for your attention suomi

2 1

TLS configuration with syncrepl
by Naga Chaitanya Palle 19 Jul '11

19 Jul '11

Hi, I am configuring TLS for syncrepl. But the consumer is not reading any updates from the server. Without tls the configuration was working fine. Please let me know where I am going wrong On client, my configuration files are as follows slapd.conf access to attrs=userPassword by self write by users read by anonymous auth access to attrs=shadowLastChange by self write by * auth access to * by * read moduleload syncprov.la syncrepl rid=124 provider=ldaps://smalldevonly.comverse-in.com:389 type=refreshOnly interval=00:00:01:00 searchbase="dc=comverse-in,dc=com" filter="(objectClass=top)" scope=sub attrs="cn,uidNumber" schemachecking=off bindmethod=simple binddn="cn=Manager,dc=comverse-in,dc=com" credentials=sonora updateref ldaps://smalldevonly.comverse-in.com /etc/ldap.conf uri ldaps://smalldevonly.comverse-in.com ldaps://dtr98.comverse-in.com base dc=comverse-in,dc=com ssl start_tls ssl on tls_cacertfile /etc/openldap/cacerts/cacert.pem tls_cacertdir /etc/openldap/cacerts /etc/openldap/ldap.conf BASE dc=comverse-in,dc=com URI ldaps://smalldevonly.comverse-in.com/ ldaps://dtr98.comverse-in.com TLS_CACERT /etc/openldap/cacerts/cacert.pem TLS_CACERTDIR /etc/openldap/cacerts TLS_REQCERT allow Thanks and Regards, Naga Chaitanya =============================================================================== Please refer to http://www.aricent.com/legal/email_disclaimer.html for important disclosures regarding this electronic communication. ===============================================================================

3 3

Re: Simple Bind w/TLS without SASL/Kerberos possible to AD?
by David Mitton 19 Jul '11

19 Jul '11

1 0

raising olcSizeLimit
by E.S. Rosenberg 17 Jul '11

17 Jul '11

Are there any negative repercussions to raising the sizelimit parameter to a high number (that encompasses the whole db), is it better to tie such limits to specific accounts that need that level of access? The documentation just says that limiting is "desirable" but a lot of people both on this list and forums seem to be setting their limits to 10k or even 30k (I guess depending on the db size). Thanks, Eli

2 1

Problem with verifying replication state with contextCSN
by Liam Gretton 15 Jul '11

15 Jul '11

I have a single provider and a single consumer, both quite lightly loaded serving a few hundred clients between them for nss_ldap. I've been trying to monitor the replication state by comparing contextCSN on both systems, but I'm finding that on the consumer contextCSN is more often than not older than the most recent entryCSN value. I read contextCSN as so: ldapsearch -H ldap://ldapserver1.company.org -LLL -x -s base -b dc=company,dc=org contextCSN contextCSN: 20110715120001.914244Z#000000#000#000000 ldapsearch -H ldap://ldapserver2.company.org -LLL -x -s base -b dc=company,dc=org contextCSN contextCSN: 20110715085237.656585Z#000000#000#000000 Looking at the values of entryCSN for ldapserver2 (the consumer): ldapsearch + | grep entryCSN | sort -u ... entryCSN: 20110714154009.500299Z#000000#000#000000 entryCSN: 20110715085237.656585Z#000000#000#000000 entryCSN: 20110715120001.914244Z#000000#000#000000 It can be seen that the most recent entryCSN matches the contextCSN of the provider, but its own contextCSN is an entry behind (often its two or three entries old). The replication is up to date, but contextCSN on the consumer doesn't seem to be getting updated in all circumstances. The consumer is replicating using syncrepl refreshAndPersist. Here's the syncrepl configuration for the consumer: syncrepl rid=001 provider=ldap://ldapserver1.company.org type=refreshAndPersist interval=00:00:05:00 retry="60 +" searchbase="dc=company,dc=org" sizelimit=unlimited timelimit=unlimited binddn="cn=replication,ou=special users,dc=company,dc=org" bindmethod=simple credentials=password schemachecking=off starttls=critical I'm also using the memberOf overlay. I see in the list archives that this has been reported before, but I can't find a bug report to go with it: <http://www.openldap.org/cgi-bin/wilma_hiliter/openldap-technical/201103/msg…> I'm using OpenLDAP 2.4.12 on 64-bit openSUSE 11.1. I haven't been able to find time to set up a test environment with the latest OpenLDAP to see if the problem exists there. Has anybody else seen this behaviour in the latest OpenLDAP? My current workaround to monitor replication status is to modify a record created for the purpose and verify that the consumer has picked it up. -- Liam Gretton liam.gretton(a)le.ac.uk HPC Architect http://www.le.ac.uk/its IT Services Tel: +44 (0)116 2522254 University of Leicester, University Road Leicestershire LE1 7RH, United Kingdom

2 1

ldapsync slapd Can't contact LDAP server
by Daniel Qian 15 Jul '11

15 Jul '11

Hi, I have a simple syncrepl setup that kind of works but every two hours there is a syncing problem from the log on the consumer side: Jul 14 01:09:57 ldapsync slapd[1636]: do_syncrep2: rid=002 (-1) Can't contact LDAP server Jul 14 01:09:57 ldapsync slapd[1636]: do_syncrepl: rid=002 rc -1 retrying (29 retries left) Jul 14 03:11:12 ldapsync slapd[1636]: do_syncrep2: rid=002 (-1) Can't contact LDAP server Jul 14 03:11:12 ldapsync slapd[1636]: do_syncrepl: rid=002 rc -1 retrying (29 retries left) Jul 14 05:12:26 ldapsync slapd[1636]: do_syncrep2: rid=002 (-1) Can't contact LDAP server Jul 14 05:12:26 ldapsync slapd[1636]: do_syncrepl: rid=002 rc -1 retrying (29 retries left) Jul 14 07:13:41 ldapsync slapd[1636]: do_syncrep2: rid=002 (-1) Can't contact LDAP server Jul 14 07:13:41 ldapsync slapd[1636]: do_syncrepl: rid=002 rc -1 retrying (29 retries left) Jul 14 09:14:55 ldapsync slapd[1636]: do_syncrep2: rid=002 (-1) Can't contact LDAP server Jul 14 09:14:55 ldapsync slapd[1636]: do_syncrepl: rid=002 rc -1 retrying (29 retries left) Jul 14 11:16:10 ldapsync slapd[1636]: do_syncrep2: rid=002 (-1) Can't contact LDAP server Jul 14 11:16:10 ldapsync slapd[1636]: do_syncrepl: rid=002 rc -1 retrying (29 retries left) Jul 14 13:17:24 ldapsync slapd[1636]: do_syncrep2: rid=002 (-1) Can't contact LDAP server Jul 14 13:17:24 ldapsync slapd[1636]: do_syncrepl: rid=002 rc -1 retrying (29 retries left) Jul 14 15:18:39 ldapsync slapd[1636]: do_syncrep2: rid=002 (-1) Can't contact LDAP server Jul 14 15:18:39 ldapsync slapd[1636]: do_syncrepl: rid=002 rc -1 retrying (29 retries left) Jul 14 17:19:53 ldapsync slapd[1636]: do_syncrep2: rid=002 (-1) Can't contact LDAP server Jul 14 17:19:53 ldapsync slapd[1636]: do_syncrepl: rid=002 rc -1 retrying (29 retries left) log from the provider looks better: Jul 14 19:18:50 ldaprov1 slapd[8459]: conn=30513 fd=20 ACCEPT from IP=x.x.x.x:1093 (IP=0.0.0.0:389) Jul 14 19:18:50 ldaprov1 slapd[8459]: conn=30513 op=0 BIND dn="cn=replica,dc=mydomain,dc=com" method=128 Jul 14 19:18:50 ldaprov1 slapd[8459]: conn=30513 op=0 BIND dn="cn=replica,dc=mydomain,dc=com" mech=SIMPLE ssf=0 Jul 14 19:18:50 ldaprov1 slapd[8459]: conn=30513 op=0 RESULT tag=97 err=0 text= Jul 14 19:18:50 ldaprov1 slapd[8459]: conn=30513 op=1 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(objectClass=*)" Jul 14 19:18:50 ldaprov1 slapd[8459]: conn=30513 op=1 SRCH attr=* + Here is the configuration for the consumer: dn: olcDatabase={1}bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: {1}bdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=mydomain,dc=com olcAddContentAcl: FALSE olcLastMod: TRUE olcMaxDerefDepth: 15 olcReadOnly: FALSE olcRootDN: cn=Manager,dc=mydomain,dc=com olcSyncUseSubentry: FALSE olcSyncrepl: {0}rid=002 provider="ldap://ldaprov1.prod:389/" type=refreshAndPe rsist retry="60 30 300 +" searchbase="dc=mydomain,dc=com" bindmetho d=simple binddn="cn=replica,dc=mydomain,dc=com" credentials=mypasswor d olcMonitoring: TRUE olcDbCacheSize: 1000 olcDbCheckpoint: 1024 15 olcDbNoSync: FALSE olcDbDirtyRead: FALSE olcDbIDLcacheSize: 0 olcDbIndex: objectClass pres,eq olcDbIndex: cn pres,eq,sub olcDbIndex: uid pres,eq,sub olcDbIndex: uidNumber pres,eq olcDbIndex: gidNumber pres,eq olcDbIndex: mail pres,eq,sub olcDbIndex: ou pres,eq,sub olcDbIndex: loginShell pres,eq olcDbIndex: sn pres,eq,sub olcDbIndex: givenName pres,eq,sub olcDbIndex: memberUid pres,eq,sub olcDbIndex: nisMapName pres,eq,sub olcDbIndex: nisMapEntry pres,eq,sub olcDbIndex: entryCSN eq olcDbIndex: entryUUID eq olcDbLinearIndex: FALSE olcDbMode: 0600 olcDbSearchStack: 16 olcDbShmKey: 0 olcDbCacheFree: 1 olcDbDNcacheSize: 0 And from the consumer side everything looks good if I manual ldapsearch with the replica account "cn=replica,dc=mydomain,dc=com" Can anyone shed some lights on how to troubleshoot this kind of problems? Thanks, Daniel

2 2

looking for entires with objectclass=glue
by Andreas Haubod 14 Jul '11

14 Jul '11

Hello, I've running two ldap server using N-Way multimaster replication. I want find all objects with "objectclass=glue". If I use JXEplorer to search "objectclass=glue" I get 136 entries back. If I use ldapsearch or Apache DS and do the same, no entries are found. In the slapcat backup from the ldap server the entires with objectclass: glue exists. So I turned "loglevel 256" in the slapd.conf. I got for JXEplorer and ldapsearch the same search: JXEplorer: slapd[23362]: conn=1001 op=7 SRCH base="ou=root" scope=2 deref=3 filter="(objectClass=glue)" slapd[23362]: conn=1001 op=7 SRCH attr=objectClass slapd[23362]: conn=1001 op=7 SEARCH RESULT tag=101 err=0 nentries=136 text= ldapsearch: slapd[23362]: conn=1004 op=1 SRCH base="ou=root" scope=2 deref=3 filter="(objectClass=glue)" slapd[23362]: conn=1004 op=1 SRCH attr=objectclass slapd[23362]: conn=1004 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= How can I get the glue entires via ldapsearch? Thanks Andreas

1 1

ppolicy in Solaris 10
by Wynand Jansen van Vuuren 14 Jul '11

14 Jul '11

My slapd.conf file is as follow # Load dynamic backend modules: modulepath /usr/local/libexec/openldap moduleload ppolicy.la # moduleload /usr/local/libexec/openldap/ppolicy.so # modulepath /usr/local/libexec/openldap # moduleload back_bdb.la # moduleload back_ldap.la # moduleload back_ldbm.la # moduleload back_passwd.la # moduleload back_shell.la and overlay ppolicy ppolicy_default "cn=default,ou=Policies,dc=rorotika,dc=com" ppolicy_use_lockout When I start slapd in debug with d 255, I get the following "error"? ine 21 (loglevel 4) line 22 (pidfile /usr/local/var/run/slapd.pid) line 23 (argsfile /usr/local/var/run/slapd.args) line 26 (modulepath /usr/local/libexec/openldap) line 27 (moduleload ppolicy.la) loaded module ppolicy.la module ppolicy.la: null module registered line 65 (access to dn.base="" by * read) >>> dnNormalize: <> <<< dnNormalize: <> Backend ACL: access to dn.base="" by * read The line that consern me is "module ppolicy.la: null module registered", is this a problem? The ppolicy does not seen to overlay... It seems that the Solaris 10 settings is still valid, for example It seems that this policy is not activated, for example the pwdMinLength: is set to 3, but when the user changes his/her password, it seems that the Solaris policy takes over from the /etc/default/passwd file test5:/ $ ssh admin777(a)10.1.1.5 * * * * * * * * * * * * W A R N I N G * * * * * * * * * * * * * * THIS SYSTEM IS RESTRICTED TO AUTHORIZED USERS FOR AUTHORIZED USE ONLY. UNAUTHORIZED ACCESS IS STRICTLY PROHIBITED AND MAY BE PUNISHABLE UNDER THE COMPUTER FRAUD AND ABUSE ACT OR OTHER APPLICABLE LAWS. IF NOT AUTHORIZED TO ACCESS THIS SYSTEM, DISCONNECT NOW. BY CONTINUING, YOU CONSENT TO YOUR KEYSTROKES AND DATA CONTENT BEING MONITORED. ALL PERSONS ARE HEREBY NOTIFIED THAT THE USE OF THIS SYSTEM CONSTITUTES CONSENT TO MONITORING AND AUDITING. * * * * * * * * * * * * W A R N I N G * * * * * * * * * * * * * Password: Last login: Tue Jul 12 11:14:22 2011 from test5.example. Sun Microsystems Inc. SunOS 5.10 Generic January 2005 Sun Microsystems Inc. SunOS 5.10 Generic January 2005 Sourcing //.profile-EIS..... test5:/ $ id uid=5011(admin777) gid=1000(users) groups=1000(users) test5:/ $ passwd passwd: Changing password for admin777 Enter existing login password: New Password: passwd: Password too short - must be at least 8 characters. Please try again New Password: test5:/ $ cat /etc/default/passwd #ident @(#)passwd.dfl 1.7 04/04/22 SMI # # Copyright 2004 Sun Microsystems, Inc. All rights reserved. # Use is subject to license terms. # MAXWEEKS=13 MINWEEKS= PASSLENGTH=8 # NAMECHECK enables/disables login name checking. Could someone point me in the right direction please?

1 0

Database indexing: use of slapindex
by anax 14 Jul '11

14 Jul '11

Hi listers Installation here: openldap-servers-2.4.15-7.fc11.i586 One master server, two backup servers (syncrepl). All authentication and mailing is managed through ldap. 1. About indexing: When i check the slapd-log, i see many <= bdb_equality_candidates: (uidNumber) not indexed <= bdb_equality_candidates: (gidNumber) not indexed In the discussion about slapd tuning http://www.openldap.org/doc/admin24/tuning.html#Indexes, however, i read that if each entry in a certain set of ldap-entries has got the candidate-attribute, it is not worth while to index the attribute, because slapd needs to read each entry in any case in order to find the requested one. this is the case for uidNumber as well as gidNumber, because both are compulsory attributes for objectClass posixAccount. My first question: is it therefore correct to disregard the above indexing requests of slapd? 2. About slapindex: When it comes to use slapindex, the docu is not clear about how to do that. Some places say, that you need to stop slapd entirely, some places say that it is sufficient to put slapd in read-only mode for the corresponding background database, which in this case would be /etc/openldap/slapd.d/cn=config/olcDatabase\=\{2\}bdb.ldif this file contains both the olcReadOnly and the olcDbIndex attributes. So i could just add the following two lines in the above file: olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq set the olcReadOnly attribute to TRUE, and restart slapd, and everything would be done automatically? Or would i need to invoke slapindex additionally with the following command slapindex -c And if i had to start slapindex additionally, would slapindex tell me, that the database is in read-only mode, so no changes are possible, not even index changes? And, if i had to start slapindex additionally, i would do it as root. the files generated by slapindex would they be owned by root (inaccessible by slapd) or by the slapd user? Would the new indexes be propagated to the backup servers by syncrepl automatically? If not, what would i have to change on the backup servers? Thank you for your attention suomi

1 0

Database indexing: slapindex
by openldap＠ayni.com 14 Jul '11

14 Jul '11

Hi listers Installation here: openldap-servers-2.4.15-7.fc11.i586 One master server, two backup servers (syncrepl). All authentication and mailing is managed by ldap. 1. About indexing: When i check the slapd-log, i see many <= bdb_equality_candidates: (uidNumber) not indexed <= bdb_equality_candidates: (gidNumber) not indexed In the discussion about slapd tuning http://www.openldap.org/doc/admin24/tuning.html#Indexes, however, i read that if each entry in a certain set of ldap-entries has got the candidate-attribute, it is not worth while to index the attribute, because slapd needs to read each entry in any case in order to find the requested one. this is the case for uidNumber as well as gidNumber, because both are compulsory attributes for objectClass posixAccount. My first question: is it therefore correct to disregard the above indexing requests of slapd? 2. About slapindex: When it comes to use slapindex, the docu is not clear about how to do that. Some places say, that you need to stop slapd entirely, some places say that it is sufficient to put slapd in read-only mode for the corresponding background database, which in this case would be /etc/openldap/slapd.d/cn=config/olcDatabase\=\{2\}bdb.ldif this file contains both the olcReadOnly and the olcDbIndex attributes. So i could just add the following two lines in the above file: olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq set the olcReadOnly attribute to TRUE, and restart slapd, and everything would be done automatically? Or would i need to invoke slapindex additionally with the following command slapindex -c And if i had to start slapindex additionally, would slapindex tell me, that the database is in read-only mode, so no changes are possible, not even index changes? And, if i had to start slapindex additionally, i would do it as root. the files generated by slapindex would they be owned by root (inaccessible by slapd) or by the slapd user? Would the new indexes be propagated to the backup servers by syncrepl automatically? If not, what would i have to change on the backup servers? Thank you for your attention suomi

1 0

Re: Simple Bind w/TLS without SASL/Kerberos possible to AD?
by David Mitton 14 Jul '11

14 Jul '11

Thanks for the reply, sorry about the poor quoting, I'm cut and pasting from the web archive. ------ From: Jose Ildefonso Camargo Tolosa <ildefonso.camargo(a)gmail.com> Date: Fri, 8 Jul 2011 08:58:16 -0430 Greetings, On Thu, Jul 7, 2011 at 4:08 PM, David Mitton <david(a)mitton.com> wrote: I am trying to use OpenLDAP from an embedded Linux system to authenticate (PAM LDAP) against a Windows AD server. I must use TLS to secure this, but I would rather not use SASL or Kerberos if possible. pam_ldap = http://www.padl.com/pam_ldap.html[1] OR http://arthurdejong.org/nss-pam-ldapd/[2] .... you are not dealing here with OpenLDAP.... DJM> Good point, I will look at exactly which module(s) I'm using and > come back to that later. I beleive for the moment I'm using whatever is in > Centos. I have Arthur Jong's modules as well, but I don't think > I've installed them yet. I have been able to mock this up on a Centos system without TLS, and the PAM worked fine. When I turn on TLS, the Windows server handshakes the TLS but then has a problem with the first message. I am also working that side. I have walked through the handshake with s_client, and the connection is happy. I am now working with ldapsearch and trying things.... The first thing I notice is that it seems to try an SASL bind. Can I stop this? I'm not sure I have SASL actually installed on this system, and I'm not sure I want it in my target. ldapsearch -x <--- does simple auth instead of sasl. Is this possible? from both the OpenLDAP client and/or Windows AD? Ideas on the correct alphabet soup to try this with ldapsearch would be appreciated. Thanks. Well, I have seen this done through samba, but you *should* be able to use AD's LDAP to authenticate your Linux workstation, I guess. Sincerely, Ildefonso Camargo ------- I tried the following command and here are the results... note that after the simple_bind, a SASL_bind line appears. I'd like to dig into this deeper.... What will give me more info? Thanks, Dave. ldapsearch -d 1 -v -x -H ldaps://172.16.9.3:363 -b "dc=foobar,dc=local" -D 'FOOBAR\mgr' -w 'Strongpw@09' '(sAMAccountName=mgr)' ldap_initialize( ldaps://172.16.9.3:363 ) ldap_create ldap_url_parse_ext(ldaps://172.16.9.3:363) ldap_bind ldap_simple_bind ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP 172.16.9.3:363 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 172.16.9.3:363 ldap_connect_timeout: fd: 3 tm: -1 async: 0 ldap_close_socket: 3 ldap_perror ldap_bind: Can't contact LDAP server (-1)

2 1

Re: basic login fails : here are some logs ...
by Olivier 13 Jul '11

13 Jul '11

I have problem to use my openldap 2.4 server for authentication on a fedora 14 : it sounds that the problem is on the on the client side configuration. Here are some logs : your help to diag would be appreciated. -> I have an ldap server that that stores posixAccount and respond to ldap queries. -> I have configure a client machine to use this ldap server for authentication when login : ***** LOGS *** **** CLIENT side **** login: olivier passe : Login incorrect **** SERVER when login on the client *** Here is what I see on the server side (IP=10.1.92.24) when I try to log in as "olivier" on the client (10.1.86.93) using /bin/login (debug level 256) : conn=1220 fd=13 ACCEPT from IP=10.1.86.93:54458 (IP=10.1.92.24:389) conn=1220 op=0 BIND dn="" method=128 conn=1220 op=0 RESULT tag=97 err=0 text= conn=1220 op=1 SRCH base="ou=People,ou=staff,dc=mydomain,dc=fr" scope=2 deref=0 filter="(uid=olivier)" conn=1220 op=1 SRCH attr=host authorizedService shadowExpire shadowFlag shadowInactive shadowLastChange shadowMax shadowMin shadowWarning uidNumber conn=1220 op=1 SEARCH RESULT tag=101 err=32 nentries=0 text= *** CLIENT When using ldappasswd ***** I manage to change the "userPassword" attributes using ldappasswd command, here are the logs on the client and server side : Client side : $ ldapsearch -h ldap-master1.mydomain.fr -D "cn=Manager,dc=mydomain,dc=fr" -w secret "uid=olivier" dn: uid=olivier,ou=Staff,ou=People,dc=mydomain,dc=fr uid: olivier ... objectClass: account objectClass: posixAccount objectClass: top userPassword:: e1NTSEF9UmlYdnk4MWtaZ0NMS2hyZnBvd2hlaezrbTd7aR5LU0s= $ ldappasswd -h -h ldap-master1.mydomain.fr -D "cn=Manager,dc=mydomain,dc=fr" -w secret "uid=olivier,ou=Staff,ou=People,dc=mydomain,dc=fr" -s newpass $ ldapsearch -h ldap-master1.mydomain.fr -D "cn=Manager,dc=mydomain,dc=fr" -w secret "uid=olivier" dn: uid=olivier,ou=Staff,ou=People,dc=mydomain,dc=fr uid: olivier ... objectClass: account objectClass: posixAccount objectClass: top userPassword:: e1NTSEF9UmlYdnk4MWtaZ0NMS2hyZnBvd2hlaezrbTd7aR5LU0s= *** SERVER side When using ldappasswd ***** Server side, here are the logs related to ldapppasswd : conn=1000 fd=11 ACCEPT from IP=10.1.86.93:52074 (IP=10.1.92.24:389) conn=1000 op=0 BIND dn="cn=Manager,dc=mydomain,dc=fr" method=128 conn=1000 op=0 BIND dn="cn=Manager,dc=mydomain,dc=fr" mech=SIMPLE ssf=0 conn=1000 op=0 RESULT tag=97 err=0 text= conn=1000 op=1 EXT oid=1.3.6.1.4.1.4203.1.11.1 conn=1000 op=1 PASSMOD id="uid=olivier,ou=Staff,ou=People,dc=mydomain,dc=fr" new conn=1000 op=1 RESULT oid= err=0 text= conn=1000 op=2 UNBIND conn=1000 fd=11 closed Thanks for your help, ---- Olivier On Tue, Jul 12, 2011 at 7:59 PM, Olivier Guillard <olivier(a)guillard.nom.fr> wrote: > Hello > > Here is the result of an ldapsearch on a client host : > > $ ldapsearch -h ldap-master1.mydomain.fr -D > "cn=Manager,dc=mydomain,dc=fr" -w secret "uid=olivier" > > dn: uid=olivier,ou=Staff,ou=People,dc=mydomain,dc=fr > uid: olivier > loginShell: /bin/tcsh > cn: Olivier > uidNumber: 1130 > gidNumber: 18104 > homeDirectory: /home/olivier > objectClass: account > objectClass: posixAccount > objectClass: top > userPassword:: e1NTSEF9UmlYdnk4MWtaZ0NMS2hyZnBvd2hlaezrbTd7aR5LU0s= > > I have the same output with this : > > $ ldapsearch -h ldap-master1.mydomain.fr -D > "uid=olivier,ou=Staff,ou=People,dc=mydomain,dc=fr" -w pass-olivier > "uid=olivier" > > Although if I omit the -w I get this : > > ldap_bind: Server is unwilling to perform (53) > additional info: unauthenticated bind (DN with no password) disallowed > > > --->> the openldap server respond. > > ================ > > On the client side (fedora 14), I have followed the documentation to > set up for ldap authentication when login : > > /etc/nsswitch.conf /etc/ldap.conf /etc/nss_ldap.conf > /etc/pam_ldap.conf /etc/openldap/ldap.conf and /etc/pam.d/ > > are configured for the system to query the ldap-master.mydomain.fr > server for authentication : > > in ldap.conf files I have : > > uri ldap://ldap-master1.mydomain.fr and > "rootbinddn cn=Manager,dc=mydomain,dc=fr" > > in nsswitch.conf : > passwd: ldap > shadow: ldap > > and in pam.d/password-auth and pam.d/system-auth and pam.d/system-auth-ac > I have the lines : > > auth sufficient pam_ldap.so use_first_pass > account [default=bad success=ok user_unknown=ignore] pam_ldap.so > password sufficient pam_ldap.so use_authtok > session optional pam_ldap.so > > I use no particular security mechanism at this stage at this stage (no > TLS, simple auth, etc.). > > ==== > > WITH ALL THIS, here is what I get in the logs when I try to login as > "olivier" on the client machine: > > Jul 12 19:32:20 fouine login: nss_ldap: failed to bind to LDAP server > ldap://ldap-master1.mydomain.fr: Can't contact LDAP server > Jul 12 19:32:20 fouine login: nss_ldap: could not search LDAP server - > Server is unavailable > > Of course, i can't log in. > > Any help ??? I'm getting mad... > > ( may be could you suggest which debug level I should use on the > server to try to track what's going on). > > Thanks, > > --- > Olivier >

4 3

OpenLPDAP client tools exit codes
by Liam Gretton 13 Jul '11

13 Jul '11

Hi, I've started relying on undocumented exit codes for ldapmodify in places. These are defined in ldap.h, e.g.: #define LDAP_CONSTRAINT_VIOLATION 0x13 #define LDAP_TYPE_OR_VALUE_EXISTS 0x14 Presumably these are undocumented for good reason, but in practice can they be relied on not to change, at least as far as OpenLDAP 2 is concerned (additional exit codes are obviously not an issue). -- Liam Gretton liam.gretton(a)le.ac.uk HPC Architect http://www.le.ac.uk/its IT Services Tel: +44 (0)116 2522254 University of Leicester, University Road Leicestershire LE1 7RH, United Kingdom

2 2

Recommended strategy for replicating cn=config database
by Jonathan Underwood 13 Jul '11

13 Jul '11

Hi, I currently have a working N-way multimaster setup (where N=2) and am using sasl/gssapi/kerberos for authenticated binding. I am using the ldap service principals for each host to authenticate, and this is working fine for allowing me to replicate databases other than the cn=config database, where I see the following in the logs: Jul 12 18:28:04 auth1 slapd[4411]: do_syncrep2: rid=001 LDAP_RES_SEARCH_RESULT Jul 12 18:28:04 auth1 slapd[4411]: do_syncrep2: rid=001 LDAP_RES_SEARCH_RESULT (32) No such object Jul 12 18:28:04 auth1 slapd[4411]: do_syncrep2: rid=001 (32) No such object Jul 12 18:28:04 auth1 slapd[4411]: do_syncrepl: rid=001 rc -2 retrying (29 retries left) where rid=001 corresponds to the entry: olcSyncRepl: rid=001 provider=ldap://auth0.domain bindmethod=sasl saslmech=gssapi searchbase="cn=config" type=refreshAndPersist retry="30 30 300 +" timeout=1 The reason this isn't working is clear: slapd on the consumer is not binding as the rootdn of the cn=config tree, and so therefore cannot search that database. I am not sure what the best fix is for this, particularly from a security point-of-view. My first thought was to add an ACL to the cn=config database such as olcAccess: to * by users read by * none, but this then opens up the cn=config tree to be readable by any authenticated user, which is somewhat undesirable. Does anyone have a suggestion as to a good strategy to allow cn=config replication in this situation? Thanks in advance, Jonathan.

2 2

LDAP handle structural integrity function
by Khaled Blah 13 Jul '11

13 Jul '11

Hallo, I use OpenLDAP in an authentication project and I would like to correctly deal with fauly networks. I mean networks that have packet losses and such. That is why I would like to know whether there is a function in OpenLDAP which allows to check (and maybe sanitize) possibly corrupted sockets associated with the LDAP handle? Many thanks for all your replies Regards, Khaled

3 3

ppolicy with Solaris 10
by Wynand Jansen van Vuuren 13 Jul '11

13 Jul '11

My slapd.conf file is as follow # Load dynamic backend modules: modulepath /usr/local/libexec/openldap moduleload ppolicy.la # moduleload /usr/local/libexec/openldap/ppolicy.so # modulepath /usr/local/libexec/openldap # moduleload back_bdb.la # moduleload back_ldap.la # moduleload back_ldbm.la # moduleload back_passwd.la # moduleload back_shell.la and overlay ppolicy ppolicy_default "cn=default,ou=Policies,dc=rorotika,dc=com" ppolicy_use_lockout When I start slapd in debug with d 255, I get the following "error"? ine 21 (loglevel 4) line 22 (pidfile /usr/local/var/run/slapd.pid) line 23 (argsfile /usr/local/var/run/slapd.args) line 26 (modulepath /usr/local/libexec/openldap) line 27 (moduleload ppolicy.la) loaded module ppolicy.la module ppolicy.la: null module registered line 65 (access to dn.base="" by * read) >>> dnNormalize: <> <<< dnNormalize: <> Backend ACL: access to dn.base="" by * read The line that consern me is "module ppolicy.la: null module registered", is this a problem? The ppolicy does not seen to overlay... It seems that the Solaris 10 settings is still valid, for example It seems that this policy is not activated, for example the pwdMinLength: is set to 3, but when the user changes his/her password, it seems that the Solaris policy takes over from the /etc/default/passwd file test5:/ $ ssh admin777(a)10.1.1.5 * * * * * * * * * * * * W A R N I N G * * * * * * * * * * * * * * THIS SYSTEM IS RESTRICTED TO AUTHORIZED USERS FOR AUTHORIZED USE ONLY. UNAUTHORIZED ACCESS IS STRICTLY PROHIBITED AND MAY BE PUNISHABLE UNDER THE COMPUTER FRAUD AND ABUSE ACT OR OTHER APPLICABLE LAWS. IF NOT AUTHORIZED TO ACCESS THIS SYSTEM, DISCONNECT NOW. BY CONTINUING, YOU CONSENT TO YOUR KEYSTROKES AND DATA CONTENT BEING MONITORED. ALL PERSONS ARE HEREBY NOTIFIED THAT THE USE OF THIS SYSTEM CONSTITUTES CONSENT TO MONITORING AND AUDITING. * * * * * * * * * * * * W A R N I N G * * * * * * * * * * * * * Password: Last login: Tue Jul 12 11:14:22 2011 from test5.example. Sun Microsystems Inc. SunOS 5.10 Generic January 2005 Sun Microsystems Inc. SunOS 5.10 Generic January 2005 Sourcing //.profile-EIS..... test5:/ $ id uid=5011(admin777) gid=1000(users) groups=1000(users) test5:/ $ passwd passwd: Changing password for admin777 Enter existing login password: New Password: passwd: Password too short - must be at least 8 characters. Please try again New Password: test5:/ $ cat /etc/default/passwd #ident @(#)passwd.dfl 1.7 04/04/22 SMI # # Copyright 2004 Sun Microsystems, Inc. All rights reserved. # Use is subject to license terms. # MAXWEEKS=13 MINWEEKS= PASSLENGTH=8 # NAMECHECK enables/disables login name checking. Could someone point me in the right direction please?

1 0

Re: OpenLDAP freezes and doesn't respond
by Cyril GROSJEAN 13 Jul '11

13 Jul '11

No I don't use pass through authentication. Anyway, I'll check the cyrus-sasl related rpm's just in case there's an available update or patch from Red Hat .. 2011/7/13 Quanah Gibson-Mount <quanah(a)zimbra.com> > --On Tuesday, July 12, 2011 11:59 AM +0200 Cyril GROSJEAN < > cgrosjean(a)janua.fr> wrote: > > # 5 0x00000000004af398 in ldap_pvt_sasl_mutex_dispose () >> >> # 6 0x00000000004b04ca in ldap_pvt_sasl_mutex_dispose () >> # 7 0x00000000004b4183 in ldap_pvt_sasl_mutex_dispose () >> # 8 0x00000000004b802e in ldap_pvt_sasl_mutex_dispose () >> # 9 0x0000000000481a7a in ldap_pvt_sasl_mutex_dispose () >> # 10 0x0000000000482547 in ldap_pvt_sasl_mutex_dispose () >> # 11 0x00000000004decab in ldap_pvt_sasl_mutex_dispose () >> # 12 0x0000000000481b4a in ldap_pvt_sasl_mutex_dispose () >> # 13 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () >> # 14 0x000000000043be3e in ldap_pvt_sasl_mutex_dispose () >> # 15 0x0000000000481bc2 in ldap_pvt_sasl_mutex_dispose () >> # 16 0x0000000000482127 in ldap_pvt_sasl_mutex_dispose () >> # 17 0x000000000043c83f in ldap_pvt_sasl_mutex_dispose () >> # 18 0x00000000004205a5 in ldap_pvt_sasl_mutex_dispose () >> # 19 0x0000000000420b7f in ldap_pvt_sasl_mutex_dispose () >> # 20 0x00002ba9886e08a8 in ldap_int_thread_pool_wrapper () >> > > This looks like a bug with cyrus-sasl to me. Are you doing pass through > authentication? > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

RE: Multi Master OpenLdap.
by arun.sasi1＠wipro.com 13 Jul '11

13 Jul '11

Team any update… From: Arun Sasi V (WI01 - Manage IT) Sent: Monday, July 11, 2011 3:20 PM To: E.S. Rosenberg Cc: openldap-technical(a)openldap.org Subject: RE: Multi Master OpenLdap. And also I could see below message nonpresent_callback: rid=003 present UUI Thanks, -Arun From: Arun Sasi V (WI01 - Manage IT) Sent: Monday, July 11, 2011 1:36 PM To: 'E.S. Rosenberg' Cc: openldap-technical(a)openldap.org Subject: RE: Multi Master OpenLdap. Thank you very much Eli for concidering my issue. Here is my scenario... I couldn’t find any abnormality in log files and also I never seen any deletion logs in the server. Slapd will go for hang and some ID`s will get disappear same will be replicate to slaves too. Mainly Groups and Computer accounts I can see some UNBIND and connection lost logs from one server and another multimaster server from Jul 11 04:03:39 gb0135embldap01 slapd[9852]: conn=138411 op=24 SEARCH RESULT tag=101 err=32 nentries=0 text= Jul 11 04:03:39 gb0135embldap01 slapd[9852]: conn=138424 op=12 SRCH base="ou=Groups,dc=emb,dc=slb,dc=com" scope=2 deref=0 filter="(&(objectClass=sambaGroupMapping)(gidNumber=65534))" Jul 11 04:03:39 gb0135embldap01 slapd[9852]: conn=138424 op=12 SRCH attr=gidNumber sambaSID sambaGroupType sambaSIDList description displayName cn objectClass Jul 11 04:03:39 gb0135embldap01 slapd[9852]: conn=138424 op=12 SEARCH RESULT tag=101 err=0 nentries=0 text= Jul 11 04:03:39 gb0135embldap01 slapd[9852]: conn=138415 op=21 SRCH base="sambaDomainName=EMB,sambaDomainName=emb,dc=emb,dc=slb,dc=com" scope=2 deref=0 filter="(&(objectClass=sambaTrustedDomainPassword)(sambaDomainName=emb))" Jul 11 04:03:39 gb0135embldap01 slapd[9852]: conn=138415 op=21 SEARCH RESULT tag=101 err=32 nentries=0 text= Jul 11 04:03:39 gb0135embldap01 slapd[9852]: conn=138385 op=46 SRCH base="ou=Groups,dc=emb,dc=slb,dc=com" scope=2 deref=0 filter="(&(objectClass=sambaGroupMapping)(|(displayName=test)(cn=test)))" Jul 11 04:03:39 gb0135embldap01 slapd[9852]: conn=138385 op=46 SRCH attr=gidNumber sambaSID sambaGroupType sambaSIDList description displayName cn objectClass Jul 11 04:03:39 gb0135embldap01 slapd[9852]: <= bdb_equality_candidates: (displayName) not indexed Jul 11 04:03:39 gb0135embldap01 slapd[9852]: <= bdb_equality_candidates: (cn) not indexed Jul 11 04:07:53 gb0135embldap01 slapd[21335]: @(#) $OpenLDAP: slapd 2.4.15 (Mar 19 2009 10:07:59) $ ^Ibuildd@yellow:/build/buildd/openldap-2.4.15/debian/build/servers/slapd Jul 11 04:07:54 gb0135embldap01 slapd[21337]: slapd starting Jul 11 04:07:54 gb0135embldap01 slapd[21337]: conn=0 fd=23 ACCEPT from IP=[::1]:57016 (IP=[::]:389) Jul 11 04:07:54 gb0135embldap01 slapd[21337]: conn=1 fd=24 ACCEPT from IP=134.32.44.37:40763 (IP=0.0.0.0:389) OLCDATABSE dn: olcDatabase={1}hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=emb,dc=slb,dc=com olcAccess: {0}to attrs=userPassword,shadowLastChange,sambaLMPassword,sambaNTPassword by dn="cn=admin,dc=emb,dc=slb,dc=com" write by dn="cn=sunone-replication,dc=emb,dc=slb,dc=com" peername.ip=136.250.9.48 write by dn="cn=sunone-replication,dc=emb,dc=slb,dc=com" peername.ip=163.185.18.238 write by anonymous auth by self write by * none olcAccess: {1}to dn.base="" by * read #Enable Local Admin to add users in the Group and also SunOne to add users to country groups olcAccess: {2}to dn.subtree="ou=groups,dc=emb,dc=slb,dc=com" by set="user/uid & [cn=group-admin,ou=SuperGroups,dc=emb,dc=slb,dc=com]/memberuid" write by dn="cn=sunone-replication,dc=emb,dc=slb,dc=com" peername.ip=136.250.9.48 write by dn="cn=sunone-replication,dc=emb,dc=slb,dc=com" peername.ip=163.185.18.238 write by * read #Enable Local Admin to add computers olcAccess: {3}to dn.subtree="ou=Computers,dc=emb,dc=slb,dc=com" by set="user/uid & [cn=group-admin,ou=SuperGroups,dc=emb,dc=slb,dc=com]/memberuid" write by * read #Enable shell-admin to set up local user access olcAccess: {4}to attrs=loginShell,homeDirectory by set="user/uid & [cn=shell-admin,ou=SuperGroups,dc=emb,dc=slb,dc=com]/memberuid" write by dn="cn=sunone-replication,dc=emb,dc=slb,dc=com" peername.ip=136.250.9.48 write by dn="cn=sunone-replication,dc=emb,dc=slb,dc=com" peername.ip=163.185.18.238 write by * read #Enable write access to account sun-one-replication for sun ldap replication. olcAccess: {5}to * by dn="cn=admin,dc=emb,dc=slb,dc=com" write by dn="cn=sunone-replication,dc=emb,dc=slb,dc=com" peername.ip=136.250.9.48 write by dn="cn=sunone-replication,dc=emb,dc=slb,dc=com" peername.ip=163.185.18.238 write by * read olcLastMod: TRUE olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq olcDbIndex: entryUUID eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: gidNumber eq olcDbIndex: loginShell eq olcDbIndex: uid eq,pres,sub olcDbIndex: memberUid eq,pres,sub olcDbIndex: uniqueMember eq,pres olcDbIndex: sambaSID eq olcDbIndex: sambaPrimaryGroupSID eq olcDbIndex: sambaGroupType eq olcDbIndex: sambaSIDList eq olcDbIndex: sambaDomainName eq olcDbIndex: default sub structuralObjectClass: olcHdbConfig entryUUID: f479600a-5f34-102f-8ddd-3ff046e70702 creatorsName: cn=admin,cn=config createTimestamp: 20100928101442Z olcRootDN: cn=admin,dc=emb,dc=slb,dc=com olcSyncrepl: {0}rid=003 provider=ldap://gb0135embldap01.emb.slb.com binddn="cn =admin,dc=emb,dc=slb,dc=com" bindmethod=simple credentials=Bsl@121z searchbas e="dc=emb,dc=slb,dc=com" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 starttls=yes olcSyncrepl: {1}rid=004 provider=ldap://ae0042embldap01.emb.slb.com binddn="cn =admin,dc=emb,dc=slb,dc=com" bindmethod=simple credentials=Bsl@121z searchbas e="dc=emb,dc=slb,dc=com" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 starttls=yes olcMirrorMode: TRUE entryCSN: 20100928191927.932499Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20100928191927Z Ldap Version @(#) $OpenLDAP: slapd 2.4.15 (Mar 19 2009 10:07:59) $ Operating system Distributor ID: Ubuntu Description: Ubuntu 9.04 Release: 9.04 Codename: jaunty Thanks, -Arun -----Original Message----- From: E.S. Rosenberg [mailto:esr@g.jct.ac.il] Sent: Monday, July 11, 2011 12:58 PM To: Arun Sasi V (WI01 - Manage IT) Cc: openldap-technical(a)openldap.org Subject: Re: Multi Master OpenLdap. Have you tried raising the loglevel? Are the schemas the same between the servers? Is time in sync between the servers? What versions are you dealing with? You don't provide a lot of info and most of us are not clairvoyant.... Regards, Eli 2011/7/11 <arun.sasi1(a)wipro.com>: > > > > > Thanks, > > -Arun > > > > From: Arun Sasi V (WI01 - Manage IT) > Sent: Wednesday, July 06, 2011 5:46 PM > To: 'openldap-technical(a)openldap.org' > Subject: Multi Master OpenLdap. > > > > Hello Team, > > > > I have configured Multi-master Mirror mode replica setup in our environment. > We have 3 regions slave Ldap server which is read only and two location we > have configured as mirror mode replica Ldap. My problem here is… > > > > Master Ldap is going hang some times and some ID`s are disappearing from the > master server. I couldn’t find any logs over there for why ID`s are > disappearing and also why Ldap is going hung state. > > > > Thanks & Regards, > > Arun Sasi V > > Please do not print this email unless it is absolutely necessary. > > The information contained in this electronic message and any attachments to > this message are intended for the exclusive use of the addressee(s) and may > contain proprietary, confidential or privileged information. If you are not > the intended recipient, you should not disseminate, distribute or copy this > e-mail. Please notify the sender immediately and destroy all copies of this > message and any attachments. > > WARNING: Computer viruses can be transmitted via email. The recipient should > check this email and any attachments for the presence of viruses. The > company accepts no liability for any damage caused by any virus transmitted > by this email. > > www.wipro.com Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

2 1

Syncrepl can't start ssl session because of refused 'client' certificate
by Thibault Le Meur 12 Jul '11

12 Jul '11

Hello, I'm trying to upgrade an openLdap server from Fedora Core 13 (openldap-servers-2.4.21-11) to Redhat Enterprise 6 (openldap-servers-2.4.23-15.el6.x86_64). In this new setup, my local bdb backend works: I can query the LDAP server on this backend using an "ldaps://" connection (it is using a server certificate). However, the Syncrepl replication process fails to establish the "ldaps://" session to my syncrepl-providers. Indeed, the TLS layer complains that my _server's certificate_ isn't a valid _client certificate_ (with error 8101 - SEC_ERROR_INADEQUATE_CERT_TYPE): but I don't want client-side authentication! In the past syncrepl didn't try to use the server certificate as a client certificate, and I haven't seen any reference to this in the documentation. I first thought it could have been related to ITS#6791 but I don't think so anymore because it only affects Syncrepl. Do you think I've missed something in the setup? Thanks in advance, Thibault Here is an excerpt of slapd startup log in debug-mode: ---------------------------------------------------------- ldap_connect_to_host: Trying 10.10.10.10:636 ldap_pvt_connect: fd: 21 tm: -1 async: 0 TLS: loaded CA certificate file /etc/ssl/cacerts/cacert.pem. TLS: certificate [CN=myldap.mydom.fr,OU=myou,O=myorg,L=myloc,ST=myst,C=FR] is not valid - error -8101:Unknown code ___f 91. TLS: error: unable to set up client certificate authentication for certificate named PEM Token #0:myldap.mydom.fr-cert.pem - 0 TLS: error: unable to set up client certificate authentication using PEM Token #0:myldap.mydom.fr-cert.pem - 0 TLS: error: could not initialize moznss security context - error -8101:Unknown code ___f 91 TLS: can't create ssl handle. slap_client_connect: URI=ldaps://otherldap.mydom.fr DN="cn=myreplicationAccount,dc=mydom,dc=fr" ldap_sasl_bind_s failed (-1) do_syncrepl: rid=125 rc -1 retrying (9 retries left) ---------------------------------------------------------- Here is my syncrepl setup: --------------------------------------------------------- syncrepl rid=125 provider=ldaps://otherldap.mydom.fr type=refreshOnly interval=00:00:03:00 retry="60 10 300 +" searchbase="dc=subranch,dc=mydom,dc=fr" filter="(objectClass=*)" scope=sub schemachecking=off bindmethod=simple binddn="cn=myreplicationAccount,dc=mydom,dc=fr" credentials="MyVerySecretPassword" --------------------------------------------------------- My setup related to TLS: --------------------------------------------------------- TLSCipherSuite HIGH TLSCertificateFile /etc/ssl/certs/myldap.mydom.fr-cert.pem TLSCertificateKeyFile /etc/ssl/keys/myldap.mydom.fr-key.pem TLSCACertificateFile /etc/ssl/cacerts/cacert.pem --------------------------------------------------------- And eventually my /etc/openldap/ldap.conf: --------------------------------------------------------- TLS_CACERT /etc/ssl/cacerts/cacert.pem ---------------------------------------------------------

4 13

Locking SAMBA ccounts with LDAP backend‏
by Michael Starling 12 Jul '11

12 Jul '11

Hello. Is it possible to have SAMBA respect PAM so that when an LDAP accounts gets locked out the SAMBA account simultaneously gets locked out as well? All my windows clients are either 2003 or 2008 servers and if I understand the blurbs below in the samba man page, the "encrypted password" directive must be set to yes in order for Windows machines to authenticate against SAMBA, however if "encrypted passwords" is set to yes then SAMBA will ignore the directive "obey pam restrictions". Is there any way around this? I'm sure you'll let me know if this question is better suited for the samba lists. OS: RHEL 5.5 x64 samba3x-3.5.4-0.70.el5_6.1 openldap-2.3.43-12.el5_6.7 obey pam restrictions (G) When Samba 3.0 is configured to enable PAM support (i.e. --with-pam), this parameter will control whether or not Samba should obey PAMÂ´s account and session management directives. The default behavior is to use PAM for clear text authentication only and to ignore any account or session management. Note that Samba always ignores PAM for authentication in the case of encrypt passwords = yes. The reason is that PAM modules cannot support the challenge/response authentication mechanism needed in the presence of SMB password encryption. encrypt passwords (G) This boolean controls whether encrypted passwords will be negotiated with the client. Note that Windows NT 4.0 SP3 and above and also Windows 98 will by default expect encrypted passwords unless a registry entry is changed. To use encrypted passwords in Samba see the chapter "User Database" in the Samba HOWTO Collection. MS Windows clients that expect Microsoft encrypted passwords and that do not have plain text password support enabled will be able to connect only to a Samba server that has encrypted password support enabled and for which the user accounts have a valid encrypted password. Refer to the smbpasswd command man page for information regarding the creation of encrypted passwords for user accounts. The use of plain text passwords is NOT advised as support for this feature is no longer maintained in Microsoft Windows products. If you want to use plain text passwords you must set this parameter to no. In order for encrypted passwords to work correctly smbd(8) must either have access to a local smbpasswd(5) file (see the smbpasswd(8) program for information on how to set up and maintain this file), or set the security = [server|domain|ads] parameter which causes smbd to authenticate against another server. -Mike

2 2

getent passwd always return 1065 users
by Oliver Schulze L. 11 Jul '11

11 Jul '11

Hi, I have a openldap server in RHEL4 and after the latest update I can only get 1065 users from the command getent passwd: getent passwd | wc -l I have like 15k users. Slapcat list them all. Where should I look for a solution? In the cache size of the DBD, in /etc/ldap.conf, in slapd.conf? Many thanks Oliver -- Oliver Schulze L. Asuncion - Paraguay http://tinymailto.com/oliver

3 3

RE: Multi Master OpenLdap.
by arun.sasi1＠wipro.com 11 Jul '11

11 Jul '11

And also I could see below message nonpresent_callback: rid=003 present UUI Thanks, -Arun From: Arun Sasi V (WI01 - Manage IT) Sent: Monday, July 11, 2011 1:36 PM To: 'E.S. Rosenberg' Cc: openldap-technical(a)openldap.org Subject: RE: Multi Master OpenLdap. Thank you very much Eli for concidering my issue. Here is my scenario... I couldn’t find any abnormality in log files and also I never seen any deletion logs in the server. Slapd will go for hang and some ID`s will get disappear same will be replicate to slaves too. Mainly Groups and Computer accounts I can see some UNBIND and connection lost logs from one server and another multimaster server from Jul 11 04:03:39 gb0135embldap01 slapd[9852]: conn=138411 op=24 SEARCH RESULT tag=101 err=32 nentries=0 text= Jul 11 04:03:39 gb0135embldap01 slapd[9852]: conn=138424 op=12 SRCH base="ou=Groups,dc=emb,dc=slb,dc=com" scope=2 deref=0 filter="(&(objectClass=sambaGroupMapping)(gidNumber=65534))" Jul 11 04:03:39 gb0135embldap01 slapd[9852]: conn=138424 op=12 SRCH attr=gidNumber sambaSID sambaGroupType sambaSIDList description displayName cn objectClass Jul 11 04:03:39 gb0135embldap01 slapd[9852]: conn=138424 op=12 SEARCH RESULT tag=101 err=0 nentries=0 text= Jul 11 04:03:39 gb0135embldap01 slapd[9852]: conn=138415 op=21 SRCH base="sambaDomainName=EMB,sambaDomainName=emb,dc=emb,dc=slb,dc=com" scope=2 deref=0 filter="(&(objectClass=sambaTrustedDomainPassword)(sambaDomainName=emb))" Jul 11 04:03:39 gb0135embldap01 slapd[9852]: conn=138415 op=21 SEARCH RESULT tag=101 err=32 nentries=0 text= Jul 11 04:03:39 gb0135embldap01 slapd[9852]: conn=138385 op=46 SRCH base="ou=Groups,dc=emb,dc=slb,dc=com" scope=2 deref=0 filter="(&(objectClass=sambaGroupMapping)(|(displayName=test)(cn=test)))" Jul 11 04:03:39 gb0135embldap01 slapd[9852]: conn=138385 op=46 SRCH attr=gidNumber sambaSID sambaGroupType sambaSIDList description displayName cn objectClass Jul 11 04:03:39 gb0135embldap01 slapd[9852]: <= bdb_equality_candidates: (displayName) not indexed Jul 11 04:03:39 gb0135embldap01 slapd[9852]: <= bdb_equality_candidates: (cn) not indexed Jul 11 04:07:53 gb0135embldap01 slapd[21335]: @(#) $OpenLDAP: slapd 2.4.15 (Mar 19 2009 10:07:59) $ ^Ibuildd@yellow:/build/buildd/openldap-2.4.15/debian/build/servers/slapd Jul 11 04:07:54 gb0135embldap01 slapd[21337]: slapd starting Jul 11 04:07:54 gb0135embldap01 slapd[21337]: conn=0 fd=23 ACCEPT from IP=[::1]:57016 (IP=[::]:389) Jul 11 04:07:54 gb0135embldap01 slapd[21337]: conn=1 fd=24 ACCEPT from IP=134.32.44.37:40763 (IP=0.0.0.0:389) OLCDATABSE dn: olcDatabase={1}hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=emb,dc=slb,dc=com olcAccess: {0}to attrs=userPassword,shadowLastChange,sambaLMPassword,sambaNTPassword by dn="cn=admin,dc=emb,dc=slb,dc=com" write by dn="cn=sunone-replication,dc=emb,dc=slb,dc=com" peername.ip=136.250.9.48 write by dn="cn=sunone-replication,dc=emb,dc=slb,dc=com" peername.ip=163.185.18.238 write by anonymous auth by self write by * none olcAccess: {1}to dn.base="" by * read #Enable Local Admin to add users in the Group and also SunOne to add users to country groups olcAccess: {2}to dn.subtree="ou=groups,dc=emb,dc=slb,dc=com" by set="user/uid & [cn=group-admin,ou=SuperGroups,dc=emb,dc=slb,dc=com]/memberuid" write by dn="cn=sunone-replication,dc=emb,dc=slb,dc=com" peername.ip=136.250.9.48 write by dn="cn=sunone-replication,dc=emb,dc=slb,dc=com" peername.ip=163.185.18.238 write by * read #Enable Local Admin to add computers olcAccess: {3}to dn.subtree="ou=Computers,dc=emb,dc=slb,dc=com" by set="user/uid & [cn=group-admin,ou=SuperGroups,dc=emb,dc=slb,dc=com]/memberuid" write by * read #Enable shell-admin to set up local user access olcAccess: {4}to attrs=loginShell,homeDirectory by set="user/uid & [cn=shell-admin,ou=SuperGroups,dc=emb,dc=slb,dc=com]/memberuid" write by dn="cn=sunone-replication,dc=emb,dc=slb,dc=com" peername.ip=136.250.9.48 write by dn="cn=sunone-replication,dc=emb,dc=slb,dc=com" peername.ip=163.185.18.238 write by * read #Enable write access to account sun-one-replication for sun ldap replication. olcAccess: {5}to * by dn="cn=admin,dc=emb,dc=slb,dc=com" write by dn="cn=sunone-replication,dc=emb,dc=slb,dc=com" peername.ip=136.250.9.48 write by dn="cn=sunone-replication,dc=emb,dc=slb,dc=com" peername.ip=163.185.18.238 write by * read olcLastMod: TRUE olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq olcDbIndex: entryUUID eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: gidNumber eq olcDbIndex: loginShell eq olcDbIndex: uid eq,pres,sub olcDbIndex: memberUid eq,pres,sub olcDbIndex: uniqueMember eq,pres olcDbIndex: sambaSID eq olcDbIndex: sambaPrimaryGroupSID eq olcDbIndex: sambaGroupType eq olcDbIndex: sambaSIDList eq olcDbIndex: sambaDomainName eq olcDbIndex: default sub structuralObjectClass: olcHdbConfig entryUUID: f479600a-5f34-102f-8ddd-3ff046e70702 creatorsName: cn=admin,cn=config createTimestamp: 20100928101442Z olcRootDN: cn=admin,dc=emb,dc=slb,dc=com olcSyncrepl: {0}rid=003 provider=ldap://gb0135embldap01.emb.slb.com binddn="cn =admin,dc=emb,dc=slb,dc=com" bindmethod=simple credentials=Bsl@121z searchbas e="dc=emb,dc=slb,dc=com" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 starttls=yes olcSyncrepl: {1}rid=004 provider=ldap://ae0042embldap01.emb.slb.com binddn="cn =admin,dc=emb,dc=slb,dc=com" bindmethod=simple credentials=Bsl@121z searchbas e="dc=emb,dc=slb,dc=com" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 starttls=yes olcMirrorMode: TRUE entryCSN: 20100928191927.932499Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20100928191927Z Ldap Version @(#) $OpenLDAP: slapd 2.4.15 (Mar 19 2009 10:07:59) $ Operating system Distributor ID: Ubuntu Description: Ubuntu 9.04 Release: 9.04 Codename: jaunty Thanks, -Arun -----Original Message----- From: E.S. Rosenberg [mailto:esr@g.jct.ac.il] Sent: Monday, July 11, 2011 12:58 PM To: Arun Sasi V (WI01 - Manage IT) Cc: openldap-technical(a)openldap.org Subject: Re: Multi Master OpenLdap. Have you tried raising the loglevel? Are the schemas the same between the servers? Is time in sync between the servers? What versions are you dealing with? You don't provide a lot of info and most of us are not clairvoyant.... Regards, Eli 2011/7/11 <arun.sasi1(a)wipro.com>: > > > > > Thanks, > > -Arun > > > > From: Arun Sasi V (WI01 - Manage IT) > Sent: Wednesday, July 06, 2011 5:46 PM > To: 'openldap-technical(a)openldap.org' > Subject: Multi Master OpenLdap. > > > > Hello Team, > > > > I have configured Multi-master Mirror mode replica setup in our environment. > We have 3 regions slave Ldap server which is read only and two location we > have configured as mirror mode replica Ldap. My problem here is… > > > > Master Ldap is going hang some times and some ID`s are disappearing from the > master server. I couldn’t find any logs over there for why ID`s are > disappearing and also why Ldap is going hung state. > > > > Thanks & Regards, > > Arun Sasi V > > Please do not print this email unless it is absolutely necessary. > > The information contained in this electronic message and any attachments to > this message are intended for the exclusive use of the addressee(s) and may > contain proprietary, confidential or privileged information. If you are not > the intended recipient, you should not disseminate, distribute or copy this > e-mail. Please notify the sender immediately and destroy all copies of this > message and any attachments. > > WARNING: Computer viruses can be transmitted via email. The recipient should > check this email and any attachments for the presence of viruses. The > company accepts no liability for any damage caused by any virus transmitted > by this email. > > www.wipro.com Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

1 0

RE: Multi Master OpenLdap.
by arun.sasi1＠wipro.com 11 Jul '11

11 Jul '11

Thank you very much Eli for concidering my issue. Here is my scenario... I couldn’t find any abnormality in log files and also I never seen any deletion logs in the server. Slapd will go for hang and some ID`s will get disappear same will be replicate to slaves too. Mainly Groups and Computer accounts I can see some UNBIND and connection lost logs from one server and another multimaster server from Jul 11 04:03:39 gb0135embldap01 slapd[9852]: conn=138411 op=24 SEARCH RESULT tag=101 err=32 nentries=0 text= Jul 11 04:03:39 gb0135embldap01 slapd[9852]: conn=138424 op=12 SRCH base="ou=Groups,dc=emb,dc=slb,dc=com" scope=2 deref=0 filter="(&(objectClass=sambaGroupMapping)(gidNumber=65534))" Jul 11 04:03:39 gb0135embldap01 slapd[9852]: conn=138424 op=12 SRCH attr=gidNumber sambaSID sambaGroupType sambaSIDList description displayName cn objectClass Jul 11 04:03:39 gb0135embldap01 slapd[9852]: conn=138424 op=12 SEARCH RESULT tag=101 err=0 nentries=0 text= Jul 11 04:03:39 gb0135embldap01 slapd[9852]: conn=138415 op=21 SRCH base="sambaDomainName=EMB,sambaDomainName=emb,dc=emb,dc=slb,dc=com" scope=2 deref=0 filter="(&(objectClass=sambaTrustedDomainPassword)(sambaDomainName=emb))" Jul 11 04:03:39 gb0135embldap01 slapd[9852]: conn=138415 op=21 SEARCH RESULT tag=101 err=32 nentries=0 text= Jul 11 04:03:39 gb0135embldap01 slapd[9852]: conn=138385 op=46 SRCH base="ou=Groups,dc=emb,dc=slb,dc=com" scope=2 deref=0 filter="(&(objectClass=sambaGroupMapping)(|(displayName=test)(cn=test)))" Jul 11 04:03:39 gb0135embldap01 slapd[9852]: conn=138385 op=46 SRCH attr=gidNumber sambaSID sambaGroupType sambaSIDList description displayName cn objectClass Jul 11 04:03:39 gb0135embldap01 slapd[9852]: <= bdb_equality_candidates: (displayName) not indexed Jul 11 04:03:39 gb0135embldap01 slapd[9852]: <= bdb_equality_candidates: (cn) not indexed Jul 11 04:07:53 gb0135embldap01 slapd[21335]: @(#) $OpenLDAP: slapd 2.4.15 (Mar 19 2009 10:07:59) $ ^Ibuildd@yellow:/build/buildd/openldap-2.4.15/debian/build/servers/slapd Jul 11 04:07:54 gb0135embldap01 slapd[21337]: slapd starting Jul 11 04:07:54 gb0135embldap01 slapd[21337]: conn=0 fd=23 ACCEPT from IP=[::1]:57016 (IP=[::]:389) Jul 11 04:07:54 gb0135embldap01 slapd[21337]: conn=1 fd=24 ACCEPT from IP=134.32.44.37:40763 (IP=0.0.0.0:389) OLCDATABSE dn: olcDatabase={1}hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=emb,dc=slb,dc=com olcAccess: {0}to attrs=userPassword,shadowLastChange,sambaLMPassword,sambaNTPassword by dn="cn=admin,dc=emb,dc=slb,dc=com" write by dn="cn=sunone-replication,dc=emb,dc=slb,dc=com" peername.ip=136.250.9.48 write by dn="cn=sunone-replication,dc=emb,dc=slb,dc=com" peername.ip=163.185.18.238 write by anonymous auth by self write by * none olcAccess: {1}to dn.base="" by * read #Enable Local Admin to add users in the Group and also SunOne to add users to country groups olcAccess: {2}to dn.subtree="ou=groups,dc=emb,dc=slb,dc=com" by set="user/uid & [cn=group-admin,ou=SuperGroups,dc=emb,dc=slb,dc=com]/memberuid" write by dn="cn=sunone-replication,dc=emb,dc=slb,dc=com" peername.ip=136.250.9.48 write by dn="cn=sunone-replication,dc=emb,dc=slb,dc=com" peername.ip=163.185.18.238 write by * read #Enable Local Admin to add computers olcAccess: {3}to dn.subtree="ou=Computers,dc=emb,dc=slb,dc=com" by set="user/uid & [cn=group-admin,ou=SuperGroups,dc=emb,dc=slb,dc=com]/memberuid" write by * read #Enable shell-admin to set up local user access olcAccess: {4}to attrs=loginShell,homeDirectory by set="user/uid & [cn=shell-admin,ou=SuperGroups,dc=emb,dc=slb,dc=com]/memberuid" write by dn="cn=sunone-replication,dc=emb,dc=slb,dc=com" peername.ip=136.250.9.48 write by dn="cn=sunone-replication,dc=emb,dc=slb,dc=com" peername.ip=163.185.18.238 write by * read #Enable write access to account sun-one-replication for sun ldap replication. olcAccess: {5}to * by dn="cn=admin,dc=emb,dc=slb,dc=com" write by dn="cn=sunone-replication,dc=emb,dc=slb,dc=com" peername.ip=136.250.9.48 write by dn="cn=sunone-replication,dc=emb,dc=slb,dc=com" peername.ip=163.185.18.238 write by * read olcLastMod: TRUE olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq olcDbIndex: entryUUID eq olcDbIndex: uidNumber eq olcDbIndex: gidNumber eq olcDbIndex: gidNumber eq olcDbIndex: loginShell eq olcDbIndex: uid eq,pres,sub olcDbIndex: memberUid eq,pres,sub olcDbIndex: uniqueMember eq,pres olcDbIndex: sambaSID eq olcDbIndex: sambaPrimaryGroupSID eq olcDbIndex: sambaGroupType eq olcDbIndex: sambaSIDList eq olcDbIndex: sambaDomainName eq olcDbIndex: default sub structuralObjectClass: olcHdbConfig entryUUID: f479600a-5f34-102f-8ddd-3ff046e70702 creatorsName: cn=admin,cn=config createTimestamp: 20100928101442Z olcRootDN: cn=admin,dc=emb,dc=slb,dc=com olcSyncrepl: {0}rid=003 provider=ldap://gb0135embldap01.emb.slb.com binddn="cn =admin,dc=emb,dc=slb,dc=com" bindmethod=simple credentials=Bsl@121z searchbas e="dc=emb,dc=slb,dc=com" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 starttls=yes olcSyncrepl: {1}rid=004 provider=ldap://ae0042embldap01.emb.slb.com binddn="cn =admin,dc=emb,dc=slb,dc=com" bindmethod=simple credentials=Bsl@121z searchbas e="dc=emb,dc=slb,dc=com" type=refreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 starttls=yes olcMirrorMode: TRUE entryCSN: 20100928191927.932499Z#000000#001#000000 modifiersName: cn=admin,cn=config modifyTimestamp: 20100928191927Z Ldap Version @(#) $OpenLDAP: slapd 2.4.15 (Mar 19 2009 10:07:59) $ Operating system Distributor ID: Ubuntu Description: Ubuntu 9.04 Release: 9.04 Codename: jaunty Thanks, -Arun -----Original Message----- From: E.S. Rosenberg [mailto:esr@g.jct.ac.il] Sent: Monday, July 11, 2011 12:58 PM To: Arun Sasi V (WI01 - Manage IT) Cc: openldap-technical(a)openldap.org Subject: Re: Multi Master OpenLdap. Have you tried raising the loglevel? Are the schemas the same between the servers? Is time in sync between the servers? What versions are you dealing with? You don't provide a lot of info and most of us are not clairvoyant.... Regards, Eli 2011/7/11 <arun.sasi1(a)wipro.com>: > > > > > Thanks, > > -Arun > > > > From: Arun Sasi V (WI01 - Manage IT) > Sent: Wednesday, July 06, 2011 5:46 PM > To: 'openldap-technical(a)openldap.org' > Subject: Multi Master OpenLdap. > > > > Hello Team, > > > > I have configured Multi-master Mirror mode replica setup in our environment. > We have 3 regions slave Ldap server which is read only and two location we > have configured as mirror mode replica Ldap. My problem here is… > > > > Master Ldap is going hang some times and some ID`s are disappearing from the > master server. I couldn’t find any logs over there for why ID`s are > disappearing and also why Ldap is going hung state. > > > > Thanks & Regards, > > Arun Sasi V > > Please do not print this email unless it is absolutely necessary. > > The information contained in this electronic message and any attachments to > this message are intended for the exclusive use of the addressee(s) and may > contain proprietary, confidential or privileged information. If you are not > the intended recipient, you should not disseminate, distribute or copy this > e-mail. Please notify the sender immediately and destroy all copies of this > message and any attachments. > > WARNING: Computer viruses can be transmitted via email. The recipient should > check this email and any attachments for the presence of viruses. The > company accepts no liability for any damage caused by any virus transmitted > by this email. > > www.wipro.com Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

1 0

RE: Multi Master OpenLdap.
by arun.sasi1＠wipro.com 11 Jul '11

11 Jul '11

Thanks, -Arun From: Arun Sasi V (WI01 - Manage IT) Sent: Wednesday, July 06, 2011 5:46 PM To: 'openldap-technical(a)openldap.org' Subject: Multi Master OpenLdap. Hello Team, I have configured Multi-master Mirror mode replica setup in our environment. We have 3 regions slave Ldap server which is read only and two location we have configured as mirror mode replica Ldap. My problem here is... Master Ldap is going hang some times and some ID`s are disappearing from the master server. I couldn't find any logs over there for why ID`s are disappearing and also why Ldap is going hung state. Thanks & Regards, Arun Sasi V Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

1 0

whose responsability
by Friedrich Locke 10 Jul '11

10 Jul '11

Hi, i have installed and configured openldap and so far, so good. But i have a simple doubt. Up to now, all users i have added to the ldap server have a field: userPassword: {SASL}user@domain I am connecting to retrieve the entry attributes with the following command: ldapsearch -x -w PASSWORD -D uid=user,ou=people,dc=my,dc=domain -b uid=user,ou=people,dc=my,dc=domain And everyting works ok. My doubt is: who is performing the password checking? The openldap server daemon (slapd) ou the ldapsearch ? Thanks in advance. Regards, Friedrich

2 3

selective services in an LDAP based CAS setup
by Joe Steeve 09 Jul '11

09 Jul '11

Hello all, We are using OpenLDAP to provide a common authentication back-end for mail, samba and a couple of web-applications. We want to selectively enable/disable services (mail, samba, etc.) for some users based on management policy. What is the best way to do it using LDAP? Regards, Joe -- .o. I'm a Free man. I use Free Software. ..o ooo http://www.joesteeve.org/

1 0

exact/base
by Friedrich Locke 08 Jul '11

08 Jul '11

Hi, may someone here explain me the difference between dn.exact and dn.base ? Thanks in advance.

3 4

limits
by Friedrich Locke 08 Jul '11

08 Jul '11

Hi, i have setted some limits in slapd.conf: limits dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" time=2048 size=16384 limits dn.one="ou=people,dc=ufv,dc=br" time=4 size=1 But my log shows: /etc/openldap/slapd.conf : line 80: deprecated "one" style "limits <pattern> <limits>" line; use "onelevel" instead. The error message is showed only for limits definition. My access rules uses "one" and i get no complains in the log file, why? Thanks in advance.

2 1

Simple Bind w/TLS without SASL/Kerberos possible to AD?
by David Mitton 08 Jul '11

08 Jul '11

I am trying to use OpenLDAP from an embedded Linux system to authenticate (PAM LDAP) against a Windows AD server. I must use TLS to secure this, but I would rather not use SASL or Kerberos if possible. I have been able to mock this up on a Centos system without TLS, and the PAM worked fine. When I turn on TLS, the Windows server handshakes the TLS but then has a problem with the first message. I am also working that side. I have walked through the handshake with s_client, and the connection is happy. I am now working with ldapsearch and trying things.... The first thing I notice is that it seems to try an SASL bind. Can I stop this? I'm not sure I have SASL actually installed on this system, and I'm not sure I want it in my target. Is this possible? from both the OpenLDAP client and/or Windows AD? Ideas on the correct alphabet soup to try this with ldapsearch would be appreciated. Thanks.

3 2

translucent proxy question
by Conger,Keith 07 Jul '11

07 Jul '11

Hi, Does anyone now if its possible to write changes through a translucent proxy to the back ldap server its in front of? Every time I try an add or remove it does it against the translucent database. The account I'm using exists on the back ldap server with the proper rights to modify attributes. After much searching I can't seem to find an answer. Thanks in Advance Keith -- Keith Conger

1 0

ldap_sasl_interactive_bind_s: Other (e.g., implementation specific ) error (80)
by Fabien COMBERNOUS 07 Jul '11

07 Jul '11

Hi There, I have an openldap master (hosted by server) and an openldap replica (hosted by replica). Authentication use SASL/GSSAPI with kerberos. On the master i get the following output : server:~ admin$ kinit root Please enter the password for root(a)SERVER.LAN: server:~ admin$ ldapsearch -b cn=mounts,dc=server,dc=lan SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Other (e.g., implementation specific ) error (80) On the replica all looks fine : replica:~ admin$ kinit root Please enter the password for root(a)SERVER.LAN: server:~ admin$ ldapsearch -b cn=mounts,dc=server,dc=lan SASL/GSSAPI authentication started SASL username: root(a)SERVER.LAN SASL SSF: 56 SASL data security layer installed. # extended LDIF # # LDAPv3 # base <cn=mounts,dc=server,dc=lan> with scope subtree # filter: (objectclass=*) # requesting: ALL # etc ... I saw some thread on mailing list that say to take care of owner, groups and permissions of files krb5.keytab and database. All looks good in this side. Any other areas to check ? Regards, -- *Fabien COMBERNOUS* /unix system engineer/ www.kezia.com <http://www.kezia.com/> *Tel: +33 (0) 467 992 986* Kezia Group

2 2

rewrite answers from AD.
by Agent Smith 07 Jul '11

07 Jul '11

I have slapd configured to proxy off of AD and that is working fine but I need to rewrite the phone number part of the AD answer to read 9xxx-xxx-xxxx from the original answer of xxx-xxx-xxxx so that the IP phones can dial them by clicking on the ldap search results. an example would help. when I query the AD with ldapsearch I get this field telephoneNumber: xxx-xxx-xxxx what I need is that field to read 9xxx-xxx-xxxx The IP phones need that field to read 9xxx-xxx-xxxx before they can use it so I configured a proxy thinking I will use rwm-rewrite to reformat that answer but I am having a devil of a time trying to figure out how, there is an example on how to 'eat blanks' on a cn filed answer so that a field with name, last_name will read name,lastname but I can't even get that to work even when I copy/paste it right from the man page of slap-rwm here are relevent parts of slapd.conf, any suggestions? I compiled slapd with ./configure --enable-rewrite=yes --enable-rwm=yes --enable-ldap=yes --enable-syslog ; database ldap #uri "ldap://ldap.yyy.zzz.edu:389/OU=xxx,DC=yyy,DC=zzz,DC=edu"; uri "ldap://ldap.yyy.zzz.edu:389" lastmod off chase-referrals no suffix "DC=yyy,DC=zzz,DC=edu" acl-bind bindmethod=simple binddn="CN=Radius Ldap,OU=System Accounts,OU=MSIS,OU=Administration,OU=xxx,DC=yyy,DC=zzz,DC=edu" credentials="password" idassert-bind bindmethod=simple binddn="CN=Radius Ldap,OU=System Accounts,OU=MSIS,OU=Administration,OU=xxx,DC=yyy,DC=zzz,DC=edu" credentials="password" mode=self idassert-authzFrom "dn.regex:.*" access to dn.subtree="DC=yyy,DC=zzz,DC=edu" by * read # The last rwm-map line maps all other attributes to nothing. overlay rwm rwm-rewriteEngine on rwm-rewriteContext eatblanks #rwm-rewriteRule "(.+)2C (.+)" "$1\,$2" #rwm-rewriteRule "([^,]+), ([^,]+)" "$1,$2" rwm-rewriterule "(.*), (.*)" "$1,$2" #rwm-rewriterule "^(.*), (.*)$" "$1,$2" rwm-map attribute uid sAMAccountname #rwm-map attribute cn cn rwm-map attribute * *

2 2

Re: access
by Friedrich Locke 07 Jul '11

07 Jul '11

How may i know i setted SASL/GSSAPI correctly ? Here is how i executed saslauthd: saslauthd -a kerberos5 -cd -t 60 -n 2 -s 128 Here is a test: sioux@gustav$ testsaslauthd -u sioux -p XYZ 0: OK "Success." sioux@gustav$ Is there something more i need to do ? Thanks. On Tue, Jun 28, 2011 at 3:04 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, June 28, 2011 3:02 PM -0300 Friedrich Locke > <friedrich.locke(a)gmail.com> wrote: > >> Sorry folks, >> >> please forgive me, i forgot to let you know i am using kerberos >> (SASL); so i bind via sasl mechanism not as the dn owned by me. >> >> Thanks once more for your help. > > If you have correctly set up SASL/GSSAPI, then when someone binds, they are > mapped to their DN in the database, and the access rules I reported would > work correclty. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

4 5

Build a "fake" LDAP
by Joao Robertson Kramer Santana 07 Jul '11

07 Jul '11

Hi, I have an Oracle database table with usernames and their encryted passwords. I would like to build an LDAP Server only for authentication. It should communicate with the client, receive the username/password, and make the authentication using the Oracle database table. I just want the clients to expect ('think') they are 'talking' with a true LDAP Server, but in fact it's just an application (Java Servlet) that uses the LDAP protocol between the client/server for authentication. In other words, the client does not know what happens inside the server, and the server does not use a true LDAP infrastructure. Does anybody has an ideia of how can I implement it? Is it possible to use OpenLDAP to simulate the conversation between the server and a client? I would appreciate any help. Thanks in advance. Jkramer

2 1

Strange olcDbDirectory permission error
by Ian Collins 07 Jul '11

07 Jul '11

Hello, I'm in the process of copying a server configuration to an Ubuntu server and I'm getting a very strange error on start up: Jul 7 14:46:03 Ubuntu64 slapd[5079]: config error processing olcDatabase={1}hdb,cn=config: olcDbDirectory: value #0: invalid path: Permission denied strace shows: [pid 5079] open("/opt/local/var/run/openldap//DUMMY", O_WRONLY|O_CREAT|O_TRUNC, 0666) = -1 EACCES (Permission denied) Even with the directory writeable to all: drwxrwxrwx 2 openldap openldap 4096 2011-07-07 14:29 /opt/local/var/run/openldap/ Any ideas? -- Ian.

2 4

RE: allow or deny certain user access to certain hosts
by ldap＠mm.st 06 Jul '11

06 Jul '11

On Sat, 18 Jun 2011 22:13 -0700, "Hai Tao" <taoh666(a)hotmail.com> wrote: > > Yes, I tried to add a host attribute, but I got object class violation > error. Any idea? > > > Thanks. > > Hai Tao > > > Did you ever resolve this? You don't mention which OS you are using, but in standard RH5 you can do try this. 1. Install nss_ldap 2. copy /usr/share/doc/nss_ldap-253/ldapns.schema /etc/openldap/schema/ldapns.schema This will provide the hostObject objectClass 3. In slapd.conf include /etc/openldap/schema/ldapns.schema 4. In a users ldap record add objectClass: hostObject 5. In the users ldap record add host: hostname 6. Modify the hosts ldap.conf file: pam_check_host_attr yes Doing this from memory, but I think that should be enough to get what you want to work on a RH5 system. RH6 uses some different files on the host. BTW, you can also use the account objectClass to provide the host attribute, but my guess is that it will most likely conflict with another structural object class.

1 1

Updating Shema in cn=config
by Andy Carlson 06 Jul '11

06 Jul '11

I have recently updated the schema (added new attributes) via the cn=config LDAP context. Once I do this, do changes get saved in real-time to the local configuration files or would I have to stop and restart the service to save the settings? Thanks much, Andy Carlson Identity Administrator | Information Systems 312-329-4385

1 0

Multi Master OpenLdap.
by arun.sasi1＠wipro.com 06 Jul '11

06 Jul '11

Hello Team, I have configured Multi-master Mirror mode replica setup in our environment. We have 3 regions slave Ldap server which is read only and two location we have configured as mirror mode replica Ldap. My problem here is... Master Ldap is going hang some times and some ID`s are disappearing from the master server. I couldn't find any logs over there for why ID`s are disappearing and also why Ldap is going hung state. Thanks & Regards, Arun Sasi V Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

1 0

schema updates and cn=config
by E.S. Rosenberg 06 Jul '11

06 Jul '11

Hi all, I was wondering about the following thing (after just reading the long cn=config thread), programs may distribute .schema files only, in which case as already pointed out you should: 1. Request in a friendly manner that they provide an ldif if possible 2. convert it yourself using slaptest and add it using ldapadd/modiy etc. The question I had is like this, a project may update/change it's schema and if they ship only .schema files or .ldif that assume that the schema is not loaded yet (ie. that do the initial add and not modify operations, what you would also get from a .schema conversion) then you are it would seem to me a bit stuck because you either: - have to unload the old schemas (using ldapmodify) which leaves you with invalid entries in your DIT while their schema is missing or - you have to manually figure out what the differences are between the currently loaded schema and the new version of the schema (diff may be helpful there) and the manually create an ldif that does all the necessary modify operations. So I was wondering if there is any way to generate a "diff-ldif" (for lack of a better name) automatically to update the schema based either on provided ldifs or provided .schema files (after conversion). Obviously the other way is to ask the project in a friendly way that they provide said "diff-ldifs" as well as regular ldifs. Maybe I am completely wrong but so far this is what I understood from all the manuals etc. Thanks for all your great work, Eli

3 2

Fwd: ldap_sasl_interactive_bind_s: Other (e.g., implementation specific ) error (80)
by Fabien COMBERNOUS 06 Jul '11

06 Jul '11

Here a test. I didn't receive my own mail. This mail was it received by the list ? -------- Original Message -------- Subject: ldap_sasl_interactive_bind_s: Other (e.g., implementation specific ) error (80) Date: Tue, 05 Jul 2011 17:52:54 +0200 From: Fabien COMBERNOUS <fcombernous(a)kezia.com> To: openldap-technical(a)openldap.org Hi There, I have an openldap master (hosted by server) and an openldap replica (hosted by replica). Authentication use SASL/GSSAPI with kerberos. On the master i get the following output : server:~ admin$ kinit root Please enter the password for root(a)SERVER.LAN: server:~ admin$ ldapsearch -b cn=mounts,dc=server,dc=lan SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Other (e.g., implementation specific ) error (80) On the replica all looks fine : replica:~ admin$ kinit root Please enter the password for root(a)SERVER.LAN: server:~ admin$ ldapsearch -b cn=mounts,dc=server,dc=lan SASL/GSSAPI authentication started SASL username: root(a)SERVER.LAN SASL SSF: 56 SASL data security layer installed. # extended LDIF # # LDAPv3 # base<cn=mounts,dc=server,dc=lan> with scope subtree # filter: (objectclass=*) # requesting: ALL # etc ... I saw some thread on mailing list that say to take care of owner, groups and permissions of files krb5.keytab and database. All looks good in this side. Any other areas to check ? Regards, -- *Fabien COMBERNOUS* /unix system engineer/ www.kezia.com<http://www.kezia.com/> *Tel: +33 (0) 467 992 986* Kezia Group

1 0

database monitor
by Friedrich Locke 06 Jul '11

06 Jul '11

I have configured database monitor and setted two access rules in its context. By the log messages below keep annoying me: /etc/openldap/slapd.conf: line 110: warning: cannot assess the validity of the ACL scope within backend naming context Backend ACL: access to dn.subtree="cn=monitor" by dn.base="cn=oldap,dc=ufv,dc=br" read by * none Backend ACL: access to * by * none /etc/openldap/slapd.conf: line 123: warning: cannot assess the validity of the ACL scope within backend naming context Backend ACL: access to * by * none config_back_db_open: line 0: warning: cannot assess the validity of the ACL scope within backend naming context slapd starting How may i "fix" that. (Altough i used the word "fix", i know it is not a error message). Thanks in advance

3 5

problem with the ppolicy overlay
by Cyril Grosjean 05 Jul '11

05 Jul '11

2 1

dumping
by Friedrich Locke 05 Jul '11

05 Jul '11

Hi, i would like to restore data generated by slapcat. I realized some field (like userPassword) in the lidf file generated was encoded in base64. How should i restore the ldif with slapadd taking the real value string for the attribute without redefined attribute value. Thanks in advance

2 1

server side sorting
by Chris Card 05 Jul '11

05 Jul '11

Hi, this FAQ http://www.openldap.org/faq/data/cache/649.html says that openldap 2.3 doesn't support Server Side Sorting (RFC 2891). Looking at openldap 2.4.23, it seems that Server Side Sorting is now supported - is this documented somewhere? Chris

7 21

deleting tree
by Friedrich Locke 05 Jul '11

05 Jul '11

I am trying to delete a complete tree, but i got the error messages: ldap_delete: Other (e.g., implementation specific) error (80) ldap_prune: Other (e.g., implementation specific) error (80) ldap_delete: Operation not allowed on non-leaf (66) additional info: subordinate objects must be deleted first But when i remove from /etc/openldap/slapd.conf the line: index cn,uid eq I can delete perfectly. Does anybody know why?

1 0

slapd "vs." db_archive
by Peter Palmreuther 04 Jul '11

04 Jul '11

Hello, I tried to use 'db_archive' to figure, which of those many log.* files already accumulated I can safely remove. Unluckily it didn't print any name, albeit there're 170 file and according to 'fuser log.*' only the last one is held open by a process (the slapd one). After restarting slapd db_archive prints 169 file names, to be precise all but the last. So it seems slapd keeps used BDB in a state it does not release the logs for archival and removal. I assume it's me that has to configure slapd or BDB environment appropriately, but unluckily I don't know which setting would have the desired effect. Any help on this? I tried to find something in Admin Guide and man pages, but I must have missed it. I only saw auto remove settings, which is not what I was out for ... I want to remove by myself, after keeping a backup for recovery. I'm using OpenLDAP 2.4.20 compiled against Berkeley 4.7. Thank for any help, and regards, Peter

2 3

Re: cannot access entries
by ian logan 04 Jul '11

04 Jul '11

Why not adjust your logLevel to include ACL processing, its usually very informative. On Jul 4, 2011, at 1:23 PM, Friedrich Locke wrote: > This is for learning purposes, the password will not be that one on a > production system. > ypldap access is just before any other more restrictive. > > My questions still remains: how may i have a listing of entry directly > below (one level only) a given base ? > Searching with a filter is interest too. But i am being prevented. > Does anybody here know how it could be done given my access rules on > the prior email ? > > Thanks once more. > > > On Mon, Jul 4, 2011 at 4:01 PM, Chris Jacobs <Chris.Jacobs(a)apollogrp.edu> wrote: >> The ypldap access should be before the one that limits more - the more restrictive one will match first. >> >> If that account is intended as you main 'root'-ish account, it should probably be granted access to all right off the bat. >> >> Also: change your ldap password now. (I've done this; sent a password to the mailing list - dumb). >> >> - chris >> >> Chris Jacobs, Systems Administrator, Technology Services Group >> Apollo Group | Apollo Marketing & Product Development | Aptimus, Inc. >> 2001 6th Ave | Ste 3200 | Seattle, WA 98121 >> phone: 206.839-8245 | cell: 206.601.3256 | Fax: 208.441.9661 >> email: chris.jacobs(a)apollogrp.edu >> >> ----- Original Message ----- >> From: openldap-technical-bounces(a)OpenLDAP.org <openldap-technical-bounces(a)OpenLDAP.org> >> To: openldap-technical(a)openldap.org <openldap-technical(a)openldap.org> >> Sent: Mon Jul 04 11:19:45 2011 >> Subject: cannot access entries >> >> Hi list members, >> >> i am trying to configure accesses to my ldap server, but i am doing >> some wrong i am not aware about. The access list is below: >> >> access to dn.one="ou=appsrv,dc=ufv,dc=br" attrs=userpassword >> by self read >> by anonymous auth >> by * none >> >> access to dn.one="ou=appsrv,dc=ufv,dc=br" >> by self read >> by * none >> >> access to dn.one="ou=people,dc=ufv,dc=br" attrs=userpassword >> by self read >> by anonymous auth >> by * none >> >> access to dn.one="ou=people,dc=ufv,dc=br" >> by self read >> by dn.exact="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read >> by * none >> >> access to dn.one="ou=group,dc=ufv,dc=br" >> by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read >> by * none >> >> >> ======================================= >> >> The command i am executing and its output is below >> >> sioux@gustav$ ldapsearch -x -w ypldapA4esuopdV -D >> cn=ypldap,ou=appsrv,dc=ufv,dc=br -b ou=people,dc=ufv,dc=br -s one >> # extended LDIF >> # >> # LDAPv3 >> # base <ou=people,dc=ufv,dc=br> with scope oneLevel >> # filter: (objectclass=*) >> # requesting: ALL >> # >> >> # search result >> search: 2 >> result: 32 No such object >> >> # numResponses: 1 >> sioux@gustav$ >> >> Why am i not getting a list of entries below ou=people,dc=ufv,dc=br ? >> >> Thanks in advance. >> >> >> >> This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system. >> >> >> >

1 0

Status of support for draft-wahl-ldap-session
by Michael Ströder 04 Jul '11

04 Jul '11

HI! It seems there is support for draft-wahl-ldap-session in OpenLDAP's source since 2007 but it seems not to be enabled in a default build. Is it sufficient to compile with -DSLAP_CONTROL_X_SESSION_TRACKING or do I also have to use -DLDAP_DEVEL (because of ifdef in ldap.h). The latter does not work with 2.4.26... Should I file an ITS for it? Ciao, Michael.

1 1

cannot access entries
by Friedrich Locke 04 Jul '11

04 Jul '11

Hi list members, i am trying to configure accesses to my ldap server, but i am doing some wrong i am not aware about. The access list is below: access to dn.one="ou=appsrv,dc=ufv,dc=br" attrs=userpassword by self read by anonymous auth by * none access to dn.one="ou=appsrv,dc=ufv,dc=br" by self read by * none access to dn.one="ou=people,dc=ufv,dc=br" attrs=userpassword by self read by anonymous auth by * none access to dn.one="ou=people,dc=ufv,dc=br" by self read by dn.exact="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read by * none access to dn.one="ou=group,dc=ufv,dc=br" by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read by * none ======================================= The command i am executing and its output is below sioux@gustav$ ldapsearch -x -w ypldapA4esuopdV -D cn=ypldap,ou=appsrv,dc=ufv,dc=br -b ou=people,dc=ufv,dc=br -s one # extended LDIF # # LDAPv3 # base <ou=people,dc=ufv,dc=br> with scope oneLevel # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 32 No such object # numResponses: 1 sioux@gustav$ Why am i not getting a list of entries below ou=people,dc=ufv,dc=br ? Thanks in advance.

2 2

problem with pwdReset
by Cyril Grosjean 04 Jul '11

04 Jul '11

2 1

cn=config and plugins
by Hanns Mattes 04 Jul '11

04 Jul '11

Hi, I'm interested in using the slapi-dnsnotify-plugin to notify slaves of changes in the pdns-server. There's an example configuration using slapd.conf[1], but I'd like to know how a plugin is configured using cn=config. Distribution ist Opensuse 11.3 zypper info shows: Name: openldap2 Version: 2.4.21-10.3.1 Arch: x86_64 (As far as I understand the *.spec-file, plugins aren't enabled in this built, so I'll have to compile my own version. Or am I wrong?) Any advice? Please let me know, if any further information is required (and please be patient, as my writing and understanding in english is limited :-)) TIA Hanns Mattes [1] http://thewalter.net/stef/software/slapi-dnsnotify/configuration.html

1 0

how to configure use of tls w/ rwm-rewritemap
by Ron Peterson 02 Jul '11

02 Jul '11

Hi, I have a rewrite map configured like: database ldap suffix "ou=myou" uri "ldap://my.backend/" tls start tls_cacertdir=/my/ca/cert/dir rwm-rewriteMap ldap uid2adminDN "ldap://my.backend/ou=yada,dc=yada?dn?sub" binddn="uid=someone,..." credentials="etc" My back end is configured to require tls, i.e. security ssf=128 update_ssf=128 simple_bind=128 If I remove that requirement, everything works. When I add it, my back end ldap server logs: Jul 1 09:24:28 mid slapd[13011]: conn=1006 op=0 BIND dn="uid=someone,..." method=128 Jul 1 09:24:28 mid slapd[13011]: conn=1006 op=0 RESULT tag=97 err=13 text=confidentiality required How do I configure rwm-rewritemap to use tls? -Ron-

2 3

stange log
by Friedrich Locke 01 Jul '11

01 Jul '11

I am seeing the log messages below on my openldap installation: @(#) $OpenLDAP: slapd 2.4.23 (Jun 28 2011 17:55:44) $ @gustav.cpd.ufv.br:/usr/ports/pobj/openldap-2.4.23/build-amd64/servers/slapd Backend ACL: access to dn.subtree="cn=monitor" by dn.base="cn=oldap,dc=ufv,dc=br" read by * none Backend ACL: access to * by * none config_back_db_open: line 0: warning: cannot assess the validity of the ACL scope within backend naming context slapd starting What does it mean? How may i avoid these messages ? What do i need to fix ? Thanks once more.

2 1

schema
by Friedrich Locke 01 Jul '11

01 Jul '11

Hi! Does anybody know where i could download the schema for simpleSecurityObject class ? Thanks in advance.

2 1

Re: schema
by ian logan 01 Jul '11

01 Jul '11

It comes with OpenLDAP, its in the Cosine schema file. On Jul 1, 2011, at 8:18 AM, Friedrich Locke wrote: > Hi! > > Does anybody know where i could download the schema for > simpleSecurityObject class ? > > Thanks in advance. >

1 0

Re: simple binds
by Friedrich Locke 01 Jul '11

01 Jul '11

Quanah, thank you for your support and patience too; now i got it working as i wished. If you come to brasil, let me know and i'll pay you some beers. Fried. On Thu, Jun 30, 2011 at 7:38 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, June 30, 2011 7:22 PM -0300 Friedrich Locke > <friedrich.locke(a)gmail.com> wrote: > >> Is it possible to perform simple binds but looking up the entry's >> password in a kerberos server? > > Please spend some time reading the OpenLDAP documentation. Your question > here is clearly answered in the OpenLDAP Admin guide, section 14.5: > > <http://www.openldap.org/doc/admin24/security.html> > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

cn=config completely replacing slapd.conf
by David N. Blank-Edelman 01 Jul '11

01 Jul '11

(taking this to a new thread) Sorry for such a vague question, but my (perhaps failing) memory is once upon a time there were still certain backends or overlays that couldn't yet be configured via cn=config and had to be specified in slapd.conf. Has 2.4 has already cleared up all of those legacy configuration requirements or is that a 2.5 goal? Thanks! -- dNb

5 5

How to configure OpenLdap Client to work with Windows Active Directory
by yen nguyen 01 Jul '11

01 Jul '11

Hi, Can ldapsearch work with Windows AD via GSSAPI? Is there any special setting/software I need to do on the client side? On my Client system, I have Windows openldap client tools (ldapsearch ....etc). My Server system has Windows AD running. I was able to use Simple Authentication and it worked. ldapsearch.exe -H ldap://MPSD-EB01T3/ -b "dc=test,dc=com" -x I know Windows 2008 AD support GSSAPI. ldapsearch -H ldap://MPSD-EB01T3/ -xLLL -s base -b "" supportedSASLMechanisms dn: supportedSASLMechanisms: GSSAPI supportedSASLMechanisms: GSS-SPNEGO supportedSASLMechanisms: EXTERNAL supportedSASLMechanisms: DIGEST-MD5 Now I tried to use GSSAPI and it failed. Is there anything special setting I need to do on the client side to make it work? ldapsearch -H ldap://MPSD-EB01T3/ -b "cn=user1,dc=test,dc=com" -W -U user1 -Y GSSAPI -d 3 ldap_url_parse_ext(ldap://MPSD-EB01T3/) ldap_create ldap_url_parse_ext(ldap://MPSD-EB01T3:389/??base) ldap_sasl_interactive_bind_s: user selected: GSSAPI ldap_int_sasl_bind: GSSAPI ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP MPSD-EB01T3:389 ldap_new_socket: 392 ldap_prepare_socket: 392 ldap_connect_to_host: Trying 192.168.1.30:389 ldap_pvt_connect: fd: 392 tm: -1 async: 0 ldap_int_sasl_open: host=MPSD-EB01T3 ldap_err2string ldap_sasl_interactive_bind_s: Unknown authentication method (-6) additional info: SASL(-4): no mechanism available: Unable to find a calback: 2

3 3

simple binds
by Friedrich Locke 01 Jul '11

01 Jul '11

Is it possible to perform simple binds but looking up the entry's password in a kerberos server? Thanks in advance.

2 1

userPassword
by Friedrich Locke 30 Jun '11

30 Jun '11

What does userPassword: {SASL}xxx(a)MY.DOMAIN mean? Thanks a lot.

2 1

I cannot auth against SASL
by Friedrich Locke 30 Jun '11

30 Jun '11

Hi! i am trying to authenticate binding the DN below and it works nicely. dn: uid=grios,ou=people,dc=ufv,dc=br uid: grios objectclass: organizationalrole objectclass: posixaccount cn: Gustavo Rios uidnumber: 2000 gidnumber: 2000 homedirectory: /home/grios userpassword: {SSHA}dWhcPjgDn4EGb/FwGMYbxx7fIqAuXCN7 loginshell: /bin/sh gecos: Gustavo V G C Rios,,, But if i change userpassword attribute to {SASL}grios(a)UFV.BR it does not work when i bind the same DN above. Does anybody have an ideia about my mistaken ? Thanks in advance.

3 2

i am desperated: authentication without success
by Friedrich Locke 30 Jun '11

30 Jun '11

Hi folks, i am trying to search my base tree but i am not able to connect due to "invalid credentials (49)". It seems very confusing because i am sure i am using the correct password. sioux@gustav$ ldapsearch -w $my_pass -D uid=grios,ou=people,dc=ufv,dc=br -b 'dc=ufv,dc=br' -s one ldap_bind: Invalid credentials (49) sioux@gustav$ The entry's ldif whose rdn is uid=grios is: dn: uid=grios,ou=people,dc=ufv,dc=br uid: grios objectclass: organizationalrole objectclass: posixaccount cn: Gustavo Rios uidnumber: 2000 gidnumber: 2000 homedirectory: /home/grios userpassword: {SASL}grios(a)ufv.br loginshell: /bin/sh gecos: Gustavo V G C Rios,,, I am monitoring heimdal kerberos log file and cyrus-sasl log file too. Nothing is shown there. I DON'T really have any ideia on my mistaken. May you please help me? Kind regards. Fried.

2 1

slaptest returns "index attribute "reqStart" undefined
by Mike Greene 30 Jun '11

30 Jun '11

Hello list members, I am trying to setup ldap 2.4.23 on new FreeBSD 8.2 "consumer" server to replace a current system that is quite old. I have copied over the slapd.conf file and associated certs, etc from the production system and I'm able to get the server working using the sample slapd.conf and examples in the quick setup guide. When I run slaptest -f slapd.conf.artemis on the configuration file I copied over I get the error: slapd.conf.artemis: line 86: index attribute "reqStart" undefined slaptest: bad configuration file! Running the same test on the production server's slapd.conf produces no error at all. I've googled, RTFM and read man pages trying to get a clue as to what might be causing this, but I'm unable to unearth any leads that have helped so far. What I have tried is to copy the production *.bdb files over to the new server thinking that was the problem, I didn't try re-indexing those files (just read about slapindex late last night, so haven't tried that yet) I was also thinking that I might need to run slapcat on the production db's and then import the ldif file using slapadd (which I'm setting up to test shortly). Clearly I'm missing something, I'm hoping that someone here who is much more adept at LDAP can suggest some additional things to try. Below is what I think are the relevant portions of the slapd.conf file, which shows the section the slaptest complains about, the second section is our replication area which I believe is directly related to the replication process. database bdb suffix cn=accesslog directory /usr/local/var/db/openldap-accesslog rootdn cn=accesslog index default eq index entryCSN,objectClass,reqStart,reqResult,reqEnd overlay accesslog logdb cn=accesslog logops writes logsuccess TRUE logpurge 07+00:00 01+00:00 I'm trying to bootstrap my Sys Admin skills (after a 12 year absence) due to the sudden loss of my long time admin, with mixed results! Time will tell, appreciate any suggestions you might have to get me past this particular issue. Mike Greene Rock Island Technology Solutions, Inc. San Juan Islands, WA. 360-378-5884 x201

2 2

slapo-memberof across proxy
by Hugo Monteiro 30 Jun '11

30 Jun '11

Hello list, With this type of setup, Client (A) <-----> back_ldap Proxy (B) <-----> syncrepl Slave (C) <-----> Master (D) I have configured the memberof overlay on both (C) and (D). I am able to query both (C) and (D), either to specifically retrieve the memberof attribute or to perform a query which filter is based on the memberof attribute. All works fine with (C) and (D) If i issue the same type of queries from (A) to (B), i'm able to retrieve the memberof attribute alright *BUT* i cannot perform searches which contain the memberof attribute on the query filter. Does (B) need any special configuration so that back_ldap can cope with the memberof overlay available on the backend servers? Thanks in advance, Hugo Monteiro. -- fct.unl.pt:~# cat .signature Hugo Monteiro Email : hugo.monteiro(a)fct.unl.pt Telefone : +351 212948300 Ext.15307 Web : http://hmonteiro.net Divisão de Informática Faculdade de Ciências e Tecnologia da Universidade Nova de Lisboa Quinta da Torre 2829-516 Caparica Portugal Telefone: +351 212948596 Fax: +351 212948548 www.fct.unl.pt apoio(a)fct.unl.pt fct.unl.pt:~# _

2 2

Re: protected entry
by Friedrich Locke 30 Jun '11

30 Jun '11

To which objectclass should the entry belongs to ? What about access rules ? Thanks On Wed, Jun 29, 2011 at 8:14 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Wednesday, June 29, 2011 8:00 PM -0300 Friedrich Locke > <friedrich.locke(a)gmail.com> wrote: > >> Dear list users, >> >> i would like to have an entry in my openldap server thats needs to >> have a password so that it would be able to permit clients to bind as >> it providing its password. >> For instance: cn=x,ou=y,dc=a,dc=b >> So anyone knowing "cn=x,ou=y,dc=a,dc=b" 's password could bind as it. > > Add a userPassword value to that entry. > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

ldap root disable su
by Arif Ali 30 Jun '11

30 Jun '11

Hi list, I have used ldap for a while now, and we are currently looking at some security options for users to not to be able to hack the ldap system what we want is that for anyone who is root not to be able to su to any ldap user. Is there anything in the slapd.conf that can be configured to do that Arif Ali catch me on freenode IRC, username: arif-ali

1 0

OpenLDAP mirror replication ldif format
by Simon Massart 30 Jun '11

30 Jun '11

Hi there, I recently installed a new Debian 6 and OpenLDAP to test the new ldif format configuration. The problem is that I do not have any base configuration to use slaptest to migrate my config to ldif format. My main concern is now to find a manual/tutorial, to be able to setup a mirror replication with ldif format, because all I can find is using the old slapd.conf. Can anyone point me somewhere, where I could find some help or give my a quick example ? Thanks in advance for any return, Sismon

2 1

bad credential
by Friedrich Locke 30 Jun '11

30 Jun '11

I upload the ldif file below into my openldap server: dn: dc=ufv,dc=br dc: ufv objectclass: dcobject objectclass: organization o: Universidade Federal de Vicosa dn: ou=group,dc=ufv,dc=br ou: group objectclass: top objectclass: organizationalunit dn: cn=its,ou=group,dc=ufv,dc=br cn: its objectclass: posixgroup gidnumber: 1000 dn: cn=asd,ou=group,dc=ufv,dc=br cn: asd objectclass: posixgroup gidnumber: 1001 memberuid: sioux dn: cn=dba,ou=group,dc=ufv,dc=br cn: dba objectclass: posixgroup gidnumber: 1002 memberuid: sioux dn: cn=wbx,ou=group,dc=ufv,dc=br cn: wbx objectclass: posixgroup gidnumber: 1003 dn: cn=alg,ou=group,dc=ufv,dc=br cn: alg objectclass: posixgroup gidnumber: 1004 memberuid: sioux dn: cn=djb,ou=group,dc=ufv,dc=br cn: djb objectclass: posixgroup gidnumber: 1005 dn: cn=nofiles,ou=group,dc=ufv,dc=br cn: nofiles objectclass: posixgroup gidnumber: 1006 dn: cn=qmail,ou=group,dc=ufv,dc=br cn: qmail objectclass: posixgroup gidnumber: 1007 dn: cn=ftp,ou=group,dc=ufv,dc=br cn: ftp objectclass: posixgroup gidnumber: 1008 dn: cn=src,ou=group,dc=ufv,dc=br cn: src objectclass: posixgroup gidnumber: 1009 dn: cn=ord,ou=group,dc=ufv,dc=br cn: ord objectclass: posixgroup gidnumber: 2000 dn: cn=adc,ou=group,dc=ufv,dc=br cn: adc objectclass: posixgroup gidnumber: 2001 dn: cn=bod,ou=group,dc=ufv,dc=br cn: bod objectclass: posixgroup gidnumber: 2002 dn: cn=frn,ou=group,dc=ufv,dc=br cn: frn objectclass: posixgroup gidnumber: 2003 dn: ou=people,dc=ufv,dc=br ou: people objectclass: top objectclass: organizationalunit dn: uid=sioux,ou=people,dc=ufv,dc=br uid: sioux objectclass: organizationalrole objectclass: posixaccount cn: Gustavo Rios uidnumber: 1000 gidnumber: 1000 homedirectory: /home/sioux userpassword: {SASL}sioux(a)UFV.BR loginshell: /bin/sh Gecos: Gustavo V G Coelho Rios,,, But when i try the command below, i get invalid credential sioux@gustav$ ldapsearch -x -W -D 'uid=sioux,ou=people,dc=ufv,dc=br' -b dc=ufv,dc=br Enter LDAP Password: ldap_bind: Invalid credentials (49) sioux@gustav$ And when i try: $ ldapsearch -Y GSSAPI -b dc=ufv,dc=br it works perfectly. Any ideia about why it does not work ?

1 0

autofs wild cards
by Collins, Cris 30 Jun '11

30 Jun '11

My auto.home has "* host:/export/&" for user directories. When I use the automount migration tool the * is changed to / and I get the error: adding new entry "cn=/,ou=auto.home,dc=domain,dc=com" ldapadd: Naming violation (64) additional info: value of naming attribute 'cn' is not present in entry Is there a way to get the wild card to work or do I need to enter each user instead of using a wild card? Thank you for your time.

2 1

pcache + back-sql
by Chris Card 30 Jun '11

30 Jun '11

[Let's try that again. Hotmail/Chrome managed to screw up the formatting before] Does anyone have an example of using the pcache overlay with back-sql? Here's the relevant section of my slapd.config: database sql suffix "......" rootdn "......." rootpw ........ dbname MySQL dbuser ......... subtree_cond "ldap_entries.dn like CONCAT('%',?)" insentry_stmt "INSERT INTO ldap_entries (dn,oc_map_id,parent,keyval) VALUES (?,?,?,?)" has_ldapinfo_dn_ru no baseobjectupper_func UPPER autocommit yes pcache bdb 10000 1 50 100 pcacheAttrset 0 * + pcacheTemplate (objectClass=) 0 60 ... pcache-directory /var/tmp/cache pcache-cachesize 100 What I'm unclear about is how to configure the private bdb database used for the cache. When use this config, slapd starts up ok, but crashes with a SEGV when (I assume) it tries to cache a result: (I am running slapd built from the latest code in HEAD from git) slap_queue_csn: queing 0xb7a52efa 20110629132038.554471Z#000000#000#000000 Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0xb7a55b90 (LWP 26226)] 0x080f3844 in slap_queue_csn (op=0xb7a53378, csn=0xb7a52f60) at ctxcsn.c:199 199 LDAP_TAILQ_INSERT_TAIL( be->be_pending_csn_list, (gdb) where #0 0x080f3844 in slap_queue_csn (op=0xb7a53378, csn=0xb7a52f60) at ctxcsn.c:199 #1 0x080f38e0 in slap_get_csn (op=0xb7a53378, csn=0xb7a52f60, manage_ctxcsn=1) at ctxcsn.c:214 #2 0x08079f33 in slap_add_opattrs (op=0xb7a53378, text=0xb7a53214, textbuf=0xb7a53074 "", textlen=256, manage_ctxcsn=1) at add.c:609 #3 0x0814187b in bdb_add (op=0xb7a53378, rs=0xb7a53200) at add.c:107 #4 0x081a144e in merge_entry (op=0xb7a53378, e=0x9f56e4c, dup=0, query_uuid=0xa040848) at pcache.c:865 #5 0x081a4d1c in cache_entries (op=0x9fdbfc8, query_uuid=0xa040848) at pcache.c:2325 #6 0x081a5244 in pcache_op_cleanup (op=0x9fdbfc8, rs=0xb7a550e4) at pcache.c:2430 #7 0x08084697 in slap_cleanup_play (op=0x9fdbfc8, rs=0xb7a550e4) at result.c:539 #8 0x08084dd3 in send_ldap_response (op=0x9fdbfc8, rs=0xb7a550e4) at result.c:724 #9 0x0808554e in slap_send_ldap_result (op=0x9fdbfc8, rs=0xb7a550e4) at result.c:851 #10 0x0813e4a3 in backsql_search (op=0x9fdbfc8, rs=0xb7a550e4) at search.c:2493 #11 0x0807402e in fe_op_search (op=0x9fdbfc8, rs=0xb7a550e4) at search.c:402 #12 0x080f1aaa in overlay_op_walk (op=0x9fdbfc8, rs=0xb7a550e4, which=op_search, oi=0x9f3dc80, on=0x0) at backover.c:671 #13 0x080f1c5f in over_op_func (op=0x9fdbfc8, rs=0xb7a550e4, which=op_search) at backover.c:723 #14 0x080f1d0e in over_op_search (op=0x9fdbfc8, rs=0xb7a550e4) at backover.c:750 #15 0x0807397d in do_search (op=0x9fdbfc8, rs=0xb7a550e4) at search.c:247 #16 0x08070704 in connection_operation (ctx=0xb7a551d0, arg_v=0x9fdbfc8) at connection.c:1138 #17 0x08070c44 in connection_read_thread (ctx=0xb7a551d0, argv=0xd) at connection.c:1274 #18 0x081e04a5 in ldap_int_thread_pool_wrapper (xpool=0x9f11f78) at tpool.c:685 #19 0x004be5ab in start_thread () from /lib/libpthread.so.0 #20 0x003b2cfe in clone () from /lib/libc.so.6 It crashes because be->be_pending_csn_list is zero, presumably because backend_startup_one() has not been called for this backend. This leads me to believe that I need something in slapd.conf to get the private bdb database initialised, but what? Chris

2 7

fetching information
by Friedrich Locke 30 Jun '11

30 Jun '11

I am planing using openldap to fetch user/group information. Below my main tree there will be ou=people and ou=group, and below those the regular user or group information. It happens that a program (ypserv) will fetch information from tree binding as cn=ypserv just below my main tree. This binding should be authenticated, so what should cn=ypserv attributes be? What about access rules for it ? Thanks a lot for your time and cooperation. Best regards! Fried.

3 3

Connections
by Friedrich Locke 30 Jun '11

30 Jun '11

I would like to see how many connections openldap is serving on a given momment. I am trying this: sioux@gustav$ ldapsearch -LLL -W -D cn=oldap,dc=ufv,dc=br -b cn=current,cn=connections,cn=monitor -H ldap://gustav.cpd.ufv.br/ objectclass=* Enter LDAP Password: dn: cn=Current,cn=Connections,cn=Monitor objectClass: monitorCounterObject cn: Current sioux@gustav$ I cannot see the number of connections. Where is my mistake ? Thanks a lot.

3 2

protected entry
by Friedrich Locke 30 Jun '11

30 Jun '11

Dear list users, i would like to have an entry in my openldap server thats needs to have a password so that it would be able to permit clients to bind as it providing its password. For instance: cn=x,ou=y,dc=a,dc=b So anyone knowing "cn=x,ou=y,dc=a,dc=b" 's password could bind as it. Any ideia? Thanks.

2 1

chaining through proxy and slave
by Hugo Monteiro 29 Jun '11

29 Jun '11

Hello list, With the following scenario Client (A) <-----> back_ldap Proxy (B) <-----> syncrepl Slave (C) <-----> Master (D) and B and C use a binddn that only has full read permissions on the database, except for a couple of attributes, on which it has full write permissions. Also, Each of the represented nodes can only "talk" to the nodes to which there is a represented connection, so (A) and (B) cannot chase a configured referral to (D). What would be the proper way to setup (B) and (C) so that (A) could push updates for the couple of attributes into the master (D) node? At the Slave level, i've already setup chaining and making it use (D) as updateref, but then any push on (B) would not propagate. I also noticed that in although i used mode=self, in the chaining, i had to configure a binddn which had full write permissions. Wouldn't it be sufficient to have a full read enabled binddn or even no binddn at all since the bind would then be made using the clients credentials? Thanks in advance, Hugo Monteiro. -- fct.unl.pt:~# cat .signature Hugo Monteiro Email : hugo.monteiro(a)fct.unl.pt Telefone : +351 212948300 Ext.15307 Web : http://hmonteiro.net Divisão de Informática Faculdade de Ciências e Tecnologia da Universidade Nova de Lisboa Quinta da Torre 2829-516 Caparica Portugal Telefone: +351 212948596 Fax: +351 212948548 www.fct.unl.pt apoio(a)fct.unl.pt fct.unl.pt:~# _

2 1

kerberos ldap/host.my.domain
by Friedrich Locke 29 Jun '11

29 Jun '11

Hi folks, i have just installed openldap and i am facing a situation i would like to share with you. In OpenBSD (the OS i am using) i have the keytab file inside /etc/kerberosV. Its access mode is 600, its ownership is root:wheel. But OpenBSD specifies a user and group the slapd daemon should run as; the user is "u" and group "g". In order to get SASL/GSSAPI working i need to add to the keytab the principal ldap/host.my.domain. I did it; now the keytab has the principals host/x.y.z and ldap/x.y.z But since slapd runs as another user it is prevented from accessing the keytab file. So i thought the following possible solutions: 0) Run slapd as root 1) change the permission of the keytab Any of those options above makes security less secure. I known there should be some more approaches, but i cannot think it right now. How did you handle that? Thanks a lot for your time and cooperation. Best regards.

4 3

n-way syncrepl issues
by Marcel van Dorp 29 Jun '11

29 Jun '11

Hi list, I tried to read all information about the subject, both in the mail archives and on the website (admin guide and faq-o-matic), but somehow things are not working as expected. I have 3 servers, Debian 6 with the distro-version of openldap (2.4.23-7). I use phpldapadmin (PLA for short), version 1.2.0.5. I also use ldapvi and the standard ldap-tools (ldapadd/ldapmodify etc). I use the slapd.d/ config backend. My userdata DIT is empty at the moment, until the issues are resolved. *) When using n-way multimaster, I understand that the whole DIT is identical on all servers (assuming full read access for the replication DN, which is the case). Because of this, I used a generic name for the certificates, while on each server the content of the files are server-specific. This works as expected. The other difference between the servers is the slapd startup command line: in it is each server's own FQDN. On debian, this is specified in /etc/default/slapd. On server1 this file has: SLAPD_SERVICES=ldap://127.0.0.1 ldaps://server1.domain.tld ldapi:///" On server2 the URI changes in ldaps://server2.domain.tld and on server3 it changes likewise. This is al per the admin guide. For some reason, replication is not working as expected. Some updates go through, others are ignored and stay local on a server. The servers are on different subnets with a firewall in-between, but I can access each server from the other servers using eg 'ldapsearch'. Question: With n-way multimaster, I understand the DIT should be identical on all servers. Can I just do tar -czf slapd.conf.tgz /etc/ldap/slapd.d on one server, and copy and untar this on the other servers (with slapd stopped) and start slapd? My (anonymized) slapd.d is at the end of this message (I deleted the (default) schema definitions for readability). Question: Is the above-mentioned method a valid way to add/restore an extra n-way multimaster node in the setup? If so, Do I do the export AFTER adding the extra node to the config, or BEFORE? Question: I also want to replicate the dc=domain,dc=tld DIT. Can I use the same rid values in de replication statements as for the cn=config DIT, or do they need to be unique within the total config? Question: I do not like to use the cn=admin,cn=config identity as the replication ID. Yet I do not have content in the dc=domain,dc=tld DIT, and thus no way to specifiy another identity. Can this be solved? Once the DIT has the identity, I assume I can change the replication ID (as long as ACLs are not blocking things). Can anyone answer my questions, or point me in the right direction? I tried numerous things with all kind of different results, but I feel I miss some fundamental insight. Thanks for any help! Marcel -------------------------------------------------------------------- Anonymized slapd.d config of server1 (exported using PLA) -------------------------------------------------------------------- # Server: Server1 (ldap://localhost) # Search Scope: sub # Search Filter: (objectClass=*) # Total Entries: 13 # # Generated by phpLDAPadmin (http://phpldapadmin.sourceforge.net) on June 29, 2011 8:19 am # Version: 1.2.0.5 version: 1 # Entry 1: cn=config dn: cn=config cn: config contextcsn: 20110621205759.540662Z#000000#000#000000 createtimestamp: 20110429201711Z creatorsname: cn=config entrycsn: 20110621205759.540662Z#000000#000#000000 entrydn: cn=config entryuuid: 690a54f4-06e9-1030-9aec-e9c45301ace2 modifiersname: cn=admin,cn=config modifytimestamp: 20110621205759Z objectclass: olcGlobal olcargsfile: /var/run/slapd/slapd.args olcloglevel: sync olcloglevel: stats olcloglevel: args olcpidfile: /var/run/slapd/slapd.pid olcserverid: 11 ldaps://server1.domain.tld olcserverid: 12 ldaps://server2.domain.tld olcserverid: 13 ldaps://server3.domain.tld olctlscacertificatefile: /etc/ssl/certs/cacert.org.pem olctlscertificatefile: /etc/ssl/certs/thishost.crt olctlscertificatekeyfile: /etc/ssl/private/thishost.key olctlsverifyclient: NEVER olctoolthreads: 1 structuralobjectclass: olcGlobal subschemasubentry: cn=Subschema # Entry 2: cn=module{0},cn=config dn: cn=module{0},cn=config cn: module{0} createtimestamp: 20110429201711Z creatorsname: cn=admin,cn=config entrycsn: 20110429201711.660046Z#000000#000#000000 entrydn: cn=module{0},cn=config entryuuid: 690b3608-06e9-1030-9af4-e9c45301ace2 modifiersname: cn=admin,cn=config modifytimestamp: 20110429201711Z objectclass: olcModuleList olcmoduleload: {0}back_hdb olcmoduleload: {1}syncprov.la olcmodulepath: /usr/lib/ldap structuralobjectclass: olcModuleList subschemasubentry: cn=Subschema # Entry 3: cn=schema,cn=config ### DELETED default schema definitions for readability # Entry 4: cn={0}core,cn=schema,cn=config ### DELETED default schema definitions for readability # Entry 5: cn={1}cosine,cn=schema,cn=config ### DELETED default schema definitions for readability # Entry 6: cn={2}nis,cn=schema,cn=config ### DELETED default schema definitions for readability # Entry 7: cn={3}inetorgperson,cn=schema,cn=config ### DELETED default schema definitions for readability # Entry 8: olcBackend={0}hdb,cn=config dn: olcBackend={0}hdb,cn=config createtimestamp: 20110429201711Z creatorsname: cn=admin,cn=config entrycsn: 20110429201711.707740Z#000000#000#000000 entrydn: olcBackend={0}hdb,cn=config entryuuid: 69127d0a-06e9-1030-9af5-e9c45301ace2 modifiersname: cn=admin,cn=config modifytimestamp: 20110429201711Z objectclass: olcBackendConfig olcbackend: {0}hdb structuralobjectclass: olcBackendConfig subschemasubentry: cn=Subschema # Entry 9: olcDatabase={-1}frontend,cn=config dn: olcDatabase={-1}frontend,cn=config createtimestamp: 20110429201711Z creatorsname: cn=config entrycsn: 20110429201711.654507Z#000000#000#000000 entrydn: olcDatabase={-1}frontend,cn=config entryuuid: 690a5da0-06e9-1030-9aed-e9c45301ace2 modifiersname: cn=config modifytimestamp: 20110429201711Z objectclass: olcDatabaseConfig objectclass: olcFrontendConfig olcaccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=extern al,cn=auth manage by * break olcaccess: {1}to dn.exact="" by * read olcaccess: {2}to dn.base="cn=Subschema" by * read olcdatabase: {-1}frontend olcsizelimit: 500 structuralobjectclass: olcDatabaseConfig subschemasubentry: cn=Subschema # Entry 10: olcDatabase={0}config,cn=config dn: olcDatabase={0}config,cn=config createtimestamp: 20110429201711Z creatorsname: cn=config entrycsn: 20110619065612.945749Z#000000#000#000000 entrydn: olcDatabase={0}config,cn=config entryuuid: 690a693a-06e9-1030-9aee-e9c45301ace2 modifiersname: cn=admin,cn=config modifytimestamp: 20110619065612Z objectclass: olcDatabaseConfig olcaccess: {0}to * by dn.exact=cn=admin,cn=config read by dn.exact=gidNumber=0+uidNumber=0,cn=pe ercred,cn=external,cn=auth manage by * break olcdatabase: {0}config olcmirrormode: TRUE olcrootdn: cn=admin,cn=config olcrootpw: {SSHA}deletedforsecurityreasons olcsyncrepl: {0}rid=011 provider=ldaps://server1.domain.tld binddn="cn=admin,cn=config" credentials="mysecretpassword" bindmethod=simple starttls=no searchbase="cn=config" type=refreshAndPersist retry="5 5 300 +" timeout=0 network-timeout=0 filter="(objectclass=*)" attrs="*,+" scope=sub olcsyncrepl: {1}rid=012 provider=ldaps://server2.domain.tld binddn="cn=admin,cn=config" credentials="mysecretpassword" bindmethod=simple starttls=no searchbase="cn=config" type=refreshAndPersist retry="5 5 300 +" timeout=0 network-timeout=0 filter="(objectclass=*)" attrs="*,+" scope=sub olcsyncrepl: {2}rid=013 provider=ldaps://server3.domain.tld binddn="cn=admin,cn=config" credentials="mysecretpassword" bindmethod=simple starttls=no searchbase="cn=config" type=refreshAndPersist retry="5 5 300 +" timeout=0 network-timeout=0 filter="(objectclass=*)" attrs="*,+" scope=sub structuralobjectclass: olcDatabaseConfig subschemasubentry: cn=Subschema # Entry 11: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config createtimestamp: 20110512150606Z creatorsname: cn=admin,cn=config entrycsn: 20110522201415.682681Z#000000#000#000000 entrydn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config entryuuid: 1ae3191c-10f5-1030-9102-e14c7638455a modifiersname: cn=admin,cn=config modifytimestamp: 20110522201415Z objectclass: olcOverlayConfig objectclass: olcSyncProvConfig objectclass: top olcoverlay: {0}syncprov olcspcheckpoint: 100 10 structuralobjectclass: olcSyncProvConfig subschemasubentry: cn=Subschema # Entry 12: olcDatabase={1}hdb,cn=config dn: olcDatabase={1}hdb,cn=config createtimestamp: 20110512144416Z creatorsname: cn=admin,cn=config entrycsn: 20110619123128.846982Z#000000#000#000000 entrydn: olcDatabase={1}hdb,cn=config entryuuid: 0e60d5a6-10f2-1030-9d9b-35ce2d01c34c modifiersname: cn=admin,cn=config modifytimestamp: 20110619123128Z objectclass: olcDatabaseConfig objectclass: olcHdbConfig olcaccess: {0}to attrs=userPassword,shadowLastChange by self write by anonym ous auth by dn="cn=admin,cn=config" write by * none olcaccess: {1}to dn.base="" by * read olcaccess: {2}to * by self write by dn="cn=admin,cn=config" write by * read olcdatabase: {1}hdb olcdbcheckpoint: 512 30 olcdbconfig: {0}set_cachesize 0 2097152 0 olcdbconfig: {1}set_lk_max_objects 1500 olcdbconfig: {2}set_lk_max_locks 1500 olcdbconfig: {3}set_lk_max_lockers 1500 olcdbdirectory: /var/lib/ldap/ olcdbindex: objectClass eq olcdbindex: entryCSN eq olcdbindex: entryUUID eq olclastmod: TRUE olcmirrormode: TRUE olcrootdn: cn=admin,cn=config olcrootpw: {SSHA}s1C7GBjdeletedforsecurityreasons olcsuffix: dc=domain,dc=tld olcsyncrepl: {0}rid=011 provider=ldaps://server1.domain.tld binddn="cn=admin,cn=config" credentials="mysecretpassword" bindmethod=simple starttls=no searchbase="dc=domain,dc=tld" type=refreshAndPersist retry="5 5 300 +" timeout=0 network-timeout=0 filter="(objectclass=*)" attrs="*,+" scope=sub olcsyncrepl: {1}rid=012 provider=ldaps://server2.domain.tld binddn="cn=admin,cn=config" credentials="mysecretpassword" bindmethod=simple starttls=no searchbase="dc=domain,dc=tld" type=refreshAndPersist retry="5 5 300 +" timeout=0 network-timeout=0 filter="(objectclass=*)" attrs="*,+" scope=sub olcsyncrepl: {2}rid=013 provider=ldaps://server3.domain.tld binddn="cn=admin,cn=config" credentials="mysecretpassword" bindmethod=simple starttls=no searchbase="dc=domain,dc=tld" type=refreshAndPersist retry="5 5 300 +" timeout=0 network-timeout=0 filter="(objectclass=*)" attrs="*,+" scope=sub structuralobjectclass: olcHdbConfig subschemasubentry: cn=Subschema # Entry 13: olcOverlay={0}syncprov,olcDatabase={1}hdb,cn=config dn: olcOverlay={0}syncprov,olcDatabase={1}hdb,cn=config createtimestamp: 20110522163658Z creatorsname: cn=admin,cn=config entrycsn: 20110522201502.521704Z#000000#000#000000 entrydn: olcOverlay={0}syncprov,olcDatabase={1}hdb,cn=config entryuuid: 74b70896-18dd-1030-94f4-2183161cb5d6 modifiersname: cn=admin,cn=config modifytimestamp: 20110522201502Z objectclass: olcOverlayConfig objectclass: olcSyncProvConfig objectclass: top olcoverlay: {0}syncprov olcspcheckpoint: 100 10 structuralobjectclass: olcSyncProvConfig subschemasubentry: cn=Subschema

1 0

Sendmail + LDAP
by Vasily Yakovlev 29 Jun '11

29 Jun '11

Hi, I experince some problems with setting up Sendmail with the LDAP database for virtual mail accounts. I believe, that the reason of my problem is in configuring dovecot-deliver, but nobody answers me in the dovecot-mailing list, so i've decided to post a message here What i have: - FreeBSD 8.2-RELEASE - sendmail (Version 8.14.4 with LDAP support installed from ports) - Dovecot LDA + dovecot (as pop3/imap) - 1.2.16 - openldap - 2.4.23 1. Following http://wiki.dovecot.org/LDA/Sendmail i've set up deliver as LDA. Everything worked fine. 2. Following http://wiki.dovecot.org/HowTo/DovecotOpenLdap i've set up Dovecot to work with tha ldap. Now i can authorize through the client or web interface and get to my maildir. 3. Now, i want my sendmail to accept mail for the account in LDAP database. sendmail.mc: ++++++++++++++++++++++ FEATURE(`local_procmail', `/usr/local/libexec/dovecot/deliver',`/usr/local/libexec/dovecot/deliver -d $u') MODIFY_MAILER_FLAGS(`LOCAL', `-f') ...................................... define(`confLDAP_DEFAULT_SPEC', `-h "localhost" -b "dc=mydomain,dc=ru" -d "cn=dovecot,ou=accounts,dc=mydomain,dc=ru" -MLDAP_AUTH_SIMPLE -P /etc/mail/ldap_pass')dnl LDAPROUTE_DOMAIN(`mydomain.ru')dnl FEATURE(`ldap_routing', `null -T<TMPF>', `ldap -1 -T<TMPF> -v mail -k (&(objectclass=posixaccount)(mail=%0))', `passthru')dnl ...................................... MAILER(procmail) ++++++++++++++++++++++ After re-making the sendmail: ++++++++++++++++++++++ [root@test2 /etc/mail]# sendmail -bv -d60.1 test_user(a)mydomain.ru map_lookup(dequote, test) => NOT FOUND (0) map_lookup(host, mydomain.ru) => mydomain.ru. (0) map_lookup(dequote, test_user) => NOT FOUND (0) map_lookup(ldapmra, test_user(a)mydomain.ru) => test_user(a)mydomain.ru (0) map_lookup(ldapmh, test_user(a)mydomain.ru) => NOT FOUND (68) map_lookup(host, mydomain.ru) => mydomain.ru. (0) map_lookup(dequote, test_user) => NOT FOUND (0) map_lookup(virtuser, test_user(a)mydomain.ru) => NOT FOUND (0) map_lookup(virtuser, @mydomain.ru) => NOT FOUND (0) test_user(a)mydomain.ru... User unknown ++++++++++++++++++++++ It's the problem of the local delivery, i believe. Why? Because after sendmail getting an email it passes it to the LDA, which must check the LDAP (not the passwd!) database for the user, to which this email is send to. Are there some possibilities to solve this problem? Or, maybe there might be a problem in cofiguring the OpenLDAP? I appreciate any help... ----------------------- Best regards, Vasily Yakovlev

1 0

SASL working but kerberos DOMAIN is not set
by Friedrich Locke 28 Jun '11

28 Jun '11

I have setted openldap+sasl+kerberos. It is working but the keberos realm is not seted in the bind dn, why? Here is my session: sioux@gustav$ ldapsearch -Y GSSAPI -b "" -s base -LLL supportedSASLMechanisms SASL/GSSAPI authentication started SASL username: sioux(a)UFV.BR SASL SSF: 56 SASL data security layer installed. dn: supportedSASLMechanisms: OTP supportedSASLMechanisms: NTLM supportedSASLMechanisms: GSSAPI supportedSASLMechanisms: DIGEST-MD5 supportedSASLMechanisms: CRAM-MD5 sioux@gustav$ Here is what i got from slapd err output : ... ... ... do_bind: dn () SASL mech GSSAPI slap_sasl_getdn: u:id converted to uid=sioux,cn=GSSAPI,cn=auth >>> dnNormalize: <uid=sioux,cn=GSSAPI,cn=auth> <<< dnNormalize: <uid=sioux,cn=gssapi,cn=auth> ==>slap_sasl2dn: converting SASL name uid=sioux,cn=gssapi,cn=auth to a DN <==slap_sasl2dn: Converted SASL name to <nothing> SASL Authorize [conn=1001]: proxy authorization allowed authzDN="" send_ldap_sasl: err=0 len=-1 do_bind: SASL/GSSAPI bind: dn="uid=sioux,cn=gssapi,cn=auth" sasl_ssf=56 send_ldap_response: msgid=3 tag=97 err=0 ber_flush2: 14 bytes to sd 13 ... ... ... Any ideia about what is going on ?

2 1

Re: access
by Friedrich Locke 28 Jun '11

28 Jun '11

Sorry folks, please forgive me, i forgot to let you know i am using kerberos (SASL); so i bind via sasl mechanism not as the dn owned by me. Thanks once more for your help. On Tue, Jun 28, 2011 at 2:05 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, June 28, 2011 10:05 AM -0300 Friedrich Locke > <friedrich.locke(a)gmail.com> wrote: > >> Dear list members, >> >> i would like to use openldap for unix users and group of my local >> network. I started studying openldap access mechanism yesterday; and i >> am a little confused. >> >> I am writing in order to get some help for a single scenario i would >> like to share with you. >> >> My users will be below ou=users,dc=ufv,dc=br. >> >> I would like to write an access rule for the following. >> >> User X had complete access to his/her entry: >> >> cn=X,dc=ufv,dc=br > > by self write > by users read > > --Quanah > > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

access
by Friedrich Locke 28 Jun '11

28 Jun '11

Dear list members, i would like to use openldap for unix users and group of my local network. I started studying openldap access mechanism yesterday; and i am a little confused. I am writing in order to get some help for a single scenario i would like to share with you. My users will be below ou=users,dc=ufv,dc=br. I would like to write an access rule for the following. User X had complete access to his/her entry: cn=X,dc=ufv,dc=br but only read access for the others entry below dc=ufv,dc=br. How could this access be implemente? Is it possible? Thanks a lot for your time and support. Fried.

2 1

LDAP-Proxy: backend inaccessible via ldaps (w/o proxy no errors)
by Jahnke-Zumbusch, Dirk 27 Jun '11

27 Jun '11

Hi all, I would like to use the proxy features (and as soon as this works for me also some kind of rewriting / mapping) with openldap 2.4.25: ./configure --prefix=/scratch/openldap \ --with-tls=openssl \ --enable-meta \ --enable-ldap \ --enable-rewrite \ --enable-rwm \ --enable-bdb \ --enable-overlays \ --enable-perl \ --enable-shell make install... I may access one LDAP backend via ldap: but not the other (Active Directory) via ldaps: What works fine is 1. ldapsearch for LDAP-Tree-1 / Server-1: ========================================= Direct access to LDAP server: ----------------------------- ldapsearch -x -H ldap://ldap-server-1 -b 'ou=OU1,o=desy,c=de' '(mail=*)' | fgrep num # numResponses: 7 # numEntries: 6 and using the proxy: ----------------------------- ldapsearch -x -H ldap://ldap-proxy -b 'ou=OU1,o=desy,c=de' '(mail=*)' | fgrep num # numResponses: 7 # numEntries: 6 (This tree is rather small.) what is not working is 2. ldapsearch for Active-Directory / Server-2: ============================================== Direct Access to AD-Server ----------------------------- ldapsearch -x -H ldaps://domain-controller \ -D CN=accountname,OU=...,OU=...,OU=...,DC=desy,DC=de \ -W \ -b 'ou=ou1,...,dc=desy,dc=de' \ '(samaccountname=testuser)' | fgrep num Enter LDAP Password: # numResponses: 2 # numEntries: 1 Doing the same via the proxy fails: ----------------------------------- ldapsearch -x -H ldap://ldap-proxy -b 'ou=...,...,dc=desy,dc=de' # extended LDIF # # LDAPv3 # base <ou=...,...,dc=desy,dc=de> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 48 Inappropriate authentication # numResponses: 1 I would like to understand why this fails. slapd.conf is like this ---------- include /scratch/openldap/etc/openldap/schema/core.schema include /scratch/openldap/etc/openldap/schema/cosine.schema include /scratch/openldap/etc/openldap/schema/inetorgperson.schema idletimeout 120 pidfile /scratch/openldap/var/run/slapd.pid argsfile /scratch/openldap/var/run/slapd.args # -- 1st LDAP-backend, the one which works, see 1. above database ldap uri ldap://ldap-server-1:portnumber/ suffix "ou=ouA,o=desy,c=de" # -- 2nd LDAP-/Active-Driectory-backend, that one, which fails database ldap suffix "ou=OU1,...,dc=desy,dc=de" uri ldaps://domain-controller/ acl-bind bindmethod=simple binddn="CN=...,DC=desy,DC=de" credentials=TopSecret idassert-bind bindmethod=simple binddn="CN=...,DC=desy,DC=de" credentials=TopSecret mode=none tls_cacertdir=/etc/pki/tls/certs tls_reqcert=never tls_crlcheck=none idle-timeout 1800 rebind-as-user yes # -- just to make sure for now that I will see everything access to * by * read # === END OF SLAPD.CONF === When I am strace'ing slapd with "-e trace=file -f" I cannot see that any file in tls_cacertdir is read. But I would have expected that. Any directions what I should looking for, now? Kind regards, Dirk -- Dirk Jahnke-Zumbusch Deutsches Elektronen-Synchrotron DESY IT Information Fabrics Member of the Helmholtz Association D-22603 Hamburg Notkestrasse 85 / 22607 Hamburg T: +49-40-899.81760 F: +49-40-899.41760 dirk.jahnke-zumbusch(a)desy.de

1 0

How to perform windows domain authentication with openldap
by Jintao Fang 27 Jun '11

27 Jun '11

I am trying to develop a ldap client with openldap and cyrus-sasl, there is one feature that user can directly sign to the ldap server if he is in a domain. Does anyone have used openldap like this? Thanks a lot.

5 4

back-sql modified queries
by Mark Nienberg 25 Jun '11

25 Jun '11

1 0

ACL caused uidNumber=4294967295 ?
by niko 24 Jun '11

24 Jun '11

Hi,I got weird problem with ldap & samba &sssd。 pdbedit -L showed all users having the same uid (4294967295) ACL : [root@rhel6 slapd.d]# grep -ir "olcAccess" . ./cn=config/olcDatabase={2}monitor.ldif:olcAccess: {0}to * by dn.base="cn=manager,dc=my-domain,dc=com" read by * none ./cn=config/olcDatabase={0}config.ldif:olcAccess: {0}to * by * none ./cn=config/olcDatabase={1}bdb.ldif:olcAccess: to * by * read by self write More specification below： -------------------------------------------------------------------------------------------------------------------------------------------------------- [root@rhel6 cn=config]# pdbedit -L testsmb:4294967295:testsmb *<sometimes, the user testsmb has correct uid 503, I don't know why> *test2:4294967295:test2 test3:4294967295:test3 [root@rhel6 ~]# getent -s sss passwd example:*:9999:9999::/home/example:/bin/sh *<sometimes,we can get user testsmb here>* [root@rhel6 cn=config]# ldapsearch -x -D "cn=root,dc=rhel6,dc=ldaptest,dc=com" -W ........ # testsmb, rhel6.ldaptest.com dn: uid=testsmb,dc=rhel6,dc=ldaptest,dc=com cn: testsmb uid: testsmb uidNumber: 503 loginShell: /bin/bash homeDirectory: /home/testsmb gidNumber: 500 userPassword:: e2NyeXB0fUFPblQvYkJsbEJTWFk= objectClass: posixAccount objectClass: shadowAccount objectClass: person objectClass: sambaSamAccount sambaPwdLastSet: 1308553125 sambaPwdCanChange: 1308553125 sambaNTPassword: 1D82374AB98BB16761B9A4F90441E201 sambaLMPassword: 67E272A0267766A117306D272A9441BB sambaPrimaryGroupSID: 2001 sambaAcctFlags: [U ] shadowLastChange: 15145 gecos: testsmb sn: testsmb sambaSID: S-1-5-21-423381952-115127825-699677302-1004 # test2, rhel6.ldaptest.com Dn: uid=test2,dc=rhel6,dc=ldaptest,dc=com cn: test2 uid: test2 uidNumber: 504 loginShell: /bin/bash homeDirectory: /home/test2 gidNumber: 500 userPassword:: e2NyeXB0fVhSbXVGQUd2cHMublE= objectClass: posixAccount objectClass: shadowAccount objectClass: person objectClass: sambaSamAccount sambaPwdLastSet: 1308557836 sambaPwdCanChange: 1308557836 sambaNTPassword: 1D82374AB98BB16761B9A4F90441E201 sambaLMPassword: 67E272A0267766A117306D272A9441BB sambaPrimaryGroupSID: 2001 sambaAcctFlags: [U ] shadowLastChange: 15145 gecos: test2 sn: test2 sambaSID: S-1-5-21-423381952-115127825-699677302-1005 # example, rhel6.ldaptest.com dn: uid=example,dc=rhel6,dc=ldaptest,dc=com cn: Example user sn: Example user uid: example uidNumber: 9999 gidNumber: 9999 loginShell: /bin/sh homeDirectory: /home/example objectClass: posixAccount objectClass: person userPassword:: KkxLKg== smb.conf security = user passdb backend = ldapsam:ldap://rhel6.ldaptest.com ldap admin dn = "cn=root,dc=rhel6,dc=ldaptest,dc=com" ldap suffix = dc=rhel6,dc=ldaptest,dc=com ldap group suffix = ou=Groups ldap machine suffix = ou=Computers ldap idmap suffix = ou=Idmap ldap ssl = start tls ldap passwd sync = yes Debug info show below slapd debug acl ------------------------------------------------------------------------------------------------------------------------------------ [root@rhel6 ~]# service slapd start Starting slapd: @(#) $OpenLDAP: slapd 2.4.19 (Jun 30 2010 03:56:07) $ mockbuild@x86-003.build.bos.redhat.com:/builddir/build/BUILD/openldap-2.4.19/openldap-2.4.19/build-servers/servers/slapd => access_allowed: search access to "cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "cn={0}corba,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "cn={1}core,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "cn={2}cosine,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "cn={3}duaconf,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "cn={4}dyngroup,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "cn={5}inetorgperson,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "cn={6}java,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "cn={7}misc,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "cn={8}nis,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "cn={9}openldap,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "cn={10}ppolicy,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "cn={11}collective,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "cn={12}samba,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "olcDatabase={-1}frontend,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) => access_allowed: search access to "olcDatabase={0}config,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) Backend ACL: access to * by * none /etc/openldap/slapd.d: line 1: warning: cannot assess the validity of the ACL scope within backend naming context => access_allowed: search access to "olcDatabase={1}bdb,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) Backend ACL: access to * by * read by self write /etc/openldap/slapd.d: line 1: warning: cannot assess the validity of the ACL scope within backend naming context => access_allowed: search access to "olcDatabase={2}monitor,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) Backend ACL: access to * by dn.base="cn=manager,dc=my-domain,dc=com" read by * none /etc/openldap/slapd.d: line 1: warning: cannot assess the validity of the ACL scope within backend naming context slapd starting * * *debug info for " su - test2"* sssd debug info ------------------------------------------------------------------------------------------------------------------------------------------------------------- (Tue Jun 21 11:02:48 2011) [sssd[be[default]]] [sdap_parse_entry] (9): OriginalDN: [uid=test2,dc=rhel6,dc=ldaptest,dc=com]. (Tue Jun 21 11:02:48 2011) [sssd[be[default]]] [sdap_process_result] (8): Trace: sh[0x9e08488], connected[1], ops[0x9ea1b10], ldap[0x9e08540] (Tue Jun 21 11:02:48 2011) [sssd[be[default]]] [sdap_get_generic_done] (6): Search result: Success(0), (null) (Tue Jun 21 11:02:48 2011) [sssd[be[default]]] [sdap_get_users_process] (6): Search for users, returned 1 results. (Tue Jun 21 11:02:48 2011) [sssd[be[default]]] [sdap_process_result] (8): Trace: sh[0x9e08488], connected[1], ops[(nil)], ldap[0x9e08540] (Tue Jun 21 11:02:48 2011) [sssd[be[default]]] [sdap_process_result] (8): Trace: ldap_result found nothing! (Tue Jun 21 11:02:48 2011) [sssd[be[default]]] [ldb] (9): start ldb transaction (nesting: 0) (Tue Jun 21 11:02:48 2011) [sssd[be[default]]] [sdap_save_user_send] (9): Save user (Tue Jun 21 11:02:48 2011) [sssd[be[default]]] [sdap_save_user_send] (2): User [test2] filtered out! (id out of range) (Tue Jun 21 11:02:48 2011) [sssd[be[default]]] [sdap_save_users_process] (2): Failed to store user 0. Ignoring. (Tue Jun 21 11:02:48 2011) [sssd[be[default]]] [ldb] (9): commit ldb transaction (nesting: 0) (Tue Jun 21 11:02:48 2011) [sssd[be[default]]] [sdap_get_users_done] (9): Saving 1 Users - Done (Tue Jun 21 11:02:48 2011) [sssd[nss]] [sbus_remove_timeout] (8): 0x9dcde28 (Tue Jun 21 11:02:48 2011) [sssd[nss]] [sbus_dispatch] (9): dbus conn: 9DCDF38 (Tue Jun 21 11:02:48 2011) [sssd[nss]] [sbus_dispatch] (9): Dispatching. (Tue Jun 21 11:02:48 2011) [sssd[nss]] [sss_dp_get_reply] (4): Got reply (0, 0, Success) from Data Provider (Tue Jun 21 11:02:48 2011) [sssd[nss]] [nss_cmd_getpwnam_callback] (2): No matching domain found for [test2], fail! (Tue Jun 21 11:02:48 2011) [sssd[nss]] [nss_cmd_getpwnam_callback] (2): No results for getpwnam call (Tue Jun 21 11:02:48 2011) [sssd[be[default]]] [acctinfo_callback] (4): Request processed. Returned 0,0,Success slapd debug info ----------------------------------------------------------------------------------------------------------------------------------------------------------------- => acl_mask: access to entry "dc=rhel6,dc=ldaptest,dc=com", attr "entry" requested => acl_mask: to all values by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: search access granted by read(=rscxd) => access_allowed: search access granted by read(=rscxd) => access_allowed: search access to "dc=rhel6,dc=ldaptest,dc=com" "entry" requested => acl_get: [1] attr entry => acl_mask: access to entry "dc=rhel6,dc=ldaptest,dc=com", attr "entry" requested => acl_mask: to all values by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: search access granted by read(=rscxd) => access_allowed: search access granted by read(=rscxd) => access_allowed: search access to "uid=test2,dc=rhel6,dc=ldaptest,dc=com" "uid" requested => acl_get: [1] attr uid => acl_mask: access to entry "uid=test2,dc=rhel6,dc=ldaptest,dc=com", attr "uid" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: search access granted by read(=rscxd) => access_allowed: search access granted by read(=rscxd) => access_allowed: search access to "uid=test2,dc=rhel6,dc=ldaptest,dc=com" "objectClass" requested => acl_get: [1] attr objectClass => acl_mask: access to entry "uid=test2,dc=rhel6,dc=ldaptest,dc=com", attr "objectClass" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: search access granted by read(=rscxd) => access_allowed: search access granted by read(=rscxd) => access_allowed: read access to "uid=test2,dc=rhel6,dc=ldaptest,dc=com" "entry" requested => acl_get: [1] attr entry => acl_mask: access to entry "uid=test2,dc=rhel6,dc=ldaptest,dc=com", attr "entry" requested => acl_mask: to all values by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: read access granted by read(=rscxd) => access_allowed: read access granted by read(=rscxd) => access_allowed: result not in cache (cn) => access_allowed: read access to "uid=test2,dc=rhel6,dc=ldaptest,dc=com" "cn" requested => acl_get: [1] attr cn => acl_mask: access to entry "uid=test2,dc=rhel6,dc=ldaptest,dc=com", attr "cn" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: read access granted by read(=rscxd) => access_allowed: read access granted by read(=rscxd) => access_allowed: result not in cache (uid) => access_allowed: read access to "uid=test2,dc=rhel6,dc=ldaptest,dc=com" "uid" requested => acl_get: [1] attr uid => acl_mask: access to entry "uid=test2,dc=rhel6,dc=ldaptest,dc=com", attr "uid" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: read access granted by read(=rscxd) => access_allowed: read access granted by read(=rscxd) => access_allowed: result not in cache (uidNumber) => access_allowed: read access to "uid=test2,dc=rhel6,dc=ldaptest,dc=com" "uidNumber" requested => acl_get: [1] attr uidNumber => acl_mask: access to entry "uid=test2,dc=rhel6,dc=ldaptest,dc=com", attr "uidNumber" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: read access granted by read(=rscxd) => access_allowed: read access granted by read(=rscxd) => access_allowed: result not in cache (loginShell) => access_allowed: read access to "uid=test2,dc=rhel6,dc=ldaptest,dc=com" "loginShell" requested => acl_get: [1] attr loginShell => acl_mask: access to entry "uid=test2,dc=rhel6,dc=ldaptest,dc=com", attr "loginShell" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: read access granted by read(=rscxd) => access_allowed: read access granted by read(=rscxd) => access_allowed: result not in cache (homeDirectory) => access_allowed: read access to "uid=test2,dc=rhel6,dc=ldaptest,dc=com" "homeDirectory" requested => acl_get: [1] attr homeDirectory => acl_mask: access to entry "uid=test2,dc=rhel6,dc=ldaptest,dc=com", attr "homeDirectory" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: read access granted by read(=rscxd) => access_allowed: read access granted by read(=rscxd) => access_allowed: result not in cache (gidNumber) => access_allowed: read access to "uid=test2,dc=rhel6,dc=ldaptest,dc=com" "gidNumber" requested => acl_get: [1] attr gidNumber => acl_mask: access to entry "uid=test2,dc=rhel6,dc=ldaptest,dc=com", attr "gidNumber" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: read access granted by read(=rscxd) => access_allowed: read access granted by read(=rscxd) => access_allowed: result not in cache (userPassword) => access_allowed: read access to "uid=test2,dc=rhel6,dc=ldaptest,dc=com" "userPassword" requested => acl_get: [1] attr userPassword => acl_mask: access to entry "uid=test2,dc=rhel6,dc=ldaptest,dc=com", attr "userPassword" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: read access granted by read(=rscxd) => access_allowed: read access granted by read(=rscxd) => access_allowed: result not in cache (objectClass) => access_allowed: read access to "uid=test2,dc=rhel6,dc=ldaptest,dc=com" "objectClass" requested => acl_get: [1] attr objectClass => acl_mask: access to entry "uid=test2,dc=rhel6,dc=ldaptest,dc=com", attr "objectClass" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: read access granted by read(=rscxd) => access_allowed: read access granted by read(=rscxd) => access_allowed: result was in cache (objectClass) => access_allowed: result was in cache (objectClass) => access_allowed: result was in cache (objectClass) => access_allowed: result not in cache (shadowLastChange) => access_allowed: read access to "uid=test2,dc=rhel6,dc=ldaptest,dc=com" "shadowLastChange" requested => acl_get: [1] attr shadowLastChange => acl_mask: access to entry "uid=test2,dc=rhel6,dc=ldaptest,dc=com", attr "shadowLastChange" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: read access granted by read(=rscxd) => access_allowed: read access granted by read(=rscxd) => access_allowed: result not in cache (gecos) => access_allowed: read access to "uid=test2,dc=rhel6,dc=ldaptest,dc=com" "gecos" requested => acl_get: [1] attr gecos => acl_mask: access to entry "uid=test2,dc=rhel6,dc=ldaptest,dc=com", attr "gecos" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: read access granted by read(=rscxd) => access_allowed: read access granted by read(=rscxd) => access_allowed: result not in cache (modifyTimestamp) => access_allowed: read access to "uid=test2,dc=rhel6,dc=ldaptest,dc=com" "modifyTimestamp" requested => acl_get: [1] attr modifyTimestamp => acl_mask: access to entry "uid=test2,dc=rhel6,dc=ldaptest,dc=com", attr "modifyTimestamp" requested => acl_mask: to value by "", (=0) <= check a_dn_pat: * <= acl_mask: [1] applying read(=rscxd) (stop) <= acl_mask: [1] mask: read(=rscxd) => slap_access_allowed: read access granted by read(=rscxd) => access_allowed: read access granted by read(=rscxd)

1 0

ppolicy overlay and pwdreset attribute question
by Cyril GROSJEAN 24 Jun '11

24 Jun '11

I use OpenLDAP 2.4.24 with the following default password policy, because I want my users to change their password at first connection, or after a password reset by an administrator: dn: cn=default,ou=policies,dc=company cn: default description: Strategie de gestion des mots de passe par defaut objectClass: top objectClass: person objectClass: pwdPolicy pwdAllowUserChange: TRUE pwdAttribute: userPassword pwdCheckQuality: 2 pwdExpireWarning: 0 pwdFailureCountInterval: 0 pwdGraceAuthNLimit: 0 pwdInHistory: 0 pwdMaxAge: 0 pwdMaxFailure: 0 pwdMinAge: 0 pwdMinLength: 8 pwdMustChange: TRUE pwdSafeModify: FALSE sn: policy When creating a user account (either as administrator or any user with sufficient rights), the pwdReset attribute is not set automatically, and thus, the newly created user can bind and search without being forced to change his password. I have to manually set the pwdReset attribute to TRUE in the user entry at creation time or after creation to force a password change. Is this normal behaviour ? I would have expected to see the pwdReset attribute automatically set (by the ppolicy overlay). Otherwise, setting pwdMustChange to TRUE in the password policy definition looks unuseful. On the contrary, when the user changes his password, the pwdReset attribute is automatically removed, which tends to mean the password policy overlay is called and does something in this case ..

3 5

olcDbCacheSize: no equality matching rule
by Gerard Ranke 24 Jun '11

24 Jun '11

Dear listmembers, After upgrading from openldap 2.4.21 to 2.4.25 my olcDbCacheSize entry seems to have gone awoll. I tried to fix that with the following ldif file: dn: olcDatabase={1}hdb,cn=config changetype:modify add: olcDbCachesize olcDbCachesize: 10000 but I got this errormessage: modifying entry "olcDatabase={1}hdb,cn=config" ldap_modify: Inappropriate matching (18) additional info: modify/add: olcDbCacheSize: no equality matching rule Does anybody have any idea what is wrong? Many thanks in advance, Gerard Ranke

2 1

RE: ppolicy works, then doesn't
by Cyril GROSJEAN 24 Jun '11

24 Jun '11

Do you have any clue (from the access log for example), that this user’s password has been successfully changed after 20110606211056Z ? Or is there any chance that the password was changed while the policy overlay wasn’t loaded, which could occur if it was changed on a misconfigured replica for example.

2 1

N-Way replication
by Darouichi, Aziz 23 Jun '11

23 Jun '11

I setup N-Way replication openldap-2.4.23 in RHEL5. Config file is identical on both servers. In one server I get this error message in the log. send_search_entry: conn 1000 ber write failed. I run slapdindex, and turned off schemasearch. Error message still being generated. Thanks,

2 3

[SOLVED] olcDbCacheSize: no equality matching rule
by Gerard Ranke 23 Jun '11

23 Jun '11

>Dear listmembers, >After upgrading from openldap 2.4.21 to 2.4.25 my olcDbCacheSize entry seems to have gone awoll. I >tried to fix that with the following ldif file: >dn: olcDatabase={1}hdb,cn=config >changetype:modify >add: olcDbCachesize >olcDbCachesize: 10000 >but I got this errormessage: >modifying entry "olcDatabase={1}hdb,cn=config" >ldap_modify: Inappropriate matching (18) > additional info: modify/add: olcDbCacheSize: no equality matching rule Been staring at this for too long: The olcDbCacheSize was sitting right there... Sorry for the noise. Best, gerard

1 0

Schema modification errors
by Marc Elliott 23 Jun '11

23 Jun '11

Hi All, I have a brand new OpenLDAP server installed by Ubuntu and running locally on which I need to alter one of the core schemas to accommodate some legacy data. Unfortunately, I keep getting errors on my modification attempts. (BTW - the LDAP repository is current empty, though schemas have been added to cn=config) The LDIF I've been submitting is: dn: cn=core,cn=schema,cn=config changetype: modify delete: objectclasses objectclasses: ( 2.5.6.17 NAME 'groupOfUniqueNames' ) - add: objectclasses objectclasses: ( 2.5.6.17 NAME 'groupOfUniqueNames' DESC 'RFC2256: a group of unique names (DN and Unique Identifier)' SUP top STRUCTURAL MUST ( cn ) MAY ( businessCategory $ seeAlso $ owner $ ou $ o $ description $ uniqueMember ) ) And the error I get is: #!RESULT ERROR #!CONNECTION ldap://localhost:389 #!DATE 2011-06-21T10:29:02.855 #!ERROR [LDAP: error code 21 - objectclasses: value #0 invalid per syntax] dn: cn=core,cn=schema,cn=config changetype: modify delete: objectclasses objectclasses: ( 2.5.6.17 NAME 'groupOfUniqueNames' ) - add: objectclasses objectclasses: ( 2.5.6.17 NAME 'groupOfUniqueNames' DESC 'RFC2256: a group of unique names (DN and Unique Identifier)' SUP top STRUCTURAL MUST ( cn ) MAY ( businessCategory $ seeAlso $ owner $ ou $ o $ description $ uniqueMember ) ) Any ideas? I'm new to OpenLDAP and usually try to avoid changing standard schema elements so I may be missing something simple. Thanks! Marc

1 0

ppolicy works, then doesn't
by Bidwell, Matt 22 Jun '11

22 Jun '11

I had ppolicy working. Then it stopped. I've cut some stuff for security but I've included some debug info off the ldap server and the ldapsearch + output for that user. Most notably pwdHistory and pwdChangedTime no longer updates. pwdMinLength seems to work, as does pwdCheckQuality. Any ideas why it stopped working or what else I can use to debug? I've recently changed the hash, but it didn't coincide with the date ppolicy stopped working. Matt >From Ldap server debug: acl: internal mod entryCSN: modify access granted acl: internal mod modifiersName: modify access granted acl: internal mod modifyTimestamp: modify access granted bdb_modify_internal: replace userPassword bdb_modify_internal: replace entryCSN bdb_modify_internal: replace modifiersName bdb_modify_internal: replace modifyTimestampca oc_check_required entry (uid=testuser,ou=fte,ou=people), objectClass "posixAccount" oc_check_required entry (uid=testuser,ou=fte,ou=people), objectClass "shadowAccount" oc_check_required entry (uid=testuser,ou=fte,ou=people), objectClass "inetOrgPerson" oc_check_allowed type "roomNumber" oc_check_allowed type "employeeType" oc_check_allowed type "shadowExpire" oc_check_allowed type "homePhone" oc_check_allowed type "givenName" oc_check_allowed type "mobile" oc_check_allowed type "objectClass" oc_check_allowed type "shadowLastChange" oc_check_allowed type "uid" oc_check_allowed type "mail" oc_check_allowed type "uidNumber" oc_check_allowed type "cn" oc_check_allowed type "telephoneNumber" oc_check_allowed type "loginShell" oc_check_allowed type "host" oc_check_allowed type "gidNumber" oc_check_allowed type "gecos" oc_check_allowed type "homeDirectory" oc_check_allowed type "sn" oc_check_allowed type "structuralObjectClass" oc_check_allowed type "entryUUID" oc_check_allowed type "creatorsName" oc_check_allowed type "createTimestamp" oc_check_allowed type "pwdHistory" oc_check_allowed type "pwdChangedTime" oc_check_allowed type "pwdPolicySubentry" oc_check_allowed type "userPassword" oc_check_allowed type "entryCSN" oc_check_allowed type "modifiersName" oc_check_allowed type "modifyTimestamp" Ldapsearch: # testuser, fte, people, dn: uid=testuser,ou=fte,ou=people structuralObjectClass: inetOrgPerson entryUUID: 2c51bca1-1460-4b26-ae20-3c054c861d30 creatorsName: cn=admin createTimestamp: 20110523222307Z pwdHistory: 20110606211017Z#1.3.6.1.4.1.1466.115.121.1.40#38#{SSHA}aZlEl1nHU2K pwdHistory: 20110606211045Z#1.3.6.1.4.1.1466.115.121.1.40#38#{SSHA}LCJWgHumf2f pwdHistory: 20110606211056Z#1.3.6.1.4.1.1466.115.121.1.40#38#{SSHA}toDKXKosvds pwdChangedTime: 20110606211056Z pwdPolicySubentry: cn=default,ou=policies entryCSN: 20110617223036.234028Z#000000#000#000000 modifiersName: uid=testuser,ou=fte,ou=people modifyTimestamp: 20110617223036Z entryDN: uid=testuser,ou=fte,ou=people subschemaSubentry: cn=Subschema hasSubordinates: FALSE # search result search: 3 result: 0 Success # numResponses: 2 # numEntries: 1

1 1

Schema modification errors
by Marc Elliott 21 Jun '11

21 Jun '11

Hi All, I have a brand new OpenLDAP server installed by Ubuntu and running locally on which I need to alter one of the core schemas to accommodate some legacy data. Unfortunately, I keep getting errors on my modification attempts. (BTW - the LDAP repository is current empty, though schemas have been added to cn=config) The LDIF I've been submitting is: dn: cn=core,cn=schema,cn=config changetype: modify delete: objectclasses objectclasses: ( 2.5.6.17 NAME 'groupOfUniqueNames' ) - add: objectclasses objectclasses: ( 2.5.6.17 NAME 'groupOfUniqueNames' DESC 'RFC2256: a group of unique names (DN and Unique Identifier)' SUP top STRUCTURAL MUST ( cn ) MAY ( businessCategory $ seeAlso $ owner $ ou $ o $ description $ uniqueMember ) ) And the error I get is: #!RESULT ERROR #!CONNECTION ldap://localhost:389 #!DATE 2011-06-21T10:29:02.855 #!ERROR [LDAP: error code 21 - objectclasses: value #0 invalid per syntax] dn: cn=core,cn=schema,cn=config changetype: modify delete: objectclasses objectclasses: ( 2.5.6.17 NAME 'groupOfUniqueNames' ) - add: objectclasses objectclasses: ( 2.5.6.17 NAME 'groupOfUniqueNames' DESC 'RFC2256: a group of unique names (DN and Unique Identifier)' SUP top STRUCTURAL MUST ( cn ) MAY ( businessCategory $ seeAlso $ owner $ ou $ o $ description $ uniqueMember ) ) Any ideas? I'm new to OpenLDAP and usually try to avoid changing standard schema elements so I may be missing something simple. Thanks! Marc

1 0

Re: schema replication problems with test059-slave-config
by Christopher Strider Cook 20 Jun '11

20 Jun '11

I'm assuming that my schema sync config issues are related to the mirrormode configuration I have not working well with the additional sync of the cn=schema,cn=config tree into cn=config,cn=slave. So I'm looking for other ways to have a single authoritative schema source that replicates to all locations. Overview: I have a pair of MirrorMode servers syncing cn=config between themselves. Also on these servers is a cn=config,cn=slave which also sync in a MirrorMode setup. Then there are a number of Consumer servers that syncrepl cn=config,cn=slave with a suffixmassage into their local cn=config databases. Initially, there was a syncrepl on the mirrormode servers that synced cn=schema,cn=config into cn=schema,cn=config,cn=slave. But this is failing (I'm presuming do to a conflict over use of the contextCSN, with the mirrormode syncs) So what are my options for keeping cn=schema,cn=config on the consumers in sync with cn=schema,cn=config on the mirrormode providers? Thanks, Chris

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical