- openldap-technical - openldap.org

[GnuTLS][TLS init def ctx failed: -1]
by Warren Howard 02 Apr '11

02 Apr '11

Hi there, I'm using: slapd -V @(#) $OpenLDAP: slapd 2.4.21 (Mar 30 2011 18:32:32) $ buildd@rothera:/build/buildd/openldap-2.4.21/debian/build/servers/slapd cat /etc/issue Ubuntu 10.04.2 LTS \n \l This is Ubuntu so openldap has been compiled with GnuTLS ldd /usr/sbin/slapd . . . libgnutls.so.26 => /usr/lib/libgnutls.so.26 (0xb73a9000) . . . I've been following this guide https://help.ubuntu.com/10.04/serverguide/C/openldap-server.html and the section on TLS works perfectly if I follow the instructions to the letter. That is, so long as the locations of olcTLSCACertificateFile, olcTLSCertificate and olcTLSCertificateKeyFile are /etc/ssl/certs, /etc/ssl/certs and /etc/ssl/private respectively, then slapd will start. For example: olcTLSCACertificateFile: /etc/ssl/certs/cacert.pem olcTLSCertificateFile: /etc/ssl/certs/ldap01_slapd_cert.pem olcTLSCertificateKeyFile: /etc/ssl/private/ldap01_slapd_key.pem However, if I change the location of any of these files slapd will fail to start with the error "TLS init def ctx failed: -1". Should anyone ask, yes I've doubled checked for correct file permissions and searched for typos. The names of the files does not matter, just their location. These appears to be bug to me. Regards, Warren.

2 2

Using memberOf overlay with groups that contain uids, not DNs
by Oliver Beattie 02 Apr '11

02 Apr '11

Hi, I realise the documentation for slapo-memberof indicate that this isn't possible, but I thought it worthwhile asking here anyway — is it possible to use the memberOf overlay with groups that use memberUid as their membership attributes, rather than user DNs? We have a large existing LDAP database that has thousands of groups like this, and would very much like to use slapo-memberof. Any pointers (positive or negative) much appreciated — just so I know for definite. —Oliver

2 1

adding a second node
by Friedrich Locke 01 Apr '11

01 Apr '11

Hi folks, i am begining to study ldap and have a doubt. In my tree i have a node a=b inserted below c=d,e=f, i.e., a=b,c=d,e=f exists. What happens if i try to insert a "new" a=b below c=d,e=f ? Thanks in advance. Gustavo.

2 1

Re: Antwort: Re: RHEL 6 OpenLDAP 2.4.19-15.el6 init problem
by Quanah Gibson-Mount 01 Apr '11

01 Apr '11

--On Friday, April 01, 2011 6:05 AM +0100 Markus Moj <MMoj(a)timocom.com> wrote: > > Hi, > > due to update and security policies in my company we are using the stable > version of the delivered build in openLDAP from Red Hat. Hi Markus, While I understand this is often the case with companies, this policy is short sighted. If you want to have a stable, secure, and functional LDAP server, then you need to be able to build OpenLDAP from source. If you insist on using RedHat's outdated and flawed packages, then you need to contact RedHat support to fix any bugs you find with it, as the advice from upstream will always be for you to build and install the current OpenLDAP version to verify whether or not any bugs you find actually exist in a current release. I would suggest you read over the change logs since OpenLDAP 2.4.19 was released to get an idea of the numerous issues that have been fixed since that release went out. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Dealing with BDB Crash
by ldap＠mm.st 01 Apr '11

01 Apr '11

A while ago I posted that we were having what we thought were random bdb backend crashes with the following in our log: bdb(o=example.com): PANIC: fatal region error detected; run recovery. This was on a on our RH5 openldap servers (2.3.43) that we were rebuilding: It appears that the crashes were caused by a vulnerability scanner that was hitting the server (still testing), even though it was suppose to be safe. We'll have to investigate what is causing it, maybe we will need an acl to stop whatever the scanner is doing. Once we stopped the automated scan, the servers seem to be running as expected. But, this brought up another issue. When the bdb backend failed, the slapd process continued run and listen on the ldap ports and clients still tried to connect to the failed server for authentication. The server accepted and established the connection with the client. Of course the client could not authenticate since the backend db was down. The client will not fail over to the other server that is listed in it's ldap.conf file since it thinks it has a valid connection. If the slap process is not running then the fail over works fine since no ports are there for the client to connect to. I'm thinking that bdb failures will be rare once we solve the scanner issue, but on a network that relies heavily on ldap, a failed bdb backend with a running slapd would cause significant issues. Just trying to restart the slapd service doesn't fix the issue, a manual recovery is required (slapd_db_recover). I was curious if anyone has put something in place to deal with this potential issue? Maybe run slapd_db_status via cron and if it errors due a bdb corruption, just stop slapd and let the admin know. At least the clients would be able to failover to the other ldap servers. I guess an automated recovery is possible via a script, but I'm not sure if that's a good idea. Maybe dealing with this type of failure is not really required, I was hoping that some of you that have been do this for a while would have some insight.

8 9

issue with slapadd
by Judith Flo Gaya 01 Apr '11

01 Apr '11

Hello, I'm using openldap-server 2.4.19-15 in a Red Hat 6 box (x86_64), rpm installation. This is the very first time I use ldap and I'm having some issues with the configuration. I read that the slapd.conf file should not be use, instead the slapd.d directory is the new system that is meant to be. As I don't know how this exactly works, I've been reading and folowing the tutorial in the openldap page. Specifically I read the Administration guide and I copy and adapt the config.ldif file to suit my needs. After a while I manage to run the command: slapadd -F /etc/openldap/slapd.d -n 0 -l config.ldif with no problems. I thought that once this was done the slapd should start smoothly, but instead I'm having an slaptest error saying that my configuration FILE is wrong. As the slapd.conf doesn't exists, I don't know where this error comes from. I tried #slaptest -v -d1 -F ../slapd.d/ [......] ldif_back_add: "olcDatabase={-1}frontend,cn=config" oc_check_required entry (olcDatabase={-1}frontend,cn=config), objectClass "olcDatabaseConfig" oc_check_required entry (olcDatabase={-1}frontend,cn=config), objectClass "olcFrontendConfig" oc_check_allowed type "objectClass" oc_check_allowed type "olcDatabase" oc_check_allowed type "olcAddContentAcl" oc_check_allowed type "olcLastMod" oc_check_allowed type "olcMaxDerefDepth" oc_check_allowed type "olcReadOnly" oc_check_allowed type "olcMonitoring" oc_check_allowed type "structuralObjectClass" oc_check_allowed type "entryUUID" oc_check_allowed type "creatorsName" oc_check_allowed type "createTimestamp" oc_check_allowed type "entryCSN" oc_check_allowed type "modifiersName" oc_check_allowed type "modifyTimestamp" ldif_back_add: err: 68 text: send_ldap_result: conn=-1 op=0 p=0 slaptest: bad configuration directory! Since the directory structure was built by the slapadd command, where is the problem? I'm sure I'm doing something wrong but I can't find it ;( Permissions are ok (at the beginning I had issues with the include core.ldif part of my config.ldif, I ended pasting the contents in the config.ldif) Thanks in advance for your help, hope you can shed some light on this. j -- Judith Flo Gaya Systems Administrator IMPPC e-mail: jflo(a)imppc.org Tel (+34) 93 554-3079 Fax (+34) 93 465-1472 Institut de Medicina Predictiva i Personalitzada del Càncer Crta Can Ruti, Camí de les Escoles s/n 08916 Badalona, Barcelona, Spain http://www.imppc.org

2 2

importing ldap database for a BDC
by deconya 01 Apr '11

01 Apr '11

Hi list Im preparing a BDC server using samba with ldap and I start to import the database. At first I commented and error with the suffix but not was the last of my problems, Im importing and appears: <= str2entry: str2ad(sambaLogonTime): attribute type undefined slapadd: could not parse entry (line=81) _ 0.09% eta 01m elapsed none spd 64.8 k/s Closing DB... What Im making bad? First I copied all inside /etc/ldap/schema/ to the BDC, and I prepared with slapcat a bckup from PDC. I installed samba and copied smb.conf modifying the role. When I go to execute the slapadd -l backup.ldif appears the error. Any idea? Thanks And Best Regards

3 3

Regexp in rootdn and set-resolving of monitor attr
by Kilian Röhner 01 Apr '11

01 Apr '11

Hey, i have two questions: 1. Is it possible to specify a regexp as rootdn? 2. In an access-rule, i have a set like: by set="(user + ([cn=Current,cn=Time,cn=Monitor]/monitorTimestamp)) & (this/modifiersName + this/createTimestamp)" write But it seems, that the Monitor-Part isn't resolved correctly (returns empty and thus empty for the whole set). What am i doing wrong here? Thanks! Regards, Kilian

3 7

overlay ppolicy not found
by sarath chandra 01 Apr '11

01 Apr '11

Hi, I'm getting this error: ------------------------------------------Mar 31 18:03:50 if-sr-000033 slapd[2170]: @(#) $OpenLDAP: slapd 2.4.23 (Feb 21 2011 03:15:19) $ root@IF-SR-000033:/root/ldap/openldap-2.4.23/servers/slapd Mar 31 18:03:50 if-sr-000033 slapd[2170]: overlay "ppolicy" not found Mar 31 18:03:50 if-sr-000033 slapd[2170]: slapd stopped. Mar 31 18:03:50 if-sr-000033 slapd[2170]: connections_destroy: nothing to destroy. ------------------------------------------ The slapd.conf file has these entries also: modulepath /usr/local/lib moduleload /usr/local/lib/ppolicy.la overlay ppolicy ppolicy_default "cn=Standard Policy,ou=Policies,dc=uaeexchange,dc=com ppolicy_use_lockout ------------------------------------------ The o/s is CentOS release 5. Can anybody suggest a solution for this? TIA Sarath

1 0

Re: 8 principal limitation in openldap
by Srivatsav M 31 Mar '11

31 Mar '11

Hi, I was triaging this issue and I ran into another mysterious area, it doesn't look like the number (8) of principals/RDN is the problem and infact the length/size of the RDN's could be the issue. Please find the /etc/ldap.conf files attached renamed according to the AD/openldap server being configured. a. In the ad_ldap_conf_size the number of characters is around 3137 for the nss_base_<map>. On line 122, if i just make the 80 as 8 in the end of the string, the command "getent passwd" is working and it lists all the users registered in the ldap.conf file but otherwise it doesn't show any user. b. In the open_ldap_conf_size_issue the number of characters is around 3103 for the nss_base_<map>. In the end of the file if i just comment the last two lines, the "getent passwd" is working and it lists all the users registered in the ldap.conf file but otherwise it doesn't show any user. from these findings this looks more like some buffer issue, can you please help me with the following. 1. Any particular method/file that I should be looking for to check this buffer size may be even in the nss_ldap library or so 2. If there is a buffer size issue of say around 3137 characters (bytes for that), what would be the best value to increase it. appreciate any help Thanks Ramakanth On 30 March 2011 01:17, Srivatsav M <srivatsav.mudumba(a)gmail.com> wrote: > Please find below the answers to your questions: > > 1. > >> We are using OpenLDAP for authenticating users registered in a LDAP > > > >> server (Open LDAP, Active Directory). > > Which one? Or both? > > Our dev environment has openLDAP and AD servers and we have tested this issue against each of them individually and are able to reproduce it against both the types of LDAP servers > > 2. Users shouldn't be "registered in the /etc/ldap.conf file". > >> Can you please help me understand why I shouldn't be using this in the > ldap.conf file? > > 3. Please supply a full copy of your /etc/ldap.conf, or at least a > representative one, and provide the example output of 'getent passwd > username' and 'groups > > >> attached along with this mail > > username' for the user who doesn't authenticate. You may also want to supply > the relevant PAM configuration files. > > $ getent passwd > root <xxxxxxxxx> > test_user:somepwd:1002:1002:Test User:/home/testuser:/bin/bash > test_people1:*:10004:10004:Test People1:/home/test_people1:/bin/bash > > >> All external users are not able to login after adding the 8th principal/RDN > > /etc/pam.d/common-auth > > auth required pam_env.so > auth sufficient pam_ldap.so use_first_pass > auth required pam_unix2.so > > /etc/pam.d/common-account > > account required pam_unix2.so > account sufficient pam_localuser.so > account required pam_ldap.so use_first_pass > > /etc/pam.d/common-session > > > session required pam_limits.so > session required pam_unix2.so > session required pam_mkhomedir.so skel=/etc/skel/ > session optional pam_ldap.so > session optional pam_umask.so > > Also, please provide details of your LDAP client (distribution release, what versions of nss_ldap and pam_ldap you are running). > > >> openldap2-client-2.3.32-0.25 > >> nss_ldap-259-4.3 > > 4. Do we know what the actual problem is? Do we know it would be solved by > nss-ldapd? > > There might be a simple misunderstanding here, or a simple configuration problem, and switching software might not solve that. > > Additionally, the distribution in question may have a different preferred LDAP client. > > >> based on the above information, would it be possible for pointing any config. issues? , please do let me know if you need any further information. > > thanks > > Ramakanth > > > On 25 March 2011 20:23, Marco Pizzoli <marco.pizzoli(a)gmail.com> wrote: > >> Hi, >> I could be corrected if I'm wrong, but this problem is not related to >> OpenLDAP. It's a nss_ldap problem. >> nss_ldap is a client library that's used by linux vendors to achieves >> seamless integration of users against *a* LDAP server. >> >> I had a similar problem with a complex configuration and bypassed (not >> solved) the problem by modifying my client configuration. >> >> I reduced the number of ldap server configured to be accessed: from 4 to >> 3. >> I reduced the number of users defined in *nss_initgroups_ignoreusers*directive: i had about 40 listed in it... >> >> Etc... >> >> Make some tries and tell me if you can solve it. >> >> Marco >> >> >> >> On Thu, Mar 24, 2011 at 9:25 PM, Srivatsav M <srivatsav.mudumba(a)gmail.com >> > wrote: >> >>> Hi, >>> >>> We are using OpenLDAP for authenticating users registered in a LDAP >>> server (Open LDAP, Active Directory). After adding 8 principals >>> (/etc/ldap.conf), none of the users registered in the /etc/ldap.conf file >>> are able to login. >>> >>> nss_base_passwd >>> OU=engg,DC=mycompany,DC=region,DC=someplace,DC=myarea,DC=compname,DC=parentcompname >>> nss_base_shadow >>> OU=engg,DC=mycompany,DC=region,DC=someplace,DC=myarea,DC=compname,DC=parentcompname >>> nss_base_group >>> OU=engg,DC=mycompany,DC=region,DC=someplace,DC=myarea,DC=compname,DC=parentcompname >>> >>> >>> Can you please share the reason for this 7 limitation in the open ldap >>> library. or how I can fix this issue. I am looking i for the header file in >>> the source files whhich has this constant or limitation defined. >>> >>> Tried googling, but it appears that no one has encountered this issue. >>> Some customers are running into this issue and it has become a severity 1 >>> issue to fix. >>> >>> Thanks >>> Ramakanth >>> >> >> >> >> -- >> _________________________________________ >> Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi. >> Jim Morrison >> > >

1 0

RHEL 6 OpenLDAP 2.4.19-15.el6 init problem
by Markus Moj 31 Mar '11

31 Mar '11

Hey, We are faceing a weird problem with our LDAP running on Red Hat 6.0. When we start our OpenLDAP with the init script as "root" the ldap server starts without problems or errors and seems to be runnig ok. If you connect with an LDAP Browser like Apache Directory Studio and try to edit some parameters in cn=config you get the following error. [LDAP: error code 80 - internal error (cannot create file)] But when you start the LDAP server with "/usr/sbin/slapd -h ldap:/// -u ldap" as the init script does, everything is working just fine and you are able to make every change you need to. Someone out there who has the same problem or already a solution or workaround for this problem? Mit freundlichen Grüßen / Kind regards Markus Moj IT Infrastructure & Services TimoCom Soft- und Hardware GmbH In der Steele 2 DE-40599 Düsseldorf Tel: +49 211 88 26 80 14 Fax: +49 211 88 26 70 14 eMail: mmoj(a)timocom.com Internet: www.timocom.com Geschäftsführer: Jens Thiermann, Gunther Matzaitis Amtsgericht Düsseldorf, HRB 34489

4 3

Global configuration directive 'logfile'
by Mark 31 Mar '11

31 Mar '11

I've been trying to get the 'logfile' configuration attribute (man5/slapd.conf.5) working but can't seem to. The relevant slapd.conf entries before I define my backend look like: loglevel stats sync logfile /tmp/openldap/var/log/slapd.log and the file exists before I start slapd: $ ls -l /tmp/openldap/var/log/slapd.log -rw-r--r-- 1 me mygrp 0 Mar 30 15:58 /tmp/openldap/var/log/slapd.log SLAPD runs fine dumping information into syslog but my logfile stays zero length. How can I get my logfile to get written to also? Thank you, My setup: RedHat Enerprise Linux 4.7 (Linux host 2.6.9-78.ELsmp #1 SMP Wed Jul 9 15:46:26 EDT 2008 x86_64 x86_64 x86_64 GNU/Linux) OpenLDAP 2.4.25 BerkeleyDB 4.8.30 OpenSSL 1.0.0d *Cyrus SASL *2.1.23 configured thusly: ( PATH="/tmp/openldap/bin:${PATH}"; export PATH echo "##BEG `date '+%Y/%m/%d %H:%M:%S'` - configure" CPPFLAGS="-I/tmp/openldap/include" \ CFLAGS="-g" \ LDFLAGS="-L/tmp/openldap/lib -R/tmp/openldap/lib" \ ./configure \ --without-subdir \ --enable-slapd \ --enable-modules \ --enable-wrappers \ --enable-backends=mod \ --disable-sql \ --disable-ndb \ --enable-overlays=mod \ --enable-debug \ --prefix=/tmp/openldap echo "##END `date '+%Y/%m/%d %H:%M:%S'` - configure" ) compiled and installed in /tmp/openldap $ file /tmp/openldap/libexec/slapd /tmp/openldap/libexec/slapd: ELF 64-bit LSB executable, AMD x86-64, version 1 (SYSV), for GNU/Linux 2.4.0, dynamically linked (uses shared libs), stripped

1 1

Re: Antwort: Re: RHEL 6 OpenLDAP 2.4.19-15.el6 init problem
by Dan White 31 Mar '11

31 Mar '11

On 31/03/11 14:29 +0100, Markus Moj wrote: >So what do you mean by specify a gid? This is not a self scripted init >script this one is 100% Red Hat we have changed nothing within the start >script. Redhat may not, but it's not uncommon for other OSs to do so. I'm assuming that the error message you are seeing is permissions related, possibly due to the fact that slapd is running under a different effective gid when you start it from the command line versus when you start it from an init script. One way to trouble shoot that is to explicitly specify a gid (-g) from your init script and your command line. -- Dan White

2 1

Infos needed to setup a ldap proxy
by Frank Bonnet 31 Mar '11

31 Mar '11

Hello Anyone could send me some pointers on documentation howto setup a proxy OpenLDAP server ? Basically I need it to have a unique LDAP server to configure all our LAN clients and have the possibility to modify the proxy server on demand to access several directory servers ( locals and distants ) Thanks

3 2

ldapsearch - CA cert without using ldap.conf
by Liam Gretton 31 Mar '11

31 Mar '11

Hi, With ldapsearch I'd like to specify on the command line the CA certificate file without having to use TLS_CACERT in ldap.conf or any other configuration file. I suspect the solution lies in either the -O or -e option to ldapsearch, but I can't find any documentation about them. I'd be very grateful to any pointers to a solution. -- Liam Gretton liam.gretton(a)le.ac.uk HPC Architect http://www.le.ac.uk/its IT Services Tel: +44 (0)116 2522254 University of Leicester, University Road Leicestershire LE1 7RH, United Kingdom

5 5

Authentication issue with syncrepl consumer
by Daniel Finn 31 Mar '11

31 Mar '11

I’ve got a strange issue going on which I believe just started happening but it’s hard to say for sure. I’ve got a small environment with a syncrepl provider and a syncrepl consumer which is placed in our DMZ. The provider is used for authentication for all of our internal linux servers and the consumer is used for authentication for all of our DMZ servers. The environment is less than 50 servers and maybe about 25 users. Both of these ldap servers are running OpenLDAP 2.3.43-12 provided by CentOS. I put this all into place about 2 months ago and everything has been working fine up until now. I’m seeing authentication failures for servers using the consumer but it’s not for all users, for example my personal user is able to authenticate fine which is what makes it hard to say when this started happening. For the most part I’m the only one logging into these servers on a regular basis. One of our web developers today let me know that he was unable to log into any servers that authenticate against the consumer but that he could log into all of the rest of our servers. I changed his password, noticed that syncrepl saw the change on the consumer and I still wasn’t able to log in as that user. I then created a new user, saw that syncrepl saw that on the consumer, and also was not able to log in as that user. Both of these users can still log into any server authenticating against the provider. On the consumer, I shut down ldap, deleted everything from under /var/lib/ldap and started from scratch using slapadd to import an ldiff that was dumped from the provider. This still didn’t fix the authentication issues. I’m not exactly sure what the relevant info is from the log so I captured a complete log that includes a failed authentication attempt with the loglevel set at 1. It can be seen here: http://pastebin.com/KY9m0CN4 The only thing I see in there that jumps out at me is: “<= bdb_index_read: failed (-30989)” It looks like I’m seeing that for every authentication failure. I found a couple old mailing posts regarding that error saything that it could either be BDB corruption or that it could just mean it’s searching for something that doesn’t exist. I was assuming that if it was BDB, that starting from scratch with the slapadd would fix it but it did not. I also did a diff against the dumps from both the provider and the consumer and when comparing the entries for a user who is failing authentication on the consumer, the only difference was the entryCSN and the modifyTimestamp. Any help would be really appreciated. Thanks, Dan Daniel Finn Linux/Storage Administrator P: 801.553.4587 M: 801.683.9147 [cid:3384344954_110196386] “Improving Oral Health Globally” Email Policy - Unauthorized review, use, disclosure, or distribution of this e-mail is strictly prohibited. This e-mail transmission, and any documents, files or previous e-mail messages attached to it, is intended solely for the individual or individuals to whom it is specifically addressed. If the recipient of this email is not the intended recipient, do not read, copy or distribute it or any of the information it contains. Please delete it immediately and notify us by return email or by telephone 801.572.4200.

1 1

user authentication on attributes
by sim123 30 Mar '11

30 Mar '11

I have openLDAP server up and running and trying to integrate it with Confluence. My LDAP structure looks like DN :: uid=123, ou=users, dc=example, dc=com uid :: 123 mail :: bjason(a)example.com cn :: barbara sn :: jason userPassword :: test (plain test for now) I have another similar entry in another branch (su) for "confluence admin", I did LDAP configuration in confluence and tested the bind with confluence user. Now for every user authentication I am assuming LDAP should be able to bind on any attribute other than DN. however I can not do that. when I try to login from confluence using mail & password, this is what I see in my slapd.d logs : connection_get(12): got connid=1000 connection_read(12): checking for input on id=1000 ber_get_next ber_get_next: tag 0x30 len 48 contents: op tag 0x60, time 1301434489 ber_get_next conn=1000 op=0 do_bind ber_scanf fmt ({imt) ber: ber_scanf fmt (m}) ber: >>> dnPrettyNormal: <uid=234,ou=su,dc=example,dc=com> <<< dnPrettyNormal: <uid=234,ou=su,dc=example,dc=com>, <uid=234,ou=su,dc=example,dc=com> do_bind: version=3 dn="uid=234,ou=su,dc=example,dc=com" method=128 bdb_dn2entry("uid=234,ou=su,dc=example,dc=com") => bdb_dn2id("dc=example,dc=com") <= bdb_dn2id: got id=0x1 => bdb_dn2id("ou=su,dc=example,dc=com") <= bdb_dn2id: got id=0x4 => bdb_dn2id("uid=234,ou=su,dc=example,dc=com") <= bdb_dn2id: got id=0x7 entry_decode: "uid=234,ou=su,dc=example,dc=com" <= entry_decode(uid=234,ou=su,dc=example,dc=com) do_bind: v3 bind: "uid=234,ou=su,dc=example,dc=com" to "uid=234,ou=su,dc=example,dc=com" send_ldap_result: conn=1000 op=0 p=3 send_ldap_response: msgid=1 tag=97 err=0 ber_flush2: 14 bytes to sd 12 connection_get(12): got connid=1000 connection_read(12): checking for input on id=1000 ber_get_next ber_get_next: tag 0x30 len 144 contents: op tag 0x63, time 1301434489 ber_get_next conn=1000 op=1 do_search ber_scanf fmt ({miiiib) ber: >>> dnPrettyNormal: <ou=user,dc=example,dc=com> <<< dnPrettyNormal: <ou=user,dc=example,dc=com>, <ou=user,dc=example,dc=com> ber_scanf fmt ({mm}) ber: ber_scanf fmt ({mm}) ber: ber_scanf fmt ({M}}) ber: => get_ctrls ber_scanf fmt ({m) ber: => get_ctrls: oid="2.16.840.1.113730.3.4.2" (noncritical) <= get_ctrls: n=1 rc=0 err="" ==> limits_get: conn=1000 op=1 self="uid=234,ou=su,dc=example,dc=com" this="ou=user,dc=example,dc=com" => bdb_search bdb_dn2entry("ou=user,dc=example,dc=com") => bdb_dn2id("ou=user,dc=example,dc=com") <= bdb_dn2id: got id=0x3 entry_decode: "ou=user,dc=example,dc=com" <= entry_decode(ou=user,dc=example,dc=com) search_candidates: base="ou=user,dc=example,dc=com" (0x00000003) scope=2 => bdb_equality_candidates (objectClass) => key_read <= bdb_index_read: failed (-30988) <= bdb_equality_candidates: id=0, first=0, last=0 => bdb_dn2idl("ou=user,dc=example,dc=com") <= bdb_dn2idl: id=2 first=3 last=6 => bdb_equality_candidates (objectClass) => key_read <= bdb_index_read 2 candidates <= bdb_equality_candidates: id=2, first=6, last=7 => bdb_equality_candidates (cn) => key_read <= bdb_index_read: failed (-30988) <= bdb_equality_candidates: id=0, first=0, last=0 bdb_search_candidates: id=0 first=3 last=0 bdb_search: no candidates send_ldap_result: conn=1000 op=1 p=3 send_ldap_response: msgid=2 tag=101 err=0 ber_flush2: 14 bytes to sd 12 I guess I should be able to do LDAP_BIND with any attribute and LDAP should be able to search user's DN based on the attribute and authenticate him as I have laready provided valid DN and password (for confluence user), am I right here? Please let me know if its doable (should be) and what am I missing here ? I tried searching for this but couldn't find it on the web. Thanks for the help and support. -simon

3 6

syncrepl binds always fail the first time
by Tyler Gates 30 Mar '11

30 Mar '11

Hello, Using version 2.4.24 I have a replication server that periodically queries the provider for updates via refreshOnly. I've noticed that once slapd is started, the bind to the replicator DN on the provider always failed but subsequent do_syncrepl retries succeed. Ideally I'd like the first bind to succeed so it pulls in all the data instead of having to wait <retry> seconds. Is this normal behavior or do I have something mis-configured? slapd.conf: include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/openldap.schema include /etc/ldap/schema/qmail.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args modulepath /usr/lib/ldap moduleload back_hdb loglevel config allow bind_anon_dn database hdb directory /var/lib/ldap suffix "dc=domain,dc=com" rootdn "cn=Manager,dc=domain,dc=com" index objectclass,entryCSN,entryUUID eq index uid,memberUid,uidNumber,gidNumber eq cachesize 200 idlcachesize 600 checkpoint 50 5 syncrepl rid=001 provider=ldaps://directory-master.domain.com type=refreshOnly interval=00:00:10:00 retry="60 5 600 +" searchbase="dc=domain,dc=com" filter="(|(&(objectClass=posixAccount)(uid=username))(&(objectClass=posixGroup)(memberUid=username)))" scope=sub attrs="cn,sn,givenName,homeDirectory,loginShell,ou,uid,uidNumber,userPassword,memberUid,gidNumber" schemachecking=off bindmethod=simple binddn="cn=replicator,dc=domain,dc=com" credentials=secret

2 1

meta and AD disabled accounts
by Fred 30 Mar '11

30 Mar '11

Okay, new to OpenLDAP, have managed to setup a meta backend/proxy to multiple Active Directory systems that is doing everything I need with one exception. I can't figure out a reliable way to filter out disabled accounts on the AD side. I know how to query this directly against AD of course (NOT UserAccountControl:1.2.840.113556.1.4.803:=2), but after a lot of searching and head scratching I'm not sure how to implement this in my slapd.conf - or even just allow the filter (if specified by a client) to pass through: My original filter: "(&(objectclass=inetOrgPerson)(!(objectclass=Computer))(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))" >From slapd debug output, after passing through the parser: "(objectClass=user)(!(!(objectClass=*)))(?=error)" As you can see, objectClass inetOrgPerson is mapped to User (and I've got some work to do on the Computer objectClass too) but the UserAccountControl bitwise flag is the part I'm hung up on right now.

2 2

entry format
by Omer Faruk SEN 30 Mar '11

30 Mar '11

Hi, I have a dump of Sun LDAP Directory server (6.3.1) I see dn: cn=me,ou=groups,dc=me,dc=com nsUniqueId: 1255060a-46e511dd-803ce5f5-385faa0b objectClass;vucsn-4869456e0009002d0000: top objectClass;vucsn-4869456e0009002d0000: groupOfUniqueNames cn;vucsn-4869456e0009002d0000;mdcsn-4869456e0009002d0000: everyone description;vucsn-4869456e0009002d0000: everyone lines what is the meaning of vucsn,mdcsn and adcsn? Regards.

2 2

slapd segfaults in one node of master-master
by Dave Smith 29 Mar '11

29 Mar '11

We run version 2.4.16 on two RHEL4 platforms in master-master configuration. One of our nodes regularly reports a segfault and exits. The log is shown below. This is a production platform so we run minimal logging for performance reasons. We have been running openldap in this configuration for 2 years without a problem. The issues started after we applied as schema change and added more users accounts to the system. The schema changes we straight-forward. We added a few optional attributes to existing objects and added one new object to our schema. Nothing that required data fixes. Our schema provides an auxiliary user account object that we use with the standard "account" object. We have a number of additional objects that are related user authentication and authorization. We applied these same changes in various development and testing environments without problem. The other thing we did was add a lot of users accounts. Prior to this release we had some 6000 users accounts. Now we have over 15000 user accounts. We are concerned that our problem may be related to the additional load from these users. We are planning further grow in the user-base. One thing I should mention is that our system is more write-heavy that the NIS replacement system. We change attributes on the account record on every authentication request. We suspect this might be replication related because when we dump (using slapcat) and compare the two nodes, one user account record is missing from the node with the segfaults. This weekend we plan to rebuild this node from the slapcat output of the other. We hope this will resolve our problem. Mar 21 00:59:02 msgeuroha slapd: slapd startup succeeded Mar 21 01:47:29 msgeuroha kernel: slapd[19367]: segfault at 0000000000000048 rip 0000003e67507c3c rsp 0000000040e7f318 error 4 Mar 21 01:53:58 msgeuroha slapd: slapd startup succeeded Mar 21 03:46:54 msgeuroha kernel: slapd[14167]: segfault at 0000000000000048 rip 0000003e67507c3c rsp 0000000040e7f318 error 4 Mar 21 03:51:34 msgeuroha slapd: slapd startup succeeded Mar 21 09:10:34 msgeuroha kernel: slapd[6834]: segfault at 0000000000000048 rip 0000003e67507c3c rsp 0000000040e7f318 error 4 --DS

2 1

YubiKey authentication
by Francis Swasey 28 Mar '11

28 Mar '11

My boss dropped by and asked me if it would be possible to have our OpenLDAP servers (2.4) which are currently using the {SASL} password form to authenticate against saslauthd which goes to Kerberos be configured (on a per entry basis) to authenticate against the YubiKey or Kerberos. Has anyone set up an OpenLDAP server to authenticate against YubiKey? Or hooked YubiKey's authenication into SASL? (google hasn't found anything for me yet) Thanks, -- Frank Swasey | http://www.uvm.edu/~fcs Sr Systems Administrator | Always remember: You are UNIQUE, University of Vermont | just like everyone else. "I am not young enough to know everything." - Oscar Wilde (1854-1900)

2 1

replication possibilities
by denethorr＠o2.pl 28 Mar '11

28 Mar '11

Dear OpenLDAPs users, i want to integrate CMS with working OpenLDAP 2.3.30 tree to authorize CMS users. I use OpenLDAP for postfix maps, samba domain, posix accounts and VPN users. Because my CMS is in location which is not controlled by IT departament, i dont want to replicate whole tree, but about 30 accounts. I will need cn, userPassword or/and sambaNTPassword. Is it possible to do it with ldap builtin replication mechanism or should i write some scripts? Any examples? Best Regards, Jan

1 0

8 principal limitation in openldap
by Srivatsav M 28 Mar '11

28 Mar '11

Hi, We are using OpenLDAP for authenticating users registered in a LDAP server (Open LDAP, Active Directory). After adding 8 principals (/etc/ldap.conf), none of the users registered in the /etc/ldap.conf file are able to login. nss_base_passwd OU=engg,DC=mycompany,DC=region,DC=someplace,DC=myarea,DC=compname,DC=parentcompname nss_base_shadow OU=engg,DC=mycompany,DC=region,DC=someplace,DC=myarea,DC=compname,DC=parentcompname nss_base_group OU=engg,DC=mycompany,DC=region,DC=someplace,DC=myarea,DC=compname,DC=parentcompname Can you please share the reason for this 7 limitation in the open ldap library. or how I can fix this issue. I am looking i for the header file in the source files whhich has this constant or limitation defined. Tried googling, but it appears that no one has encountered this issue. Some customers are running into this issue and it has become a severity 1 issue to fix. Thanks Ramakanth

5 4

Internal (implementation specific) error (80) and cannot allocate memory
by Hendrik van der Ploeg 28 Mar '11

28 Mar '11

Hello People, I'm importing a ldif file in a ldapserver which has 200 different databases on it. The max is 256 by the way. I import the ldif in every database only with a different DN per database of course. I can import the ldif file in about 30 databases and then the server gives the error message: "ldapadd: Internal (implementation specific) error (80)" And in de slapd.log: bdb_locker_id: err Cannot allocate memory(12) The ldif file consist of about 8000 lines. Is there some kind of maximum entries per database and can I expand the maximum. I just can't imagine that there is a maximum of 8000 * 30 = 240000 Hope someone can help me. Regards, Hendrik

3 8

slapo-dds and data decoding error
by Michael Ströder 27 Mar '11

27 Mar '11

HI! For the fun of it I'm implementing a small Python script which sends a Refresh Request (RFC 2589). But slapo-dds (OpenLDAP 2.4.24) returns a protocol error due to a decoding error: Mar 24 20:48:38 nb2 slapd[8202]: conn=1015 op=1 EXT oid=1.3.6.1.4.1.1466.101.119.1 Mar 24 20:48:38 nb2 slapd[8202]: conn=1015 op=1 RESULT oid= err=2 text=data decoding error But what's wrong with the request value (BER file attached)? dumpasn1 output seems right to me: 0 51: SEQUENCE { 2 45: OCTET STRING : 'cn=DDS Test Raum,ou=Testing,dc=stroeder,dc=de' 49 2: INTEGER 332 : } Ciao, Michael.

2 3

suitable of ldap and openldap
by Ian Willis 27 Mar '11

27 Mar '11

Hi All I'm involved with a project where we're exporting information from a couple of bespoke systems for analytics purposes however there is a degree of sensitivity associated with some of the information. The developers of the analytics system have requested 3 API associated which they would like to have for accessing objects which are as follows. The first two API's would be interactive. 1 Input (user_id, object) output bool whether a user can access the object 2 Input (user_id, (set of objects) output (set of objects a user can access) 3 Input (user_id) output (the set of objects a user can access) or possibly the set that a user can't access. (This API can be a couple of orders of magnitude slower than the previous two as it will only be provided as a response once per session.) We have been considering a URL/URI formal for the object identification. The object will be associated with either a set of users or groups and we're leaning towards groups. Initially there may only be two groups sensitive and general however over time a finer grained model has some longer term business appeal. Rather than create yet another bit of bespoke infrastructure I was considering recommending that the API is implemented using LDAP. The kicker is that there could be up to 2 or 3 hundred million objects split across 4000 or so users broken up into 500 groups. Most of these users currently exist in a Oracle backend for a bespoke app and most of the objects will be exported as rows from the database so essentially a row is an object. The shop is a mixed windows unix/linux shop where the directory is currently AD. The internal developers are primarily MS and one has already suggested putting the objects into AD however I've said that this would probably hose operational systems and wouldn't be such a bright idea. ADAM will be the next suggestion from the MS side and if that occurs I will be suggesting that openldap should be thrown into the mix for a bakeoff on the grounds that the best performing system should provide the service. If this comes to pass I will also be making sure that load times are in scope as well. Based upon the information above 1 Is this completely insane. 2 Any thoughts or suggestions as to the appropriate schemas for implementing this, database backends ie BDB, HDB, malloc replacement etc. LDIF scripts for loading object would be welcome :) On the bright side I do have a 16core sun 4600 at home for doing some initial feasibility work with 32G of RAM. In production I would expect that the limits on memory would be driven by response times and the amount of memory that AMD/intel hardware can support. I would expect that commercial support would need to occur as well however everything is too embryonic at present to push that barrow. My background is from the unix/linux open source area however I haven't really played enough with openldap to be confident of any concepts that I have the opportunity to push. Cheers Ian

2 1

Writing overlays: examples available?
by Marco Pizzoli 26 Mar '11

26 Mar '11

Hi all, I would like to learn how to write an overlay. I'm looking at overlay sources as available in the OpenLDAP package, but they appear to be too complex to me, particularly in not having clear comments/descriptions and, most of all, considering that I'm an occasional C programmer. I ask if someone could send to me their overlay written for very simple goals or even for fun. Some code that I can easily follow and so have an idea of which hook use to do a specific thing. Commented source would be great! :-) Thanks in advance Marco -- _________________________________________ Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi. Jim Morrison

2 1

How to obtain Operations Attributes
by Suneet Shah 26 Mar '11

26 Mar '11

Hello, I am using the Java JDK 1.6.x to query ldap. I am using the query below. However, I need to be able to pull out the operational attributes as well. Any thoughts on how I can obtain the list of operational attributes without having to specify them? SearchControls searchCtls = new SearchControls(); searchCtls.setSearchScope(SearchControls.SUBTREE_SCOPE); NamingEnumeration results = ctx.search( config.getBaseDn(), searchFilter, searchCtls); while (results != null && results.hasMore()) { SearchResult sr = (SearchResult)results.next(); Attributes searchAttrs = sr.getAttributes(); if (searchAttrs != null ) { NamingEnumeration values = searchAttrs.getAll(); while (values.hasMore()) { javax.naming.directory.Attribute atr = (javax.naming.directory.Attribute)values.next(); thanks for your help

3 4

Multimaster ldap related questions
by Cannady, Mike 25 Mar '11

25 Mar '11

I have implemented a multi-master two node ldap with openldap 2.4.22 and Berkely DB 4.8.26 on Redhat enterprise 5.4 with several readonly replicas off of the masters. I have a need to add several optional attributes to a schema and probably should upgrade to 2.4.24 as well. If this was a single-master server, it would be easy to do; just slapcat the ldap store, update software, change schema, slapadd the ldap store back, and resume slapd. I'm not sure how to do that with multi-master. One reason for using multi-master was if one master was down, the other would keep running. One should be able to upgrade one server, have it catch up with the changes that the other master had done while the first master is down and then repeat for the 2nd master. Is this possible? Has anyone done this and how was it done? I know in the near future, a high-level branch on my DIT will be purged and bulk reloaded. I have tested the load with a test setup of multi-master ldap. If I do it via ldapadd, it takes over 6 hours to load. With slapadd (and slapd down) it only takes 25 minutes plus the time for the other master to get up-to-date. Is there any way that I can speed-up the update with ldapadd? I have pieces of my slapd.conf for the 1st master at the end of this email. Slapadd has two options that appear to be needed when dealing with multi-master or replicate nodes. The first is the "-S sid" option, the second is "-w". I'm a little confused what is used where. If you are doing a dump and restore operation (slapcat, delete database, slapadd) the only option you need is the "-w" option? If you are adding new entries offline then do both options need to be specified? Is there a multi-master best practice quide somewhere? Thanks for any help, ============== slapd.conf extract ==============: ServerID 001 pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args sizelimit unlimited moduleload ppolicy.1a database bdb suffix "dc=htc,dc=com" rootdn "cn=Manager,dc=htc,dc=com" rootpw XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXx directory /usr/local/var/openldap-data cachesize 50000 dncachesize 50000 idlcachesize 150000 checkpoint 1024 5 dbconfig set_cachesize 0 268435456 1 dbconfig set_lg_bsize 2097152 dbconfig set_lg_regionmax 262144 dbconfig set_flags DB_LOG_AUTOREMOVE monitoring on index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub index entryCSN eq index entryUUID eq index uniqueIdentifier eq overlay ppolicy ppolicy_default "cn=default,ou=policies,dc=htc,dc=com" syncrepl rid=002 provider=ldap://vmldapdev2.htc.external:389 type=refreshAndPersist retry="5 5 300 +" searchbase="dc=htc,dc=com" attrs="*,+" bindmethod=simple binddn="uid=vmldapdev1,ou=replicants,ou=admin,dc=htc,dc=com" credentials=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX mirrormode TRUE overlay syncprov syncprov-checkpoint 1000 1 database monitor ********************************************************************** HTC Disclaimer: The information contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the message and deleting it from your computer. Thank you. **********************************************************************

3 3

deleting values from multivalued attribute
by Hugo Monteiro 25 Mar '11

25 Mar '11

Hello list, is it possible to perform the deletion of only a certain number of values, from a multivalued attribute, without having to perform full deletion and then adding the ones we'd like to keep? example, entry has: mail: user(a)example.com mailAlternateAddress: first.last(a)example.com mailAlternateAddress: flast(a)example.com mailAlternateAddress: firstl(a)example.com I would like to be able to remove flast(a)example.com but keep the rest of the addresses, using a single ldap operation, ending up with mail: user(a)example.com mailAlternateAddress: first.last(a)example.com mailAlternateAddress: firstl(a)example.com Best Regards, Hugo Monteiro. -- fct.unl.pt:~# cat .signature Hugo Monteiro Email : hugo.monteiro(a)fct.unl.pt Telefone : +351 212948300 Ext.15307 Web : http://hmonteiro.net Divisão de Informática Faculdade de Ciências e Tecnologia da Universidade Nova de Lisboa Quinta da Torre 2829-516 Caparica Portugal Telefone: +351 212948596 Fax: +351 212948548 www.fct.unl.pt apoio(a)fct.unl.pt fct.unl.pt:~# _

4 7

Re: syncrepl and mass deletes
by LALOT Dominique 25 Mar '11

25 Mar '11

Yes, but I believe this is not the same case. We are replicating differents datbases instead of subtree into a single database. In case you have two providers, whole refresh is not working. What can I do more to file a report? Thanks Dom 2011/3/24 Quanah Gibson-Mount <quanah(a)zimbra.com> > --On Thursday, March 24, 2011 11:44 AM +0100 LALOT Dominique < > dom.lalot(a)gmail.com> wrote: > > Well, >> >> To resume my tests: >> >> provider and consumer in 2.4.24 -> same behaviour >> Get rid of session log -> same behaviour >> >> If I removed one of the providers of my consumer, everything went fine. >> Even, if I stop the consumer during mass deletes, it sync very fast as >> soon as it starts again >> That's related to several providers for one consumer and may be something >> else I don't see. >> The second provider (first rid in my conf) has less that 15 entries and >> no updates at all. >> >> I changed the order of the providers in my slapd.conf. There is no >> difference. >> > > Have you looked at the report in ITS#6872? > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Dominique LALOT Ingénieur Systèmes et Réseaux http://annuaire.univmed.fr/showuser.php?uid=lalot

2 1

audit or accesslog remote IP
by Omer Faruk SEN 25 Mar '11

25 Mar '11

Hi, Is there a way to also log IP address of remote system at audit and/or accesslog events. Regards.

2 1

syncrepl and mass deletes
by LALOT Dominique 24 Mar '11

24 Mar '11

Hello, I am testing the replication feature in a multimaster environment replicating into a single database. As stated before, I added serverid to my providers. I just have two providers for test purpose. I tested mass updates on a provider, stopped my replica during updates, then start again and it's OK, it updates the entries If I do the same for mass deletes. I deleted 40000 entries while stopping the consumer. My consumer is still with 30000 undeleted entries. I left the consumer for hours, restarting it twice. It seems there is no regular compare between consumer or provider in such situation. I'll simplify to test in a single provider setup, to see if it works. All servers are 2.4.23 consumer side. A script is populating the DIT via slapadd first to create the dc entries. database bdb suffix "dc=fr" serverid 0x40 ldap://ldapmaitre.univ-yy.fr syncrepl rid=040 provider=ldap://ldapmaitre.univ-yy.fr/ type=refreshAndPersist searchbase="dc=univ-yy,dc=fr" retry="60 10 300 +" scope=sub filter="(objectClass=*)" attrs="*,+" schemachecking=off bindmethod=simple serverid 0x20 ldap://anutest.univ-xx.fr syncrepl rid=020 provider=ldap://anutest.univ-xx.fr/ type=refreshAndPersist searchbase="dc=univ-xx,dc=fr" retry="60 10 300 +" scope=sub filter="(objectClass=*)" attrs="*,+" schemachecking=off bindmethod=simple Mar 23 13:29:11 ldaprelay slapd[24319]: @(#) $OpenLDAP: slapd 2.4.23 (Nov 19 2010 17:41:28) $#012#011buildd@allspice :/build/buildd/openldap-2.4.23/debian/build/servers/slapd Mar 23 13:29:11 ldaprelay slapd[24320]: slapd starting Mar 23 13:29:11 ldaprelay slapd[24320]: do_syncrep2: rid=040 LDAP_RES_INTERMEDIATE - REFRESH_DELETE Mar 23 13:29:11 ldaprelay slapd[24320]: do_syncrep2: rid=020 LDAP_RES_INTERMEDIATE - REFRESH_DELETE root@ldaprelay:/etc/ldap# ldapsearch -x -LLL -s base contextcsn dn: dc=fr contextCSN: 20110323101636.221613Z#000000#040#000000 contextCSN: 20110323100346.844382Z#000000#020#000000 Thanks for any hints Dom -- Dominique LALOT Ingénieur Systèmes et Réseaux http://annuaire.univmed.fr/showuser.php?uid=lalot

3 8

Efficient Searching for Groups & its members
by sim123 24 Mar '11

24 Mar '11

Hi All, I am designing LDAP schema and the structure looks like : --ROOT ---- ou = people ------- cn = john smith ---- ou = groups ------ ou = group1 -------- member:john smith ------ ou = group2 -------- member: john smith I would like to find out what all groups john smith belongs to (I have full dn) and all the members of a group. I am wondering about the performance of such search, since one person can be part of multiple groups and there can be thousands of groups in the server. If its a relational database I can create a relationship table and put indexes in place. How can I get best performance with OpenLDAP? Or is there any other way I should design this? Thanks for the help.

3 4

How to compile slapd as static binary
by Marco Pizzoli 23 Mar '11

23 Mar '11

Hi list, could someone tell me how can I obtain a binary slapd with all libraries linked statically in it? I tried mixing many --enable-static / --enable-shared=no etc... without no luck. I also tried invoking make with LTFLAGS="-static" Thanks Marco --

1 0

OpenLDAP / Samba integration
by fuzzy_4711 23 Mar '11

23 Mar '11

Hi, I am facing issues with implementing samba user and group authentification using openldap. Is this the right place to ask? -fuz

5 7

Re: OpenLDAP / Samba integration
by fuzzy_4711 22 Mar '11

22 Mar '11

-------- Original - Text -------- > > I had a similar problem on 11.4 after a rebuild. Try turning off apparmor. > > That worked for me. > Thank you Stuart. I already did - and believe me: Every new install of openSuSE here at my place will have turned of AppArmor in the future. It is just a pain in the a.. not only for OpenLDAP. I found this behavior yesterday - it took me 3 hours or so to find out that smbd won't start when this mess was switched on. But smbd is started and working. I missed something in user mapping between samba and ldap, i guess. Search goes on. -fuz

1 0

Letting Users Create Groups
by Tim Gustafson 22 Mar '11

22 Mar '11

Hi, I'd like to let users create posixGroup objects, but I don't want them to be able to pick a gidNumber that is already in use, or that is less than 1000 or greater than 10000, and I only want the groups to be created in the ou=Group,dc=example,dc=com container. Is this possible with OpenLDAP ACLs? Tim Gustafson Baskin School of Engineering UC Santa Cruz tjg(a)soe.ucsc.edu 831-459-5354

3 6

Re: one user access all databases
by Buchan Milne 22 Mar '11

22 Mar '11

On Tuesday, 22 March 2011 12:12:53 Hendrik van der Ploeg wrote: > ok thanks, > > But how can I set the user in a seperate database to have access to a > different database? > > Use a separate local database with a suitable backend (e.g. hdb or bdb). Any "local" DN can appear in access control statements for any other database. Here is one example (allowing "local" users in dc=ranger,dc=dnsalias,dc=com access to cn=config) [bgmilne@tiger ~]$ ldapsearch -Q -LLL -b cn=config "(olcDatabase=config)" olcAccess dn: olcDatabase={0}config,cn=config olcAccess: {0}to * by group="cn=LDAP Admins,ou=System Groups,dc=ranger,dc=dnsa lias,dc=com" ssf=112 write olcAccess: {1}to * by * none [bgmilne@tiger ~]$ ldapwhoami -Q dn:uid=bgmilne,ou=people,dc=ranger,dc=dnsalias,dc=com [bgmilne@tiger ~]$ ldapcompare -Q 'cn=LDAP Admins,ou=System Groups,dc=ranger,dc=dnsalias,dc=com' member:uid=bgmilne,ou=people,dc=ranger,dc=dnsalias,dc=com TRUE (BTW, please keep replies on-list, and while we're at it, try avoid unnecessary top-posting) Regards, Buchan

2 3

Re: one user access all databases
by Hendrik van der Ploeg 22 Mar '11

22 Mar '11

ok thanks, But how can I set the user in a seperate database to have access to a different database? Regards, Hendrik > On Tue, 22 Mar 2011 12:07:54 +0200 (SAST), Buchan Milne > <bgmilne(a)staff.telkomsa.net> wrote: >> ----- "Hendrik van der Ploeg" <hvdploeg(a)competa.com> wrote: >> >>> Hello, >>> >>> Can I add 1 user in cn=config so that it can access all the >>> underlying >>> databases? (olcdatabase={1}bdb, olcdatabase={2}bdb etc. >> >> cn=config is not for hosting entries for DUA clients, just as the > 'mysql' >> database is not for hosting tables for RDBMS client applications. >> >>> The reason for this is that I use ldap-meta which connects to a LDAP >>> server with multiple databases in it. >>> >>> dc=0001,dc=domain,dc=nl >>> dc=0002,dc=domain,dc=nl >>> dc=0003,dc=domain,dc=nl >>> >>> I use "idassert-bind" at the ldap-meta server to set a different >>> username. >>> But in this situation I need to add an extra username for every >>> database in >>> slapd.conf >>> >>> Is there a possibility to use a global user which can access all the >>> databases? >> >> Use a separate local database with a suitable backend (e.g. hdb or bdb). >> >> Regards, >> Buchan -- Hendrik van der Ploeg Competa IT ( http://www.competa.com ) Verrijn Stuartlaan 20 2288 EL Rijswijk the Netherlands Phone: +31(0)704277555 Fax: +31(0)704277554

1 0

Re: one user access all databases
by Buchan Milne 22 Mar '11

22 Mar '11

----- "Hendrik van der Ploeg" <hvdploeg(a)competa.com> wrote: > Hello, > > Can I add 1 user in cn=config so that it can access all the > underlying > databases? (olcdatabase={1}bdb, olcdatabase={2}bdb etc. cn=config is not for hosting entries for DUA clients, just as the 'mysql' database is not for hosting tables for RDBMS client applications. > The reason for this is that I use ldap-meta which connects to a LDAP > server with multiple databases in it. > > dc=0001,dc=domain,dc=nl > dc=0002,dc=domain,dc=nl > dc=0003,dc=domain,dc=nl > > I use "idassert-bind" at the ldap-meta server to set a different > username. > But in this situation I need to add an extra username for every > database in > slapd.conf > > Is there a possibility to use a global user which can access all the > databases? Use a separate local database with a suitable backend (e.g. hdb or bdb). Regards, Buchan

1 0

one user access all databases
by Hendrik van der Ploeg 22 Mar '11

22 Mar '11

Hello, Can I add 1 user in cn=config so that it can access all the underlying databases? (olcdatabase={1}bdb, olcdatabase={2}bdb etc. The reason for this is that I use ldap-meta which connects to a LDAP server with multiple databases in it. dc=0001,dc=domain,dc=nl dc=0002,dc=domain,dc=nl dc=0003,dc=domain,dc=nl I use "idassert-bind" at the ldap-meta server to set a different username. But in this situation I need to add an extra username for every database in slapd.conf Is there a possibility to use a global user which can access all the databases? Thanks in advance Regards, Hendrik The Netherlands

1 0

OpenLDAP Memory Usage
by Diego Lima 22 Mar '11

22 Mar '11

Hello all, I'm experiencing some problems with some OpenLDAP servers: the slapd process seems to always use more memory, eventually reaching a point where it has consumed all the available server memory and is killed by the OOM killer. The servers have 32gb of memory plus 32gb of swap space and are running Debian Lenny (with kernel 2.6.26-2-amd64), and we have compiled OpenLDAP 2.4.23 from source, and we're using Berkeley DB 4.6. The servers are dedicated to running OpenLDAP, so they don't have other processes that use a significant amount of memory. This is a relatively high-volume environment, with 4 servers running with mirrormode to enable multi-master replication. The current database size is about 900mb. Is there any setting that could limit this memory usage? I don't feel this is "normal" considering our DB size and cache sizes. These are my slapd.conf and DB_CONFIG files: --------------------------------- slapd.conf --------------------------------- disallow bind_anon require authc #== Schemas snipped == pidfile /usr/local/openldap/var/run/slapd.pid argsfile /usr/local/openldap/var/run/slapd.args loglevel 16640 modulepath /usr/local/openldap/lib/ldap/ moduleload back_bdb moduleload ppolicy moduleload syncprov threads 8 database config rootdn "cn=admin,cn=config" rootpw {SSHA}PASS database monitor rootdn "cn=admin,cn=monitor" rootpw {SSHA}PASS database bdb suffix "dc=corpldap,dc=mycompany" rootdn "cn=admin,dc=corpldap,dc=mycompany" rootpw {SSHA}PASS directory /usr/local/openldap/var/corpldap-mycompany-data overlay ppolicy overlay syncprov ppolicy_hash_cleartext syncprov-checkpoint 100 10 syncprov-sessionlog 100 monitoring on lastmod on checkpoint 512 10 cachesize 200000 idlcachesize 600000 #== Indexes and ACLs snipped == serverid 1 syncrepl rid=002 provider="ldap://server02:389" searchbase="dc=corpldap,dc=mycompany" type="refreshAndPersist" retry="30 10 60 15 600 +" bindmethod=simple binddn="cn=repuser3,ou=replica,dc=corpldap,dc=mycompany" credentials="PASSWORD" #== other syncrepl entries snipped mirrormode on --------------------------------- DB_CONFIG --------------------------------- set_lg_max 10485760 set_lg_regionmax 1048576 set_lg_bsize 2097152 set_lg_dir /var/ldap/corpldap-mycompany-log set_flags DB_LOG_AUTOREMOVE set_cachesize 0 2073741824 0 set_lk_max_objects 5000 set_lk_max_locks 5000 set_lk_max_lockers 5000 -- Diego Lima http://www.diegolima.org

4 6

DSEE to OpenLDAP
by adam＠spoontech.biz 21 Mar '11

21 Mar '11

Hi, I have currently been given the task of migrating our current LDAP environment from Sun DSEE (6.3.1) to OpenLDAP. I have done some research on this topic, and suspect its not a trivial task, and am hoping for some pointers/advise from anyone that may have attempted this in the past... I'm not sure that replication between the two is an option (although would love it if it was :), so I have looked into exporting the current DSEE environment to a LDIF, and attempted to then import it into openldap (using slapadd), but ran into a few issues... The issue I'm currently stuck on is getting the data in the LDIF into a format that can be imported using slapadd. Currently, I have issues with automounts, pwdReset attribs etc etc... Any help would be appreciated. Cheers,

7 7

Fw: Trying to start Slapd, bad conf file.
by Noel Akins 21 Mar '11

21 Mar '11

Hi, When I try to start slapd I get a failed message saying the config file is bad. What I have below is what was uncommented in slapd.conf as it came in the package. I installed Openldap via yum on my 1and1 VPS which has CentOS. It would seem that the Openldap package for CentOS puts things in different places then in other distributions, and it also seems that this conf file is a bit more complex then what I see in introductory material on LDAP/Openldap, which isn't helping me to learn this. I'm wanting to use ldap to authenticate users on a website, and to ultimately use Shibboleth to federate logins (which requires ldap). I'm new to this and I'm not sure what the problem is with this file. One thing I wanted to ask was since I'm looking to use ldap for website authentication, do I need these schema's? I know I can create a local schema which I think is what I need to do for my purpose. If you have any suggestions or can point out what is wrong here, I would greatly appreciate it. Thank you. ######################################################################### include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema # Allow LDAPv2 client connections. This is NOT the default. allow bind_v2 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args database bdb suffix "dc=<mydomain>,dc=<org>" rootdn "cn=XXXXXX,dc=<mydomain>,dc=<org>" rootpw xxxxxxx directory /var/lib/ldap # Indices to maintain for this database index objectClass eq,pres index ou,cn,mail,surname,givenname eq,pres,sub index uidNumber,gidNumber,loginShell eq,pres index uid,memberUid eq,pres,sub index nisMapName,nisMapEntry eq,pres,sub

2 1

syncrepl consumer with several providers, is it working?
by LALOT Dominique 21 Mar '11

21 Mar '11

Hello, I'm a little bit worried about that mail and the fact that our setup is getting out of sync sometimes. http://www.openldap.org/lists/openldap-software/200505/msg00324.html versions: the providers are all 2.4. The consumer is 2.4.23, some providers 2.4.21 one 2.4.11 And our setup is not stable, we get out of sync, it's a matter of days/weeks. So, is this working? Should we prefer a relay, then replicate from the relay. What is the right solution? Is there a simple way to force replication whithout deleting the database? Should I replicate to 4 databases and create refererals, then replicate the whole tree to another consumer? Thanks in advance for any advice Dom Our configuration on the fusion consumer: database bdb suffix "dc=fr" syncrepl rid=010 provider=ldap://ldapmaitre.univ-xx.fr/ type=refreshAndPersist searchbase="dc=univ-xx,dc=fr" retry="60 10 300 +" scope=sub filter="(objectClass=*)" attrs="*,modifytimestamp,modifiersName,createTimestamp,creatorsName" schemachecking=off bindmethod=simple syncrepl rid=011 provider=ldap://ldapmaitre.univ-yy.fr/ type=refreshAndPersist searchbase="dc=univ-yy,dc=fr" retry="60 10 300 +" scope=sub filter="(objectClass=*)" attrs="*,modifytimestamp,modifiersName,createTimestamp,creatorsName" schemachecking=off bindmethod=simple syncrepl rid=012 provider=ldap://annuaire.univ-zz.fr/ type=refreshAndPersist searchbase="dc=univ-zz,dc=fr" retry="60 10 300 +" scope=sub filter="(objectClass=*)" attrs="*,modifytimestamp,modifiersName,createTimestamp,creatorsName" schemachecking=off bindmethod=simple syncrepl rid=013 provider=ldap://annuaire-maitre.univ-ww.fr/ type=refreshAndPersist searchbase="dc=univ-ww,dc=fr" retry="60 10 300 +" scope=sub filter="(objectClass=*)" attrs="*,modifytimestamp,modifiersName,createTimestamp,creatorsName" schemachecking=off bindmethod=simple -- Dominique LALOT Ingénieur Systèmes et Réseaux http://annuaire.univmed.fr/showuser.php?uid=lalot

3 4

how ldap works replicating AD?
by Lumeng Lim 21 Mar '11

21 Mar '11

am new to this but is familiar with the purpose of ldap. I just can't visualize how it works. What we would want to happen is have linux desktops to authenticate with a linux server to be able to gain access to network resources. currently. We have linux server with samba as PDC and windows clients that connect to network shared resourced. Users just login via the "domain" and network drives are mapped. When server is unavailable (in cases of laptops) user just logs in and work with the local resources We would like to have the same thing going with linux desktops and laptops. With LDAP how is this implemented? Hope someone can help us visualize so we know what softwares and configurations should be done in the side of both the server and the clients.

2 1

Re: Error code 65 - invalid structural object class chain (groupOfUniqueNames/posixGroup)]
by Casey Jordan 20 Mar '11

20 Mar '11

Quanah, Thanks for the quick reply. I understand this, however the tutorial I am following seems to require it: http://demo.exist-db.org/exist/ldap-security.xml They say "Each group is represented by a single entry under the groupDN as a union of RFC 2307 posixGroup and RFC 2256 groupOfUniqueNames." If this is indeed a requirement for these systems to talk to each other do I have any other options? Thanks, Casey On Fri, Mar 18, 2011 at 4:57 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Friday, March 18, 2011 4:16 PM -0400 Casey Jordan < > casey.jordan(a)jorsek.com> wrote: > > Hi group, >> >> I am trying to import an ldif and I keep getting this error which has me >> totally stumped: >> > > An LDAP object may only have one structural objectClass. You've provided > two. > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- -- Casey Jordan easyDITA a product of Jorsek LLC "CaseyDJordan" on LinkedIn, Twitter & Facebook Cell (585) 348 7399 Office (585) 239 6060 easydita.com This message is intended only for the use of the Addressee(s) and may contain information that is privileged, confidential, and/or exempt from disclosure under applicable law. If you are not the intended recipient, please be advised that any disclosure copying, distribution, or use of the information contained herein is prohibited. If you have received this communication in error, please destroy all copies of the message, whether in electronic or hard copy format, as well as attachments, and immediately contact the sender by replying to this e-mail or by phone. Thank you.

1 0

Understanding back_perl SampleLDAP.pm
by Marco Pizzoli 20 Mar '11

20 Mar '11

Hi list, could someone help me in understanding what the SampleLDAP.pm perl module do in its search routine? This is the code: -------- sub search { my $this = shift; my ( $base, $scope, $deref, $sizeLim, $timeLim, $filterStr, $attrOnly, @attrs ) = @_; print {*STDERR} "====$filterStr====\n"; $filterStr =~ s/$|$//gm; $filterStr =~ s/=/: /m; my @match_dn = (); for my $dn ( *keys %{$this}* ) { if ( $this->{$dn} =~ /$filterStr/imx ) { push @match_dn, $dn; last if ( scalar @match_dn == $sizeLim ); } } my @match_entries = (); for my $dn (@match_dn) { push @match_entries, $this->{$dn}; } return ( 0, @match_entries ); } -------- I'm interested in knowing what "keys %{$this}" should contain and why, in trying to use this sample perl module I cannot see any "key" of the array variable $this. I configured the database in this way: database perl suffix "dc=perl,dc=com" perlModulePath /tmp/appoggio/ perlModule SampleLDAP Thanks in advance Marco

2 4

Error code 65 - invalid structural object class chain (groupOfUniqueNames/posixGroup)]
by Casey Jordan 18 Mar '11

18 Mar '11

Hi group, I am trying to import an ldif and I keep getting this error which has me totally stumped: [LDAP: error code 65 - invalid structural object class chain (groupOfUniqueNames/posixGroup)] ( And here is the attributes it fails on ) dn: cn=dba,ou=Groups,dc=exist,dc=easydita , dc=com gidNumber: 1 objectClass: groupOfUniqueNames objectClass: posixGroup uniqueMember: uid=admin,ou=Users,dc=exist,dc=easydita , dc=com cn: dba I assume this has something to do with a conflict between posixGroup and groupOfUniqueNames, but I am pretty green on this stuff so I am not sure what I need to do to resolve this. Any help would be much appreciated. Thanks, Casey -- -- Casey Jordan easyDITA a product of Jorsek LLC "CaseyDJordan" on LinkedIn, Twitter & Facebook Cell (585) 348 7399 Office (585) 239 6060 easydita.com This message is intended only for the use of the Addressee(s) and may contain information that is privileged, confidential, and/or exempt from disclosure under applicable law. If you are not the intended recipient, please be advised that any disclosure copying, distribution, or use of the information contained herein is prohibited. If you have received this communication in error, please destroy all copies of the message, whether in electronic or hard copy format, as well as attachments, and immediately contact the sender by replying to this e-mail or by phone. Thank you.

2 1

Re: newbie problem importing ldap
by deconya 18 Mar '11

18 Mar '11

Hi Are you sure? I have a server working and not has any slapd.conf inside. The new server too. Are two ubuntu 9.04 server. Thanks 2011/3/18 Jonathan Clarke <jonathan(a)openldap.org> > On 18/03/11 15:42, deconya wrote: > > Ok and where i can change it? > > > > Mi ldap.conf only has: > > > > base dc=esci,dc=es > > > > uri ldapi://127.0.0.1/ <http://127.0.0.1/> > > > > ldap_version 3 > > > > rootbinddn cn=admin,dc=esci,dc=es > > > > Is other file? > > The configuration file for OpenLDAP server is slapd.conf. ldap.conf is > for LDAP *clients*, thus irrelevant here. > > Jonathan > > > > > 2011/3/18 Benjamin Griese <der.darude(a)gmail.com > > <mailto:der.darude@gmail.com>> > > > > Hello, > > your database suffix doesn't fit to your ldif, you're missing "dc=es" > > in your database suffix declaration. > > > > bye. > > > > On Fri, Mar 18, 2011 at 13:11, deconya <elmailpersonal(a)gmail.com > > <mailto:elmailpersonal@gmail.com>> wrote: > > > Hi list > > > > > > Im having problems configuring a new slave ldap server. I made > > > > > > # slapcat -l master.ldif in masters server > > > > > > Inside ubuntu server with openldap 2.4 Im going to import using > > > > > > # slapadd -c -l ./master.ldif > > > > > > Appears: > > > > > > slapadd: line 1: database (dc=esci) not configured to hold > > "dc=esci,dc=es" > > > slapadd: line 1: database (dc=esci) not configured to hold > > "dc=esci,dc=es" > > > slapadd: line 19: database (dc=esci) not configured to hold > > > "cn=admin,dc=esci,dc=es" > > > slapadd: line 19: database (dc=esci) not configured to hold > > > "cn=admin,dc=esci,dc=es" > > > slapadd: line 33: database (dc=esci) not configured to hold > > > "ou=Users,dc=esci,dc=es" > > > slapadd: line 33: database (dc=esci) not configured to hold > > > "ou=users,dc=esci,dc=es" > > > slapadd: line 45: database (dc=esci) not configured to hold > > > "ou=Groups,dc=esci,dc=es" > > > slapadd: line 45: database (dc=esci) not configured to hold > > > "ou=groups,dc=esci,dc=es" > > > slapadd: line 57: database (dc=esci) not configured to hold > > > "ou=Computers,dc=esci,dc=es" > > > slapadd: line 57: database (dc=esci) not configured to hold > > > "ou=computers,dc=esci,dc=es" > > > slapadd: line 69: database (dc=esci) not configured to hold > > > "ou=Idmap,dc=esci,dc=es" > > > slapadd: line 69: database (dc=esci) not configured to hold > > > "ou=idmap,dc=esci,dc=es" > > > > > > And more errores type: > > > > > > str2entry: invalid value for attributeType objectClass #4 (syntax > > > 1.3.6.1.4.1.1466.115.121.1.38) > > > slapadd: could not parse entry (line=123) > > > > > > Only I installed openldap package and inside schema folder I added > > the same > > > schema archives. > > > > > > What step Im wrong? > > > > > > Thanks And Best Regards > > > > > > > > > > > -- > > To be or not to be -- Shakespeare | To do is to be -- Nietzsche | To > > be is to do -- Sartre | Do be do be do -- Sinatra > > > > > >

2 1

Confused about pwdpolicy
by Luo, Frank Y.F. Mr. 18 Mar '11

18 Mar '11

I have an administrative user "uid=admin,ou=people,dc=compnay,dc=com" and The first ACI sentence is like this access to * by dn=" uid=admin,ou=people,dc=compnay,dc=com" manage ... {omitted} by * break access to ..... {omitted} I assume that allows this admin user to manage all the attribute (*) including changing userPassword for all users. But it turns out that I still need to set pwdAllowUserChange to TRUE in the default pwdpolicy. But as I understand this password policy controls users changing their own password, not an administrator covered by above ACI. Here I copied from the man page. pwdAllowUserChange This attribute specifies whether users are allowed to change their own passwords or not. If pwdAllowUserChange is set to "TRUE", or if the attribute is not present, users will be allowed to change their own passwords. If its value is "FALSE", users will not be allowed to change their own passwords. There must be some misundersanding here. Anyone can help? Thanks Frank

1 1

newbie problem importing ldap
by deconya 18 Mar '11

18 Mar '11

Hi list Im having problems configuring a new slave ldap server. I made # slapcat -l master.ldif in masters server Inside ubuntu server with openldap 2.4 Im going to import using # slapadd -c -l ./master.ldif Appears: slapadd: line 1: database (dc=esci) not configured to hold "dc=esci,dc=es" slapadd: line 1: database (dc=esci) not configured to hold "dc=esci,dc=es" slapadd: line 19: database (dc=esci) not configured to hold "cn=admin,dc=esci,dc=es" slapadd: line 19: database (dc=esci) not configured to hold "cn=admin,dc=esci,dc=es" slapadd: line 33: database (dc=esci) not configured to hold "ou=Users,dc=esci,dc=es" slapadd: line 33: database (dc=esci) not configured to hold "ou=users,dc=esci,dc=es" slapadd: line 45: database (dc=esci) not configured to hold "ou=Groups,dc=esci,dc=es" slapadd: line 45: database (dc=esci) not configured to hold "ou=groups,dc=esci,dc=es" slapadd: line 57: database (dc=esci) not configured to hold "ou=Computers,dc=esci,dc=es" slapadd: line 57: database (dc=esci) not configured to hold "ou=computers,dc=esci,dc=es" slapadd: line 69: database (dc=esci) not configured to hold "ou=Idmap,dc=esci,dc=es" slapadd: line 69: database (dc=esci) not configured to hold "ou=idmap,dc=esci,dc=es" And more errores type: str2entry: invalid value for attributeType objectClass #4 (syntax 1.3.6.1.4.1.1466.115.121.1.38) slapadd: could not parse entry (line=123) Only I installed openldap package and inside schema folder I added the same schema archives. What step Im wrong? Thanks And Best Regards

2 2

openldap installed, running but can't connect remotely
by Casey Jordan 18 Mar '11

18 Mar '11

Hi group, I hope this is the right list to post this under. I have been having a problem connecting to an ldap server I just set up on ubuntu 10.10 I can use ldapsearch locally and get good results. but when I try to connect remotely IE: *sudo ldapsearch -xLLL -W -H ldap://ice.rit.edu -d1 "dc=easydita,dc=com"* (See end of debug) ldap_url_parse_ext(ldap://ice.rit.edu) ldap_create ldap_url_parse_ext(ldap://ice.rit.edu:389/??base) Enter LDAP Password: ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP ice.rit.edu:389 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 127.0.0.1:389 ldap_pvt_connect: fd: 3 tm: -1 async: 0 ldap_open_defconn: successful ldap_send_server_request ber_scanf fmt ({it) ber: ber_scanf fmt ({i) ber: ber_flush2: 34 bytes to sd 3 ldap_result ld 0xb8940170 msgid 1 wait4msg ld 0xb8940170 msgid 1 (infinite timeout) wait4msg continue ld 0xb8940170 msgid 1 all 1 ** ld 0xb8940170 Connections: * host: coheed.rit.edu port: 389 (default) refcnt: 2 status: Connected last used: Thu Mar 17 19:42:29 2011 ** ld 0xb8940170 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0xb8940170 request count 1 (abandoned 0) ** ld 0xb8940170 Response Queue: Empty ld 0xb8940170 response count 0 ldap_chkResponseList ld 0xb8940170 msgid 1 all 1 ldap_chkResponseList returns ld 0xb8940170 NULL ldap_int_select read1msg: ld 0xb8940170 msgid 1 all 1 ber_get_next ber_get_next: tag 0x30 len 16 contents: read1msg: ld 0xb8940170 msgid 1 message type bind ber_scanf fmt ({eAA) ber: read1msg: ld 0xb8940170 0 new referrals read1msg: mark request completed, ld 0xb8940170 msgid 1 request done: ld 0xb8940170 msgid 1 res_errno: 49, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_parse_result ber_scanf fmt ({iAA) ber: ber_scanf fmt (}) ber: ldap_msgfree ldap_err2string *ldap_bind: Invalid credentials (49)* I think I set up my admin password correctly, but I don't know how to verify this. This info may help too: Contents of /etc/ldap/slapd.d/cn=config/olcDatabase={0}config.ldif dn: olcDatabase={0}config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.exact=cn=localroot,cn=config manage by * break olcRootDN: cn=admin,cn=config structuralObjectClass: olcDatabaseConfig entryUUID: eca09490-e524-102f-87c5-17d7a82e8985 creatorsName: cn=config createTimestamp: 20110317205733Z entryCSN: 20110317205733.193089Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20110317205733Z I've spent about 5 hours now trying to get this to work so any help would be much appreciated. Thanks Casey -- -- Casey Jordan easyDITA a product of Jorsek LLC "CaseyDJordan" on LinkedIn, Twitter & Facebook Cell (585) 348 7399 Office (585) 239 6060 easydita.com This message is intended only for the use of the Addressee(s) and may contain information that is privileged, confidential, and/or exempt from disclosure under applicable law. If you are not the intended recipient, please be advised that any disclosure copying, distribution, or use of the information contained herein is prohibited. If you have received this communication in error, please destroy all copies of the message, whether in electronic or hard copy format, as well as attachments, and immediately contact the sender by replying to this e-mail or by phone. Thank you.

2 2

OpenLDAP migration from 2.3 to 2.4
by jpb＠bordengrammar.kent.sch.uk 18 Mar '11

18 Mar '11

Hi All, I'm currently in the progress of moving from v2.3 to 2.4 and have been following the procedure shown in the documentation for switching from the old slapd.conf to the new cn= format, i.e. slaptest -f <path> -F path> . If I copy over slapd.conf from my old server and run slapd -d 256 , it starts perfectly and answers querires, etc.. If, on the other hand, I run the slaptest command shown above I get the following: <= str2entry(cn={1}core) -> 0x7fda53d38798 => access_allowed: search access to "cn={1}core,cn=schema,cn=config" "objectClass" requested <= root access granted => access_allowed: search access granted by manage(=mwrscxd) olcAttributeTypes: value #0 olcAttributeTypes: Duplicate attributeType: "2.5.4.2" config error processing cn={1}core,cn=schema,cn=config: olcAttributeTypes: Duplicate attributeType: "2.5.4.2" send_ldap_result: conn=-1 op=0 p=0 send_ldap_result: err=80 matched="" text="" slapd destroy: freeing system resources. slapd stopped. connections_destroy: nothing to destroy. I've been around Google and have found no solutions. My slapd.conf is years old and was made according to the smbldap tutorial originally written by IDEALX. The file is shown below and any info is welcome. Thanks, Julian ####slapd.conf #### include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/samba.schema database bdb directory /var/lib/ldap suffix "dc=bordengrammar,dc=kent,dc=sch,dc=uk" rootdn "cn=Administrator,dc=bordengrammar,dc=kent,dc=sch,dc=uk" sizelimit 10000 idletimeout 3700 rootpw {SSHA}<removed> index objectClass,uidNumber,gidNumber eq index cn,sn,uid,displayName pres,sub,eq index memberUid,mail,givenname eq,subinitial index sambaSID,sambaPrimaryGroupSID,sambaDomainName eq # TLSCertificateFile /etc/openldap/cacerts/ldap.cert # TLSCertificateKeyFile /etc/openldap/cacerts/ldap.key access to attrs=userPassword,sambaLMPassword,sambaNTPassword by self write by anonymous auth by * none access to * by * read access to attrs=userPassword,sambaNTPassword,sambaLMPassword,sambaPwdLastSet,sambaPwdMustChange by dn="cn=samba,ou=DSA,dc=bordengrammar,dc=kent,dc=sch,dc=uk" write by dn="cn=smbldap-tools,ou=DSA,dc=bordengrammar,dc=kent,dc=sch,dc=uk" write by dn="cn=nssldap,ou=DSA,dc=bordengrammar,dc=kent,dc=sch,dc=uk" write by self write by anonymous auth by * none access to attrs=objectClass,entry,homeDirectory,uid,uidNumber,gidNumber,memberUid by dn="cn=samba,ou=DSA,dc=bordengrammar,dc=kent,dc=sch,dc=uk" write by dn="cn=smbldap-tools,ou=DSA,dc=bordengrammar,dc=kent,dc=sch,dc=uk" write by * read access to attrs=description,telephoneNumber,roomNumber,homePhone,loginShell,gecos,cn,sn,givenname by dn="cn=samba,ou=DSA,dc=bordengrammar,dc=kent,dc=sch,dc=uk" write by dn="cn=smbldap-tools,ou=DSA,dc=bordengrammar,dc=kent,dc=sch,dc=uk" write by self write by * read access to attrs=cn,sambaLMPassword,sambaNTPassword,sambaPwdLastSet,sambaLogonTime,sambaLogoffTime,sambaKickoffTime,sambaPwdCanChange,sambaPwdMustChange,sambaAcctFlags,displayName,sambaHomePath,sambaHomeDrive,sambaLogonScript,sambaProfilePath,description,sambaUserWorkstations,sambaPrimaryGroupSID,sambaDomainName,sambaMungedDial,sambaBadPasswordCount,sambaBadPasswordTime,sambaPasswordHistory,sambaLogonHours,sambaSID,sambaSIDList,sambaTrustFlags,sambaGroupType,sambaNextRid,sambaNextGroupRid,sambaNextUserRid,sambaAlgorithmicRidBase,sambaShareName,sambaOptionName,sambaBoolOption,sambaIntegerOption,sambaStringOption,sambaStringListoption by dn="cn=samba,ou=DSA,dc=bordengrammar,dc=kent,dc=sch,dc=uk" write by dn="cn=smbldap-tools,ou=DSA,dc=bordengrammar,dc=kent,dc=sch,dc=uk" write by self write by * read access to dn.base="dc=bordengrammar,dc=kent,dc=sch,dc=uk" by dn="cn=samba,ou=DSA,dc=bordengrammar,dc=kent,dc=sch,dc=uk" write by dn="cn=smbldap-tools,ou=DSA,dc=bordengrammar,dc=kent,dc=sch,dc=uk" write by * none access to dn="ou=Users,dc=bordengrammar,dc=kent,dc=sch,dc=uk" by dn="cn=samba,ou=DSA,dc=bordengrammar,dc=kent,dc=sch,dc=uk" write by dn="cn=smbldap-tools,ou=DSA,dc=bordengrammar,dc=kent,dc=sch,dc=uk" write by * none access to dn="ou=Groups,dc=bordengrammar,dc=kent,dc=sch,dc=uk" by dn="cn=samba,ou=DSA,dc=bordengrammar,dc=kent,dc=sch,dc=uk" write by dn="cn=smbldap-tools,ou=DSA,dc=bordengrammar,dc=kent,dc=sch,dc=uk" write by * none access to dn="ou=Computers,dc=bordengrammar,dc=kent,dc=sch,dc=uk" by dn="cn=samba,ou=DSA,dc=bordengrammar,dc=kent,dc=sch,dc=uk" write by dn="cn=smbldap-tools,ou=DSA,dc=bordengrammar,dc=kent,dc=sch,dc=uk" write by * none access to * by dn="cn=slapmaster,ou=Users,dc=bordengrammar,dc=kent,dc=sch,dc=uk" read by self read by * none

2 1

ppolicy pwdMinLenght, pwdAccountLockedTime and pwdLockoutDuration don't work as supposed
by Theo Alves 18 Mar '11

18 Mar '11

Hello there, We have 40 machines on an educational informatics lab authenticating with LDAP. I am using python ldap module as management tool. I am experiencing two problems at now. The first one is when an user access ldap by python the ppolicy pwdMinLenght doesn't work. The user can freely put a password too short. That doesn't happen when using passwd. Check out the python code snip: import ldap dn = 'uid=%s,ou=People,dc=example,dc=com' % 'user1' con = ldap.initialize('ldapi:///') con.bind_s(dn, raw_input('Password: ')) #getting the present password con.passwd_s(dn, None, '1') The to default_ppolicy entry pwdMinLenght is setted to 5, even so the code above works to regular users and they can put passwords too short. The second thing is in the lab sometimes users should be disabled for time periods (2 weeks for instance). I guessed I could set pwdAccountLockedTime to now and pwdLockoutDuration to the duration and the user would be automatically unlocked after that time, but it doesn't look to work. I guess this directives are only valid when pwdFailureTime is setted by the authentication methods. Can someone confirm that I can't set manually pwdAccountLockedTime and pwdLockoutDuration to block user access to a determined period? What would be the alternatives? I hope I haven't missed the answers because a lack of English skills. I have "googled" a lot about that, but nothing useful came up. The mail list archives search in openldap-technical doesn't return anything even when I try ldap, or ppolicy. I browsed some month archives but got nothing by the e-mail subjects. Thanks in advance for any help and answers. I hope I have been understood and sorry about any mistakes I've made concerning the language. Theo -- O Pensamento Governa o Universo http://www.999thnight.com http://www.unreversed.com

2 1

(no subject)
by Juan José Aragonés 18 Mar '11

18 Mar '11

Hello After installing and configuring openLDAP in Linux I’m trying to do the same in Windows 7. No, it’s not my idea but what my boss wants me to do. So I downloaded openLDAP from http://www.userbooster.de/en/download/openldap-for-windows.aspx and installed. Configured my slapd.conf as follows: include ./schema/core.schema include ./schema/cosine.schema include ./schema/inetorgperson.schema pidfile ./run/slapd.pid argsfile ./run/slapd.args ## server permits anonymous binds allow bind_anon_dn ## Misc security settings password-hash {SSHA} ####################################################################### # Database Section ####################################################################### ## Define the beggining of example database database bdb ## Define the root suffix you serve suffix "dc=example,dc=com" ## Define a root DN for superuser privilege (Not necessary) rootdn "cn=Manager,dc=example,dc=com" ## Define the password used with roodn. For this example it will be "secret" rootpw {SSHA}E7ptTQ3Z6DdkPacF6sO3qXrueUKoM8Kq ## Directory containing the database files directory ./data/example ## Indexes to maintain index ObjectClass eq index cn,sn,mail eq,sub index departmentNumber eq ## db tunning parameters: cache 2000 entries in memory cachesize 2000 I started it (slapd -h ldap://) and it works ok. But now I'm trying to connect using ldaps, but I don't find how to create a self-signed certificate in a way as easy as it was in Linux. If you know where there's a good guide I would be really grateful. Thank you Joe Aragones

1 0

Schema Design :: ACL on Groups by Group Members only
by sim123 18 Mar '11

18 Mar '11

Hi There, I want "n" number of groups (or similar structure which keeps member information) to be created and only group members have access to those groups. Members are defined in separate user branch so my DIT look like dc=example,dc=com +--ou=people,dc=example,dc=com +----uid=bjanson,ou=users,dc=example,dc=com +----uid=matt,ou=users,dc=example,dc=com +--cn=group1,dc=example,dc=com (groupOfNames) +----cn=subgroup1,dc=example,dc=com (groupOfNames) now users bjanson and matt are member of group1, only bjanson is member of subgroup1. I would like to have ACL defined so only members can access their group. I don't need any ACL on subgroup as long as only all members of parent group can access it. Is it possible to do that in generic form because basic ACL syntax needs dn/filter in "access to " clause. In my example if I have n groups I will end up having n access control syntax in slapd.conf, which doesn't sound a good idea. Also, I don't need to use groups as such but groupOfNames/ groupOd UniqueNames are the only classes which support member attribute. Please let me know if there is any other objectClass I should use. Thanks for all the help and support, I appreciate it very much.

3 2

OpenLDAP 2.4.23 hangs when creating new group objects
by Mark Cave-Ayland 17 Mar '11

17 Mar '11

Hi all, Having just upgraded our internal LDAP server from Debian Lenny (2.4.16 internal build) to Debian Squeeze (2.4.23), we have started to see instances where the slapd process hangs and stops responding to all requests until we kill -9 and restart the process. Bizarrely enough, we can reproduce this pretty much every time when we try and create a new LDAP group using the GOsa web administration tool. Is this a known issue at all? Next time it happens, I'm happy to post a backtrace if you let me know what output you need from gdb to debug this. Many thanks, Mark. -- Mark Cave-Ayland - Senior Technical Architect PostgreSQL - PostGIS Sirius Corporation plc - control through freedom http://www.siriusit.co.uk t: +44 870 608 0063 Sirius Labs: http://www.siriusit.co.uk/labs -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

3 6

Any consideration while designing schema
by sim123 17 Mar '11

17 Mar '11

Hi, I am in process of designing schema for my recent project with really basic skill set and found this article really interesting : http://www.skills-1st.co.uk/papers/ldap-schema-design-feb-2005/ldap-schema-… I am wondering what all things one should really keep in mind before putting LDAP schema together and in general what could cause potential overhead or considered BAD design ? Also would love to know if there is any other article/ book addressing my concerns. Thanks for the help and support.

3 4

nested dyn groups (planed?)
by Christoph Kaminski 17 Mar '11

17 Mar '11

Hi all... I know it is not possible to use nested dynamic groups (dyn group inside dyn group via labeledURI attribute) but it is planed for a release in the future? -- Greetz

1 0

How to turn on LDAP_DEVEL flag?
by Коновалов Андрей Але ксандрович 17 Mar '11

17 Mar '11

I want to test component matching support in OpenLDAP 2.4.24, but it is masked by LDAP_DEVEL flag, which is turned on only when LDAP_VENDOR_VERSION=0. So... could you tell me please, how to turn on LDAP_DEVEL directly in a proper way?

3 3

OpenLDAP reports busy and hangs
by Frank Budde 17 Mar '11

17 Mar '11

Hi, with OpenLDAP 2.4.22 on Solaris 10 we discovered following situation: from time to time the slapd log file contains message "daemon: select: listen=7 busy" while ldap continues to operate normally. After 7 days of operation suddenly ldap does not respond any more and keeps printing "daemon: select: listen=7 busy". Log file shows: daemon: select: listen=7 busy daemon: listen=7, new connection on 30 daemon: activity on 1 descriptor daemon: waked daemon: added 30r (active) listener=0 conn=5656 fd=30 ACCEPT from IP=192.168.200.131:40993 (IP=192.168.200.16:9929) daemon: select: listen=7 active_threads=1 tvp=zero daemon: activity on 2 descriptors daemon: waked daemon: select: listen=7 active_threads=1 tvp=zero daemon: activity on 1 descriptor daemon: activity on: 30r daemon: read activity on 30 daemon: select: listen=7 active_threads=1 tvp=zero daemon: activity on 1 descriptor daemon: waked conn=5656 op=0 BIND dn="cn=ldapadmin,dc=abc,dc=com" method=128 daemon: select: listen=7 active_threads=1 tvp=zero conn=5656 op=0 BIND dn="cn=ldapadmin,dc=abc,dc=com" mech=SIMPLE ssf=0 conn=5656 op=0 RESULT tag=97 err=0 text= daemon: activity on 1 descriptor daemon: activity on: 30r daemon: read activity on 30 daemon: select: listen=7 active_threads=1 tvp=zero daemon: activity on 1 descriptor daemon: waked daemon: select: listen=7 active_threads=1 tvp=zero conn=5656 op=1 SRCH base="ou=users,dc=abc,dc=com" scope=1 deref=3 filter="(uid=abcservice-prd)" daemon: activity on 1 descriptor daemon: select: listen=7 busy daemon: select: listen=7 busy daemon: select: listen=7 busy daemon: select: listen=7 busy slapd.conf contains gentlehup on idletimeout 15 conn_max_pending 10 conn_max_pending_auth 30 My question: How can the problem be solved or reproduced? The problem comes up in production environment and I need to reproduce it in test environment. How can this be done? (If the problem can be reproduced with 2.4.22 I will try it with ldap 2.4.24.) Thanks for any help, /Frank -- Schon gehört? GMX hat einen genialen Phishing-Filter in die Toolbar eingebaut! http://www.gmx.net/de/go/toolbar

2 1

"hidden" attributes in openldap?
by George Mamalakis 17 Mar '11

17 Mar '11

Hi everybody, I hope I am sending this email to the correct mailing list, if not please excuse me. I am trying to find a way to hide/unhide attributes on my DIT (openldap-2.4.21) and I cannot find a way to do this. What I mean by hide/unhide is that I want specific attributes to be listed with ldapsearch only if the owner of the records agrees. I did not find any feature that does this "automatically", so I tried to implement it through acls. I created a group called i.e. "cn=publish mail,ou=Groups,dc=example,dc=com" where people wishing to disclose their emails are members of this group. On the acl statement I couldn't find a way to restrict my acl based on "conditional attributes". Is there a way to support such a behavior (maybe through an additional overlay, or oclAccess, etc)? If someone knows an answer I would be delighted to know so. Thank you all for your time in advance, mamalos PS. I have submitted a similar question to an "ldap programmers" forum, because I thought that openldap lists don't support such questions. Nevertheless, I found analogous questions being asked on this list by googling, so I thought I should give it a try. -- George Mamalakis IT Officer Electrical and Computer Engineer (Aristotle Un. of Thessaloniki), MSc (Imperial College of London) Department of Electrical and Computer Engineering Faculty of Engineering Aristotle University of Thessaloniki phone number : +30 (2310) 994379

3 6

Undefined reference to ber_* with 2.4.24
by frank.offermanns＠caseris.de 17 Mar '11

17 Mar '11

Hello, I am able to compile OpenLDAP 2.4.23 with Berkeley DB 4.8.30 with MSYS and windows with configure params: configure --prefix=/mingw --enable-acceslog --with-tls But if I try to compile OpenLDAP 2.4.24 I get several undefined references to ber_* functions when liblutil is build. Did I miss a change in the way to build OpenLDAP 2.4.24? Best regards, Frank Offermanns

2 1

PANIC: bdb fatal region
by ldap＠mm.st 17 Mar '11

17 Mar '11

I am rebuilding our aging pre 2.2 openldap servers that ran ldbm backend and slurpd. We ran this setup without any issues for many years. The new setup is: RH5 openldap 2.3.43 (Stock RH) bdb backend 4.4.20 (Stock RH) Entries in db- about 1820 LDIF file is about 1.2M Memory- Master 4GB Slave 2GB (will add two more slaves) Database section of slapd.conf: database bdb suffix "o=example.com" rootdn "cn=root">cn=root">cn=root">cn=root,o=example.com" rootpw {SSHA} ..... cachesize 1900 checkpoint 512 30 directory /var/lib/ldap index objectClass,uid,uidNumber,gidNumber,memberUid,uniqueMember eq index cn,mail,surname,givenname eq,subinitial DB_CONFIG: set_cachesize 0 4153344 1 set_lk_max_objects 1500 set_lk_max_locks 1500 set_lk_max_lockers 1500 set_lg_regionmax 1048576 set_lg_bsize 32768 set_lg_max 131072 set_lg_dir /var/lib/ldap set_flags DB_LOG_AUTOREMOVE This new setup appeared to work great for the last 10 days or so. I was able to authenticate clients, add records etc. Running slapd_db_stat -m and slapd_db_stat -c seem to indicate everything was ok. Before I put this setup into production, I got slurpd to function. Then decided to disable slurpd to use syncrepl in refreshonly mode. This also seemed to work fine. I'm not sure if the replication started this or not, but wanted to include all the events that let up to this. I have started to get: bdb(o=example.com): PANIC: fatal region error detected; run recovery On both servers at different times. During this time slapd continues to run which seems to confuse clients that try to use it and they will not try the other server that is listed in ldap.conf. To recover I did: service ldap stop, slapd_db_recover -h /var/lib/ldap, service ldap start. I then commented all the replication stuff out in the slapd.conf and restarted ldap. It will run for a while (varies 5 minutes - ?) then I get the same errors and clients are unable to authenticate. On one of the servers I deleted all the files (except DB_CONFIG) and did a slapadd of a ldif file that I generated every night (without stopping slapd). Same results once I started slapd again. I have enabled debug for slapd and have not seen anything different, I attached gdb to the running slapd and no errors are noted. I even copied a backup copy of slapd.conf prior to the replication settings (even though they are commented out) thinking that maybe something in there was causing it.. Then after several recoveries as described above the systems seem to be working again. One has not generated the error for for over 5.5 hours the other has not had any problems for 2 hours. For some reason after that period when the errors showed up for a while, things seem to be working again, at least for now. I'm nervous about putting this into production until I can get this to function properly without these issues. During the 10 day period with everything working good, the slave would occasional (rarely) get the error and I would do a recovery, but we thought this was due to possible hardware problems. Now I'm not so sure. I have a monitor script that runs slapd_db_stat -m and -c every 5 minutes and nothing seems wrong there, I far as I can tell. I'm hoping someone can help me determine possible causes or things to look at.

3 2

Re: syncrepl consumer with several providers, is it working?
by LALOT Dominique 17 Mar '11

17 Mar '11

Hi Quanah, OK, that's not so easy to migrate large infrastructures, but if you don't see other problems (about our setup), we will migrate our providers to the same version. I'm surprised, replication should be stable for years and in the real world you can't have all your servers at the same level. We are lucky that we can do that, sometimes, it's not possible. Thanks Dom 2011/3/16 Quanah Gibson-Mount <quanah(a)zimbra.com> > --On Wednesday, March 16, 2011 4:13 PM +0100 LALOT Dominique < > dom.lalot(a)gmail.com> wrote: > > Hello, >> >> I'm a little bit worried about that mail and the fact that our setup is >> getting out of sync sometimes. >> http://www.openldap.org/lists/openldap-software/200505/msg00324.html >> >> versions: the providers are all 2.4. The consumer is 2.4.23, some >> providers 2.4.21 one 2.4.11 >> > > Running multiple different versions on your master is a great way to ensure > things will not work properly. I don't know why you are surprised at having > problems. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- Dominique LALOT Ingénieur Systèmes et Réseaux http://annuaire.univmed.fr/showuser.php?uid=lalot

1 0

multi-master and consumers
by Troy Knabe 16 Mar '11

16 Mar '11

I have a couple of master ldap servers and several consumer ldap servers. Can I set it up so that both masters sync to the consumers? That way if I lose a master, my consumers would all still be updated? Thanks -Troy

2 1

Can system schema attribute matching rules be overwritten?
by LIM Chin Ho 16 Mar '11

16 Mar '11

Hi, Say for eg, the attribute cn, it is default to caseIgnoreMatch by openldap, can we overwrite it to caseExactMatch in our own schema? Or there is no way to do it. Thanks! Chinho

1 0

OpenLDAP.org takes very long time to load
by sim123 15 Mar '11

15 Mar '11

Hi There, just wanted to check, is it only I who is facing this issue? Thanks.

5 4

Re: delta-sync - ContextCSN on proivder older than consumers
by Yuri Bank 15 Mar '11

15 Mar '11

I'm using the latest stable version: OpenLDAP 2.4.23 ( running on Ubuntu 10.10 ) I've also included the relevant configuration for my Provider and Consumer[s]. Consumer[s] # {1}hdb, config dn: olcDatabase={1}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=test,dc=com olcAccess: {0}to attrs=userPassword by dn="cn=admin,dc=test,dc=com" write by an onymous auth by self write by group.exact="cn=DCNAS,o=Groups,dc=test,dc=com" w rite by * none olcAccess: {1}to attrs=shadowLastChange by self write by * read olcAccess: {2}to dn.base="" by * read olcAccess: {3}to * by dn="cn=admin,dc=test,dc=com" write by group.exact="cn=DCN AS,o=Groups,dc=test,dc=com" write by * read olcLastMod: TRUE olcRootDN: cn=admin,dc=test,dc=com olcRootPW: test olcSyncrepl: {0}rid=001 provider=ldap://10.81.255.30 bindmethod=simple binddn= "cn=admin,dc=test,dc=com" credentials=test searchbase="dc=test,dc=com" logba se="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" schemachecking=on type=refreshOnly retry="60 +" interval=00:00:00:30 syncdata =accesslog olcUpdateRef: ldap://10.81.255.30 olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq olcDbIndex: uid eq olcDbIndex: uidNumber eq olcDbIndex: cn eq olcDbIndex: memberOf eq olcDbIndex: entryUUID eq Provider: # {1}hdb, config dn: olcDatabase={1}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=test,dc=com olcAccess: {0}to attrs=userPassword by dn="cn=admin,dc=test,dc=com" write by an onymous auth by self write by group.exact="cn=DCNAS,o=Groups,dc=test,dc=com" w rite by * none olcAccess: {1}to attrs=shadowLastChange by self write by * read olcAccess: {2}to dn.base="" by * read olcAccess: {3}to * by dn="cn=admin,dc=test,dc=com" write by group.exact="cn=DCN AS,o=Groups,dc=test,dc=com" write by * read olcLastMod: TRUE olcRootDN: cn=admin,dc=test,dc=com olcRootPW: test olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq olcDbIndex: entryCSN eq olcDbIndex: entryUUID eq olcDbIndex: uid eq olcDbIndex: uidNumber eq olcDbIndex: cn eq olcDbIndex: memberOf eq # {1}syncprov, {1}hdb, config dn: olcOverlay={1}syncprov,olcDatabase={1}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {1}syncprov olcSpNoPresent: TRUE # {2}accesslog, {1}hdb, config dn: olcOverlay={2}accesslog,olcDatabase={1}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcAccessLogConfig olcOverlay: {2}accesslog olcAccessLogDB: cn=accesslog olcAccessLogOps: writes olcAccessLogPurge: 07+00:00 01+00:00 olcAccessLogSuccess: TRUE # {2}hdb, config dn: olcDatabase={2}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {2}hdb olcDbDirectory: /var/lib/ldap/accesslog olcSuffix: cn=accesslog olcRootDN: cn=admin,dc=test,dc=com olcDbIndex: default eq olcDbIndex: entryCSN,objectClass,reqEnd,reqResult,reqStart # {0}syncprov, {2}hdb, config dn: olcOverlay={0}syncprov,olcDatabase={2}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: {0}syncprov olcSpNoPresent: TRUE olcSpReloadHint: TRUE -Yuri On Sun, Mar 13, 2011 at 11:47 AM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Saturday, March 12, 2011 8:59 PM -0800 Yuri Bank <yuribank(a)gmail.com> > wrote: > > >> I've found an interesting issue with delta-sync replication in which the >> > > > The first thing you should always provide is the version of OpenLDAP you > are using. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

4 8

execve problem with back-shell
by Michael Smith 15 Mar '11

15 Mar '11

Hello all. I'm working with openLDAP again, after some years' hiatus, and very glad of it. I'm having a problem which I hope somebody's seen before. I'm trying to use back-shell (to avoid relearning Perl) for a quick-and dirty solution to a problem too tedious to describe here. Here's the relevant bits of slapd.conf: -------------- moduleload back_shell.la backend shell database shell suffix "dc=foo,dc=bar,dc=com" rootdn "cn=admin,dc=foo,dc=bar,dc=com" rootpw secretissimum-secretissimorum add /usr/local/bin/backshell.sh bind /usr/local/bin/backshell.sh compare /usr/local/bin/backshell.sh delete /usr/local/bin/backshell.sh modify /usr/local/bin/backshell.sh modrdn /usr/local/bin/backshell.sh search /usr/local/bin/backshell.sh unbind /usr/local/bin/backshell.sh syncrepl rid=123 provider=ldap://127.0.0.1 type=refreshOnly interval=00:00:00:05 searchbase="dc=foo,dc=bar,dc=com" scope=sub bindmethod=simple binddn="uid=mik,ou=Managers,dc=foo,dc=bar,dc=com" credentials="M0$tsecret" ------------- backshell.sh is moronically simple at the moment: ---------------- #!/bin/bash while read LINE do /bin/echo $LINE >>/var/lib/ldap2/replog.txt done echo RESULT ---------------- Commands to execute slapd: ~$ sudo su # /usr/sbin/slapd -d 0x4400 -f /etc/ldap/slapd2.conf -h "ldap://127.0.0.1:3889" -u openldap -g openldap --------------- Varia: ~$ which bash /bin/bash ~$ ls -ld /var/lib/ldap2 drwxr-xr-x 2 openldap openldap 4096 2011-03-04 13:10 /var/lib/ldap2 Debug output from slapd: @(#) $OpenLDAP: slapd 2.4.9 (Jul 30 2010 00:42:11) $ buildd@vernadsky:/build/buildd/openldap2.3-2.4.9/debian/build/servers/slapd WARNING: No dynamic config support for database shell. slapd starting syncrepl_entry: rid=123 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) syncrepl_entry: rid=123 inserted UUID f25a0996-d888-102f-9c2e-559808098a6b execv failed shell: fgets failed: Success (0) str2result () expecting "RESULT" --------------------- ... over and over again. strace says: [pid 19068] execve("/usr/local/bin/backshell.sh", ["/usr/local/bin/backshell.sh"], ["SHELL=/bin/bash", "TERM=xterm", "USER=root", "LS_COLORS=no=00:fi=00:di=01;34:l"..., "SUDO_USER=mike", "SUDO_UID=1001", "USERNAME=root", "PATH=/usr/local/sbin:/usr/local/"..., "MAIL=/var/mail/root", "PWD=/home/mike", "LANG=en_US.UTF-8", "SHLVL=1", "SUDO_COMMAND=/bin/su", "HOME=/root", "LOGNAME=root", "LESSOPEN=| /usr/bin/lesspipe %s", "SUDO_GID=1001", "LESSCLOSE=/usr/bin/lesspipe %s %"..., "_=/usr/sbin/slapd"]) = -1 EACCES (Permission denied) ------------- Doesn't look like it's even able to execute my little program, right? So this may be more a question about the subtleties of execve (and possibly its interactions with sudo?) than about openldap, but if some kind soul can set me on the right path, I'd be most grateful. I've manpaged and googled everything I could think of, and drawn a blank. -- -- Michael J. Smith mjs(a)smithbowen.net

6 11

newbie scenario
by Lumeng Lim 14 Mar '11

14 Mar '11

mind you i've only managed to setup ldap server under ubuntu for now. we have 2 sites to manage and I would like for users( about 250 users total) in both sites that is connected via vpn to be able to login to samba/ldap in HQ are there things to consider before going about just setting up ldap and samba? assuming that samba is going to be used as pdc and fileserver.

2 1

Modified Records Deleted - Multimaster
by John s 14 Mar '11

14 Mar '11

Hi All, I have 2 way ldap multimaster setup . Recently User names are disappeared from two Master servers . Observed that when records are modified at one Master, records are removed from two servers next day . Enabled the logs and found no errors . Let me know during the syncrepl replication is their any chance of modified records being deleted from other Master server ... Thanks in advance for any help . Ldap Version: 2.4 Regards John

2 1

Dynamic modules unloading
by Коновалов Андрей Але ксандрович 13 Mar '11

13 Mar '11

Hello! I have OpenLDAP 2.4.24 built with -enable-dynamic and --enable-modules options So, dynamic modules support is on and my question is: Why can i load module (for example: dn: cn=module{0},cn=config changeType: modify add: olcModuleLoad olcModuleLoad: translucent.la ) But when i'm trying to unload it (because it's not used at all), i cant do this anywhere? dn: cn=module{0},cn=config changeType: modify delete: olcModuleLoad olcModuleLoad: {6}translucent.la # the same with simply olcModuleLoad: translucent.la modifying entry "cn=module{0},cn=config" ldap_modify: Other (e.g., implementation specific) error (80) additional info: cannot delete olcModuleLoad If it is not realised yet, you may consume my question as a feature request :)

2 1

delta-sync - ContextCSN on proivder older than consumers
by Yuri Bank 13 Mar '11

13 Mar '11

I've found an interesting issue with delta-sync replication in which the ContextCSN on my consumers, is higher than the contextCSN on my provider. I believe this is causing some other problems with bringing up brand new consumers. I use the following command to check the ContextCSN on each consumer: Consumer: 1 root@neteng1.oak:/etc/ldap# ldapsearch -Y EXTERNAL -H ldapi:/// -s base -b "dc=test,dc=com" contextCSN dn: dc=test,dc=com SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 # extended LDIF # # LDAPv3 # base <dc=test,dc=com> with scope baseObject # filter: (objectclass=*) # requesting: contextCSN dn: dc=test,dc=com # # test.com dn: dc=test,dc=com contextCSN: 20110313041653.752098Z#000000#000#000000 # search result search: 2 result: 0 Success Consumer: 2 ybank@neteng1.iad:~$ ldapsearch -Y EXTERNAL -H ldapi:/// -s base -b "dc=test,dc=com" contextCSN dn: dc=test,dc=com SASL/EXTERNAL authentication started SASL username: gidNumber=1001+uidNumber=1010,cn=peercred,cn=external,cn=auth SASL SSF: 0 # extended LDIF # # LDAPv3 # base <dc=test,dc=com> with scope baseObject # filter: (objectclass=*) # requesting: contextCSN dn: dc=test,dc=com # # test.com dn: dc=test,dc=com contextCSN: 20110313041653.752098Z#000000#000#000000 # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 So we can see that the two consumers have matching: ContextCSN. 20110313041653.752098Z#000000#000#000000 Lets check the Provider now. Provider: root@neteng0.iad:~# ldapsearch -Y EXTERNAL -H ldapi:/// -s base -b "dc=test,dc=com" ContextCSN dn: dc=test,dc=com SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 # extended LDIF # # LDAPv3 # base <dc=test,dc=com> with scope baseObject # filter: (objectclass=*) # requesting: ContextCSN dn: dc=test,dc=com # # test.com dn: dc=test,dc=com contextCSN: 20110313041653.709140Z#000000#000#000000 # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 The providers CSN is smaller: contextCSN: 20110313041653.709140Z#000000#000#000000 Now I will search cn=accesslog on the Provider: These are the last two entries: # 20110313041653.000003Z, accesslog dn: reqStart=20110313041653.000003Z,cn=accesslog objectClass: auditAdd reqStart: 20110313041653.000003Z reqEnd: 20110313041653.000004Z reqType: add reqSession: 34633 reqAuthzID: cn=admin,dc=test,dc=com reqDN: cn=Bank\2C Yuri(banky),o=UserAccounts,dc=test,dc=com reqResult: 0 reqMod: sn:+ Bank reqMod: userPassword:+ {SASL}banky reqMod: uid:+ banky reqMod: objectClass:+ top reqMod: objectClass:+ person reqMod: objectClass:+ shadowAccount reqMod: structuralObjectClass:+ person reqMod: cn:+ Bank, Yuri(banky) reqMod: entryUUID:+ 78a75ef6-e174-102f-9571-ffecbfef68e5 reqMod: creatorsName:+ cn=admin,dc=test,dc=com reqMod: createTimestamp:+ 20110313041653Z reqMod: entryCSN:+ 20110313041653.709140Z#000000#000#000000 reqMod: modifiersName:+ cn=admin,dc=test,dc=com reqMod: modifyTimestamp:+ 20110313041653Z # 20110313041653.000006Z, accesslog dn: reqStart=20110313041653.000006Z,cn=accesslog objectClass: auditModify reqStart: 20110313041653.000006Z reqEnd: 20110313041653.000007Z reqType: modify reqSession: 34633 reqAuthzID: cn=admin,dc=test,dc=com reqDN: cn=SSLVPN,o=Groups,dc=test,dc=com reqResult: 0 reqMod: member:+ cn=Bank\2C Yuri(banky),o=UserAccounts,dc=test,dc=com reqMod: entryCSN:= 20110313041653.752098Z#000000#000#000000 reqMod: modifiersName:= cn=admin,dc=test,dc=com reqMod: modifyTimestamp:= 20110313041653Z # search result search: 2 result: 0 Success As you can see, the provider is not using the latest entryCSN as its ContextCSN, where as the consumer nodes are. Is this intended? An issue I've experienced with this is when bringing up a brand new consumer. It gets stuck in a loop trying to add that last entry. I'm guessing this has something to do with it using the wrong ConextCSN? - Yuri

2 1

ldapsearch and extended server controls?
by Brian Reichert 12 Mar '11

12 Mar '11

I have a case where I'm trying to replicate some other application's search against Active Directory. A deconstruction of a packet capture of that app's conversation shows it's making use of a control that I don't know how to specify using any combination of ldapsearch(1) or ldap.conf(5). Specifically, I see this coming over the wire as a control on the search: http://msdn.microsoft.com/en-us/library/aa366989%28v=vs.85%29.aspx 1.2.840.113556.1.4.417 LDAP_SERVER_SHOW_DELETED_OID Research shows there lots these sorts of extended control; yay, I learned something new! Is there a way of utilizing these sorts of controls via ldeapsearch? Thanks for any advice you may have... -- Brian Reichert <reichert(a)numachi.com> 55 Crystal Ave. #286 Derry NH 03038-1725 USA BSD admin/developer at large

2 2

Re: LDAP browsers and cn=config
by Gervase Markham 11 Mar '11

11 Mar '11

Hi Torsten, Thanks for your help! On 07/03/11 17:37, Torsten Schlabach (Tascel eG) wrote: > Take a look at the olcAccess attribute values of your cn=config database. > This should tell you who's allowed to read it or not. I did add a value to try and make this work (see below), but perhaps I haven't done all that's necessary. > It depends where your cn=config data comes from, but in many examples you > will find an olcAccess attribute granting write access to a DN called > cn=admin,cn=config. You need to have that object in your cn=config database > then and it should have the password attribute set. > > Post the olcAccess sections of your LDIF here, I think this may help. Here is my olcDatabase={0}config.ldif, with some comments: dn: olcDatabase={0}config objectClass: olcDatabaseConfig olcDatabase: {0}config olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external ,cn=auth manage by * break # This one added by me recently: olcAccess: {0}to * by dn.exact=cn=admin,cn=config manage by * break structuralObjectClass: olcDatabaseConfig entryUUID: 9dfea13e-dd1c-102f-8cc4-2fe95e0d0dbe creatorsName: cn=config createTimestamp: 20110307153755Z entryCSN: 20110307153755.993390Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20110307153755Z # These two added by me recently: oldRootDN: cn=admin,cn=config olcRootPW: config So it looks like I just need to make sure I have the cn=admin,cn=config object in my database. And I think I can probably add it using the magic -Y EXTERNAL method and ldapadd. However, I don't know how to construct it - what objectClass should it have? Gerv

5 9

Simple Bind pass-through to SASL/PLAIN
by Zach Schimke 11 Mar '11

11 Mar '11

Is there any trick to this? I am able to get SASL/PLAIN and SASL/GSSAPI binds to work perfectly with my ldap server. What I want to get working is the authentication pass-through. From what I can gather, it appears that LDAP should be able to authenticate a simple bind, take a look at the userPassword attribute (which contains '{SASL}username@REALM) and perform a SASL/PLAIN from there. We want to avoid maintaining two separate passwords (LDAP and Kerberos V) although some applications (like phpLDAPAdmin, Drupal, etc) do not allow the use of Kerberos natively. /etc/sasl2/slapd.conf (using CentOS): pwcheck_method: saslauthd Here's a snippet of my openldap.log during a simple bind: Mar 3 16:45:49 kdc1 slapd[28132]: conn=2009 fd=39 ACCEPT from IP=149.169.147.254:56106 (IP=0.0.0.0:636) Mar 3 16:45:49 kdc1 slapd[28132]: conn=2009 fd=39 TLS established tls_ssf=256 ssf=256 Mar 3 16:45:49 kdc1 slapd[28132]: conn=2009 op=0 BIND dn="cn=test account,ou=people,o=mars" method=128 Mar 3 16:45:49 kdc1 slapd[28132]: send_ldap_result: conn=2009 op=0 p=3 Mar 3 16:45:49 kdc1 slapd[28132]: conn=2009 op=0 RESULT tag=97 err=49 text= Mar 3 16:45:49 kdc1 slapd[28132]: connection_closing: readying conn=2009 sd=39 for close Mar 3 16:45:49 kdc1 slapd[28132]: connection_close: conn=2009 sd=-1 Mar 3 16:45:49 kdc1 slapd[28132]: conn=2009 fd=39 closed (connection lost) Anything I should double-check, modify, etc? -- Zach Schimke Mars Space Flight Facility

4 10

php ldap binding problems
by Bram Cymet 11 Mar '11

11 Mar '11

Hi, Has anyone had to problem using php_ldap where the bind to ldap will work find but will unbind right away so any attempt to search the tree fails? If so were you able to fix it? -- Bram Cymet Software Developer Canadian Bank Note Co. Ltd. 613-608-9752

4 3

Null Search Base
by ldap＠mm.st 10 Mar '11

10 Mar '11

A security scanner was run against our ldap severs and came back with a warning stating "The remote LDAP server supports search requests with a null, or empty, base object. This allows information to be retrieved without any prior knowledge of the directory structure. Coupled with a NULL BIND, an anonymous user may be able to query your LDAP server using a tool . . ." I'm not overly concerned with the warning, but I was a little confused what the scanner was reffering to. I used the following search in an effort to somewhat duplicate what the scanner was sending and what information is retrieved and was hoping someone could commet if I was ontrack. I assume the warning is due to the namingContext attribute and if desired an acl could be setup to stop the retrival on the information. This is on a RH5 openlap 2.3 server. ldapsearch -x -s base -b '' -H ldap://my.lapdap.server "(objectClass=*)" "*" + I got back this: # dn: objectClass: top objectClass: OpenLDAProotDSE structuralObjectClass: OpenLDAProotDSE configContext: cn=config namingContexts: o=mydomain supportedControl: 1.3.6. ..... . . . . supportedControl: 1.3.6. ..... supportedLDAPVersion: 3 entryDN: subschemaSubentry: cn=Subschema

3 2

Remove/Cleanup pwdHistory attribute.
by Meghanand Acharekar 10 Mar '11

10 Mar '11

Hi, Is it possible to change/remove pwdHistory attribute from an individual entry. I'm trying to change/remove using following ldif. dn: uid=user1,ou=People,dc=example,dc=com changetype: modify replace: pwdHistory pwdHistory: 0 and dn: uid=user1,ou=People,dc=example,dc=com changetype: delete delete: pwdHistory Both the tries gives following error. ldapmodify: Constraint violation (19) additional info: pwdHistory: no user modification allowed Thanks in advance. Regards, Meghanand N. Acharekar ------------------------------------------ The gates in my computer are AND, OR and NOT; they are not Bill..

1 0

JLDAP question
by PhilNad214 PhilNad214 10 Mar '11

10 Mar '11

Hi, we've had JLDAP enbedded in our project for 3-4 years and it's been easy to maintain (actually no maintenance required!). I now need to extend it and need to find out a few things - I must confess to not knowing much about LDAP and what its query language is capable of, so if I ask the question here I'm sure if it cannot be answered easily then someone will recommend a good web resource :-) Our first issue, currently we use LDAPConnection.search() to retrieve all the users that are members of a group in a particular OU. This has always been fine with small setups where admins have happily made (manually) the users part of the group. However in larger LDAP setups, where the users may already be in one of several groups, it 's a lot of extra work (potentially) to manage them (making them all members also of our group). What we'd ideally like is for the admins to be able to add those existing groups themselves to our group. This is possible of course, but when we are iterating over the search results, we get all the existing individually added members, but when it comes to an added group, we get just the group entry (no real surprise). So my question is, can the search be written in a way that if the search results was to include a group, all the members of that group are actually returned in the results? (Sort of like 'auto-expand' groups.) If that isn't possible then I assume we'll have to refactor our code to automatically do another search within the search if we encounter a group entry within the results? BTW here is a trimmed-down version of the search code: String aGroupname = "bob"; int searchScope = LDAPConnection.SCOPE_SUB; String attrs[] = { "msDS-UserAccountDisabled", "ms-DS-UserAccountAutoLocked", "msDS-UserPasswordExpired", "isDeleted", "CN", "sAMAccountName", "distinguishedName", "givenName", "middleName", "sn", "memberOf", "mail", "name", "employeeID"}; boolean attributeOnly = false; String searchDN = "OU=...."; String searchFilterA = "(memberOf=CN="+aGroupname+","+searchDN + ")"; String searchFilterB = "(memberOf=sAMAccountName="+aGroupname+","+searchDN + ")"; String searchFilter = "(|" + searchFilterA + searchFilterB + ")"; LDAPSearchConstraints cons = new LDAPSearchConstraints(); cons.setTimeLimit(10000); LDAPSearchResults searchResults = _lc.search(searchDN, // container to search searchScope, // search scope searchFilter, // search filter attrs, // "1.1" returns entry name only attributeOnly, // no attributes are returned cons); // time out value while (searchResults.hasMore()) .... etc .... Cheers, Phil

1 0

syncrepl with with multiple subordinate databases
by Dieter Kluenter 09 Mar '11

09 Mar '11

Hi, I am facing a severe problem with the replication of subordinate databases and a log database. The initial replication of the subordinate databases is successful but afterwards slapd crashes, A backtrace and a momory map can be found here http://pastebin.de/15919 the provider slapd.conf can be found here http://pastebin.de/15920 the consumer slapd.conf can be found here http://pastebin.de/15922 -Dieter -- Dieter Klünter | Systemberatung sip: 7770535(a)sipgate.de http://www.dpunkt.de/buecher/2104.html GPG Key ID:8EF7B6C6

2 1

[Solved] Poor performance on Solaris
by Juergen.Sprenger＠swisscom.com 09 Mar '11

09 Mar '11

Hi, first I wish to thank all those who supplied helpful hints to solve the problem, especially Quanah Gibson-Mount and Howard Chu. My performance issue was solved by switching from memory mapped keys to shared memory keys for hdb as suggested by Quanah and Howard. Putting 'shm_key 10' into slapd.conf and restart of slapd solved the problem. Performance improvement was about factor 10 on the Solaris box. As the problem was gone connection logging was switched off, which additionally doubled throughput as Solaris sylog can't do asynchronous logging. During further tests slapd stopped responding when many concurrent connections were active. This behaviour was caused by default settings in /etc/system. Adding two lines to /etc/system and reboot solved the problem: set rlim_fd_max = 16368 set rlim_fd_cur = 8192 Should be enough for about 8000 connections. Performance before: box1: hardware: Sun Microsystems sun4v SPARC Enterprise T5120 memory:32 GB RAM os: Solaris 10 s10s_u9wos_14a searches (avg/second): 1521 Performance after: box1: hardware: Sun Microsystems sun4v SPARC Enterprise T5120 memory:32 GB RAM os: Solaris 10 s10s_u9wos_14a searches (avg/second): 37000 My next step will be tuning network parameters. Juergen Sprenger

2 3

slapcat on bdb
by ldap＠mm.st 08 Mar '11

08 Mar '11

Running RH5 openldap 2.3 with "database bdb" in slapd.conf. This has most likely been covered, but I am seeing many conflicting recommendations on running slapcat while slapd is running. The man page states "It is always safe to run slapcat with the slapd-bdb" Which seems very definitive, but I came across another well know guide that states that even though the man page states its ok, slapd should be stopped first before running slapcat. I'm writing a short backup script to generate nightly ldif output using slapcat and would rather not shut down slapd in the script. Since I have not been running openlap for very long, I was curious if anyone has had any problems running slapcat while slapd was running.

2 1

Re: LDAP browsers and cn=config
by harry.jede＠arcor.de 08 Mar '11

08 Mar '11

Gervase Markham wrote: > Can you tell me which LDAP browsers do support this scheme? After > all, the other part of my message was asking for advice on which was > best. GQ I am using gq for years. It's an GTK based graphical LDAP Editor. And yes, you may edit cn=config. Snippet of my ~/.gq <ldapserver> <name>debby-3</name> <ldaphost>debby-3</ldaphost> <ldapport>389</ldapport> <basedn>cn=config</basedn> <binddn>cn=admin,dc=kronprinz,dc=xx</binddn> <pw-encoding>Base64</pw-encoding> <search-attribute>cn</search-attribute> </ldapserver> I am NOT using ldapi and NOT the directory cn=config, but the file slapd.conf with a config-DB definition: database config rootdn "cn=admin,dc=kronprinz,dc=xx" This rootdn is the same rootdn as I use in database hdb. So there is no need to specify a password here. -- Harry Jede

1 0

LDAP single sign on with samba
by Lumeng Lim 08 Mar '11

08 Mar '11

not sure if this is the right place. would like to implement samba with ldap as well as authentication using sonicwall basically, I just want to be able to manage groups, users and computers. would like your help on where I can start so I can implement this properly.

5 4

back_shell anomaly with distribution example deploy
by Marco Pizzoli 07 Mar '11

07 Mar '11

Hi list, I'm having a problem in using the example back_shell example of OL distribution. I'm using OL 2.4.21 as released in Ubuntu10.04 distribution. This is my database definition: database shell suffix "dc=pippo,dc=it" search /tmp/slapd_search.sh This is the example script found in the OL distribution. Im my test this is /tmp/slapd_search.sh #!/bin/bash # $OpenLDAP: /servers/slapd/back-shell/searchexample.sh,v 1.9.2.6 2011/01/04 23:50:44 kurt Exp $ ## This work is part of OpenLDAP Software <http://www.openldap.org/>. ## ## Copyright 1998-2011 The OpenLDAP Foundation. ## All rights reserved. ## ## Redistribution and use in source and binary forms, with or without ## modification, are permitted only as authorized by the OpenLDAP ## Public License. ## ## A copy of this license is available in the file LICENSE in the ## top-level directory of the distribution or, alternatively, at ## <http://www.OpenLDAP.org/license.html>. # ## Portions Copyright (c) 1995 Regents of the University of Michigan. ## All rights reserved. ## ## Redistribution and use in source and binary forms are permitted ## provided that this notice is preserved and that due credit is given ## to the University of Michigan at Ann Arbor. The name of the University ## may not be used to endorse or promote products derived from this ## software without specific prior written permission. This software ## is provided ``as is'' without express or implied warranty. while [ 1 ]; do read TAG VALUE #echo "TAG: $TAG" >>/tmp/temp1.txt #echo "VALUE: $VALUE" >>/tmp/temp1.txt if [ $? -ne 0 ]; then break fi case "$TAG" in base:) BASE=$VALUE ;; filter:) FILTER=$VALUE ;; # include other parameters here esac done LOGIN=`echo $FILTER | sed -e 's/.*=$.*$)/\1/'` PWLINE=`grep -i "^$LOGIN" /etc/passwd` #sleep 60 # if we found an entry that matches if [ $? = 0 ]; then echo $PWLINE | awk -F: '{ printf("dn: cn=%s,%s\n", $1, base); printf("objectclass: top\n"); printf("objectclass: person\n"); printf("cn: %s\n", $1); printf("cn: %s\n", $5); printf("sn: %s\n", $1); printf("uid: %s\n", $1); }' base="$BASE" echo "" fi # result echo "RESULT" echo "code: 0" exit 0 This is the result. I cannot see my user listed root@LTSP-vanilla:/etc/ldap/slapd.conf.d# ldapsearch -v -x -s sub -b "dc=pippo,dc=it" "(cn=marco)" ldap_initialize( <DEFAULT> ) filter: (cn=marco) requesting: All userApplication attributes # extended LDIF # # LDAPv3 # base <dc=pippo,dc=it> with scope subtree # filter: (cn=marco) # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 By using strace I can see full execution appering. This is the final excerpt of my output: Process 3914 detached [pid 3915] <... read resumed> "", 4096) = 0 [pid 3915] write(1, "dn: cn=marco,dc=pippo,dc=it\nobjectclass: top\nobjectclass: person\ncn: marco\ncn: marco,,,\nsn: marco\nuid: marco\n", 109) = 109 [pid 3915] exit_group(0) = ? Process 3915 detached [pid 3909] <... waitpid resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0) = 3914 [pid 3909] waitpid(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0) = 3915 [pid 3909] rt_sigprocmask(SIG_SETMASK, [CHLD], NULL, 8) = 0 [pid 3909] rt_sigaction(SIGINT, {SIG_DFL, [], 0}, {0x8086b90, [], 0}, 8) = 0 [pid 3909] close(4) = -1 EBADF (Bad file descriptor) [pid 3909] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 3909] --- SIGCHLD (Child exited) @ 0 (0) --- [pid 3909] waitpid(-1, 0xbfda677c, WNOHANG) = -1 ECHILD (No child processes) [pid 3909] sigreturn() = ? (mask now []) [pid 3909] write(1, "\n", 1) = 1 [pid 3909] rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 [pid 3909] read(255, "\n# result\necho \"RESULT\"\necho \"code: 0\"\n\nexit 0\n\n", 1835) = 48 [pid 3909] rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 [pid 3909] rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 [pid 3909] write(1, "RESULT\n", 7) = 7 [pid 3909] rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 [pid 3909] write(1, "code: 0\n", 8) = 8 [pid 3909] rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 [pid 3909] rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 [pid 3909] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 3909] exit_group(0) = ? Process 3909 detached [pid 3767] <... read resumed> "dn: cn=marco,dc=pippo,dc=it\nobjectclass: top\nobjectclass: person\ncn: marco\ncn: marco,,,\nsn: marco\nuid: marco\n", 4096) = 109 [pid 3767] --- SIGCHLD (Child exited) @ 0 (0) --- [pid 3767] waitpid(-1, NULL, WNOHANG) = 3909 [pid 3767] waitpid(-1, NULL, WNOHANG) = -1 ECHILD (No child processes) [pid 3767] sigreturn() = ? (mask now []) [pid 3767] read(19, "\nRESULT\ncode: 0\n", 4096) = 16 [pid 3767] read(19, "", 4096) = 0 [pid 3767] time(NULL) = 1299531296 [pid 3767] send(4, "<167>*Mar 7 21:54:56 slapd[3765]: shell: fgets failed: Success (0)\n*", 67, MSG_NOSIGNAL) = 67 [pid 3767] write(16, "0\f\2\1\2e\7\n\1\0\4\0\4\0", 14) = 14 [pid 3767] time(NULL) = 1299531296 [pid 3767] send(4, "<167>Mar 7 21:54:56 slapd[3765]: conn=1003 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text=\n", 94, MSG_NOSIGNAL) = 94 [pid 3767] close(19) = 0 [pid 3767] munmap(0xb777f000, 4096) = 0 [pid 3767] futex(0x212fc060, FUTEX_WAIT_PRIVATE, 32, NULL <unfinished ...> [pid 3766] <... epoll_wait resumed> {{EPOLLIN, {u32=556622232, u64=556622232}}}, 1024, 450000) = 1 [pid 3766] epoll_ctl(7, EPOLL_CTL_MOD, 16, {0, {u32=556622232, u64=556622232}}) = 0 [pid 3766] futex(0x212fc060, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x212fc05c, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1} <unfinished ...> [pid 3789] <... futex resumed> ) = 0 [pid 3789] futex(0x212fc044, FUTEX_WAIT_PRIVATE, 2, NULL <unfinished ...> [pid 3766] <... futex resumed> ) = 1 [pid 3766] futex(0x212fc044, FUTEX_WAKE_PRIVATE, 1 <unfinished ...> [pid 3789] <... futex resumed> ) = 0 [pid 3789] futex(0x212fc044, FUTEX_WAKE_PRIVATE, 1) = 0 [pid 3789] time(NULL) = 1299531296 [pid 3789] read(16, "0\5\2\1\3B\0", 8) = 7 [pid 3789] time(NULL) = 1299531296 [pid 3789] read(16, "", 8) = 0 [pid 3789] write(6, "0", 1) = 1 [pid 3789] time(NULL) = 1299531296 [pid 3789] send(4, "<167>Mar 7 21:54:56 slapd[3765]: conn=1003 op=2 UNBIND\n", 56, MSG_NOSIGNAL) = 56 [pid 3789] epoll_ctl(7, EPOLL_CTL_DEL, 16, {0, {u32=556622232, u64=556622232}}) = 0 [pid 3789] shutdown(16, 2 /* send and receive */) = 0 [pid 3789] close(16) = 0 [pid 3789] time(NULL) = 1299531296 [pid 3789] send(4, "<167>Mar 7 21:54:56 slapd[3765]: conn=1003 fd=16 closed\n", 57, MSG_NOSIGNAL) = 57 [pid 3789] futex(0x212fc060, FUTEX_WAIT_PRIVATE, 34, NULL <unfinished ...> [pid 3766] <... futex resumed> ) = 1 [pid 3766] time(NULL) = 1299531296 [pid 3766] epoll_wait(7, {{EPOLLIN, {u32=556622188, u64=556622188}}}, 1024, 1283000) = 1 [pid 3766] read(5, "0", 8192) = 1 [pid 3766] time(NULL) = 1299531296 [pid 3766] epoll_wait(7, <unfinished ...> [pid 3765] <... futex resumed> ) = ? ERESTARTSYS (To be restarted) [pid 3765] futex(0xb7609bd8, FUTEX_WAIT, 3766, NULL^C <unfinished ...> Process 3765 detached Process 3766 detached Process 3767 detached Process 3789 detached As you can see with bold font, I obtain a strange behaviour "fgets failed". But user "marco" exists in /etc/passwd. Someone could tell me what is wrong? Thanks in advance Marco -- _________________________________________ Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi. Jim Morrison

1 0

LDAP browsers and cn=config
by Gervase Markham 07 Mar '11

07 Mar '11

How does one use an LDAP browser to view and change the cn=config config? I am using the OpenLDAP 2.4.23 package from Ubuntu 10.10, and have been using both "luma" and more recently ApacheDS. I have tried an enormous number of ways all afternoon, but feel I'm stumbling in the dark. Do I have to use a special bind DN and password, or should the RootDN and password for my normal data do? If it's special, what is it? Where is it configured? I can view the data using ldapsearch, as root: ldapsearch -Y EXTERNAL -H ldapi:/// -b cn=config I've tried adding an olcRootPW and olcRootDN manually to the cn=config LDIF file (/etc/ldap/slapd.d/cn=config/olcDatabase={0}config.ldif) but when I start slapd up again and do the command-line search it seems to have noticed the password but not the RootDN :-( The magic way of getting at it (-Y EXTERNAL) given above, which works only for root, doesn't translate well into filling in boxes in an LDAP browser config. (I tried running the LDAP browser as root and binding anonymously - I could see all my data, but still not cn=config.) The slapd-config man page has lots of info about what to change, but nothing about how to change it. I've searched the web for hours, and tried to find it in the Admin Guide, but no luck. Any help would be very much appreciated! :-) Gerv

2 1

Re: When login from one application, "error=49" error show up, but other application's login are all right.
by Andrew Findlay 07 Mar '11

07 Mar '11

On Fri, Mar 04, 2011 at 11:01:28AM +0000, mahaoboy(a)gmail.com wrote: > To: openldap-its(a)openldap.org This is not a bug-report at this stage so I am directing replies to openldap-technical(a)openldap.org. > This user can logged in confluence successfully, but when could not log in > fisheye. > Log of confluence logging: > conn=5 op=8052 SRCH base="ou=eejira,o=nsn" scope=2 deref=3 > filter="(&(objectClass=person)(uid=jirasupport))" > conn=5 op=8052 ENTRY dn="cn=jirasupport,ou=people,ou=eejira,o=nsn" > conn=5 op=8052 SEARCH RESULT tag=101 err=0 nentries=1 text= > conn=8 op=0 BIND dn="cn=jirasupport,ou=people,ou=eejira,o=nsn" method=128 > conn=8 op=0 BIND dn="cn=jirasupport,ou=People,ou=eejira,o=nsn" mech=SIMPLE ssf=0 > conn=8 op=0 RESULT tag=97 err=0 text= All OK so far. > Log of fisheye logging: > conn=5 op=8051 SRCH base="ou=eejira,o=nsn" scope=2 deref=3 > filter="(&(objectClass=person)(uid=jirasupport))" > conn=5 op=8051 ENTRY dn="cn=jirasupport,ou=people,ou=eejira,o=nsn" > conn=5 op=8051 SEARCH RESULT tag=101 err=0 nentries=1 text= > conn=7 op=0 BIND dn="cn=jirasupport,ou=people,ou=eejira,o=nsn" method=128 > conn=7 op=0 RESULT tag=97 err=49 text= Error 49 (decimal) is 0x31 (hex) which is LDAP_INVALID_CREDENTIALS so the password does not match. > And other users are all right for logging in all applications. My guess would be that there is something odd about this user's password. Be aware that most existing LDAP client software treats passwords as strings of binary without consideration of character set encoding. This can lead to problems where an account has a password that cannot be represented in 7-bit ASCII. There is nothing that the LDAP server can do about this, as it does not know what character set the application is using. I would suggest changing this account's password to a new one using only printable 7-bit characters. You can maintain good security by making the password longer (but beware that the old Unix-crypt hash scheme only uses the first 8 characters so avoid that if you can: SSHA1 is far better). Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

1 0

syncrepl missing entries in openldap 2.4.23
by James_Whiteacre＠McAfee.com 05 Mar '11

05 Mar '11

I am trying to set up syncrepl to have multiple providers to a single consumer. Basically allowing me to combine two ldap's into a single ldap. I know this is probably not a standard configuration but seems like it should work. This seems to work for a while but then all of the records from one of the providers is deleted. And even though the consumer still is polling both providers the records will will not get added back. Here is my consumer syncrepl configuration. The providers are a standard provider configuration. Any help would be appreciated. Jim serverID 064 database bdb suffix "o=dogcatfish" rootdn "cn=admin,o=dogcatfish" limits dn.exact="cn=admin,o=dogcatfish" size=unlimited time=unlimited # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw admin # syncrepl configuration syncrepl rid=64 provider=ldap://provider1 type=refreshOnly interval=00:00:01:00 retry="60 10 300 +" searchbase="o=dogcatfish" filter="(objectClass=*)" scope=sub attrs="*,+" schemachecking=off bindmethod=simple binddn="cn=admin,o=dogcatfish" credentials="admin" # syncrepl configuration syncrepl rid=68 provider=ldap://provider2 type=refreshOnly interval=00:00:01:00 retry="60 10 300 +" searchbase="o=dogcatfish" filter="(objectClass=*)" scope=sub attrs="*,+" schemachecking=off bindmethod=simple binddn="cn=admin,o=dogcatfish" credentials="admin" # Indices to maintain index contextCSN,entryCSN,entryUUID,objectClass,cn,dc,mail eq checkpoint 1024 5 mirrormode TRUE

2 3

Replication monitoring
by Andreas Andersson 04 Mar '11

04 Mar '11

Hi! I posted an announcement here about a year ago about my little LDAP monitoring project CN=Monitor. Asked for feedback and received a lot. Thank you! Some feedback was related to adding replication verification for OpenLDAP so of course I gave it a try. Unfortunately I don’t have a large scale OpenLDAP environment to verify this functionality on so I need your help :) Is it working and can it be improved? This is how it works: The contextCSN is verified on all servers within the same environment. See attached image. As always… I appreciate all feedback I can get and let me know if you have any suggestions on new features or something else that can approve this monitoring application. Project page: http://cnmonitor.sourceforge.net Freshmeat: http://freshmeat.net/projects/cnmonitor Best Regards - Andreas

4 11

Combining multiple objectClasses
by Johannes Michael Jordan 04 Mar '11

04 Mar '11

Hello, I am setting up LDAP and I wonder if my sense of laying out my directory is possible to realize. For each of our users, we need (_objectClass_): - _inetOrgPerson_ (obv.) - PAM login, _posixAccount_ - automounter information for her home: _automount_ - samba account for Windows: _sambaSamAccount_ My rationale was that I put all these objectClasses into a single object. This is not possible, as several of them are structural. Next thing I tried is to create a new objectClass that has these as superiors. Also not possible: slapd silently refuses to start, when this is included in my schema file: objectclass ( 1.3.6.1.4.1.693.10.2.2 NAME 'lmeStudent' DESC 'Student working at LME.' SUP (inetOrgPerson $ sambaSamAccount) STRUCTURAL ) Whereas it starts up fine with: objectclass ( 1.3.6.1.4.1.693.10.2.2 NAME 'lmeStudent' DESC 'Student working at LME.' SUP inetOrgPerson STRUCTURAL ) What is holding slapd from accepting my schema? Johannes

2 1

Allowing users to add, but not delete, entries?
by Gervase Markham 04 Mar '11

04 Mar '11

Hi, Summary: is it possible to configure access control such that users to can add, but not delete, entries? Details: My planned schema has a branch: ou=tags,dc=example,dc=com The entries below this are like this: objectClass=groupOfNames cn=sometagname member=<user dn 1> member=<user dn 2> member=<user dn 3> ... I have worked out how to make it so users can only add and remove themselves from a tag: access to dn.children="ou=tags,dc=example,dc=com" attrs=member,entry # Allow people to add and remove themselves from any other tag by dnattr=member selfwrite # Allow anyone to read by anonymous read So far so good, but I would like authenticated users to be able to add new entries (tags), and add themselves as members to them, but _not_ to be able to delete tags. Even better, the tag would be deletable, or even automatically removed, but only if the user removed their own name and there were no more members - i.e. it was empty. (I believe the member attribute is mandatory in groupOfNames, and I don't want it to be impossible for someone to remove their name because they are the only member!) This is difficult, because as far as I can see the "write" permission does not distinguish between adding and deleting. Can someone tell me if this is possible? Thanks, Gerv

4 10

openLDAP C++ API
by sim123 04 Mar '11

04 Mar '11

Hi, I am evaluating openLDAP and need to perform ldapsearch from C++ program. I looked at openLDAP C++ API, however README says its an unstable release. So just wanted to understand, is it ok to use that API in production environment? Is anyone using it? If there is any other library for C++ and openLDAP, please point me to that. Would really appreciate any suggestions! Thanks.

2 1

objectclasses as part of schema file
by Aleksandar Stoisavljevic 03 Mar '11

03 Mar '11

Hi all, as a almost newby with openLDAP, I encounter following problem and would like if there is someone to help me to clarify few things. So the state of a problem follows. I have request from a client (e.g. client name as foo) to establish LDAP provider at my office while we are in process of development and once we are ready for acceptance then we will move our software to client machines. Therefore I have a requirement to support user management using IBM Tivoly DS. Since I am not willing to pay for such solution and having in mind that LDAP providers should support common LDAP protocol and last I have a little knowledge how to set-up openLDAP I've decided to go with openLDAP while we are at development. Now since they have some legacy directory structure, I've asked them to export existing data and to give me that file so I can import in LDAP. But as may guessed that would be the easy and often in practice this is not the case. I've noticed that exported LDIF file contain some "custom" objectClasses and was under impression that this was something related to Tivoly DS. But after further investigation I was wondering if it is the case why I can have those objectClasses as well ??? Reading more on this theme, and in a communication with a client (legacy code was done by some external 3rd party company) I've came to conclusion that client has custom schema files. Let's call them foo.schema and foo_v3.schema So two of them and now I thought that all of my problems are gone. My intention was to change slapd.conf file so that these two are now included (include directive in the the top of the slapd.conf file). So I have places these two files in /etc/openldap/schema directory and added these two lines in slapd.conf include /etc/openldap/schema/foo.schema include /etc/openldap/schema/foo_v3.schema As I've learned on my previous project that I have worked with openLDAP, now I have started slaptest command: slaptest -d 4095 -f /etc/openldap/slapd.conf And I've got following error (this is just a example, please be aware that names are different due to NDA): eading config file /etc/openldap/schema/foo_v3.schema line 1 (objectClasses {) /etc/openldap/schema/foo_v3.schema: line 1: unknown directive <objectClasses> inside backend database definition (ignored). And if I post here you the start of this foo_v3.schema the first line really starts with: objectClasses { ( 1.3.18.0.2.6.398 NAME 'os400-root' DESC 'Root node for OS/400 system projection suffix.' SUP top STRUCTURAL MAY os400-sys ) ( 1.3.18.0.2.6.399 NAME 'os400-usrprf' DESC 'Projected OS/400 user profile.' SUP top STRUCTURAL MUST os400-profile MAY userPassword ) ... To be honest, all examples that I have encounter (openLDAP and Apache DS) that was addressing customizing schema NEVER HAD objectClasses, but rather objectClass. And finally my question is, Is this what I am trying to do really feasable, and if it is what is wrong with this foo_v3.schema file and why this is not working ? Thank you for help -- Aleksandar dipl. ing. Stoisavljevic Software Developer mobile: +381 (0) 64 211 50 40 Web: http://www.staleksit.in.rs E-mail:staleks@gmail.com SkypeId: staleks_ns Mail: Branislava Nusica 10, 21000 Novi Sad, Serbia

3 2

Problem unexpected failing slapd
by Ruud Baart 03 Mar '11

03 Mar '11

Problem: For a customer we use LDAP for many years. Last year suddenly the slapd service just stopped without any traces in the logfiles. After a restart of slapd everything works fine again. But the problem was there: it was not an incident, now and then slapd just stops and always without any traces in the logfiles. Sometime three times a day, sometime a week without a failure. I can't find a pattern or any relation to any other service on the linux server. Environment: - Several (debian squeeze) servers , several windows servers. We use bdb database backend. - There is one master LDAP server which provides syncprov and two replica's LDAP servers (syncrepl). The master server is most intens used (mainly samba as primary domain controller: a few hundred useraccounts, lot of groupaccounts, workstations, acl's, etc.), one of the replica's is not very busy but handles the mail for all users (lookup: amavis, postfix, courier-imap, mailaccount settings etc). The third replica is not busy at all, it is a remote location. - Total LDAP is 3700 dn's, slapcat produces a file of 7,3 Mb. - It is only the master LDAP with stops suddenly. I have never seen a failure of a replica LDAP. Because I have no clear idea about the problem I have no idea which technical details are relevant: DB_CONFIG =========== set_cachesize 0 10485760 1 set_lk_max_objects 10000 set_lk_max_locks 10000 set_lk_max_lockers 10000 set_lg_dir /home/ldap-dbd The database is stored on a ext3 filesystem, kernel 2.6.32. The server has no problems, plenty of memory and a fast diskarray (SAS->SATA). Never technical problems with this server. And it worked without problems for a long period. Nothing has changed to the environment or the LDAP setup (except of course with the upgrade to debian squeeze but the problem was already there). What we have tried: - upgrade from openldap 2..4.17 (debian lenny+backports) to openldap 2.4.23 (debian squeeze). I saw in the release notes that problems related to syncrepl were solved. Therefor we waited for version 2.4.23 te become available in debian. This upgrade made no difference. - reindex, rebuilt the directory. When I rebuilt the LDAP with a clean LDIF file on the master LDAP or an other machine with ldapadd there is not one error or warning. The workaround for the moment: I have written a process monitor (perl daemon) which monitors the slapd daemon and if it suddenly stops, slapd is restarted. It is of course not a solution but the 300 user can work. If slapd stops without a restart within 1 minute a few hundred people can't work because samba stops working. I would like to receive suggestions what we can do to find the problem. Because there is no pattern, nothing in the logfiles I don't know where to start. -- Regards, Ruud Baart

5 12

Re: Slapd restarting slowly
by Buchan Milne 02 Mar '11

02 Mar '11

----- "Joe Tseng" <joe_tseng(a)hotmail.com> wrote: > I found the link below that sounds exactly like my problem: > > https://bugzilla.redhat.com/show_bug.cgi?id=553032 Seems RH hasn't figured it out yet ... > > I did notice httpd was hung. I configured it so it'd auth against > LDAP for > my SVN repos; It has nothing to do with whether the service itself does anything with LDAP, only if it runs as non-root and your nss_ldap configuration is broken. > it started right up by hand after slapd was running. My > > rpcidmapd also hung - is there a dependency there too? With 'bind_policy hard', or without 'bind_policy soft', and the LDAP host/uri configured in /etc/ldap.conf not available, compare the behaviour of: $ getent passwd nobody and $ groups nobody (BTW., some distros default bind_policy to 'soft' ...) Regards, Buchan

1 0

Slapd restarting slowly
by Joe Tseng 02 Mar '11

02 Mar '11

I recently set up a file server using Fedora and I configured it to run as a PDC with Samba and OpenLDAP. It had been running very smoothly until just last night when I discovered when I tried to restart the slapd service it would just sit there for a few minutes. After it did start I looked in /var/log/messages to see if I could glean some clues; it seems as part of "service slapd start" the system would request information from slapd in order to restart slapd. Seems pretty circular to me... I did not note any type of success message when slapd finally did wake up from suspended animation. I did not set slapd to generate a log file previously but after I put in that parameter in slapd.conf and restarted the service I still didn't get any output. I did get this from /var/log/messages: $ sudo tail -f /var/log/messages Feb 28 21:00:11 server0 slapd: nss_ldap: reconnecting to LDAP server (sleeping 4 seconds)... Feb 28 21:00:15 server0 slapd: nss_ldap: failed to bind to LDAP server ldap://hda.at.home: Can't contact LDAP server Feb 28 21:00:15 server0 slapd: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server Feb 28 21:00:15 server0 slapd: nss_ldap: reconnecting to LDAP server (sleeping 8 seconds)... Feb 28 21:00:23 server0 slapd: nss_ldap: failed to bind to LDAP server ldap://hda.at.home: Can't contact LDAP server Feb 28 21:00:23 server0 slapd: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server Feb 28 21:00:23 server0 slapd: nss_ldap: reconnecting to LDAP server (sleeping 16 seconds)... Feb 28 21:00:39 server0 slapd: nss_ldap: failed to bind to LDAP server ldap://hda.at.home: Can't contact LDAP server Feb 28 21:00:39 server0 slapd: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server Feb 28 21:00:39 server0 slapd: nss_ldap: reconnecting to LDAP server (sleeping 32 seconds)... Feb 28 21:01:11 server0 slapd: nss_ldap: failed to bind to LDAP server ldap://hda.at.home: Can't contact LDAP server Feb 28 21:01:11 server0 slapd: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server Feb 28 21:01:11 server0 slapd: nss_ldap: reconnecting to LDAP server (sleeping 64 seconds)... Feb 28 21:02:15 server0 slapd: nss_ldap: failed to bind to LDAP server ldap://hda.at.home: Can't contact LDAP server Feb 28 21:02:15 server0 slapd: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server Feb 28 21:02:15 server0 slapd: nss_ldap: could not search LDAP server - Server is unavailable Feb 28 21:02:15 server0 slapd[5555]: nss_ldap: failed to bind to LDAP server ldap://hda.at.home: Can't contact LDAP server Feb 28 21:02:15 server0 slapd[5555]: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server Feb 28 21:02:15 server0 slapd[5555]: nss_ldap: failed to bind to LDAP server ldap://hda.at.home: Can't contact LDAP server Feb 28 21:02:15 server0 slapd[5555]: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server Feb 28 21:02:15 server0 slapd[5555]: nss_ldap: reconnecting to LDAP server (sleeping 4 seconds)... Feb 28 21:02:19 server0 slapd[5555]: nss_ldap: failed to bind to LDAP server ldap://hda.at.home: Can't contact LDAP server Feb 28 21:02:19 server0 slapd[5555]: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server Feb 28 21:02:19 server0 slapd[5555]: nss_ldap: reconnecting to LDAP server (sleeping 8 seconds)... Feb 28 21:02:27 server0 slapd[5555]: nss_ldap: failed to bind to LDAP server ldap://hda.at.home: Can't contact LDAP server Feb 28 21:02:27 server0 slapd[5555]: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server Feb 28 21:02:27 server0 slapd[5555]: nss_ldap: reconnecting to LDAP server (sleeping 16 seconds)... Feb 28 21:02:43 server0 slapd[5555]: nss_ldap: failed to bind to LDAP server ldap://hda.at.home: Can't contact LDAP server Feb 28 21:02:43 server0 slapd[5555]: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server Feb 28 21:02:43 server0 slapd[5555]: nss_ldap: reconnecting to LDAP server (sleeping 32 seconds)... Feb 28 21:02:50 server0 smbd_audit: jtseng|10.1.0.106|create_file|fail (Is a directory)|0x20089|pictures Feb 28 21:02:50 server0 smbd_audit: jtseng|10.1.0.106|create_file|fail (Is a directory)|0x20089|pictures/porsche918 Feb 28 21:03:15 server0 slapd[5555]: nss_ldap: failed to bind to LDAP server ldap://hda.at.home: Can't contact LDAP server Feb 28 21:03:15 server0 slapd[5555]: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server Feb 28 21:03:15 server0 slapd[5555]: nss_ldap: reconnecting to LDAP server (sleeping 64 seconds)... Feb 28 21:04:19 server0 slapd[5555]: nss_ldap: failed to bind to LDAP server ldap://hda.at.home: Can't contact LDAP server Feb 28 21:04:19 server0 slapd[5555]: nss_ldap: failed to bind to LDAP server ldap://127.0.0.1/: Can't contact LDAP server Feb 28 21:04:19 server0 slapd[5555]: nss_ldap: could not search LDAP server - Server is unavailable I stopped the log when slapd was up and running: $ sudo service slapd restart Stopping slapd: [ OK ] Starting slapd: [ OK ] $ sudo service slapd status slapd (pid 5726) is running... $ ps -ef | grep slapd ldap 5726 1 0 21:04 ? 00:00:00 /usr/sbin/slapd -h ldap:/// -u ldap jtseng 5756 5501 0 21:05 pts/2 00:00:00 grep slapd My includes for slapd are as follows: include /etc/openldap/schema/corba.schema include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/duaconf.schema include /etc/openldap/schema/dyngroup.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/java.schema include /etc/openldap/schema/misc.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/ppolicy.schema include /etc/openldap/schema/collective.schema include /etc/openldap/schema/samba.schema include /etc/openldap/schema/autofs.schema include /etc/openldap/schema/ldapns.schema I imagine I won't need all of those but aside from core, inetorgperson, openldap, samba, autofs and ldapns I wouldn't know what I can discard. I know including various schemas can add to the boot time but this has not shown itself to be a problem in the recent past. As far as users are concerned it's just me, the wife, my son and three workstations. I hope someone can clue me in... Thanks. - Joe

3 3

OpenLDAP, Kerberos, Samba, PAM, How Do They Work Together?
by Nan Meng 02 Mar '11

02 Mar '11

Dear list members, I hope amateur questions could be tolerated. I would make it professional if I could. I'm a newbie to OpenLDAP and probably even Linux, but I have to take care of an office network (Linux servers with Linux and PC workstations) that features email server, domain control, file/printer sharing, user account management, web servers and so forth, on my own without anyone's help. Yesterday morning the power went down and so did our servers. After I turned the servers back on, the account information system was no longer working. Users weren't able to login with their credentials anymore, even the root. What I did was I logged in the server (the Samba PDC, LDAP server, Kerberos server, domain controller, email server) with single mode, reseted the root password, and added accounts for other individual users on the server. I know it was a bad idea. Although I got some things working (emails, file/printer sharing), but there are still other problems (PHP ldap_bind() from web servers fails, domain user accounts and profiles fail to load correctly). I know there is a centralized mechanism that handles user accounts with the help of OpenLDAP, Kerberos, Samba, BerkeleyDB (and possibly other things), but I don't have a clue of how they work together. I've been trying to learn from docs and books for a long time before this power issue, but not very successful. My greatest problem is that I don't know how these things are working together on my system. I believe I also lack some fundamental system knowledge. I've been reading the docs available, but they're so abstract to me and none of them seems to match our system configuration. I'm hoping that I can get some help from here. Maybe some one can give me some suggestions on how to troubleshoot in such a scenario as a newbie, or an entry point that I can follow in order to explore the system. I believe you can tell that I'm totally confused here without being able to give much useful information about the problem and the system. I'm sorry for my ignorance, but I really tried to deal with it myself. If this thread turns out to be annoying or ridiculous, please ignore, and I do apologize. However, while I'm still struggling on the problem, if anyone could help, I would really appreciate it. Thank you so much. N.M.

3 2

slapd 2.2.24 will not start as non root user
by Iain M Conochie 02 Mar '11

02 Mar '11

Good Afternoon, I am attempting to upgrade my openldap 2.4.x installation to the latest release 2.4.24. I am compiling from source. I can start slapd as the root user but I am unable to start as a non-root user (e.g. ldap). I am receiving the following error message: /opt/openldap/libexec/slapd -u ldap -g ldap -h ldap://XXXXX.XXXXXXXX.XXX slapd: sbind.c:76: ldap_simple_bind: Assertion `( (ld)->ld_options.ldo_valid == 0x2 )' failed. Aborted Is the server attempting to bind to another ldap server? This is the "secondary" server on the network an I have the main LDAP server in /etc/ldap.conf. Running an strace I do see slapd referencing this file: open("/etc/ldap.conf", O_RDONLY) = 8 fstat64(8, {st_mode=S_IFREG|0644, st_size=919, ...}) = 0 fstat64(8, {st_mode=S_IFREG|0644, st_size=919, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7fa1000 read(8, "#\n# LDAP Defaults\n#\n\n# See ldap."..., 4096) = 919 read(8, "", 4096) = 0 close(8) = 0 munmap(0xb7fa1000, 4096) = 0 stat64("/etc/ldap.conf", {st_mode=S_IFREG|0644, st_size=919, ...}) = 0 geteuid32() = 0 brk(0x82b2000) = 0x82b2000 stat64("/etc/ldap.conf", {st_mode=S_IFREG|0644, st_size=919, ...}) = 0 geteuid32() = 0 write(2, "slapd: sbind.c:76: ldap_simple_b"..., 95slapd: sbind.c:76: ldap_simple_bind: Assertion `( (ld)->ld_options.ldo_valid == 0x2 )' failed. ) = 95 rt_sigprocmask(SIG_UNBLOCK, [ABRT], NULL, 8) = 0 tgkill(9691, 9691, SIGABRT) = 0 --- SIGABRT (Aborted) @ 0 (0) --- +++ killed by SIGABRT +++ Process 9691 detached Does anyone have any ideas here? Regards Iain M Conochie

4 10

openldap does not want to write log files?
by Mauricio Tavares 02 Mar '11

02 Mar '11

I am feeling rather confused here. I installed openldap in a solaris10/sparc box but I do not seem to persuade it to write to a log file. FYI, right now I am running slapd as root so permissions AFAIk should not be the issue. FYI, syslog here is the old, non-rsyslog/syslog-ng variety. So, in the /etc/syslog.conf file I have: local4.info /var/log/ldap.log local4.err /var/log/ldap.log local4.notice /var/log/ldap.log which makes me think I should be covering every possible message sent by slapd. Now /var/log/ldap.log is created as -rw------- 1 root sys 0 Feb 28 16:21 ldap.log and in the slapd.conf file I have loglevel 11560 logfile /var/log/slapd.log which not only should mean slapd is blabbing a lot to the log file. Also note I am telling it to write to /var/log/slapd.log, -rw------- 1 root sys 0 Mar 1 07:39 slapd.log When I start slapd (after restarting syslog just in case), nothing is written to those two log files. In fact, the only clue that something happened is the data in slapd.log changed: -rw------- 1 root sys 0 Feb 28 16:21 ldap.log -rw------- 1 root sys 0 Mar 1 07:40 slapd.log Anything I am missing here?

5 8

multiple certificates on one LDAP server
by Yann CUEFF 01 Mar '11

01 Mar '11

Hello, Is someone know how to use multiple certificates on one LDAP Server ? I need to use Thawte/Verisign SSL certificate and self signed SSL certificate on one LDAP server. I don't find any information about that. Regards, Yann Ce message et toutes les pièces jointes (ci-après le 'Message') sont établis à l'intention exclusive des destinataires et les informations qui y figurent sont strictement confidentielles. Toute utilisation de ce Message non conforme à sa destination, toute diffusion ou toute publication totale ou partielle, est interdite sauf autorisation expresse. Si vous n'êtes pas le destinataire de ce Message, il vous est interdit de le copier, de le faire suivre, de le divulguer ou d'en utiliser tout ou partie. Si vous avez reçu ce Message par erreur, merci de le supprimer de votre système, ainsi que toutes ses copies, et de n'en garder aucune trace sur quelque support que ce soit. Nous vous remercions également d'en avertir immédiatement l'expéditeur par retour du message. Il est impossible de garantir que les communications par messagerie électronique arrivent en temps utile, sont sécurisées ou dénuées de toute erreur ou virus. ____________________________________________________ This message and any attachments (the 'Message') are intended solely for the addressees. The information contained in this Message is confidential. Any use of information contained in this Message not in accord with its purpose, any dissemination or disclosure, either whole or partial, is prohibited except formal approval. If you are not the addressee, you may not copy, forward, disclose or use any part of it. If you have received this message in error, please delete it and all copies from your system and notify the sender immediately by return message. E-mail communication cannot be guaranteed to be timely secure, error or virus-free.

1 0

Poor performance on Solaris
by Juergen.Sprenger＠swisscom.com 01 Mar '11

01 Mar '11

Hi, we had some performance issues on our ldap servers running Solaris 10 sparc. I did some tests using slamd http://www.slamd.com/ and got disturbing results: ldap-service: OpenLDAP 2.4.23, setup identical on both boxes, threads=64, identical content. box1: hardware: Sun Microsystems sun4v SPARC Enterprise T5120 memory:32 GB RAM os: Solaris 10 s10s_u9wos_14a searches (avg/second): 1521 box2: hardware: AMD 64 phenom 9850 memory: 8 GB RAM os: Linux dsv00000 2.6.36.2 #1 SMP Mon Dec 27 10:09:29 CET 2010 x86_64 AMD Phenom(tm) 9850 Quad-Core Processor AuthenticAMD GNU/Linux searches (avg/second): 22968 I am looking for some hints to improve performance on box1 to a similar level as on box2 or an explanation why on box1 performance is so bad. As slapd.conf, ldap.conf and DB_CONFIG are identical there should not be such a big gap in performance. Juergen Sprenger

7 10

Password policy: possible DoS scenario
by Konstantin Boyandin 01 Mar '11

01 Mar '11

Hello, Thanks to everyone having answered me earlier, I've managed to set up password policy on the OpenLDAP provided in CentOS 5.5 repositories (current version 2.3.43). The setup: we have password policy enabled for users accounts in our intranet. After 5 unsuccessful attempts the account is blocked for short duration (30 seconds). Does that mean that anyone now can keep all the accounts blocked most of the time? Am I right that if anyone enters someone else' incorrect password 5 times (in the given case), they will block the target account (regardless of what IP address the attacker was connecting from)? Narrower question: do password policy module developers plan to take into account what IPs are used to connect (thus, blocking only access from specific IPs)? Thanks. All the best, Konstantin

2 3

Re: Problem unexpected failing slapd
by jekvb＠gmx.co.uk 27 Feb '11

27 Feb '11

"...now and then slapd just stops and always without any traces in the logfiles. Sometime three times a day, sometime a week without a failure. I can't find a pattern or any relation to any other service on the linux server." Is your LDAP environment installed on a VM or on plain metal box? Regards, Kuba ----- Original Message ----- From: Ruud Baart Sent: 27/02/11 12:57 PM To: openldap-technical(a)openldap.org Subject: Problem unexpected failing slapd Problem: For a customer we use LDAP for many years. Last year suddenly the slapd service just stopped without any traces in the logfiles. After a restart of slapd everything works fine again. But the problem was there: it was not an incident, now and then slapd just stops and always without any traces in the logfiles. Sometime three times a day, sometime a week without a failure. I can't find a pattern or any relation to any other service on the linux server. Environment: - Several (debian squeeze) servers , several windows servers. We use bdb database backend. - There is one master LDAP server which provides syncprov and two replica's LDAP servers (syncrepl). The master server is most intens used (mainly samba as primary domain controller: a few hundred useraccounts, lot of groupaccounts, workstations, acl's, etc.), one of the replica's is not very busy but handles the mail for all users (lookup: amavis, postfix, courier-imap, mailaccount settings etc). The third replica is not busy at all, it is a remote location. - Total LDAP is 3700 dn's, slapcat produces a file of 7,3 Mb. - It is only the master LDAP with stops suddenly. I have never seen a failure of a replica LDAP. Because I have no clear idea about the problem I have no idea which technical details are relevant: DB_CONFIG =========== set_cachesize 0 10485760 1 set_lk_max_objects 10000 set_lk_max_locks 10000 set_lk_max_lockers 10000 set_lg_dir /home/ldap-dbd The database is stored on a ext3 filesystem, kernel 2.6.32. The server has no problems, plenty of memory and a fast diskarray (SAS->SATA). Never technical problems with this server. And it worked without problems for a long period. Nothing has changed to the environment or the LDAP setup (except of course with the upgrade to debian squeeze but the problem was already there). What we have tried: - upgrade from openldap 2..4.17 (debian lenny+backports) to openldap 2.4.23 (debian squeeze). I saw in the release notes that problems related to syncrepl were solved. Therefor we waited for version 2.4.23 te become available in debian. This upgrade made no difference. - reindex, rebuilt the directory. When I rebuilt the LDAP with a clean LDIF file on the master LDAP or an other machine with ldapadd there is not one error or warning. The workaround for the moment: I have written a process monitor (perl daemon) which monitors the slapd daemon and if it suddenly stops, slapd is restarted. It is of course not a solution but the 300 user can work. If slapd stops without a restart within 1 minute a few hundred people can't work because samba stops working. I would like to receive suggestions what we can do to find the problem. Because there is no pattern, nothing in the logfiles I don't know where to start. -- Regards, Ruud Baart

1 0

Help needed with opeLDAP configuration
by sim123 26 Feb '11

26 Feb '11

Dear All, I am new to LDAP and openLDAP, just installed and configured openLDAP 2.4.23 with Berkeley DB 4.8 on CentOS 5.4 using http://www.openldap.org/doc/admin24/quickstart.html make test gave an error on replication similar to this http://www.openldap.org/lists/openldap-technical/201006/msg00256.html So I think installation is correct but when I try to do a search as described in the article, result is : # ldapsearch -x -b '' -s base '(objectclass=*)' namingContexts # extended LDIF # # LDAPv3 # base <> with scope baseObject # filter: (objectclass=*) # requesting: namingContexts # # dn: namingContexts: dc=example,dc=com # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Can someone please help me identifying the problem. Thanks for the help and support.

3 3

Re: Help needed with opeLDAP configuration
by sim123 25 Feb '11

25 Feb '11

Thanks for your response, I did ignore the error. However, the search result is empty, not sure what could go wrong. my sladp.conf file is same as described in quick start guide. Thanks. On Fri, Feb 25, 2011 at 12:36 PM, Quanah Gibson-Mount <quanah(a)zimbra.com>wrote: > --On Friday, February 25, 2011 11:36 AM -0800 sim123 <Sim3159(a)gmail.com> > wrote: > > Dear All, >> >> >> I am new to LDAP and openLDAP, just installed and configured openLDAP >> 2.4.23 with Berkeley DB 4.8 on CentOS 5.4 >> using http://www.openldap.org/doc/admin24/quickstart.html >> >> make test gave an error on replication similar to >> this http://www.openldap.org/lists/openldap-technical/201006/msg00256.ht >> ml >> >> So I think installation is correct but when I try to do a search as >> described in the article, result is : >> > > As noted repeatedly, even by the test itself, you should ignore any errors > from test058. That's why it exists with success. > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

sortvals oddities - with more information and hopefully to the right list
by Andrew Elble 25 Feb '11

25 Feb '11

We are using sortvals on both member and memberUid. We have been seeing duplicate member/memberUid attributes on some objects that have been modified (as well as a lack of sorting on those attributes). It seemed that there was a correlation between modifies to objects that experienced deadlocks and the objects that had duplicate member/memberUid attributes on them. We put the seqmod overlay in place - and this reduced the number of occurrences of the issue but did not eliminate them. Upon further investigation, I discovered that it was possible to bypass the sorting behavior if the object was not created with an instance of the attribute with sorting enabled as a part of it. It would seem that attr_merge() (in attr.c) should have something like this: if ( *a == NULL ) { *a = attr_alloc( desc ); if (desc->ad_type->sat_flags & SLAP_AT_SORTED_VAL) { (*a)->a_flags |= SLAP_ATTR_SORTED_VALS; } } else { Further pursuing the issue, I started to focus on the index deletion code that was changed as a part of ITS#5183. Specifically, the portion of code within bdb_modify_internal() (in back-bdb/modify.c) that is commented: /* Move deleted values to end of array */ This code modifies save_attrs, which is actually apparently a pointer to memory that resides within the cache. If a deadlock occurs, these changes are not reverted, thereby corrupting the entry in the cache. I replaced this code with the pre-ITS#5183 code and I am no longer able to 'break' the object and insert duplicate member/memberUids. I also found it surprising that the call to bdb_idl_cache_del() in bdb_idl_delete_key() in back-bdb/idl.c occurred prior to any calls to the database? I can answer any questions about the specifics of the environment in which where we are seeing this - it is a somewhat difficult problem to reproduce outside of our production environment. I'm not terribly familiar with the code - I'm looking to see if I have collected enough data here to open an ITS to have this fixed. (or if I'm just way off base) Thanks, Andy -- Andrew W. Elble aweits(a)discipline.rit.edu Infrastructure Engineer, Communications Technical Lead Rochester Institute of Technology PGP: BFAD 8461 4CCF DC95 DA2C B0EB 965B 082E 863E C912 CONFIDENTIALITY NOTE: The information transmitted, including attachments, is intended only for the person(s) or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and destroy any copies of this information.

2 1

Migrating from Sun DSEE & Boolean values question
by Simon Fraser 25 Feb '11

25 Feb '11

Hi, We're planning to migrate to OpenLDAP from Sun Directory Server. So far the test setup works fine, with one potential problem. Sun's directory server treats boolean values as case-insensitive, while the RFC (and OpenLDAP) require upper-case TRUE and FALSE values. Is there a way of forcing case insensitivity on boolean values with OpenLDAP, so that any clients who are applying filters like "(foo=true)" will continue to work? Or is the only way to maintain stats logging and try to locate particular scripts on the machines that connect, and fix each one in turn? I realise the former option is not RFC compliant, but for me, it'll be very convenient to be permissive. Thanks, Simon. -- The Wellcome Trust Sanger Institute is operated by Genome Research Limited, a charity registered in England with number 1021457 and a company registered in England with number 2742969, whose registered office is 215 Euston Road, London, NW1 2BE.

2 1

Advise on distributed directory service
by Germ van Ek 25 Feb '11

25 Feb '11

Hello, I am asked to design a replicated OpenLDAP implementation for use on 1500 of our customers servers who are now use a non-replicated configuration using the standard passwd/shadow backend combined with a PostgreSQL database. Our customers consist of primary schools and will use the database for authentication through Samba. The reason we want to replicate the data is so that we can offer email and other services from a central datacentre. Having considered several options ( Multi-Master, MirrorMode ), after some consulting in our team, I've decided we'll opt for the 'simple' Master-Slave setup, with a Master at each customer site and 7 (virtualised) servers each handling an everage of 215 customer databases. Having 7 servers however has the disadvantage of not knowing on which server a customer's database will be when a user is trying to authenticate on their email for example. My first thought was that I would configure a special 'redirection' server only containing referrals. I 'hoped' all common clients would cache these referrals so that load on this redirection server would be low. I'm now doubting this choice for 2 reasons: - The following of this referrals seams highly unstandardized. The biggest users of the referral functionality will probably be PHP, in the PHP manual the documentation on rebinding / referral chasing is not very thorough. Any automation of this is also not present, and I would need to implement any caching myself too. ( http://www.php.net/manual/en/function.ldap-set-rebind-proc.php ) This is 'annoying' for me, but I highly doubt third party applications will all implement this in a reasonable way, and I was not planning on customizing all of the software we use... - In the notes on the documentation of referrals for OpenLDAP 2.4 ( http://www.openldap.org/doc/admin24/referrals.html ), the following note is present: Note: the use of referrals to construct a Distributed Directory Service is extremely clumsy and not well supported by common clients. If an existing installation has already been built using referrals, the use of the chain overlay to hide the referrals will greatly improve the usability of the Directory system. A better approach would be to use explicitly defined local and proxy databases in subordinate configurations to provide a seamless view of the Distributed Directory. Though I am usually very stubborn, I try to avoid designing systems in a way the documentation says is not recommended. The use of 1 single proxy cache server seams to 'ease the pain' a bit, but does not seam like a very scalable approach. The use of proxy-overlays would make the server the client connects to function as a kind of non caching proxy, and in general 'be involved' in all of the requests, which again doesn't seam very desirable, and very single-point-of-failure. All servers that are configured (customer servers excluded unless they opt/pay for it) will be configured in a failover way, I didn't mention this above to avoid too much complication. What do you recommend for distributing the databases and still be able to easily use them? Do I overestimate the amount of traffic/work a server has in the proxy overlay method? Germ van Eck Engineer Station to Station B.V. --

3 3

Using OpenLDAP and Kerberos with linux instead of OpenDirectory with MacOSX
by Fabien COMBERNOUS 25 Feb '11

25 Feb '11

Hi the list, I would like to change my MacOSX server with a Debian server. Any experience report about this is appreciated. I searched on the web but informations are pretty old. Regards, -- *Fabien COMBERNOUS* /unix system engineer/ www.kezia.com <http://www.kezia.com/> *Tel: +33 (0) 467 992 986* Kezia Group

1 0

complex characters in UID attribute
by Vinay Kalkoti 25 Feb '11

25 Feb '11

Hi, I wanted to know what all complex characters can be included for an UID attribute. I have the following user names (uid). Please let me know which which of the following uid's are invalid - test_user: IT (LOC) sup_12$ test_user:IT(LOC) test_user-IT test_user IT test_user:IT test_user(IT) test_user.IT test_user/IT test_user/IT test_user#IT test_user*IT test_user@IT Thanks, Vinay

4 5

OpenLDAP performances on AIX?
by Marco Pizzoli 25 Feb '11

25 Feb '11

Hi all, on the same line of previous mail about openldap performances on Solaris, I would like to know if someone has experience about AIX. I'm evaluating a deploy on this platform and I would like to know about any performance comparison/experience between AIX (5.3/6.1/7.1) and Linux. Thanks in advance Marco -- _________________________________________ Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi. Jim Morrison

2 2

Re: Poor performance on Solaris
by jekvb＠gmx.co.uk 25 Feb '11

25 Feb '11

<quote Quanah> Some time ago, I did benchmarks of Linux 2.6 vs Slowaris-x86 on identical hardware, and it still was noticeably slower, although not as bad as when using the sparc architecture. <quote Quanah /> Could you state what Solaris-x86 version that was? Thanks, Kuba ----- Original Message ----- From: Quanah Gibson-Mount Sent: 24/02/11 07:28 PM To: Juergen.Sprenger(a)swisscom.com, openldap-technical(a)openldap.org Subject: Re: Poor performance on Solaris --On Thursday, February 24, 2011 3:53 PM +0100 Juergen.Sprenger(a)swisscom.com wrote: > Hi, > > we had some performance issues on our ldap servers running Solaris 10 > sparc. > > I did some tests using slamd http://www.slamd.com/ and got disturbing > results: > > ldap-service: OpenLDAP 2.4.23, setup identical on both boxes, threads=64, > identical content. > > box1: > hardware: Sun Microsystems sun4v SPARC Enterprise T5120 > memory:32 GB RAM > os: Solaris 10 s10s_u9wos_14a > searches (avg/second): 1521 Slowaris is always tedious with OpenLDAP. At a previous job, I was able to replace 9 slowaris boxes with 4 linux boxes, and even then, just one of the Linux boxes could handle the complete load it took the 9 slowaris boxes to run. I will note that if you are going to use slowaris, I highly advise you set a memory key rather than using on disk cache for BDB if your DB is any size over about 4 GB. Other than that, you'll generally just have to deal with the fact it will be significantly slower than Linux. Some time ago, I did benchmarks of Linux 2.6 vs Slowaris-x86 on identical hardware, and it still was noticeably slower, although not as bad as when using the sparc architecture. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

2 1

Re: Poor performance on Solaris
by Omer Faruk SEN 24 Feb '11

24 Feb '11

Hi, I totally agree with you about Solaris + OpenLdap issues. Just use Linux if you will use openldap if possible of course .. Regards. On Thu, Feb 24, 2011 at 8:28 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Thursday, February 24, 2011 3:53 PM +0100 Juergen.Sprenger(a)swisscom.com > wrote: > >> Hi, >> >> we had some performance issues on our ldap servers running Solaris 10 >> sparc. >> >> I did some tests using slamd http://www.slamd.com/ and got disturbing >> results: >> >> ldap-service: OpenLDAP 2.4.23, setup identical on both boxes, threads=64, >> identical content. >> >> box1: >> hardware: Sun Microsystems sun4v SPARC Enterprise T5120 >> memory:32 GB RAM >> os: Solaris 10 s10s_u9wos_14a >> searches (avg/second): 1521 > > Slowaris is always tedious with OpenLDAP. At a previous job, I was able to > replace 9 slowaris boxes with 4 linux boxes, and even then, just one of the > Linux boxes could handle the complete load it took the 9 slowaris boxes to > run. > > I will note that if you are going to use slowaris, I highly advise you set a > memory key rather than using on disk cache for BDB if your DB is any size > over about 4 GB. Other than that, you'll generally just have to deal with > the fact it will be significantly slower than Linux. > > Some time ago, I did benchmarks of Linux 2.6 vs Slowaris-x86 on identical > hardware, and it still was noticeably slower, although not as bad as when > using the sparc architecture. > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

idle_timelimit - idletimeout - nscd
by ldap＠mm.st 24 Feb '11

24 Feb '11

We run a few ldap servers (RH5, openldap 2.3) for our Linux systems to authenticate against. Using the netstat command we notice that a large number of established connections are always present on our ldapservers. We currently do not use idle_timelimit in any of the client ldap.conf files and we also do not use idletimeout in slapd.conf on our servers. We have seen a few remarks stating that if idletimeout is used in slapd that it may adversely affect replications. We are trying to decide if we should use the server based idletimeout or the client idle_timelimit to close the idle connections. Any recommendations? If so, what are some sane values to start with? We currently do not use ncsd on the clients, but are considering it if that makes a difference in the above settings.

3 3

Multiple certificates
by Yann CUEFF 24 Feb '11

24 Feb '11

Hello, I have an 2.4.21 openldap server with Thawte/Verisign SSL server certificates. I created self signed certificates and everything is OK when I replace Thawte/Verisign SSL certificates with self signed certificates. I concatenated my authority certificate to client certificate and clients could negociate with openldap server. Do you now if it is possible to use both server certificates ? I tried to concatenate self signed certificates to Thawte/Verisign SSL certificates, openssl restart correctly but ldap clients did not negociate correctly with openldap server. Regards, Yann Ce message et toutes les pièces jointes (ci-après le 'Message') sont établis à l'intention exclusive des destinataires et les informations qui y figurent sont strictement confidentielles. Toute utilisation de ce Message non conforme à sa destination, toute diffusion ou toute publication totale ou partielle, est interdite sauf autorisation expresse. Si vous n'êtes pas le destinataire de ce Message, il vous est interdit de le copier, de le faire suivre, de le divulguer ou d'en utiliser tout ou partie. Si vous avez reçu ce Message par erreur, merci de le supprimer de votre système, ainsi que toutes ses copies, et de n'en garder aucune trace sur quelque support que ce soit. Nous vous remercions également d'en avertir immédiatement l'expéditeur par retour du message. Il est impossible de garantir que les communications par messagerie électronique arrivent en temps utile, sont sécurisées ou dénuées de toute erreur ou virus. ____________________________________________________ This message and any attachments (the 'Message') are intended solely for the addressees. The information contained in this Message is confidential. Any use of information contained in this Message not in accord with its purpose, any dissemination or disclosure, either whole or partial, is prohibited except formal approval. If you are not the addressee, you may not copy, forward, disclose or use any part of it. If you have received this message in error, please delete it and all copies from your system and notify the sender immediately by return message. E-mail communication cannot be guaranteed to be timely secure, error or virus-free.

1 0

pcache / proxy overlay
by Mauro Parra 24 Feb '11

24 Feb '11

Hello, is there any document besides the Kumar's article about the openLDAP proxy cache? Specially a howto about configuring the service. Saludos, M -- Saludos, Mauro Parra-Miranda Consultor Senior Novell - mparra(a)novell.com openSUSE Developer - mauro(a)openSUSE.org BB PIN - 22600AE9

2 1

remote credentials for local branch with authz-regexp
by Hugo Monteiro 23 Feb '11

23 Feb '11

Hello list, I'm using translucent in a local server. That same server also has an extra local database, which is a local only branch of the remote database. This database is a subordinate and they glue together well. Now, for the sake of management, i need to be able to identify to the local database (rootdn) but using credentials from the remote database. Assuming one has translucent to remote - dc=example,dc=com with remote admin user cn=admin,dc=example,dc=com local - ou=localbranch,dc=example,dc=com with rootdn admin user cn=admin,ou=localbranch,dc=example,dc=com I tried the follwing on the local server database hdb suffix "ou=localbranch,dc=example,dc=com" rootdn "cn=admin,ou=localbranch,dc=example,dc=com" rootpw "secret" directory "/var/lib/ldap/ou=localbranch,dc=example,dc=com" index objectClass,sambaSID eq lastmod on authz-regexp "cn=admin,dc=example,dc=com" "cn=admin,ou=localbranch,dc=example,dc=com" access to dn.base="ou=localbranch,dc=example,dc=com" by * read access to * by dn="cn=admin,ou=localbranch,dc=example,dc=com" write by dn="cn=admin,dc=example,dc=com" write by * read subordinate The credentials used to connect to the remote server have full read only access to the remote database. So the problem is that when i try to authenticate using cn=admin,dc=example,dc=com, to the local database branch, i can see the bind request being transluced to the remote server without using the authz-regexp map. Any advice is appreciated, Hugo Monteiro. -- fct.unl.pt:~# cat .signature Hugo Monteiro Email : hugo.monteiro(a)fct.unl.pt Telefone : +351 212948300 Ext.15307 Web : http://hmonteiro.net Divisão de Informática Faculdade de Ciências e Tecnologia da Universidade Nova de Lisboa Quinta da Torre 2829-516 Caparica Portugal Telefone: +351 212948596 Fax: +351 212948548 www.fct.unl.pt apoio(a)fct.unl.pt fct.unl.pt:~# _

2 2

How can I check ldap is working well?
by Olivier PAVILLA 23 Feb '11

23 Feb '11

After upgrading my server (Lenny to Squeeze). Something happened. /var/lib/ldap was empty. Thanku very debian installer :) I made a new /var/lib/ldap/DB_CONFIG I restarted ldap with something like this /etc/init.d/slapd start I looked my syslog tail -f /var/log/syslog and it contents that : Feb 23 13:46:13 unverre slapd[4660]: slap_client_connect: URI=ldaps://coruscan2.dumpsize.fr:636 DN="cn=replicapalpatine,ou=useraccess,dc=dumpsize,dc=fr" ldap_sasl_bind_s failed (-1) Feb 23 13:46:13 unverre slapd[4660]: do_syncrepl: rid=008 rc -1 retrying Feb 23 13:56:13 unverre slapd[4660]: syncrepl_message_to_entry: rid=008 mods check (objectClass: value #4 invalid per syntax) Feb 23 13:56:13 unverre slapd[4660]: do_syncrepl: rid=008 rc 21 retrying Feb 23 14:06:13 unverre slapd[4660]: syncrepl_message_to_entry: rid=008 mods check (objectClass: value #4 invalid per syntax) Feb 23 14:06:14 unverre slapd[4660]: do_syncrepl: rid=008 rc 21 retrying Anyone can translate this to me? How can I check my ldap server is working well? -- Olivier Pavilla << 仕事を探しています。求職中です。>> S.C.I.R.C. Orléans (Bourgogne) - I.U.F.M. Centre-Val de Loire 72 Rue du Faubourg Bourgogne -45044 ORLEANS Cedex 1 Tel : 02-38-49-26-20 , mailto:olivier.pavilla@univ-ørleans.fr http://blog.linux-squad.com - 僕の傑作です。

1 0

authzTo now X-ORDERED?
by Michael Ströder 23 Feb '11

23 Feb '11

HI! I'm trying to configure proxy authz with 2.4.24 without luck testing with ldapwhoami -X. Now I wonder if attribute 'authzTo' is now handled as X-ORDERED [1]. Unfortunately the subschema subentry does not contain a attribute type description for 'authzTo'. The server adds prefix "{0}" to my authzTo attribute value. Ciao, Michael. [1] http://tools.ietf.org/html/draft-chu-ldap-xordered-00

1 1

Re: openldap problems authenticating
by Tim Dunphy 23 Feb '11

23 Feb '11

Hey guys I took Quanah's advice and put the clear text password into /etc/lapd.conf on the client. I also noticed that the user account it was looking for was of a posixAccount class. And I was missing the nis.shema. So I added nis.schema to slapd.conf and restarted slapd and I was seeing the same pattern. ldapsearches on the client were working just as they were before and getents on the client were not. But I was seeing a new error in the logs at this point: Feb 23 01:16:45 LBSD2 slapd[52517]: conn=1471 op=1 SRCH base="ou=staff,dc=summitnjhome,dc=com" scope=2 deref=0 filter="(objectClass=posixAccount)" Feb 23 01:16:45 LBSD2 slapd[52517]: conn=1471 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass Feb 23 01:16:45 LBSD2 slapd[52517]: conn=1471 op=1 SEARCH RESULT tag=101 err=32 nentries=0 text= Feb 23 01:16:45 LBSD2 slapd[52517]: daemon: activity on 1 descriptor Feb 23 01:16:45 LBSD2 slapd[52517]: daemon: activity on: Feb 23 01:16:45 LBSD2 slapd[52517]: 12r Feb 23 01:16:45 LBSD2 slapd[52517]: Feb 23 01:16:45 LBSD2 slapd[52517]: daemon: read activity on 12 Feb 23 01:16:45 LBSD2 slapd[52517]: daemon: select: listen=6 active_threads=0 tvp=NULL Feb 23 01:16:45 LBSD2 slapd[52517]: daemon: select: listen=7 active_threads=0 tvp=NULL Feb 23 01:16:45 LBSD2 slapd[52517]: connection_read(12): input error=-2 id=1471, closing. Feb 23 01:16:45 LBSD2 slapd[52517]: connection_closing: readying conn=1471 sd=12 for close Feb 23 01:16:45 LBSD2 slapd[52517]: daemon: activity on 1 descriptor Feb 23 01:16:45 LBSD2 slapd[52517]: daemon: waked Feb 23 01:16:45 LBSD2 slapd[52517]: daemon: select: listen=6 active_threads=0 tvp=NULL Feb 23 01:16:45 LBSD2 slapd[52517]: daemon: select: listen=7 active_threads=0 tvp=NULL Feb 23 01:16:45 LBSD2 slapd[52517]: daemon: removing 12 Which from what I've googled means basically "object not found". Now just to clarify a point of possible confusion... my user accounts are unix posixAccounts that were migrated using the padl tools. Here's what one of the user accounts looks like: 43 uid=bluethundr,cn=summitnjops,ou=staff,ou=Group,dc=summitnjhome,dc=com uid: bluethundr cn: Timothy P. Dunphy givenName: Timothy P. sn: Dunphy mail: bluethundr(a)gmail.com mailRoutingAddress: bluethundr(a)mail.summitnjhome.com mailHost: mail.summitnjhome.com objectClass: top objectClass: person objectClass: organizationalPerson objectClass: posixAccount objectClass: inetOrgPerson objectClass: inetLocalMailRecipient objectClass: ldapPublicKey uidNumber: 1001 gidNumber: 10000 homeDirectory: /home/bluethundr gecos: Timothy Dunphy loginShell: /bin/bash sshPublicKey: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDQ0zYn6FhQ1lKnvQ1K1GbXh8hdsXlXnnUYjLcNUqv7uMjjy0xDv03bnPU0Iyl1HcQcVFYPgcjB7mo3FZjZHd9bsHRwnY688FjPv/xE78+B M8aDTuzb6czVA1X9ztc6Y6eNGYy1U4b3dseVFS+L2APkjaV5/RYPRH4mxJ8aNnrf+APaZvjtwPPEnxZST58QYdwtBvalLbgpDRTmGHrSEP2bJvUSR+iS3zC9xp90R0hFSVjd6jauXcxhkFLyG0nnmjc5sS5271 uxsXTfVFC1bHBasXL5ITFS63SpZErDWIVNwfVoR2tentddD6qJFd5ewTojRFDua3iqU4EJUl80RjmF bluethundr(a)LCENT01.summitnjhome.com sshPublicKey: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDlhRvFkT6wUAR3jw2h2Z0KV2/WsHPFkuXBD1BgzOQfR+PFhZDnt/zp44cLGwxa55RKEtFC+n/sjgmj99hKbn+0pPlGUGDuGqmWtMG45s+S oDm9pRd8uzFccNYDLQ3POhfD2EbOarR45m7X42r821YO3ZeWnn3E1rCHarXrHXFX13sp9Jh8htNlWBCEjvs37S8VC9v5XW95BY8rhqrDGJrobmzDplUlHjgYjyBWx/BQxxgvmqQfKyS8i26+IelHcqRT5cgCSU bFlPR3ouVu8eAgIE6gwKTuElIaTwJQ4QjBlaGaohEQRei0FWsfb7EzH1ikE34gJTdoaSnozU9MWc+f tim@dunphy userPassword: {CRYPT}crHJs4YTxefJE I am trying to search the directory using the pam_ldap account which is an inetOrgPerson account and looks like this: 3 cn=pam_ldap,ou=Services,dc=summitnjhome,dc=com cn: pam_ldap objectClass: top objectClass: inetOrgPerson sn: PAM userPassword: {SSHA}Cbk8VNyWQsXNmqt6n9GYDRcR0cnuA2sJ This command does find the bluethundr account: ldapsearch -xH 'ldap://LBSD2.summitnjhome.com' -D 'cn=pam_ldap,ou=Services,dc=summitnjhome,dc=com' -w 'secret' -b 'dc=summitnjhome,dc=com' '(uid=bluethundr)' (currently I'm not using TLS until I get this mess sorted out) And I am using this /etc/ldap.conf on the client which as I've mentioned is centos 5.5 host 192.168.1.44 base ou=staff,ou=Group,dc=summitnjhome,dc=com sudoers_base ou=staff,ou=Group,dc=summitnjhome,dc=com binddn cn=pam_ldap,ou=Services,dc=summitnjhome,dc=com bindpw secret scope sub pam_password exop nss_base_passwd ou=staff,dc=summitnjhome,dc=com nss_base_shadow ou=staff,dc=summitnjhome,dc=com I am definitely looking forward to an end to this vexing situation. But once again let me state that I genuinely appreciate any time and input you may be able to provide. On Tue, Feb 22, 2011 at 6:02 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, February 22, 2011 5:52 PM -0500 Tim Dunphy > <bluethundr(a)gmail.com> wrote: > >> Hello list, >> >> I am running an openldap 2.4 server under FreeBSD that was working >> well until the config was tweaked by someone on the team without >> properly documenting their work > >> bindpw {crypt}secret > > A few things: > > a) Crypt is non-portable > b) That doesn't look like a valid crypt'd password > c) You're going to need to set a plain text password to bind, regardless > > Try just changing "bindpw" to be "secret" and see what happens. If you want > better security, use SASL/EXTERNAL or SASL/GSSAPI etc. > > --Quanah > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration > -- GPG me!! gpg --keyserver pool.sks-keyservers.net --recv-keys F186197B

2 1

openldap problems authenticating
by Tim Dunphy 23 Feb '11

23 Feb '11

Hello list, I am running an openldap 2.4 server under FreeBSD that was working well until the config was tweaked by someone on the team without properly documenting their work # /usr/local/etc/ldap.con on ldap server (FreeBSD 8.1) host LBSD.summitnjhome.com base dc=summitnjhome,dc=com sudoers_base ou=sudoers,ou=Services,dc=summitnjhome,dc=com binddn cn=pam_ldap,ou=Services,dc=summitnjhome,dc=com bindpw {SSHA}secret scope sub pam_password exop nss_base_passwd ou=staff,dc=summitnjhome,dc=com nss_base_shadow ou=staff,dc=summitnjhome,dc=com # grep for ldap account shows ldap account on the ldap server itself succeeds [root@LBSD2:/usr/local/etc/openldap] #getent passwd | grep walbs walbs:secret/:1002:1003:Walkiria Soares:/home/walbs:/usr/local/bin/bash [root@LBSD2:/usr/local/etc/openldap] #grep walbs /etc/passwd [root@LBSD2:/usr/local/etc/openldap] # # /etc/ldap.conf on ldap client (centos 5.5) host LBSD2.summitnjhome.com base dc=summitnjhome,dc=com sudoers_base ou=sudoers,ou=Services,dc=summitnjhome,dc=com binddn cn=pam_ldap,ou=Services,dc=summitnjhome,dc=com bindpw {crypt}secret scope sub pam_password exop nss_base_passwd ou=staff,dc=summitnjhome,dc=com nss_base_shadow ou=staff,dc=summitnjhome,dc=com # grep getent passwd for ldap account on the client nothing turns up after a long pause [root@LCENT01:~] #getent passwd | grep walbs [root@LCENT01:~] # # nsswitch on the client passwd: files ldap shadow: files ldap group: files ldap sudoers: ldap #hosts: db files nisplus nis dns hosts: files dns # this is what's going on in the logs on the ldap server during th getent from the #client Feb 22 21:31:18 LBSD2 slapd[51158]: conn=3411 op=0 RESULT tag=97 err=49 text= Feb 22 21:31:18 LBSD2 slapd[51158]: conn=3411 op=1 UNBIND Feb 22 21:31:18 LBSD2 slapd[51158]: conn=3411 fd=22 closed Feb 22 21:31:26 LBSD2 slapd[51158]: conn=3412 fd=22 ACCEPT from IP=192.168.1.42:53811 (IP=192.168.1.44:389) Feb 22 21:31:26 LBSD2 slapd[51158]: conn=3412 op=0 BIND dn="cn=pam_ldap,ou=Services,dc=summitnjhome,dc=com" method=128 Feb 22 21:31:26 LBSD2 slapd[51158]: conn=3412 op=0 RESULT tag=97 err=49 text= Feb 22 21:31:26 LBSD2 slapd[51158]: conn=3412 op=1 UNBIND Feb 22 21:31:26 LBSD2 slapd[51158]: conn=3412 fd=22 closed #ldap search from the client as the pam services account is able to locate the ldap user info [root@LCENT02:~] #ldapsearch -xH 'ldap://LBSD2.summitnjhome.com' -D 'cn=pam_ldap ,ou=Services,dc=summitnjhome,dc=com' -w 'secret' -b 'dc=summitnjhome,dc=com' '(uid=walbs)' # extended LDIF # # LDAPv3 # base <dc=summitnjhome,dc=com> with scope subtree # filter: (uid=walbs) # requesting: ALL # # walbs, People, summitnjhome.com dn: uid=walbs,ou=People,dc=summitnjhome,dc=com uid: walbs cn: Walkiria Soares givenName: Walkiria sn: Soares mail: walbs(a)example.com objectClass: inetLocalMailRecipient objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: top uidNumber: 1002 gidNumber: 1003 # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 #pam_ldap services account in the ldap directory 3 cn=pam_ldap,ou=Services,dc=summitnjhome,dc=com cn: pam_ldap objectClass: top objectClass: inetOrgPerson sn: PAM userPassword: {SSHA}secret I have also tried doing anonymous binds on the client as well as using plain text passwords. I get the same tag=97 err=49 messages on the client either way. This is the ldap software I have on the FreeBSD server: LBSD2# pkg_info | grep -i ldap ldapvi-1.7_2 A tool to update LDAP entries with a text editor openldap-sasl-client-2.4.23 Open source LDAP client implementation with SASL2 support openldap-sasl-server-2.4.23 Open source LDAP server implementation pam_ldap-1.8.5 A pam module for authenticating with LDAP And this is what I am using on the Centos 5.5 client: [root@LCENT01:~] #rpm -qa | grep -i ldap python-ldap-2.2.0-2.1 openldap-2.3.43-12.el5_5.3 nss_ldap-253-25.el5 ldapvi-1.7-10.el5 php-ldap-5.1.6-27.el5 openldap-clients-2.3.43-12.el5_5.3 openldap-2.3.43-12.el5_5.3 nss_ldap-253-25.el5 Some advice is sorely needed here. Thank you very kindly in advance! -- GPG me!! gpg --keyserver pool.sks-keyservers.net --recv-keys F186197B

2 1

I've broken my installation
by Stuart Bailey 22 Feb '11

22 Feb '11

Hello, I had a working openldap installation that I was developing some PHP to manage. I'm using the ldap_bind PHP call without username & password, so it is an anonymous bond. I decided to have a clean install to verify everything was ok, so copied my ldap config files, and reinstall on a clean system. the problem is that now the anonymous bind will not work. I turned on all debugging, and found the entry: ... do_bind: v3 anonymous bind in the log. I'm guessing this means that anonymous bind is enabled, but still my PHP code will not bind. I'm not sure where to start to look for the problem. Could someone please point me in the right direction. I can supply logs and configs once I know where to look and what to send. Many thanks, Stuart -- Stuart Bailey BSc (hons) CEng CITP MBCS LinuSoft (Managing Director) Linux Specialist & Software Developer ~~~~~~~~~~~~~~~~~~~~~~~ Phone: (0845) 658 3563 Direct: +44 (0)1953 878162 Fax: +44 (0) 1603 858583 ~~~~~~~~~~~~~~~~~~~~~~~ http://www.linusoft.co.uk http://www.bluetoothadvertising.org.uk -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

2 1

merging local and remote attributes
by Hugo Monteiro 22 Feb '11

22 Feb '11

Hello list, I have been trying to use translucent overlay to merge attributes between a remote and a local server (both 2.4.23). From the slapo-translucent man page i read: "Attributes may be specified as both local and remote if desired." and "In any case, both the local and remote entries corresponding to a search result will be merged before being returned to the client." The thing is that if i specify an attribute (objectclass) to be both local and remote, i can only get/search for the local entries. Choosing either separately will work as advertised though. Again, i ask if this is a bug, a subtlety i have missed or this is not supposed to work with objectClass attribute? Please advise, Hugo Monteiro. -- fct.unl.pt:~# cat .signature Hugo Monteiro Email : hugo.monteiro(a)fct.unl.pt Telefone : +351 212948300 Ext.15307 Web : http://hmonteiro.net Divisão de Informática Faculdade de Ciências e Tecnologia da Universidade Nova de Lisboa Quinta da Torre 2829-516 Caparica Portugal Telefone: +351 212948596 Fax: +351 212948548 www.fct.unl.pt apoio(a)fct.unl.pt fct.unl.pt:~# _

2 3

Ipad/iPhone ldap setup
by Chris Jackson 21 Feb '11

21 Feb '11

I am having trouble accessing my openldap server over SSL using an iPhone/iPad/iPod Touch using ios 4.2.1. If I check the SSL box in the client setup on the iPhone/iPad/iPod Touch I get an error in the slapd log -- TLS negotiation Failure. With logging level 9 I get TLS accept failure error=-1 id=1. Other clients work fine over SSL/StartTLS. Outlook, addressbook in osX 10.6, jxplorer. I am using openldap 2.4.19-15 on RHEL6 with a comodo wildcard SSL cert. Chris Jackson

2 1

Re: BDB performance issue
by amolkulkarni＠gmx.com 21 Feb '11

21 Feb '11

Hi, I was not certain abt what info to put so I've given below all the info that I could gather. Kindly tell me if you require anything else. openldap = symas-openldap-silver-2.4-12.1 bdb = bundled with symas ( 4.6 ) configuration in slapd.conf *cachesize 427275* *idlcachesize 427275* (there are approx 427275 entries in the db so i've that as the cachesize.) *threads 2* (this is a server which has web applications also running. so we have reduced openldap threads to 2.) *sizelimit 1000 checkpoint 10240 10 lastmod on idletimeout 120 timelimit 360 gentlehup on* in DB_CONFIG, *set_cachesize 0 1985642496 1* (The total size of all .bdb files is 1813643264 bytes) cat /proc/cpuinfo shows 7 cpus. It has 4gb ram and 8gb swap. Thanks and Regards, Amol. ----- Original Message ----- From: Quanah Gibson-Mount Sent: 02/18/11 11:20 PM To: Amol Kulkarni, openldap-technical(a)openldap.org Subject: Re: BDB performance issue --On Friday, February 18, 2011 7:00 AM +0000 Amol Kulkarni <amolkulkarni(a)gmx.com> wrote: > Hi All, > I'm a newbie with bdb - and I have a server not performing well - > openldap shows high cpu usage and iowait of server is high. So I got > stats of bdb but I'm not sure what to make out of it. With help of > google I could see that the basic parameters like requested pages and > locks are ok. But there are other parameters which are suspect. > The output of db_stat -c is as follows : > Are the lines in red really prbs or just side effects ? How do I go abt > it ? Yes, those are definitely issues that need addressing. Unfortunately, you don't really provide any useful information that would help with resolving it. You also completely fail to note: OpenLDAP version BDB version --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Add GSSAPI to RootDSE ?
by Fabien COMBERNOUS 21 Feb '11

21 Feb '11

Hi the list, I want to add a supportedSASLMechanisms in my rootDSE : Today, i have all of this : ldapsearch -LLL -b "" -s base -x '(objectclass=*)' supportedSASLMechanisms dn: supportedSASLMechanisms: NTLM supportedSASLMechanisms: DIGEST-MD5 supportedSASLMechanisms: CRAM-MD5 I want to add GSSAPI. To add this i created the following ldif file : cat /tmp/rootDSE dn: changetype: modify add: supportedSASLMechanisms supportedSASLMechanisms: GSSAPI Then with simple autentication (-x) i used my testing olcRootDN to modify the rootDSE : ldapadd -f /tmp/rootDSE -x -D "cn=admin,dc=server,dc=lan" -W Enter LDAP Password: modifying entry "" ldap_modify: Server is unwilling to perform (53) additional info: modify upon the root DSE not supported What i'm missing ? Regards, -- *Fabien COMBERNOUS* /unix system engineer/ www.kezia.com <http://www.kezia.com/> *Tel: +33 (0) 467 992 986* Kezia Group

3 3

slapd will not start with inetorgperson
by Tim Dunphy 21 Feb '11

21 Feb '11

hello list!! I am building an ldap server on freebsd 8.1. For some reason if I include the inetorgperson schema in my slapd.conf slapd will not start here is the listing in slapd.conf # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/inetorgpreson.schema I do not know why this is the case as I can ls the file: [root@LBSD2:/usr/local/etc/openldap] #ls -l /usr/local/etc/openldap/schema/inetorgperson.schema -r--r--r-- 1 root wheel 6360 Feb 21 03:13 /usr/local/etc/openldap/schema/inetorgperson.schema If I comment out the inetorg schema slapd starts. And it looks like the ownership and permissions are the same as they are on the schema that is currently working: [root@LBSD2:/usr/local/etc/openldap] #ls -l /usr/local/etc/openldap/schema/core.schema -r--r--r-- 1 root wheel 20583 Feb 21 03:13 /usr/local/etc/openldap/schema/core.schema Boy would I love to get this working again! :) thanks for your help! -- GPG me!! gpg --keyserver pool.sks-keyservers.net --recv-keys F186197B

3 2

Re: ldap auth does not works after openldap upgrade
by Andrew Findlay 20 Feb '11

20 Feb '11

On Tue, Feb 15, 2011 at 04:04:57PM -0200, Leonardo Carneiro wrote: > Hmm, still did not worked. > > If i do a ldapsearch specifying '-D cn=root,dc=dominio,dc=com,dc=br" and the > password, the search goes ok. if i do not specify, is asks me for a sasl/md5 > authentication and fails, and just asks for a password. if i include a '-x' > parameter, also does not work: > > chester@reploid:~$ ldapsearch -v -h 192.168.0.2 -b "dc=dominio,dc=com,dc=br" > '(objectclass=*)' -LLL -x > ldap_initialize( ldap://192.168.0.2 ) > filter: (objectclass=*) > requesting: All userApplication attributes > No such object (32) You always need the -x flag. (You can only leave it out if you supply SASL credentials, and that is a complexity we do not need right now). It seems that anon users still cannot see the suffix entry at all. Try adding this line just under your 'lastmod off' line: access to * by * read Make sure that you restart the slapd process after doing this. Then try the search: ldapsearch -x -v -h 192.168.0.2 -b "dc=dominio,dc=com,dc=br" '(objectclass=*)' If you still get nothing, set SLAPD_OPTIONS="-d 128" in /etc/default/slapd and restart the server. It should not go into the background, and should produce some output on the screen. DO NOT REBOOT with this setting in place. Now retry just the search above, and post the debug output along with the new state of the slapd config file. Remove the "-d 128" again. Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

8 30

Slapd Security based on port
by Chris Jackson 20 Feb '11

20 Feb '11

Is it possible to prevent anonymous and unauthenticated binds to ldaps:// 636 but allow them on ldap:// 389? I want to allow staff to query my ldaps:// outside of my network while requiring them to login to do so but allow anyone to bind (anonymous, unauthenticated, or authenticated) internally on ldaps//: 389. I know: Anonymous bind can be disabled by "disallow bind_anon" and Unauthenticated bind mechanism is disabled by default. But if I use "disallow bind_anon it stops in on both ports. I want to stop it just on ldaps://. Chris Jackson

8 13

Ldap with GroupOfUniqueNames + PosixGroups
by Alejandro Gándara Álvarez 20 Feb '11

20 Feb '11

Hi list, I´m using slapd 2.4.11-1+lenny1, until now I was being using posixgroup as objectclass for my groups, now we need to integrate ldap with a new application which requires GroupofUniquesnames as objectclass. My question is, can I have mix groups?. I mean, a group with two objectclass as posixgroup and GroupofUniquenames. I´ve tried but I always get errors because of conflict with both objectclass. And I cant delete posixgroup objectclass because I need it to integrate with samba and other services. Could someone head me to the right way? Thanks for all Alejandro Gándara

3 5

Re: threads and concurrency
by Omer Faruk SEN 20 Feb '11

20 Feb '11

Hi, This system has 32 GB of RAM additionally OS is RHEL 5. And this system is 16 core. I see new threads are created as the load increases and I have re-checked my system and thread count is now 28. So I think at most 32 threads is fine for me Regards. On Sun, Feb 20, 2011 at 5:03 AM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Saturday, February 19, 2011 6:32 PM -0800 Howard Chu <hyc(a)symas.com> > wrote: > >> Omer Faruk SEN wrote: >>> >>> Hi , >>> >>> I have and ldap server (openldap-2.4.23 ) in slapd.conf I set >>> >>> concurrency 8192 >>> threads 256 > >> Keep in mind that each thread uses a thread stack of 4MB on 32 bit >> systems, 8MB on 64 bit systems. So you're looking at 1-2GB of RAM >> dedicated to the threads with a setting like this. Make sure you don't >> configure more threads than you have RAM for... > > I would add that your threads setting is likely a rather insane value unless > you have 256*4 cores (1024 core box). You generally don't need to set the > threads value higher than 8 or 16. > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

1 0

threads and concurrency
by Omer Faruk SEN 20 Feb '11

20 Feb '11

Hi , I have and ldap server (openldap-2.4.23 ) in slapd.conf I set concurrency 8192 threads 256 but when I do top -b -H -d 2 -p 25560 I always see 8 threads ( show 9 slapd instances) not more even if I instruct to create 256 threads. Is there anything that I miss? Additionally what is the releation of threads and concurrency. Is there any calculation method that I must obey? Regards.

3 2

Mapping user names from multiple attributes
by Jaap Winius 19 Feb '11

19 Feb '11

Hi folks, My site has user accounts defined in Kerberos and LDAP. User IDs, group IDs, given names and surnames are stored in LDAP using the person schema object E.g. for uid=jwinius, these are: cn: Jaap sn: Winius However, I recently noticed that if I send email from a random host, the name included with the source email address is just "Jaap" when I would like it to be "Jaap Winius". I suspect libnss_ldap is responsible. Is there an easy way to change how these names are mapped, so that user names would be composed of cn + space + sn? Thanks, Jaap

2 1

undefined reference to `ldap_int_tls_impl' (tls2.c) ?
by Elle Y Suzuki 18 Feb '11

18 Feb '11

make is exiting with several "undefined reference to 'ldap_int_tls_impl'" error messages: ./.libs/libldap.a(tls2.o): In function `ldap_pvt_tls_ctx_free': /home/vmplanet/Downloads/openldap-2.4.24/libraries/libldap/tls2.c:79: undefined reference to `ldap_int_tls_impl' ./.libs/libldap.a(tls2.o): In function `tls_init': /home/vmplanet/Downloads/openldap-2.4.24/libraries/libldap/tls2.c:163: undefined reference to `ldap_int_tls_impl' /home/vmplanet/Downloads/openldap-2.4.24/libraries/libldap/tls2.c:163: undefined reference to `ldap_int_tls_impl' /home/vmplanet/Downloads/openldap-2.4.24/libraries/libldap/tls2.c:168: undefined reference to `ldap_int_tls_impl' ./.libs/libldap.a(tls2.o): In function `ldap_pvt_tls_check_hostname': /home/vmplanet/Downloads/openldap-2.4.24/libraries/libldap/tls2.c:494: undefined reference to `ldap_int_tls_impl' ./.libs/libldap.a(tls2.o):/home/vmplanet/Downloads/openldap-2.4.24/libraries/libldap/tls2.c:860: more undefined references to `ldap_int_tls_impl' follow collect2: ld returned 1 exit status make[2]: *** [apitest] Error 1 make[2]: Leaving directory `/home/vmplanet/Downloads/openldap-2.4.24/libraries/libldap' make[1]: *** [all-common] Error 1 make[1]: Leaving directory `/home/vmplanet/Downloads/openldap-2.4.24/libraries' make: *** [all-common] Error 1 what is the proper way to fix this so that i might successfully make? BACKGROUND i am attempting to set up and install openldap 2.4.24 on a virtual kubuntu on windows xp. 'configure' and 'make depend' appear to run successfully. i execute the following steps: export CPPFLAGS="-I/usr/include/nss -I/usr/include/nspr -I/usr/local/BerkeleyDB.5.0/include" export LDFLAGS="-L/usr/lib/nss -L/usr/local/BerkeleyDB.5.0/lib" export LD_LIBRARY_PATH="/home/vmplanet/Downloads/db-5.0.32/build_unix/.libs" configure --enable-shell=yes --without-threads make depend (in case you're wondering why back-shell, i've included details in a previous thread, http://tinyurl.com/4flbgh4. note that in that thread, i successfully installed openldap directly on windows, but had questions about successfully testing back-shell -- and still do.) going back to the errors above, i note in which files this 'ldap_int_tls_impl' appears with a grep: ./libraries/libldap_r/tls2.c:40:static tls_impl *tls_imp = &ldap_int_tls_impl; ./libraries/libldap_r/tls_g.c:1095:tls_impl ldap_int_tls_impl = { ./libraries/libldap_r/tls_o.c:1253:tls_impl ldap_int_tls_impl = { ./libraries/libldap_r/tls_m.c:3040:tls_impl ldap_int_tls_impl = { ./libraries/libldap/tls2.c:40:static tls_impl *tls_imp = &ldap_int_tls_impl; ./libraries/libldap/tls_g.c:1095:tls_impl ldap_int_tls_impl = { ./libraries/libldap/ldap-tls.h:75:extern tls_impl ldap_int_tls_impl; Binary file ./libraries/libldap/.libs/libldap-2.4.so.2.6.0 matches Binary file ./libraries/libldap/.libs/libldap.so matches Binary file ./libraries/libldap/.libs/tls2.o matches Binary file ./libraries/libldap/.libs/libldap-2.4.so.2 matches Binary file ./libraries/libldap/.libs/libldap.a matches Binary file ./libraries/libldap/tls2.o matches ./libraries/libldap/tls_o.c:1253:tls_impl ldap_int_tls_impl = { ./libraries/libldap/tls_m.c:3040:tls_impl ldap_int_tls_impl = { ldap_int_tls_impl appears (defined) in the fellow tls* files above. is this then an indication that tls2.c is not communicating or 'linked' to its fellow tls* files or ? the output from 'make depend' appears to show that mkdep traversed the libldap and libldap_r subdirectories and successfully constructed the necessary sets of include file dependencies. admittedly, i am not altogether that familiar with (the intricacies of) the compile/make process. please advise; thanks in advance.

2 1

Syncrepl in openldap 2.3.43
by Michael Starling 18 Feb '11

18 Feb '11

I've been using slurpd for quite some time now with fairly good results however I wanted to take advantage of the newer features in syncrepl. Specifically the ability to have the slave push to the master. I was able to set this up in relative short order using the example provided in http://www.openldap.org/doc/admin23/syncrepl.html I start up my slave server and it does indeed grab all the database information from my master, however I can no longer write to my master server. What am i missing from the documentation? If I try to add a simple ldif file it fails with the following error: [root@myserver backups]# ldapadd -f replicator-policy.ldif -x -D cn=root,dc=somedomain,dc=somedomain -W Enter LDAP Password: adding new entry "cn=replicate,ou=policies,dc=somedomain,dc=somedomain" ldapadd: Server is unwilling to perform (53) additional info: shadow context; no update referral If I add an updateref to my slave slapd.conf pointing back to my master server the error changes to this: [root@myserver backups]# ldapadd -f replicator-policy.ldif -x -D cn=root,dc=somedomain,dc=somedomain -W Enter LDAP Password: adding new entry "cn=replicate,ou=policies,dc=somedomain,dc=somedomain" ldapadd: Referral (10) referrals: ldap://myserver.aa.bb.cc:389/cn=replicate,ou=policies,dc=somedomain,dc=somedomain Master syncrepl config #Syncrepl overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 Slave syncrepl config #SYNCREPL SETTINGS syncrepl rid=357 provider=ldap://myserver.aa.bb.cc:389 type=refreshAndPersist retry="60 10 300 +" searchbase="dc=somedomain,dc=somedomain" attrs="*,+" bindmethod=simple binddn="uid=replicator,ou=people,dc=somedomain,dc=somedomain" credentials=replicatorpassword

3 5

BDB performance issue
by Amol Kulkarni 18 Feb '11

18 Feb '11

Hi All, I'm a newbie with bdb - and I have a server not performing well - openldap shows high cpu usage and iowait of server is high. So I got stats of bdb but I'm not sure what to make out of it. With help of google I could see that the basic parameters like requested pages and locks are ok. But there are other parameters which are suspect. The output of db_stat -c is as follows : 196 Last allocated locker ID 0x7fffffff Current maximum unused locker ID 9 Number of lock modes 1000 Maximum number of locks possible 1000 Maximum number of lockers possible 1000 Maximum number of lock objects possible 25 Number of current locks 758 Maximum number of locks at any one time 163 Number of current lockers 167 Maximum number of lockers at any one time 25 Number of current lock objects 394 Maximum number of lock objects at any one time 3609M Total number of locks requested (3609996536) 3609M Total number of locks released (3609996497) 0 Total number of locks upgraded 50 Total number of locks downgraded 3054935 Lock requests not available due to conflicts, for which we waited 0 Lock requests not available due to conflicts, for which we did not wait 14 Number of deadlocks 0 Lock timeout value 0 Number of locks that have timed out 0 Transaction timeout value 0 Number of transactions that have timed out 712KB The size of the lock region 187M The number of region locks that required waiting (56%) The output of dbstat -m is ( which looks ok to me ) 1GB 869MB 672KB Total cache size 1 Number of caches 1 Maximum number of caches 1GB 869MB 672KB Pool individual cache size 0 Maximum memory-mapped file size 0 Maximum open file descriptors 0 Maximum sequential buffer writes 0 Sleep after writing maximum sequential buffers 0 Requested pages mapped into the process' address space 1535M Requested pages found in the cache (99%) 247743 Requested pages not found in the cache 5517 Pages created in the cache 247743 Pages read into the cache 3491659 Pages written from the cache to the backing file 0 Clean pages forced from the cache 0 Dirty pages forced from the cache 0 Dirty pages written by trickle-sync thread 253260 Current total page count 253253 Current clean page count 7 Current dirty page count 262147 Number of hash buckets used for page location 1535M Total number of times hash chains searched for a page (1535296125) 4 The longest hash chain searched for a page 1245M Total number of hash chain entries checked for page (1245967353) 31M The number of hash bucket locks that required waiting (0%) 30M The maximum number of times any hash bucket lock was waited for (1%) 13566 The number of region locks that required waiting (4%) 0 The number of buffers frozen 0 The number of buffers thawed 0 The number of frozen buffers freed Are the lines in red really prbs or just side effects ? How do I go abt it ? Thanks and Regards, Amol.

2 1

objectClass attribute merging
by Hugo Monteiro 18 Feb '11

18 Feb '11

Hello, I'm trying to merge the objectClass attribute between a central LDAP server and a local one which is using translucent overlay. I have configured the overlay with translucent_remote objectClass translucent_local objectClass If i issue a query like ldapsearch -D "cn=cdstaff,dc=unl,dc=pt" -b "ou=grupos,dc=fct,dc=unl,dc=pt" -h localhost -W -x "(cn=cpd_srv_adm)" i get # extended LDIF # # LDAPv3 # base <ou=grupos,dc=fct,dc=unl,dc=pt> with scope subtree # filter: (cn=cpd_srv_adm) # requesting: ALL # # 637, grupos, fct.unl.pt dn: uniqueIdentifier=637,ou=grupos,dc=fct,dc=unl,dc=pt displayName: Admins Servidores ADM cn: cpd_srv_adm uniqueIdentifier: 637 gidNumber: 1637 member: uniqueIdentifier=18172,ou=agentes,dc=fct,dc=unl,dc=pt member: uniqueIdentifier=18272,ou=agentes,dc=fct,dc=unl,dc=pt member: uniqueIdentifier=15093,ou=agentes,dc=fct,dc=unl,dc=pt objectClass: top objectClass: grupoUNL objectClass: posixGroup # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 but then, if i change the filter to also use objectClass like ldapsearch -D "cn=cdstaff,dc=unl,dc=pt" -b "ou=grupos,dc=fct,dc=unl,dc=pt" -h localhost -W -x "(&(objectClass=*)(cn=cpd_srv_adm))" i get # extended LDIF # # LDAPv3 # base <ou=grupos,dc=fct,dc=unl,dc=pt> with scope subtree # filter: (&(objectClass=*)(cn=cpd_srv_adm)) # requesting: ALL # # 637, grupos, fct.unl.pt dn: uniqueIdentifier=637,ou=grupos,dc=fct,dc=unl,dc=pt displayName: Admins Servidores ADM cn: cpd_srv_adm uniqueIdentifier: 637 gidNumber: 1637 member: uniqueIdentifier=18172,ou=agentes,dc=fct,dc=unl,dc=pt member: uniqueIdentifier=18272,ou=agentes,dc=fct,dc=unl,dc=pt member: uniqueIdentifier=15093,ou=agentes,dc=fct,dc=unl,dc=pt objectClass: top objectClass: grupoUNL objectClass: posixGroup # search result search: 2 result: 32 No such object # numResponses: 2 # numEntries: 1 which apparently works, but do notice that it also reports result: 32 No such object If i try the query in another client, like phpldapadmin or even luma, i'm only presented with the error message. Is this a bug? Best regards, Hugo Monteiro. -- fct.unl.pt:~# cat .signature Hugo Monteiro Email : hugo.monteiro(a)fct.unl.pt Telefone : +351 212948300 Ext.15307 Web : http://hmonteiro.net Divisão de Informática Faculdade de Ciências e Tecnologia da Universidade Nova de Lisboa Quinta da Torre 2829-516 Caparica Portugal Telefone: +351 212948596 Fax: +351 212948548 www.fct.unl.pt apoio(a)fct.unl.pt fct.unl.pt:~# _

1 0

Local root browsing for translucent proxy
by Hugo Monteiro 18 Feb '11

18 Feb '11

Hello, I have set a translucent proxy and things have been working rather well. I've been able to add/delete and modify local attributes authenticating with the local rootdn. All this has been done using openldap's command line tools. I now have the need to use a web based interface and so i installed phpldapadmin. To my surprise, i can login using the local rootdn but i'm not able to browse or search for any entry in that branch, although i have write access acls, besides the rootdn declaration. the database definition is as follows: --- snip --- database hdb suffix "dc=example,dc=com" rootdn cn=loadmin,dc=example,dc=com rootpw secret directory "/var/lib/ldap" lastmod on access to attrs=userPassword,sambaNTPassword,krb5Key by dn.exact="cn=admin,dc=example,dc=com" write by dn.exact="cn=loadmin,dc=example,dc=com" write by dn.exact="cn=reader,dc=example,dc=com" read by self read by anonymous auth by * none access to * by dn.exact="cn=admin,dc=example,dc=com" write by dn.exact="cn=loadmin,dc=example,dc=com" write by * read index sambaSID,sambaPrimaryGroupSID eq overlay translucent uri "ldap://ldapbackend.example.com" acl-bind binddn="cn=reader,dc=example,dc=com" credentials="secret" translucent_strict translucent_remote objectClass translucent_local sambaSID,sambaPrimaryGroupSID,sambaAcctFlags overlay glue --- snip --- I seen no problem in the configuration, but do please point me out any misconfiguration that might be leading to this behaviour. Since i've been able to use the command line tools, i initially supposed it was a misconfiguration or even a bug in phpldapadmin, but i'm starting to consider the problem as limitiation for the translucent overlay. Should i consider this scenario also? (I know i should be using runtime config already... Let us leave that to another occasion ;) ) Best regards, Hugo Monteiro. -- fct.unl.pt:~# cat .signature Hugo Monteiro Email : hugo.monteiro(a)fct.unl.pt Telefone : +351 212948300 Ext.15307 Web : http://hmonteiro.net Divisão de Informática Faculdade de Ciências e Tecnologia da Universidade Nova de Lisboa Quinta da Torre 2829-516 Caparica Portugal Telefone: +351 212948596 Fax: +351 212948548 www.fct.unl.pt apoio(a)fct.unl.pt fct.unl.pt:~# _

1 2

How to make ldappasswd obey password policy restrictions?
by Konstantin Boyandin 18 Feb '11

18 Feb '11

Greetings, Given: OpenLDAP: 2.4.23, password policy module enabled, default password policy loaded as dn: cn=default,ou=Policies,dc=example,dc=com cn: default objectClass: pwdPolicy objectClass: person objectClass: top pwdAllowUserChange: TRUE pwdAttribute: userPassword pwdCheckQuality: 0 pwdExpireWarning: 600 pwdFailureCountInterval: 30 pwdGraceAuthNLimit: 5 pwdInHistory: 5 pwdLockout: TRUE pwdLockoutDuration: 30 pwdMaxAge: 7776000 pwdMaxFailure: 5 pwdMinAge: 0 pwdMinLength: 5 pwdMustChange: FALSE pwdSafeModify: FALSE sn: dummy value Authentication is set via LDAP (. The problem: when I try to set password via ldappassword, using command like this: ldappasswd -e ppolicy -W -x -D "cn=Manager,dc=example,dc=com" \ -H ldap://127.0.0.1/ -A -S "uid=testuser,ou=Users,dc=example,dc=com" it bypasses password policy settings - I can set the same password, can set the previously used password. It doesn't matter whether I specify '-e ppolicy' or not. However, when I try to change password with passwd (authentication is set via LDAP, /etc/ldap.conf contains 'pam_password exop'): passwd testuser the password policy restrictions are in effect. I am not allowed to set the same password, to set previous or similar password etc. Is it possible to make ldappaswd observe password policy restrictions? Thanks. Sincerely, Konstantin

3 3

Ppolicy does not seem to work
by Jan Kohnert 18 Feb '11

18 Feb '11

Hi there, I'm new to this list, so first of all welcome to everyone. I have a problem with ppolicy and got stuck finding a solution. I configured slapd using the information from [1] trying to be able to lock users. But anyway, the lock seems to be ignored: As soon as one tries to log in, the pwdLockedTime agument es removed from the entry and I seem to be too blind or dumb to see the reason why. Here is what happens (testing my own account): b079 /etc/openldap # grep -v "^#" ldif/locked_users.ldif dn: uid=jan,ou=xxx,dc=yyy,dc=zzz,dc=org changetype: modify add: pwdAccountLockedTime pwdAccountLockedTime: 20110119225403Z b079 /etc/openldap # ldapmodify -x -D "cn=admin, dc=yyy, dc=zzz, dc=org" -W -f ldif/locked_users.ldif Enter LDAP Password: modifying entry "uid=jan,ou=xxx,dc=yyy,dc=zzz,dc=org" b079 /etc/openldap # slapcat | grep -B 13 Locked | grep "uid: jan" uid: jan b079 /etc/openldap # ldapwhoami -x -D "uid=jan, ou=xxx, dc=yyy, dc=zzz, dc=org" -W Enter LDAP Password: dn:uid=jan,ou=xxx,dc=yyy,dc=zzz,dc=org b079 /etc/openldap # slapcat | grep -B 13 Locked | grep "uid: jan"b079 /etc/openldap # And here is the relevant configuration; b079 /etc/openldap # grep ppolicy slapd.conf include /etc/openldap/schema/ppolicy.schema moduleload ppolicy.so overlay ppolicy ppolicy_default "cn=default,ou=policies,dc=yyy,dc=zzz,dc=org" b079 /etc/openldap # b079 /etc/openldap # ldapsearch -x -s base -b "cn=default, ou=policies, dc=yyy, dc=zzz, dc=org" # extended LDIF # # LDAPv3 # base <cn=default, ou=policies, dc=yyy, dc=zzz, dc=org> with scope baseObject # filter: (objectclass=*) # requesting: ALL # # default, policies, yyy.zzz.org dn: cn=default,ou=policies,dc=yyy,dc=zzz,dc=org cn: default sn: dummy value objectClass: pwdPolicy objectClass: person objectClass: top pwdAttribute: userPassword pwdMinAge: 0 pwdMaxAge: 0 pwdInHistory: 0 pwdCheckQuality: 0 pwdLockout: TRUE pwdLockoutDuration: 900 pwdFailureCountInterval: 1800 pwdMustChange: FALSE pwdAllowUserChange: TRUE pwdSafeModify: TRUE pwdExpireWarning: 604800 pwdMaxFailure: 5 pwdGraceAuthNLimit: 0 pwdMinLength: 8 # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 b079 /etc/openldap # Thank a lot in advance! [1] http://www.openldap.org/lists/openldap-technical/200810/msg00107.html -- MfG Jan

4 8

[Q] Does anybody succeed to setup SASL(digest-md5) authentication with mysql database and latest openldap-server??
by Hiroyuki Sato 18 Feb '11

18 Feb '11

Dear members. Does anybody succeed to setup SASL(digest-md5) authentication with mysql database and latest openldap-server?? I'm not sure, why this configuration does not work correctly. and It seems that LDAP server compare dn and input password in ldap authentication. (see log below) Thank you for your advice. Sincerely. -- Hiroyuki Sato. My Environment OS: Ubuntu 10.10 OpenLDAP : 2.4.24 (build myself) 1, slapd.conf .. sasl-realm mydomain.com sasl-auxprops sql sasl-regexp uid=(.*),cn=mydomain.com,cn=digest-md5,cn=auth uid=$1,ou=users,ou=mydomain.com,dc=test,dc=mydomain,dc=com Note: ``sasl-auxprops sql'' does not well document. It is important config for sql authentication 2, /usr/lib/sasl2/slapd.conf pwcheck_method: auxprop mech_list: DIGEST-MD5 log_level: 7 auxprop_plugin: sql sql_verbose: yes sql_engine: mysql sql_hostnames: database.server.add.ress sql_user: username sql_passwd: password sql_database: db_name sql_select: select password from sasl_test where username = '%u@%r' 3, dataase entry mysql> select * from sasl_test \G *************************** 1. row *************************** username: ldapuser(a)mydomain.com password: ldapuser_password 4, auth ldapsearch -R mydomain.com -h server_add.ress -Y digest-md5 -U ldapuser -b 'ou=users,ou=mydomain.com,dc=test,dc=test,dc=mydomain,dc=com' -LLL '(objectclass=*)' Password: ldap_sasl_interactive_bind_s: Insufficient access (50) 5, log ...... <= ldap_dn2bv(uid=ldap_user,cn=mydomain,dc=com,cn=DIGEST-MD5,cn=auth)=0 slap_sasl_getdn: u:id converted to uid=ldap_user,cn=mydomain,dc=com,cn=DIGEST-MD5,cn=auth >>> dnNormalize: <uid=ldap_user,cn=mydomain,dc=com,cn=DIGEST-MD5,cn=auth> => ldap_bv2dn(uid=ldap_user,cn=mydomain,dc=com,cn=DIGEST-MD5,cn=auth,0) <= ldap_bv2dn(uid=ldap_user,cn=mydomain,dc=com,cn=DIGEST-MD5,cn=auth)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=ldap_user,cn=mydomain,dc=com,cn=digest-md5,cn=auth)=0 <<< dnNormalize: <uid=ldap_user,cn=mydomain,dc=com,cn=digest-md5,cn=auth> ==>slap_sasl2dn: converting SASL name uid=ldap_user,cn=mydomain,dc=com,cn=digest-md5,cn=auth to a DN daemon: activity on 1 descriptor ==> rewrite_context_apply [depth=1] string='uid=ldap_user,cn=mydomain,dc=com,cn=digest-md5,cn=auth' ==> rewrite_rule_apply rule='uid=(.*),cn=mydomain,dc=com,cn=digest-md5,cn=auth' string='uid=ldap_user,cn=mydomain,dc=com,cn=digest-md5,cn=auth' [1 pass(es)] ==> rewrite_context_apply [depth=1] res={0,'uid=ldap_user,ou=users,ou=mydomain,dc=com,dc=test,dc=mydomain,dc=com'} [rw] authid: "uid=ldap_user,cn=mydomain,dc=com,cn=digest-md5,cn=auth" -> "uid=ldap_user,ou=users,ou=mydomain,dc=com,dc=test,dc=mydomain,dc=com" slap_parseURI: parsing uid=ldap_user,ou=users,ou=mydomain,dc=com,dc=test,dc=mydomain,dc=com ldap_url_parse_ext(uid=ldap_user,ou=users,ou=mydomain,dc=com,dc=test,dc=mydomain,dc=com) >>> dnNormalize: <uid=ldap_user,ou=users,ou=mydomain,dc=com,dc=test,dc=mydomain,dc=com> => ldap_bv2dn(uid=ldap_user,ou=users,ou=mydomain,dc=com,dc=test,dc=mydomain,dc=com,0) <= ldap_bv2dn(uid=ldap_user,ou=users,ou=mydomain,dc=com,dc=test,dc=mydomain,dc=com)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=ldap_user,ou=users,ou=mydomain,dc=com,dc=test,dc=mydomain,dc=com)=0 <<< dnNormalize: <uid=ldap_user,ou=users,ou=mydomain,dc=com,dc=test,dc=mydomain,dc=com> <==slap_sasl2dn: Converted SASL name to uid=ldap_user,ou=users,ou=mydomain,dc=com,dc=test,dc=mydomain,dc=com slap_sasl_getdn: dn:id converted to uid=ldap_user,ou=users,ou=mydomain,dc=com,dc=test,dc=mydomain,dc=com SASL Canonicalize [conn=1003]: slapAuthcDN="uid=ldap_user,ou=users,ou=mydomain,dc=com,dc=test,dc=mydomain,dc=com" daemon: activity on: daemon: epoll: listen=7 active_threads=0 tvp=NULL daemon: epoll: listen=8 active_threads=0 tvp=NULL SASL Canonicalize [conn=1003]: authzid="ldap_user" SASL proxy authorize [conn=1003]: authcid="ldap_user@mydomain,dc=com" authzid="ldap_user@mydomain,dc=com" ==>slap_sasl_authorized: can uid=ldap_user,ou=users,ou=mydomain,dc=com,dc=test,dc=mydomain,dc=com become <INPUT_PASSWORD>? ^^^^^^^^^^^^^^^^^^^^ <== slap_sasl_authorized: return 48 SASL Proxy Authorize [conn=1003]: proxy authorization disallowed (48) SASL [conn=1003] Failure: not authorized send_ldap_result: conn=1003 op=1 p=3 send_ldap_result: err=50 matched="" text="SASL(-14): authorization failure: not authorized" send_ldap_response: msgid=2 tag=97 err=50

2 7

Error: CSN too old and replication fails
by Jérémy Wagner 17 Feb '11

17 Feb '11

Hello, I'm facing some issues with syncrepl... The simplest situation in which I was able to reproduce the problem consists of 1 provider and 1 consumer. I have configured syncrepl to do a partial replication : olcSyncrepl: {0}rid=105 provider=ldaps://****:636 bindmethod=simple timeout=0 network-timeout=0 starttls=no filter="(mail=*)" searchbase="ou=groups,o=mydir" scope=sub schemachecking=off attrs="cn description mail member +" type=refreshAndPersist retry="60 +" tls_cert=**** tls_cacert=**** tls_key=**** olcSyncrepl: {1}rid=107 provider=ldaps://****:636 bindmethod=simple timeout=0 network-timeout=0 starttls=no filter="(objectclass=*)" searchbase="ou=operators,o=mydir" scope=sub schemachecking=off type=refreshAndPersist retry="60 +" tls_cert=**** tls_cacert=**** tls_key=**** olcSyncrepl: {2}rid=104 provider=ldaps://****:636 bindmethod=simple timeout=0 network-timeout=0 starttls=no filter="(uid=mytestuser)" searchbase="ou=people,o=mydir" scope=sub schemachecking=off type=refreshAndPersist retry="60 +" tls_cert=**** tls_cacert=**** tls_key=**** The initial sync (i.e. from an empty base) is fine, but then when I modify an entry (uid=mytestuser), it is not updated on the consumer, and I get the following messages: Feb 16 15:42:32 do_syncrep2: rid=107 NEW_COOKIE: rid=107,csn=20110216144232.222152Z#000000#000#000000 Feb 16 15:42:32 do_syncrep2: rid=104 cookie=rid=104,csn=20110216144232.222152Z#000000#000#000000 Feb 16 15:42:32 slap_graduate_commit_csn: removing 0x7fb58c0227d0 20110216144232.222152Z#000000#000#000000 Feb 16 15:42:32 do_syncrep2: rid=104 CSN too old, ignoring 20110216144232.222152Z#000000#000#000000 Feb 16 15:43:05 do_syncrep2: rid=105 LDAP_RES_INTERMEDIATE - NEW_COOKIE Feb 16 15:43:05 do_syncrep2: rid=105 NEW_COOKIE: rid=105,csn=20110216144305.545784Z#000000#000#000000 Feb 16 15:43:05 slap_queue_csn: queing 0x7fb58c020b50 20110216144305.545784Z#000000#000#000000 Feb 16 15:43:05 do_syncrep2: rid=107 LDAP_RES_INTERMEDIATE - NEW_COOKIE Feb 16 15:43:05 do_syncrep2: rid=107 NEW_COOKIE: rid=107,csn=20110216144305.545784Z#000000#000#000000 Feb 16 15:43:05 do_syncrep2: rid=104 cookie=rid=104,csn=20110216144305.545784Z#000000#000#000000 Feb 16 15:43:05 slap_graduate_commit_csn: removing 0x7fb58c0227d0 20110216144305.545784Z#000000#000#000000 Feb 16 15:43:05 do_syncrep2: rid=104 CSN too old, ignoring 20110216144305.545784Z#000000#000#000000 (both servers are perfectly in sync with an NTP daemon) It looks like ITS #6619 is quite similar, and unresolved. What do these messages mean ? Is there a way to force the update ? Regards, Jeremy W.

3 6

ACL Issues
by Troy Knabe 17 Feb '11

17 Feb '11

I am attempting to be very granular in the access that I give to my directory, but I seem to be struggling with the implementation. I have several proxy accounts that I want to grant the access to that they need, no more, no less. But I seem to have to put a line in like: access to dn.children="dc=company,dc=com" by * read in order to authenticate. What I thought I wanted was something like this: access to attrs=userPassword by dn.exact=proxy,dc=company,dc=com write by self write by anonymous auth But without read access above, it does not work. How can I allow proxy users/groups access w/out granting read access to everyone? Or does the dn.children allow read access to all attributes?

3 5

Queries regarding pam_groupdn.
by Meghanand Acharekar 17 Feb '11

17 Feb '11

Hi, I'm using pam_groupdn for restricting access to some for my servers, by defining user groups as follows. /etc/ldap.conf (Redhat 5.5) # Group to enforce membership of pam_groupdn cn=group1,ou=Group,dc=example,dc=com # Group member attribute pam_member_attribute memberUid This works only if the pam_member_attribute is in following format. memberUid: uid=user1,ou=People,dc=example,dc=com memberUid: uid=user2,ou=People,dc=example,dc=com Simply memberUid: user1 is not working, is there any way to fix this. Second, if a user which dose not belong to this group tries to login server, access is denied by displaying following message. You must be a memberUid of cn=group1,ou=Group,dc=example,dc=com to login. Connection closed by x.x.x.x Is it possible to change this message ? Thanks & Regards, Meghanand N. Acharekar

2 2

Aliasing entries with reserved characters
by MJ Hughes 17 Feb '11

17 Feb '11

Hi, I'm an LDAP newbie who has inherited the maintenance of an LDAP system, and am learning on the fly. Until now I've been able to puzzle out all the issues I've faced, but finally my google fu has failed me, so I'm seeking more human assistance. My problem is with reserved characters, such as , (comma). The system wasn't coping with RDNs that contained these characters, but this was easy enough to fix by simply escaping these characters with a backslash. My problem now involves trying to alias entries that contain these escaped characters - I am consistently getting "Invalid DN syntax". This is what the code to add the alias looks like: $operationDN = "aliasedObjectName=" . $this->aliasSafe($aliasDN) . "," . $locDN; $aliasParameterArray = array( "objectClass" => "alias", "aliasedObjectName" => $aliasDN ); $result = ldap_add($this->LDAPcon, $operationDN, $aliasParameterArray); The aliasSafe() function converts "=" => "\3D" and "," => "\," (unless the commas have already been escaped). This produces DNs that have the following (hypothetical) format: $aliasDN: cn=Tomorrow\, When The War Began,cn=books,dc=library,dc=com $operationDN: cn\3DTomorrow\, When The War Began\,cn\3Dbooks\,dc\3Dlibrary\,dc\3Dcom,cn=titles,cn=John Marsden,cn=authors,dc=library,dc=com I've tried every encoding of the comma (in the book name) that I can think of (eg, a single backslash, a double backslash, a triple backslash, and even '\2C') but everything I've tried so far has given me the "Invalid DN syntax" error. Could someone please help me with the syntax and encoding these DNs should have? Thanks, MJ

4 9

Conflict resolution on Syncrepl
by Diego Lima 17 Feb '11

17 Feb '11

Hello all, This is mostly a theoretical question. I currently have some OpenLDAP multimaster clusters (using syncrepl and mirrormode) and although it never happened before, what would happen if two (or more) masters received a write request exactly at the same time? The entry would have the same entryCSN on both servers and the contextCSN would be updated at the same time? Would this lead to a situation where the servers were actually out of sync but they would "think" they had the same entries? -- Diego Lima http://www.diegolima.org

3 4

seeking guidance with back-shell setup
by Elle Y Suzuki 17 Feb '11

17 Feb '11

hello, my thunderbird does not appear to be using back-shell's searchexample.sh..? i have compiled openldap on a desktop windows xp machine with the back-shell backend enabled without threads. slapd.conf is configured as suggested in the file searchexample.conf at http://tinyurl.com/47t9ets. i have added the file searchexample.sh from http://tinyurl.com/4823rtf in the appropriate directory. i start up slapd, /usr/local/libexec/slapd -d 256 -h ldap://localhost and it appears to fire up: $ /usr/local/libexec/slapd -d 256 -h ldap://localhost @(#) $OpenLDAP: slapd 2.4.24 (Feb 14 2011 09:29:58) . . . WARNING: No dynamic config support for database shell. slapd starting i configured thunderbird with a localhost ldap directory server (localhost, port 389), leaving 'base dn' and 'bind dn' blank. in attempting to test this searchexample.sh script, i open a new message and type an entry that i know appears in the /etc/passwd file. i see output in my cygwin window that is running slapd with lines including "BIND", "SRCH", "SEARCH RESULT", etc., but the tbird compose message window's "To:" field shows a "<LDAP server search problem>" which i click on and produces a pop-up with "Error code 32: No such object Verify that the Base DN is correct, and then try again, or else contact your System Administrator. To verify that the Base DN is correct, from the Edit menu, choose Preferences, then choose Mail & Newsgroups, and then choose Addressing. Click Edit Directories, and select the LDAP server being used. Click Edit to display the Base DN." however, if i were to include 'base dn' info in tbird, slapd output reports a 'fatal error' with a stack trace. meanwhile, the slapd output is as follows: conn=1002 op=3 SRCH base="" scope=2 deref=0 filter="(|(cn=suzuki*)(mail=suzuki*) (sn=suzuki*))" conn=1002 op=3 SRCH attr=cn mail conn=1002 op=3 SEARCH RESULT tag=101 err=32 nentries=0 text= several questions arise: 1. should 'base dn' and/or 'bind dn' in tbird remain blank for localhost ldap? 2. aside from what is noted in searchexample.conf above, are any of the other lines necessary in slapd.conf (rootdn, index, directory -- slapd complains if directory is made available, despite the referenced file existing). 3. what else can i do to get tbird to make use of the searchexample.sh file and report as such in the slapd output? 4. in running slapd, i see the message, "WARNING: No dynamic config support for database shell" From this (similar) thread, http://tinyurl.com/457tra6 do i understand correctly that i should still be able to utilize a shell backend, then? my current goal is the following: get slapd to run with a shell backend and thunderbird on my local desktop. our team's overall goal is to enable this setup on a linux server: we'd like to eliminate our ldap server and utilize this slapd+back-shell mechanism to access our oracle db for our ldap clients. once we are able to get this all working with back-shell, we'd like to replace the shell role with php scripts. any guidance on this task in general is greatly appreciated. my apologies in advance for any silly questions: i am new to playing with (open)ldap, and have been staring at this problem for much too long. thank you in advance.

2 2

ldap design
by Hendrik van der Ploeg 17 Feb '11

17 Feb '11

Hello People, I'm in doubt what design I need to use for openldap This is the situation; We have 1200+ customers using LDAP. We want to replicate all these ldap server to 1 big ldapserver in a datacentre with a multi-master config. So all the customers are a master-ldap who replicate to the datacentre. My idea was to build in the datacentre a ldapcluster of about 4 server My question is: Will this be stable, because there will be 1200+ ldapservers replicating to 4 ldapserver in the datacentre. I know this depends on the number of write actions at the customers. All I can say is that write actions at the customers isn't THAT much. I really hope somebody can give me an answer or maybe there's somebody else with the same config Best Regards -- Hendrik van der Ploeg

4 3

ldap not respoding
by Prathyush 16 Feb '11

16 Feb '11

HI, Will huge size of slapd.log cause slapd service to hang -- *Regards, Prathyush*

1 0

search LDAP back-sql entry with two objectclasses (structural and auxiliary)
by Andreas Härtel 16 Feb '11

16 Feb '11

Hello, I am running a LDAP server on a debian system with a mySQL database as backend. slapd-version: $OpenLDAP: slapd 2.4.11 (Jul 24 2010 08:14:20) $@murphy:/build/buildd-openldap_2.4.11-1+lenny2-i386-H5BDjb/openldap-2.4.11/debian/build/servers/slapd mysql-version: mysql Ver 14.12 Distrib 5.0.51a, for debian-linux-gnu (i486) using readline 5.2 Everything is running fine if I am searching the LDAP tree for data containing only one objectClass (inetOrgPerson). Now I have add a second auxiliary objectClass (mozillaAbPersonAlpha) to my data via ldap_entry_objclasses table in the mySQL database, but a search only results in the three inetOrgPerson fields I have set: ldapsearch -LLL -s sub -b 'ou=contacts,ou=contacts,dc=...' 'objectclass=*' -D 'cn=USER' -w unsafe-password -x dn: ou=contacts,ou=contacts,dc=... objectClass: organizationalUnit objectClass: inetOrgPerson objectClass: mozillaAbPersonAlpha ou: contacts dn: cn=Name Firstname,ou=contacts,ou=contacts,dc=... objectClass: inetOrgPerson cn: Name Firstname sn: Name givenName: Firstname If I switch the dependency in the ldap_entries table from inetOrgPerson to the mozilla scheme, I get the mozilla fields but - e.g. in phpldapadmin - I can not see any data (also in my thunderbird addressbook). My opinion: mozilla scheme is not structural. Perhaps this old mailing-list entry gives an answer but - for me myself - no solution: http://www.openldap.org/lists/openldap-software/200403/msg00303.html Hope, someone has any idea about this problem ... !? Tanks a lot, Andreas My /etc/ldap/slapd.conf file (parts of it): ################################################################# include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/extension.schema include /etc/ldap/schema/mozillaAbPersonAlpha.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel 256 modulepath /usr/lib/ldap moduleload back_hdb moduleload back_sql sizelimit 500 tool-threads 1 backend hdb backend sql database sql suffix "ou=contacts,ou=contacts,dc=... dbname contacts dbhost localhost dbuser myuser dbpasswd mypassword lastmod off has_ldapinfo_dn_ru no upper_func "upper" access to dn.subtree="ou=contacts,ou=contacts,dc=... by dn="cn=admin,dc=..." peername.ip=127.0.0.1 write by dn="cn=user" read by * none ################################################################# I thought about ataching my database entries but this could be too long. If there should be questions about it, please let me know.

1 1

Re: ldap auth does not works after openldap upgrade
by Andrew Findlay 15 Feb '11

15 Feb '11

On Tue, Feb 15, 2011 at 02:13:40PM -0200, Leonardo Carneiro wrote: > To: Andrew Findlay <andrew.findlay(a)skills-1st.co.uk> Please keep replies on the list so that other people can benefit from the discussion in future. > > Aha! How many entries did that search return? Was is about the same > > number that you would expect given your users and groups? > yep. they are all there. > > Did you previously have the LDAP server set up to refuse data to > > anonymous users? > No, it could bind as anonymous and read any data. In that case leave the database alone: the problem is in the configuration. Please post the slapd config. We need to see all of it except for any passwords. Andrew -- ----------------------------------------------------------------------- | From Andrew Findlay, Skills 1st Ltd | | Consultant in large-scale systems, networks, and directory services | | http://www.skills-1st.co.uk/ +44 1628 782565 | -----------------------------------------------------------------------

2 3

Autogroup strange behaviour
by Luca Scamoni 15 Feb '11

15 Feb '11

Hi, I'm using autogroup overlay (OpenLDAP 2.4.23, autogroup v. 1.2.2.11 but the behaviour was the same with 1.2.2.6) and I'm facing a strange situation. Operations performed using openldap client tools work as expected. The same operations performed using a java client do not. I've restricted the problematic operations to modifications of existing entries. Using attached slapd.conf and ldap.ldif it's quite simple to reproduce it. Using openldap ldapmodify client: cn=user2,ou=people,dc=example,dc=com add: description description: test modifies the entry AND triggers autogroup modify operation on group cn=description adding user2 as a member of the group (see slapd.log.ok.add) The same operation performed with JExplorer modifies the entry but does NOT triggers autogroup modification (see slapd.log.java.add) I've compared the two logs and overlay related modifications are completely skipped in the java client test. Anyone has an explanation? Note: adding a new entry or deleting an existing one (if it matches any of the criteria in memberUrl) works even with Jexplorer. thanks -- /Luca Scamoni / *Gruppo Partners Associates* Tel. Milano +39 02 67380435**- Udine +39 0432 689815 - Roma +39 06 54832300 Fax Milano +39 02 67386214 - Udine +39 0432 570120 - Roma +39 06 91659273 Cell. +39 348 0471710 Email: Luca.Scamoni(a)GruppoPA.it <mailto:Luca.Scamoni@GruppoPA.it> Sito: _www.GruppoPA.it_ <http://www.GruppoPA.it> Prima di stampare, pensa all'ambiente ** Think about the environment before printing

2 2

slapd.conf for proxy to AD
by Del 15 Feb '11

15 Feb '11

Hi, Like a lot of people I guess, I'm having trouble configuring slapd to work as a proxy server in front of Microsoft's Active Directory. AD in this case is configured to refuse to allow anonymous searches but I want to allow anonymous searches on the proxy. Therefore the configuration I'm hoping for is: * Anonymous binds to slapd get translated into an authenticated bind to AD. * Authenticated binds to slapd have their credentials (DN and password) passed through to AD. Here's what I have so far, based on the documentation. I'm using slapd.conf rather than the new conf.d directory based config, and I'm currently running openldap 2.4.19: -- database ldap chase-referrals no suffix "MY-AD-SUFFIX-HERE" uri "ldaps://MY-AD-SERVER-HERE/" cancel abandon acl-bind bindmethod=simple binddn="VALID-BIND-DN" credentials="VALID-PASSWORD" idassert-bind bindmethod=simple binddn="VALID-BIND-DN credentials="VALID-PASSWORD" mode=legacy flags=non-prescriptive idassert-authzFrom "dn.regex:.*" access to * by * read -- You can assume I've used valid bind DNs, suffixes, server names and passwords in the places where I've resorted to capitals above. I've tested these binds from the command line directly against the AD server and they all work. I have tested the above on OpenLDAP 2.3, it works for anonymous binds if and only if a successful authenticated bind is done first. The same was reported in this post: http://www.openldap.org/lists/openldap-technical/200907/msg00043.html In OpenLDAP 2.4 it fails to recognise the idassert-bind completely, all attempts at anonymous bind seem to fail. A similar problem was reported while upgrading to 2.3.11 to 2.3.27, here: http://www.openldap.org/lists/openldap-software/200701/msg00055.html Am I using the correct configuration directives to achieve what I want, and if not what should I be using? Thanx, -- Del

6 6

ldap auth does not works after openldap upgrade
by Leonardo Carneiro 15 Feb '11

15 Feb '11

Hello everyone, I upgraded my debian machine from lenny to squeeze (the new stable) that comes with samba 3.5.6 and openldap 2.4.23. this machines works primarily as a PDC. i have 3 services authenticating on ldap: samba, apache and redmine. samba is acting very weird, but it's kinda working, but redmine and apache aren't working at all. these services do bind to the server, but it cannot find the users. also, i cannot execute ldapsearchs via CLI. plus, in the bash, when i try to change to some user other than root (eg: lscarneiro), the system does not recognize the user: fileserver:~# su - lscarneiro I have no name!@fileserver:~$ whoami whoami: cannot find name for user ID 1130 i'm very VERY noob on ldap and don't know exactly what kind of info i should give to you guys to get some help. any help is very welcome

3 7

big company with different affiliates, how to integrate?
by Pieter Baele 15 Feb '11

15 Feb '11

How would you integrate several companies with one mother company? (where our Linux team and IT is part of) We need to implement different OpenLDAP servers because of policies...yeaha... ;-) But I'm not sure how to do this. My opinion: Each company needs his own pair of multi-master LDAP servers. (for HA) Each LDAP server pair belongs to one of the affiliates and there has to be a 'chinese wall' between those (if possible) Off course it should not be possible for employees from company A to authenticate through the LDAP server of company B. Except for esx, kvm and other virtualization hosts each server belongs also to only 1 of these subcompanies. But for me and other admins it should be possible to access and manage all servers using the same password and tooling (like puppet with LDAP...) My idea was some combination of chaining, proxy... (or other overlays). We could use the LDAP server of the mother company as the last part of some chain. The DIT / right structure is also still an issue for me (I'm not an LDAP expert) Other nice to haves are some AD integration and kerberos, but this has nothing to do with my question :-) -- Sincerely, Pieter Baele www.pieterb.be

2 1

How to use LDAP_OPT_CONNECT_ASYNC?
by Ian Puleston 14 Feb '11

14 Feb '11

Hi, I'm trying to use the new LDAP_OPT_CONNECT_ASYNC with OpenLDAP 2.4.23 client and I can't see how it can be done. After creating the connection structure via ldap_initialize() I then call ldap_sasl_bind() to do the bind. That calls down to ldap_new_connection() (ldap_sasl_bind -> ldap_send_initial_request -> ldap_open_defconn -> ldap_new_connection) and that implements the asynchronous connect, setting the lconn_status to LDAP_CONNST_CONNECTING and not calling ldap_int_poll() in ldap_pvt_connect(). So far so good. But ldap_send_initial_request() then gets a good return code from ldap_open_defconn(), and so it goes on to call ldap_send_server_request() to send the bind, and that then calls ldap_int_poll() which waits for the connect to complete, making the whole operation synchronous. It seems to me that for this to work asynchronously, either: 1. ldap_send_initial_request() should check for lconn_status to LDAP_CONNST_CONNECTING on return from ldap_open_defconn(), and if it is then return, probably with error LDAP_X_CONNECTING. It should then be possible to re-call ldap_sasl_bind() when the connect has completed. 2. Establish the connection via ldap_new_connection() before calling ldap_sasl_bind(). But the functions to do that don't appear to be available on the API. ldap_open() could have probably done it, but it is now deprecated. So this would appear to require a new API function that would simply call ldap_open_defconn() and return LDAP_X_CONNECTING. Or is there some other way to achieve this? Ian

3 8

ACL peername
by Natalia 14 Feb '11

14 Feb '11

Hi, i have a problem with ACLs. I will to grant access to IP. my ACL: olcAccess: to dn.subtree="ou=people,dc=example,dc=de" by group.exact="cn=lda,ou=Endsysteme,dc=example,dc=de" write by group.exact="cn=kon,ou=Endsysteme,dc=example,dc=de" read by peername.ip=127.0.0.1 read by * none But i become error: ldap_modify: Other (e.g., implementation specific) error (80) additional info: <olcAccess> handler exited with 1 in logs: conn=1034 op=4 MOD attr=olcAccess olcAccess Feb 11 13:33:07 ldap slapd2.4[21279]: slapd: line 0: expecting <access> got "writeby". Feb 11 13:33:07 ldap slapd2.4[21279]: <access clause> ::= access to <what> [ by <who> [ <access> ] [ <control> ] ]+ <what> ::= * | dn[.<dnstyle>=<DN>] [filter=<filter>] [attrs=<attrspec>] <attrspec> ::= <attrname> [val[/<matchingRule>][.<attrstyle>]=<value>] | <attrlist> <attrlist> ::= <attr> [ , <attrlist> ] <attr> ::= <attrname> | @<objectClass> | !<objectClass> | entry | children <who> ::= [ * | anonymous | users | self | dn[.<dnstyle>]=<DN> ] [ realanonymous | realusers | realself | realdn[.<dnstyle>]=<DN> ] [dnattr=<attrname>] [realdnattr=<attrname>] [group[/<objectclass>[/<attrname>]][.<style>]=<group>] [peername[.<peernamestyle>]=<peer>] [sockname[.<style>]=<name>] [domain[.<domainstyle>]=<domain>] [sockurl[.<style>]=<url>] [dynacl/<name>[/<options>][.<dynstyle>][=<pattern>]] [ssf=<n>] [transport_ssf=<n>] [tls_ssf=<n>] [sasl_ssf=<n>] <style> ::= exact | regex | base(Object) <dnstyle> ::= base(Object) | one(level) | sub(tree) | children | exact | regex <attrstyle> ::= exact | regex | base(Obj Feb 11 13:33:07 ldap slapd2.4[21279]: conn=1034 op=4 RESULT tag=103 err=80 text=<olcAccess> handler exited with 1 I have OpenLDAP 2.4.22. If i remove "by peername.ip=127.0.0.1 read" it works. Thanks for help! Kind regards Natalia

2 2

question about cn=config replication and security.
by Mailing Lists 13 Feb '11

13 Feb '11

Hello. I'm running a pair of openldap 2.4 servers which replicate cn=config DB in mirror mode. Is there a way to configure a RO user (like user from BDB) for cn=config DB, so should someone get a hold of it's password, and still will not be able to change the configs ? Regards.

3 2

Mac OS X OpenLDAP allows anonymous access to all fields
by RAT 11 Feb '11

11 Feb '11

The ongoing saga... While trying to add the ACL for to hide userPassword, we get the following error: ldap_modify: Insufficient access (50) I'm beginning to think Apple has this locked down... Robert Threet http://yesistilluseperl.blogspot.com/ ____________________________________________________________ Obama Urges Homeowners to Refinance If you owe under $729k you probably qualify for Obama's Refi Program http://thirdpartyoffers.netzero.net/TGL3231/4d559f3cb35e427677est06duc

2 1

port level security for auth and anon
by Christopher Louis Jackson 11 Feb '11

11 Feb '11

I am looking for help with setup of security with my openldap config. I currently have RHEL 6 with ldap:// and ldaps:// working for both auth binds and anon binds. What I want to do is allow anon binds on ldap:// and require authentication over an encrypted stream on ldaps:// my current access is set to: access to attrs=userPassword by anonymous auth by self read by * none access to * by * read I do not have a security statement in my slapd.conf. I have tried a few things such as changing the userpassword access to: access to userPassword > by anonymous auth sasl_ssf=128 break > by anonymous auth tls=128 > by self read but the syntax is not correct and the config will not load with above. Any help would be great. Chris Jackson

2 1

slapd security based on port
by Chris Jackson 11 Feb '11

11 Feb '11

Is it possible to prevent anonymous and unauthenticated binds to ldaps:// 636 but allow them on ldap:// 389? I want to allow staff to query my ldaps:// outside of my network while requiring them to login to do so but allow anyone to bind (anonymous, unauthenticated, or authenticated) internally on ldaps//: 389. I know: Anonymous bind can be disabled by "disallow bind_anon" and Unauthenticated bind mechanism is disabled by default. But if I use "disallow bind_anon it stops in on both ports. I want to stop it just on ldaps://. Chris Jackson ____________________________________________________________________________________ We won't tell. Get more on shows you hate to love (and love to hate): Yahoo! TV's Guilty Pleasures list. http://tv.yahoo.com/collections/265

1 0

Login with email ?
by Jarek 10 Feb '11

10 Feb '11

Hello! Is it possible to use email to login to LDAP ? I'm working on mail management panel where users are identified by emails. Now I'm searching tree for DN of particular email and then I'm logging with DN and password, but I'd like to avoid this search if possible... best regards JT.

2 1

stopping anonymous access to userPassword
by RAT 10 Feb '11

10 Feb '11

I'm unaccustomed to the new (non-slapd.conf) way of adding ACL/ACI's. I'm trying exclude anonymous access to the password. We've tried this to no affect: olcAccess: to dn.base="cn=users,dc=lib-mac,dc=local" by * read olcAccess: to dn.base="cn=Subschema" by * read olcAccess: to attrs=userPassword by self write by dn.exact="uid=diradmin,cn=users,dc=lib-mac,dc=local" read by * auth olcAccess: to dn.subtree="" by dn.exact="uid=diradmin,cn=users,dc=lib-mac,dc=local" write by users read by anonymous auth Robert Threet http://yesistilluseperl.blogspot.com/ ____________________________________________________________ $65/Hr Job - 25 Openings Part-Time job ($20-$65/hr). Requirements: Home Internet Access http://thirdpartyoffers.netzero.net/TGL3231/4d540f18d12d722e5best03duc

2 1

slapo-lastbind: warning in doing slapcat
by Marco Pizzoli 10 Feb '11

10 Feb '11

Hi list, I'm using overlay slapo-lastbind using openldap head. I receive a warning when invoking slapcat to do a full backup of my user database. This is the output of my job: [ldap@ldap03 tmp]$ /usr/local/openldap/sbin/slapcat -b "dc=lan,dc=mycorp.it" -l dump_db_user.ldif UNKNOWN attributeDescription "AUTHTIMESTAMP" inserted. The backup seems done correctly. This warning could be due to an error of mine? If not, being this a contrib overlay, should I file an ITS anyway? Thanks Marco -- _________________________________________ Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi. Jim Morrison

1 0

The correct way of updating a schema
by E.S. Rosenberg 09 Feb '11

09 Feb '11

A package I use recently updated the schema files related to the package, what is the correct way to go about replacing the schemas that were already loaded into cn=schema? My bruteforce solution was most likely not the correct way. Thanks and best regards, Eli

1 0

DB_CONFIG - Auto remove logs
by ldap＠mm.st 09 Feb '11

09 Feb '11

This may have been discussed, but i can not seem to find out why the transaction logs are not getting removed when I use DB_LOG_AUTOREMOVE in DB_CONFIG. This is on a Redhat 5 openldap 2.3 server. DB_CONFIG has the following: set_lg_dir /var/lib/ldap/bdblogs set_flags DB_LOG_AUTOREMOVE Doing slapd_db_archive shows about 134 unused files. I then did the following (is this the correct procedure to use when updating DB_CONFIG?): > serivice ldap stop > Edited DB_CONFIG > slapd_db_recover > slapd_db_archive > service ldap start The files are still there. I also manually did a checkpoint with "slapd_db_checkpoint -1" and verified the transaction log time changed. Reran "slapd_db_archive" and it outputs the same files. I read that earlier versions required a patch for this to work, but I was not sure about this one. I'm unclear on when the removal is suppose to take place, but it doesn't seem to be working.

2 2

tls_checkpeer directive
by Michael Starling 09 Feb '11

09 Feb '11

I'm running openldap-2.3.43-12.el5 on a RHEL 5.5 system: I believe I have TLS encryption working but I'd like to be able to verify my client connections. On my LDAP server I have the following in slapd.conf TLSCipherSuite HIGH:MEDIUM:+TLSv1:!SSLv2:+SSLv3 TLSCertificateFile /etc/openldap/cacerts/slapdcert.pem TLSCertificateKeyFile /etc/openldap/cacerts/slapdkey.pem TLSCACertificateFile /etc/openldap/cacerts/slapdcert.pem On the client I have the following in /etc/ldap.conf uri ldaps://10.70.5.67/ ssl on tls_cacertfile /etc/openldap/cacerts/slapdcert.pem tls_checkpeer no On the client /etc/openldap/ldap.conf URI ldaps://10.70.5.67/ TLS_CACERT /etc/openldap/cacerts/slapdcert.pem TLS_REQCERT demand These commands work both from the client and server. openssl s_client -connect servername:636 -showcerts ldapsearch -x -H ldaps://servername -b dc=domain,dc=domain -D cn=root,dc=domain,dc=domain -W So my first question would be does this guarantee encrypted sessions? Second, if I change tls_checkpeer to yes then I can't contact the LDAP server. How can I verify my clients? -Mike

2 1

Handling slapd.d in OpenLDAP and Kerberos
by sarathkrishna89＠gmail.com 08 Feb '11

08 Feb '11

Hi, We are currently trying to use OpenLDAP as the database for Kerberos in our lab. We installed OpenLDAP in Ubuntu 10.04 and is working without any problem (i,e. queries are showing the correct results) But we are not able to get Kerberos authenticate via OpenLDAP. For authenticating via OpenLDAP, the principles needs to be rewritten (using authz-policy and authz-regexp). We know how to do that in older version of OpenLDAP which had (slapd.conf) but don't know how to do the same in new OpenLDAP which has slapd.d directory instead. The manuals also doesn't say anything on this issue. We did the following for testing authentication via Kerberos: kinit username; ldapsearch -H ldaps://server.example.com And we got this result: SASL/DIGEST-MD5 authentication started Please enter your password: ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: SASL(-13): user not found: no secret in database We just want to perform this: authz-policy from authz-regexp uid=(.*),cn=example.com,cn=GSSAPI,cn=auth uid=$1,ou=people,dc=example,dc=com We think adding this in slapd.conf should serve the purpose. Any suggestions/help is highly appreciated. -- Sarath

5 5

Multimaster replication of cn=config working too well?!
by Mark Cairney 08 Feb '11

08 Feb '11

Hi, Has anyone experienced problems with the cn=config directory syncing the same change across all nodes and breaking the configuration? In the past I've had problems where the syncrepl parameters are synced across all nodes, including that node itself, which results in the servers then trying to sync with themselves. The most recent problem however was that the olcSaslHost value was synced to be one particular server on all 3 nodes. As I was using GSSAPI to do the replication this broke it completely and it meant that I could only bind via GSSAPI to one of the 3 servers. In the meantime I've set the servers not to syncrepl cn=config but this isn't ideal. Anyone else on the list had similar problems? Kind regards, Mark /********************************* Mark Cairney ITI UNIX Section Information Services University of Edinburgh Tel: 0131 650 6565 Email: mark.cairney(a)ed.ac.uk *********************************/ -- The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336.

2 1

slapd.d syntax help for ldap proxy server
by Anton Chu 08 Feb '11

08 Feb '11

I'm trying to setup a ldap proxy server for push based replication. I'm in need of help with providing the correct syntax on installing a ldap proxy using slapd.d instead of slapd.conf. The items in bold are the questionable syntax that can crossover to slapd.d. Here's my slapd.d configuration: Standalone LDAP Proxy: > > # load the schemas > ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/cosine.ldif > > ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/inetorgperson.ldif > > ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/nis.ldif > > ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/misc.ldif > > ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/ldapns.ldif > > ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/openldap.ldif > > > # Load dynamic backend modules > > dn: cn=module,cn=config > > objectClass: olcModuleList > > cn: module > > olcModulepath: /usr/lib/ldap > > olcModuleload: back_hdb > > olcModuleload: syncprov > > > # Database settings > > dn: olcDatabase=hdb,cn=config > > objectClass: olcDatabaseConfig > > objectClass: olcHdbConfig > > olcDatabase: {1}hdb > > *olcHidden: TRUE* > > olcSuffix: dc=suretecsystems,dc=com > > olcDbDirectory: /var/lib/ldap > > olcRootDN: cn=admin,dc=suretecsystems,dc=com > > olcRootPW: secret > > *olcUri: ldap://localhost:9012/* > > > > # We don't need any access to this DSA > > *olcRestrict: ALL > > olcAcl-bind: bindmethod=simple > binddn="cn=replicator,dc=suretecsystems,dc=com" > credentials=testing* > > olcSyncrepl: rid=001 > provider=ldap://localhost:9011/ > binddn="cn=replicator,dc=suretecsystems,dc=com" > bindmethod=simple > credentials=testing > searchbase="dc=suretecsystems,dc=com" > type=refreshAndPersist > retry="5 5 300 5" > > Here's the slapd.conf provided at the site that I'm trying to convert: http://www.openldap.org/doc/admin24/replication.html The following configuration is an example of a standalone LDAP Proxy: > > include /usr/local/etc/openldap/schema/core.schema > include /usr/local/etc/openldap/schema/cosine.schema > include /usr/local/etc/openldap/schema/nis.schema > include /usr/local/etc/openldap/schema/inetorgperson.schema > > include /usr/local/etc/openldap/slapd.acl > > modulepath /usr/local/libexec/openldap > moduleload syncprov.la > moduleload back_ldap.la > > ############################################################################## > # Consumer Proxy that pulls in data via Syncrepl and pushes out via slapd-ldap > ############################################################################## > > database ldap > # ignore conflicts with other databases, as we need to push out to same suffix > hidden on > suffix "dc=suretecsystems,dc=com" > rootdn "cn=slapd-ldap" > uri ldap://localhost:9012/ > > lastmod on > > # We don't need any access to this DSA > restrict all > > acl-bind bindmethod=simple > binddn="cn=replicator,dc=suretecsystems,dc=com" > credentials=testing > > syncrepl rid=001 > provider=ldap://localhost:9011/ > binddn="cn=replicator,dc=suretecsystems,dc=com" > bindmethod=simple > credentials=testing > searchbase="dc=suretecsystems,dc=com" > type=refreshAndPersist > retry="5 5 300 5" > > overlay syncprov > >

4 4

Re: slapo-lastbind
by Marco Pizzoli 08 Feb '11

08 Feb '11

On 7 Feb 2011 22:31, "Marco Pizzoli" <marco.pizzoli(a)gmail.com> wrote: > Hi Jonathan, > I understand the "locality" of the attribute, but my question is motivated > by the ppolicy_forward_updates directive that addresses this identical > problem. > Do you think it would be possible to have a similar feature with this > overlay? > > Thanks > Marco > On 7 Feb 2011 20:49, "Jonathan CLARKE" <jonathan.clarke(a)normation.com> > wrote:

3 2

slapo-lastbind
by Marco Pizzoli 07 Feb '11

07 Feb '11

Hi all, I used effectively the new slapo-lastbind overlay. I noticed that my authTimestamp attribute become populated for each user who successfully does a bind, but on my multi-master deploy I cannot have that attribute shared/replicated on all servers Any suggestions? Thanks Marco -- _________________________________________ Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi. Jim Morrison

2 1

Compile contrib modules?
by Marco Pizzoli 07 Feb '11

07 Feb '11

Hi list, Today I downloaded the HEAD repository and tried to compile also the contrib module "lastbind". With the configure script I'm not able to have that module built in. I have to do something particular? Thanks Marco -- _________________________________________ Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi. Jim Morrison

3 3

Search with filter doesn't return any results?
by Markku Tavasti 07 Feb '11

07 Feb '11

Hi! I have strange problem: I have newly built ldap database. System is running on Centos 5.5 (same as RHEL 5) # slapd -V @(#) $OpenLDAP: slapd 2.3.43 (Nov 29 2010 03:44:41) $ mockbuild@builder10.centos.org:/builddir/build/BUILD/openldap-2.3.43/openldap-2.3.43/build-servers/servers/slapd I have configured syncrepl from ldap1 to ldap2. Both systems have same slapd.conf execpt on ldap1 syncprov overlay, ldap2 syncrepl consumer. To both servers ldapsearch without additional filters works fine, and returns content of database. However, to ldap1 (synrepl master) applying any search filter gives no results. Only filters I have noticed working are objectClass-filters. For example like this: --------- shell commands & output start --------- [root@srv]# ldapsearch -x -h ldap1 -b "dc=hq,dc=mydomain,dc=com" ... actual search results removed ..... # search result search: 2 result: 0 Success # numResponses: 33 # numEntries: 32 [root@srv]# ldapsearch -x -h ldap1 -b "dc=hq,dc=mydomain,dc=com" | grep tavasti memberUid: tavasti memberUid: tavasti memberUid: tavasti # tavasti, Users, hq.mydomain.com dn: uid=tavasti,ou=Users,dc=hq,dc=mydomain,dc=com uid: tavasti homeDirectory: /home/ldap/tavasti [root@srv]# ldapsearch -x -h ldap1 -b "dc=hq,dc=mydomain,dc=com" uid=tavasti # extended LDIF # # LDAPv3 # base <dc=hq,dc=mydomain,dc=com> with scope subtree # filter: uid=tavasti # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 --------- shell commands & output end --------- On log I get with the last one: Feb 4 18:29:54 ldap1 slapd[8611]: conn=30 fd=15 ACCEPT from IP=10.x.x.x:347 25 (IP=0.0.0.0:389) Feb 4 18:29:54 ldap1 slapd[8611]: conn=30 op=0 BIND dn="" method=128 Feb 4 18:29:54 ldap1 slapd[8611]: conn=30 op=0 RESULT tag=97 err=0 text= Feb 4 18:29:54 ldap1 slapd[8611]: begin get_filter Feb 4 18:29:54 ldap1 slapd[8611]: EQUALITY Feb 4 18:29:54 ldap1 slapd[8611]: end get_filter 0 Feb 4 18:29:54 ldap1 slapd[8611]: conn=30 op=1 SRCH base="dc=hq,dc=mydomain,dc=com" scope=2 deref=0 filter="(uid=tavasti)" Feb 4 18:29:54 ldap1 slapd[8611]: => bdb_filter_candidates Feb 4 18:29:54 ldap1 slapd[8611]: AND Feb 4 18:29:54 ldap1 slapd[8611]: => bdb_list_candidates 0xa0 Feb 4 18:29:54 ldap1 slapd[8611]: => bdb_filter_candidates Feb 4 18:29:54 ldap1 slapd[8611]: OR Feb 4 18:29:54 ldap1 slapd[8611]: => bdb_list_candidates 0xa1 Feb 4 18:29:54 ldap1 slapd[8611]: => bdb_filter_candidates Feb 4 18:29:54 ldap1 slapd[8611]: EQUALITY Feb 4 18:29:54 ldap1 slapd[8611]: <= bdb_filter_candidates: id=0 first=0 last=0 Feb 4 18:29:54 ldap1 slapd[8611]: => bdb_filter_candidates Feb 4 18:29:54 ldap1 slapd[8611]: EQUALITY Feb 4 18:29:54 ldap1 slapd[8611]: <= bdb_filter_candidates: id=0 first=0 last=0 Feb 4 18:29:54 ldap1 slapd[8611]: <= bdb_list_candidates: id=0 first=0 last=0 Feb 4 18:29:54 ldap1 slapd[8611]: <= bdb_filter_candidates: id=0 first=0 last=0 Feb 4 18:29:54 ldap1 slapd[8611]: <= bdb_list_candidates: id=0 first=1 last=0 Feb 4 18:29:54 ldap1 slapd[8611]: <= bdb_filter_candidates: id=0 first=1 last=0 Feb 4 18:29:54 ldap1 slapd[8611]: conn=30 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= Feb 4 18:29:54 ldap1 slapd[8611]: conn=30 op=2 UNBIND Feb 4 18:29:54 ldap1 slapd[8611]: conn=30 fd=15 closed ---------------------------------------------------------------------- On config I have 'loglevel filter config stats' Any ideas what on earth is going on? -- M. Tavasti / tavasti(a)tavasti.fi / +358-40-5078254

2 2

Ghost/invisible subtree
by David Mohr 06 Feb '11

06 Feb '11

Hi, I'm having a strange issue. I'm running openldap 2.4.23 (on debian), and after playing around with some software using my ldap server I now have a ghost subtree. 'Ghost' meaning that I cannot see this subtree, but if I try to add an entry that used to exist, I get an 'Already exists (68)' error. With slapcat I can see all the invisible entries. I tried to run slapindex, but that did not help. Then I created a dump using slapcat, deleted the database, and used slapadd to fill it with data again. Yet my subtree is still invisible. Does anyone have suggestions on how to solve this issue? I can't seem to find any information beyond slapcat & slapadd. I don't see any obvious issues in the ldif dump either. Any help? Thanks, ~David

1 1

AccessLog behaviour
by Marco Pizzoli 05 Feb '11

05 Feb '11

Hi all, I would like to know the internal behaviour of slapo-accesslog. I would like to have accesslog with a data retention of 10 days. In my ldap usage scenario this retention produce an accesslog db of quite 10GB of data. Things are working quite fine, but when the log db contains data older than the retention I defined after restart slapd has a thread allocated at 100% of cpu of one processor. I logged at loglevel 992 = 512 + 256 + 128 + 64 + 32, blocked with iptables every external ldap access and saw these lines in the log: [cut] Feb 3 09:37:08 ldap03 slapd[16289]: => access_allowed: search access to "reqStart=20110202042854.000008Z,cn=log03,dc=mycorp.it" "reqStart" requested Feb 3 09:37:08 ldap03 slapd[16289]: <= root access granted Feb 3 09:37:08 ldap03 slapd[16289]: => access_allowed: search access granted by manage(=mwrscxd) Feb 3 09:37:08 ldap03 slapd[16289]: <= test_filter 6 Feb 3 09:37:08 ldap03 slapd[16289]: => test_filter Feb 3 09:37:08 ldap03 slapd[16289]: LE Feb 3 09:37:08 ldap03 slapd[16289]: => access_allowed: search access to "reqStart=20110202042854.000010Z,cn=log03,dc=mycorp.it" "reqStart" requested Feb 3 09:37:08 ldap03 slapd[16289]: <= root access granted Feb 3 09:37:08 ldap03 slapd[16289]: => access_allowed: search access granted by manage(=mwrscxd) Feb 3 09:37:08 ldap03 slapd[16289]: <= test_filter 6 Feb 3 09:37:08 ldap03 slapd[16289]: => test_filter Feb 3 09:37:08 ldap03 slapd[16289]: LE Feb 3 09:37:08 ldap03 slapd[16289]: => access_allowed: search access to "reqStart=20110202042854.000012Z,cn=log03,dc=mycorp.it" "reqStart" requested Feb 3 09:37:08 ldap03 slapd[16289]: <= root access granted Feb 3 09:37:08 ldap03 slapd[16289]: => access_allowed: search access granted by manage(=mwrscxd) Feb 3 09:37:08 ldap03 slapd[16289]: <= test_filter 6 Feb 3 09:37:08 ldap03 slapd[16289]: => test_filter Feb 3 09:37:08 ldap03 slapd[16289]: LE Feb 3 09:37:08 ldap03 slapd[16289]: => access_allowed: search access to "reqStart=20110202042854.000014Z,cn=log03,dc=mycorp.it" "reqStart" requested Feb 3 09:37:08 ldap03 slapd[16289]: <= root access granted Feb 3 09:37:08 ldap03 slapd[16289]: => access_allowed: search access granted by manage(=mwrscxd) Feb 3 09:37:08 ldap03 slapd[16289]: <= test_filter 6 Feb 3 09:37:08 ldap03 slapd[16289]: => test_filter Feb 3 09:37:08 ldap03 slapd[16289]: LE Feb 3 09:37:08 ldap03 slapd[16289]: => access_allowed: search access to "reqStart=20110202042855.000000Z,cn=log03,dc=mycorp.it" "reqStart" requested Feb 3 09:37:08 ldap03 slapd[16289]: <= root access granted Feb 3 09:37:08 ldap03 slapd[16289]: => access_allowed: search access granted by manage(=mwrscxd) Feb 3 09:37:08 ldap03 slapd[16289]: <= test_filter 6 Feb 3 09:37:09 ldap03 slapd[16289]: => test_filter Feb 3 09:37:09 ldap03 slapd[16289]: LE Feb 3 09:37:09 ldap03 slapd[16289]: => access_allowed: search access to "reqStart=20110202042855.000002Z,cn=log03,dc=mycorp.it" "reqStart" requested Feb 3 09:37:09 ldap03 slapd[16289]: <= root access granted Feb 3 09:37:09 ldap03 slapd[16289]: => access_allowed: search access granted by manage(=mwrscxd) Feb 3 09:37:09 ldap03 slapd[16289]: <= test_filter 6 Feb 3 09:37:09 ldap03 slapd[16289]: => test_filter Feb 3 09:37:09 ldap03 slapd[16289]: LE Feb 3 09:37:09 ldap03 slapd[16289]: => access_allowed: search access to "reqStart=20110202042855.000004Z,cn=log03,dc=mycorp.it" "reqStart" requested [cut] I could assume that slapo-accesslog is querying all entries older than the retention and passes to delete them. What if this step to end the job will take more time than the interval time of re-starting? Augmenting the frequency of this job could help in this meaning? Every best practice to follow to use accesllog effectively will be very appreciated! :-) Thanks Marco Pizzoli -- _________________________________________ Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi. Jim Morrison

2 3

How to I verify SSL is working correctly
by Rob Tanner 04 Feb '11

04 Feb '11

Hi, I’m adding SSL to an existing openLDAP server. My certificate is a 2048 bit from Comodo and I need to install both the certificate and and the intermediate chain, 5 certificates altogether. I bundled the chain into a single file in the order Comodo lists and in slapd.conf I added: TLSCACertificateFile /path/to/providerBundle.crt TLSCertificateFile /path/to/mycert.pem TLSCertificateKeyFile /path/to/mykey.pem Then I restarted openLDAP. I have several different browsers to test the SSL connection, and mostly they all worked just fine. However, lbe, a java based browser that I think was originally from Novel, asks me if I want to trust the CA root certificate, which is the first cert in the CA bundle. So, needless to say, I’m confused. Can anyone help unconfuse me? Thanks. Rob Tanner UNIX Services Manager Linfield College, McMinnville Oregon

2 1

TLS Directives in slapd.conf
by ldap＠mm.st 04 Feb '11

04 Feb '11

I have authentication working using TLS on my RH5 servers with openldap 2.3, but was looking for some clarification on the TLS directives in slapd.conf. Most of what I have seen and read states to generate the key and cert (can be done a number of ways) and update the following directives: # TLSCACertificateFile /etc/pki/tls/certs/ca-bundle.crt # TLSCertificateFile /etc/pki/tls/certs/slapd.pem # TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem Which I have done using the "make ldap.pem" in the pki directory on the Redhat server. Both the key and the cert are in a singe file. The directives now read: TLSCACertificateFile /etc/pki/tls/certs/ldap.pem TLSCertificateFile /etc/pki/tls/certs/ldap.pem TLSCertificateKeyFile /etc/pki/tls/certs/ldap.pem I place the cert section in the client ldap.conf and all seems to work fine. My question is, what is the function of TLSCACertificateFile directive. I can comment out the directive and authentication still works fine and appears to not have a effect on operation. Both TLSCertificateFile and TLSCertificateKeyFile seem to be required if any one of the directives are used. The man page explanation says it "contains certificates for all of the Certificate Authorities that slapd will recognize." I'm not sure how TLSCACertificateFile should be used, if at all. Just trying to understand how the directive should be implemented.

1 0

LDAP writes/second limit?
by Diego Lima 04 Feb '11

04 Feb '11

Hello all, I'm running some load tests on an LDAP server using JMeter and as part of the tests I'm running a continuous loop of users trying to change their passwords. The problem is, there is a point where OpenLDAP stops responding requests and is unable to complete its current operations. This is what each "user" do: Bind -> Modify userPassword -> Unbind When I spawn a few users on a short time and try to do the modify operation the server stops responding. I was able to do that by spawning 5 threads simultaneously and trying to have them change the user password at once. It seems that something is not handling the write operations well and is hanging. Slapd doesnt stop responding completely, as I'm able to send a kill signal to it and it'll tell that it is waiting for some tasks to end. The complete log follows: Feb 4 13:47:44 Server01 slapd[8772]: @(#) $OpenLDAP: slapd 2.4.23 (Jan 28 2011 17:07:07) $#012#011root@Server01:/home/suporte/openldap-2.4.23/servers/slapd Feb 4 13:47:44 Server01 slapd[8772]: /ldap/etc/slapd.conf: line 108: rootdn is always granted unlimited privileges. Feb 4 13:47:44 Server01 slapd[8773]: bdb_db_open: database "dc=diretorio,dc=mycompany": unclean shutdown detected; attempting recovery. Feb 4 13:47:45 Server01 slapd[8773]: slapd starting Feb 4 13:47:51 Server01 slapd[8773]: conn=1000 fd=12 ACCEPT from IP=192.168.1.2:6098 (IP=0.0.0.0:389) Feb 4 13:47:51 Server01 slapd[8773]: conn=1002 fd=15 ACCEPT from IP=192.168.1.2:6101 (IP=0.0.0.0:389) Feb 4 13:47:51 Server01 slapd[8773]: conn=1003 fd=13 ACCEPT from IP=192.168.1.2:6102 (IP=0.0.0.0:389) Feb 4 13:47:51 Server01 slapd[8773]: conn=1001 fd=14 ACCEPT from IP=192.168.1.2:6099 (IP=0.0.0.0:389) Feb 4 13:47:51 Server01 slapd[8773]: conn=1004 fd=16 ACCEPT from IP=192.168.1.2:6103 (IP=0.0.0.0:389) Feb 4 13:47:51 Server01 slapd[8773]: conn=1001 op=0 BIND dn="cn=tcarga_usuario4,ou=usuarios,dc=diretorio,dc=mycompany" method=128 Feb 4 13:47:51 Server01 slapd[8773]: conn=1002 op=0 BIND dn="cn=tcarga_usuario1,ou=usuarios,dc=diretorio,dc=mycompany" method=128 Feb 4 13:47:51 Server01 slapd[8773]: conn=1003 op=0 BIND dn="cn=tcarga_usuario3,ou=usuarios,dc=diretorio,dc=mycompany" method=128 Feb 4 13:47:51 Server01 slapd[8773]: conn=1004 op=0 BIND dn="cn=tcarga_usuario5,ou=usuarios,dc=diretorio,dc=mycompany" method=128 Feb 4 13:47:51 Server01 slapd[8773]: conn=1002 op=0 BIND dn="cn=tcarga_usuario1,ou=usuarios,dc=diretorio,dc=mycompany" mech=SIMPLE ssf=0 Feb 4 13:47:51 Server01 slapd[8773]: conn=1000 op=0 BIND dn="cn=tcarga_usuario2,ou=usuarios,dc=diretorio,dc=mycompany" method=128 Feb 4 13:47:51 Server01 slapd[8773]: conn=1002 op=0 RESULT tag=97 err=0 text= Feb 4 13:47:51 Server01 slapd[8773]: conn=1000 op=0 BIND dn="cn=tcarga_usuario2,ou=usuarios,dc=diretorio,dc=mycompany" mech=SIMPLE ssf=0 Feb 4 13:47:51 Server01 slapd[8773]: conn=1003 op=0 BIND dn="cn=tcarga_usuario3,ou=usuarios,dc=diretorio,dc=mycompany" mech=SIMPLE ssf=0 Feb 4 13:47:51 Server01 slapd[8773]: conn=1001 op=0 BIND dn="cn=tcarga_usuario4,ou=usuarios,dc=diretorio,dc=mycompany" mech=SIMPLE ssf=0 Feb 4 13:47:51 Server01 slapd[8773]: conn=1000 op=0 RESULT tag=97 err=0 text= Feb 4 13:47:51 Server01 slapd[8773]: conn=1003 op=0 RESULT tag=97 err=0 text= Feb 4 13:47:51 Server01 slapd[8773]: conn=1004 op=0 BIND dn="cn=tcarga_usuario5,ou=usuarios,dc=diretorio,dc=mycompany" mech=SIMPLE ssf=0 Feb 4 13:47:51 Server01 slapd[8773]: conn=1001 op=0 RESULT tag=97 err=0 text= Feb 4 13:47:51 Server01 slapd[8773]: conn=1004 op=0 RESULT tag=97 err=0 text= Feb 4 13:47:51 Server01 slapd[8773]: conn=1004 op=1 MOD dn="cn=tcarga_usuario5,ou=usuarios,dc=diretorio,dc=mycompany" Feb 4 13:47:51 Server01 slapd[8773]: conn=1000 op=1 MOD dn="cn=tcarga_usuario2,ou=usuarios,dc=diretorio,dc=mycompany" Feb 4 13:47:51 Server01 slapd[8773]: conn=1001 op=1 MOD dn="cn=tcarga_usuario4,ou=usuarios,dc=diretorio,dc=mycompany" Feb 4 13:47:51 Server01 slapd[8773]: conn=1004 op=1 MOD attr=userPassword Feb 4 13:47:51 Server01 slapd[8773]: conn=1003 op=1 MOD dn="cn=tcarga_usuario3,ou=usuarios,dc=diretorio,dc=mycompany" Feb 4 13:47:51 Server01 slapd[8773]: conn=1003 op=1 MOD attr=userPassword Feb 4 13:47:51 Server01 slapd[8773]: conn=1000 op=1 MOD attr=userPassword Feb 4 13:47:51 Server01 slapd[8773]: slap_queue_csn: queing 0x40d36450 20110204154751.766634Z#000001#000#000000 Feb 4 13:47:51 Server01 slapd[8773]: slap_queue_csn: queing 0x426a5450 20110204154751.766634Z#000000#000#000000 Feb 4 13:47:51 Server01 slapd[8773]: slap_queue_csn: queing 0x436a7450 20110204154751.766652Z#000000#000#000000 Feb 4 13:47:51 Server01 slapd[8773]: conn=1002 op=1 MOD dn="cn=tcarga_usuario1,ou=usuarios,dc=diretorio,dc=mycompany" Feb 4 13:47:51 Server01 slapd[8773]: conn=1001 op=1 MOD attr=userPassword Feb 4 13:47:51 Server01 slapd[8773]: conn=1002 op=1 MOD attr=userPassword Feb 4 13:47:51 Server01 slapd[8773]: slap_queue_csn: queing 0x42ea6450 20110204154751.766981Z#000000#000#000000 Feb 4 13:47:51 Server01 slapd[8773]: slap_queue_csn: queing 0x41ea4450 20110204154751.767126Z#000000#000#000000 Feb 4 13:47:51 Server01 slapd[8773]: conn=1004 op=1 RESULT tag=103 err=0 text= Feb 4 13:47:51 Server01 slapd[8773]: slap_graduate_commit_csn: removing 0x7f9bc4203f10 20110204154751.766634Z#000000#000#000000 Feb 4 13:47:51 Server01 slapd[8773]: conn=1004 op=2 UNBIND Feb 4 13:47:51 Server01 slapd[8773]: conn=1004 fd=16 closed [ Here I sent sigterm to slapd ] Feb 4 13:52:14 Server01 slapd[8773]: daemon: shutdown requested and initiated. Feb 4 13:52:14 Server01 slapd[8773]: slapd shutdown: waiting for 4 operations/tasks to finish The server does not respond anymore and I have to kill the process by using kill -9. Anyone ever experienced the same or can provide hints as to what is happening? I'm using slapd 2.4.23 and berkeley db 4.6 on a Debian Lenny system. -- Diego Lima http://www.diegolima.org

2 2

'Inheriting' an attribute from a group.
by ian+openldap＠comtek.co.uk 04 Feb '11

04 Feb '11

Is there a recommended, 'production' way to inherit certain attributes from a group? Perhaps some kind of overlay? For example, if a user is in the 'users' group and the users group has the attribute userQuota=100 then the user will appear to have userQuota=100. If, on the other hand, userQuota=200 is set on the user then that would override the current value. Thanks for any suggestions. Ian

3 2

System user login fails if ldap goes down.
by Meghanand Acharekar 04 Feb '11

04 Feb '11

Hi, I have configured a mixed authentication systems (LDAP + System Users). On this system some users are configure to login via ldap rest as system users. I observed that if the ldap server goes down, system users also not able to login. Is there any way to prevent this, following my pam configuration. system-auth : auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet auth sufficient pam_ldap.so use_first_pass auth required pam_deny.so account required pam_unix.so broken_shadow account sufficient pam_succeed_if.so uid < 500 quiet account [default=bad success=ok user_unknown=ignore] pam_ldap.so account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 debug minclass=4 dcredit=-1 ucredit=-1 ocredit=-1 lcredit=0 minlen=8 password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok password sufficient pam_ldap.so use_authtok password required pam_deny.so nsswitch.conf --------------------- passwd: files ldap shadow: files ldap group: files ldap I get following errors in syslog, even after proving correct password. sshd[23564]: nss_ldap: failed to bind to LDAP server ldap://10.0.119.36/: Can't contact LDAP server sshd[23564]: nss_ldap: reconnecting to LDAP server (sleeping 32 seconds)... sshd[23568]: pam_ldap: ldap_simple_bind Can't contact LDAP server sshd[23568]: Failed password for testuser from 1.2.3.4 port 33324 ssh2 sshd[23571]: fatal: Access denied for user testuser by PAM account configuration Regards, Meghanand N. Acharekar

2 4

Which backend should I use?
by Olivier PAVILLA 04 Feb '11

04 Feb '11

Hi. I need your advice again :) I have LDAP server with ldbm database on a fedora core 5 which is running for more than 3 years without any update nor upgrade neither. So now I've to migate this old LDAP on a new server with new Linux distribution (Debian Lenny). I'm tune up both /etc/ldap/slapd.conf and /var/lib/ldap/DB_CONFIG. But right now I read on a website (http://linagora.org/contrib/annuaires/documentations/openldap_guide_install…) that backend bdb will disappear. Should I use backend hdb or it doesn't make something different? -- Olivier Pavilla << 仕事を探しています。求職中です。>> S.C.I.R.C. Orléans (Bourgogne) - I.U.F.M. Centre-Val de Loire 72 Rue du Faubourg Bourgogne -45044 ORLEANS Cedex 1 Tel : 02-38-49-26-20 , mailto:olivier.pavilla@univ-ørleans.fr http://blog.linux-squad.com - 僕の傑作です。

4 5

Re: Transparent proxy, (objectClass=user) not being relayed. Schema issue?
by masarati＠aero.polimi.it 03 Feb '11

03 Feb '11

> Well now the issue I run into is slapd crashing when I also configure > proxy > caching. It stops when trying to Initialize the BDB database: > > slap_sasl_init: initialized! > bdb_back_initialize: initialize BDB backend > bdb_back_initialize: Berkeley DB 4.8.30: (April 9, 2010) > hdb_back_initialize: initialize HDB backend > hdb_back_initialize: Berkeley DB 4.8.30: (April 9, 2010) >>>> dnPrettyNormal: <dc=ad,dc=mydomain,dc=edu> > <<< dnPrettyNormal: <dc=ad,dc=mydomain,dc=edu>, <dc=ad,dc=mydomain,dc=edu> >>>> dnPrettyNormal: <dc=ad,dc=mydomain,dc=edu> > <<< dnPrettyNormal: <dc=ad,dc=mydomain,dc=edu>, <dc=ad,dc=mydomain,dc=edu> > ldap_url_parse_ext(ldap://ldapadlb.mydomain.edu/dc=ad,dc=mydomain,dc=edu) >>>> dnPrettyNormal: <dc=ad,dc=mydomain,dc=edu> > <<< dnPrettyNormal: <dc=ad,dc=mydomain,dc=edu>, <dc=ad,dc=mydomain,dc=edu> > bdb_db_init: Initializing BDB database > slapd-ldap destroy: freeing system resources. > slapd stopped. > connections_destroy: nothing to destroy. > > overlay pcache > proxycache bdb 10000 1 50 100 > proxyattrset 0 uid > proxytemplate * 0 0 > directory /usr/local/var/openldap-data > cachesize 100 Please direct software usage questions to the list. I suspect a misconfiguration; try starting slapd -with d config. p.

2 4

ldap_bind: Invalid credentials (49)
by John Espiro 03 Feb '11

03 Feb '11

System: Ubuntu 10.10 server 64bit @(#) $OpenLDAP: slapd 2.4.23 (Nov 19 2010 17:41:28) $ buildd@allspice:/build/buildd/openldap-2.4.23/debian/build/servers/slapd Problem: I am following the guide here: http://blog.suretecsystems.com/archives/163-OpenLDAP-Quick-Tips-Change-logl… Entering: ldapmodify -x -D 'cn=config' -W -f log.ldif Gives me: Enter LDAP Password: ldap_bind: Invalid credentials (49) I enter the password (that is also stored in ldap.secret), but the error persists. I've got to be missing something obvious, but it's not clear what that is... John

5 6

"Tagging" and Data Access: a request for advice and help
by Gervase Markham 03 Feb '11

03 Feb '11

[I hope this message is on-topic for this list; if not, please can you tell me where I can get some advice?] I am writing a new bit of Mozilla software called Domesday, which is a community directory: http://wiki.mozilla.org/Domesday We hope to scale it beyond 100,000, perhaps up to 1M users eventually. The aim is to help our community know each other better. One route is to use a directory for the back end, as directories are designed to store data about people. I am investigating this. So far, it seems that the inetOrgPerson objectclass, with another auxiliary objectClass for a few extra attributes we want, would be the way to go. However, Domesday has a couple of unusual requirements. 1) Tagging Firstly, I want to support "tagging". Each user can have a number (possibly large) of user-defined tags, and it must be possible to search easily and efficiently for "all users with tag X" or "all users with a tag which has prefix Y" (so we can support multipart tags, e.g. l10n:es for Spanish localizers) but also for "all tags for user Z". I anticipate there being thousands of tags. At the moment, having read just enough to be dangerous, I think I might be able to do this using objects under a common dn (dc=org,dc=mozillians,dc=tags, say) with the groupOfNames objectclass, with cn=<tagName> and member=<dn> for each member. Is that the right way to go? Does it allow easy searching for "all tags for user Z"? 2) Data Access Domesday is a very privacy-conscious application. While the UI might not permit quite as much flexibility, I want to support attribute-level control of data access, where each attribute on a person is associated with a tag (see above) and only people with that tag can see that attribute. If there are 100,000 people and maybe 10-20 items of data per person, that's a lot of access control. Having read the Access Control documentation: http://www.openldap.org/doc/admin24/access-control.html it seems that dynamic configuration would be the only workable choice. However, I am not entirely sure this can be done or, if it can, that it can be done in a performant way. It would need a lot of olcAccess attributes! So you can see how my two problems are intertwined :-) Can people please advise me on how best to achieve these two particular goals using OpenLDAP? Thanks, Gerv

2 2

Logging to syslog
by John Espiro 02 Feb '11

02 Feb '11

I have tied in a few things such as openid-ldap and openfire to use my ldap backend for authentication. I am wondering if it is possible to collect error logs for any invalid attempt that a user tries with these various applications. Rather than handling it at the application level, can I get openldap to log these events? If so, can someone point me to a link that explains it? Thanks, John

5 7

RE: Logging to syslog
by Chris Jacobs 02 Feb '11

02 Feb '11

Please reply to all (include the thread). If you lack a slapd.conf (or slapd.d) it sounds like you're NOT working on an ldap server, but rather a client. In that case, you'd check /var/log/security, etc - where the tools you're using log (like ssh, pam, etc). If there's a slapd.d dir, then you'd need to use ldapmodify to add the loglevel to your config. To get those logs to syslog, you'd need to add to syslog.conf: # Log Openldap stuff (ldap servers only) local4.* -/var/log/openldap - chris -----Original Message----- From: John Espiro [mailto:john_espiro@yahoo.com] Sent: Wednesday, February 02, 2011 12:37 PM To: Chris Jacobs Subject: Re: Logging to syslog On 2/2/2011 9:01 PM, Chris Jacobs wrote: > John, > > Are you attempting to log on a client? > > - chris Hi Chris - I don't understand your question - in what context are you talking about? John This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

3 3

slapindex Required or Not
by ldap＠mm.st 02 Feb '11

02 Feb '11

I am in the process of rebuilding our ldap servers that are many years old to run on RH5. I basically took the existing slapd.conf file from the old server and am using it on the new server (minor changes). I did a slapcat on the old server, modified the schema a little and did a slapadd on the new. Systems seem to be able to authenticate against the new test server and things seem to function corretly. For now, the db backend is ldbm. It has the following index statements: index objectClass,uid,uidNumber,gidNumber,memberUid eq index cn,mail,surname,givenname eq,subinitial I'm unclear of when and if it is required to run slapindex on the new server. Is this something that should be done after slapadd and should it be done on a regular basis? I assume you should stop slapd when this is run.

2 3

Running back-perl and hdb/bdb in the same suffix
by José Miguel Parrella Romero 02 Feb '11

02 Feb '11

Hi, I've written a Perl class to be used with back-perl. I'm able to load this class from slapd.conf using a different suffix than my traditional hdb database. Say, for example, my hdb database is serving the dc=my,dc=net suffix, and my Perl is serving dc=perl,dc=my,dc=net. This effectively prevents me from "catching" user password modifications in dc=my,dc=net. If I use the subordinate keyword on my Perl database I'm able to see searches spanning through my dc=perl,dc=my,dc=net, but then again, modifications on users in dc=my,dc=net aren't seen by the Perl backend. I've tried different approaches for this, but as of now I guess my only chance is to actually "proxy" the LDAP operations from Perl using the LDAP library to the dc=my,dc=net suffix in order to get a seamless experience and achieve my goal of user password manipulation. This is what I've seen in (really old) projects such as acctsync in Sourceforge. So, my question is: can I use both backends in the same suffix, so only some LDAP operations get overriden in Perl and others "pass through" the physical backend? And if not, what would be your strategy to achieve this goal? My last plan is to store passwords in plaintext, create an ACL to prevent everyone but a non-human role to read userPassword and move along, but I'd feel terrible about this. By the way, thanks for making such an awesome piece of software. Jose

1 0

slapadd: could not add entry dn="cn=plc1, ou=groups, dc=orleans-tours, dc=iufm, dc=fr" (line=53343): txn_aborted! Internal error (80)
by Olivier PAVILLA 02 Feb '11

02 Feb '11

Hi everyone I met some difficulties to import ldif to my ldap On the old LDAP I did [root@luz ~]# /etc/init.d/crond stop Ce qui donne Arrêt de crond : [ OK ] [root@luz ~]# /etc/init.d/ldap stop Ce qui donne Arrêt de slapd : [ OK ] After that I did #slapindex And after [root@luz ~]# slapcat > /root/sauvegarde_luz_new.ldif I uploaded on the new server And I did that luz:~/setup# slapadd -l sauvegarde_luz_new.ldif bdb(dc=orleans-tours,dc=iufm,dc=fr): Lock table is out of available locks => bdb_idl_insert_key: c_get failed: Cannot allocate memory (12) => bdb_tool_entry_put: index_entry_add failed: Internal error (80) => bdb_tool_entry_put: txn_aborted! Internal error (80) slapadd: could not add entry dn="cn=plc1,ou=groups,dc=orleans-tours,dc=iufm,dc=fr" (line=53343): txn_aborted! Internal error (80) Someone can tell me what does this message mean? I don't understand this message error then I don't know what should I do. -- Olivier Pavilla << 仕事を探しています。求職中です。>> S.C.I.R.C. Orléans (Bourgogne) - I.U.F.M. Centre-Val de Loire 72 Rue du Faubourg Bourgogne -45044 ORLEANS Cedex 1 Tel : 02-38-49-26-20 , mailto:olivier.pavilla@univ-ørleans.fr http://blog.linux-squad.com - 僕の傑作です。 "Acheté un Iphone c'est cautionné l'esclavage humain..."

2 1

Do I need using slapindex?
by Olivier PAVILLA 02 Feb '11

02 Feb '11

Hi. I need your advice. I have LDAP server on a fedora core 5 which is running for more than 3 years without any update nor upgrade neither. So now I've to migate this LDAP on a new server with new Linux distribution (Debian Lenny 5.0.7 64 bits). Should I or do I need to use slapindex before I use slapcat to export in ldif file? -- Olivier Pavilla << 仕事を探しています。求職中です。>> S.C.I.R.C. Orléans (Bourgogne) - I.U.F.M. Centre-Val de Loire 72 Rue du Faubourg Bourgogne -45044 ORLEANS Cedex 1 Tel : 02-38-49-26-20 , mailto:olivier.pavilla@univ-orleans.fr http://blog.linux-squad.com - 僕の傑作です。 "Acheté un Iphone c'est cautionné l'esclavage humain..."

3 2

Re: Transparent proxy, (objectClass=user) not being relayed. Schema issue?
by masarati＠aero.polimi.it 02 Feb '11

02 Feb '11

>> 2.3.43 included with CentOS. I'll try the latest package. Thanks! > > Ah. Actually, I only tried an undefined objectClass, which works. In > fact, in the case you're considering, (objectClass=user) contains an > invalid value of a valid attribute, while (sAMAccountName=user01) contains > an invalid attribute, so the two cases are different. Right now, with > HEAD's back-meta for "(&(objectClass=user)(sAMAccountName=user01))" I get > "(&(?objectClass=user)(!(objectClass=*)))". Let me check a bit more. I have provided another round of fixes. One of them affects back-meta (map.c, ITS#6818); another affects filter handling (ava.c); finally, another affects slapo-rwm when used in conjunction with back-ldap (rwmmap.c). Now the issue should be definitely fixed. Please test. p.

2 1

authz-regexp and uid's
by Derek Bodner 02 Feb '11

02 Feb '11

Hello, I'm running an ldap 2.3 server, with users setup under cn=<first name> <last name>,ou=People,dc=org,dc=com. I have an application that is trying to access the dn's directly, via uid=<username>,ou=People,dc=org,dc=com I've setup an authz-regexp rule to try to rewrite the request: authz-regexp uid=([^,]*),ou=People,dc=org,dc=com ldap:///ou=People,dc=org,dc=com??one?(uid=$1) But my query still seems to be failing [dbodner@nagios01 ~]$ ldapsearch -h <ldap server> -x -b "uid=dbodner,ou=People,dc=org,dc=com" # extended LDIF # # LDAPv3 # base <uid=dbodner,ou=People,dc=org,dc=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 32 No such object # numResponses: 1 Any ideas on what I'm doing wrong ? -- Derek Bodner subscribedlists(a)derekbodner.com

2 2

using slapindex on a running instance of openldap
by François Périchon 02 Feb '11

02 Feb '11

Hi, I am using the gentoo build of openldap 2.4.23 with db-4.8 on a 64bit gentoo linux system. I am trying to reindex a database after switching this database on readonly mode (by editing the bdb backend entry in th cn=config). The slapindex manpage read: Your slapd(8) should not be running (at least, not in read-write mode) when you do this to ensure consistency of the database. But I get this error: sudo -u ldap slapindex -q member bdb_db_open: database "dc=univ-lille2,dc=fr": database already in use. backend_startup_one (type=bdb, suffix="dc=univ-lille2,dc=fr"): bi_db_open failed! (-1) slap_startup failed Regards, -- François Périchon Gestion des identités numériques Université Lille 2 - Droit & Santé Centre de Ressources Informatiques http://cri.univ-lille2.fr tel: +33 3 20 96 52 28 - A: Yes. > Q: Are you sure ? >> A: Because it reverses the logical flow of conversation. >>> Q: Why is top posting annoying in email ?

1 0

same objects in multiple ou?
by Joe Comeaux 01 Feb '11

01 Feb '11

I'm trying to design an environment that does not allow anonymous binds, and the users that require authentication reside across multiple OU's. It seems common practice among authentication modules to take a cn, bind anonymously to scan for the full dn, and then check password with full dn to authenticate. What I'd like to avoid is the anonymous bind, or storing a name and password with read access to bind, to increase security. I think what would be ideal is to somehow map all objects across multiple ou's to a single ou. Something along the lines of : all objects in ou=Department1,dc=example,dc=com + ou=Department2,dc=example,dc=com + ou=Department3,dc=example,dc=com to be linked to ou=Everyone,dc=example,dc=com. If something like that were in place, new users created in Department3 could be authenticated with cn=username,ou=Everyone,dc=example,dc=com. All modules designed to check authentication would not need to bind first to search the directory for the full dn. I've seen references to aliasing, but that applies only to a single object, and also mentions of mapping, but I can't tell if that would do what I expect it to do. Has anyone else built something similar? Can what I explain even be done with OpenLDAP? What should I be looking in to for direction on setting this up? Thanks in advance -Joe Comeaux

3 7

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical