- openldap-technical - openldap.org

autonumbering
by Molenda, Mark 01 Feb '11

01 Feb '11

I know you can create a sequence for auto numbering in records, I was wondering if this is still the preferred method? What is the best way?

1 0

User managed groups - ACLs
by Christian Manal 01 Feb '11

01 Feb '11

Hi list, I am currently trying to make it possible for ordinary users to manage their own groups in the following way: 1 Any user can create new groups ("groupOfNames"). 1.1 On creation, the creator is set to be the first member and manager of the group (the latter is defined as a single-value attribute (UDBgrpAdmin) for a self defined auxiliary objectClass "UDBgrp"). 1.2 Some names should be prohibited from being used for new groups. 2 Group managers can invite any user to the group by adding their DN to the invited list of the group (UDBgrpInvited) and revoke invitations by removing DNs from said list. 2.1 Group managers can kick members from the group. 2.2 Group managers can delete the group. 2.3 Group managers can assign a new manager who has to be a member of the group. 2.4 Group managers can (re)set a description for the group. 3 Invited users can accept or decline the invitation, i.e. remove themselves from the invite list and add themselves to the member list. 4 Group members can leave the group permanently or temporarily. The latter is achieved by moving themselves from the member list to a suspended list (UDBgrpSuspended) which allows them to rejoin the group later (i.e. move themselves back to the member list) without a new invitation. I have most of the above covered, but I'm struggling with the points 1.1, 2.3 and to some extend 1.2. 1.1 and 2.3: I have no idea if this is even possible, let alone how to achieve it. 1.2: By extending the 'filter' rule that limits the objectClasses for new entries in "ou=Group" I can make a blacklist for 'cn' values, but I'd rather have something in the DIT itself, so I can modify the list without meddling with the server config. This is optional, though, since I don't except the list to change very often. This is what I've got so far: <http://openldap.pastebin.com/n8P4eKvU> Any help would be appreciated. Regards, Christian Manal

1 1

meta directory backend and rewriting option '|'
by Lehnert, Hartmut 01 Feb '11

01 Feb '11

Hello! I have a question concerning the pipe option '|' when using the meta directory backend and rewriting. In the manual pages the '|' option is marked as "not implemented". Does this reflect the actual state of the software or has somebody just forgotten to update the man page? Regards, Hartmut

2 2

Access control
by Thomas Schweikle 01 Feb '11

01 Feb '11

Hi! I am trying to set up access control for an OpenLDAP server. I'd like to use a Group to set up users allowed to access and write to entries inside my tree: I've created the group: dn: cn=administrators,dc=example,dc=com cn: administrators objectclass: groupOfNames (important for the group acl feature) member: cn=user1,ou=Users,dc=example,dc=com member: cn=user2,ou=Users,dc=example,dc=com in dn: olcDatabase=hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=example,dc=com olcRootDN: cn=adm,dc=example,dc=com olcRootPW: ${admpw} olcAccess: to attrs=userPassword,shadowLastChange,krbPrincipalKey by group.exact="cn=administrators,dc=example,dc=com" write by dn="cn=adm,dc=example,dc=com" write by anonymous auth by self write by * none olcAccess: to dn.base="" by * read olcAccess: to * by group.exact="cn=administrators,dc=example,dc=com" write by dn="cn=adm,dc=example,dc=com" write by * read Now trying to access "userPassword" from any user inside the tree "ou=Users,dc=example,dc=com". 1. The password field is empty -- it should hold a value 2. Entering a value, then pressing apply: "Error modifying 'cn=user3,ou=Users,dc=xompu,dc=de': Insufficient access I'd expected to have access to "userPassword" and I am allowed to write this value. Why does it not work if I log in with user1? -- Thomas

3 5

cn=config how to grant read rights
by John Espiro 31 Jan '11

31 Jan '11

I am new to the whole cn=config thing... Having just started with it, I have a question. I have an existing user for which I need to give read rights to the tree: "This user must have the Read right to the LDAP service.". How do I go about modifying the ACL so that he has this? John

1 0

Transparent proxy, (objectClass=user) not being relayed. Schema issue?
by Christopher Cprek 31 Jan '11

31 Jan '11

Hello, I'm attempting to configure a slapd server in a very simple transparent proxy configuration. I'm having a problem where clients for this proxy have a (objectClass=user) filter defined. This filter is being replaced with (!(objectClass=*)) when the searchRequest is relayed to the backend LDAP server. I believe this is something missing in the schema, though I'm very new to LDAP. I've already included an AD schema in my slapd.conf to resolve some AD specific filters I had trouble with. I've attempted to uncomment and modify the core.schema's definition of attributetype NAME objectClass, and commented out what I suspected was the conflicting duplicate attributeType NAME supportedApplicationContext. But I can't get slapd to start. I keep getting a duplicate attribute type error in the config. hdb_back_initialize: Sleepycat Software: Berkeley DB 4.4.20: (January 10, 2006) /etc/openldap/schema/core.schema: line 66: Duplicate attributeType: "2.5.4.0" slapd-ldap destroy: freeing system resources. slapd stopped. connections_destroy: nothing to destroy. I would appreciate any guidance to help resolve my problem. All I want is the filter (objectClass=user) to be relayed correctly from the slapd service to the LDAP proxy backend. Thanks in advance! /Chris

3 6

Authentication for on the fly configuration updates in OpenLDAP 2.4
by Razvan Deaconescu 31 Jan '11

31 Jan '11

Hi! I've browsed the configuration page for slapd[1] and it mentions that, for starting from version 2.3, "The LDAP configuration engine allows all of slapd's configuration options to be changed on the fly, generally without requiring a server restart for the changes to take effect." What is the user and password required to update the LDAP configuration database? I'm using slapd 2.4.23-7 on a Debian Squeeze (testing). I've tried using the admin user (cn=admin,dc=...,dc=...) and it fails. This link[2] mentions using the cn=admin,dc=config account and a password found in ldap.secret. I've not found that file and don't know what is the password for the cn=admin,dc=config account. Thanks, Razvan

6 11

syncrepl don't preserve the order of the value on multivalued attribute
by Ricardo Machini 30 Jan '11

30 Jan '11

Hi, I changed recently from sluprd to syncrepl. And I saw that the syncrepl do not preserve the order of the value on multivalued attribute (I dont know if it is a bug) . Example: Entry on LDAP master/slave: dn: cn=ricardo deliveryProgramPath: odeiavir deliveryProgramPath: maildrop When I do this modify on master: dn: cn=ricardo changetype:modify replace: deliveryProgramPath deliveryProgramPath: maildrop deliveryProgramPath: odeiavir The result is: LDAP Master: dn: cn=ricardo deliveryProgramPath: maildrop deliveryProgramPath: odeiavir LDAP Slave: dn: cn=ricardo deliveryProgramPath: odeiavir deliveryProgramPath: maildrop The slave server keep the old order. Someone knows if this is a replication bug ? Thanks, Ricardo Machini

2 1

How to get the socket to listen for replies from referral connections?
by Ian Puleston 29 Jan '11

29 Jan '11

Hi, Some time back I implemented an OpenLDAP-based LDAP client in a network appliance that uses code based on the tools for LDAP searches etc. I used the tool code because it gave me a nice easy LDIF-based API, but the downside was that each search operation was totally synchronous, so I'm now working on updating it to support asynchronous searches. I have a daemon task that listens for replies from the server after a request is set, and that then calls ldap_result, ldap_parse_result, etc. - basically all the things that ldap_do_search does synchronously. The daemon task, being ouside of OpenLDAP, gets the socket to listen on for each request via ldap_get_option with LDAP_OPT_SOCKBUF. This is working well. The problem is when new connections are opened when a referral/reference is followed. In this case the daemon needs to listen for replies on these too, but there is no way that I can see to get at its socket from outside the OpenLDAP core. LDAP_OPT_SOCKBUF gets the socket for the primary connection and there is no equivalent mechanism to get the sockets for the referral connections. What I've had to do is to add a new LDAP_OPT_REF_SOCKBUFS in my local OpenLDAP code to return a list of the socket buffers for additional connections opened for referrals. I am using an oldish version - 2.3.32 so: - am I missing any alternate way to get these sockets to listen on? - has anything been added in more recent versions that will help with this? - if not would this new option LDAP_OPT_REF_SOCKBUFS be a useful addition? If so I could submit it via the bug reporting. Ian

2 3

Search Filter for Second Value
by Tim Gustafson 28 Jan '11

28 Jan '11

Is there any way to craft a search filter that checks for an attribute with two or more values? For example, how could I construct a query to search for users with two passwords? Something like: userPassword[1]=* (where userPassword[0] would be the user's first password attribute) Tim Gustafson Baskin School of Engineering UC Santa Cruz tjg(a)soe.ucsc.edu 831-459-5354

3 4

Is the fix for ITS#6540 included in a minor release?
by Khosrow Ebrahimpour 28 Jan '11

28 Jan '11

Hello list, Recently I ran into the olcDbURI bug that was mentioned earlier on this mailing list (http://www.openldap.org/lists/openldap-technical/201011/msg00124.html). It turned out to be part of ITS #6540 and I've found that the issue was resolved and patch was submitted sometime in Nov, 2010. I am currently running ubuntu 10.04 with the following openldap packages : libldap-2.4-2 2.4.21-0ubuntu5.3 slapd 2.4.21-0ubuntu5.3 What I'm wondering is, if there's a minor release that I can install on my servers. I've searched the official Ubuntu repositories and they don't seem to offer an updated package, so I realize that building the package is my only option. Your input is highly appreciated. -- Khosrow

2 1

auto incrementing digit pool
by mike＠grounded.net 28 Jan '11

28 Jan '11

Is there a way of creating an attribute which can be assigned a value which auto increments using an external file. In other words, say I use the employeeNumber attribute but I want the value to be entered by picking the next value from a file. In my file, I might have 000123 000124 000125 000126 000127 Then when I run an ldap connection from my remote application, it would pick the next number if it doesn't exist on any account. The next problem is I don't know how ldap works in terms of keeping track of things. When I sync my application database with ldap, does it, or can it, check all of the users to see if a value is assigned or is that beyond it's functions? Or, would keeping track of the values be something which needs to be done on the application side? The programmers tell me that there is no means of going back to ldap to identify if a user has been assigned a value, therefore, assign the next.

1 0

Failover Failure Advice
by Anton Chu 28 Jan '11

28 Jan '11

I've setup a master and slave ldap service for failover; however, I'd like some advice on how to keep the ldap clients cached with the ldap creds if ever the master and slave ldap server goes. I've tried to extend the time of the caching on nscd - name server caching daemon - but it doesnt work when I add ldap users to certain groups. I've also tried pam caching credentials but doesn't work that well either. Finally, I also tried sssd but couldn't get it to work on my Ubuntu 10.10 clients. Anyone have simple solution that works when slave and master ldap servers get out of commission? I've thought about getent passwd >> /etc/passwd cron job, etc.

5 6

Setting OPENLDAP_FD_SETSIZE on an existing directory
by George Siddiqui 28 Jan '11

28 Jan '11

Hi, I recieved my first of these errrors from openldap server today. slapd[1648]: warning: cannot open /etc/hosts.deny: Too many open files The faqomatic suggest that I do the following: env CPPFLAGS="-DOPENLDAP_FD_ SETSIZE=8192" ./configure http://www.openldap.org/faq/data/cache/1126.html Is there anyway I can set this without having to build openldap again? Best regards, George -- George Siddiqui Systems BlueBolt Ltd 15-16 Margaret Street London W1W 8RW Tel: +44 207 637 5575 Mob: +44 7984 278 483

2 2

Translucent proxy as syncrepl consumer
by Raphael Ordinas 28 Jan '11

28 Jan '11

Hi everyone, I'm trying to setup a translucent proxy which is populating his local database as a syncrepl consumer. It works fine, changes on the master are replicated to the translucent, but i get an error in logs. Here is the extract from logs : bdb_modify: updated id=0000010d dn="uid=testuser,ou=people,dc=domain,dc=local" send_ldap_result: conn=-1 op=0 p=0 send_ldap_result: err=0 matched="" text="" syncrepl_entry: rid=002 be_modify uid=testuser,ou=people,dc=domain,dc=local (0) slap_queue_csn: queing 0x801de5670 20110127172543.325840Z#000000#000#000000 ==> translucent_modify: dc=domain,dc=local send_ldap_result: conn=-1 op=0 p=0 send_ldap_result: err=32 matched="" text="attempt to modify nonexistent local record" syncrepl_updateCookie: rid=002 be_modify failed (32) How can i solve this ? Tanks, Raphael

1 0

Subscribe question
by Stanczak Slawomir 28 Jan '11

28 Jan '11

I'm not developer of OpenLDAP Software. I'm ordinary end user. OpenLDAP Software discussion list is now shutdown. Can you tell what does it mean? Where can I send my questions when I have a problems with new OpenLDAP sotfware? Really on OpenLDAP-technical list? And maybe OpenLDAP team not supporting software discussion list for ordinary end user now? I'm very sorry but I don't understand this at all. Send me please short information about it. Regards Slawomir Stanczak

2 1

RE: openldap-technical Digest, Vol 38, Issue 26
by Alexey Shalin 28 Jan '11

28 Jan '11

Hello, can you please help me pwdExpireWarning I have setuped pwdExpireWarning 300 *5 min* then UI updated password for user 0000: 30 6d 02 01 02 64 68 04 1f 75 69 64 3d 6d 61 78 0m...dh..uid=max 0010: 2c 6f 75 3d 75 73 65 72 73 2c 6f 75 3d 74 72 61 ,ou=users,ou=tra 0020: 6e 73 6d 61 73 74 65 72 30 45 30 1e 04 0b 6f 62 nsmaster0E0...ob 0030: 6a 65 63 74 43 6c 61 73 73 31 0f 04 0d 69 6e 65 jectClass1...ine 0040: 74 4f 72 67 50 65 72 73 6f 6e 30 23 04 0e 70 77 tOrgPerson0#..pw 0050: 64 43 68 61 6e 67 65 64 54 69 6d 65 31 11 04 0f dChangedTime1... 0060: 32 30 31 31 30 31 32 38 30 37 35 34 33 31 5a 20110128075431Z After 5 minutes, if a user tries to connect to the database, it must issue a message, right ? -------------------------------------------------- This attribute controls whether and when a warning message of password expiration will be returned on a bind attempt. -------------------------------------------------- But nothing happen.. :( I have this ppolice : dn: cn=std, ou=ppolicy, ou=transmaster pwdCheckModule: check_password.so pwdMaxFailure: 6 pwdMustChange: TRUE pwdAttribute: userPassword pwdMinLength: 7 pwdSafeModify: FALSE pwdInHistory: 4 pwdGraceAuthNLimit: 3 pwdCheckQuality: 1 objectClass: pwdPolicy objectClass: top objectClass: device objectClass: pwdPolicyChecker pwdLockoutDuration: 60 cn: std pwdAllowUserChange: TRUE pwdExpireWarning: 300 pwdLockout: TRUE Thank you -----Original Message----- From: openldap-technical-bounces(a)OpenLDAP.org [mailto:openldap-technical-bounces@OpenLDAP.org] On Behalf Of openldap-technical-request(a)OpenLDAP.org Sent: Thursday, January 27, 2011 6:00 PM To: openldap-technical(a)openldap.org Subject: openldap-technical Digest, Vol 38, Issue 26 Send openldap-technical mailing list submissions to openldap-technical(a)openldap.org To subscribe or unsubscribe via the World Wide Web, visit http://www.openldap.org/lists/mm/listinfo/openldap-technical or, via email, send a message with subject or body 'help' to openldap-technical-request(a)openldap.org You can reach the person managing the list at openldap-technical-owner(a)openldap.org When replying, please edit your Subject line so it is more specific than "Re: Contents of openldap-technical digest..." Send openldap-technical mailing list submissions to openldap-technical(a)openldap.org When replying, please edit your Subject: header so it is more specific than "Re: openldap-technical digest..." Today's Topics: 1. Re: Replication monitoring (Andreas Andersson) 2. Re: Replication monitoring (Peter Boosten) 3. Re: problem with limits configuration (Dan Pritts) 4. Re: Replication monitoring (Peter Boosten) 5. Re: Replication monitoring (Peter Boosten) 6. Re: Failover Failure Advice (Anton Chu) 7. Re: Failover Failure Advice (Quanah Gibson-Mount) 8. Re: Failover Failure Advice (Chris Jacobs) 9. Re: slapd logging in chroot() environment (Peter Palmreuther) 10. Re: slapd logging in chroot() environment (Dieter Kluenter) 11. meta directory backend and rewriting option '|' (Lehnert, Hartmut) 12. constraint overlay question (jarek) 13. openldap memberof attribute (Vincent Li) 14. deleting schema elements from cn=config (Tim Gustafson) 15. Re: openldap memberof attribute (Michael Str?der) 16. MemberOf attribute not being returned (Mark Cairney) ---------------------------------------------------------------------- Message: 1 Date: Wed, 26 Jan 2011 19:32:22 +0100 From: Andreas Andersson <zreoxx(a)gmail.com> To: Peter Boosten <peter(a)boosten.org> Cc: openldap-technical(a)openldap.org Subject: Re: Replication monitoring Message-ID: <7705A370-58E9-4D18-ACF1-9E287851835E(a)gmail.com> Content-Type: text/plain; charset="windows-1252" Hi! Thanks. Made a note about the config directory. I've focused on following the FHS: http://www.pathname.com/fhs/ As it is a symlink it should be possible to put the config directory wherever you want (I guess that's what you did). How about replication verification? Can you confirm that its working? Regards - Andreas On Jan 26, 2011, at 10:19 AM, Peter Boosten wrote: > > On 24 jan 2011, at 18:55, Andreas Andersson wrote: > >> As always? I appreciate all feedback I can get > > > This actually looks quite decent: it needs some tinkering if you do not follow the installation guide (I don't want my /etc directory cluttered with software installed by me, for FreeBSD that's /usr/local/etc), but it's nice and easy to use. > > > -- > Peter Boosten > http://www.boosten.org > > >

1 0

slapo-cache and searches by dynlist (with !)
by Angel L. Mateo 27 Jan '11

27 Jan '11

Hello, I'm trying to use pcache overlay to cache queries done by dynlist overlay. This is the configuration I have: database hdb suffix <userSuffix> ... overylay dynlist dynlist-attrset labeledURIObject labeledURI # This is because, data obtained by dynlist is in another ldap directory database ldap suffix dc=mydomain,dc=com access ... uri ldap:/<anotherldap> ... overlay pcache pcache hdb 1000 1 10 60 pcacheAttrset 0 irisClassifCode sn1 givenName pcacheMaxQueries 10000 pcacheTemplate (&(objectClass=)(irisPersonalUniqueId=)) 0 3600 directory /var/lib/ldap/cachepublica cachesize 100 The pcacheTemplate is because labeledURI attributes are in the form: labeledURI: ldap:///dc=mydomain,dc=com?irisClassifCode,sn1,givenName?one? (irisPersonalUniqueID=<someCode>) The final search done in the final ldap directory is: filter="(&(!(objectClass=labeledURIObject))(irisPersonalUniqueID=<someCode>))" so I think I need to negate the search in the pcacheTemplate, but I can't because I get the error: /etc/ldap/slapd.conf: line 419: unable to parse template: AttributeDescription contains inappropriate characters. whenever I try to put the '!' in the template. Is there any way to cache this kind of query? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 868887590 Fax: 868888337

1 0

MemberOf attribute not being returned
by Mark Cairney 27 Jan '11

27 Jan '11

Hi, I'm sure this was working in the past on this server but Im now not getting anything returned when I request the memberOf attribute. I compiled OpenLDAP 2.4.23 with the following flags: ./configure --prefix=/usr/local/authz --enable-meta --enable-ldap --enable-bdb --enable-monitor --enable-syncprov --enable-translucent --enable-memberof --enable-dyngroup --enable-dynlist --with-threads --with-tls --with-cyrus-sasl --enable-syslog --enable-spasswd cd make depend make make test make install I'm using slapd.d and I have the following in /usr/local/authz/etc/openldap/slapd.d/cn=config/olcDatabase={1}bdb olcOverlay={0}dynlist.ldif olcOverlay={1}memberof.ldif olcOverlay={2}syncprov.ldif The contents of olcOverlay\=\{1\}memberof.ldif are: dn: olcOverlay={1}memberof objectClass: olcOverlayConfig objectClass: olcMemberOf olcMemberOfDangling: ignore olcMemberOfRefInt: FALSE olcMemberOfGroupOC: posixGroup olcMemberOfMemberAD: member olcMemberOfMemberOfAD: memberOf structuralObjectClass: olcMemberOf entryUUID: 4d5a3aa8-fbac-45c9-b259-941d13e02724 creatorsName: cn=config createTimestamp: 20100318151149Z entryCSN: 20100318151149.488341Z#000000#003#000000 modifiersName: cn=config modifyTimestamp: 20100318151149Z olcOverlay: {1}memberof The log is attached. -- The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336. Any ideas? The only thing I've changed recently is the ACLs Kind regards, Mark /********************************* Mark Cairney ITI UNIX Section Information Services University of Edinburgh Tel: 0131 650 6565 Email: mark.cairney(a)ed.ac.uk *********************************/

2 2

RE: MemberOf attribute not being returned
by Mark Cairney 27 Jan '11

27 Jan '11

Nevermind, I think I know what's happening. My user account was updated on our current live server running OpenLDAP 2.3 which doesn't have the MemberOf overlay. When this change was applied using syncrepl the memberOf field must have been removed. I'll take the old server out of the syncrepl but in the meantime is there any way to ensure this field is preserved when provisioning accounts in LDAP? Kind regards, Mark /********************************* Mark Cairney ITI UNIX Section Information Services University of Edinburgh Tel: 0131 650 6565 Email: mark.cairney(a)ed.ac.uk *********************************/ -- The University of Edinburgh is a charitable body, registered in Scotland, with registration number SC005336.

1 0

openldap memberof attribute
by Vincent Li 27 Jan '11

27 Jan '11

Hi, I am doing remote authentication using OpenLDAP to login BIGIP, BIGIP has a feature called remoterole to search attribute 'memberof' from LDAP server and once found the attribute, assign the remote user a role defined in various groups like admin, operator... the feature works for Active Directory, but I am unable to make it work for OpenLDAP, I couldn't find 'memberof' attribute in OpenLDAP schema, so I created the 'memberof' attribute in core.schema as below: [root@centos-vli schema]# diff -u core.schema core.schema.orig --- core.schema 2011-01-24 23:54:42.000000000 -0800 +++ core.schema.orig 2011-01-24 23:46:11.000000000 -0800 @@ -345,10 +345,6 @@ DESC 'X.520(4th): pseudonym for the object' SUP name ) -attributetype ( 2.5.4.66 NAME 'memberof' - DESC 'RFC2256: member of a group' - SUP distinguishedName ) - # Standard object classes from RFC2256 # system schema @@ -425,7 +421,7 @@ objectclass ( 2.5.6.9 NAME 'groupOfNames' DESC 'RFC2256: a group of names (DNs)' SUP top STRUCTURAL - MUST ( member $ memberof $ cn ) + MUST ( member $ cn ) MAY ( businessCategory $ seeAlso $ owner $ ou $ o $ description ) ) objectclass ( 2.5.6.10 NAME 'residentialPerson' and here is my sample ldif file: dn: ou=groups,dc=example,dc=com objectclass:organizationalunit ou: groups description: generic groups branch # create the itpeople entry under groups dn: cn=administrator,ou=groups,dc=example,dc=com objectclass: groupofnames cn: administrator description: bigip admin group member: uid=user5,ou=people,dc=example,dc=com dn: uid=user5,ou=People,dc=example,dc=com uid: user5 cn: user5 objectClass: top objectClass: posixaccount objectClass: shadowaccount objectClass: groupOfNames userPassword: secret shadowLastChange: 14997 shadowMin: 0 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 505 gidNumber: 505 homeDirectory: /home/user5 member: cn=administrator,ou=groups,dc=example,dc=com memberof: cn=administrator,ou=groups,dc=example,dc=com I can login BIGIP fine with user5, but I can't get the administrator role defined in BIGIP, is it something I configured wrong in OpenLDAP or the problem is on BIGIP Thanks Vincent

2 1

constraint overlay question
by jarek 27 Jan '11

27 Jan '11

Hello! I'd like to configure constraint for email attribute, where email is constructed from DN in the following way: DN: uid=user, ou=emails, ou=domain.name, ou=domaingroup, ROOT_DN => email: user(a)dmain.name Is it possible ? best regards JT.

1 0

slapd logging in chroot() environment
by Peter Palmreuther 27 Jan '11

27 Jan '11

Hello, I'm running OpenLDAP 2.4.20 in a chroot()-ed environment on Solaris 10. I somehow don't get logging working. I don't see any logging making it's way through syslog. Nor do I get messages to an explicitly configured "logfile". "loglevel" is set to "stat". As soon as I start slapd using "-d ..." I see the messages in the "logfile" configured. Using "truss" I see unsuccessful tries to open "/var/run/syslog_door" until I mount -F lofs /var/run /var/openldap/var/run (with "/var/openldap" being my chroot-directory). Unluckily still no syslog logging. using "pfiles <PID>" I see slapd has got a file handle to "logfile" open. But there's not "write" to this handle in truss output either. Anybody with any idea about if and how chroot-slapd and syslog (or logfile) works? Thanks in advance. -- Best regards, Peter

3 4

deleting schema elements from cn=config
by Tim Gustafson 27 Jan '11

27 Jan '11

Hi, I'm trying to understand how to delete a schema element. I'm running slapd 2.4.23 on FreeBSD 8.1. When I try to run ldapdelete: ldapdelete -H ldap://localhost -D uid=tjg,cn=config -W -x 'cn={7}java,cn=schema,cn=config' I get the following in the log file: ---------- daemon: read activity on 18 daemon: select: listen=6 active_threads=0 tvp=zero connection_get(18) connection_get(18): got connid=1068 connection_read(18): checking for input on id=1068 op tag 0x4a, time 1296090324 conn=1068 op=1 do_delete >>> dnPrettyNormal: <cn={7}java,cn=schema,cn=config> daemon: activity on 1 descriptor <<< dnPrettyNormal: <cn={7}java,cn=schema,cn=config>, <cn={7}java,cn=schema,cn=config> conn=1068 op=1 DEL dn="cn={7}java,cn=schema,cn=config" send_ldap_result: conn=1068 op=1 p=3 send_ldap_result: err=53 matched="" text="" send_ldap_response: msgid=2 tag=107 err=53 daemon: waked daemon: select: listen=6 active_threads=0 tvp=zero conn=1068 op=1 RESULT tag=107 err=53 text= daemon: activity on 1 descriptor daemon: activity on: 18r ---------- cn={7}java,cn=schema,cn=config is empty; I've already deleted all the objectClass and attribute definitions from it, but now it seems I can't delete the schema entry itself. What am I doing wrong? Tim Gustafson Baskin School of Engineering UC Santa Cruz tjg(a)soe.ucsc.edu 831-459-5354

1 0

problem with limits configuration
by Dan Pritts 26 Jan '11

26 Jan '11

Hi all, I'm having trouble with the limits configuration in slapd.conf. I've searched the mailing list, read and re-read man pages, but I just cannot make it work properly. i've got openldap 2.4.23 built from source on RHEL5, 64-bit I'm trying to set "unlimited" size for for my syncrepl user. however, it is not directly related to syncrepl, I've tried with ldapsearch too, similar results. Here is the ldapsearch command i'm trying: ldapsearch -z 19 -x -w PASSWORDHERE -D cn=ldap_repl,ou=srvaccts,dc=internet2,dc=edu -H ldaps://ldap3.internet2.edu/ -b dc=internet2,dc=edu '(cn=*)' With this, query is limited to 19 entries as expected but when i omit the -z option, or tell it anything above 500, and i get, of course, 500 entries. Here is the limits statement from my slapd.conf: limits dn.exact="cn=ldap_repl,ou=srvaccts,dc=internet2,dc=edu" size=unlimited time=unlimited I also tried these: limits dn.exact="cn=ldap_repl,ou=srvaccts,dc=internet2,dc=edu" size=999999999 limits dn.exact="cn=ldap_repl,ou=srvaccts,dc=internet2,dc=edu" size=10000 If I instead use sizelimit size=unlimited my ldapsearch command of course gives me full results. Please help, I am clearly a knuckle-dragger. thanks, danno Dan Pritts, Sr. Systems Engineer Internet2 office: +1-734-352-4953 | mobile: +1-734-834-7224

2 2

OpenLDAP server as a proxy to AD and local auth db
by L.B. 25 Jan '11

25 Jan '11

Hi all - Thanks in advance. I know this topic has been discussed at length but I'm fairly new to it and haven't been able to find enough information to get my implementation working. I've been piecing together bits and pieces of what seems like the correct parameters, but I've had no luck... and now that I've resorted to guessing, I'd like to ask for help. So here's what I'm trying to achieve: One OpenLDAP server that will A) proxy for a backend AD server and B) maintain a local database for users that are not in AD. The AD system will be used for internal/corp users while the local db will be used for external/3rd party people. The AD system has _some_ of the unix schema attributes, but not all so I will be doing some rewriting on the openldap server. The linux workstations will use the single openldap server and will only be used by internal users and we also have some websites that are for internal/external users. For the time being, I'm just working on part A - proxy requests for these linux workstations to the backend AD server and get the proper mapping figured out. My present problem is that my openldap server is connecting anonymously to the AD server and that's no good because that's not allowed. I have a AD service account defined for the openldap server connections, and have configured the correct values for the 'idassert-bind' directive (see below). Performing a manual ldapsearch works fine when I define the same parameters on the command line, but slapd isn't using the correct parameters it seems. Below are the config files, etc for each component... I hope this helps. ./ldapsearch -vvv -H ldap://corp-ad.mascorp.com -b "dc=mascorp,dc=com" -s sub -D "cn=agis-ldap,ou=service accounts,ou=administrators,dc=mascorp,dc=com" -W I've compiled and installed bdb v4.8 and openldap v2.4.23 from source. Here's how I configured openldap: LD_LIBRARY_PATH="/usr/lib:/usr/local/lib:/cluster/centauth/BerkeleyDB.4.8/lib:/usr/local/ssl/lib" CPPFLAGS="-I/cluster/centauth/BerkeleyDB.4.8/include" LDFLAGS="-L/cluster/centauth/BerkeleyDB.4.8/lib" ./configure --prefix=/cluster/centauth/openldap2.4 --enable-shared --enable-crypt=yes --enable-rewrite=yes --enable-bdb=yes --enable-hdb=yes --enable-ldap=mod --enable-meta=mod --enable-monitor=yes --enable-relay=mod --enable-overlays=yes --with-cyrus-sasl --with-threads=posix --with-tls=openssl This is the client configuration on the linux workstation: # /etc/ldap.conf base dc=mascorp,dc=com scope sub timelimit 120 bind_timelimit 120 idle_timelimit 3600 uri ldap://sso.mascorp.com ssl no pam_password ad #eof This is the server config on the openldap server: # /cluster/centauth/etc/slapd.conf include /usr/share/openldap2.4/schema/core.schema include /usr/share/openldap2.4/schema/cosine.schema include /usr/share/openldap2.4/schema/inetorgperson.schema include /usr/share/openldap2.4/schema/nis.schema include /usr/share/openldap2.4/schema/misc.schema include /usr/share/openldap2.4/schema/corba.schema include /usr/share/openldap2.4/schema/openldap.schema include /usr/share/openldap2.4/schema/ppolicy.schema include /usr/share/openldap2.4/schema/ldapns.schema include /cluster/centauth/etc/schema/microsoft.minimal.schema pidfile /cluster/centauth/var/run/slapd.pid argsfile /cluster/centauth/var/run/slapd.args loglevel -1 monitoring on defaultsearchbase "dc=mascorp,dc=com" database ldap suffix "dc=mascorp,dc=com" uri "ldap://corp-ad.mascorp.com" acl-bind bindmethod=simple binddn="cn=agis-ldap,ou=service accounts,ou=administrators,dc=mascorp,dc=com" credentials="mofosecret" idassert-bind bindmethod=simple binddn="cn=agis-ldap,ou=service accounts,ou=administrators,dc=mascorp,dc=com" credentials="mofosecret" overlay rwm rwm-map attribute uid sAMAccountName rwm-map attribute homeDirectory unixHomeDirectory rwm-map attribute cn cn rwm-map attribute displayName displayName rwm-map attribute givenName givenName rwm-map attribute sn sn rwm-map attribute mail mail rwm-map attribute userPassword objectGUID rwm-map attribute * rwm-map objectclass posixAccount organizationalPerson rwm-map objectclass inetOrgPerson user access to dn.subtree="dc=mascorp,dc=com" by * read #eof # Pertinent logs from ldap2.4.log Jan 20 00:13:57 sso slapd[30527]: do_bind: v3 anonymous bind Jan 20 00:13:57 sso slapd[30527]: ==> limits_get: conn=1000 op=1 self="[anonymous]" this="dc=mascorp,dc=com" Jan 20 00:13:57 sso slapd[30527]: send_ldap_result: err=1 matched="" text="00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece" Thanks! Rafa

2 1

slapd : segmentation violation with Mingw/MSYS
by Jean-François Berne 25 Jan '11

25 Jan '11

Hello * I need help from experienced users concerning openLDAP under Mingw : I get a SIGSEGV upon slapd invocation. Please take a look at what I did and tell what I do wrong. Perhaps someone already had this problem. The SIGSEGV is at the end. ----- SETUP and build openLDAP ----- 0. GCC 4.5.2, GNU Make 3.81, Mingw/MSYS on WinXP Home/SP3 1. openLDAP config is small: with TLS, no Cyrus-SASL, no Berkeley DB, none overlay. $ configure \ --disable-bdb --disable-hdb \ --disable-overlays \ --with-tls \ --prefix=/mingw/openldap-2.4.23 --build=i686-pc-mingw32 $ make > make_all.log 2>&1 $ make install > make_install.log 2>&1 Nothing fancy here. 2. For the sake of completion, here are the warnings of 'make all' - tls_o.c:666:4: warning: assignment discards qualifiers from pointer target type - threads.c:110:2: warning: '_sleep' is deprecated (declared at c:\mingw\bin\../lib/gcc/mingw32/4.5.2/../../../../include/stdlib.h:408) - In file included from passwd.c:85:0: ../../include/ldap_pvt.h:355:30: attention : 'struct timeval' declared inside parameter list ../../include/ldap_pvt.h:355:30: attention : visible uniquement depuis cette définition ou déclaration, ce qui n'est probablement pas ce que vous désirez Let me know if you detect something here. 3. for the time being I config'd slapd like this: .../etc/slapd.conf include C:\\MinGW\\openldap-2.4.23\\etc\\openldap/schema/core.schema pidfile C:\\MinGW\\openldap-2.4.23\\var/run/slapd.pid argsfile C:\\MinGW\\openldap-2.4.23\\var/run/slapd.args database "ldif" suffix "dc=(deleted),dc=org" rootdn "cn=Manager,dc=(deleted),dc=org" rootpw secret directory C:\\MinGW\\openldap-2.4.23\\var/openldap-data/ldif --- RUN --- 0. PATH = /mingw/openldap-2.4.23/libexec:/mingw/openldap-2.4.23/bin:.:/usr/local/bin:/mingw/bin:/bin:/c/WINDOWS/system32:/c/WINDOWS:/c/WINDOWS/System32/Wbem:/c/Programme/OpenSSH/bin:/c/Programme/GnuTLS-2.10.1/bin 1. gdb slapd 2. result: you can spot SIGSEGV right at the beginning. GNU gdb (GDB) 7.2 [...] This GDB was configured as "mingw32". [...] Reading symbols from C:\MinGW\openldap-2.4.23\libexec/slapd.exe...(no debugging symbols found)...done. (gdb) start Function "main" not defined. Make breakpoint pending on future shared library load? (y or [n]) n Starting program: C:\MinGW\openldap-2.4.23\libexec/slapd.exe [New Thread 3572.0xbbc] Program received signal SIGSEGV, Segmentation fault. 0x6086ec49 in msys-1!getuid () from C:\MinGW\msys\1.0\bin\msys-1.0.dll (gdb) quit Fazit : I am not experienced enough to know where to start looking. Any help will be appreciated. Thank you, JF

2 1

Starttls and SSL
by ldap＠mm.st 24 Jan '11

24 Jan '11

I am in the process of moving our older existing openldap server infrastructure that we use to authenticate multiple users to our Linux infrastructure to use RH5 openldap 2.3 server. The current ldap servers support starttls and listen on 389 and 636. We want to continue with this setup. While sniffing traffic using tcpdump and using various ldapsearch options I noticed that if the client doesn't request starttls or connect on 636 is is possible to grab a users ldap record and the transmission is in clear text. If I authenticate to the server using the -W option to ldapsearch the record is sent with the SSHA encrypted password. Also in the in the tcpdump stream my password I use to authenticate to the server is sent in clear text. I guess this behavior is expected since the server is listening on 389 and it is up to the client to initialize the starttls session, but I was wondering if there was a way to force the server to only use starttls on 398 and not rely on the the client to set up starttls? One option would be to only have the server start on 636 and not have it listen on 389, but we would like to keep the same functionality if possible. Am I missing something obvious? The only option that I see as a possiblity is the TLSVerifyClient { never | allow | try | demand } in slapd.conf. But, it's unclear to me if this will provide the desired effect.

2 1

how to compile openldap with database ldbm module?
by Olivier PAVILLA 24 Jan '11

24 Jan '11

Hi everyone. I'm on Debian Lenny 64bit. So I want to LDAP with database ldbm. But it appears there is no way on debian. I got openldap 2.4.23. I did ./configure --help It gave me this SLAPD Backend Options: --enable-backends enable all available backends no|yes|mod --enable-bdb enable Berkeley DB backend no|yes|mod [yes] --enable-dnssrv enable dnssrv backend no|yes|mod [no] --enable-hdb enable Hierarchical DB backend no|yes|mod There is no ldbm module anymore or what? -- Olivier Pavilla << 仕事を探しています。求職中です。>> S.C.I.R.C. Orléans (Bourgogne) - I.U.F.M. Centre-Val de Loire 72 Rue du Faubourg Bourgogne -45044 ORLEANS Cedex 1 Tel : 02-38-49-26-20 , mailto:olivier.pavilla@univ-orleans.fr http://blog.linux-squad.com - 僕の傑作です。 "Acheté un Iphone c'est cautionné l'esclavage humain..."

2 1

CLI remotes write, php remotes can't
by mike＠grounded.net 24 Jan '11

24 Jan '11

I'm trying to find leads on what else to look for with this problem. Locally, I can create users, etc. From remote centos servers, I can create and read account info from command line. However, from remotes using php-ldap, I cannot create users, only read. I'm not sure what to provide for info just yet as there are too many variables but on the other hand, someone might immediately know what the answer is. I suspect something to do with php-ldap, perhaps a config or something that's not allowing writes?

4 8

Exported group can't be imported again: Invalid syntax (21) additional info: objectClass: value #0 invalid per syntax
by Thomas Schweikle 23 Jan '11

23 Jan '11

Hi! I've exported groups from a ldap server. Importin the very same group fails: ldap_add: Invalid syntax (21) additional info: objectClass: value #0 invalid per syntax schema inetorgperson is, among others included. The group I want to add: dn: cn=somegroup,ou=Groups,dc=example,dc=org objectClass: posixGroups objectClass: top gidNumer: 3000 cn: somegroup memberUid: someuser Command: # ldapadd -D cn=manager,dc=example,dc=org -W dn: cn=somegroup,ou=Groups,dc=example,dc=org objectClass: posixGroups objectClass: top gidNumer: 3000 cn: somegroup memberUid: someuser adding new entry "cn=somegroup,ou=Groups,dc=example,dc=org" ldap_add: Invalid syntax (21) additional info: objectClass: value #0 invalid per syntax Any ideas? -- Thomas

4 5

Kerberized LDAP not accessible
by Thomas Schweikle 23 Jan '11

23 Jan '11

Hi! I kerberized ldap: dn: cn=config objectClass: olcGlobal cn: config olcAuthzRegexp: uid=(.*),cn=example.com,cn=gssapi,cn=auth uid=$1,ou=Users,dc=example,dc=com olcSaslHost: srv.example.com olcSaslRealm: EXAMPLE.COM In /etc/ldap/ldap.conf: BASE dc=example,dc=com URI ldap://srv.example.com SASL_MECH GSSAPI In /etc/ldap.conf base dc=example,dc=com uri ldap://srv.example.com ldap_version 3 rootbinddn cn=adm,dc=example,dc=com pam_password md5 I now try to connect to my ldap server: client:~$ kinit user Password for user(a)EXAMPLE.COM: client:~$ klist Ticket cache: FILE:/tmp/krb5cc_1000 Default principal: user(a)EXAMPLE.COM Valid starting Expires Service principal 01/21/11 11:32:03 01/21/11 21:32:03 krbtgt/EXAMPLE.COM(a)EXAMPLE.COM renew until 01/22/11 11:31:58 client:~$ ldapsearch -H ldap://srv.example.com SASL/DIGEST-MD5 authentication started Please enter your password: ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: SASL(-13): user not found: no secret in database client:~$ ldapsearch -D uid=user,dc=example,dc=com -H ldap://srv.example.com ldap_bind: Server is unwilling to perform (53) additional info: unauthenticated bind (DN with no password) disallowed The user in question exists: dn: cn=user user,ou=Users,dc=example,dc=com givenName: user sn: user cn: user user uid: user objectClass: inetOrgPerson objectClass: posixAccount objectClass: top uidNumber: 1000 gidNumber: 1000 homeDirectory: /home/user loginShell: /bin/zsh Any idea what is wrong? As far as I see: I do have a tgt and thus I shall be authenticated. But I am not granted access! Any idea why? -- Thomas

5 12

RE: How to enable 'pwdPolicySubentry' in ppolicy.schema
by Alexey Shalin 21 Jan '11

21 Jan '11

Thank you for your reply. But then how can I use this: dn: cn=search,ou=users,ou=my_dn changetype: modify add: pwdPolicySubentry pwdPolicy: "cn=user,ou=pwpolicies,ou=my_dn" I want to exclude user: search from default policy >From docs: Finally the account entry for the user(s) to whom this policy applies are modified to point to the specific policy using the following LDIF fragment: # point the users entry to the specific policy dn: cn=John Smith,ou=people,dc=example,dc=com changetype: modify add: pwdPolicySubentry pwdPolicy: "cn=user,ou=pwpolicies,dc=example,dc=com" ------------------------------------------------------------------------ ---- When I tried run it in my LDAP browser I got: Line 4, Column 0: Unexpected line found: 'pwdPolicy: "cn=user,ou=pwpolicies,ou=my_dn"'. Line 4, Column 0: The 'add' modification operation must have at least one value specified (Attribute: 'pwdPolicySubentry'). Line 4: Unexpected end of LDIF file. The last record will not be committed. Import data complete. Elapsed time: 0:00. Entries processed: 0. Warning(s): 0, error(s): 3. Can you please tell may be another way, how to exclude user:search from: dn: cn=std, ou=ppolicy, ou=my_dn pwdCheckModule: check_password.so pwdMaxFailure: 6 pwdMustChange: TRUE pwdAttribute: userPassword pwdMinLength: 7 pwdSafeModify: FALSE pwdInHistory: 4 pwdGraceAuthNLimit: 3 pwdCheckQuality: 1 objectClass: pwdPolicy objectClass: top objectClass: device objectClass: pwdPolicyChecker pwdLockoutDuration: 18 pwdAllowUserChange: TRUE pwdExpireWarning: 432000 pwdLockout: TRUE pwdMaxAge: 7776000 Thank you -----Original Message----- From: Howard Chu [mailto:hyc@symas.com] Sent: Friday, January 21, 2011 9:36 AM To: Alexey Shalin Cc: openldap-technical(a)openldap.org Subject: Re: How to enable 'pwdPolicySubentry' in ppolicy.schema Alexey Shalin wrote: > Hello, > > How to enable 'pwdPolicySubentry' in ppolicy.schema, I added this into > ppolicy.schema Never modify the schema files distributed with OpenLDAP. > attributetype ( 1.3.6.1.4.1.42.2.27.8.1.23 > > NAME 'pwdPolicySubentry' > > DESC 'The pwdPolicy subentry in effect for this object' > > EQUALITY distinguishedNameMatch > > SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 > > SINGLE-VALUE > > USAGE directoryOperation ) > > But after that my slapd do not started. Of course. Schema files are only for defining user attributes. Operational attributes must be implemented in code and cannot be defined from a schema config file. This particular attribute is already implemented in the ppolicy overlay so there is no need to define it again anyway. > should I upgrade openldap to the last ver ? That would make no difference here, but it's always best to stay up to date. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/ __________ Information from ESET NOD32 Antivirus, version of virus signature database 5804 (20110120) __________ The message was checked by ESET NOD32 Antivirus. http://www.esetnod32.ru/.ml __________ Information from ESET NOD32 Antivirus, version of virus signature database 5804 (20110120) __________ The message was checked by ESET NOD32 Antivirus. http://www.esetnod32.ru/.ml

1 0

How to enable 'pwdPolicySubentry' in ppolicy.schema
by Alexey Shalin 21 Jan '11

21 Jan '11

Hello, How to enable 'pwdPolicySubentry' in ppolicy.schema, I added this into ppolicy.schema attributetype ( 1.3.6.1.4.1.42.2.27.8.1.23 NAME 'pwdPolicySubentry' DESC 'The pwdPolicy subentry in effect for this object' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE USAGE directoryOperation ) But after that my slapd do not started. bash-2.05# /usr/local/libexec/slapd -h ldaps:/// -d 259 @(#) $OpenLDAP: slapd 2.4.16 (May 23 2009 06:45:03) $ steve@solaris9:/bigdisk/SOURCES/S9/openldap-2.4.16/servers/slapd ldap_pvt_gethostbyname_a: host=rtps, r=0 daemon_init: listen on ldaps:/// daemon_init: 1 listeners to open... ldap_url_parse_ext(ldaps:///) daemon: listener initialized ldaps:/// daemon_init: 2 listeners opened ldap_create slapd init: initiated server. slap_sasl_init: initialized! bdb_back_initialize: initialize BDB backend bdb_back_initialize: Berkeley DB 4.7.25: (May 15, 2008) hdb_back_initialize: initialize HDB backend hdb_back_initialize: Berkeley DB 4.7.25: (May 15, 2008) null_back_initialize: initialize null backend slapd destroy: freeing system resources. slapd stopped. connections_destroy: nothing to destroy. bash-2.05# should I upgrade openldap to the last ver ? ------------------------------------------------------------------------------- С уважением, Алексей Шалин Системный Администратор Отдел системного администрирования ЗАО "Межбанковский процессинговый центр" 720083, Кыргызская Республика г. Бишкек, ул. Ауэзова 1/2 тел.: +996 (312) 637738 (вн. 138) факс: +996 (312) 637748 e-mail: a.shalin(a)ipc.kg

2 1

can be an hdb root?
by Christ Schlacta 21 Jan '11

21 Jan '11

can I create an hdb root of ? I would like to set up a server for testing, and i'm wondering if I can configure my server such that the root is essentially "", or "Empty String", so that I can add dc=testing,dc=com, or I can add ou=test1,...testn, or I can add anything else I want for experimenting with and learning how many features of openldap work, without having to constantly reconfigure my root, or be trapped in one awkwardly long root.

2 1

nss_override_attribute_value
by Hugo Monteiro 20 Jan '11

20 Jan '11

Hello, I was wondering if there are any plans to make nss_override/default_attribute_value allow the use of env vars to perform substitutions. Something along the line of nss_override_attribute_value homeDirectory /home/users/${USER} This would allow great flexibility, specially when combined with pam_env and such. Regards, Hugo Monteiro. -- fct.unl.pt:~# cat .signature Hugo Monteiro Email : hugo.monteiro(a)fct.unl.pt Telefone : +351 212948300 Ext.15307 Web : http://hmonteiro.net Divisão de Informática Faculdade de Ciências e Tecnologia da Universidade Nova de Lisboa Quinta da Torre 2829-516 Caparica Portugal Telefone: +351 212948596 Fax: +351 212948548 www.fct.unl.pt apoio(a)fct.unl.pt fct.unl.pt:~# _

2 2

Best and most efficient way to upgrade openLDAP
by Ghyslain Tissot 18 Jan '11

18 Jan '11

Hello, We are looking for input on how to upgrade openLDAP from 2.2 to 2.3. We have looked and it seems the only documented way to upgrade is by unloading and reloading the data which is very time consuming (approx. 8-10 hours). Since this is a production system it is not adequate. What options are available? To give more more background: - there are currently approximately 7M entries in the LDAP; - we are migrating to a new server with a new version of openLDAP (dependant on RHEL version - previously RHEL 4 now RHEL 5); - we tried the option creating a staging server with 2.2 and importing on the new system (v2.3) the extracted data on the new system. Then we activated replication (SLURPD) between the two and tried updating the staging server with the transaction logs of production hoping the data would then replicate to the new system. But that does not work. Any ideas on how it can be done with minimal impact to the current LDAP and reducing the outage period?

3 2

No remote writes, only reads
by mike＠grounded.net 17 Jan '11

17 Jan '11

ldap_bind: Can't contact LDAP server (-1) On local server, I can write to LDAP server. From any remote server, I can only read from server. I don't have TLS enabled, that I know of, nothing in slapd.conf at least. I do see tls_cacertdir /etc/openldap/cacerts in the /etc/ldap.conf. I don't see anything for errors in the log file when remotes fail. The 389 port is open, no selinux or iptables or any other firewall in the way. Been searching google for hours, finding a ton of leads all of them dead ends. Wondering if someone could help me out and give me some leads on what to look for next. Thanks.

4 9

"slapadd: corrupted double-linked list"
by Marc Patermann 17 Jan '11

17 Jan '11

Hi, what could the following possibly be? When I do a # slapadd -q -v -c -l dump.ldif to a SLES 11 SP1 (openldap 2.3.20) I get this after a few 1000 entries: *** glibc detected *** slapadd: corrupted double-linked list: 0x00007f3ef0cb9920 *** ======= Backtrace: ========= /lib64/libc.so.6(+0x75018)[0x7f3eedeb2018] /lib64/libc.so.6(+0x76e0e)[0x7f3eedeb3e0e] /lib64/libc.so.6(+0x7ad91)[0x7f3eedeb7d91] /lib64/libc.so.6(realloc+0xfa)[0x7f3eedeb81aa] /usr/lib64/liblber-2.4.so.2(ber_memrealloc_x+0x48)[0x7f3eeffd4f48] slapadd(ldif_read_record+0x121)[0x7f3ef07bcd81] slapadd(slapadd+0x28b)[0x7f3ef070426b] slapadd(main+0xd4)[0x7f3ef0678b84] /lib64/libc.so.6(__libc_start_main+0xe6)[0x7f3eede5bbc6] slapadd(+0x2d509)[0x7f3ef0678509] ======= Memory map: ======== 7f3ecc000000-7f3ecc021000 rw-p 00000000 00:00 0 7f3ecc021000-7f3ed0000000 ---p 00000000 00:00 0 7f3ed0364000-7f3ed037a000 r-xp 00000000 08:02 48688 /lib64/libgcc_s.so.1 7f3ed037a000-7f3ed0579000 ---p 00016000 08:02 48688 /lib64/libgcc_s.so.1 7f3ed0579000-7f3ed057a000 r--p 00015000 08:02 48688 /lib64/libgcc_s.so.1 7f3ed057a000-7f3ed057b000 rw-p 00016000 08:02 48688 /lib64/libgcc_s.so.1 7f3ed057b000-7f3ed094c000 rw-p 00000000 00:00 0 7f3ed094c000-7f3ed1308000 rw-s 00000000 fd:05 172038 /var/lib/ldap/main-data/__db.003 7f3ed1308000-7f3ed16d9000 rw-p 00000000 00:00 0 7f3ed16d9000-7f3ed681b000 rw-s 00000000 fd:05 49158 /var/lib/ldap/human-data/__db.003 7f3ed681b000-7f3ed6d09000 rw-s 00000000 fd:05 49157 /var/lib/ldap/human-data/__db.002 7f3ed6d09000-7f3ed70da000 rw-p 00000000 00:00 0 7f3ed70da000-7f3eeb0dc000 rw-s 00000000 fd:05 335878 /var/lib/ldap/linux-data/__db.003 7f3eeb0dc000-7f3eeba8a000 rw-s 00000000 fd:05 335877 /var/lib/ldap/linux-data/__db.002 7f3eeba8a000-7f3eebaa7000 r-xp 00000000 fd:0a 163907 /usr/lib/openldap/modules/back_meta-2.4.so.2.5.3 7f3eebaa7000-7f3eebca6000 ---p 0001d000 fd:0a 163907 /usr/lib/openldap/modules/back_meta-2.4.so.2.5.3 7f3eebca6000-7f3eebca7000 r--p 0001c000 fd:0a 163907 /usr/lib/openldap/modules/back_meta-2.4.so.2.5.3 7f3eebca7000-7f3eebca8000 rw-p 0001d000 fd:0a 163907 /usr/lib/openldap/modules/back_meta-2.4.so.2.5.3 7f3eebca8000-7f3eebcac000 r-xp 00000000 fd:0a 795580 /usr/lib64/sasl2/libanonymous.so.2.0.22 7f3eebcac000-7f3eebeab000 ---p 00004000 fd:0a 795580 /usr/lib64/sasl2/libanonymous.so.2.0.22 7f3eebeab000-7f3eebeac000 r--p 00003000 fd:0a 795580 /usr/lib64/sasl2/libanonymous.so.2.0.22 7f3eebeac000-7f3eebead000 rw-p 00004000 fd:0a 795580 /usr/lib64/sasl2/libanonymous.so.2.0.22 7f3eebead000-7f3eebeaf000 r-xp 00000000 08:02 48656 /lib64/libkeyutils-1.2.so 7f3eebeaf000-7f3eec0ae000 ---p 00002000 08:02 48656 /lib64/libkeyutils-1.2.so 7f3eec0ae000-7f3eec0af000 r--p 00001000 08:02 48656 /lib64/libkeyutils-1.2.so 7f3eec0af000-7f3eec0b0000 rw-p 00002000 08:02 48656 /lib64/libkeyutils-1.2.so 7f3eec0b0000-7f3eec0b7000 r-xp 00000000 fd:0a 778733 /usr/lib64/libkrb5support.so.0.1 7f3eec0b7000-7f3eec2b7000 ---p 00007000 fd:0a 778733 /usr/lib64/libkrb5support.so.0.1 7f3eec2b7000-7f3eec2b8000 r--p 00007000 fd:0a 778733 /usr/lib64/libkrb5support.so.0.1 7f3eec2b8000-7f3eec2b9000 rw-p 00008000 fd:0a 778733 /usr/lib64/libkrb5support.so.0.1 7f3eec2b9000-7f3eec2bc000 r-xp 00000000 08:02 48700 /lib64/libcom_err.so.2.1 7f3eec2bc000-7f3eec4bb000 ---p 00003000 08:02 48700 /lib64/libcom_err.so.2.1 7f3eec4bb000-7f3eec4bc000 r--p 00002000 08:02 48700 /lib64/libcom_err.so.2.1 7f3eec4bc000-7f3eec4bd000 rw-p 00003000 08:02 48700 /lib64/libcom_err.so.2.1 7f3eec4bd000-7f3eec4e1000 r-xp 00000000 fd:0a 778721 /usr/lib64/libk5crypto.so.3.1 7f3eec4e1000-7f3eec6e0000 ---p 00024000 fd:0a 778721 /usr/lib64/libk5crypto.so.3.1 7f3eec6e0000-7f3eec6e2000 r--p 00023000 fd:0a 778721 /usr/lib64/libk5crypto.so.3.1 7f3eec6e2000-7f3eec6e3000 rw-p 00025000 fd:0a 778721 /usr/lib64/libk5crypto.so.3.1 7f3eec6e3000-7f3eec781000 r-xp 00000000 fd:0a 778731 /usr/lib64/libkrb5.so.3.3 7f3eec781000-7f3eec980000 ---p 0009e000 fd:0a 778731 /usr/lib64/libkrb5.so.3.3 7f3eec980000-7f3eec983000 r--p 0009d000 fd:0a 778731 /usr/lib64/libkrb5.so.3.3 7f3eec983000-7f3eec985000 rw-p 000a0000 fd:0a 778731 /usr/lib64/libkrb5.so.3.3 7f3eec985000-7f3eec9b0000 r-xp 00000000 fd:0a 778717 /usr/lib64/libgssapi_krb5.so.2.2 7f3eec9b0000-7f3eecbaf000 ---p 0002b000 fd:0a 778717 /usr/lib64/libgssapi_krb5.so.2.2 7f3eecbaf000-7f3eecbb0000 r--p 0002a000 fd:0a 778717 /usr/lib64/libgssapi_krb5.so.2.2 7f3eecbb0000-7f3eecbb1000 rw-p 0002b000 fd:0a 778717 /usr/lib64/libgssapi_krb5.so.2.2 7f3eecbb1000-7f3eecbb8000 r-xp 00000000 fd:0a 795710 /usr/lib64/sasl2/libgssapiv2.so.2.0.22 7f3eecbb8000-7f3eecdb7000 ---p 00007000 fd:0a 795710 /usr/lib64/sasl2/libgssapiv2.so.2.0.22 7f3eecdb7000-7f3eecdb8000 r--p 00006000 fd:0a 795710 /usr/lib64/sasl2/libgssapiv2.so.2.0.22 7f3eecdb8000-7f3eecdb9000 rw-p 00007000 fd:0a 795710 /usr/lib64/sasl2/libgssapiv2.so.2.0.22 7f3eecdb9000-7f3eecdbd000 r-xp 00000000 fd:0a 795583 /usr/lib64/sasl2/liblogin.so.2.0.22 7f3eecdbd000-7f3eecfbc000 ---p 00004000 fd:0a 795583 /usr/lib64/sasl2/liblogin.so.2.0.22 7f3eecfbc000-7f3eecfbd000 r--p 00003000 fd:0a 795583 /usr/lib64/sasl2/liblogin.so.2.0.22 7f3eecfbd000-7f3eecfbe000 rw-p 00004000 fd:0a 795583 /usr/lib64/sasl2/liblogin.so.2.0.22 7f3eecfbe000-7f3eecfc3000 r-xp 00000000 fd:0a 795586 /usr/lib64/sasl2/libsasldb.so.2.0.22 7f3eecfc3000-7f3eed1c2000 ---p 00005000 fd:0a 795586 /usr/lib64/sasl2/libsasldb.so.2.0.22 7f3eed1c2000-7f3eed1c3000 r--p 00004000 fd:0a 795586 /usr/lib64/sasl2/libsasldb.so.2.0.22 7f3eed1c3000-7f3eed1c4000 rw-p 00005000 fd:0a 795586 /usr/lib64/sasl2/libsasldb.so.2.0.22 7f3eed1c4000-7f3eed1c8000 r-xp 00000000 fd:0a 795707 /usr/lib64/sasl2/libplain.so.2.0.22 7f3eed1c8000-7f3eed3c7000 ---p 00004000 fd:0a 795707 /usr/lib64/sasl2/libplain.so.2.0.22 7f3eed3c7000-7f3eed3c8000 r--p 00003000 fd:0a 795707 /usr/lib64/sasl2/libplain.so.2.0.22 7f3eed3c8000-7f3eed3c9000 rw-p 00004000 fd:0a 795707 /usr/lib64/sasl2/libplain.so.2.0.22 7f3eed3c9000-7f3eed3cd000 r-xp 00000000 fd:0a 795716 /usr/lib64/sasl2/libcrammd5.so.2.0.22 7f3eed3cd000-7f3eed5cd000 ---p 00004000 fd:0a 795716 Without the "-q" switch it is running happily till the end. Marc

8 24

modules directory
by Christ Schlacta 17 Jan '11

17 Jan '11

I've found something odd in regard to the modules directory. I ended up needing to use checkval module for ldap authentication to work properly for me. the documentation I found said to place the following in config files: checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string notfound-reject = no } at the location I wanted the check to occur, but instead I ended up needing to use just: checkval because the above code was located in modules/checkval . The question is at this point, how could I, for example, have two different checkval checks? suppose I want to check an additional attribute? I recon I need a new file, but I'm not sure if it matters what I call the new file, or, for that matter, I'm not sure what to put inside the new file, except that I'm sure it must look very similar to that above. if someone could explain the specifics of this, or tell me where to find them explained, I would much appreciate the help. one more question: can there be multiples of ANY module specified? for example, can I use two different ldap or sql modules if I were to need to (just as a bad example, I propose: 1 radius server, 2 wlans with different user bases that can't be merged into one directory for whatever reasons).

2 2

cleaning house on ldap server?
by Christ Schlacta 17 Jan '11

17 Jan '11

I've got a radius server up and running, and I want to clean up my configuration as much as possible. is it a safe assumption that if I remove a file (actually move it out of the way) and attempt to authenticate a client that if the client can successfully authenticate that everything is working? is it also safe to assume that any file with no uncommented lines is also safe to remove? I'm most interrested in removing the SQL directories and all the unused modules in the modules directory.

2 2

Re: [sipx-users] joomla ldap; joomla users not created
by mike＠grounded.net 17 Jan '11

17 Jan '11

One more thing I've wondered about is that the domain that the joomla server connecting to ldap server is different than ldap. I'm not sure if that would somehow prevent the user from being created.

1 3

joomla ldap; joomla users not created
by mike＠grounded.net 16 Jan '11

16 Jan '11

Guessing there are no joomla users on this whole list?

2 3

One root and two domain?
by gael therond 16 Jan '11

16 Jan '11

Is it possible to add a domain on an already existing root? I got the following root for now: dc=lab,dc=corp and I want to create a second Top entry on my root which will be named like this: dc=prod,dc=corp Is that possible? I've try the following syntaxe without succes. Racine.ldif: #Racine dn: dc=prod, dc=corp ObjectClass: Top ObjectClass: dcObject ObjectClass: organization o: prod.corp dc: prod #OU Groups dn: ou=groups, dc=prod, dc=geka ObjectClass: organizationalUnit ObjectClass: top ou: groups #OU Users dn: ou=users, dc=prod, dc=geka ObjectClass: organizationalUnit ObjectClass: top ou: users And then I've done the usual LdapADD command, but with the following error returned: ldap_add: Server is unwilling to perform (53) Additional info: No global Superior Knowledge. Well, my guest is that I didn't set correctly Slapd because my default root is lab.corp instead of being TLD .corp Is that theory right? Many thanks

2 2

joining several directories into a single one, then replicating it
by LALOT Dominique 16 Jan '11

16 Jan '11

Hello, We are in the process of merging several universities into a single one. As we are working on the authentication part, we already test some solutions. We put a server as a replica of our three directories, then two other replicas from this one. It works but I am not sure this is the best solution. Is it better to put a back-meta ou back-relay server for relaying data, then replication from this one? Also, if we put all data into a single one as we did, what happens if we have the same entry-uuid? Thanks in advance Dom -- Dominique LALOT Ingénieur Systèmes et Réseaux http://annuaire.univmed.fr/showuser.php?uid=lalot

1 0

error while loading shared libraries
by jptienshan 15 Jan '11

15 Jan '11

Here is a question from a newbie. I use red hat 5.5. I didn't want to use the openldap that is bundled with and installed by red hat, so I downloaded and installed BerkeleyDB-4.8.30 and openldap-2.4.23. configure, make as a non-root make install as a root user. I specified --prefix=/usr/local in both cases. For openldap, I had to export CPPFLAGS, LDFLAGS and LD_LIBRARY_PATH as follows: export CPPFLAGS="-I/usr/local/include" export LDFLAGS="-L/usr/local/lib" export LD_LIBRARY_PATH="-I/usr/local/lib" I created a slapd file and put it in /etc/init.d, chmod and chkconfig successfully. In .bashrc file, I put /usr/local/sbin and /usr/local/lib in the path. I also added this line: export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/local/lib I was able to run slappasswd and set/create a password for root. But that was the end of my successes :( As a root user, when I type "service slapd start", I get this error: //---- Starting slapd /usr/local/libexec/slapd: error while loading shared libraries: libdb-4.8.so cannot open shared object file no such file or dir. //----- Is it because my BerkeleyDB installation isn't working properly? (I don't recall any errors while installing BDB though) or something more is amiss? I can see that the file libdb-4.8.so is in /usr/local/lib How do I solve this problem? Thank you all for taking time to read. Cheers, -------------------------------------- Get the new Internet Explorer 8 optimized for Yahoo! JAPAN http://pr.mail.yahoo.co.jp/ie8/

2 2

Re: Problems importing ppolicy LDIF: LDAP_INVALID_SYNTAX
by Alexey Shalin 15 Jan '11

15 Jan '11

Could not add object cn=default,ou=Policies,dc=itelsib,dc=com Message: Invalid syntax Error code: 0x15 (LDAP_INVALID_SYNTAX) Error description: An invalid attribute value was specified. You can not use cn=default,ou=Policies,dc=itelsib,dc=com please try cn=ppolicy,ou=Policies,dc=itelsib,dc=com -----Original Message----- From: openldap-technical-bounces(a)OpenLDAP.org [mailto:openldap-technical-bounces@OpenLDAP.org] On Behalf Of openldap-technical-request(a)OpenLDAP.org Sent: Thursday, January 13, 2011 6:00 PM To: openldap-technical(a)openldap.org Subject: openldap-technical Digest, Vol 38, Issue 12 Send openldap-technical mailing list submissions to openldap-technical(a)openldap.org To subscribe or unsubscribe via the World Wide Web, visit http://www.openldap.org/lists/mm/listinfo/openldap-technical or, via email, send a message with subject or body 'help' to openldap-technical-request(a)openldap.org You can reach the person managing the list at openldap-technical-owner(a)openldap.org When replying, please edit your Subject line so it is more specific than "Re: Contents of openldap-technical digest..." Send openldap-technical mailing list submissions to openldap-technical(a)openldap.org When replying, please edit your Subject: header so it is more specific than "Re: openldap-technical digest..." Today's Topics: 1. One root and two domain? (gael therond) 2. Re: One root and two domain? (Pierangelo Masarati) 3. Re: Evolution Contacts Schema (Peter L. Berghold) 4. Problems importing ppolicy LDIF: LDAP_INVALID_SYNTAX (Konstantin Boyandin) 5. Re: Problems importing ppolicy LDIF: LDAP_INVALID_SYNTAX (Quanah Gibson-Mount) 6. Re: Problems importing ppolicy LDIF: LDAP_INVALID_SYNTAX (Konstantin Boyandin) 7. Re: Problems importing ppolicy LDIF: LDAP_INVALID_SYNTAX (Chris Jacobs) 8. Re: Problems importing ppolicy LDIF: LDAP_INVALID_SYNTAX (Konstantin Boyandin) 9. LDAP and PAM: account is expired, but pam_ldap allows authentification (Konstantin Boyandin) 10. Re: Problems importing ppolicy LDIF: LDAP_INVALID_SYNTAX (Chris Jacobs) 11. Re: LDAP and PAM: account is expired, but pam_ldap allows authentification (Indexer) 12. Re: Problems importing ppolicy LDIF: LDAP_INVALID_SYNTAX (Howard Chu) 13. Re: LDAP and PAM: account is expired, but pam_ldap allows authentification (Howard Chu) 14. Re: LDAP and PAM: account is expired, but pam_ldap allows authentification (Chris Jacobs) 15. Re: Problems importing ppolicy LDIF: LDAP_INVALID_SYNTAX (Howard Chu) 16. Re: LDAP and PAM: account is expired, but pam_ldap allows authentification (Howard Chu) 17. Re: LDAP and PAM: account is expired, but pam_ldap allows authentification (Indexer) 18. Re: Problems importing ppolicy LDIF: LDAP_INVALID_SYNTAX (Dieter Kluenter) 19. Re: LDAP and PAM: account is expired, but pam_ldap allows authentification (Howard Chu) 20. Re: Problems importing ppolicy LDIF: LDAP_INVALID_SYNTAX (Konstantin Boyandin) 21. Re: LDAP and PAM: account is expired, but pam_ldap allows authentification (Indexer) 22. Re: Problems importing ppolicy LDIF: LDAP_INVALID_SYNTAX (Pierangelo Masarati) 23. Re: Problems importing ppolicy LDIF: LDAP_INVALID_SYNTAX (Konstantin Boyandin) 24. Re: Problems importing ppolicy LDIF: LDAP_INVALID_SYNTAX (Howard Chu) 25. Re: Problems importing ppolicy LDIF: LDAP_INVALID_SYNTAX (Howard Chu) 26. Re: Problems importing ppolicy LDIF: LDAP_INVALID_SYNTAX (Pierangelo Masarati) 27. Re: Problems importing ppolicy LDIF: LDAP_INVALID_SYNTAX (Howard Chu) 28. Re: Evolution Contacts Schema (Bj?rn Ruberg) 29. Re: Evolution Contacts Schema (Stefan Palme) 30. Hello, how (Alexey Shalin) ---------------------------------------------------------------------- Message: 1 Date: Wed, 12 Jan 2011 15:58:28 +0100 From: gael therond <gael.therond(a)gmail.com> To: openldap-technical <openldap-technical(a)openldap.org> Subject: One root and two domain? Message-ID: <AANLkTinxG_W4QQA5-vA587CN1FtYLf7TTUUchNP1DfTh(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" Is it possible to add a domain on an already existing root? I got the following root for now: dc=lab,dc=corp and I want to create a second Top entry on my root which will be named like this: dc=prod,dc=corp Is that possible? I've try the following syntaxe without succes. Racine.ldif: #Racine dn: dc=prod, dc=corp ObjectClass: Top ObjectClass: dcObject ObjectClass: organization o: prod.corp dc: prod #OU Groups dn: ou=groups, dc=prod, dc=geka ObjectClass: organizationalUnit ObjectClass: top ou: groups #OU Users dn: ou=users, dc=prod, dc=geka ObjectClass: organizationalUnit ObjectClass: top ou: users And then I've done the usual LdapADD command, but with the following error returned: ldap_add: Server is unwilling to perform (53) Additional info: No global Superior Knowledge. Well, my guest is that I didn't set correctly Slapd because my default root is lab.corp instead of being TLD .corp Is that theory right? Many thanks

2 1

OpenLDAP delegates authentication to PAM
by Manuel Rodríguez Hernández 15 Jan '11

15 Jan '11

Hello I want to configure an application that only supports LDAP authentication, the challenge I face is that this application should not use the LDAP database to compare user and password, what I need, is to authenticate against a private solution which use its own auth schema, besides the only way to pass credentials to this private solution is using PAM, that is for example: an http proxy use a PAM helper to authenticate, and the PAM config use a PAM module to pass user/password to the private solution. So due to the restrictions, I'm looking to deploy an OpenLDAP server that redirects auth or executes an external program in order to authenticate against the private solution, and finally returns the response to the application that needs the authentication. So I was looking to the back-perl module to deploy something like that, but I'm not sure it will work. Does anybody know anything to solve this deployment? I will appreciate any clue. Thanks in advance RODRIGUEZ Manuel Tel: +52 (55) 5322-5290 Soporte: +52(55) 5322-5240 Fax: +52 (55) 5322-5252 www.insys-corp.com.mx "Ce message est confidentiel. Si vous n'êtes pas le destinataire de ce message, nous vous prions de le notifier au destinataire voie un courrier électronique et de l'effacer avec toutes ces pièces jointes de son ordinateur, sans sauvegarder un copie. Vous ne devez pas le copier, l'utiliser, le répliquer, par aucun propos et même plus diffuser son contenu à personne. Merci d'avance." "Este mensaje es confidencial. Si usted no es el destinatario de este mensaje, le suplicamos se lo notifique al remitente mediante un correo electrónico y que borre el presente mensaje y sus anexos de su computadora sin retener copia de los mismos. Por lo que no debe copiar este mensaje, usarlo, transmitir para cualquier propósito ni tampoco divulgar su contenido. Muchas gracias." "This e-mail is confidential and may also be privileged. If you are not the intended recipient please immediately advise the sender by reply e-mail and delete this message and its attachments from your computer without retaining a copy. You should not copy it, use it, transfer it, for any purpose, nor disclose its contents to any other person. Thank you."

2 1

dbd to hdb migration
by dan picon 15 Jan '11

15 Jan '11

Hi, I would like to use hdb as the back-end for my openldap server in order to support subtree-renaming. Untill today i'm using dbd and i have some questions before i change it to hdb: will existing entries be deleted? If yes, what is the best way to restore it? Thank you,

2 1

joomla ldap; joomla users not created
by mike＠grounded.net 14 Jan '11

14 Jan '11

Joomla 1.5, fully updated. php does have ldap installed and working Openldap 2.3.43-12.el5_5.3 running on fully updated centos server dedicated to this. On the openldap server, I have; Server Local LDAP Server timeout (Schema | search | refresh | info | import | export | logout ) Logged in as: cn=admin,dc=mydomain,dc=com - img dc=mydomain,dc=com (2) - img cn=admin new Create new entry here - img ou=users (2) + img uid=bob + img uid=bobby new Create new entry here new Create new entry here I have Distinguished Name: ou=users,dc=mydomain,dc=com I followed docs which showed me how to create add and use a joomla.schema. The above is where joomla users are supposed to be being created. What I suspect is that joomla isn't talking to the proper joomla.schema on the ldap server which is preventing the user from being created. But since I'm new to ldap, I've not been able to figure out how to diagnose this and fix the problem. I've been struggling with this for weeks and would very much welcome some help. Thanks.

1 0

Substrings in attributes - changing schemas
by Nick Milas 14 Jan '11

14 Jan '11

Hi, I store my DNS records in openldap (I use powerdns with ldap backend) and I am trying to use a search filter like: (aRecord=10.11.12.*) but it never produces results. I noticed that aRecord is defined in dnsDomain schema (available in cosine.schema) and inherited in dnsDomain2 schema (which is used by powerdns, available here: http://www.linuxnetworks.de/pdnsldap/dnsdomain2.schema). I came to the conclusion that the problem may be caused by the fact that aRecord (oid: 0.9.2342.19200300.100.1.26) in cosine.schema has no substring matching rule defined in schema: attributetype ( 0.9.2342.19200300.100.1.26 NAME 'aRecord' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) I thought of modifying it in order to allow substring matching, like: attributetype ( 0.9.2342.19200300.100.1.26 NAME 'aRecord' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) Questions: 1. Is the above logic correct, i.e. has the cause of the problem been identified correctly? 2. Is there any other way we can search substrings of values in this (or other similar) attribute(s) without modifying the schema(s)? 3. Can an LDAP administrator freely modify an organisation's schema(s) whenever it is deemed appropriate? Are there any risks by doing it? (I understand one should be cautious when upgrading openldap, and take care to "cascade" modifications to the upgraded version.) - AND/OR - Is there any process of "schema evolution" where LDAP server users provide feedback so that standard schema(s) are globally adapted to user request(s)? In the end: What is the easiest recommended way of using customized schema(s) in an organization? Please advise. Thanks in advance, Nick

3 7

distribution list in openldap
by Ben Kim 13 Jan '11

13 Jan '11

Hi, I'm trying to create a distribution list for outlook 2007, using openldap. Outlook reads ldap contacts quite OK, but I can't make a mailing group. Does anyone know of a good tutorial? I did some googling, but most of the related questions seem unanswered. I looked at http://www.openldap.org/faq/data/cache/1317.html MS Outlook: How To Make Distribution Lists. If you have followed the tutorial already, I would need some detailed steps, since I'm not an ldap expert. Thanks. -- Ben Kim Lead Database Administrator College of Education Texas A&M University http://benix.tamu.edu

2 2

Help reading db_printlog
by Peter Palmreuther 13 Jan '11

13 Jan '11

Hello, I had soem problems with a MirrorMode set up OpenLDAP cluster (version 2.4.20) and after some replication trouble I lost some data. I could restore it by using "db_restore" on the data directory (it's a 'hdb' backend). Now I'm trying to get as much information as possible about when exactly, and as far as possible why, the data got lost / was deleted. Unluckily I don't get far with reading the output of "db_printlog". I found " http://download.oracle.com/docs/cd/E17076_02/html/installation/debug_printl…" but this does not really help in getting the meaning of all the output. Is there any more help / documentation / whatever available to "dissect" the output and get an idea about what happend (and when, if possible)? Thanks in advance, -- Peter

1 0

Hello, how
by Alexey Shalin 13 Jan '11

13 Jan '11

Good afternoon, Tell me how to exclude the user's "search" from thesecurity policies The user is located in the ou =users Ou=policy also located in ou=users The reason that I need to exclude the user, is that when I set the pwdMaxAge and pwdGraceAuthNLimit. I can not log into the application at any login. In the openldap logs have a message bdb_dn2entry("uid=search,ou=users,ou=db") bdb_entry_get: rc=0 ppolicy_bind: Entry uid=search,ou=users,ou=db has an expired password: -39 grace logins send_ldap_response: msgid=1 tag=97 err=49 ber_flush2: 52 bytes to sd 13 tls_write: want=73, written=73 0000: 17 03 01 00 44 c3 ec 7b f6 fb 12 85 2d 87 57 6c ....D..{....-.Wl 0010: 6c 8c 36 ec 6f d3 39 1d 91 4b 1a db 53 d6 99 0e l.6.o.9..K..S... 0020: e8 94 85 93 b0 9a 3e 38 18 ab 00 fc 0f 3f d6 b4 ......>8.....?.. 0030: 39 a8 2d 8f 84 7f 46 09 90 cf 1d d2 28 a3 6e eb 9.-...F.....(.n. 0040: e8 ac f0 ad 66 44 7b 4f 47 ....fD{OG ldap_write: want=52, written=52 0000: 30 32 02 01 01 61 07 0a 01 31 04 00 04 00 a0 24 02...a...1.....$ 0010: 30 22 04 19 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e 0"..1.3.6.1.4.1. 0020: 34 32 2e 32 2e 32 37 2e 38 2e 35 2e 31 04 05 30 42.2.27.8.5.1..0 0030: 03 81 01 00 .... conn=1 op=0 RESULT tag=97 err=49 text= If I set pwdGraceAuthNLimit to 100. I'm able to login into the application. I can not change password for user "search" :-( Thank you ------------------------------------------------------------------------------- С уважением, Алексей Шалин Системный Администратор Отдел системного администрирования ЗАО "Межбанковский процессинговый центр" 720083, Кыргызская Республика г. Бишкек, ул. Ауэзова 1/2 тел.: +996 (312) 637738 (вн. 138) факс: +996 (312) 637748 e-mail: a.shalin(a)ipc.kg

1 0

Evolution Contacts Schema
by Peter L. Berghold 13 Jan '11

13 Jan '11

Hi folks, I've been running in circles trying to locate something and I've had Epic Fail. Quick background: I've been setting up a new email/calendering system for my family. My wife and I both run our own small businesses and just keeping our schedules in sync is nuts. The "nice to have" my wife asked for was being able to have one central email contacts place to work with. This is where Evolution comes in. Unfortunately Evolution seems to do contacts differently than say Thunderbird and I need a "special schema" to get it to work. I've done a Google looking for the schema files and found lots of dead links and schema files that don't seem to play well. Anyone know of a more reliable source? Thanks in advance... -- Peter L. Berghold <peter(a)berghold.net>

3 4

Problems importing ppolicy LDIF: LDAP_INVALID_SYNTAX
by Konstantin Boyandin 13 Jan '11

13 Jan '11

Hello, OpenLDAP version: 2.3.43-12 (CentOS 5.5), 64-bit. In order to enable ppolicy overlay, I am trying to create the relevant entries, as specified in http://www.openldap.org/doc/admin24/overlays.html#Password%20Policies I import two LDIFs, first: dn: ou=Policies,dc=example,dc=com objectClass: organizationalUnit objectClass: top ou: Policies and second dn: cn=default,ou=Policies,dc=example,dc=com cn: default objectClass: top objectClass: pwdPolicy objectClass: person pwdAllowUserChange: TRUE pwdAttribute: userPassword pwdCheckQuality: 2 pwdExpireWarning: 600 pwdFailureCountInterval: 30 pwdGraceAuthNLimit: 2 pwdInHistory: 5 pwdLockout: TRUE pwdLockoutDuration: 0 pwdMaxAge: 7776000 pwdMaxFailure: 5 pwdMinAge: 0 pwdMinLength: 5 pwdMustChange: FALSE pwdSafeModify: FALSE sn: dummy value The first loads OK. When I try to import the second, I receive this diagnostics: Could not add object cn=default,ou=Policies,dc=itelsib,dc=com Message: Invalid syntax Error code: 0x15 (LDAP_INVALID_SYNTAX) Error description: An invalid attribute value was specified. Could someone suggest what's wrong with the attribute name? the ppolicy.schema is specified in /etc/slapd.conf. Thanks. Sincerely, Konstantin

6 15

LDAP and PAM: account is expired, but pam_ldap allows authentification
by Konstantin Boyandin 13 Jan '11

13 Jan '11

Hello, Could someone direct me to the source of wisdom to solve this: I have set correctly the fields (attributes) shadowExpire shadowLastChange shadowMin shadowMax to make the account expired (OpenLDAP used to run NT domain), but when I ssh to a server using pam_ldap authentication, it is still allowed to login. How pam_ldap should be instructed to take the expiration attributes ito account? Thanks. Sincerely, Konstantin

4 7

unique overlay
by Christian Bösch 12 Jan '11

12 Jan '11

hi, i want to use unique overlay with the following config: objectClass: olcOverlayConfig objectClass: olcUniqueConfig olcOverlay: {6}unique olcUniqueURI: ldap:///ou=People,dc=abc,dc=net?mailLocalAddress,mail,uidNumber?sub olcUniqueURI: ldap:///ou=Groups,dc=abc,dc=net?gid?one the attribute uniqueness for the people tree's uri works, but not the one for the group tree. i found out the when i do an ldapsearch for a group and filter for gid=xy i get an empty result ldapsearch -Y EXTERNAL -b 'ou=Groups,dc=abc,dc=net' 'gid=32011' the log file says: conn=18817 op=1 SRCH base="ou=Groups,dc=abc,dc=net" scope=2 deref=0 filter="(?gid=32011)" why is the filter ?gid=32011 could this be the problem? thanks for any hint. /chris

2 2

Re: using of shared memory with slapadd
by tim stone 11 Jan '11

11 Jan '11

> Run slapadd as the same user that slapd runs as. This is no different than > running slapadd without shared memory segments, where you will have the same > issue with the created BDB caching files (i.e., same results whether it is > in memory or on disk). > Thanks, yes you are right. This issue I've never seen on my server, because SuSE automatically makes automaticly (via start script) a chown in the different backend database directorys ... Thanks Steeg

1 0

using of shared memory with slapadd
by Steeg Carson 11 Jan '11

11 Jan '11

Hello, I use shm_key in my database definition and its working fine. But after using slappadd (stopped slapd), the process use the same shm_key like the slapd (read from slapd.conf) After the slapadd is finished, the shared memory remains reserved in RAM with owner root. (ipcs -m) So after slapadd, I cant start slapd, I have to delete these shared memory with ipcrm. Is there a possibility, that the slapadd deletes the shared memory before ending or is there a reason that it remain? Thanks Steeg

2 1

dynlist overlay searching in a different server
by Angel L. Mateo 11 Jan '11

11 Jan '11

Hello, I have two different LDAP servers containing different information about my users. In one of them, I'm trying to configure dynlist overlay to dinamically add attributes for users, so I have configured dynlist. I'm using the labeledURI attribute with a value like this: labeledURI: ldap://<the_other_server>:389/dc=usuarios,dc=mydomain,dc=com?irisClassifCode,sn1,givenName?one?(irisPersonalUniqueID=<userID>) Whenever I look for a user I get the error: Jan 10 13:07:07 canis12 slapd[12689]: dynlist_prepare_entry("<userDN>"): illegal URI "ldap://<the_other_server>:389/dc=usuarios,dc=mydomain,dc=com?irisClassifCode,sn1,givenName?one?(irisPersonalUniqueID=<userID>)" If I remove the server part of the URI, like: labeledURI: ldap:///dc=usuarios,dc=mydomain,dc=com?irisClassifCode,sn1,givenName?one?(irisPersonalUniqueID=<userID>) but, obviously, I'm not getting the additional attributes (because this LDAP directory doesn't have them). What am I doing wrong? Could I use a LDAP URI directed to another LDAP server? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 868887590 Fax: 868888337

3 5

Re: RE24 testing call #1 (OL 2.4.24)
by Brett Maxfield 10 Jan '11

10 Jan '11

There is a discussion of solaris threads socket read/write locking issues and some workarounds at: http://omniorb.sourceforge.net/omni40/omnithread.html See "6 Threaded I/O shutdown for Unix" Cheers Brett On 08/01/2011, at 9:55 AM, Howard Chu <hyc(a)symas.com> wrote: > Doug Leavitt wrote: >> >> On 01/ 7/11 08:01 AM, Rein Tollevik wrote: >>> On 06.01.11 22.48, Quanah Gibson-Mount wrote: >>>> --On Thursday, January 06, 2011 7:40 PM +0100 Rein Tollevik >>>> <rein(a)OpenLDAP.org> wrote: >>>> >>>>> On 04.01.11 23.34, Quanah Gibson-Mount wrote: >>>>>> Please test RE24 heavily. >>>>> >>>>> test039 deadlocks for me on 64bit solaris10, both x86 and sparc :-( It >>>>> hangs in the monitor, triggered by the new swamp -SS option added to >>>>> slapd-tester. It works if run with -S or -SSS. It is the third server >>>>> that hangs, and it does so quite consistently with the same stack trace >>>>> every time. A gdb trace is at at: >>>>> >>>>> ftp://ftp.openldap.org/incoming/rein-test039-gdb-trace.txt >>>> >>>> Does this happen on both HEAD and RE24, or RE24 only? >>> >>> Both, as well as when running the head tests suite with the 2.4.23 >>> release. Looks as if the swamp additions have tripped into an >>> existing problem, not anything new. Leave it out of RE24 until if >>> have been resolved? >>> >>> Btw, any other Solaris test runs out there? I´t like to know if it is >>> a real Solaris problem or just me.. > > I'm seeing a similar failure on 32 bit Sparc Solaris 10. But it actually locks up in test036 for me, I never get as far as test039. The gdb trace looks much the same as what you posted. > > Looks like for some reason threads that are blocked waiting for their sockets to become writable are never getting waken up. A regular SIGINT shuts down slapd cleanly so it doesn't appear to be a problem with the condvars being used to manage the threads. That kinda points to select() simply not returning the writable status. > > I haven't used this Solaris machine much, but in fact (looking at the remnants of other files in my source tree on this box) this appears to have been a problem since at least last August. (I.e., it looks like I was investigating this same problem back then but dropped it and never got back to it.) > >>> Rein > >> I'm currently testing Solaris11 (Nevada) and not seeing any issues in >> either 32 or 64 >> bit builds using both RE24 and HEAD. I have not had any failures on >> x86 yet. >> Testing is still underway for sparc and other internal system testing on >> both platforms. > > -- > -- Howard Chu > CTO, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc/ > Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

ITS#6607 to be fixed in 2.4.24?
by Eric Lakin 08 Jan '11

08 Jan '11

With 2.4.23, i ran into the bug in IDS#6607 "Forwarded bind failure messages cause success", but was able to fix it by applying the minor diff of back-ldap/chain.c rev 1.77 (as was mentioned in the bug follow-up). I've downloaded RE24 as of today & compiled it up. However, the bug is still there. Is this fix going to make it into 2.4.24 by any chance?

2 1

Dynamic list overlay and search filters
by James Bagley Jr 08 Jan '11

08 Jan '11

Maybe I¹m just being delusional in thinking that this should work... I¹m running OpenLDAP 2.4.23 on IBM AIX for authentication on a variety of AIX, Linux and web applications. As we need to use both Posixgroup and groupOfNames objects with the same membership, the dynamic list overlay seems like an ideal approach. This configuration appeared to work fine for our linux hosts and web applications, but not so well for our AIX hosts: In slapd.conf: overlay dynlist dynlist-attrset posixGroup labeledURI memberUid:uid Ldap object: dn: cn=testgroup,cn=testgroup,ou=unix,ou=groups,ou=unix,st=or,c=us cn: testgroup objectClass: top objectClass: posixGroup objectClass: labeledURIObject gidNumber: 1000 labeledURI: ldap:///ou=unix,st=or,c=us?uid?sub?(memberof=cn=testgroup,ou=unix,ou=groups, ou=unix,st=or,c=us) memberUid: chogensen memberUid: jbagley However, the AIX hosts do a search for (memberUid=jbagley)¹ to determine group membership and the ldap server does not return the above object. I¹m guessing that I was wrong in assuming the overlay would handle this type of application and that I will have to find another way. Anyone have any helpful tips? Advice? Condolences if I now have to manage twice as many group objects? Thanks! James Bagley Jr State of Oregon Data Center

2 1

Unable to install OpenLdap in GNU/Linux
by Maria Sanchez 07 Jan '11

07 Jan '11

I am trying to install OpenLDAP in GNU/Linux: uname -a Linux jupnms1 2.6.18-164.el5 #1 SMP Thu Sep 3 03:28:30 EDT 2009 x86_64 x86_64 x86_64 GNU/Linux I downloaded openldap version 2.4.23 I also installed BerkelyDB version 5.1.19 . Since the location of this db is not the default I set the proper environment variables for configure to find it: LDFLAGS=-L/usr/local/lib -L/usr/local/BerkeleyDB.5.1/lib CPPFLAGS=-I/usr/local/include -I/usr/local/BerkeleyDB.5.1/include LD_LIBRARY_PATH=/usr/lib:/usr/local/lib:/usr/local/BerkeleyDB.5.1/lib/ Additionally, I have updated the link to db.h to propperly point to the new Berkely DB: /usr/include/db.h -> /usr/local/BerkeleyDB.5.1/include/db.h because it was pointing to an old one. However after all these changes I still get an error. The command I ran is: ./configure --prefix /opt/COTS/ldap The results is attached. I really appretiate your help on this matter. I am currently evaluating different options for Authentication/Authorization data storage and have never worked with LDAP. LDAP is being proposed as the prefered way to store this data, however I need to prototype some solutions to present to management. Thanks, Maria

2 1

Emergency recovery strategy needed by novice
by Richard Troy 07 Jan '11

07 Jan '11

Hello All, I've got a bit of a problem.... Management chose a software product that depends on OpenLDAP's SLAPD service and had us put it into production without our quite understanding the software well enough to be clueful. The deployment is across virtual and real servers, the virtual servers handling the web stack and other user-oriented functionality while "real" servers handle data management. Regarding the data management, one system was chosen as a replication master, and another as slave, but being understaffed, we never quite got the replication of the OpenLDAP data configured when, today, some serious networking problems cropped up. The symptom is that we can establish an OpenLDAP (slapd) connection from the virtual side to the master, and a postgres connection - our RDBMS, but we can't get the rest of our primary application to connect properly so it's down. And it is absolutely not clear what's wrong with the master anyway. I can't get to the physical hardware because it's off in some data center somewhere that the founder located near him - and he's off traveling. So, we're "dead in the water." I was thinking that we might salvage the situation by dumping the data from the Postgres and OpenLDAP databases and restoring them to the slave system - promoting it to master - and while I've succeeded in moving over the Postgres data, I haven't a CLUE how to get started unloading and reloading the OpenLDAP data. ...I'm very competent with most things related to computing but I am _completely_ inexperienced with OpenLDAP. I've never issued any commands to or with OpenLDAP / slapd and have no idea what's normal for dealing with it. Are there dump and reload utilities? Any and all pointers / help GREATLY appreciated. Richard

4 5

Strange behavior with TLS with self-signed certs
by Michael Starling 07 Jan '11

07 Jan '11

I'm running openldap-2.3.43-12.el5 on a RHEL 5.5 system: I find that TLS will not work if I use uri ldap://10.3.5.207/ in /etc/ldap.conf on my clients. TLS magically starts working if I use the deprecated host directive instead: So if I use host 10.3.5.207 instead everything starts working: Any insight as to what might be going on?..Possibly a bug? Here are my TLS directives on my clients: #TLS settings ssl start_tls ssl on tls_cacertdir /etc/openldap/cacerts tls_cacertfile /etc/openldap/cacerts/slapdcert.pem tls_checkpeer no -Mike

4 8

Re: Index for objectclass does not work...
by Steeg Carson 07 Jan '11

07 Jan '11

2011/1/4 Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Tuesday, January 04, 2011 1:43 AM +0100 Steeg Carson > <steeg.carson(a)googlemail.com> wrote: > >> I simulate this on my database just right now: > > I suggest you read: > > <http://www.openldap.org/lists/openldap-technical/201011/msg00146.html> > > to understand how indices and their slots work. > As I now understand, the entire index for one attribute (e.g. objectClass) is "split" in several indexes. They holds for each path/node (resp. DN, but not leaf) an separate index for this attribute with all "hits" for his subtree (and for onelevel too). If I do an ldapsearch with -b "cn=ownPath,ou=root" the slapd takes the index which is bound on this node/DN? In my DIT are 470812 entires. The objectClass=subEngine exists 104384 times in the entire directory (ou=root). The objectClass=subEngine exists only 1 time under "cn=ownPath,ou=root", The following test I made with BDB, because each node holds an index for subtree and one for onelevel (hdb only for onelevel) When I search (loglevel 33): ldapsearch -x -h localhost -wpassword -D"uid=admin,ou=root" -b"cn=ownPath,ou=root" "(ObjectClass=subEngine)" I get in the logfile: ================================================ => key_read <= bdb_index_read 470601 candidates <= bdb_equality_candidates: id=-1, first=228, last=470828 <= bdb_filter_candidates: id=-1 first=228 last=470828 <= bdb_list_candidates: id=-1 first=228 last=470828 <= bdb_filter_candidates: id=-1 first=228 last=470828 <= bdb_list_candidates: id=-1 first=40595 last=470825 <= bdb_filter_candidates: id=-1 first=40595 last=470825 bdb_search_candidates: id=-1 first=40595 last=470825 => test_filter EQUALITY <= test_filter 5 bdb_search: 40595 does not match filter . . . ================================================. . Should the index at this level not hold only one entry: ldapsearch -x -h localhost -wpassword -D"uid=admin,ou=root" -b"cn=ownPath,ou=root" "(ObjectClass=subEngine)" dn | grep "^dn:" | wc -l 1 thanks Steeg!

3 7

Re: slow ldap authentication
by bluethundr 07 Jan '11

07 Jan '11

Hi list, It's been a few days and I just wanted to check back to see if anyone had any troubleshooting tips that might help to solve this situation that I'm dealing with as I'm still a relatively new LDAP admin. I really appreciated your advice in the past and have overcome some very significant technical hurdles with your assistance on a number of occasions. Thanks in advance!and I would like to wish you a belated happy new year! Tim On Sun, Jan 2, 2011 at 12:58 AM, bluethundr <bluethundr(a)gmail.com> wrote: > Hello list!! > > I would greatly appreciate your help with an issue I am having here. > It seems that when you log into hosts on the network via ldap > authentication, said authentication is extremely sloooowww... on the > order of up to 30 seconds to log in! I could use some assistance in > correlating the information in the logs with the way that slapd.conf > is configured. > > What I did to capture the event in the logs was to (after backing > them up) empty them with cat /dev/null > /var/log/openldap.log and > then log into a host on the network via an ldap account. Right after > login was finished I copied the log file to another location on the > nas and enclosed it here. Therefore it reflects only what happened > during the login. I've also enclosed my slapd.conf and ldap schema as > attachments for your perusal. > > I've attempted adding some indexes to the configuration to alleviate > the situation but unfortunately this had no effect. The ones I added > were uid and uidNumber which I've read can help address this sort of > situation. > > > [root@LBSD2:~]#grep -i index /usr/local/etc/openldap/slapd.conf > index objectClass,uid,uidNumber eq > index sudoUser eq > > thanks in advice with any assistance you can provide. > > best regards > > -- > GPG me!! > > gpg --keyserver pgp.mit.edu --recv-keys F186197B > -- GPG me!! gpg --keyserver pgp.mit.edu --recv-keys F186197B

2 1

Re: Index for objectclass does not work...
by Steeg Carson 07 Jan '11

07 Jan '11

> > I have written up documentation on performance tuning OpenLDAP 2.4 that > covers most other areas, for my work @ Zimbra, you can find it at: > > <http://wiki.zimbra.com/wiki/OpenLDAP_Performance_Tuning_6.0> > > It's based on you using Zimbra's tools to automatically update the > configuration database, but you can easily tweak what it's talking about > directly. Hello Quanah, I know this page. Its really very helpful! As talked, I tested openldap with shared memory and found, that this can accelerate the load of the LDAP-Database with slapadd a lot :-) Thanks for your help. Kindly regards, Steeg

1 0

Automated testing routines?
by Jaap Winius 06 Jan '11

06 Jan '11

Hi folks, Compiling the Debian sources for the OpenLDAP packages can take over an hour on my relatively fast workstation. Much of that time seems to be spent running a slapd server with all kinds of test routines. Is that what's actually going on? Whatever, perhaps someone could explain. Thanks, Jaap

5 6

users, groups, etc. for posix authentication?
by Christ Schlacta 06 Jan '11

06 Jan '11

is there any reason that a posix usernames, groups, passwords, etc. must be stored in distinct locations in a directory ? I realize this mostly applies to the padl pam/nis and the libnsspam-ldapd module specific. can they be stored in other structures effectively and usefully? can they be stored on a department by department basis, or in any other organizational scheme? (ou=arbitrary1,dc=... having groups and users, while ou=arb2,ou=arb3,dc=... also has users and groups?) if a scheme like the above is used, will all users and groups be available on a system? must they be free of naming conflicts, or will group=users,ou=arbitrary1,... be different from group=users,ou=arb2,ou=arb3,... ? if they're different, how would this be indicated by the systems?

2 2

ACLs to allow users to traverse DIT down to their own entry, lock down everything else
by Andreas Ntaflos 05 Jan '11

05 Jan '11

Hi list, I've been fighting with ACLs for quite a bit now and most things seems to work but I not quite everything I need. I am using OpenLDAP 2.4.21 (2.4.21-0ubuntu5.3) on Ubuntu 10.04. A DN for a typical user looks like this (horribly long): uid=foo(a)example.net,ou=users,domainName=example.net, ou=virtualDomains,dc=example,dc=com What works is users authenticating against the director and changing their own password (using ldappasswd, i.e. the LDAP extended password modify operation). I also have an authentication user that may read most of the directory. == What I want to achieve == a) Users such as just described should be able to: a.1) traverse the directory from the top (the base being "dc=example,dc=com") and a.2) see only their own entry along with the parent/ancestor entries leading to it. b) The directory should be as locked down as possible. Anonymous binds are not allowed, nor should users see any attributes other than their own. Essentially I want users to be able to use tools like phpLDAPadmin and traverse the tree down to their own entry. == What I have so far == Please comment if you find anything objectionable. {0}to attrs=userPassword by dn="uid=authenticator,ou=services,dc=example,dc=com" read by self write by users auth by anonymous auth by * none {1}to dn.subtree="ou=virtualDomains,dc=example,dc=com" by dn="uid=authenticator,ou=services,dc=example,dc=com" read by users =d break {2}to dn.regex="uid=[^,]+,ou=users,domainName=[^,]+, \ ou=virtualDomains,dc=example,dc=com" by self read This mostly works. == What doesn't work == Users can authenticate and change passwords and don't see anything except their own entry, *IF* they specify their own DN as search base in i.e. ldapsearch. Tools like phpLDAPadmin are not happy with this and say that the top entry (dc=example,dc=com) doesn't exist ("No such object"). Which is of course consistent with the ACLs as specified. So what do I need to do so users can specify "dc=example,dc=com" as search base and traverse the directory tree down to their own DN entry? I must admit that ACLs in LDAP are far more complex than I would ever have guessed. It also doesn't help that many examples on ACLs have a world-readable directory (by * read) that just gets locked down a bit. I on the other hand want the directory completely locked down and open up only specific parts to users (and later groups). Sorry for this long post. Any and all help is appreciated. Thanks, Andreas

2 1

viewing cn=config
by E.S. Rosenberg 05 Jan '11

05 Jan '11

Hi, I have a standard Debian install of slapd that was apparently automatically upgraded/updated from using slapd.conf to using olc. Now I would like to view settings before editing them so I tried some simple ldapsearch queries but all the things I try return empty results. How do I get to see the contents of cn=config? Things I have tried: ldapsearch -b cn=config -D cn=admin,dc=mydomain -W ldapsearch -x cn=config ldapsearch -D cn=admin,dc=mydomain -W cn=config Some help/pointers in the right direction would be greatly appreciated. Thanks, Eli

7 8

Granting write to ou
by Thomas D. Dahlmann 05 Jan '11

05 Jan '11

Hi I'm trying to add ordinary users write access to a specific ou. I've googled a lot and haven't really found any useful regarding to openldap 2.4 (slapd.d format). What would be the correct syntax for a ldapmodify command to accomplish this to the dn: ou=addressbook,dc=example,dc=net ? Thanks. /Thomas

4 7

Alejandro Leyva wants to stay in touch on LinkedIn
by Alejandro Leyva via LinkedIn 05 Jan '11

05 Jan '11

LinkedIn ------------Alejandro Leyva requested to add you as a connection on LinkedIn: ------------------------------------------ Edward, I'd like to add you to my professional network on LinkedIn. - Alejandro Leyva Accept invitation from Alejandro Leyva http://www.linkedin.com/e/-48cabe-gikmn8dl-6g/IxIpDd2wsdsod7c6kW2TzgvFvx58f… View invitation from Alejandro Leyva http://www.linkedin.com/e/-48cabe-gikmn8dl-6g/IxIpDd2wsdsod7c6kW2TzgvFvx58f… ------------------------------------------ DID YOU KNOW LinkedIn can help you find the right service providers using recommendations from your trusted network? Using LinkedIn Services, you can take the risky guesswork out of selecting service providers by reading the recommendations of credible, trustworthy members of your network. http://www.linkedin.com/e/-48cabe-gikmn8dl-6g/svp/inv-25/ -- (c) 2010, LinkedIn Corporation

2 1

Re: DynList + posixGroup and permission to Dir
by masarati＠aero.polimi.it 05 Jan '11

05 Jan '11

> I read manual for slapo-dynlist and I tried found sth. about autogroup. > > Can you show my some example to this? > > Or this is possible to make that dyngroup and posixGroup in linux? Please keep replies on the list. Dyngroup works exactly like dynlist, as far as I remember. I know little about autogroup; perhaps someone else can help. Did you read the README? p.

1 0

Re: problem enabling ssl on openldap 2.2.13
by rui 05 Jan '11

05 Jan '11

Hi, The "is not readable by "ldap"" error happens when i start ldap using /etc/rc.d/init.d/ldap restart These three lines are the source of the problem, if i remove them then no warning message on restart. TLSCACertificateFile server.pem TLSCertificateFile server.pem TLSCertificateKeyFile server.pem I have moved this file to /etc/openldap/cacerts and changed the above three path accordingly. I have also modified ldap.conf to have TLS_CACERT which allows me to do ldapsearch(before it was giving ssl verify problem)now with ldaps://localhost on the same sytem. I still get this when i restart the ldap server using /etc/rc.d/init.d/ldap restart, notice the er.pem after ldap - is it not picking up the path. correctly or its a harmless warning now that ldaps is working i think it is harmless. is not readable by "ldap"er.pem [WARNING] is not readable by "ldap"er.pem [WARNING] is not readable by "ldap"er.pem [WARNING] Checking configuration files for slapd: [ OK ] Starting slapd: [ OK ] ------------------------------------------------ Problem on windows: pLdapConnection = ldap_sslinit(pHost,LDAP_SSL_PORT, 1); // fine - connecting to 636 iRtn = ldap_set_option(pLdapConnection, LDAP_OPT_PROTOCOL_VERSION, (void*)&version); //fine long option; printf("Checking if SSL is enabled\n"); iRtn = ldap_get_option(pLdapConnection,LDAP_OPT_SSL,(void*)&option); Here i get returned 0 in option meaning ssl is disabled. Also if i connect afterwards, i get 0x51(Cannot contact the LDAP server) connectSuccess = ldap_connect(pLdapConnection, NULL); How can i use ssl based openldap authentication on windows client? Do i have to move the self signed server.pem to windows, i tried to add it to certificate store by changing server.pem to server.cer? Regards, rui > On Wed, Jan 5, 2011 at 8:12 AM, Dieter Kluenter <dieter(a)dkluenter.de> wrote: >> Am Tue, 4 Jan 2011 16:52:06 +0000 >> schrieb rui <guideveloper(a)gmail.com>: >> >>> Hi >>> >>> I am trying to enable tls based session with openldap from a client. I >>> created a self signed certificate based on command from >>> http://www.openldap.org/pub/ksoper/OpenLDAP_TLS.html#4.1 >>> My server.pem file is in /etc/openldap directory where slapd.conf is >>> located. >> >> This document is not recommended >>> >>> Here are further settings in my slapd.conf >>> TLSCACertificateFile server.pem >>> TLSCertificateFile server.pem >>> TLSCertificateKeyFile server.pem >>> >>> TLSVerifyClient never >>> >>> >>> When I restart the ldap, it gives me the following warnings. >>> is not readable by "ldap" [WARNING] >>> is not readable by "ldap" [WARNING] >>> is not readable by "ldap" [WARNING] >>> Checking configuration files for slapd: [ OK ] >>> Starting slapd: [ OK ] >> >> This are not slapd warnings, what is the sosurce of this result report? >> >>> >>> I have checked the ps output and it is started as: >>> ldap 6883 1 0 16:18 ? 00:00:00 /usr/sbin/slapd -u >>> ldap -h ldap:/// ldaps:/// >>> >>> AND >>> netstat -anp | grep slapd >>> tcp 0 0 0.0.0.0:389 0.0.0.0:* >>> LISTEN 7850/slapd >>> tcp 0 0 0.0.0.0:636 0.0.0.0:* >>> LISTEN 7850/slapd >>> tcp 0 0 ip:389 ip:43165 >>> ESTABLISHED 7850/slapd >>> tcp 0 0 :::389 :::* >>> LISTEN 7850/slapd >>> tcp 0 0 :::636 :::* >>> LISTEN 7850/slapd >>> unix 2 [ ] DGRAM 302231743 7850/slapd >>> >> And what is your problem? slapd is listening on ports 389 and 636 >> >> -Dieter >> >> -- >> Dieter Klünter | Systemberatung >> http://dkluenter.de >> GPG Key ID:DA147B05 >> 53°37'09,95"N >> 10°08'02,42"E >> >

2 1

DynList + posixGroup and permission to Dir
by Rafal Kaminski 05 Jan '11

05 Jan '11

Hi, I have problem with OpenLdap and permission to file. --- First - I set this in my slapd.conf: overlay dynlist dynlist-attrset labeledURIObject labeledURI --- Second - I make cn=test,ou=Projects,dc=example,dc=com with: dn: cn=test,ou=Projects,dc=example,dc=com gidNumber: 6789 objectClass: posixGroup objectClass: top objectClass: labeledURIObject labeledURI: ldap:///cn=testgroup,ou=Groups,dc=example,dc=com?memberUid?sub?(objectClass=posixGroup) memberUid: user1 (dynamic) memberUid: user2 (dynamic) in cn=testgroup,ou=Groups,dc=example,dc=com i have memberuid: user1 and memberUid: user2 --- Third - when i made getent group test I have: test:*:6789:user1,user2 But when i try id user1 i didn't see this group :( And next i set chmod 770 dir and chown root.test dir and try access to this dir. But of course it is not possible because the user is not in this group (that said "id"). Somebody know the resolve? Because i spent a lot of hours and i can't find the problem. Very thanks for help! BR, Rafal

2 2

Re: slapo-accesslog on remote ldap server
by masarati＠aero.polimi.it 05 Jan '11

05 Jan '11

> Hi all, > I would like to know if is it possibile to have accesslog overlay to > write > to a remote ldap server. > > I have 2 OL instances and I would like to aggregate accesslog data on 1 > server dedicated to serve accesslog query. In principle, yes (not tested). Log to an "ldap" database pointing to the real log database. Identity assertion may be needed. p.

1 0

Re: DynList + posixGroup and permission to Dir
by Rafal Kaminski 05 Jan '11

05 Jan '11

Hi, Please help me or tell - if this is possible to make this one? I fight with this 2 days and I can't found resolve. Thanks! BR, Rafal

2 1

slapo-accesslog on remote ldap server
by Marco Pizzoli 05 Jan '11

05 Jan '11

Hi all, I would like to know if is it possibile to have accesslog overlay to write to a remote ldap server. I have 2 OL instances and I would like to aggregate accesslog data on 1 server dedicated to serve accesslog query. Thanks in advance Marco -- _________________________________________ Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi. Jim Morrison

1 0

Re: dynlist and group membership (libnss-ldap, posixGroup, samba)
by Rafal Kaminski 05 Jan '11

05 Jan '11

Hi, I have the same problem. Did you find resolve for this? Thanks for help. BR, Rafal Kaminski

1 0

How does LDAP_OPT_RESTART work?
by Khaled Blah 05 Jan '11

05 Jan '11

Hello, I'd like to know what the meaning of LDAP_OPT_RESTART is and how it works? Is there someone here who could shed some light on this for me? First of all: next to the description in the manual is a "FIXME" and it doesn't say what needs to be fixed exactly. Second of all: I've tried my OpenLDAP based client with this option set to LDAP_OPT_ON when my client was still running and already had done one successfull bind and then stopped (with another bind while the server was stopped) and restarted my LDAP server. However, when the LDAP server was back online the connection was not restarted and the bind did not work. Did I miss something or do I misunderstand the purpose of this option? Thanks in avance to anyone who can tell me more about this. Regards, Khaled

1 0

problem enabling ssl on openldap 2.2.13
by rui 05 Jan '11

05 Jan '11

Hi I am trying to enable tls based session with openldap from a client. I created a self signed certificate based on command from http://www.openldap.org/pub/ksoper/OpenLDAP_TLS.html#4.1 My server.pem file is in /etc/openldap directory where slapd.conf is located. Here are further settings in my slapd.conf TLSCACertificateFile server.pem TLSCertificateFile server.pem TLSCertificateKeyFile server.pem TLSVerifyClient never When I restart the ldap, it gives me the following warnings. is not readable by "ldap" [WARNING] is not readable by "ldap" [WARNING] is not readable by "ldap" [WARNING] Checking configuration files for slapd: [ OK ] Starting slapd: [ OK ] I have checked the ps output and it is started as: ldap 6883 1 0 16:18 ? 00:00:00 /usr/sbin/slapd -u ldap -h ldap:/// ldaps:/// AND netstat -anp | grep slapd tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 7850/slapd tcp 0 0 0.0.0.0:636 0.0.0.0:* LISTEN 7850/slapd tcp 0 0 ip:389 ip:43165 ESTABLISHED 7850/slapd tcp 0 0 :::389 :::* LISTEN 7850/slapd tcp 0 0 :::636 :::* LISTEN 7850/slapd unix 2 [ ] DGRAM 302231743 7850/slapd Regards, rui

2 1

a problem of authentication fail in Ubuntu 10.04,slapd 2.4.21
by cn_gd＠126.com 05 Jan '11

05 Jan '11

hi all, I 'm install slapd follow bellow steps in ubuntu 10.04 lucid strictly: 1. apt-get install slapd * slapd -V @(#) $OpenLDAP: slapd 2.4.21 (Aug 10 2010 17:08:36) $ buildd@yellow:/build/buildd/openldap-2.4.21/debian/build/servers/slapd* 2. dpkg-reconfigure slapd 3.edit /etc/ldap/slapd.d/cn\=config.ldif 4. cat /etc/ldap/slapd.d/cn\=config.ldif dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/slapd/slapd.args olcLogLevel: none olcPidFile: /var/run/slapd/slapd.pid structuralObjectClass: olcGlobal dn: olcDatabase=bdb,cn=config objectClass: olcDatabaseConfig objectClass: olcBdbConfig olcDatabase: bdb olcSuffix: "dc=cg,dc=scsio,dc=ac,dc=cn" olcDbDirectory: /home/az/openldap-data olcRootDN: "cn=Manager,dc=cg,dc=scsio,dc=ac,dc=cn" olcRootPW: secret 4. /etc/init.d/slapd restart All step're OK,then I run bellow to test it: 5. ldapsearch -x -D "cn=Manager,dc=cg,dc=scsio,dc=ac,dc=cn" -w "secret" -H ldap://cg.scsio.ac.cn and it show that error: *ldap_bind: Invalid credentials (49) **I try again and again,but it'still the same.( using slappasswd to change it also turn to same problem). I wonder what's go wrong.any help would be greatly appreciated.Thank you in advance! ** *

3 2

MinGW & IPv6?
by Eric Nichols (DirWiz) 05 Jan '11

05 Jan '11

I apologize if I am posting to the wrong group. I am currently trying to configure v2.4.23 with the --enable-ipv6 and I get back the following error: configure: error: IPv6 support requires getaddrinfo() and inet_ntop() I was able to get around the getaddrinfo() by defining _WIN32_WINNT 0x501. This apparently tells mingw that this is being compiled on XP which is the minimum for IPv6 support. This leaves me with inet_ntop() which really doesn't exist in Windows land (bummer). I did find this piece of code with is a bit over my head. Could this be inserted into the OpenLDAP code somewhere as a wrapper? http://www.mail-archive.com/users@ipv6.org/msg02107.html Thanks Eric

1 0

nis vs rfc2307bis
by Mauricio Tavares 04 Jan '11

04 Jan '11

What is the difference between the nis.schema and the rfc2307bis.schema?

1 0

Problem with openldap backup script
by Nick Milas 04 Jan '11

04 Jan '11

Hello, I'm running openldap 2.4.22 using Buchan's CentOS/RHEL 5 RPMs. For some reason, although the backup script seems to be running successfully (either manually or by cron), it produces no results whatsoever: # cd /usr/share/openldap2.4/scripts/ # ls -la total 60 drwxr-xr-x 2 root root 4096 Dec 27 22:14 . drwxr-xr-x 4 root root 4096 Dec 27 22:14 .. -rwxr-xr-x 1 root root 16584 Apr 27 2010 ldap-common -rwxr-xr-x 1 root root 3776 Dec 28 09:14 ldap-hot-db-backup -rwxr-xr-x 1 root root 4979 Apr 27 2010 ldap-reinitialise-slave # ./ldap-hot-db-backup -v 4 Warning: Starting backup Warning: Successfully ran backup to temporary directory Info: We have 0 of 0 locks Info: Starting switch Warning: Switched new backup to good backup successfully Info: successfully removed all lock files Warning: Backup run completed successfully # ls -la /var/lib/ldap2.4/backup total 16 drwxr-xr-x 2 ldap ldap 4096 Jan 3 19:24 . drwxr-x--- 4 ldap ldap 4096 Jan 4 11:06 .. I am trying to go through the script code (in the backup script and in ldap-common) but it's no easy task. Can someone suggest some solution? What may be going wrong? Why everything seems successful although no backup is taken? What are these 0 of 0 locks? Any help will be appreciated. Thanks in advance, Nick

3 3

OpenLDAP 2.4.24?
by Marco Pizzoli 04 Jan '11

04 Jan '11

Hi all, I would like to know if is there a plan to make a new release of OL in the following months. Thanks in advance Marco -- _________________________________________ Non è forte chi non cade, ma chi cadendo ha la forza di rialzarsi. Jim Morrison

4 6

Re: Index for objectclass does not work...
by Steeg Carson 04 Jan '11

04 Jan '11

2011/1/4 Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Tuesday, January 04, 2011 1:43 AM +0100 Steeg Carson > <steeg.carson(a)googlemail.com> wrote: > >> I simulate this on my database just right now: > > I suggest you read: > > <http://www.openldap.org/lists/openldap-technical/201011/msg00146.html> > > to understand how indices and their slots work. > I tried to follow Howard advice with the "empty suffix", but it did'nt work. So I'll work through tomorrow (today) to understand this. Now its about 3:00am and I have to go home ;) in my bed ... Thank you very much for help till now! Kindly regards, Steeg

1 0

Re: Index for objectclass does not work...
by Steeg Carson 04 Jan '11

04 Jan '11

2011/1/4 Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Tuesday, January 04, 2011 1:08 AM +0100 Steeg Carson > <steeg.carson(a)googlemail.com> wrote: > >>> This does not look like a valid ldapsearch: >>> >>> ldapsearch -x -h localhost -D"uid=admin,ou=root" -b"cn=ou=root>" >>> "(ObjectClass=subEngine)" dn | grep "^dn:" | wc -l) >>> >>> The -b setting in particular looks broken, which is problem why you are >>> getting that message. >> >> Sorry, the base DN in the search should be -b"ou=root", my mistake. I >> tried to shorten it in the message... > > Please provide the exact ldapsearch in its entirety then (minus any > password). > I simulate this on my database just right now: =>set logelevel 33 echo >/var/log/messages # time ldapsearch -x -h localhost -wpassword -D"uid=admin,ou=root" -b"ou=root" "(objectClass=subEngine)" dn | grep "^dn:" | wc -l 104384 real 1m45.518s user 0m1.208s sys 0m1.332s grep "hdb_search:" /var/log/messages | wc -l 366201 => result form messages: ################################################### backend_startup_one: starting "ou=root" hdb_db_open: database "ou=root": dbenv_open(/var/lib/ldap_hdb). hdb_monitor_db_open: monitoring disabled; configure monitor database to enable slapd starting slap_listener_activate(7): >>> slap_listener(ldap:///) connection_get(12): got connid=1000 connection_read(12): checking for input on id=1000 op tag 0x60, time 1294100496 conn=1000 op=0 do_bind >>> dnPrettyNormal: <> <<< dnPrettyNormal: <>, <> do_bind: version=3 dn="" method=128 send_ldap_result: conn=1000 op=0 p=3 send_ldap_response: msgid=1 tag=97 err=48 do_bind: v3 anonymous bind connection_get(12): got connid=1000 connection_read(12): checking for input on id=1000 ber_get_next on fd 12 failed errno=0 (Success) connection_close: conn=1000 sd=12 slap_listener_activate(7): >>> slap_listener(ldap:///) connection_get(12): got connid=1001 connection_read(12): checking for input on id=1001 op tag 0x60, time 1294100553 conn=1001 op=0 do_bind >>> dnPrettyNormal: <uid=admin,ou=root> <<< dnPrettyNormal: <uid=admin,ou=root>, <cn=root,ou=admins,ou=root> do_bind: version=3 dn="uid=admin,ou=root" method=128 do_bind: v3 bind: "uid=admin,ou=root" to "uid=admin,ou=root" send_ldap_result: conn=1001 op=0 p=3 send_ldap_response: msgid=1 tag=97 err=0 connection_get(12): got connid=1001 connection_read(12): checking for input on id=1001 op tag 0x63, time 1294100553 conn=1001 op=1 do_search >>> dnPrettyNormal: <ou=root> <<< dnPrettyNormal: <ou=root>, <ou=root> begin get_filter EQUALITY end get_filter 0 => hdb_search bdb_dn2entry("ou=root") => hdb_dn2id("ou=root") <= hdb_dn2id: got id=0x1 entry_decode: "" <= entry_decode() search_candidates: base="ou=root" (0x00000001) scope=2 => hdb_dn2idl("ou=root") => bdb_filter_candidates #011AND => bdb_list_candidates 0xa0 => bdb_filter_candidates #011OR => bdb_list_candidates 0xa1 => bdb_filter_candidates #011EQUALITY => bdb_equality_candidates (objectClass) => key_read <= bdb_index_read: failed (-30989) <= bdb_equality_candidates: id=0, first=0, last=0 <= bdb_filter_candidates: id=0 first=0 last=0 => bdb_filter_candidates #011EQUALITY => bdb_equality_candidates (objectClass) => key_read <= bdb_index_read 470601 candidates <= bdb_equality_candidates: id=-1, first=228, last=470828 <= bdb_filter_candidates: id=-1 first=228 last=470828 <= bdb_list_candidates: id=-1 first=228 last=470828 <= bdb_filter_candidates: id=-1 first=228 last=470828 <= bdb_list_candidates: id=-1 first=228 last=470828 <= bdb_filter_candidates: id=-1 first=228 last=470828 bdb_search_candidates: id=-1 first=228 last=470828 entry_decode: "" <= entry_decode() => test_filter EQUALITY <= test_filter 6 entry_decode: "" <= entry_decode() => test_filter EQUALITY <= test_filter 5 hdb_search: 229 does not match filter entry_decode: "" <= entry_decode() => test_filter EQUALITY <= test_filter 5 hdb_search: 230 does not match filter entry_decode: "" <= entry_decode() => test_filter EQUALITY <= test_filter 5 hdb_search: 231 does not match filter entry_decode: "" <= entry_decode() => test_filter EQUALITY , , , and so on Thanks Steeg

2 1

Re: Index for objectclass does not work...
by Steeg Carson 04 Jan '11

04 Jan '11

2011/1/4 Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Tuesday, January 04, 2011 12:50 AM +0100 Steeg Carson > <steeg.carson(a)googlemail.com> wrote: > >> 2011/1/3 Quanah Gibson-Mount <quanah(a)zimbra.com>: >>>>> >>>>> The DB is always read off disk into the BDB backing cache the very >>>>> first time slapd is run (assuming back-bdb or back-hdb are your >>>>> backends). I don't see any bug/issue here. >>>>> >>>> >>>> But does the slapd process during this time _write_ (heavy the whole >>>> time) to the disk? >>> >>> Did you configure you BDB backing cache to be in memory, or on disk? >>> The default is for it to be on the disk. If you want it to be in >>> memory, set an shm_key value in the database configuration. >>> >>> --Quanah >>> >> >> Yes, thanks, thats it :). But why are the shared Memory on disk? Does >> it not make the slapd slower? > > I've only noticed it making things slower on databases that are 8GB or later > in size. > >> My second problem is, that I don't really understand, how indexes >> work, or is the a problem with slapd, my configuration or my Database? >> As I said in the message before, >> the searched objectClass=subEngine exists 104384 times in the entire >> directory: (=> ldapsearch -x -h localhost -D"uid=admin,ou=root" >> -b"cn=ou=root>" "(ObjectClass=subEngine)" dn | grep "^dn:" | wc -l) > > This does not look like a valid ldapsearch: > > ldapsearch -x -h localhost -D"uid=admin,ou=root" -b"cn=ou=root>" > "(ObjectClass=subEngine)" dn | grep "^dn:" | wc -l) > > The -b setting in particular looks broken, which is problem why you are > getting that message. Sorry, the base DN in the search should be -b"ou=root", my mistake. I tried to shorten it in the message... Thanks Steeg

2 1

Re: Index for objectclass does not work...
by Steeg Carson 04 Jan '11

04 Jan '11

2011/1/3 Quanah Gibson-Mount <quanah(a)zimbra.com>: >>> The DB is always read off disk into the BDB backing cache the very first >>> time slapd is run (assuming back-bdb or back-hdb are your backends). I >>> don't see any bug/issue here. >>> >> >> But does the slapd process during this time _write_ (heavy the whole >> time) to the disk? > > Did you configure you BDB backing cache to be in memory, or on disk? The > default is for it to be on the disk. If you want it to be in memory, set an > shm_key value in the database configuration. > > --Quanah > Yes, thanks, thats it :). But why are the shared Memory on disk? Does it not make the slapd slower? My second problem is, that I don't really understand, how indexes work, or is the a problem with slapd, my configuration or my Database? As I said in the message before, the searched objectClass=subEngine exists 104384 times in the entire directory: (=> ldapsearch -x -h localhost -D"uid=admin,ou=root" -b"cn=ou=root>" "(ObjectClass=subEngine)" dn | grep "^dn:" | wc -l) If I configure with index for Objectclass, I get for the search following messages: ####################################################################### => bdb_equality_candidates (objectClass) => key_read <= bdb_index_read 470601 candidates <= bdb_equality_candidates: id=-1, first=228, last=470828 <= bdb_filter_candidates: id=-1 first=228 last=470828 <= bdb_list_candidates: id=-1 first=228 last=470828 <= bdb_filter_candidates: id=-1 first=228 last=470828 <= bdb_list_candidates: id=-1 first=40595 last=470828 <= bdb_filter_candidates: id=-1 first=40595 last=470828 bdb_search_candidates: id=-1 first=40595 last=470828 ####################################################################### If I search then in the logfile, I see 430233 messages like: "hdb_search: <candidate> <message: does not match filter | scope not okay>" Why does the it the search (hdbsearch) 430233 times, instead only 104384 times? I've also rebuild the index, should the index not only return 104384 candidates? Thanks for helping! Kindly regards, Steeg

2 1

Re: Index for objectclass does not work...
by Steeg Carson 03 Jan '11

03 Jan '11

2011/1/3 Quanah Gibson-Mount <quanah(a)zimbra.com>: > --On Monday, January 03, 2011 9:22 PM +0100 Steeg Carson > <steeg.carson(a)googlemail.com> wrote: > >> I also used strace to catch the problem, but i did not find where the >> slapd write to disk. It seems, it comes via set up the futex write >> locks? I'm not a kernel programmer and the code from openldap is hard >> to read. But strace I use for several years to find errors, it was >> also the first choice for me, to find the error. It is not a normal >> file that will be written... > > The DB is always read off disk into the BDB backing cache the very first > time slapd is run (assuming back-bdb or back-hdb are your backends). I > don't see any bug/issue here. > But does the slapd process during this time _write_ (heavy the whole time) to the disk? I try to check this with oprofile too, but it seems not work proper with vmware ... Thanks Steeg

2 1

Index for objectclass does not work...
by Steeg Carson 03 Jan '11

03 Jan '11

Hello again, I can't solve my problem on my own... please help. As I can see at the moment, the Index for objectclass is not used. The searchtime with and without index for objectclass is the same! The search looks like: ldapsearch -x -h localhost -wpassword -D"uid=admin,ou=root" -b"cn=ownPath,ou=root" "(ObjectClass=subEngine)" The first serach, it takes about 40seconds. So after the cache is filled, the next searches takes only about 2 seconds (during both logging is turned off!)... It doesn't matter whether the index is set up in the config or not. To check, that the index is really set up (or not), I set loglevel 64 ind the slapd.conf: ####################################################################### @(#) $OpenLDAP: slapd 2.4.23 $#012#011opensuse-buildservice(a)opensuse.org line 30 (rootpw ***) line 31 (directory#011/var/lib/ldap_hdb) line 32 (logfile#011#011/var/log/openldap.log) line 33 (cachesize 1000000) line 34 (dncachesize 1000000) line 34 (idlcachesize 3000000) line 36 (dbnosync) line 38 (index objectClass eq) index objectClass 0x0004 line 39 (index cn eq,sub) index cn 0x0714 hdb_monitor_db_open: monitoring disabled; configure monitor database to enable slapd starting ####################################################################### The searched objectClass=subEngine exists 104384 times in the entire directory: (=> ldapsearch -x -h localhost -D"uid=admin,ou=root" -b"cn=ou=root>" "(ObjectClass=subEngine)" dn | grep "^dn:" | wc -l) If I configure with index for Objectclass, I get for the search following messages: ####################################################################### => bdb_equality_candidates (objectClass) => key_read <= bdb_index_read 470601 candidates <= bdb_equality_candidates: id=-1, first=228, last=470828 <= bdb_filter_candidates: id=-1 first=228 last=470828 <= bdb_list_candidates: id=-1 first=228 last=470828 <= bdb_filter_candidates: id=-1 first=228 last=470828 <= bdb_list_candidates: id=-1 first=40595 last=470828 <= bdb_filter_candidates: id=-1 first=40595 last=470828 bdb_search_candidates: id=-1 first=40595 last=470828 ####################################################################### If I search then in the logfile, I see 430233 messages like: "hdb_search: <candidate> <message: does not match filter | scope not okay>" If I configure without index for objectclass, I get for the search following messages: ####################################################################### => bdb_equality_candidates (objectClass) <= bdb_equality_candidates: (objectClass) not indexed <= bdb_filter_candidates: id=-1 first=1 last=470828 <= bdb_list_candidates: id=-1 first=1 last=470828 <= bdb_filter_candidates: id=-1 first=1 last=470828 <= bdb_list_candidates: id=-1 first=40595 last=470828 <= bdb_filter_candidates: id=-1 first=40595 last=470828 bdb_search_candidates: id=-1 first=40595 last=470828 ####################################################################### During initial set up of the Database (slapadd, copied from production, off-line with slapcat), the index for objectclass was build. I also tried to rebuild the index with slapindex. I configured a 64bit system, with 16GByte RAM and 2 CPUs under VMware ESX with own SAS-Storage (RAID10) for only this Machine. The entire directory holds 470812 entires. (=> ldapsearch -x -h localhost -wpassword -D"uid=admin,ou=root" -b"ou=root" "(objectClass=*)" dn | grep "^dn:" | wc -l) I configured slapd.conf as following: ####################################################################### include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/rfc2307bis.schema include /etc/openldap/schema/own.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args modulepath /usr/lib/ldap moduleload back_hdb sizelimit -1 timelimit 300 disallow bind_anon gentlehup on tool-threads 2 # hdb database definitions database hdb suffix "ou=root" rootdn "uid=admin,ou=root" checkpoint 4096 15 # loglevel only for test, not during time measuring loglevel 33 # or for config file processing # loglevel 64 rootpw password directory /var/lib/ldap_hdb logfile /var/log/openldap.log cachesize 1000000 dncachesize 1000000 idlcachesize 3000000 dbnosync index objectClass,entryUUID,entryCSN eq index cn eq,sub ####################################################################### In DB_CONF I set 2GB BDB page cache (set_cachesize 2 0 1) Thanks for help, kindly regards Steeg PS: During the first search, the disk is heavy used (iotop) by writing from slapd.conf ... why it - should only read ...? -

3 3

Re: Windows ldp.exe kills openldap 2.4.23
by masarati＠aero.polimi.it 03 Jan '11

03 Jan '11

> On Sun, Jan 2, 2011 at 3:45 AM, <masarati(a)aero.polimi.it> wrote: >> >> >>>> Is this a know bug (see ITS#6570) or something new? Is there a >>>> workaround >>>> it? >>> >>> AFAIK it is not known. I am able to reproduce it (Linux, HEAD code), >>> so I >>> suggest you file an ITS. With respect to a workaround, it is not clear >>> what's the purpose of the operation you're trying to accomplish. In >>> general, a modrdn on the empty DN should be meaningless (although it >>> should not crash the server). >> >> A fix is in HEAD (slapd/modrdn.c); please test. p. Please keep replies on the thread. > Thanks, I'll give it a try. And sorry for the confusion, by "work > around" a meant securing server from a such easy DOS attack, > i.e.preventing a crush. > > Do you know when 2.4.24 is scheduled to come out? Do you still want me > to create an ITS? Yes, please, so we can track the issue. Thanks, p.

2 2

Re: Kerberos/GSSAPI issues
by Brian Candler 02 Jan '11

02 Jan '11

On Thu, Dec 30, 2010 at 11:49:23AM -0800, Russ Allbery wrote: > > Have you got the one-line patch? > > Included below. Thank you Russ. Discussed further on kerberos(a)mit.edu list, and ticket raised as http://bugzilla.cyrusimap.org/show_bug.cgi?id=3380 Regards, Brian.

1 0

SASL proxy auth problem
by Jaap Winius 02 Jan '11

02 Jan '11

Hi folks, Thanks to Pierangelo's last reply, I now know what I suspected: that my consumer servers are configured to authenticate to their providers using SASL/GSSAPI, but that sometimes they don't do this, especially with proxy authorization. I've documented the entire install process: * OpenLDAP provider with MIT Kerberos V on Debian squeeze http://www.rjsystems.nl/en/2100-d6-openldap-provider-kerberos.php * OpenLDAP consumer with MIT Kerberos V on Debian squeeze http://www.rjsystems.nl/en/2100-d6-openldap-consumer-kerberos.php The last time I followed these instructions to the letter, proxy authorization worked. Now I've booted up the same machines again a few days later and it no longer works: the consumer still uses SASL to bind with the provider for replication, but it uses a SIMPLE bind for proxy authorization. Of course that results in an error. Yet, the configuration seems unchanged. Has anyone else experienced this problem? Thanks, Jaap PS -- If anyone is interested, I can supply plenty of details. See also my post of 12/24/2010 03:25:51 AM CET with subject "No ProxyAuthz with SASL-GSSAPI?"

2 6

Re: Windows ldp.exe kills openldap 2.4.23
by masarati＠aero.polimi.it 02 Jan '11

02 Jan '11

>> Is this a know bug (see ITS#6570) or something new? Is there a >> workaround >> it? > > AFAIK it is not known. I am able to reproduce it (Linux, HEAD code), so I > suggest you file an ITS. With respect to a workaround, it is not clear > what's the purpose of the operation you're trying to accomplish. In > general, a modrdn on the empty DN should be meaningless (although it > should not crash the server). A fix is in HEAD (slapd/modrdn.c); please test. p.

1 0

Windows ldp.exe kills openldap 2.4.23
by Serge Dubrouski 02 Jan '11

02 Jan '11

Hello - I just found that ldp.exe tool that comes with Windows is able to successfully kill OpenLDAP 2.4.23 when one tries tp modify DN and submits an empty old DN. Log files on openldap show this: Dec 29 15:19:32 ottawa slapd[11818]: conn=1000 op=2 do_modrdn Dec 29 15:19:32 ottawa slapd[11818]: do_modrdn: dn () newrdn (C=US) newsuperior () Dec 29 15:19:32 ottawa slapd[11818]: >>> dnPrettyNormal: <> Dec 29 15:19:32 ottawa slapd[11818]: <<< dnPrettyNormal: <>, <> Dec 29 15:19:32 ottawa slapd[11818]: >>> dnPrettyNormal: <C=US> Dec 29 15:19:32 ottawa slapd[11818]: <<< dnPrettyNormal: <c=US>, <c=us> Dec 29 15:19:32 ottawa slapd[11818]: conn=1000 op=2 MODRDN dn="" Is this a know bug (see ITS#6570) or something new? Is there a workaround it? -- Serge Dubrouski.

2 1

slapd bind method codes
by Jaap Winius 01 Jan '11

01 Jan '11

Hi folks, When clients bind with a provider and the provider's loglevel is set to stats, bind events show up frequently in the log. Often, some logged bind events have only a blank dn along with a "method" code. Here are two separate examples: slapd[903]: conn=1021 op=0 BIND dn="" method=128 slapd[903]: conn=1020 op=0 BIND dn="" method=163 Two questions: 1.) What do these method codes mean? Perhaps there list somewhere that explains all possible method codes. 2.) When a method code is shown, as in the examples above, why is the value for the dn empty? Thanks, Jaap

2 1

ber_flatten() of incomplete ber
by masarati＠aero.polimi.it 31 Dec '10

31 Dec '10

I was encoding a ber of the form "{{something}" (note the missing "}") using HEAD's liblber. ber_flatten() was (correctly?) returning an empty value; perhaps it should return an error code, indicating that the ber is incomplete? Am I missing some function to test the validity of a ber? p.

2 3

How Indexes work?
by Steeg Carson 30 Dec '10

30 Dec '10

Hello, I try to understand, how the LDAP-Indexes work. If I configure a Index for a Attribute like: index myAttribute eq the index file myAttribute.bdb is build in the data directory. When I search then ldapsearch -x -h localhost -D".." -b"<baseDN>" "(myAttribute=<searched key>)" how will the LDAP-Server process this request? Is there anywhere a good documentation? My assumption is: * At first, a the Index is looked up. The result are only the matched IDs. * The LDAP-Server now can quick give back all entries form id2enty.bdb If I use Indexes, are all other entries are examined too after give back the result from indexes? I have a database, and my search is like shown above. The search takes long. The cache is configured, the size is enough (approx. dn2id.bdb + id2entry.bdb). But what I see, is that the write IO from LDAP is enormously (seen with iotop). During the whole search, the write IO is higher than the read IO. Why? Thanks for help. Steeg

3 6

Kerberos/GSSAPI issues
by Brian Candler 30 Dec '10

30 Dec '10

Hello, I'm setting up an openldap server for Kerberos (GSSAPI) authentication only. I'm using slapd-2.4.21 from Ubuntu 10.04.1. It's basically working, and I had to do very little other than change export KRB5_KTNAME in /etc/default/slapd to point to the service keytab. However, there are a couple of strange things which I wonder if someone could help me with. (1) According to the documentation at http://www.openldap.org/doc/admin24/sasl.html#GSSAPI then the authentication DN should be uid=<primary[/instance]>,cn=<realm>,cn=gssapi,cn=auth However, running slapd in debug mode I see the cn=<realm> is missing. Here I have a ticket for inst/admin(a)WS.NSRC.ORG and run slapd -d 255: ... do_bind: dn () SASL mech GSSAPI ==> sasl_bind: dn="" mech=<continuing> datalen=32 SASL Canonicalize [conn=1000]: authcid="inst/admin" slap_sasl_getdn: conn 1000 id=inst/admin [len=10] => ldap_dn2bv(16) <= ldap_dn2bv(uid=inst/admin,cn=GSSAPI,cn=auth)=0 slap_sasl_getdn: u:id converted to uid=inst/admin,cn=GSSAPI,cn=auth >>> dnNormalize: <uid=inst/admin,cn=GSSAPI,cn=auth> => ldap_bv2dn(uid=inst/admin,cn=GSSAPI,cn=auth,0) <= ldap_bv2dn(uid=inst/admin,cn=GSSAPI,cn=auth)=0 => ldap_dn2bv(272) <= ldap_dn2bv(uid=inst/admin,cn=gssapi,cn=auth)=0 <<< dnNormalize: <uid=inst/admin,cn=gssapi,cn=auth> ==>slap_sasl2dn: converting SASL name uid=inst/admin,cn=gssapi,cn=auth to a DN <==slap_sasl2dn: Converted SASL name to <nothing> SASL Canonicalize [conn=1000]: slapAuthcDN="uid=inst/admin,cn=gssapi,cn=auth" SASL proxy authorize [conn=1000]: authcid="inst/admin" authzid="inst/admin" SASL Authorize [conn=1000]: proxy authorization allowed authzDN="" send_ldap_sasl: err=0 len=-1 do_bind: SASL/GSSAPI bind: dn="uid=inst/admin,cn=gssapi,cn=auth" sasl_ssf=56 ... ==> limits_get: conn=1000 op=3 self="uid=inst/admin,cn=gssapi,cn=auth" this="dc=ws,dc=nsrc,dc=org" ... Now this works, if I change my ACL to olcAccess: {0}to * by dn.regex="^uid=([^,]+)/admin,cn=gssapi,cn=auth$" manage by users read However, I wonder why the realm is missing, and whether it can be included (because in future, if I end up with a cross-realm setup, I'll want to see the realm for authorization) Is this a documentation error, or is there some configuration option which needs setting to preserve the realm? (2) I would like to be able to do ldapsearch without specifying -Y GSSAPI explicitly. However if I omit it, the client picks DIGEST-MD5 instead (which isn't much use, since I have no passwords in the database) # ldapsearch -b "ds=ws,dc=nsrc,dc=org" SASL/DIGEST-MD5 authentication started Please enter your password: Adding -d 255 I see that the server is offering these: ... ldap_sasl_interactive_bind_s: server supports: NTLM DIGEST-MD5 GSSAPI CRAM-MD5 ldap_int_sasl_bind: NTLM DIGEST-MD5 GSSAPI CRAM-MD5 ... How can I configure the server not to offer the other authentication mechanisms, or else to put GSSAPI at the front of the list? Thanks, Brian.

4 13

Re: invalid credentials (49) for normal user
by rui 30 Dec '10

30 Dec '10

Hi, After running slapd with "-d 128" i have found lot of messages like this. Can somebody point me to standard acl for users, i want to authenticate for every user using ldap browser or c ldap api with ldap_simple_bind with binddn bindn=uid=rui,ou=People,o=m1,c=GB ############################### Dec 29 14:13:53 m4mrh01 slapd: => acl_mask: access to entry "cn=rui,ou=Group,o=m1,c=GB", attr "objectClass" requested Dec 29 14:13:53 m4mrh01 slapd: => acl_mask: to value by "", (=n) Dec 29 14:13:54 m4mrh01 slapd: <= acl_mask: no more <who> clauses, returning =n (stop) Dec 29 14:13:54 m4mrh01 slapd: => access_allowed: search access denied by =n Dec 29 14:13:54 m4mrh01 slapd: => access_allowed: search access to "cn=m4musers,ou=Group,o=m1,c=GB" "memberUid" requested Dec 29 14:13:54 m4mrh01 slapd: => acl_get: [2] attr memberUid Dec 29 14:13:54 m4mrh01 slapd: => acl_mask: access to entry "cn=m4musers,ou=Group,o=m1,c=GB", attr "memberUid" requested Dec 29 14:13:54 m4mrh01 slapd: => acl_mask: to value by "", (=n) Dec 29 14:13:54 m4mrh01 slapd: <= acl_mask: no more <who> clauses, returning =n (stop) Dec 29 14:13:54 m4mrh01 slapd: => access_allowed: search access denied by =n Dec 29 14:18:04 m4mrh01 slapd: => access_allowed: auth access to "uid=rui,ou=People,o=m1,c=GB" "userPassword" requested Dec 29 14:18:04 m4mrh01 slapd: => acl_get: [1] attr userPassword Dec 29 14:18:04 m4mrh01 slapd: => acl_mask: access to entry "uid=rui,ou=People,o=m1,c=GB", attr "userPassword" requested Dec 29 14:18:04 m4mrh01 slapd: => acl_mask: to all values by "", (=n) Dec 29 14:18:04 m4mrh01 slapd: <= acl_mask: no more <who> clauses, returning =n (stop) Dec 29 14:18:04 m4mrh01 slapd: => access_allowed: auth access denied by =n ############################### I have also changed slapd.conf slightly ############################# access to attr=userPassword by self write by dn="uid=root,ou=People,o=M1,c=GB" write by * read access to * by self write by users read by anonymous auth ############################### Regards, rui > 1. invalid credentials (49) for normal user (rui) > 2. Re: invalid credentials (49) for normal user (Dieter Kluenter) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 24 Dec 2010 10:32:03 +0000 > From: rui <guideveloper(a)gmail.com> > To: openldap-technical(a)openldap.org > Subject: invalid credentials (49) for normal user > Message-ID: > <AANLkTikbS2LTj4D-0WMBdJXzMeBMpb3qO2=Y4wzPLv0G(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Hi, > > I have imported my passwd and groups file in ldap using > migrate_all_online.sh script. > > I am able to simple bind to ldap using > binddn= uid=root,ou=People,o=M1,c=GB but i can't seem to bind with any > other user like rui etc with their linux password. Its says invalid > credentials. > > I need to bind for authentication and then get all the primary and > secondary groups of a user(how can i do that). Why am i having this > problem - do i have to do something extra? > > When bound as root, if i do "memberUid=root" i get all the secondary > groups but i want to do it for any user. > > I am using c ldap api at the moment. > > > Here is my slapd.conf file: > ################################################## > # # See slapd.conf(5) for details on configuration options. > # This file should NOT be world readable. # > include /etc/openldap/schema/core.schema > include /etc/openldap/schema/cosine.schema > include /etc/openldap/schema/dyngroup.schema > include /etc/openldap/schema/inetorgperson.schema > include /etc/openldap/schema/misc.schema > include /etc/openldap/schema/nis.schema > include /etc/openldap/schema/openldap.schema > > ####################################################################### > # ldbm database definitions > ####################################################################### > database ldbm > suffix "o=M1,c=GB" > rootdn "uid=root,ou=People,o=M1,c=GB" > rootpw abc123 > directory /var/lib/ldap > > # Indices to maintain > index objectClass,uid,uidNumber,gidNumber eq > index cn,mail,surname,givenname eq,subinitial > > # # ACLs # > #access to dn="ou=People,o=M1,c=GB" > #attr=userPassword > #by self write > #by dn="uid=root,ou=People,o=M1,c=GB" write > #by * auth access to dn=".*,o=M1,c=GB" by self write > #by dn="uid=root,ou=People,o=M1,c=GB" write > #by * read access to dn=".*,o= M1,c=GB" > #by * read defaultaccess read > > access to attr=userpassword > by self write > by dn="uid=root,ou=People,o=M1,c=GB" write > by * read > > access to * > by self write > by dn=".+" read > by * read > > ############################################### > > Regards, > rui > > > ------------------------------ > > Message: 2 > Date: Sat, 25 Dec 2010 22:58:14 +0100 > From: "Dieter Kluenter" <dieter(a)dkluenter.de> > To: openldap-technical(a)openldap.org > Subject: Re: invalid credentials (49) for normal user > Message-ID: <87d3op1pmx.fsf(a)rubin.avci.de> > Content-Type: text/plain; charset=utf-8 > > rui <guideveloper(a)gmail.com> writes: > >> Hi, >> >> I have imported my passwd and groups file in ldap using >> migrate_all_online.sh script. >> >> I am able to simple bind to ldap using >> binddn= uid=root,ou=People,o=M1,c=GB but i can't seem to bind with any >> other user like rui etc with their linux password. Its says invalid >> credentials. > [...] > > run slapd in debugging mode, i.e. -d acl > > > ############ >> # ldbm database definitions >> ####################################################################### >> database ldbm > > ldbm is historic and not supported. > > -Dieter > > -- > Dieter Kl?nter | Systemberatung > http://dkluenter.de > GPG Key ID:DA147B05 > 53?37'09,95"N > 10?08'02,42"E > > > ------------------------------ > > _______________________________________________ > openldap-technical mailing list > openldap-technical(a)openldap.org > http://www.openldap.org/lists/mm/listinfo/openldap-technical > > > End of openldap-technical Digest, Vol 37, Issue 22 > ************************************************** >

3 6

Is attribute options supported?
by Angel L. Mateo 30 Dec '10

30 Dec '10

Hello, Is attribute options supported in openldap (version 2.4.21)? In RFC 2251 (LDAPv3) the attributes in search could be specified as attribute_name;options, so you could indicate options in the return of the attributes. Specifically, what I want to do is: I have attributes wich value is a URN, so I want to get just a special part of the URN, that is: Traditional search: Ldap filter: (mail=user(a)mydomain.com) Atributos: mail, schacPersonalUniqueID Result: mail: user(a)mydomain.com schacPersonalUniqueID: urn:mace:terena.org:schac:personalUniqueID:es:12345678Q Search with options: Ldap filter: (mail=user(a)mydomain.com) Atributos: mail, schacPersonalUniqueID;x-urn-7 Result: mail: user(a)mydomain.com schacPersonalUniqueID: 12345678Q I have tried this with a standard configuration, but it isn't working: amateo@joshua:~$ /usr/bin/ldapsearch ... mail=user(a)mydomain.com schacPersonalUniqueID;x-urn-7 # extended LDIF # # LDAPv3 # base <dc=Telematica> with scope subtree # filter: uid=amateo # requesting: irisClassifCode # # amateo, Usuarios, telematica dn: uid=user,ou=People,dc=mydomain,dc=com # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 x-urn-1: orden no encontrada Is it supported? Do I have to configure anything in the slapd server? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 868887590 Fax: 868888337

3 2

ldapsearch from server does not work but works from client
by Seau Yeen Su 30 Dec '10

30 Dec '10

Hi all, I have managed to install OpenLdap 2.4 on a RHEL 5.2 workstation. The basic openldap without TLS/SSL works fine. On the server itself and from the client I was able to do ldapsearch. However, after I created a server.pem by going through this : [url= http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch31_:_Cent… : Ch31 : Centralized Logins Using LDAP and RADIUS - Linux Home Networking[/url] ldapsearch on the ldap server itself does not work anymore. The summary of the configuration is as below: server.pem is created in /usr/local/etc/openldalp/cacerts and client.pem is in /etc/openldap/cacerts. client.pem is also moved to clients and ldapsearch works fine from client workstation. However, in the ldap server itself it does not. THe output of /etc/ldap.conf looks like below: uri ldaps://syna-ldap-02.synamatix.com/ tls_cacertdir /etc/openldap/cacerts pam_password md5 My /usr/local/etc/openldap/slapd.conf TLS portion looks like below: TLSCipherSuite HIGH:MEDIUM:+SSLv2:+SSLv3:RSA TLSCACertificateFile /usr/local/etc/openldap/cacerts/server.pem TLSCertificateFile /usr/local/etc/openldap/cacerts/server.pem TLSCertificateKeyFile /usr/local/etc/openldap/cacerts/server.pem TLSVerifyClient allow The error from ldapsearch x -H ldaps://syna-ldap-02.synamatix.com -d127 in the server itself is as below: TLS ceritficate verification: depth: 0, err: 18, subject: /C=MY/ST=KL/L=MV/O=MGRC/OU=IT/CN= syna-ldap-02.synamatix.com/emailAddress=seauyeen@mgrc.com.my, issuer: /C=MY/ST=KL/L=MV/O=MGRC/OU=IT/CN= syna-ldap-02.synamatix.com/emailAddress=seauyeen@mgrc.com.my TLS certificate verification: Error, self signed certificate tls_write: want=7, write=7 0000: 15 03 01 00 02 02 30 TLS trace: SSL3 alert write:fata:unknown CA TLS trace: SSL connect:error in SSLv3 read server certificate B TLS trace: SSL_connect:error in SSLv3 read server certificate B TLS: can't connect: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (self signed certificate). ldap_err2string ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) On the server end, as I started with debug mode, I get errors below: TLS trace: SSL3 alert read: fatal: unknown CA TLS trace: SSL_accept:failed in SSLv3 read client certificate A TLS: can't accept: erro: 14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca. connection_read(13): TLS accept failure error=-1 id=1010,closing ..... Why is that ldapsearch from client workstation works fine but not in the ldap server itself? It is osoo baffling. It is fine without TLS activated. I have been working on this for 1 week! The information online does not seem to cater to this weird incident of mine. Hope to receive some assistance really soon. If you need files and attachments, please inform me. Thanks and Happy new year guys!!!! -- ------------------------------ MGRC - Accelerating Your Journey of Discovery *Su Seau Yeen Assistant Manager IT Operations * * * *Malaysian Genomics Resource Centre Berhad (MGRC)* T: +6 03 2283 1820 | F: +6 03 2282 8102 | M: +6 012 6784642 | www.mgrc.com.my ------------------------------ This e-mail is intended only for the use of the individual or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of or taking of any action in reliance upon this information by persons or entities other than the intended recipient, is strictly prohibited. If you receive this e-mail in error, please contact us immediately by return e-mail and delete the original message(s).

1 0

one system won't authenticate
by Christ Schlacta 28 Dec '10

28 Dec '10

I've got two systems authenticating against an openldap directory, and one that refuses. I'm attempting to debug why this system won't authenticate, but there's nothing useful in auth.log, and I can't decipher the voluminous output that -d 255 provides. Iv'e checkeced all my configs and my passwords repeatedly. can anyone suggest a next step from here? PS: the system that won't auth is also the system hosting the ldap directory. TIA!!

1 0

ldap server failover on Kerberos servers?
by Kevin Longfellow 28 Dec '10

28 Dec '10

Hi, Using LDAP as the back end for Kerberos principals and openldap 2.3.43 as the client on the Kerberos servers, I see it's possible to add some failover with ldap_servers in /etc/krb5.conf and URI in /etc/openldap/ldap.conf. For example: /etc/krb5.conf: ldap_servers = ldaps://hostname1:636 ldaps://hostname2:636 /etc/openldap/ldap.conf: URI ldaps://hostname1:636 ldaps://hostname2:636 In our situation, the ldap servers are behind a BigIP so only a single hostname can be entered. I'm curious if it makes any sense to add the BigIP hostname twice? Once the initial connection is made by the Kerberos server to the first ldap server are there any failure scenarios that the below would make any sense? /etc/krb5.conf: ldap_servers = ldaps://<bigip hostname>:636 ldaps://<bigip hostname>:636 /etc/openldap/ldap.conf: URI ldaps://<bigip hostname>:636 ldaps://<bigip hostname>:636 Hopefully it makes sense what I'm asking and thanks for your time. Regards, Kevin

2 1

Problem with ACL in 2.4.22
by Nick Milas 28 Dec '10

28 Dec '10

Hi, I have upgraded from 2.3.43 to 2.4.22 on CentOS 5.5. Everything works fine, except my ACLs don't work on the new version. Strange results occur. Has anything changed significantly in v2.4 ACLs in comparison to v2.3 ACLs? For example, the following piece of code works as expected in v2.3 but not in v2.4. If some user logs in and is a member of a GroupXAdmins (where X = 1-6), he can't see the branch at all. # Allow access to entries of the subtree # access to dn.sub="dc=12.11.10.in-addr.arpa,ou=dns1,dc=example,dc=com" attrs="children,entry" by group.exact="cn=Group1Admins,ou=Groups,dc=example,dc=com" write by group.exact="cn=Group2Admins,ou=Groups,dc=example,dc=com" read by group.exact="cn=Group3Admins,ou=Groups,dc=example,dc=com" read by group.exact="cn=Group4Admins,ou=Groups,dc=example,dc=com" write by group.exact="cn=Group5Admins,ou=Groups,dc=example,dc=com" read by group.exact="cn=Group6Admins,ou=Groups,dc=example,dc=com" read by dn.exact="uid=dnsauthusr,ou=System,dc=example,dc=gr" read by * break # Allow access to all attributes of the subtree # access to dn.sub="dc=12.11.10.in-addr.arpa,ou=dns1,dc=example,dc=com" by group.exact="cn=Group1Admins,ou=Groups,dc=example,dc=com" write by group.exact="cn=Group2Admins,ou=Groups,dc=example,dc=com" read by group.exact="cn=Group3Admins,ou=Groups,dc=example,dc=com" read by group.exact="cn=Group4Admins,ou=Groups,dc=example,dc=com" write by group.exact="cn=Group5Admins,ou=Groups,dc=example,dc=com" read by group.exact="cn=Group6Admins,ou=Groups,dc=example,dc=com" read by dn.exact="uid=dnsauthusr,ou=System,dc=example,dc=com" read where Groups are of the form: dn: cn=Group1Admins,ou=Groups,dc=example,dc=com objectClass: groupOfNames cn: Group1Admins member: uid=userx,ou=people,dc=example,dc=com Please, help. Nick

3 3

Re: Certificate authentication and back-ldap proxy
by Ubay Dorta Guerra 28 Dec '10

28 Dec '10

Hi, El 28/12/10 12:00, openldap-technical-request(a)OpenLDAP.org escribió: > Hi, > Am Mon, 27 Dec 2010 15:15:21 +0000 > schrieb Ubay Dorta Guerra <udorta(a)iac.es>: > > >> The simple bind under TLS worked but when i try to use cert-based >> SASL EXTERNAL authentication i get no success. >> >> In the proxy server configuration i add the following directive >> >> idassert-bind bindmethod=sasl >> saslmech=EXTERNAL >> binddn="CN=proxy-server1.example.com,O=Internet >> > the binddn should be empty or just don't configure a binddn. > > Thank you very much. I have deleted the binddn in proxy configuration: idassert-bind bindmethod=sasl saslmech=EXTERNAL tls_cert=/etc/ssl/certs/proxy-server1.example.com.pem tls_key=/etc/ssl/private/proxy-server1.example.com.key tls_cacertdir=/etc/ssl/cacerts/ tls_reqcert=demand mode=self Now when i make a password change: ldapmodify -x -H ldaps://proxy-server1.example.com -f pass2_user.ldif -D 'uid=user_w_pass,ou=people,dc=example,dc=com' -W Enter LDAP Password: modifying entry "uid=user_w_pass,ou=people,dc=example,dc=com" I get the following messages in syslog: ldap-proxy[16709]: conn=1054 fd=8 TLS established tls_ssf=256 ssf=256 ldap-proxy[16709]: conn=1054 op=0 BIND dn="uid=user_w_pass,ou=people,dc=example,dc=com" method=128 ldap-master[16879]: conn=1022 fd=20 TLS established tls_ssf=256 ssf=256 ldap-master[16879]: conn=1022 op=0 BIND dn="uid=user_w_pass,ou=people,dc=example,dc=com" method=128 ldap-master[16879]: conn=1022 op=0 BIND dn="uid=user_w_pass,ou=people,dc=example,dc=com" mech=SIMPLE ssf=0 ldap-master[16879]: conn=1022 op=0 RESULT tag=97 err=0 text= ldap-proxy[16709]: conn=1054 op=0 BIND dn="uid=user_w_pass,ou=people,dc=example,dc=com" mech=SIMPLE ssf=0 ldap-proxy[16709]: conn=1054 op=0 RESULT tag=97 err=0 text= ldap-proxy[16709]: conn=1054 op=1 MOD dn="uid=user_w_pass,ou=people,dc=example,dc=com" ldap-proxy[16709]: conn=1054 op=1 MOD attr=userPassword ldap-master[16879]: conn=1002 op=7 PROXYAUTHZ dn="uid=user_w_pass,ou=people,dc=example,dc=com" ldap-master[16879]: conn=1002 op=7 MOD dn="uid=user_w_pass,ou=people,dc=example,dc=com" ldap-master[16879]: conn=1002 op=7 MOD attr=userPassword ldap-master[16879]: conn=1002 op=7 RESULT tag=103 err=0 text= ldap-proxy[16709]: conn=1054 op=1 RESULT tag=103 err=0 text= ldap-proxy[16709]: conn=1054 op=2 UNBIND ldap-proxy[16709]: conn=1054 fd=8 closed Regards. --------------------------------------------------------------------------------------------- ADVERTENCIA: Sobre la privacidad y cumplimiento de la Ley de Protección de Datos, acceda a http://www.iac.es/disclaimer.php WARNING: For more information on privacy and fulfilment of the Law concerning the Protection of Data, consult http://www.iac.es/disclaimer.php?lang=en

2 1

Index Usage
by Paul 28 Dec '10

28 Dec '10

Hi all, When I started at this job I acquired OpenLDAP based authentication infrastructure, which I've pretty much been able to leave to its own devices without looking under the hood at what's going on. Recently I've been noticing that a few minor performance problems I'm having seem to be linked to LDAP so I've started looking at how it's set up and it's got some quirks, e.g. # Indices to maintain index entryUUID eq index cn,sn,uid,displayName pres,sub,eq index uidNumber eq index gidNumber eq index memberUid eq index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq index sambaGroupType eq index sambaSIDList eq index sudoUser eq index uniqueMember,member eq index objectClass pres,eq index mail,mailAlternateAddress eq,sub index accountStatus eq index mailHost,deliveryMode eq index Status,HostGroup eq index default sub There are only around 600 users in the ldap tree, hardly anything. It seems a bit excessive to have that many indexes set up for the tree. Is there any way to identify which indexes are being used and how frequently? I'm pretty certain some of those entries probably get checked once in a blue moon. I'm also seeing odd entries in the ldap logs: Dec 20 11:21:17 <server> slapd[11171]: <= bdb_equality_candidates: (objectClass) index_param failed (18) Dec 20 11:21:17 <server> slapd[11171]: <= bdb_equality_candidates: (objectClass) index_param failed (18) Dec 20 11:21:17 <server> slapd[11171]: <= bdb_equality_candidates: (gidNumber) index_param failed (18) Which seems bizarre given those entries are in the list of indexes. I've tried running slapindex and restarting to no avail. Those items still seem to throw up those alerts, as does the sudoUser entry. On a separate note I've found the slapcat doesn't produce an LDIF file that slapadd will use, even keeping to the same version of software (2.3.37), or importing into newer (2.3.43). It always errors after the first entry because it seems to be trying to add a user to an ou that doesn't exist yet, which disturbs me slightly because the backup infrastructure has been relying on that mechanism for recovery. To create another ldap slave I ended up having to use Apache Directory Studio to create the LDIF for import, which slapadd was perfectly happy to work with. I'm not sure if that may be a known bug that I'm running up against. I see a few entries in archives relating to it but not much by way of response other than suggests it should work. Paul

3 5

Certificate authentication and back-ldap proxy
by Ubay Dorta Guerra 27 Dec '10

27 Dec '10

Hi, We have some problems with certificate authentication when the master server is behind a back-ldap proxy. We have openldap 2.4.21 on Suse Linux Enterprise Server 10 SP3 and these are the details of our scenario: The master server: server1.example.com has the following slapd.conf file: access to dn.base="" by * read access to dn.base="cn=Subschema" by * read access to attrs=userPassword,userPKCS12 by self write by dn.exact="CN=admin_w_cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=AU" read by * auth access to attrs=shadowLastChange by self write by * read access to * by * read # # Security SSL # TLSCipherSuite HIGH:MEDIUM:+SSLv3 TLSCertificateFile /etc/ssl/certs/server1.example.com.pem TLSCertificateKeyFile /etc/ssl/private/server1.example.com.key TLSCACertificatePath /etc/ssl/cacerts/ TLSVerifyClient demand # #Log level # loglevel 256 # Require authentication require authc ####################################################################### # HDB database definitions ####################################################################### database hdb suffix "dc=example,dc=com" checkpoint 1024 5 cachesize 10000 rootdn "cn=Manager,dc=example,dc=com" rootpw secret # Indices to maintain index objectClass eq # Overlay ppolicy overlay ppolicy ---------------------- Authentication is required, and we give access to the user passwords for the dn of a certificate. When we search for passwords using the certificate we get the following: root# ldapsearch -LLL -b 'uid=user_w_pass,ou=people,dc=example,dc=com' -H ldaps://server1.example.com userPassword SASL/EXTERNAL authentication started SASL username: CN=admin_w_cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=AU SASL SSF: 0 dn: uid=user_w_pass,ou=people,dc=example,dc=com userPassword:: e2NyeXB0fTcyMXpQbU4waWdKaU0= ----------------------- The root user (ldap client) has a ~/.ldaprc file with: TLS_CACERTDIR /etc/ssl/cacerts/ TLS_CERT /etc/ssl/certs/admin_w_cert.pem TLS_KEY /etc/ssl/private/admin_w_cert.key TLS_REQCERT demand SASL_MECH EXTERNAL In /var/log/messages we get: ldap-master[22358]: conn=1000 fd=11 ACCEPT from IP=server1.example.com:40899 (IP=server1.example.com:636) ldap-master[22358]: conn=1000 fd=11 TLS established tls_ssf=256 ssf=256 ldap-master[22358]: conn=1000 op=0 BIND dn="" method=163 ldap-master[22358]: conn=1000 op=0 BIND authcid="cn=admin_w_cert,o=internet widgits pty ltd,st=some-state,c=au" authzid="cn=admin_w_cert,o=internet widgits pty ltd,st=some-state,c=au" ldap-master[22358]: conn=1000 op=0 BIND dn="cn=admin_w_cert,o=internet widgits pty ltd,st=some-state,c=au" mech=EXTERNAL sasl_ssf=0 ssf=256 ldap-master[22358]: conn=1000 op=0 RESULT tag=97 err=0 text= ldap-master[22358]: conn=1000 op=1 SRCH base="uid=user_w_pass,ou=people,dc=example,dc=com" scope=2 deref=0 filter="(objectClass=*)" ldap-master[22358]: conn=1000 op=1 SRCH attr=userPassword ldap-master[22358]: conn=1000 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= ldap-master[22358]: conn=1000 op=2 UNBIND ldap-master[22358]: conn=1000 fd=11 closed This is the correct behavior for us. The problem appears when we introduce a back-ldap proxy between the client and the master. The proxy server (proxy-server1.example.com) is listening in port 1636 and its slapd.conf file is: # # Security SSL # TLSCipherSuite HIGH:MEDIUM:+SSLv3 TLSCACertificatePath /etc/ssl/cacerts/ TLSCertificateFile /etc/ssl/certs/proxy-server1.example.com.pem TLSCertificateKeyFile /etc/ssl/private/proxy-server1.example.com.key TLSVerifyClient demand # Log level loglevel 256 ####################################################################### # Database definitions ####################################################################### database ldap rebind-as-user true suffix "dc=example,dc=com" uri "ldaps://server1.example.com" tls ldaps tls_cert=/etc/ssl/certs/proxy-server1.example.com.pem tls_key=/etc/ssl/private/proxy-server1.example.com.key tls_cacertdir=/etc/ssl/cacerts/ ---------------------- If we search for passwords through the proxy we get: root # ldapsearch -LLL -b 'uid=user_w_pass,ou=people,dc=example,dc=com' -H ldaps://proxy-server1.example.com:1636 userPassword SASL/EXTERNAL authentication started SASL username: CN=admin_w_cert,O=Internet Widgits Pty Ltd,ST=Some-State,C=AU SASL SSF: 0 Server is unwilling to perform (53) Additional information: authentication required In the /var/log/messages the following messages appear: ldap-proxy[22802]: conn=1001 fd=8 ACCEPT from IP=proxy-server1.example.com:60712 (IP=proxy-server1.example.com:1636) ldap-proxy[22802]: conn=1001 fd=8 TLS established tls_ssf=256 ssf=256 ldap-proxy[22802]: conn=1001 op=0 BIND dn="" method=163 ldap-proxy[22802]: conn=1001 op=0 BIND authcid="cn=admin_w_cert,o=internet widgits pty ltd,st=some-state,c=au" authzid="cn=admin_w_cert,o=internet widgits pty ltd,st=some-state,c=au" ldap-proxy[22802]: conn=1001 op=0 BIND dn="cn=admin_w_cert,o=internet widgits pty ltd,st=some-state,c=au" mech=EXTERNAL sasl_ssf=0 ssf=256 ldap-proxy[22802]: conn=1001 op=0 RESULT tag=97 err=0 text= ldap-proxy[22802]: conn=1001 op=1 SRCH base="uid=user_w_pass,ou=people,dc=example,dc=com" scope=2 deref=0 filter="(objectClass=*)" ldap-proxy[22802]: conn=1001 op=1 SRCH attr=userPassword ldap-master[22358]: conn=1008 op=2 SRCH base="uid=user_w_pass,ou=people,dc=example,dc=com" scope=2 deref=0 filter="(objectClass=*)" ldap-master[22358]: conn=1008 op=2 SRCH attr=userPassword ldap-master[22358]: conn=1008 op=2 SEARCH RESULT tag=101 err=53 nentries=0 text=authentication required ldap-proxy[22802]: conn=1001 op=1 SEARCH RESULT tag=101 err=53 nentries=0 text=authentication required ldap-proxy[22802]: conn=1001 op=2 UNBIND ldap-proxy[22802]: conn=1001 fd=8 closed The /root/.ldaprc file is the same than the previous one. When we increase the logging level we discover this: .... ldap-proxy[23008]: conn=1000 op=0 do_bind ldap-proxy[23008]: >>> dnPrettyNormal: <> ldap-proxy[23008]: <<< dnPrettyNormal: <>, <> ldap-proxy[23008]: conn=1000 op=0 BIND dn="" method=163 ldap-proxy[23008]: do_bind: dn () SASL mech EXTERNAL ldap-proxy[23008]: ==> sasl_bind: dn="" mech=EXTERNAL datalen=0 ldap-proxy[23008]: SASL Canonicalize [conn=1000]: authcid="cn=admin_w_cert,o=internet widgits pty ltd,st=some-state,c=au" ldap-proxy[23008]: slap_sasl_getdn: conn 1000 id=cn=admin_w_cert,o=internet widgits pty ltd,st=some-state,c=au [len=61] ldap-proxy[23008]: ==>slap_sasl2dn: converting SASL name cn=admin_w_cert,o=internet widgits pty ltd,st=some-state,c=au to a DN ldap-proxy[23008]: <==slap_sasl2dn: Converted SASL name to <nothing> ldap-proxy[23008]: SASL Canonicalize [conn=1000]: slapAuthcDN="cn=admin_w_cert,o=internet widgits pty ltd,st=some-state,c=au" ldap-proxy[23008]: SASL proxy authorize [conn=1000]: authcid="cn=admin_w_cert,o=internet widgits pty ltd,st=some-state,c=au" authzid="cn=admin_w_cert,o=internet widgits pty ltd,st=some-state,c=au" ldap-proxy[23008]: conn=1000 op=0 BIND authcid="cn=admin_w_cert,o=internet widgits pty ltd,st=some-state,c=au" authzid="cn=admin_w_cert,o=internet widgits pty ltd,st=some-state,c=au" ldap-proxy[23008]: SASL Authorize [conn=1000]: proxy authorization allowed authzDN="" ldap-proxy[23008]: send_ldap_sasl: err=0 len=-1 ldap-proxy[23008]: conn=1000 op=0 BIND dn="cn=admin_w_cert,o=internet widgits pty ltd,st=some-state,c=au" mech=EXTERNAL sasl_ssf=0 ssf=256 ldap-proxy[23008]: do_bind: SASL/EXTERNAL bind: dn="cn=admin_w_cert,o=internet widgits pty ltd,st=some-state,c=au" sasl_ssf=0 ldap-proxy[23008]: send_ldap_response: msgid=1 tag=97 err=0 ldap-proxy[23008]: conn=1000 op=0 RESULT tag=97 err=0 text= ldap-proxy[23008]: <== slap_sasl_bind: rc=0 .... ldap-proxy[23008]: conn=1000 op=1 SRCH base="uid=user_w_pass,ou=people,dc=example,dc=com" scope=2 deref=0 filter="(objectClass=*)" ldap-proxy[23008]: conn=1000 op=1 SRCH attr=userPassword ldap-proxy[23008]: ==> limits_get: conn=1000 op=1 self="cn=admin_w_cert,o=internet widgits pty ltd,st=some-state,c=au" this="uid=user_w_pass,ou=people,dc=example,dc=com" ldap-master[22983]: daemon: activity on 1 descriptor ldap-master[22983]: daemon: activity on: ldap-master[22983]: ldap-master[22983]: slap_listener_activate(7): ldap-master[22983]: daemon: epoll: listen=7 busy ldap-master[22983]: >>> slap_listener(ldaps://server1.example.com) ..... ldap-master[22983]: conn=1000 op=0 do_bind ldap-master[22983]: >>> dnPrettyNormal: <> ldap-master[22983]: <<< dnPrettyNormal: <>, <> ldap-master[22983]: conn=1000 op=0 BIND dn="" method=128 ldap-master[22983]: do_bind: version=3 dn="" method=128 ldap-master[22983]: send_ldap_result: conn=1000 op=0 p=3 ldap-master[22983]: send_ldap_result: err=0 matched="" text="" ldap-master[22983]: send_ldap_response: msgid=1 tag=97 err=0 ldap-master[22983]: conn=1000 op=0 RESULT tag=97 err=0 text= ldap-master[22983]: do_bind: v3 anonymous bind ---------------- Therefore the proxy is binding anonymously in the master, instead of using the dn of the certificate. Is there any problem with the SASL EXTERNAL method? If we use SIMPLE authentication through the proxy, there is no problem: root # ldapsearch -LLL -x -b 'uid=user_w_pass,ou=people,dc=example,dc=com' -H ldaps://proxy-server1.example.com:1636 -D 'uid=user_w_pass,ou=people,dc=example,dc=com' -W userPassword Enter LDAP Password: dn: uid=user_w_pass,ou=people,dc=example,dc=com userPassword:: e2NyeXB0fTcyMXpQbU4waWdKaU0= Thanks in advance. --------------------------------------------------------------------------------------------- ADVERTENCIA: Sobre la privacidad y cumplimiento de la Ley de Protección de Datos, acceda a http://www.iac.es/disclaimer.php WARNING: For more information on privacy and fulfilment of the Law concerning the Protection of Data, consult http://www.iac.es/disclaimer.php?lang=en

3 4

Problem starting ldap 2.4
by Nick Milas 27 Dec '10

27 Dec '10

Hi, I am trying to migrate from CentOS 5.5 Openldap 2.3.43-12.el5_5.3 to 2.4.22-1.el5.x86_64 using Buckan RPMs (available at http://staff.telkomsa.net/packages/rhel5/openldap/x86_64/). I think I have done all necessary configuration, but when I try to start, I get a strange error: # service ldap2.4 start ' for reading (No such file or directory)f FNR=196) fatal: cannot open file `/etc/openldap2.4/schema/core.schema chown: cannot access `/var/lib/ldap2.4\r': No such file or directory Starting slapd (ldap + ldaps): [FAILED] Note, however that /etc/openldap2.4/schema/core.schema exists: # ls -la /etc/openldap2.4/schema/core.schema -rw-r--r-- 1 ldap ldap 19762 Nov 29 10:49 /etc/openldap2.4/schema/core.schema The core.schema is the first one included in slapd.conf, so there is probably a problem with all included schema files. The config file is supposed to be OK: # slaptest2.4 -f /etc/openldap2.4/slapd.conf config file testing succeeded The db data has been successfully input using slapadd, from an ldif backp. The db is in /var/lib/ldap2.4: # slapadd2.4 -l /root/ldapbk/ldif.ldap.bk -#################### 100.00% eta none elapsed 45s spd 23.7 k/s Closing DB... [root@vweb ldap2.4]# [root@vweb ldap2.4]# [root@vweb ldap2.4]# nano slapd.conf # # pwd /var/lib/ldap2.4 # slapindex2.4 # # # chown ldap:ldap * # # cd /var/lib # ls -la total 184 ... drwx------ 2 ldap ldap 4096 Dec 26 17:34 ldap drwxr-x--- 3 ldap ldap 4096 Dec 27 13:03 ldap2.4 ... I have googled around but can't find something about this error. Can someone please help? Thanks in advance, Nick Milas

1 2

No ProxyAuthz with SASL-GSSAPI?
by Jaap Winius 27 Dec '10

27 Dec '10

Hi folks, Although I've been able to get proxy authorization to work on Debian lenny systems using OpenLDAP 2.4.11 and Kerberos authentication with SASL-GSSAPI, and I've been able to get it to work on Debian squeeze using 2.4.23 (with Pierangelo's 2010-04-29 patch) and clear-text passwords, but for some reason I'm not having any same luck with the same patched 2.4.23 version when using Kerberos authentication with SASL-GSSAPI. If I compare the two squeeze systems -- clear-text vs. SASL-GSSAPI -- while the loglevels are both set to -1, and try submitting a similar change on both consumer servers, lines with "parseProxyAuthz" and "PROXYAUTHZ" show up in the syslog of the clear-text system's provider server, but nothing of the sort shows up in the syslog on the SASL-GSSAPI system's provider server. Instead, when attempting to add two objects -- cn=ccolumbus and uid=ccolumbus -- using the ldapadd utility as uid=admin on the consumer server, I see this kind of stuff in the logs: ======== begin log fragment consumer server ======================== Dec 23 18:54:16 ldapks2 slapd[29862]: daemon: read active on 17 Dec 23 18:54:16 ldapks2 slapd[29862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Dec 23 18:54:16 ldapks2 slapd[29862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Dec 23 18:54:16 ldapks2 slapd[29862]: daemon: epoll: listen=10 active_threads=0 tvp=zero Dec 23 18:54:16 ldapks2 slapd[29862]: connection_get(17) Dec 23 18:54:16 ldapks2 slapd[29862]: connection_get(17): got connid=1003 Dec 23 18:54:16 ldapks2 slapd[29862]: connection_read(17): checking for input on id=1003 Dec 23 18:54:16 ldapks2 slapd[29862]: op tag 0x60, time 1293126856 Dec 23 18:54:16 ldapks2 slapd[29862]: conn=1003 op=2 do_bind Dec 23 18:54:16 ldapks2 slapd[29862]: >>> dnPrettyNormal: <> Dec 23 18:54:16 ldapks2 slapd[29862]: <<< dnPrettyNormal: <>, <> Dec 23 18:54:16 ldapks2 slapd[29862]: conn=1003 op=2 BIND dn="" method=163 Dec 23 18:54:16 ldapks2 slapd[29862]: do_bind: dn () SASL mech GSSAPI Dec 23 18:54:16 ldapks2 slapd[29862]: ==> sasl_bind: dn="" mech=<continuing> datalen=32 Dec 23 18:54:16 ldapks2 slapd[29862]: SASL Canonicalize [conn=1003]: authcid="admin" Dec 23 18:54:16 ldapks2 slapd[29862]: slap_sasl_getdn: conn 1003 id=admin [len=5] Dec 23 18:54:16 ldapks2 slapd[29862]: slap_sasl_getdn: u:id converted to uid=admin,cn=EXAMPLE.COM,cn=GSSAPI,cn=auth Dec 23 18:54:16 ldapks2 slapd[29862]: >>> dnNormalize: <uid=admin,cn=EXAMPLE.COM,cn=GSSAPI,cn=auth> Dec 23 18:54:16 ldapks2 slapd[29862]: <<< dnNormalize: <uid=admin,cn=example.com,cn=gssapi,cn=auth> Dec 23 18:54:16 ldapks2 slapd[29862]: ==>slap_sasl2dn: converting SASL name uid=admin,cn=example.com,cn=gssapi,cn=auth to a DN Dec 23 18:54:16 ldapks2 slapd[29862]: [rw] authid: "uid=admin,cn=example.com,cn=gssapi,cn=auth" -> "uid=admin,ou=people,dc=example,dc=com" Dec 23 18:54:16 ldapks2 slapd[29862]: slap_parseURI: parsing uid=admin,ou=people,dc=example,dc=com Dec 23 18:54:16 ldapks2 slapd[29862]: >>> dnNormalize: <uid=admin,ou=people,dc=example,dc=com> Dec 23 18:54:16 ldapks2 slapd[29862]: <<< dnNormalize: <uid=admin,ou=people,dc=example,dc=com> Dec 23 18:54:16 ldapks2 slapd[29862]: <==slap_sasl2dn: Converted SASL name to uid=admin,ou=people,dc=example,dc=com Dec 23 18:54:16 ldapks2 slapd[29862]: slap_sasl_getdn: dn:id converted to uid=admin,ou=people,dc=example,dc=com Dec 23 18:54:16 ldapks2 slapd[29862]: SASL Canonicalize [conn=1003]: slapAuthcDN="uid=admin,ou=people,dc=example,dc=com" Dec 23 18:54:16 ldapks2 slapd[29862]: SASL proxy authorize [conn=1003]: authcid="admin(a)EXAMPLE.COM" authzid="admin(a)EXAMPLE.COM" Dec 23 18:54:16 ldapks2 slapd[29862]: conn=1003 op=2 BIND authcid="admin(a)EXAMPLE.COM" authzid="admin(a)EXAMPLE.COM" Dec 23 18:54:16 ldapks2 slapd[29862]: SASL Authorize [conn=1003]: proxy authorization allowed authzDN="" Dec 23 18:54:16 ldapks2 slapd[29862]: send_ldap_sasl: err=0 len=-1 Dec 23 18:54:16 ldapks2 slapd[29862]: conn=1003 op=2 BIND dn="uid=admin,ou=people,dc=example,dc=com" mech=GSSAPI sasl_ssf=56 ssf=56 Dec 23 18:54:16 ldapks2 slapd[29862]: do_bind: SASL/GSSAPI bind: dn="uid=admin,ou=people,dc=example,dc=com" sasl_ssf=56 Dec 23 18:54:16 ldapks2 slapd[29862]: send_ldap_response: msgid=3 tag=97 err=0 Dec 23 18:54:16 ldapks2 slapd[29862]: conn=1003 op=2 RESULT tag=97 err=0 text= Dec 23 18:54:16 ldapks2 slapd[29862]: <== slap_sasl_bind: rc=0 Dec 23 18:54:16 ldapks2 slapd[29862]: daemon: activity on 1 descriptor Dec 23 18:54:16 ldapks2 slapd[29862]: daemon: activity on: Dec 23 18:54:16 ldapks2 slapd[29862]: Dec 23 18:54:16 ldapks2 slapd[29862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Dec 23 18:54:16 ldapks2 slapd[29862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Dec 23 18:54:16 ldapks2 slapd[29862]: daemon: epoll: listen=10 active_threads=0 tvp=zero Dec 23 18:54:16 ldapks2 slapd[29862]: daemon: activity on 1 descriptor Dec 23 18:54:16 ldapks2 slapd[29862]: daemon: activity on: Dec 23 18:54:16 ldapks2 slapd[29862]: 17r Dec 23 18:54:16 ldapks2 slapd[29862]: Dec 23 18:54:16 ldapks2 slapd[29862]: daemon: read active on 17 Dec 23 18:54:16 ldapks2 slapd[29862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Dec 23 18:54:16 ldapks2 slapd[29862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Dec 23 18:54:16 ldapks2 slapd[29862]: daemon: epoll: listen=10 active_threads=0 tvp=zero Dec 23 18:54:16 ldapks2 slapd[29862]: connection_get(17) Dec 23 18:54:16 ldapks2 slapd[29862]: connection_get(17): got connid=1003 Dec 23 18:54:16 ldapks2 slapd[29862]: connection_read(17): checking for input on id=1003 Dec 23 18:54:16 ldapks2 slapd[29862]: op tag 0x68, time 1293126856 Dec 23 18:54:16 ldapks2 slapd[29862]: conn=1003 op=3 do_add Dec 23 18:54:16 ldapks2 slapd[29862]: conn=1003 op=3 do_add: dn (cn=ccolumbus,ou=groups,dc=example,dc=com) Dec 23 18:54:16 ldapks2 slapd[29862]: >>> dnPrettyNormal: <cn=ccolumbus,ou=groups,dc=example,dc=com> Dec 23 18:54:16 ldapks2 slapd[29862]: <<< dnPrettyNormal: <cn=ccolumbus,ou=groups,dc=example,dc=com>, <cn=ccolumbus,ou=groups,dc=example,dc=com> Dec 23 18:54:16 ldapks2 slapd[29862]: conn=1003 op=3 ADD dn="cn=ccolumbus,ou=groups,dc=example,dc=com" Dec 23 18:54:16 ldapks2 slapd[29862]: bdb_dn2entry("cn=ccolumbus,ou=groups,dc=example,dc=com") Dec 23 18:54:16 ldapks2 slapd[29862]: => hdb_dn2id("cn=ccolumbus,ou=groups,dc=example,dc=com") Dec 23 18:54:16 ldapks2 slapd[29862]: <= hdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30988) Dec 23 18:54:16 ldapks2 slapd[29862]: hdb_referrals: tag=104 target="cn=ccolumbus,ou=groups,dc=example,dc=com" matched="ou=groups,dc=example,dc=com" Dec 23 18:54:16 ldapks2 slapd[29862]: daemon: activity on 1 descriptor Dec 23 18:54:16 ldapks2 slapd[29862]: daemon: activity on: Dec 23 18:54:16 ldapks2 slapd[29862]: Dec 23 18:54:16 ldapks2 slapd[29862]: daemon: epoll: listen=8 active_threads=0 tvp=zero Dec 23 18:54:16 ldapks2 slapd[29862]: daemon: epoll: listen=9 active_threads=0 tvp=zero Dec 23 18:54:16 ldapks2 slapd[29862]: daemon: epoll: listen=10 active_threads=0 tvp=zero Dec 23 18:54:16 ldapks2 slapd[29862]: send_ldap_result: conn=1003 op=3 p=3 Dec 23 18:54:16 ldapks2 slapd[29862]: send_ldap_result: err=10 matched="" text="" Dec 23 18:54:16 ldapks2 slapd[29862]: send_ldap_result: referral="ldap://ldapks.example.com:389/cn=ccolumbus,ou=groups,dc=example,dc=com" Dec 23 18:54:16 ldapks2 slapd[29862]: >>> dnPrettyNormal: <cn=ccolumbus,ou=groups,dc=example,dc=com> Dec 23 18:54:16 ldapks2 slapd[29862]: <<< dnPrettyNormal: <cn=ccolumbus,ou=groups,dc=example,dc=com>, <cn=ccolumbus,ou=groups,dc=example,dc=com> Dec 23 18:54:16 ldapks2 slapd[29862]: ldap_back_db_open: URI=ldap://ldapks.example.com:389 Dec 23 18:54:16 ldapks2 slapd[29862]: ==> ldap_back_add("cn=ccolumbus,ou=groups,dc=example,dc=com") Dec 23 18:54:16 ldapks2 slapd[29862]: send_ldap_result: conn=1003 op=3 p=3 Dec 23 18:54:16 ldapks2 slapd[29862]: send_ldap_result: err=8 matched="" text="modifications require authentication" Dec 23 18:54:16 ldapks2 slapd[29862]: <== ldap_back_add("cn=ccolumbus,ou=groups,dc=example,dc=com"): 8 Dec 23 18:54:16 ldapks2 slapd[29862]: send_ldap_result: conn=1003 op=3 p=3 Dec 23 18:54:16 ldapks2 slapd[29862]: send_ldap_result: err=8 matched="" text="" Dec 23 18:54:16 ldapks2 slapd[29862]: send_ldap_response: msgid=4 tag=105 err=8 Dec 23 18:54:16 ldapks2 slapd[29862]: daemon: activity on 1 descriptor Dec 23 18:54:16 ldapks2 slapd[29862]: daemon: activity on: Dec 23 18:54:16 ldapks2 slapd[29862]: 17r ======== end log fragment consumer server ========================== The only thing I think looks strange in the above is this line: SASL Authorize [conn=1003]: proxy authorization allowed authzDN="" Why is the authzDN empty? ======== begin log fragment provider server ======================== Dec 23 18:54:16 ldapks1 slapd[1265]: daemon: activity on 1 descriptor Dec 23 18:54:16 ldapks1 slapd[1265]: daemon: activity on: Dec 23 18:54:16 ldapks1 slapd[1265]: Dec 23 18:54:16 ldapks1 slapd[1265]: slap_listener_activate(8): Dec 23 18:54:16 ldapks1 slapd[1265]: daemon: epoll: listen=8 busy Dec 23 18:54:16 ldapks1 slapd[1265]: daemon: epoll: listen=9 active_threads=0 tvp=zero Dec 23 18:54:16 ldapks1 slapd[1265]: daemon: epoll: listen=10 active_threads=0 tvp=zero Dec 23 18:54:16 ldapks1 slapd[1265]: >>> slap_listener(ldap:///) Dec 23 18:54:16 ldapks1 slapd[1265]: daemon: listen=8, new connection on 18 Dec 23 18:54:16 ldapks1 slapd[1265]: daemon: added 18r (active) listener=(nil) Dec 23 18:54:16 ldapks1 slapd[1265]: conn=1004 fd=18 ACCEPT from IP=192.168.2.56:43112 (IP=0.0.0.0:389) Dec 23 18:54:16 ldapks1 slapd[1265]: daemon: activity on 2 descriptors Dec 23 18:54:16 ldapks1 slapd[1265]: daemon: activity on: Dec 23 18:54:16 ldapks1 slapd[1265]: 18r Dec 23 18:54:16 ldapks1 slapd[1265]: Dec 23 18:54:16 ldapks1 slapd[1265]: daemon: read active on 18 Dec 23 18:54:16 ldapks1 slapd[1265]: daemon: epoll: listen=8 active_threads=0 tvp=zero Dec 23 18:54:16 ldapks1 slapd[1265]: daemon: epoll: listen=9 active_threads=0 tvp=zero Dec 23 18:54:16 ldapks1 slapd[1265]: daemon: epoll: listen=10 active_threads=0 tvp=zero Dec 23 18:54:16 ldapks1 slapd[1265]: connection_get(18) Dec 23 18:54:16 ldapks1 slapd[1265]: connection_get(18): got connid=1004 Dec 23 18:54:16 ldapks1 slapd[1265]: connection_read(18): checking for input on id=1004 Dec 23 18:54:16 ldapks1 slapd[1265]: op tag 0x60, time 1293126856 Dec 23 18:54:16 ldapks1 slapd[1265]: conn=1004 op=0 do_bind Dec 23 18:54:16 ldapks1 slapd[1265]: >>> dnPrettyNormal: <> Dec 23 18:54:16 ldapks1 slapd[1265]: <<< dnPrettyNormal: <>, <> Dec 23 18:54:16 ldapks1 slapd[1265]: conn=1004 op=0 BIND dn="" method=128 Dec 23 18:54:16 ldapks1 slapd[1265]: do_bind: version=3 dn="" method=128 Dec 23 18:54:16 ldapks1 slapd[1265]: send_ldap_result: conn=1004 op=0 p=3 Dec 23 18:54:16 ldapks1 slapd[1265]: send_ldap_result: err=0 matched="" text="" Dec 23 18:54:16 ldapks1 slapd[1265]: send_ldap_response: msgid=1 tag=97 err=0 Dec 23 18:54:16 ldapks1 slapd[1265]: conn=1004 op=0 RESULT tag=97 err=0 text= Dec 23 18:54:16 ldapks1 slapd[1265]: do_bind: v3 anonymous bind Dec 23 18:54:16 ldapks1 slapd[1265]: daemon: activity on 1 descriptor Dec 23 18:54:16 ldapks1 slapd[1265]: daemon: activity on: Dec 23 18:54:16 ldapks1 slapd[1265]: Dec 23 18:54:16 ldapks1 slapd[1265]: daemon: epoll: listen=8 active_threads=0 tvp=zero Dec 23 18:54:16 ldapks1 slapd[1265]: daemon: epoll: listen=9 active_threads=0 tvp=zero Dec 23 18:54:16 ldapks1 slapd[1265]: daemon: epoll: listen=10 active_threads=0 tvp=zero Dec 23 18:54:16 ldapks1 slapd[1265]: daemon: activity on 1 descriptor Dec 23 18:54:16 ldapks1 slapd[1265]: daemon: activity on: Dec 23 18:54:16 ldapks1 slapd[1265]: 18r Dec 23 18:54:16 ldapks1 slapd[1265]: Dec 23 18:54:16 ldapks1 slapd[1265]: daemon: read active on 18 Dec 23 18:54:16 ldapks1 slapd[1265]: daemon: epoll: listen=8 active_threads=0 tvp=zero Dec 23 18:54:16 ldapks1 slapd[1265]: daemon: epoll: listen=9 active_threads=0 tvp=zero Dec 23 18:54:16 ldapks1 slapd[1265]: daemon: epoll: listen=10 active_threads=0 tvp=zero Dec 23 18:54:16 ldapks1 slapd[1265]: connection_get(18) Dec 23 18:54:16 ldapks1 slapd[1265]: connection_get(18): got connid=1004 Dec 23 18:54:16 ldapks1 slapd[1265]: connection_read(18): checking for input on id=1004 Dec 23 18:54:16 ldapks1 slapd[1265]: op tag 0x68, time 1293126856 Dec 23 18:54:16 ldapks1 slapd[1265]: conn=1004 op=1 do_add Dec 23 18:54:16 ldapks1 slapd[1265]: conn=1004 op=1 do_add: dn (cn=ccolumbus,ou=groups,dc=example,dc=com) Dec 23 18:54:16 ldapks1 slapd[1265]: >>> dnPrettyNormal: <cn=ccolumbus,ou=groups,dc=example,dc=com> Dec 23 18:54:16 ldapks1 slapd[1265]: <<< dnPrettyNormal: <cn=ccolumbus,ou=groups,dc=example,dc=com>, <cn=ccolumbus,ou=groups,dc=example,dc=com> Dec 23 18:54:16 ldapks1 slapd[1265]: conn=1004 op=1 ADD dn="cn=ccolumbus,ou=groups,dc=example,dc=com" Dec 23 18:54:16 ldapks1 slapd[1265]: send_ldap_result: conn=1004 op=1 p=3 Dec 23 18:54:16 ldapks1 slapd[1265]: send_ldap_result: err=8 matched="" text="modifications require authentication" Dec 23 18:54:16 ldapks1 slapd[1265]: send_ldap_response: msgid=2 tag=105 err=8 Dec 23 18:54:16 ldapks1 slapd[1265]: conn=1004 op=1 RESULT tag=105 err=8 text=modifications require authentication Dec 23 18:54:16 ldapks1 slapd[1265]: daemon: activity on 1 descriptor Dec 23 18:54:16 ldapks1 slapd[1265]: daemon: activity on: ======== end log fragment provider server ========================== The ldapadd command on the consumer server gives: adding new entry "cn=ccolumbus,ou=groups,dc=example,dc=com" ldap_add: Strong(er) authentication required (8) Some more background info. In the DIT, the consumer server is represented by and authorized to function as a proxy via this object: dn: cn=ldapks2,ou=consumers,dc=example,dc=com cn: ldapks2 objectClass: simpleSecurityObject objectClass: organizationalRole description: LDAP server2 replicator authzTo: dn.regex:^uid=[^,]+,ou=people,dc=example,dc=com$ userPassword:: e0NSWVBUfSo= structuralObjectClass: organizationalRole entryUUID: d939b140-a341-102f-8cd1-6f46e6760f2b creatorsName: uid=admin,ou=people,dc=example,dc=com createTimestamp: 20101224003819Z entryCSN: 20101224003819.303636Z#000000#000#000000 modifiersName: uid=admin,ou=people,dc=example,dc=com modifyTimestamp: 20101224003819Z When the consumer, ldapks2, synchronizes with the provider, ldapks1, the consumer also shows up in the syslog on the provider server as cn=ldapks2,ou=consumers,dc=example,dc=com. That's a good sign, although after adding the relevant olcAuthzRegexp on the provider, it began to work that way after I had restarted slapd. On the provider, the cn=config DIT looks like this: ======== begin cn=config DIT fragment provider server ============== dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /var/run/slapd/slapd.args olcAuthzPolicy: to olcAuthzRegexp: {0}uid=ldap/([^/\.]+).example.com,cn=example.com,cn=gssapi,cn= auth cn=$1,ou=consumers,dc=example,dc=com olcAuthzRegexp: {1}uid=([^,]+),cn=example.com,cn=gssapi,cn=auth uid=$1,ou=peop le,dc=example,dc=com olcLogLevel: stats olcPidFile: /var/run/slapd/slapd.pid olcSaslRealm: EXAMPLE.COM olcToolThreads: 1 dn: olcDatabase={1}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=example,dc=com olcAccess: {0}to attrs=userPassword,shadowLastChange by dn.one="ou=consumers,d c=example,dc=com" read by * none olcAccess: {1}to attrs=loginShell by dn.one="ou=consumers,dc=example,dc=com" r ead by self write by * none olcAccess: {2}to dn.base="" by * read olcAccess: {3}to * by users read by * none olcLastMod: TRUE olcRootDN: uid=admin,ou=people,dc=example,dc=com olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq olcDbIndex: uid eq olcDbIndex: cn eq olcDbIndex: ou eq olcDbIndex: dc eq olcDbIndex: entryUUID eq olcDbIndex: entryCSN eq ======== end cn=config DIT fragment provider server ================ Chaining is enabled on the consumer server: ======== begin cn=config DIT fragment consumer server ============== dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib/ldap olcModuleLoad: {0}back_hdb olcModuleLoad: {1}back_ldap dn: olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config objectClass: olcOverlayConfig objectClass: olcChainConfig olcOverlay: {0}chain olcChainReturnError: TRUE dn: olcDatabase={0}ldap,olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config objectClass: olcLDAPConfig objectClass: olcChainDatabase olcDatabase: {0}ldap olcDbURI: "ldap://ldapks.example.com:389/" olcDbIDAssertBind: bindmethod=sasl saslmech=gssapi mode=self olcDbRebindAsUser: TRUE dn: olcDatabase={1}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=example,dc=com olcAccess: {0}to attrs=userPassword,shadowLastChange by * none olcAccess: {1}to attrs=loginShell by self read by * none olcAccess: {2}to dn.base="" by * read olcAccess: {3}to * by users read by * none olcLastMod: TRUE olcRootDN: cn=manager olcSyncrepl: {0}rid=123 provider="ldap://ldapks.example.com:389/" type=refresh AndPersist retry="60 30 300 +" searchbase="dc=example,dc=com" bindmethod=sasl saslmech=gssapi olcUpdateRef: "ldap://ldapks.example.com:389/" olcDbCheckpoint: 512 30 olcDbConfig: {0}set_cachesize 0 2097152 0 olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: objectClass eq olcDbIndex: entryCSN eq olcDbIndex: entryUUID eq olcDbIndex: uid eq olcDbIndex: cn eq olcDbIndex: ou eq olcDbIndex: dc eq ======== end cn=config DIT fragment consumer server ================ BTW, "ldapks.example.com" is an alias for "ldapks1.example.com." That's pretty much it, I think. Is this problem due to another bug, or have I made a mistake somewhere? Thanks, Jaap

1 2

invalid credentials (49) for normal user
by rui 25 Dec '10

25 Dec '10

Hi, I have imported my passwd and groups file in ldap using migrate_all_online.sh script. I am able to simple bind to ldap using binddn= uid=root,ou=People,o=M1,c=GB but i can't seem to bind with any other user like rui etc with their linux password. Its says invalid credentials. I need to bind for authentication and then get all the primary and secondary groups of a user(how can i do that). Why am i having this problem - do i have to do something extra? When bound as root, if i do "memberUid=root" i get all the secondary groups but i want to do it for any user. I am using c ldap api at the moment. Here is my slapd.conf file: ################################################## # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/dyngroup.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/misc.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/openldap.schema ####################################################################### # ldbm database definitions ####################################################################### database ldbm suffix "o=M1,c=GB" rootdn "uid=root,ou=People,o=M1,c=GB" rootpw abc123 directory /var/lib/ldap # Indices to maintain index objectClass,uid,uidNumber,gidNumber eq index cn,mail,surname,givenname eq,subinitial # # ACLs # #access to dn="ou=People,o=M1,c=GB" #attr=userPassword #by self write #by dn="uid=root,ou=People,o=M1,c=GB" write #by * auth access to dn=".*,o=M1,c=GB" by self write #by dn="uid=root,ou=People,o=M1,c=GB" write #by * read access to dn=".*,o= M1,c=GB" #by * read defaultaccess read access to attr=userpassword by self write by dn="uid=root,ou=People,o=M1,c=GB" write by * read access to * by self write by dn=".+" read by * read ############################################### Regards, rui

2 1

Openldap Authentication
by Sachin Bhugra 23 Dec '10

23 Dec '10

Hi All, I have configured a ldap server and trying to login to same ldap server using a ldap user. However, I am not able to login and getting the following in /var/log/secure: Dec 22 20:06:29 redhat5 sshd[7241]: Invalid user ldapu1 from 192.168.85.1 Dec 22 20:06:31 redhat5 sshd[7242]: input_userauth_request: invalid user ldapu1 Dec 22 20:06:37 redhat5 sshd[7241]: pam_unix(sshd:auth): check pass; user unknown Dec 22 20:06:37 redhat5 sshd[7241]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.85.1 Dec 22 20:06:37 redhat5 sshd[7241]: pam_succeed_if(sshd:auth): error retrieving information about user ldapu1 Dec 22 20:06:39 redhat5 sshd[7241]: Failed password for invalid user ldapu1 from 192.168.85.1 port 4461 ssh2 Following appears in ldap.log: Dec 22 20:07:52 redhat5 slapd[2966]: conn=1 op=30 SRCH base="ou=Users,dc=homeldap,dc=com" scope=1 deref=0 filter="(&(objectClass=posixAccount)(uid=ldapu1))" Dec 22 20:07:52 redhat5 slapd[2966]: conn=1 op=30 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass Dec 22 20:07:52 redhat5 slapd[2966]: conn=1 op=30 SEARCH RESULT tag=101 err=0 nentries=0 text= Dec 22 20:07:52 redhat5 slapd[2966]: conn=1 op=31 SRCH base="ou=Computers,dc=homeldap,dc=com" scope=1 deref=0 filter="(&(objectClass=posixAccount)(uid=ldapu1))" Dec 22 20:07:52 redhat5 slapd[2966]: conn=1 op=31 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass Dec 22 20:07:52 redhat5 slapd[2966]: conn=1 op=31 SEARCH RESULT tag=101 err=0 nentries=0 text= I can see that if I use the ldapsearch with same filter, I am not able to locate the user "ldapu1". However, if I change the filter to (|(objectClass=posixAccount)(uid=ldapu1))", it shows me the ldap user: ============= [root@redhat5 ~]# ldapsearch -x -b "ou=Users,dc=homeldap,dc=com" -D "cn=Manager,dc=homeldap,dc=com" -W -H "ldap://127.0.0.1/" "(|(objectClass=posixAccount)(uid=ldapu1))" Enter LDAP Password: # extended LDIF # # LDAPv3 # base <ou=Users,dc=homeldap,dc=com> with scope subtree # filter: (|(objectClass=posixAccount)(uid=ldapu1)) # requesting: ALL # # ldapu1, Users, homeldap.com dn: cn=ldapu1,ou=Users,dc=homeldap,dc=com objectClass: inetOrgPerson cn: ldapu1 sn: ldapu1 uid: ldapu1 userPassword:: bGRhcHV1MQ== # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 ============= Can someone please tell me where I have made a mistake? -- Is it necessary to create an account on Linux box and then migrate it to ldap? -- I was just wondering if I can somehow change the default filter from AND to OR at the time of login. I used "pam_filter |objectClass=inetOrgPerson" in ldap.conf however, it didn't change the filter. Regards,

2 1

Is large size of __db file a problem?
by Amol Kulkarni 23 Dec '10

23 Dec '10

Hi List, On one of my servers, the size of a __db file is about 1.9 gb. What does this mean ? Will it cause prbs? The bdb cachesize is also set to about 1.9 gb on this server bcos the that is the size of .bdb files. The server has 4gb ram and 8gb swap. Kindly share your learnings and experiences about this. Thanks and Regards, Amol.

1 0

doubt about cache tuning
by Amol Kulkarni 23 Dec '10

23 Dec '10

Hi List, I read the performance tuning document in the openldap admin guide. It says ideal case is to allocate cachesize for all entries in ldap. In case I do set cachesize for all entries, is it necessary to allocate cache for bdb in the DB_CONFIG ? Currently I'm facing a problem on a server where I've foll. config : slapd.conf : cachesize 419363 idlcachesize 419363 the cachesize here is the number of entries in ldap. Also in DB_CONFIG, I have set set_cachesize 0 2026582016 1 This cache size in DB_CONFIG is abt 1.9 gb. It was calculated by adding file sizes of all .bdb files in the ldap data folder. The problem is that the slapd process is using more than 100% cpu ( on a multicpu server ) . The usage does fluctuate from 20% to 200%. Higher cpu usage is triggered when there are ldap write operations. I doubt that I have overtuned the cache. Kindly share your learnings and experiences. Thanks and Regards, Amol

1 0

Enable SASL and GSSAPI authentication
by Jörg Herzinger 22 Dec '10

22 Dec '10

Hi, I've been running openLDAP with GSSAPI authentication for quite a while now and everything has been running quite fine. The last days I tried enabling SASL password auth as described in [1] Now password authentication works fine, but it seems that GSS somehow has been disabled: root@ldap1 ~ # ldapsearch -x -H ldap:// -b '' -s base -LLL supportedSASLMechanisms dn: While without SASL enabled I get: root@ldap1 ~ # ldapsearch -x -H ldap:// -b '' -s base -LLL supportedSASLMechanisms dn: supportedSASLMechanisms: GSSAPI Is it possible to enable both, GSS and SASL pass through auth? I checked the dokumentation and couldn't find a clue if it is or not. openLDAP version is 2.4.11 on Debian Lenny, Kerberos is MIT version 1.6 also on Lenny. Slapd config can be found here [2] tia, Jörg Herzinger [1] http://www.openldap.org/doc/admin24/security.html#Pass-Through authentication [2] https://github.com/joerg/global2000-puppet/blob/master/modules/ldapserver/t…

3 4

adding a custom objectClass
by Troy Knabe 21 Dec '10

21 Dec '10

I just figured out creating custom schema definitions for 2.3, and now I am trying to move that to 2.4 and cn=schema,cn=config. I have an existing schema definition: dn: cn={3}ours,cn=schema,cn=config with attributes and one objectClass. I would like to add another objectClass that inherits from the current one. Here is the current one: olcObjectClasses: {0}( 1.3.6.1.4.1.32879.1 NAME 'myobjclass' DESC 'Custom ObjectClass ' SUP inetOrgPerson STRUCTURAL MAY ( userType $ gradeLevel $ mailHost $ mailalternateaddress ) ) Here is the LDIF of what I am trying to add: dn: cn={3}ours,cn=schema,cn=config objecClass: olcSchemaConfig cn: {3}ours olcObjectClasses: ( 1.3.6.1.4.1.32879.1.0.1 NAME 'eSIS' DESC 'Custom ObjectClass2' SUP myobjclass MAY (gender $ birthdate $ pupilNumber $ ssIdNumber $ withdrawlDate $ homeRoom $ sped $ lep $ school)) But I am getting this error. (I have confirmed that all of the MAY attributes are defined in the schema. ldap_add: Undefined attribute type (17) additional info: objecClass: attribute type undefined

2 2

Can't read attribute except as root
by Richard Connon 20 Dec '10

20 Dec '10

Hi. I'm having some trouble reading certain attributes using non-root DNs on my directory. My olcAccess attributes on the relevant database are these: olcAccess: {0}to attrs=userPassword,shadowLastChange,loginShell,gecos by self write by anonymous auth by * none olcAccess: {1}to * by * read My understanding suggests that the second line should allow any user and even anonymous to read all attributes but I can't read the loginShell attribute as anonymous

2 1

Re: Filesystem & backend options for embedded openldap
by Bruce Edge 20 Dec '10

20 Dec '10

On Sat, Dec 18, 2010 at 12:26 PM, Peter Lambrechtsen <plambrechtsen(a)gmail.com> wrote: > Or perhaps TinyLdap? http://www.fefe.de/tinyldap/ > > Also FreeRadius (if your app's support Radius and LDAP) supports a myriad of > backend databases. > Hmm, very interesting. I was not aware of this project. My concern is that there's been very little activity on the project in recent years. Is there no simple, reliable, backend config for openldap? I'm not concerned with speed, just reliability and data integrity. I'd settle for a 10x performance penalty for data integrity. -Bruce > On Sun, Dec 19, 2010 at 5:59 AM, Bruce Edge <bruce.edge(a)gmail.com> wrote: >> >> On Sat, Dec 18, 2010 at 12:19 AM, Peter Lambrechtsen >> <plambrechtsen(a)gmail.com> wrote: >> > Why don't you use SQLite instead??? It's pretty rock solid backend >> > database. >> > >> > Unless your client side only wants to talk LDAP. >> >> Hi, >> Thanks the the response. One of the reasons for ldap is that it >> handles all the authentication for a lot of the packages we're using >> out of the box so it was a natural progression to extend it to handle >> the other data we need as well. >> The only probems, it appears, is how to make it more failsafe on the back >> end. >> >> -Bruce >> >> > >> > On Sat, Dec 18, 2010 at 6:48 AM, Bruce Edge <bruce.edge(a)gmail.com> >> > wrote: >> >> >> >> Perhaps a bit more detail... >> >> During testing our developers frequently hang the target machines. >> >> This usually results in a corrupted ldap database even though no write >> >> activity was present on the box since long before the crash. >> >> >> >> What ldap config tuning options are required to get slapd to sync the >> >> backend to a state where power loss / kernel crashes do not corrupt >> >> the data? >> >> >> >> Thanks >> >> >> >> -Bruce >> >> >> >> On Wed, Dec 15, 2010 at 10:25 AM, Bruce Edge <bruce.edge(a)gmail.com> >> >> wrote: >> >> > I'm working on an embedded system for which I would like to use >> >> > openldap as the means of config storage. >> >> > I've spent a lot of time RTFM'ing and still feel that there is a lot >> >> > that is escaping me as far as the optimal configuration. >> >> > >> >> > If the primary goal is data safety and zero human intervention, what >> >> > would be the optimal combination of file system / backend storage / >> >> > and config options? >> >> > >> >> > I would like to never have to manually recover a database and have it >> >> > gracefully recover from power failures. Speed is not an issue as it's >> >> > very low traffic. Integritiy is everything. >> >> > It's target storage is a USB flash device. Are there any special >> >> > considerations WRT flash storage and ldap? >> >> > >> >> > Thanks in advance. >> >> > >> >> > -Bruce >> >> > >> > >> > > >

4 7

Constant invalid credentials error (49)
by gael therond 20 Dec '10

20 Dec '10

Dear members, I installing/configuring a new OpenLDAP server with compiled sources today. But unfortunatly I got a serious issue with this server. Here are the specs: OpenLDAP Slapd 2.4.23. Configure Commands: ./configure --prefix=/usr/local/ldap/ --sysconfdir=/etc/ldap/ --enable-ipv6=no --enable-dynacl --enable-cleartext=no --enable-crypt --enable-lmpasswd --enable-rlookups --enable-backends=no --enable-bdb --enable-dnssrv --enable-ldap --with-tls --enable-kerberos "Make" commands have been correctly and without errors tested. But now, if I launch my slapd, and if I want to access it throught a LDAP Browser, for exemple JXplorer, I can't. I've got an Invalid Credentials error = 49 message. Here is link my slapd.conf and ACL file.(Pastebin): slapd.conf: http://pastebin.com/3bfu5exy acl file: http://pastebin.com/wJUjJAT0 If I try to pass the following command to change the password and connect me with the new one but it failed: ldappasswd -x -v -D "cn=manager,dc=lab,dc=geka" -A -S -W Then when it ask me the old password I type "test" without the ", then I confirm it. The following message ask me to a new password, that I type (123123 for informations) and confirm again. Then it ask me for the LDAP Password, and so I test with 123123 without success. Same way if I test with the following command and test as password: ldappasswd -v -D "cn=manager,dc=lab,dc=geka" -W Here is the error message: ldap_bind: Invalid credentials (49) I now my password, 'cause it's simply write on the slapd.conf file, but it seems that the LDAP server refuse any connections.

2 1

LDAP installation
by Stefano Malini 18 Dec '10

18 Dec '10

Dear all, i'm installing OpenLdap 2.4.23 on a virtual box with linux ubuntu 2.4.31-14 in /usr/local/. I first succesfully installed Berkeley DB 4.8.26 always in /usr/local/ My problem is launching ./configure command from OpenLDAP directory. The last lines are: checking db.h usability... no checking db.h presence... no checking for db.h... no configure: error: BDB/HDB: BerkeleyDB not available Could you help me, please? Thank you very much, Stefano

3 5

Re: Filesystem & backend options for embedded openldap
by Bruce Edge 18 Dec '10

18 Dec '10

On Sat, Dec 18, 2010 at 12:19 AM, Peter Lambrechtsen <plambrechtsen(a)gmail.com> wrote: > Why don't you use SQLite instead??? It's pretty rock solid backend database. > > Unless your client side only wants to talk LDAP. Hi, Thanks the the response. One of the reasons for ldap is that it handles all the authentication for a lot of the packages we're using out of the box so it was a natural progression to extend it to handle the other data we need as well. The only probems, it appears, is how to make it more failsafe on the back end. -Bruce > > On Sat, Dec 18, 2010 at 6:48 AM, Bruce Edge <bruce.edge(a)gmail.com> wrote: >> >> Perhaps a bit more detail... >> During testing our developers frequently hang the target machines. >> This usually results in a corrupted ldap database even though no write >> activity was present on the box since long before the crash. >> >> What ldap config tuning options are required to get slapd to sync the >> backend to a state where power loss / kernel crashes do not corrupt >> the data? >> >> Thanks >> >> -Bruce >> >> On Wed, Dec 15, 2010 at 10:25 AM, Bruce Edge <bruce.edge(a)gmail.com> wrote: >> > I'm working on an embedded system for which I would like to use >> > openldap as the means of config storage. >> > I've spent a lot of time RTFM'ing and still feel that there is a lot >> > that is escaping me as far as the optimal configuration. >> > >> > If the primary goal is data safety and zero human intervention, what >> > would be the optimal combination of file system / backend storage / >> > and config options? >> > >> > I would like to never have to manually recover a database and have it >> > gracefully recover from power failures. Speed is not an issue as it's >> > very low traffic. Integritiy is everything. >> > It's target storage is a USB flash device. Are there any special >> > considerations WRT flash storage and ldap? >> > >> > Thanks in advance. >> > >> > -Bruce >> > > >

1 0

Filesystem & backend options for embedded openldap
by Bruce Edge 17 Dec '10

17 Dec '10

I'm working on an embedded system for which I would like to use openldap as the means of config storage. I've spent a lot of time RTFM'ing and still feel that there is a lot that is escaping me as far as the optimal configuration. If the primary goal is data safety and zero human intervention, what would be the optimal combination of file system / backend storage / and config options? I would like to never have to manually recover a database and have it gracefully recover from power failures. Speed is not an issue as it's very low traffic. Integritiy is everything. It's target storage is a USB flash device. Are there any special considerations WRT flash storage and ldap? Thanks in advance. -Bruce

1 1

syncrep and memberof
by Yuri Bank 17 Dec '10

17 Dec '10

Are there any known issues with these two overlays when used together? I'm curious what the suggested configuration would be in a single Provider + many Consumer setup. Should the memberof overlay be enabled on the consumer nodes or just the provider? I've noticed that when I add new users to the database, all users under that OU will be refreshed and at which time I lose the memberof attribute for SOME of the users, on only 1 or 2 of the consumer nodes. It seems like a bug, but I wonder if there is any way to get around this. I was thinking of trying delta-sync replication.

1 0

can't contact the LDAP server
by kibirango moses 17 Dec '10

17 Dec '10

hullo everybody I have tested the SLAPD server and it is giving me the output below root@mailbackup:/etc/openldap# ldapsearch -x -W -D 'cn=Manager,dc=mak,dc=ac,dc=ug' -b "" -s base Enter LDAP Password: ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) How can i contact the LDAP server? Thanx

2 1

TLS trace: SSL_accept:error in SSLv2/v3 read client hello A
by Martin Jungowski 17 Dec '10

17 Dec '10

Hi everybody, I'm trying to run OpenLDAP 2.2.13 on a CentOS 4.8 box with TLS/SSL enabled. Certificate should be ok (fqdn set as common name!), self-signed since I can't copy a cacert file to all clients that will one day have to connect to the server (among others a few iPhones). "openssl x509 -in slapd.pem -noout -text" returns the correct contents of the certificate, "openssl s_client -connect localhost:636 -showcerts" works too (although it does hang at the end right after "---" which I guess is normal.. haven't left it running for 300 seconds yet). However, whenever trying to connect to my LDAP server through port 636 I get the above error message. The full message when performing "ldapsearch -x -h localhost:636 -b dc=home" (no difference if I replace localhost with the fqdn): > daemon: activity on 1 descriptors > daemon: new connection on 10 > daemon: added 10r > daemon: activity on: > daemon: select: listen=6 active_threads=0 tvp=NULL > daemon: select: listen=7 active_threads=0 tvp=NULL > daemon: activity on 1 descriptors > daemon: activity on: 10r > daemon: read activity on 10 > connection_get(10): got connid=7 > connection_read(10): checking for input on id=7 > TLS trace: SSL_accept:before/accept initialization > TLS trace: SSL_accept:error in SSLv2/v3 read client hello A > TLS: can't accept. > TLS: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol s23_srvr.c:580 > connection_read(10): TLS accept error error=-1 id=7, closing > connection_closing: readying conn=7 sd=10 for close > connection_close: conn=7 sd=10 > daemon: removing 10 > daemon: select: listen=6 active_threads=0 tvp=NULL > daemon: select: listen=7 active_threads=0 tvp=NULL > daemon: activity on 1 descriptors > daemon: select: listen=6 active_threads=0 tvp=NULL > daemon: select: listen=7 active_threads=0 tvp=NULL Same error message when trying to connect with jxplorer or Thunderbird. Any ideas what else I could try? I've tried various ways of creating a certificate, including both the CentOS recommended "make slapd.pem" in / usr/share/ssl/certs and the "openssl" way but neither made any difference. They all resulted in the exact same error pattern. Frankly, I'm out of ideas. Thanks in advance, Martin -- Rieke Computersysteme GmbH Hellerholz 5 D-82061 Neuried Email: martin[at]rhm[dot]de

2 1

using of db_stat
by Steeg Carson 17 Dec '10

17 Dec '10

Hello, can I really use db_stat with id2entry.bdb and dn2id.bdb without concern and impact of production (speed of ldap) to investigate the database statistic? - Is db_stat usable on a online database without any danger - If I use db_stat online, which impact I have to expect? Thanks for help!

1 1

posixAccount Object creation failing in 2.4.23 with ndb backend
by Nathanael Anderson 17 Dec '10

17 Dec '10

after I include the nis schema in slapd.conf and try to create a user with the new attributes, I recieve this error: ndb_oc_create: CREATE TABLE posixAccount failed, Can't create table 'OpenLDAP.posixAccount' (errno: 157) (1005) ndb_back_add: ndb_entry_put_data failed (80) Tuple did not exist(626) This seems like a ndb backend issue. I have lots of free space in my OpenLDAP ndb backend database for more tables and rows. mysql> select * from memoryusage; +---------+--------------+---------+------------+------------+---------+ | node_id | memory_type | used | used_pages | total | total_pages | +---------+--------------+---------+------------+------------+---------+ | 3 | Data memory | 2457600 | 75 | 1073741824 | 2768 | | 3 | Index memory | 475136 | 58 | 268697600 | 32800 | | 4 | Data memory | 2457600 | 75 | 1073741824 | 32768 | | 4 | Index memory | 475136 | 58 | 268697600 | 32800 | +---------+--------------+---------+------------+------------+---------+ 4 rows in set (0.00 sec) and manual table creation works fine. mysql> create table person2 (sn varchar(128)) engine=ndbcluster; Query OK, 0 rows affected (0.06 sec) mysql> drop table person2; Query OK, 0 rows affected (0.03 sec) any idea's? Nathanael

1 0

BDB File Size...
by Rowley, Mathew 16 Dec '10

16 Dec '10

I recently deleted about 25k entries in a specific OU. Since, the memory usage of the slapd process has consistently stayed at 70%-75% cpu usage: PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 29911 openldap 18 0 12.6g 10g 4.1g S 0 69.6 1003:25 slapd I have also noticed that the DB files have stayed the same size - specifically one is 4gigs: -rw------- 1 openldap openldap 4.0G Nov 30 21:18 __db.003 On a slave to this box, the file size is drastically lower: -rw------- 1 openldap openldap 321M Dec 16 05:02 __db.003 I am assuming that the reason the CPU and memory usage is so high due to trying to keep the entire directory structure in memroy. Is this normal behavior? Is there a way to purge the database files? One other thing that happened was the slaves that are syncing to this server did not update the OU described above. Any help would be great. Thanks.

2 3

enabling monitoring of database
by kibirango moses 16 Dec '10

16 Dec '10

I have installed openldap and on testing the out below is given .How can i configure monitor database ? I thought it is enabled by --enable monitor root@mailbackup:/# slaptest -v -f /etc/openldap/slapd.conf bdb_monitor_db_open: monitoring disabled; configure monitor database to enable config file testing succeeded Installation command : ./configure --sysconfdir=/etc --with-cyrus-sasl --with-threads --with-tls --with-yielding-select --with-mp --enable-slapd --enable-slurpd --enable-cleartext --enable-bdb --enable-ldap --enable-monitor --enable-perl --enable-sql --enable-syslog --enable-spasswd

2 1

failing to "make test" in openldap installation
by kibirango moses 16 Dec '10

16 Dec '10

Hullo everyone I am installing Openldap but in am failing to test and below are my installation commands: env CPPFLAGS="-I/usr/local/BerkeleyDB.5.1/include -I/usr/local/ssl/include/openssl" \ LDFLAGS="-L/usr/local/BerkeleyDB.5.1/lib -L/usr/local/ssl/lib" \ ./configure --sysconfdir=/etc --with-cyrus-sasl --with-threads --with-tls --with-yielding-select --with-mp --enable-slapd --enable-slurpd --enable-cleartext --enable-bdb --enable-ldap --enable-monitor --enable-perl --enable-sql --enable-syslog --enable-spasswd make test has the following errors at the end Initiating LDAP tests for BDB... Could not locate slapd(8) make[2]: *** [bdb-yes] Error 1 make[2]: Leaving directory `/usr/local/src/openldap-2.4.23/tests' make[1]: *** [test] Error 2 make[1]: Leaving directory `/usr/local/src/openldap-2.4.23/tests' make: *** [test] Error 2 *root@mailbackup:/usr/local/src/openldap-2.4.23#* Anybody to help me go over this? Thanx

2 1

Unable to authenticate with "secondary" uids, slapd 2.4.23, centos5.5
by Chan Wilson 16 Dec '10

16 Dec '10

Hi all, I have several LDAP trees and installs (2.4.23, centos 5.5, bdb) that utilize "secondary" uids as the sites are in the process of migrating user IDs. In essence, allowing both "user" and "user.name" to authenticate as the same "user" account: dn: uid=user,ou=people,dc=example,dc=com uid: user uid: user.name This has all been working beautifully since inception with 2.4.21. However, "something changed" either at the O/S level or slapd level to break this, and I'm at a loss as to what to look at next. When doing an ldapsearch -D with the "secondary" uid, it fails, and the server-side has a return from bdb_dn2id -- "get failed: DB_NOTFOUND: No matching key/data pair found (-30988)", which implies that the BDB index file for uid doesn't contain the additional uids. Not sure how to look at that, slapd_db_dump doesn't reveal anything human-parsable. Does this ring any bells? Was it just a fluke that this worked? thanks, --Chan

2 1

problem with ldap_search _ext and ldap_result
by siva prakash 16 Dec '10

16 Dec '10

After binding the ldap server, here are my code snippets, finished = 0; rc = ldap_search_ext( ld, "testactivedirectory.com", sub_tree, "(sAMAccountName=user1)", NULL, 0, NULL, NULL, NULL, 1, &msgid ); if ( rc != LDAP_SUCCESS ) { fprintf( stderr, "ldap_search_ext: %s \n", ldap_err2string( rc ) ); ldap_unbind( ld ); return( 1 ); } while (!finished) { rc = ldap_result( ld, msgid, LDAP_MSG_ONE, &zerotime, &res ); printf("check the search result :%d\n", rc); switch ( rc ) { case -1: fprintf( stderr, "ldap_result: %s\n", ldap_err2string( rc ) ); ldap_unbind( ld ); return( 1 ); case 0: break; case LDAP_RES_SEARCH_ENTRY: /* Get and print the DN of the entry. */ if (( dn = ldap_get_dn( ld, res )) != NULL ) { printf( "dn-> %s\n", dn ); ldap_memfree( dn ); } break; case LDAP_RES_SEARCH_RESULT: finished = 1; break; default: break; } } while running this program, i could get the intended result what the distinguished name i want, but the ldap_result in not being exit with LDAP_RES_SEARCH_RESULT option. it tooks lot of time to respond with LDAP_RES_SEARCH_RESULT, even no more entry to provide. check the search result :100 dn-> CN=user1,CN=Users,DC=testactivedirectory,DC=com (it waits in looop... it exits after a very long time) check the search result :101 i wanted to avoid this waiting time, even i have been sending entries should be limited to 1, it doesn't seems to be reflected, i have found other way of fixing this, doing two bind and two unbind option. but that is not seems a optimized manner. Let me know how to fix this problem, Thanks, LDAP Learner

1 0

openldap and kerberos integration
by Thierry Lacoste 16 Dec '10

16 Dec '10

Hello, I'm experimenting with integrating Kerberos and OpenLDAP following roughly http://wiki.mandriva.com/en/Projects/OpenLDAP_DIT I'm using CentOS and Buchan Milne's repository (http://staff.telkomsa.net/packages/rhel5/ ) both for OpenLDAP and Heimdal. I've almost succeeded except for password integration. It seems that the smbk5pwd module provided by openldap2.4- servers-2.4.22-1.el5 in /usr/lib/openldap2.4/smbpwd.so is built without kerberos support. With "smbk5pwd-enable krb5" I have the following error: /etc/openldap2.4/slapd.conf: line 154: smbk5pwd: <smbk5pwd-enable> module "smbk5pwd-enable" only allowed when compiled with -DDO_KRB5. What is the easiest option to get a kerberos supporting smbk5pwd? BTW I'd appreciate any recommandations about providing kerberos and LDAP authentication (with the same password) in a production setting. Should I use Heimdal or MIT kerberos ? If Heimdal, is it better to use OpenLDAP as a backend for Kerberos or let Kerberos use its native backend? If OpenLDAP as a backend, is it better to use {K5KEY} as the userPassword or let smbk5pwd synchronize everything? Best regards, Thierry

4 11

Re: Re: how to analysis openldap log
by owen nirvana 16 Dec '10

16 Dec '10

> > I could not find apis for analysising log. > > > > Thanks for help! > What kind of log are you referring to? > syslog, log database or monitor database? log databasem, the files like log.000000x in /var/ldap/ gtalk:freeespeech@gmail.com <gtalk%3Afreeespeech(a)gmail.com>

2 1

how to implement default groups?
by Judd Maltin 15 Dec '10

15 Dec '10

Hi folks, how to implement default groups? I'd like to setup a "default" group entry that automatically includes the bindDN as a member. Better yet, I'd like to indicate a regex for members of the group. There's all sorts of nice things that can be done with ACLs, but they're irrelevant. And there's nothing in dynlist or other overlays that will help me. Am I barking up the wrong tree? Thanks, -judd -- Judd Maltin T: 917-882-1270 T: 888-639-4614 F: 501-694-7809 Gratitude is the end of despair and the beginning of joy.

1 0

New Attributes, ACL, and Indices
by Andy Carlson 15 Dec '10

15 Dec '10

I have recently added a few new attributes to an existing object class (this was a custom object class, not an out-of-the-box one). I also created a few olcAccess (ACL) entries to enable access to these new attributes and olcDbIndex entries to index the values of the attributes. I added all of these using the cn=config directory structure containers. It is my understanding that unless I modify schema/ldif files on the server that these changes will be lost upon server/service restart. I have the idea that these are the correct folder, but since I've never done this before I'm seeking confirmation/direction. The ACLs and Indices appear to be located in the /opt/<Server-Instance>/common/setup folder. In this folder there is an olcAccess.bdb.ldif file (which appears to hold the ACLs). There's also an LDIF file for the frontend and monitor container located within cn=config. The attributes appear to be located in the /opt/<Server-Instance>1/etc/openldap/schema.mbi folder (mbi is an identifier for our organization). In this folder there is a file named mbiUser.schema (mbiUser is the custom object class). I suspect that this is where the attributes would be stored. Again, this is a non-exhaustive listing of a few things that caught my eye. Let me know if you have any thoughts or suggestions. Thanks much, Andy Carlson Identity Administrator | Information Systems Moody Bible Institute 820 N. LaSalle Blvd., Chicago, IL 60610 312-329-4385 www.moodyministries.net<http://www.moodyministries.net> >From the Word. To Life.

1 0

PAM Filtering Not working with CRYPT Passwds
by Anton Chu 15 Dec '10

15 Dec '10

I have installed the ldapns.schema in my ubuntu 10.04 ldap server to enable host based authentication/filtering. I have some ubuntu 10.10 ldap clients that requires filtering. All my ldap users have passwords in crypt format that I have converted to an ldif file using the PADL migration.pl scripts. After importing them into my ldap server, the pam filtering wasn't working; however, when I changed the passwords from crypt to clear or md5 or sha1, filtering worked fine. The question is how can I get filtering to work with {CRYPT} password hashing? cat /etc/ldap.conf | grep -v ^# | grep -v ^$ > base dc=web,dc=net > uri ldap://10.112.18.2 > ldap_version 3 > rootbinddn cn=admin,dc=web,dc=net > bind_policy soft > pam_filter |(host=webdev120)(host=\*) > nss_initgroups_ignoreusers > backup,bin,daemon,games,gnats,irc,libuuid,list,lp,mail,man,news,proxy,root,sshd,sync,sys,syslog,uucp,www-data > > cat common-auth | grep -v ^# | grep -v ^$ > auth [success=2 default=ignore] pam_unix.so nullok_secure > auth [success=1 default=ignore] pam_ldap.so use_first_pass > auth requisite pam_deny.so > auth required pam_permit.so > cat common-account | grep -v ^# | grep -v ^$ > account [success=2 new_authtok_reqd=done default=ignore] pam_unix.so > account [success=1 default=ignore] pam_ldap.so > account requisite pam_deny.so > account required pam_permit.so > cat common-password | grep -v ^# | grep -v ^$ > password [success=2 default=ignore] pam_unix.so obscure sha512 > password [success=1 user_unknown=ignore default=die] pam_ldap.so > use_authtok try_first_pass > password requisite pam_deny.so > password required pam_permit.so >

1 0

How Indexes work?
by Steeg Carson 15 Dec '10

15 Dec '10

Hello, I try to understand, how the LDAP-Indexes work. If I configure a Index for a Attribute like: index myAttribute eq the index file myAttribute.bdb is build in the data directory. When I search then ldapsearch -x -h localhost -D".." -b"<baseDN>" "(myAttribute=<searched key>)" how will the LDAP-Server process this request? Is there anywhere a good documentation? My assumption is: * At first, a the Index is looked up. The result are only the matched IDs. * The LDAP-Server now can quick give back all entires form id2enty.bdb If I use Indexes, are all other entires are examined too after give back the result from indexes? I have a database, and my search is like shown above. The search takes long. The cache is configured, the size is enough (approx. dn2id.bdb + id2entry.bdb). But what I see, is that the write IO from LDAP is enormously (seen with iotop). During the whole search, the write IO is higher than the read IO. Why? Thanks for help. Steeg

1 0

Debugging syncrepl
by Angel L. Mateo 15 Dec '10

15 Dec '10

Hello, I've configured 2 ldap servers (2.4.21, from ubuntu 10.04 package) in a master-master configuration. The configuration I have is: {0}rid=004 provider=ldap://ldap1.mydomain.com binddn="<replicauser>" bindmethod=simple credentials=<replicapass> searchbase="<dc=mydomain>" type=refreshOnly interval=00:00:00:10 retry="5 5 300 +" timeout=1 {1}rid=005 provider=ldap://ldap2.mydomain.com binddn="<relicauser>" bindmethod=simple credentials=<replicapass> searchbase="<dc=mydomain>" type=refreshOnly interval=00:00:00:10 retry="5 5 300 +" timeout=1 I have an oclAccess like: {3}to dn.subtree=<dc=mydomain> by group.exact=<admingroup> manage ... by * none break Replica user belongs to group <admingroup>, so it has complete access to the directory. I have also a limit like: {1}group=<admingroup> time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited so it has no limits. The problem is that I'm loading the directory with a lot of entries (about 109000). After all the load process (I've done it in ldap2, with ldapadd commands) I have all the entries in ldap2, but I have a few less in ldap1 (about 107000). How could I debug the problem? I have tried later to remove from ldap2 an entry that it isn't at ldap1, and then add it again and the replication is done, so I don't know why it hasn't been replicated the first time. -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 868887590 Fax: 868888337

1 0

Syncrepl attrs selection
by Raphael Ordinas 15 Dec '10

15 Dec '10

Hi everyone, I'm facing a minor problem with syncrepl. I'd like to tell syncrepl to sync all attributs but the one specified. Is this possible ? Thanks Raphael

2 2

Using dynlist overlay like dynlist and dyngroup (extend dyngroup schema?)
by c0re 15 Dec '10

15 Dec '10

Hello openldap users! slapd.conf: overlay dynlist dynlist-attrset groupOfUrls labeledURI member ldif: dn: cn=testgroup,ou=servers,dc=domain,dc=local objectclass: groupOfNames cn: testgroup member: cn=test,ou=users,dc=domain,dc=local dn: cn=maingroup,ou=servers,dc=domain,dc=local objectclass: groupOfNames cn: maingroup member: cn=testgroup,ou=servers,dc=domain,dc=local dn: cn=testgroup,ou=servers,dc=domain,dc=local objectClass: top objectClass: labeledURIObject objectClass: groupOfURLs cn: testgroup labeledURI: ldap:///ou=users,dc=domain,dc=local??one?(objectClass=inetOrgPerson) dn: cn=maingroup,ou=serversGroups,dc=domain,dc=local objectClass: top objectClass: labeledURIObject objectClass: groupOfURLs cn: maingroup labeledURI: ldap:///ou=servers,dc=domain,dc=local?member?one?(objectClass=groupOfUrls) With this configuration when ldapsearching for contents of "cn=testgroup,ou=servers,dc=domain,dc=local" I got "member: cn=testgroup,ou=servers,dc=domain,dc=local". Cool! It's working. Then I want to have dynlist that contains members of group of dyngroups. And here I stuck. In slapd.conf I can say that some objectClass can be dyngroup or dynlist, but not together. That's right. Then I though that I can extend dyngroup.schema and add groupOfUrls2, then add "dynlist-attrset groupOfUrls2 labeledURI" to slapd.conf and groupOfUrls2 will behave like dynlist, and groupOfUrls will still be dyngroup. That's would be very good for me! I looked in dyngroup.schema and copy groupOfUrls definition to groupOfUrls2. objectClass ( NetscapeLDAPobjectClass:33 NAME 'groupOfURLs2' SUP top STRUCTURAL MUST cn MAY ( memberURL $ businessCategory $ description $ o $ ou $ owner $ seeAlso ) ) But there was error: /usr/local/etc/openldap/schema/dyngroup.schema: line 89 objectClass: Inconsistent duplicate objectClass: "2.16.840.1.113730.3.2.33" /usr/local/etc/openldap/slapd.conf: line 11: <include> handler exited with 1! slapd destroy: freeing system resources. slapd stopped. So... I changed 33 to 34 in chema. Error gone, slapd started. I added to ldap: dn: cn=maingroup2,ou=serversGroups,dc=domain,dc=local objectClass: top objectClass: labeledURIObject objectClass: groupOfURLs2 cn: maingroup labeledURI: ldap:///ou=servers,dc=domain,dc=local?member?one?(objectClass=groupOfUrls) and my slapd.conf not looking like this: overlay dynlist dynlist-attrset groupOfUrls labeledURI member dynlist-attrset groupOfUrls2 labeledURI So groupOfUrls must be dyngroup, and groupOfUrls2 must be dynlist. And now when I ldapsearch for member attr in maingroup2 I wanted to get all members of groups that are under ou=servers,dc=domain,dc=local, but I got no members... Logic was - testgroup (and others groupOfURLs) work as dyngroup and generate member attr in it depending on specified labeledURI. Then maingroup2 (and others) will ldapsearch in ou=servers and make member: attr depending on member attr of groups in ou=servers (and some filters, that I will use later). But maingroup2 not working... It not generate member: attr in it. I think I was wrong changing 33 to 34, because I need some more thing to do, but I do not know what I should do. Can anoyone suggest what to do?

1 0

ldap personal addressbook
by Umarzuki Mochlis 15 Dec '10

15 Dec '10

i already setup squirrelmail and roundcubemail to read ldap global addressbook on RHEL 5 but how can i make both be able to: 1. store personal addressbook in openldap 2. import addressbooks from squirrelmail database into openldap so both webmail can view the same addressbook any hints and links are welcomed. -- Regards, Umarzuki Mochlis http://debmal.my

1 0

Re: backend issue
by Friedrich Locke 14 Dec '10

14 Dec '10

Hi, Here are the location of some files related to db-4.6.21 installed in my box. sioux@lion$ pkg_info -L db-4.6.21 | grep include /usr/local/include/db4/db.h /usr/local/include/db4/db_185.h /usr/local/include/db4/db_cxx.h sioux@lion$ pkg_info -L db-4.6.21 | grep lib /usr/local/lib/db4/libdb.a /usr/local/lib/db4/libdb.la /usr/local/lib/db4/libdb_cxx.a /usr/local/lib/db4/libdb_cxx.la /usr/local/share/doc/db4/ref/build_unix/shlib.html /usr/local/share/doc/db4/ref/refs/libtp_usenix.ps /usr/local/lib/db4/libdb.so.5.0 /usr/local/lib/db4/libdb_cxx.so.6.0 /usr/local/lib/libdb.so.5.0 /usr/local/lib/libdb_cxx.so.6.0 sioux@lion$ I setted CPPFLAGS as the following (and it worked when i ran ./configure): sioux@lion$ export CPPFLAGS="-I/usr/local/include/db4" But for LDFLAGS, how should i set it? On Tue, Dec 14, 2010 at 4:25 PM, Quanah Gibson-Mount <quanah(a)zimbra.com> wrote: > --On Tuesday, December 14, 2010 5:51 AM -0200 Friedrich Locke > <friedrich.locke(a)gmail.com> wrote: > >> Ok! >> >> I looked at /usr/include/db.h. How could i solve this problem ? > > Set the appropriate variables, specifically: > CPPFLAGS > and > LDFLAGS > > --Quanah > > > -- > > Quanah Gibson-Mount > Sr. Member of Technical Staff > Zimbra, Inc > A Division of VMware, Inc. > -------------------- > Zimbra :: the leader in open source messaging and collaboration >

2 1

backend issue
by Friedrich Locke 14 Dec '10

14 Dec '10

Hi folks, i run openbsd as my OS of choice and would like to install openldap and BDB. i am forced to use openldap 2.3.43 with Berkeley DB v3. Is there anything i should be aware about this combination? Has anyone in this list faced the same scenario ? What is your experience? best regards, Fried.

3 6

rwm overlay missing
by Josh Spranger 14 Dec '10

14 Dec '10

I have OpenLDAP 2.4.23 on OpenSUSE 11. When I compiled the binaries I used the flags -enable-ldap and -enable-rewrite so I could use it as a Proxy to AD. I also want to use the rwm overlay to remap the AD attributes. My problem is when I configure 'overlay rwm' and use slaptest it returns with "overlay 'rwm' not found" and I do not have any rwm.la files anywhere to load in the 'moduleload' section. I presume I am missing a configure flag, but for this version which one? Thanks!

2 1

OpenLDAP and third party authentication integration
by Any Joe 14 Dec '10

14 Dec '10

Dear LDAP tech gurus, Newbie here.. I need some pointers on how to integrate a third party web-based auth system and OpenLDAP. Our reqs are as follows 1. We dont store passwords (or hashes) in LDAP and they are dont-care for us; for backward compatibility we may still have some admin/admin-password credentials on LDAP). In other words, reg-users are not authenticated against LDAP, but we use LDAP for directories and corp-info repository purposes. 2. Third party app will authenticate and may access user info in LDAP depending on the applications 3. Users will be created, deleted and modified on LDAP directories, but again passwords are dont-cares What is the best way to achieve this? Any lit/pointers highly appreciated. Many thanks in anticipation -JM

2 1

how to analysis openldap log
by owen nirvana 14 Dec '10

14 Dec '10

I could not find apis for analysising log. Thanks for help! gtalk:freeespeech@gmail.com <gtalk%3Afreeespeech(a)gmail.com>

2 1

Openldap occasional hunging
by Nick Milas 14 Dec '10

14 Dec '10

Hi, I am experiencing the following problem: Occasionally but consistently (about once a month), one of my ldap servers will hung - usually after some entry update. I find out the hung due to problems with the services which are dependent on ldap (mail, dns, see below). The question is: Why does this happen, and how can I avoid it? All servers are production systems, and need maximum reliability. When the problem occurs, I need to stop ldap service. If I try to start it again, I get: Checking configuration files for slapd: bdb_db_open: unclean shutdown detected; attempting recovery. bdb_db_open: Recovery skipped in read-only mode. Run manual recovery if errors are encountered. Then (as I have found from researching the problem), I must issue (as root): # service ldap stop # slapd_db_recover -v -h /var/lib/ldap ... # slapindex # chown ldap:ldap /var/lib/ldap/* # service ldap start Then, everything works fine again. My setup is: one master (provider) openldap server (where all modifications take place) with 3 slaves (consumers), one of which is used with postfix/dovecot, and the other two with powerdns (ldap backend). Sync is being done with syncrepl, type=refreshAndPersist. Modifications are carried out using phpLDAPadmin (1.0.7), JXplorer, and other custom php scripts. The DIT is small (less than 2000 entries in total) and DIT changes are relatively few (max ~50 modifications per day, sometimes no modifications are made for several days). The hung can occur to anyone of the ldap servers (either master or slave), with the same frequency (about once per month)! One of the servers is affected each time. All servers run CentOS 5.5 with the latest openldap packages available: 2.3.43-12.el5_5.3. BDB: # slapd_db_upgrade -V Sleepycat Software: Berkeley DB 4.4.20: (January 10, 2006) I wonder: Could such a database corruption problem occur in case: 1. An entry is being modified at the same time as it is being read by another process? 2. An entry is being modified "concurrently" by two different connected clients? Could the problem be resolved with upgrading to a more recent openldap/bdb version? Can anyone suggest RPM (RHEL5 or Centos 5) packages to use safely (with TLS, cyrus-sasl, slapi, overlays=mod, plugins, modules) ? Thanks in advance, Nick

1 0

How to rename the BASE DN?
by Anton Chu 14 Dec '10

14 Dec '10

How do I rename my base dn due to my domain name change? I'm using the latest openldap run time configuraiton.

4 4

Duplicate DN records, sometimes..
by Jorgen Lundman 14 Dec '10

14 Dec '10

openldap-2.4.23 db-4.8.30.NC Solaris 10u8 x86 We use LDAP for many things, including DNS. We've had an intermittent issue where doing a ldap subtree (recursive) delete would fail. I dug deeper, and found that it would die with NO SUCH OBJECT. Curiously, it was not lying. Or rather, the LDAP Search to determine the objects to delete would return duplicate for the "@" entry. - Found 9 service entries in subtree DNSZoneName=reger.jorgen.jp,ou=dns: 1 DNSHostName=(a),DNSZoneName=reger.jorgen.jp,ou=dns 2 DNSHostName=(a),DNSZoneName=reger.jorgen.jp,ou=dns etc. What would then happen, is that the #1 deletion would succeed (and delete both entries). After which it would try to delete #2 and receive NO SUCH OBJECT. I created a new (many many new) domains, and did a command-line ldapsearch: /usr/local/bin/ldapsearch -h 172.20.12.113 -b DNSZoneName=fun.jorgen.jp,ou=dns # fun.jorgen.jp, dns, dn: DNSZoneName=fun.jorgen.jp,ou=dns objectClass: DNSZone DNSZoneName: fun.jorgen.jp # @, fun.jorgen.jp, dns dn: DNSHostName=(a),DNSZoneName=fun.jorgen.jp,ou=dns objectClass: DNSHost DNSHostName: @ # @, fun.jorgen.jp, dns dn: DNSHostName=(a),DNSZoneName=fun.jorgen.jp,ou=dns objectClass: DNSHost DNSHostName: @ How curious. I peppered the perl code with the same ldapsearch to try to determine where the duplicate DN was (accidentally?) created. I found that if I had this: ldapdb::CreateSOA($domain,$serial,28800, 7200, 604800, $ttl, "hostmaster.$domain.", "dns01.company.com."); system("/usr/local/bin/ldapsearch -h $ldap_host_dns DNSZoneName=$domain,ou=dns"); ldapdb::AddRecord($domain, "NS", "@", "dns01.company.com."); The duplicate records were no longer created. By simply having an LDAP search between the creation of the tree, the error went away. Does anyone know what is actually going on here? I have also found that I can create a LDAP tree, which has duplicate "@" entries. Then wait ~30mins, and the duplicate entry also, sometimes(?), goes away. But not always. The code for CreateSOA and AddRecord is relatively simple, here I have stripped out the error checking code for simplicity. ---------------------------------------------------------------------- CreateSOA(): $ldap = Net::LDAP->new($ldap_host_dns); $mesg = $ldap->bind($ldap_bind, password=>$ldap_pass); $mesg = $ldap->add("DNSZoneName=$adddomain,$ldap_base_dns", attr => [ 'objectClass' => [ 'DNSZone' ], 'DNSZoneName' => "$adddomain" ] ); $mesg = $ldap->add("DNSHostName=\@,DNSZoneName=$adddomain,$ldap_base_dns", attr => [ 'objectClass' => [ 'DNSHost' ], 'DNSHostName' => "\@" ] ); $mesg = $ldap->add("DNSRecord=SOA,DNSHostName=\@,DNSZoneName=$adddomain,$lda p_base_dns", attr => [ 'objectClass' => [ 'DNSSOARecord' ], 'DNSHostName' => "\@", 'DNSRecord' => "SOA", 'DNSType' => "soa", 'DNSSerial' => "$serial", 'DNSRefresh' => "$refresh", 'DNSRetry' => "$retry", 'DNSExpire' => "$expire", 'DNSMinimum' => "$minttl", 'DNSAdminEmail' => "$hostmaster", 'DNSPrimaryns' => "$nameserver", 'DNSTTL' => "$minttl" ] ); $ldap->unbind; ---------------------------------------------------------------------- And AddRecord: $ldap = Net::LDAP->new($ldap_host_dns); $mesg = $ldap->bind($ldap_bind, password=>$ldap_pass); $mesg = $ldap->add("DNSHostName=$name,DNSZoneName=$domain,$ldap_base_dns", attr => [ 'objectClass' => [ 'DNSHost' ], 'DNSHostName' => "$name" ] ); $ldap->unbind; ---------------------------------------------------------------------- For now, we will have the simple/pointless ldapsearch between CreateSOA and AddRecord to avoid the duplicate "@" DN entry, and in ldap delete-subtree we will ignore NO SUCH OBJECT error so that it keeps going and cleans up the domain properly. Lund -- Jorgen Lundman | <lundman(a)lundman.net> Unix Administrator | +81 (0)3 -5456-2687 ext 1017 (work) Shibuya-ku, Tokyo | +81 (0)90-5578-8500 (cell) Japan | +81 (0)3 -3375-1767 (home)

1 0

Re: backend issue
by Quanah Gibson-Mount 13 Dec '10

13 Dec '10

--On Monday, December 13, 2010 7:51 PM -0200 Friedrich Locke <friedrich.locke(a)gmail.com> wrote: > Excuse me Mr. Quanah, > > but where do you download BDB 4.4.x from ? If you want help, keep your replies to the list. --Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Mac OS X OpenLDAP allows anonymous access to all fields
by RAT 13 Dec '10

13 Dec '10

I am experimenting with authenticating users off of OpenLDAP. The default deployment from Apple seems to be (at least in my case) completely wide open. I have been trying to find a ACI to block access to the password value. Does anyone have any good resources on this or, better yet, an ACI I can apply? Robert Threet http://yesistilluseperl.blogspot.com/ ____________________________________________________________ Obama Urges Homeowners to Refinance If you owe under $729k you probably qualify for Obama's Refi Program http://thirdpartyoffers.netzero.net/TGL3231/4d0648688b054664b76st03duc

2 1

Re: Mac OS X OpenLDAP allows anonymous access to all fields
by RAT 13 Dec '10

13 Dec '10

I have SSHA1 working, but still not comfortable with this being visible via LDAP query. http://www.openldap.org/doc/admin24/security.html What are others doing to harden the default install? Robert Threet http://yesistilluseperl.blogspot.com/ ---------- Original Message ---------- From: "RAT" <robert3t(a)netzero.net> To: openldap-technical(a)openldap.org Subject: Mac OS X OpenLDAP allows anonymous access to all fields Date: Mon, 13 Dec 2010 16:22:44 GMT I am experimenting with authenticating users off of OpenLDAP. The default deployment from Apple seems to be (at least in my case) completely wide open. I have been trying to find a ACI to block access to the password value. Does anyone have any good resources on this or, better yet, an ACI I can apply? Robert Threet http://yesistilluseperl.blogspot.com/ ____________________________________________________________ How to Fall Asleep? Cambridge Researchers have developed an all natural sleep aid just for you. http://thirdpartyoffers.netzero.net/TGL3231/4d065f00159b66954dest06duc

1 0

push replication with proxy and rwm overlay
by Gwenn Gueguen 13 Dec '10

13 Dec '10

Hi all, I'm trying to set up push replication from master to slave through a proxy with rwm overlay. Master, proxy and slave are OpenLDAP 2.4.11 from debian lenny. On the slave, I don't want samba related attributes so I used the attrs param on syncrepl to only get attributes I want but entries still have sambaSamAccount or sambaGroupMapping as objectClass. I tried using the rwm overlay to remove these references to samba in objectclass but it did not work and I still get the following error when proxy tries to add the entries on the slave: error code 0x15: objectClass: value #3 invalid per syntax Here is the proxy configuration: include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/samba.schema include /etc/ldap/schema/authldap.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args loglevel -1 modulepath /usr/lib/ldap moduleload back_ldap moduleload syncprov moduleload rwm database ldap suffix "..." rootdn "cn=admin,..." uri ldap://ldap-dmz # Save the time that the entry gets modified, for database #1 lastmod on #We don't need any access to this DSA restrict all overlay rwm rwm-map objectclass inetOrgPerson * rwm-map objectclass posixAccount * rwm-map objectclass shadowAccount * rwm-map objectclass organizationalPerson * rwm-map objectclass person * rwm-map objectclass posixGroup * # rwm-map objectclass sambaSamAccount # rwm-map objectclass sambaGroupMapping rwm-map objectclass * acl-bind bindmethod=simple idassert-bind bindmethod=simple binddn="cn=admin,..." credentials="secret" syncrepl rid=001 provider=ldap://ldap attrs="@inetOrgPerson,@posixAccount,@shadowAccount,@organizationalPerson,@person" bindmethod=simple searchbase="ou=people,..." type=refreshAndPersist retry="60 +" interval=00:00:01:00 schemachecking=off syncrepl rid=002 provider=ldap://ldap attrs="@posixGroup" bindmethod=simple searchbase="ou=groups,..." type=refreshAndPersist retry="60 +" interval=00:00:01:00 schemachecking=off overlay syncprov I tried upgrading OpenLdap on the proxy to 2.4.17 from backports and also upgraded to squeeze with OpenLdap 2.4.23 but I still get the error. Am I doing something wrong or is rwm buggy ? Thanks, -- Gwenn

1 1

Ordering of shadowExpire values
by Antonio Batovanja 13 Dec '10

13 Dec '10

From nis.schema: attributetype ( 1.3.6.1.1.1.1.10 NAME 'shadowExpire' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) If I add ORDERING integerOrderingMatch to shadowExpire, I can use a range filter like (&(objectclass=shadowaccount)(shadowexpire>=1000)) What else can I do to be able to use a range filter? I don't like changing standard schemas... Cheers, Toni

1 0

debugging memberOf overlay
by c0re 13 Dec '10

13 Dec '10

Hello all! Trying to get memberOf overlay working. Added to slapd.conf "overlay memberof" Restarted slapd. Checked that overlay loaded # slaptest -d 1 ............. config_build_entry: "olcOverlay={1}memberof" ............. Then added 1 user and 2 groups via ldif: dn: cn=test,ou=users,dc=domain,dc=local sn: test cn: test uid: test objectClass: inetOrgPerson objectClass: top objectClass: person objectClass: posixAccount objectClass: shadowAccount objectClass: radiusprofile uidNumber: 5555 gidNumber: 5555 homeDirectory: /home/test givenName: test loginShell: /bin/sh shadowMin: 0 shadowMax: 999 shadowWarning: 7 shadowInactive: -1 shadowExpire: 0 shadowFlag: 0 dialupAccess: yes dn: cn=testgroup,ou=servers,dc=domain,dc=local objectclass: groupOfNames cn: testgroup member: cn=test,ou=users,dc=domain,dc=local dn: cn=maingroup,ou=servers,dc=domain,dc=local objectclass: groupOfNames cn: maingroup member: cn=testgroup,ou=servers,dc=domain,dc=local And made # ldapsearch -x -D "cn=admin,dc=domain,dc=local" -b "dc=domain,dc=local" -W "(cn=test)" memberOf # extended LDIF # # LDAPv3 # base <dc=domain,dc=local> with scope subtree # filter: (cn=test) # requesting: memberOf # # test, users, domain.local dn: cn=test,ou=users,dc=domain,dc=local # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 As you see - no memberOf in users attrs. I got no ideas why... By that I wanted to test output of ldapsearch to check will there be two or one memberOf attrs. Thanks!

1 2

Oddities with searching for a specific value of an attribute
by Sebastian Urbanneck 12 Dec '10

12 Dec '10

Sorry for this weird topic, but I didn't know how to name this one. These are the facts: we're using the phamm.schema from the PHAMM Project for saving virtual domain entries in our Ldap database. Searching for them is mostly no pronblem, but one specific circumstance is bothering me to death: when I try to search for a specific value of the attribute "vd", the corresponding entry is not always found. Any other attribute does the trick, but vd does'nt. For example: the search for (using the root_dn) ldapsearch -x -W -D "cn=admin,dc=uebergebuehr,dc=de" -b "ou=domains,dc=uebergebuehr,dc=de" "(vd=*) -s"one" produces following output: ---------output------------- # extended LDIF # # LDAPv3 # base <vd=lak-hessen.de,ou=domains,dc=uebergebuehr,dc=de> with scope baseObject # filter: (vd=*) # requesting: ALL # # lak-hessen.de, domains, uebergebuehr.de dn: vd=lak-hessen.de,ou=domains,dc=uebergebuehr,dc=de vd: lak-hessen.de lastChange: 1291723263 maxMail: 100 maxAlias: 100 maxQuota: 100 accountActive: TRUE editAV: TRUE delete: FALSE postfixTransport: dovecot objectClass: top objectClass: VirtualDomain description: lak-hessen.de # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 ------------------------------------- This is true for everytime I put a Wildcard (*) into the search pattern, and with scope "sub" there's also no matter in which part of the tree above this entry I am. But when I'm searching specificly for the value (lak-hessen.de) nothin is found, no matter in which entry I am and which scope use. Strangely this pattern _is_ found when you go into the entry of the domain itself (vd=lak-hessen.de,ou=domains,...) and search with scobe 'base'. Any idea what I'm doing wrong? Or is this a bug? I think ACLs are ruled out because of using the root_dn. I didn't want to file a Bug before being reallly sure that this is one regards Sebastian

2 2

slapcat, PROXIED attributeDescription inserted, and cron jobs
by btb＠bitrate.net 10 Dec '10

10 Dec '10

hi- i'm running slapcat from a daily cron job to back up cn=config and other databases. i've recently updated from 2.4.21 to 2.4.23, and notice now in the output of slapcat, messages such as >slapcat -b 'cn=config' -l 'config.ldif' > /dev/null PROXIED attributeDescription "OU" inserted. PROXIED attributeDescription "DC" inserted. a bit of searching seems to indicate that these shouldn't be cause for concern, and are just informative messages. since these messages are written to stderr, cron sends email every time it runs slapcat. if they're not errors, do they maybe belong in stdout rather than stderr? alternatively, can these messages be suppressed? according to the man page, there doesn't appear a way to do so. thanks -ben

4 4

x500UniqueIdentifier
by Juan Gonzalez 09 Dec '10

09 Dec '10

Hi, I'm trying to insert userCertificate values containing x500UniqueIdentifiers. When the value appears at the SubjectNames, it inserts correctly. By this I assume there is a validation for the field formatting. When I have a x500UniqueIdentifier at the IssuerNames it fails to insert. Is there a specific place where valid attributes and syntaxes for IssuerNames should be declared? Thanks Jgcardoso.

3 3

slapd 2.4.23 SASL/GSSAPI problem
by Matej Zagiba 09 Dec '10

09 Dec '10

Hello everybody, I'm running debian squeeze (testing) with openldap 2.4.23 and MIT kerberos 1.8.3 KDC. I had functinal SASL/GSSAPI authentication configured, but recently it stopped working. I cannot be realy sure, but I suspect upgrade from openldap 2.4.22 is the cause. In logs I see lots of this: SASL [conn=1003] Failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Configuration file does not specify default realm) I added sasl-realm option but it did not helped. All other kerberos applications works without problem. Is there any (new) SASL option I missed? Or it's a bug in 2.4.23? Thanks for any help. Matej Zagiba

2 5

Re: Drives me crazy .. openLDAP 2.4 - migrate config from 2.3
by Götz Reinicke - IT-Koordinator 09 Dec '10

09 Dec '10

Hey Victor, thanks four your long helpful answer. Yes, it is the Redhat provided openldap-servers-2.4.22-7.el6.i386, because compiling from source (on RH 5!) did not work for me :-( (s. other discussion) For me I'd like to stay with the RH Packages, as compiling is not yet part of my daily business ;-) But things may change.... Before I started to try your suggestions, I restarted my testsystem and 'just' launched slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d and adjusted the file permissions. And voila, my slapd config is build and the server starts without errors. All I did was restarting the system, no change to the config. So something had a hick-up. Regards . Götz Am 08.12.10 18:30, schrieb Gattegno, Victor (GCC - Software): > Hello Götz, > > Which OpenLDAP 2.4 version do you use? > The one of RHEL 6? > > Or the one (OpenLDAP 2.4.23) from http://www.openldap.org? > Then slapd.conf is : /usr/local/etc/openldap/slapd.conf > > I would recommend you OpenLDAP 2.4.23 from http://www.openldap.org > associated with BDB recommended-version: > http://www.openldap.org/doc/admin24/appendix-recommended-versions.html > > Check with: > locate slapd > slapd -V > >> db_open(/var/lib/ldap/id2entry.bdb) failed: No such file or directory (2). > It seems that slaptest saw that your configuration expects a LDAP database in /var/lib/ldap, which doesn't exist... I guess that you have "directory /var/lib/ldap" in your slapd.conf, then you should have a database associated... > > So, first, check your slapd.conf content. > > After that, test it through: > slaptest -f /etc/openldap/slapd.conf > > Once your slapd.conf is ok, you can convert it through: > slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d > Or (if OpenLDAP 2.4.23) through: > slaptest -f /usr/local/etc/openldap/slapd.conf -F /usr/local/etc/openldap/slapd.d > > Rgds, > Victor > > -----Original Message----- > From: openldap-technical-bounces(a)OpenLDAP.org [mailto:openldap-technical-bounces@OpenLDAP.org] On Behalf Of Götz Reinicke - IT-Koordinator > Sent: mercredi 8 décembre 2010 16:53 > To: openldap-technical(a)openldap.org > Subject: Drives me crazy .. openLDAP 2.4 - migrate config from 2.3 > > Hey, > > I recently started to get used to Red Hat Enterprise 6 with openldap 2.4 > and the main migration point is the 'new' config style. > > I removed my test-database (I have a ldif-backup) files and the default > config from my testsystem. > > I followed the RH guide [1], but now get an error with my testsystem > while lauching this command: > > slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d > > bdb_db_open: database "dc=filmakademie,dc=de": > db_open(/var/lib/ldap/id2entry.bdb) failed: No such file or directory (2). > > backend_startup_one (type=bdb, suffix="dc=filmakademie,dc=de"): > bi_db_open failed! (2) > > > > What may I have missed? Any suggestions? Thanks a lot for pointing me > into the right direction! > > /Götz > > > [1] > http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html-single/Mi… -- Götz Reinicke IT-Koordinator Tel. +49 7141 969 420 Fax +49 7141 969 55 420 E-Mail goetz.reinicke(a)filmakademie.de Filmakademie Baden-Württemberg GmbH Akademiehof 10 71638 Ludwigsburg www.filmakademie.de Eintragung Amtsgericht Stuttgart HRB 205016 Vorsitzende des Aufsichtsrats: Prof. Dr. Claudia Hübner Geschäftsführer: Prof. Thomas Schadt

1 1

Host Best Authentication
by Anton Chu 08 Dec '10

08 Dec '10

Anyone have a great solution on setting up host base filtering? I've tried the ldapns.schema and then setup pam using this site: https://help.ubuntu.com/community/LDAPClientAuthentication Ddin't work. Regards

1 0

Drives me crazy .. openLDAP 2.4 - migrate config from 2.3
by Götz Reinicke - IT-Koordinator 08 Dec '10

08 Dec '10

Hey, I recently started to get used to Red Hat Enterprise 6 with openldap 2.4 and the main migration point is the 'new' config style. I removed my test-database (I have a ldif-backup) files and the default config from my testsystem. I followed the RH guide [1], but now get an error with my testsystem while lauching this command: slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d bdb_db_open: database "dc=filmakademie,dc=de": db_open(/var/lib/ldap/id2entry.bdb) failed: No such file or directory (2). backend_startup_one (type=bdb, suffix="dc=filmakademie,dc=de"): bi_db_open failed! (2) What may I have missed? Any suggestions? Thanks a lot for pointing me into the right direction! /Götz [1] http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html-single/Mi… -- Götz Reinicke IT-Koordinator Tel. +49 7141 969 420 Fax +49 7141 969 55 420 E-Mail goetz.reinicke(a)filmakademie.de Filmakademie Baden-Württemberg GmbH Akademiehof 10 71638 Ludwigsburg www.filmakademie.de Eintragung Amtsgericht Stuttgart HRB 205016 Vorsitzende des Aufsichtsrats: Prof. Dr. Claudia Hübner Geschäftsführer: Prof. Thomas Schadt

1 0

how to compile recent openldap on Centos 5.5
by Götz Reinicke - IT-Koordinator 06 Dec '10

06 Dec '10

Hello, I tried to compile the Release 2.4.23 of openldap on my centos 5.5 server. It fails with: checking db.h usability... yes checking db.h presence... yes checking for db.h... yes checking for Berkeley DB major version in db.h... 4 checking for Berkeley DB minor version in db.h... 3 checking if Berkeley DB version supported by BDB/HDB backends... no configure: error: BerkeleyDB version incompatible with BDB/HDB backends I do have db4 installed: db4-4.3.29-10.el5_5.2 db4-devel-4.3.29-10.el5_5.2 db4-utils-4.3.29-10.el5_5.2 What may I do wrong? Any sugesstions? Thanks and regards . Götz -- Götz Reinicke IT-Koordinator Tel. +49 7141 969 420 Fax +49 7141 969 55 420 E-Mail goetz.reinicke(a)filmakademie.de Filmakademie Baden-Württemberg GmbH Akademiehof 10 71638 Ludwigsburg www.filmakademie.de Eintragung Amtsgericht Stuttgart HRB 205016 Vorsitzende des Aufsichtsrats: Prof. Dr. Claudia Hübner Geschäftsführer: Prof. Thomas Schadt

8 12

Re: Want interesting restrictions to ldap auth on different servers to different users
by c0re 06 Dec '10

06 Dec '10

2010/12/6 Dan White <dwhite(a)olp.net>: > On 06/12/10 15:34 +0300, c0re wrote: >> >> 2010/12/1 Dan White <dwhite(a)olp.net>: >> Thanks for example! >> >> But it still requires to edit clients.conf when adding device. And not >> restricts by groups. > > That's true, unless you have some of your clients coming from behind > one NAT address. I'm not aware of any way around that. > >> As per http://wiki.freeradius.org/Rlm_ldap I can use >> >> groupmembership_filter = >> >> "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" >> >> If there any other variables that can be used? I mean not only >> Ldap-userDn, but something like Ldap-clientIP, or Ldap-clientHostname >> or anything else to unique identify remote device. So I can use >> dynamic groups in OpenLdap and restrict access to device by group >> membership. > > As for the client IP, or other identifying information of the > authenticating device, I've always tried to use huntgroups to identify the > device rather than trying to perform a match in the LDAP filter, but that > approach might work just fine. > > Keep in mind that different types of devices will send more or less > information in its RADIUS request. Running freeradius in '-X' mode, and > sending a sample request will show you the information that you might be > able to match on. > > -- > Dan White > Thanks for tip about -X mode, will do it if get troubles. Found very interesting message in mailists here: http://lists.freeradius.org/pipermail/freeradius-users/2010-October/msg0005… Even more interesting - storing NAS secret in ldap! And using variable Packet-Src-IP-Address to differ source devices. Will try to get it work at this week.

1 0

help for tuning slapd
by Stéphane PURNELLE 06 Dec '10

06 Dec '10

Hi all, Sometimes my sladd process take more than 100% CPU and I don't know why. Searching on google I foud nsome tips about tunning but I don't understand some part of the article (set_cachesize chapter) ( http://www.openldap.org/doc/admin23/tuning.html) openldap 2.3.43 with BDB db-4.2.52 on Redhat Enterprise Linux 5.3 Some output : db_stat -d dn2id.bdb 53162 Btree magic number. 9 Btree version number. Flags: duplicates, little-endian 2 Minimum keys per-page. 4096 Underlying database page size. 2 Number of levels in the tree. 1588 Number of unique keys in the tree. 3159 Number of data items in the tree. 5 Number of tree internal pages. 19000 Number of bytes free in tree internal pages (7% ff). 51 Number of tree leaf pages. 113150 Number of bytes free in tree leaf pages (46% ff). 10 Number of tree duplicate pages. 18790 Number of bytes free in tree duplicate pages (54% ff). 0 Number of tree overflow pages. 0 Number of bytes free in tree overflow pages (0% ff). 0 Number of pages on the free list. db_stat -d id2entry.bdb 53162 Btree magic number. 9 Btree version number. Flags: little-endian 2 Minimum keys per-page. 16384 Underlying database page size. 2 Number of levels in the tree. 792 Number of unique keys in the tree. 792 Number of data items in the tree. 1 Number of tree internal pages. 13792 Number of bytes free in tree internal pages (16% ff). 117 Number of tree leaf pages. 717074 Number of bytes free in tree leaf pages (63% ff). 0 Number of tree duplicate pages. 0 Number of bytes free in tree duplicate pages (0% ff). 25 Number of tree overflow pages. 276539 Number of bytes free in tree overflow pages (32% ff). 4 Number of pages on the free list. anyone can help me for tuning mu openldap DB ? thanks Stéphane Purnelle ----------------------------------- Stéphane PURNELLE Admin. Systèmes et Réseaux Service Informatique Corman S.A. Tel : 00 32 (0)87/342467

1 0

ldap_result returns LDAP_TIMEOUT even after getting search response
by Shankar Anand R 06 Dec '10

06 Dec '10

Hi, I am seeing very slow responses while using ldap_search_ext() and ldap_result(). I have explained my application below. Kindly let me know if you see any problems/clues. I have written a simple application which reads a file and does LDAP search for all entities in the file. I am doing a simple bind with the LDAP server. I have 2 threads and 2 queues namely, LDAP Search queue and LDAP result queue. - Thread 1 reads all the entities from LDAP Search queue, sends out LDAP search requests for those entities and puts them into LDAP result queue. - Thread 2 reads all the entities from LDAP Result queue and checks for search results for those entities. These 2 threads do these tasks every 1 second. Since I don't want to overload the LDAP server I have programmed a constraint of a maximum of 20 outstanding LDAP searches that haven't got a result yet. Successful ldap_result() seems to be taking a long time. I keep getting LDAP_TIMEOUT errors. But i do get the result eventually without any retransmissions. But after a long time. When I capture the LDAP packets, the results seems to coming in pretty quick. But still ldap_result returns a LDAP_TIMEOUT error. Why should ldap_result() return a timeout in this case? Note that I am using LDAP_MSG_ONE in ldap_result. And I am using a timeout of 0 - I want to poll for the result and not actually block. I have turned OFF LDAP_OPT_REFERRALS on client side. (But still not able to figure out how to prevent Active Directory 2008 from sending out referrals). My test file contains 25 entities and I want to query the LDAP server for these 25 entities. This is a simplified form of my log: At 0 seconds: LDAP Search thread: 25 more LDAP searches pending. 0 LDAP Search waiting for results Sent out 20 LDAP Search Requests. Trigger to start LDAP Result thread after 1 second. 5 more LDAP searches pending. Wait for 1 second before sending these out. At 1 seconds: LDAP Result thread: 20 LDAP Search results pending. Got 1 LDAP results. 19 LDAP Search results still pending. Try again after 1 second. LDAP Search Thread: 5 more LDAP Searches pending. 19 LDAP Search waiting for results. Sent out 1 LDAP Search Requests. 4 more LDAP searches pending. Wait for 1 second before sending these out. At 2 seconds: LDAP Result thread: 20 LDAP Search results pending. Got 5 LDAP results. 15 LDAP Search results still pending. Try again after 1 second. LDAP Search Thread: 4 more LDAP Searches pending. 15 LDAP Search waiting for results. Sent out 4 LDAP Search Requests. 0 LDAP Search pending. Stopping LDAP Search thread. At 3 seconds: LDAP Result thread: 19 LDAP Search results pending. Got 4 LDAP results. 15 LDAP Search results still pending. Try again after 1 second. At 4 seconds: LDAP Result thread: 15 LDAP Search results pending. Got 4 LDAP results. 11 LDAP Search results still pending. Try again after 1 second. At 5 seconds: LDAP Result thread: 11 LDAP Search results pending. Got 3 LDAP results. 8 LDAP Search results still pending. Try again after 1 second. At 6 seconds: LDAP Result thread: 8 LDAP Search results pending. Got 2 LDAP results. 6 LDAP Search results still pending. Try again after 1 second. At 7 seconds: LDAP Result thread: 6 LDAP Search results pending. Got 1 LDAP results. 5 LDAP Search results still pending. Try again after 1 second. At 8 seconds: LDAP Result thread: 5 LDAP Search results pending. Got 2 LDAP results. 3 LDAP Search results still pending. Try again after 1 second. At 8 seconds: LDAP Result thread: 3 LDAP Search results pending. Got 1 LDAP results. 2 LDAP Search results still pending. Try again after 1 second. At 9 seconds: LDAP Result thread: 2 LDAP Search results pending. Got 0 LDAP results. 2 LDAP Search results still pending. Try again after 1 second. At 10 seconds: LDAP Result thread: 2 LDAP Search results pending. Got 1 LDAP results. 1 LDAP Search results still pending. Try again after 1 second. At 11 seconds: LDAP Result thread: 1 LDAP Search results pending. Got 0 LDAP results. 1 LDAP Search results still pending. Try again after 1 second. At 12 seconds: LDAP Result thread: 1 LDAP Search results pending. Got 1 LDAP results. 0 LDAP Search Results pending. Stopping LDAP Result thread. Any help/clues is much appreciated. Regards, Shankar

1 0

Re: Want interesting restrictions to ldap auth on different servers to different users
by c0re 06 Dec '10

06 Dec '10

2010/12/1 Dan White <dwhite(a)olp.net>: > On 01/12/10 18:27 +0300, c0re wrote: >> >> Can't understand about how to use nssov overlay in my case, but >> understood about dynamic groups overlay and it should fit to my needs. >> >> Also I've got freeradius that authenticate users by looking in ldap. >> Works good. But can't understand about how to restrict users to login >> to some devices. At that moment all users has access to all devices >> via radius. Same requests - this must be controlled via openldap. >> >> May be someone uses freeradius and has already made such restritions >> and can give me some tips. > > Here's one approach: > > Given a huntgroups file of: > > device1 NAS-IP-Address == 192.168.1.1 > cisco1 NAS-IP-Address == 192.168.1.2 > > and corresponding entries in your clients.conf, you can add something like > this in your users file: > > DEFAULT Huntgroup-Name == "device1", ldap-customattr-Ldap-Group == "device1" > Fall-Through = no > > DEFAULT Huntgroup-Name == "device1", Auth-Type := Reject > > DEFAULT Huntgroup-Name == "cisco1", ldap-customattr-Ldap-Group == > "cisco1/admin", User-Profile := "cn=ciscoadmin,ou=radius,dc=example,dc=net" > Fall-Through = no > > DEFAULT Huntgroup-Name == "cisco1", Auth-Type := Reject > > then create /etc/freeradius/modules/ldap-customattr with: > > ldap ldap-customattr { > > server = "ldap://ldap.example.net" > ldap_debug = 0x0028 > identity = "$dn" > password = $pass > ldap_connections_number = 5 > basedn = "dc=example,dc=net" > filter = "(uid=%u)" > start_tls = no > tls_mode = no > password_attribute = "userPassword" > groupname_attribute = "customattr" > groupmembership_filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" > groupmembership_attribute = "customattr" > > } > > Add 'ldap-customattr' inside the 'instantiate' section within > /etc/freeradius/radiusd.conf. > > Add this to your tree: > > dn: cn=ciscoadmin,ou=radius,dc=example,dc=net > objectClass: radiusObjectProfile > objectClass: radiusprofile > cn: ciscoadmin > radiusReplyItem: cisco-avpair = "shell:priv-lvl=15" > > > Then within your user entries, any user with: > > customattr: device1 > > will be authorized to authenticate to device1, and > > customattr: cisco1/admin > > will authenticate to cisco1, and will also drop directly into enable mode, > assuming the cisco device is configured to do so. > > -- > Dan White > Thanks for example! But it still requires to edit clients.conf when adding device. And not restricts by groups. As per http://wiki.freeradius.org/Rlm_ldap I can use groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" If there any other variables that can be used? I mean not only Ldap-userDn, but something like Ldap-clientIP, or Ldap-clientHostname or anything else to unique identify remote device. So I can use dynamic groups in OpenLdap and restrict access to device by group membership.

1 0

Multiple LDAP server IPs to ldap_init, server is busy and failover question.
by Jorgen Lundman 06 Dec '10

06 Dec '10

Solaris 10 x86 u8 openldap-2.4.23 db-4.8.30.NC dovecot-1.2.7 Can I have some clarification on how failover works when using OpenLDAP library as a client. If a piece of software is passing multiple space-separated hosts to ldap_init() (or initialize) calls, but receives "Server is busy" error during a search request, should the LDAP library not handle that for the caller automatically/transparently? Ie, switch to next working LDAP server, and perform the ldap_search. Or is it closer to that ldap_init will find the first working IP (the failover is early in the flow), but if an already started search later fails, it is up to the software to retry/reconnect? It only guarantees that the initial connection is valid. What is the general practise here? Thanks, Lund -- Jorgen Lundman | <lundman(a)lundman.net> Unix Administrator | +81 (0)3 -5456-2687 ext 1017 (work) Shibuya-ku, Tokyo | +81 (0)90-5578-8500 (cell) Japan | +81 (0)3 -3375-1767 (home)

1 0

OpenLDAP 2.4 authentication methods
by Josh Spranger 04 Dec '10

04 Dec '10

I have OpenLDAP version 2.4 installed on an OpenSUSE box. I am using it as an LDAP Proxy to Windows AD domain. It works perfectly using standard LDAP logon credentials (cn=user,DC=domain,DC=com). But I have some applications that use user(a)domain.com<mailto:user@domain.com> logon credentials. Is there a way to configure OpenLDAP to authenticate in this way? Slapd config file available on request. Thanks! Josh Spranger Sr. Network Engineer

2 3

Cannot ID LDAP User On LDAP Client
by Anton Chu 03 Dec '10

03 Dec '10

I've setup an Ubuntu 10.10 LDAP Client to authenticate off my LDAP server. I've install the following: sudo apt-get install libpam-ldap libnss-ldap nss-updatedb libnss-db nscd ldap-utils pam_ccreds Here's my /etc/nsswitch.conf: passwd: files ldap [NOTFOUND=return] db > > group: files ldap [NOTFOUND=return] db > > shadow: files ldap > > hosts: files dns > networks: files > > protocols: db files > services: db files > ethers: db files > rpc: db files > I can nss_updatedb ldap succssfully: # nss_updatedb ldap passwd... done. group... done. I can getent passwd, getent passwd shadow, getent group just fine and they all show all my ldap users. However, I cannot do an id ldapuser ex: $ id tony id: tony: No such user Here's my auth.log: Dec 1 21:08:17 webdev120 sshd[14765]: pam_unix(sshd:auth): check pass; user > unknown > Here's my syslog: sshd[14648]: Libgcrypt warning: missing initialization - please fix the > application > Here's my /etc/pam.d/commoun-auth: auth [success=4 default=ignore] pam_unix.so nullok_secure > auth [success=3 default=ignore] pam_ldap.so use_first_pass > auth [success=2 default=ignore] pam_ccreds.so minimum_uid=1000 > action=validate use_first_pass > auth [default=ignore] pam_ccreds.so minimum_uid=1000 action=update > # here's the fallback if no module succeeds > #auth requisite pam_deny.so > # prime the stack with a positive return value if there isn't one already; > # this avoids us returning an error just because nothing sets a success > code > # since the modules above will each just jump around > #auth required pam_permit.so > # and here are more per-package modules (the "Additional" block) > auth optional pam_ccreds.so minimum_uid=1000 action=store > # end of pam-auth-update config > Here's my /etc/pam.d/common-account: # here are the per-package modules (the "Primary" block) > account [success=2 new_authtok_reqd=done default=ignore] pam_unix.so > account [success=1 default=ignore] pam_ldap.so > # here's the fallback if no module succeeds > account requisite pam_deny.so > # prime the stack with a positive return value if there isn't one already; > # this avoids us returning an error just because nothing sets a success > code > # since the modules above will each just jump around > account required pam_permit.so > # and here are more per-package modules (the "Additional" block) > # end of pam-auth-update config > ID works just fine with my local users on my local machine so somehow it's not able to read the ldap users. Any insights appreciated.

3 7

last login time
by Nick Folino 03 Dec '10

03 Dec '10

I saw some old list traffic from 2005 about implementing last login time into the password policy. Was this idea scrapped? Nick

1 0

MemberOf out of sync on consumer[s]
by Yuri Bank 03 Dec '10

03 Dec '10

Hello, I've been putting this off for a while, but this is happening frequently enough that I think its time to ask for opinions on the bug I'm running into with OpenLDAP and the MemberOf overlay. Version: 2.4.23 Configuration: Single Provider, with 4 Consumers. It seems that when I add a new users on my provider, the MemberOf attribute disappears randomly for some users, on some ( not all ) consumer nodes. Everything in the DIT is in tact, and the changes made on my provider are replicated to the consumers correctly. The only issue here is with the memberof attribute. The only way for me to remedy this problem is to shutdown slapd on the affected consumer node, delete everything in /var/sun/slapd, and then start slapd again which then fully syncs with my provider with all memberof attributes in tact. My testing shows that this is triggered by making changes to to my LDAP groups/users on the provider node, but that is all I can find. Nothing in the logs gives me any clues as to what is happening. Has anyone experienced similar problems? Thanks, -Yuri

1 0

slap-hdb dirtyread
by CHIROSSEL, Olivier 03 Dec '10

03 Dec '10

Hi Someone kwon the status of this option ? "dirtyread Allow reads of modified but not yet committed data. Usually transactions are isolated to prevent other operations from accessing uncommitted data. This option may improve perforâ[m mance, but may also return inconsistent results if the data comes from a transaction that is later aborted. In this case, the modified data is discarded and a subsequent search will return a different result." For me this should be associate with the use of DB_READ_UNCOMMITTED flag .... Regards, Olivier

1 0

passwd fails
by Holger Schier 03 Dec '10

03 Dec '10

Hi guys, my ldapserver works fine now, but the first users are arriving. The normal user should change their own password. So, everyone thinks of passwd in the shell. But: LDAP password information update failed: Insufficient access Must supply old password to be changed as well as new one Here is my ACL: olcAccess: {0} to attrs=pwdChangedTime,pwdAccountLockedTime,pwdFailureTime,pwdH istory,pwdGraceUseTime,pwdReset by * none olcAccess: {1}to attrs=userPassword by self write by * auth olcAccess: {2}to attrs=shadowLastChange by self write by dn.base="cn=BINDUSER,dc=MY,dc=DC" read by users read by * auth olcAccess: {3}to attrs=userPKCS12 by self read by * none olcAccess: {4}to * by dn.base="cn=BINDUSER,dc=MY,dc=DC" read by * none I tried the same with olcAccess: {4}to * by * read and allowing anonymous binds, but same error. passwd seems to try to bind with the binduser and then to read and to write the userPassword, but only has auth access. Has anyone an idea how to enable this? Thanks a lot. Holger

3 2

memory leak when chasing referrals?
by Arthur de Jong 02 Dec '10

02 Dec '10

Hello list, I'm not 100% sure that this is a bug in OpenLDAP or in my code so I'll post here first. I run into a memory leak when running the code below on a server that contains referrals. The code itself is the minimal representation I could make that triggers the leak. The referral I used is something like: dn: ou=ref,ou=people,dc=test,dc=tld objectClass: referral objectClass: extensibleObject dc: subtree ref: ldap://otherserver/ou=morepeople,dc=test2,dc=tld ou: ref When I run the code through "valgrind --leak-check=full" I get: ==30395== 4,184 (80 direct, 4,104 indirect) bytes in 1 blocks are definitely lost in loss record 3 of 3 ==30395== at 0x402328F: calloc (vg_replace_malloc.c:467) ==30395== by 0x41D2CDF: ber_memcalloc_x (in /usr/lib/liblber-2.4.so.2.5.6) ==30395== by 0x40650A0: ldap_send_server_request (in /usr/lib/libldap_r-2.4.so.2.5.6) ==30395== by 0x4065EB1: ldap_chase_v3referrals (in /usr/lib/libldap_r-2.4.so.2.5.6) ==30395== by 0x40510A3: ldap_result (in /usr/lib/libldap_r-2.4.so.2.5.6) ==30395== by 0x8048871: main (test.c:28) Is there something wrong with my code (except for the complete lack of error handling that I stripped out to improve readability)? Should I free something in the LDAP_RES_SEARCH_REFERENCE case? Thanks. -----8<-- test.c --8<----- #include <stdio.h> #include <errno.h> #define LDAP_DEPRECATED 1 #include <ldap.h> int main(int argc,char *argv[]) { char *base="dc=test,dc=tld"; char *filter="(objectClass=posixAccount)"; char *attrs[] = { "uid", NULL }; int i; LDAP *ld; LDAPMessage *msg=NULL; int msgid; char **values; /* set up connection */ ldap_initialize(&ld,"ldap://localhost"); i=3; ldap_set_option(ld,LDAP_OPT_PROTOCOL_VERSION,&i); ldap_simple_bind_s(ld,NULL,NULL); /* start search and handle results */ ldap_search_ext(ld,base,LDAP_SCOPE_SUB,filter,attrs, 0,NULL,NULL,NULL,LDAP_NO_LIMIT,&msgid); while (1) { switch (ldap_result(ld,msgid,LDAP_MSG_ONE,NULL,&msg)) { case LDAP_RES_SEARCH_ENTRY: /* we have a normal search entry, print some attribute values */ values=ldap_get_values(ld,msg,attrs[0]); for (i=0;values[i]!=NULL;i++) fprintf(stderr,"%s=%s\n",attrs[0],values[i]); ldap_value_free(values); break; case LDAP_RES_SEARCH_RESULT: /* end of results */ ldap_msgfree(msg); ldap_unbind(ld); return 0; case LDAP_RES_SEARCH_REFERENCE: break; /* just ignore search references */ default: /* we have some error condition, bail out */ return -1; } ldap_msgfree(msg); } } -----8<-- test.c --8<----- -- -- arthur - arthur(a)arthurdejong.org - http://arthurdejong.org --

1 0

Readonly user for translucent proxy
by Christoph Berkemeier 02 Dec '10

02 Dec '10

Greetings, i am using an translucent proxy over here on Debian Lenny 64-bit in version 2.4.11-1+lenny2. The proxy is working fine when i am using the rootdn configured in my translucent proxy conf. But when i configure a readonly dn like below, i get only parts of my upstream server. The readonly is configured like this: access to * by dn="cn=admin,dc=hq,dc=example,dc=com" write by dn="uid=tlc,ou=user,dc=example,dc=com" read by * read With this config it should not even be necessary to configure an additional user, should it? The overlay is configured like this: overlay translucent translucent_local memberUid lastmod off uri ldaps://ldap.example.com acl-bind binddn="uid=tlc,ou=user,dc=example,dc=com" credentials="verysecret" Every authenticated dn uses the same binddn and credentials for the upstream ldap server ldap.example.com, right? Best Regards, Christoph Berkemeier

1 0

OpenLDAP on T2000
by Nick Folino 02 Dec '10

02 Dec '10

I'm evaluating OpenLDAP on various platforms and am having trouble getting the tools (slapadd, slapindex, etc) to perform well on Sun's T2000 servers. For example slapadd is running at about 50k/s. On an x86 server importing the same ldif yields over 1M/s. Using Berkeley DB 4.8 backend. I'm assuming the problem is related to CPU speed and threads. Can anyone give me some tips to increase the performance on this platform? Nick

4 3

Programmatically creating users
by Juan Pablo Romero Méndez 02 Dec '10

02 Dec '10

Hello, I'm trying to programmatically call useradd to create an ldap user on opensuse 11.2. The problem is that calling useradd -m --service ldap -D "cn=Administrator,dc=tkm,dc=com,dc=mx" testuser requests the ldap admin password in a way which I find difficult to handle programmatically. I thought that setting rootbinddn in /etc/ldap.conf and the password in /etc/ldap.secret would prevent useradd to ask the password but this is not the case. Is it possible to accomplish this? (i.e. configure useradd/passswd to not to ask passwords in the command line?) Regards, Juan Pablo

2 1

synrepl sends wrong rid cookie?
by Marc Patermann 02 Dec '10

02 Dec '10

Hi, on the provider server there are 3 databases glued together with one sync provider in the top level database: ... overlay glue overlay syncprov syncprov-checkpoint 100 10 syncprov-sessionlog 100 one consumer replicates two of the three database, each to a database, each database has its own synrepl statement with an own searchbase to get only the entries of this tree/database from the provider. Each database has its own rid: 401 and 402. When something changes in database 1 ou=humans, rid=401, the change is replicated. When something changes in database 2 ou=linux, rid=402, it is not. Only after a restart of the consumer changes apply. Now I saw this in the log: 1. change in ou=humans (rid=401) 2. change in ou=linux (rid=402) 3. change in ou=linux (rid=402) Dec 1 17:53:15 tfas099 slapd[12318]: do_syncrep2: rid=402 LDAP_RES_INTERMEDIATE - NEW_COOKIE Dec 1 17:53:15 tfas099 slapd[12318]: do_syncrep2: rid=402 NEW_COOKIE: rid=402,csn=20101201165315.347441Z#000000#000#000000 Dec 1 17:53:15 tfas099 slapd[12318]: do_syncrep2: rid=401 cookie=rid=401,csn=20101201165315.347441Z#000000#000#000000 Dec 1 17:53:15 tfas099 slapd[12318]: syncrepl_entry: rid=401 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_MODIFY) Dec 1 17:53:15 tfas099 slapd[12318]: syncrepl_entry: rid=401 be_search (0) Dec 1 17:53:15 tfas099 slapd[12318]: syncrepl_entry: rid=401 employeeNumber=0,ou=humans,ou=foo Dec 1 17:53:15 tfas099 slapd[12318]: syncrepl_entry: rid=401 be_modify employeeNumber=0,ou=humans,ou=foo (0) ... Dec 1 17:53:28 tfas099 slapd[12318]: do_syncrep2: rid=401 LDAP_RES_INTERMEDIATE - NEW_COOKIE Dec 1 17:53:28 tfas099 slapd[12318]: do_syncrep2: rid=401 NEW_COOKIE: rid=401,csn=20101201165328.955051Z#000000#000#000000 ... Dec 1 17:53:42 tfas099 slapd[12318]: do_syncrep2: rid=401 LDAP_RES_INTERMEDIATE - NEW_COOKIE Dec 1 17:53:42 tfas099 slapd[12318]: do_syncrep2: rid=401 NEW_COOKIE: rid=401,csn=20101201165342.175128Z#000000#000#000000 As you can see, on all three changes rid=401 is mentioned, never rid=402. When I restart, I can see this: Dec 1 18:06:35 tfas099 slapd[15676]: do_syncrep2: rid=401 LDAP_RES_INTERMEDIATE - REFRESH_DELETE Dec 1 18:06:35 tfas099 slapd[15676]: syncrepl_entry: rid=402 LDAP_RES_SEARCH_ENTRY(LDAP_SYNC_ADD) Dec 1 18:06:35 tfas099 slapd[15676]: syncrepl_entry: rid=402 inserted UUID 9cd2cfc4-9005-102f-9517-d54a6b53d2d0 Dec 1 18:06:35 tfas099 slapd[15676]: syncrepl_entry: rid=402 be_search (0) Dec 1 18:06:35 tfas099 slapd[15676]: syncrepl_entry: rid=402 ou=accounts,ou=linux,ou=steuer,o=landesverwaltung niedersachsen,c=de Dec 1 18:06:35 tfas099 slapd[15676]: syncrepl_entry: rid=402 be_modify ou=accounts,ou=linux,ou=steuer,o=landesverwaltung niedersachsen,c=de (0) Dec 1 18:06:35 tfas099 slapd[15676]: do_syncrep2: rid=402 LDAP_RES_INTERMEDIATE - REFRESH_DELETE Dec 1 18:06:35 tfas099 slapd[15676]: do_syncrep2: rid=402 cookie=rid=402,csn=20101201165342.175128Z#000000#000#000000 I get the rid=402 changes! Is this a configuration error on my side? Provider is 2.4.23, consumer is 2.4.20. Marc

2 2

Rebuild openldap so all modules/overlays are separate
by Chris Jacobs 02 Dec '10

02 Dec '10

Main question: how to build openldap with all overlays as dynamically loaded modules (ie: optional). Why? These problems have been covered before, recently even. I'm trying to get Solaris 9/10 clients talking to openldap server. I can do getent passwd <user> but getent passwd or getent group or even ldaplist all fail. I haven't had any success with Benjamin's acl fix/work around, or configuring the overlay for sssvlv in slapd.conf. So, I thought I'd recompile openldap - without sssvlv support, but then I thought why have to do this again in the future if I find another incompatibility? I'd prefer to simply have all overlays/modules as separate loadable modules. When I compiled OpenLDAP, I configured it with: ./configure --with-tls=openssl \ --enable-crypt \ --enable-dynamic \ --enable-ldap \ --enable-lmpasswd \ --enable-modules \ --enable-overlays \ --enable-spasswd \ --sysconfdir=/etc The enable-overlays option builds in a number of overlays I use and am interested in using in the future - however, it also enables sss/vlv. I supposed I could try to build it again with that option followed by --disable-sssvlv but what I'd really prefer is a way to build openldap with the overlays as separate modules that I can load/unload when/as I need them. I've searched the documentation, but I can't figure out how. It's quite likely I haven't looked in the right spot. I'm currently trying to make my way through the configure script... Blech. Thanks for any pointers, - chris Chris Jacobs, Systems Administrator, Information Technology & Operations Apollo Group | Apollo Marketing | Aptimus, Inc. 2001 6th Ave | Ste 3200 | Seattle, WA 98121 phone: 206.839-8245 | cell: 206.601.3256 | Fax: 208.441.9661 email: chris.jacobs(a)apollogrp.edu This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.

4 4

Re: Want interesting restrictions to ldap auth on different servers to different users
by c0re 01 Dec '10

01 Dec '10

2010/11/19 Phuong Marie VUONG <mangocphung(a)gmail.com>: > Hello, > > First, im sorry about my English. I share here my experience which worked > for limit acces host/group of host for user... > > In the configuration of ldap client /etc/ldap.conf , i have activate the > host attribute and a filter in nss_base_passwd > pam_check_host_attr yes > nss_base_passwd > ou=People,dc=xxxxx,dc=xxxx?one?|(host=hostname.domain)(host=PatternofHostGroup)(host=*) > > In the user entry, add the host attribute > And in the host set, you can put the pattern value correpond of the level > that you want to authorize to connect , for exe : > hostname.domain > or > PatternofHostGroup > or > * > > Hope that can help > > > 2010/11/19 c0re <nr1c0re(a)gmail.com> >> >> can you give an example of usage pam_check_host_attr? >> >> And how can I use group of hosts and assign user to this group to >> permit access user to this group avoiding enumerating hosts in users >> dn each time I add new user? >> >> What should I set in "host:"? Hostname of server? How host attr are >> sent to pam_ldap? >> >> 2010/11/18 Aaron Richton <richton(a)nbcs.rutgers.edu>: >> > On Thu, 18 Nov 2010, c0re wrote: >> > >> >> I mean user user1 can must login only on server1,server2 and server3. >> >> And user2 can login only on server5 and server2. >> > >> > You could probably overload almost anything (dyngroups, OpenLDAP ACLs, >> > search filters, who knows) to accomplish this, but the cleanest way to >> > do >> > this in pam_ldap would utilize pam_check_host_attr. I assume pam_ldap >> > because you mentioned "pam_groupdn" which is not an OpenLDAP >> > configuration >> > directive. >> > > > > > -- > Milan&Phuong > 06.17.34.09.77 > 09.53.57.04.94 > http://www.phuong.fr/photos/ > > > I moved a bit different way. I used pam_groupdn in ldap.conf and created a group for each server. Now if I add user to ldap, I need to add to groups "memberUid: `userdn`". And user will be able to login to those servers in which groups is user as a member. But if I got 100-200 servers and want to give access to new user to all this servers, I should add user to all groups. Of course it's a waste of time and it's possible to be done via some external shell/perl script, but may be there another way in openldap? pam_check_host_attr do almost same. If I add user - I need to add all hosts to user attr "host:". So it's same work I think.

2 2

ssf settings on server restart
by Christian Bösch 01 Dec '10

01 Dec '10

hi, i have an acl set to allow only some ips to connect unencrypted: {0}to dn.children="dc=abc,dc=net" by peername.ip=10.10.40.100 read break by peername.ip=10.10.8.49 read break by ssf=128 read break by * none olcSecurity: ssf=0 tls=0 simple_bind=0 update_ssf=0 this works in general, but if i restart slapd i get from the defined ips from above 'confidentially required'. then i have to set ssf=1 then back to ssf=0 to make it work again? anyone an idea why? /thx.chris

2 6

ACL based on superior entry
by Michael Ströder 01 Dec '10

01 Dec '10

HI! Is it possible to grant access in an ACL by a certain attribute value of the superior entry? I'd like to be able to disable bind for users based on a status flag in the container entry under which all user entries reside. Ciao, Michael.

2 2

RE: ldap crashing once under load
by Francis, Steve (IHG) 01 Dec '10

01 Dec '10

I see this in the config via : ldapsearch -Y external -H ldapi:/// -b cn=config olcRootDN: cn=Admin,o=SAH olcRootPW: {SSHA}VIYAj8/mu1iPhyrClvWqRUKJFrhZRFdKSQ== olcDbCacheSize: 10000 olcDbCheckpoint: 1024 5 olcDbConfig: {0}set_cachesize 0 15000000 1 olcDbConfig: {1}set_lg_regionmax 262144 olcDbConfig: {2}set_lg_bsize 2097152 olcDbConfig: {3}set_flags DB_LOG_AUTOREMOVE olcDbIDLcacheSize: 30000 Do these need to be adjusted? Thanks, Steve Francis Technical Advisor - zSeries, zLinux, z/OS IHG Alpharetta Data Center Ph: 770-442-7157 Cell: 770-906-3122 IM: francisihg "Life's tough...It's even tougher if you're stupid!!" John Wayne ________________________________ From: Francis, Steve (IHG) Sent: Wednesday, December 01, 2010 12:57 AM To: openldap-technical(a)openldap.org Subject: ldap crashing once under load hello, I just recently migrated an exsiting app that uses an LDAP server on z/OS with no issues, to a SLES 11.1 server on a z10 processor using OpenLdap, and get the following error. Nov 30 23:15:50 adczlnxldapp1 slapd[15854]: slapd starting Nov 30 23:25:39 adczlnxldapp1 slapd[15854]: ch_malloc of 16777216 bytes failed I have at least 1gb memory assigned to the linux instance. Is there something I can do to correct this. I have temporarily pointed the app to use the z/OS LDAP server and all is fine....Our intent is to completely move this to zLinux and get off the z/OS LDAP server. Steve Francis Technical Advisor - zSeries, zLinux, z/OS IHG Alpharetta Data Center Ph: 770-442-7157 Cell: 770-906-3122 IM: francisihg "Life's tough...It's even tougher if you're stupid!!" John Wayne

1 0

ldap crashing once under load
by Francis, Steve (IHG) 01 Dec '10

01 Dec '10

hello, I just recently migrated an exsiting app that uses an LDAP server on z/OS with no issues, to a SLES 11.1 server on a z10 processor using OpenLdap, and get the following error. Nov 30 23:15:50 adczlnxldapp1 slapd[15854]: slapd starting Nov 30 23:25:39 adczlnxldapp1 slapd[15854]: ch_malloc of 16777216 bytes failed I have at least 1gb memory assigned to the linux instance. Is there something I can do to correct this. I have temporarily pointed the app to use the z/OS LDAP server and all is fine....Our intent is to completely move this to zLinux and get off the z/OS LDAP server. Steve Francis Technical Advisor - zSeries, zLinux, z/OS IHG Alpharetta Data Center Ph: 770-442-7157 Cell: 770-906-3122 IM: francisihg "Life's tough...It's even tougher if you're stupid!!" John Wayne

1 0

syncrepl with accesslog not replicating
by Dieter Klünter 30 Nov '10

30 Nov '10

Hi, I am facing a problem with OpenLDAP-2.4.23. That is I am trying to setup a delta replication based on accesslog. Although the accesslog database contains new entries and the log database is successfully read, no replication ever takes place, while a setup without accesslog replicates successfully. An excerpt from the systemlogs: slapd[19170]: conn=1050 fd=20 ACCEPT from IP=192.168.0.8:41487 (IP=0.0.0.0:389) slapd[19170]: conn=1050 op=0 EXT oid=1.3.6.1.4.1.1466.20037 slapd[19170]: conn=1050 op=0 STARTTLS slapd[19170]: conn=1050 op=0 RESULT oid= err=0 text= slapd[19170]: conn=1050 fd=20 TLS established tls_ssf=256 ssf=256 slapd[19170]: conn=1050 op=1 BIND dn="" method=163 slapd[19170]: conn=1050 op=1 BIND authcid="cn=replicator,o=avci,c=de" authzid="cn=replicator,o=avci,c=de" slapd[19170]: conn=1050 op=1 BIND dn="cn=replicator,o=avci,c=de" mech=EXTERNAL sasl_ssf=0 ssf=256 slapd[19170]: conn=1050 op=1 RESULT tag=97 err=0 text= slapd[19170]: conn=1050 op=2 SRCH base="cn=log" scope=2 deref=0 filter="(&(objectClass=auditWriteObject)(reqResult=0))" slapd[19170]: conn=1050 op=2 SRCH attr=reqDN reqType reqMod reqNewRDN reqDeleteOldRDN reqNewSuperior entryCSN slapd[19170]: conn=1050 op=2 SEARCH RESULT tag=101 err=0 nentries=7 text= slapd[19170]: conn=1050 op=3 UNBIND slapd[19170]: conn=1050 fd=20 closed A ldapsearch -Y EXTERNAL -ZZ -H ldap://localhost -b cn=log -s one "(&(objectClass=auditWriteObject)(reqResult=0))" provides the expected results, an example # 20101129144212.000003Z, log dn: reqStart=20101129144212.000003Z,cn=log objectClass: auditModify reqStart: 20101129144212.000003Z reqEnd: 20101129144212.000004Z reqType: modify reqSession: 1007 reqAuthzID: cn=admanager,o=avci,c=de reqControls: {0}{2.16.840.1.113730.3.4.18 controlValue "646O3K636O3N61646N616O 616765722M6P3N617663692M633N6465"} reqDN:: Y249U2Now6RmZXIgV29sZmdhbmcsb3U9YWRyZXNzYnVjaCxvPWF2Y2ksYz1kZQ== reqResult: 0 reqMod: sn:- Wolfgang reqMod: sn:+ Schaefer reqMod: entryCSN:= 20101129144212.353910Z#000000#000#000000 reqMod: modifiersName:= cn=admanager,o=avci,c=de reqMod: modifyTimestamp:= 20101129144212Z The relevant config files can be found here: Provider slapd.conf: http://pastebin.de/12273 Consumer slapd.conf: http://pastebin.de/12275 -Dieter -- Dieter Kl�nter | Systemberatung sip: 7770535(a)sipgate.de http://www.dpunkt.de/buecher/2104.html GPG Key ID:8EF7B6C6

3 11

slapcat segfaults when ppolicy overlay added
by Ryan Steele 30 Nov '10

30 Nov '10

I've been trying, unsuccessfully, to set up ppolicy in my installation (2.4.21 on Ubuntu). As soon as I set up the overlay (before I even configure a user with a password policy or set up a default policy), slapcatting the database results in a segmentation fault. I tried it on 2.4.23 and 2.4.17 with the same results. Here is the configuration I'm using, and a backtrace from the 2.4.21 installation: dn: cn=module{0} objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib/ldap olcModuleLoad: {0}back_hdb.la olcModuleLoad: {1}autogroup.la olcModuleLoad: {2}syncprov.la olcModuleLoad: {3}smbk5pwd.la olcModuleLoad: {4}ppolicy.la dn: olcOverlay={3}ppolicy objectClass: olcOverlayConfig objectClass: olcPPolicyConfig olcOverlay: {3}ppolicy olcPPolicyHashCleartext: FALSE olcPPolicyUseLockout: TRUE olcPPolicyForwardUpdates: FALSE structuralObjectClass: olcPPolicyConfig (gdb) run Starting program: /usr/sbin/slapcat -n1 [Thread debugging using libthread_db enabled] Program received signal SIGSEGV, Segmentation fault. 0x00007ffff242d840 in ppolicy_restrict (op=0x7fffffffd710, rs=0x7fffffffd670) at /usr/src/openldap/openldap-2.4.21/servers/slapd/overlays/ppolicy.c:1271 1271 /usr/src/openldap/openldap-2.4.21/servers/slapd/overlays/ppolicy.c: No such file or directory. in /usr/src/openldap/openldap-2.4.21/servers/slapd/overlays/ppolicy.c (gdb) backtrace #0 0x00007ffff242d840 in ppolicy_restrict (op=0x7fffffffd710, rs=0x7fffffffd670) at /usr/src/openldap/openldap-2.4.21/servers/slapd/overlays/ppolicy.c:1271 #1 0x00007ffff7f6ed3a in overlay_op_walk (op=0x7fffffffd710, rs=0x7fffffffd670, which=<value optimized out>, oi=0x7ffff8320fc0, on=0x7ffff8340d50) at /usr/src/openldap/openldap-2.4.21/servers/slapd/backover.c:659 #2 0x00007ffff7f6f8ab in over_op_func (op=0x7fffffffd710, rs=0xfffffffffffffff0, which=4294957776) at /usr/src/openldap/openldap-2.4.21/servers/slapd/backover.c:721 #3 0x00007ffff2a4b141 in autogroup_db_open (be=<value optimized out>, cr=<value optimized out>) at autogroup.c:1754 #4 0x00007ffff7f6e994 in over_db_open (be=<value optimized out>, cr=0x7fffffffdfc0) at /usr/src/openldap/openldap-2.4.21/servers/slapd/backover.c:155 #5 0x00007ffff7f1388c in backend_startup_one (be=0x7ffff8314e80, cr=0x7fffffffdfc0) at /usr/src/openldap/openldap-2.4.21/servers/slapd/backend.c:224 #6 0x00007ffff7f13a83 in backend_startup (be=0x7ffff8314e80) at /usr/src/openldap/openldap-2.4.21/servers/slapd/backend.c:278 #7 0x00007ffff7f742cc in slap_tool_init (progname=<value optimized out>, tool=2, argc=2, argv=0x7fffffffe5b8) at /usr/src/openldap/openldap-2.4.21/servers/slapd/slapcommon.c:780 #8 0x00007ffff7f7335a in slapcat (argc=-9520, argv=<value optimized out>) at /usr/src/openldap/openldap-2.4.21/servers/slapd/slapcat.c:51 #9 0x00007ffff7ee84f5 in main (argc=2, argv=0x7fffffffe5b8) at /usr/src/openldap/openldap-2.4.21/servers/slapd/main.c:657 As soon as I remove olcOverlay={3}ppolicy from the backend database, the problem disappears. The configuration isn't anything special so I don't think it's a misconfiguration issue, but I figured I'd get a second opinion from the list before submitting this issue as a bug to the ITS. As always, all advice and input is appreciated. -Ryan

2 3

cn=config and authz-regexp
by Julien Vehent 30 Nov '10

30 Nov '10

Hi list, I'm moving a LDAP directory on a freshly installed Debian Squeeze and I'm discovering cn=config. On my former installation, I have SASL configured using : --- authz-regexp "^uid=([^,]+).*,cn=[^,]*,cn=auth$" "ldap:///dc=domain,dc=net??sub?(uid=$1)" authz-policy to password-hash {CLEARTEXT} --- How do I translate this into cn=config directives ? I believe it should be stored into /etc/ldap/slapd.d/cn=config/olcDatabase\=\{1\}hdb.ldif is that correct ? Thanks, Julien

2 2

RE: Problems Enabling Authentication using Cyrus SASL
by Fernando Torrez 30 Nov '10

30 Nov '10

Hi all I got work sasl authentication to access ldap server by correcting two things: 1.- inserting the proxyuser's userpassword in clear text (userPassord=secret) 2.- fixing the proxyuser's authzTo atributte to authzTo: ldap:///ou=people,dc=plainjoe,dc=org??sub?(objectClass=account) (results at the end of this mail) As far as it can be seen, there's no need for cyrus-sasl for these matter but my final purpose is to enable Cyrus-sasl with openldap as backend to authenticate users for cyrus-imapd and postfix services. Any hints would be appreciated. Thanks to all for your support Fernando firewall:~ # ldapwhoami -U proxyuser -X u:test -Y digest-md5 SASL/DIGEST-MD5 authentication started Please enter your password: SASL username: u:test SASL SSF: 128 SASL data security layer installed. dn:uid=test,ou=people,dc=plainjoe,dc=org firewall:~ # ldapsearch -Y digest-md5 -U proxyuser -b 'dc=plainjoe,dc=org' '(objectclass=*)' SASL/DIGEST-MD5 authentication started Please enter your password: SASL username: proxyuser SASL SSF: 128 SASL data security layer installed. # extended LDIF # # LDAPv3 # base <dc=plainjoe,dc=org> with scope subtree # filter: (objectclass=*)

3 4

Re: syncrepl with accesslog not replicating
by Quanah Gibson-Mount 29 Nov '10

29 Nov '10

--On Monday, November 29, 2010 10:46 PM +0100 Dieter Kluenter <dieter(a)dkluenter.de> wrote: > Quanah Gibson-Mount <quanah(a)zimbra.com> writes: > > OK, this is what I had, so going back to original configuration. You had scope specified, and the missing new line between the syncrepl and updateref clauses. Please keep this on the list. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

1 0

Let user's modify some LDAP entry ?
by Frank Bonnet 29 Nov '10

29 Nov '10

Hello I'm searching for some web based software to let users modify "some" data in our LDAP database after having been authenticated. Typically I would like to let them the possiblity to modify their loginShell , password , phone number ... etc Does such software exists ? Thank you

2 3

Using shell database
by krishan kumar 29 Nov '10

29 Nov '10

Hello, I have compiled openldap-2.4.23 from source. Recently I am learning to use shell database so I try running searchexample.sh script file provided with the openldap sources. But I am not successful in doing so. I think script is not getting executed and I am not getting any search results. Search gives the following result-: #ldapsearch -x -D 'cn=Manager,dc=example,dc=com' -W -b 'dc=shell1,dc=com' '(uid=root)' Enter LDAP Password: # extended LDIF # # LDAPv3 # base <dc=shell1,dc=com> with scope subtree # filter: (uid=root) # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1 --------------------------------------------------------------------------- My slapd.conf section for shell database is as follows-: database shell suffix "dc=shell1,dc=com" search /usr/local/openldap-test/etc/openldap/searchexample.sh ---------------------------------------------------------------------------- When started slapd with -d 1 option, I am getting following debugging information upon executing above search example-: -------------------------------------------------------------------------------------------------------------- <output truncated>.. send_ldap_response: msgid=1 tag=97 err=0 ber_flush2: 14 bytes to sd 17connection_get(17): got connid=1002 connection_read(17): checking for input on id=1002 ber_get_next ber_get_next: tag 0x30 len 53 contents: op tag 0x63, time 1291033804 ber_get_next conn=1002 op=1 do_search ber_scanf fmt ({miiiib) ber: >>> dnPrettyNormal: <dc=shell1,dc=com> <<< dnPrettyNormal: <dc=shell1,dc=com>, <dc=shell1,dc=com> ber_scanf fmt ({mm}) ber: ber_scanf fmt ({M}}) ber: ==> limits_get: conn=1002 op=1 self="cn=manager,dc=example,dc=com" this="dc=shell1,dc=com" execv failed shell: fgets failed: Success (0) str2result () expecting "RESULT" send_ldap_result: conn=1002 op=1 p=3 send_ldap_response: msgid=2 tag=101 err=0 ber_flush2: 14 bytes to sd 17 connection_get(17): got connid=1002 connection_read(17): checking for input on id=1002 ber_get_next ber_get_next: tag 0x30 len 5 contents: op tag 0x42, time 1291033804 ber_get_next conn=1002 op=2 do_unbind connection_close: conn=1002 sd=17 ---------------------------------------------------------------------------------------------------------------------- Please help me to got shell database working. Thanks.

1 0

OpenLDAP runs OK, Mac Mail and Address book do not display entries.
by Toomas Vendelin 29 Nov '10

29 Nov '10

Hi, I have set up an OpenLDAP server on a CentOS 5.5 machine and uploaded test data from ldif file. Apache directory studio connects to server nicely from my Mac and displays the records. Apple Mail and address book also seem to connect OK, but no search results returned in Address Book, and e-mails are not auto-completed in Mail. At the same time, I successfully connect to other publicly accessible servers, so it is probably a fault in my LDIF data. What is it? Do I need to use some schema specific to Apple? As for now, only the default ones are used. My LDIF data (all characters are fictional): Code: dn: dc=minu,dc=biz dc: minu objectClass: dcObject objectClass: organization o: Vendelin & Barilko dn: ou=people,dc=minu,dc=biz ou: people objectClass: organizationalUnit dn: cn=Deniska Borilko, ou=people,dc=minu,dc=biz cn: Deniska Borilko objectClass: inetOrgPerson sn: Borilko mail: denis(a)somedomain.com My LDAP settings both in Mail and address book: Code: Search base: ou=people,dc=minu,dc=biz Scope: subtree Thanks in advance! Toomas

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical